IL2648 / fuzzer

a web app fuzzer
0 stars 0 forks source link

finding form fields does not work (syntax error) #12

Closed gberl001 closed 9 years ago

gberl001 commented 9 years ago

Did anyone run this program to verify these features worked? There is a slash causing a syntax error in the regex pattern for counting the number of tags. Simply removing this character allows the count to come up properly, however, the inputs parsed through urls still shows up blank.

It appears as though the code was copy-pasted from a reference that allows arguments (such as /g for global) but the / was accidentally copied. In which case, again, this never worked so it wasn't tested.

I give up, it's taking me longer to track down these problems than I am willing to put up with. This should have all been working for the first release. I've spent the past two hours now just tracking down faulty code, and we're talking doesn't work at all, not just that it runs into the occasional bug for some unique site. There is no possible way that I can work on phase two without phase one working and I've put too much time into other individuals' code and it's still not complete.

gberl001 commented 9 years ago

As you can see, I am pretty pissed right now, I put at least four hours of time into my portion of code running it on various large websites (python.org, se.rit.edu, cs.rit.edu, mcc.edu) to ensure it worked in any case I could come up with. I'm not saying that there aren't others who put the time in (maybe they put the time in but it was a learning curve problem) but this should be much more robust than this, it isn't that many lines of code and it isn't complex at all. As far as I can see, there are two cases, either the time isn't getting put in or using python was a bad idea because it's causing people to generate faulty code. Again, to clarify, I am not directing this at anyone in particular because I don't know which case it is, if you didn't spend enough time on phase one you should know that you didn't so I guess that's all.

Please let me know if anyone is not willing to put the time in for phase two, I would like to get a decent grade and if I have to put in more time to make up for others I'm fine, as long as I know I have to first. Lastly, I hate to come off looking like an a\ and I typically try to steer clear of ranting through text as it is a horrible way to convey a message but, given the time constraints and the fact that I'm up at 3:15 when i didn't want to be, I waived my own rules for the day. If you are not heard from or you have no code submitted by tomorrow night it's going to get redistributed to someone else. This should be fully functional by Sunday night, at the very least we should have functionality complete if not error checking as well.

That's all, sorry for the rant and I'm not some super angry hot head who holds grudges or anything like that so don't be weird about it when we see each other in person... it is what it is and I try to say it like it is, just usually not in text. No sense in beating around the bush wasting time you know?

cburtner007 commented 9 years ago

Hey,

Speaking of wasting time... It looks like we've both been trying to work out the same issues yesterday :) I wouldn't say I spent 14 effective hours straight on this yesterday, but I didn't work on anything else and I spent the whole day home. I'm also responding to a rant, which isn't really productive either. I think your time would've been better spent trying to figure out how to test/deliver the new functionality while waiting for the old to get fixed (I know it's not easy and can take a little bit of time, but it's definitely not impossible - and certainly would've let you get started)

To speak to the final integration... Yes, it was tested and it ran. At least I thought it ran at the time. This ended up being a VERY last minute thing and it definitely wasn't tested as thoroughly as it should have been. This is my fault, as I didn't deliver my part until extremely late in the game. I'm not sure if I should take /all/ the blame, but then again, does it matter?

To speak to the issue you noted... What I discovered was that the issue was with the way the URLs were getting parsed (they were always getting parsed+passed so that they have a "/." at the end, which always broke the request)

To count the number of input tags, this is the code snipppet:

    inputElements = re.findall("<input.*?>", r.content)

Note that there are no slashes, as you had claimed. There are no slashes to remove. So what did you remove from this?

However, assuming you were not speaking to the above snippet - perhaps you were referring to this one...?

        inputName = re.findall("name=\"(.*?)\"", inputElements[x]) 

Now, there are slashes here (and it certainly wasn't copy-pasted from the internet :o) ) but those slashes actually just escape the quotation marks.

So again, I'm curious as to what you found and what you removed and how the program is still working after you removed them? I know you were speaking to "/" slashes, but I couldn't find any of those in any of the regex patterns you were speaking about =\

gberl001 commented 9 years ago

Again, you never said you were adding error checking, I did apologize for that. You said you were sanitizing the inputs... I thought that meant main()

Did you do form inputs and page discovery, if not then it is definitely not your fault, if you did then it still wasn't but I found problems in both, mainly with form inputs.

I have a very different visual of what finding input tags looked like, per the commit commented "final" screen shot 2015-03-14 at 10 29 02 am Note line 181, I mis"spoke" in that it does not look like it was copied and pasted, I thought the / was at the end which is you would do in Perl to use args like /g for global or /i of case insensitive. In any case, it didn't work and it was a syntax error.

I didn't realize you were going to get so upset, like I said, I was not blaming any one person. I assumed that if the person(s) responsible for not putting in enough effort would know who they were and feel guilty enough, I wasn't going to point blame. Also, because, it may not be due to a lack of effort but that it might have been due to the language choice.

cburtner007 commented 9 years ago

Omg, my apologies, I forgot that was one of the changes I made yesterday. No you're right, that slash was there and it shouldn't have been there and I had the same reaction when I stumbled on it as well (That is: "How did this ever even run?"). I removed it from my code (as you can see in the commit I made this morning =[ ) and promptly forgot it was ever there, my apologies for that.

When you say "syntax error" do you mean everything crashed? Or that it ran and just wasn't catching what it was supposed to catch? Because I found that it ran when I had tested it in my own branch and it was working! I saw it work even. Granted, it definitely wasn't as thoroughly tested as it should have been though. Regardless, it was an error that shouldn't have made it this far.

My intention wasn't to come across as upset, so much as frustrated (I tried to use as many emoticons as I thought I was appropriate so that my response wouldn't come across as super harsh!). I understood where you were coming from and that it was 3am in the morning so I wasn't holding it against you. It's just that I spent the whole day on Friday working on this with very little to show for my efforts, and even less to show if our efforts ended up being duplicated.

I think the language choice was correct, regardless of the issues we've had :)

gberl001 commented 9 years ago

No problem, it's fixed now.

It was quietly "failing" so no errors, I just happened to be running on a website I know is small (couple pages) but it had a form and nothing showed up when I tested my code (for the new stuff, not altered code). I use RegEx a lot so I know that would produce a sytax error (in RegEx) because the forward slash is a special character.

Sorry, I'm old, I don't so much pay attention to emoticons ha ha. I missed emoticons by a few years.

Just FYI though, I am working on the new stuff, I was ready to test it but when I ran the program, it broke. I can just skip doing the other functions for now but at the time I was expecting it to run but it never even made it to my code so I got really upset with all of the errors I was getting with the program.

Anyway, I'm going to single out the sensitive data portion so it runs without running the other parts of code. If you need any help with this stuff I have no issues helping out. I should be getting back to the sensitive data portion shortly and it should be done except for some testing. I'll let you know when I'm done and then you can let me know if there is something you want to delegate my way.

gberl001 commented 9 years ago

Fixed by Curtis