(PayloadInjector injector, String param, int attackDedication, short get404Code)
| 314 | } |
| 315 | |
| 316 | private static boolean tryStatusCache(PayloadInjector injector, String param, int attackDedication, short get404Code) { |
| 317 | String canary = BulkUtilities.generateCanary()+".jpg"; |
| 318 | byte[] setPoison200Req = injector.getInsertionPoint().buildRequest(BulkUtilities.helpers.stringToBytes(addStatusPayload(param))); |
| 319 | setPoison200Req = BulkUtilities.appendToPath(setPoison200Req, canary); |
| 320 | |
| 321 | byte[] getPoison200Req = injector.getInsertionPoint().buildRequest(BulkUtilities.helpers.stringToBytes(addStatusPayload("xyz"+param+"z"))); |
| 322 | getPoison200Req = BulkUtilities.appendToPath(getPoison200Req, canary); |
| 323 | |
| 324 | for(int j=0; j<attackDedication; j++) { |
| 325 | Scan.request(injector.getService(), setPoison200Req); |
| 326 | } |
| 327 | |
| 328 | for(int j=0; j<attackDedication; j+=3) { |
| 329 | IHttpRequestResponse getPoison200 = Scan.request(injector.getService(), getPoison200Req); |
| 330 | short getPoison200Code = BulkUtilities.helpers.analyzeResponse(getPoison200.getResponse()).getStatusCode(); |
| 331 | if (getPoison200Code != get404Code) { |
| 332 | BulkUtilities.callbacks.addScanIssue(new CustomScanIssue(getPoison200.getHttpService(), BulkUtilities.getURL(getPoison200), getPoison200, "Status-code cache poisoning " + j, "Cache poisoning: '" + param + "'. Diff based cache poisoning. Good luck confirming", "High", "Tentative", "Investigate")); |
| 333 | } |
| 334 | return true; |
| 335 | } |
| 336 | |
| 337 | return false; |
| 338 | } |
| 339 | |
| 340 | // private boolean tryStatusCache(PayloadInjector injector, String param, int attackDedication, String pathCacheBuster, byte[] base404, short get404Code, int i) { |
| 341 | // IParameter cacheBuster = BulkUtilities.helpers.buildParameter(BulkUtilities.generateCanary(), "1", IParameter.PARAM_URL); |
no test coverage detected