* Check for Parameter Cloaking */
()
| 512 | |
| 513 | /* Check for Parameter Cloaking */ |
| 514 | func ScanParameterCloaking() reportResult { |
| 515 | var repResult reportResult |
| 516 | repResult.Technique = "Parameter Cloaking" |
| 517 | |
| 518 | if len(impactfulQueries) == 0 { |
| 519 | msg := "No impactful query parameters were found beforehand. Run the query parameter scan (maybe with a different wordlist)." |
| 520 | Print(msg+"\n", Yellow) |
| 521 | repResult.HasError = true |
| 522 | repResult.ErrorMessages = append(repResult.ErrorMessages, msg) |
| 523 | return repResult |
| 524 | } else { |
| 525 | msg := fmt.Sprintf("The following parameters were found to be impactful and will be tested for parameter cloaking: %s\n", impactfulQueries) |
| 526 | Print(msg, Cyan) |
| 527 | } |
| 528 | |
| 529 | utm_parameters := []string{"utm_source", "utm_medium", "utm_campaign", "utm_content", "utm_term", "gad_campaignid"} |
| 530 | parameters_to_test := utm_parameters |
| 531 | for _, k := range unkeyedQueries { |
| 532 | if !slices.Contains(parameters_to_test, k) { // only add parameters which are not already in the list |
| 533 | parameters_to_test = append(parameters_to_test, k) |
| 534 | } |
| 535 | } |
| 536 | |
| 537 | /***********TODO Check if urlWithCb already contains utm parameter. |
| 538 | Check if ? or querySeperator is needed |
| 539 | ****************/ |
| 540 | |
| 541 | // The first request is made so a cache miss is forced and the following responses will only |
| 542 | //have a cache hit, if they are unkeyed |
| 543 | rUrl := Config.Website.Url.String() |
| 544 | cb := "cb" + randInt() |
| 545 | rp := requestParams{ |
| 546 | identifier: "first request %s", |
| 547 | url: rUrl, |
| 548 | cb: cb, |
| 549 | } |
| 550 | firstRequest(rp) |
| 551 | |
| 552 | threads := Config.Threads |
| 553 | if Config.Website.Cache.CBisHTTPMethod { |
| 554 | threads = 1 // No multithreading if HTTP Method is used... Otherwise there will be a lot of false negatives/positives |
| 555 | PrintVerbose("Can only scan single threaded because a HTTP Method is used as Cachebuster...\n", Yellow, 1) |
| 556 | } |
| 557 | sem := make(chan int, threads) |
| 558 | var wg sync.WaitGroup |
| 559 | var m sync.Mutex |
| 560 | |
| 561 | unkeyed_parameters := []string{} |
| 562 | cache := Config.Website.Cache |
| 563 | if cache.Indicator == "" || cache.TimeIndicator { |
| 564 | msg := "hit/miss isn't verbose. Can't check which parameters unkeyed, so all utm_parameters and query parameters will be used\n" |
| 565 | Print(msg, Yellow) |
| 566 | unkeyed_parameters = parameters_to_test |
| 567 | |
| 568 | } else { |
| 569 | //Test which parameters are unkeyed |
| 570 | wg.Add(len(parameters_to_test)) |
| 571 |
no test coverage detected