1
# -*- coding: binary -*-
2
require 'cgi'
3
require 'uri'
4

5
require 'nokogiri'
6
require 'rkelly'
7

8
module Rex
9
module Proto
10
module Http
11

12
###
13
#
14
# HTTP response class.
15
#
16
###
17
class Response < Packet
18

19
  ##
20
  #
21
  # Builtin response class wrappers.
22
  #
23
  ##
24

25
  #
26
  # HTTP 200/OK response class wrapper.
27
  #
28
  class OK < Response
29
    def initialize(message = 'OK', proto = DefaultProtocol)
30
      super(200, message, proto)
31
    end
32
  end
33

34
  #
35
  # HTTP 404/File not found response class wrapper.
36
  #
37
  class E404 < Response
38
    def initialize(message = 'File not found', proto = DefaultProtocol)
39
      super(404, message, proto)
40
    end
41
  end
42

43
  #
44
  # Constructage of the HTTP response with the supplied code, message, and
45
  # protocol.
46
  #
47
  def initialize(code = 200, message = 'OK', proto = DefaultProtocol)
48
    super()
49

50
    self.code    = code.to_i
51
    self.message = message
52
    self.proto   = proto
53

54
    # Default responses to auto content length on
55
    self.auto_cl = true
56

57
    # default chunk sizes (if chunked is used)
58
    self.chunk_min_size = 1
59
    self.chunk_max_size = 10
60

61
    # 100 continue counter
62
    self.count_100 = 0
63
  end
64

65
  #
66
  # Gets cookies from the Set-Cookie header in a format to be used
67
  # in the 'cookie' send_request field
68
  #
69
  def get_cookies
70
    cookies = ""
71
    if (self.headers.include?('Set-Cookie'))
72
      set_cookies = self.headers['Set-Cookie']
73
      key_vals = set_cookies.scan(/\s?([^, ;]+?)=([^, ;]*?)[;,]/)
74
      key_vals.each do |k, v|
75
        # Dont downcase actual cookie name as may be case sensitive
76
        name = k.downcase
77
        next if name == 'path'
78
        next if name == 'expires'
79
        next if name == 'domain'
80
        next if name == 'max-age'
81
        cookies << "#{k}=#{v}; "
82
      end
83
    end
84

85
    return cookies.strip
86
  end
87

88
  #
89
  # Gets cookies from the Set-Cookie header in a parsed format
90
  #
91
  def get_cookies_parsed
92
    if (self.headers.include?('Set-Cookie'))
93
      ret = CGI::Cookie::parse(self.headers['Set-Cookie'])
94
    else
95
      ret = {}
96
    end
97
    ret
98
  end
99

100

101
  # Returns a parsed HTML document.
102
  # Instead of using regexes to parse the HTML body, you should use this and use the Nokogiri API.
103
  #
104
  # @see http://www.nokogiri.org/
105
  # @return [Nokogiri::HTML::Document]
106
  def get_html_document
107
    Nokogiri::HTML(self.body)
108
  end
109

110
  # Returns a parsed XML document.
111
  # Instead of using regexes to parse the XML body, you should use this and use the Nokogiri API.
112
  #
113
  # @see http://www.nokogiri.org/
114
  # @return [Nokogiri::XML::Document]
115
  def get_xml_document
116
    Nokogiri::XML(self.body)
117
  end
118

119
  def gzip_decode!
120
    self.body = gzip_decode
121
  end
122

123
  def gzip_decode
124
    gz = Zlib::GzipReader.new(StringIO.new(self.body.to_s))    
125

126
    gz.read
127
  end
128

129
  # Returns a parsed json document.
130
  # Instead of using regexes to parse the JSON body, you should use this.
131
  #
132
  # @return [Hash]
133
  def get_json_document
134
    json = {}
135

136
    begin
137
      json = JSON.parse(self.body)
138
    rescue JSON::ParserError => e
139
      elog(e)
140
    end
141

142
    json
143
  end
144

145
  # Returns meta tags.
146
  # You will probably want to use this the web app's version info (or other stuff) can be found
147
  # in the metadata.
148
  #
149
  # @return [Array<Nokogiri::XML::Element>]
150
  def get_html_meta_elements
151
    n = get_html_document
152
    n.search('//meta')
153
  end
154

155
  # Returns parsed JavaScript blocks.
156
  # The parsed version is a RKelly object that allows you to be able do advanced parsing.
157
  #
158
  # @see https://github.com/tenderlove/rkelly
159
  # @return [Array<RKelly::Nodes::SourceElementsNode>]
160
  def get_html_scripts
161
    n = get_html_document
162
    rkelly = RKelly::Parser.new
163
    n.search('//script').map { |s| rkelly.parse(s.text) }
164
  end
165

166

167
  # Returns a collection of found hidden inputs
168
  #
169
  # @return [Array<Hash>] An array, each element represents a form that contains a hash of found hidden inputs
170
  #  * 'name' [String] The hidden input's original name. The value is the hidden input's original value.
171
  # @example
172
  #  res = send_request_cgi('uri'=>'/')
173
  #  inputs = res.get_hidden_inputs
174
  #  session_id = inputs[0]['sessionid'] # The first form's 'sessionid' hidden input
175
  def get_hidden_inputs
176
    forms = []
177
    noko = get_html_document
178
    noko.search("form").each_entry do |form|
179
      found_inputs = {}
180
      form.search("input").each_entry do |input|
181
        input_type = input.attributes['type'] ? input.attributes['type'].value : ''
182
        next if input_type !~ /hidden/i
183

184
        input_name = input.attributes['name'] ? input.attributes['name'].value : ''
185
        input_value = input.attributes['value'] ? input.attributes['value'].value : ''
186
        found_inputs[input_name] = input_value unless input_name.empty?
187
      end
188
      forms << found_inputs unless found_inputs.empty?
189
    end
190

191
    forms
192
  end
193

194
  #
195
  # Updates the various parts of the HTTP response command string.
196
  #
197
  def update_cmd_parts(str)
198
    if (md = str.match(/HTTP\/(.+?)\s+(\d+)\s?(.+?)\r?\n?$/))
199
      self.message = md[3].gsub("\r", '')
200
      self.code    = md[2].to_i
201
      self.proto   = md[1]
202
    else
203
      raise RuntimeError, "Invalid response command string", caller
204
    end
205

206
    check_100()
207
  end
208

209
  #
210
  # Allow 100 Continues to be ignored by the caller
211
  #
212
  def check_100
213
    # If this was a 100 continue with no data, reset
214
    if self.code == 100 and (self.body_bytes_left == -1 or self.body_bytes_left == 0) and self.count_100 < 5
215
      self.reset_except_queue
216
      self.count_100 += 1
217
    end
218
  end
219

220
  # Answers if the response is a redirection one.
221
  #
222
  # @return [Boolean] true if the response is a redirection, false otherwise.
223
  def redirect?
224
    [301, 302, 303, 307, 308].include?(code)
225
  end
226

227
  # Provides the uri of the redirection location.
228
  #
229
  # @return [URI] the uri of the redirection location.
230
  # @return [nil] if the response hasn't a Location header or it isn't a valid uri.
231
  def redirection
232
    URI(headers['Location'])
233
  rescue ArgumentError, ::URI::InvalidURIError
234
    nil
235
  end
236

237
  #
238
  # Returns the response based command string.
239
  #
240
  def cmd_string
241
    "HTTP\/#{proto} #{code}#{(message and message.length > 0) ? ' ' + message : ''}\r\n"
242
  end
243

244
  #
245
  # Used to store a copy of the original request
246
  #
247
  attr_accessor :request
248

249
  #
250
  # Host address:port associated with this request/response
251
  #
252
  attr_accessor :peerinfo
253

254
  attr_accessor :code
255
  attr_accessor :message
256
  attr_accessor :proto
257
  attr_accessor :count_100
258
end
259

260
end
261
end
262
end
263

264