Class: Arachni::Checks::Captcha

Inherits:
Arachni::Check::Base show all
Defined in:
components/checks/passive/grep/captcha.rb

Overview

Author:

Constant Summary collapse

CAPTCHA_RX = 
/.*captcha.*/i

Constants included from Arachni::Check::Auditor

Arachni::Check::Auditor::DOM_ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::FILE_SIGNATURES, Arachni::Check::Auditor::FILE_SIGNATURES_PER_PLATFORM, Arachni::Check::Auditor::Format, Arachni::Check::Auditor::SOURCE_CODE_SIGNATURES_PER_PLATFORM

Constants included from Arachni

BANNER, Arachni::Cookie, Form, Header, JSON, Link, LinkTemplate, NestedCookie, Severity, UIForm, UIInput, VERSION, WEBSITE, WIKI, XML

Instance Attribute Summary

Attributes included from Arachni::Check::Auditor

#framework, #page

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Arachni::Check::Base

#browser_cluster, #clean_up, elements, exempt_platforms, has_exempt_platforms?, has_platforms?, #initialize, platforms, #plugins, prefer, #preferred, preferred, #prepare, #session, supports_platforms?

Methods included from Arachni::Check::Auditor

#audit, #audit_differential, #audit_signature, #audit_timeout, #audited, #audited?, #buffered_audit, #each_candidate_dom_element, #each_candidate_element, has_timeout_candidates?, #http, #initialize, #log, #log_issue, #log_remote_file, #log_remote_file_if_exists, #match_and_log, #max_issues, #preferred, reset, #skip?, timeout_audit_run, #trace_taint, #with_browser, #with_browser_cluster

Methods inherited from Arachni::Component::Base

author, description, fullname, #shortname, shortname, shortname=, version

Methods included from Arachni::Component::Output

#depersonalize_output, #depersonalize_output?, #intercept_print_message

Methods included from UI::Output

#caller_location, #debug?, #debug_level, #debug_level_1?, #debug_level_2?, #debug_level_3?, #debug_level_4?, #debug_off, #debug_on, #disable_only_positives, #error_buffer, #error_log_fd, #error_logfile, #has_error_log?, #included, #log_error, #mute, #muted?, #only_positives, #only_positives?, #print_bad, #print_debug, #print_debug_backtrace, #print_debug_exception, #print_debug_level_1, #print_debug_level_2, #print_debug_level_3, #print_debug_level_4, #print_error, #print_error_backtrace, #print_exception, #print_info, #print_line, #print_ok, #print_status, #print_verbose, #reroute_to_file, #reroute_to_file?, reset_output_options, #set_error_logfile, #unmute, #verbose?, #verbose_off, #verbose_on

Methods included from Arachni::Component::Utilities

#read_file

Methods included from Utilities

#available_port, available_port_mutex, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_file, #cookies_from_parser, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_parser, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_parser, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite

Methods included from Arachni

URI, collect_young_objects, #get_long_win32_filename, jruby?, null_device, profile?, windows?

Constructor Details

This class inherits a constructor from Arachni::Check::Base

Class Method Details

.info ⇒ Object 



39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
 
# File 'components/checks/passive/grep/captcha.rb', line 39

def self.info
    {
        name:        'CAPTCHA',
        description: %q{Greps pages for forms with CAPTCHAs.},
        elements:    [ Element::Form ],
        author:      'Tasos "Zapotek" Laskos <[email protected]>',
        version:     '0.2.2',

        issue:       {
            name:        %q{CAPTCHA protected form},
            description: %q{
To prevent the automated abuse of a page, applications can implement what is
known as a CAPTCHA.

These are used to ensure human interaction with the application and are often
used on forms where the application conducts sensitive actions. These typically
include user registration, or submitting emails via "Contact Us" pages etc.

Arachni has flagged this not as a vulnerability, but as a prompt for the
penetration tester to conduct further manual testing on the CAPTCHA function, as
Arachni cannot audit CAPTCHA protected forms.

Testing for insecurely implemented CAPTCHA is a manual process, and an insecurely
implemented CAPTCHA could allow a cyber-criminal a means to abuse these sensitive
actions.
},
            severity:    Severity::INFORMATIONAL,
            remedy_guidance: %q{
Although no remediation may be required based on this finding alone, manual
testing should ensure that:

1. The server keeps track of CAPTCHA tokens in use and has the token terminated
after its first use or after a period of time. Therefore preventing replay attacks.
2. The CAPTCHA answer is not hidden in plain text within the response that is
sent to the client.
3. The CAPTCHA image should not be weak and easily solved.
},
        },
        max_issues: 25
    }
end

Instance Method Details

#find_proof(node) ⇒ Object 



30
31
32
33
34
35
36
37
 
# File 'components/checks/passive/grep/captcha.rb', line 30

def find_proof( node )
    node.nodes_by_name('input').each do |input|
            html = input.to_html
            return html if html =~ CAPTCHA_RX
        end

    nil
end

#run ⇒ Object 



14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
 
# File 'components/checks/passive/grep/captcha.rb', line 14

def run
    return if !page.body =~ CAPTCHA_RX

    # since we only care about forms parse the HTML and match forms only
    page.document.nodes_by_name( 'form' ).each do |form|
        # pretty dumb way to do this but it's a pretty dumb issue anyways...
        next if !(proof = find_proof( form ))

        log(
            signature: CAPTCHA_RX,
            proof:     proof,
            vector:    Element::Form.from_node( page.url, form ).first
        )
    end
end