Skip to content

Commit 7aae265

Browse files
MindPatchMindPatch
authored
Merge pull request #45 from rusty-sec/remove_fuzzer
better report & removing fuzzer
2 parents cce6eac + ef490e8 commit 7aae265

File tree

8 files changed

+261
-195
lines changed

8 files changed

+261
-195
lines changed

‎fuzzer/test/xss.lua

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
2+
3+
function report(url)
4+
NewReport:setRisk("low")
5+
NewReport:setUrl(url)
6+
end
7+
8+
function main(url)
9+
report(url)
10+
Reports:addReport(NewReport)
11+
end

‎src/cli/logger.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ pub fn init_log(log_path: &str) -> Result<(), std::io::Error> {
1414
.level_for("hyper", log::LevelFilter::Warn)
1515
.level_for("reqwest", log::LevelFilter::Warn)
1616
.level_for("isahc", log::LevelFilter::Warn);
17-
// Disalbe unwanted loggers
17+
// Disalbe unwanted loggers
1818
logger
1919
.chain(fern::log_file(log_path).unwrap())
2020
.apply()

‎src/core/mod.rs

+36-84
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,18 @@
11
pub mod utils;
2-
use futures::{lock::Mutex, stream, StreamExt};
2+
use futures::lock::Mutex;
33
use log::{debug, error, info, warn};
44
use mlua::Lua;
55
use thirtyfour::prelude::*;
6+
use url::Url;
67

78
use utils::files::filename_to_string;
89
use utils::html::{css_selector, html_parse, html_search};
910
use utils::http as http_sender;
1011
use utils::is_match;
11-
use utils::report::report_script;
12-
use utils::url::{change_urlquery, set_urlvalue, urljoin};
12+
use utils::lua_report::report_script;
13+
use utils::report::{AllReports,OutReport};
14+
use utils::url::HttpMessage;
1315

14-
use std::collections::HashMap;
1516
use std::fs::File;
1617
use std::fs::OpenOptions;
1718
use std::io::Read;
@@ -159,16 +160,6 @@ impl<'a> LuaLoader<'a> {
159160
}
160161

161162
fn get_httpfunc(&self, lua: &Lua) {
162-
lua.globals()
163-
.set(
164-
"set_urlvalue",
165-
lua.create_function(|_, (url, param, payload): (String, String, String)| {
166-
Ok(set_urlvalue(&url, &param, &payload))
167-
})
168-
.unwrap(),
169-
)
170-
.unwrap();
171-
172163
lua.globals()
173164
.set(
174165
"sleep",
@@ -179,30 +170,6 @@ impl<'a> LuaLoader<'a> {
179170
.unwrap(),
180171
)
181172
.unwrap();
182-
// Set Functions
183-
let set_urlvalue =
184-
lua.create_function(|_, (url, param, payload): (String, String, String)| {
185-
Ok(set_urlvalue(&url, &param, &payload))
186-
});
187-
let change_url = lua
188-
.create_function(
189-
|_, (url, payload, remove_content): (String, String, bool)| {
190-
Ok(change_urlquery(url, payload, remove_content))
191-
},
192-
)
193-
.unwrap();
194-
lua.globals().set("change_urlquery", change_url).unwrap();
195-
lua.globals()
196-
.set("set_urlvalue", set_urlvalue.unwrap())
197-
.unwrap();
198-
199-
lua.globals()
200-
.set(
201-
"urljoin",
202-
lua.create_function(|_, (url, path): (String, String)| Ok(urljoin(url, path)))
203-
.unwrap(),
204-
)
205-
.unwrap();
206173
}
207174

208175
/// Start All Lua Scripts
@@ -218,7 +185,20 @@ impl<'a> LuaLoader<'a> {
218185
self.get_httpfunc(&lua);
219186
self.get_utilsfunc(&lua);
220187
self.get_matching_func(&lua);
221-
lua.globals().set("TARGET_URL", target_url).unwrap();
188+
lua.globals()
189+
.set(
190+
"HttpMessage",
191+
HttpMessage {
192+
url: Url::parse(target_url).unwrap(),
193+
},
194+
)
195+
.unwrap();
196+
lua.globals()
197+
.set("Reports",AllReports {
198+
reports: Vec::new()
199+
}).unwrap();
200+
lua.globals()
201+
.set("NewReport", OutReport::init()).unwrap();
222202
match driver {
223203
None => {}
224204
_ => {
@@ -242,24 +222,7 @@ impl<'a> LuaLoader<'a> {
242222
lua.globals().set("SCRIPT_PATH", script_dir).unwrap();
243223

244224
lua.load(script_code).exec_async().await.unwrap();
245-
let payloads_func = lua
246-
.globals()
247-
.get::<_, mlua::Function>("payloads_gen")
248-
.unwrap();
249-
let payloads = payloads_func
250-
.call_async::<_, mlua::Table>(target_url)
251-
.await
252-
.unwrap();
253-
let payloads = {
254-
let mut all_payloads = Vec::new();
255-
payloads
256-
.pairs::<mlua::Value, mlua::Value>()
257-
.into_iter()
258-
.for_each(|item| {
259-
all_payloads.push(item.unwrap());
260-
});
261-
all_payloads
262-
};
225+
263226
// HTTP Sender
264227
lua.globals()
265228
.set(
@@ -273,36 +236,25 @@ impl<'a> LuaLoader<'a> {
273236
.unwrap();
274237

275238
let main_func = lua.globals().get::<_, mlua::Function>("main").unwrap();
276-
let script_threads = lua.globals().get::<_, usize>("THREADS").unwrap_or(5);
277-
stream::iter(payloads.into_iter())
278-
.map(move |payload| {
279-
let main_func = main_func.clone();
280-
async move {
281-
main_func
282-
.call_async::<_, mlua::Table>(payload)
283-
.await
284-
.unwrap();
285-
}
286-
})
287-
.buffer_unordered(script_threads)
288-
.collect::<Vec<_>>()
289-
.await;
239+
debug!("MAIN FUNC STARTED");
240+
main_func.call_async::<_, mlua::Value>(target_url).await.unwrap();
241+
debug!("MAIN FUNC DONE");
242+
290243
if report_code.len() > 0 {
244+
// Still under development (not ready yet)
291245
report_script(filename_to_string(report_code).unwrap().as_str());
292246
} else {
293-
let out_table = lua.globals().get::<_, bool>("VALID".to_owned()).unwrap();
294-
if out_table {
295-
let mut test_report: HashMap<String, mlua::Value> = HashMap::new();
296-
lua.globals()
297-
.get::<_, mlua::Table>("REPORT")
298-
.unwrap()
299-
.pairs::<String, mlua::Value>()
300-
.for_each(|out_report| {
301-
let current_out = out_report.clone();
302-
test_report.insert(current_out.unwrap().0, out_report.unwrap().1);
303-
});
304-
let results = serde_json::to_string(&test_report).unwrap();
305-
self.write_report(&results);
247+
let final_report = lua.globals().get::<_, AllReports>("Reports");
248+
match final_report {
249+
Ok(the_report) => {
250+
if the_report.clone().reports.len() > 0 {
251+
let results = serde_json::to_string(&the_report.reports).unwrap();
252+
self.write_report(&results);
253+
}
254+
}
255+
Err(err) => {
256+
error!("Report Error: {}", err);
257+
}
306258
}
307259
}
308260
self.bar.inc(1);

‎src/core/utils/http.rs

+5
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,11 @@ impl Sender {
132132
/// ```lua
133133
/// local resp = http:send("GET","http://google.com")
134134
/// print(resp.body:GetStrOrNil())
135+
///
136+
/// -- set proxy/timeout
137+
/// http:set_proxy("http://proxysite.com:8080")
138+
/// http:set_timeout(15)
139+
/// http:set_redirects(2) // set custom redirects limit
135140
/// ```
136141
pub async fn send(
137142
&self,

‎src/core/utils/lua_report.rs

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
use log::{debug, error};
2+
use mlua::Lua;
3+
use std::collections::HashMap;
4+
use std::fs::OpenOptions;
5+
use std::io::Write;
6+
7+
pub fn report_script(report_code: &str) {
8+
debug!("Running the Report Script");
9+
let lua_vm = Lua::new();
10+
lua_report_func(&lua_vm);
11+
match lua_vm.load(report_code).exec() {
12+
Ok(_done) => {}
13+
Err(err) => {
14+
println!("CODE: {}", report_code);
15+
println!("ERR {:?}", err);
16+
error!("Lua Report Error: {}", err);
17+
}
18+
}
19+
}
20+
21+
fn lua_report_func(vm: &Lua) -> &Lua {
22+
vm.globals()
23+
.set(
24+
"to_json",
25+
vm.create_function(|_, data: mlua::Table| {
26+
let mut test_report: HashMap<String, mlua::Value> = HashMap::new();
27+
data.pairs::<String, mlua::Value>().for_each(|out_report| {
28+
let current_out = out_report.clone();
29+
test_report.insert(current_out.unwrap().0, out_report.unwrap().1);
30+
});
31+
let results = serde_json::to_string(&test_report).unwrap();
32+
Ok(results)
33+
})
34+
.unwrap(),
35+
)
36+
.unwrap();
37+
38+
vm.globals()
39+
.set(
40+
"save_file",
41+
vm.create_function(|_, (data, report_path): (String, String)| {
42+
save_file(&report_path, &data);
43+
Ok(())
44+
})
45+
.unwrap(),
46+
)
47+
.unwrap();
48+
vm
49+
}
50+
51+
fn save_file(file_path: &str, results: &str) {
52+
OpenOptions::new()
53+
.write(true)
54+
.append(true)
55+
.create(true)
56+
.open(file_path)
57+
.expect("Could not open file")
58+
.write_all(format!("{}\n", results).as_str().as_bytes())
59+
.expect("Could not write to file");
60+
}

‎src/core/utils/mod.rs

+1
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ pub mod files;
2222
pub mod html;
2323
pub mod http;
2424
// pub mod oast;
25+
pub mod lua_report;
2526
pub mod report;
2627
pub mod url;
2728

0 commit comments

Comments
 (0)