public void Run()
{
_runnable = true;
TestSelectedRequests();
TestMultiSteps();
_trafficFile.SetState(AccessorState.Idle);
_runnable = false;
}
private void StopClick(object sender, EventArgs e)
{
_abort = true;
_fuzzOn = false;
button1.ForeColor = Color.White;
lock (_lock)
{
_payloads.Clear();
}
timer1.Stop();
button2.Text = "Saving...";
button2.Enabled = false;
_outputFile.SetState(AccessorState.Idle);
string filePath = _fileSelector.Text;
if (!String.IsNullOrWhiteSpace(filePath))
{
_outputFile.Save(filePath);
}
button1.Enabled = true;
button2.Enabled = true;
button2.Text = "Stop and Save";
_fileSelector.Enabled = true;
}
private void StartClick(object sender, EventArgs e)
{
if (_fuzzOn)
{
return;
}
_options.MatchPattern = _textPattern.Text;
_options.ReversePattern = _reversePattern.Checked;
GenerateRequestsToFuzz();
ErrorBox error = new ErrorBox();
if (!String.IsNullOrWhiteSpace(_fileSelector.Text))
{
_outputFile = new TrafficViewerFile();
_outputFile.Save(_fileSelector.Text);
if (!File.Exists(_fileSelector.Text))
{
error.Show("Invalid result file location");
return;
}
_options.OutputFile = _fileSelector.Text;
}
else
{
_outputFile = TrafficViewer.Instance.TrafficViewerFile;
_outputFile.SetState(AccessorState.Tailing);
}
if (!int.TryParse(_textNumThreads.Text, out _numThreads))
{
error.Show("Invalid number of threads specified");
return;
}
_options.NumberOfThreads = _numThreads;
_options.Save();
GenerateAndRunPayloads();
}
public void Run()
{
_runnable = true;
var customTests = _testFile.GetCustomTests().Values;
Tester tester = new Tester(this, _testFile);
if (_requestsToTest.Count == 0)
{
//load the requests to test
foreach (var tvReqInfo in _selectedRequests)
{
_requestsToTest.Enqueue(tvReqInfo);
}
}
_trafficFile.SetState(AccessorState.Loading);
while (_runnable && _requestsToTest.Count > 0)
{
TVRequestInfo workingEntry = _requestsToTest.Peek();
//check the request;
byte[] reqBytes = _trafficFile.LoadRequestData(workingEntry.Id);
byte[] respBytes = _trafficFile.LoadResponseData(workingEntry.Id);
HttpRequestInfo workingReqInfo = null;
if (reqBytes == null)
{
Log("SELECT A NEW REQUEST");
_requestsToTest.Dequeue(); //remove the request;
continue;
}
else
{
workingReqInfo = new HttpRequestInfo(reqBytes, true);
workingReqInfo.IsSecure = workingEntry.IsHttps;
}
string rawRequest = workingReqInfo.ToString();
string rawResponse = respBytes != null?Constants.DefaultEncoding.GetString(respBytes) : String.Empty;
if (ShouldBeTested(rawRequest, _testFile.GetAttackTargetList()))
{
MultiThreadedTestExecution testExecution = new MultiThreadedTestExecution(tester, rawRequest, rawResponse, new Uri(workingReqInfo.FullUrl), _testFile.NumberOfThreads);
bool containsFuzz = rawRequest.Contains(Constants.FUZZ_STRING);
foreach (CustomTestDef testDef in customTests)
{
if (containsFuzz)
{
testExecution.TestsQueue.Enqueue(new TestJob(String.Empty, String.Empty, RequestLocation.Path, testDef));
}
else
{
//iterate through parameters, cookies and headers
foreach (var parameter in workingReqInfo.PathVariables)
{
testExecution.TestsQueue.Enqueue(new TestJob(parameter.Key, parameter.Value, RequestLocation.Path, testDef));
}
foreach (var parameter in workingReqInfo.QueryVariables)
{
testExecution.TestsQueue.Enqueue(new TestJob(parameter.Key, parameter.Value, RequestLocation.Query, testDef));
}
foreach (var parameter in workingReqInfo.BodyVariables)
{
testExecution.TestsQueue.Enqueue(new TestJob(parameter.Key, parameter.Value, RequestLocation.Body, testDef));
}
if (!_testFile.TestOnlyParameters)
{
foreach (var header in workingReqInfo.Headers)
{
if (!header.Name.Equals("Host"))
{
testExecution.TestsQueue.Enqueue(new TestJob(header.Name, header.Value, RequestLocation.Headers, testDef));
}
}
foreach (var cookie in workingReqInfo.Cookies)
{
testExecution.TestsQueue.Enqueue(new TestJob(cookie.Key, cookie.Value, RequestLocation.Cookies, testDef));
}
}
}
testExecution.StartTestsAsync();
while (testExecution.IsRunning)
{
if (!_runnable)
{
testExecution.CancelTests();
}
//wait for the test execution to complete
Thread.Sleep(10);
}
}
}
if (_requestsToTest.Count > 0)
{
_requestsToTest.Dequeue();
}
}
//we also initialize all multi-step operations
List <string> multiStepList = _testFile.GetMultiStepList();
_multiStepsToTest = new Queue <string>();
foreach (string path in multiStepList)
{
if (File.Exists(path))
{
_multiStepsToTest.Enqueue(path);
}
else
{
SdkSettings.Instance.Logger.Log(TraceLevel.Error, "Multi-Step path '{0}' does not exist.", path);
}
}
while (_multiStepsToTest.Count > 0)
{
if (!_runnable)
{
return;
}
string path = _multiStepsToTest.Peek();
bool isAbl = path.EndsWith(".login");
TrafficViewerFile htd = new TrafficViewerFile();
if (isAbl)
{
SdkSettings.Instance.Logger.Log(TraceLevel.Error, "ABL files are not supported");
continue;
}
else
{
htd.Open(path);
}
SequentialAttackProxy proxy = GetTestProxy(_netSettings, true) as SequentialAttackProxy;
proxy.Start();
DefaultNetworkSettings netSettings = new DefaultNetworkSettings();
netSettings.WebProxy = new WebProxy(proxy.Host, proxy.Port);
netSettings.CertificateValidationCallback = _netSettings.CertificateValidationCallback;
RequestSender.RequestSender reqSender = new RequestSender.RequestSender(netSettings);
do
{
reqSender.Send(htd);
}while (!proxy.TestComplete && _runnable);
proxy.Stop();
if (_runnable)
{
_multiStepsToTest.Dequeue();
}
}
_trafficFile.SetState(AccessorState.Idle);
_runnable = false;
}