- Notifications
You must be signed in to change notification settings - Fork 12
Expand file tree
/
Copy pathParamFirstCheck.py
More file actions
Latest commit
94 lines (79 loc) · 3.31 KB
/
Copy pathParamFirstCheck.py
File metadata and controls
94 lines (79 loc) · 3.31 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
#!/usr/bin/env python3
importsys
importrequests
classbcolors:
SQLColor='\033[92m'
RCEColor='\033[93m'
LFIColor='\033[91m'
RESET='\033[0m'
OpenRedColor='\033[94m'
defSearch(list, emptylist, line):
forparaminlist:
ifparaminline:
emptylist.append(line)
returnemptylist
defmain():
SqlParam= ["Id=","id=","page=","dir=","search=","category=","class=","file=","url=","news=","item=","menu=","lang=","name=","ref=","title=","view=","topic=","thread=","type=","data=","form=","join=","main=","nav=","region="]
RceParam= ["cmd=", "exec=","command=","execute=","ping=","query=","jump=","code=","reg=","do=","func=","arg=","option=","load=","process=","step=","read=","function=","req=","feature=","exe=","module=","payload=","run=","print="]
LfiParam= ["cat=", "dir=","action=","board=","date=","detail=","file=","download=","path=","folder=","prefix=","include=","page=","inc=","locate=","show=","doc=","site=","type=","view=","content=","document=","layout=","mod=","conf="]
OpenParam= ["next=", "url=", "target=","rurl=","dest=","destination=","redir=","redirect_url=","redirect_uri=","redirect=","/redirect/","cgi-bin/redirect","/out/","view=","/login?to=","image_url=","go=","return=","returnTo=","return_to=","checkout_url=","continue=","return_path=","post_logout_redirect_uri=","targetOrigin=","fallback=","ref_url=","host=","prejoin_data=","callback=","callback_url=","callbackUrl=","authorize_callback=","wp_http_referer=","link=","referrer="]
sqlist= []
rcelist= []
lfilist= []
openred= []
proxies= {"http":"http://127.0.0.1:8080", "https":"http://127.0.0.1:8080"}
iflen(sys.argv)>6:
print(bcolors.LFIColor+"[!] "+bcolors.RESET+"too much arguments")
sys.exit(1)
eliflen(sys.argv)<2:
print(bcolors.LFIColor+"[!] "+bcolors.RESET+"No argument given")
sys.exit(1)
forlineinsys.stdin:
sql=Search(SqlParam, sqlist, line)
rce=Search(RceParam, rcelist, line)
lfi=Search(LfiParam, lfilist, line)
open=Search(OpenParam, openred, line)
if'--sql'insys.argv:
print(bcolors.SQLColor+"In Top 25 SQL:\n"+bcolors.RESET)
forurlinsql:
print(url)
if'--proxy'insys.argv:
r=requests.get(url, proxies=proxies, verify=False)
else:
pass
print("------------------------------------------")
if'--rce'insys.argv:
print(bcolors.RCEColor+"In Top 25 RCE:\n"+bcolors.RESET)
forurlinrce:
print(url)
if'--proxy'insys.argv:
r=requests.get(url, proxies=proxies, verify=False)
else:
pass
print("------------------------------------------")
if'--lfi'insys.argv:
print(bcolors.LFIColor+"In Top 25 LFI:\n"+bcolors.RESET)
forurlinlfi:
print(url)
if'--proxy'insys.argv:
r=requests.get(url, proxies=proxies, verify=False)
else:
pass
print("------------------------------------------")
if'--open-redirect'insys.argv:
print(bcolors.OpenRedColor+"In Top Open Redirect:\n"+bcolors.RESET)
forurlinopen:
print(url)
if'--proxy'insys.argv:
r=requests.get(url, proxies=proxies, verify=False)
else:
pass
if__name__=='__main__':
try:
main()
exceptExceptionase:
print(bcolors.LFIColor+"[!] "+bcolors.RESET+"A problem has occured.")
print(bcolors.OpenRedColor+"[*] "+bcolors.RESET+"Error info:")
print(e)
exceptKeyboardInterrupt:
print(bcolors.LFIColor+"[!] "+bcolors.RESET+"Script canceled.")