y1nglamore / idor_detect_tool Goto Github PK

一款API水平越权漏洞检测工具

Home Page: https://www.gem-love.com/2023/01/26/%E6%B0%B4%E5%B9%B3%E8%B6%8A%E6%9D%83%E6%8C%96%E6%8E%98%E6%8A%80%E5%B7%A7%E4%B8%8E%E8%87%AA%E5%8A%A8%E5%8C%96%E8%B6%8A%E6%9D%83%E6%BC%8F%E6%B4%9E%E6%A3%80%E6%B5%8B/

License: GNU General Public License v3.0

Python 57.48% Smarty 6.07% HTML 36.45%

idor_detect_tool's Introduction

API越权漏洞检测工具

概述

通过替换认证信息后重放请求，并对比数据包结果，判断接口是否存在越权漏洞

详细介绍：水平越权挖掘技巧与自动化越权漏洞检测

本工具仅供用于越权漏洞自动化测试的学习交流只用，工具本身只是个DEMO，其使用效果尚未得到充分的验证。

特点

支持HTTPS
自动过滤图片/js/css/html页面等静态内容
多线程检测，避免阻塞
支持输出报表与完整的URL、请求、响应

安装和使用

安装依赖

python3 -m pip install -r requirements.txt

启动

python3 start.py

即可监听socks5://127.0.0.1:8889。

安装证书

使用SwitchOmega等插件连接该代理，并访问mitm.it即可进入证书安装页面，根据操作系统进行证书安装。

以MacOS为例：

下载安装后，打开钥匙串访问，找到mitmproxy证书，修改为alwaystrust

检测漏洞

首先准备好目标系统的A、B两账号，根据系统的鉴权逻辑（Cookie、header、参数等）将A账号信息配置config/config.yml，之后登录B账号

使用B账号访问，脚本会自动替换鉴权信息并重放，根据响应结果判断是否存在越权漏洞

生成报表

每次有新漏洞都会自动添加到report/result.html中，通过浏览器打开：

点击具体条目可以展开/折叠对应的请求和响应：

检测逻辑

流量清洗：过滤掉静态资源和非json响应的请求
公共接口清洗：过滤掉无需参数即可访问的GET请求（例如/api/getCurrentTime）此类公共接口无需鉴权，因此无越权问题
长度卡点：判断响应长度是否大于100，用来去除一些空接口（只返回JSON骨架）
相似度检查：以Levenshtein距离计算相似度，相似度大于87%认为是相同的响应
关键字检查：对于响应长度小于100的请求判断是否包含“成功”“完成”等关键词。

测试用例

DEMO中给出了一个测试用代码，其中存在两个水平越权漏洞。

架构图

idor_detect_tool's People

Stargazers

Watchers

Forkers

sec-fork crj0b ifishzz explangcn bingpo zhangzhoudezhang ch1ngg cleanmgr112 retnullyu ibug1024 zxcv0221 galaxylove startagain2016 jaygith diguaranran fuckingawsomeblueteam rockmelodies secsystem lcamry zc0604 trustedsoftware benniedaniel tliutao zzhacked bajinsheng zzhsec cr4zyrain crackercat print1n wouijvziqy test2504 ashupup lay0us mahiro424 nuc-orz-lab javalangclass dmind-nll 02bx juneman 3yujw7njai longofo wuxueeee ddostest123 zo-zero-one ifofor keyboardancer arryboom mssky9527 explore-c wayswei kk-hub446 pingyan2019 web-logs2 testitok traers 406226161 zhangkaibin0921 l0veheather mxhaha dashbaord202401 s0rryerr0r jnusimba 10cks jorson-chen

idor_detect_tool's Issues

Exception in thread Thread-13:
Traceback (most recent call last):
File "C:\Program Files\Python38\lib\threading.py", line 932, in _bootstrap_inner
self.run()
File "C:\Program Files\Python38\lib\threading.py", line 870, in run
self._target(*self._args, **self._kwargs)
File "C:\Users\94818\Downloads\IDOR_detect_tool-master\core\replay.py", line 46, in init
Output(self.api, self.source_flow, self.modify_flow, source_resp, modify_resp, self.pretty_host).output()
File "C:\Users\94818\Downloads\IDOR_detect_tool-master\core\output.py", line 52, in output
content = f.read()
UnicodeDecodeError: 'gbk' codec can't decode byte 0xa7 in position 1635: illegal multibyte sequence

in script addons.py: No module named '__mitmproxy_script__'

在导入包时一直提示这个报错，要怎么解决？

windows导入证书需要密码

把这个错误，师傅知道怎么解决吗？

[+] 启动mitmproxy 127.0.0.1:8889
in script addons.py: 'type' object is not subscriptable
Task exception was never retrieved
future: <Task finished name='Task-5' coro=<ErrorCheck._shutdown_if_errored() done, defined at /usr/local/lib/python3.8/site-packages/mitmproxy/addons/errorcheck.py:18> exception=SystemExit(1)>
Traceback (most recent call last):
File "/usr/local/Cellar/[email protected]/3.8.13_1/Frameworks/Python.framework/Versions/3.8/lib/python3.8/asyncio/runners.py", line 44, in run
return loop.run_until_complete(main)
File "/usr/local/Cellar/[email protected]/3.8.13_1/Frameworks/Python.framework/Versions/3.8/lib/python3.8/asyncio/base_events.py", line 603, in run_until_complete
self.run_forever()
File "/usr/local/Cellar/[email protected]/3.8.13_1/Frameworks/Python.framework/Versions/3.8/lib/python3.8/asyncio/base_events.py", line 570, in run_forever
self._run_once()
File "/usr/local/Cellar/[email protected]/3.8.13_1/Frameworks/Python.framework/Versions/3.8/lib/python3.8/asyncio/base_events.py", line 1859, in _run_once
handle._run()
File "/usr/local/Cellar/[email protected]/3.8.13_1/Frameworks/Python.framework/Versions/3.8/lib/python3.8/asyncio/events.py", line 81, in _run
self._context.run(self._callback, *self._args)
File "/usr/local/lib/python3.8/site-packages/mitmproxy/addons/errorcheck.py", line 20, in _shutdown_if_errored
sys.exit(1)
SystemExit: 1