Created
April 26, 2021 07:50
-
-
Save pdparchitect/762727ad9bd92cc54fce99916ca03def to your computer and use it in GitHub Desktop.
New apprach to writing web security scanners using async generators
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/** | |
* Generates new http transactions to discover directories, common files and vulnerabilities | |
* @param tran | |
* @param options | |
*/ | |
const discover = async function*(tran, options) { | |
// TODO: add code here | |
} | |
/** | |
* Given an input transaction, generate new transactions by spidering | |
* @param tran | |
* @param options | |
*/ | |
const spider = async function*(tran, options) { | |
// TODO: add code here | |
} | |
/** | |
* Active fuzz of the input transaction to discover known vulnerabilities | |
* @param tran | |
* @param options | |
*/ | |
const fuzz = async function*(tran, options) { | |
// TODO: add code here | |
} | |
/** | |
* Passive analyzis of the input transaction to discover vulnerabilities | |
* @param tran | |
* @param options | |
*/ | |
const analyze = async function*(tran, options) { | |
// TODO: add code here | |
} | |
/** | |
* Scan the target given input parameters | |
* @param tran | |
* @param options | |
*/ | |
const scan = async function* (tran, options) { | |
for await (let tran of spider(tran, options)) { | |
yield tran | |
yield* analyze(tran, options) | |
for await (let tran of fuzz(tran, options)) { | |
yield tran | |
yield* analyze(tran, options) | |
const { maxDepthLevel = 10, depthLevel = 0 } = options || {} | |
if (depthLevel <= maxDepthLevel) { | |
yield* scan(tran, { ...options, maxDepthLevel, depthLevel: depthLevel + 1 }) | |
} | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment