Merge pull request #172 from s0md3v/2.2.0

2.2.0

CHANGELOG.md

@@ -1,3 +1,9 @@
+#### 2.2.0
+- Ability to detect parameters that respond to a certain value e.g. "?debug=yes"
+- Added "required parameter" detection 
+- Heuristic can now extract words out of json/text responses
+- Fixed -oB option description
+
 #### 2.1.6
 - Fixed multiple breaking bugs
 - Export results as they come in multi-target mode

README.md

@@ -74,4 +74,5 @@ Direct links to some basic options are given below:
 Optionally, you can use the `--help` argument to explore Arjun on your own.
 
 ##### Credits
-The parameter names wordlist is created by extracting top parameter names from [CommonCrawl](http://commoncrawl.org) dataset and merging best words from [SecLists](https://github.com/danielmiessler/SecLists) and [param-miner](https://github.com/PortSwigger/param-miner) wordlists into that.
+The parameter names wordlist is created by extracting top parameter names from [CommonCrawl](http://commoncrawl.org) dataset and merging best words from [SecLists](https://github.com/danielmiessler/SecLists) and [param-miner](https://github.com/PortSwigger/param-miner) wordlists into that.\
+`db/special.json` wordlist is taken from [data-payloads](https://github.com/yehgdotnet/data-payloads).

arjun/__init__.py

@@ -1 +1 @@
-__version__ = '2.1.6'
+__version__ = '2.2.0'

arjun/__main__.py

@@ -4,6 +4,7 @@
 from arjun.core.colors import green, end, info, bad, good, run, res
 
 import argparse
+import json
 
 from urllib.parse import urlparse
 import arjun.core.config as mem
@@ -26,7 +27,7 @@
 parser.add_argument('-d', help='Delay between requests in seconds. (default: 0)', dest='delay', type=float, default=0)
 parser.add_argument('-t', help='Number of concurrent threads. (default: 5)', dest='threads', type=int, default=5)
 parser.add_argument('-w', help='Wordlist file path. (default: {arjundir}/db/large.txt)', dest='wordlist', default=arjun_dir+'/db/large.txt')
-parser.add_argument('-m', help='Request method to use: GET/POST/XML/JSON. (default: GET)', dest='method', default='GET')
+parser.add_argument('-m', help='Request method to use: GET/POST/XML/JSON/HEADERS. (default: GET)', dest='method', default='GET')
 parser.add_argument('-i', help='Import target URLs from file.', dest='import_file', nargs='?', const=True)
 parser.add_argument('-T', help='HTTP request timeout in seconds. (default: 15)', dest='timeout', type=float, default=15)
 parser.add_argument('-c', help='Chunk size. The number of parameters to be sent at once', type=int, dest='chunks', default=500)
@@ -127,14 +128,19 @@ def initialize(request, wordlist, single_url=False):
  factors = define(response_1, response_2, fuzz, fuzz[::-1], wordlist)
  if single_url:
  print('%s Analysing HTTP response for potential parameter names' % run)
- found = heuristic(response_1.text, wordlist)
+ found, words_exist = heuristic(response_1, wordlist)
  if found:
  num = len(found)
- s = 's' if num > 1 else ''
- print('%s Heuristic scanner found %i parameter%s: %s' % (good, num, s, ', '.join(found)))
+ if words_exist:
+ print('%s Heuristic scanner found %i parameters' % (good, num))
+ else:
+ s = 's' if num > 1 else ''
+ print('%s Heuristic scanner found %i parameter%s: %s' % (good, num, s, ', '.join(found)))
  if single_url:
  print('%s Logicforcing the URL endpoint' % run)
  populated = populate(wordlist)
+ with open(f'{arjun_dir}/db/special.json', 'r') as f:
+ populated.update(json.load(f))
  param_groups = slicer(populated, int(len(wordlist)/mem.var['chunks']))
  prev_chunk_count = len(param_groups)
  last_params = []
@@ -157,7 +163,8 @@ def initialize(request, wordlist, single_url=False):
  if reason:
  name = list(param.keys())[0]
  confirmed_params.append(name)
- print('%s parameter detected: %s, based on: %s' % (res, name, reason))
+ if single_url:
+ print('%s parameter detected: %s, based on: %s' % (res, name, reason))
  return confirmed_params
 
 
@@ -171,14 +178,15 @@ def main():
  # in case of a single target
  mem.var['kill'] = False
  url = request['url']
- these_params = initialize(request, wordlist)
+ these_params = initialize(request, wordlist, single_url=True)
  if these_params == 'skipped':
  print('%s Skipped %s due to errors' % (bad, request['url']))
  elif these_params:
  final_result[url] = {}
  final_result[url]['params'] = these_params
  final_result[url]['method'] = request['method']
  final_result[url]['headers'] = request['headers']
+ print('%s Parameters found: %s' % (good, ', '.join(final_result[url]['params'])))
  exporter(final_result)
  else:
  print('%s No parameters were discovered.' % info)

arjun/core/anomaly.py

@@ -89,7 +89,7 @@ def compare(response, factors, params):
  return ('param name reflection', params)
  if factors['value_missing']:
  for value in params.values():
- if type(value) != str:
+ if type(value) != str or len(value) != 6:
  continue
  if value in response.text and re.search(r'[\'"\s]%s[\'"\s]' % value, response.text):
  return ('param value reflection', params)

arjun/core/exporter.py

@@ -18,8 +18,8 @@ def burp_export(result):
  exports results to Burp Suite by sending request to Burp proxy
  """
  proxies = {
- 'http': 'http://' + mem.var['burp_port'],
- 'https': 'https://' + mem.var['burp_port']
+ 'http': 'http://127.0.0.1:' + mem.var['burp_port'],
+ 'https': 'https://127.0.0.1:' + mem.var['burp_port']
  }
  for url, data in result.items():
  if data['method'] == 'GET':

arjun/core/requester.py

@@ -18,7 +18,7 @@ def requester(request, payload={}):
  if len(request.get('include', '')) != 0:
  payload.update(request['include'])
  if mem.var['stable']:
- mem.var['delay'] = random.choice(range(6, 12))
+ mem.var['delay'] = random.choice(range(3, 10))
  time.sleep(mem.var['delay'])
  url = request['url']
  if mem.var['kill']:

arjun/db/special.json

@@ -0,0 +1,153 @@
+{
+ "debug": "yes",
+ "debug": "true",
+ "debug": "1",
+ "debug": "on",
+ "test": "yes",
+ "test": "true",
+ "test": "1",
+ "test": "on",
+ "source": "yes",
+ "source": "true",
+ "source": "1",
+ "source": "on",
+ "admin": "yes",
+ "admin": "true",
+ "admin": "1",
+ "admin": "on",
+ "show": "yes",
+ "show": "true",
+ "show": "1",
+ "show": "on",
+ "bot": "yes",
+ "bot": "1",
+ "bot": "on",
+ "antibot": "off",
+ "antibot": "0",
+ "antibot": "no",
+ "antibot": "none",
+ "antibot": "nil",
+ "antirobot": "off",
+ "antirobot": "0",
+ "antirobot": "no",
+ "antirobot": "none",
+ "antirobot": "nil",
+ "env": "staging",
+ "env": "test",
+ "env": "testing",
+ "env": "pre",
+ "env": "pre-staging",
+ "env": "daily",
+ "env": "uat",
+ "anticrawl": "off",
+ "anticrawl": "0",
+ "anticrawl": "none",
+ "anticrawl": "no",
+ "anticrawl": "nil",
+ "captcha": "off",
+ "captcha": "0",
+ "captcha": "none",
+ "captcha": "no",
+ "captcha": "nil",
+ "signing": "off",
+ "signing": "0",
+ "signing": "none",
+ "signing": "no",
+ "signing": "nil",
+ "signature": "off",
+ "signature": "0",
+ "signature": "none",
+ "signature": "no",
+ "signature": "nil",
+ "enc": "off",
+ "enc": "0",
+ "enc": "none",
+ "enc": "no",
+ "enc": "nil",
+ "encryption": "off",
+ "encryption": "0",
+ "encryption": "none",
+ "encryption": "no",
+ "encryption": "nil",
+ "automation": "on",
+ "automation": "1",
+ "automation": "yes",
+ "waf": "disabled",
+ "waf": "disable",
+ "waf": "off",
+ "waf": "0",
+ "waf": "no",
+ "security": "disabled",
+ "security": "disable",
+ "security": "0",
+ "security": "no",
+ "isdebug": "yes",
+ "isdebug": "true",
+ "isdebug": "1",
+ "isdebug": "on",
+ "istest": "yes",
+ "istest": "true",
+ "istest": "1",
+ "istest": "on",
+ "isadmin": "yes",
+ "isadmin": "true",
+ "isadmin": "1",
+ "isadmin": "on",
+ "isbot": "yes",
+ "isbot": "1",
+ "isbot": "on",
+ "isenv": "staging",
+ "isenv": "test",
+ "isenv": "testing",
+ "isenv": "pre",
+ "isenv": "pre-staging",
+ "isenv": "daily",
+ "isenv": "uat",
+ "hascaptcha": "off",
+ "hascaptcha": "0",
+ "hascaptcha": "none",
+ "hascaptcha": "no",
+ "hascaptcha": "nil",
+ "hassigning": "off",
+ "hassigning": "0",
+ "hassigning": "none",
+ "hassigning": "no",
+ "hassigning": "nil",
+ "hassignature": "off",
+ "hassignature": "0",
+ "hassignature": "none",
+ "hassignature": "no",
+ "hassignature": "nil",
+ "isenc": "off",
+ "isenc": "0",
+ "isenc": "none",
+ "isenc": "no",
+ "isenc": "nil",
+ "isencryption": "off",
+ "isencryption": "0",
+ "isencryption": "none",
+ "isencryption": "no",
+ "isencryption": "nil",
+ "hasautomation": "on",
+ "hasautomation": "1",
+ "hasautomation": "yes",
+ "haswaf": "disabled",
+ "haswaf": "disable",
+ "haswaf": "off",
+ "haswaf": "0",
+ "haswaf": "no",
+ "issecurity": "disabled",
+ "issecurity": "disable",
+ "hassecurity": "0",
+ "hassecurity": "no",
+ "disable": "waf",
+ "disable": "security",
+ "disabled": "waf",
+ "disabled": "security",
+ "dosinglesignon": "1",
+ "singlesignon": "1",
+ "hassinglesignon": "1",
+ "dosso": "1",
+ "sso": "1",
+ "hassso": "1"
+}

arjun/plugins/heuristic.py

@@ -1,23 +1,32 @@
 import re
 
+from arjun.core.colors import info
+import arjun.core.config as mem
 from arjun.core.utils import extract_js
 
-re_not_junk = re.compile(r'^[A-Za-z0-9_]+$')
-
-
-def is_not_junk(param):
- return (re_not_junk.match(param) is not None)
-
 # TODO: for map keys, javascript tolerates { param: "value" }
+re_words = re.compile(r'[A-Za-z][A-Za-z0-9_]*')
+re_not_junk = re.compile(r'^[A-Za-z0-9_]+$')
 re_input_names = re.compile(r'''(?i)<input.+?name=["']?([^"'\s>]+)''')
 re_input_ids = re.compile(r'''(?i)<input.+?id=["']?([^"'\s>]+)''')
 re_empty_vars = re.compile(r'''(?:[;\n]|\bvar|\blet)(\w+)\s*=\s*(?:['"`]{1,2}|true|false|null)''')
 re_map_keys = re.compile(r'''['"](\w+?)['"]\s*:\s*['"`]''')
 
+def is_not_junk(param):
+ return (re_not_junk.match(param) is not None)
 
-def heuristic(response, wordlist):
+def heuristic(raw_response, wordlist):
+ words_exist = False
  potential_params = []
 
+ headers, response = raw_response.headers, raw_response.text
+ if headers.get('content-type', '').startswith(('application/json', 'text/plain')):
+ if len(response) < 200:
+ if ('required' or 'missing' or 'not found' or 'requires') in response.lower() and ('param' or 'parameter' or 'field') in response.lower():
+ if not mem.var['quiet']:
+ print('%s The endpoint seems to require certain parameters to function. Check the repsonse and use the --include option appropriately for better results.' % info)
+ words_exist = True
+ potential_params = re_words.findall(response)
  # Parse Inputs
  input_names = re_input_names.findall(response)
  potential_params += input_names
@@ -34,7 +43,7 @@ def heuristic(response, wordlist):
  potential_params += map_keys
 
  if len(potential_params) == 0:
- return []
+ return [], words_exist
 
  found = set()
  for word in potential_params:
@@ -45,4 +54,4 @@ def heuristic(response, wordlist):
  wordlist.remove(word)
  wordlist.insert(0, word)
 
- return list(found)
+ return list(found), words_exist