Esempio n. 1
0
    def modify_request(self, request):
        """
        Mangles the request

        :param request: HTTPRequest instance that is going to be modified
                        by the evasion plugin
        :return: The modified request
        """
        # First we mangle the URL
        path = request.url_object.get_path()
        path = self._mutate(path)

        # Finally, we set all the mutants to the request in order to return it
        new_url = request.url_object.copy()
        new_url.set_path(path)

        # Mangle the postdata
        data = request.get_data()
        if data:

            try:
                # Only mangle the postdata if it is a url encoded string
                parse_qs(data)
            except:
                pass
            else:
                data = self._mutate(data)

        new_req = HTTPRequest(new_url, data, request.headers,
                              request.get_origin_req_host(),
                              retries=request.retries_left)

        return new_req
Esempio n. 2
0
 def can_parse(post_data):
     try:
         parse_qs(post_data)
     except:
         return False
     else:
         return True
Esempio n. 3
0
    def modify_request(self, request):
        """
        Mangles the request

        :param request: HTTPRequest instance that is going to be modified by
                        the evasion plugin
        :return: The modified request
        """
        # Mangle the postdata
        data = str(request.get_data())
        if data:

            try:
                # Only mangle the postdata if it is a url encoded string
                parse_qs(data)
            except:
                pass
            else:
                data = '\x00' + data
                headers_copy = copy.deepcopy(request.headers)
                headers_copy['content-length'] = str(len(data))

                request = HTTPRequest(request.url_object,
                                      data,
                                      headers_copy,
                                      request.get_origin_req_host(),
                                      retries=request.retries_left)

        return request
Esempio n. 4
0
    def modify_request(self, request):
        """
        Mangles the request

        :param request: HTTPRequest instance that is going to be modified by
                        the evasion plugin
        :return: The modified request
        """
        # Mangle the postdata
        data = str(request.get_data())
        if data:

            try:
                # Only mangle the postdata if it is a url encoded string
                parse_qs(data)
            except:
                pass
            else:
                data = '\x00' + data
                headers_copy = copy.deepcopy(request.headers)
                headers_copy['content-length'] = str(len(data))

                request = HTTPRequest(request.url_object, data, headers_copy,
                                      request.get_origin_req_host(),
                                      retries=request.retries_left)

        return request
Esempio n. 5
0
    def modify_request(self, request):
        """
        Mangles the request

        :param request: HTTPRequest instance that is going to be modified by
                        the evasion plugin
        :return: The modified request
        """
        data = str(request.get_data())

        if not data:
            return request

        # Only mangle the postdata if it is a url encoded string
        try:
            parse_qs(data)
        except:
            return request

        data = '\x00' + data
        headers_copy = copy.deepcopy(request.headers)
        headers_copy['content-length'] = str(len(data))

        new_req = request.copy()
        new_req.set_headers(headers_copy)
        new_req.set_data(data)

        return request
Esempio n. 6
0
    def modify_request(self, request):
        """
        Mangles the request

        :param request: HTTPRequest instance that is going to be modified
                        by the evasion plugin
        :return: The modified request
        """
        # First we mangle the URL
        path = request.url_object.get_path()
        path = self._mutate(path)

        # Finally, we set all the mutants to the request in order to return it
        new_url = request.url_object.copy()
        new_url.set_path(path)

        # Mangle the postdata
        data = request.get_data()
        if data:

            try:
                # Only mangle the postdata if it is a url encoded string
                parse_qs(data)
            except:
                pass
            else:
                data = self._mutate(data)

        new_req = HTTPRequest(new_url,
                              data,
                              request.headers,
                              request.get_origin_req_host(),
                              retries=request.retries_left)

        return new_req
Esempio n. 7
0
 def can_parse(post_data):
     try:
         parse_qs(post_data)
     except:
         return False
     else:
         return True
Esempio n. 8
0
    def modify_request(self, request):
        """
        Mangles the request

        :param request: HTTPRequest instance that is going to be modified by
                        the evasion plugin
        :return: The modified request

        """
        # First we mangle the URL
        path = request.url_object.get_path()
        path = self._mutate(path)

        # Now we mangle the postdata
        data = request.get_data()
        if data:
            try:
                # Only mangle the postdata if it is a url encoded string
                parse_qs(data)
            except:
                pass
            else:
                # We get here only if the parsing was successful
                data = self._mutate(data)

        # Finally, we set all the mutants to the request in order to return it
        new_url = request.url_object.copy()
        new_url.set_path(path)

        new_req = request.copy()
        new_req.set_data(data)
        new_req.set_uri(new_url)

        return new_req
Esempio n. 9
0
    def modify_request(self, request):
        """
        Mangles the request

        :param request: HTTPRequest instance that is going to be modified
                        by the evasion plugin
        :return: The modified request
        """
        # First we mangle the URL
        qs = copy.deepcopy(request.url_object.querystring)
        qs = self._mutate(qs)

        # Finally, we set all the mutants to the request in order to return it
        new_url = request.url_object.copy()
        new_url.querystring = qs

        # Mangle the postdata
        post_data = request.get_data()
        if post_data:

            try:
                # Only mangle the postdata if it is a url encoded string
                post_data = parse_qs(post_data)
            except:
                pass
            else:
                post_data = str(self._mutate(post_data))

        new_req = HTTPRequest(
            new_url, post_data, request.headers, request.get_origin_req_host(), retries=request.retries_left
        )

        return new_req
Esempio n. 10
0
    def modify_request(self, request):
        """
        Mangles the request

        :param request: HTTPRequest instance that is going to be modified
                        by the evasion plugin
        :return: The modified request
        """
        # First we mangle the URL
        qs = copy.deepcopy(request.url_object.querystring)
        qs = self._mutate(qs)

        # Finally, we set all the mutants to the request in order to return it
        new_url = request.url_object.copy()
        new_url.querystring = qs

        # Mangle the postdata
        post_data = request.get_data()
        if post_data:

            try:
                # Only mangle the postdata if it is a url encoded string
                post_data = parse_qs(post_data)
            except:
                pass
            else:
                post_data = str(self._mutate(post_data))

        new_req = HTTPRequest(new_url,
                              post_data,
                              request.headers,
                              request.get_origin_req_host(),
                              retries=request.retries_left)

        return new_req
Esempio n. 11
0
    def test_find_csrf_token_true_simple(self):
        url = URL('http://moth/w3af/audit/csrf/')
        query_string = parse_qs('secret=f842eb01b87a8ee18868d3bf80a558f3')
        freq = FuzzableRequest(url, method='GET')
        freq.set_querystring(query_string)

        token = self.csrf_plugin._find_csrf_token(freq)
        self.assertIn('secret', token)
Esempio n. 12
0
    def test_find_csrf_token_false(self):
        url = URL('http://moth/w3af/audit/csrf/')
        query_string = parse_qs('secret=not a token')
        freq = FuzzableRequest(url, method='GET')
        freq.set_querystring(query_string)

        token = self.csrf_plugin._find_csrf_token(freq)
        self.assertIn('secret', token)
Esempio n. 13
0
 def test_find_csrf_token_false(self):
     url = URL('http://moth/w3af/audit/csrf/')
     query_string = parse_qs('secret=not a token')
     freq = FuzzableRequest(url, method='GET')
     freq.set_querystring(query_string)
     
     token = self.csrf_plugin._find_csrf_token(freq)
     self.assertIn('secret', token)
Esempio n. 14
0
 def test_find_csrf_token_true_simple(self):
     url = URL('http://moth/w3af/audit/csrf/')
     query_string = parse_qs('secret=f842eb01b87a8ee18868d3bf80a558f3')
     freq = FuzzableRequest(url, method='GET')
     freq.set_querystring(query_string)
     
     token = self.csrf_plugin._find_csrf_token(freq)
     self.assertIn('secret', token)
Esempio n. 15
0
    def validate(self, value):
        if isinstance(value, QueryString):
            return value

        try:
            return parse_qs(value)
        except Exception:
            msg = 'Invalid query string configured by user.'
            raise BaseFrameworkException(msg)
Esempio n. 16
0
    def modify_request(self, request):
        """
        Mangles the request

        :param request: HTTPRequest instance that is going to be modified by
                        the evasion plugin
        :return: The modified request

        """
        # This is a test URL
        # http://172.16.1.132/index.asp?q=%uFF1Cscript%3Ealert(%22Hello%22)%3C/script%3E
        # This is the content of index.asp :
        # <%=Request.QueryString("q")%>

        # First we mangle the URL
        path = request.url_object.get_path()
        path = self._mutate(path)

        # Now we mangle the postdata
        data = request.get_data()
        if data:

            try:
                # Only mangle the postdata if it is a url encoded string
                parse_qs(data)
            except:
                pass
            else:
                # We get here only if the parsing was successful
                data = self._mutate(data)

        # Finally, we set all the mutants to the request in order to return it
        new_url = request.url_object.copy()
        new_url.set_path(path)

        new_req = HTTPRequest(new_url, data, request.headers,
                              request.get_origin_req_host(),
                              retries=request.retries_left)

        return new_req
Esempio n. 17
0
    def test_add_when_qs_and_postdata(self):
        url = URL('http://www.w3af.com/?id=1')
        original_req = HTTPRequest(url, data='a=b')

        modified_req = self.eplugin.modify_request(original_req)
        self.assertEqual(len(modified_req.url_object.querystring), 2)
        self.assertIn('id=1', str(modified_req.url_object.querystring))
        
        data = parse_qs(modified_req.get_data())
        self.assertEqual(len(data), 2)
        self.assertIn('a=b', str(data))

        modified_qs = modified_req.url_object.querystring
        self.assertEqual(len(modified_qs), 2)
Esempio n. 18
0
    def test_add_when_qs_and_postdata(self):
        url = URL('http://www.w3af.com/?id=1')
        original_req = HTTPRequest(url, data='a=b')

        modified_req = self.eplugin.modify_request(original_req)
        self.assertEqual(len(modified_req.url_object.querystring), 2)
        self.assertIn('id=1', str(modified_req.url_object.querystring))

        data = parse_qs(modified_req.get_data())
        self.assertEqual(len(data), 2)
        self.assertIn('a=b', str(data))

        modified_qs = modified_req.url_object.querystring
        self.assertEqual(len(modified_qs), 2)
Esempio n. 19
0
 def test_get_query_string(self):
     self.assertEqual(URL(u'http://w3af.com/a/').querystring,
                      QueryString({}.items()))
     
     self.assertEqual(URL(u'http://w3af.com/foo/bar.txt?id=3').querystring,
                      QueryString({u'id': [u'3']}.items()))
     
     self.assertEqual(URL(u'http://w3af.com/foo/bar.txt?id=3&id=4').querystring,
                      QueryString({u'id': [u'3', u'4']}.items()))
     
     url = URL(u'http://w3af.com/foo/bar.txt?id=3&ff=4&id=5')
     self.assertEqual(url.querystring,
                      QueryString({u'id': [u'3', u'5'], u'ff': [u'4']}.items()))
     
     self.assertEqual(url.querystring, parse_qs(str(url.querystring)))
Esempio n. 20
0
    def from_postdata(cls, headers, post_data):
        if not URLEncodedForm.is_urlencoded(headers):
            raise ValueError('Request is not %s.' % URLEncodedForm.ENCODING)

        if not URLEncodedForm.can_parse(post_data):
            raise ValueError('Failed to parse post_data as Form.')

        parsed_data = parse_qs(post_data)
        urlencoded_form = cls()

        for key, value_list in parsed_data.iteritems():
            for value in value_list:
                form_field = GenericFormField(INPUT_TYPE_TEXT, key, value)
                urlencoded_form.add_form_field(form_field)

        return urlencoded_form
Esempio n. 21
0
    def from_postdata(cls, headers, post_data):
        if not URLEncodedForm.is_urlencoded(headers):
            raise ValueError('Request is not %s.' % URLEncodedForm.ENCODING)

        if not URLEncodedForm.can_parse(post_data):
            raise ValueError('Failed to parse post_data as Form.')

        parsed_data = parse_qs(post_data)
        urlencoded_form = cls()

        for key, value_list in parsed_data.iteritems():
            for value in value_list:
                form_field = GenericFormField(INPUT_TYPE_TEXT, key, value)
                urlencoded_form.add_form_field(form_field)

        return urlencoded_form
Esempio n. 22
0
    def set_options(self, options_list):
        self.name = options_list['name'].get_value()
        self.url = options_list['url'].get_value()
        self.data = parse_qs(options_list['data'].get_value())
        self.method = options_list['method'].get_value()
        self.vulnerable_parameter = options_list['vulnerable_parameter'].get_value()

        if not self.data:
            msg = 'This vulnerability requires data to be configured.'
            raise ValueError(msg)

        if self.vulnerable_parameter not in self.data:
            msg = 'The vulnerable parameter was not found in the configured data'\
                  ' field. Please enter one of the following values: %s.'
            raise ValueError(msg % ', '.join(self.data))

        try:
            self.create_vuln()
            
        except RuntimeError, rte:
            # https://github.com/andresriancho/w3af/issues/4310
            raise ValueError('%s' % rte)
Esempio n. 23
0
 def validate(self, value):
     try:
         return parse_qs(value)
     except Exception:
         msg = 'Invalid query string configured by user.'
         raise BaseFrameworkException(msg)
Esempio n. 24
0
 def test_parse_qs_case01(self):
     self.assertEqual(parse_qs('id=3'),
                      QueryString([(u'id', [u'3'])]))
Esempio n. 25
0
 def test_parse_qs_case06(self):
     expected_parsed_url = QueryString(
         [(u'\u9834\u82f1', [u'\u75ab\u76ca'])], encoding='euc-jp')
     self.assertEqual(
         parse_qs(u'%B1%D0%B1%D1=%B1%D6%B1%D7', encoding='euc-jp'),
         expected_parsed_url)
Esempio n. 26
0
 def test_parse_qs_case05(self):
     self.assertEqual(parse_qs('pname'), QueryString([(u'pname', [u''])]))
Esempio n. 27
0
 def test_parse_qs_case04(self):
     self.assertEqual(parse_qs('id=3&ff=4&id=5'),
                      QueryString([(u'id', [u'3', u'5']), (u'ff', [u'4'])]))
Esempio n. 28
0
 def test_parse_qs_repeated_parameter_names(self):
     self.assertEqual(parse_qs('id=3&id=4'),
                      QueryString([(u'id', [u'3', u'4'])]))
Esempio n. 29
0
 def __init__(self):
     self.name = ''
     self.url = URL('http://host.tld/')
     self.data = parse_qs('')
     self.method = 'GET'
     self.vulnerable_parameter = ''
Esempio n. 30
0
 def test_parse_qs_case01(self):
     self.assertEqual(parse_qs('id=3'), QueryString([(u'id', [u'3'])]))
Esempio n. 31
0
    def test_parse_qs_case03(self):
        qs = QueryString([(u'id', [u'3 1'])])
        parsed_qs = parse_qs('id=3%201')

        self.assertEqual(str(parsed_qs), str(qs))
Esempio n. 32
0
 def test_parse_qs_repeated_parameter_names(self):
     self.assertEqual(parse_qs('id=3&id=4'),
                      QueryString([(u'id', [u'3', u'4'])]))
Esempio n. 33
0
 def test_parse_qs_case04(self):
     self.assertEqual(parse_qs('id=3&ff=4&id=5'),
                      QueryString([(u'id', [u'3', u'5']),
                                   (u'ff', [u'4'])]))
Esempio n. 34
0
 def test_parse_qs_case05(self):
     self.assertEqual(parse_qs('pname'),
                      QueryString([(u'pname', [u''])]))
Esempio n. 35
0
 def test_parse_qs_case06(self):
     expected_parsed_url = QueryString([(u'\u9834\u82f1',
                                         [u'\u75ab\u76ca'])],
                                       encoding='euc-jp')
     self.assertEqual(parse_qs(u'%B1%D0%B1%D1=%B1%D6%B1%D7', encoding='euc-jp'),
                      expected_parsed_url)
Esempio n. 36
0
    def test_parse_qs_case03(self):
        qs = QueryString([(u'id', [u'3 1'])])
        parsed_qs = parse_qs('id=3%201')

        self.assertEqual(str(parsed_qs), str(qs))