This script, `ffuf_basicauth.sh`, is a shell script designed to generate...

This script, ffuf_basicauth.sh, is a shell script designed to generate Base64-encoded combinations of HTTP Basic Authentication credentials from two input wordlists: one for usernames and another for passwords. Here's what it does:

High-Level Overview

• Inputs: The script takes two input files — a list of usernames and a list of passwords.
• Outputs: It produces Base64-encoded username:password combinations for HTTP Basic Authentication, which can be passed to other tools like ffuf.

Detailed Breakdown

1. Shebang: The script starts with #!/bin/sh, indicating it should be executed in a POSIX-compliant shell.

2. Argument Verification:

   • It ensures that exactly two arguments are provided (usernames.txt and passwords.txt).
   • If invalid usage is detected, it prints a usage message and exits.

3. File Existence Check:

   • The script verifies the existence of the provided username and password files. If one or both files are missing, an error message is printed.

4. Wordlist Sizes:

   • It calculates the number of lines (entries) in the username file (USERNAME_WORDLIST_SIZE) and the password file (PASSWORD_WORDLIST_SIZE) using wc -l.
   • The script then calculates the total number of possible combinations of usernames and passwords (OUTPUT_WORDLIST_SIZE = usernames × passwords).

5. User Feedback:

   • Before starting the generation process, the script prints the number of entries in both wordlists and the total number of combinations that will be generated.

6. Credential Combination Generation:

   • For each username in the username file:
     • For each password in the password file:
       • It prints a Base64-encoded username:password string. The encoding is done using the base64 utility in a UNIX-like fashion.

7. Usage Example:

   • The script is intended to be paired with tools like ffuf. For instance, the example shows how these Base64 credentials can be used by ffuf to test HTTP endpoints:

     ./ffuf_basicauth.sh usernames.txt passwords.txt | ffuf -w -:AUTH \
     -u https://example.org/endpoint -H "Authorization: Basic AUTH" -fc 403
     

     • Here:
       • The script generates Base64 strings to be used in HTTP Basic Authentication.
       • These strings are passed as input to ffuf to test the endpoint https://example.org/endpoint.

Key Features

• Base64 Encoding: Essential for HTTP Basic Authentication, as it requires credentials to be sent in the format Authorization: Basic <Base64(username:password)>.
• Dynamic Calculation: Automatically calculates the size of input files and provides feedback on the progress.
• Tool Integration: Designed for use in conjunction with tools like ffuf for automated testing workflows, such as brute-forcing protected endpoints.

Example Input and Output

Inputs:

• usernames.txt:

  admin
  user
  guest
  

• passwords.txt:

  password123
  admin123
  guest
  

Output:

The script will output Base64-encoded combinations of username:password, one per line:

YWRtaW46cGFzc3dvcmQxMjM=
YWRtaW46YWRtaW4xMjM=
YWRtaW46Z3Vlc3Q=
dXNlcjpzd29yZDEyMw==
dXNlcjpzdWVyMTIz==
[....]

This output can then be fed into testing tools to validate HTTP Basic Authentication credentials.