web-cache-vulnerability-scanner
Go-based CLI tool for testing for web cache poisoning
Versão no Kali: 2.0.0-0kali1 · Arquiteturas: amd64 arm64 · Comandos: 2
Metapacotes:
kali-linux-everything
Documentação do Kali:
https://www.kali.org/tools/web-cache-vulnerability-scanner/
Web Cache Vulnerability Scanner (WCVS) is a fast and versatile CLI scanner for web cache poisoning and web cache deception developed by Hackmanit and Maximilian Hildebrand. The scanner supports many different web cache poisoning and web cache deception techniques, includes a crawler to identify further URLs to test, and can adapt to a specific web cache for more efficient testing. It is highly customizable and can be easily integrated into existing CI/CD pipelines.
sudo apt install web-cache-vulnerability-scanner (6.27 MB)
Dependências: libc6
Escolha um comando ao lado para ver a descrição e a ajuda completa.
wcvs
root@kali:~# wcvs -h
__/\\____/\\___/\\_____/\\\\\\\\__/\\\____/\\\__/\\\\\\\\\\_
_\/\\\__/\\\\_/\\\___/\\\//////__\//\\\__/\\\__\/\\\//////__
_\//\\\/\\\\\/\\\___/\\\__________\//\\\/\\\___\/\\\\\\\\\\_
__\//\\\\\/\\\\\___\//\\\__________\//\\\\\____\////////\\\_
___\//\\\\//\\\_____\///\\\\\\\\____\//\\\______/\\\\\\\\\\_
____\///__\///________\////////______\///______\//////////__
WCVS - the Web Cache Vulnerability Scanner. (v2.0.0)
Published by Hackmanit under http://www.apache.org/licenses/LICENSE-2.0
Author: Maximilian Hildebrand
Repository: https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner
Blog Post: https://hackmanit.de/en/blog-en/145-web-cache-vulnerability-scanner-wcvs-free-customizable-easy-to-use
Usage: Web-Cache-Vulnerability-Scanner(.exe) [options]
General Options:
--help -h Show this help and quit
--verbosity -v Set verbosity. 0 = quiet, 1 = normal, 2 = verbose
--reqrate -rr Requests per second. Float value. Has to be greater than 0. Default value is infinite
--threads -t Threads to use. Default value is 20
--timeout -to Seconds until timeout. Default value is 15
--onlytest -ot Choose which tests to run. Use the , separator to specify multiple ones. Example: -onlytest 'deception,cookies,css,forwarding,smuggling,dos,headers,parameters,fatget,cloaking,splitting,pollution,encoding'
--skiptest -st Choose which tests to not run. Use the , separator to specify multiple ones. Example: -skiptest 'deception,cookies,css,forwarding,smuggling,dos,headers,parameters,fatget,cloaking,splitting,pollution,encoding'
--useproxy -up Do you want to use a proxy?
--proxyurl -purl Url for the proxy. Default value is http://127.0.0.1:8080
--force -f Perform the tests no matter if there is a cache or even the cachebuster works or not
--ignorestatus -is Ignore a specific status code for cache poisoning
--reasontypes -rt Choose which reason types to use for cache poisoning. Choose from: body (reflection in body),header (reflection in header), status (change of status code), length (change of body length). Default is 'body,header,status,length'
--contentlengthdifference -cldiff Threshold for reporting possible Finding, when 'poisoned' response differs more from the original length. Default is 5000. 0 = don't check. May be prone to false positives!
--hitmissdifference -hmdiff Threshold for time difference (milliseconds) between cache hit and cache miss responses. Default is 30
--skiptimebased -stime Skip checking if a repsonse gets cached by measuring time differences (may be prone to false positives, or increase hitmissdifference)
--skipwordlistcachbuster -swordlistcb Skip using wordlists to check for cachebusters (may be time intensive)
--cacheheader -ch Specify a custom cache header
--nocolor -nc Disable colored output
--nostatusline -ns Disable status line output
Generate Options:
--generatepath -gp Path all files (log, report, completed) will be written to. Example: -gp '/p/a/t/h/'. Default is './'
--generatereport -gr Do you want a report to be generated?
--escapejson -ej Do you want HTML special chars to be encoded in the report?
--generatecompleted -gc Do you want a list with completed URLs to be generated?
--generatelog -gl Do you want a log file to be created?
Request Options:
--url -u Url to scan. Has to start with http:// or https://. Otherwise use file: to specify a file with (multiple) urls. E.g. -u https://www.example.com or -u file:/usr/share/web-cache-vulnerability-scanner/templates/url_list
--usehttp -http Use http instead of https for URLs, which doesn't specify either one
--declineCookies -dc Do you don't want to use cookies, which are received in the response of the first request?
--cachebuster -cb Specify the cachebuster to use. The default value is cbwcvs
--setcookies -sc Set a Cookie. Otherwise use file: to specify a file with urls. E.g. -sc uid=123 or -sc file:/usr/share/web-cache-vulnerability-scanner/templates/cookie_list
--setheaders -sh Set a Header. Otherwise use file: to specify a file with urls. E.g. -sh 'User-Agent: Safari/1.1' or -sh file:/usr/share/web-cache-vulnerability-scanner/templates/header_list
--setparameters -sp Set a Query Parameter. Otherwise use file: to specify a file with urls. E.g. -sp user=admin or -sp file:/usr/share/web-cache-vulnerability-scanner/templates/parameter_list
--setbody -sb Set the requests' body. Otherwise use file: to specify a file with urls. E.g. -sb 'admin=true' or -sh file:/usr/share/web-cache-vulnerability-scanner/templates/body_file
--post -post Do a POST request instead of a GET request
--contenttype -ct Set the contenttype for a POST Request. Default is application/x-www-form-urlencoded. If you don't want a content-type to be used at all use -ct ''
--parameterseparator -ps Specify the separator for parameters. The default value is &
--useragentchrome -uac Set chrome as User-Agent. Default is WebCacheVulnerabilityScanner v2.0.0
Crawl Options:
--recursivity -r Put (via href or src specified) urls at the end of the queue if the domain is the same. Specify how deep the recursivity shall go. Default value is 0 (no recursivity)
--reclimit -rl Define a limit, how many files shall be checked recursively. Default is 0 (unlimited)
--recinclude -rin Choose which links should be included. Separate with a space. E.g: -rin '.js .css'
--recexclude -rex Use -cp (-completedpath) or -gc (-generatecompleted) to generate a list of already completed URLs. Use -rex path/to/file so the already completed URLs won't be tested again recursively.
--recdomains -red Define an additional domain which is allowed to be added recursively. Otherwise use file: to specify a file with urls. E.g. -sh 'api.example.com' or -sh file:templates/recdomains_list
Wordlist Options:
--headerwordlist -hw Wordlist for headers to test.
--parameterwordlist -pw Wordlist for query parameters to test.
web-cache-vulnerability-scanner
root@kali:~# web-cache-vulnerability-scanner -h
__/\\____/\\___/\\_____/\\\\\\\\__/\\\____/\\\__/\\\\\\\\\\_
_\/\\\__/\\\\_/\\\___/\\\//////__\//\\\__/\\\__\/\\\//////__
_\//\\\/\\\\\/\\\___/\\\__________\//\\\/\\\___\/\\\\\\\\\\_
__\//\\\\\/\\\\\___\//\\\__________\//\\\\\____\////////\\\_
___\//\\\\//\\\_____\///\\\\\\\\____\//\\\______/\\\\\\\\\\_
____\///__\///________\////////______\///______\//////////__
WCVS - the Web Cache Vulnerability Scanner. (v2.0.0)
Published by Hackmanit under http://www.apache.org/licenses/LICENSE-2.0
Author: Maximilian Hildebrand
Repository: https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner
Blog Post: https://hackmanit.de/en/blog-en/145-web-cache-vulnerability-scanner-wcvs-free-customizable-easy-to-use
Usage: Web-Cache-Vulnerability-Scanner(.exe) [options]
General Options:
--help -h Show this help and quit
--verbosity -v Set verbosity. 0 = quiet, 1 = normal, 2 = verbose
--reqrate -rr Requests per second. Float value. Has to be greater than 0. Default value is infinite
--threads -t Threads to use. Default value is 20
--timeout -to Seconds until timeout. Default value is 15
--onlytest -ot Choose which tests to run. Use the , separator to specify multiple ones. Example: -onlytest 'deception,cookies,css,forwarding,smuggling,dos,headers,parameters,fatget,cloaking,splitting,pollution,encoding'
--skiptest -st Choose which tests to not run. Use the , separator to specify multiple ones. Example: -skiptest 'deception,cookies,css,forwarding,smuggling,dos,headers,parameters,fatget,cloaking,splitting,pollution,encoding'
--useproxy -up Do you want to use a proxy?
--proxyurl -purl Url for the proxy. Default value is http://127.0.0.1:8080
--force -f Perform the tests no matter if there is a cache or even the cachebuster works or not
--ignorestatus -is Ignore a specific status code for cache poisoning
--reasontypes -rt Choose which reason types to use for cache poisoning. Choose from: body (reflection in body),header (reflection in header), status (change of status code), length (change of body length). Default is 'body,header,status,length'
--contentlengthdifference -cldiff Threshold for reporting possible Finding, when 'poisoned' response differs more from the original length. Default is 5000. 0 = don't check. May be prone to false positives!
--hitmissdifference -hmdiff Threshold for time difference (milliseconds) between cache hit and cache miss responses. Default is 30
--skiptimebased -stime Skip checking if a repsonse gets cached by measuring time differences (may be prone to false positives, or increase hitmissdifference)
--skipwordlistcachbuster -swordlistcb Skip using wordlists to check for cachebusters (may be time intensive)
--cacheheader -ch Specify a custom cache header
--nocolor -nc Disable colored output
--nostatusline -ns Disable status line output
Generate Options:
--generatepath -gp Path all files (log, report, completed) will be written to. Example: -gp '/p/a/t/h/'. Default is './'
--generatereport -gr Do you want a report to be generated?
--escapejson -ej Do you want HTML special chars to be encoded in the report?
--generatecompleted -gc Do you want a list with completed URLs to be generated?
--generatelog -gl Do you want a log file to be created?
Request Options:
--url -u Url to scan. Has to start with http:// or https://. Otherwise use file: to specify a file with (multiple) urls. E.g. -u https://www.example.com or -u file:/usr/share/web-cache-vulnerability-scanner/templates/url_list
--usehttp -http Use http instead of https for URLs, which doesn't specify either one
--declineCookies -dc Do you don't want to use cookies, which are received in the response of the first request?
--cachebuster -cb Specify the cachebuster to use. The default value is cbwcvs
--setcookies -sc Set a Cookie. Otherwise use file: to specify a file with urls. E.g. -sc uid=123 or -sc file:/usr/share/web-cache-vulnerability-scanner/templates/cookie_list
--setheaders -sh Set a Header. Otherwise use file: to specify a file with urls. E.g. -sh 'User-Agent: Safari/1.1' or -sh file:/usr/share/web-cache-vulnerability-scanner/templates/header_list
--setparameters -sp Set a Query Parameter. Otherwise use file: to specify a file with urls. E.g. -sp user=admin or -sp file:/usr/share/web-cache-vulnerability-scanner/templates/parameter_list
--setbody -sb Set the requests' body. Otherwise use file: to specify a file with urls. E.g. -sb 'admin=true' or -sh file:/usr/share/web-cache-vulnerability-scanner/templates/body_file
--post -post Do a POST request instead of a GET request
--contenttype -ct Set the contenttype for a POST Request. Default is application/x-www-form-urlencoded. If you don't want a content-type to be used at all use -ct ''
--parameterseparator -ps Specify the separator for parameters. The default value is &
--useragentchrome -uac Set chrome as User-Agent. Default is WebCacheVulnerabilityScanner v2.0.0
Crawl Options:
--recursivity -r Put (via href or src specified) urls at the end of the queue if the domain is the same. Specify how deep the recursivity shall go. Default value is 0 (no recursivity)
--reclimit -rl Define a limit, how many files shall be checked recursively. Default is 0 (unlimited)
--recinclude -rin Choose which links should be included. Separate with a space. E.g: -rin '.js .css'
--recexclude -rex Use -cp (-completedpath) or -gc (-generatecompleted) to generate a list of already completed URLs. Use -rex path/to/file so the already completed URLs won't be tested again recursively.
--recdomains -red Define an additional domain which is allowed to be added recursively. Otherwise use file: to specify a file with urls. E.g. -sh 'api.example.com' or -sh file:templates/recdomains_list
Wordlist Options:
--headerwordlist -hw Wordlist for headers to test.
--parameterwordlist -pw Wordlist for query parameters to test.
