Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reduce false positives with canary probe #2168

Merged
merged 7 commits into from
Jan 14, 2025
+239 −17
Merged

Reduce false positives with canary probe #2168

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6bbc9d0
reduce false postives with canary probe
liquidsec Jan 13, 2025
8d6df7e
changing comments
liquidsec Jan 13, 2025
e8d0915
fixing tests
liquidsec Jan 13, 2025
10b9eb3
adding support for all parameter types
liquidsec Jan 13, 2025
969b07d
tests for all parameter types
liquidsec Jan 13, 2025
1a163e7
fix test
liquidsec Jan 13, 2025
cba944a
comment cleanup
liquidsec Jan 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 20 additions & 4 deletions bbot/modules/reflected_parameters.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,26 @@ async def handle_event(self, event):
await self.emit_event(data, "FINDING", event)

async def detect_reflection(self, event, url):
"""Detects reflection by sending a probe with a random value."""
"""Detects reflection by sending a probe with a random value and a canary parameter."""
probe_parameter_name = event.data["name"]
probe_parameter_value = self.helpers.rand_string()
probe_url = self.helpers.add_get_params(url, {probe_parameter_name: probe_parameter_value}).geturl()
self.debug(f"reflected_parameters Probe URL: {probe_url}")
canary_parameter_value = self.helpers.rand_string()
probe_url = self.helpers.add_get_params(
url,
{
probe_parameter_name: probe_parameter_value,
"c4n4ry": canary_parameter_value
}
).geturl()

probe_response = await self.helpers.request(probe_url, method="GET")
return probe_response and probe_parameter_value in probe_response.text

# Check if the probe parameter value is reflected AND the canary is not
if probe_response:
response_text = probe_response.text
reflection_result = (
probe_parameter_value in response_text and
canary_parameter_value not in response_text
)
return reflection_result
return False
23 changes: 23 additions & 0 deletions bbot/test/test_step_2/module_tests/test_module_reflected_parameters.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,3 +44,26 @@ def check(self, module_test, events):
in e.data["description"]
for e in events
)

class TestReflected_parameters_with_canary(TestReflected_parameters_fromexcavate):

def request_handler(self, request):
normal_block = '<html><a href="/?reflected=foo">foo</a></html>'
qs = str(request.query_string.decode())
if qs:
# Split the query string into key-value pairs
params = qs.split("&")
# Construct the reflected block with all parameters
reflected_block = '<html><a href="/?'
reflected_block += '&'.join(params)
reflected_block += '"></a></html>'
return Response(reflected_block, status=200)
else:
return Response(normal_block, status=200)

def check(self, module_test, events):
# Ensure no findings are emitted when the canary is reflected
assert not any(
e.type == "FINDING"
for e in events
)
Loading