laluka/bypass-url-parserPrueba cientos de técnicas de omisión de URL contra páginas protegidas por 40X usando solicitudes curl sin procesar, con escaneo multimodo, suplantación de encabezados y exportación de resultados en JSON/HTML para la evaluación del control de acceso.
Una herramienta que prueba MUCHOS bypasses de URL para alcanzar una página protegida con 4xx.
Si te preguntas por qué este código es nada más que un sucio wrapper de curl, aquí está el motivo:
Esto es sorprendentemente difícil de lograr en Python sin perder todas las bondades de la librería, como el parseo y la encapsulación SSL/TLS.
Así que, haz como yo: usa curl como backend; va a estar bien.
La herramienta también puede usarse como librería; consulta lib_sample_usage.py.
Recomendamos usar pipx para instalar esta herramienta:
pipx install bypass-url-parser
# Or, for the latest development version:
pipx install git+https://github.com/laluka/bypass-url-parser
Alternativamente, puedes usar pip:
pip install bypass-url-parser
Bypass URL Parser, made with love by @TheLaluka
A tool that tests MANY URL bypasses to reach a 4xx-protected page.
Usage:
bypass-url-parser (-u <URL> | -R <file>) [-m <mode>] [-o <outdir>] [-S <level>] [ (-H <header>)...] [-r <num>]
[-s <ip>] [--spoofip-replace] [-p <port>] [--spoofport-replace] [-t <threads>] [-T <timeout>]
[--request-tls] [--jsonl] [--dump-payloads] [-x <proxy_url>] [-v | -d | -dd]
Program options:
-u, --url <URL> URL (path is optional) to run bypasses against
-R, --request <file> Load HTTP raw request from a file
-H, --header <header> Header(s) to use, format: "Cookie: can_i_haz=fire"
-m, --mode <mode> Bypass modes. See 'Bypasser.BYPASS_MODES' in code [Default: all]
-o, --outdir <outdir> Output directory for results
-x, --proxy <proxy_url> Set a proxy in the format http://proxy_ip:port.
-S, --save-level <level> Save results level. From 0 (DISABLE) to 3 (FULL) [Default: 2]
-s, --spoofip <ip> IP(s) to inject in ip-specific headers
-p, --spoofport <port> Port(s) to inject in port-specific headers
-r, --retry <num> Retry attempts for failed requests. Set 0 to disable retries [Default: 1]
-t, --threads <threads> Scan with N parallel threads [Default: 1]
-T, --timeout <timeout> Request times out after N seconds [Default: 5]
General options:
-h, --help Show help, you are here :)
-v, --verbose Verbose output
-d, --debug Show more details like curl commands generated by this tool
-dd, --debug Print debug level 2 (including class-level debug output)
-V, --version Show version info
Misc options:
--spoofip-replace Disable list of default internal IPs in 'http_headers_ip' bypass mode
--spoofport-replace Disable list of default internal ports in 'http_headers_port' bypass mode
--request-tls Force usage of TLS/HTTPS for the request load with the '-R, --request' option
--dump-payloads Print all payloads (curls) generated by this tool.
--jsonl Print results in JSON lines format (pipe command output)
Examples:
bypass-url-parser -u "http://127.0.0.1/juicy_403_endpoint/" -s 8.8.8.8 -d
bypass-url-parser -u /path/urls -t 30 -T 5 -H "Cookie: me_iz=admin" -H "User-agent: test"
bypass-url-parser -R /path/request_file --request-tls -m "mid_paths, end_paths"
Los códigos de estado HTTP se colorean cuando la salida se muestra en una terminal interactiva. Los colores se desactivan automáticamente
cuando la salida se redirige o se canaliza, y también se pueden desactivar configurando NO_COLOR.
bypass-url-parser -u http://127.0.0.1:8000/foo/bar
2022-08-09 14:52:40 lalu-perso bup[361559] WARNING Trying to bypass 'http://127.0.0.1:8000/foo/bar' url (3213 payloads)...
2022-08-09 14:52:40 lalu-perso bup[361559] INFO Doing: 50 / 3213
[...]
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Doing: 3200 / 3213
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Retry (1/3) the '16' failed curl commands with 10 threads and 10s timeout
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Retry (2/3) the '16' failed curl commands with 5 threads and 20s timeout
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Retry (3/3) the '16' failed curl commands with 1 threads and 30s timeout
2022-08-09 14:52:55 lalu-perso bup[361559] INFO
[#####] [bypass_method] [payload] => [status_code] [content_type] [content_length] [lines_count] [word_counts] [title] [server] [redirect_url]
[GROUP (1587)] [original_request] [http://127.0.0.1:8000/foo/bar] => [404] [text/html] [469] [14] [95] [Error response] [SimpleHTTP/0.6 Python/3.8.10] []
[GROUP (10)] [http_methods] [-X CONNECT http://127.0.0.1:8000/foo/bar] => [501] [text/html] [500] [14] [96] [Error response] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000/???foo/bar] => [200] [text/html] [913] [26] [27] [Directory listing for /???foo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000//???foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/???foo/bar]
[SINGLE] [mid_paths] [http://127.0.0.1:8000/??foo/bar] => [200] [text/html] [911] [26] [27] [Directory listing for /??foo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000//??foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/??foo/bar]
[SINGLE] [mid_paths] [http://127.0.0.1:8000/?foo/bar] => [200] [text/html] [909] [26] [27] [Directory listing for /?foo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000//?foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/?foo/bar]
[SINGLE] [mid_paths] [http://127.0.0.1:8000///?anythingfoo/bar] => [200] [text/html] [929] [26] [27] [Directory listing for ///?anythingfoo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000////?anythingfoo/bar] => [200] [text/html] [931] [26] [27] [Directory listing for ////?anythingfoo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[GROUP (2)] [mid_paths] [http://127.0.0.1:8000/#?foo/bar] => [200] [text/html] [893] [26] [27] [Directory listing for /] [SimpleHTTP/0.6 Python/3.8.10] []
[GROUP (2)] [mid_paths] [http://127.0.0.1:8000//#?foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/]
# Deps
sudo apt install -y bat curl virtualenv python3
# Tool
virtualenv -p python3 .py3
source .py3/bin/activate
PDM_BUILD_SCM_VERSION="$(git describe --abbrev=0)-dev" pip install .
# To run directly from source:
python src/bypass_url_parser/__init__.py -u https://thinkloveshare.com/juicy_403_endpoint/
# After installation:
bypass-url-parser -u https://thinkloveshare.com/juicy_403_endpoint/
cat /tmp/tmpRANDOM-bypass-url-parser/triaged-bypass.json | jq -r '.results[].request_curl_cmd'
cat /tmp/tmpRANDOM-bypass-url-parser/triaged-bypass.json | jq -r '.results[].response_data'