arachni 1.3.2 → 1.4

data/components/checks/active/code_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -12,8 +12,6 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.2.3
-#
 # @see http://cwe.mitre.org/data/definitions/94.html
 # @see http://php.net/manual/en/function.eval.php
 # @see http://perldoc.perl.org/functions/eval.html
@@ -32,18 +30,18 @@ class Arachni::Checks::CodeInjection < Arachni::Check::Base
 
     def self.options
         @options ||= {
-            substring: (rand1.to_i + rand2.to_i).to_s,
-            format:    [Format::STRAIGHT]
+            signatures: (rand1.to_i * rand2.to_i).to_s,
+            format:     [Format::STRAIGHT]
         }
     end
 
     def self.code_strings
         # code strings to be injected to the webapp
         @code_strings ||= {
-            php:    "print #{rand1}+#{rand2};",
-            perl:   "print #{rand1}+#{rand2};",
-            python: "print #{rand1}+#{rand2}",
-            asp:    "Response.Write\x28#{rand1}+#{rand2}\x29"
+            php:    "print #{rand1}*#{rand2};",
+            perl:   "print #{rand1}*#{rand2};",
+            python: "print #{rand1}*#{rand2}",
+            asp:    "Response.Write\x28#{rand1}*#{rand2}\x29"
         }
     end
 
@@ -70,7 +68,7 @@ Injects code snippets and assess whether or not execution was successful.
 },
             elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.3',
+            version:     '0.2.5',
             platforms:   payloads.keys,
 
             issue:       {

data/components/checks/active/code_injection_php_input_wrapper.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -7,15 +7,14 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.2
 # @see OWASP    https://www.owasp.org/index.php/Top_10_2007-Malicious_File_Execution
 class Arachni::Checks::CodeInjectionPhpInputWrapper < Arachni::Check::Base
 
     def self.options
         @options ||= {
-            format:    [Format::STRAIGHT],
-            body:      "<?php echo 'vDBVBsbVdv'; ?> <?php echo chr(80).chr(76).chr(76).chr(33).chr(56).chr(111).chr(55) ?>",
-            substring: 'vDBVBsbVdv PLL!8o7',
+            format:     [Format::STRAIGHT],
+            body:       "<?php echo 'vDBVBsbVdv'; ?> <?php echo chr(80).chr(76).chr(76).chr(33).chr(56).chr(111).chr(55) ?>",
+            signatures: 'vDBVBsbVdv PLL!8o7',
 
             # Add one more mutation (on the fly) which will include the extension
             # of the original value (if that value was a filename) after a null byte.
@@ -53,7 +52,7 @@ to try and load it.
 },
             elements:    [ Element::Form, Element::Link, Element::Cookie, Element::Header ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1.2',
+            version:     '0.1.3',
             platforms:   [:php],
 
             issue:       {

data/components/checks/active/code_injection_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/csrf.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/file_inclusion.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,7 +9,6 @@
 # File inclusion check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.6
 #
 # @see http://cwe.mitre.org/data/definitions/98.html
 # @see https://www.owasp.org/index.php/PHP_File_Inclusion
@@ -18,33 +17,28 @@ class Arachni::Checks::FileInclusion < Arachni::Check::Base
     def self.options
         @options ||= {
             format: [Format::STRAIGHT],
-            regexp: {
-                unix: [
-                    /DOCUMENT_ROOT.*HTTP_USER_AGENT/,
-                    /:.+:\d+:\d+:.+:[0-9a-zA-Z\/]+/im
-                ],
-                windows: [
-                    /\[boot loader\].*\[operating systems\]/im,
-                    /\[fonts\].*\[extensions\]/im
-                ],
-                java:    [
-                    /<web\-app/im
-                ],
+            signatures: FILE_SIGNATURES_PER_PLATFORM.merge(
                 # Generic PHP errors.
                 php: [
-                    /An error occurred in script/,
-                    /Failed opening '.*?' for inclusion/,
-                    /Failed opening required/,
-                    /failed to open stream:/,
-                    /<b>Warning<\/b>:\s+file/,
-                    /<b>Warning<\/b>:\s+read_file/,
-                    /<b>Warning<\/b>:\s+highlight_file/,
-                    /<b>Warning<\/b>:\s+show_source/
+                    'An error occurred in script',
+                    'Failed opening required',
+                    'failed to open stream:',
+                    proc do |response|
+                        next if !response.body.include?( "Failed opening '" )
+                        /Failed opening '.*?' for inclusion/
+                    end,
+                    proc do |response|
+                        next if !response.body.include?( '<b>Warning</b>:' )
+                        /<b>Warning<\/b>:\s+(?:file|read_file|highlight_file|show_source)/
+                    end
                 ],
                 perl: [
-                    /in .* at .* line d+?\./
+                    proc do |response|
+                        next if !response.body.include?( ' line ' )
+                        /in .* at .* line d+?\./
+                    end
                 ]
-            },
+            ),
 
             # Add one more mutation (on the fly) which will include the extension
             # of the original value (if that value was a filename) after a null byte.
@@ -100,8 +94,8 @@ content or errors in the HTTP response body.
 },
             elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1.6',
-            platforms:   options[:regexp].keys,
+            version:     '0.1.7',
+            platforms:   options[:signatures].keys,
 
             issue:       {
                 name:            %q{File Inclusion},

data/components/checks/active/ldap_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,7 +9,6 @@
 # LDAP injection check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.3
 #
 # @see http://cwe.mitre.org/data/definitions/90.html
 # @see http://projects.webappsec.org/w/page/13246947/LDAP-Injection
@@ -23,8 +22,8 @@ class Arachni::Checks::LdapInjection < Arachni::Check::Base
     def run
         # This string will hopefully force the webapp to output LDAP error messages.
         audit( '#^($!@$)(()))******',
-            format:    [Format::APPEND],
-            substring: self.class.error_strings
+            format:     [Format::APPEND],
+            signatures: self.class.error_strings
         )
     end
 
@@ -37,7 +36,7 @@ discover failures in user input validation.
 },
             elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.3',
+            version:     '0.1.4',
 
             issue:       {
                 name:            %q{LDAP Injection},

data/components/checks/active/no_sql_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -7,25 +7,18 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.2
 class Arachni::Checks::NoSqlInjection < Arachni::Check::Base
 
-    def self.error_patterns
-        return @error_patterns if @error_patterns
+    def self.error_signatures
+        return @error_signatures if @error_signatures
 
-        @error_patterns = {}
-        Dir[File.dirname( __FILE__ ) + '/no_sql_injection/patterns/*'].each do |file|
-            @error_patterns[File.basename( file ).to_sym] =
-                IO.read( file ).split( "\n" ).map do |pattern|
-                    Regexp.new( pattern, Regexp::IGNORECASE )
-                end
+        @error_signatures = {}
+        Dir[File.dirname( __FILE__ ) + '/no_sql_injection/substrings/*'].each do |file|
+            @error_signatures[File.basename( file ).to_sym] =
+                IO.read( file ).split( "\n" )
         end
 
-        @error_patterns
-    end
-
-    def self.ignore_patterns
-        @ignore_patterns ||= read_file( 'regexp_ignore.txt' )
+        @error_signatures
     end
 
     # Prepares the payloads that will hopefully cause the webapp to output SQL
@@ -36,10 +29,8 @@ class Arachni::Checks::NoSqlInjection < Arachni::Check::Base
 
     def self.options
         @options ||= {
-            format:                    [Format::APPEND],
-            regexp:                    error_patterns,
-            ignore:                    ignore_patterns,
-            longest_word_optimization: true
+            format:     [Format::APPEND],
+            signatures: error_signatures
         }
     end
 
@@ -55,7 +46,7 @@ NoSQL injection check, uses known DB errors to identify vulnerabilities.
 },
             elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.2',
+            version:     '0.1.3',
             platforms:   payloads.keys,
 
             issue:       {

data/components/checks/active/no_sql_injection/substrings/mongodb

@@ -0,0 +1 @@
+Uncaught exception 'MongoCursorException'

data/components/checks/active/no_sql_injection_differential.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -7,7 +7,6 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.1
 class Arachni::Checks::NoSqlInjectionDifferential < Arachni::Check::Base
 
     def self.options
@@ -23,7 +22,7 @@ class Arachni::Checks::NoSqlInjectionDifferential < Arachni::Check::Base
             end
         end
 
-        @options = { false: '-1', pairs: pairs }
+        @options = { false: '-1839', pairs: pairs }
     end
 
     def run
@@ -40,7 +39,7 @@ that of a vulnerable application.
 },
             elements:    [ Element::Link, Element::Form, Element::Cookie ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.1',
+            version:     '0.1.2',
             platforms:   [ :nosql ],
 
             issue:       {

data/components/checks/active/os_cmd_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,7 +9,6 @@
 # Simple OS command injection check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2.5
 #
 # @see http://cwe.mitre.org/data/definitions/78.html
 # @see https://www.owasp.org/index.php/OS_Command_Injection
@@ -17,14 +16,11 @@ class Arachni::Checks::OsCmdInjection < Arachni::Check::Base
 
     def self.options
         @options ||= {
-            regexp: {
+            signatures: {
                 unix: [
-                    /:.+:\d+:\d+:.+:[0-9a-zA-Z\/]+/im
+                    FILE_SIGNATURES['passwd']
                 ],
-                windows: [
-                    /\[boot loader\].*\[operating systems\]/im,
-                    /\[fonts\].*\[extensions\]/im
-                ]
+                windows: FILE_SIGNATURES_PER_PLATFORM[:windows]
             },
             format: [Format::STRAIGHT]
         }
@@ -73,7 +69,7 @@ Tries to find Operating System command injections.
 },
             elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.2.5',
+            version:     '0.2.6',
             platforms:   payloads.keys,
 
             issue:       {

data/components/checks/active/os_cmd_injection_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/path_traversal.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,7 +9,6 @@
 # Path Traversal check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.4.6
 #
 # @see http://cwe.mitre.org/data/definitions/22.html
 # @see https://www.owasp.org/index.php/Path_Traversal
@@ -21,20 +20,8 @@ class Arachni::Checks::PathTraversal < Arachni::Check::Base
 
     def self.options
         @options ||= {
-            format: [Format::STRAIGHT],
-            regexp: {
-                unix: [
-                    /DOCUMENT_ROOT.*HTTP_USER_AGENT/,
-                    /:.+:\d+:\d+:.+:[0-9a-zA-Z\/]+/im
-                ],
-                windows: [
-                    /\[boot loader\].*\[operating systems\]/im,
-                    /\[fonts\].*\[extensions\]/im
-                ],
-                java: [
-                    /<web\-app/im
-                ]
-            },
+            format:     [Format::STRAIGHT],
+            signatures: FILE_SIGNATURES_PER_PLATFORM,
 
             # Add one more mutation (on the fly) which will include the extension
             # of the original value (if that value was a filename) after a null byte.
@@ -111,7 +98,7 @@ of relevant content in the HTML responses.
 },
             elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.4.6',
+            version:     '0.4.7',
             platforms:   payloads.keys,
 
             issue:       {

data/components/checks/active/response_splitting.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -28,7 +28,13 @@ class Arachni::Checks::ResponseSplitting < Arachni::Check::Base
 
         # try to inject the headers into all vectors
         # and pass a block that will check for a positive result
-        audit( header, submit: { follow_location: false } ) do |response, element|
+        audit(
+            header,
+            submit: {
+                follow_location:   false,
+                response_max_size: 0
+            }
+        ) do |response, element|
             next if response.headers[header_name].to_s.downcase != 'no'
 
             log(

data/components/checks/active/rfi.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,7 +9,6 @@
 # Simple Remote File Inclusion (and tutorial) check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.3.1
 #
 # @see http://cwe.mitre.org/data/definitions/94.html
 # @see http://projects.webappsec.org/Remote-File-Inclusion
@@ -58,8 +57,8 @@ class Arachni::Checks::Rfi < Arachni::Check::Base # *always* extend Arachni::Che
     #
     def self.options
         @options ||= {
-            substring:       '705cd559b16e6946826207c2199bd890',
-            submit: {
+            signatures: '705cd559b16e6946826207c2199bd890',
+            submit:     {
                 follow_location: false
             }
         }
@@ -106,7 +105,7 @@ the HTTP response body.
             # empty or don't define it at all.
             elements:    ELEMENTS_WITH_INPUTS - [Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.3.1',
+            version:     '0.3.2',
 
             issue:       {
                 name:        %q{Remote File Inclusion},