Class: Arachni::Checks::OsCmdInjection
- Inherits:
-
Arachni::Check::Base
- Object
- Arachni::Component::Base
- Arachni::Check::Base
- Arachni::Checks::OsCmdInjection
- Defined in:
- components/checks/active/os_cmd_injection.rb
Overview
Simple OS command injection check.
Constant Summary
Constants included from Arachni::Check::Auditor
Arachni::Check::Auditor::DOM_ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::FILE_SIGNATURES, Arachni::Check::Auditor::FILE_SIGNATURES_PER_PLATFORM, Arachni::Check::Auditor::Format, Arachni::Check::Auditor::SOURCE_CODE_SIGNATURES_PER_PLATFORM
Constants included from Arachni
BANNER, Arachni::Cookie, Form, Header, JSON, Link, LinkTemplate, NestedCookie, Severity, UIForm, UIInput, VERSION, WEBSITE, WIKI, XML
Instance Attribute Summary
Attributes included from Arachni::Check::Auditor
Class Method Summary collapse
Instance Method Summary collapse
Methods inherited from Arachni::Check::Base
#browser_cluster, #clean_up, elements, exempt_platforms, has_exempt_platforms?, has_platforms?, #initialize, platforms, #plugins, prefer, #preferred, preferred, #prepare, #session, supports_platforms?
Methods included from Arachni::Check::Auditor
#audit, #audit_differential, #audit_signature, #audit_timeout, #audited, #audited?, #buffered_audit, #each_candidate_dom_element, #each_candidate_element, has_timeout_candidates?, #http, #initialize, #log, #log_issue, #log_remote_file, #log_remote_file_if_exists, #match_and_log, #max_issues, #preferred, reset, #skip?, timeout_audit_run, #trace_taint, #with_browser, #with_browser_cluster
Methods inherited from Arachni::Component::Base
author, description, fullname, #shortname, shortname, shortname=, version
Methods included from Arachni::Component::Output
#depersonalize_output, #depersonalize_output?, #intercept_print_message
Methods included from UI::Output
#caller_location, #debug?, #debug_level, #debug_level_1?, #debug_level_2?, #debug_level_3?, #debug_level_4?, #debug_off, #debug_on, #disable_only_positives, #error_buffer, #error_log_fd, #error_logfile, #has_error_log?, #included, #log_error, #mute, #muted?, #only_positives, #only_positives?, #print_bad, #print_debug, #print_debug_backtrace, #print_debug_exception, #print_debug_level_1, #print_debug_level_2, #print_debug_level_3, #print_debug_level_4, #print_error, #print_error_backtrace, #print_exception, #print_info, #print_line, #print_ok, #print_status, #print_verbose, #reroute_to_file, #reroute_to_file?, reset_output_options, #set_error_logfile, #unmute, #verbose?, #verbose_off, #verbose_on
Methods included from Arachni::Component::Utilities
Methods included from Utilities
#available_port, available_port_mutex, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_file, #cookies_from_parser, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_parser, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_parser, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite
Methods included from Arachni
URI, collect_young_objects, #get_long_win32_filename, jruby?, null_device, profile?, windows?
Constructor Details
This class inherits a constructor from Arachni::Check::Base
Class Method Details
.info ⇒ Object
64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 |
# File 'components/checks/active/os_cmd_injection.rb', line 64 def self.info { name: 'OS command injection', description: %q{ Tries to find Operating System command injections. }, elements: ELEMENTS_WITH_INPUTS, author: 'Tasos "Zapotek" Laskos <[email protected]> ', version: '0.2.6', platforms: payloads.keys, issue: { name: %q{Operating system command injection}, description: %q{ To perform specific actions from within a web application, it is occasionally required to run Operating System commands and have the output of these commands captured by the web application and returned to the client. OS command injection occurs when user supplied input is inserted into one of these commands without proper sanitisation and is then executed by the server. Cyber-criminals will abuse this weakness to perform their own arbitrary commands on the server. This can include everything from simple `ping` commands to map the internal network, to obtaining full control of the server. Arachni was able to inject specific Operating System commands and have the output from that command contained within the server response. This indicates that proper input sanitisation is not occurring. }, references: { 'OWASP' => 'https://www.owasp.org/index.php/OS_Command_Injection', 'WASC' => 'http://projects.webappsec.org/w/page/13246950/OS%20Commanding' }, tags: %w(os command code injection regexp error), cwe: 78, severity: Severity::HIGH, remedy_guidance: %q{ It is recommended that untrusted data is never used to form a command to be executed by the OS. To validate data, the application should ensure that the supplied value contains only the characters that are required to perform the required action. For example, where the form field expects an IP address, only numbers and periods should be accepted. Additionally, all control operators (`&`, `&&`, `|`, `||`, `$`, `\`, `#`) should be explicitly denied and never accepted as valid input by the server. }, } } end |
.options ⇒ Object
17 18 19 20 21 22 23 24 25 26 27 |
# File 'components/checks/active/os_cmd_injection.rb', line 17 def self. @options ||= { signatures: { unix: [ FILE_SIGNATURES['passwd'] ], windows: FILE_SIGNATURES_PER_PLATFORM[:windows] }, format: [Format::STRAIGHT] } end |
.payloads ⇒ Object
29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 |
# File 'components/checks/active/os_cmd_injection.rb', line 29 def self.payloads @payloads ||= { unix: [ '/bin/cat /etc/passwd' ], aix: [ '/bin/cat /etc/security/passwd' ], bsd: [ '/bin/cat /etc/master.passwd', ], windows: [ 'type %SystemDrive%\\\\boot.ini', 'type %SystemRoot%\\\\win.ini' ] }.inject({}) do |h, (platform, payloads)| h[platform] ||= [] payloads.each do |payload| h[platform] << "#{payload}" ['', '\'', '"'].each do |q| h[platform] |= [ '&&', '|', ';' ]. map { |sep| "#{q} #{sep} #{payload} #{sep} #{q}" } end h[platform] << "` #{payload}`" end h end end |
Instance Method Details
#run ⇒ Object
60 61 62 |
# File 'components/checks/active/os_cmd_injection.rb', line 60 def run audit self.class.payloads, self.class. end |