additional test + black

blacklanternsecurity · Nov 27, 2023 · 1a05798 · 1a05798
1 parent bf88791
commit 1a05798
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 8 deletions.
diff --git a/badsecrets/examples/cli.py b/badsecrets/examples/cli.py
@@ -74,7 +74,11 @@ def report(self):
 class ReportIdentify(BaseReport):
     def report(self):
         self.print_report(
-            print_status("Cryptographic Product Identified (no vulnerability, or not confirmed vulnerable)\n", color=Fore.YELLOW, passthru=True)
+            print_status(
+                "Cryptographic Product Identified (no vulnerability, or not confirmed vulnerable)\n",
+                color=Fore.YELLOW,
+                passthru=True,
+            )
         )
         if self.x["hashcat"] is not None:
             print_hashcat_results(self.x["hashcat"])

diff --git a/badsecrets/modules/aspnet_vstate.py b/badsecrets/modules/aspnet_vstate.py
@@ -26,4 +26,4 @@ def check_secret(self, compressed_vstate):
         uncompressed = self.attempt_decompress(compressed_vstate)
         if uncompressed and ASPNET_Viewstate.valid_preamble(uncompressed):
             r = {"source": compressed_vstate, "info": "ASP.NET Vstate (Unprotected, Compressed)"}
-            return {"secret": "UNPROTECTED (compressed)", "details": r}
+            return {"secret": "UNPROTECTED (compressed)", "details": r}
diff --git a/tests/all_modules_test.py b/tests/all_modules_test.py
@@ -126,9 +126,8 @@ def test_carve_all_cookies():
         r_list = carve_all_modules(requests_response=res)
         assert len(r_list) == 7
 
-def test_carve_multiple_vulns():
-
 
+def test_carve_multiple_vulns():
     multiple_vuln_html = """
     <div class="aspNetHidden">
 <input type="hidden" name="__VSTATE" id="__VSTATE" value="H4sIAAAAAAAA/81VXW/TMBRNltZNsnVsCBCMFwvxAFrVde3G2EORpo6PagJNZOJlqpib3LURiT0cRyg888p/4Q/xW4Zv6w6GG" />
@@ -138,11 +137,31 @@ def test_carve_multiple_vulns():
 
     with requests_mock.Mocker() as m:
         m.get(
-        f"http://multiplevulns.carve-all.badsecrets.com/",
-        status_code=200,
-        text=multiple_vuln_html,
+            f"http://multiplevulns.carve-all.badsecrets.com/",
+            status_code=200,
+            text=multiple_vuln_html,
         )
 
         res = requests.get(f"http://multiplevulns.carve-all.badsecrets.com/")
         r_list = carve_all_modules(requests_response=res)
-        assert len(r_list) == 2
+        assert len(r_list) == 2
+
+
+def test_carve_empty_vstate():
+    empty_vstate_html = """
+    <div class="aspNetHidden">
+<input type="hidden" name="__VSTATE" id="__VSTATE" value="" />
+
+"""
+
+    with requests_mock.Mocker() as m:
+        m.get(
+            f"http://emptyvstate.carve-all.badsecrets.com/",
+            status_code=200,
+            text=empty_vstate_html,
+        )
+
+        res = requests.get(f"http://emptyvstate.carve-all.badsecrets.com/")
+        r_list = carve_all_modules(requests_response=res)
+        assert r_list
+        assert r_list[0]["product"] == "EMPTY '__VSTATE' FORM FIELD"