(self, event)
| 129 | ) |
| 130 | |
| 131 | async def handle_event(self, event): |
| 132 | if event.type == "URL": |
| 133 | if self.config.get("force_common_headers", False) is False: |
| 134 | return False |
| 135 | |
| 136 | # If force_common_headers is True, we force the emission of a WEB_PARAMETER for each of the common headers to force fuzzing against them |
| 137 | for h in self.common_headers: |
| 138 | description = f"Speculative (Forced) Header [{h}]" |
| 139 | data = { |
| 140 | "host": str(event.host), |
| 141 | "type": "HEADER", |
| 142 | "name": h, |
| 143 | "original_value": None, |
| 144 | "url": event.data, |
| 145 | "description": description, |
| 146 | } |
| 147 | await self.emit_event(data, "WEB_PARAMETER", event) |
| 148 | |
| 149 | elif event.type == "WEB_PARAMETER": |
| 150 | # check connectivity to url |
| 151 | connectivity_test = await self.helpers.request(event.data["url"], timeout=10) |
| 152 | |
| 153 | if connectivity_test: |
| 154 | original_type = event.data["type"] |
| 155 | |
| 156 | # Normal fuzzing pass (skipped for POSTPARAM if disable_post is True) |
| 157 | if not (self.disable_post and original_type == "POSTPARAM"): |
| 158 | for submodule_name, submodule in self.submodules.items(): |
| 159 | self.debug(f"Starting {submodule_name} fuzz()") |
| 160 | await self.run_submodule(submodule, event) |
| 161 | |
| 162 | # Additional pass: try POSTPARAM as GETPARAM |
| 163 | if self.try_post_as_get and original_type == "POSTPARAM": |
| 164 | event.data["type"] = "GETPARAM" |
| 165 | event.data["converted_from_post"] = True |
| 166 | for submodule_name, submodule in self.submodules.items(): |
| 167 | self.debug(f"Starting {submodule_name} fuzz() (try_post_as_get)") |
| 168 | await self.run_submodule(submodule, event) |
| 169 | |
| 170 | # Additional pass: try GETPARAM as POSTPARAM |
| 171 | if self.try_get_as_post and original_type == "GETPARAM": |
| 172 | event.data["type"] = "POSTPARAM" |
| 173 | event.data["converted_from_get"] = True |
| 174 | for submodule_name, submodule in self.submodules.items(): |
| 175 | self.debug(f"Starting {submodule_name} fuzz() (try_get_as_post)") |
| 176 | await self.run_submodule(submodule, event) |
| 177 | else: |
| 178 | self.debug(f"WEB_PARAMETER URL {event.data['url']} failed connectivity test, aborting") |
| 179 | |
| 180 | async def cleanup(self): |
| 181 | if self.interactsh_instance: |
nothing calls this directly
no test coverage detected