Class: Arachni::BrowserCluster::Jobs::TaintTrace

Inherits:
DOMExploration show all
Defined in:
lib/arachni/browser_cluster/jobs/taint_trace.rb,
lib/arachni/browser_cluster/jobs/taint_trace/result.rb,
lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb,
lib/arachni/browser_cluster/jobs/taint_trace/event_trigger/result.rb

Overview

Traces a #taint throughout the JS environment of the given DOMExploration#resource. It also allows custom JS code to be executed under the same scope in order to directly introduce the #taint.

It will pass each evaluated page with the result.

Author:

  • Tasos “Zapotek” Laskos <tasos.laskos@arachni-scanner.com>

Defined Under Namespace

Classes: EventTrigger, Result

Instance Attribute Summary collapse

Attributes inherited from DOMExploration

#resource

Attributes inherited from Arachni::BrowserCluster::Job

#args, #browser, #forwarder, #time

Instance Method Summary collapse

Methods inherited from DOMExploration

#clean_copy, #dup, #initialize

Methods inherited from Arachni::BrowserCluster::Job

#==, #clean_copy, #configure_and_run, #dup, #forward, #forward_as, #hash, #id, #initialize, #never_ending=, #never_ending?, #save_result, #timed_out!, #timed_out?

Constructor Details

This class inherits a constructor from Arachni::BrowserCluster::Jobs::DOMExploration

Instance Attribute Details

#injector ⇒ String

Returns JS code to execute in order to introduce the taint.

Returns:

  • (String) —

    JS code to execute in order to introduce the taint.



33
34
35
 
# File 'lib/arachni/browser_cluster/jobs/taint_trace.rb', line 33

def injector
  @injector
end

#taint ⇒ String

Returns Taint to trace throughout the data-flow of the JS environment.

Returns:

  • (String) —

    Taint to trace throughout the data-flow of the JS environment.



29
30
31
 
# File 'lib/arachni/browser_cluster/jobs/taint_trace.rb', line 29

def taint
  @taint
end

Instance Method Details

#run ⇒ Object 



35
36
37
38
39
40
41
42
 
# File 'lib/arachni/browser_cluster/jobs/taint_trace.rb', line 35

def run
    browser.javascript.taint       = self.taint
    browser.javascript.custom_code = self.injector

    browser.on_new_page_with_sink { |page| save_result( page: page ) }

    super
end

#to_s ⇒ Object Also known as: inspect 



44
45
46
47
48
 
# File 'lib/arachni/browser_cluster/jobs/taint_trace.rb', line 44

def to_s
    "#<#{self.class}:#{object_id} @resource=#{@resource} " <<
        "@taint=#{@taint.inspect} @injector=#{@injector.inspect} " <<
        "time=#{@time} timed_out=#{timed_out?}>"
end