53 lines
1.9 KiB
YAML
53 lines
1.9 KiB
YAML
id: reflection-ssti
|
|
|
|
info:
|
|
name: Reflected SSTI Arithmetic Based
|
|
author: pdteam
|
|
severity: medium
|
|
reference:
|
|
- https://github.com/zaproxy/zap-extensions/blob/2d9898900abe85a47b9fe0ceb85ec39070816b98/addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/SstiScanRule.java
|
|
- https://github.com/DiogoMRSilva/websitesVulnerableToSSTI#list-of-seversneeds-update
|
|
tags: ssti,dast
|
|
|
|
variables:
|
|
first: "{{rand_int(1000, 9999)}}"
|
|
second: "{{rand_int(1000, 9999)}}"
|
|
result: "{{to_number(first)*to_number(second)}}"
|
|
|
|
http:
|
|
- pre-condition:
|
|
- type: dsl
|
|
dsl:
|
|
- 'method == "GET"'
|
|
|
|
skip-variables-check: true
|
|
payloads:
|
|
ssti:
|
|
- '{{concat("${", "{{first}}*{{second}}", "}")}}'
|
|
- '{{concat("{{", "{{first}}*{{second}}", "}}")}}'
|
|
- '{{concat("<%=", "{{first}}*{{second}}", "%>")}}'
|
|
- '{{concat("{", "{{first}}*{{second}}", "}")}}'
|
|
- '{{concat("{{{", "{{first}}*{{second}}", "}}}")}}'
|
|
- '{{concat("${{", "{{first}}*{{second}}", "}}")}}'
|
|
- '{{concat("#{", "{{first}}*{{second}}", "}")}}'
|
|
- '{{concat("[[", "{{first}}*{{second}}", "]]")}}'
|
|
- '{{concat("{{=", "{{first}}*{{second}}", "}}")}}'
|
|
- '{{concat("[[${", "{{first}}*{{second}}", "}]]")}}'
|
|
- '{{concat("${xyz|", "{{first}}*{{second}}", "}")}}'
|
|
- '{{concat("#set($x=", "{{first}}*{{second}}", ")${x}")}}'
|
|
- '{{concat("@(", "{{first}}*{{second}}", ")")}}'
|
|
- '{{concat("{@", "{{first}}*{{second}}", "}")}}'
|
|
|
|
fuzzing:
|
|
- part: query
|
|
type: postfix
|
|
fuzz:
|
|
- "{{ssti}}"
|
|
|
|
stop-at-first-match: true
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "{{result}}"
|
|
# digest: 4a0a00473045022060b24ab805932a9aae5635d76725d92d78d3366f76b103480386f7db2231b750022100cf4e3feff8153a59a9b668bbe6c989c4940074ec6857c5f4f4f920660719143d:922c64590222798bb761d5b6d8e72950 |