-
Notifications
You must be signed in to change notification settings - Fork 9
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #35 from usdAG/develop
FlowMate v1.1 Release
- Loading branch information
Showing
79 changed files
with
3,419 additions
and
410 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| package audit; | ||
|
|
||
| import db.MatchHelperClass; | ||
| import gui.AuditFindingView; | ||
|
|
||
| public class CrossContentTypeAudit { | ||
|
|
||
| private AuditFindingView auditFindingView; | ||
|
|
||
| public CrossContentTypeAudit(AuditFindingView auditFindingView) { | ||
| this.auditFindingView = auditFindingView; | ||
| } | ||
|
|
||
| public void performAudit(MatchHelperClass matchHelper) { | ||
| var inputValueType = matchHelper.getInputValueObj().getType(); | ||
| var responseContentType = matchHelper.getResponseContentType(); | ||
|
|
||
| // Ignore responseContentType HTML and JSON | ||
| if (responseContentType.equals("HTML") || responseContentType.equals("JSON") || responseContentType.equals("CSS") || inputValueType.equals("COOKIE")) { | ||
| return; | ||
| } | ||
|
|
||
| if (!responseContentType.equals(inputValueType)) { | ||
| AuditFinding finding = buildAuditFinding(matchHelper.getName(), inputValueType, responseContentType); | ||
| auditFindingView.addFinding(finding); | ||
| } | ||
| } | ||
|
|
||
| private AuditFinding buildAuditFinding(String paramName, String contentTypeEntered, String contentTypeFound) { | ||
| return new CrossContentTypeAuditFinding(paramName, contentTypeEntered, contentTypeFound); | ||
| } | ||
|
|
||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| package audit; | ||
|
|
||
| public class CrossContentTypeAuditFinding extends AuditFinding { | ||
|
|
||
| private String parameterName; | ||
| private String contentTypeEntered; | ||
| private String contentTypeFound; | ||
| private static final String name = "Cross-Content-Type Parameter Match"; | ||
|
|
||
| public CrossContentTypeAuditFinding(String parameterName, String contentTypeEntered, String contentTypeFound) { | ||
| super(name, AuditFinding.FindingSeverity.MIDDLE); | ||
| this.parameterName = parameterName; | ||
| this.contentTypeEntered = contentTypeEntered; | ||
| this.contentTypeFound = contentTypeFound; | ||
| } | ||
|
|
||
|
|
||
| @Override | ||
| public String getShortDescription() { | ||
| return String.format("The parameter %s was entered with content type %s and found in content type %s", this.parameterName, this.contentTypeEntered, this.contentTypeFound); | ||
| } | ||
|
|
||
| @Override | ||
| public String getLongDescription() { | ||
| String htmlTemplate = """ | ||
| <h1>Description</h1> | ||
| FlowMate identified a <b>data flow where the input value is reflected in a different content type</b>. If the data is not properly sanitized or validated, this might allow vulnerabilities exploiting the specific syntax or processing rule for that content type. | ||
| For instance, if input values are contained in an XML-response, an attacker might be able to inject XML tags that manipulate data. Another example are CSV files, where attackers can inject formula expressions that might allow code execution when imported in Microsoft Excel. | ||
| <h1>Details</h1> | ||
| The following data flow has been identified: | ||
| <ul> | ||
| <li>Parameter (Value): PARAMETER_NAME</li> | ||
| <li>Input Location (Content Type): ENTERED_IN</li> | ||
| <li>Output Location (Content Type): FOUND_IN</li> | ||
| </ul> | ||
| <h1>How to Test</h1> | ||
| <ol> | ||
| <li>Try to inject meta sequences corresponding to the output file format of the application</li> | ||
| <li>Check if the parser is still able to process the resulting file format, if you break the expected format</li> | ||
| <li>Furthermore, you could use pingback URLs such as the Burp collaborator, to see if your input is processed insecurely (e.g. in case of XXE)</li> | ||
| </ol> | ||
| """; | ||
| return htmlTemplate.replace("PARAMETER_NAME", this.parameterName).replace("ENTERED_IN", this.contentTypeEntered).replace("FOUND_IN", this.contentTypeFound); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| package audit; | ||
|
|
||
| import db.MatchHelperClass; | ||
| import db.entities.InputValue; | ||
| import gui.AuditFindingView; | ||
| import utils.URLExtension; | ||
|
|
||
| public class CrossScopeAudit { | ||
|
|
||
| private AuditFindingView auditFindingView; | ||
|
|
||
| public CrossScopeAudit(AuditFindingView auditFindingView) { | ||
| this.auditFindingView = auditFindingView; | ||
| } | ||
|
|
||
| public void performAudit(MatchHelperClass match) { | ||
| String parameterName = match.getName(); | ||
| InputValue inputValue = match.getInputValueObj(); | ||
| String inputDomain = URLExtension.stringToUrl(inputValue.getUrl()).getHost(); | ||
| String matchDomain = URLExtension.stringToUrl(match.getUrl()).getHost(); | ||
|
|
||
| if (!inputDomain.equals(matchDomain)) { | ||
| AuditFinding finding = buildAuditFinding(parameterName, inputDomain, matchDomain); | ||
| auditFindingView.addFinding(finding); | ||
| } | ||
| } | ||
|
|
||
| private AuditFinding buildAuditFinding(String paramName, String inputDomain, String matchDomain) { | ||
| return new CrossScopeAuditFinding(paramName, inputDomain, matchDomain); | ||
| } | ||
|
|
||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| package audit; | ||
|
|
||
| public class CrossScopeAuditFinding extends AuditFinding { | ||
|
|
||
| private String parameterName; | ||
| private String inputDomain; | ||
| private String matchDomain; | ||
| private static final String name = "Cross-Scope Match"; | ||
|
|
||
| public CrossScopeAuditFinding(String parameterName, String inputDomain, String matchDomain) { | ||
| super(name, AuditFinding.FindingSeverity.MIDDLE); | ||
| this.parameterName = parameterName; | ||
| this.inputDomain = inputDomain; | ||
| this.matchDomain = matchDomain; | ||
| } | ||
|
|
||
| @Override | ||
| public String getShortDescription() { | ||
| return String.format("The parameter %s was entered in domain %s and found in domain %s", this.parameterName, this.inputDomain, this.matchDomain); | ||
| } | ||
|
|
||
| @Override | ||
| public String getLongDescription() { | ||
| String htmlTemplate = """ | ||
| <h1>Description</h1> | ||
| FlowMate identified a <b>data flow that crosses scope boundaries</b>, meaning that the output location is in another application or application component (domain) as the input parameter. Different applications often differ in their input and output handling, which increases the probability of related vulnerabilities. | ||
| Examples for vulnerabilities include Cross-Site Scripting (XSS), Server-Side Template Injections (SSTI), Second-Order SQL-Injections and Server-Site Request Forgery (SSRF). | ||
| As an example, consider a parameter that can be set using an API and its value is then displayed in a web application. This might allow bypassing of input filtering that the application might apply. | ||
| <h1>Details</h1> | ||
| The following data flow has been Identified: | ||
| <ul> | ||
| <li>Parameter (Value): PARAMETER_NAME</li> | ||
| <li>Input Location (Scope #1): INPUT_DOMAIN</li> | ||
| <li>Output Location (Scope #2): OUTPUT_DOMAIN</li> | ||
| </ul> | ||
| <h1>How to Test</h1> | ||
| <ol> | ||
| <li>Make sure to test the affected data flows for vulnerabilities arising specifically from different applications handling the inserted data</li> | ||
| <li>For instance, if different programming languages or frameworks are used to build these applications, vulnerabilities may emerge due to variations in their input handling and sanitization processes</li> | ||
| <li>This could lead to various types of injection vulnerabilities</li> | ||
| </ol> | ||
| """; | ||
| return htmlTemplate.replace("PARAMETER_NAME", this.parameterName).replace("INPUT_DOMAIN", this.inputDomain).replace("OUTPUT_DOMAIN", this.matchDomain); | ||
| } | ||
| } |
Oops, something went wrong.