components/checks/active/ldap_injection.rb in arachni-1.3.2 vs components/checks/active/ldap_injection.rb in arachni-1.4
- old
+ new
@@ -1,17 +1,16 @@
=begin
- Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+ Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
This file is part of the Arachni Framework project and is subject to
redistribution and commercial restrictions. Please see the Arachni Framework
web site for more information on licensing and terms of use.
=end
# LDAP injection check.
#
# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.3
#
# @see http://cwe.mitre.org/data/definitions/90.html
# @see http://projects.webappsec.org/w/page/13246947/LDAP-Injection
# @see https://www.owasp.org/index.php/LDAP_injection
class Arachni::Checks::LdapInjection < Arachni::Check::Base
@@ -21,12 +20,12 @@
end
def run
# This string will hopefully force the webapp to output LDAP error messages.
audit( '#^($!@$)(()))******',
- format: [Format::APPEND],
- substring: self.class.error_strings
+ format: [Format::APPEND],
+ signatures: self.class.error_strings
)
end
def self.info
{
@@ -35,10 +34,10 @@
It tries to force the web application to return LDAP error messages, in order to
discover failures in user input validation.
},
elements: ELEMENTS_WITH_INPUTS,
author: 'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
- version: '0.1.3',
+ version: '0.1.4',
issue: {
name: %q{LDAP Injection},
description: %q{
Lightweight Directory Access Protocol (LDAP) is used by web applications to access