def setup_requester_tab(self):
self.historyRequestResponse = RequestResponseWidget(
self.framework, self.mainWindow.requesterHistoryTabWidget,
self.mainWindow.requesterHistorySearchResultsPlaceholder, self)
self.requesterHistoryDataModel = ResponsesDataModel.ResponsesDataModel(
self.framework, self)
self.mainWindow.requesterHistoryTreeView.setModel(
self.requesterHistoryDataModel)
self.mainWindow.requesterHistoryTreeView.activated.connect(
self.fill_history_request_response)
self.mainWindow.requesterHistoryTreeView.clicked.connect(
self.fill_history_request_response)
self.mainWindow.requesterHistoryTreeView.doubleClicked.connect(
self.requester_history_item_double_clicked)
self.historyResponsesContextMenu = ResponsesContextMenuWidget(
self.framework, self.requesterHistoryDataModel,
self.mainWindow.requesterHistoryTreeView, self)
self.historyResponsesContextMenu.set_currentChanged_callback(
self.fill_history_request_response)
self.sequenceRunnerRequestResponse = RequestResponseWidget(
self.framework, self.mainWindow.sequenceRunnerTabWidget,
self.mainWindow.sequenceRunnerSearchResultsPlaceholder, self)
self.sequenceRunnerDataModel = ResponsesDataModel.ResponsesDataModel(
self.framework, self)
self.mainWindow.sequenceRunnerTreeView.setModel(
self.sequenceRunnerDataModel)
self.mainWindow.sequenceRunnerTreeView.activated.connect(
self.fill_sequence_runner_request_response)
self.mainWindow.sequenceRunnerTreeView.clicked.connect(
self.fill_sequence_runner_request_response)
self.mainWindow.sequenceRunnerTreeView.doubleClicked.connect(
self.requester_sequence_runner_item_double_clicked)
self.sequence_runnerResponsesContextMenu = ResponsesContextMenuWidget(
self.framework, self.sequenceRunnerDataModel,
self.mainWindow.sequenceRunnerTreeView, self)
self.sequence_runnerResponsesContextMenu.set_currentChanged_callback(
self.fill_sequence_runner_request_response)
self.miniResponseRenderWidget = MiniResponseRenderWidget(
self.framework, self.mainWindow.reqRespTabWidget, True, self)
self.scopeController = self.framework.getScopeController()
def __init__(self, framework, mainWindow):
QObject.__init__(self, mainWindow)
self.framework = framework
self.mainWindow = mainWindow
self.mainWindow.domFuzzerStartButton.clicked.connect(
self.handle_fuzzerStart_clicked)
self.mainWindow.domFuzzerStopButton.clicked.connect(
self.handle_fuzzerStop_clicked)
self.mainWindow.domFuzzerClearQueueButton.clicked.connect(
self.handle_fuzzerClearQueue_clicked)
self.mainWindow.domFuzzerStartButton.setEnabled(True)
self.mainWindow.domFuzzerStopButton.setEnabled(False)
self.miniResponseRenderWidget = MiniResponseRenderWidget(
self.framework, self.mainWindow.domFuzzerResultsTabWidget, False,
self)
self.setup_fuzz_window()
self.Data = None
self.cursor = None
self.framework.subscribe_database_events(self.db_attach,
self.db_detach)
def __init__(self, framework, mainWindow):
QObject.__init__(self, mainWindow)
self.framework = framework
self.mainWindow = mainWindow
self.mainWindow.domFuzzerStartButton.clicked.connect(self.handle_fuzzerStart_clicked)
self.mainWindow.domFuzzerStopButton.clicked.connect(self.handle_fuzzerStop_clicked)
self.mainWindow.domFuzzerClearQueueButton.clicked.connect(self.handle_fuzzerClearQueue_clicked)
self.mainWindow.domFuzzerStartButton.setEnabled(True)
self.mainWindow.domFuzzerStopButton.setEnabled(False)
self.miniResponseRenderWidget = MiniResponseRenderWidget(self.framework, self.mainWindow.domFuzzerResultsTabWidget, False, self)
self.setup_fuzz_window()
self.Data = None
self.cursor = None
self.framework.subscribe_database_events(self.db_attach, self.db_detach)
def setup_requester_tab(self):
self.historyRequestResponse = RequestResponseWidget(self.framework, self.mainWindow.requesterHistoryTabWidget, self.mainWindow.requesterHistorySearchResultsPlaceholder, self)
self.requesterHistoryDataModel = ResponsesDataModel.ResponsesDataModel(self.framework, self)
self.mainWindow.requesterHistoryTreeView.setModel(self.requesterHistoryDataModel)
self.mainWindow.requesterHistoryTreeView.activated.connect(self.fill_history_request_response)
self.mainWindow.requesterHistoryTreeView.clicked.connect(self.fill_history_request_response)
self.mainWindow.requesterHistoryTreeView.doubleClicked.connect(self.requester_history_item_double_clicked)
self.historyResponsesContextMenu = ResponsesContextMenuWidget(self.framework, self.requesterHistoryDataModel, self.mainWindow.requesterHistoryTreeView, self)
self.historyResponsesContextMenu.set_currentChanged_callback(self.fill_history_request_response)
self.sequenceRunnerRequestResponse = RequestResponseWidget(self.framework, self.mainWindow.sequenceRunnerTabWidget, self.mainWindow.sequenceRunnerSearchResultsPlaceholder, self)
self.sequenceRunnerDataModel = ResponsesDataModel.ResponsesDataModel(self.framework, self)
self.mainWindow.sequenceRunnerTreeView.setModel(self.sequenceRunnerDataModel)
self.mainWindow.sequenceRunnerTreeView.activated.connect(self.fill_sequence_runner_request_response)
self.mainWindow.sequenceRunnerTreeView.clicked.connect(self.fill_sequence_runner_request_response)
self.mainWindow.sequenceRunnerTreeView.doubleClicked.connect(self.requester_sequence_runner_item_double_clicked)
self.sequence_runnerResponsesContextMenu = ResponsesContextMenuWidget(self.framework, self.sequenceRunnerDataModel, self.mainWindow.sequenceRunnerTreeView, self)
self.sequence_runnerResponsesContextMenu.set_currentChanged_callback(self.fill_sequence_runner_request_response)
self.miniResponseRenderWidget = MiniResponseRenderWidget(self.framework, self.mainWindow.reqRespTabWidget, True, self)
self.scopeController = self.framework.getScopeController()
class DomFuzzerTab(QObject):
class CallbackLogger():
def __init__(self):
self.messages = []
def log(self, source, url, message):
self.messages.append((source, url, message))
def clear_messages(self):
self.messages = []
def get_messages(self):
return self.messages
def __init__(self, framework, mainWindow):
QObject.__init__(self, mainWindow)
self.framework = framework
self.mainWindow = mainWindow
self.mainWindow.domFuzzerStartButton.clicked.connect(
self.handle_fuzzerStart_clicked)
self.mainWindow.domFuzzerStopButton.clicked.connect(
self.handle_fuzzerStop_clicked)
self.mainWindow.domFuzzerClearQueueButton.clicked.connect(
self.handle_fuzzerClearQueue_clicked)
self.mainWindow.domFuzzerStartButton.setEnabled(True)
self.mainWindow.domFuzzerStopButton.setEnabled(False)
self.miniResponseRenderWidget = MiniResponseRenderWidget(
self.framework, self.mainWindow.domFuzzerResultsTabWidget, False,
self)
self.setup_fuzz_window()
self.Data = None
self.cursor = None
self.framework.subscribe_database_events(self.db_attach,
self.db_detach)
def db_attach(self):
self.Data = self.framework.getDB()
self.cursor = self.Data.allocate_thread_cursor()
def db_detach(self):
self.close_cursor()
self.Data = None
def close_cursor(self):
if self.cursor and self.Data:
self.cursor.close()
self.Data.release_thread_cursor(self.cursor)
self.cursor = None
def handle_fuzzerStart_clicked(self):
self.mainWindow.domFuzzerStartButton.setEnabled(False)
self.mainWindow.domFuzzerStopButton.setEnabled(True)
self.domFuzzerThread.startFuzzing(self)
def handle_fuzzerStop_clicked(self):
self.mainWindow.domFuzzerStartButton.setEnabled(True)
self.mainWindow.domFuzzerStopButton.setEnabled(False)
self.domFuzzerThread.stopFuzzing()
def handle_fuzzerClearQueue_clicked(self):
self.domFuzzerThread.clearFuzzQueue()
def setup_fuzzer_results_treeview(self):
treeView = self.mainWindow.domFuzzerResultsTreeView
treeView.setSelectionMode(treeView.ExtendedSelection)
self.resultsTreeViewSelectionModel = QItemSelectionModel(
treeView.model())
treeView.setSelectionModel(self.resultsTreeViewSelectionModel)
treeView.clicked.connect(self.handle_resultsTreeView_clicked)
# self.resultsTreeViewSelectionModel.selectionChanged.connect(self.handle_selectionChanged)
self.resultsTreeViewSelectionModel.currentChanged.connect(
self.handle_currentChanged)
treeView.setContextMenuPolicy(Qt.CustomContextMenu)
self.connect(treeView,
SIGNAL("customContextMenuRequested(const QPoint&)"),
self.fuzzer_results_context_menu)
self.resultsMenu = QMenu(treeView)
self.copyUrlAction = action = QAction("Copy URL", self)
action.triggered.connect(self.fuzzer_results_copy_url)
self.resultsMenu.addAction(action)
def fuzzer_results_context_menu(self, point):
if len(self.resultsTreeViewSelectionModel.selectedRows()) > 1:
self.copyUrlAction.setText('Copy URLs')
else:
self.copyUrlAction.setText('Copy URL')
self.resultsMenu.exec_(
self.mainWindow.domFuzzerResultsTreeView.mapToGlobal(point))
def fuzzer_results_index_to_url(self, dataModel, index):
index = dataModel.index(index.row(), 5) # TODO: use constant
if index.isValid():
currentItem = dataModel.data(index)
if currentItem is not None:
url = currentItem
return url
return None
def fuzzer_results_copy_url(self):
url_list = []
dataModel = self.mainWindow.domFuzzerResultsTreeView.model()
for index in self.resultsTreeViewSelectionModel.selectedRows():
curUrl = self.fuzzer_results_index_to_url(dataModel, index)
if curUrl:
url_list.append(curUrl)
QApplication.clipboard().setText('\n'.join(url_list))
def setup_fuzz_window(self):
self.callbackLogger = self.CallbackLogger()
self.domFuzzerWebView = DomFuzzerWebView(self.framework,
self.callbackLogger,
self.mainWindow)
self.domFuzzerPlaceholderLayout = self.mainWindow.domFuzzerFuzzPlaceholder.layout(
)
if not self.domFuzzerPlaceholderLayout:
self.domFuzzerPlaceholderLayout = QVBoxLayout(
self.mainWindow.domFuzzerFuzzPlaceholder)
self.domFuzzerPlaceholderLayout.addWidget(self.domFuzzerWebView)
self.currentFuzzId = None
QObject.connect(self.domFuzzerWebView, SIGNAL('loadStarted()'),
self.handle_webView_loadStarted)
QObject.connect(self.domFuzzerWebView, SIGNAL('loadFinished(bool)'),
self.handle_webView_loadFinished)
def set_fuzzer_thread(self, domFuzzerThread):
self.domFuzzerThread = domFuzzerThread
QObject.connect(self,
SIGNAL('fuzzItemAvailable(int, QByteArray, QUrl)'),
self.handle_fuzzItemAvailable)
QObject.connect(self, SIGNAL('fuzzRunFinished()'),
self.handle_fuzzRunFinished)
self.qtimer = QTimer()
self.qtimer2 = QTimer()
QObject.connect(self.qtimer, SIGNAL('timeout()'),
self.handle_load_timeout)
QObject.connect(self.qtimer2, SIGNAL('timeout()'),
self.handle_render_timeout)
def handle_fuzzItemAvailable(self, fuzzId, htmlContent, qurl):
self.currentFuzzId = fuzzId
self.currentFuzzUrl = qurl.toEncoded().data().decode('utf-8')
self.callbackLogger.clear_messages()
self.qtimer.start(3000) # 3 seconds to finish
self.domFuzzerWebView.setContent(htmlContent, '', qurl)
def handle_webView_loadStarted(self):
# print('loading started')
pass
def handle_webView_loadFinished(self, ok):
url = self.domFuzzerWebView.url().toString()
# print(('handle_webView_loadFinished', ok, url))
if url == 'about:blank':
return
if self.qtimer.isActive():
self.qtimer.stop()
if self.qtimer2.isActive():
self.qtimer2.stop()
if ok:
self.qtimer2.start(1000) # 1 seconds to finish
else:
self.fuzzItemCompleted(ok)
def handle_load_timeout(self):
if self.qtimer.isActive():
self.qtimer.stop()
# print('forcbily stopping page')
self.domFuzzerWebView.stop()
self.fuzzItemCompleted(False)
def handle_render_timeout(self):
if self.qtimer2.isActive():
self.qtimer2.stop()
# TODO: should check progress
self.domFuzzerWebView.stop()
self.fuzzItemCompleted(True)
def fuzzItemCompleted(self, ok):
if self.currentFuzzId is not None:
mainFrame = self.domFuzzerWebView.page().mainFrame()
dom = mainFrame.documentElement()
html = dom.toOuterXml()
self.domFuzzerThread.fuzzItemFinished(
self.currentFuzzId, self.currentFuzzUrl, html,
self.callbackLogger.get_messages())
self.domFuzzerWebView.setUrl(QUrl('about:blank'))
self.currentFuzzId = None
def handle_fuzzRunFinished(self):
self.mainWindow.domFuzzerStartButton.setEnabled(True)
self.mainWindow.domFuzzerStopButton.setEnabled(False)
def handle_resultsTreeView_clicked(self):
index = self.mainWindow.domFuzzerResultsTreeView.currentIndex()
self.fill_results_view(index)
def handle_currentChanged(self, index):
self.fill_results_view(index)
def fill_results_view(self, index):
index = self.mainWindow.domFuzzerResultsDataModel.index(
index.row(), DomFuzzerResultsTable.ID)
if index.isValid():
currentItem = self.mainWindow.domFuzzerResultsDataModel.data(index)
if currentItem is not None:
fuzzId = str(currentItem)
self.populate_results_response_render(fuzzId)
def populate_results_response_render(self, fuzzId):
results = self.Data.read_dom_fuzzer_results_by_id(
self.cursor, int(fuzzId))
if results:
resultsItems = [m or '' for m in results]
self.miniResponseRenderWidget.populate_response_content(
resultsItems[DomFuzzerResultsTable.URL],
b'', # TODO: determine if it makes sense to expose these values
b'',
b'',
bytes(resultsItems[DomFuzzerResultsTable.RENDERED_DATA]),
'')
class RequesterTab(QObject):
def __init__(self, framework, mainWindow):
QObject.__init__(self, mainWindow)
self.framework = framework
self.mainWindow = mainWindow
self.mainWindow.requesterSendButton.clicked.connect(
self.requester_send_button_clicked)
self.mainWindow.bulkRequestPushButton.clicked.connect(
self.requester_bulk_request_button_clicked)
self.mainWindow.requesterHistoryClearButton.clicked.connect(
self.requester_history_clear_button_clicked)
self.mainWindow.reqTabWidget.currentChanged.connect(
self.handle_tab_currentChanged)
self.mainWindow.requesterSequenceCheckBox.stateChanged.connect(
self.handle_requesterSequenceCheckBox_stateChanged)
self.mainWindow.bulkRequestSequenceCheckBox.stateChanged.connect(
self.handle_bulkRequestSequenceCheckBox_stateChanged)
self.mainWindow.sequenceRunnerRunButton.clicked.connect(
self.handle_sequenceRunnerRunButton_clicked)
self.pending_request = None
self.pending_bulk_requests = None
self.pending_sequence_requests = None
self.re_request = re.compile(
r'^(\S+)\s+((?:https?://(?:\S+\.)+\w+(?::\d+)?)?/.*)\s+HTTP/\d+\.\d+\s*$',
re.I)
self.re_request_cookie = re.compile(r'^Cookie:\s*(\S+)', re.I | re.M)
self.re_replacement = re.compile(r'\$\{(\w+)\}')
self.framework.subscribe_populate_requester_response_id(
self.requester_populate_response_id)
self.framework.subscribe_populate_bulk_requester_responses(
self.bulk_requester_populate_responses)
self.framework.subscribe_sequences_changed(self.fill_sequences)
self.setup_requester_tab()
self.Data = None
self.cursor = None
self.framework.subscribe_database_events(self.db_attach,
self.db_detach)
def db_attach(self):
self.Data = self.framework.getDB()
self.cursor = self.Data.allocate_thread_cursor()
self.fill_requesters()
def db_detach(self):
self.close_cursor()
self.Data = None
def close_cursor(self):
if self.cursor and self.Data:
self.cursor.close()
self.Data.release_thread_cursor(self.cursor)
self.cursor = None
def setup_requester_tab(self):
self.historyRequestResponse = RequestResponseWidget(
self.framework, self.mainWindow.requesterHistoryTabWidget,
self.mainWindow.requesterHistorySearchResultsPlaceholder, self)
self.requesterHistoryDataModel = ResponsesDataModel.ResponsesDataModel(
self.framework, self)
self.mainWindow.requesterHistoryTreeView.setModel(
self.requesterHistoryDataModel)
self.mainWindow.requesterHistoryTreeView.activated.connect(
self.fill_history_request_response)
self.mainWindow.requesterHistoryTreeView.clicked.connect(
self.fill_history_request_response)
self.mainWindow.requesterHistoryTreeView.doubleClicked.connect(
self.requester_history_item_double_clicked)
self.historyResponsesContextMenu = ResponsesContextMenuWidget(
self.framework, self.requesterHistoryDataModel,
self.mainWindow.requesterHistoryTreeView, self)
self.historyResponsesContextMenu.set_currentChanged_callback(
self.fill_history_request_response)
self.sequenceRunnerRequestResponse = RequestResponseWidget(
self.framework, self.mainWindow.sequenceRunnerTabWidget,
self.mainWindow.sequenceRunnerSearchResultsPlaceholder, self)
self.sequenceRunnerDataModel = ResponsesDataModel.ResponsesDataModel(
self.framework, self)
self.mainWindow.sequenceRunnerTreeView.setModel(
self.sequenceRunnerDataModel)
self.mainWindow.sequenceRunnerTreeView.activated.connect(
self.fill_sequence_runner_request_response)
self.mainWindow.sequenceRunnerTreeView.clicked.connect(
self.fill_sequence_runner_request_response)
self.mainWindow.sequenceRunnerTreeView.doubleClicked.connect(
self.requester_sequence_runner_item_double_clicked)
self.sequence_runnerResponsesContextMenu = ResponsesContextMenuWidget(
self.framework, self.sequenceRunnerDataModel,
self.mainWindow.sequenceRunnerTreeView, self)
self.sequence_runnerResponsesContextMenu.set_currentChanged_callback(
self.fill_sequence_runner_request_response)
self.miniResponseRenderWidget = MiniResponseRenderWidget(
self.framework, self.mainWindow.reqRespTabWidget, True, self)
self.scopeController = self.framework.getScopeController()
def requester_history_item_double_clicked(self, index):
Id = interface.index_to_id(self.requesterHistoryDataModel, index)
if Id:
dialog = RequestResponseDetailDialog(self.framework, Id,
self.mainWindow)
dialog.show()
dialog.exec_()
def fill_history_request_response(self, index):
Id = interface.index_to_id(self.requesterHistoryDataModel, index)
if Id:
self.historyRequestResponse.fill(Id)
def requester_sequence_runner_item_double_clicked(self, index):
Id = interface.index_to_id(self.sequenceRunnerDataModel, index)
if Id:
dialog = RequestResponseDetailDialog(self.framework, Id,
self.mainWindow)
dialog.show()
dialog.exec_()
def fill_sequence_runner_request_response(self, index):
Id = interface.index_to_id(self.sequenceRunnerDataModel, index)
if Id:
self.sequenceRunnerRequestResponse.fill(Id)
def fill_requesters(self):
# requesters
self.requesterHistoryDataModel.clearModel()
history_items = []
for row in self.Data.get_all_requester_history(self.cursor):
response_item = interface.data_row_to_response_items(row)
history_items.append(response_item)
self.requesterHistoryDataModel.append_data(history_items)
self.fill_sequences()
self.mainWindow.requesterUrlEdit.setText(
self.framework.get_raft_config_value('requesterUrlEdit'))
self.mainWindow.bulkRequestUrlListEdit.setPlainText(
self.framework.get_raft_config_value('bulkRequestUrlListEdit'))
def fill_sequences(self):
self.fill_sequences_combo_box(
self.mainWindow.requesterSequenceComboBox)
self.fill_sequences_combo_box(
self.mainWindow.bulkRequestSequenceComboBox)
self.fill_sequences_combo_box(
self.mainWindow.sequenceRunnerSequenceComboBox)
def requester_populate_response_id(self, Id):
row = self.Data.read_responses_by_id(self.cursor, Id)
if not row:
return
responseItems = interface.data_row_to_response_items(row)
method, url, template_text = self.generate_template_for_response_item(
responseItems)
self.set_combo_box_text(self.mainWindow.requesterRequestMethod,
method.upper())
self.mainWindow.requesterUrlEdit.setText(url)
self.mainWindow.requesterTemplateEdit.setPlainText(template_text)
def bulk_requester_populate_responses(self, id_list):
url_list = []
first = True
for Id in id_list:
row = self.Data.read_responses_by_id(self.cursor, Id)
if not row:
continue
responseItems = interface.data_row_to_response_items(row)
url = responseItems[ResponsesTable.URL]
if url not in url_list:
url_list.append(url)
if first:
method, url, template_text = self.generate_template_for_response_item(
responseItems)
self.set_combo_box_text(self.mainWindow.bulkRequestMethodEdit,
method.upper())
self.mainWindow.bulkRequestTemplateEdit.setPlainText(
template_text)
first = False
self.mainWindow.bulkRequestUrlListEdit.setPlainText(
'\n'.join(url_list))
def generate_template_for_response_item(self, responseItems):
url = responseItems[ResponsesTable.URL]
reqHeaders = str(responseItems[ResponsesTable.REQ_HEADERS], 'utf-8',
'ignore')
reqData = str(responseItems[ResponsesTable.REQ_DATA], 'utf-8',
'ignore')
method = responseItems[ResponsesTable.REQ_METHOD]
splitted = urlparse.urlsplit(url)
useragent = self.framework.useragent()
has_cookie = False
template = StringIO()
template.write('${method} ${request_uri} HTTP/1.1\n')
first = True
for line in reqHeaders.splitlines():
if not line:
break
if first and self.re_request.match(line):
first = False
continue
if ':' in line:
name, value = [v.strip() for v in line.split(':', 1)]
lname = name.lower()
if 'host' == lname:
if splitted.hostname and value == splitted.hostname:
template.write('Host: ${host}\n')
continue
elif 'user-agent' == lname:
if useragent == value:
template.write('User-Agent: ${user_agent}\n')
continue
template.write(line)
template.write('\n')
template.write('\n')
template.write(reqData)
return method, url, template.getvalue()
def set_combo_box_text(self, comboBox, selectedText):
index = comboBox.findText(selectedText)
if -1 == index:
comboBox.addItem(selectedText)
index = comboBox.findText(selectedText)
comboBox.setCurrentIndex(index)
def handle_requesterSequenceCheckBox_stateChanged(self, state):
self.mainWindow.requesterSequenceComboBox.setEnabled(
self.mainWindow.requesterSequenceCheckBox.isChecked())
def handle_bulkRequestSequenceCheckBox_stateChanged(self, state):
self.mainWindow.bulkRequestSequenceComboBox.setEnabled(
self.mainWindow.bulkRequestSequenceCheckBox.isChecked())
def handle_tab_currentChanged(self, index):
# TODO: must this hard-coded ?
if 0 == index:
self.fill_sequences_combo_box(
self.mainWindow.requesterSequenceComboBox)
elif 1 == index:
self.fill_sequences_combo_box(
self.mainWindow.bulkRequestSequenceComboBox)
elif 2 == index:
self.fill_sequences_combo_box(
self.mainWindow.sequenceRunnerSequenceComboBox)
def requester_send_button_clicked(self):
""" Make a request from the Request tab """
if 'Cancel' == self.mainWindow.requesterSendButton.text(
) and self.pending_request is not None:
self.pending_request.cancel()
self.pending_request = None
self.mainWindow.requesterSendButton.setText('Send')
return
qurl = QUrl.fromUserInput(self.mainWindow.requesterUrlEdit.text())
url = qurl.toEncoded().data().decode('utf-8')
self.mainWindow.requesterUrlEdit.setText(url)
self.framework.set_raft_config_value('requesterUrlEdit', url)
templateText = str(self.mainWindow.requesterTemplateEdit.toPlainText())
method = str(self.mainWindow.requesterRequestMethod.currentText())
use_global_cookie_jar = self.mainWindow.requesterUseGlobalCookieJar.isChecked(
)
replacements = self.build_replacements(method, url)
(method, url, headers,
body) = self.process_template(url, templateText, replacements)
sequenceId = None
if self.mainWindow.requesterSequenceCheckBox.isChecked():
sequenceId = str(
self.mainWindow.requesterSequenceComboBox.itemData(
self.mainWindow.requesterSequenceComboBox.currentIndex()))
self.requestRunner = RequestRunner(self.framework, self)
if use_global_cookie_jar:
self.requesterCookieJar = self.framework.get_global_cookie_jar()
else:
self.requesterCookieJar = InMemoryCookieJar(self.framework, self)
self.requestRunner.setup(self.requester_response_received,
self.requesterCookieJar, sequenceId)
self.pending_request = self.requestRunner.queue_request(
method, url, headers, body)
self.mainWindow.requesterSendButton.setText('Cancel')
self.miniResponseRenderWidget.clear_response_render()
def requester_response_received(self, response_id, context):
if 0 != response_id:
row = self.Data.read_responses_by_id(self.cursor, response_id)
if row:
response_item = interface.data_row_to_response_items(row)
self.Data.insert_requester_history(self.cursor, response_id)
self.requesterHistoryDataModel.append_data([response_item])
url = response_item[ResponsesTable.URL]
req_headers = response_item[ResponsesTable.REQ_HEADERS]
req_body = response_item[ResponsesTable.REQ_DATA]
res_headers = response_item[ResponsesTable.RES_HEADERS]
res_body = response_item[ResponsesTable.RES_DATA]
res_content_type = response_item[
ResponsesTable.RES_CONTENT_TYPE]
self.miniResponseRenderWidget.populate_response_content(
url, req_headers, req_body, res_headers, res_body,
res_content_type)
self.mainWindow.requesterSendButton.setText('Send')
self.pending_request = None
def requester_bulk_request_button_clicked(self):
if 'Cancel' == self.mainWindow.bulkRequestPushButton.text(
) and self.pending_bulk_requests is not None:
self.cancel_bulk_requests = True
for context, pending_request in self.pending_bulk_requests.items():
pending_request.cancel()
self.pending_bulk_requests = None
self.mainWindow.bulkRequestPushButton.setText('Send')
self.mainWindow.bulkRequestProgressBar.setValue(0)
return
if self.pending_bulk_requests is None:
self.pending_bulk_requests = {}
method = str(self.mainWindow.bulkRequestMethodEdit.currentText())
templateText = str(
self.mainWindow.bulkRequestTemplateEdit.toPlainText())
template_url = str(self.mainWindow.bulkRequestUrlEdit.text())
url_list = str(self.mainWindow.bulkRequestUrlListEdit.toPlainText())
self.framework.set_raft_config_value('bulkRequestUrlListEdit',
url_list)
request_urls = url_list.splitlines()
self.mainWindow.bulkRequestProgressBar.setValue(0)
self.mainWindow.bulkRequestProgressBar.setMaximum(len(request_urls))
sequenceId = None
if self.mainWindow.bulkRequestSequenceCheckBox.isChecked():
sequenceId = str(
self.mainWindow.bulkRequestSequenceComboBox.itemData(
self.mainWindow.bulkRequestSequenceComboBox.currentIndex())
)
first = True
self.cancel_bulk_requests = False
for request_url in request_urls:
if self.cancel_bulk_requests:
break
request_url = request_url.strip()
if request_url:
context = uuid.uuid4().hex
# TODO: move this hack
if '$' in template_url:
replacements = self.build_replacements(method, request_url)
url = self.re_replacement.sub(
lambda m: replacements.get(m.group(1)), template_url)
else:
url = request_url
if not self.scopeController.isUrlInScope(url, url):
self.framework.log_warning(
'skipping out of scope URL: %s' % (url))
self.mainWindow.bulkRequestProgressBar.setValue(
self.mainWindow.bulkRequestProgressBar.value() + 1)
continue
use_global_cookie_jar = self.mainWindow.bulkRequestUseGlobalCookieJar.isChecked(
)
replacements = self.build_replacements(method, url)
(method, url, headers,
body) = self.process_template(url, templateText, replacements)
if first:
self.mainWindow.bulkRequestPushButton.setText('Cancel')
if use_global_cookie_jar:
self.bulkRequesterCookieJar = self.framework.get_global_cookie_jar(
)
else:
self.bulkRequesterCookieJar = InMemoryCookieJar(
self.framework, self)
self.bulk_requestRunner = RequestRunner(
self.framework, self)
self.bulk_requestRunner.setup(
self.requester_bulk_response_received,
self.bulkRequesterCookieJar, sequenceId)
first = False
self.pending_bulk_requests[
context] = self.bulk_requestRunner.queue_request(
method, url, headers, body, context)
def requester_bulk_response_received(self, response_id, context):
self.mainWindow.bulkRequestProgressBar.setValue(
self.mainWindow.bulkRequestProgressBar.value() + 1)
context = str(context)
if self.pending_bulk_requests is not None:
try:
self.pending_bulk_requests.pop(context)
except KeyError as e:
pass
if 0 != response_id:
row = self.Data.read_responses_by_id(self.cursor, response_id)
if row:
response_item = interface.data_row_to_response_items(row)
self.Data.insert_requester_history(self.cursor, response_id)
self.requesterHistoryDataModel.append_data([response_item])
finished = False
if self.pending_bulk_requests is None or len(
self.pending_bulk_requests) == 0:
self.mainWindow.bulkRequestProgressBar.setValue(
self.mainWindow.bulkRequestProgressBar.maximum())
finished = True
elif self.mainWindow.bulkRequestProgressBar.value(
) == self.mainWindow.bulkRequestProgressBar.maximum():
finished = True
if finished:
self.mainWindow.bulkRequestPushButton.setText('Send')
def handle_sequenceRunnerRunButton_clicked(self):
""" Run a sequence """
if 'Cancel' == self.mainWindow.sequenceRunnerRunButton.text(
) and self.pending_sequence_requests is not None:
self.cancel_sequence_requests = True
for context, pending_request in self.pending_sequence_requests.items(
):
pending_request.cancel()
self.pending_sequence_requests = None
self.mainWindow.sequenceRunnerButton.setText('Send')
self.mainWindow.sequenceRunnerButton.setValue(0)
return
self.sequenceRunnerDataModel.clearModel()
sequenceId = str(
self.mainWindow.sequenceRunnerSequenceComboBox.itemData(
self.mainWindow.sequenceRunnerSequenceComboBox.currentIndex()))
use_global_cookie_jar = self.mainWindow.sequenceRunnerUseGlobalCookieJar.isChecked(
)
if use_global_cookie_jar:
self.sequenceRunnerCookieJar = self.framework.get_global_cookie_jar(
)
else:
self.sequenceRunnerCookieJar = InMemoryCookieJar(
self.framework, self)
self.sequence_requestRunner = RequestRunner(self.framework, self)
self.sequence_requestRunner.setup(
self.sequence_runner_response_received,
self.sequenceRunnerCookieJar, sequenceId)
self.pending_sequence_requests = self.sequence_requestRunner.run_sequence(
)
self.mainWindow.sequenceRunnerRunButton.setText('Cancel')
def sequence_runner_response_received(self, response_id, context):
context = str(context)
if self.pending_sequence_requests is not None:
try:
self.pending_sequence_requests.pop(context)
except KeyError as e:
print((e))
pass
if 0 != response_id:
row = self.Data.read_responses_by_id(self.cursor, response_id)
if row:
response_item = interface.data_row_to_response_items(row)
self.sequenceRunnerDataModel.append_data([response_item])
if self.pending_sequence_requests is None or len(
self.pending_sequence_requests) == 0:
self.mainWindow.sequenceRunnerRunButton.setText('Send')
def requester_history_clear_button_clicked(self):
self.Data.clear_requester_history(self.cursor)
self.requesterHistoryDataModel.clearModel()
def fill_sequences_combo_box(self, comboBox):
selectedText = comboBox.currentText()
comboBox.clear()
for row in self.Data.get_all_sequences(self.cursor):
sequenceItem = [m or '' for m in row]
name = str(sequenceItem[1])
Id = str(sequenceItem[0])
item = comboBox.addItem(name, Id)
if selectedText:
index = comboBox.findText(selectedText)
if index != -1:
comboBox.setCurrentIndex(index)
def build_replacements(self, method, url):
replacements = {}
splitted = urlparse.urlsplit(url)
replacements['method'] = method.upper()
replacements['url'] = url
replacements['scheme'] = splitted.scheme or ''
replacements['netloc'] = splitted.netloc or ''
replacements['host'] = splitted.hostname or ''
replacements['path'] = splitted.path or '/'
replacements['query'] = splitted.query or ''
replacements['fragment'] = splitted.fragment or ''
replacements['request_uri'] = urlparse.urlunsplit(
('', '', replacements['path'], replacements['query'], ''))
replacements['user_agent'] = self.framework.useragent()
return replacements
def process_template(self, url, template, replacements):
method, uri = '', ''
headers, body = '', ''
# TODO: this allows for missing entries -- is this good?
func = lambda m: replacements.get(m.group(1))
prev = 0
while True:
n = template.find('\n', prev)
if -1 == n:
break
if n > 0 and '\r' == template[n - 1]:
line = template[prev:n - 1]
else:
line = template[prev:n]
if 0 == len(line):
# end of headers
headers = template[0:n + 1]
body = template[n + 1:]
break
prev = n + 1
if not headers:
headers = template
body = ''
# TODO: could work from ordered dict to main order?
headers_dict = {}
first = True
for line in headers.splitlines():
if not line:
break
if '$' in line:
line = self.re_replacement.sub(func, line)
if first:
m = self.re_request.match(line)
if not m:
raise Exception(
'Invalid HTTP request: failed to match request line: %s'
% (line))
method = m.group(1)
uri = m.group(2)
first = False
continue
if ':' in line:
name, value = [v.strip() for v in line.split(':', 1)]
headers_dict[name] = value
if '$' in body:
body = self.re_replacement.sub(func, body)
url = urlparse.urljoin(url, uri)
return (method, url, headers_dict, body)
class DomFuzzerTab(QObject):
class CallbackLogger():
def __init__(self):
self.messages = []
def log(self, source, url, message):
self.messages.append((source, url, message))
def clear_messages(self):
self.messages = []
def get_messages(self):
return self.messages
def __init__(self, framework, mainWindow):
QObject.__init__(self, mainWindow)
self.framework = framework
self.mainWindow = mainWindow
self.mainWindow.domFuzzerStartButton.clicked.connect(self.handle_fuzzerStart_clicked)
self.mainWindow.domFuzzerStopButton.clicked.connect(self.handle_fuzzerStop_clicked)
self.mainWindow.domFuzzerClearQueueButton.clicked.connect(self.handle_fuzzerClearQueue_clicked)
self.mainWindow.domFuzzerStartButton.setEnabled(True)
self.mainWindow.domFuzzerStopButton.setEnabled(False)
self.miniResponseRenderWidget = MiniResponseRenderWidget(self.framework, self.mainWindow.domFuzzerResultsTabWidget, False, self)
self.setup_fuzz_window()
self.Data = None
self.cursor = None
self.framework.subscribe_database_events(self.db_attach, self.db_detach)
def db_attach(self):
self.Data = self.framework.getDB()
self.cursor = self.Data.allocate_thread_cursor()
def db_detach(self):
self.close_cursor()
self.Data = None
def close_cursor(self):
if self.cursor and self.Data:
self.cursor.close()
self.Data.release_thread_cursor(self.cursor)
self.cursor = None
def handle_fuzzerStart_clicked(self):
self.mainWindow.domFuzzerStartButton.setEnabled(False)
self.mainWindow.domFuzzerStopButton.setEnabled(True)
self.domFuzzerThread.startFuzzing(self)
def handle_fuzzerStop_clicked(self):
self.mainWindow.domFuzzerStartButton.setEnabled(True)
self.mainWindow.domFuzzerStopButton.setEnabled(False)
self.domFuzzerThread.stopFuzzing()
def handle_fuzzerClearQueue_clicked(self):
self.domFuzzerThread.clearFuzzQueue()
def setup_fuzzer_results_treeview(self):
treeView = self.mainWindow.domFuzzerResultsTreeView
treeView.setSelectionMode(treeView.ExtendedSelection)
self.resultsTreeViewSelectionModel = QItemSelectionModel(treeView.model())
treeView.setSelectionModel(self.resultsTreeViewSelectionModel)
treeView.clicked.connect(self.handle_resultsTreeView_clicked)
# self.resultsTreeViewSelectionModel.selectionChanged.connect(self.handle_selectionChanged)
self.resultsTreeViewSelectionModel.currentChanged.connect(self.handle_currentChanged)
treeView.setContextMenuPolicy(Qt.CustomContextMenu)
self.connect(treeView, SIGNAL("customContextMenuRequested(const QPoint&)"), self.fuzzer_results_context_menu)
self.resultsMenu = QMenu(treeView)
self.copyUrlAction = action = QAction("Copy URL", self)
action.triggered.connect(self.fuzzer_results_copy_url)
self.resultsMenu.addAction(action)
def fuzzer_results_context_menu(self, point):
if len(self.resultsTreeViewSelectionModel.selectedRows()) > 1:
self.copyUrlAction.setText('Copy URLs')
else:
self.copyUrlAction.setText('Copy URL')
self.resultsMenu.exec_(self.mainWindow.domFuzzerResultsTreeView.mapToGlobal(point))
def fuzzer_results_index_to_url(self, dataModel, index):
index = dataModel.index(index.row(), 5) # TODO: use constant
if index.isValid():
currentItem = dataModel.data(index)
if currentItem is not None:
url = currentItem
return url
return None
def fuzzer_results_copy_url(self):
url_list = []
dataModel = self.mainWindow.domFuzzerResultsTreeView.model()
for index in self.resultsTreeViewSelectionModel.selectedRows():
curUrl = self.fuzzer_results_index_to_url(dataModel, index)
if curUrl:
url_list.append(curUrl)
QApplication.clipboard().setText('\n'.join(url_list))
def setup_fuzz_window(self):
self.callbackLogger = self.CallbackLogger()
self.domFuzzerWebView = DomFuzzerWebView(self.framework, self.callbackLogger, self.mainWindow)
self.domFuzzerPlaceholderLayout = self.mainWindow.domFuzzerFuzzPlaceholder.layout()
if not self.domFuzzerPlaceholderLayout:
self.domFuzzerPlaceholderLayout = QVBoxLayout(self.mainWindow.domFuzzerFuzzPlaceholder)
self.domFuzzerPlaceholderLayout.addWidget(self.domFuzzerWebView)
self.currentFuzzId = None
QObject.connect(self.domFuzzerWebView, SIGNAL('loadStarted()'), self.handle_webView_loadStarted)
QObject.connect(self.domFuzzerWebView, SIGNAL('loadFinished(bool)'), self.handle_webView_loadFinished)
def set_fuzzer_thread(self, domFuzzerThread):
self.domFuzzerThread = domFuzzerThread
QObject.connect(self, SIGNAL('fuzzItemAvailable(int, QByteArray, QUrl)'), self.handle_fuzzItemAvailable)
QObject.connect(self, SIGNAL('fuzzRunFinished()'), self.handle_fuzzRunFinished)
self.qtimer = QTimer()
self.qtimer2 = QTimer()
QObject.connect(self.qtimer, SIGNAL('timeout()'), self.handle_load_timeout)
QObject.connect(self.qtimer2, SIGNAL('timeout()'), self.handle_render_timeout)
def handle_fuzzItemAvailable(self, fuzzId, htmlContent, qurl):
self.currentFuzzId = fuzzId
self.currentFuzzUrl = qurl.toEncoded().data().decode('utf-8')
self.callbackLogger.clear_messages()
self.qtimer.start(3000) # 3 seconds to finish
self.domFuzzerWebView.setContent(htmlContent, '', qurl)
def handle_webView_loadStarted(self):
# print('loading started')
pass
def handle_webView_loadFinished(self, ok):
url = self.domFuzzerWebView.url().toString()
# print(('handle_webView_loadFinished', ok, url))
if url == 'about:blank':
return
if self.qtimer.isActive():
self.qtimer.stop()
if self.qtimer2.isActive():
self.qtimer2.stop()
if ok:
self.qtimer2.start(1000) # 1 seconds to finish
else:
self.fuzzItemCompleted(ok)
def handle_load_timeout(self):
if self.qtimer.isActive():
self.qtimer.stop()
# print('forcbily stopping page')
self.domFuzzerWebView.stop()
self.fuzzItemCompleted(False)
def handle_render_timeout(self):
if self.qtimer2.isActive():
self.qtimer2.stop()
# TODO: should check progress
self.domFuzzerWebView.stop()
self.fuzzItemCompleted(True)
def fuzzItemCompleted(self, ok):
if self.currentFuzzId is not None:
mainFrame = self.domFuzzerWebView.page().mainFrame()
dom = mainFrame.documentElement()
html = dom.toOuterXml()
self.domFuzzerThread.fuzzItemFinished(self.currentFuzzId, self.currentFuzzUrl, html, self.callbackLogger.get_messages())
self.domFuzzerWebView.setUrl(QUrl('about:blank'))
self.currentFuzzId = None
def handle_fuzzRunFinished(self):
self.mainWindow.domFuzzerStartButton.setEnabled(True)
self.mainWindow.domFuzzerStopButton.setEnabled(False)
def handle_resultsTreeView_clicked(self):
index = self.mainWindow.domFuzzerResultsTreeView.currentIndex()
self.fill_results_view(index)
def handle_currentChanged(self, index):
self.fill_results_view(index)
def fill_results_view(self, index):
index = self.mainWindow.domFuzzerResultsDataModel.index(index.row(), DomFuzzerResultsTable.ID)
if index.isValid():
currentItem = self.mainWindow.domFuzzerResultsDataModel.data(index)
if currentItem is not None:
fuzzId = str(currentItem)
self.populate_results_response_render(fuzzId)
def populate_results_response_render(self, fuzzId):
results = self.Data.read_dom_fuzzer_results_by_id(self.cursor, int(fuzzId))
if results:
resultsItems = [m or '' for m in results]
self.miniResponseRenderWidget.populate_response_content(
resultsItems[DomFuzzerResultsTable.URL],
b'', # TODO: determine if it makes sense to expose these values
b'',
b'',
bytes(resultsItems[DomFuzzerResultsTable.RENDERED_DATA]),
''
)
def __init__(self, framework, mainWindow):
QObject.__init__(self, mainWindow)
self.framework = framework
self.mainWindow = mainWindow
self.mainWindow.wfStdPreChk.stateChanged.connect(self.handle_wfStdPreChk_stateChanged)
self.mainWindow.wfStdPostChk.stateChanged.connect(self.handle_wfStdPostChk_stateChanged)
self.mainWindow.wfTempSeqChk.stateChanged.connect(self.handle_wfTempSeqChk_stateChanged)
# Handle the toggling of payload mappings in the config tab
self.mainWindow.wfPay1FuzzRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay1StaticRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay1DynamicRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay2FuzzRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay2StaticRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay2DynamicRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay3FuzzRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay3StaticRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay3DynamicRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay4FuzzRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay4StaticRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay4DynamicRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay5FuzzRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay5StaticRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay5DynamicRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.fuzzerHistoryClearButton.clicked.connect(self.fuzzer_history_clear_button_clicked)
# inserted to initially fill the sequences box.
# ToDo: Need to do this better
self.mainWindow.mainTabWidget.currentChanged.connect(self.handle_mainTabWidget_currentChanged)
self.mainWindow.webFuzzTab.currentChanged.connect(self.handle_webFuzzTab_currentChanged)
self.mainWindow.stdFuzzTab.currentChanged.connect(self.handle_stdFuzzTab_currentChanged)
# self.mainWindow.webFuzzTab.currentChanged.connect(self.fill_payloads)
self.mainWindow.wfStdAddButton.clicked.connect(self.insert_payload_marker)
self.mainWindow.wfStdStartButton.clicked.connect(self.start_fuzzing_clicked)
self.mainWindow.wfDataDictonaryAddButton.clicked.connect(self.handle_wfDataDictonaryAddButton_clicked)
self.framework.subscribe_populate_webfuzzer_response_id(self.webfuzzer_populate_response_id)
self.framework.subscribe_sequences_changed(self.fill_sequences)
self.mainWindow.wfFunctionsComboBox.activated.connect(self.fill_function_edit)
self.mainWindow.wfFunctionsSaveButton.clicked.connect(self.save_function_file)
self.mainWindow.wfFunctionsDeleteButton.clicked.connect(self.del_function_file)
self.miniResponseRenderWidget = MiniResponseRenderWidget(self.framework, self.mainWindow.stdFuzzResultsTabWidget, True, self)
self.re_request = re.compile(r'^(\S+)\s+((?:https?://(?:\S+\.)+\w+(?::\d+)?)?/.*)\s+HTTP/\d+\.\d+\s*$', re.I)
self.re_request_cookie = re.compile(r'^Cookie:\s*(\S+)', re.I|re.M)
self.re_replacement = re.compile(r'\$\{(\w+)\}')
self.setup_fuzzer_tab()
self.setup_functions_tab()
self.functions_dir = os.path.join(self.framework.get_data_dir(), 'functions')
self.Attacks = Payloads.Payloads(self.framework)
self.Attacks.list_files()
# Fill the payloads combo boxes on init
self.fill_payloads()
self.pending_fuzz_requests = None
# Fill the functions combo box on init
self.fill_function_combo_box()
self.mainWindow.wfDataDictionaryDataTable.setColumnCount(2)
self.mainWindow.wfDataDictionaryDataTable.setHorizontalHeaderLabels(['Replacement', 'Value'])
self.Data = None
self.cursor = None
self.framework.subscribe_database_events(self.db_attach, self.db_detach)
class WebFuzzerTab(QObject):
def __init__(self, framework, mainWindow):
QObject.__init__(self, mainWindow)
self.framework = framework
self.mainWindow = mainWindow
self.mainWindow.wfStdPreChk.stateChanged.connect(self.handle_wfStdPreChk_stateChanged)
self.mainWindow.wfStdPostChk.stateChanged.connect(self.handle_wfStdPostChk_stateChanged)
self.mainWindow.wfTempSeqChk.stateChanged.connect(self.handle_wfTempSeqChk_stateChanged)
# Handle the toggling of payload mappings in the config tab
self.mainWindow.wfPay1FuzzRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay1StaticRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay1DynamicRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay2FuzzRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay2StaticRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay2DynamicRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay3FuzzRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay3StaticRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay3DynamicRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay4FuzzRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay4StaticRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay4DynamicRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay5FuzzRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay5StaticRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.wfPay5DynamicRadio.toggled.connect(self.handle_payload_toggled)
self.mainWindow.fuzzerHistoryClearButton.clicked.connect(self.fuzzer_history_clear_button_clicked)
# inserted to initially fill the sequences box.
# ToDo: Need to do this better
self.mainWindow.mainTabWidget.currentChanged.connect(self.handle_mainTabWidget_currentChanged)
self.mainWindow.webFuzzTab.currentChanged.connect(self.handle_webFuzzTab_currentChanged)
self.mainWindow.stdFuzzTab.currentChanged.connect(self.handle_stdFuzzTab_currentChanged)
# self.mainWindow.webFuzzTab.currentChanged.connect(self.fill_payloads)
self.mainWindow.wfStdAddButton.clicked.connect(self.insert_payload_marker)
self.mainWindow.wfStdStartButton.clicked.connect(self.start_fuzzing_clicked)
self.mainWindow.wfDataDictonaryAddButton.clicked.connect(self.handle_wfDataDictonaryAddButton_clicked)
self.framework.subscribe_populate_webfuzzer_response_id(self.webfuzzer_populate_response_id)
self.framework.subscribe_sequences_changed(self.fill_sequences)
self.mainWindow.wfFunctionsComboBox.activated.connect(self.fill_function_edit)
self.mainWindow.wfFunctionsSaveButton.clicked.connect(self.save_function_file)
self.mainWindow.wfFunctionsDeleteButton.clicked.connect(self.del_function_file)
self.miniResponseRenderWidget = MiniResponseRenderWidget(self.framework, self.mainWindow.stdFuzzResultsTabWidget, True, self)
self.re_request = re.compile(r'^(\S+)\s+((?:https?://(?:\S+\.)+\w+(?::\d+)?)?/.*)\s+HTTP/\d+\.\d+\s*$', re.I)
self.re_request_cookie = re.compile(r'^Cookie:\s*(\S+)', re.I|re.M)
self.re_replacement = re.compile(r'\$\{(\w+)\}')
self.setup_fuzzer_tab()
self.setup_functions_tab()
self.functions_dir = os.path.join(self.framework.get_data_dir(), 'functions')
self.Attacks = Payloads.Payloads(self.framework)
self.Attacks.list_files()
# Fill the payloads combo boxes on init
self.fill_payloads()
self.pending_fuzz_requests = None
# Fill the functions combo box on init
self.fill_function_combo_box()
self.mainWindow.wfDataDictionaryDataTable.setColumnCount(2)
self.mainWindow.wfDataDictionaryDataTable.setHorizontalHeaderLabels(['Replacement', 'Value'])
self.Data = None
self.cursor = None
self.framework.subscribe_database_events(self.db_attach, self.db_detach)
def db_attach(self):
self.Data = self.framework.getDB()
self.cursor = self.Data.allocate_thread_cursor()
self.fill_fuzzers()
self.fill_standard_edits()
self.fill_config_edits()
self.restore_data_dictionary()
def db_detach(self):
self.close_cursor()
self.Data = None
def close_cursor(self):
if self.cursor and self.Data:
self.cursor.close()
self.Data.release_thread_cursor(self.cursor)
self.cursor = None
def setup_fuzzer_tab(self):
self.fuzzerHistoryDataModel = ResponsesDataModel.ResponsesDataModel(self.framework, self)
self.mainWindow.fuzzerHistoryTreeView.setModel(self.fuzzerHistoryDataModel)
self.mainWindow.fuzzerHistoryTreeView.doubleClicked.connect(self.fuzzer_history_item_double_clicked)
self.mainWindow.fuzzerHistoryTreeView.clicked.connect(self.handle_fuzzer_history_clicked)
self.mainWindow.fuzzerHistoryTreeView.activated.connect(self.handle_fuzzer_history_clicked)
self.responsesContextMenu = ResponsesContextMenuWidget(self.framework, self.fuzzerHistoryDataModel, self.mainWindow.fuzzerHistoryTreeView, self)
self.responsesContextMenu.set_currentChanged_callback(self.fill_fuzzer_history)
def setup_functions_tab(self):
self.functionsLayout = self.mainWindow.wfFunctionsEditPlaceholder.layout()
if not self.functionsLayout:
self.functionsLayout = QVBoxLayout(self.mainWindow.wfFunctionsEditPlaceholder)
self.functionsEditScintilla = Qsci.QsciScintilla(self.mainWindow.wfFunctionsEditPlaceholder)
ScintillaHelpers.SetScintillaProperties(self.framework, self.functionsEditScintilla, 'python')
self.functionsEditScintilla.setAutoIndent(True)
self.functionsLayout.addWidget(self.functionsEditScintilla)
self.framework.subscribe_zoom_in(self.edit_function_zoom_in)
self.framework.subscribe_zoom_out(self.edit_function_zoom_out)
def edit_function_zoom_in(self):
self.functionsEditScintilla.zoomIn()
def edit_function_zoom_out(self):
self.functionsEditScintilla.zoomOut()
def fill_fuzzers(self):
history_items = []
for row in self.Data.get_all_fuzzer_history(self.cursor):
response_item = [m or '' for m in row]
history_items.append(response_item)
self.fuzzerHistoryDataModel.append_data(history_items)
self.fill_sequences()
def fill_standard_edits(self):
self.mainWindow.wfStdUrlEdit.setText(self.framework.get_raft_config_value('WebFuzzer.Standard.RequestUrl'))
self.mainWindow.wfStdEdit.document().setHtml(self.framework.get_raft_config_value('WebFuzzer.Standard.TemplateHtml'))
index = self.mainWindow.stdFuzzerReqMethod.findText(self.framework.get_raft_config_value('WebFuzzer.Standard.Method'))
if index != -1:
self.mainWindow.stdFuzzerReqMethod.setCurrentIndex(index)
self.mainWindow.wfStdPreChk.setChecked(self.framework.get_raft_config_value('WebFuzzer.Standard.PreSequenceEnabled', bool))
index = self.mainWindow.wfStdPreBox.findText(self.framework.get_raft_config_value('WebFuzzer.Standard.PreSequenceId'))
if index != -1:
self.mainWindow.wfStdPreBox.setCurrentIndex(index)
self.mainWindow.wfStdPostChk.setChecked(self.framework.get_raft_config_value('WebFuzzer.Standard.PostSequenceEnabled', bool))
index = self.mainWindow.wfStdPostBox.findText(self.framework.get_raft_config_value('WebFuzzer.Standard.PostSequenceId'))
if index != -1:
self.mainWindow.wfStdPostBox.setCurrentIndex(index)
def fill_config_edits(self):
self.fill_config_edit_item('Payload1', self.mainWindow.wfPay1FuzzRadio, self.mainWindow.wfPay1PayloadBox, self.mainWindow.wfPay1StaticRadio, self.mainWindow.wfPay1DynamicRadio, self.mainWindow.wfPay1StaticEdit)
self.fill_config_edit_item('Payload2', self.mainWindow.wfPay2FuzzRadio, self.mainWindow.wfPay2PayloadBox, self.mainWindow.wfPay2StaticRadio, self.mainWindow.wfPay2DynamicRadio, self.mainWindow.wfPay2StaticEdit)
self.fill_config_edit_item('Payload3', self.mainWindow.wfPay3FuzzRadio, self.mainWindow.wfPay3PayloadBox, self.mainWindow.wfPay3StaticRadio, self.mainWindow.wfPay3DynamicRadio, self.mainWindow.wfPay3StaticEdit)
self.fill_config_edit_item('Payload4', self.mainWindow.wfPay4FuzzRadio, self.mainWindow.wfPay4PayloadBox, self.mainWindow.wfPay4StaticRadio, self.mainWindow.wfPay4DynamicRadio, self.mainWindow.wfPay4StaticEdit)
self.fill_config_edit_item('Payload5', self.mainWindow.wfPay5FuzzRadio, self.mainWindow.wfPay5PayloadBox, self.mainWindow.wfPay5StaticRadio, self.mainWindow.wfPay5DynamicRadio, self.mainWindow.wfPay5StaticEdit)
def fill_config_edit_item(self, payload_item, fuzzRadio, payloadBox, staticRadio, dynamicRadio, staticEdit):
fuzzRadio.setChecked(self.framework.get_raft_config_value('WebFuzzer.Config.{0}FuzzSelected'.format(payload_item), bool))
index = payloadBox.findText(self.framework.get_raft_config_value('WebFuzzer.Config.{0}FuzzPayload'.format(payload_item)))
if index != -1:
payloadBox.setCurrentIndex(index)
staticRadio.setChecked(self.framework.get_raft_config_value('WebFuzzer.Config.{0}StaticSelected'.format(payload_item), bool))
dynamicRadio.setChecked(self.framework.get_raft_config_value('WebFuzzer.Config.{0}DynamicSelected'.format(payload_item), bool))
staticEdit.setText(self.framework.get_raft_config_value('WebFuzzer.Config.{0}StaticEdit'.format(payload_item)))
def fuzzer_history_item_double_clicked(self, index):
Id = interface.index_to_id(self.fuzzerHistoryDataModel, index)
if Id:
dialog = RequestResponseDetailDialog(self.framework, Id, self.mainWindow)
dialog.show()
dialog.exec_()
def handle_mainTabWidget_currentChanged(self):
self.save_configuration_values()
def handle_stdFuzzTab_currentChanged(self):
self.save_standard_configuration()
def handle_webFuzzTab_currentChanged(self):
self.save_configuration_values()
def fill_sequences(self):
self.fill_sequences_combo_box(self.mainWindow.wfStdPreBox)
self.fill_sequences_combo_box(self.mainWindow.wfStdPostBox)
self.fill_sequences_combo_box(self.mainWindow.wfStdBox)
def fill_sequences_combo_box(self, comboBox):
selectedText = comboBox.currentText()
comboBox.clear()
for row in self.Data.get_all_sequences(self.cursor):
sequenceItem = [m or '' for m in row]
name = str(sequenceItem[1])
Id = str(sequenceItem[0])
item = comboBox.addItem(name, Id)
if selectedText:
index = comboBox.findText(selectedText)
if index != -1:
comboBox.setCurrentIndex(index)
def fill_payloads(self):
self.fill_payload_combo_box(self.mainWindow.wfPay1PayloadBox)
self.fill_payload_combo_box(self.mainWindow.wfPay2PayloadBox)
self.fill_payload_combo_box(self.mainWindow.wfPay3PayloadBox)
self.fill_payload_combo_box(self.mainWindow.wfPay4PayloadBox)
self.fill_payload_combo_box(self.mainWindow.wfPay5PayloadBox)
def fill_payload_combo_box(self, comboBox):
selectedText = comboBox.currentText()
comboBox.clear()
payloads = self.Attacks.list_files()
for item in payloads:
if item.startswith("."):
pass
else:
comboBox.addItem(item)
def fill_payload_combo_box_function(self, comboBox):
selectedText = comboBox.currentText()
comboBox.clear()
functions = self.Attacks.list_function_files()
for item in functions:
if item.startswith("."):
pass
else:
comboBox.addItem(item)
def fill_function_combo_box(self):
comboBox = self.mainWindow.wfFunctionsComboBox
comboBox.clear()
functions = self.Attacks.list_function_files()
for item in functions:
if item.startswith("."):
pass
else:
comboBox.addItem(item)
def fill_function_edit(self):
filename = self.mainWindow.wfFunctionsComboBox.currentText()
func = self.Attacks.read_function(filename)
# Clear the Scintilla widget
self.functionsEditScintilla.clear()
for line in func:
self.functionsEditScintilla.append(line.decode("utf8"))
def save_function_file(self):
function_file = self.mainWindow.wfFunctionsComboBox.currentText()
content = self.functionsEditScintilla.text()
self.Attacks.save_function(function_file, content)
def del_function_file(self):
# Gets the current name of the file selected in the combobox
filename = self.mainWindow.wfFunctionsComboBox.currentText()
path = self.functions_dir
message = "Are you sure you want to delete: {0}".format(filename)
response = ConfirmDialog.display_confirm_dialog(self.mainWindow, message)
if response == True:
os.remove(os.path.join(path,filename))
self.fill_function_combo_box()
# Clear the items from the scintilla widget
#ToDo: This should be the default data for the function
self.functionsEditScintilla.clear()
def create_payload_map(self):
# create payload map from configuration tab
payload_mapping = {}
payload_config_items = (
("payload_1",
"fuzz", self.mainWindow.wfPay1FuzzRadio, self.mainWindow.wfPay1PayloadBox,
"static", self.mainWindow.wfPay1StaticRadio, self.mainWindow.wfPay1StaticEdit,
"dynamic", self.mainWindow.wfPay1DynamicRadio, self.mainWindow.wfPay1StaticEdit,
),
("payload_2",
"fuzz", self.mainWindow.wfPay2FuzzRadio, self.mainWindow.wfPay2PayloadBox,
"static", self.mainWindow.wfPay2StaticRadio, self.mainWindow.wfPay2StaticEdit,
"dynamic", self.mainWindow.wfPay2DynamicRadio, self.mainWindow.wfPay2StaticEdit,
),
("payload_3",
"fuzz", self.mainWindow.wfPay3FuzzRadio, self.mainWindow.wfPay3PayloadBox,
"static", self.mainWindow.wfPay3StaticRadio, self.mainWindow.wfPay3StaticEdit,
"dynamic", self.mainWindow.wfPay3DynamicRadio, self.mainWindow.wfPay3StaticEdit,
),
("payload_4",
"fuzz", self.mainWindow.wfPay4FuzzRadio, self.mainWindow.wfPay4PayloadBox,
"static", self.mainWindow.wfPay4StaticRadio, self.mainWindow.wfPay4StaticEdit,
"dynamic", self.mainWindow.wfPay4DynamicRadio, self.mainWindow.wfPay4StaticEdit,
),
("payload_5",
"fuzz", self.mainWindow.wfPay5FuzzRadio, self.mainWindow.wfPay5PayloadBox,
"static", self.mainWindow.wfPay5StaticRadio, self.mainWindow.wfPay5StaticEdit,
"dynamic", self.mainWindow.wfPay5DynamicRadio, self.mainWindow.wfPay5StaticEdit,
),
)
# Determine active payloads and map them
for config_item in payload_config_items:
payload_item = config_item[0]
payload_mapping[payload_item] = ('none', '')
for offset in (1, 4, 7):
if config_item[offset+1].isChecked():
payload_type = config_item[offset]
# print((payload_type, offset))
if payload_type == "dynamic":
payload_mapping[payload_item] = (payload_type, str(config_item[offset+2].text()), config_item[3].currentText())
elif payload_type == "fuzz":
payload_mapping[payload_item] = (payload_type, str(config_item[offset+2].currentText()), '')
else:
payload_mapping[payload_item] = (payload_type, str(config_item[offset+2].text()), '')
break
return payload_mapping
def create_functions(self):
self.global_ns = self.local_ns = {}
functions = [
'''
import urllib.parse
import re
import random
def url_encode(input):
return urllib.parse.quote(input)
re_alert_mangler = re.compile(r'alert\([^(]+\)', re.I)
def randomize_alert_replace(m):
return 'alert(%d.%d)' % (random.randint(0,99999), random.randint(0,99999))
def randomize_alert(input):
return re_alert_mangler.sub(randomize_alert_replace, input)
'''
]
for func_str in functions:
compiled = compile(func_str, '<string>', 'exec')
exec(compiled, self.global_ns, self.local_ns)
def set_combo_box_text(self, comboBox, selectedText):
index = comboBox.findText(selectedText)
if -1 != index:
comboBox.setCurrentIndex(index)
else:
index = comboBox.addItem(selectedText)
comboBox.setCurrentIndex(index)
def handle_wfStdPreChk_stateChanged(self, state):
self.mainWindow.wfStdPreBox.setEnabled(self.mainWindow.wfStdPreChk.isChecked())
def handle_wfStdPostChk_stateChanged(self, state):
self.mainWindow.wfStdPostBox.setEnabled(self.mainWindow.wfStdPostChk.isChecked())
def handle_wfTempSeqChk_stateChanged(self, state):
self.mainWindow.wfStdBox.setEnabled(self.mainWindow.wfTempSeqChk.isChecked())
def handle_payload_toggled(self):
self.mainWindow.wfPay1PayloadBox.setEnabled(self.mainWindow.wfPay1FuzzRadio.isChecked() or self.mainWindow.wfPay1DynamicRadio.isChecked())
self.mainWindow.wfPay1StaticEdit.setEnabled(self.mainWindow.wfPay1StaticRadio.isChecked() or self.mainWindow.wfPay1DynamicRadio.isChecked())
# self.mainWindow.wfPay1PayloadBox.setEnabled(self.mainWindow.wfPay1DynamicRadio.isChecked()) or self.fill_payload_combo_box_function(self.mainWindow.wfPay1PayloadBox)
self.mainWindow.wfPay2PayloadBox.setEnabled(self.mainWindow.wfPay2FuzzRadio.isChecked() or self.mainWindow.wfPay2DynamicRadio.isChecked())
self.mainWindow.wfPay2StaticEdit.setEnabled(self.mainWindow.wfPay2StaticRadio.isChecked() or self.mainWindow.wfPay2DynamicRadio.isChecked())
self.mainWindow.wfPay3PayloadBox.setEnabled(self.mainWindow.wfPay3FuzzRadio.isChecked() or self.mainWindow.wfPay3DynamicRadio.isChecked())
self.mainWindow.wfPay3StaticEdit.setEnabled(self.mainWindow.wfPay3StaticRadio.isChecked() or self.mainWindow.wfPay3DynamicRadio.isChecked())
self.mainWindow.wfPay4PayloadBox.setEnabled(self.mainWindow.wfPay4FuzzRadio.isChecked() or self.mainWindow.wfPay4DynamicRadio.isChecked())
self.mainWindow.wfPay4StaticEdit.setEnabled(self.mainWindow.wfPay4StaticRadio.isChecked() or self.mainWindow.wfPay4DynamicRadio.isChecked())
self.mainWindow.wfPay5PayloadBox.setEnabled(self.mainWindow.wfPay5FuzzRadio.isChecked() or self.mainWindow.wfPay5DynamicRadio.isChecked())
self.mainWindow.wfPay5StaticEdit.setEnabled(self.mainWindow.wfPay5StaticRadio.isChecked() or self.mainWindow.wfPay5DynamicRadio.isChecked())
# Determine if fuzz or dynamic is selected and change combo box items
if self.mainWindow.wfPay1FuzzRadio.isChecked():
self.fill_payload_combo_box(self.mainWindow.wfPay1PayloadBox)
if self.mainWindow.wfPay1DynamicRadio.isChecked():
self.fill_payload_combo_box_function(self.mainWindow.wfPay1PayloadBox)
if self.mainWindow.wfPay2FuzzRadio.isChecked():
self.fill_payload_combo_box(self.mainWindow.wfPay2PayloadBox)
if self.mainWindow.wfPay2DynamicRadio.isChecked():
self.fill_payload_combo_box_function(self.mainWindow.wfPay2PayloadBox)
if self.mainWindow.wfPay3FuzzRadio.isChecked():
self.fill_payload_combo_box(self.mainWindow.wfPay3PayloadBox)
if self.mainWindow.wfPay3DynamicRadio.isChecked():
self.fill_payload_combo_box_function(self.mainWindow.wfPay3PayloadBox)
if self.mainWindow.wfPay4FuzzRadio.isChecked():
self.fill_payload_combo_box(self.mainWindow.wfPay4PayloadBox)
if self.mainWindow.wfPay4DynamicRadio.isChecked():
self.fill_payload_combo_box_function(self.mainWindow.wfPay4PayloadBox)
if self.mainWindow.wfPay5FuzzRadio.isChecked():
self.fill_payload_combo_box(self.mainWindow.wfPay5PayloadBox)
if self.mainWindow.wfPay5DynamicRadio.isChecked():
self.fill_payload_combo_box_function(self.mainWindow.wfPay5PayloadBox)
def handle_fuzzer_history_clicked(self):
index = self.mainWindow.fuzzerHistoryTreeView.currentIndex()
self.fill_fuzzer_history(index)
def fill_fuzzer_history(self, index):
Id = interface.index_to_id(self.fuzzerHistoryDataModel, index)
if Id:
row = self.Data.read_responses_by_id(self.cursor, Id)
if not row:
return
responseItems = interface.data_row_to_response_items(row)
url = responseItems[ResponsesTable.URL]
reqHeaders = responseItems[ResponsesTable.REQ_HEADERS]
reqData = responseItems[ResponsesTable.REQ_DATA]
resHeaders = responseItems[ResponsesTable.RES_HEADERS]
resData = responseItems[ResponsesTable.RES_DATA]
contentType = responseItems[ResponsesTable.RES_CONTENT_TYPE]
self.miniResponseRenderWidget.populate_response_content(url, reqHeaders, reqData, resHeaders, resData, contentType)
def webfuzzer_populate_response_id(self, Id):
self.clear_data_dictionary()
row = self.Data.read_responses_by_id(self.cursor, Id)
if not row:
return
responseItems = interface.data_row_to_response_items(row)
url = responseItems[ResponsesTable.URL]
reqHeaders = responseItems[ResponsesTable.REQ_HEADERS].decode('utf-8', 'ignore')
reqData = responseItems[ResponsesTable.REQ_DATA].decode('utf-8', 'ignore')
method = responseItems[ResponsesTable.REQ_METHOD]
splitted = urlparse.urlsplit(url)
# Create a new parsed object removing the scheme and netloc
base_url = urlparse.urlunsplit((splitted[0], splitted[1], splitted[2], '', ''))
req_loc = ("", "", "", splitted.query, splitted.fragment)
useragent = self.framework.useragent()
has_cookie = False
template = StringIO()
template.write('${method} ${request_uri}%s HTTP/1.1\n' % urlparse.urlunsplit(req_loc))
first = True
for line in reqHeaders.splitlines():
if not line:
break
if first and self.re_request.match(line):
first = False
continue
if ':' in line:
name, value = [v.strip() for v in line.split(':', 1)]
lname = name.lower()
if 'host' == lname:
if splitted.hostname and value == splitted.hostname:
template.write('Host: ${host}\n')
continue
elif 'user-agent' == lname:
if useragent == value:
template.write('User-Agent: ${user_agent}\n')
continue
template.write(line)
template.write('\n')
template.write('\n')
template.write(reqData)
self.set_combo_box_text(self.mainWindow.stdFuzzerReqMethod, method.upper())
self.mainWindow.wfStdUrlEdit.setText(base_url)
self.mainWindow.wfStdEdit.setPlainText(template.getvalue())
def insert_payload_marker(self):
""" Inserts a payload marker at current cursor position """
index = self.mainWindow.stdFuzzPayloadBox.currentIndex()
curPayload = str(self.mainWindow.stdFuzzPayloadBox.itemText(index))
currentText = self.mainWindow.wfStdEdit.textCursor().selectedText()
self.store_in_data_dictionary(curPayload, currentText)
self.mainWindow.wfStdEdit.textCursor().insertHtml("<font color='red'>${%s}</font>" % curPayload)
self.save_configuration_values()
def clear_data_dictionary(self):
tableWidget = self.mainWindow.wfDataDictionaryDataTable
while tableWidget.rowCount() > 0:
tableWidget.removeRow(0)
self.save_data_dictionary_to_config()
def store_in_data_dictionary(self, replacement, value):
# TODO: currently logic allows for duplicate values to appear
tableWidget = self.mainWindow.wfDataDictionaryDataTable
row = tableWidget.rowCount()
tableWidget.insertRow(row)
tableWidget.setItem(row, 0, QTableWidgetItem(replacement))
tableWidget.setItem(row, 1, QTableWidgetItem(value))
self.save_data_dictionary_to_config()
def save_data_dictionary_to_config(self):
ddict = self.get_values_from_data_dictionary()
dd_data = json.dumps(ddict)
self.framework.set_raft_config_value('WebFuzzer.Standard.DataDictionary', dd_data)
def restore_data_dictionary(self):
dd_data = self.framework.get_raft_config_value('WebFuzzer.Standard.DataDictionary', '')
if dd_data:
tableWidget = self.mainWindow.wfDataDictionaryDataTable
obj = json.loads(dd_data)
for name, value in obj.items():
row = tableWidget.rowCount()
tableWidget.insertRow(row)
tableWidget.setItem(row, 0, QTableWidgetItem(name))
tableWidget.setItem(row, 1, QTableWidgetItem(value))
def get_values_from_data_dictionary(self):
tableWidget = self.mainWindow.wfDataDictionaryDataTable
ddict = {}
for rindex in range(0, tableWidget.rowCount()):
name = tableWidget.item(rindex, 0).text()
value = tableWidget.item(rindex, 1).text()
ddict[name] = value
return ddict
def handle_wfDataDictonaryAddButton_clicked(self):
name = self.mainWindow.wfDataDictionaryDataName.text()
value = self.mainWindow.wfDataDictionaryDataValue.text()
self.store_in_data_dictionary(name, value)
def save_configuration_values(self):
self.save_standard_configuration()
self.save_config_configuration()
def save_standard_configuration(self):
url = str(self.mainWindow.wfStdUrlEdit.text())
templateHtml = str(self.mainWindow.wfStdEdit.document().toHtml())
method = str(self.mainWindow.stdFuzzerReqMethod.currentText())
self.framework.set_raft_config_value('WebFuzzer.Standard.RequestUrl', url)
self.framework.set_raft_config_value('WebFuzzer.Standard.TemplateHtml', templateHtml)
self.framework.set_raft_config_value('WebFuzzer.Standard.Method', method)
self.framework.set_raft_config_value('WebFuzzer.Standard.PreSequenceEnabled', self.mainWindow.wfStdPreChk.isChecked())
self.framework.set_raft_config_value('WebFuzzer.Standard.PreSequenceId', self.mainWindow.wfStdPreBox.itemData(self.mainWindow.wfStdPreBox.currentIndex()))
self.framework.set_raft_config_value('WebFuzzer.Standard.PostSequenceEnabled', self.mainWindow.wfStdPostChk.isChecked())
self.framework.set_raft_config_value('WebFuzzer.Standard.PostSequenceId', self.mainWindow.wfStdPostBox.itemData(self.mainWindow.wfStdPostBox.currentIndex()))
def save_config_configuration(self):
self.save_config_configuration_item('Payload1', self.mainWindow.wfPay1FuzzRadio, self.mainWindow.wfPay1PayloadBox, self.mainWindow.wfPay1StaticRadio, self.mainWindow.wfPay1DynamicRadio, self.mainWindow.wfPay1StaticEdit)
self.save_config_configuration_item('Payload2', self.mainWindow.wfPay2FuzzRadio, self.mainWindow.wfPay2PayloadBox, self.mainWindow.wfPay2StaticRadio, self.mainWindow.wfPay2DynamicRadio, self.mainWindow.wfPay2StaticEdit)
self.save_config_configuration_item('Payload3', self.mainWindow.wfPay3FuzzRadio, self.mainWindow.wfPay3PayloadBox, self.mainWindow.wfPay3StaticRadio, self.mainWindow.wfPay3DynamicRadio, self.mainWindow.wfPay3StaticEdit)
self.save_config_configuration_item('Payload4', self.mainWindow.wfPay4FuzzRadio, self.mainWindow.wfPay4PayloadBox, self.mainWindow.wfPay4StaticRadio, self.mainWindow.wfPay4DynamicRadio, self.mainWindow.wfPay4StaticEdit)
self.save_config_configuration_item('Payload5', self.mainWindow.wfPay5FuzzRadio, self.mainWindow.wfPay5PayloadBox, self.mainWindow.wfPay5StaticRadio, self.mainWindow.wfPay5DynamicRadio, self.mainWindow.wfPay5StaticEdit)
def save_config_configuration_item(self, payload_item, fuzzRadio, payloadBox, staticRadio, dynamicRadio, staticEdit):
self.framework.set_raft_config_value('WebFuzzer.Config.{0}FuzzSelected'.format(payload_item), fuzzRadio.isChecked())
self.framework.set_raft_config_value('WebFuzzer.Config.{0}FuzzPayload'.format(payload_item), str(payloadBox.currentText()))
self.framework.set_raft_config_value('WebFuzzer.Config.{0}StaticSelected'.format(payload_item), staticRadio.isChecked())
self.framework.set_raft_config_value('WebFuzzer.Config.{0}DynamicSelected'.format(payload_item), dynamicRadio.isChecked())
self.framework.set_raft_config_value('WebFuzzer.Config.{0}StaticEdit'.format(payload_item), staticEdit.text())
def start_fuzzing_clicked(self):
""" Start the fuzzing attack """
if 'Cancel' == self.mainWindow.wfStdStartButton.text() and self.pending_fuzz_requests is not None:
self.cancel_fuzz_requests = True
for context, pending_request in self.pending_fuzz_requests.items():
pending_request.cancel()
self.pending_fuzz_requests = None
self.mainWindow.wfStdStartButton.setText('Start Attack')
self.mainWindow.fuzzerStandardProgressBar.setValue(0)
return
self.pending_fuzz_requests = {}
url = str(self.mainWindow.wfStdUrlEdit.text())
templateText = str(self.mainWindow.wfStdEdit.toPlainText())
method = str(self.mainWindow.stdFuzzerReqMethod.currentText())
self.save_standard_configuration()
replacements = self.build_replacements(method, url)
sequenceId = None
if self.mainWindow.wfStdPreChk.isChecked():
sequenceId = self.mainWindow.wfStdPreBox.itemData(self.mainWindow.wfStdPreBox.currentIndex())
postSequenceId = None
if self.mainWindow.wfStdPostChk.isChecked():
postSequenceId = self.mainWindow.wfStdPostBox.itemData(self.mainWindow.wfStdPostBox.currentIndex())
# Fuzzing stuff
payload_mapping = self.create_payload_map()
# print(payload_mapping)
self.create_functions()
template_definition = TemplateDefinition(templateText)
template_items = template_definition.template_items
### print(template_items)
parameter_names = template_definition.parameter_names
self.global_ns = self.local_ns = {}
scriptLoader = ScriptLoader()
errors = []
fuzz_payloads = {}
for name, payload_info in payload_mapping.items():
if name in parameter_names:
payload_type, payload_value, payload_file = payload_info
if 'fuzz' == payload_type:
filename = payload_value
values = self.Attacks.read_data(filename)
fuzz_payloads[name] = values
elif 'dynamic' == payload_type:
target = payload_file
# TODO: should this come from saved file or current Scintilla values (?)
script_env = scriptLoader.load_from_file(os.path.join(self.functions_dir, target), self.global_ns, self.local_ns)
expression = payload_value
if not expression.endswith('()'):
expression += '()'
eval_result = eval(expression, self.global_ns, self.local_ns)
fuzz_payloads[name] = [str(v) for v in eval_result]
elif 'static' == payload_type:
pass
elif 'none' == payload_type:
# unconfigured payload
errors.append(name)
test_slots = []
counters = []
tests_count = []
total_tests = 1
for name, payload_info in payload_mapping.items():
if name in parameter_names:
payload_type, payload_value, payload_file = payload_info
if 'static' == payload_type:
# static payload value
payloads = [payload_value]
elif 'fuzz' == payload_type:
payloads = fuzz_payloads[name]
elif 'dynamic' == payload_type:
payloads = fuzz_payloads[name]
total_tests *= len(payloads)
test_slots.append((name, payloads))
counters.append(0)
tests_count.append(len(payloads))
position_end = len(counters) - 1
position = position_end
self.miniResponseRenderWidget.clear_response_render()
self.mainWindow.fuzzerStandardProgressBar.setValue(0)
self.mainWindow.fuzzerStandardProgressBar.setMaximum(total_tests)
finished = False
first = True
while not finished:
data = {}
for j in range(0, len(test_slots)):
name, payloads = test_slots[j]
data[name] = payloads[counters[j]]
template_io = StringIO()
self.apply_template_parameters(template_io, data, template_items)
templateText = template_io.getvalue()
context = uuid.uuid4().hex
# print('%s%s%s' % ('-'*32, request, '-'*32))
use_global_cookie_jar = self.mainWindow.webFuzzerUseGlobalCookieJar.isChecked()
(method, url, headers, body) = self.process_template(url, templateText, replacements)
if first:
self.mainWindow.wfStdStartButton.setText('Cancel')
if use_global_cookie_jar:
self.fuzzRequesterCookieJar = self.framework.get_global_cookie_jar()
else:
self.fuzzRequesterCookieJar = InMemoryCookieJar(self.framework, self)
self.requestRunner = RequestRunner(self.framework, self)
self.requestRunner.setup(self.fuzzer_response_received, self.fuzzRequesterCookieJar, sequenceId, postSequenceId)
first = False
self.pending_fuzz_requests[context] = self.requestRunner.queue_request(method, url, headers, body, context)
# increment to next test
counters[position] = (counters[position] + 1) % (tests_count[position])
while position >= 0 and counters[position] == 0:
position -= 1
counters[position] = (counters[position] + 1) % (tests_count[position])
if position == -1:
finished = True
else:
position = position_end
def apply_template_parameters(self, template_io, data, template_items):
for item in template_items:
if item.is_text():
template_io.write(item.item_value)
elif item.is_builtin():
template_io.write('${'+item.item_value+'}')
elif item.is_payload():
template_io.write(data[item.item_value])
elif item.is_function():
temp_io = StringIO()
self.apply_template_parameters(temp_io, data, item.items)
temp_result = temp_io.getvalue()
temp_io = None
result = eval('%s(%s)' % (item.item_value, repr(temp_result)), self.global_ns, self.local_ns)
template_io.write(str(result))
else:
raise Exception('unsupported template parameters: ' + repr(item))
def build_replacements(self, method, url):
replacements = {}
splitted = urlparse.urlsplit(url)
replacements['method'] = method.upper()
replacements['url'] = url
replacements['scheme'] = splitted.scheme or ''
replacements['netloc'] = splitted.netloc or ''
replacements['host'] = splitted.hostname or ''
replacements['path'] = splitted.path or ''
replacements['query'] = splitted.query or ''
replacements['fragment'] = splitted.fragment or ''
replacements['request_uri'] = url
replacements['user_agent'] = self.framework.useragent()
return replacements
def process_template(self, url, template, replacements):
# Start of old
method, uri = '' ,''
headers, body = '', ''
# TODO: this allows for missing entries -- is this good?
func = lambda m: replacements.get(m.group(1))
prev = 0
while True:
n = template.find('\n', prev)
if -1 == n:
break
if n > 0 and '\r' == template[n-1]:
line = template[prev:n-1]
else:
line = template[prev:n]
if 0 == len(line):
# end of headers
headers = template[0:n+1]
body = template[n+1:]
break
prev = n + 1
if not headers:
headers = template
body = ''
# TODO: could work from ordered dict to main order?
headers_dict = {}
first = True
for line in headers.splitlines():
# print(line)
if not line:
break
if '$' in line:
line = self.re_replacement.sub(func, line)
if first:
m = self.re_request.match(line)
if not m:
raise Exception('Invalid HTTP request: failed to match request line: %s' % (line))
method = m.group(1)
uri = m.group(2)
first = False
continue
if ':' in line:
name, value = [v.strip() for v in line.split(':', 1)]
headers_dict[name] = value
if '$' in body:
body = self.re_replacement.sub(func, body)
url = urlparse.urljoin(url, uri)
return (method, url, headers_dict, body)
def fuzzer_history_clear_button_clicked(self):
self.Data.clear_fuzzer_history(self.cursor)
self.fuzzerHistoryDataModel.clearModel()
def fuzzer_response_received(self, response_id, context):
self.mainWindow.fuzzerStandardProgressBar.setValue(self.mainWindow.fuzzerStandardProgressBar.value()+1)
context = str(context)
if self.pending_fuzz_requests is not None:
try:
self.pending_fuzz_requests.pop(context)
except KeyError as e:
pass
if 0 != response_id:
row = self.Data.read_responses_by_id(self.cursor, response_id)
if row:
response_item = [m or '' for m in row]
self.Data.insert_fuzzer_history(self.cursor, response_id)
self.fuzzerHistoryDataModel.append_data([response_item])
finished = False
if self.pending_fuzz_requests is None or len(self.pending_fuzz_requests) == 0:
self.mainWindow.fuzzerStandardProgressBar.setValue(self.mainWindow.fuzzerStandardProgressBar.maximum())
finished = True
elif self.mainWindow.fuzzerStandardProgressBar.value() == self.mainWindow.fuzzerStandardProgressBar.maximum():
finished = True
if finished:
self.mainWindow.wfStdStartButton.setText('Start Attack')
class RequesterTab(QObject):
def __init__(self, framework, mainWindow):
QObject.__init__(self, mainWindow)
self.framework = framework
self.mainWindow = mainWindow
self.mainWindow.requesterSendButton.clicked.connect(self.requester_send_button_clicked)
self.mainWindow.bulkRequestPushButton.clicked.connect(self.requester_bulk_request_button_clicked)
self.mainWindow.requesterHistoryClearButton.clicked.connect(self.requester_history_clear_button_clicked)
self.mainWindow.reqTabWidget.currentChanged.connect(self.handle_tab_currentChanged)
self.mainWindow.requesterSequenceCheckBox.stateChanged.connect(self.handle_requesterSequenceCheckBox_stateChanged)
self.mainWindow.bulkRequestSequenceCheckBox.stateChanged.connect(self.handle_bulkRequestSequenceCheckBox_stateChanged)
self.mainWindow.sequenceRunnerRunButton.clicked.connect(self.handle_sequenceRunnerRunButton_clicked)
self.pending_request = None
self.pending_bulk_requests = None
self.pending_sequence_requests = None
self.re_request = re.compile(r'^(\S+)\s+((?:https?://(?:\S+\.)+\w+(?::\d+)?)?/.*)\s+HTTP/\d+\.\d+\s*$', re.I)
self.re_request_cookie = re.compile(r'^Cookie:\s*(\S+)', re.I|re.M)
self.re_replacement = re.compile(r'\$\{(\w+)\}')
self.framework.subscribe_populate_requester_response_id(self.requester_populate_response_id)
self.framework.subscribe_populate_bulk_requester_responses(self.bulk_requester_populate_responses)
self.framework.subscribe_sequences_changed(self.fill_sequences)
self.setup_requester_tab()
self.Data = None
self.cursor = None
self.framework.subscribe_database_events(self.db_attach, self.db_detach)
def db_attach(self):
self.Data = self.framework.getDB()
self.cursor = self.Data.allocate_thread_cursor()
self.fill_requesters()
def db_detach(self):
self.close_cursor()
self.Data = None
def close_cursor(self):
if self.cursor and self.Data:
self.cursor.close()
self.Data.release_thread_cursor(self.cursor)
self.cursor = None
def setup_requester_tab(self):
self.historyRequestResponse = RequestResponseWidget(self.framework, self.mainWindow.requesterHistoryTabWidget, self.mainWindow.requesterHistorySearchResultsPlaceholder, self)
self.requesterHistoryDataModel = ResponsesDataModel.ResponsesDataModel(self.framework, self)
self.mainWindow.requesterHistoryTreeView.setModel(self.requesterHistoryDataModel)
self.mainWindow.requesterHistoryTreeView.activated.connect(self.fill_history_request_response)
self.mainWindow.requesterHistoryTreeView.clicked.connect(self.fill_history_request_response)
self.mainWindow.requesterHistoryTreeView.doubleClicked.connect(self.requester_history_item_double_clicked)
self.historyResponsesContextMenu = ResponsesContextMenuWidget(self.framework, self.requesterHistoryDataModel, self.mainWindow.requesterHistoryTreeView, self)
self.historyResponsesContextMenu.set_currentChanged_callback(self.fill_history_request_response)
self.sequenceRunnerRequestResponse = RequestResponseWidget(self.framework, self.mainWindow.sequenceRunnerTabWidget, self.mainWindow.sequenceRunnerSearchResultsPlaceholder, self)
self.sequenceRunnerDataModel = ResponsesDataModel.ResponsesDataModel(self.framework, self)
self.mainWindow.sequenceRunnerTreeView.setModel(self.sequenceRunnerDataModel)
self.mainWindow.sequenceRunnerTreeView.activated.connect(self.fill_sequence_runner_request_response)
self.mainWindow.sequenceRunnerTreeView.clicked.connect(self.fill_sequence_runner_request_response)
self.mainWindow.sequenceRunnerTreeView.doubleClicked.connect(self.requester_sequence_runner_item_double_clicked)
self.sequence_runnerResponsesContextMenu = ResponsesContextMenuWidget(self.framework, self.sequenceRunnerDataModel, self.mainWindow.sequenceRunnerTreeView, self)
self.sequence_runnerResponsesContextMenu.set_currentChanged_callback(self.fill_sequence_runner_request_response)
self.miniResponseRenderWidget = MiniResponseRenderWidget(self.framework, self.mainWindow.reqRespTabWidget, True, self)
self.scopeController = self.framework.getScopeController()
def requester_history_item_double_clicked(self, index):
Id = interface.index_to_id(self.requesterHistoryDataModel, index)
if Id:
dialog = RequestResponseDetailDialog(self.framework, Id, self.mainWindow)
dialog.show()
dialog.exec_()
def fill_history_request_response(self, index):
Id = interface.index_to_id(self.requesterHistoryDataModel, index)
if Id:
self.historyRequestResponse.fill(Id)
def requester_sequence_runner_item_double_clicked(self, index):
Id = interface.index_to_id(self.sequenceRunnerDataModel, index)
if Id:
dialog = RequestResponseDetailDialog(self.framework, Id, self.mainWindow)
dialog.show()
dialog.exec_()
def fill_sequence_runner_request_response(self, index):
Id = interface.index_to_id(self.sequenceRunnerDataModel, index)
if Id:
self.sequenceRunnerRequestResponse.fill(Id)
def fill_requesters(self):
# requesters
self.requesterHistoryDataModel.clearModel()
history_items = []
for row in self.Data.get_all_requester_history(self.cursor):
response_item = interface.data_row_to_response_items(row)
history_items.append(response_item)
self.requesterHistoryDataModel.append_data(history_items)
self.fill_sequences()
self.mainWindow.requesterUrlEdit.setText(self.framework.get_raft_config_value('requesterUrlEdit'))
self.mainWindow.bulkRequestUrlListEdit.setPlainText(self.framework.get_raft_config_value('bulkRequestUrlListEdit'))
def fill_sequences(self):
self.fill_sequences_combo_box(self.mainWindow.requesterSequenceComboBox)
self.fill_sequences_combo_box(self.mainWindow.bulkRequestSequenceComboBox)
self.fill_sequences_combo_box(self.mainWindow.sequenceRunnerSequenceComboBox)
def requester_populate_response_id(self, Id):
row = self.Data.read_responses_by_id(self.cursor, Id)
if not row:
return
responseItems = interface.data_row_to_response_items(row)
method, url, template_text = self.generate_template_for_response_item(responseItems)
self.set_combo_box_text(self.mainWindow.requesterRequestMethod, method.upper())
self.mainWindow.requesterUrlEdit.setText(url)
self.mainWindow.requesterTemplateEdit.setPlainText(template_text)
def bulk_requester_populate_responses(self, id_list):
url_list = []
first = True
for Id in id_list:
row = self.Data.read_responses_by_id(self.cursor, Id)
if not row:
continue
responseItems = interface.data_row_to_response_items(row)
url = responseItems[ResponsesTable.URL]
if url not in url_list:
url_list.append(url)
if first:
method, url, template_text = self.generate_template_for_response_item(responseItems)
self.set_combo_box_text(self.mainWindow.bulkRequestMethodEdit, method.upper())
self.mainWindow.bulkRequestTemplateEdit.setPlainText(template_text)
first = False
self.mainWindow.bulkRequestUrlListEdit.setPlainText('\n'.join(url_list))
def generate_template_for_response_item(self, responseItems):
url = responseItems[ResponsesTable.URL]
reqHeaders = str(responseItems[ResponsesTable.REQ_HEADERS], 'utf-8', 'ignore')
reqData = str(responseItems[ResponsesTable.REQ_DATA], 'utf-8', 'ignore')
method = responseItems[ResponsesTable.REQ_METHOD]
splitted = urlparse.urlsplit(url)
useragent = self.framework.useragent()
has_cookie = False
template = StringIO()
template.write('${method} ${request_uri} HTTP/1.1\n')
first = True
for line in reqHeaders.splitlines():
if not line:
break
if first and self.re_request.match(line):
first = False
continue
if ':' in line:
name, value = [v.strip() for v in line.split(':', 1)]
lname = name.lower()
if 'host' == lname:
if splitted.hostname and value == splitted.hostname:
template.write('Host: ${host}\n')
continue
elif 'user-agent' == lname:
if useragent == value:
template.write('User-Agent: ${user_agent}\n')
continue
template.write(line)
template.write('\n')
template.write('\n')
template.write(reqData)
return method, url, template.getvalue()
def set_combo_box_text(self, comboBox, selectedText):
index = comboBox.findText(selectedText)
if -1 == index:
comboBox.addItem(selectedText)
index = comboBox.findText(selectedText)
comboBox.setCurrentIndex(index)
def handle_requesterSequenceCheckBox_stateChanged(self, state):
self.mainWindow.requesterSequenceComboBox.setEnabled(self.mainWindow.requesterSequenceCheckBox.isChecked())
def handle_bulkRequestSequenceCheckBox_stateChanged(self, state):
self.mainWindow.bulkRequestSequenceComboBox.setEnabled(self.mainWindow.bulkRequestSequenceCheckBox.isChecked())
def handle_tab_currentChanged(self, index):
# TODO: must this hard-coded ?
if 0 == index:
self.fill_sequences_combo_box(self.mainWindow.requesterSequenceComboBox)
elif 1 == index:
self.fill_sequences_combo_box(self.mainWindow.bulkRequestSequenceComboBox)
elif 2 == index:
self.fill_sequences_combo_box(self.mainWindow.sequenceRunnerSequenceComboBox)
def requester_send_button_clicked(self):
""" Make a request from the Request tab """
if 'Cancel' == self.mainWindow.requesterSendButton.text() and self.pending_request is not None:
self.pending_request.cancel()
self.pending_request = None
self.mainWindow.requesterSendButton.setText('Send')
return
qurl = QUrl.fromUserInput(self.mainWindow.requesterUrlEdit.text())
url = qurl.toEncoded().data().decode('utf-8')
self.mainWindow.requesterUrlEdit.setText(url)
self.framework.set_raft_config_value('requesterUrlEdit', url)
templateText = str(self.mainWindow.requesterTemplateEdit.toPlainText())
method = str(self.mainWindow.requesterRequestMethod.currentText())
use_global_cookie_jar = self.mainWindow.requesterUseGlobalCookieJar.isChecked()
replacements = self.build_replacements(method, url)
(method, url, headers, body) = self.process_template(url, templateText, replacements)
sequenceId = None
if self.mainWindow.requesterSequenceCheckBox.isChecked():
sequenceId = str(self.mainWindow.requesterSequenceComboBox.itemData(self.mainWindow.requesterSequenceComboBox.currentIndex()))
self.requestRunner = RequestRunner(self.framework, self)
if use_global_cookie_jar:
self.requesterCookieJar = self.framework.get_global_cookie_jar()
else:
self.requesterCookieJar = InMemoryCookieJar(self.framework, self)
self.requestRunner.setup(self.requester_response_received, self.requesterCookieJar, sequenceId)
self.pending_request = self.requestRunner.queue_request(method, url, headers, body)
self.mainWindow.requesterSendButton.setText('Cancel')
self.miniResponseRenderWidget.clear_response_render()
def requester_response_received(self, response_id, context):
if 0 != response_id:
row = self.Data.read_responses_by_id(self.cursor, response_id)
if row:
response_item = interface.data_row_to_response_items(row)
self.Data.insert_requester_history(self.cursor, response_id)
self.requesterHistoryDataModel.append_data([response_item])
url = response_item[ResponsesTable.URL]
req_headers = response_item[ResponsesTable.REQ_HEADERS]
req_body = response_item[ResponsesTable.REQ_DATA]
res_headers = response_item[ResponsesTable.RES_HEADERS]
res_body = response_item[ResponsesTable.RES_DATA]
res_content_type = response_item[ResponsesTable.RES_CONTENT_TYPE]
self.miniResponseRenderWidget.populate_response_content(url, req_headers, req_body, res_headers, res_body, res_content_type)
self.mainWindow.requesterSendButton.setText('Send')
self.pending_request = None
def requester_bulk_request_button_clicked(self):
if 'Cancel' == self.mainWindow.bulkRequestPushButton.text() and self.pending_bulk_requests is not None:
self.cancel_bulk_requests = True
for context, pending_request in self.pending_bulk_requests.items():
pending_request.cancel()
self.pending_bulk_requests = None
self.mainWindow.bulkRequestPushButton.setText('Send')
self.mainWindow.bulkRequestProgressBar.setValue(0)
return
if self.pending_bulk_requests is None:
self.pending_bulk_requests = {}
method = str(self.mainWindow.bulkRequestMethodEdit.currentText())
templateText = str(self.mainWindow.bulkRequestTemplateEdit.toPlainText())
template_url = str(self.mainWindow.bulkRequestUrlEdit.text())
url_list = str(self.mainWindow.bulkRequestUrlListEdit.toPlainText())
self.framework.set_raft_config_value('bulkRequestUrlListEdit', url_list)
request_urls = url_list.splitlines()
self.mainWindow.bulkRequestProgressBar.setValue(0)
self.mainWindow.bulkRequestProgressBar.setMaximum(len(request_urls))
sequenceId = None
if self.mainWindow.bulkRequestSequenceCheckBox.isChecked():
sequenceId = str(self.mainWindow.bulkRequestSequenceComboBox.itemData(self.mainWindow.bulkRequestSequenceComboBox.currentIndex()))
first = True
self.cancel_bulk_requests = False
for request_url in request_urls:
if self.cancel_bulk_requests:
break
request_url = request_url.strip()
if request_url:
context = uuid.uuid4().hex
# TODO: move this hack
if '$' in template_url:
replacements = self.build_replacements(method, request_url)
url = self.re_replacement.sub(lambda m: replacements.get(m.group(1)), template_url)
else:
url = request_url
if not self.scopeController.isUrlInScope(url, url):
self.framework.log_warning('skipping out of scope URL: %s' % (url))
self.mainWindow.bulkRequestProgressBar.setValue(self.mainWindow.bulkRequestProgressBar.value()+1)
continue
use_global_cookie_jar = self.mainWindow.bulkRequestUseGlobalCookieJar.isChecked()
replacements = self.build_replacements(method, url)
(method, url, headers, body) = self.process_template(url, templateText, replacements)
if first:
self.mainWindow.bulkRequestPushButton.setText('Cancel')
if use_global_cookie_jar:
self.bulkRequesterCookieJar = self.framework.get_global_cookie_jar()
else:
self.bulkRequesterCookieJar = InMemoryCookieJar(self.framework, self)
self.bulk_requestRunner = RequestRunner(self.framework, self)
self.bulk_requestRunner.setup(self.requester_bulk_response_received, self.bulkRequesterCookieJar, sequenceId)
first = False
self.pending_bulk_requests[context] = self.bulk_requestRunner.queue_request(method, url, headers, body, context)
def requester_bulk_response_received(self, response_id, context):
self.mainWindow.bulkRequestProgressBar.setValue(self.mainWindow.bulkRequestProgressBar.value()+1)
context = str(context)
if self.pending_bulk_requests is not None:
try:
self.pending_bulk_requests.pop(context)
except KeyError as e:
pass
if 0 != response_id:
row = self.Data.read_responses_by_id(self.cursor, response_id)
if row:
response_item = interface.data_row_to_response_items(row)
self.Data.insert_requester_history(self.cursor, response_id)
self.requesterHistoryDataModel.append_data([response_item])
finished = False
if self.pending_bulk_requests is None or len(self.pending_bulk_requests) == 0:
self.mainWindow.bulkRequestProgressBar.setValue(self.mainWindow.bulkRequestProgressBar.maximum())
finished = True
elif self.mainWindow.bulkRequestProgressBar.value() == self.mainWindow.bulkRequestProgressBar.maximum():
finished = True
if finished:
self.mainWindow.bulkRequestPushButton.setText('Send')
def handle_sequenceRunnerRunButton_clicked(self):
""" Run a sequence """
if 'Cancel' == self.mainWindow.sequenceRunnerRunButton.text() and self.pending_sequence_requests is not None:
self.cancel_sequence_requests = True
for context, pending_request in self.pending_sequence_requests.items():
pending_request.cancel()
self.pending_sequence_requests = None
self.mainWindow.sequenceRunnerButton.setText('Send')
self.mainWindow.sequenceRunnerButton.setValue(0)
return
self.sequenceRunnerDataModel.clearModel()
sequenceId = str(self.mainWindow.sequenceRunnerSequenceComboBox.itemData(self.mainWindow.sequenceRunnerSequenceComboBox.currentIndex()))
use_global_cookie_jar = self.mainWindow.sequenceRunnerUseGlobalCookieJar.isChecked()
if use_global_cookie_jar:
self.sequenceRunnerCookieJar = self.framework.get_global_cookie_jar()
else:
self.sequenceRunnerCookieJar = InMemoryCookieJar(self.framework, self)
self.sequence_requestRunner = RequestRunner(self.framework, self)
self.sequence_requestRunner.setup(self.sequence_runner_response_received, self.sequenceRunnerCookieJar, sequenceId)
self.pending_sequence_requests = self.sequence_requestRunner.run_sequence()
self.mainWindow.sequenceRunnerRunButton.setText('Cancel')
def sequence_runner_response_received(self, response_id, context):
context = str(context)
if self.pending_sequence_requests is not None:
try:
self.pending_sequence_requests.pop(context)
except KeyError as e:
print((e))
pass
if 0 != response_id:
row = self.Data.read_responses_by_id(self.cursor, response_id)
if row:
response_item = interface.data_row_to_response_items(row)
self.sequenceRunnerDataModel.append_data([response_item])
if self.pending_sequence_requests is None or len(self.pending_sequence_requests) == 0:
self.mainWindow.sequenceRunnerRunButton.setText('Send')
def requester_history_clear_button_clicked(self):
self.Data.clear_requester_history(self.cursor)
self.requesterHistoryDataModel.clearModel()
def fill_sequences_combo_box(self, comboBox):
selectedText = comboBox.currentText()
comboBox.clear()
for row in self.Data.get_all_sequences(self.cursor):
sequenceItem = [m or '' for m in row]
name = str(sequenceItem[1])
Id = str(sequenceItem[0])
item = comboBox.addItem(name, Id)
if selectedText:
index = comboBox.findText(selectedText)
if index != -1:
comboBox.setCurrentIndex(index)
def build_replacements(self, method, url):
replacements = {}
splitted = urlparse.urlsplit(url)
replacements['method'] = method.upper()
replacements['url'] = url
replacements['scheme'] = splitted.scheme or ''
replacements['netloc'] = splitted.netloc or ''
replacements['host'] = splitted.hostname or ''
replacements['path'] = splitted.path or '/'
replacements['query'] = splitted.query or ''
replacements['fragment'] = splitted.fragment or ''
replacements['request_uri'] = urlparse.urlunsplit(('', '', replacements['path'], replacements['query'], ''))
replacements['user_agent'] = self.framework.useragent()
return replacements
def process_template(self, url, template, replacements):
method, uri = '' ,''
headers, body = '', ''
# TODO: this allows for missing entries -- is this good?
func = lambda m: replacements.get(m.group(1))
prev = 0
while True:
n = template.find('\n', prev)
if -1 == n:
break
if n > 0 and '\r' == template[n-1]:
line = template[prev:n-1]
else:
line = template[prev:n]
if 0 == len(line):
# end of headers
headers = template[0:n+1]
body = template[n+1:]
break
prev = n + 1
if not headers:
headers = template
body = ''
# TODO: could work from ordered dict to main order?
headers_dict = {}
first = True
for line in headers.splitlines():
if not line:
break
if '$' in line:
line = self.re_replacement.sub(func, line)
if first:
m = self.re_request.match(line)
if not m:
raise Exception('Invalid HTTP request: failed to match request line: %s' % (line))
method = m.group(1)
uri = m.group(2)
first = False
continue
if ':' in line:
name, value = [v.strip() for v in line.split(':', 1)]
headers_dict[name] = value
if '$' in body:
body = self.re_replacement.sub(func, body)
url = urlparse.urljoin(url, uri)
return (method, url, headers_dict, body)