mirror of https://github.com/gophish/gophish
86 lines
2.6 KiB
Go
86 lines
2.6 KiB
Go
|
package models
|
||
|
|
|
||
|
|
import (
|
||
|
|
"strings"
|
||
|
|
|
||
|
|
"github.com/PuerkitoBio/goquery"
|
||
|
|
"gopkg.in/check.v1"
|
||
|
|
)
|
||
|
|
|
||
|
|
func (s *ModelsSuite) TestPostPage(c *check.C) {
|
||
|
|
html := `<html>
|
||
|
|
<head></head>
|
||
|
|
<body><form action="example.com">
|
||
|
|
<input name="username"/>
|
||
|
|
<input name="password" type="password"/>
|
||
|
|
</form></body>
|
||
|
|
</html>`
|
||
|
|
p := Page{
|
||
|
|
Name: "Test Page",
|
||
|
|
HTML: html,
|
||
|
|
RedirectURL: "http://example.com",
|
||
|
|
}
|
||
|
|
// Check the capturing credentials and passwords
|
||
|
|
p.CaptureCredentials = true
|
||
|
|
p.CapturePasswords = true
|
||
|
|
err := PostPage(&p)
|
||
|
|
c.Assert(err, check.Equals, nil)
|
||
|
|
c.Assert(p.RedirectURL, check.Equals, "http://example.com")
|
||
|
|
d, err := goquery.NewDocumentFromReader(strings.NewReader(p.HTML))
|
||
|
|
c.Assert(err, check.Equals, nil)
|
||
|
|
forms := d.Find("form")
|
||
|
|
forms.Each(func(i int, f *goquery.Selection) {
|
||
|
|
// Check the action has been set
|
||
|
|
a, _ := f.Attr("action")
|
||
|
|
c.Assert(a, check.Equals, "")
|
||
|
|
// Check the password still has a name
|
||
|
|
_, ok := f.Find("input[type=\"password\"]").Attr("name")
|
||
|
|
c.Assert(ok, check.Equals, true)
|
||
|
|
// Check the username is still correct
|
||
|
|
u, ok := f.Find("input").Attr("name")
|
||
|
|
c.Assert(ok, check.Equals, true)
|
||
|
|
c.Assert(u, check.Equals, "username")
|
||
|
|
})
|
||
|
|
// Check what happens when we don't capture passwords
|
||
|
|
p.CapturePasswords = false
|
||
|
|
p.HTML = html
|
||
|
|
p.RedirectURL = ""
|
||
|
|
err = PutPage(&p)
|
||
|
|
c.Assert(err, check.Equals, nil)
|
||
|
|
c.Assert(p.RedirectURL, check.Equals, "")
|
||
|
|
d, err = goquery.NewDocumentFromReader(strings.NewReader(p.HTML))
|
||
|
|
c.Assert(err, check.Equals, nil)
|
||
|
|
forms = d.Find("form")
|
||
|
|
forms.Each(func(i int, f *goquery.Selection) {
|
||
|
|
// Check the action has been set
|
||
|
|
a, _ := f.Attr("action")
|
||
|
|
c.Assert(a, check.Equals, "")
|
||
|
|
// Check the password still has a name
|
||
|
|
_, ok := f.Find("input[type=\"password\"]").Attr("name")
|
||
|
|
c.Assert(ok, check.Equals, false)
|
||
|
|
// Check the username is still correct
|
||
|
|
u, ok := f.Find("input").Attr("name")
|
||
|
|
c.Assert(ok, check.Equals, true)
|
||
|
|
c.Assert(u, check.Equals, "username")
|
||
|
|
})
|
||
|
|
// Finally, check when we don't capture credentials
|
||
|
|
p.CaptureCredentials = false
|
||
|
|
p.HTML = html
|
||
|
|
err = PutPage(&p)
|
||
|
|
c.Assert(err, check.Equals, nil)
|
||
|
|
d, err = goquery.NewDocumentFromReader(strings.NewReader(p.HTML))
|
||
|
|
c.Assert(err, check.Equals, nil)
|
||
|
|
forms = d.Find("form")
|
||
|
|
forms.Each(func(i int, f *goquery.Selection) {
|
||
|
|
// Check the action has been set
|
||
|
|
a, _ := f.Attr("action")
|
||
|
|
c.Assert(a, check.Equals, "")
|
||
|
|
// Check the password still has a name
|
||
|
|
_, ok := f.Find("input[type=\"password\"]").Attr("name")
|
||
|
|
c.Assert(ok, check.Equals, false)
|
||
|
|
// Check the username is still correct
|
||
|
|
_, ok = f.Find("input").Attr("name")
|
||
|
|
c.Assert(ok, check.Equals, false)
|
||
|
|
})
|
||
|
|
}
|