130 lines
5.4 KiB
Bash
Executable File
130 lines
5.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# test.sh - curl tests for all badtests.py endpoints
|
|
# Usage: ./test.sh [host:port]
|
|
# Output is capped at 8KB per endpoint to prevent multi-GB files
|
|
|
|
HOST="${1:-localhost:60666}"
|
|
SEP="--------------------------------------------"
|
|
MAX_OUTPUT=8192 # max bytes of curl output to capture per endpoint
|
|
|
|
test_endpoint() {
|
|
local path="$1"
|
|
local title="$2"
|
|
local extra_flags="$3"
|
|
echo "$SEP"
|
|
echo "ENDPOINT: $path"
|
|
echo "TITLE: $title"
|
|
echo ""
|
|
local cmd="curl -sv --max-time 5 ${extra_flags} http://${HOST}${path}"
|
|
echo "COMMAND: $cmd"
|
|
echo ""
|
|
eval "$cmd" 2>&1 | head -c "$MAX_OUTPUT"
|
|
echo ""
|
|
echo ""
|
|
}
|
|
|
|
# --- Content-Length Abuses ---
|
|
test_endpoint "/cl-word" "Content-Length: banana"
|
|
test_endpoint "/cl-empty" "Content-Length: (empty)"
|
|
test_endpoint "/cl-negative" "Content-Length: -99999999999999999"
|
|
test_endpoint "/cl-huge" "Content-Length: 99999999999999999" "--max-time 2"
|
|
test_endpoint "/cl-zero" "Content-Length: 0 (body sent)"
|
|
test_endpoint "/cl-float" "Content-Length: 3.14159"
|
|
test_endpoint "/cl-hex" "Content-Length: 0xDEAD"
|
|
test_endpoint "/cl-null" "Content-Length: 5\\x00"
|
|
test_endpoint "/cl-negative-one" "Content-Length: -1"
|
|
test_endpoint "/cl-nan" "Content-Length: NaN"
|
|
test_endpoint "/cl-inf" "Content-Length: Infinity"
|
|
test_endpoint "/cl-mismatch" "Content-Length: 1 (body is 30 bytes)"
|
|
|
|
# --- Content-Type Abuses ---
|
|
test_endpoint "/ct-garbage" "Content-Type: 200 random chars"
|
|
test_endpoint "/ct-multi" "Content-Type: 5 MIME types"
|
|
test_endpoint "/ct-empty" "Content-Type: (empty)"
|
|
test_endpoint "/ct-null" "Content-Type: text/\\x00html"
|
|
test_endpoint "/ct-emoji" "Content-Type: emoji"
|
|
test_endpoint "/ct-mega" "Content-Type: 10KB long"
|
|
test_endpoint "/ct-crlf" "Content-Type with CRLF injection"
|
|
test_endpoint "/ct-semicolon" "Content-Type with 50 charset params"
|
|
|
|
# --- Status Code Abuses ---
|
|
test_endpoint "/status-neg" "Status: -1"
|
|
test_endpoint "/status-zero" "Status: 0"
|
|
test_endpoint "/status-999" "Status: 999"
|
|
test_endpoint "/status-huge" "Status: 99999"
|
|
test_endpoint "/status-word" "Status: BANANA"
|
|
|
|
# --- Header Abuses ---
|
|
test_endpoint "/hdr-mega-name" "Header name: 64KB of As"
|
|
test_endpoint "/hdr-mega-val" "Header value: 1MB of Bs"
|
|
test_endpoint "/hdr-1000" "1000 headers"
|
|
test_endpoint "/hdr-empty-name" "Header: : empty_name"
|
|
test_endpoint "/hdr-no-colon" "Header without colon"
|
|
test_endpoint "/hdr-dup-cl" "Duplicate Content-Length: 5 and 999"
|
|
test_endpoint "/hdr-null" "Header with null bytes"
|
|
test_endpoint "/hdr-newline" "Header with bare \\n"
|
|
|
|
# --- Body Abuses ---
|
|
test_endpoint "/body-endless" "Infinite body stream" "--max-time 2"
|
|
test_endpoint "/body-none" "Content-Length: 5, no body" "--max-time 2"
|
|
test_endpoint "/body-binary" "4KB binary as text/html"
|
|
|
|
# --- Transfer-Encoding Abuses ---
|
|
test_endpoint "/te-invalid" "Transfer-Encoding: banana"
|
|
test_endpoint "/te-double" "Content-Length + Transfer-Encoding"
|
|
test_endpoint "/te-bad-chunk" "Chunked with ZZZ chunk size"
|
|
|
|
# --- Protocol Abuses ---
|
|
test_endpoint "/proto-garbage" "512 random bytes (no HTTP)"
|
|
test_endpoint "/proto-empty" "Empty response (0 bytes)"
|
|
test_endpoint "/proto-half" "HTTP/9.9 version"
|
|
test_endpoint "/proto-no-headers" "Status line + body, no headers"
|
|
test_endpoint "/proto-just-newlines" "Response is just CRLF"
|
|
|
|
# --- Encoding Abuses ---
|
|
test_endpoint "/enc-utf16" "Body is UTF-16, header says UTF-8"
|
|
test_endpoint "/enc-gzip-lie" "Content-Encoding: gzip (plaintext body)"
|
|
|
|
# --- Redirect Abuses ---
|
|
test_endpoint "/redir-self" "301 redirect loop"
|
|
test_endpoint "/redir-garbage" "301 garbage Location URL"
|
|
test_endpoint "/redir-chain" "302 infinite unique redirect chain" "-L --max-redirs 5"
|
|
|
|
# --- Timing Abuses ---
|
|
test_endpoint "/slow-headers" "Slowloris: 1 byte per 0.5s headers" "--max-time 2"
|
|
test_endpoint "/slow-body" "Body: 1 byte per second (a-z)" "--max-time 2"
|
|
|
|
# --- HTML/Content Abuses ---
|
|
test_endpoint "/html-utf16" "Full HTML page encoded as UTF-16LE"
|
|
test_endpoint "/html-long-title" "HTML title is 1000 characters"
|
|
test_endpoint "/html-multiline-title" "HTML title with embedded newlines"
|
|
test_endpoint "/html-irc-title" "Title with CRLF IRC injection"
|
|
test_endpoint "/html-unicode" "Random unicode title and body"
|
|
test_endpoint "/html-meta-refresh" "Meta refresh loop (0 second)"
|
|
|
|
# --- Terminal Abuses ---
|
|
echo "$SEP"
|
|
echo "ENDPOINT: /ansi-chaos"
|
|
echo "TITLE: ANSI escape code nightmare"
|
|
echo ""
|
|
echo "COMMAND: curl -s --max-time 5 http://${HOST}/ansi-chaos | cat -v"
|
|
echo ""
|
|
curl -s --max-time 5 "http://${HOST}/ansi-chaos" | cat -v | head -c "$MAX_OUTPUT"
|
|
echo ""
|
|
echo ""
|
|
|
|
# --- Network Abuses ---
|
|
test_endpoint "/net-gzip-bomb" "Gzip bomb (~10KB to 10MB)" "-o /dev/null"
|
|
test_endpoint "/net-event-flood" "SSE event flood (infinite)" "--max-time 1"
|
|
test_endpoint "/net-mime-sniff" "MIME type confusion (JS as image/jpeg)"
|
|
test_endpoint "/net-cache-poison" "Contradicting cache headers"
|
|
test_endpoint "/net-hsts-bomb" "HSTS with insane max-age"
|
|
|
|
# --- Miscellaneous ---
|
|
test_endpoint "/misc-ipv4" "Shows your connecting IPv4 address" "-4"
|
|
test_endpoint "/misc-ipv6" "Shows your connecting IPv6 address" "-6"
|
|
|
|
echo "$SEP"
|
|
echo "ALL TESTS COMPLETE"
|
|
echo "$SEP"
|