Add --test-all-form-params option

lib/ronin/vulns/cli/commands/lfi.rb

@@ -47,6 +47,7 @@ module Commands
         #         --test-cookie-param NAME     Tests the HTTP Cookie name
         #         --test-all-cookie-params     Test all Cookie param names
         #         --test-form-param NAME       Tests the form param name
+        #         --test-all-form-params       Test all form param names
         #     -i, --input FILE                 Reads URLs from the list file
         #     -O, --os unix|windows            Sets the OS to test for
         #     -D, --depth COUNT                Sets the directory depth to escape up

lib/ronin/vulns/cli/commands/open_redirect.rb

@@ -47,6 +47,7 @@ module Commands
         #         --test-cookie-param NAME     Tests the HTTP Cookie name
         #         --test-all-cookie-params     Test all Cookie param names
         #         --test-form-param NAME       Tests the form param name
+        #         --test-all-form-params       Test all form param names
         #     -i, --input FILE                 Reads URLs from the list file
         #     -T, --test-url URL               Optional test URL to try to redirect to
         #     -h, --help                       Print help information

lib/ronin/vulns/cli/commands/reflected_xss.rb

@@ -47,6 +47,7 @@ module Commands
         #         --test-cookie-param NAME     Tests the HTTP Cookie name
         #         --test-all-cookie-params     Test all Cookie param names
         #         --test-form-param NAME       Tests the form param name
+        #         --test-all-form-params       Test all form param names
         #     -i, --input FILE                 Reads URLs from the list file
         #     -h, --help                       Print help information
         #

lib/ronin/vulns/cli/commands/rfi.rb

@@ -47,6 +47,7 @@ module Commands
         #         --test-cookie-param NAME     Tests the HTTP Cookie name
         #         --test-all-cookie-params     Test all Cookie param names
         #         --test-form-param NAME       Tests the form param name
+        #         --test-all-form-params       Test all form param names
         #     -i, --input FILE                 Reads URLs from the list file
         #     -B double-encode|suffix-escape|null-byte,
         #         --filter-bypass              Optional filter-bypass strategy to use

lib/ronin/vulns/cli/commands/scan.rb

@@ -45,6 +45,7 @@ module Commands
         #         --test-header-names NAME     Tests the HTTP Header name
         #         --test-cookie-params NAME    Tests the HTTP Cookie name
         #         --test-form-params NAME      Tests the form param name
+        #         --test-all-form-params       Test all form param names
         #     -i, --input FILE                 Reads URLs from the list file
         #         --lfi-os unix|windows        Sets the OS to test for
         #         --lfi-depth COUNT            Sets the directory depth to escape up

lib/ronin/vulns/cli/commands/sqli.rb

@@ -47,6 +47,7 @@ module Commands
         #         --test-cookie-param NAME     Tests the HTTP Cookie name
         #         --test-all-cookie-params     Test all Cookie param names
         #         --test-form-param NAME       Tests the form param name
+        #         --test-all-form-params       Test all form param names
         #     -i, --input FILE                 Reads URLs from the list file
         #     -Q, --escape-quote               Escapes quotation marks
         #     -P, --escape-parens              Escapes parenthesis

lib/ronin/vulns/cli/commands/ssti.rb

@@ -48,6 +48,7 @@ module Commands
         #         --test-cookie-param NAME     Tests the HTTP Cookie name
         #         --test-all-cookie-params     Test all Cookie param names
         #         --test-form-param NAME       Tests the form param name
+        #         --test-all-form-params       Test all form param names
         #     -i, --input FILE                 Reads URLs from the list file
         #     -T {X*Y | X/Z | X+Y | X-Y},      Optional numeric test to use
         #         --test-expr

lib/ronin/vulns/cli/web_vuln_command.rb

@@ -148,6 +148,10 @@ class WebVulnCommand < Command
                                    self.test_form_params << name
                                  end
 
+        option :test_all_form_params, desc: 'Tests all form param names' do
+          self.test_form_params = true
+        end
+
         option :input, short: '-i',
                        value: {
                          type:  String,
@@ -358,6 +362,18 @@ def test_form_params
           @scan_kwargs[:form_params] ||= Set.new
         end
 
+        #
+        # Sets the form params to test.
+        #
+        # @param [Set<String>, true] new_form_params
+        #   The new form param names to test.
+        #
+        # @return [Set<String>, true]
+        #
+        def test_form_params=(new_form_params)
+          @scan_kwargs[:form_params] = new_form_params
+        end
+
         #
         # Scans a URL for web vulnerabilities.
         #

lib/ronin/vulns/web_vuln.rb

@@ -336,14 +336,15 @@ def self.scan_cookie_params(url,cookie_params=nil, http: nil, **kwargs)
       # @return [Array<Web>]
       #   All discovered web vulnerabilities.
       #
-      def self.scan_form_params(url,form_params, http: nil, **kwargs)
+      def self.scan_form_params(url,form_params=nil, http: nil, form_data: {}, **kwargs)
         url    = URI(url)
         http ||= Support::Network::HTTP.connect_uri(url)
 
-        vulns = []
+        form_params ||= form_data.keys
+        vulns         = []
 
         form_params.each do |form_param|
-          vuln = new(url, form_param: form_param, http: http, **kwargs)
+          vuln = new(url, form_param: form_param, http: http, form_data: form_data, **kwargs)
 
           if vuln.vulnerable?
             yield vuln if block_given?
@@ -455,7 +456,12 @@ def self.scan(url, query_params:  nil,
 
           if form_params
             vulns.concat(
-              scan_form_params(url,form_params, http: http, **kwargs,&block)
+              case form_params
+              when true
+                scan_form_params(url, http: http, **kwargs,&block)
+              else
+                scan_form_params(url,form_params, http: http, **kwargs,&block)
+              end
             )
           end
         end

spec/cli/web_vuln_command_spec.rb

@@ -631,6 +631,15 @@
       end
     end
 
+    context "when #test_all_form_params is set" do
+      let(:argv) { %w[--test-all-form-param] }
+      before { subject.option_parser.parse(argv) }
+
+      it "must set the :form_params key in the Hash to true" do
+        expect(subject.scan_kwargs[:form_params]).to be(true)
+      end
+    end
+
     context "when #test_form_params is set" do
       let(:form_param) { 'id' }
 

spec/web_vuln_spec.rb

@@ -528,6 +528,25 @@ def vulnerable?
 
         subject.scan_form_params(url,form_params, form_data: form_data)
       end
+
+      context "and a form_params value is not given" do
+        let(:form_params) { nil }
+        let(:form_data) do
+          {
+            'foo' => '1',
+            'bar' => '2',
+            'baz' => '3'
+          }
+        end
+
+        it "must send requests with each Cookie param overridden with the payload" do
+          stub_request(:get, url).with(body: "foo=#{payload}&bar=2&baz=3")
+          stub_request(:get, url).with(body: "foo=1&bar=#{payload}&baz=3")
+          stub_request(:get, url).with(body: "foo=1&bar=2&baz=#{payload}")
+
+          subject.scan_form_params(url,form_params, form_data: form_data)
+        end
+      end
     end
 
     context "when one of the responses indicates it's vulnerable" do
@@ -693,6 +712,27 @@ def vulnerable?
           subject.scan(url, form_params: form_params, form_data: form_data)
         end
       end
+
+      context "and it's true" do
+        context "and a form_data: value is given" do
+          let(:form_params) { nil }
+          let(:form_data) do
+            {
+              'foo' => '1',
+              'bar' => '2',
+              'baz' => '3'
+            }
+          end
+
+          it "must send requests with each Cookie param overridden with the payload" do
+            stub_request(:get, url).with(body: "foo=#{payload}&bar=2&baz=3")
+            stub_request(:get, url).with(body: "foo=1&bar=#{payload}&baz=3")
+            stub_request(:get, url).with(body: "foo=1&bar=2&baz=#{payload}")
+
+            subject.scan(url, form_params: true, form_data: form_data)
+          end
+        end
+      end
     end
   end