Welcome to my blog. You can with your friends and collect the amazing picture from here and plz click on the ads by google

Monday, January 22, 2024

Smuggler - An HTTP Request Smuggling / Desync Testing Tool


An HTTP Request Smuggling / Desync testing tool written in Python 3


IMPORTANT

This tool does not guarantee no false-positives or false-negatives. Just because a mutation may report OK does not mean there isn't a desync issue, but more importantly just because the tool indicates a potential desync issue does not mean there definitely exists one. The script may encounter request processors from large entities (i.e. Google/AWS/Yahoo/Akamai/etc..) that may show false positive results.


Installation
  1. git clone https://github.com/defparam/smuggler.git
  2. cd smuggler
  3. python3 smuggler.py -h

Example Usage

Single Host:

python3 smuggler.py -u <URL>

List of hosts:

cat list_of_hosts.txt | python3 smuggler.py

Options

 
usage: smuggler.py [-h] [-u URL] [-v VHOST] [-x] [-m METHOD] [-l LOG] [-q]
                   [-t TIMEOUT] [--no-color] [-c CONFIGFILE]

optional arguments:
  -h, --help            show this help message and exit
  -u URL, --url URL     Target URL with Endpoint
  -v VHOST, --vhost VHOST
                        Specify a virtual host
  -x, --exit_early      Exit scan on first finding
  -m METHOD, --method METHOD
                        HTTP method to use (e.g GET, POST) Default: POST
  -l LOG, --log LOG     Specify a log file
  -q, --quiet           Quiet mode will only log issues found
  -t TIMEOUT, --timeout TIMEOUT
                        Socket timeout value Default: 5
  --no-color            Suppress color codes
  -c CONFIGFILE, --configfile CONFIGFILE
                        Filepath to the configuration file of payloads

Smuggler at a minimum requires either a URL via the -u/--url argument or a list of URLs piped into the script via stdin. If the URL specifies https:// then Smuggler will connect to the host:port using SSL/TLS. If the URL specifies http:// then no SSL/TLS will be used at all. If only the host is specified, then the script will default to https://

Use -v/--vhost <host> to specify a different host header from the server address

Use -x/--exit_early to exit the scan of a given server when a potential issue is found. In piped mode smuggler will just continue to the next host on the list

Use -m/--method <method> to specify a different HTTP verb from POST (i.e GET/PUT/PATCH/OPTIONS/CONNECT/TRACE/DELETE/HEAD/etc...)

Use -l/--log <file> to write output to file as well as stdout

Use -q/--quiet reduce verbosity and only log issues found

Use -t/--timeout <value> to specify the socket timeout. The value should be high enough to conclude that the socket is hanging, but low enough to speed up testing (default: 5)

Use --no-color to suppress the output color codes printed to stdout (logs by default don't include color codes)

Use -c/--configfile <configfile> to specify your smuggler mutation configuration file (default: default.py)


Config Files

Configuration files are python files that exist in the ./config directory of smuggler. These files describe the content of the HTTP requests and the transfer-encoding mutations to test.

Here is example content of default.py:

def render_template(gadget):
	RN = "\r\n"
	p = Payload()
	p.header  = "__METHOD__ __ENDPOINT__?cb=__RANDOM__ HTTP/1.1" + RN
	# p.header += "Transfer-Encoding: chunked" +RN	
	p.header += gadget + RN
	p.header += "Host: __HOST__" + RN
	p.header += "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36" + RN
	p.header += "Content-type: application/x-www-form-urlencoded; charset=UTF-8" + RN
	p.header += "Content-Length: __REPLACE_CL__" + RN
	return p


mutations["nameprefix1"] = render_template(" Transfer-Encoding: chunked")
mutations["tabprefix1"] = render_template("Transfer-Encoding:\tchunked")
mutations["tabprefix2"] = render_template("Transfer-Encoding\t:\tchunked")
mutations["space1"] = render_template("Transfer-Encoding : chunked")

for i in [0x1,0x4,0x8,0x9,0xa,0xb,0xc,0xd,0x1F,0x20,0x7f,0xA0,0xFF]:
	mutations["midspace-%   02x"%i] = render_template("Transfer-Encoding:%cchunked"%(i))
	mutations["postspace-%02x"%i] = render_template("Transfer-Encoding%c: chunked"%(i))
	mutations["prespace-%02x"%i] = render_template("%cTransfer-Encoding: chunked"%(i))
	mutations["endspace-%02x"%i] = render_template("Transfer-Encoding: chunked%c"%(i))
	mutations["xprespace-%02x"%i] = render_template("X: X%cTransfer-Encoding: chunked"%(i))
	mutations["endspacex-%02x"%i] = render_template("Transfer-Encoding: chunked%cX: X"%(i))
	mutations["rxprespace-%02x"%i] = render_template("X: X\r%cTransfer-Encoding: chunked"%(i))
	mutations["xnprespace-%02x"%i] = render_template("X: X%c\nTransfer-Encoding: chunked"%(i))
	mutations["endspacerx-%02x"%i] = render_template("Transfer-Encoding: chunked\r%cX: X"%(i))
	mutations["endspacexn-%02x"%i] = render_template("Transfer-Encoding: chunked%c\nX: X"%(i))

There are no input arguments yet on specifying your own customer headers and user-agents. It is recommended to create your own configuration file based on default.py and modify it to your liking.

Smuggler comes with 3 configuration files: default.py (fast), doubles.py (niche, slow), exhaustive.py (very slow) default.py is the fastest because it contains less mutations.

specify configuration files using the -c/--configfile <configfile> command line option


Payloads Directory

Inside the Smuggler directory is the payloads directory. When Smuggler finds a potential CLTE or TECL desync issue, it will automatically dump a binary txt file of the problematic payload in the payloads directory. All payload filenames are annotated with the hostname, desync type and mutation type. Use these payloads to netcat directly to the server or to import into other analysis tools.


Helper Scripts

After you find a desync issue feel free to use my Turbo Intruder desync scripts found Here: https://github.com/defparam/tiscripts DesyncAttack_CLTE.py and DesyncAttack_TECL.py are great scripts to help stage a desync attack


License

These scripts are released under the MIT license. See LICENSE.



Related word


  1. Pentest Tools Github
  2. Install Pentest Tools Ubuntu
  3. Hacking Tools For Beginners
  4. Hack Tools Online
  5. How To Hack
  6. Pentest Tools Linux
  7. Hack Apps
  8. Pentest Box Tools Download
  9. Pentest Tools
  10. Easy Hack Tools
  11. Hacker Techniques Tools And Incident Handling
  12. Nsa Hacker Tools
  13. Hacking Tools For Windows
  14. Pentest Automation Tools
  15. Hacking Tools Windows
  16. World No 1 Hacker Software
  17. New Hack Tools
  18. Pentest Tools Bluekeep
  19. What Are Hacking Tools
  20. Hacker Tools Github
  21. Hacker Tools Online
  22. Hacking Tools For Windows 7
  23. Hacking Tools Online
  24. Pentest Tools Find Subdomains
  25. Hacking Tools For Mac
  26. Game Hacking
  27. Hacking Tools For Mac
  28. Hack App
  29. Hacker Security Tools
  30. Easy Hack Tools
  31. Physical Pentest Tools
  32. Hacker Tools Apk
  33. Hack Website Online Tool
  34. What Are Hacking Tools
  35. Hacking Tools For Windows Free Download
  36. Hacking Tools Free Download
  37. Game Hacking
  38. Blackhat Hacker Tools
  39. Hack Tools Download
  40. Hacker Tools Software
  41. Hacking Tools Kit
  42. Hacking Tools Windows
  43. Hack Tools For Windows
  44. Bluetooth Hacking Tools Kali
  45. Pentest Tools Github
  46. Hacking Tools 2019
  47. Blackhat Hacker Tools
  48. Hacker Tools For Mac
  49. Hacker Tools For Pc
  50. Hacking Tools Github
  51. Termux Hacking Tools 2019
  52. New Hacker Tools
  53. Usb Pentest Tools
  54. Hacker Tools Free Download
  55. Wifi Hacker Tools For Windows
  56. Hacking Tools For Games
  57. Hacking Tools Windows 10
  58. Hack Tools Pc
  59. Android Hack Tools Github
  60. Top Pentest Tools
  61. Pentest Tools For Android
  62. Hack Tools Github
  63. Computer Hacker
  64. How To Hack
  65. Pentest Tools Nmap
  66. Pentest Tools List
  67. Game Hacking
  68. Pentest Tools Android
  69. Pentest Tools Framework
  70. Hacker Tools For Mac
  71. Hacker Techniques Tools And Incident Handling
  72. Kik Hack Tools
  73. Hack Tools Github
  74. Hack Rom Tools
  75. Hacker Tools Software
  76. Hacker Tools 2020
  77. Pentest Tools Find Subdomains
  78. How To Hack
  79. World No 1 Hacker Software
  80. New Hack Tools
  81. Pentest Tools For Mac
  82. Pentest Tools Website Vulnerability
  83. Easy Hack Tools
  84. Hackrf Tools
  85. Hacking Tools Kit
  86. Hacker Tools Software
  87. Underground Hacker Sites
  88. Hacker Tools Apk Download
  89. Hack Tools For Ubuntu
  90. Growth Hacker Tools
  91. Hacker Tools Apk
  92. Pentest Tools Github
  93. Github Hacking Tools
  94. Hack App
  95. World No 1 Hacker Software
  96. Pentest Tools Port Scanner
  97. Free Pentest Tools For Windows
  98. Hacker Tools
  99. Hackrf Tools
  100. Hack Tools Pc
  101. Pentest Tools Tcp Port Scanner
  102. Hack Website Online Tool
  103. Pentest Tools Alternative
  104. Pentest Tools Download
  105. Hacking Tools
  106. Android Hack Tools Github
  107. Tools Used For Hacking
  108. Pentest Tools For Windows
  109. Hacker Tools List
  110. Pentest Tools Bluekeep
  111. Hak5 Tools
Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)