arachni 1.1 → 1.2

data/components/fingerprinters/servers/gunicorn.rb

@@ -0,0 +1,33 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni
+module Platform::Fingerprinters
+
+# Identifies Gunicorn resources.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.1
+class Gunicorn < Platform::Fingerprinter
+
+    def run
+        return update_platforms if server_or_powered_by_include?( 'gunicorn' )
+
+        headers.keys.each do |header|
+            return update_platforms if header.start_with?( 'x-gunicorn')
+        end
+    end
+
+    def update_platforms
+        platforms << :python << :gunicorn
+    end
+
+end
+
+end
+end

data/components/fingerprinters/servers/jetty.rb

@@ -19,7 +19,7 @@ module Platform::Fingerprinters
 class Jetty < Platform::Fingerprinter
 
     def run
-        platforms << :jsp << :jetty if server_or_powered_by_include? 'jetty'
+        platforms << :java << :jetty if server_or_powered_by_include? 'jetty'
     end
 
 end

data/components/fingerprinters/servers/tomcat.rb

@@ -9,17 +9,24 @@
 module Arachni
 module Platform::Fingerprinters
 
-#
 # Identifies Tomcat web servers.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
 # @version 0.1
-#
 class Tomcat < Platform::Fingerprinter
 
+    IDS = %w(coyote tomcat)
+
     def run
-        platforms << :tomcat << :jsp if server_or_powered_by_include? 'tomcat'
+        IDS.each do |id|
+            next if !server_or_powered_by_include? id
+
+            return update_platforms
+        end
+    end
+
+    def update_platforms
+        platforms << :java << :tomcat
     end
 
 end

data/components/path_extractors/anchors.rb

@@ -6,24 +6,17 @@
     web site for more information on licensing and terms of use.
 =end
 
-#
 # Extracts paths from anchor elements.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.1.1
-#
+# @version 0.2
 class Arachni::Parser::Extractors::Anchors < Arachni::Parser::Extractors::Base
 
-    #
-    # Returns an array of paths as plain strings
-    #
-    # @param    [Nokogiri]  doc  Nokogiri document
-    #
-    # @return   [Array<String>]  paths
-    #
-    def run( doc )
-        doc.search( '//a[@href]' ).map { |a| a['href'] }
+    def run
+        return [] if !includes?( 'href' )
+
+        document.search( '//a[@href]' ).map { |a| a['href'] }
     end
 
 end

data/components/path_extractors/areas.rb

@@ -6,24 +6,16 @@
     web site for more information on licensing and terms of use.
 =end
 
-#
 # Extracts paths from anchor elements.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.1.1
-#
+# @version 0.2
 class Arachni::Parser::Extractors::Areas < Arachni::Parser::Extractors::Base
 
-    #
-    # Returns an array of paths as plain strings
-    #
-    # @param    [Nokogiri]  doc  Nokogiri document
-    #
-    # @return   [Array<String>]  paths
-    #
-    def run( doc )
-        doc.search( '//area[@href]' ).map { |a| a['href'] }
+    def run
+        return [] if !includes?( 'area' ) || !includes?( 'href' )
+
+        document.search( '//area[@href]' ).map { |a| a['href'] }
     end
 
 end

data/components/path_extractors/comments.rb

@@ -9,11 +9,13 @@
 # Extract paths from HTML comments.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.1
+# @version 0.2
 class Arachni::Parser::Extractors::Comments < Arachni::Parser::Extractors::Base
 
-    def run( doc )
-        doc.xpath( '//comment()' ).map do |comment|
+    def run
+        return [] if !includes?( '<!--' )
+
+        document.xpath( '//comment()' ).map do |comment|
             comment.text.scan( /(\/[\/a-zA-Z0-9%._-]+)/ )
         end.flatten.select { |s| s.include? '/' }
     end

data/components/path_extractors/data_url.rb

@@ -0,0 +1,21 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+# Extracts paths from anchor elements.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.2
+class Arachni::Parser::Extractors::DataURL < Arachni::Parser::Extractors::Base
+
+    def run
+        return [] if !includes?( 'data-url' )
+
+        document.search( '//a[@data-url]' ).map { |a| a['data-url'] }
+    end
+
+end

data/components/path_extractors/forms.rb

@@ -6,24 +6,16 @@
     web site for more information on licensing and terms of use.
 =end
 
-#
 # Extracts paths from "form" HTML elements.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.1.1
-#
+# @version 0.2
 class Arachni::Parser::Extractors::Forms < Arachni::Parser::Extractors::Base
 
-    #
-    # Returns an array of paths as plain strings
-    #
-    # @param    [Nokogiri]  doc  Nokogiri document
-    #
-    # @return   [Array<String>]  paths
-    #
-    def run( doc )
-        doc.search( '//form[@action]' ).map { |a| a['action'] }
+    def run
+        return [] if !includes?( 'action' )
+
+        document.search( '//form[@action]' ).map { |a| a['action'] }
     end
 
 end

data/components/path_extractors/frames.rb

@@ -6,24 +6,17 @@
     web site for more information on licensing and terms of use.
 =end
 
-#
 # Extracts paths from frames.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.1.1
-#
+# @version 0.2
 class Arachni::Parser::Extractors::Frames < Arachni::Parser::Extractors::Base
 
-    #
-    # Returns an array of paths as plain strings
-    #
-    # @param    [Nokogiri]  doc  Nokogiri document
-    #
-    # @return   [Array<String>]  paths
-    #
-    def run( doc )
-        doc.css( 'frame', 'iframe' ).map { |a| a.attributes['src'].content rescue next }
+    def run
+        return [] if !includes?( 'frame' )
+
+        document.css( 'frame', 'iframe' ).
+            map { |a| a.attributes['src'].content rescue next }
     end
 
 end

data/components/path_extractors/generic.rb

@@ -8,7 +8,6 @@
 
 require 'uri'
 
-#
 # Extract URLs from arbitrary text.
 #
 # You might think that this renders the rest path extractors redundant
@@ -17,19 +16,11 @@ require 'uri'
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.2.1
-#
+# @version 0.3
 class Arachni::Parser::Extractors::Generic < Arachni::Parser::Extractors::Base
 
-    #
-    # Returns an array of paths as plain strings
-    #
-    # @param    [Nokogiri]  doc  Nokogiri document
-    #
-    # @return   [Array<String>]  paths
-    #
-    def run( doc )
-        URI.extract( doc.to_s, %w(http https) ).map do |u|
+    def run
+        URI.extract( html, %w(http https) ).map do |u|
             #
             # This extractor needs to be a tiny bit intelligent because
             # due to its generic nature it'll inevitably match some garbage.

data/components/path_extractors/links.rb

@@ -6,24 +6,16 @@
     web site for more information on licensing and terms of use.
 =end
 
-#
 # Extracts paths from "link" HTML elements.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.1.1
-#
+# @version 0.2
 class Arachni::Parser::Extractors::Links < Arachni::Parser::Extractors::Base
 
-    #
-    # Returns an array of paths as plain strings
-    #
-    # @param    [Nokogiri]  doc  Nokogiri document
-    #
-    # @return   [Array<String>]  paths
-    #
-    def run( doc )
-        doc.search( "//link[@href]" ).map { |a| a['href'] }
+    def run
+        return [] if !includes?( 'link' )
+
+        document.search( '//link[@href]' ).map { |a| a['href'] }
     end
 
 end

data/components/path_extractors/meta_refresh.rb

@@ -6,24 +6,16 @@
     web site for more information on licensing and terms of use.
 =end
 
-#
 # Extracts meta refresh URLs.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.1.2
-#
+# @version 0.2
 class Arachni::Parser::Extractors::MetaRefresh < Arachni::Parser::Extractors::Base
 
-    #
-    # Returns an array of paths as plain strings
-    #
-    # @param    [Nokogiri]  doc  Nokogiri document
-    #
-    # @return   [Array<String>]  paths
-    #
-    def run( doc )
-        doc.search( "//meta[
+    def run
+        return [] if !includes?( 'http-equiv' )
+
+        document.search( "//meta[
                 translate(
                     @http-equiv,
                         'ABCDEFGHIJKLMNOPQRSTUVWXYZ',

data/components/path_extractors/scripts.rb

@@ -6,24 +6,18 @@
     web site for more information on licensing and terms of use.
 =end
 
-# Extracts paths from "script" HTML elements.<br/>
-# Both from "src" and the text inside the scripts.
+# Extracts paths from `script` HTML elements.
+# Both from `src` and the text inside the scripts.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.1.2
+# @version 0.2
 class Arachni::Parser::Extractors::Scripts < Arachni::Parser::Extractors::Base
 
-    #
-    # Returns an array of paths as plain strings
-    #
-    # @param    [Nokogiri]  doc  Nokogiri document
-    #
-    # @return   [Array<String>]  paths
-    #
-    def run( doc )
-        doc.search( '//script[@src]' ).map { |a| a['src'] } |
-            doc.xpath( '//script' ).map(&:text).join.
+    def run
+        return [] if !includes?( 'script' )
+
+        document.search( '//script[@src]' ).map { |a| a['src'] } |
+            document.xpath( '//script' ).map(&:text).join.
                 scan( /[\/a-zA-Z0-9%._-]+/ ).
                 select { |s| s.include?( '.' ) && s.include?( '/' ) }
     end

data/components/plugins/autologin.rb

@@ -13,14 +13,15 @@
 # framework-wide cookies.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.2
+# @version 0.2.1
 class Arachni::Plugins::AutoLogin < Arachni::Plugin::Base
 
     STATUSES  = {
-        ok:             'Form submitted successfully.',
-        form_not_found: 'Could not find a form suiting the provided parameters.',
-        check_failed:   'Form submitted but the response did not match the verifier.'
+        ok:               'Form submitted successfully.',
+        form_not_found:   'Could not find a form suiting the provided parameters.',
+        form_not_visible: 'The form was located but its DOM element is not ' <<
+                              'visible and thus cannot be submitted.',
+        check_failed:     'Form submitted but the response did not match the verifier.'
     }
 
     def prepare
@@ -46,6 +47,14 @@ class Arachni::Plugins::AutoLogin < Arachni::Plugin::Base
             print_error STATUSES[:form_not_found]
             @errored = true
             return
+        rescue Arachni::Session::Error::FormNotVisible
+            register_results(
+                'status'  => 'form_not_visible',
+                'message' => STATUSES[:form_not_visible]
+            )
+            print_error STATUSES[:form_not_visible]
+            @errored = true
+            return
         end
 
         framework.options.session.check_url     ||= response.url
@@ -93,6 +102,9 @@ class Arachni::Plugins::AutoLogin < Arachni::Plugin::Base
 It looks for the login form in the user provided URL, merges its input fields
 with the user supplied parameters and sets the cookies of the response and
 request as framework-wide cookies.
+
+**NOTICE**: If the login form is by default hidden and requires a sequence of DOM
+interactions in order to become visible, this plugin will not be able to submit it.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
             version:     '0.2',

data/components/plugins/defaults/meta/remedies/discovery.rb

@@ -6,32 +6,19 @@
     web site for more information on licensing and terms of use.
 =end
 
-# Catches custom 404 or similar server behavior that can confuse discovery
-# checks.
+# Catches custom-404s that somehow slipped past the {HTTP::Client::Dynamic404Handler}
+# (or similar server behavior) that can confuse discovery checks.
 #
 # This is relatively easy to determine since valid responses to discovery checks
-# should vary wildly while custom 404 responses will have many commonalities
+# should vary wildly, while custom-404 responses will have many commonalities
 # every time.
 #
 # This is a sort of baseline implementation/anomaly detection.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.3
+# @version 0.3.1
 class Arachni::Plugins::Discovery < Arachni::Plugin::Base
 
-    # Valid responses to discovery checks should vary *wildly* especially
-    # considering the types of directories and files that these checks look for.
-    #
-    # On the other hand custom 404 or such responses will have many things in
-    # common which makes it possible to spot them without much bother.
-    SIMILARITY_TOLERANCE = 0.25
-
-    REMARK = 'This issue was logged by a discovery check but ' +
-        'the response for the resource it identified is very similar to responses ' +
-        'for other resources of similar type. This is a strong indication that ' +
-        'the logged issue is a false positive.'
-
     def run
         wait_while_framework_running
 
@@ -50,6 +37,9 @@ class Arachni::Plugins::Discovery < Arachni::Plugin::Base
             next if !issue.tags.includes_tags?( :discovery )
 
             issue.variations.each do |variation|
+                # Skip it if already flagged as untrusted.
+                next if variation.untrusted?
+
                 processed_issues += 1
 
                 # We'll do this per path since 404 handlers and such operate per
@@ -87,17 +77,9 @@ class Arachni::Plugins::Discovery < Arachni::Plugin::Base
             similarity = Float( diff.size * issue_digests_per_path[path].size ) /
                 response_size_per_path[path]
 
-            next if similarity < SIMILARITY_TOLERANCE
-
-            # Gotcha!
-            issue_digests_per_path[path].each do |digest|
-                Data.issues[digest].variations.each do |issue|
-                    issue.add_remark :meta_analysis, REMARK
-
-                    # Requires manual verification.
-                    issue.trusted = false
-                end
-            end
+            Arachni::Element::Server.flag_issues_if_untrusted(
+                similarity, issue_digests_per_path[path]
+            )
         end
     end
 
@@ -112,7 +94,7 @@ while the server responses were exhibiting an anomalous factor of similarity.
 There's a good chance that these issues are false positives.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.3',
+            version:     '0.3.1',
             tags:        %w(anomaly discovery file directories meta)
         }
     end