Mass Assigner is a strong instrument designed to determine and exploit mass project vulnerabilities in net purposes. It achieves this by first retrieving knowledge from a specified request, akin to fetching consumer profile knowledge. Then, it systematically makes an attempt to use every parameter extracted from the response to a second request supplied, one parameter at a time. This strategy permits for the automated testing and exploitation of potential mass project vulnerabilities.
Disclaimer
This instrument actively modifies server-side knowledge. Please guarantee you may have correct authorization earlier than use. Any unauthorized or criminality utilizing this instrument is fully at your individual danger.
Options
- Permits the addition of customized headers inside requests
- Affords customization of varied HTTP strategies for each origin and goal requests
- Helps rate-limiting to handle request thresholds successfully
- Supplies the choice to specify “ignored parameters” which the instrument will ignore throughout execution
- Improved the help in nested arrays/objects inside JSON knowledge in responses
What’s Subsequent
- Help further content material sorts, akin to “utility/x-www-form-urlencoded”
Set up & Utilization
Set up necessities
pip3 set up -r necessities.txt
Run the script
python3 mass_assigner.py --fetch-from "http://instance.com/path-to-fetch-data" --target-req "http://instance.com/path-to-probe-the-data"
Arguments
Forbidden Buster accepts the next arguments:
-h, --help present this assist message and exit
--fetch-from FETCH_FROM
URL to fetch knowledge from
--target-req TARGET_REQ
URL to ship modified knowledge to
-H HEADER, --header HEADER
Add a customized header. Format: 'Key: Worth'
-p PROXY, --proxy PROXY
Use Proxy, Utilization i.e: http://127.0.0.1:8080.
-d DATA, --data DATA Add knowledge to the request physique. JSON is supported with escaping.
--rate-limit RATE_LIMIT
Variety of requests per second
--source-method SOURCE_METHOD
HTTP technique for the preliminary request. Default is GET.
--target-method TARGET_METHOD
HTTP technique for the modified request. Default is PUT.
--ignore-params IGNORE_PARAMS
Parameters to disregard throughout modification, separated by comma.
Instance Utilization:
python3 mass_assigner.py --fetch-from "http://instance.com/api/v1/me" --target-req "http://instance.com/api/v1/me" --header "Authorization: Bearer XXX" --proxy "http://proxy.instance.com" --data '{"param1": "check", "param2":true}'
