
CRLF 및 오픈 리다이렉트 퍼저
URL 목록을 순회하며 CRLF 및 오픈 리다이렉트 페이로드를 시도하는 간단한 Python 도구입니다.
▪ ▐ ▄ ▐▄▄▄▄▄▄ . ▄▄· ▄▄▄▄▄▄• ▄▌.▄▄ ·
██ •█▌▐█ ·██▀▄.▀·▐█ ▌▪•██ █▪██▌▐█ ▀.
▐█·▐█▐▐▌▪▄ ██▐▀▀▪▄██ ▄▄ ▐█.▪█▌▐█▌▄▀▀▀█▄
▐█▌██▐█▌▐▌▐█▌▐█▄▄▌▐███▌ ▐█▌·▐█▄█▌▐█▄▪▐█
▀▀▀▀▀▀ █▪ ▀▀▀• ▀▀▀ ·▀▀▀ ▀▀▀ ▀▀▀ ▀▀▀▀
~ BOUNTYSTRIKE ~
usage: Injectus [-h] [-f FILE] [-u URL] [-r] [-w WORKERS] [-t TIMEOUT]
[-d DELAY] [-c] [-op]
CRLF and open redirect fuzzer. Crafted by @dubs3c.
optional arguments:
-h, --help show this help message and exit
-f FILE, --file FILE File containing URLs
-u URL, --url URL Single URL to test
-r, --no-request Only build attack list, do not perform any requests
-w WORKERS, --workers WORKERS
Amount of asyncio workers, default is 10
-t TIMEOUT, --timeout TIMEOUT
HTTP request timeout, default is 6 seconds
-d DELAY, --delay DELAY
The delay between requests, default is 1 second
-c, --crlf Only perform crlf attacks
-op, --openredirect Only perform open redirect attacks
버그 바운티 파이프라인 (https://github.com/BountyStrike/Bountystrike-sh)에 포함할 간단한 CRLF/오픈 리다이렉트 스캐너가 필요했습니다. 제 요구를 충족시키는 도구를 찾지 못해서 Injectus를 만들었습니다. 다른 도구보다 잘 작동하는지 확인하기 위한 약간의 실험입니다.
다음 URL이 있다고 가정해 봅시다:
https://dubell.io/?param1=value1&url=value2¶m3=value3
CRLF 공격의 경우, Injectus는 모든 CRLF 페이로드를 각 파라미터 값에 한 번씩 주입합니다. 예를 들어, 위 URL을 사용하여 다음과 같은 목록을 생성합니다:
https://dubell.io/?param1=%%0a0abounty:strike&url=value2¶m3=value3
https://dubell.io/?param1=%0abounty:strike&url=value2¶m3=value3
https://dubell.io/?param1=%0d%0abounty:strike&url=value2¶m3=value3
https://dubell.io/?param1=%0dbounty:strike&url=value2¶m3=value3
https://dubell.io/?param1=%23%0dbounty:strike&url=value2¶m3=value3
https://dubell.io/?param1=%25%30%61bounty:strike&url=value2¶m3=value3
https://dubell.io/?param1=%25%30abounty:strike&url=value2¶m3=value3
https://dubell.io/?param1=%250abounty:strike&url=value2¶m3=value3
https://dubell.io/?param1=%25250abounty:strike&url=value2¶m3=value3
https://dubell.io/?param1=%3f%0dbounty:strike&url=value2¶m3=value3
https://dubell.io/?param1=%u000abounty:strike&url=value2¶m3=value3
https://dubell.io/?param1=value1&url=%%0a0abounty:strike¶m3=value3
https://dubell.io/?param1=value1&url=%0abounty:strike¶m3=value3
https://dubell.io/?param1=value1&url=%0d%0abounty:strike¶m3=value3
https://dubell.io/?param1=value1&url=%0dbounty:strike¶m3=value3
https://dubell.io/?param1=value1&url=%23%0dbounty:strike¶m3=value3
https://dubell.io/?param1=value1&url=%25%30%61bounty:strike¶m3=value3
https://dubell.io/?param1=value1&url=%25%30abounty:strike¶m3=value3
https://dubell.io/?param1=value1&url=%250abounty:strike¶m3=value3
https://dubell.io/?param1=value1&url=%25250abounty:strike¶m3=value3
https://dubell.io/?param1=value1&url=%3f%0dbounty:strike¶m3=value3
https://dubell.io/?param1=value1&url=%u000abounty:strike¶m3=value3
https://dubell.io/?param1=value1&url=value2¶m3=%%0a0abounty:strike
https://dubell.io/?param1=value1&url=value2¶m3=%0abounty:strike
https://dubell.io/?param1=value1&url=value2¶m3=%0d%0abounty:strike
https://dubell.io/?param1=value1&url=value2¶m3=%0dbounty:strike
https://dubell.io/?param1=value1&url=value2¶m3=%23%0dbounty:strike
https://dubell.io/?param1=value1&url=value2¶m3=%25%30%61bounty:strike
https://dubell.io/?param1=value1&url=value2¶m3=%25%30abounty:strike
https://dubell.io/?param1=value1&url=value2¶m3=%250abounty:strike
https://dubell.io/?param1=value1&url=value2¶m3=%25250abounty:strike
https://dubell.io/?param1=value1&url=value2¶m3=%3f%0dbounty:strike
https://dubell.io/?param1=value1&url=value2¶m3=%u000abounty:strike
보시다시피, 모든 CRLF 페이로드는 첫 번째 파라미터 값에 주입됩니다. 루프가 완료되면 Injectus는 모든 페이로드를 두 번째 파라미터에 주입하고, 이런 식으로 계속 진행합니다. 모든 파라미터에 주입이 완료되면 목록이 완성됩니다.
쿼리 파라미터가 없는 경우, Injectus는 각 페이로드를 URL에 단순히 추가합니다. 예:
https://dubell.io/some/path/%%0a0abounty:strike
https://dubell.io/some/path/%0abounty:strike
https://dubell.io/some/path/%0d%0abounty:strike
https://dubell.io/some/path/%0dbounty:strike
https://dubell.io/some/path/%23%0dbounty:strike
https://dubell.io/some/path/%23%0dbounty:strike
https://dubell.io/some/path/%25%30%61bounty:strike
https://dubell.io/some/path/%25%30abounty:strike
https://dubell.io/some/path/%250abounty:strike
https://dubell.io/some/path/%25250abounty:strike
https://dubell.io/some/path/%3f%0dbounty:strike
https://dubell.io/some/path/%3f%0dbounty:strike
https://dubell.io/some/path/%u000abounty:strike
오픈 리다이렉트 페이로드를 주입할 때, Injectus는 url과 같은 일반적인 리다이렉트 키워드를 포함하는 쿼리/경로 파라미터가 있는 경우에만 페이로드를 주입합니다. 다음 URL에 주입하는 경우: https://dubell.io/?param1=value1&url=dashboard¶m3=value3:
https://dubell.io/?param1=value1&url=$2f%2fbountystrike.io%2f%2fparam3=value3
https://dubell.io/?param1=value1&url=%2f$2fbountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=%2fbountystrike.io%2f%2fparam3=value3
https://dubell.io/?param1=value1&url=%2fbountystrike.io//param3=value3
https://dubell.io/?param1=value1&url=%2fbountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=////bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=///bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=//bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=/\x08ountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=/bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=/http://bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=bountystrike.ioparam3=value3
URL에 쿼리 파라미터 url이 포함되어 있으므로 Injectus는 해당 파라미터에 페이로드를 주입합니다.
경로 파라미터를 사용하는 예시입니다. 원본 URL: https://dubell.io/some/path/that/redirect/dashboard:
https://dubell.io/some/path/that/redirect/$2f%2fbountystrike.io%2f%2f
https://dubell.io/some/path/that/redirect/%2f$2fbountystrike.io
https://dubell.io/some/path/that/redirect/%2fbountystrike.io%2f%2f
https://dubell.io/some/path/that/redirect/%2fbountystrike.io
https://dubell.io/some/path/that/redirect/%2fbountystrike.io//
https://dubell.io/some/path/that/redirect/////bountystrike.io
https://dubell.io/some/path/that/redirect////bountystrike.io
https://dubell.io/some/path/that/redirect///bountystrike.io
https://dubell.io/some/path/that/redirect//\x08ountystrike.io
https://dubell.io/some/path/that/redirect//bountystrike.io
https://dubell.io/some/path/that/redirect//http://bountystrike.io
https://dubell.io/some/path/that/redirect/bountystrike.io
이전과 마찬가지로, 쿼리 파라미터나 경로 파라미터가 발견되지 않으면 Injectus는 각 페이로드를 URL에 단순히 추가합니다:
https://dubell.io/$2f%2fbountystrike.io%2f%2f
https://dubell.io/%2f$2fbountystrike.io
https://dubell.io/%2fbountystrike.io%2f%2f
https://dubell.io/%2fbountystrike.io
https://dubell.io/%2fbountystrike.io//
https://dubell.io/////bountystrike.io
https://dubell.io////bountystrike.io
https://dubell.io///bountystrike.io
https://dubell.io//\\bountystrike.io
https://dubell.io//bountystrike.io
https://dubell.io//http://bountystrike.io
https://dubell.io/bountystrike.io
pip3.7 install -r requirements.txt --user
모든 피드백이나 아이디어를 환영합니다! 무엇인가 개선하고 싶으신가요? 풀 리퀘스트를 생성해 주세요!
git checkout -b my-new-featurepre-commit installgit commit -am 'Add some feature'git push origin my-new-feature