Fuzzer = {} Fuzzer.default_jsdir = app.dir..'Scripts\\Fuzzer\\' Fuzzer.default_jsfilters = [[ // Add your JS filters here. Examples: // if (http.status == 404) { canlog = false; } // if (http.responseText.search("doesn't exist") != -1) { canlog = false; } ]] function Fuzzer:displaydiv(name,bool) local e = self.ui.element e:select('div[id="'..name..'"]') if bool == false then e:setstyle('display','none') else e:setstyle('display','block') end end function Fuzzer:mode_changed() local ui = self.ui local newmode = ui.mode.value ui.start.value = '0' ui.aend.value = '100' self:displaydiv('increment',false) self:displaydiv('startend',false) self:displaydiv('character',false) self:displaydiv('wordlist',false) if newmode == 'wordlist' then self:displaydiv('wordlist',true) end if newmode == 'number' then self:displaydiv('increment',true) self:displaydiv('startend',true) end if newmode == 'char_repeat' then self:displaydiv('increment',true) self:displaydiv('startend',true) self:displaydiv('character',true) ui.start.value = '1' end if newmode == 'ascii' then self:displaydiv('startend',true) ui.start.value = '32' ui.aend.value = '126' end end function Fuzzer:openjs() local ui = self.ui local f = ui.scriptlist.value local fcontents = '' if scop.file.exists(self.default_jsdir..f) then fcontents = scop.file.getcontents(self.default_jsdir..f) end ui.script.value = fcontents end function Fuzzer:get_scriptlist(ext) local p = scl.listparser:new() local flist = scl.stringlist:new() local l = scop.dir.getfilelist(self.default_jsdir..'*'..ext) p:load(l) while p:parsing() do flist:add('') end local result = flist.text flist:release() p:release() return result end function Fuzzer:loadui(url,script,ext) local html = Syhunt:getfile('Scripts/Fuzzer.html') local advoptions = '' html = stringop.replace(html,'',self:get_scriptlist(ext)) if ext == '.lua' then html = html..'' advoptions = Syhunt:getfile('Scripts/ReqEditorLow_Adv.html') else html = html..'' advoptions = Syhunt:getfile('Scripts/XHREditor_Adv.html') end html = stringop.replace(html,'',advoptions) browser.loadpagex('fuzzer',html,'Fuzzer.ui') local ui = self.ui ui.isxhr.value = true ui.url.value = url..'{$1}' ui.labprogdir.value = app.dir ui.lablangext.value = ext ui.script.value = script end function Fuzzer:loadfromreqeditor(baseurl) local baseurl = self.ui.url.value self:loadui(baseurl,self.default_jsfilters,'.js') end function Fuzzer:view() self:loadui(tab.url,self.default_jsfilters,'.js') end function Fuzzer:view_lowlevel() local default_filters = [[ -- Add your Lua filters here. Examples: -- if http.status == 404 then canlog = false end -- if scop.re.match(http.text,'someregex') == false then canlog = false end -- if stringop.match(string.lower(http.text),'*error*') == false then canlog = false end ]] self:loadui(tab.url,default_filters,'.lua') local ui = self.ui local hdr = tab.sentheaders self:loadhost() if hdr == '' then hdr = 'GET /'..scop.url.crack(tab.url).path..' HTTP/1.1\nHost: '..ui.host.value..'\nConnection: Keep-Alive' end ui.divstandard:setstyle('display','none') ui.divlow:setstyle('display','block') ui.request.value = stringop.replace(hdr,' HTTP/','{$1} HTTP/') ui.islow.value = true ui.isxhr.value = false end function Fuzzer:loadhost() local ui = self.ui local url = scop.url.crack(tab.url) local request = ui.request.value if scop.http.getheader(request,'Host') ~= '' then url.host = scop.http.getheader(request,'Host') url.host = stringop.trim(url.host) url.port = 80 if stringop.match(url.host,'*:*') then url.port = stringop.after(url.host,':') url.host = stringop.before(url.host,':') end end ui.host.value = url.host ui.port.value = url.port end function Fuzzer:start() local ui = self.ui local script = Syhunt:getfile('Scripts/FuzzerTask.lua') local j = {} j.filter = ui.script.value j.delay = ui.delay.value -- fuzzer mode j.mode = ui.mode.value j.wordlistfile = ui.wordlist.value j.char = ui.char.value j.i_start = ui.start.value j.i_end = ui.aend.value j.i_inc = ui.inc.value j.isxhr = ui.isxhr.value j.islow = ui.islow.value -- fuzzer mode end -- advanced options if ui.isxhr.value == true then j.method = ui.method.value j.baseurl = ui.url.value j.basepostdata = ui.postdata.value j.basereqheaders = ui.reqheaders.value j.username = ui.username.value j.password = ui.password.value end if ui.islow.value == true then j.host = ui.host.value j.port = ui.port.value j.baserequest = ui.request.value j.autocontentlen = ui.autocontentlen.value j.enablegzip = ui.enablegzip.value j.maxretry = ui.maxretry.value end -- advanced options end browser.options.showheaders = true tab.capturerealtime = false tab:runtask(script,json.encode(j)) end