diff options
Diffstat (limited to 'internal/proxy')
| -rw-r--r-- | internal/proxy/intrude.go | 124 | ||||
| -rw-r--r-- | internal/proxy/intrude_test.go | 116 | ||||
| -rw-r--r-- | internal/proxy/repeat.go | 28 |
3 files changed, 258 insertions, 10 deletions
diff --git a/internal/proxy/intrude.go b/internal/proxy/intrude.go new file mode 100644 index 0000000..933a309 --- /dev/null +++ b/internal/proxy/intrude.go @@ -0,0 +1,124 @@ +// Intruder-equivalent: mark positions in a raw request template with § +// (Burp's own marker character, so anyone who's used Burp already knows +// the syntax), and Sniper-attack them - one position fuzzed at a time +// through a shared payload set, every other marked position holding its +// base value. Battering ram / pitchfork / cluster bomb are not +// implemented; Sniper covers the large majority of real Intruder usage +// and this whole feature is explicitly optional in the build order. +package proxy + +import ( + "bytes" + "context" + "fmt" + + "mitmux/internal/store" +) + +const marker = "§" + +// maxIntrudeRequests caps positions × payloads for one attack - a safety +// limit against an accidental huge wordlist times several positions +// turning into an unbounded flood, not a tuned production value. +const maxIntrudeRequests = 1000 + +// IntrudePosition is one marked, resolved insertion point. +type IntrudePosition struct { + Index int // 0-based, in order of appearance + Base string // the text between its markers +} + +// ParseMarkers finds every §base§ pair in template and returns the +// resolved positions plus template with the markers stripped out (the +// form actually used as the base request when no position is being +// fuzzed). An odd number of § markers is a user error - unterminated +// marker - reported rather than guessed at. +func ParseMarkers(template []byte) (positions []IntrudePosition, stripped []byte, err error) { + parts := bytes.Split(template, []byte(marker)) + if len(parts)%2 != 1 { + return nil, nil, fmt.Errorf("unterminated %s marker - markers must come in pairs", marker) + } + if len(parts) == 1 { + return nil, template, nil + } + + var buf bytes.Buffer + for i, part := range parts { + if i%2 == 1 { + positions = append(positions, IntrudePosition{Index: len(positions), Base: string(part)}) + } + buf.Write(part) + } + return positions, buf.Bytes(), nil +} + +// buildRequest re-inserts each position's base value into stripped +// (computed relative to the ORIGINAL template's marker layout, so this +// re-derives offsets rather than operating on the already-stripped +// bytes) except for `active`, which gets payload instead. +func buildRequest(template []byte, active int, payload string) ([]byte, error) { + parts := bytes.Split(template, []byte(marker)) + if len(parts)%2 != 1 { + return nil, fmt.Errorf("unterminated %s marker", marker) + } + var buf bytes.Buffer + pos := 0 + for i, part := range parts { + if i%2 == 1 { + if pos == active { + buf.WriteString(payload) + } else { + buf.Write(part) + } + pos++ + continue + } + buf.Write(part) + } + return buf.Bytes(), nil +} + +// Intrude runs a Sniper attack: template must contain at least one +// §marked§ position. For each position, in order, every payload is sent +// with that position replaced by the payload and all others at their +// base value; onResult is called synchronously after each request +// completes - with the position index, the payload used, the resulting +// entry (nil if sendErr is set), and any send error - so a caller can +// stream progress, and stops the attack early if it returns false. +func (s *Server) Intrude(ctx context.Context, scheme, host string, template []byte, payloads []string, + onResult func(position int, payload string, entry *store.Entry, sendErr error) bool) error { + positions, _, err := ParseMarkers(template) + if err != nil { + return err + } + if len(positions) == 0 { + return fmt.Errorf("no %s-marked positions in the request template", marker) + } + if len(payloads) == 0 { + return fmt.Errorf("no payloads") + } + if total := len(positions) * len(payloads); total > maxIntrudeRequests { + return fmt.Errorf("attack would send %d requests (%d positions × %d payloads), over the %d limit", + total, len(positions), len(payloads), maxIntrudeRequests) + } + + for _, pos := range positions { + for _, payload := range payloads { + raw, err := buildRequest(template, pos.Index, payload) + if err != nil { + return err + } + + // sendRaw is already self-bounding (dialForRepeat's own dial + // timeout, then conn.SetDeadline for the rest), so ctx here + // only needs to carry cancellation - e.g. the IPC connection + // driving this attack closing mid-run. + e, sendErr := s.sendRaw(ctx, scheme, host, raw, "intruder") + + if !onResult(pos.Index, payload, e, sendErr) { + return nil + } + } + } + return nil +} diff --git a/internal/proxy/intrude_test.go b/internal/proxy/intrude_test.go new file mode 100644 index 0000000..5df80e6 --- /dev/null +++ b/internal/proxy/intrude_test.go @@ -0,0 +1,116 @@ +package proxy + +import ( + "reflect" + "testing" +) + +func TestParseMarkers(t *testing.T) { + tests := []struct { + name string + template string + wantPos []IntrudePosition + wantOut string + wantErr bool + }{ + { + name: "single position", + template: "GET /users/§123§ HTTP/1.1", + wantPos: []IntrudePosition{{Index: 0, Base: "123"}}, + wantOut: "GET /users/123 HTTP/1.1", + }, + { + name: "two positions", + template: "GET /a/§1§/b/§2§ HTTP/1.1", + wantPos: []IntrudePosition{{Index: 0, Base: "1"}, {Index: 1, Base: "2"}}, + wantOut: "GET /a/1/b/2 HTTP/1.1", + }, + { + name: "no markers", + template: "GET / HTTP/1.1", + wantPos: nil, + wantOut: "GET / HTTP/1.1", + }, + { + name: "empty marker", + template: "GET /§§ HTTP/1.1", + wantPos: []IntrudePosition{{Index: 0, Base: ""}}, + wantOut: "GET / HTTP/1.1", + }, + { + name: "unterminated marker", + template: "GET /§broken HTTP/1.1", + wantErr: true, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + pos, out, err := ParseMarkers([]byte(tt.template)) + if tt.wantErr { + if err == nil { + t.Fatalf("expected error, got nil") + } + return + } + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + if !reflect.DeepEqual(pos, tt.wantPos) { + t.Errorf("positions = %+v, want %+v", pos, tt.wantPos) + } + if string(out) != tt.wantOut { + t.Errorf("stripped = %q, want %q", out, tt.wantOut) + } + }) + } +} + +func TestBuildRequest(t *testing.T) { + template := "GET /a/§1§/b/§2§/c/§3§ HTTP/1.1" + + tests := []struct { + active int + payload string + want string + }{ + {0, "PAYLOAD", "GET /a/PAYLOAD/b/2/c/3 HTTP/1.1"}, + {1, "PAYLOAD", "GET /a/1/b/PAYLOAD/c/3 HTTP/1.1"}, + {2, "PAYLOAD", "GET /a/1/b/2/c/PAYLOAD HTTP/1.1"}, + } + + for _, tt := range tests { + got, err := buildRequest([]byte(template), tt.active, tt.payload) + if err != nil { + t.Fatalf("active=%d: unexpected error: %v", tt.active, err) + } + if string(got) != tt.want { + t.Errorf("active=%d: got %q, want %q", tt.active, got, tt.want) + } + } +} + +func TestBuildRequestPayloadContainingMarkerChar(t *testing.T) { + // A payload that itself contains the marker character must not be + // reinterpreted as a marker on a later buildRequest call - each call + // re-splits the ORIGINAL template, not the previously built request. + template := "GET /§1§/§2§ HTTP/1.1" + got, err := buildRequest([]byte(template), 0, "§injected§") + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + want := "GET /§injected§/2 HTTP/1.1" + if string(got) != want { + t.Errorf("got %q, want %q", got, want) + } +} + +func TestIntrudeRequestCount(t *testing.T) { + positions, _, err := ParseMarkers([]byte("GET /§a§/§b§ HTTP/1.1")) + if err != nil { + t.Fatal(err) + } + if len(positions) != 2 { + t.Fatalf("expected 2 positions, got %d", len(positions)) + } +} diff --git a/internal/proxy/repeat.go b/internal/proxy/repeat.go index cecf481..3ee7cea 100644 --- a/internal/proxy/repeat.go +++ b/internal/proxy/repeat.go @@ -25,38 +25,46 @@ import ( // HTTP/2's binary framing, so the connection is negotiated HTTP/1.1-only // rather than letting the server pick. func (s *Server) Repeat(ctx context.Context, scheme, host string, raw []byte) (*store.Entry, error) { + return s.sendRaw(ctx, scheme, host, raw, "repeater") +} + +// sendRaw is the shared raw-byte send/record primitive behind Repeat and +// Intrude - same wire behavior (exact bytes, HTTP/1.1-only, bounded by +// upstreamTimeout), tagged with whichever source called it so history +// can tell repeater sends from intruder attack requests apart. +func (s *Server) sendRaw(ctx context.Context, scheme, host string, raw []byte, source string) (*store.Entry, error) { started := time.Now() method, path := parseRequestLine(raw) conn, err := dialForRepeat(ctx, scheme, host) if err != nil { - return s.recordRepeat(started, time.Since(started), scheme, host, method, path, raw, nil, 0, err.Error()) + return s.recordRaw(started, time.Since(started), scheme, host, method, path, raw, nil, 0, err.Error(), source) } defer conn.Close() // See the matching comment in forward(): without this, a hung // server - or a user-edited request malformed enough that nothing - // ever replies - blocks this Repeat call, and the IPC connection - // handling it, forever. + // ever replies - blocks this call, and whatever's waiting on it + // (an IPC connection, or an entire Intruder attack), forever. conn.SetDeadline(time.Now().Add(upstreamTimeout)) if _, err := conn.Write(raw); err != nil { - return s.recordRepeat(started, time.Since(started), scheme, host, method, path, raw, nil, 0, err.Error()) + return s.recordRaw(started, time.Since(started), scheme, host, method, path, raw, nil, 0, err.Error(), source) } tee := newTeeConn(conn) resp, err := http.ReadResponse(bufio.NewReader(tee), &http.Request{Method: method}) duration := time.Since(started) if err != nil { - return s.recordRepeat(started, duration, scheme, host, method, path, raw, nil, 0, err.Error()) + return s.recordRaw(started, duration, scheme, host, method, path, raw, nil, 0, err.Error(), source) } defer resp.Body.Close() io.Copy(io.Discard, resp.Body) - return s.recordRepeat(started, duration, scheme, host, method, path, raw, tee.Take(), resp.StatusCode, "") + return s.recordRaw(started, duration, scheme, host, method, path, raw, tee.Take(), resp.StatusCode, "", source) } -func (s *Server) recordRepeat(started time.Time, duration time.Duration, scheme, host, method, path string, - reqRaw, respRaw []byte, status int, errMsg string) (*store.Entry, error) { +func (s *Server) recordRaw(started time.Time, duration time.Duration, scheme, host, method, path string, + reqRaw, respRaw []byte, status int, errMsg, source string) (*store.Entry, error) { e := &store.Entry{ StartedAt: started, Duration: duration, @@ -70,12 +78,12 @@ func (s *Server) recordRepeat(started time.Time, duration time.Duration, scheme, RequestExact: true, ResponseExact: respRaw != nil, Error: errMsg, - Source: "repeater", + Source: source, } if s.store != nil { id, err := s.store.Insert(e) if err != nil { - return nil, fmt.Errorf("store repeater entry: %w", err) + return nil, fmt.Errorf("store %s entry: %w", source, err) } e.ID = id if s.OnEntry != nil { |