|
1 /* |
|
2 |
|
3 HTML manglizer |
|
4 -------------- |
|
5 Copyright (C) 2004 by Michal Zalewski <lcamtuf@coredump.cx> |
|
6 |
|
7 Fault reproduction utility. |
|
8 |
|
9 */ |
|
10 |
|
11 |
|
12 #include <stdio.h> |
|
13 #include <unistd.h> |
|
14 #include <stdlib.h> |
|
15 #include <string.h> |
|
16 #include <time.h> |
|
17 |
|
18 #include "tags.h" |
|
19 |
|
20 #define R(x) (rand() % (x)) |
|
21 |
|
22 #define MAXTCOUNT 100 |
|
23 #define MAXPCOUNT 20 |
|
24 #define MAXSTR2 80 |
|
25 |
|
26 void make_up_value(void) { |
|
27 char c=R(2); |
|
28 |
|
29 if (c) putchar('"'); |
|
30 |
|
31 switch (R(31)) { |
|
32 |
|
33 case 0: printf("javascript:"); make_up_value(); break; |
|
34 // case 1: printf("jar:"); make_up_value(); break; |
|
35 case 2: printf("mk:"); make_up_value(); break; |
|
36 case 3: printf("file:"); make_up_value(); break; |
|
37 case 4: printf("http:"); make_up_value(); break; |
|
38 case 5: printf("about:"); make_up_value(); break; |
|
39 case 6: printf("_blank"); break; |
|
40 case 7: printf("_self"); break; |
|
41 case 8: printf("top"); break; |
|
42 case 9: printf("left"); break; |
|
43 case 10: putchar('&'); make_up_value(); putchar(';'); break; |
|
44 case 11: make_up_value(); make_up_value(); break; |
|
45 |
|
46 case 12 ... 20: { |
|
47 int c = R(10) ? R(10) : (1 + R(MAXSTR2) * R(MAXSTR2)); |
|
48 char* x = malloc(c); |
|
49 memset(x,R(256),c); |
|
50 fwrite(x,c,1,stdout); |
|
51 free(x); |
|
52 break; |
|
53 } |
|
54 |
|
55 case 21: printf("%s","%n%n%n%n%n%n"); break; |
|
56 case 22: putchar('#'); break; |
|
57 case 23: putchar('*'); break; |
|
58 default: if (R(2)) putchar('-'); printf("%d",rand()); break; |
|
59 |
|
60 } |
|
61 |
|
62 if (c) putchar('"'); |
|
63 |
|
64 } |
|
65 |
|
66 |
|
67 void random_tag(void) { |
|
68 int tn, tc; |
|
69 |
|
70 do tn = R(MAXTAGS); while (!tags[tn][0]); |
|
71 tc = R(MAXPCOUNT) + 1; |
|
72 |
|
73 putchar('<'); |
|
74 |
|
75 switch (R(10)) { |
|
76 case 0: putchar(R(256)); break; |
|
77 case 1: putchar('/'); |
|
78 } |
|
79 |
|
80 printf("%s", tags[tn][0]); |
|
81 |
|
82 while (tc--) { |
|
83 int pn; |
|
84 switch (R(32)) { |
|
85 case 0: putchar(R(256)); |
|
86 case 1: break; |
|
87 default: putchar(' '); |
|
88 } |
|
89 do pn = R(MAXPARS-1) + 1; while (!tags[tn][pn]); |
|
90 printf("%s", tags[tn][pn]); |
|
91 switch (R(32)) { |
|
92 case 0: putchar(R(256)); |
|
93 case 1: break; |
|
94 default: putchar('='); |
|
95 } |
|
96 |
|
97 make_up_value(); |
|
98 |
|
99 } |
|
100 |
|
101 putchar('>'); |
|
102 |
|
103 } |
|
104 |
|
105 |
|
106 int main(int argc,char** argv) { |
|
107 int tc,seed; |
|
108 char* x = getenv("QUERY_STRING"); |
|
109 |
|
110 if (!x || sscanf(x,"%x",&seed) != 1) { |
|
111 printf("Content-type: text/plain\n\nMissing or invalid parameter.\n"); |
|
112 exit(1); |
|
113 } |
|
114 |
|
115 printf("Content-Type: text/html;charset=utf-8\nRefresh: 0;URL=remangle.cgi?0x%08x\n\n", seed); |
|
116 printf("<HTML><HEAD><META HTTP-EQUIV=\"Refresh\" content=\"0;URL=remangle.cgi?0x%08x\">\n", seed); |
|
117 printf("<script language=\"javascript\">setTimeout('window.location=\"remangle.cgi?0x%08x\"', 1000);</script>\n", seed); |
|
118 |
|
119 srand(seed); |
|
120 |
|
121 tc = R(MAXTCOUNT) + 1; |
|
122 while (tc--) random_tag(); |
|
123 fflush(0); |
|
124 return 0; |
|
125 } |