Gamercat
/
geneva
mirror of https://github.com/Kkevsterrr/geneva
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #36 from VwCSXg/improve-http-plugin 

Fine-tuning http-plugin evaluation
This commit is contained in:
Kevin Bock 2022-08-16 13:39:42 -04:00 committed by GitHub
parent 3c1c963c93 4108f731a7
commit 5551466e7c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 22 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
plugins/http/client.py
View File

@ -3,24 +3,15 @@ Run by the evaluator, tries to make a GET request to a given server
""" """
import argparse import argparse
import logging
import os import os
import random
import socket import socket
import sys
import time
import traceback
import urllib.request import urllib.request
import requests import requests
socket.setdefaulttimeout(1)
import external_sites
import actions.utils
from plugins.plugin_client import ClientPlugin from plugins.plugin_client import ClientPlugin
socket.setdefaulttimeout(1)
BASEPATH = os.path.dirname(os.path.abspath(__file__)) BASEPATH = os.path.dirname(os.path.abspath(__file__))
@ -46,7 +37,11 @@ class HTTPClient(ClientPlugin):
parser = argparse.ArgumentParser(description='HTTP Client', prog="http/client.py") parser = argparse.ArgumentParser(description='HTTP Client', prog="http/client.py")
parser.add_argument('--host-header', action='store', default="", help='specifies host header for HTTP request') parser.add_argument('--host-header', action='store', default="", help='specifies host header for HTTP request')
parser.add_argument('--injected-http-contains', action='store', default="", help='checks if injected http response contains string') parser.add_argument('--injected-http-contains', action='store',
default="", help='checks if injected http response contains string')
parser.add_argument('--valid-http-contains', action='store',
default="", help='checks if http response contains the given string. '
'if not, the connection is evaluated as broken')
args, _ = parser.parse_known_args(command) args, _ = parser.parse_known_args(command)
args = vars(args) args = vars(args)
@ -70,36 +65,42 @@ class HTTPClient(ClientPlugin):
# If we've been given a non-standard port, append that to the URL # If we've been given a non-standard port, append that to the URL
port = args.get("port", 80) port = args.get("port", 80)
if port != 80: if port != 80:
url += ":%s" % str(port) url += f":{str(port)}"
if args.get("bad_word"): if args.get("bad_word"):
url += "?q=%s" % args.get("bad_word") url += f"?q={args.get('bad_word')}"
injected_http = args.get("injected_http_contains")
try: try:
res = requests.get(url, allow_redirects=False, timeout=3, headers=headers) res = requests.get(url, allow_redirects=False, timeout=3, headers=headers)
logger.debug(res.text) logger.debug(res.text)
# If we need to monitor for an injected response, check that here # If we need to monitor for an injected response, check that here
if injected_http and injected_http in res.text: if args.get("injected_http_contains") and args.get("injected_http_contains") in res.text:
fitness -= 90 fitness -= 90
elif args.get("valid_http_contains"):
if args.get("valid_http_contains") in res.text:
# valid response found
fitness += 100
else:
fitness -= 120
logger.debug("valid response needed, but not found -> connection broke\n")
else: else:
fitness += 100 fitness += 100
except requests.exceptions.ConnectTimeout as exc: except requests.exceptions.ConnectTimeout:
logger.exception("Socket timeout.") logger.exception("Socket timeout.")
fitness -= 100 fitness -= 100
except (requests.exceptions.ConnectionError, ConnectionResetError) as exc: except (requests.exceptions.ConnectionError, ConnectionResetError):
logger.exception("Connection RST.") logger.exception("Connection RST.")
fitness -= 90 fitness -= 90
except urllib.error.URLError as exc: except urllib.error.URLError as exc:
logger.debug(exc) logger.debug(exc)
fitness += -101 fitness -= 101
# Timeouts generally mean the strategy killed the TCP stream. # Timeouts generally mean the strategy killed the TCP stream.
# HTTPError usually mean the request was destroyed. # HTTPError usually mean the request was destroyed.
# Punish this more harshly than getting caught by the censor. # Punish this more harshly than getting caught by the censor.
except (requests.exceptions.Timeout, requests.exceptions.HTTPError) as exc: except (requests.exceptions.Timeout, requests.exceptions.HTTPError) as exc:
logger.debug(exc) logger.debug(exc)
fitness += -120 fitness -= 120
except Exception: except Exception:
logger.exception("Exception caught in HTTP test to site %s.", url) logger.exception("Exception caught in HTTP test to site %s.", url)
fitness += -100 fitness -= 100
return fitness * 4 return fitness * 4