Class: Rex::Proto::Http::Response

Inherits:
Packet
  • Object
show all
Defined in:
lib/rex/proto/http/response.rb

Overview

HTTP response class.

Direct Known Subclasses

E404, OK

Defined Under Namespace

Classes: E404, OK

Instance Attribute Summary collapse

Attributes inherited from Packet

#auto_cl, #body, #bufq, #chunk_max_size, #chunk_min_size, #compress, #error, #headers, #incomplete, #max_data, #state, #transfer_chunked

Instance Method Summary collapse

Methods inherited from Packet

#[], #[]=, #chunk, #completed?, #from_s, #parse, #reset, #reset_except_queue, #to_s

Constructor Details

#initialize(code = 200, message = 'OK', proto = DefaultProtocol) ⇒ Response

Constructage of the HTTP response with the supplied code, message, and protocol.



46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
 
# File 'lib/rex/proto/http/response.rb', line 46

def initialize(code = 200, message = 'OK', proto = DefaultProtocol)
  super()

  self.code    = code.to_i
  self.message = message
  self.proto   = proto

  # Default responses to auto content length on
  self.auto_cl = true

  # default chunk sizes (if chunked is used)
  self.chunk_min_size = 1
  self.chunk_max_size = 10

  # 100 continue counter
  self.count_100 = 0
end

Instance Attribute Details

#code ⇒ Object

Returns the value of attribute code.



229
230
231
 
# File 'lib/rex/proto/http/response.rb', line 229

def code
  @code
end

#count_100 ⇒ Object

Returns the value of attribute count_100.



232
233
234
 
# File 'lib/rex/proto/http/response.rb', line 232

def count_100
  @count_100
end

#message ⇒ Object

Returns the value of attribute message.



230
231
232
 
# File 'lib/rex/proto/http/response.rb', line 230

def message
  @message
end

#proto ⇒ Object

Returns the value of attribute proto.



231
232
233
 
# File 'lib/rex/proto/http/response.rb', line 231

def proto
  @proto
end

#request ⇒ Object

Used to store a copy of the original request



226
227
228
 
# File 'lib/rex/proto/http/response.rb', line 226

def request
  @request
end

Instance Method Details

#check_100 ⇒ Object

Allow 100 Continues to be ignored by the caller



189
190
191
192
193
194
195
 
# File 'lib/rex/proto/http/response.rb', line 189

def check_100
  # If this was a 100 continue with no data, reset
  if self.code == 100 and (self.body_bytes_left == -1 or self.body_bytes_left == 0) and self.count_100 < 5
    self.reset_except_queue
    self.count_100 += 1
  end
end

#cmd_string ⇒ Object

Returns the response based command string.



219
220
221
 
# File 'lib/rex/proto/http/response.rb', line 219

def cmd_string
  "HTTP\/#{proto} #{code}#{(message and message.length > 0) ? ' ' + message : ''}\r\n"
end

#get_cookies ⇒ Object

Gets cookies from the Set-Cookie header in a format to be used in the ‘cookie’ send_request field



68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
 
# File 'lib/rex/proto/http/response.rb', line 68

def get_cookies
  cookies = ""
  if (self.headers.include?('Set-Cookie'))
    set_cookies = self.headers['Set-Cookie']
    key_vals = set_cookies.scan(/\s?([^, ;]+?)=([^, ;]*?)[;,]/)
    key_vals.each do |k, v|
      # Dont downcase actual cookie name as may be case sensitive
      name = k.downcase
      next if name == 'path'
      next if name == 'expires'
      next if name == 'domain'
      next if name == 'max-age'
      cookies << "#{k}=#{v}; "
    end
  end

  return cookies.strip
end

#get_hidden_inputs ⇒ Array<Hash>

Returns a collection of found hidden inputs

Examples:

res = send_request_cgi('uri'=>'/')
inputs = res.get_hidden_inputs
session_id = inputs[0]['sessionid'] # The first form's 'sessionid' hidden input



152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
 
# File 'lib/rex/proto/http/response.rb', line 152

def get_hidden_inputs
  forms = []
  noko = get_html_document
  noko.search("form").each_entry do |form|
    found_inputs = {}
    form.search("input").each_entry do |input|
      input_type = input.attributes['type'] ? input.attributes['type'].value : ''
      next if input_type !~ /hidden/i

      input_name = input.attributes['name'] ? input.attributes['name'].value : ''
      input_value = input.attributes['value'] ? input.attributes['value'].value : ''
      found_inputs[input_name] = input_value unless input_name.empty?
    end
    forms << found_inputs unless found_inputs.empty?
  end

  forms
end

#get_html_document ⇒ Nokogiri::HTML::Document

Returns a parsed HTML document. Instead of using regexes to parse the HTML body, you should use this and use the Nokogiri API.

See Also:



93
94
95
 
# File 'lib/rex/proto/http/response.rb', line 93

def get_html_document
  Nokogiri::HTML(self.body)
end

#get_html_meta_elements ⇒ Array<Nokogiri::XML::Element>

Returns meta tags. You will probably want to use this the web app’s version info (or other stuff) can be found in the metadata.



127
128
129
130
 
# File 'lib/rex/proto/http/response.rb', line 127

def get_html_meta_elements
  n = get_html_document
  n.search('//meta')
end

#get_html_scripts ⇒ Array<RKelly::Nodes::SourceElementsNode>

Returns parsed JavaScript blocks. The parsed version is a RKelly object that allows you to be able do advanced parsing.

See Also:



137
138
139
140
141
 
# File 'lib/rex/proto/http/response.rb', line 137

def get_html_scripts
  n = get_html_document
  rkelly = RKelly::Parser.new
  n.search('//script').map { |s| rkelly.parse(s.text) }
end

#get_json_document ⇒ Hash

Returns a parsed json document. Instead of using regexes to parse the JSON body, you should use this.



110
111
112
113
114
115
116
117
118
119
120
 
# File 'lib/rex/proto/http/response.rb', line 110

def get_json_document
  json = []

  begin
    json = JSON.parse(self.body)
  rescue JSON::ParserError => e
    elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")
  end

  json
end

#get_xml_document ⇒ Nokogiri::XML::Document

Returns a parsed XML document. Instead of using regexes to parse the XML body, you should use this and use the Nokogiri API.

See Also:



102
103
104
 
# File 'lib/rex/proto/http/response.rb', line 102

def get_xml_document
  Nokogiri::XML(self.body)
end

#redirect? ⇒ Boolean

Answers if the response is a redirection one.



200
201
202
 
# File 'lib/rex/proto/http/response.rb', line 200

def redirect?
  [301, 302, 303, 307, 308].include?(code)
end

#redirection ⇒ URI?

Provides the uri of the redirection location.



208
209
210
211
212
213
214
 
# File 'lib/rex/proto/http/response.rb', line 208

def redirection
  begin
    URI(headers['Location'])
  rescue ::URI::InvalidURIError
    nil
  end
end

#update_cmd_parts(str) ⇒ Object

Updates the various parts of the HTTP response command string.



174
175
176
177
178
179
180
181
182
183
184
 
# File 'lib/rex/proto/http/response.rb', line 174

def update_cmd_parts(str)
  if (md = str.match(/HTTP\/(.+?)\s+(\d+)\s?(.+?)\r?\n?$/))
    self.message = md[3].gsub(/\r/, '')
    self.code    = md[2].to_i
    self.proto   = md[1]
  else
    raise RuntimeError, "Invalid response command string", caller
  end

  check_100()
end