|
domingo, 4 de junio de 2023
Analiza y selecciona proveedores en la industria alimentaria.
Guía para un plan maestro de producción.
|
Las empresas alimentarias se enfrentan a este problema.
|
Smuggler - An HTTP Request Smuggling / Desync Testing Tool
An HTTP Request Smuggling / Desync testing tool written in Python 3
This tool does not guarantee no false-positives or false-negatives. Just because a mutation may report OK does not mean there isn't a desync issue, but more importantly just because the tool indicates a potential desync issue does not mean there definitely exists one. The script may encounter request processors from large entities (i.e. Google/AWS/Yahoo/Akamai/etc..) that may show false positive results.
Installation
Single Host:
python3 smuggler.py -u <URL>
List of hosts:
cat list_of_hosts.txt | python3 smuggler.py
Options
usage: smuggler.py [-h] [-u URL] [-v VHOST] [-x] [-m METHOD] [-l LOG] [-q]
[-t TIMEOUT] [--no-color] [-c CONFIGFILE]
optional arguments:
-h, --help show this help message and exit
-u URL, --url URL Target URL with Endpoint
-v VHOST, --vhost VHOST
Specify a virtual host
-x, --exit_early Exit scan on first finding
-m METHOD, --method METHOD
HTTP method to use (e.g GET, POST) Default: POST
-l LOG, --log LOG Specify a log file
-q, --quiet Quiet mode will only log issues found
-t TIMEOUT, --timeout TIMEOUT
Socket timeout value Default: 5
--no-color Suppress color codes
-c CONFIGFILE, --configfile CONFIGFILE
Filepath to the configuration file of payloads
Smuggler at a minimum requires either a URL via the -u/--url argument or a list of URLs piped into the script via stdin. If the URL specifies https:// then Smuggler will connect to the host:port using SSL/TLS. If the URL specifies http:// then no SSL/TLS will be used at all. If only the host is specified, then the script will default to https://
Use -v/--vhost <host> to specify a different host header from the server address
Use -x/--exit_early to exit the scan of a given server when a potential issue is found. In piped mode smuggler will just continue to the next host on the list
Use -m/--method <method> to specify a different HTTP verb from POST (i.e GET/PUT/PATCH/OPTIONS/CONNECT/TRACE/DELETE/HEAD/etc...)
Use -l/--log <file> to write output to file as well as stdout
Use -q/--quiet reduce verbosity and only log issues found
Use -t/--timeout <value> to specify the socket timeout. The value should be high enough to conclude that the socket is hanging, but low enough to speed up testing (default: 5)
Use --no-color to suppress the output color codes printed to stdout (logs by default don't include color codes)
Use -c/--configfile <configfile> to specify your smuggler mutation configuration file (default: default.py)
Config Files
Configuration files are python files that exist in the ./config directory of smuggler. These files describe the content of the HTTP requests and the transfer-encoding mutations to test.
Here is example content of default.py:
def render_template(gadget):
RN = "\r\n"
p = Payload()
p.header = "__METHOD__ __ENDPOINT__?cb=__RANDOM__ HTTP/1.1" + RN
# p.header += "Transfer-Encoding: chunked" +RN
p.header += gadget + RN
p.header += "Host: __HOST__" + RN
p.header += "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36" + RN
p.header += "Content-type: application/x-www-form-urlencoded; charset=UTF-8" + RN
p.header += "Content-Length: __REPLACE_CL__" + RN
return p
mutations["nameprefix1"] = render_template(" Transfer-Encoding: chunked")
mutations["tabprefix1"] = render_template("Transfer-Encoding:\tchunked")
mutations["tabprefix2"] = render_template("Transfer-Encoding\t:\tchunked")
mutations["space1"] = render_template("Transfer-Encoding : chunked")
for i in [0x1,0x4,0x8,0x9,0xa,0xb,0xc,0xd,0x1F,0x20,0x7f,0xA0,0xFF]:
mutations["midspace-% 02x"%i] = render_template("Transfer-Encoding:%cchunked"%(i))
mutations["postspace-%02x"%i] = render_template("Transfer-Encoding%c: chunked"%(i))
mutations["prespace-%02x"%i] = render_template("%cTransfer-Encoding: chunked"%(i))
mutations["endspace-%02x"%i] = render_template("Transfer-Encoding: chunked%c"%(i))
mutations["xprespace-%02x"%i] = render_template("X: X%cTransfer-Encoding: chunked"%(i))
mutations["endspacex-%02x"%i] = render_template("Transfer-Encoding: chunked%cX: X"%(i))
mutations["rxprespace-%02x"%i] = render_template("X: X\r%cTransfer-Encoding: chunked"%(i))
mutations["xnprespace-%02x"%i] = render_template("X: X%c\nTransfer-Encoding: chunked"%(i))
mutations["endspacerx-%02x"%i] = render_template("Transfer-Encoding: chunked\r%cX: X"%(i))
mutations["endspacexn-%02x"%i] = render_template("Transfer-Encoding: chunked%c\nX: X"%(i))There are no input arguments yet on specifying your own customer headers and user-agents. It is recommended to create your own configuration file based on default.py and modify it to your liking.
Smuggler comes with 3 configuration files: default.py (fast), doubles.py (niche, slow), exhaustive.py (very slow) default.py is the fastest because it contains less mutations.
specify configuration files using the -c/--configfile <configfile> command line option
Payloads Directory
Inside the Smuggler directory is the payloads directory. When Smuggler finds a potential CLTE or TECL desync issue, it will automatically dump a binary txt file of the problematic payload in the payloads directory. All payload filenames are annotated with the hostname, desync type and mutation type. Use these payloads to netcat directly to the server or to import into other analysis tools.
After you find a desync issue feel free to use my Turbo Intruder desync scripts found Here: https://github.com/defparam/tiscripts DesyncAttack_CLTE.py and DesyncAttack_TECL.py are great scripts to help stage a desync attack
License
More articles
- Pentest Tools Port Scanner
- Top Pentest Tools
- Hak5 Tools
- Hacking Tools Name
- Hacker Tools Free Download
- Hacker
- Pentest Tools Tcp Port Scanner
- Hacker Tools For Mac
- Hacks And Tools
- Top Pentest Tools
- Bluetooth Hacking Tools Kali
- Hacking Tools Windows
- How To Make Hacking Tools
- Pentest Recon Tools
- Hacker Tools 2020
- Wifi Hacker Tools For Windows
- Pentest Tools Free
- Hacking Tools And Software
- Hacker Tools 2020
- Pentest Tools Free
- Free Pentest Tools For Windows
- Hack Tool Apk No Root
- Hack Tools Download
- Ethical Hacker Tools
- Pentest Box Tools Download
- Hacking Tools Name
- Pentest Tools For Android
- Hacking Tools Hardware
- Hacker Tool Kit
- Pentest Tools Github
- Pentest Tools For Windows
- New Hacker Tools
- Hacking Tools Kit
- Pentest Tools Kali Linux
- Hack Tools For Games
- Hack Tools For Games
- Growth Hacker Tools
- Top Pentest Tools
- Bluetooth Hacking Tools Kali
- Hacker Search Tools
- Hacker Tools For Mac
- Hack Website Online Tool
- Hacker Tools Hardware
- Hacker Tools For Ios
- Pentest Tools Free
- Pentest Tools Nmap
- Hack Tools For Windows
- Hacking Tools Pc
- What Is Hacking Tools
- Pentest Tools Windows
- Hacking Tools Github
- Hack Tools
- Tools Used For Hacking
- How To Make Hacking Tools
- Hacking Tools And Software
- Hack Tools
- Hack Tool Apk No Root
- Hacker Tools Linux
- Pentest Tools Online
- Hacker Tools Windows
- Game Hacking
- Hack Tool Apk
- Hacking Tools For Beginners
- Pentest Tools Apk
- Easy Hack Tools
- Free Pentest Tools For Windows
- Top Pentest Tools
- World No 1 Hacker Software
- Hacker Tools Mac
- New Hacker Tools
- Hacking Tools Github
- Hacking Tools 2019
- Pentest Tools Linux
- Hacking Tools For Beginners
- Hacker Tools For Mac
- Hackrf Tools
- Game Hacking
- Termux Hacking Tools 2019
- Best Hacking Tools 2020
- Hack Tools For Windows
- Pentest Tools Url Fuzzer
- Easy Hack Tools
- Hack Tools For Ubuntu
- Top Pentest Tools
- Hack Tool Apk
- Pentest Tools Open Source
- Hacking Tools Software
- Hack Tools Download
- Best Hacking Tools 2019
- Hacking Tools For Windows Free Download
- Blackhat Hacker Tools
- Hacker Tool Kit
- Hacker Tool Kit
- Hacker Tool Kit
- Hacking Tools Name
- Pentest Tools Review
- Hacker Techniques Tools And Incident Handling
- Hacker Tools For Windows
- Pentest Tools Port Scanner
- Hacking Tools Mac
- Hack Tool Apk
- Hacking Tools And Software
- Growth Hacker Tools
- Hacker Security Tools
- Hacker Tools Apk
- Pentest Tools Download
- Pentest Tools Windows
- Hack Rom Tools
- Hacking Tools Download
- Pentest Tools Framework
- Pentest Tools Download
- Wifi Hacker Tools For Windows
- Hacking Tools Kit
- Hacking Tools Kit
- Hacker Tools Github
- Hack Website Online Tool
- Pentest Tools Online
- Hacker Tools List
- Growth Hacker Tools
- Hacker Tools
- Pentest Tools For Mac
- Hacker Search Tools
- Pentest Tools Android
- Hacking App
- Pentest Tools Tcp Port Scanner
- Hacking App
- Hacker Tools
- Hacking Tools Software
- Hacking Tools Name
- Hacking Tools Download
- Hacker Tools Windows
- Pentest Tools For Ubuntu
- Pentest Tools Review
- Pentest Tools Windows
- Hacking Tools Windows 10
- How To Hack
- Hack Tools Online
- Pentest Tools Kali Linux
- Physical Pentest Tools
- Hacker Techniques Tools And Incident Handling
- Hacker Tools List
- Pentest Tools List
- Hacker Tools For Windows
- Wifi Hacker Tools For Windows
- Hacking Tools Download
- Hacking Apps
- Hack Tool Apk
- Hacking Tools For Mac
- Physical Pentest Tools
- Pentest Tools Download
- Pentest Tools Open Source
- Hacking Tools Free Download