arachni 1.4 → 1.6.0

data/spec/support/servers/checks/active/unvalidated_redirect.rb

@@ -3,9 +3,11 @@ require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
 require 'open-uri'
+require_relative '../check_server'
 
 def get_variations( str )
-    return if !str
+    return if str.to_s.empty?
+
     str = str.split( "\0" ).first
     return if !str
 
@@ -37,6 +39,7 @@ get '/' do
         <a href="/link?input=default">Link</a>
         <a href="/form">Form</a>
         <a href="/cookie">Cookie</a>
+        <a href="/nested_cookie">Nested cookie</a>
         <a href="/header">Header</a>
         <a href="/json">JSON</a>
         <a href="/xml">XML</a>
@@ -47,6 +50,7 @@ get "/link" do
     <<-EOHTML
         <a href="/link/straight?input=default">Link</a>
         <a href="/link/append?input=default">Link</a>
+        <a href="/link/prepend?input=default">Link</a>
         <a href="/link/js?input=default">Link</a>
     EOHTML
 end
@@ -65,6 +69,14 @@ get '/link/append' do
     get_variations( params['input'].split( default ).last )
 end
 
+get '/link/prepend' do
+    default = 'default'
+    return if !params['input'].end_with?( default )
+
+    get_variations( params['input'].split( default ).last )
+end
+
+
 get '/link/js' do
     get_js_variations( params['input'] )
 end
@@ -79,6 +91,10 @@ get '/form' do
             <input name='input' value='default' />
         </form>
 
+        <form action="/form/prepend">
+            <input name='input' value='default' />
+        </form>
+
         <form action="/form/js">
             <input name='input' value='default' />
         </form>
@@ -99,6 +115,13 @@ get '/form/append' do
     get_variations( params['input'].split( default ).last )
 end
 
+get '/form/prepend' do
+    default = 'default'
+    return if !params['input'] || !params['input'].end_with?( default )
+
+    get_variations( params['input'].split( default ).last )
+end
+
 get '/form/js' do
     get_js_variations( params['input'] )
 end
@@ -107,6 +130,7 @@ get '/cookie' do
     <<-EOHTML
         <a href="/cookie/straight">Cookie</a>
         <a href="/cookie/append">Cookie</a>
+        <a href="/cookie/prepend">Cookie</a>
         <a href="/cookie/js">Cookie</a>
     EOHTML
 end
@@ -128,14 +152,59 @@ get '/cookie/append' do
     get_variations( cookies['cookie2'].split( default ).last )
 end
 
+get '/cookie/prepend' do
+    default = 'cookie value'
+    cookies['cookie2'] ||= default
+    return if !cookies['cookie2'].end_with?( default )
+
+    get_variations( cookies['cookie2'].split( default ).last )
+end
+
 get '/cookie/js' do
     get_js_variations( cookies['cookie2'] )
 end
 
+get '/nested_cookie' do
+    <<-EOHTML
+        <a href="/nested_cookie/straight">Nested cookie</a>
+        <a href="/nested_cookie/append">Nested cookie</a>
+        <a href="/nested_cookie/js">Nested cookie</a>
+    EOHTML
+end
+
+get '/nested_cookie/straight' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if value.start_with?( default )
+
+    get_variations( value )
+end
+
+get '/nested_cookie/prepend' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if !value.end_with?( default )
+
+    get_variations( value.split( default ).last )
+end
+
+get '/nested_cookie/js' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    get_js_variations( value )
+end
+
 get '/header' do
     <<-EOHTML
         <a href="/header/straight">Header</a>
         <a href="/header/append">Header</a>
+        <a href="/header/prepend">Header</a>
         <a href="/header/js">Header</a>
     EOHTML
 end
@@ -154,6 +223,13 @@ get '/header/append' do
     get_variations( env['HTTP_USER_AGENT'].split( default ).last )
 end
 
+get '/header/prepend' do
+    default = 'arachni_user'
+    return if !env['HTTP_USER_AGENT'] || !env['HTTP_USER_AGENT'].end_with?( default )
+
+    get_variations( env['HTTP_USER_AGENT'].split( default ).last )
+end
+
 get '/header/js' do
     get_js_variations( env['HTTP_USER_AGENT'] )
 end
@@ -168,6 +244,10 @@ get "/json" do
             http_request = new XMLHttpRequest();
             http_request.open( "POST", "/json/append", true);
             http_request.send( '{"input": "arachni_user"}' );
+
+            http_request = new XMLHttpRequest();
+            http_request.open( "POST", "/json/prepend", true);
+            http_request.send( '{"input": "arachni_user"}' );
         </script>
     EOHTML
 end
@@ -190,6 +270,16 @@ post "/json/append" do
     get_variations( @json['input'].split( default ).last )
 end
 
+post "/json/prepend" do
+    return if !@json
+
+    default = 'arachni_user'
+    return if !@json['input'].end_with?( default )
+
+    get_variations( @json['input'].split( default ).last )
+end
+
+
 get "/xml" do
     <<-EOHTML
             <script type="application/javascript">
@@ -201,6 +291,10 @@ get "/xml" do
                 http_request.open( "POST", "/xml/text/append", true);
                 http_request.send( '<input>arachni_user</input>' );
 
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/text/prepend", true);
+                http_request.send( '<input>arachni_user</input>' );
+
                 http_request = new XMLHttpRequest();
                 http_request.open( "POST", "/xml/attribute/straight", true);
                 http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
@@ -208,6 +302,10 @@ get "/xml" do
                 http_request = new XMLHttpRequest();
                 http_request.open( "POST", "/xml/attribute/append", true);
                 http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/attribute/prepend", true);
+                http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
             </script>
     EOHTML
 end
@@ -234,6 +332,17 @@ post "/xml/text/append" do
     get_variations( input.split( default ).last )
 end
 
+post "/xml/text/prepend" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first.content
+
+    return if !input.end_with?( default )
+
+    get_variations( input.split( default ).last )
+end
+
 post "/xml/attribute/straight" do
     return if !@xml
 
@@ -255,3 +364,14 @@ post "/xml/attribute/append" do
 
     get_variations( input.split( default ).last )
 end
+
+post "/xml/attribute/prepend" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first['my-attribute']
+
+    return if !input.end_with?( default )
+
+    get_variations( input.split( default ).last )
+end

data/spec/support/servers/checks/active/xpath_injection.rb

@@ -2,6 +2,7 @@ require 'nokogiri'
 require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 @@errors ||= {}
 if @@errors.empty?
@@ -38,6 +39,7 @@ get '/'do
         <a href="/link">Link</a>
         <a href="/form">Form</a>
         <a href="/cookie">Cookie</a>
+        <a href="/nested_cookie">Nested cookie</a>
         <a href="/header">Header</a>
         <a href="/link-template">Link template</a>
         <a href="/json">JSON</a>
@@ -119,6 +121,31 @@ get '/cookie/append' do
     get_variations( cookies['cookie2'].split( default ).last )
 end
 
+get '/nested_cookie' do
+    <<-EOHTML
+        <a href="/nested_cookie/flip">Nested cookie</a>
+        <a href="/nested_cookie/append">Nested cookie</a>
+    EOHTML
+end
+
+get '/nested_cookie/flip' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    inputs = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )
+    inputs.keys.map { |k| get_variations( k ) }.to_s
+end
+
+get '/nested_cookie/append' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if !value.start_with?( default )
+
+    get_variations( value.split( default ).last )
+end
+
 get '/header' do
     <<-EOHTML
         <a href="/header/flip">Header</a>

data/spec/support/servers/checks/active/xss.rb

@@ -1,5 +1,6 @@
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 def get_variations( str )
     str.to_s.upcase
@@ -24,6 +25,7 @@ get '/' do
         <a href="/link-template">Link template</a>
         <a href="/form">Form</a>
         <a href="/cookie">Cookie</a>
+        <a href="/nested_cookie">Nested cookie</a>
         <a href="/header">Header</a>
 
         <a href="/gotchas">Gotchas</a>
@@ -239,6 +241,44 @@ get '/cookie/append' do
     get_variations( cookies['cookie2'].split( default ).last )
 end
 
+get '/nested_cookie' do
+    <<-EOHTML
+        <a href="/nested_cookie/in_comment">Cookie</a>
+        <a href="/nested_cookie/double_encoded">Cookie</a>
+        <a href="/nested_cookie/append">Cookie</a>
+    EOHTML
+end
+
+get '/nested_cookie/in_comment' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name']
+
+    <<-EOHTML
+        <!-- #{value} -->
+    EOHTML
+end
+
+get '/nested_cookie/append' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if !value.start_with?( default )
+
+    get_variations( value )
+end
+
+get '/nested_cookie/double_encoded' do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+
+    get_variations( ::URI.decode( value ) )
+end
+
 get '/header' do
     <<-EOHTML
         <a href="/header/straight">Header</a>

data/spec/support/servers/checks/active/xss_event.rb

@@ -1,14 +1,15 @@
 require 'sinatra'
 require 'sinatra/contrib'
 require_relative '../check_server'
+require_relative '../check_server'
 
 def attributes
-    current_check::EVENT_ATTRS
+    current_check::ATTRIBUTES
 end
 
 def get_variations( str )
     attribute = env['PATH_INFO'].split( '/' ).last
-    [ '', '"', "'" ].map { |q| "<a href='/' #{attribute}=#{q}#{str.to_s.upcase}#{q}>#{attribute}</a>" }.join
+    [ '', '"', "'" ].map { |q| "<a href='#' #{attribute}=#{q}#{str.to_s.upcase}#{q}>#{attribute}</a>" }.join
 end
 
 get '/' do
@@ -16,6 +17,7 @@ get '/' do
         <a href="/link/?input=default">Link</a>
         <a href="/form/">Form</a>
         <a href="/cookie/">Cookie</a>
+        <a href="/nested_cookie/">Nested cookie</a>
         <a href="/header/">Header</a>
     EOHTML
 end
@@ -65,6 +67,24 @@ attributes.each do |attribute|
     end
 end
 
+get "/nested_cookie/" do
+    attributes.map do |attribute|
+        default = 'nested cookie value'
+        cookies["nested_cookie_#{attribute}"] ||= "#{attribute}_name=#{default}"
+
+        <<-EOHTML
+            <a href="#{attribute}">#{attribute}</a>
+        EOHTML
+    end.join
+end
+
+attributes.each do |attribute|
+    get "/nested_cookie/#{attribute}" do
+        value = Arachni::NestedCookie.parse_inputs( cookies["nested_cookie_#{attribute}"] )["#{attribute}_name"]
+        get_variations( value )
+    end
+end
+
 get "/header/" do
     attributes.map do |attribute|
         <<-EOHTML
@@ -78,3 +98,4 @@ attributes.each do |attribute|
         get_variations( env['HTTP_USER_AGENT'] )
     end
 end
+

data/spec/support/servers/checks/active/xss_script_context.rb

@@ -1,5 +1,6 @@
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 def get_variations( str )
     <<-EOHTML
@@ -14,6 +15,7 @@ get '/' do
         <a href="/link?input=default">Link</a>
         <a href="/form">Form</a>
         <a href="/cookie">Cookie</a>
+        <a href="/nested_cookie">Nested cookie</a>
         <a href="/header">Header</a>
         <a href="/link-template">Link template</a>
     EOHTML
@@ -63,6 +65,22 @@ get "/cookie/straight" do
     get_variations( cookies['cookie2'] )
 end
 
+get "/nested_cookie" do
+    <<-EOHTML
+        <a href="/nested_cookie/straight">Cookie</a>
+    EOHTML
+end
+
+get "/nested_cookie/straight" do
+    default = 'nested cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if value.start_with?( default )
+
+    get_variations value
+end
+
 get "/header" do
     <<-EOHTML
         <a href="/header/straight">Header</a>

data/spec/support/servers/checks/active/xss_tag.rb

@@ -1,11 +1,13 @@
 require 'sinatra'
 require 'sinatra/contrib'
+require_relative '../check_server'
 
 get '/' do
     <<-EOHTML
         <a href="/link?input=default">Link</a>
         <a href="/form">Form</a>
         <a href="/cookie">Cookie</a>
+        <a href="/nested_cookie">Nested cookie</a>
         <a href="/header">Header</a>
     EOHTML
 end
@@ -109,6 +111,44 @@ get "/cookie/double" do
     "<a href='/' class=\"#{cookies['cookie2']}more-stuff\">Vuln</a>"
 end
 
+get "/nested_cookie" do
+    <<-EOHTML
+        <a href="/nested_cookie/no">Nested cookie</a>
+        <a href="/nested_cookie/single">Nested cookie</a>
+        <a href="/nested_cookie/double">Nested cookie</a>
+    EOHTML
+end
+
+get "/nested_cookie/no" do
+    default = 'nested_cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if !value.start_with?( default )
+
+    "<a href='/' class=#{value}more-stuff>Vuln</a>"
+end
+
+get "/nested_cookie/single" do
+    default = 'nested_cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if !value.start_with?( default )
+
+    "<a href='/' class='#{value}more-stuff'>Vuln</a>"
+end
+
+get "/nested_cookie/double" do
+    default = 'nested_cookie value'
+    cookies['nested_cookie'] ||= "name=#{default}"
+
+    value = Arachni::NestedCookie.parse_inputs( cookies['nested_cookie'] )['name'].to_s
+    return if !value.start_with?( default )
+
+    "<a href='/' class=\"#{value}more-stuff\">Vuln</a>"
+end
+
 get "/header" do
     <<-EOHTML
         <a href="/header/no">Header</a>

data/spec/support/servers/checks/passive/backup_files.rb

@@ -2,16 +2,35 @@ require 'sinatra'
 require_relative '../check_server'
 
 get '/' do
-    <<-HTML
+    s = <<-HTML
         <a href="/some_filename.php">Hit me</a>
     HTML
+
+    current_check::IGNORE_EXTENSIONS.each do |extension|
+        s << <<-HTML
+            <a href="/some_media.#{extension}">Hit media</a>
+        HTML
+    end
+
+    s
 end
 
 get( '/some_filename.php' ){}
 
+current_check::IGNORE_EXTENSIONS.each do |extension|
+    get( '/some_media.' + extension ){}
+end
+
 current_check.formats.each do |format|
     path = format.gsub( '[name]', 'some_filename' ).gsub( '[extension]', 'php' )
     get '/' + path do
         path
     end
+
+    current_check::IGNORE_EXTENSIONS.each do |extension|
+        path = format.gsub( '[name]', 'some_media' ).gsub( '[extension]', extension )
+        get '/' + path do
+            path
+        end
+    end
 end

data/spec/support/servers/checks/passive/grep/cookie_set_for_parent_domain.rb

@@ -8,14 +8,12 @@ get '/' do
     })
     response.set_cookie( 'cookie2', {
         value:  'value2',
-        domain: '.localhost'
+        domain: 'localhost'
     })
     response.set_cookie( 'cookie3', {
-        value:  'value3',
-        domain: 'localhost'
+        value:  'value3'
     })
     response.set_cookie( 'cookie4', {
-        value:  'value4',
-        domain: 'localhost'
+        value:  'value4'
     })
 end

data/spec/support/servers/checks/passive/grep/insecure_cookies_https.rb

@@ -30,6 +30,15 @@ class InsecureCookiesSServer < Sinatra::Base
             value:  "value4",
             secure: true
         })
+
+        <<EOHTML
+<html>
+<script>
+    document.cookie = "jscookie=blah";
+    document.cookie = "jscookie2=blah;secure";
+</script>
+</html>
+EOHTML
     end
 
 end

data/spec/support/servers/checks/passive/grep/x_frame_options.rb

@@ -7,3 +7,8 @@ end
 get '/safe' do
     headers 'X-Frame-Options' => 'DENY'
 end
+
+get '/non-200' do
+    headers 'X-Frame-Options' => ''
+    [404, 'Not found']
+end

data/spec/support/servers/plugins/autologin.rb

@@ -33,6 +33,20 @@ get '/login' do
             <input name='username' value='' />
             <input name='password' type='password' value='' />
             <input name='token' type='hidden' value='secret!' />
+            <input name='submit_me' type='hidden' value='submitted' />
+        </form>
+    HTML
+end
+
+get '/login/submit_input' do
+    cookies[:preserve] = 'this'
+
+    <<-HTML
+        <form method='post' name='login_form' action="/login">
+            <input name='username' value='' />
+            <input name='password' type='password' value='' />
+            <input name='token' type='hidden' value='secret!' />
+            <input name='submit_me' type='submit' value='submitted' />
         </form>
     HTML
 end
@@ -48,7 +62,9 @@ end
 
 post '/login' do
     if params['username'] == 'john' && params['password'] == 'doe' &&
-        params['token'] == 'secret!' && cookies[:preserve] == 'this'
+        params['token'] == 'secret!' && cookies[:preserve] == 'this' &&
+        params['submit_me'] == 'submitted'
+
         cookies[:success] = true
         redirect '/redirect/1'
     else

data/spec/support/servers/plugins/webhook_notify.rb

@@ -0,0 +1,9 @@
+require 'sinatra'
+require 'json'
+
+post '/hook' do
+    [
+        request.env['CONTENT_TYPE'],
+        request.body.read
+    ].to_json
+end

data/spec/support/shared/check.rb

@@ -52,6 +52,7 @@ shared_examples_for 'check' do
     after( :each ) do
         @issues.clear
         process_kill_reactor
+        framework.clean_up
         framework.reset
     end