Class: Msf::Exploit::Remote::HTTP::FlaskUnsign::URLSafeSigner

Inherits:
Object
  • Object
show all
Defined in:
lib/msf/core/exploit/remote/http/flask_unsign.rb

Direct Known Subclasses

URLSafeTimedSigner

Constant Summary collapse

DEFAULT_SEPARATOR = 
'.'

Instance Method Summary collapse

Constructor Details

#initialize(secret_key, salt, separator: DEFAULT_SEPARATOR) ⇒ URLSafeSigner

Returns a new instance of URLSafeSigner.



21
22
23
24
25
 
# File 'lib/msf/core/exploit/remote/http/flask_unsign.rb', line 21

def initialize(secret_key, salt, separator: DEFAULT_SEPARATOR)
  @secret_key = secret_key
  @salt = salt
  @separator = separator
end

Instance Method Details

#derive_key ⇒ Object 



27
28
29
30
31
 
# File 'lib/msf/core/exploit/remote/http/flask_unsign.rb', line 27

def derive_key
  hmac = OpenSSL::HMAC.new(@secret_key, OpenSSL::Digest.new('SHA1'))
  hmac.update(@salt)
  hmac.digest
end

#get_signature(value) ⇒ Object 



33
34
35
36
37
 
# File 'lib/msf/core/exploit/remote/http/flask_unsign.rb', line 33

def get_signature(value)
  hmac = OpenSSL::HMAC.new(derive_key, OpenSSL::Digest.new('SHA1'))
  hmac.update(value)
  FlaskUnsign.base64_encode(hmac.digest)
end