pax_global_header 0000666 0000000 0000000 00000000064 14732751445 0014526 g ustar 00root root 0000000 0000000 52 comment=8274a8ba9af5d231a40845e94a96859673befdc9
Web-Cache-Vulnerability-Scanner-1.3.3/ 0000775 0000000 0000000 00000000000 14732751445 0017466 5 ustar 00root root 0000000 0000000 Web-Cache-Vulnerability-Scanner-1.3.3/.gitignore 0000664 0000000 0000000 00000000375 14732751445 0021463 0 ustar 00root root 0000000 0000000 # ignore Log, Completed, Report
*_WCVS_*
# ignore the url list file
urls.list
# ignore test folder
test/
# ignore vscode
.vscode/
# ignore compiled binaries
Web-Cache-Vulnerability-Scanner
Web-Cache-Vulnerability-Scanner.exe
# ignore build folder
build/ Web-Cache-Vulnerability-Scanner-1.3.3/Dockerfile 0000664 0000000 0000000 00000000400 14732751445 0021452 0 ustar 00root root 0000000 0000000 # BUILDER
FROM golang:latest AS builder
WORKDIR /go/src/app
COPY . .
RUN go get -d -v ./...
RUN go build -o wcvs
# RUNNING
FROM debian:buster
RUN mkdir /app
COPY --from=builder /go/src/app/wcvs /wcvs
WORKDIR /app/
COPY wordlists/ wordlists/
CMD ["/wcvs"] Web-Cache-Vulnerability-Scanner-1.3.3/LICENSE 0000664 0000000 0000000 00000001014 14732751445 0020467 0 ustar 00root root 0000000 0000000 Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Web-Cache-Vulnerability-Scanner-1.3.3/NOTICE 0000664 0000000 0000000 00000001014 14732751445 0020366 0 ustar 00root root 0000000 0000000 Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Web-Cache-Vulnerability-Scanner-1.3.3/README.md 0000664 0000000 0000000 00000026013 14732751445 0020747 0 ustar 00root root 0000000 0000000
[](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/latest)
[](https://goreportcard.com/report/github.com/Hackmanit/Web-Cache-Vulnerability-Scanner)
[](https://golang.org/)
[](https://www.apache.org/licenses/LICENSE-2.0)
Web Cache Vulnerability Scanner (WCVS) is a fast and versatile CLI scanner for [web cache poisoning](#background-information) and web cache deception developed by [Hackmanit](https://hackmanit.de) and [Maximilian Hildebrand](https://www.github.com/m10x).
The scanner supports many different web cache poisoning and web cache deception techniques, includes a crawler to identify further URLs to test,
and can adapt to a specific web cache for more efficient testing. It is highly customizable and can be easily integrated into existing CI/CD pipelines.
- [Features](#features)
- [Installation](#installation)
- [Option 1: Pre-built Binary](#option-1-pre-built-binary)
- [Option 2: Kali Linux / BlackArch Repository](#option-2-kali-linux--blackarch-repository)
- [Option 3: Install Using Go](#option-3-install-using-go)
- [Option 4: Docker](#option-4-docker)
- [Usage](#usage)
- [Specify Headers, Parameters, Cookies, and More](#specify-headers-parameters-cookies-and-more)
- [Generate a JSON Report](#generate-a-json-report)
- [Crawl for URLs](#crawl-for-urls)
- [Use a Proxy](#use-a-proxy)
- [Throttle or Accelerate](#throttle-or-accelerate)
- [Further Flags](#further-flags)
- [Background Information](#background-information)
- [License](#license)
# Features
- Support for 9 web cache poisoning techniques:
1. Unkeyed header poisoning
2. Unkeyed parameter poisoning
3. Parameter cloaking
4. Fat GET
5. HTTP response splitting
6. HTTP request smuggling
7. HTTP header oversize (HHO)
8. HTTP meta character (HMC)
9. HTTP method override (HMO)
- Support for multiple web cache deception techniques:
1. Path Parameter
2. Path Traversal (.css file, /static directory and /robots.txt)
3. Appended special characters (both encoded and not encoded)
- Analyzing a web cache before testing and adapting to it for more efficient testing
- Generating a report in JSON format
- Crawling websites for further URLs to scan
- Routing traffic through a proxy (e.g., Burp Suite)
- Limiting requests per second to bypass rate limiting
# Installation
## Option 1: Pre-built Binary
Prebuilt binaries of WCVS are provided on the [releases page](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases). These releases include 2 default wordlists, as well.
## Option 2: Kali Linux / BlackArch Repository
- Kali Linux: `apt install web-cache-vulnerability-scanner`
- BlackArch: `pacman -S wcvs`
## Option 3: Install Using Go
The repository can be installed using Go.
go1.21 and higher
```
go install -v github.com/Hackmanit/Web-Cache-Vulnerability-Scanner@latest
```
## Option 4: Docker
### 1. Clone repository or download the [latest source code release](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/latest)
### 2. Build image (the wordlists folder will also be copied)
```
$ docker build .
Sending build context to Docker daemon 29.54MB
Step 1/10 : FROM golang:latest AS builder
---> 05c8f6d2538a
Step 2/10 : WORKDIR /go/src/app
---> Using cache
---> f591f24be8cf
Step 3/10 : COPY . .
---> 38b358dd3472
Step 4/10 : RUN go get -d -v ./...
---> Running in 41f53de436c5
....
Removing intermediate container 9e2e84d14ff3
---> 1668edcf6ee3
Successfully built 1668edcf6ee3
```
### 3. Run wcvs
```
$ docker run -it 1668edcf6ee3 /wcvs --help
https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner
version 1.0.0
```
# Usage
WCVS is highly customizable using its flags. Many of the flags can either contain a value directly or the path to a file.
The only mandatory flag is `-u/--url` to provide the target URL which should be tested for web cache poisoning/deception. The target URL can be provided in different formats,
WCVS needs two wordlists in order to test for the first 5 techniques - one wordlist with header names and one with parameter names. The wordlists can either be present in the same directory WCVS is executed from or specified using the `--headerwordlist/-hw` and `--parameterwordlist/-pw` flags.
### Examples:
```
wcvs -u 127.0.0.1
wcvs -u http://127.0.0.1
wcvs -u https://example.com
wcvs -u file:path/to/url_list
wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt"
wcvs -u https://example.com -pw "file:/home/user/Documents/wordlist-parameter.txt"
wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt" -pw "file:/home/user/Documents/wordlist-parameter.txt"
```
## Specify Headers, Parameters, Cookies, and More
- `--cacheheader/-ch` specifies a custom cache header which will be checked for cache hits and misses
- `--setcookies/-sc` specifies cookies which shall be added to the request
- `--setheaders/-sh` specifies headers which shall be added to the request
- `--setparameters/-sp` specifies parameters which shall be added to the request. While it is also possible to simply add them to the URL, it might be more useful in some cases to add them via this flag.
- `--post/-post` changes the HTTP method from GET to POST
- `--setbody/-sb` specifies the body which shall be added to the request
- `--contenttype/-ct` specifies the value of the Content-Type header
- `--useragentchrome/-uac` changes the User-Agent from `WebCacheVulnerabilityScanner v{Version-Number}` to `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36`. While the same can be achieved with e.g. `-sh "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) ...`, this flag provides a quicker way.
- `--cacheheader/-ch` specify a custom cache header (case-insensitive)
#### If you want to specify more than 1 cookie, parameter or header you need to specify a file which contains them. Take a look at the [available templates](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/tree/master/templates).
### Examples:
```
wcvs -u https://example.com -ch "X-Custom-Header-ABC"
wcvs -u https://example.com -sc "PHPSESSID=123"
wcvs -u https://example.com -sc "file:/home/user/Documents/cookies.txt"
wcvs -u https://example.com -sh "Referer: localhost"
wcvs -u https://example.com -sh "file:/home/user/Documents/headers.txt"
wcvs -u https://example.com -sp "admin=true"
wcvs -u https://example.com -sp "file:/home/user/Documents/parameters.txt"
wcvs -u https://example.com -post -sb "admin=true"
wcvs -u https://example.com -post -sb "file:/home/user/Documents/body.txt"
wcvs -u https://example.com -post -sb "{}" -ct "application/json"
wcvs -u https://example.com -uac
wcvs -u https://example.com -ch "X-Custom-Cache-Header"
```
## Generate a JSON Report
A JSON report is generated and updated after each scanned URL if the flag `--generatereport/-gr` is set.
The report is written, just like a log file, into the same directory WCVS is executed from. In order to change the directory for all output files use `--generatepath/-gp`.
If HTML special chars shall be encoded in the report, use `--escapejson/-ej`.
### Examples:
```
wcvs -u https://example.com -gr
wcvs -u https://example.com -gr -ej
wcvs -u https://example.com -gr -gp /home/user/Documents
wcvs -u https://example.com -gr -gp /home/user/Documents -ej
```
## Crawl for URLs
In order to crawl for URLs, `--recursivity/-r` needs to be set. It specifies how deep the crawler shall go recursion-wise.
By default WCVS only crawls for URLs of the same domain. To also crawl for other domains, `--recdomains/red` can be used.
To only crawl URLs which inherit a specific string, `--recinclude/-rin` can be used.
`--reclimit/-rl` limits how many URLs are crawled for each recursion depth.
Also, a list with URLs which shall not be crawled can be specified with `--recexclude/-rex`. `--generatecompleted/-gc` can, for example, be used to generate a list with all already tested URLs. If a scan is repeated, but WCVS shall not crawl and test again the same URLs, this list can be used for `--recexclude/-rex`.
### Examples:
```
wcvs -u https://example.com -r 5
wcvs -u https://example.com -r 5 -red /home/user/Documents/mydomains.txt
wcvs -u https://example.com -r 5 -rl 2
wcvs -u https://example.com -r 5 -rex /home/user/Documents/donttest.txt
```
## Use a Proxy
To use a proxy, a CA certificate of the proxy in PEM format is needed.
Burp Suite certificates are provided in DER format, for example. To convert them, the following command can be used:
`openssl x509 -inform DER -outform PEM -text -in cacert.der -out cacert.pem`.
The path to the certificate can be specified with `--proxycertpath/-ppath`.
The default URL for the proxy is `http://127.0.0.1:8080`. In order to change it, use `--proxyurl/-purl`.
### Examples:
```
wcvs -u https://example.com -ppath /home/user/Documents/cacert.pem
wcvs -u https://example.com -ppath /home/user/Documents/cacert.pem -purl http://127.0.0.1:8081
```
## Throttle or Accelerate
The number of maximum allowed requests per second can be set with `--reqrate/-rr`. By default, this number is unrestricted.
Contrary, the number of requests per second can be increased potentially, if `--threads/-t` is used to increase the number of concurrent threads WCVS utilizes. The default value is 20.
### Examples:
```
wcvs -u https://example.com -rr 10
wcvs -u https://example.com -rr 1
wcvs -u https://example.com -rr 0.5
wcvs -u https://example.com -t 50
```
## Further Flags
WCVS provides even more than the beforehand mentioned flags and options. `--help/-h` provides a list of each flag, its meaning, and how to use it.
### Example:
```
wcvs -h
```
## Background Information
A short series of blog posts giving more information about web cache poisoning and WCVS can be found here:
1. [Is Your Application Vulnerable to Web Cache Poisoning?](https://www.hackmanit.de/en/blog-en/142-is-your-application-vulnerable-to-web-cache-poisoning)
2. [Web Cache Vulnerability Scanner (WCVS) - Free, Customizable, Easy-To-Use](https://www.hackmanit.de/en/blog-en/145-web-cache-vulnerability-scanner-wcvs-free-customizable-easy-to-use)
The Web Cache Vulnerability Scanner (WCVS) was developed as a part of a [bachelor's thesis by Maximilian Hildebrand](https://hackmanit.de/images/download/thesis/Automated-Scanning-for-Web-Cache-Poisoning-Vulnerabilities.pdf).
## License
WCVS is developed by [Hackmanit](https://hackmanit.de) and [Maximilian Hildebrand](https://www.github.com/m10x) and licensed under the [Apache License, Version 2.0](license.txt).
Web-Cache-Vulnerability-Scanner-1.3.3/buildBinariesLinux.sh 0000775 0000000 0000000 00000003366 14732751445 0023631 0 ustar 00root root 0000000 0000000 #!/bin/bash
version=1.3.3
# Windows amd64
goos=windows
goarch=amd64
GOOS=$goos GOARCH=$goarch go build -o wcvs.exe
zip build/web-cache-vulnerability-scanner_"$version"_"$goos"_"$goarch".zip wcvs.exe wordlists/headers wordlists/parameters
# Linux amd64
goos=linux
goarch=amd64
GOOS=$goos GOARCH=$goarch go build -o wcvs
tar cfvz build/web-cache-vulnerability-scanner_"$version"_"$goos"_"$goarch".tar.gz wcvs wordlists/headers wordlists/parameters
# Linux arm64
goos=linux
goarch=arm64
GOOS=$goos GOARCH=$goarch go build -o wcvs
tar cfvz build/web-cache-vulnerability-scanner_"$version"_"$goos"_"$goarch".tar.gz wcvs wordlists/headers wordlists/parameters
# Darwin/MacOS amd64
goos=darwin
goarch=amd64
GOOS=$goos GOARCH=$goarch go build -o wcvs
tar cfvz build/web-cache-vulnerability-scanner_"$version"_"$goos"_"$goarch".tar.gz wcvs wordlists/headers wordlists/parameters
# Darwin/MacOS arm64
goos=darwin
goarch=arm64
GOOS=$goos GOARCH=$goarch go build -o wcvs
tar cfvz build/web-cache-vulnerability-scanner_"$version"_"$goos"_"$goarch".tar.gz wcvs wordlists/headers wordlists/parameters
# FreeBSD amd64
goos=freebsd
goarch=amd64
GOOS=$goos GOARCH=$goarch go build -o wcvs
tar cfvz build/web-cache-vulnerability-scanner_"$version"_"$goos"_"$goarch".tar.gz wcvs wordlists/headers wordlists/parameters
# OpenBSD amd64
goos=openbsd
goarch=amd64
GOOS=$goos GOARCH=$goarch go build -o wcvs
tar cfvz build/web-cache-vulnerability-scanner_"$version"_"$goos"_"$goarch".tar.gz wcvs wordlists/headers wordlists/parameters
# reset GOOS and GOARCH
set GOOS=
set GOARCH=
# remove wcvs
rm wcvs
rm wcvs.exe
# generate checksum file
find build/ -type f \( -iname "*.tar.gz" -or -iname "*.zip" \) -exec sha256sum {} + > build/web-cache-vulnerability-scanner_"$version"_checksums_sha256.txt
Web-Cache-Vulnerability-Scanner-1.3.3/go.mod 0000664 0000000 0000000 00000001106 14732751445 0020572 0 ustar 00root root 0000000 0000000 module github.com/Hackmanit/Web-Cache-Vulnerability-Scanner
go 1.21
require (
github.com/fatih/color v1.18.0
golang.org/x/net v0.33.0
golang.org/x/time v0.8.0
moul.io/http2curl v1.0.0
)
require (
github.com/mattn/go-colorable v0.1.13 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/smartystreets/goconvey v1.8.1 // indirect
golang.org/x/mod v0.17.0 // indirect
golang.org/x/sync v0.10.0 // indirect
golang.org/x/sys v0.28.0 // indirect
golang.org/x/text v0.21.0 // indirect
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
)
Web-Cache-Vulnerability-Scanner-1.3.3/go.sum 0000664 0000000 0000000 00000004360 14732751445 0020624 0 ustar 00root root 0000000 0000000 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
github.com/smarty/assertions v1.15.0 h1:cR//PqUBUiQRakZWqBiFFQ9wb8emQGDb0HeGdqGByCY=
github.com/smarty/assertions v1.15.0/go.mod h1:yABtdzeQs6l1brC900WlRNwj6ZR55d7B+E8C6HtKdec=
github.com/smartystreets/goconvey v1.8.1 h1:qGjIddxOk4grTu9JPOU31tVfq3cNdBlNa5sSznIX1xY=
github.com/smartystreets/goconvey v1.8.1/go.mod h1:+/u4qLyY6x1jReYOp7GOM2FSt8aP9CzCZL03bI28W60=
golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
moul.io/http2curl v1.0.0 h1:6XwpyZOYsgZJrU8exnG87ncVkU1FVCcTRpwzOkTDUi8=
moul.io/http2curl v1.0.0/go.mod h1:f6cULg+e4Md/oW1cYmwW4IWQOVl2lGbmCNGOHvzX2kE=
Web-Cache-Vulnerability-Scanner-1.3.3/pkg/ 0000775 0000000 0000000 00000000000 14732751445 0020247 5 ustar 00root root 0000000 0000000 Web-Cache-Vulnerability-Scanner-1.3.3/pkg/config.go 0000664 0000000 0000000 00000004337 14732751445 0022052 0 ustar 00root root 0000000 0000000 package pkg
import (
"net/http"
"net/url"
"golang.org/x/time/rate"
)
var Config ConfigStruct
type (
ConfigStruct struct {
Threads int
ReqRate float64
Verbosity int
DoPost bool
ContentType string
QuerySeparator string
CacheBuster string
TimeOut int
DeclineCookies bool
Force bool
UseHTTP bool
CLDiff int
HMDiff int
SkipTimebased bool
CacheHeader string
DisableColor bool
IgnoreStatus []int
Recursivity int
RecInclude string
RecExclude []string
RecDomains []string
RecLimit int
Urls []string
Cookies []string
Headers []string
Parameters []string
Body string
OnlyTest string
SkipTest string
GeneratePath string
GenerateReport bool
EscapeJSON bool
GenerateCompleted bool
ProxyCertPath string
ProxyURL string
HeaderWordlist string
QueryWordlist string
Limiter *rate.Limiter `json:"-"`
Website WebsiteStruct `json:"-"`
}
WebsiteStruct struct {
Headers http.Header
Body string
Cookies []*http.Cookie
Url *url.URL
UrlWOQueries string
Queries map[string]string
StatusCode int
Cache CacheStruct
Domain string
}
CacheStruct struct {
CBwasFound bool
CBisParameter bool
CBisHeader bool
CBisCookie bool
CBisHTTPMethod bool
CBName string
//HitMissVerbose bool
//HitMissTime bool
NoCache bool
Indicator string
TimeIndicator bool
}
)
func init() {
}
func ReadConfigFile() ConfigStruct {
config := ConfigStruct{
Threads: 0,
Recursivity: 0,
Verbosity: 0,
DoPost: false,
ContentType: "",
QuerySeparator: "",
CacheBuster: "",
TimeOut: 0,
DeclineCookies: false,
Urls: nil,
Cookies: nil,
Headers: nil,
Parameters: nil,
Body: "",
OnlyTest: "",
SkipTest: "",
ProxyCertPath: "",
ProxyURL: "",
HeaderWordlist: "",
QueryWordlist: "",
Website: WebsiteStruct{
Body: "",
Cookies: nil,
Url: nil,
UrlWOQueries: "",
Queries: nil,
StatusCode: 0,
},
}
return config
}
Web-Cache-Vulnerability-Scanner-1.3.3/pkg/deception.go 0000664 0000000 0000000 00000022706 14732751445 0022557 0 ustar 00root root 0000000 0000000 package pkg
import (
"errors"
"fmt"
"io"
"net/http"
"net/http/httputil"
"strings"
"moul.io/http2curl"
)
func TestWebCacheDeception() reportResult {
var repResult reportResult
repResult.Technique = "Cache Deception"
// cacheable extensions: class, css, jar, js, jpg, jpeg, gif, ico, png, bmp, pict, csv, doc, docx, xls, xlsx, ps, pdf, pls, ppt, pptx, tif, tiff, ttf, otf, webp, woff, woff2, svg, svgz, eot, eps, ejs, swf, torrent, midi, mid
appendings := []string{
"/.css", // Path parameter
"/nonexistent1.css", // Path parameter
"/../nonexistent2.css", // Path traversal
"/%2e%2e/nonexistent3.css", // Encoded path traversal
"%0Anonexistent4.css", // Encoded Newline
"%00nonexistent5.css", // Encoded Null Byte
"%09nonexistent6.css", // Encoded Tab
"%3Bnonexistent7.css", // Encoded Semicolon
"%23nonexistent8.css", // Encoded Pound
"%3Fname=valnonexistent9.css", // Encoded Question Mark
"%26name=valnonexistent10.css", // Encoded Ampersand
";nonexistent11.css", // Semicolon
"?nonexistent12.css", // Question Mark
"&nonexistent13.css", // Ampersand
"%0A%2f%2e%2e%2fresources%2fnonexistent1.css", // Encoded Path Traversal to static directory using Encoded Newline
"%00%2f%2e%2e%2fresources%2fnonexistent2.css", // Encoded Path Traversal to static directory using Encoded Null Byte
"%09%2f%2e%2e%2fresources%2fnonexistent3.css", // Encoded Path Traversal to static directory using Encoded Tab
"%3B%2f%2e%2e%2fresources%2fnonexistent4.css", // Encoded Path Traversal to static directoryEncoded using Semicolon
"%23%2f%2e%2e%2fresources%2fnonexistent5.css", // Encoded Path Traversal to static directory using Encoded Pound
"%3F%2f%2e%2e%2fresources%2fnonexistent6.css", // Encoded Path Traversal to static directory using Encoded Question Mark
"%26%2f%2e%2e%2fresources%2fnonexistent7.css", // Encoded Path Traversal to static directory using Encoded Ampersand
";%2f%2e%2e%2fresources%2fnonexistent8.css", // Encoded Path Traversal to static directory using Semicolon
"?%2f%2e%2e%2fresources%2fnonexistent9.css", // Encoded Path Traversal to static directoy using Question Mark
"&%2f%2e%2e%2fresources%2fnonexistent10.css", // Encoded Path Traversal to static directory using Ampersand
"%0A%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2frobots.txt?a", // Encoded Path Traversal to robots.txt using Encoded Newline
"%00%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2frobots.txt?b", // Encoded Path Traversal to robots.txt directory using Encoded Null Byte
"%09%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2frobots.txt?c", // Encoded Path Traversal to robots.txt directory using Encoded Tab
"%3B%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2frobots.txt?d", // Encoded Path Traversal to robots.txt directoryEncoded using Semicolon
"%23%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2frobots.txt?e", // Encoded Path Traversal to robots.txt directory using Encoded Pound
"%3F%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2frobots.txt?f", // Encoded Path Traversal to robots.txt directory using Encoded Question Mark
"%26%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2frobots.txt?g", // Encoded Path Traversal to robots.txt directory using Encoded Ampersand
";%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2frobots.txt?h", // Encoded Path Traversal to robots.txt directory using Semicolon
"?%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2frobots.txt?i", // Encoded Path Traversal to robots.txt directoy using Question Mark
"&%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2frobots.txt?j", // Encoded Path Traversal to robots.txt directory using Ampersand
}
// TODO add "Exploiting normalization by the origin server" cache deception which needs to prepend something before the url path
PrintVerbose("Testing for Web Cache Deception\n", NoColor, 1)
// test each appending one after another
for _, appendStr := range appendings {
err := webCacheDeceptionTemplate(&repResult, appendStr)
if err != nil {
repResult.HasError = true
repResult.ErrorMessages = append(repResult.ErrorMessages, err.Error())
}
}
return repResult
}
func webCacheDeceptionTemplate(repResult *reportResult, appendStr string) error {
var req *http.Request
var resp *http.Response
var err error
var msg string
var body []byte
var repRequest reportRequest
rUrl := Config.Website.Url.String()
// Überprüfen, ob der String genau zwei `//` enthält
if strings.Count(rUrl, "/") == 2 && !strings.HasPrefix(appendStr, "/") {
// append `/`, so e.g. https://example%0A does not throw an error when building the request
rUrl += "/"
}
req, err = http.NewRequest("GET", rUrl+appendStr, nil)
if err != nil {
msg = fmt.Sprintf("webCacheDeceptionTemplate: %s: http.NewRequest: %s\n", appendStr, err.Error())
Print(msg, Red)
return errors.New(msg)
}
// Do request
newClient := http.Client{
CheckRedirect: http.DefaultClient.CheckRedirect,
Timeout: http.DefaultClient.Timeout,
}
setRequest(req, false, "", http.Cookie{})
_, err = newClient.Do(req)
if err != nil {
msg = fmt.Sprintf("webCacheDeceptionTemplate: %s: newClient.Do: %s\n", appendStr, err.Error())
PrintVerbose(msg, Yellow, 1)
return errors.New(msg)
}
resp, err = newClient.Do(req) // send request 2 times so it'll return a cache hit if deception was successful!
if err != nil {
msg = fmt.Sprintf("webCacheDeceptionTemplate: %s: newClient.Do: %s\n", appendStr, err.Error())
PrintVerbose(msg, Yellow, 1)
return errors.New(msg)
} else {
defer resp.Body.Close()
body, err = io.ReadAll(resp.Body)
if err != nil {
msg = fmt.Sprintf("webCacheDeceptionTemplate: %s: io.ReadAll: %s\n", appendStr, err.Error())
Print(msg, Red)
return errors.New(msg)
}
if resp.StatusCode != Config.Website.StatusCode && resp.StatusCode != 404 && resp.StatusCode != 400 {
msg = fmt.Sprintf("Unexpected Status Code %d for webCacheDeceptionTemplate: %s\n", resp.StatusCode, appendStr)
Print(msg, Yellow)
}
}
// Add the request as curl command to the report
command, err := http2curl.GetCurlCommand(req)
if err != nil {
PrintVerbose("Error: http2curl: "+err.Error()+"\n", Yellow, 1)
}
repRequest.CurlCommand = command.String()
var indicValue string
if Config.Website.Cache.Indicator == "" { // check if now a cache indicator exists
customCacheHeader := strings.ToLower(Config.CacheHeader)
for key, val := range resp.Header {
switch strings.ToLower(key) {
case "x-cache", "cf-cache-status", "x-drupal-cache", "x-varnish-cache", "akamai-cache-status", "server-timing", "x-iinfo", "x-nc", "x-hs-cf-cache-status", "x-proxy-cache", "x-cache-hits", "x-cache-status", "x-cache-info", "x-rack-cache", "cdn_cache_status", "x-akamai-cache", "x-akamai-cache-remote", "x-cache-remote", customCacheHeader:
// CacheHeader flag might not be set (=> ""). Continue in this case
if key == "" {
continue
}
Config.Website.Cache.Indicator = key
msg := fmt.Sprintf("%s: %s header was found: %s \n", req.URL, key, val)
PrintVerbose(msg, NoColor, 1)
addHitMissIndicatorMap(strings.ToLower(key))
case "age":
// only set it it wasn't set to x-cache or sth. similar beforehand
if Config.Website.Cache.Indicator == "" {
Config.Website.Cache.Indicator = key
msg := fmt.Sprintf("%s: %s header was found: %s\n", req.URL, key, val)
PrintVerbose(msg, NoColor, 1)
addHitMissIndicatorMap(strings.ToLower("age"))
}
}
}
}
indicValue = strings.TrimSpace(strings.ToLower(resp.Header.Get(Config.Website.Cache.Indicator)))
// check if there's a cache hit and if the body didn't change (otherwise it could be a cached error page, for example)
if checkCacheHit(indicValue, "") && string(body) == Config.Website.Body {
repResult.Vulnerable = true
repRequest.Reason = "The response got cached due to Web Cache Deception"
msg = fmt.Sprintf("%s was successfully decepted! appended: %s\n", rUrl, appendStr)
Print(msg, Green)
msg = "Curl: " + repRequest.CurlCommand + "\n\n"
Print(msg, Green)
repRequest.URL = req.URL.String()
// Dump the request without the body
var dumpReqBytes []byte
dumpReqBytes, _ = httputil.DumpRequest(req, false)
repRequest.Request = string(dumpReqBytes)
// Dump the response
responseBytes, _ := httputil.DumpResponse(resp, true)
repRequest.Response = string(responseBytes)
repResult.Requests = append(repResult.Requests, repRequest)
} else {
PrintVerbose("Curl command: "+repRequest.CurlCommand+"\n", NoColor, 2)
}
return nil
}
Web-Cache-Vulnerability-Scanner-1.3.3/pkg/flags.go 0000664 0000000 0000000 00000032542 14732751445 0021700 0 ustar 00root root 0000000 0000000 package pkg
import (
"flag"
"fmt"
"os"
"runtime"
"strconv"
"strings"
"text/tabwriter"
"github.com/fatih/color"
"golang.org/x/time/rate"
)
var (
version string
useragent string
generalOptions []FlagStruct
generateOptions []FlagStruct
requestOptions []FlagStruct
crawlOptions []FlagStruct
wordlistOptions []FlagStruct
)
type FlagStruct struct {
LongFlag string
ShortFlag string
Description string
}
func init() {
}
func ParseFlags(vers string) {
/* Getting Command-line flags */
version = vers
useragent = "WebCacheVulnerabilityScanner v" + version
pathPrefix := ""
if runtime.GOOS == "windows" {
pathPrefix = "C:"
}
// General Options
techniqueNames := "deception,cookies,css,forwarding,smuggling,dos,headers,parameters,fatget,cloaking,splitting"
var ignoreStatus string
appendInt(&generalOptions, &Config.Verbosity,
"verbosity", "v", 1, "Set verbosity. 0 = quiet, 1 = normal, 2 = verbose")
appendFloat(&generalOptions, &Config.ReqRate,
"reqrate", "rr", float64(rate.Inf), "Requests per second. Float value. Has to be greater than 0. Default value is infinite")
appendInt(&generalOptions, &Config.Threads,
"threads", "t", 20, "Threads to use. Default value is 20")
appendInt(&generalOptions, &Config.TimeOut,
"timeout", "to", 15, "Seconds until timeout. Default value is 15")
appendString(&generalOptions, &Config.OnlyTest,
"onlytest", "ot", "", "Choose which tests to run. Use the , separator to specify multiple ones. Example: -onlytest '"+techniqueNames+"'")
appendString(&generalOptions, &Config.SkipTest,
"skiptest", "st", "", "Choose which tests to not run. Use the , separator to specify multiple ones. Example: -skiptest '"+techniqueNames+"'")
appendString(&generalOptions, &Config.ProxyCertPath,
"proxycertpath", "ppath", "", "Path to the cert of the proxy you want to use. The cert has to have the PEM Format. Burp e.g. is in the DER Format. Use the following command to convert it: openssl x509 -inform DER -outform PEM -text -in cacert.der -out certificate.pem")
appendString(&generalOptions, &Config.ProxyURL,
"proxyurl", "purl", "http://127.0.0.1:8080", "Url for the proxy. Default value is http://127.0.0.1:8080")
appendBoolean(&generalOptions, &Config.Force,
"force", "f", false, "Perform the tests no matter if there is a cache or even the cachebuster works or not")
appendString(&generalOptions, &ignoreStatus,
"ignorestatus", "is", "", "Ignore a specific status code for cache poisoning")
appendInt(&generalOptions, &Config.CLDiff,
"contentlengthdifference", "cldiff", 0, "Threshold for reporting possible Finding, when 'poisoned' response differs more from the original length. Default is 0 (don't check)")
appendInt(&generalOptions, &Config.HMDiff,
"hitmissdifference", "hmdiff", 30, "Threshold for time difference between cache hit and cache miss responses. Default is 30")
appendBoolean(&generalOptions, &Config.SkipTimebased,
"skiptimebased", "stime", false, "Skip checking if a repsonse gets cached by measuring time differences")
appendString(&generalOptions, &Config.CacheHeader,
"cacheheader", "ch", "", "Specify a custom cache header")
appendBoolean(&generalOptions, &Config.DisableColor,
"nocolor", "nc", false, "Disable color output")
// Generate Options
appendString(&generateOptions, &Config.GeneratePath,
"generatepath", "gp", "./", "Path all files (log, report, completed) will be written to. Example: -gp '"+pathPrefix+"/p/a/t/h/'. Default is './'")
appendBoolean(&generateOptions, &Config.GenerateReport,
"generatereport", "gr", false, "Do you want a report to be generated?")
appendBoolean(&generateOptions, &Config.EscapeJSON,
"escapejson", "ej", false, "Do you want HTML special chars to be encoded in the report?")
appendBoolean(&generateOptions, &Config.GenerateCompleted,
"generatecompleted", "gc", false, "Do you want a list with completed URLs to be generated?")
// Request Options
var (
urlStr string
setCookiesStr string
setHeadersStr string
setParametersStr string
setBodyStr string
userAgentChrome bool
)
appendString(&requestOptions, &urlStr,
"url", "u", "", "Url to scan. Has to start with http:// or https://. Otherwise use file: to specify a file with (multiple) urls. E.g. -u https://www.example.com or -u file:templates/url_list")
appendBoolean(&requestOptions, &Config.UseHTTP,
"usehttp", "http", false, "Use http instead of https for URLs, which doesn't specify either one")
appendBoolean(&requestOptions, &Config.DeclineCookies,
"declineCookies", "dc", false, "Do you don't want to use cookies, which are received in the response of the first request?")
appendString(&requestOptions, &Config.CacheBuster,
"cachebuster", "cb", "cbwcvs", "Specify the cachebuster to use. The default value is cbwcvs")
appendString(&requestOptions, &setCookiesStr,
"setcookies", "sc", "", "Set a Cookie. Otherwise use file: to specify a file with urls. E.g. -sc uid=123 or -sc file:templates/cookie_list")
appendString(&requestOptions, &setHeadersStr,
"setheaders", "sh", "", "Set a Header. Otherwise use file: to specify a file with urls. E.g. -sh 'User-Agent: Safari/1.1' or -sh file:templates/header_list")
appendString(&requestOptions, &setParametersStr,
"setparameters", "sp", "", "Set a Query Parameter. Otherwise use file: to specify a file with urls. E.g. -sp user=admin or -sp file:templates/parameter_list")
appendString(&requestOptions, &setBodyStr,
"setbody", "sb", "", "Set the requests' body. Otherwise use file: to specify a file with urls. E.g. -sb 'admin=true' or -sh file:templates/body_file")
appendBoolean(&requestOptions, &Config.DoPost,
"post", "post", false, "Do a POST request instead of a GET request")
appendString(&requestOptions, &Config.ContentType,
"contenttype", "ct", "application/x-www-form-urlencoded", "Set the contenttype for a POST Request. Default is application/x-www-form-urlencoded. If you don't want a content-type to be used at all use -ct ''")
appendString(&requestOptions, &Config.QuerySeparator,
"parameterseparator", "ps", "&", "Specify the separator for parameters. The default value is &")
appendBoolean(&requestOptions, &userAgentChrome,
"useragentchrome", "uac", false, "Set chrome as User-Agent. Default is "+useragent)
// Crawl Options
var (
recExcludeStr string
recDomainsStr string
)
appendInt(&crawlOptions, &Config.Recursivity,
"recursivity", "r", 0, "Put (via href or src specified) urls at the end of the queue if the domain is the same. Specify how deep the recursivity shall go. Default value is 0 (no recursivity)")
appendInt(&crawlOptions, &Config.RecLimit,
"reclimit", "rl", 0, "Define a limit, how many files shall be checked recursively. Default is 0 (unlimited)")
appendString(&crawlOptions, &Config.RecInclude,
"recinclude", "rin", "", "Choose which links should be included. Separate with a space. E.g: -rin '.js .css'")
appendString(&crawlOptions, &recExcludeStr,
"recexclude", "rex", "", "Use -cp (-completedpath) or -gc (-generatecompleted) to generate a list of already completed URLs. Use -rex path/to/file so the already completed URLs won't be tested again recursively.")
appendString(&crawlOptions, &recDomainsStr,
"recdomains", "red", "", "Define an additional domain which is allowed to be added recursively. Otherwise use file: to specify a file with urls. E.g. -sh 'api.example.com' or -sh file:templates/recdomains_list")
// Wordlist Options
appendString(&wordlistOptions, &Config.HeaderWordlist,
"headerwordlist", "hw", "wordlists/headers", "Wordlist for headers to test. Default path is 'wordlists/top-headers'")
appendString(&wordlistOptions, &Config.QueryWordlist,
"parameterwordlist", "pw", "wordlists/parameters", "Wordlist for query parameters to test. Default path is 'wordlists/top-parameters'")
flag.CommandLine.Usage = help
// flags need to be parsed, before they are used
flag.Parse()
// Check if color should be disabled
if Config.DisableColor {
color.NoColor = true
}
/* Checking values of Flags */
if len(flag.Args()) > 0 {
msg := fmt.Sprintf("%s: Args are not supported! Use flags. Use -h or --help to get a list of all supported flags\n", flag.Args())
PrintFatal(msg)
}
if urlStr == "" {
msg := "No url specified. Use -url or -u. Use -h or --help to get a list of all supported flags\n"
PrintFatal(msg)
}
// Change User Agent
if userAgentChrome {
useragent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36"
}
// IgnoreStatus string to int slice
if ignoreStatus != "" {
statusSlice := strings.Split(ignoreStatus, ",")
for _, status := range statusSlice {
statusInt, err := strconv.Atoi(strings.TrimSpace(status))
if err != nil {
PrintFatal("Error converting to int: " + err.Error())
}
Config.IgnoreStatus = append(Config.IgnoreStatus, statusInt)
}
}
// Read RecExcludeURL(s)
if recExcludeStr != "" {
Config.RecExclude = ReadLocalFile(recExcludeStr, "RecExclude")
}
// Read RecDomain(s)
Config.RecDomains = readFile(recDomainsStr, Config.RecDomains, "RecDomain")
// Read URL(s)
Config.Urls = readFile(urlStr, Config.Urls, "URL")
// Read Cookie(s)
Config.Cookies = readFile(setCookiesStr, Config.Cookies, "Cookie")
// Read Header(s)
Config.Headers = readFile(setHeadersStr, Config.Headers, "Heades")
// Read Parameter(s)
Config.Parameters = readFile(setParametersStr, Config.Parameters, "Parameter")
/* Read Body */
if strings.HasPrefix(setBodyStr, "path:") {
bodySlice := ReadLocalFile(setBodyStr, "Body")
for _, l := range bodySlice {
l = strings.TrimSuffix(l, "\r")
l = strings.TrimSpace(l)
if strings.HasPrefix(l, "//") || l == "" {
continue
}
Config.Body += l
}
} else {
Config.Body = setBodyStr
}
// Set Limiter
Config.Limiter = rate.NewLimiter(rate.Limit(Config.ReqRate), 1)
Config.OnlyTest = strings.ToLower(Config.OnlyTest)
Config.SkipTest = strings.ToLower(Config.SkipTest)
}
// TODO: is field []string needed here?
func readFile(str string, field []string, name string) []string {
if strings.HasPrefix(str, "file:") {
return ReadLocalFile(str, name)
} else {
return append(field, str)
}
}
func help() {
w := new(tabwriter.Writer)
w.Init(os.Stdout, 8, 8, 0, '\t', 0)
fmt.Printf(getLogo()+"\nWCVS - the Web Cache Vulnerability Scanner. (v%s)"+"\n\n", version)
fmt.Println("Published by Hackmanit under http://www.apache.org/licenses/LICENSE-2.0")
fmt.Println("Author: Maximilian Hildebrand")
fmt.Println("Repository: https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner")
fmt.Println("Blog Post: https://hackmanit.de/en/blog-en/145-web-cache-vulnerability-scanner-wcvs-free-customizable-easy-to-use")
fmt.Print("Usage: Web-Cache-Vulnerability-Scanner(.exe) [options]\n\n")
fmt.Println("General Options:")
fmt.Fprintf(w, "%s\t%s\t%s\n", "--help", "-h", "Show this help and quit")
writeToWriter(w, generalOptions)
fmt.Println("\nGenerate Options:")
writeToWriter(w, generateOptions)
fmt.Println("\nRequest Options:")
writeToWriter(w, requestOptions)
fmt.Println("\nCrawl Options:")
writeToWriter(w, crawlOptions)
fmt.Println("\nWordlist Options:")
writeToWriter(w, wordlistOptions)
os.Exit(0)
}
func getLogo() string {
// source: https://patorjk.com/software/taag/#p=display&f=Slant%20Relief&t=wcvs
logo := `
__/\\____/\\___/\\_____/\\\\\\\\__/\\\____/\\\__/\\\\\\\\\\_
_\/\\\__/\\\\_/\\\___/\\\//////__\//\\\__/\\\__\/\\\//////__
_\//\\\/\\\\\/\\\___/\\\__________\//\\\/\\\___\/\\\\\\\\\\_
__\//\\\\\/\\\\\___\//\\\__________\//\\\\\____\////////\\\_
___\//\\\\//\\\_____\///\\\\\\\\____\//\\\______/\\\\\\\\\\_
____\///__\///________\////////______\///______\//////////__`
logo = strings.ReplaceAll(logo, "_", color.HiRedString("_"))
return logo
}
func writeToWriter(w *tabwriter.Writer, flagStruct []FlagStruct) {
for _, ts := range flagStruct {
fmt.Fprintf(w, "--%s\t-%s\t%s\n", ts.LongFlag, ts.ShortFlag, ts.Description)
}
w.Flush()
}
func appendString(options *[]FlagStruct, varString *string, longFlag string, shortFlag string, defaultValue string, description string) {
flag.StringVar(varString, longFlag, defaultValue, "")
if shortFlag != longFlag {
flag.StringVar(varString, shortFlag, defaultValue, "")
}
*options = append(*options, FlagStruct{
LongFlag: longFlag,
ShortFlag: shortFlag,
Description: description})
}
func appendInt(options *[]FlagStruct, varInt *int, longFlag string, shortFlag string, defaultValue int, description string) {
flag.IntVar(varInt, longFlag, defaultValue, "")
if shortFlag != longFlag {
flag.IntVar(varInt, shortFlag, defaultValue, "")
}
*options = append(*options, FlagStruct{
LongFlag: longFlag,
ShortFlag: shortFlag,
Description: description})
}
func appendFloat(options *[]FlagStruct, varFloat *float64, longFlag string, shortFlag string, defaultValue float64, description string) {
flag.Float64Var(varFloat, longFlag, defaultValue, "")
if shortFlag != longFlag {
flag.Float64Var(varFloat, shortFlag, defaultValue, "")
}
*options = append(*options, FlagStruct{
LongFlag: longFlag,
ShortFlag: shortFlag,
Description: description})
}
func appendBoolean(options *[]FlagStruct, varBoolean *bool, longFlag string, shortFlag string, defaultValue bool, description string) {
flag.BoolVar(varBoolean, longFlag, defaultValue, "")
if shortFlag != longFlag {
flag.BoolVar(varBoolean, shortFlag, defaultValue, "")
}
*options = append(*options, FlagStruct{
LongFlag: longFlag,
ShortFlag: shortFlag,
Description: description})
}
Web-Cache-Vulnerability-Scanner-1.3.3/pkg/recon.go 0000664 0000000 0000000 00000121321 14732751445 0021704 0 ustar 00root root 0000000 0000000 package pkg
import (
"bytes"
"errors"
"fmt"
"io"
"net/http"
"net/url"
"strings"
"time"
"golang.org/x/net/html"
)
var (
hitmissindicator map[string]int
cachebuster map[string]int
total_hitmissindicator map[string]int
total_cachebuster map[string]int
once_hitmissindicator map[string]int
once_cachebuster map[string]int
Statistics map[string]int
timeFalsePos []int64
timeFalseNeg []int64
countFalsePos []int
countFalseNeg []int
boolFalsePos bool
boolFalseNeg bool
cb_method bool
cb_cookie bool
cb_parameter bool
cb_header bool
)
func init() {
hitmissindicator = map[string]int{}
cachebuster = map[string]int{}
once_hitmissindicator = map[string]int{}
once_cachebuster = map[string]int{}
total_hitmissindicator = map[string]int{}
total_cachebuster = map[string]int{}
countFalsePos = []int{0, 0}
countFalseNeg = []int{0, 0}
}
func addFalsePos() {
if !boolFalsePos {
boolFalsePos = true
countFalsePos[0]++
}
countFalsePos[1]++
}
func addFalseNeg() {
if !boolFalseNeg {
boolFalseNeg = true
countFalseNeg[0]++
}
countFalseNeg[1]++
}
func cbFoundDifference(times []int64, identifier string) {
if len(times)%2 == 0 {
for i := 0; i < len(times); i += 2 {
dif := times[i] - times[i+1]
if dif < int64(Config.HMDiff) {
msg := fmt.Sprintf("The time difference (%d) was smaller than the threshold (%d)\n", dif, Config.HMDiff)
PrintVerbose(msg, NoColor, 2)
timeFalseNeg = append(timeFalseNeg, dif)
addFalseNeg()
return
}
}
} else {
msg := fmt.Sprintf("%s: len(times) mod 2 != 0\n", identifier)
Print(msg, Yellow)
}
}
func cbNotFoundDifference(times []int64, identifier string) {
if len(times)%2 == 0 {
for i := 0; i < len(times); i += 2 {
dif := times[i] - times[i+1]
if dif >= int64(Config.HMDiff) {
msg := fmt.Sprintf("The time difference (%d) was equal or higher than the threshold (%d)", dif, Config.HMDiff)
Print(msg, Yellow)
timeFalsePos = append(timeFalsePos, dif)
addFalsePos()
return
}
}
} else {
msg := fmt.Sprintf("%s: len(times) mod 2 != 0", identifier)
Print(msg, Yellow)
}
}
func addHitMissIndicatorMap(name string) {
hitmissindicator[name]++
if hitmissindicator[name] == 1 {
once_hitmissindicator[name]++
}
total_hitmissindicator[name]++
}
func addCachebusterMap(name string) {
cachebuster[name]++
if cachebuster[name] == 1 {
once_cachebuster[name]++
}
total_cachebuster[name]++
}
/* Check if the parameter "cb" (or any other defined by flag -cb), the headers "accept-encoding, accept, cookie, origin" or any cookie can be used as cachebuster */
func CheckCache(stat string) (CacheStruct, bool, []error) {
if strings.Contains(stat, "sub") {
hitmissindicator = map[string]int{}
cachebuster = map[string]int{}
}
cb_method = false
cb_cookie = false
cb_parameter = false
cb_header = false
boolFalseNeg = false
boolFalsePos = false
var cache CacheStruct
var errSlice []error
customCacheHeader := strings.ToLower(Config.CacheHeader)
// analyze the website headers
for key, val := range Config.Website.Headers {
switch strings.ToLower(key) {
case "cache-control", "pragma":
msg := fmt.Sprintf("%s header was found: %s \n", key, val)
PrintVerbose(msg, NoColor, 1)
case "x-cache", "cf-cache-status", "x-drupal-cache", "x-varnish-cache", "akamai-cache-status", "server-timing", "x-iinfo", "x-nc", "x-hs-cf-cache-status", "x-proxy-cache", "x-cache-hits", "x-cache-status", "x-cache-info", "x-rack-cache", "cdn_cache_status", "x-akamai-cache", "x-akamai-cache-remote", "x-cache-remote", customCacheHeader:
// CacheHeader flag might not be set (=> ""). Continue in this case
if key == "" {
continue
}
cache.Indicator = key
msg := fmt.Sprintf("%s header was found: %s \n", key, val)
PrintVerbose(msg, NoColor, 1)
addHitMissIndicatorMap(strings.ToLower(key))
case "age":
// only set it it wasn't set to x-cache or sth. similar beforehand
if cache.Indicator == "" {
cache.Indicator = key
msg := fmt.Sprintf("%s header was found: %s\n", key, val)
PrintVerbose(msg, NoColor, 1)
addHitMissIndicatorMap(strings.ToLower("age"))
}
}
}
addHitMissIndicatorMap("total")
addCachebusterMap("total")
alwaysMiss := false
var err error
if cache.Indicator == "" {
msg := "No x-cache (or other cache hit/miss header) header was found\nThe time will be measured as cache hit/miss indicator\n"
Print(msg, Yellow)
} else {
alwaysMiss, err = checkIfAlwaysMiss(cache)
if err != nil {
errSlice = append(errSlice, err)
}
}
// test for cachebuster, if the cache doesnt always return a miss
if !alwaysMiss {
// Check first if a parameter can be used as cachebuster
if !cache.CBwasFound {
err = cachebusterParameter(&cache)
if err != nil {
errSlice = append(errSlice, err)
}
}
// Check second if a header can be used as cachebuster
if !cache.CBwasFound {
errs := cachebusterHeader(&cache)
if err != nil {
errSlice = append(errSlice, errs...)
}
}
// Check third if a cookie can be used as cachebuster
if !cache.CBwasFound {
errs := cachebusterCookie(&cache)
if err != nil {
errSlice = append(errSlice, errs...)
}
}
// Check fourth if a HTTP Method can be used as cachebuster
if !cache.CBwasFound {
errs := cachebusterHTTPMethod(&cache)
if err != nil {
errSlice = append(errSlice, errs...)
}
}
totalCachebusters := "comb_"
if cb_method {
addCachebusterMap("total_httpmethods")
totalCachebusters += "httpmethod"
}
if cb_cookie {
addCachebusterMap("total_cookies")
totalCachebusters += "cookie"
}
if cb_header {
addCachebusterMap("total_headers")
totalCachebusters += "header"
}
if cb_parameter {
addCachebusterMap("total_parameters")
totalCachebusters += "parameter"
}
if cache.CBwasFound {
addCachebusterMap(totalCachebusters)
}
}
if cache.Indicator == "" && !cache.TimeIndicator {
msg := "No cache indicator could be found"
Print(msg+"\n", Yellow)
errSlice = append(errSlice, errors.New(strings.ToLower(msg)))
addHitMissIndicatorMap("none")
addCachebusterMap("none")
} else {
addHitMissIndicatorMap("found")
if !cache.CBwasFound {
msg := "No cachebuster could be found"
Print(msg+"\n", Yellow)
errSlice = append(errSlice, errors.New(strings.ToLower(msg)))
addCachebusterMap("none")
} else {
addCachebusterMap("found")
}
}
if (!cache.CBwasFound || (cache.Indicator == "" && !cache.TimeIndicator)) && !Config.Force {
msg := "Use -f/-force to force the test\n"
Print(msg, Yellow)
}
msg := fmt.Sprintf("Statistics:\nGeneral: %+v\nIndicator: %+v\nCachebuster: %+v\nOnce_Indicator: %+v\nOnce_Cachebuster: %+v\nTotal_Indicator: %+v\nTotal_Cachebuster: %+v\nTimeFalseNeg: %+v: %+v\nTimeFalsePos: %+v: %+v\n",
Statistics, hitmissindicator, cachebuster, once_hitmissindicator, once_cachebuster, total_hitmissindicator, total_cachebuster, countFalseNeg, timeFalseNeg, countFalsePos, timeFalsePos)
PrintVerbose(msg, Cyan, 2)
return cache, alwaysMiss, errSlice
}
func checkIfAlwaysMiss(cache CacheStruct) (bool, error) {
errorString := "checkIfAlwaysMiss"
var req *http.Request
var err error
weburl := Config.Website.Url.String()
if Config.DoPost {
req, err = http.NewRequest("POST", weburl, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", weburl, nil)
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
return false, errors.New(msg)
}
setRequest(req, Config.DoPost, "", http.Cookie{})
waitLimiter(errorString)
resp, err := http.DefaultClient.Do(req)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
return false, errors.New(msg)
}
defer resp.Body.Close()
firstUnix := time.Now().Unix()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
setRequest(req, Config.DoPost, "", http.Cookie{})
waitLimiter(errorString)
secondUnix := time.Now().Unix()
timeDiff := secondUnix - firstUnix
// make sure that there is at least 2 sec difference.
// So that first req has Age=0 and second req has Age>=2
if timeDiff <= 1 && strings.EqualFold("age", cache.Indicator) {
time.Sleep(2 * time.Second)
}
resp, err = http.DefaultClient.Do(req)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
return false, errors.New(msg)
}
defer resp.Body.Close()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
indicValue := strings.TrimSpace(strings.ToLower(resp.Header.Get(cache.Indicator)))
if !checkCacheHit(indicValue, cache.Indicator) {
addCachebusterMap("always-miss")
msg := "cache returns always miss"
Print(msg+"\n", Yellow)
return true, errors.New(msg)
}
return false, nil
}
func cachebusterCookie(cache *CacheStruct) []error {
var errSlice []error
for i, c := range Config.Website.Cookies {
errorString := "cachebusterCookie " + c.Name
identifier := "Cookie " + c.Name + " as Cachebuster"
var req *http.Request
var err error
var times []int64
if cache.Indicator == "" {
// No Cache Indicator was found. So time will be used as Indicator
if Config.SkipTimebased {
continue
}
var newCookie http.Cookie
var cb string
for ii := 0; ii < 5*2; ii++ {
weburl := Config.Website.Url.String()
if Config.DoPost {
req, err = http.NewRequest("POST", weburl, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", weburl, nil)
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
if ii%2 == 0 {
cb = randInt()
newCookie = *c
newCookie.Value = cb
}
setRequest(req, Config.DoPost, "", newCookie)
waitLimiter(errorString)
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
defer resp.Body.Close()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
}
msg := fmt.Sprintf("measured times: %d\n", times)
PrintVerbose(msg, NoColor, 2)
skip := false
for ii := range times {
// Cache miss has to take 30ms (misshitdif) longer than cache hit
if ii%2 == 1 && times[ii-1]-times[ii] < int64(Config.HMDiff) {
msg := fmt.Sprintf("%s was not successful (Cookie)\n", identifier)
PrintVerbose(msg, NoColor, 2)
skip = true
break
}
}
if skip {
continue
}
cache.TimeIndicator = true
cache.CBwasFound = true
cache.CBisCookie = true
cache.CBisHTTPMethod = false
cache.CBisHeader = false
cache.CBisParameter = false
cache.CBName = Config.Website.Cookies[i].Name
cb_cookie = true
addHitMissIndicatorMap("time")
addCachebusterMap("cookie_" + Config.Website.Cookies[i].Name)
msg = fmt.Sprintf("%s was successful (Cookie, time was used as indicator)\n", identifier)
Print(msg, Cyan)
} else {
// A hit miss Indicator was found. Sending 2 requests, each with a new cachebuster, expecting 2 misses
weburl := Config.Website.Url.String()
if Config.DoPost {
req, err = http.NewRequest("POST", weburl, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", weburl, nil)
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
cb := randInt()
newCookie := *c
newCookie.Value = cb
setRequest(req, Config.DoPost, "", newCookie)
waitLimiter(errorString)
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
defer resp.Body.Close()
firstUnix := time.Now().Unix()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
indicValue := strings.TrimSpace(strings.ToLower(resp.Header.Get(cache.Indicator)))
if checkCacheHit(indicValue, cache.Indicator) {
// If there is a hit, the cachebuster didn't work
msg := fmt.Sprintf("%s was not successful (Cookie)\n", identifier)
PrintVerbose(msg, NoColor, 2)
continue
} else {
if Config.DoPost {
req, err = http.NewRequest("POST", weburl, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", weburl, nil)
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
cb = randInt()
c.Value = cb
setRequest(req, Config.DoPost, "", *c)
waitLimiter(errorString)
secondUnix := time.Now().Unix()
timeDiff := secondUnix - firstUnix
// make sure that there is at least 2 sec difference.
// So that first req has Age=0 and second req has Age>=2
if timeDiff <= 1 && strings.EqualFold("age", cache.Indicator) {
time.Sleep(2 * time.Second)
}
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
defer resp.Body.Close()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
indicValue = strings.TrimSpace(strings.ToLower(resp.Header.Get(cache.Indicator)))
if checkCacheHit(indicValue, cache.Indicator) {
// If there is a hit, the cachebuster didn't work
msg := fmt.Sprintf("%s was not successful (Cookie)\n", identifier)
PrintVerbose(msg, NoColor, 2)
cbNotFoundDifference(times, identifier)
} else {
cache.CBwasFound = true
cache.CBisCookie = true
cache.CBisHTTPMethod = false
cache.CBisHeader = false
cache.CBisParameter = false
cache.CBName = Config.Website.Cookies[i].Name
cb_cookie = true
addCachebusterMap("cookie_" + Config.Website.Cookies[i].Name)
msg := fmt.Sprintf("%s was successful (Cookie)\n", identifier)
Print(msg, Cyan)
cbFoundDifference(times, identifier)
continue
}
}
}
}
return errSlice
}
func cachebusterHeader(cache *CacheStruct) []error {
headers := []string{"Accept-Encoding", "Accept", "Cookie", "Origin"}
values := []string{"gzip, deflate, ", "*/*, text/", "wcvs_cookie=", ""}
var errSlice []error
for i, header := range headers {
errorString := "cachebusterHeader " + header
identifier := "Header " + header + " as Cachebuster"
var req *http.Request
var err error
var times []int64
if cache.Indicator == "" {
// No Cache Indicator was found. So time will be used as Indicator
if Config.SkipTimebased {
continue
}
var cb string
for ii := 0; ii < 5*2; ii++ {
weburl := Config.Website.Url.String()
if Config.DoPost {
req, err = http.NewRequest("POST", weburl, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", weburl, nil)
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
setRequest(req, Config.DoPost, "", http.Cookie{})
if ii%2 == 0 {
cb = values[i] + randInt()
if h := req.Header.Get(header); h != "" {
msg := fmt.Sprintf("Overwriting %s:%s with %s:%s\n", header, h, header, cb)
Print(msg, NoColor)
}
req.Header.Set(header, cb)
}
waitLimiter(errorString)
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
defer resp.Body.Close()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
}
msg := fmt.Sprintf("measured times: %d\n", times)
PrintVerbose(msg, NoColor, 2)
skip := false
for ii := range times {
// Cache miss has to take 30ms (misshitdif) longer than cache hit
if ii%2 == 1 && times[ii-1]-times[ii] < int64(Config.HMDiff) {
msg := fmt.Sprintf("%s was not successful (Header)\n", identifier)
PrintVerbose(msg, NoColor, 2)
skip = true
break
}
}
if skip {
continue
}
cache.TimeIndicator = true
cache.CBwasFound = true
cache.CBisHeader = true
cache.CBisCookie = false
cache.CBisHTTPMethod = false
cache.CBisParameter = false
cache.CBName = header
cb_header = true
addHitMissIndicatorMap("time")
addCachebusterMap("header_" + header)
msg = fmt.Sprintf("%s was successful (Header, time was used as indicator)\n", identifier)
Print(msg, Cyan)
continue
} else {
// A hit miss Indicator was found. Sending 2 requests, each with a new cachebuster, expecting 2 misses
weburl := Config.Website.Url.String()
if Config.DoPost {
req, err = http.NewRequest("POST", weburl, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", weburl, nil)
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
setRequest(req, Config.DoPost, "", http.Cookie{})
cb := values[i] + randInt()
if h := req.Header.Get(header); h != "" {
msg := fmt.Sprintf("Overwriting %s:%s with %s:%s\n", header, h, header, cb)
Print(msg, NoColor)
}
req.Header.Set(header, cb)
waitLimiter(errorString)
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
defer resp.Body.Close()
firstUnix := time.Now().Unix()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
indicValue := strings.TrimSpace(strings.ToLower(resp.Header.Get(cache.Indicator)))
if checkCacheHit(indicValue, cache.Indicator) {
// If there is a hit, the cachebuster didn't work
msg := fmt.Sprintf("%s was not successful (Header)\n", identifier)
PrintVerbose(msg, NoColor, 2)
continue
} else {
if Config.DoPost {
req, err = http.NewRequest("POST", weburl, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", weburl, nil)
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
setRequest(req, Config.DoPost, "", http.Cookie{})
cb = values[i] + randInt()
if h := req.Header.Get(header); h != "" {
msg := fmt.Sprintf("Overwriting %s:%s with %s:%s\n", header, h, header, cb)
Print(msg, NoColor)
}
req.Header.Set(header, cb)
waitLimiter(errorString)
secondUnix := time.Now().Unix()
timeDiff := secondUnix - firstUnix
// make sure that there is at least 2 sec difference.
// So that first req has Age=0 and second req has Age>=2
if timeDiff <= 1 && strings.EqualFold("age", cache.Indicator) {
time.Sleep(2 * time.Second)
}
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
defer resp.Body.Close()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
indicValue = strings.TrimSpace(strings.ToLower(resp.Header.Get(cache.Indicator)))
if checkCacheHit(indicValue, cache.Indicator) {
// If there is a hit, the cachebuster didn't work
msg := fmt.Sprintf("%s was not successful (Header)\n", identifier)
PrintVerbose(msg, NoColor, 2)
cbNotFoundDifference(times, identifier)
} else {
cache.CBwasFound = true
cache.CBisHeader = true
cache.CBisCookie = false
cache.CBisHTTPMethod = false
cache.CBisParameter = false
cache.CBName = header
cb_header = true
addCachebusterMap("header_" + header)
msg := fmt.Sprintf("%s was successful (Header)\n", identifier)
Print(msg, Cyan)
cbFoundDifference(times, identifier)
continue
}
}
}
}
return errSlice
}
func cachebusterParameter(cache *CacheStruct) error {
errorString := "cachebusterParameter"
identifier := "Parameter " + Config.CacheBuster + " as Cachebuster"
var req *http.Request
var err error
var times []int64
if cache.Indicator == "" {
// No Cache Indicator was found. So time will be used as Indicator
if Config.SkipTimebased {
return nil
}
var urlCb string
for i := 0; i < 5*2; i++ {
if i%2 == 0 {
urlCb, _ = addCachebusterParameter(Config.Website.Url.String(), "")
}
if Config.DoPost {
req, err = http.NewRequest("POST", urlCb, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", urlCb, nil)
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
return errors.New(msg)
}
setRequest(req, Config.DoPost, "", http.Cookie{})
waitLimiter(errorString)
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
return errors.New(msg)
}
defer resp.Body.Close()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
}
msg := fmt.Sprintf("measured times: %d\n", times)
PrintVerbose(msg, NoColor, 2)
for i := range times {
// Cache miss has to take 30ms (misshitdif) longer than cache hit
if i%2 == 1 && times[i-1]-times[i] < int64(Config.HMDiff) {
msg := fmt.Sprintf("%s was not successful (Parameter)\n", identifier)
PrintVerbose(msg, NoColor, 2)
return nil
}
}
cache.TimeIndicator = true
cache.CBwasFound = true
cache.CBisParameter = true
cache.CBisHeader = false
cache.CBisCookie = false
cache.CBisHTTPMethod = false
cache.CBName = Config.CacheBuster
cb_parameter = true
addHitMissIndicatorMap("time")
addCachebusterMap(Config.CacheBuster)
msg = fmt.Sprintf("%s was successful (Parameter, time was used as indicator)\n", identifier)
Print(msg, Cyan)
} else {
// A hit miss Indicator was found. Sending 2 requests, each with a new cachebuster, expecting 2 misses
urlCb, _ := addCachebusterParameter(Config.Website.Url.String(), "")
if Config.DoPost {
req, err = http.NewRequest("POST", urlCb, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", urlCb, nil)
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
return errors.New(msg)
}
setRequest(req, Config.DoPost, "", http.Cookie{})
waitLimiter(errorString)
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
return errors.New(msg)
}
defer resp.Body.Close()
firstUnix := time.Now().Unix()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
indicValue := strings.TrimSpace(strings.ToLower(resp.Header.Get(cache.Indicator)))
if checkCacheHit(indicValue, cache.Indicator) {
// If there is a hit, the cachebuster didn't work
msg := fmt.Sprintf("%s was not successful (Parameter)\n", identifier)
PrintVerbose(msg, NoColor, 2)
} else {
urlCb, _ := addCachebusterParameter(Config.Website.Url.String(), "")
if Config.DoPost {
req, err = http.NewRequest("POST", urlCb, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", urlCb, nil)
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
return errors.New(msg)
}
setRequest(req, Config.DoPost, "", http.Cookie{})
waitLimiter(errorString)
secondUnix := time.Now().Unix()
timeDiff := secondUnix - firstUnix
// make sure that there is at least 2 sec difference.
// So that first req has Age=0 and second req has Age>=2
if timeDiff <= 1 && strings.EqualFold("age", cache.Indicator) {
time.Sleep(2 * time.Second)
}
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
return errors.New(msg)
}
defer resp.Body.Close()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
indicValue = strings.TrimSpace(strings.ToLower(resp.Header.Get(cache.Indicator)))
if checkCacheHit(indicValue, cache.Indicator) {
// If there is a hit, the cachebuster didn't work
msg := fmt.Sprintf("%s was not successful (Parameter)\n", identifier)
PrintVerbose(msg, NoColor, 2)
cbNotFoundDifference(times, identifier)
} else {
cache.CBwasFound = true
cache.CBisParameter = true
cache.CBisHeader = false
cache.CBisCookie = false
cache.CBisHTTPMethod = false
cache.CBName = Config.CacheBuster
cb_parameter = true
addCachebusterMap(Config.CacheBuster)
msg := fmt.Sprintf("%s was successful (Parameter)\n", identifier)
Print(msg, Cyan)
cbFoundDifference(times, identifier)
}
}
}
return nil
}
func cachebusterHTTPMethod(cache *CacheStruct) []error {
http_methods := []string{"PURGE", "FASTLYPURGE"}
var errSlice []error
for _, method := range http_methods {
errorString := "cachebusterHTTPMethod " + method
identifier := "HTTP Method " + method + " as Cachebuster"
var req *http.Request
var err error
var times []int64
if cache.Indicator == "" {
// No Cache Indicator was found. So time will be used as Indicator
if Config.SkipTimebased {
continue
}
skip := false
for ii := 0; ii < 5*2; ii++ {
weburl := Config.Website.Url.String()
if ii%2 == 0 {
req, err = http.NewRequest(method, weburl, nil)
} else {
if Config.DoPost {
req, err = http.NewRequest("POST", weburl, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", weburl, nil)
}
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
setRequest(req, Config.DoPost, "", http.Cookie{})
waitLimiter(errorString)
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
defer resp.Body.Close()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
if resp.StatusCode >= 400 {
skip = true
break
}
}
if skip {
continue
}
msg := fmt.Sprintf("measured times: %d\n", times)
PrintVerbose(msg, NoColor, 2)
skip = false
for ii := range times {
// Cache miss has to take 30ms (misshitdif) longer than cache hit
if ii%2 == 1 && times[ii-1]-times[ii] < int64(Config.HMDiff) {
msg := fmt.Sprintf("%s was not successful (HTTP Method)\n", identifier)
PrintVerbose(msg, NoColor, 2)
skip = true
break
}
}
if skip {
continue
}
cache.TimeIndicator = true
cache.CBwasFound = true
cache.CBisHTTPMethod = true
cache.CBisParameter = false
cache.CBisHeader = false
cache.CBisCookie = false
cache.CBName = method
cb_method = true
addHitMissIndicatorMap("time")
addCachebusterMap("method_" + method)
msg = fmt.Sprintf("%s was successful (HTTP Method, time was used as indicator)\n", identifier)
Print(msg, Cyan)
continue
} else {
// A hit miss Indicator was found. Sending 2 requests, each with a new cachebuster, expecting 2 misses
weburl := Config.Website.Url.String()
req, err = http.NewRequest(method, weburl, bytes.NewBufferString(Config.Body))
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
setRequest(req, Config.DoPost, "", http.Cookie{})
waitLimiter(errorString)
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
defer resp.Body.Close()
firstUnix := time.Now().Unix()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
if resp.StatusCode >= 400 {
continue
}
indicValue := strings.TrimSpace(strings.ToLower(resp.Header.Get(cache.Indicator)))
if checkCacheHit(indicValue, cache.Indicator) {
// If there is a hit, the cachebuster didn't work
msg := fmt.Sprintf("%s was not successful (HTTP Method)\n", identifier)
PrintVerbose(msg, NoColor, 2)
} else {
req, err = http.NewRequest(method, weburl, bytes.NewBufferString(Config.Body))
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
setRequest(req, Config.DoPost, "", http.Cookie{})
waitLimiter(errorString)
secondUnix := time.Now().Unix()
timeDiff := secondUnix - firstUnix
// make sure that there is at least 2 sec difference.
// So that first req has Age=0 and second req has Age>=2
if timeDiff <= 1 && strings.EqualFold("age", cache.Indicator) {
time.Sleep(2 * time.Second)
}
start := time.Now()
resp, err := http.DefaultClient.Do(req)
elapsed := time.Since(start).Milliseconds()
times = append(times, elapsed)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error())
Print(msg+"\n", Red)
errSlice = append(errSlice, errors.New(msg))
continue
}
defer resp.Body.Close()
if resp.StatusCode != Config.Website.StatusCode {
msg := fmt.Sprintf("%s: Unexpected Status Code: %d\n", errorString, resp.StatusCode)
Print(msg, Yellow)
}
if resp.StatusCode >= 400 {
continue
}
indicValue = strings.TrimSpace(strings.ToLower(resp.Header.Get(cache.Indicator)))
if checkCacheHit(indicValue, cache.Indicator) {
// If there is a hit, the cachebuster didn't work
msg := fmt.Sprintf("%s was not successful (HTTP Method)\n", identifier)
PrintVerbose(msg, NoColor, 2)
cbNotFoundDifference(times, identifier)
} else {
cache.CBwasFound = true
cache.CBisHTTPMethod = true
cache.CBisParameter = false
cache.CBisHeader = false
cache.CBisCookie = false
cache.CBName = method
cb_method = true
addCachebusterMap("method_" + method)
msg := fmt.Sprintf("%s was successful (HTTP Method)\n", identifier)
Print(msg, Cyan)
cbFoundDifference(times, identifier)
continue
}
}
}
}
return errSlice
}
/* Simple get request to get the body of a normal response and the cookies */
func GetWebsite(requrl string, setStatusCode bool, cacheBuster bool) (WebsiteStruct, error) {
errorString := "GetWebsite"
var web WebsiteStruct
cache := Config.Website.Cache
queryParameterMap := make(map[string]string)
// get domain
domainParts := strings.SplitN(requrl, "/", 4)
domain := domainParts[0] + "//" + domainParts[2]
// splitting url like {https://www.m10x.de/}?{name=max&role=admin}
urlSlice := strings.SplitN(requrl, "?", 2)
// splitting queries like {name=max}&{role=admin}
var parameterSlice []string
if strings.Contains(requrl, "?") {
parameterSlice = strings.Split(urlSlice[1], Config.QuerySeparator)
}
if len(parameterSlice) > 0 {
queryParameterMap = setQueryParameterMap(queryParameterMap, parameterSlice)
}
if len(Config.Parameters) > 0 {
queryParameterMap = setQueryParameterMap(queryParameterMap, Config.Parameters)
}
requrl = urlSlice[0]
urlNoQueries := urlSlice[0]
// adding query parameter
for key, val := range queryParameterMap {
if !strings.Contains(requrl, "?") {
requrl += "?"
} else {
requrl += Config.QuerySeparator
}
requrl += key + "=" + val
}
cb := ""
if cacheBuster {
cb = randInt()
}
var req *http.Request
var err error
if Config.Website.Cache.CBisHTTPMethod {
req, err = http.NewRequest(Config.Website.Cache.CBName, requrl, bytes.NewBufferString(Config.Body))
} else if Config.DoPost {
req, err = http.NewRequest("POST", requrl, bytes.NewBufferString(Config.Body))
} else {
req, err = http.NewRequest("GET", requrl, nil)
}
if err != nil {
msg := fmt.Sprintf("%s: http.NewRequest: %s", errorString, err.Error())
Print(msg+"\n", Red)
return web, errors.New(msg)
}
setRequest(req, Config.DoPost, cb, http.Cookie{})
waitLimiter(errorString)
resp, err := http.DefaultClient.Do(req)
if err != nil {
msg := fmt.Sprintf("%s: http.DefaultClient.Do: %s", errorString, err.Error()) // Error: context deadline exceeded -> panic; runtime error
Print(msg+"\n", Red)
return web, errors.New(msg)
}
defer resp.Body.Close()
body, err := io.ReadAll(resp.Body)
if err != nil {
msg := fmt.Sprintf("%s: ioutil.ReadAll: %s", errorString, err.Error())
Print(msg+"\n", Red)
return web, errors.New(msg)
}
weburl, err := url.Parse(requrl)
if err != nil {
msg := fmt.Sprintf("%s: url.Parse: %s", errorString, err.Error())
Print(msg+"\n", Red)
return web, errors.New(msg)
}
tempStatusCode := Config.Website.StatusCode
// Only overwrite statuscode if 1. it wasn't set via flag 2. its the first and only request or the second of two requests
if setStatusCode && tempStatusCode != resp.StatusCode {
tempStatusCode = resp.StatusCode
cache = Config.Website.Cache
msg := fmt.Sprintf("The default status code was set to %d\n", tempStatusCode)
Print(msg, Cyan)
}
// if retrieveCookies is false, only the specified cookies will be used
// otherwise the by the server given cookies AND the specified cookies will be used
cookiesWebsite := Config.Website.Cookies
if !Config.DeclineCookies {
cookiesWebsite = append(cookiesWebsite, resp.Cookies()...)
}
/*
weburl.Host: www.example.com
weburl.Path: /
weburl.Hostname():www.example.com
weburl.String(): https://www.example.com/?test=12
domain: https://www.example.com
urlNoQueries: https://www.example.com/
*/
web = WebsiteStruct{
Headers: resp.Header,
Body: string(body),
Cookies: cookiesWebsite,
StatusCode: tempStatusCode,
Url: weburl,
UrlWOQueries: urlNoQueries,
Queries: queryParameterMap,
Cache: cache,
Domain: domain,
//make map doesnt work here. is now in main method
//Added: make(map[string]bool),
}
return web, nil
}
func setQueryParameterMap(queryParameterMap map[string]string, querySlice []string) map[string]string {
for _, q := range querySlice {
q = strings.TrimSuffix(q, "\r")
q = strings.TrimSpace(q)
if q == "" {
continue
} else if !strings.Contains(q, "=") {
msg := fmt.Sprintf("Specified parameter %s doesn't contain a = and will be skipped\n", q)
Print(msg, Yellow)
continue
} else {
query := strings.SplitN(q, "=", 2)
// ok is true, if a query already is set
val, ok := queryParameterMap[query[0]]
if ok {
msg := fmt.Sprintf("Overwriting %s=%s with %s=%s\n", query[0], val, query[0], query[1])
Print(msg, NoColor)
}
queryParameterMap[query[0]] = query[1]
}
}
return queryParameterMap
}
func addDomain(x string, domain string) string {
if strings.HasPrefix(x, "#") || strings.HasPrefix(x, "mailto:") {
return ""
}
if strings.HasPrefix(x, "https://"+domain) || strings.HasPrefix(x, "http://"+domain) {
return x
} else if strings.HasPrefix(x, "//") {
return Config.Website.Domain + x[1:]
} else if !strings.HasPrefix(x, "http://") && !strings.HasPrefix(x, "https://") {
if strings.HasPrefix(x, "/") {
return Config.Website.Domain + x
}
return Config.Website.Domain + "/" + x
} else {
for i, d := range Config.RecDomains {
if Config.RecDomains[i] == "" {
continue
}
if strings.HasPrefix(x, "https://"+d) || strings.HasPrefix(x, "http://"+d) {
return x
}
}
msg := fmt.Sprintf("%s doesn't have %s as domain\n", x, domain)
PrintVerbose(msg, NoColor, 1)
return ""
}
}
func checkRecInclude(x string, recInclude string) bool {
for _, inc := range strings.Split(recInclude, " ") {
// remove spaces and skip if someone used multiple spaces instead of one
if inc == "" {
continue
}
if strings.Contains(x, inc) {
return true
}
}
return false
}
func addUrl(urls []string, url string, added map[string]bool, excluded map[string]bool) []string {
url = addDomain(url, Config.Website.Url.Hostname())
if url != "" {
// Check if url isnt added yet and if it satisfies RecInclude (=contains it)
if excluded[url] {
msg := fmt.Sprintf("Skipped to add %s to the queue, because it is on the exclude list\n", url)
PrintVerbose(msg, NoColor, 1)
} else if added[url] {
msg := fmt.Sprintf("Skipped to add %s to the queue, because it was already added\n", url)
PrintVerbose(msg, NoColor, 2)
} else if Config.RecInclude == "" || checkRecInclude(url, Config.RecInclude) {
urls = append(urls, url)
added[url] = true
} else {
msg := fmt.Sprintf("Skipped to add %s to the queue, because it doesn't satisfy RecInclude\n", url)
PrintVerbose(msg, NoColor, 1)
}
}
return urls
}
func CrawlUrls(added map[string]bool, excluded map[string]bool) []string {
bodyReader := strings.NewReader(Config.Website.Body)
tokenizer := html.NewTokenizer(bodyReader)
var urls []string
eof := false
for !eof {
tokentype := tokenizer.Next()
switch tokentype {
case html.StartTagToken, html.SelfClosingTagToken:
token := tokenizer.Token()
if token.Data == "a" || token.Data == "link" {
for _, a := range token.Attr {
if a.Key == "href" {
urls = addUrl(urls, a.Val, added, excluded)
break
}
}
} else if token.Data == "script" {
for _, a := range token.Attr {
if a.Key == "src" {
urls = addUrl(urls, a.Val, added, excluded)
break
}
}
}
// When EOF is reached a html.ErrorToken appears
case html.ErrorToken:
err := tokenizer.Err()
if err == io.EOF {
eof = true
break
}
msg := fmt.Sprintf("error tokenizing HTML: %+v", tokenizer.Err())
Print(msg, Yellow)
}
}
if h := Config.Website.Headers.Get("Location"); h != "" {
urls = addUrl(urls, h, added, excluded)
}
return urls
}
Web-Cache-Vulnerability-Scanner-1.3.3/pkg/report.go 0000664 0000000 0000000 00000005136 14732751445 0022116 0 ustar 00root root 0000000 0000000 package pkg
import (
"bytes"
"encoding/json"
"fmt"
"os"
)
type (
reportResult struct {
Technique string `json:"technique"`
HasError bool `json:"hasError"`
ErrorMessages []string `json:"errorMessages"`
Vulnerable bool `json:"isVulnerable"`
Requests []reportRequest `json:"requests"`
}
reportRequest struct {
URL string `json:"-"`
Reason string `json:"reason"`
CurlCommand string `json:"curlCommand"`
Request string `json:"request"`
Response string `json:"response"`
}
reportSettings struct {
ReportPath string `json:"-"`
IndentPrefix string `json:"-"`
IndentSuffix string `json:"-"`
}
ReportWebsite struct {
URL string `json:"url"`
Vulnerable bool `json:"isVulnerable"`
HasError bool `json:"hasError"`
ErrorMessages []string `json:"errorMessages"`
Results []reportResult `json:"results"`
}
Report struct {
Settings reportSettings `json:"-"`
Name string `json:"name"`
Version string `json:"version"`
Vulnerable bool `json:"foundVulnerabilities"`
HasError bool `json:"hasError"`
ErrorMessages []string `json:"errorMessages"`
Date string `json:"date"`
Duration string `json:"duration"`
Command string `json:"command"`
Config *ConfigStruct `json:"config,omitempty"`
Websites []ReportWebsite `json:"websites"`
}
)
func init() {
}
func GenerateReport(report Report, currentDate string) {
reportPath := Config.GeneratePath + currentDate + "_WCVS_Report.json"
var file *os.File
defer file.Close()
file, err := os.OpenFile(reportPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0666)
if err != nil {
msg := fmt.Sprintf("GenerateReport: os.OpenFile: %s\n", err.Error())
PrintFatal(msg)
}
report.Settings.IndentPrefix = ""
report.Settings.IndentSuffix = " "
if Config.EscapeJSON {
j, err := json.MarshalIndent(report, report.Settings.IndentPrefix, report.Settings.IndentSuffix)
if err != nil {
msg := fmt.Sprintf("Generator: json.MarshalIndent: %s\n", err.Error())
PrintFatal(msg)
}
file.WriteString(string(j))
} else {
bf := bytes.NewBuffer([]byte{})
jsonEncoder := json.NewEncoder(bf)
jsonEncoder.SetEscapeHTML(false)
jsonEncoder.SetIndent(report.Settings.IndentPrefix, report.Settings.IndentSuffix)
jsonEncoder.Encode(report)
file.WriteString(bf.String())
}
msg := fmt.Sprintf("Exported report %s\n", reportPath)
PrintVerbose(msg, NoColor, 1)
report.Settings.ReportPath = reportPath
}
Web-Cache-Vulnerability-Scanner-1.3.3/pkg/request_smuggling.go 0000664 0000000 0000000 00000022170 14732751445 0024344 0 ustar 00root root 0000000 0000000 package pkg
import (
"bufio"
"crypto/tls"
"fmt"
"net"
"net/url"
"strings"
"time"
"golang.org/x/net/proxy"
)
func init() {
}
func GenerateHeaderString() string {
headers := ""
userAgent := useragent
cache := Config.Website.Cache
for i, c := range Config.Website.Cookies {
if i == 0 {
headers += "Cookie: "
} else {
headers += "; "
}
valToAdd := c.Value
if cache.CBisCookie && c.Name == cache.CBName {
valToAdd = randInt()
}
headers += c.Name + "=" + valToAdd
}
if headers != "" {
headers += "\r\n"
}
headerSlice := Config.Headers
if cache.CBisHeader {
headerSlice = append(headerSlice, cache.CBName+": "+randInt())
}
for i, h := range headerSlice {
h = strings.TrimSuffix(h, "\r")
h = strings.TrimSpace(h)
if h == "" {
continue
} else if !strings.Contains(h, ":") {
msg := "Specified header" + h + "doesn't contain a : and will be skipped"
Print(msg, NoColor)
continue
} else {
hSplitted := strings.SplitN(h, ":", 2)
hSplitted[0] = strings.TrimSpace(hSplitted[0])
hSplitted[1] = strings.TrimSpace(hSplitted[1])
// Only add header that has the same name as the cachebuster header, if it is the last header of the slice
if cache.CBisHeader && strings.EqualFold(hSplitted[0], cache.CBName) && i+1 != len(headerSlice) {
continue
}
headers += h + "\r\n"
if strings.EqualFold(hSplitted[0], "User-Agent") {
userAgent = hSplitted[1]
}
}
}
// if its the same, the useragent wasnt added yet
if userAgent == useragent {
headers += "User-Agent: " + useragent + "\r\n"
}
return headers
}
/* Run clte before tecl. Dont test for tecl if clte already works! */
func clte(path string, headers string) string {
httpMethod := "POST"
if Config.Website.Cache.CBisHTTPMethod {
httpMethod = Config.Website.Cache.CBName
}
payload := fmt.Sprintf(""+
"%s %s HTTP/1.1\r\n"+ // POST /about HTTP/1.1
"Host: %s\r\n"+ // Host: example.com
"%s"+ // *Additional Headers generated*
"Transfer-Encoding: chunked\r\n"+ // Transfer-Encoding: chunked
"Content-Length: 4\r\n"+ // Content-Length: 4
"\r\n"+ //
"1\r\n"+ // 1
"Z\r\n"+ // Z
"Q"+ // Q
"", httpMethod, path, Config.Website.Url.Host, headers)
return payload
}
func tecl(path string, headers string) string {
httpMethod := "POST"
if Config.Website.Cache.CBisHTTPMethod {
httpMethod = Config.Website.Cache.CBName
}
payload := fmt.Sprintf(""+
"%s %s HTTP/1.1\r\n"+ // POST /about HTTP/1.1
"Host: %s\r\n"+ // Host: example.com
"%s"+ // *Additional Headers generated*
"Transfer-Encoding: chunked\r\n"+ // Transfer-Encoding: chunked
"Content-Length: 6\r\n"+ // Content-Length: 6
"\r\n"+ //
"0\r\n"+ // 0
"\r\n"+ //
"X"+ // X
"", httpMethod, path, Config.Website.Url.Host, headers)
return payload
}
func clcl(path string, headers string) string {
httpMethod := "POST"
if Config.Website.Cache.CBisHTTPMethod {
httpMethod = Config.Website.Cache.CBName
}
payload := fmt.Sprintf(""+
"%s %s HTTP/1.1\r\n"+ // POST /about HTTP/1.1
"Host: %s\r\n"+ // Host: example.com
"%s"+ // *Additional Headers generated*
"Content-Length: 10\r\n"+ // Content-Length: 10
"Content-Length: 11\r\n"+ // Content-Length: 11
"\r\n"+ //
"M\r\n"+ // M
"1\r\n"+ // 1
"0\r\n"+ // 0
"X"+ // X
"", httpMethod, path, Config.Website.Url.Host, headers)
return payload
}
func clcl2(path string, headers string) string {
httpMethod := "POST"
if Config.Website.Cache.CBisHTTPMethod {
httpMethod = Config.Website.Cache.CBName
}
payload := fmt.Sprintf(""+
"%s %s HTTP/1.1\r\n"+ // POST /about HTTP/1.1
"Host: %s\r\n"+ // Host: example.com
"%s"+ // *Additional Headers generated*
"Content-Length: 6\r\n"+ // Content-Length: 11
"Content-Length: 4\r\n"+ // Content-Length: 10
"\r\n"+ //
"M\r\n"+ // M
"1\r\n"+ // 1
"0\r\n"+ // 0
"X"+ // X
"", httpMethod, path, Config.Website.Url.Host, headers)
return payload
}
func httpRequestSmuggling(req string, result *reportResult, proxyUrl *url.URL) {
/*
dialer, err := proxy.SOCKS5("tcp", strings.TrimPrefix(Config.ProxyURL, "http://"), nil, nil)
if err != nil {
PrintFatal(err.Error())
}
Print("ads", NoColor)*/
errorString := "httpRequestSmuggling"
httpsUsed := false
proxyUsed := false
address := Config.Website.Domain
address = strings.TrimSuffix(address, "/")
if strings.HasPrefix(address, "https://") {
httpsUsed = true
address = strings.TrimPrefix(address, "https://")
if !strings.Contains(address, ":") {
address += ":443"
}
} else if strings.HasPrefix(address, "http://") {
address = strings.TrimPrefix(address, "http://")
if !strings.Contains(address, ":") {
address += ":80"
}
} else {
msg := "Request Smuggling: " + address + " doesn't has http:// or https:// as prefix\n"
Print(msg, Yellow)
result.HasError = true
result.ErrorMessages = append(result.ErrorMessages, msg)
return
}
if Config.ProxyCertPath != "" {
//proxyUsed = true
proxyUsed = false
}
timeOutCount := 0
for i := 0; i < 3; i++ {
var err error
var connS *tls.Conn
var conn net.Conn
var resp string
var msg string
waitLimiter(fmt.Sprintf("%s %d", errorString, i))
if proxyUsed {
dialerP, err := proxy.FromURL(proxyUrl, proxy.Direct)
/*dialerP, err := proxy.SOCKS5("tcp", proxyUrl.Host, nil, &net.Dialer{
Timeout: 15 * time.Second,
KeepAlive: 15 * time.Second,
})*/
if err != nil {
msg = fmt.Sprintf("%s: proxy.FromURL: %s", errorString, err.Error())
Print(msg+"\n", Red)
result.HasError = true
result.ErrorMessages = append(result.ErrorMessages, msg)
return
}
conn, err = dialerP.Dial("tcp", address)
if err != nil {
msg = fmt.Sprintf("%s: dialerP.Dial: %s", errorString, err.Error())
Print(msg+"\n", Red)
result.HasError = true
result.ErrorMessages = append(result.ErrorMessages, msg)
}
} else if httpsUsed {
/* Das hat teilweise zu Errorn geführt ohne InsecureSkipVerify
if tlsConfig == nil {
tlsConfig = new(tls.Config)
}
*/
tlsConfig := &tls.Config{
InsecureSkipVerify: true,
}
connS, err = tls.Dial("tcp", address, tlsConfig)
if err != nil {
msg = fmt.Sprintf("%s: tls.Dial: %s", errorString, err.Error())
Print(msg+"\n", Red)
result.HasError = true
result.ErrorMessages = append(result.ErrorMessages, msg)
return
}
} else {
dialer := net.Dialer{Timeout: time.Duration(Config.TimeOut) * time.Second}
conn, err = dialer.Dial("tcp", address)
if err != nil {
msg = fmt.Sprintf("%s: dialerP.Dial: %s", errorString, err.Error())
Print(msg+"\n", Red)
result.HasError = true
result.ErrorMessages = append(result.ErrorMessages, msg)
return
}
}
err = nil
if proxyUsed {
defer conn.Close()
fmt.Fprint(conn, req)
conn.SetReadDeadline(time.Now().Add(time.Duration(Config.TimeOut) * time.Second))
resp, err = bufio.NewReader(conn).ReadString('\n')
} else if httpsUsed {
defer connS.Close()
fmt.Fprint(connS, req)
connS.SetReadDeadline(time.Now().Add(time.Duration(Config.TimeOut) * time.Second))
resp, err = bufio.NewReader(connS).ReadString('\n')
} else {
defer conn.Close()
fmt.Fprint(conn, req)
conn.SetReadDeadline(time.Now().Add(time.Duration(Config.TimeOut) * time.Second))
resp, err = bufio.NewReader(conn).ReadString('\n')
}
if err != nil {
msg = fmt.Sprintf("%s: bufio.NewReader.ReadString: %s", errorString, err.Error())
Print(msg+"\n", Yellow)
// Time out error is same for TLS and Conn. Both use net.Error.Timeout
nerr, _ := err.(net.Error)
if nerr != nil && nerr.Timeout() {
timeOutCount++
msg = fmt.Sprintf("(%d/3) timeouts to confirm Request Smuggling\n", i+1)
Print(msg, Yellow)
//TODO: Wenn timeout, dann noch ein normales request senden, welches nicht auch timeouten darf?
} else {
msg = "Aborting test because of: " + err.Error() + "\n"
Print(msg, Yellow)
result.HasError = true
result.ErrorMessages = append(result.ErrorMessages, msg)
return
}
} else {
// When there isn't a timout this means that the Request Smuggling technique wasn't successful!
// TODO: Print entfernen!
if strings.Contains(resp, "500") {
reason := "Server returned 500 Internal Server Error. It *may* be vulnerable to this Request Smuggling technique."
fillRequest(result, reason, req, Config.Website.Url.String())
msg = "Response:" + resp + reason + "\n"
Print(msg, Green)
} else {
msg = "Response:" + resp + "Request didn't time out and therefore *likely* isn't vulnerable to this Request Smuggling technique.\n"
PrintVerbose(msg, NoColor, 2)
}
return
}
}
if timeOutCount == 3 {
msg := "The request timed out 3 times in a row. It *may* be vulnerable to this Request Smuggling technique."
fillRequest(result, msg, req, Config.Website.Url.String())
Print(msg+"\n", Green)
}
}
func fillRequest(result *reportResult, reason string, req string, reqURL string) {
result.Vulnerable = true
var request reportRequest
request.Reason = reason
request.Request = req
request.URL = reqURL
result.Requests = append(result.Requests, request)
}
Web-Cache-Vulnerability-Scanner-1.3.3/pkg/requests.go 0000664 0000000 0000000 00000032364 14732751445 0022461 0 ustar 00root root 0000000 0000000 package pkg
import (
"bytes"
"errors"
"fmt"
"io"
"net/http"
"net/http/httputil"
"strconv"
"strings"
"sync"
"moul.io/http2curl"
)
const (
respSplitHeader = "Web_Cache"
respSplitValue = "Vulnerability_Scanner"
)
type requestParams struct {
repResult *reportResult
headers []string
values []string
parameters []string
//cookie oldCookie
identifier string
poison string
url string
cb string
success string
bodyString string
forcePost bool
duplicateHeaders bool
newCookie http.Cookie
m *sync.Mutex
}
/*type oldCookie struct {
position int
oldValue string
}*/
func init() {
}
func getRespSplit() string {
return "\\r\\n" + respSplitHeader + ": " + respSplitValue
}
func checkPoisoningIndicators(repResult *reportResult, request reportRequest, success string, body string, poison string, statusCode1 int, statusCode2 int, sameBodyLength bool, header http.Header, recursive bool) string {
headerWithPoison := ""
if header != nil && poison != "" {
for x := range header {
if x == respSplitHeader && header.Get(x) == respSplitValue {
request.Reason = "HTTP Response Splitting"
}
if strings.Contains(header.Get(x), poison) {
headerWithPoison = x
}
}
}
if request.Reason == "" {
if poison != "" && strings.Contains(body, poison) {
request.Reason = "Response Body contained " + poison
} else if headerWithPoison != "" {
request.Reason = fmt.Sprintf("%s header contains poison value %s", headerWithPoison, poison)
} else if statusCode1 >= 0 && statusCode1 != Config.Website.StatusCode && statusCode1 == statusCode2 {
// check if status code should be ignored
if len(Config.IgnoreStatus) > 0 {
for _, status := range Config.IgnoreStatus {
if statusCode1 == status || Config.Website.StatusCode == status {
PrintVerbose("Skipped Status Code "+strconv.Itoa(status)+"\n", Cyan, 1)
_, err := GetWebsite(Config.Website.Url.String(), true, true)
if err != nil {
Print(fmt.Sprintln("Error while checking whether the default status code changed: ", err.Error()), Yellow)
}
return headerWithPoison
}
}
}
if !recursive {
var tmpWebsite WebsiteStruct
var err error
// try up to 3 times
count := 3
for i := 0; i < count; i++ {
Print(fmt.Sprintln("Status Code", statusCode1, "differed from the default", Config.Website.StatusCode, ", sending verification request", i+1, "from up to 3"), Yellow)
tmpWebsite, err = GetWebsite(Config.Website.Url.String(), true, true)
if err == nil {
Print(fmt.Sprintln("The verification request returned the Status Code", tmpWebsite.StatusCode), Yellow)
break
}
}
if err != nil {
repResult.HasError = true
msg := fmt.Sprintf("%s: couldn't verify if status code %d is the new default status code, because the verification encountered the following error %d times: %s", request.URL, statusCode1, count, err.Error())
repResult.ErrorMessages = append(repResult.ErrorMessages, msg)
} else {
Config.Website = tmpWebsite
}
return checkPoisoningIndicators(repResult, request, success, body, poison, statusCode1, statusCode2, sameBodyLength, header, true)
} else {
request.Reason = fmt.Sprintf("Status Code %d differed from %d", statusCode1, Config.Website.StatusCode)
}
} else if Config.CLDiff != 0 && success != "" && sameBodyLength && len(body) > 0 && compareLengths(len(body), len(Config.Website.Body), Config.CLDiff) {
if !recursive {
var tmpWebsite WebsiteStruct
var err error
// try up to 3 times
count := 3
for i := 0; i < count; i++ {
tmpWebsite, err = GetWebsite(Config.Website.Url.String(), true, true)
if err == nil {
break
}
}
if err != nil {
repResult.HasError = true
msg := fmt.Sprintf("%s: couldn't verify if body length %d is the new default body length, because the verification request encountered the following error %d times: %s", request.URL, statusCode1, count, err.Error())
repResult.ErrorMessages = append(repResult.ErrorMessages, msg)
} else {
Config.Website = tmpWebsite
}
return checkPoisoningIndicators(repResult, request, success, body, poison, statusCode1, statusCode2, sameBodyLength, header, true)
} else {
request.Reason = fmt.Sprintf("Length %d differed more than %d bytes from normal length %d", len(body), Config.CLDiff, len(Config.Website.Body))
}
} else {
return headerWithPoison
}
}
PrintNewLine()
Print(success, Green)
msg := "URL: " + request.URL + "\n"
Print(msg, Green)
msg = "Reason: " + request.Reason + "\n"
Print(msg, Green)
msg = "Curl: " + request.CurlCommand + "\n\n"
Print(msg, Green)
repResult.Vulnerable = true
repResult.Requests = append(repResult.Requests, request)
return headerWithPoison
}
func compareLengths(len1 int, len2 int, limit int) bool {
var diff int
if len1 >= len2 {
diff = len1 - len2
} else {
diff = len2 - len1
}
return diff > limit
}
/* Check if the second response makes sense or the continuation shall be stopped */
func stopContinuation(body []byte, statusCode int, headers http.Header) bool {
if string(body) != Config.Website.Body {
return false
} else if statusCode != Config.Website.StatusCode {
return false
} else if len(headers) != len(Config.Website.Headers) {
return false
}
for k, v := range headers {
v2 := Config.Website.Headers.Values(k)
// check if length of v and v2 is the same
if len(v) != len(v2) {
return false
}
}
return true
}
func addParameters(urlStr *string, parameters []string) {
for _, p := range parameters {
if p == "" {
continue
}
if !strings.Contains(*urlStr, "?") {
*urlStr += "?"
} else {
*urlStr += Config.QuerySeparator
}
*urlStr += p
}
}
func firstRequest(rp requestParams) ([]byte, int, reportRequest, http.Header, error) {
var req *http.Request
var resp *http.Response
var err error
var msg string
var body []byte
var repRequest reportRequest
if rp.headers == nil {
rp.headers = []string{""}
}
if rp.values == nil {
rp.values = []string{""}
}
if rp.parameters == nil {
rp.parameters = []string{""}
}
if rp.values[0] == "2ndrequest" {
rp.identifier = fmt.Sprintf("2nd request of %s", rp.identifier)
} else {
rp.identifier = fmt.Sprintf("1st request of %s", rp.identifier)
}
// check if headers and values have the same length
if len(rp.headers) != len(rp.values) && rp.values[0] != "2ndrequest" {
msg = fmt.Sprintf("%s: len(header) %s %d != len(value) %s %d\n", rp.identifier, rp.headers, len(rp.headers), rp.values, len(rp.values))
Print(msg, Red)
return body, -1, repRequest, nil, errors.New(msg)
}
addParameters(&rp.url, rp.parameters)
if !rp.forcePost && Config.Website.Cache.CBisHTTPMethod && rp.values[0] != "2ndrequest" {
req, err = http.NewRequest(Config.Website.Cache.CBName, rp.url, bytes.NewBufferString(rp.bodyString))
} else if Config.DoPost || rp.forcePost {
if rp.bodyString == "" {
rp.bodyString = Config.Body
}
req, err = http.NewRequest("POST", rp.url, bytes.NewBufferString(rp.bodyString))
} else if rp.bodyString != "" {
req, err = http.NewRequest("GET", rp.url, bytes.NewBufferString(rp.bodyString))
} else {
req, err = http.NewRequest("GET", rp.url, nil)
}
if err != nil {
msg = fmt.Sprintf("%s: http.NewRequest: %s\n", rp.identifier, err.Error())
Print(msg, Red)
return body, -1, repRequest, nil, errors.New(msg)
}
newClient := http.Client{
CheckRedirect: http.DefaultClient.CheckRedirect,
Timeout: http.DefaultClient.Timeout,
}
setRequest(req, Config.DoPost, rp.cb, rp.newCookie)
for i := range rp.headers {
if rp.headers[i] == "" {
continue
}
if rp.values[0] == "2ndrequest" {
msg = rp.identifier + "2nd request doesnt allow headers to be set\n"
Print(msg, Red)
break
}
if strings.EqualFold(rp.headers[i], "Host") && !rp.duplicateHeaders {
newHost := req.URL.Host + rp.values[i]
msg := fmt.Sprintf("Overwriting Host:%s with Host:%s\n", req.URL.Host, newHost)
PrintVerbose(msg, NoColor, 2)
req.Host = newHost
} else if rp.headers[i] != "" {
if h := req.Header.Get(rp.headers[i]); h != "" && !rp.duplicateHeaders {
msg := fmt.Sprintf("Overwriting %s:%s with %s:%s\n", rp.headers[i], h, rp.headers[i], rp.values[i])
PrintVerbose(msg, NoColor, 2)
// Directly writing to map doesn't uppercase header(for HTTP1)
req.Header[rp.headers[i]] = []string{rp.values[i]}
} else if h != "" && rp.duplicateHeaders {
// Directly writing to map doesn't uppercase the header(for HTTP1)
req.Header[rp.headers[i]] = []string{h, rp.values[i]}
} else {
// Directly writing to map doesn't uppercase the header(for HTTP1)
req.Header[rp.headers[i]] = []string{rp.values[i]}
}
}
}
waitLimiter(rp.identifier)
var dumpReqBytes []byte
var bodyBackup []byte
if req.Body != nil {
// Backup the request body, because it can only be read once
bodyBackup, err = io.ReadAll(req.Body)
if err != nil {
msg = fmt.Sprintf("%s: io.ReadAll: %s\n", rp.identifier, err.Error())
Print(msg, Red)
return body, -1, repRequest, nil, errors.New(msg)
}
// Restore the request body for the first use
req.Body = io.NopCloser(bytes.NewReader(bodyBackup))
// Dump the request including the body
dumpReqBytes, _ = httputil.DumpRequest(req, true)
} else {
// Dump the request without the body
dumpReqBytes, _ = httputil.DumpRequest(req, false)
}
repRequest.Request = string(dumpReqBytes)
// Do request
resp, err = newClient.Do(req)
if err != nil {
msg = fmt.Sprintf("%s: newClient.Do: %s\n", rp.identifier, err.Error())
Print(msg, Red)
return body, -1, repRequest, nil, errors.New(msg)
} else {
defer resp.Body.Close()
body, err = io.ReadAll(resp.Body)
if err != nil {
msg = fmt.Sprintf("%s: io.ReadAll: %s\n", rp.identifier, err.Error())
Print(msg, Red)
return body, -1, repRequest, nil, errors.New(msg)
}
if resp.StatusCode != Config.Website.StatusCode {
msg = fmt.Sprintf("Unexpected Status Code %d for %s\n", resp.StatusCode, rp.identifier)
Print(msg, Yellow)
}
}
if stopContinuation(body, resp.StatusCode, resp.Header.Clone()) {
msg := "stop"
return body, -1, repRequest, nil, errors.New(msg)
}
// Add the request as curl command to the report
command, err := http2curl.GetCurlCommand(req)
if err != nil {
PrintVerbose("Error: firstRequest: "+err.Error()+"\n", Yellow, 1)
}
commandFixed := strings.Replace(command.String(), "-d ''", "-d '"+string(bodyBackup)+"'", 1)
if !strings.Contains(rp.url, req.Host) {
commandFixed = strings.Replace(commandFixed, "'http", "-H 'Host: "+req.Host+"' 'http", 1)
}
repRequest.CurlCommand = commandFixed
PrintVerbose("Curl command: "+repRequest.CurlCommand+"\n", NoColor, 2)
responseBytes, _ := httputil.DumpResponse(resp, true)
repRequest.Response = string(responseBytes)
repRequest.URL = req.URL.String()
//TODO: Also use dumped request/response of 2nd request
return body, resp.StatusCode, repRequest, resp.Header.Clone(), nil
}
func secondRequest(rUrl string, identifier string, cb string) ([]byte, int, http.Header, error) {
rp := requestParams{
values: []string{"2ndrequest"},
identifier: identifier,
url: rUrl,
cb: cb,
}
body, statusCode, _, header, err := firstRequest(rp)
return body, statusCode, header, err
}
// TODO: ResponseSplitting Methode
/* return value:first bool is needed for responsesplitting, second bool is only needed for ScanParameters */
func issueRequest(rp requestParams) (string, bool) {
body1, statusCode1, request, header1, err := firstRequest(rp)
if err != nil {
if err.Error() != "stop" {
if rp.m != nil {
rp.m.Lock()
defer rp.m.Unlock()
}
rp.repResult.HasError = true
rp.repResult.ErrorMessages = append(rp.repResult.ErrorMessages, err.Error())
}
return "", false
}
firstRequestPoisoningIndicator(rp.identifier, body1, rp.poison, header1)
body2, statusCode2, respHeader, err := secondRequest(rp.url, rp.identifier, rp.cb)
if err != nil {
if err.Error() != "stop" {
if rp.m != nil {
rp.m.Lock()
defer rp.m.Unlock()
}
rp.repResult.HasError = true
rp.repResult.ErrorMessages = append(rp.repResult.ErrorMessages, err.Error())
}
return "", true
}
sameBodyLength := len(body1) == len(body2)
// Lock here, to prevent false positives and too many GetWebsite requests
if rp.m != nil {
rp.m.Lock()
defer rp.m.Unlock()
}
responseSplittingHeader := checkPoisoningIndicators(rp.repResult, request, rp.success, string(body2), rp.poison, statusCode1, statusCode2, sameBodyLength, respHeader, false)
return responseSplittingHeader, true
}
func firstRequestPoisoningIndicator(identifier string, body []byte, poison string, header http.Header) {
var reason string
if poison != "" && strings.Contains(string(body), poison) {
reason = "Response Body contained " + poison
}
if header != nil && poison != "" {
for x := range header {
if strings.Contains(header.Get(x), poison) {
reason = "Response Body contained " + poison
}
}
}
if Config.CLDiff != 0 && reason == "" && len(body) > 0 && compareLengths(len(body), len(Config.Website.Body), Config.CLDiff) {
reason = fmt.Sprintf("Length %d differed more than %d bytes from normal length %d", len(body), Config.CLDiff, len(Config.Website.Body))
}
if reason != "" {
msg := identifier + ": " + reason + "\n"
Print(msg, Cyan)
}
}
Web-Cache-Vulnerability-Scanner-1.3.3/pkg/techniques.go 0000664 0000000 0000000 00000104066 14732751445 0022755 0 ustar 00root root 0000000 0000000 package pkg
import (
"fmt"
"io"
"net/http"
"net/url"
"strconv"
"strings"
"sync"
"golang.org/x/net/html"
)
var impactfulQueries []string
func init() {
}
/* Scan cookies for poisoning */
func ScanCookies() reportResult {
var repResult reportResult
repResult.Technique = "Cookies"
for i, c := range Config.Website.Cookies {
poison := randInt()
msg := fmt.Sprintf("Checking cookie %s (%d/%d)\n", c.Name, i+1, len(Config.Website.Cookies))
Print(msg, NoColor)
rUrl := Config.Website.Url.String()
cb := randInt()
success := fmt.Sprintf("Cookie %s was successfully poisoned! cbwcvs: %s poison: %s\n", c.Name, cb, poison)
identifier := c.Name + "=" + c.Value
msg = fmt.Sprintf("Overwriting %s=%s with %s=%s\n", c.Name, c.Value, c.Name, poison)
Print(msg, NoColor)
newCookie := *c
newCookie.Value = poison
rp := requestParams{
repResult: &repResult,
headers: []string{""},
values: []string{""},
identifier: identifier,
poison: poison,
url: rUrl,
cb: cb,
success: success,
bodyString: "",
forcePost: false,
duplicateHeaders: false,
m: nil,
newCookie: newCookie,
}
responseSplittingHeader, _ := issueRequest(rp)
// check for response splitting, if poison was reflected in a header
if responseSplittingHeader != "" {
msg := fmt.Sprintf("Checking cookie %s for Response Splitting, because it was reflected in the header %s\n", c.Name, responseSplittingHeader)
PrintVerbose(msg, Cyan, 1)
rp.poison += getRespSplit()
rp.url = rUrl
rp.cb = randInt()
rp.success = fmt.Sprintf("Cookie %s successfully poisoned the header %s with Response Splitting! cbwcvs: %s poison: %s\n", c.Name, responseSplittingHeader, rp.cb, rp.poison)
rp.identifier += " response splitting"
msg = fmt.Sprintf("Overwriting %s=%s with %s=%s\n", c.Name, c.Value, c.Name, rp.poison)
Print(msg, NoColor)
issueRequest(rp)
}
}
return repResult
}
func ScanForwardingHeaders() reportResult {
var repResult reportResult
repResult.Technique = "Forward/Host Headers"
// Host header
header := "Host"
portInt := 31337
// Check if port is already contained in default response
for searchBodyHeadersForString(strconv.Itoa(portInt), Config.Website.Body, Config.Website.Headers) {
portInt++
}
port := strconv.Itoa(portInt)
values := []string{":" + port, ":@" + port, " " + port}
for _, value := range values {
PrintVerbose("Port-Number "+strconv.Itoa(portInt)+" was already present in websites response. Adding 1 to it.\n", NoColor, 2)
ForwardHeadersTemplate(&repResult, []string{header}, []string{value}, header, value, false)
}
// Duplicate Host header
header = "host"
poison := randInt()
values = []string{poison}
for _, value := range values {
ForwardHeadersTemplate(&repResult, []string{header}, []string{value}, header, value, true)
}
// X-Forwarded Headers
headers := []string{"X-Forwarded-Host", "X-Forwarded-Scheme"}
poison = randInt()
values = []string{poison, "nothttps"}
identifier := "X-Forwarded-Host and X-Forwarded-Scheme"
ForwardHeadersTemplate(&repResult, headers, values, identifier, poison, false)
// Forwarded Header
header = "Forwarded"
value := "host=" + randInt()
ForwardHeadersTemplate(&repResult, []string{header}, []string{value}, header, value, false)
// X-Forwarded-Port Header
header = "X-Forwarded-Port"
value = port
ForwardHeadersTemplate(&repResult, []string{header}, []string{value}, header, value, false)
return repResult
}
func ForwardHeadersTemplate(repResult *reportResult, headers []string, values []string, identifier string, poison string, duplicateHeaders bool) {
rUrl := Config.Website.Url.String()
cb := randInt()
success := fmt.Sprintf("%s was successfully poisoned! cbwcvs: %s poison: %s\n", headers, cb, values)
rp := requestParams{
repResult: repResult,
headers: headers,
values: values,
identifier: identifier,
poison: poison,
url: rUrl,
cb: cb,
success: success,
bodyString: "",
forcePost: false,
duplicateHeaders: duplicateHeaders,
m: nil,
newCookie: http.Cookie{},
}
responseSplittingHeader, _ := issueRequest(rp)
// check for response splitting, if poison was reflected in a header
if responseSplittingHeader != "" {
rp.values[0] += getRespSplit()
msg := fmt.Sprintf("Checking header(s) %s with value(s) %s for Response Splitting, because it was reflected in the header %s\n", rp.headers, rp.values, responseSplittingHeader)
PrintVerbose(msg, Cyan, 1)
rp.poison += getRespSplit()
rp.url = rUrl
rp.cb = randInt()
rp.success = fmt.Sprintf("%s successfully poisoned the header %s with Response Splitting! cbwcvs: %s poison: %s\n", headers, responseSplittingHeader, rp.cb, rp.values)
rp.identifier += " response splitting"
issueRequest(rp)
}
}
func ScanHTTPRequestSmuggling(proxyURL *url.URL) reportResult {
var repResult reportResult
identifier := "HTTP Request Smuggling"
repResult.Technique = identifier
path := Config.Website.Url.Path
if Config.Website.Cache.CBisParameter {
path, _ = addCachebusterParameter(path, "")
}
if path == "" {
path = "/"
}
headers := GenerateHeaderString()
PrintVerbose("Trying CLTE Request Smuggling\n", NoColor, 1)
req := clte(path, headers)
httpRequestSmuggling(req, &repResult, proxyURL)
if !repResult.Vulnerable {
PrintVerbose("Trying TECL Request Smuggling\n", NoColor, 1)
req = tecl(path, headers)
httpRequestSmuggling(req, &repResult, proxyURL)
}
if !repResult.Vulnerable {
PrintVerbose("Trying CLCL Request Smuggling\n", NoColor, 1)
req = clcl(path, headers)
httpRequestSmuggling(req, &repResult, proxyURL)
}
if !repResult.Vulnerable {
PrintVerbose("Trying CLCL2 Request Smuggling\n", NoColor, 1)
req = clcl2(path, headers)
httpRequestSmuggling(req, &repResult, proxyURL)
}
return repResult
}
/* Scan headers for poisoning */
func ScanHeaders(headerList []string) reportResult {
var repResult reportResult
repResult.Technique = "Headers"
sem := make(chan int, Config.Threads)
var wg sync.WaitGroup
wg.Add(len(headerList))
var m sync.Mutex
msg := fmt.Sprintf("Testing %d headers\n", len(headerList))
PrintVerbose(msg, NoColor, 1)
for i, header := range headerList {
header = strings.Trim(header, "\r")
if header == "" {
msg := fmt.Sprintf("Skipping empty header (%d/%d)\n", i+1, len(headerList))
PrintVerbose(msg, NoColor, 1)
wg.Done()
continue
}
header = http.CanonicalHeaderKey(header)
go func(i int, header string) {
defer wg.Done()
sem <- 1
defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert
msg := fmt.Sprintf("Testing now (%d/%d) %s\n", i+1, len(headerList), header)
PrintVerbose(msg, NoColor, 2)
rUrl := Config.Website.Url.String()
poison := randInt()
cb := randInt()
success := fmt.Sprintf("Header %s was successfully poisoned! cbwcvs: %s poison: %s\n", header, cb, poison)
identifier := fmt.Sprintf("header %s", header)
rp := requestParams{
repResult: &repResult,
headers: []string{header},
values: []string{poison},
identifier: identifier,
poison: poison,
url: rUrl,
cb: cb,
success: success,
bodyString: "",
forcePost: false,
duplicateHeaders: false,
m: &m,
newCookie: http.Cookie{},
}
responseSplittingHeader, _ := issueRequest(rp)
// check for response splitting, if poison was reflected in a header
if responseSplittingHeader != "" {
msg := fmt.Sprintf("Testing now (%d/%d) %s for Response Splitting, because it was reflected in the header %s\n", i+1, len(headerList), header, responseSplittingHeader)
PrintVerbose(msg, Cyan, 1)
rp.url = rUrl
rp.cb = randInt()
rp.poison += getRespSplit()
rp.success = fmt.Sprintf("Header %s successfully poisoned the header %s with Response Splitting! cbwcvs: %s poison: %s\n", header, responseSplittingHeader, rp.cb, rp.poison)
rp.identifier += " response splitting"
issueRequest(rp)
}
}(i, header)
}
wg.Wait()
return repResult
}
/* Scan headers for poisoning. Test 10x aufeinmal */ /*
func ScanHeaders(headerList []string) reportResult {
var repResult reportResult
repResult.Technique = "Headers"
sem := make(chan int, Config.Threads)
var wg sync.WaitGroup
wg.Add(len(headerList))
var m sync.Mutex
// add 10 headers at a time to check if the response differs
for i := 0; i < len(headerList); i += 10 {
var headers = []string{}
for ii := 0; i < 10; i++ {
if len(headerList) > i+ii {
defer wg.Done()
headerToAdd := strings.Trim(headerList[i+ii], "\r")
if headerToAdd == "" {
msg := fmt.Sprintf("Skipping empty header (%d/%d)\n", i+1, len(headerList))
PrintVerbose(msg, NoColor, 1)
wg.Done()
continue
} else {
headerToAdd = http.CanonicalHeaderKey(headerToAdd)
headers = append(headers, headerToAdd)
}
}
}
poison := randInt()
msg := fmt.Sprintf("Testing now (%d/%d) %s\n", i+ii+1, len(headerList), headers)
PrintVerbose(msg, NoColor, 2)
urlWithCb, _ := addCacheBuster(Config.Website.Url.String(), "", Config.CacheBuster)
identifier := fmt.Sprintf("headers %s", headers)
rp := requestParams{
headers: headers,
values: []string{poison},
identifier: identifier,
poison: poison,
url: urlWithCb,
}
respBody, respCode, _, respHeaders, err := firstRequest(rp)
// TODO repeat when timedout
if err != nil {
continue
}
for ii, header := range headers {
poison = randInt()
go func(i int, header string, poison string) {
defer wg.Done()
sem <- 1
defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert
msg := fmt.Sprintf("Testing now (%d/%d) %s\n", i+1, len(headerList), header)
PrintVerbose(msg, NoColor, 2)
urlWithCb, cb := addCacheBuster(Config.Website.Url.String(), "", Config.CacheBuster)
success := fmt.Sprintf("Header %s was successfully poisoned! cbwcvs: %s poison: %s\n", header, cb, poison)
identifier := fmt.Sprintf("header %s", header)
rp := requestParams{
repResult: &repResult,
headers: []string{header},
values: []string{poison},
identifier: identifier,
poison: poison,
url: urlWithCb,
cbwcvs: cb,
success: success,
bodyString: "",
forcePost: false,
duplicateHeaders: false,
m: &m,
cookie: oldCookie{},
}
responseSplitting, _ := issueRequest(rp)
// check for response splitting, if poison was reflected in a header
if responseSplitting {
msg := fmt.Sprintf("Testing now (%d/%d) %s for Response Splitting, because it was reflected in the response' header\n", i+1, len(headerList), header)
PrintVerbose(msg, Cyan, 1)
rp.url, rp.cb = addCacheBuster(Config.Website.Url.String(), "", Config.CacheBuster)
rp.poison += getRespSplit()
rp.success = fmt.Sprintf("Header %s was successfully poisoned with Response Splitting! cbwcvs: %s poison: %s\n", header, rp.cb, rp.poison)
rp.identifier += " response splitting"
issueRequest(rp)
}
}(i+ii, header, poison)
}
}
wg.Wait()
return repResult
}*/
/*
func addCbWithPoison(parameter string, poison string) (string, string) {
var urlWithCb, cb string
if _, ok := Config.Website.Queries[parameter]; ok {
// if the query to add is already present
queryParameterMap := make(map[string]string)
for key, val := range Config.Website.Queries {
queryParameterMap[key] = val
}
msg := fmt.Sprintf("Overwriting %s=%s with %s=%s\n", parameter, queryParameterMap[parameter], parameter, poison)
Print(msg, NoColor)
queryParameterMap[parameter] = poison
urlWithCb = Config.Website.UrlWOQueries + "?"
for key, val := range queryParameterMap {
if !strings.HasSuffix(urlWithCb, "?") {
urlWithCb += "&"
}
urlWithCb += key + "=" + val
}
urlWithCb, cb = AddCacheBuster(urlWithCb+Config.QuerySeperator, "", Config.CacheBuster)
} else {
// if query isn't already present, just add it and the cachebuster
urlWithCb = Config.Website.Url.String()
urlWithCb += parameter + "=" + poison + Config.QuerySeperator
urlWithCb, cb = AddCacheBuster(urlWithCb, "", Config.CacheBuster)
}
return urlWithCb, cb
}
*/
/* Scan query parameters for poisoning */
func ScanParameters(parameterList []string) reportResult {
var repResult reportResult
repResult.Technique = "Parameters"
sem := make(chan int, Config.Threads)
var wg sync.WaitGroup
wg.Add(len(parameterList))
var m sync.Mutex
impactfulQueries = nil
msg := fmt.Sprintf("Testing %d parameters\n", len(parameterList))
PrintVerbose(msg, NoColor, 1)
for i, parameter := range parameterList {
if parameter == "" {
msg := fmt.Sprintf("Skipping empty query (%d/%d) %s\n", i+1, len(parameterList), parameter)
PrintVerbose(msg, NoColor, 2)
wg.Done()
continue
}
go func(i int, parameter string) {
defer wg.Done()
sem <- 1
defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert
parameter = strings.Trim(parameter, "\r")
msg := fmt.Sprintf("Testing now Parameter (%d/%d) %s\n", i+1, len(parameterList), parameter)
PrintVerbose(msg, NoColor, 2)
rUrl := Config.Website.Url.String()
poison := randInt()
cb := randInt()
success := fmt.Sprintf("Query Parameter %s was successfully poisoned! cbwcvs: %s poison: %s\n", parameter, cb, poison)
identifier := fmt.Sprintf("parameter %s", parameter)
rp := requestParams{
repResult: &repResult,
headers: []string{""},
values: []string{poison},
parameters: []string{parameter + "=" + poison},
identifier: identifier,
poison: poison,
url: rUrl,
cb: cb,
success: success,
bodyString: "",
forcePost: false,
duplicateHeaders: false,
newCookie: http.Cookie{},
m: &m,
}
responseSplittingHeader, appendParameter := issueRequest(rp)
if appendParameter {
impactfulQueries = append(impactfulQueries, parameter)
}
// check for response splitting, if poison was reflected in a header
if responseSplittingHeader != "" {
msg := fmt.Sprintf("Testing now Parameter (%d/%d) %s for Response Splitting, because it was reflected in the header %s\n", i+1, len(parameterList), parameter, responseSplittingHeader)
PrintVerbose(msg, Cyan, 1)
rp.poison += getRespSplit()
rp.parameters = []string{parameter + "=" + rp.poison}
rp.url = rUrl
rp.cb = randInt()
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s with Response Splitting! cbwcvs: %s poison: %s\n", parameter, responseSplittingHeader, rp.cb, rp.poison)
rp.identifier += " response splitting"
issueRequest(rp)
}
}(i, parameter)
}
wg.Wait()
return repResult
}
/* Check for fat GET */
func ScanFatGET() reportResult {
var repResult reportResult
repResult.Technique = "Fat GET"
if len(impactfulQueries) == 0 {
msg := "No impactful query parameters were found beforehand. Run the query parameter scan (maybe with a different wordlist)."
Print(msg+"\n", Yellow)
repResult.HasError = true
repResult.ErrorMessages = append(repResult.ErrorMessages, msg)
return repResult
} else {
msg := fmt.Sprintf("The following parameters were found to be impactful and will be tested for parameter cloaking: %s\n", impactfulQueries)
Print(msg, NoColor)
}
sem := make(chan int, Config.Threads)
var wg sync.WaitGroup
wg.Add(len(impactfulQueries))
var m sync.Mutex
headers := []string{"", "", "X-HTTP-Method-Override", "X-HTTP-Method", "X-Method-Override"}
values := []string{"", "", "POST", "POST", "POST"}
for method := 0; method < 5; method++ {
var identifier string
forcePost := false
if method == 0 {
identifier = "simple Fat GET"
} else if method == 1 {
identifier = "POST Fat GET"
forcePost = true
} else {
identifier = fmt.Sprintf("%s Fat GET", headers[method-2])
}
msg := "Testing now " + identifier + "\n"
Print(msg, NoColor)
for i, s := range impactfulQueries {
// Parameter Limit for BA
if i >= 500 {
if i == 500 {
Print("Parameter Limit for BA at 500\n", Red)
}
wg.Done()
continue
}
poison := randInt()
go func(i int, s string, poison string) {
defer wg.Done()
sem <- 1
defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert
msg := fmt.Sprintf("(%d/%d) %s\n", i+1, len(impactfulQueries), s)
PrintVerbose(msg, NoColor, 2)
rUrl := Config.Website.Url.String()
cb := randInt()
bodyString := s + "=" + poison
success := fmt.Sprintf("Query Parameter %s was successfully poisoned via %s! cbwcvs: %s poison:%s\n", s, identifier, cb, poison)
rp := requestParams{
repResult: &repResult,
headers: []string{headers[method]},
values: []string{values[method]},
identifier: identifier,
poison: poison,
url: rUrl,
cb: cb,
success: success,
bodyString: bodyString,
forcePost: forcePost,
duplicateHeaders: false,
m: &m,
newCookie: http.Cookie{},
}
responseSplittingHeader, _ := issueRequest(rp)
// check for response splitting, if poison was reflected in a header
if responseSplittingHeader != "" {
msg := fmt.Sprintf("Testing now (%d/%d) %s for Response Splitting, because it was reflected in the header %s\n", i+1, len(impactfulQueries), s, responseSplittingHeader)
PrintVerbose(msg, Cyan, 1)
rp.url = rUrl
rp.cb = randInt()
rp.poison += getRespSplit()
rp.bodyString += getRespSplit()
rp.identifier += " response splitting"
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s via %s with Response Splitting! cbwcvs: %s poison:%s\n", s, responseSplittingHeader, identifier, rp.cb, rp.poison)
issueRequest(rp)
}
}(i, s, poison)
}
wg.Wait()
wg.Add(len(impactfulQueries))
}
return repResult
}
/* Check for Parameter Cloaking */
func ScanParameterCloaking() reportResult {
var repResult reportResult
repResult.Technique = "Parameter Cloaking"
if len(impactfulQueries) == 0 {
msg := "No impactful query parameters were found beforehand. Run the query parameter scan (maybe with a different wordlist)."
Print(msg+"\n", Yellow)
repResult.HasError = true
repResult.ErrorMessages = append(repResult.ErrorMessages, msg)
return repResult
} else {
msg := fmt.Sprintf("The following parameters were found to be impactful and will be tested for parameter cloaking:\n%s\n", impactfulQueries)
Print(msg, NoColor)
}
utm_parameter := []string{"utm_source", "utm_medium", "utm_campaign", "utm_content", "utm_term"}
unkeyed_parameter := []string{}
/***********Check if urlWithCb already contains utm parameter.
Check if ? or querySeperator is needed
****************/
// The first request is made so a cache miss is forced and the following responses will only
//have a cache hit, if they are unkeyed
rUrl := Config.Website.Url.String()
cb := randInt()
rp := requestParams{
identifier: "first request %s",
url: rUrl,
cb: cb,
}
firstRequest(rp)
sem := make(chan int, Config.Threads)
var wg sync.WaitGroup
var m sync.Mutex
cache := Config.Website.Cache
if cache.Indicator == "" /*|| cache.TimeIndicator*/ {
//Add tests for cache.TimeIndicator and cache.Reflection
//Cant test if utm_parameter are unkeyed if X-Cache isn't set
//So they will be all added as unkeyed_parameter
msg := "hit/miss isn't verbose. Can't check which utm_parameter is unkeyed, so all will be used\n"
Print(msg, Yellow)
unkeyed_parameter = utm_parameter
} else {
//Test which utm_parameter are unkeyed
wg.Add(len(utm_parameter))
for i, s := range utm_parameter {
// Parameter Limit for BA
if i >= 500 {
if i == 500 {
Print("Parameter Limit for BA at 500\n", Red)
}
wg.Done()
continue
}
go func(i int, s string) {
defer wg.Done()
sem <- 1
defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert
msg := fmt.Sprintf("Testing now for unkeyed utm parameters (%d/%d) %s\n", i+1, len(utm_parameter), s)
PrintVerbose(msg, NoColor, 2)
identifier := fmt.Sprintf("unkeyed utm %s", s)
//TODO: TimeOut behandeln!!!
rp := requestParams{
identifier: identifier,
url: rUrl,
cb: cb,
parameters: []string{s + "=foobar"}, // utm parameter with nonsense value
}
_, _, _, respHeader, err := firstRequest(rp)
if err != nil {
if err.Error() == "stop" {
return
}
m.Lock()
repResult.HasError = true
repResult.ErrorMessages = append(repResult.ErrorMessages, err.Error())
m.Unlock()
}
indicValue := respHeader.Get(cache.Indicator)
if checkCacheHit(indicValue, cache.Indicator) {
m.Lock()
unkeyed_parameter = append(unkeyed_parameter, s)
m.Unlock()
}
}(i, s)
}
wg.Wait()
}
if len(unkeyed_parameter) == 0 {
msg := "No unkeyed utm parameters could be found. Parameter Cloaking is not possible using utm parameters\n"
Print(msg, Yellow)
} else {
msg := fmt.Sprintf("The following utm parameters were found to be unkeyed and will be tested for parameter cloaking:\n %s\n", unkeyed_parameter)
Print(msg, NoColor)
}
cloak := ";"
if Config.QuerySeparator == ";" {
cloak = "&"
}
for iu, u := range unkeyed_parameter {
//its sufficient to only test one unkeyed_parameter as it should behave the same way as the others.
if iu > 0 && cache.Indicator != "" {
break
}
wg.Add(len(impactfulQueries))
for is, s := range impactfulQueries {
poison := randInt()
go func(iu int, u string, is int, s string, poison string) {
defer wg.Done()
sem <- 1
defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert
msg := fmt.Sprintf("Testing now Parameter Cloaking (%d/%d) %s%s%s\n", iu+is+1, len(impactfulQueries)*len(unkeyed_parameter), u, cloak, s)
PrintVerbose(msg, NoColor, 2)
cb := randInt()
success := fmt.Sprintf("Query Parameter %s was successfully poisoned via Parameter Cloaking using %s! cbwcvs:%s poison:%s\n", s, u, cb, poison)
identifier := fmt.Sprintf("parameter cloaking %s %s", u, s)
rp := requestParams{
repResult: &repResult,
headers: []string{""},
values: []string{poison},
parameters: []string{u + "=foobar" + cloak + s + "=" + poison},
identifier: identifier,
poison: poison,
url: rUrl,
cb: cb,
success: success,
bodyString: "",
forcePost: false,
duplicateHeaders: false,
m: &m,
newCookie: http.Cookie{},
}
responseSplittingHeader, _ := issueRequest(rp)
// check for response splitting, if poison was reflected in a header
if responseSplittingHeader != "" {
msg := fmt.Sprintf("Testing now Parameter Cloaking (%d/%d) %s%s%s for Response Splitting, because it was reflected in the header %s\n", iu+is+1, len(impactfulQueries)*len(unkeyed_parameter), u, cloak, s, responseSplittingHeader)
PrintVerbose(msg, Cyan, 1)
rp.url = rUrl
rp.cb = randInt()
rp.poison += getRespSplit()
rp.parameters = []string{u + "=foobar" + cloak + s + "=" + rp.poison}
rp.success = fmt.Sprintf("Query Parameter %s successfully poisoned the header %s with Response Splitting using %s with Parameter Cloaking! cbwcvs:%s poison:%s\n", s, responseSplittingHeader, u, rp.cb, rp.poison)
rp.identifier += " response splitting"
issueRequest(rp)
}
}(iu, u, is, s, poison)
}
wg.Wait()
}
return repResult
}
/* Check for different DOS techniques */
func DOS() reportResult {
var repResult reportResult
repResult.Technique = "DOS"
// TODO: Ist nur Header Value oder auch Header Name ausschlaggebend?
hho(&repResult)
// HMC (Header Metachar Character)
// TODO: Check for more META CHARACTERS?
//TODO: Change to other header, which is probably whitelisted
headers := []string{"X-Metachar-Header"}
values := []string{"\\n", "\\r", "\\a", "\\0", "\\b", "\\e", "\\v", "\\f", "\\u0000"}
for _, header := range headers {
headerDOSTemplate(&repResult, values, header, "HMC ", true)
}
// HMO (HTTP Method Override)
values = []string{"GET", "POST", "DELETE", "HEAD", "OPTIONS", "CONNECT", "PATCH", "PUT", "TRACE", "NONSENSE"}
headers = []string{"X-HTTP-Method-Override", "X-HTTP-Method", "X-Method-Override"}
for _, header := range headers {
headerDOSTemplate(&repResult, values, header, "HMO ", true)
}
// DOS via not implemented transferEncoding
values = []string{"asdf"}
headerDOSTemplate(&repResult, values, "zTRANSFER-ENCODING", "Not supported Transfer-Encoding ", true)
// DOS via incompatible/outdated browser agent
values = []string{"Mozilla/5.0 (Windows; U; MSIE 9.0; WIndows NT 9.0; en-US))"}
headerDOSTemplate(&repResult, values, "User-Agent", "incompatible browser ", true)
// DOS via blacklisted security scanner user agent // TODO: Also add bots? Or will the IP be blocked too fast
values = []string{"WebCacheVulnerabilityScanner v" + version, "Fuzz Faster U Fool", "Nuclei - Open-source project (github.com/projectdiscovery/nuclei)", "sqlmap/1.3.11#stable (http://sqlmap.org)", "gobuster/3.1.0", "Wfuzz/2.2", "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)", "masscan/1.3", "blekkobot"}
headerDOSTemplate(&repResult, values, "User-Agent", "blacklisted security scanners ", true)
// DOS via illegal header name
/* Currently disabled because of net/http throws error because of illegal character TODO: workaround, see https://stackoverflow.com/questions/70678016/how-to-bypass-golangs-http-request-net-http-rfc-compliance
values = []string{"foobar"}
headerDOSTemplate(&repResult, values, "Ill\\egal", "illegal header name ", true)
*/
// DOS via Max-Forwards (Webserver/Cache returns request)
values = []string{"0", "1", "2"}
headerDOSTemplate(&repResult, values, "Max-Forwards", "max-forwards ", true)
// DOS via waf blocking because of a blacklist word
// TODO: change header to probably whitelisted header, More Blacklist words?
values = []string{".burpcollaborator.net", ""}
headerDOSTemplate(&repResult, values, "Any-Header", "blacklist ", true)
// DOS via Range
values = []string{"bytes=cow"}
headerDOSTemplate(&repResult, values, "Range", "", true)
// DOS via X-Forwarded-Protocol
values = []string{"http", "https", "ssl", "nonsense"}
headerDOSTemplate(&repResult, values, "X-Forwarded-Protocol", "", true)
// DOS via X-Forwarded-Protocol
values = []string{"http", "https", "nothttps", "nonsense"}
headerDOSTemplate(&repResult, values, "X-Forwarded-Scheme", "", true)
// DOS via X-Fordwarded-SSL
values = []string{"on", "off", "nonsense"}
headerDOSTemplate(&repResult, values, "X-Forwarded-SSL", "", true)
return repResult
}
/* HTTP Header Oversize */
func hho(repResult *reportResult) {
repetitions := []int{50, 100, 200} //4k, 8k, 16k
msg := fmt.Sprintf("Testing now HHO with Size Limits of ~80*%d bytes\n", repetitions)
PrintVerbose(msg, NoColor, 2)
sem := make(chan int, Config.Threads)
var wg sync.WaitGroup
wg.Add(len(repetitions))
var m sync.Mutex
for _, repetition := range repetitions {
go func(repetition int) {
defer wg.Done()
sem <- 1
defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert
limit := repetition * 8 / 100
//msg := fmt.Sprintf("Testing now HHO with Size Limit %dk bytes\n", limit)
//Print(msg, NoColor)
headers := []string{}
values := []string{}
for i := 0; i < repetition; i++ {
headername := fmt.Sprintf("X-Oversized-Header-%d", i+1)
value := "Big-Value-000000000000000000000000000000000000000000000000000000000000000000000000000000"
headers = append(headers, headername)
values = append(values, value)
}
rUrl := Config.Website.Url.String()
cb := randInt()
identifier := fmt.Sprintf("HHO with limit of %dk bytes", limit)
rp := requestParams{
headers: headers,
values: values,
identifier: identifier,
url: rUrl,
cb: cb,
}
_, statusCode1, request, _, err := firstRequest(rp)
if err != nil {
if err.Error() != "stop" {
m.Lock()
repResult.HasError = true
repResult.ErrorMessages = append(repResult.ErrorMessages, err.Error())
m.Unlock()
}
return
}
// send second request also with cb
_, statusCode2, respHeader, err := secondRequest(rUrl, identifier, cb)
if err != nil {
if err.Error() != "stop" {
m.Lock()
repResult.HasError = true
repResult.ErrorMessages = append(repResult.ErrorMessages, err.Error())
m.Unlock()
}
return
}
msg = fmt.Sprintf("HHO DOS was successfully poisoned! cbwcvs: %s \n%s\n", cb, request.URL)
m.Lock()
_ = checkPoisoningIndicators(repResult, request, msg, "", "", statusCode1, statusCode2, false, respHeader, false)
m.Unlock()
}(repetition)
}
wg.Wait()
}
func headerDOSTemplate(repResult *reportResult, values []string, header string, msgextra string, httpConform bool) {
msg := fmt.Sprintf("Testing now %sDOS with header %s and values %s\n", msgextra, header, values)
PrintVerbose(msg, NoColor, 2)
sem := make(chan int, Config.Threads)
var wg sync.WaitGroup
wg.Add(len(values))
var m sync.Mutex
for _, value := range values {
go func(value string, httpConform bool) {
defer wg.Done()
sem <- 1
defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert
msg := fmt.Sprintf("Testing now %s Header DOS with %s\n", header, value)
PrintVerbose(msg, NoColor, 2)
rUrl := Config.Website.Url.String()
cb := randInt()
success := fmt.Sprintf("%sDOS with header %s was successfully poisoned! cbwcvs: %s poison: %s\n", msgextra, header, cb, value)
identifier := fmt.Sprintf("%s%s with %s", msgextra, header, value)
rp := requestParams{
repResult: repResult,
headers: []string{header},
values: []string{value},
identifier: identifier,
poison: "",
url: rUrl,
cb: cb,
success: success,
bodyString: "",
forcePost: false,
duplicateHeaders: false,
m: &m,
newCookie: http.Cookie{},
}
responseSplittingHeader, _ := issueRequest(rp)
// check for response splitting, if poison was reflected in a header
if responseSplittingHeader != "" {
msg := fmt.Sprintf("Testing now %s Header DOS with %s\n for Response Splitting, because it was reflected in the header %s", header, value, responseSplittingHeader)
PrintVerbose(msg, Cyan, 1)
rp.values[0] += getRespSplit()
rp.url = rUrl
rp.cb = randInt()
rp.success = fmt.Sprintf("%sDOS with header %s successfully poisoned the header %s with Response Splitting! cbwcvs: %s poison: %s\n", msgextra, header, responseSplittingHeader, rp.cb, rp.values[0])
rp.identifier += getRespSplit() + " with response splitting"
issueRequest(rp)
}
}(value, httpConform)
}
wg.Wait()
}
func ScanCSS() reportResult {
var repResult reportResult
repResult.Technique = "CSS poisoning"
bodyReader := strings.NewReader(Config.Website.Body)
tokenizer := html.NewTokenizer(bodyReader)
var urls []string
eof := false
for !eof {
tokentype := tokenizer.Next()
switch tokentype {
case html.StartTagToken, html.SelfClosingTagToken:
token := tokenizer.Token()
if token.Data == "link" {
for _, a := range token.Attr {
if a.Key == "href" {
if !strings.HasSuffix(a.Val, ".css") {
break
}
tempURL := addDomain(a.Val, Config.Website.Domain)
if tempURL != "" {
urls = append(urls, tempURL)
}
break
}
}
}
// When EOF is reached a html.ErrorToken appears
case html.ErrorToken:
err := tokenizer.Err()
if err == io.EOF {
eof = true
break
}
msg := fmt.Sprintf("error tokenizing HTML: %+v", tokenizer.Err())
Print(msg, Yellow)
}
}
if len(urls) == 0 {
msg := "No CSS files were found.\n"
PrintVerbose(msg, Yellow, 1)
return repResult
}
msg := fmt.Sprintf("Testing the following CSS files for poisoning\n%s\n", urls)
PrintVerbose(msg, NoColor, 1)
sem := make(chan int, Config.Threads)
var wg sync.WaitGroup
wg.Add(len(urls))
var m sync.Mutex
for _, url := range urls {
go func(url string) {
defer wg.Done()
sem <- 1
defer func() { <-sem }() // Freigabe der Semaphore, egal was passiert. Dadurch werden Deadlocks verhindert
//msg := fmt.Sprintf("Testing now %s Header DOS with %s\n", header, value)
//Print(msg, NoColor)
urlWithCb, cb := addCachebusterParameter(url, "")
identifier := url
rp := requestParams{
identifier: identifier,
url: urlWithCb,
cb: randInt(),
}
body, _, request, _, err := firstRequest(rp)
if err != nil {
if err.Error() != "stop" {
m.Lock()
repResult.HasError = true
repResult.ErrorMessages = append(repResult.ErrorMessages, err.Error())
m.Unlock()
}
return
}
if strings.Contains(string(body), cb) {
msg = fmt.Sprintf("The following CSS file reflects the url with the cb %s\n%s\n", cb, url)
Print(msg, Green)
}
body, _, _, err = secondRequest(url, identifier, rp.cb)
if err != nil {
if err.Error() != "stop" {
m.Lock()
repResult.HasError = true
repResult.ErrorMessages = append(repResult.ErrorMessages, err.Error())
m.Unlock()
}
return
}
if strings.Contains(string(body), cb) {
PrintNewLine()
msg = fmt.Sprintf("A CSS file was successfully poisoned! cbwcvs: %s\nURL: %s\n", cb, request.URL)
Print(msg, Green)
msg = "Reason: CSS reflects URL\n"
Print(msg, Green)
m.Lock()
repResult.Vulnerable = true
repResult.Requests = append(repResult.Requests, request)
m.Unlock()
}
}(url)
}
wg.Wait()
return repResult
}
Web-Cache-Vulnerability-Scanner-1.3.3/pkg/utils.go 0000664 0000000 0000000 00000014075 14732751445 0021745 0 ustar 00root root 0000000 0000000 package pkg
import (
"context"
"fmt"
"log"
"math/rand"
"net/http"
"net/url"
"os"
"strconv"
"strings"
"github.com/fatih/color"
)
var (
NoColor = 0
Red = 1
Yellow = 2
Green = 3
Cyan = 4
)
func PrintNewLine() {
Print("\n", NoColor)
}
func PrintVerbose(msg string, c int, threshold int) {
if c == Red {
log.Print("[ERR] " + msg)
msg = color.RedString("[ERR] ") + msg
} else if c == Yellow {
msg = color.YellowString("[!] ") + msg
log.Print("[!] " + msg)
} else if c == Green {
msg = color.GreenString("[+] ") + msg
log.Print("[+] " + msg)
} else if c == Cyan {
msg = color.CyanString("[*] ") + msg
log.Print("[*] " + msg)
} else {
log.Print(msg)
}
if Config.Verbosity >= threshold {
fmt.Print(msg)
}
}
func Print(msg string, c int) {
PrintVerbose(msg, c, 0)
}
func PrintFatal(msg string) {
Print(msg, Red)
os.Exit(1)
}
func ReadLocalFile(path string, name string) []string {
path = strings.TrimPrefix(path, "file:")
if strings.HasPrefix(strings.ToLower(path), "file:") {
PrintFatal("Please make sure that path: is lowercase")
}
w, err := os.ReadFile(path)
if err != nil {
additional := ""
if name == "header" {
additional = "Use the flag \"-hw path/to/wordlist\" to specify the path to a header wordlist\n"
} else if name == "parameter" {
additional = "Use the flag \"-pw path/to/wordlist\" to specify the path to a parameter wordlist\n"
}
PrintFatal("The specified " + name + " file path " + path + " couldn't be found: " + err.Error() + "\n" + additional)
}
return strings.Split(string(w), "\n")
}
func setRequest(req *http.Request, doPost bool, cb string, cookie http.Cookie) {
cache := Config.Website.Cache
if cb != "" && cache.CBisParameter {
var newUrl string
newUrl, _ = addCachebusterParameter(req.URL.String(), cb)
var err error
req.URL, err = url.Parse(newUrl)
if err != nil {
msg := "Converting " + newUrl + " to URL:" + err.Error() + "\n"
Print(msg, Red)
}
}
setRequestHeaders(req, cb)
//TODO config nötig oder nur config.Website.Cookies?
setRequestCookies(req, cb, cookie)
// Content-Type nur hinzufügen, wenn nicht schon vorher geschehen
if doPost {
if req.Header.Get("Content-Type") == "" && Config.ContentType != "" {
req.Header.Add("Content-Type", Config.ContentType)
}
}
}
/* TODO wie bei requestCookies nur die erste occurrence eines headers aufnehmen */
func setRequestHeaders(req *http.Request, cb string) {
cache := Config.Website.Cache
req.Header.Set("User-Agent", useragent)
for _, h := range Config.Headers {
h = strings.TrimSuffix(h, "\r")
h = strings.TrimSpace(h)
if h == "" {
continue
} else if !strings.Contains(h, ":") {
msg := "Specified header" + h + "doesn't contain a : and will be skipped"
Print(msg, NoColor)
continue
} else {
hSplitted := strings.SplitN(h, ":", 2)
// is this header the cachebuster?
if cb != "" && cache.CBisHeader && strings.EqualFold(hSplitted[0], cache.CBName) {
req.Header.Set(cache.CBName, cb)
}
req.Header.Set(strings.TrimSpace(hSplitted[0]), strings.TrimSpace(hSplitted[1]))
}
}
}
/* */
func setRequestCookies(req *http.Request, cb string, cookie http.Cookie) {
cache := Config.Website.Cache
for _, c := range Config.Website.Cookies {
// only add first occurrence of a cookie to the request
_, err := req.Cookie(c.Name)
if err == http.ErrNoCookie {
if cb != "" && cache.CBisCookie && c.Name == cache.CBName {
c.Value = cb
if c.Name == cookie.Name {
msg := "Can't test cookie " + c.Name + " for Web Cache Poisoning, as it is used as Cachebuster\n"
Print(msg, Yellow)
}
} else if c.Name == cookie.Name {
c = &cookie
}
req.AddCookie(c)
}
}
}
/* if rp.newCookie.Name != "" {
if Config.Website.Cache.CBisCookie && strings.EqualFold(Config.Website.Cache.CBName, rp.newCookie.Name) {
msg = "Can't test cookie " + rp.newCookie.Name + " for Web Cache Poisoning, as it is used as Cachebuster\n"
Print(msg, Yellow)
} else {
removeCookie := http.Cookie
req.AddCookie(&rp.newCookie)
}
*/
func addCachebusterParameter(strUrl string, cb string) (string, string) {
if cb == "" {
cb = randInt()
}
if !strings.Contains(strUrl, "?") {
strUrl += "?" + Config.CacheBuster + "=" + cb
} else {
strUrl += Config.QuerySeparator + Config.CacheBuster + "=" + cb
}
return strUrl, cb
}
/* Create a random long integer */
func randInt() string {
min := 100000000000
max := 999999999999
result := min + rand.Intn(max-min)
return strconv.Itoa(result)
}
func waitLimiter(identifier string) {
err := Config.Limiter.Wait(context.Background())
if err != nil {
msg := identifier + " rate Wait: " + err.Error()
Print(msg, Red)
}
}
func searchBodyHeadersForString(cb string, body string, headers http.Header) bool {
if strings.Contains(body, cb) {
return true
}
for _, h := range headers {
for _, v := range h {
if strings.Contains(v, cb) {
return true
}
}
}
return false
}
// check if cache was hit
func checkCacheHit(value string, indicator string) bool {
if indicator == "" {
indicator = Config.Website.Cache.Indicator
}
if strings.EqualFold("age", indicator) {
value = strings.TrimSpace(value)
if value != "0" && value != "" {
return true
}
} else if strings.EqualFold("x-iinfo", indicator) {
// String anhand von Leerzeichen aufteilen
parts := strings.Split(value, " ")
// Prüfen, ob der zweite Part existiert
if len(parts) > 1 {
secondPart := parts[1]
// Sicherstellen, dass der zweite Part mindestens zwei Zeichen lang ist
if len(secondPart) > 1 {
secondChar := strings.ToUpper(string(secondPart[1]))
if secondChar == "C" || secondChar == "V" {
return true
}
}
}
// Cache Hit may have 0,>0 or >0,0 as value. Both responses are cached
} else if strings.EqualFold("x-cache-hits", indicator) {
for _, x := range strings.Split(indicator, ",") {
x = strings.TrimSpace(x)
if x != "0" {
return true
}
}
// Some Headers may have "miss,hit" or "hit,miss" as value. But both are cached responses.
} else if strings.Contains(value, "hit") || strings.Contains(value, "cached") {
return true
}
return false
}
Web-Cache-Vulnerability-Scanner-1.3.3/templates/ 0000775 0000000 0000000 00000000000 14732751445 0021464 5 ustar 00root root 0000000 0000000 Web-Cache-Vulnerability-Scanner-1.3.3/templates/body_file 0000664 0000000 0000000 00000000123 14732751445 0023337 0 ustar 00root root 0000000 0000000 // lines which start with // or are empty will be ignored
// Example:
//admin=true Web-Cache-Vulnerability-Scanner-1.3.3/templates/config_file 0000664 0000000 0000000 00000000123 14732751445 0023647 0 ustar 00root root 0000000 0000000 // lines which start with // or are empty will be ignored
// Example Config:
//
// Web-Cache-Vulnerability-Scanner-1.3.3/templates/cookie_list 0000664 0000000 0000000 00000000154 14732751445 0023713 0 ustar 00root root 0000000 0000000 // lines which start with // or are empty will be ignored
// Example Cookies:
//uid=123456
//session=ABCDEF Web-Cache-Vulnerability-Scanner-1.3.3/templates/header_list 0000664 0000000 0000000 00000000313 14732751445 0023667 0 ustar 00root root 0000000 0000000 // lines which start with // or are empty will be ignored
// Cookies specified here won't work. Use --setcookies (-sc) instead
// Example Headers:
//X-Forwarded-Host:example.com
//User-Agent: Safari/1.1 Web-Cache-Vulnerability-Scanner-1.3.3/templates/parameter_list 0000664 0000000 0000000 00000000173 14732751445 0024423 0 ustar 00root root 0000000 0000000 // lines which start with // or are empty will be ignored
// Example Parameters:
//admin=true
//verbosity=2
//username=max Web-Cache-Vulnerability-Scanner-1.3.3/templates/recdomains_list 0000664 0000000 0000000 00000000205 14732751445 0024563 0 ustar 00root root 0000000 0000000 // lines which start with // or are empty will be ignored
// Example Domains:
//www.example.com
//api.example.com
//blog.example.com Web-Cache-Vulnerability-Scanner-1.3.3/templates/url_list 0000664 0000000 0000000 00000000226 14732751445 0023244 0 ustar 00root root 0000000 0000000 // lines which start with // or are empty will be ignored
// Example URLs:
//https://www.example.com
//http://api.example.com/?admin=true&verbosity=2 Web-Cache-Vulnerability-Scanner-1.3.3/web-cache-vulnerability-scanner.go 0000664 0000000 0000000 00000047126 14732751445 0026163 0 ustar 00root root 0000000 0000000 package main
import (
"crypto/tls"
"crypto/x509"
"fmt"
"log"
"net/http"
"net/url"
"os"
"strings"
"time"
"github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/pkg"
"golang.org/x/net/http2"
)
const version = "1.3.3"
var (
currentDate string
report pkg.Report
completedFile *os.File
proxyURL *url.URL
headerList []string
parameterList []string
noTestPreference bool
excluded map[string]bool
added map[string]bool
)
func main() {
//pkg.ReadConfigFile()
pkg.ParseFlags(version)
pkg.Statistics = map[string]int{}
/*****************************/
/**** SET EXPORT STRUCT ****/
report.Name = "Web_Cache_Vulnerability_Scanner"
report.Version = version
report.Config = &pkg.Config
currentDate = time.Now().Format("2006-01-02_15-04-05")
report.Date = currentDate
report.Duration = "Not finished yet"
/***************************/
//Create generatePath directory
if pkg.Config.GeneratePath != "./" {
if !strings.HasSuffix(pkg.Config.GeneratePath, "/") {
pkg.Config.GeneratePath += "/"
}
if _, err := os.Stat(pkg.Config.GeneratePath); err != nil {
if os.IsNotExist(err) {
err := os.Mkdir(pkg.Config.GeneratePath, 0755)
if err != nil {
msg := fmt.Sprintf("Error while creating Directory: %s\n", err.Error())
pkg.PrintFatal(msg)
}
}
}
}
// Check pkg.Config if Log shall be printed or no logs shall be made
/* Setting Logoutput to Log file and stdout */
f, err := os.OpenFile(pkg.Config.GeneratePath+currentDate+"_WCVS_Log", os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0644)
if err != nil {
msg := fmt.Sprintf("Error while creating/opening Log File: %s\n", err.Error())
pkg.PrintFatal(msg)
}
defer f.Close()
//wrt := io.MultiWriter(f, os.Stdout)
//log.SetOutput(wrt)
log.SetOutput(f)
report.Command = fmt.Sprint(os.Args)
report.Command = strings.TrimPrefix(report.Command, "[")
report.Command = strings.TrimSuffix(report.Command, "]")
pkg.PrintVerbose(report.Command, pkg.NoColor, 2)
/******************************************/
if pkg.Config.Verbosity < 0 || pkg.Config.Verbosity > 2 {
msg := fmt.Sprintf("%d is not a valid verbosity between 0 and 2!\n", pkg.Config.Verbosity)
pkg.PrintFatal(msg)
}
/* print copyright etc */
pkg.PrintVerbose("Published by Hackmanit under http://www.apache.org/licenses/LICENSE-2.0\n", pkg.NoColor, 1)
pkg.PrintVerbose("Author: Maximilian Hildebrand\n", pkg.NoColor, 1)
pkg.PrintVerbose("Repository: https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner\n\n", pkg.NoColor, 1)
msg := fmt.Sprintf("WCVS v%s started at %s\n", version, currentDate)
pkg.PrintVerbose(msg, pkg.NoColor, 1)
start := time.Now()
noTestPreference = true
if pkg.Config.OnlyTest != "" && pkg.Config.SkipTest != "" {
msg = "You can't set both doTest and dontTest\n"
pkg.PrintFatal(msg)
} else if pkg.Config.OnlyTest != "" {
noTestPreference = false
} else if pkg.Config.SkipTest != "" {
noTestPreference = false
}
if pkg.Config.GenerateReport {
pkg.GenerateReport(report, currentDate)
}
if pkg.Config.GenerateCompleted {
completedFile = createCompletedURLs()
}
/***************************/
/* Setting up proxy (e.g. burp), if wanted */
proxyURL = setProxy()
/*******************************************/
// Reading header wordlist, only if it is needed
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "header") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "header")) {
headerList = pkg.ReadLocalFile(pkg.Config.HeaderWordlist, "header")
}
// Reading parameter wordlist, only if it is needed
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "parameter") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "parameter")) {
parameterList = pkg.ReadLocalFile(pkg.Config.QueryWordlist, "parameter")
}
/*******************************************************/
excluded = make(map[string]bool)
for _, u := range pkg.Config.RecExclude {
u = strings.TrimSuffix(u, "\r")
u = strings.TrimSpace(u)
// check if empty or is a comment
if u == "" || strings.HasPrefix(u, "//") {
continue
}
if !strings.HasPrefix(u, "http://") && !strings.HasPrefix(u, "https://") {
msg = fmt.Sprintf("URL %s doesn't begin with http:// or https:// and gets skipped\n", u)
pkg.Print(msg, pkg.Yellow)
continue
}
excluded[u] = true
}
added = make(map[string]bool)
var testUrls []string
for _, u := range pkg.Config.Urls {
u = strings.TrimSuffix(u, "\r")
u = strings.TrimSpace(u)
// check if empty or is a comment
if u == "" || strings.HasPrefix(u, "//") {
continue
}
if !strings.HasPrefix(u, "http://") && !strings.HasPrefix(u, "https://") {
prefix := "https"
if pkg.Config.UseHTTP {
prefix = "http"
}
msg = fmt.Sprintf("URL %s gets the prefix %s\n", u, prefix)
pkg.PrintVerbose(msg, pkg.Yellow, 2)
u = prefix + "://" + u
}
added[u] = true
testUrls = append(testUrls, u)
}
for i, u := range testUrls {
var recUrls []string
var progress string
progress = fmt.Sprintf("(%d/%d)", i+1, len(testUrls))
runTests(0, u, progress, &recUrls, "sub_")
for rec := 1; rec <= pkg.Config.Recursivity; rec++ {
var urlsToAdd []string
for ii, uu := range recUrls {
if ii != 0 && ii == pkg.Config.RecLimit {
msg = "RecLimit was reached. The next URL - if available - will be tested\n"
pkg.Print(msg, pkg.NoColor)
break
}
progress = fmt.Sprintf("(%d/%d):(%d/%d)", i+1, len(testUrls), ii+1, len(recUrls))
runTests(rec, uu, progress, &urlsToAdd, "crawl_")
}
recUrls = urlsToAdd
}
}
/* Scan finished */
msg = "Successfully finished the scan\n"
pkg.PrintVerbose(msg, pkg.NoColor, 1)
duration := time.Since(start)
msg = fmt.Sprintf("Duration: %s\n\n", duration)
pkg.PrintVerbose(msg, pkg.NoColor, 1)
/****************/
if pkg.Config.GenerateReport {
report.Duration = duration.String()
pkg.GenerateReport(report, currentDate)
}
}
func runTests(rec int, u string, progress string, foundUrls *[]string, stat string) {
var repWebsite pkg.ReportWebsite
var err error
repWebsite.URL = u
msg := fmt.Sprintf("\nTesting website%s: %s\n", progress, u)
pkg.Print(msg, pkg.NoColor)
pkg.Print("===============================================================\n", pkg.NoColor)
/* Setting up client: cookies and noredirect */
msg = "Setting up client\n"
pkg.PrintVerbose(msg, pkg.NoColor, 2)
// Setting cookies, specified by setcookies
pkg.Config.Website.Cookies = []*http.Cookie{}
for _, c := range pkg.Config.Cookies {
c = strings.TrimSuffix(c, "\r")
c = strings.TrimSpace(c)
if c == "" {
continue
} else if !strings.Contains(c, "=") {
msg = "Specified cookie %s doesn't contain a = and will be skipped\n"
pkg.PrintVerbose(msg, pkg.NoColor, 2)
continue
} else {
cSlice := strings.SplitAfterN(c, "=", 2)
cSlice[0] = strings.TrimSuffix(cSlice[0], "=")
cookie := http.Cookie{
Name: cSlice[0],
Value: cSlice[1],
}
pkg.Config.Website.Cookies = append(pkg.Config.Website.Cookies, &cookie)
}
}
timeOutDuration := time.Duration(time.Duration(pkg.Config.TimeOut) * time.Second)
clientNoRedir := &http.Client{
CheckRedirect: func(redirRequest *http.Request, via []*http.Request) error {
/* Commented out, because it unnecessary bloats up logs, especially for 301/302 links
msg := fmt.Sprintf("Redirect Request denied: %s\n", redirRequest.Header)
pkg.PrintVerbose(msg, pkg.Yellow, 2)
*/
return http.ErrUseLastResponse
},
Timeout: timeOutDuration,
}
http.DefaultClient = clientNoRedir
pkg.Statistics[stat+"total"]++
// retrieve cookies, headers etc. Only setStatusCode if no cookies shall be accepted. Otherwise the next request with set Cookies sets the status code
if !pkg.Config.DeclineCookies {
pkg.Config.Website, err = pkg.GetWebsite(u, false, false)
} else {
pkg.Config.Website, err = pkg.GetWebsite(u, true, false)
}
if err != nil {
repWebsite.HasError = true
repWebsite.ErrorMessages = append(repWebsite.ErrorMessages, err.Error())
report.Websites = append(report.Websites, repWebsite)
msg := fmt.Sprintf("Couldn't test url: %s\n", err.Error())
pkg.Print(msg, pkg.Red)
pkg.Statistics[stat+"noconnection"]++
return
}
if strings.HasPrefix(pkg.Config.Website.Body, "Burp Suite") {
msg := fmt.Sprintf("Couldn't connect to given url: \n%s\n", pkg.Config.Website.Body)
pkg.Print(msg, pkg.Red)
pkg.Statistics[stat+"noconnection"]++
return
}
if !pkg.Config.DeclineCookies {
// retrieve response with all cookies set
pkg.Config.Website, err = pkg.GetWebsite(u, true, false)
if err != nil {
repWebsite.HasError = true
repWebsite.ErrorMessages = append(repWebsite.ErrorMessages, err.Error())
report.Websites = append(report.Websites, repWebsite)
msg := fmt.Sprintf("Couldn't test url: %s\n", err.Error())
pkg.Print(msg, pkg.Red)
return
}
}
// check if there's a cache and the cachebuster works
var errSlice []error
var alwaysMiss bool
pkg.Config.Website.Cache, alwaysMiss, errSlice = pkg.CheckCache(stat)
for _, err := range errSlice {
if err != nil {
repWebsite.HasError = true
repWebsite.ErrorMessages = append(repWebsite.ErrorMessages, err.Error())
}
}
/* dont return when there's an error. Because the crawler shall be run anyways. Also there might was a cachebuster found and an error for an other cachebuster which doesnt matter
if len(errSlice) > 0 && !pkg.Config.Force {
return
}
*/
// retrieve response with cachebuster if cachebuster was found
if pkg.Config.Website.Cache.CBwasFound {
pkg.Config.Website, err = pkg.GetWebsite(u, true, true)
if err != nil {
repWebsite.HasError = true
repWebsite.ErrorMessages = append(repWebsite.ErrorMessages, err.Error())
report.Websites = append(report.Websites, repWebsite)
msg := fmt.Sprintf("Couldn't test url: %s\n", err.Error())
pkg.Print(msg, pkg.Red)
pkg.Statistics[stat+"errorcachebuster"]++
return
}
}
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "decep") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "decep")) {
msg = addSeparator("Web Cache Deception")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
if alwaysMiss || pkg.Config.Website.Cache.Indicator == "" {
pkg.Statistics[stat+"deceptiontested"]++
repWebsite.Results = append(repWebsite.Results, pkg.TestWebCacheDeception())
} else {
msg = "The response already gets cached!"
pkg.Print(msg+"\n", pkg.Yellow)
}
} else {
msg = addSeparator("Skipping Web Cache Deception")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
}
/*******************************************/
if pkg.Config.Website.Cache.CBwasFound || pkg.Config.Force {
if !pkg.Config.Website.Cache.CBwasFound && pkg.Config.Force {
pkg.Print("\nNo Cachebuster was found. Forcing the parameter "+pkg.Config.CacheBuster+" as Cachebuster.", pkg.Cyan)
pkg.Config.Website.Cache.CBwasFound = true
pkg.Config.Website.Cache.CBisParameter = true
pkg.Config.Website.Cache.CBName = pkg.Config.CacheBuster
}
pkg.Statistics[stat+"poisoningtested"]++
/* Testing for cookie poisoning */
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "cookie") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "cookie")) {
msg = addSeparator("Cookie Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
repWebsite.Results = append(repWebsite.Results, pkg.ScanCookies())
if len(pkg.Config.Website.Cookies) == 0 {
msg = "There were no cookies to test!"
pkg.Print(msg+"\n", pkg.Yellow)
repWebsite.Results[len(repWebsite.Results)-1].ErrorMessages = append(repWebsite.Results[len(repWebsite.Results)-1].ErrorMessages, msg)
repWebsite.Results[len(repWebsite.Results)-1].HasError = true
}
} else {
msg = addSeparator("Skipping Cookie Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
}
/*****************************/
/* Testing for css poisoning */
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "css") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "css")) {
msg = addSeparator("CSS Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
repWebsite.Results = append(repWebsite.Results, pkg.ScanCSS())
} else {
msg = addSeparator("Skipping CSS Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
}
/*****************************/
/* Testing for multiple forwarding headers for poisoning */
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "forward") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "forward")) {
msg = addSeparator("Multiple Forwarding Headers Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
repWebsite.Results = append(repWebsite.Results, pkg.ScanForwardingHeaders())
} else {
msg = addSeparator("Skipping Multiple Forwarding Headers Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
}
/*************************************************************/
/* Testing for HTTP request smuggling poisoning */
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "smuggl") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "smuggl")) {
msg = addSeparator("HTTP Request Smuggling Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
repWebsite.Results = append(repWebsite.Results, pkg.ScanHTTPRequestSmuggling(proxyURL))
} else {
msg = addSeparator("Skipping HTTP Request Smuggling Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
}
/*************************************************************/
/* Testing for multiple Cache Poisoned Denial Of Service Techniques */
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "dos") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "dos")) {
msg = addSeparator("Cache Poisoned Denial Of Service")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
repWebsite.Results = append(repWebsite.Results, pkg.DOS())
} else {
msg = addSeparator("Skipping Cache Poisoned Denial Of Service")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
}
/***********************************************************/
/* Testing for header poisoning */
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "header") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "header")) {
msg = addSeparator("Header Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
repWebsite.Results = append(repWebsite.Results, pkg.ScanHeaders(headerList))
} else {
msg = addSeparator("Skipping Header Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
}
/********************************/
/* Testing for query parameter poisoning */
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "parameter") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "parameter")) {
msg = addSeparator("Query Parameter Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
repWebsite.Results = append(repWebsite.Results, pkg.ScanParameters(parameterList))
} else {
msg = addSeparator("Skipping Query Parameter Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
}
/*****************************************/
/* Testing for Fat GET */
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "fat") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "fat")) {
msg = addSeparator("Fat GET Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
if pkg.Config.DoPost {
msg = "Can't check for Fat GET Poisoning, because POST was specified\n"
pkg.PrintVerbose(msg, pkg.Yellow, 1)
} else {
repWebsite.Results = append(repWebsite.Results, pkg.ScanFatGET())
}
} else {
msg = addSeparator("Skipping Fat GET Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
}
/**********************/
/* Testing for Parameter Cloaking */
if noTestPreference || strings.Contains(pkg.Config.OnlyTest, "cloaking") || (pkg.Config.SkipTest != "" && !strings.Contains(pkg.Config.SkipTest, "cloaking")) {
msg = addSeparator("Parameter Cloaking Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
if pkg.Config.DoPost {
msg = "Can't check for Parameter Cloaking Poisoning, because POST was specified\n"
pkg.PrintVerbose(msg, pkg.Yellow, 1)
} else {
repWebsite.Results = append(repWebsite.Results, pkg.ScanParameterCloaking())
}
} else {
msg = addSeparator("Skipping Parameter Cloaking Poisoning")
pkg.PrintVerbose(msg, pkg.NoColor, 1)
}
/**********************************/
}
/* Check for linked files */
if pkg.Config.Recursivity > rec {
msg = fmt.Sprintf("\nChecking recursively for urls (%d/%d)\n", rec+1, pkg.Config.Recursivity)
pkg.Print(msg, pkg.NoColor)
tempUrls := pkg.CrawlUrls(added, excluded)
if len(tempUrls) > 0 {
msg = fmt.Sprintf("Found %d urls", len(tempUrls))
pkg.Print(msg, pkg.NoColor)
msg = "Adding the following urls to the Queue:"
pkg.PrintVerbose(msg, pkg.NoColor, 1)
pkg.PrintVerbose("\n", pkg.NoColor, 0)
for _, u := range tempUrls {
pkg.PrintVerbose(u+"\n", pkg.NoColor, 1)
}
*foundUrls = append(*foundUrls, tempUrls...)
} else {
msg = "No urls were found to add to the queue"
pkg.Print(msg, pkg.NoColor)
}
}
/**************************/
if pkg.Config.GenerateCompleted {
_, err = completedFile.WriteString(u + "\n")
if err != nil {
pkg.Print("Couldn't write to WCVS_Completed File: %s\n"+err.Error(), pkg.Red)
}
}
if pkg.Config.GenerateReport {
for _, r := range repWebsite.Results {
if r.Vulnerable {
repWebsite.Vulnerable = true
break
}
}
report.Websites = append(report.Websites, repWebsite)
report.Vulnerable = report.Vulnerable || repWebsite.Vulnerable
pkg.PrintNewLine()
pkg.GenerateReport(report, currentDate)
}
pkg.Print("===============================================================\n\n", pkg.NoColor)
}
func addSeparator(msg string) string {
separator := " --------------------------------------------------------------"
return fmt.Sprintf("\n%s\n| %s\n%s\n", separator, msg, separator)
}
func createCompletedURLs() *os.File {
completedPath := pkg.Config.GeneratePath + currentDate + "_WCVS_Completed"
_, err := os.Stat(completedPath)
var file *os.File
defer file.Close()
if !os.IsNotExist(err) {
msg := fmt.Sprintf("The file %s will be overwritten, as it already exists\n", completedPath)
pkg.PrintVerbose(msg, pkg.Yellow, 1)
file, err = os.OpenFile(completedPath, os.O_WRONLY, 0666)
} else {
file, err = os.Create(completedPath)
}
if err != nil {
msg := "Couldn't create WCVS_Completed file: " + err.Error() + "\n"
pkg.PrintFatal(msg)
}
return file
}
/* Setting proxy with specified proxyURL and proxyCertPath */
func setProxy() *url.URL {
if pkg.Config.ProxyCertPath != "" {
proxyURL, err := url.Parse(pkg.Config.ProxyURL)
if err != nil {
msg := "setProxy: url.Parse: " + err.Error() + "\n"
pkg.PrintFatal(msg)
}
caCert, err := os.ReadFile(pkg.Config.ProxyCertPath)
if err != nil {
msg := "setProxy: ioutil.ReadFile: " + err.Error() + "\n"
pkg.PrintFatal(msg)
}
//caCertPool,err := x509.SystemCertPool()
// führt zu crypto/x509: system root pool is not available on Windows
caCertPool := x509.NewCertPool()
ok := caCertPool.AppendCertsFromPEM(caCert)
if !ok {
msg := "setProxy: could not append cert\n"
pkg.PrintFatal(msg)
}
tlsConfig := &tls.Config{RootCAs: caCertPool,
InsecureSkipVerify: true}
tr := &http.Transport{
Proxy: http.ProxyURL(proxyURL),
TLSClientConfig: tlsConfig}
err = http2.ConfigureTransport(tr)
if err != nil {
msg := fmt.Sprintf("setProxy: Cannot switch to HTTP2: %s\n", err.Error())
pkg.PrintFatal(msg)
}
http.DefaultTransport = tr
return proxyURL
} else {
tlsConfig := &tls.Config{InsecureSkipVerify: true}
tr := &http.Transport{
TLSClientConfig: tlsConfig}
http.DefaultTransport = tr
return nil
}
}
Web-Cache-Vulnerability-Scanner-1.3.3/wordlists/ 0000775 0000000 0000000 00000000000 14732751445 0021520 5 ustar 00root root 0000000 0000000 Web-Cache-Vulnerability-Scanner-1.3.3/wordlists/headers 0000664 0000000 0000000 00000041034 14732751445 0023060 0 ustar 00root root 0000000 0000000 __requesturi
__requestverb
accept
accept-application
accept-charset
accept-encoding
accept-encodxng
accept-language
accept-ranges
accept-version
accepted
access-control-allow-credentials
access-control-allow-headers
access-control-allow-methods
access-control-allow-origin
access-control-expose-headers
access-control-max-age
access-control-request-headers
access-control-request-method
access-token
accesskey
action
admin
age
ajax
akamai-origin-hop
allow
alt-used
app
app-env
app-key
appcookie
apply-to-redirect-ref
appname
appversion
atcept-language
auth
auth-any
auth-basic
auth-digest
auth-digest-ie
auth-gssneg
auth-key
auth-ntlm
auth-password
auth-realm
auth-type
auth-user
authentication
authorization
bad-gateway
bad-request
bae-env-addr-bcms
bae-env-addr-bcs
bae-env-addr-bus
bae-env-addr-channel
bae-env-addr-sql-ip
bae-env-addr-sql-port
bae-env-ak
bae-env-appid
bae-env-sk
bae-logid
bar
base
base-url
basic
bearer-indication
body-maxlength
body-truncated
brief
browser-user-agent
cache-control
cache-info
case-files
catalog
catalog-server
category
cert-cookie
cert-flags
cert-issuer
cert-keysize
cert-secretkeysize
cert-serialnumber
cert-server-issuer
cert-server-subject
cert-subject
cf-connecting-ip
cf-ipcountry
cf-template-path
cf-visitor
ch
challenge-response
charset
chunk-size
client
client-address
client-bad-request
client-conflict
client-error-cannot-access-local-file
client-error-cannot-connect
client-error-communication-failure
client-error-connect
client-error-invalid-parameters
client-error-invalid-server-address
client-error-no-error
client-error-protocol-failure
client-error-unspecified-error
client-expectation-failed
client-forbidden
client-gone
client-ip
client-length-required
client-method-not-allowed
client-not-acceptable
client-not-found
client-payment-required
client-precondition-failed
client-proxy-auth-required
client-quirk-mode
client-request-timeout
client-request-too-large
client-request-uri-too-large
client-requested-range-not-possible
client-unauthorized
client-unsupported-media-type
clientaddress
clientip
cloudfront-viewer-country
cloudinary-name
cloudinary-public-id
cloudinary-version
cloudinaryurl
code
coming-from
command
compress
conflict
connection
connection-type
contact
content
content-disposition
content-encoding
content-language
content-length
content-location
content-md5
content-range
content-security-policy
content-security-policy-report-only
content-type
content-type-xhtml
context-path
continue
cookie
cookie-domain
cookie-httponly
cookie-parse-raw
cookie-path
cookie-secure
cookie-vars
cookie2
cookies
core-base
created
credentials-filepath
curl
curl-multithreaded
custom-header
custom-secret-header
dataserviceversion
date
debug
deflate-level-def
deflate-level-max
deflate-level-min
deflate-strategy-def
deflate-strategy-filt
deflate-strategy-fixed
deflate-strategy-huff
deflate-strategy-rle
deflate-type-gzip
deflate-type-raw
deflate-type-zlib
delete
depth
destination
destroy
devblocksproxybase
devblocksproxyhost
devblocksproxyssl
device-stock-ua
digest
dir
dir-name
dir-resource
disable-gzip
dkim-signature
dnt
download-attachment
download-bad-url
download-bz2
download-cut-short
download-e-headers-sent
download-e-invalid-archive-type
download-e-invalid-content-type
download-e-invalid-file
download-e-invalid-param
download-e-invalid-request
download-e-invalid-resource
download-e-no-ext-mmagic
download-e-no-ext-zlib
download-inline
download-mime-type
download-no-server
download-size
download-status-not-found
download-status-server-error
download-status-unauthorized
download-status-unknown
download-tar
download-tgz
download-url
download-zip
e-encoding
e-header
e-invalid-param
e-malformed-headers
e-message-type
e-querystring
e-request
e-request-method
e-request-pool
e-response
e-runtime
e-socket
e-url
enable-gzip
enable-no-cache-headers
encoding-stream-flush-full
encoding-stream-flush-none
encoding-stream-flush-sync
env-silla-environment
env-vars
error
error-1
error-2
error-3
error-4
error-formatting-html
espo-authorization
espo-cgi-auth
etag
eve-charid
eve-charname
eve-solarsystemid
eve-solarsystemname
eve-trusted
ex-copy-movie
expect
expectation-failed
expires
ext
failed-dependency
fake-header
fastly-client-ip
fb-appid
fb-secret
file-not-found
filename
files
files-vars
fire-breathing-dragon
foo
foo-bar
forbidden
force-language
force-local-xhprof
format
forwarded
forwarded-for
forwarded-for-ip
forwarded-proto
from
fromlink
front-end-https
gateway-interface
gateway-time-out
get
get-vars
givenname
global-all
global-cookie
global-get
global-post
gone
google-code-project-hosting-hook-hmac
gzip-level
h0st
head
header
header-lf
header-status-client-error
header-status-informational
header-status-redirect
header-status-server-error
header-status-successful
home
host
host-liveserver
host-name
host-unavailable
hosti
htaccess
http-accept
http-accept-encoding
http-accept-language
http-authorization
http-connection
http-cookie
http-host
http-phone-number
http-referer
http-url
http-user-agent
http_sm_authdirname
http_sm_authdirnamespace
http_sm_authdiroid
http_sm_authdirserver
http_sm_authreason
http_sm_authtype
http_sm_dominocn
http_sm_realm
http_sm_realmoid
http_sm_sdomain
http_sm_serveridentityspec
http_sm_serversessionid
http_sm_serversessionspec
http_sm_sessiondrift
http_sm_timetoexpire
http_sm_transactionid
http_sm_universalid
http_sm_user
http_sm_userdn
http_sm_usermsg
https
https-from-lb
https-keysize
https-secretkeysize
https-server-issuer
https-server-subject
if
if-match
if-modified-since
if-modified-since-version
if-none-match
if-posted-before
if-range
if-unmodified-since
if-unmodified-since-version
image
images
incap-client-ip
info
info-download-size
info-download-time
info-return-code
info-total-request-stat
info-total-response-stat
insufficient-storage
internal-server-error
ipresolve-any
ipresolve-v4
ipresolve-v6
ischedule-version
iv-groups
iv-user
jenkins
keep-alive
kiss-rpc
large-allocation
last-event-id
last-modified
length-required
link
local-addr
local-content-sha1
local-dir
location
lock-token
locked
mail
max-conn
max-forwards
max-request-size
max-uri-length
maxdataserviceversion
message
message-b
meth-
meth-acl
meth-baseline-control
meth-checkin
meth-checkout
meth-connect
meth-copy
meth-delete
meth-get
meth-head
meth-label
meth-lock
meth-merge
meth-mkactivity
meth-mkcol
meth-mkworkspace
meth-move
meth-options
meth-post
meth-propfind
meth-proppatch
meth-put
meth-report
meth-trace
meth-uncheckout
meth-unlock
meth-update
meth-version-control
method
method-not-allowed
mimetype
mod-env
mod-rewrite
mod-security-message
modauth
mode
module-class
module-class-path
module-name
moved-permanently
moved-temporarily
ms-asprotocolversion
msg-none
msg-request
msg-response
msisdn
multi-status
multipart-boundary
multiple-choices
my-header
mysqlport
native-sockets
nl
no-content
non-authoritative
nonce
not-acceptable
not-exists
not-extended
not-found
not-implemented
not-modified
notification-template
oc-chunked
ocs-apirequest
ok
on-behalf-of
onerror-continue
onerror-die
onerror-return
opencart
options
organizer
orig_path_info
origin
originator
overwrite
params-allow-comma
params-allow-failure
params-default
params-get-catid
params-get-currentday
params-get-disposition
params-get-downwards
params-get-givendate
params-get-lang
params-get-type
params-raise-error
partial-content
passkey
password
path
path-base
path-info
path-themes
path-translated
payment-required
pc-remote-addr
phone-number
php
php-auth-pw
php-auth-user
phpthreads
pink-pony
port
portsensor-auth
post
post-error
post-files
post-vars
postredir-301
postredir-302
postredir-all
pragma
pragma-no-cache
precondition-failed
prefer
processing
profile
protocol
protocols
proxy
proxy-agent
proxy-authenticate
proxy-authentication-required
proxy-authorization
proxy-connection
proxy-host
proxy-http
proxy-http-1-0
proxy-password
proxy-port
proxy-pwd
proxy-request-fulluri
proxy-socks4
proxy-socks4a
proxy-socks5
proxy-socks5-hostname
proxy-url
proxy-user
public-key-pins
public-key-pins-report-only
pull
put
query-string
querystring
querystring-type-array
querystring-type-bool
querystring-type-float
querystring-type-int
querystring-type-object
querystring-type-string
range
range-not-satisfiable
raw-post-data
read-state-begin
read-state-body
read-state-headers
real-ip
real-method
reason
reason-phrase
recipient
redirect
redirect-found
redirect-perm
redirect-post
redirect-problem-withoutwww
redirect-problem-withwww
redirect-proxy
redirect-temp
redirected-accept-language
redirection-found
redirection-multiple-choices
redirection-not-modified
redirection-permanent
redirection-see-other
redirection-temporary
redirection-unused
redirection-use-proxy
ref
referer
referrer
referrer-policy
refferer
refresh
remix-hash
remote-addr
remote-host
remote-host-wp
remote-user
remote-userhttps
report-to
request
request-entity-too-large
request-error
request-error-file
request-error-gzip-crc
request-error-gzip-data
request-error-gzip-method
request-error-gzip-read
request-error-proxy
request-error-redirects
request-error-response
request-error-url
request-http-ver-1-0
request-http-ver-1-1
request-mbstring
request-method
request-method-
request-method-delete
request-method-get
request-method-head
request-method-options
request-method-post
request-method-put
request-method-trace
request-time-out
request-timeout
request-uri
request-uri-too-large
request-vars
request2-tests-base-url
request2-tests-proxy-host
requesttoken
reset-content
response
rest-key
rest-sign
retry-after
returned-error
rlnclientipaddr
root
safe-ports-list
safe-ports-ssl-list
schedule-reply
scheme
script-name
sec-websocket-accept
sec-websocket-extensions
sec-websocket-key
sec-websocket-key1
sec-websocket-key2
sec-websocket-origin
sec-websocket-protocol
sec-websocket-version
secretkey
see-other
self
send-x-frame-options
server
server-bad-gateway
server-error
server-gateway-timeout
server-internal
server-name
server-not-implemented
server-port
server-port-secure
server-protocol
server-service-unavailable
server-software
server-unsupported-version
server-vars
server-varsabantecart
service-unavailable
session-id-tag
session-vars
set-cookie
set-cookie2
shib-
shib-application-id
shib-identity-provider
shib-logouturl
shopilex
slug
sn
soapaction
socket-connection-err
socketlog
somevar
sourcemap
sp-client
sp-host
ssl
ssl-https
ssl-offloaded
ssl-session-id
ssl-version-any
sslsessionid
status
status-
status-403
status-403-admin-del
status-404
status-bad-request
status-code
status-forbidden
status-ok
status-platform-403
str-match
strict-transport-security
success-accepted
success-created
success-no-content
success-non-authoritative
success-ok
success-partial-content
success-reset-content
support
support-encodings
support-events
support-magicmime
support-requests
support-sslrequests
surrogate-capability
switching-protocols
te
temporary-redirect
test
test-config
test-server-path
test-something-anything
ticket
time-out
timeout
timing-allow-origin
title
tk
tmp
token
trailer
transfer-encoding
translate
transport-err
true-client-ip
ua
ua-color
ua-cpu
ua-os
ua-pixels
ua-resolution
ua-voice
unauthorized
unencoded-url
unit-test-mode
unless-modified-since
unprocessable-entity
unsupported-media-type
upgrade
upgrade-insecure-requests
upgrade-required
upload-default-chmod
uri
url
url-from-env
url-join-path
url-join-query
url-replace
url-sanitize-path
url-strip-
url-strip-all
url-strip-auth
url-strip-fragment
url-strip-pass
url-strip-path
url-strip-port
url-strip-query
url-strip-user
use-gzip
use-proxy
user
user-agent
user-agent-via
user-email
user-id
user-mail
user-name
user-photos
useragent
useragent-via
util
variant-also-varies
vary
verbose
verbose-throttle
verify-cert
version
version-1-0
version-1-1
version-any
version-none
version-not-supported
versioncode
via
viad
wap-connection
warning
web-server-api
webodf-member-id
webodf-session-id
webodf-session-revision
work-directory
www-address
www-authenticate
x
x-
x-aastra-expmod1
x-aastra-expmod2
x-aastra-expmod3
x-accel-mapping
x-access-token
x-advertiser-id
x-ajax-real-method
x-alto-ajax-keyz
x-amz-date
x-amz-website-redirect-location
x-amzn-remapped-host
x-api-key
x-api-signature
x-api-timestamp
x-apitoken
x-apple-client-application
x-apple-store-front
x-arr-log-id
x-arr-ssl
x-att-deviceid
x-auth-key
x-auth-mode
x-auth-password
x-auth-service-provider
x-auth-token
x-auth-user
x-auth-userid
x-auth-username
x-authentication
x-authentication-key
x-authorization
x-avantgo-screensize
x-azc-remote-addr
x-bear-ajax-request
x-bluecoat-via
x-bolt-phone-ua
x-browser-height
x-browser-width
x-cascade
x-cept-encoding
x-cf-url
x-chrome-extension
x-cisco-bbsm-clientip
x-client-host
x-client-id
x-client-ip
x-client-key
x-client-os
x-client-os-ver
x-clientip
x-cluster-client-ip
x-codeception-codecoverage
x-codeception-codecoverage-config
x-codeception-codecoverage-debug
x-codeception-codecoverage-suite
x-collect-coverage
x-coming-from
x-confirm-delete
x-content-type
x-content-type-options
x-credentials-request
x-csrf-crumb
x-csrf-token
x-csrftoken
x-cuid
x-custom
x-dagd-proxy
x-davical-testcase
x-dcmguid
x-debug-test
x-device-user-agent
x-dialog
x-dns-prefetch-control
x-do-not-track
x-dokuwiki-do
x-drestcg
x-dsid
x-elgg-apikey
x-elgg-hmac
x-elgg-hmac-algo
x-elgg-nonce
x-elgg-posthash
x-elgg-posthash-algo
x-elgg-time
x-em-uid
x-enable-coverage
x-environment-override
x-expected-entity-length
x-experience-api-version
x-fb-user-remote-addr
x-file-id
x-file-name
x-file-resume
x-file-size
x-file-type
x-filename
x-firelogger
x-fireloggerauth
x-firephp-version
x-flash-version
x-flx-consumer-key
x-flx-consumer-secret
x-flx-redirect-url
x-foo
x-foo-bar
x-forward-for
x-forward-proto
x-forwarded
x-forwarded-by
x-forwarded-for
x-forwarded-for-original
x-forwarded-host
x-forwarded-port
x-forwarded-proto
x-forwarded-protocol
x-forwarded-scheme
x-forwarded-server
x-forwarded-ssl
x-forwarder-for
x-from
x-gb-shared-secret
x-geoip-country
x-get-checksum
x-helpscout-event
x-helpscout-signature
x-hgarg-
x-host
x-http-destinationurl
x-http-host-override
x-http-method
x-http-method-override
x-http-path-override
x-http-status-code-override
x-https
x-htx-agent
x-huawei-userid
x-hub-signature
x-if-unmodified-since
x-imbo-test-config
x-insight
x-ip
x-ip-trail
x-iwproxy-nesting
x-jphone-color
x-jphone-display
x-jphone-geocode
x-jphone-msname
x-jphone-uid
x-json
x-kaltura-remote-addr
x-known-signature
x-known-username
x-litmus
x-litmus-second
x-locking
x-machine
x-mandrill-signature
x-method-override
x-mobile-gateway
x-mobile-ua
x-mosso-dt
x-moz
x-ms-policykey
x-msisdn
x-myqee-system-debug
x-myqee-system-hash
x-myqee-system-isadmin
x-myqee-system-isrest
x-myqee-system-pathinfo
x-myqee-system-project
x-myqee-system-rstr
x-myqee-system-time
x-network-info
x-nfsn-https
x-ning-request-uri
x-nokia-bearer
x-nokia-connection-mode
x-nokia-gateway-id
x-nokia-ipaddress
x-nokia-msisdn
x-nokia-wia-accept-original
x-nokia-wtls
x-nuget-apikey
x-oc-mtime
x-opera-info
x-operamini-features
x-operamini-phone
x-operamini-phone-ua
x-options
x-orange-id
x-orchestra-scheme
x-orig-client
x-original-host
x-original-http-command
x-original-remote-addr
x-original-url
x-original-user-agent
x-originally-forwarded-for
x-originally-forwarded-proto
x-originating-ip
x-os-prefs
x-overlay
x-pagelet-fragment
x-password
x-phabricator-csrf
x-phpbb-using-plupload
x-pjax
x-pjax-container
x-prototype-version
x-proxy-url
x-pswd
x-purpose
x-qafoo-profiler
x-real-ip
x-remote-addr
x-remote-protocol
x-render-partial
x-request
x-request-id
x-request-signature
x-request-start
x-request-timestamp
x-requested-with
x-response-format
x-rest-cors
x-rest-password
x-rest-username
x-rewrite-url
x-sakura-forwarded-for
x-scalr-auth-key
x-scalr-auth-token
x-scalr-env-id
x-scheme
x-screen-height
x-screen-width
x-sendfile-type
x-serial-number
x-serialize
x-server-id
x-server-name
x-server-port
x-signature
x-sina-proxyuser
x-skyfire-phone
x-skyfire-screen
x-ssl
x-subdomain
x-te
x-teamsite-preremap
x-test-session-id
x-tine20-jsonkey
x-tine20-request-type
x-tomboy-client
x-tor
x-twilio-signature
x-ua-device
x-ucbrowser-device-ua
x-uidh
x-unique-id
x-uniquewcid
x-up-calling-line-id
x-up-devcap-iscolor
x-up-devcap-post-charset
x-up-devcap-screendepth
x-up-devcap-screenpixels
x-up-subno
x-update
x-update-range
x-upload-maxresolution
x-upload-name
x-upload-size
x-upload-type
x-url-scheme
x-user
x-user-agent
x-username
x-varnish
x-verify-credentials-authorization
x-vodafone-3gpdpcontext
x-wap-client-sdu-size
x-wap-clientid
x-wap-gateway
x-wap-network-client-ip
x-wap-network-client-msisdn
x-wap-profile
x-wap-proxy-cookie
x-wap-session-id
x-wap-tod
x-wap-tod-coded
x-whatever
x-wikimedia-debug
x-wp-nonce
x-wp-pjax-prefetch
x-ws-api-key
x-xc-schema-version
x-xhprof-debug
x-xhr-referer
x-xmlhttprequest
x-xpid
x-zikula-ajax-token
x-zotero-version
x-ztgo-bearerinfo
xauthorization
xonnection
xpdb-debugger
xproxy
xroxy-connection
xxx-real-ip
xxxxxxxxxxxxxxx
y
zotero-api-version
zotero-write-token Web-Cache-Vulnerability-Scanner-1.3.3/wordlists/parameters 0000664 0000000 0000000 00000151577 14732751445 0023626 0 ustar 00root root 0000000 0000000 id
user
account
number
order
no
doc
key
email
group
profile
edit
report
daemon
upload
dir
execute
download
log
ip
cli
cmd
file
document
folder
root
path
pg
style
pdf
template
php_path
select
role
update
query
name
sort
where
search
params
process
row
view
table
from
sel
results
sleep
fetch
keyword
column
field
delete
string
filter
dest
redirect
uri
continue
url
window
next
data
reference
site
html
val
validate
domain
callback
return
page
feed
host
port
to
out
show
navigation
open
preview
activity
content
access
admin
dbg
debug
grant
test
alter
clone
create
disable
enable
exec
load
make
modify
rename
reset
shell
utm_source
utm_medium
utm_campaign
utm_term
utm_content
toggle
adm
cfg
config
action
_method
password
type
username
title
code
q
submit
token
message
t
c
mode
lang
p
status
start
charset
description
s
post
excerpt
login
comment
step
ajax
state
f
error
save
format
tab
offset
a
limit
do
plugin
theme
text
language
height
logout
pass
h
value
filename
year
version
subject
m
u
confirm
width
w
size
date
source
GLOBALS
op
method
uid
tag
category
target
ids
term
new
locale
author
paged
cat
msg
add
d
day
nonce
captcha
output
revision
i
xml
db
time
section
image
r
files
tags
users
send
updated
skips
n
check
orderby
num
import
prefix
fields
pwd
pid
month
module
parent
cancel
activate
checked
success
desc
case
remove
position
location
extra
count
b
rating
pass2
hostname
move
hash
dry
cid
body
src
level
generate
g
dbname
option
userid
sql
options
address
activated
action2
password2
pass1
meta
ID
deleted
act
e
taxonomy
ref
publish
secret
app
rememberme
country
phone
hidden
force
export
sticky
nickname
v
plugins
locked
command
returnUrl
item
amount
timestamp
server
signature
part
json
del
comments
visible
LoginForm
keywords
enabled
base
refresh
foo
y
media
info
guid
dt
x
testdata
list
visibility
User
thumb
stage
history
timezone
upgrade
menu
items
class
blog
link
end
dbhost
approved
stylesheet
sid
settings
postid
deactivate
closed
posted
noheader
ContactForm
tax
ss
inline
gid
attachments
added
replytocom
dismiss
clear
city
spam
request
all
sidebar
dbuser
checkbox
short
active
session
registration
hh
price
nsql
mm
loggedout
lastname
SMALLER
saved
rsd
ps
newcontent
mn
linkurl
jj
install
hidem
firstname
detached
color
clearsql
checkemail
BIGGER
aa
slug
remember
referrer
reason
o
note
referredby
l
deletepost
dbpass
attached
tid
testcookie
noredir
newcat
monthnum
metakeyinput
insertonlybutton
input
form
failure
down
deletemeta
deletecomment
context
backto
undismiss
sitename
service
resetheader
print
phperror
oitar
metavalue
metakeyselect
mail
liveupdate
linkcheck
deletebookmarks
changeit
answers
addmeta
trashed
fid
back
selection
mod
label
img
features
direction
uname
sidebars
hide
auth
untrashed
task
submitted
database
addnew
Submit
purge
notes
editwidget
removewidget
nrows
groups
disabled
zip
trash
repair
overwrite
referer
themes
mid
defaults
custom
ctype
widget
topic
main
js
blogname
untrash
unspammed
unspam
spammed
selectall
quantity
newuser
networkwide
invalid
index
function
screen
reply
lat
gender
find
display
directory
batch
alt
set
scrollto
fwidth
fheight
sub
same
rows
reauth
notify
confirmdelete
autosave
aid
vote
review
keys
destination
allusers
passwd
change
apage
allblogs
private
noapi
charsout
catslist
categories
up
subscribe
script
removeheader
pos
period
nocache
kill
columns
api
z
sortby
register
recovered
pagenum
last
event
customized
attachment
answer
welcome
timeout
scope
rid
result
public
payload
ns
mobile
css
align
what
rank
qqfile
max
createuser
background
avatar
alias
total
question
priority
days
cache
skin
schema
orientation
groupid
done
summary
skipped
range
go
dump
confirmation
CKEditorFuncNum
changes
ticket
pw
pointer
param
first
entry
drop
default
selected
popup
owner
nolog
nochange
length
goto
company
Comment
close
website
st
skip
restart
pages
node
localize
fname
except
Type
restore
profiler
previewed
password1
NewFolderName
lng
left
layout
k
fn
flag
doaction2
details
currency
copy
compare
broken
block
paper
line
jax
icon
flush
fileName
dl
controller
catid
PayerID
newname
flash
decomposition
confirmed
chromeless
bid
yes
weight
verify
values
run
route
replace
read
project
Post
PHPSESSID
nid
md5
map
logopng
listInfo
letter
hour
fullname
exclude
dbprefix
authors
zoom
userId
trigger
setting
rs
provider
package
operation
ok
object
mark
lid
invoice
insertonly
full
forum
err
doit
backup
ac
sent
phpThumbDebug
photo
interval
editor
echostr
channel
args
agree
WPLANG
userspage
usersearch
triggers
insert
inc
homepage
hello
func
duration
did
cookie
contact
chunk
apply
terms
tables
startdate
shortcode
scale
reverse
required
origin
indexes
identifier
hashed
fontcolor
databases
approve
advanced
webfile
urls
types
toggledisplay
subaction
sortorder
sign
sEcho
searchtype
saveasdraft
rss
recipient
prev
notice
njlowercolor
njform
njfontcolor
members
member
md5s
init
hs
headerimage
header
fontdisplay
finish
fax
engine
current
client
cc
callf
article
ver
ts
roles
region
raw
qid
old
nick
model
lon
lock
iDisplayLength
ext
expire
enddate
empty
chunks
album
userselect
userName
telephone
stats
saveauthors
right
revert
response
news
lname
images
highlight
frob
embed
denied
dccharset
contents
compress
Command
area
aim
accept
vid
unit
undeleted
thread
textinputs
textcolor
store
sqlite
showall
rsargs
reload
record
posts
pagenow
override
opt
opname
job
idx
help
groupname
filters
fileid
expand
entity
cp
clean
caption
apikey
verbose
var
tpl
topics
top
tablename
sSearch
sex
separator
scripts
rules
rt
rate
product
prepopulate
pgtIou
pgtId
pgsql
permissions
oracle
oldpass
mssql
modules
labels
get
foldername
family
delimiter
CurrentFolder
choice
box
autologin
age
again
actions
wysiwyg
word
userID
unsort
uninstall
unfoldmenu
support
startDate
standalone
since
score
runtests
regex
published
proxy
points
phrase
oldpassword
oid
noajax
newpassword
newName
minute
mac
langCode
iDisplayStart
genre
From
font
emails
eid
dst
device
demo
deletefile
cropDetails
connection
collation
cms
attributes
attribute
as
adduser
zone
zipcode
words
viewtype
usr
To
ssl
single
sendmail
protocol
phpinfo
perpage
newsletter
newsid
names
Name
min
logoutRequest
logo
interface
frequency
firstName
dbName
criteria
by
button
break
bg
ban
authorize
artist
allow
un
stripeToken
resize
replyto
remote
random
products
pic
perms
parentid
original
opener
namespace
mime
loc
lastName
jabber
global
forums
foo1
FileName
endpoint
Email
detail
descr
deny
delall
customer
copyright
compression
collection
address2
yim
week
unsubscribe
truncate
tableName
speed
sortOrder
sig
share
servername
sections
room
resource
req
qty
perm
orderid
operator
noconfirmation
newFileName
makedoc
license
graph
frame
duplicate
discount
created
clearcache
CKEditor
auto
after
about
wsdl
video
uploaded
unban
thumbnail
subtitle
stop
startIndex
sorttype
snippet
silent
sessionid
sequence
sender
searchTerm
sd
sc
rule
reg
redir
quote
prune
productid
popupurl
popuptitle
pageid
oc
nom
newpass
memo
maxResults
iSortingCols
gateway
for
feedback
fcksource
extension
draft
dev
deleteall
csv
business
board
address1
addr
addgroup
who
unread
ttl
temp
tagid
sure
subpage
stat
showThumbs
setup
res
queryType
postcode
permission
pending
pattern
passkey
nr
match
jsonp
itemid
invites
invite
foo6
foo2
filetype
fc
encoding
enc
em
element
discard
delay
def
dbpassword
currentFolder
course
commit
cols
challenge
call
branch
blogid
banned
array
archive
web
unlock
uniqid
txt
twitter
todo
threadid
team
system
storage
STATUS
sites
rollback
resettext
repeat
rem
receiver
rebuild
rebroadcast
re
quality
qq
Profile
privileges
primary
poll
Password
parameters
os
orderbydate
opauth
messages
maintenance
long
links
ignore
handler
forward
fileext
endDate
driver
docroot
deletepage
d2
cron
control
configure
conditions
Collation
codepress
chart
bitrate
barcode
AuthItemForm
assign
adminpass
write
watch
switch
subtype
street
str
siteurl
shipping
salt
rev
returnto
repo
rel
RegistrationForm
r2
pre
player
place
pk
person
permalink
pc
payment
pagename
other
openid
notifications
nojs
newPassword
newdir
network
multi
mailbox
lowercase
layer
jsoncallback
itemName
isbn
iid
grade
game
expires
expiration
encode
edited
dropped
domains
dept
dbtype
conf
col
cname
char
browse
bio
banner
balance
asc
anonymous
announcement
xmldump
UserRecoveryForm
UserLogin
UserChangePassword
USER
updates
tx
tweet
trust
track
topicid
tool
timeformat
tb
step2
ssid
sendto
season
Search
schedule
scan
sa
repassword
reinstall
realname
radius
px
proxyuser
ProfileField
pmid
pm
picture
paymentType
param2
nopass
newfolder
mysql
multiple
Message
longitude
logtype
loader
latitude
languages
join
ipaddress
instance
iframe
id2
hours
home
groupId
gallery
ftp
friends
footer
fld
fieldtype
feature
fail
explain
episode
email2
EaseTemplateVer
distance
dirname
depth
delfile
decode
dbport
crop
cost
connect
confirmpassword
com
co
chk
child
categoryid
Body
birthdate
begin
before
BackURL
avatars
autofocus
authenticate
at
aname
agreement
adminname
activkey
xajax
viewonline
unwatch
ui
typeid
th
templateid
targets
tagged
sw
super
subname
subform
subdir
strings
strict
statistics
starttime
spec
sord
snapshot
side
sh
serial
second
rewrite
retry
realm
rand
profiling
previous
preset
poster
policies
pn
platform
placement
pin
pID
php
parentID
pagination
pagesize
p2
p1
oldPassword
name2
msn
moved
monitor
migrate
merge
maxage
mask
manufacturer
ls
loginname
ld
Lang
kid
include
idSelect
hook
goback
fs
frontpage
fontsize
filepath
Filename
filecontent
featured
fav
failed
extend
eventId
eventid
endtime
editid
div
delivery
dbUser
dbsize
dbPassword
DATA
dashboard
cursor
container
component
compact
colors
collapse
characters
ch
cats
cart
calendar
C
browser
brand
birthday
bcc
attr
apps
ad
zid
xajaxargs
which
warned
venue
uuid
usuario
usesubform
unique
undelete
uids
tz
torrent
titles
templates
templatename
targetid
TableList
syear
svg
suser
suffix
subtotal
submitorderby
submitoptions
State
staff
special
sortBy
sorder
sname
sm
sitemap
siteid
simpledb
signin
sidx
sID
ShowFunctionFields
shoutbox
sec
sample
revokeall
resume
resetpasskey
regenerate
recursive
recover
recipients
receipt
quota
quiet
queue
publisher
progress
program
problem
postsperpage
postId
pollid
playlist
paymentAmount
passphrase
pagetitle
pageSize
pageno
pageID
padding
otp
onserver
obfuscate
newvalue
newDir
mongo
moderator
modal
mimetype
mID
ma
lst
loop
lookup
loggedin
lastID
issue
intro
in
idp
head
handle
gz
groupID
gift
gID
funcs
fulltext
folderid
flags
fill
fieldname
feedurl
feeds
errors
entries
elastic
dontlimitchars
donor
dob
displayname
disp
des
department
delmarked
dbusername
dbstats
dateformat
crypt
credit
createview
cpu
cover
coppa
contentType
complete
Comments
commentid
cID
catorder
book
authkey
attach
articles
appname
appid
append
and
analyze
agreed
agent
adress
adminmail
addfolder
addcomment
accountid
y2
x2
WriteTags
with
wipe
why
wctx
vp
videoType
vcode
vbrmethod
userrole
userpass
Username
useremail
userdata
unsynchronizedtags
unstick
unsecuresubmit
unbookmark
ua
typ
tv
tree
transfer
trackzero
TracksTotal
tracknoalbum
trackinalbum
Track
trace
tot
torrentid
Toolbar
TOKEN
todate
titlefeat
tipo
thumbs
tel
tc
tagtypes
tagname
TagFormatsToWrite
synchronizetagsfrom
sum
subdomain
stype
stub
struct
stock
stick
static
srv
split
sp
sn
smtp
sku
Skin
signout
showwysiwyg
showtagfiles
ShowMD5
showfiles
shadow
selector
securesubmit
searchtext
searchKey
savemode
saveid
saveField
SAMLResponse
samemix
rpp
rolename
rights
returnURL
returnurl
restrict
resolve
rescanerrors
reorder
renamefileto
reminder
rememberMe
relative
recent
realName
radio
quickmod
qa
pw2
psubmit
properties
projects
proceed
privacy
pretty
pname
phase
persistent
permanent
percent
pay
PASSWORD
passwd2
partial
paid
orderId
oID
npassword
notmodrewrite
notapache
nonemptycomments
noalert
newUser
newscan
newpw
newpass2
newpage
newfile
msgid
mrpage
more
money
moduleName
mlpage
mkdir
missingtrackvolume
minutes
minor
mensaje
md5datadupes
manager
m3utitle
m3ufilename
m3uartist
m3u
longurl
logs
Login
ln
lists
listid
listdirectory
linktype
lines
like
lib
KEY
itemType
itemId
isAjax
int
initial
grp
groupName
GenreOther
genredistribution
Genre
fullfolder
framed
formName
formid
formatdistribution
foldmenu
flip
fixid3v1padding
filetypelist
filesize
filenamepattern
filelist
fileextensions
fieldValue
fieldName
fieldid
fID
feid
extended
extAction
existing
ex
events
eventName
errorswarnings
encoderoptionsdistribution
encodedbydistribution
emptygenres
emailAddress
emailaddress
edituser
dp
displayName
disallow
dirs
dictionary
deleteid
defaultValue
deadfilescheck
deactivated
dd
dbType
dates
ctf
createdb
Country
correctcase
copied
cookies
convert
contactname
confirmPassword
configuration
condition
cluster
CKFinderFuncNum
CKFinderCommand
chmod
children
chat
cep
cd
cb
catname
catID
CardType
caching
bookmark
bodytext
bgcolor
baseurl
bar
autofixforcesource
autofixforcedest
autofix
authtype
audiobitrates
assignment
artisttitledupes
application
APICpictureType
ans
announce
anchor
amt
always
adv
addusers
accessType
y1
xrds
x1
wrap
work
way
warning
votes
vn
views
videoid
verifypeer
verifyhost
vendor
varValue
varName
variant
variable
utmr
utmp
utmdebug
utmac
uses
userEmail
use
uporder
updatedb
unbansubmit
ult
ul2
ul
UA
u2
u1
type2
txtDescription
transaction
tracker
tos
torrentsperpage
topicsperpage
toboard
Title
timeframe
tID
textarea
testing
testemail
tbl
tasks
taglist
Tag
tableprefix
tableId
t2
t1
survey
surname
supportfor
subtab
subscription
submit1
subj
styles
storyid
step1
stay
Status
start2
standard
span
so
smtpPort
smiley
slogan
slide
sitetitle
signatures
SID
showqueries
showpage
shout
sha1
sf
severity
sesskey
sessidpass
series
sectionid
searchText
searchid
searchField
sdb
sday
scheme
scene
scenario
savesettings
savepms
savefile
saveData
Save
sandbox
rotatefile
rotate
roleid
rn
revoke
returnID
resync
restock
resolution
resizetype
resizefile
resetkey
resend
requestid
reportid
renamefile
renameext
removeall
release
relation
recurring
RecordingUrl
recordid
reasontype
race
qs
push
pub
province
protection
property
pref
predefined
pp
play
plan
pl
ping
pf
permerror
passw
PASS
PaRes
parameter
organization
org
orderBy
online
oldusername
oldpwd
older
objects
nowarn
notification
newpw2
NEWPASS
newlang
nav
myEditor
modname
modeextension
modcomment
metric
memberName
maxwidth
matchtype
mapping
mandatory
ls2
local
lightbox
levels
langID
L
kick
karma
j
Itemid
isDuplicate
iphone
ipexclude
invitecode
inv
interests
interest
ins
inputH
industry
incldead
importance
imgurl
imgpath
IMG
imageid
ident
id1
Id
icq
href
hostid
hl
hit
headline
heading
HeaderHexBytes
goodfiles
Generate
ft
fragment
forumid
foreign
followup
fm
fldr
fileType
filetotal
fileID
fg
fCancel
facebook
extUpload
extTID
extMethod
expiry
example
errorCode
eol
entityid
encoded
emphasis
emailnotif
elements
edition
editing
editfile
editaction
dupfiles
donated
doinstall
docid
dlt
dl2
direct
dip
Digits
dict
delid
deletepms
deleteImage
decoded
datetime
dateStart
dateEnd
date2
datatype
cut
currencyCodeType
ct
csrf
cs
cPath
courses
coupon
controllers
content1
contacts
contactid
conn
commentId
cod
cm
clientid
clearLogs
classification
chosen
channelmode
chanid
chan
Category
campaign
callerid
caller
cached
bulk
bucket
boards
blogusers
blogs
billing
bID
bib
bbconfigloc
base64
bansubmit
badfiles
authorID
attempt
arguments
anon
angle
alpha
alert
albumid
ageverify
agb
afilter
adminpassword
adminid
adminemail
AddAuthItemForm
activation
actionfile
Action
acceptpms
accepted
abstract
abort
a2
zoneid
youtube
yourname
wwname
wmax
wiki
widgets
Widget
whitelist
wait
voucher
vol
vl
visualizationSettings
viewName
viewname
via
Version
varname
variables
validator
valid
utype
utf8
usort
Users
USERNAME
url1
URL
uploadpos
Upload
Update
upc
until
unset
unselectall
unpublished
undo
u9
u8
u7
u6
u50
u5
u49
u48
u47
u46
u45
u44
u43
u42
u41
u40
u4
u39
u38
u37
u36
u35
u34
u33
u32
u31
u30
u3
u29
u28
u27
u26
u25
u24
u23
u22
u21
u20
u19
u18
u17
u16
u15
u14
u13
u12
u11
u10
txtEmail
trid
transactionID
trackusers
totalProductCount
topicID
tokens
times
timer
timelimit
thumbnails
throttle
themename
testmethods
taskid
targetboard
tac
tableFields
tabid
sys
sy
suspend
supplierID
subwdata
suburb
substruc
substep
submit2
sublogin
subjoin
subconst
subcat
subacc
student
STRUCTURE
structure
strReferrer
strProfileData
strId
strFormId
stream
steps
stdDateFilterField
stdDateFilter
station
startTime
startday
sserver
square
sqlquery
sq
spass
sound
sortKey
sortfield
sortDir
sort2
song
smonth
skype
singleout
signup
SignatureValue
Signature
showtemplate
showSource
ShowFieldTypesInDataEditView
showAll
shortname
shop
ship
searchType
searchterm
searchbox
searchaction
searchable
school
saveToFile
runQuery
ruleid
rp
round
Role
rmFiles
rm
rID
responsecompression
Reset
requiredData
requestKey
requestcompression
repopulate
removeVariables
removeID
removeid
removeAll
remark
relmodule
RelayState
regSubmit
RegisterForm
refid
referral
records
rec
reboot
rc
ratio
ratings
r1
quick
quest
queryPart
qtype
qr
purpose
pto
proxypwd
proxyport
proto
promote
probe
PRIVILEGES
printview
previewwrite
pressthis
prenom
posttext
pop
point
pms
pmnotif
plus
pkg
phpMyAdmin
phonenumber
phone2
phone1
pfrom
paypal
paste
passwrd
passwordConfirm
password3
partner
parked
parenttab
ParentID
param1
panel
pageTitle
PAGE
Page
pack
p2ajax
OutSum
OUTPUTFILETEXT
OUTPUT
orderNo
or
optimize
oldname
offline
occ
npw
np
nowarned
nombre
nn
nID
newuseremail
newtitle
newtext
newtag
newstatus
newpwd
NEWPRIVILEGES
newpassword2
newPass2
newpass1
newPass
NEWNAME
NEWHOST
newdid
NEWCHOICE
nb
name1
NAME
mytribe
mtime
mp
movie
movefile
mood
months
monitorconfig
modifier
modid
mirror
mhpw
metrics
methodpayload
membername
memberID
membergroups
mediaid
maxtime
markread
markdown
mailto
mailSubject
mailid
longtitle
logoff
loginguest
logid
locations
locationName
listPrice
linkname
limitTypes
lim
lID
legend
leap
lead
lcwidget
latest
languageID
labelName
keystring
keepHTML
keep
ItemId
itemID
itemCode
ipp
IP
invoiceid
InvId
intTimestamp
intDatabaseIndex
institution
installmode
inst
INSERTTYPE
initdb
INDEXTYPE
INDEXCOLUMNLIST
imaptest
IGNOREFIRST
if
idstring
idlist
hosts
HOST
hdnProductId
gzip
grid
GRANTOPTION
google
gold
gids
getInfos
GenerateForm
generated
fullsite
frontend
fromdate
formSubmit
FormbuilderTestModel
FORMAT
follow
folders
folderID
foffset
focus
fldName
filtertype
filterText
filterName
fileFormat
Fields
FIELDNAMES
field2
field1
fee
f2
EXPORTTABLE
exportImages
EXPORTDB
exception
exact
eventID
eval
endyear
en
email1
EMAIL
elementId
eids
education
editParts
Edit
ec
dtstart
dtend
downloadpos
downloaded
dname
dm
dlconfig
distinct
displayVisualization
director
directmode
dipl
difficulty
DeviceId
design
descending
desact
deluser
DELIMITER
deleteUsers
deletefolder
deldir
decline
dbms
DBLIST
dbase
dayDelta
date1
dataType
DATABASE
d1
cvv
customers
currentid
curr
curfile
cur
ctid
credits
createclass
cr
countryName
countryCode
counter
core
coords
contactName
connectt
conflict
configfile
completed
comp
commenttext
colours
colName
CollectionId
Cmd
clientcookies
clickedon
clicked
cleanup
CHOICE
chartSettings
chars
charge
channelName
channelID
changed
cf
cert
cdone
catId
card
canvas
campaignid
cal
cainfo
build
btn
breakdown
border
bool
blocks
blockid
blacklist
birthDate
binary
bi
bbox
banreason
bank
bandwidth
backend
autodeltime
autodel
autocomplete
authorName
authorized
AuthItem
AuthChildForm
atype
AttachmentName
AssignmentForm
Artist
Article
aoe
allrows
alli2
allDay
akey
ajxaction
ajaxRequest
aggregate
adminpwd
admid
addon
additional
ADAPTER
ACTION
ACCESSLEVEL
a1
3
1
png
ob
maxdays
aliases
SHIPTOZIP
SHIPTOSTATE
SHIPTOCOUNTRY
SHIPTOCITY
Delete
Address
zID
yeniyer
ww
wser
wq
wdir
vpn
voting
viewscount
verified
vPath
ux
ut
usrid
userspec
userpicpersonal
usefilename
urldown
uptime
uploadloc
upfile
ty
tradercap
todoAction
toaddress
toAdd
tmp
tickets
templateID
tarfile
sv
submitcollation
step4
step3
srcport
sqlf
shortcut
seqnum
searchlabel
searchip
searchClause2
searchClause
scheduled
sameall
rw
rto
rmdir
reveal
resetVoteCount
renamefolder
remoteserver
regval
regtype
regname
registre
redirection
readregname
qaction
pu
prog
prepare
preference
precmd
power
postgroup
postRedirect
pool
pmsg
pipi
pids
phpvarname
phpexec
phpev
passwrd2
passwrd1
pa
ox
overmodsecurity
orderdir
orderByColumn
onserverover
oldpasswrd
oldemail
obgz
newver
newdirectory
netmask
nere
mysqlpass
mx
msgs
mquery
moderators
mkfile
missing
mip
minage
menuHashes
mem
mbname
maxPlotLimit
mass
lngfile
ldap
kind
jump
it
ispublic
ipaddr
inside
immediate
imagesize
iStart
iLength
iColumns
hp
hname
guestname
gf
getfile
generalgroup
fromname
fixErrors
finished
filterCategory
filterAlert
fileperm
fileact
fedit
fdownload
fdelete
fchmod
fallback
eventDate
erorr
ephp
ep
env
enquiry
emailto
emailActivate
eheight
ef
editform
editfilename
ed
dup
dstport
dosyaa
dontFormat
dolma
doi
displayAllColumns
dirupload
dif
delregname
delim
deleteuser
deleteAccount
dc
dbu
dbsession
dbp
dbh
dateFormat
dataLabel
cy
customerid
customWhereClause
curl
curdir
criteriaValues
criteriaTables
criteriaSort
criteriaShow
criteriaSearchType
criteriaSearchString
criteriaRowInsert
criteriaRowDelete
criteriaRowAdd
criteriaColumnTypes
criteriaColumnOperators
criteriaColumnNames
criteriaColumnName
criteriaColumnInsert
criteriaColumnDelete
criteriaColumnCount
criteriaColumnCollations
criteriaColumnAdd
criteriaColumn
criteriaAndOrRow
criteriaAndOrColumn
createfolder
cpy
coppaPost
coppaFax
coord
cookiename
cookielength
contactId
con
community
columnsToDisplay
cn
cl
chmod0
checksum
changeusername
certificate
censortext
censortest
censorWholeWord
censorIgnoreCase
calname
calid
c99shcook
bug
brd
bport
boardurl
boardid
boardaccess
bgc
bday2
backuptype
backconnectport
backcconnmsge
backcconnmsg
appId
animate
allday
actionfolder
aclid
absolute
aPath
TYPE
SHIPTOSTREET
ProfileForm
Mohajer22
MD
M2
F
ER
Direction
CURRENCYCODE
A
zrecord
zpage
zonetxt
zonet
zonesub
yearend
yPath
xsrf
wstype
woeid
weekdays
webid
watermark
vv
vpassword
viewed
viewall
viewUsers
viewResults
viewOption
ver2
ver1
variations
usertype
userlength
userip
usergroup
userGroup
userEnableRecovery
usepost
used
upsql
uploadfile
uploadForm
updateRecordID
updateFileID
updateData
updateBiblioID
upd
upage
unzip
untilDate
unstable
unhideNavItem
uitype
ue
typE
txtCommand
txtAddComment
tvid
tt
transactionId
transStatus
transId
tpp
tp
totaltopics
topicseen
tools
toolbar
tok
timezonedetection
timeUnit
timeIncrement
ti
threshold
thankyou
tftp
tfid
tests
testmode
tempLoanID
te
taxid
tagvalue
tabs
sync
symlinktarget
symlink
supplierPlace
supplierPhone
supplierName
supplierFax
supplierEmail
supplierContact
supplierAccount
subsection
subscribed
subs
submitok
subjectType
subid
subfiles
subdom
subcategory
subact
strategy
strHtml
story
stories
statusID
states
startval
starts
stars
star
stUpload
ssi
sshport
ssearch
sqluser
sqlpass
sqlhost
spoiler
specialchars
specDetailInfo
spage
smtpusername
smtpport
smtppassword
smodule
sl
skid
siteName
showsc
shown
showh
showevent
showdupes
showUnhideDialog
showCheckbox
shared
shareWith
shareType
setMetrics
setDefault
sessionId
sesc
services
serverurl
servertype
servers
serverid
serveR
seriesTitle
serialID
seqNumber
seq
separate
selectedDoc
security
sect
searchin
searchby
searchString
searchName
searchId
sea
scid
scdir
scalingup
savemsg
saveandnext
saveZ
saveNclose
saveLogs
saveKardexes
salesrank
saction
runcmd
ruletype
ruledefgroup
ruledef
rssfeed
rowspage
rownumber
rowid
routines
routes
rmver
rminstall
returnaction
resultXML
reshares
resetpassword
reserved
reserveLimit
reserveItemID
reserveID
reserveAlert
resent
requireAgreement
reqType
reportsent
reports
reportView
reportContentType
replies
replaceWith
repeatable
ren
removesess
removeFines
remotefile
remipp
remail
relpathinfo
releasedate
relatedmodule
regularity
regexp
regDate
refurl
recvDate
recsEachPage
recoveryPassword
recordSep
recordOffset
recordNum
recaptcha
recapBy
reborrowLimit
ready
rback
rawfilter
ranking
ragename
rage
r4
quirks
quickReturnID
questionid
querY
qt
qindsub
qcontent
qact2
qact
publisherName
publisherID
publicUpload
ptype
ptID
pt
pruningOptions
proxypass
proxyhostmsg
protect
prop
projectid
projectID
progresskey
profiles
producttype
processed
pro
priceCurrency
pr
postto
postgroups
postfrom
postal
portalauth
popuptype
pod
plug
plain
placeName
placeID
pipe
phpini
phpcode
pftext
personal
pd
pb
paymentStatus
pause
passwords
passwd1
passlength
passWord
pasS
parentId
palette
pais
pageId
packageName
overrideID
outbox
ot
ordDate
optimization
opml
operations
opacHide
oldform
oldfilename
off
oauth
nzbpath
numbers
numExtended
null
ntp2
ntp1
noupdate
notsent
notificationType
notificationCode
noteid
notdeleted
notactivated
noredirect
noChangeGroup
nfid
nf
newowner
newgroupname
newf
newer
newemail
newdb
newWidth
newPassword2
newLoanDate
newHeight
newDueDate
newDirectory
nentries
myip
msgfield
ms
movieview
mountType
mountPoint
modulename
moduleid
modulePath
moduleDesc
modifiedSince
misc
minuteDelta
minus
mins
minimum
mini
microhistory
methodsig
memory
memberTypeName
memberTypeID
memberPostal
memberPhone
memberPeriode
memberPIN
memberNotes
memberFax
memberEmail
memberAddress
me
md5sum
md5sig
maxentries
maxUploadSize
matchword
matchuser
matchname
matchcase
massupload
marked
makenote
makedir
mailtxt
mailsub
mailing
magic
logging
logfile
logdefaultblock
logMeIn
locationID
loanStatus
loanSessionID
loanPeriode
loanLimit
loanID
listprice
listname
listing
listarea
listShow
link2
lineid
lifetime
library
len
leave
layoutType
layers
lasturl
lastmodified
lastid
lastQueryStr
languagePrefix
langName
labelDesc
labdef
kw
kstart
keyname
keydata
key2
key1
kb
k2
jupart
jufinal
joindate
iv
itemname
itemStatusID
itemStatus
itemSourceName
itemSource
itemSite
itemShares
itemCollID
itemAction
iso
isdescending
isPersonal
isPending
invitepage
inverse
inventoryCode
invcDate
installpath
installed
installdata
installbind
instName
inputSearchVal
inheritperm
inherit
indxtxt
indx
incspeed
inXML
inUsername
inPopUp
inPassword
inNewPass
imdbid
imdb
ie
idtype
idc
htaccess
hot
holiday
holDesc
holDateEnd
holDate
hideNavItem
hex
headers
harm
harddiskstandby
gx
guest
gtype
grouptype
groupreason
groupr
groupfilter
graphid
gracePeriode
grabs
gpack
googleplus
gmdName
gmdID
gmdCode
gmd
giveout
getupdatestatus
getstatus
getprogress
getactivity
getDropdownValues
geoOption
generic
gen
gameid
fu
ftpuser
fstype
front
fromsearch
fromemail
frequencyName
frequencyID
free
fp
forgot
foreignTable
foreignDb
forceRefresh
folderpath
flow
fldname
fldlength
fldlabel
flddecimal
fldType
fldPickList
fldLength
fldLabel
fldDecimal
fix
firstday
finishID
finesDesc
finesDate
fineEachDay
findString
fileurl
fileto
fileold
filenew
filename2
filefrom
fileframe
filecontents
fileURL
fileTitle
fileDir
fileDesc
fieldlabel
fieldType
fieldSep
fieldId
fieldEnc
fh
ffile
favicon
fam
external
extensions
exponent
expirationyear
expirationmonth
expDateYear
expDateMonth
expDate
exemplar
exe
exccat
evtitle
eta
errorstr
errormsg
errormail
errmsg
enroll
ends
endday
encryption
encrypted
encrypt
enclose
enableReserve
emailcomplete
emailId
editf
editable
editUserGroupSubmit
editUserGroup
eday
ecotax
dwld
due
dto
dos
documentID
doaction
doSearch
doImport
doExport
dnssec
dns2
dns1
dn
dmodule
disk
disablelocallogging
disabledBBC
dis
dirToken
dim
digest
dialog
dhcp
dfrom
df
depts
demolish
delsub
delrule
delrow
delgroup
deletesmiley
deleteip
deleteevent
deletecheck
deleteUserGroup
debet
dbserver
dbpw
dbid
dbPrefix
dbPort
dbHost
dayname
datetype
dateto
datefrom
dateReceived
dateExpected
dataurl
dataset
datadir
databaseloginpassword
databaseloginname
databasehost
dB
cw
cvv2Number
cvmodule
customfield
custid
cust
currentFolderPath
curpage
csid
crt
creditCardType
creditCardNumber
credentials
createpages
createmode
crdir
couponamount
counts
convertmode
conversation
conv
contest
contentTitle
contentPath
contentDesc
contbutt
contains
consumer
constraint
consoleview
confirmFinish
combine
columnIndex
color2
colltype
collTypeName
collTypeID
collType
codes
cmspassword
cmsadminemail
cmsadmin
cls
clientId
cleared
classOptions
claim
chvalue
chpage
chkagree
checkprivstable
checkprivsdb
checkout
checking
checkboxes
checkShares
checkReshare
check1
channels
changepassword
changecurrent
changeUserGroup
cfgval
cfgkey
categoryID
cardtype
cap
callbackPW
callNumber
calendarid
calcolor
bzipcode
buddies
btnSubmit
bstate
bridge
breadcrumb
bphone
boxes
box3
box2
box1
bootstrap
bomb
boardtheme
boardseen
boardprofile
blocklabel
blastname
bits
birthyear
birthmonth
binding
bill
biblioTitle
biblioID
bfirstname
beta
bemail
beginner
bcountry
bconfirmemail
bcity
bbc
baza
batchID
batchExtend
basedn
baddress2
baddress1
backupnow
backdrop
baba
autoupdate
automatic
authorityType
authPin
authList
audioFolder
asin
arg
arch
applicable
appkey
appeal
aop
animal
altmethodpayload
alterview
alsoDeleteFile
allsignups
allflag
allfiles
allboards
aliasid
algorithm
afterupload
aemail
adopt
adminuser
adminpass2
adminEnableRecovery
addcategory
addUserGroupSubmit
addUserGroup
addSpider
addReply
addMessage
addList
acttype
actors
actionName
acl
acct
accountnumber
accountname
abc
aID
WSDL
UserChangePassForm
UID
Test
Term
Tab
T
Submit1
Settings
SaveInSent
SORT
SHIPTOSTREET2
Review
ReturnUrl
RecordingDuration
Project
Product
PasswordResetForm
PasswordForm
Or
MenuItem
Menu
METHOD
Language
LOCALECODE
Issue
InstallForm
Group
ExpirationYear
ExpirationMonth
ERORR
DialCallStatus
DeviceType
DATE
D
Condition
CallSid
CVV
B
AudioPlayerSubmit
AudioPlayerReset
AccountNumber
zonefile
zipName
zhsd
yy
ystart
yellowtemp
yellowstales
yellowremfails
yellowrejects
yellowgetfails
yellowgessper
yellowfan
yellowdiscards
yellowavgmhper
years
yahoo
xxx
xx
xtype
xnum
xmode
xmldata
xjxmthd
xjxfun
xjxevt
xjxcls
xjxargs
xjxGenerateStyle
xjxGenerateJavascript
xhrLocation
xhprof
xdebug
wu
wstoken
writeSchema
wresult
wrcont
wpseo
wpnonce
wpas
workingdiR
workgroup
workflow
workerId
wordlist
wood
wlk
wli
withdraw
withCount
wins2
wins1
wins
wildcard
wikitext
wide
whw
whom
websiteId
webserver
webpage
webguiproto
webguiport
wbp
wbcp
warn
want
wakeall
wa
vuln
vrt
vpntype
vouchersyncusername
vouchersyncport
vouchersyncpass
vouchersyncdbip
vouchers
volume
void
vnutr
vlanprioset
vlanprio
vjcomp
villagename
viewweek
viewupgradelog
viewscope
viewMode
viewBag
videos
videopress
videoTitle
videoTags
videoId
videoDescription
videoCategory
vhostcontainer
vhid
vgrlf
versions
verse
verifycode
verification
verboselog
verb
vecdo
ve
vcheck
vbxsite
vbulletin
vbss
vbsq
vat
vars
variants
var2
var1
valor
validation
validateValue
validateId
ustsub
ustools
ustname
usrgroups
usetoken
usetcp
userrealname
usernamefld
username2
usermail
userlogin
userlevel
userinfo
userids
userf
useraction
userPassword
userEdit
userDialogResult
userAgent
usepublicip
useicmp
usecurl
useR
uscmnds
urlup
urltype
urlf
urldd0
url2
urL
upports
uploadurl
uploading
uploadhd
uploadf
uploader
uploaddir
uploadPath
upl
upip
upin
upff
upf
updateurl
updatempd
updateme
updateid
updatefile
updateType
updateMsgCount
upcont
upcom
upchange
unverify
unscheduled
unreleased
unpubdate
unknown
units
unitprice
uniqueid
uniqueID
undodrag
unbanreason
ulang
uk
uf
ucd
uback
uN
uID
u1p
typeofdata
typename
typefilter
type6
type1
txtwebemail
txtsupport
txtUsername
txtRecallBuffer
txtPHPCommand
txtCaptcha
txtAddress
txpower
txkey
txantenna
tvname
tuser
tunable
tribe
tresc
trapstring
trapserverport
trapserver
trappercap
trapenable
transport
transient
traffic
tracks
trackback
tpshcook
tplName
tplID
town
touserid
touch
totalcount
totalTracks
totalItems
topsearch
toppool
tooltip
tomod
toid
toProcess
tn
tld
titulo
titre
tint
timeupdateinterval
timeservers
timeoffset
timeint
timedescr
timedd0
timeFormat
tile
tids
ticketid
ticketbits
thumbWidth
thumbHeight
throwexception
threadID
thisX
themeName
tftpinterface
textonly
texto
textmail
textfield
textIn
text0Name
testvar
testdbpwd
testdb
testType
testMode
testID
templatefile
tempName
temat
teamid
teacher
tdir
td
tcpmssfix
tcpidletimeout
tcp
tbname
tbls
taxtype
taxrate
taskID
targetname
targetip
tagcloudview
tagId
tablo
tableList
tabla
tabAction
tab1
ta
t3
syslocation
sysevents
sysemail
syscontact
syscmd
syntax
synconupgrade
synchronize
syncfilter
symgo
symbol
svff
svdi
supprimer
suppr
sunrise
subsubaction
subset
subscriptionId
subscribers
subqcmnds
subop
subnetv6
subnet
submode
submitv
submitrobots
submithtaccess
submitf
submitThemes
submitReset
submitFilter
submitFilesAdminSettings
submitEmail
submitAdd
submit4
submit3
submail
subjectid
subfolder
subdomains
subcanemaildomain
subId
subGenre
stuid
stuff
students
studentidx
sts
strukt
stringtoh
strin
strictcn
strictbind
streamMode
stp
storagegroup
stoptime
stoppool
stoppga
stopbtn
stime
stereo
stepid
step5
stdlib
stderr
statut
statusid
statsgraph
staticarp
statetype
statetimeout
statetable
stateid
stateOrProvinceName
startyear
startpool
startpga
startnum
startmonth
startdisplayingat
startbtn
startMonth
starred
stamp
staffId
stack
sshdkeyonly
srname
srm
srctype
srctrack
srctext
srcnot
srcmask
srch
srcfmt
srcendport
srcbeginposrt
srcbeginport
sr
sqtid
sqsrv
sqquery
sqpwd
sqprt
sqlwxp
sqluser4
sqluser3
sqluser2
sqluser1
sqltype
sqlty
sqlportb4
sqlportb3
sqlportb2
sqlportb1
sqlport4
sqlport3
sqlport2
sqlport1
sqlport
sqlpass4
sqlpass3
sqlpass2
sqlpass1
sqlog
sqlite2
sqlhost4
sqlhost3
sqlhost2
sqlhost1
sqlfile
sqldp
sqldebug
sqlcode
sqlaction
sqdbn
sqconf
spy
spots
spot
sport
spoofmac
spellstring
spelling
specs
specifiedpassword
specialsettings
speciallogfile
specialFiles
spammer
spamcheck
sourcetracking
sourceport
sourceip
sourcego
sorttable
sortname
sorting
sortdirection
sortdir
sortable
sortField
songid
soname
something
somestuff
some
solrsort
snn
snmpscanner
snatched
snaplen
smtptls
smtpssl
smtprelay
smtpnotifyemailaddress
smtpipaddress
smtpfromaddress
smtpPassword
sms
smode
smile
smfdbu
smfdbp
smfdbn
smfdbh
smf
smartpagebreak
smartmonemail
slot
slid
skiplang
skipIOS
skipANDROID
skinname
skinName
sk
sjid
sizey
sizes
sitter2
sitter1
sitedown
siteId
simpin
silver
showthumbs
showtext
showslow
showmessage
showinfo
showinactive
showbd
showact
showIndex
showFooterMessage
shorturl
shortseq
shopping
shiptobilling
sharing
sharednet
sh311
sh3
sfname
sfldr
sfilter
sfilename
setype
setupid
settype
settags
setrw
setoption
setname
setlanguage
setlang
setdefault
setUserAgent
setPublic
sessions
sessid
sess
servicestatusfilter
serviceName
serversdisabled
serverip
servercn
serverId
serie
serialspeed
serialport
serialize
serdir
ser
sentitems
senm
senha
sendtime
sendpassword
sendmsg
sendmethod
sendit
sendfile
senderEmail
sendemail
sendactivation
sendTo
selyear
selmonth
sellernick
selectvalues
selectop
selectlist
selectedmodule
selectedTable
selectcategory
selectAmount
sele
selday
selCountry
segment
seed
sedir
securityscanner
secu
secs
secretKey
searchval
searchuser
searchstring
searchfield
searchadvsizeto
searchadvsizefrom
searchadvr
searchadvposter
searchadvgroups
searchadvcat
searchUsername
searchQuery
searchOper
searcc
seC
scrubrnid
scrubnodf
scores
schooldatex
schedule0
sched
scalepoints
sca
sbjct
savmode
savetest
saveoptions
savehostid
savegroup
savefolderurl
savefolder
savefilenameurl
savefilename
savedraft
saveconf
savePath
saveNedit
saveNcreate
saveNback
sat
sampledata
salutation
saleprice
safemodz
safefile
safecss
safe
sabsetting
sabapikeytype
sYear
sName
sColumns
s3key
s3bucket
rxantenna
rwenable
rwcommunity
rvm
runsnippet
runid
runer
runState
rtl
rstarget4
rstarget3
rstarget2
rstarget1
rsswidgettextlength
rsswidgetheight
rssurl
rssmaxitems
rrule
rrdbackup
rport
rpassword
rownum
rowId
routeid
rootpath
rollbits
rocommunity
robotsnew
rname
rmid
richtext
rfiletxt
rfile
rfc959workaround
rf
reverseacct
returnsession
returnpage
retries
ret
resultmatch
resultid
resubmit
restorefile
restorearea
restartchk
respuesta
responsive
resources
resourcefile
residence
resetwidgets
resetpass
resetlogs
resetlog
resetPassword
rescanwifi
requests
reqid
reqFor
req128
repwd
repositoryurl
reportname
reportfun
reportType
replayMode
repeatMonth
repass
reopen
rensub
renold
rennew
renf
renderlinks
renderimages
renderforms
renderfields
render
rempool
removep
removemp
removefields
removeOldVisits
remoteserver3
remoteserver2
remotekey
remoteip
remot
remmin
remhrs
remdays
remarks
reloadfilter
relevance
relayd
relay
relationships
relationship
relations
related
rela
reglocation
registered
reginput
regid
regdomain
regdhcpstatic
regdhcp
regcountry
refuse
refund
refuid
refreshinterval
reflectiontimeout
refkod
referid
referer2
redirurl
redirectto
redirectUri
redfi
reddi
recurse
recurringtype
recurrence
recreate
recordsArray
recordcount
recordType
recordID
reconstruct
recommend
recipientCurrency
recipientAmount
recherche
receipient
recache
reauthenticateacct
reauthenticate
realpath
readonly
readme
reading
rdata
rawAuthMessage
rasamednsasdhcp6
rapriority
randkey
ramode
rainterface
radomainsearchlist
radns2
radns1
radiusvendor
radiusserverport
radiusserveracctport
radiusserver2port
radiusserver2acctport
radiusserver2
radiusserver
radiussecret2
radiussecret
radiussecenable
radiusport4
radiusport3
radiusport2
radiusport
radiusnasid
radiuskey4
radiuskey3
radiuskey2
radiuskey
radiusissueips
radiusip4
radiusip3
radiusip2
radiusip
radiusenable
radiusacctport
radiobutton
radPostPage
rN
rM
r3
r00t
qx
quoteid
qunfatmpname
quizid
quitchk
quietlogin
quickmanagertv
quickmanagerclose
quickmanager
quicklogin
questions
querytype
querysql
queryString
quantityBackup
qu
qtranslateincompatiblemessage
qsubject
qqfafile
qmrefresh
qact3
q3
q2
purgedb
puremode
purchaseorderid
purchaseid
publickey
pubkey
pubdate
puT
ptpid
ptp
psk
psid
pseudo
ps2pdf
prv
proxyusername
proxyurl
proxypassword
proxyhost
prov
protocomp
protmode
promiscuous
projectionxy
projection
profileId
prof
productname
productlist
productcode
productDescription
processlogin
processlist
processing
procedure
probability
prj
privid
privatekey
priv
priority3
priority2
priority1
prio
printer
principal
primarymodule
primaryconsole
prices
pri
prevpage
press
presence
prescription
prereq
preg
prefork
prefetchkey
prefetch
preauthurl
ppsstratum
ppsselect
ppsrefid
ppsport
ppsfudge1
ppsflag4
ppsflag3
ppsflag2
pppoeid
ppid
ppdebug
ppage
potentialid
potentalid
posttype
postedText
postback
postafterlogin
postData
post2
post1
portscanner
portbw
portbl
portbc
port1
porder
pop3host
pools
poolopts
poolname
pollvote
pollport
pollQuestion
pollOptions
plusminus
plname
plid
playlistTitle
playlistDescription
plaintext
pkgs
pkgrepourl
pinned
pictitle
pics
pickfieldtable
pickfieldname
pickfieldlabel
pickfieldcolname
pick
piasS
pi
phpsettings
phpsettingid
phpenabled
phpbbkat
phpbbdbu
phpbbdbp
phpbbdbn
phpbbdbh
phpbb
photoid
phoneNr
phone3
pguser
pgsqlcon
pgport
pgdb
peruserbw
personality
personId
persistcommonwireless
persist
perms9
perms8
perms7
perms6
perms5
perms4
perms3
perms2
perms1
perms0
permStatus
periodo
periodidx
perform
perPage
peerstats
peace
pdouser
pdopass
pdodsn
pdocon
pdnpipe
pcid
paypalListener
payments
paymentId
paymentData
paths
pathf
path2news
patch
passwordnotifymethod
passwordkey
passwordgenmethod
passwordfld2
passwordfld1
passwordfld
passwordconfirm
passwordc
passwdList
passthrumacaddusername
passthrumacadd
passgen
passf
passenger
passd
partition
parseSchema
parid
parentqueue
parentfieldid
paranoia
paporchap
pagestyle
pagestart
pageop
pagenumber
pageborder
pageType
pageOwner
padID
paID
pW
pUID
pPassConf
pPass
pPage
pName
pMail
pDesc
p4ssw0rD
p3
p2p
p2index
p2entry
p1index
p1entry
overwriteconfigxml
overdue
ouT
ostlang
orionprofile
origname
organizationalUnitName
organizationName
orgajax
orders
ordering
orderType
orauser
oraclecon
opwd
optin
optimizer
oper
openings
opened
openbasedir
oof
onw
onlyforuser
onlyfind
ondemand
on
oldtime
olddir
oldaction
oldPlaylistTitle
oldMountPoint
oldEmail
odbcuser
odbcpass
odbcdsn
odbccon
odb
occupation
objectIDs
obj
nurlen
nurld
numwant
numlabel
numberposts
numail
nuked
nuf
ntporphan
nslookup
nrresults
npassworda
npage
noxml
nowmodule
nounce
notrap
notices
noti
not
nosync
noserve
noreload
nordr
noquery
nopfsync
nopeer
nopackages
noofrows
none
nonat
nomodify
nometool
nome
nomacfilter
nolimit
nolang
nohttpsforwards
nohttpreferercheck
nohtml
nogrants
noexpand
noedit
nodraft
nodnsrebindcheck
nodeid
noconcurrentlogins
noantilockout
noaction
noRedirect
noOfBytes
nmdf
nfile
nf4cs
nf4c
nf1
nextserver
nextid
nextPage
newwin
newusername
newusergroup
newtype
newtime
newtheme
newtemplate
newrule
newprefix
newpref
newpath
newnick
newmessage
newids
newid
newgroup
newdocgroup
newcode
newcategory
newalbum
newaccount
newX10Monitor
newWindow
newVideoTitle
newVideoTags
newVideoDescription
newVideoCategory
newValue
newText
newSite
newProject
newPlaylistTitle
newPlaylistDescription
newPath
newMonitor
newGroup
newGame
newControl
netgraph
netboot
nested
neg
ncbase
nc
natreflection
natport
nameren
namelist
namefe
name3
namE
n1
myusername
mysqls
mysqlcon
mypassword
myname
mylogout
mycode
mybulletin
mybbindex
mybbdbu
mybbdbp
mybbdbn
mybbdbh
mw
mve
mvdi
mute
music
muser
multiplier
multifieldname
multifieldid
mtype
mtu
mto
mtext
msubj
mssqlcon
mss
msqur
msq1
msid
msi
msgtype
msgnoaccess
msgno
msgexpired
msgcachesize
msg1
mru
mpdconf
mpath
mpage
moveup
moveto
movedown
movd
mount
motivo
motd
moodlewsrestformat
mon
moduletype
moduleorder
moduleguid
moduleType
moduleId
modified
modfunc
modfile
moderate
modelId
modeid
modcat
modE
mobj
mobilephone
mnam
mmsg
mmail
mlist
ml
mkF
mkD
mito
minkills
minViewability
minJs
minCss
mimetypes
milw0
mids
mibii
mhtc
mhost
mhash
mh
mg
mfrom
mfldr
mffw
metadata
messagesubject
messageid
messagebody
messageMultiplier
mess
meridiem
mergefile
merchantReference
menutitle
menus
menuindex
menuid
memtype
memday944
memday942
memberPasswd2
memberPasswd
memberPassWord
mediatype
mediaopt
medalweek
medalid
mdp
md5q
md5pass
md5hash
md5crack
md
mcid
mc
mbox
mbadmin
maxtry
maxtemp
maxstore
maxstales
maxremfails
maxrejects
maxprocperip
maxproc
maxmss
maxleasetime
maximumtableentries
maximumstates
maxgetfails
maxgessper
maxfan
maxdiscards
maxcrop
maxaddr
maxZipInputSize
master
masssource
massedit
massdefaceurl
massdefacedir
massa
masdr
marker
markdefault
manual
managerlanguage
manage
man
makeupdate
maintitle
maint
mainmessage
mainGenre
mailsent
maillisttmpname
mailcontent
mailbodyid
mailbody
mailMethod
mailAuth
magicfields
macname
mV
mSendm
mKf
mKd
mD
lucky
lticket
lp
losslow
losshigh
loopstats
lookfornewversion
longlastingsession
logsys
logprivatenets
logpeer
logoutid
loglighttpd
loglevel
loginmessage
loginemail
loginautocomplete
logic
loggedAt
logfilesize
logfilE
logf
logeraser
logdefaultpass
logbogons
logall
logable
logType
logFile
lockid
locationid
localized
localityName
localip
localfile
localf
localbeginport
loan
lm
live
listorder
listmode
liste2
liste1
liste
listSubmitted
listItem
listId
linkedin
link1
link0
limitpage
limitless
limite
liked
lfilename
lemail
legendstyle
legendsize
legendfontsize
legendfontr
legendfontg
legendfontb
legendfont
lecture
leaptxt
leadval
leadsource
lbg
lbcp
latencylow
latencyhigh
lastactive
lastActive
langs
langname
lanes
lane
landscape
lan
laggif
l7container
kr
kod
king
kime
kim
killfilter
kil
keytype
keylen
keyid
keepslashes
keeppass
katid
jpeg
joingroup
joined
jid
jform
jenkins
jaxl
jahr
jCryption
itemkey
itemcount
isverify
issues
ispersis
isocode
isnano
isim
isenabled
isemaildomain
iscustomreport
iscomment
iscatchall
isbinddomain
isactive
isSwitch
isDev
iron
ipv6allow
ipsecpsk
ipscanner
iprestricted
ipprotocol
ipproto
iplist
ipandport
ipaddrv6
invoiceId
inviteesid
invited
invitation
invest
invalidate
introeditor
interfaces
instanceId
installstep
installGoingOn
inputid
inputSize
injector
initstr
initialtext
initialise
initdelay
inifile
inid
inf3ct
ineligible
indent
includenoncache
incl
iname
inajax
inactive
inViewWarnings
inViewLogs
inViewErrors
inSessionSecuirty
inRemember
inNewUserName
inForgotPassword
inDownLoad
inConfEmail
inBindLog
importrobotsmeta
importonly
importmethod
importid
importfile
importer
important
importaioseo
importType
importFile
impersonate
imgtype
imgid
imdbID
imagename
imagefile
imagedetails
imageUrl
imageThumbID
imagE
ikesaid
ikeid
ignoresubjectmismatch
ignorephpver
ignorefatal
ignored
ignoreTV
ifnum
ifname
ieee8021x
idname
idletimeout
identity
identifiant
idb
idSite
idL
id9level
id9gid
id8level
id8gid
id7level
id7gid
id6level
id6gid
id5level
id5gid
id4level
id4gid
id40level
id40gid
id3level
id3gid
id39level
id39gid
id38level
id38gid
id37level
id37gid
id36level
id36gid
id35level
id35gid
id34level
id34gid
id33level
id33gid
id32level
id32gid
id31level
id31gid
id30level
id30gid
id2level
id2gid
id29level
id29gid
id28level
id28gid
id27level
id27gid
id26level
id26gid
id25level
id25gid
id24level
id24gid
id23level
id23gid
id22level
id22gid
id21level
id21gid
id20level
id20gid
id1level
id1gid
id19level
id19gid
id18level
id18gid
id17level
id17gid
id16level
id16gid
id15level
id15gid
id14level
id14gid
id13level
id13gid
id12level
id12gid
id11level
id11gid
id10level
id10gid
icp
icode
icmptype
icerik
ical
hwhy
htype
httpsverify
httpsname
httpscanner
https
httpbanner
htmlemail
html2xhtml
htcc
htc
htaccessnew
hrs
howmuch
howmany
howlong
how
hostres
hostipformat
hostapd
hostName
hosT
horario
holdcnt
hlp
hldb
hidrfile
hidid
hideversion
hidemenu
hideidentity
hidFileID
hid
hellotime
health
hd
hc
having
hashtoh
hashkey
hasAudio
hardenglue
ham
gtin
gt
gs
grupo
grps
grpage
grouped
groupdesc
groupdel
groupby
groupIDs
groupCounter
greif
graphtype
graphlot
granularity
grants
granted
gr
gpstype
gpssubsec
gpsstratum
gpsspeed
gpsselect
gpsrefid
gpsprefer
gpsport
gpsnmea
gpsinitcmd
gpsfudge2
gpsfudge1
gpsflag4
gpsflag3
gpsflag2
gpsflag1
gotod
goodsid
gomkf
godb
godashboard
goal
gn
github
gip
gifif
ggid
gfils
getpic
getm
getenv
getdyndnsstatus
getdb
getdate
getcfg
getThermalSensorsData
getOutputCompression
generatekey
generateKeypair
general
ged
geT
gdork
gd
gc
gbid
gatewayv6
gameID
gadget
ga
fyear
fwdelay
fw
fvonly
fuzz
functionz
functionp
ftype
ftpscanner
ftps
ftppass
ftphost
fsOP
fromAddress
frm
friendlyiface
friend
fresh
frames
fqdn
fq
fpath
fpassw
forwarding
forwarderid
formname
formfactor
formdata
formatup
formats
formatdown
formage
formId
formAutosave
forgotPassword
forever
foreground
forceIcon
forceFormat
fontr
fontg
fonte
fontb
fontSize
following
folderId
fmt
flushcache
flowtable
floor
floating
fldMandatory
flashtype
flashpga
fl
fixmetadesc
firmwareurl
finds
findid
fin
filtre
filtertext
filterlogentriesinterfaces
filterlogentries
filterdescriptions
filled
filew
filetosave
filesend
fileoffset
filename64
filename32
filecreate
filecount
fileOffset
fileLength
fileExistsAction
fileEdit
fileDataName
fileContent
file2ch
filE
fieldkey
fieldCounter
fid2
feedId
fe
fdo
fdel
fcsubmit
fcopy
fbclearall
favourite
favorites
favicons
fast
familyName
facility
facid
fType
ezID
eyear
extras
extractDir
extern
extdisplay
extdir
exportVideo
exportMisc
exportFrames
exportFormat
exportFile
exportDetail
exploit
expirationDate
expid
expertise
expanded
expandAll
exp
exitsql
exists
exif
executeForm
execmethod
execmassdeface
excludedRecords
exchange
exc
exTime
exT
ewidth
eventname
eventTitle
evap
evalsource
evalinfect
evalcode
evac
etag
et
eshopId
eshopAccount
esId
error500path
error404path
error403path
erne
epot
epoch
entryid
entryPoint
entryId
entryID
entityID
entire
enhanced
enforceHTTPS
endport
endmonth
encoder
encod
enablestp
enablesshd
enableserial
enablenatreflectionhelper
enablebinatreflection
emonth
eml
embedded
emailsubject
emailfrom
emailch
emailToken
emailList
emailID
emailBody
elementType
ee
edittxt
editprofile
editkey
editgroup
editedon
edge
ecraz
ealgo
dynamic
dxval
dxsqlsearch
dxportscan
dxparam
dxmode
dxinstant
dximg
dxfile
dxdirsimple
dxdir
dummy
dumd
duid
duedate
dsttype
dstnot
dstmask
dstip
dstendport
dstbeginport
dscp
dryrun
droptables
drilldown
dragtable
dragdroporder
dpgn
dpath
downloadid
downloadbtn
downloadbackup
downloadIndex
downloaD
downf
downchange
dosthisserver
dosearch
dopt
donotbackuprrd
domerge
domen
domainsearchlist
domainname
domaiN
doimage
documentroot
documentgroup
doctype
docs
docgroups
docgroup
doRegister
doDelete
dnssrcip
dnssecstripped
dnsquery
dnslocalhost
dnsallowoverride
dns4
dns3
dnpipe
dlgzip
dldone
dlPath
dkim
dizin
divider
diversity
distribution
diskspace
discipline
disapprove
disablevpnrules
disablesegmentationoffloading
disablescrub
disablereplyto
disablenegate
disablelargereceiveoffloading
disablehttpredirect
disablefilter
disableconsolemenu
disablechecksumoffloading
disablecheck
disablecarp
disablebeep
dirr
dirlisting
dirfree
directoryscanner
direccion
dire
dircreate
diract
dirList
dimensions
dig
diff
dhtc
dhcpv6leaseinlocaltime
dhcprejectfrom
dhcpleaseinlocaltime
dhcphostname
dhcpfirst
dhcpbackup
dhcp6usev4iface
dhcp6prefixonly
dfilename
devid
deviceid
detail0
destslice
destino
destd
descripcion
desc2
desc1
deptid
deposit
depid
denyunknown
dend
demoData
deltype
deltpl
delstring
delsel
delpref
delmac
deliveries
deliver
delimeter
delfriend
delfolder
delfl
delfbadmin
delf
deleteweek
deletesubmit
deleterule
deletegrp
deleteg
deletedir
deletedSpecs
deletecntlist
deleteUser
deletePrices
deleteList
deleteIndex
deleteImages
deleteCategory
deldat
deld
delName
degrees
deftime
defaulttemplate
defaultqueue
defaultleasetime
defaultgw
deduction
decrypt
debugmethods
debugfailover
debugbox
debug3
debug2
debit
deathplace
deathdate
deadline
deact
deS
deL
ddo
ddnsupdate
ddnsdomainprimary
ddnsdomainkeyname
ddnsdomainkey
ddnsdomain
dbsocket
dbn
dbbase
dbUsername
dbTablePrefix
dbPwd
dbPass
dbOP
datestamp
datechange
datasrt
dataroot
dataofs
datagapradius
datagapangle
dataflt
databasename
dataangle
data2
darezz
dare
dID
cx
customernumber
customcss
customaddtplid
customId
customFieldId
currentday
currentPassword
currentPage
currencyid
currencyCode
curpath
cuenta
ctx
ctrl
ctag
csvIDs
csspreview
csrftoken
csr
cs2
cs1
crypo
crtty
crrt
crefile
createstdsubdomain
createlist
createdon
createaccount
cre
crcf
crannycap
cracK
cpyto
cpw
cpath
cpass
cpage
coverage
courseId
couponcode
coupling
countryID
countonly
copyname
cop
contenttype
containerid
contactidlist
contactID
contactEmail
cont
consumerSecret
consumerKey
const
consent
connsub
connport
connections
connectionType
connectback
confirmEmail
confirm3
confirm2
configs
concepto
compr
compose
communication
commonName
commits
commex
commentaire
commander
combo
color1
college
collectionto
collectionfrom
collectcolumn
coin
codetype
coded
codeblock
coauthors
coM
cnpj
cmspasswordconfirm
cmode
cmmd
cmediafix
cmdr
cmdir
cmdid
cmdex
cmde
closenotice
closedate
clockstats
clipboard
cleartokens
clearquery
clearlogs
clearSess
clearLog
cleancache
clay
classname
cktime
ckeditor
ck
cipher
cinterface
cids
choix
choice2
chmodnow
chmodenum
chm
chkalldocs
chfl
checksumbits
checknum
checkmetadesc
checkid
checkconnect
checkaliasesurlcert
chdir
chats
chatmsg
chartsize
characterid
chapter
chapo
changestatus
changero
changeVisitAlpha
changePass
cfy
cfx
cfilename
cfile
cfil
cfed
certsubject
certref
certid
certdepth
cds
cdirname
cdir
cateid
categoryname
categoryName
catalogid
catalogName
casein
cartId
caref
cardno
capture
cantidad
canpreview
canned
caneditphpsettings
caneditdomain
cancelled
canceldelete
campo
cambio
callop
callerId
caid
cacheable
cable
cP
c37url
c2
byws
bythis
bysyml
bypcu
bypassstaticroutes
byoc
byfc9
byfc
byetc
bye
bycw
byapache
bwdefaultup
bwdefaultdn
bv
buy
buttonval
buttons
businessName
bulletin
budget
bs
broadcast
bridgeif
breakpoints
breakpoint
bps
bpg
bpage
bounce
bottom
bots
bootslice
boolean
bookings
bonus
bogonsinterval
boardmod
blogtitle
blogtags
blogbody
blockpriv
blockeduntil
blockedmacsurl
blockedafter
blockbogons
blatent
birthplace
birth
bip
bindpw
bindip
binddn
bgColor
benchmark
behaviour
be
bduss
bcip
baz
baslik
basket
basic
basemodule
bantype
bantime
bannedUser
banip
banid
backurl
backupcount
backupbeforeupgrade
backuparea
autorefresh
autoredirect
autoptp
autoplay
autogroup
autoenable
autoedge
autoassign
autoapprove
autoadjust
autoaddfields
authserver
authorship
authorizedkeys
authname
authmode
authlvl
authentication
authcn
authcfg
auid
attendance
attachmentsid
attachmentUploadDir
attachmentId
attachid
attaches
assigntype
assignedTo
assigned
asset
assertion
asid
asText
artistid
articleid
argv
argb
arg2
archivo
archivedate
archiveDate
apple
apnum
apn
apinger
apiKey
aot
answerid
annotation
ann
animetitle
anidb
andor
ampm
amountup
amountdown
alturlenable
althostnames
alternate
allyid
allss
allqw
allowopts
allowinvalidsig
allowed
allowZipDownload
allids
allfields
allergies
allDepts
aliasimport
aliasesresolveinterval
aliA
algo
alertEmail
albumname
alI
al
ak
ajaxMode
ajaxCalendar
ajaxAction
aj
airdate
agentoption
affw
affiliate
af
advskew
advbase
advancedview
adsr
adresse
admins
adminlogin
adminUser
adminPass
adminPWD
adminEmail
adlr
addurl
addtype
addtxt
addtag
addsite
addrule
addressren
address0
addpool
addonkey
additionalData
addfile
addevent
addcat
addacc
addUser
addOption
addComment
addBase
adaptivestart
adaptiveend
adapter
ad2syp
ad2syc
actreject
actpass
activityID
activationKey
actionadd
actionType
actid
actblock
act3
act2
acpage
ackqueue
ack
acfcomp
accLimit
acao
abbr
ZipName
Yol
Y
XL
WIDsubject
VerifyCode
VPSSignature
UserType
UserSettingsForm
UserName
UserLoginForm
UserForm
UserCreateForm
URI
TxAuthNo
TrYaG
Touchm
Toucha
Touch
Taxonomy
Task
Target
TO
TITL
SysMessage
SubsiteID
Submit2
StoreCategory
StepID
Soups
ShareForm
SettingsForm
Setting
Service
SecurityKey
SearchForm
Sandwiches
Salads
SURN
SUBMIT
SPFX
SAMLRequest
Result
ResourceUploadForm
ResetRRD
Register
ReduxFrameworkPlugin
ROMN
RESULT
RESET
REPO
RECHECK
RC
Q
Public
ProjectUserForm
PostCodeResult
PostCode
Plain
Person
Perms
PayerStatus
ParentPage
Parent
PWD
PUBL
PHONE
Owner
Opt2
Opt1
OpenWith
Object
NetworkUserID
NetworkScreenName
NetworkPlatform
NSFX
NPFX
NOTE
NICK
N3tshcook
ModuleVar
LostPasswordForm
Lookup
LegendMode
Last4Digits
LATEST
KloutID
Joomla
Import
IPv6
HowMany
Hkrkoz
Help
Heads
Hash
HMACKey
Good
GiftAid
GROUP
GRAPHS
GIVN
GENDER
Form
Flag
Filter
FileIDs
File
Field
FactoryName
FactoryId
FXuser
FXpass
FXimage
FONE
FILES
FIELDS
Export
ExpiryDate
Example
Event
EmailForm
EVEN
ENCRYPTION
E
Download
DevForceUpdate
Desserts
DUMP
DESC
Customer
CustomPage
Currency
Create
Coupon
ContentList
Contacts
City
Cancel
CallStatus
Calendar
CV2Result
CSalt
CID
CHIL
CAVV
CAPTCHA
CALN
Blog
Block
Beverages
AuthItemChild
Attachment
Albania
Admin
AddressStatus
AddressResult
Accounts
AVSCV2
AUTH
AMOUNT
ALL
ABBR
4
3DSecureStatus
23
22
21
2
17
16
15
14
13
12
11
_escaped_fragment_
__amp_source_origin
http_host