MCPcopy Create free account
hub / github.com/Hackmanit/Web-Cache-Vulnerability-Scanner / ScanParameterPollution

Function ScanParameterPollution

pkg/techniques.go:714–823  ·  view source on GitHub ↗

* Check for Parameter Pollution */

()

Source from the content-addressed store, hash-verified

712
713/* Check for Parameter Pollution */
714func ScanParameterPollution() reportResult {
715 var repResult reportResult
716 repResult.Technique = "Parameter Pollution"
717
718 if len(impactfulQueries) == 0 {
719 msg := "No impactful query parameters were found beforehand. Run the query parameter scan (maybe with a different wordlist)."
720 Print(msg+"\n", Yellow)
721 repResult.HasError = true
722 repResult.ErrorMessages = append(repResult.ErrorMessages, msg)
723 return repResult
724 } else {
725 msg := fmt.Sprintf("The following parameters were found to be impactful and will be tested for parameter pollution: %s\n", impactfulQueries)
726 Print(msg, Cyan)
727 }
728
729 threads := Config.Threads
730 if Config.Website.Cache.CBisHTTPMethod {
731 threads = 1 // No multithreading if HTTP Method is used... Otherwise there will be a lot of false negatives/positives
732 PrintVerbose("Can only scan single threaded because a HTTP Method is used as Cachebuster...\n", Yellow, 1)
733 }
734 sem := make(chan int, threads)
735 var wg sync.WaitGroup
736 var m sync.Mutex
737
738 if len(impactfulQueries) > 500 { // only test first 500 impactful queries. TODO decrease amount as such a high amount most likely means they are false positives anyways
739 shortenedQueries := []string{}
740 for i := range 500 {
741 shortenedQueries = append(shortenedQueries, impactfulQueries[i])
742 }
743 impactfulQueries = shortenedQueries
744 }
745 impactfulQueries = append(impactfulQueries, impactfulQueries...) // we want to test each impactful query parameter 2times. One time with the poison in the first and second with the poison in the second appearance
746
747 wg.Add(len(impactfulQueries))
748
749 for is, s := range impactfulQueries {
750 poison := "p" + randInt()
751 prependCB := false // shall be true for the second test of the cachebuster
752
753 go func(is int, s string, poison string, secondHalf bool) {
754 defer wg.Done()
755 sem <- 1
756 defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert
757
758 url := Config.Website.Url.String()
759 ogValue := "foobar"
760 if strings.Contains(strings.ToLower(url), "?"+s+"=") || strings.Contains(strings.ToLower(url), "&"+s+"=") {
761 url, ogValue, _ = removeParam(url, s)
762 }
763
764 var parameters []string
765 if is >= len(impactfulQueries)/2 {
766 parameters = []string{s + "=" + poison, s + "=" + ogValue}
767 } else {
768 parameters = []string{s + "=" + ogValue, s + "=" + poison}
769 }
770
771 msg := fmt.Sprintf("Testing now Parameter Pollution (%d/%d) %s\n", is+1, len(impactfulQueries)*2, s)

Callers 1

runTestsFunction · 0.92

Calls 6

PrintFunction · 0.85
PrintVerboseFunction · 0.85
randIntFunction · 0.85
removeParamFunction · 0.85
issueRequestsFunction · 0.85
getRespSplitFunction · 0.85

Tested by

no test coverage detected