Class: Arachni::Checks::CodeInjection
- Inherits:
-
Arachni::Check::Base
- Object
- Arachni::Component::Base
- Arachni::Check::Base
- Arachni::Checks::CodeInjection
- Defined in:
- components/checks/active/code_injection.rb
Overview
It's designed to work with PHP, Perl, Python, Java, ASP and Ruby but still needs some more testing.
Constant Summary
Constants included from Arachni::Check::Auditor
Arachni::Check::Auditor::DOM_ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::FILE_SIGNATURES, Arachni::Check::Auditor::FILE_SIGNATURES_PER_PLATFORM, Arachni::Check::Auditor::Format, Arachni::Check::Auditor::SOURCE_CODE_SIGNATURES_PER_PLATFORM
Constants included from Arachni
BANNER, Arachni::Cookie, Form, Header, JSON, Link, LinkTemplate, NestedCookie, Severity, UIForm, UIInput, VERSION, WEBSITE, WIKI, XML
Instance Attribute Summary
Attributes included from Arachni::Check::Auditor
Class Method Summary collapse
- .code_strings ⇒ Object
- .info ⇒ Object
- .options ⇒ Object
- .payloads ⇒ Object
- .rand1 ⇒ Object
- .rand2 ⇒ Object
Instance Method Summary collapse
Methods inherited from Arachni::Check::Base
#browser_cluster, #clean_up, elements, exempt_platforms, has_exempt_platforms?, has_platforms?, #initialize, platforms, #plugins, prefer, #preferred, preferred, #prepare, #session, supports_platforms?
Methods included from Arachni::Check::Auditor
#audit, #audit_differential, #audit_signature, #audit_timeout, #audited, #audited?, #buffered_audit, #each_candidate_dom_element, #each_candidate_element, has_timeout_candidates?, #http, #initialize, #log, #log_issue, #log_remote_file, #log_remote_file_if_exists, #match_and_log, #max_issues, #preferred, reset, #skip?, timeout_audit_run, #trace_taint, #with_browser, #with_browser_cluster
Methods inherited from Arachni::Component::Base
author, description, fullname, #shortname, shortname, shortname=, version
Methods included from Arachni::Component::Output
#depersonalize_output, #depersonalize_output?, #intercept_print_message
Methods included from UI::Output
#caller_location, #debug?, #debug_level, #debug_level_1?, #debug_level_2?, #debug_level_3?, #debug_level_4?, #debug_off, #debug_on, #disable_only_positives, #error_buffer, #error_log_fd, #error_logfile, #has_error_log?, #included, #log_error, #mute, #muted?, #only_positives, #only_positives?, #print_bad, #print_debug, #print_debug_backtrace, #print_debug_exception, #print_debug_level_1, #print_debug_level_2, #print_debug_level_3, #print_debug_level_4, #print_error, #print_error_backtrace, #print_exception, #print_info, #print_line, #print_ok, #print_status, #print_verbose, #reroute_to_file, #reroute_to_file?, reset_output_options, #set_error_logfile, #unmute, #verbose?, #verbose_off, #verbose_on
Methods included from Arachni::Component::Utilities
Methods included from Utilities
#available_port, available_port_mutex, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_file, #cookies_from_parser, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_parser, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_parser, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite
Methods included from Arachni
URI, collect_young_objects, #get_long_win32_filename, jruby?, null_device, profile?, windows?
Constructor Details
This class inherits a constructor from Arachni::Check::Base
Class Method Details
.code_strings ⇒ Object
38 39 40 41 42 43 44 45 46 |
# File 'components/checks/active/code_injection.rb', line 38 def self.code_strings # code strings to be injected to the webapp @code_strings ||= { php: "print #{rand1}*#{rand2};", perl: "print #{rand1}*#{rand2};", python: "print #{rand1}*#{rand2}", asp: "Response.Write\x28#{rand1}*#{rand2}\x29" } end |
.info ⇒ Object
63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 |
# File 'components/checks/active/code_injection.rb', line 63 def self.info { name: 'Code injection', description: %q{ Injects code snippets and assess whether or not execution was successful. }, elements: ELEMENTS_WITH_INPUTS, author: 'Tasos "Zapotek" Laskos <[email protected]>', version: '0.2.5', platforms: payloads.keys, issue: { name: %q{Code injection}, description: %q{ A modern web application will be reliant on several different programming languages. These languages can be broken up in two flavours. These are client-side languages (such as those that run in the browser -- like JavaScript) and server-side languages (which are executed by the server -- like ASP, PHP, JSP, etc.) to form the dynamic pages (client-side code) that are then sent to the client. Because all server-side code should be executed by the server, it should only ever come from a trusted source. Code injection occurs when the server takes untrusted code (ie. from the client) and executes it. Cyber-criminals will abuse this weakness to execute arbitrary code on the server, which could result in complete server compromise. Arachni was able to inject specific server-side code and have the executed output from the code contained within the server response. This indicates that proper input sanitisation is not occurring. }, references: { 'PHP' => 'http://php.net/manual/en/function.eval.php', 'Perl' => 'http://perldoc.perl.org/functions/eval.html', 'Python' => 'http://docs.python.org/py3k/library/functions.html#eval', 'ASP' => 'http://www.aspdev.org/asp/asp-eval-execute/', }, tags: %w(code injection regexp), cwe: 94, severity: Severity::HIGH, remedy_guidance: %q{ It is recommended that untrusted input is never processed as server-side code. To validate input, the application should ensure that the supplied value contains only the data that are required to perform the relevant action. For example, where a username is required, then no non-alpha characters should not be accepted. } } } end |
.options ⇒ Object
31 32 33 34 35 36 |
# File 'components/checks/active/code_injection.rb', line 31 def self. @options ||= { signatures: (rand1.to_i * rand2.to_i).to_s, format: [Format::STRAIGHT] } end |
.payloads ⇒ Object
48 49 50 51 52 53 54 55 56 57 |
# File 'components/checks/active/code_injection.rb', line 48 def self.payloads return @payloads if @payloads @payloads = {} code_strings.each do |platform, payload| @payloads[platform] = [ ';%s', "\";%s#", "';%s#" ]. map { |var| var % payload } | [payload] end @payloads end |
.rand1 ⇒ Object
23 24 25 |
# File 'components/checks/active/code_injection.rb', line 23 def self.rand1 @rand1 ||= '28763' end |
.rand2 ⇒ Object
27 28 29 |
# File 'components/checks/active/code_injection.rb', line 27 def self.rand2 @rand2 ||= '4196403' end |
Instance Method Details
#run ⇒ Object
59 60 61 |
# File 'components/checks/active/code_injection.rb', line 59 def run audit( self.class.payloads, self.class. ) end |