arachni 1.5 → 1.6.1

data/lib/arachni/http/proxy_server/connection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -84,7 +84,7 @@ class Connection < Arachni::Reactor::Connection
                                 url:     sanitize_url( @parser.request_url, headers ),
                                 method:  method,
                                 body:    @body,
-                                headers: headers
+                                headers: Arachni::HTTP::Client.headers.to_h.merge( headers )
                             )
                         )
 
@@ -140,10 +140,6 @@ class Connection < Arachni::Reactor::Connection
             if @options[:request_handler].call( request, response )
                 print_debug_level_3 '-- Handler approves, running...'
 
-                # Even though it's a blocking request, force it to go through
-                # the HTTP::Client in order to handle cookie update and
-                # fingerprinting handlers.
-                HTTP::Client.queue( request )
                 response = request.run
 
                 print_debug_level_3 "-- ...completed in #{response.time}: #{response.status_line}"
@@ -153,7 +149,6 @@ class Connection < Arachni::Reactor::Connection
         else
             print_debug_level_3 '-- Running...'
 
-            HTTP::Client.queue( request )
             response = request.run
 
             print_debug_level_3 "-- ...completed in #{response.time}: #{response.status_line}"
@@ -296,7 +291,7 @@ class Connection < Arachni::Reactor::Connection
             headers.delete name
         end
 
-        headers
+        headers.to_h
     end
 
     def cleanup_response_headers( headers )

data/lib/arachni/http/proxy_server/ssl-interceptor-cacert.pem

@@ -1,34 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIF6zCCA9OgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBjzELMAkGA1UEBhMCR1Ix
-DzANBgNVBAgMBkF0dGlrYTEPMA0GA1UEBwwGQXRoZW5zMRAwDgYDVQQKDAdBcmFj
-aG5pMQ4wDAYDVQQLDAVQcm94eTEQMA4GA1UEAwwHQXJhY2huaTEqMCgGCSqGSIb3
-DQEJARYbYXJhY2huaUBhcmFjaG5pLXNjYW5uZXIuY29tMB4XDTE1MDYxNDAyMDgz
-MVoXDTI1MDYxMTAyMDgzMVowgY8xCzAJBgNVBAYTAkdSMQ8wDQYDVQQIDAZBdHRp
-a2ExDzANBgNVBAcMBkF0aGVuczEQMA4GA1UECgwHQXJhY2huaTEOMAwGA1UECwwF
-UHJveHkxEDAOBgNVBAMMB0FyYWNobmkxKjAoBgkqhkiG9w0BCQEWG2FyYWNobmlA
-YXJhY2huaS1zY2FubmVyLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
-ggIBAKfH1iQiuG8zYS514F8zZLp8//00gPIML7+wcJn4cw2iN+yEix6RuZEIzqva
-TfC4H6lZTyUhsoGZCeYAzzH9BMri/9uHJF+4worPfVKYIsm3TnMOVYoIC1kP1/Gj
-Y1ih8KI/3baw0pddtJJeQ5/GjDaxx4+ynY4ZxrNcFmbTYXSrPcd62V/D4+edVnLi
-uQsUezWYx7gNFiAuPRtlgJVBwzRoPV+Fh7Es2/SfmNSfGBCCYOpj4Fh0GOv7pSV0
-9TeF1W/XqDoq/eZ7RzLXoFK0Rz70/22MnFWAIdEUHZqwh3ktndNEK2QHq9FRGUx8
-cUlXVAJgYv8tTErYVBltKIi2qgbnkh0Rb+rT2OkgmSL9lg0PwpXChMeSo6o6riC7
-5a8PQi6OmIseY742QYmBXApXDHtSzaY8onHUvqgxFrFpP0Bmca3AoF6kWQfXfRwS
-ClMLwfBBDVeb+Tt97MO1G4m2VEW6c7o9H1t4td55LGslUzfJrmFe99vjAtdRTVqG
-t3qDjbYi5VpE9kIyKcPHZkSKelMQ4VO1qB14CdaK/3ufqHTk7Ro2hKgstKDqnTCF
-R7Qb9yXFsb1QyNtW8898T5mQm0HWQxdkaxcodizVjY5inHgqNwPa7A469EYFm5in
-dLSOQtdPOV4q+y5lfhA2MkE3pRdSZPpnTqCEkSVVoKfdVlftAgMBAAGjUDBOMB0G
-A1UdDgQWBBRvmR7gGqIfTQB0GygwgI22Kyr1bDAfBgNVHSMEGDAWgBRvmR7gGqIf
-TQB0GygwgI22Kyr1bDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4ICAQAx
-g+ZjxJZXW1dYkc9ItXwAZba7oQJapLPu1iWCFy5cU13gck2MwDqfaDApNdr+erHg
-WN7N+smMO+x3+lZZptzTfc6g/hBthBBAnetj8CUehjnWCo3aBGgVLE/mIEyHyFym
-JX6xgcNYpvEzHT2o3Kmu/dAHCqY/3P9NtGJMhf7fy/Zz72tGY+ZTlthFSGWOjIEV
-KXTtYnRUKmIRBLMacZmrJKIZCp/qGVSnFh9yjxHTWPNXXngGMxF9ItsFbdakjefn
-hi2sHqns6/YbMaD2wK42dRQH1wH66DCGbyDPQO2j8iGK1q4Ggps+mGNYNBzMSAO/
-ybdGRLQNq8ag7RXr/tNp/jYHopS/Ga0+3bOnCKf6MXNOolknSZhsOo16BWKDRd+d
-m9ZTlro9AQr9+jdychG41IQNHXySrC5F1jLtzpEE5CJZIXkEFNYRcO9HMByJ3qwG
-759oYcMklwhU+NSC5qXpD2Z9KGf5rc0HmoO6OyD4T8hnQXkuAqoIN/NBg6YSNisN
-H2C2gbl+taRLt0/RVCiacylo5pl3XSZuQxtGaQl55gRXQDPnlfB2CtIrV44gHZOJ
-88s+Ld9h44aoT2rWbLld6dU5ElZXWEJOim+aYKJewxX7PwEHn4iCpvMLu+4jXH3j
-OkDTHheVJkxyhTDQ43ebg3/qi4yFaQyAHk3bQItwCw==
+MIIDSzCCAjOgAwIBAgIUYcNQxDuiU4HcgTPTRe8+r4QM87YwDQYJKoZIhvcNAQEN
+BQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjExMTI0MDkzODI1WhcNMzEx
+MTIyMDkzODI1WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMXSNkRqFHAwBxiC8bgiQNDKQxeJq68NGd7ofq4z
++vDziB0XnAiR6cWMmRVXRO0kSTNUMpum+uDPD0zvlgMgu/I0MBckck9hmoWQaq5N
+mzAHiweFIhI283HzPaDb3Ucmkv9HMXOH60gzD3d+Bft2f661F/xzdhDpwMr+HG3x
+hcVr7jJEFNFgZkzXHYPJgRq9SF7Tb/hMJDcwZaOwp62/vdvniDLI+lXnPtpWUVtG
+IdQJdVk27NW0mRKaYPp7GlpOjHezyfTaUzh+e8KHD+A/2JWSgkeh2FhO8nsxH6Rj
+nB97hJdsR6Bq+IH7z6BA1/mm2GWPwzvycMNwKRQpJzgH2uUCAwEAAaOBkDCBjTAd
+BgNVHQ4EFgQUizexcP6110RDXbXGDUZEMwnbkM0wUQYDVR0jBEowSIAUizexcP61
+10RDXbXGDUZEMwnbkM2hGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghRhw1DE
+O6JTgdyBM9NF7z6vhAzztjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkq
+hkiG9w0BAQ0FAAOCAQEACPb7DedEorHyfPuCiF0yXCKWZlKSsb4IzBooIxsRjrCG
+RKjbix3PEiRZTEwEFgalq4kL9C954io2/4CzfxPcvNv9xNd176UaFTW7t8zRP43m
+vNY3aEO5l52GvDc+i3OZ2CDT4d2oQt10ZeYCHzHBJwu4+v0nqhgMBFXeclrnDf/h
+wI1A6ijk0VYBDI0mJx8pSiLsJrDIM7Rd2jDwgkH3YbhKTYctdzraYVBQl9itqHNc
+wQ9u8+OqsKuYkvSuUiGts4UWuMN1B8ePa/pjpareuoFiQDqZGZh2hUxBc41Mmc7o
+5aSOBcR4JGItYbkzU/KSUskfhWpFWJSBbHDKeqKXaA==
 -----END CERTIFICATE-----

data/lib/arachni/http/proxy_server/ssl-interceptor-cakey.pem

@@ -1,51 +1,30 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIJKAIBAAKCAgEAp8fWJCK4bzNhLnXgXzNkunz//TSA8gwvv7BwmfhzDaI37ISL
-HpG5kQjOq9pN8LgfqVlPJSGygZkJ5gDPMf0EyuL/24ckX7jCis99UpgiybdOcw5V
-iggLWQ/X8aNjWKHwoj/dtrDSl120kl5Dn8aMNrHHj7KdjhnGs1wWZtNhdKs9x3rZ
-X8Pj551WcuK5CxR7NZjHuA0WIC49G2WAlUHDNGg9X4WHsSzb9J+Y1J8YEIJg6mPg
-WHQY6/ulJXT1N4XVb9eoOir95ntHMtegUrRHPvT/bYycVYAh0RQdmrCHeS2d00Qr
-ZAer0VEZTHxxSVdUAmBi/y1MSthUGW0oiLaqBueSHRFv6tPY6SCZIv2WDQ/ClcKE
-x5KjqjquILvlrw9CLo6Yix5jvjZBiYFcClcMe1LNpjyicdS+qDEWsWk/QGZxrcCg
-XqRZB9d9HBIKUwvB8EENV5v5O33sw7UbibZURbpzuj0fW3i13nksayVTN8muYV73
-2+MC11FNWoa3eoONtiLlWkT2QjIpw8dmRIp6UxDhU7WoHXgJ1or/e5+odOTtGjaE
-qCy0oOqdMIVHtBv3JcWxvVDI21bzz3xPmZCbQdZDF2RrFyh2LNWNjmKceCo3A9rs
-Djr0RgWbmKd0tI5C1085Xir7LmV+EDYyQTelF1Jk+mdOoISRJVWgp91WV+0CAwEA
-AQKCAgAo/qXvDGC+IvKy1HBvMnKBMnul1YdQHPQpxSWuKUuLYECD1NrdLEQIEPvW
-d6+lioeJ7F1vOC2Sht8pSLdXgngCTravX/TeQpmeKxZ28N9HJDfR2wXBhTeomjts
-OjzS8jaGnk5BDjFWdLnjLY8eYffugT++d6kRiHDJcE208B8Wz6R3siecw5NTC1mN
-FqKZ93YnYV4jNWdbk5CwuftR/NCCZJniVhESlGBmA/zmrrzFg+XEP4UYd72DI2h1
-n38vAs9k1W+wTsLc5vA9lvwAWTYzRs+GZ93m8jjRCjY1jr57OE8gyL5FYa50pXkl
-/B3+Co1nSz/FE79ZZkQeNlK6HM+sHM5K0UILW+lKcDci+ABGH9mwkEtJwvg6XkhZ
-2iGyBaXtEObzaDugZoNuttAURbA32r9kRJNtPXP/Q0/fkQHTpd70iq9ax0Ztdh3H
-hatt9VxN3h+NVl4xfZrBJdQYUrxb6wrraABnz7QUmRpHMulgaSnAIXe4MvZEleKe
-tAZg9sIRzzYy1bkQLdwgwTHuNNUm6usiK7HRBv94R4PycPsXTAq8CSGp0FheSW+S
-QmFCeJhaEaNGRC5mp5Wk7sycVrKDu63ch8cABdFewTuB7LZCnviY/9CGdfu+LFgD
-bQGEqq+OxHXOr6xb5c7W5LY7oxWafab6OohHPOulcxEIOF3NzQKCAQEA2gvN9i97
-+ntPXg4q4uk3rq6QpLke+q6MjM289xaNgkN2fQthxAzo3bK7yc7+zKbmKXIxrb0n
-GWWY/xTci6NS8W44YxdwZNB0LORa6gkpH3znsYLa4HsOYQTtLDu/6rOwE+EUwPA/
-UUp1TaseD0+eV8Jrz8whqdU33wUSs2mi6R7kYcb8J9PXnlHz9qw3TuPPug2Tt7Q8
-AmydJ/XiniEN2gF0DS3+99cbqLb2C7CeX7W+E8sxYRs2tQliWIMYr1iXDkKRi2Qb
-KnUQWD/N4WwNYQ6mwYKwc6J1T37Ucp5FWYwVBqa5vV1KbrXb4JLJCWqwsy+mpE+i
-wlfVVKgIi/j7ywKCAQEAxPwv8GBx84amUVBLPAUo5LPFhTOvZmHGNMNvYjVdk5Ud
-B37M3XbQMiTKQoeDII4Rr1cnkLUDm4eqgROkmlBAJZB9QLIrc87Hre8jW3eucU8y
-kVc90yUprc7WmvOcF1zilvjcNbt2gsVlmhbWuyqqn1aWfzvxjzqUXW6Xju0jD0wi
-a5qeMOVhJXrSTdy0gjZ7qg4BVWr01rIAuqifBKt7En9ynxqI4XEyzK9RYpex3ek1
-yJzVAW3fn/HN1pKpBLS6QOsUtqWQDQKGZM6zYDR49mnUuTWYkhh3pXeHQ3uNsJwR
-wS+FPu8YaiodGLXclwTmLZz093D7eChsoAjDvvB0JwKCAQEAtOVkOyFL5xQUVYDF
-fblkk8yJfc+DbxAO1OX/JrMUNYUIsVcXBhJ7wyn8d8H+TAUPIEV4B57M6FoMo1tI
-WaTnNBtwNm2Etm7mYzQUZOOytUfn5LIeKmyNElqG9dKgNvRaWTO8BxGKRkPSq9wS
-NTulr0NCNIQzTXXyQ1kvGZ/DI0qYyLHQEq7CzLtK/lQEErQXa1DGQ3sI6i339+Yb
-23qqxjm8cQ6+4Bka/k7ENBCUY+0gw8Uos1pjebBOYgZpHVgPAiqiGxWzH/c81yog
-ASumseX43MQy5cxbLNeZI3pBKLh53SnHIN5b2RuRTnAYz3IvJImc4+aZrkg2WWSK
-qq2nHwKCAQAaqR8743HIygKcosdr+i7MtWAYZSRqMPWIkqLyodJmdRoWt5y2pKwM
-/Vm6o2il8VSHbL5YIYe5dyUmjygKEq575xBsvzCOXgA8lE8uxAYCI/vuG+asOy1m
-7sWw9yO7LcElOc1kIFkr3deggVLSxjWNl0SLN+u7vOvzsVIl8AZ8vYszERwz9feu
-AO+RxjtQHFukanzXuMAmhrT+jm/nS+Y+XK2AxzCbgpyjg176fxl9tWCoJEHYDazk
-ku+PCQ6DKorC2o5VIhdbC2pxHmC8tp1gjHZUEuLxcwpOhNzzzzcgHh9xDCN2nxmo
-1MZXX9XZQrp8le+5xbrjSmVZS5Zis1ylAoIBADOMSmu//rdDwCwptRByopmLiE+S
-2AayD1Xk7X9YjkotXNYttOfnnnXq6pyEj4X0c0ISL9MkyADJ6+mx5GWH6yQlWIjo
-T00AcL5//IreAIRGluUhkFeI45QvgFfinKRiIN9YzAqhNHCEM7lEYGhMygD0OK0Y
-ZluvUvYshFLXbZA7+rYCzLM5FgeY2dxMJ4lIiXZwC5cbE95mf6bGlGb8/deBp0eW
-iGVyOSoY/Eh6qDDrQV4FOFRVFg7+9CKr8VDNizKTE6/JZFOb/F85QLwzx1zaJD1A
-FmGleWRh50XEaSAB0lA4LPWUl/m6r45bB03d9A6mx4axgl7ttjaIz6Vw9WQ=
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,2A035C8A165173F5841E28DE1D0A3673
+
+3hM9SEm1c4Hhu4HPApkPtuA4sl34K0Ul46jH34Ep+rt1tPkC+rPSS+dmZffVOc+j
+eOHajJf0rJXxjJ3ugsnXqmoTIMTEVgTG81+RQ1DfF1S4HWmp0zyqEnltXzrUV22l
+H/B783dEBdaFnUbnAISNePqNuU4f5rNPzlSMZlZ9WtiTXsB6QMUrGaLyDBpVsG3S
+lNFiqeRsCumvheH5UXFECzN/jy+m569uYkla8W5DivjhLd4eg0KZsa0Z6NpdbFTL
+E7ZouXkm33UbyhIPgz8Z5PA9CVAbcVZEKmXoanHbvz0kUYZY6DTpm/E62dBoSSmn
+R9831JKJDcQ+VdGbsDrbwTMKqx8dezCk6S5XrBd6hp7eE5FjN4+8IU4XRs57B/X9
+rWDvzxBwKKRh1l6MRu1bSsmlKd1+pAXz9Bi+6goYQfn+LsWTluUWpB+HYSfT1/AN
+V9XNjbZ70nlmUJtRhgctAt1O6sWpG3gPkWuBlhWr5rngeQr7t/Q6N5BS8UJ5yq9L
+jhDjUT9aZDEUdqIIh+3WTAPO4uMHHIohq2AtFi1PXqjajGAj8sQlAsST/ePjNkLz
+A/jZ+M8wc8Q8pyVrci3m9m6Kme2JI9JbvuOvkr7aAe3B6NLfpBx6BR7yT7dmGDxu
+in3qph/23xRTj1FLG/QEbHFRTiFxTQhD6kximZk68D0/b5GEv9grXlZk53DSaZ/o
+MTlsC+UwniKtGw3BhKqlH1KE0sYkS0ivRyUeQTH6Vujg33/asdNGu1U4nhTtZZWb
+2y4DVK+ZW36bKudY1klWTS+C3E1kHI9pOYlvmdTIV8maU930AFRGSITZZ/3yLjgm
+2SLcs2YrPWLZVgPe5O0w1N2ushxUDnclxvUr5HDH+thndmCB498e/1YIMFzb+c4f
+QfJjvGlEtmo5LxSCodlhGJ9Uw/K1CTAefiXkcpUx8AZV6/UEaFSlVk7XW7e/vcDZ
+sUvLm1oZXCnOzQIv3++akf+kZnFrTuwnIaAtVaBczluJihUDEv69WPymJ3kVNJ8C
+vo/R2oXQrtwI4NjdZ2pg3tka3RUJ7q9yT7KTnjeAhI1ZzTV8MbsT+mxA8nDixVtS
+kXInhCkara1STTFt0rUsiuaZxV3/sK4TpVmkm+hrbeEfacaFq2ZtAO6dtfyPL+Kq
+U4GkjEzK6fZ7elFzZ+xISV7oS+PBcNk2pqKZxI5rg8JMtBAgiUnVmIVqGuD9nNzf
+sttPzjbw1S3ezC7hcmTNcKa9UzAUO4+RBmakiVMBIHYEPyXTGgvbsFUT6abXg6pb
+tvKNnMaBDkF+YP+QTcbo4kJ7f//e1XNHbtnGkLu9N+PL45vam7YQFpq3YpwYVl18
+PfjoYCWoR8CfUzXEdf7blURzjyvbGg1DQ/WskenfupmpdVtxsiqzEcEgzyOsWmL0
+e7kx4IrOI49VS0aePDUh92kCKLl9+wKNfD+UNEaYuXo0sqYBmlBNBdUBzljokzxC
+GIag0AYLoIMZe0ccEa3PpVuAa0uMMrfVujLx3bXY5PrVw69gEPwc+GZz8MgAQWX5
+BGxtnrv1qhe6RpIB0AibY3myO+qIlVEOszJHDoMK8J5MKwu50s5L8R0M+Y3JdGHi
 -----END RSA PRIVATE KEY-----

data/lib/arachni/http/proxy_server/ssl_interceptor.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -16,6 +16,7 @@ class SSLInterceptor < Connection
 
     include TLS
 
+    CA_PASSPHRASE = 'interceptor'
     CA_CERTIFICATE = File.dirname( __FILE__ ) + '/ssl-interceptor-cacert.pem'
     CA_KEY         = File.dirname( __FILE__ ) + '/ssl-interceptor-cakey.pem'
 
@@ -43,9 +44,9 @@ class SSLInterceptor < Connection
 
         if @role == :server
             ca     = OpenSSL::X509::Certificate.new( File.read( CA_CERTIFICATE ) )
-            ca_key = OpenSSL::PKey::RSA.new( File.read( CA_KEY ) )
+            ca_key = OpenSSL::PKey::RSA.new( File.read( CA_KEY ), CA_PASSPHRASE )
 
-            keypair = OpenSSL::PKey::RSA.new( 1024 )
+            keypair = OpenSSL::PKey::RSA.new( 2048 )
 
             req            = OpenSSL::X509::Request.new
             req.version    = 0
@@ -53,12 +54,12 @@ class SSLInterceptor < Connection
                 "CN=#{@origin_host}/subjectAltName=#{@origin_host}/O=Arachni/OU=Proxy/L=Athens/ST=Attika/C=GR"
             )
             req.public_key = keypair.public_key
-            req.sign( keypair, OpenSSL::Digest::SHA1.new )
+            req.sign( keypair, OpenSSL::Digest::SHA256.new )
 
             cert            = OpenSSL::X509::Certificate.new
             cert.version    = 2
             cert.serial     = rand( 999999 )
-            cert.not_before = Time.new
+            cert.not_before = Time.new - 600
             cert.not_after  = cert.not_before + (60 * 60 * 24 * 365)
             cert.public_key = req.public_key
             cert.subject    = req.subject
@@ -78,7 +79,7 @@ class SSLInterceptor < Connection
                                      true
                 )
             ]
-            cert.sign( ca_key, OpenSSL::Digest::SHA1.new )
+            cert.sign( ca_key, OpenSSL::Digest::SHA256.new )
 
             @ssl_context = OpenSSL::SSL::SSLContext.new
             @ssl_context.cert = cert

data/lib/arachni/http/proxy_server/tunnel.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/http/proxy_server.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/http/request/scope.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/http/request.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -832,7 +832,13 @@ class Request < Message
     def client_run
         # Set #on_complete so that the #response will be set.
         on_complete {}
-        to_typhoeus.run
+
+        treq = self.to_typhoeus
+
+        hydra = (Thread.current[:client_run_hydra] ||= Typhoeus::Hydra.new)
+        hydra.queue treq
+        hydra.run
+
         self.response
     end
 

data/lib/arachni/http/response/scope.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/http/response.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -286,7 +286,7 @@ class Response < Message
         redirections = response.redirections.map do |redirect|
             rurl   = URI.to_absolute( redirect.headers['Location'],
                                       response.effective_url )
-            rurl ||= response.effective_url
+            rurl ||= URI.normalize( response.effective_url )
 
             # Broken redirection, skip it...
             next if !rurl
@@ -296,7 +296,7 @@ class Response < Message
                 code:          redirect.code,
                 headers:       redirect.headers
             ))
-        end
+        end.compact
 
         return_code    = response.return_code
         return_message = response.return_message

data/lib/arachni/http.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/issue/severity/base.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/issue/severity.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/issue.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/option_group.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/option_groups/audit.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -114,6 +114,15 @@ class Audit < Arachni::OptionGroup
     alias :cookie_doms  :cookies
     alias :cookie_doms= :cookies=
 
+    # @note Default is `false`.
+    #
+    # @return    [Bool]
+    #   Audit nested cookies.
+    #
+    # @see Element::NestedCookie
+    # @see Element::Capabilities::Auditable#audit
+    attr_accessor :nested_cookies
+
     # @note Default is `false`.
     #
     # @return    [Bool]
@@ -284,7 +293,7 @@ class Audit < Arachni::OptionGroup
     end
     alias :element? :elements?
 
-    [:links, :forms, :cookies, :headers, :cookies_extensively,
+    [:links, :forms, :cookies, :nested_cookies, :headers, :cookies_extensively,
      :with_both_http_methods, :link_doms, :form_doms, :cookie_doms,
      :jsons, :xmls, :ui_inputs, :ui_input_doms, :ui_forms, :ui_form_doms,
      :parameter_values, :parameter_names, :with_extra_parameter].each do |attribute|

data/lib/arachni/option_groups/browser_cluster.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -17,6 +17,10 @@ class BrowserCluster < Arachni::OptionGroup
     #   Data to be set in the browser's `localStorage`.
     attr_accessor :local_storage
 
+    # @return   [Hash]
+    #   Data to be set in the browser's `sessionStorage`.
+    attr_accessor :session_storage
+
     # @return   [Hash<Regexp,String>]
     #   When the page URL matched the key `Regexp`, wait until the `String` CSS
     #   selector in the value matches an element.
@@ -46,21 +50,31 @@ class BrowserCluster < Arachni::OptionGroup
     #   Screen height.
     attr_accessor :screen_height
 
+    # @return   [Bool]
+    #   Shall we wait for the max timer to fire on the page?
+    attr_accessor :wait_for_timers
+
     set_defaults(
         local_storage:       {},
+        session_storage:     {},
         wait_for_elements:   {},
-        pool_size:           6,
+        wait_for_timers:     false,
+        pool_size:           4,
         # Not actually a timeout for the job anymore, sets a timeout for Selenium
         # communication HTTP requests.
         # Name hijacked for compatibility, but should probably change in the
         # future.
-        job_timeout:         10,
-        worker_time_to_live: 100,
+        job_timeout:         60,
+        worker_time_to_live: 250,
         ignore_images:       false,
         screen_width:        1600,
         screen_height:       1200
     )
 
+    def wait_for_timers?
+        !!@wait_for_timers
+    end
+
     def local_storage=( data )
         data ||= {}
 
@@ -71,6 +85,16 @@ class BrowserCluster < Arachni::OptionGroup
         @local_storage = data
     end
 
+    def session_storage=( data )
+        data ||= {}
+
+        if !data.is_a?( Hash )
+            fail ArgumentError, "Expected data to be Hash, got #{data.class} instead."
+        end
+
+        @session_storage = data
+    end
+
     def css_to_wait_for( url )
         wait_for_elements.map do |pattern, css|
             next if !(url =~ pattern)

data/lib/arachni/option_groups/datastore.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/option_groups/dispatcher.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/option_groups/http.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -251,11 +251,11 @@ class HTTP < Arachni::OptionGroup
     attr_accessor :ssl_version
 
     set_defaults(
-        user_agent:             "Arachni/v#{Arachni::VERSION}",
-        request_timeout:        10_000,
+        user_agent:             "Mozilla/5.0 (Gecko) Arachni/v#{Arachni::VERSION}",
+        request_timeout:        20_000,
         request_redirect_limit: 5,
-        request_concurrency:    20,
-        request_queue_size:     100,
+        request_concurrency:    10,
+        request_queue_size:     50,
         request_headers:        {},
         response_max_size:      500_000,
         cookies:                {},

data/lib/arachni/option_groups/input.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/option_groups/output.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/option_groups/paths.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -7,6 +7,7 @@
 =end
 
 require 'fileutils'
+require 'tmpdir'
 
 module Arachni::OptionGroups
 
@@ -75,6 +76,16 @@ class Paths < Arachni::OptionGroup
         File.expand_path( File.dirname( __FILE__ ) + '/../../..' ) + '/'
     end
 
+    def tmpdir
+        if config['framework']['tmpdir'].to_s.empty?
+            # On MS Windows Dir.tmpdir can return the path with a shortname,
+            # better avoid that as it can be insonsistent with other paths.
+            Arachni.get_long_win32_filename( Dir.tmpdir )
+        else
+            Arachni.get_long_win32_filename( config['framework']['tmpdir'] )
+        end
+    end
+
     def config
         self.class.config
     end

data/lib/arachni/option_groups/rpc.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/option_groups/scope.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -14,6 +14,38 @@ module Arachni::OptionGroups
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 class Scope < Arachni::OptionGroup
 
+    EXCLUDE_MIME_TYPES = {
+      # Media
+      image:       %w(
+            gif bmp tif tiff jpg jpeg jpe pjpeg png ico psd xcf 3dm max svg eps
+            drw ai
+        ),
+      video:       %w(asf rm mpg mpeg mpe 3gp 3g2  avi flv mov mp4 swf vob wmv),
+      audio:       %w(aif mp3 mpa ra wav wma mid m4a ogg flac),
+
+      # Generic data
+      archive:     %w(zip zipx tar gz 7z rar bz2),
+      disk:        %w(bin cue dmg iso mdf vcd raw),
+
+      # Executables -- or thereabouts.
+      application: %w(exe apk app jar pkg deb rpm msi),
+
+      # Assets
+      #
+      # The browsers will not check the scope for asset files, so these shouldn't
+      # mess with it, they should only narrow down the audit.
+      font:        %w(ttf otf woff woff2 fon fnt),
+      stylesheet:  %w(css),
+      script:      %w(js),
+
+      # Documents
+      #
+      # Allow rtf, ps, xls, doc, ppt, ppts since they can contain greppable text.
+      document:    %w(pdf docx xlsx pptx odt odp),
+    }
+
+    EXCLUDE_FILE_EXTENSIONS = Set.new( EXCLUDE_MIME_TYPES.values.flatten.uniq )
+
     # @note `nil` is infinite -- default is `nil`.
     #
     # @return    [Integer]
@@ -38,6 +70,14 @@ class Scope < Arachni::OptionGroup
     # @see Browser#trigger_events
     attr_accessor :dom_event_limit
 
+    # @note `nil` is infinite -- default is `nil`.
+    #
+    # @return    [Integer]
+    #   How many elements should inherit the DOM events of their parents.
+    #
+    # @see Browser#trigger_events
+    attr_accessor :dom_event_inheritance_limit
+
     # @note `nil` is infinite -- default is `nil`.
     #
     # @return    [Integer]
@@ -145,9 +185,11 @@ class Scope < Arachni::OptionGroup
     attr_accessor :url_rewrites
 
     set_defaults(
+        directory_depth_limit:    10,
+        auto_redundant_paths:     15,
         redundant_path_patterns:  {},
-        dom_depth_limit:          5,
-        exclude_file_extensions:  Set.new,
+        dom_depth_limit:          4,
+        exclude_file_extensions:  EXCLUDE_FILE_EXTENSIONS,
         exclude_path_patterns:    [],
         exclude_content_patterns: [],
         include_path_patterns:    [],
@@ -201,7 +243,7 @@ class Scope < Arachni::OptionGroup
     end
 
     def auto_redundant?
-        !!@auto_redundant_paths
+        @auto_redundant_paths.to_i > 0
     end
 
     def auto_redundant_counter

data/lib/arachni/option_groups/session.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/option_groups/snapshot.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework