From 913036694084aebbeedd32ca83d3eba7922e39c0 Mon Sep 17 00:00:00 2001 From: Simon-Terrien <155531166+Simon-Terrien@users.noreply.github.com> Date: Thu, 22 Feb 2024 16:36:37 +0100 Subject: [PATCH] Correction for port adding and debuging --- .../src/com/faction/api/FactionAPI.java | 124 +++++++++++++----- .../src/com/faction/gui/FactionGUI.java | 8 +- .../src/com/faction/gui/SendToFaction.java | 31 ++++- 3 files changed, 123 insertions(+), 40 deletions(-) diff --git a/FactionBurp/src/com/faction/api/FactionAPI.java b/FactionBurp/src/com/faction/api/FactionAPI.java index a2ee509..7482b71 100644 --- a/FactionBurp/src/com/faction/api/FactionAPI.java +++ b/FactionBurp/src/com/faction/api/FactionAPI.java @@ -33,22 +33,24 @@ public class FactionAPI { private String SERVER = ""; private String TOKEN = ""; + private String PORT = "8090"; // Initialiser PORT avec une chaîne +// Valeur par défaut pour HTTP, 443 pour HTTPS par exemple private Integer refresh; private LinkedHashMap levelMap = new LinkedHashMap(); private int highSev = 4; private int medSev = 3; private int lowSev = 2; private int infoSev = 0; - public static final String ADDVULN = "/assessments/addVuln/"; - public static final String ADDDEFAULTVULN = "/assessments/addDefaultVuln/"; - public static final String SEARCH_DEFAULT_VULN = "/vulnerabilities/default/"; - public static final String QUEUE = "/assessments/queue"; - public static final String VQUEUE = "/verifications/queue"; - public static final String GETVULN = "/assessments/vuln/"; - public static final String GETVULNS = "/assessments/vulns/"; - public static final String SETNOTE = "/assessments/notes/"; - public static final String HISTORY = "/assessments/history/"; - public static final String LEVELS = "/vulnerabilities/getrisklevels/"; + public static final String ADDVULN = "/api/assessments/addVuln/"; + public static final String ADDDEFAULTVULN = "/api/assessments/addDefaultVuln/"; + public static final String SEARCH_DEFAULT_VULN = "/api/vulnerabilities/default/"; + public static final String QUEUE = "/api/assessments/queue"; + public static final String VQUEUE = "/api/verifications/queue"; + public static final String GETVULN = "/api/assessments/vuln/"; + public static final String GETVULNS = "/api/assessments/vulns/"; + public static final String SETNOTE = "/api/assessments/notes/"; + public static final String HISTORY = "/api/assessments/history/"; + public static final String LEVELS = "/api/vulnerabilities/getrisklevels/"; public static final String BURP_SEV_HIGH = "high"; public static final String BURP_SEV_MED = "medium"; @@ -113,10 +115,12 @@ public String getSeverityStringFromSeverityId(Integer sevId) { public void updateProps(String server, String token, String refresh) { this.SERVER = server; this.TOKEN = token; + this.PORT = PORT; this.refresh = Integer.parseInt(refresh); Properties props = this.getProps(); props.setProperty("server", server); props.setProperty("token", token); + props.setProperty("port", PORT); props.setProperty("refresh", refresh); String path = System.getProperty("user.home") + File.separator + "/.faction" + File.separator; File f = new File(path + "faction.properties"); @@ -147,15 +151,14 @@ public void updateSev(String burpSevName, String sevName) { e.printStackTrace(); } } - public Properties getProps() { Properties props = new Properties(); InputStream is = null; - + try { String path = System.getProperty("user.home") + File.separator + "/.faction" + File.separator; File f = new File(path + "faction.properties"); - + if (!f.exists()) { File p = new File(path); if (!p.exists()) { @@ -167,18 +170,20 @@ public Properties getProps() { props.load(is); this.SERVER = props.getProperty("server", ""); this.TOKEN = props.getProperty("token", ""); + this.PORT = props.getProperty("port", "8090"); // Chargement du port this.refresh = Integer.parseInt(props.getProperty("refresh", "20")); this.highSev = Integer.parseInt(props.getProperty(BURP_SEV_HIGH, "4")); this.medSev = Integer.parseInt(props.getProperty(BURP_SEV_MED, "3")); this.lowSev = Integer.parseInt(props.getProperty(BURP_SEV_LOW, "2")); this.infoSev = Integer.parseInt(props.getProperty(BURP_SEV_INFO, "0")); + // ... le reste de la méthode ... return props; } catch (Exception e) { - is = null; + e.printStackTrace(); + return null; } - return null; - } + public LinkedHashMap getLevelMap() { JSONArray array = this.executeGet(LEVELS); @@ -196,31 +201,56 @@ public LinkedHashMap getLevelMap() { public JSONArray executePost(String targetURL, String postData) { try { - logging.logToOutput("Sending Post"); - URL url = new URL(this.SERVER); + logging.logToOutput("Sending Post"); + URL url = new URL(this.SERVER + ":" + this.PORT + targetURL); // Assurez-vous que l'URL est correcte + logging.logToOutput("URL: " + url.toString()); // Journaliser l'URL complète String targetHost = url.getHost(); - String targetPath = url.getPath(); - boolean isSecure = url.getProtocol().equals("https") ; - HttpService service = HttpService - .httpService(targetHost, isSecure); + int portInt = Integer.parseInt(this.PORT); + boolean isSecure = url.getProtocol().equals("https"); + HttpService service = HttpService.httpService(targetHost, portInt, isSecure); + HttpRequest request = HttpRequest .httpRequest() .withService(service) .withHeader("Host", targetHost) .withMethod("POST") - .withPath(targetPath + targetURL) + .withPath(targetURL) .withAddedHeader("FACTION-API-KEY", this.TOKEN) .withAddedHeader("Content-Language", "en-US") .withAddedHeader("Accept", "application/json") .withAddedHeader("Content-Type", "application/x-www-form-urlencoded") .withBody(postData); - CompletableFuture requestResponse = CompletableFuture.supplyAsync(() ->{ + + // Journaliser les détails de la requête + logging.logToOutput("Request Headers: " + request.headers().toString()); + logging.logToOutput("Request Body: " + postData); + + CompletableFuture requestResponse = CompletableFuture.supplyAsync(() -> { HttpRequestResponse response = http.sendRequest(request); return response; }); - + HttpRequestResponse response = requestResponse.get(); - + logging.logToOutput("Sending request to: " + url.toString()); + logging.logToOutput("Request Method: " + request.method().toString()); + logging.logToOutput("Request Headers: " + request.headers().toString()); + if (request.method().equals("POST")) { + logging.logToOutput("Request Body: " + postData); // Pour les requêtes POST uniquement + } + if (response != null && response.hasResponse()) { + logging.logToOutput("Received response with status code: " + response.response().statusCode()); + + // Imprimer les en-têtes de réponse + logging.logToOutput("Response Headers: " + response.response().headers().toString()); + + // Imprimer le corps de la réponse, s'il est présent + if (response.response().body() != null) { + logging.logToOutput("Response Body: " + response.response().bodyToString()); + } + } else { + logging.logToOutput("No response received."); + } + if (response.hasResponse() && response.response().statusCode() == 200) { String jsonString = response.response().bodyToString(); @@ -246,28 +276,49 @@ public JSONArray executePost(String targetURL, String postData) { public JSONArray executeGet(String targetURL) { try { - URL url = new URL(this.SERVER); + URL url = new URL(this.SERVER + ":" + this.PORT + targetURL); // Assurez-vous que l'URL est correcte + logging.logToOutput("URL: " + url.toString()); // Journaliser l'URL complète String targetHost = url.getHost(); - String targetPath = url.getPath(); - boolean isSecure = url.getProtocol().equals("https") ; - HttpService service = HttpService - .httpService(targetHost, isSecure); + int portInt = Integer.parseInt(this.PORT); + boolean isSecure = url.getProtocol().equals("https"); + HttpService service = HttpService.httpService(targetHost, portInt, isSecure); + HttpRequest request = HttpRequest .httpRequest() .withService(service) .withHeader("Host", targetHost) .withMethod("GET") - .withPath(targetPath + targetURL.replace("+", "%20")) + .withPath(targetURL.replace("+", "%20")) .withAddedHeader("FACTION-API-KEY", this.TOKEN) .withAddedHeader("Content-Language", "en-US") .withAddedHeader("Accept", "application/json"); - - CompletableFuture requestResponse = CompletableFuture.supplyAsync(() ->{ + + // Journaliser les détails de la requête + logging.logToOutput("Request Headers: " + request.headers().toString()); + + CompletableFuture requestResponse = CompletableFuture.supplyAsync(() -> { HttpRequestResponse response = http.sendRequest(request); return response; }); + logging.logToOutput("Sending request to: " + url.toString()); + logging.logToOutput("Request Method: " + request.method().toString()); + logging.logToOutput("Request Headers: " + request.headers().toString()); + HttpRequestResponse response = requestResponse.get(); + if (response != null && response.hasResponse()) { + logging.logToOutput("Received response with status code: " + response.response().statusCode()); + + // Imprimer les en-têtes de réponse + logging.logToOutput("Response Headers: " + response.response().headers().toString()); + + // Imprimer le corps de la réponse, s'il est présent + if (response.response().body() != null) { + logging.logToOutput("Response Body: " + response.response().bodyToString()); + } + } else { + logging.logToOutput("No response received."); + } if (response.hasResponse() && response.response().statusCode() == 200) { JSONParser parser = new JSONParser(); try { @@ -288,7 +339,10 @@ public JSONArray executeGet(String targetURL) { } public String getCSS() { - return SERVER.replace("api", "") + "service/rd_styles.css"; + // Cette version suppose que SERVER inclut le protocole, l'hôte et le port si nécessaire. + // Elle ajoute simplement le chemin approprié au fichier CSS, sans tenter de remplacer ou d'ajuster "api". + return SERVER + "/service/rd_styles.css"; } + } diff --git a/FactionBurp/src/com/faction/gui/FactionGUI.java b/FactionBurp/src/com/faction/gui/FactionGUI.java index 95f36a6..aefb269 100644 --- a/FactionBurp/src/com/faction/gui/FactionGUI.java +++ b/FactionBurp/src/com/faction/gui/FactionGUI.java @@ -157,7 +157,7 @@ public void valueChanged(ListSelectionEvent event) { int row = verTable.convertRowIndexToModel(r); Long vid = (Long)verModel.getValueAt(row, 4); - JSONArray json = factionApi.executeGet("/assessments/vuln/" + vid); + JSONArray json = factionApi.executeGet("/api/assessments/vuln/" + vid); JSONObject j = (JSONObject)json.get(0); JSONArray s = (JSONArray)j.get("Steps"); List Images = new ArrayList(); @@ -253,7 +253,7 @@ public void valueChanged(ListSelectionEvent event) { notes2Txt.setText(notes[1]==null? "Nothing to Show" : notes[1]); JSONArray json = new JSONArray(); try { - json = factionApi.executeGet("/assessments/history/" + URLEncoder.encode(appId,"UTF-8")); + json = factionApi.executeGet("/api/assessments/history/" + URLEncoder.encode(appId,"UTF-8")); } catch (UnsupportedEncodingException e) { e.printStackTrace(); } @@ -487,7 +487,7 @@ public void valueChanged(ListSelectionEvent event) { int r = vulnTable.getSelectedRow(); int row = vulnTable.convertRowIndexToModel(r); Long vid = (Long)vulnModel.getValueAt(row, 6); - JSONArray json = factionApi.executeGet("/assessments/vuln/" + vid); + JSONArray json = factionApi.executeGet("/api/assessments/vuln/" + vid); JSONObject j = (JSONObject)json.get(0); VulnerabilityDetailsPane test = new VulnerabilityDetailsPane(factionApi,(String)j.get("Name"), j.get("Description").toString(),j.get("Recommendation").toString(),j.get("Details").toString(), legacyCallback); test.setDefaultCloseOperation(JFrame.HIDE_ON_CLOSE); @@ -736,7 +736,7 @@ private synchronized void updateAPI() { if(!appId.equals("")){ JSONArray vulns = new JSONArray(); try { - vulns = factionApi.executeGet("/assessments/history/" + URLEncoder.encode(appId,"UTF-8")); + vulns = factionApi.executeGet("/api/assessments/history/" + URLEncoder.encode(appId,"UTF-8")); } catch (UnsupportedEncodingException e) { // TODO Auto-generated catch block e.printStackTrace(); diff --git a/FactionBurp/src/com/faction/gui/SendToFaction.java b/FactionBurp/src/com/faction/gui/SendToFaction.java index 0144c9b..dd79d02 100644 --- a/FactionBurp/src/com/faction/gui/SendToFaction.java +++ b/FactionBurp/src/com/faction/gui/SendToFaction.java @@ -39,6 +39,7 @@ import javax.swing.Box; import java.awt.Dimension; import javax.swing.JTextField; +import javax.swing.SwingUtilities; import javax.swing.border.LineBorder; import java.awt.Color; import javax.swing.JButton; @@ -254,6 +255,7 @@ public void actionPerformed(ActionEvent arg0) { searchPanel.add(lblSearch, gbc_lblSearch); vulnSearch = new JTextField(); + /* vulnSearch.addKeyListener(new KeyAdapter() { @Override public void keyTyped(KeyEvent arg0) { @@ -294,7 +296,34 @@ public void keyTyped(KeyEvent arg0) { } } + }); */ + vulnSearch.addKeyListener(new KeyAdapter() { + @Override + public void keyReleased(KeyEvent e) { // Changed from keyTyped to keyReleased + SwingUtilities.invokeLater(new Runnable() { // Ensure updates are made on the EDT + public void run() { + if(vulnSearch.getText().length() >= 2){ + // Perform the search and update the JComboBox + JSONArray jarray = factionApi.executeGet(FactionAPI.SEARCH_DEFAULT_VULN + vulnSearch.getText()); + DefaultComboBoxModel model = (DefaultComboBoxModel) defaultVulns.getModel(); + model.removeAllElements(); // Clear existing items + _defaultVulns.clear(); + for(int i=0; i< jarray.size(); i++){ + JSONObject obj = (JSONObject)jarray.get(i); + String itemName = ""+obj.get("Name"); + model.addElement(itemName); + _defaultVulns.put(itemName, obj); + } + } else { + DefaultComboBoxModel model = (DefaultComboBoxModel) defaultVulns.getModel(); + model.removeAllElements(); // Clear if search text is less than 2 + _defaultVulns.clear(); + } + } + }); + } }); + GridBagConstraints gbc_vulnSearch = new GridBagConstraints(); gbc_vulnSearch.insets = new Insets(0, 0, 5, 0); gbc_vulnSearch.fill = GridBagConstraints.HORIZONTAL; @@ -547,7 +576,7 @@ public void actionPerformed(ActionEvent arg0) { gbc_rigidArea_3.gridy = 8; frame.getContentPane().add(rigidArea_3, gbc_rigidArea_3); - asmts = factionApi.executeGet("/assessments/queue"); + asmts = factionApi.executeGet("/api/assessments/queue"); for(int i=0; i< asmts.size(); i++){ JSONObject obj = (JSONObject)asmts.get(i); assessmentList.addItem(obj.get("AppId") + " " + obj.get("Name"));