Class: Arachni::Checks::FormUpload
- Inherits:
-
Arachni::Check::Base
- Object
- Arachni::Component::Base
- Arachni::Check::Base
- Arachni::Checks::FormUpload
- Defined in:
- components/checks/passive/grep/form_upload.rb
Overview
Looks for and logs forms with file inputs.
Constant Summary
Constants included from Arachni::Check::Auditor
Arachni::Check::Auditor::DOM_ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::FILE_SIGNATURES, Arachni::Check::Auditor::FILE_SIGNATURES_PER_PLATFORM, Arachni::Check::Auditor::Format, Arachni::Check::Auditor::SOURCE_CODE_SIGNATURES_PER_PLATFORM
Constants included from Arachni
BANNER, Arachni::Cookie, Form, Header, JSON, Link, LinkTemplate, NestedCookie, Severity, UIForm, UIInput, VERSION, WEBSITE, WIKI, XML
Instance Attribute Summary
Attributes included from Arachni::Check::Auditor
Class Method Summary collapse
Instance Method Summary collapse
Methods inherited from Arachni::Check::Base
#browser_cluster, #clean_up, elements, exempt_platforms, has_exempt_platforms?, has_platforms?, #initialize, platforms, #plugins, prefer, #preferred, preferred, #prepare, #session, supports_platforms?
Methods included from Arachni::Check::Auditor
#audit, #audit_differential, #audit_signature, #audit_timeout, #audited, #audited?, #buffered_audit, #each_candidate_dom_element, #each_candidate_element, has_timeout_candidates?, #http, #initialize, #log, #log_issue, #log_remote_file, #log_remote_file_if_exists, #match_and_log, #max_issues, #preferred, reset, #skip?, timeout_audit_run, #trace_taint, #with_browser, #with_browser_cluster
Methods inherited from Arachni::Component::Base
author, description, fullname, #shortname, shortname, shortname=, version
Methods included from Arachni::Component::Output
#depersonalize_output, #depersonalize_output?, #intercept_print_message
Methods included from UI::Output
#caller_location, #debug?, #debug_level, #debug_level_1?, #debug_level_2?, #debug_level_3?, #debug_level_4?, #debug_off, #debug_on, #disable_only_positives, #error_buffer, #error_log_fd, #error_logfile, #has_error_log?, #included, #log_error, #mute, #muted?, #only_positives, #only_positives?, #print_bad, #print_debug, #print_debug_backtrace, #print_debug_exception, #print_debug_level_1, #print_debug_level_2, #print_debug_level_3, #print_debug_level_4, #print_error, #print_error_backtrace, #print_exception, #print_info, #print_line, #print_ok, #print_status, #print_verbose, #reroute_to_file, #reroute_to_file?, reset_output_options, #set_error_logfile, #unmute, #verbose?, #verbose_off, #verbose_on
Methods included from Arachni::Component::Utilities
Methods included from Utilities
#available_port, available_port_mutex, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_file, #cookies_from_parser, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_parser, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_parser, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite
Methods included from Arachni
URI, collect_young_objects, #get_long_win32_filename, jruby?, null_device, profile?, windows?
Constructor Details
This class inherits a constructor from Arachni::Check::Base
Class Method Details
.info ⇒ Object
27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 |
# File 'components/checks/passive/grep/form_upload.rb', line 27 def self.info { name: 'Form-based File Upload', description: 'Logs upload forms which require manual testing.', elements: [ Element::Form ], author: 'Tasos "Zapotek" Laskos <[email protected]>', version: '0.2.3', issue: { name: %q{Form-based File Upload}, description: %q{ The design of many web applications require that users be able to upload files that will either be stored or processed by the receiving web server. Arachni has flagged this not as a vulnerability, but as a prompt for the penetration tester to conduct further manual testing on the file upload function. An insecure form-based file upload could allow a cyber-criminal a means to abuse and successfully exploit the server directly, and/or any third party that may later access the file. This can occur through uploading a file containing server side-code (such as PHP) that is then executed when requested by the client. }, references: { 'owasp.org' => 'https://www.owasp.org/index.php/Unrestricted_File_Upload' }, cwe: 200, tags: %w(file upload), severity: Severity::INFORMATIONAL, remedy_guidance: %q{ The identified page should at a minimum: 1. Whitelist permitted file types and block all others. This should be conducted on the MIME type of the file rather than its extension. 2. As the file is uploaded, and prior to being handled (written to the disk) by the server, the filename should be stripped of all control, special, or Unicode characters. 3. Ensure that the upload is conducted via the HTTP `POST` method rather than `GET` or `PUT`. 4. Ensure that the file is written to a directory that does not hold any execute permission and that all files within that directory inherit the same permissions. 5. Scan (if possible) with an up-to-date virus scanner before being stored. 6. Ensure that the application handles files as per the host operating system. For example, the length of the file name is appropriate, there is adequate space to store the file, protection against overwriting other files etc. } }, max_issues: 25 } end |
Instance Method Details
#run ⇒ Object
14 15 16 17 18 19 20 21 22 23 24 25 |
# File 'components/checks/passive/grep/form_upload.rb', line 14 def run page.forms.each do |form| form.inputs.keys.each do |name| next if form.details_for( name )[:type] != :file log( proof: form.node.nodes_by_attribute_name_and_value( 'type','file' ).first.to_html, vector: form ) end end end |