arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -5,10 +5,10 @@ describe WEBrick::Cookie do
5
5
  describe '.parse_set_cookie' do
6
6
  it 'includes the httponly attribute' do
7
7
  str = "cookie2=val2; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com; HttpOnly"
8
- WEBrick::Cookie.parse_set_cookie( str ).httponly.should be_true
8
+ expect(WEBrick::Cookie.parse_set_cookie( str ).httponly).to be_truthy
9
9
 
10
10
  str = "cookie2=val2; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com"
11
- WEBrick::Cookie.parse_set_cookie( str ).httponly.should be_false
11
+ expect(WEBrick::Cookie.parse_set_cookie( str ).httponly).to be_falsey
12
12
  end
13
13
  end
14
14
 
@@ -6,7 +6,7 @@ describe Arachni::Scope do
6
6
 
7
7
  describe '#options' do
8
8
  it "returns #{Arachni::OptionGroups::Scope}" do
9
- subject.options.should be_kind_of Arachni::OptionGroups::Scope
9
+ expect(subject.options).to be_kind_of Arachni::OptionGroups::Scope
10
10
  end
11
11
  end
12
12
 
@@ -37,7 +37,7 @@ describe Arachni::Session do
37
37
  describe '#has_login_check?' do
38
38
  context 'when #check_url and #check_pattern have not been configured' do
39
39
  it 'returns false' do
40
- subject.has_login_check?.should be_false
40
+ expect(subject.has_login_check?).to be_falsey
41
41
  end
42
42
  end
43
43
 
@@ -46,7 +46,7 @@ describe Arachni::Session do
46
46
  @opts.session.check_url = @url
47
47
  @opts.session.check_pattern = 'logged-in user'
48
48
 
49
- subject.has_login_check?.should be_true
49
+ expect(subject.has_login_check?).to be_truthy
50
50
  end
51
51
  end
52
52
  end
@@ -56,53 +56,54 @@ describe Arachni::Session do
56
56
  context "when #{Arachni::OptionGroups::Scope}#dom_depth_limit is 0" do
57
57
  it 'returns false' do
58
58
  Arachni::Options.scope.dom_depth_limit = 0
59
- subject.has_browser?.should be_false
59
+ expect(subject.has_browser?).to be_falsey
60
60
  end
61
61
  end
62
62
 
63
63
  context "when not #{Arachni::Browser}.has_executable?" do
64
64
  it 'returns false' do
65
- Arachni::Browser.stub(:has_executable?) { false }
66
- subject.has_browser?.should be_false
65
+ allow(Arachni::Browser).to receive(:has_executable?) { false }
66
+ expect(subject.has_browser?).to be_falsey
67
67
  end
68
68
  end
69
69
  end
70
70
 
71
71
  describe '#configuration' do
72
72
  it "returns #{Arachni::Data::Session}#configuration" do
73
- subject.configuration.object_id.should ==
73
+ expect(subject.configuration.object_id).to eq(
74
74
  Arachni::Data.session.configuration.object_id
75
+ )
75
76
  end
76
77
  end
77
78
 
78
79
  describe '#clean_up' do
79
80
  it 'shuts down the #browser' do
80
81
  configured.login
81
- configured.should be_logged_in
82
+ expect(configured).to be_logged_in
82
83
 
83
84
  browser = configured.browser
84
85
  configured.clean_up
85
- browser.should be_nil
86
+ expect(browser).to be_nil
86
87
  end
87
88
 
88
89
  it 'clears the #configuration' do
89
- configured.should be_configured
90
+ expect(configured).to be_configured
90
91
  configured.clean_up
91
- configured.should_not be_configured
92
+ expect(configured).not_to be_configured
92
93
  end
93
94
  end
94
95
 
95
96
  describe '#browser' do
96
97
  context 'before calling #login' do
97
98
  it 'returns nil' do
98
- configured.browser.should be_nil
99
+ expect(configured.browser).to be_nil
99
100
  end
100
101
  end
101
102
 
102
103
  context 'after #login' do
103
104
  it 'kills the browser' do
104
105
  configured.login
105
- configured.browser.should be_nil
106
+ expect(configured.browser).to be_nil
106
107
  end
107
108
  end
108
109
  end
@@ -118,7 +119,7 @@ describe Arachni::Session do
118
119
 
119
120
  subject.login
120
121
 
121
- b.should be_kind_of Arachni::Browser
122
+ expect(b).to be_kind_of Arachni::Browser
122
123
  end
123
124
 
124
125
  it 'updates the system cookies from the browser' do
@@ -129,12 +130,12 @@ describe Arachni::Session do
129
130
 
130
131
  subject.login
131
132
 
132
- Arachni::HTTP::Client.cookies.find { |c| c.name == 'foo' }.should be_true
133
+ expect(Arachni::HTTP::Client.cookies.find { |c| c.name == 'foo' }).to be_truthy
133
134
  end
134
135
  end
135
136
 
136
137
  context 'when a browser is not available' do
137
- before { subject.stub(:has_browser?) { false } }
138
+ before { allow(subject).to receive(:has_browser?) { false } }
138
139
 
139
140
  it 'does not pass a browser instance' do
140
141
  b = true
@@ -144,7 +145,7 @@ describe Arachni::Session do
144
145
 
145
146
  subject.login
146
147
 
147
- b.should be_nil
148
+ expect(b).to be_nil
148
149
  end
149
150
  end
150
151
  end
@@ -152,16 +153,16 @@ describe Arachni::Session do
152
153
  context 'when given login form info' do
153
154
  it 'finds and submits the login form with the given credentials' do
154
155
  configured.login
155
- configured.should be_logged_in
156
+ expect(configured).to be_logged_in
156
157
  end
157
158
 
158
159
  context 'when a browser is not available' do
159
- before { subject.stub(:has_browser?) { false } }
160
+ before { allow(subject).to receive(:has_browser?) { false } }
160
161
 
161
162
  it 'uses the framework Page helpers' do
162
- configured.should_not be_logged_in
163
- configured.login.should be_kind_of Arachni::Page
164
- configured.should be_logged_in
163
+ expect(configured).not_to be_logged_in
164
+ expect(configured.login).to be_kind_of Arachni::Page
165
+ expect(configured).to be_logged_in
165
166
  end
166
167
  end
167
168
 
@@ -180,26 +181,28 @@ describe Arachni::Session do
180
181
 
181
182
  subject.login
182
183
 
183
- subject.should be_logged_in
184
+ expect(subject).to be_logged_in
184
185
  end
185
186
 
186
187
  it 'returns the resulting browser evaluated page' do
187
- configured.login.should be_kind_of Arachni::Page
188
+ expect(configured.login).to be_kind_of Arachni::Page
188
189
 
189
190
  transition = configured.login.dom.transitions.first
190
- transition.event.should == :load
191
- transition.element.should == :page
192
- transition.options[:url].should == configured.configuration[:url]
191
+ expect(transition.event).to eq(:load)
192
+ expect(transition.element).to eq(:page)
193
+ expect(transition.options[:url]).to eq(configured.configuration[:url])
193
194
 
194
195
  transition = configured.login.dom.transitions.last
195
- transition.event.should == :submit
196
- transition.element.tag_name.should == :form
196
+ expect(transition.event).to eq(:submit)
197
+ expect(transition.element.tag_name).to eq(:form)
197
198
 
198
- transition.options[:inputs]['username'].should ==
199
+ expect(transition.options[:inputs]['username']).to eq(
199
200
  configured.configuration[:inputs][:username]
201
+ )
200
202
 
201
- transition.options[:inputs]['password'].should ==
203
+ expect(transition.options[:inputs]['password']).to eq(
202
204
  configured.configuration[:inputs][:password]
205
+ )
203
206
  end
204
207
  end
205
208
  end
@@ -222,7 +225,7 @@ describe Arachni::Session do
222
225
  context 'and a valid session is available' do
223
226
  it 'returns true' do
224
227
  configured.login
225
- configured.should be_logged_in
228
+ expect(configured).to be_logged_in
226
229
  end
227
230
  end
228
231
 
@@ -231,7 +234,7 @@ describe Arachni::Session do
231
234
  @opts.session.check_url = @url
232
235
  @opts.session.check_pattern = 'logged-in user'
233
236
 
234
- subject.should_not be_logged_in
237
+ expect(subject).not_to be_logged_in
235
238
  end
236
239
  end
237
240
 
@@ -242,12 +245,12 @@ describe Arachni::Session do
242
245
  bool = false
243
246
  configured.logged_in? { |b| bool = b }
244
247
  configured.http.run
245
- bool.should be_true
248
+ expect(bool).to be_truthy
246
249
 
247
250
  not_bool = true
248
251
  configured.logged_in?( no_cookie_jar: true ) { |b| not_bool = b }
249
252
  configured.http.run
250
- not_bool.should be_false
253
+ expect(not_bool).to be_falsey
251
254
  end
252
255
  end
253
256
  end
@@ -256,13 +259,13 @@ describe Arachni::Session do
256
259
  describe '#configured?' do
257
260
  context 'when login instructions have been provided' do
258
261
  it 'returns true' do
259
- configured.configured?.should be_true
262
+ expect(configured.configured?).to be_truthy
260
263
  end
261
264
  end
262
265
 
263
266
  context 'when login instructions have not been provided' do
264
267
  it 'returns false' do
265
- subject.configured?.should be_false
268
+ expect(subject.configured?).to be_falsey
266
269
  end
267
270
  end
268
271
  end
@@ -271,7 +274,7 @@ describe Arachni::Session do
271
274
  it 'returns session cookies' do
272
275
  subject.http.get @url + '/with_nonce', mode: :sync, update_cookies: true
273
276
 
274
- subject.cookies.map(&:name).sort.should == %w(rack.session session_cookie).sort
277
+ expect(subject.cookies.map(&:name).sort).to eq(%w(rack.session session_cookie).sort)
275
278
  end
276
279
  end
277
280
 
@@ -289,7 +292,7 @@ describe Arachni::Session do
289
292
  # (to make sure that it will be refreshed before logging in)
290
293
  subject.http.get @url + '/nonce_login', mode: :sync
291
294
 
292
- subject.configured?.should be_true
295
+ expect(subject.configured?).to be_truthy
293
296
 
294
297
  @opts.session.check_url = @url + '/with_nonce'
295
298
  @opts.session.check_pattern = 'logged-in user'
@@ -300,9 +303,9 @@ describe Arachni::Session do
300
303
  subject.cookie { |c| cookie = c }
301
304
  subject.http.run
302
305
 
303
- cookie.name.should == 'rack.session'
306
+ expect(cookie.name).to eq('rack.session')
304
307
 
305
- subject.can_login?.should be_true
308
+ expect(subject.can_login?).to be_truthy
306
309
  end
307
310
 
308
311
  context 'when called without having configured a login check' do
@@ -317,29 +320,29 @@ describe Arachni::Session do
317
320
  context 'when passed an array of :pages' do
318
321
  it 'should go through its forms and locate the login one' do
319
322
  p = Arachni::Page.from_url( @url + '/login' )
320
- subject.find_login_form( pages: [ p, p ] ).coverage_id.should == @id
323
+ expect(subject.find_login_form( pages: [ p, p ] ).coverage_id).to eq(@id)
321
324
  end
322
325
  end
323
326
  context 'when passed an array of :forms' do
324
327
  it 'should go through its forms and locate the login one' do
325
328
  p = Arachni::Page.from_url( @url + '/login' )
326
- subject.find_login_form( forms: p.forms ).coverage_id.should == @id
329
+ expect(subject.find_login_form( forms: p.forms ).coverage_id).to eq(@id)
327
330
  end
328
331
  end
329
332
  context 'when passed a url' do
330
333
  it 'store the cookies set by that url' do
331
- Arachni::HTTP::Client.cookies.should be_empty
334
+ expect(Arachni::HTTP::Client.cookies).to be_empty
332
335
 
333
- subject.find_login_form( url: @url + '/login' ).coverage_id.should == @id
336
+ expect(subject.find_login_form( url: @url + '/login' ).coverage_id).to eq(@id)
334
337
 
335
- Arachni::HTTP::Client.cookies.find do |c|
338
+ expect(Arachni::HTTP::Client.cookies.find do |c|
336
339
  c.name == 'you_need_to' && c.value == 'preserve this'
337
- end.should be_kind_of Arachni::Cookie
340
+ end).to be_kind_of Arachni::Cookie
338
341
  end
339
342
 
340
343
  context 'and called without a block' do
341
344
  it 'should operate in blocking mode, go through its forms and locate the login one' do
342
- subject.find_login_form( url: @url + '/login' ).coverage_id.should == @id
345
+ expect(subject.find_login_form( url: @url + '/login' ).coverage_id).to eq(@id)
343
346
  end
344
347
  end
345
348
  context 'and called with a block' do
@@ -349,33 +352,33 @@ describe Arachni::Session do
349
352
  subject.find_login_form( url: @url + '/login' ) { |f| form = f }
350
353
  subject.http.run
351
354
 
352
- form.coverage_id.should == @id
355
+ expect(form.coverage_id).to eq(@id)
353
356
  end
354
357
  end
355
358
  end
356
359
  context 'when passed an array of :inputs' do
357
360
  it 'should use them to narrow down the list' do
358
- subject.find_login_form(
361
+ expect(subject.find_login_form(
359
362
  url: @url + '/multiple',
360
363
  inputs: :token
361
- ).coverage_id.should == @id
364
+ ).coverage_id).to eq(@id)
362
365
  end
363
366
  end
364
367
  context 'when passed an :action' do
365
368
  context Regexp do
366
369
  it 'should use it to match against form actions' do
367
- subject.find_login_form(
370
+ expect(subject.find_login_form(
368
371
  url: @url + '/multiple',
369
372
  action: /login/
370
- ).coverage_id.should == @id
373
+ ).coverage_id).to eq(@id)
371
374
  end
372
375
  end
373
376
  context String do
374
377
  it 'should use it to match against form actions' do
375
- subject.find_login_form(
378
+ expect(subject.find_login_form(
376
379
  url: @url + '/multiple',
377
380
  action: "#{@url}/login"
378
- ).coverage_id.should == @id
381
+ ).coverage_id).to eq(@id)
379
382
  end
380
383
  end
381
384
  end
@@ -384,13 +387,13 @@ describe Arachni::Session do
384
387
  describe '#can_login?' do
385
388
  context 'when there are no login sequences' do
386
389
  it 'returns false' do
387
- subject.can_login?.should be_false
390
+ expect(subject.can_login?).to be_falsey
388
391
  end
389
392
  end
390
393
 
391
394
  context 'when there are login sequences' do
392
395
  it 'returns true' do
393
- configured.can_login?.should be_true
396
+ expect(configured.can_login?).to be_truthy
394
397
  end
395
398
  end
396
399
  end
@@ -409,9 +412,9 @@ describe Arachni::Session do
409
412
  }
410
413
  )
411
414
 
412
- subject.logged_in?.should be_false
415
+ expect(subject.logged_in?).to be_falsey
413
416
  subject.ensure_logged_in
414
- subject.logged_in?.should be_true
417
+ expect(subject.logged_in?).to be_truthy
415
418
  end
416
419
  end
417
420
 
@@ -427,9 +430,9 @@ describe Arachni::Session do
427
430
  }
428
431
  )
429
432
 
430
- subject.logged_in?.should be_false
433
+ expect(subject.logged_in?).to be_falsey
431
434
  subject.ensure_logged_in
432
- subject.logged_in?.should be_false
435
+ expect(subject.logged_in?).to be_falsey
433
436
  end
434
437
  end
435
438
 
@@ -446,16 +449,16 @@ describe Arachni::Session do
446
449
  }
447
450
  )
448
451
 
449
- subject.logged_in?.should be_false
452
+ expect(subject.logged_in?).to be_falsey
450
453
  subject.ensure_logged_in
451
- subject.logged_in?.should be_true
454
+ expect(subject.logged_in?).to be_truthy
452
455
  end
453
456
  end
454
457
 
455
458
  context 'when there is no login capability' do
456
459
  it 'returns nil' do
457
- subject.can_login?.should be_false
458
- subject.ensure_logged_in.should be_nil
460
+ expect(subject.can_login?).to be_falsey
461
+ expect(subject.ensure_logged_in).to be_nil
459
462
  end
460
463
  end
461
464
  end
@@ -15,11 +15,11 @@ describe Arachni::Snapshot do
15
15
  let(:summary) { subject.summary }
16
16
 
17
17
  it 'includes :data' do
18
- summary[:data].should == Arachni::Data.statistics
18
+ expect(summary[:data]).to eq(Arachni::Data.statistics)
19
19
  end
20
20
 
21
21
  it 'includes :state' do
22
- summary[:state].should == Arachni::State.statistics
22
+ expect(summary[:state]).to eq(Arachni::State.statistics)
23
23
  end
24
24
  end
25
25
 
@@ -29,13 +29,13 @@ describe Arachni::Snapshot do
29
29
  subject.dump( dump_archive )
30
30
  subject.load( dump_archive )
31
31
 
32
- subject.metadata.should == subject.read_metadata( dump_archive )
32
+ expect(subject.metadata).to eq(subject.read_metadata( dump_archive ))
33
33
  end
34
34
  end
35
35
 
36
36
  context 'when not dealing with a restored snapshot' do
37
37
  it 'returns nil' do
38
- subject.metadata.should be_nil
38
+ expect(subject.metadata).to be_nil
39
39
  end
40
40
  end
41
41
  end
@@ -46,13 +46,13 @@ describe Arachni::Snapshot do
46
46
  subject.dump( dump_archive )
47
47
  subject.load( dump_archive )
48
48
 
49
- subject.should be_restored
49
+ expect(subject).to be_restored
50
50
  end
51
51
  end
52
52
 
53
53
  context 'when not dealing with a restored snapshot' do
54
54
  it 'returns false' do
55
- subject.should_not be_restored
55
+ expect(subject).not_to be_restored
56
56
  end
57
57
  end
58
58
  end
@@ -63,13 +63,13 @@ describe Arachni::Snapshot do
63
63
  subject.dump( dump_archive )
64
64
  subject.load( dump_archive )
65
65
 
66
- subject.location.should == dump_archive
66
+ expect(subject.location).to eq(dump_archive)
67
67
  end
68
68
  end
69
69
 
70
70
  context 'when not dealing with a restored snapshot' do
71
71
  it 'returns nil' do
72
- subject.location.should be_nil
72
+ expect(subject.location).to be_nil
73
73
  end
74
74
  end
75
75
  end
@@ -81,15 +81,15 @@ describe Arachni::Snapshot do
81
81
  end
82
82
 
83
83
  it 'includes a :timestamp' do
84
- metadata[:timestamp].should be_kind_of Time
84
+ expect(metadata[:timestamp]).to be_kind_of Time
85
85
  end
86
86
 
87
87
  it 'includes a :version' do
88
- metadata[:version].should == Arachni::VERSION
88
+ expect(metadata[:version]).to eq(Arachni::VERSION)
89
89
  end
90
90
 
91
91
  it 'includes a #summary' do
92
- metadata[:summary].should == subject.summary
92
+ expect(metadata[:summary]).to eq(subject.summary)
93
93
  end
94
94
 
95
95
  context 'when trying to read an invalid file' do
@@ -101,8 +101,8 @@ describe Arachni::Snapshot do
101
101
 
102
102
  describe '.dump' do
103
103
  it "stores #{Arachni::State} to disk" do
104
- Arachni::State.should receive(:dump)
105
- Arachni::Data.should receive(:dump)
104
+ expect(Arachni::State).to receive(:dump)
105
+ expect(Arachni::Data).to receive(:dump)
106
106
 
107
107
  subject.dump( dump_archive )
108
108
  end
@@ -112,8 +112,8 @@ describe Arachni::Snapshot do
112
112
  it "stores #{Arachni::State} to disk" do
113
113
  subject.dump( dump_archive )
114
114
 
115
- Arachni::State.should receive(:load)
116
- Arachni::Data.should receive(:load)
115
+ expect(Arachni::State).to receive(:load)
116
+ expect(Arachni::Data).to receive(:load)
117
117
 
118
118
  subject.load( dump_archive )
119
119
  end