Injectus

Semplice strumento Python che scorre una lista di URL provando payload CRLF e open redirect.


    ▪   ▐ ▄  ▐▄▄▄▄▄▄ . ▄▄· ▄▄▄▄▄▄• ▄▌.▄▄ ·
    ██ •█▌▐█  ·██▀▄.▀·▐█ ▌▪•██  █▪██▌▐█ ▀.
    ▐█·▐█▐▐▌▪▄ ██▐▀▀▪▄██ ▄▄ ▐█.▪█▌▐█▌▄▀▀▀█▄
    ▐█▌██▐█▌▐▌▐█▌▐█▄▄▌▐███▌ ▐█▌·▐█▄█▌▐█▄▪▐█
    ▀▀▀▀▀ █▪ ▀▀▀• ▀▀▀ ·▀▀▀  ▀▀▀  ▀▀▀  ▀▀▀▀
               ~ BOUNTYSTRIKE ~

usage: Injectus [-h] [-f FILE] [-u URL] [-r] [-w WORKERS] [-t TIMEOUT]
                [-d DELAY] [-c] [-op]

Fuzzer CRLF e open redirect. Creato da @dubs3c.

argomenti opzionali:
  -h, --help            mostra questo messaggio di aiuto ed esci
  -f FILE, --file FILE  File contenente gli URL
  -u URL, --url URL     Singolo URL da testare
  -r, --no-request      Solo costruire la lista di attacchi, non effettuare richieste
  -w WORKERS, --workers WORKERS
                        Numero di worker asyncio, default 10
  -t TIMEOUT, --timeout TIMEOUT
                        Timeout della richiesta HTTP, default 6 secondi
  -d DELAY, --delay DELAY
                        Ritardo tra le richieste, default 1 secondo
  -c, --crlf            Esegui solo attacchi CRLF
  -op, --openredirect   Esegui solo attacchi open redirect

Motivazione

Avevo bisogno di uno scanner semplice per CRLF/open redirect da integrare nella mia pipeline di bug bounty su https://github.com/BountyStrike/Bountystrike-sh. Non ho trovato strumenti che soddisfacessero le mie esigenze, quindi ho creato Injectus. È un piccolo esperimento per vedere se funziona meglio di altri strumenti.

Progettazione

Se abbiamo il seguente URL:

https://dubell.io/?param1=value1&url=value2&param3=value3

Per gli attacchi CRLF, Injectus inietta ogni payload una volta nel valore di un parametro, per ogni n parametri. Ad esempio, Injectus creerà la seguente lista con l'URL sopra:

https://dubell.io/?param1=%%0a0abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%0abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%0d%0abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%0dbounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%23%0dbounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%25%30%61bounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%25%30abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%250abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%25250abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%3f%0dbounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%u000abounty:strike&url=value2&param3=value3

https://dubell.io/?param1=value1&url=%%0a0abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%0abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%0d%0abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%0dbounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%23%0dbounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%25%30%61bounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%25%30abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%250abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%25250abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%3f%0dbounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%u000abounty:strike&param3=value3

https://dubell.io/?param1=value1&url=value2&param3=%%0a0abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%0abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%0d%0abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%0dbounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%23%0dbounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%25%30%61bounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%25%30abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%250abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%25250abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%3f%0dbounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%u000abounty:strike

Come puoi vedere, ogni payload CRLF viene iniettato nel valore del primo parametro. Una volta completato il ciclo, Injectus inietta ogni payload nel secondo parametro, e così via. Quando tutti i parametri sono stati iniettati, la lista è completa.

Se non ci sono parametri di query, Injectus si limita ad aggiungere ogni payload all'URL, in questo modo:

https://dubell.io/some/path/%%0a0abounty:strike
https://dubell.io/some/path/%0abounty:strike
https://dubell.io/some/path/%0d%0abounty:strike
https://dubell.io/some/path/%0dbounty:strike
https://dubell.io/some/path/%23%0dbounty:strike
https://dubell.io/some/path/%23%0dbounty:strike
https://dubell.io/some/path/%25%30%61bounty:strike
https://dubell.io/some/path/%25%30abounty:strike
https://dubell.io/some/path/%250abounty:strike
https://dubell.io/some/path/%25250abounty:strike
https://dubell.io/some/path/%3f%0dbounty:strike
https://dubell.io/some/path/%3f%0dbounty:strike
https://dubell.io/some/path/%u000abounty:strike

Quando si iniettano payload open redirect, Injectus inietta un payload solo se esiste un parametro di query o percorso contenente una parola chiave tipica di reindirizzamento, ad esempio url. Iniettando nell'URL seguente https://dubell.io/?param1=value1&url=dashboard&param3=value3:

https://dubell.io/?param1=value1&url=$2f%2fbountystrike.io%2f%2fparam3=value3
https://dubell.io/?param1=value1&url=%2f$2fbountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=%2fbountystrike.io%2f%2fparam3=value3
https://dubell.io/?param1=value1&url=%2fbountystrike.io//param3=value3
https://dubell.io/?param1=value1&url=%2fbountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=////bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=///bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=//bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=/\x08ountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=/bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=/http://bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=bountystrike.ioparam3=value3

L'URL contiene il parametro di query url, quindi Injectus inietterà i payload in quel parametro.

Un esempio con parametri di percorso. L'URL originale è https://dubell.io/some/path/that/redirect/dashboard:

https://dubell.io/some/path/that/redirect/$2f%2fbountystrike.io%2f%2f
https://dubell.io/some/path/that/redirect/%2f$2fbountystrike.io
https://dubell.io/some/path/that/redirect/%2fbountystrike.io%2f%2f
https://dubell.io/some/path/that/redirect/%2fbountystrike.io
https://dubell.io/some/path/that/redirect/%2fbountystrike.io//
https://dubell.io/some/path/that/redirect/////bountystrike.io
https://dubell.io/some/path/that/redirect////bountystrike.io
https://dubell.io/some/path/that/redirect///bountystrike.io
https://dubell.io/some/path/that/redirect//\x08ountystrike.io
https://dubell.io/some/path/that/redirect//bountystrike.io
https://dubell.io/some/path/that/redirect//http://bountystrike.io
https://dubell.io/some/path/that/redirect/bountystrike.io

Come prima, se non vengono trovati parametri di query o di percorso, Injectus si limita ad aggiungere ogni payload all'URL:

https://dubell.io/$2f%2fbountystrike.io%2f%2f
https://dubell.io/%2f$2fbountystrike.io
https://dubell.io/%2fbountystrike.io%2f%2f
https://dubell.io/%2fbountystrike.io
https://dubell.io/%2fbountystrike.io//
https://dubell.io/////bountystrike.io
https://dubell.io////bountystrike.io
https://dubell.io///bountystrike.io
https://dubell.io//\\bountystrike.io
https://dubell.io//bountystrike.io
https://dubell.io//http://bountystrike.io
https://dubell.io/bountystrike.io

Installazione

pip3.7 install -r requirements.txt --user

Contribuire

Ogni feedback o idea è benvenuto! Vuoi migliorare qualcosa? Crea una pull request!

Fai un fork!
Crea il tuo ramo per la funzionalità: git checkout -b my-new-feature
Configura i controlli pre-commit: pre-commit install
Esegui il commit delle tue modifiche: git commit -am 'Add some feature'
Carica il ramo: git push origin my-new-feature
Invia una pull request :D

Injectus

Più Popolari

Injectus

Motivazione

Progettazione

Installazione

Contribuire