WebScarab Template - DOS Testing

The series of WebScarab templates continues. Today's entry is for the "Scripted" portion of WebScarab . The below code will allow you to send numerous parallel requests to your target. This is effective for testing how an application handles a large number of requests for some sort of intensive operation. As always, I provide this information to help the authorized security assessors. For all others, you are on your own.

FYI, there are several other WebScarab templates. You can find links to them on the right side of the page and also included below:

• WebScarab Bean Shell
• WebScarab Scripted
• WebScarab Search Plugin

-Michael Coates

---

/* ======================================= */
/* Provided by http://michael-coates.blogspot.com */
/* ======================================= */

import org.owasp.webscarab.model.ConversationID;
import org.owasp.webscarab.model.HttpUrl;
import org.owasp.webscarab.model.Request;
import org.owasp.webscarab.model.Response;

// define subroutines BEFORE the main part of the script executes,
// otherwise they won't be found

//========================================
//printRequestSmall method
// Optional use this if desired by calling within editable section
void printRequestSmall(Request request){
out.println("Req "+i+" of "+TotalRequests+" to "+request.getMethod()+" "+request.getURL());
}

//========================================
//printRequest method
// Optional use this if desired by calling within editable section
void printRequest(Request request){
out.println("========");
out.println(request.getMethod());
out.println(request.getURL());
out.println(request.getVersion());
String[] headers=request.getHeaderNames();
for(String header : headers){
out.println(header+" : " + request.getHeader(header));
}
out.println("========");
}

//========================================
//printResponse method
// Optional use this if desired by calling within editable section
void printResponse(Response response){
out.println("========");
out.println(response.getStatus());
out.println(response.getMessage());
//print the headers
String[] headers=response.getHeaderNames();
for(String header : headers){
out.println(header+" : " + response.getHeader(header));
}
out.println("");
//print the content
byte[] data=response.getContent();
String data_response=new String(data);
out.println(data_response);

out.println("========");
}

// call this to fetch them in parallel
// the number of simultaneous connections is unbounded
// requests will be sent as fast as possible until reaching the
// limit set in the section at the end
void fetchParallel() {
while (hasMoreRequests() || scripted.isAsyncBusy()) {
while (hasMoreRequests()) {
request = getNextRequest();
scripted.submitAsyncRequest(request);
//printRequest(request);
printRequestSmall(request);
}

if (scripted.hasAsyncResponse()) {
while (scripted.hasAsyncResponse()) {
response = scripted.getAsyncResponse();
request = response.getRequest();
//printResponse(response);
}
} else Thread.sleep(100);
}
}

// a counter, so we can know when to stop
int i=0;
int TotalRequests;
boolean hasMoreRequests() {
return i < TotalRequests;
}

/******************************************************************************
***************** USER EDITABLE SCRIPT STARTS HERE ***************************
* *
* Of course, you can modify the bits above, but you shouldn't need *
* to, if you follow the algorithm suggested below. *
* *
******************************************************************************/
//====Set the number below equal to the total number of requests====
TotalRequests=5;

// modify this routine to construct the next request - no changes needed
Request getNextRequest() {
// create a new request copied from the template
Request request = new Request(template);
i++;
return request;
}

//====Edit this section====
// create a template that contains the basics
Request template = new Request();
template.setMethod("GET");
template.setURL(new HttpUrl("http://www..com"));
template.setVersion("HTTP/1.0");
template.setHeader("User-Agent","WebScarab");
template.setHeader("Host","www.google.com:80");
template.setHeader("Accept"," text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5");
template.setHeader("Accept-Language"," en-us,en;q=0.5");
template.setHeader("Accept-Encoding"," gzip,deflate");
template.setHeader("Accept-Charset"," ISO-8859-1,utf-8;q=0.7,*;q=0.7");
template.setHeader("Keep-Alive"," 300");
template.setHeader("Proxy-Connection"," keep-alive");
//template.setHeader("Cookie"," Some cookie values here");

//===Fetch in Parallel===
fetchParallel();