漏洞验证框架的构思与实现

   func GenOriginalReq(url string) (*http.Request, error) {     // 生成原始请求，如果没有协议默认使用http     if strings.HasPrefix(url, "http://") || strings.HasPrefix(url, "https://") {     } else {       url = "http://" + url     }     originalReq, err := http.NewRequest("GET", url, nil)     if err != nil {       log.Error("util/requests.go:GenOriginalReq original request gen error", url, err)       return nil, err     }     originalReq.Header.Set("Host", originalReq.Host)     originalReq.Header.Set("Accept-Encoding", "gzip, deflate")     originalReq.Header.Set("Accept","*/*")     originalReq.Header.Set("User-Agent", conf.GlobalConfig.HttpConfig.Headers.UserAgent)     originalReq.Header.Set("Accept-Language","en")     originalReq.Header.Set("Connection","close")     return originalReq, nil   }

func GenOriginalReqFromRaw(filePath string) (*http.Request, error)  {  raw, err := ioutil.ReadFile(filePath)  if err != nil {    c.JSON(msg.ErrResp("请求报文文件解析失败"))    return nil, err  }  oreq, err := http.ReadRequest(bufio.NewReader(bytes.NewReader(raw)))  if err != nil {    return nil, err  }  if !oreq.URL.IsAbs() {    scheme := "http"    oreq.URL.Scheme = scheme    oreq.URL.Host = oreq.Host  }  return oreq, nil}

name: poc-yaml-airflow-unauthrules:  - method: GET    path: /admin/    E xpression: |      response.status == 200 && response.body.bcontains(b"<title>Airflow - DAGs</title>") && response.body.bcontains(b"<h2>DAGs</h2>")

GET /aaa/bbb.html HTTP/1.1Host: testphp.vulnweb.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0Accept-Encoding: gzip, deflateConnection: close

GET /aaa/admin/ HTTP/1.1Host: testphp.vulnweb.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0Accept-Encoding: gzip, deflateConnection: close

func ExecE xpressionHandle(ctx controllerContext){    var result bool    var err error    poc := ctx.GetPoc()    if poc == nil {        log.Error("[rule/handle.go:ExecE xpressionHandle error] ", "poc is nil")        return    }    if poc.Groups != nil {        result, err = ctx.Groups(ctx.IsDebug())    } else {
        result, err = ctx.Rules(poc.Rules,ctx.IsDebug())    }    if err != nil {        log.Error("[rule/handle.go:ExecE xpressionHandle error] ", err)        return    }    if result {        ctx.Abort()    }    return}

// 根据原始请求 + rule 生成并发起新的请求func (controller *PocController) DoSingleRuleRequest(rule *Rule) (*proto.Response, error) {    fastReq := controller.Request.Fast    // fixReq : 根据规则对原始请求进行变形    fixedFastReq := fasthttp.AcquireRequest()    fastReq.CopyTo(fixedFastReq)    curPath := string(fixedFastReq.URI().Path())    affects := controller.Plugin.Affects    switch affects {    // 情况4 参数级    case AffectAppendParameter, AffectReplaceParameter:        for k, v := range rule.Headers {            fixedFastReq.Header.Set(k, v)        }        return util.DoFasthttpRequest(fixedFastReq, rule.FollowRedirects)    //    情况3 content级    case AffectContent:        return util.DoFasthttpRequest(fixedFastReq, rule.FollowRedirects)    // 情况1 dir级    case AffectDirectory:        // 目录级漏洞检测 判断是否以 "/"结尾        if curPath != "" && strings.HasSuffix(curPath, "/") {            // 去掉规则中的的"/" 再拼            curPath = fmt.Sprint(curPath, strings.TrimPrefix(rule.Path, "/"))        } else {            curPath = fmt.Sprint(curPath, "/" ,strings.TrimPrefix(rule.Path, "/"))        }    // 情况2    case AffectServer:        curPath = rule.Path    // url级(直接使用原始请求头，只替换路径和完整post参数)    case AffectURL:        //curPath = curPath, strings.TrimPrefix(rule.Path, "/"))    default:    }    // 兼容xray: 某些 POC 没有区分path和query    curPath = strings.ReplaceAll(curPath, " ", "%20")    curPath = strings.ReplaceAll(curPath, "+", "%20")    fixedFastReq.URI().DisablePathNormalizing= true    fixedFastReq.URI().Update(curPath)    for k, v := range rule.Headers {        fixedFastReq.Header.Set(k, v)    }    fixedFastReq.Header.SetMethod(rule.Method)    // 处理multipart    contentType := string(fixedFastReq.Header.ContentType())    if strings.HasPrefix(strings.ToLower(contentType),"multipart/form-Data") && strings.Contains(rule.Body,"nn") {        multipartBody, err := util.DealMultipart(contentType, rule.Body)        if err != nil {            return nil, err        }        fixedFastReq.SetBody([]byte(multipartBody))    }else {        fixedFastReq.SetBody([]byte(rule.Body))    }    return util.DoFasthttpRequest(fixedFastReq, rule.FollowRedirects)}

func DealMultipart(contentType string, ruleBody string) (result string, err error) {    errMsg := ""    // 处理multipart的/n    re := regexp.MustCompile(`(?m)multipart/form-Data; boundary=(.*)`)    match := re.FindStringSubmatch(contentType)    if len(match) != 2 {        errMsg = "no boundary in content-type"        //logging.GlobalLogger.Error("util/requests.go:DealMultipart Err", errMsg)        return "", errors.New(errMsg)    }    boundary := "--" + match[1]    multiPartContent := ""    // 处理rule    multiFile := strings.Split(ruleBody, boundary)    if len(multiFile) == 0 {        errMsg = "ruleBody.Body multi content format err"        //logging.GlobalLogger.Error("util/requests.go:DealMultipart Err", errMsg)        return multiPartContent, errors.New(errMsg)    }    for _, singleFile := range multiFile {        //    处理单个文件        //    文件头和文件响应        spliteTmp := strings.Split(singleFile,"nn")        if len(spliteTmp) == 2 {            fileHeader := spliteTmp[0]            fileBody := spliteTmp[1]            fileHeader = strings.Replace(fileHeader,"n","rn",-1)            multiPartContent += boundary + fileHeader + "rnrn" + strings.TrimRight(fileBody ,"n") + "rn"        }    }    multiPartContent += boundary + "--" + "rn"    return multiPartContent, nil}