arachni 1.1 → 1.2

data/components/checks/active/unvalidated_redirect.rb

@@ -12,7 +12,7 @@
 # header field to determine whether the attack was successful.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2.2
+# @version 0.2.3
 #
 # @see https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards
 class Arachni::Checks::UnvalidatedRedirect < Arachni::Check::Base
@@ -32,8 +32,17 @@ class Arachni::Checks::UnvalidatedRedirect < Arachni::Check::Base
         self.class.payload? url
     end
 
+    def self.options
+        @options ||= {
+            format: [ Format::STRAIGHT ],
+            submit: {
+                follow_location: false
+            }
+        }
+    end
+
     def run
-        audit( self.class.payloads, submit: { follow_location: false } ) do |response, element|
+        audit( self.class.payloads, self.class.options ) do |response, element|
             # If this was a sample/default value submission ignore it, we only
             # care about our payloads.
             next if !payload? element.seed
@@ -68,7 +77,7 @@ URL to determine whether the attack was successful.
 },
             elements:    ELEMENTS_WITH_INPUTS - [Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.2',
+            version:     '0.2.3',
 
             issue:       {
                 name:            %q{Unvalidated redirect},

data/components/checks/active/unvalidated_redirect_dom.rb

@@ -9,7 +9,7 @@
 # Unvalidated redirect DOM check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1
+# @version 0.1.1
 #
 # @see https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards
 class Arachni::Checks::UnvalidatedRedirectDOM < Arachni::Check::Base
@@ -56,7 +56,7 @@ Injects URLs and checks the browser URL to determine whether the attack was succ
 },
             elements:    DOM_ELEMENTS_WITH_INPUTS - [Element::LinkTemplate::DOM],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1',
+            version:     '0.1.1',
 
             issue:       {
                 name:            %q{Unvalidated DOM redirect},
@@ -81,7 +81,7 @@ to redirecting the client to the injected value.
                 },
                 tags:            %w(unvalidated redirect dom injection),
                 cwe:             819,
-                severity:        Severity::MEDIUM,
+                severity:        Severity::HIGH,
                 remedy_guidance: %q{
 The application should ensure that the supplied value for a redirect is permitted.
 This can be achieved by performing whitelisting on the parameter value.

data/components/checks/active/xss.rb

@@ -13,7 +13,7 @@
 # {BrowserCluster} for evaluation and {#trace_taint taint-tracing}.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.4.1
+# @version 0.4.4
 #
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
@@ -36,9 +36,9 @@ class Arachni::Checks::Xss < Arachni::Check::Base
             # Go for an error.
             "()\"&%1'-;#{tag}'",
 
-            # Break out of HTML comments.
-            "-->#{tag}<!--"
-        ]
+            # Break out of HTML comments and text areas.
+            "</textarea>-->#{tag}<!--<textarea>"
+        ].map{ |p| [p, Form.encode( p ) ]}.flatten.uniq
     end
 
     def self.options
@@ -67,6 +67,9 @@ class Arachni::Checks::Xss < Arachni::Check::Base
             return
         end
 
+        # No idea what was returned, but we can't work with it.
+        return if !response.to_page.has_script?
+
         with_browser_cluster do
             print_info 'Progressing to deferred browser evaluation of response.'
 
@@ -82,9 +85,19 @@ class Arachni::Checks::Xss < Arachni::Check::Base
     end
 
     def find_proof( resource )
-        proof = Nokogiri::HTML( resource.body ).css( self.class.tag_name )
-        return if proof.empty?
-        proof.to_s
+        proof_nodes = Nokogiri::HTML( resource.body ).css( self.class.tag_name )
+        return if proof_nodes.empty?
+
+        proof = nil
+        proof_nodes.each do |e|
+            # Text-areas have TEXT not nodes Nokogiri!
+            next if e.parent.name =='textarea'
+            proof = e.to_s
+        end
+
+        return if !proof
+
+        proof
     end
 
     def self.info
@@ -97,7 +110,7 @@ tainted responses to look for proof of vulnerability.
             elements:    [Element::Form, Element::Link, Element::Cookie,
                           Element::Header, Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.4.1',
+            version:     '0.4.4',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS)},
@@ -121,8 +134,8 @@ HTML element content.
                 references:  {
                     'ha.ckers' => 'http://ha.ckers.org/xss.html',
                     'Secunia'  => 'http://secunia.com/advisories/9716/',
-                    'WASC' => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
-                    'OWASP' => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
+                    'WASC'     => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
+                    'OWASP'    => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
                 },
                 tags:            %w(xss regexp injection script),
                 cwe:             79,

data/components/checks/active/xss_dom_inputs.rb

@@ -7,7 +7,7 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.1
+# @version 0.2
 class Arachni::Checks::XssDomInputs < Arachni::Check::Base
 
     INPUTS = Set.new([:input, :textarea])
@@ -23,38 +23,132 @@ class Arachni::Checks::XssDomInputs < Arachni::Check::Base
     end
 
     def run
-        # If the page doesn't contain any supported inputs don't bother.
-        return if !page.document ||
-            !INPUTS.find { |type| page.document.css( type.to_s ).any? }
+        return if !page.document
 
+        # Everything past this point requires inputs to be present.
+        return if !page.has_elements?( INPUTS.to_a )
+
+        # Fill in inputs and trigger their associated events.
+        trigger_inputs
+
+        return if !page.has_elements?( :button )
+
+        # Fill in inputs and hit buttons.
+        trigger_buttons
+    end
+
+    def trigger_inputs
         with_browser do |browser|
             browser.load( page ).each_element_with_events do |locator, events|
-                next if !INPUTS.include? locator.tag_name
-                events.each do |event, _|
+
+                locator_id = "#{page.url}:#{locator.css}"
+                next if !INPUTS.include?( locator.tag_name ) || audited?( locator_id )
+                audited locator_id
+
+                filter_events( locator.tag_name, events ).each do |event, _|
+
+                    print_status "Scheduling '#{event}' on '#{locator}'"
 
                     # Instead of working with the same browser we do it this way
                     # in order to distribute the workload via the browser cluster.
                     with_browser do |b|
-                        b.javascript.taint = self.tag
+                        print_status "Triggering '#{event}' on '#{locator}'"
+
+                        b.javascript.taint = self.tag_name
                         b.load page
 
                         transition = b.fire_event( locator, event, value: self.tag )
-                        next if !transition
+                        if !transition
+                            print_bad "Could not '#{event}' on '#{locator}'"
+                            next
+                        end
 
                         # Page may be out of scope, some sort of JS redirection.
-                        next if !(p = b.to_page)
+                        if !(p = b.to_page)
+                            print_bad "Could not capture page snapshot after '#{event}' on '#{locator}'"
+                        end
 
                         p.dom.transitions << transition
 
-                        check_and_log p
+                        check_and_log( p )
+
+                        print_status "Finished '#{event}' on '#{locator}'"
+                    end
+                end
+            end
+        end
+    end
+
+    def trigger_buttons
+        with_browser do |browser|
+            browser.load( page ).each_element_with_events do |locator, events|
+
+                locator_id = "#{page.url}:#{locator.css}"
+                next if locator.tag_name != :button || audited?( locator_id )
+                audited locator_id
+
+                events.each do |event, _|
+                    print_status "Scheduling '#{event}' on '#{locator}' after filling in inputs"
+
+                    with_browser do |b|
+                        print_status "Triggering '#{event}' on '#{locator}' after filling in inputs"
+
+                        b.javascript.taint = self.tag_name
+                        b.load page
+
+                        transitions = fill_in_inputs( b )
+                        if transitions.empty?
+                            print_bad "Could not fill in any inputs for '#{event}' on '#{locator}'"
+                            next
+                        end
+
+                        transition = b.fire_event( locator, event )
+                        if !transition
+                            print_bad "Could not '#{event}' on '#{locator}'"
+                            next
+                        end
+
+                        transitions << transition
+
+                        # Page may be out of scope, some sort of JS redirection.
+                        if !(p = b.to_page)
+                            print_bad "Could not capture page snapshot after '#{event}' on '#{locator}'"
+                        end
+
+                        transitions.each do |t|
+                            p.dom.transitions << t
+                        end
+
+                        check_and_log( p )
+
+                        print_status "Finished '#{event}' on '#{locator}' after filling in inputs"
                     end
                 end
             end
         end
     end
 
+    def fill_in_inputs( browser )
+        transitions = []
+
+        INPUTS.each do |tag|
+            browser.watir.send("#{tag}s").each do |locator|
+                print_status "Filling in '#{locator.opening_tag}'"
+
+                transitions << fill_in_input( browser, locator )
+            end
+        end
+
+        transitions.compact
+    end
+
+    def fill_in_input( browser, locator )
+        browser.fire_event( locator, :input, value: self.tag )
+    end
+
     def check_and_log( page )
         return if !(proof = find_proof( page ))
+
         log(
             vector: Element::GenericDOM.new(
                 url:        page.url,
@@ -66,11 +160,19 @@ class Arachni::Checks::XssDomInputs < Arachni::Check::Base
     end
 
     def find_proof( page )
+        return if !page.has_elements?( self.tag_name )
+
         proof = page.document.css( self.tag_name )
         return if proof.empty?
+
         proof.to_s
     end
 
+    def filter_events( element, events )
+        supported = Set.new( Arachni::Browser::Javascript.events_for( element ) )
+        events.reject { |name, _| !supported.include? ('on' + name.to_s.gsub( /^on/, '' )).to_sym }
+    end
+
     def self.info
         {
             name:        'DOM XSS via input field',
@@ -79,7 +181,7 @@ Injects an HTML element into page text fields, triggers their associated events
 and inspects the DOM for proof of vulnerability.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.1',
+            version:     '0.2',
             elements:    [Element::GenericDOM],
 
             issue:       {

data/components/checks/active/xxe.rb

@@ -7,7 +7,7 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1
+# @version 0.1.1
 class Arachni::Checks::Xxe < Arachni::Check::Base
 
     ENTITY = 'xxe_entity'
@@ -18,7 +18,7 @@ class Arachni::Checks::Xxe < Arachni::Check::Base
             regexp: {
                 unix: [
                     /DOCUMENT_ROOT.*HTTP_USER_AGENT/,
-                    /(root|mail):.+:\d+:\d+:.+:[0-9a-zA-Z\/]+/im
+                    /:.+:\d+:\d+:.+:[0-9a-zA-Z\/]+/im
                 ],
                 windows: [
                     /\[boot loader\].*\[operating systems\]/im,
@@ -74,7 +74,7 @@ processed based on the resulting HTTP response.
 },
             elements:    [Element::XML],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1',
+            version:     '0.1.1',
             platforms:   options[:regexp].keys,
 
             issue:       {

data/components/checks/passive/backdoors.rb

@@ -25,11 +25,12 @@ class Arachni::Checks::Backdoors < Arachni::Check::Base
 
     def self.info
         {
-            name:        'Backdoors',
-            description: %q{Tries to find common backdoors on the server.},
-            elements:    [Element::Server],
-            author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.2.3',
+            name:             'Backdoors',
+            description:      %q{Tries to find common backdoors on the server.},
+            elements:         [Element::Server],
+            author:           'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
+            version:          '0.2.4',
+            exempt_platforms: [ :ruby, :aspx_mvc, :django, :cakephp ],
 
             issue:       {
                 name:            %q{A backdoor file exists on the server},

data/components/checks/passive/backup_directories.rb

@@ -7,7 +7,6 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1
 class Arachni::Checks::BackupDirectories < Arachni::Check::Base
 
     def self.formats
@@ -35,11 +34,12 @@ class Arachni::Checks::BackupDirectories < Arachni::Check::Base
 
     def self.info
         {
-            name:        'Backup directories',
-            description: %q{Tries to find backed-up directories.},
-            elements:    [ Element::Server ],
-            author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1',
+            name:             'Backup directories',
+            description:      %q{Tries to find backed-up directories.},
+            elements:         [ Element::Server ],
+            author:           'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
+            version:          '0.1.1',
+            exempt_platforms: Arachni::Platform::Manager::FRAMEWORKS,
 
             issue:       {
                 name:            %q{Backup directory},

data/components/checks/passive/backup_files.rb

@@ -9,7 +9,6 @@
 # Backup file discovery check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.3
 class Arachni::Checks::BackupFiles < Arachni::Check::Base
 
     def self.formats
@@ -47,11 +46,12 @@ class Arachni::Checks::BackupFiles < Arachni::Check::Base
 
     def self.info
         {
-            name:        'Backup files',
-            description: %q{Tries to identify backup files.},
-            elements:    [ Element::Server ],
-            author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.3',
+            name:             'Backup files',
+            description:      %q{Tries to identify backup files.},
+            elements:         [ Element::Server ],
+            author:           'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
+            version:          '0.3.1',
+            exempt_platforms: Arachni::Platform::Manager::FRAMEWORKS,
 
             issue:       {
                 name:            %q{Backup file},

data/components/checks/passive/common_admin_interfaces.rb

@@ -0,0 +1,58 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+# Looks for common administration interfaces on the server.
+#
+# @author Brendan Coles <bcoles@gmail.com>
+# @author Tasos Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.1
+class Arachni::Checks::CommonAdminInterfaces < Arachni::Check::Base
+
+    def self.resources
+        @filenames ||= read_file( 'admin-panels.txt' )
+    end
+
+    def run
+        path = get_path( page.url )
+        return if audited?( path )
+
+        self.class.resources.each do |file|
+            log_remote_file_if_exists( path + file )
+        end
+
+        audited( path )
+    end
+
+    def self.info
+        {
+            name:        'Common administration interfaces',
+            description: %q{Tries to find common admin interfaces on the server.},
+            elements:    [ Element::Server ],
+            author:      [
+                'Brendan Coles <bcoles@gmail.com>',
+                'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>'
+            ],
+            version:     '0.1',
+            targets:     %w(Generic),
+            references: {
+                'Apache.org' => 'http://httpd.apache.org/docs/2.0/mod/mod_access.html',
+                'WASC'       => 'http://projects.webappsec.org/w/page/13246953/Predictable%20Resource%20Location'
+            },
+            issue: {
+                name:            %q{Common administration interface},
+                description:     %q{An administration interface was identified and should be reviewed.},
+                tags:            %w(common path file discovery),
+                severity:        Severity::LOW,
+                remedy_guidance: %q{
+Access to administration interfaces should be restricted to trusted IP addresses only.
+}
+            }
+        }
+    end
+
+end