arachni 1.3.2 → 1.4

data/components/checks/active/xss.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -47,9 +47,23 @@ class Arachni::Checks::Xss < Arachni::Check::Base
         }
     end
 
+    def self.optimization_cache
+        @optimization_cache ||= {}
+    end
+    def optimization_cache
+        self.class.optimization_cache
+    end
+
     def run
         audit( self.class.strings, self.class.options ) do |response, element|
-            check_and_log( response, element )
+            # If there's no vuln responses will usually be identical, so bail
+            # out early.
+            # If responses aren't identical due to noise, well, we're not losing
+            # much.
+            next if optimization_cache[response.body.hash] == :checked
+
+            optimization_cache[response.body.hash] =
+                check_and_log( response, element )
         end
     end
 
@@ -58,17 +72,18 @@ class Arachni::Checks::Xss < Arachni::Check::Base
         # The other cases either don't matter or are covered by the xss_dom check.
         if (self.class.elements - [Arachni::Link]).include?( element.class ) &&
             !response.body.downcase.include?( self.class.tag )
-            return
+
+            return :checked
         end
 
         # See if we managed to successfully inject our element in the doc tree.
         if find_proof( response )
             log vector: element, proof: self.class.tag, response: response
-            return
+            return :checked
         end
 
         # No idea what was returned, but we can't work with it.
-        return if !response.to_page.has_script?
+        return :checked if !response.to_page.has_script?
 
         with_browser_cluster do
             print_info 'Progressing to deferred browser evaluation of response.'
@@ -76,21 +91,28 @@ class Arachni::Checks::Xss < Arachni::Check::Base
             # Pass the response to the BrowserCluster for evaluation and see if the
             # element appears in the doc tree now.
             trace_taint( response, taint: self.class.tag ) do |page|
+                # At this point further checks will be body based, identical
+                # bodies will yield identical results.
+                next if optimization_cache["traced-#{page.body.hash}".hash] == :traced
+                optimization_cache["traced-#{page.body.hash}".hash] = :traced
+
                 print_info 'Checking results of deferred taint analysis.'
 
                 next if !(proof = find_proof( page ))
+
                 log vector: element, proof: proof, page: page
             end
         end
     end
 
     def find_proof( resource )
-        proof_nodes = Nokogiri::HTML( resource.body ).css( self.class.tag_name )
+        return if !resource.body.has_html_tag?( self.class.tag_name )
+
+        proof_nodes = Arachni::Parser.parse( resource.body ).css( self.class.tag_name )
         return if proof_nodes.empty?
 
         proof = nil
         proof_nodes.each do |e|
-            # Text-areas have TEXT not nodes Nokogiri!
             next if e.parent.name =='textarea'
             proof = e.to_s
         end
@@ -110,7 +132,7 @@ tainted responses to look for proof of vulnerability.
             elements:    [Element::Form, Element::Link, Element::Cookie,
                           Element::Header, Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.4.4',
+            version:     '0.4.6',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS)},
@@ -132,10 +154,9 @@ Arachni has discovered that it is possible to insert script content directly int
 HTML element content.
 },
                 references:  {
-                    'ha.ckers' => 'http://ha.ckers.org/xss.html',
-                    'Secunia'  => 'http://secunia.com/advisories/9716/',
-                    'WASC'     => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
-                    'OWASP'    => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
+                    'Secunia' => 'http://secunia.com/advisories/9716/',
+                    'WASC'    => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
+                    'OWASP'   => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
                 },
                 tags:            %w(xss regexp injection script),
                 cwe:             79,

data/components/checks/active/xss_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -24,8 +24,8 @@ class Arachni::Checks::XssDom < Arachni::Check::Base
             # Straight injection.
             tag,
 
-            # Break out of HTML comments.
-            "-->#{tag}<!--"
+            # Break out of HTML comments and text areas.
+            "</textarea>-->#{tag}<!--<textarea>"
         ]
     end
 
@@ -46,10 +46,13 @@ class Arachni::Checks::XssDom < Arachni::Check::Base
 
     def check_and_log( page, element )
         return if !(proof = find_proof( page ))
+
         log vector: element, proof: proof, page: page
     end
 
     def find_proof( page )
+        return if !page.body.has_html_tag?( self.class.tag_name )
+
         proof = page.document.css( self.class.tag_name )
         return if proof.empty?
         proof.to_s
@@ -64,7 +67,7 @@ tainted responses to look for proof of vulnerability.
 },
             elements:    DOM_ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1',
+            version:     '0.1.2',
 
             issue:       {
                 name:            %q{DOM-based Cross-Site Scripting (XSS)},

data/components/checks/active/xss_dom_script_context.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/xss_event.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -10,8 +10,6 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.1.5
-#
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
 # @see http://secunia.com/advisories/9716/
@@ -43,30 +41,54 @@ class Arachni::Checks::XssEvent < Arachni::Check::Base
         'src'
     ]
 
+    def self.attribute_name
+        'arachni_xss_in_element_event'
+    end
+
     def self.strings
         @strings ||= [
-            ";arachni_xss_in_element_event=#{random_seed}//",
-            "\";arachni_xss_in_element_event=#{random_seed}//",
-            "';arachni_xss_in_element_event=#{random_seed}//"
-        ].map { |s| [ "script:#{s}", s ] }.flatten
+            ";#{attribute_name}=#{random_seed}//",
+            "\";#{attribute_name}=#{random_seed}//",
+            "';#{attribute_name}=#{random_seed}//"
+        ].map { |s| [ " script:#{s}", " #{s}" ] }.flatten
     end
 
     def self.options
         @options ||= { format: [ Format::APPEND ] }
     end
 
+    def self.optimization_cache
+        @optimization_cache ||= {}
+    end
+    def optimization_cache
+        self.class.optimization_cache
+    end
+
     def run
-        audit self.class.strings, self.class.options, &method(:check_and_log)
+        audit self.class.strings, self.class.options do |response, element|
+            next if optimization_cache[response.body.hash] == :checked
+
+            optimization_cache[response.body.hash] =
+                check_and_log( response, element )
+        end
     end
 
     def check_and_log( response, element )
-        body = response.body.downcase
-        return if element.seed.to_s.empty? || !body.include?( element.seed )
+        body = response.body
+
+        return :checked if !(body =~ /#{self.class.attribute_name}/i)
+        return if element.seed.to_s.empty? || !(body =~ /#{element.seed}/i)
+
+        included_attributes = EVENT_ATTRS.select do |attribute|
+            body =~ /#{attribute}/i
+        end
+
+        return :checked if included_attributes.empty?
 
-        doc  = Nokogiri::HTML( body )
-        seed = element.seed.dup
+        doc  = Arachni::Parser.parse( body )
+        seed = element.seed
 
-        EVENT_ATTRS.each do |attribute|
+        included_attributes.each do |attribute|
             doc.xpath( "//*[@#{attribute}]" ).each do |elem|
                 value = elem.attributes[attribute].to_s.downcase
                 seed  = seed.split( ':', 2 ).last
@@ -76,10 +98,12 @@ class Arachni::Checks::XssEvent < Arachni::Check::Base
                     # xss_script_context check. However VBScript doesn't have
                     # full support so we settle.
                     if value =~ /^(vb|)script:/ && value.include?( seed )
-                        return log vector: element, response: response, proof: value
+                        log vector: element, response: response, proof: value
+                        return
                     end
                 elsif value.include?( seed )
-                    return log vector: element, response: response, proof: value
+                    log vector: element, response: response, proof: value
+                    return
                 end
             end
         end
@@ -91,7 +115,7 @@ class Arachni::Checks::XssEvent < Arachni::Check::Base
             description: %q{Cross-Site Scripting in event tag of HTML element.},
             elements:    [Element::Form, Element::Link, Element::Cookie, Element::Header],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1.5',
+            version:     '0.1.7',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in event tag of HTML element},
@@ -114,10 +138,9 @@ an HTML event attribute. For example `<div onmouseover="x=INJECTION_HERE"</div>`
 where `INJECTION_HERE` represents the location where the Arachni payload was detected.
 },
                 references:  {
-                    'ha.ckers' => 'http://ha.ckers.org/xss.html',
-                    'Secunia'  => 'http://secunia.com/advisories/9716/',
-                    'WASC'     => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
-                    'OWASP'    => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
+                    'Secunia' => 'http://secunia.com/advisories/9716/',
+                    'WASC'    => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
+                    'OWASP'   => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
                 },
                 tags:            %w(xss event injection dom attribute),
                 cwe:             79,

data/components/checks/active/xss_path.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -60,7 +60,7 @@ class Arachni::Checks::XssPath < Arachni::Check::Base
         return if !body.include?( self.class.string )
 
         # see if we managed to successfully inject our element
-        return if Nokogiri::HTML( body ).css( self.class.tag ).empty?
+        return if Arachni::Parser.parse( body ).css( self.class.tag ).empty?
 
         log vector: Element::Path.new( response.url ),
             proof: self.class.string, response: response
@@ -97,8 +97,9 @@ For example `HTTP://yoursite.com/INJECTION_HERE/`, where `INJECTION_HERE`
 represents the location where the Arachni payload was injected.
 },
                 references:  {
-                    'ha.ckers' => 'http://ha.ckers.org/xss.html',
-                    'Secunia'  => 'http://secunia.com/advisories/9716/'
+                    'Secunia' => 'http://secunia.com/advisories/9716/',
+                    'WASC'    => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
+                    'OWASP'   => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
                 },
                 tags:            %w(xss path injection regexp),
                 cwe:             79,

data/components/checks/active/xss_script_context.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -11,8 +11,6 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.2.1
-#
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
 # @see http://secunia.com/advisories/9716/
@@ -77,13 +75,27 @@ class Arachni::Checks::XssScriptContext < Arachni::Check::Base
         @options ||= { format: [ Format::STRAIGHT ] }
     end
 
+    def self.optimization_cache
+        @optimization_cache ||= {}
+    end
+    def optimization_cache
+        self.class.optimization_cache
+    end
+
     def taints( browser_cluster )
         self.class.strings.map { |taint| taint % browser_cluster.javascript_token }
     end
 
     def run
         with_browser_cluster do |cluster|
-            audit taints( cluster ), self.class.options, &method(:check_and_log)
+            audit taints( cluster ), self.class.options do |response, element|
+                # Completely body based, identical bodies will yield identical
+                # results.
+                next if optimization_cache[response.body.hash]
+                optimization_cache[response.body.hash] = true
+
+                check_and_log( response, element )
+            end
         end
     end
 
@@ -93,7 +105,8 @@ class Arachni::Checks::XssScriptContext < Arachni::Check::Base
         return if !(proof = tainted?( response, element.seed ))
 
         if proof.is_a? String
-            return log vector: element, proof: element.seed, response: response
+            log vector: element, proof: element.seed, response: response
+            return
         end
 
         print_info 'Response is tainted, scheduling a taint-trace.'
@@ -114,10 +127,26 @@ class Arachni::Checks::XssScriptContext < Arachni::Check::Base
     def tainted?( response, seed )
         return if seed.to_s.empty? || !response.body.to_s.include?( seed )
 
-        doc = Nokogiri::HTML( response.body )
-        return true if doc.css('script').to_s.include?( seed )
+        # Quick check to see if the payload landed in a <script>.
+        in_script = (response.body =~ /<script.*?>.*#{Regexp.escape seed}.*?<\/script>/im)
+
+        # Quick check to see if the payload landed in any attributes.
+        pure_seed     = self.class.seed % browser_cluster.javascript_token
+        in_attributes = ATTRIBUTES.select do |attribute|
+            !!response.body.scan( /#{attribute}=(.*?)>/im ).flatten.find do |match|
+                match.include? pure_seed
+            end
+        end
+
+        # Nowhere to be seen, bail out early.
+        return if in_attributes.empty? && !in_script
+
+        # More comprehensive checks by searching the document.
+        doc = Arachni::Parser.parse( response.body )
+
+        return true if in_script && doc.css('script').to_s.include?( seed )
 
-        ATTRIBUTES.each do |attribute|
+        in_attributes.each do |attribute|
             doc.xpath( "//*[@#{attribute}]" ).each do |elem|
                 value = elem.attributes[attribute].to_s
 
@@ -143,7 +172,7 @@ Injects JS taint code and check to see if it gets executed as proof of vulnerabi
             elements:    [ Element::Form, Element::Link, Element::Cookie,
                            Element::Header, Element::LinkTemplate ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.2.1',
+            version:     '0.2.3',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in script context},
@@ -165,8 +194,9 @@ Arachni has discovered that it is possible to force the page to execute custom
 JavaScript code.
 },
                 references:  {
-                    'ha.ckers' => 'http://ha.ckers.org/xss.html',
-                    'Secunia'  => 'http://secunia.com/advisories/9716/'
+                    'Secunia' => 'http://secunia.com/advisories/9716/',
+                    'WASC'    => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
+                    'OWASP'   => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
                 },
                 tags:            %w(xss script dom injection),
                 cwe:             79,

data/components/checks/active/xss_tag.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -11,17 +11,16 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.1.8
-#
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
 # @see http://secunia.com/advisories/9716/
 class Arachni::Checks::XssTag < Arachni::Check::Base
 
-    TAG_NAME = 'arachni_xss_in_tag'
+    ATTRIBUTE_NAME = 'arachni_xss_in_tag'
 
     def self.strings
-        @strings ||= ['', '\'', '"'].map { |q| "#{q} #{TAG_NAME}=#{q}#{random_seed}#{q} blah=#{q}" }
+        @strings ||= ['', '\'', '"'].
+            map { |q| "#{q} #{ATTRIBUTE_NAME}=#{q}#{random_seed}#{q} blah=#{q}" }
     end
 
     def run
@@ -31,16 +30,16 @@ class Arachni::Checks::XssTag < Arachni::Check::Base
     end
 
     def check_and_log( response, element )
-        body = response.body.downcase
-
-        # if we have no body or it doesn't contain the TAG_NAME under any
+        # if we have no body or it doesn't contain the ATTRIBUTE_NAME under any
         # context there's no point in parsing the HTML to verify the vulnerability
-        return if !body.include?( TAG_NAME )
+        return if !(response.body =~ /#{ATTRIBUTE_NAME}/i)
+
+        body = response.body.downcase
 
         # see if we managed to inject a working HTML attribute to any
         # elements
-        Nokogiri::HTML( body ).xpath( "//*[@#{TAG_NAME}]" ).each do |node|
-            next if node[TAG_NAME] != random_seed
+        Arachni::Parser.parse( body ).xpath( "//*[@#{ATTRIBUTE_NAME}]" ).each do |node|
+            next if node[ATTRIBUTE_NAME] != random_seed
 
             proof = (payload = find_included_payload( body )) ? payload : node.to_s
             log vector: element, proof: proof.to_s, response: response
@@ -61,7 +60,7 @@ class Arachni::Checks::XssTag < Arachni::Check::Base
             description: %q{Cross-Site Scripting in HTML tag.},
             elements:    [ Element::Form, Element::Link, Element::Cookie, Element::Header ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1.8',
+            version:     '0.1.10',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in HTML tag},
@@ -84,9 +83,9 @@ tag. For example `<INJECTION_HERE href=.......etc>` where `INJECTION_HERE`
 represents the location where the Arachni payload was detected.
 },
                 references:  {
-                    'ha.ckers' => 'http://ha.ckers.org/xss.html',
-                    'Secunia'  => 'http://secunia.com/advisories/9716/',
-                    'WASC' => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting'
+                    'Secunia' => 'http://secunia.com/advisories/9716/',
+                    'WASC'    => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
+                    'OWASP'   => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
                 },
 
                 tags:            %w(xss script tag regexp dom attribute injection),