diff --git a/lib/filter/init.rb b/lib/filter/init.rb index e992891d0..23f9b8ee0 100644 --- a/lib/filter/init.rb +++ b/lib/filter/init.rb @@ -17,7 +17,15 @@ module BeEF return false if BeEF::Filter.has_non_printable_char?(str) true end - + + # check the os name value - for example, 'Windows XP' + def self.is_valid_osname?(str) + return false if not BeEF::Filter.is_non_empty_string?(str) + return false if BeEF::Filter.has_non_printable_char?(str) + return false if str.length < 2 + true + end + # verify the browser version string is valid def self.is_valid_browserversion?(str) return false if not BeEF::Filter.is_non_empty_string?(str) diff --git a/lib/server/inithandler.rb b/lib/server/inithandler.rb index 4f23035d2..eb6fbf76f 100644 --- a/lib/server/inithandler.rb +++ b/lib/server/inithandler.rb @@ -45,6 +45,11 @@ module BeEF raise WEBrick::HTTPStatus::BadRequest, "Invalid browser browser string" if not Filter.is_valid_browserstring?(browser_string) BD.set(session_id, 'BrowserReportedName', browser_string) + # get and store the os name + os_name = get_param(request.query, 'OsName') + raise WEBrick::HTTPStatus::BadRequest, "Invalid browser os name" if not Filter.is_valid_osname?(os_name) + BD.set(session_id, 'OsName', os_name) + # get and store page title page_title = get_param(request.query, 'PageTitle') raise WEBrick::HTTPStatus::BadRequest, "Invalid page title name" if not Filter.is_valid_pagetitle?(page_title) diff --git a/lib/ui/modules/modules.rb b/lib/ui/modules/modules.rb index bbfe2288e..7f0381cd2 100644 --- a/lib/ui/modules/modules.rb +++ b/lib/ui/modules/modules.rb @@ -71,6 +71,21 @@ class Modules < BeEF::HttpController summary_grid_hash['results'].push(page_name_row) # add the row end + # set and add the return values for the os name + os_name = BD.get(zombie_session, 'OsName') + if not host_name.nil? + encoded_os_name = CGI.escapeHTML(os_name) + encoded_os_name_hash = { 'OS Name' => encoded_os_name } + + page_name_row = { + 'category' => 'Browser Hook Initialisation', + 'data' => encoded_os_name_hash, + 'from' => 'Initialisation' + } + + summary_grid_hash['results'].push(page_name_row) # add the row + end + # set and add the return values for the browser name browser_name = BD.get(zombie_session, 'BrowserName') if not browser_name.nil?