Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Awesome cookie checker #6

Merged
merged 6 commits into from
Jul 22, 2020
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
refactored the code & adapted to the new project structure
  • Loading branch information
HochuOlivie committed Jul 20, 2020
commit 721acd9f83cc7f0c26933c490e62406df704762e
5 changes: 5 additions & 0 deletions src/scripts/recon/cookie_checker/__init__.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
import sys
from pathlib import Path

__root_dir = Path(__file__).parents[4]
sys.path.append(str(__root_dir))
77 changes: 9 additions & 68 deletions src/scripts/recon/cookie_checker/__main__.py
Original file line number Diff line number Diff line change
@@ -1,71 +1,12 @@
from src.core.base.recon import ReconRunner, PossibleKeys
from src.core.utils.response import ScriptResponse
from src.core.utils.validators import validate_kwargs
from requests import get
#!/usr/bin/env python3

from pprint import pprint
from sys import argv

class Runner(ReconRunner):
"""
Class that performs cookie flags checking.
"""
from src.core.utils.module import run_module
from .module import Runner

def __init__(self, logger: str = __name__):
"""
Re-init base class instance with this function.
Simply put, you need to provide proper logger name
to the parent class, so please, save this structure for
the init function.
:param logger: logger to use (name of _this_ runner by default)
"""
super(Runner, self).__init__(logger)

def __has_http_only(self, cookie):
"""
Checks the specified cookie
for the HttpOnly flag.
:param cookie: Cookie for Checking
:return: True if there is
HttpOnly flag.
"""
extra_args = cookie.__dict__.get("_rest")
if extra_args:
for key in extra_args.keys():
if key.lower() == "httponly":
return True

return False

@validate_kwargs(PossibleKeys.KEYS)
def run(self, *args, **kwargs) -> ScriptResponse.success or ScriptResponse.error:
"""
Checks Secure, HttpOnly, Prefixed,
Same-site flags for the
cookies of a specified URL.
:param args: args from core runner
:param kwargs: kwargs from core runner
:return: ScriptResponse with dictionary
containing flags mentioned above.
"""

url = kwargs.get("url", "")

result = {}

if url == "":
return ScriptResponse.error(message="Url was not provided!")

response = get(kwargs["url"])
cookies = response.cookies

for i in cookies:
result[i.name] = {}
result[i.name]["Path"] = i.path
result[i.name]["Secure"] = i.secure
result[i.name]["HttpOnly"] = self.__has_http_only(i)
result[i.name]["Prefix"] = i.name.startswith(("__Secure-", "__Host-"))
result[i.name]["Same-Site"] = i.__dict__.get("_rest").get("SameSite", None)

return ScriptResponse.success(
result=result,
message=f"Successfully finished cookie policy check for {url}",
)
result = run_module(
Runner, args=argv, arg_name="url", arg_default="https://www.intel.com/"
)
pprint(result)
73 changes: 73 additions & 0 deletions src/scripts/recon/cookie_checker/module.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
#!/usr/bin/env python3
from src.core.base.recon import ReconRunner, PossibleKeys
from src.core.utils.response import ScriptResponse
from src.core.utils.validators import validate_kwargs
from requests import get
import http.cookiejar as cookiejar


class Runner(ReconRunner):
"""
Class that performs cookie flags checking.
"""

def __init__(self, logger: str = __name__):
"""
Re-init base class instance with this function.
Simply put, you need to provide proper logger name
to the parent class, so please, save this structure for
the init function.
:param logger: logger to use (name of _this_ runner by default)
"""
super(Runner, self).__init__(logger)

def __has_http_only(self, cookie: cookiejar.Cookie) -> bool:
"""
Checks the specified cookie
for the HttpOnly flag.
:param cookie: Cookie for Checking
:return: True if there is
HttpOnly flag.
"""
extra_args = cookie.__dict__.get("_rest")

if not extra_args:
return False

return any(key.lower() == "httponly" for key in extra_args.keys())

@validate_kwargs(PossibleKeys.KEYS)
def run(self, *args, **kwargs) -> ScriptResponse.success or ScriptResponse.error:
"""
Checks Secure, HttpOnly, Prefixed,
Same-site flags for the
cookies of a specified URL.
:param args: args from core runner
:param kwargs: kwargs from core runner
:return: ScriptResponse with dictionary
containing flags mentioned above.
"""

url = kwargs.get("url")

if not url:
return ScriptResponse.error(message="Url was not provided!")

result = {}


response = get(url)

for cookie in response.cookies:
result[cookie.name] = {
"Path": cookie.path,
"Secure": cookie.secure,
"HttpOnly": self.__has_http_only(cookie),
"Prefix": cookie.name.startswith(("__Secure-", "__Host-")),
"Same-Site": cookie.__dict__.get("_rest").get("SameSite", "None")
}

return ScriptResponse.success(
result=result,
message=f"Successfully finished cookie policy check for {url}",
)