Intruder payload processing and grep-match/grep-extract

Payload processing: an optional case rule (upper/lower) and an optional
encode rule (URL/Base64/Hex/HTML) applied to every payload line before
it's substituted into the request, cycled with 'c'/'e'. Case always
runs before encode - folding an already-encoded value would corrupt it
(e.g. uppercasing Base64 padding). Applied entirely client-side in
startIntrude() (payload_rules.go): a pure string transform with no
proxy-side state, so it needs no protocol changes and reuses the
Decoder's own urlEncodeAll.

Grep-match/grep-extract: two optional Go regexps, edited with 'm'/'v'
using the same modal edit-buffer pattern as the history list's '/'
search (enter validates-and-commits, esc reverts to the last-confirmed
pattern, an unparseable regexp is rejected with an error rather than
silently accepted). Evaluated server-side, in internal/ipc/server.go's
"intrude" handler, against each result's actual entry.ResponseRaw -
that's where the real response bytes already are, and it's how Burp's
own grep options work (matched against the real response, not a
client-refetched copy). Grep-match flags a result (new Match column);
grep-extract captures the first submatch, or the whole match if the
pattern has no capturing group (new Extract column). Both patterns are
compiled once before the attack starts and apply for that run only, not
retroactively if changed mid-attack.

All four new keys (c/e/m/v) are gated to normal mode, checked in the
view's outer key switch before ever reaching the template/payloads
vi-textareas - otherwise they'd be either untypeable letters or steal
keystrokes mid-edit. Same discipline as the Repeater tab keys.

internal/ipc: Request gained GrepMatch/GrepExtract string fields (for
"intrude"), IntrudeResultMsg gained GrepMatch bool/GrepExtract string,
and the client Intrude() helper takes the two pattern strings as new
trailing parameters.

Verified live in tmux against a running daemon and real httpbin.org
traffic: built a template with a §marked§ query param, payloads 1/2/3,
grep-match `"id": "2"` and grep-extract `"id": "([0-9]+)"`, ran the
attack and confirmed the Match column flagged only the payload=2 row
and Extract correctly pulled 1/2/3 from each response respectively;
cycled case/encode through all states; confirmed an invalid regexp
(`[abc`) is rejected with a visible error and esc correctly reverts to
the last-confirmed pattern instead of committing the invalid one.

(Also confirmed, incidentally: a batch of vi normal-mode two-key
commands like "gg"/"dd" sent as one multi-character tmux send-keys
argument doesn't reliably reach the app as separate keystrokes - a
tmux scripting artifact, not a bug in the vi-mode implementation, which
works correctly when each key is sent as its own event, as any real
keypress would be.)

go build/vet/gofmt/test/mod tidy all clean.

1 files changed, 30 insertions, 0 deletions

diff --git a/internal/ipc/server.go b/internal/ipc/server.go
index 28279a7..9602912 100644
--- a/internal/ipc/server.go
+++ b/internal/ipc/server.go
@@ -6,6 +6,7 @@ import (
 	"io"
 	"log"
 	"net"
+	"regexp"
 	"sync"
 
 	"mitmux/internal/rules"
@@ -155,6 +156,23 @@ func (s *Server) handleConn(conn net.Conn) {
 				enc.Encode(Response{Type: "error", Error: "intruder not available"})
 				continue
 			}
+			var grepMatchRe, grepExtractRe *regexp.Regexp
+			if req.GrepMatch != "" {
+				re, err := regexp.Compile(req.GrepMatch)
+				if err != nil {
+					enc.Encode(Response{Type: "error", Error: "grep-match: " + err.Error()})
+					continue
+				}
+				grepMatchRe = re
+			}
+			if req.GrepExtract != "" {
+				re, err := regexp.Compile(req.GrepExtract)
+				if err != nil {
+					enc.Encode(Response{Type: "error", Error: "grep-extract: " + err.Error()})
+					continue
+				}
+				grepExtractRe = re
+			}
 			err := s.intruder.Intrude(context.Background(), req.Scheme, req.Host, req.Raw, req.Payloads,
 				func(position int, payload string, entry *store.Entry, sendErr error) bool {
 					r := IntrudeResultMsg{Position: position, Payload: payload}
@@ -169,6 +187,18 @@ func (s *Server) handleConn(conn net.Conn) {
 						if entry.Error != "" && r.Error == "" {
 							r.Error = entry.Error
 						}
+						if grepMatchRe != nil {
+							r.GrepMatch = grepMatchRe.Match(entry.ResponseRaw)
+						}
+						if grepExtractRe != nil {
+							if m := grepExtractRe.FindSubmatch(entry.ResponseRaw); m != nil {
+								if len(m) > 1 {
+									r.GrepExtract = string(m[1])
+								} else {
+									r.GrepExtract = string(m[0])
+								}
+							}
+						}
 					}
 					return enc.Encode(Response{Type: "intrude_result", IntrudeResult: &r}) == nil
 				})