library/src/exploitation/WebExploitation/BP-WebExploitation.cc
// Generates a url suitable for XSS testing
Generates a url suitable for XSS testing
Generates a url suitable for XSS testing
char * BP_WebAssessmentGenerateXSSAnchorTestSet
(
	char *                      baseTestURL,
	P_BP_WEB_XSS_TEST           test,
	P_BP_HTML_ANCHOR_VAR_LIST   vars,
	P_BP_HTML_ANCHOR_DELIMITERS delims,
	char *                      asciiXSSPayload,
	size_t                      subAtPosition
)
{
	if (!baseTestURL || !vars || !delims || !asciiXSSPayload)
		return NULL;
	if(!test->testFront || !test->testTail)
		return NULL;
	size_t setSize = bpstrlen(baseTestURL);
	setSize += bpstrlen(test->testFront);
	setSize += bpstrlen(test->testTail);
	setSize += delims->sLen;
	setSize += bpstrlen(asciiXSSPayload);
	P_BP_HTML_ANCHOR_VAR_LIST varsFirst = vars->first;
	for
	(
		vars = vars->first;
		vars != NULL;
		vars = vars->next
	)
	{
		setSize += vars->nameLen;
		setSize += vars->contentLen;
		setSize += delims->vLen;
		setSize += delims->nLen;
	}
	vars = varsFirst;
	char *embedStr = (char *) bpcalloc(setSize + 4096, 1);
	if (!embedStr)
		return NULL;
	memcpy(embedStr, baseTestURL, bpstrlen(baseTestURL));
	size_t posCounter = 0;
	memcpy(&embedStr[bpstrlen(embedStr)], delims->startDelimiter, bpstrlen(delims->startDelimiter));
	for
	(
		vars = vars->first;
		vars;
		vars = vars->next
	)
	{
		if (posCounter == subAtPosition)
		{
			snprintf(&embedStr[bpstrlen(embedStr)], setSize, "%s%s%s%s%s", vars->name, delims->valueDelimiter, test->testFront, asciiXSSPayload, test->testTail);
		}
		else
		{
			snprintf(&embedStr[bpstrlen(embedStr)], setSize, "%s%s%s", vars->name, delims->valueDelimiter, vars->content);
		}
		strncat(embedStr, delims->nextDelimiter, delims->nLen);
		posCounter++;
	}
	if (embedStr[bpstrlen(embedStr) - 1] == (char) delims->nextDelimiter[0])
		embedStr[bpstrlen(embedStr) - 1] = '\0';
	return embedStr;
}
char * BP_WebAssessmentGenerateXSSAnchorTestSet ( char * baseTestURL , P_BP_WEB_XSS_TEST test , P_BP_HTML_ANCHOR_VAR_LIST vars , P_BP_HTML_ANCHOR_DELIMITERS delims , char * asciiXSSPayload , size_t subAtPosition ) { if ( ! baseTestURL || ! vars || ! delims || ! asciiXSSPayload ) return NULL ; if ( ! test -> testFront || ! test -> testTail ) return NULL ; size_t setSize = bpstrlen ( baseTestURL ) ; setSize += bpstrlen ( test -> testFront ) ; setSize += bpstrlen ( test -> testTail ) ; setSize += delims -> sLen ; setSize += bpstrlen ( asciiXSSPayload ) ; P_BP_HTML_ANCHOR_VAR_LIST varsFirst = vars -> first ; for ( vars = vars -> first ; vars != NULL ; vars = vars -> next ) { setSize += vars -> nameLen ; setSize += vars -> contentLen ; setSize += delims -> vLen ; setSize += delims -> nLen ; } vars = varsFirst ; char * embedStr = ( char * ) bpcalloc ( setSize + 4096 , 1 ) ; if ( ! embedStr ) return NULL ; memcpy ( embedStr , baseTestURL , bpstrlen ( baseTestURL ) ) ; size_t posCounter = 0 ; memcpy ( & embedStr [ bpstrlen ( embedStr ) ] , delims -> startDelimiter , bpstrlen ( delims -> startDelimiter ) ) ; for ( vars = vars -> first ; vars ; vars = vars -> next ) { if ( posCounter == subAtPosition ) { snprintf ( & embedStr [ bpstrlen ( embedStr ) ] , setSize , " " , vars -> name , delims -> valueDelimiter , test -> testFront , asciiXSSPayload , test -> testTail ) ; } else { snprintf ( & embedStr [ bpstrlen ( embedStr ) ] , setSize , " " , vars -> name , delims -> valueDelimiter , vars -> content ) ; } strncat ( embedStr , delims -> nextDelimiter , delims -> nLen ) ; posCounter ++ ; } if ( embedStr [ bpstrlen ( embedStr ) - 1 ] == ( char ) delims -> nextDelimiter [ 0 ] ) embedStr [ bpstrlen ( embedStr ) - 1 ] = ' \0 ' ; return embedStr ; }
Generates a url suitable for XSS testing
Generates a url suitable for XSS testing
// NULL Checks // test front and tail cannot either be null // Add the length of the base url // Add the length of the test // Append size of start delimiter // Save first pointer // reset pointer // precision allocation // a rose by any other name // variable position counter // copy in start delimiter // Walk Variable List // if the position indicates we're at the subsitution position, set things up as such // append next delimiter // increments to determine proper replacements // remove last next delimiter // return allocated string