search

Averroes / raft

Response Analysis and Further Testing RAFT is a testing tool for the identification of vulnerabilities in web applications. RAFT is a suite of tools that utilize common shared elements to make testing and analysis easier. The tool provides visibility in to areas that other tools do not such as various client side storage. RAFT uses markup to create templates for fuzz testing.
https://code.google.com/p/raft/w/list
GNU General Public License v3.0
23 stars 9 forks source link

Analysis From Burp state File Causes Exception #51

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago 
What steps will reproduce the problem?
0. Started up app via terminal: /opt/local/bin/python raft.pyw
1. Loaded burp file from previous client assessment
2. Waited for Responses to populate
3. Clicked on Start analysis button
4. View terminal output

What is the expected output? What do you see instead?
Expecting something to populate the Analysis tab. Instead, received output and 
an exception in the terminal window.

What version of the product are you using? On what operating system?

Running Mac 10.6 with dependencies installed via latest macports.

Please provide any additional information below.
[quixotic] ~/tools/raft-read-only% /opt/local/bin/python raft.pyw 
('CONSOLE--->', '[object Object]')
('DEBUG', 'SiteMapThread started...')
('DEBUG', 'ResponsesThread started...')
('DEBUG', 'AnalyzerThread started...')
('DEBUG', 'DomFuzzerThread started...')
('DEBUG', 'SpiderThread started...')
('DEBUG', 'Database temp.raftdb attached')
starting populating responses
finished populating responses

[from Jon: list of browser plugins not found or error opening via dlopen. Can 
send via direct email if desired]

('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 0', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Illegal token: ["\'<img src=x onerror=})"]: , 0', ())
('Illegal token: ["\'<img src=x onerror=})"]: , 0', ())
('Illegal token: ["\'<img src=x onerror=})"]: , 0', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Illegal token: ["\'<img src=x onerror=})"]: , 0', ())
('Illegal token: ["\'<img src=x onerror=})"]: , 0', ())
('Illegal token: ["\'<img src=x onerror=})"]: , 0', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Illegal token: ["\'<img src=x onerror=})"]: , 0', ())
('Illegal token: ["\'<img src=x onerror=})"]: , 0', ())
('Illegal token: ["\'<img src=x onerror=})"]: , 0', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
('Missing operand: , 1', ())
EXCEPTION:
Traceback (most recent call last):
  File "/Users/work/tools/raft-read-only/core/workers/AnalyzerThread.py", line 96, in handle_runAnalysis
    fullanalysistext = self.analyze_content()
  File "/Users/work/tools/raft-read-only/core/workers/AnalyzerThread.py", line 140, in analyze_content
    self.framework.get_request_response(dbrow[ResponsesTable.ID])
  File "/Users/work/tools/raft-read-only/core/framework/Framework.py", line 211, in get_request_response
    request_response = self.request_response_dict[response_id] = RequestResponse.RequestResponse(self, response_id)
  File "/Users/work/tools/raft-read-only/core/RequestResponse.py", line 90, in __init__
    self.fill(Id)
  File "/Users/work/tools/raft-read-only/core/RequestResponse.py", line 135, in fill
    results = self.htmlExtractor.process(self.responseBody, self.responseUrl, self.charset, results)
  File "/Users/work/tools/raft-read-only/lib/extractors/HtmlExtractor.py", line 736, in process
    self.process_etree(results, jsParser, htmlbuf, html)
  File "/Users/work/tools/raft-read-only/lib/extractors/HtmlExtractor.py", line 712, in process_etree
    self.process_tag(results, jsParser, elem)
  File "/Users/work/tools/raft-read-only/lib/extractors/HtmlExtractor.py", line 391, in process_tag
    self.process_script_block(results, jsParser, elem)
  File "/Users/work/tools/raft-read-only/lib/extractors/HtmlExtractor.py", line 432, in process_script_block
    jsParser.parse(script)
  File "/Users/work/tools/raft-read-only/lib/extractors/JSParser.py", line 1096, in parse
    raise tokenizer.newSyntaxError("Syntax error")
NameError: global name 'tokenizer' is not defined

Original issue reported on code.google.com by jon.pas...@gmail.com on 9 Aug 2011 at 11:19

GoogleCodeExporter commented 8 years ago

Original comment by gfleisch...@gmail.com on 5 Jul 2013 at 1:44