Skip to content

Commit b28ceb4

Browse files
stealthcopterstealthcopter
committed
getting more polished
1 parent 89e54d6 commit b28ceb4

22 files changed

+613
-371
lines changed

‎README.md‎

Lines changed: 86 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,23 @@ Transform intercepted requests into ready-to-use exploit scripts instantly! This
66

77
## 🚀 Key Features
88

9-
* **Multi-language Support**: Generate exploits in Python, Node.js, Ruby, and Bash/cURL
10-
* **One-Click Generation**: Convert any intercepted request into working exploit code
9+
* **Multi-language Support**: Generate exploits in Python, JavaScript and Bash/cURL (more languages coming soon!)
10+
* **Instant Generation**: Convert any intercepted or edited request into working exploit code
1111
* **Clean Code Output**: Get properly formatted, production-ready scripts
12-
* **Framework Integration**: Uses popular frameworks like Requests, Axios, and Net::HTTP
12+
* **Framework Integration**: Uses popular frameworks like Requests, fetch etc.
1313
* **Smart Request Parsing**: Automatically handles headers, parameters, and content types
1414

1515
Perfect for security researchers, penetration testers, and bug bounty hunters who want to quickly validate and demonstrate vulnerabilities. Save time on exploit development and focus on what matters - finding security issues!
1616

1717
## Feature Requests
1818

19-
If you have a language or framework you would find useful but it's missing from here, please open an [feature request](https://github.com/BugBountyzip/CaidoCSRF/issues/new).
19+
If you have a language or framework you would like adding please open an [feature request](https://github.com/BugBountyzip/CaidoCSRF/issues/new).
2020

21-
The intention with this plugin is to make it as simple as possible to add more languages and frameworks. This will likely move to a basic templating language to allow user-defined templates, but let's see if anyone actually uses this first.
21+
The intention with this plugin is to make it as simple as possible to add more languages and frameworks via user-defined templates, but let's see if anyone actually uses this first.
2222

2323
## Usage
2424

25-
1. Install the plugin from Caido's plugin store (or download the zip from this github repo)
25+
1. ~~Install the plugin from Caido's plugin store or~~ (coming soon 🤞) download the zip from the [releases page](https://github.com/stealthcopter/CaidoExploitGenerator/releases) and install in Caido
2626
2. Right-click on a request in Caido
2727
3. Select the PoC Generator button
2828
4. Choose your desired CSRF payload type from the dropdown
@@ -36,27 +36,90 @@ The intention with this plugin is to make it as simple as possible to add more l
3636

3737
## Output Example
3838

39+
See below for some examples of the generated exploit scripts from a request:
40+
41+
### Python / Requests
42+
3943
```python
4044
import requests
4145

42-
def exploit():
43-
headers = {
44-
"Cookie": "hidufhoiauhfoiuhaiofhoafsa",
45-
}
46-
data = {
47-
"data[wp-refresh-metabox-loader-nonces][post_id]": "187",
48-
"data[wp-refresh-post-lock][lock]": "1744145293:2",
49-
"data[wp-refresh-post-lock][post_id]": "187",
50-
"interval": "10",
51-
"screen_id": "post",
52-
"has_focus": "true",
53-
}
54-
r = requests.post('https://target.domain.com/vulnerable.php', headers=headers, data=data)
46+
url = 'https://stealthcopter.com/testing/endpoint'
47+
48+
headers = {
49+
'Cookie': 'secret=155ee356-23a6-11f0-af46-678665dcd42c',
50+
'X-Forwarded-For': '127.0.0.1'
51+
}
5552

56-
print(r.status_code)
57-
print(r.text)
53+
data = {
54+
'action': 'delete',
55+
'csrf': '7e5dbebc12',
56+
'file': '/etc/passwd'
57+
}
5858

59-
return r.ok
59+
r = requests.post(url, headers=headers, data=data)
6060

61-
exploit()
61+
print(r.status_code)
62+
print(r.text)
6263
```
64+
65+
### JavaScript / Fetch
66+
67+
```javascript
68+
const url = 'https://stealthcopter.com/json/store/v1/checkout?_locale=en'
69+
70+
let body = JSON.stringify({
71+
"billing_address": {
72+
"first_name": "Test",
73+
"last_name": "Testerton",
74+
"company": "",
75+
"address_1": "123 Addressington Lane",
76+
"address_2": "Testington upon Twine",
77+
"city": "Biscuiton",
78+
"state": "CA",
79+
"postcode": "14125",
80+
"country": "US",
81+
"email": "[email protected]",
82+
"phone": "123456789"
83+
},
84+
"create_account": false,
85+
"account_no": 2857915,
86+
"customer_password": null,
87+
"payment_data": [
88+
{
89+
"key": "new-payment-method",
90+
"value": false
91+
}
92+
]
93+
})
94+
95+
const options = {
96+
method: 'POST',
97+
headers: {
98+
'Content-Type':'application/json',
99+
'Cookie': 'PHPSESSID=vmnuns3bgtvf69nbs7ne4vjt9o;',
100+
},
101+
body: body,
102+
}
103+
104+
try {
105+
const response = await fetch(url, options)
106+
107+
console.log('Status:', response.status)
108+
const responseBody = await response.text()
109+
console.log('Response:', responseBody)
110+
} catch (error) {
111+
console.error('Error:', error)
112+
}
113+
```
114+
115+
### Bash / Curl
116+
117+
```bash
118+
curl -X POST \
119+
-H 'Cookie:secret=155ee356-23a6-11f0-af46-678665dcd42c' \
120+
-H 'X-Forwarded-For:127.0.0.1' \
121+
-d 'action=delete' \
122+
-d 'csrf=7e5dbebc12' \
123+
-d 'file=/etc/passwd' \
124+
'https://stealthcopter.com/testing/endpoint'
125+
```

‎assets/javascript-fetch.hbs‎

Lines changed: 28 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,35 @@
1-
const url = '{{escapeSingleQuotes url}}';
1+
const url = '{{escapeSingleQuotes url}}'
22

3-
const exploit = async () => {
4-
const options = {
5-
method: '{{method}}',
6-
{{#if headers}}
7-
headers: {
8-
{{#each headers}}
9-
'{{escapeSingleQuotes @key}}': '{{escapeSingleQuotes this}}',
10-
{{/each}}
11-
},
12-
{{/if}}
133
{{#if json}}
14-
body: JSON.stringify({{body}})
4+
let body = JSON.stringify({{body}})
155
{{else if params}}
16-
body: JSON.stringify({
17-
{{#each params}}
18-
'{{escapeSingleQuotes @key}}': '{{escapeSingleQuotes this}}',
19-
{{/each}}
20-
})
6+
const params = new URLSearchParams()
7+
{{#each params}}
8+
params.append('{{escapeSingleQuotes @key}}', '{{escapeSingleQuotes this}}')
9+
{{/each}}
10+
let body = params.toString()
2111
{{else if body}}
22-
body: `{{escapeSingleQuotes body}}`
12+
body = `{{escapeBackticks body}}`
2313
{{/if}}
24-
};
25-
26-
try {
27-
const response = await fetch(url, options);
2814

29-
console.log('Status:', response.status);
30-
const responseBody = await response.text();
31-
console.log('Response:', responseBody);
32-
33-
return response.ok;
34-
} catch (error) {
35-
console.error('Error:', error);
36-
return false;
37-
}
38-
};
15+
const options = {
16+
method: '{{method}}',
17+
{{#if headers}}
18+
headers: { {{#if json}}
19+
'Content-Type':'application/json',{{/if}}
20+
{{#each headers}}
21+
'{{escapeSingleQuotes @key}}': '{{escapeSingleQuotes this}}',
22+
{{/each}}
23+
},
24+
{{/if}}
25+
body: body,
26+
}
3927

40-
exploit();
28+
try {
29+
const response = await fetch(url, options)
30+
console.log('Status:', response.status)
31+
const responseBody = await response.text()
32+
console.log('Response:', responseBody)
33+
} catch (error) {
34+
console.error('Error:', error)
35+
}

‎assets/python-requests.hbs‎

Lines changed: 14 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,19 @@
11
import requests
22

3-
def exploit():
4-
url = '{{escapeSingleQuotes url}}'
3+
url = '{{escapeSingleQuotes url}}'
54

6-
{{#if headers}}
7-
headers = {{dict headers}}
8-
{{/if}}
9-
{{#if params}}
10-
data = {{dict params}}
11-
{{else if json}}
12-
data = {{ body }}
13-
{{else}}
14-
data = '''{{ escapeSingleQuotes body }}'''
15-
{{/if}}
5+
{{#if headers}}
6+
headers = {{dict headers}}
7+
{{/if}}
8+
{{#if params}}
9+
data = {{dict params}}
10+
{{else if json}}
11+
data = {{ body }}
12+
{{else}}
13+
data = '''{{ escapeSingleQuotes body }}'''
14+
{{/if}}
1615

17-
r = requests.{{toLowerCase method}}(url, {{#if headers}}headers=headers, {{/if}}{{#if json}}json{{else}}data{{/if}}=data)
16+
r = requests.{{toLowerCase method}}(url, {{#if headers}}headers=headers, {{/if}}{{#if json}}json{{else}}data{{/if}}=data)
1817

19-
print(r.status_code)
20-
print(r.text)
21-
22-
return r.ok
23-
24-
exploit()
18+
print(r.status_code)
19+
print(r.text)

‎assets/requests/basic.http‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
POST /testing/endpoint HTTP/1.1
2+
Host: stealthcopter.com
3+
Upgrade-Insecure-Requests: 1
4+
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
5+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6+
Accept-Encoding: gzip, deflate
7+
Accept-Language: en-US,en;q=0.9
8+
Cookie: secret=155ee356-23a6-11f0-af46-678665dcd42c
9+
Content-Type: application/x-www-form-urlencoded
10+
Content-Length: 46
11+
X-Forwarded-For: 127.0.0.1
12+
13+
action=delete&csrf=7e5dbebc12&file=/etc/passwd

‎assets/requests/json.http‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
POST /json/store/v1/checkout?_locale=en HTTP/1.1
2+
Host: stealthcopter.com
3+
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
4+
Accept: application/json, */*;q=0.1
5+
Content-Type: application/json
6+
Origin: http://stealthcopter.com
7+
Referer: http://stealthcopter.com/
8+
Accept-Encoding: gzip, deflate
9+
Accept-Language: en-US,en;q=0.9
10+
Cookie: PHPSESSID=vmnuns3bgtvf69nbs7ne4vjt9o;
11+
12+
{
13+
"billing_address": {
14+
"first_name": "Test",
15+
"last_name": "Testerton",
16+
"company": "",
17+
"address_1": "123 Addressington Lane",
18+
"address_2": "Testington upon Twine",
19+
"city": "Biscuiton",
20+
"state": "CA",
21+
"postcode": "14125",
22+
"country": "US",
23+
"email": "[email protected]",
24+
"phone": "123456789"
25+
},
26+
"create_account": false,
27+
"account_no": 2857915,
28+
"customer_password": null,
29+
"payment_data": [
30+
{
31+
"key": "new-payment-method",
32+
"value": false
33+
}
34+
]
35+
}

‎assets/requests/xml.http‎

Whitespace-only changes.

‎caido.config.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,12 @@ const id = "exploit-generator";
1111
export default defineConfig({
1212
id,
1313
name: "Exploit Generator",
14-
description: "Generate Proof of Concept exploit scripts from requests",
15-
version: "0.0.2",
14+
description: "Generate customizable PoC exploit scripts in multiple languages from HTTP requests.",
15+
version: "0.0.3",
1616
author: {
1717
name: "stealthcopter",
18-
email: "exploit-generator@stealthcopter.com",
19-
url: "https://github.com/stealthcopter",
18+
email: "exploit-gen@stealthcopter.com",
19+
url: "https://github.com/stealthcopter/CaidoExploitGenerator",
2020
},
2121
plugins: [
2222
{
@@ -28,7 +28,7 @@ export default defineConfig({
2828
kind: 'frontend',
2929
id: "frontend",
3030
root: 'packages/frontend',
31-
assets: ["assets/*.hbs"],
31+
assets: ["assets/*.hbs", "assets/requests/*.http"],
3232
backend: {
3333
id: "backend",
3434
},

0 commit comments

Comments
 (0)