Method fuzz

bbot/modules/lightfuzz/submodules/serial.py:81–189

(self)

        return False

    async def fuzz(self):
        cookies = self.event.data.get("assigned_cookies", {})
        control_payload_hex = self.CONTROL_PAYLOAD_HEX
        control_payload_base64 = self.CONTROL_PAYLOAD_BASE64
        control_payload_php_raw = self.CONTROL_PAYLOAD_PHP_RAW

        base64_serialization_payloads = self.BASE64_SERIALIZATION_PAYLOADS
        hex_serialization_payloads = self.HEX_SERIALIZATION_PAYLOADS
        php_raw_serialization_payloads = self.PHP_RAW_SERIALIZATION_PAYLOADS

        serialization_errors = self.SERIALIZATION_ERRORS
        general_errors = self.GENERAL_ERRORS

        probe_value = self.incoming_probe_value(populate_empty=False)
        if probe_value:
            if self.is_possibly_serialized(probe_value):
                self.debug(
                    f"Existing value is not ruled out for being a serialized object, proceeding [{self.event.data['type']}] [{self.event.data['name']}]"
                )
            else:
                self.debug(
                    f"The Serialization Submodule only operates when there is no original value, or when the original value could potentially be a serialized object, aborting [{self.event.data['type']}] [{self.event.data['name']}]"
                )
                return

        try:
            http_compare_hex = self.compare_baseline(self.event.data["type"], control_payload_hex, cookies)
            http_compare_base64 = self.compare_baseline(self.event.data["type"], control_payload_base64, cookies)
            http_compare_php_raw = self.compare_baseline(self.event.data["type"], control_payload_php_raw, cookies)
        except HttpCompareError as e:
            self.debug(f"HttpCompareError encountered: {e}")
            return

        # Proceed with payload probes
        for payload_set, payload_baseline in [
            (base64_serialization_payloads, http_compare_base64),
            (hex_serialization_payloads, http_compare_hex),
            (php_raw_serialization_payloads, http_compare_php_raw),
        ]:
            for type, payload in payload_set.items():
                try:
                    matches_baseline, diff_reasons, reflection, response = await self.compare_probe(
                        payload_baseline, self.event.data["type"], payload, cookies
                    )
                except HttpCompareError as e:
                    self.debug(f"HttpCompareError encountered: {e}")
                    continue

                if matches_baseline:
                    self.debug(f"Payload {type} matches baseline, skipping")
                    continue

                self.debug(f"Probe result for {type}: {response}")

                status_code = getattr(response, "status_code", 0)
                if status_code == 0:
                    continue