MCPcopy Create free account
hub / github.com/Hackmanit/Web-Cache-Vulnerability-Scanner / issueRequests

Function issueRequests

pkg/requests.go:377–433  ·  view source on GitHub ↗

* return values:first bool is needed for responsesplitting, second bool is only needed for ScanParameters */

(rp requestParams)

Source from the content-addressed store, hash-verified

375
376/* return values:first bool is needed for responsesplitting, second bool is only needed for ScanParameters */
377func issueRequests(rp requestParams) (respsplit []string, impact bool, unkeyed bool) {
378 var repCheck reportCheck
379 repCheck.Identifier = rp.identifier
380 repCheck.URL = rp.url
381
382 body1, statusCode1, repRequest, header1, err := firstRequest(rp)
383 if err != nil {
384 if err.Error() != "stop" {
385 if rp.m != nil {
386 rp.m.Lock()
387 defer rp.m.Unlock()
388 }
389 rp.repResult.HasError = true
390 rp.repResult.ErrorMessages = append(rp.repResult.ErrorMessages, err.Error())
391 }
392
393 return nil, false, false
394 }
395 repCheck.Request = repRequest
396
397 impactful := firstRequestPoisoningIndicator(rp.identifier, body1, rp.poison, header1, Config.Website.Cache.CBName == rp.name, rp.cb, statusCode1)
398
399 if Config.Website.Cache.NoCache || Config.Website.Cache.Indicator == "age" {
400 time.Sleep(1 * time.Second) // wait a second to ensure that age header is not set to 0
401 }
402
403 body2, statusCode2, repRequest, respHeader, err := secondRequest(rp)
404 if err != nil {
405 if err.Error() != "stop" {
406 if rp.m != nil {
407 rp.m.Lock()
408 defer rp.m.Unlock()
409 }
410 rp.repResult.HasError = true
411 rp.repResult.ErrorMessages = append(rp.repResult.ErrorMessages, err.Error())
412 }
413 return nil, impactful, false
414 }
415 repCheck.SecondRequest = &repRequest
416 sameBodyLength := len(body1) == len(body2)
417
418 // Check for cache hit
419 hit := false
420 for _, v := range respHeader[Config.Website.Cache.Indicator] {
421 indicValue := strings.TrimSpace(strings.ToLower(v))
422 hit = hit || checkCacheHit(indicValue, Config.Website.Cache.Indicator)
423 }
424
425 // Lock here, to prevent false positives and too many GetWebsite requests
426 if rp.m != nil {
427 rp.m.Lock()
428 defer rp.m.Unlock()
429 }
430 responseSplittingHeaders := checkPoisoningIndicators(rp.repResult, repCheck, rp.success, string(body2), rp.poison, statusCode1, statusCode2, sameBodyLength, respHeader, false)
431
432 return responseSplittingHeaders, impactful, hit
433}
434

Callers 10

ScanCookiesFunction · 0.85
ForwardHeadersTemplateFunction · 0.85
ScanHeadersFunction · 0.85
ScanParametersFunction · 0.85
ScanFatGETFunction · 0.85
ScanParameterCloakingFunction · 0.85
ScanParameterPollutionFunction · 0.85
ScanParameterEncodingFunction · 0.85
hhoFunction · 0.85
headerDOSTemplateFunction · 0.85

Calls 5

firstRequestFunction · 0.85
secondRequestFunction · 0.85
checkCacheHitFunction · 0.85
checkPoisoningIndicatorsFunction · 0.85

Tested by

no test coverage detected