Skip to content

Commit 3ba438c

Browse files
m10xm10x
committed
changed default cb name to cbwcvs
1 parent 935e4d7 commit 3ba438c

File tree

2 files changed

+20
-20
lines changed

2 files changed

+20
-20
lines changed

‎pkg/flags.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ func ParseFlags(vers string) {
106106
appendBoolean(&requestOptions, &Config.DeclineCookies,
107107
"declineCookies", "dc", false, "Do you don't want to use cookies, which are received in the response of the first request?")
108108
appendString(&requestOptions, &Config.CacheBuster,
109-
"cachebuster", "cb", "cb", "Specify the cachebuster to use. The default value is cachebuster")
109+
"cachebuster", "cb", "cbwcvs", "Specify the cachebuster to use. The default value is cbwcvs")
110110
appendString(&requestOptions, &setCookiesStr,
111111
"setcookies", "sc", "", "Set a Cookie. Otherwise use file: to specify a file with urls. E.g. -sc uid=123 or -sc file:templates/cookie_list")
112112
appendString(&requestOptions, &setHeadersStr,

‎pkg/techniques.go‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func ScanCookies() reportResult {
2929

3030
rUrl := Config.Website.Url.String()
3131
cb := randInt()
32-
success := fmt.Sprintf("Cookie %s was successfully poisoned! cb: %s poison: %s\n", c.Name, cb, poison)
32+
success := fmt.Sprintf("Cookie %s was successfully poisoned! cbwcvs: %s poison: %s\n", c.Name, cb, poison)
3333
identifier := c.Name + "=" + c.Value
3434
msg = fmt.Sprintf("Overwriting %s=%s with %s=%s\n", c.Name, c.Value, c.Name, poison)
3535
Print(msg, NoColor)
@@ -62,7 +62,7 @@ func ScanCookies() reportResult {
6262
rp.poison += getRespSplit()
6363
rp.url = rUrl
6464
rp.cb = randInt()
65-
rp.success = fmt.Sprintf("Cookie %s successfully poisoned the header %s with Response Splitting! cb: %s poison: %s\n", c.Name, responseSplittingHeader, rp.cb, rp.poison)
65+
rp.success = fmt.Sprintf("Cookie %s successfully poisoned the header %s with Response Splitting! cbwcvs: %s poison: %s\n", c.Name, responseSplittingHeader, rp.cb, rp.poison)
6666
rp.identifier += " response splitting"
6767

6868
msg = fmt.Sprintf("Overwriting %s=%s with %s=%s\n", c.Name, c.Value, c.Name, rp.poison)
@@ -125,7 +125,7 @@ func ScanForwardingHeaders() reportResult {
125125
func ForwardHeadersTemplate(repResult *reportResult, headers []string, values []string, identifier string, poison string, duplicateHeaders bool) {
126126
rUrl := Config.Website.Url.String()
127127
cb := randInt()
128-
success := fmt.Sprintf("%s was successfully poisoned! cb: %s poison: %s\n", headers, cb, values)
128+
success := fmt.Sprintf("%s was successfully poisoned! cbwcvs: %s poison: %s\n", headers, cb, values)
129129

130130
rp := requestParams{
131131
repResult: repResult,
@@ -153,7 +153,7 @@ func ForwardHeadersTemplate(repResult *reportResult, headers []string, values []
153153
rp.poison += getRespSplit()
154154
rp.url = rUrl
155155
rp.cb = randInt()
156-
rp.success = fmt.Sprintf("%s successfully poisoned the header %s with Response Splitting! cb: %s poison: %s\n", headers, responseSplittingHeader, rp.cb, rp.values)
156+
rp.success = fmt.Sprintf("%s successfully poisoned the header %s with Response Splitting! cbwcvs: %s poison: %s\n", headers, responseSplittingHeader, rp.cb, rp.values)
157157
rp.identifier += " response splitting"
158158

159159
issueRequest(rp)
@@ -234,7 +234,7 @@ func ScanHeaders(headerList []string) reportResult {
234234
rUrl := Config.Website.Url.String()
235235
poison := randInt()
236236
cb := randInt()
237-
success := fmt.Sprintf("Header %s was successfully poisoned! cb: %s poison: %s\n", header, cb, poison)
237+
success := fmt.Sprintf("Header %s was successfully poisoned! cbwcvs: %s poison: %s\n", header, cb, poison)
238238
identifier := fmt.Sprintf("header %s", header)
239239

240240
rp := requestParams{
@@ -262,7 +262,7 @@ func ScanHeaders(headerList []string) reportResult {
262262
rp.url = rUrl
263263
rp.cb = randInt()
264264
rp.poison += getRespSplit()
265-
rp.success = fmt.Sprintf("Header %s successfully poisoned the header %s with Response Splitting! cb: %s poison: %s\n", header, responseSplittingHeader, rp.cb, rp.poison)
265+
rp.success = fmt.Sprintf("Header %s successfully poisoned the header %s with Response Splitting! cbwcvs: %s poison: %s\n", header, responseSplittingHeader, rp.cb, rp.poison)
266266
rp.identifier += " response splitting"
267267

268268
issueRequest(rp)
@@ -338,7 +338,7 @@ func ScanHeaders(headerList []string) reportResult {
338338
msg := fmt.Sprintf("Testing now (%d/%d) %s\n", i+1, len(headerList), header)
339339
PrintVerbose(msg, NoColor, 2)
340340
urlWithCb, cb := addCacheBuster(Config.Website.Url.String(), "", Config.CacheBuster)
341-
success := fmt.Sprintf("Header %s was successfully poisoned! cb: %s poison: %s\n", header, cb, poison)
341+
success := fmt.Sprintf("Header %s was successfully poisoned! cbwcvs: %s poison: %s\n", header, cb, poison)
342342
identifier := fmt.Sprintf("header %s", header)
343343
344344
rp := requestParams{
@@ -348,7 +348,7 @@ func ScanHeaders(headerList []string) reportResult {
348348
identifier: identifier,
349349
poison: poison,
350350
url: urlWithCb,
351-
cb: cb,
351+
cbwcvs: cb,
352352
success: success,
353353
bodyString: "",
354354
forcePost: false,
@@ -365,7 +365,7 @@ func ScanHeaders(headerList []string) reportResult {
365365
366366
rp.url, rp.cb = addCacheBuster(Config.Website.Url.String(), "", Config.CacheBuster)
367367
rp.poison += getRespSplit()
368-
rp.success = fmt.Sprintf("Header %s was successfully poisoned with Response Splitting! cb: %s poison: %s\n", header, rp.cb, rp.poison)
368+
rp.success = fmt.Sprintf("Header %s was successfully poisoned with Response Splitting! cbwcvs: %s poison: %s\n", header, rp.cb, rp.poison)
369369
rp.identifier += " response splitting"
370370
371371
issueRequest(rp)
@@ -449,7 +449,7 @@ func ScanParameters(parameterList []string) reportResult {
449449
rUrl := Config.Website.Url.String()
450450
poison := randInt()
451451
cb := randInt()
452-
success := fmt.Sprintf("Query Parameter %s was successfully poisoned! cb: %s poison: %s\n", parameter, cb, poison)
452+
success := fmt.Sprintf("Query Parameter %s was successfully poisoned! cbwcvs: %s poison: %s\n", parameter, cb, poison)
453453
identifier := fmt.Sprintf("parameter %s", parameter)
454454

455455
rp := requestParams{
@@ -482,7 +482,7 @@ func ScanParameters(parameterList []string) reportResult {
482482
rp.parameters = []string{parameter + "=" + rp.poison}
483483
rp.url = rUrl
484484
rp.cb = randInt()
485-
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s with Response Splitting! cb: %s poison: %s\n", parameter, responseSplittingHeader, rp.cb, rp.poison)
485+
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s with Response Splitting! cbwcvs: %s poison: %s\n", parameter, responseSplittingHeader, rp.cb, rp.poison)
486486
rp.identifier += " response splitting"
487487
issueRequest(rp)
488488
}
@@ -553,7 +553,7 @@ func ScanFatGET() reportResult {
553553
rUrl := Config.Website.Url.String()
554554
cb := randInt()
555555
bodyString := s + "=" + poison
556-
success := fmt.Sprintf("Query Parameter %s was successfully poisoned via %s! cb: %s poison:%s\n", s, identifier, cb, poison)
556+
success := fmt.Sprintf("Query Parameter %s was successfully poisoned via %s! cbwcvs: %s poison:%s\n", s, identifier, cb, poison)
557557

558558
rp := requestParams{
559559
repResult: &repResult,
@@ -582,7 +582,7 @@ func ScanFatGET() reportResult {
582582
rp.poison += getRespSplit()
583583
rp.bodyString += getRespSplit()
584584
rp.identifier += " response splitting"
585-
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s via %s with Response Splitting! cb: %s poison:%s\n", s, responseSplittingHeader, identifier, rp.cb, rp.poison)
585+
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s via %s with Response Splitting! cbwcvs: %s poison:%s\n", s, responseSplittingHeader, identifier, rp.cb, rp.poison)
586586

587587
issueRequest(rp)
588588
}
@@ -723,7 +723,7 @@ func ScanParameterCloaking() reportResult {
723723
msg := fmt.Sprintf("Testing now Parameter Cloaking (%d/%d) %s%s%s\n", iu+is+1, len(impactfulQueries)*len(unkeyed_parameter), u, cloak, s)
724724
PrintVerbose(msg, NoColor, 2)
725725
cb := randInt()
726-
success := fmt.Sprintf("Query Parameter %s was successfully poisoned via Parameter Cloaking using %s! cb:%s poison:%s\n", s, u, cb, poison)
726+
success := fmt.Sprintf("Query Parameter %s was successfully poisoned via Parameter Cloaking using %s! cbwcvs:%s poison:%s\n", s, u, cb, poison)
727727
identifier := fmt.Sprintf("parameter cloaking %s %s", u, s)
728728

729729
rp := requestParams{
@@ -753,7 +753,7 @@ func ScanParameterCloaking() reportResult {
753753
rp.cb = randInt()
754754
rp.poison += getRespSplit()
755755
rp.parameters = []string{u + "=foobar" + cloak + s + "=" + rp.poison}
756-
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s with Response Splitting using %s with Parameter Cloaking! cb:%s poison:%s\n", s, responseSplittingHeader, u, rp.cb, rp.poison)
756+
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s with Response Splitting using %s with Parameter Cloaking! cbwcvs:%s poison:%s\n", s, responseSplittingHeader, u, rp.cb, rp.poison)
757757
rp.identifier += " response splitting"
758758

759759
issueRequest(rp)
@@ -902,7 +902,7 @@ func hho(repResult *reportResult) {
902902
return
903903
}
904904

905-
msg = fmt.Sprintf("HHO DOS was successfully poisoned! cb: %s \n%s\n", cb, request.URL)
905+
msg = fmt.Sprintf("HHO DOS was successfully poisoned! cbwcvs: %s \n%s\n", cb, request.URL)
906906
m.Lock()
907907
_ = checkPoisoningIndicators(repResult, request, msg, "", "", statusCode1, statusCode2, false, respHeader, false)
908908
m.Unlock()
@@ -932,7 +932,7 @@ func headerDOSTemplate(repResult *reportResult, values []string, header string,
932932
PrintVerbose(msg, NoColor, 2)
933933
rUrl := Config.Website.Url.String()
934934
cb := randInt()
935-
success := fmt.Sprintf("%sDOS with header %s was successfully poisoned! cb: %s poison: %s\n", msgextra, header, cb, value)
935+
success := fmt.Sprintf("%sDOS with header %s was successfully poisoned! cbwcvs: %s poison: %s\n", msgextra, header, cb, value)
936936
identifier := fmt.Sprintf("%s%s with %s", msgextra, header, value)
937937

938938
rp := requestParams{
@@ -960,7 +960,7 @@ func headerDOSTemplate(repResult *reportResult, values []string, header string,
960960
rp.values[0] += getRespSplit()
961961
rp.url = rUrl
962962
rp.cb = randInt()
963-
rp.success = fmt.Sprintf("%sDOS with header %s successfully poisoned the header %s with Response Splitting! cb: %s poison: %s\n", msgextra, header, responseSplittingHeader, rp.cb, rp.values[0])
963+
rp.success = fmt.Sprintf("%sDOS with header %s successfully poisoned the header %s with Response Splitting! cbwcvs: %s poison: %s\n", msgextra, header, responseSplittingHeader, rp.cb, rp.values[0])
964964
rp.identifier += getRespSplit() + " with response splitting"
965965

966966
issueRequest(rp)
@@ -1075,7 +1075,7 @@ func ScanCSS() reportResult {
10751075

10761076
if strings.Contains(string(body), cb) {
10771077
PrintNewLine()
1078-
msg = fmt.Sprintf("A CSS file was successfully poisoned! cb: %s\nURL: %s\n", cb, request.URL)
1078+
msg = fmt.Sprintf("A CSS file was successfully poisoned! cbwcvs: %s\nURL: %s\n", cb, request.URL)
10791079
Print(msg, Green)
10801080
msg = "Reason: CSS reflects URL\n"
10811081
Print(msg, Green)

0 commit comments

Comments
 (0)