arachni 1.2.1 → 1.3

data/lib/arachni/element/link_template/dom/capabilities/submittable.rb

@@ -0,0 +1,29 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni::Element
+class LinkTemplate::DOM
+module Capabilities
+
+# Extends {Arachni::Element::DOM::Capabilities::Submittable} with
+# {LinkTemplate}-specific functionality.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module Submittable
+    include Arachni::Element::DOM::Capabilities::Submittable
+
+    def prepare_browser( browser, options )
+        @browser = browser
+        browser.javascript.custom_code = options[:custom_code]
+        browser.javascript.taint       = options[:taint]
+    end
+
+end
+end
+end
+end

data/lib/arachni/element/server.rb

@@ -139,12 +139,10 @@ class Server < Base
 
     def self.flag_issues_as_untrusted( issue_digests )
         issue_digests.uniq.each do |digest|
-            next if !Arachni::Data.issues[digest]
+            next if !(issue = Arachni::Data.issues[digest])
 
-            Arachni::Data.issues[digest].variations.each do |issue|
-                issue.add_remark :meta_analysis, REMARK
-                issue.trusted = false
-            end
+            issue.add_remark :meta_analysis, REMARK
+            issue.trusted = false
         end
     end
 

data/lib/arachni/element/ui_form.rb

@@ -0,0 +1,106 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+require_relative 'base'
+
+module Arachni::Element
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class UIForm < Base
+    require_relative 'ui_form/dom'
+
+    include Arachni::Element::Capabilities::DOMOnly
+
+    SUPPORTED_TYPES = Set.new([:input, :button])
+
+    attr_accessor :opening_tags
+
+    def initialize( options )
+        super options
+
+        @opening_tags = (options[:opening_tags] || []).dup
+    end
+
+    def dup
+        super.tap do |o|
+            o.opening_tags = self.opening_tags.dup
+        end
+    end
+
+    def self.type
+        :ui_form
+    end
+
+    def self.from_browser( browser, page )
+        ui_forms = []
+
+        # JS not supported on page, no sense in continuing...
+        return ui_forms if !browser.javascript.supported?
+
+        # Does the page have any buttons at all?
+        if !page.has_elements?( :button ) &&
+            !page.document.xpath( "//input[@type='button']" )
+            return ui_forms
+        end
+
+        # Does the page have any text inputs?
+        inputs, opening_tags = inputs_from_page( page )
+        return ui_forms if inputs.empty?
+
+        # Looks like we have input groups, get buttons with events.
+        browser.each_element_with_events false do |locator, events|
+            next if !SUPPORTED_TYPES.include?( locator.tag_name )
+            next if locator.tag_name == :input &&
+                locator.attributes['type'] != 'button'
+
+            browser.filter_events( locator.tag_name, events ).each do |event, _|
+                ui_forms << new(
+                    action:       page.url,
+                    source:       locator.to_s,
+                    method:       event,
+                    inputs:       inputs,
+                    opening_tags: opening_tags
+                )
+            end
+        end
+
+        ui_forms
+    end
+
+    def self.inputs_from_page( page )
+        opening_tags = {}
+        inputs       = {}
+
+        page.document.css( 'textarea' ).each do |textarea|
+            name = node_to_name( textarea )
+
+            inputs[name]       = textarea.text
+            opening_tags[name] = Arachni::Browser::ElementLocator.from_node( textarea ).to_s
+        end
+
+        page.document.css( 'input' ).each do |input|
+            next if input['type'] && input['type'] != 'text'
+
+            name = node_to_name( input )
+
+            inputs[name]       = input['value'].to_s
+            opening_tags[name] = Arachni::Browser::ElementLocator.from_node( input ).to_s
+        end
+
+        [inputs, opening_tags]
+    end
+
+    def self.node_to_name( node )
+        node['name'] || node['id'] ||
+            Arachni::Browser::ElementLocator.from_node( node ).to_s
+    end
+
+end
+end
+
+Arachni::UIForm = Arachni::Element::UIForm

data/lib/arachni/element/ui_form/dom.rb

@@ -0,0 +1,107 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+require_relative '../dom'
+
+module Arachni::Element
+class UIForm
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class DOM < DOM
+    include Arachni::Element::Capabilities::WithNode
+
+    include Arachni::Element::DOM::Capabilities::Mutable
+    include Arachni::Element::DOM::Capabilities::Inputtable
+    include Arachni::Element::DOM::Capabilities::Submittable
+    include Arachni::Element::DOM::Capabilities::Auditable
+
+    INPUTS = Set.new([:input, :textarea])
+
+    def initialize( options )
+        super
+
+        @opening_tags = (options[:opening_tags] || parent.opening_tags).dup
+
+        self.method = options[:method] || self.parent.method
+
+        inputs = (options[:inputs] || self.parent.inputs ).dup
+
+        @valid_input_names = Set.new(inputs.keys)
+        self.inputs        = inputs
+
+        @default_inputs = self.inputs.dup.freeze
+    end
+
+    # Submits the form using the configured {#inputs}.
+    def trigger
+        transitions = fill_in_inputs
+
+        print_debug "Submitting: #{self.source}"
+        submission_transition = browser.fire_event( element, @method )
+        print_debug "Submitted: #{self.source}"
+
+        return if !submission_transition
+
+        transitions + [submission_transition]
+    end
+
+    def valid_input_name?( name )
+        @valid_input_names.include? name.to_s
+    end
+
+    def type
+        self.class.type
+    end
+    def self.type
+        :ui_form_dom
+    end
+
+    def initialization_options
+        super.merge(
+            inputs:       inputs.dup,
+            method:       @method,
+            opening_tags: @opening_tags.dup
+        )
+    end
+
+    def marshal_dump
+        super.tap { |h| h.delete :@valid_input_names }
+    end
+
+    private
+
+    def fill_in_inputs
+        transitions = []
+
+        @inputs.each do |name, value|
+            locator     = locator_for_input( name )
+            opening_tag = @opening_tags[name]
+
+            print_debug "Filling in: #{name} => #{value} [#{opening_tag}]"
+
+            t = browser.fire_event( locator, :input, value: value )
+
+            if !t
+                print_debug "Could not fill in: #{name} => #{value} [#{opening_tag}]"
+                next
+            end
+            print_debug "Filled in: #{name} => #{value} [#{opening_tag}]"
+
+            transitions << t
+        end
+
+        transitions
+    end
+
+    def locator_for_input( name )
+        Arachni::Browser::ElementLocator.from_html @opening_tags[name]
+    end
+
+end
+end
+end

data/lib/arachni/element/ui_input.rb

@@ -0,0 +1,62 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+require_relative 'base'
+
+module Arachni::Element
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class UIInput < Base
+    require_relative 'input/dom'
+
+    include Arachni::Element::Capabilities::DOMOnly
+
+    SUPPORTED_TYPES = Set.new([:input, :textarea])
+
+    def self.type
+        :ui_input
+    end
+
+    def self.from_browser( browser, page )
+        inputs = []
+
+        return inputs if !browser.javascript.supported?
+
+        if page.document.css( 'textarea' ).empty? &&
+            page.document.xpath( '//input[@type="text"]' ).empty? &&
+                page.document.xpath( '//input[not(@type)]' ).empty?
+            return inputs
+        end
+
+        browser.each_element_with_events false do |locator, events|
+            next if !SUPPORTED_TYPES.include?( locator.tag_name )
+            next if locator.attributes['type'] &&
+                locator.attributes['type'] != 'text'
+
+            browser.filter_events( locator.tag_name, events ).each do |event, _|
+                name = locator.attributes['name'] || locator.attributes['id'] ||
+                    locator.to_s
+
+                inputs << new(
+                    action: page.url,
+                    source: locator.to_s,
+                    method: event,
+                    inputs: {
+                        name => locator.attributes['value'].to_s
+                    }
+                )
+            end
+        end
+
+        inputs
+    end
+
+end
+end
+
+Arachni::UIInput = Arachni::Element::UIInput

data/lib/arachni/element/xml.rb

@@ -18,7 +18,8 @@ class XML < Base
     lib = "#{File.dirname( __FILE__ )}/#{File.basename(__FILE__, '.rb')}/capabilities/**/*.rb"
     Dir.glob( lib ).each { |f| require f }
 
-    # Generic element capabilities.
+    include Arachni::Element::Capabilities::Auditable
+    include Arachni::Element::Capabilities::Submittable
     include Arachni::Element::Capabilities::Analyzable
     include Arachni::Element::Capabilities::WithSource
 

data/lib/arachni/framework.rb

@@ -133,6 +133,7 @@ class Framework
     #   Framework statistics:
     #
     #   *  `:http`          -- {HTTP::Client#statistics}
+    #   * `browser_cluster` -- {BrowserCluster.statistics}
     #   *  `:runtime`       -- Scan runtime in seconds.
     #   *  `:found_pages`   -- Number of discovered pages.
     #   *  `:audited_pages` -- Number of audited pages.
@@ -141,11 +142,12 @@ class Framework
     #   *  `:messages`      -- {#status_messages}
     def statistics
         {
-            http:          http.statistics,
-            runtime:       @start_datetime ? Time.now - @start_datetime : 0,
-            found_pages:   sitemap.size,
-            audited_pages: state.audited_page_count,
-            current_page:  @current_url
+            http:            http.statistics,
+            browser_cluster: BrowserCluster.statistics,
+            runtime:         @start_datetime ? Time.now - @start_datetime : 0,
+            found_pages:     sitemap.size,
+            audited_pages:   state.audited_page_count,
+            current_page:    @current_url
         }
     end
 

data/lib/arachni/framework/parts/audit.rb

@@ -80,7 +80,6 @@ module Audit
 
         state.audited_page_count += 1
         add_to_sitemap( page )
-        sitemap.merge!( browser_sitemap )
 
         print_line
         print_status "[HTTP: #{page.code}] #{page.dom.url}"

data/lib/arachni/framework/parts/check.rb

@@ -80,6 +80,7 @@ module Check
             @checks.run_one( check, page )
         rescue => e
             print_error "Error in #{check.to_s}: #{e.to_s}"
+            print_error "Page: #{page.dom.url}"
             print_error_backtrace e
             false
         end

data/lib/arachni/framework/parts/data.rb

@@ -184,6 +184,10 @@ module Data
         data.add_page_to_sitemap( page )
     end
 
+    def update_sitemap( entries )
+        data.update_sitemap( entries )
+    end
+
     def push_paths_from_page( page )
         page.paths.select { |path| push_to_url_queue( path ) }
     end

data/lib/arachni/framework/parts/state.rb

@@ -108,8 +108,6 @@ module State
 
         state.status = :cleanup
 
-        sitemap.merge!( browser_sitemap )
-
         if shutdown_browsers
             state.set_status_message :browser_cluster_shutdown
             shutdown_browser_cluster

data/lib/arachni/http/client.rb

@@ -116,6 +116,8 @@ class Client
     # @return   [Dynamic404Handler]
     attr_reader :dynamic_404_handler
 
+    attr_reader :original_max_concurrency
+
     def initialize
         super
         reset
@@ -177,12 +179,14 @@ class Client
     #   *  {#burst_responses_per_second}
     #   *  {#burst_average_response_time}
     #   *  {#max_concurrency}
+    #   *  {#original_max_concurrency}
     def statistics
        [:request_count, :response_count, :time_out_count,
         :total_responses_per_second, :burst_response_time_sum,
         :burst_response_count, :burst_responses_per_second,
         :burst_average_response_time, :total_average_response_time,
-        :max_concurrency].inject({}) { |h, k| h[k] = send(k); h }
+        :max_concurrency, :original_max_concurrency].
+           inject({}) { |h, k| h[k] = send(k); h }
     end
 
     # @return    [CookieJar]
@@ -549,10 +553,15 @@ class Client
         request = response.request
 
         synchronize do
-            @response_count          += 1
-            @burst_response_count    += 1
-            @burst_response_time_sum += response.time
-            @total_response_time_sum += response.time
+            @response_count       += 1
+            @burst_response_count += 1
+
+            response_time = response.timed_out? ?
+                request.timeout / 1_000.0 :
+                response.time
+
+            @burst_response_time_sum += response_time
+            @total_response_time_sum += response_time
 
             if response.request.fingerprint? &&
                 Platform::Manager.fingerprint?( response )
@@ -587,8 +596,10 @@ class Client
     end
 
     def client_initialize
+        @original_max_concurrency = Options.http.request_concurrency || MAX_CONCURRENCY
+
         @hydra = Typhoeus::Hydra.new(
-            max_concurrency: Options.http.request_concurrency || MAX_CONCURRENCY
+            max_concurrency: @original_max_concurrency
         )
     end