arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -21,7 +21,7 @@ describe Arachni::Browser::Javascript do
21
21
  describe '.events_for' do
22
22
  it 'returns events for the given element' do
23
23
  described_class::EVENTS_PER_ELEMENT.each do |element, events|
24
- described_class.events_for( element ).should == described_class::GLOBAL_EVENTS | events
24
+ expect(described_class.events_for( element )).to eq(described_class::GLOBAL_EVENTS | events)
25
25
  end
26
26
  end
27
27
  end
@@ -33,24 +33,24 @@ describe Arachni::Browser::Javascript do
33
33
  onmouseover: 'blah2();',
34
34
  id: 'my-id'
35
35
  }
36
- described_class.select_event_attributes( attributes ).should == {
36
+ expect(described_class.select_event_attributes( attributes )).to eq({
37
37
  onclick: 'blah();',
38
38
  onmouseover: 'blah2();'
39
- }
39
+ })
40
40
  end
41
41
  end
42
42
 
43
43
  describe '#dom_monitor' do
44
44
  it 'provides access to the DOMMonitor javascript interface' do
45
45
  @browser.load "#{@taint_tracer_url}/debug"
46
- subject.dom_monitor.js_object.should end_with 'DOMMonitor'
46
+ expect(subject.dom_monitor.js_object).to end_with 'DOMMonitor'
47
47
  end
48
48
  end
49
49
 
50
50
  describe '#taint_tracer' do
51
51
  it 'provides access to the TaintTracer javascript interface' do
52
52
  @browser.load "#{@taint_tracer_url}/debug"
53
- subject.taint_tracer.js_object.should end_with 'TaintTracer'
53
+ expect(subject.taint_tracer.js_object).to end_with 'TaintTracer'
54
54
  end
55
55
  end
56
56
 
@@ -58,28 +58,31 @@ describe Arachni::Browser::Javascript do
58
58
  it 'injects the given code into the response' do
59
59
  subject.custom_code = 'window.has_custom_code = true'
60
60
  @browser.load "#{@taint_tracer_url}/debug"
61
- subject.run( 'return window.has_custom_code' ).should == true
61
+ expect(subject.run( 'return window.has_custom_code' )).to eq(true)
62
62
  end
63
63
  end
64
64
 
65
65
  describe '#log_execution_flow_sink_stub' do
66
66
  it 'returns JS code for TaintTracer.log_execution_flow_sink()' do
67
- subject.log_execution_flow_sink_stub( 1, 2, 3 ).should ==
67
+ expect(subject.log_execution_flow_sink_stub( 1, 2, 3 )).to eq(
68
68
  "_#{subject.token}TaintTracer.log_execution_flow_sink(1, 2, 3)"
69
+ )
69
70
  end
70
71
  end
71
72
 
72
73
  describe '#log_data_flow_sink_stub' do
73
74
  it 'returns JS code for TaintTracer.log_data_flow_sink()' do
74
- subject.log_data_flow_sink_stub( 1, 2, 3 ).should ==
75
+ expect(subject.log_data_flow_sink_stub( 1, 2, 3 )).to eq(
75
76
  "_#{subject.token}TaintTracer.log_data_flow_sink(1, 2, 3)"
77
+ )
76
78
  end
77
79
  end
78
80
 
79
81
  describe '#debug_stub' do
80
82
  it 'returns JS code for TaintTracer.debug()' do
81
- subject.debug_stub( 1, 2, 3 ).should ==
83
+ expect(subject.debug_stub( 1, 2, 3 )).to eq(
82
84
  "_#{subject.token}TaintTracer.debug(1, 2, 3)"
85
+ )
83
86
  end
84
87
  end
85
88
 
@@ -87,14 +90,14 @@ describe Arachni::Browser::Javascript do
87
90
  context 'when there is support for the Javascript environment' do
88
91
  it 'returns true' do
89
92
  @browser.load "#{@taint_tracer_url}/debug"
90
- subject.supported?.should be_true
93
+ expect(subject.supported?).to be_truthy
91
94
  end
92
95
  end
93
96
 
94
97
  context 'when there is no support for the Javascript environment' do
95
98
  it 'returns false' do
96
99
  @browser.load "#{@taint_tracer_url}/without_javascript_support"
97
- subject.supported?.should be_false
100
+ expect(subject.supported?).to be_falsey
98
101
  end
99
102
  end
100
103
 
@@ -102,21 +105,22 @@ describe Arachni::Browser::Javascript do
102
105
  it 'returns false' do
103
106
  Arachni::Options.url = @taint_tracer_url
104
107
  @browser.load 'http://google.com/'
105
- subject.supported?.should be_false
108
+ expect(subject.supported?).to be_falsey
106
109
  end
107
110
  end
108
111
  end
109
112
 
110
113
  describe '#log_execution_flow_sink_stub' do
111
114
  it 'returns JS code that calls JS\'s log_execution_flow_sink_stub()' do
112
- subject.log_execution_flow_sink_stub.should ==
115
+ expect(subject.log_execution_flow_sink_stub).to eq(
113
116
  "_#{subject.token}TaintTracer.log_execution_flow_sink()"
117
+ )
114
118
 
115
119
  @browser.load "#{@taint_tracer_url}/debug?input=#{subject.log_execution_flow_sink_stub}"
116
120
 
117
121
  @browser.watir.form.submit
118
- subject.execution_flow_sinks.should be_any
119
- subject.execution_flow_sinks.first.data.should be_empty
122
+ expect(subject.execution_flow_sinks).to be_any
123
+ expect(subject.execution_flow_sinks.first.data).to be_empty
120
124
  end
121
125
  end
122
126
 
@@ -126,24 +130,24 @@ describe Arachni::Browser::Javascript do
126
130
 
127
131
  as = @browser.watir.as
128
132
 
129
- as[0].name.should == '1'
130
- as[0].html.should_not include 'data-arachni-id'
133
+ expect(as[0].name).to eq('1')
134
+ expect(as[0].html).not_to include 'data-arachni-id'
131
135
 
132
- as[1].name.should == '2'
133
- as[1].html.should include 'data-arachni-id'
136
+ expect(as[1].name).to eq('2')
137
+ expect(as[1].html).to include 'data-arachni-id'
134
138
 
135
- as[2].name.should == '3'
136
- as[2].html.should_not include 'data-arachni-id'
139
+ expect(as[2].name).to eq('3')
140
+ expect(as[2].html).not_to include 'data-arachni-id'
137
141
 
138
- as[3].name.should == '4'
139
- as[3].html.should_not include 'data-arachni-id'
142
+ expect(as[3].name).to eq('4')
143
+ expect(as[3].html).not_to include 'data-arachni-id'
140
144
  end
141
145
  end
142
146
 
143
147
  describe '#dom_digest' do
144
148
  it 'returns a string digest of the current DOM tree' do
145
149
  @browser.load( @dom_monitor_url + 'digest' )
146
- subject.dom_digest.should == subject.dom_monitor.digest
150
+ expect(subject.dom_digest).to eq(subject.dom_monitor.digest)
147
151
  end
148
152
  end
149
153
 
@@ -152,7 +156,7 @@ describe Arachni::Browser::Javascript do
152
156
  it 'returns information about all DOM elements along with their events' do
153
157
  @browser.load @dom_monitor_url + 'elements_with_events/attributes'
154
158
 
155
- subject.dom_elements_with_events.should == [
159
+ expect(subject.dom_elements_with_events).to eq([
156
160
  {
157
161
  'tag_name' => 'body', 'events' => [], 'attributes' => {}
158
162
  },
@@ -177,7 +181,7 @@ describe Arachni::Browser::Javascript do
177
181
  ],
178
182
  'attributes' => { 'onclick' => 'handler_3()', 'id' => 'my-button3' }
179
183
  }
180
- ]
184
+ ])
181
185
  end
182
186
  end
183
187
 
@@ -185,7 +189,7 @@ describe Arachni::Browser::Javascript do
185
189
  it 'returns information about all DOM elements along with their events' do
186
190
  @browser.load @dom_monitor_url + 'elements_with_events/listeners'
187
191
 
188
- subject.dom_elements_with_events.should == [
192
+ expect(subject.dom_elements_with_events).to eq([
189
193
  {
190
194
  'tag_name' => 'body', 'events' => [], 'attributes' => {}
191
195
  },
@@ -208,13 +212,13 @@ describe Arachni::Browser::Javascript do
208
212
  'events' => [],
209
213
  'attributes' => { 'id' => 'my-button3' }
210
214
  }
211
- ]
215
+ ])
212
216
  end
213
217
 
214
218
  it 'does not include custom events' do
215
219
  @browser.load @dom_monitor_url + 'elements_with_events/listeners/custom'
216
220
 
217
- subject.dom_elements_with_events.should == [
221
+ expect(subject.dom_elements_with_events).to eq([
218
222
  {
219
223
  'tag_name' => 'body', 'events' => [], 'attributes' => {}
220
224
  },
@@ -223,7 +227,7 @@ describe Arachni::Browser::Javascript do
223
227
  'events' => [],
224
228
  'attributes' => { 'id' => 'my-button' }
225
229
  }
226
- ]
230
+ ])
227
231
  end
228
232
  end
229
233
  end
@@ -231,14 +235,14 @@ describe Arachni::Browser::Javascript do
231
235
  describe '#timeouts' do
232
236
  it 'keeps track of setTimeout() timers' do
233
237
  @browser.load( @dom_monitor_url + 'timeout-tracker' )
234
- subject.timeouts.should == subject.dom_monitor.timeouts
238
+ expect(subject.timeouts).to eq(subject.dom_monitor.timeouts)
235
239
  end
236
240
  end
237
241
 
238
242
  describe '#intervals' do
239
243
  it 'keeps track of setInterval() timers' do
240
244
  @browser.load( @dom_monitor_url + 'interval-tracker' )
241
- subject.intervals.should == subject.dom_monitor.intervals
245
+ expect(subject.intervals).to eq(subject.dom_monitor.intervals)
242
246
  end
243
247
  end
244
248
 
@@ -246,7 +250,7 @@ describe Arachni::Browser::Javascript do
246
250
  it 'returns debugging information' do
247
251
  @browser.load "#{@taint_tracer_url}/debug?input=#{subject.debug_stub(1)}"
248
252
  @browser.watir.form.submit
249
- subject.debugging_data.should == subject.taint_tracer.debugging_data
253
+ expect(subject.debugging_data).to eq(subject.taint_tracer.debugging_data)
250
254
  end
251
255
  end
252
256
 
@@ -255,8 +259,8 @@ describe Arachni::Browser::Javascript do
255
259
  @browser.load "#{@taint_tracer_url}/debug?input=#{subject.log_execution_flow_sink_stub(1)}"
256
260
  @browser.watir.form.submit
257
261
 
258
- subject.execution_flow_sinks.should be_any
259
- subject.execution_flow_sinks.should == subject.taint_tracer.execution_flow_sinks
262
+ expect(subject.execution_flow_sinks).to be_any
263
+ expect(subject.execution_flow_sinks).to eq(subject.taint_tracer.execution_flow_sinks)
260
264
  end
261
265
  end
262
266
 
@@ -267,8 +271,8 @@ describe Arachni::Browser::Javascript do
267
271
  @browser.watir.form.submit
268
272
 
269
273
  sinks = subject.data_flow_sinks
270
- sinks.should be_any
271
- sinks.should == subject.taint_tracer.data_flow_sinks[@browser.javascript.taint]
274
+ expect(sinks).to be_any
275
+ expect(sinks).to eq(subject.taint_tracer.data_flow_sinks[@browser.javascript.taint])
272
276
  end
273
277
  end
274
278
 
@@ -290,7 +294,7 @@ describe Arachni::Browser::Javascript do
290
294
  sink2 = subject.taint_tracer.data_flow_sinks[@browser.javascript.taint]
291
295
  sink2[0].trace[1].function.arguments[0].delete( 'timeStamp' )
292
296
 
293
- sink.should == sink2
297
+ expect(sink).to eq(sink2)
294
298
  end
295
299
 
296
300
  it 'empties the sink' do
@@ -298,7 +302,7 @@ describe Arachni::Browser::Javascript do
298
302
  @browser.watir.form.submit
299
303
 
300
304
  subject.flush_data_flow_sinks
301
- subject.data_flow_sinks.should be_empty
305
+ expect(subject.data_flow_sinks).to be_empty
302
306
  end
303
307
  end
304
308
 
@@ -316,7 +320,7 @@ describe Arachni::Browser::Javascript do
316
320
  sink2 = subject.taint_tracer.execution_flow_sinks
317
321
  sink2[0].trace[1].function.arguments[0].delete( 'timeStamp' )
318
322
 
319
- sink.should == sink2
323
+ expect(sink).to eq(sink2)
320
324
  end
321
325
 
322
326
  it 'empties the sink' do
@@ -324,7 +328,7 @@ describe Arachni::Browser::Javascript do
324
328
  @browser.watir.form.submit
325
329
 
326
330
  subject.flush_execution_flow_sinks
327
- subject.execution_flow_sinks.should be_empty
331
+ expect(subject.execution_flow_sinks).to be_empty
328
332
  end
329
333
  end
330
334
 
@@ -351,23 +355,23 @@ describe Arachni::Browser::Javascript do
351
355
  before(:each){ subject.serve( request, response ) }
352
356
 
353
357
  it 'sets the correct status code' do
354
- response.code.should == 200
358
+ expect(response.code).to eq(200)
355
359
  end
356
360
 
357
361
  it 'populates the given response body with its contents' do
358
- response.body.should == body
362
+ expect(response.body).to eq(body)
359
363
  end
360
364
 
361
365
  it 'sets the correct Content-Type' do
362
- response.headers.content_type.should == content_type
366
+ expect(response.headers.content_type).to eq(content_type)
363
367
  end
364
368
 
365
369
  it 'sets the correct Content-Length' do
366
- response.headers['content-length'].should == content_length
370
+ expect(response.headers['content-length']).to eq(content_length)
367
371
  end
368
372
 
369
373
  it 'returns true' do
370
- subject.serve( request, response ).should be_true
374
+ expect(subject.serve( request, response )).to be_truthy
371
375
  end
372
376
  end
373
377
  end
@@ -375,7 +379,7 @@ describe Arachni::Browser::Javascript do
375
379
  context 'other' do
376
380
  it 'returns false' do
377
381
  request.url = 'stuff'
378
- subject.serve( request, response ).should be_false
382
+ expect(subject.serve( request, response )).to be_falsey
379
383
  end
380
384
  end
381
385
  end
@@ -411,15 +415,15 @@ EOHTML
411
415
  end
412
416
 
413
417
  it 'inject a TaintTracer.update_tracers() call before the code' do
414
- injected.body.scan( /(.*)foo/m ).flatten.first.should include taint_tracer_update
418
+ expect(injected.body.scan( /(.*)foo/m ).flatten.first).to include taint_tracer_update
415
419
  end
416
420
 
417
421
  it 'inject a DOMMonitor.update_trackers() call before the code' do
418
- injected.body.scan( /(.*)foo/m ).flatten.first.should include dom_monitor_update
422
+ expect(injected.body.scan( /(.*)foo/m ).flatten.first).to include dom_monitor_update
419
423
  end
420
424
 
421
425
  it 'appends a semicolon and newline to the body' do
422
- injected.body.should include "#{response.body};\n"
426
+ expect(injected.body).to include "#{response.body};\n"
423
427
  end
424
428
 
425
429
  it 'updates the Content-Length' do
@@ -429,8 +433,8 @@ EOHTML
429
433
 
430
434
  new_content_length = response.headers['content-length'].to_i
431
435
 
432
- new_content_length.should > old_content_length
433
- new_content_length.should == response.body.bytesize
436
+ expect(new_content_length).to be > old_content_length
437
+ expect(new_content_length).to eq(response.body.bytesize)
434
438
  end
435
439
  end
436
440
 
@@ -455,8 +459,8 @@ EOHTML
455
459
 
456
460
  new_content_length = response.headers['content-length'].to_i
457
461
 
458
- new_content_length.should > old_content_length
459
- new_content_length.should == response.body.bytesize
462
+ expect(new_content_length).to be > old_content_length
463
+ expect(new_content_length).to eq(response.body.bytesize)
460
464
  end
461
465
 
462
466
  context 'when the response does not already contain the JS code' do
@@ -465,7 +469,7 @@ EOHTML
465
469
 
466
470
  %w(taint_tracer dom_monitor).each do |name|
467
471
  src = "#{described_class::SCRIPT_BASE_URL}#{name}.js"
468
- Nokogiri::HTML( response.body ).xpath( "//script[@src='#{src}']" ).should be_any
472
+ expect(Nokogiri::HTML( response.body ).xpath( "//script[@src='#{src}']" )).to be_any
469
473
  end
470
474
  end
471
475
 
@@ -474,7 +478,7 @@ EOHTML
474
478
 
475
479
  it 'injects taint tracer update calls at the top of the script' do
476
480
  subject.inject( response )
477
- Nokogiri::HTML(response.body).css('script')[-2].to_s.should ==
481
+ expect(Nokogiri::HTML(response.body).css('script')[-2].to_s).to eq(
478
482
  "<script>
479
483
 
480
484
  // Injected by #{described_class}
@@ -482,15 +486,17 @@ EOHTML
482
486
  _#{subject.token}DOMMonitor.update_trackers();
483
487
 
484
488
  // My code and stuff</script>"
489
+ )
485
490
  end
486
491
 
487
492
  it 'injects taint tracer update calls after the script' do
488
493
  subject.inject( response )
489
- Nokogiri::HTML(response.body).css('script')[-1].to_s.should ==
494
+ expect(Nokogiri::HTML(response.body).css('script')[-1].to_s).to eq(
490
495
  "<script type=\"text/javascript\">" +
491
496
  "_#{subject.token}TaintTracer.update_tracers();" +
492
497
  "_#{subject.token}DOMMonitor.update_trackers();" +
493
498
  '</script>'
499
+ )
494
500
  end
495
501
  end
496
502
  end
@@ -506,7 +512,7 @@ EOHTML
506
512
  subject.inject( response )
507
513
  intializer = subject.taint_tracer.stub.function( :initialize, subject.taint )
508
514
 
509
- response.body.should == presponse.body.gsub( pintializer, intializer )
515
+ expect(response.body).to eq(presponse.body.gsub( pintializer, intializer ))
510
516
  end
511
517
 
512
518
  it 'updates the custom code' do
@@ -519,7 +525,7 @@ EOHTML
519
525
  subject.custom_code = 'alert(2);'
520
526
  subject.inject( response )
521
527
 
522
- response.body.should == presponse.body.gsub( code, subject.custom_code )
528
+ expect(response.body).to eq(presponse.body.gsub( code, subject.custom_code ))
523
529
  end
524
530
  end
525
531
  end
@@ -561,8 +567,9 @@ EOHTML
561
567
  describe '#run' do
562
568
  it 'executes the given script under the browser\'s context' do
563
569
  @browser.load @dom_monitor_url
564
- Nokogiri::HTML(@browser.source).to_s.should ==
570
+ expect(Nokogiri::HTML(@browser.source).to_s).to eq(
565
571
  Nokogiri::HTML(subject.run( 'return document.documentElement.innerHTML' ) ).to_s
572
+ )
566
573
  end
567
574
  end
568
575
 
@@ -571,14 +578,17 @@ EOHTML
571
578
  @browser.load @dom_monitor_url
572
579
  source = Nokogiri::HTML(@browser.source).to_s
573
580
 
574
- source.should ==
581
+ expect(source).to eq(
575
582
  Nokogiri::HTML(subject.run_without_elements( 'return document.documentElement' ) ).to_s
583
+ )
576
584
 
577
- source.should ==
585
+ expect(source).to eq(
578
586
  Nokogiri::HTML(subject.run_without_elements( 'return [document.documentElement]' ).first ).to_s
587
+ )
579
588
 
580
- source.should ==
589
+ expect(source).to eq(
581
590
  Nokogiri::HTML(subject.run_without_elements( 'return { html: document.documentElement }' )['html'] ).to_s
591
+ )
582
592
  end
583
593
  end
584
594
  end
@@ -3,12 +3,12 @@ require 'spec_helper'
3
3
  describe Arachni::BrowserCluster::Job::Result do
4
4
  let(:job) { Factory[:custom_job] }
5
5
  subject { described_class.new }
6
- it { should respond_to :job }
7
- it { should respond_to :job= }
6
+ it { is_expected.to respond_to :job }
7
+ it { is_expected.to respond_to :job= }
8
8
 
9
9
  describe '#initialize' do
10
10
  it 'sets the given data via accessors' do
11
- described_class.new( job: job ).job.id.should == job.id
11
+ expect(described_class.new( job: job ).job.id).to eq(job.id)
12
12
  end
13
13
  end
14
14
  end