yellow

~ opinionated web scanning pipeline for pentesters in a hurry
git clone https://github.com/djnnvx/yellow.git
catchall_test.go (1635B)
      1 package scan
      2 
      3 import (
      4 	"net/http"
      5 	"net/http/httptest"
      6 	"reflect"
      7 	"testing"
      8 )
      9 
     10 func TestAnswersEveryPath(t *testing.T) {
     11 	loginWall := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
     12 		if r.URL.Path == "/login" {
     13 			w.Write([]byte("sign in"))
     14 			return
     15 		}
     16 		http.Redirect(w, r, "/login", http.StatusFound)
     17 	}))
     18 	defer loginWall.Close()
     19 
     20 	sane := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
     21 		http.NotFound(w, r)
     22 	}))
     23 	defer sane.Close()
     24 
     25 	dead := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
     26 	deadURL := dead.URL
     27 	dead.Close()
     28 
     29 	if !answersEveryPath(loginWall.URL) {
     30 		t.Error("host redirecting everything to a login page must be flagged")
     31 	}
     32 	if answersEveryPath(sane.URL) {
     33 		t.Error("host returning 404 on unknown paths must not be flagged")
     34 	}
     35 	if answersEveryPath(deadURL) {
     36 		t.Error("unreachable host must fail open, not be flagged")
     37 	}
     38 }
     39 
     40 func TestCollapseCatchAll(t *testing.T) {
     41 	probes := map[string]int{}
     42 	catchAll := func(root string) bool {
     43 		probes[root]++
     44 		return root == "https://wall.tld"
     45 	}
     46 
     47 	got := collapseCatchAll([]string{
     48 		"https://wall.tld/a",
     49 		"https://ok.tld/1",
     50 		"https://wall.tld/b",
     51 		"https://wall.tld/c",
     52 		"https://ok.tld/2",
     53 		"::::not a url",
     54 	}, catchAll)
     55 
     56 	want := []string{
     57 		"https://wall.tld/",
     58 		"https://ok.tld/1",
     59 		"https://ok.tld/2",
     60 		"::::not a url",
     61 	}
     62 	if !reflect.DeepEqual(got, want) {
     63 		t.Errorf("got %v, want %v", got, want)
     64 	}
     65 	if probes["https://wall.tld"] != 1 || probes["https://ok.tld"] != 1 {
     66 		t.Errorf("each host must be probed once, got %v", probes)
     67 	}
     68 }