arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -3,14 +3,14 @@ require 'spec_helper'
3
3
  shared_examples_for 'lookup' do
4
4
  subject { described_class.new }
5
5
 
6
- it { should respond_to :collection }
6
+ it { is_expected.to respond_to :collection }
7
7
 
8
8
  describe '#<<' do
9
9
  it 'adds an object and return self' do
10
- (subject << 'test').should == subject
10
+ expect(subject << 'test').to eq(subject)
11
11
  end
12
12
  it 'aliased to #add' do
13
- subject.add( 'test2' ).should == subject
13
+ expect(subject.add( 'test2' )).to eq(subject)
14
14
  end
15
15
  end
16
16
 
@@ -20,13 +20,13 @@ shared_examples_for 'lookup' do
20
20
  subject << 'test'
21
21
  subject << 'test2'
22
22
 
23
- subject.include?( 'test' ).should be_true
24
- subject.include?( 'test2' ).should be_true
23
+ expect(subject.include?( 'test' )).to be_truthy
24
+ expect(subject.include?( 'test2' )).to be_truthy
25
25
  end
26
26
  end
27
27
  context 'when an object is not included' do
28
28
  it 'returns false' do
29
- subject.include?( 'test3' ).should be_false
29
+ expect(subject.include?( 'test3' )).to be_falsey
30
30
  end
31
31
  end
32
32
  end
@@ -35,22 +35,22 @@ shared_examples_for 'lookup' do
35
35
  it 'deletes an object and return self' do
36
36
  subject << 'test'
37
37
 
38
- subject.include?( 'test' ).should be_true
39
- subject.delete( 'test' ).should be_true
40
- subject.include?( 'test' ).should be_false
38
+ expect(subject.include?( 'test' )).to be_truthy
39
+ expect(subject.delete( 'test' )).to be_truthy
40
+ expect(subject.include?( 'test' )).to be_falsey
41
41
  end
42
42
  end
43
43
 
44
44
  describe '#empty?' do
45
45
  context 'when empty' do
46
46
  it 'returns true' do
47
- subject.empty?.should be_true
47
+ expect(subject.empty?).to be_truthy
48
48
  end
49
49
  end
50
50
  context 'when not empty' do
51
51
  it 'returns false' do
52
52
  subject << 'test'
53
- subject.empty?.should be_false
53
+ expect(subject.empty?).to be_falsey
54
54
  end
55
55
  end
56
56
  end
@@ -58,13 +58,13 @@ shared_examples_for 'lookup' do
58
58
  describe '#any?' do
59
59
  context 'when empty' do
60
60
  it 'returns false' do
61
- subject.any?.should be_false
61
+ expect(subject.any?).to be_falsey
62
62
  end
63
63
  end
64
64
  context 'when not empty' do
65
65
  it 'returns true' do
66
66
  subject << 'test'
67
- subject.any?.should be_true
67
+ expect(subject.any?).to be_truthy
68
68
  end
69
69
  end
70
70
  end
@@ -72,13 +72,13 @@ shared_examples_for 'lookup' do
72
72
  describe '#size' do
73
73
  it 'returns the size' do
74
74
  bf = described_class.new
75
- bf.size.should == 0
75
+ expect(bf.size).to eq(0)
76
76
  bf << '1'
77
- bf.size.should == 1
77
+ expect(bf.size).to eq(1)
78
78
  bf << '1'
79
- bf.size.should == 1
79
+ expect(bf.size).to eq(1)
80
80
  bf << '2'
81
- bf.size.should == 2
81
+ expect(bf.size).to eq(2)
82
82
  end
83
83
  end
84
84
 
@@ -87,9 +87,9 @@ shared_examples_for 'lookup' do
87
87
  bf = described_class.new
88
88
  bf << '1'
89
89
  bf << '2'
90
- bf.size.should == 2
90
+ expect(bf.size).to eq(2)
91
91
  bf.clear
92
- bf.size.should == 0
92
+ expect(bf.size).to eq(0)
93
93
  end
94
94
  end
95
95
 
@@ -101,7 +101,7 @@ shared_examples_for 'lookup' do
101
101
  subject << 'test'
102
102
  new << 'test'
103
103
 
104
- subject.should == new
104
+ expect(subject).to eq(new)
105
105
  end
106
106
  end
107
107
 
@@ -112,7 +112,7 @@ shared_examples_for 'lookup' do
112
112
  subject << 'test'
113
113
  new << 'test2'
114
114
 
115
- subject.should_not == new
115
+ expect(subject).not_to eq(new)
116
116
  end
117
117
  end
118
118
  end
@@ -125,7 +125,7 @@ shared_examples_for 'lookup' do
125
125
  subject << 'test'
126
126
  new << 'test'
127
127
 
128
- subject.hash.should == new.hash
128
+ expect(subject.hash).to eq(new.hash)
129
129
  end
130
130
  end
131
131
 
@@ -136,7 +136,7 @@ shared_examples_for 'lookup' do
136
136
  subject << 'test'
137
137
  new << 'test2'
138
138
 
139
- subject.hash.should_not == new.hash
139
+ expect(subject.hash).not_to eq(new.hash)
140
140
  end
141
141
  end
142
142
  end
@@ -146,11 +146,11 @@ shared_examples_for 'lookup' do
146
146
  subject << 'test'
147
147
  copy = subject.dup
148
148
 
149
- copy.should == subject
149
+ expect(copy).to eq(subject)
150
150
 
151
151
  copy << 'test2'
152
152
 
153
- copy.should_not == subject
153
+ expect(copy).not_to eq(subject)
154
154
  end
155
155
  end
156
156
  end
@@ -115,7 +115,9 @@ class Framework
115
115
 
116
116
  def print_statistics( unmute = false )
117
117
  statistics = @framework.statistics
118
- http = statistics[:http]
118
+
119
+ http = statistics[:http]
120
+ browser_cluster = statistics[:browser_cluster]
119
121
 
120
122
  refresh_line nil, unmute
121
123
  refresh_info( "Audited #{statistics[:audited_pages]} pages.", unmute )
@@ -127,22 +129,29 @@ class Framework
127
129
 
128
130
  refresh_line nil, unmute
129
131
 
130
- refresh_info( "Sent #{statistics[:http][:request_count]} requests.", unmute )
131
- refresh_info( "Received and analyzed #{statistics[:http][:response_count]} responses.", unmute )
132
- refresh_info( "In #{seconds_to_hms( statistics[:runtime] )}", unmute )
132
+ refresh_info( "Duration: #{seconds_to_hms( statistics[:runtime] )}", unmute )
133
+
134
+ res_req = "#{statistics[:http][:response_count]}/#{statistics[:http][:request_count]}"
135
+ refresh_info( "Processed #{res_req} HTTP requests.", unmute )
133
136
 
134
- avg = "Average: #{http[:total_responses_per_second].to_s} requests/second."
137
+ avg = "-- #{http[:total_responses_per_second].round(3)} requests/second."
135
138
  refresh_info( avg, unmute )
136
139
 
140
+ jobs = "#{browser_cluster[:completed_job_count]}/#{browser_cluster[:queued_job_count]}"
141
+ refresh_info( "Processed #{jobs} browser jobs.", unmute )
142
+
143
+ jobsps = "-- #{browser_cluster[:seconds_per_job].round(3)} second/job."
144
+ refresh_info( jobsps, unmute )
145
+
137
146
  refresh_line nil, unmute
138
147
  if !statistics[:current_page].to_s.empty?
139
148
  refresh_info( "Currently auditing #{statistics[:current_page]}", unmute )
140
149
  end
141
150
 
142
- refresh_info( "Burst response time sum #{http[:burst_response_time_sum]} seconds", unmute )
151
+ refresh_info( "Burst response time sum #{http[:burst_response_time_sum].round(3)} seconds", unmute )
143
152
  refresh_info( "Burst response count #{http[:burst_response_count]}", unmute )
144
- refresh_info( "Burst average response time #{http[:burst_average_response_time]} seconds", unmute )
145
- refresh_info( "Burst average #{http[:burst_responses_per_second]} requests/second", unmute )
153
+ refresh_info( "Burst average response time #{http[:burst_average_response_time].round(3)} seconds", unmute )
154
+ refresh_info( "Burst average #{http[:burst_responses_per_second].round(3)} requests/second", unmute )
146
155
  refresh_info( "Timed-out requests #{http[:time_out_count]}", unmute )
147
156
  refresh_info( "Original max concurrency #{options.http.request_concurrency}", unmute )
148
157
  refresh_info( "Throttled max concurrency #{http[:max_concurrency]}", unmute )
@@ -450,13 +459,15 @@ class Framework
450
459
  if !options.audit.links? && !options.audit.forms? &&
451
460
  !options.audit.cookies? && !options.audit.headers? &&
452
461
  !options.audit.link_templates? && !options.audit.jsons? &&
453
- !options.audit.xmls?
462
+ !options.audit.xmls? && !options.audit.ui_inputs? &&
463
+ !options.audit.ui_forms?
454
464
 
455
465
  print_info 'No element audit options were specified, will audit ' <<
456
- 'links, forms, cookies, JSONs and XMLs.'
466
+ 'links, forms, cookies, UI inputs, UI forms, JSONs and XMLs.'
457
467
  print_line
458
468
 
459
- options.audit.elements :links, :forms, :cookies, :jsons, :xmls
469
+ options.audit.elements :links, :forms, :cookies, :ui_inputs,
470
+ :ui_forms, :jsons, :xmls
460
471
  end
461
472
  end
462
473
 
@@ -208,6 +208,15 @@ class OptionParser < UI::CLI::OptionParser
208
208
  options.audit.xmls = true
209
209
  end
210
210
 
211
+ on( '--audit-ui-inputs', 'Audit orphan Input elements with events.' ) do
212
+ options.audit.ui_inputs = true
213
+ end
214
+
215
+ on( '--audit-ui-forms', 'Audit UI Forms.',
216
+ 'Input and button groups that do not belong to a parent <form> element.' ) do
217
+ options.audit.ui_forms = true
218
+ end
219
+
211
220
  on( '--audit-parameter-names',
212
221
  'Inject payloads into parameter names.'
213
222
  ) do
@@ -521,6 +530,12 @@ class OptionParser < UI::CLI::OptionParser
521
530
  separator ''
522
531
  separator 'Browser cluster'
523
532
 
533
+ on( '--browser-cluster-local-storage FILE',
534
+ "Sets the browsers' local storage using the JSON data in FILE."
535
+ ) do |file|
536
+ options.browser_cluster.local_storage = ::JSON.load( IO.read( file ) )
537
+ end
538
+
524
539
  on( '--browser-cluster-wait-for-element PATTERN:CSS',
525
540
  'Wait for element matching CSS to appear when visiting a page whose' <<
526
541
  ' URL matches the PATTERN.'
@@ -41,7 +41,14 @@ class OptionParser
41
41
  end
42
42
 
43
43
  def on( *args, &block )
44
- parser.on( *args, &block )
44
+ parser.on( *args ) do |*bargs|
45
+ begin
46
+ block.call *bargs
47
+ rescue => e
48
+ print_bad "#{args.first.split( /\s/ ).first}: [#{e.class}] #{e}"
49
+ exit 1
50
+ end
51
+ end
45
52
  end
46
53
 
47
54
  def banner
@@ -203,7 +203,8 @@ module Output
203
203
  # @see #debug?
204
204
  def print_debug( str = '', level = 1 )
205
205
  return if !debug?( level )
206
- print_color( '[!]', 36, str, $stderr )
206
+
207
+ print_color( "[#{'!' * level}]", 36, str, $stderr )
207
208
  end
208
209
 
209
210
  def print_debug_level_1( str = '' )
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: arachni
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.2.1
4
+ version: '1.3'
5
5
  platform: ruby
6
6
  authors:
7
7
  - Tasos Laskos
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2015-07-25 00:00:00.000000000 Z
11
+ date: 2015-10-07 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rack
@@ -385,7 +385,6 @@ files:
385
385
  - components/checks/active/xpath_injection/errors.txt
386
386
  - components/checks/active/xss.rb
387
387
  - components/checks/active/xss_dom.rb
388
- - components/checks/active/xss_dom_inputs.rb
389
388
  - components/checks/active/xss_dom_script_context.rb
390
389
  - components/checks/active/xss_event.rb
391
390
  - components/checks/active/xss_path.rb
@@ -677,10 +676,10 @@ files:
677
676
  - lib/arachni/element/body.rb
678
677
  - lib/arachni/element/capabilities/analyzable.rb
679
678
  - lib/arachni/element/capabilities/analyzable/differential.rb
680
- - lib/arachni/element/capabilities/analyzable/taint.rb
679
+ - lib/arachni/element/capabilities/analyzable/signature.rb
681
680
  - lib/arachni/element/capabilities/analyzable/timeout.rb
682
681
  - lib/arachni/element/capabilities/auditable.rb
683
- - lib/arachni/element/capabilities/auditable/dom.rb
682
+ - lib/arachni/element/capabilities/dom_only.rb
684
683
  - lib/arachni/element/capabilities/inputtable.rb
685
684
  - lib/arachni/element/capabilities/mutable.rb
686
685
  - lib/arachni/element/capabilities/refreshable.rb
@@ -697,6 +696,11 @@ files:
697
696
  - lib/arachni/element/cookie/capabilities/mutable.rb
698
697
  - lib/arachni/element/cookie/capabilities/with_dom.rb
699
698
  - lib/arachni/element/cookie/dom.rb
699
+ - lib/arachni/element/dom.rb
700
+ - lib/arachni/element/dom/capabilities/auditable.rb
701
+ - lib/arachni/element/dom/capabilities/inputtable.rb
702
+ - lib/arachni/element/dom/capabilities/mutable.rb
703
+ - lib/arachni/element/dom/capabilities/submittable.rb
700
704
  - lib/arachni/element/form.rb
701
705
  - lib/arachni/element/form/capabilities/auditable.rb
702
706
  - lib/arachni/element/form/capabilities/mutable.rb
@@ -705,6 +709,9 @@ files:
705
709
  - lib/arachni/element/form/dom.rb
706
710
  - lib/arachni/element/generic_dom.rb
707
711
  - lib/arachni/element/header.rb
712
+ - lib/arachni/element/header/capabilities/inputtable.rb
713
+ - lib/arachni/element/header/capabilities/mutable.rb
714
+ - lib/arachni/element/input/dom.rb
708
715
  - lib/arachni/element/json.rb
709
716
  - lib/arachni/element/json/capabilities/inputtable.rb
710
717
  - lib/arachni/element/json/capabilities/mutable.rb
@@ -713,13 +720,18 @@ files:
713
720
  - lib/arachni/element/link/capabilities/submittable.rb
714
721
  - lib/arachni/element/link/capabilities/with_dom.rb
715
722
  - lib/arachni/element/link/dom.rb
723
+ - lib/arachni/element/link/dom/capabilities/submittable.rb
716
724
  - lib/arachni/element/link_template.rb
717
725
  - lib/arachni/element/link_template/capabilities/auditable.rb
718
726
  - lib/arachni/element/link_template/capabilities/inputtable.rb
719
727
  - lib/arachni/element/link_template/capabilities/with_dom.rb
720
728
  - lib/arachni/element/link_template/dom.rb
729
+ - lib/arachni/element/link_template/dom/capabilities/submittable.rb
721
730
  - lib/arachni/element/path.rb
722
731
  - lib/arachni/element/server.rb
732
+ - lib/arachni/element/ui_form.rb
733
+ - lib/arachni/element/ui_form/dom.rb
734
+ - lib/arachni/element/ui_input.rb
723
735
  - lib/arachni/element/xml.rb
724
736
  - lib/arachni/element/xml/capabilities/inputtable.rb
725
737
  - lib/arachni/element/xml/capabilities/mutable.rb
@@ -923,7 +935,7 @@ files:
923
935
  - spec/arachni/data_spec.rb
924
936
  - spec/arachni/element/body_spec.rb
925
937
  - spec/arachni/element/capabilities/analyzable/differential_spec.rb
926
- - spec/arachni/element/capabilities/analyzable/taint_spec.rb
938
+ - spec/arachni/element/capabilities/analyzable/signature_spec.rb
927
939
  - spec/arachni/element/capabilities/analyzable/timeout_spec.rb
928
940
  - spec/arachni/element/capabilities/with_scope/scope_spec.rb
929
941
  - spec/arachni/element/cookie/dom_spec.rb
@@ -939,6 +951,10 @@ files:
939
951
  - spec/arachni/element/link_template_spec.rb
940
952
  - spec/arachni/element/path_spec.rb
941
953
  - spec/arachni/element/server_spec.rb
954
+ - spec/arachni/element/ui_form/ui_form_dom_spec.rb
955
+ - spec/arachni/element/ui_form_spec.rb
956
+ - spec/arachni/element/ui_input/dom_spec.rb
957
+ - spec/arachni/element/ui_input_spec.rb
942
958
  - spec/arachni/element/xml_spec.rb
943
959
  - spec/arachni/element_filter_spec.rb
944
960
  - spec/arachni/error_spec.rb
@@ -1064,7 +1080,6 @@ files:
1064
1080
  - spec/components/checks/active/unvalidated_redirect_dom_spec.rb
1065
1081
  - spec/components/checks/active/unvalidated_redirect_spec.rb
1066
1082
  - spec/components/checks/active/xpath_injection_spec.rb
1067
- - spec/components/checks/active/xss_dom_inputs_spec.rb
1068
1083
  - spec/components/checks/active/xss_dom_script_context_spec.rb
1069
1084
  - spec/components/checks/active/xss_dom_spec.rb
1070
1085
  - spec/components/checks/active/xss_event_spec.rb
@@ -1200,6 +1215,8 @@ files:
1200
1215
  - spec/support/factories/element/link_template.rb
1201
1216
  - spec/support/factories/element/path.rb
1202
1217
  - spec/support/factories/element/server.rb
1218
+ - spec/support/factories/element/ui_form.rb
1219
+ - spec/support/factories/element/ui_input.rb
1203
1220
  - spec/support/factories/element/xml.rb
1204
1221
  - spec/support/factories/http/request.rb
1205
1222
  - spec/support/factories/http/response.rb
@@ -1255,7 +1272,7 @@ files:
1255
1272
  - spec/support/fixtures/run_check/server.rb
1256
1273
  - spec/support/fixtures/script_plugin.rb
1257
1274
  - spec/support/fixtures/services/echo.rb
1258
- - spec/support/fixtures/taint_check/taint.rb
1275
+ - spec/support/fixtures/signature_check/signature.rb
1259
1276
  - spec/support/fixtures/usernames.txt
1260
1277
  - spec/support/fixtures/wait_check/wait.rb
1261
1278
  - spec/support/helpers/auditor.rb
@@ -1294,18 +1311,20 @@ files:
1294
1311
  - spec/support/servers/arachni/check/auditor.rb
1295
1312
  - spec/support/servers/arachni/element/body.rb
1296
1313
  - spec/support/servers/arachni/element/capabilities/analyzable/differential.rb
1297
- - spec/support/servers/arachni/element/capabilities/analyzable/taint.rb
1314
+ - spec/support/servers/arachni/element/capabilities/analyzable/signature.rb
1298
1315
  - spec/support/servers/arachni/element/capabilities/analyzable/timeout.rb
1299
1316
  - spec/support/servers/arachni/element/cookie.rb
1300
1317
  - spec/support/servers/arachni/element/cookie/cookie_dom.rb
1301
1318
  - spec/support/servers/arachni/element/form.rb
1302
1319
  - spec/support/servers/arachni/element/form/form_dom.rb
1303
1320
  - spec/support/servers/arachni/element/header.rb
1321
+ - spec/support/servers/arachni/element/input/input_dom.rb
1304
1322
  - spec/support/servers/arachni/element/json.rb
1305
1323
  - spec/support/servers/arachni/element/link.rb
1306
1324
  - spec/support/servers/arachni/element/link/link_dom.rb
1307
1325
  - spec/support/servers/arachni/element/link_template.rb
1308
1326
  - spec/support/servers/arachni/element/link_template/link_template_dom.rb
1327
+ - spec/support/servers/arachni/element/ui_form/ui_form_dom.rb
1309
1328
  - spec/support/servers/arachni/element/xml.rb
1310
1329
  - spec/support/servers/arachni/framework.rb
1311
1330
  - spec/support/servers/arachni/http/client.rb
@@ -1364,7 +1383,6 @@ files:
1364
1383
  - spec/support/servers/checks/active/xpath_injection/php
1365
1384
  - spec/support/servers/checks/active/xss.rb
1366
1385
  - spec/support/servers/checks/active/xss_dom.rb
1367
- - spec/support/servers/checks/active/xss_dom_inputs.rb
1368
1386
  - spec/support/servers/checks/active/xss_dom_script_context.rb
1369
1387
  - spec/support/servers/checks/active/xss_event.rb
1370
1388
  - spec/support/servers/checks/active/xss_path.rb
@@ -1430,16 +1448,21 @@ files:
1430
1448
  - spec/support/shared/component/options/base.rb
1431
1449
  - spec/support/shared/element/base.rb
1432
1450
  - spec/support/shared/element/capabilities/auditable.rb
1433
- - spec/support/shared/element/capabilities/auditable/dom.rb
1451
+ - spec/support/shared/element/capabilities/dom_only.rb
1434
1452
  - spec/support/shared/element/capabilities/inputtable.rb
1435
1453
  - spec/support/shared/element/capabilities/mutable.rb
1436
1454
  - spec/support/shared/element/capabilities/refreshable.rb
1437
- - spec/support/shared/element/capabilities/submitable.rb
1455
+ - spec/support/shared/element/capabilities/submittable.rb
1438
1456
  - spec/support/shared/element/capabilities/with_auditor.rb
1439
1457
  - spec/support/shared/element/capabilities/with_dom.rb
1440
1458
  - spec/support/shared/element/capabilities/with_node.rb
1441
1459
  - spec/support/shared/element/capabilities/with_scope.rb
1442
1460
  - spec/support/shared/element/capabilities/with_source.rb
1461
+ - spec/support/shared/element/dom.rb
1462
+ - spec/support/shared/element/dom/auditable.rb
1463
+ - spec/support/shared/element/dom/inputtable.rb
1464
+ - spec/support/shared/element/dom/mutable.rb
1465
+ - spec/support/shared/element/dom/submittable.rb
1443
1466
  - spec/support/shared/external/wavsep.rb
1444
1467
  - spec/support/shared/fingerprinter.rb
1445
1468
  - spec/support/shared/framework.rb
@@ -1508,7 +1531,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
1508
1531
  version: '0'
1509
1532
  requirements: []
1510
1533
  rubyforge_project:
1511
- rubygems_version: 2.4.7
1534
+ rubygems_version: 2.4.8
1512
1535
  signing_key:
1513
1536
  specification_version: 4
1514
1537
  summary: Arachni is a feature-full, modular, high-performance Ruby framework aimed
@@ -1550,6 +1573,7 @@ test_files:
1550
1573
  - spec/support/fixtures/passwords.txt
1551
1574
  - spec/support/fixtures/cookies.txt
1552
1575
  - spec/support/fixtures/fingerprinters/test.rb
1576
+ - spec/support/fixtures/signature_check/signature.rb
1553
1577
  - spec/support/fixtures/usernames.txt
1554
1578
  - spec/support/fixtures/run_check/links.rb
1555
1579
  - spec/support/fixtures/run_check/flch.rb
@@ -1561,7 +1585,6 @@ test_files:
1561
1585
  - spec/support/fixtures/run_check/cookies.rb
1562
1586
  - spec/support/fixtures/run_check/empty.rb
1563
1587
  - spec/support/fixtures/run_check/server.rb
1564
- - spec/support/fixtures/taint_check/taint.rb
1565
1588
  - spec/support/fixtures/plugins_with_priorities/p0.rb
1566
1589
  - spec/support/fixtures/plugins_with_priorities/p22.rb
1567
1590
  - spec/support/fixtures/plugins_with_priorities/p_nil.rb
@@ -1623,7 +1646,6 @@ test_files:
1623
1646
  - spec/support/servers/checks/active/sql_injection/mysql
1624
1647
  - spec/support/servers/checks/active/xpath_injection.rb
1625
1648
  - spec/support/servers/checks/active/session_fixation.rb
1626
- - spec/support/servers/checks/active/xss_dom_inputs.rb
1627
1649
  - spec/support/servers/checks/active/no_sql_injection_differential.rb
1628
1650
  - spec/support/servers/checks/active/sql_injection_timing.rb
1629
1651
  - spec/support/servers/checks/active/sql_injection.rb
@@ -1694,13 +1716,15 @@ test_files:
1694
1716
  - spec/support/servers/arachni/element/cookie.rb
1695
1717
  - spec/support/servers/arachni/element/link_template.rb
1696
1718
  - spec/support/servers/arachni/element/xml.rb
1719
+ - spec/support/servers/arachni/element/ui_form/ui_form_dom.rb
1697
1720
  - spec/support/servers/arachni/element/link/link_dom.rb
1698
1721
  - spec/support/servers/arachni/element/link.rb
1699
1722
  - spec/support/servers/arachni/element/form/form_dom.rb
1700
- - spec/support/servers/arachni/element/capabilities/analyzable/taint.rb
1723
+ - spec/support/servers/arachni/element/capabilities/analyzable/signature.rb
1701
1724
  - spec/support/servers/arachni/element/capabilities/analyzable/differential.rb
1702
1725
  - spec/support/servers/arachni/element/capabilities/analyzable/timeout.rb
1703
1726
  - spec/support/servers/arachni/element/cookie/cookie_dom.rb
1727
+ - spec/support/servers/arachni/element/input/input_dom.rb
1704
1728
  - spec/support/servers/arachni/element/json.rb
1705
1729
  - spec/support/servers/arachni/element/link_template/link_template_dom.rb
1706
1730
  - spec/support/servers/arachni/element/header.rb
@@ -1739,10 +1763,12 @@ test_files:
1739
1763
  - spec/support/factories/element/link_template.rb
1740
1764
  - spec/support/factories/element/xml.rb
1741
1765
  - spec/support/factories/element/link.rb
1766
+ - spec/support/factories/element/ui_input.rb
1742
1767
  - spec/support/factories/element/json.rb
1743
1768
  - spec/support/factories/element/generic_dom.rb
1744
1769
  - spec/support/factories/element/header.rb
1745
1770
  - spec/support/factories/element/server.rb
1771
+ - spec/support/factories/element/ui_form.rb
1746
1772
  - spec/support/factories/page.rb
1747
1773
  - spec/support/factories/http/request.rb
1748
1774
  - spec/support/factories/http/response.rb
@@ -1761,17 +1787,22 @@ test_files:
1761
1787
  - spec/support/shared/support/lookup.rb
1762
1788
  - spec/support/shared/support/cache.rb
1763
1789
  - spec/support/shared/element/base.rb
1790
+ - spec/support/shared/element/dom.rb
1764
1791
  - spec/support/shared/element/capabilities/inputtable.rb
1765
1792
  - spec/support/shared/element/capabilities/mutable.rb
1766
1793
  - spec/support/shared/element/capabilities/refreshable.rb
1767
1794
  - spec/support/shared/element/capabilities/with_node.rb
1768
- - spec/support/shared/element/capabilities/submitable.rb
1795
+ - spec/support/shared/element/capabilities/submittable.rb
1769
1796
  - spec/support/shared/element/capabilities/with_source.rb
1770
- - spec/support/shared/element/capabilities/auditable/dom.rb
1797
+ - spec/support/shared/element/capabilities/dom_only.rb
1771
1798
  - spec/support/shared/element/capabilities/with_auditor.rb
1772
1799
  - spec/support/shared/element/capabilities/with_scope.rb
1773
1800
  - spec/support/shared/element/capabilities/with_dom.rb
1774
1801
  - spec/support/shared/element/capabilities/auditable.rb
1802
+ - spec/support/shared/element/dom/inputtable.rb
1803
+ - spec/support/shared/element/dom/mutable.rb
1804
+ - spec/support/shared/element/dom/submittable.rb
1805
+ - spec/support/shared/element/dom/auditable.rb
1775
1806
  - spec/support/shared/external/wavsep.rb
1776
1807
  - spec/support/shared/plugin.rb
1777
1808
  - spec/support/shared/framework.rb
@@ -1836,7 +1867,6 @@ test_files:
1836
1867
  - spec/components/checks/active/trainer_spec.rb
1837
1868
  - spec/components/checks/active/xss_script_context_spec.rb
1838
1869
  - spec/components/checks/active/unvalidated_redirect_dom_spec.rb
1839
- - spec/components/checks/active/xss_dom_inputs_spec.rb
1840
1870
  - spec/components/checks/active/os_cmd_injection_spec.rb
1841
1871
  - spec/components/checks/active/no_sql_injection_spec.rb
1842
1872
  - spec/components/checks/active/path_traversal_spec.rb
@@ -1996,11 +2026,15 @@ test_files:
1996
2026
  - spec/arachni/support/database/hash_spec.rb
1997
2027
  - spec/arachni/element/body_spec.rb
1998
2028
  - spec/arachni/element/server_spec.rb
2029
+ - spec/arachni/element/ui_form_spec.rb
1999
2030
  - spec/arachni/element/path_spec.rb
2031
+ - spec/arachni/element/ui_input_spec.rb
2032
+ - spec/arachni/element/ui_form/ui_form_dom_spec.rb
2000
2033
  - spec/arachni/element/link/dom_spec.rb
2001
2034
  - spec/arachni/element/form/dom_spec.rb
2035
+ - spec/arachni/element/ui_input/dom_spec.rb
2002
2036
  - spec/arachni/element/capabilities/analyzable/differential_spec.rb
2003
- - spec/arachni/element/capabilities/analyzable/taint_spec.rb
2037
+ - spec/arachni/element/capabilities/analyzable/signature_spec.rb
2004
2038
  - spec/arachni/element/capabilities/analyzable/timeout_spec.rb
2005
2039
  - spec/arachni/element/capabilities/with_scope/scope_spec.rb
2006
2040
  - spec/arachni/element/cookie/dom_spec.rb