pcap_test.go

package main

import (
	"os"
	"strings"
	"testing"

	"github.com/vulncheck-oss/go-exploit/db"
)

func TestConfluencePCAP(t *testing.T) {
	dbName := "./test/test.db"
	db.GlobalHTTPRespCacheLimit = 1000000
	if !db.InitializeDB(dbName) {
		t.Error("Failed to create the db")
	}
	defer os.Remove(dbName)

	if !DoPCAP("test/testdata/confluence-exploit.pcapng") {
		t.Error("Failed parsing of confluence pcap")
	}

	request, lookupOK := db.GetHTTPResponse("10.9.49.88", 8090, "/")
	if !lookupOK {
		t.Error("Failed DB lookup")
	}
	if !strings.HasPrefix(request, "HTTP/1.1 200") {
		t.Error("Failed to resolve '/'")
	}

	// payload is gzip encoded (which go exploit 1.21.1+ should handle)
	if !strings.Contains(request, "\x1f\x8b\x08") {
		t.Error("Failed to extract the body for '/'")
	}

	_, lookupOK = db.GetHTTPResponse("10.9.49.88", 8090, "/template/aui/text-inline.vm")
	if lookupOK {
		t.Error("Should not have found content for /template/aui/text-inline.vm")
	}
}