예제 #1
0
def change_password():
    Tip = ""
    #获取传递的参数
    c_u = request.args.get("u")
    if c_u:
        if request.method == "GET":
            return render_template("changepwd.html", username=c_u)
        else:
            '''POST请求,说明用户提交了表单'''
            #从表单中获取原密码、新密码、确认密码
            o_password = request.form.get("o_password")
            o_password = Encode(o_password)
            n_password = request.form.get("n_password")
            a_password = request.form.get("a_password")
            #根据传递的用户名取出用户信息
            c_user = User.query.filter(User.username == c_u).first()
            #判断原密码是不是对的
            if o_password != c_user.password:
                Tip = "原密码错误!"
            else:
                '''判断两次密码是否一致'''
                if n_password != a_password:
                    Tip = "两次密码不一致!"
                else:
                    '''验证通过,修改数据库'''
                    c_user.password = Encode(n_password)
                    #执行
                    db.session.commit()
                    # 需要重新登录
                    return render_template("login.html")
            # 传参、跳转至修改密码界面
            return render_template("changepwd.html", username=c_u, Tip=Tip)
예제 #2
0
    def __init__(self, path = "./collector.ini"):
        
        cf = ConfigParser.ConfigParser()
        cf.read(path)

        #return all section
        secs = cf.sections()
        logging.info("config sections: %s" % secs)
 
        encode = cf.get("other", "encode")
 
        self.db_host = cf.get("db", "host")
        self.db_port = cf.getint("db", "port")
        self.db_user = cf.get("db", "user")
        if(encode == "0"):
            self.db_pw = cf.get("db", "pw")
            self.db_pw_b = Encode.encrypt(self.db_pw)
        else:
            self.db_pw_b = cf.get("db", "pw")
            self.db_pw = Encode.decrypt(self.db_pw_b)
            
        self.db_name = cf.get("db", "name")
        
        self.sl_host = cf.get("syslog", "host")
        self.sl_port = cf.getint("syslog", "port")
 
 
        #modify one value and write to file
        cf.set("db", "pw", self.db_pw_b)
        cf.set("other", "encode", "1")
        cf.write(open(path, "w"))
예제 #3
0
파일: crawler.py 프로젝트: xssmap/xssmap
 def __init__(self, domain, threads, depth, times, headers, father):
     self.domain = domain
     if self.domain[self.domain.__len__() - 1] == '/':
         self.domain = self.domain[0:self.domain.__len__() - 1]
     self.threads = threads
     self.times = times
     self.cookies = {}
     self.headers = {}
     self.count = 0
     self.controlthread = 0
     self.depth = depth
     self.father = father
     self.realdomain = ''
     self.payload = Payload()
     self.encode = Encode()
     if headers != '':
         self.setheader(headers)
     if 'https' in self.domain:
         self.domain1 = self.domain.replace('https://', '')
         self.domain2 = 'http://' + self.domain1
         self.domain3 = 'http%3A%2F%2F' + self.domain1
         self.domain4 = 'https%3A%2F%2F' + self.domain1
     elif 'http' in self.domain:
         self.domain1 = self.domain.replace('http://', '')
         self.domain2 = 'https://' + self.domain1
         self.domain3 = 'http%3A%2F%2F' + self.domain1
         self.domain4 = 'https%3A%2F%2F' + self.domain1
     else:
         self.domain1 = 'http://' + self.domain
         self.domain2 = 'https://' + self.domain
         self.domain3 = 'http%3A%2F%2F' + self.domain
         self.domain4 = 'https%3A%2F%2F' + self.domain
     self.queue = Queue()
     self.urlqueue = Queue()
     self.lock = threading.RLock()
     self.lock2 = threading.RLock()
     self.lock3 = threading.RLock()
     self.lock4 = threading.RLock()
     self.lock5 = threading.RLock()
     self.bloomfilter = ScalableBloomFilter(
         initial_capacity=10000,
         error_rate=0.001,
         mode=ScalableBloomFilter.LARGE_SET_GROWTH)
     self.bloomfilter2 = ScalableBloomFilter(
         initial_capacity=10000,
         error_rate=0.001,
         mode=ScalableBloomFilter.LARGE_SET_GROWTH)
     self.blacklist = [
         '<', '{', '\'', '"', '.css', '.jpg', '.mp4', '.png', '.gif',
         '.avi', '.jpeg', '.ico', '.mp3', '.pdf', 'docx', 'doc', 'bmp',
         '.rmvb', '.zip', '.rar', '.exe', '.ppt', '.pptx', 'xls'
     ]
     self.rule = 'http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+'
예제 #4
0
    def predict_click_event(self, master_frame):
        # randomize the waiting time:
        millisecond = 1 / (random.randint(3, 10))
        loading(master_frame, time=millisecond)

        # order: accessibility, defence, numForces, visibility, waterLevel, soil, topography, speed, importance.
        entered_user_list = [
            self.accessibility_combo_str.get(),
            self.defence_combo_str.get(),
            self.numForces_combo_str.get(),
            self.visibility_combo_str.get(),
            self.waterLevel_combo_str.get(),
            self.soil_combo_str.get(),
            self.topography_combo_str.get(),
            self.speed_combo_str.get(),
            self.importance_combo_str.get()
        ]

        encode = Encode()
        translated_list = encode.translate_list(entered_user_list)
        x_test = encode.encode_words(translated_list)
        # print(enterd_user_list)
        # print(translated_list)
        # print(x_test)
        x_test = reshape(x_test, [1, -1])
        y = model.fitted_model.predict(x_test)[0]

        string_msg = "با توجه به مقادیر ورودی دیوار "

        # get the name of the predicted wall and add to the output message string:
        wall_name = encode.decode_wall_name(y)
        string_msg += "\"" + wall_name + "\""
        string_msg += " پیشنهاد می‌شود"

        # change the labels text to the predicted wall:
        label = master_frame.winfo_children()[2]
        label.config(text=string_msg, fg='black')

        # set picture:
        label_img = master_frame.winfo_children()[1]

        if y == 1:
            label_img.config(image=self.img_precast_wall)
        if y == 2:
            label_img.config(image=self.img_retaining_wall)
        if y == 3:
            label_img.config(image=self.img_barbed_wire)
        if y == 4:
            label_img.config(image=self.img_non_protection)
예제 #5
0
def register():
    # Tip提示信息
    Tip = ""
    if (request.method == "POST"):
        username = request.form.get("username")
        telephone = request.form.get("telephone")
        # 根据用户名查询用户是否存在
        U_username = User.query.filter(User.username == username).first()
        # 根据电话号码查询用户是否存在
        U_telephone = User.query.filter(User.telephone == telephone).first()
        if (U_username):
            '''用户名已被注册'''
            Tip = "该用户名已被注册!"
            #注册失败,返回注册界面
            return render_template("register.html", Tip=Tip)
        if (U_telephone):
            '''账号已被注册'''
            Tip = "该电话号码已被注册!"
        else:
            '''账号未被注册'''
            # 创建新用户对象
            user1 = User()
            user1.username = request.form.get("username")

            #密码加密
            password = request.form.get("password")
            user1.password = Encode(password)
            #user1.password = password

            # 验证电话号码格式是否正确
            user1.telephone = request.form.get("telephone")
            if (re.match('^1[0-9]{10}$', user1.telephone)):
                {}
            else:
                '''电话格式不合法'''
                Tip = "该电话格式不合法!"
                #电话号码不通过,返回注册界面
                return render_template("register.html", Tip=Tip)

            #验证邮箱格式是否正确
            user1.email = request.form.get("email")
            if (re.match(r'^[0-9a-zA-Z_]{0,19}@[0-9a-zA-Z]{1,13}\.com$',
                         user1.email)):
                user1.gender = request.form.get("gender")
                user1.age = request.form.get("age")
                user1.city = request.form.get("city")
                user1.job = request.form.get("job")
                user1.other = request.form.get("other")

                # 插入数据库
                db.session.add(user1)
                # 执行
                db.session.commit()
                # 注册成功后跳转至登录界面
                return render_template("login.html")
            else:
                '''邮箱格式不合法'''
                Tip = "该邮箱格式不合法!"
    # GET请求或注册不成功都将返回注册界面
    return render_template("register.html", Tip=Tip)
예제 #6
0
def login():
    #Tip提示信息
    Tip = ""
    if (request.method == "POST"):
        userid = request.form.get("userid")
        password = request.form.get("password")
        if (userid == ""):
            return render_template("register.html")
        U = User.query.filter(
            User.telephone == userid).first()  #根据用户账号查询用户是否存在
        if (U):
            if (Encode(password) == U.password):
                # 如何存在就创建在线用户对象,用来存放在线用户信息
                on_user = Online()  #创建
                on_user.username = U.username  #用户名
                on_user.time = datetime.now()  #登陆时间
                db.session.add(on_user)  #插入到数据库
                db.session.commit()  #执行
                on_users = Online.query.filter().all()  #查询所有在线用户信息
                number = len(on_users)  #记录人数
                return render_template("welcome.html",
                                       username=U.username,
                                       number=number - 1)  #传参,跳转页面
            else:
                Tip = "账号或密码错误!"  #邮箱格式错误
        else:
            Tip = "该账号不存在,请先注册!"  #账号不存在
    return render_template("login.html", Tip=Tip)  #传参,跳转页面
예제 #7
0
파일: gui.py 프로젝트: xssmap/xssmap
 def __init__(self):
     ctypes.windll.shell32.SetCurrentProcessExplicitAppUserModelID(
         "myappid")
     self.window = tkinter.Tk()
     self.window.title("xssmap")
     self.height = 800
     self.width = 1024
     self.window.geometry(
         "%dx%d+%d+%d" %
         (self.width, self.height,
          (self.window.winfo_screenwidth() - self.width) / 2,
          (self.window.winfo_screenheight() - self.height) / 2))
     self.window.resizable(width=False, height=False)
     self.window.iconbitmap("xssmap.ico")
     self.text1 = None
     self.text2 = None
     self.text3 = None
     self.button1 = None
     self.button2 = None
     self.button3 = None
     self.finish = False
     self.p = None
     self.combobox = None
     self.source = None
     self.dist = None
     self.index1 = 0
     self.index2 = 0
     self.ssl = 0
     self.payload = Payload()
     self.package = Package('', 0)
     self.encode = Encode()
     self.setframe1()
     self.setframe2()
     self.setframe3()
     self.setframe4()
     self.setframe5()
예제 #8
0
# encoding: utf-8
if __name__ == '__main__':
    from encode import Encode
    from decode import Decode
    from time import sleep
    start = 'tree.png'
    dna = 'tree.tar.gz.dna'
    final = 'tree.tar.gz.final     '
    print('encoding................')
    sleep(0.5)
    Encode(file_in=start,
           out=dna,
           size=32,
           rs=2,
           max_homopolymer=3,
           gc=0.05,
           delta=0.001,
           c_dist=0.025,
           stop=2000,
           no_fasta=True).main()
    print('decoding................')
    sleep(0.5)
    chunk = int(input('please input the number of chunk or segments:'))
    Decode(file_in=dna,
           out=final,
           header_size=4,
           rs=2,
           delta=0.001,
           c_dist=0.025,
           chunk_num=chunk,
           max_homopolymer=3,
예제 #9
0
import pandas as pd
from sklearn import tree
from encode import Encode

df = pd.read_excel("dataset.xlsx")

# delete number rows column:
columns_names = df.keys(
)[:-1]  # the unwanted column is not included in the list.
df = df[columns_names]

encode = Encode()
df = df.apply(encode.translate_list)  # translate to english.
df = df.apply(encode.encode_words)  # encoded to numbers.

df = df.dropna()

# split data: # todo: train and test set.
x = df.iloc[:, 1:].values
y = df.iloc[:, 0].values

# todo: run model in a loop for optimization.
clf = tree.DecisionTreeClassifier()
fitted_model = clf.fit(x, y)
y_hat = fitted_model.predict(x)
예제 #10
0
파일: gui.py 프로젝트: xssmap/xssmap
class Gui:
    def __init__(self):
        ctypes.windll.shell32.SetCurrentProcessExplicitAppUserModelID(
            "myappid")
        self.window = tkinter.Tk()
        self.window.title("xssmap")
        self.height = 800
        self.width = 1024
        self.window.geometry(
            "%dx%d+%d+%d" %
            (self.width, self.height,
             (self.window.winfo_screenwidth() - self.width) / 2,
             (self.window.winfo_screenheight() - self.height) / 2))
        self.window.resizable(width=False, height=False)
        self.window.iconbitmap("xssmap.ico")
        self.text1 = None
        self.text2 = None
        self.text3 = None
        self.button1 = None
        self.button2 = None
        self.button3 = None
        self.finish = False
        self.p = None
        self.combobox = None
        self.source = None
        self.dist = None
        self.index1 = 0
        self.index2 = 0
        self.ssl = 0
        self.payload = Payload()
        self.package = Package('', 0)
        self.encode = Encode()
        self.setframe1()
        self.setframe2()
        self.setframe3()
        self.setframe4()
        self.setframe5()

    def setflag(self):
        try:
            self.text1.tag_configure('red', foreground='#DC143C')
            self.text1.insert(tkinter.SEL_FIRST, "$", 'red')
            self.text1.insert(tkinter.SEL_LAST, "$", 'red')
            self.button1['state'] = tkinter.DISABLED
        except tkinter.TclError:
            messagebox.showerror("提示", "请选中标记参数")

    def unsetflag(self):
        content = self.text1.get("0.0", "end").strip('\n')
        self.text1.delete("0.0", "end")
        self.text1.insert("0.0", content.replace('$', ''))
        self.button1['state'] = tkinter.NORMAL
        self.text1.see(1000.0)

    def valid(self):
        data = self.source[0:self.
                           index1] + 'jimmywhite' + self.source[self.index2 +
                                                                1:]
        self.package.setcontent(data)
        self.package.setssl(self.ssl)
        self.package.process()
        self.package.setcontent(self.dist)
        result = self.package.process()
        if result.find('jimmywhite') > 0:
            return True
        return False

    def typeone(self):
        content = self.source[0:self.index1] + '<jimmywhite>' + self.source[
            self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        content = self.source[0:self.index1] + self.encode.urlencode(
            '<jimmywhite>') + self.source[self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        content = self.source[0:self.index1] + self.encode.unicodeencode(
            '<jimmywhite>') + self.source[self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        content = self.source[0:self.index1] + self.encode.htmlencode(
            '<jimmywhite>') + self.source[self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        content = self.source[0:self.index1] + self.encode.doubleencode(
            '<jimmywhite>') + self.source[self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        content = self.source[0:self.index1] + self.encode.base64encode(
            '<jimmywhite>') + self.source[self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        return False

    def typetwo(self):
        content = self.source[0:self.index1] + 'jimmywhite' + self.source[
            self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        if content.find('"jimmywhite"') > 0:
            return True
        content = self.source[0:self.index1] + self.encode.doubleencode(
            'jimmywhite') + self.source[self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        if content.find('"jimmywhite"') > 0:
            return True
        content = self.source[0:self.index1] + self.encode.base64encode(
            'jimmywhite') + self.source[self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        if content.find('"jimmywhite"') > 0:
            return True
        content = self.source[0:self.index1] + self.encode.htmlencode(
            'jimmywhite') + self.source[self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        if content.find('"jimmywhite"') > 0:
            return True
        content = self.source[0:self.index1] + self.encode.unicodeencode(
            'jimmywhite') + self.source[self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        if content.find('"jimmywhite"') > 0:
            return True
        content = self.source[0:self.index1] + self.encode.urlencode(
            'jimmywhite') + self.source[self.index2 + 1:]
        self.package.setcontent(content)
        self.package.process()
        self.package.setcontent(self.dist)
        content = self.package.process()
        if content.find('"jimmywhite"') > 0:
            return True
        return False

    def testone(self):
        for i in range(0, self.payload.payloads1.__len__()):
            content = self.source[0:self.index1] + self.payload.payloads1[
                i] + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.payload.payloads1[i]
            content = self.source[0:self.index1] + self.encode.urlencode(
                self.payload.payloads1[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.encode.urlencode(self.payload.payloads1[i])
            content = self.source[0:self.index1] + self.encode.unicodeencode(
                self.payload.payloads1[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.encode.unicodeencode(self.payload.payloads1[i])
            content = self.source[0:self.index1] + self.encode.htmlencode(
                self.payload.payloads1[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.encode.htmlencode(self.payload.payloads1[i])
            content = self.source[0:self.index1] + self.encode.base64encode(
                self.payload.payloads1[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.encode.base64encode(self.payload.payloads1[i])
            content = self.source[0:self.index1] + self.encode.doubleencode(
                self.payload.payloads1[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.encode.doubleencode(self.payload.payloads1[i])
            content = self.source[0:self.index1] + self.encode.capsencode(
                self.payload.payloads1[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            index = 0
            while content.find(
                    self.encode.capsencode(self.payload.payloads1[i]),
                    index + 1) > 0:
                index = content.find(
                    self.encode.capsencode(self.payload.payloads1[i]),
                    index + 1)
                if content[index - 1] != '"':
                    return self.encode.capsencode(self.payload.payloads1[i])
        return 'fail'

    def testtwo(self):
        for i in range(0, self.payload.payloads2.__len__()):
            content = self.source[0:self.index1] + self.payload.payloads2[
                i] + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            if content.find(self.payload.payloads2[i]) > 0:
                return self.payload.payloads2[i]
            content = self.source[0:self.index1] + self.encode.capsencode(
                self.payload.payloads2[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            if content.find(self.encode.capsencode(
                    self.payload.payloads2[i])) > 0:
                return self.encode.capsencode(self.payload.payloads2[i])
            content = self.source[0:self.index1] + self.encode.doubleencode(
                self.payload.payloads2[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            if content.find(self.payload.payloads2[i]) > 0:
                return self.encode.doubleencode(self.payload.payloads2[i])
            content = self.source[0:self.index1] + self.encode.base64encode(
                self.payload.payloads2[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            if content.find(self.payload.payloads2[i]) > 0:
                return self.encode.base64encode(self.payload.payloads2[i])
            content = self.source[0:self.index1] + self.encode.htmlencode(
                self.payload.payloads2[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            if content.find(self.payload.payloads2[i]) > 0:
                return self.encode.htmlencode(self.payload.payloads2[i])
            content = self.source[0:self.index1] + self.encode.unicodeencode(
                self.payload.payloads2[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            if content.find(self.payload.payloads2[i]) > 0:
                return self.encode.unicodeencode(self.payload.payloads2[i])
            content = self.source[0:self.index1] + self.encode.urlencode(
                self.payload.payloads2[i]) + self.source[self.index2 + 1:]
            self.package.setcontent(content)
            self.package.process()
            self.package.setcontent(self.dist)
            content = self.package.process()
            if content.find(self.payload.payloads2[i]) > 0:
                return self.encode.urlencode(self.payload.payloads2[i])
        return 'fail'

    def testxss(self):
        if self.combobox.get() == 'http':
            self.ssl = 0
        else:
            self.ssl = 1
        flag = False
        self.source = self.text1.get("0.0", "end")
        self.dist = self.text2.get("0.0", "end")
        self.index1 = self.source.find('$', 0)
        self.index2 = self.source.find('$', self.index1 + 1)
        if self.valid():
            if self.typeone():
                p = self.testone()
                if p != 'fail':
                    self.p = p
                    self.text3.insert("end", "检测存在XSS!\n")
                    self.text3.insert("end", "PAYLOAD:" + self.p)
                    flag = True
            if self.typetwo() and flag is False:
                p = self.testtwo()
                if p != 'fail':
                    self.p = p
                    self.text3.insert("end", "检测存在XSS!\n")
                    self.text3.insert("end", "PAYLOAD:" + self.p)
        self.finish = True

    def show(self):
        while self.finish is False:
            pass
        tkinter.messagebox.showinfo('XSS检测成功', 'PAYLOAD:' + self.p)

    def start(self):
        self.button3['state'] = 'disabled'
        thread.start_new_thread(self.testxss, ())

    def setframe1(self):
        frame = tkinter.Frame(self.window, height=300)
        frame.pack(fill=tkinter.X)
        frame.pack_propagate(0)
        label = tkinter.Label(frame, text="XSS输入点")
        label.pack()
        self.text1 = tkinter.Text(frame)
        self.text1.pack(fill=tkinter.X)

    def setframe2(self):
        frame = tkinter.Frame(self.window, height=50)
        frame.pack(fill=tkinter.X)
        frame.pack_propagate(0)
        frame1 = tkinter.Frame(frame)
        frame1.pack(side=tkinter.LEFT)
        frame2 = tkinter.Frame(frame)
        frame2.pack(side=tkinter.RIGHT)
        self.button1 = tkinter.Button(frame1,
                                      text="标记参数",
                                      command=self.setflag,
                                      cursor="hand2")
        self.button1.pack(ipadx=200)
        self.button2 = tkinter.Button(frame2,
                                      text="清除标记",
                                      command=self.unsetflag,
                                      cursor="hand2")
        self.button2.pack(ipadx=200)

    def setframe3(self):
        frame = tkinter.Frame(self.window, height=300)
        frame.pack(fill=tkinter.X)
        frame.pack_propagate(0)
        label = tkinter.Label(frame, text="XSS输出点")
        label.pack()
        self.text2 = tkinter.Text(frame)
        self.text2.pack(fill=tkinter.X)

    def setframe4(self):
        frame = tkinter.Frame(self.window, height=100)
        frame.pack(fill=tkinter.X)
        frame.pack_propagate(0)
        label = tkinter.Label(frame, text="检测结果")
        label.pack()
        self.text3 = tkinter.Text(frame)
        self.text3.pack(fill=tkinter.X)

    def setframe5(self):
        frame = tkinter.Frame(self.window, height=50)
        frame1 = tkinter.Frame(frame, height=50)
        frame2 = tkinter.Frame(frame, height=50)
        frame.pack(fill=tkinter.X)
        frame.pack_propagate(0)
        frame1.pack(side=tkinter.LEFT)
        frame2.pack(side=tkinter.RIGHT)
        self.combobox = ttk.Combobox(frame1, state="readonly", width=5)
        self.combobox['value'] = ['http', 'https']
        self.combobox.current(0)
        self.combobox.pack(ipadx=200)
        self.button3 = tkinter.Button(frame2,
                                      text="开始",
                                      command=self.start,
                                      cursor="hand2")
        self.button3.pack(ipadx=200)
예제 #11
0
 def __init__(self, text):
     key, combination = self.getFromDB()
     e = Encode()
     text = e.toUpper(text)
     self.out_text = e.code(text, combination)
     self.out_text = key + " " + self.out_text
예제 #12
0
파일: crawler.py 프로젝트: xssmap/xssmap
class Crawler:
    def __init__(self, domain, threads, depth, times, headers, father):
        self.domain = domain
        if self.domain[self.domain.__len__() - 1] == '/':
            self.domain = self.domain[0:self.domain.__len__() - 1]
        self.threads = threads
        self.times = times
        self.cookies = {}
        self.headers = {}
        self.count = 0
        self.controlthread = 0
        self.depth = depth
        self.father = father
        self.realdomain = ''
        self.payload = Payload()
        self.encode = Encode()
        if headers != '':
            self.setheader(headers)
        if 'https' in self.domain:
            self.domain1 = self.domain.replace('https://', '')
            self.domain2 = 'http://' + self.domain1
            self.domain3 = 'http%3A%2F%2F' + self.domain1
            self.domain4 = 'https%3A%2F%2F' + self.domain1
        elif 'http' in self.domain:
            self.domain1 = self.domain.replace('http://', '')
            self.domain2 = 'https://' + self.domain1
            self.domain3 = 'http%3A%2F%2F' + self.domain1
            self.domain4 = 'https%3A%2F%2F' + self.domain1
        else:
            self.domain1 = 'http://' + self.domain
            self.domain2 = 'https://' + self.domain
            self.domain3 = 'http%3A%2F%2F' + self.domain
            self.domain4 = 'https%3A%2F%2F' + self.domain
        self.queue = Queue()
        self.urlqueue = Queue()
        self.lock = threading.RLock()
        self.lock2 = threading.RLock()
        self.lock3 = threading.RLock()
        self.lock4 = threading.RLock()
        self.lock5 = threading.RLock()
        self.bloomfilter = ScalableBloomFilter(
            initial_capacity=10000,
            error_rate=0.001,
            mode=ScalableBloomFilter.LARGE_SET_GROWTH)
        self.bloomfilter2 = ScalableBloomFilter(
            initial_capacity=10000,
            error_rate=0.001,
            mode=ScalableBloomFilter.LARGE_SET_GROWTH)
        self.blacklist = [
            '<', '{', '\'', '"', '.css', '.jpg', '.mp4', '.png', '.gif',
            '.avi', '.jpeg', '.ico', '.mp3', '.pdf', 'docx', 'doc', 'bmp',
            '.rmvb', '.zip', '.rar', '.exe', '.ppt', '.pptx', 'xls'
        ]
        self.rule = 'http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+'

    def black(self, url):
        for i in self.blacklist:
            if i in url:
                return False
        return True

    def black2(self, url):
        if '.js' in url and '.jsp' not in url:
            if self.domain in url or self.domain1 in url or self.domain2 in url or self.domain3 in url or self.domain4 in url:
                return True
            else:
                return False
        if '.' + self.domain in url:
            return False
        if '.' + self.domain1 in url:
            return False
        if '.' + self.domain2 in url:
            return False
        if '.' + self.domain3 in url:
            return False
        if '.' + self.domain4 in url:
            return False
        if '=' + self.domain in url:
            return False
        if '=' + self.domain1 in url:
            return False
        if '=' + self.domain2 in url:
            return False
        if '=' + self.domain3 in url:
            return False
        if '=' + self.domain4 in url:
            return False
        if '/' + self.domain in url and '//' + self.domain not in url:
            return False
        if '/' + self.domain1 in url and '//' + self.domain1 not in url:
            return False
        if '/' + self.domain2 in url and '//' + self.domain2 not in url:
            return False
        if '/' + self.domain3 in url and '//' + self.domain3 not in url:
            return False
        if '/' + self.domain4 in url and '//' + self.domain4 not in url:
            return False
        if self.domain in url or self.domain1 in url or self.domain2 in url or self.domain3 in url or self.domain4 in url:
            return True
        else:
            return False

    def setheader(self, url):
        index = 0
        l = 0
        url += '\n'
        while index < url.__len__() - 1:
            index = url.find(':', index)
            index1 = url.find('\n', index)
            index2 = url.find('\n', index1 + 1)
            if ':' not in url[index1:index2]:
                while ':' not in url[index1:index2]:
                    index3 = index2
                    index2 = url.find('\n', index2 + 1)
                    if index2 <= 0:
                        index2 = index3
                        break
            else:
                index2 = index1
            if url[index + 1] != ' ':
                self.headers.update(
                    {url[l:index]: url[index + 1:index2].replace('\n', '')})
            else:
                self.headers.update(
                    {url[l:index]: url[index + 2:index2].replace('\n', '')})
            index = index2 + 1
            l = index

    def setcookies(self, cookies):
        index = cookies.find('=')
        index2 = cookies.find(';')
        index3 = 0
        self.lock2.acquire()
        self.cookies.update({cookies[0:index]: cookies[index + 2:index2]})
        self.lock2.release()
        while cookies.find(',', index) > 0:
            index = cookies.find(',', index3)
            while cookies[index +
                          2] == '0' or cookies[index + 2] == '1' or cookies[
                              index + 2] == '2' or cookies[index + 2] == '3':
                index = cookies.find(',', index + 1)
            index2 = cookies.find('=', index)
            index3 = cookies.find(';', index2)
            self.lock2.acquire()
            self.cookies.update(
                {cookies[index + 2:index2]: cookies[index2 + 1:index3]})
            self.lock2.release()
            index = cookies.find(',', index + 1)
            while cookies[index +
                          2] == '0' or cookies[index + 2] == '1' or cookies[
                              index + 2] == '2' or cookies[index + 2] == '3':
                index = cookies.find(',', index + 1)

    def stepone(self):
        urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
        r = None
        if 'http' in self.domain:
            try:
                r = requests.get(url=self.domain,
                                 verify=False,
                                 timeout=(self.times, self.times),
                                 headers=self.headers,
                                 stream=True)
                self.realdomain = self.domain
            except requests.exceptions.Timeout:
                pass
            except requests.exceptions.ConnectionError:
                pass
            except requests.exceptions.ChunkedEncodingError:
                pass

        else:
            try:
                r = requests.get(url="http://" + self.domain,
                                 verify=False,
                                 timeout=(self.times, self.times),
                                 headers=self.headers,
                                 stream=True)
                self.realdomain = 'http://' + self.domain
            except requests.exceptions.Timeout:
                pass
            except requests.exceptions.ConnectionError:
                pass
            except requests.exceptions.ChunkedEncodingError:
                pass
            if r.text.__len__() < 100:
                try:
                    r = requests.get(url="https://" + self.domain,
                                     verify=False,
                                     timeout=(self.times, self.times),
                                     headers=self.headers,
                                     stream=True)
                    self.realdomain = 'https://' + self.domain
                except requests.exceptions.Timeout:
                    pass
                except requests.exceptions.ConnectionError:
                    pass
                except requests.exceptions.ChunkedEncodingError:
                    pass
        content = r.text
        print content
        if r.headers.get('Set-Cookie'):
            cookies = r.headers['Set-Cookie']
            self.setcookies(cookies)
        href = re.findall(self.rule, content)
        href2 = re.findall('href="(.*?)"', content)
        href3 = re.findall('href=(.*?)>', content)
        if href.__len__() > 0:
            for url in href:
                if self.black(url):
                    if url.__len__() > 0:
                        if url[0] == '/':
                            url = url.replace('//', '')
                        url = url.replace('&amp;', '&')
                    if self.black2(url):
                        if not self.bloomfilter.add(url):
                            self.queue.put(url)
        if href2.__len__() > 0:
            for url in href2:
                if '//' not in url:
                    if self.black(url):
                        if url.__len__() > 0:
                            url = url.replace('&amp;', '&')
                            if url[0] != '/':
                                url = '/' + url
                            if self.black2(self.realdomain + url):
                                if not self.bloomfilter.add(self.realdomain +
                                                            url):
                                    self.queue.put(self.realdomain + url)
        if href3.__len__() > 0:
            for url in href3:
                url = url.replace('"', '')
                if '//' not in url:
                    if self.black(url):
                        if url.__len__() > 0:
                            url = url.replace('&amp;', '&')
                            if url[0] != '/':
                                url = '/' + url
                            if self.black2(self.realdomain + url):
                                if not self.bloomfilter.add(self.realdomain +
                                                            url):
                                    self.queue.put(self.realdomain + url)
        for i in range(0, 100):
            self.queue.put("https://www.baidu.com")
        locks = []
        for i in range(0, self.threads):
            lock = threading.Lock()
            locks.append(lock)
            thread.start_new_thread(self.steptwo, (lock, ))
        time.sleep(5)
        for lock in locks:
            while lock.locked():
                pass
        time.sleep(1000)
        '''locks = []
        for i in range(0, 20):
            lock = threading.Lock()
            locks.append(lock)
            thread.start_new_thread(self.testxss, (lock,))
        time.sleep(5)
        for lock in locks:
            while lock.locked():
                pass
        print 1
        time.sleep(1000)'''

    def steptwo(self, minilock):
        minilock.acquire()
        while True:
            self.lock.acquire()
            self.count += 1
            if self.queue.qsize() < 1:
                self.lock.release()
                break
            url = self.queue.get()
            self.lock.release()
            url = url.replace('&amp;', '&')
            if '?' in url and '=' in url:
                self.stepthree(url)
            urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
            if 'http' in url:
                try:
                    if self.headers:
                        r = requests.get(url=url,
                                         verify=False,
                                         timeout=(self.times, self.times),
                                         headers=self.headers,
                                         stream=True)
                    else:
                        self.lock2.acquire()
                        cookies = self.cookies
                        self.lock2.release()
                        r = requests.get(url=url,
                                         verify=False,
                                         timeout=(self.times, self.times),
                                         headers=self.headers,
                                         stream=True,
                                         cookies=cookies)

                except requests.exceptions.Timeout:
                    pass
                except requests.exceptions.ConnectionError:
                    pass
                except requests.exceptions.ChunkedEncodingError:
                    pass
            else:
                try:
                    if self.headers:
                        r = requests.get(url="http://" + url,
                                         verify=False,
                                         timeout=(self.times, self.times),
                                         headers=self.headers,
                                         stream=True)
                    else:
                        self.lock2.acquire()
                        cookies = self.cookies
                        self.lock2.release()
                        r = requests.get(url="http://" + url,
                                         verify=False,
                                         timeout=(self.times, self.times),
                                         headers=self.headers,
                                         stream=True,
                                         cookies=cookies)
                except requests.exceptions.Timeout:
                    pass
                except requests.exceptions.ConnectionError:
                    pass
                except requests.exceptions.ChunkedEncodingError:
                    pass
                if r.text.__len__() < 100:
                    try:
                        if self.headers:
                            r = requests.get(url="https://" + url,
                                             verify=False,
                                             timeout=(self.times, self.times),
                                             headers=self.headers,
                                             stream=True)
                        else:
                            self.lock2.acquire()
                            cookies = self.cookies
                            self.lock2.release()
                            r = requests.get(url="https://" + url,
                                             verify=False,
                                             timeout=(self.times, self.times),
                                             headers=self.headers,
                                             stream=True,
                                             cookies=cookies)
                    except requests.exceptions.Timeout:
                        pass
                    except requests.exceptions.ConnectionError:
                        pass
                    except requests.exceptions.ChunkedEncodingError:
                        pass
            if r.status_code == 200:
                try:
                    content = r.text
                except requests.exceptions.ConnectionError:
                    continue
                except AttributeError:
                    continue
                except requests.exceptions.ChunkedEncodingError:
                    continue
            else:
                continue
            if r.headers.get('Set-Cookie'):
                cookies = r.headers['Set-Cookie']
                self.setcookies(cookies)
            href = re.findall(self.rule, content)
            href2 = re.findall('href="(.*?)"', content)
            if href.__len__() > 0:
                for url in href:
                    if self.black(url):
                        if url.__len__() > 0:
                            if url[0] == '/':
                                url = url.replace('//', '')
                            url = url.replace('&amp;', '&')
                        if self.black2(url):
                            if not self.bloomfilter.add(url):
                                self.queue.put(url)
            if href2.__len__() > 0:
                for url in href2:
                    if '//' not in url:
                        if self.black(url):
                            if url.__len__() > 0:
                                url = url.replace('&amp;', '&')
                                if url[0] != '/':
                                    url = '/' + url
                                if self.black2(self.realdomain + url):
                                    if not self.bloomfilter.add(
                                            self.realdomain + url):
                                        self.queue.put(self.realdomain + url)
            if self.count > self.depth:
                break
        minilock.release()

    def stepthree(self, url):
        url += '&'
        index2 = url.find('=') + 1
        newurl = url[0:url.find('=') + 1] + 'xss'
        while True:
            index1 = url.find('&', index2 + 1)
            index2 = url.find('=', index2 + 1)
            if index1 > 0 and index2 > 0:
                newurl += url[index1:index2] + '=xss'
            else:
                break
        if not self.bloomfilter2.add(newurl):
            self.urlqueue.put(url[0:url.__len__() - 1])
            self.lock5.acquire()
            self.father.text2.insert("end", url[0:url.__len__() - 1] + '\n')
            self.lock5.release()
            if self.controlthread < 20:
                thread.start_new_thread(self.testxss, (None, ))

    def network(self, url):
        try:
            if self.headers:
                r = requests.get(url=url,
                                 verify=False,
                                 timeout=(self.times, self.times),
                                 headers=self.headers,
                                 stream=True)
            else:
                self.lock2.acquire()
                cookies = self.cookies
                r = requests.get(url=url,
                                 verify=False,
                                 timeout=(self.times, self.times),
                                 headers=self.headers,
                                 stream=True,
                                 cookies=cookies)
                self.lock2.release()
        except requests.exceptions.Timeout:
            pass
        except requests.exceptions.ConnectionError:
            pass
        except requests.exceptions.ChunkedEncodingError:
            pass
        return r.text

    def valid(self, url, index1, index2):
        url = url[0:index1 + 1] + 'jimmywhite' + url[index2:]
        url = url.strip('&')
        if self.network(url).find('jimmywhite') > 0:
            return True
        else:
            return False

    def typeone(self, url, index1, index2):
        url = url.strip('&')
        content = self.network(url[0:index1 + 1] + '<jimmywhite>' +
                               url[index2:])
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        content = self.network(url[0:index1 + 1] +
                               self.encode.capsencode('<jimmywhite>') +
                               url[index2:])
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        content = self.network(url[0:index1 + 1] +
                               self.encode.doubleencode('<jimmywhite>') +
                               url[index2:])
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        content = self.network(url[0:index1 + 1] +
                               self.encode.htmlencode('<jimmywhite>') +
                               url[index2:])
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        content = self.network(url[0:index1 + 1] +
                               self.encode.unicodeencode('<jimmywhite>') +
                               url[index2:])
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        content = self.network(url[0:index1 + 1] +
                               self.encode.urlencode('<jimmywhite>') +
                               url[index2:])
        index = 0
        while content.find('<jimmywhite>', index + 2) > 0:
            index = content.find('<jimmywhite>', index + 2)
            if content[index - 1] != '"':
                return True
        return False

    def typetwo(self, url, index1, index2):
        url = url.strip('&')
        if self.network(url[0:index1 + 1] + 'jimmywhite' +
                        url[index2:]).find('"jimmywhite"') > 0:
            return True
        if self.network(url[0:index1 + 1] +
                        self.encode.capsencode('jimmywhite') +
                        url[index2:]).find('"jimmywhite"') > 0:
            return True
        if self.network(url[0:index1 + 1] +
                        self.encode.doubleencode('jimmywhite') +
                        url[index2:]).find('"jimmywhite"') > 0:
            return True
        if self.network(url[0:index1 + 1] +
                        self.encode.htmlencode('jimmywhite') +
                        url[index2:]).find('<"jimmywhite"') > 0:
            return True
        if self.network(url[0:index1 + 1] +
                        self.encode.unicodeencode('jimmywhite') +
                        url[index2:]).find('"jimmywhite"') > 0:
            return True
        if self.network(url[0:index1 + 1] +
                        self.encode.urlencode('jimmywhite') +
                        url[index2:]).find('"jimmywhite"') > 0:
            return True
        if self.network(url[0:index1 + 1] +
                        self.encode.base64encode('jimmywhite') +
                        url[index2:]).find('"jimmywhite"') > 0:
            return True
        return False

    def testone(self, url, index1, index2):
        url = url.strip('&')
        for i in range(0, self.payload.payloads1.__len__()):
            content = self.network(url[0:index1 + 1] +
                                   self.payload.payloads1[i] + url[index2:])
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.payload.payloads1[i]
            content = self.network(
                url[0:index1 + 1] +
                self.encode.capsencode(self.payload.payloads1[i]) +
                url[index2:])
            index = 0
            while content.find(
                    self.encode.capsencode(self.payload.payloads1[i]),
                    index + 1) > 0:
                index = content.find(
                    self.encode.capsencode(self.payload.payloads1[i]),
                    index + 1)
                if content[index - 1] != '"':
                    return self.encode.capsencode(self.payload.payloads1[i])
            content = self.network(
                url[0:index1 + 1] +
                self.encode.urlencode(self.payload.payloads1[i]) +
                url[index2:])
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.encode.urlencode(self.payload.payloads1[i])
            content = self.network(
                url[0:index1 + 1] +
                self.encode.unicodeencode(self.payload.payloads1[i]) +
                url[index2:])
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.encode.unicodeencode(self.payload.payloads1[i])
            content = self.network(
                url[0:index1 + 1] +
                self.encode.htmlencode(self.payload.payloads1[i]) +
                url[index2:])
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.encode.htmlencode(self.payload.payloads1[i])
            content = self.network(
                url[0:index1 + 1] +
                self.encode.doubleencode(self.payload.payloads1[i]) +
                url[index2:])
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.encode.doubleencode(self.payload.payloads1[i])
            content = self.network(
                url[0:index1 + 1] +
                self.encode.base64encode(self.payload.payloads1[i]) +
                url[index2:])
            index = 0
            while content.find(self.payload.payloads1[i], index + 1) > 0:
                index = content.find(self.payload.payloads1[i], index + 1)
                if content[index - 1] != '"':
                    return self.encode.base64encode(self.payload.payloads1[i])
        return 'fail'

    def testtwo(self, url, index1, index2):
        url = url.strip('&')
        for i in range(0, self.payload.payloads2.__len__()):
            if self.network(url[0:index1 + 1] + self.payload.payloads2[i] +
                            url[index2:]).find(self.payload.payloads2[i]) > 0:
                return self.payload.payloads2[i]
            if self.network(url[0:index1 + 1] +
                            self.encode.capsencode(self.payload.payloads2[i]) +
                            url[index2:]).find(
                                self.encode.capsencode(
                                    self.payload.payloads2[i])) > 0:
                return self.encode.capsencode(self.payload.payloads2[i])
            if self.network(url[0:index1 + 1] + self.encode.doubleencode(
                    self.payload.payloads2[i]) + url[index2:]).find(
                        self.payload.payloads2[i]) > 0:
                return self.encode.doubleencode(self.payload.payloads2[i])
            if self.network(url[0:index1 + 1] +
                            self.encode.htmlencode(self.payload.payloads2[i]) +
                            url[index2:]).find(self.payload.payloads2[i]) > 0:
                return self.encode.htmlencode(self.payload.payloads2[i])
            if self.network(url[0:index1 + 1] + self.encode.unicodeencode(
                    self.payload.payloads2[i]) + url[index2:]).find(
                        self.payload.payloads2[i]) > 0:
                return self.encode.unicodeencode(self.payload.payloads2[i])
            if self.network(url[0:index1 + 1] +
                            self.encode.urlencode(self.payload.payloads2[i]) +
                            url[index2:]).find(self.payload.payloads2[i]) > 0:
                return self.encode.urlencode(self.payload.payloads2[i])
            if self.network(url[0:index1 + 1] + self.encode.base64encode(
                    self.payload.payloads2[i]) + url[index2:]).find(
                        self.payload.payloads2[i]) > 0:
                return self.encode.base64encode(self.payload.payloads2[i])
        return 'fail'

    def testthree(self, url, index1, index2):
        url = url.strip('&')
        for i in range(0, self.payload.payloads3.__len__()):
            if self.network(url[0:index1 + 1] + self.payload.payloads3[i] +
                            url[index2:]).find(self.payload.payloads3[i]) > 0:
                return self.payload.payloads3[i] + url[index2:]
            if self.network(url[0:index1 + 1] +
                            self.encode.capsencode(self.payload.payloads3[i]) +
                            url[index2:]).find(
                                self.encode.capsencode(
                                    self.payload.payloads3[i])) > 0:
                return self.encode.capsencode(self.payload.payloads3[i])
            if self.network(url[0:index1 + 1] + self.encode.doubleencode(
                    self.payload.payloads3[i]) + url[index2:]).find(
                        self.payload.payloads3[i]) > 0:
                return self.encode.doubleencode(self.payload.payloads3[i])
            if self.network(url[0:index1 + 1] +
                            self.encode.htmlencode(self.payload.payloads3[i]) +
                            url[index2:]).find(self.payload.payloads3[i]) > 0:
                return self.encode.htmlencode(self.payload.payloads3[i])
            if self.network(url[0:index1 + 1] + self.encode.unicodeencode(
                    self.payload.payloads3[i]) + url[index2:]).find(
                        self.payload.payloads3[i]) > 0:
                return self.encode.unicodeencode(self.payload.payloads3[i])
            if self.network(url[0:index1 + 1] +
                            self.encode.urlencode(self.payload.payloads3[i]) +
                            url[index2:]).find(self.payload.payloads3[i]) > 0:
                return self.encode.urlencode(self.payload.payloads3[i])
            if self.network(url[0:index1 + 1] + self.encode.base64encode(
                    self.payload.payloads3[i]) + url[index2:]).find(
                        self.payload.payloads3[i]) > 0:
                return self.encode.base64encode(self.payload.payloads3[i])
        return 'fail'

    def testxss(self, minilock):
        # minilock.acquire()
        self.lock3.acquire()
        self.controlthread += 1
        if not self.urlqueue.empty():
            url = self.urlqueue.get()
        else:
            self.lock3.release()
            return
        self.lock3.release()
        url += '&'
        index2 = 0
        index3 = url.find('?')
        while True:
            index1 = url.find('=', index2 + 1)
            index2 = url.find('&', index2 + 1)
            if index3 != url.find('?'):
                index3 = index2
            if index1 > 0 and index2 > 0:
                if self.valid(url, index1, index2):
                    if self.typeone(url, index1, index2):
                        p = self.testone(url, index1, index2)
                        if p != 'fail':
                            self.lock4.acquire()
                            self.father.text3.insert(
                                "end", 'URL:' + url.strip('&') + '\n')
                            self.father.text3.insert(
                                "end", 'VAR:' + url[index3 + 1:index1] + '\n')
                            self.father.text3.insert("end",
                                                     'PAYLOAD:' + p + '\n')
                            self.father.text3.insert(
                                "end", 'XSSURL:' + url[0:index1 + 1] + p +
                                url[index2:].strip('&') + '\n')
                            self.father.text3.insert("end", '\n')
                            self.lock4.release()
                            continue
                    if self.typetwo(url, index1, index2):
                        p = self.testtwo(url, index1, index2)
                        if p != 'fail':
                            self.lock4.acquire()
                            self.father.text3.insert(
                                "end", 'URL:' + url.strip('&') + '\n')
                            self.father.text3.insert(
                                "end", 'VAR:' + url[index3 + 1:index1] + '\n')
                            self.father.text3.insert("end",
                                                     'PAYLOAD:' + p + '\n')
                            self.father.text3.insert(
                                "end", 'XSSURL:' + url[0:index1 + 1] + p +
                                url[index2:].strip('&') + '\n')
                            self.father.text3.insert("end", '\n')
                            self.lock4.release()
                            continue
                    '''if self.testthree(url, index1, index2):
                        p = self.testthree(url, index1, index2)
                        if p != 'fail':
                            self.lock4.acquire()
                            self.father.text3.insert("end", 'URL:' + url.strip('&') + '\n')
                            self.father.text3.insert("end", 'VAR:' + url[index3 + 1: index1] + '\n')
                            self.father.text3.insert("end", 'PAYLOAD:' + p + '\n')
                            self.father.text3.insert("end", 'XSSURL:' + url[0:index1 + 1] + p + url[index2:].strip('&') + '\n')
                            self.father.text3.insert("end", '\n')
                            self.lock4.release()
                            continue'''
            else:
                break
예제 #13
0
file_name: assignment4_b64.py

Must have the encode.py and decode.py classes for this to function.
The json file holding the base64 dict will be generated.

Nov 07 2019

"""
import base64
from encode import Encode
from decode import Decode
import json
import hashlib

en = Encode()
de = Decode()
"""
The dictionary below is here in case the json file is not present
in the directory.  This will ensure the table is present for the
Encode and Decode classes, but is not necessary to run the code.
"""
base64_dict = {
    0: "A",
    1: "B",
    2: "C",
    3: "D",
    4: "E",
    5: "F",
    6: "G",
    7: "H",