Class: Arachni::Issue

Inherits:
Object show all
Defined in:
lib/arachni/issue.rb

Overview

Represents a detected issues.

Author:

Defined Under Namespace

Modules: Severity

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(opts = {}) ⇒ Issue

Sets up the instance attributes

Parameters:

  • opts (Hash) (defaults to: {}) —

    configuration hash Usually the returned data of a module’s info() method for the references merged with a name=>value pair hash holding class attributes



221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
 
# File 'lib/arachni/issue.rb', line 221

def initialize( opts = {} )
    @verification = false
    @references   = {}
    @opts         = { regexp: '' }

    opts.each do |k, v|
        begin
            send( "#{k.to_s.downcase}=", encode( v ) )
        rescue
        end
    end

    opts[:regexp] = opts[:regexp].to_s if opts[:regexp]
    opts[:issue].each do |k, v|
        begin
            send( "#{k.to_s.downcase}=", encode( v ) )
        rescue
        end
    end if opts[:issue]

    @headers ||= {}
    if opts[:headers] && opts[:headers][:request]
        @headers[:request] = {}.merge( opts[:headers][:request] )
    end
    @headers[:request] ||= {}

    if opts[:headers] && opts[:headers][:response]
        @headers[:response] = {}.merge( opts[:headers][:response] )
    end
    @headers[:response] ||= {}

    @response ||= ''

    @method   = @method.to_s.upcase
    @mod_name = opts[:name]

    # remove this block because it won't be able to be serialized
    @opts.delete( :each_mutation )
    @tags ||= []
end

Instance Attribute Details

#cvssv2 ⇒ String

The CVSS v2 score

Returns:



165
166
167
 
# File 'lib/arachni/issue.rb', line 165

def cvssv2
  @cvssv2
end

#cwe ⇒ String

The CWE ID number of the issue

Returns:



142
143
144
 
# File 'lib/arachni/issue.rb', line 142

def cwe
  @cwe
end

#cwe_url ⇒ String

The CWE URL of the issue

Returns:



149
150
151
 
# File 'lib/arachni/issue.rb', line 149

def cwe_url
  @cwe_url
end

#description ⇒ String

The description of the issue

Returns:



128
129
130
 
# File 'lib/arachni/issue.rb', line 128

def description
  @description
end

#elem ⇒ String

The vulnerable element, link, form or cookie

Returns:



114
115
116
 
# File 'lib/arachni/issue.rb', line 114

def elem
  @elem
end

#headers ⇒ Hash<Symbol, Hash>

The headers exchanged during the attack

Returns:

  • (Hash<Symbol, Hash>) —

    :request and :reply headers



72
73
74
 
# File 'lib/arachni/issue.rb', line 72

def headers
  @headers
end

#id ⇒ String

The string that identified the issue

Returns:



93
94
95
 
# File 'lib/arachni/issue.rb', line 93

def id
  @id
end

#injected ⇒ String

The injected data that revealed the issue

Returns:



86
87
88
 
# File 'lib/arachni/issue.rb', line 86

def injected
  @injected
end

#internal_modname ⇒ Object

Returns the value of attribute internal_modname.



207
208
209
 
# File 'lib/arachni/issue.rb', line 207

def internal_modname
  @internal_modname
end

#metasploitable ⇒ String

The Metasploit module that can exploit the vulnerability.

ex. exploit/unix/webapp/php_include

Returns:



202
203
204
 
# File 'lib/arachni/issue.rb', line 202

def metasploitable
  @metasploitable
end

#method ⇒ String

HTTP method

Returns:



121
122
123
 
# File 'lib/arachni/issue.rb', line 121

def method
  @method
end

#mod_name ⇒ String

The module that detected the issue

Returns:

  • (String) —

    the name of the module



51
52
53
 
# File 'lib/arachni/issue.rb', line 51

def mod_name
  @mod_name
end

#name ⇒ String

The name of the issue

Returns:



44
45
46
 
# File 'lib/arachni/issue.rb', line 44

def name
  @name
end

#opts ⇒ Hash

Returns audit options associated with the issue.

Returns:

  • (Hash) —

    audit options associated with the issue



205
206
207
 
# File 'lib/arachni/issue.rb', line 205

def opts
  @opts
end

#references ⇒ Hash

References related to the issue

Returns:

  • (Hash) 


135
136
137
 
# File 'lib/arachni/issue.rb', line 135

def references
  @references
end

#regexp ⇒ String

The regexp that identified the issue

Returns:



100
101
102
 
# File 'lib/arachni/issue.rb', line 100

def regexp
  @regexp
end

#regexp_match ⇒ String

The data that was matched by the regexp

Returns:



107
108
109
 
# File 'lib/arachni/issue.rb', line 107

def regexp_match
  @regexp_match
end

#remedy_code ⇒ String

A code snippet showing the user how to remedy the situation

Returns:



179
180
181
 
# File 'lib/arachni/issue.rb', line 179

def remedy_code
  @remedy_code
end

#remedy_guidance ⇒ String

A brief text informing the user how to remedy the situation

Returns:



172
173
174
 
# File 'lib/arachni/issue.rb', line 172

def remedy_guidance
  @remedy_guidance
end

#response ⇒ String

The HTML response of the attack

Returns:

  • (String) —

    the html response of the attack



79
80
81
 
# File 'lib/arachni/issue.rb', line 79

def response
  @response
end

#severity ⇒ String

To be assigned a constant form Severity

Returns:

See Also:



158
159
160
 
# File 'lib/arachni/issue.rb', line 158

def severity
  @severity
end

#tags ⇒ Array<String>

Returns:



210
211
212
 
# File 'lib/arachni/issue.rb', line 210

def tags
  @tags
end

#url ⇒ String

The vulnerable URL

Returns:



65
66
67
 
# File 'lib/arachni/issue.rb', line 65

def url
  @url
end

#var ⇒ String

The vulnerable HTTP variable

Returns:

  • (String) —

    the name of the http variable



58
59
60
 
# File 'lib/arachni/issue.rb', line 58

def var
  @var
end

#variations ⇒ Object

Placeholder variable to be populated by AuditStore#prepare_variations

See Also:

  • AuditStore#prepare_variations


186
187
188
 
# File 'lib/arachni/issue.rb', line 186

def variations
  @variations
end

#verification ⇒ Bool

Is manual verification required?

Returns:

  • (Bool) 


193
194
195
 
# File 'lib/arachni/issue.rb', line 193

def verification
  @verification
end

Instance Method Details

#==(other) ⇒ Object 



337
338
339
 
# File 'lib/arachni/issue.rb', line 337

def ==( other )
    hash == other.hash
end

#[](k) ⇒ Object 



298
299
300
301
302
 
# File 'lib/arachni/issue.rb', line 298

def []( k )
    send( "#{k}" )
rescue
    instance_variable_get( "@#{k.to_s}".to_sym )
end

#[]=(k, v) ⇒ Object 



304
305
306
307
308
309
310
311
 
# File 'lib/arachni/issue.rb', line 304

def []=( k, v )
    v = encode( v )
    begin
        send( "#{k.to_s}=", v )
    rescue
        instance_variable_set( "@#{k.to_s}".to_sym, v )
    end
end

#digest ⇒ Object Also known as: _hash 



345
346
347
 
# File 'lib/arachni/issue.rb', line 345

def digest
    Digest::SHA2.hexdigest( unique_id )
end

#each(&block) ⇒ Object 



313
314
315
 
# File 'lib/arachni/issue.rb', line 313

def each( &block )
    to_h.each( &block )
end

#each_pair(&block) ⇒ Object 



317
318
319
 
# File 'lib/arachni/issue.rb', line 317

def each_pair( &block )
    to_h.each_pair( &block )
end

#eql?(other) ⇒ Boolean

Returns:

  • (Boolean) 


350
351
352
 
# File 'lib/arachni/issue.rb', line 350

def eql?( other )
    hash == other.hash
end

#hash ⇒ Object 



341
342
343
 
# File 'lib/arachni/issue.rb', line 341

def hash
    unique_id.hash
end

#match ⇒ Object 



262
263
264
 
# File 'lib/arachni/issue.rb', line 262

def match
    self.regexp_match
end

#remove_instance_var(var) ⇒ Object 



354
355
356
 
# File 'lib/arachni/issue.rb', line 354

def remove_instance_var( var )
    remove_instance_variable( var )
end

#to_h ⇒ Object Also known as: to_hash 



321
322
323
324
325
326
327
328
329
330
 
# File 'lib/arachni/issue.rb', line 321

def to_h
    h = {}
    self.instance_variables.each do |var|
        h[normalize_name( var )] = instance_variable_get( var )
    end
    h[:digest] = h[:_hash] = digest
    h[:hash]  = hash
    h[:unique_id] = unique_id
    h
end

#unique_id ⇒ Object 



333
334
335
 
# File 'lib/arachni/issue.rb', line 333

def unique_id
    "#{@mod_name}::#{@elem}::#{@var}::#{@url.split( '?' ).first}"
end