Class: Arachni::Framework

Inherits:
Object show all
Includes:
Module::Utilities, UI::Output
Defined in:
lib/framework.rb

Overview

Arachni::Framework class

The Framework class ties together all the components.<br/> It should be wrapped by a UI class.

It’s the brains of the operation, it bosses the rest of the classes around.<br/> It runs the audit, loads modules and reports and runs them according to user options.

@author: Tasos “Zapotek” Laskos

<[email protected]>
<[email protected]>

@version: 0.2.1

Direct Known Subclasses

RPC::XML::Server::Framework

Constant Summary collapse

REVISION =

the version of this class

'0.2.1'

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from Module::Utilities

#exception_jail, #get_path, #normalize_url, #read_file, #seed

Methods included from UI::Output

#buffer, #debug!, #debug?, #flush_buffer, #mute!, #muted?, #only_positives!, #only_positives?, #print_debug, #print_debug_backtrace, #print_debug_pp, #print_error, #print_error_backtrace, #print_info, #print_line, #print_ok, #print_status, #print_verbose, #reroute_to_file, #reroute_to_file?, #unmute!, #verbose!, #verbose?

Constructor Details

#initialize(opts) ⇒ Framework

Initializes system components.

Parameters:



128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
 
# File 'lib/framework.rb', line 128

def initialize( opts )

    Encoding.default_external = "BINARY"
    Encoding.default_internal = "BINARY"

    @opts = opts

    @modules = Arachni::Module::Manager.new( @opts )
    @reports = Arachni::Report::Manager.new( @opts )
    @plugins = Arachni::Plugin::Manager.new( self )

    @page_queue = Queue.new

    prepare_cookie_jar( )
    prepare_user_agent( )

    # deep clone the redundancy rules to preserve their counter
    # for the reports
    @orig_redundant = @opts.redundant.deep_clone

    @running = false
    @paused  = []

    @plugin_store = {}

    @current_url = ''
end

Instance Attribute Details

#auditmap ⇒ Object (readonly)

Returns the value of attribute auditmap.



108
109
110
 
# File 'lib/framework.rb', line 108

def auditmap
  @auditmap
end

#http ⇒ Arachni::HTTP (readonly)

Returns:



105
106
107
 
# File 'lib/framework.rb', line 105

def http
  @http
end

#modules ⇒ Arachni::Module::Manager (readonly)

Returns module manager.

Returns:



90
91
92
 
# File 'lib/framework.rb', line 90

def modules
  @modules
end

#opts ⇒ Options (readonly)

Instance options

Returns:



80
81
82
 
# File 'lib/framework.rb', line 80

def opts
  @opts
end

#page_queue ⇒ Queue<Arachni::Parser::Page> (readonly)

Holds candidate pages to be audited.

Pages in the queue are pushed in by the trainer, the queue doesn’t hold pages returned by the spider.

Plug-ins can push their own pages to be audited if they wish to…

Returns:



120
121
122
 
# File 'lib/framework.rb', line 120

def page_queue
  @page_queue
end

#plugins ⇒ Arachni::Plugin::Manager (readonly)

Returns plugin manager.

Returns:



95
96
97
 
# File 'lib/framework.rb', line 95

def plugins
  @plugins
end

#reports ⇒ Arachni::Report::Manager (readonly)

Returns report manager.

Returns:



85
86
87
 
# File 'lib/framework.rb', line 85

def reports
  @reports
end

#sitemap ⇒ Object (readonly)

Returns the value of attribute sitemap.



107
108
109
 
# File 'lib/framework.rb', line 107

def sitemap
  @sitemap
end

#spider ⇒ Arachni::Spider (readonly)

Returns spider.

Returns:



100
101
102
 
# File 'lib/framework.rb', line 100

def spider
  @spider
end

Instance Method Details

#audit ⇒ Object

Audits the site.

Runs the spider, analyzes each page as it appears and passes it to (#run_mods} to be audited.



238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
 
# File 'lib/framework.rb', line 238

def audit

    wait_if_paused

    @spider = Arachni::Spider.new( @opts )

    @sitemap  ||= []
    @auditmap ||= []

    # initiates the crawl
    @spider.run {
        |page|

        @sitemap |= @spider.pages

        @page_queue << page
        audit_queue if !@opts.spider_first
    }

    audit_queue

    if( @opts.http_harvest_last )
        harvest_http_responses( )
    end

end

#audit_queue ⇒ Object 



265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
 
# File 'lib/framework.rb', line 265

def audit_queue

    # this will run until no new elements appear for the given page
    while( !@page_queue.empty? && page = @page_queue.pop )

        # audit the page
        exception_jail{ run_mods( page ) }

        # run all the queued HTTP requests and harvest the responses
        http.run

        # check to see if the page was updated
        page = http.trainer.page
        # and push it in the queue to be audited as well
        @page_queue << page if page

    end
end

#audit_store(fresh = false) ⇒ AuditStore

Returns the results of the audit as an AuditStore instance

Returns:

See Also:



292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
 
# File 'lib/framework.rb', line 292

def audit_store( fresh = false )

    # restore the original redundacy rules and their counters
    @opts.redundant = @orig_redundant
    opts = @opts.to_h
    opts['mods'] = @modules.keys

    if( !fresh && @store )
        return @store
    else
        return @store = AuditStore.new( {
            :version  => version( ),
            :revision => REVISION,
            :options  => opts,
            :sitemap  => @sitemap ? @sitemap.sort : ['N/A'],
            :issues   => @modules.results( ).deep_clone,
            :plugins  => @plugin_store
        }, self )
     end
end

#lsmod ⇒ Array<Hash>

Returns an array of hashes with information about all available modules

Returns:

  • (Array<Hash>) 


335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
 
# File 'lib/framework.rb', line 335

def lsmod

    mod_info = []
    @modules.available( ).each {
        |name|

        path = @modules.name_to_path( name )
        next if !lsmod_match?( path )

        info = @modules[name].info( )

        info[:mod_name]    = name
        info[:name]        = info[:name].strip
        info[:description] = info[:description].strip

        if( !info[:dependencies] )
            info[:dependencies] = []
        end

        info[:author]    = info[:author].strip
        info[:version]   = info[:version].strip
        info[:path]      = path.strip

        mod_info << info
    }

    # unload all modules
    @modules.clear( )

    return mod_info

end

#lsplug ⇒ Array<Hash>

Returns an array of hashes with information about all available reports

Returns:

  • (Array<Hash>) 


398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
 
# File 'lib/framework.rb', line 398

def lsplug

    plug_info = []

    @plugins.available( ).each {
        |plugin|

        info = @plugins[plugin].info

        info[:plug_name]   = plugin
        info[:path]        = @plugins.name_to_path( plugin )

        plug_info << info
    }

    @plugins.clear( )

    return plug_info
end

#lsrep ⇒ Array<Hash>

Returns an array of hashes with information about all available reports

Returns:

  • (Array<Hash>) 


374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
 
# File 'lib/framework.rb', line 374

def lsrep

    rep_info = []
    @reports.available( ).each {
        |report|

        info = @reports[report].info

        info[:rep_name]    = report
        info[:path]        = @reports.name_to_path( report )

        rep_info << info
    }
    @reports.clear( )

    return rep_info
end

#pause! ⇒ Object 



426
427
428
429
 
# File 'lib/framework.rb', line 426

def pause!
    @paused << caller
    return true
end

#paused? ⇒ Boolean

Returns:

  • (Boolean) 


422
423
424
 
# File 'lib/framework.rb', line 422

def paused?
    !@paused.empty?
end

#plugin_store(plugin, obj) ⇒ Object 



313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
 
# File 'lib/framework.rb', line 313

def plugin_store( plugin, obj )
    name = ''
    @plugins.each_pair {
        |k, v|

        if plugin.class.name == v.name
            name = k
            break
        end
    }

    @plugin_store[name] = {
        :results => obj
    }.merge( plugin.class.info )
end

#resume! ⇒ Object 



431
432
433
434
 
# File 'lib/framework.rb', line 431

def resume!
    @paused.delete( caller )
    return true
end

#revision ⇒ String

Returns the revision of the Arachni::Framework (this) class

Returns:



450
451
452
 
# File 'lib/framework.rb', line 450

def revision
    REVISION
end

#run(&block) ⇒ Object

Runs the system

It parses the instanse options and runs the audit

Parameters:

  • &block (Block) —

    a block to call after the audit has finished but before running the reports



168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
 
# File 'lib/framework.rb', line 168

def run( &block )
    @running = true

    @opts.start_datetime = Time.now

    # run all plugins
    @plugins.run

    # catch exceptions so that if something breaks down or the user opted to
    # exit the reports will still run with whatever results
    # Arachni managed to gather
    begin
        # start the audit
        audit( )
    rescue Exception
    end

    clean_up!
    begin
        block.call if block
    rescue Exception
    end

    # run reports
    if( @opts.reports && !@opts.reports.empty? )
        exception_jail{ @reports.run( audit_store( ) ) }
    end

    return true
end

#running? ⇒ Boolean

Returns:

  • (Boolean) 


418
419
420
 
# File 'lib/framework.rb', line 418

def running?
    @running
end

#stats(refresh_time = false) ⇒ Object 



199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
 
# File 'lib/framework.rb', line 199

def stats( refresh_time = false )
    req_cnt = http.request_count
    res_cnt = http.response_count

    @auditmap ||= []
    @sitemap  ||= []
    if !refresh_time || @auditmap.size == @sitemap.size
        @opts.delta_time ||= Time.now - @opts.start_datetime
    else
        @opts.delta_time = Time.now - @opts.start_datetime
    end

    curr_avg = 0
    if http.curr_res_cnt > 0
        curr_avg = (http.curr_res_cnt / http.curr_res_time).to_i.to_s
    end

    return {
        :requests   => req_cnt,
        :responses  => res_cnt,
        :time       => audit_store.delta_time,
        :avg        => ( res_cnt / @opts.delta_time ).to_i.to_s,
        :sitemap_size  => @sitemap.size,
        :auditmap_size => @auditmap.size,
        :curr_res_time => http.curr_res_time,
        :curr_res_cnt  => http.curr_res_cnt,
        :curr_avg      => curr_avg,
        :average_res_time => http.average_res_time,
        :max_concurrency => http.max_concurrency,
        :current_page    => @current_url
    }
end

#version ⇒ String

Returns the version of the framework

Returns:



441
442
443
 
# File 'lib/framework.rb', line 441

def version
    Arachni::VERSION
end