{"id":13538926,"url":"https://github.com/c0ny1/upload-fuzz-dic-builder","last_synced_at":"2025-04-12T15:37:30.817Z","repository":{"id":53201372,"uuid":"156092925","full_name":"c0ny1/upload-fuzz-dic-builder","owner":"c0ny1","description":"上传漏洞fuzz字典生成脚本","archived":false,"fork":false,"pushed_at":"2021-04-01T08:33:22.000Z","size":176,"stargazers_count":1251,"open_issues_count":6,"forks_count":259,"subscribers_count":17,"default_branch":"master","last_synced_at":"2025-04-03T15:11:14.538Z","etag":null,"topics":["fuzz","upload-vul"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/c0ny1.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-11-04T14:53:17.000Z","updated_at":"2025-04-02T15:27:33.000Z","dependencies_parsed_at":"2022-08-15T03:30:24.762Z","dependency_job_id":null,"html_url":"https://github.com/c0ny1/upload-fuzz-dic-builder","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c0ny1%2Fupload-fuzz-dic-builder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c0ny1%2Fupload-fuzz-dic-builder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c0ny1%2Fupload-fuzz-dic-builder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c0ny1%2Fupload-fuzz-dic-builder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/c0ny1","download_url":"https://codeload.github.com/c0ny1/upload-fuzz-dic-builder/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248590532,"owners_count":21129840,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["fuzz","upload-vul"],"created_at":"2024-08-01T09:01:17.777Z","updated_at":"2025-04-12T15:37:30.782Z","avatar_url":"https://github.com/c0ny1.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"683b645c2162a1fce5f24ac2abfa1973\"\u003e\u003c/a\u003e漏洞\u0026\u0026漏洞管理\u0026\u0026漏洞发现/挖掘\u0026\u0026漏洞开发\u0026\u0026漏洞利用\u0026\u0026Fuzzing","Python","Python (1887)"],"sub_categories":["功能"],"readme":"# upload-fuzz-dic-builder 上传漏洞fuzz字典生成脚本\n\n![生成的字典](doc/upload_fuzz_dic.png)\n\n## 一、uasg\n\n```\n$ python upload-fuzz-dic-builder.py -h\nusage: upload-fuzz-dic-builder [-h] [-n] [-a] [-l] [-m] [--os] [-d] [-o]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -n , --upload-filename\n                        Upload file name\n  -a , --allow-suffix   Allowable upload suffix\n  -l , --language       Uploaded script language\n  -m , --middleware     Middleware used in Web System\n  --os                  Target operating system type\n  -d, --double-suffix   Is it possible to generate double suffix?\n  -o , --output         Output file\n```\n\n### 1.1 Example1\n生成适合全语言，全部中间件，全部操作系统的fuzz字典\n\n```\npython upload-fuzz-dic-builder.py\n```\n\n### 1.2 Example2\n生成适合后端语言为`asp`的fuzz字典\n\n```\npython upload-fuzz-dic-builder.py -l asp\n```\n\n### 1.3 Example3\n上传文件名为：`test`，可以上传后缀为`jpg`，后端语言为`php`，中间件为`apache`，操作系统为`Windows`，输出字典名为`upload_filename.txt`的fuzz字典\n\n```\npython upload-fuzz-dic-builder.py -n test -a jpg -l php -m apache --os win -o upload_file.txt\n```\n\n\n### 1.4 注意：\n\n1. 生成时给的上传点相关信息越详细，生成的字典越精确！\n2. 在使用burp的Intruder模块进行fuzz时将Payload面板中`Payload Encoding`一栏的`URL-encode these characters`选项设置为未选中状态。\n\n![burp intruder模块设置](doc/burp_intruder_setting.png)\n\n## 二、more\n\n[构造优质上传漏洞fuzz字典](http://gv7.me/articles/2018/make-upload-vul-fuzz-dic/)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fc0ny1%2Fupload-fuzz-dic-builder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fc0ny1%2Fupload-fuzz-dic-builder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fc0ny1%2Fupload-fuzz-dic-builder/lists"}