Esempio n. 1
0
    def test_add_HTTPQSRequest(self):
        ds = DiskSet()

        uri = URL("http://w3af.org/?id=2")
        hdr = Headers([("Referer", "http://w3af.org/")])

        qsr1 = HTTPQSRequest(uri, method="GET", headers=hdr)

        uri = URL("http://w3af.org/?id=3")
        qsr2 = HTTPQSRequest(uri, method="GET", headers=hdr)

        uri = URL("http://w3af.org/?id=7")
        qsr3 = HTTPQSRequest(uri, method="FOO", headers=hdr)

        ds.add(qsr1)
        ds.add(qsr2)
        ds.add(qsr2)
        ds.add(qsr1)

        self.assertEqual(ds[0], qsr1)
        self.assertEqual(ds[1], qsr2)
        self.assertFalse(qsr3 in ds)
        self.assertTrue(qsr2 in ds)
        self.assertEqual(len(ds), 2)

        # This forces an internal change in the URL object
        qsr2.get_url().url_string
        self.assertTrue(qsr2 in ds)
Esempio n. 2
0
    def test_fuzzable_request(self):
        dl = DiskList()

        uri = URL('http://w3af.org/?id=2')
        qsr1 = HTTPQSRequest(uri,
                             method='GET',
                             headers=Headers([('Referer', 'http://w3af.org/')
                                              ]))

        uri = URL('http://w3af.org/?id=3')
        qsr2 = HTTPQSRequest(uri,
                             method='OPTIONS',
                             headers=Headers([('Referer', 'http://w3af.org/')
                                              ]))

        uri = URL('http://w3af.org/?id=7')
        qsr3 = HTTPQSRequest(uri,
                             method='FOO',
                             headers=Headers([('Referer', 'http://w3af.org/')
                                              ]))

        dl.append(qsr1)
        dl.append(qsr2)

        self.assertEqual(dl[0], qsr1)
        self.assertEqual(dl[1], qsr2)
        self.assertFalse(qsr3 in dl)
        self.assertTrue(qsr2 in dl)
Esempio n. 3
0
    def test_filename_fname_qs(self):
        cf_singleton.save('fuzzable_headers', [])
        cf_singleton.save('fuzz_cookies', False)
        cf_singleton.save('fuzz_url_filenames', True)  # This one changed
        cf_singleton.save('fuzzed_files_extension', 'gif')
        cf_singleton.save('fuzz_form_files', False)
        cf_singleton.save('fuzz_url_parts', False)

        url = URL('http://moth/foo.htm?id=1')
        freq = HTTPQSRequest(url)
        generated_mutants = create_mutants(freq, self.payloads)

        expected_urls = [
            u'http://moth/foo.htm?id=abc',
            u'http://moth/foo.htm?id=def',
            u'http://moth/abc.htm',
            u'http://moth/def.htm',
            u'http://moth/foo.abc',
            u'http://moth/foo.def',
        ]

        generated_urls = [m.get_uri().url_string for m in generated_mutants]

        self.assertEqual(generated_urls, expected_urls)

        self.assertTrue(
            all(
                isinstance(m, QSMutant) or isinstance(m, FileNameMutant)
                for m in generated_mutants))
Esempio n. 4
0
    def test_qs_and_cookie(self):
        cf_singleton.save('fuzzable_headers', [])
        cf_singleton.save('fuzz_cookies', True)  # This one changed
        cf_singleton.save('fuzz_url_filenames', False)
        cf_singleton.save('fuzzed_files_extension', 'gif')
        cf_singleton.save('fuzz_form_files', False)
        cf_singleton.save('fuzz_url_parts', False)

        url = URL('http://moth/?id=1')
        # And now there is a cookie
        cookie = Cookie('foo=bar')
        freq = HTTPQSRequest(url, cookie=cookie)
        generated_mutants = create_mutants(freq, self.payloads)

        expected_urls = [
            u'http://moth/?id=abc', u'http://moth/?id=def',
            u'http://moth/?id=1', u'http://moth/?id=1'
        ]

        generated_urls = [m.get_uri().url_string for m in generated_mutants]

        self.assertEqual(generated_urls, expected_urls)

        expected_cookies = ['foo=bar;', 'foo=bar;', 'foo=abc;', 'foo=def;']

        generated_cookies = [str(m.get_cookie()) for m in generated_mutants]

        self.assertEqual(expected_cookies, generated_cookies)

        self.assertTrue(
            all(
                isinstance(m, QSMutant) or isinstance(m, CookieMutant)
                for m in generated_mutants))
Esempio n. 5
0
    def test_urlparts_filename_path_qs(self):
        cf_singleton.save('fuzzable_headers', [])
        cf_singleton.save('fuzz_cookies', False)
        cf_singleton.save('fuzz_url_filenames', True)  # This one changed
        cf_singleton.save('fuzzed_files_extension', 'gif')
        cf_singleton.save('fuzz_form_files', False)
        cf_singleton.save('fuzz_url_parts', True)  # This one changed

        url = URL('http://moth/foo/bar.htm?id=1')
        freq = HTTPQSRequest(url)
        generated_mutants = create_mutants(freq, self.payloads)

        generated_uris = [m.get_uri().url_string for m in generated_mutants]
        expected_uris = [
            'http://moth/foo/bar.htm?id=abc',
            'http://moth/foo/bar.htm?id=def',
            'http://moth/foo/abc.htm',
            'http://moth/foo/def.htm',
            'http://moth/foo/bar.abc',
            'http://moth/foo/bar.def',
            'http://moth/abc/bar.htm',
            'http://moth/def/bar.htm',
            'http://moth/foo/abc',
            'http://moth/foo/def',
        ]
        self.assertEqual(generated_uris, expected_uris)
Esempio n. 6
0
    def test_mutant_creation_repeated_parameter_names(self):
        self.url = URL('http://moth/?id=1&id=2')
        freq = HTTPQSRequest(self.url)

        created_mutants = QSMutant.create_mutants(freq, self.payloads, [],
                                                  False, self.fuzzer_config)

        expected_dc_lst = [
            DataContainer([('id', ['abc', '2'])]),
            DataContainer([('id', ['def', '2'])]),
            DataContainer([('id', ['1', 'abc'])]),
            DataContainer([('id', ['1', 'def'])])
        ]

        created_dc_lst = [i.get_dc() for i in created_mutants]

        self.assertEqual(created_dc_lst, expected_dc_lst)

        self.assertEqual(created_mutants[0].get_var(), 'id')
        self.assertEqual(created_mutants[0].get_var_index(), 0)
        self.assertEqual(created_mutants[0].get_original_value(), '1')

        self.assertEqual(created_mutants[2].get_var(), 'id')
        self.assertEqual(created_mutants[2].get_var_index(), 1)
        self.assertEqual(created_mutants[2].get_original_value(), '2')

        self.assertTrue(all(isinstance(m, QSMutant) for m in created_mutants))
Esempio n. 7
0
    def test_mutant_creation(self):
        url = URL('http://moth/?a=1&b=2')
        headers = Headers([('Referer', 'http://moth/')])
        freq = HTTPQSRequest(url, headers=headers)

        created_mutants = HeadersMutant.create_mutants(freq, self.payloads, [],
                                                       False,
                                                       self.fuzzer_config)

        expected_dc_lst = [
            Headers([('Referer', 'abc')]),
            Headers([('Referer', 'def')])
        ]

        created_dc_lst = [i.get_dc() for i in created_mutants]

        self.assertEqual(created_dc_lst, expected_dc_lst)

        self.assertEqual(created_mutants[0].get_var(), 'Referer')
        self.assertEqual(created_mutants[0].get_var_index(), 0)
        self.assertEqual(created_mutants[0].get_original_value(), '')
        self.assertEqual(created_mutants[1].get_var(), 'Referer')
        self.assertEqual(created_mutants[1].get_var_index(), 0)
        self.assertEqual(created_mutants[1].get_original_value(), '')

        self.assertTrue(
            all(isinstance(m, HeadersMutant) for m in created_mutants))
Esempio n. 8
0
    def test_valid_results_double_encoding(self):
        """
        In this case the number of generated mutants is higher due to the
        encoded and double encoded versions which are returned. In the previous
        case, and given that both the encoded and double encoded versions were
        the same, the number of generated mutants was 4.
        """
        payloads = [
            'ls - la', 'ping 127.0.0.1 -c 5', 'http://127.0.0.1:8015/test/'
        ]
        freq = HTTPQSRequest(URL('http://www.w3af.com/foo/bar'))

        generated_mutants = URLPartsMutant.create_mutants(
            freq, payloads, [], False, self.fuzzer_config)

        expected_urls = [
            'http://www.w3af.com/ls+-+la/bar',
            'http://www.w3af.com/ls%2B-%2Bla/bar',
            'http://www.w3af.com/ping+127.0.0.1+-c+5/bar',
            'http://www.w3af.com/ping%2B127.0.0.1%2B-c%2B5/bar',
            'http://www.w3af.com/foo/ls+-+la',
            'http://www.w3af.com/foo/ls%2B-%2Bla',
            'http://www.w3af.com/foo/ping+127.0.0.1+-c+5',
            'http://www.w3af.com/foo/ping%2B127.0.0.1%2B-c%2B5',
            'http://www.w3af.com/http%3A%2F%2F127.0.0.1%3A8015%2Ftest%2F/bar',
            'http://www.w3af.com/http%253A%252F%252F127.0.0.1%253A8015%252Ftest%252F/bar',
            'http://www.w3af.com/foo/http%3A%2F%2F127.0.0.1%3A8015%2Ftest%2F',
            'http://www.w3af.com/foo/http%253A%252F%252F127.0.0.1%253A8015%252Ftest%252F'
        ]

        generated_urls = set(
            [m.get_url().url_string for m in generated_mutants])

        self.assertEqual(set(expected_urls), generated_urls)
Esempio n. 9
0
    def test_no_cookie(self):
        freq = HTTPQSRequest(self.url)

        generated_mutants = CookieMutant.create_mutants(
            freq, self.payloads, [], False, self.fuzzer_config)

        self.assertEqual(len(generated_mutants), 0, generated_mutants)
Esempio n. 10
0
    def test_config_false(self):
        fuzzer_config = {'fuzz_cookies': False}
        freq = HTTPQSRequest(URL('http://www.w3af.com/foo/bar'))

        generated_mutants = CookieMutant.create_mutants(
            freq, self.payloads, [], False, fuzzer_config)

        self.assertEqual(len(generated_mutants), 0, generated_mutants)
Esempio n. 11
0
    def test_config_true(self):
        fuzzer_config = {'fuzz_url_parts': True}
        freq = HTTPQSRequest(URL('http://www.w3af.com/foo/bar'))

        generated_mutants = URLPartsMutant.create_mutants(
            freq, self.payloads, [], False, fuzzer_config)

        self.assertNotEqual(len(generated_mutants), 0, generated_mutants)
Esempio n. 12
0
    def test_config_true(self):
        fuzzer_config = {'fuzz_cookies': True}

        cookie = Cookie('foo=bar; spam=eggs')
        freq = HTTPQSRequest(self.url, cookie=cookie)

        generated_mutants = CookieMutant.create_mutants(
            freq, self.payloads, [], False, fuzzer_config)

        self.assertNotEqual(len(generated_mutants), 0, generated_mutants)
Esempio n. 13
0
    def test_add_HTTPQSRequest(self):
        ds = DiskSet()

        uri = URL('http://w3af.org/?id=2')
        hdr = Headers([('Referer', 'http://w3af.org/')])

        qsr1 = HTTPQSRequest(uri, method='GET', headers=hdr)

        uri = URL('http://w3af.org/?id=3')
        qsr2 = HTTPQSRequest(uri, method='GET', headers=hdr)

        uri = URL('http://w3af.org/?id=7')
        qsr3 = HTTPQSRequest(uri, method='FOO', headers=hdr)

        ds.add(qsr1)
        ds.add(qsr2)
        ds.add(qsr2)
        ds.add(qsr1)

        self.assertEqual(ds[0], qsr1)
        self.assertEqual(ds[1], qsr2)
        self.assertFalse(qsr3 in ds)
        self.assertTrue(qsr2 in ds)
        self.assertEqual(len(ds), 2)

        # This forces an internal change in the URL object
        qsr2.get_url().url_string
        self.assertTrue(qsr2 in ds)
Esempio n. 14
0
    def test_urlparts_no_path(self):
        cf_singleton.save('fuzzable_headers', [])
        cf_singleton.save('fuzz_cookies', False)
        cf_singleton.save('fuzz_url_filenames', False)
        cf_singleton.save('fuzzed_files_extension', 'gif')
        cf_singleton.save('fuzz_form_files', False)
        cf_singleton.save('fuzz_url_parts', True)  # This one changed

        url = URL('http://moth/')
        freq = HTTPQSRequest(url)
        generated_mutants = create_mutants(freq, self.payloads)

        self.assertEqual(generated_mutants, [])
Esempio n. 15
0
    def test_qs_and_no_cookie(self):
        cf_singleton.save('fuzzable_headers', [])
        cf_singleton.save('fuzz_cookies', True)  # This one changed
        cf_singleton.save('fuzz_url_filenames', False)
        cf_singleton.save('fuzzed_files_extension', 'gif')
        cf_singleton.save('fuzz_form_files', False)
        cf_singleton.save('fuzz_url_parts', False)

        url = URL('http://moth/?id=1')
        # But there is no cookie
        freq = HTTPQSRequest(url)
        generated_mutants = create_mutants(freq, self.payloads)

        expected_urls = ['http://moth/?id=abc', 'http://moth/?id=def']
        generated_urls = [m.get_uri().url_string for m in generated_mutants]

        self.assertEqual(generated_urls, expected_urls)
Esempio n. 16
0
    def test_valid_results(self):
        freq = HTTPQSRequest(URL('http://www.w3af.com/foo/bar.htm'))

        generated_mutants = FileNameMutant.create_mutants(freq, self.payloads,
                                                          [], False,
                                                          self.fuzzer_config)

        self.assertEqual(len(generated_mutants), 4, generated_mutants)

        expected_urls = [URL('http://www.w3af.com/foo/abc.htm'),
                         URL('http://www.w3af.com/foo/def.htm'),
                         URL('http://www.w3af.com/foo/bar.abc'),
                         URL('http://www.w3af.com/foo/bar.def')]

        generated_urls = [m.get_url() for m in generated_mutants]

        self.assertEqual(expected_urls, generated_urls)
Esempio n. 17
0
    def test_audit_return_vulns(self):
        plugin_inst = self.w3af.plugins.get_plugin_inst('audit', 'sqli')

        target_url = get_moth_http(
            '/audit/sql_injection/where_string_single_qs.py')
        uri = URL(target_url + '?uname=pablo')
        freq = HTTPQSRequest(uri)

        vulns = plugin_inst.audit_return_vulns(freq)

        self.assertEqual(len(vulns), 1, vulns)

        vuln = vulns[0]
        self.assertEquals("syntax error", vuln['error'])
        self.assertEquals("Unknown database", vuln['db'])
        self.assertEquals(target_url, str(vuln.get_url()))

        self.assertEqual(plugin_inst._store_kb_vulns, False)
Esempio n. 18
0
    def test_simple(self):
        cf_singleton.save('fuzzable_headers', [])
        cf_singleton.save('fuzz_cookies', False)
        cf_singleton.save('fuzz_url_filenames', False)
        cf_singleton.save('fuzzed_files_extension', 'gif')
        cf_singleton.save('fuzz_form_files', False)
        cf_singleton.save('fuzz_url_parts', False)

        url = URL('http://moth/?id=1')
        freq = HTTPQSRequest(url)
        generated_mutants = create_mutants(freq, self.payloads)

        expected_urls = ['http://moth/?id=abc', 'http://moth/?id=def']
        generated_urls = [m.get_uri().url_string for m in generated_mutants]

        self.assertEqual(generated_urls, expected_urls)
        self.assertTrue(all(
            isinstance(m, QSMutant) for m in generated_mutants))
Esempio n. 19
0
    def test_valid_results(self):
        cookie = Cookie('foo=bar; spam=eggs')
        freq = HTTPQSRequest(self.url, cookie=cookie)

        generated_mutants = CookieMutant.create_mutants(
            freq, self.payloads, [], False, self.fuzzer_config)

        self.assertEqual(len(generated_mutants), 4, generated_mutants)

        expected_cookies = [
            'foo=abc; spam=eggs;', 'foo=def; spam=eggs;', 'foo=bar; spam=abc;',
            'foo=bar; spam=def;'
        ]

        generated_cookies = [str(m.get_cookie()) for m in generated_mutants]
        self.assertEqual(expected_cookies, generated_cookies)

        generated_cookies = [str(m.get_dc()) for m in generated_mutants]
        self.assertEqual(expected_cookies, generated_cookies)
Esempio n. 20
0
    def test_fuzz_headers_no_headers(self):
        cf_singleton.save('fuzzable_headers', ['Referer'])  # This one changed
        cf_singleton.save('fuzz_cookies', False)
        cf_singleton.save('fuzz_url_filenames', False)
        cf_singleton.save('fuzzed_files_extension', 'gif')
        cf_singleton.save('fuzz_form_files', False)
        cf_singleton.save('fuzz_url_parts', False)

        url = URL('http://moth/?id=1')
        # No headers in the original request
        #headers = Headers([('Referer', 'http://moth/foo/bar/')])
        freq = HTTPQSRequest(url)
        generated_mutants = create_mutants(freq, self.payloads)

        expected_urls = [
            'http://moth/?id=abc',
            'http://moth/?id=def',
            'http://moth/?id=1',
            'http://moth/?id=1',
        ]
        generated_urls = [m.get_uri().url_string for m in generated_mutants]

        self.assertEqual(generated_urls, expected_urls)

        expected_headers = [
            Headers(),
            Headers(),
            Headers([('Referer', 'abc')]),
            Headers([('Referer', 'def')]),
        ]

        generated_headers = [m.get_headers() for m in generated_mutants]

        self.assertEqual(expected_headers, generated_headers)

        self.assertTrue(
            all(
                isinstance(m, QSMutant) or isinstance(m, HeadersMutant)
                for m in generated_mutants))
Esempio n. 21
0
    def test_basics(self):
        cookie = Cookie('foo=bar; spam=eggs')
        freq = HTTPQSRequest(self.url, cookie=cookie)

        m = CookieMutant(freq)
        m.set_var('foo', 0)
        m.set_mod_value('abc')

        self.assertEqual(m.get_url().url_string, 'http://moth/')
        self.assertEqual(str(m.get_cookie()), 'foo=abc; spam=eggs;')

        expected_mod_value = 'The cookie data that was sent is: "foo=abc;'\
                             ' spam=eggs;".'
        generated_mod_value = m.print_mod_value()

        self.assertEqual(generated_mod_value, expected_mod_value)

        expected_found_at = '"http://moth/", using HTTP method GET. The modified'\
                            ' parameter was the session cookie with value: '\
                            '"foo=abc; spam=eggs;".'
        generated_found_at = m.found_at()

        self.assertEqual(generated_found_at, expected_found_at)
Esempio n. 22
0
    def test_basics(self):
        divided_path = DataContainer()
        divided_path['start'] = ''
        divided_path['modified_part'] = 'ping!'
        divided_path['end'] = '.htm'

        freq = HTTPQSRequest(URL('http://www.w3af.com/foo/bar.htm'))
        m = FileNameMutant(freq)
        m.set_mutant_dc(divided_path)
        m.set_var('modified_part')
        self.assertEqual(m.get_url().url_string,
                         u'http://www.w3af.com/foo/ping%21.htm')

        expected_mod_value = 'The sent url filename is: "ping!.htm".'
        generated_mod_value = m.print_mod_value()

        self.assertEqual(generated_mod_value, expected_mod_value)

        expected_found_at = '"http://www.w3af.com/foo/ping%21.htm", using HTTP'\
                            ' method GET. The modified parameter was the URL'\
                            ' filename, with value: "ping!".'
        generated_found_at = m.found_at()

        self.assertEqual(generated_found_at, expected_found_at)
Esempio n. 23
0
    def test_valid_results_double_encoding(self):
        """
        In this case the number of generated mutants is higher due to the
        encoded and double encoded versions which are returned. In the previous
        case, and given that both the encoded and double encoded versions were
        the same, the number of generated mutants was 4.
        """
        payloads = ['ls - la', 'http://127.0.0.1:8015/test/']
        freq = HTTPQSRequest(URL('http://www.w3af.com/bar.htm'))

        generated_mutants = FileNameMutant.create_mutants(freq, payloads, [],
                                                          False,
                                                          self.fuzzer_config)

        expected_urls = ['http://www.w3af.com/ls+-+la.htm',
                         'http://www.w3af.com/bar.ls+-+la',
                         'http://www.w3af.com/http%3A%2F%2F127.0.0.1%3A8015%2Ftest%2F.htm',
                         'http://www.w3af.com/http%3A//127.0.0.1%3A8015/test/.htm',
                         'http://www.w3af.com/bar.http%3A%2F%2F127.0.0.1%3A8015%2Ftest%2F',
                         'http://www.w3af.com/bar.http%3A//127.0.0.1%3A8015/test/']

        generated_urls = [m.get_url().url_string for m in generated_mutants]

        self.assertEqual(set(expected_urls), set(generated_urls))
Esempio n. 24
0
    def test_basics(self):
        divided_path = DataContainer()
        divided_path['start'] = '/'
        divided_path['modified_part'] = 'ping!'
        divided_path['end'] = '/bar'

        freq = HTTPQSRequest(URL('http://www.w3af.com/foo/bar'))
        m = URLPartsMutant(freq)
        m.set_mutant_dc(divided_path)
        m.set_var('modified_part')
        self.assertEqual(m.get_url().url_string,
                         u'http://www.w3af.com/ping%21/bar')

        expected_mod_value = 'The sent urlparts is: "/ping!/bar".'
        generated_mod_value = m.print_mod_value()

        self.assertEqual(generated_mod_value, expected_mod_value)

        expected_found_at = '"http://www.w3af.com/ping%21/bar", using HTTP method'\
                            ' GET. The modified parameter was the URL path, with'\
                            ' value: "ping!".'
        generated_found_at = m.found_at()

        self.assertEqual(generated_found_at, expected_found_at)
Esempio n. 25
0
def create_fuzzable_requests(resp, request=None, add_self=True):
    """
    Generates the fuzzable requests based on an HTTP response instance.

    :param resp: An HTTPResponse instance.
    :param request: The HTTP request that generated the resp
    :param add_self: If I should add the current HTTP request
                         (:param request) to the result on not.

    :return: A list of fuzzable requests.
    """
    res = []

    # Headers for all fuzzable requests created here:
    # And add the fuzzable headers to the dict
    req_headers = dict((h, '') for h in cf.cf.get('fuzzable_headers'))
    req_headers.update(request and request.get_headers() or {})
    req_headers = Headers(req_headers.items())

    # Get the cookie!
    cookieObj = _create_cookie(resp)

    # Create the fuzzable request that represents the request object
    # passed as parameter
    if add_self:
        qsr = HTTPQSRequest(resp.get_uri(),
                            headers=req_headers,
                            cookie=cookieObj)
        res.append(qsr)

    # If response was a 30X (i.e. a redirect) then include the
    # corresponding fuzzable request.
    resp_headers = resp.get_headers()

    for url_header_name in URL_HEADERS:
        url_header_value, _ = resp_headers.iget(url_header_name, '')
        if url_header_value:
            url = smart_unicode(url_header_value, encoding=resp.charset)
            try:
                absolute_location = resp.get_url().url_join(url)
            except ValueError:
                msg = 'The application sent a "%s" redirect that w3af' \
                      ' failed to correctly parse as an URL, the header' \
                      ' value was: "%s"'
                om.out.debug(msg % (url_header_name, url))
            else:
                qsr = HTTPQSRequest(absolute_location,
                                    headers=req_headers,
                                    cookie=cookieObj)
                res.append(qsr)

    # Try to find forms in the document
    try:
        dp = parser_cache.dpc.get_document_parser_for(resp)
    except BaseFrameworkException:
        # Failed to find a suitable parser for the document
        form_list = []
    else:
        form_list = dp.get_forms()
        same_domain = lambda f: f.get_action().get_domain() == \
                                resp.get_url().get_domain()
        form_list = [f for f in form_list if same_domain(f)]

    if not form_list:
        # Check if its a wsdl file
        #TODO: Rewrite web service support
        """
        wsdlp = WSDLParser()
        try:
            wsdlp.set_wsdl(resp.get_body())
        except BaseFrameworkException:
            pass
        else:
            for rem_meth in wsdlp.get_methods():
                wspdr = WebServiceRequest(
                    rem_meth.get_location(),
                    rem_meth.get_action(),
                    rem_meth.get_parameters(),
                    rem_meth.get_namespace(),
                    rem_meth.get_methodName(),
                    req_headers
                )
                res.append(wspdr)
        """
    else:
        # Create one HTTPPostDataRequest for each form variant
        mode = cf.cf.get('form_fuzzing_mode')
        for form in form_list:
            for variant in form.get_variants(mode):
                if form.get_method().upper() == 'POST':
                    r = HTTPPostDataRequest(variant.get_action(),
                                            variant.get_method(), req_headers,
                                            cookieObj, variant)
                else:
                    # The default is a GET request
                    r = HTTPQSRequest(variant.get_action(),
                                      headers=req_headers,
                                      cookie=cookieObj)
                    r.set_dc(variant)

                res.append(r)
    return res
Esempio n. 26
0
def create_fuzzable_request_from_parts(url,
                                       method='GET',
                                       post_data='',
                                       add_headers=None):
    """
    Creates a fuzzable request based on the input parameters.

    :param req_url: A URL object
    :param method: A string that represents the method ('GET', 'POST', etc)
    :param post_data: A string that represents the postdata.
    :param add_headers: A Headers object that holds the headers. If `req_url` is a
                        request then this dict will be merged with the request's
                        headers.
    """
    if add_headers is not None and not isinstance(add_headers, Headers):
        raise ValueError('create_fuzzable_request requires Headers object.')

    if not isinstance(url, URL):
        raise TypeError('Requires URL to create FuzzableRequest.')

    headers = add_headers or Headers()

    # Just a query string request! No postdata
    if not post_data:
        return HTTPQSRequest(url, method, headers)

    else:
        # Seems to be something that has post data
        data = {}
        conttype, header_name = headers.iget('content-type', '')
        if conttype:
            del headers[header_name]

        contlen, header_name = headers.iget('content-length', '')
        if contlen:
            del headers[header_name]

        #
        # Case #1 - multipart form data - prepare data container
        #
        if conttype.startswith('multipart/form-data'):
            pdict = cgi.parse_header(conttype)[1]
            try:
                dc = cgi.parse_multipart(StringIO(post_data), pdict)
            except Exception, e:
                msg = 'Multipart form data is invalid, exception: "%s".' \
                      ' Returning our best match HTTPPostDataRequest.'
                om.out.debug(msg % e)

                empty_data = QueryString()
                return HTTPPostDataRequest(url, method, headers, dc=empty_data)
            else:
                data = QueryString()
                data.update(dc)

                # Please note that the QueryString is just a container for the
                # information. When the HTTPPostDataRequest is sent it should
                # be serialized into multipart again by the MultipartPostHandler
                # because the headers contain the multipart/form-data header
                headers['content-type'] = conttype

                return HTTPPostDataRequest(url, method, headers, dc=data)

        #
        # Case #2 - JSON request
        #
        try:
            data = json.loads(post_data)
        except:
            pass
        else:
            if data:
                return JSONPostDataRequest(url, method, headers, dc=data)

        #
        # Case #3 - XMLRPC request
        #
        if all(map(lambda stop: stop in post_data.lower(), XMLRPC_WORDS)):
            return XMLRPCRequest(post_data, url, method, headers)

        #
        # Case #4 - a typical post request
        #
        try:
            data = parse_qs(post_data)
        except:
            om.out.debug('Failed to create a data container that '
                         'can store this data: "' + post_data + '".')
        else:
            # Finally create request
            return HTTPPostDataRequest(url, method, headers, dc=data)

        return None