timing_attack 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 95817b4056c1f1165c1ac8906afaec786275d967
-  data.tar.gz: 89f6577a6bb247bdb5becd5049bd1237b065cd0c
+  metadata.gz: a9dad3ef8376bd88e79bcd12837a63ba8f3a13bc
+  data.tar.gz: e9264080d5a988ec447116417c9a70d90651dad9
 SHA512:
-  metadata.gz: 1419ba3974ce57b6895a15d96dc589f0c0748244fc2240d8ff0f8c0e9ba31beac4f54e541127682f10276bf49b601a286ccb48319ae309f30f09481a955efbb0
-  data.tar.gz: 2f91cf8e49eb9d33c1277f87aff5924f734caedd58bb4b817d3e9797110082678ca12c271de483a0029623fcadf05be2ce5db2a02cfe3477561a67d8ef26dcc8
+  metadata.gz: 4c30183c4cad7f9aab7d7b4ad38ea8bdecbf33462d5e6bb665259f216682ceae8d5665fd09f8641f2173cfb2b189cb2f3207aa9f4fa6efdbef49d928d39298c2
+  data.tar.gz: 8176233a6769ddbba0c37e74dd7b640af90b476bf90a0600e3ae57c83d1cf87468e3cbdd1eeec3c9d8b3530b948b597c95b4f2007df4444e5d5d238a48329bdf

data/README.md

@@ -29,6 +29,8 @@ timing_attack [options] -u <target> <inputs>
     -i, --inputs-file FILE           Read inputs from specified file, one per line
         --parameters STR             JSON hash of URL parameters.  'INPUT' will be replaced with the attack string
         --parameters-file FILE       Name of file containing parameters as with --parameters
+        --headers STR                JSON hash of headers.  'INPUT' will be replaced with the attack string
+        --headers-file FILE          Name of file containing headers as with --headers
         --body STR                   JSON hash of parameters to be included in the request body.  'INPUT' will be replaced with the attack string
         --body-file FILE             Name of file containing parameters as with --body
         --http-username STR          HTTP basic authentication username.  'INPUT' will be replaced with the attack string
@@ -42,9 +44,12 @@ timing_attack [options] -u <target> <inputs>
 
 Note that setting concurrency too high can add significant jitter to your results.  If you know that your inputs contain elements in both long and short response groups but your results are bogus, try backing off on concurrency.  The default value of 15 is a good starting place for robust remote targets, but you might need to dial it back to as far as 1 (especially if you're attacking a single-threaded server)
 
-For the `url`, `body`, and `parameters` options, the string `INPUT` can be included.  It will be replaced with the current test string.
+For the `url`, `body`, `headers`, `--http-password`, `http-username`, and
+`parameters` options, the string `INPUT` can be included.  It will be replaced
+with the current test string.
 
-The `body` and `parameters` options take objects serialized with JSON.
+The `body`, `headers`, and `parameters` options take objects serialized with
+JSON.
 
 ### Enumeration
 
@@ -88,10 +93,11 @@ This will attempt a brute-force timing attack against against the `password`
 parameter.
 
 ### Specifying inputs
-The URL itself (`--url`), URL parameters (`--parameters`), and the HTTP body
-(`--body`) can all contain the string `INPUT`.  `INPUT` will be replaced with
-the current attack string, whether it is specified on the command line (as in
-enumeration mode), or generated by timing_attack (as in brute force mode).
+The URL itself (`--url`), URL parameters (`--parameters`), HTTP body
+(`--body`), and HTTP headers (`--headers`) can all contain the string `INPUT`.
+`INPUT` will be replaced with the current attack string, whether it is
+specified on the command line (as in enumeration mode), or generated by
+timing_attack (as in brute force mode).
 
 To perform a timing attack against HTTP basic authentication, `--http-username`
 and `--http-password` can be specified.  `INPUT` will be replaced with the
@@ -101,10 +107,11 @@ The `--parameters` and `--body` options must be specified in JSON format.
 
 ## Reading from files
 
-Body contents, parameters, and inputs can all be read from a file specified on
-the comamnd line with `--body-file`, `--parameters-file`, and `--inputs-file`
-respectively.  `--body-file` and `--parameters-file` expect the file's contents
-to be a JSON hash; `--inputs-file` simply expects one input per line.
+Body contents, parameters, headers, and inputs can all be read from a file
+specified on the comamnd line with `--body-file`, `--parameters-file`,
+`--headers-file`, and `--inputs-file` respectively.  `--body-file`,
+`--parameters-file`, and `--headers-file` expect the file's contents to be a
+JSON hash; `--inputs-file` simply expects one input per line.
 
 Example:
 ```

data/exe/timing_attack

@@ -61,6 +61,12 @@ class TimingAttackCli
       opts.on("--parameters-file FILE", "Name of file containing parameters as with --parameters") do |str|
         options[:params] = json_file(str)
       end
+      opts.on("--headers STR", "JSON hash of headers.  'INPUT' will be replaced with the attack string") do |str|
+        options[:headers] = JSON.parse(str)
+      end
+      opts.on("--headers-file FILE", "Name of file containing headers as with --headers") do |str|
+        options[:headers] = json_file(str)
+      end
       opts.on("--body STR", "JSON hash of parameters to be included in the request body.  'INPUT' will be replaced with the attack string") do |str|
         options[:body] = JSON.parse(str)
       end

data/lib/timing_attack/attacker.rb

@@ -4,7 +4,7 @@ module TimingAttack
       @options = default_options.merge(options)
       raise ArgumentError.new("Must provide url") if url.nil?
       unless specified_input_option?
-        msg = "'#{INPUT_FLAG}' not found in url, parameters, body, or HTTP authentication options"
+        msg = "'#{INPUT_FLAG}' not found in url, parameters, body, headers, or HTTP authentication options"
         raise ArgumentError.new(msg)
       end
       raise ArgumentError.new("Iterations can't be < 3") if iterations < 3
@@ -15,6 +15,7 @@ module TimingAttack
         puts "Target: #{url}"
         puts "Method: #{method.to_s.upcase}"
         puts "Parameters: #{params.inspect}" unless params.empty?
+        puts "Headers: #{headers.inspect}" unless headers.empty?
         puts "Body: #{body.inspect}" unless body.empty?
       end
       attack!
@@ -23,7 +24,7 @@ module TimingAttack
     private
     attr_reader :attacks, :options
 
-    %i(iterations url verbose width method mean percentile threshold concurrency params body).each do |sym|
+    %i(iterations url verbose width method mean percentile threshold concurrency params body headers).each do |sym|
       define_method(sym) { options.fetch sym }
     end
     alias_method :verbose?, :verbose
@@ -39,6 +40,7 @@ module TimingAttack
         concurrency: 15,
         params: {},
         body: {},
+        headers: {},
         basic_auth_username: "",
         basic_auth_password: ""
       }.freeze
@@ -58,7 +60,7 @@ module TimingAttack
     end
 
     def input_options
-      @input_options ||= %i(basic_auth_password basic_auth_username body params url)
+      @input_options ||= %i(basic_auth_password basic_auth_username body params url headers)
     end
 
     def specified_input_option?

data/lib/timing_attack/spinner.rb

@@ -3,9 +3,10 @@ module TimingAttack
 
     STATES = %w(| / - \\)
     def increment
-      @spinner_i ||= 0
-      @spinner_i += 1
-      print "\r #{STATES[@spinner_i % STATES.length]}"
+      @_spinner ||= 0
+      print "\r #{STATES[@_spinner % STATES.length]}"
+      @_spinner += 1
+      @_spinner = 0 if @_spinner >= STATES.length
     end
   end
 end

data/lib/timing_attack/test_case.rb

@@ -13,8 +13,9 @@ module TimingAttack
         options.fetch(:url).
         gsub(INPUT_FLAG, input)
       )
-      @params = params_from(options.fetch :params, {})
-      @body = params_from(options.fetch :body, {})
+      @params = params_from(options.fetch(:params, {}))
+      @body = params_from(options.fetch(:body, {}))
+      @headers = params_from(options.fetch(:headers, {}))
       @basic_auth_username = params_from(
         options.fetch(:basic_auth_username, "")
       )
@@ -36,6 +37,7 @@ module TimingAttack
       }.tap do |h|
         h[:params] = params unless params.empty?
         h[:body] = body unless body.empty?
+        h[:headers] = headers unless headers.empty?
         h[:userpwd] = typhoeus_basic_auth unless typhoeus_basic_auth.empty?
       end
     end
@@ -85,6 +87,6 @@ module TimingAttack
     end
 
     attr_reader :times, :options, :percentiles, :url, :params, :body
-    attr_reader :basic_auth_username, :basic_auth_password
+    attr_reader :basic_auth_username, :basic_auth_password, :headers
   end
 end

data/lib/timing_attack/version.rb

@@ -1,3 +1,3 @@
 module TimingAttack
-  VERSION = "0.6.0"
+  VERSION = "0.7.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: timing_attack
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Forrest Fleming
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-12-06 00:00:00.000000000 Z
+date: 2017-12-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ruby-progressbar