Skip to content

Commit 7238dc0

Browse files
aaaahuiaaaaahuia
committed
403ByPass_BaiZeSEC-1.0
1 parent 0192ee2 commit 7238dc0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+4441
-1
lines changed

‎README.md‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,27 @@
11
# 403ByPass
2-
403ByPass-Burp Extensions_java
2+
3+
**403绕过-BurpSuite插件 by 白泽Sec-ahui**
4+
5+
联系方式：aaaahuia@163.com
6+
7+
#### 工具简述：
8+
9+
基于常见的框架漏洞或IP伪造尝试绕过网页403限制
10+
11+
#### 使用方法：
12+
13+
`BurpSuite -> Extender -> Extensions -> Add -> Extension Type: Java -> Select file: 403ByPass_BaiZeSEC-1.0.jar -> Next till Finish`
14+
15+
#### 测试代码：
16+
17+
```php
18+
<?php
19+
if($_SERVER['HTTP_X_FORWARDED_FOR']=="127.0.0.1"){
20+
http_response_code(200);
21+
print("200 success");
22+
}else{
23+
http_response_code(403);
24+
print("403 error");
25+
}
26+
```
27+

‎pom.xml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>org.Baize</groupId>
8+
<artifactId>403ByPass_BaizeSEC</artifactId>
9+
<version>1.0</version>
10+
11+
<name>403bypass_BaiZeSEC</name>
12+
<!-- FIXME change it to the project's website -->
13+
<url>http://www.example.com</url>
14+
15+
<properties>
16+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
17+
<maven.compiler.source>1.7</maven.compiler.source>
18+
<maven.compiler.target>1.7</maven.compiler.target>
19+
</properties>
20+
21+
<dependencies>
22+
<dependency>
23+
<groupId>junit</groupId>
24+
<artifactId>junit</artifactId>
25+
<version>4.11</version>
26+
<scope>test</scope>
27+
</dependency>
28+
<dependency>
29+
<groupId>net.portswigger.burp.extender</groupId>
30+
<artifactId>burp-extender-api</artifactId>
31+
<version>1.7.22</version>
32+
</dependency>
33+
34+
<!-- https://mvnrepository.com/artifact/com.google.code.gson/gson -->
35+
<dependency>
36+
<groupId>com.google.code.gson</groupId>
37+
<artifactId>gson</artifactId>
38+
<version>2.8.6</version>
39+
</dependency>
40+
41+
<!-- to get root domain -->
42+
<dependency>
43+
<groupId>com.google.guava</groupId>
44+
<artifactId>guava</artifactId>
45+
<version>30.1-jre</version>
46+
</dependency>
47+
48+
<!-- https://mvnrepository.com/artifact/org.apache.commons/commons-text -->
49+
<dependency>
50+
<groupId>org.apache.commons</groupId>
51+
<artifactId>commons-text</artifactId>
52+
<version>1.9</version>
53+
</dependency>
54+
55+
<!-- https://mvnrepository.com/artifact/org.beanshell/bsh -->
56+
<dependency>
57+
<groupId>org.beanshell</groupId>
58+
<artifactId>bsh</artifactId>
59+
<version>2.0b5</version>
60+
</dependency>
61+
</dependencies>
62+
63+
<build>
64+
<sourceDirectory>src</sourceDirectory>
65+
<pluginManagement><!-- lock down plugins versions to avoid using Maven defaults (may be moved to parent pom) -->
66+
<plugins>
67+
68+
<plugin>
69+
<artifactId>maven-assembly-plugin</artifactId>
70+
<configuration>
71+
<descriptorRefs>
72+
<descriptorRef>jar-with-dependencies</descriptorRef>
73+
</descriptorRefs>
74+
<archive>
75+
<manifest>
76+
<addDefaultImplementationEntries>
77+
true<!--to get Version from pom.xml -->
78+
</addDefaultImplementationEntries>
79+
</manifest>
80+
</archive>
81+
</configuration>
82+
<executions>
83+
<execution>
84+
<id>make-assembly</id>
85+
<phase>package</phase>
86+
<goals>
87+
<goal>single</goal>
88+
</goals>
89+
</execution>
90+
</executions>
91+
</plugin>
92+
<!-- clean lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#clean_Lifecycle -->
93+
<plugin>
94+
<artifactId>maven-clean-plugin</artifactId>
95+
<version>3.1.0</version>
96+
</plugin>
97+
<!-- default lifecycle, jar packaging: see https://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_jar_packaging -->
98+
<plugin>
99+
<artifactId>maven-resources-plugin</artifactId>
100+
<version>3.0.2</version>
101+
</plugin>
102+
<plugin>
103+
<artifactId>maven-compiler-plugin</artifactId>
104+
<version>3.8.0</version>
105+
</plugin>
106+
<plugin>
107+
<artifactId>maven-surefire-plugin</artifactId>
108+
<version>2.22.1</version>
109+
</plugin>
110+
<plugin>
111+
<artifactId>maven-jar-plugin</artifactId>
112+
<version>3.0.2</version>
113+
</plugin>
114+
<plugin>
115+
<artifactId>maven-install-plugin</artifactId>
116+
<version>2.5.2</version>
117+
</plugin>
118+
<plugin>
119+
<artifactId>maven-deploy-plugin</artifactId>
120+
<version>2.8.2</version>
121+
</plugin>
122+
<!-- site lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#site_Lifecycle -->
123+
<plugin>
124+
<artifactId>maven-site-plugin</artifactId>
125+
<version>3.7.1</version>
126+
</plugin>
127+
<plugin>
128+
<artifactId>maven-project-info-reports-plugin</artifactId>
129+
<version>3.0.0</version>
130+
</plugin>
131+
</plugins>
132+
</pluginManagement>
133+
</build>
134+
</project>

‎src/burp/BurpExtender.java‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
package burp;
2+
3+
import java.io.PrintWriter;
4+
import java.util.ArrayList;
5+
import java.util.Arrays;
6+
import java.util.List;
7+
8+
public class BurpExtender implements IBurpExtender,IScannerCheck
9+
{
10+
private IExtensionHelpers _helpers;
11+
private PrintWriter stdout;
12+
private PrintWriter stderr;
13+
private IBurpExtenderCallbacks _callbacks;
14+
public static String NAME = "403ByPass_BaizeSEC";
15+
public static String VERSION = "1.0";
16+
17+
@Override
18+
public void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks)
19+
{
20+
// 设置插件的名称
21+
callbacks.setExtensionName(NAME);
22+
this._callbacks = callbacks;
23+
24+
// 获取burp提供的标准输出流和错误输出流
25+
stdout = new PrintWriter(callbacks.getStdout(), true);
26+
stderr = new PrintWriter(callbacks.getStderr(), true);
27+
28+
_helpers = callbacks.getHelpers();
29+
30+
callbacks.registerScannerCheck(this);
31+
this.stdout.println(basicInformationOutput());
32+
33+
}
34+
35+
36+
@Override
37+
public List<IScanIssue> doPassiveScan(IHttpRequestResponse baseRequestResponse) {
38+
39+
List<String> results = new ArrayList<>();
40+
41+
42+
IRequestInfo iRequestInfo = _helpers.analyzeRequest(baseRequestResponse);
43+
44+
45+
IResponseInfo iResponseInfo = _helpers.analyzeResponse(baseRequestResponse.getResponse());
46+
47+
if(iResponseInfo.getStatusCode()!=403) return null;
48+
String oldReq = _helpers.bytesToString(baseRequestResponse.getRequest());
49+
String oldUrl = iRequestInfo.getUrl().getPath();
50+
while(oldUrl!="/" && oldUrl.endsWith("/")){
51+
oldUrl=oldUrl.substring(0,oldUrl.length()-1);
52+
}
53+
String previousPath = oldUrl.substring(0,oldUrl.lastIndexOf("/"));
54+
String lastPath = oldUrl.substring(oldUrl.lastIndexOf("/")+1);
55+
56+
57+
stdout.println("Scanning: "+iRequestInfo.getUrl());
58+
59+
String[] payloads = new String[]{"%2e/"+lastPath, lastPath+"/.", "./"+lastPath+"/./", lastPath+"%20/", "%20"+lastPath+"%20/", lastPath+"..;/",lastPath+"?",lastPath+"??","/"+lastPath+"//",lastPath+"/",lastPath+"/.randomstring"};
60+
String[] hpayloads = new String[]{"X-Rewrite-URL: "+oldUrl, "X-Original-URL: "+oldUrl,"Referer: /"+lastPath, "X-Custom-IP-Authorization: 127.0.0.1","X-Originating-IP: 127.0.0.1","X-Forwarded-For: 127.0.0.1","X-Remote-IP: 127.0.0.1","X-Client-IP: 127.0.0.1","X-Host: 127.0.0.1","X-Forwarded-Host: 127.0.0.1"};
61+
62+
for(String p:payloads){
63+
String newReq = oldReq.replace(oldUrl,previousPath+"/"+p);
64+
IHttpRequestResponse checkRequestResponse = _callbacks.makeHttpRequest(baseRequestResponse.getHttpService(),_helpers.stringToBytes(newReq));
65+
short STT_CODE = _helpers.analyzeResponse(checkRequestResponse.getResponse()).getStatusCode();
66+
if(STT_CODE == 200) {
67+
results.add("Url payload: "+_helpers.analyzeRequest(checkRequestResponse).getUrl()+" | Status code: "+STT_CODE);
68+
}
69+
}
70+
71+
for(String hp:hpayloads){
72+
String newReq="";
73+
if(hp.startsWith("Referer:") && oldReq.contains("Referer:")){
74+
newReq = oldReq.replace("^Referer:.*?$",hp);
75+
}else{
76+
newReq = oldReq.replace("User-Agent: ",hp+"\r\n"+"User-Agent: ");
77+
}
78+
79+
IHttpRequestResponse checkRequestResponse = _callbacks.makeHttpRequest(baseRequestResponse.getHttpService(),_helpers.stringToBytes(newReq));
80+
short STT_CODE = _helpers.analyzeResponse(checkRequestResponse.getResponse()).getStatusCode();
81+
if(STT_CODE == 200) {
82+
results.add("Header payload: "+hp+" | Status code: "+STT_CODE);
83+
}
84+
85+
}
86+
if(results.toString().equals("[]")) return null;
87+
CustomScanIssue customScanIssue = new CustomScanIssue(
88+
_helpers.analyzeRequest(baseRequestResponse).getUrl(),
89+
"403 ByPass Vuln",
90+
0,
91+
"High",
92+
"Certain",
93+
null,
94+
null,
95+
results.toString(),
96+
null,
97+
new IHttpRequestResponseWithMarkers[]{_callbacks.applyMarkers(baseRequestResponse, null, null)},
98+
baseRequestResponse.getHttpService()
99+
);
100+
101+
List<IScanIssue> issues = new ArrayList<>();
102+
issues.add(customScanIssue);
103+
stdout.println("===================================");
104+
stdout.println("恭喜！有一个漏洞被发现，漏洞信息为: "+_helpers.analyzeRequest(baseRequestResponse).getUrl()+" "+results);
105+
stdout.println("===================================");
106+
return issues;
107+
}
108+
109+
@Override
110+
public List<IScanIssue> doActiveScan(IHttpRequestResponse baseRequestResponse, IScannerInsertionPoint insertionPoint) {
111+
return null;
112+
}
113+
114+
@Override
115+
public int consolidateDuplicateIssues(IScanIssue existingIssue, IScanIssue newIssue) {
116+
if (existingIssue.getUrl()==newIssue.getUrl()) return -1;
117+
return 0;
118+
}
119+
120+
/**
121+
* 基本信息输出
122+
*/
123+
private static String basicInformationOutput() {
124+
125+
String str1 = "===================================\n";
126+
String str2 = String.format("%s 加载成功\n", NAME);
127+
String str3 = String.format("版本: %s\n", VERSION);
128+
String str4 = "作者: BaiZeSec_ahui\n";
129+
String str5 = "邮箱: aaaahuia@163.com\n";
130+
String str6 = "===================================\n";
131+
String detail = str1 + str2 + str3 + str4 + str5 + str6;
132+
return detail;
133+
}
134+
135+
136+
}

0 commit comments

Comments
 (0)