timing_attack 0.5.3 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c5a767bc1557cd2d37febb6f62077dc19df8c26c
-  data.tar.gz: e990ce379d138770f9e00b2933f6050a87906a58
+  metadata.gz: 95817b4056c1f1165c1ac8906afaec786275d967
+  data.tar.gz: 89f6577a6bb247bdb5becd5049bd1237b065cd0c
 SHA512:
-  metadata.gz: 95324a0b30885988d91f5e50414562782e71fba9be7d6513f99a7d88523ede5edb7bd563c019b3a9b2e1e86a44865a9b06619d3d9bae32d8afb7bb4cb509ec09
-  data.tar.gz: c3bf51e06ee02e73a5277929b94738d2ec56b7ca466de0c7ea4eda8e859b024c36afbcf2df85768e6233a502cf1b8dbdc5927309dbd998322bf1e08faa91050d
+  metadata.gz: 1419ba3974ce57b6895a15d96dc589f0c0748244fc2240d8ff0f8c0e9ba31beac4f54e541127682f10276bf49b601a286ccb48319ae309f30f09481a955efbb0
+  data.tar.gz: 2f91cf8e49eb9d33c1277f87aff5924f734caedd58bb4b817d3e9797110082678ca12c271de483a0029623fcadf05be2ce5db2a02cfe3477561a67d8ef26dcc8

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Forrest Fleming
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -1,4 +1,6 @@
+![Arsenal_2017](https://cdn.rawgit.com/toolswatch/badges/master/arsenal/2017.svg)
 [![Gem Version](https://badge.fury.io/rb/timing_attack.svg)](http://badge.fury.io/rb/timing_attack)
+
 # timing_attack
 
 Profile web applications, sorting inputs into two categories based on
@@ -24,8 +26,11 @@ timing_attack [options] -u <target> <inputs>
     -p, --post                       Use POST, not GET
     -q, --quiet                      Quiet mode (don't display progress bars)
     -b, --brute-force                Brute force mode
+    -i, --inputs-file FILE           Read inputs from specified file, one per line
         --parameters STR             JSON hash of URL parameters.  'INPUT' will be replaced with the attack string
+        --parameters-file FILE       Name of file containing parameters as with --parameters
         --body STR                   JSON hash of parameters to be included in the request body.  'INPUT' will be replaced with the attack string
+        --body-file FILE             Name of file containing parameters as with --body
         --http-username STR          HTTP basic authentication username.  'INPUT' will be replaced with the attack string
         --http-password STR          HTTP basic authentication password.  'INPUT' will be replaced with the attack string
         --percentile NUM             Use NUMth percentile for calculations (default: 3)
@@ -94,6 +99,41 @@ current attack string as above.
 
 The `--parameters` and `--body` options must be specified in JSON format.
 
+## Reading from files
+
+Body contents, parameters, and inputs can all be read from a file specified on
+the comamnd line with `--body-file`, `--parameters-file`, and `--inputs-file`
+respectively.  `--body-file` and `--parameters-file` expect the file's contents
+to be a JSON hash; `--inputs-file` simply expects one input per line.
+
+Example:
+```
+% cat inputs.txt
+charles@poodles.com
+camel@sahara.com
+woofer@beagles.net
+bactrian@dev.null
+dromedary@dev.null
+alpaca@theand.es
+```
+```
+% cat params.txt
+{"login":"INPUT", "password":"123", "delta":"10"}
+```
+```
+% timing_attack -q -u "http://localhost:3000/timing/login" \
+                      --parameters-file params.txt \
+                      --inputs-file inputs.txt
+Short tests:
+  woofer@beagles.net            0.0023
+  alpaca@theand.es              0.0025
+Long tests:
+  bactrian@dev.null             0.1042
+  charles@poodles.com           0.1046
+  camel@sahara.com              0.1051
+  dromedary@dev.null            0.1054
+```
+
 ## How it works
 
 The various inputs are each thrown at the endpoint `--number` times.  The

data/exe/timing_attack

@@ -15,6 +15,24 @@ class TimingAttackCli
 
   private
 
+  def json_file(filename)
+    begin
+      JSON.parse(File.read(filename))
+    rescue JSON::ParserError => e
+      raise TimingAttack::Errors::InvalidFileFormatError.new("Invalid JSON in #{filename}: #{e.message}")
+    rescue Errno::ENOENT
+      raise TimingAttack::Errors::FileNotFoundError.new("#{filename} not found")
+    end
+  end
+
+  def flat_file(filename)
+    begin
+      File.readlines(filename).map(&:strip)
+    rescue Errno::ENOENT
+      raise TimingAttack::Errors::FileNotFoundError.new("#{filename} not found")
+    end
+  end
+
   def opt_parser
     @opt_parser ||= OptionParser.new do |opts|
       opts.program_name = File.basename(__FILE__)
@@ -34,12 +52,21 @@ class TimingAttackCli
       opts.on("-p", "--post", "Use POST, not GET") { |bool| options[:method] = bool ? :post : :get }
       opts.on("-q", "--quiet", "Quiet mode (don't display progress bars)") { |bool| options[:verbose] = !bool }
       opts.on("-b", "--brute-force", "Brute force mode") { |bool| options[:brute_force] = bool }
+      opts.on("-i FILE", "--inputs-file FILE", "Read inputs from specified file, one per line") do |str|
+        options[:inputs] = flat_file(filename)
+      end
       opts.on("--parameters STR", "JSON hash of URL parameters.  'INPUT' will be replaced with the attack string") do |str|
         options[:params] = JSON.parse(str)
       end
+      opts.on("--parameters-file FILE", "Name of file containing parameters as with --parameters") do |str|
+        options[:params] = json_file(str)
+      end
       opts.on("--body STR", "JSON hash of parameters to be included in the request body.  'INPUT' will be replaced with the attack string") do |str|
         options[:body] = JSON.parse(str)
       end
+      opts.on("--body-file FILE", "Name of file containing parameters as with --body") do |str|
+        options[:body] = json_file(str)
+      end
       opts.on("--http-username STR", "HTTP basic authentication username.  'INPUT' will be replaced with the attack string") do |str|
         options[:basic_auth_username] = str
       end
@@ -61,6 +88,9 @@ class TimingAttackCli
   def parse_options
     begin
       opt_parser.parse!
+    rescue TimingAttack::Errors::InvalidFileFormatError, TimingAttack::Errors::FileNotFoundError => e
+      STDERR.puts e.message
+      exit
     rescue OptionParser::InvalidOption => e
       STDERR.puts e.message
       puts opt_parser
@@ -70,6 +100,7 @@ class TimingAttackCli
 
   def sanitize_options
     options[:verbose] = true if options[:verbose].nil?
+    options[:inputs] = ARGV if options[:inputs].nil?
     if options[:percentile]
       options.delete(:mean)
     elsif options[:median]
@@ -84,7 +115,8 @@ class TimingAttackCli
       atk = if options.delete(:brute_force)
               TimingAttack::BruteForcer.new(options: options)
             else
-              TimingAttack::Enumerator.new(inputs: ARGV, options: options)
+              inputs = options.delete(:inputs)
+              TimingAttack::Enumerator.new(inputs: inputs, options: options)
             end
       atk.run!
     rescue ArgumentError => e

data/lib/timing_attack/errors.rb

@@ -1,6 +1,7 @@
 module TimingAttack
   module Errors
-    class BruteForcerError < StandardError
-    end
+    BruteForcerError = Class.new(StandardError)
+    InvalidFileFormatError = Class.new(StandardError)
+    FileNotFoundError = Class.new(StandardError)
   end
 end

data/lib/timing_attack/version.rb

@@ -1,3 +1,3 @@
 module TimingAttack
-  VERSION = "0.5.3"
+  VERSION = "0.6.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: timing_attack
 version: !ruby/object:Gem::Version
-  version: 0.5.3
+  version: 0.6.0
 platform: ruby
 authors:
 - Forrest Fleming
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-02-14 00:00:00.000000000 Z
+date: 2017-12-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ruby-progressbar
@@ -119,6 +119,7 @@ files:
 - ".rspec"
 - ".travis.yml"
 - Gemfile
+- LICENSE.txt
 - README.md
 - Rakefile
 - bin/console
@@ -154,7 +155,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2
+rubygems_version: 2.6.11
 signing_key: 
 specification_version: 4
 summary: Perform timing attacks against web applications