Merge pull request #258 from kingthorin/rand-fuzz

feat: Add SecureRandom fuzz payload generator JS script

Author: psiinon

CHANGELOG.md

@@ -7,6 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ### Added
 - variant/CompoundCookies.js - An input vector script that handles splitting of compound cookies (Issue 6582).
 - active/corsair.py > An active scan script to check for CORS related issues.)
+- payloadgenerator/securerandom.js > A fuzzer payload generator script that uses Java's SecureRandom as it's source (related to issue 6892).
 
 ## [13] - 2021-10-14
 ### Fixed

payloadgenerator/securerandom.js

@@ -0,0 +1,31 @@
+// Auxiliary variables/constants for payload generation.
+var SecureRandom = Java.type("java.security.SecureRandom");
+var random = new SecureRandom();
+var NUMBER_OF_PAYLOADS = 10;
+var INITIAL_VALUE = 1;
+var count = INITIAL_VALUE;
+
+function getNumberOfPayloads() {
+	return NUMBER_OF_PAYLOADS;
+}
+
+function hasNext() {
+	return (count <= NUMBER_OF_PAYLOADS);
+}
+
+function next() {
+	count++;
+	// There are other data type options offered by SecureRandom
+	// https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/security/SecureRandom.html
+	// If you don't want leading negative signs on ints you could use Math.abs
+	// If you want to pad to a certain length you could do something like:
+	// String.format("%010d", random.nextint());'
+	return random.nextInt();
+}
+
+function reset() {
+	count = INITIAL_VALUE;
+}
+
+function close() {
+}