KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#typescript #ai-agents #developer-tools #codex #claude-code #cli #react #mcp #open-source #deepseek-harness #dsh-plugin #ai

sputr

★ 86 Open GitHub ↗

Security Payload Unit Test Repository (SPUTR)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Security Payload Unit Test Repository (SPUTR)
---
A repository of payloads for security unit/integration testing.

Quickstart
--
1- sputr.py -h

Layout
--
* /
* sputr.py           # Go here for everything
* ../payloads/       # Different payload sets
* ../exploit_chars/  # Used by generate_payloads, interesting characters by vulnerability
* ../libs/           # language/framework libraries for including in unit tests.

config.json
---
To generate and start tests, need to build a config.json file. There are a few required json parameters if you building it by hand.

Required Configuration Details
---
The following example configuration tests one endpoint for XSS, each of the the main json objects are required by SPUTR (token, creds, csrf, domain, endpoints).

```
{
        "token":{
                        "name":"session_cookie", "value":""
        },
        "creds":{
                        "username":{ "name":"username", "value":"seth" },
                        "password":{ "name":"password", "password":"soccerlover" }
        },
        "csrf":{
                "pattern":"\\w{32}",
                "name":"csrfmiddlewaretoken",
                "login_url":"http://localhost:8000/taskManager/login/",
                "auth_url":"http://localhost:8000/taskManager/project_list/"
        },
        "domain":{
                        "host":"localhost:8000",
                        "protocol":"http://",
                        "login_url":"http://localhost:8000/taskManager/login/",
                        "auth_url":"http://localhost:8000/taskManager/project_list/"
        },
        "endpoints":[
                        { "path":"/taskManager/search/",
                	  "method":"GET",
                          "auth":1,
                          "params":{ "q":"item" },
                          "tests":"01000" }
        ]
}
```

JSON Objects
---
* token: session token that must be tracked for authentication
* creds: credentials for accessing the application during testing
* csrf: csrf token to track for requests
* domain: application connection information, including login_url for authenticaiton and auth_url for authentication test
* endpoints: each of the different locations and tests to run
* tests: inside endpoints, determines what tests to run on each endpoint (currently 5)
  * 10000 == SQL Injection (SQLi)
  * 01000 == Cross-Site Scripting (XSS)
  * 00100 == Insecure Direct Object Reference (IDOR)
  * 00010 == Cross-Site Request Forgery (CSRF)
  * 00001 == Missing Function Level Access Control (MFLAC)

sputr

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README