private void AddSSLRelatedVulnerability(WSDescriberForReport WSItemVulnerabilities, int vulnId)
{
VulnerabilityForReport sslVuln = new VulnerabilityForReport();
sslVuln.Vuln = vulnerabilities.Vulnerability.Where(v => v.id == vulnId).FirstOrDefault();
sslVuln.VulnerableMethodName = "";
sslVuln.VulnerableParamName = "";
sslVuln.Payload = "";
sslVuln.Response = "";
sslVuln.StatusCode = "";
WSItemVulnerabilities.Vulns.Add(sslVuln);
}
public void SetSoapFaultException(WSOperation operation, SoapException soapEx, WSDescriberForReport WSItemVulnerabilities, bool isDebug)
{
if (WSItemVulnerabilities.Vulns.Where(v => v.VulnerableMethodName.Equals(operation.MethodName) && v.Vuln.id == 7).Count() <= 0) // aynı method için sadece 1 tane soap fault zafiyeti yaz
{
mainForm.Log(" Soap Exception: " + soapEx.ToString(), FontStyle.Regular, isDebug);
VulnerabilityForReport soapFaultVuln = new VulnerabilityForReport();
soapFaultVuln.Vuln = MainForm.vulnerabilities.Vulnerability.Where(v => v.id == 7).FirstOrDefault();
soapFaultVuln.VulnerableMethodName = operation.MethodName;
soapFaultVuln.VulnerableParamName = "";
soapFaultVuln.Payload = "";
soapFaultVuln.Response = soapEx.Message;
soapFaultVuln.StatusCode = "";
WSItemVulnerabilities.Vulns.Add(soapFaultVuln);
}
}
private void CheckUnAuthenticatedMethod(WebServiceToInvoke wsInvoker, WSOperation operation, VulnerabilitiesVulnerability vuln,
string targetNameSpace, WSDescriberForReport WSItemVulnerabilities, ReportObject reportObject,
bool isDebug, ref List<Param> respHeader, string customSoapHeaderTags, string customSoapBodyTags)
{
for (int j = 0; j < operation.Parameters.Count; j++)
{
SetParameterDefaultValue(wsInvoker, operation.Parameters[j], isDebug);
}
try
{
try
{
reportObject.TotalRequestCount++;
wsInvoker.InvokeMethod(operation.MethodName, targetNameSpace, null, ref respHeader, customSoapHeaderTags, customSoapBodyTags);
}
catch (SoapException soapEx)
{
//throw ex;
SetSoapFaultException(operation, soapEx, WSItemVulnerabilities, isDebug);
}
catch (Exception ex)
{
throw ex;
}
}
finally { wsInvoker.PosInvoke(); }
if (!vuln.statusCode.Equals(wsInvoker.StatusCode.ToString())) // status code is not 401, no redirect
{
VulnerabilityForReport authVuln = new VulnerabilityForReport();
authVuln.Vuln = MainForm.vulnerabilities.Vulnerability.Where(v => v.id == 1).FirstOrDefault();
authVuln.VulnerableMethodName = operation.MethodName;
authVuln.VulnerableParamName = "";
authVuln.Payload = "";
authVuln.Response = wsInvoker.ResultString;
authVuln.StatusCode = wsInvoker.StatusCode.ToString();
WSItemVulnerabilities.Vulns.Add(authVuln);
mainForm.Log(" Auth Vulnerability Found: " + wsInvoker.ResultString + " - status code is : " + wsInvoker.StatusCode.ToString(), FontStyle.Bold, true);
}
}
private void SetVuln(WebServiceToInvoke wsInvoker, WSDescriberForReport WSItemVulnerabilities,
VulnerabilitiesVulnerability vuln, WSOperation operation, string payload, string paramName, string logStr)
{
mainForm.Log(logStr, FontStyle.Bold, true);
VulnerabilityForReport vulnRep = new VulnerabilityForReport();
vulnRep.Vuln = vuln;
vulnRep.VulnerableMethodName = operation.MethodName;
vulnRep.VulnerableParamName = paramName;
vulnRep.Payload = payload;
vulnRep.Response = wsInvoker.ResultString;
vulnRep.StatusCode = wsInvoker.StatusCode.ToString();
WSItemVulnerabilities.Vulns.Add(vulnRep);
}
