Fuzzer = {}
Fuzzer.default_jsdir = app.dir..'Scripts\\Fuzzer\\'
Fuzzer.default_jsfilters = [[
// Add your JS filters here. Examples:
// if (http.status == 404) { canlog = false; }
// if (http.responseText.search("doesn't exist") != -1) { canlog = false; }
]]
function Fuzzer:displaydiv(name,bool)
local e = self.ui.element
e:select('div[id="'..name..'"]')
if bool == false then
e:setstyle('display','none')
else
e:setstyle('display','block')
end
end
function Fuzzer:mode_changed()
local ui = self.ui
local newmode = ui.mode.value
ui.start.value = '0'
ui.aend.value = '100'
self:displaydiv('increment',false)
self:displaydiv('startend',false)
self:displaydiv('character',false)
self:displaydiv('wordlist',false)
if newmode == 'wordlist' then
self:displaydiv('wordlist',true)
end
if newmode == 'number' then
self:displaydiv('increment',true)
self:displaydiv('startend',true)
end
if newmode == 'char_repeat' then
self:displaydiv('increment',true)
self:displaydiv('startend',true)
self:displaydiv('character',true)
ui.start.value = '1'
end
if newmode == 'ascii' then
self:displaydiv('startend',true)
ui.start.value = '32'
ui.aend.value = '126'
end
end
function Fuzzer:openjs()
local ui = self.ui
local f = ui.scriptlist.value
local fcontents = ''
if scop.file.exists(self.default_jsdir..f) then
fcontents = scop.file.getcontents(self.default_jsdir..f)
end
ui.script.value = fcontents
end
function Fuzzer:get_scriptlist(ext)
local p = scl.listparser:new()
local flist = scl.stringlist:new()
local l = scop.dir.getfilelist(self.default_jsdir..'*'..ext)
p:load(l)
while p:parsing() do
flist:add('')
end
local result = flist.text
flist:release()
p:release()
return result
end
function Fuzzer:loadui(url,script,ext)
local html = Syhunt:getfile('Scripts/Fuzzer.html')
local advoptions = ''
html = stringop.replace(html,'',self:get_scriptlist(ext))
if ext == '.lua' then
html = html..''
advoptions = Syhunt:getfile('Scripts/ReqEditorLow_Adv.html')
else
html = html..''
advoptions = Syhunt:getfile('Scripts/XHREditor_Adv.html')
end
html = stringop.replace(html,'',advoptions)
browser.loadpagex('fuzzer',html,'Fuzzer.ui')
local ui = self.ui
ui.isxhr.value = true
ui.url.value = url..'{$1}'
ui.labprogdir.value = app.dir
ui.lablangext.value = ext
ui.script.value = script
end
function Fuzzer:loadfromreqeditor(baseurl)
local baseurl = self.ui.url.value
self:loadui(baseurl,self.default_jsfilters,'.js')
end
function Fuzzer:view()
self:loadui(tab.url,self.default_jsfilters,'.js')
end
function Fuzzer:view_lowlevel()
local default_filters = [[
-- Add your Lua filters here. Examples:
-- if http.status == 404 then canlog = false end
-- if scop.re.match(http.text,'someregex') == false then canlog = false end
-- if stringop.match(string.lower(http.text),'*error*') == false then canlog = false end
]]
self:loadui(tab.url,default_filters,'.lua')
local ui = self.ui
local hdr = tab.sentheaders
self:loadhost()
if hdr == '' then
hdr = 'GET /'..scop.url.crack(tab.url).path..' HTTP/1.1\nHost: '..ui.host.value..'\nConnection: Keep-Alive'
end
ui.divstandard:setstyle('display','none')
ui.divlow:setstyle('display','block')
ui.request.value = stringop.replace(hdr,' HTTP/','{$1} HTTP/')
ui.islow.value = true
ui.isxhr.value = false
end
function Fuzzer:loadhost()
local ui = self.ui
local url = scop.url.crack(tab.url)
local request = ui.request.value
if scop.http.getheader(request,'Host') ~= '' then
url.host = scop.http.getheader(request,'Host')
url.host = stringop.trim(url.host)
url.port = 80
if stringop.match(url.host,'*:*') then
url.port = stringop.after(url.host,':')
url.host = stringop.before(url.host,':')
end
end
ui.host.value = url.host
ui.port.value = url.port
end
function Fuzzer:start()
local ui = self.ui
local script = Syhunt:getfile('Scripts/FuzzerTask.lua')
local j = {}
j.filter = ui.script.value
j.delay = ui.delay.value
-- fuzzer mode
j.mode = ui.mode.value
j.wordlistfile = ui.wordlist.value
j.char = ui.char.value
j.i_start = ui.start.value
j.i_end = ui.aend.value
j.i_inc = ui.inc.value
j.isxhr = ui.isxhr.value
j.islow = ui.islow.value
-- fuzzer mode end
-- advanced options
if ui.isxhr.value == true then
j.method = ui.method.value
j.baseurl = ui.url.value
j.basepostdata = ui.postdata.value
j.basereqheaders = ui.reqheaders.value
j.username = ui.username.value
j.password = ui.password.value
end
if ui.islow.value == true then
j.host = ui.host.value
j.port = ui.port.value
j.baserequest = ui.request.value
j.autocontentlen = ui.autocontentlen.value
j.enablegzip = ui.enablegzip.value
j.maxretry = ui.maxretry.value
end
-- advanced options end
browser.options.showheaders = true
tab.capturerealtime = false
tab:runtask(script,json.encode(j))
end