Merge branch 'add-headers' of github.com:edoardottt/pphack into add-headers

edoardottt · edoardottt · commit d3e4d89f3bc7 · 2025-01-26T11:26:41.000+01:00
diff --git a/.github/release.yml b/.github/release.yml
@@ -0,0 +1,17 @@
+changelog:
+  exclude:
+    authors:
+      - dependabot
+  categories:
+    - title: 🎉 New Features
+      labels:
+        - "Type: Enhancement"
+    - title: 🐞 Bug Fixes
+      labels:
+        - "Type: Bug" 
+    - title: 🔨 Maintenance
+      labels:
+        - "Type: Maintenance" 
+    - title: Other Changes
+      labels:
+        - "*"
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
@@ -24,7 +24,7 @@ jobs:
         uses: golangci/golangci-lint-action@v3
         with:
           # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-          version: v1.61.0
+          version: v1.61
           args: --timeout=5m
 
           # Optional: working directory, useful for monorepos
diff --git a/.github/workflows/release-binary.yml b/.github/workflows/release-binary.yml
@@ -0,0 +1,31 @@
+name: 🎉 Release Binary
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Check out code"
+        uses: actions/checkout@v3
+        with: 
+          fetch-depth: 0
+
+      - name: "Set up Go"
+        uses: actions/setup-go@v4
+        with: 
+          go-version: 1.23.x
+
+      - name: "Create release on GitHub"
+        timeout-minutes: 10
+        uses: goreleaser/goreleaser-action@v4
+        with: 
+          args: "release --clean"
+          version: latest
+          workdir: .
+        env: 
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/release-test.yml b/.github/workflows/release-test.yml
@@ -0,0 +1,28 @@
+name: 🔨 Release Test
+
+on:
+  pull_request:
+    paths:
+      - '**.go'
+      - '**.mod'
+  workflow_dispatch:
+
+jobs:
+  release-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Check out code"
+        uses: actions/checkout@v3
+        with: 
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: 1.23.x
+      
+      - name: release test
+        uses: goreleaser/goreleaser-action@v4
+        with:
+          args: "release --clean --snapshot"
+          version: latest
diff --git a/.golangci.yml b/.golangci.yml
@@ -33,7 +33,6 @@ linters:
     - staticcheck
     - stylecheck
     - testpackage
-    - typecheck
     - unconvert
     - unparam
     - unused
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
@@ -0,0 +1,41 @@
+release:
+  header: |
+    ## pphack {{ .Tag }} 🥳
+    *The Most Advanced Client-Side Prototype Pollution Scanner*
+
+  footer: |
+      If you encounter a problem, just open an [issue](https://github.com/edoardottt/pphack/issues)
+
+before:
+  hooks:
+    - go mod tidy
+
+builds:
+  - env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - windows
+      - darwin
+    goarch:
+      - amd64
+      - 386
+      - arm
+      - arm64
+    ignore:
+      - goos: darwin
+        goarch: '386'
+      - goos: windows
+        goarch: 'arm'
+      - goos: windows
+        goarch: 'arm64'
+    binary: '{{ .ProjectName }}'
+    main: ./cmd/pphack/
+
+archives:
+- format: zip
+  name_template: '{{ .ProjectName }}_{{ .Version }}_{{ if eq .Os "darwin" }}macOS{{ else }}{{ .Os }}{{ end }}_{{ .Arch }}'
+
+checksum:
+  algorithm: sha256
+
diff --git a/README.md b/README.md
@@ -45,6 +45,8 @@ Install 📡
 go install github.com/edoardottt/pphack/cmd/pphack@latest
 ```
 
+pphack relies on [`chromedp`](https://github.com/chromedp/chromedp), so you need a Chrome or Chromium browser.
+
 Get Started 🎉
 ----------
 
@@ -75,6 +77,7 @@ OUTPUT:
    -o, -output string  File to write output results
    -v, -verbose        Verbose output
    -s, -silent         Silent output. Print only results
+   -j, -json           JSON output
 ```
 
 Examples 💡
@@ -124,4 +127,4 @@ License 📝
 -------
 
 This repository is under [MIT License](https://github.com/edoardottt/pphack/blob/main/LICENSE).  
-[edoardoottavianelli.it](https://www.edoardoottavianelli.it) to contact me.
+[edoardottt.com](https://edoardottt.com/) to contact me.
diff --git a/pkg/input/flags.go b/pkg/input/flags.go
@@ -41,6 +41,7 @@ type Options struct {
 	RateLimit   int
 	Silent      bool
 	Verbose     bool
+	JSON        bool
 }
 
 func (options *Options) configureOutput() {
@@ -89,6 +90,7 @@ func ParseOptions() *Options {
 		flagSet.StringVarP(&options.FileOutput, "output", "o", "", `File to write output results`),
 		flagSet.BoolVarP(&options.Verbose, "verbose", "v", false, `Verbose output`),
 		flagSet.BoolVarP(&options.Silent, "silent", "s", false, `Silent output. Print only results`),
+		flagSet.BoolVarP(&options.JSON, "json", "j", false, `JSON output`),
 	)
 
 	if help() || noArgs() {
diff --git a/pkg/output/banner.go b/pkg/output/banner.go
@@ -11,7 +11,7 @@ import "github.com/projectdiscovery/gologger"
 var printed = false
 
 const (
-	Version = "v0.1.0"
+	Version = "v0.0.5"
 	banner  = `                 __               __  
     ____  ____  / /_  ____ ______/ /__
    / __ \/ __ \/ __ \/ __ ` + "`" + `/ ___/ //_/
diff --git a/pkg/output/json.go b/pkg/output/json.go
@@ -0,0 +1,32 @@
+/*
+pphack - The Most Advanced Client-Side Prototype Pollution Scanner
+
+This repository is under MIT License https://github.com/edoardottt/pphack/blob/main/LICENSE
+*/
+
+package output
+
+import "encoding/json"
+
+// JSONData.
+type JSONData struct {
+	URL          string `json:"URL,omitempty"`
+	JSEvaluation string `json:"JSEvaluation,omitempty"`
+	Error        string `json:"Error,omitempty"`
+}
+
+// FormatJSON returns the input as JSON string.
+func FormatJSON(url, jsEval, e string) ([]byte, error) {
+	input := &JSONData{
+		URL:          url,
+		JSEvaluation: jsEval,
+		Error:        e,
+	}
+
+	jsonOutput, err := json.Marshal(input)
+	if err != nil {
+		return nil, err
+	}
+
+	return jsonOutput, nil
+}
diff --git a/pkg/output/json_test.go b/pkg/output/json_test.go
@@ -0,0 +1,58 @@
+/*
+pphack - The Most Advanced Client-Side Prototype Pollution Scanner
+
+This repository is under MIT License https://github.com/edoardottt/pphack/blob/main/LICENSE
+*/
+
+package output_test
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/edoardottt/pphack/pkg/output"
+)
+
+func TestFormatJSON(t *testing.T) {
+	tests := []struct {
+		name  string
+		input output.JSONData
+		want  string
+	}{
+		{name: "no error",
+			input: output.JSONData{
+				URL: "https://edoardottt.github.io/pp-test?constructor.prototype.oigczu=oigczu\u0026__proto__[oigczu]=" +
+					"oigczu\u0026constructor[prototype][oigczu]=oigczu\u0026__proto__.oigczu=oigczu\u0026__proto__." +
+					"oigczu=1|2|3\u0026__proto__[oigczu]={\"json\":\"value\"}#__proto__[oigczu]=oigczu",
+				JSEvaluation: "oigczu",
+				Error:        "",
+			},
+			want: `{"URL":"https://edoardottt.github.io/pp-test?constructor.prototype.oigczu=oigczu\u0026__proto__` +
+				`[oigczu]=oigczu\u0026constructor[prototype][oigczu]=oigczu\u0026__proto__.oigczu=oigczu\u0026__proto__.` +
+				`oigczu=1|2|3\u0026__proto__[oigczu]={\"json\":\"value\"}#__proto__[oigczu]=oigczu","JSEvaluation":"oigczu"}`,
+		},
+		{name: "error",
+			input: output.JSONData{
+				URL: "https://edoardottt.github.io/pp-tes?constructor.prototype.sqtiwx=sqtiwx\u0026__proto__[sqtiwx]" +
+					"=sqtiwx\u0026constructor[prototype][sqtiwx]=sqtiwx\u0026__proto__.sqtiwx=sqtiwx\u0026__proto__." +
+					"sqtiwx=1|2|3\u0026__proto__[sqtiwx]={\"json\":\"value\"}#__proto__[sqtiwx]=sqtiwx",
+				JSEvaluation: "",
+				Error:        "encountered an undefined value",
+			},
+			want: `{"URL":"https://edoardottt.github.io/pp-tes?constructor.prototype.sqtiwx=sqtiwx\u0026__proto__[sqtiwx]` +
+				`=sqtiwx\u0026constructor[prototype][sqtiwx]=sqtiwx\u0026__proto__.sqtiwx=sqtiwx\u0026__proto__.` +
+				`sqtiwx=1|2|3\u0026__proto__[sqtiwx]={\"json\":\"value\"}#__proto__[sqtiwx]=` +
+				`sqtiwx","Error":"encountered an undefined value"}`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, _ := output.FormatJSON(tt.input.URL, tt.input.JSEvaluation, tt.input.Error)
+			if !reflect.DeepEqual(string(got), tt.want) {
+				t.Errorf("GetJSONString\n%v", string(got))
+				t.Errorf("want\n%v", tt.want)
+			}
+		})
+	}
+}
diff --git a/pkg/scan/runner.go b/pkg/scan/runner.go
@@ -110,9 +110,7 @@ func (r *Runner) Run() {
 			for value := range r.InputChan {
 				targetURL, err := PrepareURL(value, testPayload)
 				if err != nil {
-					if r.Options.Verbose {
-						gologger.Error().Msg(err.Error())
-					}
+					verboseOutput(r, value, err)
 				}
 
 				ctx, cancel := context.WithTimeout(pctx, time.Second*time.Duration(r.Options.Timeout))
@@ -122,13 +120,15 @@ func (r *Runner) Run() {
 
 				res, err := Scan(ctx, headers, js, targetURL)
 				if err != nil {
-					if r.Options.Verbose {
-						gologger.Error().Msg(err.Error())
-					}
+					verboseOutput(r, targetURL, err)
 				}
 
 				if resTrimmed := strings.TrimSpace(res); resTrimmed != "" {
-					writeOutput(r, targetURL)
+					if err != nil {
+						writeOutput(r, targetURL, res, err.Error())
+					} else {
+						writeOutput(r, targetURL, res, "")
+					}
 				}
 
 				cancel()
@@ -143,13 +143,13 @@ func (r *Runner) Run() {
 	wg.Wait()
 }
 
-func writeOutput(r *Runner, targetURL string) {
-	if !r.Result.Printed(targetURL) {
-		write(r.OutMutex, &r.Options, targetURL)
+func writeOutput(r *Runner, url, jsEval, err string) {
+	if !r.Result.Printed(url) {
+		write(r.OutMutex, &r.Options, url, jsEval, err)
 	}
 }
 
-func write(m *sync.Mutex, options *input.Options, o string) {
+func write(m *sync.Mutex, options *input.Options, u, jse, e string) {
 	if options.FileOutput != "" && options.Output == nil {
 		file, err := os.OpenFile(options.FileOutput, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0644)
 		if err != nil {
@@ -159,15 +159,44 @@ func write(m *sync.Mutex, options *input.Options, o string) {
 		options.Output = file
 	}
 
+	var (
+		o   []byte
+		err error
+	)
+
+	if options.JSON {
+		o, err = output.FormatJSON(u, jse, e)
+		if err != nil {
+			gologger.Fatal().Msg(err.Error())
+		}
+	} else {
+		o = []byte(u)
+	}
+
 	m.Lock()
 
 	if options.Output != nil {
-		if _, err := options.Output.Write([]byte(o + "\n")); err != nil && options.Verbose {
+		if _, err := options.Output.Write([]byte(string(o) + "\n")); err != nil && options.Verbose {
 			gologger.Fatal().Msg(err.Error())
 		}
 	}
 
 	m.Unlock()
 
-	fmt.Println(o)
+	fmt.Println(string(o))
+}
+
+func verboseOutput(r *Runner, value string, err error) {
+	if r.Options.Verbose {
+		if r.Options.JSON {
+			o, err := output.FormatJSON(value, "", err.Error())
+			if err != nil {
+				gologger.Error().Msg(err.Error())
+			}
+
+			fmt.Println(string(o))
+		} else {
+			gologger.Error().Msg(err.Error())
+		}
+	}
 }
diff --git a/snapcraft.yaml b/snapcraft.yaml
@@ -2,7 +2,7 @@ name: pphack
 summary: The Most Advanced Client-Side Prototype Pollution Scanner
 description: |
       The Most Advanced Client-Side Prototype Pollution Scanner
-version: 0.1.0
+version: 0.0.5
 grade: stable
 base: core20
 

Original file line number	Diff line number	Diff line change
`@@ -41,6 +41,7 @@ type Options struct {`
`41`	`41`	`RateLimit int`
`42`	`42`	`Silent bool`
`43`	`43`	`Verbose bool`
	`44`	`+ JSON bool`
`44`	`45`	`}`
`45`	`46`
`46`	`47`	`func (options *Options) configureOutput() {`
`@@ -89,6 +90,7 @@ func ParseOptions() *Options {`
`89`	`90`	flagSet.StringVarP(&options.FileOutput, "output", "o", "", `File to write output results`),
`90`	`91`	flagSet.BoolVarP(&options.Verbose, "verbose", "v", false, `Verbose output`),
`91`	`92`	flagSet.BoolVarP(&options.Silent, "silent", "s", false, `Silent output. Print only results`),
	`93`	+ flagSet.BoolVarP(&options.JSON, "json", "j", false, `JSON output`),
`92`	`94`	`)`
`93`	`95`
`94`	`96`	`if help() \|\| noArgs() {`