arachni 1.4 → 1.5

data/components/checks/active/xpath_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/xss.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -13,7 +13,6 @@
 # {BrowserCluster} for evaluation and {#trace_taint taint-tracing}.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.4.4
 #
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
@@ -21,7 +20,7 @@
 class Arachni::Checks::Xss < Arachni::Check::Base
 
     def self.tag_name
-        "some_dangerous_input_#{random_seed}"
+        "#{shortname}_#{random_seed}"
     end
 
     def self.tag
@@ -43,7 +42,7 @@ class Arachni::Checks::Xss < Arachni::Check::Base
 
     def self.options
         @options ||= {
-            format: [Format::APPEND],
+            format: [Format::APPEND]
         }
     end
 
@@ -56,14 +55,16 @@ class Arachni::Checks::Xss < Arachni::Check::Base
 
     def run
         audit( self.class.strings, self.class.options ) do |response, element|
+            next if !response.html?
+
             # If there's no vuln responses will usually be identical, so bail
             # out early.
             # If responses aren't identical due to noise, well, we're not losing
             # much.
-            next if optimization_cache[response.body.hash] == :checked
+            k = "#{response.url.hash}-#{response.body.hash}".hash
+            next if optimization_cache[k] == :checked
 
-            optimization_cache[response.body.hash] =
-                check_and_log( response, element )
+            optimization_cache[k] = check_and_log( response, element )
         end
     end
 
@@ -77,7 +78,7 @@ class Arachni::Checks::Xss < Arachni::Check::Base
         end
 
         # See if we managed to successfully inject our element in the doc tree.
-        if find_proof( response )
+        if self.class.find_proof( response )
             log vector: element, proof: self.class.tag, response: response
             return :checked
         end
@@ -85,36 +86,60 @@ class Arachni::Checks::Xss < Arachni::Check::Base
         # No idea what was returned, but we can't work with it.
         return :checked if !response.to_page.has_script?
 
-        with_browser_cluster do
+        with_browser_cluster do |cluster|
             print_info 'Progressing to deferred browser evaluation of response.'
 
             # Pass the response to the BrowserCluster for evaluation and see if the
             # element appears in the doc tree now.
-            trace_taint( response, taint: self.class.tag ) do |page|
-                # At this point further checks will be body based, identical
-                # bodies will yield identical results.
-                next if optimization_cache["traced-#{page.body.hash}".hash] == :traced
-                optimization_cache["traced-#{page.body.hash}".hash] = :traced
+            cluster.trace_taint(
+                response,
+                {
+                    taint: self.class.tag,
+                    args:  [element, page]
+                },
+                self.class.check_browser_result_cb
+            )
+        end
+    end
 
-                print_info 'Checking results of deferred taint analysis.'
+    def self.check_browser_result( result, element, referring_page, cluster )
+        page = result.page
 
-                next if !(proof = find_proof( page ))
+        # At this point further checks will be body based, identical
+        # bodies will yield identical results.
+        key = "traced-#{page.body.hash}".hash
+        return if optimization_cache[key] == :traced
+        optimization_cache[key] = :traced
 
-                log vector: element, proof: proof, page: page
-            end
-        end
+        print_info 'Checking results of deferred taint analysis.'
+
+        return if !(proof = find_proof( page ))
+
+        log(
+            vector:         element,
+            proof:          proof,
+            page:           page,
+            referring_page: referring_page
+        )
     end
 
-    def find_proof( resource )
-        return if !resource.body.has_html_tag?( self.class.tag_name )
+    def self.check_browser_result_cb
+        @check_browser_result_cb ||= method(:check_browser_result)
+    end
+
+    def self.find_proof( resource )
+        return if !resource.body.has_html_tag?( self.tag_name )
+
+        proof_nodes = Arachni::Parser.parse(
+            resource.body,
+            whitelist:     [self.tag_name, 'textarea'],
+            stop_on_first: [self.tag_name]
+        ).nodes_by_name( self.tag_name )
 
-        proof_nodes = Arachni::Parser.parse( resource.body ).css( self.class.tag_name )
         return if proof_nodes.empty?
 
-        proof = nil
-        proof_nodes.each do |e|
-            next if e.parent.name =='textarea'
-            proof = e.to_s
+        proof = proof_nodes.find do |e|
+            e.parent.name != :textarea
         end
 
         return if !proof
@@ -132,7 +157,7 @@ tainted responses to look for proof of vulnerability.
             elements:    [Element::Form, Element::Link, Element::Cookie,
                           Element::Header, Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.4.6',
+            version:     '0.4.9',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS)},

data/components/checks/active/xss_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -7,12 +7,11 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1
 class Arachni::Checks::XssDom < Arachni::Check::Base
     prefer :xss
 
     def self.tag_name
-        "some_dangerous_input_#{random_seed}"
+        "#{shortname}_#{random_seed}"
     end
 
     def self.tag
@@ -40,22 +39,27 @@ class Arachni::Checks::XssDom < Arachni::Check::Base
         return if !browser_cluster
 
         each_candidate_dom_element do |element|
-            element.audit( self.class.strings, self.class.options, &method(:check_and_log) )
+            element.audit( self.class.strings, self.class.options )
         end
     end
 
-    def check_and_log( page, element )
+    def self.check_and_log( page, element )
         return if !(proof = find_proof( page ))
 
         log vector: element, proof: proof, page: page
     end
 
-    def find_proof( page )
-        return if !page.body.has_html_tag?( self.class.tag_name )
+    def self.find_proof( page )
+        return if !page.body.has_html_tag?( self.tag_name )
 
-        proof = page.document.css( self.class.tag_name )
-        return if proof.empty?
-        proof.to_s
+        proof = Arachni::Parser.parse(
+            page.body,
+            whitelist:     [self.tag_name],
+            stop_on_first: [self.tag_name]
+        ).nodes_by_name( self.tag_name ).first
+        return if !proof
+
+        proof.to_html
     end
 
     def self.info
@@ -67,7 +71,7 @@ tainted responses to look for proof of vulnerability.
 },
             elements:    DOM_ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.2',
+            version:     '0.1.4',
 
             issue:       {
                 name:            %q{DOM-based Cross-Site Scripting (XSS)},

data/components/checks/active/xss_dom_script_context.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -7,7 +7,6 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.1
 class Arachni::Checks::XssDomScriptContext < Arachni::Check::Base
 
     prefer :xss_script_context
@@ -45,13 +44,12 @@ class Arachni::Checks::XssDomScriptContext < Arachni::Check::Base
         each_candidate_dom_element do |element|
             element.audit(
                 taints,
-                self.class.options.merge( submit: { taint: seed } ),
-                &method(:check_and_log)
+                self.class.options.merge( submit: { taint: seed } )
             )
         end
     end
 
-    def check_and_log( page, element )
+    def self.check_and_log( page, element )
         return if page.dom.execution_flow_sinks.empty?
         log vector: element, page: page
     end
@@ -64,7 +62,7 @@ Injects JS taint code and checks to see if it gets executed as proof of vulnerab
 },
             elements:    DOM_ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.1',
+            version:     '0.1.2',
 
             issue:       {
                 name:            %q{DOM-based Cross-Site Scripting (XSS) in script context},

data/components/checks/active/xss_event.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -15,7 +15,7 @@
 # @see http://secunia.com/advisories/9716/
 class Arachni::Checks::XssEvent < Arachni::Check::Base
 
-    EVENT_ATTRS = [
+    ATTRIBUTES = [
         'onload',
         'onunload',
         'onblur',
@@ -41,6 +41,38 @@ class Arachni::Checks::XssEvent < Arachni::Check::Base
         'src'
     ]
 
+    class SAX
+        attr_reader :proof
+
+        def initialize( seed )
+            @seed       = seed
+            @attributes = Set.new( ATTRIBUTES )
+        end
+
+        def document
+        end
+
+        def attr( name, value )
+            name  = name.to_s.downcase
+            value = value.downcase
+
+            return if !@attributes.include?( name )
+
+            if name == 'src'
+                # Javascript cases can be handled more reliably by the
+                # xss_script_context check; VBScript doesn't have full support
+                # so we settle.
+                if value =~ /^(vb|)script:/ && value.include?( @seed )
+                    @proof = value
+                    fail Arachni::Parser::SAX::Stop
+                end
+            elsif value.include?( @seed )
+                @proof = value
+                fail Arachni::Parser::SAX::Stop
+            end
+        end
+    end
+
     def self.attribute_name
         'arachni_xss_in_element_event'
     end
@@ -66,10 +98,12 @@ class Arachni::Checks::XssEvent < Arachni::Check::Base
 
     def run
         audit self.class.strings, self.class.options do |response, element|
-            next if optimization_cache[response.body.hash] == :checked
+            next if !response.html?
 
-            optimization_cache[response.body.hash] =
-                check_and_log( response, element )
+            k = "#{response.url.hash}-#{response.body.hash}".hash
+            next if optimization_cache[k] == :checked
+
+            optimization_cache[k] = check_and_log( response, element )
         end
     end
 
@@ -79,34 +113,12 @@ class Arachni::Checks::XssEvent < Arachni::Check::Base
         return :checked if !(body =~ /#{self.class.attribute_name}/i)
         return if element.seed.to_s.empty? || !(body =~ /#{element.seed}/i)
 
-        included_attributes = EVENT_ATTRS.select do |attribute|
-            body =~ /#{attribute}/i
-        end
+        handler = SAX.new( element.seed.split( ':', 2 ).last )
+        Arachni::Parser.parse( body, handler: handler )
 
-        return :checked if included_attributes.empty?
-
-        doc  = Arachni::Parser.parse( body )
-        seed = element.seed
-
-        included_attributes.each do |attribute|
-            doc.xpath( "//*[@#{attribute}]" ).each do |elem|
-                value = elem.attributes[attribute].to_s.downcase
-                seed  = seed.split( ':', 2 ).last
-
-                if attribute == 'src'
-                    # Javascript cases can be handled more reliably by the
-                    # xss_script_context check. However VBScript doesn't have
-                    # full support so we settle.
-                    if value =~ /^(vb|)script:/ && value.include?( seed )
-                        log vector: element, response: response, proof: value
-                        return
-                    end
-                elsif value.include?( seed )
-                    log vector: element, response: response, proof: value
-                    return
-                end
-            end
-        end
+        return :checked if !handler.proof
+
+        log vector: element, response: response, proof: handler.proof
     end
 
     def self.info
@@ -115,7 +127,7 @@ class Arachni::Checks::XssEvent < Arachni::Check::Base
             description: %q{Cross-Site Scripting in event tag of HTML element.},
             elements:    [Element::Form, Element::Link, Element::Cookie, Element::Header],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1.7',
+            version:     '0.1.9',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in event tag of HTML element},

data/components/checks/active/xss_path.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -10,8 +10,6 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.1.10
-#
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
 # @see http://secunia.com/advisories/9716/
@@ -53,14 +51,19 @@ class Arachni::Checks::XssPath < Arachni::Check::Base
     end
 
     def check_and_log( response )
+        return if !response.html?
+
         body = response.body.downcase
 
         # check for the existence of the tag name in the response before
         # parsing to verify, no reason to waste resources...
         return if !body.include?( self.class.string )
 
-        # see if we managed to successfully inject our element
-        return if Arachni::Parser.parse( body ).css( self.class.tag ).empty?
+        return if Arachni::Parser.parse(
+            response.body,
+            whitelist:     [self.class.tag],
+            stop_on_first: [self.class.tag]
+        ).nodes_by_name( self.class.tag ).empty?
 
         log vector: Element::Path.new( response.url ),
             proof: self.class.string, response: response
@@ -73,7 +76,7 @@ class Arachni::Checks::XssPath < Arachni::Check::Base
             description: %q{Cross-Site Scripting check for path injection},
             elements:    [ Element::Path ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1.10',
+            version:     '0.1.11',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in path},

data/components/checks/active/xss_script_context.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -36,9 +36,67 @@ class Arachni::Checks::XssScriptContext < Arachni::Check::Base
         'onmouseout',
         'onmouseover',
         'onmouseup',
+
+        # Not an event attribute so it gets special treatment by being checked
+        # for a "script:" prefix.
         'src'
     ]
 
+    class SAX
+        attr_reader :tainted
+
+        def initialize( seed )
+            @seed       = seed
+            @attributes = Set.new( ATTRIBUTES )
+        end
+
+        def document
+        end
+
+        def tainted?
+            !!@tainted
+        end
+
+        def start_element( name )
+            @in_script = (name.to_s.downcase == 'script')
+        end
+
+        def end_element( name )
+            @in_script = false
+        end
+
+        def attr( name, value )
+            name  = name.to_s.downcase
+            value = value.downcase
+
+            return if !@attributes.include?( name )
+
+            if name == 'src'
+                if @seed.start_with?( 'javascript:' ) && value == @seed
+                    @tainted = true
+                    fail Arachni::Parser::SAX::Stop
+                end
+            else
+                if value == @seed
+                    @tainted = true
+                    fail Arachni::Parser::SAX::Stop
+                end
+            end
+
+            if value.include?( @seed )
+                @tainted = true
+                fail Arachni::Parser::SAX::Stop
+            end
+        end
+
+        def text( value )
+            return if !@in_script || value !~ /#{Regexp.escape( @seed )}/i
+
+            @tainted = true
+            fail Arachni::Parser::SAX::Stop
+        end
+    end
+
     def self.seed
         'window.top._%s_taint_tracer.log_execution_flow_sink()'
     end
@@ -89,10 +147,13 @@ class Arachni::Checks::XssScriptContext < Arachni::Check::Base
     def run
         with_browser_cluster do |cluster|
             audit taints( cluster ), self.class.options do |response, element|
+                next if !response.html?
+
                 # Completely body based, identical bodies will yield identical
                 # results.
-                next if optimization_cache[response.body.hash]
-                optimization_cache[response.body.hash] = true
+                k = "#{response.url.hash}-#{response.body.hash}".hash
+                next if optimization_cache[k]
+                optimization_cache[k] = true
 
                 check_and_log( response, element )
             end
@@ -109,58 +170,50 @@ class Arachni::Checks::XssScriptContext < Arachni::Check::Base
             return
         end
 
-        print_info 'Response is tainted, scheduling a taint-trace.'
-
-        # Pass the response to the BrowserCluster for evaluation and see if the
-        # JS payload we injected got executed by inspecting the page's
-        # execution-flow sink.
-        trace_taint( response, taint: self.class.seed ) do |page|
-            print_info 'Checking results of deferred taint analysis for' <<
-                           ' execution-flow sink data.'
-
-            next if page.dom.execution_flow_sinks.empty?
-
-            log vector: element, proof: element.seed, page: page
+        with_browser_cluster do |cluster|
+            print_info 'Response is tainted, scheduling a taint-trace.'
+
+            # Pass the response to the BrowserCluster for evaluation and see if the
+            # JS payload we injected got executed by inspecting the page's
+            # execution-flow sink.
+            cluster.trace_taint(
+                response,
+                {
+                    taint: self.class.seed,
+                    args:  [element, page]
+                },
+                self.class.check_browser_result_cb
+            )
         end
     end
 
-    def tainted?( response, seed )
-        return if seed.to_s.empty? || !response.body.to_s.include?( seed )
-
-        # Quick check to see if the payload landed in a <script>.
-        in_script = (response.body =~ /<script.*?>.*#{Regexp.escape seed}.*?<\/script>/im)
-
-        # Quick check to see if the payload landed in any attributes.
-        pure_seed     = self.class.seed % browser_cluster.javascript_token
-        in_attributes = ATTRIBUTES.select do |attribute|
-            !!response.body.scan( /#{attribute}=(.*?)>/im ).flatten.find do |match|
-                match.include? pure_seed
-            end
-        end
+    def self.check_browser_result( result, element, referring_page, cluster )
+        page = result.page
 
-        # Nowhere to be seen, bail out early.
-        return if in_attributes.empty? && !in_script
+        print_info 'Checking results of deferred taint analysis for' <<
+                       ' execution-flow sink data.'
 
-        # More comprehensive checks by searching the document.
-        doc = Arachni::Parser.parse( response.body )
+        return if page.dom.execution_flow_sinks.empty?
 
-        return true if in_script && doc.css('script').to_s.include?( seed )
+        log(
+            vector:         element,
+            proof:          element.seed,
+            page:           page,
+            referring_page: referring_page
+        )
+    end
 
-        in_attributes.each do |attribute|
-            doc.xpath( "//*[@#{attribute}]" ).each do |elem|
-                value = elem.attributes[attribute].to_s
+    def self.check_browser_result_cb
+        @check_browser_result_cb ||= method(:check_browser_result)
+    end
 
-                if attribute == 'src'
-                    return value if seed.start_with?( 'javascript:' ) && value == seed
-                else
-                    return value if value == seed
-                end
+    def tainted?( response, seed )
+        return if seed.to_s.empty? || !response.body.to_s.include?( seed )
 
-                return true  if value.include?( seed )
-            end
-        end
+        handler = SAX.new( self.class.seed % browser_cluster.javascript_token )
+        Arachni::Parser.parse( response.body, handler: handler )
 
-        false
+        handler.tainted?
     end
 
     def self.info
@@ -172,7 +225,7 @@ Injects JS taint code and check to see if it gets executed as proof of vulnerabi
             elements:    [ Element::Form, Element::Link, Element::Cookie,
                            Element::Header, Element::LinkTemplate ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.2.3',
+            version:     '0.2.5',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in script context},