Add cache-poisoning-fuzz (#3413)

patch-1
Dwi Siswanto 2021-12-25 14:56:35 +07:00 committed by GitHub
parent 405162f41f
commit 057d48eb1a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 2951 additions and 0 deletions

View File

@ -0,0 +1,34 @@
id: cache-poisoning-fuzz
info:
name: Cache Poison Fuzzing
author: dwisiswant0
severity: info
reference:
- https://youst.in/posts/cache-poisoning-at-scale/
tags: cache,fuzz
requests:
- raw:
- |
GET /?{{uniq}}=1 HTTP/1.1
Host: {{Hostname}}
{{headers}}: {{uniq}}.tld
- |
GET /?{{uniq}}=1 HTTP/1.1
Host: {{Hostname}}
attack: clusterbomb
payloads:
uniq:
- "{{md5(rand_text_numeric(32))}}"
headers: helpers/wordlists/headers.txt
stop-at-first-match: true
req-condition: true
matchers:
- type: dsl
dsl:
- 'contains(body_2, "{{uniq}}")'

File diff suppressed because it is too large Load Diff