【Web攻击最佳实践】1. Race Window

# if the target supports HTTP/2, use engine=Engine.BURP2 to trigger the single-packet attack
# if they only support HTTP/1, use Engine.THREADED or Engine.BURP instead
# for more information, check out https://portswigger.net/research/smashing-the-state-machine
engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=1,
                           engine=Engine.BURP2
                           )

# the 'gate' argument withholds part of each request until openGate is invoked
# if you see a negative timestamp, the server responded before the request was complete
for i in range(20):
    engine.queue(target.req, gate='race1')

# once every 'race1' tagged request has been queued
# invoke engine.openGate() to send them in sync
engine.openGate('race1')

open class RequestEngine {
    // 存储所有gate
    protected val gates = HashMap<String, Floodgate>()
    
    // 请求队列
    protected val requestQueue = LinkedBlockingQueue<Request>()
    
    init {
        // 根据不同engine类型创建具体实现
        when (engineType) {
            Engine.SPIKE -> engine = SpikeEngine()
            Engine.HTTP2 -> engine = HTTP2RequestEngine()
            Engine.THREADED -> engine = ThreadedRequestEngine()
            // ...
        }
    }
}

fun queue(template: String, payloads: List<String>, gate: String?) {
    // 1. 如果指定了gate，创建或获取Floodgate
    val floodgate = if(gate != null) {
        gates.getOrPut(gate) { Floodgate(gate, this) }
    } else null
    
    // 2. 创建Request对象
    val request = Request(
        template = template,
        payloads = payloads,
        gate = floodgate
    )
    
    // 3. 将请求加入队列
    requestQueue.offer(request)

init {
        requestQueue = if (maxQueueSize > 0) {
            LinkedBlockingQueue(maxQueueSize)
        }
        else {
            LinkedBlockingQueue()
        }

        idleTimeout *= 1000
        threadLauncher = DefaultThreadLauncher()
        socketFactory = TrustAllSocketFactory()
        target = URL(url)
        val retryQueue = LinkedBlockingQueue<Request>()

        completedLatch = CountDownLatch(threads)
        for(j in 1..threads) {
            thread {
                // create engine时候会启动发送报文线程，但此时会阻塞
                sendRequests(retryQueue)
            }
        }
    }
    

private fun sendRequests(retryQueue: LinkedBlockingQueue<Request>) {
    while (!shouldAbandonAttack()) {
        // 1. 阻塞等待获取第一个请求
        val req = requestQueue.take()  // 这里会等待直到队列中有请求
        
        if (req.gate != null) {
            val gatedReqs = ArrayList<Request>()
            req.gate!!.reportReadyWithoutWaiting()

            // 将queue的报文陆续添加到req里
            gatedReqs.add(req)
            
            // 2. 继续收集同一个gate的请求，直到gate打开或所有请求就绪
            while (!req.gate!!.isOpen.get() && !shouldAbandonAttack()) {
                val nextReq = requestQueue.poll(50, TimeUnit.MILLISECONDS) 
                    ?: throw RuntimeException("Gate deadlock")
                    
                if (nextReq.gate!!.name != req.gate!!.name) {
                    throw RuntimeException("Over-read while waiting for gate to open")
                }
                
                nextReq.connectionID = connectionID
                gatedReqs.add(nextReq)
                
                // 如果所有请求都收集完毕，跳出循环
                if (nextReq.gate!!.reportReadyWithoutWaiting()) {
                    break
                }
            }
            
            // 3. 开始发送请求...
            // 4. 先发送0~last-1的字节
            connection.sendFrames(prepFrames)
            Thread.sleep(100) // headstart size

            for (gatedReq in gatedReqs) {
                gatedReq.time = System.nanoTime()
            }

            // 5. 本地协议栈热身
            if (warmLocalConnection) {
                val warmer = burp.network.stack.http2.frame.PingFrame("12345678".toByteArray())
                // val warmer = burp.network.stack.http2.frame.DataFrame(finalFrames[0].Q, FrameFlags(0), "".toByteArray())
                // using an empty data frame upsets some servers
                connection.sendFrames(warmer) // just send it straight away
                //finalFrames.add(0, warmer)
            }

            // 6. 先发送last-1~last的字节
            for (pair in finalFrames) {
                //Utils.out("Sending final frame")
                if (pair.second != 0L) {
                    //Utils.out("Sleeping for "+pair.second)
                    // fixme response arrives before this frame is sent!
                    Thread.sleep(pair.second)
                }
                //Utils.out("Finished sleeping")
                connection.sendFrames(pair.first)
            }
        }
    }
}

class Floodgate {
    fun openGate(gateName: String) {
        val gate = gates[gateName] ?: return
        
        // 等待所有请求就绪
        while (gate.remaining.get() > 0) {
            synchronized(gate.remaining) {
                gate.remaining.wait()
            }
        }
        
        // 打开gate
        synchronized(gate.isOpen) {
            gate.isOpen.set(true)
            gate.isOpen.notifyAll()
        }
    }
}