Skip to content

#30 Attacker which scans for Session ID in URL #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JessicaBachmann wants to merge 8 commits into
base: master
Choose a base branch
from
Open

#30 Attacker which scans for Session ID in URL #72

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
f75a76d
test for session url
JessicaBachmann Jan 27, 2014
74d2515
testcase for session url
JessicaBachmann Feb 20, 2014
d8ba8e0
attack structure
JessicaBachmann Feb 20, 2014
970ca68
testcase with 3 different id in url
JessicaBachmann Mar 5, 2014
8573ed0
add session_url to __init__.py
JessicaBachmann Mar 5, 2014
f31b377
attacker for session url
JessicaBachmann Mar 6, 2014
fd1c539
String corrected
JessicaBachmann Mar 20, 2014
dfbfd3a
still syntax error
JessicaBachmann Mar 31, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 57 additions & 0 deletions test/test_sessions_url.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@

import unittest
import sys

import tutil
import webvulnscan.attacks.session_url

#session id's in URL can appear in various forms
#this test creates forms of sid, sessionid, phpsessid


def make_client(headers):
headers['Content-Type'] = 'text/html; charset=utf-8'
return tutil.TestClient({
'/': b'''(200, b'<html></html>', headers)''',
})


class SessionUrl(unittest.TestCase):
#creating site without any session
def test_static_site(self):
client = make_client({})
client.run_attack(webvulnscan.attacks.session_url)
client.log.assert_count(0)

#sid in link
def test_site_with_post(self):
client = tutil.TestClient({
'/': u'''<html>
<a href="www.sample.org/index.html?
sid=edb0e8665db4e9042fe0176a89aade16">link1</a>
</html>'''
})
client.run_attack(webvulnscan.attacks.session_url)
client.log.assert_count(1)

#sessionid in link
def test_site_with_get(self):
client = tutil.TestClient({
'/': u'''<html>
<a href="www.sample.org/index.html?
sessionid=edb0e8665db4e9042fe0176a89aade16">link2</a>
</html>'''
})
client.run_attack(webvulnscan.attacks.session_url)
client.log.assert_count(1)

#phpsessid in link
def test_site_with_get(self):
client = tutil.TestClient({
'/': u'''<html>
<a href="www.sample.org/index.html?
phpsessid=edb0e8665db4e9042fe0176a89aade16">link3</a>
</html>'''
})
client.run_attack(webvulnscan.attacks.session_url)
client.log.assert_count(1)
3 changes: 2 additions & 1 deletion webvulnscan/attacks/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@
from .clickjack import clickjack
from .cookiescan import cookiescan
from .exotic_characters import exotic_characters
from .session_url import session_url


def all_attacks():
return [xss, csrf, crlf, breach, clickjack, cookiescan, exotic_characters]
return [xss, csrf, crlf, breach, clickjack, cookiescan, exotic_characters, session_url]
19 changes: 19 additions & 0 deletions webvulnscan/attacks/session_url.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
from ..utils import attack


def check_id(page):
if "sid" in page.url:
return true
if "sessionid" in page.url:
return true
if "phpsessid" in page.url:
return true
return false


@attack()
def session_url(client, log, page):
#session id in url found
if check_id(page):
log('vuln', page.url, u"Session ID in URL")
return