Class: Arachni::Checks::XssPath

Inherits:
Arachni::Check::Base show all
Defined in:
components/checks/active/xss_path.rb

Overview

XSS in URL path check.

See Also:

Author:

Constant Summary

Constants included from Arachni::Check::Auditor

Arachni::Check::Auditor::DOM_ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::ELEMENTS_WITH_INPUTS, Arachni::Check::Auditor::FILE_SIGNATURES, Arachni::Check::Auditor::FILE_SIGNATURES_PER_PLATFORM, Arachni::Check::Auditor::Format, Arachni::Check::Auditor::SOURCE_CODE_SIGNATURES_PER_PLATFORM

Constants included from Arachni

BANNER, Arachni::Cookie, Form, Header, JSON, Link, LinkTemplate, NestedCookie, Severity, UIForm, UIInput, VERSION, WEBSITE, WIKI, XML

Instance Attribute Summary

Attributes included from Arachni::Check::Auditor

#framework, #page

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Arachni::Check::Base

#browser_cluster, #clean_up, elements, exempt_platforms, has_exempt_platforms?, has_platforms?, #initialize, platforms, #plugins, prefer, #preferred, preferred, #prepare, #session, supports_platforms?

Methods included from Arachni::Check::Auditor

#audit, #audit_differential, #audit_signature, #audit_timeout, #audited, #audited?, #buffered_audit, #each_candidate_dom_element, #each_candidate_element, has_timeout_candidates?, #http, #initialize, #log, #log_issue, #log_remote_file, #log_remote_file_if_exists, #match_and_log, #max_issues, #preferred, reset, #skip?, timeout_audit_run, #trace_taint, #with_browser, #with_browser_cluster

Methods inherited from Arachni::Component::Base

author, description, fullname, #shortname, shortname, shortname=, version

Methods included from Arachni::Component::Output

#depersonalize_output, #depersonalize_output?, #intercept_print_message

Methods included from UI::Output

#caller_location, #debug?, #debug_level, #debug_level_1?, #debug_level_2?, #debug_level_3?, #debug_level_4?, #debug_off, #debug_on, #disable_only_positives, #error_buffer, #error_log_fd, #error_logfile, #has_error_log?, #included, #log_error, #mute, #muted?, #only_positives, #only_positives?, #print_bad, #print_debug, #print_debug_backtrace, #print_debug_exception, #print_debug_level_1, #print_debug_level_2, #print_debug_level_3, #print_debug_level_4, #print_error, #print_error_backtrace, #print_exception, #print_info, #print_line, #print_ok, #print_status, #print_verbose, #reroute_to_file, #reroute_to_file?, reset_output_options, #set_error_logfile, #unmute, #verbose?, #verbose_off, #verbose_on

Methods included from Arachni::Component::Utilities

#read_file

Methods included from Utilities

#available_port, available_port_mutex, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_file, #cookies_from_parser, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_parser, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_parser, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite

Methods included from Arachni

URI, collect_young_objects, #get_long_win32_filename, jruby?, null_device, profile?, windows?

Constructor Details

This class inherits a constructor from Arachni::Check::Base

Class Method Details

.info ⇒ Object 



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
 
# File 'components/checks/active/xss_path.rb', line 73

def self.info
    {
        name:        'XSS in path',
        description: %q{Cross-Site Scripting check for path injection},
        elements:    [ Element::Path ],
        author:      'Tasos "Zapotek" Laskos <[email protected]> ',
        version:     '0.1.11',

        issue:       {
            name:            %q{Cross-Site Scripting (XSS) in path},
            description:     %q{
Client-side scripts are used extensively by modern web applications.
They perform from simple functions (such as the formatting of text) up to full
manipulation of client-side data and Operating System interaction.

Cross Site Scripting (XSS) allows clients to inject scripts into a request and
have the server return the script to the client in the response. This occurs
because the application is taking untrusted data (in this example, from the client)
and reusing it without performing any validation or sanitisation.

If the injected script is returned immediately this is known as reflected XSS.
If the injected script is stored by the server and returned to any client visiting
the affected page, then this is known as persistent XSS (also stored XSS).

Arachni has discovered that it is possible to insert script content directly into
the requested PATH and have it returned in the server's response.
For example `HTTP://yoursite.com/INJECTION_HERE/`, where `INJECTION_HERE`
represents the location where the Arachni payload was injected.
},
            references:  {
                'Secunia' => 'http://secunia.com/advisories/9716/',
                'WASC'    => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
                'OWASP'   => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
            },
            tags:            %w(xss path injection regexp),
            cwe:             79,
            severity:        Severity::HIGH,
            remedy_guidance: %q{
To remedy XSS vulnerabilities, it is important to never use untrusted or unfiltered
data within the code of a HTML page.

Untrusted data can originate not only form the client but potentially a third
party or previously uploaded file etc.

Filtering of untrusted data typically involves converting special characters to
their HTML entity encoded counterparts (however, other methods do exist, see references).
These special characters include:

* `&`
* `<`
* `>`
* `"`
* `'`
* `/`

An example of HTML entity encoding is converting `<` to `&lt;`.

Although it is possible to filter untrusted input, there are five locations
within an HTML page where untrusted input (even if it has been filtered) should
never be placed:

1. Directly in a script.
2. Inside an HTML comment.
3. In an attribute name.
4. In a tag name.
5. Directly in CSS.

Each of these locations have their own form of escaping and filtering.

_Because many browsers attempt to implement XSS protection, any manual verification
of this finding should be conducted using multiple different browsers and browser
versions._
}
        }
    }
end

.requests ⇒ Object 



26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'components/checks/active/xss_path.rb', line 26

def self.requests
    @requests ||= [
        [ string, {} ],
        [ '>"\'>' + string, {} ],

        [ '', { string => '' } ],
        [ '', { '>"\'>' + string => '' } ],

        [ '', { '' => string } ],
        [ '', { '' => '>"\'>' + string } ]
    ]
end

.string ⇒ Object 



22
23
24
 
# File 'components/checks/active/xss_path.rb', line 22

def self.string
    @string ||= '<' + tag + '/>'
end

.tag ⇒ Object 



18
19
20
 
# File 'components/checks/active/xss_path.rb', line 18

def self.tag
    @tag ||= 'my_tag_' + random_seed
end

Instance Method Details

#check_and_log(response) ⇒ Object 



53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'components/checks/active/xss_path.rb', line 53

def check_and_log( response )
    return if !response.html?

    body = response.body.downcase

    # check for the existence of the tag name in the response before
    # parsing to verify, no reason to waste resources...
    return if !body.include?( self.class.string )

    return if Arachni::Parser.parse(
        response.body,
        whitelist:     [self.class.tag],
        stop_on_first: [self.class.tag]
    ).nodes_by_name( self.class.tag ).empty?

    log vector: Element::Path.new( response.url ),
        proof: self.class.string, response: response
end

#run ⇒ Object 



39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'components/checks/active/xss_path.rb', line 39

def run
    path = get_path( page.url )

    return if audited?( path )
    audited( path )

    self.class.requests.each do |str, parameters|
        url  = path + str
        print_status "Checking for: #{url}"

        http.get( url, parameters: parameters, &method(:check_and_log) )
    end
end