alertpay

Saturday, May 27, 2023

Smuggler - An HTTP Request Smuggling / Desync Testing Tool


An HTTP Request Smuggling / Desync testing tool written in Python 3


IMPORTANT

This tool does not guarantee no false-positives or false-negatives. Just because a mutation may report OK does not mean there isn't a desync issue, but more importantly just because the tool indicates a potential desync issue does not mean there definitely exists one. The script may encounter request processors from large entities (i.e. Google/AWS/Yahoo/Akamai/etc..) that may show false positive results.


Installation

  1. git clone https://github.com/defparam/smuggler.git
  2. cd smuggler
  3. python3 smuggler.py -h

Example Usage

Single Host:

python3 smuggler.py -u <URL>

List of hosts:

cat list_of_hosts.txt | python3 smuggler.py

Options

usage: smuggler.py [-h] [-u URL] [-v VHOST] [-x] [-m METHOD] [-l LOG] [-q]
[-t TIMEOUT] [--no-color] [-c CONFIGFILE]

optional arguments:
-h, --help show this help message and exit
-u URL, --url URL Target URL with Endpoint
-v VHOST, --vhost VHOST
Specify a virtual host
-x, --exit_early Exit scan on first finding
-m METHOD, --method METHOD
HTTP method to use (e.g GET, POST) Default: POST
-l LOG, --log LOG Specify a log file
-q, --quiet Quiet mode will only log issues found
-t TIMEOUT, --timeout TIMEOUT
Socket timeout value Default: 5
--no-color Suppress color codes
-c CONFIGFILE, --configfile CONFIGFILE
Filepath to the configuration file of payloads

Smuggler at a minimum requires either a URL via the -u/--url argument or a list of URLs piped into the script via stdin. If the URL specifies https:// then Smuggler will connect to the host:port using SSL/TLS. If the URL specifies http:// then no SSL/TLS will be used at all. If only the host is specified, then the script will default to https://

Use -v/--vhost <host> to specify a different host header from the server address

Use -x/--exit_early to exit the scan of a given server when a potential issue is found. In piped mode smuggler will just continue to the next host on the list

Use -m/--method <method> to specify a different HTTP verb from POST (i.e GET/PUT/PATCH/OPTIONS/CONNECT/TRACE/DELETE/HEAD/etc...)

Use -l/--log <file> to write output to file as well as stdout

Use -q/--quiet reduce verbosity and only log issues found

Use -t/--timeout <value> to specify the socket timeout. The value should be high enough to conclude that the socket is hanging, but low enough to speed up testing (default: 5)

Use --no-color to suppress the output color codes printed to stdout (logs by default don't include color codes)

Use -c/--configfile <configfile> to specify your smuggler mutation configuration file (default: default.py)


Config Files

Configuration files are python files that exist in the ./config directory of smuggler. These files describe the content of the HTTP requests and the transfer-encoding mutations to test.

Here is example content of default.py:

def render_template(gadget):
RN = "\r\n"
p = Payload()
p.header = "__METHOD__ __ENDPOINT__?cb=__RANDOM__ HTTP/1.1" + RN
# p.header += "Transfer-Encoding: chunked" +RN
p.header += gadget + RN
p.header += "Host: __HOST__" + RN
p.header += "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36" + RN
p.header += "Content-type: application/x-www-form-urlencoded; charset=UTF-8" + RN
p.header += "Content-Length: __REPLACE_CL__" + RN
return p


mutations["nameprefix1"] = render_template(" Transfer-Encoding: chunked")
mutations["tabprefix1"] = render_template("Transfer-Encoding:\tchunked")
mutations["tabprefix2"] = render_template("Transfer-Encoding\t:\tchunked")
mutations["space1"] = render_template("Transfer-Encoding : chunked")

for i in [0x1,0x4,0x8,0x9,0xa,0xb,0xc,0xd,0x1F,0x20,0x7f,0xA0,0xFF]:
mutations["midspace-% 02x"%i] = render_template("Transfer-Encoding:%cchunked"%(i))
mutations["postspace-%02x"%i] = render_template("Transfer-Encoding%c: chunked"%(i))
mutations["prespace-%02x"%i] = render_template("%cTransfer-Encoding: chunked"%(i))
mutations["endspace-%02x"%i] = render_template("Transfer-Encoding: chunked%c"%(i))
mutations["xprespace-%02x"%i] = render_template("X: X%cTransfer-Encoding: chunked"%(i))
mutations["endspacex-%02x"%i] = render_template("Transfer-Encoding: chunked%cX: X"%(i))
mutations["rxprespace-%02x"%i] = render_template("X: X\r%cTransfer-Encoding: chunked"%(i))
mutations["xnprespace-%02x"%i] = render_template("X: X%c\nTransfer-Encoding: chunked"%(i))
mutations["endspacerx-%02x"%i] = render_template("Transfer-Encoding: chunked\r%cX: X"%(i))
mutations["endspacexn-%02x"%i] = render_template("Transfer-Encoding: chunked%c\nX: X"%(i))

There are no input arguments yet on specifying your own customer headers and user-agents. It is recommended to create your own configuration file based on default.py and modify it to your liking.

Smuggler comes with 3 configuration files: default.py (fast), doubles.py (niche, slow), exhaustive.py (very slow) default.py is the fastest because it contains less mutations.

specify configuration files using the -c/--configfile <configfile> command line option


Payloads Directory

Inside the Smuggler directory is the payloads directory. When Smuggler finds a potential CLTE or TECL desync issue, it will automatically dump a binary txt file of the problematic payload in the payloads directory. All payload filenames are annotated with the hostname, desync type and mutation type. Use these payloads to netcat directly to the server or to import into other analysis tools.


Helper Scripts

After you find a desync issue feel free to use my Turbo Intruder desync scripts found Here: https://github.com/defparam/tiscripts DesyncAttack_CLTE.py and DesyncAttack_TECL.py are great scripts to help stage a desync attack


License

These scripts are released under the MIT license. See LICENSE.



More articles

  1. Hak5 Tools
  2. Hack Tool Apk
  3. Hacker Tool Kit
  4. Black Hat Hacker Tools
  5. Pentest Tools Review
  6. Hackers Toolbox
  7. Hacker Tools List
  8. Hacker Tools Free Download
  9. Hack Tools Download
  10. Hackers Toolbox
  11. New Hacker Tools
  12. Hacking Tools Download
  13. Hack Tools Online
  14. Free Pentest Tools For Windows
  15. Hacker Tool Kit
  16. Hack Tools Online
  17. Hacker Tools Github
  18. Pentest Tools Windows
  19. New Hack Tools
  20. Usb Pentest Tools
  21. Pentest Tools Find Subdomains
  22. Hacking Tools For Windows
  23. Hacking Tools Github
  24. Termux Hacking Tools 2019
  25. Hacking Tools For Games
  26. Pentest Tools Find Subdomains
  27. Hacker Tools For Mac
  28. Pentest Tools Bluekeep
  29. Hack Tools For Games
  30. Best Hacking Tools 2019
  31. New Hack Tools
  32. Pentest Automation Tools
  33. Physical Pentest Tools
  34. Hacking Tools Hardware
  35. Kik Hack Tools
  36. Nsa Hacker Tools
  37. Hacking Apps
  38. Hack And Tools
  39. Hacking Tools Windows
  40. Blackhat Hacker Tools
  41. Hacker Tools Software
  42. Easy Hack Tools
  43. Hacking Tools For Windows
  44. Hacking Tools 2020
  45. Hacking Tools For Kali Linux
  46. Pentest Tools
  47. New Hack Tools
  48. Hacking Tools Name
  49. Pentest Tools Review
  50. Pentest Tools For Windows
  51. How To Hack
  52. Hacker Tools Linux
  53. Pentest Tools For Windows
  54. Pentest Tools Kali Linux
  55. Hack Tools For Ubuntu
  56. Hacker Tools Online
  57. Pentest Tools For Android
  58. Pentest Tools Tcp Port Scanner
  59. Hacker Tools For Ios
  60. Hacker Search Tools
  61. Hacking Tools And Software
  62. Pentest Tools Find Subdomains
  63. Hacking Tools Mac
  64. Hacking Tools Download
  65. Top Pentest Tools
  66. Pentest Tools Github
  67. Best Hacking Tools 2020
  68. Hacker Hardware Tools
  69. Hack Tools Download
  70. Hacker Tools Free
  71. Hacker Search Tools
  72. Nsa Hacker Tools
  73. Hacker Security Tools
  74. Best Hacking Tools 2019
  75. Hacker Tools 2019
  76. Hacker Tools For Windows
  77. Pentest Tools Alternative
  78. Hack App
  79. Hack Tools Github
  80. Pentest Tools Url Fuzzer
  81. Hacker Tools Free
  82. What Are Hacking Tools
  83. Hacker
  84. Hacker Tools Github
  85. Hack And Tools
  86. Nsa Hacker Tools
  87. Hack Tools 2019
  88. Hacker Tools Hardware
  89. Hacker Tools For Mac
  90. Free Pentest Tools For Windows
  91. Hacker Tools Apk
  92. Computer Hacker
  93. Best Pentesting Tools 2018
  94. Hacking Tools Software
  95. Hacking Tools For Games
  96. Pentest Tools Website Vulnerability
  97. How To Install Pentest Tools In Ubuntu
  98. Hacker Tools For Ios
  99. Hacker Tools 2019
  100. Pentest Recon Tools
  101. Hacking Tools 2020
  102. Hacking Tools For Kali Linux
  103. Best Hacking Tools 2019
  104. Hacker Tools Online
  105. Hacker Tools Apk
  106. Hacking Tools Name
  107. Hacking Tools For Beginners
  108. Tools Used For Hacking
  109. Pentest Tools Android
  110. Hack Apps
  111. Hacks And Tools
  112. Hack Tools For Pc

No comments: