Merge pull request #90 from kaakaww/feature/sleep-and-fuzz

some delay params to simulate slow responding apps

.github/workflows/build.yaml

@@ -10,5 +10,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v2
+      - name: Set up JDK 17
+        uses: actions/setup-java@v2
+        with:
+          distribution: 'temurin'
+          java-version: '17'
       - name: Gradle build
-        run: ./gradlew :build
+        run: ./gradlew :build --stacktrace --info --rerun

.github/workflows/release.yaml

@@ -10,6 +10,11 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v2
+      - name: Set up JDK 17
+        uses: actions/setup-java@v2
+        with:
+          distribution: 'temurin'
+          java-version: '17'
       - name: Gradle assemble
         run: './gradlew :assemble'
       - uses: softprops/action-gh-release@v1

build.gradle.kts

@@ -4,16 +4,16 @@ plugins {
     java
     idea
     distribution
-    id("org.springframework.boot") version "2.1.6.RELEASE"
+    id("org.springframework.boot") version "2.7.18"
 }
 apply(plugin = "io.spring.dependency-management")
 
 repositories {
     mavenCentral()
 }
 
-java.sourceCompatibility = JavaVersion.VERSION_11
-java.targetCompatibility = JavaVersion.VERSION_11
+java.sourceCompatibility = JavaVersion.VERSION_17
+java.targetCompatibility = JavaVersion.VERSION_17
 
 dependencies {
 
@@ -28,13 +28,14 @@ dependencies {
     implementation("io.jsonwebtoken:jjwt-api:0.10.7")
     implementation("org.apache.logging.log4j:log4j-slf4j-impl:2.14.1")
 
-    implementation("org.springdoc:springdoc-openapi-ui:1.2.32")
+    implementation("org.springdoc:springdoc-openapi-ui:1.8.0")
 
     testCompileOnly("junit:junit")
 
     implementation("io.jsonwebtoken:jjwt-impl:0.10.7")
     implementation("io.jsonwebtoken:jjwt-jackson:0.10.7")
     implementation("io.resurface:resurfaceio-logger:2.2.0")
+    implementation("org.apache.commons:commons-compress:1.27.1")
 
     compileOnly("org.projectlombok:lombok:1.18.10")
     annotationProcessor("org.projectlombok:lombok:1.18.22")

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.6.1-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-7.6.4-all.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

hawkscripts/active/fuzzer.kts

@@ -0,0 +1,69 @@
+import com.github.javafaker.Faker
+import com.stackhawk.hste.extension.script.ScriptVars
+import com.stackhawk.hste.extension.scripts.scanrules.ScriptsActiveScanner
+import org.apache.log4j.LogManager
+import org.parosproxy.paros.network.HttpMessage
+
+val logger = LogManager.getLogger("fuzzer")
+
+val faker = Faker()
+val scriptVars = ScriptVars.getScriptVars("fuzzer.kts")
+
+fun alert(activeScanner: ScriptsActiveScanner, msg: HttpMessage, evidence: String, param: String, fuzzedParam: String) {
+    val risk = 2 // 0: info, 1: low, 2: medium, 3: high
+    val confidence = 3 // 0: falsePositive, 1: low, 2: medium, 3: high, 4: confirmed
+    val title = "Fuzzer found a 5xx error"
+    val description = "Fuzzer was able to find a 5xx error"
+    val solution = "Handle bad input and never throw a 5xx error"
+    val reference = ""
+    val otherInfo = "fuzzed param: $param=$fuzzedParam"
+    val pluginId = 10_00_063; //Custom Plugin ID
+
+    activeScanner.newAlert()
+        .setPluginId(pluginId)
+        .setRisk(risk)
+        .setConfidence(confidence)
+        .setName(title)
+        .setDescription(description)
+        .setEvidence(evidence)
+        .setOtherInfo(otherInfo)
+        .setSolution(solution)
+        .setReference(reference)
+        .setMessage(msg)
+        .raise();
+}
+
+fun scanNode(activeScanner: ScriptsActiveScanner, origMessage: HttpMessage) {
+    logger.debug("scanNode fuzzer hook: ${origMessage.requestHeader.uri}")
+    return
+}
+
+fun scan(activeScanner: ScriptsActiveScanner, origMessage: HttpMessage, param: String, value: String) {
+    logger.debug("scan fuzzer hook: ${origMessage.requestHeader.uri} | ${param}=${value}")
+    val iterations = scriptVars["iterations"]?.toInt() ?: 1
+    val stringStartLength = scriptVars["stringStartLength"]?.toInt() ?: 1
+    val stringEndLength = scriptVars["stringEndLength"]?.toInt() ?: 100
+    (1..iterations).forEach { i ->
+        val msg = origMessage.cloneRequest()
+        val fuzzedParamValue = if (i % 2 == 0) {
+            faker.lorem().characters(stringStartLength, stringEndLength)
+        } else {
+            faker.harryPotter().spell()
+        }
+
+        if (param.isNotBlank()) {
+            activeScanner.setParam(msg, param, fuzzedParamValue)
+        }
+        try {
+            activeScanner.sendAndReceive(msg, false, false)
+            if (msg.responseHeader.statusCode >= 500) {
+                logger.debug("request: ${msg.requestHeader}${msg.requestBody}")
+                alert(activeScanner, msg, msg.responseHeader.primeHeader, param, fuzzedParamValue)
+                logger.debug("response: ${msg.responseHeader.statusCode} ${msg.responseHeader}${msg.responseBody}")
+            }
+        } catch (e: Exception) {
+            logger.error("Error sending request: ${e.message}")
+        }
+    }
+
+}

hawkscripts/hawkscripts.gradle.kts

@@ -7,7 +7,7 @@ plugins {
     kotlin("jvm") version "1.8.22"
 }
 
-val kotlinVersion = "1.7.20"
+val kotlinVersion = "1.8.22"
 val hawkScriptSdkVersion = lazy { sdkVersion() }
 val sdkZipName = lazy {  "hawkscript-sdk-${hawkScriptSdkVersion.value}.zip" }
 val hawkScriptSDKZip = lazy { "$buildDir/${sdkZipName.value}" }

openapi.json

@@ -1 +1 @@
-{"openapi":"3.0.1","info":{"title":"OpenAPI definition","version":"v0"},"servers":[{"url":"https://localhost:9000","description":"Generated server url"}],"paths":{"/api/token/items/search/":{"get":{"tags":["token-item-controller"],"operationId":"search","responses":{"200":{"description":"default response","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/token/items/search/{text}":{"get":{"tags":["token-item-controller"],"operationId":"search_1","parameters":[{"name":"text","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"default response","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/auth/signin":{"post":{"tags":["jwt-auth-controller"],"operationId":"signin","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthenticationRequest"}}}},"responses":{"200":{"description":"default response","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/items/search":{"post":{"tags":["jwt-item-controller"],"operationId":"search_2","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Search"}}}},"responses":{"200":{"description":"default response","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/items/search/{text}":{"get":{"tags":["jwt-item-controller"],"operationId":"search_3","parameters":[{"name":"text","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"default response","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/items/search/":{"get":{"tags":["jwt-item-controller"],"operationId":"searchAll","responses":{"200":{"description":"default response","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/users/search/{text}":{"get":{"tags":["jwt-user-controller"],"operationId":"search_4","parameters":[{"name":"text","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"default response","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/users/search/bad/{text}":{"get":{"tags":["jwt-user-controller"],"operationId":"searchCrappy","parameters":[{"name":"text","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"default response","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/users/search/":{"get":{"tags":["jwt-user-controller"],"operationId":"searchAll_1","responses":{"200":{"description":"default response","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/basic/items/search/":{"get":{"tags":["basic-auth-item-controller"],"operationId":"search_5","responses":{"200":{"description":"default response","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/basic/items/search/{text}":{"get":{"tags":["basic-auth-item-controller"],"operationId":"search_6","parameters":[{"name":"text","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"default response","content":{"*/*":{"schema":{"type":"string"}}}}}}}},"components":{"schemas":{"AuthenticationRequest":{"type":"object","properties":{"username":{"type":"string"},"password":{"type":"string"},"tenant":{"type":"string"}}},"Search":{"type":"object","properties":{"searchText":{"type":"string"}}}}}}
+{"openapi":"3.0.1","info":{"title":"OpenAPI definition","version":"v0"},"servers":[{"url":"https://localhost:9000","description":"Generated server url"}],"paths":{"/api/jwt/items/search":{"post":{"tags":["jwt-item-controller"],"operationId":"search","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Search"}}},"required":true},"responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/auth/signin":{"post":{"tags":["jwt-auth-controller"],"operationId":"signin","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthenticationRequest"}}},"required":true},"responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/token/items/search/":{"get":{"tags":["token-item-controller"],"operationId":"search_1","responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/token/items/search/{text}":{"get":{"tags":["token-item-controller"],"operationId":"search_2","parameters":[{"name":"text","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/okta/me/token":{"get":{"tags":["okta-controller"],"operationId":"me","responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"$ref":"#/components/schemas/OktaIdInfo"}}}}}}},"/api/jwt/users/search/":{"get":{"tags":["jwt-user-controller"],"operationId":"searchAll","responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/User"}}}}}}}},"/api/jwt/users/search/{text}":{"get":{"tags":["jwt-user-controller"],"operationId":"search_3","parameters":[{"name":"text","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/users/search/bad/{text}":{"get":{"tags":["jwt-user-controller"],"operationId":"searchCrappy","parameters":[{"name":"text","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/items/{id}":{"get":{"tags":["jwt-item-controller"],"operationId":"getById","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/items/search/":{"get":{"tags":["jwt-item-controller"],"operationId":"searchAll_1","responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/jwt/items/search/{text}":{"get":{"tags":["jwt-item-controller"],"operationId":"search_4","parameters":[{"name":"text","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/basic/items/search/":{"get":{"tags":["basic-auth-item-controller"],"operationId":"search_5","responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"string"}}}}}}},"/api/basic/items/search/{text}":{"get":{"tags":["basic-auth-item-controller"],"operationId":"search_6","parameters":[{"name":"text","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"*/*":{"schema":{"type":"string"}}}}}}}},"components":{"schemas":{"Search":{"type":"object","properties":{"searchText":{"type":"string"}}},"AuthenticationRequest":{"type":"object","properties":{"username":{"type":"string"},"password":{"type":"string"},"tenant":{"type":"string"}}},"OktaIdInfo":{"type":"object","properties":{"token":{"type":"string"}}},"User":{"type":"object","properties":{"id":{"type":"integer","format":"int64"},"name":{"type":"string"},"description":{"type":"string"},"tenantId":{"type":"string"}}}}}}