#!ruby -Ilib require 'rex' ['hex-normal', 'hex-all','u-all'].each { |encoding| ['vars_get','vars_post'].each { |vars| ['GET', 'POST'].each { |method| [0, 2].each { |size| [1, 2].each { |encode_count| system("~/src/snort-2.6.1.3/src/snort -D -i en0 -bdl . host 10.4.10.148 and port 80 ") sleep(1) c = Rex::Proto::Http::Client.new('10.4.10.148') c.set_config( 'uri_encode_mode' => encoding, 'chunked_size' => size, 'uri_encode_count' => encode_count ) r = c.request_cgi( 'method' => method, vars => { 'fname' => 'val' }, 'ctype' => 'application/x-www-form-urlencoded', 'chunked_size' => size ) p r resp = c.send_recv(r) p resp.body server_status = (resp.body =~ /This is the response./ ? 'server_ok' : 'server_failed') encoding_status = (resp.body =~ /PARAM fname
.*VALUE val
/m ? 'encoding_supported' : 'encoding_unsupported') sleep(1) system("killall -9 snort") system("mv snort.log.* #{server_status}-#{encoding_status}-#{encoding}-#{vars}-#{method}-chunk_#{(size > 0) ? 'enabled' : 'disabled'}-encoding_#{encode_count}.pcap") } } } } }