def test_copy(self):
u = URL('http://www.w3af.com/?id=1&id=2')
self.assertEqual(u, u.copy())
def test_copy(self):
u = URL('http://www.w3af.com/?id=1&id=2')
self.assertEqual(u, u.copy())
class TestSerializedObject(unittest.TestCase):
def setUp(self):
kb.kb.cleanup()
self.plugin = serialized_object()
self.url = URL('http://www.w3af.com/')
self.headers = Headers([('content-type', 'text/html')])
self.response = HTTPResponse(200, '', self.headers, self.url, self.url, _id=1)
def tearDown(self):
self.plugin.end()
def test_php_serialized_objects_query_string(self):
for i, obj in enumerate(SERIALIZED_PHP_OBJECTS):
url = self.url.copy()
qs = QueryString([(str(i), [obj])])
url.set_querystring(qs)
request = FuzzableRequest(url)
self.plugin.grep(request, self.response)
self.assertEquals(len(kb.kb.get('serialized_object',
'serialized_object')), 2)
def test_php_serialized_objects_query_string_b64(self):
url = self.url.copy()
b64obj = base64.b64encode(SERIALIZED_PHP_OBJECTS[0])
qs = QueryString([('viewstate', [b64obj])])
url.set_querystring(qs)
request = FuzzableRequest(url)
self.plugin.grep(request, self.response)
self.assertEquals(len(kb.kb.get('serialized_object',
'serialized_object')), 1)
def test_php_serialized_objects_headers(self):
headers = Headers([('X-API-Key', SERIALIZED_PHP_OBJECTS[0])])
request = FuzzableRequest(self.url, headers=headers)
self.plugin.grep(request, self.response)
self.assertEquals(len(kb.kb.get('serialized_object',
'serialized_object')), 1)
def test_php_serialized_objects_cookies(self):
cookie_value = 'state=%s' % base64.b64encode(SERIALIZED_PHP_OBJECTS[0])
headers = Headers([('Cookie', cookie_value)])
request = FuzzableRequest(self.url, headers=headers)
self.plugin.grep(request, self.response)
self.assertEquals(len(kb.kb.get('serialized_object',
'serialized_object')), 1)
def test_php_serialized_objects_post_data(self):
post_data = 'obj=%s' % base64.b64encode(SERIALIZED_PHP_OBJECTS[1])
headers = Headers([('Content-Type', 'application/x-www-form-urlencoded')])
form = URLEncodedForm.from_postdata(headers, post_data)
request = FuzzableRequest(self.url, headers=headers, post_data=form)
self.plugin.grep(request, self.response)
self.assertEquals(len(kb.kb.get('serialized_object',
'serialized_object')), 1)
def test_not_php_serialized_objects(self):
# Note that I'm sending the serialized object in reverse string order
post_data = 'obj=%s' % base64.b64encode(SERIALIZED_PHP_OBJECTS[1][::-1])
headers = Headers([('Content-Type', 'application/x-www-form-urlencoded')])
form = URLEncodedForm.from_postdata(headers, post_data)
request = FuzzableRequest(self.url, headers=headers, post_data=form)
self.plugin.grep(request, self.response)
self.assertEquals(len(kb.kb.get('serialized_object',
'serialized_object')), 0)