library/src/exploitation/WebExploitation/BP-WebExploitationExploitRequestSets.cc
// Run exploit request set.  Retry count the number of retries to
// retry a request in the case of a failedHTTPRequest.  If proxy subsystem
// is enabled, each retry will use a new proxy.
Run exploit request set.  Retry count the number of retries to
retry a request in the case of a failedHTTPRequest.  If proxy subsystem
is enabled, each retry will use a new proxy.
Run exploit request set . Retry count the number of retries to retry a request in the case of a failedHTTPRequest . If proxy subsystem is enabled each retry will use a new proxy .
BP_ERROR_T BP_RunWebExploitRequestSet(P_BP_WEB_ASSESSMENT assessment, P_BP_WEB_EXPLOIT_REQUEST_SET ers, size_t retry_count)
{
	if(!ers)
		return ERR_FAILURE;
	if(!assessment)
		return ERR_FAILURE;
	if(!assessment->session)
		return ERR_FAILURE;
	assessment->session->last_request_was_blacklisted = 0;
	if(assessment->audit_blacklist)
	if(assessment->audit_blacklist[0])
	{
		size_t blacklist_len = BP_CountNullTerminatedPtrArray(assessment->audit_blacklist);
		size_t blacklist_match_position = BP_StringMatchesBlacklistREGEXP(assessment->audit_blacklist, blacklist_len, ers->get_str);
		printf("\n [+] Request blacklist JIT testing: [p:%u], %s", blacklist_match_position, ers->get_str);
		if(blacklist_match_position)
		{
			printf("\n [+] Request blacklist JIT matched and blocked: [p:%u], %s", blacklist_match_position, ers->get_str );
			assessment->session->last_request_was_blacklisted = 1;
			return ERR_FAILURE;
		}
	}
	assessment->session->last_request_was_blacklisted = 0;
	if(assessment->audit_whitelist)
	if(assessment->audit_whitelist[0])
	{
		size_t whitelist_len = BP_CountNullTerminatedPtrArray(assessment->audit_whitelist);
		size_t whitelist_match_position = BP_StringMatchesBlacklistREGEXP(assessment->audit_whitelist, whitelist_len, ers->get_str);
		printf("\n [+] Request whitelist JIT testing: [p:%u], %s", whitelist_match_position, ers->get_str);
		if(!whitelist_match_position)
		{
			printf("\n [+] Request whitelist JIT NOT matched and thereby disgarded: [p:%u], %s", whitelist_match_position, ers->get_str );
			assessment->session->last_request_was_blacklisted = 1;
			return ERR_FAILURE;
		}
	}
	size_t http_status = 0;
	size_t insert_id = 0;
	if(assessment->db_log_mysql_session)
	{
		insert_id = BP_LogWebExploitRequestSetInDB(assessment->db_log_mysql_session, ers, assessment->db_result_id);
		if(insert_id)
		{
			assessment->db_http_last_request_made_id = insert_id;
		}
		else
		{
			printf("\n [!!] Failed to log exploit request set in the database (no insert_id was created)");
			return ERR_FAILURE;
		}
	}
	size_t audit_retry_request_iter = 0;
	size_t request_completed_successfully = 1;
	if(ers->post_str)
		BP_HTTPSetPostVars(assessment->session, ers->post_str);
	while(BP_HTTPRequest(assessment->session, ers->get_str) == ERR_FAILURE)
	{
		if(assessment->session->last_request_was_blacklisted)
			return ERR_FAILURE;
		curl_easy_getinfo(assessment->session->curl, CURLINFO_RESPONSE_CODE, (long *) &ers->http_response_code);
		if(ers->http_response_code)
		if(assessment->db_log_mysql_session)
		{
			BP_WebExploitationRequestUpdateHTTPStatus(assessment->db_log_mysql_session, insert_id, ers->http_response_code, 0);
		}
		if(ers->http_response_code >= 500 && ers->http_response_code < 600)
		{
			printf("\n [+] Internal server error on exploit set (directly follows):");
			BP_DisplayExploitRequestSet(ers);
			break;
		}
		if(ers->http_response_code >= 300 && ers->http_response_code < 400)
		{
			break;
		}
		if(ers->http_response_code >= 200 && ers->http_response_code < 300)
		{
			break;
		}
		audit_retry_request_iter++;
		if(audit_retry_request_iter > retry_count)
		{
			printf("\n [+] Exploit request limit exceeded.  Most likely bad request.");
			return ERR_FAILURE;
		}
	}
	curl_easy_getinfo(assessment->session->curl, CURLINFO_RESPONSE_CODE, (long *) &ers->http_response_code);
	if(ers->http_response_code)
	if(assessment->db_log_mysql_session)
	{
		BP_WebExploitationRequestUpdateHTTPStatus(assessment->db_log_mysql_session, insert_id, ers->http_response_code, 0);
	}
	if(ers->http_response_code >= 400 && ers->http_response_code < 500)
	{
	}
	if(ers->http_response_code >= 500 && ers->http_response_code < 600)
	{
		printf("\n [+] Internal server error on exploit set (directly follows):");
		BP_DisplayExploitRequestSet(ers);
	}
	if(ers->http_response_code >= 300 && ers->http_response_code < 400)
	{
	}
	if(ers->http_response_code >= 200 && ers->http_response_code < 300)
	{
	}
	return ERR_SUCCESS;
}
BP_ERROR_T BP_RunWebExploitRequestSet ( P_BP_WEB_ASSESSMENT assessment , P_BP_WEB_EXPLOIT_REQUEST_SET ers , size_t retry_count ) { if ( ! ers ) return ERR_FAILURE ; if ( ! assessment ) return ERR_FAILURE ; if ( ! assessment -> session ) return ERR_FAILURE ; assessment -> session -> last_request_was_blacklisted = 0 ; if ( assessment -> audit_blacklist ) if ( assessment -> audit_blacklist [ 0 ] ) { size_t blacklist_len = BP_CountNullTerminatedPtrArray ( assessment -> audit_blacklist ) ; size_t blacklist_match_position = BP_StringMatchesBlacklistREGEXP ( assessment -> audit_blacklist , blacklist_len , ers -> get_str ) ; printf ( " \n " , blacklist_match_position , ers -> get_str ) ; if ( blacklist_match_position ) { printf ( " \n " , blacklist_match_position , ers -> get_str ) ; assessment -> session -> last_request_was_blacklisted = 1 ; return ERR_FAILURE ; } } assessment -> session -> last_request_was_blacklisted = 0 ; if ( assessment -> audit_whitelist ) if ( assessment -> audit_whitelist [ 0 ] ) { size_t whitelist_len = BP_CountNullTerminatedPtrArray ( assessment -> audit_whitelist ) ; size_t whitelist_match_position = BP_StringMatchesBlacklistREGEXP ( assessment -> audit_whitelist , whitelist_len , ers -> get_str ) ; printf ( " \n " , whitelist_match_position , ers -> get_str ) ; if ( ! whitelist_match_position ) { printf ( " \n " , whitelist_match_position , ers -> get_str ) ; assessment -> session -> last_request_was_blacklisted = 1 ; return ERR_FAILURE ; } } size_t http_status = 0 ; size_t insert_id = 0 ; if ( assessment -> db_log_mysql_session ) { insert_id = BP_LogWebExploitRequestSetInDB ( assessment -> db_log_mysql_session , ers , assessment -> db_result_id ) ; if ( insert_id ) { assessment -> db_http_last_request_made_id = insert_id ; } else { printf ( " \n " ) ; return ERR_FAILURE ; } } size_t audit_retry_request_iter = 0 ; size_t request_completed_successfully = 1 ; if ( ers -> post_str ) BP_HTTPSetPostVars ( assessment -> session , ers -> post_str ) ; while ( BP_HTTPRequest ( assessment -> session , ers -> get_str ) == ERR_FAILURE ) { if ( assessment -> session -> last_request_was_blacklisted ) return ERR_FAILURE ; curl_easy_getinfo ( assessment -> session -> curl , CURLINFO_RESPONSE_CODE , ( long * ) & ers -> http_response_code ) ; if ( ers -> http_response_code ) if ( assessment -> db_log_mysql_session ) { BP_WebExploitationRequestUpdateHTTPStatus ( assessment -> db_log_mysql_session , insert_id , ers -> http_response_code , 0 ) ; } if ( ers -> http_response_code >= 500 && ers -> http_response_code < 600 ) { printf ( " \n " ) ; BP_DisplayExploitRequestSet ( ers ) ; break ; } if ( ers -> http_response_code >= 300 && ers -> http_response_code < 400 ) { break ; } if ( ers -> http_response_code >= 200 && ers -> http_response_code < 300 ) { break ; } audit_retry_request_iter ++ ; if ( audit_retry_request_iter > retry_count ) { printf ( " \n " ) ; return ERR_FAILURE ; } } curl_easy_getinfo ( assessment -> session -> curl , CURLINFO_RESPONSE_CODE , ( long * ) & ers -> http_response_code ) ; if ( ers -> http_response_code ) if ( assessment -> db_log_mysql_session ) { BP_WebExploitationRequestUpdateHTTPStatus ( assessment -> db_log_mysql_session , insert_id , ers -> http_response_code , 0 ) ; } if ( ers -> http_response_code >= 400 && ers -> http_response_code < 500 ) { } if ( ers -> http_response_code >= 500 && ers -> http_response_code < 600 ) { printf ( " \n " ) ; BP_DisplayExploitRequestSet ( ers ) ; } if ( ers -> http_response_code >= 300 && ers -> http_response_code < 400 ) { } if ( ers -> http_response_code >= 200 && ers -> http_response_code < 300 ) { } return ERR_SUCCESS ; }
Run exploit request set.
Run exploit request set .
// ############################################################### // ####### Check Assessment Request Blacklist First ############## // ############################################################### // reset blacklist toggle // run blacklist check if set // get the length of the blacklist // run the blacklist testing algorithm // if blacklist matched position return err failure // ############################################################### // ####### Check Assessment Request Whitelist Second ############# // ############################################################### // reset whitelist toggle // run blacklist check if set // get the length of the whitelist // run the whitelist testing algorithm // if blacklist matched position return err failure // ############################################################### // ## Process Database Operations (Request Logging) ############## // ############################################################### // holds the http status code returned // holds an insert id if the record is inserted into the database successfully // log the request if set // log the exploit request set // set the insert id //  Uncommenting this causes a segfault, we need to find out why.  It causes a statement mismatch. /*
			http_status = BP_WebExploitationRequestSetCheckHTTPStatusForDBID(assessment->db_log_mysql_session, insert_id);
			if(http_status != 0)
			{
				printf("\n [!!] Failed to log exploit request set in the database (http_status was zero)");
				return ERR_FAILURE;
			}
			*/ // ############################################################### // ####### Set GET/POST and Run Request ########################## // ############################################################### // set audit retry request iter to zero // This is toggled off if a request fails.  Defaults to 1. // set post data if it exists // attempt to make request using the session // exit if the request was blacklisted // get the http status code returned from the server // if logging is turned on, update the status code if its not 0 // check the http response code // printf("\n Got 200 status code."); // check for good pages with 0 lengths // printf("\n Got 200 status code."); // increment requests //  run a check and exit in the case that the request simply will not run // display error message // get the http status code returned from the server // if logging is turned on, update the status code if its not 0 // check the http response code // 400 is valid, we shouldn't exit failure here, as we could find // errors in 400 pages. // return ERR_FAILURE; // check the http response code // printf("\n [+] Page relocation (status 300 request NOT FOLLOWED."); // check for good pages with 0 lengths // printf("\n Got 200 status code."); // return indicating success