Class: Arachni::Checks::Xss

Inherits:
Arachni::Check::Base show all
Defined in:
components/checks/active/xss.rb

Overview

Injects an HTML element into page inputs and then parses the HTML markup of tainted responses to look for proof of vulnerability.

If this rudimentary check fails, tainted responses are forwarded to the BrowserCluster for evaluation and taint-tracing.

See Also:

Author:

Constant Summary

Constants included from Arachni::Check::Auditor

Arachni::Check::Auditor::DOM_ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::FILE_SIGNATURES, Arachni::Check::Auditor::FILE_SIGNATURES_PER_PLATFORM, Arachni::Check::Auditor::Format, Arachni::Check::Auditor::SOURCE_CODE_SIGNATURES_PER_PLATFORM

Constants included from Arachni

BANNER, Arachni::Cookie, Form, Header, JSON, Link, LinkTemplate, NestedCookie, Severity, UIForm, UIInput, VERSION, WEBSITE, WIKI, XML

Instance Attribute Summary

Attributes included from Arachni::Check::Auditor

#framework, #page

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Arachni::Check::Base

#browser_cluster, #clean_up, elements, exempt_platforms, has_exempt_platforms?, has_platforms?, #initialize, platforms, #plugins, prefer, #preferred, preferred, #prepare, #session, supports_platforms?

Methods included from Arachni::Check::Auditor

#audit, #audit_differential, #audit_signature, #audit_timeout, #audited, #audited?, #buffered_audit, #each_candidate_dom_element, #each_candidate_element, has_timeout_candidates?, #http, #initialize, #log, #log_issue, #log_remote_file, #log_remote_file_if_exists, #match_and_log, #max_issues, #preferred, reset, #skip?, timeout_audit_run, #trace_taint, #with_browser, #with_browser_cluster

Methods inherited from Arachni::Component::Base

author, description, fullname, #shortname, shortname, shortname=, version

Methods included from Arachni::Component::Output

#depersonalize_output, #depersonalize_output?, #intercept_print_message

Methods included from UI::Output

#caller_location, #debug?, #debug_level, #debug_level_1?, #debug_level_2?, #debug_level_3?, #debug_level_4?, #debug_off, #debug_on, #disable_only_positives, #error_buffer, #error_log_fd, #error_logfile, #has_error_log?, #included, #log_error, #mute, #muted?, #only_positives, #only_positives?, #print_bad, #print_debug, #print_debug_backtrace, #print_debug_exception, #print_debug_level_1, #print_debug_level_2, #print_debug_level_3, #print_debug_level_4, #print_error, #print_error_backtrace, #print_exception, #print_info, #print_line, #print_ok, #print_status, #print_verbose, #reroute_to_file, #reroute_to_file?, reset_output_options, #set_error_logfile, #unmute, #verbose?, #verbose_off, #verbose_on

Methods included from Arachni::Component::Utilities

#read_file

Methods included from Utilities

#available_port, available_port_mutex, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_file, #cookies_from_parser, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_parser, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_parser, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite

Methods included from Arachni

URI, collect_young_objects, #get_long_win32_filename, jruby?, null_device, profile?, windows?

Constructor Details

This class inherits a constructor from Arachni::Check::Base

Class Method Details

.check_browser_result(result, element, referring_page, cluster) ⇒ Object 



105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'components/checks/active/xss.rb', line 105

def self.check_browser_result( result, element, referring_page, cluster )
    page = result.page

    # At this point further checks will be body based, identical
    # bodies will yield identical results.
    key = "traced-#{page.body.hash}".hash
    return if optimization_cache[key] == :traced
    optimization_cache[key] = :traced

    print_info 'Checking results of deferred taint analysis.'

    return if !(proof = find_proof( page ))

    log(
        vector:         element,
        proof:          proof,
        page:           page,
        referring_page: referring_page
    )
end

.check_browser_result_cb ⇒ Object 



126
127
128
 
# File 'components/checks/active/xss.rb', line 126

def self.check_browser_result_cb
    @check_browser_result_cb ||= method(:check_browser_result)
end

.find_proof(resource) ⇒ Object 



130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
 
# File 'components/checks/active/xss.rb', line 130

def self.find_proof( resource )
    return if !resource.body.has_html_tag?( self.tag_name )

    proof_nodes = Arachni::Parser.parse(
        resource.body,
        whitelist:     [self.tag_name, 'textarea'],
        stop_on_first: [self.tag_name]
    ).nodes_by_name( self.tag_name )

    return if proof_nodes.empty?

    proof = proof_nodes.find do |e|
        e.parent.name != :textarea
    end

    return if !proof

    proof.to_html
end

.info ⇒ Object 



150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
 
# File 'components/checks/active/xss.rb', line 150

def self.info
    {
        name:        'XSS',
        description: %q{
Injects an HTML element into page inputs and then parses the HTML markup of
tainted responses to look for proof of vulnerability.
},
        elements:    [Element::Form, Element::Link, Element::Cookie,
             Element::NestedCookie, Element::Header, Element::LinkTemplate],
        author:      'Tasos "Zapotek" Laskos <[email protected]> ',
        version:     '0.4.10',

        issue:       {
            name:            %q{Cross-Site Scripting (XSS)},
            description:     %q{
Client-side scripts are used extensively by modern web applications.
They perform from simple functions (such as the formatting of text) up to full
manipulation of client-side data and Operating System interaction.

Cross Site Scripting (XSS) allows clients to inject scripts into a request and
have the server return the script to the client in the response. This occurs
because the application is taking untrusted data (in this example, from the client)
and reusing it without performing any validation or sanitisation.

If the injected script is returned immediately this is known as reflected XSS.
If the injected script is stored by the server and returned to any client visiting
the affected page, then this is known as persistent XSS (also stored XSS).

Arachni has discovered that it is possible to insert script content directly into
HTML element content.
},
            references:  {
                'Secunia' => 'http://secunia.com/advisories/9716/',
                'WASC'    => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
                'OWASP'   => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
            },
            tags:            %w(xss regexp injection script),
            cwe:             79,
            severity:        Severity::HIGH,
            remedy_guidance: %q{
To remedy XSS vulnerabilities, it is important to never use untrusted or unfiltered
data within the code of a HTML page.

Untrusted data can originate not only form the client but potentially a third
party or previously uploaded file etc.

Filtering of untrusted data typically involves converting special characters to
their HTML entity encoded counterparts (however, other methods do exist, see references).
These special characters include:

* `&`
* `<`
* `>`
* `"`
* `'`
* `/`

An example of HTML entity encoding is converting `<` to `&lt;`.

Although it is possible to filter untrusted input, there are five locations
within an HTML page where untrusted input (even if it has been filtered) should
never be placed:

1. Directly in a script.
2. Inside an HTML comment.
3. In an attribute name.
4. In a tag name.
5. Directly in CSS.

Each of these locations have their own form of escaping and filtering.

_Because many browsers attempt to implement XSS protection, any manual verification
of this finding should be conducted using multiple different browsers and browser
versions._
}
        }
    }
end

.optimization_cache ⇒ Object 



49
50
51
 
# File 'components/checks/active/xss.rb', line 49

def self.optimization_cache
    @optimization_cache ||= {}
end

.options ⇒ Object 



43
44
45
46
47
 
# File 'components/checks/active/xss.rb', line 43

def self.options
    @options ||= {
        format: [Format::APPEND]
    }
end

.strings ⇒ Object 



30
31
32
33
34
35
36
37
38
39
40
41
 
# File 'components/checks/active/xss.rb', line 30

def self.strings
    @strings ||= [
        # Straight injection.
        tag,

        # Go for an error.
        "()\"&%1'-;#{tag}'",

        # Break out of HTML comments and text areas.
        "</textarea>-->#{tag}<!--<textarea>"
    ].map{ |p| [p, Form.encode( p ) ]}.flatten.uniq
end

.tag ⇒ Object 



26
27
28
 
# File 'components/checks/active/xss.rb', line 26

def self.tag
    "<#{tag_name}/>"
end

.tag_name ⇒ Object 



22
23
24
 
# File 'components/checks/active/xss.rb', line 22

def self.tag_name
    "#{shortname}_#{random_seed}"
end

Instance Method Details

#check_and_log(response, element) ⇒ Object 



71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
 
# File 'components/checks/active/xss.rb', line 71

def check_and_log( response, element )
    # Bail out if the response is not tainted unless we're dealing with a Link.
    # The other cases either don't matter or are covered by the xss_dom check.
    if (self.class.elements - [Arachni::Link]).include?( element.class ) &&
        !response.body.downcase.include?( self.class.tag )

        return :checked
    end

    # See if we managed to successfully inject our element in the doc tree.
    if self.class.find_proof( response )
        log vector: element, proof: self.class.tag, response: response
        return :checked
    end

    # No idea what was returned, but we can't work with it.
    return :checked if !response.to_page.has_script?

    with_browser_cluster do |cluster|
        print_info 'Progressing to deferred browser evaluation of response.'

        # Pass the response to the BrowserCluster for evaluation and see if the
        # element appears in the doc tree now.
        cluster.trace_taint(
            response,
            {
                taint: self.class.tag,
                args:  [element, page]
            },
            self.class.check_browser_result_cb
        )
    end
end

#optimization_cache ⇒ Object 



52
53
54
 
# File 'components/checks/active/xss.rb', line 52

def optimization_cache
    self.class.optimization_cache
end

#run ⇒ Object 



56
57
58
59
60
61
62
63
64
65
66
67
68
69
 
# File 'components/checks/active/xss.rb', line 56

def run
    audit( self.class.strings, self.class.options ) do |response, element|
        next if !response.html?

        # If there's no vuln responses will usually be identical, so bail
        # out early.
        # If responses aren't identical due to noise, well, we're not losing
        # much.
        k = "#{response.url.hash}-#{response.body.hash}".hash
        next if optimization_cache[k] == :checked

        optimization_cache[k] = check_and_log( response, element )
    end
end