text: /*
   * BP-WebExploitation.h
   *
   *  Created on: Mar 5, 2009
   *      Author: Jason Medeiros
   */
  
  #ifndef BPWEBEXPLOITATION_H_
  #define BPWEBEXPLOITATION_H_
  
  /*
   * JM NOTE: Some of the function declarations here reside in files other then
   * BP-WebExploitation.cc.   They all reside in the WebExploitation folder however
   * and if you need to find them, run a search in that folder, or look at my notes
   * for evidence of where they would be literally or logically in relative perspective to the
   * WebExploitation/ folder. Have fun.
   */
  
  
  // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  // %%%%%%%%%%%%%%%%%%%% ASSESSMENT FUNCTIONALITY %%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  enum BP_WEB_ASSESSMENT_FAILURES
  {
  	BP_WEB_ASSESSMENT_SUCCESS,
  	BP_WEB_ASSESSMENT_MAX_REQUESTS_EXCEEDED
  };
  
  // SQL Engine Enumeration (mostly used by outside applications)
  enum BP_SQL_ENGINES
  {
  	BP_SQL_ENGINE_NONE,
  	BP_SQL_ENGINE_MYSQL,
  	BP_SQL_ENGINE_MSQL,
  	BP_SQL_ENGINE_ORACLE,
  	BP_SQL_ENGINE_ODBC,
  	BP_SQL_ENGINE_POSTGRES,
  	BP_SQL_ENGINE_INVALID
  };
  
  
  // Application Server Engine Enumerations (herein refered to as APP_ENGINES)
  enum BP_APP_ENGINES
  {
  	BP_APP_ENGINE_NONE,
  	BP_APP_ENGINE_PHP,
  	BP_APP_ENGINE_JSP,
  	BP_APP_ENGINE_ASP,
  	BP_APP_ENGINE_CFM,
  	BP_APP_ENGINE_DNET,
  	BP_APP_ENGINE_INVALID
  };
  
  
  
  // This structure is used to hold the assessment
  // which relates to one page in a session.
  typedef struct _BP_WEB_ASSESSMENT {
  
  	// memory allocator tail queue
  	P_BP_LINKL tq;
  
  
  	// URL Base for the assessment
  	char *baseAssessmentURL;
  
  	// number of retries to use on http requests.  Set this high for proxies, as
  	// they will continuously fail.
  	size_t http_request_max_retries;
  
  	// Site lock: If true will stay on base assessment site, if not
  	// it will logically crawl outside site boundrarys. (dangerous)
  	bool siteLock;
  
  	// Optional POST String To Set for Request (for forms)
  	char *postArgs;
  
  	// Optional Cookie String to set for request (for forms)
  	char *cookie;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% SESSION AND EXTRACTION FLAGS %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// Creates a new session on invocation if this flag is set
  	bool createNewSession;
  
  	// If no extraction is provided for the assessment, this flag
  	// tells blockparty to require an extraction from the assessment session
  	// before performing any analysis. (mainly used for batch list processing)
  	bool performRequiredExtraction;
  
  	// session associated with the assessment (destroyed/created seperately :: Only a ptr)
  	P_BP_HTTP_SESSION session;
  
  	// decoded html associated with the assessment  (destroyed/created seperately :: Only a ptr)
  	P_BP_HTML_FULL_EXTRACTION pageExtraction;
  
  	// format character table to use when generating test sets
  	char **fmtTable;
  
  	// maximum request retries attempts before failing assessment
  	size_t maxRetryRequests;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Error Reporting Functionality %%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// if this value is positive, we have a failed assessment
  	size_t failedAssessment;
  
  	// enable email notification
  	bool enable_email_notices;
  
  	// smtp configuration
  	char *email_smtp_username;
  	char *email_smtp_password;
  	char *email_smtp_from;
  	char *email_smtp_server;
  
  	// templates
  	char *email_xss_template;
  	char *email_sql_error_message_template;
  	char *email_appserver_message_template;
  	char *email_confirmed_or_blind_sqli_template;
  
  	// doesn't send any information in emails
  	bool redact_email_information;
  
  	// nofication email(s) to use
  	char **notification_emails;
  
  	// # sends out a test email confirming email system is working when
  	// # job is launched.
  	bool send_notification_email_on_job_start;
  
  	// # sends out a notification email when a xss is detected
  	bool send_notification_email_on_xss;
  
  	// # sends out a notification email when a sql error message is detected
  	bool send_notification_email_on_sql_error_messages;
  
  	// # sends out a notification email when an application server message is detected
  	bool send_notification_email_on_appserver_messages;
  
  	// # Sends out a notification when a blind sql injection occurs, or a
  	// # sqli is actually exploited.
  	bool send_notification_email_on_confirmed_or_blind_sqli;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Request Randomization Settings %%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// This utilizes random browser strings between requests
  	size_t randomizeBrowserStrsBetweenRequests;
  
  	// User strings used by the assessment
  	char ** userAgentPool;
  	size_t userAgentCount;
  
  	// user agent pool for randomization
  	BP_USER_AGENT_POOL userAgentPoolType;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Proxy Settings %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// This utilizes a random proxy from the list between requests
  	size_t useProxies;
  	size_t randomizeProxyRequests;
  
  	// see the enumeration in BP-NetworkWeb.h for an explanation of this
  	// value.  NOTICE: Setting this value in an assessment changes the proxy policy
  	// in the underlying cURL session being used for this session.
  	BP_WEB_PROXY_POLICY proxyPolicy;
  
  	// Proxy pool used for this assessment NOTICE: This pool is used in the
  	// underlying session, and this should be enabled typically if sessions are
  	// NOT being reused.
  	char ** proxyList;
  	size_t numProxies;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% HTTP Status Codes %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// http status code array
  	P_BP_WEB_ASSESSMENT_EXCLUSION_CODES statusCodes;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Request Count Caps %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// The number of form/anchor variables found multiplied by
  	// the total number of checks cannot exceed either of these
  	// two values.  Their initial values are 655350.
  	size_t maxAnchorPossibilities;
  	size_t maxFormPossibilities;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% XSS Checks %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// Identifies which test set was utilized for testing (for proper indexing)
  	BP_XSS_TEST_SET xssTestSetId;
  
  	// XSS Check Array to Use For Assessment
  	P_BP_WEB_XSS_TEST xssChecks;
  	size_t xssChecksCount;
  
  	// Payload used for xss checks (default is alort(1);) SPELLED WRONG ON PURPOSE
  	// FOR EVASION OF IDS RULES.
  	char *xssPayload;
  
  	// When the assessment finishes, this pointer will hold a linked list of
  	// xss results which can be walked and stored.
  	P_BP_WEB_XSS_TEST_RESULT xssResults;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% SQL Injection Checks %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// Identifies which test array was used for testing
  	BP_SQLINJ_TEST_SET sqlInjTestSetId;
  
  	// SQL Injection Check List to Use
  	P_BP_WEB_SQLINJ_TEST sqlChecks;
  
  	// count of sql injection checks (used in destructor)
  	size_t sqlCheckCount;
  
  	// Results list/structure for sql checks
  	P_BP_WEB_SQLINJ_TEST_RESULT sqlResults;
  
  	// Payload destined for server
  	char * sqlInjectPayload;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% SQL Check Tables for Validation %%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// ----------- MYSQL -------------------------------------------
  	// flag to indicate to run mysql checks
  	bool runMysqlChecks;
  
  	// Error Table which contains unmodified/unparsed table of errors
  	P_BP_MYSQL_ERR_CODES mysqlErrCodes;
  
  	// Error Checks Related to Mysql Used for Identifying SQL Injections
  	P_BP_FMT_ERR_TESTS mysqlErrChecks;
  
  	// number of mysql error checks which will be performed
  	size_t mysqlErrCheckCount;
  
  
  	// ----------- MSQL -------------------------------------------
  
  	// flag to indicate to run msql checks
  	bool runMsqlChecks;
  
  	// Error Table which contains unmodified/unparsed table of errors
  	P_BP_MSQL_ERR_CODES msqlErrCodes;
  
  	// Error Checks Related to Msql Used for Identifying SQL Injections
  	P_BP_FMT_ERR_TESTS msqlErrChecks;
  
  	// number of msql error checks which will be performed
  	size_t msqlErrCheckCount;
  
  
  	// ----------- ORACLE -------------------------------------------
  
  	// flag to indicate to run msql checks
  	bool runOracleChecks;
  
  	// Error Table which contains unmodified/unparsed table of errors
  	P_BP_ORACLE_ERR_CODES oracleErrCodes;
  
  	// Error Checks Related to Msql Used for Identifying SQL Injections
  	P_BP_FMT_ERR_TESTS oracleErrChecks;
  
  	// number of msql error checks which will be performed
  	size_t oracleErrCheckCount;
  
  
  	// ----------- ODBC -------------------------------------------
  
  	// flag to indicate to run msql checks
  	bool runODBCChecks;
  
  	// Error Table which contains unmodified/unparsed table of errors
  	P_BP_ODBC_ERR_CODES odbcErrCodes;
  
  	// Error Checks Related to ODBC Used for Identifying SQL Injections
  	P_BP_FMT_ERR_TESTS odbcErrChecks;
  
  	// number of odbc error checks which will be performed
  	size_t odbcErrCheckCount;
  
  
  	// ----------- Postgres -------------------------------------------
  
  	// flag to indicate to run postgres checks
  	bool runPostgresChecks;
  
  	// Error Table which contains unmodified/unparsed table of errors
  	P_BP_POSTGRES_ERR_CODES postgresErrCodes;
  
  	// Error Checks Related to Postgres Used for Identifying SQL Injections
  	P_BP_FMT_ERR_TESTS postgresErrChecks;
  
  	// number of Postgres error checks which will be performed
  	size_t postgresErrCheckCount;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Blind SQL Injection Testing %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// stack of blind sqli test results.  Populated after blindsqli routines are
  	// run.  Null if unrun.
  	P_BP_WEB_BLIND_SQLINJ_TEST_RESULT bsqli_results;
  
  	// Number of results in the above structure array. 0 if empty.
  	size_t bsqli_result_count;
  
  	// flag indicating whether or not to run the underlying blind sqli testing subsystem
  	size_t bsqli_testing_enabled;
  
  	// flag indicating whether or not to only test anchors found to be
  	// dropping mysql error messages.
  	size_t bsqli_only_test_anchors_with_assoc_sql_match;
  
  	// flag indicating whether or not to only test forms found to be
  	// dropping mysql error messages.
  	size_t bsqli_only_test_forms_with_assoc_sql_match;
  
  	// Timeout to use for mysql sleep
  	size_t bsqli_mysql_sleep_timeout;
  
  	// Number of iterations to use for mysql
  	// benchmark.  Effectively
  	size_t bsqli_mysql_benchmark_md5_count;
  
  	// time in seconds that the request took to complete a successful request
  	size_t bsqli_request_time_to_complete_from_successful_connect;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Server/Application Error Checks %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// JM Note: These checks are reserved for detecting errors within
  	// underlying application configurations.
  
  	// Turn on or off the application server checks, the corresponding lower
  	// level checks must be on additionally for them to be run.
  	bool runAppServerChecks;
  
  	// Main Application Error List (contains any errors found during assessment)
  	P_BP_WEB_APPSERVER_TEST_RESULT appErrorResults;
  
  
  	// ------------------ PHP -----------------------------------
  
  	// flag to indicate to run php app checks
  	bool runPhpChecks;
  
  	// Error Table which contains unmodified/unparsed table of errors
  	P_BP_PHP_ERR_CODES phpErrCodes;
  
  	// Error Checks Related to PHP Used for Identifying PHP Errors
  	P_BP_FMT_ERR_TESTS phpErrChecks;
  
  	// number of php error checks which will be performed
  	size_t phpErrCheckCount;
  
  
  	// ------------------ JSP -----------------------------------
  
  	// flag to indicate to run php app checks
  	bool runJspChecks;
  
  	// Error Table which contains unmodified/unparsed table of errors
  	P_BP_JSP_ERR_CODES jspErrCodes;
  
  	// Error Checks Related to JSP Used for Identifying PHP Errors
  	P_BP_FMT_ERR_TESTS jspErrChecks;
  
  	// number of jsp error checks which will be performed
  	size_t jspErrCheckCount;
  
  
  
  	// ------------------ ASP -----------------------------------
  
  	// ASP errors are like postgres errors and do not contain any special
  	// format string characters or otherwise.
  
  	// flag to indicate to run asp app checks
  	bool runAspChecks;
  
  	// error code check array
  	P_BP_ASP_ERR_CODES aspErrCodes;
  
  	// Error Checks Related to ASP Used for Identifying errors
  	P_BP_FMT_ERR_TESTS aspErrChecks;
  
  	// number of asp error checks which will be performed
  	size_t aspErrCheckCount;
  
  
  	// ------------------ CFM -----------------------------------
  
  
  	// flag to indicate to run cold fusion app checks
  	bool runCfmChecks;
  
  	// Error Table which contains unmodified/unparsed table of errors
  	P_BP_CFM_ERR_CODES cfmErrCodes;
  
  	// Error Checks Related to Cold Fusion Used for Identifying Cold Fusion Errors
  	P_BP_FMT_ERR_TESTS cfmErrChecks;
  
  	// number of cfm error checks which will be performed
  	size_t cfmErrCheckCount;
  
  
  	// ------------------ .NET -----------------------------------
  
  
  	// flag to indicate to run .NET app checks
  	bool runDnetChecks;
  
  	// Error Table which contains unmodified/unparsed table of errors
  	P_BP_DNET_ERR_CODES dnetErrCodes;
  
  	// Error Checks Related to .NET Used for Identifying .NET Errors
  	P_BP_FMT_ERR_TESTS dnetErrChecks;
  
  	// number of dnet error checks which will be performed
  	size_t dnetErrCheckCount;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% DB Request Logging %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// THIS IS DEPRECATED
  
  	// NOTE: SHA1 SUM IS ALWAYS LOGGED IF DB LOGGING IS ENABLED
  
  	// Mysql.  To enable logging, set this to a pointer to a mysql session.
  	P_BP_MYSQL_SESSION db_log_mysql_session;
  
  	// result id used to link entry to the results table
  	size_t db_result_id;
  
  	// last http request id made
  	size_t db_http_last_request_made_id;
  
  	// flag to indicate what to log
  	size_t db_req_log_status_code;
  	size_t db_req_log_get_data;
  	size_t db_req_log_post_data;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Blacklisting %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// blacklist used to prevent requests from being made to arbitrary
  	// out-of-scope sites.
  	char ** audit_blacklist;
  
  	//  whitelist used to prevent requests from being made to arbitrary
  	// out-of-scope sites.
  	char ** audit_whitelist;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% STANDARD WEB EXPLOITS %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// ---------- Default Web Sploits ---------------------------
  
  
  	// --------- Custom User Web Sploits ------------------------
  
  	// List Pointers
  	struct _BP_WEB_ASSESSMENT * first;
  	struct _BP_WEB_ASSESSMENT * prev;
  	struct _BP_WEB_ASSESSMENT * next;
  
  } BP_WEB_ASSESSMENT, *P_BP_WEB_ASSESSMENT;
  
  
  
  // Assessment queue (currently unused)
  typedef struct _BP_WEB_ASSESSMENT_QUEUE {
  
  	// linked list of assessments
  	P_BP_WEB_ASSESSMENT assessments;
  
  } BP_WEB_ASSESSMENT_QUEUE, *P_BP_WEB_ASSESSMENT_QUEUE;
  
  
  // If substituions occur within an exploit request set, this indicator is
  // used to determine the type.
  typedef enum BP_WEB_EXPLOIT_REQUEST_SET_SUBSTITUTION_TYPE
  {
  	BP_WEB_EXPLOIT_REQUEST_SET_SUBSTITUTION_NONE,
  	BP_WEB_EXPLOIT_REQUEST_SET_SUBSTITUTION_ANCHOR,
  	BP_WEB_EXPLOIT_REQUEST_SET_SUBSTITUTION_FORM,
  	BP_WEB_EXPLOIT_REQUEST_SET_SUBSTITUTION_HEADER,
  	BP_WEB_EXPLOIT_REQUEST_SET_SUBSTITUTION_COOKIE
  
  };
  
  
  // Lookup type to use
  typedef enum BP_WEB_EXPLOIT_REQUEST_SET_VAR_LOOKUP
  {
  	BP_WEB_EXPLOIT_REQUEST_SET_VAR_LOOKUP_BY_NAME,
  	BP_WEB_EXPLOIT_REQUEST_SET_VAR_LOOKUP_BY_POSITION
  };
  
  
  // This structure is used to make requests through the web
  // auditing system.  The reason that data is requested through
  // the use of this structure, is to ease the process of logging
  // exploit tests.  All pointers in this structure must be free'd.
  typedef struct _BP_WEB_EXPLOIT_REQUEST_SET {
  
  
  	// tailqueue allocator for this ERS
  	P_BP_LINKL tq;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Identifying Information %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// if you choose to name your ERS, this is where it's stored
  	char * name;
  
  	// sha1 unique hash which is calculated
  	// by adding all strings in this structure
  	// together and sha1'ing them.
  	char *sha1_hash;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% General Result Information %%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  
  	// http get string to use
  	char *get_str;
  
  	// http post string to use
  	char *post_str;
  
  	// cookie string to use
  	char *cookie_str;
  
  	// the request header string
  	char * request_header_str;
  
  	// http response code for the request set
  	size_t http_response_code;
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Lookup Information %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// lookup type
  	BP_WEB_EXPLOIT_REQUEST_SET_VAR_LOOKUP lookup_type;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Substitution Information %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  
  	// This is the name of the item to substitute.  If it's a form,
  	// it will be the name of an input, if it's an anchor, it'll be
  	// the name of var to substitue.  If it's a header, it'll be the
  	// header name, if it's a cookie, it'll be the cookie var name.
  	char name_of_item_substituted;
  
  
  	// the substitution type associated with this exploit request
  	BP_WEB_EXPLOIT_REQUEST_SET_SUBSTITUTION_TYPE substitution_type;
  
  	// if this is a header request substitution, this value is set
  	P_BP_HTTP_REQUEST_HEADER header;
  
  	// if this is an anchor substitution, this value is set
  	P_BP_HTML_ANCHOR_LIST anchor;
  
  	// if this is a form substitution, this value is set
  	P_BP_HTML_FORM_LIST form;
  
  	// form tests require inputs, so if it's a form test, this is also set.
  	P_BP_HTML_INPUT_LIST form_inputs;
  
  
  } BP_WEB_EXPLOIT_REQUEST_SET, *P_BP_WEB_EXPLOIT_REQUEST_SET;
  
  
  // Request set manager.
  typedef struct __BP_WEB_EXPLOIT_REQUEST_MGR {
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Identifiers %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// name of the exploit request manager
  	char * name;
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% ERM Data %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// tailqueue to use for managing requests
  	P_BP_LINKL tq;
  
  
  	// HTTP session associated with this request set manager.
  	P_BP_HTTP_SESSION http_session_reference;
  
  	// HTML extraction reference associated with this manager
  	P_BP_HTML_FULL_EXTRACTION html_extraction_reference;
  
  
  
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%% Request Sets %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  	// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  	// pointer to a stack of request sets
  	P_BP_WEB_EXPLOIT_REQUEST_SET request_sets;
  
  	// number of requests in this request set manager
  	size_t request_set_n;
  
  
  } BP_WEB_EXPLOIT_REQUEST_MGR, *P_BP_WEB_EXPLOIT_REQUEST_MGR;
  
  
  // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  // %%% Create Web Assessment %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  
  // Creates an new assessment structure and fills out its data structures.
  P_BP_WEB_ASSESSMENT BP_CreateWebAssessment
  (
  		char *                    baseAssessmentURL,
  		P_BP_HTTP_SESSION         session,
  		P_BP_HTML_FULL_EXTRACTION extraction,
  		bool                      genSqlTables,
  		bool                      genAppEngineTables,
  		bool                      siteLock
  );
  
  
  // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  // %%% Set Basic Request Data %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  
  // This combines aggregate data into a basic data structure.  Useful
  // for providing easy to visualize, indexed data.
  BP_ERROR_T BP_WebAssessmentSetBasicRequestData
  (
  		P_BP_WEB_ASSESSMENT                  assessment,
  		P_BP_WEB_ANALYSIS_BASIC_REQUEST_DATA request_data_in, /* this structure is filled */
  		P_BP_WEB_EXPLOIT_REQUEST_SET         exploit_request_set,
  		P_BP_HTTP_SESSION                    http_session,
  		P_BP_HTML_ANCHOR_LIST                anchor,
  		size_t                               anchor_index,
  		P_BP_HTML_FORM_LIST                  form,
  		size_t                               form_index,
  		size_t                               request_header_index
  );
  
  
  
  // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  // %%% Assessment Utility Lookup Functions %%%%%%%%%%%%%%%%%%%
  // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
  // SQLINJ: Checks a web assessment to see if it contains a vulnerabile form input.  If so, it looks up the
  // form action (aka target page), and returns the HTML form property structure that contains its value/size.
  // Returns null on failure.
  P_BP_HTML_FORM_PROPERTY_LIST BP_GetVulnerableFormActionPropertySQL(P_BP_WEB_SQLINJ_TEST_RESULT sqlinj);
  
  // XSS: Checks a web assessment to see if it contains a vulnerabile form input.  If so, it looks up the
  // form action (aka target page), and returns the HTML form property structure that contains its value/size.
  // Returns null on failure.
  P_BP_HTML_FORM_PROPERTY_LIST BP_GetVulnerableFormActionPropertyXSS(P_BP_WEB_XSS_TEST_RESULT xss);
  
  
  // Appends an assessment to an existing list
  
  // Creates a full list of assessments provided an anchor list,
  // in the case of an encountered anchor which is not HTTP, the baseURL parameter is
  // prefixed to the new assessment, which is useful for relative anchors.  If the
  // anchor contains a prefix of http(s):// this will not be used.
  P_BP_WEB_ASSESSMENT BP_CreateWebAssessmentsFromAnchors(P_BP_WEB_ASSESSMENT appendList, char *baseURL, P_BP_HTML_ANCHOR_LIST anchors);
  
  
  // Creates a full list of assessments provided a form list
  P_BP_WEB_ASSESSMENT BP_CreateWebAssessmentsFromForms(P_BP_WEB_ASSESSMENT appendList, P_BP_HTML_FORM_LIST forms);
  
  
  // Append an assessment to an existing list
  size_t BP_AppendWebAssessmentList(P_BP_WEB_ASSESSMENT inList, P_BP_WEB_ASSESSMENT appendList);
  
  // Retrieves the last element from the list
  P_BP_WEB_ASSESSMENT BP_WebAssessmentGetLastElement(P_BP_WEB_ASSESSMENT inList);
  
  // Resets the first pointer in the whole list
  size_t BP_ChangeWebAssessmentListFirstPointers(P_BP_WEB_ASSESSMENT inList, P_BP_WEB_ASSESSMENT newFirst);
  
  // Remove an element from the list
  size_t BP_RemoveWebAssessmentElementFromList(P_BP_WEB_ASSESSMENT inList, P_BP_WEB_ASSESSMENT removeList);
  
  // See if element is in the list
  P_BP_WEB_ASSESSMENT BP_WebAssessmentFindElementInList(P_BP_WEB_ASSESSMENT inList, P_BP_WEB_ASSESSMENT testList);
  
  
  
  
  // Duplicates the provided string (calloc) and sets it in the provided
  // structure.
  size_t BP_SetAssessmentBaseURL(P_BP_WEB_ASSESSMENT assessment, char *url);
  
  // Sets session pointer in the web assessment
  size_t BP_SetAssessmentSession(P_BP_WEB_ASSESSMENT assessment, P_BP_HTTP_SESSION session);
  
  // Sets the SQL check pointer in assessment
  size_t BP_SetAssessmentSQLChecks(P_BP_WEB_ASSESSMENT assessment, P_BP_WEB_SQLINJ_TEST sqlChecks);
  
  // Sets the XSS check pointer in the assessment
  size_t BP_SetAssessmentXSSChecks(P_BP_WEB_ASSESSMENT assessment, P_BP_WEB_XSS_TEST xssChecks);
  
  
  // Multiple assessment dispatcher (runs the full list of assessments, aka all assessments)
  size_t BP_RunWebAssessments(P_BP_WEB_ASSESSMENT assessmentList);
  
  // MAIN ASSESSMENT DISPATCHER: Responsible for running an assessment (aka 1 assessment)
  size_t BP_RunWebAssessment(P_BP_WEB_ASSESSMENT assessment);
  
  // Checks anchors in an assessment (SHOULD BE INVOKED FROM MAIN DISPATCHER ONLY)
  size_t BP_RunWebAssessmentAnchorChecks(P_BP_WEB_ASSESSMENT assessment);
  
  // Checks form in an assessment (SHOULD BE INVOKED FROM MAIN DISPATCHER ONLY)
  size_t BP_RunWebAssessmentFormChecks(P_BP_WEB_ASSESSMENT assessment);
  
  
  
  
  // --------- XSS Related Assessment Functionality ------------------
  
  // Generates a url suitable for XSS testing
  char * BP_WebAssessmentGenerateXSSAnchorTestSet
  (
  		char *                      baseTestURL,
  		P_BP_WEB_XSS_TEST           test,
  		P_BP_HTML_ANCHOR_VAR_LIST   vars,
  		P_BP_HTML_ANCHOR_DELIMITERS delims,
  		char *                      asciiXSSPayload,
  		size_t                      subAtPosition
  );
  
  // Generates a form input string suitable for xss testing
  char * BP_WebAssessmentGenerateXSSFormTestSet
  (
  		P_BP_WEB_XSS_TEST           test,
  		P_BP_HTML_FORM_LIST         form,
  		P_BP_HTML_ANCHOR_DELIMITERS delims,
  		char *                      asciiXSSPayload,
  		size_t                      subAtPosition
  );
  
  
  // Appends a result set to the end of an assessment set
  size_t BP_WebAssessmentAppendXSSResultToList
  (
  		P_BP_WEB_XSS_TEST_RESULT inList,
  		P_BP_WEB_XSS_TEST_RESULT appendList
  );
  
  // Utilizes the data stored within the session in order to attempt a match with
  // a given XSS Test.
  P_BP_WEB_XSS_TEST_RESULT BP_WebAssessmentRunXSSAnchorMatchCheck
  (
  		P_BP_WEB_ASSESSMENT       assessment,
  		P_BP_WEB_XSS_TEST         test,
  		size_t                    testIndex,
  		size_t                    runMagicQuotesTest,
  		P_BP_HTML_ANCHOR_LIST     anchor,
  		P_BP_HTML_ANCHOR_VAR_LIST vulnVar,
  		size_t                    anchorVarPosition
  );
  
  
  
  // --------- SQL Related Assessment Functionality ------------------
  
  // Generates an anchor test suitable for SQL Injection testing
  char * BP_WebAssessmentGenerateSQLAnchorTestSet
  (
  		char *                      baseTestURL,
  		P_BP_WEB_SQLINJ_TEST        test,
  		P_BP_HTML_ANCHOR_VAR_LIST   vars,
  		P_BP_HTML_ANCHOR_DELIMITERS delims,
  		char *                      sqlInjectPayload,
  		size_t                      subAtPosition
  );
  
  // Generates a form test suitable for SQL Injection testing
  char * BP_WebAssessmentGenerateSQLFormTestSet
  (
  		P_BP_WEB_SQLINJ_TEST        test,
  		P_BP_HTML_FORM_LIST         form,
  		P_BP_HTML_ANCHOR_DELIMITERS delims,
  		char *                      sqlInjectPayload,
  		size_t                      subAtPosition
  );
  
  
  // MYSQL: Attempts to check a retrieved buffer for signs of MYSQL errors
  P_BP_WEB_SQLINJ_TEST_RESULT BP_WebAssessmentRunMYSQLAnchorMatchCheck
  (
  		P_BP_WEB_ASSESSMENT         assessment,
  		P_BP_WEB_SQLINJ_TEST        test,
  		size_t                      testIndex,
  		size_t                      runMagicQuotesTest,
  		P_BP_HTML_ANCHOR_LIST       anchor,
  		P_BP_HTML_ANCHOR_VAR_LIST   vulnVar,
  		size_t                      anchorVarPosition
  );
  
  // MSQL: Attempts to check a retrieved buffer for signs of Microsoft SQL errors
  P_BP_WEB_SQLINJ_TEST_RESULT BP_WebAssessmentRunMSQLAnchorMatchCheck
  (
  		P_BP_WEB_ASSESSMENT         assessment,
  		P_BP_WEB_SQLINJ_TEST        test,
  		size_t                      testIndex,
  		size_t                      runMagicQuotesTest,
  		P_BP_HTML_ANCHOR_LIST       anchor,
  		P_BP_HTML_ANCHOR_VAR_LIST   vulnVar,
  		size_t                      anchorVarPosition
  );
  
  // PGSQL: Attempts to check a retrieved buffer for signs of Postgres SQL errors
  P_BP_WEB_SQLINJ_TEST_RESULT BP_WebAssessmentRunPGSQLAnchorMatchCheck
  (
  		P_BP_WEB_ASSESSMENT       assessment,
  		P_BP_WEB_SQLINJ_TEST      test,
  		size_t                    testIndex,
  		size_t                    runMagicQuotesTest,
  		P_BP_HTML_ANCHOR_LIST     anchor,
  		P_BP_HTML_ANCHOR_VAR_LIST vulnVar,
  		size_t                    anchorVarPosition
  );
  
  
  // Appends a result set to the end of an assessment set
  size_t BP_WebAssessmentAppendSQLResultToList(P_BP_WEB_SQLINJ_TEST_RESULT inList, P_BP_WEB_SQLINJ_TEST_RESULT appendList);
  
  
  // ---------------BLIND SQL INJECTION RELATED TESTS/UTILITIES -------
  
  
  // checks an anchor for  blind sqli
  P_BP_WEB_BLIND_SQLINJ_TEST_RESULT BP_WebAssessmentCheckAnchorForBlindSQLi(P_BP_WEB_ASSESSMENT assessment, P_BP_HTML_ANCHOR_LIST anchor);
  
  // checks an anchor for  blind sqli
  P_BP_WEB_BLIND_SQLINJ_TEST_RESULT BP_WebAssessmentCheckFormForBlindSQLi(P_BP_WEB_ASSESSMENT assessment, P_BP_HTML_FORM_LIST anchor);
  
  // Generates a list of test conditions for union select conditions.  The front_parts
  // parameter must be null pointer terminated to use this function correctly.
  P_BP_WEB_BLIND_SQLINJ_TEST BP_WebExploitatinGenUnionSelectTestConditions
  (
  		char ** front_parts,
  		size_t  matrix_size,
  		char *  str_test,
  		char *  int_test,
  		size_t  gen_integer_tests,
  		size_t  gen_string_tests,
  		size_t  max_nesting
  );
  
  // Generates a matrix of union select tests to run provided str and int type values.  All
  // arrays in all dimensions of this matrix are null pointer terminated.  The order in which
  // tests are generated is optimized for blind sqli detection and should not be modified
  // without understanding what's going on.
  char *** BP_GenerateBlindSQLiUnionMatrixFromStrIntText(char *str_val, char *int_val, size_t width);
  
  
  
  // Generates a form input string suitable for blind sql injection testing.
  char * BP_WebAssessmentGenerateBlindSQLiAnchorTestSet
  (
  		char *                      baseTestURL,
  		P_BP_WEB_BLIND_SQLINJ_TEST  test,
  		P_BP_HTML_ANCHOR_VAR_LIST   vars,
  		P_BP_HTML_ANCHOR_DELIMITERS delims,
  		char *                      asciiXSSPayload,
  		size_t                      subAtPosition
  );
  
  // Generates a url suitable for XSS test// Generates a form input string suitable for blind sql injection testing.
  char * BP_WebAssessmentGenerateBlindSQLiAnchorTestSet
  (
  		P_BP_WEB_BLIND_SQLINJ_TEST  test,
  		P_BP_HTML_FORM_LIST         form,
  		P_BP_HTML_ANCHOR_DELIMITERS delims,
  		char *                      asciiXSSPayload,
  		size_t                      subAtPosition
  );
  
  // Generates a form input string suitable for blind sql injection testing.
  char * BP_WebAssessmentGenerateBlindSQLiFormTestSet
  (
  		P_BP_WEB_BLIND_SQLINJ_TEST  test,
  		P_BP_HTML_FORM_LIST         form,
  		P_BP_HTML_ANCHOR_DELIMITERS delims,
  		char *                      asciiXSSPayload,
  		size_t                      subAtPosition
  );
  
  // Creates a duplicate row for use in unioning which can be position modified.
  char **BP_WebExploitationDuplicateUnionSelectRow(char **row);
  
  // Duplicates an inverted union select row of items
  char **BP_WebExploitationDuplicateInvertedUnionSelectRow(char **row, char *invert_this, char *with_this);
  
  // prints a matrix
  size_t BP_WebExploitationPrintUnionSelectMatrix(char *** matrix);
  
  // Joins two matrixes bottom to top logically in a stacked
  // array.  No inputs are destroyed, only pointer swapping occurs so
  // you must be careful to not doublefree pointers.
  char *** BP_WebExploitationBlindSQLiMergeMatrixesAndFree(char *** matrix_top, char *** matrix_bottom);
  
  // Generates a completed union select string suitable for use in blind
  // sqli testing.  All strings must be null terminated.
  char * BP_WebExploitationBlindSQLiCreateExploitStr(char *test_front, char ** test_positions, char *test_tail);
  
  
  // displays a blind sql injection test set
  size_t BP_DisplayBlindSQLiTestSet(P_BP_WEB_BLIND_SQLINJ_TEST tests);
  
  // displays a blind sql injection test (singular)
  size_t BP_DisplayBlindSQLiTest(P_BP_WEB_BLIND_SQLINJ_TEST test);
  
  
  // ----------------- APP ENGINE UTILITIES ---------------------------
  
  // Appends a result set to the end of an application engine assessment set
  size_t BP_WebAssessmentAppendAppEngineResultToList(P_BP_WEB_APPSERVER_TEST_RESULT inList, P_BP_WEB_APPSERVER_TEST_RESULT appendList);
  
  
  // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  // %%%%%%%%%%%%%% DOMAIN/IP Identification Utilities %%%%%%%%%%%%%%%%
  
  enum BP_BASE_TARGET_TYPE {
  	BP_BASE_TARGET_TYPE_HTTP_IP,
  	BP_BASE_TARGET_TYPE_HTTPS_IP,
  	BP_BASE_TARGET_TYPE_HTTP_DNS,
  	BP_BASE_TARGET_TYPE_HTTPS_DNS
  };
  
  // Tests to see if a string is part of a DNS domain, or simply an IP address. Will
  // test up until either a 0x00 or a / character.
  // eg http://192.168.1.1 vs http://www.test.com
  BP_BASE_TARGET_TYPE BP_HTTPIdentifyBaseType(char *testStr, size_t len);
  
  // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  // %%%%%%%%% REQUEST STRING GENERATION/EXCLUSION %%%%%%%%%%%%%%%%%%%%
  
  /*
   * Explanation:
   * These routines are used for the generation of request strings used with
   * either the GET or POST methods.  These routines take into account the values
   * set within the assessment structure, and based upon them either generate a
   * valid request string, or return NULL to indicate that an exclusion has
   * occured.  These routines are primarily utilized within the Run*Tests() series
   * of functions which are most often ran from RunAssessment().
   */
  
  
  char * BP_WebAssessmentGenerateAnchorRequest(P_BP_WEB_ASSESSMENT assessment, P_BP_HTML_ANCHOR_LIST anchor);
  
  char * BP_WebAssessmentGenerateFormRequest(P_BP_WEB_ASSESSMENT assessment, P_BP_HTML_FORM_LIST form);
  
  
  // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  // %%%%%%%%%%%%%% Assessment Visualization Functionality %%%%%%%%%%%%
  
  // Utility function which prints out a representation of the SQL Test list for
  // use with library debugging and testing. (auto-invoked by PrintAssessments)
  void BP_PrintSqlResultList(P_BP_WEB_ASSESSMENT assessment);
  
  // Displays the stack of blind sql injection results.  The results
  // are stored in a stack of structures rather than the list format of
  // the other results due to it being a simply better design.  In the future
  // i plan to reimplement all result lists as stacks in this fashion.
  void BP_PrintBlindSQLiResults(P_BP_WEB_ASSESSMENT assessment);
  
  // Utility to print out xss resuls (auto-invoked by PrintAssessments)
  void BP_PrintXssResultList(P_BP_WEB_XSS_TEST_RESULT inList);
  
  // Utility function to print out the values in the assessment
  void BP_PrintAssessments(P_BP_WEB_ASSESSMENT assessment);
  
  // Utility function to print list objects simply (debug function mainly)
  void BP_PrintWebAssessmentListLinkage(P_BP_WEB_ASSESSMENT assessment);
  
  
  // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  // %%%%%%%%%%%%%%%%%% ASSESSMENT DECONSTRUCTORS %%%%%%%%%%%%%%%%%%%%%%%%%%
  
  // Destroys a Valid Assessment
  size_t BP_DestroyAssessment(P_BP_WEB_ASSESSMENT assessment, bool destroySession, bool destroyExtraction, bool destroyResults);
  
  // Destroys an appError Result List
  size_t BP_DestroyAppErrorResults(P_BP_WEB_APPSERVER_TEST_RESULT results);
  
  // ERR_FAILURE if necessary pointers are unset
  size_t BP_CheckWebAssessmentPointers(P_BP_WEB_ASSESSMENT assessment);
  
  // Generates a test target based off a anchor.
  char *BP_WebExploitationGetAnchorRelativeTestTarget(P_BP_WEB_ASSESSMENT assessment, P_BP_HTML_ANCHOR_LIST anchor, size_t anchor_buff_len);
  
  // Generates a test target based off a form.
  char *BP_WebExploitationGetFormRelativeTestTarget(P_BP_WEB_ASSESSMENT assessment, P_BP_HTML_FORM_LIST form, size_t form_buff_len);
  
  #endif /* BPWEBEXPLOITATION_H_ */
  