def test_sampling_removes_origin_information(self):
sample_a = '<iframe sandbox="allow-same-origin allow-scripts allow-top-navigation" id="preferredMethod" src="https://www.example.com:2096/unprotected/loader.html?random=Hh2c1OlZNtIkWS8F&goto_uri=%2ffiles.inc" style="display:none;"></iframe>' * 10 # noqa
sample_b = '<iframe sandbox="allow-same-origin allow-scripts allow-top-navigation" id="preferredMethod" src="https://www.example.com:2096/unprotected/loader.html?random=nsfufafuidafKNUF&goto_uri=%2fabc12345678901234567890.inc" style="display:none;"></iframe>' * 10 # noqa
comparator = ContentSampling()
sig_a = ContentSignature(code=200,
content_sample=comparator._sample(
sample_a, "http://example.com/files.inc"))
sig_b = ContentSignature(code=200,
content_sample=comparator._sample(
sample_b,
"http://example.com/abc123.inc"))
self.assertTrue(sig_a.match_sample(sig_b))
def config_hammertime(self):
global_heuristics = [
DynamicTimeout(0.05, 2),
RetryOnErrors(range(500, 503)),
DeadHostDetection(threshold=200),
ContentHashSampling(),
ContentSampling(),
ContentSimhashSampling()
]
soft_404 = DetectSoft404()
follow_redirects = FollowRedirects()
reject_error_code = RejectStatusCode(range(400, 600))
heuristics = [
reject_error_code,
RejectWebApplicationFirewall(),
RejectCatchAllRedirect(), follow_redirects, soft_404,
HashResponse(),
SetExpectedMimeType(),
RejectUnexpectedResponse()
]
self.hammertime.heuristics.add_multiple(global_heuristics)
self.hammertime.heuristics.add_multiple(heuristics)
soft_404.child_heuristics.add_multiple(global_heuristics)
follow_redirects.child_heuristics.add(reject_error_code)
follow_redirects.child_heuristics.add_multiple(global_heuristics)
def setUp(self):
self.rule = DetectSoft404(collect_retry_delay=0.0, tail_lookup=False)
self.engine = FakeEngine()
self.runner = Pipeline(engine=self.engine)
self.runner.add(ContentHashSampling(), with_child=True)
self.runner.add(ContentSampling(), with_child=True)
self.runner.add(ContentSimhashSampling(), with_child=True)
self.runner.add(self.rule)
self.kb = self.runner.kb
self.rule.child_heuristics = self.runner.child_heuristics
self.host = "http://example.com"
def setup_hammertime_heuristics(hammertime,
*,
user_agent=default_user_agent,
vhost=None,
confirmation_factor=1,
har_output_dir=None):
global heuristics_with_child
dead_host_detection = DeadHostDetection(threshold=200)
detect_soft_404 = DetectSoft404(distance_threshold=6,
confirmation_factor=confirmation_factor)
follow_redirects = FollowRedirects()
heuristics_with_child = [
RejectCatchAllRedirect(), follow_redirects,
RejectIgnoredQuery()
]
hosts = (vhost,
conf.target_host) if vhost is not None else conf.target_host
init_heuristics = [
SetHeader("User-Agent", user_agent),
SetHeader("Host", vhost if vhost is not None else conf.target_host),
ContentHashSampling(),
ContentSampling(),
ContentSimhashSampling(), dead_host_detection,
RejectStatusCode({503, 508}, exception_class=StopRequest),
StripTag('input'),
StripTag('script')
]
global_heuristics = [
RejectStatusCode({404, 406, 502}),
RejectWebApplicationFirewall(),
DynamicTimeout(1.0, 5),
RedirectLimiter(),
FilterRequestFromURL(allowed_urls=hosts),
IgnoreLargeBody(initial_limit=initial_limit)
]
# Dead host detection must be first to make sure there is no skipped after_headers
hammertime.heuristics.add_multiple(init_heuristics)
# General
hammertime.heuristics.add_multiple(global_heuristics)
hammertime.heuristics.add_multiple(heuristics_with_child)
hammertime.heuristics.add_multiple([
detect_soft_404,
MatchString(),
ValidateEntry(),
DetectBehaviorChange(buffer_size=100),
LogBehaviorChange(),
ValidateEntry(),
])
detect_soft_404.child_heuristics.add_multiple(init_heuristics)
detect_soft_404.child_heuristics.add_multiple(heuristics_with_child)
for heuristic in heuristics_with_child:
heuristic.child_heuristics.add_multiple(init_heuristics)
heuristic.child_heuristics.add_multiple(global_heuristics)
if har_output_dir is not None:
from tachyon.har import StoreHAR, FileWriter
hammertime.heuristics.add(StoreHAR(writer=FileWriter(har_output_dir)))