arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -19,7 +19,7 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
19
19
  Arachni::HTTP::Client.on_complete do |response|
20
20
  next if response.url.include? 'ignore'
21
21
 
22
- response.body.should be_empty
22
+ expect(response.body).to be_empty
23
23
  end
24
24
  end
25
25
 
@@ -52,9 +52,9 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
52
52
  subject.timing_attack_remark_data = h
53
53
 
54
54
  dupped = subject.dup
55
- dupped.should == dupped
56
- dupped.timing_attack_remark_data.should == h
57
- dupped.timing_attack_remark_data.object_id.should_not == h.object_id
55
+ expect(dupped).to eq(dupped)
56
+ expect(dupped.timing_attack_remark_data).to eq(h)
57
+ expect(dupped.timing_attack_remark_data.object_id).not_to eq(h.object_id)
58
58
  end
59
59
  end
60
60
  end
@@ -62,7 +62,7 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
62
62
 
63
63
  describe '#to_rpc_data' do
64
64
  it "does not include 'timing_attack_remark_data'" do
65
- subject.to_rpc_data.should_not include 'timing_attack_remark_data'
65
+ expect(subject.to_rpc_data).not_to include 'timing_attack_remark_data'
66
66
  end
67
67
  end
68
68
 
@@ -74,83 +74,83 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
74
74
  id = subject.timeout_id
75
75
 
76
76
  subject.auditor = '2'
77
- subject.timeout_id.should_not == id
77
+ expect(subject.timeout_id).not_to eq(id)
78
78
 
79
79
  subject.auditor = 1
80
80
  id = subject.timeout_id
81
81
 
82
82
  subject.auditor = 2
83
- subject.timeout_id.should == id
83
+ expect(subject.timeout_id).to eq(id)
84
84
  end
85
85
 
86
86
  it 'takes into account #action' do
87
87
  e = subject.dup
88
- e.stub(:action) { action }
88
+ allow(e).to receive(:action) { action }
89
89
 
90
90
  c = subject.dup
91
- c.stub(:action) { "#{action}2" }
91
+ allow(c).to receive(:action) { "#{action}2" }
92
92
 
93
- e.timeout_id.should_not == c.timeout_id
93
+ expect(e.timeout_id).not_to eq(c.timeout_id)
94
94
  end
95
95
 
96
96
  it 'takes into account #type' do
97
97
  e = subject.dup
98
- e.stub(:type) { :blah }
98
+ allow(e).to receive(:type) { :blah }
99
99
 
100
100
  c = subject.dup
101
- c.stub(:type) { :blooh }
101
+ allow(c).to receive(:type) { :blooh }
102
102
 
103
- e.timeout_id.should_not == c.timeout_id
103
+ expect(e.timeout_id).not_to eq(c.timeout_id)
104
104
  end
105
105
 
106
106
  it 'takes into account #inputs names' do
107
107
  e = subject.dup
108
- e.stub(:inputs) { {input1: 'stuff' } }
108
+ allow(e).to receive(:inputs) { {input1: 'stuff' } }
109
109
 
110
110
  c = subject.dup
111
- c.stub(:inputs) { {input1: 'stuff2' } }
112
- e.timeout_id.should == c.timeout_id
111
+ allow(c).to receive(:inputs) { {input1: 'stuff2' } }
112
+ expect(e.timeout_id).to eq(c.timeout_id)
113
113
 
114
114
  e = subject.dup
115
- e.stub(:inputs) { {input1: 'stuff' } }
115
+ allow(e).to receive(:inputs) { {input1: 'stuff' } }
116
116
 
117
117
  c = subject.dup
118
- c.stub(:inputs) { {input2: 'stuff' } }
118
+ allow(c).to receive(:inputs) { {input2: 'stuff' } }
119
119
 
120
- e.timeout_id.should_not == c.timeout_id
120
+ expect(e.timeout_id).not_to eq(c.timeout_id)
121
121
  end
122
122
 
123
123
  it 'takes into account the #affected_input_value' do
124
124
  e = subject.dup
125
- e.stub(:affected_input_value) { :blah }
125
+ allow(e).to receive(:affected_input_value) { :blah }
126
126
 
127
127
  c = subject.dup
128
- c.stub(:affected_input_value) { :blooh }
128
+ allow(c).to receive(:affected_input_value) { :blooh }
129
129
 
130
- e.timeout_id.should_not == c.timeout_id
130
+ expect(e.timeout_id).not_to eq(c.timeout_id)
131
131
  end
132
132
 
133
133
  it 'takes into account the #affected_input_name' do
134
134
  e = subject.dup
135
- e.stub(:affected_input_name) { :blah }
135
+ allow(e).to receive(:affected_input_name) { :blah }
136
136
 
137
137
  c = subject.dup
138
- c.stub(:affected_input_name) { :blooh }
138
+ allow(c).to receive(:affected_input_name) { :blooh }
139
139
 
140
- e.timeout_id.should_not == c.timeout_id
140
+ expect(e.timeout_id).not_to eq(c.timeout_id)
141
141
  end
142
142
  end
143
143
 
144
144
  describe '#ensure_responsiveness' do
145
145
  context 'when the server is responsive' do
146
146
  it 'returns true' do
147
- subject.ensure_responsiveness.should be_true
147
+ expect(subject.ensure_responsiveness).to be_truthy
148
148
  end
149
149
  end
150
150
  context 'when the server is not responsive' do
151
151
  it 'returns false' do
152
- Arachni::Element::Link.new( url: @url + '/sleep' ).
153
- ensure_responsiveness( 1 ).should be_false
152
+ expect(Arachni::Element::Link.new( url: @url + '/sleep' ).
153
+ ensure_responsiveness( 1 )).to be_falsey
154
154
  end
155
155
  end
156
156
  end
@@ -159,13 +159,13 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
159
159
  context 'when there are candidates' do
160
160
  it 'returns true' do
161
161
  described_class.add_phase_2_candidate subject
162
- described_class.has_candidates?.should be_true
162
+ expect(described_class.has_candidates?).to be_truthy
163
163
  end
164
164
  end
165
165
 
166
166
  context 'when there are no candidates' do
167
167
  it 'returns false' do
168
- described_class.has_candidates?.should be_false
168
+ expect(described_class.has_candidates?).to be_falsey
169
169
  end
170
170
  end
171
171
  end
@@ -185,7 +185,7 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
185
185
  end
186
186
  run
187
187
 
188
- response.body.should be_empty
188
+ expect(response.body).to be_empty
189
189
  end
190
190
 
191
191
  context 'when element submission results in a response with a response time' do
@@ -197,7 +197,7 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
197
197
  end
198
198
  run
199
199
 
200
- candidate.should be_true
200
+ expect(candidate).to be_truthy
201
201
  end
202
202
  end
203
203
 
@@ -216,7 +216,7 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
216
216
  end
217
217
  run
218
218
 
219
- candidate.should be_nil
219
+ expect(candidate).to be_nil
220
220
  end
221
221
  end
222
222
  end
@@ -253,14 +253,14 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
253
253
  end
254
254
  run
255
255
 
256
- candidate.should be_true
256
+ expect(candidate).to be_truthy
257
257
 
258
258
  verified = nil
259
259
  candidate.timing_attack_verify( 1000 ) do
260
260
  verified = true
261
261
  end
262
262
 
263
- verified.should be_nil
263
+ expect(verified).to be_nil
264
264
  end
265
265
  end
266
266
 
@@ -277,7 +277,7 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
277
277
  response = r
278
278
  end
279
279
 
280
- response.should be_kind_of Arachni::HTTP::Response
280
+ expect(response).to be_kind_of Arachni::HTTP::Response
281
281
  end
282
282
  end
283
283
 
@@ -299,14 +299,14 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
299
299
  end
300
300
  run
301
301
 
302
- candidate.should be_true
302
+ expect(candidate).to be_truthy
303
303
 
304
304
  verified = nil
305
305
  candidate.timing_attack_verify( 1000 ) do
306
306
  verified = true
307
307
  end
308
308
 
309
- verified.should be_nil
309
+ expect(verified).to be_nil
310
310
  end
311
311
  end
312
312
 
@@ -327,14 +327,14 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
327
327
  end
328
328
  run
329
329
 
330
- candidate.should be_true
330
+ expect(candidate).to be_truthy
331
331
 
332
332
  verified = nil
333
333
  candidate.timing_attack_verify( 1000 ) do
334
334
  verified = true
335
335
  end
336
336
 
337
- verified.should be_nil
337
+ expect(verified).to be_nil
338
338
  end
339
339
  end
340
340
  end
@@ -357,7 +357,7 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
357
357
  )
358
358
  run
359
359
 
360
- issues.first.remarks[:timing_attack].size.should == 3
360
+ expect(issues.first.remarks[:timing_attack].size).to eq(3)
361
361
  end
362
362
 
363
363
  context 'when the element action matches a skip rule' do
@@ -369,10 +369,10 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
369
369
  end
370
370
 
371
371
  it 'returns false' do
372
- subject.timeout_analysis(
372
+ expect(subject.timeout_analysis(
373
373
  '__TIME__',
374
374
  options.merge( timeout: 2000 )
375
- ).should be_false
375
+ )).to be_falsey
376
376
  end
377
377
  end
378
378
 
@@ -393,8 +393,8 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
393
393
  run
394
394
 
395
395
  issue = issues.first
396
- issue.platform_name.should == :windows
397
- issue.platform_type.should == :os
396
+ expect(issue.platform_name).to eq(:windows)
397
+ expect(issue.platform_type).to eq(:os)
398
398
  end
399
399
  end
400
400
 
@@ -410,8 +410,8 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
410
410
  c.timeout_analysis( '__TIME__', options.merge( timeout: 2000 ) )
411
411
  run
412
412
 
413
- issues.should be_any
414
- issues.flatten.first.vector.seed.should == '8000'
413
+ expect(issues).to be_any
414
+ expect(issues.flatten.first.vector.seed).to eq('8000')
415
415
  end
416
416
  end
417
417
 
@@ -425,8 +425,8 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
425
425
  )
426
426
  run
427
427
 
428
- issues.should be_any
429
- issues.flatten.first.vector.seed.should == '8'
428
+ expect(issues).to be_any
429
+ expect(issues.flatten.first.vector.seed).to eq('8')
430
430
  end
431
431
  end
432
432
 
@@ -445,8 +445,8 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
445
445
  )
446
446
  run
447
447
 
448
- issues.should be_any
449
- issues.flatten.first.response.time.to_i.should == 11
448
+ expect(issues).to be_any
449
+ expect(issues.flatten.first.response.time.to_i).to eq(11)
450
450
  end
451
451
  end
452
452
  end
@@ -10,14 +10,14 @@ describe Arachni::Element::Capabilities::WithScope::Scope do
10
10
 
11
11
  describe '#out?' do
12
12
  it 'returns false' do
13
- subject.should_not be_out
13
+ expect(subject).not_to be_out
14
14
  end
15
15
 
16
16
  context 'when #redundant?' do
17
17
  context 'is true' do
18
18
  it 'returns true' do
19
- subject.stub(:redundant?) { true }
20
- subject.should be_out
19
+ allow(subject).to receive(:redundant?) { true }
20
+ expect(subject).to be_out
21
21
  end
22
22
  end
23
23
  end
@@ -25,8 +25,8 @@ describe Arachni::Element::Capabilities::WithScope::Scope do
25
25
  context "when #{Arachni::OptionGroups::Audit}#element?" do
26
26
  context 'is false' do
27
27
  it 'returns true' do
28
- Arachni::Options.audit.stub(:element?) { false }
29
- subject.should be_out
28
+ allow(Arachni::Options.audit).to receive(:element?) { false }
29
+ expect(subject).to be_out
30
30
  end
31
31
  end
32
32
  end
@@ -1,12 +1,23 @@
1
1
  require 'spec_helper'
2
2
 
3
3
  describe Arachni::Element::Cookie::DOM do
4
- it_should_behave_like 'element_dom', single_input: true, without_node: true
4
+ inputs = { 'param' => '1' }
5
+
6
+ it_should_behave_like 'element_dom'
7
+
8
+ it_should_behave_like 'submittable_dom'
9
+ it_should_behave_like 'inputtable_dom', single_input: true, inputs: inputs
10
+ it_should_behave_like 'mutable_dom', single_input: true, inputs: inputs
11
+ it_should_behave_like 'auditable_dom'
5
12
 
6
13
  def auditable_extract_parameters( page )
7
14
  Hash[[page.document.css('#container').text.split( '=' )]]
8
15
  end
9
16
 
17
+ def run
18
+ auditor.browser_cluster.wait
19
+ end
20
+
10
21
  before :each do
11
22
  @framework = Arachni::Framework.new
12
23
  @page = Arachni::Page.from_url( "#{url}/" )
@@ -18,7 +29,12 @@ describe Arachni::Element::Cookie::DOM do
18
29
  @framework.reset
19
30
  end
20
31
 
32
+ let(:auditor) { @auditor }
33
+
21
34
  subject { parent.dom }
35
+
36
+ let(:url) { web_server_url_for( :cookie_dom ) }
37
+
22
38
  let(:parent) do
23
39
  Arachni::Element::Cookie.new(
24
40
  action: "#{url}/",
@@ -30,8 +46,8 @@ describe Arachni::Element::Cookie::DOM do
30
46
  c.dom.auditor = auditor
31
47
  end
32
48
  end
33
- let(:url) { web_server_url_for( :cookie_dom ) }
34
- let(:auditor) { @auditor }
49
+
50
+
35
51
  let(:inputtable) do
36
52
  Arachni::Element::Cookie.new(
37
53
  action: "#{url}/",
@@ -46,37 +62,37 @@ describe Arachni::Element::Cookie::DOM do
46
62
 
47
63
  describe '#name' do
48
64
  it 'returns the cookie name' do
49
- subject.name.should == parent.name
65
+ expect(subject.name).to eq(parent.name)
50
66
  end
51
67
  end
52
68
 
53
69
  describe '#value' do
54
70
  it 'returns the cookie value' do
55
- subject.value.should == parent.value
71
+ expect(subject.value).to eq(parent.value)
56
72
  end
57
73
  end
58
74
 
59
75
  describe '#to_set_cookie' do
60
76
  it 'returns a string in a Set-Cookie response header format' do
61
- subject.to_set_cookie.should == parent.to_set_cookie
77
+ expect(subject.to_set_cookie).to eq(parent.to_set_cookie)
62
78
  end
63
79
  end
64
80
 
65
81
  describe '#type' do
66
82
  it 'returns :cookie_dom' do
67
- subject.type.should == :cookie_dom
83
+ expect(subject.type).to eq(:cookie_dom)
68
84
  end
69
85
  end
70
86
 
71
87
  describe '.type' do
72
88
  it 'returns :cookie_dom' do
73
- described_class.type.should == :cookie_dom
89
+ expect(described_class.type).to eq(:cookie_dom)
74
90
  end
75
91
  end
76
92
 
77
93
  describe '#parent' do
78
94
  it 'returns the parent element' do
79
- subject.parent.should be_kind_of Arachni::Element::Cookie
95
+ expect(subject.parent).to be_kind_of Arachni::Element::Cookie
80
96
  end
81
97
  end
82
98
 
@@ -91,45 +107,48 @@ describe Arachni::Element::Cookie::DOM do
91
107
 
92
108
  subject.trigger
93
109
 
94
- subject.inputs.should == auditable_extract_parameters( browser.to_page )
110
+ expect(subject.inputs).to eq(auditable_extract_parameters( browser.to_page ))
95
111
  called = true
96
112
  end
97
113
 
98
114
  subject.auditor.browser_cluster.wait
99
- called.should be_true
115
+ expect(called).to be_truthy
100
116
  end
101
117
 
102
118
  it 'returns a playable transition' do
103
119
  inputs = { 'param' => 'The.Dude' }
104
120
  subject.update inputs
105
121
 
106
- transition = nil
122
+ transitions = []
107
123
  called = false
108
124
  subject.with_browser do |browser|
109
125
  subject.browser = browser
110
126
  browser.load subject.page
111
127
 
112
- transition = subject.trigger
128
+ transitions = subject.trigger
113
129
 
114
130
  page = browser.to_page
115
131
 
116
- subject.inputs.should == auditable_extract_parameters( page )
132
+ expect(subject.inputs).to eq(auditable_extract_parameters( page ))
117
133
  called = true
118
134
  end
119
135
 
120
136
  subject.auditor.browser_cluster.wait
121
- called.should be_true
137
+ expect(called).to be_truthy
122
138
 
123
139
  called = false
124
140
  auditor.with_browser do |browser|
125
141
  browser.load subject.page
126
142
 
127
- transition.play browser
128
- auditable_extract_parameters( browser.to_page ).should == inputs
143
+ transitions.each do |transition|
144
+ transition.play browser
145
+ end
146
+
147
+ expect(auditable_extract_parameters( browser.to_page )).to eq(inputs)
129
148
  called = true
130
149
  end
131
150
  auditor.browser_cluster.wait
132
- called.should be_true
151
+ expect(called).to be_truthy
133
152
  end
134
153
  end
135
154