Added MDB database file leakage

2021-06-11 23:22:22 +05:30 · 2021-06-11 23:22:22 +05:30 · c728d256cd
parent 962959f573
commit c728d256cd
2 changed files with 381 additions and 0 deletions
--- a/fuzzing/mdb-database-file.yaml
+++ b/fuzzing/mdb-database-file.yaml
@ -0,0 +1,40 @@
+id: mdb-database-file
+
+info:
+  name: MDB database file leakage
+  author: pdteam
+  severity: medium
+  tags: fuzz,mdb,asp
+  reference: https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.5-Testing_for_MS_Access.html
+
+requests:
+  - payloads:
+      mdbPaths: helpers/wordlists/mdb-paths.txt
+
+    attack: sniper
+    threads: 50
+
+    raw:
+      - |
+        GET {{mdbPaths}} HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Accept-Language: en-US,en;q=0.9
+        Connection: close
+
+    max-size: 500 # Size in bytes - Max Size to read from server response
+    matchers-condition: and
+    matchers:
+      - type: binary
+        binary:
+          - "000100005374616E64617264204A657420444200"  # mdb
+        part: body
+
+      - type: word
+        words:
+          - "application/x-msaccess"
+        part: header
+
+      - type: status
+        status:
+          - 200
--- a/helpers/wordlists/mdb-paths.txt
+++ b/helpers/wordlists/mdb-paths.txt
@ -0,0 +1,341 @@
+/Databases/asp99cms.mdb
+/mgyg/order.mdb
+/eWebEditor/db/ewebeditor.mdb
+/db/ewebeditor.mdb
+/webadmin/htmledit/db/ewebeditor.mdb
+/admin/EDITOR/DB/safdafasds35d.mdb
+/admin/sou/./southidceditor.mdb
+/Data/Test.mdb
+/htmledit/db/ewebeditor.mdb
+/mdb/IPAddress.mdb
+/bb_adminlogin/htmledit/db/ewebeditor.mdb
+/admin/maillist.mdb
+/manage/Webedit/db/ewebeditor.mdb
+/Webedit/db/ewebeditor.mdb
+/Admin/WebEdit/db/ewebeditor.mdb
+/editor/editor/db/ewebeditor.mdb
+/admin/WebEditor/db/ewebeditor.mdb
+/edit/db/ewebeditor.mdb
+/Database/aberdadb20061230153740.mdb
+/bbs/Data/leadbbs.mdb
+/setup/moban.mdb
+/Editor/db/home961editor.mdb
+/Database/SiteWeaver.mdb
+/Editor/db/ewebeditor.mdb
+/bbs/boke/Data/Dvboke.mdb
+/packet.mdb
+/HSH.mdb
+/HYTop.mdb
+/tomdb.mdb
+/FooSun_Data/FooSun_Data.mdb
+/database/SiteWeaver6.5.mdb
+/admin/htmledit/db/ewebeditor.mdb
+/admin/editor/db/ewebeditor.mdb
+/msmir_net.mdb
+/msmir/msmir.mdb
+/data.mdb
+/admin/southidceditor/datas/southidceditor.mdb
+/bbs/Databackup/dvbbs7_Backup.mdb
+/data/dvbbs7.mdb
+/dvbbs/data/dvbbs7.mdb
+/databackup/dvbbs7.mdb
+/manage/ewebeditor/db/ewebeditor.mdb
+/shopxp_data/data.mdb
+/database/PowerEasy2006.mdb
+/database/PowerEasy5.mdb
+/bbs/data/dvbbs6.mdb
+/data/dvbbs6.mdb
+/bbs/data/dvbbs7.mdb
+/shopxp/shopxp.mdb
+/bbs/data/dvbbs8.mdb
+/data/dvbbs8.mdb
+/Databases/myszw.mdb
+/Databases/vicndatadata.mdb
+/userdata.mdb
+/admin/Databackup/New_Backup.mdb
+/manage/editor/db/ewebeditor.mdb
+/webeditor/db/ewebeditor.mdb
+/bbs/Databackup/dvbbs8.mdb
+/Databackup/dvbbs8.MDB
+/bbs/Databackup/dvbbs8_Backup.mdb
+/db/com02.mdb
+/db/data.mdb
+/Data/LeadBBS.mdb
+/Data/MeskyDMS_Data.mdb
+/Foosun_Data/FS400.mdb
+/KS_Data/KesionCMS4.mdb
+/admin/Databackup/NewCloud_Backup.MDB
+/bbs/database/BBSXP2007.mdb
+/database/BBSXP2007.mdb
+/database/bbsxp.mdb
+/bbs/database/bbsxp.mdb
+/database/useryyewuhjdjhgutwehdskjwewyt.mdb
+/database/companydatabase.mdb
+/database/jobcom.mdb
+/database/snowboy.mdb
+/temp/PE_TemplateProject.mdb
+/ESYSManager/EasyesESYS.mdb
+/data/cfwztg.mdb
+/_database/5d7525e61ca2ae39.mdb
+/db/pinyin.mdb
+/data/WRMPS.mdb
+/eWebEditor/admin/db/ewebeditor.mdb
+/Editor/admin/data.mdb
+/Editor/admin/db/ewebeditor.mdb
+/Editor/ewebeditor.mdb
+/Editor/admin/ewebeditor/db/ewebeditor.mdb
+/Chinese//Database/DataShop.mdb
+/Database/DataShop.mdb
+/Web_system/Web_system.mdb
+/cmseditor/db/ewebeditor.mdb
+/Databases/lixiang.mdb
+/Databases/tb11.mdb
+/data/qcdn_news.mdb
+/database/newcloud6.mdb
+/database/powereasy4.mdb
+/data/Joekoe_CMS_4.0.mdb
+/blogdata/1-blog.mdb
+/database/leadbbs.mdb
+/dxxobbs/mdb/dxxobbs.mdb
+/data/snowboy.mdb
+/database/database.mdb
+/data/appoen.mdb
+/download.mdb
+/dat.mdb
+/db.mdb
+/Data/data.mdb
+/Data/db.mdb
+/database/bbsxp2011.mdb
+/data/music.mdb
+/data/scadata.mdb
+/data/team.mdb
+/data/cnmai.mdb
+/database/newasp.mdb
+/admin/eWebEditor/db/ewebeditor.mdb
+/movie.mdb
+/shujuku/movie.mdb
+/admin/data/qcdn_news.mdb
+/firend.mdb
+/blogdata/L-BLOG.mdb
+/access/sf2.mdb
+/bbs/access/sf2.mdb
+/blog/blogdata/L-BLOG.mdb
+/data/down.mdb
+/data/Database.mdb
+/db/xzjddown.mdb
+/data/db1.mdb
+/MirCMS_ADB.mdb
+/ztqdata.mdb
+/zt/ztpdata.mdb
+/database/PowerEasy2007.mdb
+/database/PowerEasy2008.mdb
+/database/PE_Region.mdb
+/mdb/dxxobbs.mdb
+/Databases/0791idc.mdb
+/Data/0791idc.mdb
+/db/0791idc.mdb
+/Database/0791idc.mdb
+/Database/data/data.mdb
+/tour.mdb
+/ksqdate/_xidate.mdb
+/southidceditor/datas/southidceditor.mdb
+/data/tour.mdb
+/datebase/tour.mdb
+/data/zidc2008.mdb
+/datebase/zidc2008.mdb
+/database/tour.mdb
+/database/zidc2008.mdb
+/Databackup/dvbbs7_Backup.mdb
+/Databackup/dvbbs8_Backup.mdb
+/admin/HTML/db/ewebeditor.mdb
+/KS_Data/KesionCMS7.mdb
+/KS_Data/KesionCMS5.mdb
+/KS_Data/KesionCMS3.mdb
+/KS_Data/KesionCMS2.mdb
+/KS_Data/KesionCMS1.mdb
+/KS_Data/KesionCMS.mdb
+/datas/data.mdb
+/datas/datas.mdb
+/datas/ED-SC2.0.mdb
+/data/admin.mdb
+/Cl_CreateLiveCMSv42.mdb
+/SqlIn.mdb
+/system/database/Content.mdb
+/database/Content.mdb
+/admin/database/Content.mdb
+/system/database/Content1.mdb
+/database/Content1.mdb
+/ddbb/bs_itkoo2008.mdb
+/ddbb/bs_itkoo2009.mdb
+/ddbb/bs_itkoo2010.mdb
+/ddbb/bs_itkoo2011.mdb
+/ddbb/bs_itkoo2012.mdb
+/newsadmin/ubb/db/ewebeditor.mdb
+/ubb/db/ewebeditor.mdb
+/boke/Data/Dvboke.mdb
+/cnkdata/cms2011.mdb
+/ksqdate/xidate.mdb
+/data/eimscms.mdb
+/database/eimscms.mdb
+/db/eimscms.mdb
+/yy.mdb
+/qq.mdb
+/msn.mdb
+/Data/Ylmv_data.mdb
+/date/Idea_Site.mdb
+/chinammc_data/chinammc_shop.mdb
+/database/datas.mdb
+/data/CmsDj_Data.mdb
+/ubbcode/db/ewebeditor.mdb
+/0791idc.mdb
+/0791idc0.mdb
+/1-blog.mdb
+/1.mdb
+/123.mdb
+/1231.mdb
+/123456789/123456789.mdb
+/2.mdb
+/25175guestbook.mdb
+/282836278.mdb
+/3.mdb
+/3210.mdb
+/ASP/cart/database/metacart.mdb
+/AccessDB/d0w2b8d3.mdb
+/Ameav_Site.mdb
+/App_Data/App_Data.mdb
+/App_Data/data.mdb
+/App_Data/database.mdb
+/App_Data/db.mdb
+/BOOK.MDB
+/BarkBaseData.mdb
+/DATA/zblog.mdb
+/DATABASE/Fooee.mdb
+/DB/ddb.mdb
+/Data#userabc.mdb
+/Data/4Ne8Ev8Zl0Qy.mdb
+/Data/9959.mdb
+/Data/DvSQLLOG.mdb
+/Data/Fl_Web.mdb
+/Data/IPaddress.mdb
+/Data/MeQskdyDMS_4DaJta.mdb
+/Data/glgk2007.mdb
+/Data/oblog4.60.mdb
+/DataBackup/dvbbs.mdb
+/DataBase/#SoYiCi.MDB
+/DataBase/BBSXP7.mdb
+/DataBase/DB.mdb
+/DataBase/bbsxp6.mdb
+/DataBase/jycms.mdb
+/DataShop.mdb
+/DataShop/datashop.mdb
+/DataShop1.mdb
+/Data_ACT/Actcms.mdb
+/Data_LT/datareach.mdb
+/Dataabc/Data#userabc.mdb
+/Databackup/New_Backup.mdb
+/Databackup/bak.mdb
+/Databackup/dvbbs5.mdb
+/Databackup/dvbbs6.mdb
+/Databackup/shopxp.mdb
+/Database/Ameav_Site.mdb
+/Database/Bak_Site.mdb
+/Database/Counter.mdb
+/Database/DataShop1.mdb
+/Database/Database2006.mdb
+/Database/SuperFTP.Cn.mdb
+/Database/caifuw.mdb
+/Database/data.mdb
+/Database/mjaqibmugg@1hy9f.mdb
+/Database/roha.mdb
+/Database/sk_data.mdb
+/Database/tyqiye.mdb
+/Database/vote.mdb
+/Database/xxcms.mdb
+/Databases/0791idc0.mdb
+/Databases/21asp.mdb
+/Databases/bonfurniture.mdb
+/Databases/dskf96sad8d7d987sad.mdb
+/Databases/php99cms.mdb
+/Databases/wygkcn.mdb
+/Datas/editor.mdb
+/ESYSManager/DataBase/EsysV3.0.mdb
+/Editor.mdb
+/Enterprise.mdb
+/Enterprises.mdb
+/FS400.mdb
+/Fl_Web.mdb
+/Gsbbs/db/6k.mdb
+/HN_news.mdb
+/HXMYDATABASE/#WY_OAdata2010.MDB
+/HxData/#HxData.mdb
+/Idea_Site.mdb
+/Joekoe_CMS_4.0.mdb
+/KesionCMS5.mdb
+/PowerEasy2005.mdb
+/PowerEasy2006.mdb
+/PowerEasy6.mdb
+/ShopData.mdb
+/Skins/Dv_skin.mdb
+/Skyj.mdb
+/System/Database/Counter.mdb
+/TgDatabases/tianguang.mdb
+/WRMPS.mdb
+/WebManage/module/eWebEditor/db/ewebeditor.mdb
+/WebManage/module/eWebEditor/db1/ewebeditor.mdb
+/Web_Data/data.mdb
+/Web_Data/db.mdb
+/Website.mdb
+/_DataBase/Website.mdb
+/_database/back.mdb
+/_database/e3b3ee1b5da271ai.mdb
+/_private/shopping_cart.mdb
+/a.mdb
+/access.mdb
+/access/access.mdb
+/ad/dv_chanad.mdb
+/adffjhfgdfghsdfgsdfghjf.mdb
+/admin.mdb
+/admin/Databackup/AutoBackDB.Mdb
+/admin/Databases/male520backup.mdb
+/admin/Datas/editor.mdb
+/admin/admin.mdb
+/admin/cai/loaycai.mdb
+/admin/counter.mdb
+/admin/data/data.mdb
+/admin/data/db2.mdb
+/admin/data/news30000.mdb
+/admin/data/sub.mdb
+/admin/data/web.mdb
+/admin/databackup/datashop.mdb
+/admin/databackup/ebossi_data_backup.mdb
+/admin/date/web.mdb
+/admin/db/db2.mdb
+/admin/eWebEditor_v280_Free/db/ewebeditor.mdb
+/admin/eWebEditordb/ewebeditor.mdb
+/admin/edit/db/ewebeditor.mdb
+/admin/edit/db/ewebeditor1013.mdb
+/admin/editor/db/ewebeditor1013.mdb
+/admin/ewebeditor/db/ewebeditor1013.mdb
+/admin/gb/gb.mdb
+/admin/htmedit/db/ewebeditor.mdb
+/admin/info.mdb
+/admin/shopbackup.mdb
+/admin/sou/southidceditor.mdb
+/admin/tmp.mdb
+/admin/web/db/ewebeditor.mdb
+/admin888/121.mdb
+/bbs/Databackup/dvbbs.MDB
+/boss/WebEditor/db/ewebeditor.mdb
+/eWeb/db/ewebeditor.mdb
+/ewebedit/db/ewebeditor.mdb
+/ewebeditor.mdb
+/eWebEditor_v280_Free/db/ewebeditor.mdb
+/global.mdb
+/htmedit/db/ewebeditor.mdb
+/maillist.mdb
+/manage/Edit/db/ewebeditor.mdb
+/manage/eWeb/db/ewebeditor.mdb
+/manage/eWebEditor_v280_Free/db/ewebeditor.mdb
+/manage/htmedit/db/ewebeditor.mdb
+/manage/WebEditor/db/ewebeditor.mdb
+/webedit1/db/ewebeditor.mdb