arachni 1.3.2 → 1.4

data/lib/arachni/element/capabilities/auditable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -114,8 +114,7 @@ module Auditable
         return false if self.inputs.empty?
 
         if scope.out?
-            print_debug_level_2 "#{__method__}: Element is out of scope, " <<
-                                    "skipping: #{audit_id}"
+            print_debug_level_2 "Element is out of scope, skipping: #{audit_id}"
             return false
         end
 
@@ -235,8 +234,13 @@ module Auditable
     #
     # @param  [Block]   block
     #   Block to be used for analysis of the response.
-    def submit_and_process( options = {}, &block )
-        submit( options ) do |response|
+    def submit_and_process( &block )
+        submit( @audit_options[:submit] || {} ) do |response|
+            # In case of redirection or runtime scope changes.
+            if !response.parsed_url.seed_in_host? && response.scope.out?
+                next
+            end
+
             element = response.request.performer
             if !element.audit_options[:silent]
                 print_status "Analyzing response ##{response.request.id} for " <<
@@ -316,8 +320,6 @@ module Auditable
         skip_like_option = [@audit_options.delete(:skip_like)].flatten.compact
         each_mutation    = @audit_options.delete(:each_mutation)
 
-        submit_options = @audit_options[:submit] || {}
-
         # Iterate over all fuzz variations and audit each one.
         each_mutation( payload, @audit_options ) do |elem|
             if !audit_input?( elem.affected_input_name )
@@ -345,8 +347,14 @@ module Auditable
             if skip_like_option.any?
                 should_skip = false
                 skip_like_option.each do |like|
-                    break should_skip = true if like.call( elem )
+                    if like.call( elem )
+                        mid = elem.audit_id( payload  )
+                        print_debug_level_2 ":skip_like callbacks returned true for mutation, skipping: #{mid}"
+                        print_debug_level_2 "--> #{like}"
+                        break should_skip = true
+                    end
                 end
+
                 next if should_skip
             end
 
@@ -361,21 +369,18 @@ module Auditable
                 [elements].flatten.compact.each do |e|
                     next if !e.is_a?( self.class )
 
-                    e.submit_and_process( submit_options, &block )
+                    e.submit_and_process( &block )
                 end
             end
 
-            elem.submit_and_process( submit_options, &block )
+            elem.submit_and_process( &block )
         end
 
         true
     end
 
-    def audit_input?( path )
-        [path].flatten.each do |name|
-            return false if !Options.audit.vector?( name )
-        end
-        true
+    def audit_input?( name )
+        Options.audit.vector?( name )
     end
 
     # Checks whether or not an audit has been already performed.

data/lib/arachni/element/capabilities/dom_only.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -15,6 +15,7 @@ module Element::Capabilities
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 module DOMOnly
+    include Arachni::Element::Capabilities::WithAuditor
     include Arachni::Element::Capabilities::Inputtable
     include Arachni::Element::Capabilities::WithNode
     include Arachni::Element::Capabilities::WithDOM
@@ -35,15 +36,15 @@ module DOMOnly
     end
 
     def coverage_id
-        dom.coverage_id
+        "#{type}:#{dom.coverage_id}"
     end
 
     def coverage_hash
-        dom.coverage_hash
+        coverage_id.persistent_hash
     end
 
     def id
-        dom.id
+        "#{type}:#{dom.id}"
     end
 
     def dup

data/lib/arachni/element/capabilities/inputtable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -38,7 +38,7 @@ module Capabilities::Inputtable
     end
 
     INPUTTABLE_CACHE = {
-        inputtable_id: Support::Cache::LeastRecentlyPushed.new( 1_000 )
+        inputtable_id: Support::Cache::LeastRecentlyPushed.new( 100_000 )
     }
 
     # Frozen version of {#inputs}, has all the original names and values.
@@ -52,6 +52,39 @@ module Capabilities::Inputtable
     #   Frozen effective inputs.
     attr_reader :inputs
 
+    # @note Null-bytes will always be encoded.
+    #
+    # @return   [Array]
+    #   List of input names which should have their values submitted in raw
+    #   form, without encoding.
+    attr_reader :raw_inputs
+
+    def initialize( options )
+        super
+        @raw_inputs = []
+    end
+
+    # @param    [String]    name
+    #   Name of the input to check.
+    #
+    # @return   [Boolean]
+    #   `true` if the input `name` is in {#raw_inputs}, `false` otherwise.
+    def raw_input?( name )
+        @raw_inputs.include? name
+    end
+
+    # @note Will convert names to strings.
+    #
+    # @param  [Array]  raw
+    #   Input names whose values should not be encoded during submission.
+    #
+    # @raise   [Error::InvalidData::Name]
+    def raw_inputs=( raw )
+        names = raw.map(&:to_s)
+        names.each { |name| fail_if_invalid_name( name ) }
+        @raw_inputs = raw.map(&:to_s)
+    end
+
     # @note Will convert keys and values to strings.
     #
     # @param  [Hash]  hash
@@ -104,7 +137,8 @@ module Capabilities::Inputtable
     # Resets the inputs to their original format/values.
     def reset
         super if defined?( super )
-        self.inputs = @default_inputs.deep_clone
+        self.inputs = @default_inputs.rpc_clone
+        self.raw_inputs = []
         self
     end
 
@@ -227,34 +261,44 @@ module Capabilities::Inputtable
     # @return   [String]
     #   Uniquely identifies the {#inputs}.
     def inputtable_id
-        INPUTTABLE_CACHE[:inputtable_id][@inputs] ||=
-            @inputs ? @inputs.sort_by { |k, _| k }.hash.to_s : ''
+        Arachni::Element::Capabilities::Inputtable.inputtable_id( inputs, raw_inputs )
+    end
+
+    def self.inputtable_id( inputs, raw_inputs )
+        INPUTTABLE_CACHE[:inputtable_id].fetch [inputs, raw_inputs] do
+            id  = inputs ? inputs.sort_by { |k, _| k }.hash.to_s : ''
+            id << ':'
+            id << (raw_inputs ? raw_inputs.sort.hash.to_s : '')
+        end
     end
 
     def to_h
         (defined?( super ) ? super : {}).merge(
             inputs:         inputs,
+            raw_inputs:     raw_inputs,
             default_inputs: default_inputs
         )
     end
 
     private
 
-    def fail_if_invalid( name, value )
+    def fail_if_invalid_name( name )
         if !valid_input_data?( name.to_s )
             fail Error::InvalidData::Name,
                  "Invalid data in input name for #{self.class}: #{name.inspect}"
         end
 
-        if !valid_input_data?( value.to_s )
-            fail Error::InvalidData::Value,
-                 "Invalid data in input value for #{self.class}: #{value.inspect}"
-        end
-
         if !valid_input_name?( name.to_s )
             fail Error::InvalidData::Name,
                  "Invalid name for #{self.class}: #{name.inspect}"
         end
+    end
+
+    def fail_if_invalid_value( value )
+        if !valid_input_data?( value.to_s )
+            fail Error::InvalidData::Value,
+                 "Invalid data in input value for #{self.class}: #{value.inspect}"
+        end
 
         if !valid_input_value?( value.to_s )
             fail Error::InvalidData::Value,
@@ -262,8 +306,14 @@ module Capabilities::Inputtable
         end
     end
 
+    def fail_if_invalid( name, value )
+        fail_if_invalid_name( name )
+        fail_if_invalid_value( value )
+    end
+
     def copy_inputtable( other )
-        other.inputs = self.inputs.dup
+        other.inputs     = self.inputs.dup
+        other.raw_inputs = self.raw_inputs.dup
         other
     end
 

data/lib/arachni/element/capabilities/mutable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -51,9 +51,9 @@ module Mutable
         #
         # Values can be OR'ed bitfields of all available constants of {Format}.
         format:                 [
-                                    Format::STRAIGHT, Format::APPEND,
-                                    Format::NULL, Format::APPEND | Format::NULL
-                                ],
+            Format::STRAIGHT, Format::APPEND,
+            Format::NULL, Format::APPEND | Format::NULL
+        ],
 
         # Inject the payload into parameter values.
         #
@@ -69,6 +69,13 @@ module Mutable
         # * `false`
         parameter_names:        nil,
 
+        # Add mutations with non-encoded payloads.
+        #
+        # * `nil`: Use system settings (`!Options.audit.with_raw_parameters`).
+        # * `true`
+        # * `false`
+        with_raw_payloads:       nil,
+
         # Add the payload to an extra parameter.
         #
         # * `nil`: Use system settings (`!Options.audit.with_extra_parameter`).
@@ -135,6 +142,13 @@ module Mutable
         @immutables ||= Set.new
     end
 
+    # @return   [Boolean]
+    #   `true` if the mutation's {#affected_input_value} has been set to skip
+    #   encoding, `false` otherwise.
+    def with_raw_payload?
+        raw_inputs.include? affected_input_name
+    end
+
     # @note Vector names in {#immutables} will be excluded.
     #
     # Injects the `payload` in self's values according to formatting options
@@ -162,7 +176,7 @@ module Mutable
         print_debug_formatting( options )
 
         options          = prepare_mutation_options( options )
-        generated        = Support::LookUp::HashSet.new( hasher: :mutable_id )
+        generated        = Support::LookUp::HashSet.new
         filled_in_inputs = Options.input.fill( @inputs )
 
         if options[:parameter_values]
@@ -182,8 +196,15 @@ module Mutable
                         formatted_payload, format, &block
                     )
 
-                    next if !elem || !options[:with_both_http_methods]
-                    yield_if_unique( elem.switch_method, generated, &block )
+                    next if !elem
+
+                    if options[:with_raw_payloads]
+                        yield_if_unique( elem.with_raw_payload, generated, &block )
+                    end
+
+                    if options[:with_both_http_methods]
+                        yield_if_unique( elem.switch_method, generated, &block )
+                    end
                 end
             end
         end
@@ -193,8 +214,8 @@ module Mutable
                 each_formatted_payload( payload, options[:format] ) do |format, formatted_payload|
 
                     elem = create_and_yield_if_unique(
-                        generated, filled_in_inputs.merge( EXTRA_NAME => '' ), payload, EXTRA_NAME,
-                        formatted_payload, format, &block
+                        generated, filled_in_inputs.merge( EXTRA_NAME => '' ),
+                        payload, EXTRA_NAME, formatted_payload, format, &block
                     )
 
                     next if !elem || !options[:with_both_http_methods]
@@ -223,6 +244,16 @@ module Mutable
         nil
     end
 
+    def parameter_name_audit?
+        affected_input_name == FUZZ_NAME
+    end
+
+    def with_raw_payload
+        self.dup.tap do |c|
+            c.raw_inputs << c.affected_input_name
+        end
+    end
+
     def switch_method
         self.dup.tap { |c| c.method = (c.method == :get ? :post : :get) }
     end
@@ -270,6 +301,7 @@ module Mutable
 
         s << "default-inputs=#{default_inputs.inspect} "
         s << "inputs=#{inputs.inspect} "
+        s << "raw_inputs=#{raw_inputs.inspect} "
 
         if mutation?
             s << "seed=#{seed.inspect} "
@@ -293,7 +325,15 @@ module Mutable
     protected
 
     def mutable_id
-        "#{self.method}:#{inputtable_id}"
+        Arachni::Element::Capabilities::Mutable.mutable_id(
+            method,
+            inputs,
+            raw_inputs
+        )
+    end
+
+    def self.mutable_id( method, inputs, raw_inputs )
+        "#{method}:#{Arachni::Element::Capabilities::Inputtable.inputtable_id( inputs, raw_inputs )}"
     end
 
     private
@@ -301,6 +341,10 @@ module Mutable
     def prepare_mutation_options( options )
         options = MUTATION_OPTIONS.merge( options )
 
+        if options[:with_raw_payloads].nil?
+            options[:with_raw_payloads] = Options.audit.with_raw_payloads?
+        end
+
         if options[:parameter_values].nil?
             options[:parameter_values] = Options.audit.parameter_values?
         end
@@ -353,8 +397,18 @@ module Mutable
         elem
     end
 
-    def create_and_yield_if_unique( list, inputs, seed, input_name, input_value,
-                                      format, &block )
+    def create_and_yield_if_unique(
+        list, inputs, seed, input_name, input_value,format, &block
+    )
+        # We can check if it's unique prior to actually creating, so do it.
+        return if list.include?(
+            Arachni::Element::Capabilities::Mutable.mutable_id(
+                self.method,
+                inputs,
+                []
+            )
+        )
+
         element = create_mutation( inputs, seed, input_name, input_value, format )
         return if !element
 
@@ -363,7 +417,7 @@ module Mutable
     end
 
     def yield_if_unique( element, list )
-        return if list.include?( element )
+        return if list.include?( element.mutable_id )
 
         print_debug_mutation element
         list << element
@@ -444,6 +498,13 @@ module Mutable
         mutation.inputs.each do |k, v|
             print_debug_level_2 "|----> #{k.inspect} => #{v.inspect}"
         end
+
+        if mutation.raw_inputs.any?
+            print_debug_level_2 '|--> Raw inputs: '
+            mutation.raw_inputs.each do |k|
+                print_debug_level_2 "|----> #{k.inspect}"
+            end
+        end
     end
 
     def print_debug_trainer( opts )

data/lib/arachni/element/capabilities/refreshable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/capabilities/submittable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -74,7 +74,10 @@ module Capabilities::Submittable
 
         @auditor ||= options.delete( :auditor )
 
-        options[:performer]      ||= self
+        options[:performer] ||= self
+
+        options[:raw_parameters] ||= raw_inputs
+
         http_request( options, &block )
     end