From 339bba5bcb25f30756c5e2df6b109cc6920a77fa Mon Sep 17 00:00:00 2001 From: Sarah Jamie Lewis Date: Thu, 27 Apr 2023 10:58:42 -0700 Subject: [PATCH] Cleaning up Cwtchbot --- cmd/devbot/main.go | 142 ----------- cmd/fuzzbot/blns.json | 517 ----------------------------------------- cmd/fuzzbot/fuzzbot.go | 245 ------------------- 3 files changed, 904 deletions(-) delete mode 100644 cmd/devbot/main.go delete mode 100644 cmd/fuzzbot/blns.json delete mode 100644 cmd/fuzzbot/fuzzbot.go diff --git a/cmd/devbot/main.go b/cmd/devbot/main.go deleted file mode 100644 index 89bd069..0000000 --- a/cmd/devbot/main.go +++ /dev/null @@ -1,142 +0,0 @@ -package main - -import ( - "cwtch.im/cwtch/event" - "cwtch.im/cwtch/model" - "cwtch.im/cwtch/protocol/connections" - "encoding/json" - "fmt" - "git.openprivacy.ca/openprivacy/log" - "git.openprivacy.ca/sarah/cwtchbot" - "github.com/araddon/dateparse" - "math/rand" - "os/user" - "path" - "strings" - "time" -) - -var cwtchbot *bot.CwtchBot - -type OverlayEnvelope struct { - onion string - Overlay int `json:"o"` - Data string `json:"d"` -} - -func Unwrap(onion, msg string) *OverlayEnvelope { - var envelope OverlayEnvelope - err := json.Unmarshal([]byte(msg), &envelope) - if err != nil { - log.Errorf("json error: %v", err) - return nil - } - envelope.onion = onion - return &envelope -} - -func (this *OverlayEnvelope) reply(msg string) { - retenv := OverlayEnvelope{Overlay:1, Data:msg} - raw, _ := json.Marshal(retenv) - log.Debugf("sending %v to %v", string(raw), this.onion) - cwtchbot.Peer.SendMessageToPeer(this.onion, string(raw)) -} - -func (this *OverlayEnvelope) spam() { - for { - this.reply(fmt.Sprintf("%d", rand.Int())) - } -} - -func helpMessage() string { - return "help\nevery\nin\nat\nspam\nstop" -} - -func main() { - user, _ := user.Current() - log.SetLevel(log.LevelInfo) - cwtchbot = bot.NewCwtchBot(path.Join(user.HomeDir, "/.echobot/"), "echobot") - - cwtchbot.Launch() - - for { - log.Infof("Process.....\n") - message := cwtchbot.Queue.Next() - switch message.EventType { - case event.NewMessageFromGroup: - if message.Data[event.RemotePeer] != cwtchbot.Peer.GetOnion() { - log.Infof("New Message: %v\v", message.Data[event.Data]) - cwtchbot.Peer.SendMessageToGroupTracked(message.Data[event.GroupID], message.Data[event.Data]) - } - case event.NewMessageFromPeer: - log.Infof("New Event: %v", message) - cwtchbot.Queue.Publish(event.NewEvent(event.PeerAcknowledgement, map[event.Field]string{event.EventID: message.EventID, event.RemotePeer: message.Data[event.RemotePeer]})) - - envelope := Unwrap(message.Data[event.RemotePeer], message.Data[event.Data]) - mainTimer := time.NewTimer(time.Nanosecond) - - if envelope.Overlay == 1 { - cmd := strings.Split(envelope.Data, " ") - switch cmd[0] { - case "help": - envelope.reply(helpMessage()) - case "every": - interval, err := time.ParseDuration(cmd[1]) - if err != nil { - envelope.reply(fmt.Sprintf("parse error: %s", err)) - continue - } - envelope.reply("you got it!") - mainTimer.Stop() - mainTimer = time.AfterFunc(interval, func() { - envelope.reply(cmd[2]) - mainTimer.Reset(interval) - }) - case "in": - interval, err := time.ParseDuration(cmd[1]) - if err != nil { - envelope.reply(fmt.Sprintf("parse error: %s", err)) - continue - } - envelope.reply("will do!") - mainTimer.Stop() - mainTimer = time.AfterFunc(interval, func() { - envelope.reply(cmd[2]) - }) - case "at": - at, err := dateparse.ParseAny(cmd[1]) - if err != nil { - envelope.reply(fmt.Sprintf("parse error: %s", err)) - continue - } - envelope.reply(fmt.Sprintf("ok, sending at %v", at)) - - mainTimer.Stop() - interval := time.Until(at) - time.AfterFunc(interval, func() { - envelope.reply(cmd[2]) - }) - case "spam": - envelope.reply("lol ok you asked for it!") - mainTimer.Stop() - mainTimer = time.AfterFunc(time.Nanosecond, func() { - envelope.reply(fmt.Sprintf("%d", rand.Int())) - mainTimer.Reset(time.Nanosecond) - }) - default: - envelope.reply("unrecognized command") - } - } else { - log.Warnf("unknown overlay type %d", envelope.Overlay) - } - case event.PeerStateChange: - state := message.Data[event.ConnectionState] - if state == connections.ConnectionStateName[connections.AUTHENTICATED] { - log.Infof("Auto approving stranger %v", message.Data[event.RemotePeer]) - cwtchbot.Peer.AddContact("stranger", message.Data[event.RemotePeer], model.AuthApproved) - } - default: - log.Infof("New Event: %v", message) - } - } -} diff --git a/cmd/fuzzbot/blns.json b/cmd/fuzzbot/blns.json deleted file mode 100644 index bfb195f..0000000 --- a/cmd/fuzzbot/blns.json +++ /dev/null @@ -1,517 +0,0 @@ -[ - "", - "undefined", - "undef", - "null", - "NULL", - "(null)", - "nil", - "NIL", - "true", - "false", - "True", - "False", - "TRUE", - "FALSE", - "None", - "hasOwnProperty", - "then", - "\\", - "\\\\", - "0", - "1", - "1.00", - "$1.00", - "1/2", - "1E2", - "1E02", - "1E+02", - "-1", - "-1.00", - "-$1.00", - "-1/2", - "-1E2", - "-1E02", - "-1E+02", - "1/0", - "0/0", - "-2147483648/-1", - "-9223372036854775808/-1", - "-0", - "-0.0", - "+0", - "+0.0", - "0.00", - "0..0", - ".", - "0.0.0", - "0,00", - "0,,0", - ",", - "0,0,0", - "0.0/0", - "1.0/0.0", - "0.0/0.0", - "1,0/0,0", - "0,0/0,0", - "--1", - "-", - "-.", - "-,", - "999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999", - "NaN", - "Infinity", - "-Infinity", - "INF", - "1#INF", - "-1#IND", - "1#QNAN", - "1#SNAN", - "1#IND", - "0x0", - "0xffffffff", - "0xffffffffffffffff", - "0xabad1dea", - "123456789012345678901234567890123456789", - "1,000.00", - "1 000.00", - "1'000.00", - "1,000,000.00", - "1 000 000.00", - "1'000'000.00", - "1.000,00", - "1 000,00", - "1'000,00", - "1.000.000,00", - "1 000 000,00", - "1'000'000,00", - "01000", - "08", - "09", - "2.2250738585072011e-308", - ",./;'[]\\-=", - "<>?:\"{}|_+", - "!@#$%^&*()`~", - "\u0001\u0002\u0003\u0004\u0005\u0006\u0007\b\u000e\u000f\u0010\u0011\u0012\u0013\u0014\u0015\u0016\u0017\u0018\u0019\u001a\u001b\u001c\u001d\u001e\u001f", - "€‚ƒ„†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ", - "\t\u000b\f …             ​

   ", - "­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‪‫‬‭‮⁠⁡⁢⁣⁤⁦⁧⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵󠀶󠀷󠀸󠀹󠀺󠀻󠀼󠀽󠀾󠀿󠁀󠁁󠁂󠁃󠁄󠁅󠁆󠁇󠁈󠁉󠁊󠁋󠁌󠁍󠁎󠁏󠁐󠁑󠁒󠁓󠁔󠁕󠁖󠁗󠁘󠁙󠁚󠁛󠁜󠁝󠁞󠁟󠁠󠁡󠁢󠁣󠁤󠁥󠁦󠁧󠁨󠁩󠁪󠁫󠁬󠁭󠁮󠁯󠁰󠁱󠁲󠁳󠁴󠁵󠁶󠁷󠁸󠁹󠁺󠁻󠁼󠁽󠁾󠁿", - "", - "￾", - "Ω≈ç√∫˜µ≤≥÷", - "åß∂ƒ©˙∆˚¬…æ", - "œ∑´®†¥¨ˆøπ“‘", - "¡™£¢∞§¶•ªº–≠", - "¸˛Ç◊ı˜Â¯˘¿", - "ÅÍÎÏ˝ÓÔÒÚÆ☃", - "Œ„´‰ˇÁ¨ˆØ∏”’", - "`⁄€‹›fifl‡°·‚—±", - "⅛⅜⅝⅞", - "ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя", - "٠١٢٣٤٥٦٧٨٩", - "⁰⁴⁵", - "₀₁₂", - "⁰⁴⁵₀₁₂", - "ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็", - "'", - "\"", - "''", - "\"\"", - "'\"'", - "\"''''\"'\"", - "\"'\"'\"''''\"", - "", - "", - "", - "", - "田中さんにあげて下さい", - "パーティーへ行かないか", - "和製漢語", - "部落格", - "사회과학원 어학연구소", - "찦차를 타고 온 펲시맨과 쑛다리 똠방각하", - "社會科學院語學研究所", - "울란바토르", - "𠜎𠜱𠝹𠱓𠱸𠲖𠳏", - "𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓/𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆", - "表ポあA鷗ŒéB逍Üߪąñ丂㐀𠀀", - "Ⱥ", - "Ⱦ", - "ヽ༼ຈل͜ຈ༽ノ ヽ༼ຈل͜ຈ༽ノ", - "(。◕ ∀ ◕。)", - "`ィ(´∀`∩", - "__ロ(,_,*)", - "・( ̄∀ ̄)・:*:", - "゚・✿ヾ╲(。◕‿◕。)╱✿・゚", - ",。・:*:・゜’( ☻ ω ☻ )。・:*:・゜’", - "(╯°□°)╯︵ ┻━┻)", - "(ノಥ益ಥ)ノ ┻━┻", - "┬─┬ノ( º _ ºノ)", - "( ͡° ͜ʖ ͡°)", - "¯\\_(ツ)_/¯", - "😍", - "👩🏽", - "👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️", - "👾 🙇 💁 🙅 🙆 🙋 🙎 🙍", - "🐵 🙈 🙉 🙊", - "❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙", - "✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿", - "👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦", - "🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧", - "0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟", - "🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸", - "🇺🇸🇷🇺🇸🇦🇫🇦🇲", - "🇺🇸🇷🇺🇸🇦", - "123", - "١٢٣", - "ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر الحدود أي بعد, معاملة بولندا، الإطلاق عل إيو.", - "בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ", - "הָיְתָהtestالصفحات التّحول", - "﷽", - "ﷺ", - "مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، ", - "᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜‪‪‪", - "‪‪᚛                 ᚜‪", - "‪‪test‪", - "‫test‫", - "
test
", - "test⁠test‫", - "⁦test⁧", - "Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ͏͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣", - "̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖̦̻͢.̛̖̞̠̫̰", - "̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰̲͙̻̝f ̪̰̰̗̖̭̘͘c̦͍̲̞͍̩̙ḥ͚a̮͎̟̙͜ơ̩̹͎s̤.̝̝ ҉Z̡̖̜͖̰̣͉̜a͖̰͙̬͡l̲̫̳͍̩g̡̟̼̱͚̞̬ͅo̗͜.̟", - "̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹̼̣l̴͔̰̤̟͔ḽ̫.͕", - "Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮", - "˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥", - "00˙Ɩ$-", - "The quick brown fox jumps over the lazy dog", - "𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠", - "𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌", - "𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈", - "𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰", - "𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘", - "𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐", - "⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢", - "", - "<script>alert('123');</script>", - "", - "", - "\">", - "'>", - ">", - "", - "< / script >< script >alert(123)< / script >", - " onfocus=JaVaSCript:alert(123) autofocus", - "\" onfocus=JaVaSCript:alert(123) autofocus", - "' onfocus=JaVaSCript:alert(123) autofocus", - "<script>alert(123)</script>", - "ript>alert(123)ript>", - "-->", - "\";alert(123);t=\"", - "';alert(123);t='", - "JavaSCript:alert(123)", - ";alert(123);", - "src=JaVaSCript:prompt(132)", - "\"><\\x3Cscript>javascript:alert(1)", - "'`\"><\\x00script>javascript:alert(1)", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "ABC
DEF", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "test", - "`\"'>", - "`\"'>", - "`\"'>", - "`\"'>", - "`\"'>", - "`\"'>", - "`\"'>", - "`\"'>", - "`\"'>", - "`\"'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "\"`'>", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "", - "XXX", - "javascript:alert(1)\"` `>", - "", - "", - "<a href=http://foo.bar/#x=`y></a><img alt=\"`><img src=x:x onerror=javascript:alert(1)></a>\">", - "<!--[if]><script>javascript:alert(1)</script -->", - "<!--[if<img src=x onerror=javascript:alert(1)//]> -->", - "<script src=\"/\\%(jscript)s\"></script>", - "<script src=\"\\\\%(jscript)s\"></script>", - "<IMG \"\"\"><SCRIPT>alert(\"XSS\")</SCRIPT>\">", - "<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>", - "<IMG SRC=# onmouseover=\"alert('xxs')\">", - "<IMG SRC= onmouseover=\"alert('xxs')\">", - "<IMG onmouseover=\"alert('xxs')\">", - "<IMG SRC=javascript:alert('XSS')>", - "<IMG SRC=javascript:alert('XSS')>", - "<IMG SRC=javascript:alert('XSS')>", - "<IMG SRC=\"jav ascript:alert('XSS');\">", - "<IMG SRC=\"jav ascript:alert('XSS');\">", - "<IMG SRC=\"jav ascript:alert('XSS');\">", - "<IMG SRC=\"jav ascript:alert('XSS');\">", - "perl -e 'print \"<IMG SRC=java\\0script:alert(\\\"XSS\\\")>\";' > out", - "<IMG SRC=\"  javascript:alert('XSS');\">", - "<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", - "<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>", - "<SCRIPT/SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>", - "<<SCRIPT>alert(\"XSS\");//<</SCRIPT>", - "<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >", - "<SCRIPT SRC=//ha.ckers.org/.j>", - "<IMG SRC=\"javascript:alert('XSS')\"", - "<iframe src=http://ha.ckers.org/scriptlet.html <", - "\\\";alert('XSS');//", - "<u oncopy=alert()> Copy me</u>", - "<i onwheel=alert(1)> Scroll over me </i>", - "<plaintext>", - "http://a/%%30%30", - "</textarea><script>alert(123)</script>", - "1;DROP TABLE users", - "1'; DROP TABLE users-- 1", - "' OR 1=1 -- 1", - "' OR '1'='1", - "'; EXEC sp_MSForEachTable 'DROP TABLE ?'; --", - " ", - "%", - "_", - "-", - "--", - "--version", - "--help", - "$USER", - "/dev/null; touch /tmp/blns.fail ; echo", - "`touch /tmp/blns.fail`", - "$(touch /tmp/blns.fail)", - "@{[system \"touch /tmp/blns.fail\"]}", - "eval(\"puts 'hello world'\")", - "System(\"ls -al /\")", - "`ls -al /`", - "Kernel.exec(\"ls -al /\")", - "Kernel.exit(1)", - "%x('ls -al /')", - "<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]><foo>&xxe;</foo>", - "$HOME", - "$ENV{'HOME'}", - "%d", - "%s%s%s%s%s", - "{0}", - "%*.*s", - "%@", - "%n", - "File:///", - "../../../../../../../../../../../etc/passwd%00", - "../../../../../../../../../../../etc/hosts", - "() { 0; }; touch /tmp/blns.shellshock1.fail;", - "() { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; }", - "<<< %s(un='%s') = %u", - "+++ATH0", - "CON", - "PRN", - "AUX", - "CLOCK$", - "NUL", - "A:", - "ZZ:", - "COM1", - "LPT1", - "LPT2", - "LPT3", - "COM2", - "COM3", - "COM4", - "DCC SEND STARTKEYLOGGER 0 0 0", - "Scunthorpe General Hospital", - "Penistone Community Church", - "Lightwater Country Park", - "Jimmy Clitheroe", - "Horniman Museum", - "shitake mushrooms", - "RomansInSussex.co.uk", - "http://www.cum.qc.ca/", - "Craig Cockburn, Software Specialist", - "Linda Callahan", - "Dr. Herman I. Libshitz", - "magna cum laude", - "Super Bowl XXX", - "medieval erection of parapets", - "evaluate", - "mocha", - "expression", - "Arsenal canal", - "classic", - "Tyson Gay", - "Dick Van Dyke", - "basement", - "If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.", - "Roses are \u001b[0;31mred\u001b[0m, violets are \u001b[0;34mblue. Hope you enjoy terminal hue", - "But now...\u001b[20Cfor my greatest trick...\u001b[8m", - "The quic\b\b\b\b\b\bk brown fo\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007\u0007x... [Beeeep]", - "Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗", - "🏳0🌈️", - "జ్ఞ‌ా", - "گچپژ", - "{% print 'x' * 64 * 1024**3 %}", - "{{ \"\".__class__.__mro__[2].__subclasses__()[40](\"/etc/passwd\").read() }}" -] diff --git a/cmd/fuzzbot/fuzzbot.go b/cmd/fuzzbot/fuzzbot.go deleted file mode 100644 index 622edbe..0000000 --- a/cmd/fuzzbot/fuzzbot.go +++ /dev/null @@ -1,245 +0,0 @@ -package main - -import ( - "crypto/rand" - "crypto/sha256" - "cwtch.im/cwtch/event" - "cwtch.im/cwtch/functionality/filesharing" - "cwtch.im/cwtch/model" - "cwtch.im/cwtch/model/attr" - "cwtch.im/cwtch/model/constants" - "cwtch.im/cwtch/protocol/connections" - "cwtch.im/cwtch/protocol/files" - "encoding/base64" - "encoding/hex" - "encoding/json" - "git.openprivacy.ca/openprivacy/log" - "git.openprivacy.ca/sarah/cwtchbot" - _ "github.com/mutecomm/go-sqlcipher/v4" - "io" - "io/ioutil" - "math/big" - "os" - "os/user" - "path" - "strings" - "time" -) - -type BLNS struct { - inputs []string -} - -func main() { - user, _ := user.Current() - log.SetLevel(log.LevelInfo) - cwtchbot := bot.NewCwtchBot(path.Join(user.HomeDir, "/.fuzzbot/"), "fuzzbot") - - cwtchbot.Launch() - - blns := new(BLNS) - blns_file, err := ioutil.ReadFile("./cmd/fuzzbot/blns.json") - if err != nil { - log.Errorf("could not read BLNS file %v", err) - os.Exit(1) - } - var inputs []string - err = json.Unmarshal(blns_file, &inputs) - if err != nil { - log.Errorf("could not decode BLNS file %v", err) - } - blns.inputs = inputs - - input := make([]byte, 64) - _, err = rand.Read(input) - if err != nil { - panic(err) - } - cwtchbot.Peer.SetScopedZonedAttribute(attr.LocalScope, attr.ProfileZone, constants.Name, "fuzzbot") - - // Will currently only work on Sarah's custom fork (testing custom profile images) - fh := new(filesharing.Functionality) - fileKey, _, err := fh.ShareFile("./fuzzbot.png", cwtchbot.Peer) - log.Errorf("sharing file: %v %v", fileKey, err) - const CustomProfileImageKey = "custom-profile-image" - cwtchbot.Peer.SetScopedZonedAttribute(attr.PublicScope, attr.ProfileZone, CustomProfileImageKey, fileKey) - - // Create a group for this session: - // group, invite := cwtchbot.Peer.StartGroup("ur33edbwvbevcls5ue6jpkoubdptgkgl5bedzfyau2ibf5276lyp4uid") - - // fmt.Printf("invite: %v", invite) - - for { - log.Infof("Process.....\n") - message := cwtchbot.Queue.Next() - switch message.EventType { - case event.NewMessageFromPeer: - log.Infof("New Event: %v", message) - cwtchbot.Queue.Publish(event.NewEvent(event.PeerAcknowledgement, map[event.Field]string{event.EventID: message.EventID, event.RemotePeer: message.Data[event.RemotePeer]})) - msg := cwtchbot.UnpackMessage(message.Data[event.Data]) - log.Infof("Message: %v", msg) - command := strings.Split(msg.Data, " ") - cid, _ := cwtchbot.Peer.FetchConversationInfo(message.Data[event.RemotePeer]) - switch command[0] { - case "blns": - { - reply := string(cwtchbot.PackMessage(msg.Overlay, "Starting the Fuzzing Process...")) - cwtchbot.Peer.SendMessage(cid.ID, reply) - for _, input := range blns.inputs { - reply := string(cwtchbot.PackMessage(msg.Overlay, input)) - cwtchbot.Peer.SendMessage(cid.ID, reply) - } - } - case "blns-mutate": - { - reply := string(cwtchbot.PackMessage(msg.Overlay, "Starting the BLNS Mutation Process...")) - cwtchbot.Peer.SendMessage(cid.ID, reply) - for _, input := range blns.inputs { - for i := 0; i < 5; i++ { - reply := string(cwtchbot.PackMessage(msg.Overlay, mutate(input))) - cwtchbot.Peer.SendMessage(cid.ID, reply) - time.Sleep(time.Millisecond * 50) - } - } - } - case "random-overlay": - { - reply := string(cwtchbot.PackMessage(msg.Overlay, "Starting the Fuzzing Process...")) - cwtchbot.Peer.SendMessage(cid.ID, reply) - for i := 0; i < 100; i++ { - input := make([]byte, 64) - _, err := rand.Read(input) - if err != nil { - panic(err) - } - reply := string(cwtchbot.PackMessage(int(input[0]), string(input))) - cwtchbot.Peer.SendMessage(cid.ID, reply) - } - } - case "random": - { - reply := string(cwtchbot.PackMessage(msg.Overlay, "Starting the Fuzzing Process...")) - cwtchbot.Peer.SendMessage(cid.ID, reply) - for i := 0; i < 100; i++ { - input := make([]byte, 64) - _, err := rand.Read(input) - if err != nil { - panic(err) - } - reply := string(input) - cwtchbot.Peer.SendMessage(cid.ID, reply) - } - } - case "quoteme": - hashSum := sha256.Sum256([]byte(message.Data[event.RemotePeer] + message.Data[event.Data])) - contentHash := base64.StdEncoding.EncodeToString(hashSum[:]) - reply := string(cwtchbot.PackMessage(10, `{"quotedHash":"`+contentHash+`","body":"quoted for you"}`)) - cwtchbot.Peer.SendMessage(cid.ID, reply) - case "quoteme-evil": - hashSum := sha256.Sum256([]byte(message.Data[event.RemotePeer] + message.Data[event.Data])) - contentHash := base64.StdEncoding.EncodeToString(hashSum[:]) - reply := string(cwtchbot.PackMessage(10, `{"quotedHash":"`+contentHash+`","body":"quoted for you"}`)) - cwtchbot.Peer.SendMessage(cid.ID, mutate(reply)) - case "help": - reply := string(cwtchbot.PackMessage(msg.Overlay, "Fuzzing commands: [blns, invite-me]")) - cwtchbot.Peer.SendMessage(cid.ID, reply) - reply = string(cwtchbot.PackMessage(msg.Overlay, "Cwtch Testing Group Invite: [testgroup-invite]")) - cwtchbot.Peer.SendMessage(cid.ID, reply) - case "slow": - for i := 0; i < 10; i++ { - reply := string(cwtchbot.PackMessage(msg.Overlay, "Fuzzing commands: [blns, invite-me]")) - cwtchbot.Peer.SendMessage(cid.ID, mutate(reply)) - time.Sleep(time.Second * 2) - } - case "sharefile": - for i := 0; i < 100; i++ { - manifest, _ := files.CreateManifest("./README.md") - - var nonce [24]byte - if _, err := io.ReadFull(rand.Reader, nonce[:]); err != nil { - log.Errorf("Cannot read from random: %v\n", err) - } - - message := filesharing.OverlayMessage{ - Name: path.Base(manifest.FileName), - Hash: hex.EncodeToString(manifest.RootHash), - Nonce: hex.EncodeToString(nonce[:]), - Size: manifest.FileSizeInBytes, - } - - data, _ := json.Marshal(message) - - wrapper := model.MessageWrapper{ - Overlay: model.OverlayFileSharing, - Data: string(data), - } - wrapperJSON, _ := json.Marshal(wrapper) - cwtchbot.Peer.SendMessage(cid.ID, mutate(string(wrapperJSON))) - } - - case "fuzz-peer-details": - break - case "testgroup-invite": - reply := string(cwtchbot.PackMessage(101, "tofubundle:server:eyJLZXlzIjp7ImJ1bGxldGluX2JvYXJkX29uaW9uIjoiaXNicjJ0NmJmbHVsMnp5aTZoanRudWV6YjJ4dmZyNDJzdnpqZzJxM2d5cWZnZzN3bW5yYmtrcWQiLCJwcml2YWN5X3Bhc3NfcHVibGljX2tleSI6Ik1JWC93L2VKeHQ4TTZMRW5TNnU1MStFQTVUNFVZY3VIZ3d6TElrYkhkeVk9IiwidG9rZW5fc2VydmljZV9vbmlvbiI6ImxpNTNxNmp1YWZ1NGF2cjdydHlsdG1zcTJ1anl5N3NjcnIzZnRua3JsaWNzeGV3Njd4cTY0c3lkIn0sIlNpZ25hdHVyZSI6IjIvTWw3T09HK2FYSFh2NTFkU2xJRHQxZjUxK1VUUmRTWnNFSHVxYlRqc3N4alZ5Qm1RUm1QU0xWSnZKUXBwS2cvZ1N0MzZrWVJKNXl1WWxEUDhzQ0NBPT0ifQ==||torv3eyJHcm91cElEIjoiOTQwYTc5OGI4MjY4YzI1Yjg0ZmMzYThlNWFhM2RiMzkiLCJHcm91cE5hbWUiOiJDd3RjaCBSZWxlYXNlIENhbmRpZGF0ZSBUZXN0ZXJzISIsIlNpZ25lZEdyb3VwSUQiOm51bGwsIlRpbWVzdGFtcCI6MCwiU2hhcmVkS2V5IjoiS3lmT2F6YzJuNUZyS1AzYzV5allheTZpVEN5TXhKQUhrT29YVWpSV3k4QT0iLCJTZXJ2ZXJIb3N0IjoiaXNicjJ0NmJmbHVsMnp5aTZoanRudWV6YjJ4dmZyNDJzdnpqZzJxM2d5cWZnZzN3bW5yYmtrcWQifQ==")) - cwtchbot.Peer.SendMessage(cid.ID, reply) - case "invite-me": - - //num := 1 - //if len(command) >= 2 { - // num, _ = strconv.Atoi(command[1]) - //} - // - //for i := 0; i < num; i++ { - // randIndex, _ := rand.Int(rand.Reader, big.NewInt(int64(len(blns.inputs)))) - // cwtchbot.Peer.SetGroupAttribute(group, "local.name", mutate(blns.inputs[randIndex.Uint64()])) - // group := cwtchbot.Peer.GetGroup(group) - // randIndex, _ = rand.Int(rand.Reader, big.NewInt(int64(len(blns.inputs)))) - // group.GroupID = mutate(blns.inputs[randIndex.Uint64()]) - // invite, _ := group.Invite() - // inviteMessage := cwtchbot.PackMessage(101, fmt.Sprintf("tofubundle:server:%s||%s", "eyJLZXlzIjp7ImJ1bGxldGluX2JvYXJkX29uaW9uIjoidXIzM2VkYnd2YmV2Y2xzNXVlNmpwa291YmRwdGdrZ2w1YmVkemZ5YXUyaWJmNTI3Nmx5cDR1aWQiLCJwcml2YWN5X3Bhc3NfcHVibGljX2tleSI6Iml2UnNSOUNpMGdqWHhjTk5LSVVqOTdwQU1rdndhV1Vta25WMnlOU3lWQ2c9IiwidG9rZW5fc2VydmljZV9vbmlvbiI6ImN4ang1c3Izb3AyaTZoanJqc2Z6amJ1ZWZoaXlxM3RlbDV1bHhuYmoyNnZ0dm9ycGhsZW1zbGlkIn0sIlNpZ25hdHVyZSI6IktDckxGZ3QxZU1KYnptOS9wUWZxY1F5a3lBVU5hV1FKQnlTRTdIdXc5N2NZTHlXYmR0SGxSVWx4VG1hK3JMMVcybTNQOTRrVEszclFnZi9XUjhiTkRRPT0ifQ==", invite)) - // //cwtchbot.Peer.SendMessageToPeer(message.Data[event.RemotePeer], string(cwtchbot.PackMessage(msg.Overlay, fmt.Sprintf("tofubundle:server:%s||torv3%s", "eyJLZXlzIjp7ImJ1bGxldGluX2JvYXJkX29uaW9uIjoidXIzM2VkYnd2YmV2Y2xzNXVlNmpwa291YmRwdGdrZ2w1YmVkemZ5YXUyaWJmNTI3Nmx5cDR1aWQiLCJwcml2YWN5X3Bhc3NfcHVibGljX2tleSI6Iml2UnNSOUNpMGdqWHhjTk5LSVVqOTdwQU1rdndhV1Vta25WMnlOU3lWQ2c9IiwidG9rZW5fc2VydmljZV9vbmlvbiI6ImN4ang1c3Izb3AyaTZoanJqc2Z6amJ1ZWZoaXlxM3RlbDV1bHhuYmoyNnZ0dm9ycGhsZW1zbGlkIn0sIlNpZ25hdHVyZSI6IktDckxGZ3QxZU1KYnptOS9wUWZxY1F5a3lBVU5hV1FKQnlTRTdIdXc5N2NZTHlXYmR0SGxSVWx4VG1hK3JMMVcybTNQOTRrVEszclFnZi9XUjhiTkRRPT0ifQ==", base64.StdEncoding.EncodeToString(invite))))) - // cwtchbot.Peer.SendMessage(cid, string(inviteMessage)) - //} - } - case event.PeerStateChange: - state := message.Data[event.ConnectionState] - if state == connections.ConnectionStateName[connections.AUTHENTICATED] { - log.Infof("Auto approving stranger %v", message.Data[event.RemotePeer]) - cwtchbot.Peer.NewContactConversation(message.Data[event.RemotePeer], model.DefaultP2PAccessControl(), true) - } - - default: - log.Infof("New Event: %v", message) - } - } -} - -// mutate is a very basic string mutator that simply garbles a random byte. We've got no success conditions -// to feed back to the mutator so we need to rely on a larger corpus, custom injection and simple mutations. -func mutate(input string) string { - if len(input) > 0 { - randByte, _ := rand.Int(rand.Reader, big.NewInt(int64(len(input)+1))) - randMask, _ := rand.Int(rand.Reader, big.NewInt(255)) - // zero indexed... - index := randByte.Uint64() - mutatedInput := input - if index < uint64(len(input)) { - mutatedInput = input[:index] - mutatedInput = string(append([]byte(mutatedInput), input[index]^uint8(randMask.Uint64()))) - if index+1 <= uint64(len(input)) { - mutatedInput = string(append([]byte(mutatedInput), input[index+1:]...)) - } - return mutatedInput - } - } - return input -} - -func randomString() string { - input := make([]byte, 64) - _, err := rand.Read(input) - if err != nil { - panic(err) - } - return string(input) -}