arachni 1.1 → 1.2

data/components/checks/passive/xst.rb

@@ -33,7 +33,11 @@ class Arachni::Checks::Xst < Arachni::Check::Base
         http.trace( page.url ) do |response|
             next if response.code != 200 || response.body.to_s.empty?
 
-            log vector: Element::Server.new( response.url ), response: response
+            log(
+                vector:   Element::Server.new( response.url ),
+                response: response,
+                proof:    response.status_line
+            )
             print_ok 'TRACE is enabled.'
         end
     end
@@ -48,7 +52,7 @@ class Arachni::Checks::Xst < Arachni::Check::Base
             description: %q{Sends an HTTP TRACE request and checks if it succeeded.},
             elements:    [ Element::Server ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.6',
+            version:     '0.1.7',
 
             issue:       {
                 name:            %q{HTTP TRACE},

data/components/fingerprinters/frameworks/aspx_mvc.rb

@@ -0,0 +1,43 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni
+module Platform::Fingerprinters
+
+# Identifies ASP.NET MVC resources.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.1
+class ASPXMVC < Platform::Fingerprinter
+
+    ANTI_CSRF_NONCE = '__requestverificationtoken'
+    HEADER_FIELDS   = %w(x-aspnetmvc-version)
+
+    def run
+        # Naive but enough, I think.
+        if html? && page.body =~ /input.*#{ANTI_CSRF_NONCE}/i
+            return update_platforms
+        end
+
+        if (headers.keys & HEADER_FIELDS).any?
+            return update_platforms
+        end
+
+        if cookies.include?( ANTI_CSRF_NONCE )
+            update_platforms
+        end
+    end
+
+    def update_platforms
+        platforms << :asp << :aspx << :windows << :aspx_mvc
+    end
+
+end
+
+end
+end

data/components/fingerprinters/frameworks/cakephp.rb

@@ -0,0 +1,28 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni
+module Platform::Fingerprinters
+
+# Identifies CakePHP resources.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+#
+# @version 0.1
+class CakePHP < Platform::Fingerprinter
+
+    def run
+        if cookies.include?( 'cakephp' )
+            platforms << :php << :cakephp
+        end
+    end
+
+end
+
+end
+end

data/components/fingerprinters/frameworks/cherrypy.rb

@@ -0,0 +1,31 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni
+module Platform::Fingerprinters
+
+# Identifies CherryPy resources.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.1
+class CherryPy < Platform::Fingerprinter
+
+    def run
+        return if !server_or_powered_by_include?( 'cherrypy' )
+
+        update_platforms
+    end
+
+    def update_platforms
+        platforms << :python << :cherrypy
+    end
+
+end
+
+end
+end

data/components/fingerprinters/frameworks/django.rb

@@ -0,0 +1,33 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni
+module Platform::Fingerprinters
+
+# Identifies Django resources.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.1
+class Django < Platform::Fingerprinter
+
+    def run
+        return update_platforms if server_or_powered_by_include?( 'django' )
+
+        headers.keys.each do |header|
+            return update_platforms if header.start_with?( 'x-django')
+        end
+    end
+
+    def update_platforms
+        platforms << :python << :django
+    end
+
+end
+
+end
+end

data/components/fingerprinters/frameworks/jsf.rb

@@ -0,0 +1,30 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni
+module Platform::Fingerprinters
+
+# Identifies JSF resources.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+#
+# @version 0.1
+class JSF < Platform::Fingerprinter
+
+    def run
+        if server_or_powered_by_include?( 'jsf' ) ||
+            parameters.include?( 'javax.faces.token')
+
+            platforms << :java << :jsf
+        end
+    end
+
+end
+
+end
+end

data/components/fingerprinters/frameworks/rack.rb

@@ -9,21 +9,19 @@
 module Arachni
 module Platform::Fingerprinters
 
-#
 # Identifies Rack applications.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.1
-#
+# @version 0.1.2
 class Rack < Platform::Fingerprinter
 
     SESSIONID = 'rack.session'
-    ID        = 'mod_rack'
 
     def run
-        return if !cookies.include?( SESSIONID ) &&
-            !server_or_powered_by_include?( ID )
+        return if !powered_by.include?( 'mod_rack' ) &&
+            !headers.keys.find { |h| h.include? 'x-rack' } &&
+            !cookies.include?( SESSIONID )
+
         platforms << :ruby << :rack
     end
 

data/components/fingerprinters/frameworks/rails.rb

@@ -0,0 +1,43 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni
+module Platform::Fingerprinters
+
+# Identifies Rails resources.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.1.1
+class Rails < Platform::Fingerprinter
+
+    IDs = %w(rails)
+
+    def run
+        headers.keys.each do |header|
+            return update_platforms if header.start_with?( 'x-rails' )
+        end
+
+        IDs.each do |id|
+            next if !server_or_powered_by_include? id
+
+            return update_platforms
+        end
+
+        if cookies.include?( '_rails_admin_session' )
+            update_platforms
+        end
+    end
+
+    def update_platforms
+        platforms << :ruby << :rack << :rails
+    end
+
+end
+
+end
+end

data/components/fingerprinters/languages/aspx.rb

@@ -9,38 +9,38 @@
 module Arachni
 module Platform::Fingerprinters
 
-#
 # Identifies ASPX resources.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.1
-#
+# @version 0.1.1
 class ASPX < Platform::Fingerprinter
 
     EXTENSION       = 'aspx'
     SESSION_COOKIE  = 'asp.net_sessionid'
     X_POWERED_BY    = 'asp.net'
-    VIEWSTATE       = 'viewstate'
+    VIEWSTATE       = '__viewstate'
     HEADER_FIELDS   = %w(x-aspnet-version x-aspnetmvc-version)
 
     def run
         if extension == EXTENSION ||
             # Session ID in URL, like:
             #   http://blah.com/(S(yn5cby55lgzstcen0ng2b4iq))/stuff.aspx
-            uri.path =~ /\/\(s\([a-z0-9]+\)\)\//i ||
-            cookies.include?( SESSION_COOKIE )
+            uri.path =~ /\/\(s\([a-z0-9]+\)\)\//i
+
             return update_platforms
         end
 
-        page.forms.each do |form|
-            form.inputs.each do |k, v|
-                return update_platforms if k.downcase.include? VIEWSTATE
-            end
+        # Naive but enough, I think.
+        if html? && page.body =~ /input.*#{VIEWSTATE}/i
+            return update_platforms
         end
 
         if server_or_powered_by_include?( X_POWERED_BY ) ||
             (headers.keys & HEADER_FIELDS).any?
+            return update_platforms
+        end
+
+        if cookies.include?( SESSION_COOKIE )
             update_platforms
         end
     end

data/components/fingerprinters/languages/{jsp.rb → java.rb}

@@ -9,22 +9,26 @@
 module Arachni
 module Platform::Fingerprinters
 
-# Identifies JSP resources.
+# Identifies Java resources.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.1.1
-class JSP < Platform::Fingerprinter
+# @version 0.1.3
+class Java < Platform::Fingerprinter
 
     EXTENSION = 'jsp'
     SESSIONID = 'jsessionid'
 
     def run
         if extension == EXTENSION || parameters.include?( SESSIONID ) ||
-            cookies.include?( SESSIONID ) ||
+            server_or_powered_by_include?( 'java' ) ||
             server_or_powered_by_include?( 'servlet' ) ||
-            server_or_powered_by_include?( 'jsp' )
-            platforms << :jsp << :tomcat
+            server_or_powered_by_include?( 'jsp' ) ||
+            server_or_powered_by_include?( 'jboss' ) ||
+            server_or_powered_by_include?( 'glassfish' ) ||
+            server_or_powered_by_include?( 'oracle' ) ||
+            cookies.include?( SESSIONID )
+
+            platforms << :java
         end
     end
 

data/components/fingerprinters/languages/php.rb

@@ -9,13 +9,10 @@
 module Arachni
 module Platform::Fingerprinters
 
-#
 # Identifies PHP resources.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.1
-#
+# @version 0.1.1
 class PHP < Platform::Fingerprinter
 
     EXTENSION = /php\d*/  # In case it's php5 or something.
@@ -23,8 +20,11 @@ class PHP < Platform::Fingerprinter
 
     def run
         if uri.path =~ /.php\d*\/*/ || extension =~ EXTENSION ||
-            parameters.include?( SESSIONID ) || cookies.include?( SESSIONID ) ||
-            server_or_powered_by_include?( 'php' )
+            parameters.include?( SESSIONID ) ||
+            server_or_powered_by_include?( 'php' ) ||
+            headers.include?( 'x-php-pid' ) ||
+            cookies.include?( SESSIONID )
+
             platforms << :php
         end
     end

data/components/fingerprinters/languages/python.rb

@@ -9,21 +9,29 @@
 module Arachni
 module Platform::Fingerprinters
 
-#
 # Identifies Python resources.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.1
-#
+# @version 0.1.2
 class Python < Platform::Fingerprinter
 
+    IDS       = %w(python zope zserver wsgi plone)
     EXTENSION = 'py'
 
     def run
-        if extension == EXTENSION || powered_by.include?( 'python' )
-            platforms << :python
+        return update_platforms if extension == EXTENSION
+
+        IDS.each do |id|
+            return update_platforms if server_or_powered_by_include?( id )
         end
+
+        if cookies.include?( '_ZopeId' )
+            update_platforms
+        end
+    end
+
+    def update_platforms
+        platforms << :python
     end
 
 end

data/components/fingerprinters/languages/ruby.rb

@@ -9,21 +9,19 @@
 module Arachni
 module Platform::Fingerprinters
 
-#
 # Identifies Ruby resources.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
 # @version 0.1
-#
 class Ruby < Platform::Fingerprinter
 
-    IDs = %w(mod_rails mod_rack phusion passenger)
+    IDs = %w(mod_rack phusion passenger)
 
     def run
         IDs.each do |id|
-            next if !server_or_powered_by_include? id
-            return platforms << :ruby
+            next if !powered_by.include? id
+            return platforms << :ruby << :rack
         end
     end
 

data/components/fingerprinters/servers/apache.rb

@@ -9,17 +9,18 @@
 module Arachni
 module Platform::Fingerprinters
 
-#
 # Identifies Apache web servers.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
 # @version 0.1
-#
 class Apache < Platform::Fingerprinter
 
     def run
-        platforms << :apache if server_or_powered_by_include? 'apache'
+        if server_or_powered_by_include?( 'apache' ) &&
+            !server_or_powered_by_include?( 'coyote' )
+
+            platforms << :apache
+        end
     end
 
 end