Skip to content

Commit 2dc9253

Browse files
preetkaran20preetkaran20
authored
Merge pull request #13 from Keenal/renameJWTActiveScanner
change JWTActiveScanner to JWTActiveScanRule
2 parents a490e87 + a5a2646 commit 2dc9253

File tree

9 files changed

+30
-30
lines changed

9 files changed

+30
-30
lines changed

src/main/java/org/zaproxy/zap/extension/jwt/JWTActiveScanner.java renamed to src/main/java/org/zaproxy/zap/extension/jwt/JWTActiveScanRule.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,17 +46,17 @@
4646
* @author KSASAN [email protected]
4747
* @since TODO add version
4848
*/
49-
public class JWTActiveScanner extends AbstractAppParamPlugin {
49+
public class JWTActiveScanRule extends AbstractAppParamPlugin {
5050

5151
private static final int PLUGIN_ID = 40036;
5252
private static final String NAME = JWTI18n.getMessage("jwt.scanner.name");
5353
private static final String DESCRIPTION = JWTI18n.getMessage("jwt.scanner.description");
5454
private static final String SOLUTION = JWTI18n.getMessage("jwt.scanner.soln");
5555
private static final String REFERENCE = JWTI18n.getMessage("jwt.scanner.refs");
56-
private static final Logger LOGGER = Logger.getLogger(JWTActiveScanner.class);
56+
private static final Logger LOGGER = Logger.getLogger(JWTActiveScanRule.class);
5757
private int maxRequestCount;
5858

59-
public JWTActiveScanner() {}
59+
public JWTActiveScanRule() {}
6060

6161
@Override
6262
public void init() {

‎src/main/java/org/zaproxy/zap/extension/jwt/attacks/ClientSideAttack.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
import org.parosproxy.paros.network.HttpHeader;
3535
import org.parosproxy.paros.network.HttpMessage;
3636
import org.zaproxy.addon.commonlib.CookieUtils;
37-
import org.zaproxy.zap.extension.jwt.JWTActiveScanner;
37+
import org.zaproxy.zap.extension.jwt.JWTActiveScanRule;
3838
import org.zaproxy.zap.extension.jwt.JWTI18n;
3939
import org.zaproxy.zap.extension.jwt.utils.VulnerabilityType;
4040

@@ -46,7 +46,7 @@
4646
*/
4747
public class ClientSideAttack {
4848

49-
private JWTActiveScanner jwtActiveScanner;
49+
private JWTActiveScanRule jwtActiveScanRule;
5050
private String param;
5151
private HttpMessage msg;
5252

@@ -58,7 +58,7 @@ private void raiseAlert(
5858
int confidence,
5959
String param,
6060
HttpMessage msg) {
61-
this.jwtActiveScanner.raiseAlert(
61+
this.jwtActiveScanRule.raiseAlert(
6262
risk,
6363
confidence,
6464
JWTI18n.getMessage(MESSAGE_PREFIX + vulnerabilityType.getMessageKey() + ".name"),
@@ -72,12 +72,12 @@ private void raiseAlert(
7272
}
7373

7474
/**
75-
* @param jwtActiveScanner
75+
* @param jwtActiveScanRule
7676
* @param param parameter having JWT token
7777
* @param msg original Http Message
7878
*/
79-
public ClientSideAttack(JWTActiveScanner jwtActiveScanner, String param, HttpMessage msg) {
80-
this.jwtActiveScanner = jwtActiveScanner;
79+
public ClientSideAttack(JWTActiveScanRule jwtActiveScanRule, String param, HttpMessage msg) {
80+
this.jwtActiveScanRule = jwtActiveScanRule;
8181
this.param = param;
8282
this.msg = msg;
8383
}

‎src/main/java/org/zaproxy/zap/extension/jwt/attacks/HeaderAttack.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ private boolean executeNoneAlgorithmVariantAttacks(JWTHolder jwtHolder) {
6767
JWTHolder clonedJWTHolder = new JWTHolder(jwtHolder);
6868
for (String noneVariant : NONE_ALGORITHM_VARIANTS) {
6969
for (String headerVariant : this.manipulatingHeaders(noneVariant)) {
70-
if (this.serverSideAttack.getJwtActiveScanner().isStop()) {
70+
if (this.serverSideAttack.getJwtActiveScanRule().isStop()) {
7171
return false;
7272
}
7373
clonedJWTHolder.setHeader(headerVariant);

‎src/main/java/org/zaproxy/zap/extension/jwt/attacks/JWTAttack.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,9 @@ public interface JWTAttack {
3838
* @return {@code true} if attacks is successful else {@code false}
3939
*/
4040
default boolean verifyJWTToken(String newJWTToken, ServerSideAttack serverSideAttack) {
41-
serverSideAttack.getJwtActiveScanner().decreaseRequestCount();
41+
serverSideAttack.getJwtActiveScanRule().decreaseRequestCount();
4242
return serverSideAttack
43-
.getJwtActiveScanner()
43+
.getJwtActiveScanRule()
4444
.sendManipulatedMsgAndCheckIfAttackSuccessful(
4545
serverSideAttack.getMsg(),
4646
serverSideAttack.getParam(),
@@ -66,7 +66,7 @@ default void raiseAlert(
6666
String jwtToken,
6767
ServerSideAttack serverSideAttack) {
6868
serverSideAttack
69-
.getJwtActiveScanner()
69+
.getJwtActiveScanRule()
7070
.raiseAlert(
7171
alertLevel,
7272
confidenceLevel,

‎src/main/java/org/zaproxy/zap/extension/jwt/attacks/MiscAttack.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ private boolean executeAttackAndRaiseAlert(String newJWTToken) {
6161
private boolean executeEmptyPayloads() {
6262
List<String> jwtEmptyTokens = Arrays.asList("...", ".....");
6363
for (String emptyToken : jwtEmptyTokens) {
64-
if (!this.serverSideAttack.getJwtActiveScanner().isStop()
64+
if (!this.serverSideAttack.getJwtActiveScanRule().isStop()
6565
&& executeAttackAndRaiseAlert(emptyToken)) {
6666
return true;
6767
}

‎src/main/java/org/zaproxy/zap/extension/jwt/attacks/PayloadAttack.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ private boolean executeNullByteAttack() {
6666
String nullBytePayload = NULL_BYTE_CHARACTER + Constant.getEyeCatcher();
6767
JWTHolder clonedJWTToken = new JWTHolder(this.serverSideAttack.getJwtHolder());
6868
try {
69-
if (this.serverSideAttack.getJwtActiveScanner().isStop()) {
69+
if (this.serverSideAttack.getJwtActiveScanRule().isStop()) {
7070
return false;
7171
}
7272
// Adding null byte to payload encoded with base64 encoding
@@ -86,7 +86,7 @@ private boolean executeNullByteAttack() {
8686
// encoding.
8787
JSONObject payloadJsonObject = new JSONObject(clonedJWTToken.getPayload());
8888
for (String key : payloadJsonObject.keySet()) {
89-
if (this.serverSideAttack.getJwtActiveScanner().isStop()) {
89+
if (this.serverSideAttack.getJwtActiveScanRule().isStop()) {
9090
return false;
9191
}
9292
Object originalKeyValue = payloadJsonObject.get(key);

‎src/main/java/org/zaproxy/zap/extension/jwt/attacks/ServerSideAttack.java‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
import java.util.Arrays;
2323
import java.util.List;
2424
import org.parosproxy.paros.network.HttpMessage;
25-
import org.zaproxy.zap.extension.jwt.JWTActiveScanner;
25+
import org.zaproxy.zap.extension.jwt.JWTActiveScanRule;
2626
import org.zaproxy.zap.extension.jwt.JWTHolder;
2727

2828
/**
@@ -32,7 +32,7 @@
3232
* @since TODO add version
3333
*/
3434
public class ServerSideAttack {
35-
private JWTActiveScanner jwtActiveScanner;
35+
private JWTActiveScanRule jwtActiveScanRule;
3636
private String param;
3737
private String paramValue;
3838
private HttpMessage msg;
@@ -46,26 +46,26 @@ public class ServerSideAttack {
4646

4747
/**
4848
* @param jwtHolder Parsed JWT Token
49-
* @param jwtActiveScanner instance of {@link JWTActiveScanner}
49+
* @param jwtActiveScanRule instance of {@link JWTActiveScanRule}
5050
* @param msg original Http Message
5151
* @param param parameter having JWT token
5252
* @param paramValue original parameter value
5353
*/
5454
public ServerSideAttack(
5555
JWTHolder jwtHolder,
56-
JWTActiveScanner jwtActiveScanner,
56+
JWTActiveScanRule jwtActiveScanRule,
5757
String param,
5858
HttpMessage msg,
5959
String paramValue) {
6060
this.jwtHolder = jwtHolder;
61-
this.jwtActiveScanner = jwtActiveScanner;
61+
this.jwtActiveScanRule = jwtActiveScanRule;
6262
this.param = param;
6363
this.msg = msg;
6464
this.paramValue = paramValue;
6565
}
6666

67-
public JWTActiveScanner getJwtActiveScanner() {
68-
return jwtActiveScanner;
67+
public JWTActiveScanRule getJwtActiveScanRule() {
68+
return jwtActiveScanRule;
6969
}
7070

7171
public String getParam() {
@@ -86,7 +86,7 @@ public JWTHolder getJwtHolder() {
8686

8787
public boolean execute() {
8888
for (JWTAttack jwtAttack : JWTATTACKS) {
89-
if (jwtActiveScanner.isStop()) {
89+
if (jwtActiveScanRule.isStop()) {
9090
return false;
9191
} else {
9292
if (jwtAttack.executeAttack(this)) {

‎src/main/java/org/zaproxy/zap/extension/jwt/attacks/SignatureAttack.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ public class SignatureAttack implements JWTAttack {
8989
private boolean executeNullByteAttack() throws JWTException {
9090
// Appends signature with NullByte plus ZAP eyeCather.
9191
JWTHolder cloneJWTHolder = new JWTHolder(this.serverSideAttack.getJwtHolder());
92-
if (this.serverSideAttack.getJwtActiveScanner().isStop()) {
92+
if (this.serverSideAttack.getJwtActiveScanRule().isStop()) {
9393
return false;
9494
}
9595

@@ -108,7 +108,7 @@ private boolean executeNullByteAttack() throws JWTException {
108108
return true;
109109
}
110110

111-
if (this.serverSideAttack.getJwtActiveScanner().isStop()) {
111+
if (this.serverSideAttack.getJwtActiveScanRule().isStop()) {
112112
return false;
113113
}
114114

@@ -164,7 +164,7 @@ public boolean executeCustomPrivateKeySignedJWTTokenAttack() throws JWTException
164164
try {
165165
if (algoType.startsWith(JWT_RSA_ALGORITHM_IDENTIFIER)
166166
|| algoType.startsWith(JWT_RSA_PSS_ALGORITHM_IDENTIFIER)) {
167-
if (this.serverSideAttack.getJwtActiveScanner().isStop()) {
167+
if (this.serverSideAttack.getJwtActiveScanRule().isStop()) {
168168
return false;
169169
}
170170
// Generating JWK
@@ -183,7 +183,7 @@ public boolean executeCustomPrivateKeySignedJWTTokenAttack() throws JWTException
183183
if (curve == null) {
184184
continue;
185185
}
186-
if (this.serverSideAttack.getJwtActiveScanner().isStop()) {
186+
if (this.serverSideAttack.getJwtActiveScanRule().isStop()) {
187187
return false;
188188
}
189189
// Generating JWK
@@ -249,7 +249,7 @@ private boolean executeAlgoKeyConfusionAttack() throws JWTException {
249249
try (FileInputStream fileInputStream = new FileInputStream(trustStorePath)) {
250250
keyStore.load(fileInputStream, password);
251251
while (keyStore.aliases().hasMoreElements()) {
252-
if (this.serverSideAttack.getJwtActiveScanner().isStop()) {
252+
if (this.serverSideAttack.getJwtActiveScanRule().isStop()) {
253253
return false;
254254
}
255255
String alias = keyStore.aliases().nextElement();

‎src/main/java/org/zaproxy/zap/extension/jwt/ui/JWTOptionsPanel.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
import org.zaproxy.zap.extension.jwt.utils.JWTUIUtils;
4848

4949
/**
50-
* JWT options panel for specifying settings which are used by {@code JWTActiveScanner} and {@code
50+
* JWT options panel for specifying settings which are used by {@code JWTActiveScanRule} and {@code
5151
* JWTFuzzer} for finding vulnerabilities in applications.
5252
*
5353
* @author KSASAN [email protected]

0 commit comments

Comments
 (0)