arachni 1.0.6 → 1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9c9fcad54f45425bae6cfe2e13128890fe6bd259
-  data.tar.gz: 5909dde7398a67e4da8f94fdbb11f40e3fc6d9b7
+  metadata.gz: 8f24a93602ee05ee80f03367f6076200362efff6
+  data.tar.gz: 0e6c3ee901415342be5661d62bf41925cc6b36f2
 SHA512:
-  metadata.gz: 9adfdde00f808552c7f8387f5bf7bb766672fee202b757dc150eb92eb5f33326ab3fb680ada9b1cf024f26c1a9c503006d47238d5359f9eb9c2f42b27538f0bf
-  data.tar.gz: fe7f56f73a56ddc426095e9abd9b54315c0be4ba493fb2a1666521a38cb8a88a4e3992a810ff0b1d936a4d9e4d6a5f23f5c319333241686f8adca5789c891b89
+  metadata.gz: ab0b21531f7be52bbe924d1a58f58de719222b72df67431c22898d519dd66bd47f297166b083a68add14cf64ee64ea3497c66350f3c68ec9da0eeda85a56751c
+  data.tar.gz: 54e4aff6b4437087c2f32919c2eb669648fc88e4fb42c397ec27a64058741af717bd750eb1a0c5d4f1cefa46cfb44750049e024a57c4538409b9686daee17b54

data/CHANGELOG.md

@@ -1,5 +1,198 @@
 # ChangeLog
 
+## 1.1 _(May 1, 2015)_
+
+- `gemspec` -- Require Ruby >= 2.0.0.
+- Options
+    - `--authorized-by` -- Fixed expected type (`Integer` => `String`).
+    - HTTP
+        - `request_timeout` -- Lowered from 50 to 10 seconds.
+        - `response_max_size` -- Set to 500KB.
+    - BrowserCluster
+        - `job_timeout` -- Lowered from 120 to 15 seconds.
+    - Scope
+        - `dom_depth_limit` -- Lowered from 10 to 5.
+    - Added:
+        - Audit
+            - `--audit-parameter-names` -- Injects payloads into parameter names.
+            - `--audit-with-extra-parameter` -- Injects payloads into an extra parameter.
+        - HTTP
+            - `--http-ssl-verify-peer` -- Verify SSL peer.
+            - `--http-ssl-verify-host` -- Verify SSL host.
+            - `--http-ssl-certificate` -- SSL certificate to use.
+            - `--http-ssl-certificate-type` -- SSL certificate type.
+            - `--http-ssl-key` -- SSL private key to use.
+            - `--http-ssl-key-type` -- SSL key type.
+            - `--http-ssl-key-password` -- Password for the SSL private key.
+            - `--http-ssl-ca` -- File holding one or more certificates with which to verify the peer.
+            - `--http-ssl-ca-directory` -- Directory holding multiple certificate files with which to verify the peer.
+            - `--http-ssl-version` -- SSL version to use.
+- `URI`
+    - Added `#resource_name`.
+    - Added `.full_and_absolute?`.
+    - `Scope`
+        - `#redundant?` -- No longer updates counter by default.
+        - `#auto_redundant?`
+            - No longer updates counter by default.
+            - Only consider URLs with query parameters.
+- `HTTP`
+    - `Client`
+        - Overhauled custom-404 identification and moved to `Dynamic404Handler`.
+- `Framework`
+    - `Parts`
+        - `Data`
+            - `#push_to_page_queue` -- Update redundancy scope counters.
+            - `#push_to_url_queue` -- Update redundancy scope counters.
+        - `Audit`
+            - `#audit_page`
+                - Apply DOM metadata to pages not originated from `Browser#to_page`.
+        - `Browser`
+            - Added utility `#browser`.
+            - Added `#use_browsers?`, determining whether system options and
+                capabilities allow for browsers to be used.
+            - `#wait_for_browsers?` => `#wait_for_browser_cluster?`
+- `Element`
+    - All
+        - Renamed `#html` to `#source`.
+        - Moved element-specific capabilities to their own files.
+    - `Cookie`
+            - `.encode` -- Encode `=` even when in value.
+    - `JSON` -- Represents JSON input vectors.
+    - `XML` -- Represents XML input vectors.
+    - `Form`
+        - Support forms with multiple values for `submit` inputs with sa
+        me names.
+    - `Server`
+        - `#log_remote_file_if_exists` -- Perform some rudimentary meta-analysis
+            on possible issues and only feed the identified resources back to the
+            system if they are above a certain threshold of similarity.
+            This fixes infinite loop scenarios when dealing with unreliable
+            custom-404 fingerprints.
+    - `Capabilities`
+        - `Mutable`
+            - `:param_flip` => `:parameter_names`
+            - Added `:parameter_values` option.
+            - Added `:with_extra_parameter` option.
+        - `Analyzable`
+            - `Timeout`
+                - Updated algorithm to be resilient to WAF/IDS/IPS filtering.
+                - Added remarks to each issue containing extra information
+                    regarding the state of the web application during analysis.
+            - `Differential` -- Added remarks to each issue containing extra information
+                regarding the used payloads.
+            - `Taint`
+                - Don't log issues when unable to get a verification response.
+                - Provide all matched data as proof, not only the regexp captured ones.
+        - `WithDOM`
+            - Added `#skip_dom` (set via `Browser#to_page`), to prevent `DOM`s
+                from being loaded and audited when there are no associated events.
+- `Page`
+    - Added `#update_metadata`, updating `#metadata` from `#cache` elements.
+    - Added `#reload_metadata`, updating `#cache` elements from `#metadata`.
+    - Added `#import_metadata`, importing `#metadata` from other page.
+    - `DOM`
+        - `#restore` -- Added debugging messages.
+- `Utilities`
+    - Added `.full_and_absolute_url?`.
+- `Browser`
+    - Updated to extract JSON and XML input vectors from HTTP requests.
+    - `#shutdown` -- Fixed Selenium exceptions on dead browser process.
+    - `#to_page` -- Apply DOM metadata to page elements.
+    - `#spawn_phantomjs` -- Enabled `--disk-cache` option for `phantomjs`.
+    - `#fire_event` -- Recode input values to fix encoding errors.
+    - `#to_page` -- Return empty page on unavailable response data instead of `nil`.
+    - `#snapshot_id` -- Updated to only consider important element attributes
+        (depending on type) instead of all of them.
+    - `ElementLocator`
+        - `#css` -- Returns a CSS locator.
+        - `#locate` -- Updated to use `#css`.
+    - `Javascript`
+        - Added `.select_event_attributes`.
+        - `DOMMonitor`
+            - `#digest` -- Removed `data-arachni-id` from digest.
+        - `TaintTracer`
+            - Added support for tracing multiple taints in groups.
+            - Added tracing for:
+                - `escape()`
+                - `unescape()`
+                - `String`
+                    - `indexOf()`
+                    - `lastIndexOf()`
+                - `jQuery`
+                    - `cookie()` plugin.
+- `BrowserCluster`
+    - `Worker`
+        - `#browser_respawn` -- Catch Watir/Selenium errors.
+- `Session`
+    - Ensure the browser is shut-down after each login operation.
+- `Check`
+    - `Auditor`
+        - `#each_candidate_dom_element` -- Yield element DOMs instead of parent elements.
+- `Plugin`
+    - `Manager`
+        - `#run` -- Optimized plugin initialization by using a queue to signal
+            a ready-state, instead of blocking for 1 second.
+-  Checks
+    - Active
+        - Added
+            - `unvalidated_redirect_dom` -- Logs DOM-based unvalidated redirects.
+            - `xxe` -- Logs XML External Entity vulnerabilities.
+        - `trainer` -- Disabled parameter flip for the payload to avoid parameter
+            pollution.
+        - `os_cmd_injection` -- Only use straight payload injection instead
+            of straight and append.
+        - `code_injection` -- Only use straight payload injection instead
+            of straight and append.
+        - `xss` -- When auditing links don't require a tainted response for
+            browser analysis.
+        - `xss_script_context`
+            - Updated payloads.
+            - Only use straight payload injection instead of straight and append.
+        - `xss_dom_script_context` -- Only use straight payload injection instead
+            of straight and append.
+        - `xss_tag` -- Updated payloads to handle cases when more data are appended
+            to the landed value.
+        - `xss_event` -- Added proof to the issue.
+    - Passive
+        - Added
+            - `insecure_cross_domain_policy_access` -- Checks `crossdomain.xml`
+                files for `allow-access-from` wildcard policies.
+            - `insecure_cross_domain_policy_headers` -- Checks `crossdomain.xml`
+                files for wildcard `allow-http-request-headers-from` policies.
+            - `insecure_client_access_policy` -- Checks `clientaccesspolicy.xml`
+                files for wildcard domain policies.
+            - `insecure_cors_policy` -- Logs wildcard `Access-Control-Allow-Origin`
+                headers per host.
+            - `x_frame_options` -- Logs missing `X-Frame-Options` headers per host.
+            - `common_directories` -- Added:
+                - `rails/info/routes`
+                - `rails/info/properties`
+        - `http_put` -- Try to `DELETE` the `PUT` file.
+        - `html_objects` -- Updated regexp to use non-capturing groups.
+- Plugins
+    - All
+        - Updated `#prepare` methods to not block, in accordance with the new
+            `Plugin::Manager#run` behavior.
+    - `email_notify`
+        - Added `domain` option.
+        - Fixed extension for `html` reporter.
+        - Added support for `afr` report type.
+    - `proxy` -- Added XML and JSON input vector extraction.
+    - Added:
+        - `vector_collector` -- Collects information about all seen input vectors
+            which are within the scan scope.
+        - `headers_collector` -- Collects response headers based on specified criteria.
+        - `exec` -- Calls external executables at different scan stages.
+- Report -- Renamed `#html` to `#source` for all elements.
+    - `html`
+        - Updated chart rendering to only take place when visiting the chart page.
+        - Fixed broken links.
+        - Cleaned up chart severity handling.
+        - Summary
+            - Added OWASP Top 10 tab.
+    - `xml`
+        - Schema update for issue remarks.
+
 ## 1.0.6 _(December 07, 2014)_
 
 - `arachni_rpcd` -- Fixed bug causing the `--nickname` option to not be understood.

data/Gemfile

@@ -26,4 +26,3 @@ group :prof do
 end
 
 gemspec
-

data/LICENSE.md

@@ -1,6 +1,6 @@
 # License
 
-Copyright 2010-2014 [Tasos Laskos](mailto:tasos.laskos@arachni-scanner.com).
+Copyright 2010-2015 [Tasos Laskos](mailto:tasos.laskos@arachni-scanner.com).
 
 The Arachni Framework (henceforth referred to simply as "Arachni") is dual-licensed.
 

data/README.md

@@ -1,17 +1,9 @@
-**NOTICE**:
-
-* Arachni's license has changed, please see the _LICENSE_ file before working
-    with the project.
-* v1.0 is not backwards compatible with v0.4.
-
-<hr/>
-
 # Arachni - Web Application Security Scanner Framework
 
 <table>
     <tr>
         <th>Version</th>
-        <td>1.0.6</td>
+        <td>1.1</td>
     </tr>
     <tr>
         <th>Homepage</th>
@@ -46,7 +38,7 @@
     </tr>
     <tr>
         <th>Copyright</th>
-        <td>2010-2014 Tasos Laskos</td>
+        <td>2010-2015 Tasos Laskos</td>
     </tr>
     <tr>
         <th>License</th>
@@ -123,11 +115,11 @@ you with its findings.
 
  - Cookie-jar/cookie-string support.
  - Custom header support.
- - SSL support.
+ - SSL support with fine-grained options.
  - User Agent spoofing.
  - Proxy support for SOCKS4, SOCKS4A, SOCKS5, HTTP/1.1 and HTTP/1.0.
  - Proxy authentication.
- - Site authentication (Automated form-based, Cookie-Jar, Basic-Digest, NTLMv1 and others).
+ - Site authentication (SSL-based, form-based, Cookie-Jar, Basic-Digest, NTLMv1, Kerberos and others).
  - Automatic log-out detection and re-login during the scan (when the initial
     login was performed via the `autologin`, `login_script` or `proxy` plugins).
  - Custom 404 page detection.
@@ -233,6 +225,8 @@ Arachni is able to extract and audit the following elements and their inputs:
  - Headers
  - Generic client-side elements like `input`s which have associated DOM events.
  - AJAX-request parameters.
+ - JSON request data.
+ - XML request data.
 
 ### Open [distributed architecture](https://github.com/Arachni/arachni/wiki/Distributed-components)
 
@@ -293,6 +287,8 @@ Arachni is able to extract and audit the following elements and their inputs:
         - Can load them via the integrated browser environment.
     - Headers
     - Generic client-side DOM elements like `input`s.
+    - JSON request data.
+    - XML request data.
  - Can ignore binary/non-text pages.
  - Can optionally audit elements using both `GET` and `POST` HTTP methods.
  - Can optionally submit all links and forms of the page along with the cookie
@@ -416,6 +412,7 @@ Active checks engage the web application via its inputs.
     - Windows
 - Remote file inclusion (`rfi`).
 - Unvalidated redirects (`unvalidated_redirect`).
+- Unvalidated DOM redirects (`unvalidated_redirect_dom`).
 - XPath injection (`xpath_injection`).
     - Generic
     - PHP
@@ -431,6 +428,11 @@ Active checks engage the web application via its inputs.
 - DOM XSS inputs (`xss_dom_inputs`).
 - DOM XSS script context (`xss_dom_script_context`).
 - Source code disclosure (`source_code_disclosure`)
+- XML External Entity (`xxe`).
+    - Linux
+    - *BSD
+    - Solaris
+    - Windows
 
 ##### Passive
 
@@ -464,6 +466,11 @@ Passive checks look for the existence of files, folders and signatures.
 - localstart.asp (`localstart_asp`)
 - Cookie set for parent domain (`cookie_set_for_parent_domain`)
 - Missing `Strict-Transport-Security` headers for HTTPS sites (`hsts`).
+- Missing `X-Frame-Options` headers (`x_frame_options`).
+- Insecure CORS policy (`insecure_cors_policy`).
+- Insecure cross-domain policy (allow-access-from) (`insecure_cross_domain_policy_access`)
+- Insecure cross-domain policy (allow-http-request-headers-from) (`insecure_cross_domain_policy_headers`)
+- Insecure client-access policy (`insecure_client_access_policy`)
 
 #### Reporters
 
@@ -503,6 +510,10 @@ core remains lean and makes it easy for anyone to add arbitrary functionality.
 - Uncommon headers (`uncommon_headers`) -- Logs uncommon headers.
 - Content-types (`content_types`) -- Logs content-types of server responses aiding in the
     identification of interesting (possibly leaked) files.
+- Vector collector (`vector_collector`) -- Collects information about all seen input vectors
+    which are within the scan scope.
+- Headers collector (`headers_collector`) -- Collects response headers based on specified criteria.
+- Exec (`exec`) -- Calls external executables at different scan stages.
 
 ##### Defaults
 
@@ -585,9 +596,3 @@ need to follow in order to contribute code:
 
 Dual-licensed (Apache License v2.0/Commercial) -- please see the _LICENSE_ file
 for more information.
-
-## Disclaimer
-
-This is free software and you are allowed to use it as you see fit.
-However, neither the development team nor any of our contributors can be held
-responsible for your actions nor for any damage caused by the use of this software.

data/Rakefile

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -145,7 +145,6 @@ begin
                 begin
                     $spec_issues = []
 
-                    # Rake::Task['spec:checks'].execute rescue nil
                     RSpec::Core::Runner.run(FileList[ 'spec/components/checks/**/*_spec.rb' ])
 
                     ($spec_issues.size / 3).times do |i|
@@ -154,6 +153,9 @@ begin
                         issue.add_remark( :stuff, 'Blah' )
                         issue.add_remark( :stuff, 'Blah2' )
 
+                        issue.add_remark( :stuff2, '2 Blah' )
+                        issue.add_remark( :stuff2, '2 Blah2' )
+
                         # Flag some issues as untrusted.
                         $spec_issues.sample.trusted = false
                     end
@@ -162,7 +164,7 @@ begin
                     $spec_issues.each { |i| Arachni::Data.issues << i }
 
                     Arachni::Options.url = 'http://test.com'
-                    Arachni::Options.audit.elements :forms, :links, :cookies, :headers
+                    Arachni::Options.audit.elements Arachni::Page::ELEMENTS - [:link_templates]
                     Arachni::Options.audit.link_templates = [
                         /\/input\/(?<input>.+)\//,
                         /input\|(?<input>.+)/

data/arachni.gemspec

@@ -1,6 +1,6 @@
 # coding: utf-8
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -10,7 +10,7 @@
 Gem::Specification.new do |s|
     require File.expand_path( File.dirname( __FILE__ ) ) + '/lib/arachni/version'
 
-    s.required_ruby_version = '>= 1.9.3'
+    s.required_ruby_version = '>= 2.0.0'
 
     s.name              = 'arachni'
     s.version           = Arachni::VERSION
@@ -24,6 +24,7 @@ Gem::Specification.new do |s|
     s.authors           = [ 'Tasos Laskos' ]
     s.licenses          = ['Apache-2.0', 'Proprietary']
 
+    s.files            += Dir.glob( 'config/**/**' )
     s.files            += Dir.glob( 'gfx/**/**' )
     s.files            += Dir.glob( 'lib/**/**' )
     s.files            += Dir.glob( 'ui/**/**' )
@@ -43,6 +44,8 @@ Gem::Specification.new do |s|
 
     s.rdoc_options      = [ '--charset=UTF-8' ]
 
+    s.add_dependency 'rack'
+
     s.add_dependency 'bundler'
 
     # For compressing/decompressing system state archives.
@@ -61,7 +64,7 @@ Gem::Specification.new do |s|
     end
 
     # RPC client/server implementation.
-    s.add_dependency 'arachni-rpc',       '0.2.1.1'
+    s.add_dependency 'arachni-rpc',       '0.2.1.2'
 
     # HTTP client.
     s.add_dependency 'typhoeus',          '0.6.9'
@@ -73,16 +76,16 @@ Gem::Specification.new do |s|
     s.add_dependency 'pony',              '1.8'
 
     # Printing complex objects.
-    s.add_dependency 'awesome_print',     '1.2.0'
+    s.add_dependency 'awesome_print',     '~> 1.2.0'
 
     # JSON reporter.
-    s.add_dependency 'json',              '1.8.1'
+    s.add_dependency 'json',              '~> 1.8.1'
 
     # For the Arachni console (arachni_console).
     s.add_dependency 'rb-readline',       '0.5.1'
 
     # Markup parsing.
-    s.add_dependency 'nokogiri',          '1.6.2.1'
+    s.add_dependency 'nokogiri',          '~> 1.6.5'
 
     # Outputting data in table format (arachni_rpcd_monitor).
     s.add_dependency 'terminal-table',    '1.4.5'
@@ -95,7 +98,7 @@ Gem::Specification.new do |s|
     s.add_dependency 'kramdown',          '1.4.1'
 
     # Used to scrub Markdown for XSS etc.
-    s.add_dependency 'loofah',            '2.0.0'
+    s.add_dependency 'loofah',            '~> 2.0.0'
 
     s.post_install_message = <<MSG
 
@@ -112,7 +115,7 @@ License            - Apache License v2.0/Proprietary
                         (https://github.com/Arachni/arachni/blob/master/LICENSE.md)
 Author             - Tasos "Zapotek" Laskos (http://twitter.com/Zap0tek)
 Twitter            - http://twitter.com/ArachniScanner
-Copyright          - 2010-2014 Tasos Laskos
+Copyright          - 2010-2015 Tasos Laskos
 
 Please do not hesitate to ask for assistance (via the support portal)
 or report a bug (via GitHub Issues) if you come across any problem.

data/bin/arachni

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework