laluka/bypass-url-parserTestet hunderte von URL-Bypass-Techniken gegen 40X-geschützte Seiten unter Verwendung von raw curl-Anfragen, mit Multi-Mode-Scanning, Header-Spoofing und JSON/HTML-Ergebnisexport zur Bewertung der Zugriffskontrolle.
Ein Tool, das VIELE URL-Bypässe testet, um eine 4xx-geschützte Seite zu erreichen.
Falls du dich fragst, warum dieser Code nichts weiter als ein schmutziger curl-Wrapper ist, hier die Gründe:
Das ist überraschend schwer in Python zu erreichen, ohne all die Annehmlichkeiten der Bibliothek wie Parsing und SSL/TLS-Kapselung zu verlieren.
Also mach es wie ich: Verwende curl als Backend; das wird schon gut gehen.
Das Tool kann auch als Bibliothek verwendet werden; siehe lib_sample_usage.py.
Wir empfehlen, dieses Tool mit pipx zu installieren:
pipx install bypass-url-parser
# Or, for the latest development version:
pipx install git+https://github.com/laluka/bypass-url-parser
Alternativ können Sie pip verwenden:
pip install bypass-url-parser
Bypass URL Parser, made with love by @TheLaluka
A tool that tests MANY URL bypasses to reach a 4xx-protected page.
Usage:
bypass-url-parser (-u <URL> | -R <file>) [-m <mode>] [-o <outdir>] [-S <level>] [ (-H <header>)...] [-r <num>]
[-s <ip>] [--spoofip-replace] [-p <port>] [--spoofport-replace] [-t <threads>] [-T <timeout>]
[--request-tls] [--jsonl] [--dump-payloads] [-x <proxy_url>] [-v | -d | -dd]
Program options:
-u, --url <URL> URL (path is optional) to run bypasses against
-R, --request <file> Load HTTP raw request from a file
-H, --header <header> Header(s) to use, format: "Cookie: can_i_haz=fire"
-m, --mode <mode> Bypass modes. See 'Bypasser.BYPASS_MODES' in code [Default: all]
-o, --outdir <outdir> Output directory for results
-x, --proxy <proxy_url> Set a proxy in the format http://proxy_ip:port.
-S, --save-level <level> Save results level. From 0 (DISABLE) to 3 (FULL) [Default: 2]
-s, --spoofip <ip> IP(s) to inject in ip-specific headers
-p, --spoofport <port> Port(s) to inject in port-specific headers
-r, --retry <num> Retry attempts for failed requests. Set 0 to disable retries [Default: 1]
-t, --threads <threads> Scan with N parallel threads [Default: 1]
-T, --timeout <timeout> Request times out after N seconds [Default: 5]
General options:
-h, --help Show help, you are here :)
-v, --verbose Verbose output
-d, --debug Show more details like curl commands generated by this tool
-dd, --debug Print debug level 2 (including class-level debug output)
-V, --version Show version info
Misc options:
--spoofip-replace Disable list of default internal IPs in 'http_headers_ip' bypass mode
--spoofport-replace Disable list of default internal ports in 'http_headers_port' bypass mode
--request-tls Force usage of TLS/HTTPS for the request load with the '-R, --request' option
--dump-payloads Print all payloads (curls) generated by this tool.
--jsonl Print results in JSON lines format (pipe command output)
Examples:
bypass-url-parser -u "http://127.0.0.1/juicy_403_endpoint/" -s 8.8.8.8 -d
bypass-url-parser -u /path/urls -t 30 -T 5 -H "Cookie: me_iz=admin" -H "User-agent: test"
bypass-url-parser -R /path/request_file --request-tls -m "mid_paths, end_paths"
HTTP-Statuscodes werden farbig dargestellt, wenn die Ausgabe in einem interaktiven Terminal angezeigt wird. Farben werden automatisch deaktiviert,
wenn die Ausgabe umgeleitet oder weitergeleitet wird, und können auch durch Setzen von NO_COLOR deaktiviert werden.
bypass-url-parser -u http://127.0.0.1:8000/foo/bar
2022-08-09 14:52:40 lalu-perso bup[361559] WARNING Trying to bypass 'http://127.0.0.1:8000/foo/bar' url (3213 payloads)...
2022-08-09 14:52:40 lalu-perso bup[361559] INFO Doing: 50 / 3213
[...]
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Doing: 3200 / 3213
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Retry (1/3) the '16' failed curl commands with 10 threads and 10s timeout
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Retry (2/3) the '16' failed curl commands with 5 threads and 20s timeout
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Retry (3/3) the '16' failed curl commands with 1 threads and 30s timeout
2022-08-09 14:52:55 lalu-perso bup[361559] INFO
[#####] [bypass_method] [payload] => [status_code] [content_type] [content_length] [lines_count] [word_counts] [title] [server] [redirect_url]
[GROUP (1587)] [original_request] [http://127.0.0.1:8000/foo/bar] => [404] [text/html] [469] [14] [95] [Error response] [SimpleHTTP/0.6 Python/3.8.10] []
[GROUP (10)] [http_methods] [-X CONNECT http://127.0.0.1:8000/foo/bar] => [501] [text/html] [500] [14] [96] [Error response] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000/???foo/bar] => [200] [text/html] [913] [26] [27] [Directory listing for /???foo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000//???foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/???foo/bar]
[SINGLE] [mid_paths] [http://127.0.0.1:8000/??foo/bar] => [200] [text/html] [911] [26] [27] [Directory listing for /??foo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000//??foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/??foo/bar]
[SINGLE] [mid_paths] [http://127.0.0.1:8000/?foo/bar] => [200] [text/html] [909] [26] [27] [Directory listing for /?foo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000//?foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/?foo/bar]
[SINGLE] [mid_paths] [http://127.0.0.1:8000///?anythingfoo/bar] => [200] [text/html] [929] [26] [27] [Directory listing for ///?anythingfoo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000////?anythingfoo/bar] => [200] [text/html] [931] [26] [27] [Directory listing for ////?anythingfoo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[GROUP (2)] [mid_paths] [http://127.0.0.1:8000/#?foo/bar] => [200] [text/html] [893] [26] [27] [Directory listing for /] [SimpleHTTP/0.6 Python/3.8.10] []
[GROUP (2)] [mid_paths] [http://127.0.0.1:8000//#?foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/]
# Deps
sudo apt install -y bat curl virtualenv python3
# Tool
virtualenv -p python3 .py3
source .py3/bin/activate
PDM_BUILD_SCM_VERSION="$(git describe --abbrev=0)-dev" pip install .
# To run directly from source:
python src/bypass_url_parser/__init__.py -u https://thinkloveshare.com/juicy_403_endpoint/
# After installation:
bypass-url-parser -u https://thinkloveshare.com/juicy_403_endpoint/
cat /tmp/tmpRANDOM-bypass-url-parser/triaged-bypass.json | jq -r '.results[].request_curl_cmd'
cat /tmp/tmpRANDOM-bypass-url-parser/triaged-bypass.json | jq -r '.results[].response_data'