Class: Arachni::Options

Inherits:
Object show all
Includes:
Singleton
Defined in:
lib/arachni/options.rb

Overview

Options storage class.

Implements the Singleton pattern and formally defines all of Arachni’s runtime options.

Author:

Constant Summary collapse

PROFILE_EXT =

The extension of the profile files.

Returns:

'.afp'

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Options

Returns a new instance of Options.



475
476
477
 
# File 'lib/arachni/options.rb', line 475

def initialize
    reset
end

Instance Attribute Details

#arachni_verbose ⇒ Bool

Be verbose?

Returns:

  • (Bool) 


133
134
135
 
# File 'lib/arachni/options.rb', line 133

def arachni_verbose
  @arachni_verbose
end

#audit_cookies ⇒ Bool

Should Arachni audit cookies?

Returns:

  • (Bool) 


220
221
222
 
# File 'lib/arachni/options.rb', line 220

def audit_cookies
  @audit_cookies
end

#audit_cookies_extensively ⇒ Object Also known as: audit_cookies_extensively?

Returns the value of attribute audit_cookies_extensively.



222
223
224
 
# File 'lib/arachni/options.rb', line 222

def audit_cookies_extensively
  @audit_cookies_extensively
end

#audit_forms ⇒ Bool

Should Arachni audit forms?

Returns:

  • (Bool) 


213
214
215
 
# File 'lib/arachni/options.rb', line 213

def audit_forms
  @audit_forms
end

#audit_headers ⇒ Bool

Should Arachni audit HTTP headers?

Returns:

  • (Bool) 


230
231
232
 
# File 'lib/arachni/options.rb', line 230

def audit_headers
  @audit_headers
end

#audit_links ⇒ Bool

Should Arachni audit links?

Returns:

  • (Bool) 


206
207
208
 
# File 'lib/arachni/options.rb', line 206

def audit_links
  @audit_links
end

#authed_by ⇒ String

The person that authorized the scan<br/> It will be added to the HTTP “user-agent” and “from” headers.

Returns:



276
277
278
 
# File 'lib/arachni/options.rb', line 276

def authed_by
  @authed_by
end

#auto_redundant ⇒ Bool

Returns configure the Spider‘s auto-redundant feature.

Returns:

  • (Bool) —

    configure the Spider‘s auto-redundant feature



467
468
469
 
# File 'lib/arachni/options.rb', line 467

def auto_redundant
  @auto_redundant
end

#cookie_jar ⇒ String

Location of the cookiejar

Returns:



327
328
329
 
# File 'lib/arachni/options.rb', line 327

def cookie_jar
  @cookie_jar
end

#cookie_string ⇒ String

Returns cookies in the form of “name=value; name2=value2”.

Returns:

  • (String) —

    cookies in the form of “name=value; name2=value2”



332
333
334
 
# File 'lib/arachni/options.rb', line 332

def cookie_string
  @cookie_string
end

#cookies ⇒ Hash

To be populated by the framework

Parsed cookiejar cookies

Returns:

  • (Hash) —

    name=>value pairs



320
321
322
 
# File 'lib/arachni/options.rb', line 320

def cookies
  @cookies
end

#cost ⇒ Float

Returns cost of using the Dispatcher.

Returns:

  • (Float) —

    cost of using the Dispatcher



83
84
85
 
# File 'lib/arachni/options.rb', line 83

def cost
  @cost
end

#custom_headers ⇒ Hash<String, String>

Returns custom HTTP headers to be included for every HTTP Request.

Returns:

  • (Hash<String, String>) —

    custom HTTP headers to be included for every HTTP Request



442
443
444
 
# File 'lib/arachni/options.rb', line 442

def custom_headers
  @custom_headers
end

#datastore ⇒ Hash

General purpose datastore.

Since this class is a Singleton and is passed to pretty much everything it’s a good candidate for message passing or obscure options that the user doesn’t need to know.

Returns:

  • (Hash) 


56
57
58
 
# File 'lib/arachni/options.rb', line 56

def datastore
  @datastore
end

#debug ⇒ Bool

Output debugging messages?

Returns:

  • (Bool) 


140
141
142
 
# File 'lib/arachni/options.rb', line 140

def debug
  @debug
end

#delta_time ⇒ Integer

Returns to be populated by the framework.

Returns:

  • (Integer) —

    to be populated by the framework



387
388
389
 
# File 'lib/arachni/options.rb', line 387

def delta_time
  @delta_time
end

#depth_limit ⇒ Integer

How deep to go in the site structure?<br/> If nil, depth_limit = inf

Returns:

  • (Integer) 


162
163
164
 
# File 'lib/arachni/options.rb', line 162

def depth_limit
  @depth_limit
end

#dir ⇒ Hash

Holds absolute paths for the directory structure of the framework

Returns:

  • (Hash) 


105
106
107
 
# File 'lib/arachni/options.rb', line 105

def dir
  @dir
end

#exclude ⇒ Array

Exclusion filters.

URLs matching any of these patterns won’t be followed or audited.

Returns:



348
349
350
 
# File 'lib/arachni/options.rb', line 348

def exclude
  @exclude
end

#exclude_binaries ⇒ Object

Returns the value of attribute exclude_binaries.



464
465
466
 
# File 'lib/arachni/options.rb', line 464

def exclude_binaries
  @exclude_binaries
end

#exclude_cookies ⇒ Array

Cookies to exclude from the audit

Returns:



355
356
357
 
# File 'lib/arachni/options.rb', line 355

def exclude_cookies
  @exclude_cookies
end

#exclude_vectors ⇒ Array

Vectors to exclude from the audit

Returns:



362
363
364
 
# File 'lib/arachni/options.rb', line 362

def exclude_vectors
  @exclude_vectors
end

#extend_paths ⇒ Array<String>

Returns paths to use in addition to crawling the webapp.

Returns:

  • (Array<String>) —

    paths to use in addition to crawling the webapp



451
452
453
 
# File 'lib/arachni/options.rb', line 451

def extend_paths
  @extend_paths
end

#extend_paths_filepath ⇒ String

Returns path to file containing #extend_paths.

Returns:



454
455
456
 
# File 'lib/arachni/options.rb', line 454

def extend_paths_filepath
  @extend_paths_filepath
end

#finish_datetime ⇒ Time

Returns to be populated by the framework.

Returns:

  • (Time) —

    to be populated by the framework



384
385
386
 
# File 'lib/arachni/options.rb', line 384

def finish_datetime
  @finish_datetime
end

#follow_subdomains ⇒ Bool

Should the crawler follow subdomains?

Returns:

  • (Bool) 


378
379
380
 
# File 'lib/arachni/options.rb', line 378

def follow_subdomains
  @follow_subdomains
end

#fuzz_methods ⇒ Object

Returns the value of attribute fuzz_methods.



462
463
464
 
# File 'lib/arachni/options.rb', line 462

def fuzz_methods
  @fuzz_methods
end

#grid_mode ⇒ String

Supported values:

  • high_performance

If nil, it won’t make use of the Grid.

Returns:

  • (String) —

    current grid mode



68
69
70
 
# File 'lib/arachni/options.rb', line 68

def grid_mode
  @grid_mode
end

#help ⇒ Bool

Show help?

Returns:

  • (Bool) 


119
120
121
 
# File 'lib/arachni/options.rb', line 119

def help
  @help
end

#http_req_limit ⇒ Integer

How many concurrent HTTP requests?

Returns:

  • (Integer) 


199
200
201
 
# File 'lib/arachni/options.rb', line 199

def http_req_limit
  @http_req_limit
end

#http_timeout ⇒ Integer

Returns HTTP request timeout in milliseconds.

Returns:

  • (Integer) —

    HTTP request timeout in milliseconds



473
474
475
 
# File 'lib/arachni/options.rb', line 473

def http_timeout
  @http_timeout
end

#include ⇒ Array

Inclusion filters.

Only URLs that match any of these patterns will be followed.

Returns:



371
372
373
 
# File 'lib/arachni/options.rb', line 371

def include
  @include
end

#link_count_limit ⇒ Integer

How many links to follow? If -1, link_count_limit = inf

Returns:

  • (Integer) 


170
171
172
 
# File 'lib/arachni/options.rb', line 170

def link_count_limit
  @link_count_limit
end

#load_profile ⇒ Array

Location of Arachni Framework Profile (.afp) files to load

Returns:



265
266
267
 
# File 'lib/arachni/options.rb', line 265

def load_profile
  @load_profile
end

#login_check_pattern ⇒ Object

Returns the value of attribute login_check_pattern.



470
471
472
 
# File 'lib/arachni/options.rb', line 470

def 
  @login_check_pattern
end

#login_check_url ⇒ Object

Returns the value of attribute login_check_url.



469
470
471
 
# File 'lib/arachni/options.rb', line 469

def 
  @login_check_url
end

#lsmod ⇒ Array<Regexp>

List modules, based on regexps, and exit?

Returns:



185
186
187
 
# File 'lib/arachni/options.rb', line 185

def lsmod
  @lsmod
end

#lsplug ⇒ Array<Regexp>

Returns regexps to use to select which plugins to list.

Returns:

  • (Array<Regexp>) —

    regexps to use to select which plugins to list



390
391
392
 
# File 'lib/arachni/options.rb', line 390

def lsplug
  @lsplug
end

#lsrep ⇒ Bool

List reports and exit?

Returns:

  • (Bool) 


192
193
194
 
# File 'lib/arachni/options.rb', line 192

def lsrep
  @lsrep
end

#max_retries ⇒ Integer

Returns maximum retries for failed RPC calls.

Returns:

  • (Integer) —

    maximum retries for failed RPC calls



59
60
61
 
# File 'lib/arachni/options.rb', line 59

def max_retries
  @max_retries
end

#max_slaves ⇒ Integer

Returns maximum amount of slave Instances to use.

Returns:

  • (Integer) —

    maximum amount of slave Instances to use



460
461
462
 
# File 'lib/arachni/options.rb', line 460

def max_slaves
  @max_slaves
end

#min_pages_per_instance ⇒ Integer

Returns minimum pages per RPC Instance when in High Performance Mode.

Returns:

  • (Integer) —

    minimum pages per RPC Instance when in High Performance Mode



457
458
459
 
# File 'lib/arachni/options.rb', line 457

def min_pages_per_instance
  @min_pages_per_instance
end

#mods ⇒ Array Also known as: modules

Array of modules to load

Returns:



237
238
239
 
# File 'lib/arachni/options.rb', line 237

def mods
  @mods
end

#neighbour ⇒ String

Returns the URL of a neighbouring Dispatcher.

Returns:

  • (String) —

    the URL of a neighbouring Dispatcher



73
74
75
 
# File 'lib/arachni/options.rb', line 73

def neighbour
  @neighbour
end

#nickname ⇒ String

Returns Dispatcher nickname.

Returns:

  • (String) —

    Dispatcher nickname



98
99
100
 
# File 'lib/arachni/options.rb', line 98

def nickname
  @nickname
end

#node_ping_interval ⇒ Float

Returns how soon to check for neighbour node status.

Returns:

  • (Float) —

    how soon to check for neighbour node status



78
79
80
 
# File 'lib/arachni/options.rb', line 78

def node_ping_interval
  @node_ping_interval
end

#node_ssl_cert ⇒ String

Returns path to a client PEM certificate key for the grid nodes.

Returns:

  • (String) —

    path to a client PEM certificate key for the grid nodes



422
423
424
 
# File 'lib/arachni/options.rb', line 422

def node_ssl_cert
  @node_ssl_cert
end

#node_ssl_pkey ⇒ String

Returns path to a client PEM private key for the grid nodes.

Returns:

  • (String) —

    path to a client PEM private key for the grid nodes



419
420
421
 
# File 'lib/arachni/options.rb', line 419

def node_ssl_pkey
  @node_ssl_pkey
end

#obey_robots_txt ⇒ Bool

Should the crawler obery robots.txt files?

Returns:

  • (Bool) 


154
155
156
 
# File 'lib/arachni/options.rb', line 154

def obey_robots_txt
  @obey_robots_txt
end

#only_positives ⇒ Bool

Output only positive results during the audit?

Returns:

  • (Bool) 


126
127
128
 
# File 'lib/arachni/options.rb', line 126

def only_positives
  @only_positives
end

#pipe_id ⇒ String

Returns a string identifying this bandwidth pipe.

Returns:

  • (String) —

    a string identifying this bandwidth pipe



88
89
90
 
# File 'lib/arachni/options.rb', line 88

def pipe_id
  @pipe_id
end

#plugins ⇒ Array<String>

Returns plugins to load, by name.

Returns:



393
394
395
 
# File 'lib/arachni/options.rb', line 393

def plugins
  @plugins
end

#pool_size ⇒ Integer

Returns amount of Instances to keep in the pool.

Returns:

  • (Integer) —

    amount of Instances to keep in the pool



432
433
434
 
# File 'lib/arachni/options.rb', line 432

def pool_size
  @pool_size
end

#proxy_host ⇒ String

The address of the proxy server

Returns:



283
284
285
 
# File 'lib/arachni/options.rb', line 283

def proxy_host
  @proxy_host
end

#proxy_password ⇒ String

The proxy password

Returns:



297
298
299
 
# File 'lib/arachni/options.rb', line 297

def proxy_password
  @proxy_password
end

#proxy_port ⇒ String

The port to connect on the proxy server

Returns:



290
291
292
 
# File 'lib/arachni/options.rb', line 290

def proxy_port
  @proxy_port
end

#proxy_type ⇒ String

The proxy type

Returns:



311
312
313
 
# File 'lib/arachni/options.rb', line 311

def proxy_type
  @proxy_type
end

#proxy_username ⇒ String

The proxy user

Returns:



304
305
306
 
# File 'lib/arachni/options.rb', line 304

def proxy_username
  @proxy_username
end

#redirect_limit ⇒ Integer

How many redirects to follow? If -1, redirect_limit = inf

Returns:

  • (Integer) 


178
179
180
 
# File 'lib/arachni/options.rb', line 178

def redirect_limit
  @redirect_limit
end

#redundant ⇒ Hash[Regexp, Integer]

Filters for redundant links in the form of (pattern => counter).

Returns:

  • (Hash[Regexp, Integer]) 


147
148
149
 
# File 'lib/arachni/options.rb', line 147

def redundant
  @redundant
end

#repload ⇒ String

Location of an Arachni Framework Report (.afr) file to load

Returns:



251
252
253
 
# File 'lib/arachni/options.rb', line 251

def repload
  @repload
end

#reports ⇒ Array

Array of reports to load

Returns:



244
245
246
 
# File 'lib/arachni/options.rb', line 244

def reports
  @reports
end

#reroute_to_logfile ⇒ Bool

Returns true if the output of the RPC instances should be redirected to a file, false otherwise.

Returns:

  • (Bool) —

    true if the output of the RPC instances should be redirected to a file, false otherwise



429
430
431
 
# File 'lib/arachni/options.rb', line 429

def reroute_to_logfile
  @reroute_to_logfile
end

#restrict_paths ⇒ Array<String>

Returns paths to use instead of crawling the webapp.

Returns:

  • (Array<String>) —

    paths to use instead of crawling the webapp



445
446
447
 
# File 'lib/arachni/options.rb', line 445

def restrict_paths
  @restrict_paths
end

#restrict_paths_filepath ⇒ String

Returns path to file containing #restrict_paths.

Returns:



448
449
450
 
# File 'lib/arachni/options.rb', line 448

def restrict_paths_filepath
  @restrict_paths_filepath
end

#rpc_address ⇒ String

Returns (hostname or IP) address for the RPC server to bind to.

Returns:

  • (String) —

    (hostname or IP) address for the RPC server to bind to



399
400
401
 
# File 'lib/arachni/options.rb', line 399

def rpc_address
  @rpc_address
end

#rpc_instance_port_range ⇒ Array<Integer>

Returns Range of ports to use when spawning instances, first element should be the lowest port number, last the max port number.

Returns:

  • (Array<Integer>) —

    Range of ports to use when spawning instances, first element should be the lowest port number, last the max port number.



404
405
406
 
# File 'lib/arachni/options.rb', line 404

def rpc_instance_port_range
  @rpc_instance_port_range
end

#rpc_port ⇒ Integer

Returns port for the RPC server to listen to.

Returns:

  • (Integer) —

    port for the RPC server to listen to



396
397
398
 
# File 'lib/arachni/options.rb', line 396

def rpc_port
  @rpc_port
end

#save_profile ⇒ String

Where to save the Arachni Framework Profile (.afp) file

Returns:



258
259
260
 
# File 'lib/arachni/options.rb', line 258

def save_profile
  @save_profile
end

#server ⇒ String

Returns URL of an RPC dispatcher (used by the CLI RPC client interface).

Returns:

  • (String) —

    URL of an RPC dispatcher (used by the CLI RPC client interface)



425
426
427
 
# File 'lib/arachni/options.rb', line 425

def server
  @server
end

#show_profile ⇒ Object

Returns the value of attribute show_profile.



268
269
270
 
# File 'lib/arachni/options.rb', line 268

def show_profile
  @show_profile
end

#ssl ⇒ Bool

Returns true if SSL should be enabled, false otherwise.

Returns:

  • (Bool) —

    true if SSL should be enabled, false otherwise.



407
408
409
 
# File 'lib/arachni/options.rb', line 407

def ssl
  @ssl
end

#ssl_ca ⇒ String

Returns path to a PEM CA file.

Returns:

  • (String) —

    path to a PEM CA file



416
417
418
 
# File 'lib/arachni/options.rb', line 416

def ssl_ca
  @ssl_ca
end

#ssl_cert ⇒ String

Returns path to a PEM certificate.

Returns:

  • (String) —

    path to a PEM certificate



413
414
415
 
# File 'lib/arachni/options.rb', line 413

def ssl_cert
  @ssl_cert
end

#ssl_pkey ⇒ String

Returns path to a PEM private key.

Returns:

  • (String) —

    path to a PEM private key



410
411
412
 
# File 'lib/arachni/options.rb', line 410

def ssl_pkey
  @ssl_pkey
end

#start_datetime ⇒ Time

Returns to be populated by the framework.

Returns:

  • (Time) —

    to be populated by the framework



381
382
383
 
# File 'lib/arachni/options.rb', line 381

def start_datetime
  @start_datetime
end

#url ⇒ String, URI

The URL to audit

Returns:



112
113
114
 
# File 'lib/arachni/options.rb', line 112

def url
  @url
end

#user_agent ⇒ String

The HTTP user-agent to use

Returns:



339
340
341
 
# File 'lib/arachni/options.rb', line 339

def user_agent
  @user_agent
end

#webui_password ⇒ String

Returns password for the WebUI.

Returns:

  • (String) —

    password for the WebUI



438
439
440
 
# File 'lib/arachni/options.rb', line 438

def webui_password
  @webui_password
end

#webui_username ⇒ String

Returns username for the WebUI.

Returns:

  • (String) —

    username for the WebUI



435
436
437
 
# File 'lib/arachni/options.rb', line 435

def webui_username
  @webui_username
end

#weight ⇒ Float

Returns Dispatcher weight.

Returns:

  • (Float) —

    Dispatcher weight



93
94
95
 
# File 'lib/arachni/options.rb', line 93

def weight
  @weight
end

Class Method Details

.method_missing(sym, *args, &block) ⇒ Object 



1318
1319
1320
 
# File 'lib/arachni/options.rb', line 1318

def self.method_missing( sym, *args, &block )
    instance.send( sym, *args, &block )
end

Instance Method Details

#==(other) ⇒ Bool

Compares 2 Arachni::Options objects.

Parameters:

Returns:

  • (Bool) —

    true if self == other, false otherwise



1211
1212
1213
 
# File 'lib/arachni/options.rb', line 1211

def ==( other )
    to_hash == other.to_hash
end

#audit(*element_types) ⇒ Object

Enables auditing of element types.

Parameters:

  • element_types (String, Symbol, Array) —
    Allowed: links, forms, cookies, headers


624
625
626
627
628
629
630
631
632
633
634
635
636
 
# File 'lib/arachni/options.rb', line 624

def audit( *element_types )
    element_types.flatten.compact.each do |type|
        begin
            self.send( "audit_#{type}=", true )
        rescue
            begin
                self.send( "audit_#{type}s=", true )
            rescue
            end
        end
    end
    true
end

#audit?(*element_types) ⇒ Bool

Get audit settings for the given element types.

Parameters:

  • element_types (String, Symbol, Array) —
    Allowed: links, forms, cookies, headers

Returns:

  • (Bool) 


665
666
667
668
669
670
671
672
673
674
675
676
 
# File 'lib/arachni/options.rb', line 665

def audit?( *element_types )
    !element_types.flatten.compact.map do |type|
        !!begin
            self.send( "audit_#{type}" )
        rescue
            begin
                self.send( "audit_#{type}s" )
            rescue
            end
        end
    end.uniq.include?( false )
end

#auto_redundant? ⇒ Boolean

Returns:

  • (Boolean) 


574
575
576
 
# File 'lib/arachni/options.rb', line 574

def auto_redundant?
    !!@auto_redundant
end

#crawl ⇒ Object 



586
587
588
 
# File 'lib/arachni/options.rb', line 586

def crawl
    self.link_count_limit = -1
end

#crawl? ⇒ Boolean

Returns:

  • (Boolean) 


590
591
592
 
# File 'lib/arachni/options.rb', line 590

def crawl?
    self.link_count_limit != 0
end

#do_not_crawl ⇒ Object 



582
583
584
 
# File 'lib/arachni/options.rb', line 582

def do_not_crawl
    self.link_count_limit = 0
end

#dont_audit(*element_types) ⇒ Object

Disables auditing of element types.

Parameters:

  • element_types (String, Symbol, Array) —
    Allowed: links, forms, cookies, headers


643
644
645
646
647
648
649
650
651
652
653
654
655
 
# File 'lib/arachni/options.rb', line 643

def dont_audit( *element_types )
    element_types.flatten.compact.each do |type|
        begin
            self.send( "audit_#{type}=", false )
        rescue
            begin
                self.send( "audit_#{type}s=", false )
            rescue
            end
        end
    end
    true
end

#exclude_binaries? ⇒ Boolean

Returns:

  • (Boolean) 


570
571
572
 
# File 'lib/arachni/options.rb', line 570

def exclude_binaries?
    self.exclude_binaries
end

#fuzz_methods? ⇒ Boolean

Returns:

  • (Boolean) 


578
579
580
 
# File 'lib/arachni/options.rb', line 578

def fuzz_methods?
    self.fuzz_methods
end

#load(filepath) ⇒ Arachni::Options

Loads a file created by #save.

Parameters:

  • filepath (String) —

    path to the file created by #save

Returns:



1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
 
# File 'lib/arachni/options.rb', line 1176

def load( filepath )
    opts = YAML::load( IO.read( filepath ) )

    if opts.restrict_paths_filepath
        opts.restrict_paths = paths_from_file( opts.restrict_paths_filepath )
    end

    if opts.extend_paths_filepath
        opts.extend_paths   = paths_from_file( opts.extend_paths_filepath )
    end

    opts
end

#merge!(options) ⇒ Arachni::Options

Merges self with the object in options, skipping nils and empty Arrays or Hashes.

Parameters:

Returns:



1222
1223
1224
1225
1226
1227
1228
1229
 
# File 'lib/arachni/options.rb', line 1222

def merge!( options )
    options.to_hash.each_pair do |k, v|
        next if !v
        next if ( v.is_a?( Array ) || v.is_a?( Hash ) ) && v.empty?
        send( "#{k.to_s}=", v )
    end
    self
end

#no_protocol_for_url ⇒ Object 



1086
1087
1088
 
# File 'lib/arachni/options.rb', line 1086

def no_protocol_for_url
    @no_protocol_for_url = true
end

#no_protocol_for_url? ⇒ Boolean

Returns:

  • (Boolean) 


1090
1091
1092
 
# File 'lib/arachni/options.rb', line 1090

def no_protocol_for_url?
    !!@no_protocol_for_url
end

#parse(require_url = true) ⇒ Object 



752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
 
# File 'lib/arachni/options.rb', line 752

def parse( require_url = true )
    # Construct getops struct
    opts = GetoptLong.new(
        [ '--help',              '-h', GetoptLong::NO_ARGUMENT ],
        [ '--verbosity',         '-v', GetoptLong::NO_ARGUMENT ],
        [ '--only-positives',    '-k', GetoptLong::NO_ARGUMENT ],
        [ '--lsmod',                   GetoptLong::OPTIONAL_ARGUMENT ],
        [ '--lsrep',                   GetoptLong::OPTIONAL_ARGUMENT ],
        [ '--audit-links',       '-g', GetoptLong::NO_ARGUMENT ],
        [ '--audit-forms',       '-p', GetoptLong::NO_ARGUMENT ],
        [ '--audit-cookies',     '-c', GetoptLong::NO_ARGUMENT ],
        [ '--audit-cookie-jar',        GetoptLong::NO_ARGUMENT ],
        [ '--audit-headers',           GetoptLong::NO_ARGUMENT ],
        [ '--spider-first',            GetoptLong::NO_ARGUMENT ],
        [ '--obey-robots-txt',   '-o', GetoptLong::NO_ARGUMENT ],
        [ '--redundant',               GetoptLong::REQUIRED_ARGUMENT ],
        [ '--depth',             '-d', GetoptLong::REQUIRED_ARGUMENT ],
        [ '--redirect-limit',    '-q', GetoptLong::REQUIRED_ARGUMENT ],
        [ '--link-count',        '-u', GetoptLong::REQUIRED_ARGUMENT ],
        [ '--mods',              '-m', GetoptLong::REQUIRED_ARGUMENT ],
        [ '--modules',                 GetoptLong::REQUIRED_ARGUMENT ],
        [ '--report',                  GetoptLong::REQUIRED_ARGUMENT ],
        [ '--repload',                 GetoptLong::REQUIRED_ARGUMENT ],
        [ '--authed-by',               GetoptLong::REQUIRED_ARGUMENT ],
        [ '--load-profile',            GetoptLong::REQUIRED_ARGUMENT ],
        [ '--save-profile',            GetoptLong::REQUIRED_ARGUMENT ],
        [ '--show-profile',            GetoptLong::NO_ARGUMENT ],
        [ '--proxy',             '-z', GetoptLong::REQUIRED_ARGUMENT ],
        [ '--proxy-auth',        '-x', GetoptLong::REQUIRED_ARGUMENT ],
        [ '--proxy-type',        '-y', GetoptLong::REQUIRED_ARGUMENT ],
        [ '--cookie-jar',        '-j', GetoptLong::REQUIRED_ARGUMENT ],
        [ '--cookie-string'          , GetoptLong::REQUIRED_ARGUMENT ],
        [ '--user-agent',        '-b', GetoptLong::REQUIRED_ARGUMENT ],
        [ '--exclude',           '-e', GetoptLong::REQUIRED_ARGUMENT ],
        [ '--include',           '-i', GetoptLong::REQUIRED_ARGUMENT ],
        [ '--exclude-cookie',          GetoptLong::REQUIRED_ARGUMENT ],
        [ '--exclude-vector',          GetoptLong::REQUIRED_ARGUMENT ],
        [ '--http-req-limit',          GetoptLong::REQUIRED_ARGUMENT ],
        [ '--http-timeout',            GetoptLong::REQUIRED_ARGUMENT ],
        [ '--follow-subdomains', '-f', GetoptLong::NO_ARGUMENT ],
        [ '--debug',             '-w', GetoptLong::NO_ARGUMENT ],
        [ '--server',                  GetoptLong::REQUIRED_ARGUMENT ],
        [ '--plugin',                  GetoptLong::OPTIONAL_ARGUMENT ],
        [ '--lsplug',                  GetoptLong::OPTIONAL_ARGUMENT ],
        [ '--serialized-opts',         GetoptLong::REQUIRED_ARGUMENT ],
        [ '--ssl',                     GetoptLong::NO_ARGUMENT ],
        [ '--ssl-pkey',                GetoptLong::REQUIRED_ARGUMENT ],
        [ '--ssl-cert',                GetoptLong::REQUIRED_ARGUMENT ],
        [ '--node-ssl-pkey',          GetoptLong::REQUIRED_ARGUMENT ],
        [ '--node-ssl-cert',          GetoptLong::REQUIRED_ARGUMENT ],
        [ '--ssl-ca',                 GetoptLong::REQUIRED_ARGUMENT ],
        [ '--address',                GetoptLong::REQUIRED_ARGUMENT ],
        [ '--reroute-to-logfile',     GetoptLong::NO_ARGUMENT ],
        [ '--pool-size',              GetoptLong::REQUIRED_ARGUMENT ],
        [ '--neighbour',              GetoptLong::REQUIRED_ARGUMENT ],
        [ '--weight',                 GetoptLong::REQUIRED_ARGUMENT ],
        [ '--cost',                   GetoptLong::REQUIRED_ARGUMENT ],
        [ '--pipe-id',                GetoptLong::REQUIRED_ARGUMENT ],
        [ '--nickname',               GetoptLong::REQUIRED_ARGUMENT ],
        [ '--username',               GetoptLong::REQUIRED_ARGUMENT ],
        [ '--password',               GetoptLong::REQUIRED_ARGUMENT ],
        [ '--port',                   GetoptLong::REQUIRED_ARGUMENT ],
        [ '--host',                   GetoptLong::REQUIRED_ARGUMENT ],
        [ '--custom-header',          GetoptLong::REQUIRED_ARGUMENT ],
        [ '--restrict-paths',         GetoptLong::REQUIRED_ARGUMENT ],
        [ '--extend-paths',           GetoptLong::REQUIRED_ARGUMENT ],
        [ '--port-range',             GetoptLong::REQUIRED_ARGUMENT ],
        [ '--http-harvest-last',      GetoptLong::NO_ARGUMENT ],
        [ '--fuzz-methods',           GetoptLong::NO_ARGUMENT ],
        [ '--audit-cookies-extensively',      GetoptLong::NO_ARGUMENT ],
        [ '--exclude-binaries',       GetoptLong::NO_ARGUMENT ],
        [ '--auto-redundant',         GetoptLong::OPTIONAL_ARGUMENT ],
        [ '--login-check-url',        GetoptLong::REQUIRED_ARGUMENT ],
        [ '--login-check-pattern',    GetoptLong::REQUIRED_ARGUMENT ]
    )

    opts.quiet = true

    begin
        opts.each do |opt, arg|

            case opt

                when '--help'
                    @help = true

                when '--serialized-opts'
                    merge!( unserialize( arg ) )

                when '--only-positives'
                    @only_positives = true

                when '--verbosity'
                    @arachni_verbose = true

                when '--debug'
                    @debug = true

                when '--plugin'
                    plugin, opt_str = arg.split( ':', 2 )

                    opts = {}
                    if opt_str
                        opt_arr = opt_str.split( ',' )
                        opt_arr.each {
                            |c_opt|
                            name, val = c_opt.split( '=', 2 )
                            opts[name] = val
                        }
                    end

                    @plugins[plugin] = opts

                when '--redundant'
                    regexp, counter = arg.to_s.split( ':', 2 )
                    @redundant[ Regexp.new( regexp ) ] = Integer( counter )

                when '--port-range'
                    first, last = arg.to_s.split( '-' )
                    @rpc_instance_port_range = [ Integer( first ), Integer( last ) ]

                when '--custom-header'
                    header, val = arg.to_s.split( /=/, 2 )
                    @custom_headers[header] = val

                when '--restrict-paths'
                    @restrict_paths |= paths_from_file( arg )
                    @restrict_paths_filepath = arg

                when '--extend-paths'
                    @extend_paths |= paths_from_file( arg )
                    @extend_paths_filepath = arg

                when '--obey_robots_txt'
                    @obey_robots_txt = true

                when '--depth'
                    @depth_limit = arg.to_i

                when '--link-count'
                    @link_count_limit = arg.to_i

                when '--redirect-limit'
                    @redirect_limit = arg.to_i

                when '--lsmod'
                    @lsmod << Regexp.new( arg.to_s )

                when '--lsplug'
                    @lsplug << Regexp.new( arg.to_s )

                when '--lsrep'
                    @lsrep << Regexp.new( arg.to_s )

                when '--http-req-limit'
                    @http_req_limit = arg.to_i

                when '--http-timeout'
                    @http_timeout = arg.to_i

                when '--audit-links'
                    @audit_links = true

                when '--audit-forms'
                    @audit_forms = true

                when '--audit-cookies'
                    @audit_cookies = true

                when '--audit-cookie-jar'
                    @audit_cookie_jar = true

                when '--audit-headers'
                    @audit_headers = true

                when '--mods', '--modules'
                    @mods = arg.to_s.split( /,/ )

                when '--report'
                    report, opt_str = arg.split( ':' )

                    opts = {}
                    if opt_str
                        opt_arr = opt_str.split( ',' )
                        opt_arr.each {
                            |c_opt|
                            name, val = c_opt.split( '=' )
                            opts[name] = val
                        }
                    end

                    @reports[report] = opts

                when '--repload'
                    @repload = arg

                when '--save-profile'
                    @save_profile = arg

                when '--load-profile'
                    @load_profile << arg

                when '--show-profile'
                    @show_profile = true

                when '--authed-by'
                    @authed_by = arg

                when '--proxy'
                    @proxy_host, @proxy_port =
                        arg.to_s.split( /:/ )

                when '--proxy-auth'
                    @proxy_username, @proxy_password =
                        arg.to_s.split( /:/ )

                when '--proxy-type'
                    @proxy_type = arg.to_s

                when '--cookie-jar'
                    @cookie_jar = arg.to_s

                when '--cookie-string'
                    @cookie_string = arg.to_s

                when '--user-agent'
                    @user_agent = arg.to_s

                when '--exclude'
                    @exclude << Regexp.new( arg )

                when '--include'
                    @include << Regexp.new( arg )

                when '--exclude-cookie'
                    @exclude_cookies << arg

                when '--exclude-vector'
                    @exclude_vectors << arg

                when '--follow-subdomains'
                    @follow_subdomains = true

                when '--http-harvest-last'
                    puts 'The http-harvest-last option has been removed.'
                    puts 'Please adjust your command-line arguments and try again.'
                    exit

                when '--ssl'
                    @ssl = true

                when '--ssl-pkey'
                    @ssl_pkey = arg.to_s

                when '--ssl-cert'
                    @ssl_cert = arg.to_s

                when '--ssl-ca'
                    @ssl_ca = arg.to_s

                when '--server'
                    @server = arg.to_s

                when '--reroute-to-logfile'
                    @reroute_to_logfile = true

                when '--port'
                    @rpc_port = arg.to_i

                when '--address'
                    @rpc_address = arg.to_s

                when '--pool-size'
                    @pool_size = arg.to_i

                when '--neighbour'
                    @neighbour = arg.to_s

                when '--cost'
                    @cost = arg.to_s

                when '--weight'
                    @weight = arg.to_s

                when '--pipe-id'
                    @pipe_id = arg.to_s

                when '--nickname'
                    @nickname = arg.to_s

                when '--host'
                    @server = arg.to_s

                when '--username'
                    @webui_username = arg.to_s

                when '--password'
                    @webui_password = arg.to_s

                when '--fuzz-methods'
                    @fuzz_methods = true

                when '--audit-cookies-extensively'
                    @audit_cookies_extensively = true

                when '--exclude-binaries'
                    @exclude_binaries = true

                when '--auto-redundant'
                    @auto_redundant = arg.empty? ? 10 : arg.to_i

                when '--login-check-url'
                    @login_check_url = arg

                when '--login-check-pattern'
                    @login_check_pattern = arg
            end
        end

        if (!@login_check_url && @login_check_pattern) ||
            (@login_check_url && !@login_check_pattern)
            fail "Both '--login-check-url' and '--login-check-pattern' options are required."
        end

    rescue => e
        puts BANNER
        puts
        puts e
        exit
    end

    self.url = ARGV.shift if require_url
end

#paths_from_file(file) ⇒ Object 



1314
1315
1316
 
# File 'lib/arachni/options.rb', line 1314

def paths_from_file( file )
    IO.read( file ).lines.map { |p| p.strip }
end

#redundant?(url, &block) ⇒ Bool

Checks is the provided URL matches a redundant filter and decreases its counter if so.

If a filter’s counter has reached 0 the method returns true.

Parameters:

  • url (String)
  • block (Block) —

    to be called for each match and be passed the count, regexp and url

Returns:

  • (Bool) —

    true if the url is redundant, false otherwise



558
559
560
561
562
563
564
565
566
567
568
 
# File 'lib/arachni/options.rb', line 558

def redundant?( url, &block )
    redundant.each do |regexp, count|
        next if !(url =~ regexp)
        return true if count == 0

        block.call( count, regexp, url ) if block_given?

        redundant[regexp] -= 1
    end
    false
end

#reset ⇒ Object 



479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
 
# File 'lib/arachni/options.rb', line 479

def reset
    # nil everything out
    self.instance_variables.each { |var| instance_variable_set( var.to_s, nil ) }

    @dir            = {}
    @dir['root']    = root_path
    @dir['gfx']     = @dir['root'] + 'gfx/'
    @dir['conf']    = @dir['root'] + 'conf/'
    @dir['logs']    = @dir['root'] + 'logs/'
    @dir['data']    = @dir['root'] + 'data/'
    @dir['modules'] = @dir['root'] + 'modules/'
    @dir['reports'] = @dir['root'] + 'reports/'
    @dir['plugins'] = @dir['root'] + 'plugins/'
    @dir['rpcd_handlers']   = @dir['root'] + 'rpcd_handlers/'
    @dir['path_extractors'] = @dir['root'] + 'path_extractors/'

    @dir['lib']     = @dir['root'] + 'lib/arachni/'
    @dir['mixins']  = @dir['lib'] + 'mixins/'
    @dir['arachni'] = @dir['lib'][0...-1]

    # we must add default values for everything because that can serve
    # both as a default configuration and as an inexpensive way to declare
    # their data types for later verification

    @datastore  = {}
    @redundant  = {}

    @obey_robots_txt   = false
    @fuzz_methods      = false
    @audit_cookies_extensively = false
    @exclude_binaries  = false
    @auto_redundant    = false

    @depth_limit      = -1
    @link_count_limit = -1
    @redirect_limit   = 20

    @lsmod      = []
    @lsrep      = []

    @http_req_limit = 20

    @mods = []

    @reports    = {}

    @exclude    = []
    @exclude_cookies    = []
    @exclude_vectors    = []

    @include    = []

    @lsplug     = []
    @plugins    = {}

    @rpc_instance_port_range = [1025, 65535]

    @load_profile       = []
    @restrict_paths     = []
    @extend_paths       = []
    @custom_headers     = {}

    @min_pages_per_instance = 30
    @max_slaves = 10
    self
end

#root_path ⇒ String

Returns root path of the framework.

Returns:

  • (String) —

    root path of the framework



1095
1096
1097
 
# File 'lib/arachni/options.rb', line 1095

def root_path
    File.dirname( File.dirname( File.dirname( File.expand_path( File.expand_path(  __FILE__  ) ) ) ) ) + '/'
end

#save(file) ⇒ Object

Saves ‘self’ to file.

Parameters:



1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
 
# File 'lib/arachni/options.rb', line 1126

def save( file )

    dir = @dir.clone

    load_profile    = []
    save_profile    = nil
    authed_by       = nil
    restrict_paths  = []
    extend_paths    = []

    load_profile   = @load_profile.clone    if @load_profile
    save_profile   = @save_profile.clone    if @save_profile
    authed_by      = @authed_by.clone       if @authed_by
    restrict_paths = @restrict_paths.clone  if @restrict_paths
    extend_paths   = @extend_paths.clone    if @extend_paths

    @dir            = nil
    @load_profile   = []
    @save_profile   = nil
    @authed_by      = nil
    @restrict_paths = []
    @extend_paths   = []

    begin
        f = File.open( file, 'w' )
        YAML.dump( self, f )
    rescue
        return
    ensure
        f.close

        @dir          = dir
        @load_profile = load_profile
        @save_profile = save_profile
        @authed_by    = authed_by

        @restrict_paths = restrict_paths
        @extend_paths   = extend_paths
    end

    f.path
end

#serialize ⇒ String

Returns Single-line, Base64 encoded serialized version of self.

Returns:

  • (String) —

    Single-line, Base64 encoded serialized version of self.

See Also:



1104
1105
1106
 
# File 'lib/arachni/options.rb', line 1104

def serialize
    Base64.encode64( to_yaml ).split( "\n" ).join
end

#set(options) ⇒ TrueClass

Configures options via a Hash object

Parameters:

  • options (Hash) —

    options to set

Returns:

  • (TrueClass) 


685
686
687
688
689
690
691
692
693
694
695
 
# File 'lib/arachni/options.rb', line 685

def set( options )
    options.each_pair do |k, v|
        begin
            send( "#{k.to_s}=", v )
        rescue => e
            #ap e
            #ap e.backtrace
        end
    end
    true
end

#to_arg(key) ⇒ Object 



1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
 
# File 'lib/arachni/options.rb', line 1235

def to_arg( key )

    do_not_parse = %w(show_profile url dir)

    var = self.instance_variable_get( "@#{key}" )

    return if !var
    return if ( var.is_a?( Array ) || var.is_a?( Hash ) ) && var.empty?
    return if do_not_parse.include?( key )
    return if key == 'include' && var == [/.*/]
    return if key == 'reports' && var.keys == %w(stdout)

    key = 'exclude_cookie' if key == 'exclude_cookies'
    key = 'exclude_vector' if key == 'exclude_vectors'
    key = 'report'         if key == 'reports'

    key = key.gsub( '_', '-' )

    arg = ''

    case key

        when 'mods'
            var = var.join( ',' )

        when 'restrict-paths'
            var = @restrict_paths_filepath

        when 'extend-paths'
            var = @extend_paths_filepath

        when 'rpc-instance-port-range'
            var = var.join( '-' )

        when 'arachni-verbose'
            key = 'verbosity'

        when 'redundant'
            var.each do |rule|
                arg += " --#{key}=#{rule['regexp'].source}:#{rule['count']}"
            end
            return arg

        when 'plugins','report'
            arg = ''
            var.each do |opt, val|
                arg += " --#{key.chomp( 's' )}=#{opt}"
                arg += ':' if !val.empty?

                val.each {
                    |k, v|
                    arg += "#{k}=#{v},"
                }

                arg.chomp!( ',' )
            end
            return arg

        when 'proxy-port'
            return

        when 'proxy-addr'
            return "--proxy=#{self.proxy_host}:#{self.proxy_port}"
    end

    if var.is_a?( TrueClass )
        arg = "--#{key}"
    elsif var.is_a?( String ) || var.is_a?( Fixnum )
        arg = "--#{key}=#{var.to_s}"
    elsif var.is_a?( Array )
        var.each do |i|
            i = i.source if i.is_a?( Regexp )
            arg += " --#{key}=#{i}"
        end
    end

    arg
end

#to_args ⇒ Object 



1231
1232
1233
 
# File 'lib/arachni/options.rb', line 1231

def to_args
    ' ' + to_hash.map { |key, val| to_arg( key ) if val }.compact.join( ' ' ) + " #{self.url}"
end

#to_h ⇒ Hash Also known as: to_hash

Converts the Options object to hash

Returns:

  • (Hash) 


1195
1196
1197
1198
1199
1200
1201
 
# File 'lib/arachni/options.rb', line 1195

def to_h
    hash = {}
    self.instance_variables.each do |var|
        hash[normalize_name( var )] = self.instance_variable_get( var )
    end
    hash
end

#unserialize(str) ⇒ Arachni::Options

Unserializes what is returned by #serialize.

Parameters:

Returns:

See Also:



1117
1118
1119
 
# File 'lib/arachni/options.rb', line 1117

def unserialize( str )
    YAML.load( Base64.decode64( str ) )
end