fuzz

Documentation

Overview

Package fuzz contains the fuzzing functionality for dynamic fuzzing of HTTP requests and its respective implementation.

Index

• type ExecuteRuleInput
• type GeneratedRequest
• type Rule
  • func (rule *Rule) Compile(generator *generators.PayloadGenerator, options *protocols.ExecutorOptions) error
  • func (rule *Rule) Execute(input *ExecuteRuleInput) error

Types

type ExecuteRuleInput

type ExecuteRuleInput struct {
	// Input is the context args input
	Input *contextargs.Context
	// Callback is the callback for generated rule requests
	Callback func(GeneratedRequest) bool
	// InteractURLs contains interact urls for execute call
	InteractURLs []string
	// Values contains dynamic values for the rule
	Values map[string]interface{}
	// BaseRequest is the base http request for fuzzing rule
	BaseRequest *retryablehttp.Request
}

ExecuteRuleInput is the input for rule Execute function

type GeneratedRequest

type GeneratedRequest struct {
	// Request is the http request for rule
	Request *retryablehttp.Request
	// InteractURLs is the list of interactsh urls
	InteractURLs []string
	// DynamicValues contains dynamic values map
	DynamicValues map[string]interface{}
}

GeneratedRequest is a single generated request for rule

type Rule

type Rule struct {
	// description: |
	//   Type is the type of fuzzing rule to perform.
	//
	//   replace replaces the values entirely. prefix prefixes the value. postfix postfixes the value
	//   and infix places between the values.
	// values:
	//   - "replace"
	//   - "prefix"
	//   - "postfix"
	//   - "infix"
	Type string `` /* 168-byte string literal not displayed */

	// description: |
	//   Part is the part of request to fuzz.
	//
	//   query fuzzes the query part of url. More parts will be added later.
	// values:
	//   - "query"
	Part string `` /* 127-byte string literal not displayed */

	// description: |
	//   Mode is the mode of fuzzing to perform.
	//
	//   single fuzzes one value at a time. multiple fuzzes all values at same time.
	// values:
	//   - "single"
	//   - "multiple"
	Mode string `` /* 142-byte string literal not displayed */

	// description: |
	//   Keys is the optional list of key named parameters to fuzz.
	// examples:
	//   - name: Examples of keys
	//     value: >
	//       []string{"url", "file", "host"}
	Keys []string `` /* 128-byte string literal not displayed */

	// description: |
	//   KeysRegex is the optional list of regex key parameters to fuzz.
	// examples:
	//   - name: Examples of key regex
	//     value: >
	//       []string{"url.*"}
	KeysRegex []string `` /* 137-byte string literal not displayed */

	// description: |
	//   Values is the optional list of regex value parameters to fuzz.
	// examples:
	//   - name: Examples of value regex
	//     value: >
	//       []string{"https?://.*"}
	ValuesRegex []string `` /* 133-byte string literal not displayed */

	// description: |
	//   Fuzz is the list of payloads to perform substitutions with.
	// examples:
	//   - name: Examples of fuzz
	//     value: >
	//       []string{"{{ssrf}}", "{{interactsh-url}}", "example-value"}
	Fuzz []string `` /* 143-byte string literal not displayed */
	// contains filtered or unexported fields
}

Rule is a single rule which describes how to fuzz the request

func (*Rule) Compile

func (rule *Rule) Compile(generator *generators.PayloadGenerator, options *protocols.ExecutorOptions) error

Compile compiles a fuzzing rule and initializes it for operation

func (*Rule) Execute

func (rule *Rule) Execute(input *ExecuteRuleInput) error

Execute executes a fuzzing rule accepting a callback on which generated requests are returned.

Input is not thread safe and should not be shared between concurrent goroutines.