metasploit-framework/data/msfcrawler/forms.rb

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

# $Revision$

require 'rubygems'
require 'pathname'
require 'hpricot'
require 'uri'

class CrawlerForms < BaseParser

  def parse(request,result)

    if !result['Content-Type'].include? "text/html"
      return
    end

    hr = ''
    m = ''

    doc = Hpricot(result.body.to_s)
    doc.search('form').each do |f|
      hr = f.attributes['action']

      fname = f.attributes['name']
      if fname.empty?
        fname = "NONE"
      end

      m = "GET"
      if !f.attributes['method'].empty?
        m = f.attributes['method'].upcase
      end

      #puts "Parsing form name: #{fname} (#{m})"

      htmlform = Hpricot(f.inner_html)

      arrdata = []

      htmlform.search('input').each do |p|
        #puts p.attributes['name']
        #puts p.attributes['type']
        #puts p.attributes['value']

        #raw_request has uri_encoding disabled as it encodes '='.
        arrdata << (p.attributes['name'] + "=" + Rex::Text.uri_encode(p.attributes['value']))
      end

      data = arrdata.join("&").to_s


      begin
        hreq = urltohash(m,hr,request['uri'],data)

        hreq['ctype'] = 'application/x-www-form-urlencoded'

        insertnewpath(hreq)


      rescue URI::InvalidURIError
        #puts "Parse error"
        #puts "Error: #{link[0]}"
      end
    end
  end
end