original = "GET /animal?data=[+b64mutate]SGVsbG8gSGFja2VyIQ==[+end] HTTP/1.1"

class TestLogic(Transform):
@ApplyIteration(10)
def test_b64mutate(self, data, state):
if state.init:
state.decoded = base64.b64decode(data)
return
return base64.b64encode(random_insert(state.decoded, ["'"]))

TestFactory = TestLogic(original)
for test in TestFactory:
print(test)Tests Generated:GET /animal?data=SGVsbG8gSCdhY2tlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGFja2VyISc= HTTP/1.1
GET /animal?data=SGVsbG8gSGFjaydlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGEnY2tlciE= HTTP/1.1
GET /animal?data=SCdlbGxvIEhhY2tlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGFjaydlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGFja2VyISc= HTTP/1.1
GET /animal?data=SCdlbGxvIEhhY2tlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGFjJ2tlciE= HTTP/1.1
GET /animal?data=SGVsbG8gSGFjJ2tlciE= HTTP/1.1In the example above the test uses state.init to base64 decode the wrapped inner payload only once at the beginning of the test sequence and store that result into state.decoded. Then for all normal test generation executions state.decoded is used as the decoded inner data to be processed. This type of pattern is useful to improve the performance (https://www.kitploit.com/search/label/Performance) of your transform due to the fact that only 1 decode occurs at the beginning (vs decoding the same payload at the generation of every test).DocumentationTag Types[+tag]inner[+end] - Sniper style iterative transform[%tag]inner[%end] - Clusterbomb style iterative transform[#tag]inner[#end] - Batteringram/Pitchfork style iterative transform[@tag]inner[@end] - Stateless persistant transformLogic DecoratorsNameArgumentsdata inputDescription@ApplyIteration(n)n= # of Iterationsinner value of the haptyc tagLogic to generate N tests with inner as data@ApplyRange(b,e,s=1)b = begin value, e = max value, s = stepgenerated value of the rangeLogic to generate a test for every value stepped with the value given as data@ApplyList(L)L = python listitem of the listLogic to generate a test for every value in the list given as data@ApplyFilelist(path)path = filesystem (https://www.kitploit.com/search/label/Filesystem) pathitem of the listLogic to generate a test for every value in the filelist given as data@ApplyPayloads(name)name = builtin list nameitem of the listLogic to generate a test for every value in the built-in list given as dataHaptyc Class DecoratorsNameArgumentsDescription@CloneTransform(srcname, destname)srcname=string of a transform method copy from, destname=string of a non-existent transform method to copy intoCloneTransform is used to copy the implementation of one transform into another namespace without needing to copy/paste. This is useful in '%' and '#' style attacks when you need to re-use the same transform implementation in multiple positionsTransform Class Helper MethodsNameDescriptionself.inner()Retrives the inner payload of the tagself.stop()Will immediately stop test generation of that transformself.me()Will return the name of the current transform contextself.set_label(label)Will set the label for this current testself.get_label(label)Will get the label for this current testTransform Helper State AttributesNameDescriptionstate.iterCurrent iteration count of the transform (0-based)state.initBoolean that indicates if in the initialization stageHelper Mutation FunctionsNameDescriptionradamsa(data)This function will execute radamsa on the input data and returns its result (radamsa is required to be installed)index_insert(data, list, index)This function will insert a payload from the list into the supplied data at the supplied indexrandom_insert(data, list)This function will insert a payload from the list into the supplied data at a random indexBulitin Wordlists@ApplyPayloads("0-9")@ApplyPayloads("10 letter words")@ApplyPayloads("11 letter words")@ApplyPayloads("12 letter words")@ApplyPayloads("3

___________________________
@hacking_Attack
@Hacking_Video

letter words")@ApplyPayloads("4 letter words")@ApplyPayloads("5 letter words")@ApplyPayloads("6 letter words")@ApplyPayloads("7 letter words")@ApplyPayloads("8 letter words")@ApplyPayloads("9 letter words")@ApplyPayloads("a-z")@ApplyPayloads("CGI scripts")@ApplyPayloads("Directories - long")@ApplyPayloads("Directories - short")@ApplyPayloads("dirsearch")@ApplyPayloads("Extensions - long")@ApplyPayloads("Extensions - short")@ApplyPayloads("Filenames - long")@ApplyPayloads("Filenames - short")@ApplyPayloads("Format strings")@ApplyPayloads("Form field names - long")@ApplyPayloads("Form field names - short")@ApplyPayloads("Form field values")@ApplyPayloads("Fuzzing - full")@ApplyPayloads("Fuzzing - JSON_XML injection")@ApplyPayloads("Fuzzing - out-of-band")@ApplyPayloads("Fuzzing - path traversal")@ApplyPayloads("Fuzzing - path traversal (https://www.kitploit.com/search/label/Path%20Traversal) (single file)")@ApplyPayloads("Fuzzing - quick")@ApplyPayloads("Fuzzing - SQL injection")@ApplyPayloads("Fuzzing - template injection")@ApplyPayloads("Fuzzing - XSS")@ApplyPayloads("HTTP headers")@ApplyPayloads("HTTP verbs")@ApplyPayloads("IIS files and directories")@ApplyPayloads("Interesting files and directories")@ApplyPayloads("Local files - Java")@ApplyPayloads("Local files - Linux")@ApplyPayloads("Local files - Windows")@ApplyPayloads("Passwords")@ApplyPayloads("Server-side variable names")@ApplyPayloads("Short words")@ApplyPayloads("SSRF targets")@ApplyPayloads("User agents - long")@ApplyPayloads("User agents - short")@ApplyPayloads("Usernames")How to installThere are 2 ways to install HaptycThe easy way using the release turbo-intruder-all_w_haptyc.jar attached to this repositoryThe manual wayEither way you choose these releases do not include radamsa and if you want radamsa support you must install it from this repo: (Optional) Installl radamsa via https://gitlab.com/akihe/radamsaHow to install - Pre-packaged (easy)Clone this repo and note turbo-intruder-all_w_haptyc.jar in the release dirOpen BurpGo to the Extender tabClick the Add buttonClick the Select File ... button and choose turbo-intruder-all_w_haptyc.jarHow to install - Manual (patching turbo-intruder-all.jar)Clone this repoIn bash execute ./install.sh In Burp reload Turbo Intruder

Download Haptyc (https://github.com/defparam/haptyc)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Seal HackTheBox Walkthrough

Seal is a CTF Linux machine rated as medium difficulty on Hack the Box platform. So let get started and deep dive into breaking down

The post Seal HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Haptyc - Test Generation Framework

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Name That Toon: Modern-Day Frosty

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Dark Reading: Attacks/Breaches
Bug-Bounty Programs Shift Focus to Most Critical Flaws

The number of bug bounty programs jumped by a third, the median payout for a critical vulnerability report rose to $3,000, but rewards for easier-to-find lower-severity flaws stagnated in 2021.

Dark Reading: Attacks/Breaches
40% of Corporate Networks Targeted by Attackers Seeking to Exploit Log4j

More than 60 variants of the original exploit were introduced over the last day alone.

Dark Reading: Attacks/Breaches
Why Classifying Ransomware as a National Security Threat Matters

Government actions help starve attack groups of the resources - money, ability to recruit, and time.

Dark Reading: Attacks/Breaches
Kronos Suffers Ransomware Attack, Expects Full Restoration to Take 'Weeks'

Customers advised to adopt alternative internal processes to support the affected human resources services.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Volvo Confirms R&D Data Stolen in Breach

The company confirmed last week that one of its file repositories was accessed by a third party.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Sunset: Twilight Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/848/0*1Sz2CcOG7vQ5grR1.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Testing for Local File Inclusion Vulnerability-Part 1

https://cdn-images-1.medium.com/max/600/1*NlxG-DnPzNe8UARdBd3s5w.jpeg
Hi. Been on a research streak with my team, the Cyb0ts.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 5 Ethical Hacking Courses on Udemy

https://cdn-images-1.medium.com/max/2600/0*hd8rZ5EvfqICYzcY
5 Best Ethical Hacking and Cyber Security Courses on Udemy

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video