arachni 1.4 → 1.6.0

data/spec/support/servers/checks/active/no_sql_injection.rb

@@ -2,6 +2,7 @@ require 'nokogiri'
 require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 @@errors ||= {}
 if @@errors.empty?
@@ -41,6 +42,7 @@ end
             <a href="/#{platform_str}/link">Link</a>
             <a href="/#{platform_str}/form">Form</a>
             <a href="/#{platform_str}/cookie">Cookie</a>
+            <a href="/#{platform_str}/nested_cookie">Nested cookie</a>
             <a href="/#{platform_str}/header">Header</a>
             <a href="/#{platform_str}/link-template">Link template</a>
             <a href="/#{platform_str}/json">JSON</a>
@@ -124,6 +126,31 @@ end
         get_variations( platform, cookies['cookie2'].split( default ).last )
     end
 
+    get "/#{platform}/nested_cookie" do
+        <<-EOHTML
+            <a href="/#{platform}/nested_cookie/flip">Nested cookie</a>
+            <a href="/#{platform}/nested_cookie/append">Nested cookie</a>
+        EOHTML
+    end
+
+    get "/#{platform}/nested_cookie/flip" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        inputs = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )
+        inputs.keys.map { |k| get_variations( platform, k ) }.to_s
+    end
+
+    get "/#{platform}/nested_cookie/append" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+        return if !value.start_with?( default )
+
+        get_variations( platform, value.split( default ).last )
+    end
+
     get "/#{platform_str}/header" do
         <<-EOHTML
             <a href="/#{platform_str}/header/flip">Header</a>

data/spec/support/servers/checks/active/no_sql_injection_differential.rb

@@ -1,5 +1,6 @@
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 def default
     'default'
@@ -23,6 +24,7 @@ end
             <a href="/#{platform}/link?input=default">Link</a>
             <a href="/#{platform}/form">Form</a>
             <a href="/#{platform}/cookie">Cookie</a>
+            <a href="/#{platform}/nested_cookie">Nested cookie</a>
             <a href="/#{platform}/header">Header</a>
         EOHTML
     end
@@ -60,4 +62,21 @@ end
         cookies['cookie'] ||= default
         get_result( cookies['cookie'] )
     end
+
+    get "/#{platform}/nested_cookie" do
+        <<-EOHTML
+            <a href="/#{platform}/nested_cookie/append">Nested cookie</a>
+        EOHTML
+    end
+
+    get "/#{platform}/nested_cookie/append" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+        return if value.start_with?( default )
+
+        get_result( value )
+    end
+
 end

data/spec/support/servers/checks/active/os_cmd_injection.rb

@@ -60,6 +60,7 @@ STRINGS.keys.each do |platform|
             <a href="/#{platform_str}/link?input=default">Link</a>
             <a href="/#{platform_str}/form">Form</a>
             <a href="/#{platform_str}/cookie">Cookie</a>
+            <a href="/#{platform_str}/nested_cookie">Nested cookie</a>
             <a href="/#{platform_str}/header">Header</a>
             <a href="/#{platform_str}/link-template">Link template</a>
             <a href="/#{platform_str}/json">JSON</a>
@@ -161,6 +162,34 @@ STRINGS.keys.each do |platform|
         get_variations( platform, cookies['cookie2'].split( default ).last )
     end
 
+    get "/#{platform}/nested_cookie" do
+        <<-EOHTML
+            <a href="/#{platform}/nested_cookie/straight">Nested cookie</a>
+            <a href="/#{platform}/nested_cookie/append">Nested cookie</a>
+        EOHTML
+    end
+
+    get "/#{platform}/nested_cookie/straight" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+        return if value.start_with?( default )
+
+        get_variations( platform, value )
+    end
+
+    get "/#{platform}/nested_cookie/append" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+        return if !value.start_with?( default )
+
+        get_variations( platform, value.split( default ).last )
+    end
+
+
     get "/#{platform_str}/header" do
         <<-EOHTML
             <a href="/#{platform_str}/header/straight">Cookie</a>

data/spec/support/servers/checks/active/os_cmd_injection_timing.rb

@@ -10,7 +10,7 @@ REGEXP = {
 }
 
 def exec( platform, str, prefix = nil, postfix = nil )
-    return if !str
+    return if str.to_s.empty?
 
     r = ''
     r << Regexp.escape( prefix ) if prefix
@@ -61,6 +61,7 @@ REGEXP.keys.each do |platform|
             <a href="/#{platform_str}/link?input=default">Link</a>
             <a href="/#{platform_str}/form">Form</a>
             <a href="/#{platform_str}/cookie">Cookie</a>
+            <a href="/#{platform_str}/nested_cookie">Nested cookie</a>
             <a href="/#{platform_str}/header">Header</a>
             <a href="/#{platform_str}/link-template">Link template</a>
             <a href="/#{platform_str}/json">JSON</a>
@@ -124,6 +125,22 @@ REGEXP.keys.each do |platform|
         get_variations( platform, cookies['cookie'] )
     end
 
+    get "/#{platform}/nested_cookie" do
+        <<-EOHTML
+            <a href="/#{platform}/nested_cookie/straight">Nested cookie</a>
+        EOHTML
+    end
+
+    get "/#{platform}/nested_cookie/straight" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+        return if value.start_with?( default )
+
+        get_variations( platform, value )
+    end
+
     get "/#{platform_str}/header" do
         <<-EOHTML
             <a href="/#{platform_str}/header/straight">Cookie</a>

data/spec/support/servers/checks/active/path_traversal.rb

@@ -2,6 +2,7 @@ require 'nokogiri'
 require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 def default
     "default.html"
@@ -92,9 +93,7 @@ MAPIX=1
 }
 
 def get_variations( system, str )
-    return if !str
-
-    require 'ap'
+    return if str.to_s.empty?
 
     str = str.split( "\0" ).first
     str = str.split( 'file:/' ).last
@@ -129,6 +128,7 @@ OUT.keys.each do |system|
             <a href="/#{system_str}/link?input=default">Link</a>
             <a href="/#{system_str}/form">Form</a>
             <a href="/#{system_str}/cookie">Cookie</a>
+            <a href="/#{system_str}/nested_cookie">Nested cookie</a>
             <a href="/#{system_str}/header">Header</a>
             <a href="/#{system_str}/link-template">Link template</a>
             <a href="/#{system_str}/json">JSON</a>
@@ -220,6 +220,33 @@ OUT.keys.each do |system|
         get_variations( system, cookies['cookie1'] )
     end
 
+    get "/#{system}/nested_cookie" do
+        <<-EOHTML
+            <a href="/#{system}/nested_cookie/straight">Nested cookie</a>
+            <a href="/#{system}/nested_cookie/with_null">Nested cookie</a>
+        EOHTML
+    end
+
+    get "/#{system}/nested_cookie/straight" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+        return if value.start_with?( default ) || value.include?( "\0" )
+
+        get_variations( system, value )
+    end
+
+    get "/#{system}/nested_cookie/with_null" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+        return if !value.include?( "\00." )
+
+        get_variations( system, value )
+    end
+
     get "/#{system_str}/header" do
         <<-EOHTML
             <a href="/#{system_str}/header/straight">Header</a>

data/spec/support/servers/checks/active/response_splitting.rb

@@ -2,9 +2,10 @@ require 'nokogiri'
 require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 def get_variations( str )
-    return if !str
+    return if str.to_s.empty?
 
     str = URI.decode( str )
     k, v = str.strip.split( ':' )
@@ -33,6 +34,7 @@ get '/' do
         <a href="/link?input=default">Link</a>
         <a href="/form">Form</a>
         <a href="/cookie">Cookie</a>
+        <a href="/nested_cookie">Nested cookie</a>
         <a href="/header">Header</a>
         <a href="/link-template">Link template</a>
         <a href="/json">JSON</a>
@@ -135,6 +137,33 @@ get '/cookie/append' do
     get_variations( cookies['cookie2'].split( default ).last )
 end
 
+get '/nested_cookie' do
+    <<-EOHTML
+        <a href="/nested_cookie/straight">Nested cookie</a>
+        <a href="/nested_cookie/append">Nested cookie</a>
+    EOHTML
+end
+
+get '/nested_cookie/straight' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if value.start_with?( default )
+
+    get_variations( value )
+end
+
+get '/nested_cookie/append' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if !value.start_with?( default )
+
+    get_variations( value.split( default ).last )
+end
+
 get '/header' do
     <<-EOHTML
         <a href="/header/straight">Header</a>

data/spec/support/servers/checks/active/rfi.rb

@@ -2,11 +2,11 @@ require 'nokogiri'
 require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
-
+require_relative '../check_server'
 require 'open-uri'
 
 def get_variations( str )
-    return if !str
+    return if str.to_s.empty?
 
     str = "http://#{str}" if !str.downcase.start_with?( 'http://' )
     open( str.split( "\0" ).first ) rescue nil
@@ -32,6 +32,7 @@ get '/' do
         <a href="/link?input=default">Link</a>
         <a href="/form">Form</a>
         <a href="/cookie">Cookie</a>
+        <a href="/nested_cookie">Nested cookie</a>
         <a href="/header">Header</a>
         <a href="/json">JSON</a>
         <a href="/xml">XML</a>
@@ -110,6 +111,33 @@ get "/cookie/append" do
     get_variations( cookies['cookie2'].split( default ).last )
 end
 
+get '/nested_cookie' do
+    <<-EOHTML
+        <a href="/nested_cookie/straight">Nested cookie</a>
+        <a href="/nested_cookie/append">Nested cookie</a>
+    EOHTML
+end
+
+get '/nested_cookie/straight' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if value.start_with?( default )
+
+    get_variations( value )
+end
+
+get '/nested_cookie/append' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if !value.start_with?( default )
+
+    get_variations( value.split( default ).last )
+end
+
 get "/header" do
     <<-EOHTML
         <a href="/header/straight">Header</a>

data/spec/support/servers/checks/active/session_fixation.rb

@@ -2,7 +2,7 @@ require 'sinatra'
 require 'sinatra/contrib'
 
 def get_variations( str )
-    return if !str
+    return if str.to_s.empty?
 
     cookies['session'] = str
 end
@@ -28,8 +28,6 @@ get '/' do
         #{greet_user}
         <a href="/link?input=default">Link</a>
         <a href="/form">Form</a>
-        <a href="/cookie">Cookie</a>
-        <a href="/header">Header</a>
         <a href="/link-template">Link template</a>
     EOHTML
 end

data/spec/support/servers/checks/active/source_code_disclosure.rb

@@ -3,6 +3,7 @@ require 'nokogiri'
 require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 def default
     'default.html'
@@ -46,11 +47,13 @@ OUT.keys.each do |language|
 
     get "/#{language}" do
         cookies['cookie'] ||= default
+        cookies['nested_cookie'] ||= "name=#{default}"
 
         <<-EOHTML
             <a href="/#{language}/link">Link</a>
             <a href="/#{language}/form">Form</a>
             <a href="/#{language}/cookie">Cookie</a>
+            <a href="/#{language}/nested_cookie">Nested cookie</a>
             <a href="/#{language}/header">Header</a>
             <a href="/#{language}/link-template">Link template</a>
             <a href="/#{language}/json">JSON</a>
@@ -129,6 +132,19 @@ OUT.keys.each do |language|
         get_variations( language, cookies['cookie'] )
     end
 
+    get "/#{language}/nested_cookie" do
+        <<-EOHTML
+            <a href="/#{language}/nested_cookie/straight.#{ext}">Nested cookie</a>
+        EOHTML
+    end
+
+    get "/#{language}/nested_cookie/straight.#{ext}" do
+        value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+        return if value.start_with?( default )
+
+        get_variations( language, value )
+    end
+
     get "/#{language}/header" do
         <<-EOHTML
             <a href="/#{language}/header/straight.#{ext}">Header</a>

data/spec/support/servers/checks/active/sql_injection/java

@@ -0,0 +1,2 @@
+org.hibernate.QueryException: unexpected char:
+org.hibernate.QueryException: expecting '

data/spec/support/servers/checks/active/sql_injection.rb

@@ -2,6 +2,7 @@ require 'nokogiri'
 require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 @@errors ||= {}
 if @@errors.empty?
@@ -46,6 +47,7 @@ end
             <a href="/#{platform_str}/link">Link</a>
             <a href="/#{platform_str}/form">Form</a>
             <a href="/#{platform_str}/cookie">Cookie</a>
+            <a href="/#{platform_str}/nested_cookie">Nested cookie</a>
             <a href="/#{platform_str}/header">Header</a>
             <a href="/#{platform_str}/link-template">Link template</a>
             <a href="/#{platform_str}/json">JSON</a>
@@ -132,6 +134,31 @@ end
         get_variations( platform, cookies['cookie2'].split( default ).last )
     end
 
+    get "/#{platform}/nested_cookie" do
+        <<-EOHTML
+            <a href="/#{platform}/nested_cookie/flip">Nested cookie</a>
+            <a href="/#{platform}/nested_cookie/append">Nested cookie</a>
+        EOHTML
+    end
+
+    get "/#{platform}/nested_cookie/flip" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        inputs = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )
+        inputs.keys.map { |k| get_variations( platform, k ) }.to_s
+    end
+
+    get "/#{platform}/nested_cookie/append" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+        return if !value.start_with?( default )
+
+        get_variations( platform, value.split( default ).last )
+    end
+
     get "/#{platform_str}/header" do
         <<-EOHTML
             <a href="/#{platform_str}/header/flip">Header</a>

data/spec/support/servers/checks/active/sql_injection_differential.rb

@@ -1,5 +1,6 @@
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 def default
     'default'
@@ -23,6 +24,7 @@ end
             <a href="/#{platform}/link?input=default">Link</a>
             <a href="/#{platform}/form">Form</a>
             <a href="/#{platform}/cookie">Cookie</a>
+            <a href="/#{platform}/nested_cookie">Nested cookie</a>
             <a href="/#{platform}/header">Header</a>
         EOHTML
     end
@@ -60,5 +62,22 @@ end
         cookies['cookie'] ||= default
         get_result( cookies['cookie'] )
     end
+
+    get "/#{platform}/nested_cookie" do
+        <<-EOHTML
+            <a href="/#{platform}/nested_cookie/straight">Nested cookie</a>
+        EOHTML
+    end
+
+    get "/#{platform}/nested_cookie/straight" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+        return if value.start_with?( default )
+
+        get_result( value )
+    end
+
 end
 

data/spec/support/servers/checks/active/sql_injection_timing.rb

@@ -2,6 +2,7 @@ require 'nokogiri'
 require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 REGEXP = {
     mysql: 'sleep\(\s?(\d+)\s?\)',
@@ -10,7 +11,7 @@ REGEXP = {
 }
 
 def get_variations( platform, str )
-    return if !str
+    return if str.to_s.empty?
 
     time = str.scan( Regexp.new( REGEXP[platform] ) ).flatten.first
     return if !time
@@ -40,6 +41,7 @@ REGEXP.keys.each do |platform|
             <a href="/#{platform}/link?input=default">Link</a>
             <a href="/#{platform}/form">Form</a>
             <a href="/#{platform}/cookie">Cookie</a>
+            <a href="/#{platform}/nested_cookie">Nested cookie</a>
             <a href="/#{platform}/header">Header</a>
             <a href="/#{platform}/link-template">Link template</a>
             <a href="/#{platform}/json">JSON</a>
@@ -140,6 +142,22 @@ REGEXP.keys.each do |platform|
         get_variations( platform, cookies['cookie2'] )
     end
 
+    get "/#{platform}/nested_cookie" do
+        <<-EOHTML
+            <a href="/#{platform}/nested_cookie/append">Nested cookie</a>
+        EOHTML
+    end
+
+    get "/#{platform}/nested_cookie/append" do
+        default = 'nested cookie value'
+        cookies['nested_cookie'] ||= "name=#{default}"
+
+        value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+        return if !value.start_with?( default )
+
+        get_variations( platform, value )
+    end
+
     get "/#{platform}/header" do
         <<-EOHTML
             <a href="/#{platform}/header/straight">Cookie</a>