arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -7,21 +7,21 @@ describe Arachni::Framework::Parts::Browser do
7
7
  context 'when #use_browsers? is' do
8
8
  context true do
9
9
  before do
10
- subject.stub(:use_browsers?) { true }
10
+ allow(subject).to receive(:use_browsers?) { true }
11
11
  end
12
12
 
13
13
  it "returns #{Arachni::BrowserCluster}" do
14
- subject.browser_cluster.should be_kind_of Arachni::BrowserCluster
14
+ expect(subject.browser_cluster).to be_kind_of Arachni::BrowserCluster
15
15
  end
16
16
  end
17
17
 
18
18
  context false do
19
19
  before do
20
- subject.stub(:use_browsers?) { false }
20
+ allow(subject).to receive(:use_browsers?) { false }
21
21
  end
22
22
 
23
23
  it 'returns nil' do
24
- subject.browser_cluster.should be_nil
24
+ expect(subject.browser_cluster).to be_nil
25
25
  end
26
26
  end
27
27
  end
@@ -35,7 +35,7 @@ describe Arachni::Framework::Parts::Browser do
35
35
  end
36
36
 
37
37
  it 'returns false' do
38
- subject.use_browsers?.should be_false
38
+ expect(subject.use_browsers?).to be_falsey
39
39
  end
40
40
  end
41
41
 
@@ -45,7 +45,7 @@ describe Arachni::Framework::Parts::Browser do
45
45
  end
46
46
 
47
47
  it 'returns true' do
48
- subject.use_browsers?.should be_true
48
+ expect(subject.use_browsers?).to be_truthy
49
49
  end
50
50
  end
51
51
  end
@@ -57,7 +57,7 @@ describe Arachni::Framework::Parts::Browser do
57
57
  end
58
58
 
59
59
  it 'returns false' do
60
- subject.use_browsers?.should be_false
60
+ expect(subject.use_browsers?).to be_falsey
61
61
  end
62
62
  end
63
63
 
@@ -67,7 +67,7 @@ describe Arachni::Framework::Parts::Browser do
67
67
  end
68
68
 
69
69
  it 'returns true' do
70
- subject.use_browsers?.should be_true
70
+ expect(subject.use_browsers?).to be_truthy
71
71
  end
72
72
  end
73
73
  end
@@ -75,21 +75,21 @@ describe Arachni::Framework::Parts::Browser do
75
75
  context 'when #host_has_browser? is' do
76
76
  context true do
77
77
  before do
78
- subject.stub(:use_browsers?) { true }
78
+ allow(subject).to receive(:use_browsers?) { true }
79
79
  end
80
80
 
81
81
  it 'returns true' do
82
- subject.use_browsers?.should be_true
82
+ expect(subject.use_browsers?).to be_truthy
83
83
  end
84
84
  end
85
85
 
86
86
  context false do
87
87
  before do
88
- subject.stub(:host_has_browser?) { false }
88
+ allow(subject).to receive(:host_has_browser?) { false }
89
89
  end
90
90
 
91
91
  it 'returns false' do
92
- subject.use_browsers?.should be_false
92
+ expect(subject.use_browsers?).to be_falsey
93
93
  end
94
94
  end
95
95
  end
@@ -99,21 +99,21 @@ describe Arachni::Framework::Parts::Browser do
99
99
  context "when #{Arachni::Browser}.has_executable? is" do
100
100
  context true do
101
101
  before do
102
- Arachni::Browser.stub(:has_executable?) { true }
102
+ allow(Arachni::Browser).to receive(:has_executable?) { true }
103
103
  end
104
104
 
105
105
  it 'returns true' do
106
- subject.host_has_browser?.should be_true
106
+ expect(subject.host_has_browser?).to be_truthy
107
107
  end
108
108
  end
109
109
 
110
110
  context false do
111
111
  before do
112
- Arachni::Browser.stub(:has_executable?) { false }
112
+ allow(Arachni::Browser).to receive(:has_executable?) { false }
113
113
  end
114
114
 
115
115
  it 'returns false' do
116
- subject.host_has_browser?.should be_false
116
+ expect(subject.host_has_browser?).to be_falsey
117
117
  end
118
118
  end
119
119
  end
@@ -5,8 +5,8 @@ describe Arachni::Framework::Parts::Check do
5
5
 
6
6
  describe '#checks' do
7
7
  it 'provides access to the check manager' do
8
- subject.checks.is_a?( Arachni::Check::Manager ).should be_true
9
- subject.checks.available.should == %w(taint)
8
+ expect(subject.checks.is_a?( Arachni::Check::Manager )).to be_truthy
9
+ expect(subject.checks.available).to eq(%w(signature))
10
10
  end
11
11
  end
12
12
 
@@ -15,7 +15,7 @@ describe Arachni::Framework::Parts::Check do
15
15
  it 'uses it to filter out checks that do not match it' do
16
16
  subject.list_checks( 'boo' ).size == 0
17
17
 
18
- subject.list_checks( 'taint' ).should == subject.list_checks
18
+ expect(subject.list_checks( 'signature' )).to eq(subject.list_checks)
19
19
  subject.list_checks.size == 1
20
20
  end
21
21
  end
@@ -5,7 +5,7 @@ describe Arachni::Framework::Parts::Data do
5
5
 
6
6
  describe '#data' do
7
7
  it "returns #{Arachni::Data::Framework}" do
8
- subject.data.should be_kind_of Arachni::Data::Framework
8
+ expect(subject.data).to be_kind_of Arachni::Data::Framework
9
9
  end
10
10
  end
11
11
 
@@ -14,10 +14,10 @@ describe Arachni::Framework::Parts::Data do
14
14
  Arachni::Framework.new do |f|
15
15
  f.options.url = "#{@url}/"
16
16
  f.options.audit.elements :links, :forms, :cookies
17
- f.checks.load :taint
17
+ f.checks.load :signature
18
18
 
19
19
  f.run
20
- f.sitemap.should == { "#{@url}/" => 200 }
20
+ expect(f.sitemap).to eq({ "#{@url}/" => 200 })
21
21
  end
22
22
  end
23
23
  end
@@ -27,33 +27,33 @@ describe Arachni::Framework::Parts::Data do
27
27
 
28
28
  it 'pushes it to the page audit queue and returns true' do
29
29
  subject.options.audit.elements :links, :forms, :cookies
30
- subject.checks.load :taint
30
+ subject.checks.load :signature
31
31
 
32
- subject.page_queue_total_size.should == 0
33
- subject.push_to_page_queue( page ).should be_true
32
+ expect(subject.page_queue_total_size).to eq(0)
33
+ expect(subject.push_to_page_queue( page )).to be_truthy
34
34
  subject.run
35
35
 
36
- subject.report.issues.size.should == 1
37
- subject.page_queue_total_size.should > 0
36
+ expect(subject.report.issues.size).to eq(1)
37
+ expect(subject.page_queue_total_size).to be > 0
38
38
  end
39
39
 
40
40
  it 'updates the #sitemap with the DOM URL' do
41
41
  subject.options.audit.elements :links, :forms, :cookies
42
- subject.checks.load :taint
42
+ subject.checks.load :signature
43
43
 
44
- subject.sitemap.should be_empty
44
+ expect(subject.sitemap).to be_empty
45
45
 
46
46
  page = Arachni::Page.from_url( @url + '/link' )
47
47
  page.dom.url = @url + '/link/#/stuff'
48
48
 
49
49
  subject.push_to_page_queue page
50
- subject.sitemap.should include @url + '/link/#/stuff'
50
+ expect(subject.sitemap).to include @url + '/link/#/stuff'
51
51
  end
52
52
 
53
53
  it "passes it to #{Arachni::ElementFilter}#update_from_page_cache" do
54
54
  page = Arachni::Page.from_url( @url + '/link' )
55
55
 
56
- Arachni::ElementFilter.should receive(:update_from_page_cache).with(page)
56
+ expect(Arachni::ElementFilter).to receive(:update_from_page_cache).with(page)
57
57
 
58
58
  subject.push_to_page_queue page
59
59
  end
@@ -62,58 +62,58 @@ describe Arachni::Framework::Parts::Data do
62
62
  it 'ignores it' do
63
63
  page = Arachni::Page.from_url( @url + '/stuff' )
64
64
 
65
- subject.page_queue_total_size.should == 0
65
+ expect(subject.page_queue_total_size).to eq(0)
66
66
  subject.push_to_page_queue( page )
67
67
  subject.push_to_page_queue( page )
68
68
  subject.push_to_page_queue( page )
69
- subject.page_queue_total_size.should == 1
69
+ expect(subject.page_queue_total_size).to eq(1)
70
70
  end
71
71
 
72
72
  it 'returns false' do
73
73
  page = Arachni::Page.from_url( @url + '/stuff' )
74
74
 
75
- subject.page_queue_total_size.should == 0
76
- subject.push_to_page_queue( page ).should be_true
77
- subject.push_to_page_queue( page ).should be_false
78
- subject.push_to_page_queue( page ).should be_false
79
- subject.page_queue_total_size.should == 1
75
+ expect(subject.page_queue_total_size).to eq(0)
76
+ expect(subject.push_to_page_queue( page )).to be_truthy
77
+ expect(subject.push_to_page_queue( page )).to be_falsey
78
+ expect(subject.push_to_page_queue( page )).to be_falsey
79
+ expect(subject.page_queue_total_size).to eq(1)
80
80
  end
81
81
  end
82
82
 
83
83
  context 'when #accepts_more_pages?' do
84
84
  context false do
85
85
  it 'returns false' do
86
- subject.stub(:accepts_more_pages?) { false }
87
- subject.push_to_page_queue( page ).should be_false
86
+ allow(subject).to receive(:accepts_more_pages?) { false }
87
+ expect(subject.push_to_page_queue( page )).to be_falsey
88
88
  end
89
89
  end
90
90
 
91
91
  context true do
92
92
  it 'returns true' do
93
- subject.stub(:accepts_more_pages?) { true }
94
- subject.push_to_page_queue( page ).should be_true
93
+ allow(subject).to receive(:accepts_more_pages?) { true }
94
+ expect(subject.push_to_page_queue( page )).to be_truthy
95
95
  end
96
96
  end
97
97
  end
98
98
 
99
99
  context "when #{Arachni::Page::Scope}#out? is true" do
100
100
  it 'returns false' do
101
- Arachni::Page::Scope.any_instance.stub(:out?) { true }
102
- subject.push_to_page_queue( page ).should be_false
101
+ allow_any_instance_of(Arachni::Page::Scope).to receive(:out?) { true }
102
+ expect(subject.push_to_page_queue( page )).to be_falsey
103
103
  end
104
104
  end
105
105
 
106
106
  context "when #{Arachni::URI::Scope}#redundant? is true" do
107
107
  it 'returns false' do
108
- Arachni::Page::Scope.any_instance.stub(:redundant?) { true }
109
- subject.push_to_page_queue( page ).should be_false
108
+ allow_any_instance_of(Arachni::Page::Scope).to receive(:redundant?) { true }
109
+ expect(subject.push_to_page_queue( page )).to be_falsey
110
110
  end
111
111
  end
112
112
 
113
113
  context "when #{Arachni::Page::Scope}#auto_redundant? is true" do
114
114
  it 'returns false' do
115
- Arachni::Page::Scope.any_instance.stub(:auto_redundant?) { true }
116
- subject.push_to_page_queue( page ).should be_false
115
+ allow_any_instance_of(Arachni::Page::Scope).to receive(:auto_redundant?) { true }
116
+ expect(subject.push_to_page_queue( page )).to be_falsey
117
117
  end
118
118
  end
119
119
  end
@@ -121,65 +121,65 @@ describe Arachni::Framework::Parts::Data do
121
121
  describe '#push_to_url_queue' do
122
122
  it 'pushes a URL to the URL audit queue' do
123
123
  subject.options.audit.elements :links, :forms, :cookies
124
- subject.checks.load :taint
124
+ subject.checks.load :signature
125
125
 
126
- subject.url_queue_total_size.should == 0
127
- subject.push_to_url_queue( @url + '/link' ).should be_true
126
+ expect(subject.url_queue_total_size).to eq(0)
127
+ expect(subject.push_to_url_queue( @url + '/link' )).to be_truthy
128
128
  subject.run
129
129
 
130
- subject.report.issues.size.should == 1
131
- subject.url_queue_total_size.should == 3
130
+ expect(subject.report.issues.size).to eq(1)
131
+ expect(subject.url_queue_total_size).to eq(3)
132
132
  end
133
133
 
134
134
  context 'when the URL has already been seen' do
135
135
  it 'returns false' do
136
- subject.push_to_url_queue( @url + '/link' ).should be_true
137
- subject.push_to_url_queue( @url + '/link' ).should be_false
136
+ expect(subject.push_to_url_queue( @url + '/link' )).to be_truthy
137
+ expect(subject.push_to_url_queue( @url + '/link' )).to be_falsey
138
138
  end
139
139
 
140
140
  it 'ignores it' do
141
- subject.url_queue_total_size.should == 0
141
+ expect(subject.url_queue_total_size).to eq(0)
142
142
  subject.push_to_url_queue( @url + '/link' )
143
143
  subject.push_to_url_queue( @url + '/link' )
144
144
  subject.push_to_url_queue( @url + '/link' )
145
- subject.url_queue_total_size.should == 1
145
+ expect(subject.url_queue_total_size).to eq(1)
146
146
  end
147
147
  end
148
148
 
149
149
  context 'when #accepts_more_pages?' do
150
150
  context false do
151
151
  it 'returns false' do
152
- subject.stub(:accepts_more_pages?) { false }
153
- subject.push_to_url_queue( @url ).should be_false
152
+ allow(subject).to receive(:accepts_more_pages?) { false }
153
+ expect(subject.push_to_url_queue( @url )).to be_falsey
154
154
  end
155
155
  end
156
156
 
157
157
  context true do
158
158
  it 'returns true' do
159
- subject.stub(:accepts_more_pages?) { true }
160
- subject.push_to_url_queue( @url ).should be_true
159
+ allow(subject).to receive(:accepts_more_pages?) { true }
160
+ expect(subject.push_to_url_queue( @url )).to be_truthy
161
161
  end
162
162
  end
163
163
  end
164
164
 
165
165
  context "when #{Arachni::URI::Scope}#out? is true" do
166
166
  it 'returns false' do
167
- Arachni::URI::Scope.any_instance.stub(:out?) { true }
168
- subject.push_to_url_queue( @url ).should be_false
167
+ allow_any_instance_of(Arachni::URI::Scope).to receive(:out?) { true }
168
+ expect(subject.push_to_url_queue( @url )).to be_falsey
169
169
  end
170
170
  end
171
171
 
172
172
  context "when #{Arachni::URI::Scope}#redundant? is true" do
173
173
  it 'returns false' do
174
- Arachni::URI::Scope.any_instance.stub(:redundant?) { true }
175
- subject.push_to_url_queue( @url ).should be_false
174
+ allow_any_instance_of(Arachni::URI::Scope).to receive(:redundant?) { true }
175
+ expect(subject.push_to_url_queue( @url )).to be_falsey
176
176
  end
177
177
  end
178
178
 
179
179
  context "when #{Arachni::URI::Scope}#auto_redundant? is true" do
180
180
  it 'returns false' do
181
- Arachni::URI::Scope.any_instance.stub(:auto_redundant?) { true }
182
- subject.push_to_url_queue( @url ).should be_false
181
+ allow_any_instance_of(Arachni::URI::Scope).to receive(:auto_redundant?) { true }
182
+ expect(subject.push_to_url_queue( @url )).to be_falsey
183
183
  end
184
184
  end
185
185
  end
@@ -5,7 +5,7 @@ describe Arachni::Framework::Parts::Platform do
5
5
 
6
6
  describe '#list_platforms' do
7
7
  it 'returns information about all valid platforms' do
8
- subject.list_platforms.should == {
8
+ expect(subject.list_platforms).to eq({
9
9
  'Operating systems' => {
10
10
  unix: 'Generic Unix family',
11
11
  linux: 'Linux',
@@ -61,9 +61,9 @@ describe Arachni::Framework::Parts::Platform do
61
61
  cherrypy: 'CherryPy',
62
62
  cakephp: 'CakePHP',
63
63
  symfony: 'Symfony',
64
- nette: 'Nette Framework'
64
+ nette: 'Nette'
65
65
  }
66
- }
66
+ })
67
67
  end
68
68
  end
69
69
 
@@ -5,29 +5,30 @@ describe Arachni::Framework::Parts::Plugin do
5
5
 
6
6
  describe '#plugins' do
7
7
  it 'provides access to the plugin manager' do
8
- subject.plugins.is_a?( Arachni::Plugin::Manager ).should be_true
9
- subject.plugins.available.sort.should ==
8
+ expect(subject.plugins.is_a?( Arachni::Plugin::Manager )).to be_truthy
9
+ expect(subject.plugins.available.sort).to eq(
10
10
  %w(wait bad with_options distributable loop default suspendable).sort
11
+ )
11
12
  end
12
13
  end
13
14
 
14
15
  describe '#list_plugins' do
15
16
  it 'returns info on all plugins' do
16
- subject.list_plugins.size.should == subject.plugins.available.size
17
+ expect(subject.list_plugins.size).to eq(subject.plugins.available.size)
17
18
 
18
19
  info = subject.list_plugins.find { |p| p[:options].any? }
19
20
  plugin = subject.plugins[info[:shortname]]
20
21
 
21
22
  plugin.info.each do |k, v|
22
23
  if k == :author
23
- info[k].should == [v].flatten
24
+ expect(info[k]).to eq([v].flatten)
24
25
  next
25
26
  end
26
27
 
27
- info[k].should == v
28
+ expect(info[k]).to eq(v)
28
29
  end
29
30
 
30
- info[:shortname].should == plugin.shortname
31
+ expect(info[:shortname]).to eq(plugin.shortname)
31
32
  end
32
33
 
33
34
  context 'when a pattern is given' do
@@ -5,28 +5,28 @@ describe Arachni::Framework::Parts::Report do
5
5
 
6
6
  describe '#reporters' do
7
7
  it 'provides access to the reporter manager' do
8
- subject.reporters.is_a?( Arachni::Reporter::Manager ).should be_true
9
- subject.reporters.available.sort.should == %w(afr foo error).sort
8
+ expect(subject.reporters.is_a?( Arachni::Reporter::Manager )).to be_truthy
9
+ expect(subject.reporters.available.sort).to eq(%w(afr foo error).sort)
10
10
  end
11
11
  end
12
12
 
13
13
  describe '#list_reporters' do
14
14
  it 'returns info on all reporters' do
15
- subject.list_reporters.size.should == subject.reporters.available.size
15
+ expect(subject.list_reporters.size).to eq(subject.reporters.available.size)
16
16
 
17
17
  info = subject.list_reporters.find { |p| p[:options].any? }
18
18
  report = subject.reporters[info[:shortname]]
19
19
 
20
20
  report.info.each do |k, v|
21
21
  if k == :author
22
- info[k].should == [v].flatten
22
+ expect(info[k]).to eq([v].flatten)
23
23
  next
24
24
  end
25
25
 
26
- info[k].should == v
26
+ expect(info[k]).to eq(v)
27
27
  end
28
28
 
29
- info[:shortname].should == report.shortname
29
+ expect(info[:shortname]).to eq(report.shortname)
30
30
  end
31
31
 
32
32
  context 'when a pattern is given' do
@@ -46,7 +46,7 @@ describe Arachni::Framework::Parts::Report do
46
46
  context 'when passed a valid reporter name' do
47
47
  it 'returns the reporter as a string' do
48
48
  json = @new_framework.report_as( :json )
49
- JSON.load( json )['issues'].size.should == @new_framework.report.issues.size
49
+ expect(JSON.load( json )['issues'].size).to eq(@new_framework.report.issues.size)
50
50
  end
51
51
 
52
52
  context 'which does not support the \'outfile\' option' do