Skip to content

Commit 1843b90

Browse files
m10xm10x
committed
improved responsesplitting feedback
1 parent 3aa9823 commit 1843b90

File tree

2 files changed

+37
-47
lines changed

2 files changed

+37
-47
lines changed

‎pkg/requests.go‎

Lines changed: 9 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -49,16 +49,7 @@ func getRespSplit() string {
4949
return "\\r\\n" + respSplitHeader + ": " + respSplitValue
5050
}
5151

52-
func checkPoisoningIndicators(repResult *reportResult, request reportRequest, success string, body string, poison string, statusCode1 int, statusCode2 int, sameBodyLength bool, header http.Header, recursive bool) bool {
53-
testForResponseSplitting := false
54-
// forwardheader benutzen keinen mutex. deswegen macht das if hier keinen Sinn
55-
/*if m == nil {
56-
result.HasError = true
57-
msg := fmt.Sprintf("%s: checkPoisoningIndicators: mutex is nil", request.URL)
58-
Print(msg, Red)
59-
result.ErrorMessages = append(result.ErrorMessages, msg)
60-
return testForResponseSplitting
61-
}*/
52+
func checkPoisoningIndicators(repResult *reportResult, request reportRequest, success string, body string, poison string, statusCode1 int, statusCode2 int, sameBodyLength bool, header http.Header, recursive bool) string {
6253
headerWithPoison := ""
6354
if header != nil && poison != "" {
6455
for x := range header {
@@ -76,7 +67,6 @@ func checkPoisoningIndicators(repResult *reportResult, request reportRequest, su
7667
request.Reason = "Response Body contained " + poison
7768
} else if headerWithPoison != "" {
7869
request.Reason = fmt.Sprintf("%s header contains poison value %s", headerWithPoison, poison)
79-
testForResponseSplitting = true
8070
} else if statusCode1 >= 0 && statusCode1 != Config.Website.StatusCode && statusCode1 == statusCode2 {
8171
// check if status code should be ignored
8272
if len(Config.IgnoreStatus) > 0 {
@@ -87,7 +77,7 @@ func checkPoisoningIndicators(repResult *reportResult, request reportRequest, su
8777
if err != nil {
8878
Print(fmt.Sprintln("Error while checking whether the default status code changed: ", err.Error()), Yellow)
8979
}
90-
return testForResponseSplitting
80+
return headerWithPoison
9181
}
9282
}
9383
}
@@ -141,7 +131,7 @@ func checkPoisoningIndicators(repResult *reportResult, request reportRequest, su
141131
request.Reason = fmt.Sprintf("Length %d differed more than %d bytes from normal length %d", len(body), Config.CLDiff, len(Config.Website.Body))
142132
}
143133
} else {
144-
return testForResponseSplitting
134+
return headerWithPoison
145135
}
146136
}
147137

@@ -155,7 +145,7 @@ func checkPoisoningIndicators(repResult *reportResult, request reportRequest, su
155145
Print(msg, Green)
156146
repResult.Vulnerable = true
157147
repResult.Requests = append(repResult.Requests, request)
158-
return testForResponseSplitting
148+
return headerWithPoison
159149
}
160150

161151
func compareLengths(len1 int, len2 int, limit int) bool {
@@ -377,7 +367,7 @@ func secondRequest(rUrl string, identifier string, cb string) ([]byte, int, http
377367

378368
// TODO: ResponseSplitting Methode
379369
/* return value:first bool is needed for responsesplitting, second bool is only needed for ScanParameters */
380-
func issueRequest(rp requestParams) (bool, bool) {
370+
func issueRequest(rp requestParams) (string, bool) {
381371
body1, statusCode1, request, header1, err := firstRequest(rp)
382372
if err != nil {
383373
if err.Error() != "stop" {
@@ -389,7 +379,7 @@ func issueRequest(rp requestParams) (bool, bool) {
389379
rp.repResult.ErrorMessages = append(rp.repResult.ErrorMessages, err.Error())
390380
}
391381

392-
return false, false
382+
return "", false
393383
}
394384

395385
firstRequestPoisoningIndicator(rp.identifier, body1, rp.poison, header1)
@@ -404,7 +394,7 @@ func issueRequest(rp requestParams) (bool, bool) {
404394
rp.repResult.HasError = true
405395
rp.repResult.ErrorMessages = append(rp.repResult.ErrorMessages, err.Error())
406396
}
407-
return false, true
397+
return "", true
408398
}
409399
sameBodyLength := len(body1) == len(body2)
410400

@@ -414,9 +404,9 @@ func issueRequest(rp requestParams) (bool, bool) {
414404
rp.m.Lock()
415405
defer rp.m.Unlock()
416406
}
417-
responseSplitting := checkPoisoningIndicators(rp.repResult, request, rp.success, string(body2), rp.poison, statusCode1, statusCode2, sameBodyLength, respHeader, false)
407+
responseSplittingHeader := checkPoisoningIndicators(rp.repResult, request, rp.success, string(body2), rp.poison, statusCode1, statusCode2, sameBodyLength, respHeader, false)
418408

419-
return responseSplitting, true
409+
return responseSplittingHeader, true
420410
}
421411

422412
func firstRequestPoisoningIndicator(identifier string, body []byte, poison string, header http.Header) {

‎pkg/techniques.go‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -52,17 +52,17 @@ func ScanCookies() reportResult {
5252
m: nil,
5353
newCookie: newCookie,
5454
}
55-
responseSplitting, _ := issueRequest(rp)
55+
responseSplittingHeader, _ := issueRequest(rp)
5656

5757
// check for response splitting, if poison was reflected in a header
58-
if responseSplitting {
59-
msg := fmt.Sprintf("Checking cookie %s for Response Splitting, because it was reflected in the response' header\n", c.Name)
58+
if responseSplittingHeader != "" {
59+
msg := fmt.Sprintf("Checking cookie %s for Response Splitting, because it was reflected in the header %s\n", c.Name, responseSplittingHeader)
6060
PrintVerbose(msg, Cyan, 1)
6161

6262
rp.poison += getRespSplit()
6363
rp.url = rUrl
6464
rp.cb = randInt()
65-
rp.success = fmt.Sprintf("Cookie %s was successfully poisoned with Response Splitting! cb: %s poison: %s\n", c.Name, rp.cb, rp.poison)
65+
rp.success = fmt.Sprintf("Cookie %s successfully poisoned the header %s with Response Splitting! cb: %s poison: %s\n", c.Name, responseSplittingHeader, rp.cb, rp.poison)
6666
rp.identifier += " response splitting"
6767

6868
msg = fmt.Sprintf("Overwriting %s=%s with %s=%s\n", c.Name, c.Value, c.Name, rp.poison)
@@ -142,18 +142,18 @@ func ForwardHeadersTemplate(repResult *reportResult, headers []string, values []
142142
m: nil,
143143
newCookie: http.Cookie{},
144144
}
145-
responseSplitting, _ := issueRequest(rp)
145+
responseSplittingHeader, _ := issueRequest(rp)
146146

147147
// check for response splitting, if poison was reflected in a header
148-
if responseSplitting {
148+
if responseSplittingHeader != "" {
149149
rp.values[0] += getRespSplit()
150-
msg := fmt.Sprintf("Checking header(s) %s with value(s) %s for Response Splitting, because it was reflected in the response' header\n", rp.headers, rp.values)
150+
msg := fmt.Sprintf("Checking header(s) %s with value(s) %s for Response Splitting, because it was reflected in the header %s\n", rp.headers, rp.values, responseSplittingHeader)
151151
PrintVerbose(msg, Cyan, 1)
152152

153153
rp.poison += getRespSplit()
154154
rp.url = rUrl
155155
rp.cb = randInt()
156-
rp.success = fmt.Sprintf("%s was successfully poisoned with Response Splitting! cb: %s poison: %s\n", headers, rp.cb, rp.values)
156+
rp.success = fmt.Sprintf("%s successfully poisoned the header %s with Response Splitting! cb: %s poison: %s\n", headers, responseSplittingHeader, rp.cb, rp.values)
157157
rp.identifier += " response splitting"
158158

159159
issueRequest(rp)
@@ -252,17 +252,17 @@ func ScanHeaders(headerList []string) reportResult {
252252
m: &m,
253253
newCookie: http.Cookie{},
254254
}
255-
responseSplitting, _ := issueRequest(rp)
255+
responseSplittingHeader, _ := issueRequest(rp)
256256

257257
// check for response splitting, if poison was reflected in a header
258-
if responseSplitting {
259-
msg := fmt.Sprintf("Testing now (%d/%d) %s for Response Splitting, because it was reflected in the response' header\n", i+1, len(headerList), header)
258+
if responseSplittingHeader != "" {
259+
msg := fmt.Sprintf("Testing now (%d/%d) %s for Response Splitting, because it was reflected in the header %s\n", i+1, len(headerList), header, responseSplittingHeader)
260260
PrintVerbose(msg, Cyan, 1)
261261

262262
rp.url = rUrl
263263
rp.cb = randInt()
264264
rp.poison += getRespSplit()
265-
rp.success = fmt.Sprintf("Header %s was successfully poisoned with Response Splitting! cb: %s poison: %s\n", header, rp.cb, rp.poison)
265+
rp.success = fmt.Sprintf("Header %s successfully poisoned the header %s with Response Splitting! cb: %s poison: %s\n", header, responseSplittingHeader, rp.cb, rp.poison)
266266
rp.identifier += " response splitting"
267267

268268
issueRequest(rp)
@@ -468,21 +468,21 @@ func ScanParameters(parameterList []string) reportResult {
468468
newCookie: http.Cookie{},
469469
m: &m,
470470
}
471-
responseSplitting, appendParameter := issueRequest(rp)
471+
responseSplittingHeader, appendParameter := issueRequest(rp)
472472

473473
if appendParameter {
474474
impactfulQueries = append(impactfulQueries, parameter)
475475
}
476476
// check for response splitting, if poison was reflected in a header
477-
if responseSplitting {
478-
msg := fmt.Sprintf("Testing now Parameter (%d/%d) %s for Response Splitting, because it was reflected in the response' header\n", i+1, len(parameterList), parameter)
477+
if responseSplittingHeader != "" {
478+
msg := fmt.Sprintf("Testing now Parameter (%d/%d) %s for Response Splitting, because it was reflected in the header %s\n", i+1, len(parameterList), parameter, responseSplittingHeader)
479479
PrintVerbose(msg, Cyan, 1)
480480

481481
rp.poison += getRespSplit()
482482
rp.parameters = []string{parameter + "=" + rp.poison}
483483
rp.url = rUrl
484484
rp.cb = randInt()
485-
rp.success = fmt.Sprintf("Query Parameter %s was successfully poisoned with Response Splitting! cb: %s poison: %s\n", parameter, rp.cb, rp.poison)
485+
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s with Response Splitting! cb: %s poison: %s\n", parameter, responseSplittingHeader, rp.cb, rp.poison)
486486
rp.identifier += " response splitting"
487487
issueRequest(rp)
488488
}
@@ -570,19 +570,19 @@ func ScanFatGET() reportResult {
570570
m: &m,
571571
newCookie: http.Cookie{},
572572
}
573-
responseSplitting, _ := issueRequest(rp)
573+
responseSplittingHeader, _ := issueRequest(rp)
574574

575575
// check for response splitting, if poison was reflected in a header
576-
if responseSplitting {
577-
msg := fmt.Sprintf("Testing now (%d/%d) %s for Response Splitting, because it was reflected in the response' header\n", i+1, len(impactfulQueries), s)
576+
if responseSplittingHeader != "" {
577+
msg := fmt.Sprintf("Testing now (%d/%d) %s for Response Splitting, because it was reflected in the header %s\n", i+1, len(impactfulQueries), s, responseSplittingHeader)
578578
PrintVerbose(msg, Cyan, 1)
579579

580580
rp.url = rUrl
581581
rp.cb = randInt()
582582
rp.poison += getRespSplit()
583583
rp.bodyString += getRespSplit()
584584
rp.identifier += " response splitting"
585-
rp.success = fmt.Sprintf("Query Parameter %s was successfully poisoned via %s with Response Splitting! cb: %s poison:%s\n", s, identifier, rp.cb, rp.poison)
585+
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s via %s with Response Splitting! cb: %s poison:%s\n", s, responseSplittingHeader, identifier, rp.cb, rp.poison)
586586

587587
issueRequest(rp)
588588
}
@@ -742,18 +742,18 @@ func ScanParameterCloaking() reportResult {
742742
m: &m,
743743
newCookie: http.Cookie{},
744744
}
745-
responseSplitting, _ := issueRequest(rp)
745+
responseSplittingHeader, _ := issueRequest(rp)
746746

747747
// check for response splitting, if poison was reflected in a header
748-
if responseSplitting {
749-
msg := fmt.Sprintf("Testing now Parameter Cloaking (%d/%d) %s%s%s for Response Splitting, because it was reflected in the response' header\n", iu+is+1, len(impactfulQueries)*len(unkeyed_parameter), u, cloak, s)
748+
if responseSplittingHeader != "" {
749+
msg := fmt.Sprintf("Testing now Parameter Cloaking (%d/%d) %s%s%s for Response Splitting, because it was reflected in the header %s\n", iu+is+1, len(impactfulQueries)*len(unkeyed_parameter), u, cloak, s, responseSplittingHeader)
750750
PrintVerbose(msg, Cyan, 1)
751751

752752
rp.url = rUrl
753753
rp.cb = randInt()
754754
rp.poison += getRespSplit()
755755
rp.parameters = []string{u + "=foobar" + cloak + s + "=" + rp.poison}
756-
rp.success = fmt.Sprintf("Query Parameter %s was successfully poisoned via Response Splitting using %s with Parameter Cloaking! cb:%s poison:%s\n", s, u, rp.cb, rp.poison)
756+
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s with Response Splitting using %s with Parameter Cloaking! cb:%s poison:%s\n", s, responseSplittingHeader, u, rp.cb, rp.poison)
757757
rp.identifier += " response splitting"
758758

759759
issueRequest(rp)
@@ -950,17 +950,17 @@ func headerDOSTemplate(repResult *reportResult, values []string, header string,
950950
m: &m,
951951
newCookie: http.Cookie{},
952952
}
953-
responseSplitting, _ := issueRequest(rp)
953+
responseSplittingHeader, _ := issueRequest(rp)
954954

955955
// check for response splitting, if poison was reflected in a header
956-
if responseSplitting {
957-
msg := fmt.Sprintf("Testing now %s Header DOS with %s\n for Response Splitting, because it was reflected in the response' header", header, value)
956+
if responseSplittingHeader != "" {
957+
msg := fmt.Sprintf("Testing now %s Header DOS with %s\n for Response Splitting, because it was reflected in the header %s", header, value, responseSplittingHeader)
958958
PrintVerbose(msg, Cyan, 1)
959959

960960
rp.values[0] += getRespSplit()
961961
rp.url = rUrl
962962
rp.cb = randInt()
963-
rp.success = fmt.Sprintf("%sDOS with header %s was successfully poisoned with Response Splitting! cb: %s poison: %s\n", msgextra, header, rp.cb, rp.values[0])
963+
rp.success = fmt.Sprintf("%sDOS with header %s successfully poisoned the header %s with Response Splitting! cb: %s poison: %s\n", msgextra, header, responseSplittingHeader, rp.cb, rp.values[0])
964964
rp.identifier += getRespSplit() + " with response splitting"
965965

966966
issueRequest(rp)

0 commit comments

Comments
 (0)