passbe/beef-migration-test-3 — Issue #412: Some attack vector characters throws exceptions in WebRick (Bad URI)
Author: passbe
Created: 2011-12-09 00:52:37+00:00
State: open

ruby: 1.9.2 (1.8.7 for sure has the same problem)

Examples:

[2011-07-08 12:40:27] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/sqli/?id=pippo|echo%202bc9f05ecc87c172%20254221d76bf55b7a||a&Submit=Submit'.
[2011-07-08 12:33:46] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccioba83e<a>7918817a3ad'.
[2011-07-08 12:34:06] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccio%00ba83e<a>7918817a3ad'.
[2011-07-08 12:38:06] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccio"'.
[2011-07-08 12:38:27] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccio|echo%20612dcdb345dccd5d%20b00dea9dea0678e7||a'.
[2011-07-08 12:38:47] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccio|ping%20-n%2020%20127.0.0.1||x'.
[2011-07-08 12:38:47] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccio`ping%20-c%2020%20127.0.0.1`'.
[2011-07-08 12:38:47] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccio|ping%20-c%2020%20127.0.0.1||x'.
[2011-07-08 12:38:47] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccio..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini'.
[2011-07-08 12:38:47] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccio..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini'.
[2011-07-08 12:39:27] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccio..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini%00ciccio'.
[2011-07-08 12:39:27] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccio..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini%00ciccio'.
[2011-07-08 12:40:07] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/sqli/?id=pippo"&Submit=Submit'.
[2011-07-08 12:40:47] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/sqli/?id=pippo|ping%20-n%2020%20127.0.0.1||x&Submit=Submit'.
[2011-07-08 12:40:47] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/sqli/?id=pippo`ping%20-c%2020%20127.0.0.1`&Submit=Submit'.
[2011-07-08 12:40:47] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/sqli/?id=pippo|ping%20-c%2020%20127.0.0.1||x&Submit=Submit'.
[2011-07-08 12:40:47] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/sqli/?id=pippo..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini&Submit=Submit'.
[2011-07-08 12:40:47] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/sqli/?id=pippo..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini&Submit=Submit'.
[2011-07-08 12:41:27] ERROR bad URI `http://192.168.10.128/dvwa/vulnerabilities/xss_r/?name=ciccio]]>>'.

Things that need to be patched:
- the WebRick Http request
- the default parsing regex for the URI component
Google Code Issue: http://code.google.com/p/beef/issues/detail?id=370