common

Documentation

Overview

Package common provides request plumbing shared by the SQLi detection engine: an HTTP throttle, a response signature / similarity metric, baseline capture and a concurrency-safe metrics meter.

Index

• Variables
• func Do(ctx context.Context, client *httpclient.Client, th Throttle, ...) (*httpclient.Response, error)
• func MedianDuration(list []time.Duration) time.Duration
• func Sim(a, b *Sig) float64
• type Baseline
  • func CaptureBaseline(ctx context.Context, client *httpclient.Client, th Throttle, ...) (*Baseline, error)
• type Meter
• type Sig
  • func SigOf(resp *httpclient.Response) *Sig
• type Throttle
  • func NewThrottle(delay time.Duration) Throttle

Variables

var (
	// ErrUnreachable indicates the target could not be reached during baseline
	// capture.
	ErrUnreachable = errors.New("target unreachable during baseline capture")
)

Functions

func Do

func Do(ctx context.Context, client *httpclient.Client, th Throttle, method, url string, body []byte, headers map[string]string, timeout time.Duration, meter *Meter) (*httpclient.Response, error)

Do sends one request with the shared throttle/meter plumbing. A configured timeout is applied per-request on top of ctx. The target's status feeds back into the throttle so it can slow down under pressure.

func MedianDuration

func MedianDuration(list []time.Duration) time.Duration

MedianDuration returns the median of the given durations.

func Sim

func Sim(a, b *Sig) float64

Sim returns a 0..1 similarity ratio between two response signatures. It is a weighted blend of a token-based Dice coefficient and a length ratio, with a penalty when the status codes differ. 1.0 means "identical", near zero means "completely different".

Types

type Baseline

type Baseline struct {
	Sig       *Sig
	Stable    bool
	Samples   int
	AvgSim    float64
	Median    time.Duration
	Durations []time.Duration
}

Baseline captures the "normal" behaviour of an injection point: a canonical response signature, its stability across samples and the median latency.

func CaptureBaseline

func CaptureBaseline(ctx context.Context, client *httpclient.Client, th Throttle, rr *injection.RenderedRequest, timeout time.Duration, meter *Meter) (*Baseline, error)

CaptureBaseline issues several requests for the clean (non-injected) request and distills a stable baseline. It fails fast with ErrUnreachable when no request succeeds.

type Meter

type Meter struct {
	Requests atomic.Int64
	Errors   atomic.Int64
}

Meter counts requests and errors across a scan.

type Sig

type Sig struct {
	Status   int
	Len      int
	Duration time.Duration
	// contains filtered or unexported fields
}

Sig is a compact, comparable fingerprint of an HTTP response.

func SigOf

func SigOf(resp *httpclient.Response) *Sig

SigOf builds a Sig from an HTTP response.

type Throttle

type Throttle interface {
	// Wait blocks until the next request is allowed, honouring ctx.
	Wait(ctx context.Context) error
	// Note informs the throttle of a completed request's status so it can
	// adapt its pacing.
	Note(status int)
}

Throttle paces outbound requests: a configurable inter-request delay plus adaptive backoff when the target throttles us (429) or is failing (5xx).

func NewThrottle

func NewThrottle(delay time.Duration) Throttle

NewThrottle returns a Throttle that spaces requests by the configured delay. A zero delay still imposes a tiny floor so a target is never hammered in an uncontrolled loop.