arachni 1.5.1 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: f1728e58117259b5f10e529734b0643b91e04635
-  data.tar.gz: 656bbd3c108692ca6764795a47ade985735b0b9a
+SHA256:
+  metadata.gz: dd7e309d9d2b470547087e8876ff7cd964633f3a957fb66f68b408908e65ec7a
+  data.tar.gz: 70dd90857dcec49ffe11838b58fa4446af926bc16f09b7c1d4445f7175835eca
 SHA512:
-  metadata.gz: a072ffdf8586c6206de12bf6717343d0cf96c1bf3450f35756408f48758cdbaa6c8cffe18ce6d950e8017bcb48eb008d9dccf94a1c756d38a6b5172151024c35
-  data.tar.gz: e073d1da05c8a8e4697803946ef42f7bfd22ca32878f471f3920bc6d7dcf17fd85aa3d4c1d3ef9d23bc3f064e06a5cb5591875b58f0571ff4b2585ba2273b279
+  metadata.gz: 184b53b149a25cd512a88e96109e1289322d5cd403e96176a395656081531d917982b298924e80aff2fc4750f30ffa3ead392780737e4321d577051856e4be38
+  data.tar.gz: 3aaf63cc591b6af068ed2e048b7cca228d78f870cb6a706290fee6618ce5c436f8a57b2425a4511e6adc2279da17795de283fb93d0c921544621c961eb828d23

data/CHANGELOG.md

@@ -1,5 +1,49 @@
 # ChangeLog
 
+## 1.6.0 _(March 4, 2022)_
+
+- Options
+    - Scope
+        - `--scope-dom-depth-limit` -- Changed default from `5` to `4`.
+        - `--scope-auto-redundant` -- Changed default from `inf` to `15`.
+        - `--scope-directory-depth-limit` -- Changed default from `inf` to `10`.
+    - Browser cluster
+        - `--browser-cluster-pool-size` -- Changed default from `5` to `4`.
+    - HTTP
+       - `--http-max-concurrency` -- Changed default from `20` to `10`.
+    - New
+        - `--scope-dom-event-inheritance-limit` -- Limits the amount of inherited events.
+        - `--browser-cluster-session-storage` -- Sets the browsers' session storage.
+        - `--browser-cluster-wait-for-timers` -- Wait for the maximum `setTimeout()`
+           -- Used to be hardcoded to `true`, now defaults to `false`.
+- `URI`
+    - `#encode` -- Fixed encoding order of `+`.
+    - `#decode` -- Fixed decoding order of `+`.
+- `Element`
+    - Added `NestedCookie`: Handles key-value pairs inside individual cookies.
+- `Browser` -- Replaced PhantomJS with headless Chrome.
+    - `Javascript`
+        - `DOMMonitor`
+            - `#elements_with_events` -- Optionally limits event inheritance.
+- `Rest::Server`
+    - Added `/scans/:id/report.afr`.
+    - Added error handling for when trying to connect to killed instances.
+- `Support`
+    - `Database` -- Updated to compress disk data.
+- `Parser` -- Recode node data to UTF-8.
+- `Process`
+    - `Manager`
+        - `#spawn` -- Pass Arachni options via `ENV` rather than `ARGV`.
+- Checks
+    - Active
+        - `xss` -- Fixed proof data to return HTML.
+        - `csrf` -- Disabled for pages with DOM transitions due to FPs.
+    - Passive
+        - `x_frame_options` -- Ignore non-200 pages.
+        - `common_directories` -- Look for `.git`.
+- Plugins
+    - `proxy` -- Fixed error on login sequence recording.
+
 ## 1.5.1 _(March 29, 2017)_
 
 - `config/write_paths.yml` -- Added configurable temporary directory.

data/Gemfile

@@ -1,6 +1,6 @@
 source 'https://rubygems.org'
 
-gem 'rake', '11.3.0'
+gem 'rake', '>= 12.3.3'
 gem 'pry'
 
 group :docs do
@@ -9,9 +9,7 @@ group :docs do
 end
 
 group :spec do
-    gem 'simplecov', require: false, group: :test
-
-    gem 'rspec', '2.99.0'
+    gem 'rspec'
     gem 'faker'
 end
 

data/LICENSE.md

@@ -1,6 +1,6 @@
 # License
 
-Copyright 2010-2017 [Sarosys LLC](http://www.sarosys.com).
+Copyright 2010-2022 [Ecsypno](http://www.ecsypno.com).
 
 ```
                     Arachni Public Source License

data/README.md

@@ -3,7 +3,7 @@
 <table>
     <tr>
         <th>Version</th>
-        <td>1.5.1</td>
+        <td>1.6.0</td>
     </tr>
     <tr>
         <th>Homepage</th>
@@ -38,7 +38,7 @@
     </tr>
     <tr>
         <th>Copyright</th>
-        <td>2010-2017 <a href="http://www.sarosys.com">Sarosys LLC</a></td>
+        <td>2010-2022 <a href="http://www.ecsypno.com">Ecsypno</a></td>
     </tr>
     <tr>
         <th>License</th>
@@ -228,6 +228,7 @@ Arachni is able to extract and audit the following elements and their inputs:
     - Along with ones that have client-side parameters in their URL fragments, i.e.:
             `http://example.com/#/param/val/param2/val2`
  - Cookies
+    - Also supports nested cookies, containing key-value pairs inside individual cookies.
  - Headers
  - Generic client-side elements which have associated DOM events.
  - AJAX-request parameters.

data/Rakefile

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/arachni.gemspec

@@ -1,6 +1,6 @@
 # coding: utf-8
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -10,7 +10,7 @@
 Gem::Specification.new do |s|
     require File.expand_path( File.dirname( __FILE__ ) ) + '/lib/arachni/version'
 
-    s.required_ruby_version = '>= 2.2.0'
+    s.required_ruby_version = '>= 2.3.0'
 
     s.name              = 'arachni'
     s.version           = Arachni::VERSION
@@ -43,76 +43,76 @@ Gem::Specification.new do |s|
 
     s.add_dependency 'awesome_print',       '1.6.1'
 
-    s.add_dependency 'rack',                '1.6.4'
+    s.add_dependency 'rack',                '2.2.3'
+    s.add_dependency 'rack-test'
 
     # Don't specify version, messes with the packages since they always grab the
     # latest one.
     s.add_dependency 'bundler'
 
-    s.add_dependency 'concurrent-ruby',     '1.0.2'
-    s.add_dependency 'concurrent-ruby-ext', '1.0.2'
+    s.add_dependency 'concurrent-ruby',     '1.0.5'
+    s.add_dependency 'concurrent-ruby-ext', '1.0.5'
 
     # For compressing/decompressing system state archives.
-    s.add_dependency 'rubyzip',             '1.2.1'
+    s.add_dependency 'rubyzip',             '>= 1.3.0'
 
     # HTTP proxy server
     s.add_dependency 'http_parser.rb',      '0.6.0'
 
     # HTML report
-    s.add_dependency 'coderay',             '1.1.0'
+    s.add_dependency 'coderay',             '1.1.2'
 
-    s.add_dependency 'childprocess',        '0.5.3'
+    s.add_dependency 'childprocess',        '0.9.0'
 
     # RPC serialization.
-    s.add_dependency 'msgpack',             '0.7.0'
+    s.add_dependency 'msgpack',             '1.2.4'
 
     if RUBY_PLATFORM != 'java'
         # Optimized JSON.
-        s.add_dependency 'oj',              '2.15.0'
+        s.add_dependency 'oj',              '3.6.5'
         s.add_dependency 'oj_mimic_json',   '1.0.1'
     end
 
     # Web server
-    s.add_dependency 'puma',                '2.14.0'
+    s.add_dependency 'puma',                '>= 4.3.9'
 
     # REST API
-    s.add_dependency 'sinatra',             '1.4.6'
-    s.add_dependency 'sinatra-contrib',     '1.4.6'
+    s.add_dependency 'sinatra',             '2.1.0'
+    s.add_dependency 'sinatra-contrib',     '2.1.0'
 
     # RPC client/server implementation.
     s.add_dependency 'arachni-rpc',         '~> 0.2.1.4'
 
     # HTTP client.
-    s.add_dependency 'typhoeus',            '1.0.2'
+    s.add_dependency 'typhoeus',            '1.3.0'
 
     # Fallback URI parsing and encoding utilities.
-    s.add_dependency 'addressable',         '2.3.6'
+    s.add_dependency 'addressable',         '>= 2.8.0'
 
     # E-mail plugin.
-    s.add_dependency 'pony',                '1.11'
+    s.add_dependency 'pony',                '1.12'
 
     # For the Arachni console (arachni_console).
-    s.add_dependency 'rb-readline',         '0.5.1'
+    s.add_dependency 'rb-readline',         '0.5.5'
 
     # Markup parsing, for reports and Element::XML.
-    s.add_dependency 'nokogiri',            '1.6.8.1'
+    s.add_dependency 'nokogiri'
     # Really fast and lightweight markup parsing, for pages.
-    s.add_dependency 'ox',                  '2.4.11'
+    s.add_dependency 'ox',                  '2.9.4'
 
     # Outputting data in table format (arachni_rpcd_monitor).
-    s.add_dependency 'terminal-table',      '1.4.5'
+    s.add_dependency 'terminal-table',      '1.8.0'
 
     # Browser support for DOM/JS/AJAX analysis stuff.
-    # Lock webdriver, newer versions has issues.
-    s.add_dependency 'selenium-webdriver',  '3.0.1'
-    s.add_dependency 'watir-webdriver',     '0.8.0'
+    s.add_dependency 'watir',               '6.19.1'
+    s.add_dependency 'selenium-webdriver',  '4.1.0'
 
     # Markdown to HTML conversion, used by the HTML report for component
     # descriptions.
-    s.add_dependency 'kramdown',            '1.4.1'
+    s.add_dependency 'kramdown',            '>= 2.3.0'
 
     # Used to scrub Markdown for XSS etc.
-    s.add_dependency 'loofah',              '2.0.3'
+    s.add_dependency 'loofah',              '>= 2.3.1'
 
     s.post_install_message = <<MSG
 
@@ -129,7 +129,7 @@ License            - Arachni Public Source License v1.0
                         (https://github.com/Arachni/arachni/blob/master/LICENSE.md)
 Author             - Tasos "Zapotek" Laskos (http://twitter.com/Zap0tek)
 Twitter            - http://twitter.com/ArachniScanner
-Copyright          - 2010-2017 Sarosys LLC (http://www.sarosys.com)
+Copyright          - 2010-2022 Ecsypno (http://www.ecsypno.com)
 
 Please do not hesitate to ask for assistance (via the support portal)
 or report a bug (via GitHub Issues) if you come across any problem.

data/bin/arachni

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_console

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_multi

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_reporter

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_reproduce

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_rest_server

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_restore

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_rpc

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_rpcd

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_rpcd_monitor

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/bin/arachni_script

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/code_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/code_injection_php_input_wrapper.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/code_injection_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/csrf.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -40,6 +40,11 @@
 class Arachni::Checks::CSRF < Arachni::Check::Base
 
     def run
+        # TODO:
+        #   Check forms that were created dynamically via JS.
+        #   Maybe add a csrf_dom check?
+        return if page.dom.transitions.any?
+
         print_status 'Looking for CSRF candidates...'
         print_status 'Simulating logged-out user.'
 
@@ -95,7 +100,7 @@ checks them for lack of anti-CSRF tokens.
 },
             elements:    [ Element::Form ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.4',
+            version:     '0.4.1',
 
             issue:       {
                 name:            %q{Cross-Site Request Forgery},

data/components/checks/active/file_inclusion.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/ldap_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/no_sql_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/no_sql_injection_differential.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -37,9 +37,9 @@ It uses differential analysis to determine how different inputs affect the behav
 of the web application and checks if the displayed behavior is consistent with
 that of a vulnerable application.
 },
-            elements:    [ Element::Link, Element::Form, Element::Cookie ],
+            elements:    [ Element::Link, Element::Form, Element::Cookie, Element::NestedCookie ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.2',
+            version:     '0.1.3',
             platforms:   [ :nosql ],
 
             issue:       {

data/components/checks/active/os_cmd_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/os_cmd_injection_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/path_traversal.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/response_splitting.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/rfi.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/session_fixation.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/source_code_disclosure.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/sql_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/sql_injection_differential.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -55,9 +55,9 @@ It uses differential analysis to determine how different inputs affect behavior
 of the web application and checks if the displayed behavior is consistent with
 that of a vulnerable application.
 },
-            elements:    [ Element::Link, Element::Form, Element::Cookie ],
+            elements:    [ Element::Link, Element::Form, Element::Cookie, Element::NestedCookie ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.4.4',
+            version:     '0.4.5',
             platforms:   [ :sql ],
 
             issue:       {

data/components/checks/active/sql_injection_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/trainer.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/unvalidated_redirect.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/unvalidated_redirect_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/xpath_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/xss.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -144,7 +144,7 @@ class Arachni::Checks::Xss < Arachni::Check::Base
 
         return if !proof
 
-        proof
+        proof.to_html
     end
 
     def self.info
@@ -155,9 +155,9 @@ Injects an HTML element into page inputs and then parses the HTML markup of
 tainted responses to look for proof of vulnerability.
 },
             elements:    [Element::Form, Element::Link, Element::Cookie,
-                          Element::Header, Element::LinkTemplate],
+                 Element::NestedCookie, Element::Header, Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.4.9',
+            version:     '0.4.10',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS)},

data/components/checks/active/xss_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/xss_dom_script_context.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework