behavioral

Documentation

Index

• func PrintFindings(findings []Finding)
• func PrintModel(model *BehaviorModel)
• type BehaviorModel
• type Boundary
• type Config
• type Engine
  • func New(cfg Config) *Engine
  • func (e *Engine) Run() (*BehaviorModel, []Finding)
• type Finding
• type Inconsistency
• type Probe
• type ResponseClass

Functions

func PrintFindings

func PrintFindings(findings []Finding)

PrintFindings outputs findings

func PrintModel

func PrintModel(model *BehaviorModel)

PrintModel outputs the behavior model in a readable format

Types

type BehaviorModel

type BehaviorModel struct {
	InputType       string                    // what the server thinks our input is (url, query, filename, id, text)
	Transformations []string                  // what the server does to our input (url_fetch, db_query, file_read, reflect, ignore)
	Boundaries      []Boundary                // where behavior changes
	Inconsistencies []Inconsistency           // the bugs - where logic breaks
	ResponseMap     map[string]*ResponseClass // all observed response classes
}

BehaviorModel represents the server's observed behavior

type Boundary

type Boundary struct {
	Input       string
	Before      string // behavior before this input
	After       string // behavior after this input
	Trigger     string // what caused the change
	Description string
}

Boundary is where server behavior changes

type Config

type Config struct {
	Target  string
	Method  string
	Body    string
	Headers []string
	Cookies string
	Param   string
	Value   string
	Timeout int
	Ctx     context.Context
}

type Engine

type Engine struct {
	Target     string
	Method     string
	Body       string
	Headers    []string
	Cookies    string
	ParamName  string
	ParamValue string
	Timeout    int
	// contains filtered or unexported fields
}

Engine implements behavioral intent mapping. Instead of "does this payload trigger a known bug?", it asks: "How does this server PROCESS my input? Where are the inconsistencies?"

Phase 1: Probe - send structured input variations to map behavior Phase 2: Model - build a model of how the server treats input Phase 3: Attack - find inconsistencies in the model and exploit them

func New

func New(cfg Config) *Engine

func (*Engine) Run

func (e *Engine) Run() (*BehaviorModel, []Finding)

Run executes the full behavioral analysis pipeline

type Finding

type Finding struct {
	Severity    string
	Confidence  string
	Title       string
	Description string
	Evidence    []Probe
	Implication string
}

Finding from behavioral analysis

type Inconsistency

type Inconsistency struct {
	Severity    string
	Title       string
	Description string
	ProofA      Probe  // request that shows behavior A
	ProofB      Probe  // request that shows contradicting behavior B
	Implication string // what this means for an attacker
}

Inconsistency is a logical contradiction in server behavior

type Probe

type Probe struct {
	Input   string
	Status  int
	Size    int
	TimeMs  int64
	Body    string
	Headers map[string]string
	Class   string // which response class this belongs to
}

Probe is a single request/response pair

type ResponseClass

type ResponseClass struct {
	Name    string
	Status  int
	SizeMin int
	SizeMax int
	TimeAvg int64
	Pattern string // what makes this class unique
	Count   int
	Samples []Probe
}

ResponseClass groups similar responses