arachni 1.4 → 1.6.0

data/spec/components/checks/active/sql_injection_spec.rb

@@ -5,12 +5,12 @@ describe name_from_filename do
 
     def self.platforms
         [:access, :db2, :emc, :firebird, :frontbase, :hsqldb, :informix, :ingres,
-         :interbase, :maxdb, :mssql, :mysql, :oracle, :pgsql, :sqlite, :sybase]
+         :interbase, :maxdb, :mssql, :mysql, :oracle, :pgsql, :sqlite, :sybase, :java]
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -18,146 +18,172 @@ describe name_from_filename do
             access:     {
                 Element::Form         => 15,
                 Element::Link         => 15,
-                Element::Cookie       => 12,
+                Element::Cookie       => 24,
                 Element::Header       => 6,
                 Element::LinkTemplate => 12,
                 Element::JSON         => 12,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 18
             },
             db2:        {
                 Element::Form         => 15,
                 Element::Link         => 15,
-                Element::Cookie       => 12,
+                Element::Cookie       => 24,
                 Element::Header       => 6,
                 Element::LinkTemplate => 12,
                 Element::JSON         => 12,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 18
             },
             emc:        {
                 Element::Form         => 10,
                 Element::Link         => 10,
-                Element::Cookie       => 8,
+                Element::Cookie       => 16,
                 Element::Header       => 4,
                 Element::LinkTemplate => 8,
                 Element::JSON         => 8,
-                Element::XML          => 8
+                Element::XML          => 8,
+                Element::NestedCookie => 12
             },
             firebird:   {
                 Element::Form         => 5,
                 Element::Link         => 5,
-                Element::Cookie       => 4,
+                Element::Cookie       => 8,
                 Element::Header       => 2,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 4,
-                Element::XML          => 4
+                Element::XML          => 4,
+                Element::NestedCookie => 6
             },
             frontbase:  {
                 Element::Form         => 5,
                 Element::Link         => 5,
-                Element::Cookie       => 4,
+                Element::Cookie       => 8,
                 Element::Header       => 2,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 4,
-                Element::XML          => 4
+                Element::XML          => 4,
+                Element::NestedCookie => 6
             },
             hsqldb:     {
                 Element::Form         => 5,
                 Element::Link         => 5,
-                Element::Cookie       => 4,
+                Element::Cookie       => 8,
                 Element::Header       => 2,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 4,
-                Element::XML          => 4
+                Element::XML          => 4,
+                Element::NestedCookie => 6
             },
             informix:   {
                 Element::Form         => 15,
                 Element::Link         => 15,
-                Element::Cookie       => 12,
+                Element::Cookie       => 24,
                 Element::Header       => 6,
                 Element::LinkTemplate => 12,
                 Element::JSON         => 12,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 18
             },
             ingres:     {
                 Element::Form         => 15,
                 Element::Link         => 15,
-                Element::Cookie       => 12,
+                Element::Cookie       => 24,
                 Element::Header       => 6,
                 Element::LinkTemplate => 12,
                 Element::JSON         => 12,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 18
             },
             interbase:  {
                 Element::Form         => 10,
                 Element::Link         => 10,
-                Element::Cookie       => 8,
+                Element::Cookie       => 16,
                 Element::Header       => 4,
                 Element::LinkTemplate => 8,
                 Element::JSON         => 8,
-                Element::XML          => 8
+                Element::XML          => 8,
+                Element::NestedCookie => 12
             },
             maxdb:      {
                 Element::Form         => 5,
                 Element::Link         => 5,
-                Element::Cookie       => 4,
+                Element::Cookie       => 8,
                 Element::Header       => 2,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 4,
-                Element::XML          => 4
+                Element::XML          => 4,
+                Element::NestedCookie => 6
             },
             mssql:      {
                 Element::Form         => 97,
                 Element::Link         => 97,
-                Element::Cookie       => 78,
+                Element::Cookie       => 156,
                 Element::Header       => 38,
                 Element::LinkTemplate => 76,
                 Element::JSON         => 78,
-                Element::XML          => 76
+                Element::XML          => 76,
+                Element::NestedCookie => 116
             },
             mysql:      {
                 Element::Form         => 65,
                 Element::Link         => 65,
-                Element::Cookie       => 52,
+                Element::Cookie       => 104,
                 Element::Header       => 26,
                 Element::LinkTemplate => 52,
                 Element::JSON         => 52,
-                Element::XML          => 52
+                Element::XML          => 52,
+                Element::NestedCookie => 78
             },
             oracle:     {
                 Element::Form         => 25,
                 Element::Link         => 25,
-                Element::Cookie       => 20,
+                Element::Cookie       => 40,
                 Element::Header       => 10,
                 Element::LinkTemplate => 20,
                 Element::JSON         => 20,
-                Element::XML          => 20
+                Element::XML          => 20,
+                Element::NestedCookie => 30
             },
             pgsql:      {
                 Element::Form         => 45,
                 Element::Link         => 45,
-                Element::Cookie       => 36,
+                Element::Cookie       => 72,
                 Element::Header       => 18,
                 Element::LinkTemplate => 36,
                 Element::JSON         => 36,
-                Element::XML          => 36
+                Element::XML          => 36,
+                Element::NestedCookie => 54
             },
             sqlite:     {
                 Element::Form         => 20,
                 Element::Link         => 20,
-                Element::Cookie       => 16,
+                Element::Cookie       => 32,
                 Element::Header       => 8,
                 Element::LinkTemplate => 16,
                 Element::JSON         => 16,
-                Element::XML          => 16
+                Element::XML          => 16,
+                Element::NestedCookie => 24
             },
             sybase:     {
                 Element::Form         => 15,
                 Element::Link         => 15,
-                Element::Cookie       => 12,
+                Element::Cookie       => 24,
                 Element::Header       => 6,
                 Element::LinkTemplate => 12,
                 Element::JSON         => 12,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 18
+            },
+            java:       {
+                Element::Form         => 10,
+                Element::Link         => 10,
+                Element::Cookie       => 16,
+                Element::Header       => 4,
+                Element::LinkTemplate => 8,
+                Element::JSON         => 8,
+                Element::XML          => 8,
+                Element::NestedCookie => 12
             }
         }
     end

data/spec/components/checks/active/sql_injection_timing_spec.rb

@@ -8,8 +8,8 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -17,29 +17,32 @@ describe name_from_filename do
             mysql: {
                 Element::Form         => 16,
                 Element::Link         => 16,
-                Element::Cookie       => 16,
+                Element::Cookie       => 32,
                 Element::Header       => 16,
                 Element::LinkTemplate => 16,
                 Element::JSON         => 16,
-                Element::XML          => 32
+                Element::XML          => 32,
+                Element::NestedCookie => 16
             },
             pgsql: {
                 Element::Form         => 6,
                 Element::Link         => 6,
-                Element::Cookie       => 6,
+                Element::Cookie       => 12,
                 Element::Header       => 6,
                 Element::LinkTemplate => 6,
                 Element::JSON         => 6,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 6
             },
             mssql: {
                 Element::Form         => 9,
                 Element::Link         => 9,
-                Element::Cookie       => 9,
+                Element::Cookie       => 18,
                 Element::Header       => 9,
                 Element::LinkTemplate => 9,
                 Element::JSON         => 9,
-                Element::XML          => 18
+                Element::XML          => 18,
+                Element::NestedCookie => 9
             }
         }
     end

data/spec/components/checks/active/unvalidated_redirect_spec.rb

@@ -4,18 +4,19 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
         {
-            Element::Form   => 14,
-            Element::Link   => 10,
-            Element::Cookie => 5,
-            Element::Header => 5,
-            Element::JSON   => 3,
-            Element::XML    => 6
+            Element::Form         => 26,
+            Element::Link         => 22,
+            Element::Cookie       => 11,
+            Element::Header       => 11,
+            Element::JSON         => 9,
+            Element::XML          => 18,
+            Element::NestedCookie => 16
         }
     end
 

data/spec/components/checks/active/xpath_injection_spec.rb

@@ -4,19 +4,20 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
         {
             Element::Form         => 150,
             Element::Link         => 150,
-            Element::Cookie       => 150,
+            Element::Cookie       => 300,
             Element::Header       => 75,
             Element::LinkTemplate => 150,
             Element::JSON         => 75,
-            Element::XML          => 150
+            Element::XML          => 150,
+            Element::NestedCookie => 225
         }
     end
 

data/spec/components/checks/active/xss_dom_script_context_spec.rb

@@ -43,7 +43,7 @@ describe name_from_filename do
             data = data_flow_sinks.last
             expect(data.function.source).to start_with 'function pre_eval('
             expect(data.function.name).to eq 'pre_eval'
-            expect(data.object).to eq 'DOMWindow'
+            expect(data.object).to eq 'Window'
             expect(data.taint).to include 'taint_tracer.log_execution_flow_sink()'
             expect(data.tainted_value).to include 'taint_tracer.log_execution_flow_sink()'
             expect(data.function.arguments).to eq [data.tainted_value]
@@ -53,20 +53,16 @@ describe name_from_filename do
             case issue.vector
 
                 when Element::Form::DOM
-                    expect(trace.size).to eq 2
                     expect(trace.first.function.source).to start_with 'function handleSubmit()'
                     expect(trace.first.function.name).to start_with 'handleSubmit'
 
-                when Element::LinkTemplate::DOM
-                    expect(trace.size).to eq 2
-                    expect(trace.first.url).to eq issue.page.dom.url
-
-                when Element::Link::DOM
-                    expect(trace.size).to eq 2
-                    expect(trace.first.url).to eq issue.page.dom.url
+                # when Element::LinkTemplate::DOM
+                #     expect(trace.first.url).to eq issue.page.dom.url
+                #
+                # when Element::Link::DOM
+                #     expect(trace.first.url).to eq issue.page.dom.url
 
                 when Element::Cookie::DOM
-                    expect(trace.size).to eq 2
                     expect(trace.first.url).to eq issue.page.dom.url
 
                 when Element::UIInput::DOM

data/spec/components/checks/active/xss_dom_spec.rb

@@ -41,7 +41,7 @@ describe name_from_filename do
 
                     expect(data_flow_sink.function.source).to start_with 'function decodeURI()'
                     expect(data_flow_sink.function.name).to eq 'decodeURI'
-                    expect(data_flow_sink.object).to eq 'DOMWindow'
+                    expect(data_flow_sink.object).to eq 'Window'
                     expect(data_flow_sink.tainted_value).to include Arachni::URI(issue.vector.seed).to_s
                     expect(data_flow_sink.function.arguments).to eq [data_flow_sink.tainted_value]
 
@@ -54,7 +54,7 @@ describe name_from_filename do
 
                     expect(data_flow_sink.function.source).to start_with 'function decodeURIComponent()'
                     expect(data_flow_sink.function.name).to eq 'decodeURIComponent'
-                    expect(data_flow_sink.object).to eq 'DOMWindow'
+                    expect(data_flow_sink.object).to eq 'Window'
                     expect(data_flow_sink.tainted_value).to include Arachni::URI(issue.vector.seed).to_s
                     expect(data_flow_sink.function.arguments).to eq [data_flow_sink.tainted_value]
 

data/spec/components/checks/active/xss_event_spec.rb

@@ -4,11 +4,19 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header ]
     end
 
-    def issue_count
-        114
+    def issue_count_per_element
+        {
+            Element::Form         => 210,
+            Element::Link         => 114,
+            Element::Cookie       => 228,
+            Element::Header       => 114,
+            Element::LinkTemplate => 114,
+            Element::NestedCookie => 228
+        }
     end
 
     easy_test

data/spec/components/checks/active/xss_script_context_spec.rb

@@ -4,17 +4,18 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate ]
     end
 
     def issue_count_per_element
         {
-            Element::Form         => 16,
-            Element::Link         => 16,
-            Element::Cookie       => 16,
-            Element::Header       => 12,
-            Element::LinkTemplate => 9
+            Element::Form         => 64,
+            Element::Link         => 32,
+            Element::Cookie       => 32,
+            Element::Header       => 24,
+            Element::LinkTemplate => 18,
+            Element::NestedCookie => 32
         }
     end
 

data/spec/components/checks/active/xss_spec.rb

@@ -4,17 +4,18 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate ]
     end
 
     def issue_count_per_element
         {
-            Element::Form         => 9,
-            Element::Link         => 10,
-            Element::Cookie       => 7,
+            Element::Form         => 12,
+            Element::Link         => 13,
+            Element::Cookie       => 14,
             Element::Header       => 6,
-            Element::LinkTemplate => 9
+            Element::LinkTemplate => 12,
+            Element::NestedCookie => 7
         }
     end
 

data/spec/components/checks/active/xss_tag_spec.rb

@@ -4,11 +4,19 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header ]
     end
 
-    def issue_count
-        5
+    def issue_count_per_element
+        {
+            Element::Form         => 5,
+            Element::Link         => 5,
+            Element::Cookie       => 10,
+            Element::Header       => 5,
+            Element::LinkTemplate => 5,
+            Element::NestedCookie => 10
+        }
     end
 
     easy_test

data/spec/components/checks/passive/backup_directories_spec.rb

@@ -11,5 +11,7 @@ describe name_from_filename do
         current_check.formats.size
     end
 
-    easy_test
+    easy_test do
+        expect(issues.find { |issue| issue.remarks.empty? }).to be_nil
+    end
 end

data/spec/components/checks/passive/backup_files_spec.rb

@@ -11,5 +11,8 @@ describe name_from_filename do
         current_check.formats.size
     end
 
-    easy_test
+    easy_test do
+        expect(issues.find { |issue| issue.remarks.empty? }).to be_nil
+        expect(issues.find { |issue| current_check::IGNORE_EXTENSIONS.include?( issue.response.parsed_url.resource_extension) }).to be_nil
+    end
 end

data/spec/components/checks/passive/grep/insecure_cookies_spec.rb

@@ -8,8 +8,8 @@ describe name_from_filename do
     end
 
     def issue_count
-        2
+        3
     end
 
-    easy_test { expect(issues.map { |i| i.vector.name }.sort).to eq %w(cookie cookie2).sort }
+    easy_test { expect(issues.map { |i| i.vector.name }.sort).to eq %w(cookie cookie2 jscookie).sort }
 end

data/spec/components/checks/passive/grep/x_frame_options_spec.rb

@@ -22,4 +22,10 @@ describe name_from_filename do
         run
         expect(issues).to be_empty
     end
+
+    it 'does not log hosts non-200 pages' do
+        options.url = "#{url}/non-200"
+        run
+        expect(issues).to be_empty
+    end
 end

data/spec/components/path_extractors/comments_spec.rb

@@ -18,7 +18,9 @@ describe name_from_filename do
 /other/stuff/here.php
 -->
             <!-- <style type="text/css"> stuff: here; </style> -->
-            Blah blah...
+
+            <div>Blah blah...</div>
+
             <!--Pre blah /stuff/here post blah -->
         HTML
     end

data/spec/components/path_extractors/data_url_spec.rb

@@ -7,12 +7,16 @@ describe name_from_filename do
         [
             'http://test.com',
             'test',
-            'test.com'
+            'test.com',
+            'test.gr'
         ]
     end
 
     def text
-        results.map { |u| "<a data-url='#{u}'>Stuff</a>" }.join
+        <<EOHTML
+        <a class="test" data-url= 'http://test.com'>1</a> <span data-url= 'test.com'>2</span>
+        <div data-url = 'test' id=blah>2</div> <p data-url=test.gr >3</p>
+EOHTML
     end
 
     easy_test

data/spec/components/path_extractors/links_spec.rb

@@ -12,7 +12,7 @@ describe name_from_filename do
     end
 
     def text
-        results.map { |u| "<link href='#{u}'>Stuff</form>" }.join
+        results.map { |u| "<link href='#{u}'>Stuff</link>" }.join
     end
 
     easy_test

data/spec/components/plugins/autologin_spec.rb

@@ -16,7 +16,7 @@ describe name_from_filename do
         it 'locates the form and login successfully' do
             options.plugins[component_name] = {
                 'url'        => url + '/login',
-                'parameters' => 'username=john&password=doe',
+                'parameters' => 'username=john&password=doe&submit_me=submitted',
                 'check'      => 'Hi there logged-in user'
             }
 
@@ -32,7 +32,7 @@ describe name_from_filename do
         it 'provides a login sequence and login check to the framework' do
             options.plugins[component_name] = {
                 'url'        => url + '/login',
-                'parameters' => 'username=john&password=doe',
+                'parameters' => 'username=john&password=doe&submit_me=submitted',
                 'check'      => 'Hi there logged-in user'
             }
 

data/spec/components/plugins/webhook_notify_spec.rb

@@ -0,0 +1,69 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before( :all ) do
+        options.url = url
+    end
+
+    context 'when the content-type is JSON' do
+        it 'sends a POST request at the end of the scan' do
+            options.plugins['webhook_notify'] = {
+                'url'          => "#{options.url}/hook",
+                'content_type' => 'json',
+                'payload'      => {
+                    'SEED'          => '$SEED$',
+                    'URL'           => '$URL$',
+                    'MAX_SEVERITY'  => '$MAX_SEVERITY$',
+                    'ISSUE_COUNT'   => '$ISSUE_COUNT$',
+                    'DURATION'      => '$DURATION$'
+                }.to_json
+            }
+
+            run
+
+            expect(actual_results['success']).to eq true
+            expect(actual_results['status']).to eq 'ok'
+            expect(actual_results['message']).to eq 'No error'
+            expect(actual_results['response']).to eq(
+                "HTTP/1.1 200 OK\r\n" <<
+                "Content-Type: text/html;charset=utf-8\r\n" <<
+                "X-XSS-Protection: 1; mode=block\r\n" <<
+                "X-Content-Type-Options: nosniff\r\n" <<
+                "X-Frame-Options: SAMEORIGIN\r\n" <<
+                "Content-Length: 174\r\n\r\n" <<
+                "[\"application/json\",\"{\\\"SEED\\\":\\\"#{Arachni::Utilities.random_seed}\\\",\\\"URL\\\":\\\"#{options.url}\\\",\\\"MAX_SEVERITY\\\":\\\"\\\",\\\"ISSUE_COUNT\\\":\\\"0\\\",\\\"DURATION\\\":\\\"#{framework.report.delta_time}\\\"}\"]"
+            )
+        end
+    end
+
+    context 'when the content-type is XML' do
+        it 'sends a POST request at the end of the scan' do
+            options.plugins['webhook_notify'] = {
+                'url'          => "#{options.url}/hook",
+                'content_type' => 'xml',
+                'payload'      => '<SEED>$SEED$</SEED>' <<
+                    '<URL>$URL$</URL>' <<
+                    '<MAX_SEVERITY>$MAX_SEVERITY$</MAX_SEVERITY>' <<
+                    '<ISSUE_COUNT>$ISSUE_COUNT$</ISSUE_COUNT>' <<
+                    '<DURATION>$DURATION$</DURATION>'
+            }
+
+            run
+
+            expect(actual_results['success']).to eq true
+            expect(actual_results['status']).to eq 'ok'
+            expect(actual_results['message']).to eq 'No error'
+            expect(actual_results['response']).to eq(
+                "HTTP/1.1 200 OK\r\n" <<
+                "Content-Type: text/html;charset=utf-8\r\n" <<
+                "X-XSS-Protection: 1; mode=block\r\n" <<
+                "X-Content-Type-Options: nosniff\r\n" <<
+                "X-Frame-Options: SAMEORIGIN\r\n" <<
+                "Content-Length: 185\r\n\r\n" <<
+                "[\"application/xml\",\"<SEED>#{Arachni::Utilities.random_seed}</SEED><URL>#{options.url}</URL><MAX_SEVERITY></MAX_SEVERITY><ISSUE_COUNT>0</ISSUE_COUNT><DURATION>#{framework.report.delta_time}</DURATION>\"]"
+            )
+        end
+    end
+end