arachni 1.1 → 1.2

data/components/plugins/login_script.rb

@@ -12,18 +12,31 @@
 class Arachni::Plugins::LoginScript < Arachni::Plugin::Base
 
     STATUSES  = {
-        success:       'Login was successful.',
-        failure:       'The script was executed successfully, but the login check failed.',
-        error:         'A runtime error was encountered while executing the login script.',
-        missing_check: 'No session check was provided, either via interface options or the script.'
+        success:         'Login was successful.',
+        failure:         'The script was executed successfully, but the login check failed.',
+        error:           'A runtime error was encountered while executing the login script.',
+        missing_browser: 'A browser is required for this operation but is not available.',
+        missing_check:   'No session check was provided, either via interface options or the script.'
     }
 
     def prepare
-        script = IO.read( @options[:script] )
-        @script = proc { |browser| eval script }
+        script    = IO.read( @options[:script] )
+        @script   = proc do |browser|
+            if javascript?
+                browser.goto @framework.options.url
+                browser.execute_script script
+            else
+                eval script
+            end
+        end
     end
 
     def run
+        if javascript? && !session.has_browser?
+            set_status :missing_browser, :error
+            return
+        end
+
         framework_pause
         print_info 'System paused.'
 
@@ -71,6 +84,10 @@ class Arachni::Plugins::LoginScript < Arachni::Plugin::Base
         framework_resume
     end
 
+    def javascript?
+        @options[:script].split( '.' ).last == 'js'
+    end
+
     def set_status( status, type = nil, extra = {} )
         type ||= status
 
@@ -96,7 +113,9 @@ The script needn't necessarily perform an actual login operation. If another
 process is used to manage sessions, the script can be used to communicate with
 that process and, for example, load and set cookies from a shared cookie-jar.
 
-**With browser (slow):**
+# Ruby
+
+## With browser (slow)
 
 If a [browser](http://watirwebdriver.com/) is available, it will be exposed to
 the script via the `browser` variable. Otherwise, that variable will have a
@@ -115,7 +134,7 @@ value of `nil`.
     framework.options.session.check_url     = browser.url
     framework.options.session.check_pattern = /Sign Off|MY ACCOUNT/
 
-**Without browser (fast):**
+## Without browser (fast)
 
 If a real browser environment is not required for the login operation, then
 using the system-wide HTTP interface is preferable, as it will be much faster
@@ -133,15 +152,26 @@ and consume much less resources.
     framework.options.session.check_url     = to_absolute( response.headers.location, response.url )
     framework.options.session.check_pattern = /Sign Off|MY ACCOUNT/
 
-**From cookie-jar:**
+## From cookie-jar
 
 If an external process is used to manage sessions, you can keep Arachni in sync
 by loading cookies from a shared Netscape-style cookie-jar file.
 
     http.cookie_jar.load 'cookies.txt'
+
+# Javascript
+
+When the given script has a `.js` file extension, it will be loaded and executed
+in the browser, within the page of the target URL.
+
+    document.getElementById( 'uid' ).value   = 'jsmith';
+    document.getElementById( 'passw' ).value = 'Demo1234';
+
+    document.getElementById( 'login' ).submit();
+
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1',
+            version:     '0.2',
             options:     [
                 Options::Path.new( :script,
                     required:    true,

data/components/plugins/metrics.rb

@@ -0,0 +1,235 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.1
+class Arachni::Plugins::Metrics < Arachni::Plugin::Base
+
+    def prepare
+        @metrics = {
+            'general'   => {
+                'egress_traffic'  => 0,
+                # Approximation, may differ from the real value depending on
+                # compression and other factors.
+                'ingress_traffic' => 0,
+                'uses_http'       => false,
+                'uses_https'      => false
+            },
+            'scan'      => {
+                'duration'      => 0,
+                'authenticated' => false
+            },
+            'http'      => {
+                'requests'              => 0,
+                'response_time_min'     => 0,
+                'response_time_max'     => 0,
+                'response_time_average' => 0,
+                'request_size_min'      => 0,
+                'request_size_max'      => 0,
+                'request_size_average'  => 0,
+                'response_size_min'     => 0,
+                'response_size_max'     => 0,
+                'response_size_average' => 0
+            },
+            'resource'  => {
+                'binary'            => Arachni::Support::LookUp::HashSet.new,
+                'without_parameters' => Arachni::Support::LookUp::HashSet.new,
+                'with_parameters'    => Arachni::Support::LookUp::HashSet.new
+            },
+            'element'   => {
+                'links'                    => 0,
+                'forms'                    => 0,
+                'cookies'                  => 0,
+                'jsons'                    => 0,
+                'xmls'                     => 0,
+                'headers'                  => 0,
+                'has_forms_with_nonces'    => false,
+                'has_forms_with_passwords' => false,
+                'input_names_total'        => 0,
+                'input_names_unique'       => Arachni::Support::LookUp::HashSet.new
+            },
+            'dom'       => {
+                'event_listeners' => Arachni::Support::LookUp::HashSet.new,
+                'swf_objects'     => Arachni::Support::LookUp::HashSet.new
+            },
+            'platforms' => Arachni::Platform::Manager::TYPES.keys.
+                inject({}) { |h, t| h[t.to_s] = Set.new; h }
+        }
+    end
+
+    def run
+        http_response_time_total = 0
+
+        http.on_complete do |response|
+            response.platforms.to_a.each do |platform|
+                @metrics['platforms'][Arachni::Platform::Manager.find_type( platform ).to_s] << platform.to_s
+            end
+
+            @metrics['general']['egress_traffic']  += response.request.to_s.size
+            @metrics['general']['ingress_traffic'] += response.to_s.size
+
+            if @metrics['http']['response_time_min'].is_a?( Integer ) ||
+                response.time < @metrics['http']['response_time_min']
+
+                @metrics['http']['response_time_min'] = response.time
+            end
+            if response.time > @metrics['http']['response_time_max']
+                @metrics['http']['response_time_max'] = response.time
+            end
+
+            response_size = response.to_s.size
+            if @metrics['http']['response_size_min'].is_a?( Integer ) ||
+                response_size < @metrics['http']['response_size_min']
+
+                @metrics['http']['response_size_min'] = response_size
+            end
+            if response_size > @metrics['http']['response_size_max']
+                @metrics['http']['response_size_max'] = response_size
+            end
+
+            request_size = response.request.to_s.size
+            if @metrics['http']['request_size_min'].is_a?( Integer ) ||
+                request_size < @metrics['http']['request_size_min']
+
+                @metrics['http']['request_size_min'] = request_size
+            end
+            if request_size > @metrics['http']['request_size_max']
+                @metrics['http']['request_size_max'] = request_size
+            end
+
+            # Only track OK codes, otherwise discovery checks will muck with the
+            # data.
+            if response.code == 200
+                if response.request.body.is_a?( Hash ) ||
+                    response.request.parameters.any? ||
+                    response.request.url.include?( '?' )
+
+                    if response.request.body.is_a? Hash
+                        body = response.request.body.keys.sort
+                    else
+                        body = nil
+                    end
+
+                    @metrics['resource']['with_parameters'] <<
+                        "#{response.parsed_url.up_to_path}#{response.request.parameters.keys.sort}:#{body}"
+                else
+                    @metrics['resource']['without_parameters'] << response.url
+                end
+            end
+
+            @metrics['general']['uses_http']  ||=
+                (response.parsed_url.scheme == 'http')
+            @metrics['general']['uses_https'] ||=
+                (response.parsed_url.scheme == 'https')
+
+            if !response.text?
+                @metrics['resource']['binary'] << response.url
+            end
+
+            http_response_time_total += response.time
+        end
+
+        framework.on_page_audit do |page|
+            %w(links forms cookies headers jsons xmls).each do |type|
+                page.send( type ).each do |e|
+                    next if e.inputs.empty?
+
+                    @metrics['element'][type]                += 1
+                    @metrics['element']['input_names_total'] += e.inputs.size
+
+                    e.inputs.keys.each do |name|
+                        @metrics['element']['input_names_unique'] << name
+                    end
+
+                    if e.is_a? Arachni::Element::Form
+                        # Probably not a real form, just a request with inputs
+                        # captured by the browsers and fed back to the system.
+                        if !e.source
+                            @metrics['element'][type] -= 1
+                        end
+
+                        @metrics['element']['has_forms_with_nonces']    ||= !!e.has_nonce?
+                        @metrics['element']['has_forms_with_passwords'] ||= !!e.requires_password?
+                    end
+                end
+            end
+
+            if (swf = find_swf( page ))
+                @metrics['dom']['swf_objects'] << swf
+            end
+
+            if Arachni::Options.scope.dom_depth_limit.to_i < page.dom.depth + 1 &&
+                browser_cluster && page.has_script?
+
+                with_browser do |browser|
+                    browser.load( page ).each_element_with_events do |locator, event_data|
+                        event_data.each do |data|
+                            @metrics['dom']['event_listeners'] << "#{locator}:#{data}"
+                        end
+                    end
+                end
+            end
+        end
+
+        wait_while_framework_running
+
+        @metrics = process( @metrics )
+
+        @metrics['http']['requests'] = framework.statistics[:http][:response_count]
+
+        @metrics['http']['response_time_average'] =
+            http_response_time_total / @metrics['http']['requests']
+
+        @metrics['http']['response_size_average'] =
+            @metrics['general']['ingress_traffic'] / @metrics['http']['requests']
+
+        @metrics['http']['request_size_average'] =
+            @metrics['general']['egress_traffic'] / @metrics['http']['requests']
+
+        @metrics['scan']['duration']      = framework.statistics[:runtime]
+        @metrics['scan']['authenticated'] = !!Arachni::Options.session.check_url
+
+        register_results @metrics
+    end
+
+    def find_swf( page )
+        page.body.scan( /(?:data|src)=['"]?(.*)\.swf['"]?>/ )[0]
+    end
+
+    def process( hash )
+        h = {}
+        hash.each do |k, v|
+            case v
+                when Hash
+                    v = process( v )
+
+                when Set
+                    v = v.to_a
+
+                when Arachni::Support::LookUp::HashSet
+                    v = v.size
+
+            end
+
+            h[k] = v
+        end
+        h
+    end
+
+    def self.info
+        {
+            name:        'Metrics',
+            description: %q{
+Captures metrics about multiple aspects of the scan and the web application.
+},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
+            version:     '0.1'
+        }
+    end
+
+end

data/components/plugins/proxy.rb

@@ -60,7 +60,13 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
         print_info "Control panel URL: #{url_for( :panel )}"
         print_info "Shutdown URL:      #{url_for( :shutdown )}"
         print_info 'The scan will resume once you visit the shutdown URL.'
-
+        print_info
+        print_info 'When browsing HTTPS sites, please accept the Arachni SSL certificate' +
+            ' or install the CA certificate manually from:'
+        print_info "    #{Arachni::HTTP::ProxyServer::INTERCEPTOR_CA_CERTIFICATE}"
+        print_info
+        print_bad '**DO NOT** forget to revoke it after using the proxy, as it' +
+            ' can be used by anyone to impersonate 3rd party servers.'
         print_info
         print_info '*' * 82
         print_info '* You need to clear your browser\'s cookies for this site before using the proxy! *'
@@ -77,7 +83,12 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
     end
 
     def prepare_pages_for_inspection
-        @pages.select { |p| (p.forms.any? || p.links.any? || p.cookies.any?) && p.text? }
+        (@pages.select do |p|
+            next if !p.text?
+
+            p.forms.any? || p.links.any? || p.cookies.any? || p.jsons.any? ||
+                p.xmls.any?
+        end).to_a
     end
 
     def vectors_yaml
@@ -86,12 +97,18 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
             page.elements.each do |element|
                 next if element.inputs.empty?
 
-                vectors << {
+                data = {
                     type:   element.type,
                     method: element.method,
                     action: element.action,
                     inputs: element.inputs
                 }
+
+                if element.respond_to? :source
+                    data[:source] = element.source
+                end
+
+                vectors << data
             end
         end
         vectors.to_yaml
@@ -476,7 +493,7 @@ a way to restrict usage enough to avoid users unwittingly interfering with each
 others' sessions.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.3.2',
+            version:     '0.3.3',
             options:     [
                 Options::Port.new( :port,
                     description: 'Port to bind to.',

data/components/plugins/proxy/panel/page_accordion.html.erb

@@ -7,9 +7,13 @@
                     <%= html_encode page.title %>
                     -
                     <%= page.forms.size %> forms,
-                    <%= page.links.size %> links and
-                    <%= page.cookies.size %> cookies
+                    <%= page.links.size %> links,
+                    <%= page.cookies.size %> cookies,
+                    <%= page.jsons.size %> JSONs and
+                    <%= page.xmls.size %> XMLs.
+
                     <br/>
+
                     (<%= page.url %>)
                 </p>
             </div>
@@ -60,6 +64,34 @@
                             <hr />
                         <% end %>
                     </div>
+                    <div class="well links">
+                        <h2>JSONs</h2>
+                        <% page.jsons.each do |json| %>
+                            <p>
+                                <b>Action: <%= html_encode json.action %></b>
+                            <ul>
+                                <% json.inputs.each do |k, v| %>
+                                    <li><%= k.inspect %> = <%= v.inspect %></li>
+                                <% end %>
+                            </ul>
+                            </p>
+                            <hr />
+                        <% end %>
+                    </div>
+                    <div class="well links">
+                        <h2>XMLs</h2>
+                        <% page.xmls.each do |xml| %>
+                            <p>
+                                <b>Action: <%= html_encode xml.action %></b>
+                            <ul>
+                                <% xml.inputs.each do |k, v| %>
+                                    <li><%= k.inspect %> = <%= v.inspect %></li>
+                                <% end %>
+                            </ul>
+                            </p>
+                            <hr />
+                        <% end %>
+                    </div>
                 </div>
             </div>
         </div>

data/components/plugins/restrict_to_dom_state.rb

@@ -0,0 +1,70 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.1
+class Arachni::Plugins::RestrictToDOMState < Arachni::Plugin::Base
+
+    def prepare
+        print_status 'Sending pause signal...'
+        @pause_id = framework.pause( false )
+        print_status '...done.'
+
+        # Disable any operations that can lead to a crawl, we only want the
+        # system to audit the page snapshot we give it.
+        framework.options.scope.do_not_crawl
+
+        @fragment = options[:fragment]
+        @url      = "#{framework.options.url}##{@fragment}"
+
+        print_info "Full URL set to: #{@url}"
+    end
+
+    def run
+        print_status 'Initialising browser...'
+        browser = Arachni::Browser.new( store_pages: false )
+        print_status '...done.'
+
+        print_status 'Loading page...'
+        page = browser.load( @url ).to_page
+        print_info '  Transitions:'
+        page.dom.print_transitions( method(:print_info), '    ' )
+
+        framework.push_to_page_queue page, true
+        print_status 'Pushed to page queue.'
+    ensure
+        return if !browser
+
+        print_status 'Shutting down browser...'
+        browser.shutdown
+        print_status '...done.'
+    end
+
+    def clean_up
+        print_status 'Resuming scan...'
+        framework.resume @pause_id
+        print_status '...done.'
+    end
+
+    def self.info
+        {
+            name:        'Restrict to DOM state',
+            description: %q{Restricts the scan to a single page's DOM state.},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
+            version:     '0.1',
+            options:     [
+                Options::String.new( :fragment,
+                    required:    true,
+                    description: 'URL fragment for the desired state.'
+                )
+            ],
+            priority:    0 # run before any other plugin
+        }
+    end
+
+end