search

Hackmanit / Web-Cache-Vulnerability-Scanner

Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).
Other
871 stars 127 forks source link
bugbounty hacking hacking-tool penetration-testing penetration-testing-tools pentesting scanner security security-audit security-scanner security-tools vulnerability-scanners web-cache

readme

Release Go Report Card GitHub go.mod Go version License

Web Cache Vulnerability Scanner (WCVS) is a fast and versatile CLI scanner for web cache poisoning and web cache deception developed by Hackmanit and Maximilian Hildebrand.

The scanner supports many different web cache poisoning and web cache deception techniques, includes a crawler to identify further URLs to test, and can adapt to a specific web cache for more efficient testing. It is highly customizable and can be easily integrated into existing CI/CD pipelines.

Features

Installation

Option 1: Pre-built Binary

Prebuilt binaries of WCVS are provided on the releases page. These releases include 2 default wordlists, as well.

Option 2: Kali Linux / BlackArch Repository

go1.21 and higher

go install -v github.com/Hackmanit/Web-Cache-Vulnerability-Scanner@latest

Option 4: Docker

1. Clone repository or download the latest source code release

2. Build image (the wordlists folder will also be copied)

$ docker build .
Sending build context to Docker daemon  29.54MB
Step 1/10 : FROM golang:latest AS builder
 ---> 05c8f6d2538a
Step 2/10 : WORKDIR /go/src/app
 ---> Using cache
 ---> f591f24be8cf
Step 3/10 : COPY . .
 ---> 38b358dd3472
Step 4/10 : RUN go get -d -v ./...
 ---> Running in 41f53de436c5
....
Removing intermediate container 9e2e84d14ff3
 ---> 1668edcf6ee3
Successfully built 1668edcf6ee3

3. Run wcvs

$ docker run -it 1668edcf6ee3 /wcvs --help
https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner
version 1.0.0

Usage

WCVS is highly customizable using its flags. Many of the flags can either contain a value directly or the path to a file.

The only mandatory flag is -u/--url to provide the target URL which should be tested for web cache poisoning/deception. The target URL can be provided in different formats,

WCVS needs two wordlists in order to test for the first 5 techniques - one wordlist with header names and one with parameter names. The wordlists can either be present in the same directory WCVS is executed from or specified using the --headerwordlist/-hw and --parameterwordlist/-pw flags.

Examples:

wcvs -u 127.0.0.1
wcvs -u http://127.0.0.1
wcvs -u https://example.com
wcvs -u file:path/to/url_list

wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt"
wcvs -u https://example.com -pw "file:/home/user/Documents/wordlist-parameter.txt"
wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt" -pw "file:/home/user/Documents/wordlist-parameter.txt"

Specify Headers, Parameters, Cookies, and More

If you want to specify more than 1 cookie, parameter or header you need to specify a file which contains them. Take a look at the available templates.

Examples:

wcvs -u https://example.com -ch "X-Custom-Header-ABC"

wcvs -u https://example.com -sc "PHPSESSID=123"
wcvs -u https://example.com -sc "file:/home/user/Documents/cookies.txt"

wcvs -u https://example.com -sh "Referer: localhost"
wcvs -u https://example.com -sh "file:/home/user/Documents/headers.txt"

wcvs -u https://example.com -sp "admin=true"
wcvs -u https://example.com -sp "file:/home/user/Documents/parameters.txt"

wcvs -u https://example.com -post -sb "admin=true"
wcvs -u https://example.com -post -sb "file:/home/user/Documents/body.txt"

wcvs -u https://example.com -post -sb "{}" -ct "application/json"

wcvs -u https://example.com -uac

wcvs -u https://example.com -ch "X-Custom-Cache-Header"

Generate a JSON Report

A JSON report is generated and updated after each scanned URL if the flag --generatereport/-gr is set. The report is written, just like a log file, into the same directory WCVS is executed from. In order to change the directory for all output files use --generatepath/-gp. If HTML special chars shall be encoded in the report, use --escapejson/-ej.

Examples:

wcvs -u https://example.com -gr
wcvs -u https://example.com -gr -ej
wcvs -u https://example.com -gr -gp /home/user/Documents
wcvs -u https://example.com -gr -gp /home/user/Documents -ej

Crawl for URLs

In order to crawl for URLs, --recursivity/-r needs to be set. It specifies how deep the crawler shall go recursion-wise. By default WCVS only crawls for URLs of the same domain. To also crawl for other domains, --recdomains/red can be used. To only crawl URLs which inherit a specific string, --recinclude/-rin can be used. --reclimit/-rl limits how many URLs are crawled for each recursion depth. Also, a list with URLs which shall not be crawled can be specified with --recexclude/-rex. --generatecompleted/-gc can, for example, be used to generate a list with all already tested URLs. If a scan is repeated, but WCVS shall not crawl and test again the same URLs, this list can be used for --recexclude/-rex.

Examples:

wcvs -u https://example.com -r 5
wcvs -u https://example.com -r 5 -red /home/user/Documents/mydomains.txt
wcvs -u https://example.com -r 5 -rl 2
wcvs -u https://example.com -r 5 -rex /home/user/Documents/donttest.txt

Use a Proxy

To use a proxy, a CA certificate of the proxy in PEM format is needed. Burp Suite certificates are provided in DER format, for example. To convert them, the following command can be used: openssl x509 -inform DER -outform PEM -text -in cacert.der -out cacert.pem. The path to the certificate can be specified with --proxycertpath/-ppath. The default URL for the proxy is http://127.0.0.1:8080. In order to change it, use --proxyurl/-purl.

Examples:

wcvs -u https://example.com -ppath /home/user/Documents/cacert.pem
wcvs -u https://example.com -ppath /home/user/Documents/cacert.pem -purl http://127.0.0.1:8081

Throttle or Accelerate

The number of maximum allowed requests per second can be set with --reqrate/-rr. By default, this number is unrestricted. Contrary, the number of requests per second can be increased potentially, if --threads/-t is used to increase the number of concurrent threads WCVS utilizes. The default value is 20.

Examples:

wcvs -u https://example.com -rr 10
wcvs -u https://example.com -rr 1
wcvs -u https://example.com -rr 0.5
wcvs -u https://example.com -t 50

Further Flags

WCVS provides even more than the beforehand mentioned flags and options. --help/-h provides a list of each flag, its meaning, and how to use it.

Example:

wcvs -h

Background Information

A short series of blog posts giving more information about web cache poisoning and WCVS can be found here:

  1. Is Your Application Vulnerable to Web Cache Poisoning?
  2. Web Cache Vulnerability Scanner (WCVS) - Free, Customizable, Easy-To-Use

The Web Cache Vulnerability Scanner (WCVS) was developed as a part of a bachelor's thesis by Maximilian Hildebrand.

License

WCVS is developed by Hackmanit and Maximilian Hildebrand and licensed under the Apache License, Version 2.0.