REcollapse Documentation

REcollapse uses numeric modes to define where and how to apply fuzzing to the input string:

1. Starting: Fuzz the beginning of the input (e.g., $input).
2. Separator: Fuzz before and after special characters (e.g., this$_$is$.$an$_$example).
3. Normalization: Replace bytes according to the normalization table.
4. Termination: Fuzz the end of the input (e.g., input$).
5. Regex Metacharacters: Replace regex metacharacters: .^$*+-?()[]{}\|.
6. Case Folding: Replace bytes according to the case table (upper/lower).
7. Byte Truncation: Replace bytes according to the truncation table.

Choose an encoding mode based on the target application's content type:

1. URL-encoded (-e 1): For application/x-www-form-urlencoded or query/body parameters (e.g., %22input).
2. Unicode (-e 2): For application/json (e.g., \u0022input).
3. Raw (-e 3): For multipart/form-data (e.g., "input).
4. Double URL-encoded (-e 4).

REcollapse is a helper tool for black-box regex fuzzing. It generates payloads that can be used with other fuzzing tools like ffuf, Burp, or Caido.

Basic Syntax: recollapse [options] [input]

Common Usage Patterns:

• Fuzzing a URL: recollapse -e 1 -m 1,2,4 -r 10-11 https://legit.example.com
• Piping input: echo "a@b.com" | recollapse
• Integration with ffuf: Pipe the output of recollapse directly into ffuf using the -w - flag to use stdin as a wordlist.

echo "<svg/onload=alert(1)>" | recollapse | ffuf -w - -u "https://example.com/?param=FUZZ" -mc 200,403,500

$ recollapse -e 1 -m 1,2,4 -r 10-11 https://legit.example.com

You can install REcollapse via pip3 or by building from source. It requires Python 3.

Via pip:

pip3 install recollapse

Via source:

python3 setup.py install
# or
pip3 install .

Via Docker:

docker build -t recollapse .
# or
docker pull 0xacb/recollapse

The modes parameter controls which fuzzing strategies are applied. Use the following constants:

• MODE_START (1): Inject bytes at the start of the input.
• MODE_SEP (2): Inject bytes at punctuation separators.
• MODE_NORM (3): Replace characters with their normalization equivalents.
• MODE_TERM (4): Inject bytes at the end of the input.
• MODE_RE_META (5): Replace regex metacharacters (.^$*+-?()[]{}\|) with fuzzing bytes.
• MODE_CASE (6): Replace characters with their case-variant equivalents.
• MODE_TRUNC (7): Replace characters with their truncation equivalents.

MODES_ALL is a predefined list containing all available modes.

The encoding parameter determines how the injected bytes are represented in the output string. Use these constants:

• ENCODING_RAW (3): Injects the raw character representation.
• ENCODING_URL (1): Injects bytes as URL-encoded hex strings (e.g., %ff).
• ENCODING_UNICODE (2): Injects bytes as Unicode escape sequences (e.g., \u00ff).
• ENCODING_DOUBLE_URL (4): Injects bytes using double URL encoding.

You can export the internal normalization, truncation, or case tables to HTML files for easier viewing.

$ recollapse -nt --html > normalization_table.html
$ recollapse -tt --html > truncation_table.html
$ recollapse -ct --html > case_table.html

You can import Recollapse to generate variants programmatically within your Python scripts.

from recollapse import Recollapse

recollapse = Recollapse(modes=Recollapse.DEFAULT_MODES,
                        encoding=Recollapse.ENCODING_RAW)
variants = recollapse.generate("<script")
for variant in variants:
    print(variant)