Class: Synthra::Generator::Modes::HostileMode

Inherits:
BaseMode
  • Object
show all
Defined in:
lib/synthra/generator/modes.rb

Overview

Hostile mode - security attack payloads

Generates security attack payloads (SQL injection, XSS, buffer overflow) for security testing of API endpoints consuming this data.

Constant Summary collapse

SQL_INJECTION_PAYLOADS =

Security attack payloads

[
  "' OR '1'='1",
  "'; DROP TABLE users;--",
  "' UNION SELECT * FROM users--",
  "1' OR '1'='1",
  "admin'--",
  "' OR 1=1;--",
  "1' AND '1'='1",
  "' OR 'x'='x",
  "') OR ('1'='1--",
  "1' OR '1'='1' /*"
].freeze
XSS_PAYLOADS = 
[
  "<script>alert(1)</script>",
  "<img src=x onerror=alert(1)>",
  "<svg onload=alert(1)>",
  "javascript:alert(1)",
  "<body onload=alert(1)>",
  "<iframe src=javascript:alert(1)>",
  "<input onfocus=alert(1) autofocus>",
  "<select onfocus=alert(1) autofocus>",
  "<textarea onfocus=alert(1) autofocus>",
  "<keygen onfocus=alert(1) autofocus>"
].freeze
BUFFER_OVERFLOW_PAYLOADS = 
[
  "A" * 1000,
  "A" * 10000,
  "A" * 100000,
  "\x00" * 1000,
  "\xFF" * 1000
].freeze
UNICODE_ATTACKS = 
[
  "\u202E" + "evil" + "\u202D", # RTL override
  "\uFEFF" + "text", # BOM
  "\u200B" * 100, # Zero-width spaces
  "\u2060" * 100, # Word joiner
  "Zalgo: H\u0301\u0302\u0303\u0304\u0305\u0306\u0307\u0308\u0309\u030A\u030B\u030C\u030D\u030E\u030F\u0310\u0311\u0312\u0313\u0314\u0315\u0316\u0317\u0318\u0319\u031A\u031B\u031C\u031D\u031E\u031F\u0320\u0321\u0322\u0323\u0324\u0325\u0326\u0327\u0328\u0329\u032A\u032B\u032C\u032D\u032E\u032F\u0330\u0331\u0332\u0333\u0334\u0335\u0336\u0337\u0338\u0339\u033A\u033B\u033C\u033D\u033E\u033F\u0340\u0341\u0342\u0343\u0344\u0345\u0346\u0347\u0348\u0349\u034A\u034B\u034C\u034D\u034E\u034F\u0350\u0351\u0352\u0353\u0354\u0355\u0356\u0357\u0358\u0359\u035A\u035B\u035C\u035D\u035E\u035F\u0360\u0361\u0362\u0363\u0364\u0365\u0366\u0367\u0368\u0369\u036A\u036B\u036C\u036D\u036E\u036F\u0489\u048A\u048B\u048C\u048D\u048E\u048F\u0490\u0491\u0492\u0493\u0494\u0495\u0496\u0497\u0498\u0499\u049A\u049B\u049C\u049D\u049E\u049F\u04A0\u04A1\u04A2\u04A3\u04A4\u04A5\u04A6\u04A7\u04A8\u04A9\u04AA\u04AB\u04AC\u04AD\u04AE\u04AF\u04B0\u04B1\u04B2\u04B3\u04B4\u04B5\u04B6\u04B7\u04B8\u04B9\u04BA\u04BB\u04BC\u04BD\u04BE\u04BF\u04C0\u04C1\u04C2\u04C3\u04C4\u04C5\u04C6\u04C7\u04C8\u04C9\u04CA\u04CB\u04CC\u04CD\u04CE\u04CF\u04D0\u04D1\u04D2\u04D3\u04D4\u04D5\u04D6\u04D7\u04D8\u04D9\u04DA\u04DB\u04DC\u04DD\u04DE\u04DF\u04E0\u04E1\u04E2\u04E3\u04E4\u04E5\u04E6\u04E7\u04E8\u04E9\u04EA\u04EB\u04EC\u04ED\u04EE\u04EF\u04F0\u04F1\u04F2\u04F3\u04F4\u04F5\u04F6\u04F7\u04F8\u04F9\u04FA\u04FB\u04FC\u04FD\u04FE\u04FF"
].freeze

Instance Method Summary collapse

Constructor Details

This class inherits a constructor from Synthra::Generator::Modes::BaseMode

Instance Method Details

#buffer_overflow ⇒ String

Get buffer overflow payload

Returns:

  • (String) —

    buffer overflow string



402
403
404
 
# File 'lib/synthra/generator/modes.rb', line 402

def buffer_overflow
  BUFFER_OVERFLOW_PAYLOADS.sample(random: @rng.instance_variable_get(:@random))
end

#generate(type_instance, args, context = nil) ⇒ Object

Generate a hostile value

Parameters:

  • type_instance (Base) —

    type generator instance

  • args (Hash) —

    type arguments

Returns:

  • (Object) —

    hostile value



377
378
379
380
 
# File 'lib/synthra/generator/modes.rb', line 377

def generate(type_instance, args, context = nil)
  context ||= Generator::Context.new
  type_instance.generate_hostile(@rng, context, args)
end

#sql_injection ⇒ String

Get SQL injection payload

Returns:

  • (String) —

    SQL injection string



386
387
388
 
# File 'lib/synthra/generator/modes.rb', line 386

def sql_injection
  SQL_INJECTION_PAYLOADS.sample(random: @rng.instance_variable_get(:@random))
end

#unicode_attack ⇒ String

Get Unicode attack payload

Returns:

  • (String) —

    Unicode attack string



410
411
412
 
# File 'lib/synthra/generator/modes.rb', line 410

def unicode_attack
  UNICODE_ATTACKS.sample(random: @rng.instance_variable_get(:@random))
end

#xss_payload ⇒ String

Get XSS payload

Returns:

  • (String) —

    XSS attack string



394
395
396
 
# File 'lib/synthra/generator/modes.rb', line 394

def xss_payload
  XSS_PAYLOADS.sample(random: @rng.instance_variable_get(:@random))
end