Class: Arachni::Element::Link

Inherits:
Base show all
Includes:
Capabilities::Analyzable, Capabilities::Auditable, Capabilities::Refreshable, Capabilities::Submittable, Capabilities::WithDOM
Defined in:
lib/arachni/element/link.rb,
lib/arachni/element/link/dom.rb,
lib/arachni/element/link/capabilities/with_dom.rb,
lib/arachni/element/link/capabilities/auditable.rb,
lib/arachni/element/link/capabilities/submittable.rb

Overview

Represents an auditable link element

Author:

Defined Under Namespace

Modules: Capabilities Classes: DOM

Constant Summary

Constants included from Capabilities::Auditable

Capabilities::Auditable::OPTIONS

Constants included from Capabilities::Mutable

Capabilities::Mutable::EXTRA_NAME, Capabilities::Mutable::FUZZ_NAME, Capabilities::Mutable::FUZZ_NAME_VALUE, Capabilities::Mutable::MUTATION_OPTIONS

Constants included from Capabilities::Inputtable

Capabilities::Inputtable::INPUTTABLE_CACHE

Constants included from Capabilities::Analyzable::Differential

Capabilities::Analyzable::Differential::DIFFERENTIAL_OPTIONS

Constants included from Capabilities::Analyzable::Timeout

Capabilities::Analyzable::Timeout::TIMEOUT_OPTIONS

Constants included from Capabilities::Analyzable::Taint

Capabilities::Analyzable::Taint::TAINT_CACHE, Capabilities::Analyzable::Taint::TAINT_OPTIONS

Constants inherited from Base

Base::MAX_SIZE

Instance Attribute Summary

Attributes included from Capabilities::Auditable

#audit_options

Attributes included from Capabilities::WithAuditor

#auditor

Attributes included from Capabilities::Mutable

#affected_input_name, #format, #seed

Attributes included from Capabilities::Inputtable

#default_inputs, #inputs

Attributes included from Capabilities::WithDOM

#dom, #skip_dom

Attributes included from Capabilities::Analyzable::Differential

#differential_analysis_options

Attributes included from Capabilities::Analyzable::Timeout

#timing_attack_remark_data

Attributes inherited from Base

#initialization_options, #page

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Capabilities::Auditable

#audit, #audit_id, #audit_status_message, #audit_status_message_action, #audit_verbose_message, #coverage_hash, #coverage_id, #dup, #matches_skip_like_blocks?, #reset, reset, #skip?, skip_like

Methods included from Capabilities::WithAuditor

#dup, #marshal_dump, #orphan?, #prepare_for_report, #remove_auditor

Methods included from Capabilities::Mutable

#affected_input_value, #affected_input_value=, #dup, #each_mutation, #immutables, #inspect, #mutation?, #mutations, #reset, #switch_method, #to_h

Methods included from Capabilities::Submittable

#action, #action=, #dup, #http, #method, #method=, #platforms, #submit, #to_h

Methods included from Capabilities::Inputtable

#[], #[]=, #changes, #dup, #has_inputs?, #inputtable_id, #reset, #to_h, #try_input, #update, #valid_input_data?, #valid_input_name?, #valid_input_name_data?, #valid_input_value?, #valid_input_value_data?

Methods included from Utilities

#available_port, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_document, #cookies_from_file, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_document, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_document, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite

Methods included from Capabilities::WithDOM

#dup, #skip_dom?

Methods included from Capabilities::Refreshable

#refresh, #refresh_id

Methods included from Capabilities::Analyzable

has_timeout_candidates?, reset, timeout_audit_run

Methods included from Capabilities::Analyzable::Differential

#differential_analysis, #dup, reset

Methods included from Capabilities::Analyzable::Timeout

add_phase_2_candidate, candidates_include?, deduplicate, deduplicate?, do_not_deduplicate, #dup, #ensure_responsiveness, has_candidates?, payload_delay_from_options, reset, run, #timeout_analysis, timeout_from_options, #timeout_id, #timing_attack_probe, #timing_attack_verify

Methods included from Capabilities::Analyzable::Taint

#taint_analysis

Methods inherited from Base

#==, #action, #dup, from_rpc_data, #hash, #marshal_dump, #marshal_load, #persistent_hash, #prepare_for_report, #reset, #to_h, #to_hash, too_big?, #type, type, #url, #url=

Methods included from Capabilities::WithScope

#scope

Constructor Details

#initialize(options) ⇒ Link

Returns a new instance of Link.

Parameters:

Options Hash (options):

  • :url (String) —

    URL of the page which includes the link.

  • :action (String) —

    Link URL – defaults to ‘:url`.

  • :inputs (Hash) —

    Query parameters as ‘name => value` pairs. If none have been provided they will automatically be extracted from Capabilities::Submittable#action.



40
41
42
43
44
45
 
# File 'lib/arachni/element/link.rb', line 40

def initialize( options )
    super( options )

    self.inputs     = (self.inputs || {}).merge( options[:inputs] || {} )
    @default_inputs = self.inputs.dup.freeze
end

Class Method Details

.decode(*args) ⇒ Object 



145
146
147
 
# File 'lib/arachni/element/link.rb', line 145

def decode( *args )
    ::URI.decode( *args )
end

.encode(string) ⇒ Object 



141
142
143
 
# File 'lib/arachni/element/link.rb', line 141

def encode( string )
    Arachni::HTTP::Request.encode string
end

.from_document(url, document) ⇒ Array<Link>

Extracts links from a document.

Parameters:

  • url (String) —

    URL of the document – used for path normalization purposes.

  • document (String, Nokogiri::HTML::Document)

Returns:



108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
 
# File 'lib/arachni/element/link.rb', line 108

def from_document( url, document )
    if !document.is_a?( Nokogiri::HTML::Document )
        document = document.to_s

        return [] if !(document =~ /\?.*=/)

        document = Nokogiri::HTML( document )
    end

    base_url =  begin
        document.search( '//base[@href]' )[0]['href']
    rescue
        url
    end

    document.search( '//a' ).map do |link|
        next if too_big?( link['href'] )

        href = to_absolute( link['href'], base_url )
        next if !href

        if (parsed_url = Arachni::URI( href ))
            next if parsed_url.scope.out?
        end

        new(
            url:    url.freeze,
            action: href.freeze,
            source: link.to_html.freeze
        )
    end.compact
end

.from_response(response) ⇒ Array<Link>

Extracts links from an HTTP response.

Parameters:

Returns:



96
97
98
99
 
# File 'lib/arachni/element/link.rb', line 96

def from_response( response )
    url = response.url
    [new( url: url )] | from_document( url, response.body )
end

Instance Method Details

#decode(*args) ⇒ Object

See Also:



75
76
77
 
# File 'lib/arachni/element/link.rb', line 75

def decode( *args )
    self.class.decode( *args )
end

#encode(*args) ⇒ Object

See Also:



67
68
69
 
# File 'lib/arachni/element/link.rb', line 67

def encode( *args )
    self.class.encode( *args )
end

#id ⇒ Object 



79
80
81
 
# File 'lib/arachni/element/link.rb', line 79

def id
    dom_data ? "#{super}:#{dom_data[:inputs].sort_by { |k,_| k }}" : super
end

#simple ⇒ Hash

Returns Simple representation of self in the form of ‘{ Capabilities::Submittable#action => Capabilities::Inputtable#inputs }`.

Returns:



49
50
51
 
# File 'lib/arachni/element/link.rb', line 49

def simple
    { self.action => self.inputs }
end

#to_rpc_data ⇒ Object 



83
84
85
86
87
 
# File 'lib/arachni/element/link.rb', line 83

def to_rpc_data
    data = super
    data.delete 'dom_data'
    data
end

#to_s ⇒ String

Returns Absolute URL with a merged version of Capabilities::Submittable#action and Capabilities::Inputtable#inputs as a query.

Returns:



55
56
57
58
59
60
61
 
# File 'lib/arachni/element/link.rb', line 55

def to_s
    uri = uri_parse( self.action ).dup
    uri.query = self.inputs.
        map { |k, v| "#{encode(k)}=#{encode(v)}" }.
        join( '&' )
    uri.to_s
end