From 0efe183857413f56c3fb9387c77e6db31910ffac Mon Sep 17 00:00:00 2001
From: Rick M <kingthorin@users.noreply.github.com>
Date: Sat, 30 Oct 2021 21:12:28 -0400
Subject: [PATCH] feat: Add SecureRandom fuzz payload generator JS script

- payloadgenerator/securerandom.js > New payload generator script which
uses SecureRandom.
- CHANGELOG.md > Added note.

Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>
---
 CHANGELOG.md                     |  1 +
 payloadgenerator/securerandom.js | 31 +++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 payloadgenerator/securerandom.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f0f7eb5e..05a282e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ### Added
 - variant/CompoundCookies.js - An input vector script that handles splitting of compound cookies (Issue 6582).
 - active/corsair.py > An active scan script to check for CORS related issues.)
+- payloadgenerator/securerandom.js > A fuzzer payload generator script that uses Java's SecureRandom as it's source (related to issue 6892).
 
 ## [13] - 2021-10-14
 ### Fixed
diff --git a/payloadgenerator/securerandom.js b/payloadgenerator/securerandom.js
new file mode 100644
index 00000000..4d200da5
--- /dev/null
+++ b/payloadgenerator/securerandom.js
@@ -0,0 +1,31 @@
+// Auxiliary variables/constants for payload generation.
+var SecureRandom = Java.type("java.security.SecureRandom");
+var random = new SecureRandom();
+var NUMBER_OF_PAYLOADS = 10;
+var INITIAL_VALUE = 1;
+var count = INITIAL_VALUE;
+
+function getNumberOfPayloads() {
+	return NUMBER_OF_PAYLOADS;
+}
+
+function hasNext() {
+	return (count <= NUMBER_OF_PAYLOADS);
+}
+
+function next() {
+	count++;
+	// There are other data type options offered by SecureRandom
+	// https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/security/SecureRandom.html
+	// If you don't want leading negative signs on ints you could use Math.abs
+	// If you want to pad to a certain length you could do something like:
+	// String.format("%010d", random.nextint());'
+	return random.nextInt();
+}
+
+function reset() {
+	count = INITIAL_VALUE;
+}
+
+function close() {
+}