fuzzer.cpp

#include <ctime>
#include <fstream>
#include <iostream>
#include <sstream>
#include <cstring>
using namespace std;
#include <curl/curl.h>
#include <vector>
#include <regex>

// TODO List
// ajouter le logging dans le fichier
// ajouter dans la lecture d'option:
//   -r <depth> (niveau de rec)
//   -v <level> (niveau de verbosité)
//   <option> <fichier> (pour exécuter des programmes sur les pages lues)

enum logLevel
{
    SILENT,   // no log whatsoever
    ERROR,    // log errors only
    WARNING,  // log warnings too
    INFO,     // log basic infos
    ADVANCED, // log everything
    DEBUG
};

class Logger
{
public:
    // Constructor
    Logger(const string &filename)
    {
        logFile.open(filename, ios::app);
        if (!logFile.is_open())
        {
            cerr << "Error opening the log file." << endl;
        }
    }

    // Destructor: Closes the log file
    ~Logger() { logFile.close(); }

    // creates a log entry
    void log(logLevel logLevel, const string &message)
    {
        // Get current timestamp
        time_t now = time(0);
        tm *timeinfo = localtime(&now);
        char timestamp[20];
        strftime(timestamp, sizeof(timestamp), "%Y-%m-%d %H:%M:%S", timeinfo);

        // create log entry
        ostringstream logEntry;
        logEntry << "[" << timestamp << "]"
                 << levelToString(logLevel) << ":" << message
                 << endl;

        // Output dans la console
        cout << logEntry.str();

        // output dans le fichier de log
        if (logFile.is_open())
        {
            logFile << logEntry.str();
            logFile.flush(); // Writes immediatly
        }
    }

private:
    ofstream logFile;

    // converts log level to a string
    string levelToString(logLevel level)
    {
        switch (level)
        {
        case SILENT:
            return "SILENT";
        case ERROR:
            return "ERROR";
        case WARNING:
            return "WARNING";
        case INFO:
            return "INFO";
        case ADVANCED:
            return "ADVANCED";
        case DEBUG:
            return "DEBUG";
        default:
            return "UNKNOWN";
        }
    }
};

class Parameters
{
public:
    bool dirs;
    bool subs;
    bool output;
    bool help;
    bool error;
    char *link;
    int depth; // recursion depths
    string forceContinue;
    vector<int> range;
    logLevel level;
    ifstream wordlistSubs;
    ifstream wordlistDirs;
    ofstream logFile;

    Parameters()
    {
        this->dirs = false;
        this->subs = false;
        this->output = false;
        this->help = false;
        this->error = false;
        this->level = INFO;
        this->link = NULL;
        this->depth = 3;
        this->forceContinue = "NULL";
        this->range = vector<int>();
    }
};

void printHelp(char *functionName)
{
    cout << endl
         << "usage: fuzzer [options] <uri>" << endl;
    cout << endl
         << "Options:" << endl;
    cout << "   -d [wordlist] | --directories [wordlist] : Searches for directories on the specified url. If wordlist is not included, it takes /usr/share/wordlists/dirb/big.txt as default file" << endl;
    cout << "   -s [wordlist] | --subdomains [wordlist] : Searches for subdomains of the specified url. For this option, it is recommended to not specify a folder in the url. Default file is /usr/share/wordlists/subs/medium.txt" << endl;
    cout << "   -h | --help : displays this text" << endl;
    cout << "   -v | --verbose : set verbose level to DEBUG" << endl;
    cout << "   -o <file> | --output <file> : set <file> as the file for storing the output" << endl;
    cout << "   -r <range> | --range: specify the <range> allowed for http responses. It is possible to specify either single response codes or ranges for response codes." << "\n"
         << "           example: -r 200-299,300,301 will log every request made which return code is either between 200 and 299 or is 300 or 301. Be careful to NOT add any space between commas. Default is 200-299" << endl;
    cout << "   if options are all in one flag (i.e. -sdo for example), the parameters for the names of the input and output files are gonna be taken in order (i.e. -sdo <subs file> <dirs file> <output file> for example)" << "\n"
         << "           Note that long options cannot be stacked. For example, -sdirectories or --sdirectories doesn't work" << endl;
}

void printError(char *functionName)
{
    cout << "Error while executing, check the parameters used. Check the link from the arguments" << endl;
    printHelp(functionName);
}

int strToInt(string code)
{
    int responseCode = 0;
    int i = 0;
    while (code[i] != '\0')
    {
        responseCode = responseCode * 10 + (code[i] - '0');
        i++;
    }
    return responseCode;
}

void printRange(vector<int> range)
{
    for (int i = 0; i < range.size() / 2; i++)
    {
        cout << " " << range[2 * i] << "-" << range[2 * i + 1] << ";";
    }
}

void printStringVector(vector<string> v)
{
    for (string s : v)
    {
        cout << s.data() << ", ";
    }
}

int searchParameters(int argc, char *argv[], Parameters *pm, int i, char *option)
{
    // returns the number of arguments we skip, intended for treating the input and output files
    if (option == NULL)
    {
        option = argv[i];
#include <regex>
    }

    if (strcmp(option, "-d") == 0 || strcmp(option, "--directories") == 0)
    {
        pm->dirs = true;
        if ((i + 1 < argc - 1) && (argv[i + 1][0] != '-'))
        { // searching for a file
            pm->wordlistDirs.open(argv[i + 1]);
            if (!pm->wordlistDirs.is_open())
            {
                pm->error = true;
                if (pm->level > 0)
                {
                    // log level error or more
                    cout << "Errror, couldn't open the wordlist for directory fuzzing" << endl;
                }
            }
            else
            {
                if (pm->level > 4)
                {
                    // level for advanced logs or more
                    cout << "reading the dirb file " << argv[i + 1] << endl;
                }
            }
            return 1;
        }
        else
        { // if no file has been found
            if (pm->level > 1)
            {
                // level for warnings or more
                cout << "No file has been found for the directories search, opening /usr/share/wordlists/dirb/big.txt" << endl;
            }
            pm->wordlistDirs.open("/usr/share/wordlists/dirb/big.txt");
            if (!pm->wordlistDirs.is_open())
            {
                pm->error = true;
                if (pm->level > 0)
                {
                    cout << "Errror, couldn't open the wordlist for directory fuzzing" << endl;
                }
            }
            else
            {
                if (pm->level > 4)
                {
                    cout << "reading the dirb file /usr/share/wordlists/dirb/big.txt" << endl;
                }
            }
        }
        return 0;
    }
    else if (strcmp(option, "-s") == 0 || strcmp(option, "--subdomains") == 0)
    {
        pm->subs = true;
        if ((i + 1 < argc - 1) && (argv[i + 1][0] != '-'))
        {
            pm->wordlistSubs.open(argv[i + 1]);
            if (!pm->wordlistSubs.is_open())
            {
                pm->error = true;
                if (pm->level > 0)
                {
                    cout << "Errror, couldn't open the wordlist for sub-domains fuzzing" << endl;
                }
            }
            else
            {
                if (pm->level > 4)
                {
                    cout << "reading the subs file " << argv[i + 1] << endl;
                }
            }
            return 1;
        }
        else
        {
            if (pm->level > 1)
            {
                cout << "No file has been found for the subdomains search, opening /usr/share/wordlists/subs/medium.txt" << endl;
            }
            pm->wordlistDirs.open("/usr/share/wordlists/subs/medium.txt");
            if (!pm->wordlistSubs.is_open())
            {
                pm->error = true;
                if (pm->level > 0)
                {
                    cout << "Errror, couldn't open the wordlist for sub-domains fuzzing" << endl;
                }
            }
            else
            {
                if (pm->level > 4)
                {
                    cout << "reading the subs file /usr/share/wordlists/subs/medium.txt" << endl;
                }
            }
        }
        return 0;
    }
    else if (strcmp(option, "-h") == 0 || strcmp(option, "--help") == 0)
    {
        pm->help = true; // 0 indicates the help indications must be printed
        return 0;
    }
    else if (strcmp(option, "-v") == 0 || strcmp(option, "--verbose") == 0)
    {
        pm->level = ADVANCED;
        return 0;
    }
    else if (strcmp(option, "-o") == 0 || strcmp(option, "--output") == 0)
    {
        pm->output = true;
        if (i + 1 >= argc - 1)
        {
            pm->error = true;
            if (pm->level > 0)
            {
                cout << "Error, not enough arguments, file probably is missing" << endl;
            }
            return 0;
        }
        pm->logFile.open(argv[i + 1]);
        if (!pm->logFile.is_open())
        {
            pm->error = true;
            if (pm->level > 0)
            {
                cout << "There was a problem when opening the file, please check if the parameter is correct" << endl;
            }
        }
        else
        {
            if (pm->level > 4)
            {
                cout << "writing the output file " << argv[i + 1] << endl;
            }
        }
        // i++;
        return 1;
    }
    else if (strcmp(option, "-r") == 0 || strcmp(option, "--range") == 0)
    {
        if (i + 1 < argc - 1)
        {
            // fetching the range argument
            string range, rangeInput = argv[i + 1];
            stringstream rangeStream(rangeInput);
            while (getline(rangeStream, range, ','))
            {
                // iterating through each range, all seperated by ','.
                string it, itInput = range;
                stringstream itStream(itInput);
                if (getline(itStream, it, '-'))
                {
                    // separating the 2 values from the range "200-299"
                    int n1 = strToInt(it);
                    pm->range.push_back(n1);
                    if (getline(itStream, it, '-'))
                    {
                        // if it was a range indicated, then add the second number (we will now have 200 and 299 in the range)
                        int n2 = strToInt(it);
                        pm->range.push_back(n2);
                    }
                    else
                    {
                        // if it was a unique value, we had the same value (the range will contain 200 and 200)
                        pm->range.push_back(n1);
                    }
                }
                else
                {
                    if (pm->level > 0)
                    {
                        cout << "Error while trying to read ranges" << endl;
                    }
                    pm->error = true;
                    return 0;
                }
                // adds to range
            }

            return 1;
        }
        else
        {
            if (pm->level > 0)
            {
                cout << "Error encountered, it seems that no range has been provided" << endl;
            }
            pm->error = true;
            return 0;
        }
    }
    else
    {
        // If options are stacked in one string, we check them one by one, that's why we need a recursive searchParameters function
        int index = 1;
        int shift = 0;
        while ((option[index] != '\0') && (option[index] == 'd' || option[index] == 's' || option[index] == 'h' || option[index] == 'v' || option[index] == 'o'))
        {
            char *param = (char *)malloc(3 * sizeof(char));
            param[0] = '-';
            param[1] = option[index];
            param[2] = '\0';
            // create a new option for each letter in this group of options and go through with it. We need recursion for that
            shift = searchParameters(argc, argv, pm, i, param);
            i += shift;
            index++;
        }
        return shift;
    }
}

#include <regex>
void loopParameters(int argc, char *argv[], Parameters *pm)
{
    // go through parameters
    for (int i = 1; i < argc - 1; i++)
    {
        // we only go to argc - 1 as the last argument is supposed to be the link
        i += searchParameters(argc, argv, pm, i, NULL);
    }
}

char *parseLink(char *lastArg, Parameters *pm)
{
    return lastArg;
}

size_t noWriteCallback(char *contents, size_t size, size_t nmemb, void *userp)
{
    // dummy function for no body output
    return size * nmemb;
}

bool isInRange(int code, Parameters *pm)
{
    bool res = false;
    for (int i = 0; i < pm->range.size() / 2; i++)
    {
        res = res || ((pm->range[2 * i] <= code) && (pm->range[2 * i + 1] >= code));
    }
    return res;
}

vector<string> makeSubsRequests(Parameters *pm, string url)
{
    vector<string> res = vector<string>();

    // Logging curl
    string readBuffer;
    CURL *easyhandle;
    CURLcode reqRes;
    easyhandle = curl_easy_init();
    CURLcode responseCode;

    if (pm->level > 3)
    {
        curl_easy_setopt(easyhandle, CURLOPT_VERBOSE, 1L);
    }
    else
    {
        curl_easy_setopt(easyhandle, CURLOPT_VERBOSE, 0L);
    }

    if (easyhandle)
    {
        // checking if base website is available
        curl_easy_setopt(easyhandle, CURLOPT_URL, url.data());
        curl_easy_setopt(easyhandle, CURLOPT_WRITEFUNCTION, noWriteCallback);
        curl_easy_setopt(easyhandle, CURLOPT_WRITEDATA, &readBuffer);
        reqRes = curl_easy_perform(easyhandle);
        curl_easy_getinfo(easyhandle, CURLINFO_RESPONSE_CODE, &responseCode);
        curl_easy_cleanup(easyhandle);

        // if (!isInRange(responseCode, pm))
        if (pm->level > 4)
        {
            cout << "response code for subs finding on " << url << " is " << responseCode << endl;
        }
        if (!((responseCode >= 200) && (responseCode <= 299)))
        {
            // if (pm->forceContinue == "NULL")
            // {
            //     pm->forceContinue = "No";
            //     // char *forceContinue = NULL;
            //     cout << "Error : site does not seem to be accessible. Do you wish to continue? [y/N] - ";
            //     getline(cin, pm->forceContinue);
            // }
            // if ((pm->forceContinue == "Y") || (pm->forceContinue == "y") || (pm->forceContinue == "yes") || (pm->forceContinue == "Yes") || (pm->forceContinue == "YES"))
            // {
            //     // nothing to do, we continue
            // }
            // else
            // {
            if (pm->level > 3)
            {
                cout << "Error : site " << url.data() << " does not seem to be accessible, terminating" << endl;
            }
            pm->error = true;
            return res;
            // }
        }
        else
        {
            cout << "Successful subdomain request on url " << url.data() << endl;
        }
        res.push_back(url);
        return res;
    }

    // going through pathnames and testing the website for those
    if (pm->level > 4)
    {
        cout << "Testing for Subdomains" << endl;
    }

    string sub = "";
    char *fullUrl = url.data();
    regex motif(R"((https?)://([^ ]+))"); // Match http:// followed by the domain

    while (getline(pm->wordlistSubs, sub))
    {

        // Use a lambda as the format function
        string r = regex_replace(fullUrl, motif, "$1://" + sub + ".$2");
        char *replaced = r.data();
        if (pm->level > 4)
        {
            cout << "Testing subdomain " << replaced << endl;
        }

        easyhandle = curl_easy_init();
        if (easyhandle)
        {
            curl_easy_setopt(easyhandle, CURLOPT_URL, replaced);
            curl_easy_setopt(easyhandle, CURLOPT_WRITEFUNCTION, noWriteCallback);
            curl_easy_setopt(easyhandle, CURLOPT_WRITEDATA, &readBuffer);

            if (pm->output == true)
            {
                curl_easy_setopt(easyhandle, CURLOPT_WRITEDATA, &pm->logFile);
            }

            reqRes = curl_easy_perform(easyhandle);

            long responseCode = 0;
            curl_easy_getinfo(easyhandle, CURLINFO_RESPONSE_CODE, &responseCode);
            if (pm->level > 5)
            {
                cout << "Sub request response code: " << responseCode << endl;
            }

            if (isInRange(responseCode, pm))
            {
                if (pm->level > 5)
                {
                    cout << "pushing sub " << replaced << " to urls to test " << endl;
                }
                res.push_back(replaced);
            }
        }
        curl_easy_cleanup(easyhandle);
    }

    // cleaning the directory
    curl_global_cleanup();

    return res;
}

vector<string> makeDirsRequests(Parameters *pm, string url)
{
    vector<string> res = vector<string>();

    // Logging curl
    string readBuffer;
    CURL *easyhandle;
    CURLcode reqRes;
    easyhandle = curl_easy_init();
    CURLcode responseCode;

    if (pm->level > 4)
    {
        curl_easy_setopt(easyhandle, CURLOPT_VERBOSE, 1L);
    }
    else
    {
        curl_easy_setopt(easyhandle, CURLOPT_VERBOSE, 0L);
    }

    if (easyhandle)
    {
        // checking if base website is available
        curl_easy_setopt(easyhandle, CURLOPT_URL, url.data());
        curl_easy_setopt(easyhandle, CURLOPT_WRITEFUNCTION, noWriteCallback);
        curl_easy_setopt(easyhandle, CURLOPT_WRITEDATA, &readBuffer);
        reqRes = curl_easy_perform(easyhandle);
        curl_easy_getinfo(easyhandle, CURLINFO_RESPONSE_CODE, &responseCode);
        curl_easy_cleanup(easyhandle);

        if (pm->level > 5)
        {
            cout << "main site " << url << " returned the code " << responseCode << endl;
        }

        // if (!isInRange(responseCode, pm))
        if (!((responseCode >= 200) && (responseCode <= 299)))
        {
            // if (pm->forceContinue == "NULL")
            // {
            //     pm->forceContinue = "No";
            //     // char *forceContinue = NULL;
            //     cout << "Error : site does not seem to be accessible. Do you wish to continue? [y/N]" << endl;
            //     getline(cin, pm->forceContinue);
            // }
            // if ((pm->forceContinue == "Y") || (pm->forceContinue == "y") || (pm->forceContinue == "yes") || (pm->forceContinue == "Yes") || (pm->forceContinue == "YES"))
            // {
            //     // nothing to do, we continue
            // }
            // else
            // {
            if (pm->level > 4)
            {
                cout << "Error : site " << url.data() << " does not seem to be accessible, terminating" << endl;
            }
            //     pm->error = true;
            //     return res;
            // }
        }
        else
        {
            if (pm->level > 4)
            {
                cout << "Successful directory request on url " << url.data() << endl;
            }
        }
    }

    // going through pathnames and testing the website for those
    if (pm->level > 5)
    {
        cout << "Testing for directories" << endl;
    }
    string path;
    while (getline(pm->wordlistDirs, path))
    {
        path = "/" + path;
        string full = url + path;
        char *fullUrl = full.data();
        if (pm->level > 5)
        {
            cout << "testing url : " << fullUrl << endl;
        }

        easyhandle = curl_easy_init();
        if (easyhandle)
        {

            curl_easy_setopt(easyhandle, CURLOPT_URL, fullUrl);
            curl_easy_setopt(easyhandle, CURLOPT_WRITEFUNCTION, noWriteCallback);
            curl_easy_setopt(easyhandle, CURLOPT_WRITEDATA, &readBuffer);

            if (pm->output == true)
            {
                curl_easy_setopt(easyhandle, CURLOPT_WRITEDATA, &pm->logFile);
            }

            curl_easy_perform(easyhandle);

            long response_code = 0;
            curl_easy_getinfo(easyhandle, CURLINFO_RESPONSE_CODE, &response_code);
            if (pm->level > 5)
            {
                cout << "Response code: " << response_code << endl;
            }

            if (isInRange(responseCode, pm))
            {
                if (pm->level > 5)
                {
                    cout << "appending path " << fullUrl << " to urls to test" << endl;
                }
                res.push_back(fullUrl);
            }
        }

        curl_easy_cleanup(easyhandle);
    }

    // cleaning the directory
    curl_easy_cleanup(easyhandle);
    curl_global_cleanup();

    return res;
}

void recursiveRequests(int depth, Parameters *pm, string url)
{
    if (depth == 0)
    {
        // si on arrive à la fin de la boucle
        return;
    }

    // sinon on continue notre recherche
    if (pm->dirs)
    {
        vector<string> res = makeDirsRequests(pm, url);
        // on passe par tous les chemins trouvés par
        while (!res.empty())
        {
            string popped = res.back();
            char *poppedUrl = popped.data();
            res.pop_back();
            recursiveRequests(depth - 1, pm, poppedUrl);
        }
    }
}

void startOnSubs(Parameters *pm)
{
    // on chercher les subdomains si demandé
    vector<string> res;
    if (pm->subs)
    {
        res = makeSubsRequests(pm, pm->link);
    }
    // sinon on ne garde que le lien de départ
    else
    {
        res = vector<string>();
        res.push_back(pm->link);
    }

    if (pm->level > 5)
    {
        cout << "Subdomains to test for paths: ";
        printStringVector(res);
        cout << endl;
    }
    // on fait la recherche de paths si demandé
    if (pm->dirs)
    {
        // on itère à travers les subs trouvés
        for (string url : res)
        {
            // on lance la recherche de paths récursive
            recursiveRequests(pm->depth, pm, url);
        }
    }
}

int main(int argc, char *argv[])
{
    if (argc == 1)
    {
        cout << "Fetching for a new option" << endl;
        printError(argv[0]);
        return 0;
    }

    // go through parameters
    Parameters p = Parameters();
    Parameters *pm = &p;
    pm->range.push_back(200);
    pm->range.push_back(299); // default success code is 200-299
    pm->forceContinue = "NULL";
    pm->depth = 3;
    loopParameters(argc, argv, pm);
    // parseArguments(argc, argv, pm);

    pm->link = parseLink(argv[argc - 1], pm); // parse the link obtained
    if (pm->level > 1)
    {
        cout << "Code is being executed on the link '" << pm->link << "'" << endl;
    }

    // error or help handling
    if (pm->error == true)
    {
        printError(argv[0]);
        return 0;
    }
    else if (pm->help == true)
    {
        printHelp(argv[0]);
        return 0;
    }

    if (pm->level > 5)
    {
        cout << "response code ranges for logged responses are";
        printRange(pm->range);
        cout << endl;
    }

    // Main function
    startOnSubs(pm);

    return 0;
}