d34db33f-1007 / fuzz300

Robust and blazing fast open-redirect vulnerability scanner with ability of recursevely crawling all of web-forms, entry points, or links with data.

After Golismero project got dead there is no more any up to date open-source tool that can collect links with parametrs and web-forms and then test them, so i decided to write one by my own. At the first step this tool does collect all the entry-points for the target website and then tryes to find open redirect vulnerability.

Why this project is better than other open-redirect scanners? It does recursevely crawl all the links from the target website and finds potential vulnerable web-forms by itself instead of using CommonCrawl or getting links list from user input. In the future i will probably add more modules to fuzz for SQL Injections and XSS.

Instalation

~$ git clone https://github.com/d34db33f-1007/fuzz300.git
~$ pip3 install -r requirements.txt

Usage

~$ python3.8 fuzz300.py -u https://example.com
~$ python3.8 fuzz300.py -u https://www.example.com -c 'Cookie: user=admin'

After running you will also find newly created files with interesting links and all website entry-points.

Tips

• Try using the same parameter twice: ?next=whitelisted.com&next=google.com
• If periods filtered, use an IPv4 address in decimal notation http://www.geektools.com/geektools-cgi/ipconv.cgi
• Try a double-URL and triple-URL encoded version of payloads
• Try redirecting to an IP address (instead of a domain) using different notations: IPv6, IPv4 in decimal, hex or octal
• For XSS, try replacing alert(1) with prompt(1) & confirm(1)
• If extension checked, try ?image_url={payload}/.jpg
• Try target.com/?redirect_url=.uk (or [any_param]=.uk). If it redirects to target.com.uk, then it’s vulnerable! target.com.uk and target.com are different domains.
• Use /U+e280 RIGHT-TO-LEFT OVERRIDE: https://whitelisted.com@%E2%80%[email protected]
------ The unicode character U+202E changes all subsequent text to be right-to-left
------ E.g.: https://hackerone.com/reports/299403

Exploitation

• Phishing
• Chaining open redirect with
-- • SSRF
-- • OAuth token disclosure
-- • XSS
-- • CRLF injection

Open redirect writeups

• Hackerone report 158434: Open Redirect & XSS on Shopify, $1,000
• Hackerone report 101962: Open Redirect on Shopify, $500
• Hackerone report 55546: Open Redirect on Shopify, $500
• Hackerone report 55525: Open Redirect on Shopify, $500
• Hackerone report 169759: Open Redirect on Shopify, $500
• Hackerone report 160047: Open Redirect on Shopify, $500
• Hackerone report 103772: Open Redirect on Shopify, $500
• Hackerone report 159522: Open Redirect on Shopify, $500

fuzz300's Issues

help

`/usr/lib/python3/dist-packages/wfuzz/init.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.

Starting to fuzz urls to find open-redirect vulnerability

Traceback (most recent call last):
File "/home/kali/fuzz300/fuzz300.py", line 133, in
openredirect()
File "/home/kali/fuzz300/fuzz300.py", line 117, in openredirect
fuzz(url, ['data/openredirect.json'], 'data/openredirect.txt')
File "/home/kali/fuzz300/modules/fuzzer.py", line 12, in fuzz
for r in sess.fuzz(payloads=[("file",dict(fn=payload))]):
File "/usr/lib/python3/dist-packages/wfuzz/options.py", line 245, in fuzz
fz = Fuzzer(self.compile())
^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/wfuzz/options.py", line 361, in compile
raise FuzzExceptBadOptions(
wfuzz.exception.FuzzExceptBadOptions: FUZZ words and number of payloads do not match!
`
thx