arachni 1.3.2 → 1.4

data/lib/arachni/processes/manager.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -43,11 +43,11 @@ class Manager
         Timeout.timeout 10 do
             while sleep 0.1 do
                 begin
-                    # I'd rather this be an INT but WEBrick's INT traps write to
-                    # the Logger and multiple INT signals force it to write to a
-                    # closed logger and crash.
-                    Process.kill( Gem.win_platform? ? 'QUIT' : 'KILL', pid )
-                rescue Errno::ESRCH
+                    Process.kill( Arachni.windows? ? 'KILL' : 'TERM', pid )
+                # Either kill was succesful or we don't have enough perms or
+                # we hit a reused PID for someone else's process, either way,
+                # consider the process gone.
+                rescue Errno::ESRCH, Errno::EPERM
                     @pids.delete pid
                     return
                 end
@@ -56,6 +56,31 @@ class Manager
     rescue Timeout::Error
     end
 
+    # @param    [Integer]   pid
+    # @return   [Boolean]
+    #   `true` if the process is alive, `false` otherwise.
+    def alive?( pid )
+        # Windows is not big on POSIX so try it its own way if possible.
+        if Arachni.windows?
+            begin
+                alive = false
+                wmi = WIN32OLE.connect( 'winmgmts://' )
+                processes = wmi.ExecQuery( "select ProcessId from win32_process where ProcessID='#{pid}'" )
+                processes.each do |proc|
+                    proc.ole_free
+                    alive = true
+                end
+                processes.ole_free
+                wmi.ole_free
+
+                return alive
+            rescue WIN32OLERuntimeError
+            end
+        end
+
+        !!(Process.kill( 0, pid ) rescue false)
+    end
+
     # @param    [Array<Integer>]   pids
     #   PIDs of the process to {Arachni::Processes::Manager#kill}.
     def kill_many( pids )
@@ -104,8 +129,29 @@ class Manager
         fork = options.delete(:fork)
         fork = true if fork.nil?
 
+        stdin      = options.delete(:stdin)
+        stdout     = options.delete(:stdout)
+        stderr     = options.delete(:stderr)
+        new_pgroup = options.delete(:new_pgroup)
+
+        spawn_options = {}
+
+        if new_pgroup
+            if Arachni.windows?
+                spawn_options[:new_pgroup] = new_pgroup
+            else
+                spawn_options[:pgroup] = new_pgroup
+            end
+        end
+
+        spawn_options[:in]     = stdin  if stdin
+        spawn_options[:out]    = stdout if stdout
+        spawn_options[:err]    = stderr if stderr
+
+        options[:ppid]  = Process.pid
+
         options[:options] ||= {}
-        options[:options] = Options.to_h.merge( options[:options] )
+        options[:options]   = Options.to_h.merge( options[:options] )
 
         # Paths are not included in RPC nor Hash representations as they're
         # considered local, in this case though they're necessary to provide
@@ -122,8 +168,17 @@ class Manager
         # have a fallback ready.
         if fork && Process.respond_to?( :fork )
             pid = Process.fork do
-                if discard_output?
+                $stdin = spawn_options[:in] if spawn_options[:in]
+
+                if spawn_options[:out]
+                    $stdout = spawn_options[:out]
+                elsif discard_output?
                     $stdout.reopen( Arachni.null_device, 'w' )
+                end
+
+                if spawn_options[:err]
+                    $stderr = spawn_options[:err]
+                elsif discard_output?
                     $stderr.reopen( Arachni.null_device, 'w' )
                 end
 
@@ -146,7 +201,11 @@ class Manager
             # It's very, **VERY** important that we use this argument format as
             # it bypasses the OS shell and we can thus count on a 1-to-1 process
             # creation and that the PID we get will be for the actual process.
-            pid = Process.spawn( RbConfig.ruby, RUNNER, *argv )
+            pid = Process.spawn(
+                RbConfig.ruby,
+                RUNNER,
+                *(argv + [spawn_options])
+            )
         end
 
         self << pid

data/lib/arachni/report.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/reporter.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/reporter/base.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/reporter/formatter_manager.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -12,7 +12,9 @@ module Reporter
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 class FormatterManager < Component::Manager
     def paths
-        Dir.glob( File.join( "#{@lib}", '*.rb' ) ).reject { |path| helper?( path ) }
+        @paths_cache ||=
+            Dir.glob( File.join( "#{@lib}", '*.rb' ) ).
+                reject { |path| helper?( path ) }
     end
 end
 

data/lib/arachni/reporter/manager.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -45,7 +45,8 @@ class Manager < Arachni::Component::Manager
     private
 
     def paths
-        Dir.glob( File.join( "#{@lib}", '*.rb' ) ).reject { |path| helper?( path ) }
+        @paths_cache ||= Dir.glob( File.join( "#{@lib}", '*.rb' ) ).
+            reject { |path| helper?( path ) }
     end
 
 end

data/lib/arachni/reporter/options.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/rest/server.rb

@@ -0,0 +1,231 @@
+=begin
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+require 'puma'
+require 'puma/minissl'
+require 'sinatra'
+require 'sinatra/contrib'
+
+module Arachni
+module Rest
+
+class Server < Sinatra::Base
+    lib = Options.paths.lib
+    require lib + 'processes'
+    require lib + 'rest/server/instance_helpers'
+
+    helpers InstanceHelpers
+
+    use Rack::Deflater
+    use Rack::Session::Pool
+
+    set :environment, :production
+
+    enable :logging
+
+    VALID_REPORT_FORMATS = %w(json xml yaml html.zip)
+
+    before do
+        protected!
+        content_type :json
+    end
+
+    helpers do
+        def protected!
+            if !settings.respond_to?( :username )
+                settings.set :username, nil
+            end
+
+            if !settings.respond_to?( :password )
+                settings.set :password, nil
+            end
+
+            return if !settings.username && !settings.password
+            return if authorized?
+
+            headers['WWW-Authenticate'] = 'Basic realm="Restricted Area"'
+            halt 401, "Not authorized\n"
+        end
+
+        def authorized?
+            @auth ||= Rack::Auth::Basic::Request.new( request.env )
+            @auth.provided? && @auth.basic? && @auth.credentials == [
+                settings.username.to_s, settings.password.to_s
+            ]
+        end
+
+        def fail_if_not_exists
+            token = params[:id]
+
+            return if exists? token
+
+            halt 404, "Scan not found for token: #{h token}."
+        end
+
+        def h( text )
+            Rack::Utils.escape_html( text )
+        end
+    end
+
+    # List scans.
+    get '/scans' do
+        json instances.keys.inject({}){ |h, k| h.merge! k => {}}
+    end
+
+    # Create
+    post '/scans' do
+        options = ::JSON.load( request.body.read ) || {}
+
+        instance = Processes::Instances.spawn( fork: false )
+
+        begin
+            instance.service.scan( options )
+        rescue => e
+            Processes::Instances.kill( instance.url )
+            halt 500,
+                 json(
+                     error:     "#{e.class}: #{e}",
+                     backtrace: e.backtrace
+                 )
+        end
+
+        instances[instance.token] = instance
+
+        json id: instance.token
+    end
+
+    # Progress
+    get '/scans/:id' do
+        fail_if_not_exists
+
+        session[params[:id]] ||= {
+            seen_issues:  [],
+            seen_errors:  0,
+            seen_sitemap: 0
+        }
+
+        data = scan_for( params[:id] ).progress(
+            with:    [
+                :issues,
+                errors:  session[params[:id]][:seen_errors],
+                sitemap: session[params[:id]][:seen_sitemap]
+            ],
+            without: [
+                issues: session[params[:id]][:seen_issues]
+            ]
+        )
+
+        data[:issues].each do |issue|
+            session[params[:id]][:seen_issues] << issue['digest']
+        end
+
+        session[params[:id]][:seen_errors]  += data[:errors].size
+        session[params[:id]][:seen_sitemap] += data[:sitemap].size
+
+        json data
+    end
+
+    get '/scans/:id/report.html.zip' do
+        fail_if_not_exists
+        content_type 'zip'
+        scan_for( params[:id] ).report_as( 'html' )
+    end
+
+    get '/scans/:id/report.?:format?' do
+        fail_if_not_exists
+
+        params[:format] ||= 'json'
+
+        if !VALID_REPORT_FORMATS.include?( params[:format] )
+            halt 400, "Invalid report format: #{h params[:format]}."
+        end
+
+        content_type params[:format]
+
+        scan_for( params[:id] ).report_as( params[:format] )
+    end
+
+    put '/scans/:id/pause' do
+        fail_if_not_exists
+
+        json scan_for( params[:id] ).pause
+    end
+
+    put '/scans/:id/resume' do
+        fail_if_not_exists
+
+        json scan_for( params[:id] ).resume
+    end
+
+    # Abort/shutdown
+    delete '/scans/:id' do
+        fail_if_not_exists
+        id = params[:id]
+
+        instance = instances[id]
+        instance.service.shutdown
+
+        # Make sure.
+        kill_instance( id )
+
+        instances.delete( id ).close
+
+        session.delete params[:id]
+
+        json nil
+    end
+
+    class <<self
+        include Arachni::UI::Output
+
+        def run!( options )
+            set :username, options[:username]
+            set :password, options[:password]
+
+            server = Puma::Server.new( self )
+            server.min_threads = 0
+            server.max_threads = 16
+
+            ssl = false
+            if options[:ssl_key] && options[:ssl_certificate]
+                ctx = Puma::MiniSSL::Context.new
+
+                ctx.key  = options[:ssl_key]
+                ctx.cert = options[:ssl_certificate]
+
+                if options[:ssl_ca]
+                    print_info 'CA provided, peer verification has been enabled.'
+
+                    ctx.ca          = options[:ssl_ca]
+                    ctx.verify_mode = Puma::MiniSSL::VERIFY_PEER |
+                        Puma::MiniSSL::VERIFY_FAIL_IF_NO_PEER_CERT
+                else
+                    print_info 'CA missing, peer verification has been disabled.'
+                end
+
+                ssl = true
+                server.binder.add_ssl_listener( options[:bind], options[:port], ctx )
+            else
+                ssl = false
+                server.add_tcp_listener( options[:bind], options[:port] )
+            end
+
+            print_status "Listening on http#{'s' if ssl}://#{options[:bind]}:#{options[:port]}"
+
+            begin
+                server.run.join
+            rescue Interrupt
+                server.stop( true )
+            end
+        end
+    end
+
+end
+
+end
+end

data/lib/arachni/rest/server/instance_helpers.rb

@@ -0,0 +1,37 @@
+=begin
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni
+module Rest
+class Server
+
+module InstanceHelpers
+
+    @@instances = {}
+
+    def instances
+        @@instances
+    end
+
+    def scan_for( id )
+        @@instances[id].service
+    end
+
+    def exists?( id )
+        instances.include? id
+    end
+
+    def kill_instance( id )
+        Processes::Instances.kill( instances[id].url )
+    end
+
+end
+
+end
+end
+end