(repResult *reportResult, values []string, header string, msgextra string, httpConform bool)
| 1085 | } |
| 1086 | |
| 1087 | func headerDOSTemplate(repResult *reportResult, values []string, header string, msgextra string, httpConform bool) { |
| 1088 | msg := fmt.Sprintf("Testing now %sDOS with header %s and values %s\n", msgextra, header, values) |
| 1089 | PrintVerbose(msg, NoColor, 2) |
| 1090 | |
| 1091 | threads := Config.Threads |
| 1092 | if Config.Website.Cache.CBisHTTPMethod { |
| 1093 | threads = 1 // No multithreading if HTTP Method is used... Otherwise there will be a lot of false negatives/positives |
| 1094 | PrintVerbose("Can only scan single threaded because a HTTP Method is used as Cachebuster...\n", Yellow, 1) |
| 1095 | } |
| 1096 | sem := make(chan int, threads) |
| 1097 | var wg sync.WaitGroup |
| 1098 | wg.Add(len(values)) |
| 1099 | var m sync.Mutex |
| 1100 | |
| 1101 | for _, value := range values { |
| 1102 | |
| 1103 | go func(value string, httpConform bool) { |
| 1104 | defer wg.Done() |
| 1105 | sem <- 1 |
| 1106 | defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert |
| 1107 | |
| 1108 | msg := fmt.Sprintf("Testing now %q Header DOS with %q\n", header, value) // %q for raw printing of control characters |
| 1109 | PrintVerbose(msg, NoColor, 2) |
| 1110 | rUrl := Config.Website.Url.String() |
| 1111 | cb := "cb" + randInt() |
| 1112 | success := fmt.Sprintf("%sDOS with header %q was successfully poisoned! cachebuster %s: %s poison: %q\n", msgextra, header, Config.Website.Cache.CBName, cb, value) |
| 1113 | identifier := fmt.Sprintf("%s%q with %q", msgextra, header, value) |
| 1114 | |
| 1115 | rp := requestParams{ |
| 1116 | repResult: repResult, |
| 1117 | headers: []string{header}, |
| 1118 | values: []string{value}, |
| 1119 | identifier: identifier, |
| 1120 | poison: "", |
| 1121 | url: rUrl, |
| 1122 | cb: cb, |
| 1123 | success: success, |
| 1124 | bodyString: "", |
| 1125 | forcePost: false, |
| 1126 | m: &m, |
| 1127 | newCookie: nil, |
| 1128 | } |
| 1129 | responseSplittingHeaders, _, _ := issueRequests(rp) |
| 1130 | |
| 1131 | // check for response splitting, if poison was reflected in a header |
| 1132 | for _, responseSplittingHeader := range responseSplittingHeaders { |
| 1133 | msg := fmt.Sprintf("Testing now %s Header DOS with %s\n for Response Splitting, because it was reflected in the header %s", header, value, responseSplittingHeader) |
| 1134 | PrintVerbose(msg, Cyan, 1) |
| 1135 | |
| 1136 | rp.values[0] += getRespSplit() |
| 1137 | rp.url = rUrl |
| 1138 | rp.cb = "cb" + randInt() |
| 1139 | rp.success = fmt.Sprintf("%sDOS with header %s successfully poisoned the header %s with Response Splitting! cachebuster %s: %s poison: %s\n", msgextra, header, responseSplittingHeader, Config.Website.Cache.CBName, rp.cb, rp.values[0]) |
| 1140 | rp.identifier += getRespSplit() + " with response splitting" |
| 1141 | |
| 1142 | issueRequests(rp) |
| 1143 | } |
| 1144 | }(value, httpConform) |
no test coverage detected