1 Star 0 Fork 0

小义的爸爸/upload-fuzz-dic-builder

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
贡献代码
同步代码
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README
MIT

upload-fuzz-dic-builder 上传漏洞fuzz字典生成脚本

生成的字典

一、uasg

$ python upload-fuzz-dic-builder.py -h
usage: upload-fuzz-dic-builder [-h] [-n] [-a] [-l] [-m] [--os] [-d] [-o]

optional arguments:
  -h, --help            show this help message and exit
  -n , --upload-filename
                        Upload file name
  -a , --allow-suffix   Allowable upload suffix
  -l , --language       Uploaded script language
  -m , --middleware     Middleware used in Web System
  --os                  Target operating system type
  -d, --double-suffix   Is it possible to generate double suffix?
  -o , --output         Output file

1.1 Example1

生成适合全语言,全部中间件,全部操作系统的fuzz字典

python upload-fuzz-dic-builder.py

1.2 Example2

生成适合后端语言为asp的fuzz字典

python upload-fuzz-dic-builder.py -l asp

1.3 Example3

上传文件名为:test,可以上传后缀为jpg,后端语言为php,中间件为apache,操作系统为Windows,输出字典名为upload_filename.txt的fuzz字典

python upload-fuzz-dic-builder.py -n test -a jpg -l php -m apache --os win -o upload_file.txt

1.4 注意:

  1. 生成时给的上传点相关信息越详细,生成的字典越精确!
  2. 在使用burp的Intruder模块进行fuzz时将Payload面板中Payload Encoding一栏的URL-encode these characters选项设置为未选中状态。

burp intruder模块设置

二、more

构造优质上传漏洞fuzz字典

MIT License Copyright (c) 2018 残亦 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

简介

上传漏洞fuzz字典生成脚本 展开 收起
README
MIT
取消

发行版

暂无发行版

贡献者

全部

语言

近期动态

不能加载更多了
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/csharphpython/upload-fuzz-dic-builder.git
git@gitee.com:csharphpython/upload-fuzz-dic-builder.git
csharphpython
upload-fuzz-dic-builder
upload-fuzz-dic-builder
master

搜索帮助