Hacking Articles Tips Tricks Videos Tutorials

Web Cache Vulnerability Scanner (https://www.kitploit.com/search/label/Vulnerability%20Scanner) (WCVS) is a fast and versatile CLI scanner for web cache poisoning (https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#background-information) developed by Hackmanit (https://hackmanit.de/).The scanner supports many different web cache poisoning techniques, includes a crawler to identify further URLs to test, and can adapt to a specific web cache for more efficient testing. It is highly customizable (https://www.kitploit.com/search/label/Customizable) and can be easily integrated into existing CI/CD pipelines.
FeaturesSupport for 9 web cache poisoning techniques: Unkeyed header poisoningUnkeyed parameter poisoningParameter cloakingFat GETHTTP response splittingHTTP request smugglingHTTP header oversize (HHO)HTTP meta character (HMC)HTTP method override (HMO)Analyzing a web cache before testing and adapting to it for more efficient testingGenerating a report in JSON formatCrawling websites for further URLs to scanRouting traffic through a proxy (e.g., Burp Suite)Limiting requests per second to bypass rate limitingInstallationOption 1: Pre-built Binary (Recommended)Prebuilt binaries of WCVS are provided on the releases page (https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases). These releases include 2 default wordlists, as well.Option 2: Fetch Repository Using GoThe repository can be fetched using Go.go get -u https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner
UsageWCVS is highly customizable using its flags. Many of the flags can either contain a value directly or the path to a file.The only mandatory flag is -u/--url to provide the target URL which should be tested for web cache poisoning. The target URL can be provided in different formats,WCVS needs two wordlists in order to test for the first 5 techniques - one wordlist with header names and one with parameter names. The wordlists can either be present in the same directory WCVS is executed from or specified using the --headerwordlist/-hw and --parameterwordlist/-pw flags.Examples:wcvs -u 127.0.0.1
wcvs -u http://127.0.0.1
wcvs -u https://example.com
wcvs -u file:path/to/url_list

wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt"
wcvs -u https://example.com -pw "file:/home/user/Documents/wordlist-parameter.txt"
wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt" -pw "file:/home/user/Documents/wordlist-parameter.txt"
Specify Headers, Parameters, Cookies, and More--setcookies/-sc specifies cookies which shall be added to the request--setheaders/-sh specifies headers which shall be added to the request--setparameters/-sp specifies parameters which shall be added to the request. While it is also possible to simply add them to the URL, it might be more useful in some cases to add them via this flag.--post/-post changes the HTTP method from GET to POST--setbody/-sb specifies the body which shall be added to the request--contenttype/-ct specifies the value of the Content-Type header--useragentchrome/-uac changes the User-Agent from WebCacheVulnerabilityScanner v{Version-Number} to Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36. While the same can be achieved with e.g. -sh "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ..., this flag provides a quicker way.Examples:wcvs -u https://example.com -sc "PHPSESSID=123"
wcvs -u https://example.com -sc "file:/home/user/Documents/cookies.txt"

wcvs -u https://example.com -sh "Referer: localhost"
wcvs -u https://example.com -sh "file:/home/user/Documents/headers.txt"

wcvs -u https://example.com -sp "admin=true"
wcvs -u https://example.com -sp "file:/home/user/Documents/parameters.txt"

wcvs -u https://example.com -post -sb "admin=true"
wcvs -u https://example.com -post -sb "file:/home/user/Documents/body.txt"

wcvs -u https://example.com -post -sb "{}" -ct "application/json"

11 views21:01

About

Blog

Apps

Platform