Added custom date, email, and URL flags

cmd/automate.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"strings"
+	"time"
 
 	"github.com/spf13/cobra"
 
@@ -14,6 +15,7 @@ import (
 var getAccessibleEndpoints bool
 var outputFormat string
 var responsePreviewLength int
+var testString string
 var verbose bool
 
 var automateCmd = &cobra.Command{
@@ -43,6 +45,12 @@ responds in an abnormal way, manual testing should be conducted (prepare manual
 			}
 		}
 
+		_, err := time.Parse("2006-01-02", customDate)
+		if err != nil {
+			fmt.Println("An invalid date was supplied. Please supply a date in '2006-01-02' format.")
+			os.Exit(1)
+		}
+
 		var bodyBytes []byte
 
 		client := CheckAndConfigureProxy()
@@ -74,6 +82,7 @@ responds in an abnormal way, manual testing should be conducted (prepare manual
 func init() {
 	automateCmd.PersistentFlags().StringVarP(&outputFormat, "output-format", "F", "console", "The output format. Only 'console' (default) and 'json' are supported at the moment.")
 	automateCmd.PersistentFlags().BoolVar(&getAccessibleEndpoints, "get-accessible-endpoints", false, "Only output the accessible endpoints (those that return a 200 status code).")
+	automateCmd.PersistentFlags().StringVar(&testString, "test-string", "bishopfox", "The string to use when testing endpoints with string values.")
 	automateCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, "enable verbose mode, which shows a preview of each response.")
 	automateCmd.PersistentFlags().IntVar(&responsePreviewLength, "response-preview-length", 50, "sets the response preview length when using verbose output.")
 

cmd/prepare.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -22,6 +23,12 @@ This enables you to test specific API functions for common vulnerabilities or mi
 			}
 		}
 
+		_, err := time.Parse("2006-01-02", customDate)
+		if err != nil {
+			fmt.Println("An invalid date was supplied. Please supply a date in '2006-01-02' format.")
+			os.Exit(1)
+		}
+
 		client := CheckAndConfigureProxy()
 
 		fmt.Printf("\n")

cmd/root.go

@@ -7,6 +7,9 @@ import (
 
 var apiTarget string
 var basePath string
+var customDate string
+var customEmail string
+var customURL string
 var format string
 var insecure bool
 var localFile string
@@ -49,7 +52,7 @@ $ sj convert -u https://petstore.swagger.io/v2/swagger.json -o openapi.json`,
 			log.Error("Command not specified. See the --help flag for usage.")
 		}
 	},
-	Version: "2.1.0",
+	Version: "2.3.0",
 }
 
 func Execute() {
@@ -64,6 +67,9 @@ func init() {
 	rootCmd.AddCommand(convertCmd)
 	rootCmd.PersistentFlags().StringVarP(&UserAgent, "agent", "A", "Swagger Jacker (github.com/BishopFox/sj)", "Set the User-Agent string.")
 	rootCmd.PersistentFlags().StringVarP(&basePath, "base-path", "b", "", "Set the API base path if not defined in the definition file (i.e. /V2/).")
+	rootCmd.PersistentFlags().StringVarP(&customURL, "custom-url", "c", "https://bishopfox.com", "Set a custom URL to test discovered URL parameters.")
+	rootCmd.PersistentFlags().StringVarP(&customDate, "custom-date", "d", "1990-01-01", "A custom date to test discovered date parameters.")
+	rootCmd.PersistentFlags().StringVar(&customEmail, "custom-email", "[email protected]", "A custom email address to test discovered email parameters.")
 	rootCmd.PersistentFlags().StringVarP(&format, "format", "f", "json", "Declare the format of the definition file (json/yaml/yml/js).")
 	rootCmd.PersistentFlags().StringArrayVarP(&Headers, "headers", "H", nil, "Add custom headers, separated by a colon (\"Name: Value\"). Multiple flags are accepted.")
 	rootCmd.PersistentFlags().BoolVarP(&insecure, "insecure", "i", false, "Ignores server certificate validation.")

cmd/utils.go

@@ -3,7 +3,6 @@ package cmd
 import (
 	"bytes"
 	"encoding/json"
-	"encoding/xml"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -22,107 +21,14 @@ var jsonVerboseResultArray []VerboseResult
 var specTitle string
 var specDescription string
 
-func PrintSpecInfo(spec map[string]interface{}) {
-	info, ok := spec["info"].(map[string]interface{})
-	if !ok || info == nil {
-		log.Info("No information defined in the documentation.")
-	} else {
-		title, ok := info["title"].(string)
-		if ok && title != "" {
-			if outputFormat == "json" {
-				specTitle = title
-			} else {
-				fmt.Printf("Title: %s\n", title)
-			}
-		}
-
-		description, ok := info["description"].(string)
-		if ok && description != "" {
-			if outputFormat == "json" {
-				specDescription = description
-			} else {
-				fmt.Printf("Description: %s\n", description)
-			}
-		}
-	}
-}
-
-func GenerateRequests(bodyBytes []byte, client http.Client) {
-	// Ingests the specification file
-	spec := SafelyUnmarshalSpec(bodyBytes)
-
-	// Checks defined security schemes and prompts for authentication
-	CheckSecuritySchemes(spec)
-
-	u, _ := url.Parse(swaggerURL)
-
-	// Gets the target server and base path from the specification file
-	if apiTarget == "" {
-		if v, ok := spec["swagger"].(string); ok && strings.HasPrefix(v, "2") {
-			// Swagger (v2)
-			host, _ := spec["host"].(string)
-			bp, _ := spec["basePath"].(string)
-			if bp == "/" {
-				basePath = ""
-			} else if bp != "" {
-				basePath = bp
-			}
-
-			if host != "" && strings.Contains(host, "://") {
-				apiTarget = host
-			} else {
-				if host != "" {
-					apiTarget = u.Scheme + "://" + host
-				}
-			}
-		} else if v, ok := spec["openapi"].(string); ok && strings.HasPrefix(v, "3") {
-			// OpenAPI (v3)
-			if servers, ok := spec["servers"].([]interface{}); ok && len(servers) > 0 {
-				if len(servers) > 1 {
-					if !quiet && (os.Args[1] != "endpoints") && apiTarget == "" {
-						log.Warn("Multiple servers detected in documentation. You can manually set a server to test with the -T flag.\nThe detected servers are as follows:")
-						for i := range servers {
-							if srv, ok := servers[i].(map[string]interface{}); ok {
-								if serverURL, ok := srv["url"].(string); ok {
-									if strings.Contains(serverURL, "://") {
-										fmt.Println(serverURL)
-									} else {
-										fmt.Println(apiTarget + serverURL)
-									}
-								}
-							}
-						}
-					}
-				} else {
-					if srv, ok := servers[0].(map[string]interface{}); ok {
-						if serverURL, ok := srv["url"].(string); ok {
-							if strings.Contains(serverURL, "://") {
-								apiTarget = serverURL
-							} else if serverURL == "/" {
-								basePath = ""
-							} else {
-								basePath = serverURL
-								apiTarget = u.Scheme + "://" + u.Host
-							}
-						}
-					}
-				}
-			}
-		}
-	}
-
-	// Use the original host at the target if no server found from specification.
-	if apiTarget == "" {
-		apiTarget = u.Scheme + "://" + u.Host
-	}
-
-	if os.Args[1] != "endpoints" {
-		// Prints Title/Description/Version values if they exist
-		PrintSpecInfo(spec)
-	}
-
-	// Reviews all defined API routes and builds requests as defined
-	BuildRequestsFromPaths(spec, client)
+type SchemaNode struct {
+	Type       string
+	Properties map[string]*SchemaNode
+	Items      *SchemaNode
+	Required   map[string]bool
+	Enum       []interface{}
+	Example    interface{}
+	Ref        string
 }
 
 func BuildRequestsFromPaths(spec map[string]interface{}, client http.Client) {
@@ -171,7 +77,7 @@ func BuildRequestsFromPaths(spec map[string]interface{}, client http.Client) {
 												pType = schema["type"].(string)
 												// Attempt to prevent version strings from being improperly supplied (i.e. v1)
 												if pType == "string" && pMap["name"] != "version" {
-													pValue = "bishopfox"
+													pValue = testString
 												} else {
 													pValue = "1"
 												}
@@ -202,7 +108,7 @@ func BuildRequestsFromPaths(spec map[string]interface{}, client http.Client) {
 																	} else if propertyType, ok := propertyName["type"].(string); ok {
 																		// Attempt to prevent version strings from being improperly supplied (i.e. v1)
 																		if propertyType == "string" && propertyName["name"] != "version" {
-																			pValue = "bishopfox"
+																			pValue = testString
 																		} else {
 																			pValue = "1"
 																		}
@@ -227,7 +133,7 @@ func BuildRequestsFromPaths(spec map[string]interface{}, client http.Client) {
 										} else if pType, ok := pMap["type"].(string); ok {
 											// Attempt to prevent version strings from being improperly supplied (i.e. v1)
 											if pType == "string" && pMap["name"] != "version" {
-												pValue = "bishopfox"
+												pValue = testString
 											} else {
 												pValue = "1"
 											}
@@ -271,94 +177,19 @@ func BuildRequestsFromPaths(spec map[string]interface{}, client http.Client) {
 
 									if ct, ok := contentTypes[cType].(map[string]interface{}); ok {
 										if schema, ok := ct["schema"].(map[string]interface{}); ok {
-											if ref, ok := schema["$ref"].(string); ok {
-												if components, ok := spec["components"].(map[string]interface{}); ok {
-													if schemas, ok := components["schemas"].(map[string]interface{}); ok {
-														schemaName := strings.TrimPrefix(ref, "#/components/schemas/")
-														if s, ok := schemas[schemaName].(map[string]interface{}); ok {
-															if properties, ok := s["properties"].(map[string]interface{}); ok {
+											expanded := ExpandSchema(spec, schema, map[string]bool{})
+											example := GenerateExample(expanded)
 
-																for propertyItem := range properties {
-																	var pValue string
-																	if propertyName, ok := properties[propertyItem].(map[string]interface{}); ok {
-																		if propertyType, ok := propertyName["type"].(string); ok {
-																			switch propertyType {
-																			case "string":
-																				// Attempt to prevent version strings from being improperly supplied (i.e. v1)
-																				if propertyName["name"] != "version" {
-																					pValue = "bishopfox"
-																				} else {
-																					pValue = "1"
-																				}
-																			case "int":
-																				pValue = "1"
-																			default:
-																				pValue = "1"
-																			}
-
-																			switch cType {
-																			case "application/json":
-																				if strings.Contains(curl, "-d") && strings.Contains(curl, "application/json") {
-																					bodyData = ""
-																					curl = strings.TrimSuffix(curl, "}'")
-																					if propertyType == "string" {
-																						bodyData += fmt.Sprintf(",\"%s\":\"%s\"}'", propertyItem, pValue)
-																					} else {
-																						bodyData += fmt.Sprintf(",\"%s\":%s}'", propertyItem, pValue)
-																					}
-																					curl += bodyData
-																				} else if !strings.Contains(curl, "Content-Type") {
-																					if propertyType == "string" {
-																						bodyData += fmt.Sprintf("{\"%s\":\"%s\"}", propertyItem, pValue)
-																					} else {
-																						bodyData += fmt.Sprintf("{\"%s\":%s}", propertyItem, pValue)
-																					}
-
-																					curl += fmt.Sprintf(" -H \"Content-Type: %s\" -d '%s'", contentType, bodyData)
-																				}
-																			case "application/xml", "text/xml":
-																				bodyData = ""
-																				type Element struct {
-																					XMLName xml.Name
-																					Content any `xml:",chardata"`
-																				}
-
-																				type Root struct {
-																					XMLName  xml.Name  `xml:"root"`
-																					Elements []Element `xml:",any"`
-																				}
-
-																				var elements []Element
-																				elements = append(elements, Element{
-																					XMLName: xml.Name{Local: propertyItem},
-																					Content: pValue,
-																				})
-
-																				root := Root{
-																					Elements: elements,
-																				}
-
-																				xmlData, err := xml.Marshal(root)
-																				if err != nil {
-																					log.Warn("Error marshalling XML data.")
-																				}
-
-																				if strings.Contains(curl, "-d") && strings.Contains(curl, "xml") {
-																					curl = strings.TrimSuffix(curl, "</root>'")
-																					bodyData = strings.TrimSuffix(bodyData, "</root>'")
-																					bodyData += strings.TrimPrefix(string(xmlData), "<root>")
-																					curl += bodyData + "'"
-																				} else if !strings.Contains(curl, "Content-Type") {
-																					bodyData = string(xmlData)
-																					curl += fmt.Sprintf(" -H \"Content-Type: %s\" -d '%s'", contentType, bodyData)
-																				}
-																			}
-																		}
-																	}
-																}
-															}
-														}
-													}
+											if cType == "application/json" {
+												bodyBytes, err := json.Marshal(example)
+												if err == nil {
+													curl += fmt.Sprintf(" -H \"Content-Type: application/json\" -d '%s'\"", bodyBytes)
+												}
+											}
+											if cType == "application/xml" || cType == "text/xml" {
+												if obj, ok := example.(map[string]interface{}); ok {
+													xml := XmlFromObject(obj)
+													curl += fmt.Sprintf(" -H \"Content-Type: %s\" -d '%s'", cType, xml)
 												}
 											}
 										}
@@ -458,6 +289,236 @@ func BuildRequestsFromPaths(spec map[string]interface{}, client http.Client) {
 	}
 }
 
+func EnforceSingleContentType(newContentType string) {
+	newContentType = strings.TrimSpace(newContentType)
+
+	// Remove old 'Content-Type' header
+	Headers = slices.DeleteFunc(Headers, func(h string) bool {
+		return strings.HasPrefix(strings.ToLower(h), "content-type:")
+	})
+
+	Headers = append(Headers, "Content-Type: "+newContentType)
+
+	// Remove empty elements to avoid repetitions of "-H ''"
+	Headers = slices.DeleteFunc(Headers, func(h string) bool {
+		return strings.TrimSpace(h) == ""
+	})
+}
+
+func ExpandSchema(
+	spec map[string]interface{},
+	schema map[string]interface{},
+	visited map[string]bool,
+) *SchemaNode {
+	if schema == nil {
+		return &SchemaNode{Type: "object"}
+	}
+
+	if ref, ok := schema["$ref"].(string); ok {
+		if visited[ref] {
+			return &SchemaNode{Type: "object"} // break cycle
+		}
+		visited[ref] = true
+
+		resolved := ResolveRef(spec, ref)
+		if resolved == nil {
+			return &SchemaNode{Type: "object"}
+		}
+		return ExpandSchema(spec, resolved, visited)
+	}
+
+	node := &SchemaNode{
+		Properties: map[string]*SchemaNode{},
+		Required:   map[string]bool{},
+	}
+
+	if t, ok := schema["type"].(string); ok {
+		node.Type = t
+	}
+
+	if props, ok := schema["properties"].(map[string]interface{}); ok {
+		for name, raw := range props {
+			if m, ok := raw.(map[string]interface{}); ok {
+				node.Properties[name] = ExpandSchema(spec, m, visited)
+			}
+		}
+	}
+
+	if items, ok := schema["items"].(map[string]interface{}); ok {
+		node.Items = ExpandSchema(spec, items, visited)
+	}
+
+	if allOf, ok := schema["allOf"].([]interface{}); ok {
+		merged := &SchemaNode{Type: "object", Properties: map[string]*SchemaNode{}}
+		for _, entry := range allOf {
+			if m, ok := entry.(map[string]interface{}); ok {
+				sub := ExpandSchema(spec, m, visited)
+				for k, v := range sub.Properties {
+					merged.Properties[k] = v
+				}
+			}
+		}
+		return merged
+	}
+
+	return node
+}
+
+func GenerateExample(node *SchemaNode) interface{} {
+	switch node.Type {
+	case "object", "":
+		obj := map[string]interface{}{}
+		for k, v := range node.Properties {
+			if strings.Contains(strings.ToLower(k), "date") {
+				obj[k] = customDate
+			} else if strings.Contains(strings.ToLower(k), "url") {
+				obj[k] = customURL
+			} else if strings.Contains(strings.ToLower(k), "email") {
+				obj[k] = customEmail
+			} else {
+				obj[k] = GenerateExample(v)
+			}
+		}
+		return obj
+	case "array":
+		if node.Items != nil {
+			return []interface{}{GenerateExample(node.Items)}
+		}
+		return []interface{}{}
+	case "string":
+		return testString
+	case "integer", "number":
+		return 1
+	case "boolean":
+		return true
+	default:
+		return nil
+	}
+}
+
+func GenerateRequests(bodyBytes []byte, client http.Client) {
+	// Ingests the specification file
+	spec := SafelyUnmarshalSpec(bodyBytes)
+
+	// Checks defined security schemes and prompts for authentication
+	CheckSecuritySchemes(spec)
+
+	u, _ := url.Parse(swaggerURL)
+
+	// Gets the target server and base path from the specification file
+	if apiTarget == "" {
+		if v, ok := spec["swagger"].(string); ok && strings.HasPrefix(v, "2") {
+			// Swagger (v2)
+			host, _ := spec["host"].(string)
+			bp, _ := spec["basePath"].(string)
+			if bp == "/" {
+				basePath = ""
+			} else if bp != "" {
+				basePath = bp
+			}
+
+			if host != "" && strings.Contains(host, "://") {
+				apiTarget = host
+			} else {
+				if host != "" {
+					apiTarget = u.Scheme + "://" + host
+				}
+			}
+		} else if v, ok := spec["openapi"].(string); ok && strings.HasPrefix(v, "3") {
+			// OpenAPI (v3)
+			if servers, ok := spec["servers"].([]interface{}); ok && len(servers) > 0 {
+				if len(servers) > 1 {
+					if !quiet && (os.Args[1] != "endpoints") && apiTarget == "" {
+						log.Warn("Multiple servers detected in documentation. You can manually set a server to test with the -T flag.\nThe detected servers are as follows:")
+						for i := range servers {
+							if srv, ok := servers[i].(map[string]interface{}); ok {
+								if serverURL, ok := srv["url"].(string); ok {
+									if strings.Contains(serverURL, "://") {
+										fmt.Println(serverURL)
+									} else {
+										fmt.Println(apiTarget + serverURL)
+									}
+								}
+							}
+						}
+					}
+				} else {
+					if srv, ok := servers[0].(map[string]interface{}); ok {
+						if serverURL, ok := srv["url"].(string); ok {
+							if strings.Contains(serverURL, "://") {
+								apiTarget = serverURL
+							} else if serverURL == "/" {
+								basePath = ""
+							} else {
+								basePath = serverURL
+								apiTarget = u.Scheme + "://" + u.Host
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+
+	// Use the original host at the target if no server found from specification.
+	if apiTarget == "" {
+		apiTarget = u.Scheme + "://" + u.Host
+	}
+
+	if os.Args[1] != "endpoints" {
+		// Prints Title/Description/Version values if they exist
+		PrintSpecInfo(spec)
+	}
+
+	// Reviews all defined API routes and builds requests as defined
+	BuildRequestsFromPaths(spec, client)
+}
+
+func ResolveRef(spec map[string]interface{}, ref string) map[string]interface{} {
+	if !strings.HasPrefix(ref, "#") {
+		return nil
+	}
+
+	parts := strings.Split(ref[2:], "/")
+	var cur interface{} = spec
+
+	for _, p := range parts {
+		m, ok := cur.(map[string]interface{})
+		if !ok {
+			return nil
+		}
+		cur = m[p]
+	}
+
+	resolved, _ := cur.(map[string]interface{})
+	return resolved
+}
+
+func PrintSpecInfo(spec map[string]interface{}) {
+	info, ok := spec["info"].(map[string]interface{})
+	if !ok || info == nil {
+		log.Info("No information defined in the documentation.")
+	} else {
+		title, ok := info["title"].(string)
+		if ok && title != "" {
+			if outputFormat == "json" {
+				specTitle = title
+			} else {
+				fmt.Printf("Title: %s\n", title)
+			}
+		}
+
+		description, ok := info["description"].(string)
+		if ok && description != "" {
+			if outputFormat == "json" {
+				specDescription = description
+			} else {
+				fmt.Printf("Description: %s\n", description)
+			}
+		}
+	}
+}
+
 func SetScheme(swaggerURL string) (scheme string) {
 	if strings.HasPrefix(swaggerURL, "http://") {
 		scheme = "http"
@@ -469,6 +530,17 @@ func SetScheme(swaggerURL string) (scheme string) {
 	return scheme
 }
 
+func SafelyUnmarshalSpec(data []byte) map[string]interface{} {
+
+	var doc map[string]interface{}
+	if err := yaml.Unmarshal(data, &doc); err != nil {
+		fmt.Printf("Failed to unmarshal API documentation: %v\n", err)
+		os.Exit(1)
+	}
+
+	return doc
+}
+
 /*
 TrimHostScheme trims the scheme from the provided URL if the '-T' flag is supplied to sj.
 */
@@ -487,29 +559,29 @@ func TrimHostScheme(apiTarget, fullUrlHost string) (host string) {
 	return host
 }
 
-func SafelyUnmarshalSpec(data []byte) map[string]interface{} {
+func XmlFromObject(obj map[string]interface{}) string {
+	var b strings.Builder
 
-	var doc map[string]interface{}
-	if err := yaml.Unmarshal(data, &doc); err != nil {
-		fmt.Printf("Failed to unmarshal API documentation: %v\n", err)
-		os.Exit(1)
+	for k, v := range obj {
+		switch val := v.(type) {
+		case map[string]interface{}:
+			b.WriteString("<" + k + ">")
+			b.WriteString(XmlFromObject(val))
+			b.WriteString("</" + k + ">")
+		case []interface{}:
+			for _, item := range val {
+				b.WriteString("<" + k + ">")
+				if m, ok := item.(map[string]interface{}); ok {
+					b.WriteString(XmlFromObject(m))
+				} else {
+					b.WriteString(XmlFromObject(m))
+				}
+				b.WriteString("</" + k + ">")
+			}
+		default:
+			b.WriteString(fmt.Sprintf("<%s>%v</%s>", k, val, k))
+		}
 	}
 
-	return doc
-}
-
-func EnforceSingleContentType(newContentType string) {
-	newContentType = strings.TrimSpace(newContentType)
-
-	// Remove old 'Content-Type' header
-	Headers = slices.DeleteFunc(Headers, func(h string) bool {
-		return strings.HasPrefix(strings.ToLower(h), "content-type:")
-	})
-
-	Headers = append(Headers, "Content-Type: "+newContentType)
-
-	// Remove empty elements to avoid repetitions of "-H ''"
-	Headers = slices.DeleteFunc(Headers, func(h string) bool {
-		return strings.TrimSpace(h) == ""
-	})
+	return b.String()
 }