https://github.com/nccgroup/argumentinjectionhammer

A Burp Extension designed to identify argument injection vulnerabilities.
https://github.com/nccgroup/argumentinjectionhammer

Last synced: about 1 month ago
JSON representation

A Burp Extension designed to identify argument injection vulnerabilities.

• Host: GitHub
• URL: https://github.com/nccgroup/argumentinjectionhammer
• Owner: nccgroup
• Created: 2019-04-16T16:28:24.000Z (over 5 years ago)
• Default Branch: master
• Last Pushed: 2019-04-16T16:45:33.000Z (over 5 years ago)
• Last Synced: 2024-11-09T06:38:44.299Z (about 1 month ago)
• Language: Python
• Homepage: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/may/argument-injection-hammer/
• Size: 191 KB
• Stars: 118
• Watchers: 11
• Forks: 21
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• WebHackersWeapons - argumentinjectionhammer
• awesome-burp-extensions - Argument Injection Hammer - it is used to identify argument injection vulnerabilities, like *curl* *awk* etc, and sth just like these (Vulnerability Specific Extensions / Command Injection)

README

        
# Argument Injection Hammer

Argument Injection Hammer is an extension for the intercepting proxy [Burp Suite](https://portswigger.net/burp/) that extends the scanner's ability to detect argument injection and manipulation vulnerabilities in web applications and web services.

A web application is vulnerable to [argument injection](https://cwe.mitre.org/data/definitions/88.html) when untrusted inputs are passed as arguments to an external command.  An attacker can manipulate the arguments passed to the process to trigger either an arbitrary file write, arbitrary file read, or OS command injection depending on the supported arguments of the command and how the command is executed.  Argument injection should not be confused with [OS command injection](https://cwe.mitre.org/data/definitions/78.html) in which it is possible to use shell metacharacters to force the target application to execute additional arbitrary OS commands.

The extension contains payloads that can detect argument injection and manipulation vulnerabilities associated with common Linux commands using both in-band detection techniques and timing-based detection techniques.  The extension also supports limited brute forcing of short argument flags. 

## Supported Command Payloads

* `awk` 

* `curl`

* `date`

* `find`

* `git`

* `jrunscript`

* `lua`

* `mysql`

* `nmap`

* `openssl`

* `perl`

* `php`

* `php-cgi`

* `python`

* `readelf`

* `ruby`

* `sed`

* `sendmail`

* `sort`

* `sqlite3`

* `ssh`

* `tar`

* `wget`

* `zip`

## Installation

This extension is written in Python, so make sure to [configure Jython first within Burp Suite](https://support.portswigger.net/customer/portal/articles/1965930-how-to-install-an-extension-in-burp-suite).  After configuring Jython, simply add the extension into Burp Suite (Extender -> Extensions -> Add).

## Future Ideas

* Support out-of-band detection techniques.

* Add payloads to target common Windows commands.

* Add payloads for additional Linux commands.