本文整理汇总了Python中w3af.core.data.request.fuzzable_request.FuzzableRequest.from_http_response方法的典型用法代码示例。如果您正苦于以下问题:Python FuzzableRequest.from_http_response方法的具体用法?Python FuzzableRequest.from_http_response怎么用?Python FuzzableRequest.from_http_response使用的例子?那么恭喜您, 这里精选的方法代码示例或许可以为您提供帮助。您也可以进一步了解该方法所在类w3af.core.data.request.fuzzable_request.FuzzableRequest
的用法示例。
在下文中一共展示了FuzzableRequest.from_http_response方法的5个代码示例,这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞,您的评价将有助于系统推荐出更棒的Python代码示例。
示例1: _do_request
# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_http_response [as 别名]
def _do_request(self, url, mutant):
"""
Perform a simple GET to see if the result is an error or not, and then
run the actual fuzzing.
"""
response = self._uri_opener.GET(
mutant, cache=True, headers=self._headers)
if not (is_404(response) or
response.get_code() in (403, 401) or
self._return_without_eval(mutant)):
# Create the fuzzable request and send it to the core
fr = FuzzableRequest.from_http_response(response)
self.output_queue.put(fr)
#
# Save it to the kb (if new)!
#
if response.get_url() not in self._seen and response.get_url().get_file_name():
desc = 'A potentially interesting file was found at: "%s".'
desc = desc % response.get_url()
i = Info('Potentially interesting file', desc, response.id,
self.get_name())
i.set_url(response.get_url())
kb.kb.append(self, 'files', i)
om.out.information(i.get_desc())
# Report only once
self._seen.add(response.get_url())
示例2: crawl
# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_http_response [as 别名]
def crawl(self, fuzzable_request):
"""
Get the sitemap.xml file and parse it.
:param fuzzable_request: A fuzzable_request instance that contains
(among other things) the URL to test.
"""
base_url = fuzzable_request.get_url().base_url()
sitemap_url = base_url.url_join('sitemap.xml')
response = self._uri_opener.GET(sitemap_url, cache=True)
if '</urlset>' in response and not is_404(response):
# Send response to core
fr = FuzzableRequest.from_http_response(response)
self.output_queue.put(fr)
om.out.debug('Parsing xml file with xml.dom.minidom.')
try:
dom = xml.dom.minidom.parseString(response.get_body())
except:
raise BaseFrameworkException('Error while parsing sitemap.xml')
else:
raw_url_list = dom.getElementsByTagName("loc")
parsed_url_list = []
for url in raw_url_list:
try:
url = url.childNodes[0].data
url = URL(url)
except ValueError, ve:
msg = 'Sitemap file had an invalid URL: "%s"'
om.out.debug(msg % ve)
except:
om.out.debug('Sitemap file had an invalid format')
示例3: _check_if_exists
# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_http_response [as 别名]
def _check_if_exists(self, web_shell_url):
"""
Check if the file exists.
:param web_shell_url: The URL to check
"""
try:
response = self._uri_opener.GET(web_shell_url, cache=True)
except BaseFrameworkException:
om.out.debug('Failed to GET webshell:' + web_shell_url)
else:
if self._is_possible_backdoor(response):
desc = 'A web backdoor was found at: "%s"; this could ' \
'indicate that the server has been compromised.'
desc = desc % response.get_url()
v = Vuln('Potential web backdoor', desc, severity.HIGH,
response.id, self.get_name())
v.set_url(response.get_url())
kb.kb.append(self, 'backdoors', v)
om.out.vulnerability(v.get_desc(), severity=v.get_severity())
fr = FuzzableRequest.from_http_response(response)
self.output_queue.put(fr)
示例4: _check_if_exists
# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_http_response [as 别名]
def _check_if_exists(self, web_shell_url):
"""
Check if the file exists.
:param web_shell_url: The URL to check
"""
try:
response = self._uri_opener.GET(web_shell_url, cache=True)
except BaseFrameworkException:
om.out.debug('Failed to GET webshell:' + web_shell_url)
else:
signature = self._match_signature(response)
if signature is None:
return
desc = (u'An HTTP response matching the web backdoor signature'
u' "%s" was found at: "%s"; this could indicate that the'
u' server has been compromised.')
desc %= (signature, response.get_url())
# It's probability is higher if we found a long signature
_severity = severity.HIGH if len(signature) > 8 else severity.MEDIUM
v = Vuln(u'Potential web backdoor', desc, _severity,
response.id, self.get_name())
v.set_url(response.get_url())
kb.kb.append(self, 'backdoors', v)
om.out.vulnerability(v.get_desc(), severity=v.get_severity())
fr = FuzzableRequest.from_http_response(response)
self.output_queue.put(fr)
示例5: is_404
# 需要导入模块: from w3af.core.data.request.fuzzable_request import FuzzableRequest [as 别名]
# 或者: from w3af.core.data.request.fuzzable_request.FuzzableRequest import from_http_response [as 别名]
# when scanning phpinfo in window box
# the problem is generating a lot of results
# due to all-the-same-for-windows files phpVersion.php, phpversion.php ..etc
# Well, how to solve it?
# Finding one phpinfo file is enough for auditing for the target
# So, we report every phpinfo file found
# but we do and report auditing once. Sounds logical?
#
# Feb/17/2009 by Andres Riancho:
# Yes, that sounds ok for me.
# Check if it's a phpinfo file
if not is_404(response):
# Create the fuzzable request and send it to the core
fr = FuzzableRequest.from_http_response(response)
self.output_queue.put(fr)
"""
|Modified|
old: regex_str = 'alt="PHP Logo" /></a><h1 class="p">PHP Version (.*?)</h1>'
new: regex_str = '(<tr class="h"><td>\n|alt="PHP Logo" /></a>)<h1 class="p">PHP Version (.*?)</h1>'
by aungkhant - I've been seeing phpinfo pages which don't print php logo image.
One example, ning.com.
"""
regex_str = '(<tr class="h"><td>\n|alt="PHP Logo" /></a>)<h1'\
' class="p">PHP Version (.*?)</h1>'
php_version = re.search(regex_str, response.get_body(), re.I)