Skip to content

Commit a941beb

Browse files
kingthorinkingthorin
authored
Merge pull request #441 from ricekot/spotless-js-scripts
Format JS scripts with Prettier
2 parents f17ef7c + 9fa4064 commit a941beb

File tree

124 files changed

+7029
-5246
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

124 files changed

+7029
-5246
lines changed

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
1111
- httpsender/RsaEncryptPayloadForZap.py - A script that encrypts requests using RSA
1212
- selenium/FillOTPInMFA.js - A script that fills the OTP in MFA
1313

14+
### Changed
15+
- Use Prettier to format all JavaScript scripts.
16+
1417
## [18] - 2024-01-29
1518
### Added
1619
- httpsender/RsaSigningForZap.py - A script that signs requests using RSA

‎active/Cross Site WebSocket Hijacking.js‎

Lines changed: 68 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -37,73 +37,83 @@
3737
* Note: Active scripts are initially disabled, right click the script to enable it.
3838
*/
3939

40-
var Base64 = Java.type("java.util.Base64")
41-
var Random = Java.type("java.util.Random")
42-
var String = Java.type("java.lang.String")
43-
var ByteArray = Java.type("byte[]")
40+
var Base64 = Java.type("java.util.Base64");
41+
var Random = Java.type("java.util.Random");
42+
var String = Java.type("java.lang.String");
43+
var ByteArray = Java.type("byte[]");
4444

45-
var LOG_DEBUG_MESSAGES = false // change to true for more logs
45+
var LOG_DEBUG_MESSAGES = false; // change to true for more logs
4646

47-
var RISK = 3
48-
var CONFIDENCE = 2
49-
var TITLE = "Cross-Site WebSocket Hijacking"
50-
var DESCRIPTION = "Server accepted WebSocket connection through HTTP Upgrade request with modified Origin header."
51-
var SOLUTION = "Validate Origin header on WebSocket connection handshake, to ensure only specified origins are allowed to connect.\
52-
Also, WebSocket handshake should use random tokens, similar to anti CSRF tokens."
53-
var REFERENCE = "https://tools.ietf.org/html/rfc6455#section-10.2"
54-
var OTHER = "See also https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking\
55-
or https://christian-schneider.net/CrossSiteWebSocketHijacking.html"
56-
var CWEID = 346 // CWE-346: Origin Validation Error, http://cwe.mitre.org/data/definitions/346.html
57-
var WASCID = 9 // WASC-9 Cross Site Request Forgery, http://projects.webappsec.org/w/page/13246919/Cross%20Site%20Request%20Forgery
47+
var RISK = 3;
48+
var CONFIDENCE = 2;
49+
var TITLE = "Cross-Site WebSocket Hijacking";
50+
var DESCRIPTION =
51+
"Server accepted WebSocket connection through HTTP Upgrade request with modified Origin header.";
52+
var SOLUTION =
53+
"Validate Origin header on WebSocket connection handshake, to ensure only specified origins are allowed to connect.\
54+
Also, WebSocket handshake should use random tokens, similar to anti CSRF tokens.";
55+
var REFERENCE = "https://tools.ietf.org/html/rfc6455#section-10.2";
56+
var OTHER =
57+
"See also https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking\
58+
or https://christian-schneider.net/CrossSiteWebSocketHijacking.html";
59+
var CWEID = 346; // CWE-346: Origin Validation Error, http://cwe.mitre.org/data/definitions/346.html
60+
var WASCID = 9; // WASC-9 Cross Site Request Forgery, http://projects.webappsec.org/w/page/13246919/Cross%20Site%20Request%20Forgery
5861

5962
function scanNode(as, msg) {
60-
var target = msg.getRequestHeader().getURI().toString()
61-
62-
// check if this is a WebSocket HTTP Upgrade request (the message should include also "Connection: Upgrade" header if we wanted to check it strictly)
63-
// TODO: in ZAP 2.11 we might use msg.isWebSocketUpgrade() check instead
64-
var upgradeHeader = msg.getRequestHeader().getHeader("Upgrade")
65-
if (!upgradeHeader || upgradeHeader.toLowerCase() !== "websocket") {
66-
if (LOG_DEBUG_MESSAGES) {
67-
print("Cross-Site WebSocket Hijacking rule skipped for url=" + target + ", it does not appear to be a WebSocket upgrade request")
68-
}
69-
return
70-
}
63+
var target = msg.getRequestHeader().getURI().toString();
7164

65+
// check if this is a WebSocket HTTP Upgrade request (the message should include also "Connection: Upgrade" header if we wanted to check it strictly)
66+
// TODO: in ZAP 2.11 we might use msg.isWebSocketUpgrade() check instead
67+
var upgradeHeader = msg.getRequestHeader().getHeader("Upgrade");
68+
if (!upgradeHeader || upgradeHeader.toLowerCase() !== "websocket") {
7269
if (LOG_DEBUG_MESSAGES) {
73-
print("Cross-Site WebSocket Hijacking rule started for url=" + target)
70+
print(
71+
"Cross-Site WebSocket Hijacking rule skipped for url=" +
72+
target +
73+
", it does not appear to be a WebSocket upgrade request"
74+
);
7475
}
75-
msg = msg.cloneRequest()
76+
return;
77+
}
78+
79+
if (LOG_DEBUG_MESSAGES) {
80+
print("Cross-Site WebSocket Hijacking rule started for url=" + target);
81+
}
82+
msg = msg.cloneRequest();
7683

77-
// set random Sec-WebSocket-Key
78-
var randomBytes = new ByteArray(16)
79-
new Random().nextBytes(randomBytes)
80-
var secWsKey = new String(Base64.getEncoder().encode(randomBytes))
81-
msg.getRequestHeader().setHeader("Sec-WebSocket-Key", secWsKey)
84+
// set random Sec-WebSocket-Key
85+
var randomBytes = new ByteArray(16);
86+
new Random().nextBytes(randomBytes);
87+
var secWsKey = new String(Base64.getEncoder().encode(randomBytes));
88+
msg.getRequestHeader().setHeader("Sec-WebSocket-Key", secWsKey);
8289

83-
// set Origin header using custom domain, .example is a reserved TLD in RFC 2606 so it should not match domain name of a scanned service
84-
msg.getRequestHeader().setHeader("Origin", "https://cswsh.example")
90+
// set Origin header using custom domain, .example is a reserved TLD in RFC 2606 so it should not match domain name of a scanned service
91+
msg.getRequestHeader().setHeader("Origin", "https://cswsh.example");
8592

86-
as.sendAndReceive(msg, true, false)
93+
as.sendAndReceive(msg, true, false);
8794

88-
var responseStatus = msg.getResponseHeader().getStatusCode()
89-
if (responseStatus === 101) {
90-
// should not have accepted connection with different origin
91-
if (LOG_DEBUG_MESSAGES) {
92-
print("Cross-Site WebSocket Hijacking vulnerability found, sending alert for url=" + target)
93-
}
94-
as.newAlert()
95-
.setRisk(RISK)
96-
.setConfidence(CONFIDENCE)
97-
.setName(TITLE)
98-
.setDescription(DESCRIPTION)
99-
.setParam(target)
100-
.setEvidence(msg.getResponseHeader().getPrimeHeader())
101-
.setOtherInfo(OTHER)
102-
.setSolution(SOLUTION)
103-
.setReference(REFERENCE)
104-
.setCweId(CWEID)
105-
.setWascId(WASCID)
106-
.setMessage(msg)
107-
.raise()
108-
}
95+
var responseStatus = msg.getResponseHeader().getStatusCode();
96+
if (responseStatus === 101) {
97+
// should not have accepted connection with different origin
98+
if (LOG_DEBUG_MESSAGES) {
99+
print(
100+
"Cross-Site WebSocket Hijacking vulnerability found, sending alert for url=" +
101+
target
102+
);
103+
}
104+
as.newAlert()
105+
.setRisk(RISK)
106+
.setConfidence(CONFIDENCE)
107+
.setName(TITLE)
108+
.setDescription(DESCRIPTION)
109+
.setParam(target)
110+
.setEvidence(msg.getResponseHeader().getPrimeHeader())
111+
.setOtherInfo(OTHER)
112+
.setSolution(SOLUTION)
113+
.setReference(REFERENCE)
114+
.setCweId(CWEID)
115+
.setWascId(WASCID)
116+
.setMessage(msg)
117+
.raise();
118+
}
109119
}

0 commit comments

Comments
 (0)