def _remove_member_from_team(team_id, member):
"""Remove an org member from a team"""
url = '{}/teams/{}/members/{}?access_token={}'.format(
GITHUB_API_URL,
team_id,
member,
get_access_token())
fetch_url(url, urlfetch.DELETE)
# Create a log entry
message = '{} was removed from {}'.format(member, _get_team_name(team_id))
create_log(message)
def get_description(update, context):
context.user_data['description'] = update.message.text
text = "Points " + str(context.user_data['points']) + " for " + str(
context.user_data['description'])
logs.create_log(datetime.now(), update._effective_user.username,
context.user_data['username'], text)
data.scope(context.user_data['username'], context.user_data['points'])
markup = ReplyKeyboardMarkup(config.main_keyboard, one_time_keyboard=False)
context.bot.send_message(chat_id=update.effective_chat.id,
text='Ok',
reply_markup=markup)
return ConversationHandler.END
def _add_members_to_team(team_id, members):
"""Add members of org to a team"""
for member in members:
url = '{}/teams/{}/members/{}?access_token={}'.format(
GITHUB_API_URL,
team_id,
member,
get_access_token())
fetch_url(url, urlfetch.PUT)
# Create a log entry
message = '{} was added to {}'.format(members, _get_team_name(team_id))
create_log(message)
def add_team(team_id, repo):
"""Add team access to a repo"""
# Build url for HTTP request
url = '{}/teams/{}/repos/{}/{}?access_token={}'.format(
GITHUB_API_URL,
team_id,
os.environ.get('ORG'),
repo,
get_access_token())
# Give repo access to team
fetch_url(url, urlfetch.PUT)
# Create a log entry
message = '{} was added to the {} repo'.format(_get_team_name(team_id),
repo)
create_log(message)
def remove_team(team_id, repo):
"""Remove team access from a repo"""
# Build url for HTTP request
url = '{}/teams/{}/repos/{}/{}?access_token={}'.format(
GITHUB_API_URL,
team_id,
os.environ.get('ORG'),
repo,
get_access_token())
# Remove repo access from a team
fetch_url(url, urlfetch.DELETE)
# Create a log entry
message = '{} was removed from the {} repo'.format(_get_team_name(team_id),
repo)
create_log(message)
def _create_private_repo(name, description, private=True):
"""Create a private repo"""
url = '{}/orgs/{}/repos?access_token={}'.format(GITHUB_API_URL,
os.environ.get('ORG'),
get_access_token())
fields = {
"name": name,
"description": description,
"private": True,
}
# Send request to Github's API
fetch_url(url, urlfetch.POST, json.dumps(fields))
# Create a log entry
message = '{} created the {} repo'.format(get_user_name(), name)
create_log(message)
def edit_team(team_name, team_id, edit_type):
"""Edit the access of a team"""
url = '{}/teams/{}?access_token={}'.format(GITHUB_API_URL,
team_id,
get_access_token())
# Get the required info to perform the query
fields = {
"name": team_name,
"id": team_id,
"permission": edit_type,
}
fetch_url(url, urlfetch.PATCH, json.dumps(fields))
# Create a log entry
message = '{} was given {} access'.format(team_name, edit_type)
create_log(message)
def scan_html(payload, url):
param = dict(parse_qsl(urlsplit(url).query))
tainted_params = {x: payload for x in param}
logs.create_log(logs_des, "Params : " + str(tainted_params))
if len(tainted_params) > 0:
attack_url = urlsplit(url).geturl() + urlencode(tainted_params)
resp = requests.post(url=attack_url, data=payload)
if resp.status_code == 200:
if payload in resp.text:
attack_encode = html.escape(attack_url)
logs.create_log(logs_des,
"HTML Injection Found : " + str(attack_url))
print("HTML Injection at %s\nInjection", attack_url)
else:
logs.create_log(logs_des,
"No HTML Injection Found : " + str(url))
print("This URL is not Vulnerable")
import os
import socket
import sys
import time
import traceback
from pathlib import Path
import socketio
from dotenv import load_dotenv
import logs
import spray
# Setup log
log = logs.create_log('host')
def handle_exception(exc_type, exc_value, exc_traceback):
if issubclass(exc_type, KeyboardInterrupt):
sys.__excepthook__(exc_type, exc_value, exc_traceback)
return
log.critical("Uncaught exception",
exc_info=(exc_type, exc_value, exc_traceback))
sys.excepthook = handle_exception
# Load environment variables
env_path = Path(__file__).parent.absolute() / '.env'
Callum Morrison, 2021
"""
import os
import queue
import time
from pathlib import Path
from threading import Thread
from dotenv import load_dotenv
import logs
import util
# Setup log
log = logs.create_log(__name__)
# Load environment variables
env_path = Path(__file__).parent.absolute() / '.env'
load_dotenv(dotenv_path=env_path)
# Initialise spraying queue
spray_queue = queue.Queue(maxsize=1)
class Spray():
def __init__(self, sid, log):
import vision
self.log = log
# Initialise camera
help=
'Plase enter valid URL example: http://testphp.vulnweb.com/listproducts.php?cat=2'
)
parser.add_argument('-ul', help='Plase provide URL List File ')
parser.add_argument('-d',
required=True,
help='Domain Name example: esds.co.in')
args = parser.parse_args()
url_s = args.url
url_file = args.ul
domain = args.d
#store logs with domain name and timestamp
logs_des = work_dir + str(domain) + timestamp + '.txt'
logs.create_log(logs_des, "Scanning Started for : " + str(domain))
payload = "<h1><a href='https://www.google.com/'> Vulnerable Link </a></h1>"
logs.create_log(logs_des, "Payload Used : " + str(payload))
''''Execute for multiple URL'S'''
if url_file:
#read url list file and strip \n and close file
fh = open(url_file)
test = [line.rstrip() for line in fh.readlines()]
fh.close()
#REGEX that will match applicable urls ex: "php?cat=2"
url_s = []
pattern = '.*\?((.*=.*)(&?))+'
print(test)
for urls in test:
if re.match(pattern, urls):