def start(pidfile,username=None):
log("starting daemon")
if pidfile is None:
pidfile = DEFAULT_PID_FILE
pid = get_pid(pidfile)
if pid != 0 and pid_exists(pid):
log("daemon pid %d is already running" % pid)
sys.exit(1)
pid = os.fork()
if pid:
log("daemon pid %d started" % pid)
set_pid(pidfile,pid)
if username:
import pwd
try:
uid = pwd.getpwnam(username)[2]
os.chown(pidfile,uid,-1)
except KeyError:
log("can't find user")
sys.exit(1)
sys.exit(0)
else:
try:
sys.stdout = open("/dev/null", "w+")
except Exception:
pass
os.setsid()
if username:
import pwd
try:
uid = pwd.getpwnam(username)[2]
os.setuid(uid)
except KeyError:
log("can't find user")
sys.exit(1)
def stop(pidfile, exit=True):
log("stopping daemon")
result = True
if pidfile is None:
pidfile = DEFAULT_PID_FILE
pid = get_pid(pidfile)
if pid != 0:
try:
os.kill(pid, signal.SIGINT)
os.remove(pidfile)
import time
for i in xrange(0, 10):
time.sleep(0.1)
if not pid_exists(pid):
break
if pid_exists(pid):
log("failed to stop timeout")
result = False
else:
log("daemon pid %d stopped" % pid)
except OSError:
log("failed to stop daemon")
result = False
else:
log("can't find daemon pid file")
result = False
if exit:
if result:
sys.exit(0)
else:
sys.exit(1)
else:
return result
def stop(pidfile, exit=True):
log("stopping daemon")
result = True
if pidfile is None:
pidfile = DEFAULT_PID_FILE
pid = get_pid(pidfile)
if pid != 0:
try:
os.kill(pid, signal.SIGINT)
os.remove(pidfile)
import time
for i in xrange(0,10):
time.sleep(0.1)
if not pid_exists(pid):
break
if pid_exists(pid):
log("failed to stop timeout")
result = False
else:
log("daemon pid %d stopped" % pid)
except OSError:
log("failed to stop daemon")
result = False
else:
log("can't find daemon pid file")
result = False
if exit:
if result:
sys.exit(0)
else:
sys.exit(1)
else:
return result
def start(pidfile, username=None):
log("starting daemon")
if pidfile is None:
pidfile = DEFAULT_PID_FILE
pid = get_pid(pidfile)
if pid != 0 and pid_exists(pid):
log("daemon pid %d is already running" % pid)
sys.exit(1)
pid = os.fork()
if pid:
log("daemon pid %d started" % pid)
set_pid(pidfile, pid)
if username:
import pwd
try:
uid = pwd.getpwnam(username)[2]
os.chown(pidfile, uid, -1)
except KeyError:
log("can't find user")
sys.exit(1)
sys.exit(0)
else:
try:
sys.stdout = open("/dev/null", "w+")
except Exception:
pass
os.setsid()
if username:
import pwd
try:
uid = pwd.getpwnam(username)[2]
os.setuid(uid)
except KeyError:
log("can't find user")
sys.exit(1)
def sig_handler(signum, frame):
from core.utils import log
log("exiting")
global controller
controller.stop()
webui.app.stop()
log("exited")
core.utils.close_log()
sys.exit(0)
def sig_handler(signum, frame):
from core.utils import log
log("exiting")
global controller
controller.stop()
webui.app.stop()
log("exited")
core.utils.close_log()
sys.exit(0)
def narrower(oldParamList, url, include, headers, GET, delay, originalResponse, originalCode, reflections, factors, threadCount):
newParamList = []
threadpool = concurrent.futures.ThreadPoolExecutor(max_workers=threadCount)
futures = (threadpool.submit(quickBruter, part, originalResponse, originalCode, reflections, factors, include, delay, headers, url, GET) for part in oldParamList)
for i, result in enumerate(concurrent.futures.as_completed(futures)):
if result.result():
newParamList.extend(slicer(result.result()))
log('%s Processing: %i/%-6i' % (info, i + 1, len(oldParamList)), mode='run')
return newParamList
def create_connection(addr):
host, port = addr
# Attempt connection to server
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((host, port))
return sock
except (ValueError, OSError):
log("Could not make a connection to the server\nQuitting")
sys.exit(0)
def run_server():
# Get host and port
host = settings.SERVER_HOST
port = settings.SERVER_PORT
# Create new server socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((host, port))
log("Server started on host %s and port %s" % (host, port))
sock.listen(5)
new_connections(sock)
def set_pid(pidfile,pid=os.getpid()):
f = None
try:
f = open(pidfile, 'w')
f.write(str(pid))
os.chmod(pidfile, 0600)
except IOError:
log("can't write pid file")
finally:
if f:
f.close()
def set_pid(pidfile, pid=os.getpid()):
f = None
try:
f = open(pidfile, 'w')
f.write(str(pid))
os.chmod(pidfile, 0600)
except IOError:
log("can't write pid file")
finally:
if f:
f.close()
def new_connections(sock):
try:
while True:
c_sock, address = sock.accept()
global total_connections
connections.append(
Client(c_sock, address, total_connections, "Name", True))
connections[len(connections) - 1].start()
log("New connection at ID " +
str(connections[len(connections) - 1]))
total_connections += 1
except (KeyboardInterrupt, EOFError):
pass
def check_data(self):
log("Client %s: '%s' bits received" % (str(self.id), self.frames), 2)
dec_data = server_physical(self.frames)
log("Client %s: '%s' bits decoded" % (str(self.id), dec_data), 2)
de_frame_data = server_dll(dec_data)
if de_frame_data != "":
err_msg = "No error found."
self.display("Decoded data from client: " + de_frame_data)
else:
err_msg = "Error in data."
self.reset_data()
return err_msg
def heuristic(response, paramList):
done = []
forms = re.findall(r'(?i)(?s)<form.*?</form.*?>', response)
for form in forms:
method = re.search(r'(?i)method=[\'"](.*?)[\'"]', form)
inputs = re.findall(r'(?i)(?s)<input.*?>', response)
for inp in inputs:
inpName = re.search(r'(?i)name=[\'"](.*?)[\'"]', inp)
if inpName:
inpType = re.search(r'(?i)type=[\'"](.*?)[\'"]', inp)
inpValue = re.search(r'(?i)value=[\'"](.*?)[\'"]', inp)
inpName = d(e(inpName.group(1)))
if inpName not in done:
if inpName in paramList:
paramList.remove(inpName)
done.append(inpName)
paramList.insert(0, inpName)
log('%s Heuristic found a potential parameter: %s%s%s' % (good, green, inpName, end))
log('%s Prioritizing it' % good)
def zap():
root_url = var['root_url']
# Makes request to robots.txt
response = requester(root_url + '/robots.txt', crawl=False)
# Making sure robots.txt isn't some fancy 404 page
if response and '<body' not in response.text:
# If you know it, you know it
disallowed_list = re.search(
r'User-agent: \*[.\s\S]*?(?:Sitemap:|User-agent:|$)',
response.text)
if disallowed_list:
matches = re.finditer(r'(?m)^Disallow:\s+(.*?)$',
disallowed_list.group(0))
for match in matches:
match = match.group(1)
if match != '/':
url = root_url + match.replace('?', '\?').replace(
'*', '[^/]*?')
# Add the URL to robots list
result['urls']['disallowed'].add(url)
result['urls']['disallowed'] = list(result['urls']['disallowed'])
if result['urls']['disallowed']:
print('^' + '|^'.join(result['urls']['disallowed']))
var['exclude'] = re.compile('^' +
'|^'.join(result['urls']['disallowed']))
sitemaps = set([root_url + '/sitemap.xml'])
matches = re.finditer(r'Sitemap: (.*?)$', response.text)
if matches:
for match in matches:
sitemaps.append(handle_anchor(root_url, match.group(1)))
for sitemap in sitemaps:
response = requester(sitemap, crawl=False)
# Making sure it isn't some fancy 404 page
if response and '<body' not in response.text:
matches = raw_urls(response.text)
if matches: # if there are any matches
print('%s URLs retrieved from %s: %i' %
(good, sitemap, len(matches)))
for match in matches:
log('Internal page', match)
# Cleaning up the URL and adding it to the internal list for
# crawling
result['urls']['internal'].add(match)
def run(self):
while self.signal:
try:
if self.socket.sendall(b'11111111') == 0:
raise ConnectionResetError
while True:
try:
chunk = self.socket.recv(2048)
except OSError:
break
frame = bytes2str(chunk)
self.frames += str(frame)
if self.frames == "":
continue
err_msg = self.check_data()
self.display(err_msg)
self.return_data(err_msg)
except (ConnectionResetError, BrokenPipeError):
log("Client " + str(self.address) + " has disconnected")
self.signal = False
self.socket.close()
connections.remove(self)
break
def decode(self):
zeroes = "0" * (len(self.key) - 1)
log("Decoding data...", 4)
log("Data: %s" % self.data, 4)
log("Remainder: %s" % self.remainder, 3)
if self.remainder == zeroes:
return self.data[:-(len(self.key) - 1)]
else:
return ""
def run_client():
host = settings.SERVER_HOST
port = settings.SERVER_PORT
sock = create_connection((host, port))
# Send data to server
try:
while True:
# Input data to send
orig_data = input("Enter data you want to send: ")
# Convert data to list of frames
enc_frames = client_dll(orig_data)
log("Frames to be send: ", 2, end="")
log(enc_frames, 2)
# Implement coding scheme to each frame
coded_frames = client_physical(enc_frames)
log("Encoded frames: ", 2, end="")
log(coded_frames, 2)
# Send number of frames
# num_of_frames = str(len(enc_frames))
# encode_num_of_frames = client_dll(num_of_frames)[0]
# sock.sendall(str2bytes(encode_num_of_frames))
# Send the frames
for frame in coded_frames:
sock.sendall(str2bytes(frame))
# receive data from the server
# recv_data = sock.recv(settings.PACKET_SIZE)
# print(("Received message from the server: " + bytes2str(recv_data)))
except (KeyboardInterrupt, EOFError):
sock.close()
print()
sys.exit(0)
def initialize(url, include, headers, GET, delay, paramList, threadCount):
url = stabilize(url)
log('%s Analysing the content of the webpage' % run)
firstResponse = requester(url, include, headers, GET, delay)
log('%s Analysing behaviour for a non-existent parameter' % run)
originalFuzz = randomString(6)
data = {originalFuzz : originalFuzz[::-1]}
data.update(include)
response = requester(url, data, headers, GET, delay)
reflections = response.text.count(originalFuzz[::-1])
log('%s Reflections: %s%i%s' % (info, green, reflections, end))
originalResponse = response.text
originalCode = response.status_code
log('%s Response Code: %s%i%s' % (info, green, originalCode, end))
newLength = len(response.text)
plainText = removeTags(originalResponse)
plainTextLength = len(plainText)
log('%s Content Length: %s%i%s' % (info, green, newLength, end))
log('%s Plain-text Length: %s%i%s' % (info, green, plainTextLength, end))
factors = {'sameHTML': False, 'samePlainText': False}
if len(firstResponse.text) == len(originalResponse):
factors['sameHTML'] = True
elif len(removeTags(firstResponse.text)) == len(plainText):
factors['samePlainText'] = True
log('%s Parsing webpage for potential parameters' % run)
heuristic(firstResponse.text, paramList)
fuzz = randomString(8)
data = {fuzz : fuzz[::-1]}
data.update(include)
log('%s Performing heuristic level checks' % run)
toBeChecked = slicer(paramList, 50)
foundParams = []
while True:
toBeChecked = narrower(toBeChecked, url, include, headers, GET, delay, originalResponse, originalCode, reflections, factors, threadCount)
toBeChecked = unityExtracter(toBeChecked, foundParams)
if not toBeChecked:
break
if foundParams:
log('%s Heuristic found %i potential parameters.' % (info, len(foundParams)))
paramList = foundParams
finalResult = []
jsonResult = []
threadpool = concurrent.futures.ThreadPoolExecutor(max_workers=threadCount)
futures = (threadpool.submit(bruter, param, originalResponse, originalCode, factors, include, reflections, delay, headers, url, GET) for param in foundParams)
for i, result in enumerate(concurrent.futures.as_completed(futures)):
if result.result():
finalResult.append(result.result())
log('%s Progress: %i/%i' % (info, i + 1, len(paramList)), mode='run')
log('%s Scan Completed ' % info)
for each in finalResult:
for param, reason in each.items():
log('%s Valid parameter found: %s%s%s' % (good, green, param, end))
log('%s Reason: %s' % (info, reason))
jsonResult.append({"param": param, "reason": reason})
if not jsonResult:
log('%s Unable to verify existence of parameters detected by heuristic' % bad)
return jsonResult
headers['Content-type'] = 'application/json'
if args.GET:
GET = True
else:
GET = False
include = getParams(include)
paramList = []
try:
with open(wordlist, 'r') as file:
for line in file:
paramList.append(line.strip('\n'))
except FileNotFoundError:
log('%s The specified file for parameters doesn\'t exist' % bad)
quit()
urls = []
if url_file:
try:
with open(url_file, 'r') as file:
for line in file:
urls.append(line.strip('\n'))
except FileNotFoundError:
log('%s The specified file for URLs doesn\'t exist' % bad)
quit()
if not url and not url_file:
log('%s No URL specified.' % bad)
def display(self, msg):
log("Client " + str(self.id) + ": " + msg)
def encode(self):
log("Encoding data...", 4)
log("Data: %s" % self.data, 4)
log("Remainder: %s" % self.remainder, 3)
return self.data + self.remainder
