RevOK - An HTTP Response fuzzer to find Vulnerabilities in

项目说明

RevOK

We see the targets of our scan as passi, and this leads to underestimating the risk of performing a scan. However, the tools we use to scan are not immune to .
Testing these bugs is often hard since they require a dedicated testing infrastructure: Re analysts by simulating a malicious target and by tracking data in the security scanner.

!RevOK flow

While the focus is on security scanners, RevOK can be used to test any software that takes (attacker-controlled) third-party data and displays it to a user (e.g., ser REST API calls).

Re us to find two XSS to RCE bugs in Metasploit Pro[2] (C and C), as well as many other .
We described this technique in our paper "Ne Your : Weaponizing in Security Scanners", accepted at RAID 2020.

How to cite us

Re the automatic testing methodology presented in "Ne Your : Weaponizing in Security Scanners".

If you want to cite us, please use the following (BibTeX) reference:

Getting started

The core of RevOK is the stub component.
It listens for incoming requests and sends attack responses.

Responses are crafted from a *template file* and a *substitution list* containing attack payloads.

This is an example of a template file:

For each incoming request, the stub substitutes the placeholder ($a by default) with a new element of the substitution list.
You can also define custom placeholders using the --placeholder (-p) switch. Example usage:

You can find example.template and example.substitutions in this repo. WARNING: stub will substitute ANY occurrence of the defined placeholder; choose one that does not occur in any other part of the template.

You can also define a specific port using the --port switch, for example:

Additional options are a from the --help switch.

Automatic token deployment

"All responses are equal, but some responses are more equal than others"

Responses are not all parsed in the same way.
Some parsers accept that the *Status message* is something different from "OK" or "Mo",
others do not and discard the response.

To make testing easier, the stub component has a *tracking mode*, where it generates responses based on
a *probabilistic context-free grammar*.

You can launch the tracking mode of the stub component without defining the template and substitution list:

Enumerate tainted flows

Fetch attack template

Targets

To let you try Re a realistic target, we built DVAS, a *Damn Application Scanner*.

Why RevOK?

In short, Re scanners explode.

This is somewhat of an obscure reference from the 1981 movie *Scanners* [4].

Private military company ConSec recruits "scanners" – super-powered indi capable of telepathy and psychokinesis – and uses them in service of the company.
However, when one of ConSec's scanners demonstrates his powers at a marketing event, the – Darryl Revok – turns out to be a more powerful scanner, who causes the ConSec scanner's head to explode.

Here you can find the full scene.

References

1. Attacking the attackers
2. Metasploit Pro Release Notes for C and C
3. A. , G. Costa, A. Armando. "Ne Your : Weaponizing in Security Scanners"
4. Scanners (1981)

项目信息

开发语言：Python

Star 数：27

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An HTTP Response fuzzer to find Vulnerabilities in Security Scanners展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。