Agartha

Payload Injection (LFI, RCE, SQLi, with optional BCheck), Auth Issues (Access Matrix, HTTP 403), Copy as JavaScript, and Bambdas

---

Agartha, specializes in advance payload generation and access control assessment. It adeptly identifies vulnerabilities related to injection attacks, and authentication/authorization issues. The dynamic payload generator crafts extensive wordlists for various injection vectors, including SQL Injection, Local File Inclusion (LFI), and Remote Code Execution(RCE). Furthermore, the extension constructs a comprehensive user access matrix, revealing potential access violations and privilege escalation paths. It also assists in performing HTTP 403 bypass checks, shedding light on auth misconfigurations. Additionally, it can convert HTTP requests to JavaScript code to help digging up XSS issues more.

In summary:

• Payload Generator: It dynamically constructs comprehensive wordlists for injection attacks, incorporating various encoding and escaping characters to enhance the effectiveness of security testing. These wordlists cover critical vulnerabilities such as SQL Injection (SQLi), Local File Inclusion (LFI), Remote Code Execution (RCE), and now also support BCheck syntax for seamless integration with Burp's BCheck framework.
  • Local File Inclusion, Path Traversal: It helps identifying vulnerabilities that allow attackers to access files on the server's filesystem.
  • Remote Code Execution, Command Injection: It aims to detects potential command injection points, enabling robust testing for code execution vulnerabilities.
  • SQL Injection: It assists to uncover SQL Injection vulnerabilities, including Stacked Queries, Boolean-Based, Union-Based, and Time-Based.
• Auth Matrix: By constructing a comprehensive access matrix, the tool reveals potential access violations and privilege escalation paths. This feature enhances security posture by addressing authentication and authorization issues.
  • You can use the web Spider feature to generate a sitemap/URL list, and it will crawl visible links from the user's session automatically.
• 403 Bypass: It aims to tackle common access restrictions, such as HTTP 403 Forbidden responses. It utilizes techniques like URL manipulation and request header modification to bypass implemented limitations.
• Copy as JavaScript: It converts Http requests to JavaScript code for further XSS exploitation and more.
• Bambdas Script Generator: The feature supports automatic generation of Bambdas-compatible scripts based on user input. It eliminates the need for manual coding, enabling faster creation of custom scripts and streamlining integration with the Bambdas engine.
  
  

Here is a small tutorial how to use.

Installation

You should download 'Jython' file and set your environment first:

• Burp Menu > Extender > Options > Python Environment > Locate Jython standalone jar file.

You can install Agartha through official store:

• Burp Menu > Extender > BApp Store > Agartha

Or for manual installation:

• Burp Menu > Extender > Extensions > Add > Extension Type: Python > Extension file(.py): Select 'Agartha.py' file

After all, you will see 'Agartha' tab in the main window and it will be also registered the right click, under:

• 'Extensions > Agartha', with three sub-menus:

  • 'Auth Matrix'

  • '403 Bypass'

  • 'Copy as JavaScript'

    

Local File Inclusion / Path Traversal

It supports both Unix and Windows file syntaxes, enabling dynamic wordlist generation for any desired path. Additionally, it can attempt to bypass Web Application Firewall (WAF) implementations, with various encodings and other techniques.

• 'Depth' specifies the extent of directory traversal for wordlist generation. You can create wordlists that reach up to or equal to this specified level. The default value is 5.
• 'Waf Bypass' inquires whether you want to enable all bypass features, such as the use of null bytes, various encoding techniques, and other methods to circumvent web application firewalls.

Remote Code Execution / Command Injection

It generates dynamic wordlists for command execution based on the supplied command. It combines various separators and terminators for both Unix and Windows environments.

• 'URL Encoding' encodes the output.

SQL Injection

It generates payloads for various types of SQL injection attacks, including Stacked Queries, Boolean-Based, Union-Based, and Time-Based. It doesn’t require any user inputs; you simply select the desired SQL attack types and databases, and it generates a wordlist with different combinations.

• 'URL Encoding' encodes the output.
• 'Waf Bypass' inquires whether you want to enable all bypass features, such as the use of null bytes, various encoding techniques, and other methods to circumvent web application firewalls.
• 'Union-Based' requires the specified depth for payload generation. You can create wordlists that reach up to the given value. The default value is 5.
• The remaining aspects pertain to database types and various attack vectors.

BCheck Code Generator

BCheck is Burp Suite's framework for creating and importing custom scan checks. These user-defined checks run alongside Burp Scanner’s built-in routines, allowing you to tailor scans to specific vulnerabilities or testing needs. By using BChecks, you can extend Burp’s scanning capabilities and streamline your workflow for more targeted and efficient assessments. Now you can generate the code automatically:

• You can click the “Generate the Payloads” button in the blue box above to create a classic wordlist, which can be used manually in Burp's Intruder or Repeater.
• Now, you also have the option to click the “Generate payloads for BCheck” button in the red box to generate the same payloads formatted in BCheck syntax, ready to be used in scans.

Please be aware that as the Bambdas script increases in size, it may cause performance issues, particularly during scanning. Larger scripts can slow down responsiveness, increase memory usage, and lead to delays in executing tasks.

After clicking the "Generate payloads for BCheck" button, the BCheck code will be automatically copied to your clipboard.

Next, go to 'Extensions > BChecks > New > Blank' from the Burp Suite menu, and simply paste the generated code.