├── .gitignore ├── LICENSE ├── README.md ├── build.gradle.kts ├── gradle.properties ├── gradle └── wrapper │ ├── gradle-wrapper.jar │ └── gradle-wrapper.properties ├── gradlew ├── gradlew.bat ├── images └── reflect.png ├── settings.gradle.kts └── src └── main └── kotlin ├── ExtensionReflect.kt ├── ReflectActions.kt ├── ReflectHighlight.kt ├── ReflectListener.kt ├── ReflectOptions.kt └── ReflectPanel.kt /.gitignore: -------------------------------------------------------------------------------- 1 | .idea/ 2 | .gradle 3 | classes/ 4 | build/ 5 | .DS_Store -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright [yyyy] [name of copyright owner] 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Reflect 2 | 3 | An [OWASP Zed Attack Proxy (ZAP)](https://www.zaproxy.org) add-on to help find reflected parameter vulnerabilities. 4 | 5 | #### Features: 6 | 7 | * Inspect in scope urls for reflected parameters 8 | * Save requests/responses to table 9 | 10 | ![Reflect](/images/reflect.png) 11 | 12 | ## Install the Reflect add-on 13 | 14 | ### Download or build the extension 15 | #### Option 1: Download release 16 | You can find the latest release (ZAP file) [here](https://github.com/TypeError/reflect/releases). 17 | 18 | #### Option 2: Build the extension 19 | 20 | ```sh 21 | gradle build 22 | ``` 23 | 24 | Add-on ZAP file will be located at: `./build/zapAddOn/bin` 25 | 26 | ### Load the extension 27 | 1. Open OWASP ZAP 28 | 2. File 29 | 3. Load Add-on file 30 | 4. Select reflect `.zap` file -------------------------------------------------------------------------------- /build.gradle.kts: -------------------------------------------------------------------------------- 1 | import org.zaproxy.gradle.addon.AddOnStatus 2 | 3 | plugins { 4 | kotlin("jvm") version "1.4.30" 5 | id("org.zaproxy.add-on") version "0.4.0" 6 | } 7 | 8 | version = "0.0.11" 9 | description = "Finds reflected parameters" 10 | 11 | zapAddOn { 12 | addOnName.set("Reflect") 13 | addOnStatus.set(AddOnStatus.ALPHA) 14 | zapVersion.set("2.9.0") 15 | 16 | manifest { 17 | author.set("Caleb Kinney") 18 | } 19 | } 20 | 21 | repositories { 22 | mavenCentral() 23 | } 24 | 25 | dependencies { 26 | implementation(kotlin("stdlib-jdk8")) 27 | } 28 | 29 | tasks { 30 | compileKotlin { 31 | kotlinOptions.jvmTarget = "1.8" 32 | } 33 | } -------------------------------------------------------------------------------- /gradle.properties: -------------------------------------------------------------------------------- 1 | kotlin.code.style=official -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TypeError/reflect/a291a563536f575074d9bd90c2c5dcd2de320e93/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-6.7-bin.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /gradlew: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env sh 2 | 3 | # 4 | # Copyright 2015 the original author or authors. 5 | # 6 | # Licensed under the Apache License, Version 2.0 (the "License"); 7 | # you may not use this file except in compliance with the License. 8 | # You may obtain a copy of the License at 9 | # 10 | # https://www.apache.org/licenses/LICENSE-2.0 11 | # 12 | # Unless required by applicable law or agreed to in writing, software 13 | # distributed under the License is distributed on an "AS IS" BASIS, 14 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 15 | # See the License for the specific language governing permissions and 16 | # limitations under the License. 17 | # 18 | 19 | ############################################################################## 20 | ## 21 | ## Gradle start up script for UN*X 22 | ## 23 | ############################################################################## 24 | 25 | # Attempt to set APP_HOME 26 | # Resolve links: $0 may be a link 27 | PRG="$0" 28 | # Need this for relative symlinks. 29 | while [ -h "$PRG" ] ; do 30 | ls=`ls -ld "$PRG"` 31 | link=`expr "$ls" : '.*-> \(.*\)$'` 32 | if expr "$link" : '/.*' > /dev/null; then 33 | PRG="$link" 34 | else 35 | PRG=`dirname "$PRG"`"/$link" 36 | fi 37 | done 38 | SAVED="`pwd`" 39 | cd "`dirname \"$PRG\"`/" >/dev/null 40 | APP_HOME="`pwd -P`" 41 | cd "$SAVED" >/dev/null 42 | 43 | APP_NAME="Gradle" 44 | APP_BASE_NAME=`basename "$0"` 45 | 46 | # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 47 | DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' 48 | 49 | # Use the maximum available, or set MAX_FD != -1 to use that value. 50 | MAX_FD="maximum" 51 | 52 | warn () { 53 | echo "$*" 54 | } 55 | 56 | die () { 57 | echo 58 | echo "$*" 59 | echo 60 | exit 1 61 | } 62 | 63 | # OS specific support (must be 'true' or 'false'). 64 | cygwin=false 65 | msys=false 66 | darwin=false 67 | nonstop=false 68 | case "`uname`" in 69 | CYGWIN* ) 70 | cygwin=true 71 | ;; 72 | Darwin* ) 73 | darwin=true 74 | ;; 75 | MINGW* ) 76 | msys=true 77 | ;; 78 | NONSTOP* ) 79 | nonstop=true 80 | ;; 81 | esac 82 | 83 | CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar 84 | 85 | 86 | # Determine the Java command to use to start the JVM. 87 | if [ -n "$JAVA_HOME" ] ; then 88 | if [ -x "$JAVA_HOME/jre/sh/java" ] ; then 89 | # IBM's JDK on AIX uses strange locations for the executables 90 | JAVACMD="$JAVA_HOME/jre/sh/java" 91 | else 92 | JAVACMD="$JAVA_HOME/bin/java" 93 | fi 94 | if [ ! -x "$JAVACMD" ] ; then 95 | die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME 96 | 97 | Please set the JAVA_HOME variable in your environment to match the 98 | location of your Java installation." 99 | fi 100 | else 101 | JAVACMD="java" 102 | which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 103 | 104 | Please set the JAVA_HOME variable in your environment to match the 105 | location of your Java installation." 106 | fi 107 | 108 | # Increase the maximum file descriptors if we can. 109 | if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then 110 | MAX_FD_LIMIT=`ulimit -H -n` 111 | if [ $? -eq 0 ] ; then 112 | if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then 113 | MAX_FD="$MAX_FD_LIMIT" 114 | fi 115 | ulimit -n $MAX_FD 116 | if [ $? -ne 0 ] ; then 117 | warn "Could not set maximum file descriptor limit: $MAX_FD" 118 | fi 119 | else 120 | warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT" 121 | fi 122 | fi 123 | 124 | # For Darwin, add options to specify how the application appears in the dock 125 | if $darwin; then 126 | GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\"" 127 | fi 128 | 129 | # For Cygwin or MSYS, switch paths to Windows format before running java 130 | if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then 131 | APP_HOME=`cygpath --path --mixed "$APP_HOME"` 132 | CLASSPATH=`cygpath --path --mixed "$CLASSPATH"` 133 | 134 | JAVACMD=`cygpath --unix "$JAVACMD"` 135 | 136 | # We build the pattern for arguments to be converted via cygpath 137 | ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null` 138 | SEP="" 139 | for dir in $ROOTDIRSRAW ; do 140 | ROOTDIRS="$ROOTDIRS$SEP$dir" 141 | SEP="|" 142 | done 143 | OURCYGPATTERN="(^($ROOTDIRS))" 144 | # Add a user-defined pattern to the cygpath arguments 145 | if [ "$GRADLE_CYGPATTERN" != "" ] ; then 146 | OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)" 147 | fi 148 | # Now convert the arguments - kludge to limit ourselves to /bin/sh 149 | i=0 150 | for arg in "$@" ; do 151 | CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -` 152 | CHECK2=`echo "$arg"|egrep -c "^-"` ### Determine if an option 153 | 154 | if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then ### Added a condition 155 | eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"` 156 | else 157 | eval `echo args$i`="\"$arg\"" 158 | fi 159 | i=`expr $i + 1` 160 | done 161 | case $i in 162 | 0) set -- ;; 163 | 1) set -- "$args0" ;; 164 | 2) set -- "$args0" "$args1" ;; 165 | 3) set -- "$args0" "$args1" "$args2" ;; 166 | 4) set -- "$args0" "$args1" "$args2" "$args3" ;; 167 | 5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;; 168 | 6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;; 169 | 7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;; 170 | 8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;; 171 | 9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;; 172 | esac 173 | fi 174 | 175 | # Escape application args 176 | save () { 177 | for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done 178 | echo " " 179 | } 180 | APP_ARGS=`save "$@"` 181 | 182 | # Collect all arguments for the java command, following the shell quoting and substitution rules 183 | eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS" 184 | 185 | exec "$JAVACMD" "$@" 186 | -------------------------------------------------------------------------------- /gradlew.bat: -------------------------------------------------------------------------------- 1 | @rem 2 | @rem Copyright 2015 the original author or authors. 3 | @rem 4 | @rem Licensed under the Apache License, Version 2.0 (the "License"); 5 | @rem you may not use this file except in compliance with the License. 6 | @rem You may obtain a copy of the License at 7 | @rem 8 | @rem https://www.apache.org/licenses/LICENSE-2.0 9 | @rem 10 | @rem Unless required by applicable law or agreed to in writing, software 11 | @rem distributed under the License is distributed on an "AS IS" BASIS, 12 | @rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | @rem See the License for the specific language governing permissions and 14 | @rem limitations under the License. 15 | @rem 16 | 17 | @if "%DEBUG%" == "" @echo off 18 | @rem ########################################################################## 19 | @rem 20 | @rem Gradle startup script for Windows 21 | @rem 22 | @rem ########################################################################## 23 | 24 | @rem Set local scope for the variables with windows NT shell 25 | if "%OS%"=="Windows_NT" setlocal 26 | 27 | set DIRNAME=%~dp0 28 | if "%DIRNAME%" == "" set DIRNAME=. 29 | set APP_BASE_NAME=%~n0 30 | set APP_HOME=%DIRNAME% 31 | 32 | @rem Resolve any "." and ".." in APP_HOME to make it shorter. 33 | for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi 34 | 35 | @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 36 | set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" 37 | 38 | @rem Find java.exe 39 | if defined JAVA_HOME goto findJavaFromJavaHome 40 | 41 | set JAVA_EXE=java.exe 42 | %JAVA_EXE% -version >NUL 2>&1 43 | if "%ERRORLEVEL%" == "0" goto execute 44 | 45 | echo. 46 | echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 47 | echo. 48 | echo Please set the JAVA_HOME variable in your environment to match the 49 | echo location of your Java installation. 50 | 51 | goto fail 52 | 53 | :findJavaFromJavaHome 54 | set JAVA_HOME=%JAVA_HOME:"=% 55 | set JAVA_EXE=%JAVA_HOME%/bin/java.exe 56 | 57 | if exist "%JAVA_EXE%" goto execute 58 | 59 | echo. 60 | echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 61 | echo. 62 | echo Please set the JAVA_HOME variable in your environment to match the 63 | echo location of your Java installation. 64 | 65 | goto fail 66 | 67 | :execute 68 | @rem Setup the command line 69 | 70 | set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar 71 | 72 | 73 | @rem Execute Gradle 74 | "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* 75 | 76 | :end 77 | @rem End local scope for the variables with windows NT shell 78 | if "%ERRORLEVEL%"=="0" goto mainEnd 79 | 80 | :fail 81 | rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of 82 | rem the _cmd.exe /c_ return code! 83 | if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 84 | exit /b 1 85 | 86 | :mainEnd 87 | if "%OS%"=="Windows_NT" endlocal 88 | 89 | :omega 90 | -------------------------------------------------------------------------------- /images/reflect.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TypeError/reflect/a291a563536f575074d9bd90c2c5dcd2de320e93/images/reflect.png -------------------------------------------------------------------------------- /settings.gradle.kts: -------------------------------------------------------------------------------- 1 | rootProject.name = "reflect" 2 | 3 | -------------------------------------------------------------------------------- /src/main/kotlin/ExtensionReflect.kt: -------------------------------------------------------------------------------- 1 | package org.zaproxy.zap.extension.reflect 2 | 3 | import org.parosproxy.paros.extension.ExtensionAdaptor 4 | import org.parosproxy.paros.extension.ExtensionHook 5 | import org.parosproxy.paros.network.HttpSender 6 | import java.awt.EventQueue 7 | 8 | class ExtensionReflect : ExtensionAdaptor(NAME) { 9 | 10 | private var reflectPanel: ReflectPanel? = null 11 | private var reflectListener: ReflectListener? = null 12 | 13 | companion object { 14 | const val NAME = "Reflect" 15 | } 16 | 17 | override fun hook(extensionHook: ExtensionHook?) { 18 | super.hook(extensionHook) 19 | if (view != null) { 20 | reflectPanel = ReflectPanel() 21 | reflectPanel?.let { panel -> 22 | reflectListener = ReflectListener(panel) 23 | HttpSender.addListener(reflectListener) 24 | extensionHook?.hookView?.addStatusPanel(panel) 25 | } 26 | } 27 | } 28 | 29 | override fun unload() { 30 | HttpSender.removeListener(reflectListener) 31 | } 32 | 33 | override fun canUnload(): Boolean = true 34 | 35 | override fun getAuthor(): String = "Caleb Kinney" 36 | 37 | override fun getDescription(): String = "Finds reflected parameters." 38 | 39 | override fun postInstall() { 40 | super.postInstall() 41 | 42 | if (view != null) { 43 | EventQueue.invokeLater { 44 | reflectPanel?.setTabFocus() 45 | } 46 | } 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /src/main/kotlin/ReflectActions.kt: -------------------------------------------------------------------------------- 1 | package org.zaproxy.zap.extension.reflect 2 | 3 | import java.awt.Toolkit 4 | import java.awt.datatransfer.Clipboard 5 | import java.awt.datatransfer.StringSelection 6 | import java.awt.event.ActionEvent 7 | import java.awt.event.ActionListener 8 | import javax.swing.JMenuItem 9 | import javax.swing.JPopupMenu 10 | 11 | class ReflectionActions( 12 | private val panel: ReflectPanel 13 | ) : ActionListener { 14 | private val table = panel.table 15 | private val actionsMenu = JPopupMenu() 16 | private val copyURLs = JMenuItem("Copy URL(s)") 17 | private val deleteMenu = JMenuItem("Delete Reflection(s)") 18 | private val clearMenu = JMenuItem("Clear Reflections") 19 | 20 | init { 21 | copyURLs.addActionListener(this) 22 | deleteMenu.addActionListener(this) 23 | clearMenu.addActionListener(this) 24 | actionsMenu.apply { 25 | add(copyURLs) 26 | addSeparator() 27 | add(deleteMenu) 28 | add(clearMenu) 29 | } 30 | panel.table.componentPopupMenu = actionsMenu 31 | } 32 | 33 | override fun actionPerformed(e: ActionEvent?) { 34 | if (table.selectedRow == -1) return 35 | val selectedReflections = getSelectedReflections() 36 | when (e?.source) { 37 | deleteMenu -> { 38 | panel.model.removeReflection(selectedReflections) 39 | } 40 | clearMenu -> { 41 | panel.model.clearReflections() 42 | } 43 | copyURLs -> { 44 | val urls = selectedReflections.map { it.url }.joinToString() 45 | val clipboard: Clipboard = Toolkit.getDefaultToolkit().systemClipboard 46 | clipboard.setContents(StringSelection(urls), null) 47 | } 48 | } 49 | } 50 | 51 | private fun getSelectedReflections(): MutableList { 52 | val selectedReflections: MutableList = ArrayList() 53 | for (index in table.selectedRows) { 54 | val row = panel.rowSorter.convertRowIndexToModel(index) 55 | selectedReflections.add(panel.model.displayedReflections[row]) 56 | } 57 | return selectedReflections 58 | } 59 | } 60 | -------------------------------------------------------------------------------- /src/main/kotlin/ReflectHighlight.kt: -------------------------------------------------------------------------------- 1 | package org.zaproxy.zap.extension.reflect 2 | 3 | import org.parosproxy.paros.network.HttpMessage 4 | import org.parosproxy.paros.view.View 5 | import org.zaproxy.zap.extension.search.SearchMatch 6 | import java.net.URLDecoder 7 | 8 | class ReflectHighlight( 9 | private val reqRes: HttpMessage, 10 | private val headerTokens: List, 11 | private val bodyTokens: List 12 | ) { 13 | 14 | private val searchMatch: Pair by lazy { 15 | Pair( 16 | searchMatcher(headerTokens, SearchMatch.Location.RESPONSE_HEAD), 17 | searchMatcher(bodyTokens, SearchMatch.Location.RESPONSE_BODY) 18 | ) 19 | } 20 | 21 | fun highlight() { 22 | if (searchMatch.second != null) { 23 | View.getSingleton().responsePanel.highlightBody(searchMatch.second) 24 | } else if (searchMatch.first != null) { 25 | View.getSingleton().responsePanel.highlightHeader(searchMatch.first) 26 | } 27 | } 28 | 29 | private fun searchMatcher(tokens: List, searchLocation: SearchMatch.Location): SearchMatch? { 30 | val token = tokens.minByOrNull { it.length } ?: return null 31 | val pattern = token.toRegex() 32 | var match = if (searchLocation == SearchMatch.Location.RESPONSE_BODY) { 33 | pattern.find(reqRes.responseBody.toString()) 34 | } else { 35 | pattern.find(reqRes.responseHeader.toString()) 36 | } 37 | 38 | if (match == null) { 39 | val decodedPattern = URLDecoder.decode(token, "UTF-8").toRegex() 40 | match = if (searchLocation == SearchMatch.Location.RESPONSE_BODY) { 41 | decodedPattern.find(reqRes.responseBody.toString()) 42 | } else { 43 | decodedPattern.find(reqRes.responseHeader.toString()) 44 | } 45 | } 46 | 47 | return match?.let { matchResult -> 48 | SearchMatch( 49 | reqRes, 50 | searchLocation, 51 | matchResult.range.first, 52 | matchResult.range.last + 1 53 | ) 54 | } 55 | } 56 | } 57 | -------------------------------------------------------------------------------- /src/main/kotlin/ReflectListener.kt: -------------------------------------------------------------------------------- 1 | package org.zaproxy.zap.extension.reflect 2 | 3 | import org.apache.commons.httpclient.URI 4 | import org.apache.log4j.Logger 5 | import org.parosproxy.paros.network.HtmlParameter 6 | import org.parosproxy.paros.network.HttpHeader 7 | import org.parosproxy.paros.network.HttpMessage 8 | import org.parosproxy.paros.network.HttpSender 9 | import org.zaproxy.zap.network.HttpSenderListener 10 | import java.net.URLDecoder 11 | import java.time.LocalDateTime 12 | import java.time.format.DateTimeFormatter 13 | 14 | data class ReflectedResponse( 15 | val msg: HttpMessage, 16 | val dateTime: String, 17 | val host: String, 18 | val url: URI?, 19 | val path: String, 20 | val method: String, 21 | val statusCode: Int, 22 | val title: String, 23 | val length: String, 24 | val mimeType: String, 25 | val protocol: String, 26 | val parameters: String, 27 | val highlighter: ReflectHighlight 28 | ) 29 | 30 | class ReflectListener(private val reflectPanel: ReflectPanel) : HttpSenderListener { 31 | 32 | private val logger: Logger = Logger.getLogger(ReflectListener::class.java) 33 | 34 | override fun onHttpResponseReceive(msg: HttpMessage?, initiator: Int, sender: HttpSender?) { 35 | msg?.let { req -> 36 | findReflection(req) 37 | } 38 | } 39 | 40 | private fun findReflection(req: HttpMessage) { 41 | if (req.isInScope || reflectPanel.scopeCheckbox.isSelected) { 42 | val params = mutableSetOf() 43 | params.addAll(req.urlParams) 44 | params.addAll(req.formParams) 45 | val filteredParams = params.asSequence().filter { it.value.length >= 4 } 46 | val responseHeader = req.responseHeader.toString() 47 | val responseBody = req.responseBody.toString() 48 | 49 | val reflectedHeader = filteredParams 50 | .filter { 51 | reflectionFound(req, responseHeader, it.value) 52 | }.toSet() 53 | 54 | val reflectedBody = filteredParams 55 | .filter { 56 | reflectionFound(req, responseBody, it.value) 57 | }.toSet() 58 | 59 | val reflectedHeaderTokens = reflectedHeader.map { it.value }.toSet().toList() 60 | val reflectedBodyTokens = reflectedBody.map { it.value }.toSet().toList() 61 | val reflected = (reflectedHeader + reflectedBody).toSet().toList() 62 | if (reflected.isNotEmpty()) { 63 | val now = LocalDateTime.now() 64 | val dateFormatter = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss") 65 | val dateTime = now.format(dateFormatter) ?: "" 66 | val parameters = reflected.joinToString { "${it.name}=${it.value}" } 67 | val length = if (req.responseHeader.contentLength != -1) { 68 | req.responseHeader.contentLength.toString() 69 | } else { 70 | "" 71 | } 72 | val reqRes = ReflectedResponse( 73 | msg = req, 74 | dateTime = dateTime, 75 | host = req.requestHeader?.uri?.host ?: "", 76 | url = req.requestHeader?.uri, 77 | path = req.requestHeader.uri.path, 78 | method = req.requestHeader?.method ?: "", 79 | statusCode = req.responseHeader.statusCode, 80 | title = getTitle(responseBody), 81 | length = length, 82 | mimeType = req.responseHeader.getHeaderValues(HttpHeader.CONTENT_TYPE).toString(), 83 | protocol = req.requestHeader.uri.scheme, 84 | parameters = parameters, 85 | highlighter = ReflectHighlight(req, reflectedHeaderTokens, reflectedBodyTokens) 86 | ) 87 | reflectPanel.addReflection(reqRes) 88 | } 89 | } 90 | } 91 | 92 | private fun reflectionFound(req: HttpMessage, response: String, paramValue: String): Boolean { 93 | if (response.contains(paramValue)) { 94 | return true 95 | } 96 | 97 | return try { 98 | response.contains( 99 | URLDecoder.decode(paramValue, "UTF-8"), ignoreCase = true 100 | ) 101 | } catch (e: IllegalArgumentException) { 102 | logger.debug( 103 | "An error occurred URL decoding the parameter value: $paramValue on ${req.requestHeader?.uri} [Reflect add-on]", 104 | e 105 | ) 106 | return false 107 | } 108 | } 109 | 110 | private fun getTitle(responseBody: String): String { 111 | val titleRegex = "(.*?)".toRegex() 112 | val title = titleRegex.find(responseBody)?.value ?: "" 113 | return title.removePrefix("").removeSuffix("") 114 | } 115 | 116 | override fun getListenerOrder(): Int = 0 117 | 118 | override fun onHttpRequestSend(msg: HttpMessage?, initiator: Int, sender: HttpSender?) {} 119 | } 120 | -------------------------------------------------------------------------------- /src/main/kotlin/ReflectOptions.kt: -------------------------------------------------------------------------------- 1 | package org.zaproxy.zap.extension.reflect 2 | 3 | import java.awt.FlowLayout 4 | import javax.swing.JButton 5 | import javax.swing.JCheckBox 6 | import javax.swing.JLabel 7 | import javax.swing.JPanel 8 | import javax.swing.JSplitPane 9 | import javax.swing.JTextField 10 | import javax.swing.SwingUtilities 11 | 12 | class ReflectOptions( 13 | private val reflectPanel: ReflectPanel 14 | ) { 15 | val panel = JSplitPane(JSplitPane.HORIZONTAL_SPLIT) 16 | private val loadPanel = JPanel(FlowLayout(FlowLayout.RIGHT)) 17 | private val searchBar = JTextField("", 20) 18 | private val searchPanel = JPanel(FlowLayout(FlowLayout.LEFT)) 19 | val scopeCheckBox = JCheckBox("Collect out of scope requests") 20 | 21 | init { 22 | val clearButton = JButton("Clear Reflections") 23 | val searchLabel = JLabel("Search Reflections:") 24 | val searchButton = JButton("Search") 25 | val resetButton = JButton("Reset") 26 | clearButton.addActionListener { clearReflection() } 27 | searchBar.addActionListener { searchReflection() } 28 | searchButton.addActionListener { searchReflection() } 29 | resetButton.addActionListener { resetSearch() } 30 | loadPanel.add(clearButton) 31 | searchPanel.apply { 32 | add(searchLabel) 33 | add(searchBar) 34 | add(searchButton) 35 | add(resetButton) 36 | add(clearButton) 37 | } 38 | panel.leftComponent = searchPanel 39 | panel.rightComponent = loadPanel 40 | panel.dividerSize = 0 41 | } 42 | 43 | fun filtered(): Boolean { 44 | return if (searchBar.text.isNotEmpty()) { 45 | searchReflection() 46 | true 47 | } else { 48 | false 49 | } 50 | } 51 | 52 | private fun searchReflection() { 53 | SwingUtilities.invokeLater { 54 | val searchText = searchBar.text.toLowerCase() 55 | var filteredReflection = this.reflectPanel.reflections 56 | if (searchText.isNotEmpty()) { 57 | filteredReflection = filteredReflection 58 | .filter { 59 | it.url.toString().toLowerCase().contains(searchText) || 60 | it.msg.requestBody.toString().toLowerCase().contains( 61 | searchText 62 | ) || 63 | it.msg.responseBody.toString().toLowerCase().contains( 64 | searchText 65 | ) 66 | }.toMutableList() 67 | } 68 | reflectPanel.model.refreshReflections(filteredReflection) 69 | } 70 | } 71 | 72 | private fun resetSearch() { 73 | searchBar.text = "" 74 | reflectPanel.model.refreshReflections() 75 | } 76 | 77 | private fun clearReflection() { 78 | reflectPanel.model.clearReflections() 79 | } 80 | } 81 | -------------------------------------------------------------------------------- /src/main/kotlin/ReflectPanel.kt: -------------------------------------------------------------------------------- 1 | package org.zaproxy.zap.extension.reflect 2 | 3 | import org.parosproxy.paros.extension.AbstractPanel 4 | import org.parosproxy.paros.view.View 5 | import java.awt.BorderLayout 6 | import javax.swing.JScrollPane 7 | import javax.swing.JSplitPane 8 | import javax.swing.JTable 9 | import javax.swing.ListSelectionModel 10 | import javax.swing.SwingUtilities 11 | import javax.swing.table.AbstractTableModel 12 | import javax.swing.table.TableRowSorter 13 | 14 | class ReflectPanel : AbstractPanel() { 15 | val model = ReflectionsModel() 16 | val table = JTable(model) 17 | val reflections = model.reflections 18 | private val reflectionOptions = ReflectOptions(this) 19 | val scopeCheckbox = reflectionOptions.scopeCheckBox 20 | private val panel = JSplitPane(JSplitPane.VERTICAL_SPLIT) 21 | val rowSorter = TableRowSorter(model) 22 | 23 | init { 24 | ReflectionActions(this) 25 | table.autoResizeMode = JTable.AUTO_RESIZE_ALL_COLUMNS 26 | table.columnModel.getColumn(0).preferredWidth = 50 // ID 27 | table.columnModel.getColumn(1).preferredWidth = 50 // method 28 | table.columnModel.getColumn(2).preferredWidth = 120 // host 29 | table.columnModel.getColumn(3).preferredWidth = 450 // params 30 | table.columnModel.getColumn(4).preferredWidth = 250 // path 31 | table.columnModel.getColumn(5).preferredWidth = 150 // title 32 | table.columnModel.getColumn(6).preferredWidth = 145 // date 33 | table.columnModel.getColumn(7).preferredWidth = 50 // status 34 | table.columnModel.getColumn(8).preferredWidth = 50 // length 35 | table.columnModel.getColumn(9).preferredWidth = 100 // mime 36 | table.columnModel.getColumn(10).preferredWidth = 100 // protocol 37 | table.setSelectionMode(ListSelectionModel.MULTIPLE_INTERVAL_SELECTION) 38 | table.rowSorter = rowSorter 39 | table.autoscrolls = true 40 | 41 | table.selectionModel.addListSelectionListener { 42 | if (table.selectedRow != -1) { 43 | SwingUtilities.invokeLater { 44 | val displayedReflections = model.displayedReflections 45 | val selectedRow = table.convertRowIndexToModel(table.selectedRow) 46 | val requestResponse = displayedReflections[selectedRow].msg 47 | View.getSingleton().displayMessage(requestResponse) 48 | displayedReflections[selectedRow].highlighter.highlight() 49 | } 50 | } 51 | } 52 | name = "Reflect" 53 | layout = BorderLayout() 54 | val reflectionsTable = JScrollPane(table) 55 | panel.topComponent = reflectionOptions.panel 56 | panel.bottomComponent = reflectionsTable 57 | add(panel) 58 | } 59 | 60 | fun addReflection(reflection: ReflectedResponse) { 61 | reflections.add(reflection) 62 | if (!reflectionOptions.filtered()) 63 | model.refreshReflections() 64 | } 65 | } 66 | 67 | class ReflectionsModel : AbstractTableModel() { 68 | private val columns = 69 | listOf( 70 | "ID", 71 | "Method", 72 | "Host", 73 | "Reflected Parameters", 74 | "Path", 75 | "Title", 76 | "Added", 77 | "Status", 78 | "Length", 79 | "MIME", 80 | "Protocol" 81 | ) 82 | var reflections: MutableList = ArrayList() 83 | var displayedReflections: MutableList = ArrayList() 84 | private set 85 | 86 | override fun getRowCount(): Int = displayedReflections.size 87 | 88 | override fun getColumnCount(): Int = columns.size 89 | 90 | override fun getColumnName(column: Int) = columns[column] 91 | 92 | override fun getColumnClass(columnIndex: Int): Class<*> { 93 | return when (columnIndex) { 94 | 0 -> java.lang.Integer::class.java 95 | in 1..10 -> String::class.java 96 | else -> throw IndexOutOfBoundsException("$columnIndex is out of bounds.") 97 | } 98 | } 99 | 100 | override fun getValueAt(rowIndex: Int, columnIndex: Int): Any { 101 | val reflection = displayedReflections[rowIndex] 102 | 103 | return when (columnIndex) { 104 | 0 -> rowIndex 105 | 1 -> reflection.method 106 | 2 -> reflection.host 107 | 3 -> reflection.parameters 108 | 4 -> reflection.path 109 | 5 -> reflection.title 110 | 6 -> reflection.dateTime 111 | 7 -> reflection.statusCode.toString() 112 | 8 -> reflection.length 113 | 9 -> reflection.mimeType 114 | 10 -> reflection.protocol 115 | else -> "" 116 | } 117 | } 118 | 119 | fun removeReflection(reflection: MutableList) { 120 | reflections.removeAll(reflection) 121 | refreshReflections() 122 | } 123 | 124 | fun clearReflections() { 125 | reflections.clear() 126 | refreshReflections() 127 | } 128 | 129 | fun refreshReflections(updatedReflection: MutableList = reflections) { 130 | displayedReflections = updatedReflection 131 | fireTableDataChanged() 132 | } 133 | } 134 | --------------------------------------------------------------------------------