arachni 1.4 → 1.5

data/spec/support/servers/arachni/http/client/dynamic_404_handler_redirect_2.rb

@@ -0,0 +1,11 @@
+require 'sinatra'
+
+get '/error/index.html' do
+    response.headers['Content-Type'] = 'text/html'
+    "custom page"
+end
+
+get '*' do
+    status 404
+    "404 Not Found"
+end

data/spec/support/servers/arachni/http/proxy_server.rb

@@ -7,3 +7,15 @@ end
 get '/sleep' do
     sleep 5
 end
+
+get '/text' do
+    content_type 'text/html; charset=ss'
+
+    'Blah'.encode( 'ASCII-8BIT' )
+end
+
+get '/binary' do
+    content_type 'application/binary'
+
+    "\x01\x02\x03".encode( 'ASCII-8BIT' )
+end

data/spec/support/servers/arachni/session.rb

@@ -29,6 +29,20 @@ get '/login' do
             <input name='username' value='' />
             <input name='password' type='password' value='' />
             <input name='token' type='hidden' value='secret!' />
+            <input name="submit_me" type="submit" value="Login!"/>
+        </form>
+    HTML
+end
+
+get '/without_button' do
+    cookies[:you_need_to] = 'preserve this'
+
+    <<-HTML
+        <form method='post' name='login_form' action="/login">
+            <input name='username' value='' />
+            <input name='password' type='password' value='' />
+            <input name='token' type='hidden' value='secret!' />
+            <input name="submit_me" type="hidden" value="Login!"/>
         </form>
     HTML
 end
@@ -61,6 +75,12 @@ get '/javascript_login' do
             input.value = "secret!";
             form.appendChild(input);
 
+            var input = document.createElement("input");
+            input.type = "submit";
+            input.name = "submit_me";
+            input.value = "Login!";
+            form.appendChild(input);
+
             var input = document.createElement("input");
             input.type = "submit";
             form.appendChild(input);
@@ -83,6 +103,7 @@ get '/disappearing_login' do
             <input name='username' value='' />
             <input name='password' type='password' value='' />
             <input name='token' type='hidden' value='secret!' />
+            <input name="submit_me" type="submit" value="Login!"/>
         </form>
     HTML
 end
@@ -98,13 +119,15 @@ get '/multiple' do
             <input name='username' value='' />
             <input name='password' type='password' value='' />
             <input name='token' type='hidden' value='secret!' />
+            <input name="submit_me" type="submit" value="Login!"/>
         </form>
     HTML
 end
 
 post '/login' do
     if params['username'] == 'john' && params['password'] == 'doe' &&
-        params['token'] == 'secret!'
+        params['token'] == 'secret!' && params['submit_me'] == 'Login!'
+
         cookies[:success] = true
         redirect '/'
     else

data/spec/support/servers/checks/active/csrf.rb

@@ -16,82 +16,6 @@ end
 get '/' do
     html = common
 
-    if logged_in?( cookies )
-        html << <<-HTML
-        <form name='insecure_important_form' action='?'>
-            <input name='hooa!' value='important stuff' />
-        </form>
-
-        <form name='secure_important_form' action='?'>
-            <input name='booya!' value='other important stuff' />
-            <input type='hidden' name='my_kewl_token' value='da39a3ee5e6b4b0d3255bfef95601890afd80709' />
-        </form>
-        HTML
-    end
-
-    html
-end
-
-get '/token_in_name' do
-    html = common
-
-    if logged_in?( cookies )
-        html << <<-HTML
-        <form name='insecure_important_form' action='?'>
-            <input name='hooa!' value='important stuff' />
-        </form>
-
-        <form name='secure_important_form' action='?'>
-            <input name='booya!' value='other important stuff' />
-        <input type='hidden' name='da39a3ee5e6b4b0d3255bfef95601890afd80709' />
-
-        <form name='secure_important_form_2' action='?'>
-            <input name='blahcsrfblah' value='stuff' />
-        </form>
-
-        HTML
-    end
-
-    html
-end
-
-get '/token_in_action' do
-    html = common
-
-    if logged_in?( cookies )
-        html << <<-HTML
-        <form name='insecure_important_form' action='?'>
-            <input name='hooa!' value='important stuff' />
-        </form>
-
-        <form name='secure_important_form' action='?da39a3ee5e6b4b0d3255bfef95601890afd80709'>
-            <input name='booya!' value='other important stuff' />
-        </form>
-
-        <form name='secure_important_form2' action='?da39a3ee5e6b4b0d3255bfef95601890afd80709=test'>
-            <input name='booya!' value='other important stuff' />
-        </form>
-
-        <form name='secure_important_form3' action='?test=da39a3ee5e6b4b0d3255bfef95601890afd80709'>
-            <input name='booya!' value='other important stuff' />
-        </form>
-
-        <form name='secure_important_form4' action='?csrf=stuff'>
-            <input name='booya!' value='other important stuff' />
-        </form>
-
-        <form name='secure_important_form5' action='?stuff=csrf'>
-            <input name='booya!' value='other important stuff' />
-        </form>
-        HTML
-    end
-
-    html
-end
-
-get '/with_nonce' do
-    html = common
-
     if logged_in?( cookies )
         html << <<-HTML
         <form name='insecure_important_form' action='?'>

data/spec/support/servers/checks/active/sql_injection/java

@@ -0,0 +1,2 @@
+org.hibernate.QueryException: unexpected char:
+org.hibernate.QueryException: expecting '

data/spec/support/servers/checks/active/unvalidated_redirect.rb

@@ -47,6 +47,7 @@ get "/link" do
     <<-EOHTML
         <a href="/link/straight?input=default">Link</a>
         <a href="/link/append?input=default">Link</a>
+        <a href="/link/prepend?input=default">Link</a>
         <a href="/link/js?input=default">Link</a>
     EOHTML
 end
@@ -65,6 +66,14 @@ get '/link/append' do
     get_variations( params['input'].split( default ).last )
 end
 
+get '/link/prepend' do
+    default = 'default'
+    return if !params['input'].end_with?( default )
+
+    get_variations( params['input'].split( default ).last )
+end
+
+
 get '/link/js' do
     get_js_variations( params['input'] )
 end
@@ -79,6 +88,10 @@ get '/form' do
             <input name='input' value='default' />
         </form>
 
+        <form action="/form/prepend">
+            <input name='input' value='default' />
+        </form>
+
         <form action="/form/js">
             <input name='input' value='default' />
         </form>
@@ -99,6 +112,13 @@ get '/form/append' do
     get_variations( params['input'].split( default ).last )
 end
 
+get '/form/prepend' do
+    default = 'default'
+    return if !params['input'] || !params['input'].end_with?( default )
+
+    get_variations( params['input'].split( default ).last )
+end
+
 get '/form/js' do
     get_js_variations( params['input'] )
 end
@@ -107,6 +127,7 @@ get '/cookie' do
     <<-EOHTML
         <a href="/cookie/straight">Cookie</a>
         <a href="/cookie/append">Cookie</a>
+        <a href="/cookie/prepend">Cookie</a>
         <a href="/cookie/js">Cookie</a>
     EOHTML
 end
@@ -128,6 +149,14 @@ get '/cookie/append' do
     get_variations( cookies['cookie2'].split( default ).last )
 end
 
+get '/cookie/prepend' do
+    default = 'cookie value'
+    cookies['cookie2'] ||= default
+    return if !cookies['cookie2'].end_with?( default )
+
+    get_variations( cookies['cookie2'].split( default ).last )
+end
+
 get '/cookie/js' do
     get_js_variations( cookies['cookie2'] )
 end
@@ -136,6 +165,7 @@ get '/header' do
     <<-EOHTML
         <a href="/header/straight">Header</a>
         <a href="/header/append">Header</a>
+        <a href="/header/prepend">Header</a>
         <a href="/header/js">Header</a>
     EOHTML
 end
@@ -154,6 +184,13 @@ get '/header/append' do
     get_variations( env['HTTP_USER_AGENT'].split( default ).last )
 end
 
+get '/header/prepend' do
+    default = 'arachni_user'
+    return if !env['HTTP_USER_AGENT'] || !env['HTTP_USER_AGENT'].end_with?( default )
+
+    get_variations( env['HTTP_USER_AGENT'].split( default ).last )
+end
+
 get '/header/js' do
     get_js_variations( env['HTTP_USER_AGENT'] )
 end
@@ -168,6 +205,10 @@ get "/json" do
             http_request = new XMLHttpRequest();
             http_request.open( "POST", "/json/append", true);
             http_request.send( '{"input": "arachni_user"}' );
+
+            http_request = new XMLHttpRequest();
+            http_request.open( "POST", "/json/prepend", true);
+            http_request.send( '{"input": "arachni_user"}' );
         </script>
     EOHTML
 end
@@ -190,6 +231,16 @@ post "/json/append" do
     get_variations( @json['input'].split( default ).last )
 end
 
+post "/json/prepend" do
+    return if !@json
+
+    default = 'arachni_user'
+    return if !@json['input'].end_with?( default )
+
+    get_variations( @json['input'].split( default ).last )
+end
+
+
 get "/xml" do
     <<-EOHTML
             <script type="application/javascript">
@@ -201,6 +252,10 @@ get "/xml" do
                 http_request.open( "POST", "/xml/text/append", true);
                 http_request.send( '<input>arachni_user</input>' );
 
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/text/prepend", true);
+                http_request.send( '<input>arachni_user</input>' );
+
                 http_request = new XMLHttpRequest();
                 http_request.open( "POST", "/xml/attribute/straight", true);
                 http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
@@ -208,6 +263,10 @@ get "/xml" do
                 http_request = new XMLHttpRequest();
                 http_request.open( "POST", "/xml/attribute/append", true);
                 http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/attribute/prepend", true);
+                http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
             </script>
     EOHTML
 end
@@ -234,6 +293,17 @@ post "/xml/text/append" do
     get_variations( input.split( default ).last )
 end
 
+post "/xml/text/prepend" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first.content
+
+    return if !input.end_with?( default )
+
+    get_variations( input.split( default ).last )
+end
+
 post "/xml/attribute/straight" do
     return if !@xml
 
@@ -255,3 +325,14 @@ post "/xml/attribute/append" do
 
     get_variations( input.split( default ).last )
 end
+
+post "/xml/attribute/prepend" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first['my-attribute']
+
+    return if !input.end_with?( default )
+
+    get_variations( input.split( default ).last )
+end

data/spec/support/servers/checks/active/xss_event.rb

@@ -3,7 +3,7 @@ require 'sinatra/contrib'
 require_relative '../check_server'
 
 def attributes
-    current_check::EVENT_ATTRS
+    current_check::ATTRIBUTES
 end
 
 def get_variations( str )

data/spec/support/servers/checks/passive/backup_files.rb

@@ -2,16 +2,35 @@ require 'sinatra'
 require_relative '../check_server'
 
 get '/' do
-    <<-HTML
+    s = <<-HTML
         <a href="/some_filename.php">Hit me</a>
     HTML
+
+    current_check::IGNORE_EXTENSIONS.each do |extension|
+        s << <<-HTML
+            <a href="/some_media.#{extension}">Hit media</a>
+        HTML
+    end
+
+    s
 end
 
 get( '/some_filename.php' ){}
 
+current_check::IGNORE_EXTENSIONS.each do |extension|
+    get( '/some_media.' + extension ){}
+end
+
 current_check.formats.each do |format|
     path = format.gsub( '[name]', 'some_filename' ).gsub( '[extension]', 'php' )
     get '/' + path do
         path
     end
+
+    current_check::IGNORE_EXTENSIONS.each do |extension|
+        path = format.gsub( '[name]', 'some_media' ).gsub( '[extension]', extension )
+        get '/' + path do
+            path
+        end
+    end
 end

data/spec/support/servers/checks/passive/grep/cookie_set_for_parent_domain.rb

@@ -8,14 +8,12 @@ get '/' do
     })
     response.set_cookie( 'cookie2', {
         value:  'value2',
-        domain: '.localhost'
+        domain: 'localhost'
     })
     response.set_cookie( 'cookie3', {
-        value:  'value3',
-        domain: 'localhost'
+        value:  'value3'
     })
     response.set_cookie( 'cookie4', {
-        value:  'value4',
-        domain: 'localhost'
+        value:  'value4'
     })
 end

data/spec/support/servers/checks/passive/grep/insecure_cookies_https.rb

@@ -30,6 +30,15 @@ class InsecureCookiesSServer < Sinatra::Base
             value:  "value4",
             secure: true
         })
+
+        <<EOHTML
+<html>
+<script>
+    document.cookie = "jscookie=blah";
+    document.cookie = "jscookie2=blah;secure";
+</script>
+</html>
+EOHTML
     end
 
 end

data/spec/support/servers/plugins/autologin.rb

@@ -33,6 +33,20 @@ get '/login' do
             <input name='username' value='' />
             <input name='password' type='password' value='' />
             <input name='token' type='hidden' value='secret!' />
+            <input name='submit_me' type='hidden' value='submitted' />
+        </form>
+    HTML
+end
+
+get '/login/submit_input' do
+    cookies[:preserve] = 'this'
+
+    <<-HTML
+        <form method='post' name='login_form' action="/login">
+            <input name='username' value='' />
+            <input name='password' type='password' value='' />
+            <input name='token' type='hidden' value='secret!' />
+            <input name='submit_me' type='submit' value='submitted' />
         </form>
     HTML
 end
@@ -48,7 +62,9 @@ end
 
 post '/login' do
     if params['username'] == 'john' && params['password'] == 'doe' &&
-        params['token'] == 'secret!' && cookies[:preserve] == 'this'
+        params['token'] == 'secret!' && cookies[:preserve] == 'this' &&
+        params['submit_me'] == 'submitted'
+
         cookies[:success] = true
         redirect '/redirect/1'
     else