Skip to content

Commit a4cd039

Browse files
DeliciousBountyDeliciousBounty
committed
fixed output
1 parent 8a11ec1 commit a4cd039

File tree

6 files changed

+172
-176
lines changed

6 files changed

+172
-176
lines changed

‎cherrybomb-engine/src/lib.rs‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -93,13 +93,16 @@ async fn run_active_profile(
9393
oas: &OAS3_1,
9494
oas_json: &Value,
9595
) -> anyhow::Result<Value> {
96-
9796
//creating a server struct from config
98-
let serv: Vec<Server> = config.servers_override.iter().map(|url| Server {
99-
base_url: url.to_owned(),
100-
description: None,
101-
variables: None,
102-
}).collect::<Vec<Server>>();
97+
let serv: Vec<Server> = config
98+
.servers_override
99+
.iter()
100+
.map(|url| Server {
101+
base_url: url.to_owned(),
102+
description: None,
103+
variables: None,
104+
})
105+
.collect::<Vec<Server>>();
103106

104107
// Creating active scan struct
105108
verbose_print(
@@ -113,7 +116,7 @@ async fn run_active_profile(
113116
return Err(anyhow::anyhow!("Error creating active scan struct: {}", e));
114117
}
115118
};
116-
119+
117120
// Running active scan
118121
verbose_print(config, None, "Running active scan...");
119122
let temp_auth = Authorization::None;
@@ -182,7 +185,11 @@ async fn run_normal_profile(
182185
Ok(report)
183186
}
184187

185-
async fn run_full_profile(config: &Config, oas: &OAS3_1, oas_json: &Value) -> anyhow::Result<Value> {
188+
async fn run_full_profile(
189+
config: &Config,
190+
oas: &OAS3_1,
191+
oas_json: &Value,
192+
) -> anyhow::Result<Value> {
186193
let mut report = json!({});
187194
let mut results = HashMap::from([
188195
("active", run_active_profile(config, oas, oas_json).await),

‎cherrybomb-engine/src/scan/active/active_scanner.rs‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ use crate::scan::active::http_client::auth::Authorization;
44
use crate::scan::active::utils::send_req;
55
use crate::scan::checks::*;
66
use crate::scan::Level;
7-
use cherrybomb_oas::legacy::legacy_oas::OAS;
87
use cherrybomb_oas::legacy::legacy_oas::Server;
8+
use cherrybomb_oas::legacy::legacy_oas::OAS;
99
use cherrybomb_oas::legacy::path::PathItem;
1010
use cherrybomb_oas::legacy::refs::*;
1111
use cherrybomb_oas::legacy::schema::*;
@@ -84,7 +84,7 @@ impl<T: OAS + Serialize + for<'de> Deserialize<'de>> ActiveScan<T> {
8484
})
8585
}
8686

87-
pub async fn run(&mut self, tp: ActiveScanType, auth: &Authorization, serv : &Vec<Server>) {
87+
pub async fn run(&mut self, tp: ActiveScanType, auth: &Authorization, serv: &Vec<Server>) {
8888
self.path_params = Self::create_hash(self, auth).await;
8989
match tp {
9090
ActiveScanType::Full => {
@@ -99,7 +99,7 @@ impl<T: OAS + Serialize + for<'de> Deserialize<'de>> ActiveScan<T> {
9999
}
100100
ActiveScanType::OnlyTests => {
101101
for check in ActiveChecks::iter() {
102-
self.checks.push(self.run_check(check, auth,serv).await);
102+
self.checks.push(self.run_check(check, auth, serv).await);
103103
}
104104
}
105105
ActiveScanType::Partial(checks) => {
@@ -110,7 +110,6 @@ impl<T: OAS + Serialize + for<'de> Deserialize<'de>> ActiveScan<T> {
110110
};
111111
}
112112

113-
114113
fn payloads_generator(oas: &T, oas_value: &Value) -> Vec<OASMap> {
115114
let mut payloads = vec![];
116115
for (path, path_item) in oas.get_paths() {

‎cherrybomb-engine/src/scan/active/additional_checks.rs‎

Lines changed: 24 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ use crate::active::active_scanner::{ActiveScan, CheckRetVal, ResponseData};
22
use crate::active::http_client::{auth::Authorization, *};
33
use crate::active::utils::create_payload;
44
use crate::scan::Level;
5-
use cherrybomb_oas::legacy::legacy_oas::{OAS, Server};
5+
use cherrybomb_oas::legacy::legacy_oas::{Server, OAS};
66
use cherrybomb_oas::legacy::utils::Method;
77
use serde::Serialize;
88
use serde_json::{json, Value};
@@ -21,12 +21,10 @@ pub fn change_payload(orig: &Value, path: &[String], new_val: Value) -> Value {
2121

2222
impl<T: OAS + Serialize> ActiveScan<T> {
2323
pub async fn check_ssl(&self, auth: &Authorization, serv: &Vec<Server>) -> CheckRetVal {
24-
25-
2624
let mut ret_val = CheckRetVal::default();
27-
25+
2826
let req = AttackRequest::builder()
29-
.servers(self.oas.servers(), false,serv)
27+
.servers(self.oas.servers(), false, serv)
3028
.path("")
3129
.auth(auth.clone())
3230
.parameters(vec![])
@@ -315,8 +313,8 @@ impl<T: OAS + Serialize> ActiveScan<T> {
315313
let req = AttackRequest::builder()
316314
.servers(self.oas.servers(), true)
317315
.method(*m)
318-
// .payload(&oas_map.payload.payload.to_string())
319-
//TODO! create function that translate json payload to XML and vice versa
316+
// .payload(&oas_map.payload.payload.to_string())
317+
//TODO! create function that translate json payload to XML and vice versa
320318
.path(&oas_map.path.path)
321319
.parameters(vec_param)
322320
.auth(auth.clone())
@@ -432,11 +430,11 @@ impl<T: OAS + Serialize> ActiveScan<T> {
432430
for (m, op) in oas_map
433431
.path
434432
.path_item
435-
//.filter(|| path_item==p)
433+
//.filter(|| path_item==p)
436434
.get_ops()
437435
.iter()
438436
.filter(|(m, _)| m == &Method::POST)
439-
//947
437+
//947
440438
{
441439
let param_to_test =
442440
&json_path.last().unwrap_or(&"empty".to_string()).to_owned()[..];
@@ -485,8 +483,8 @@ impl<T: OAS + Serialize> ActiveScan<T> {
485483
}
486484
}
487485
}
488-
// if no param in body req exist in the default array
489-
// so let's check if there is any good param in the query
486+
// if no param in body req exist in the default array
487+
// so let's check if there is any good param in the query
490488
else {
491489
let mut param_is_good_to_send = false;
492490
@@ -552,7 +550,7 @@ impl<T: OAS + Serialize> ActiveScan<T> {
552550
) -> (CheckRetVal, Vec<String>) {
553551
let mut ret_val = CheckRetVal::default();
554552
let mut vec_polluted = vec!["blstparamtopollute".to_string()];
555-
// let base_url = server.unwrap().get(0).unwrap().clone();
553+
// let base_url = server.unwrap().get(0).unwrap().clone();
556554
for (path, item) in &self.oas.get_paths() {
557555
for (m, op) in item.get_ops() {
558556
let _text = path.to_string();
@@ -582,7 +580,7 @@ impl<T: OAS + Serialize> ActiveScan<T> {
582580
.build();
583581
let response_vector =
584582
req.send_request_all_servers(self.verbosity > 0).await;
585-
// dbg!(&response_vector);
583+
// dbg!(&response_vector);
586584
for response in response_vector {
587585
ret_val.1.push(
588586
&req,
@@ -737,7 +735,7 @@ impl<T: OAS + Serialize> ActiveScan<T> {
737735
schema.minimum.map(|min| ("minimum", min - 1.0)),
738736
schema.maximum.map(|max| ("maximum", max + 1.0)),
739737
]);
740-
// dbg!(&test_vals);
738+
// dbg!(&test_vals);
741739
for val in test_vals.into_iter().flatten() {
742740
for (m, op) in oas_map
743741
.path
@@ -799,12 +797,12 @@ impl<T: OAS + Serialize> ActiveScan<T> {
799797
.filter(|key| key.to_lowercase().contains("id"))
800798
.cloned()
801799
.collect::<Vec<String>>();
802-
//dbg!(id_vec);
800+
//dbg!(id_vec);
803801
for (path, item) in &self.oas.get_paths() {
804802
for (_m, op) in item.get_ops().iter().filter(|(m, _)| m == &Method::GET) {
805803
let mut vec_params: Vec<RequestParameter> = Vec::new();
806804
for i in op.params() {
807-
//TODO Check if there is only one param
805+
//TODO Check if there is only one param
808806
let type_param = match i
809807
.inner(&self.oas_value)
810808
.param_in
@@ -818,7 +816,7 @@ impl<T: OAS + Serialize> ActiveScan<T> {
818816
};
819817
if id_vec.contains(&i.inner(&self.oas_value).name) {
820818
vec_params.push(RequestParameter {
821-
// TODO check if others values are ok
819+
// TODO check if others values are ok
822820
name: i.inner(&self.oas_value).name.to_string(),
823821
value: self
824822
.path_params
@@ -827,7 +825,7 @@ impl<T: OAS + Serialize> ActiveScan<T> {
827825
.to_string(),
828826
dm: type_param,
829827
});
830-
//sending the request
828+
//sending the request
831829
let req = AttackRequest::builder()
832830
.uri(server, path)
833831
.parameters(vec_params.clone())
@@ -837,8 +835,8 @@ impl<T: OAS + Serialize> ActiveScan<T> {
837835
.build();
838836
let response_vector = req.send_request(self.verbosity > 0).await;
839837
if let Ok(res) = response_vector {
840-
//logging
841-
//logging request/response/description
838+
//logging
839+
//logging request/response/description
842840
ret_val.1.push(
843841
&req,
844842
&res,
@@ -913,7 +911,7 @@ impl<T: OAS + Serialize> ActiveScan<T> {
913911
let response_vector =
914912
req.send_request(self.verbosity > 0).await;
915913
if let Ok(res) = response_vector {
916-
//logging request/response/description
914+
//logging request/response/description
917915
ret_val.1.push(&req, &res, "Testing for BOLA".to_string());
918916
ret_val.0.push((
919917
ResponseData {
@@ -943,7 +941,7 @@ impl<T: OAS + Serialize> ActiveScan<T> {
943941
let mut ret_val = CheckRetVal::default();
944942
let h = vec![MHeader::from("content-type", "application/json")];
945943
for oas_map in self.payloads.iter() {
946-
//for (_json_path, _schema) in &oas_map.payload.map {
944+
//for (_json_path, _schema) in &oas_map.payload.map {
947945
for _schema in oas_map.payload.map.values() {
948946
for (m, op) in oas_map.path.path_item.get_ops().iter() {
949947
let vec_param = create_payload(
@@ -960,7 +958,7 @@ impl<T: OAS + Serialize> ActiveScan<T> {
960958
.method(*m)
961959
.headers(h.clone())
962960
.parameters(vec_param.clone())
963-
//.auth(auth.clone())
961+
//.auth(auth.clone())
964962
.payload(&oas_map.payload.payload.to_string())
965963
.build();
966964
@@ -988,7 +986,7 @@ impl<T: OAS + Serialize> ActiveScan<T> {
988986
pub async fn check_authentication_for_get(&self, _auth: &Authorization) -> CheckRetVal {
989987
let mut ret_val = CheckRetVal::default();
990988
let _server = self.oas.servers();
991-
// let base_url = server.unwrap().get(0).unwrap().clone();
989+
// let base_url = server.unwrap().get(0).unwrap().clone();
992990
for (path, item) in &self.oas.get_paths() {
993991
for (m, op) in item.get_ops() {
994992
if m == Method::GET {
@@ -1007,11 +1005,11 @@ impl<T: OAS + Serialize> ActiveScan<T> {
10071005
.build();
10081006
let response_vector = req.send_request_all_servers(self.verbosity > 0).await;
10091007
for response in response_vector {
1010-
//logging request/response/description
1008+
//logging request/response/description
10111009
ret_val
10121010
.1
10131011
.push(&req, &response, "Testing without auth".to_string());
1014-
// println!("Status Code : {:?}", res.status);
1012+
// println!("Status Code : {:?}", res.status);
10151013
ret_val.0.push((
10161014
ResponseData{
10171015
location: path.to_string(),
@@ -1026,7 +1024,6 @@ impl<T: OAS + Serialize> ActiveScan<T> {
10261024
}
10271025
ret_val
10281026
}*/
1029-
10301027
}
10311028

10321029
const LIST_CONTENT_TYPE: [&str; 2] = ["application/xml", "application/xml"];

‎cherrybomb-engine/src/scan/active/http_client/req.rs‎

Lines changed: 24 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -32,31 +32,36 @@ impl AttackRequestBuilder {
3232
}
3333
self
3434
}
35-
pub fn servers(&mut self, servers: Option<Vec<Server>>, secure: bool, config_server: &Vec<Server>) -> &mut Self {
36-
if config_server.is_empty(){
37-
if let Some(servers) = servers {
38-
for server in servers {
39-
let mut new_server_addr = server.base_url.clone();
40-
if let Some(vars) = &server.variables {
41-
for (k, v) in vars {
42-
new_server_addr =
43-
new_server_addr.replace(&format!("{{{k}}}"), v.default.as_str());
35+
pub fn servers(
36+
&mut self,
37+
servers: Option<Vec<Server>>,
38+
secure: bool,
39+
config_server: &Vec<Server>,
40+
) -> &mut Self {
41+
if config_server.is_empty() {
42+
if let Some(servers) = servers {
43+
for server in servers {
44+
let mut new_server_addr = server.base_url.clone();
45+
if let Some(vars) = &server.variables {
46+
for (k, v) in vars {
47+
new_server_addr =
48+
new_server_addr.replace(&format!("{{{k}}}"), v.default.as_str());
49+
}
4450
}
51+
if !secure & new_server_addr.starts_with("https") {
52+
new_server_addr.replace_range(0..5, "http")
53+
}
54+
self.servers.push(Server {
55+
base_url: new_server_addr,
56+
description: server.description,
57+
variables: server.variables,
58+
});
4559
}
46-
if !secure & new_server_addr.starts_with("https") {
47-
new_server_addr.replace_range(0..5, "http")
48-
}
49-
self.servers.push(Server {
50-
base_url: new_server_addr,
51-
description: server.description,
52-
variables: server.variables,
53-
});
5460
}
5561
}
56-
}
5762
//TODO implement error here
5863
else {
59-
self.servers= config_server.to_vec();
64+
self.servers = config_server.to_vec();
6065
}
6166
self
6267
}

0 commit comments

Comments
 (0)