def hashspider(url, log_path): urls = [url] visited = [url] #print log_path while len(urls) > 0: sys.stdout.flush() try: htmltext = requests.get(urls[0]).text urlhash = func.md5(htmltext[10:600]) csvfiler = file(log_path + 'webhash.csv', 'rb') reader = csv.reader(csvfiler) exists = False # exists or not? for line in reader: if urls[0] == line[0]: exists = True if urlhash != line[1]: print line, 'has been tampered!', urlhash exit() else: pass csvfiler.close() if exists == False: # Not exists, so it should be written into the log file. with open(log_path + 'webhash.csv', 'ab+') as csvfile: spamwriter = csv.writer(csvfile, dialect='excel') spamwriter.writerow([urls[0], urlhash]) csvfile.close() print urls[0], '[Good]' except: print urls[0], '[Bad]' soup = BeautifulSoup(htmltext, "html.parser") urls.pop(0) print len(urls), for tag in soup.findAll('a', href = True): tag['href'] = urlparse.urljoin(url, tag['href']) if url in tag['href'] and tag['href'] not in visited and "#" not in tag['href']: # While in the sanme domin urls.append(tag['href']) visited.append(tag['href'])
def requests(self,post={},get={}): global conf access = False self.send_response(200) self.head.write("<head>") self.body.write("<body>") lite = func.sql_connect(conf['db_path']) if 'uName' in post and 'uPass' in post: # holt User anhand des usernamens ipaddr = func.no_inject(self.client_address[0]) blocktime = func.timestamp(conf['ipblock']) log = func.sql(lite,"SELECT timecode FROM log WHERE ipAddr = '%s' AND answere = 'X' AND timecode > '%s'" % (ipaddr,blocktime)) print(log) if(len(log) < 3): que = "SELECT uPass, uSalt, uID FROM users WHERE uName LIKE '%s'" % post["uName"][0] data = func.sql(lite,que) if len(data) == 1: # Prüft ob Passwort stimmt nMD5 = "%s%s" % (post["uPass"][0],data[0][1]) if func.md5(nMD5) == data[0][0]: # erstelle neues uSalt und uPass uSalt = func.random(75) nMD5 = "%s%s" % (post["uPass"][0],uSalt) uPass = func.md5(nMD5) session = func.random(32) expire = func.timestamp(conf['expire']) que = "UPDATE users SET uSalt = '%s',uPass='******',uSession='%s',expire='%s'" % (uSalt,uPass,session,expire) if func.sql(lite,que): # db update erfolgreich session = session access = True else: # update fehlgeschlagen self.body.write('''<p>Schreiben in DB Fehlgeschlagen</p>''') else: # Passwort stimmt nicht self.body.write('''<p>Passwort nicht Korrekt</p>''') dellog = func.timestamp(conf['dellog']) now = func.timestamp() func.sql(lite,"DELETE FROM log WHERE timecode < '%s';" % dellog) func.sql(lite,"INSERT INTO log (tokenID, answere, timecode, ipAddr) VALUES ('fffffffffffffffffffffffffffffffff','X','%s','%s')" % (now,ipaddr)); else: #user existiert nicht self.body.write('''<p>User nicht Korrekt</p>''') dellog = func.timestamp(conf['dellog']) now = func.timestamp() func.sql(lite,"DELETE FROM log WHERE timecode < '%s';" % dellog) func.sql(lite,"INSERT INTO log (tokenID, answere, timecode, ipAddr) VALUES ('fffffffffffffffffffffffffffffffff','X','%s','%s')" % (now,ipaddr)); else: #ip gesperrt self.body.write('''<p>Die IP-Adresse wurde gesperrt</p>''') else: #token prüfen und gleich expire erneuern print(get) if 's' in get: if "logout" in get: expire = '0000-00-00- 00:00:00' else: expire = func.timestamp(conf['expire']) now = func.timestamp() session = func.no_inject(get['s']) que = "UPDATE users SET expire='%s' WHERE uSession = '%s'" % (expire,session) print(que) if func.sql(lite,que): if "logout" in get: self.body.write('''<p>Session beendet.</p>''') access = False else: access = True else: # Token abgelaufen self.body.write('''<p>Session abgelaufen</p>''') else: # Token nicht existent self.body.write('''<p>Keine Session gefunden</p>''') #TODO pass # Content if access == True: # hier kommt alles rein was nur erreichbar ist, wenn man angemeldet ist # Navigation navi = '''<a href="/stats/index/s/%s">Statistik</a> <a href="/user/list/s/%s">Userliste</a> <a href="/user/create/s/%s">User erstellen</a> <a href="/logout/index/s/%s">Logout</a> <hr/>''' % (session,session,session,session) self.body.write(navi) if 'user' in get: if get["user"] == '': get["user"] = '******' if get["user"] == 'create': if "submit" in post: #TODO pass else: content = '''<form action="/user/create/s/%s" method="post">Name<input type="text" name="uName" /><br/>Passwort <input type="password" name="uPass" />(Nur ausfüllen, wenn der user admin zugriff haben soll.)<br/><input type="submit" name="submit" value="Erstellen" /></form>''' % session self.body.write(content) if get["user"] == 'edit': pass #TODO if get["user"] == 'del': pass #TODO if get["user"] == 'detail': pass #TODO if get["user"] == 'list': pass #TODO if "token" in get: #token list gibts in user details schon #token create #token deleter pass if "log" in get: #todo pass else: # hier sieht man nur wenn man abgemeldet ist # Navigation self.body.write(''' <a href="/stats">Statistik</a> <a href="/login">Login</a> <hr/>''') if "login" in get: self.body.write('''<form action="" method="post"> User: <input type="text" name="uName" /><br/> Pass: <input type="password" name="uPass" /></br> <input type="submit" name="submit" value="Login" /> </form>''') #TODO self.body.write('''Abgemeldet''') if "stats" in get: self.body.write("stats chosen"); pass #TODO tmp = urlsplit(self.path) print(tmp.path) if tmp.path == "/favicon.ico": #todo self.send_header('Content-Type','image/ico') self.end_headers() with open('favicon.ico', 'rb') as f: self.wfile.write(f.read()) f.close pass if "style.css" in get: pass #todo #Aufräumen func.sql_close(lite); self.body.write("</body></html>")
def requests(self, post={}, get={}): global conf access = False self.send_response(200) self.head.write("<head>") self.body.write("<body>") lite = func.sql_connect(conf['db_path']) if 'uName' in post and 'uPass' in post: # holt User anhand des usernamens ipaddr = func.no_inject(self.client_address[0]) blocktime = func.timestamp(conf['ipblock']) log = func.sql( lite, "SELECT timecode FROM log WHERE ipAddr = '%s' AND answere = 'X' AND timecode > '%s'" % (ipaddr, blocktime)) print(log) if (len(log) < 3): que = "SELECT uPass, uSalt, uID FROM users WHERE uName LIKE '%s'" % post[ "uName"][0] data = func.sql(lite, que) if len(data) == 1: # Prüft ob Passwort stimmt nMD5 = "%s%s" % (post["uPass"][0], data[0][1]) if func.md5(nMD5) == data[0][0]: # erstelle neues uSalt und uPass uSalt = func.random(75) nMD5 = "%s%s" % (post["uPass"][0], uSalt) uPass = func.md5(nMD5) session = func.random(32) expire = func.timestamp(conf['expire']) que = "UPDATE users SET uSalt = '%s',uPass='******',uSession='%s',expire='%s'" % ( uSalt, uPass, session, expire) if func.sql(lite, que): # db update erfolgreich session = session access = True else: # update fehlgeschlagen self.body.write( '''<p>Schreiben in DB Fehlgeschlagen</p>''') else: # Passwort stimmt nicht self.body.write('''<p>Passwort nicht Korrekt</p>''') dellog = func.timestamp(conf['dellog']) now = func.timestamp() func.sql( lite, "DELETE FROM log WHERE timecode < '%s';" % dellog) func.sql( lite, "INSERT INTO log (tokenID, answere, timecode, ipAddr) VALUES ('fffffffffffffffffffffffffffffffff','X','%s','%s')" % (now, ipaddr)) else: #user existiert nicht self.body.write('''<p>User nicht Korrekt</p>''') dellog = func.timestamp(conf['dellog']) now = func.timestamp() func.sql(lite, "DELETE FROM log WHERE timecode < '%s';" % dellog) func.sql( lite, "INSERT INTO log (tokenID, answere, timecode, ipAddr) VALUES ('fffffffffffffffffffffffffffffffff','X','%s','%s')" % (now, ipaddr)) else: #ip gesperrt self.body.write('''<p>Die IP-Adresse wurde gesperrt</p>''') else: #token prüfen und gleich expire erneuern print(get) if 's' in get: if "logout" in get: expire = '0000-00-00- 00:00:00' else: expire = func.timestamp(conf['expire']) now = func.timestamp() session = func.no_inject(get['s']) que = "UPDATE users SET expire='%s' WHERE uSession = '%s'" % ( expire, session) print(que) if func.sql(lite, que): if "logout" in get: self.body.write('''<p>Session beendet.</p>''') access = False else: access = True else: # Token abgelaufen self.body.write('''<p>Session abgelaufen</p>''') else: # Token nicht existent self.body.write('''<p>Keine Session gefunden</p>''') #TODO pass # Content if access == True: # hier kommt alles rein was nur erreichbar ist, wenn man angemeldet ist # Navigation navi = '''<a href="/stats/index/s/%s">Statistik</a> <a href="/user/list/s/%s">Userliste</a> <a href="/user/create/s/%s">User erstellen</a> <a href="/logout/index/s/%s">Logout</a> <hr/>''' % (session, session, session, session) self.body.write(navi) if 'user' in get: if get["user"] == '': get["user"] = '******' if get["user"] == 'create': if "submit" in post: #TODO pass else: content = '''<form action="/user/create/s/%s" method="post">Name<input type="text" name="uName" /><br/>Passwort <input type="password" name="uPass" />(Nur ausfüllen, wenn der user admin zugriff haben soll.)<br/><input type="submit" name="submit" value="Erstellen" /></form>''' % session self.body.write(content) if get["user"] == 'edit': pass #TODO if get["user"] == 'del': pass #TODO if get["user"] == 'detail': pass #TODO if get["user"] == 'list': pass #TODO if "token" in get: #token list gibts in user details schon #token create #token deleter pass if "log" in get: #todo pass else: # hier sieht man nur wenn man abgemeldet ist # Navigation self.body.write(''' <a href="/stats">Statistik</a> <a href="/login">Login</a> <hr/>''') if "login" in get: self.body.write('''<form action="" method="post"> User: <input type="text" name="uName" /><br/> Pass: <input type="password" name="uPass" /></br> <input type="submit" name="submit" value="Login" /> </form>''') #TODO self.body.write('''Abgemeldet''') if "stats" in get: self.body.write("stats chosen") pass #TODO tmp = urlsplit(self.path) print(tmp.path) if tmp.path == "/favicon.ico": #todo self.send_header('Content-Type', 'image/ico') self.end_headers() with open('favicon.ico', 'rb') as f: self.wfile.write(f.read()) f.close pass if "style.css" in get: pass #todo #Aufräumen func.sql_close(lite) self.body.write("</body></html>")
def requests(self,post={},get={}): global conf html = False access = False self.send_response(200) self.send_header('Content-Type','text/html') self.end_headers() if 'style.css' not in get.keys() and 'favicon.ico' not in get.keys(): html = True self.wfile.write(bytes("<html><head><title>Web-Administration Zuul</title><link href='/style.css' type='text/css' rel='stylesheet'/></head><body>","UTF-8")) lite = func.sql_connect(conf['db_path']) # session erzeugen if bytes('u',"UTF-8") in post.keys() and bytes('p',"UTF-8") in post.keys(): # holt User anhand des usernamens ipaddr = func.no_inject(self.client_address[0]) blocktime = func.timestamp(conf['ipblock']) log = func.sql(lite,"SELECT timecode FROM log WHERE addInfo = '%s' AND answere = 'X' AND timecode > '%s'" % (ipaddr,blocktime)) if(len(log) < 5): que = "SELECT uPass, uSalt, uID FROM users WHERE uName LIKE '%s'" % post[b"u"][0].decode("utf-8") print(que) data = func.sql(lite,que) if len(data) == 1: # Prüft ob Passwort stimmt nMD5 = "%s%s" % (post[b"p"][0].decode("utf-8") ,data[0][1]) if func.md5(nMD5) == data[0][0]: # erstelle neues uSalt und uPass uSalt = func.random(75) nMD5 = "%s%s" % (post[b"p"][0].decode("utf-8") ,uSalt) uPass = func.md5(nMD5) session = func.random(32) expire = func.timestamp(conf['expire']) que = "UPDATE users SET uSalt = '%s',uPass='******',uSession='%s',expire='%s'" % (uSalt,uPass,session,expire) if func.sql(lite,que): # db update erfolgreich session = session access = True else: # update fehlgeschlagen self.wfile.write(bytes('''<p>Schreiben in DB Fehlgeschlagen</p>''',"UTF-8")) else: # Passwort stimmt nicht self.wfile.write(bytes('''<p>Passwort nicht Korrekt</p>''',"UTF-8")) dellog = func.timestamp(conf['dellog']) now = func.timestamp() func.sql(lite,"DELETE FROM log WHERE timecode < '%s';" % dellog) func.sql(lite,"INSERT INTO log (tokenID, answere, timecode, addInfo) VALUES ('fffffffffffffffffffffffffffffffff','X','%s','%s')" % (now,ipaddr)); else: #user existiert nicht self.wfile.write(bytes('''<p>User nicht Korrekt</p>''',"UTF-8")) dellog = func.timestamp(conf['dellog']) now = func.timestamp() func.sql(lite,"DELETE FROM log WHERE timecode < '%s';" % dellog) func.sql(lite,"INSERT INTO log (tokenID, answere, timecode, addInfo) VALUES ('fffffffffffffffffffffffffffffffff','X','%s','%s')" % (now,ipaddr)); else: #ip gesperrt self.wfile.write(bytes('''<p>Die IP-Adresse wurde gesperrt</p>''',"UTF-8")) else: # laufende session #token prüfen und gleich expire erneuern if 's' in get.keys(): if 'logout' in get.keys(): expire = '0000-00-00- 00:00:00' else: expire = func.timestamp(conf['expire']) now = func.timestamp() session = func.no_inject(get['s']) que = "UPDATE users SET expire='%s' WHERE uSession = '%s'" % (expire,session) if func.sql(lite,que): if 'logout' in get.keys(): self.wfile.write(bytes('''<p>Session beendet.</p>''',"UTF-8")) access = False else: access = True else: # Token abgelaufen self.wfile.write(bytes('''<p>Session abgelaufen</p>''',"UTF-8")) else: # Token nicht existent self.wfile.write(bytes('''<p>Keine Session gefunden</p>''',"UTF-8")) # Content if access == True: # hier kommt alles rein was nur erreichbar ist, wenn man angemeldet ist # Navigation navi = '''<div><a href="/stats/index/s/%s">Statistik</a> <a href="/user/list/s/%s">Userliste</a> <a href="/user/create/s/%s">User erstellen</a> <a href="/logout/index/s/%s">Logout</a></div> <hr/>''' % (session,session,session,session) self.wfile.write(bytes(navi,"UTF-8")) if 'token' in get.keys(): #token search #TODO #token create #ungeprüft if get['token'] == 'add': if 'tid' in get.keys(): tid = func.no_inject(get['tid']) id = func.no_inject(get['id']) if func.sql(lite,"INSERT INTO token (tID,userID,tKey) VALUES ('"+tid+"','"+id+"','')"): self.wfile.write(bytes('''<p>Anlegen erfolgreich</p>''',"UTF-8")) else: self.wfile.write(bytes('''<p>Anlegen fehlgeschlagen</p>''',"UTF-8")) get['user'] = '******' else: data = func.sql(lite,"SELECT tokenID,timecode FROM log WHERE answere = 'D' ORDER BY timecode DESC LIMIT 10") for d in data: self.wfile.write(bytes("[<a href='/token/add/id/"+get['id']+"/tid/"+d[0]+"/s/"+session+"'>Add to User</a>] "+ d[0] +"("+d[1]+")","UTF-8")) #token deleter if get['token'] == 'del': if 'tid' in get.keys(): tid = func.no_inject(get['tid']) if func.sql(lite,"DELETE FROM token WHERE tID = '"+tid+"';"): self.wfile.write(bytes('''<p>Löschen erfolgreich</p>''',"UTF-8")) else: self.wfile.write(bytes('''<p>Löschen fehlgeschlagen</p>''',"UTF-8")) get['user'] = '******' else: data = func.sql(lite,"SELECT tokenID,timecode FROM log WHERE answere = 'D' ORDER BY timecode DESC LIMIT 10") for d in data: self.wfile.write(bytes("[<a href='/token/add/id/"+get['id']+"/tid/"+d[0]+"/s/"+session+"'>Add to User</a>] "+ d[0] +"("+d[1]+")","UTF-8")) #token an anderen user geben if get['token'] == 'change': pass #TODO if 'log' in get.keys(): pass #todo if 'user' in get.keys(): #ungeprüft if get["user"] == '': get["user"] = '******' #ungeprüft if get["user"] == 'create': if bytes('submit',"UTF-8") in post.keys(): uName = func.no_inject(post[b'uName'][0].decode("utf-8") ) uMember = func.no_inject(post[b'uMember'][0].decode("utf-8") ) if(post[b'uPass'][0].decode("utf-8") != ''): uSalt = func.random(75) uPass = func.md5(post[b'uPass'][0].decode("utf-8") +uSalt) else: uSalt = '' uPass = '' if func.sql(lite,"INSERT INTO users (uName,uPass,uSalt,uMember,uSession) VALUES ('"+uName+"','"+uPass+"','"+uSalt+"','"+uMember+"','')"): self.wfile.write(bytes('''<p>User angelegt</p>''',"UTF-8")) get["id"] = func.sql(lite,"SELECT uID FROM users ORDER BY uID DESC LIMIT 1")[0][0] get["user"] = '******' else: self.wfile.write(bytes('''<p>Anlegen fehlgeschlagen</p>''',"UTF-8")) else: content = '''<form action="/user/create/s/%s" method="post"><div><span>Name</span><input type="text" name="uName" /></div><div><span>Passwort</span><input type="password" name="uPass" />(Nur ausfüllen, wenn der user admin zugriff haben soll.)</div><div><span>Member-ID</span><input type="text" name="uMember" /></div><div><input type="submit" name="submit" value="Erstellen" /></div></form>''' % session self.wfile.write(bytes(content,"UTF-8")) #ungeprüft if get["user"] == 'edit': if bytes('submit',"UTF-8") in post.keys(): uName = func.no_inject(post[b'uName'][0].decode("utf-8") ) uMember = func.no_inject(post[b'uMember'][0].decode("utf-8") ) id = func.no_inject(get['id']) if(post[b'uPass'][0].decode("utf-8") != ''): uSalt = func.random(75) uPass = func.md5(post[b'uPass'][0].decode("utf-8") +uSalt) res = func.sql(lite,"UPDATE users SET uName = '"+uName+"',uPass = '******',uSalt = '"+uSalt+"',uMember = '"+uMember+"' WHERE uID = '"+id+"'") else: res = func.sql(lite,"UPDATE users SET uName = '"+uName+"',uMember = '"+uMember+"' WHERE uID = '"+id+"'") if res == True: self.wfile.write(bytes('''<p>User editiert</p>''',"UTF-8")) else: self.wfile.write(bytes('''<p>Editieren fehlgeschlagen</p>''',"UTF-8")) get["user"] = '******' else: id = func.no_inject(get['id']) #user daten werden in form, geladen self.wfile.write(bytes("<table><thead><tr><th>Feld</th><th>Daten</th></tr></thead><tbody>","UTF-8")) ud = func.sql(lite,"SELECT uName, uPass, uMember FROM users WHERE uID = %s" % id) if len(ud) == 1: if ud[0][1] == '': admin = 'User' else: admin = 'Admin' content = '''<form action="/user/edit/id/%s/s/%s" method="post"><div><span>Name</span><input type="text" name="uName" value="%s" /></div><div><span>Gruppe:</span> %s</div><div><span>Passwort</span><input type="password" name="uPass" />(bleibt unverändert wenn leer.)</div><div><span>Member-ID</span><input type="text" name="uMember" value="%s" /></div><div><input type="submit" name="submit" value="Erstellen" /></div></form>''' % (id,session,ud[0][0],admin,ud[0][2]) self.wfile.write(bytes(content,"UTF-8")) self.wfile.write(bytes("</tbody></table>[<a href='/token/add/id/"+id+"/s/"+session+"'>AddToken</a>]<table><thead><tr><th>ID</th><th>zuletzt benutzt</th><th>Optionen</th></tr></thead><tbody>","UTF-8")) #zugehörige tokens gelistet data = func.sql(lite,"SELECT tID,tActive,lastUsed FROM token WHERE userID = '%s';" % id) for d in data: if d[1] == 1: active = 'Aktiv' else: active = 'Deaktiviert' self.wfile.write(bytes("<tr><td>"+d[0]+"</td><td>"+d[3]+"</td><td>"+active+"</td><td>[De/Aktivieren][Löschen][Weitergeben]</td></tr>","UTF-8")) self.wfile.write(bytes("</tbody></table>","UTF-8")) #geprüft if get["user"] == 'del': id = func.no_inject(get['id']) if bytes('submit',"UTF-8") in post.keys(): func.sql(lite,"DELETE FROM token WHERE userID = '%s'" % id) func.sql(lite,"DELETE FROM users WHERE uID = '%s'" % id) get["user"] = '******' else: self.wfile.write(bytes("<form action='/user/del/id/"+id+"/s/"+session+"' method='post'>Sicher? <input type='submit' name='submit' value='Ja, klar' /></form>","UTF-8")) #ungeprüft if get["user"] == 'list': data = func.sql(lite,"SELECT uId,uName,uPass,uMember FROM users ORDER BY uName") self.wfile.write(bytes('''<table><thead><tr><th>ID</th><th>Name</th><th>Optionen</th></tr></thead><tbody>''',"UTF-8")) for d in data: if d[2] != '': ismod = '*' else: ismod = '' self.wfile.write(bytes("<tr><td>"+str(d[0])+"</td><td>"+d[1]+" "+ismod+"</td><td>[<a href='/user/edit/id/"+str(d[0])+"/s/"+session+"'>Edit</a>][De/Aktivieren][<a href='/user/del/id/"+str(d[0])+"/s/"+session+"'>Löschen</a>]</td></tr>","UTF-8")) self.wfile.write(bytes("</tbody></table>","UTF-8")) #TODO else: # hier sieht man nur wenn man abgemeldet ist # Navigation self.wfile.write(bytes(''' <div><a href="/stats">Statistik</a> <a href="/login">Login</a> </div> <hr/>''',"UTF-8")) if 'login' in get.keys(): self.wfile.write(bytes('''<form action="" method="post"> <div><span>User:</span> <input type="text" name="u" /></div> <div><span>Pass:</span> <input type="password" name="p" /></div> <div><input type="submit" name="submit" value="Login" /></div> </form>''',"UTF-8")) #TODO self.wfile.write(bytes('''Abgemeldet''',"UTF-8")) if 'stats' in get.keys(): self.wfile.write(bytes('''Statistik<br/> was soll hier alles rein????''',"UTF-8")) #todo if 'favicon.ico' in get.keys(): #todo pass #ungeprüft if 'style.css' in get.keys(): self.wfile.write(bytes('''p {background-color: #000000; display: block; color: #ffffff;} span {display: block; width: 200px; float:left;} input {display:block; float:left;} div{width:100%; clear: both;}''',"UTF-8")) #Aufräumen if html == True: self.wfile.write(bytes("</body></html>","UTF-8")) func.sql_close(lite);
import func import requests print func.md5('hazzel')