dwisiswant0/ppfuzz

A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀

ppfuzz

Prototype Pollution Fuzzer

A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀

• Installation
  • Binary
  • Source
  • Dependencies
• Demonstration
• Usage
  • Basic
  • Options
• Usage
• Supporting Materials
• Contributing
• Attribution
• Acknowledments
• License

---

Installation

Binary

Simply, download a pre-built binary from releases page and run!

Source

NOTE: Rust should be installed!

Using cargo:

▶ cargo install ppfuzz

— or

Manual building executable from source code:

▶ git clone https://github.com/dwisiswant0/ppfuzz
▶ cd ppfuzz && cargo build --release
# binary file located at target/release/ppfuzz

Dependencies

ppfuzz uses chromiumoxide, which requires Chrome or Chromium browser to be installed. If the CHROME environment variable is set, then it'll use it as the default executable. Otherwise, the filenames google-chrome-stable, chromium, chromium-browser, chrome and chrome-browser are searched for in standard places. If that fails, /Applications/Google Chrome.app/... (on MacOS) or the registry (on Windows) is consulted.

Demonstration

As you can see in the demo above (click to view in high-quality), ppfuzz attempts to check for prototype-pollution vulnerabilities by adding an object & pointer queries, if it's indeed vulnerable: it'll fingerprinting the script gadgets used and then display additional payload info that could potentially escalate its impact to XSS, bypass or cookie injection.

Usage

It's fairly simple to use ppfuzz!

▶ ppfuzz -l FILE [OPTIONS]

Basic

Use -l/--list to provide input list:

▶ ppfuzz -l FILE

You can also provide the list using I/O redirection:

▶ ppfuzz < FILE

— or chain it from another command output:

▶ cat FILE | ppfuzz

Only show vulnerable targets/suppress an errors:

▶ ppfuzz -l FILE 2>/dev/null

Options

Here are all the options it supports:

▶ ppfuzz -h

Flag	Description	Default value
-l, --list	List of target URLs
-c, --concurrency	Set the concurrency level	5
-t, --timeout	Max. time allowed for connection (s)	30
-h, --help	Prints help information
-V, --version	Prints version information

Supporting Materials

• Nuclei templates
• PPScan
• Prototype Pollution and useful Script Gadgets
• JavaScript prototype pollution attack in NodeJS
• Prototype pollution – and bypassing client-side HTML sanitizers

Contributing

When I started ppfuzz, I had very little or no knowledge on Rust and I believe there may be a lot of drawbacks/security vulnerabilities. So all contributions are welcome, of course — any bug reports & suggestions are appreciated, some environment have not been tested yet.

Attribution

Besides being my learning medium, this tool was created because it was inspired by @R0X4R's tip on how to automate prototype pollution checking using page-fetch.

Cross-compile GitHub workflow inspired by crodjer's sysit.

Acknowledments

Since this tool includes some contributions, I'll publically thank the following users for their helps and resources:

• @mattsse - for his awesome chromiumoxide & mentoring me which helped a lot to quickly adapt Rust!
• Fourty2#4842 (Discord) - for helpful workaround.
• All contributors.

License

ppfuzz is distributed under MIT. See LICENSE.

ppfuzz's Issues

Error on building

There is an error when building from source code and from cargo.
Different one from this other issue
Here is the error:

Compiling ppfuzz v1.0.1
error[E0658]: binding by-move and by-ref in the same pattern is unstable
--> /home/jusepe/.cargo/registry/src/github.com-1ecc6299db9ec823/ppfuzz-1.0.1/src/fuzzer.rs:53:37
|
53 |         if let Ok((ref url, vuln, is_err, detail, gadgets)) = res {
|                    -------                ^^^^^^  ^^^^^^^ by-move pattern here
|                    |                      |
|                    |                      by-move pattern here
|                    by-ref pattern here
|
= note: see issue #68354 <https://github.com/rust-lang/rust/issues/68354> for more information

error: aborting due to previous error

For more information about this error, try `rustc --explain E0658`.
error: could not compile `ppfuzz`.

To learn more, run the command again with --verbose.
warning: build failed, waiting for other jobs to finish...
error: failed to compile `ppfuzz v1.0.1`, intermediate artifacts can be found at `/tmp/cargo-installRpiuBb`

Caused by:
build failed

Cargo version:

cargo 1.46.0

Can not Execute Binary File

I am using preinstalled version. I have chrome installed too but when i try to execute ppfuzz from /usr/local/bin it says binary not executable and when it is placed somewhere else it says command not found. I have also tried chmod +x ppfuzz command but still same error.

error: failed to run custom build command for `chromiumoxide_cdp v0.3.0`

Hello folks,

How i can fix this issue?
Regards :)

error: failed to run custom build command for `chromiumoxide_cdp v0.3.0` Caused by: process didn't exit successfully: `/home/imrannaz/ppfuzz/target/release/build/chromiumoxide_cdp-425bf18a73ff6576/build-script-build` (exit code: 1) --- stderr error running rustfmt: Os { code: 2, kind: NotFound, message: "No such file or directory" } warning: build failed, waiting for other jobs to finish... error: build failed

hi
i got this is error how to fix it

RUSTSEC-2024-0320: yaml-rust is unmaintained.

yaml-rust is unmaintained.

Details
Status	unmaintained
Package	yaml-rust
Version	0.4.5
URL	rustsec/advisory-db#1921
Date	2024-03-20

The maintainer seems unreachable.

Many issues and pull requests have been submitted over the years
without any response.

Alternatives

Consider switching to the actively maintained yaml-rust2 fork of the original project:

• yaml-rust2
• yaml-rust2 @ crates.io)

See advisory page for additional details.

unresolved imports

unresolved imports clap::crate_authors, clap::crate_description, clap::crate_name, clap::crate_version
--> src/parser.rs:5:3
|
5 | crate_authors,
| ^^^^^^^^^^^^^ no crate_authors in the root
6 | crate_description,
| ^^^^^^^^^^^^^^^^^ no crate_description in the root
7 | crate_name,
| ^^^^^^^^^^ no crate_name in the root
8 | crate_version,
| ^^^^^^^^^^^^^ no crate_version in the root

error: cannot determine resolution for the macro crate_name
--> src/parser.rs:30:4
|
30 | crate_name!(), "FILE", "[OPTIONS]"
| ^^^^^^^^^^
|
= note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_authors
--> src/parser.rs:33:12
|
33 | .author(crate_authors!())
| ^^^^^^^^^^^^^
|
= note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_description
--> src/parser.rs:34:11
|
34 | .about(crate_description!())
| ^^^^^^^^^^^^^^^^^
|
= note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_name
--> src/parser.rs:35:10
|
35 | .name(crate_name!())
| ^^^^^^^^^^
|
= note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_version
--> src/parser.rs:36:13
|
36 | .version(crate_version!())
| ^^^^^^^^^^^^^
|
= note: import resolution is stuck, try simplifying macro imports

warning: use of deprecated macro load_yaml: Deprecated in Issue #3087, maybe clap::Parser would fit your use case?
--> src/parser.rs:27:14
|
27 | let yaml = load_yaml!("cli.yaml");
| ^^^^^^^^^
|
= note: #[warn(deprecated)] on by default

warning: use of deprecated macro clap::load_yaml: Deprecated in Issue #3087, maybe clap::Parser would fit your use case?
--> src/parser.rs:9:3
|
9 | load_yaml,
| ^^^^^^^^^

error[E0308]: mismatched types
--> src/parser.rs:32:23
|
32 | let app = App::from(yaml)
| ^^^^ expected struct App, found &yaml_rust::yaml::Yaml

Some errors have detailed explanations: E0308, E0432.
For more information about an error, try rustc --explain E0308.
warning: ppfuzz (lib) generated 2 warnings
error: could not compile ppfuzz due to 7 previous errors; 2 warnings emitted

Unable to launch browser:

ppfuzz -l list.txt

---

| x | x | / _..___
| | | | | |/ // /
|| || ||`//_/

Prototype Pollution Fuzzer
@dwisiswant0

[ERRO] Unable to launch browser: Request timed out..
[INFO] Use '-h' flag for more info about command.

fix

Nuclei templates not work

Add fingerprinting script gadgets

Set extra HTTP headers for request

The script does not runs in wsl or wsl2

I was thinking of using this tool but this does not works in wsl and wsl2

value: Timeout

Can you help me to fix this error
Thanks

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Timeout', /root/.cargo/registry/src/github.com-1ecc6299db9ec823/ppfuzz-0.0.1/src/browser.rs:23:10
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

RUSTSEC-2023-0065: Tungstenite allows remote attackers to cause a denial of service

Tungstenite allows remote attackers to cause a denial of service

Details
Package	tungstenite
Version	0.17.3
URL	snapview/tungstenite-rs#376
Date	2023-09-25
Patched versions	>=0.20.1

The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause
a denial of service (minutes of CPU consumption) via an excessive length of an
HTTP header in a client handshake. The length affects both how many times a parse
is attempted (e.g., thousands of times) and the average amount of data for each
parse attempt (e.g., millions of bytes).

See advisory page for additional details.

Chromium

Chromium still running in the background after ppfuzz's scanning which ate the ram.

[Enhancement] Latest version download automation

Hi,
first of all I need to thank you for your effort made on this awesome tool.

Can you please delete the version number from the compiled binaries names?
We, in reconftw, trying to automate the installation of tools but if the binaries for every new version will have a different name, that's will complicate installing the latest version of ppfuzz.

for exemple the names can be as below:

ppfuzz-aarch64
ppfuzz-armv7
ppfuzz-linux
ppfuzz-linux-i386
ppfuzz-osx
ppfuzz-windows.exe

Otherwise, we need to update the installation script for every new ppfuzz version.
thanks in advnce
Bilel Eljaamii

Outdated version in cargo

Only ppfuzz 1.0.1 is available in cargo, while latest version being 1.0.2

Error while building the resources

Hello. I used the command cargo build --release for building the resources after cloning it in my directory. Everything went fine till nearly 175 resources, later I am getting the following error

problem install on macbookpro m1

`cargo build --release

Compiling ppfuzz v1.0.1 (/Users/azhariramadhan/Documents/pentest-tools/reconftw/ppfuzz)
error[E0432]: unresolved imports clap::crate_authors, clap::crate_description, clap::crate_name, clap::crate_version
--> src/parser.rs:5:3
|
5 | crate_authors,
| ^^^^^^^^^^^^^ no crate_authors in the root
6 | crate_description,
| ^^^^^^^^^^^^^^^^^ no crate_description in the root
7 | crate_name,
| ^^^^^^^^^^ no crate_name in the root
8 | crate_version,
| ^^^^^^^^^^^^^ no crate_version in the root

error: cannot determine resolution for the macro crate_name
--> src/parser.rs:30:4
|
30 | crate_name!(), "FILE", "[OPTIONS]"
| ^^^^^^^^^^
|
= note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_authors
--> src/parser.rs:33:12
|
33 | .author(crate_authors!())
| ^^^^^^^^^^^^^
|
= note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_description
--> src/parser.rs:34:11
|
34 | .about(crate_description!())
| ^^^^^^^^^^^^^^^^^
|
= note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_name
--> src/parser.rs:35:10
|
35 | .name(crate_name!())
| ^^^^^^^^^^
|
= note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_version
--> src/parser.rs:36:13
|
36 | .version(crate_version!())
| ^^^^^^^^^^^^^
|
= note: import resolution is stuck, try simplifying macro imports

error[E0308]: mismatched types
--> src/parser.rs:32:23
|
32 | let app = App::from(yaml)
| --------- ^^^^ expected struct App, found &yaml_rust::yaml::Yaml
| |
| arguments to this function are incorrect
|
note: associated function defined here

Some errors have detailed explanations: E0308, E0432.
For more information about an error, try rustc --explain E0308.
error: could not compile ppfuzz due to 7 previous errors
`

Use rustfmt to format code

Use https://github.com/rust-lang/rustfmt to format the code

[enhancement] add option

Please add -silent or -s option and only VULN or INFO should be the output.