arachni 1.2.1 → 1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +66 -0
- data/Gemfile +1 -1
- data/README.md +16 -5
- data/components/checks/active/ldap_injection/errors.txt +1 -0
- data/components/checks/active/source_code_disclosure.rb +1 -1
- data/components/checks/active/unvalidated_redirect.rb +6 -6
- data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
- data/components/checks/passive/grep/captcha.rb +14 -5
- data/components/checks/passive/grep/form_upload.rb +7 -3
- data/components/checks/passive/grep/hsts.rb +3 -3
- data/components/checks/passive/grep/html_objects.rb +2 -3
- data/components/checks/passive/grep/http_only_cookies.rb +2 -3
- data/components/checks/passive/grep/insecure_cookies.rb +1 -1
- data/components/checks/passive/grep/password_autocomplete.rb +2 -2
- data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
- data/components/checks/passive/grep/x_frame_options.rb +2 -2
- data/components/checks/passive/http_put.rb +2 -3
- data/components/path_extractors/comments.rb +3 -3
- data/components/path_extractors/scripts.rb +10 -1
- data/components/plugins/defaults/autothrottle.rb +27 -18
- data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
- data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
- data/components/plugins/login_script.rb +9 -3
- data/components/plugins/proxy.rb +4 -3
- data/components/reporters/html.rb +11 -14
- data/components/reporters/html/default/issue.erb +13 -38
- data/components/reporters/html/default/issue/info.erb +1 -1
- data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
- data/components/reporters/stdout.rb +62 -71
- data/components/reporters/xml.rb +26 -40
- data/components/reporters/xml/schema.xsd +43 -89
- data/lib/arachni/browser.rb +52 -3
- data/lib/arachni/browser/javascript.rb +3 -3
- data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
- data/lib/arachni/browser_cluster.rb +61 -0
- data/lib/arachni/browser_cluster/job.rb +21 -1
- data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
- data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
- data/lib/arachni/browser_cluster/worker.rb +5 -0
- data/lib/arachni/check/auditor.rb +22 -12
- data/lib/arachni/data/framework.rb +13 -1
- data/lib/arachni/data/issues.rb +9 -25
- data/lib/arachni/element/base.rb +9 -3
- data/lib/arachni/element/capabilities/analyzable.rb +2 -6
- data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
- data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
- data/lib/arachni/element/capabilities/auditable.rb +0 -6
- data/lib/arachni/element/capabilities/dom_only.rb +61 -0
- data/lib/arachni/element/capabilities/with_dom.rb +3 -1
- data/lib/arachni/element/cookie.rb +35 -5
- data/lib/arachni/element/cookie/dom.rb +13 -4
- data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
- data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
- data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
- data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
- data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
- data/lib/arachni/element/form.rb +12 -1
- data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
- data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/form/dom.rb +9 -3
- data/lib/arachni/element/header.rb +14 -33
- data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
- data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
- data/lib/arachni/element/input/dom.rb +71 -0
- data/lib/arachni/element/json.rb +2 -0
- data/lib/arachni/element/link.rb +3 -0
- data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link/dom.rb +16 -3
- data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/link_template.rb +3 -5
- data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
- data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link_template/dom.rb +16 -3
- data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/server.rb +3 -5
- data/lib/arachni/element/ui_form.rb +106 -0
- data/lib/arachni/element/ui_form/dom.rb +107 -0
- data/lib/arachni/element/ui_input.rb +62 -0
- data/lib/arachni/element/xml.rb +2 -1
- data/lib/arachni/framework.rb +7 -5
- data/lib/arachni/framework/parts/audit.rb +0 -1
- data/lib/arachni/framework/parts/check.rb +1 -0
- data/lib/arachni/framework/parts/data.rb +4 -0
- data/lib/arachni/framework/parts/state.rb +0 -2
- data/lib/arachni/http/client.rb +17 -6
- data/lib/arachni/http/proxy_server.rb +52 -5
- data/lib/arachni/http/request.rb +1 -1
- data/lib/arachni/issue.rb +34 -179
- data/lib/arachni/issue/severity.rb +2 -0
- data/lib/arachni/option_groups/audit.rb +22 -2
- data/lib/arachni/option_groups/browser_cluster.rb +15 -0
- data/lib/arachni/page.rb +3 -2
- data/lib/arachni/parser.rb +24 -5
- data/lib/arachni/platform/manager.rb +1 -2
- data/lib/arachni/rpc/server/framework.rb +3 -4
- data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
- data/lib/arachni/session.rb +1 -1
- data/lib/arachni/trainer.rb +4 -7
- data/lib/arachni/watir/element.rb +12 -1
- data/lib/version +1 -1
- data/spec/arachni/browser/element_locator_spec.rb +43 -43
- data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
- data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
- data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
- data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
- data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
- data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
- data/spec/arachni/browser/javascript_spec.rb +73 -63
- data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
- data/spec/arachni/browser_cluster/job_spec.rb +68 -48
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
- data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
- data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
- data/spec/arachni/browser_cluster_spec.rb +64 -39
- data/spec/arachni/browser_spec.rb +692 -527
- data/spec/arachni/check/auditor_spec.rb +177 -147
- data/spec/arachni/check/base_spec.rb +33 -33
- data/spec/arachni/check/manager_spec.rb +15 -15
- data/spec/arachni/component/base_spec.rb +8 -8
- data/spec/arachni/component/manager_spec.rb +100 -99
- data/spec/arachni/component/options/address_spec.rb +3 -3
- data/spec/arachni/component/options/base_spec.rb +7 -7
- data/spec/arachni/component/options/bool_spec.rb +9 -9
- data/spec/arachni/component/options/float_spec.rb +6 -6
- data/spec/arachni/component/options/int_spec.rb +5 -5
- data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
- data/spec/arachni/component/options/object_spec.rb +2 -2
- data/spec/arachni/component/options/path_spec.rb +3 -3
- data/spec/arachni/component/options/port_spec.rb +5 -5
- data/spec/arachni/component/options/string_spec.rb +3 -3
- data/spec/arachni/component/options/url_spec.rb +4 -4
- data/spec/arachni/component/utilities_spec.rb +2 -2
- data/spec/arachni/data/framework/rpc_spec.rb +10 -9
- data/spec/arachni/data/framework_spec.rb +65 -46
- data/spec/arachni/data/issues_spec.rb +39 -77
- data/spec/arachni/data/plugins_spec.rb +11 -11
- data/spec/arachni/data/session_spec.rb +6 -6
- data/spec/arachni/data_spec.rb +8 -8
- data/spec/arachni/element/body_spec.rb +10 -10
- data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
- data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
- data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
- data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
- data/spec/arachni/element/cookie/dom_spec.rb +37 -18
- data/spec/arachni/element/cookie_spec.rb +206 -139
- data/spec/arachni/element/form/dom_spec.rb +36 -19
- data/spec/arachni/element/form_spec.rb +210 -187
- data/spec/arachni/element/generic_dom_spec.rb +14 -14
- data/spec/arachni/element/header_spec.rb +35 -17
- data/spec/arachni/element/json_spec.rb +53 -31
- data/spec/arachni/element/link/dom_spec.rb +46 -28
- data/spec/arachni/element/link_spec.rb +58 -40
- data/spec/arachni/element/link_template/dom_spec.rb +47 -29
- data/spec/arachni/element/link_template_spec.rb +79 -61
- data/spec/arachni/element/path_spec.rb +1 -1
- data/spec/arachni/element/server_spec.rb +33 -32
- data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
- data/spec/arachni/element/ui_form_spec.rb +242 -0
- data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
- data/spec/arachni/element/ui_input_spec.rb +136 -0
- data/spec/arachni/element/xml_spec.rb +42 -24
- data/spec/arachni/element_filter_spec.rb +49 -48
- data/spec/arachni/error_spec.rb +3 -3
- data/spec/arachni/framework/parts/audit_spec.rb +64 -63
- data/spec/arachni/framework/parts/browser_spec.rb +16 -16
- data/spec/arachni/framework/parts/check_spec.rb +3 -3
- data/spec/arachni/framework/parts/data_spec.rb +48 -48
- data/spec/arachni/framework/parts/platform_spec.rb +3 -3
- data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
- data/spec/arachni/framework/parts/report_spec.rb +7 -7
- data/spec/arachni/framework/parts/scope_spec.rb +16 -16
- data/spec/arachni/framework/parts/state_spec.rb +68 -69
- data/spec/arachni/framework_spec.rb +39 -31
- data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
- data/spec/arachni/http/client_spec.rb +219 -208
- data/spec/arachni/http/cookie_jar_spec.rb +72 -72
- data/spec/arachni/http/headers_spec.rb +14 -14
- data/spec/arachni/http/proxy_server_spec.rb +43 -42
- data/spec/arachni/http/request_spec.rb +105 -103
- data/spec/arachni/http/response/scope_spec.rb +24 -24
- data/spec/arachni/http/response_spec.rb +50 -49
- data/spec/arachni/issue/severity_spec.rb +10 -9
- data/spec/arachni/issue_spec.rb +71 -369
- data/spec/arachni/option_groups/audit_spec.rb +114 -114
- data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
- data/spec/arachni/option_groups/datastore_spec.rb +6 -6
- data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
- data/spec/arachni/option_groups/http_spec.rb +11 -11
- data/spec/arachni/option_groups/input_spec.rb +31 -27
- data/spec/arachni/option_groups/output_spec.rb +2 -2
- data/spec/arachni/option_groups/paths_spec.rb +17 -17
- data/spec/arachni/option_groups/rpc_spec.rb +2 -2
- data/spec/arachni/option_groups/scope_spec.rb +40 -40
- data/spec/arachni/option_groups/session_spec.rb +6 -5
- data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
- data/spec/arachni/options_spec.rb +46 -45
- data/spec/arachni/page/dom/transition_spec.rb +74 -72
- data/spec/arachni/page/dom_spec.rb +35 -35
- data/spec/arachni/page/scope_spec.rb +15 -15
- data/spec/arachni/page_spec.rb +217 -217
- data/spec/arachni/parser_spec.rb +106 -104
- data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
- data/spec/arachni/platform/list_spec.rb +33 -33
- data/spec/arachni/platform/manager_spec.rb +67 -64
- data/spec/arachni/plugin/base_spec.rb +10 -10
- data/spec/arachni/plugin/manager_spec.rb +38 -37
- data/spec/arachni/report_spec.rb +43 -40
- data/spec/arachni/reporter/base_spec.rb +15 -15
- data/spec/arachni/reporter/manager_spec.rb +4 -4
- data/spec/arachni/reporter/options_spec.rb +6 -6
- data/spec/arachni/rpc/client/base_spec.rb +6 -6
- data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
- data/spec/arachni/rpc/client/instance_spec.rb +6 -6
- data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
- data/spec/arachni/rpc/server/base_spec.rb +5 -5
- data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
- data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
- data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
- data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
- data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
- data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
- data/spec/arachni/rpc/server/framework_spec.rb +90 -85
- data/spec/arachni/rpc/server/instance_spec.rb +126 -107
- data/spec/arachni/rpc/server/output_spec.rb +1 -1
- data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
- data/spec/arachni/ruby/array_spec.rb +42 -42
- data/spec/arachni/ruby/hash_spec.rb +20 -18
- data/spec/arachni/ruby/io_spec.rb +2 -2
- data/spec/arachni/ruby/object_spec.rb +1 -1
- data/spec/arachni/ruby/set_spec.rb +3 -3
- data/spec/arachni/ruby/string_spec.rb +30 -30
- data/spec/arachni/ruby/webrick_spec.rb +2 -2
- data/spec/arachni/scope_spec.rb +1 -1
- data/spec/arachni/session_spec.rb +67 -64
- data/spec/arachni/snapshot_spec.rb +15 -15
- data/spec/arachni/state/audit_spec.rb +11 -11
- data/spec/arachni/state/element_filter_spec.rb +6 -6
- data/spec/arachni/state/framework/rpc_spec.rb +12 -12
- data/spec/arachni/state/framework_spec.rb +125 -121
- data/spec/arachni/state/http_spec.rb +7 -7
- data/spec/arachni/state/options_spec.rb +7 -7
- data/spec/arachni/state/plugins_spec.rb +8 -8
- data/spec/arachni/state_spec.rb +10 -10
- data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
- data/spec/arachni/support/buffer/base_spec.rb +39 -39
- data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
- data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
- data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
- data/spec/arachni/support/cache/preference_spec.rb +4 -4
- data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
- data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
- data/spec/arachni/support/database/hash_spec.rb +44 -43
- data/spec/arachni/support/database/queue_spec.rb +27 -27
- data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
- data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
- data/spec/arachni/support/mixins/observable_spec.rb +6 -6
- data/spec/arachni/support/signature_spec.rb +19 -19
- data/spec/arachni/trainer_spec.rb +39 -39
- data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
- data/spec/arachni/uri/scope_spec.rb +66 -66
- data/spec/arachni/uri_spec.rb +107 -105
- data/spec/arachni/utilities_spec.rb +40 -40
- data/spec/components/checks/active/csrf_spec.rb +8 -8
- data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
- data/spec/components/checks/active/sql_injection_spec.rb +16 -16
- data/spec/components/checks/active/trainer_spec.rb +4 -4
- data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
- data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
- data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
- data/spec/components/checks/active/xss_dom_spec.rb +46 -24
- data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
- data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
- data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
- data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
- data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
- data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
- data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
- data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
- data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
- data/spec/components/checks/passive/webdav_spec.rb +1 -1
- data/spec/components/checks/passive/xst_spec.rb +1 -1
- data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
- data/spec/components/path_extractors/comments_spec.rb +5 -1
- data/spec/components/path_extractors/scripts_spec.rb +5 -2
- data/spec/components/plugins/autologin_spec.rb +22 -22
- data/spec/components/plugins/autothrottle_spec.rb +6 -5
- data/spec/components/plugins/content_types_spec.rb +4 -4
- data/spec/components/plugins/cookie_collector_spec.rb +5 -5
- data/spec/components/plugins/exec_spec.rb +12 -12
- data/spec/components/plugins/form_dicattack_spec.rb +3 -3
- data/spec/components/plugins/headers_collector_spec.rb +8 -8
- data/spec/components/plugins/healthmap_spec.rb +3 -3
- data/spec/components/plugins/http_dicattack_spec.rb +3 -3
- data/spec/components/plugins/login_script_spec.rb +79 -22
- data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
- data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
- data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
- data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
- data/spec/components/plugins/script_spec.rb +1 -1
- data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
- data/spec/components/plugins/vector_collector_spec.rb +2 -2
- data/spec/components/plugins/vector_feed_spec.rb +40 -40
- data/spec/components/plugins/waf_detector_spec.rb +6 -6
- data/spec/components/reporters/json_spec.rb +4 -4
- data/spec/components/reporters/marshal_spec.rb +2 -2
- data/spec/components/reporters/yaml_spec.rb +3 -2
- data/spec/external/wavsep/active/sqli_spec.rb +1 -3
- data/spec/spec_helper.rb +4 -0
- data/spec/support/factories/element/ui_form.rb +14 -0
- data/spec/support/factories/element/ui_input.rb +13 -0
- data/spec/support/factories/issue.rb +0 -13
- data/spec/support/fixtures/report.afr +0 -0
- data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
- data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
- data/spec/support/helpers/framework.rb +1 -1
- data/spec/support/helpers/pages.rb +2 -2
- data/spec/support/servers/arachni/browser.rb +139 -0
- data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
- data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
- data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
- data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
- data/spec/support/servers/checks/active/trainer_check.rb +7 -7
- data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
- data/spec/support/servers/checks/active/xss_dom.rb +50 -0
- data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
- data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
- data/spec/support/shared/check.rb +10 -12
- data/spec/support/shared/component/options/base.rb +24 -24
- data/spec/support/shared/element/base.rb +25 -25
- data/spec/support/shared/element/capabilities/auditable.rb +116 -140
- data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
- data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
- data/spec/support/shared/element/capabilities/mutable.rb +122 -111
- data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
- data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
- data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
- data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
- data/spec/support/shared/element/capabilities/with_node.rb +4 -6
- data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
- data/spec/support/shared/element/capabilities/with_source.rb +6 -8
- data/spec/support/shared/element/dom.rb +144 -0
- data/spec/support/shared/element/dom/auditable.rb +42 -0
- data/spec/support/shared/element/dom/inputtable.rb +5 -0
- data/spec/support/shared/element/dom/mutable.rb +3 -0
- data/spec/support/shared/element/dom/submittable.rb +119 -0
- data/spec/support/shared/external/wavsep.rb +3 -3
- data/spec/support/shared/fingerprinter.rb +2 -2
- data/spec/support/shared/framework.rb +1 -1
- data/spec/support/shared/http/message.rb +9 -9
- data/spec/support/shared/option_group.rb +17 -17
- data/spec/support/shared/path_extractor.rb +1 -1
- data/spec/support/shared/plugin.rb +2 -2
- data/spec/support/shared/support/cache.rb +57 -57
- data/spec/support/shared/support/lookup.rb +25 -25
- data/ui/cli/framework.rb +22 -11
- data/ui/cli/framework/option_parser.rb +15 -0
- data/ui/cli/option_parser.rb +8 -1
- data/ui/cli/output.rb +2 -1
- metadata +54 -20
- data/components/checks/active/xss_dom_inputs.rb +0 -236
- data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
- data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
- data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -5,10 +5,10 @@ describe WEBrick::Cookie do
|
|
5
5
|
describe '.parse_set_cookie' do
|
6
6
|
it 'includes the httponly attribute' do
|
7
7
|
str = "cookie2=val2; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com; HttpOnly"
|
8
|
-
WEBrick::Cookie.parse_set_cookie( str ).httponly.
|
8
|
+
expect(WEBrick::Cookie.parse_set_cookie( str ).httponly).to be_truthy
|
9
9
|
|
10
10
|
str = "cookie2=val2; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com"
|
11
|
-
WEBrick::Cookie.parse_set_cookie( str ).httponly.
|
11
|
+
expect(WEBrick::Cookie.parse_set_cookie( str ).httponly).to be_falsey
|
12
12
|
end
|
13
13
|
end
|
14
14
|
|
data/spec/arachni/scope_spec.rb
CHANGED
@@ -37,7 +37,7 @@ describe Arachni::Session do
|
|
37
37
|
describe '#has_login_check?' do
|
38
38
|
context 'when #check_url and #check_pattern have not been configured' do
|
39
39
|
it 'returns false' do
|
40
|
-
subject.has_login_check
|
40
|
+
expect(subject.has_login_check?).to be_falsey
|
41
41
|
end
|
42
42
|
end
|
43
43
|
|
@@ -46,7 +46,7 @@ describe Arachni::Session do
|
|
46
46
|
@opts.session.check_url = @url
|
47
47
|
@opts.session.check_pattern = 'logged-in user'
|
48
48
|
|
49
|
-
subject.has_login_check
|
49
|
+
expect(subject.has_login_check?).to be_truthy
|
50
50
|
end
|
51
51
|
end
|
52
52
|
end
|
@@ -56,53 +56,54 @@ describe Arachni::Session do
|
|
56
56
|
context "when #{Arachni::OptionGroups::Scope}#dom_depth_limit is 0" do
|
57
57
|
it 'returns false' do
|
58
58
|
Arachni::Options.scope.dom_depth_limit = 0
|
59
|
-
subject.has_browser
|
59
|
+
expect(subject.has_browser?).to be_falsey
|
60
60
|
end
|
61
61
|
end
|
62
62
|
|
63
63
|
context "when not #{Arachni::Browser}.has_executable?" do
|
64
64
|
it 'returns false' do
|
65
|
-
Arachni::Browser.
|
66
|
-
subject.has_browser
|
65
|
+
allow(Arachni::Browser).to receive(:has_executable?) { false }
|
66
|
+
expect(subject.has_browser?).to be_falsey
|
67
67
|
end
|
68
68
|
end
|
69
69
|
end
|
70
70
|
|
71
71
|
describe '#configuration' do
|
72
72
|
it "returns #{Arachni::Data::Session}#configuration" do
|
73
|
-
subject.configuration.object_id.
|
73
|
+
expect(subject.configuration.object_id).to eq(
|
74
74
|
Arachni::Data.session.configuration.object_id
|
75
|
+
)
|
75
76
|
end
|
76
77
|
end
|
77
78
|
|
78
79
|
describe '#clean_up' do
|
79
80
|
it 'shuts down the #browser' do
|
80
81
|
configured.login
|
81
|
-
configured.
|
82
|
+
expect(configured).to be_logged_in
|
82
83
|
|
83
84
|
browser = configured.browser
|
84
85
|
configured.clean_up
|
85
|
-
browser.
|
86
|
+
expect(browser).to be_nil
|
86
87
|
end
|
87
88
|
|
88
89
|
it 'clears the #configuration' do
|
89
|
-
configured.
|
90
|
+
expect(configured).to be_configured
|
90
91
|
configured.clean_up
|
91
|
-
configured.
|
92
|
+
expect(configured).not_to be_configured
|
92
93
|
end
|
93
94
|
end
|
94
95
|
|
95
96
|
describe '#browser' do
|
96
97
|
context 'before calling #login' do
|
97
98
|
it 'returns nil' do
|
98
|
-
configured.browser.
|
99
|
+
expect(configured.browser).to be_nil
|
99
100
|
end
|
100
101
|
end
|
101
102
|
|
102
103
|
context 'after #login' do
|
103
104
|
it 'kills the browser' do
|
104
105
|
configured.login
|
105
|
-
configured.browser.
|
106
|
+
expect(configured.browser).to be_nil
|
106
107
|
end
|
107
108
|
end
|
108
109
|
end
|
@@ -118,7 +119,7 @@ describe Arachni::Session do
|
|
118
119
|
|
119
120
|
subject.login
|
120
121
|
|
121
|
-
b.
|
122
|
+
expect(b).to be_kind_of Arachni::Browser
|
122
123
|
end
|
123
124
|
|
124
125
|
it 'updates the system cookies from the browser' do
|
@@ -129,12 +130,12 @@ describe Arachni::Session do
|
|
129
130
|
|
130
131
|
subject.login
|
131
132
|
|
132
|
-
Arachni::HTTP::Client.cookies.find { |c| c.name == 'foo' }.
|
133
|
+
expect(Arachni::HTTP::Client.cookies.find { |c| c.name == 'foo' }).to be_truthy
|
133
134
|
end
|
134
135
|
end
|
135
136
|
|
136
137
|
context 'when a browser is not available' do
|
137
|
-
before { subject.
|
138
|
+
before { allow(subject).to receive(:has_browser?) { false } }
|
138
139
|
|
139
140
|
it 'does not pass a browser instance' do
|
140
141
|
b = true
|
@@ -144,7 +145,7 @@ describe Arachni::Session do
|
|
144
145
|
|
145
146
|
subject.login
|
146
147
|
|
147
|
-
b.
|
148
|
+
expect(b).to be_nil
|
148
149
|
end
|
149
150
|
end
|
150
151
|
end
|
@@ -152,16 +153,16 @@ describe Arachni::Session do
|
|
152
153
|
context 'when given login form info' do
|
153
154
|
it 'finds and submits the login form with the given credentials' do
|
154
155
|
configured.login
|
155
|
-
configured.
|
156
|
+
expect(configured).to be_logged_in
|
156
157
|
end
|
157
158
|
|
158
159
|
context 'when a browser is not available' do
|
159
|
-
before { subject.
|
160
|
+
before { allow(subject).to receive(:has_browser?) { false } }
|
160
161
|
|
161
162
|
it 'uses the framework Page helpers' do
|
162
|
-
configured.
|
163
|
-
configured.login.
|
164
|
-
configured.
|
163
|
+
expect(configured).not_to be_logged_in
|
164
|
+
expect(configured.login).to be_kind_of Arachni::Page
|
165
|
+
expect(configured).to be_logged_in
|
165
166
|
end
|
166
167
|
end
|
167
168
|
|
@@ -180,26 +181,28 @@ describe Arachni::Session do
|
|
180
181
|
|
181
182
|
subject.login
|
182
183
|
|
183
|
-
subject.
|
184
|
+
expect(subject).to be_logged_in
|
184
185
|
end
|
185
186
|
|
186
187
|
it 'returns the resulting browser evaluated page' do
|
187
|
-
configured.login.
|
188
|
+
expect(configured.login).to be_kind_of Arachni::Page
|
188
189
|
|
189
190
|
transition = configured.login.dom.transitions.first
|
190
|
-
transition.event.
|
191
|
-
transition.element.
|
192
|
-
transition.options[:url].
|
191
|
+
expect(transition.event).to eq(:load)
|
192
|
+
expect(transition.element).to eq(:page)
|
193
|
+
expect(transition.options[:url]).to eq(configured.configuration[:url])
|
193
194
|
|
194
195
|
transition = configured.login.dom.transitions.last
|
195
|
-
transition.event.
|
196
|
-
transition.element.tag_name.
|
196
|
+
expect(transition.event).to eq(:submit)
|
197
|
+
expect(transition.element.tag_name).to eq(:form)
|
197
198
|
|
198
|
-
transition.options[:inputs]['username'].
|
199
|
+
expect(transition.options[:inputs]['username']).to eq(
|
199
200
|
configured.configuration[:inputs][:username]
|
201
|
+
)
|
200
202
|
|
201
|
-
transition.options[:inputs]['password'].
|
203
|
+
expect(transition.options[:inputs]['password']).to eq(
|
202
204
|
configured.configuration[:inputs][:password]
|
205
|
+
)
|
203
206
|
end
|
204
207
|
end
|
205
208
|
end
|
@@ -222,7 +225,7 @@ describe Arachni::Session do
|
|
222
225
|
context 'and a valid session is available' do
|
223
226
|
it 'returns true' do
|
224
227
|
configured.login
|
225
|
-
configured.
|
228
|
+
expect(configured).to be_logged_in
|
226
229
|
end
|
227
230
|
end
|
228
231
|
|
@@ -231,7 +234,7 @@ describe Arachni::Session do
|
|
231
234
|
@opts.session.check_url = @url
|
232
235
|
@opts.session.check_pattern = 'logged-in user'
|
233
236
|
|
234
|
-
subject.
|
237
|
+
expect(subject).not_to be_logged_in
|
235
238
|
end
|
236
239
|
end
|
237
240
|
|
@@ -242,12 +245,12 @@ describe Arachni::Session do
|
|
242
245
|
bool = false
|
243
246
|
configured.logged_in? { |b| bool = b }
|
244
247
|
configured.http.run
|
245
|
-
bool.
|
248
|
+
expect(bool).to be_truthy
|
246
249
|
|
247
250
|
not_bool = true
|
248
251
|
configured.logged_in?( no_cookie_jar: true ) { |b| not_bool = b }
|
249
252
|
configured.http.run
|
250
|
-
not_bool.
|
253
|
+
expect(not_bool).to be_falsey
|
251
254
|
end
|
252
255
|
end
|
253
256
|
end
|
@@ -256,13 +259,13 @@ describe Arachni::Session do
|
|
256
259
|
describe '#configured?' do
|
257
260
|
context 'when login instructions have been provided' do
|
258
261
|
it 'returns true' do
|
259
|
-
configured.configured
|
262
|
+
expect(configured.configured?).to be_truthy
|
260
263
|
end
|
261
264
|
end
|
262
265
|
|
263
266
|
context 'when login instructions have not been provided' do
|
264
267
|
it 'returns false' do
|
265
|
-
subject.configured
|
268
|
+
expect(subject.configured?).to be_falsey
|
266
269
|
end
|
267
270
|
end
|
268
271
|
end
|
@@ -271,7 +274,7 @@ describe Arachni::Session do
|
|
271
274
|
it 'returns session cookies' do
|
272
275
|
subject.http.get @url + '/with_nonce', mode: :sync, update_cookies: true
|
273
276
|
|
274
|
-
subject.cookies.map(&:name).sort.
|
277
|
+
expect(subject.cookies.map(&:name).sort).to eq(%w(rack.session session_cookie).sort)
|
275
278
|
end
|
276
279
|
end
|
277
280
|
|
@@ -289,7 +292,7 @@ describe Arachni::Session do
|
|
289
292
|
# (to make sure that it will be refreshed before logging in)
|
290
293
|
subject.http.get @url + '/nonce_login', mode: :sync
|
291
294
|
|
292
|
-
subject.configured
|
295
|
+
expect(subject.configured?).to be_truthy
|
293
296
|
|
294
297
|
@opts.session.check_url = @url + '/with_nonce'
|
295
298
|
@opts.session.check_pattern = 'logged-in user'
|
@@ -300,9 +303,9 @@ describe Arachni::Session do
|
|
300
303
|
subject.cookie { |c| cookie = c }
|
301
304
|
subject.http.run
|
302
305
|
|
303
|
-
cookie.name.
|
306
|
+
expect(cookie.name).to eq('rack.session')
|
304
307
|
|
305
|
-
subject.can_login
|
308
|
+
expect(subject.can_login?).to be_truthy
|
306
309
|
end
|
307
310
|
|
308
311
|
context 'when called without having configured a login check' do
|
@@ -317,29 +320,29 @@ describe Arachni::Session do
|
|
317
320
|
context 'when passed an array of :pages' do
|
318
321
|
it 'should go through its forms and locate the login one' do
|
319
322
|
p = Arachni::Page.from_url( @url + '/login' )
|
320
|
-
subject.find_login_form( pages: [ p, p ] ).coverage_id.
|
323
|
+
expect(subject.find_login_form( pages: [ p, p ] ).coverage_id).to eq(@id)
|
321
324
|
end
|
322
325
|
end
|
323
326
|
context 'when passed an array of :forms' do
|
324
327
|
it 'should go through its forms and locate the login one' do
|
325
328
|
p = Arachni::Page.from_url( @url + '/login' )
|
326
|
-
subject.find_login_form( forms: p.forms ).coverage_id.
|
329
|
+
expect(subject.find_login_form( forms: p.forms ).coverage_id).to eq(@id)
|
327
330
|
end
|
328
331
|
end
|
329
332
|
context 'when passed a url' do
|
330
333
|
it 'store the cookies set by that url' do
|
331
|
-
Arachni::HTTP::Client.cookies.
|
334
|
+
expect(Arachni::HTTP::Client.cookies).to be_empty
|
332
335
|
|
333
|
-
subject.find_login_form( url: @url + '/login' ).coverage_id.
|
336
|
+
expect(subject.find_login_form( url: @url + '/login' ).coverage_id).to eq(@id)
|
334
337
|
|
335
|
-
Arachni::HTTP::Client.cookies.find do |c|
|
338
|
+
expect(Arachni::HTTP::Client.cookies.find do |c|
|
336
339
|
c.name == 'you_need_to' && c.value == 'preserve this'
|
337
|
-
end.
|
340
|
+
end).to be_kind_of Arachni::Cookie
|
338
341
|
end
|
339
342
|
|
340
343
|
context 'and called without a block' do
|
341
344
|
it 'should operate in blocking mode, go through its forms and locate the login one' do
|
342
|
-
subject.find_login_form( url: @url + '/login' ).coverage_id.
|
345
|
+
expect(subject.find_login_form( url: @url + '/login' ).coverage_id).to eq(@id)
|
343
346
|
end
|
344
347
|
end
|
345
348
|
context 'and called with a block' do
|
@@ -349,33 +352,33 @@ describe Arachni::Session do
|
|
349
352
|
subject.find_login_form( url: @url + '/login' ) { |f| form = f }
|
350
353
|
subject.http.run
|
351
354
|
|
352
|
-
form.coverage_id.
|
355
|
+
expect(form.coverage_id).to eq(@id)
|
353
356
|
end
|
354
357
|
end
|
355
358
|
end
|
356
359
|
context 'when passed an array of :inputs' do
|
357
360
|
it 'should use them to narrow down the list' do
|
358
|
-
subject.find_login_form(
|
361
|
+
expect(subject.find_login_form(
|
359
362
|
url: @url + '/multiple',
|
360
363
|
inputs: :token
|
361
|
-
).coverage_id.
|
364
|
+
).coverage_id).to eq(@id)
|
362
365
|
end
|
363
366
|
end
|
364
367
|
context 'when passed an :action' do
|
365
368
|
context Regexp do
|
366
369
|
it 'should use it to match against form actions' do
|
367
|
-
subject.find_login_form(
|
370
|
+
expect(subject.find_login_form(
|
368
371
|
url: @url + '/multiple',
|
369
372
|
action: /login/
|
370
|
-
).coverage_id.
|
373
|
+
).coverage_id).to eq(@id)
|
371
374
|
end
|
372
375
|
end
|
373
376
|
context String do
|
374
377
|
it 'should use it to match against form actions' do
|
375
|
-
subject.find_login_form(
|
378
|
+
expect(subject.find_login_form(
|
376
379
|
url: @url + '/multiple',
|
377
380
|
action: "#{@url}/login"
|
378
|
-
).coverage_id.
|
381
|
+
).coverage_id).to eq(@id)
|
379
382
|
end
|
380
383
|
end
|
381
384
|
end
|
@@ -384,13 +387,13 @@ describe Arachni::Session do
|
|
384
387
|
describe '#can_login?' do
|
385
388
|
context 'when there are no login sequences' do
|
386
389
|
it 'returns false' do
|
387
|
-
subject.can_login
|
390
|
+
expect(subject.can_login?).to be_falsey
|
388
391
|
end
|
389
392
|
end
|
390
393
|
|
391
394
|
context 'when there are login sequences' do
|
392
395
|
it 'returns true' do
|
393
|
-
configured.can_login
|
396
|
+
expect(configured.can_login?).to be_truthy
|
394
397
|
end
|
395
398
|
end
|
396
399
|
end
|
@@ -409,9 +412,9 @@ describe Arachni::Session do
|
|
409
412
|
}
|
410
413
|
)
|
411
414
|
|
412
|
-
subject.logged_in
|
415
|
+
expect(subject.logged_in?).to be_falsey
|
413
416
|
subject.ensure_logged_in
|
414
|
-
subject.logged_in
|
417
|
+
expect(subject.logged_in?).to be_truthy
|
415
418
|
end
|
416
419
|
end
|
417
420
|
|
@@ -427,9 +430,9 @@ describe Arachni::Session do
|
|
427
430
|
}
|
428
431
|
)
|
429
432
|
|
430
|
-
subject.logged_in
|
433
|
+
expect(subject.logged_in?).to be_falsey
|
431
434
|
subject.ensure_logged_in
|
432
|
-
subject.logged_in
|
435
|
+
expect(subject.logged_in?).to be_falsey
|
433
436
|
end
|
434
437
|
end
|
435
438
|
|
@@ -446,16 +449,16 @@ describe Arachni::Session do
|
|
446
449
|
}
|
447
450
|
)
|
448
451
|
|
449
|
-
subject.logged_in
|
452
|
+
expect(subject.logged_in?).to be_falsey
|
450
453
|
subject.ensure_logged_in
|
451
|
-
subject.logged_in
|
454
|
+
expect(subject.logged_in?).to be_truthy
|
452
455
|
end
|
453
456
|
end
|
454
457
|
|
455
458
|
context 'when there is no login capability' do
|
456
459
|
it 'returns nil' do
|
457
|
-
subject.can_login
|
458
|
-
subject.ensure_logged_in.
|
460
|
+
expect(subject.can_login?).to be_falsey
|
461
|
+
expect(subject.ensure_logged_in).to be_nil
|
459
462
|
end
|
460
463
|
end
|
461
464
|
end
|
@@ -15,11 +15,11 @@ describe Arachni::Snapshot do
|
|
15
15
|
let(:summary) { subject.summary }
|
16
16
|
|
17
17
|
it 'includes :data' do
|
18
|
-
summary[:data].
|
18
|
+
expect(summary[:data]).to eq(Arachni::Data.statistics)
|
19
19
|
end
|
20
20
|
|
21
21
|
it 'includes :state' do
|
22
|
-
summary[:state].
|
22
|
+
expect(summary[:state]).to eq(Arachni::State.statistics)
|
23
23
|
end
|
24
24
|
end
|
25
25
|
|
@@ -29,13 +29,13 @@ describe Arachni::Snapshot do
|
|
29
29
|
subject.dump( dump_archive )
|
30
30
|
subject.load( dump_archive )
|
31
31
|
|
32
|
-
subject.metadata.
|
32
|
+
expect(subject.metadata).to eq(subject.read_metadata( dump_archive ))
|
33
33
|
end
|
34
34
|
end
|
35
35
|
|
36
36
|
context 'when not dealing with a restored snapshot' do
|
37
37
|
it 'returns nil' do
|
38
|
-
subject.metadata.
|
38
|
+
expect(subject.metadata).to be_nil
|
39
39
|
end
|
40
40
|
end
|
41
41
|
end
|
@@ -46,13 +46,13 @@ describe Arachni::Snapshot do
|
|
46
46
|
subject.dump( dump_archive )
|
47
47
|
subject.load( dump_archive )
|
48
48
|
|
49
|
-
subject.
|
49
|
+
expect(subject).to be_restored
|
50
50
|
end
|
51
51
|
end
|
52
52
|
|
53
53
|
context 'when not dealing with a restored snapshot' do
|
54
54
|
it 'returns false' do
|
55
|
-
subject.
|
55
|
+
expect(subject).not_to be_restored
|
56
56
|
end
|
57
57
|
end
|
58
58
|
end
|
@@ -63,13 +63,13 @@ describe Arachni::Snapshot do
|
|
63
63
|
subject.dump( dump_archive )
|
64
64
|
subject.load( dump_archive )
|
65
65
|
|
66
|
-
subject.location.
|
66
|
+
expect(subject.location).to eq(dump_archive)
|
67
67
|
end
|
68
68
|
end
|
69
69
|
|
70
70
|
context 'when not dealing with a restored snapshot' do
|
71
71
|
it 'returns nil' do
|
72
|
-
subject.location.
|
72
|
+
expect(subject.location).to be_nil
|
73
73
|
end
|
74
74
|
end
|
75
75
|
end
|
@@ -81,15 +81,15 @@ describe Arachni::Snapshot do
|
|
81
81
|
end
|
82
82
|
|
83
83
|
it 'includes a :timestamp' do
|
84
|
-
metadata[:timestamp].
|
84
|
+
expect(metadata[:timestamp]).to be_kind_of Time
|
85
85
|
end
|
86
86
|
|
87
87
|
it 'includes a :version' do
|
88
|
-
metadata[:version].
|
88
|
+
expect(metadata[:version]).to eq(Arachni::VERSION)
|
89
89
|
end
|
90
90
|
|
91
91
|
it 'includes a #summary' do
|
92
|
-
metadata[:summary].
|
92
|
+
expect(metadata[:summary]).to eq(subject.summary)
|
93
93
|
end
|
94
94
|
|
95
95
|
context 'when trying to read an invalid file' do
|
@@ -101,8 +101,8 @@ describe Arachni::Snapshot do
|
|
101
101
|
|
102
102
|
describe '.dump' do
|
103
103
|
it "stores #{Arachni::State} to disk" do
|
104
|
-
Arachni::State.
|
105
|
-
Arachni::Data.
|
104
|
+
expect(Arachni::State).to receive(:dump)
|
105
|
+
expect(Arachni::Data).to receive(:dump)
|
106
106
|
|
107
107
|
subject.dump( dump_archive )
|
108
108
|
end
|
@@ -112,8 +112,8 @@ describe Arachni::Snapshot do
|
|
112
112
|
it "stores #{Arachni::State} to disk" do
|
113
113
|
subject.dump( dump_archive )
|
114
114
|
|
115
|
-
Arachni::State.
|
116
|
-
Arachni::Data.
|
115
|
+
expect(Arachni::State).to receive(:load)
|
116
|
+
expect(Arachni::Data).to receive(:load)
|
117
117
|
|
118
118
|
subject.load( dump_archive )
|
119
119
|
end
|