本文整理汇总了Python中w3af.core.data.kb.info.Info.set_url方法的典型用法代码示例。如果您正苦于以下问题:Python Info.set_url方法的具体用法?Python Info.set_url怎么用?Python Info.set_url使用的例子?那么恭喜您, 这里精选的方法代码示例或许可以为您提供帮助。您也可以进一步了解该方法所在类w3af.core.data.kb.info.Info
的用法示例。
在下文中一共展示了Info.set_url方法的15个代码示例,这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞,您的评价将有助于系统推荐出更棒的Python代码示例。
示例1: _analyze_methods
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def _analyze_methods(self, url, allowed_methods, id_list):
# Check for DAV
if set(allowed_methods).intersection(self.DAV_METHODS):
# dav is enabled!
# Save the results in the KB so that other plugins can use this
# information
desc = 'The URL "%s" has the following allowed methods. These'\
' include DAV methods and should be disabled: %s'
desc = desc % (url, ', '.join(allowed_methods))
i = Info('DAV methods enabled', desc, id_list, self.get_name())
i.set_url(url)
i['methods'] = allowed_methods
kb.kb.append(self, 'dav-methods', i)
else:
# Save the results in the KB so that other plugins can use this
# information. Do not remove these information, other plugins
# REALLY use it !
desc = 'The URL "%s" has the following enabled HTTP methods: %s'
desc = desc % (url, ', '.join(allowed_methods))
i = Info('Allowed HTTP methods', desc, id_list, self.get_name())
i.set_url(url)
i['methods'] = allowed_methods
kb.kb.append(self, 'methods', i)
示例2: grep
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def grep(self, request, response):
"""
Check if HTTPS responses have the Strict-Transport-Security header set.
:param request: The HTTP request object.
:param response: The HTTP response object
:return: None, all results are saved in the kb.
"""
if self._reports > MAX_REPORTS:
return
if request.get_url().get_protocol() != 'https':
return
sts_header_value, _ = response.get_headers().iget(STS_HEADER, None)
if sts_header_value is not None:
return
self._reports += 1
desc = 'The web server uses HTTPS but does not set the '\
' Strict-Transport-Security header.'
i = Info('Missing Strict Transport Security header', desc,
response.id, self.get_name())
i.set_url(response.get_url())
i[STSInfoSet.ITAG] = response.get_url().get_domain()
self.kb_append_uniq_group(self, 'strict_transport_security', i,
group_klass=STSInfoSet)
示例3: _check_user_dir
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def _check_user_dir(self, mutated_url, user, user_desc, user_tag,
non_existent):
"""
Perform the request and compare with non_existent
:see _create_tests: For parameter description
:return: The HTTP response id if the mutated_url is a web user
directory, None otherwise.
"""
resp = self.http_get_and_parse(mutated_url)
path = mutated_url.get_path()
response_body = resp.get_body().replace(path, '')
if fuzzy_not_equal(response_body, non_existent, 0.7):
# Avoid duplicates
known_users = [u['user'] for u in kb.kb.get('user_dir', 'users')]
if user in known_users:
return
# Save the finding to the KB
desc = 'An operating system user directory was found at: "%s"'
desc = desc % resp.get_url()
i = Info('Web user home directory', desc, resp.id, self.get_name())
i.set_url(resp.get_url())
i['user'] = user
i['user_desc'] = user_desc
i['user_tag'] = user_tag
self.kb_append_uniq(self, 'users', i)
# Analyze if we can get more information from this finding
self._analyze_finding(i)
示例4: grep
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def grep(self, request, response):
"""
Plugin entry point.
:param request: The HTTP request object.
:param response: The HTTP response object
:return: None, all results are saved in the kb.
"""
if not response.is_text_or_html():
return
if not self.symfony_detected(response):
return
if self.has_csrf_token(response):
return
desc = ('The URL: "%s" seems to be generated by the Symfony framework'
' and contains a form that has CSRF protection disabled.')
desc %= response.get_url()
i = Info('Symfony Framework with CSRF protection disabled',
desc, response.id, self.get_name())
i.set_url(response.get_url())
self.kb_append_uniq(self, 'symfony', i, 'URL')
示例5: grep
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def grep(self, request, response):
"""
Check if all responses have X-Content-Type-Options header set
:param request: The HTTP request object.
:param response: The HTTP response object
:return: None, all results are saved in the kb.
"""
if self._reports > MAX_REPORTS:
return
ct_options_value, _ = response.get_headers().iget(CT_OPTIONS_HEADER, None)
if ct_options_value is not None:
if ct_options_value.strip().lower() == NOSNIFF:
return
self._reports += 1
desc = 'The URL "%s" returned an HTTP response without the' \
' recommended HTTP header X-Content-Type-Options'
desc %= response.get_url()
i = Info('Missing X-Content-Type-Options header', desc,
response.id, self.get_name())
i.set_url(response.get_url())
i[CTSniffingInfoSet.ITAG] = response.get_url().get_domain()
self.kb_append_uniq_group(self, 'content_sniffing', i,
group_klass=CTSniffingInfoSet)
示例6: grep
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def grep(self, request, response):
"""
Plugin entry point. Parse the object tags.
:param request: The HTTP request object.
:param response: The HTTP response object
:return: None
"""
url = response.get_url()
dom = response.get_dom()
if response.is_text_or_html() and dom is not None:
elem_list = self._tag_xpath(dom)
for element in elem_list:
tag_name = element.tag
desc = 'The URL: "%s" has an "%s" tag. We recommend you download'\
' the client side code and analyze it manually.'
desc = desc % (response.get_uri(), tag_name)
i = Info('Browser plugin content', desc, response.id,
self.get_name())
i.set_url(url)
i.add_to_highlight(tag_name)
self.kb_append_uniq(self, tag_name, i, 'URL')
示例7: grep
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def grep(self, request, response):
"""
Plugin entry point, verify if the HTML has a form with file uploads.
:param request: The HTTP request object.
:param response: The HTTP response object
:return: None
"""
if not response.is_text_or_html():
return
url = response.get_url()
for tag in mp_doc_parser.get_tags_by_filter(response, ('input',)):
input_type = tag.attrib.get('type', None)
if input_type is None:
continue
if input_type.lower() != 'file':
continue
msg = 'A form which allows file uploads was found at "%s"'
msg %= url
i = Info('File upload form', msg, response.id, self.get_name())
i.set_url(url)
self.kb_append_uniq(self, 'file_upload', i, 'URL')
示例8: grep
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def grep(self, request, response):
"""
Check if the header names are common or not
:param request: The HTTP request object.
:param response: The HTTP response object
:return: None, all results are saved in the kb.
"""
# Check for protocol anomalies
self._content_location_not_300(request, response)
# Check header names
for header_name in response.get_headers().keys():
if header_name.upper() in self.COMMON_HEADERS:
continue
# Create a new info object and save it to the KB
hvalue = response.get_headers()[header_name]
desc = 'The remote web server sent the HTTP header: "%s"'\
' with value: "%s", which is quite uncommon and'\
' requires manual analysis.'
desc = desc % (header_name, hvalue)
i = Info('Strange header', desc, response.id, self.get_name())
i.add_to_highlight(hvalue, header_name)
i.set_url(response.get_url())
i[StrangeHeaderInfoSet.ITAG] = header_name
i['header_value'] = hvalue
self.kb_append_uniq_group(self, 'strange_headers', i,
group_klass=StrangeHeaderInfoSet)
示例9: _fingerprint_data
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def _fingerprint_data(self, domain_path, wp_unique_url, response):
"""
Find wordpress version from data
"""
for wp_fingerprint in self._get_wp_fingerprints():
# The URL in the XML is relative AND it has two different variables
# that we need to replace:
# $wp-content$ -> wp-content/
# $wp-plugins$ -> wp-content/plugins/
path = wp_fingerprint.filepath
path = path.replace('$wp-content$', 'wp-content/')
path = path.replace('$wp-plugins$', 'wp-content/plugins/')
test_url = domain_path.url_join(path)
response = self._uri_opener.GET(test_url, cache=True)
response_hash = hashlib.md5(response.get_body()).hexdigest()
if response_hash == wp_fingerprint.hash:
version = wp_fingerprint.version
# Save it to the kb!
desc = 'WordPress version "%s" fingerprinted by matching known md5'\
' hashes to HTTP responses of static resources available at'\
' the remote WordPress install.'
desc = desc % version
i = Info('Fingerprinted Wordpress version', desc, response.id,
self.get_name())
i.set_url(test_url)
kb.kb.append(self, 'info', i)
om.out.information(i.get_desc())
break
示例10: _analyze_methods
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def _analyze_methods(self, url, _allowed_methods, id_list):
# Sometimes there are no allowed methods, which means that our plugin
# failed to identify any methods.
if not _allowed_methods:
return
# Check for DAV
elif set(_allowed_methods).intersection(self.DAV_METHODS):
# dav is enabled!
# Save the results in the KB so that other plugins can use this
# information
desc = ('The URL "%s" has the following allowed methods. These'
' include DAV methods and should be disabled: %s')
desc = desc % (url, ', '.join(_allowed_methods))
i = Info('DAV methods enabled', desc, id_list, self.get_name())
i.set_url(url)
i['methods'] = _allowed_methods
kb.kb.append(self, 'dav-methods', i)
else:
# Save the results in the KB so that other plugins can use this
# information. Do not remove these information, other plugins
# REALLY use it !
desc = 'The URL "%s" has the following enabled HTTP methods: %s'
desc = desc % (url, ', '.join(_allowed_methods))
i = Info('Allowed HTTP methods', desc, id_list, self.get_name())
i.set_url(url)
i['methods'] = _allowed_methods
kb.kb.append(self, 'methods', i)
示例11: grep
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def grep(self, request, response):
"""
Plugin entry point.
:param request: The HTTP request object.
:param response: The HTTP response object
:return: None, all results are saved in the kb.
"""
if not response.is_text_or_html():
return
url = response.get_url()
dom = response.get_dom()
# In some strange cases, we fail to normalize the document
if dom is None:
return
script_elements = self._script_xpath(dom)
for element in script_elements:
# returns the text between <script> and </script>
script_content = element.text
if script_content is not None:
res = self._ajax_regex_re.search(script_content)
if res:
desc = 'The URL: "%s" has AJAX code.' % url
i = Info('AJAX code', desc, response.id,
self.get_name())
i.set_url(url)
i.add_to_highlight(res.group(0))
self.kb_append_uniq(self, 'ajax', i, 'URL')
示例12: _match_cookie_fingerprint
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def _match_cookie_fingerprint(self, request, response, cookie_obj):
"""
Now we analyze the cookie and try to guess the remote web server or
programming framework based on the cookie that was sent.
:return: True if the cookie was fingerprinted
"""
cookie_obj_str = cookie_obj.output(header='')
for cookie_str_db, system_name in self.COOKIE_FINGERPRINT:
if cookie_str_db in cookie_obj_str:
if system_name not in self._already_reported_server:
desc = 'A cookie matching the cookie fingerprint DB'\
' has been found when requesting "%s".'\
' The remote platform is: "%s".'
desc = desc % (response.get_url(), system_name)
i = Info('Identified cookie', desc,
response.id, self.get_name())
i.set_url(response.get_url())
i['httpd'] = system_name
self._set_cookie_to_rep(i, cobj=cookie_obj)
kb.kb.append(self, 'security', i)
self._already_reported_server.append(system_name)
return True
return False
示例13: discover
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def discover(self, fuzzable_request):
"""
:param fuzzable_request: A fuzzable_request instance that contains
(among other things) the URL to test.
"""
root_domain = fuzzable_request.get_url().get_root_domain()
pks_se = pks(self._uri_opener)
results = pks_se.search(root_domain)
pks_url = 'http://pgp.mit.edu:11371/'
for result in results:
mail = result.username + '@' + root_domain
desc = 'The mail account: "%s" was found at: "%s".'
desc = desc % (mail, pks_url)
i = Info('Email account', desc, result.id, self.get_name())
i.set_url(URL(pks_url))
i['mail'] = mail
i['user'] = result.username
i['name'] = result.name
i['url_list'] = {URL(pks_url)}
kb.kb.append('emails', 'emails', i)
om.out.information(i.get_desc())
示例14: _analyze_author
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def _analyze_author(self, response, frontpage_author):
"""
Analyze the author URL.
:param response: The http response object for the _vti_inf file.
:param frontpage_author: A regex match object.
:return: None. All the info is saved to the kb.
"""
author_location = response.get_url().get_domain_path().url_join(
frontpage_author.group(1))
# Check for anomalies in the location of author.exe
if frontpage_author.group(1) != '_vti_bin/_vti_aut/author.exe':
name = 'Customized frontpage configuration'
desc = 'The FPAuthorScriptUrl is at: "%s" instead of the default'\
' location: "/_vti_bin/_vti_adm/author.exe". This is very'\
' uncommon.'
desc = desc % author_location
else:
name = 'FrontPage FPAuthorScriptUrl'
desc = 'The FPAuthorScriptUrl is at: "%s".'
desc = desc % author_location
i = Info(name, desc, response.id, self.get_name())
i.set_url(author_location)
i['FPAuthorScriptUrl'] = author_location
kb.kb.append(self, 'frontpage_version', i)
om.out.information(i.get_desc())
示例15: grep
# 需要导入模块: from w3af.core.data.kb.info import Info [as 别名]
# 或者: from w3af.core.data.kb.info.Info import set_url [as 别名]
def grep(self, request, response):
"""
Analyze if the HTTP response reason messages are strange.
:param request: The HTTP request object.
:param response: The HTTP response object
:return: None, all results are saved in the kb.
"""
response_code = response.get_code()
msg_list = W3C_REASONS.get(response_code, None)
if msg_list is None:
return
response_reason = response.get_msg().lower()
if response_reason in msg_list:
# It's common, nothing to do here.
return
# Create a new info object from scratch and save it to the kb:
desc = "The remote Web server sent a strange HTTP reason" 'message "%s", manual inspection is recommended.'
desc = desc % response.get_msg()
i = Info("Strange HTTP Reason message", desc, response.id, self.get_name())
i.set_url(response.get_url())
i.add_to_highlight(response.get_msg())
i[StrangeHeaderInfoSet.ITAG] = response.get_msg()
self.kb_append_uniq_group(self, "strange_reason", i, group_klass=StrangeHeaderInfoSet)