Class: Arachni::Checks::Captcha
- Inherits:
-
Arachni::Check::Base
- Object
- Arachni::Component::Base
- Arachni::Check::Base
- Arachni::Checks::Captcha
- Defined in:
- components/checks/passive/grep/captcha.rb
Overview
Constant Summary collapse
- CAPTCHA_RX =
/.*captcha.*/i
Constants included from Arachni::Check::Auditor
Arachni::Check::Auditor::DOM_ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::FILE_SIGNATURES, Arachni::Check::Auditor::FILE_SIGNATURES_PER_PLATFORM, Arachni::Check::Auditor::Format, Arachni::Check::Auditor::SOURCE_CODE_SIGNATURES_PER_PLATFORM
Constants included from Arachni
BANNER, Arachni::Cookie, Form, Header, JSON, Link, LinkTemplate, NestedCookie, Severity, UIForm, UIInput, VERSION, WEBSITE, WIKI, XML
Instance Attribute Summary
Attributes included from Arachni::Check::Auditor
Class Method Summary collapse
Instance Method Summary collapse
Methods inherited from Arachni::Check::Base
#browser_cluster, #clean_up, elements, exempt_platforms, has_exempt_platforms?, has_platforms?, #initialize, platforms, #plugins, prefer, #preferred, preferred, #prepare, #session, supports_platforms?
Methods included from Arachni::Check::Auditor
#audit, #audit_differential, #audit_signature, #audit_timeout, #audited, #audited?, #buffered_audit, #each_candidate_dom_element, #each_candidate_element, has_timeout_candidates?, #http, #initialize, #log, #log_issue, #log_remote_file, #log_remote_file_if_exists, #match_and_log, #max_issues, #preferred, reset, #skip?, timeout_audit_run, #trace_taint, #with_browser, #with_browser_cluster
Methods inherited from Arachni::Component::Base
author, description, fullname, #shortname, shortname, shortname=, version
Methods included from Arachni::Component::Output
#depersonalize_output, #depersonalize_output?, #intercept_print_message
Methods included from UI::Output
#caller_location, #debug?, #debug_level, #debug_level_1?, #debug_level_2?, #debug_level_3?, #debug_level_4?, #debug_off, #debug_on, #disable_only_positives, #error_buffer, #error_log_fd, #error_logfile, #has_error_log?, #included, #log_error, #mute, #muted?, #only_positives, #only_positives?, #print_bad, #print_debug, #print_debug_backtrace, #print_debug_exception, #print_debug_level_1, #print_debug_level_2, #print_debug_level_3, #print_debug_level_4, #print_error, #print_error_backtrace, #print_exception, #print_info, #print_line, #print_ok, #print_status, #print_verbose, #reroute_to_file, #reroute_to_file?, reset_output_options, #set_error_logfile, #unmute, #verbose?, #verbose_off, #verbose_on
Methods included from Arachni::Component::Utilities
Methods included from Utilities
#available_port, available_port_mutex, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_file, #cookies_from_parser, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_parser, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_parser, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite
Methods included from Arachni
URI, collect_young_objects, #get_long_win32_filename, jruby?, null_device, profile?, windows?
Constructor Details
This class inherits a constructor from Arachni::Check::Base
Class Method Details
.info ⇒ Object
39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 |
# File 'components/checks/passive/grep/captcha.rb', line 39 def self.info { name: 'CAPTCHA', description: %q{Greps pages for forms with CAPTCHAs.}, elements: [ Element::Form ], author: 'Tasos "Zapotek" Laskos <[email protected]>', version: '0.2.2', issue: { name: %q{CAPTCHA protected form}, description: %q{ To prevent the automated abuse of a page, applications can implement what is known as a CAPTCHA. These are used to ensure human interaction with the application and are often used on forms where the application conducts sensitive actions. These typically include user registration, or submitting emails via "Contact Us" pages etc. Arachni has flagged this not as a vulnerability, but as a prompt for the penetration tester to conduct further manual testing on the CAPTCHA function, as Arachni cannot audit CAPTCHA protected forms. Testing for insecurely implemented CAPTCHA is a manual process, and an insecurely implemented CAPTCHA could allow a cyber-criminal a means to abuse these sensitive actions. }, severity: Severity::INFORMATIONAL, remedy_guidance: %q{ Although no remediation may be required based on this finding alone, manual testing should ensure that: 1. The server keeps track of CAPTCHA tokens in use and has the token terminated after its first use or after a period of time. Therefore preventing replay attacks. 2. The CAPTCHA answer is not hidden in plain text within the response that is sent to the client. 3. The CAPTCHA image should not be weak and easily solved. }, }, max_issues: 25 } end |
Instance Method Details
#find_proof(node) ⇒ Object
30 31 32 33 34 35 36 37 |
# File 'components/checks/passive/grep/captcha.rb', line 30 def find_proof( node ) node.nodes_by_name('input').each do |input| html = input.to_html return html if html =~ CAPTCHA_RX end nil end |
#run ⇒ Object
14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
# File 'components/checks/passive/grep/captcha.rb', line 14 def run return if !page.body =~ CAPTCHA_RX # since we only care about forms parse the HTML and match forms only page.document.nodes_by_name( 'form' ).each do |form| # pretty dumb way to do this but it's a pretty dumb issue anyways... next if !(proof = find_proof( form )) log( signature: CAPTCHA_RX, proof: proof, vector: Element::Form.from_node( page.url, form ).first ) end end |