text: #!/usr/bin/python 2 3 import sys 4 import getopt 5 import httplib2 6 7 # Try to get url from server 8 def surf(url, query): 9 print "GET " + query 10 11 try: 12 response, content = web_client.request(url) 13 14 if response.status == 200: 15 print "FOUND " + query 16 except httplib2.ServerNotFoundError: 17 print "Got error for " + url + \ 18 ": Server not found" 19 sys.exit(1) 20 21 22 # Dictionary file 23 query_file = "web-queries.txt" 24 25 # Target http server and port
  94 7 HTTP Hacks
  26 host = "localhost" 27 port = 80 28 29 # Run in file mode? 30 file_mode = False 31 32 # Parsing parameter 33 try: 34 cmd_opts = "f:Fh:p:" 35 opts, args = getopt.getopt(sys.argv[1:], cmd_opts) 36 except getopt.GetoptError: 37 print sys.argv[0] + """ 38 -f <query_file> 39 -F(ile_mode) 40 -h <host> 41 -p <port>""" 42 sys.exit(0) 43 44 for opt in opts: 45 if opt[0] == "-f": 46 query_file = opt[1] 47 elif opt[0] == "-F": 48 file_mode = True 49 elif opt[0] == "-h": 50 host = opt[1] 51 elif opt[0] == "-p": 52 port = opt[1] 53 54 if port == 443: 55 url = "https://" + host 56 elif port != 80: 57 url = "http://" + host + ":" + port 58 else: 59 url = "http://" + host 60 61 # This pattern will be added to each query 62 salts = (’~’, ’~1’, ’.back’, ’.bak’, 63 ’.old’, ’.orig’, ’_backup’) 64 65 # Get a web browser object 66 web_client = httplib2.Http() 67 68 # Read dictionary and handle each query 69 for query in open(query_file): 70 query = query.strip("\n")
  7.9 SQL Injection 95
  71 72 # Try dictionary traversal 73 for dir_sep in [’/’, ’//’, ’/test/../’]: 74 url += dir_sep + query 75 76 if file_mode: 77 for salt in salts: 78 url += salt 79 surf(url, 80 dir_sep + query + salt) 81 else: 82 surf(url, dir_sep + query)
  