arachni 1.3.2 → 1.4

data/components/checks/active/xxe.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -7,25 +7,14 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.1
 class Arachni::Checks::Xxe < Arachni::Check::Base
 
     ENTITY = 'xxe_entity'
 
     def self.options
         @options ||= {
-            format: [Format::STRAIGHT],
-            regexp: {
-                unix: [
-                    /DOCUMENT_ROOT.*HTTP_USER_AGENT/,
-                    /:.+:\d+:\d+:.+:[0-9a-zA-Z\/]+/im
-                ],
-                windows: [
-                    /\[boot loader\].*\[operating systems\]/im,
-                    /\[fonts\].*\[extensions\]/im
-                ]
-            },
-
+            format:        [Format::STRAIGHT],
+            signatures:    FILE_SIGNATURES_PER_PLATFORM.select { |k, _| payloads.include? k },
             each_mutation: proc do |mutation|
                 mutation.platforms.pick( payloads ).map do |platform, payloads|
                     payloads.map do |payload|
@@ -74,8 +63,8 @@ processed based on the resulting HTTP response.
 },
             elements:    [Element::XML],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.1',
-            platforms:   options[:regexp].keys,
+            version:     '0.1.2',
+            platforms:   options[:signatures].keys,
 
             issue:       {
                 name:            %q{XML External Entity},

data/components/checks/passive/allowed_methods.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/passive/backdoors.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -16,6 +16,8 @@ class Arachni::Checks::Backdoors < Arachni::Check::Base
     end
 
     def run
+        return if page.code != 200
+
         path = get_path( page.url )
         return if audited?( path )
 
@@ -29,7 +31,7 @@ class Arachni::Checks::Backdoors < Arachni::Check::Base
             description:      %q{Tries to find common backdoors on the server.},
             elements:         [Element::Server],
             author:           'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:          '0.2.5',
+            version:          '0.2.6',
             exempt_platforms: Arachni::Platform::Manager::FRAMEWORKS,
 
             issue:       {

data/components/checks/passive/backup_directories.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -14,6 +14,8 @@ class Arachni::Checks::BackupDirectories < Arachni::Check::Base
     end
 
     def run
+        return if page.code != 200
+
         if page.parsed_url.path.to_s.empty? || page.parsed_url.path == '/'
             print_info "Backing out, couldn't extract directory name from: #{page.url}"
             return
@@ -38,7 +40,7 @@ class Arachni::Checks::BackupDirectories < Arachni::Check::Base
             description:      %q{Tries to find backed-up directories.},
             elements:         [ Element::Server ],
             author:           'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:          '0.1.1',
+            version:          '0.1.2',
             exempt_platforms: Arachni::Platform::Manager::FRAMEWORKS,
 
             issue:       {

data/components/checks/passive/backup_files.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -16,6 +16,8 @@ class Arachni::Checks::BackupFiles < Arachni::Check::Base
     end
 
     def run
+        return if page.code != 200
+
         resource = page.parsed_url.without_query
         return if audited?( resource )
 
@@ -50,7 +52,7 @@ class Arachni::Checks::BackupFiles < Arachni::Check::Base
             description:      %q{Tries to identify backup files.},
             elements:         [ Element::Server ],
             author:           'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:          '0.3.1',
+            version:          '0.3.2',
             exempt_platforms: Arachni::Platform::Manager::FRAMEWORKS,
 
             issue:       {

data/components/checks/passive/common_admin_interfaces.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -10,7 +10,6 @@
 #
 # @author Brendan Coles <bcoles@gmail.com>
 # @author Tasos Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1
 class Arachni::Checks::CommonAdminInterfaces < Arachni::Check::Base
 
     def self.resources
@@ -18,6 +17,8 @@ class Arachni::Checks::CommonAdminInterfaces < Arachni::Check::Base
     end
 
     def run
+        return if page.code != 200
+
         path = get_path( page.url )
         return if audited?( path )
 
@@ -37,7 +38,7 @@ class Arachni::Checks::CommonAdminInterfaces < Arachni::Check::Base
                 'Brendan Coles <bcoles@gmail.com>',
                 'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>'
             ],
-            version:     '0.1',
+            version:     '0.1.1',
             targets:     %w(Generic),
             references: {
                 'Apache.org' => 'http://httpd.apache.org/docs/2.0/mod/mod_access.html',

data/components/checks/passive/common_directories.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -19,6 +19,8 @@ class Arachni::Checks::CommonDirectories < Arachni::Check::Base
     end
 
     def run
+        return if page.code != 200
+
         path = get_path( page.url )
         return if audited?( path )
 

data/components/checks/passive/common_files.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -16,6 +16,8 @@ class Arachni::Checks::CommonFiles < Arachni::Check::Base
     end
 
     def run
+        return if page.code != 200
+
         path = get_path( page.url )
         return if audited?( path )
 

data/components/checks/passive/directory_listing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -48,11 +48,11 @@ class Arachni::Checks::DirectoryListing < Arachni::Check::Base
     def check_and_log( path )
         audited( path )
 
-        # if we have a 403 Forbidden it means that we successfully
+        # If we have a 403 Forbidden it means that we successfully
         # built a pah which would force a directory listing *but*
         # the web server kicked our asses...so let's run away like
         # little girls...
-        @harvested.each { |res| return if res.code == 403 }
+        @harvested.each { |res| return if !res.ok? || res.code == 403 }
 
         if !File.basename( @harvested[0].url, '?*' ).empty? &&
             same_page?( @harvested[0], @harvested[5] )
@@ -80,7 +80,7 @@ class Arachni::Checks::DirectoryListing < Arachni::Check::Base
             description:      %q{Tries to force directory listings.},
             elements:         [ Element::Server ],
             author:           'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:          '0.1.6',
+            version:          '0.1.7',
             exempt_platforms: Arachni::Platform::Manager::FRAMEWORKS,
 
             issue:       {

data/components/checks/passive/grep/captcha.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/passive/grep/cookie_set_for_parent_domain.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/passive/grep/credit_card.rb

@@ -1,22 +1,19 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
     web site for more information on licensing and terms of use.
 =end
 
-#
 # Credit Card Number recon check.
 #
 # Scans page for credit card numbers.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2.3
 #
 # @see http://en.wikipedia.org/wiki/Bank_card_number
 # @see http://en.wikipedia.org/wiki/Luhn_algorithm
-#
 class Arachni::Checks::CreditCard < Arachni::Check::Base
 
     def self.cc_regexp
@@ -61,8 +58,6 @@ class Arachni::Checks::CreditCard < Arachni::Check::Base
         sum % 10 == 0
     end
 
-    # TODO: Someone needs to re-check these associations, some don't
-    #   work and I've no idea how to resolve this.
     def valid_association?( number )
         number = number.to_s.gsub( /\D/, '' )
 
@@ -81,7 +76,7 @@ class Arachni::Checks::CreditCard < Arachni::Check::Base
             description: %q{Scans pages for credit card numbers.},
             elements:    [ Element::Body ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.3',
+            version:     '0.2.4',
 
             issue:       {
                 name:            %q{Credit card number disclosure},
@@ -117,6 +112,9 @@ Additionally, credit card numbers should not be stored by the application, unles
 the organisation also complies with other security controls as outlined in the
 Payment Card Industry Data Security Standard (PCI DSS).
 },
+                # Well, we can't know whether the logged number actually is an
+                # CC now can we?
+                trusted: false
             }
         }
     end

data/components/checks/passive/grep/cvs_svn_users.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/passive/grep/emails.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,14 +9,142 @@
 # Looks for and logs e-mail addresses.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2.1
 class Arachni::Checks::Emails < Arachni::Check::Base
 
+    PATTERN     =
+        /[A-Z0-9._%+-]+(?:@|\s*\[at\]\s*)[A-Z0-9.-]+(?:\.|\s*\[dot\]\s*)[A-Z]{2,4}/i
+
+    MIN_THREADS = 0
+    MAX_THREADS = 10
+
+    # @return   [Hash<String, Bool>]
+    #   Cached results for domain resolutions through the entire scan.
+    def self.cache
+        @cache ||= Concurrent::Hash.new
+    end
+
+    # @return   [Hash<String, Array<Block>]
+    #   Callers waiting for the results of a resolution per domain.
+    def waiting
+        @waiting ||= {}
+    end
+
+    # If there are multiple checks for the same domain queue them,
+    # we can perform only one and notify the rest.
+    #
+    # @param    [String]    domain
+    # @param    [Block]    block
+    #   Callback to notify, will only be called if the domain exists.
+    def wait_for( domain, &block )
+        waiting[domain] ||= []
+        waiting[domain] << block
+    end
+
+    def pool( min_threads = nil )
+        @pool ||= Concurrent::ThreadPoolExecutor.new(
+            # Only spawn threads when necessary, not from the get go.
+            min_threads: min_threads || MIN_THREADS,
+
+            max_threads: MAX_THREADS,
+
+            # No bounds on the amount of domains to be checked.
+            max_queue:   0
+        )
+    end
+
+    # Checks whether or not an e-mail exists by resolving the domain.
+    # {#resolve} will need to be called after all callbacks have been queued.
+    #
+    # @param    [String]    email
+    #   E-mail to check.
+    # @param    [Block]    block
+    #   Callback to notify, will only be called if the e-mail exists.
+    def if_exists( email, &block )
+        print_info "Verifying: #{email}"
+
+        domain = deobfuscate( email ).split( '@', 2 ).last
+
+        # Same domain as the current page, gets a pass.
+        if page.parsed_url.host == domain
+            block.call true
+            return
+        end
+
+        # In the cache, yay!
+        if self.class.cache.include?( domain )
+            if self.class.cache[domain]
+                print_info "Resolved: #{domain}"
+                block.call
+                return
+            end
+
+            print_info "Could not resolve: #{domain}"
+            return
+        end
+
+        wait_for( domain, &block )
+    end
+
+    # Process the {#if_exists} queue.
+    def resolve
+        return if waiting.empty?
+
+        p = pool( [waiting.size, MAX_THREADS].min )
+
+        waiting.each do |domain, _|
+            p.post do
+                begin
+                    Resolv.getaddress domain
+
+                    print_info "Resolved: #{domain}"
+                    self.class.cache[domain] = true
+                rescue Resolv::ResolvError
+                    print_info "Could not resolve: #{domain}"
+                    self.class.cache[domain] = false
+                end
+            end
+        end
+
+        http.after_run do
+            pool.shutdown
+            pool.wait_for_termination
+
+            waiting.each do |domain, callbacks|
+                next if !self.class.cache[domain]
+
+                while (cb = callbacks.pop)
+                    cb.call
+                end
+            end
+        end
+    end
+
+    def deobfuscate( email )
+        email = email.dup
+        email.gsub!( '[at]', '@' )
+        email.gsub!( '[dot]', '.' )
+        email.gsub!( ' ', '' )
+        email
+    end
+
     def run
-        match_and_log( /[A-Z0-9._%+-]+(?:@|\s*\[at\]\s*)[A-Z0-9.-]+(?:\.|\s*\[dot\]\s*)[A-Z]{2,4}/i ) do |email|
-            return false if audited?( email )
-            audited( email )
+        body = Element::Body.new( self.page.url ).tap { |b| b.auditor = self }
+
+        page.body.scan( PATTERN ).flatten.uniq.compact.each do |email|
+            next if audited?( email )
+
+            if_exists email do
+                log(
+                    signature: PATTERN,
+                    proof:     email,
+                    vector:    body
+                )
+
+                audited( email )
+            end
         end
+
+        resolve
     end
 
     def self.info
@@ -25,7 +153,7 @@ class Arachni::Checks::Emails < Arachni::Check::Base
             description: %q{Greps pages for disclosed e-mail addresses.},
             elements:    [ Element::Body ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.1',
+            version:     '0.3',
 
             issue:       {
                 name:            %q{E-mail address disclosure},
@@ -45,8 +173,7 @@ addresses that were stored within the affected page.
                 severity:        Severity::INFORMATIONAL,
                 remedy_guidance: %q{E-mail addresses should be presented in such
                     a way that it is hard to process them automatically.}
-            },
-            max_issues: 25
+            }
         }
     end