# Algorithm to generate all the possible combinations

I develop an application using WinForms/C#.

• In my software I have a List of objects, let's say `List<Item> Items`.
• There is also another List of objects, let's say `List<Factor> Factors`.
• Every Item contains multiple Output Factors (information you can extract from the Item).
• Also, every Item contains multiple Input Factors (they can trigger a function in the Item. Every Item requires a different set of Factors).

A very simplistic (like pseudo-code) example of the class could be:

``````class Factor
{
int Id { get; set; };
string Title;
string Description;
}

class Item1 : Item
{
List<Factor> OutputFactors { get; set; }  //Factor1, Factor3
List<Factor> InputFactors { get; set; }  //Factor4, Factor2, Factor7
...
}

class Item2 : Item
{
List<Factor> OutputFactors { get; set; }  //Factor3, Factor5, Factor6
List<Factor> InputFactors { get; set; }  //Factor1, Factor3
...
}
``````

Question: In a given `List<Item>` how can I find all the possible paths/ combinations which can trigger every Item of the List.

For example, the above code with Item1 and Item2 would have as a result:

``````--------Path1----------------
Get Factors from: Item1.OutputFactors[0] , Item1.OutputFactors[1]
Triggers: Item2.InputFactors
--------Path2----------------
Get Factors from: Item1.OutputFactors[0] , Item2.OutputFactors[0]
Triggers: Item2.InputFactors
--------Path3----------------
....
``````

Note: I will use the code in a pen-test tool I develop, in order to track down all the possible attack factors in every webpage of a domain.

## 1 Answer

The examples you have provided are kind of nonsensical.

What you are describing with "attributes" are just request parameters that are used when one is redirected from one page to another.

An algorithm to map out all pages is to go the homepage, regex all form tags, add the action attribute (url) to a list, expand that action attribute list object by the request parameters in the body of the form tag (list) and also remember which request method it is (get/post).

Doing this recursively, you will reach every page that you have access. If page 1 redirects to page 2 with params: p1, p2, p3, your list will contain [{fromPage: page1, toPage: page2, params: [p1, p2, p3], method: get}, ...].

Once you have gathered all that information, you can start to do boundary tests ("attacks") on all parameters. For page1->page2, you would use p1 - p3 and set them to any possible value and see if the server crashes or behaves inappropriately...

But before you can do all of this, you will have set an internal alarm and will be heavily monitored and dealt with appropriately! Unless you have authority to legitimately pen-test a page, I would not bother! Not worth it! I do not assume you have because of the lack of knowledge you have demonstrated with the way you asked the question!

• You are just throwing around words now. "Brute Force to gain privileges/account details" - as if testing out any possible combination of values for the parameters of each form was not "brute force"... furthermore, no brute force grants you "access", it merely shows you bugs. Whether you can capitalize on bugs or not, depends on the specific bug. Is it a buffer overflow in the underlying software used? Can you inject custom assembler shellcode? What platform is it? Same with "SQL injection", and other stuff! Whether you like it or not, what I said holds true to what you are trying to do... – Aphton Jul 20 '18 at 17:33
• Tasos Kalaitzidis No, of course not. But your question was (...) "In my software every web application has many WebPages which follow the bellow structrure" --> "Question: I need a method/algorithm on how to find all the possible combinations/paths of a possible attack" You are specifically asking about paths/pages. You even listed a folder structure above that! You never talked about every attack vector. That would be to broad to begin with anyway. Let me ask you one thing - what do you not like about my answer? Does it not solve the problem? – Aphton Jul 20 '18 at 18:33
• Well ok, then this is a case of miscommunication. You basically wanna find all attack vectors on a webpage... That is to broad for me to address, I will have to pass. Good luck with finding the answer to your question! – Aphton Jul 20 '18 at 19:09