Skip to content

Commit 2f5289e

Browse files
hktalenthktalent
committed
3、file fuzz针对
aac、abw、arc... 的Content-Type: 进行类型识别，跳过无用的fuzz 2022-10-11
1 parent efbefc6 commit 2f5289e

File tree

7 files changed

+58
-22
lines changed

7 files changed

+58
-22
lines changed

‎brute/filefuzz.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,9 @@ import (
99
"github.com/hktalent/goSqlite_gorm/lib/scan/Const"
1010
"github.com/hktalent/goSqlite_gorm/pkg/models"
1111
"log"
12+
"mime"
1213
"net/url"
14+
"path/filepath"
1315
"regexp"
1416
"strings"
1517
"sync"
@@ -158,6 +160,8 @@ type FuzzData struct {
158160
Req *util.Page
159161
}
160162

163+
var r001 = regexp.MustCompile(`\.(aac)|(abw)|(arc)|(avif)|(avi)|(azw)|(bin)|(bmp)|(bz)|(bz2)|(cda)|(csh)|(css)|(csv)|(doc)|(docx)|(eot)|(epub)|(gz)|(gif)|(ico)|(ics)|(jar)|(jpeg)|(jpg)|(js)|(json)|(jsonld)|(mid)|(midi)|(mjs)|(mp3)|(mp4)|(mpeg)|(mpkg)|(odp)|(ods)|(odt)|(oga)|(ogv)|(ogx)|(opus)|(otf)|(png)|(pdf)|(php)|(ppt)|(pptx)|(rar)|(rtf)|(sh)|(svg)|(tar)|(tif)|(tiff)|(ts)|(ttf)|(txt)|(vsd)|(wav)|(weba)|(webm)|(webp)|(woff)|(woff2)|(xhtml)|(xls)|(xlsx)|(xml)|(xul)|(zip)|(3gp)|(3g2)|(7z)$`)
164+
161165
// 重写了fuzz：优化流程、优化算法、修复线程安全bug、增加智能功能
162166
// 两次 ioutil.ReadAll(resp.Body)，第二次就会 Read返回EOF error
163167
func FileFuzz(u string, indexStatusCode int, indexContentLength int, indexbody string) ([]string, []string) {
@@ -213,6 +217,9 @@ func FileFuzz(u string, indexStatusCode int, indexContentLength int, indexbody s
213217
if strings.HasPrefix(url404req.Protocol, "HTTP/2") || strings.HasPrefix(url404req.Protocol, "HTTP/3") {
214218
MaxErrorTimes = int32(len(filedic))
215219
}
220+
if c1 := util.GetClient(u, map[string]interface{}{"Timeout": 15 * time.Second, "ErrLimit": MaxErrorTimes}); nil != c1 {
221+
util.PutClientCc(u, c1)
222+
}
216223
//defer func() {
217224
// close(ch)
218225
// close(async_data)
@@ -304,6 +311,18 @@ func FileFuzz(u string, indexStatusCode int, indexContentLength int, indexbody s
304311
} else if lst200.Body == req.Body { // 无意义的 200
305312
continue
306313
}
314+
if oU1, err := url.Parse(szUrl); nil == err {
315+
a50 := r001.FindStringSubmatch(oU1.Path)
316+
if 0 < len(a50) {
317+
s2 := mime.TypeByExtension(filepath.Ext(a50[0]))
318+
ct := (*req).Header.Get("Content-Type")
319+
if "" != ct && "" != s2 && strings.Contains(ct, s2) {
320+
continue
321+
}
322+
}
323+
}
324+
325+
mime.TypeByExtension(".jpg")
307326
//log.Printf("%d : %s \n", req.StatusCode, szUrl)
308327
}
309328
go util.CheckHeader(req.Header, u)

‎lib/test/test.go‎

Lines changed: 20 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
package main
22

33
import (
4-
"fmt"
5-
"github.com/hktalent/ProScan4all/lib/util"
64
"log"
7-
"sync"
5+
"mime"
86
)
97

108
func main() {
9+
log.Println(mime.TypeByExtension(".jsp"))
1110
//
1211
//data, err := ioutil.ReadFile("/Users/51pwn/MyWork/TestPoc/JRMPListener.ser")
1312
//if nil == err {
@@ -24,22 +23,22 @@ func main() {
2423
// log.Println(resp.StatusCode)
2524
// }
2625
//})
27-
var Wg = sync.WaitGroup{}
28-
// 单独测试没有问题
29-
for i := 33; i < 8082; i++ {
30-
Wg.Add(1)
31-
go func(n int) {
32-
defer Wg.Done()
33-
s1 := fmt.Sprintf("http://127.0.0.1:%d/scan4all", n)
34-
if resp, err := util.HttpRequset(s1, "GET", "", false, nil); nil == err {
35-
log.Println(resp.StatusCode, s1)
36-
} else {
37-
if n == 8081 {
38-
log.Println(err)
39-
}
40-
}
41-
}(i)
42-
43-
}
44-
Wg.Wait()
26+
//var Wg = sync.WaitGroup{}
27+
//// 单独测试没有问题
28+
//for i := 33; i < 8082; i++ {
29+
// Wg.Add(1)
30+
// go func(n int) {
31+
// defer Wg.Done()
32+
// s1 := fmt.Sprintf("http://127.0.0.1:%d/scan4all", n)
33+
// if resp, err := util.HttpRequset(s1, "GET", "", false, nil); nil == err {
34+
// log.Println(resp.StatusCode, s1)
35+
// } else {
36+
// if n == 8081 {
37+
// log.Println(err)
38+
// }
39+
// }
40+
// }(i)
41+
//
42+
//}
43+
//Wg.Wait()
4544
}

‎lib/util/checkerImp.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,11 @@ func RegResponsCheckFunc(cbk ...func(*CheckerTools, ...interface{})) {
3737
GetInstance(RespBody).RegCheckFunc(cbk...)
3838
}
3939

40+
// 注册body处理
41+
func RegHeaderCheckFunc(cbk ...func(*CheckerTools, ...interface{})) {
42+
GetInstance(ReqHeader).RegCheckFunc(cbk...)
43+
}
44+
4045
// 构建一个检查器
4146
func New(name string) *CheckerTools {
4247
ct := GetObjFromNoRpt[*CheckerTools](name)

‎lib/util/util.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,12 @@ func GetClient4Cc(szUrl string) *PipelineHttp.PipelineHttp {
8989
}
9090
return nil
9191
}
92+
func PutClientCc(szUrl string, c *PipelineHttp.PipelineHttp) {
93+
CloseHttpClient(szUrl)
94+
oU, _ := url.Parse(szUrl)
95+
clientHttpCc.Delete(oU.Scheme + oU.Host)
96+
clientHttpCc.Set(oU.Scheme+oU.Host, c, defaultInteractionDuration)
97+
}
9298

9399
//var G_hc *http.Client
94100

‎new.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
11
1、fuzz、及所有请求输出限制为800k，避免被反制、进行内存攻击导致程序崩溃
22
2、修复naabu、nmap扫描后使用ip继续走后续流程，导致无法正确访问目标的bug，https通常是限定只能域名访问的
3+
3、file fuzz针对
4+
aac、abw、arc、avif、avi、azw、bin、bmp、bz、bz2、cda、csh、css、csv、doc、docx、eot、epub、gz、gif、ico、ics、jar、jpeg、jpg、js、json、jsonld、mid、midi、mjs、mp3、mp4、mpeg、mpkg、odp、ods、odt、oga、ogv、ogx、opus、otf、png、pdf、php、ppt、pptx、rar、rtf、sh、svg、tar、tif、tiff、ts、ttf、txt、vsd、wav、weba、webm、webp、woff、woff2、xhtml、xls、xlsx、xml、xul、zip、3gp、3g2、7z
5+
的Content-Type: 进行类型识别，跳过无用的fuzz

‎pkg/checker/fuzz/fuzzBody.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,5 +30,8 @@ func init() {
3030
util.SendLog(fmt.Sprintf("%v", i), "leak", strings.Join(a, "\n"), "")
3131
}
3232
})
33+
//util.RegHeaderCheckFunc(func(r *util.CheckerTools, i ...interface{}) {
34+
//
35+
//})
3336
})
3437
}

‎pocs_go/shiro/CVE_2016_4437.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,8 @@ func init() {
9696
// 检查 cookie
9797
// Shiro CVE_2016_4437 cookie
9898
// 其他POC cookie同一检查入口
99-
util.GetInstance(util.ReqHeader).RegCheckFunc(func(r *util.CheckerTools, args ...interface{}) {
99+
// 第一个参数header，第二个为 url
100+
util.RegHeaderCheckFunc(func(r *util.CheckerTools, args ...interface{}) {
100101
a := r.GetHead(args[0], "Set-Cookie")
101102
if nil != a && 0 < len(a) {
102103
//return len(DeleteMe.FindAllStringIndex(SetCookieAll, -1))

0 commit comments

Comments
 (0)