arachni 1.3.2 → 1.4

data/components/checks/active/session_fixation.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -20,7 +20,7 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.1.2
+# @version 0.1.3
 class Arachni::Checks::SessionFixation < Arachni::Check::Base
 
     def token
@@ -43,7 +43,13 @@ class Arachni::Checks::SessionFixation < Arachni::Check::Base
                 name = cookie.name
                 print_info "Found session cookie named: #{name}"
 
-                audit( token ) do |response, element|
+                audit(
+                    token,
+                    with_raw_parameters: false,
+                    submit: {
+                        response_max_size: 0
+                    }
+                ) do |response, element|
                     cookie = cookies_from_response( response ).
                         select { |c| c.name == name }.first
                     next if !cookie || !cookie.value.include?( token )

data/components/checks/active/source_code_disclosure.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -11,29 +11,14 @@
 # source code.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2.3
 #
 # @see http://cwe.mitre.org/data/definitions/540.html
 class Arachni::Checks::SourceCodeDisclosure < Arachni::Check::Base
 
     def self.options
         @options ||= {
-            format:  [Format::STRAIGHT],
-            regexp:  {
-                php:  [
-                    /<\?php/
-                ],
-                java: [
-                    /<%|<%=|<%@\s+page|<%@\s+include|<%--|import\s+javax.servlet|
-                        import\s+java.io|import=['"]java.io|request\.getParameterValues\(|
-                        response\.setHeader|response\.setIntHeader\(/m
-                ],
-                asp:  [
-                    /<%|Response\.Write|Request\.Form|Request\.QueryString|
-                        Response\.Flush|Session\.SessionID|Session\.Timeout|
-                        Server\.CreateObject|Server\.MapPath/im
-                ]
-            },
+            format:     [Format::STRAIGHT],
+            signatures: SOURCE_CODE_SIGNATURES_PER_PLATFORM,
 
             # Add one more mutation (on the fly) which will include the extension
             # of the original value (if that value was a filename) after a null byte.
@@ -121,8 +106,8 @@ source code.
 },
             elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.3',
-            platforms:   options[:regexp].keys,
+            version:     '0.2.4',
+            platforms:   options[:signatures].keys,
 
             issue:       {
                 name:            %q{Source code disclosure},

data/components/checks/active/sql_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,7 +9,6 @@
 # SQL Injection check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2.2
 #
 # @see http://cwe.mitre.org/data/definitions/89.html
 # @see http://unixwiz.net/techtips/sql-injection.html
@@ -18,22 +17,36 @@
 # @see https://www.owasp.org/index.php/SQL_Injection
 class Arachni::Checks::SqlInjection < Arachni::Check::Base
 
-    def self.error_patterns
-        return @error_patterns if @error_patterns
+    def self.error_signatures
+        return @error_signatures if @error_signatures
 
-        @error_patterns = {}
-        Dir[File.dirname( __FILE__ ) + '/sql_injection/patterns/*'].each do |file|
-            @error_patterns[File.basename( file ).to_sym] =
-                IO.read( file ).split( "\n" ).map do |pattern|
-                    Regexp.new( pattern, Regexp::IGNORECASE )
+        @error_signatures = {}
+
+        Dir[File.dirname( __FILE__ ) + '/sql_injection/substrings/*'].each do |file|
+            @error_signatures[File.basename( file ).to_sym] =
+                IO.read( file ).split( "\n" )
+        end
+
+        Dir[File.dirname( __FILE__ ) + '/sql_injection/regexps/*'].each do |file|
+            platform = File.basename( file, '.yaml' ).to_sym
+
+            @error_signatures[platform] ||= []
+
+            YAML.load_file( file ).each do |substring, pattern|
+                regexp = Regexp.new( pattern )
+
+                @error_signatures[platform] << proc do |response|
+                    next if !response.body.include?( substring )
+                    regexp
                 end
+            end
         end
 
-        @error_patterns
+        @error_signatures
     end
 
-    def self.ignore_patterns
-        @ignore_patterns ||= read_file( 'regexp_ignore.txt' )
+    def self.ignore_signatures
+        @ignore_signatures ||= read_file( 'ignore_substrings' )
     end
 
     # Prepares the payloads that will hopefully cause the webapp to output SQL
@@ -44,10 +57,9 @@ class Arachni::Checks::SqlInjection < Arachni::Check::Base
 
     def self.options
         @options ||= {
-            format:                    [Format::APPEND],
-            regexp:                    error_patterns,
-            ignore:                    ignore_patterns,
-            longest_word_optimization: true
+            format:     [Format::APPEND],
+            signatures: error_signatures,
+            ignore:     ignore_signatures
         }
     end
 
@@ -63,8 +75,8 @@ SQL injection check, uses known SQL DB errors to identify vulnerabilities.
 },
             elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.2',
-            platforms:   options[:regexp].keys,
+            version:     '0.2.3',
+            platforms:   options[:signatures].keys,
 
             issue:       {
                 name:            %q{SQL Injection},

data/components/checks/active/sql_injection/regexps/db2.yaml

@@ -0,0 +1,2 @@
+CLI Driver: CLI Driver.*DB2
+db2_: db2_\w+\(

data/components/checks/active/sql_injection/regexps/frontbase.yaml

@@ -0,0 +1 @@
+Transaction rollback: Exception (condition )?\d+\. Transaction rollback\.

data/components/checks/active/sql_injection/regexps/informix.yaml

@@ -0,0 +1 @@
+Informix: Exception.*Informix

data/components/checks/active/sql_injection/regexps/ingres.yaml

@@ -0,0 +1,2 @@
+ingres_: Warning.*ingres_
+Ingres: Ingres\W.*Driver

data/components/checks/active/sql_injection/regexps/maxdb.yaml

@@ -0,0 +1,2 @@
+SQL error: SQL error.*POS([0-9]+).*
+maxdb: Warning.*maxdb.*

data/components/checks/active/sql_injection/regexps/mssql.yaml

@@ -0,0 +1,8 @@
+Procedure or function: Procedure or function .* expects parameter
+in query expression: Syntax error .* in query expression
+SQL Server: OLE DB.*SQL Server
+mssql_: Warning.*mssql_.*
+Driver: Driver.*SQL[\-\_\ ]*Server
+SQL Server: SQL Server.*Driver
+SQL Server: SQL Server.*[0-9a-fA-F]{8}
+SqlClient: Exception.*\WSystem\.Data\.SqlClient\.

data/components/checks/active/sql_injection/regexps/mysql.yaml

@@ -0,0 +1,4 @@
+Table ': Table '[^']+' doesn't exist
+SQL syntax: SQL syntax.*MySQL
+mysql_: Warning.*mysql_.*
+

data/components/checks/active/sql_injection/regexps/oracle.yaml

@@ -0,0 +1,4 @@
+ORA-: ORA-[0-9][0-9][0-9][0-9]
+Oracle: Oracle.*Driver
+oci_: Warning.*oci_.*
+ora_: Warning.*ora_.*

data/components/checks/active/sql_injection/regexps/pgsql.yaml

@@ -0,0 +1,3 @@
+ERROR: PostgreSQL.*ERROR
+pg_: Warning.*pg_.*
+PG::: PG::([a-zA-Z]*)Error

data/components/checks/active/sql_injection/regexps/sqlite.yaml

@@ -0,0 +1,2 @@
+sqlite_: Warning.*sqlite_.*
+SQLite3::: "Warning.*SQLite3::"

data/components/checks/active/sql_injection/regexps/sybase.yaml

@@ -0,0 +1,2 @@
+sybase: Warning.*sybase.*
+Server message: Sybase.*Server message.*

data/components/checks/active/sql_injection/substrings/access

@@ -0,0 +1,3 @@
+JET Database Engine
+Access Database Engine
+[Microsoft][ODBC Microsoft Access Driver]

data/components/checks/active/sql_injection/substrings/db2

@@ -0,0 +1,2 @@
+[IBM][CLI Driver][DB2/6000]
+DB2 SQL error

data/components/checks/active/sql_injection/{patterns → substrings}/emc

@@ -1,2 +1,2 @@
-\[DM_QUERY_E_SYNTAX\]
+[DM_QUERY_E_SYNTAX]
 has occurred in the vicinity of:

data/components/checks/active/sql_injection/{patterns → substrings}/firebird

@@ -1,2 +1 @@
 Dynamic SQL Error
-

data/components/checks/active/sql_injection/substrings/hsqldb

@@ -0,0 +1 @@
+org.hsqldb.jdbc

data/components/checks/active/sql_injection/{patterns → substrings}/informix

@@ -1,3 +1,2 @@
 An illegal character has been found in the statement
-com\.informix\.jdbc
-Exception.*Informix
+com.informix.jdbc

data/components/checks/active/sql_injection/substrings/ingres

@@ -0,0 +1 @@
+Ingres SQLSTATE

data/components/checks/active/sql_injection/substrings/mssql

@@ -0,0 +1,17 @@
+System.Data.OleDb.OleDbException
+[Microsoft][ODBC SQL Server Driver]
+[Macromedia][SQLServer JDBC Driver]
+[SqlException
+System.Data.SqlClient.SqlException
+Unclosed quotation mark after the character string
+'80040e14'
+mssql_query()
+Microsoft OLE DB Provider for ODBC Drivers
+Microsoft OLE DB Provider for SQL Server
+Incorrect syntax near
+Sintaxis incorrecta cerca de
+Syntax error in string in query expression
+Unclosed quotation mark before the character string
+Data type mismatch in criteria expression.
+ADODB.Field (0x800A0BCD)
+the used select statements have different number of columns

data/components/checks/active/sql_injection/{patterns → substrings}/mysql

@@ -1,15 +1,12 @@
 supplied argument is not a valid MySQL
 Column count doesn't match value count at row
-mysql_fetch_array\(\)
+mysql_fetch_array()
 on MySQL result index
 You have an error in your SQL syntax;
 You have an error in your SQL syntax near
 MySQL server version for the right syntax to use
-\[MySQL\]\[ODBC
+[MySQL][ODBC
 Column count doesn't match
-Table '[^']+' doesn't exist
-SQL syntax.*MySQL
-Warning.*mysql_.*
 valid MySQL result
-MySqlClient\.
+MySqlClient.
 

data/components/checks/active/sql_injection/substrings/oracle

@@ -0,0 +1,2 @@
+java.sql.SQLException
+Oracle error

data/components/checks/active/sql_injection/{patterns → substrings}/pgsql

@@ -1,9 +1,6 @@
 PostgreSQL query failed:
 supplied argument is not a valid PostgreSQL result
-pg_query\(\) \[:
-pg_exec\(\) \[:
-PostgreSQL.*ERROR
-Warning.*pg_.*
+pg_query() [:
+pg_exec() [:
 valid PostgreSQL result
-Npgsql\.
-PG::([a-zA-Z]*)Error
+Npgsql.

data/components/checks/active/sql_injection/substrings/sqlite

@@ -0,0 +1,3 @@
+SQLite/JDBCDriver
+SQLite.Exception
+System.Data.SQLite.SQLiteException

data/components/checks/active/sql_injection/substrings/sybase

@@ -0,0 +1 @@
+Sybase message:

data/components/checks/active/sql_injection_differential.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -14,8 +14,6 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.4.3
-#
 # @see http://cwe.mitre.org/data/definitions/89.html
 # @see http://capec.mitre.org/data/definitions/7.html
 # @see https://www.owasp.org/index.php/Blind_SQL_Injection
@@ -36,13 +34,13 @@ class Arachni::Checks::SqlInjectionDifferential < Arachni::Check::Base
         return @options if @options
 
         pairs  = []
-        falses = queries_for_expression( '1=%q%2' )
+        falses = queries_for_expression( '%q%1%q%=%q%2' )
 
-        queries_for_expression( '1=%q%1' ).each.with_index do |true_expr, i|
+        queries_for_expression( '%q%1%q%=%q%1' ).each.with_index do |true_expr, i|
             pairs << { true_expr => falses[i] }
         end
 
-        @options = { false: '-1', pairs: pairs }
+        @options = { false: '-1839', pairs: pairs }
     end
 
     def run
@@ -59,7 +57,7 @@ that of a vulnerable application.
 },
             elements:    [ Element::Link, Element::Form, Element::Cookie ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.4.3',
+            version:     '0.4.4',
             platforms:   [ :sql ],
 
             issue:       {

data/components/checks/active/sql_injection_differential/payloads.txt

@@ -1 +1 @@
--1%q% or
+-1839%q% or

data/components/checks/active/sql_injection_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/trainer.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -12,7 +12,6 @@
 # It also forces Arachni to train itself by analyzing the server responses.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.4
 class Arachni::Checks::Trainer < Arachni::Check::Base
 
     def run
@@ -21,7 +20,9 @@ class Arachni::Checks::Trainer < Arachni::Check::Base
         # wasting bandwidth.
         return if framework.page_limit_reached?
 
-        audit( "_arachni_trainer_#{random_seed}", submit: { train: true } ){}
+        audit( "_arachni_trainer_#{random_seed}",
+               submit: { train: true, with_raw_parameters: false }
+        ){}
     end
 
     def self.info
@@ -33,7 +34,7 @@ It also forces Arachni to train itself by analyzing the server responses.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
             elements:    [ Element::Form, Element::Link, Element::Cookie, Element::Header ],
-            version:     '0.1.4'
+            version:     '0.1.5'
         }
     end
 

data/components/checks/active/unvalidated_redirect.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/unvalidated_redirect_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/xpath_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,7 +9,6 @@
 # XPath Injection check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.5
 #
 # @see http://cwe.mitre.org/data/definitions/91.html
 # @see https://www.owasp.org/index.php/XPATH_Injection
@@ -26,7 +25,7 @@ class Arachni::Checks::XpathInjection < Arachni::Check::Base
     end
 
     def self.options
-        @options ||= { format: [Format::APPEND], substring: error_strings }
+        @options ||= { format: [Format::APPEND], signatures: error_strings }
     end
 
     def run
@@ -39,7 +38,7 @@ class Arachni::Checks::XpathInjection < Arachni::Check::Base
             description: %q{XPath injection check},
             elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.5',
+            version:     '0.1.6',
 
             issue:       {
                 name:            %q{XPath Injection},