arachni 1.4 → 1.6.0

data/components/checks/active/xss_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -7,12 +7,11 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1
 class Arachni::Checks::XssDom < Arachni::Check::Base
     prefer :xss
 
     def self.tag_name
-        "some_dangerous_input_#{random_seed}"
+        "#{shortname}_#{random_seed}"
     end
 
     def self.tag
@@ -40,22 +39,27 @@ class Arachni::Checks::XssDom < Arachni::Check::Base
         return if !browser_cluster
 
         each_candidate_dom_element do |element|
-            element.audit( self.class.strings, self.class.options, &method(:check_and_log) )
+            element.audit( self.class.strings, self.class.options )
         end
     end
 
-    def check_and_log( page, element )
+    def self.check_and_log( page, element )
         return if !(proof = find_proof( page ))
 
         log vector: element, proof: proof, page: page
     end
 
-    def find_proof( page )
-        return if !page.body.has_html_tag?( self.class.tag_name )
+    def self.find_proof( page )
+        return if !page.body.has_html_tag?( self.tag_name )
 
-        proof = page.document.css( self.class.tag_name )
-        return if proof.empty?
-        proof.to_s
+        proof = Arachni::Parser.parse(
+            page.body,
+            whitelist:     [self.tag_name],
+            stop_on_first: [self.tag_name]
+        ).nodes_by_name( self.tag_name ).first
+        return if !proof
+
+        proof.to_html
     end
 
     def self.info
@@ -67,7 +71,7 @@ tainted responses to look for proof of vulnerability.
 },
             elements:    DOM_ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.2',
+            version:     '0.1.4',
 
             issue:       {
                 name:            %q{DOM-based Cross-Site Scripting (XSS)},

data/components/checks/active/xss_dom_script_context.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -7,7 +7,6 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.1
 class Arachni::Checks::XssDomScriptContext < Arachni::Check::Base
 
     prefer :xss_script_context
@@ -45,13 +44,12 @@ class Arachni::Checks::XssDomScriptContext < Arachni::Check::Base
         each_candidate_dom_element do |element|
             element.audit(
                 taints,
-                self.class.options.merge( submit: { taint: seed } ),
-                &method(:check_and_log)
+                self.class.options.merge( submit: { taint: seed } )
             )
         end
     end
 
-    def check_and_log( page, element )
+    def self.check_and_log( page, element )
         return if page.dom.execution_flow_sinks.empty?
         log vector: element, page: page
     end
@@ -64,7 +62,7 @@ Injects JS taint code and checks to see if it gets executed as proof of vulnerab
 },
             elements:    DOM_ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.1',
+            version:     '0.1.2',
 
             issue:       {
                 name:            %q{DOM-based Cross-Site Scripting (XSS) in script context},

data/components/checks/active/xss_event.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -15,7 +15,7 @@
 # @see http://secunia.com/advisories/9716/
 class Arachni::Checks::XssEvent < Arachni::Check::Base
 
-    EVENT_ATTRS = [
+    ATTRIBUTES = [
         'onload',
         'onunload',
         'onblur',
@@ -41,6 +41,38 @@ class Arachni::Checks::XssEvent < Arachni::Check::Base
         'src'
     ]
 
+    class SAX
+        attr_reader :proof
+
+        def initialize( seed )
+            @seed       = seed
+            @attributes = Set.new( ATTRIBUTES )
+        end
+
+        def document
+        end
+
+        def attr( name, value )
+            name  = name.to_s.downcase
+            value = value.downcase
+
+            return if !@attributes.include?( name )
+
+            if name == 'src'
+                # Javascript cases can be handled more reliably by the
+                # xss_script_context check; VBScript doesn't have full support
+                # so we settle.
+                if value =~ /^(vb|)script:/ && value.include?( @seed )
+                    @proof = value
+                    fail Arachni::Parser::SAX::Stop
+                end
+            elsif value.include?( @seed )
+                @proof = value
+                fail Arachni::Parser::SAX::Stop
+            end
+        end
+    end
+
     def self.attribute_name
         'arachni_xss_in_element_event'
     end
@@ -66,10 +98,12 @@ class Arachni::Checks::XssEvent < Arachni::Check::Base
 
     def run
         audit self.class.strings, self.class.options do |response, element|
-            next if optimization_cache[response.body.hash] == :checked
+            next if !response.html?
 
-            optimization_cache[response.body.hash] =
-                check_and_log( response, element )
+            k = "#{response.url.hash}-#{response.body.hash}".hash
+            next if optimization_cache[k] == :checked
+
+            optimization_cache[k] = check_and_log( response, element )
         end
     end
 
@@ -79,43 +113,21 @@ class Arachni::Checks::XssEvent < Arachni::Check::Base
         return :checked if !(body =~ /#{self.class.attribute_name}/i)
         return if element.seed.to_s.empty? || !(body =~ /#{element.seed}/i)
 
-        included_attributes = EVENT_ATTRS.select do |attribute|
-            body =~ /#{attribute}/i
-        end
+        handler = SAX.new( element.seed.split( ':', 2 ).last )
+        Arachni::Parser.parse( body, handler: handler )
 
-        return :checked if included_attributes.empty?
-
-        doc  = Arachni::Parser.parse( body )
-        seed = element.seed
-
-        included_attributes.each do |attribute|
-            doc.xpath( "//*[@#{attribute}]" ).each do |elem|
-                value = elem.attributes[attribute].to_s.downcase
-                seed  = seed.split( ':', 2 ).last
-
-                if attribute == 'src'
-                    # Javascript cases can be handled more reliably by the
-                    # xss_script_context check. However VBScript doesn't have
-                    # full support so we settle.
-                    if value =~ /^(vb|)script:/ && value.include?( seed )
-                        log vector: element, response: response, proof: value
-                        return
-                    end
-                elsif value.include?( seed )
-                    log vector: element, response: response, proof: value
-                    return
-                end
-            end
-        end
+        return :checked if !handler.proof
+
+        log vector: element, response: response, proof: handler.proof
     end
 
     def self.info
         {
             name:        'XSS in HTML element event attribute',
             description: %q{Cross-Site Scripting in event tag of HTML element.},
-            elements:    [Element::Form, Element::Link, Element::Cookie, Element::Header],
+            elements:    [Element::Form, Element::Link, Element::Cookie, Element::NestedCookie, Element::Header],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1.7',
+            version:     '0.1.10',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in event tag of HTML element},

data/components/checks/active/xss_path.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -10,8 +10,6 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.1.10
-#
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
 # @see http://secunia.com/advisories/9716/
@@ -53,14 +51,19 @@ class Arachni::Checks::XssPath < Arachni::Check::Base
     end
 
     def check_and_log( response )
+        return if !response.html?
+
         body = response.body.downcase
 
         # check for the existence of the tag name in the response before
         # parsing to verify, no reason to waste resources...
         return if !body.include?( self.class.string )
 
-        # see if we managed to successfully inject our element
-        return if Arachni::Parser.parse( body ).css( self.class.tag ).empty?
+        return if Arachni::Parser.parse(
+            response.body,
+            whitelist:     [self.class.tag],
+            stop_on_first: [self.class.tag]
+        ).nodes_by_name( self.class.tag ).empty?
 
         log vector: Element::Path.new( response.url ),
             proof: self.class.string, response: response
@@ -73,7 +76,7 @@ class Arachni::Checks::XssPath < Arachni::Check::Base
             description: %q{Cross-Site Scripting check for path injection},
             elements:    [ Element::Path ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1.10',
+            version:     '0.1.11',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in path},

data/components/checks/active/xss_script_context.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -36,9 +36,67 @@ class Arachni::Checks::XssScriptContext < Arachni::Check::Base
         'onmouseout',
         'onmouseover',
         'onmouseup',
+
+        # Not an event attribute so it gets special treatment by being checked
+        # for a "script:" prefix.
         'src'
     ]
 
+    class SAX
+        attr_reader :tainted
+
+        def initialize( seed )
+            @seed       = seed
+            @attributes = Set.new( ATTRIBUTES )
+        end
+
+        def document
+        end
+
+        def tainted?
+            !!@tainted
+        end
+
+        def start_element( name )
+            @in_script = (name.to_s.downcase == 'script')
+        end
+
+        def end_element( name )
+            @in_script = false
+        end
+
+        def attr( name, value )
+            name  = name.to_s.downcase
+            value = value.downcase
+
+            return if !@attributes.include?( name )
+
+            if name == 'src'
+                if @seed.start_with?( 'javascript:' ) && value == @seed
+                    @tainted = true
+                    fail Arachni::Parser::SAX::Stop
+                end
+            else
+                if value == @seed
+                    @tainted = true
+                    fail Arachni::Parser::SAX::Stop
+                end
+            end
+
+            if value.include?( @seed )
+                @tainted = true
+                fail Arachni::Parser::SAX::Stop
+            end
+        end
+
+        def text( value )
+            return if !@in_script || value !~ /#{Regexp.escape( @seed )}/i
+
+            @tainted = true
+            fail Arachni::Parser::SAX::Stop
+        end
+    end
+
     def self.seed
         'window.top._%s_taint_tracer.log_execution_flow_sink()'
     end
@@ -89,10 +147,13 @@ class Arachni::Checks::XssScriptContext < Arachni::Check::Base
     def run
         with_browser_cluster do |cluster|
             audit taints( cluster ), self.class.options do |response, element|
+                next if !response.html?
+
                 # Completely body based, identical bodies will yield identical
                 # results.
-                next if optimization_cache[response.body.hash]
-                optimization_cache[response.body.hash] = true
+                k = "#{response.url.hash}-#{response.body.hash}".hash
+                next if optimization_cache[k]
+                optimization_cache[k] = true
 
                 check_and_log( response, element )
             end
@@ -109,58 +170,50 @@ class Arachni::Checks::XssScriptContext < Arachni::Check::Base
             return
         end
 
-        print_info 'Response is tainted, scheduling a taint-trace.'
-
-        # Pass the response to the BrowserCluster for evaluation and see if the
-        # JS payload we injected got executed by inspecting the page's
-        # execution-flow sink.
-        trace_taint( response, taint: self.class.seed ) do |page|
-            print_info 'Checking results of deferred taint analysis for' <<
-                           ' execution-flow sink data.'
-
-            next if page.dom.execution_flow_sinks.empty?
-
-            log vector: element, proof: element.seed, page: page
+        with_browser_cluster do |cluster|
+            print_info 'Response is tainted, scheduling a taint-trace.'
+
+            # Pass the response to the BrowserCluster for evaluation and see if the
+            # JS payload we injected got executed by inspecting the page's
+            # execution-flow sink.
+            cluster.trace_taint(
+                response,
+                {
+                    taint: self.class.seed,
+                    args:  [element, page]
+                },
+                self.class.check_browser_result_cb
+            )
         end
     end
 
-    def tainted?( response, seed )
-        return if seed.to_s.empty? || !response.body.to_s.include?( seed )
-
-        # Quick check to see if the payload landed in a <script>.
-        in_script = (response.body =~ /<script.*?>.*#{Regexp.escape seed}.*?<\/script>/im)
-
-        # Quick check to see if the payload landed in any attributes.
-        pure_seed     = self.class.seed % browser_cluster.javascript_token
-        in_attributes = ATTRIBUTES.select do |attribute|
-            !!response.body.scan( /#{attribute}=(.*?)>/im ).flatten.find do |match|
-                match.include? pure_seed
-            end
-        end
+    def self.check_browser_result( result, element, referring_page, cluster )
+        page = result.page
 
-        # Nowhere to be seen, bail out early.
-        return if in_attributes.empty? && !in_script
+        print_info 'Checking results of deferred taint analysis for' <<
+                       ' execution-flow sink data.'
 
-        # More comprehensive checks by searching the document.
-        doc = Arachni::Parser.parse( response.body )
+        return if page.dom.execution_flow_sinks.empty?
 
-        return true if in_script && doc.css('script').to_s.include?( seed )
+        log(
+            vector:         element,
+            proof:          element.seed,
+            page:           page,
+            referring_page: referring_page
+        )
+    end
 
-        in_attributes.each do |attribute|
-            doc.xpath( "//*[@#{attribute}]" ).each do |elem|
-                value = elem.attributes[attribute].to_s
+    def self.check_browser_result_cb
+        @check_browser_result_cb ||= method(:check_browser_result)
+    end
 
-                if attribute == 'src'
-                    return value if seed.start_with?( 'javascript:' ) && value == seed
-                else
-                    return value if value == seed
-                end
+    def tainted?( response, seed )
+        return if seed.to_s.empty? || !response.body.to_s.include?( seed )
 
-                return true  if value.include?( seed )
-            end
-        end
+        handler = SAX.new( self.class.seed % browser_cluster.javascript_token )
+        Arachni::Parser.parse( response.body, handler: handler )
 
-        false
+        handler.tainted?
     end
 
     def self.info
@@ -170,9 +223,9 @@ class Arachni::Checks::XssScriptContext < Arachni::Check::Base
 Injects JS taint code and check to see if it gets executed as proof of vulnerability.
 },
             elements:    [ Element::Form, Element::Link, Element::Cookie,
-                           Element::Header, Element::LinkTemplate ],
+                           Element::NestedCookie, Element::Header, Element::LinkTemplate ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.2.3',
+            version:     '0.2.6',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in script context},

data/components/checks/active/xss_tag.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -18,6 +18,31 @@ class Arachni::Checks::XssTag < Arachni::Check::Base
 
     ATTRIBUTE_NAME = 'arachni_xss_in_tag'
 
+    class SAX
+        attr_reader :landed
+
+        def initialize( seed )
+            @seed = seed
+        end
+
+        def document
+        end
+
+        def landed?
+            !!@landed
+        end
+
+        def attr( name, value )
+            name  = name.to_s.downcase
+            value = value.downcase
+
+            return if ATTRIBUTE_NAME != name || value != @seed
+
+            @landed = true
+            fail Arachni::Parser::SAX::Stop
+        end
+    end
+
     def self.strings
         @strings ||= ['', '\'', '"'].
             map { |q| "#{q} #{ATTRIBUTE_NAME}=#{q}#{random_seed}#{q} blah=#{q}" }
@@ -30,21 +55,21 @@ class Arachni::Checks::XssTag < Arachni::Check::Base
     end
 
     def check_and_log( response, element )
-        # if we have no body or it doesn't contain the ATTRIBUTE_NAME under any
-        # context there's no point in parsing the HTML to verify the vulnerability
-        return if !(response.body =~ /#{ATTRIBUTE_NAME}/i)
+        return if !response.html?
 
-        body = response.body.downcase
+        # If we have no body or it doesn't contain the ATTRIBUTE_NAME under any
+        # context there's no point in parsing the HTML to verify the vulnerability.
+        return if !(response.body =~ /#{ATTRIBUTE_NAME}/i)
 
-        # see if we managed to inject a working HTML attribute to any
-        # elements
-        Arachni::Parser.parse( body ).xpath( "//*[@#{ATTRIBUTE_NAME}]" ).each do |node|
-            next if node[ATTRIBUTE_NAME] != random_seed
+        handler = SAX.new( random_seed )
+        Arachni::Parser.parse( response.body, handler: handler )
+        return if !handler.landed?
 
-            proof = (payload = find_included_payload( body )) ? payload : node.to_s
-            log vector: element, proof: proof.to_s, response: response
-            return
-        end
+        log(
+            vector: element,
+            proof: find_included_payload( response.body.downcase ).to_s,
+            response: response
+        )
     end
 
     def find_included_payload( body )
@@ -58,9 +83,10 @@ class Arachni::Checks::XssTag < Arachni::Check::Base
         {
             name:        'XSS in HTML tag',
             description: %q{Cross-Site Scripting in HTML tag.},
-            elements:    [ Element::Form, Element::Link, Element::Cookie, Element::Header ],
+            elements:    [ Element::Form, Element::Link, Element::Cookie,
+                           Element::NestedCookie, Element::Header ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1.10',
+            version:     '0.1.12',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in HTML tag},

data/components/checks/active/xxe.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/passive/allowed_methods.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/passive/backdoors.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/passive/backup_directories.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -28,7 +28,19 @@ class Arachni::Checks::BackupDirectories < Arachni::Check::Base
         name = File.basename( page.parsed_url.path )
 
         self.class.formats.each do |format|
-            log_remote_file_if_exists( path + format.gsub( '[name]', name ) )
+            backup_name = format.gsub( '[name]', name )
+            url = path + backup_name
+
+            remark = 'Identified by converting the original directory name of ' <<
+                "'#{name}' to '#{backup_name}' using format '#{format}'."
+
+            log_remote_file_if_exists(
+                url,
+                false,
+                remarks: {
+                    check: [ remark ]
+                }
+            )
         end
 
         audited( resource )
@@ -40,7 +52,7 @@ class Arachni::Checks::BackupDirectories < Arachni::Check::Base
             description:      %q{Tries to find backed-up directories.},
             elements:         [ Element::Server ],
             author:           'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:          '0.1.2',
+            version:          '0.1.3',
             exempt_platforms: Arachni::Platform::Manager::FRAMEWORKS,
 
             issue:       {