Skip to content
This repository was archived by the owner on Aug 24, 2023. It is now read-only.

Commit 86a8b55

Browse files
author
root
committed
Updated
1 parent a4bed5d commit 86a8b55

File tree

7 files changed

+205
-0
lines changed

7 files changed

+205
-0
lines changed

‎19 bruteforce_login_form/extract_forms.py

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/usr/bin/python
2+
3+
import requests
4+
from BeautifulSoup import BeautifulSoup
5+
6+
def request(url):
7+
try:
8+
return requests.get(url)
9+
except requests.exceptions.ConnectionError:
10+
pass
11+
12+
target_url = "http://192.168.44.101/mutillidae/index.php?page=dns-lookup.php"
13+
response = request(target_url)
14+
15+
parsed_html = BeautifulSoup(response.content)
16+
forms_list = parsed_html.findAll("form")
17+
18+
for form in forms_list:
19+
print "Action: ",form.get("action")
20+
print "Method: ",form.get("method")
21+
print "EncType: ",form.get("enctype")
22+
print "ID: ",form.get("id")
23+
24+
25+
inputs_list = form.findAll("input")
26+
27+
for input in inputs_list:
28+
input_name = input.get("name")
29+
print "Name: ",input_name
30+

‎19 bruteforce_login_form/post.py renamed to ‎19 bruteforce_login_form/post_request.py

File renamed without changes.

‎19 bruteforce_login_form/posting_form.py

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/python
2+
3+
import requests
4+
from BeautifulSoup import BeautifulSoup
5+
import urlparse
6+
7+
def request(url):
8+
try:
9+
return requests.get(url)
10+
except requests.exceptions.ConnectionError:
11+
pass
12+
13+
target_url = "http://192.168.44.101/mutillidae/index.php?page=dns-lookup.php"
14+
response = request(target_url)
15+
16+
parsed_html = BeautifulSoup(response.content)
17+
forms_list = parsed_html.findAll("form")
18+
19+
for form in forms_list:
20+
action = form.get("action")
21+
post_url = urlparse.urljoin(target_url,action)
22+
print post_url
23+
method = form.get("method")
24+
25+
inputs_list = form.findAll("input")
26+
post_data = {}
27+
28+
for input in inputs_list:
29+
input_name = input.get("name")
30+
input_type = input.get("type")
31+
input_value = input.get("value")
32+
if input_type == "text":
33+
input_value = "test"
34+
35+
post_data[input_name] = input_value
36+
37+
result = requests.post(post_url,data=post_data)
38+
print result.content
39+

‎19 bruteforce_login_form/wwe

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
[<form action="index.php?page=dns-lookup.php" method="post" enctype="application/x-www-form-urlencoded" onsubmit="return onSubmitBlogEntry(this);" id="idDNSLookupForm">
2+
<table style="margin-left:auto; margin-right:auto;">
3+
<tr id="id-bad-cred-tr" style="display: none;">
4+
<td colspan="2" class="error-message">
5+
Error: Invalid Input
6+
</td>
7+
</tr>
8+
<tr><td></td></tr>
9+
<tr>
10+
<td colspan="2" class="form-header">Who would you like to do a DNS lookup on?<br /><br />Enter IP or hostname</td>
11+
</tr>
12+
<tr><td></td></tr>
13+
<tr>
14+
<td class="label">Hostname/IP</td>
15+
<td><input type="text" id="idTargetHostInput" name="target_host" size="20" /></td>
16+
</tr>
17+
<tr><td></td></tr>
18+
<tr>
19+
<td colspan="2" style="text-align:center;">
20+
<input name="dns-lookup-php-submit-button" class="button" type="submit" value="Lookup DNS" />
21+
</td>
22+
</tr>
23+
<tr><td></td></tr>
24+
<tr><td></td></tr>
25+
</table>
26+
</form>]

‎20 vulnerability_scanner/scanner.py

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#!/usr/bin/python
2+
3+
import requests
4+
import re
5+
import urlparse
6+
from BeautifulSoup import BeautifulSoup
7+
8+
class Scanner:
9+
def __init__(self,url,ignore_links):
10+
self.session = requests.Session()
11+
self.target_url = url
12+
self.target_links = []
13+
self.links_to_ignore = ignore_links
14+
15+
def extract_links_from(self,url):
16+
response = self.session.get(url)
17+
return re.findall('(?:href=")(.*?)"',response.content)
18+
19+
def crawl(self,url=None):
20+
if url == None:
21+
url = self.target_url
22+
href_links = self.extract_links_from(url)
23+
24+
for link in href_links:
25+
link = urlparse.urljoin(url,link)
26+
27+
if "#" in link: # #r refers to original page so avoid duplicate page again and again
28+
link = link.split("#")[0]
29+
30+
if self.target_url in link and link not in self.target_links and link not in self.links_to_ignore:
31+
#to avoid repeating the same url and ignore logout url
32+
self.target_links.append(link)
33+
print link
34+
self.crawl(link)
35+
36+
def extract_forms(self,url):
37+
response = self.session.get(url)
38+
parsed_html = BeautifulSoup(response.content)
39+
return parsed_html.findAll("form")
40+
41+
def submit_form(self,form,value,url):
42+
action = form.get("action")
43+
post_url = urlparse.urljoin(url,action)
44+
method = form.get("method")
45+
46+
inputs_list = form.findAll("input")
47+
post_data = {}
48+
49+
for input in inputs_list:
50+
input_name = input.get("name")
51+
input_type = input.get("type")
52+
input_value = input.get("value")
53+
if input_type == "text":
54+
input_value = value
55+
56+
post_data[input_name] = input_value
57+
if method == "post":
58+
return self.session.post(post_url,data=post_data)
59+
return self.session.get(post_url,params=post_data)
60+
61+
def run_scanner(self):
62+
for link in self.target_links:
63+
forms = self.extract_forms(link)
64+
for form in forms:
65+
print "[+] Testing form in " + link
66+
is_vulnerable_to_xss = self.test_xss_in_form(form,link)
67+
if is_vulnerable_to_xss:
68+
print "\n\n[***] XSS discovered in "+link+" in the follwing form"
69+
print form
70+
71+
72+
if "=" in link:
73+
print "\n\n[+] Testing " + link
74+
if_vulnerable_to_xss = self.test_xss_in_link(link)
75+
if is_vulnerable_to_xss:
76+
print "[***] Discovered XSS in " + link
77+
78+
def test_xss_in_link(self,url):
79+
xss_test_script = "<sCript>alert('test')</scriPt>"
80+
url = url.replace("=","="+ xss_test_script)
81+
response = self.session.get(url)
82+
83+
return xss_test_script in response.content
84+
85+
def test_xss_in_form(self,form,url):
86+
xss_test_script = "<sCript>alert('test')</scriPt>"
87+
response = self.submit_form(form,xss_test_script,url)
88+
return xss_test_script in response.content

‎20 vulnerability_scanner/scanner.pyc

3.53 KB
Binary file not shown.

‎20 vulnerability_scanner/vulnerability_scanner.py

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/usr/bin/python
2+
3+
import scanner
4+
5+
target_url = "http://192.168.44.101/dvwa/"
6+
links_to_ignore = ["http://192.168.44.101/dvwa/logout.php"]
7+
8+
data_dict = {"username":"admin","password":"password","Login":"submit"}
9+
10+
vuln_scanner = scanner.Scanner(target_url,links_to_ignore)
11+
vuln_scanner.session.post("http://192.168.44.101/dvwa/login.php",data=data_dict)
12+
13+
vuln_scanner.crawl()
14+
vuln_scanner.run_scanner()
15+
16+
#forms = vuln_scanner.extract_forms("http://192.168.44.101/dvwa/vulnerabilities/xss_r/")
17+
#print forms
18+
#response = vuln_scanner.test_xss_in_form(forms[0],"http://192.168.44.101/dvwa/vulnerabilities/xss_r/")
19+
#print response
20+
#response = vuln_scanner.test_xss_in_link("http://192.168.44.101/dvwa/vulnerabilities/xss_r/?name=")
21+
#print response
22+

0 commit comments

Comments
 (0)