arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -13,13 +13,13 @@ describe Arachni::State::HTTP do
13
13
 
14
14
  describe '#headers' do
15
15
  it 'returns a Hash' do
16
- subject.headers.should be_kind_of Hash
16
+ expect(subject.headers).to be_kind_of Hash
17
17
  end
18
18
  end
19
19
 
20
20
  describe '#cookie_jar' do
21
21
  it "returns a #{Arachni::HTTP::CookieJar}" do
22
- subject.cookie_jar.should be_kind_of Arachni::HTTP::CookieJar
22
+ expect(subject.cookie_jar).to be_kind_of Arachni::HTTP::CookieJar
23
23
  end
24
24
  end
25
25
 
@@ -28,7 +28,7 @@ describe Arachni::State::HTTP do
28
28
 
29
29
  it 'includes :cookies' do
30
30
  subject.cookie_jar << cookie
31
- statistics[:cookies].should == [cookie.to_s]
31
+ expect(statistics[:cookies]).to eq([cookie.to_s])
32
32
  end
33
33
  end
34
34
 
@@ -46,15 +46,15 @@ describe Arachni::State::HTTP do
46
46
  subject.dump( dump_directory )
47
47
 
48
48
  http = described_class.load( dump_directory )
49
- http.headers.should == subject.headers
50
- http.cookie_jar.should == subject.cookie_jar
49
+ expect(http.headers).to eq(subject.headers)
50
+ expect(http.cookie_jar).to eq(subject.cookie_jar)
51
51
  end
52
52
  end
53
53
 
54
54
  describe '#clear' do
55
55
  it 'clears the list' do
56
- subject.headers.should receive(:clear)
57
- subject.cookie_jar.should receive(:clear)
56
+ expect(subject.headers).to receive(:clear)
57
+ expect(subject.cookie_jar).to receive(:clear)
58
58
 
59
59
  subject.clear
60
60
  end
@@ -10,24 +10,24 @@ describe Arachni::State::Options do
10
10
  @dump_directory = "#{Dir.tmpdir}/options-#{Arachni::Utilities.generate_token}"
11
11
  end
12
12
 
13
- it { should respond_to :clear}
13
+ it { is_expected.to respond_to :clear}
14
14
 
15
15
  describe '#statistics' do
16
16
  let(:statistics) { subject.statistics }
17
17
 
18
18
  it 'includes :url' do
19
19
  Arachni::Options.url = 'http://test/'
20
- statistics[:url].should == Arachni::Options.url
20
+ expect(statistics[:url]).to eq(Arachni::Options.url)
21
21
  end
22
22
 
23
23
  it 'includes :checks' do
24
24
  Arachni::Options.checks = %w(xss* sql_injection)
25
- statistics[:checks].should == Arachni::Options.checks
25
+ expect(statistics[:checks]).to eq(Arachni::Options.checks)
26
26
  end
27
27
 
28
28
  it 'includes :plugins' do
29
29
  Arachni::Options.plugins = { 'autologin' => {} }
30
- statistics[:plugins].should == %w(autologin)
30
+ expect(statistics[:plugins]).to eq(%w(autologin))
31
31
  end
32
32
  end
33
33
 
@@ -36,8 +36,8 @@ describe Arachni::State::Options do
36
36
  Arachni::Options.datastore.my_custom_option = 'my value'
37
37
  subject.dump( dump_directory )
38
38
 
39
- Arachni::Options.load( "#{dump_directory}/options" ).
40
- datastore.my_custom_option.should == 'my value'
39
+ expect(Arachni::Options.load( "#{dump_directory}/options" ).
40
+ datastore.my_custom_option).to eq('my value')
41
41
  end
42
42
  end
43
43
 
@@ -48,7 +48,7 @@ describe Arachni::State::Options do
48
48
 
49
49
  described_class.load( dump_directory )
50
50
 
51
- Arachni::Options.datastore.my_custom_option.should == 'my value'
51
+ expect(Arachni::Options.datastore.my_custom_option).to eq('my value')
52
52
  end
53
53
  end
54
54
 
@@ -18,7 +18,7 @@ describe Arachni::State::Plugins do
18
18
 
19
19
  describe '#runtime' do
20
20
  it 'returns a Hash' do
21
- subject.runtime.should be_kind_of Hash
21
+ expect(subject.runtime).to be_kind_of Hash
22
22
  end
23
23
  end
24
24
 
@@ -29,7 +29,7 @@ describe Arachni::State::Plugins do
29
29
 
30
30
  subject.store( :distributable, result )
31
31
 
32
- subject.statistics[:names].should == [:distributable]
32
+ expect(subject.statistics[:names]).to eq([:distributable])
33
33
  end
34
34
  end
35
35
 
@@ -39,7 +39,7 @@ describe Arachni::State::Plugins do
39
39
  result = { stuff: 1 }
40
40
 
41
41
  subject.store( :distributable, result )
42
- subject[:distributable].should == result
42
+ expect(subject[:distributable]).to eq(result)
43
43
  end
44
44
  end
45
45
 
@@ -49,10 +49,10 @@ describe Arachni::State::Plugins do
49
49
  subject.dump( dump_directory )
50
50
 
51
51
  results_file = "#{dump_directory}/runtime/distributable"
52
- File.exists?( results_file ).should be_true
53
- subject.runtime.should == {
52
+ expect(File.exists?( results_file )).to be_truthy
53
+ expect(subject.runtime).to eq({
54
54
  distributable: Marshal.load( IO.read( results_file ) )
55
- }
55
+ })
56
56
  end
57
57
  end
58
58
 
@@ -61,14 +61,14 @@ describe Arachni::State::Plugins do
61
61
  subject.runtime[:distributable] = { stuff: 1 }
62
62
  subject.dump( dump_directory )
63
63
 
64
- subject.runtime.should == described_class.load( dump_directory ).runtime
64
+ expect(subject.runtime).to eq(described_class.load( dump_directory ).runtime)
65
65
  end
66
66
  end
67
67
 
68
68
  describe '#clear' do
69
69
  %w(runtime).each do |method|
70
70
  it "clears ##{method}" do
71
- subject.send(method).should receive(:clear)
71
+ expect(subject.send(method)).to receive(:clear)
72
72
  subject.clear
73
73
  end
74
74
  end
@@ -15,37 +15,37 @@ describe Arachni::State do
15
15
 
16
16
  describe '#audit' do
17
17
  it "returns an instance of #{described_class::Audit}" do
18
- subject.audit.should be_kind_of described_class::Audit
18
+ expect(subject.audit).to be_kind_of described_class::Audit
19
19
  end
20
20
  end
21
21
 
22
22
  describe '#element_filter' do
23
23
  it "returns an instance of #{described_class::ElementFilter}" do
24
- subject.element_filter.should be_kind_of described_class::ElementFilter
24
+ expect(subject.element_filter).to be_kind_of described_class::ElementFilter
25
25
  end
26
26
  end
27
27
 
28
28
  describe '#framework' do
29
29
  it "returns an instance of #{described_class::Framework}" do
30
- subject.framework.should be_kind_of described_class::Framework
30
+ expect(subject.framework).to be_kind_of described_class::Framework
31
31
  end
32
32
  end
33
33
 
34
34
  describe '#options' do
35
35
  it "returns an instance of #{described_class::Options}" do
36
- subject.options.should be_kind_of described_class::Options
36
+ expect(subject.options).to be_kind_of described_class::Options
37
37
  end
38
38
  end
39
39
 
40
40
  describe '#http' do
41
41
  it "returns an instance of #{described_class::HTTP}" do
42
- subject.http.should be_kind_of described_class::HTTP
42
+ expect(subject.http).to be_kind_of described_class::HTTP
43
43
  end
44
44
  end
45
45
 
46
46
  describe '#plugins' do
47
47
  it "returns an instance of #{described_class::Plugins}" do
48
- subject.plugins.should be_kind_of described_class::Plugins
48
+ expect(subject.plugins).to be_kind_of described_class::Plugins
49
49
  end
50
50
  end
51
51
 
@@ -56,7 +56,7 @@ describe Arachni::State do
56
56
  describe '#statistics' do
57
57
  %w(options audit element_filter framework http plugins).each do |name|
58
58
  it "includes :#{name} statistics" do
59
- subject.statistics[name.to_sym].should == subject.send(name).statistics
59
+ expect(subject.statistics[name.to_sym]).to eq(subject.send(name).statistics)
60
60
  end
61
61
  end
62
62
  end
@@ -70,8 +70,8 @@ describe Arachni::State do
70
70
 
71
71
  new_instance = subject.load( dump_directory ).send(name)
72
72
 
73
- new_instance.should be_kind_of subject.send(name).class
74
- new_instance.object_id.should_not == previous_instance.object_id
73
+ expect(new_instance).to be_kind_of subject.send(name).class
74
+ expect(new_instance.object_id).not_to eq(previous_instance.object_id)
75
75
  end
76
76
  end
77
77
  end
@@ -79,7 +79,7 @@ describe Arachni::State do
79
79
  describe '#clear' do
80
80
  %w(options audit element_filter framework http plugins).each do |method|
81
81
  it "clears ##{method}" do
82
- subject.send(method).should receive(:clear)
82
+ expect(subject.send(method)).to receive(:clear)
83
83
  subject.clear
84
84
  end
85
85
  end
@@ -14,11 +14,11 @@ describe Arachni::Support::Buffer::AutoFlush do
14
14
 
15
15
  20.times { |i| b << i }
16
16
 
17
- buffers.size.should == 2
18
- buffers.shift.should == (0..9).to_a
19
- buffers.shift.should == (10...20).to_a
17
+ expect(buffers.size).to eq(2)
18
+ expect(buffers.shift).to eq((0..9).to_a)
19
+ expect(buffers.shift).to eq((10...20).to_a)
20
20
 
21
- b.should be_empty
21
+ expect(b).to be_empty
22
22
  end
23
23
  end
24
24
  end
@@ -35,10 +35,10 @@ describe Arachni::Support::Buffer::AutoFlush do
35
35
 
36
36
  20.times { |i| b << i }
37
37
 
38
- buffers.size.should == 2
39
- buffers.shift.should == (0..9).to_a
40
- buffers.shift.should == (10...20).to_a
41
- b.should be_empty
38
+ expect(buffers.size).to eq(2)
39
+ expect(buffers.shift).to eq((0..9).to_a)
40
+ expect(buffers.shift).to eq((10...20).to_a)
41
+ expect(b).to be_empty
42
42
 
43
43
  b = described_class.new( 99999, 10 )
44
44
 
@@ -49,10 +49,10 @@ describe Arachni::Support::Buffer::AutoFlush do
49
49
 
50
50
  20.times { |i| b.batch_push (0..1000).to_a }
51
51
 
52
- buffers.size.should == 2
53
- buffers.shift.should == (0..1000).to_a
54
- buffers.shift.should == (0..1000).to_a
55
- b.should be_empty
52
+ expect(buffers.size).to eq(2)
53
+ expect(buffers.shift).to eq((0..1000).to_a)
54
+ expect(buffers.shift).to eq((0..1000).to_a)
55
+ expect(b).to be_empty
56
56
  end
57
57
  end
58
58
  end
@@ -62,15 +62,15 @@ describe Arachni::Support::Buffer::AutoFlush do
62
62
  b = described_class.new( 10, 999, Set )
63
63
  b << 'test'
64
64
  b << 'test'
65
- b.size.should == 1
66
- b.flush.class.should == Set
65
+ expect(b.size).to eq(1)
66
+ expect(b.flush.class).to eq(Set)
67
67
 
68
68
  b = described_class.new
69
69
  b << 'test'
70
70
  b << 'test'
71
- b.size.should == 2
71
+ expect(b.size).to eq(2)
72
72
 
73
- b.flush.class.should == Array
73
+ expect(b.flush.class).to eq(Array)
74
74
  end
75
75
  end
76
76
  end
@@ -7,7 +7,7 @@ describe Arachni::Support::Buffer::Base do
7
7
  it 'determines whether or not the buffer is full' do
8
8
  b = described_class.new( 10 )
9
9
  20.times { |i| b << i }
10
- b.full?.should be_true
10
+ expect(b.full?).to be_truthy
11
11
  end
12
12
  end
13
13
 
@@ -16,15 +16,15 @@ describe Arachni::Support::Buffer::Base do
16
16
  b = described_class.new( 10, Set )
17
17
  b << 'test'
18
18
  b << 'test'
19
- b.size.should == 1
20
- b.flush.class.should == Set
19
+ expect(b.size).to eq(1)
20
+ expect(b.flush.class).to eq(Set)
21
21
 
22
22
  b = described_class.new
23
23
  b << 'test'
24
24
  b << 'test'
25
- b.size.should == 2
25
+ expect(b.size).to eq(2)
26
26
 
27
- b.flush.class.should == Array
27
+ expect(b.flush.class).to eq(Array)
28
28
  end
29
29
  end
30
30
  end
@@ -34,13 +34,13 @@ describe Arachni::Support::Buffer::Base do
34
34
  b = described_class.new
35
35
  b << 'test'
36
36
  b << 'test'
37
- b.size.should == 2
37
+ expect(b.size).to eq(2)
38
38
  end
39
39
  it 'aliased to #push' do
40
40
  b = described_class.new
41
41
  b.push 'test'
42
42
  b.push 'test'
43
- b.size.should == 2
43
+ expect(b.size).to eq(2)
44
44
  end
45
45
  end
46
46
 
@@ -48,7 +48,7 @@ describe Arachni::Support::Buffer::Base do
48
48
  it 'pushes a batch of entries' do
49
49
  b = described_class.new
50
50
  b.batch_push [ 'test', 'test2' ]
51
- b.size.should == 2
51
+ expect(b.size).to eq(2)
52
52
  end
53
53
  end
54
54
 
@@ -56,7 +56,7 @@ describe Arachni::Support::Buffer::Base do
56
56
  it 'returns the number of entries in the buffer' do
57
57
  b = described_class.new
58
58
  b.batch_push [ 'test', 'test2', 'test3' ]
59
- b.size.should == 3
59
+ expect(b.size).to eq(3)
60
60
  end
61
61
  end
62
62
 
@@ -65,14 +65,14 @@ describe Arachni::Support::Buffer::Base do
65
65
  context 'is empty' do
66
66
  it 'returns true' do
67
67
  b = described_class.new( 10 )
68
- b.empty?.should be_true
68
+ expect(b.empty?).to be_truthy
69
69
  end
70
70
  end
71
71
  context 'is not empty' do
72
72
  it 'returns false' do
73
73
  b = described_class.new( 10 )
74
74
  b << 1
75
- b.empty?.should be_false
75
+ expect(b.empty?).to be_falsey
76
76
  end
77
77
  end
78
78
  end
@@ -84,14 +84,14 @@ describe Arachni::Support::Buffer::Base do
84
84
  it 'returns true' do
85
85
  b = described_class.new( 10 )
86
86
  20.times { |i| b << i }
87
- b.full?.should be_true
87
+ expect(b.full?).to be_truthy
88
88
  end
89
89
  end
90
90
  context 'not reached its maximum size' do
91
91
  it 'returns false' do
92
92
  b = described_class.new( 100 )
93
93
  20.times { |i| b << i }
94
- b.full?.should be_false
94
+ expect(b.full?).to be_falsey
95
95
  end
96
96
  end
97
97
  end
@@ -101,18 +101,18 @@ describe Arachni::Support::Buffer::Base do
101
101
  it 'returns buffer contents' do
102
102
  b = described_class.new
103
103
  b.batch_push [ 'test', 'test2', 'test3' ]
104
- b.size.should == 3
104
+ expect(b.size).to eq(3)
105
105
 
106
- b.flush.should == [ 'test', 'test2', 'test3' ]
107
- b.size.should == 0
106
+ expect(b.flush).to eq([ 'test', 'test2', 'test3' ])
107
+ expect(b.size).to eq(0)
108
108
  end
109
109
  it 'empties the buffer' do
110
110
  b = described_class.new
111
111
  b.batch_push [ 'test', 'test2', 'test3' ]
112
- b.size.should == 3
112
+ expect(b.size).to eq(3)
113
113
 
114
- b.flush.should == [ 'test', 'test2', 'test3' ]
115
- b.size.should == 0
114
+ expect(b.flush).to eq([ 'test', 'test2', 'test3' ])
115
+ expect(b.size).to eq(0)
116
116
  end
117
117
  end
118
118
 
@@ -123,30 +123,30 @@ describe Arachni::Support::Buffer::Base do
123
123
  b = described_class.new
124
124
 
125
125
  call_args = []
126
- b.on_push do |buffer|
126
+ expect(b.on_push do |buffer|
127
127
  call_args << buffer
128
- end.should == b
128
+ end).to eq(b)
129
129
 
130
- b.on_push do |buffer|
130
+ expect(b.on_push do |buffer|
131
131
  call_args << buffer
132
- end.should == b
132
+ end).to eq(b)
133
133
 
134
134
  b << item
135
- call_args.should == [ item, item]
135
+ expect(call_args).to eq([ item, item])
136
136
 
137
137
  b = described_class.new
138
138
 
139
139
  call_args = []
140
- b.on_push do |buffer|
140
+ expect(b.on_push do |buffer|
141
141
  call_args << buffer
142
- end.should == b
142
+ end).to eq(b)
143
143
 
144
- b.on_push do |buffer|
144
+ expect(b.on_push do |buffer|
145
145
  call_args << buffer
146
- end.should == b
146
+ end).to eq(b)
147
147
 
148
148
  b.push item
149
- call_args.should == [ item, item]
149
+ expect(call_args).to eq([ item, item])
150
150
  end
151
151
  end
152
152
 
@@ -157,16 +157,16 @@ describe Arachni::Support::Buffer::Base do
157
157
  b = described_class.new
158
158
 
159
159
  call_args = []
160
- b.on_batch_push do |buffer|
160
+ expect(b.on_batch_push do |buffer|
161
161
  call_args << buffer
162
- end.should == b
162
+ end).to eq(b)
163
163
 
164
- b.on_batch_push do |buffer|
164
+ expect(b.on_batch_push do |buffer|
165
165
  call_args << buffer
166
- end.should == b
166
+ end).to eq(b)
167
167
 
168
168
  b.batch_push item
169
- call_args.should == [ item, item]
169
+ expect(call_args).to eq([ item, item])
170
170
  end
171
171
  end
172
172
 
@@ -178,16 +178,16 @@ describe Arachni::Support::Buffer::Base do
178
178
  b << item
179
179
 
180
180
  call_args = []
181
- b.on_flush do |buffer|
181
+ expect(b.on_flush do |buffer|
182
182
  call_args << buffer
183
- end.should == b
183
+ end).to eq(b)
184
184
 
185
- b.on_flush do |buffer|
185
+ expect(b.on_flush do |buffer|
186
186
  call_args << buffer
187
- end.should == b
187
+ end).to eq(b)
188
188
 
189
189
  b.flush
190
- call_args.should == [ [item], [item]]
190
+ expect(call_args).to eq([ [item], [item]])
191
191
  end
192
192
  end
193
193
  end