Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Is "Body" works as intended? #19

Open
Sh1Yo opened this issue Apr 28, 2020 · 3 comments
Open

Is "Body" works as intended? #19

Sh1Yo opened this issue Apr 28, 2020 · 3 comments
Labels
enhancement New feature or request

Comments

@Sh1Yo
Copy link

Sh1Yo commented Apr 28, 2020

As we can see in the docs:

Header() and Body() have same usage of Query() generator.

- Query("{{.payload}}", "{{.name}}") works fine, but
- Body("{{.payload}}", "{{.name}}") just ignored.
I tried to set the method to POST, but anyways it doesn't work
My config is -

id: ci-fuzz-01
info:
  name: Command Injection Reflection
  risk: High
payloads:
- 'echo TJEGSE$((2314+6548321))$(echo TJEGSE)TJEGSE' 
requests:
- detections:
  - StringSearch("response", "6550635") && (StringCount("response", "6550635") > StringCount("oresponse",
    "6550635"))
  generators:
  - Body("{{.payload}}", "{{.name}}")
type: fuzz
variables:
- name: 'cmd

'
@j3ssie
Copy link
Member

j3ssie commented May 3, 2020

This look like a bug let me investigate and let you know.

@j3ssie j3ssie added the bug Something isn't working label May 3, 2020
@j3ssie
Copy link
Member

j3ssie commented May 16, 2020

Body("{{.payload}}") this should works. Because I do not support body select param yet

@Sh1Yo
Copy link
Author

Sh1Yo commented May 16, 2020

Okay, but I think that select param for Body is a necessary option so I will leave the issue open until you add it.

@j3ssie j3ssie added enhancement New feature or request and removed bug Something isn't working labels May 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants