diff --git a/Vi/vi.py b/Vi/vi.py deleted file mode 100755 index 43408b9..0000000 --- a/Vi/vi.py +++ /dev/null @@ -1,135 +0,0 @@ -#!/usr/bin/env python3 -import re -import urllib.parse -from collections import deque - -import requests -import requests.exceptions -from bs4 import BeautifulSoup - -''' -Vi.py - an automated script to extract all inteersting information from website - -@author: bl4de - -@TBD: -- refactor scafolding code [In progress] -- add argparser - -- extract JavaScript files -> scan them for stuff - (API endpoints, secrets, hardcoded information etc.) -- parse HTML for stuff -- harvest useful information from any comment found (in HTML and JS alike) -- other? (TBA) -''' - - -def extract_emails(emails: set, http_response: requests.Response) -> set: - ''' - Extracts emails from provided HTTP response body and append them - to already found set of emails - ''' - emails.update(set(re.findall( - r"[a-z0-9\.\-+_]+@[a-z0-9\.\-+_]+\.[a-z]+", http_response.text, re.IGNORECASE))) - return emails - - -def extract_javascript_files(javascript_files: set, http_response: requests.Response) -> set: - ''' - Extracts JavaScript files urls from provided HTTP response body and append them - to already found set of javascript_files - ''' - javascript_files.update(set(re.findall( - r"[a-z0-9\.\-_]+\.js", http_response.text, re.IGNORECASE - ))) - return javascript_files - - -def parse_javascript_file(js_filename: str): - ''' - Parse JavaScript file for interesting stuff - ''' - TYPE = 'DEBUG' - print(f"[{TYPE}] parsing {js_filename} for interesting stuff...") - pass - - -def tear_off(): - ''' - Performs data extraction stage - ''' - for js_filename in javascript_files: - parse_javascript_file(js_filename) - - pass - - -def recon(emails: set, javascript_files: set): - ''' - Creates list of resources; some will be proceeded later in next - steps - ''' - user_url = str(input('[+] Enter Target URL To Scan: ')) - urls = deque([user_url]) - MAX_COUNT = 2 - - scraped_urls = set() - - count = 0 - - try: - ''' - main execution loop - ''' - while len(urls): - count += 1 - if count == MAX_COUNT: - break - url = urls.popleft() - scraped_urls.add(url) - - parts = urllib.parse.urlsplit(url) - base_url = '{0.scheme}://{0.netloc}'.format(parts) - - path = url[:url.rfind('/') + 1] if '/' in parts.path else url - - print('[%d] Processing %s' % (count, url)) - try: - response = requests.get(url) - except (requests.exceptions.MissingSchema, requests.exceptions.ConnectionError): - continue - - emails = extract_emails(emails, response) - javascript_files = extract_javascript_files( - javascript_files, response) - - soup = BeautifulSoup(response.text, features="lxml") - - for anchor in soup.find_all("a"): - link = anchor.attrs['href'] if 'href' in anchor.attrs else '' - if link.startswith('/'): - link = base_url + link - elif not link.startswith('http'): - link = path + link - if not link in urls and not link in scraped_urls: - urls.append(link) - except KeyboardInterrupt: - print('[-] Closing!') - - for mail in emails: - print(mail) - for url in urls: - print(url) - for js_file in javascript_files: - print(js_file) - - -if __name__ == "__main__": - emails = set() - javascript_files = set() - - # go through provided url; find emails, javascript files etc. - recon(emails, javascript_files) - - # extract sensitive and interesting information from what was found - tear_off() diff --git a/pef/imports/pefdocs.py b/pef/imports/pefdocs.py index c05b10c..a0efbfd 100644 --- a/pef/imports/pefdocs.py +++ b/pef/imports/pefdocs.py @@ -1,628 +1,889 @@ # Reference(S) for pef.py +# exploitable functions +exploitableFunctions = { + "javascript": [ + "eval(", + "document.URL", + "document.documentURI", + "document.baseURI", + "location", + "document.cookie", + "document.referrer", + "document.write(", + "innerHTML", + "outerHTML", + "insertAdjacentHTML(", + "location.host", + "location.href", + "location.search", + "Function(", + "textContent", + "innerText", + "URLSearchParams(", + ], + "php": [ + # "`", + "system(", + "exec(", + "popen(", + "pcntl_exec(", + "eval(", + "arse_str(", + "parse_url(", + "preg_replace(", + "create_function(", + "passthru(", + "shell_exec(", + "popen(", + "proc_open(", + "pcntl_exec(", + "extract(", + "putenv(", + "ini_set(", + "mail(", + "unserialize(", + "assert(", + "call_user_func(", + "call_user_func_array(", + "ereg_replace(", + "eregi_replace(", + "mb_ereg_replace(", + "mb_eregi_replace(", + "virtual", + "readfile(", + "file_get_contents(", + "show_source(", + "highlight_file(", + "fopen(", + "file(", + "fpassthru(", + "fsockopen(", + "gzopen(", + "gzread(", + "gzfile(", + "gzpassthru(", + "readgzfile(", + "mssql_query(", + "odbc_exec(", + "sqlsrv_query(", + "PDO::query(", + "move_uploaded_file(", + "echo", + "print(", + "printf(", + "ldap_search(", + "sqlite_", + "sqlite_query(", + "pg_", + "pg_query(", + "mysql_", + "mysql_query(", + "mysqli::query(", + "mysqli_", + "mysqli_query(", + "apache_setenv(", + "dl(", + "escapeshellarg(", + "escapeshellcmd(", + "extract(", + "get_cfg_var(", + "get_current_user(", + "getcwd(", + "getenv(", + "ini_restore(", + "ini_set(", + "passthru(", + "pcntl_exec(", + "php_uname(", + "phpinfo(", + "popen(", + "proc_open(", + "putenv(", + "symlink(", + "syslog(", + "curl_exec(", + "__wakeup(", + "__destruct(", + "__sleep(", + "filter_var(", + "file_put_contents(", + "extractTo(", + "$_POST", + "$_GET", + "$_COOKIES", + "$_REQUEST", + "$_SERVER", + "$_SESSION", + "include($_GET", + "require($_GET", + "include_once($_GET", + "require_once($_GET", + "include($_REQUEST", + "require($_REQUEST", + "include_once($_REQUEST", + "require_once($_REQUEST", + "SELECT.*FROM", + "INSERT.*INTO", + "UPDATE.*", + "DELETE.*FROM" + ] +} + # doc dipslayed: # 1st element - description # 2nd element - syntax # 3rd element - possible vulnerability classes exploitableFunctionsDesc = { - "`": [ - "Allows to execute system command", - "`$command`", - "RCE", - "critical", - "sink" - ], - "system()": [ - "Allows to execute system command passed as an argument", - "system ( string $command [, int &$return_var ] ) : string", - "RCE", - "critical", - "sink" - ], - "exec()": [ - "exec - Execute an external program", - "exec ( string $command [, array &$output [, int &$return_var ]] ) : string", - "RCE", - "critical", - "sink" - ], - "call_user_func_array()": [ - "Call a callback with an array of parameters", - "call_user_func_array ( callable $callback , array $param_arr ) : mixed", - "RCE", - "high", - "sink" - ], - "parse_url()": [ - "parse_url — Parse a URL and return its components", - "parse_url(string $url, int $component = -1): mixed", - "SSRF, Filter Bypass", - "medium", - "sink" - ], - "parse_str()": [ - "when parse_str(arg, [target]) parses URL-like string, it sets variables in current scope WITHOUT initializing it", - "parse_str ( string $encoded_string [, array &$result ] ) : void" - "Code Injection", - "high", - "sink" - ], - "eval()": [ - "Evaluate a string as PHP code", - "eval ( string $code ) : mixed", - "RCE", - "critical", - "sink" - ], - "preg_replace()": [ - "Perform a regular expression search and replace. Searches subject for matches to pattern and replaces them with replacement", - "preg_replace ( mixed $pattern , mixed $replacement , mixed $subject [, int $limit = -1 [, int &$count ]] ) : mixed", - "RCE (in certain conditions)", - "medium" - ], - "create_function()": [ - "DEPRECATED as of PHP 7.2.0 - Create an anonymous (lambda-style) function. Creates an anonymous function from the parameters passed, and returns a unique name for it.", - "create_function ( string $args , string $code ) : string", - "Code Injection, RCE", - "medium", - "sink" - ], - "passthru()": [ - "Execute an external program and display raw output", - "passthru ( string $command [, int &$return_var ] ) : void", - "RCE", - "critical", - "sink" - ], - "shell_exec()": [ - "Execute command via shell and return the complete output as a string. This function is identical to the backtick operator.", - "shell_exec ( string $cmd ) : string", - "RCE", - "critical", - "sink" - ], - "popen()": [ - "Opens process file pointer. Opens a pipe to a process executed by forking the command given by command.", - "popen ( string $command , string $mode ) : resource", - "Code Injection", - "critical", - "sink" - ], - "proc_open()": [ - "Execute a command and open file pointers for input/output. proc_open() is similar to popen() but provides a much greater degree of control over the program execution.", - "proc_open ( string $cmd , array $descriptorspec , array &$pipes [, string $cwd = NULL [, array $env = NULL [, array $other_options = NULL ]]] ) : resource", - "Code Injection", - "high", - "sink" - ], - "pcntl_exec()": [ - "Executes the program with the given arguments.", - "pcntl_exec ( string $path [, array $args [, array $envs ]] ) : void", - "RCE", - "critical", - "sink" - ], - "extract()": [ - "Import variables into the current symbol table from an array", - "extract ( array &$array [, int $flags = EXTR_OVERWRITE [, string $prefix = NULL ]] ) : int", - "Code Injection", - "high", - "sink" - ], - "ini_set()": [ - "Sets the value of the given configuration option. The configuration option will keep this new value during the script's execution, and will be restored at the script's ending.", - "ini_set ( string $varname , string $newvalue ) : string", - "PHP Interpreter behavior change; application settings overwrite", - "low" - ], - "mail()": [ - "Sends an email.", - "mail ( string $to , string $subject , string $message [, mixed $additional_headers [, string $additional_parameters ]] ) : bool", - "Arbitrary mail sending", - "low", - "sink" - ], - "echo": [ - "Outputs all parameters. No additional newline is appended.", - "echo ( string $arg1 [, string $... ] ) : void", - "XSS, HTML Injection, Content Injection etc.", - "low" - ], - "unserialize()": [ - "unserialize() takes a single serialized variable and converts it back into a PHP value.", - "unserialize ( string $str [, array $options ] ) : mixed", - "Code Injection, RCE (in certain conditions)", - "high", - "sink" - ], - "assert()": [ - "assert() will check the given assertion and take appropriate action if its result is FALSE. If the assertion is given as a string it will be evaluated as PHP code by assert() - ONLY PNP <7.2.0", - "assert ( mixed $assertion [, string $description ] ) : bool (PHP 5,7) assert ( mixed $assertion [, Throwable $exception ] ) : bool (PHP 7)", - "RCE, Code Injection (in certain conditions)", - "low" - ], - "call_user_func()": [ - "Calls the callback given by the first parameter and passes the remaining parameters as arguments.", - "call_user_func ( callable $callback [, mixed $... ] ) : mixed", - "Code Injection", - "high", - "sink" - ], - "ereg_replace()": [ - "This function scans string for matches to pattern, then replaces the matched text with replacement (DEPRECATED in PHP 5.3.0, and REMOVED in PHP 7.0.0.)", - "ereg_replace ( string $pattern , string $replacement , string $string ) : string", - "Code Injection", - "low", - "sink" - ], - "eregi_replace()": [ - "This function is identical to ereg_replace() except that this ignores case distinction when matching alphabetic characters. (DEPRECATED in PHP 5.3.0, and REMOVED in PHP 7.0.0)", - "eregi_replace ( string $pattern , string $replacement , string $string ) : string", - "Code Injection", - "low", - "sink" - ], - "mb_ereg_replace()": [ - "Scans string for matches to pattern, then replaces the matched text with replacement. Never use the e modifier when working on untrusted input. No automatic escaping will happen (as known from preg_replace()).", - "mb_ereg_replace ( string $pattern , string $replacement , string $string [, string $option = \"msr\" ] ) : string", - "Code Injection", - "low", - "sink" - ], - "mb_eregi_replace()": [ - "Scans string for matches to pattern, then replaces the matched text with replacement. Never use the e modifier when working on untrusted input. No automatic escaping will happen (as known from preg_replace()).", - "mb_eregi_replace ( string $pattern , string $replace , string $string [, string $option = \"msri\" ] ) : string", - "Code Injection", - "low", - "sink" - ], - "virtual()": [ - "Perform an Apache sub-request (calls url passed as an argument). This function is supported when PHP is installed as an Apache module or by the NSAPI server module", - "virtual ( string $filename ) : bool", - "Local File Include, Remote File Include", - "low", - "sink" - ], - "readfile()": [ - "Reads a file and writes it to the output buffer.", - "readfile ( string $filename [, bool $use_include_path = FALSE [, resource $context ]] ) : int", - "Code Injection, LFI, RFI", - "high", - "source" - ], - "file_get_contents()": [ - "This function is similar to file(), except that file_get_contents() returns the file in a string, starting at the specified offset up to maxlen bytes. On failure, file_get_contents() will return FALSE.", - "file_get_contents ( string $filename [, bool $use_include_path = FALSE [, resource $context [, int $offset = 0 [, int $maxlen ]]]] ) : string", - "Code Injection, LFI, RFI", - "high", - "source" - ], - "show_source()": [ - "(Alias for highlight_file()) Prints out or returns a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.", - "show_source ( string $filename [, bool $return = FALSE ] ) : mixed", - "Information Disclosure", - "low", - "source" - ], - "highlight_file()": [ - "Prints out or returns a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.", - "highlight_file ( string $filename [, bool $return = FALSE ] ) : mixed", - "Information Disclosure", - "low", - "source" - ], - "fopen()": [ - "fopen() binds a named resource, specified by filename, to a stream.", - "fopen ( string $filename , string $mode [, bool $use_include_path = FALSE [, resource $context ]] ) : resource", - "Code Injection, LFI, RFI", - "low", - "source" - ], - "file()": [ - "Reads an entire file into an array.", - "ile ( string $filename [, int $flags = 0 [, resource $context ]] ) : array", - "Code Injection, LFI, RFI", - "low", - "source" - ], - "fpassthru()": [ - "Reads to EOF on the given file pointer from the current position and writes the results to the output buffer.", - "fpassthru ( resource $handle ) : int", - "Code Injection, LFI, RFI, RCE (depending on the context)", - "low", - "sink" - ], - "fsockopen()": [ - "Initiates a socket connection to the resource specified by hostname.", - "fsockopen ( string $hostname [, int $port = -1 [, int &$errno [, string &$errstr [, float $timeout = ini_get(\"default_socket_timeout\") ]]]] ) : resource", - "RCE (depends on context)", - "low", - "sink" - ], - "gzopen()": [ - "Opens a gzip (.gz) file for reading or writing.", - "gzopen ( string $filename , string $mode [, int $use_include_path = 0 ] ) : resource", - "Code Injection, LFI (depends on context)", - "low", - "sink" - ], - "gzread()": [ - "gzread() reads up to length bytes from the given gz-file pointer. Reading stops when length (uncompressed) bytes have been read or EOF is reached, whichever comes first.", - "gzread ( resource $zp , int $length ) : string", - "Code Injection, LFI", - "low", - "sink" - ], - "gzfile()": [ - "Read entire gz-file into an array. This function is identical to readgzfile(), except that it returns the file in an array.", - "gzfile ( string $filename [, int $use_include_path = 0 ] ) : array", - "Code Injection, LFI", - "low", - "sink" - ], - "gzpassthru()": [ - "Output all remaining data on a gz-file pointer. Reads to EOF on the given gz-file pointer from the current position and writes the (uncompressed) results to standard output.", - "gzpassthru ( resource $zp ) : int", - "Code Injection, LFI", - "low", - "sink" - ], - "readgzfile()": [ - "Output a gz-file. Reads a file, decompresses it and writes it to standard output.", - "readgzfile ( string $filename [, int $use_include_path = 0 ] ) : int", - "Code Injection, LFI, RCE", - "medium", - "sink" - ], - "mssql_query()": [ - "Send MS SQL query to the currently active database on the server that's associated with the specified link identifier. This function was REMOVED in PHP 7.0.0.", - "mssql_query ( string $query [, resource $link_identifier [, int $batch_size = 0 ]] ) : mixed", - "SQL Injection", - "high" - ], - "odbc_exec()": [ - "Sends an SQL statement to the database server.", - "odbc_exec ( resource $connection_id , string $query_string [, int $flags ] ) : resource", - "SQL Injection", - "high", - "sink" - ], - "sqlsrv_query()": [ - "Prepares and executes a query", - "sqlsrv_query ( resource $conn , string $sql [, array $params [, array $options ]] ) : mixed", - "SQL Injection", - "medium", - "sink" - ], - "PDO::query()": [ - "PDO::query() executes an SQL statement in a single function call, returning the result set (if any) returned by the statement as a PDOStatement object.", - "public PDO::query ( string $statement , int $PDO::FETCH_CLASS , string $classname , array $ctorargs ) : PDOStatement", - "SQL Injection", - "medium", - "sink" - ], - "move_uploaded_file()": [ - "This function checks to ensure that the file designated by filename is a valid upload file (meaning that it was uploaded via PHP's HTTP POST upload mechanism). If the file is valid, it will be moved to the filename given by destination.", - "move_uploaded_file ( string $filename , string $destination ) : bool", - "File Include", - "low", - "sink" - ], - "print()": [ - "Outputs arg. print is not actually a real function (it is a language construct) so you are not required to use parentheses with its argument list.", - "print ( string $arg ) : int", - "XSS, Content/HTML Injection", - "low", - "sink" - ], - "printf()": [ - "Produces output according to format.", - "printf ( string $format [, mixed $... ] ) : int", - "XSS, Content/HTML Injection", - "low", - "sink" - ], - "ldap_search()": [ - "Performs the search for a specified filter on the directory with the scope of LDAP_SCOPE_SUBTREE. This is equivalent to searching the entire directory.", - "ldap_search ( resource $link_identifier , string $base_dn , string $filter [, array $attributes = array() [, int $attrsonly = 0 [, int $sizelimit = -1 [, int $timelimit = -1 [, int $deref = LDAP_DEREF_NEVER [, array $serverctrls = array() ]]]]]] ) : resource", - "unknown?", - "low" - ], - "header()": [ - "Send a raw HTTP header", - "header ( string $header [, bool $replace = TRUE [, int $http_response_code ]] ) : void", - "Header Injection, Open Redirect", - "low", - "sink" - ], - "sqlite_query()": [ - "SQLiteDatabase::query - Executes a query against a given database and returns a result handle", - "sqlite_query ( string $query , resource $dbhandle [, int $result_type = SQLITE_BOTH [, string &$error_msg ]] ) : resource", - "SQL Injection", - "medium", - "sink" - ], - "pg_query()": [ - "pg_query() executes the query on the specified database connection. pg_query_params() should be preferred in most cases.", - "pg_query ([ resource $connection ], string $query ) : resource", - "SQL Injection", - "medium", - "sink" - ], - "mysql_query()": [ - "mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier.(deprecated in PHP 5.5.0, and it was removed in PHP 7.0.0)", - "mysql_query ( string $query [, resource $link_identifier = NULL ] ) : mixed", - "SQL Injection", - "high", - "sink" - ], - "mysqli_query()": [ - "Performs a query against the database.", - "mysqli_query ( mysqli $link , string $query [, int $resultmode = MYSQLI_STORE_RESULT ] ) : mixed", - "SQL Injection", - "medium", - "sink" - ], - "mysqli::query()": [ - "Performs a query against the database.", - "mysqli::query ( string $query [, int $resultmode = MYSQLI_STORE_RESULT ] ) : mixed", - "SQL Injection", - "medium", - "sink" - ], - "apache_setenv()": [ - "Sets the value of the Apache environment variable specified by variable.", - "apache_setenv ( string $variable , string $value [, bool $walk_to_top = FALSE ] ) : bool", - "ENV server variables overwrite", - "low", - "sink" - ], - "dl()": [ - "Loads a PHP extension at runtime", - "dl ( string $library ) : bool", - "Code Injection, RCE (in certain conditions)", - "low", - "sink" - ], - "escapeshellarg()": [ - "Escape a string to be used as a shell argument", - "escapeshellarg ( string $arg ) : string", - "", - "low" - ], - "escapeshellcmd()": [ - "Escapes any characters in a string that might be used to trick a shell command into executing arbitrary commands", - "escapeshellcmd ( string $command ) : string", - "", - "low" - ], - "get_cfg_var()": [ - "Gets the value of a PHP configuration option", - "get_cfg_var ( string $option ) : mixed", - "Information Disclosure", - "low" - ], - "get_current_user()": [ - "Gets the name of the owner of the current PHP script", - "get_current_user ( void ) : string", - "Information Disclosure", - "low" - ], - "getcwd()": [ - "Gets the current working directory", - "getcwd ( void ) : string", - "Information Disclosure", - "low" - ], - "getenv()": [ - " Gets the value of an environment variable", - "getenv ( string $varname [, bool $local_only = FALSE ] ) : string", - "Information Disclosure", - "low" - ], - "php_uname()": [ - "Returns information about the operating system PHP is running on", - "php_uname ([ string $mode = \"a\" ] ) : string", - "Information Disclosure", - "low" - ], - "phpinfo()": [ - "Outputs information about PHP's configuration", - "phpinfo ([ int $what = INFO_ALL ] ) : bool", - "Information Disclosure", - "medium" - ], - "putenv()": [ - "Adds setting to the server environment. The environment variable will only exist for the duration of the current request. At the end of the request the environment is restored to its original state.", - "putenv ( string $setting ) : bool", - "ENV variable create/owerwrite", - "low", - "sink" - ], - "symlink()": [ - "Creates a symbolic link to the existing target with the specified name link.", - "symlink ( string $target , string $link ) : bool", - "LFI (in certain conditions)", - "low" - ], - "syslog()": [ - "Generate a system log message", - "syslog ( int $priority , string $message ) : bool", - "Log poisoning", - "low" - ], - "curl_exec()": [ - "Execute the given cURL session. This function should be called after initializing a cURL session and all the options for the session are set.", - "curl_exec ( resource $ch ) : mixed", - "SSRF", - "medium", - "sink" - ], - "__destruct()": [ - "unserialize() checks if your class has a function with the magic name __destruct(). If so, that function is executed after unserialization", - "__destruct ( void ) : void", - "Object Injection; RCE via unserialize() + POP gadget chain", - "high", - "sink" - ], - "__wakeup()": [ - "serialize() checks if your class has a function with the magic name __wakeup(). If so, that function is executed prior to any serialization", - "__wakeup ( void ) : void", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__sleep()": [ - "serialize() checks if your class has a function with the magic name __sleep(). If so, that function is executed prior to any serialization", - "public __sleep ( void ) : array", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__serialize()": [ - "checks if the class has a function with the magic name __serialize(). If so, that function is executed prior to any serialization. It must construct and return an associative array of key/value pairs that represent the serialized form of the object. If no array is returned a TypeError will be thrown.", - "public __sleep ( void ) : array", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__unserialize()": [ - "checks for the presence of a function with the magic name __unserialize(). If present, this function will be passed the restored array that was returned from __serialize(). It may then restore the properties of the object from that array as appropriate.", - "public __sleep ( void ) : array", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__call()": [ - "Triggered when invoking inaccessible methods in an object context", - "public __call ( string $name , array $arguments ) : mixed", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__get()": [ - "Is utilized for reading data from inaccessible (protected or private) or non-existing properties.", - "public __get ( string $name ) : mixed", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__set()": [ - "Is run when writing data to inaccessible (protected or private) or non-existing properties.", - "public __set ( string $name, mixed $value ) : void", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "__callStatic()": [ - "Triggered when invoking inaccessible methods in a static context.", - "public static __callStatic ( string $name , array $arguments ) : mixed", - "Object Injection; RCE via unserialize() + POP gadget chain", - "medium", - "sink" - ], - "filter_var()": [ - "Filters a variable with a specified filter", - "filter_var ( mixed $variable [, int $filter = FILTER_DEFAULT [, mixed $options ]] ) : mixed", - "Validation bypass (in certain conditions)", - "low" - ], - "file_put_contents()": [ - "Write data to a file", - "file_put_contents ( string $filename , mixed $data [, int $flags = 0 [, resource $context ]] ) : int", - "Arbitrary file write", - "high", - "source" - ], - "extractTo(": [ - "Extract the complete archive or the given files to the specified destination. The default permissions for extracted files and directories give the widest possible access.", - "public ZipArchive::extractTo(string $pathto, array|string|null $files = null): bool", - "Arbitrary file write", - "medium", - "source" - ], - "SELECT.*FROM": [ - "SQL syntax found.", - "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", - "SQL Injection", - "medium", - "source" - ], - "INSERT.*INTO": [ - "SQL syntax found.", - "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", - "SQL Injection", - "medium", - "source" - ], - "UPDATE.*": [ - "SQL syntax found.", - "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", - "SQL Injection", - "medium", - "source" - ], - "DELETE.*FROM": [ - "SQL syntax found.", - "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", - "SQL Injection", - "medium", - "source" - ], - "$_POST": [ - "$_POST reference found", - "", - "", - "critical", - "source" - ], - "$_GET": [ - "$_GET reference found", - "", - "", - "critical", - "source" - ], - "$_REQUEST": [ - "$_REQUEST reference found", - "", - "", - "critical", - "source" - ], - "$_FILES": [ - "$_FILES reference found", - "", - "", - "high", - "source" - ], - "$_ENV": [ - "$_ENV reference found", - "", - "", - "medium", - "source" - ], - "$_COOKIES": [ - "$_COOKIES reference found", - "", - "", - "high", - "source" - ], - "$_SESSION": [ - "$_SESSION reference found", - "", - "", - "medium", - "source" - ], - "$_SERVER": [ - "$_SERVER reference found", - "", - "", - "medium", - "source" - ] + "javascript": { + "eval()": [ + "The eval() function evaluates JavaScript code represented as a string and returns its completion value. The source is parsed as a script.", + "eval(script)", + "RCE", + "critical", + "sink" + ], + "document.URL": [ + "The URL of the document", + "document.URL", + "SSRF, Filter Bypass", + "medium", + "source" + ], + "document.documentURI": [ + "The documentURI property returns the URI of the document", + "document.documentURI", + "SSRF, Filter Bypass", + "medium", + "source" + ], + "document.baseURI": [ + "The baseURI property returns the absolute base URI of the document", + "document.baseURI", + "SSRF, Filter Bypass", + "medium", + "source" + ], + "location": [ + "The location property of the Window interface is a Location object, which represents the location (URL) of the object to which it is applied.", + "location", + "SSRF, Filter Bypass", + "medium", + "source" + ], + "document.cookie": [ + "The cookie property of the Document interface represents the cookies of the current document.", + "document.cookie", + "XSS, CSRF, Cookie Injection", + "medium", + "source" + ], + "document.referrer": [ + "The referrer property of the Document interface returns the address of the previous document from which the current document was accessed.", + "document.referrer", + "SSRF, Filter Bypass", + "medium", + "source" + ], + "document.write()": [ + "The write() method of the Document interface writes a string of text to a document stream opened by document.open().", + "document.write(text)", + "XSS, HTML Injection, Content Injection etc.", + "high", + "sink" + ], + "innerHTML": [ + "The innerHTML property of the Element interface gets or sets the HTML or XML markup contained within the element.", + "element.innerHTML", + "XSS, HTML Injection, Content Injection etc.", + "high", + "sink" + ], + "outerHTML": [ + "The outerHTML property of the Element interface gets or sets the HTML or XML markup contained within the element, including the element itself.", + "element.outerHTML", + "XSS, HTML Injection, Content Injection etc.", + "high", + "sink" + ], + "insertAdjacentHTML": [ + "The insertAdjacentHTML() method of the Element interface parses the specified text as HTML or XML and inserts the resulting nodes into the DOM tree at a specified position.", + "element.insertAdjacentHTML(position, text)", + "XSS, HTML Injection, Content Injection etc.", + "high", + "sink" + ], + "location.host": [ + "The host property of the Location interface returns the host and port of the URL.", + "location.host", + "SSRF, Filter Bypass, Open Redirect", + "medium", + "sink" + ], + "location.href": [ + "The href property of the Location interface gets or sets the entire URL.", + "location.href", + "SSRF, Filter Bypass, Open Redirect", + "medium", + "sink" + ], + "location.search": [ + "The search property of the Location interface gets or sets the query string part of the URL.", + "location.search", + "SSRF, Filter Bypass", + "medium", + "sink" + ], + "Function()": [ + "The Function() constructor creates a new Function object. Calling the constructor directly can create functions dynamically, but it is not recommended due to security and performance reasons.", + "new Function([arg1[, arg2[, ...argN]],] functionBody)", + "RCE", + "critical", + "sink" + ], + "textContent": [ + "The textContent property of the Node interface represents the text content of the node and its descendants.", + "element.textContent", + "XSS, HTML Injection, Content Injection etc.", + "medium", + "sink" + ], + "innerText": [ + "The innerText property of the Element interface represents the rendered text content of an element and its descendants.", + "element.innerText", + "XSS, HTML Injection, Content Injection etc.", + "medium", + "sink" + ], + "URLSearchParams": [ + "The URLSearchParams interface defines utility methods to work with the query string of a URL.", + "URLSearchParams()", + "XSS, HTML Injection, Content Injection etc.", + "medium", + "source" + ], + + }, + "php": { + "`": [ + "Allows to execute system command", + "`$command`", + "RCE", + "critical", + "sink" + ], + "system()": [ + "Allows to execute system command passed as an argument", + "system ( string $command [, int &$return_var ] ) : string", + "RCE", + "critical", + "sink" + ], + "exec()": [ + "exec - Execute an external program", + "exec ( string $command [, array &$output [, int &$return_var ]] ) : string", + "RCE", + "critical", + "sink" + ], + "call_user_func_array()": [ + "Call a callback with an array of parameters", + "call_user_func_array ( callable $callback , array $param_arr ) : mixed", + "RCE", + "high", + "sink" + ], + "parse_url()": [ + "parse_url — Parse a URL and return its components", + "parse_url(string $url, int $component = -1): mixed", + "SSRF, Filter Bypass", + "medium", + "sink" + ], + "parse_str()": [ + "when parse_str(arg, [target]) parses URL-like string, it sets variables in current scope WITHOUT initializing it", + "parse_str ( string $encoded_string [, array &$result ] ) : void" + "Code Injection", + "high", + "sink" + ], + "eval()": [ + "Evaluate a string as PHP code", + "eval ( string $code ) : mixed", + "RCE", + "critical", + "sink" + ], + "preg_replace()": [ + "Perform a regular expression search and replace. Searches subject for matches to pattern and replaces them with replacement", + "preg_replace ( mixed $pattern , mixed $replacement , mixed $subject [, int $limit = -1 [, int &$count ]] ) : mixed", + "RCE (in certain conditions)", + "medium" + ], + "create_function()": [ + "DEPRECATED as of PHP 7.2.0 - Create an anonymous (lambda-style) function. Creates an anonymous function from the parameters passed, and returns a unique name for it.", + "create_function ( string $args , string $code ) : string", + "Code Injection, RCE", + "medium", + "sink" + ], + "passthru()": [ + "Execute an external program and display raw output", + "passthru ( string $command [, int &$return_var ] ) : void", + "RCE", + "critical", + "sink" + ], + "shell_exec()": [ + "Execute command via shell and return the complete output as a string. This function is identical to the backtick operator.", + "shell_exec ( string $cmd ) : string", + "RCE", + "critical", + "sink" + ], + "popen()": [ + "Opens process file pointer. Opens a pipe to a process executed by forking the command given by command.", + "popen ( string $command , string $mode ) : resource", + "Code Injection", + "critical", + "sink" + ], + "proc_open()": [ + "Execute a command and open file pointers for input/output. proc_open() is similar to popen() but provides a much greater degree of control over the program execution.", + "proc_open ( string $cmd , array $descriptorspec , array &$pipes [, string $cwd = NULL [, array $env = NULL [, array $other_options = NULL ]]] ) : resource", + "Code Injection", + "high", + "sink" + ], + "pcntl_exec()": [ + "Executes the program with the given arguments.", + "pcntl_exec ( string $path [, array $args [, array $envs ]] ) : void", + "RCE", + "critical", + "sink" + ], + "extract()": [ + "Import variables into the current symbol table from an array", + "extract ( array &$array [, int $flags = EXTR_OVERWRITE [, string $prefix = NULL ]] ) : int", + "Code Injection", + "high", + "sink" + ], + "ini_set()": [ + "Sets the value of the given configuration option. The configuration option will keep this new value during the script's execution, and will be restored at the script's ending.", + "ini_set ( string $varname , string $newvalue ) : string", + "PHP Interpreter behavior change; application settings overwrite", + "low" + ], + "mail()": [ + "Sends an email.", + "mail ( string $to , string $subject , string $message [, mixed $additional_headers [, string $additional_parameters ]] ) : bool", + "Arbitrary mail sending", + "low", + "sink" + ], + "echo": [ + "Outputs all parameters. No additional newline is appended.", + "echo ( string $arg1 [, string $... ] ) : void", + "XSS, HTML Injection, Content Injection etc.", + "low" + ], + "unserialize()": [ + "unserialize() takes a single serialized variable and converts it back into a PHP value.", + "unserialize ( string $str [, array $options ] ) : mixed", + "Code Injection, RCE (in certain conditions)", + "high", + "sink" + ], + "assert()": [ + "assert() will check the given assertion and take appropriate action if its result is FALSE. If the assertion is given as a string it will be evaluated as PHP code by assert() - ONLY PNP <7.2.0", + "assert ( mixed $assertion [, string $description ] ) : bool (PHP 5,7) assert ( mixed $assertion [, Throwable $exception ] ) : bool (PHP 7)", + "RCE, Code Injection (in certain conditions)", + "low" + ], + "call_user_func()": [ + "Calls the callback given by the first parameter and passes the remaining parameters as arguments.", + "call_user_func ( callable $callback [, mixed $... ] ) : mixed", + "Code Injection", + "high", + "sink" + ], + "ereg_replace()": [ + "This function scans string for matches to pattern, then replaces the matched text with replacement (DEPRECATED in PHP 5.3.0, and REMOVED in PHP 7.0.0.)", + "ereg_replace ( string $pattern , string $replacement , string $string ) : string", + "Code Injection", + "low", + "sink" + ], + "eregi_replace()": [ + "This function is identical to ereg_replace() except that this ignores case distinction when matching alphabetic characters. (DEPRECATED in PHP 5.3.0, and REMOVED in PHP 7.0.0)", + "eregi_replace ( string $pattern , string $replacement , string $string ) : string", + "Code Injection", + "low", + "sink" + ], + "mb_ereg_replace()": [ + "Scans string for matches to pattern, then replaces the matched text with replacement. Never use the e modifier when working on untrusted input. No automatic escaping will happen (as known from preg_replace()).", + "mb_ereg_replace ( string $pattern , string $replacement , string $string [, string $option = \"msr\" ] ) : string", + "Code Injection", + "low", + "sink" + ], + "mb_eregi_replace()": [ + "Scans string for matches to pattern, then replaces the matched text with replacement. Never use the e modifier when working on untrusted input. No automatic escaping will happen (as known from preg_replace()).", + "mb_eregi_replace ( string $pattern , string $replace , string $string [, string $option = \"msri\" ] ) : string", + "Code Injection", + "low", + "sink" + ], + "virtual()": [ + "Perform an Apache sub-request (calls url passed as an argument). This function is supported when PHP is installed as an Apache module or by the NSAPI server module", + "virtual ( string $filename ) : bool", + "Local File Include, Remote File Include", + "low", + "sink" + ], + "readfile()": [ + "Reads a file and writes it to the output buffer.", + "readfile ( string $filename [, bool $use_include_path = FALSE [, resource $context ]] ) : int", + "Code Injection, LFI, RFI", + "high", + "source" + ], + "file_get_contents()": [ + "This function is similar to file(), except that file_get_contents() returns the file in a string, starting at the specified offset up to maxlen bytes. On failure, file_get_contents() will return FALSE.", + "file_get_contents ( string $filename [, bool $use_include_path = FALSE [, resource $context [, int $offset = 0 [, int $maxlen ]]]] ) : string", + "Code Injection, LFI, RFI", + "high", + "source" + ], + "show_source()": [ + "(Alias for highlight_file()) Prints out or returns a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.", + "show_source ( string $filename [, bool $return = FALSE ] ) : mixed", + "Information Disclosure", + "low", + "source" + ], + "highlight_file()": [ + "Prints out or returns a syntax highlighted version of the code contained in filename using the colors defined in the built-in syntax highlighter for PHP.", + "highlight_file ( string $filename [, bool $return = FALSE ] ) : mixed", + "Information Disclosure", + "low", + "source" + ], + "fopen()": [ + "fopen() binds a named resource, specified by filename, to a stream.", + "fopen ( string $filename , string $mode [, bool $use_include_path = FALSE [, resource $context ]] ) : resource", + "Code Injection, LFI, RFI", + "low", + "source" + ], + "file()": [ + "Reads an entire file into an array.", + "ile ( string $filename [, int $flags = 0 [, resource $context ]] ) : array", + "Code Injection, LFI, RFI", + "low", + "source" + ], + "fpassthru()": [ + "Reads to EOF on the given file pointer from the current position and writes the results to the output buffer.", + "fpassthru ( resource $handle ) : int", + "Code Injection, LFI, RFI, RCE (depending on the context)", + "low", + "sink" + ], + "fsockopen()": [ + "Initiates a socket connection to the resource specified by hostname.", + "fsockopen ( string $hostname [, int $port = -1 [, int &$errno [, string &$errstr [, float $timeout = ini_get(\"default_socket_timeout\") ]]]] ) : resource", + "RCE (depends on context)", + "low", + "sink" + ], + "gzopen()": [ + "Opens a gzip (.gz) file for reading or writing.", + "gzopen ( string $filename , string $mode [, int $use_include_path = 0 ] ) : resource", + "Code Injection, LFI (depends on context)", + "low", + "sink" + ], + "gzread()": [ + "gzread() reads up to length bytes from the given gz-file pointer. Reading stops when length (uncompressed) bytes have been read or EOF is reached, whichever comes first.", + "gzread ( resource $zp , int $length ) : string", + "Code Injection, LFI", + "low", + "sink" + ], + "gzfile()": [ + "Read entire gz-file into an array. This function is identical to readgzfile(), except that it returns the file in an array.", + "gzfile ( string $filename [, int $use_include_path = 0 ] ) : array", + "Code Injection, LFI", + "low", + "sink" + ], + "gzpassthru()": [ + "Output all remaining data on a gz-file pointer. Reads to EOF on the given gz-file pointer from the current position and writes the (uncompressed) results to standard output.", + "gzpassthru ( resource $zp ) : int", + "Code Injection, LFI", + "low", + "sink" + ], + "readgzfile()": [ + "Output a gz-file. Reads a file, decompresses it and writes it to standard output.", + "readgzfile ( string $filename [, int $use_include_path = 0 ] ) : int", + "Code Injection, LFI, RCE", + "medium", + "sink" + ], + "mssql_query()": [ + "Send MS SQL query to the currently active database on the server that's associated with the specified link identifier. This function was REMOVED in PHP 7.0.0.", + "mssql_query ( string $query [, resource $link_identifier [, int $batch_size = 0 ]] ) : mixed", + "SQL Injection", + "high" + ], + "odbc_exec()": [ + "Sends an SQL statement to the database server.", + "odbc_exec ( resource $connection_id , string $query_string [, int $flags ] ) : resource", + "SQL Injection", + "high", + "sink" + ], + "sqlsrv_query()": [ + "Prepares and executes a query", + "sqlsrv_query ( resource $conn , string $sql [, array $params [, array $options ]] ) : mixed", + "SQL Injection", + "medium", + "sink" + ], + "PDO::query()": [ + "PDO::query() executes an SQL statement in a single function call, returning the result set (if any) returned by the statement as a PDOStatement object.", + "public PDO::query ( string $statement , int $PDO::FETCH_CLASS , string $classname , array $ctorargs ) : PDOStatement", + "SQL Injection", + "medium", + "sink" + ], + "move_uploaded_file()": [ + "This function checks to ensure that the file designated by filename is a valid upload file (meaning that it was uploaded via PHP's HTTP POST upload mechanism). If the file is valid, it will be moved to the filename given by destination.", + "move_uploaded_file ( string $filename , string $destination ) : bool", + "File Include", + "low", + "sink" + ], + "print()": [ + "Outputs arg. print is not actually a real function (it is a language construct) so you are not required to use parentheses with its argument list.", + "print ( string $arg ) : int", + "XSS, Content/HTML Injection", + "low", + "sink" + ], + "printf()": [ + "Produces output according to format.", + "printf ( string $format [, mixed $... ] ) : int", + "XSS, Content/HTML Injection", + "low", + "sink" + ], + "ldap_search()": [ + "Performs the search for a specified filter on the directory with the scope of LDAP_SCOPE_SUBTREE. This is equivalent to searching the entire directory.", + "ldap_search ( resource $link_identifier , string $base_dn , string $filter [, array $attributes = array() [, int $attrsonly = 0 [, int $sizelimit = -1 [, int $timelimit = -1 [, int $deref = LDAP_DEREF_NEVER [, array $serverctrls = array() ]]]]]] ) : resource", + "unknown?", + "low" + ], + "header()": [ + "Send a raw HTTP header", + "header ( string $header [, bool $replace = TRUE [, int $http_response_code ]] ) : void", + "Header Injection, Open Redirect", + "low", + "sink" + ], + "sqlite_query()": [ + "SQLiteDatabase::query - Executes a query against a given database and returns a result handle", + "sqlite_query ( string $query , resource $dbhandle [, int $result_type = SQLITE_BOTH [, string &$error_msg ]] ) : resource", + "SQL Injection", + "medium", + "sink" + ], + "pg_query()": [ + "pg_query() executes the query on the specified database connection. pg_query_params() should be preferred in most cases.", + "pg_query ([ resource $connection ], string $query ) : resource", + "SQL Injection", + "medium", + "sink" + ], + "mysql_query()": [ + "mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier.(deprecated in PHP 5.5.0, and it was removed in PHP 7.0.0)", + "mysql_query ( string $query [, resource $link_identifier = NULL ] ) : mixed", + "SQL Injection", + "high", + "sink" + ], + "mysqli_query()": [ + "Performs a query against the database.", + "mysqli_query ( mysqli $link , string $query [, int $resultmode = MYSQLI_STORE_RESULT ] ) : mixed", + "SQL Injection", + "medium", + "sink" + ], + "mysqli::query()": [ + "Performs a query against the database.", + "mysqli::query ( string $query [, int $resultmode = MYSQLI_STORE_RESULT ] ) : mixed", + "SQL Injection", + "medium", + "sink" + ], + "apache_setenv()": [ + "Sets the value of the Apache environment variable specified by variable.", + "apache_setenv ( string $variable , string $value [, bool $walk_to_top = FALSE ] ) : bool", + "ENV server variables overwrite", + "low", + "sink" + ], + "dl()": [ + "Loads a PHP extension at runtime", + "dl ( string $library ) : bool", + "Code Injection, RCE (in certain conditions)", + "low", + "sink" + ], + "escapeshellarg()": [ + "Escape a string to be used as a shell argument", + "escapeshellarg ( string $arg ) : string", + "", + "low" + ], + "escapeshellcmd()": [ + "Escapes any characters in a string that might be used to trick a shell command into executing arbitrary commands", + "escapeshellcmd ( string $command ) : string", + "", + "low" + ], + "get_cfg_var()": [ + "Gets the value of a PHP configuration option", + "get_cfg_var ( string $option ) : mixed", + "Information Disclosure", + "low" + ], + "get_current_user()": [ + "Gets the name of the owner of the current PHP script", + "get_current_user ( void ) : string", + "Information Disclosure", + "low" + ], + "getcwd()": [ + "Gets the current working directory", + "getcwd ( void ) : string", + "Information Disclosure", + "low" + ], + "getenv()": [ + " Gets the value of an environment variable", + "getenv ( string $varname [, bool $local_only = FALSE ] ) : string", + "Information Disclosure", + "low" + ], + "php_uname()": [ + "Returns information about the operating system PHP is running on", + "php_uname ([ string $mode = \"a\" ] ) : string", + "Information Disclosure", + "low" + ], + "phpinfo()": [ + "Outputs information about PHP's configuration", + "phpinfo ([ int $what = INFO_ALL ] ) : bool", + "Information Disclosure", + "medium" + ], + "putenv()": [ + "Adds setting to the server environment. The environment variable will only exist for the duration of the current request. At the end of the request the environment is restored to its original state.", + "putenv ( string $setting ) : bool", + "ENV variable create/owerwrite", + "low", + "sink" + ], + "symlink()": [ + "Creates a symbolic link to the existing target with the specified name link.", + "symlink ( string $target , string $link ) : bool", + "LFI (in certain conditions)", + "low" + ], + "syslog()": [ + "Generate a system log message", + "syslog ( int $priority , string $message ) : bool", + "Log poisoning", + "low" + ], + "curl_exec()": [ + "Execute the given cURL session. This function should be called after initializing a cURL session and all the options for the session are set.", + "curl_exec ( resource $ch ) : mixed", + "SSRF", + "medium", + "sink" + ], + "__destruct()": [ + "unserialize() checks if your class has a function with the magic name __destruct(). If so, that function is executed after unserialization", + "__destruct ( void ) : void", + "Object Injection; RCE via unserialize() + POP gadget chain", + "high", + "sink" + ], + "__wakeup()": [ + "serialize() checks if your class has a function with the magic name __wakeup(). If so, that function is executed prior to any serialization", + "__wakeup ( void ) : void", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__sleep()": [ + "serialize() checks if your class has a function with the magic name __sleep(). If so, that function is executed prior to any serialization", + "public __sleep ( void ) : array", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__serialize()": [ + "checks if the class has a function with the magic name __serialize(). If so, that function is executed prior to any serialization. It must construct and return an associative array of key/value pairs that represent the serialized form of the object. If no array is returned a TypeError will be thrown.", + "public __sleep ( void ) : array", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__unserialize()": [ + "checks for the presence of a function with the magic name __unserialize(). If present, this function will be passed the restored array that was returned from __serialize(). It may then restore the properties of the object from that array as appropriate.", + "public __sleep ( void ) : array", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__call()": [ + "Triggered when invoking inaccessible methods in an object context", + "public __call ( string $name , array $arguments ) : mixed", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__get()": [ + "Is utilized for reading data from inaccessible (protected or private) or non-existing properties.", + "public __get ( string $name ) : mixed", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__set()": [ + "Is run when writing data to inaccessible (protected or private) or non-existing properties.", + "public __set ( string $name, mixed $value ) : void", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "__callStatic()": [ + "Triggered when invoking inaccessible methods in a static context.", + "public static __callStatic ( string $name , array $arguments ) : mixed", + "Object Injection; RCE via unserialize() + POP gadget chain", + "medium", + "sink" + ], + "filter_var()": [ + "Filters a variable with a specified filter", + "filter_var ( mixed $variable [, int $filter = FILTER_DEFAULT [, mixed $options ]] ) : mixed", + "Validation bypass (in certain conditions)", + "low" + ], + "file_put_contents()": [ + "Write data to a file", + "file_put_contents ( string $filename , mixed $data [, int $flags = 0 [, resource $context ]] ) : int", + "Arbitrary file write", + "high", + "source" + ], + "extractTo(": [ + "Extract the complete archive or the given files to the specified destination. The default permissions for extracted files and directories give the widest possible access.", + "public ZipArchive::extractTo(string $pathto, array|string|null $files = null): bool", + "Arbitrary file write", + "medium", + "source" + ], + "SELECT.*FROM": [ + "SQL syntax found.", + "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", + "SQL Injection", + "medium", + "source" + ], + "INSERT.*INTO": [ + "SQL syntax found.", + "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", + "SQL Injection", + "medium", + "source" + ], + "UPDATE.*": [ + "SQL syntax found.", + "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", + "SQL Injection", + "medium", + "source" + ], + "DELETE.*FROM": [ + "SQL syntax found.", + "This is likely a raw SQL query, which can be filled with user provided input or not implemented as prepared statement", + "SQL Injection", + "medium", + "source" + ], + "$_POST": [ + "$_POST reference found", + "", + "", + "critical", + "source" + ], + "$_GET": [ + "$_GET reference found", + "", + "", + "critical", + "source" + ], + "$_REQUEST": [ + "$_REQUEST reference found", + "", + "", + "critical", + "source" + ], + "$_FILES": [ + "$_FILES reference found", + "", + "", + "high", + "source" + ], + "$_ENV": [ + "$_ENV reference found", + "", + "", + "medium", + "source" + ], + "$_COOKIES": [ + "$_COOKIES reference found", + "", + "", + "high", + "source" + ], + "$_SESSION": [ + "$_SESSION reference found", + "", + "", + "medium", + "source" + ], + "$_SERVER": [ + "$_SERVER reference found", + "", + "", + "medium", + "source" + ] + } } diff --git a/pef/pef.py b/pef/pef.py index 4e1329f..80cb34a 100755 --- a/pef/pef.py +++ b/pef/pef.py @@ -37,143 +37,26 @@ import re import sys -from imports import pefdocs +from imports.pefdocs import exploitableFunctions, exploitableFunctionsDesc from imports.beautyConsole import beautyConsole -# exploitable functions -exploitableFunctions = [ - "`", - "system(", - "exec(", - "popen(", - "pcntl_exec(", - "eval(", - "arse_str(", - "parse_url(", - "preg_replace(", - "create_function(", - "passthru(", - "shell_exec(", - "popen(", - "proc_open(", - "pcntl_exec(", - "extract(", - "putenv(", - "ini_set(", - "mail(", - "unserialize(", - "assert(", - "call_user_func(", - "call_user_func_array(", - "ereg_replace(", - "eregi_replace(", - "mb_ereg_replace(", - "mb_eregi_replace(", - "virtual", - "readfile(", - "file_get_contents(", - "show_source(", - "highlight_file(", - "fopen(", - "file(", - "fpassthru(", - "fsockopen(", - "gzopen(", - "gzread(", - "gzfile(", - "gzpassthru(", - "readgzfile(", - "mssql_query(", - "odbc_exec(", - "sqlsrv_query(", - "PDO::query(", - "move_uploaded_file(", - "echo", - "print(", - "printf(", - "ldap_search(", - "sqlite_", - "sqlite_query(", - "pg_", - "pg_query(", - "mysql_", - "mysql_query(", - "mysqli::query(", - "mysqli_", - "mysqli_query(", - "apache_setenv(", - "dl(", - "escapeshellarg(", - "escapeshellcmd(", - "extract(", - "get_cfg_var(", - "get_current_user(", - "getcwd(", - "getenv(", - "ini_restore(", - "ini_set(", - "passthru(", - "pcntl_exec(", - "php_uname(", - "phpinfo(", - "popen(", - "proc_open(", - "putenv(", - "symlink(", - "syslog(", - "curl_exec(", - "__wakeup(", - "__destruct(", - "__sleep(", - "filter_var(", - "file_put_contents(", - "extractTo(", - "$_POST", - "$_GET", - "$_COOKIES", - "$_REQUEST", - "$_SERVER", - "$_SESSION", - "include($_GET", - "require($_GET", - "include_once($_GET", - "require_once($_GET", - "include($_REQUEST", - "require($_REQUEST", - "include_once($_REQUEST", - "require_once($_REQUEST", - "SELECT.*FROM", - "INSERT.*INTO", - "UPDATE.*", - "DELETE.*FROM" -] - # allowed scan levels ALLOWED_LEVELS = ['ALL', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'] DEFAULT_LEVELS = 'MEDIUM,HIGH,CRITICAL' - -def banner(): - """ - Prints welcome banner with contact info - """ - print(beautyConsole.getColor("green") + "\n\n", "-" * 100) - print("-" * 6, " PEF | PHP Source Code grep tool", - " " * 35, "-" * 16) - print("-" * 6, " https://github.com/bl4de ", - " " * 22, "-" * 16) - print("-" * 100, "\33[0m\n") - +ALLOWED_LANG = ['PHP', 'JavaScript'] +DEFAULT_LANG = 'PHP' class PefEngine: """ implements pef engine """ - def __init__(self, level, source_or_sink, filename, skip_vendor, phpfunction, verbose): + def __init__(self, lang, level, source_or_sink, filename, skip_vendor, phpfunction, verbose): """ constructor """ + self.lang = lang # selected language self.level = level # scan only for level set of functions self.source_or_sink = source_or_sink # show only sinks or sources self.filename = filename # name of file/folder to scan @@ -226,8 +109,8 @@ def print_code_line(self, file_name, _line, i, fn, severity="", level='ALL', sou meets_criteria = 0 # print legend only if there is entry in pefdocs.py - if fn and fn.strip() in pefdocs.exploitableFunctionsDesc.keys(): - doc = pefdocs.exploitableFunctionsDesc.get(fn.strip()) + if fn and fn.strip() in exploitableFunctionsDesc[self.lang].keys(): + doc = exploitableFunctionsDesc[self.lang].get(fn.strip()) impact = doc[3] if (impact.upper() in level.upper()) or level == 'ALL': @@ -265,7 +148,7 @@ def main(self, src): line = l.rstrip() if self.level: if not self.is_comment(line): - for fn in exploitableFunctions: + for fn in exploitableFunctions[self.lang]: (meets_criteria, number_of_issues) = self.analyse_line(l, i, fn, f, line) if number_of_issues is not None: res = True @@ -315,40 +198,61 @@ def print_summary(self, total_found: int) -> None: print(f"{beautyConsole.getColor('grey')}Severity levels: {beautyConsole.getColor('grey')} LOW {beautyConsole.getColor('green')} MEDIUM {beautyConsole.getColor('yellow')} HIGH {beautyConsole.getColor('red')} CRITICAL{beautyConsole.getColor('grey')}\n") -# main program -if __name__ == "__main__": +def banner(): + """ + Prints welcome banner with contact info + """ + print(beautyConsole.getColor("green") + "\n\n", "-" * 100) + print("-" * 6, " PEF | PHP Source Code grep tool", + " " * 35, "-" * 16) + print("-" * 6, " https://github.com/bl4de ", + " " * 22, "-" * 16) + print("-" * 100, "\33[0m\n") +def parse_arguments(): + """ + Parses command line arguments + """ parser = argparse.ArgumentParser( - description=sys.modules[__name__].__doc__, + description="PHP Source Code grep tool", add_help=True ) - filename = '.' # initial value for file/dir to scan is current directory - phpfunction = '' - parser.add_argument( - "-s", "--skip-vendor", help=f"exclude ./vendor folder", action="store_true") + "-s", "--skip-vendor", help="exclude ./vendor folder", action="store_true") parser.add_argument( - "-v", "--verbose", help=f"show documentation", action="store_true") + "-v", "--verbose", help="show documentation", action="store_true") parser.add_argument( "-l", "--level", - help=f"severity: ALL, LOW, MEDIUM, HIGH or CRITICAL; default: {DEFAULT_LEVELS} if -f is set, this setting is ignored") + help=f"severity: ALL, LOW, MEDIUM, HIGH or CRITICAL; default: {DEFAULT_LEVELS}") parser.add_argument( - "-S", "--sources", help=f"show only sources", action="store_true") + "-L", "--lang", + help=f"language: PHP, JavaScript; default: {DEFAULT_LANG}") parser.add_argument( - "-K", "--sinks", help=f"show only sinks", action="store_true") + "-S", "--sources", help="show only sources", action="store_true") + parser.add_argument( + "-K", "--sinks", help="show only sinks", action="store_true") parser.add_argument( "-f", "--function", - help=f"Search for particular PHP function (eg. unserialize)", + help="Search for particular PHP function (eg. unserialize)", ) parser.add_argument( "-d", "--dir", - help=f"Directory to scan (or sinlge file, optionally)", + help="Directory to scan (or single file, optionally)", ) + return parser.parse_args() + +# main program +if __name__ == "__main__": - args = parser.parse_args() + if len(sys.argv) == 1: + print(f"{beautyConsole.getColor('red')}No arguments provided, use -h for help") + exit(1) + args = parse_arguments() + + lang = args.lang.lower() if args.lang else DEFAULT_LANG.lower() level = args.level.upper() if args.level else 'HIGH,CRITICAL' # if we are looking for a specific function, level is not taken into account @@ -361,13 +265,19 @@ def print_summary(self, total_found: int) -> None: if args.sinks: source_or_sink = 'sink' + # if no directory or file is provided, exit if args.dir is None: print(f"{beautyConsole.getColor('red')}No directory or file(s) to scan provided...") - exit(0) + exit(1) + + # check if the langauge selected is available + if lang not in [l.lower() for l in ALLOWED_LANG]: + print(f"{beautyConsole.getColor('red')}Language {args.lang} is not supported, use one of: {', '.join(ALLOWED_LANG)}") + exit(1) filename = args.dir # main orutine starts here - engine = PefEngine(level, source_or_sink, + engine = PefEngine(lang, level, source_or_sink, filename, args.skip_vendor, args.function, args.verbose) engine.run() diff --git a/pef/test.js b/pef/test.js new file mode 100644 index 0000000..a9711a6 --- /dev/null +++ b/pef/test.js @@ -0,0 +1,5 @@ +'use strict'; +const cmd = 'console.log("Hello, World!");'; +eval(cmd); + + diff --git a/s0mbra.sh b/s0mbra.sh index a932357..17d618a 100755 --- a/s0mbra.sh +++ b/s0mbra.sh @@ -77,13 +77,13 @@ http_server() { # runs john with rockyou.txt against hash type [FORMAT] and file [HASHES] rockyou_john() { echo -e "$BLUE[s0mbra] Running john with rockyou dictionary against $1 of type $2$CLR" - echo > "$HACKING_HOME"/tools/JohnTheRipper/run/john.pot + echo > "$HACKING_HOME"/tools/jtr/run/john.pot if [[ -n $2 ]]; then - "$HACKING_HOME"/tools/JohnTheRipper/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt --format="$2" "$1" + "$HACKING_HOME"/tools/jtr/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt --format="$2" "$1" elif [[ -z $2 ]]; then - "$HACKING_HOME"/tools/JohnTheRipper/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt "$1" + "$HACKING_HOME"/tools/jtr/run/john --wordlist="$HACKING_HOME"/dictionaries/rockyou.txt "$1" fi - cat "$HACKING_HOME"/tools/JohnTheRipper/run/john.pot + cat "$HACKING_HOME"/tools/jtr/run/john.pot echo -e "\n$BLUE[s0mbra] Done." osascript -e 'display notification "our choom John has left the house..." with title "s0mbra says:"' } @@ -91,14 +91,14 @@ rockyou_john() { # show JohnTheRipper's pot file john_pot() { echo -e "$BLUE[s0mbra] Joghn The Ripper pot file:$GRAY" - cat "$HACKING_HOME"/tools/JohnTheRipper/run/john.pot + cat "$HACKING_HOME"/tools/jtr/run/john.pot echo -e "\n$BLUE[s0mbra] Done." } # ZIP password cracking with rockyou.txt rockyou_zip() { echo -e "$BLUE[s0mbra] Running $MAGENTA zip2john $BLUE and prepare hash for hashcat..." - "$HACKING_HOME"/tools/JohnTheRipper/run/zip2john "$1" | cut -d ':' -f 2 > ./hashes.txt + "$HACKING_HOME"/tools/jtr/run/zip2john "$1" | cut -d ':' -f 2 > ./hashes.txt echo -e "$BLUE[s0mbra] Starting $MAGENTA hashcat $BLUE (using $YELLOW rockyou.txt $BLUE dictionary against $YELLOW hashes.txt $BLUE file)...$CLR" hashcat -m 13600 ./hashes.txt ~/hacking/dictionaries/rockyou.txt echo -e "\n$BLUE[s0mbra] Done." @@ -107,7 +107,7 @@ rockyou_zip() { # converts id_rsa to JohnTheRipper format for cracking SSH key ssh_to_john() { echo -e "$BLUE[s0mbra] Converting SSH id_rsa key to JohnTheRipper format to crack it$CLR" - python "$HACKING_HOME"/tools/JohnTheRipper/run/sshng2john.py "$1" > "$1".hash + python "$HACKING_HOME"/tools/jtr/run/sshng2john.py "$1" > "$1".hash echo -e "$BLUE[s0mbra] We have a hash.\n" echo -e "$BLUE[s0mbra] Let's now crack it!" rockyou_john "$1".hash @@ -217,7 +217,7 @@ enum() { DOMAIN=$1 echo -e "$BLUE[s0mbra] Let's see what have we got here...$CLR\n" - # amass passive enum + amass passive enum echo -e "\n$GREEN--> amass (takes some time, so sit tight, Choom...)$CLR\n" amass enum -passive -d $DOMAIN -o "$TMPDIR/amass.tmp" cut -d' ' -f 1 "$TMPDIR/amass.tmp" | grep -e '[a-z]' | sort -u | sed "s,\x1B\[[0-9;]*[a-zA-Z],,g" | grep $DOMAIN > "$TMPDIR/enum_amass.log" @@ -234,8 +234,8 @@ enum() { # cleanup echo -e "\n$BLUE[s0mbra] Remove temporary files...\n" - rm -f $TMPDIR/sublister_$DOMAIN.log - rm -f $TMPDIR/subfinder.log + rm -f $TMPDIR/enum_amass.log + rm -f $TMPDIR/enum_subfinder.log rm -f $TMPDIR/amass.tmp # httpx @@ -675,25 +675,13 @@ hshr() { echo -e "$BLUE\n[s0mbra] Done! $CLR" } -# extract links and API endpoints from JavaScript file -urls() { - echo -e "$BLUE[s0mbra] Extracting URLs from $1...$CLR" - python /Users/bl4de/hacking/tools/LinkFinder/linkfinder.py -i "$1" -o cli | rg http | sort -u - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} +# cat <<'-md-' +# # s0mbra.sh - Recon and pentest tool -endpoints() { - echo -e "$BLUE[s0mbra] Extracting URLs from $1...$CLR" - python /Users/bl4de/hacking/tools/LinkFinder/linkfinder.py -i "$1" -o cli | rg -v http | sort -u - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} +# This script is a collection of various tools and functions for reconnaissance, pentesting, and code analysis +# It provides functionalities for network scanning, web application testing, cloud storage enumeration, and more. -# extract secrets from JavaScript file -secrets() { - echo -e "$BLUE[s0mbra] Extracting secrets from $1...$CLR" - python /Users/bl4de/hacking/tools/SecretFinder/SecretFinder.py -i "$1" -o cli | sort -u - echo -e "$BLUE\n[s0mbra] Done! $CLR" -} +# -md- ### menu cmd=$1 @@ -813,15 +801,6 @@ case "$cmd" in rubysast) ruby_sast "$2" ;; - urls) - urls "$2" - ;; - endpoints) - endpoints "$2" - ;; - secrets) - secrets "$2" - ;; *) clear echo -e "$CLR" @@ -850,9 +829,7 @@ case "$cmd" in echo -e "$BLUE_BG:: STATIC CODE ANALYSIS ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN unmin $GRAY[FILE]\t\t\t$YELLOW(JavaScript)$CLR\t$CYAN snyktest $GRAY[DIR]\t\t\t$YELLOW(JavaScript)$CLR" echo -e "$CYAN rubysast $GRAY[DIR]\t\t\t$YELLOW(Ruby)$CLR\t\t$CYAN disass $GRAY[BINARY]\t\t$YELLOW(asm)$CLR" - echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN urls $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR" - echo -e "$CYAN secrets $GRAY[FILE|DIR|URL]\t\t$YELLOW(JavaScript)$CLR\t$CYAN endpoints $GRAY[FILE|DIR|URL]\t$YELLOW(JavaScript)$CLR" - echo -e "$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR" + echo -e "$CYAN unjar $GRAY[.jar FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN pysast $GRAY[DIR]\t\t\t$YELLOW(Python)$CLR" echo -e "$BLUE_BG:: ANDROID ::\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t$CLR" echo -e "$CYAN jadx $GRAY[.apk FILE]\t\t$YELLOW(Java)$CLR\t\t$CYAN dex_to_jar $GRAY[.dex file]$CLR\t\t$YELLOW(Java)$CLR" echo -e "$CYAN apk $GRAY[.apk FILE]$CLR\t\t$YELLOW(Java)$CLR\t\t$CYAN abe $GRAY[.ab FILE]$CLR\t\t\t$YELLOW(Java)$CLR" diff --git a/subdomain_enum.sh b/subdomain_enum.sh deleted file mode 100644 index daea6b3..0000000 --- a/subdomain_enum.sh +++ /dev/null @@ -1,98 +0,0 @@ -#!/bin/bash -# Subdomain enumeration and web server discovery + screenshot tools -# -# @author: bl4de -# @licence: MIT -# - - -## create domains/ folder -create_domains_folder() { - if [ ! -d domains ]; then - mkdir domains - echo -e "$(date) domains/ folder created" >> subdomain_enum.log - fi -} - - -## perform sublist3r and amass enumeration on each domain passed as an argument -enumerate_domain() { - local DOMAIN=$1 - echo -e "$(date) started enumerate $DOMAIN" >> subdomain_enum.log - sublister -d $DOMAIN -o domains/$DOMAIN.sublister - amass enum -brute -min-for-recursive 1 -d $DOMAIN -o domains/$DOMAIN.amass - - if [ -s domains/$DOMAIN.sublister ] || [ -s domains/$DOMAIN.amass ]; then - cat domains/$DOMAIN.* > domains/$DOMAIN.all - sort -u -k 1 domains/$DOMAIN.all > domains/$DOMAIN - fi - rm -f domains/$DOMAIN.* - echo -e "$(date) finished enumerate $DOMAIN, total number of unique domains found: $(cat domains/$DOMAIN|wc -l)" >> subdomain_enum.log -} - -## processing all outputed list of domains into one, removing dups -## and sorting -create_list_of_domains() { - echo -e "$(date) create final list of domains found..." >> subdomain_enum.log - # concatenate and sort all domains from the target - cat domains/*.* > domains/domains.all - sort -u -k 1 domains/domains.all > domains/__domains - # remove odd
left by Sublist3r or amass :P - sed 's/
/#/g' __domains | tr '#' '\n' > __domains.final - rm -f domains/domains.all - echo -e "$(date) ... Done! $(cat domains/__domains.final|wc -l) unique domains gathered \o/" >> subdomain_enum.log -} - - -## runs denumerator -run_denumerator() { - echo -e "$(date) denumerator started" >> subdomain_enum.log - denumerator -f domains/__domains.final -c 200,302,403,500 - echo -e "$(date) denumerator finished" >> subdomain_enum.log - echo -e "$(date) total webservers enumerated and saved to report: $(ls -l report/ | wc -l)" >> subdomain_enum.log -} - - -## performs nmap scan -run_virustotal_enum() { - echo -e "$(date) virustotal $CIDR enumeration started" >> subdomain_enum.log - # run virustotal.py reverse domain search - virustotal --cidr $CIDR --output domains/virustotal.domains - echo -e "$(date) virustotal $CIDR enumeration finished, $(cat domains/virustotal.domains|wc -l) domains found" >> subdomain_enum.log -} - - -## ----------------------------------------------------------------------------- - -# list of domains - text file, one domain in single line -DOMAINS=$1 - -# IP address range -CIDR=$2 - -echo -e "$(date) subdomain_enum.sh started" >> subdomain_enum.log - -# enusre that domains/ folder exists, if not create one -create_domains_folder - -if [[ -n $CIDR ]]; then - run_virustotal_enum -fi - -cat $DOMAINS | while read DOMAIN -do - enumerate_domain $DOMAIN -done - -# concatenate and sort all domains from the target -create_list_of_domains -echo -e "\n[+} DONE. Found $(wc -l domains/__domains.final) unique subdomains" - -# run denumerator on the domains/domains.final output file -run_denumerator - -echo -e "\n[+} DONE." - -## ----------------------------------------------------------------------------- - -