Exemplo n.º 1
0
 public ResultData(FuzzData test, string sent, DateTime start, DateTime end)
 {
     this.test  = test;
     this.sent  = sent;
     this.start = start;
     this.end   = end;
 }
Exemplo n.º 2
0
            public string CreateRequest(FuzzData job, Random rand)
            {
                return($@"POST / HTTP/2
Host: {job.fullhost}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: */*
Transfer-Encoding: chunked".Replace("\n", "\r\n") + "\r\n");
            }
Exemplo n.º 3
0
 public FuzzData(FuzzData src)
 {
     name                 = src.name;
     maxLineLength        = src.maxLineLength;
     host                 = src.host;
     port                 = src.port;
     payload              = src.payload;
     seed                 = src.seed;
     nextChar             = src.nextChar;
     nextLine             = src.nextLine;
     createInitialRequest = src.createInitialRequest;
     insertNewlines       = src.insertNewlines;
     newline              = src.newline;
     _fullhost            = src.fullhost;
 }
Exemplo n.º 4
0
        private static string PrebakedHTTP(FuzzData job)
        {
            return($@"POST / HTTP/2
Host: {job.fullhost}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://{job.fullhost}/wherever
Content-Length: {job.payload.Length}
content-type: text/plain
Origin: https://{job.fullhost}
Connection: keep-alive
Cookie: veryFreshIndeed
Sec-GPC: 1
TE: Trailers

{job.payload}".Replace("\n", "\r\n"));;
        }
Exemplo n.º 5
0
        private static async Task <int> Pwn(string host, short port, Action <FuzzData> callback)
        {
            string name = callback.Method.Name;

            Log.Info($"Doing test [{name}] on {host}:{port}...");
            string result = await Request.Post($"{harnessHost}/test", $"{{\"name\":\"{name}\"}}");

            // Wait for a new instance of the test app to be up and running
            await Request.Post($"{harnessHost}/restart", "{}");

            // await Task.Delay(100);
            // Log.Info(result);

            List <FuzzData> atks  = new List <FuzzData>();
            FuzzData        basis = new FuzzData(host, port, "{\"ayyy\":\"lmao\"}");

            atks.Add(new FuzzData(basis));
            atks.Add(new FuzzData(basis)
            {
                name = "RandomHeaders", nextLine = RandomHeader
            });
            atks.Add(new FuzzData(basis)
            {
                name = "AcceptHeaderStuffer", nextLine = new AcceptHeaderStuffer().NextLine
            });
            atks.Add(new FuzzData(basis)
            {
                name = "RandomAcceptHeaderStuffer", nextLine = new RandomAcceptHeaderStuffer().NextLine
            });
            atks.Add(new FuzzData(basis)
            {
                name = "HeaderContinuation", nextLine = new HeaderContinuation().NextLine
            });

            EndlessChunked ec = new EndlessChunked();

            atks.Add(new FuzzData(basis)
            {
                name = "EndlessChunked", nextLine = ec.NextLine, createInitialRequest = ec.CreateRequest
            });

            foreach (FuzzData atk in atks)
            {
                try {
                    Log.Info($"Test [{atk.name}] starting");
                    atk.BindSocket();
                    callback(atk);
                    atk.UnbindSocket();


                    Log.Info($"Test [{atk.name}] finished");
                } catch (Exception e) {
                    Log.Warning($"Unhandled Exception occurred during test {atk.name}:", e);
                }
                await Request.Post($"{harnessHost}/restart", "{}");
            }

            for (int i = 0; i < outputs.Count; i++)
            {
                var res = outputs[i];

                File.WriteAllText($"{logfile}-{i}-{res.test.name}.txt", res.sent);
            }

            return(0);
        }
Exemplo n.º 6
0
        private static void FuzzBasic(FuzzData job)
        {
            string fullhost    = job.fullhost;
            string payload     = job.payload;
            Random rand        = new Random(job.seed);
            string partialHttp = job.createInitialRequest(job, rand);

            StringBuilder allSent      = new StringBuilder();
            StringBuilder allRead      = new StringBuilder();
            long          bytesSent    = 0;
            long          byteDebounce = 1024 * 1024;
            DateTime      start        = DateTime.UtcNow;

            void send(string data)
            {
                byte[] bytes = Encoding.UTF8.GetBytes(data);
                allSent.Append(data);
                job.sock.Send(bytes);
                bytesSent += bytes.Length;
                if (bytesSent >= byteDebounce)
                {
                    byteDebounce *= 2;
                    Log.Debug($"Still sending. So far, sent {FormatBytes(bytesSent)} over {FormatTimeFrom(start)}.");
                }
            }

            byte[] readBuff = new byte[4096];
            void read()
            {
                try {
                    if (job.sock.Available > 0)
                    {
                        int    bytesRead = job.sock.Receive(readBuff, 0, 4096, SocketFlags.None);
                        string str       = Encoding.UTF8.GetString(readBuff, 0, bytesRead);
                        allRead.Append(str);
                    }
                } catch (Exception e) { }
            }

            send(partialHttp);
            StringBuilder nextLine = new StringBuilder();
            DateTime      end;

            while (true)
            {
                try {
                    nextLine.Clear();

                    if (job.insertNewlines)
                    {
                        send(job.newline);
                        read();
                    }

                    if (job.nextLine != null)
                    {
                        nextLine.Append(job.nextLine(rand));
                    }
                    else
                    {
                        int len = rand.Next(2, job.maxLineLength);
                        for (int i = 0; i < len; i++)
                        {
                            nextLine.Append(job.nextChar(rand));
                        }
                    }

                    send(nextLine.ToString());
                } catch (Exception e) {
                    end = DateTime.UtcNow;
                    TimeSpan elapsed = end - start;

                    Log.Warning($"Exception during test after sending {FormatBytes(bytesSent)} over {FormatTime(elapsed)}\nHTTP Message received:\n----------\n{allRead.ToString()}\n---------\n", e);
                    break;
                }
            }

            ResultData result = new ResultData(job, allSent.ToString(), start, end);

            outputs.Add(result);
        }