Skip to content

Remove default values from api profiles#284

Merged
cobbr merged 2 commits intocobbr:devfrom
sclow:remove_default_values_from_api_profiles
Feb 6, 2021
Merged

Remove default values from api profiles#284
cobbr merged 2 commits intocobbr:devfrom
sclow:remove_default_values_from_api_profiles

Conversation

@sclow
Copy link

@sclow sclow commented Feb 5, 2021

Issue
When trying to create listener profiles via the Swagger_UI, the default values in "Profile.cs" get applied regardless of what is supplied within the Swagger_UI.
This is not an issue within the native (web/websocket) UI.

Steps to Validate
E.g. for a Covenant instance running on "https://kali:7443/" you can access the Swagger UI at "https://kali:7443/swagger/", authenticate and set your Bearer to allow other commands.

  1. Authenticate!
  2. Use "GET /api/profiles/http/{id}" with the ID = 1 to get the "DefaultHttpProfile" - copy the JSON response
  3. Use "PUT /api/profiles/http" and the copied JSON code to update the "DefaultHttpProfile"
  4. See that the URLs, Response and Request headers now have default values applied that were not in the configuration supplied to the API.

Why a problem?
If two listeners use the same default value for URL they end up conflicting over requests to that URL end point, this makes existing GRUNTS go offline (LOST) and new GRUNTS are unstable until the conflict is resolved.

Proposed Fix

  1. Remove Default values from "Profile.cs", this allows the API to behave as expected, however it also breaks the WebUI as you can create a listener with no sane defaults.
  2. Move the Default values into the HttpProfileForm.razor HTML template, such that when creating a new profile (and therefore the Lists for HttpURLs and Requests / Responses are empty) sane defaults get applied.

Testing Conducted

  1. That the Swagger_API can create listener profiles that matched supplied configuration.
  2. That the Web_UI can create listener profiles with sane default values.
  3. That Listeners can be created using newly created profiles
  4. That GRUNTS can connect to this Listeners using new profiles.

@cobbr cobbr changed the base branch from master to dev February 5, 2021 23:36
@cobbr cobbr merged commit 3e039ce into cobbr:dev Feb 6, 2021
@cobbr
Copy link
Owner

cobbr commented Feb 6, 2021

Thanks @sclow , great catch and fix, appreciate it!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants