Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Already on GitHub? Sign in to your account

Add support for URL templates #247

Closed
Zapotek opened this Issue Jul 23, 2012 · 4 comments

Comments

Projects
None yet
2 participants
Owner

Zapotek commented Jul 23, 2012

Add support for URL templates to allow users to specify the proper way to extract URL params from paths.
A lot of apps now use URL-rewrite-like functionality so this a must have.

@ghost ghost assigned Zapotek Jul 23, 2012

Contributor

user021 commented Sep 26, 2013

On another scanner (Acunetix) i noticed this feature, basically can warn if URl rewrite was detected and then you got 2 options, ignore and continue scan or stop scan and define URL rewrite rules, i was wondering if we could get this one step further, auto detect URL rewrite and automatically add rules on the fly during the scan so we avoid infinite scan loops and fps

http://www.acunetix.com/support/no_url_rewrite_rules/
http://www.acunetix.com/blog/docs/acunetix-define-url-rewrite-rules/
http://www.addedbytes.com/articles/for-beginners/url-rewriting-for-beginners/

Owner

Zapotek commented May 9, 2014

Working on this now, reliably auto-detecting it would be impossible, however, what we can do is fuzz each path fragment individually.

That wouldn't even require the user to provide rewrite rules (which can be a PITA and be fraught with mistakes) as all possible rules would be covered -- I think.
Or we can have both features, in case the user is confident and wants to optimize the scan.

Thoughts?

Owner

Zapotek commented May 18, 2014

What I ended up doing is allow for auditing a new class of element, a link-template.

Say you've got this link: http://test.com/user/john/block

You can cherry pick from that link which parts to audit using a regular expression that uses named captures, like so: /user\/\w+\/(?<action>\w+)/

The above would extract the block part from the link and assign the name action to it and then treat it as a regular input.

Or, if you've got many inputs in the same link, you can do something like: /\/(?<category>\w+)\/(?<username>\w+)\/(?<action>\w+)/

Which will extract the category (user), username (john) and action (block) inputs.

I'll also add rewrite support like in the links you provided as it's generally preferable if you've got access to them.

Owner

Zapotek commented May 20, 2014

URL rewrite support implemented as well.

@Zapotek Zapotek closed this May 20, 2014

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment