Script to solve burp labs or for bug bounty #340

timruff · 2023-05-17T09:08:35Z

Just simple script to add IP random to X-Forwarded-For: in Header request.
For section HTTP Sender

thc202 · 2023-05-17T09:16:33Z

Would be good to mention the original script, maybe it can be removed too since the HTTP Sender applies to fuzzer messages as well.

timruff · 2023-05-17T09:58:23Z

I can't get random_x_forwarded_for_ip.js to work in Fuzzer HTTP processor. In the fuzzer the script does not appear, in the response the x-forwarded-for-ip does not appear.
The only way to do it was the script I put.

timruff

remove name and add comment to script origine

timruff · 2023-05-17T11:30:34Z

I'm sorry, I just understood how to use the random_x_forwarded_for_ip.js script, I see how why my script is not necessary. Thanks for the time spent on the problem.

thc202 · 2023-05-17T11:39:16Z

It's the other way around, this script supersedes the other script and why was suggesting to remove the other script, though both cover their own use cases.

thc202 · 2023-05-17T11:42:30Z

httpsender/AddHeaderXForwardedForRandomIP.js

@@ -1,4 +1,4 @@
-// @author Ruffenach Timothée
+// The original script comes from the Fuzzer HTTP Processor section under the name random_x_forwarded_for_ip.js


I was not saying to remove the name, just mention the other script. This is for maintenance purposes, if changes are done in one script they most likely need to be done in both.

kingthorin · 2023-05-20T08:47:21Z

httpfuzzerprocessor/pitchWork.py

@@ -0,0 +1,84 @@
+# Version 1.0
+# @author RUFFENACH Timothée
+# Script inspired from https://02108124551050482571.googlegroups.com/attach/54c6e34f6fe20/message_processor.js?part=0.1&view=1&vt=ANaJVrEJuACewYorhYYa_zyhyMSug06pmlERCqfYdLsukQBC3OW3LATuXG1WHk_Fw9a0nhexG8ykFDuFgBGYrKAg_pOQ61M36MwC9SOBGvK4KLZn3eDkNzY (dot run on owasp 2.12.0)


dot run on owasp 2.12.0

?

legacy script in javascript don't run with owasp 2.12.0

That's not a ZAP issue that's a JRE issue. If you're using a Java 11 JRE it'll still run.

Also OWASP is the organization ZAP is the project/product 😉

Link to the thread/post rather than the attachment, which should be more reliable.

I don't found the original post.

kingthorin · 2023-05-20T08:47:49Z

httpfuzzerprocessor/pitchWork.py

+# The script fuzz in mode pitchfork.
+# To Use : Enable script.
+# In fuzzer Add 2 EmptyNull with good number.
+# Select two 2 files and launch  the fuzzer.


There's a double space between launch and the.

kingthorin · 2023-05-20T08:57:59Z

httpfuzzerprocessor/pitchWork.py

+    fileChooser.setMultiSelectionEnabled(True)
+    filePath1 = ""
+    result = fileChooser.showOpenDialog(None)
+
+    if result == JFileChooser.APPROVE_OPTION:
+        selectedFiles = fileChooser.getSelectedFiles()
+        for file in selectedFiles:


Why does this need to allow multi-select? If only single files could be selected wouldn't that remove the need to loop?

Also since this logic is the same for both files can't it just be extracted to a method?

This should be done in the EDT also.

kingthorin · 2023-05-20T08:58:48Z

httpfuzzerprocessor/pitchWork.py

+# Script inspired from https://02108124551050482571.googlegroups.com/attach/54c6e34f6fe20/message_processor.js?part=0.1&view=1&vt=ANaJVrEJuACewYorhYYa_zyhyMSug06pmlERCqfYdLsukQBC3OW3LATuXG1WHk_Fw9a0nhexG8ykFDuFgBGYrKAg_pOQ61M36MwC9SOBGvK4KLZn3eDkNzY (dot run on owasp 2.12.0)
+# The script fuzz in mode pitchfork.
+# To Use : Enable script.
+# In fuzzer Add 2 EmptyNull with good number.


Suggested change

# In fuzzer Add 2 EmptyNull with good number.

# In the Fuzzer add 2 EmptyNull payloads with a good number of iterations.

timruff · 2023-05-20T13:31:54Z

I made some correction and integrated the multiple payloads management.

kingthorin · 2023-06-05T19:33:10Z

Why are more and more files being added to this PR?

kingthorin · 2023-06-05T19:33:21Z

To address the DCO requirement you'll need to sign-off the commit(s):

Signed-off-by: Timothée Ruffenach <[email protected]>

…mIP.js Signed-off-by: Timothée Ruffenach <[email protected]>

Signed-off-by: Timothée Ruffenach <[email protected]>

timruff · 2023-06-05T20:21:45Z

I'm doing courses on zap proxy to do burp suite labs with zap proxy. I need to make scripts to fix labs or bounty bugs. I don't know much about git hub it my first contribution on other project with github.

kingthorin · 2023-06-05T20:23:13Z

Okay that makes more sense I guess. They're all useful. Might want to tweak the title/subject and maybe make it draft (until you've included everything you're thinking of).

Signed-off-by: Timothée Ruffenach <[email protected]>

…to fileAction.py Signed-off-by: Timothée Ruffenach <[email protected]>

Signed-off-by: Timothée Ruffenach <[email protected]>

kingthorin

I didn't get through all the "standalone" scripts, but here's more feedback.

kingthorin · 2023-06-28T10:16:32Z

httpfuzzerprocessor/RTT_time_filter.py

+	if (init == False):
+		initialise()


Maybe "shouldInit" should be more clear to future users/maintainers?

ok Im have rename to shouldInit

kingthorin · 2023-06-28T10:16:50Z

httpfuzzerprocessor/RTT_time_filter.py

+
+# Called after receiving the fuzzed message from the server
+def processResult(utils, fuzzResult) :
+	global isChek,time


rename isCheck by choice

My point was that it's misspelled here.

kingthorin · 2023-06-28T10:19:33Z

httpfuzzerprocessor/RTT_time_filter.py

+	time = getNumber(1,50000,"how many time do you want ?")
+	isCheck = JOptionPane.showConfirmDialog(None, "more high or equal (YES) esle less or equal (NO)", "Confirm", JOptionPane.YES_NO_OPTION)


This English is rough, I'm happy to help but I need a better description of what's meant here.

They should both start with capitals and there's a type in "else".

I changed the sentences for more understanding, sorry my native language is not english

No problem, that's why I was offering to help 👍

kingthorin · 2023-06-28T10:20:21Z

httpfuzzerprocessor/RTT_time_filter.py

+	if isCheck == JOptionPane.YES_OPTION and (int(fuzzResult.getHttpMessage().getTimeElapsedMillis()) >= time):
+		return bool(1)
+	elif isCheck == JOptionPane.NO_OPTION and (int(fuzzResult.getHttpMessage().getTimeElapsedMillis()) <= time):
+		return bool(1)
+	else:
+		return bool(0);


Any reason these can't just return true or false?

Ok i have changed by TRUE and FALSE

kingthorin · 2023-06-28T10:21:05Z

httpfuzzerprocessor/filtersResultWithStringOnBodyResponse.py

+
+    # ask stings to find
+    while entry == "":
+        entry = getString("what character string do you want to find ?")


Suggested change

entry = getString("what character string do you want to find ?")

entry = getString("What character string do you want to find ?")

I made the changes and make correction of other sentence

kingthorin · 2023-06-28T10:26:40Z

httpfuzzerprocessor/pitchWork.py

+    while number == -1:
+        number = chooseNumber()
+
+    # choose file user        


Yes, is here the files of users are add. i have modified the comment by "add files chosen by the user"

kingthorin · 2023-06-28T10:28:56Z

standalone/2FABypassBruteForceLabAcademy.zst

Is it really worth including this? Aren't the URLs specific to your lab/academy instance at the time?

yes, but in the course I said to change the address.
it is possible to make a dialog box in zest to ask for the URLs ?

Hmmm good question, I've never tried that with zest. Hopefully someone else on the team can answer.

In Edit Zest Scrip the prefix seems modifiable but that the modification it is impossible to save it.

payloadprocessor/full_HTML_encode.py

kingthorin · 2023-06-28T10:30:45Z

standalone/OAST_Listen_Burp_Colaborator.py

+        biid = getString("what is your biid ?")
+
+        # Get number for update info
+        update = getNumber(1,3600, "how many time do you want refresh information ?")        


Suggested change

update = getNumber(1,3600, "how many time do you want refresh information ?")

update = getNumber(1,3600, "How many times do you want refresh information ?")

kingthorin · 2023-06-28T10:31:38Z

standalone/OAST_Listen_Burp_Colaborator.py

+
+def main():
+        global biid 
+        biid = getString("what is your biid ?")


Suggested change

biid = getString("what is your biid ?")

biid = getString("What is your biid ?")

Will "biid" be clear to a user because I have no idea what it is.

The biid is a token of burp collaborator protection, i wireshark the token name is biid. Look link https://www.onsecurity.io/blog/persistent-access-to-burp-suite-sessions-step-by-step-guide/

I don't understand the meaning of biid but I know that it stores the user's secret key.
I replaced What is your biid ? by What is your secret key (biid) ?
The capital letters have been put.

Signed-off-by: Timothée Ruffenach <[email protected]>

…ull-URL_encoding_auto-submit.js Signed-off-by: Timothée Ruffenach <[email protected]>

Signed-off-by: Timothée Ruffenach <[email protected]>

kingthorin · 2023-07-25T17:04:55Z

It's going to be really hard for us to review this and move it along if you don't pick a "line in the sand".

You can always create another branch or something for future contribs.

thc202 · 2024-02-06T17:15:23Z

encode-decode/decodeHTMLEntitities.js

+# @author Timothée Ruffenach
+# Version 1.0
+# decode HTML Entities


This is not valid comment for JavaScript (there are others that need to be corrected).

timruff commented May 17, 2023

View reviewed changes

timruff closed this May 17, 2023

thc202 reopened this May 17, 2023

thc202 reviewed May 17, 2023

View reviewed changes

kingthorin reviewed May 20, 2023

View reviewed changes

timruff added 16 commits June 5, 2023 22:03

add file AddHeaderXFowardForRandomIP.js to httpsender

93a1322

Signed-off-by: Timothée Ruffenach <[email protected]>

rename AddHeaderXForwardForRandomIP.js to AddHeaderXForwardedForRando…

cbb4c54

…mIP.js Signed-off-by: Timothée Ruffenach <[email protected]>

remove name and add comment origin script

9c8550f

Signed-off-by: Timothée Ruffenach <[email protected]>

add comment name

62827ce

Signed-off-by: Timothée Ruffenach <[email protected]>

add file pitchWork.py in httpfuzzerprocessor

a52e39d

Signed-off-by: Timothée Ruffenach <[email protected]>

correction to pitchwork.py, add multiple payloads gestion

184ee22

Signed-off-by: Timothée Ruffenach <[email protected]>

correction syntax

89f3feb

Signed-off-by: Timothée Ruffenach <[email protected]>

add fileActions.py in standalone

2d4f87d

Signed-off-by: Timothée Ruffenach <[email protected]>

add filtersResultWithStringOnBodyResponse.py

2ca32f9

Signed-off-by: Timothée Ruffenach <[email protected]>

fix issue in filtersResultWithSringOnBodyResonse.py

6193f5d

Signed-off-by: Timothée Ruffenach <[email protected]>

add function in fileActions.py

8246fb7

Signed-off-by: Timothée Ruffenach <[email protected]>

add RTT_time_filter.py to httpfuzzerprocessor

ef64087

Signed-off-by: Timothée Ruffenach <[email protected]>

add OAST_Listen_Burp_Colaborator.py to standalone

ea7c1a6

Signed-off-by: Timothée Ruffenach <[email protected]>

remove decode(utf-8) in OAST_Listen_Burp_Colaborator.py

a126174

Signed-off-by: Timothée Ruffenach <[email protected]>

OAST_Listen_Burp_Colaborator.py add decode

aaed85c

Signed-off-by: Timothée Ruffenach <[email protected]>

add full_HTML_encode.py to payloadprocessor

eb53c3d

Signed-off-by: Timothée Ruffenach <[email protected]>

timruff force-pushed the contribution branch from 89872cf to eb53c3d Compare June 5, 2023 20:05

timruff changed the title ~~add script AddHeaderXForwarderdForRandomIP.js~~ Script to solve burp labs or for bug bounty Jun 5, 2023

timruff added 4 commits June 8, 2023 21:42

resolve issue to fileActions in Json tab

e13d5fc

Signed-off-by: Timothée Ruffenach <[email protected]>

add 2FABypassBruteForceLabAcademy.zst to standalone

c1028bc

Signed-off-by: Timothée Ruffenach <[email protected]>

add feature Encode line file in MD5 and Inserting string before line …

088dbe9

…to fileAction.py Signed-off-by: Timothée Ruffenach <[email protected]>

add infinite_money_logic_flaw.zst

f668db1

Signed-off-by: Timothée Ruffenach <[email protected]>

kingthorin reviewed Jun 28, 2023

View reviewed changes

timruff added 9 commits June 28, 2023 19:08

Change RTT_time_filter.py to version 1.1

5d4b10c

Signed-off-by: Timothée Ruffenach <[email protected]>

Change RTT_time_filter.py add processResult

0be7fa4

Signed-off-by: Timothée Ruffenach <[email protected]>

Change sentance in fileStringResilt.py

171120f

Signed-off-by: Timothée Ruffenach <[email protected]>

Change comment to file pitchWork.py

c0f239f

Signed-off-by: Timothée Ruffenach <[email protected]>

Change sentence in OAST_Listen_Burp_Colaboratory.py

907b08d

Signed-off-by: Timothée Ruffenach <[email protected]>

Add decodeHTMLEntities.js and encodeHTMLEntities.js

b188c61

Signed-off-by: Timothée Ruffenach <[email protected]>

Add CSRF_poc_generator.js and CSRF_poc_generator_auto-submit.js

587d32f

Signed-off-by: Timothée Ruffenach <[email protected]>

Add CSRF_poc_generator_full-URL-enconfing.js and CSRF_poc_generator_f…

ddc6190

…ull-URL_encoding_auto-submit.js Signed-off-by: Timothée Ruffenach <[email protected]>

fix issues to file CSRF

09f6f72

Signed-off-by: Timothée Ruffenach <[email protected]>

thc202 reviewed Feb 6, 2024

View reviewed changes

		@@ -1,4 +1,4 @@
		// @author Ruffenach Timothée
		// The original script comes from the Fuzzer HTTP Processor section under the name random_x_forwarded_for_ip.js

	# In fuzzer Add 2 EmptyNull with good number.
	# In the Fuzzer add 2 EmptyNull payloads with a good number of iterations.

		time = getNumber(1,50000,"how many time do you want ?")
		isCheck = JOptionPane.showConfirmDialog(None, "more high or equal (YES) esle less or equal (NO)", "Confirm", JOptionPane.YES_NO_OPTION)

	entry = getString("what character string do you want to find ?")
	entry = getString("What character string do you want to find ?")

	update = getNumber(1,3600, "how many time do you want refresh information ?")
	update = getNumber(1,3600, "How many times do you want refresh information ?")

	biid = getString("what is your biid ?")
	biid = getString("What is your biid ?")

Script to solve burp labs or for bug bounty #340

Are you sure you want to change the base?

Script to solve burp labs or for bug bounty #340

Conversation

timruff commented May 17, 2023

thc202 commented May 17, 2023

timruff commented May 17, 2023

timruff left a comment

Choose a reason for hiding this comment

timruff commented May 17, 2023

thc202 commented May 17, 2023

thc202 May 17, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

timruff commented May 20, 2023

kingthorin commented Jun 5, 2023

kingthorin commented Jun 5, 2023

timruff commented Jun 5, 2023

kingthorin commented Jun 5, 2023

kingthorin left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

timruff Jun 28, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kingthorin commented Jul 25, 2023

Choose a reason for hiding this comment

thc202 May 17, 2023 •

edited

Loading

timruff Jun 28, 2023 •

edited

Loading