arachni 1.4 → 1.6.0

data/components/checks/active/csrf.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -24,8 +24,8 @@
 #   * Extract forms.
 # * Check forms that appear *only* when logged-in for CSRF.
 #
-# In order for the check to give meaningful results, a valid cookie-jar of a logged-in
-# user must be supplied to the framework.
+# In order for the check to give meaningful results, a valid session of a
+# logged-in user must be supplied to the framework.
 #
 # However, as Arachni goes through the system it will gather
 # cookies just like a user would, so if there are forms that only appear
@@ -40,6 +40,11 @@
 class Arachni::Checks::CSRF < Arachni::Check::Base
 
     def run
+        # TODO:
+        #   Check forms that were created dynamically via JS.
+        #   Maybe add a csrf_dom check?
+        return if page.dom.transitions.any?
+
         print_status 'Looking for CSRF candidates...'
         print_status 'Simulating logged-out user.'
 
@@ -50,86 +55,26 @@ class Arachni::Checks::CSRF < Arachni::Check::Base
 
             print_status "Found #{logged_out.size} context irrelevant forms."
 
-            # get forms that are worthy of testing for CSRF i.e. appear only when the user is logged-in
+            # get forms that are worthy of testing for CSRF i.e. appear only
+            # when the user is logged-in
             candidates = page.forms - logged_out
 
             print_status "Found #{candidates.size} CSRF candidates."
 
-            candidates.each { |form| _log( form ) if unsafe?( form ) }
-        end
-    end
-
-    # Tries to detect if a form is protected using an anti-CSRF token.
-    #
-    # @param    [Arachni::Element::Form]  form
-    #
-    # @return   [Bool]
-    #   `true` if the form has no anti-CSRF token, `false` otherwise
-    def unsafe?( form )
-        # If a form has a nonce then we're cool, bail out early
-        return false if form.has_nonce?
-
-        # If the form has no source then it was dynamically provided by some
-        # component, so skip them.
-        return false if !form.source
-
-        #
-        # Nobody says that tokens must be in a +value+ attribute, they can
-        # just as well be in +name+ -- so we check them both...
-        #
-        found_token = (form.inputs || []).map do |k, v|
-            csrf_token?( v ) || csrf_token?( k )
-        end.include?( true )
-
-        return false if found_token
-
-        link_vars = uri_parse_query( form.action )
-        if link_vars.any?
-            # and we also need to check for a token in the form action.
-            found_token = link_vars.to_a.flatten.
-                map { |val| csrf_token?( val ) }.include?( true )
-        end
-
-        !found_token
-    end
-
-    # Checks if the str is an anti-CSRF token of base10/16/32/64.
-    #
-    # @param  [String]  str
-    def csrf_token?( str )
-        return false if !str
-        return true if str.to_s.include?( 'csrf' )
-
-        # we could use regexps but i kinda like lcamtuf's (Michal's) way
-        base16_len_min    = 8
-        base16_digit_num  = 2
+            candidates.each do |form|
+                # If the form has no source then it was dynamically provided by
+                # some component, so skip it.
+                next if !form.source
 
-        base64_len_min    = 6
-        base64_digit_num  = 1
-        base64_case       = 2
-        base64_digit_num2 = 3
-        base64_slash_cnt  = 2
+                # If a form has a nonce then we're cool.
+                next if form.has_nonce?
 
-        len = str.size
-        digit_cnt = str.scan( /[0-9]+/ ).join.size
-
-        if len >= base16_len_min && digit_cnt >= base16_digit_num
-            return true
+                log_form( form )
+            end
         end
-
-        upper_cnt = str.scan( /[A-Z]+/ ).join.size
-        slash_cnt = str.scan( /\/+/ ).join.size
-
-        if len >= base64_len_min && slash_cnt <= base64_slash_cnt &&
-            ((digit_cnt >= base64_digit_num && upper_cnt >= base64_case ) ||
-                digit_cnt >= base64_digit_num2)
-            return true
-        end
-
-        false
     end
 
-    def _log( form )
+    def log_form( form )
         url  = form.action
         name = form.name_or_id
 
@@ -155,7 +100,7 @@ checks them for lack of anti-CSRF tokens.
 },
             elements:    [ Element::Form ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.3.5',
+            version:     '0.4.1',
 
             issue:       {
                 name:            %q{Cross-Site Request Forgery},

data/components/checks/active/file_inclusion.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/ldap_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/no_sql_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/no_sql_injection_differential.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -37,9 +37,9 @@ It uses differential analysis to determine how different inputs affect the behav
 of the web application and checks if the displayed behavior is consistent with
 that of a vulnerable application.
 },
-            elements:    [ Element::Link, Element::Form, Element::Cookie ],
+            elements:    [ Element::Link, Element::Form, Element::Cookie, Element::NestedCookie ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.2',
+            version:     '0.1.3',
             platforms:   [ :nosql ],
 
             issue:       {

data/components/checks/active/os_cmd_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/os_cmd_injection_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/path_traversal.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -16,7 +16,7 @@
 class Arachni::Checks::PathTraversal < Arachni::Check::Base
 
     MINIMUM_TRAVERSALS = 0
-    MAXIMUM_TRAVERSALS = 6
+    MAXIMUM_TRAVERSALS = 8
 
     def self.options
         @options ||= {
@@ -98,7 +98,7 @@ of relevant content in the HTML responses.
 },
             elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.4.7',
+            version:     '0.4.8',
             platforms:   payloads.keys,
 
             issue:       {

data/components/checks/active/response_splitting.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/rfi.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/session_fixation.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/source_code_disclosure.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/sql_injection/regexps/hsqldb.yaml

@@ -0,0 +1 @@
+Unexpected token: Unexpected token.*in statement \[

data/components/checks/active/sql_injection/substrings/hsqldb

@@ -1 +1,2 @@
 org.hsqldb.jdbc
+Unexpected end of command in statement [

data/components/checks/active/sql_injection/substrings/java

@@ -0,0 +1,4 @@
+org.hibernate.QueryException: unexpected char:
+org.hibernate.QueryException: expecting '
+java.sql.SQLSyntaxErrorException
+java.sql.SQLException

data/components/checks/active/sql_injection/substrings/oracle

@@ -1,2 +1 @@
-java.sql.SQLException
 Oracle error

data/components/checks/active/sql_injection/substrings/sqlite

@@ -1,3 +1,4 @@
 SQLite/JDBCDriver
 SQLite.Exception
 System.Data.SQLite.SQLiteException
+SQLITE_ERROR

data/components/checks/active/sql_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/sql_injection_differential.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -55,9 +55,9 @@ It uses differential analysis to determine how different inputs affect behavior
 of the web application and checks if the displayed behavior is consistent with
 that of a vulnerable application.
 },
-            elements:    [ Element::Link, Element::Form, Element::Cookie ],
+            elements:    [ Element::Link, Element::Form, Element::Cookie, Element::NestedCookie ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.4.4',
+            version:     '0.4.5',
             platforms:   [ :sql ],
 
             issue:       {

data/components/checks/active/sql_injection_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/trainer.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/unvalidated_redirect.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -29,7 +29,7 @@ class Arachni::Checks::UnvalidatedRedirect < Arachni::Check::Base
         (@set_payloads ||= Set.new( payloads )).include? Arachni::URI( url ).to_s
     end
     def payload?( url )
-        self.class.payload? url
+        self.class.payload? url.to_s.split( '?' ).first
     end
 
     def self.options
@@ -37,7 +37,24 @@ class Arachni::Checks::UnvalidatedRedirect < Arachni::Check::Base
             format: [ Format::STRAIGHT ],
             submit: {
                 follow_location: false
-            }
+            },
+
+            # Add one more mutation (on the fly) which will include the original
+            # value.
+            each_mutation: proc do |mutation|
+                next if !mutation.affected_input_value
+
+                m = mutation.dup
+
+                # Figure out the extension of the default value, if it has one.
+                original_value = m.default_inputs[m.affected_input_name]
+
+                # Null-terminate the injected value and append the ext.
+                m.affected_input_value += "/?#{original_value}"
+
+                # Pass our new mutation back to be audited.
+                m
+            end
         }
     end
 
@@ -58,16 +75,22 @@ class Arachni::Checks::UnvalidatedRedirect < Arachni::Check::Base
             # a JS redirect.
             next if !response.body.include?( element.seed )
 
-            with_browser do |browser|
-                browser.load( response )
-
-                if payload? browser.url
-                    log vector: element, response: response
-                end
-            end
+            with_browser( element, response, page, self.class.check_browser_result_cb )
         end
     end
 
+    def self.check_browser_result( browser, element, response, referring_page )
+        browser.load( response )
+
+        return if !payload? browser.url
+
+        log vector: element, response: response, referring_page: referring_page
+    end
+
+    def self.check_browser_result_cb
+        @check_browser_result_cb ||= method(:check_browser_result)
+    end
+
     def self.info
         {
             name:        'Unvalidated redirect',
@@ -77,7 +100,7 @@ URL to determine whether the attack was successful.
 },
             elements:    ELEMENTS_WITH_INPUTS - [Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.4',
+            version:     '0.2.5',
 
             issue:       {
                 name:            %q{Unvalidated redirect},

data/components/checks/active/unvalidated_redirect_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -39,11 +39,11 @@ class Arachni::Checks::UnvalidatedRedirectDOM < Arachni::Check::Base
 
     def run
         each_candidate_dom_element do |element|
-            element.audit( self.class.payloads, self.class.options, &method(:check_and_log) )
+            element.audit( self.class.payloads, self.class.options )
         end
     end
 
-    def check_and_log( page, element )
+    def self.check_and_log( page, element )
         return if !payload? page.url
         log vector: element, page: page
     end
@@ -59,7 +59,7 @@ Injects URLs and checks the browser URL to determine whether the attack was succ
                 Element::UIInput::DOM
             ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.2',
+            version:     '0.1.3',
 
             issue:       {
                 name:            %q{Unvalidated DOM redirect},

data/components/checks/active/xpath_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/xss.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -13,7 +13,6 @@
 # {BrowserCluster} for evaluation and {#trace_taint taint-tracing}.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.4.4
 #
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
@@ -21,7 +20,7 @@
 class Arachni::Checks::Xss < Arachni::Check::Base
 
     def self.tag_name
-        "some_dangerous_input_#{random_seed}"
+        "#{shortname}_#{random_seed}"
     end
 
     def self.tag
@@ -43,7 +42,7 @@ class Arachni::Checks::Xss < Arachni::Check::Base
 
     def self.options
         @options ||= {
-            format: [Format::APPEND],
+            format: [Format::APPEND]
         }
     end
 
@@ -56,14 +55,16 @@ class Arachni::Checks::Xss < Arachni::Check::Base
 
     def run
         audit( self.class.strings, self.class.options ) do |response, element|
+            next if !response.html?
+
             # If there's no vuln responses will usually be identical, so bail
             # out early.
             # If responses aren't identical due to noise, well, we're not losing
             # much.
-            next if optimization_cache[response.body.hash] == :checked
+            k = "#{response.url.hash}-#{response.body.hash}".hash
+            next if optimization_cache[k] == :checked
 
-            optimization_cache[response.body.hash] =
-                check_and_log( response, element )
+            optimization_cache[k] = check_and_log( response, element )
         end
     end
 
@@ -77,7 +78,7 @@ class Arachni::Checks::Xss < Arachni::Check::Base
         end
 
         # See if we managed to successfully inject our element in the doc tree.
-        if find_proof( response )
+        if self.class.find_proof( response )
             log vector: element, proof: self.class.tag, response: response
             return :checked
         end
@@ -85,41 +86,65 @@ class Arachni::Checks::Xss < Arachni::Check::Base
         # No idea what was returned, but we can't work with it.
         return :checked if !response.to_page.has_script?
 
-        with_browser_cluster do
+        with_browser_cluster do |cluster|
             print_info 'Progressing to deferred browser evaluation of response.'
 
             # Pass the response to the BrowserCluster for evaluation and see if the
             # element appears in the doc tree now.
-            trace_taint( response, taint: self.class.tag ) do |page|
-                # At this point further checks will be body based, identical
-                # bodies will yield identical results.
-                next if optimization_cache["traced-#{page.body.hash}".hash] == :traced
-                optimization_cache["traced-#{page.body.hash}".hash] = :traced
+            cluster.trace_taint(
+                response,
+                {
+                    taint: self.class.tag,
+                    args:  [element, page]
+                },
+                self.class.check_browser_result_cb
+            )
+        end
+    end
 
-                print_info 'Checking results of deferred taint analysis.'
+    def self.check_browser_result( result, element, referring_page, cluster )
+        page = result.page
 
-                next if !(proof = find_proof( page ))
+        # At this point further checks will be body based, identical
+        # bodies will yield identical results.
+        key = "traced-#{page.body.hash}".hash
+        return if optimization_cache[key] == :traced
+        optimization_cache[key] = :traced
 
-                log vector: element, proof: proof, page: page
-            end
-        end
+        print_info 'Checking results of deferred taint analysis.'
+
+        return if !(proof = find_proof( page ))
+
+        log(
+            vector:         element,
+            proof:          proof,
+            page:           page,
+            referring_page: referring_page
+        )
     end
 
-    def find_proof( resource )
-        return if !resource.body.has_html_tag?( self.class.tag_name )
+    def self.check_browser_result_cb
+        @check_browser_result_cb ||= method(:check_browser_result)
+    end
+
+    def self.find_proof( resource )
+        return if !resource.body.has_html_tag?( self.tag_name )
+
+        proof_nodes = Arachni::Parser.parse(
+            resource.body,
+            whitelist:     [self.tag_name, 'textarea'],
+            stop_on_first: [self.tag_name]
+        ).nodes_by_name( self.tag_name )
 
-        proof_nodes = Arachni::Parser.parse( resource.body ).css( self.class.tag_name )
         return if proof_nodes.empty?
 
-        proof = nil
-        proof_nodes.each do |e|
-            next if e.parent.name =='textarea'
-            proof = e.to_s
+        proof = proof_nodes.find do |e|
+            e.parent.name != :textarea
         end
 
         return if !proof
 
-        proof
+        proof.to_html
     end
 
     def self.info
@@ -130,9 +155,9 @@ Injects an HTML element into page inputs and then parses the HTML markup of
 tainted responses to look for proof of vulnerability.
 },
             elements:    [Element::Form, Element::Link, Element::Cookie,
-                          Element::Header, Element::LinkTemplate],
+                 Element::NestedCookie, Element::Header, Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.4.6',
+            version:     '0.4.10',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS)},