Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add some kind of debugging messages / audit log #35

Open
postmodern opened this issue Feb 3, 2023 · 0 comments
Open

Add some kind of debugging messages / audit log #35

postmodern opened this issue Feb 3, 2023 · 0 comments
Assignees
Labels
discussion Topic is open to discussion feature New Feature

Comments

@postmodern
Copy link
Member

postmodern commented Feb 3, 2023

Some users will want to see what the ronin-vulns commands are doing behind the scenes when testing URLs for vulnerabilities. We will need to somehow need to log/save the requests, responses, and what payload was used.

Option 1: logger

A logger object could be passed into WebVuln#initialize and the #vulnerable? methods could use it to write debug messages. This would be the quickest way to expose what exactly is being done, but would mix CLI messages into the web vulnerability classes; I would like to keep all CLI formatting logic in Ronin::Vulns::CLI.

Option 2: instance variables

A quick-and-dirty solution might be to add instance variables to store the payload used, the request, and the response objects.

Option 3: an Audit Event Array

A more data-orientated approach might be to store structured AuditEvent objects into some kind of AuditLog object, which would behave like an Array. This would allow tracking fine grained events and inspecting them with other Ruby code.

Option 4: an Audit Event callback

Instead of storing audit events in a list and inspecting them later, we could initialize WebVuln with some kind of event_callback which could be passed the AuditEvent objects as they are created. This could also be used to convert the event objects into debug messages, or save them to a JSON file, etc.

@postmodern postmodern added discussion Topic is open to discussion feature New Feature labels Feb 3, 2023
@postmodern postmodern self-assigned this Feb 3, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
discussion Topic is open to discussion feature New Feature
Projects
None yet
Development

No branches or pull requests

1 participant