Home Page - MiUtility

arachni --checks - --plugin=login_script:script=login5.rb --browser-cluster-pool-size='4' --browser-cluster-job-timeout='60' --session-check-url=http://dev-miu-rs.miutility.com/miagent --session-check-pattern=miagent http://dev-miu-rs.miutility.com/miagent/launch-pad Arachni - Web Application Security Scanner Framework v2.0dev Author: Tasos "Zapotek" Laskos (With the support of the community and the Arachni Team.) Website: http://arachni-scanner.com Documentation: http://arachni-scanner.com/wiki [~] No element audit options were specified, will audit links, forms, cookies, UI inputs, UI forms, JSONs and XMLs. [*] Initializing... [*] Preparing plugins... [~] Login script: Running the script. https://miutilityadfs.miutilityadfs.com/adfs/oauth2/authorize?response_type=id_token&client_id=0174c6a8-24b0-4760-95e8-c0224d73f006&redirect_uri=http%3A%2F%2Fdev-miu-rs.miutility.com%2F&state=39e9c209-db12-4ebb-b362-56856d172e72&client-request-id=5878fcad-e99a-4603-b883-fd9e3e90f63d&x-client-SKU=Js&x-client-Ver=1.0.10&nonce=a2c56296-fbaf-44aa-8f39-c0ba6429ed72 Home Page - MiUtility

[~] Login script: Execution completed. [+] Login script: Login was successful. [~] Login script: Cookies set to: [~] Login script: * "MSISAuth" = "AAEAAD7QbQpMpMHrs5RYlZYER30bIx8jkaGCYHPOtRXgbnoi36ftcOKeiA8CyYmRpTArEQIj4Z caxux9TbkJCGg/BqySQVG12umNz9WH0aoB/jOdFyU5PYj075jWE74A3tgZO5U4bYzYuN7i3oLoPcBTwvlKbbxu692EFiK1uvAdNfR9CnSKtp69zQ1stzwpPZyTBhEOYQ3BEQDgNUoaJRYyb8gQjp94zxWmn5SHi8GXumla076c/GPASWN/D2jIJJWQR4iC1XV03C/bRmxJfMYJWndy0NOnWWxdFANtHAwRqKlpnv6V2G0BH3FFrKovXz7 ubpGRmEJpEG2HRkzE6kEMI55wnpRSC3ieQmPLu2rV3/450DgaI8kPxz00TkEAkVKwABAABJ7sqf40I7VuEWbGLgRxoP139p612/EAu98Nn9W0 eWBXi2Mk59yrTY2z4dObhdi9 qcelx1STGw2fkNQArTyYcwHalzE6RFKOKpdhNQRbZh7Z/tO4ScCY9C5flWts0hbUCXRjCCDON273B25dSRa8EoAx7 4j9pP8bHW34KBpTWtFSG c9jpClBJHie4i26GnGvzvYDOrvnRlQJxh7AhlRfYeb6i2eLteHslLRx5BCPMBoqF OxkxvTvSypBKD6vybZG9UAyerDQjf6pp2w/UA1 w1k53KAGlWLRudXnxBJOnleuswHP2GghflQz7sNxB2OWbG3rPpePrfwhdX3SnIAMAAPOTqfnq xDfwSrr/1E7mmrib52pQNeCpouFMlEJOm0Np8YQFrADHyiUwAMaPQyzkMdtzZDls fOOhVl5fYlFxtimPtkPXLhlphIMbVsUj2Wk0cYo/XrlJGgu2BmfHH8WYQlGoMAdXkNYwuZij2JsC7 Gtjj5IIPGM5DzKFGIfANb6fG4ey2cORRlIhjKn89fhkd47NwOipWVsgwyfcTsxZibRVvfZj7OOnYxlqZkvCyms02HwmSWOG3D/QRcVxFLax3GYeg3xkDaAZ2LAJrVIiZ/InW10WhnUapPhi6USzF2bTf/ jNea3/DSs2fmlEGnGeTU7X7Lk7vc0/2u8078mzVbUKnkweEfjoYCGYNUNZl1A6i7XyFdCFd3Nkan2Ia1AvoAFqhWBN7vf3G2Err90 4C6z6DyJlUE544A6mMl3miZRSeDcgGmH7Qc/71onDhXLL0LRKOc1uFGRS4UqY3b5LDCJ0ZDY/AqlcONAd186gEiYqy aCdlJRQkjKNSvprU9cI7xppx10TGd7yd5pnwPeXHNqzhm55yzz0YOQgXH2d 1WlpRsd75fWebzGhM qWcBG2c2DQ/4Gs5x30rzry01tY53Y96dFesL1GZEi6bde8ygvYU0nQT0fzOZAsoUeGZHKFxQL4rwy/IwclW9SHLOTuuCs4JiQ6Mg9MQlWZ48S1cDxCU45Aeo6ILNSJf6 JgZ0Haa EdJTqhRydoTokIoS32W6HMf6ZyFvnYTaZbwWSx37r5Y9bsETtZTOS/fuCyRF1OrLS7PIH3KfP/m/13CnE zx7F6UfzfLjvhGoNv3SVVK05fOizzN5UQurjQqw TKqlcGVLhC680GLZep0Isxv9T7s7a2dDE1cJWlBEAgKuuTsW5Zav/zjTFfBY/vo21xj2qfAnCazYIDWc5B/LeXXoGrBQwX6L7p/Akr8RSXANkohkXQEb4FNba47gsWN7qJcuDcphfWiGDPuqjMt58Ni84wu7BZh7qDaR6q4tmI84uSWtMfXOACOTpNeUhOvzcp tIzN3dzzNwKFmrw3OgNI0hEdPKsfxW7X9kS23" [~] Login script: * "MSISAuthenticated" = "NC8yNC8yMDE3IDI6MzA6NDggQU0=" [~] Login script: * "MSISLoopDetectionCookie" = "MjAxNy0wNC0yNDowMjozMDo0OFpcMQ==" [*] ... done. [*] BrowserCluster: Initializing 4 browsers... [*] BrowserCluster: Spawned #1 with PID 65153 [lifeline at PID 65148]. [*] BrowserCluster: Spawned #2 with PID 65182 [lifeline at PID 65175]. [*] BrowserCluster: Spawned #3 with PID 65210 [lifeline at PID 65205]. [*] BrowserCluster: Spawned #4 with PID 65235 [lifeline at PID 65232]. [*] BrowserCluster: Initialization completed with 4 browsers in the pool. [*] [HTTP: 200] http://dev-miu-rs.miutility.com/#id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IjFPTmlzMU1lUHg5QXRfMlB6UjQ1WW1YN1ZqQSIsImtpZCI6IjFPTmlzMU1lUHg5QXRfMlB6UjQ1WW1YN1ZqQSJ9.eyJhdWQiOiIwMTc0YzZhOC0yNGIwLTQ3NjAtOTVlOC1jMDIyNGQ3M2YwMDYiLCJpc3MiOiJodHRwczovL21pdXRpbGl0eWFkZnMubWl1dGlsaXR5YWRmcy5jb20vYWRmcy9zZXJ2aWNlcy90cnVzdCIsImlhdCI6MTQ5MzAwMTA0OCwiZXhwIjoxNDkzMDA0NjQ4LCJhdXRoX3RpbWUiOjE0OTMwMDEwNDgsIm5vbmNlIjoiYTJjNTYyOTYtZmJhZi00NGFhLThmMzktYzBiYTY0MjllZDcyIiwic3ViIjoiZG1QeHBzaWxpbEZPcys1OTFxVitNS1ZKZ1VuYzBuc01PSHdYUWgrZlhxND0iLCJ1cG4iOiJ2c2hpbmRlQG1pdXRpbGl0eWFkZnMuY29tIiwidW5pcXVlX25hbWUiOiJNSVVUSUxJVFlBREZTMFxcdnNoaW5kZSJ9.J8MQ_DYZpDmKwcpFPmqVu2Ed9nV7seHCWdEWKBBk_cOykBJPVupYFEJ_2G0I80wEFk9S6qziGhfB8yGGSNVydkKC_6L8bxo7bf0N4IEzHNjwd3kxvUpILrxi6npWRJyxSz30am-H0H2c6n-3AhXRAPGYRjw79zwh_B13DDIXr6IreSYOZaWD37sj6YMHHaMyFHi2fAmU9oJfQVXFssC9BuZ-L034Umc2UG6_U_7j5N7qgBFU1rR0afS8ObbIKl9_q1S_zgehx_Wx4vpp1tnW5f5gquTHvRGPTU9TxpZpGZ6whSkLBoL-OG5orRwyAQBzLdO1rftMK1-cfFOLa40vhg&state=39e9c209-db12-4ebb-b362-56856d172e72 [~] Identified as: windows, iis, asp, aspx [~] Analysis resulted in 0 usable paths. [~] DOM depth: 1 (Limit: 5) [~] Transitions: [~] -- [4.0224s] load => page (http://dev-miu-rs.miutility.com/#id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IjFPTmlzMU1lUHg5QXRfMlB6UjQ1WW1YN1ZqQSIsImtpZCI6IjFPTmlzMU1lUHg5QXRfMlB6UjQ1WW1YN1ZqQSJ9.eyJhdWQiOiIwMTc0YzZhOC0yNGIwLTQ3NjAtOTVlOC1jMDIyNGQ3M2YwMDYiLCJpc3MiOiJodHRwczovL21pdXRpbGl0eWFkZnMubWl1dGlsaXR5YWRmcy5jb20vYWRmcy9zZXJ2aWNlcy90cnVzdCIsImlhdCI6MTQ5MzAwMTA0OCwiZXhwIjoxNDkzMDA0NjQ4LCJhdXRoX3RpbWUiOjE0OTMwMDEwNDgsIm5vbmNlIjoiYTJjNTYyOTYtZmJhZi00NGFhLThmMzktYzBiYTY0MjllZDcyIiwic3ViIjoiZG1QeHBzaWxpbEZPcys1OTFxVitNS1ZKZ1VuYzBuc01PSHdYUWgrZlhxND0iLCJ1cG4iOiJ2c2hpbmRlQG1pdXRpbGl0eWFkZnMuY29tIiwidW5pcXVlX25hbWUiOiJNSVVUSUxJVFlBREZTMFxcdnNoaW5kZSJ9.J8MQ_DYZpDmKwcpFPmqVu2Ed9nV7seHCWdEWKBBk_cOykBJPVupYFEJ_2G0I80wEFk9S6qziGhfB8yGGSNVydkKC_6L8bxo7bf0N4IEzHNjwd3kxvUpILrxi6npWRJyxSz30am-H0H2c6n-3AhXRAPGYRjw79zwh_B13DDIXr6IreSYOZaWD37sj6YMHHaMyFHi2fAmU9oJfQVXFssC9BuZ-L034Umc2UG6_U_7j5N7qgBFU1rR0afS8ObbIKl9_q1S_zgehx_Wx4vpp1tnW5f5gquTHvRGPTU9TxpZpGZ6whSkLBoL-OG5orRwyAQBzLdO1rftMK1-cfFOLa40vhg&state=39e9c209-db12-4ebb-b362-56856d172e72) [~] * [0.0999s] request => http://dev-miu-rs.miutility.com/ [~] * [0.1001s] request => http://dev-miu-rs.miutility.com/feature/get [~] * [0.0996s] request => http://dev-miu-rs.miutility.com/settings/get [*] [HTTP: 200] http://dev-miu-rs.miutility.com/miagent/launch-pad [~] Identified as: windows, iis, asp, aspx [~] Analysis resulted in 0 usable paths. [~] DOM depth: 0 (Limit: 5) [*] Workload exhausted, waiting for new pages from the browser-cluster... [~] BrowserCluster: Pending jobs: 2 [~] BrowserCluster: Pending jobs: 1 ================================================================================ [+] Web Application Security Report - Arachni Framework [~] Report generated on: 2017-04-24 05:31:09 +0300 [~] Report false positives at: http://github.com/Arachni/arachni/issues [+] System settings: [~] --------------- [~] Version: 2.0dev [~] Seed: 90c50c29a1373dc4102269211a3018c4 [~] Audit started on: 2017-04-24 05:30:42 +0300 [~] Audit finished on: 2017-04-24 05:31:09 +0300 [~] Runtime: 00:00:27 [~] URL: http://dev-miu-rs.miutility.com/miagent/launch-pad [~] User agent: Arachni/v2.0dev [*] Audited elements: [~] * Links [~] * Forms [~] * Cookies [~] * XMLs [~] * JSONs [~] * UI inputs [~] * UI forms [*] Checks: [~] =========================== [+] 0 issues were detected. [+] Plugin data: [~] --------------- [*] Health map [~] ~~~~~~~~~~~~~~ [~] Description: Generates a simple list of safe/unsafe URLs. [~] Legend: [+] No issues [-] Has issues [+] http://dev-miu-rs.miutility.com/#id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IjFPTmlzMU1lUHg5QXRfMlB6UjQ1WW1YN1ZqQSIsImtpZCI6IjFPTmlzMU1lUHg5QXRfMlB6UjQ1WW1YN1ZqQSJ9.eyJhdWQiOiIwMTc0YzZhOC0yNGIwLTQ3NjAtOTVlOC1jMDIyNGQ3M2YwMDYiLCJpc3MiOiJodHRwczovL21pdXRpbGl0eWFkZnMubWl1dGlsaXR5YWRmcy5jb20vYWRmcy9zZXJ2aWNlcy90cnVzdCIsImlhdCI6MTQ5MzAwMTA0OCwiZXhwIjoxNDkzMDA0NjQ4LCJhdXRoX3RpbWUiOjE0OTMwMDEwNDgsIm5vbmNlIjoiYTJjNTYyOTYtZmJhZi00NGFhLThmMzktYzBiYTY0MjllZDcyIiwic3ViIjoiZG1QeHBzaWxpbEZPcys1OTFxVitNS1ZKZ1VuYzBuc01PSHdYUWgrZlhxND0iLCJ1cG4iOiJ2c2hpbmRlQG1pdXRpbGl0eWFkZnMuY29tIiwidW5pcXVlX25hbWUiOiJNSVVUSUxJVFlBREZTMFxcdnNoaW5kZSJ9.J8MQ_DYZpDmKwcpFPmqVu2Ed9nV7seHCWdEWKBBk_cOykBJPVupYFEJ_2G0I80wEFk9S6qziGhfB8yGGSNVydkKC_6L8bxo7bf0N4IEzHNjwd3kxvUpILrxi6npWRJyxSz30am-H0H2c6n-3AhXRAPGYRjw79zwh_B13DDIXr6IreSYOZaWD37sj6YMHHaMyFHi2fAmU9oJfQVXFssC9BuZ-L034Umc2UG6_U_7j5N7qgBFU1rR0afS8ObbIKl9_q1S_zgehx_Wx4vpp1tnW5f5gquTHvRGPTU9TxpZpGZ6whSkLBoL-OG5orRwyAQBzLdO1rftMK1-cfFOLa40vhg&state=39e9c209-db12-4ebb-b362-56856d172e72 [+] http://dev-miu-rs.miutility.com/miagent/launch-pad [~] Total: 2 [+] Without issues: 2 [-] With issues: 0 ( 0% ) [*] Login script [~] ~~~~~~~~~~~~~~ [~] Description: Loads and sets an external script as the system's login sequence, to be executed prior to the scan and whenever a log-out is detected. The script needn't necessarily perform an actual login operation. If another process is used to manage sessions, the script can be used to communicate with that process and, for example, load and set cookies from a shared cookie-jar. # Ruby ## With browser (slow) If a [browser](http://watir.github.io/) is available, it will be exposed to the script via the `browser` variable. Otherwise, that variable will have a value of `nil`. browser.goto 'http://testfire.net/bank/login.aspx' form = browser.form( id: 'login' ) form.text_field( name: 'uid' ).set 'jsmith' form.text_field( name: 'passw' ).set 'Demo1234' form.submit # You can also configure the session check from the script, dynamically, # if you don't want to set static options via the user interface. framework.options.session.check_url = browser.url framework.options.session.check_pattern = /Sign Off|MY ACCOUNT/ ## Without browser (fast) If a real browser environment is not required for the login operation, then using the system-wide HTTP interface is preferable, as it will be much faster and consume much less resources. response = http.post( 'http://testfire.net/bank/login.aspx', parameters: { 'uid' => 'jsmith', 'passw' => 'Demo1234' }, mode: :sync, update_cookies: true ) framework.options.session.check_url = to_absolute( response.headers.location, response.url ) framework.options.session.check_pattern = /Sign Off|MY ACCOUNT/ ## From cookie-jar If an external process is used to manage sessions, you can keep Arachni in sync by loading cookies from a shared Netscape-style cookie-jar file. http.cookie_jar.load 'cookies.txt' ## Advanced session check configuration In addition to just settings the `check_url` and `check_pattern` options, you can also set arbitrary HTTP request options for the login check, to cover cases where extra tokens or a method other than `GET` must be used. session.check_options = { # :get, :post, :put, :delete method: :post, # URL query parameters. parameters: { 'param1' => 'value' }, # Request body parameters -- can also be a String instead of Hash. body: { 'body_param1' => 'value' }, cookies: { 'custom_cookie' => 'value' }, headers: { 'X-Custom-Header' => 'value' } } # Javascript When the given script has a `.js` file extension, it will be loaded and executed in the browser, within the page of the target URL. document.getElementById( 'uid' ).value = 'jsmith'; document.getElementById( 'passw' ).value = 'Demo1234'; document.getElementById( 'login' ).submit(); [+] Login was successful. [~] Cookies set to: [~] * MSISAuth = AAEAAD7QbQpMpMHrs5RYlZYER30bIx8jkaGCYHPOtRXgbnoi36ftcOKeiA8CyYmRpTArEQIj4Z caxux9TbkJCGg/BqySQVG12umNz9WH0aoB/jOdFyU5PYj075jWE74A3tgZO5U4bYzYuN7i3oLoPcBTwvlKbbxu692EFiK1uvAdNfR9CnSKtp69zQ1stzwpPZyTBhEOYQ3BEQDgNUoaJRYyb8gQjp94zxWmn5SHi8GXumla076c/GPASWN/D2jIJJWQR4iC1XV03C/bRmxJfMYJWndy0NOnWWxdFANtHAwRqKlpnv6V2G0BH3FFrKovXz7 ubpGRmEJpEG2HRkzE6kEMI55wnpRSC3ieQmPLu2rV3/450DgaI8kPxz00TkEAkVKwABAABJ7sqf40I7VuEWbGLgRxoP139p612/EAu98Nn9W0 eWBXi2Mk59yrTY2z4dObhdi9 qcelx1STGw2fkNQArTyYcwHalzE6RFKOKpdhNQRbZh7Z/tO4ScCY9C5flWts0hbUCXRjCCDON273B25dSRa8EoAx7 4j9pP8bHW34KBpTWtFSG c9jpClBJHie4i26GnGvzvYDOrvnRlQJxh7AhlRfYeb6i2eLteHslLRx5BCPMBoqF OxkxvTvSypBKD6vybZG9UAyerDQjf6pp2w/UA1 w1k53KAGlWLRudXnxBJOnleuswHP2GghflQz7sNxB2OWbG3rPpePrfwhdX3SnIAMAAPOTqfnq xDfwSrr/1E7mmrib52pQNeCpouFMlEJOm0Np8YQFrADHyiUwAMaPQyzkMdtzZDls fOOhVl5fYlFxtimPtkPXLhlphIMbVsUj2Wk0cYo/XrlJGgu2BmfHH8WYQlGoMAdXkNYwuZij2JsC7 Gtjj5IIPGM5DzKFGIfANb6fG4ey2cORRlIhjKn89fhkd47NwOipWVsgwyfcTsxZibRVvfZj7OOnYxlqZkvCyms02HwmSWOG3D/QRcVxFLax3GYeg3xkDaAZ2LAJrVIiZ/InW10WhnUapPhi6USzF2bTf/ jNea3/DSs2fmlEGnGeTU7X7Lk7vc0/2u8078mzVbUKnkweEfjoYCGYNUNZl1A6i7XyFdCFd3Nkan2Ia1AvoAFqhWBN7vf3G2Err90 4C6z6DyJlUE544A6mMl3miZRSeDcgGmH7Qc/71onDhXLL0LRKOc1uFGRS4UqY3b5LDCJ0ZDY/AqlcONAd186gEiYqy aCdlJRQkjKNSvprU9cI7xppx10TGd7yd5pnwPeXHNqzhm55yzz0YOQgXH2d 1WlpRsd75fWebzGhM qWcBG2c2DQ/4Gs5x30rzry01tY53Y96dFesL1GZEi6bde8ygvYU0nQT0fzOZAsoUeGZHKFxQL4rwy/IwclW9SHLOTuuCs4JiQ6Mg9MQlWZ48S1cDxCU45Aeo6ILNSJf6 JgZ0Haa EdJTqhRydoTokIoS32W6HMf6ZyFvnYTaZbwWSx37r5Y9bsETtZTOS/fuCyRF1OrLS7PIH3KfP/m/13CnE zx7F6UfzfLjvhGoNv3SVVK05fOizzN5UQurjQqw TKqlcGVLhC680GLZep0Isxv9T7s7a2dDE1cJWlBEAgKuuTsW5Zav/zjTFfBY/vo21xj2qfAnCazYIDWc5B/LeXXoGrBQwX6L7p/Akr8RSXANkohkXQEb4FNba47gsWN7qJcuDcphfWiGDPuqjMt58Ni84wu7BZh7qDaR6q4tmI84uSWtMfXOACOTpNeUhOvzcp tIzN3dzzNwKFmrw3OgNI0hEdPKsfxW7X9kS23 [~] * MSISAuthenticated = NC8yNC8yMDE3IDI6MzA6NDggQU0= [~] * MSISLoopDetectionCookie = MjAxNy0wNC0yNDowMjozMDo0OFpcMQ== [~] Report saved at: /home/vortiz/arachni/miagent/dev-miu-rs.miutility.com 2017-04-24 05_31_09 +0300.afr [0.0MB] [~] Audited 2 page snapshots. [~] Duration: 00:00:27 [~] Processed 22/22 HTTP requests. [~] -- 2.451 requests/second. [~] Processed 2/2 browser jobs. [~] -- 6.0 second/job. [~] Currently auditing http://dev-miu-rs.miutility.com/miagent/launch-pad [~] Burst response time sum 0.391 seconds [~] Burst response count 6 [~] Burst average response time 0.065 seconds [~] Burst average 0.0 requests/second [~] Timed-out requests 0 [~] Original max concurrency 20 [~] Throttled max concurrency 20