* Check for Parameter Pollution */
()
| 712 | |
| 713 | /* Check for Parameter Pollution */ |
| 714 | func ScanParameterPollution() reportResult { |
| 715 | var repResult reportResult |
| 716 | repResult.Technique = "Parameter Pollution" |
| 717 | |
| 718 | if len(impactfulQueries) == 0 { |
| 719 | msg := "No impactful query parameters were found beforehand. Run the query parameter scan (maybe with a different wordlist)." |
| 720 | Print(msg+"\n", Yellow) |
| 721 | repResult.HasError = true |
| 722 | repResult.ErrorMessages = append(repResult.ErrorMessages, msg) |
| 723 | return repResult |
| 724 | } else { |
| 725 | msg := fmt.Sprintf("The following parameters were found to be impactful and will be tested for parameter pollution: %s\n", impactfulQueries) |
| 726 | Print(msg, Cyan) |
| 727 | } |
| 728 | |
| 729 | threads := Config.Threads |
| 730 | if Config.Website.Cache.CBisHTTPMethod { |
| 731 | threads = 1 // No multithreading if HTTP Method is used... Otherwise there will be a lot of false negatives/positives |
| 732 | PrintVerbose("Can only scan single threaded because a HTTP Method is used as Cachebuster...\n", Yellow, 1) |
| 733 | } |
| 734 | sem := make(chan int, threads) |
| 735 | var wg sync.WaitGroup |
| 736 | var m sync.Mutex |
| 737 | |
| 738 | if len(impactfulQueries) > 500 { // only test first 500 impactful queries. TODO decrease amount as such a high amount most likely means they are false positives anyways |
| 739 | shortenedQueries := []string{} |
| 740 | for i := range 500 { |
| 741 | shortenedQueries = append(shortenedQueries, impactfulQueries[i]) |
| 742 | } |
| 743 | impactfulQueries = shortenedQueries |
| 744 | } |
| 745 | impactfulQueries = append(impactfulQueries, impactfulQueries...) // we want to test each impactful query parameter 2times. One time with the poison in the first and second with the poison in the second appearance |
| 746 | |
| 747 | wg.Add(len(impactfulQueries)) |
| 748 | |
| 749 | for is, s := range impactfulQueries { |
| 750 | poison := "p" + randInt() |
| 751 | prependCB := false // shall be true for the second test of the cachebuster |
| 752 | |
| 753 | go func(is int, s string, poison string, secondHalf bool) { |
| 754 | defer wg.Done() |
| 755 | sem <- 1 |
| 756 | defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert |
| 757 | |
| 758 | url := Config.Website.Url.String() |
| 759 | ogValue := "foobar" |
| 760 | if strings.Contains(strings.ToLower(url), "?"+s+"=") || strings.Contains(strings.ToLower(url), "&"+s+"=") { |
| 761 | url, ogValue, _ = removeParam(url, s) |
| 762 | } |
| 763 | |
| 764 | var parameters []string |
| 765 | if is >= len(impactfulQueries)/2 { |
| 766 | parameters = []string{s + "=" + poison, s + "=" + ogValue} |
| 767 | } else { |
| 768 | parameters = []string{s + "=" + ogValue, s + "=" + poison} |
| 769 | } |
| 770 | |
| 771 | msg := fmt.Sprintf("Testing now Parameter Pollution (%d/%d) %s\n", is+1, len(impactfulQueries)*2, s) |
no test coverage detected