* Scan cookies for poisoning */
()
| 22 | |
| 23 | /* Scan cookies for poisoning */ |
| 24 | func ScanCookies() reportResult { |
| 25 | var repResult reportResult |
| 26 | repResult.Technique = "Cookies" |
| 27 | i := 0 |
| 28 | for k, v := range Config.Website.Cookies { |
| 29 | poison := "p" + randInt() |
| 30 | msg := fmt.Sprintf("Checking cookie %s (%d/%d)\n", k, i+1, len(Config.Website.Cookies)) |
| 31 | Print(msg, NoColor) |
| 32 | i++ |
| 33 | |
| 34 | rUrl := Config.Website.Url.String() |
| 35 | cb := "cb" + randInt() |
| 36 | success := fmt.Sprintf("Cookie %s was successfully poisoned! cachebuster %s: %s poison: %s\n", k, Config.Website.Cache.CBName, cb, poison) |
| 37 | identifier := k + "=" + v |
| 38 | msg = fmt.Sprintf("Overwriting %s=%s with %s=%s\n", k, v, k, poison) |
| 39 | Print(msg, NoColor) |
| 40 | |
| 41 | newCookie := map[string]string{} |
| 42 | newCookie["key"] = k |
| 43 | newCookie["value"] = poison |
| 44 | |
| 45 | rp := requestParams{ |
| 46 | repResult: &repResult, |
| 47 | headers: []string{""}, |
| 48 | values: []string{""}, |
| 49 | name: k, |
| 50 | identifier: identifier, |
| 51 | poison: poison, |
| 52 | url: rUrl, |
| 53 | cb: cb, |
| 54 | success: success, |
| 55 | bodyString: "", |
| 56 | forcePost: false, |
| 57 | m: nil, |
| 58 | newCookie: newCookie, |
| 59 | } |
| 60 | responseSplittingHeaders, _, _ := issueRequests(rp) |
| 61 | |
| 62 | // check for response splitting, if poison was reflected in a header |
| 63 | for _, responseSplittingHeader := range responseSplittingHeaders { |
| 64 | msg := fmt.Sprintf("Checking cookie %s for Response Splitting, because it was reflected in the header %s\n", k, responseSplittingHeader) |
| 65 | PrintVerbose(msg, Cyan, 1) |
| 66 | |
| 67 | rp.poison += getRespSplit() |
| 68 | rp.url = rUrl |
| 69 | rp.cb = "cb" + randInt() |
| 70 | rp.success = fmt.Sprintf("Cookie %s successfully poisoned the header %s with Response Splitting! cachebuster %s: %s poison: %s\n", k, responseSplittingHeader, Config.Website.Cache.CBName, rp.cb, rp.poison) |
| 71 | rp.identifier += " response splitting" |
| 72 | |
| 73 | msg = fmt.Sprintf("Overwriting %s=%s with %s=%s\n", k, v, k, rp.poison) |
| 74 | Print(msg, NoColor) |
| 75 | |
| 76 | issueRequests(rp) |
| 77 | } |
| 78 | } |
| 79 | return repResult |
| 80 | } |
| 81 |
no test coverage detected