Only run module if path is parametric.

subgraph · Sep 27, 2014 · de0421b · de0421b
1 parent cde6c64
commit de0421b
Show file tree

Hide file tree

Showing 6 changed files with 28 additions and 9 deletions.
diff --git a/scripts/scanner/modules/injection/format-string-inject.js b/scripts/scanner/modules/injection/format-string-inject.js
@@ -6,7 +6,11 @@ var module = {
 };
 
 function initialize(ctx) {
-  ctx.submitMultipleAlteredRequests(process, ["vega%dn%dn%dn%dn%dn%dn%dn%dn", "vega%nd%nd%nd%nd%nd%nd%nd%nd"]);
+  var ps = ctx.getPathState();
+
+  if (ps.isParametric()) {
+    ctx.submitMultipleAlteredRequests(process, ["vega%dn%dn%dn%dn%dn%dn%dn%dn", "vega%nd%nd%nd%nd%nd%nd%nd%nd"]);
+  }
 }
 
 function process(req, res, ctx) {

diff --git a/scripts/scanner/modules/injection/local-file-include.js b/scripts/scanner/modules/injection/local-file-include.js
@@ -318,8 +318,10 @@ alteredRequests.push({
 
 function initialize(ctx) {
 	var ps = ctx.getPathState();
-	ctx.submitAlteredRequest(process, alteredRequests[0].payload, false, 0);
-  ps.incrementFuzzCounter();
+	if (ps.isParametric()) {
+	  ctx.submitAlteredRequest(process, alteredRequests[0].payload, false, 0);
+          ps.incrementFuzzCounter();
+        }
 
 };
 

diff --git a/scripts/scanner/modules/injection/shell-injection.js b/scripts/scanner/modules/injection/shell-injection.js
@@ -5,7 +5,10 @@ var module = {
 };
 
 function initialize(ctx) {
-  ctx.submitMultipleAlteredRequests(process, ["`true`", "`false`", "`uname`", "\"`true`\"", "\"`false`\"", "\"`uname`\"", "'true'", "'false'", "'uname'"], true);
+  var ps = ctx.getPathState();
+  if (ps.isParametric()) {
+    ctx.submitMultipleAlteredRequests(process, ["`true`", "`false`", "`uname`", "\"`true`\"", "\"`false`\"", "\"`uname`\"", "'true'", "'false'", "'uname'"], true);
+  }
 }
 
 function process(req, res, ctx) {

diff --git a/scripts/scanner/modules/injection/url-injection.js b/scripts/scanner/modules/injection/url-injection.js
@@ -4,7 +4,11 @@ var module = {
 };
 
 function initialize(ctx) {
-  ctx.submitMultipleAlteredRequests(process, ["http://vega.invalid/;?", "//vega.invalid/;?", "vega://invalid/;?", " src=http://vega.invalid/;?", "\" src=http://vega.invalid/;?"]);
+
+  var ps = ctx.getPathState();
+  if (ps.isParametric()) {
+    ctx.submitMultipleAlteredRequests(process, ["http://vega.invalid/;?", "//vega.invalid/;?", "vega://invalid/;?", " src=http://vega.invalid/;?", "\" src=http://vega.invalid/;?"]);
+  }
 }
 
 function process(req, res, ctx) {

diff --git a/scripts/scanner/modules/injection/xml-injection.js b/scripts/scanner/modules/injection/xml-injection.js
@@ -5,7 +5,11 @@ var module = {
 };
 
 function initialize(ctx) {
-  ctx.submitMultipleAlteredRequests(process, ["vega>'>\"><vega></vega>", "vega>'>\"></vega><vega>"]);
+  var ps = ctx.getPathState();
+
+  if (ps.isParametric()) {
+    ctx.submitMultipleAlteredRequests(process, ["vega>'>\"><vega></vega>", "vega>'>\"></vega><vega>"]);
+  }
 }
 
 function process(req, res, ctx) {

diff --git a/scripts/scanner/modules/injection/xss-injection.js b/scripts/scanner/modules/injection/xss-injection.js
@@ -26,9 +26,11 @@ function createRequest(ps, index) {
 
 function initialize(ctx) {
   var ps = ctx.getPathState();
-
-  for (var i = 0; i < payloads.length; i++) {
-    ctx.submitRequest(createRequest(ps, i), process, i);      
+
+  if (ps.isParametric()) {  
+    for (var i = 0; i < payloads.length; i++) {
+      ctx.submitRequest(createRequest(ps, i), process, i);      
+    }
   }
 };