<s> from tornado . httputil import HTTPHeaders <EOL> from tornado . httpclient import HTTPRequest <EOL> from framework . http . wafbypasser . core . hpp_lib import asp_hpp , param_overwrite <EOL> from framework . http . wafbypasser . core . placeholder_length import find_length <EOL> from framework . http . wafbypasser . core . detection import * <EOL> from framework . http . wafbypasser . core . argument_parser import get_args <EOL> from framework . http . wafbypasser . core . fuzzer import Fuzzer <EOL> from framework . http . wafbypasser . core . helper import load_payload_file , Error <EOL> from framework . http . wafbypasser . core . http_helper import HTTPHelper <EOL> from framework . http . wafbypasser . core . param_source_detector import detect_accepted_sources <EOL> from framework . http . wafbypasser . core . response_analyzer import analyze_responses , print_request , print_response , analyze_chars , analyze_encoded_chars , analyze_accepted_sources <EOL> from framework . http . wafbypasser . core . placeholder_manager import PlaceholderManager <EOL> from framework . http . wafbypasser . core . obfuscation_lib import unicode_urlencode , urlencode , transformations_info <EOL> import string <EOL> class WAFBypasser : <EOL> def fuzz ( self , args , requests ) : <EOL> if args [ "<STR_LIT>" ] or args [ "<STR_LIT>" ] : <EOL> delay = args [ "<STR_LIT>" ] or <NUM_LIT:0> <EOL> follow_cookies = args [ "<STR_LIT>" ] or False <EOL> print "<STR_LIT>" <EOL> responses = self . fuzzer . sync_fuzz ( requests , delay , follow_cookies ) <EOL> else : <EOL> print "<STR_LIT>" + str ( len ( requests ) ) <EOL> print "<STR_LIT>" <EOL> responses = self . fuzzer . async_fuzz ( requests ) <EOL> print "<STR_LIT>" <EOL> return responses <EOL> def is_detection_set ( self , args ) : <EOL> det_functions = [ "<STR_LIT>" , "<STR_LIT>" , "<STR_LIT>" ] <EOL> args_set = False <EOL> for name in det_functions : <EOL> if args [ name ] is not None : <EOL> return <EOL> Error ( self . owtf , "<STR_LIT>" ) <EOL> def require ( self , args , params ) : <EOL> param_missing = False <EOL> for param in params : <EOL> if args [ param ] is None : <EOL> param_missing = True <EOL> print "<STR_LIT>" + param <EOL> if param_missing : <EOL> Error ( self . owtf , "<STR_LIT>" ) <EOL> def __init__ ( self , owtf ) : <EOL> self . ua = "<STR_LIT>" "<STR_LIT>" <EOL> self . init_request = HTTPRequest ( "<STR_LIT>" , <EOL> auth_username = None , <EOL> auth_password = None , <EOL> follow_redirects = True , <EOL> max_redirects = <NUM_LIT:10> , <EOL> allow_nonstandard_methods = True , <EOL> headers = None , <EOL> proxy_host = None , <EOL> proxy_port = None , <EOL> proxy_username = None , <EOL> proxy_password = None , <EOL> user_agent = self . ua , <EOL> request_timeout = <NUM_LIT> ) <EOL> self . sig = "<STR_LIT>" <EOL> self . length_signature = self . sig + "<STR_LIT>" + self . sig <EOL> self . fsig = self . sig + "<STR_LIT>" + self . sig <EOL> self . template_signature_re = self . sig + "<STR_LIT>" + self . sig + "<STR_LIT>" <EOL> self . template_signature_re += self . sig <EOL> self . detection_struct = [ ] <EOL> self . pm = None <EOL> self . http_helper = None <EOL> self . fuzzer = None <EOL> self . owtf = owtf <EOL> def init_methods ( self , args ) : <EOL> methods = args [ "<STR_LIT>" ] or [ ] <EOL> if methods : <EOL> if self . sig + "<STR_LIT:all>" + self . sig in methods : <EOL> methods . remove ( self . sig + "<STR_LIT:all>" + self . sig ) <EOL> methods . extend ( <EOL> load_payload_file ( "<STR_LIT>" ) ) <EOL> methods = list ( set ( methods ) ) <EOL> else : <EOL> if args [ "<STR_LIT:data>" ] is None : <EOL> methods . append ( "<STR_LIT:GET>" ) <EOL> else : <EOL> methods . append ( "<STR_LIT:POST>" ) <EOL> return methods <EOL> def init_headers ( self , args ) : <EOL> headers = HTTPHeaders ( ) <EOL> if args [ "<STR_LIT>" ] : <EOL> for header in args [ "<STR_LIT>" ] : <EOL> values = header . split ( '<STR_LIT::>' , <NUM_LIT:1> ) <EOL> if len ( values ) == <NUM_LIT:2> : <EOL> headers . add ( * values ) <EOL> else : <EOL> headers . add ( values [ <NUM_LIT:0> ] , "<STR_LIT>" ) <EOL> if args [ "<STR_LIT>" ] : <EOL> headers . add ( "<STR_LIT>" , args [ "<STR_LIT>" ] ) <EOL> return headers <EOL> def init_detection_struct ( self , args ) : <EOL> if args [ "<STR_LIT>" ] : <EOL> detection_args = { } <EOL> detection_args [ "<STR_LIT>" ] = args [ "<STR_LIT>" ] [ <NUM_LIT:0> ] <EOL> detection_args [ "<STR_LIT>" ] = "<STR_LIT>" in args [ "<STR_LIT>" ] [ <NUM_LIT:1> : ] <EOL> detection_args [ "<STR_LIT>" ] = False <EOL> if args [ "<STR_LIT>" ] : <EOL> detection_args [ "<STR_LIT>" ] = True <EOL> self . detection_struct . append ( { "<STR_LIT>" : contains , <EOL> "<STR_LIT>" : detection_args , <EOL> "<STR_LIT:info>" : "<STR_LIT>" } ) <EOL> if args [ "<STR_LIT>" ] : <EOL> detection_args = { } <EOL> detection_args [ "<STR_LIT>" ] = args [ "<STR_LIT>" ] [ <NUM_LIT:0> ] <EOL> detection_args [ "<STR_LIT>" ] = False <EOL> if args [ "<STR_LIT>" ] : <EOL> detection_args [ "<STR_LIT>" ] = True <EOL> self . detection_struct . append ( { "<STR_LIT>" : resp_code_detection , <EOL> "<STR_LIT>" : detection_args , <EOL> "<STR_LIT:info>" : "<STR_LIT>" } ) <EOL> if args [ "<STR_LIT>" ] : <EOL> detection_args = { } <EOL> detection_args [ "<STR_LIT:time>" ] = args [ "<STR_LIT>" ] [ <NUM_LIT:0> ] <EOL> detection_args [ "<STR_LIT>" ] = False <EOL> if args [ "<STR_LIT>" ] : <EOL> detection_args [ "<STR_LIT>" ] = True <EOL> self . detection_struct . append ( { "<STR_LIT>" : resp_time_detection , <EOL> "<STR_LIT>" : detection_args , <EOL> "<STR_LIT:info>" : "<STR_LIT>" } ) <EOL> def start ( self , args ) : <EOL> self . sig = args [ "<STR_LIT>" ] or self . sig <EOL> self . pm = PlaceholderManager ( self . sig ) <EOL> target = args [ "<STR_LIT:target>" ] <EOL> methods = self . init_methods ( args ) <EOL> headers = self . init_headers ( args ) <EOL> data = args [ "<STR_LIT:data>" ] or "<STR_LIT>" <EOL> self . init_detection_struct ( args ) <EOL> self . init_request . headers = headers <EOL> self . http_helper = HTTPHelper ( self . init_request ) <EOL> self . fuzzer = Fuzzer ( self . http_helper ) <EOL> if args [ "<STR_LIT>" ] == "<STR_LIT>" : <EOL> self . require ( args , [ "<STR_LIT>" ] ) <EOL> self . is_detection_set ( args ) <EOL> if len ( methods ) > <NUM_LIT:1> : <EOL> Error ( self . owtf , "<STR_LIT>" ) <EOL> print "<STR_LIT>" <EOL> ch = args [ "<STR_LIT>" ] [ <NUM_LIT:0> ] <EOL> length = find_length ( self . owtf , <EOL> self . http_helper , <EOL> self . length_signature , <EOL> target , <EOL> methods [ <NUM_LIT:0> ] , <EOL> self . detection_struct , <EOL> ch , <EOL> headers , <EOL> data ) <EOL> print "<STR_LIT>" + str ( length ) <EOL> elif args [ "<STR_LIT>" ] == "<STR_LIT>" : <EOL> self . is_detection_set ( args ) <EOL> self . require ( args , [ "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" , <EOL> "<STR_LIT>" ] ) <EOL> if len ( methods ) > <NUM_LIT:1> : <EOL> Error ( self . owtf , "<STR_LIT>" ) <EOL> print "<STR_LIT>" <EOL> accepted_method = methods [ <NUM_LIT:0> ] <EOL> param_name = args [ "<STR_LIT>" ] <EOL> accepted_value = args [ "<STR_LIT>" ] <EOL> param_source = args [ "<STR_LIT>" ] <EOL> requests = detect_accepted_sources ( self . http_helper , <EOL> target , <EOL> data , <EOL> headers , <EOL> param_name , <EOL> param_source , <EOL> accepted_value , <EOL> accepted_method ) <EOL> responses = self . fuzz ( args , requests ) <EOL> analyze_accepted_sources ( responses , self . detection_struct ) <EOL> elif args [ "<STR_LIT>" ] == "<STR_LIT>" : <EOL> print "<STR_LIT>" <EOL> cnt_types = load_payload_file ( "<STR_LIT>" ) <EOL> new_headers = self . http_helper . add_header_param ( <EOL> headers , <EOL> "<STR_LIT:Content-Type>" , self . fsig ) <EOL> self . pm = PlaceholderManager ( self . sig ) <EOL> requests = self . pm . transformed_http_requests ( <EOL> self . http_helper , <EOL> methods , <EOL> target , <EOL> cnt_types , <EOL> new_headers , <EOL> data ) <EOL> responses = self . fuzz ( args , requests ) <EOL> for response in responses : <EOL> print "<STR_LIT>" <EOL> print_request ( response ) <EOL> print "<STR_LIT>" <EOL> print_response ( response ) <EOL> print <EOL> elif args [ "<STR_LIT>" ] == "<STR_LIT>" or args [ "<STR_LIT>" ] == "<STR_LIT>" : <EOL> self . require ( args , [ "<STR_LIT>" , "<STR_LIT>" , "<STR_LIT>" ] ) <EOL> param_name = args [ "<STR_LIT>" ] <EOL> param_source = args [ "<STR_LIT>" ] <EOL> self . is_detection_set ( args ) <EOL> payloads = [ ] <EOL> for p_file in args [ "<STR_LIT>" ] : <EOL> payloads += load_payload_file ( p_file ) <EOL> if args [ "<STR_LIT>" ] == "<STR_LIT>" : <EOL> print "<STR_LIT>" <EOL> requests = asp_hpp ( self . http_helper , <EOL> methods , <EOL> payloads , <EOL> param_name , <EOL> param_source , <EOL> target , <EOL> headers , <EOL> data ) <EOL> responses = self . fuzz ( args , requests ) <EOL> elif args [ "<STR_LIT>" ] == "<STR_LIT>" : <EOL> requests = param_overwrite ( self . http_helper , <EOL> param_name , <EOL> param_source , <EOL> payloads [ <NUM_LIT:0> ] , <EOL> target , <EOL> data , <EOL> headers ) <EOL> responses = self . fuzz ( args , requests ) <EOL> analyze_responses ( responses , <EOL> self . http_helper , <EOL> self . detection_struct ) <EOL> elif args [ "<STR_LIT>" ] == "<STR_LIT>" : <EOL> self . is_detection_set ( args ) <EOL> payloads = [ ] <EOL> for i in range ( <NUM_LIT:0> , <NUM_LIT> ) : <EOL> payloads . append ( chr ( i ) ) <EOL> requests = self . pm . transformed_http_requests ( self . http_helper , <EOL> methods , <EOL> target , <EOL> payloads , <EOL> headers , <EOL> data ) <EOL> responses = self . fuzz ( args , requests ) <EOL> sent_payloads = analyze_chars ( responses , <EOL> self . http_helper , <EOL> self . detection_struct ) <EOL> payloads = [ ] <EOL> if sent_payloads [ "<STR_LIT>" ] : <EOL> print <EOL> print "<STR_LIT>" <EOL> for bad_char in sent_payloads [ "<STR_LIT>" ] : <EOL> payloads . append ( urlencode ( bad_char ) ) <EOL> requests = self . pm . transformed_http_requests ( self . http_helper , <EOL> methods , <EOL> target , <EOL> payloads , <EOL> headers , <EOL> data ) <EOL> responses = self . fuzz ( args , requests ) <EOL> analyze_encoded_chars ( responses , <EOL> self . http_helper , <EOL> self . detection_struct ) <EOL> print <EOL> print "<STR_LIT>" <EOL> payloads = [ ] <EOL> for bad_char in sent_payloads [ "<STR_LIT>" ] : <EOL> payloads . append ( unicode_urlencode ( bad_char ) ) <EOL> requests = self . pm . transformed_http_requests ( self . http_helper , <EOL> methods , <EOL> target , <EOL> payloads , <EOL> headers , <EOL> data ) <EOL> responses = self . fuzz ( args , requests ) <EOL> analyze_encoded_chars ( responses , <EOL> self . http_helper , <EOL> self . detection_struct ) <EOL> good_char = None <EOL> for char in string . letters : <EOL> good_char = char <EOL> break <EOL> if not good_char : <EOL> for char in string . digits : <EOL> good_char = char <EOL> break <EOL> if not good_char : <EOL> good_char = sent_payloads [ "<STR_LIT>" ] [ <NUM_LIT:0> ] <EOL> print <EOL> print "<STR_LIT>" <EOL> payloads = [ ] <EOL> for bad_char in sent_payloads [ "<STR_LIT>" ] : <EOL> payloads . append ( bad_char + good_char ) <EOL> requests = self . pm . transformed_http_requests ( self . http_helper , <EOL> methods , <EOL> target , <EOL> payloads , <EOL> headers , <EOL> data ) <EOL> responses = self . fuzz ( args , requests ) <EOL> analyze_encoded_chars ( responses , <EOL> self . http_helper , <EOL> self . detection_struct ) <EOL> print <EOL> print "<STR_LIT>" <EOL> payloads = [ ] <EOL> for bad_char in sent_payloads [ "<STR_LIT>" ] : <EOL> payloads . append ( good_char + bad_char ) <EOL> requests = self . pm . transformed_http_requests ( self . http_helper , <EOL> methods , <EOL> target , <EOL> payloads , <EOL> headers , <EOL> data ) <EOL> responses = self . fuzz ( args , requests ) <EOL> analyze_encoded_chars ( responses , <EOL> self . http_helper , <EOL> self . detection_struct ) <EOL> print "<STR_LIT>" <EOL> payloads = [ ] <EOL> for bad_char in sent_payloads [ "<STR_LIT>" ] : <EOL> payloads . append ( bad_char + good_char ) <EOL> requests = self . pm . transformed_http_requests ( self . http_helper , <EOL> methods , <EOL> target , <EOL> payloads , <EOL> headers , <EOL> data ) <EOL> responses = self . fuzz ( args , requests ) <EOL> analyze_encoded_chars ( responses , <EOL> self . http_helper , <EOL> self . detection_struct ) <EOL> print "<STR_LIT>" <EOL> payloads = [ ] <EOL> for bad_char in sent_payloads [ "<STR_LIT>" ] : <EOL> payloads . append ( good_char + bad_char + good_char ) <EOL> requests = self . pm . transformed_http_requests ( self . http_helper , <EOL> methods , <EOL> target , <EOL> payloads , <EOL> headers , <EOL> data ) <EOL> responses = self . fuzz ( args , requests ) <EOL> analyze_encoded_chars ( responses , <EOL> self . http_helper , <EOL> self . detection_struct ) <EOL> elif args [ "<STR_LIT>" ] == "<STR_LIT>" : <EOL> fuzzing_placeholders = PlaceholderManager . get_placeholder_number ( <EOL> self . template_signature_re , str ( args ) ) <EOL> if fuzzing_placeholders > <NUM_LIT:1> : <EOL> Error ( self . owtf , "<STR_LIT>" <EOL> "<STR_LIT>" ) <EOL> elif fuzzing_placeholders == <NUM_LIT:0> : <EOL> Error ( self . owtf , "<STR_LIT>" ) <EOL> self . is_detection_set ( args ) <EOL> payloads = [ ] <EOL> if args [ "<STR_LIT>" ] : <EOL> for p_file in args [ "<STR_LIT>" ] : <EOL> payloads += load_payload_file ( p_file ) <EOL> else : <EOL> payloads . append ( "<STR_LIT>" ) <EOL> print "<STR_LIT>" <EOL> requests = self . pm . transformed_http_requests ( self . http_helper , <EOL> methods , <EOL> target , <EOL> payloads , <EOL> headers , <EOL> data ) <EOL> responses = self . fuzz ( args , requests ) <EOL> analyze_responses ( responses , <EOL> self . http_helper , <EOL> self . detection_struct ) <EOL> elif args [ "<STR_LIT>" ] == "<STR_LIT>" : <EOL> print transformations_info ( ) <EOL> elif args [ "<STR_LIT>" ] == "<STR_LIT>" : <EOL> self . require ( args , [ "<STR_LIT>" , "<STR_LIT>" ] ) <EOL> length = int ( args [ "<STR_LIT>" ] [ <NUM_LIT:0> ] ) <EOL> accepted_value = args [ "<STR_LIT>" ] [ <NUM_LIT:0> ] <EOL> payloads = [ ] <EOL> for p_file in args [ "<STR_LIT>" ] : <EOL> payloads += load_payload_file ( p_file ) <EOL> payloads = [ ( length - len ( payload ) ) * accepted_value + payload <EOL> for payload in payloads ] <EOL> requests = self . pm . transformed_http_requests ( self . http_helper , <EOL> methods , <EOL> target , <EOL> payloads , <EOL> headers , <EOL> data ) <EOL> responses = self . fuzz ( args , requests ) <EOL> analyze_responses ( responses , <EOL> self . http_helper , <EOL> self . detection_struct ) <EOL> else : <EOL> Error ( self . owtf , "<STR_LIT>" ) <EOL> if __name__ == "<STR_LIT:__main__>" : <EOL> wafbypasser = WAFBypasser ( ) <EOL> arguments = get_args ( ) <EOL> wafbypasser . start ( arguments ) </s>
