concuss 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8cda3e6dd7c8fec832edc74bfd9ce03f2f3879642664e0fd32f887b3c3ddcb0
-  data.tar.gz: a1f8fabf05a0ac40d9c4aa0b189f24dab1d6ad8dfb528adf53585f244209ccd5
+  metadata.gz: ebbc8f1ad06752a93ba6b66ef4fa666a693532a792b71d14ff830ae1a7537494
+  data.tar.gz: 8a1b02193ffb5bac321fbad3a4905c7b00f9ddfec1df543ab755aba9c564b4e2
 SHA512:
-  metadata.gz: b964667adac8e919166dbbaff87cd822250071b77539cf5d0e93ce9fbddefc043de7f8b3205471f13f2e7bffdc81228a2ade804e539a3e12a40aef58ec77c5fd
-  data.tar.gz: 922a3c95a34088569b528f032f08e62c427238790031b467cc96775f9d32498e440c64721297e7278bf1b38307f451b3300abe37e194f9e7de0f0f8f09423ae0
+  metadata.gz: f9407c5f49b7dc5b2f03ad0b69e00e21b6f1940ea6167c630ffe59fd4366bd1e099c68e061fe2943c9c3c41ff4103ce781b50e9ed85a268627ab7e2fe41b0050
+  data.tar.gz: e891c23429f6931b81bf9b00a9b38bb4ecb361ebc3c40d35dead0b7f5510e8a7ed33cd88c27dbb532d438baed12126cabf588cf04dc82448e64b45584402a0a3

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    concuss (0.1.0)
+    concuss (0.2.0)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -44,10 +44,10 @@ While concuss is designed to be used as a command line tool, you can also includ
 require 'concuss'
 
 concuss = Concuss.new(url: 'http://localhost:4567', file: 'header_file.txt', header_set: :standard, test_string: "OOGABOOGA")
-concuss.attack!
+report = concuss.attack!
 ```
 
-This will spit out the results, which isn't super useful if you need to post process them... I'll work on that though.
+From there, you'll get a `Concuss::Report` object that contains the raw data as well as filters for `hits`, `misses`, `headers`, and the `url` in the event you've done a bunch of these.
 
 ## Demo
 

data/bin/concuss

@@ -31,5 +31,9 @@ if ARGV[0].nil?
 end
 
 options[:url] = ARGV[0]
+options[:formatter] = Concuss::Formatters::Table
+options[:progress_type] = :dots
+
+puts "Scanning #{options[:url]}"
 
 Concuss.new(**options).attack!

data/lib/concuss/formatters/table.rb

@@ -0,0 +1,31 @@
+class Concuss::Formatters::Table
+
+  HEADINGS = ['HEADER', 'RESPONSE_CODE', 'HIT/MISS'].freeze
+
+  def initialize(report)
+    @report = report
+  end
+
+  def print
+    header_max_length = @report.headers.map(&:length).max
+    response_code_length = HEADINGS[1].length
+    hit_header_length = HEADINGS[2].length
+
+    header_format = "%-#{header_max_length}s | %-#{response_code_length}s | %-0s\n"
+    separator = '-' * (header_max_length + response_code_length + hit_header_length + 6)
+
+    puts header_format % HEADINGS
+    puts separator
+    print_data(@report.hits, header_format)
+    print_data(@report.misses, header_format)
+  end
+
+  private
+
+  def print_data(data, header_format)
+    data.sort.each do |header, values|
+      puts header_format % [header, values[:response_code], values[:hit] ? 'HIT' : 'MISS']
+    end
+  end
+end
+

data/lib/concuss/formatters.rb

@@ -0,0 +1,6 @@
+class Concuss
+  module Formatters
+  end
+end
+
+require_relative 'formatters/table'

data/lib/concuss/report.rb

@@ -0,0 +1,20 @@
+class Concuss::Report
+  attr_reader :data, :url
+
+  def initialize(data:, url:)
+    @url = url
+    @data = data
+  end
+
+  def hits
+    data.select { |_, value| value[:hit] }
+  end
+
+  def misses
+    data.reject { |_, value| value[:hit] }
+  end
+
+  def headers
+    data.keys
+  end
+end

data/lib/concuss/runner.rb

@@ -3,18 +3,20 @@ require 'net/http'
 
 class Concuss::Runner
   DEFAULT_USER_AGENT = "Concuss/#{Concuss::VERSION}"
-  
-  attr_reader :headers, :url, :test_string, :user_agent
 
-  def initialize(headers:, url:, test_string: nil, user_agent: nil)
+  attr_reader :headers, :url, :test_string, :user_agent, :progress_type
+
+  def initialize(headers:, url:, test_string: nil, user_agent: nil, progress_type: nil)
     @headers = headers
     @url = url
     @test_string = test_string || SecureRandom.hex(25)
     @user_agent = user_agent || DEFAULT_USER_AGENT
+    @progress_type = progress_type
   end
 
   def run
     uri = URI(@url)
+    report_data = { }
 
     @headers.each do |header|
       response = Net::HTTP.get_response(uri,
@@ -24,14 +26,20 @@ class Concuss::Runner
         }
       )
 
-      if response.code == "200" && response.body.include?(@test_string)
-        result = "HIT"
-      else
-        result = "MISS"
-      end
+      hit = response.code == "200" && response.body.include?(@test_string)
+      report_data[header] = { response_code: response.code, hit: hit }
 
-      puts "#{header} - #{response.code} - #{result}"
+      case progress_type
+      when :full
+        puts "#{header} - #{response.code} - #{hit ? "HIT" : "MISS"}"
+      when :dots
+        print "."
+      end
     end
+
+    puts "" if progress_type == :dots
+
+    return Concuss::Report.new(data: report_data, url: @url)
   end
 end
 

data/lib/concuss/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class Concuss
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/lib/concuss.rb

@@ -3,25 +3,32 @@
 class Concuss
   class Error < StandardError; end
 
-  attr_reader :url, :file, :header_set, :headers, :test_string, :user_agent
+  attr_reader :url, :file, :header_set, :headers, :test_string, :user_agent, :formatter, :progress_type
 
-  def initialize(url:, file: nil, header_set: :all, test_string: nil, user_agent: nil)
+  def initialize(url:, file: nil, header_set: :all, test_string: nil, user_agent: nil, formatter: nil, progress_type: nil)
     @url = url
     @file = file
     @header_set = file.nil? ? header_set : :file
     @test_string = test_string
     @user_agent = user_agent
+    @formatter = formatter
+    @progress_type = progress_type
 
     @headers = Concuss::Headers.new(header_set: @header_set, file: @file).group
   end
 
   def attack!
-    runner = Concuss::Runner.new(headers: headers, url: url, test_string: test_string, user_agent: user_agent)
+    runner = Concuss::Runner.new(headers: headers, url: url, test_string: test_string, user_agent: user_agent, progress_type: progress_type)
+    results = runner.run
 
-    runner.run
+    formatter.new(results).print if formatter
+
+    return results
   end
 end
 
 require_relative "concuss/version"
+require_relative "concuss/report"
 require_relative "concuss/headers"
 require_relative "concuss/runner"
+require_relative "concuss/formatters"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: concuss
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Patrick Tulskie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-29 00:00:00.000000000 Z
+date: 2023-02-04 00:00:00.000000000 Z
 dependencies: []
 description: Test websites for header injection issues
 email:
@@ -27,7 +27,10 @@ files:
 - Rakefile
 - bin/concuss
 - lib/concuss.rb
+- lib/concuss/formatters.rb
+- lib/concuss/formatters/table.rb
 - lib/concuss/headers.rb
+- lib/concuss/report.rb
 - lib/concuss/runner.rb
 - lib/concuss/version.rb
 homepage: https://github.com/patricktulskie/concuss