Class: Arachni::Checks::Xss
- Inherits:
-
Arachni::Check::Base
- Object
- Arachni::Component::Base
- Arachni::Check::Base
- Arachni::Checks::Xss
- Defined in:
- components/checks/active/xss.rb
Overview
Injects an HTML element into page inputs and then parses the HTML markup of tainted responses to look for proof of vulnerability.
If this rudimentary check fails, tainted responses are forwarded to the BrowserCluster for evaluation and taint-tracing.
Constant Summary
Constants included from Arachni::Check::Auditor
Arachni::Check::Auditor::DOM_ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::FILE_SIGNATURES, Arachni::Check::Auditor::FILE_SIGNATURES_PER_PLATFORM, Arachni::Check::Auditor::Format, Arachni::Check::Auditor::SOURCE_CODE_SIGNATURES_PER_PLATFORM
Constants included from Arachni
BANNER, Arachni::Cookie, Form, Header, JSON, Link, LinkTemplate, NestedCookie, Severity, UIForm, UIInput, VERSION, WEBSITE, WIKI, XML
Instance Attribute Summary
Attributes included from Arachni::Check::Auditor
Class Method Summary collapse
- .check_browser_result(result, element, referring_page, cluster) ⇒ Object
- .check_browser_result_cb ⇒ Object
- .find_proof(resource) ⇒ Object
- .info ⇒ Object
- .optimization_cache ⇒ Object
- .options ⇒ Object
- .strings ⇒ Object
- .tag ⇒ Object
- .tag_name ⇒ Object
Instance Method Summary collapse
Methods inherited from Arachni::Check::Base
#browser_cluster, #clean_up, elements, exempt_platforms, has_exempt_platforms?, has_platforms?, #initialize, platforms, #plugins, prefer, #preferred, preferred, #prepare, #session, supports_platforms?
Methods included from Arachni::Check::Auditor
#audit, #audit_differential, #audit_signature, #audit_timeout, #audited, #audited?, #buffered_audit, #each_candidate_dom_element, #each_candidate_element, has_timeout_candidates?, #http, #initialize, #log, #log_issue, #log_remote_file, #log_remote_file_if_exists, #match_and_log, #max_issues, #preferred, reset, #skip?, timeout_audit_run, #trace_taint, #with_browser, #with_browser_cluster
Methods inherited from Arachni::Component::Base
author, description, fullname, #shortname, shortname, shortname=, version
Methods included from Arachni::Component::Output
#depersonalize_output, #depersonalize_output?, #intercept_print_message
Methods included from UI::Output
#caller_location, #debug?, #debug_level, #debug_level_1?, #debug_level_2?, #debug_level_3?, #debug_level_4?, #debug_off, #debug_on, #disable_only_positives, #error_buffer, #error_log_fd, #error_logfile, #has_error_log?, #included, #log_error, #mute, #muted?, #only_positives, #only_positives?, #print_bad, #print_debug, #print_debug_backtrace, #print_debug_exception, #print_debug_level_1, #print_debug_level_2, #print_debug_level_3, #print_debug_level_4, #print_error, #print_error_backtrace, #print_exception, #print_info, #print_line, #print_ok, #print_status, #print_verbose, #reroute_to_file, #reroute_to_file?, reset_output_options, #set_error_logfile, #unmute, #verbose?, #verbose_off, #verbose_on
Methods included from Arachni::Component::Utilities
Methods included from Utilities
#available_port, available_port_mutex, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_file, #cookies_from_parser, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_parser, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_parser, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite
Methods included from Arachni
URI, collect_young_objects, #get_long_win32_filename, jruby?, null_device, profile?, windows?
Constructor Details
This class inherits a constructor from Arachni::Check::Base
Class Method Details
.check_browser_result(result, element, referring_page, cluster) ⇒ Object
105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 |
# File 'components/checks/active/xss.rb', line 105 def self.check_browser_result( result, element, referring_page, cluster ) page = result.page # At this point further checks will be body based, identical # bodies will yield identical results. key = "traced-#{page.body.hash}".hash return if optimization_cache[key] == :traced optimization_cache[key] = :traced print_info 'Checking results of deferred taint analysis.' return if !(proof = find_proof( page )) log( vector: element, proof: proof, page: page, referring_page: referring_page ) end |
.check_browser_result_cb ⇒ Object
126 127 128 |
# File 'components/checks/active/xss.rb', line 126 def self.check_browser_result_cb @check_browser_result_cb ||= method(:check_browser_result) end |
.find_proof(resource) ⇒ Object
130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 |
# File 'components/checks/active/xss.rb', line 130 def self.find_proof( resource ) return if !resource.body.has_html_tag?( self.tag_name ) proof_nodes = Arachni::Parser.parse( resource.body, whitelist: [self.tag_name, 'textarea'], stop_on_first: [self.tag_name] ).nodes_by_name( self.tag_name ) return if proof_nodes.empty? proof = proof_nodes.find do |e| e.parent.name != :textarea end return if !proof proof.to_html end |
.info ⇒ Object
150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 |
# File 'components/checks/active/xss.rb', line 150 def self.info { name: 'XSS', description: %q{ Injects an HTML element into page inputs and then parses the HTML markup of tainted responses to look for proof of vulnerability. }, elements: [Element::Form, Element::Link, Element::Cookie, Element::NestedCookie, Element::Header, Element::LinkTemplate], author: 'Tasos "Zapotek" Laskos <[email protected]> ', version: '0.4.10', issue: { name: %q{Cross-Site Scripting (XSS)}, description: %q{ Client-side scripts are used extensively by modern web applications. They perform from simple functions (such as the formatting of text) up to full manipulation of client-side data and Operating System interaction. Cross Site Scripting (XSS) allows clients to inject scripts into a request and have the server return the script to the client in the response. This occurs because the application is taking untrusted data (in this example, from the client) and reusing it without performing any validation or sanitisation. If the injected script is returned immediately this is known as reflected XSS. If the injected script is stored by the server and returned to any client visiting the affected page, then this is known as persistent XSS (also stored XSS). Arachni has discovered that it is possible to insert script content directly into HTML element content. }, references: { 'Secunia' => 'http://secunia.com/advisories/9716/', 'WASC' => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting', 'OWASP' => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet' }, tags: %w(xss regexp injection script), cwe: 79, severity: Severity::HIGH, remedy_guidance: %q{ To remedy XSS vulnerabilities, it is important to never use untrusted or unfiltered data within the code of a HTML page. Untrusted data can originate not only form the client but potentially a third party or previously uploaded file etc. Filtering of untrusted data typically involves converting special characters to their HTML entity encoded counterparts (however, other methods do exist, see references). These special characters include: * `&` * `<` * `>` * `"` * `'` * `/` An example of HTML entity encoding is converting `<` to `<`. Although it is possible to filter untrusted input, there are five locations within an HTML page where untrusted input (even if it has been filtered) should never be placed: 1. Directly in a script. 2. Inside an HTML comment. 3. In an attribute name. 4. In a tag name. 5. Directly in CSS. Each of these locations have their own form of escaping and filtering. _Because many browsers attempt to implement XSS protection, any manual verification of this finding should be conducted using multiple different browsers and browser versions._ } } } end |
.optimization_cache ⇒ Object
49 50 51 |
# File 'components/checks/active/xss.rb', line 49 def self.optimization_cache @optimization_cache ||= {} end |
.options ⇒ Object
43 44 45 46 47 |
# File 'components/checks/active/xss.rb', line 43 def self. @options ||= { format: [Format::APPEND] } end |
.strings ⇒ Object
30 31 32 33 34 35 36 37 38 39 40 41 |
# File 'components/checks/active/xss.rb', line 30 def self.strings @strings ||= [ # Straight injection. tag, # Go for an error. "()\"&%1'-;#{tag}'", # Break out of HTML comments and text areas. "</textarea>-->#{tag}<!--<textarea>" ].map{ |p| [p, Form.encode( p ) ]}.flatten.uniq end |
.tag ⇒ Object
26 27 28 |
# File 'components/checks/active/xss.rb', line 26 def self.tag "<#{tag_name}/>" end |
.tag_name ⇒ Object
22 23 24 |
# File 'components/checks/active/xss.rb', line 22 def self.tag_name "#{shortname}_#{random_seed}" end |
Instance Method Details
#check_and_log(response, element) ⇒ Object
71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 |
# File 'components/checks/active/xss.rb', line 71 def check_and_log( response, element ) # Bail out if the response is not tainted unless we're dealing with a Link. # The other cases either don't matter or are covered by the xss_dom check. if (self.class.elements - [Arachni::Link]).include?( element.class ) && !response.body.downcase.include?( self.class.tag ) return :checked end # See if we managed to successfully inject our element in the doc tree. if self.class.find_proof( response ) log vector: element, proof: self.class.tag, response: response return :checked end # No idea what was returned, but we can't work with it. return :checked if !response.to_page.has_script? with_browser_cluster do |cluster| print_info 'Progressing to deferred browser evaluation of response.' # Pass the response to the BrowserCluster for evaluation and see if the # element appears in the doc tree now. cluster.trace_taint( response, { taint: self.class.tag, args: [element, page] }, self.class.check_browser_result_cb ) end end |
#optimization_cache ⇒ Object
52 53 54 |
# File 'components/checks/active/xss.rb', line 52 def optimization_cache self.class.optimization_cache end |
#run ⇒ Object
56 57 58 59 60 61 62 63 64 65 66 67 68 69 |
# File 'components/checks/active/xss.rb', line 56 def run audit( self.class.strings, self.class. ) do |response, element| next if !response.html? # If there's no vuln responses will usually be identical, so bail # out early. # If responses aren't identical due to noise, well, we're not losing # much. k = "#{response.url.hash}-#{response.body.hash}".hash next if optimization_cache[k] == :checked optimization_cache[k] = check_and_log( response, element ) end end |