From 6114567258bcad0517a0d881168711aaacdba5d5 Mon Sep 17 00:00:00 2001 From: srdusr <99972264+srdusr@users.noreply.github.com> Date: Thu, 11 Jun 2026 00:37:00 +0200 Subject: Intruder: Battering ram, Pitchfork, and Cluster bomb attack modes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Generalizes Intrude beyond Sniper to all four of Burp's attack modes (proxy.AttackMode). Sniper and Battering ram only ever need one shared payload set; Pitchfork and Cluster bomb are inherently per-position, so they take one payload set per §marked§ position instead. Request-set generation (intrudeValues) is pure and side-effect free, so the total request count is validated against the existing 1000 cap before anything is dispatched - Cluster bomb's product is checked incrementally, one payload set at a time, so a pathological product bails out before ever trying to enumerate it. This also makes the combinatorics unit-testable without a live target. IntrudeResultMsg now reports Values (one substitution per marked position, in order) instead of a single Position/Payload pair, since three of the four modes touch multiple positions per request. TUI: `a` cycles the attack mode. Pitchfork/Cluster bomb reuse the existing single Payloads pane rather than a new multi-widget editor - sets are separated by a `---` delimiter line, in position order. Verified live against a real daemon: all four modes produce the expected substitution values and request counts, and pitchfork correctly rejects a payload-set count that doesn't match the template's marked positions. --- internal/ipc/server.go | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'internal/ipc/server.go') diff --git a/internal/ipc/server.go b/internal/ipc/server.go index c83254e..c890a54 100644 --- a/internal/ipc/server.go +++ b/internal/ipc/server.go @@ -9,6 +9,7 @@ import ( "regexp" "sync" + "mitmux/internal/proxy" "mitmux/internal/rules" "mitmux/internal/scope" "mitmux/internal/store" @@ -20,11 +21,12 @@ type Repeater interface { Repeat(ctx context.Context, scheme, host string, raw []byte) (*store.Entry, error) } -// Intruder runs a Sniper attack over a §marked§ request template - +// Intruder runs an attack (Sniper, Battering ram, Pitchfork, or Cluster +// bomb - see proxy.AttackMode) over a §marked§ request template - // implemented by *proxy.Server. type Intruder interface { - Intrude(ctx context.Context, scheme, host string, template []byte, payloads []string, - onResult func(position int, payload string, entry *store.Entry, sendErr error) bool) error + Intrude(ctx context.Context, scheme, host string, template []byte, mode proxy.AttackMode, payloadSets [][]string, + onResult func(iteration int, values []string, entry *store.Entry, sendErr error) bool) error } // Hub fans out newly captured history entries to subscribed clients. @@ -174,9 +176,9 @@ func (s *Server) handleConn(conn net.Conn) { } grepExtractRe = re } - err := s.intruder.Intrude(context.Background(), req.Scheme, req.Host, req.Raw, req.Payloads, - func(position int, payload string, entry *store.Entry, sendErr error) bool { - r := IntrudeResultMsg{Position: position, Payload: payload} + err := s.intruder.Intrude(context.Background(), req.Scheme, req.Host, req.Raw, req.Mode, req.PayloadSets, + func(iteration int, values []string, entry *store.Entry, sendErr error) bool { + r := IntrudeResultMsg{Iteration: iteration, Values: values} if sendErr != nil { r.Error = sendErr.Error() } -- cgit v1.2.3