Test origin/referrer validation
(tester)
| 124 | |
| 125 | |
| 126 | def test_origin_validation(tester): |
| 127 | """Test origin/referrer validation""" |
| 128 | print("\n[*] Testing origin validation...") |
| 129 | |
| 130 | # Test 1: Send requests with fake origins |
| 131 | print(" - Testing origin header validation...") |
| 132 | |
| 133 | malicious_origins = [ |
| 134 | "http://attacker.com", |
| 135 | "http://evil.example.com", |
| 136 | "http://192.168.1.100", |
| 137 | "file:///etc/passwd", |
| 138 | ] |
| 139 | |
| 140 | for origin in malicious_origins: |
| 141 | try: |
| 142 | # TCP doesn't have HTTP headers, but test at protocol level |
| 143 | sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) |
| 144 | sock.connect((tester.host, tester.port)) |
| 145 | |
| 146 | # Send command (would work if no origin checking) |
| 147 | msg = { |
| 148 | "type": "command", |
| 149 | "id": str(uuid.uuid4()), |
| 150 | "command": "api.getCommands", |
| 151 | } |
| 152 | sock.sendall(json.dumps(msg).encode() + b"\n") |
| 153 | sock.settimeout(2.0) |
| 154 | response = sock.recv(4096) |
| 155 | sock.close() |
| 156 | |
| 157 | if b"success" in response: |
| 158 | print(f" Accepted connection (no origin validation at TCP level)") |
| 159 | break |
| 160 | |
| 161 | except Exception as e: |
| 162 | pass |
| 163 | |
| 164 | |
| 165 | def test_command_authorization(tester): |