library/src/exploitation/WebExploitation/BP-WebExploitation.cc
// Generates a form input string suitable for xss testing
Generates a form input string suitable for xss testing
Generates a form input string suitable for xss testing
char * BP_WebAssessmentGenerateXSSFormTestSet
(
		P_BP_WEB_XSS_TEST           test,
		P_BP_HTML_FORM_LIST         form,
		P_BP_HTML_ANCHOR_DELIMITERS delims,
		char *                      asciiXSSPayload,
		size_t                      subAtPosition
)
{
	if (!form || !delims || !asciiXSSPayload)
		return NULL;
	if (!form->inputs)
		return NULL;
	size_t setSize = 0;
	setSize += bpstrlen(test->testFront);
	setSize += bpstrlen(test->testTail);
	setSize += delims->sLen;
	setSize += bpstrlen(asciiXSSPayload);
	P_BP_HTML_INPUT_PROPERTY_LIST tmpName  = NULL;
	P_BP_HTML_INPUT_PROPERTY_LIST tmpValue = NULL;
	P_BP_HTML_INPUT_LIST inputsFirst = form->inputs->first;
	P_BP_HTML_INPUT_LIST inputs = form->inputs->first;
	for
	(
		inputs = inputsFirst;
		inputs;
		inputs = inputs->next
	)
	{
		tmpName = HTMLGetInputPropertyByNameI(inputs->properties, "name");
		if (!tmpName)
			continue;
		setSize += tmpName->nLen;
		setSize += tmpName->cLen;
		tmpValue = HTMLGetInputPropertyByNameI(inputs->properties, "value");
		if (!tmpValue)
		{
			setSize += 1024;
		}
		else
		{
			setSize += tmpValue->nLen;
			setSize += tmpValue->cLen;
		}
		setSize += delims->vLen;
		setSize += delims->nLen;
	}
	inputs = inputsFirst;
	char *embedStr = (char *) bpcalloc(setSize + 4096, 1);
	if (!embedStr)
		return NULL;
	size_t posCounter = 0;
	for
	(
		inputs = inputs->first;
		inputs;
		inputs = inputs->next
	)
	{
		if (posCounter == subAtPosition)
		{
			tmpName = HTMLGetInputPropertyByNameI(inputs->properties, "name");
			if (!tmpName)
				break;
			snprintf(&embedStr[bpstrlen(embedStr)], setSize, "%s%s%s%s%s", tmpName->content, delims->valueDelimiter, test->testFront, asciiXSSPayload,
					test->testTail);
		}
		else
		{
			tmpName = HTMLGetInputPropertyByNameI(inputs->properties, "name");
			if (!tmpName)
				break;
			tmpValue = HTMLGetInputPropertyByNameI(inputs->properties, "value");
			if (!tmpValue)
			{
				snprintf(&embedStr[bpstrlen(embedStr)], setSize, "%s%s%s", tmpName->content, delims->valueDelimiter, "ABC");
			}
			else
			{
				snprintf(&embedStr[bpstrlen(embedStr)], setSize, "%s%s%s", tmpName->content, delims->valueDelimiter, tmpValue->content);
			}
		}
		strncat(embedStr, delims->nextDelimiter, delims->nLen);
		posCounter++;
	}
	if(bpstrlen(embedStr))
	if (embedStr[bpstrlen(embedStr) - 1] == (char) delims->nextDelimiter[0])
		embedStr[bpstrlen(embedStr) - 1] = '\0';
	return embedStr;
}
char * BP_WebAssessmentGenerateXSSFormTestSet ( P_BP_WEB_XSS_TEST test , P_BP_HTML_FORM_LIST form , P_BP_HTML_ANCHOR_DELIMITERS delims , char * asciiXSSPayload , size_t subAtPosition ) { if ( ! form || ! delims || ! asciiXSSPayload ) return NULL ; if ( ! form -> inputs ) return NULL ; size_t setSize = 0 ; setSize += bpstrlen ( test -> testFront ) ; setSize += bpstrlen ( test -> testTail ) ; setSize += delims -> sLen ; setSize += bpstrlen ( asciiXSSPayload ) ; P_BP_HTML_INPUT_PROPERTY_LIST tmpName = NULL ; P_BP_HTML_INPUT_PROPERTY_LIST tmpValue = NULL ; P_BP_HTML_INPUT_LIST inputsFirst = form -> inputs -> first ; P_BP_HTML_INPUT_LIST inputs = form -> inputs -> first ; for ( inputs = inputsFirst ; inputs ; inputs = inputs -> next ) { tmpName = HTMLGetInputPropertyByNameI ( inputs -> properties , " " ) ; if ( ! tmpName ) continue ; setSize += tmpName -> nLen ; setSize += tmpName -> cLen ; tmpValue = HTMLGetInputPropertyByNameI ( inputs -> properties , " " ) ; if ( ! tmpValue ) { setSize += 1024 ; } else { setSize += tmpValue -> nLen ; setSize += tmpValue -> cLen ; } setSize += delims -> vLen ; setSize += delims -> nLen ; } inputs = inputsFirst ; char * embedStr = ( char * ) bpcalloc ( setSize + 4096 , 1 ) ; if ( ! embedStr ) return NULL ; size_t posCounter = 0 ; for ( inputs = inputs -> first ; inputs ; inputs = inputs -> next ) { if ( posCounter == subAtPosition ) { tmpName = HTMLGetInputPropertyByNameI ( inputs -> properties , " " ) ; if ( ! tmpName ) break ; snprintf ( & embedStr [ bpstrlen ( embedStr ) ] , setSize , " " , tmpName -> content , delims -> valueDelimiter , test -> testFront , asciiXSSPayload , test -> testTail ) ; } else { tmpName = HTMLGetInputPropertyByNameI ( inputs -> properties , " " ) ; if ( ! tmpName ) break ; tmpValue = HTMLGetInputPropertyByNameI ( inputs -> properties , " " ) ; if ( ! tmpValue ) { snprintf ( & embedStr [ bpstrlen ( embedStr ) ] , setSize , " " , tmpName -> content , delims -> valueDelimiter , " " ) ; } else { snprintf ( & embedStr [ bpstrlen ( embedStr ) ] , setSize , " " , tmpName -> content , delims -> valueDelimiter , tmpValue -> content ) ; } } strncat ( embedStr , delims -> nextDelimiter , delims -> nLen ) ; posCounter ++ ; } if ( bpstrlen ( embedStr ) ) if ( embedStr [ bpstrlen ( embedStr ) - 1 ] == ( char ) delims -> nextDelimiter [ 0 ] ) embedStr [ bpstrlen ( embedStr ) - 1 ] = ' \0 ' ; return embedStr ; }
Generates a form input string suitable for xss testing
Generates a form input string suitable for xss testing
// NULL Checks // form must have inputs (return null otherwise) // Length calculation variable // Add the length of the test // Append size of start delimiter // used in the loop below for form input calculations (not allocated) // Save first pointer // walk the list and grow buffer to an appropriate size // walk the inputs // value does not have to be set arbitrarily by the developer, if not set // add an arbitrary 1024 bytes to the buffer. // reset pointer // precision allocation // variable position counter // Walk Variable List // Value does not have to be set, if its not set use the string ABC // append next delimiter // increments to determine proper replacements // remove last next delimiter // return allocated string