Method fuzz

bbot/modules/lightfuzz/submodules/path.py:28–154

(self)

    friendly_name = "Path Traversal"

    async def fuzz(self):
        cookies = self.event.data.get("assigned_cookies", {})
        probe_value = self.incoming_probe_value(populate_empty=False)
        if not probe_value:
            self.debug(
                f"Path Traversal detection requires original value, aborting [{self.event.data['type']}] [{self.event.data['name']}]"
            )
            return

        # Single dot traversal tolerance test
        path_techniques = {
            "single-dot traversal tolerance (no-encoding)": {
                "singledot_payload": f"./a/../{probe_value}",
                "doubledot_payload": f"../a/../{probe_value}",
            },
            "single-dot traversal tolerance (no-encoding, leading slash)": {
                "singledot_payload": f"/./a/../{probe_value}",
                "doubledot_payload": f"/../a/../{probe_value}",
            },
            "single-dot traversal tolerance (url-encoding)": {
                "singledot_payload": quote(f"./a/../{probe_value}".encode(), safe=""),
                "doubledot_payload": quote(f"../a/../{probe_value}".encode(), safe=""),
            },
            "single-dot traversal tolerance (url-encoding, leading slash)": {
                "singledot_payload": quote(f"/./a/../{probe_value}".encode(), safe=""),
                "doubledot_payload": quote(f"/../a/../{probe_value}".encode(), safe=""),
            },
            "single-dot traversal tolerance (non-recursive stripping)": {
                "singledot_payload": f"...//a/....//{probe_value}",
                "doubledot_payload": f"....//a/....//{probe_value}",
            },
            "single-dot traversal tolerance (non-recursive stripping, leading slash)": {
                "singledot_payload": f"/...//a/....//{probe_value}",
                "doubledot_payload": f"/....//a/....//{probe_value}",
            },
            "single-dot traversal tolerance (double url-encoding)": {
                "singledot_payload": f".%252fa%252f..%252f{probe_value}",
                "doubledot_payload": f"..%252fa%252f..%252f{probe_value}",
            },
            "single-dot traversal tolerance (double url-encoding, leading slash)": {
                "singledot_payload": f"%252f.%252fa%252f..%252f{probe_value}",
                "doubledot_payload": f"%252f..%252fa%252f..%252f{probe_value}",
            },
        }

        compiled_regex = self.lightfuzz.helpers.re.compile(r"/(?:[\w-]+/)*[\w-]+\.\w+")
        linux_path_regex = await self.lightfuzz.helpers.re.match(compiled_regex, probe_value)
        if linux_path_regex is not None:
            original_path_only = "/".join(probe_value.split("/")[:-1])
            original_filename_only = probe_value.split("/")[-1]
            # Some servers validate the start of the path, so we construct our payload with the original path and filename
            path_techniques["single-dot traversal tolerance (start of path validation)"] = {
                "singledot_payload": f"{original_path_only}/./{original_filename_only}",
                "doubledot_payload": f"{original_path_only}/../{original_filename_only}",
            }

        for path_technique, payloads in path_techniques.items():
            iterations = 5  # one failed detection is tolerated, as long as its not the first run