pett.bsh

/* Privilege Escalation Testing Tool (PETT) 
 * Copyright (c) 2012, Sebastian Banescu
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without 
 * modification, are permitted provided that the following conditions are met:
 * 
 * Redistributions of source code must retain the above copyright notice, this 
 * list of conditions and the following disclaimer.
 * 
 * Redistributions in binary form must reproduce the above copyright notice, this
 * list of conditions and the following disclaimer in the documentation and/or 
 * other materials provided with the distribution.
 * 
 * Neither the name of the author nor the names of its contributors may
 * be used to endorse or promote products derived from this software without 
 * specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
 * OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
 * POSSIBILITY OF SUCH DAMAGE.
 */

import org.owasp.webscarab.model.ConversationID;
import org.owasp.webscarab.model.HttpUrl;
import org.owasp.webscarab.model.Request;
import org.owasp.webscarab.model.Response;
import org.owasp.webscarab.util.LevenshteinDistance;
import java.io.BufferedReader;
import java.io.FileReader;
import java.io.LineNumberReader;
import javax.swing.*;
import javax.swing.border.*;
import javax.swing.table.*;
import java.awt.*;
import java.util.List;
import java.util.Arrays;
import java.util.ArrayList;

// Execution status of the GUI
int RUNNING = 0;
int DONE = 1;
int EXITED = 2;
// Request sending types
int PARALLEL = -1;
int SEQUENTIAL = -2;
// Name of file where inputs are stored and loded from
String INPUT_FILE_NAME = "inp.dat";
// Variables section
Integer sendingType = PARALLEL;
Integer waitTime = 0;

String exportFileName = "";
BufferedWriter exportFileWriter = null;

Vector sensitiveDataVector = new Vector(); // contains strings of sensitive data
String sensitiveDataFilePath = "";

Vector requestVector = new Vector(); // a vector of Request objects that are sent
Vector newParamValues = new Vector(); // a vector of vectors containing the new values for each parameter given as input

Integer startReqNr;
Integer endReqNr;
Integer cookieReqNr = -1;
Integer reloginReqNr;
boolean relogin = false;
boolean changeCookie = false;
boolean noPostParams = true;

Request loginRequest = null;

Vector responseData = null; // response data input by the user in the GUI table: (name, req#) pairs
Vector responseLD = new Vector(); // LevensteinDistance objects having base responses indicated by the user
Vector responseSize = new Vector(); // Content sizes of the responses indicated by the user
Vector responseName = new Vector(); // The titles to print out for the responses
Vector responseLocation = new Vector(); // A vector with the response locations in case of a 302 Found status
Vector paramData = null;

// modify this routine to determine when we are finished
// NB: This can be called multiple times between requests, so it
// should not have any side effects
boolean hasMoreRequests() {
    return startReqNr <= endReqNr;
}

void printLine(String str) {
	out.println(str);
	if (exportFileWriter != null)
	{
		exportFileWriter.write(str,0,str.length());
		exportFileWriter.newLine();
	}	
}

// expands param table with new values from intervals or files
void expandParameterValues() {
	Iterator it = paramData.iterator();
	while (it.hasNext()) {
		Vector newParamData = new Vector();
		Vector v = it.next();
		String param = v.get(0);
		String oldMethod = v.get(1);
		String oldValue = v.get(2);
		String newMethod = v.get(3);
		String newValue = v.get(4);
		String newValue2 = v.get(5);
		boolean isFile = v.get(6);
		
		if (isFile) { // check if newValue should be a file name
			try {	
				paramValueReader = new LineNumberReader(new BufferedReader(new FileReader(newValue)));
				while ((line = paramValueReader.readLine()) != null) {
					if (!line.equals(""))
						newParamData.add(URLEncoder.encode(line));
				}
				paramValueReader.close();
			} catch (IOException ioe) {
				out.println("IOException for File: "+newValue+". The parameter data could not be read from the specified file.");
				newParamData.add(newValue);
			}
		} else if ((newValue2 != null) && !newValue2.equals("")) { // check if it is an interval
			try {
				int newEndValue = Integer.parseInt(newValue2);
				int newStartValue = Integer.parseInt(newValue)+1;
				if (newStartValue > newEndValue)
					newStartValue = newEndValue;
				for (int i=newStartValue; i<=newEndValue; i++) {
					newParamData.add(i);
				}
			} catch (NumberFormatException nfe) {
				out.println("NumberFormatException for parameter: "+param+". One of the two new values is not an integer number.");
				newParamData.add(newValue);
			}
		} else { // otherwise its a single value
			newParamData.add(newValue);
		}	
		
		newParamValues.add(newParamData);
	}
}

boolean parameterChanges(int index,
						String paramName,
						String oldValue,
						String oldMethod,  
						Vector newValue,
						String newMethod,
						Vector paramNameVector1, 
						Vector paramValueVector1, 
						Vector paramNameVector2, 
						Vector paramValueVector2) {
	boolean changes = false;
	
	if ((noPostParams == true) && (newMethod.equals("POST")))
		return changes;
		
	if (oldValue.equals("*") || oldValue.equals(paramValueVector1.get(index).get(0))) {
		changes = true;
		if (newMethod.equals(oldMethod)) {
			paramValueVector1.set(index, newValue);
		} else if (newMethod.equals("DROP")) {
			paramNameVector1.remove(index);
			paramValueVector1.remove(index);
		} else {
			paramNameVector1.remove(index);
			Vector oldv = paramValueVector1.remove(index);
			if (newValue.get(0).equals("")) {
				newValue = oldv;
			}
			paramNameVector2.add(paramName);
			paramValueVector2.add(newValue);
		}
	}	
	
	return changes;
}

// set request parameters
Vector setParameters(Request request) {
	if ((request == null) || (paramData == null))
		return null;
	
	Vector returnRequestVector = new Vector();
	HttpUrl url = request.getURL();
	
	// Parse GET parameters
	Vector getParamVector = null;
	Vector getParamName = new Vector();
	Vector getParamValue = new Vector();	
	String query = url.getQuery();
	if (query != null) {
		//out.println("query = "+query);
		getParamVector = new Vector(Arrays.asList(query.split("&")));
		Iterator getIt = getParamVector.iterator();
		while (getIt.hasNext()) {
			String p = getIt.next();
			String[] ps = p.split("=");
			getParamName.add(ps[0]);
		
			if (ps.length > 1) {
				Vector elem = new Vector();
				elem.add(ps[1]);
				getParamValue.add(elem);
			}
			else {
				Vector elem = new Vector();
				elem.add("");
				getParamValue.add(elem);
			}
		}
	}
	// Parse POST parameters
	String body = new String(request.getContent());
	Vector postParamName = new Vector();
	Vector postParamValue = new Vector();
	Vector postParamVector = null;
	
	if (!body.equals("")) {
		//out.println("body = "+body);
		postParamVector = new Vector(Arrays.asList(body.split("&")));
		Iterator postIt = postParamVector.iterator();
		while (postIt.hasNext()) {
			String p = postIt.next();
			String[] ps = p.split("=");
			postParamName.add(ps[0]);
			
			if (ps.length > 1) {
				Vector elem = new Vector();
				elem.add(ps[1]);
				postParamValue.add(elem);
			}
			else {
				Vector elem = new Vector();
				elem.add("");
				postParamValue.add(elem);
			}
		}
	}
	// if request had no parameters at all
	if ((getParamVector == null) && (postParamVector == null))	{
		returnRequestVector.add(request);
		return returnRequestVector;
	}

	boolean anyChanges = false;	
	
	// replace parameters in temporary auxiliary vectors	
	Iterator it = paramData.iterator();
	int paramIdx = 0;
	while (it.hasNext()) {
		Vector v = it.next();
		String paramConcat = v.get(0);
		String oldMethod = v.get(1);
		String oldValue = v.get(2);
		String newMethod = v.get(3);
		Vector newValue = newParamValues.get(paramIdx++);
		
		// split param strings for same purpose
		String[] paramArray = paramConcat.split(",");
		int paramArrayLen = paramArray.length;
		for (int i=0; i<paramArrayLen; i++) {
			paramArray[i] = paramArray[i].trim();
		}
		
		//out.println(paramConcat + " " + oldMethod + " " + oldValue + " " + newMethod + " " + newValue);
		if ((getParamVector != null) && oldMethod.equals("GET")) {
			if (paramArray[0].equals("*")) { // replace every parameter
				int getParamSize = getParamName.size();
				for (int index=(getParamSize-1); index>=0; index--) {
					if (parameterChanges(index, getParamName.get(index), oldValue, oldMethod, newValue, newMethod, getParamName, getParamValue, postParamName, postParamValue)) {
						anyChanges = true;
					}	
				}
			} else {
				int index = -1;
				int i = 0;
				for (i=0; i<paramArrayLen; i++) {
					index = getParamName.indexOf(paramArray[i]);
					
					if (index == -1) {
						//out.println("Parameter: " + param + " not found as GET");
						continue;
					}
					
					if (parameterChanges(index, paramArray[i], oldValue, oldMethod, newValue, newMethod, getParamName, getParamValue, postParamName, postParamValue)) {
						anyChanges = true;
					}
				}
			}
		} else if ((postParamVector != null) && oldMethod.equals("POST")) {
			if (paramArray[0].equals("*")) { // replace every parameter
				int postParamSize = postParamName.size();
				for (int index=(postParamSize-1); index>=0; index--) {
					if (parameterChanges(index, postParamName.get(index), oldValue, oldMethod, newValue, newMethod, postParamName, postParamValue, getParamName, getParamValue)) {
						anyChanges = true;
					}
				}
			} else {
				int index = -1;
				int i = 0;
				for (i=0; i<paramArrayLen; i++) {
					index = postParamName.indexOf(paramArray[i]);
				
					if (index == -1) {
						//out.println("Parameter: " + param + " not found as POST");
						continue;
					}
					
					if (parameterChanges(index, paramArray[i], oldValue, oldMethod, newValue, newMethod, postParamName, postParamValue, getParamName, getParamValue)) {
						anyChanges = true;
					}
				}
			}
		}
	}
	
	// check if there have been any parameter modifications in the loop before
	// if not, there is no point in reconstructing the request, just return the old request
	if (anyChanges == false) {
		returnRequestVector.add(request);
		return returnRequestVector;
	}
	
	// initialize the counters for each param values
	int postSize = postParamValue.size();
	Vector postParamValueCounter = new Vector(postSize);
	for (int i=0; i<postSize; i++) {
		postParamValueCounter.add(0);
	}
	
	int getSize = getParamValue.size();
	Vector getParamValueCounter = new Vector(getSize);
	for (int i=0; i<getSize; i++) {
		getParamValueCounter.add(0);
	}
	
	boolean notFinished = true;
	// reconstruct the request with the new parameter values
	while (notFinished) {
		notFinished = false;
		newRequest = new Request(request);
		String query = "";
		int size = getParamName.size();
		
		if (size > 0) {
			int i;
			for (i=0; i<size; i++) {
				//out.println("paramName = "+getParamName.get(i));
				Vector paramVal1 = getParamValue.get(i);
				int paramSize = paramVal1.size();
				int paramIdx = getParamValueCounter.get(i);
				query += getParamName.get(i) + "=" + paramVal1.get(paramIdx++) + "&";
				//out.println("paramVal1.get("+paramIdx+") = "+paramVal1.get(paramIdx));
				if (!notFinished && (paramIdx < paramSize)) {
					notFinished = true;
					getParamValueCounter.set(i, paramIdx);
				}
			}
			query = "?" + query.substring(0, query.length()-1);
		}
		//out.println("query = "+query);
		
		String oldUrl = url.toString();
		String beginUrl = null;
		try {
			int posQ = oldUrl.indexOf("?");
			beginUrl = oldUrl.substring(0,posQ);
		} catch (StringIndexOutOfBoundsException e) {
			beginUrl = oldUrl;
		}
		
		newRequest.setURL(new HttpUrl(beginUrl+query));
		
		if (!postParamName.isEmpty()) {
			String body = "";
			int size = postParamName.size();
			int i;
			for (i=0; i<size; i++) {
				Vector paramVal1 = postParamValue.get(i);
				int paramSize = paramVal1.size();
				int paramIdx = postParamValueCounter.get(i);
				body += postParamName.get(i) + "=" + paramVal1.get(paramIdx++) + "&";
				if (!notFinished && (paramIdx < paramSize)) {
					notFinished = true;
					postParamValueCounter.set(i, paramIdx);
				}
			}
			body = body.substring(0, body.length()-1);
			
			newRequest.setContent(body.getBytes("UTF-8"));
			
			if (newRequest.getMethod().equals("GET")) {
				/*
				newRequest.addHeader("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8");
				newRequest.addHeader("Pragma", "no-cache");
				newRequest.addHeader("Cache-Control", "no-cache");
				*/
				newRequest.setMethod("POST");
			}
		} else if (newRequest.getMethod().equals("POST")) {
			newRequest.setNoBody();
			/*
			newRequest.deleteHeader("Content-Type");
			newRequest.deleteHeader("Pragma");
			newRequest.delteHeader("Cache-Control");
			*/
			newRequest.setMethod("GET");
		}
		returnRequestVector.add(newRequest);
	}
	
	return returnRequestVector;
}

// modify this routine to construct the next request, and update the
// position in the list
Request getNextRequest() {
	String url = "NO URL";
	Request request = null;
	if ((requestVector != null) && (requestVector.size() > 0)) {
		request = requestVector.remove(0);
	} else {
		do{
			Request req = scripted.getRequest(startReqNr);
			if (req == null) // it happens that WebScarab Summary is missing a Request ID
				continue;
			request = new Request(req);
			url = request.getURL().toString();
			//out.println("at req #"+startReqNr+" URL: "+url);	    		
			startReqNr++;
			if (changeCookie == true)
				request.setHeader("Cookie",cookie);
		} while (url.endsWith("gif")||url.endsWith("png")||url.endsWith("jpg")||url.endsWith("ico")||url.endsWith("css")||url.endsWith("js"));
		//out.println("before set parameters");
		if ((noPostParams == true) && (request.getMethod().equals("POST"))) {
			request.setNoBody();
			request.setMethod("GET");
		}
		requestVector = setParameters(request);
		//out.println("after set parameters");
		if (requestVector != null)
			request = requestVector.remove(0);
	}
    //out.println("Trying " + url);
	return request;
}

List tokenize(byte[] bytes) {
        if (bytes == null)
            return new ArrayList();
      
        String[] words = new String(bytes).split("\\s");
        List tokens = Arrays.asList(words);
        return tokens;
}

boolean containsErrorMessage(String page) {
	String[] errorMsg = {"Access denied", "Invalid", "Error", "Forbidden"};

	for (int i=0; i<errorMsg.length; i++)
		if (page.contains(errorMsg[i]))
			return true;
			
	return false;
}

int getMinimumIndex(Vector v)
{
	int min = Integer.MAX_VALUE;
	int minIndex = -1;
	int currIndex = 0;
	Iterator it = v.iterator();
	while (it.hasNext())
	{
		int n = it.next();
		if (n < min)
		{
			min = n;
			minIndex = currIndex;
		}
		currIndex++;
	}
	return minIndex;
}

void gotResponse(Response response, int originalRequestNr) {
    scripted.addConversation(response);
	if (!response.getStatus().startsWith("4") && !response.getStatus().startsWith("304"))
	{
		Request req = response.getRequest();
		int size = Integer.parseInt(response.getHeader("Content-length"));
		
		if (size == error_page_size)
		{
			printLine("Access denied @ URL: " + req.getURL());
		}
		else 
		{
			// compare authorized user response to this response
			Response authResponse = scripted.getResponse(originalRequestNr);
			byte[] authBytes = authResponse.getContent();
			String type = authResponse.getHeader("Content-Type");
			int authSize = Integer.parseInt(authResponse.getHeader("Content-length"));
			LevenshteinDistance authTargetDist = null;
			if (type != null && type.startsWith("text")) 
			{
				List target = tokenize(authBytes);
				authTargetDist = new LevenshteinDistance(target);
			}
					
			byte[] targetBytes = response.getContent();
			type = response.getHeader("Content-Type");

			if (type == null || !type.startsWith("text")) 
			{
				printLine("Access denied @ URL: " + req.getURL());
				return;
			}
			List target = tokenize(targetBytes);
			String contentBody = new String(targetBytes);

			if (containsErrorMessage(contentBody))
			{// check if page contains any error messages
				printLine("Access denied @ URL: " + req.getURL());
			}
			else if (authTargetDist != null && (authTargetDist.getDistance(target) < (authSize/10)))
			{// compare this response to the response of the original user
				printLine("Access denied @ URL: " + req.getURL());
			}
			else if (levDist.getDistance(target) < (error_page_size/10))	
			{// compare error page to this response
				printLine("Access denied @ URL: " + req.getURL());
			} 
			else		
			{
				printLine("Success @ URL: " + req.getURL() + " size = " + Integer.parseInt(response.getHeader("Content-length")));	
			}	
		}
		//out.println("with status: " + response.getStatus());	
	}
}

void compareHeaders(Response r, ConversationID cid) {
	String[] headerNames = r.getHeaderNames();
	int size = headerNames.length;
	Request req = r.getRequest();
	Iterator resIt = responseData.iterator();
	while (resIt.hasNext()) {
		Vector expected = resIt.next();
		int expId = -1;
		try {
			expId = Integer.parseInt(expected.get(1));
			if (!isGoodID(expId))
				continue;
		} catch (NumberFormatException nfe) {
			continue;	
		}
		
		Response er = scripted.getResponse(expId);
		if (er == null)
			continue;
		
		boolean match = true;
		for (int i=0; i<size && match; i++) {
			if (erHeader != null) {
				if (!r.getHeader(headerNames[i]).equals(er.getHeader(headerNames[i])))
					match = false;
			} else
				match = false;
		}
		
		if (match) {
			printLine(expected.get(0)+" @ ID "+ cid +" URL:"+ req.getURL());
		} else { 
			printLine("Undefined response @ ID "+ cid +" URL:"+ req.getURL());
		}
	}
}

void gotResponse(Response response) {
    ConversationID convID = scripted.addConversation(response);
	if (response.getStatus().startsWith("2")) {
		Request req = response.getRequest();
		int size = 0;
		
		try { // some responses don't have Content-length header but they do have content
			size = Integer.parseInt(response.getHeader("Content-length"));
		} catch (NumberFormatException nfe) {
			byte[] content = response.getContent();
			if (content.length >= 0)
				size = content.length;
			else {
				out.println("Warning: The response has no body content. Only the headers will be compared.");
				compareHeaders(response, convID);
				return;
			}
		}
		
		if (size == 0) // if Content-length: 0
			compareHeaders(response, convID);
			
		boolean foundSensitiveData = false;
		String type = response.getHeader("Content-Type");
		Vector measurementResults = new Vector();
		
		if (type == null || !type.startsWith("text")) { // compare response sizes
			Iterator resIt = responseSize.iterator();
			int index = 0;
			while (resIt.hasNext()) {
				int resSize = resIt.next();
				if (responseLocation.get(index++) != null)
					continue;
				measurementResults.add(Math.abs(size-resSize));
			}
		}
		else { // compare Levenshtein Distances
			byte[] targetBytes = response.getContent();
			List target = tokenize(targetBytes);
			
			
			Iterator resIt = responseLD.iterator();
			int index = 0;
			while (resIt.hasNext()) {
				LevenshteinDistance levDist = resIt.next();
				if (responseLocation.get(index++) != null)
					continue;
				measurementResults.add(levDist.getDistance(target));
			}
			
			// also search if response contains any sensitive data 
			if (sensitiveDataVector != null) {
				String body = new String(targetBytes);
				Iterator sdIt = sensitiveDataVector.iterator();
				String sdNotice = "Sensitive Data: ";
				
				while (sdIt.hasNext()) {
					String sd = sdIt.next();
					if (body.contains(sd)) {
						sdNotice += sd + " AND ";
						foundSensitiveData = true;
					}
				}
				
				if (foundSensitiveData) { // the 4 from the line below stands for the string "AND "
					printLine(sdNotice.substring(0, sdNotice.length()-4) + "@ ID " + convID + " URL:" + req.getURL());
				}
			}
		}	
		
		int minIndex = getMinimumIndex(measurementResults);
		if ((minIndex > -1) && (measurementResults.get(minIndex) < responseSize.get(minIndex)/10))
			printLine(responseName.get(minIndex)+" @ ID "+ convID +" URL:"+ req.getURL());
		else if (!foundSensitiveData)
			printLine("Undefined response @ ID "+ convID +" URL:"+ req.getURL());
	} else if (response.getStatus().equals("302")) {
		Request req = response.getRequest();
		String location = response.getHeader("Location");
		Iterator resIt = responseLocation.iterator();
		int index = 0;
		while (resIt.hasNext()) {
			String resLocation = resIt.next();
			if ((resLocation != null) && resLocation.equals(location)) {
				printLine(responseName.get(index)+" @ ID "+ convID +" URL:"+ req.getURL());
				return;
			}
			index++;
		}
		printLine("Undefined response @ ID "+ convID +" URL:"+ req.getURL());
	}
}

// call this to fetch them in parallel
// the number of simultaneous connections is controlled by the Scripted plugin 
// It is currently hardcoded in the source at 4 simultaneous requests
void fetchParallel() {
    while (scripted.isAsyncBusy() || hasMoreRequests()) {
        while (scripted.hasAsyncCapacity() && hasMoreRequests()) {
			//out.println("sent request");
			request = getNextRequest();
			if (request != null) {
				scripted.submitAsyncRequest(request);
			}
        }
        Thread.sleep(100);
        while (scripted.hasAsyncResponse()) {
			//out.println("got response");
			gotResponse(scripted.getAsyncResponse());
        }
    }
}

// call this to fetch the requests one after another
void fetchSequentially() {
    while (hasMoreRequests()) {
        if (relogin) {
			scripted.fetchResponse(loginRequest);
			//out.println("Relogin Sent");
		}
        request = getNextRequest();
        if (request != null) {
			response = scripted.fetchResponse(request);
			gotResponse(response);
			Thread.sleep(waitTime);
		}
    }
}

boolean isGoodID(int id) {
	return (id > 0);
}

DefaultCellEditor methodDropDown(boolean newMethod) {
	Vector v = new Vector(2);
	v.add("GET");
	v.add("POST");
	if (newMethod == true)
		v.add("DROP");
	dd = new JComboBox(v);
	return new DefaultCellEditor(dd);
}

// method that builds the GUI
JFrame gui() {
	invoke( method, args ) {}

    windowClosing(WindowEvent we) {
		we.getWindow().setVisible(false);
		allSet = EXITED;
	}
	
	JFrame frame = new JFrame("Privilege Escalation Testing Tool");
    frame.addWindowListener(this);
    frame.addComponentListener(this);
	frame.setBounds(100, 100, 590, 660);	
	
	JPanel panel = new JPanel();
	frame.getContentPane().add(panel, BorderLayout.CENTER);
	panel.setLayout(null);
	
	JPanel requestIntervalPanel = new JPanel();
	requestIntervalPanel.setBorder(new TitledBorder(null, "Request Interval", TitledBorder.LEADING, TitledBorder.TOP, null, null));
	requestIntervalPanel.setBounds(12, 12, 235, 83);
	panel.add(requestIntervalPanel);
	requestIntervalPanel.setLayout(null);
	
	JLabel lblStartRequest = new JLabel("Start Request ID:");
	lblStartRequest.setBounds(12, 27, 124, 15);
	requestIntervalPanel.add(lblStartRequest);
	lblStartRequest.setToolTipText("The request number from the WebScarab Summary tab that the script will first replay");
	
	JLabel lblEndRequest = new JLabel("End Request ID:");
	lblEndRequest.setBounds(12, 54, 124, 15);
	requestIntervalPanel.add(lblEndRequest);
	lblEndRequest.setToolTipText("The request number from the WebScarab Summary tab that the script will last replay");
	
	endReqTextField = new JTextField();
	endReqTextField.setBounds(153, 52, 70, 19);
	requestIntervalPanel.add(endReqTextField);
	endReqTextField.setText("");
	endReqTextField.setColumns(10);
	
	startReqTextField = new JTextField();
	startReqTextField.setBounds(153, 25, 70, 19);
	requestIntervalPanel.add(startReqTextField);
	startReqTextField.setText("");
	startReqTextField.setColumns(10);
	DefaultTableModel tableModel = new DefaultTableModel();
	Vector responseColumnNames = new Vector();
	responseColumnNames.add("Name of page");
	responseColumnNames.add("Request #");
	tableModel.setColumnIdentifiers(responseColumnNames);
	
	JButton btnRunScript = new JButton("Run Script");
	btnRunScript.setBounds(231, 595, 117, 25);
	panel.add(btnRunScript);
	DefaultTableModel paramTableModel = new DefaultTableModel();
	Vector paramColumnNames = new Vector();
	paramColumnNames.add("Parameter name");
	paramColumnNames.add("Old method");
	paramColumnNames.add("Old value");
	paramColumnNames.add("New method");
	paramColumnNames.add("New value start");
	paramColumnNames.add("New value end");
	paramColumnNames.add("File");
	paramTableModel.setColumnIdentifiers(paramColumnNames);
	
	JPanel ResponsePanel = new JPanel();
	ResponsePanel.setBorder(new TitledBorder(null, "Expected Responses", TitledBorder.LEADING, TitledBorder.TOP, null, null));
	ResponsePanel.setBounds(259, 11, 315, 164);
	panel.add(ResponsePanel);
	ResponsePanel.setLayout(null);
	
	JButton btnAddRow = new JButton("Add Row");
	btnAddRow.setBounds(79, 127, 95, 25);
	ResponsePanel.add(btnAddRow);
	btnAddRow.setToolTipText("Add another expected response");
	
	table = new JTable();
	JScrollPane scrollPane = new JScrollPane(table);
	scrollPane.setBounds(12, 24, 291, 95);
	ResponsePanel.add(scrollPane);
	table.setFillsViewportHeight(true);
	table.setBorder(new EtchedBorder(EtchedBorder.LOWERED, null, null));
	table.setSelectionMode(ListSelectionModel.MULTIPLE_INTERVAL_SELECTION);
	table.setModel(tableModel);
	
	JButton btnDeleteResponseRow = new JButton("Delete Row");
	btnDeleteResponseRow.setBounds(186, 127, 117, 25);
	ResponsePanel.add(btnDeleteResponseRow);
	
	JPanel ParamPanel = new JPanel();
	ParamPanel.setBorder(new TitledBorder(null, "Parameters to Change", TitledBorder.LEADING, TitledBorder.TOP, null, null));
	ParamPanel.setBounds(12, 235, 562, 158);
	panel.add(ParamPanel);
	ParamPanel.setLayout(null);
	
	JButton btnAddRow_1 = new JButton("Add Row");
	btnAddRow_1.setBounds(326, 121, 95, 25);
	ParamPanel.add(btnAddRow_1);
	btnAddRow_1.setToolTipText("Add another parameter");
	
	JScrollPane scrollPane_1 = new JScrollPane();
	scrollPane_1.setBounds(12, 22, 538, 96);
	ParamPanel.add(scrollPane_1);
	
	table_1 = new JTable();
	table_1.setModel(paramTableModel);
	table_1.getColumnModel().getColumn(0).setPreferredWidth(122);
	table_1.setFillsViewportHeight(true);
	
	scrollPane_1.setViewportView(table_1);
	
	JButton btnDeleteParamRow = new JButton("Delete Row");
	btnDeleteParamRow.setBounds(433, 121, 117, 25);
	ParamPanel.add(btnDeleteParamRow);
	
	JPanel cookiePanel = new JPanel();
	cookiePanel.setBorder(new TitledBorder(null, "", TitledBorder.LEADING, TitledBorder.TOP, null, null));
	cookiePanel.setBounds(12, 105, 235, 71);
	panel.add(cookiePanel);
	cookiePanel.setLayout(null);
	
	JCheckBox chckbxChangeCookie = new JCheckBox("Use Cookie");
	chckbxChangeCookie.setBounds(8, 8, 104, 23);
	cookiePanel.add(chckbxChangeCookie);
	chckbxChangeCookie.setSelected(true);
	
	cookieTextField = new JTextField();
	cookieTextField.setText("");
	cookieTextField.setBounds(162, 40, 61, 19);
	cookiePanel.add(cookieTextField);
	cookieTextField.setColumns(10);
	
	JLabel lblUse = new JLabel("Cookie from Request:");
	lblUse.setBounds(8, 42, 157, 15);
	cookiePanel.add(lblUse);
	lblUse.setToolTipText("The request number from which the Cookie will be used");
	
	JPanel fetchMethodPanel = new JPanel();
	fetchMethodPanel.setBorder(new TitledBorder(null, "Request Sending", TitledBorder.LEADING, TitledBorder.TOP, null, null));
	fetchMethodPanel.setBounds(12, 405, 562, 48);
	panel.add(fetchMethodPanel);
	fetchMethodPanel.setLayout(null);
	
	JRadioButton rdbtnParallel = new JRadioButton("Parallel");
	rdbtnParallel.setToolTipText("Uses 4 threads that send requests in parallel. The number 4 is hardcoded in WebScarab, not the script.");
	rdbtnParallel.setBounds(8, 17, 86, 23);
	fetchMethodPanel.add(rdbtnParallel);
	
	JRadioButton rdbtnSequential = new JRadioButton("Sequential");
	rdbtnSequential.setSelected(true);
	rdbtnSequential.setToolTipText("Sends requests one after the other.");
	rdbtnSequential.setBounds(98, 17, 102, 23);
	fetchMethodPanel.add(rdbtnSequential);
	
	//Group the radio buttons.
    ButtonGroup group = new ButtonGroup();
    group.add(rdbtnParallel);
    group.add(rdbtnSequential);
	
	JLabel lblWait = new JLabel("Wait");
	lblWait.setBounds(223, 21, 39, 15);
	fetchMethodPanel.add(lblWait);
	
	waitTextField = new JTextField();
	waitTextField.setEnabled(true);
	waitTextField.setText("0");
	waitTextField.setBounds(261, 19, 60, 19);
	fetchMethodPanel.add(waitTextField);
	waitTextField.setColumns(10);
	
	JLabel lblMillisecsBetweenRequests = new JLabel("milliseconds between requests");
	lblMillisecsBetweenRequests.setBounds(322, 21, 228, 15);
	fetchMethodPanel.add(lblMillisecsBetweenRequests);
	
	JPanel resultExportPanel = new JPanel();
	resultExportPanel.setBorder(new TitledBorder(null, "Output Exporting", TitledBorder.LEADING, TitledBorder.TOP, null, null));
	resultExportPanel.setBounds(12, 465, 558, 48);
	panel.add(resultExportPanel);
	resultExportPanel.setLayout(null);
	
	JLabel lblExportOutputsTo = new JLabel("Export outputs to file:");
	lblExportOutputsTo.setBounds(12, 21, 165, 15);
	resultExportPanel.add(lblExportOutputsTo);
	
	fileTextField = new JTextField();
	fileTextField.setBounds(170, 19, 286, 19);
	resultExportPanel.add(fileTextField);
	fileTextField.setColumns(10);
	
	JButton btnFileSelect = new JButton("Select");
	btnFileSelect.setBounds(468, 16, 78, 25);
	resultExportPanel.add(btnFileSelect);
	
	JPanel sensitiveDataPanel = new JPanel();
	sensitiveDataPanel.setBorder(new TitledBorder(null, "Sensitive Data Matching", TitledBorder.LEADING, TitledBorder.TOP, null, null));
	sensitiveDataPanel.setBounds(12, 182, 558, 48);
	panel.add(sensitiveDataPanel);
	sensitiveDataPanel.setLayout(null);
	
	JLabel lblSeachForStrings = new JLabel("Seach for strings from file:");
	lblSeachForStrings.setBounds(12, 21, 188, 15);
	sensitiveDataPanel.add(lblSeachForStrings);
	
	JButton btnSensitiveDataFileSelect = new JButton("Select");
	btnSensitiveDataFileSelect.setBounds(468, 16, 78, 25);
	sensitiveDataPanel.add(btnSensitiveDataFileSelect);
	
	textSensitiveDataField = new JTextField();
	textSensitiveDataField.setBounds(204, 19, 252, 19);
	sensitiveDataPanel.add(textSensitiveDataField);
	textSensitiveDataField.setColumns(10);
	
	JCheckBox chckbxNoPostParameters = new JCheckBox("No POST parameters");
	chckbxNoPostParameters.setBounds(22, 526, 183, 23);
	panel.add(chckbxNoPostParameters);
	
	JPanel reloginPanel = new JPanel();
	reloginPanel.setBorder(new TitledBorder(null, "", TitledBorder.LEADING, TitledBorder.TOP, null, null));
	reloginPanel.setBounds(301, 517, 269, 66);
	panel.add(reloginPanel);
	reloginPanel.setLayout(null);
	
	JCheckBox chckbxRelogin = new JCheckBox("Re-login before every request");
	chckbxRelogin.setBounds(8, 8, 237, 23);
	reloginPanel.add(chckbxRelogin);
	
	JLabel lblLoginRequestId = new JLabel("Login Request ID:");
	lblLoginRequestId.setBounds(8, 39, 125, 15);
	reloginPanel.add(lblLoginRequestId);
	
	reloginReqTextField = new JTextField();
	reloginReqTextField.setBounds(136, 37, 114, 19);
	reloginPanel.add(reloginReqTextField);
	reloginReqTextField.setColumns(10);

	table.getColumnModel().getColumn(0).setPreferredWidth(143);
	
	TableColumn col = table_1.getColumnModel().getColumn(1);
	col.setCellEditor(methodDropDown(false));
	col.setMinWidth(80);
	col.setMaxWidth(80);
	col.setResizable(false);
	
	col = table_1.getColumnModel().getColumn(3);
	col.setCellEditor(methodDropDown(true));
	col.setMinWidth(80);
	col.setMaxWidth(80);
	col.setResizable(false);
	
	col = table_1.getColumnModel().getColumn(6);
	col.setCellEditor(new DefaultCellEditor(new JCheckBox()));
	col.setMinWidth(35);
	col.setMaxWidth(35);
	col.setResizable(false);
	
	// This is the equivalent of an inner class in bsh.
	runButtonHandler() {
		actionPerformed(ActionEvent ae) {
			try {
				// Get information from text fields
				int startReq = Integer.parseInt(startReqTextField.getText());
				if (isGoodID(startReq))
					startReqNr = startReq;
				int endReq = Integer.parseInt(endReqTextField.getText());
				if (isGoodID(endReq)) {
					if (startReq < endReq)
						endReqNr = endReq;
					else {
						endReqNr = startReq; 
						out.println("Warning: The Start Request ID is higher than the End Request ID. Will only replay the Start Request ID.");
					}
				}
			} catch (Exception e) {
				out.println("Warning: The Start and/or End Request IDs are not specified correctly");
				return;
			}
			
			if (changeCookie == true) {
				try {
					int cookieReq = Integer.parseInt(cookieTextField.getText());
					if (isGoodID(cookieReq))
						cookieReqNr = cookieReq;
					else
						changeCookie = false;
				} catch (NumberFormatException nfe) {
					changeCookie = false;
					chckbxChangeCookie.setSelected(changeCookie);
				}
			}
			
			// Check if we need to relogin
			relogin = chckbxRelogin.isSelected();
			if (relogin) {
				try {
					reloginReqNr = Integer.parseInt(reloginReqTextField.getText());
					if (!isGoodID(reloginReqNr))
						relogin = false;
					else
					{
						loginRequest = scripted.getRequest(reloginReqNr);
						if (loginRequest == null)
							relogin = false;
					}
				} catch (NumberFormatException nfe) {
					out.println("WARNING: The login request you have indicated is not in integer format");
					relogin = false;
					chckbxRelogin.setSelected(relogin);
				}
			}
			//out.println("got info from text fields");
			// Get information from response table
			responseData = tableModel.getDataVector();
			if (responseData == null)
				responseData = new Vector();
			
			Iterator resIt = responseData.iterator();
			while (resIt.hasNext())
			{
				Vector v = resIt.next();
				try {
					int resNr = Integer.parseInt(v.get(1));
					
					if (!isGoodID(resNr))
						continue;
					Response r = scripted.getResponse(resNr);
					if (r == null)
						continue;
					responseName.add(v.get(0));	
					responseLocation.add(r.getHeader("Location"));
					responseSize.add(Integer.parseInt(r.getHeader("Content-length")));
					byte[] baseBytes = r.getContent();
					String type = r.getHeader("Content-Type");
					if (type != null && type.startsWith("text")) 
					{
						List baseline = tokenize(baseBytes);
						LevenshteinDistance levDist = new LevenshteinDistance(baseline);
						responseLD.add(levDist);
					}
					else
						responseLD.add(null);
				} catch (NumberFormatException nfe) {
					// This happens when the user doesn't enter numeric values in ALL the Response table rows
				}
			}
			//out.println("got info from response table");
			// Get sensitive data from file
			sensitiveDataFilePath = textSensitiveDataField.getText();
			if ((sensitiveDataFilePath != null) && !sensitiveDataFilePath.equals(""))
			{
				try {
					sensitiveDataFileReader = new LineNumberReader(new BufferedReader(new FileReader(sensitiveDataFilePath)));
					while ((line = sensitiveDataFileReader.readLine()) != null) {
						if (!line.equals(""))
							sensitiveDataVector.add(line);
					}
					sensitiveDataFileReader.close();
				} catch (IOException ioe) {
					out.println("IOException for Sensitive Data File: The sensitive data could not be read from the specified file.");
					sensitiveDataVector = null;
				}
			}
			//out.println("got sensitive data vector " + sensitiveDataVector);
			// Get information from parameter table
			paramData = paramTableModel.getDataVector();
			
			// Request sending type
			if (rdbtnSequential.isSelected()) {
				sendingType = SEQUENTIAL;
				try {
					waitTime = Integer.parseInt(waitTextField.getText());
					if (waitTime < 0)
						waitTime = 0;
				} catch (NumberFormatException nfe) {
					// Wait time was not given in correct numeric format
					waitTime = 0;
				}
			}
			//out.println("got info from param table");
			// Check and prepare export file
			exportFileName = fileTextField.getText();
			if ((exportFileName != null) && !exportFileName.equals(""))
			{
				try {
					exportFileWriter = new BufferedWriter(new FileWriter(exportFileName));
				} catch (IOException ioe) {
					out.println("IOException for Export File: The named file exists but is a directory rather than a regular file, does not exist but cannot be created, or cannot be opened for any other reason.");
					out.println("Info: The outputs will not be exported in the file.");
					exportFileWriter = null;
				}
			}
			// Get No POST parameters check box state
			noPostParams = chckbxNoPostParameters.isSelected();
			
			//out.println("all done");
			// Done parsing inputs
			allSet = DONE;
			frame.setVisible(false);
		}
		return this;
	}
	
	btnRunScript.addActionListener(runButtonHandler());
	
	// Table Model listener
	JFileChooser fcParamFile = new JFileChooser();
	
	paramTableModelHandler() {
		tableChanged(TableModelEvent e) {
	        int column = e.getColumn();
	        TableModel model = (TableModel)e.getSource();
	        String columnName = model.getColumnName(column);
	        if (columnName.equals("File")) {
		        int row = e.getFirstRow();
		        boolean data = model.getValueAt(row, column);
				if (data == true) {
					int returnVal = fcParamFile.showOpenDialog(frame);
					
					if (returnVal == JFileChooser.APPROVE_OPTION) {
			            model.setValueAt(fcParamFile.getSelectedFile().getAbsolutePath(), row, 4);
			        } 
				}
			}
		}
		
		return this;
	}
	
	paramTableModel.addTableModelListener(paramTableModelHandler());
	
	//Create a file chooser for exporting output
	JFileChooser fc = new JFileChooser();
	
	selectFileButtonHandler() {
		actionPerformed(ActionEvent ae) {
			int returnVal = fc.showOpenDialog(frame);

	        if (returnVal == JFileChooser.APPROVE_OPTION) {
	            fileTextField.setText(fc.getSelectedFile().getAbsolutePath());
	        } 
		}
		return this;
	}
	
	btnFileSelect.addActionListener(selectFileButtonHandler());
	
	//Create a file chooser for sensitive data 
	JFileChooser fcSensitiveData = new JFileChooser();
	
	selectSensitiveDataFileButtonHandler() {
		actionPerformed(ActionEvent ae) {
			int returnVal = fcSensitiveData.showOpenDialog(frame);

	        if (returnVal == JFileChooser.APPROVE_OPTION) {
	            textSensitiveDataField.setText(fcSensitiveData.getSelectedFile().getAbsolutePath());
	        } 
		}
		return this;
	}
	
	btnSensitiveDataFileSelect.addActionListener(selectSensitiveDataFileButtonHandler());
	
	radioButtonHandler() {
		itemStateChanged(ItemEvent ie) {
			if (ie.getStateChange() == ItemEvent.SELECTED) {
				waitTextField.setEnabled(true);
				chckbxRelogin.setEnabled(true);
				reloginReqTextField.setEnabled(true);
			}
			else if (ie.getStateChange() == ItemEvent.DESELECTED) {
				waitTextField.setEnabled(false);
				chckbxRelogin.setEnabled(false);
				relogin = false;
				chckbxRelogin.setSelected(relogin);
				reloginReqTextField.setEnabled(false);
			}
		}
		return this;
	}
	
	rdbtnSequential.addItemListener(radioButtonHandler());
	
	cookieCheckBoxHandler() {
		itemStateChanged(ItemEvent ie) {
			if (ie.getStateChange() == ItemEvent.SELECTED)
				changeCookie = true;
			else if (ie.getStateChange() == ItemEvent.DESELECTED)
				changeCookie = false;
		}
		return this;
	}
	
	chckbxChangeCookie.addItemListener(cookieCheckBoxHandler());
	
	addResponseRowButtonHandler() {
		actionPerformed(ActionEvent ae) {
			Vector param = new Vector();
			for (int i=0; i<responseColumnNames.size(); i++)
				param.add("");
			tableModel.addRow(param);
		}
		return this;
	}
	
	btnAddRow.addActionListener(addResponseRowButtonHandler());
	
	deleteResponseRowButtonHandler() {
		actionPerformed(ActionEvent ae) {
			int[] rows = table.getSelectedRows();
			
			if (rows.length > 0)
			{
				for (int i=(rows.length-1); i>=0; i--)
				{
					//out.println("deleteing row: "+rows[i]);
					tableModel.removeRow(rows[i]);
				}
			}
		}
		return this;
	}
	
	btnDeleteResponseRow.addActionListener(deleteResponseRowButtonHandler());
	
	addParamRowButtonHandler() {
		actionPerformed(ActionEvent ae) {
			Vector param = new Vector();
			for (int i=0; i<paramColumnNames.size(); i++)
				param.add("");
			param.set(6, false); // File checkbox field
			paramTableModel.addRow(param);
		}
		return this;
	}
	
	btnAddRow_1.addActionListener(addParamRowButtonHandler());
	
	deleteParamRowButtonHandler() {
		actionPerformed(ActionEvent ae) {
			int[] rows = table_1.getSelectedRows();
			
			if (rows.length > 0)
			{
				for (int i=(rows.length-1); i>=0; i--)
				{
					//out.println("deleteing row: "+rows[i]);
					paramTableModel.removeRow(rows[i]);
				}
			}
		}
		return this;
	}
	
	btnDeleteParamRow.addActionListener(deleteParamRowButtonHandler());
	
	componentResized(ComponentEvent ce) {
		int width = ce.getComponent().getWidth();
		int height = ParamPanel.getHeight();
		ParamPanel.resize(width-30, height);
		height = scrollPane_1.getHeight();
		scrollPane_1.resize(width-50, height);
	}
	
	// load inputs from file
	try
	{
		FileInputStream fis = new FileInputStream(INPUT_FILE_NAME);
		ObjectInputStream ois = new ObjectInputStream(fis);
	
		startReqNr = ois.readInt();
		endReqNr = ois.readInt();
		cookieReqNr = ois.readInt();
		changeCookie = ois.readBoolean();
		noPostParams = ois.readBoolean();
		sensitiveDataFilePath = ois.readObject();
		responseData = ois.readObject();
		paramData = ois.readObject();
		
		startReqTextField.setText(startReqNr+"");
		endReqTextField.setText(endReqNr+"");
		cookieTextField.setText(cookieReqNr+"");
		chckbxChangeCookie.setSelected(changeCookie);
		chckbxNoPostParameters.setSelected(noPostParams);
		textSensitiveDataField.setText(sensitiveDataFilePath);
		paramTableModel.setDataVector(paramData, paramColumnNames);
		tableModel.setDataVector(responseData, responseColumnNames);
		
		TableColumn col = table_1.getColumnModel().getColumn(1);
		col.setCellEditor(methodDropDown(false));
		col.setMinWidth(80);
		col.setMaxWidth(80);
		col.setResizable(false);
		
		col = table_1.getColumnModel().getColumn(3);
		col.setCellEditor(methodDropDown(true));
		col.setMinWidth(80);
		col.setMaxWidth(80);
		col.setResizable(false);
		
		col = table_1.getColumnModel().getColumn(6);
		col.setCellEditor(new DefaultCellEditor(new JCheckBox()));
		col.setMinWidth(35);
		col.setMaxWidth(35);
		col.setResizable(false);
		
		ois.close();
	} catch (Exception fnfe) { 
		// nothing to do
	}
	return frame;
}

void saveInputs() {
	FileOutputStream fos = new FileOutputStream(INPUT_FILE_NAME);
	ObjectOutputStream oos = new ObjectOutputStream(fos);

	oos.writeInt(startReqNr);
	oos.writeInt(endReqNr);
	oos.writeInt(cookieReqNr);
	oos.writeBoolean(changeCookie);
	oos.writeBoolean(noPostParams);
	oos.writeObject(sensitiveDataFilePath);
	oos.writeObject(responseData);
	oos.writeObject(paramData);
	
	oos.close();
}

allSet = RUNNING;
gui = gui();
gui.show();

// Wait for user to set the parameters
while (allSet == RUNNING)
	try {
		Thread.sleep(1000);
	} catch (InterruptedException sie) {
		out.println("A thread in WebScarab has interrupted the Privilege Escalation Testing Tool (PETT). Please restart the PETT.");
		out.println("=========== Interrupted ============");
		gui.setVisible(false);
		return;
	}
	

if (allSet == EXITED)
	return;
// else allSet == DONE and the following instructions can be executed

printLine("=========== Started new run ============");
printLine("Start Request ID:"+startReqNr);
printLine("End Request ID:"+endReqNr);
printLine("Use Cookie:"+changeCookie);
printLine("Cookie Request ID:"+cookieReqNr);
printLine("Expected Responses:"+responseData);
printLine("Sensitive Data Strings:"+sensitiveDataVector);
printLine("Parameters to change:"+paramData);
printLine("Don't use POST parameters:"+noPostParams);

saveInputs();

try {
	if (changeCookie == true) {
		//out.println("cookie: "+scripted.getRequest(cookieReqNr));
		cookie = scripted.getRequest(cookieReqNr).getHeader("Cookie");
		if (cookie == null) {
			out.println("Error: The request ID that you want to take the cookie from does not have a Cookie header.");
			out.println("=========== Interrupted ============");
			return;
		}
	}
	else
		printLine("WARNING: Not using a cookie from a different request");
		
} catch (NullPointerException npe) {
	out.println("Error: The request ID you want to take the cookie from does not exist in the Summary tab");
	out.println("=========== Interrupted ============");
	return;
}

expandParameterValues();

if (sendingType == PARALLEL)
{
	out.println("Fetching requests in parallel");
	fetchParallel();
}
else if (sendingType == SEQUENTIAL)
{
	out.println("Fetching requests sequentially, waiting time is: "+ waitTime);
	fetchSequentially();
}

if (exportFileWriter != null)
	exportFileWriter.close();

out.println("=========== Finished ============");