arachni 1.5.1 → 1.6.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: f1728e58117259b5f10e529734b0643b91e04635
-  data.tar.gz: 656bbd3c108692ca6764795a47ade985735b0b9a
+SHA256:
+  metadata.gz: 98a242080468df426489cea1c37dbc3420ee9b329f04b27fa03163cb8df49de3
+  data.tar.gz: 4afd4d3d17fcbd14fd57f5faec17f2fce8af7f87359de9a969be3b789d983568
 SHA512:
-  metadata.gz: a072ffdf8586c6206de12bf6717343d0cf96c1bf3450f35756408f48758cdbaa6c8cffe18ce6d950e8017bcb48eb008d9dccf94a1c756d38a6b5172151024c35
-  data.tar.gz: e073d1da05c8a8e4697803946ef42f7bfd22ca32878f471f3920bc6d7dcf17fd85aa3d4c1d3ef9d23bc3f064e06a5cb5591875b58f0571ff4b2585ba2273b279
+  metadata.gz: 444dc3e67802214b06dd71f6af65b1dc4a7a119e33b9295af381c54dc3723e6a0f6e3dc255452925c59151daf1fed90eafaac60818de26d8e8e43ed6ce9be5c9
+  data.tar.gz: 69fc119cc27759c4a604293428e954f9d7a85c67503ff0705202ffb12856a6d7dfedec71ae2a2046fe42f206aa13b4b1f737562db776d2f74a7ca3cc5163383a

data/CHANGELOG.md

@@ -1,5 +1,61 @@
 # ChangeLog
 
+## 1.6.1.1 (May 3, 2022)
+
+ - Plugins
+   - `exec` -- Fixed error on empty option.
+ - Reporters
+   - `stdout` -- Inform of Arachni's obsolescence and its successor [Ecsypno SCNR](https://www.ecsypno.com/).
+   - `html` -- Inform of Arachni's obsolescence and its successor [Ecsypno SCNR](https://www.ecsypno.com/).
+
+## 1.6.1 _(March 20, 2022)_
+
+ - `Browser#eelenium` -- Disable sandbox.
+
+## 1.6.0 _(March 4, 2022)_
+
+- Options
+    - Scope
+        - `--scope-dom-depth-limit` -- Changed default from `5` to `4`.
+        - `--scope-auto-redundant` -- Changed default from `inf` to `15`.
+        - `--scope-directory-depth-limit` -- Changed default from `inf` to `10`.
+    - Browser cluster
+        - `--browser-cluster-pool-size` -- Changed default from `5` to `4`.
+    - HTTP
+       - `--http-max-concurrency` -- Changed default from `20` to `10`.
+    - New
+        - `--scope-dom-event-inheritance-limit` -- Limits the amount of inherited events.
+        - `--browser-cluster-session-storage` -- Sets the browsers' session storage.
+        - `--browser-cluster-wait-for-timers` -- Wait for the maximum `setTimeout()`
+           -- Used to be hardcoded to `true`, now defaults to `false`.
+- `URI`
+    - `#encode` -- Fixed encoding order of `+`.
+    - `#decode` -- Fixed decoding order of `+`.
+- `Element`
+    - Added `NestedCookie`: Handles key-value pairs inside individual cookies.
+- `Browser` -- Replaced PhantomJS with headless Chrome.
+    - `Javascript`
+        - `DOMMonitor`
+            - `#elements_with_events` -- Optionally limits event inheritance.
+- `Rest::Server`
+    - Added `/scans/:id/report.afr`.
+    - Added error handling for when trying to connect to killed instances.
+- `Support`
+    - `Database` -- Updated to compress disk data.
+- `Parser` -- Recode node data to UTF-8.
+- `Process`
+    - `Manager`
+        - `#spawn` -- Pass Arachni options via `ENV` rather than `ARGV`.
+- Checks
+    - Active
+        - `xss` -- Fixed proof data to return HTML.
+        - `csrf` -- Disabled for pages with DOM transitions due to FPs.
+    - Passive
+        - `x_frame_options` -- Ignore non-200 pages.
+        - `common_directories` -- Look for `.git`.
+- Plugins
+    - `proxy` -- Fixed error on login sequence recording.
+
 ## 1.5.1 _(March 29, 2017)_
 
 - `config/write_paths.yml` -- Added configurable temporary directory.

data/Gemfile

@@ -1,6 +1,6 @@
 source 'https://rubygems.org'
 
-gem 'rake', '11.3.0'
+gem 'rake', '>= 12.3.3'
 gem 'pry'
 
 group :docs do
@@ -9,9 +9,7 @@ group :docs do
 end
 
 group :spec do
-    gem 'simplecov', require: false, group: :test
-
-    gem 'rspec', '2.99.0'
+    gem 'rspec'
     gem 'faker'
 end
 

data/LICENSE.md

@@ -1,6 +1,6 @@
 # License
 
-Copyright 2010-2017 [Sarosys LLC](http://www.sarosys.com).
+Copyright 2010-2022 [Ecsypno](http://www.ecsypno.com).
 
 ```
                     Arachni Public Source License

data/README.md

@@ -1,9 +1,14 @@
+# Notice
+
+Arachni is heading towards obsolescence, try out its next-gen successor 
+[Ecsypno](https://www.ecsypno.com/) [SCNR](https://ecsypno.com/scnr-documentation/)!
+
 # Arachni - Web Application Security Scanner Framework
 
 <table>
     <tr>
         <th>Version</th>
-        <td>1.5.1</td>
+        <td>1.6.1.1</td>
     </tr>
     <tr>
         <th>Homepage</th>
@@ -38,7 +43,7 @@
     </tr>
     <tr>
         <th>Copyright</th>
-        <td>2010-2017 <a href="http://www.sarosys.com">Sarosys LLC</a></td>
+        <td>2010-2022 <a href="http://www.ecsypno.com">Ecsypno</a></td>
     </tr>
     <tr>
         <th>License</th>
@@ -112,27 +117,27 @@ you with its findings.
 
 ### General
 
- - Cookie-jar/cookie-string support.
- - Custom header support.
- - SSL support with fine-grained options.
- - User Agent spoofing.
- - Proxy support for SOCKS4, SOCKS4A, SOCKS5, HTTP/1.1 and HTTP/1.0.
- - Proxy authentication.
- - Site authentication (SSL-based, form-based, Cookie-Jar, Basic-Digest, NTLMv1, Kerberos and others).
- - Automatic log-out detection and re-login during the scan (when the initial
-    login was performed via the `autologin`, `login_script` or `proxy` plugins).
- - Custom 404 page detection.
- - UI abstraction:
+- Cookie-jar/cookie-string support.
+- Custom header support.
+- SSL support with fine-grained options.
+- User Agent spoofing.
+- Proxy support for SOCKS4, SOCKS4A, SOCKS5, HTTP/1.1 and HTTP/1.0.
+- Proxy authentication.
+- Site authentication (SSL-based, form-based, Cookie-Jar, Basic-Digest, NTLMv1, Kerberos and others).
+- Automatic log-out detection and re-login during the scan (when the initial
+  login was performed via the `autologin`, `login_script` or `proxy` plugins).
+- Custom 404 page detection.
+- UI abstraction:
     - [Command-line Interface](https://github.com/Arachni/arachni/wiki/Executables).
     - [Web User Interface](https://github.com/Arachni/arachni-ui-web).
- - Pause/resume functionality.
- - Hibernation support -- Suspend to and restore from disk.
- - High performance asynchronous HTTP requests.
+- Pause/resume functionality.
+- Hibernation support -- Suspend to and restore from disk.
+- High performance asynchronous HTTP requests.
     - With adjustable concurrency.
     - With the ability to auto-detect server health and adjust its concurrency
-        automatically.
- - Support for custom default input values, using pairs of patterns (to be matched
-    against input names) and values to be used to fill in matching inputs.
+      automatically.
+- Support for custom default input values, using pairs of patterns (to be matched
+  against input names) and values to be used to fill in matching inputs.
 
 ### Integrated browser environment
 
@@ -155,27 +160,27 @@ with a great deal of information regarding the state of the page at the time.
 
 Relevant information include:
 
- - Page DOM, as HTML code.
-     - With a list of DOM transitions required to restore the state of the
-         page to the one at the time it was logged.
- - Original DOM (i.e. prior to the action that caused the page to be logged),
-     as HTML code.
-     - With a list of DOM transitions.
- - Data-flow sinks -- Each sink is a JS method which received a tainted argument.
-     - Parent object of the method (ex.: `DOMWindow`).
-     - Method signature (ex.: `decodeURIComponent()`).
-     - Arguments list.
-         - With the identified taint located recursively in the included objects.
-     - Method source code.
-     - JS stacktrace.
- - Execution flow sinks -- Each sink is a successfully executed JS payload,
-     as injected by the security checks.
-     - Includes a JS stacktrace.
- - JavaScript stack-traces include:
-     - Method names.
-     - Method locations.
-     - Method source codes.
-     - Argument lists.
+- Page DOM, as HTML code.
+    - With a list of DOM transitions required to restore the state of the
+      page to the one at the time it was logged.
+- Original DOM (i.e. prior to the action that caused the page to be logged),
+  as HTML code.
+    - With a list of DOM transitions.
+- Data-flow sinks -- Each sink is a JS method which received a tainted argument.
+    - Parent object of the method (ex.: `DOMWindow`).
+    - Method signature (ex.: `decodeURIComponent()`).
+    - Arguments list.
+        - With the identified taint located recursively in the included objects.
+    - Method source code.
+    - JS stacktrace.
+- Execution flow sinks -- Each sink is a successfully executed JS payload,
+  as injected by the security checks.
+    - Includes a JS stacktrace.
+- JavaScript stack-traces include:
+    - Method names.
+    - Method locations.
+    - Method source codes.
+    - Argument lists.
 
 In essence, you have access to roughly the same information that your favorite
 debugger (for example, FireBug) would provide, as if you had set a breakpoint to
@@ -189,15 +194,15 @@ consuming in a high-performance fashion.
 
 Configuration options include:
 
- - Adjustable pool-size, i.e. the amount of browser workers to utilize.
- - Timeout for each job.
- - Worker TTL counted in jobs -- Workers which exceed the TTL have their browser
-     process respawned.
- - Ability to disable loading images.
- - Adjustable screen width and height.
-     - Can be used to analyze responsive and mobile applications.
- - Ability to wait until certain elements appear in the page.
- - Configurable local storage data.
+- Adjustable pool-size, i.e. the amount of browser workers to utilize.
+- Timeout for each job.
+- Worker TTL counted in jobs -- Workers which exceed the TTL have their browser
+  process respawned.
+- Ability to disable loading images.
+- Adjustable screen width and height.
+    - Can be used to analyze responsive and mobile applications.
+- Ability to wait until certain elements appear in the page.
+- Configurable local storage data.
 
 ### Coverage
 
@@ -212,27 +217,28 @@ order to provide coverage for a full set of possible scenarios.
 By inspecting all possible pages and their states (when using client-side code)
 Arachni is able to extract and audit the following elements and their inputs:
 
- - Forms
+- Forms
     - Along with ones that require interaction via a real browser due to DOM events.
- - User-interface Forms
+- User-interface Forms
     - Input and button groups which don't belong to an HTML `<form>` element but
-        are instead associated via JS code.
- - User-interface Inputs
+      are instead associated via JS code.
+- User-interface Inputs
     - Orphan `<input>` elements with associated DOM events.
- - Links
+- Links
     - Along with ones that have client-side parameters in their fragment, i.e.:
-        `http://example.com/#/?param=val&param2=val2`
+      `http://example.com/#/?param=val&param2=val2`
     - With support for rewrite rules.
- - LinkTemplates -- Allowing for extraction of arbitrary inputs from generic paths,
-    based on user-supplied templates -- useful when rewrite rules are not available.
+- LinkTemplates -- Allowing for extraction of arbitrary inputs from generic paths,
+  based on user-supplied templates -- useful when rewrite rules are not available.
     - Along with ones that have client-side parameters in their URL fragments, i.e.:
-            `http://example.com/#/param/val/param2/val2`
- - Cookies
- - Headers
- - Generic client-side elements which have associated DOM events.
- - AJAX-request parameters.
- - JSON request data.
- - XML request data.
+      `http://example.com/#/param/val/param2/val2`
+- Cookies
+    - Also supports nested cookies, containing key-value pairs inside individual cookies.
+- Headers
+- Generic client-side elements which have associated DOM events.
+- AJAX-request parameters.
+- JSON request data.
+- XML request data.
 
 ### Open [distributed architecture](https://github.com/Arachni/arachni/wiki/Distributed-components)
 
@@ -246,7 +252,7 @@ Both approaches allow you to:
 
 - Remotely monitor and manage scans.
 - Perform multiple scans at the same time -- Each scan is compartmentalized to
-    its own OS process to take advantage of:
+  its own OS process to take advantage of:
     - Multi-core/SMP architectures.
     - OS-level scheduling/restrictions.
     - Sandboxed failure propagation.
@@ -260,51 +266,51 @@ Both approaches allow you to:
     - Uses JSON to format messages.
 - Stateful scan monitoring.
     - Unique sessions automatically only receive updates when polling for progress,
-        rather than full data.
+      rather than full data.
 
 #### [RPC API](https://github.com/Arachni/arachni/wiki/RPC-API)
 
 - High-performance/low-bandwidth [communication protocol](https://github.com/Arachni/arachni-rpc).
     - `MessagePack` serialization for performance, efficiency and ease of
-        integration with 3rd party systems.
+      integration with 3rd party systems.
 - Grid:
     - Self-healing.
     - Scale up/down by hot-plugging/hot-unplugging nodes.
         - Can scale up infinitely by adding nodes to increase scan capacity.
     - _(Always-on)_ Load-balancing -- All Instances are automatically provided
-        by the least burdened Grid member.
+      by the least burdened Grid member.
         - With optional per-scan opt-out/override.
     - _(Optional)_ High-Performance mode -- Combines the resources of
-        multiple nodes to perform multi-Instance scans.
+      multiple nodes to perform multi-Instance scans.
         - Enabled on a per-scan basis.
 
 ### Scope configuration
 
- - Filters for redundant pages like galleries, catalogs, etc. based on regular
-    expressions and counters.
+- Filters for redundant pages like galleries, catalogs, etc. based on regular
+  expressions and counters.
     - Can optionally detect and ignore redundant pages automatically.
- - URL exclusion filters using regular expressions.
- - Page exclusion filters based on content, using regular expressions.
- - URL inclusion filters using regular expressions.
- - Can be forced to only follow HTTPS paths and not downgrade to HTTP.
- - Can optionally follow subdomains.
- - Adjustable page count limit.
- - Adjustable redirect limit.
- - Adjustable directory depth limit.
- - Adjustable DOM depth limit.
- - Adjustment using URL-rewrite rules.
- - Can read paths from multiple user supplied files (to both restrict and extend
-    the scope).
+- URL exclusion filters using regular expressions.
+- Page exclusion filters based on content, using regular expressions.
+- URL inclusion filters using regular expressions.
+- Can be forced to only follow HTTPS paths and not downgrade to HTTP.
+- Can optionally follow subdomains.
+- Adjustable page count limit.
+- Adjustable redirect limit.
+- Adjustable directory depth limit.
+- Adjustable DOM depth limit.
+- Adjustment using URL-rewrite rules.
+- Can read paths from multiple user supplied files (to both restrict and extend
+  the scope).
 
 ### Audit
 
- - Can audit:
+- Can audit:
     - Forms
         - Can automatically refresh nonce tokens.
         - Can submit them via the integrated browser environment.
-     - User-interface Forms
+    - User-interface Forms
         - Input and button groups which don't belong to an HTML `<form>` element
-            but are instead associated via JS code.
+          but are instead associated via JS code.
     - User-interface Inputs
         - Orphan `<input>` elements with associated DOM events.
     - Links
@@ -317,13 +323,13 @@ Both approaches allow you to:
     - Generic client-side DOM elements.
     - JSON request data.
     - XML request data.
- - Can ignore binary/non-text pages.
- - Can audit elements using both `GET` and `POST` HTTP methods.
- - Can inject both raw and HTTP encoded payloads.
- - Can submit all links and forms of the page along with the cookie
-    permutations to provide extensive cookie-audit coverage.
- - Can exclude specific input vectors by name.
- - Can include specific input vectors by name.
+- Can ignore binary/non-text pages.
+- Can audit elements using both `GET` and `POST` HTTP methods.
+- Can inject both raw and HTTP encoded payloads.
+- Can submit all links and forms of the page along with the cookie
+  permutations to provide extensive cookie-audit coverage.
+- Can exclude specific input vectors by name.
+- Can include specific input vectors by name.
 
 ### Components
 
@@ -514,7 +520,7 @@ Passive checks look for the existence of files, folders and signatures.
 
 - Standard output
 - [HTML](http://www.arachni-scanner.com/reports/report.html/)
-    ([zip](http://www.arachni-scanner.com/reports/report.html.zip)) (`html`).
+  ([zip](http://www.arachni-scanner.com/reports/report.html.zip)) (`html`).
 - [XML](http://www.arachni-scanner.com/reports/report.xml) (`xml`).
 - [Text](http://www.arachni-scanner.com/reports/report.txt) (`text`).
 - [JSON](http://www.arachni-scanner.com/reports/report.json) (`json`)
@@ -529,32 +535,32 @@ Plugins add extra functionality to the system in a modular fashion, this way the
 core remains lean and makes it easy for anyone to add arbitrary functionality.
 
 - Passive Proxy  (`proxy`) -- Analyzes requests and responses between the web app and
-    the browser assisting in AJAX audits, logging-in and/or restricting the scope of the audit.
+  the browser assisting in AJAX audits, logging-in and/or restricting the scope of the audit.
 - Form based login (`autologin`).
 - Script based login (`login_script`).
 - Dictionary attacker for HTTP Auth (`http_dicattack`).
 - Dictionary attacker for form based authentication (`form_dicattack`).
 - Cookie collector (`cookie_collector`) -- Keeps track of cookies while establishing a timeline of changes.
 - WAF (Web Application Firewall) Detector (`waf_detector`) -- Establishes a baseline of
-    normal behavior and uses rDiff analysis to determine if malicious inputs cause any behavioral changes.
+  normal behavior and uses rDiff analysis to determine if malicious inputs cause any behavioral changes.
 - BeepNotify (`beep_notify`) -- Beeps when the scan finishes.
 - EmailNotify (`email_notify`) -- Sends a notification (and optionally a report) over SMTP at
-    the end of the scan.
+  the end of the scan.
 - VectorFeed (`vector_feed`) -- Reads in vector data from which it creates elements to be
-    audited. Can be used to perform extremely specialized/narrow audits on a per vector/element basis.
-    Useful for unit-testing or a gazillion other things.
+  audited. Can be used to perform extremely specialized/narrow audits on a per vector/element basis.
+  Useful for unit-testing or a gazillion other things.
 - Script (`script`) -- Loads and runs an external Ruby script under the scope of a plugin,
-    used for debugging and general hackery.
+  used for debugging and general hackery.
 - Uncommon headers (`uncommon_headers`) -- Logs uncommon headers.
 - Content-types (`content_types`) -- Logs content-types of server responses aiding in the
-    identification of interesting (possibly leaked) files.
+  identification of interesting (possibly leaked) files.
 - Vector collector (`vector_collector`) -- Collects information about all seen input vectors
-    which are within the scan scope.
+  which are within the scan scope.
 - Headers collector (`headers_collector`) -- Collects response headers based on specified criteria.
 - Exec (`exec`) -- Calls external executables at different scan stages.
 - Metrics (`metrics`) -- Captures metrics about multiple aspects of the scan and the web application.
 - Restrict to DOM state (`restrict_to_dom_state`) -- Restricts the audit to a single page's DOM
-    state, based on a URL fragment.
+  state, based on a URL fragment.
 - Webhook notify (`webhook_notify`) -- Sends a webhook payload over HTTP at the end of the scan.
 - Rate limiter (`rate_limiter`) -- Rate limits HTTP requests.
 - Page dump (`page_dump`) -- Dumps page data to disk as YAML.
@@ -564,7 +570,7 @@ core remains lean and makes it easy for anyone to add arbitrary functionality.
 Default plugins will run for every scan and are placed under `/plugins/defaults/`.
 
 - AutoThrottle (`autothrottle`) -- Dynamically adjusts HTTP throughput during the scan for
-    maximum bandwidth utilization.
+  maximum bandwidth utilization.
 - Healthmap (`healthmap`) -- Generates sitemap showing the health of each crawled/audited URL
 
 ###### Meta
@@ -573,12 +579,12 @@ Plugins under `/plugins/defaults/meta/` perform analysis on the scan results
 to determine trustworthiness or just add context information or general insights.
 
 - TimingAttacks (`timing_attacks`) -- Provides a notice for issues uncovered by timing attacks
-    when the affected audited pages returned unusually high response times to begin with.
-    It also points out the danger of DoS attacks against pages that perform heavy-duty processing.
+  when the affected audited pages returned unusually high response times to begin with.
+  It also points out the danger of DoS attacks against pages that perform heavy-duty processing.
 - Discovery (`discovery`) -- Performs anomaly detection on issues logged by discovery
-    checks and warns of the possibility of false positives where applicable.
+  checks and warns of the possibility of false positives where applicable.
 - Uniformity (`uniformity`) -- Reports inputs that are uniformly vulnerable across a number
-    of pages hinting to the lack of a central point of input sanitization.
+  of pages hinting to the lack of a central point of input sanitization.
 
 ### Trainer subsystem
 
@@ -628,10 +634,10 @@ need to follow in order to contribute code:
 
 * Fork the project.
 * Start a feature branch based on the [experimental](https://github.com/Arachni/arachni/tree/experimental)
-    branch (`git checkout -b <feature-name> experimental`).
+  branch (`git checkout -b <feature-name> experimental`).
 * Add specs for your code.
 * Run the spec suite to make sure you didn't break anything (`rake spec:core`
-    for the core libs or `rake spec` for everything).
+  for the core libs or `rake spec` for everything).
 * Commit and push your changes.
 * Issue a pull request and wait for your code to be reviewed.
 

data/Rakefile

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/arachni.gemspec

@@ -1,6 +1,6 @@
 # coding: utf-8
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -10,7 +10,7 @@
 Gem::Specification.new do |s|
     require File.expand_path( File.dirname( __FILE__ ) ) + '/lib/arachni/version'
 
-    s.required_ruby_version = '>= 2.2.0'
+    s.required_ruby_version = '>= 2.3.0'
 
     s.name              = 'arachni'
     s.version           = Arachni::VERSION
@@ -43,76 +43,76 @@ Gem::Specification.new do |s|
 
     s.add_dependency 'awesome_print',       '1.6.1'
 
-    s.add_dependency 'rack',                '1.6.4'
+    s.add_dependency 'rack',                '2.2.3'
+    s.add_dependency 'rack-test'
 
     # Don't specify version, messes with the packages since they always grab the
     # latest one.
     s.add_dependency 'bundler'
 
-    s.add_dependency 'concurrent-ruby',     '1.0.2'
-    s.add_dependency 'concurrent-ruby-ext', '1.0.2'
+    s.add_dependency 'concurrent-ruby',     '1.0.5'
+    s.add_dependency 'concurrent-ruby-ext', '1.0.5'
 
     # For compressing/decompressing system state archives.
-    s.add_dependency 'rubyzip',             '1.2.1'
+    s.add_dependency 'rubyzip',             '>= 1.3.0'
 
     # HTTP proxy server
     s.add_dependency 'http_parser.rb',      '0.6.0'
 
     # HTML report
-    s.add_dependency 'coderay',             '1.1.0'
+    s.add_dependency 'coderay',             '1.1.2'
 
-    s.add_dependency 'childprocess',        '0.5.3'
+    s.add_dependency 'childprocess',        '0.9.0'
 
     # RPC serialization.
-    s.add_dependency 'msgpack',             '0.7.0'
+    s.add_dependency 'msgpack',             '1.2.4'
 
     if RUBY_PLATFORM != 'java'
         # Optimized JSON.
-        s.add_dependency 'oj',              '2.15.0'
+        s.add_dependency 'oj',              '3.6.5'
         s.add_dependency 'oj_mimic_json',   '1.0.1'
     end
 
     # Web server
-    s.add_dependency 'puma',                '2.14.0'
+    s.add_dependency 'puma',                '>= 4.3.9'
 
     # REST API
-    s.add_dependency 'sinatra',             '1.4.6'
-    s.add_dependency 'sinatra-contrib',     '1.4.6'
+    s.add_dependency 'sinatra',             '2.1.0'
+    s.add_dependency 'sinatra-contrib',     '2.1.0'
 
     # RPC client/server implementation.
     s.add_dependency 'arachni-rpc',         '~> 0.2.1.4'
 
     # HTTP client.
-    s.add_dependency 'typhoeus',            '1.0.2'
+    s.add_dependency 'typhoeus',            '1.3.0'
 
     # Fallback URI parsing and encoding utilities.
-    s.add_dependency 'addressable',         '2.3.6'
+    s.add_dependency 'addressable',         '>= 2.8.0'
 
     # E-mail plugin.
-    s.add_dependency 'pony',                '1.11'
+    s.add_dependency 'pony',                '1.12'
 
     # For the Arachni console (arachni_console).
-    s.add_dependency 'rb-readline',         '0.5.1'
+    s.add_dependency 'rb-readline',         '0.5.5'
 
     # Markup parsing, for reports and Element::XML.
-    s.add_dependency 'nokogiri',            '1.6.8.1'
+    s.add_dependency 'nokogiri'
     # Really fast and lightweight markup parsing, for pages.
-    s.add_dependency 'ox',                  '2.4.11'
+    s.add_dependency 'ox',                  '2.9.4'
 
     # Outputting data in table format (arachni_rpcd_monitor).
-    s.add_dependency 'terminal-table',      '1.4.5'
+    s.add_dependency 'terminal-table',      '1.8.0'
 
     # Browser support for DOM/JS/AJAX analysis stuff.
-    # Lock webdriver, newer versions has issues.
-    s.add_dependency 'selenium-webdriver',  '3.0.1'
-    s.add_dependency 'watir-webdriver',     '0.8.0'
+    s.add_dependency 'watir',               '6.19.1'
+    s.add_dependency 'selenium-webdriver',  '4.1.0'
 
     # Markdown to HTML conversion, used by the HTML report for component
     # descriptions.
-    s.add_dependency 'kramdown',            '1.4.1'
+    s.add_dependency 'kramdown',            '>= 2.3.0'
 
     # Used to scrub Markdown for XSS etc.
-    s.add_dependency 'loofah',              '2.0.3'
+    s.add_dependency 'loofah',              '>= 2.3.1'
 
     s.post_install_message = <<MSG
 
@@ -129,7 +129,7 @@ License            - Arachni Public Source License v1.0
                         (https://github.com/Arachni/arachni/blob/master/LICENSE.md)
 Author             - Tasos "Zapotek" Laskos (http://twitter.com/Zap0tek)
 Twitter            - http://twitter.com/ArachniScanner
-Copyright          - 2010-2017 Sarosys LLC (http://www.sarosys.com)
+Copyright          - 2010-2022 Ecsypno (http://www.ecsypno.com)
 
 Please do not hesitate to ask for assistance (via the support portal)
 or report a bug (via GitHub Issues) if you come across any problem.

data/bin/arachni

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_console

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_multi

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_reporter

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework