Python FuzzableRequest.from_parts方法代码示例

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def _get_request_response_from_work_unit(self, work_unit):
        """
        In some cases the work unit is a tuple with request / response instances.

        In other cases it is an ID, which needs to be queried from the History DB
        to get the request / response.

        :param work_unit: One of the options explained above
        :return: A request / response tuple
        """
        if not isinstance(work_unit, int):
            request, response = work_unit
        else:
            # Before we sent requests and responses as work units,
            # but since we changed from Queue to CachedQueue for BaseConsumer
            # the database was growing really big (1GB) for storing that traffic
            # and I decided to migrate to using just the response.id and querying
            # the SQLite one extra time.
            history = HistoryItem()
            request, response = history.load_from_file(work_unit)

        # Create a fuzzable request based on the urllib2 request object
        headers_inst = Headers(request.header_items())
        request = FuzzableRequest.from_parts(request.url_object,
                                             request.get_method(),
                                             request.get_data() or '',
                                             headers_inst)

        return request, response

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
 def test_str_with_postdata(self):
     headers = Headers([('content-type', URLEncodedForm.ENCODING)])
     fr = FuzzableRequest.from_parts("http://www.w3af.com/", post_data='a=1',
                                     headers=headers)
     expected = 'Method: GET | http://www.w3af.com/ | URL encoded ' \
                'form: (a)'
     self.assertEqual(str(fr), expected)

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def test_multipart_post(self):
        boundary, post_data = multipart_encode([('a', 'bcd'), ], [])
        multipart_boundary = 'multipart/form-data; boundary=%s'

        headers = Headers([('content-length', str(len(post_data))),
                           ('content-type', multipart_boundary % boundary)])

        fr = FuzzableRequest.from_parts(self.url, headers=headers,
                                        post_data=post_data, method='POST')

        form_params = FormParameters()
        form_params.add_field_by_attr_items([('name', 'a'),
                               ('type', 'text'),
                               ('value', 'bcd')])

        expected_container = MultipartContainer(form_params)
        expected_headers = Headers([('content-type',
                                     multipart_boundary % boundary)])

        self.assertEqual(fr.get_url(), self.url)
        self.assertEqual(fr.get_headers(), expected_headers)
        self.assertIn('multipart/form-data', fr.get_headers()['content-type'])
        self.assertEqual(fr.get_method(), 'POST')
        self.assertIsInstance(fr.get_raw_data(), MultipartContainer)
        self.assertEqual(fr.get_raw_data(), expected_container)

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def test_from_freq(self):
        freq = FuzzableRequest.from_parts(self.get_url(), 'POST',
                                          XML_WITH_FUZZABLE, Headers())
        m = XmlRpcMutant(freq)

        self.assertIsInstance(m.get_dc(), XmlRpcContainer)

        dc = m.get_dc()
        self.assertIn('string', dc)
        self.assertIn('base64', dc)

        self.assertEqual(len(dc['string']), 1)
        self.assertEqual(len(dc['base64']), 1)

        self.assertEqual(dc['string'][0], 'Foo bar')
        self.assertEqual(dc['base64'][0], 'Spam eggs')

        self.assertEqual(str(m.get_dc()), str(m.get_data()))

        found_at = '"http://w3af.com/a/b/c.php", using HTTP method POST. ' \
                   'The sent XML-RPC was: "<methodCall>\n   <methodName>' \
                   'sample.sum</methodName>\n   <params>\n ".'
        self.assertEqual(m.found_at(), found_at)

        headers = m.get_headers()
        self.assertIn('Content-Type', headers)
        self.assertEqual(headers['Content-Type'], 'application/xml')

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def test_simplest(self):
        fr = FuzzableRequest.from_parts(self.url)

        self.assertEqual(fr.get_url(), self.url)
        self.assertEqual(fr.get_headers(), Headers())
        self.assertEqual(fr.get_method(), "GET")
        self.assertIsInstance(fr.get_raw_data(), KeyValueContainer)

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def test_raw_url(self):
        raw_url = "http://w3af.org/foo/"
        fr = FuzzableRequest.from_parts(raw_url)

        self.assertEqual(fr.get_url().url_string, raw_url)
        self.assertEqual(fr.get_headers(), Headers())
        self.assertEqual(fr.get_method(), "GET")
        self.assertIsInstance(fr.get_raw_data(), KeyValueContainer)

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def test_headers_method(self):
        hdr = Headers([("foo", "bar")])
        fr = FuzzableRequest.from_parts(self.url, method="PUT", headers=hdr)

        self.assertEqual(fr.get_url(), self.url)
        self.assertEqual(fr.get_headers(), hdr)
        self.assertEqual(fr.get_method(), "PUT")
        self.assertIsInstance(fr.get_raw_data(), KeyValueContainer)

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def test_json_post(self):
        post_data = '{"1":"2"}'
        hdr = Headers([("content-length", str(len(post_data))), ("content-type", "application/json")])

        fr = FuzzableRequest.from_parts(self.url, headers=hdr, post_data=post_data, method="POST")

        self.assertEqual(fr.get_url(), self.url)
        self.assertEqual(fr.get_headers(), hdr)
        self.assertEqual(fr.get_method(), "POST")
        self.assertIsInstance(fr.get_raw_data(), JSONContainer)

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def test_xmlrpc_mutant(self):
        url = URL('http://moth/?id=1')
        post_data = XML_WITH_FUZZABLE
        headers = Headers()
        freq = FuzzableRequest.from_parts(url, 'POST', post_data, headers)
        mutants = create_mutants(freq, self.payloads)

        self.assertAllInstance(mutants[:2], QSMutant)
        self.assertAllInstance(mutants[4:], XmlRpcMutant)
        self.assertAllHaveTokens(mutants)

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def test_simple_post(self):
        post_data = "a=b&d=3"
        hdr = Headers([("content-length", str(len(post_data))), ("content-type", URLEncodedForm.ENCODING)])

        fr = FuzzableRequest.from_parts(self.url, headers=hdr, post_data=post_data, method="POST")

        self.assertEqual(fr.get_url(), self.url)
        self.assertEqual(fr.get_headers(), hdr)
        self.assertEqual(fr.get_method(), "POST")
        self.assertIn("content-type", fr.get_headers())
        self.assertIsInstance(fr.get_raw_data(), URLEncodedForm)

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def test_xmlrpc_post(self):
        post_data = """<methodCall>
            <methodName>system.listMethods</methodName>
            <params></params>
        </methodCall>"""

        headers = Headers([("content-length", str(len(post_data)))])

        fr = FuzzableRequest.from_parts(self.url, headers=headers, post_data=post_data, method="POST")

        self.assertEqual(fr.get_url(), self.url)
        self.assertEqual(fr.get_headers(), headers)
        self.assertEqual(fr.get_method(), "POST")
        self.assertIsInstance(fr.get_raw_data(), XmlRpcContainer)

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def test_json_creation_missing_header(self):
        post_data = '{"1":"2"}'
        # Missing the content-type header for json
        headers = Headers([("content-length", str(len(post_data)))])

        fr = FuzzableRequest.from_parts(self.url, headers=headers, post_data=post_data, method="POST")

        self.assertEqual(fr.get_url(), self.url)
        self.assertEqual(fr.get_headers(), headers)
        self.assertEqual(fr.get_method(), "POST")

        # Here the "default" post-data is set, which will be empty because we
        # failed to parse the post-data
        self.assertIsInstance(fr.get_raw_data(), PlainContainer)
        self.assertEqual(fr.get_raw_data().get_param_names(), [])

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
def create_mutant_from_params(method, uri, var, post_data):
    uri = URL(uri)

    if method.upper() == 'GET' and var in uri.querystring:
        MutantKlass = QSMutant
        headers = Headers()
    else:
        MutantKlass = PostDataMutant
        headers = Headers([('content-type', URLEncodedForm.ENCODING)])

    freq = FuzzableRequest.from_parts(uri, method=method,
                                      post_data=post_data, headers=headers)
    mutant = MutantKlass(freq)
    mutant.get_dc().set_token((var, 0))
    return mutant

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def _grep(self, request, response):

        url_instance = request.url_object
        domain = url_instance.get_domain()

        if self._grep_queue_put is not None and\
        domain in cf.cf.get('target_domains'):

            # Create a fuzzable request based on the urllib2 request object
            headers_inst = Headers(request.header_items())
            fr = FuzzableRequest.from_parts(url_instance,
                                            request.get_method(),
                                            request.get_data() or '',
                                            headers_inst)

            self._grep_queue_put((fr, response))

# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_parts [as 别名]
    def test_invalid_multipart_post(self):
        _, post_data = multipart_encode([("a", "bcd")], [])

        # It is invalid because there is a missing boundary parameter in the
        # content-type header
        headers = Headers([("content-length", str(len(post_data))), ("content-type", "multipart/form-data")])

        fr = FuzzableRequest.from_parts(self.url, headers=headers, post_data=post_data, method="POST")

        self.assertEqual(fr.get_url(), self.url)
        self.assertEqual(fr.get_headers(), headers)
        self.assertEqual(fr.get_method(), "POST")

        # Here the "default" post-data is set, which will be empty because we
        # failed to parse the post-data
        self.assertIsInstance(fr.get_raw_data(), PlainContainer)
        self.assertEqual(fr.get_raw_data().get_param_names(), [])