hitman 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a6a5e4c277a70f15b092f88487d8ba8654b29a84
-  data.tar.gz: cb5e4d1b018be1f34e0258f4af2b44c93afa8de5
+  metadata.gz: 10c1e35d8dd67d87fc3ba4878e8b42768d40e3cc
+  data.tar.gz: 6165050c77f3153e195184a1ba7cde5e9190c8dc
 SHA512:
-  metadata.gz: 66fc72fbbcb27cc1c4fa26642c0b87115b241796c3626c8e4c9f9c662b8e6191fe14cd80230e43bd81839001ca2563f5cc2b84e9517cce70bb28b40eb105e572
-  data.tar.gz: c40dd82ef778bb73a4a2b32af004f072f5912d9677eeafa01de974a33ee81dac05d9c61b79a7a81d7dce9c436efe5048552d222c92ef2e8183db84ddd8dd3be1
+  metadata.gz: cb6acce374a2eba3a66e0e984ee468f8dc392ad8378701972a48ab88e8829611f0ee21efda3206ee4b5f0b8913e13ea24ef9671e0376e483b8f2d4594d227aed
+  data.tar.gz: 16ca63b73868706bec235247a3dbf1e91d28ad0e53fce4a4a83954031e394994dd3349d416069ba822f45fa7139b235b366687db31e944c40928f582f2c85f81

data/README.md

@@ -22,7 +22,69 @@ Or install it yourself as:
 
 ## Usage
 
-TODO: Write usage instructions here
+At the moment, Hitman can only auto-analyse Grape APIs, but if you have any other API, you can still use it by supplying the configuration manually.
+
+First, define a target to attack. It is best to run your API locally, for speed reasons.
+
+```ruby
+t = Hitman::Target.new('my api', 'http://localhost:9292')
+```
+
+Hitman needs the name and the address of its target. He's gonna find out the rest. No need for a picture.
+
+If your API uses param authentication, you can supply `postfix` data which will be attached to every request made, e.g. if you need to authenticate:
+
+```ruby
+t.postfix = { email: 'test@hitman.org', password: '12345678' }
+```
+
+Hitman first needs to analyse the target to find the best possible strategy to attack. Load your API class and pass it, along with a reference to your target, to Hitman:
+
+```ruby
+scanner = Hitman::Scanner.new
+target = scanner.scan_grape(t, API)
+```
+
+Hitman is ready and armed now. Start the fuzzer and watch chaos unfold.
+
+```ruby
+fuzzer = Hitman::Fuzzer.new
+fuzzer.start(target)
+```
+
+## Not using a Grape API? No problem.
+
+You just manually need to supply some secret information to Hitman.
+
+First, create a target:
+
+```ruby
+t = Hitman::Target.new('my api', 'http://localhost:9292')
+```
+
+Then, for every endpoint of your API, you need to supply the HTTP method, the path and possible parameters in the form
+
+```ruby
+route = Hitman::Route.new('post', '/api/users')
+t.routes << route
+route.params << Hitman::Param.new('email', 'string')
+route.params << Hitman::Param.new('password', 'string')
+route.params << Hitman::Param.new('password_confirmation', 'string')
+```
+
+You can use this example:
+
+```ruby
+my_api_routes.each do |api_route|
+  route = Hitman::Route.new(api_route.method, api_route.path)
+  t.routes << route
+  api_route.params.each do |name, type|
+    route.params << Hitman::Param.new(name, type)
+  end
+end
+```
+
+After that, you're ready to run the Fuzzer.
 
 ## Development
 
@@ -32,5 +94,4 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/hitman.
-
+Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/hitman.

data/lib/hitman/iterators/symbol_iterator.rb

@@ -0,0 +1,9 @@
+class SymbolIterator
+  def random_string(length)
+    rand(36**length).to_s(36)
+  end
+
+  def get
+    [:'', random_string(10).to_sym, random_string(500).to_sym]
+  end
+end

data/lib/hitman/version.rb

@@ -1,3 +1,3 @@
 module Hitman
-  VERSION = "0.1.1"
+  VERSION = "0.1.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hitman
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Lukas_Skywalker
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-02-03 00:00:00.000000000 Z
+date: 2018-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -58,6 +58,7 @@ files:
 - lib/hitman/iterators/hash_iterator.rb
 - lib/hitman/iterators/integer_iterator.rb
 - lib/hitman/iterators/string_iterator.rb
+- lib/hitman/iterators/symbol_iterator.rb
 - lib/hitman/param.rb
 - lib/hitman/request.rb
 - lib/hitman/route.rb
@@ -83,7 +84,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.3
+rubygems_version: 2.6.11
 signing_key: 
 specification_version: 4
 summary: API fuzzing for professionals