Class: Arachni::Checks::CreditCard

Inherits:
Arachni::Check::Base show all
Defined in:
components/checks/passive/grep/credit_card.rb

Overview

Credit Card Number recon check.

Scans page for credit card numbers.

See Also:

Author:

Constant Summary

Constants included from Arachni::Check::Auditor

Arachni::Check::Auditor::DOM_ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::FILE_SIGNATURES, Arachni::Check::Auditor::FILE_SIGNATURES_PER_PLATFORM, Arachni::Check::Auditor::Format, Arachni::Check::Auditor::SOURCE_CODE_SIGNATURES_PER_PLATFORM

Constants included from Arachni

BANNER, Arachni::Cookie, Form, Header, JSON, Link, LinkTemplate, NestedCookie, Severity, UIForm, UIInput, VERSION, WEBSITE, WIKI, XML

Instance Attribute Summary

Attributes included from Arachni::Check::Auditor

#framework, #page

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Arachni::Check::Base

#browser_cluster, #clean_up, elements, exempt_platforms, has_exempt_platforms?, has_platforms?, #initialize, platforms, #plugins, prefer, #preferred, preferred, #prepare, #session, supports_platforms?

Methods included from Arachni::Check::Auditor

#audit, #audit_differential, #audit_signature, #audit_timeout, #audited, #audited?, #buffered_audit, #each_candidate_dom_element, #each_candidate_element, has_timeout_candidates?, #http, #initialize, #log, #log_issue, #log_remote_file, #log_remote_file_if_exists, #match_and_log, #max_issues, #preferred, reset, #skip?, timeout_audit_run, #trace_taint, #with_browser, #with_browser_cluster

Methods inherited from Arachni::Component::Base

author, description, fullname, #shortname, shortname, shortname=, version

Methods included from Arachni::Component::Output

#depersonalize_output, #depersonalize_output?, #intercept_print_message

Methods included from UI::Output

#caller_location, #debug?, #debug_level, #debug_level_1?, #debug_level_2?, #debug_level_3?, #debug_level_4?, #debug_off, #debug_on, #disable_only_positives, #error_buffer, #error_log_fd, #error_logfile, #has_error_log?, #included, #log_error, #mute, #muted?, #only_positives, #only_positives?, #print_bad, #print_debug, #print_debug_backtrace, #print_debug_exception, #print_debug_level_1, #print_debug_level_2, #print_debug_level_3, #print_debug_level_4, #print_error, #print_error_backtrace, #print_exception, #print_info, #print_line, #print_ok, #print_status, #print_verbose, #reroute_to_file, #reroute_to_file?, reset_output_options, #set_error_logfile, #unmute, #verbose?, #verbose_off, #verbose_on

Methods included from Arachni::Component::Utilities

#read_file

Methods included from Utilities

#available_port, available_port_mutex, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_file, #cookies_from_parser, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_parser, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_parser, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite

Methods included from Arachni

URI, collect_young_objects, #get_long_win32_filename, jruby?, null_device, profile?, windows?

Constructor Details

This class inherits a constructor from Arachni::Check::Base

Class Method Details

.cc_regexp ⇒ Object 



19
20
21
 
# File 'components/checks/passive/grep/credit_card.rb', line 19

def self.cc_regexp
    @cc_regexp ||= /\b(((4\d{3})|(5[1-5]\d{2})|(6011))[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}|3[4,7][\d\s-]{15})\b/
end

.info ⇒ Object 



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
 
# File 'components/checks/passive/grep/credit_card.rb', line 73

def self.info
    {
        name:        'Credit card number disclosure',
        description: %q{Scans pages for credit card numbers.},
        elements:    [ Element::Body ],
        author:      'Tasos "Zapotek" Laskos <[email protected]>',
        version:     '0.2.4',

        issue:       {
            name:            %q{Credit card number disclosure},
            description:     %q{
Credit card numbers are used in applications where a user is able to purchase
goods and/or services.

A credit card number is a sensitive piece of information and should be handled
as such. Cyber-criminals will use various methods to attempt to compromise credit
card information that can then be used for fraudulent purposes.

Through the use of regular expressions and CC number format validation, Arachni
was able to discover a credit card number located within the affected page.
},
            references:  {
                'Wikipedia - Bank card number' => 'http://en.wikipedia.org/wiki/Bank_card_number',
                'Wikipedia - Luhn algorithm'   => 'http://en.wikipedia.org/wiki/Luhn_algorithm',
                'Luhn Ruby implementation'     => 'https://gist.github.com/1182499'
            },
            cwe:             200,
            severity:        Severity::MEDIUM,
            remedy_guidance: %q{
Initially, the credit card number within the response should be checked to ensure
its validity, as it is possible that the regular expression has matched on a
similar number with no relation to a real credit card.

If the response does contain a valid credit card number, then all efforts should
be taken to remove or further protect this information. This can be achieved by
removing the credit card number altogether, or by masking the number so that
only the last few digits are present within the response. (eg. _**********123_).

Additionally, credit card numbers should not be stored by the application, unless
the organisation also complies with other security controls as outlined in the
Payment Card Industry Data Security Standard (PCI DSS).
},
            # Well, we can't know whether the logged number actually is an
            # CC now can we?
            trusted: false
        }
    }
end

.relative_number(number) ⇒ Object 



23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'components/checks/passive/grep/credit_card.rb', line 23

def self.relative_number( number )
    @relative_numder ||= {
        '0' => 0,
        '1' => 2,
        '2' => 4,
        '3' => 6,
        '4' => 8,
        '5' => 1,
        '6' => 3,
        '7' => 5,
        '8' => 7,
        '9' => 9
    }
    @relative_numder[number.to_s]
end

Instance Method Details

#run ⇒ Object 



39
40
41
42
 
# File 'components/checks/passive/grep/credit_card.rb', line 39

def run
    # match CC number candidates and verify matches before logging
    match_and_log( self.class.cc_regexp ){ |match| valid_credit_card?( match ) }
end

#valid_association?(number) ⇒ Boolean

Returns:

  • (Boolean) 


61
62
63
64
65
66
67
68
69
70
71
 
# File 'components/checks/passive/grep/credit_card.rb', line 61

def valid_association?( number )
    number = number.to_s.gsub( /\D/, '' )

    return :dinners  if number.length == 14 && number =~ /^3(0[0-5]|[68])/
    return :amex     if number.length == 15 && number =~ /^3[47]/
    return :visa     if [13,16].include?( number.length ) && number =~ /^4/
    return :master   if number.length == 16 && number =~ /^5[1-5]/
    return :discover if number.length == 16 && number =~ /^6011/

    nil
end

#valid_credit_card?(number) ⇒ Boolean

Checks for a valid credit card number

Returns:

  • (Boolean) 


47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'components/checks/passive/grep/credit_card.rb', line 47

def valid_credit_card?( number )
    return if !valid_association?( number )

    number = number.to_s.gsub( /\D/, '' )
    number.reverse!

    sum = 0
    number.split( '' ).each_with_index do |n, i|
        sum += ( i % 2 == 0 ) ? n.to_i : self.class.relative_number( n )
    end

    sum % 10 == 0
end