arachni 1.2.1 → 1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d17c2d7494c0ec0cbaf825b7f55ce71a90fb48ba
-  data.tar.gz: 3343cc7e23ed519a1b5e7e059aa3e88cf777ba32
+  metadata.gz: 706f2003d1263e3894635514152f7b16aaea736d
+  data.tar.gz: 8947b852c5714245f173921d794b0babcae004e2
 SHA512:
-  metadata.gz: 697804e1e14595b202beada64a5b2b0296d33fb4b61714091084c4d2ef813af467470a31bb04f571aed438c18b4f1cef8c91ea1bf299f46580556372108ae1bc
-  data.tar.gz: 245fd98a16d683a668eddf41deb0783de006679352308b2c4e268a48a5f2bcfdd159431624a80d3d82f46633bcc4cf0d4ad2971afaff42a942a35d4939f608a4
+  metadata.gz: 6a7e3b6201d61176c12fbf3da6b18f66e14af3110e851fa2f127a6cfa69c2688eb68b20f0b075b904a16eb6547a6eaf1e0641997448f2b1ad81a8d0aad8c174c
+  data.tar.gz: 23e26d260d0dab562d0691ca11f92bd652c7d212d7a864d3346d12f3c8e66df491d4e08ff2397e12779dc26a27f8affe2adcae7b8c011568749e61dca488ea3c

data/CHANGELOG.md

@@ -1,5 +1,71 @@
 # ChangeLog
 
+## 1.3 _(October 01, 2015)_
+
+- `UI`
+    - `CLI`
+        - Options
+            - `--browser-cluster-local-storage` -- Sets `localStorage` data from JSON file.
+- `Issue`
+    - `#variations` -- Removed, all issues now include full data.
+    - `#unique_id`, `#digest` -- In cases of passive issues, the associated
+        `#proof` is now taken into consideration.
+- `Data`
+    - `Framework`
+        - `#update_sitemap` -- Don't push URLs that include the
+            `Utilities.random_seed` to the sitemap to keep noise down.
+- `Element`
+    - `Cookie`
+        - `.encode` -- Updated list of reversed characters.
+        - `.decode` -- Handle broken encodings.
+    - `Form`
+        - `.decode` -- Handle broken encodings.
+    - `UIForm` -- Audits `<input>` and `<button>` groups which don't belong to
+        a `<form>` parent. Also covers cases of `<form>` submissions that occur
+        via elements other than a submit button.
+    - `UIInput` -- Audits individual `<input>` elements which have associated DOM events.
+    - `Capabilities` -- Refactored to allow for easier expansion of DOM capabilities.
+        - `Analyzable`
+            - `Differential` -- Updated to remove the injected seed from the response
+                bodies, echoed payloads can compromise the analysis.
+            - `Taint` => `Signature` -- Signature analysis better describes that
+                process and the "taint" terminology was overloaded by the browser's
+                taint tracing subsystems.
+- `Browser`
+    - Use the faster, native `#click` event on `Watir` elements, instead of `fire_event`.
+    - Sets `localStorage` data from `Arachni::OptionGroups::BrowserCluster#local_storage`.
+    - `Javascript`
+        - `TaintTracer`
+            - Updated sanitization of traced `Event` arguments to extract only
+                certain properties instead of iterating through the whole object.
+            - Limited the depth of the recursive taint search in argument objects.
+- `Components`
+    - Path extractors
+        - `comments`
+            - Small cleanup in acceptable paths.
+        - `script`
+            - Updated to not get fooled by comment strings (`/*Comment`, `//Comment`).
+            - Updated to require absolute paths to avoid processing junk.
+    - Reporters -- All reporters have been updated to remove `Issue#variations`.
+        - `xml` -- Updated schema to include the new `Element::UIForm::DOM` and
+            `Element::Input::DOM` elements.
+    - Plugins
+        - `proxy` -- Fixed bug causing the plugin to hang after proxy server shutdown.
+        - `login_script`
+            - Wait for the page to settle when using a JS login script.
+            - Catch script syntax errors.
+    - Checks
+        - Active
+            - Removed
+                `xss_dom_inputs` -- No longer necessary, covered by new DOM
+                    element abstractions and `xss_dom`.
+            - `unvalidated_redirect` -- Updated to use `Utilities.random_seed`
+                in the injected URL.
+            - `unvalidated_redirect_dom` -- Updated to use `Utilities.random_seed`
+                in the injected URL.
+        - Passive -- Reworked proofs to remove dynamic content which can interfere
+            with issue uniqueness or removed proofs altogether when not necessary.
+
 ## 1.2.1 _(July 25, 2015)_
 
 - HTTP

data/Gemfile

@@ -10,7 +10,7 @@ end
 group :spec do
     gem 'simplecov', require: false, group: :test
 
-    gem 'rspec', '2.99'
+    gem 'rspec'
     gem 'faker'
 
     gem 'puma' if !Gem.win_platform? || RUBY_PLATFORM == 'java'

data/README.md

@@ -3,7 +3,7 @@
 <table>
     <tr>
         <th>Version</th>
-        <td>1.2.1</td>
+        <td>1.3</td>
     </tr>
     <tr>
         <th>Homepage</th>
@@ -196,6 +196,8 @@ Configuration options include:
  - Ability to disable loading images.
  - Adjustable screen width and height.
      - Can be used to analyze responsive and mobile applications.
+ - Ability to wait until certain elements appear in the page.
+ - Configurable local storage data.
 
 ### Coverage
 
@@ -211,7 +213,12 @@ By inspecting all possible pages and their states (when using client-side code)
 Arachni is able to extract and audit the following elements and their inputs:
 
  - Forms
-    - Along with ones that require interaction with a real browser due to DOM events.
+    - Along with ones that require interaction via a real browser due to DOM events.
+ - User-interface Forms
+    - Input and button groups which don't belong to an HTML `<form>` element but
+        are instead associated via JS code.
+ - User-interface Inputs
+    - Orphan `<input>` elements with associated DOM events.
  - Links
     - Along with ones that have client-side parameters in their fragment, i.e.:
         `http://example.com/#/?param=val&param2=val2`
@@ -222,7 +229,7 @@ Arachni is able to extract and audit the following elements and their inputs:
             `http://example.com/#/param/val/param2/val2`
  - Cookies
  - Headers
- - Generic client-side elements like `input`s which have associated DOM events.
+ - Generic client-side elements which have associated DOM events.
  - AJAX-request parameters.
  - JSON request data.
  - XML request data.
@@ -278,6 +285,11 @@ Arachni is able to extract and audit the following elements and their inputs:
     - Forms
         - Can automatically refresh nonce tokens.
         - Can submit them via the integrated browser environment.
+     - User-interface Forms
+        - Input and button groups which don't belong to an HTML `<form>` element
+            but are instead associated via JS code.
+    - User-interface Inputs
+        - Orphan `<input>` elements with associated DOM events.
     - Links
         - Can load them via the integrated browser environment.
     - LinkTemplates
@@ -285,7 +297,7 @@ Arachni is able to extract and audit the following elements and their inputs:
     - Cookies
         - Can load them via the integrated browser environment.
     - Headers
-    - Generic client-side DOM elements like `input`s.
+    - Generic client-side DOM elements.
     - JSON request data.
     - XML request data.
  - Can ignore binary/non-text pages.
@@ -433,7 +445,6 @@ Active checks engage the web application via its inputs.
 - XSS in HTML tags (`xss_tag`).
 - XSS in script context (`xss_script_context`).
 - DOM XSS (`xss_dom`).
-- DOM XSS inputs (`xss_dom_inputs`).
 - DOM XSS script context (`xss_dom_script_context`).
 - Source code disclosure (`source_code_disclosure`)
 - XML External Entity (`xxe`).

data/components/checks/active/ldap_injection/errors.txt

@@ -1,5 +1,6 @@
 supplied argument is not a valid ldap
 javax.naming.NameNotFoundException
+javax.naming.directory.InvalidSearchFilterException
 LDAPException
 com.sun.jndi.ldap
 Search: Bad search filter

data/components/checks/active/source_code_disclosure.rb

@@ -108,7 +108,7 @@ class Arachni::Checks::SourceCodeDisclosure < Arachni::Check::Base
         return if self.class.payloads.empty?
 
         each_candidate_element do |element|
-            element.taint_analysis( self.class.payloads, self.class.options )
+            element.signature_analysis( self.class.payloads, self.class.options )
         end
     end
 

data/components/checks/active/unvalidated_redirect.rb

@@ -12,16 +12,16 @@
 # header field to determine whether the attack was successful.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2.3
-#
 # @see https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards
 class Arachni::Checks::UnvalidatedRedirect < Arachni::Check::Base
 
+    BASE_URL = "www.#{Utilities.random_seed}.com"
+
     def self.payloads
         @payloads ||= [
-            'www.arachni-boogie-woogie.com',
-            'https://www.arachni-boogie-woogie.com',
-            'http://www.arachni-boogie-woogie.com'
+            BASE_URL,
+            "https://#{BASE_URL}",
+            "http://#{BASE_URL}"
         ].map { |url| Arachni::URI( url ).to_s }
     end
 
@@ -77,7 +77,7 @@ URL to determine whether the attack was successful.
 },
             elements:    ELEMENTS_WITH_INPUTS - [Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.3',
+            version:     '0.2.4',
 
             issue:       {
                 name:            %q{Unvalidated redirect},

data/components/checks/active/unvalidated_redirect_dom.rb

@@ -9,16 +9,16 @@
 # Unvalidated redirect DOM check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.1
-#
 # @see https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards
 class Arachni::Checks::UnvalidatedRedirectDOM < Arachni::Check::Base
 
+    BASE_URL = "www.#{Utilities.random_seed}.com"
+
     def self.payloads
         @payloads ||= [
-            'www.arachni-boogie-woogie.com',
-            'https://www.arachni-boogie-woogie.com',
-            'http://www.arachni-boogie-woogie.com'
+            BASE_URL,
+            "https://#{BASE_URL}",
+            "http://#{BASE_URL}"
         ].map { |url| Arachni::URI( url ).to_s }
     end
 
@@ -54,9 +54,12 @@ class Arachni::Checks::UnvalidatedRedirectDOM < Arachni::Check::Base
             description: %q{
 Injects URLs and checks the browser URL to determine whether the attack was successful.
 },
-            elements:    DOM_ELEMENTS_WITH_INPUTS - [Element::LinkTemplate::DOM],
+            elements:    DOM_ELEMENTS_WITH_INPUTS - [
+                Element::LinkTemplate::DOM,
+                Element::UIInput::DOM
+            ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.1',
+            version:     '0.1.2',
 
             issue:       {
                 name:            %q{Unvalidated DOM redirect},

data/components/checks/passive/grep/captcha.rb

@@ -7,10 +7,10 @@
 =end
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2
+# @version 0.2.1
 class Arachni::Checks::Captcha < Arachni::Check::Base
 
-    CAPTCHA_RX = /captcha/i
+    CAPTCHA_RX = /.*captcha.*/i
 
     def run
         return if !page.body =~ CAPTCHA_RX
@@ -18,23 +18,32 @@ class Arachni::Checks::Captcha < Arachni::Check::Base
         # since we only care about forms parse the HTML and match forms only
         page.document.css( 'form' ).each do |form|
             # pretty dumb way to do this but it's a pretty dumb issue anyways...
-            next if !((form_html = form.to_s) =~ CAPTCHA_RX)
+            next if !(proof = find_proof( form ))
 
             log(
                 signature: CAPTCHA_RX,
-                proof:     form_html,
+                proof:     proof,
                 vector:    Element::Form.from_document( page.url, form ).first
             )
         end
     end
 
+    def find_proof( node )
+        node.css('input').each do |input|
+            html = input.to_html
+            return html if html =~ CAPTCHA_RX
+        end
+
+        nil
+    end
+
     def self.info
         {
             name:        'CAPTCHA',
             description: %q{Greps pages for forms with CAPTCHAs.},
             elements:    [ Element::Form ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2',
+            version:     '0.2.1',
 
             issue:       {
                 name:        %q{CAPTCHA protected form},

data/components/checks/passive/grep/form_upload.rb

@@ -10,14 +10,18 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.2.1
+# @version 0.2.2
 class Arachni::Checks::FormUpload < Arachni::Check::Base
 
     def run
         page.forms.each do |form|
             form.inputs.keys.each do |name|
                 next if form.details_for( name )[:type] != :file
-                log( proof: form.source, vector: form )
+
+                log(
+                    proof: form.node.xpath('input[@type="file"]').to_html,
+                    vector: form
+                )
             end
         end
     end
@@ -28,7 +32,7 @@ class Arachni::Checks::FormUpload < Arachni::Check::Base
             description: 'Logs upload forms which require manual testing.',
             elements:    [ Element::Form ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.1',
+            version:     '0.2.2',
 
             issue:       {
                 name:        %q{Form-based File Upload},

data/components/checks/passive/grep/hsts.rb

@@ -7,7 +7,7 @@
 =end
 
 # @author  Tasos Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.1
+# @version 0.1.2
 class Arachni::Checks::Hsts < Arachni::Check::Base
 
     def run
@@ -19,7 +19,7 @@ class Arachni::Checks::Hsts < Arachni::Check::Base
 
         log(
             vector: Element::Server.new( page.url ),
-            proof:  page.response.headers_string
+            proof:  page.response.status_line
         )
     end
 
@@ -28,7 +28,7 @@ class Arachni::Checks::Hsts < Arachni::Check::Base
             name:        'HTTP Strict Transport Security',
             description: %q{Checks HTTPS pages for missing `Strict-Transport-Security` headers.},
             author:      'Tasos Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.1',
+            version:     '0.1.2',
             elements:    [ Element::Server ],
 
             issue:       {

data/components/checks/passive/grep/html_objects.rb

@@ -9,11 +9,10 @@
 # Looks for HTML "object" tags.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.3
 class Arachni::Checks::HtmlObjects < Arachni::Check::Base
 
     def self.regexp
-        @regexp ||= /<object(?:.*?)>(?:.*?)<\/object>/im
+        @regexp ||= /<object.*?>.*?<\/object>/im
     end
 
     def run
@@ -30,7 +29,7 @@ class Arachni::Checks::HtmlObjects < Arachni::Check::Base
             description: description,
             elements:    [ Element::Body ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.3',
+            version:     '0.1.4',
 
             issue:       {
                 name:        %q{HTML object},

data/components/checks/passive/grep/http_only_cookies.rb

@@ -9,14 +9,13 @@
 # Logs cookies that are accessible via JavaScript.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.3
 class Arachni::Checks::HttpOnlyCookies < Arachni::Check::Base
 
     def run
         page.cookies.each do |cookie|
             next if cookie.http_only? || audited?( cookie.name )
 
-            log( vector: cookie, proof: cookie.source )
+            log( vector: cookie )
             audited( cookie.name )
         end
     end
@@ -27,7 +26,7 @@ class Arachni::Checks::HttpOnlyCookies < Arachni::Check::Base
             description: %q{Logs cookies that are accessible via JavaScript.},
             elements:    [ Element::Cookie ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.3',
+            version:     '0.1.4',
 
             issue:       {
                 name:            %q{HttpOnly cookie},

data/components/checks/passive/grep/insecure_cookies.rb

@@ -15,7 +15,7 @@ class Arachni::Checks::InsecureCookies < Arachni::Check::Base
         page.cookies.each do |cookie|
             next if cookie.secure? || audited?( cookie.name )
 
-            log( vector: cookie, proof: cookie.source )
+            log( vector: cookie )
             audited( cookie.name )
         end
     end

data/components/checks/passive/grep/password_autocomplete.rb

@@ -18,7 +18,7 @@ class Arachni::Checks::PasswordAutocomplete < Arachni::Check::Base
             next if form.simple[:autocomplete] == 'off'
             next if has_input_with_autocomplete_off? form
 
-            log( proof: form.source, vector: form )
+            log( vector: form )
         end
     end
 
@@ -36,7 +36,7 @@ class Arachni::Checks::PasswordAutocomplete < Arachni::Check::Base
                 without explicitly disabling auto-complete.},
             elements:    [ Element::Form ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.3',
+            version:     '0.3.1',
 
             issue:       {
                 name:        %q{Password field with auto-complete},

data/components/checks/passive/grep/unencrypted_password_forms.rb

@@ -23,19 +23,19 @@ class Arachni::Checks::UnencryptedPasswordForms < Arachni::Check::Base
         return if !check_form?( form )
 
         form.inputs.each do |name, v|
-            next if form.field_type_for( name ) != :password || audited?( form.id )
+            next if form.field_type_for( name ) != :password
 
             cform = form.dup
             cform.affected_input_name = name
-            log( vector: cform, proof: form.source )
-
-            print_ok( "Found unprotected password field '#{name}' at #{page.url}" )
-            audited form.id
+            log( vector: cform  )
         end
+
+        audited form.id
     end
 
     def check_form?( form )
-        uri_parse( form.action ).scheme.downcase == 'http'
+        uri_parse( form.action ).scheme == 'http' ||
+            audited?( form.id ) || !form.requires_password?
     end
 
     def self.info
@@ -45,7 +45,7 @@ class Arachni::Checks::UnencryptedPasswordForms < Arachni::Check::Base
                 over an encrypted channel (HTTPS).},
             elements:    [ Element::Form ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.2',
+            version:     '0.2.1',
 
             issue:       {
                 name:            %q{Unencrypted password form},