* Scan query parameters for poisoning */
(parameterList []string)
| 306 | |
| 307 | /* Scan query parameters for poisoning */ |
| 308 | func ScanParameters(parameterList []string) reportResult { |
| 309 | var repResult reportResult |
| 310 | repResult.Technique = "Parameters" |
| 311 | |
| 312 | parametersToTest := parameterList |
| 313 | for k := range Config.Website.Queries { |
| 314 | if !slices.Contains(parameterList, k) { // only add parameters which are not already in the list |
| 315 | parametersToTest = append(parametersToTest, k) // add custom parameters to list |
| 316 | } |
| 317 | } |
| 318 | |
| 319 | threads := Config.Threads |
| 320 | if Config.Website.Cache.CBisHTTPMethod { |
| 321 | threads = 1 // No multithreading if HTTP Method is used... Otherwise there will be a lot of false negatives/positives |
| 322 | PrintVerbose("Can only scan single threaded because a HTTP Method is used as Cachebuster...\n", Yellow, 1) |
| 323 | } |
| 324 | sem := make(chan int, threads) |
| 325 | var wg sync.WaitGroup |
| 326 | wg.Add(len(parametersToTest)) |
| 327 | var m sync.Mutex |
| 328 | |
| 329 | impactfulQueries = []string{} |
| 330 | unkeyedQueries = []string{} |
| 331 | |
| 332 | msg := fmt.Sprintf("Testing %d parameters\n", len(parametersToTest)) |
| 333 | PrintVerbose(msg, NoColor, 1) |
| 334 | |
| 335 | for i, parameter := range parametersToTest { |
| 336 | if parameter == "" { |
| 337 | msg := fmt.Sprintf("Skipping empty query (%d/%d) %s\n", i+1, len(parametersToTest), parameter) |
| 338 | PrintVerbose(msg, NoColor, 2) |
| 339 | wg.Done() |
| 340 | continue |
| 341 | } |
| 342 | |
| 343 | go func(i int, parameter string) { |
| 344 | defer wg.Done() |
| 345 | sem <- 1 |
| 346 | defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert |
| 347 | |
| 348 | parameter = strings.Trim(parameter, "\r") |
| 349 | msg := fmt.Sprintf("Testing now Parameter (%d/%d) %s\n", i+1, len(parametersToTest), parameter) |
| 350 | PrintVerbose(msg, NoColor, 2) |
| 351 | |
| 352 | rUrl := Config.Website.Url.String() |
| 353 | poison := "p" + randInt() |
| 354 | cb := "cb" + randInt() |
| 355 | success := fmt.Sprintf("Query Parameter %s was successfully poisoned! cachebuster %s: %s poison: %s\n", parameter, Config.Website.Cache.CBName, cb, poison) |
| 356 | identifier := fmt.Sprintf("parameter %s", parameter) |
| 357 | |
| 358 | ogValue := NOOGPARAM |
| 359 | if strings.Contains(strings.ToLower(rUrl), "?"+parameter+"=") || strings.Contains(strings.ToLower(rUrl), "&"+parameter+"=") { // remove param if it already existed, so that it will be set only one time and that being with the poison value |
| 360 | rUrl, ogValue, _ = removeParam(rUrl, parameter) |
| 361 | } |
| 362 | |
| 363 | rp := requestParams{ |
| 364 | repResult: &repResult, |
| 365 | headers: []string{""}, |
no test coverage detected