arachni 1.1 → 1.2

data/spec/components/fingerprinters/os/linux_spec.rb

@@ -3,15 +3,18 @@ require 'spec_helper'
 describe Arachni::Platform::Fingerprinters::Linux do
     include_examples 'fingerprinter'
 
+    def platforms
+        [:linux]
+    end
+
     context 'when there is an Server header' do
         described_class::IDs.each do |id|
             context "and it contains #{id}" do
                 it 'identifies it as Linux' do
-                    page = Arachni::Page.from_data(
+                    check_platforms Arachni::Page.from_data(
                         url:     'http://stuff.com/blah',
                         response: { headers: { 'Server' => "Apache/2.2.21 (#{id})" } }
                     )
-                    platforms_for( page ).should include :linux
                 end
             end
         end
@@ -21,11 +24,10 @@ describe Arachni::Platform::Fingerprinters::Linux do
         described_class::IDs.each do |id|
             context "and it contains #{id}" do
                 it 'identifies it as Linux' do
-                    page = Arachni::Page.from_data(
+                    check_platforms Arachni::Page.from_data(
                         url:     'http://stuff.com/blah',
                         response: { headers: { 'X-Powered-By' => "Apache/2.2.21 (#{id})" } }
                     )
-                    platforms_for( page ).should include :linux
                 end
             end
         end

data/spec/components/fingerprinters/os/solaris_spec.rb

@@ -3,15 +3,18 @@ require 'spec_helper'
 describe Arachni::Platform::Fingerprinters::Solaris do
     include_examples 'fingerprinter'
 
+    def platforms
+        [:solaris]
+    end
+
     context 'when there is an Server header' do
         described_class::IDs.each do |id|
             context "and it contains #{id}" do
                 it 'identifies it as Solaris' do
-                    page = Arachni::Page.from_data(
+                    check_platforms Arachni::Page.from_data(
                         url:     'http://stuff.com/blah',
                         response: { headers: { 'Server' => "Apache/2.2.21 (#{id})" } }
                     )
-                    platforms_for( page ).should include :solaris
                 end
             end
         end
@@ -21,11 +24,10 @@ describe Arachni::Platform::Fingerprinters::Solaris do
         described_class::IDs.each do |id|
             context "and it contains #{id}" do
                 it 'identifies it as Solaris' do
-                    page = Arachni::Page.from_data(
+                    check_platforms Arachni::Page.from_data(
                         url:     'http://stuff.com/blah',
                         response: { headers: { 'X-Powered-By' => "Apache/2.2.21 (#{id})" } }
                     )
-                    platforms_for( page ).should include :solaris
                 end
             end
         end

data/spec/components/fingerprinters/os/unix_spec.rb

@@ -3,23 +3,25 @@ require 'spec_helper'
 describe Arachni::Platform::Fingerprinters::Unix do
     include_examples 'fingerprinter'
 
+    def platforms
+        [:unix]
+    end
+
     context 'when there is an Server header' do
         it 'identifies it as Unix' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'Server' => 'Apache/2.2.21 (Unix)' } }
             )
-            platforms_for( page ).should include :unix
         end
     end
 
     context 'when there is a X-Powered-By header' do
         it 'identifies it as Unix' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'X-Powered-By' => 'Stuf/0.4 (Unix)' } }
             )
-            platforms_for( page ).should include :unix
         end
     end
 

data/spec/components/fingerprinters/os/windows_spec.rb

@@ -3,15 +3,18 @@ require 'spec_helper'
 describe Arachni::Platform::Fingerprinters::Windows do
     include_examples 'fingerprinter'
 
+    def platforms
+        [:windows]
+    end
+
     context 'when there is an Server header' do
         described_class::IDs.each do |id|
             context "and it contains #{id}" do
                 it 'identifies it as Windows' do
-                    page = Arachni::Page.from_data(
+                    check_platforms Arachni::Page.from_data(
                         url:     'http://stuff.com/blah',
                         response: { headers: { 'Server' => "Apache/2.2.21 (#{id})" } }
                     )
-                    platforms_for( page ).should include :windows
                 end
             end
         end
@@ -21,11 +24,10 @@ describe Arachni::Platform::Fingerprinters::Windows do
         described_class::IDs.each do |id|
             context "and it contains #{id}" do
                 it 'identifies it as Windows' do
-                    page = Arachni::Page.from_data(
+                    check_platforms Arachni::Page.from_data(
                         url:     'http://stuff.com/blah',
                         response: { headers: { 'X-Powered-By' => "PHP/5.0 (#{id})" } }
                     )
-                    platforms_for( page ).should include :windows
                 end
             end
         end

data/spec/components/fingerprinters/servers/apache_spec.rb

@@ -3,23 +3,34 @@ require 'spec_helper'
 describe Arachni::Platform::Fingerprinters::Apache do
     include_examples 'fingerprinter'
 
+    def platforms
+        [:apache]
+    end
+
     context 'when there is an Server header' do
         it 'identifies it as Apache' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'Server' => 'Apache/2.2.21' } }
             )
-            platforms_for( page ).should include :apache
         end
     end
 
     context 'when there is a X-Powered-By header' do
         it 'identifies it as Apache' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'X-Powered-By' => 'Stuf/0.4 (Apache)' } }
             )
-            platforms_for( page ).should include :apache
+        end
+    end
+
+    context 'when there is an Server header that includes Coyote' do
+        it 'does not identify it as Apache' do
+            platforms_for( Arachni::Page.from_data(
+                url:     'http://stuff.com/blah',
+                response: { headers:  { 'Server' => 'Apache-Coyote/1.1' } }
+            )).to_a.should be_empty
         end
     end
 

data/spec/components/fingerprinters/servers/gunicorn_spec.rb

@@ -0,0 +1,28 @@
+require 'spec_helper'
+
+describe Arachni::Platform::Fingerprinters::Gunicorn do
+    include_examples 'fingerprinter'
+
+    def platforms
+        [:python, :gunicorn]
+    end
+
+    context 'when there is a Server header' do
+        it 'identifies it as Gunicorn' do
+            check_platforms Arachni::Page.from_data(
+                url: 'http://stuff.com/blah',
+                response: { headers: { 'Server' => 'gunicorn/18.0' } }
+            )
+        end
+    end
+
+    context 'when there are X-Gunicorn headers' do
+        it 'identifies it as Gunicorn' do
+            check_platforms Arachni::Page.from_data(
+                url: 'http://stuff.com/blah',
+                response: { headers: { 'X-Gunicorn-Stuff' => 'Blah' } }
+            )
+        end
+    end
+
+end

data/spec/components/fingerprinters/servers/iis_spec.rb

@@ -3,25 +3,25 @@ require 'spec_helper'
 describe Arachni::Platform::Fingerprinters::IIS do
     include_examples 'fingerprinter'
 
+    def platforms
+        [:iis, :windows]
+    end
+
     context 'when there is an Server header' do
         it 'identifies it as IIS' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'Server' => 'IIS/2.2.21' } }
             )
-            platforms_for( page ).should include :iis
-            platforms_for( page ).should include :windows
         end
     end
 
     context 'when there is a X-Powered-By header' do
         it 'identifies it as IIS' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'X-Powered-By' => 'Stuf/0.4 (IIS)' } }
             )
-            platforms_for( page ).should include :iis
-            platforms_for( page ).should include :windows
         end
     end
 

data/spec/components/fingerprinters/servers/jetty_spec.rb

@@ -3,25 +3,25 @@ require 'spec_helper'
 describe Arachni::Platform::Fingerprinters::Jetty do
     include_examples 'fingerprinter'
 
+    def platforms
+        [:jetty, :java]
+    end
+
     context 'when there is an Server header' do
         it 'identifies it as Jetty' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'Server' => 'Jetty/2.2.21' } }
             )
-            platforms_for( page ).should include :jetty
-            platforms_for( page ).should include :jsp
         end
     end
 
     context 'when there is a X-Powered-By header' do
         it 'identifies it as Jetty' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'X-Powered-By' => 'Stuff/0.4 (Jetty)' } }
             )
-            platforms_for( page ).should include :jetty
-            platforms_for( page ).should include :jsp
         end
     end
 

data/spec/components/fingerprinters/servers/nginx_spec.rb

@@ -3,23 +3,25 @@ require 'spec_helper'
 describe Arachni::Platform::Fingerprinters::Nginx do
     include_examples 'fingerprinter'
 
+    def platforms
+        [:nginx]
+    end
+
     context 'when there is an Server header' do
         it 'identifies it as Nginx' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'Server' => 'Nginx/2.2.21' } }
             )
-            platforms_for( page ).should include :nginx
         end
     end
 
     context 'when there is a X-Powered-By header' do
         it 'identifies it as Nginx' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'X-Powered-By' => 'Stuf/0.4 (Nginx)' } }
             )
-            platforms_for( page ).should include :nginx
         end
     end
 

data/spec/components/fingerprinters/servers/tomcat_spec.rb

@@ -3,25 +3,34 @@ require 'spec_helper'
 describe Arachni::Platform::Fingerprinters::Tomcat do
     include_examples 'fingerprinter'
 
+    def platforms
+        [:tomcat, :java]
+    end
+
     context 'when there is an Server header' do
         it 'identifies it as Tomcat' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'Server' => 'Tomcat/2.2.21' } }
             )
-            platforms_for( page ).should include :tomcat
-            platforms_for( page ).should include :jsp
         end
     end
 
     context 'when there is a X-Powered-By header' do
         it 'identifies it as Tomcat' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers: { 'X-Powered-By' => 'Stuf/0.4 (Tomcat)' } }
             )
-            platforms_for( page ).should include :tomcat
-            platforms_for( page ).should include :jsp
+        end
+    end
+
+    context 'when there is an Server header' do
+        it 'identifies it as Tomcat' do
+            check_platforms Arachni::Page.from_data(
+                url:     'http://stuff.com/blah',
+                response: { headers:  { 'Server' => 'Apache-Coyote/1.1' } }
+            )
         end
     end
 

data/spec/components/path_extractors/data_url_spec.rb

@@ -0,0 +1,19 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'path_extractor'
+
+    def results
+        [
+            'http://test.com',
+            'test',
+            'test.com'
+        ]
+    end
+
+    def text
+        results.map { |u| "<a data-url='#{u}'>Stuff</a>" }.join
+    end
+
+    easy_test
+end

data/spec/components/plugins/autologin_spec.rb

@@ -76,6 +76,29 @@ describe name_from_filename do
         end
     end
 
+    context 'when the form is not visible' do
+        before do
+            options.plugins[component_name] = {
+                'url'        => url + '/hidden_login',
+                'parameters' => 'username=john&password=doe',
+                'check'      => 'Hi there logged-in user'
+            }
+        end
+
+        it 'complains about not the form being invisible' do
+            run
+
+            actual_results['status'].should  == 'form_not_visible'
+            actual_results['message'].should == plugin::STATUSES[:form_not_visible]
+        end
+
+        it 'aborts the scan' do
+            run
+
+            framework.status.should == :aborted
+        end
+    end
+
     context 'when the verifier does not match' do
         before do
             options.plugins[component_name] = {

data/spec/components/plugins/login_script_spec.rb

@@ -14,6 +14,8 @@ describe name_from_filename do
         IO.write( script_path, script )
 
         options.plugins[component_name] = { 'script' => script_path }
+
+        framework.options.scope.dom_depth_limit = 1
     end
 
     after(:each) { FileUtils.rm_f script_path }
@@ -22,27 +24,84 @@ describe name_from_filename do
     let(:script_path) { "#{Dir.tmpdir}/login_script_#{Time.now.to_i}" }
 
     context 'when a browser' do
-        let(:script) do
-            <<EOSCRIPT
+        context 'is available' do
+            context 'when using a Ruby script' do
+                let(:script) do
+                    <<EOSCRIPT
                 framework.options.datastore.browser = browser
 EOSCRIPT
-        end
+                end
 
-        context 'is available' do
-            it "exposes a Watir::Browser interface via the 'browser' variable" do
-                run
+                it "exposes a Watir::Browser interface via the 'browser' variable" do
+                    run
 
-                options.datastore.browser.should be_kind_of Watir::Browser
+                    options.datastore.browser.should be_kind_of Watir::Browser
+                end
+            end
+
+            context 'when using a Javascript script' do
+                let(:script) do
+                    <<EOSCRIPT
+                document.cookie = 'mycookie=myvalue'
+EOSCRIPT
+                end
+                let(:script_path) { "#{super()}.js" }
+
+                it 'runs the code' do
+                    run
+
+                    framework.http.cookies.
+                        find { |c| c.name == 'mycookie' }.value.should == 'myvalue'
+                end
             end
         end
 
         context 'is not available' do
-            it "sets 'browser' to 'nil'" do
+            before do
                 framework.options.scope.dom_depth_limit = 0
-                run
+            end
+
+            context 'when using a Ruby script' do
+                let(:script) do
+                    <<EOSCRIPT
+                    framework.options.datastore.browser = browser
+EOSCRIPT
+                end
+
+                it "sets 'browser' to 'nil'" do
+                    run
 
-                options.datastore.browser.should be_nil
+                    options.datastore.browser.should be_nil
+                end
             end
+
+            context 'when using a Javascript script' do
+                let(:script) do
+                    <<EOSCRIPT
+                document.cookie = 'mycookie=myvalue'
+EOSCRIPT
+                end
+                let(:script_path) { "#{super()}.js" }
+
+                it 'sets the status' do
+                    run
+
+                    actual_results['status'].should  == 'missing_browser'
+                end
+
+                it 'sets the message' do
+                    run
+
+                    actual_results['message'].should == plugin::STATUSES[:missing_browser]
+                end
+
+                it 'aborts the scan' do
+                    run
+
+                    framework.status.should == :aborted
+                end
+            end
+
         end
     end
 
@@ -129,28 +188,57 @@ EOSCRIPT
     end
 
     context 'when there is a runtime error in the script' do
-        let(:script) do
-            <<EOSCRIPT
-                fail
+        context 'when using Ruby' do
+            let(:script) do
+                <<EOSCRIPT
+                    fail
 EOSCRIPT
-        end
+            end
 
-        it 'sets the status' do
-            run
+            it 'sets the status' do
+                run
 
-            actual_results['status'].should  == 'error'
-        end
+                actual_results['status'].should  == 'error'
+            end
 
-        it 'sets the message' do
-            run
+            it 'sets the message' do
+                run
+
+                actual_results['message'].should == plugin::STATUSES[:error]
+            end
 
-            actual_results['message'].should == plugin::STATUSES[:error]
+            it 'aborts the scan' do
+                run
+
+                framework.status.should == :aborted
+            end
         end
 
-        it 'aborts the scan' do
-            run
+        context 'when using Javascript' do
+            let(:script) do
+                <<EOSCRIPT
+                document.cookie = '
+EOSCRIPT
+            end
+            let(:script_path) { "#{super()}.js" }
 
-            framework.status.should == :aborted
+            it 'sets the status' do
+                run
+
+                actual_results['status'].should  == 'error'
+            end
+
+            it 'sets the message' do
+                run
+
+                actual_results['message'].should == plugin::STATUSES[:error]
+            end
+
+            it 'aborts the scan' do
+                run
+
+                framework.status.should == :aborted
+            end
         end
     end