concuss 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c5ead6fff82661378bb379172fb4e62a3d22c5a312d363cc9c49a8ebce268e40
-  data.tar.gz: 9bce360c65581ef6ec55ecd6084609680fff69a4480f7ef75041a8cb1c8df756
+  metadata.gz: d8cda3e6dd7c8fec832edc74bfd9ce03f2f3879642664e0fd32f887b3c3ddcb0
+  data.tar.gz: a1f8fabf05a0ac40d9c4aa0b189f24dab1d6ad8dfb528adf53585f244209ccd5
 SHA512:
-  metadata.gz: 5f83174439a0930992841f179026927addfd43b3aab14ce08738959f28a04a23eff6b40d83ca610586b5d23aa22c9073d59c0fa04843e0fe15bcf8f865a51302
-  data.tar.gz: 517db0408b735b4f4741f720f23222e5c9ab2f4cdc5b09f3a943df65e54b33dfc68256bcd3b9fda1d350c597003b6ce7cbb6bcc08e39a6b15f8d1233872f2ad3
+  metadata.gz: b964667adac8e919166dbbaff87cd822250071b77539cf5d0e93ce9fbddefc043de7f8b3205471f13f2e7bffdc81228a2ade804e539a3e12a40aef58ec77c5fd
+  data.tar.gz: 922a3c95a34088569b528f032f08e62c427238790031b467cc96775f9d32498e440c64721297e7278bf1b38307f451b3300abe37e194f9e7de0f0f8f09423ae0

data/CHANGELOG.md

@@ -1,5 +1,7 @@
-## [Unreleased]
+## [0.2.0] - 2023-01-29
+
+* Add support for custom user agents. If none provided, used a default user agent that identifies itself as Concuss/VERSION
 
 ## [0.1.0] - 2023-01-18
 
-- Initial release
+* Initial release

data/README.md

@@ -1,11 +1,16 @@
 # Concuss
 
+[![Gem Version](https://badge.fury.io/rb/concuss.svg)](https://badge.fury.io/rb/concuss)
+[![Build Status](https://github.com/patricktulskie/concuss/actions/workflows/main.yml/badge.svg)](https://github.com/patricktulskie/concuss/actions/workflows/main.yml)
+
 ## What is it?
 
 Concuss is a tool for banging against a url with a bunch of different headers to look for potential vulnerabilities.
 
 It works by sending a custom or a random string to a webserver for a specific url in a variety of headers to see if it's able to get that string to appear on the page. If so, you'll get a HIT and you can evaluate that header to see if it's useful for some kind of XSS, cache poisoning, or some other form of injection from malformed headers.
 
+Often times web app and framework developers assume that headers from the client are not malicious or manipulated and will just write them out to the page in one form or another. This project is a specialized tool to find instances of this so that they can be fixed before they are abused.
+
 ## What it is NOT.
 
 Concuss is not a tool for automating vulnerabilities, nor should it be used to certify that a page is safe from vulnerabilities. It should not be used on applications or website that you do not personally have permission to scan.
@@ -44,12 +49,34 @@ concuss.attack!
 
 This will spit out the results, which isn't super useful if you need to post process them... I'll work on that though.
 
+## Demo
+
+There is a sample app with a vulnerability to test with in the `vuln_app` directory. It takes the contents of `X-CSRF-Token` and spits them out blindly.
+
+Here's some steps to get going with that:
+
+```
+docker-compose build
+docker-compose run console bash
+
+# You should see the vuln_app container boot up and
+# then you'll land in bash on the console container
+
+bin/concuss http://vuln_app:4567 -h non_standard
+```
+
 ## Development
 
-After checking out the repo, run `script/setup` to install dependencies. Then, run `rspec` to run the tests. You can also run `script/console` for an interactive prompt that will allow you to experiment.
+Primarily, you'll want to use Docker to do debugging and development. To get into the console, just run `docker-compose run console bash` and from there you can run `bin/concuss` against the sample vulnerable app, or you can run `rspec` to run the specs.
+
+If you prefer to develop without docker, after checking out the repo, run `bundle install` to install dependencies. Then, run `rspec` to run the tests.
+
+When developing using docker or on your bare machine you can also run `script/console` for an interactive prompt that will allow you to experiment. This will give you access to the underlying classes and let you experiment outside the confines of the CLI.
 
 If you add features or fix bugs, please write specs and open up a PR.
 
+Note: Concuss was designed to easily install on most systems with ruby 3+. As such, its only dependencies are in the ruby standard library.
+
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/patricktulskie/concuss

data/bin/concuss

@@ -19,6 +19,10 @@ OptionParser.new do |opts|
   opts.on("-t", "--test-string STRING", "Set a custom test string. If none specified, it sets a random string to match on.") do |v|
     options[:test_string] = v
   end
+
+  opts.on("-a", "--user-agent STRING", "Set a custom user agent. If none specified, it defaults to Concuss/#{Concuss::VERSION}") do |v|
+    options[:user_agent] = v
+  end
 end.parse!
 
 if ARGV[0].nil?

data/lib/concuss/headers.rb

@@ -30,7 +30,6 @@ class Concuss::Headers
     'Range',
     'Referer',
     'TE',
-    'User-Agent',
     'Upgrade',
     'Via',
     'Warning'

data/lib/concuss/runner.rb

@@ -2,12 +2,15 @@ require 'securerandom'
 require 'net/http'
 
 class Concuss::Runner
-  attr_reader :headers, :url, :test_string
+  DEFAULT_USER_AGENT = "Concuss/#{Concuss::VERSION}"
+  
+  attr_reader :headers, :url, :test_string, :user_agent
 
-  def initialize(headers:, url:, test_string: nil)
+  def initialize(headers:, url:, test_string: nil, user_agent: nil)
     @headers = headers
     @url = url
     @test_string = test_string || SecureRandom.hex(25)
+    @user_agent = user_agent || DEFAULT_USER_AGENT
   end
 
   def run
@@ -15,7 +18,10 @@ class Concuss::Runner
 
     @headers.each do |header|
       response = Net::HTTP.get_response(uri,
-        { header => test_string }
+        {
+          header => test_string,
+          'User-Agent' => user_agent
+        }
       )
 
       if response.code == "200" && response.body.include?(@test_string)

data/lib/concuss/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class Concuss
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/concuss.rb

@@ -3,19 +3,20 @@
 class Concuss
   class Error < StandardError; end
 
-  attr_reader :url, :file, :header_set, :headers, :test_string
+  attr_reader :url, :file, :header_set, :headers, :test_string, :user_agent
 
-  def initialize(url:, file: nil, header_set: :all, test_string: nil)
+  def initialize(url:, file: nil, header_set: :all, test_string: nil, user_agent: nil)
     @url = url
     @file = file
     @header_set = file.nil? ? header_set : :file
     @test_string = test_string
+    @user_agent = user_agent
 
     @headers = Concuss::Headers.new(header_set: @header_set, file: @file).group
   end
 
   def attack!
-    runner = Concuss::Runner.new(headers: headers, url: url, test_string: test_string)
+    runner = Concuss::Runner.new(headers: headers, url: url, test_string: test_string, user_agent: user_agent)
 
     runner.run
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: concuss
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Patrick Tulskie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-21 00:00:00.000000000 Z
+date: 2023-01-29 00:00:00.000000000 Z
 dependencies: []
 description: Test websites for header injection issues
 email:
@@ -45,7 +45,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="