Added NestedCookie to handle key-value pairs inside individual cookies

Arachni · Jun 6, 2017 · 6a4135b · 6a4135b
1 parent f87fd93
commit 6a4135b
Show file tree

Hide file tree

Showing 72 changed files with 2,062 additions and 180 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,8 @@
 - Options
     - New
         - `--scope-dom-event-inheritance-limit` -- Limits the amount of inherited events.
+- `Element`
+    - Added `NestedCookie`: Handles key-value pairs inside individual cookies.
 - `Browser`
     - `Javascript`
         - `DOMMonitor`

diff --git a/README.md b/README.md
@@ -259,6 +259,7 @@ Arachni is able to extract and audit the following elements and their inputs:
     - Along with ones that have client-side parameters in their URL fragments, i.e.:
             `http://example.com/#/param/val/param2/val2`
  - Cookies
+    - Also supports nested cookies, containing key-value pairs inside individual cookies.
  - Headers
  - Generic client-side elements which have associated DOM events.
  - AJAX-request parameters.

diff --git a/components/checks/active/no_sql_injection_differential.rb b/components/checks/active/no_sql_injection_differential.rb
@@ -37,9 +37,9 @@ def self.info
 of the web application and checks if the displayed behavior is consistent with
 that of a vulnerable application.
 },
-            elements:    [ Element::Link, Element::Form, Element::Cookie ],
+            elements:    [ Element::Link, Element::Form, Element::Cookie, Element::NestedCookie ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.2',
+            version:     '0.1.3',
             platforms:   [ :nosql ],
 
             issue:       {

diff --git a/components/checks/active/sql_injection_differential.rb b/components/checks/active/sql_injection_differential.rb
@@ -55,9 +55,9 @@ def self.info
 of the web application and checks if the displayed behavior is consistent with
 that of a vulnerable application.
 },
-            elements:    [ Element::Link, Element::Form, Element::Cookie ],
+            elements:    [ Element::Link, Element::Form, Element::Cookie, Element::NestedCookie ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.4.4',
+            version:     '0.4.5',
             platforms:   [ :sql ],
 
             issue:       {

diff --git a/components/checks/active/xss.rb b/components/checks/active/xss.rb
@@ -155,9 +155,9 @@ def self.info
 tainted responses to look for proof of vulnerability.
 },
             elements:    [Element::Form, Element::Link, Element::Cookie,
-                          Element::Header, Element::LinkTemplate],
+                 Element::NestedCookie, Element::Header, Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.4.9',
+            version:     '0.4.10',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS)},

diff --git a/components/checks/active/xss_event.rb b/components/checks/active/xss_event.rb
@@ -125,9 +125,9 @@ def self.info
         {
             name:        'XSS in HTML element event attribute',
             description: %q{Cross-Site Scripting in event tag of HTML element.},
-            elements:    [Element::Form, Element::Link, Element::Cookie, Element::Header],
+            elements:    [Element::Form, Element::Link, Element::Cookie, Element::NestedCookie, Element::Header],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1.9',
+            version:     '0.1.10',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in event tag of HTML element},

diff --git a/components/checks/active/xss_script_context.rb b/components/checks/active/xss_script_context.rb
@@ -223,9 +223,9 @@ def self.info
 Injects JS taint code and check to see if it gets executed as proof of vulnerability.
 },
             elements:    [ Element::Form, Element::Link, Element::Cookie,
-                           Element::Header, Element::LinkTemplate ],
+                           Element::NestedCookie, Element::Header, Element::LinkTemplate ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.2.5',
+            version:     '0.2.6',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in script context},

diff --git a/components/checks/active/xss_tag.rb b/components/checks/active/xss_tag.rb
@@ -83,9 +83,10 @@ def self.info
         {
             name:        'XSS in HTML tag',
             description: %q{Cross-Site Scripting in HTML tag.},
-            elements:    [ Element::Form, Element::Link, Element::Cookie, Element::Header ],
+            elements:    [ Element::Form, Element::Link, Element::Cookie,
+                           Element::NestedCookie, Element::Header ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.1.11',
+            version:     '0.1.12',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS) in HTML tag},

diff --git a/components/reporters/html.rb b/components/reporters/html.rb
@@ -439,7 +439,7 @@ def self.info
             description:  %q{Exports the audit results as a compressed HTML report.},
             content_type: 'application/zip',
             author:       'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:      '0.4.3',
+            version:      '0.4.4',
             options:      [
                 Options.outfile( '.html.zip' ),
                 Options.skip_responses
@@ -489,6 +489,7 @@ def prepare_data
                 Element::Link::DOM.type   => 0,
                 Element::Cookie.type => 0,
                 Element::Cookie::DOM.type => 0,
+                Element::NestedCookie.type => 0,
                 Element::LinkTemplate.type => 0,
                 Element::LinkTemplate::DOM.type => 0,
                 Element::Header.type => 0,

diff --git a/components/reporters/xml.rb b/components/reporters/xml.rb
@@ -181,7 +181,7 @@ def self.info
             description:  %q{Exports the audit results as an XML (.xml) file.},
             content_type: 'text/xml',
             author:       'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:      '0.3.6',
+            version:      '0.3.7',
             options:      [ Options.outfile( '.xml' ), Options.skip_responses ]
         }
     end

diff --git a/components/reporters/xml/schema.xsd b/components/reporters/xml/schema.xsd
@@ -762,6 +762,7 @@
             <xs:enumeration value="Arachni::Element::Link::DOM"/>
             <xs:enumeration value="Arachni::Element::Cookie" />
             <xs:enumeration value="Arachni::Element::Cookie::DOM" />
+            <xs:enumeration value="Arachni::Element::NestedCookie" />
             <xs:enumeration value="Arachni::Element::Header" />
             <xs:enumeration value="Arachni::Element::LinkTemplate" />
             <xs:enumeration value="Arachni::Element::LinkTemplate::DOM"/>

diff --git a/lib/arachni/check/auditor.rb b/lib/arachni/check/auditor.rb
@@ -104,6 +104,8 @@ def self.check?( page, restrict_to_elements = nil, ignore_dom_depth = false )
                             audit.form_doms? && page.has_script? && !!page.forms.find(&:dom) },
                     Element::Cookie            =>
                         proc { audit.cookies? && page.cookies.any? },
+                    Element::NestedCookie            =>
+                        proc { audit.nested_cookies? && page.nested_cookies.any? },
                     Element::Cookie::DOM       =>
                         proc { (ignore_dom_depth || page.dom.depth > 0) &&
                             audit.cookie_doms? && page.has_script? && page.cookies.any? },
@@ -117,8 +119,8 @@ def self.check?( page, restrict_to_elements = nil, ignore_dom_depth = false )
                         proc { audit.jsons? && page.jsons.find { |e| e.inputs.any? } },
                     Element::XML               =>
                         proc { audit.xmls? && page.xmls.find { |e| e.inputs.any? } },
-                    Element::UIInput             => false,
-                    Element::UIInput::DOM        =>
+                    Element::UIInput           => false,
+                    Element::UIInput::DOM      =>
                         proc { audit.ui_inputs? && page.ui_inputs.any? },
                     Element::UIForm            => false,
                     Element::UIForm::DOM       =>
@@ -297,8 +299,8 @@ def max_issues
 
     # Non-DOM auditable elements.
     ELEMENTS_WITH_INPUTS = [
-        Element::Link, Element::Form, Element::Cookie, Element::Header,
-        Element::LinkTemplate, Element::JSON, Element::XML
+        Element::Link, Element::Form, Element::Cookie, Element::NestedCookie,
+        Element::Header, Element::LinkTemplate, Element::JSON, Element::XML
     ]
 
     # Auditable DOM elements.
@@ -491,6 +493,9 @@ def each_candidate_element( &block )
                 when Element::Cookie.type
                     prepare_each_element(page.cookies, &block )
 
+                when Element::NestedCookie.type
+                    prepare_each_element(page.nested_cookies, &block )
+
                 when Element::Header.type
                     prepare_each_element( page.headers, &block )