arachni 1.2.1 → 1.3

data/components/checks/passive/grep/x_frame_options.rb

@@ -17,7 +17,7 @@ class Arachni::Checks::XFrameOptions < Arachni::Check::Base
 
         log(
             vector: Element::Server.new( page.url ),
-            proof:  page.response.headers_string
+            proof:  page.response.status_line
         )
     end
 
@@ -54,7 +54,7 @@ embedded into other sites.
                 cwe:         693,
                 severity:    Severity::LOW,
                 remedy_guidance: %q{
-Configure your web server to include an X-Frame-Options header.
+Configure your web server to include an `X-Frame-Options` header.
 }
             }
         }

data/components/checks/passive/http_put.rb

@@ -20,7 +20,7 @@ class Arachni::Checks::HttpPut < Arachni::Check::Base
     end
 
     def run
-        path = get_path( page.url ) + 'Arachni-' + random_seed.to_s[0..4].to_s
+        path = "#{get_path( page.url )}Arachni-#{random_seed}"
         return if audited?( path )
         audited( path )
 
@@ -44,7 +44,6 @@ class Arachni::Checks::HttpPut < Arachni::Check::Base
             response: put_response,
             proof:    put_response.status_line
         )
-        print_ok "File has been created: #{response.url}"
     end
 
     def self.info
@@ -53,7 +52,7 @@ class Arachni::Checks::HttpPut < Arachni::Check::Base
             description: %q{Checks if uploading files is possible using the HTTP PUT method.},
             elements:    [ Element::Server ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.2',
+            version:     '0.2.3',
 
             issue:       {
                 name:            %q{Publicly writable directory},

data/components/path_extractors/comments.rb

@@ -9,15 +9,15 @@
 # Extract paths from HTML comments.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2
+# @version 0.2.1
 class Arachni::Parser::Extractors::Comments < Arachni::Parser::Extractors::Base
 
     def run
         return [] if !includes?( '<!--' )
 
         document.xpath( '//comment()' ).map do |comment|
-            comment.text.scan( /(\/[\/a-zA-Z0-9%._-]+)/ )
-        end.flatten.select { |s| s.include? '/' }
+            comment.text.scan( /(^|\s)(\/[\/a-zA-Z0-9%._-]+)/ )
+        end.flatten.select { |s| s.start_with? '/' }
     end
 
 end

data/components/path_extractors/scripts.rb

@@ -19,7 +19,16 @@ class Arachni::Parser::Extractors::Scripts < Arachni::Parser::Extractors::Base
         document.search( '//script[@src]' ).map { |a| a['src'] } |
             document.xpath( '//script' ).map(&:text).join.
                 scan( /[\/a-zA-Z0-9%._-]+/ ).
-                select { |s| s.include?( '.' ) && s.include?( '/' ) }
+                select do |s|
+                    # String looks like a path, but don't get fooled by comments.
+                    s.include?( '.' ) && s.include?( '/' )  &&
+                    !s.include?( '*' ) && !s.start_with?( '//' ) &&
+
+                    # Require absolute paths, otherwise we may get caught in
+                    # a loop, this context isn't the most reliable for extracting
+                    # real paths.
+                    s.start_with?( '/' )
+                end
     end
 
 end

data/components/plugins/defaults/autothrottle.rb

@@ -9,20 +9,21 @@
 # Auto adjusts HTTP throughput for maximum network utilization.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.5
 class Arachni::Plugins::AutoThrottle < Arachni::Plugin::Base
 
     is_distributable
 
     # Will decrease concurrency if the average response time for each burst is
     # above this threshold.
-    THRESHOLD = 0.9
+    #
+    # One second per response does not exactly say healthy server.
+    THRESHOLD = 1
 
     # Easy on the throttle.
     STEP_UP   = 1
 
     # Hard on the breaks.
-    STEP_DOWN = -3
+    STEP_DOWN = -2
 
     # Don't drop bellow this.
     MIN_CONCURRENCY = 2
@@ -30,29 +31,37 @@ class Arachni::Plugins::AutoThrottle < Arachni::Plugin::Base
     def prepare
         http = framework.http
 
-        # run for each response as it arrives
+        # Run for each response as it arrives
         http.on_complete do
-            # adjust on a per-burst basis
+            # Adjust on a per-burst basis.
             next if http.burst_response_count == 0 ||
                 http.burst_response_count % http.max_concurrency != 0
 
-            if( http.max_concurrency > MIN_CONCURRENCY &&
-                http.burst_average_response_time > THRESHOLD ) ||
-                http.max_concurrency > framework.options.http.request_concurrency
+            response_time = http.burst_average_response_time
 
-                step = http.max_concurrency + STEP_DOWN < MIN_CONCURRENCY ?
-                    MIN_CONCURRENCY - http.max_concurrency : STEP_DOWN
+            if http.max_concurrency > MIN_CONCURRENCY &&
+                response_time >= THRESHOLD
 
-                http.max_concurrency = http.max_concurrency + step
-                print_info "Decreasing HTTP request concurrency to #{http.max_concurrency} (#{step})."
-                print_info "Average response time for this burst: #{http.burst_average_response_time}"
+                # No-matter what, don't fall bellow the minimum concurrency.
+                http.max_concurrency = [
+                    http.max_concurrency + STEP_DOWN,
+                    MIN_CONCURRENCY
+                ].max
 
-            elsif http.burst_average_response_time < THRESHOLD &&
-                http.max_concurrency < framework.options.http.request_concurrency
+                print_info "Decreasing HTTP request concurrency to #{http.max_concurrency}."
+                print_info "Average response time for this burst: #{response_time}"
+
+            elsif http.max_concurrency < http.original_max_concurrency &&
+                response_time < THRESHOLD
+
+                # No-matter what, don't exceed the original maximum concurrency.
+                http.max_concurrency = [
+                    http.max_concurrency + STEP_UP,
+                    http.original_max_concurrency
+                ].min
 
-                http.max_concurrency = http.max_concurrency + STEP_UP
                 print_info "Increasing HTTP request concurrency to #{http.max_concurrency} (+#{STEP_UP})."
-                print_info "Average response time for this burst: #{http.burst_average_response_time}"
+                print_info "Average response time for this burst: #{response_time}"
             end
         end
     end
@@ -66,7 +75,7 @@ in order to maintain stability and avoid from killing the server.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
             tags:        %w(meta http throttle),
-            version:     '0.1.5'
+            version:     '0.1.6'
         }
     end
 

data/components/plugins/defaults/meta/remedies/discovery.rb

@@ -16,7 +16,6 @@
 # This is a sort of baseline implementation/anomaly detection.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.3.1
 class Arachni::Plugins::Discovery < Arachni::Plugin::Base
 
     def run
@@ -36,37 +35,35 @@ class Arachni::Plugins::Discovery < Arachni::Plugin::Base
         Data.issues.each do |issue|
             next if !issue.tags.includes_tags?( :discovery )
 
-            issue.variations.each do |variation|
-                # Skip it if already flagged as untrusted.
-                next if variation.untrusted?
-
-                processed_issues += 1
-
-                # We'll do this per path since 404 handlers and such operate per
-                # directory...usually...probably...hopefully.
-                path = File.dirname( uri_parse( variation.vector.action ).path )
-
-                # Gather total response sizes per path.
-                response_size_per_path[path] ||= 0
-                response_size_per_path[path]  += variation.response.body.size
-
-                # Categorize issues per path as well.
-                issue_digests_per_path[path] ||= []
-                issue_digests_per_path[path] << variation.digest
-
-                # Extract the static parts of the responses in order to determine
-                # how much of them doesn't change between requests.
-                #
-                # Large deviations between responses are good because it means that
-                # we're not dealing with some custom not-found response (or something
-                # similar) as these types of responses stay pretty similar.
-                #
-                # On the other hand, valid responses will be dissimilar since the
-                # discovery checks look for different things.
-                diffs_per_path[path] = !diffs_per_path[path] ?
-                    variation.response.body :
-                    diffs_per_path[path].rdiff( variation.response.body )
-            end
+            # Skip it if already flagged as untrusted.
+            next if issue.untrusted?
+
+            processed_issues += 1
+
+            # We'll do this per path since 404 handlers and such operate per
+            # directory...usually...probably...hopefully.
+            path = File.dirname( uri_parse( issue.vector.action ).path )
+
+            # Gather total response sizes per path.
+            response_size_per_path[path] ||= 0
+            response_size_per_path[path]  += issue.response.body.size
+
+            # Categorize issues per path as well.
+            issue_digests_per_path[path] ||= []
+            issue_digests_per_path[path] << issue.digest
+
+            # Extract the static parts of the responses in order to determine
+            # how much of them doesn't change between requests.
+            #
+            # Large deviations between responses are good because it means that
+            # we're not dealing with some custom not-found response (or something
+            # similar) as these types of responses stay pretty similar.
+            #
+            # On the other hand, valid responses will be dissimilar since the
+            # discovery checks look for different things.
+            diffs_per_path[path] = !diffs_per_path[path] ?
+                issue.response.body :
+                diffs_per_path[path].rdiff( issue.response.body )
         end
 
         # Not a lot of sense in comparing a single issue with itself.
@@ -94,7 +91,7 @@ while the server responses were exhibiting an anomalous factor of similarity.
 There's a good chance that these issues are false positives.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.3.1',
+            version:     '0.3.2',
             tags:        %w(anomaly discovery file directories meta)
         }
     end

data/components/plugins/defaults/meta/remedies/timing_attacks.rb

@@ -10,8 +10,6 @@
 # pages returned unusually high response times to begin with.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.3
 class Arachni::Plugins::TimingAttacks < Arachni::Plugin::Base
 
     is_distributable
@@ -61,16 +59,14 @@ class Arachni::Plugins::TimingAttacks < Arachni::Plugin::Base
         @times.each_pair { |url, time| avg[url] = time / @counter[url] }
 
         Data.issues.each do |issue|
-            issue.variations.each do |variation|
-                response_time = avg[uri_parse( variation.vector.action ).up_to_path.persistent_hash]
-                next if !issue.tags.includes_tags?( TAG ) || !response_time ||
-                    response_time < TIME_THRESHOLD
+            response_time = avg[uri_parse( issue.vector.action ).up_to_path.persistent_hash]
+            next if !issue.tags.includes_tags?( TAG ) || !response_time ||
+                response_time < TIME_THRESHOLD
 
-                variation.add_remark :meta_analysis, REMARK
+            issue.add_remark :meta_analysis, REMARK
 
-                # Requires manual verification.
-                variation.trusted = false
-            end
+            # Requires manual verification.
+            issue.trusted = false
         end
     end
 
@@ -90,7 +86,7 @@ Pages with high response times usually include heavy-duty processing which makes
 them prime targets for Denial-of-Service attacks.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.3',
+            version:     '0.3.1',
             tags:        %w(anomaly timing attacks meta)
         }
     end

data/components/plugins/login_script.rb

@@ -14,7 +14,7 @@ class Arachni::Plugins::LoginScript < Arachni::Plugin::Base
     STATUSES  = {
         success:         'Login was successful.',
         failure:         'The script was executed successfully, but the login check failed.',
-        error:           'A runtime error was encountered while executing the login script.',
+        error:           'An error was encountered while executing the login script.',
         missing_browser: 'A browser is required for this operation but is not available.',
         missing_check:   'No session check was provided, either via interface options or the script.'
     }
@@ -43,12 +43,18 @@ class Arachni::Plugins::LoginScript < Arachni::Plugin::Base
         session.record_login_sequence do |browser|
             print_info 'Running the script.'
             @script.call browser ? browser.watir : nil
+
+            # JS run async so we need to wait for the page to settle after
+            # execution.
+            session.browser.wait_till_ready if javascript?
+
             print_info 'Execution completed.'
         end
 
         begin
             session.login( true )
-        rescue => e
+        rescue Exception => e
+            print_exception e
             set_status :error
             return
         end
@@ -171,7 +177,7 @@ in the browser, within the page of the target URL.
 
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2',
+            version:     '0.2.2',
             options:     [
                 Options::Path.new( :script,
                     required:    true,

data/components/plugins/proxy.rb

@@ -78,10 +78,11 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
         end
 
         wait_while_framework_running
-        @server.shutdown
     end
 
     def clean_up
+        @server.shutdown
+
         @pages.each { |p| framework.push_to_page_queue( p, true ) }
         framework_resume
     end
@@ -191,7 +192,7 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
         if shutdown?( url )
             print_status 'Shutting down...'
             set_response_body( res, erb( :shutdown_message ) )
-            @server.shutdown
+            clean_up
             return
         end
 
@@ -497,7 +498,7 @@ a way to restrict usage enough to avoid users unwittingly interfering with each
 others' sessions.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.3.4',
+            version:     '0.3.5',
             options:     [
                 Options::Port.new( :port,
                     description: 'Port to bind to.',

data/components/reporters/html.rb

@@ -271,14 +271,9 @@ access unauthorized pages.
         end
 
         def issue_id( issue )
-            # Trust evaluation needs to come from variations.
-            untrusted = issue.variation? ?
-                issue.untrusted? : issue.variations.first.untrusted?
+            issue = report.issue_by_digest( issue.digest )
 
-            # Generic issue data needs to come from the parent.
-            issue = report.issue_by_digest( issue.digest ) if issue.variation?
-
-            "issues-#{'un' if untrusted}trusted-severity-" <<
+            "issues-#{'un' if issue.untrusted?}trusted-severity-" <<
                 "#{issue.severity}-#{issue.check[:shortname]}-#{issue.digest}"
         end
 
@@ -367,7 +362,7 @@ access unauthorized pages.
 
             grouped_issues[:trusted][by_severity.first.severity] =
                 by_name.inject({}) do |h, (name, issues)|
-                    i = issues.select { |i| !i.variations.find(&:untrusted?) }
+                    i = issues.select(&:trusted?)
                     next h if i.empty?
 
                     h[name] = i
@@ -376,7 +371,7 @@ access unauthorized pages.
 
             grouped_issues[:untrusted][by_severity.first.severity] =
                 by_name.inject({}) do |h, (name, issues)|
-                    i = issues.select { |i| i.variations.find(&:untrusted?) }
+                    i = issues.select(&:untrusted?)
                     next h if i.empty?
 
                     h[name] = i
@@ -445,7 +440,7 @@ access unauthorized pages.
             description:  %q{Exports the audit results as a compressed HTML report.},
             content_type: 'application/zip',
             author:       'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:      '0.4.1',
+            version:      '0.4.2',
             options:      [
                 Options.outfile( '.html.zip' ),
                 Options.skip_responses
@@ -501,9 +496,11 @@ access unauthorized pages.
                 Element::Body.type   => 0,
                 Element::Path.type   => 0,
                 Element::Server.type => 0,
-                Element::GenericDOM.type => 0,
-                Element::JSON.type       => 0,
-                Element::XML.type        => 0
+                Element::GenericDOM.type  => 0,
+                Element::JSON.type        => 0,
+                Element::XML.type         => 0,
+                Element::UIInput::DOM.type  => 0,
+                Element::UIForm::DOM.type => 0
             },
             verification:     {
                 'Yes' => 0,
@@ -564,7 +561,7 @@ access unauthorized pages.
             graph_data[:severity_index_for_issue][issue.name] =
                 Issue::Severity::ORDER.reverse.index( issue.severity.to_sym ) + 1
 
-            if issue.variations.first.trusted?
+            if issue.trusted?
                 has_trusted_issues = true
                 graph_data[:trust]['Trusted'] += 1
                 graph_data[:trusted_severities][issue.severity.to_sym] += 1

data/components/reporters/html/default/issue.erb

@@ -17,9 +17,9 @@
                                 <% end.join( ', ') %>
                             <% end %>
 
-                            <% if issue.variations.first.request %>
+                            <% if issue.request %>
                                 using
-                                <code><%= issue.variations.first.request.method.to_s.upcase %></code>
+                                <code><%= issue.request.method.to_s.upcase %></code>
                             <% end %>
                         </a>
 
@@ -37,45 +37,20 @@
                 </div>
 
                 <div class="panel-body">
-                    <% if issue.variations.size == 1 %>
-                            <div class="row">
-                                <div class="col-md-12">
-                                    <%=
-                                        erb 'issue/info.erb',
-                                            issue: issue.variations.first,
-                                            parent_issue: issue,
-                                            id:    issue_id( issue )
-                                    %>
-                                </div>
-                            </div>
-                    <% else %>
-                        <% issue.variations.each.with_index do |v, i| %>
-                                <div class="row">
-                                    <div class="col-md-12">
-                                        <strong>
-                                            <a
-                                            id="<%= issue_id(issue) %>-variation-<%= i %>"
-                                            href="<%= issue_location(issue) %>/variation/<%= i %>">
-                                                Variation <%= i %>
-                                            </a>
-                                        </strong>
-
-                                        <%=
-                                            erb 'issue/info.erb',
-                                                issue: v,
-                                                parent_issue: issue,
-                                                id:    issue_id( v )
-                                        %>
-                                    </div>
-                                </div>
-                        <% end %>
-                    <% end %>
+                    <div class="row">
+                        <div class="col-md-12">
+                            <%=
+                                erb 'issue/info.erb',
+                                    issue: issue,
+                                    id:    issue_id( issue )
+                            %>
+                        </div>
+                    </div>
 
                     <%=
                         erb 'issue/details.erb',
-                            issue:        issue.variations.first,
-                            parent_issue: issue,
-                            id:           issue_id( issue )
+                            issue: issue,
+                            id:    issue_id( issue )
                     %>
                 </div>
             </div>