exploitkit

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 22, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

README

exploitkit

Deterministic web-entry probes and payload helpers built on core.HTTPDoer and core.ProcessRunner. It is intentionally small and bounded:

primitive requests evidence
CmdiProbe baseline + 6–10 fixed payloads unique echo marker / sleep delta / OAST payload
SSTIProbe baseline + 9 expressions arithmetic evaluation, reflection rejected
LFIProbe baseline + 11 traversal/wrapper payloads /etc/passwd, win.ini, PHP filter base64
SQLiProbe baseline + error/boolean/time sets DB error signature, true/false diff, sleep delta
SSRFProbe baseline + loopback/metadata/file payloads metadata marker, status/body diff
LFILogPoison 1 poison request + 1 include marker proves PHP execution; optional ?c= output
RedisGopherRCE none (string builder) Redis CONFIG SET/SET/SAVE gopher URL
MSFExecute one msfconsole run check or run stdout/stderr
DeserGenerate none (local subprocess) ysoserial / phpggc output, base64 + hex

Design rules:

  • No built-in target, credential, wordlist or one-click exploit chain.
  • Probes only read or sleep; they do not write to the target.
  • CmdiExecute, LFIRead and the host's sqlmap wrapper require a payload or technique that a probe already confirmed.
  • Caller must inject a gate-aware HTTPDoer (scope + rate limit + audit) and a gate-aware ProcessRunner; this package performs no authorization itself.

Typical host wiring:

kit := exploitkit.New(httpx.New(scope, limiter, audit))
finding, err := kit.CmdiProbe(ctx, exploitkit.CmdiOptions{
    Point: exploitkit.InjectPoint{
        URL: "https://target/search?q=1", Param: "q", Value: "1",
    },
})

Documentation

Overview

Package exploitkit provides deterministic, low-volume exploit probes for the common web entry points: command injection, SSTI, LFI, SQL injection, SSRF and deserialization payload generation.

It is not an exploit framework and it never chains steps by itself. Every probe sends a bounded number of requests, keeps the baseline response, and reports a technique plus the exact payload that produced evidence. Hosts remain responsible for authorization, approval and evidence storage through the injected core.HTTPDoer / ProcessRunner ports.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func GopherPayload 

func GopherPayload(host string, port int, raw string) string

GopherPayload builds a raw gopher:// URL for an internal TCP service. It is only a string constructor; sending it still requires an SSRF entry point.

func MSFResource 

func MSFResource(req MSFRequest) (string, error)

MSFResource builds the `-x` script. Values are quoted and reject newlines so an option cannot inject an extra msfconsole command.

func Manifest 

func Manifest() core.Manifest

Manifest declares the ten exposed tools. Each tool's Data is described by output_schema so agents know the return shape before calling.

func NewCapability 

func NewCapability(deps core.Deps) (core.Capability, error)

NewCapability builds the capability from injected ports.

func RedisGopherRCE 

func RedisGopherRCE(opt RedisGopherOptions) (string, error)

RedisGopherRCE builds the gopher URL for the classic Redis unauthenticated webshell chain. It does not send anything.

func SSTIExecute 

func SSTIExecute(engine, command string) (string, error)

SSTIExecute renders an engine-specific command-execution payload. It does not send it; the caller reviews the generated expression before using it.

Types

type Capability 

type Capability struct {
	// contains filtered or unexported fields
}

Capability adapts the probe primitives to the registry/capability contract. Every tool returns a Result envelope (Status/Summary/Meta/Findings/Next), never bare data. Hosts inject a gate-aware HTTPDoer and ProcessRunner; this package performs no authorization itself.

func (*Capability) Call 

func (c *Capability) Call(ctx context.Context, call core.Call) (core.Result, error)

Call dispatches by tool name, returning a populated envelope.

func (*Capability) Manifest 

func (c *Capability) Manifest() core.Manifest

Manifest implements core.Capability.

type CmdiOptions 

type CmdiOptions struct {
	Point          InjectPoint `json:"point"`
	Technique      string      `json:"technique,omitempty"` // echo|time|oast
	Marker         string      `json:"marker,omitempty"`
	SleepSeconds   int         `json:"sleep_seconds,omitempty"`
	CallbackDomain string      `json:"callback_domain,omitempty"`
}

CmdiOptions controls command-injection probing. The default technique is echo (a unique marker must appear in the response). time needs a sleep differential; oast returns payloads for the host to trigger and verify with an OAST client such as oastkit.

type DeserKind 

type DeserKind string

DeserKind identifies the target runtime. 

const (
	DeserJava DeserKind = "java"
	DeserPHP  DeserKind = "php"
)

type DeserRequest 

type DeserRequest struct {
	Kind      DeserKind          `json:"kind"`
	Chain     string             `json:"chain"`
	Command   string             `json:"command"`
	Binary    string             `json:"binary,omitempty"` // 覆盖默认路径
	ExtraArgs []string           `json:"extra_args,omitempty"`
	Env       []string           `json:"env,omitempty"`
	Timeout   time.Duration      `json:"timeout,omitempty"`
	Runner    core.ProcessRunner `json:"-"`
}

DeserRequest asks for a serialized payload. Binaries are host-provided: a local ysoserial.jar for Java or a phpggc executable for PHP. Nothing is sent.

type DeserResult 

type DeserResult struct {
	Kind     DeserKind `json:"kind"`
	Chain    string    `json:"chain"`
	Command  string    `json:"command"`
	Bytes    int       `json:"bytes"`
	Base64   string    `json:"base64"`
	Hex      string    `json:"hex"`
	Stdout   string    `json:"stdout,omitempty"`
	Stderr   string    `json:"stderr,omitempty"`
	Binary   string    `json:"binary"`
	ExitCode int       `json:"exit_code"`
	Note     string    `json:"note,omitempty"`
}

DeserResult carries the generated bytes in both raw and transport-friendly encodings. Base64 is the default for query/body insertion; hex is available for binary protocols.

type Finding 

type Finding struct {
	Vulnerable bool          `json:"vulnerable"`
	Technique  string        `json:"technique,omitempty"`
	DBMS       string        `json:"dbms,omitempty"`
	Engine     string        `json:"engine,omitempty"`
	Payload    string        `json:"payload,omitempty"`
	Evidence   string        `json:"evidence,omitempty"`
	Baseline   ProbeResult   `json:"baseline"`
	Probes     []ProbeResult `json:"probes,omitempty"`
}

Finding is the output shared by all probes.

type InjectPoint 

type InjectPoint struct {
	URL       string            `json:"url"`
	Method    string            `json:"method,omitempty"`
	Headers   map[string]string `json:"headers,omitempty"`
	Body      string            `json:"body,omitempty"`
	Param     string            `json:"param,omitempty"`
	Location  string            `json:"location,omitempty"` // query|body|json|header|cookie
	Value     string            `json:"value,omitempty"`    // baseline value
	TimeoutMS int               `json:"timeout_ms,omitempty"`
	Proxy     string            `json:"proxy,omitempty"`
}

InjectPoint describes where a payload goes. Either put {{inject}} in URL, Body or a header value, or set Param + Location.

func (InjectPoint) Apply 

func (p InjectPoint) Apply(payload string) (core.Request, error)

Apply renders one payload into a concrete request.

type Kit 

type Kit struct {
	HTTP core.HTTPDoer
}

Kit holds the injected ports.

func New 

func New(httpDoer core.HTTPDoer) *Kit

func (*Kit) CmdiExecute 

func (k *Kit) CmdiExecute(ctx context.Context, point InjectPoint, template, command string) (ProbeResult, error)

CmdiExecute runs one command through a confirmed injection point. The caller must pass a payload template that already worked ({{value}} and {{cmd}} are substituted), keeping the tool honest about what was verified.

func (*Kit) CmdiProbe 

func (k *Kit) CmdiProbe(ctx context.Context, opt CmdiOptions) (*Finding, error)

CmdiProbe tests a small, fixed set of separator/precedence variants. It never runs a destructive command: echo writes a marker, time sleeps, oast resolves a hostname.

func (*Kit) DeserGenerate 

func (k *Kit) DeserGenerate(ctx context.Context, req DeserRequest) (*DeserResult, error)

DeserGenerate runs a local payload generator. The output is not sent to any target; hosts must place it in an authorized request themselves.

func (*Kit) LFILogPoison 

func (k *Kit) LFILogPoison(ctx context.Context, opt LFIPoisonOptions) (*Finding, error)

LFILogPoison performs the log-poisoning proof and returns the include response. A marker in the response proves PHP execution; the command output (if any) is included verbatim for the operator to bind as evidence.

func (*Kit) LFIProbe 

func (k *Kit) LFIProbe(ctx context.Context, opt LFIOptions) (*Finding, error)

LFIProbe tests traversal variants and PHP filter wrappers. It only reads a fixed proof file; arbitrary reads use LFIRead after a technique is confirmed.

func (*Kit) LFIRead 

func (k *Kit) LFIRead(ctx context.Context, point InjectPoint, confirmedPayload, path string) (ProbeResult, error)

LFIRead applies a confirmed traversal payload to a different file. The caller supplies the payload returned by LFIProbe; the fixed proof file name is replaced with path.

func (*Kit) MSFExecute 

func (k *Kit) MSFExecute(ctx context.Context, req MSFRequest) (*MSFResult, error)

MSFExecute runs the generated resource through `msfconsole -q -x`.

func (*Kit) SQLiProbe 

func (k *Kit) SQLiProbe(ctx context.Context, opt SQLiOptions) (*Finding, error)

SQLiProbe runs error, boolean and time probes in that order.

func (*Kit) SSRFProbe 

func (k *Kit) SSRFProbe(ctx context.Context, opt SSRFOptions) (*Finding, error)

SSRFProbe returns a finding when an internal/metadata payload changes the response or returns a known metadata marker. A callback payload is always returned so the host can verify an out-of-band hit.

func (*Kit) SSTIProbe 

func (k *Kit) SSTIProbe(ctx context.Context, opt SSTIOptions) (*Finding, error)

SSTIProbe injects arithmetic expressions and requires the evaluated result while rejecting plain reflection of the payload.

func (*Kit) Send 

func (k *Kit) Send(ctx context.Context, point InjectPoint, payload string) (ProbeResult, error)

Send injects one confirmed payload (for example a gopher URL) and returns the response. It is the host-side "execute after SSRFProbe" primitive.

type LFIOptions 

type LFIOptions struct {
	Point  InjectPoint `json:"point"`
	OS     string      `json:"os,omitempty"`     // unix|windows|auto
	Target string      `json:"target,omitempty"` // 默认 /etc/passwd
}

LFIOptions controls local-file-inclusion probing.

type LFIPoisonOptions 

type LFIPoisonOptions struct {
	Point            InjectPoint `json:"point"`
	ConfirmedPayload string      `json:"confirmed_payload"`
	LogPath          string      `json:"log_path,omitempty"`   // 默认 /var/log/apache2/access.log
	PoisonURL        string      `json:"poison_url,omitempty"` // 默认用 point.URL
	Header           string      `json:"header,omitempty"`     // 默认 User-Agent
	Marker           string      `json:"marker,omitempty"`
	Command          string      `json:"command,omitempty"` // 可选：写入 shell 后执行
}

LFIPoisonOptions turns a confirmed LFI into code execution through log poisoning. It writes a marker-only PHP snippet into the User-Agent (or a caller-selected header), then includes the access log through the confirmed traversal payload. The optional command is passed as ?c=... to the PHP snippet; no file is written to the target by this package.

type MSFRequest 

type MSFRequest struct {
	Module    string             `json:"module"`
	Options   map[string]string  `json:"options,omitempty"`
	Payload   string             `json:"payload,omitempty"`
	LHOST     string             `json:"lhost,omitempty"`
	LPORT     string             `json:"lport,omitempty"`
	CheckOnly bool               `json:"check_only,omitempty"`
	Timeout   time.Duration      `json:"timeout,omitempty"`
	Binary    string             `json:"binary,omitempty"`
	Runner    core.ProcessRunner `json:"-"`
	Targets   []core.Target      `json:"-"`
}

MSFRequest runs one Metasploit module through a local msfconsole. It is an optional adapter: hosts without msfconsole get a normal process error.

type MSFResult 

type MSFResult struct {
	Module   string `json:"module"`
	Mode     string `json:"mode"` // check|run
	Command  string `json:"command"`
	Output   string `json:"output"`
	ExitCode int    `json:"exit_code"`
}

type ProbeResult 

type ProbeResult struct {
	Payload    string              `json:"payload"`
	Status     int                 `json:"status"`
	DurationMS int64               `json:"duration_ms"`
	Body       string              `json:"body,omitempty"`
	Headers    map[string][]string `json:"headers,omitempty"`
	Error      string              `json:"error,omitempty"`
}

ProbeResult is one request/response pair kept for evidence.

type RedisGopherOptions 

type RedisGopherOptions struct {
	Host     string `json:"host,omitempty"`     // 默认 127.0.0.1
	Port     int    `json:"port,omitempty"`     // 默认 6379
	WebRoot  string `json:"web_root"`           // 如 /var/www/html
	Filename string `json:"filename,omitempty"` // 默认 4zrec.php
	Password string `json:"password,omitempty"`
}

RedisGopherOptions describes a Redis "write a PHP file through CONFIG SET + SAVE" chain. The caller must know the web root and that the Redis instance is reachable through the SSRF entry point. No authentication is attempted unless Password is set.

type SQLiOptions 

type SQLiOptions struct {
	Point        InjectPoint `json:"point"`
	DBMS         string      `json:"dbms,omitempty"` // auto|mysql|postgres|mssql
	SleepSeconds int         `json:"sleep_seconds,omitempty"`
}

SQLiOptions controls SQL-injection probing. The probe only reads: error messages, boolean response differences, or sleep timing. It never writes or extracts data.

type SSRFOptions 

type SSRFOptions struct {
	Point          InjectPoint `json:"point"`
	InternalPorts  []int       `json:"internal_ports,omitempty"` // 默认 80,443,8080,6379,9200
	CallbackDomain string      `json:"callback_domain,omitempty"`
}

SSRFOptions controls server-side request forgery probing. The probe compares a baseline response with loopback, cloud-metadata and file-scheme payloads. OAST verification stays with the host: use a callback_domain and check oast_get_records afterwards.

type SSTIOptions 

type SSTIOptions struct {
	Point  InjectPoint `json:"point"`
	Engine string      `json:"engine,omitempty"` // auto|jinja2|twig|freemarker|velocity|thymeleaf|jsp|erb
}

SSTIOptions controls server-side template injection probing.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.