Refactored code

config/hard/owasp_juice_shop_config.json

@@ -1,5 +1,12 @@
 {
   "name": "OWASP Juice Shop",
+  "bender": {
+    "email": "bender@juice-sh.op",
+    "password": "a"
+  },
+  "admin": {
+    "email": " admin@juice-sh.op"
+  },
   "username": "sdfdzasasdaasdasdsdwerwddd@mail",
   "password": "test",
   "token": "your_api_token_here",

src/hackingBuddyGPT/usecases/web_api_testing/documentation/parsing/openapi_parser.py

@@ -155,7 +155,7 @@ def get_schema_for_endpoint(self, path, method):
 
         return None
 
-    def classify_endpoints(self):
+    def classify_endpoints(self, name=""):
         classifications = {
             'resource_intensive_endpoint': [],
             'public_endpoint': [],
@@ -272,6 +272,9 @@ def classify_endpoints(self):
                 if any(keyword in path.lower() for keyword in ['user', 'users', 'signup']) and not "login" in path or any(word in description for word in ['create a user']):
                     if not any(keyword in path.lower() for keyword in ['pictures', 'verify-email-token', 'change-email', "reset", "verify", "videos", "mechanic"]):
                         if method.upper() == "POST" and not "data-export" in path:
+                            if "OWASP" in name:
+                                if "sers" not in path :
+                                    continue
                             classifications["account_creation"].append({
                             "method":method.upper(),
                             "path":path,

src/hackingBuddyGPT/usecases/web_api_testing/prompt_generation/prompt_generation_helper.py

@@ -3,10 +3,6 @@
 import re
 import uuid
 
-import nltk
-
-from hackingBuddyGPT.usecases.web_api_testing.prompt_generation.information import PromptStrategy
-
 
 class PromptGenerationHelper(object):
     """
@@ -82,18 +78,24 @@ def get_user_from_prompt(self,step, accounts) -> dict:
         step = step["step"]
         # Search for the substring containing 'user:'
         if "user:" in step:
-                # Extract the part after 'user:' and add it to the user_info list
-                data_string = step.split("user:")[1].split(".\n")[0]
-                # Replace single quotes with double quotes for JSON compatibility
-                data_string_json = data_string.replace("'", '"')
-
-
-                # Parse the string into a dictionary
-                user_info = json.loads(data_string_json)
+            # Extract the part after 'user:' and add it to the user_info list
+            data_string = step.split("user:")[1].split(".\n")[0]
+            # Replace single quotes with double quotes for JSON compatibility
+
+            data_string_json = data_string.replace("'", '"')
+            print(f'data_string_json: {data_string_json}')
+            data_string_json = data_string_json.replace("\"\" ", '" ')
+            print(f'data_string_json: {data_string_json}')
+
+            # Parse the string into a dictionary
+            user_info = json.loads(data_string_json)
+            print(f'user_info: {user_info}')
         counter =0
         for acc in accounts:
             for key in acc.keys():
                 if key in user_info.keys():
+                    if isinstance(acc[key], str) and "or 1=1--" in acc[key]:
+                        acc[key] = "' or 1=1--"
                     if key != "x":
                         if acc[key] == user_info[key]:
                             counter +=1

src/hackingBuddyGPT/usecases/web_api_testing/prompt_generation/prompts/basic_prompt.py

@@ -1,7 +1,5 @@
 from abc import ABC, abstractmethod
 from typing import Optional
-
-# from hackingBuddyGPT.usecases.web_api_testing.prompt_generation import PromptGenerationHelper
 from hackingBuddyGPT.usecases.web_api_testing.prompt_generation.information import (
     PenTestingInformation,
 )
@@ -47,7 +45,10 @@ def __init__(
         self.planning_type = planning_type
         self.prompt_helper = prompt_helper
         self.strategy = strategy
-        self.current_step = None
+        self.current_step = 0
+        self.explored_sub_steps = []
+        self.previous_purpose = None
+        self.counter = 0
 
     def set_pentesting_information(self, pentesting_information: PenTestingInformation):
         self.pentesting_information = pentesting_information
@@ -119,3 +120,121 @@ def get_documentation_steps(self):
                 "Construct and make GET requests to these endpoints using common query parameters (e.g. `/resource?param1=1&param2=3`) or based on documentation hints, testing until a valid request with query parameters is achieved."
             ]
         ]
+    def extract_properties(self):
+        properties = self.open_api_spec.get("components", {}).get("schemas", {}).get("Post", {}).get("properties", {})
+        extracted_props = {}
+
+        for prop_name, prop_details in properties.items():
+            example = prop_details.get("example", "No example provided")
+            prop_type = prop_details.get("type", "Unknown type")
+            extracted_props[prop_name] = {
+                "example": example,
+                "type": prop_type
+            }
+
+        return extracted_props
+
+    def sort_previous_prompt(self, previous_prompt):
+        sorted_list = []
+        for i in range(len(previous_prompt) - 1, -1, -1):
+            sorted_list.append(previous_prompt[i])
+        return sorted_list
+
+
+    def extract_endpoints_from_prompts(self, step):
+        endpoints = []
+        # Extract endpoints from the text using simple keyword matching
+        if isinstance(step, list):
+            step = step[0]
+        if "endpoint" in step.lower():
+            words = step.split()
+            for word in words:
+                if word.startswith("https://") or word.startswith("/") and len(word) > 1:
+                    endpoints.append(word)
+
+        return list(set(endpoints))  # Return unique endpoints
+
+
+
+    def get_properties(self, step_details):
+        endpoints = self.extract_endpoints_from_prompts(step_details['step'])
+        for endpoint in endpoints:
+            for keys in self.pentesting_information.categorized_endpoints:
+                for ep in self.pentesting_information.categorized_endpoints[keys]:
+                    print(f'ep:{ep}')
+
+                    if ep["path"] == endpoint:
+                        print(f'ep:{ep}')
+                        print(f' endpoint: {endpoint}')
+                        schema = ep.get('schema', {})
+                        if schema != None and schema != {}:
+                            properties = schema.get('properties', {})
+                        else:
+                            properties = None
+                        return properties
+
+    def next_purpose(self, step, icl_steps, purpose):
+        # Process the step and return its result
+        last_item = icl_steps[-1]
+        if self.check_if_step_is_same(last_item, step):
+            # If it's the last step, remove the purpose and update self.purpose
+            if purpose in self.pentesting_information.pentesting_step_list:
+                self.pentesting_information.pentesting_step_list.remove(purpose)
+            if self.pentesting_information.pentesting_step_list:
+                self.purpose = self.pentesting_information.pentesting_step_list[0]
+
+            self.counter = 0 # Reset counter
+            print(f'purpose:{self.purpose}')
+
+    def check_if_step_is_same(self, step1, step2):
+        # Check if 'steps' and 'path' are identical
+        steps_same = (step1.get('steps', [])[0] == step2.get('steps', [])[0].get("step"))
+        print(f'step1: {step1}')
+        print(f'step2: {step2}')
+        #path_same = (step1.get('path', []) == step2.get('path', []))
+
+        # Check if 'expected_response_code' are identical
+        #response_code_same = (
+                    #
+        # Check if 'security' instructions are the same
+        #security_same = (step1.get('security', []) == step2.get('security', []))
+
+        # Evaluate and return the overall comparison
+        return steps_same
+    def all_substeps_explored(self, icl_steps):
+        all_steps = []
+        for step in icl_steps.get("steps") :
+            all_steps.append(step)
+
+        if all_steps in self.explored_sub_steps:
+            return True
+        else:
+            return False
+
+    def get_props(self, data, result ):
+        for key, value in data.items():
+
+            if isinstance(value, dict):
+
+                # Recursively extract properties from nested dictionaries
+
+                nested_properties = self.extract_properties_with_examples(value)
+
+                result.update(nested_properties)
+
+            elif isinstance(value, list):
+
+                if value:
+
+                    example_value = value[0]
+
+                    result[key] = {"type": "list", "example": example_value}
+
+                else:
+
+                    result[key] = {"type": "list", "example": "[]"}
+            else:
+
+                result[key] = {"type": type(value).__name__, "example": value}
+
+        return result

src/hackingBuddyGPT/usecases/web_api_testing/prompt_generation/prompts/state_learning/in_context_learning_prompt.py

@@ -1,7 +1,5 @@
 import json
 from typing import Dict, Optional, Any, List
-from unittest import result
-
 from hackingBuddyGPT.usecases.web_api_testing.prompt_generation.information.prompt_information import (
     PromptContext,
     PromptPurpose,
@@ -46,10 +44,7 @@ def __init__(self, context: PromptContext, prompt_helper, context_information: D
         self.open_api_spec = open_api_spec
         self.response_history = {
         }
-        self.current_step = 0
-        self.explored_sub_steps =[]
-        self.previous_purpose = None
-        self.counter = 0
+
 
 
     def generate_prompt(
@@ -163,10 +158,13 @@ def _get_pentesting_steps(self, move_type: str, common_step: Optional[str] = "")
                         # single step test case
                         if len(icl_test_case.get("steps")) == 1:
                             self.current_sub_step = icl_test_case.get("steps")[0]
+                            self.current_sub_step["path"] = icl_test_case.get("path")[0]
                         else:
                             if self.counter < len(icl_test_case.get("steps")):
                                 # multi-step test case
                                 self.current_sub_step = icl_test_case.get("steps")[self.counter]
+                                if len(icl_test_case.get("path")) > 1:
+                                    self.current_sub_step["path"] = icl_test_case.get("path")[self.counter]
                             self.explored_sub_steps.append(self.current_sub_step)
                         self.explored_steps.append(icl_test_case)
 
@@ -190,19 +188,7 @@ def _get_pentesting_steps(self, move_type: str, common_step: Optional[str] = "")
     import json
 
     # Function to extract properties from the schema
-    def extract_properties(self):
-        properties = self.open_api_spec.get("components", {}).get("schemas", {}).get("Post", {}).get("properties", {})
-        extracted_props = {}
-
-        for prop_name, prop_details in properties.items():
-            example = prop_details.get("example", "No example provided")
-            prop_type = prop_details.get("type", "Unknown type")
-            extracted_props[prop_name] = {
-                "example": example,
-                "type": prop_type
-            }
 
-        return extracted_props
 
     # Function to extract example response from paths
     def extract_example_response(self, api_paths, endpoint, method="get"):
@@ -282,11 +268,6 @@ def extract_properties_with_examples(self, data):
 
         return result
 
-    def sort_previous_prompt(self, previous_prompt):
-        sorted_list = []
-        for i in range(len(previous_prompt) - 1, -1, -1):
-            sorted_list.append(previous_prompt[i])
-        return sorted_list
 
     def transform_to_icl_with_previous_examples(self, test_case, purpose):
         """
@@ -307,7 +288,8 @@ def transform_to_icl_with_previous_examples(self, test_case, purpose):
         transformed_case = {
             "phase_title": f"Phase: {test_case['objective']}",
             "steps": [],
-            "assessments": []
+            "assessments": [],
+            "path": test_case.get("path")
         }
 
         print(f' PHASE: {test_case["objective"]}')
@@ -364,18 +346,6 @@ def transform_to_icl_with_previous_examples(self, test_case, purpose):
 
         return transformed_case
 
-    def extract_endpoints_from_prompts(self, step):
-        endpoints = []
-        # Extract endpoints from the text using simple keyword matching
-        if isinstance(step, list):
-            step = step[0]
-        if "endpoint" in step.lower():
-            words = step.split()
-            for word in words:
-                if word.startswith("https://") or word.startswith("/") and len(word) > 1:
-                    endpoints.append(word)
-
-        return list(set(endpoints))  # Return unique endpoints
 
     def transform_test_case_to_string(self, test_case, character):
         """
@@ -424,85 +394,7 @@ def transform_test_case_to_string(self, test_case, character):
 
         return ''.join(result)
 
-    def get_properties(self, step_details):
-        endpoints = self.extract_endpoints_from_prompts(step_details['step'])
-        for endpoint in endpoints:
-            for keys in self.pentesting_information.categorized_endpoints:
-                for ep in self.pentesting_information.categorized_endpoints[keys]:
-                    print(f'ep:{ep}')
-
-                    if ep["path"] == endpoint:
-                        print(f'ep:{ep}')
-                        print(f' endpoint: {endpoint}')
-                        schema = ep.get('schema', {})
-                        if schema != None and schema != {}:
-                            properties = schema.get('properties', {})
-                        else:
-                            properties = None
-                        return properties
-
-    def next_purpose(self, step, icl_steps, purpose):
-        # Process the step and return its result
-        last_item = icl_steps[-1]
-        if self.check_if_step_is_same(last_item, step):
-            # If it's the last step, remove the purpose and update self.purpose
-            if purpose in self.pentesting_information.pentesting_step_list:
-                self.pentesting_information.pentesting_step_list.remove(purpose)
-            if self.pentesting_information.pentesting_step_list:
-                self.purpose = self.pentesting_information.pentesting_step_list[0]
-
-            self.counter = 0 # Reset counter
-
-    def check_if_step_is_same(self, step1, step2):
-        # Check if 'steps' and 'path' are identical
-        steps_same = (step1.get('steps', [])[0] == step2.get('steps', [])[0].get("step"))
-        #path_same = (step1.get('path', []) == step2.get('path', []))
-
-        # Check if 'expected_response_code' are identical
-        #response_code_same = (
-                    #
-        # Check if 'security' instructions are the same
-        #security_same = (step1.get('security', []) == step2.get('security', []))
-
-        # Evaluate and return the overall comparison
-        return steps_same
-    def all_substeps_explored(self, icl_steps):
-        all_steps = []
-        for step in icl_steps.get("steps") :
-            all_steps.append(step)
-
-        if all_steps in self.explored_sub_steps:
-            return True
-        else:
-            return False
-
-    def get_props(self, data, result ):
-        for key, value in data.items():
-
-            if isinstance(value, dict):
-
-                # Recursively extract properties from nested dictionaries
-
-                nested_properties = self.extract_properties_with_examples(value)
-
-                result.update(nested_properties)
 
-            elif isinstance(value, list):
-
-                if value:
-
-                    example_value = value[0]
-
-                    result[key] = {"type": "list", "example": example_value}
-
-                else:
-
-                    result[key] = {"type": "list", "example": "[]"}
-            else:
-
-                result[key] = {"type": type(value).__name__, "example": value}
-
-        return result