(self)
| 365 | return hash_functions[hash_length] |
| 366 | |
| 367 | async def fuzz(self): |
| 368 | cookies = self.event.data.get("assigned_cookies", {}) |
| 369 | probe_value = self.incoming_probe_value(populate_empty=False) |
| 370 | |
| 371 | if not probe_value: |
| 372 | self.debug( |
| 373 | f"The Cryptography Probe Submodule requires original value, aborting [{self.event.data['type']}] [{self.event.data['name']}]" |
| 374 | ) |
| 375 | return |
| 376 | |
| 377 | # obtain the baseline probe to compare against |
| 378 | baseline_probe = await self.baseline_probe(cookies) |
| 379 | if not baseline_probe: |
| 380 | self.verbose(f"Couldn't get baseline_probe for url {self.event.data['url']}, aborting") |
| 381 | return |
| 382 | |
| 383 | # perform the manipulation techniques |
| 384 | try: |
| 385 | truncate_probe_value = self.modify_string(probe_value, action="truncate") |
| 386 | mutate_probe_value = self.modify_string(probe_value, action="mutate") |
| 387 | except ValueError as e: |
| 388 | self.debug(f"Encountered error modifying value for parameter [{self.event.data['name']}]: {e} , aborting") |
| 389 | return |
| 390 | |
| 391 | # Basic crypanalysis |
| 392 | likely_crypto, possible_block_cipher = self.cryptanalysis(probe_value) |
| 393 | |
| 394 | # if the value is not likely to be cryptographic, we can skip the rest of the tests |
| 395 | if not likely_crypto: |
| 396 | self.debug("Parameter value does not appear to be cryptographic, aborting tests") |
| 397 | return |
| 398 | |
| 399 | # Cryptographic Response Divergence Test |
| 400 | |
| 401 | http_compare = self.compare_baseline(self.event.data["type"], probe_value, cookies) |
| 402 | try: |
| 403 | arbitrary_probe = await self.compare_probe(http_compare, self.event.data["type"], "AAAAAAA", cookies) # |
| 404 | truncate_probe = await self.compare_probe( |
| 405 | http_compare, self.event.data["type"], truncate_probe_value, cookies |
| 406 | ) # manipulate the value by truncating a byte |
| 407 | mutate_probe = await self.compare_probe( |
| 408 | http_compare, self.event.data["type"], mutate_probe_value, cookies |
| 409 | ) # manipulate the value by mutating a byte in place |
| 410 | except HttpCompareError as e: |
| 411 | self.verbose(f"Encountered HttpCompareError Sending Compare Probe: {e}") |
| 412 | return |
| 413 | |
| 414 | confirmed_techniques = [] |
| 415 | # mutate_probe[0] will be false if the response is different - mutate_probe[1] stores what aspect of the response is different (headers, body, code) |
| 416 | # ensure the difference is in the body and not the headers or code |
| 417 | # if the body is different and not empty, we have confirmed that single-byte mutation affected the response body |
| 418 | if mutate_probe[0] is False and "body" in mutate_probe[1]: |
| 419 | if (http_compare.compare_body(mutate_probe[3].text, arbitrary_probe[3].text) is False) or mutate_probe[ |
| 420 | 3 |
| 421 | ].text == "": |
| 422 | confirmed_techniques.append("Single-byte Mutation") |
| 423 | |
| 424 | # if the body is different and not empty, we have confirmed that byte truncation affected the response body |
nothing calls this directly
no test coverage detected