laluka/bypass-url-parser원시 curl 요청을 사용하여 40X 보호된 페이지에 대해 수백 가지 URL 우회 기법을 테스트하며, 멀티 모드 스캐닝, 헤더 스푸핑, 접근 제어 평가를 위한 JSON/HTML 결과 내보내기를 제공합니다.
4xx로 보호된 페이지에 도달하기 위해 다양한 URL 우회 기법을 테스트하는 도구입니다.
이 코드가 그저 지저분한 curl 래퍼에 불과한 이유가 궁금하다면, 그 이유는 다음과 같습니다:
파싱이나 SSL/TLS 캡슐화 같은 라이브러리의 장점을 모두 포기하지 않고 Python에서 이를 달성하는 것은 놀랍게도 어렵습니다.
그러니 저처럼 하세요: 백엔드로 curl을 사용하세요; 그것만으로 충분합니다.
이 도구는 라이브러리로도 사용할 수 있습니다; lib_sample_usage.py를 참고하세요.
이 도구를 설치하려면 pipx를 사용할 것을 권장합니다:
pipx install bypass-url-parser
# Or, for the latest development version:
pipx install git+https://github.com/laluka/bypass-url-parser
또는 pip를 사용할 수 있습니다:
pip install bypass-url-parser
Bypass URL Parser, made with love by @TheLaluka
A tool that tests MANY URL bypasses to reach a 4xx-protected page.
Usage:
bypass-url-parser (-u <URL> | -R <file>) [-m <mode>] [-o <outdir>] [-S <level>] [ (-H <header>)...] [-r <num>]
[-s <ip>] [--spoofip-replace] [-p <port>] [--spoofport-replace] [-t <threads>] [-T <timeout>]
[--request-tls] [--jsonl] [--dump-payloads] [-x <proxy_url>] [-v | -d | -dd]
Program options:
-u, --url <URL> URL (path is optional) to run bypasses against
-R, --request <file> Load HTTP raw request from a file
-H, --header <header> Header(s) to use, format: "Cookie: can_i_haz=fire"
-m, --mode <mode> Bypass modes. See 'Bypasser.BYPASS_MODES' in code [Default: all]
-o, --outdir <outdir> Output directory for results
-x, --proxy <proxy_url> Set a proxy in the format http://proxy_ip:port.
-S, --save-level <level> Save results level. From 0 (DISABLE) to 3 (FULL) [Default: 2]
-s, --spoofip <ip> IP(s) to inject in ip-specific headers
-p, --spoofport <port> Port(s) to inject in port-specific headers
-r, --retry <num> Retry attempts for failed requests. Set 0 to disable retries [Default: 1]
-t, --threads <threads> Scan with N parallel threads [Default: 1]
-T, --timeout <timeout> Request times out after N seconds [Default: 5]
General options:
-h, --help Show help, you are here :)
-v, --verbose Verbose output
-d, --debug Show more details like curl commands generated by this tool
-dd, --debug Print debug level 2 (including class-level debug output)
-V, --version Show version info
Misc options:
--spoofip-replace Disable list of default internal IPs in 'http_headers_ip' bypass mode
--spoofport-replace Disable list of default internal ports in 'http_headers_port' bypass mode
--request-tls Force usage of TLS/HTTPS for the request load with the '-R, --request' option
--dump-payloads Print all payloads (curls) generated by this tool.
--jsonl Print results in JSON lines format (pipe command output)
Examples:
bypass-url-parser -u "http://127.0.0.1/juicy_403_endpoint/" -s 8.8.8.8 -d
bypass-url-parser -u /path/urls -t 30 -T 5 -H "Cookie: me_iz=admin" -H "User-agent: test"
bypass-url-parser -R /path/request_file --request-tls -m "mid_paths, end_paths"
대화형 터미널에서 출력이 표시될 때 HTTP 상태 코드에 색상이 적용됩니다. 출력이 리디렉션되거나 파이프로 전달되면 색상은 자동으로 비활성화되며, NO_COLOR를 설정하여 비활성화할 수도 있습니다.
bypass-url-parser -u http://127.0.0.1:8000/foo/bar
2022-08-09 14:52:40 lalu-perso bup[361559] WARNING Trying to bypass 'http://127.0.0.1:8000/foo/bar' url (3213 payloads)...
2022-08-09 14:52:40 lalu-perso bup[361559] INFO Doing: 50 / 3213
[...]
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Doing: 3200 / 3213
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Retry (1/3) the '16' failed curl commands with 10 threads and 10s timeout
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Retry (2/3) the '16' failed curl commands with 5 threads and 20s timeout
2022-08-09 14:52:54 lalu-perso bup[361559] INFO Retry (3/3) the '16' failed curl commands with 1 threads and 30s timeout
2022-08-09 14:52:55 lalu-perso bup[361559] INFO
[#####] [bypass_method] [payload] => [status_code] [content_type] [content_length] [lines_count] [word_counts] [title] [server] [redirect_url]
[GROUP (1587)] [original_request] [http://127.0.0.1:8000/foo/bar] => [404] [text/html] [469] [14] [95] [Error response] [SimpleHTTP/0.6 Python/3.8.10] []
[GROUP (10)] [http_methods] [-X CONNECT http://127.0.0.1:8000/foo/bar] => [501] [text/html] [500] [14] [96] [Error response] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000/???foo/bar] => [200] [text/html] [913] [26] [27] [Directory listing for /???foo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000//???foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/???foo/bar]
[SINGLE] [mid_paths] [http://127.0.0.1:8000/??foo/bar] => [200] [text/html] [911] [26] [27] [Directory listing for /??foo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000//??foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/??foo/bar]
[SINGLE] [mid_paths] [http://127.0.0.1:8000/?foo/bar] => [200] [text/html] [909] [26] [27] [Directory listing for /?foo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000//?foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/?foo/bar]
[SINGLE] [mid_paths] [http://127.0.0.1:8000///?anythingfoo/bar] => [200] [text/html] [929] [26] [27] [Directory listing for ///?anythingfoo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[SINGLE] [mid_paths] [http://127.0.0.1:8000////?anythingfoo/bar] => [200] [text/html] [931] [26] [27] [Directory listing for ////?anythingfoo/bar] [SimpleHTTP/0.6 Python/3.8.10] []
[GROUP (2)] [mid_paths] [http://127.0.0.1:8000/#?foo/bar] => [200] [text/html] [893] [26] [27] [Directory listing for /] [SimpleHTTP/0.6 Python/3.8.10] []
[GROUP (2)] [mid_paths] [http://127.0.0.1:8000//#?foo/bar] => [301] [] [] [0] [0] [] [SimpleHTTP/0.6 Python/3.8.10] [/]
# Deps
sudo apt install -y bat curl virtualenv python3
# Tool
virtualenv -p python3 .py3
source .py3/bin/activate
PDM_BUILD_SCM_VERSION="$(git describe --abbrev=0)-dev" pip install .
# To run directly from source:
python src/bypass_url_parser/__init__.py -u https://thinkloveshare.com/juicy_403_endpoint/
# After installation:
bypass-url-parser -u https://thinkloveshare.com/juicy_403_endpoint/
cat /tmp/tmpRANDOM-bypass-url-parser/triaged-bypass.json | jq -r '.results[].request_curl_cmd'
cat /tmp/tmpRANDOM-bypass-url-parser/triaged-bypass.json | jq -r '.results[].response_data'
docker run --rm -it -v "$PWD:/host" -w /host ghcr.io/laluka/bypass-url-parser:latest bash -il
# Then run bup -h. Keep the container open because output is saved to /tmp by default.
# Alternatively, save the output to the current directory so you can inspect it later.
Bypass URL Parser는 여러 입력 형식을 허용합니다:
-m, --mode, -s, --spoofip, -p, --spoofport는 파일명, 문자열, 쉼표로 구분된
문자열, 또는 리스트(Bypasser를 라이브러리로 사용할 때)를 허용합니다.-u, --url은 파일명, 문자열, 또는 리스트(Bypasser를 라이브러리로 사용할 때)를 허용합니다.- 사용)은 이 모든 인수에 대해 지원됩니다.예를 들어, 여러 대상 URL(-u, --url)을 정의하려는 경우, 다음 명령은 모두 동일한 결과를 생성합니다: