Exemple #1
0
    def test_basic(self):
        freq = FuzzableRequest(URL('http://www.w3af.com/'))
        fake_ref = 'http://w3af.org/'

        mutant = HeadersMutant(freq.copy())
        mutant.set_var('Referer')
        original_referer = freq.get_referer()
        mutant.set_original_value(original_referer)
        mutant.set_mod_value(fake_ref)

        self.assertEqual(mutant.get_headers()['Referer'], fake_ref)
        self.assertEqual(mutant.get_original_value(), original_referer)
    def test_basic(self):
        freq = FuzzableRequest(URL('http://www.w3af.com/'))
        fake_ref = 'http://w3af.org/'

        mutant = HeadersMutant(freq.copy())
        mutant.set_var('Referer')
        original_referer = freq.get_referer()
        mutant.set_original_value(original_referer)
        mutant.set_mod_value(fake_ref)

        self.assertEqual(mutant.get_headers()['Referer'], fake_ref)
        self.assertEqual(mutant.get_original_value(), original_referer)
Exemple #3
0
    def test_mutant_creation(self):
        url = URL('http://moth/?a=1&b=2')
        headers = Headers([('Referer', 'http://moth/')])
        freq = HTTPQSRequest(url, headers=headers)

        created_mutants = HeadersMutant.create_mutants(freq, self.payloads, [],
                                                       False,
                                                       self.fuzzer_config)

        expected_dc_lst = [
            Headers([('Referer', 'abc')]),
            Headers([('Referer', 'def')])
        ]

        created_dc_lst = [i.get_dc() for i in created_mutants]

        self.assertEqual(created_dc_lst, expected_dc_lst)

        self.assertEqual(created_mutants[0].get_var(), 'Referer')
        self.assertEqual(created_mutants[0].get_var_index(), 0)
        self.assertEqual(created_mutants[0].get_original_value(), '')
        self.assertEqual(created_mutants[1].get_var(), 'Referer')
        self.assertEqual(created_mutants[1].get_var_index(), 0)
        self.assertEqual(created_mutants[1].get_original_value(), '')

        self.assertTrue(
            all(isinstance(m, HeadersMutant) for m in created_mutants))
Exemple #4
0
    def test_found_at(self):
        headers = Headers([('Referer', 'http://moth/')])
        freq = FuzzableRequest(URL('http://www.w3af.com/?id=3'),
                               headers=headers)
        m = HeadersMutant(freq)
        m.set_var('Referer')
        m.set_mod_value('foo')

        expected = '"http://www.w3af.com/", using HTTP method GET. The modified'\
                   ' header was: "Referer" and it\'s value was: "foo".'
        self.assertEqual(m.found_at(), expected)
Exemple #5
0
    def _is_origin_checked(self, freq, orig_response):
        '''
        :return: True if the remote web application verifies the Referer before
                 processing the HTTP request.
        '''
        fake_ref = 'http://www.w3af.org/'
        mutant = HeadersMutant(freq.copy())
        mutant.set_var('Referer')
        mutant.set_original_value(freq.get_referer())
        mutant.set_mod_value(fake_ref)
        mutant_response = self._uri_opener.send_mutant(mutant)

        if not self._is_resp_equal(orig_response, mutant_response):
            return True

        return False
    def test_found_at(self):
        headers = Headers([('Referer', 'http://moth/')])
        freq = FuzzableRequest(URL('http://www.w3af.com/?id=3'),
                               headers=headers)
        m = HeadersMutant(freq)
        m.set_var('Referer')
        m.set_mod_value('foo')

        expected = '"http://www.w3af.com/", using HTTP method GET. The modified'\
                   ' header was: "Referer" and it\'s value was: "foo".'
        self.assertEqual(m.found_at(), expected)
Exemple #7
0
 def _is_origin_checked(self, freq, orig_response):
     '''
     :return: True if the remote web application verifies the Referer before
              processing the HTTP request.
     '''
     fake_ref = 'http://www.w3af.org/'
     mutant = HeadersMutant(freq.copy())
     mutant.set_var('Referer')
     mutant.set_original_value(freq.get_referer())
     mutant.set_mod_value(fake_ref)
     mutant_response = self._uri_opener.send_mutant(mutant)
     
     if not self._is_resp_equal(orig_response, mutant_response):
         return True
     
     return False
    def test_mutant_creation(self):
        url = URL('http://moth/?a=1&b=2')
        headers = Headers([('Referer', 'http://moth/')])
        freq = HTTPQSRequest(url, headers=headers)

        created_mutants = HeadersMutant.create_mutants(freq, self.payloads, [],
                                                       False, self.fuzzer_config)

        expected_dc_lst = [Headers([('Referer', 'abc')]),
                           Headers([('Referer', 'def')])]

        created_dc_lst = [i.get_dc() for i in created_mutants]

        self.assertEqual(created_dc_lst, expected_dc_lst)

        self.assertEqual(created_mutants[0].get_var(), 'Referer')
        self.assertEqual(created_mutants[0].get_var_index(), 0)
        self.assertEqual(created_mutants[0].get_original_value(), '')
        self.assertEqual(created_mutants[1].get_var(), 'Referer')
        self.assertEqual(created_mutants[1].get_var_index(), 0)
        self.assertEqual(created_mutants[1].get_original_value(), '')

        self.assertTrue(
            all(isinstance(m, HeadersMutant) for m in created_mutants))