WebApp Sec mailing list archives
Re: Webscarab how to?
From: Rogan Dawes <discard () dawes za net>
Date: Sun, 09 Jul 2006 21:25:43 +0200
f_kenisky () earthlink net wrote:
sorry about the first one my fingers got ahead of the brain. Ok I've read through the FUZZER thingly page. Not 100% clear but I've copied the text and made a few corrections. As far as the fuzzer is concerned I want to use the RegEx and put in some stuff on one of the identified fields. When I put in a few RegEx characters and add the description and then click add I get the following dialog box; Error; Invalid regular expression! No wildcards permitted near index 0 ?-6*0-?^
Here are a few examples of regular expressions that you can use: [a-z]{3} does: aaa aab aac ... aaz aba abb abc ... azy azz baa ... etc How about: [0-9a-f]{6}-[0-9A-F]{2} 6 hex digits, using lowercase a-f, followed by a hyphen, followed by 2 hex digits, using uppercase A-F. Or: [a-f][0-9a-f]{5} 6 hex digits, starting with a00000 going to ffffff WARNING: Don't go overboard wit your regular expressions. The internal engine will allow you to use an expression that will create up to 4 billion possibilities. However, currently, WebScarab reads every single item, and places it into the list that you see when you are loading the files. You'll run out of memory VERY quickly. Besides, it makes no sense whatsoever to try to brute force something of that scale . . . . .
Not really sure what I'm trying to get with this cool regular expression but it really doesn't matter since the fuzz won't take it.
Maybe the examples above will help you out.
After playing with the fuzzer I found an area (HTML) with a date field. MM dd YY. Three separate fields. I set up three separate .txt files with MM dd & YY. The .txt file for the month included all 12 months (as numeric values) and I also included a "-" and "*" just to see if the app would take that information. Now I may be trying to do something that the Fuzzer wasn't intended to do so my apologies. In esseence the month.txt file had 36 separate variables. i.e.(01, 02, 03...-01, -02, -03...*01,*02,*03etc)
Seems entirely reasonable. Probably unnecessary to try all 12 months with - and *, since if it doesn't accept the first one, it is unlikely to accept it for the 12th, but it's up to you, obviously. ;-)
The html page I'm referring to had an begining and ending date so I included both in the fuzz test and used the month.txt file for each during the same test. With a year.txt file containing 50+ years the fuzzer only fuzzed 36 (the number of months).
Ok. What you probably want to do is make the priority columns different, so that they increment independently.
If the priorities are all the same, you'll get: (Assuming your year starts with 1950)
1950 01 01 (Y M D) 1951 02 02 1953 03 03 etcIf you make the priorities different, e.g. 1 for year, 2 for Month, 3 for days, you'll get
1950 01 01 1950 01 02 1950 01 03 ... 1950 12 31 1951 01 01 .. 1951 12 31 1952 01 01 etc 1950 12 31
Hope I'm clear here as I got a feeling I'm confusing more people.
Hope I've managed to explain it sufficiently. If you do understand, maybe you could update the OWASP page? Let me know if my explanation has simply confused you more, and I'll try again. ;-)
Thanks
Regards, Rogan ------------------------------------------------------------------------- Sponsored by: WatchfireSecuring a web application goes far beyond testing the application using manual processes, or by using automated systems and tools. Watchfire's "Web Application Security: Automated Scanning or Manual Penetration Testing?" whitepaper examines a few vulnerability detection methods - specifically comparing and contrasting manual penetration testing with automated scanning tools. Download it today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm --------------------------------------------------------------------------
Current thread:
- Re: Webscarab how to? Jezebel Ali (Jul 01)
- Re: Webscarab how to? Rogan Dawes (Jul 01)
- <Possible follow-ups>
- Re: Re: Webscarab how to? mr . nasty (Jul 03)
- Re: Webscarab how to? Rogan Dawes (Jul 04)
- RE: Re: Webscarab how to? PPowenski (Jul 04)
- Re: RE: Re: Webscarab how to? f_kenisky (Jul 08)
- Re: RE: Re: Webscarab how to? c0redump (Jul 09)
- Re: Webscarab how to? Rogan Dawes (Jul 09)