arachni 1.3.2 → 1.4

data/components/fingerprinters/os/windows.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/fingerprinters/servers/apache.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/fingerprinters/servers/gunicorn.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/fingerprinters/servers/iis.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/fingerprinters/servers/jetty.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/fingerprinters/servers/nginx.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/fingerprinters/servers/tomcat.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/path_extractors/anchors.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/path_extractors/areas.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/path_extractors/comments.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/path_extractors/data_url.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/path_extractors/forms.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/path_extractors/frames.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/path_extractors/generic.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/path_extractors/links.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/path_extractors/meta_refresh.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,7 +9,7 @@
 # Extracts meta refresh URLs.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2
+# @version 0.2.1
 class Arachni::Parser::Extractors::MetaRefresh < Arachni::Parser::Extractors::Base
 
     def run
@@ -25,7 +25,7 @@ class Arachni::Parser::Extractors::MetaRefresh < Arachni::Parser::Extractors::Ba
             begin
                 _, url = url['content'].split( ';', 2 )
                 next if !url
-                unquote( url.split( '=', 2 ).last )
+                unquote( url.split( '=', 2 ).last.strip )
             rescue
                 next
             end

data/components/path_extractors/scripts.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/autologin.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -17,26 +17,22 @@
 class Arachni::Plugins::AutoLogin < Arachni::Plugin::Base
 
     STATUSES  = {
-        ok:               'Form submitted successfully.',
+        ok:               'Logged in successfully.',
         form_not_found:   'Could not find a form suiting the provided parameters.',
         form_not_visible: 'The form was located but its DOM element is not ' <<
                               'visible and thus cannot be submitted.',
-        check_failed:     'Form submitted but the response did not match the verifier.'
+        check_failed:     'The response did not match the verifier.'
     }
 
     def prepare
         @parameters = request_parse_body( options[:parameters] )
         @verifier   = Regexp.new( options[:check] )
         @url        = options[:url].to_s
-        @errored    = false
-    end
-
-    def run
-        framework_pause
-        print_info 'System paused.'
 
         session.configure( url: @url, inputs: @parameters )
 
+        print_status 'Logging in, please wait.'
+
         response = begin
             session.login( true )
         rescue Arachni::Session::Error::FormNotFound
@@ -44,19 +40,19 @@ class Arachni::Plugins::AutoLogin < Arachni::Plugin::Base
                 'status'  => 'form_not_found',
                 'message' => STATUSES[:form_not_found]
             )
-            print_error STATUSES[:form_not_found]
-            @errored = true
-            return
+            handle_error( :form_not_found )
+            return clean_up
         rescue Arachni::Session::Error::FormNotVisible
             register_results(
                 'status'  => 'form_not_visible',
                 'message' => STATUSES[:form_not_visible]
             )
-            print_error STATUSES[:form_not_visible]
-            @errored = true
+            handle_error( :form_not_visible )
             return
         end
 
+        print_status "Form submitted successfully, checking the session's validity."
+
         framework.options.session.check_url     ||= response.url
         framework.options.session.check_pattern ||= @verifier
 
@@ -65,8 +61,7 @@ class Arachni::Plugins::AutoLogin < Arachni::Plugin::Base
                 'status'  => 'check_failed',
                 'message' => STATUSES[:check_failed]
             )
-            print_error STATUSES[:check_failed]
-            @errored = true
+            handle_error( :check_failed )
             return
         end
 
@@ -85,14 +80,11 @@ class Arachni::Plugins::AutoLogin < Arachni::Plugin::Base
         end
     end
 
-    def clean_up
-        if @errored
-            print_info 'Aborting the scan.'
-            framework_abort
-            return
-        end
+    def handle_error( type )
+        print_error STATUSES[type]
 
-        framework_resume
+        print_info 'Aborting the scan.'
+        framework_abort
     end
 
     def self.info
@@ -107,7 +99,7 @@ request as framework-wide cookies.
 interactions in order to become visible, this plugin will not be able to submit it.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2',
+            version:     '0.2.1',
             options:     [
                 Options::String.new( :url,
                     required:    true,

data/components/plugins/beep_notify.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/content_types.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/cookie_collector.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/defaults/autothrottle.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/defaults/healthmap.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/defaults/meta/remedies/discovery.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -30,7 +30,7 @@ class Arachni::Plugins::Discovery < Arachni::Plugin::Base
         # URL path => size of response bodies.
         response_size_per_path  = {}
 
-        processed_issues = 0
+        issue_count_per_path = {}
 
         Data.issues.each do |issue|
             next if !issue.tags.includes_tags?( :discovery )
@@ -38,12 +38,13 @@ class Arachni::Plugins::Discovery < Arachni::Plugin::Base
             # Skip it if already flagged as untrusted.
             next if issue.untrusted?
 
-            processed_issues += 1
-
             # We'll do this per path since 404 handlers and such operate per
             # directory...usually...probably...hopefully.
             path = File.dirname( uri_parse( issue.vector.action ).path )
 
+            issue_count_per_path[path] ||= 0
+            issue_count_per_path[path]  += 1
+
             # Gather total response sizes per path.
             response_size_per_path[path] ||= 0
             response_size_per_path[path]  += issue.response.body.size
@@ -66,11 +67,11 @@ class Arachni::Plugins::Discovery < Arachni::Plugin::Base
                 diffs_per_path[path].rdiff( issue.response.body )
         end
 
-        # Not a lot of sense in comparing a single issue with itself.
-        return if processed_issues < 2
-
         diffs_per_path.each_pair do |path, diff|
-            # calculate the similarity ratio of the responses under the current path
+            # Not a lot of sense in comparing a single issue with itself.
+            next if issue_count_per_path[path] <= 1
+
+            # Calculate the similarity ratio of the responses under the current path.
             similarity = Float( diff.size * issue_digests_per_path[path].size ) /
                 response_size_per_path[path]
 
@@ -91,7 +92,7 @@ while the server responses were exhibiting an anomalous factor of similarity.
 There's a good chance that these issues are false positives.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.3.2',
+            version:     '0.3.3',
             tags:        %w(anomaly discovery file directories meta)
         }
     end

data/components/plugins/defaults/meta/remedies/timing_attacks.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/defaults/meta/uniformity.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/email_notify.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -67,7 +67,7 @@ class Arachni::Plugins::EmailNotify < Arachni::Plugin::Base
             name:        'E-mail notify',
             description: %q{Sends a notification (and optionally a report) over SMTP at the end of the scan.},
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.5',
+            version:     '0.1.6',
             options:     [
                 Options::String.new( :to,
                     required:    true,
@@ -95,11 +95,9 @@ class Arachni::Plugins::EmailNotify < Arachni::Plugin::Base
                     description: 'Use TLS/SSL?.'
                 ),
                 Options::String.new( :username,
-                    required:    true,
                     description: 'SMTP username.'
                 ),
                 Options::String.new( :password,
-                    required:    true,
                     description: 'SMTP password.'
                 ),
                 Options::String.new( :domain,
@@ -108,7 +106,7 @@ class Arachni::Plugins::EmailNotify < Arachni::Plugin::Base
                 ),
                 Options::MultipleChoice.new( :authentication,
                     description: 'Authentication.',
-                    default:     'plain',
+                    default:     '',
                     choices:     ['plain', 'login', 'cram_md5', '']
                 ),
                 Options::MultipleChoice.new( :report,

data/components/plugins/exec.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/form_dicattack.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/headers_collector.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/http_dicattack.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/login_script.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -29,24 +29,26 @@ class Arachni::Plugins::LoginScript < Arachni::Plugin::Base
                 eval script
             end
         end
-    end
 
-    def run
         if javascript? && !session.has_browser?
             set_status :missing_browser, :error
             return
         end
 
-        framework_pause
-        print_info 'System paused.'
-
         session.record_login_sequence do |browser|
             print_info 'Running the script.'
-            @script.call browser ? browser.watir : nil
 
-            # JS run async so we need to wait for the page to settle after
-            # execution.
-            session.browser.wait_till_ready if javascript?
+            if browser
+                watir = browser.watir
+                watir.window.resize_to(
+                    Arachni::Options.browser_cluster.screen_width,
+                    Arachni::Options.browser_cluster.screen_height
+                )
+                @script.call watir
+                browser.wait_till_ready
+            else
+                @script.call
+            end
 
             print_info 'Execution completed.'
         end
@@ -80,16 +82,6 @@ class Arachni::Plugins::LoginScript < Arachni::Plugin::Base
         print_exception e
     end
 
-    def clean_up
-        if @failed
-            print_info 'Aborting the scan.'
-            framework_abort
-            return
-        end
-
-        framework_resume
-    end
-
     def javascript?
         @options[:script].split( '.' ).last == 'js'
     end
@@ -104,8 +96,12 @@ class Arachni::Plugins::LoginScript < Arachni::Plugin::Base
             }.merge( extra )
         )
 
-        @failed = true if type == :error
         send "print_#{type}", STATUSES[status]
+
+        if type == :error
+            print_info 'Aborting the scan.'
+            framework_abort
+        end
     end
 
     def self.info
@@ -165,6 +161,35 @@ by loading cookies from a shared Netscape-style cookie-jar file.
 
     http.cookie_jar.load 'cookies.txt'
 
+## Advanced session check configuration
+
+In addition to just settings the `check_url` and `check_pattern` options,
+you can also set arbitrary HTTP request options for the login check, to cover
+cases where extra tokens or a method other than `GET` must be used.
+
+    session.check_options = {
+        # :get, :post, :put, :delete
+        method:     :post,
+
+        # URL query parameters.
+        parameters: {
+            'param1' => 'value'
+        },
+
+        # Request body parameters -- can also be a String instead of Hash.
+        body:       {
+            'body_param1' => 'value'
+        },
+
+        cookies:    {
+            'custom_cookie' => 'value'
+        },
+
+        headers:    {
+            'X-Custom-Header' => 'value'
+        }
+    }
+
 # Javascript
 
 When the given script has a `.js` file extension, it will be loaded and executed
@@ -177,7 +202,7 @@ in the browser, within the page of the target URL.
 
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.2',
+            version:     '0.2.3',
             options:     [
                 Options::Path.new( :script,
                     required:    true,