or Create a profile

Home → Questions →

XSS testing of Cookie Keys

Steven Phillips's Avatar

Steven Phillips

26 May, 2017 03:52 PM

First off I'd like to give thanks to the dev & support team of Arachni for providing such a good tool!

I am new to Arachni so this could be covered elsewhere, but if so I've failed to find it. So far I have Arachni successfully crawling through our site and having given it an insecure version I am hoping it will find various known issues. It has done very well, finding most of the issues, but there is one hole to do with our use of cookies.

We use keys within cookies, i.e. multiple key=value pairs within one cookie, so rather than have:

Cookies: name1=value1; name2=value2;

We have:

Cookies: name1=key1=value1&key2=value2;

This means that when testing for XSS the payload should be injected into both key1 & key2, but currently it appears that Arachni only injects at the end of the Cookie value so only key2 is injected, key1 is never tested. Ideally I would like it try both of the following (i.e. as if it was 2 different cookies):

Cookies: name1=key1=value1<inject-here>&key2=value2;
Cookies: name1=key1=value1&key2=value2<inject-here>;

Can Arachni be configured to do this? If so how? And if not how hard would it be to implement?

I can give a working example if needed.

  1. Support Staff 1 Posted by Tasos Laskos on 26 May, 2017 04:13 PM

    Tasos Laskos's Avatar

    I think that you're looking for this: https://github.com/Arachni/arachni/wiki/Command-line-user-interface...

    Give it a try and let me know how it works.

    Cheers

  2. 2 Posted by Steven Phillips on 26 May, 2017 06:14 PM

    Steven Phillips's Avatar

    Hi Tasos,

    Thanks for the quick response. I've tried the option but it doesn't seem to work, running with --output-debug I get the following printed in the console:

    [*] Response Splitting: Auditing cookie input 'ATEST' pointing to: 'https://localhost/atest/'
[*] Response Splitting: Auditing cookie input 'Parameter name fuzzing' pointing to: 'https://localhost/atest/'

    I only get the second line if I use the --audit-parameter-names option, so its getting the option, but its not identifying the obvious coding flaw. The cookie ATEST is initialised to:

    Cookies: ATEST=ua=2&nm=John+Doe&uk=23;

    And then my test website does the dumbest thing of:

    nm = Request.Cookies("ATEST")("nm")
If nm = "" Then Response.Write "Not set" Else Response.Write nm

    i.e. no Html encoding, so any injection into the 'nm' cookie key would work - but Arachni is not finding it.

    What have I missed?

  3. Support Staff 3 Posted by Tasos Laskos on 27 May, 2017 03:48 PM

    Tasos Laskos's Avatar

    I don't think Arachni can do what you want, there's no support for nested cookies -- is that actually a thing? I've never come across it before.

    Out of curiosity, can you please show me the Set-Cookie header?

  4. 4 Posted by Steven Phillips on 28 May, 2017 12:14 PM

    Steven Phillips's Avatar

    Hi Tasos

    I've cut the example down to 2 simple files which should run in any version of IIS which ASP enabled.

    First file: atest.asp

    <%
If Request.Cookies("ATEST1") = "" Then
  nm = "John Doe"
  Response.Cookies("ATEST1")("uk") = 23
  Response.Cookies("ATEST1")("nm") = nm
  Response.Cookies("ATEST1")("ua") = 2
Else
  nm = Request.Cookies("ATEST1")("nm")
End If
Response.Write "<!DOCTYPE html PUBLIC ""-//W3C//DTD XHTML 1.0 Strict//EN"" ""http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd""><html xmlns=""http://www.w3.org/1999/xhtml"" lang=""en"" xml:lang=""en""><head><title>Test1 for Arachni</title></head><body>"
Response.Write "<form action=""setNameEx.asp"" method=""post""><div><p><strong>Name:</strong> "
If nm = "" Then Response.Write "Not set" Else Response.Write nm
Response.Write "<br/><br/><strong>Enter name</strong>&nbsp;&nbsp;<input name=""nam"" type=""text"" maxlength=""100"" value="""
Response.Write nm
Response.Write """/><br/><br/>&nbsp;&nbsp;&nbsp;&nbsp;<input name=""mems"" value=""Save changes"" type=""submit""/>&nbsp;&nbsp;<input name=""mems"" value=""Cancel"" type=""submit""/>"
Response.Write "</div></form>"
Response.Write "</body></html>"
%>

    Second file: setNameEx.asp

    <%
If Request("mems") <> "Cancel" Then Response.Cookies("ATEST1")("nm") = Request("nam")
Response.Redirect("atest1.asp")
%>

    When first loaded the initialisation of ATEST1 leads to:

    Set-Cookie: ATEST1=ua=2&nm=John+Doe&uk=23;

    Note the order is reversed, i.e. the initialisation order is uk, nm & then ua and the order in the cookie is ua, nm, uk. When I set the name to 'John&Doe' the following is returned:

    Set-Cookie: ATEST1=nm=John%26Doe&uk=23&ua=2;

    Note nm becomes first, so the last modified key is given first. This is the worst behaviour for arachni as any added/changed key will never be injected.

    Note also that IIS URL encodes the values so a '&' is a reliable key separator.

    So would it be possible to create a '--cookie-has-keys' option which can be used multiple times, taking a cookie name and ideally makes Arachni inject before any '&' as well as at the end?

    As I said, Arachni is so close to doing all I want it to but as you can see, this is rather a large hole for us. I would be happy to try any implement this if you thought it feasible and could give me a few pointers...

    Thanks.

  5. Support Staff 5 Posted by Tasos Laskos on 28 May, 2017 12:42 PM

    Tasos Laskos's Avatar

    I should be able to swing that, adding new input vectors to Arachni isn't that difficult but I'll have to do it myself.
    It may take a while to get to this though.

  6. 6 Posted by Steven Phillips on 28 May, 2017 01:02 PM

    Steven Phillips's Avatar

    Anything I can do to help? I'll certainly be happy to test :-)

  7. Support Staff 7 Posted by Tasos Laskos on 28 May, 2017 01:08 PM

    Tasos Laskos's Avatar

    You've been most helpful already, I understand the behavior you need. Once I have something that you can test I'll let you know.
    I sense that you need this soon, so I'm making it my next task. I'll try to start work on this within a couple of days.

  8. 8 Posted by Steven Phillips on 28 May, 2017 01:38 PM

    Steven Phillips's Avatar

    Much appreciated Tasos!

  9. Support Staff 9 Posted by Tasos Laskos on 31 May, 2017 03:16 PM

    Tasos Laskos's Avatar

    I think I got it working, I need to run a few time consuming tests before I push the change though. Might take a couple more days.

  10. 10 Posted by Steven Phillips on 31 May, 2017 06:30 PM

    Steven Phillips's Avatar

    Excellent news - looking forward to giving it a hammering :-)

    While on the subject of cookies, I've been looking for a way to stop Arachni audit a specific cookie (we use a cookie internally for testing that does not need injecting etc) and found various web references to the '--exclude-cookie' option but this no longer appears to exist.

    Has this functionality been removed or is there still a way to stop a specific cookie from being audited?

    Thanks

  11. Support Staff 11 Posted by Tasos Laskos on 31 May, 2017 06:33 PM

    Tasos Laskos's Avatar

  12. 12 Posted by Steven Phillips on 31 May, 2017 08:31 PM

    Steven Phillips's Avatar

    That's what I'm after - thanks!

  13. Support Staff 13 Posted by Tasos Laskos on 06 Jun, 2017 09:20 AM

    Tasos Laskos's Avatar

    Done: https://github.com/Arachni/arachni/commit/6a4135b062d56711809628042...

    Give the nightlies a try, the option is called --audit-nested-cookies.

  14. 14 Posted by Steven Phillips on 06 Jun, 2017 11:51 AM

    Steven Phillips's Avatar

    Hi Tasos,

    I've downloaded and installed, verified the option is being used but nothing is being reported!?! What am I doing wrong? In the console I see:

    [*] XSS: Auditing cookie input 'ATEST1' pointing to: 'https://localhost/atest1.asp'
[*] XSS: Auditing nested_cookie input 'nm' pointing to: 'https://localhost/atest1.asp'

    and atest1.asp does:

    nm = Request.Cookies("ATEST1")("nm")
Response.Write nm

    So no attempt to check the value of 'nm' or protect the output but arachni is not reporting the issue. Is there any way to see what its injecting or the response it got? I've tried using page_dump plugin but I only got 3 yaml files and none had an injection (so is this limited to the initial output from the spider?).

    This looks so close now but I'm confused as to why it hasn't spotted the injection, best guess would be that the injected value wasn't URL encoded so IIS broke the injection...

  15. Support Staff 15 Posted by Tasos Laskos on 07 Jun, 2017 08:34 AM

    Tasos Laskos's Avatar

    The page_dump plugin will only save pages as they're crawled, it won't dump all HTTP responses. My advice would be to use a proxy to see what's going on.

  16. 16 Posted by Steven Phillips on 07 Jun, 2017 11:42 AM

    Steven Phillips's Avatar

    Hi Tasos,

    I've reduced the checks-list down to just xss to keep things focused and found out what the problem is. When a non-nested cookie is used Arachni spots the weakness with any of the xss injections (but only lists one so changes on each run).

    The problem is in the way Arachni is trying to inject and encode the nested cookies. The format is the same as a URL line with query values and the encoding is very important, it has to be:

    <COOKIE-NAME>=<key1-name>=<key1-value>&<key2-name>=<key2-value>&....

    Where the key names and values are URL encoded but the '=' and '&' separators aren't and mustn't be. So:

    ATEST1=a=b&c=d&e=f

    Is a valid nested cookie with Request.Cookies("ATEST1")("a") == 'b', Request.Cookies("ATEST1")("c") == 'd' etc. However

    ATEST1=a%3Db%26c%3Dd%26e%3Df

    Is not a valid nested cookie it is now simply a cookie with a single value, this is why Arachni is not spotting my simple test case, the injected cookie value is sent as follows:

    ATEST1=ua%3D2%26nm%3DJohn+Doe%253Cxss_617d82c6b0fc3da69ad107e7a7a1ea9d%252F%253E%26uk%3D23

    So the page's call to Request.Cookies("ATEST1")("nm") returns an empty string.

    Given a nested cookie of 'ATEST1=a=b&c=d&e=f', the easiest way I can think of for injecting a nested-cookie is to literally insert the URL encoded injection before every '&', i.e. test:

    ATEST1=a=bINJECT%2DCODE&c=d&e=f
ATEST1=a=b&c=dINJECT%2DCODE&e=f

    To inject both 'a' and 'c' keys, injecting 'e' is not needed become the basic cookie injection will have done this key already. I've looked at some of the arachni ruby code and I must confess it did not make much sense to me, but if you want to send me a patch for testing I'm very happy to.

    One point of curiosity, as mentioned above, with each run I seem to get a different injection attempted, certainly not every injection and not the same one, but a random one. Is this by design? And does this mean that, in practice, I may get variable results depending on which injections were 'randomly' selected? I can imagine this is done so there is a balance between performance and coverage, i.e. each run is reasonable in time and full coverage is obtained over time with successive runs, but would be good to know this is by design not misconfiguration on my part.

    Thanks,

    Steve

  17. Support Staff 17 Posted by Tasos Laskos on 07 Jun, 2017 11:45 AM

    Tasos Laskos's Avatar

    I see, I'll update the code.

    Also, injections aren't random and are identical in all ways that matter, what changes is the seed (617d82c6b0fc3da69ad107e7a7a1ea9d) for each scan, which is random.
    Are you seeing something different?

  18. 18 Posted by Steven Phillips on 07 Jun, 2017 12:44 PM

    Steven Phillips's Avatar

    I am seeing something different - I've had to run my test case quite a few time and I've been comparing the injections given to a non-nested cookie (ATEST1M) with those of the nested one (ATEST1) and here are all the identifiied xss injections for the non-nested cookie for the last 5 runs:

    Run 10: <xss_6e0273565f8eaa2e3bc5aeeac244a501/>
Run 11: ()"&%1'-;<xss_185046ab4c535fb3be25aef5ff616098/>'
Run 12: ()"&%1'-;<xss_cfb7c88e73ff68c89e59bf4b4b42cf5f/>'
Run 13: </textarea>--><xss_617d82c6b0fc3da69ad107e7a7a1ea9d/><!--<textarea>
Run 14: </textarea>--><xss_299dcf513be02805200d79e993274027/><!--<textarea>
   and: <xss_299dcf513be02805200d79e993274027/>

    So only in the last run was more than one identified, however following is a list of HTTP_COOKIE values given when ATEST1M appears to be injected during run 13 (in order):

    ATEST1M=Hello+world!%253Cxss_617d82c6b0fc3da69ad107e7a7a1ea9d%252F%253E;ATEST1=ua=2&nm=John+Doe&uk=23
ATEST1M=Hello+world!%253Cxss_617d82c6b0fc3da69ad107e7a7a1ea9d%252F%253E;ATEST1=nm=&uk=23&ua=2
ATEST1M=Hello+world!</textarea>--><xss_617d82c6b0fc3da69ad107e7a7a1ea9d/><!--<textarea>;ATEST1=nm=&uk=23&ua=2

    The one arachni identified is the last one but the encoding of this is wrong for IIS with ASP, the initial non-injected value of HTTP_COOKIE is:

    ATEST1M=Hello+world%21;ATEST1=ua=2&nm=John+Doe&uk=23

    The ATEST1M value decoded is "Hello world!', IIS+ASP encodes the ' ' to a '+', but arachni appears to be decoding the %## part of the value, injecting and then not encoding the result.

    The other 2 values look like a double encoding - note the '%253Cxss' this decodes to '%3Cxss' which then further decodes to '<xss' - I don't know what caused this, especially as this appears in the first injection of ATEST1M.

    For the 14th run the following HTTP_COOKIE values were submitted (in order):

    ATEST1M=Hello+world!<xss_299dcf513be02805200d79e993274027/>;ATEST1=ua=2&nm=John+Doe&uk=23
ATEST1M=Hello+world!%2528%2529%2522%2526%25251%2527-%253B%253Cxss_299dcf513be02805200d79e993274027%252F%253E%2527;ATEST1=ua=2&nm=John+Doe&uk=23
ATEST1M=Hello+world!%253Cxss_299dcf513be02805200d79e993274027%252F%253E;ATEST1=nm=&uk=23&ua=2
ATEST1M=Hello+world!</textarea>--><xss_299dcf513be02805200d79e993274027/><!--<textarea>;ATEST1=nm=&uk=23&ua=2

    The first and last were reported but note the second, this appears to be a double encoded form of the injection identified in runs 11 & 12, this injection was not present in run 13 for ATEST1M in any encoded form.

    Please note at I am running classic ASP code on IIS so I'm using the no fingerprinting option having set platforms to 'windows mssql iis asp', I'm also using a profile afp file and option --profile-load-filepath rather than doing this all by command line options as this seems easier to read and maintain.

  19. Support Staff 19 Posted by Tasos Laskos on 14 Jun, 2017 11:12 AM

    Tasos Laskos's Avatar

    To be honest I'm a bit confused, I'm not sure I understand what you're describing.
    Regarding the encoding though, Arachni decodes the cookie and when it alters its value for the injection it encodes it again according to the RFC.

    Double encoded values are there simply because the XSS check also includes double encoded payloads.

    Regarding the encoding of & and = in the nested cookies, that's tricky because there's nothing about nested cookies in the RFC and those are sensitive characters.
    So, when it comes time for transport these are encoded and that happens in the HTTP client which isn't aware of the input vector. If I don't find a clean way of handling this I'm afraid that I'll have to revert the change and simply not supported nested cookies as input vectors.

  20. 20 Posted by Steven Phillips on 14 Jun, 2017 12:20 PM

    Steven Phillips's Avatar

    Hi Tasos,

    I'm anxious to get this working, not only for my benefit, but for all users of Arachni that are testing MS sites. If you go to a .Net site, e.g. msdn.microsoft.com or www.asp.net there are some base cookies, like MSFPC, which clearly have nested values so this is and will continue to be an important area of testing.

    Can you point me to this area of code, i.e. where the xss checker locates nested values and injects payloads and I'll have a play to see if I can be of any help.

    Thanks,

    Steve

  21. Support Staff 21 Posted by Tasos Laskos on 15 Jun, 2017 10:58 AM

    Tasos Laskos's Avatar

    It's not that simple (it's simpler in a sense), the checks aren't aware of the input vectors, they all expose the same API so there's not a place in the XSS check that handles nested cookies specifically.
    I got an idea of how to go about fixing this though, I'll let you know once I've got something that you can test.

  22. Support Staff 22 Posted by Tasos Laskos on 18 Jun, 2017 03:17 PM

    Tasos Laskos's Avatar

    Can you give the nightlies a try please?

  23. 23 Posted by Steven Phillips on 19 Jun, 2017 07:14 AM

    Steven Phillips's Avatar

    Hi Tasos,

    I'm getting an exception from the overnight build before it has started testing the site:

    [-] [utilities#exception_jail:428] [NoMethodError] undefined method `nested_cookies=' for #<Arachni::OptionGroups::Audit:0x0000000408d668>
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/option_group.rb:101:in `block in update'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/option_group.rb:101:in `each'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/option_group.rb:101:in `update'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/options.rb:291:in `block in update'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/options.rb:288:in `each'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/options.rb:288:in `update'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/options.rb:332:in `load'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/options.rb:57:in `method_missing'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/utilities.rb:206:in `block in load_profile'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/utilities.rb:425:in `call'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/utilities.rb:425:in `exception_jail'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/utilities.rb:205:in `load_profile'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/framework/option_parser.rb:638:in `block in profiles'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/option_parser.rb:46:in `call'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/option_parser.rb:46:in `block in on'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1396:in `call'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1396:in `block in parse_in_order'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1383:in `catch'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1383:in `parse_in_order'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1377:in `order!'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1469:in `permute!'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1491:in `parse!'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/option_parser.rb:73:in `parse'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/framework.rb:426:in `parse_options'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/framework.rb:32:in `initialize'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/bin/arachni:12:in `new'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/bin/arachni:12:in `<top (required)>'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/arachni-ui-web/bin/arachni:17:in `load'
[-] [utilities#exception_jail:428] c:/utils/arachni/system/arachni-ui-web/bin/arachni:17:in `<main>'
[-] [utilities#exception_jail:429] 
[-] [utilities#exception_jail:430] Parent:
[-] [utilities#exception_jail:431] Arachni::UI::CLI::Framework::OptionParser
[-] [utilities#exception_jail:432] 
[-] [utilities#exception_jail:433] Block:
[-] [utilities#exception_jail:434] #<Proc:0x00000006e4f8d0@c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/utilities.rb:205>
[-] [utilities#exception_jail:435] 
[-] [utilities#exception_jail:436] Caller:
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/utilities.rb:425:in `exception_jail'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/utilities.rb:205:in `load_profile'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/framework/option_parser.rb:638:in `block in profiles'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/option_parser.rb:46:in `call'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/option_parser.rb:46:in `block in on'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1396:in `call'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1396:in `block in parse_in_order'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1383:in `catch'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1383:in `parse_in_order'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1377:in `order!'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1469:in `permute!'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/2.2.0/optparse.rb:1491:in `parse!'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/option_parser.rb:73:in `parse'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/framework.rb:426:in `parse_options'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/framework.rb:32:in `initialize'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/bin/arachni:12:in `new'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/ruby/lib/ruby/gems/2.2.0/gems/arachni-1.5.1/bin/arachni:12:in `<top (required)>'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/arachni-ui-web/bin/arachni:17:in `load'
[-] [utilities#exception_jail:437] c:/utils/arachni/system/arachni-ui-web/bin/arachni:17:in `<main>'
[-] [utilities#exception_jail:438] --------------------------------------------------------------------------------

    Please let me know if you need any more information or if there is a simple way to patch this build.

    Thanks,

    Steve

  24. Support Staff 24 Posted by Tasos Laskos on 19 Jun, 2017 03:32 PM

    Tasos Laskos's Avatar

    Are you sure you used the nightlies? I'm seeing "arachni-1.5.1" in there.

  25. 25 Posted by Steven Phillips on 19 Jun, 2017 03:44 PM

    Steven Phillips's Avatar

    Hi Tasos,

    Sorry - I downloaded the overnight build and then extracted the release - Duhhh!

    And you are a star! Nested value now being correctly XSS injected and weakness in my test case has now been identify correctly - this is excellent news!

    I'm now going to run it on a less trivial test site and see what comes out...

    Thanks for your rapid help on this,

    Steve

  26. Support Staff 26 Posted by Tasos Laskos on 19 Jun, 2017 03:47 PM

    Tasos Laskos's Avatar

    Good to head, feel free to re-open this discussion if you come across any issues.

  27. Tasos Laskos closed this discussion on 19 Jun, 2017 03:47 PM.

Comments are currently closed for this discussion. You can start a new one.

  • New Issue

  • Conversation Started

  • The discussion is closed

    No more actions from Arachni or the discussion starter are required.

  • Re-open the discussion

Private Permissions

This discussion is private. Only you and Arachni support staff can see and reply to it.

Public Permissions

This discussion is public. Everyone can see and reply to it.

Keyboard shortcuts

Generic

? Show this help
ESC Blurs the current field

Comment Form

r Focus the comment reply box
^ + ↩ Submit the comment

You can use Command ⌘ instead of Control ^ on Mac

Recent Discussions

19 Oct, 2023 06:03 PM Error - Not able Scan /ruby/lib/ruby/gems/2.7.0/gems/arachni-1.6.1.3/lib/arachni/rpc/server/framework.rb:156:in `block in run'
12 Aug, 2023 11:04 AM Error when launching arachni_web
08 May, 2023 05:30 PM Security Assessment
05 May, 2023 10:53 AM REST API - Not detecting Any Issues
16 Mar, 2023 02:43 AM BITCOIN LOTTERY - SOFTWARE FREE

Recent Articles

Optimizing for faster scans
Service scanning
Software as a Service (Saas)