From c8908602cd43c078766a5f72deee069adea0347c Mon Sep 17 00:00:00 2001 From: webklex Date: Mon, 19 Sep 2022 02:57:28 +0200 Subject: [PATCH 1/4] Make header names and values extractable --- explo/modules/http.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/explo/modules/http.py b/explo/modules/http.py index 5612c17..98a1097 100644 --- a/explo/modules/http.py +++ b/explo/modules/http.py @@ -52,7 +52,8 @@ def execute(block, scope): message="==> Found in HEADERS: '%s'" % color.cyan(keyword)) if 'extract' in opts: - scope[name]['extracted'] = extract(response.text, opts['extract']) + headers = '\r\n'.join([a+":"+b for a, b in response.headers.items()]) + scope[name]['extracted'] = extract(headers+"\r\n\r\n"+response.text, opts['extract']) if 'find' in opts: keyword = opts['find'] From df2c67bdf7b8fc857eb31f27b2ead9a8fc17126e Mon Sep 17 00:00:00 2001 From: webklex Date: Mon, 19 Sep 2022 02:58:26 +0200 Subject: [PATCH 2/4] Missing file extension added --- ...ind_testphp.vulnweb.com => SQLI_blind_testphp.vulnweb.com.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename examples/{SQLI_blind_testphp.vulnweb.com => SQLI_blind_testphp.vulnweb.com.yml} (100%) diff --git a/examples/SQLI_blind_testphp.vulnweb.com b/examples/SQLI_blind_testphp.vulnweb.com.yml similarity index 100% rename from examples/SQLI_blind_testphp.vulnweb.com rename to examples/SQLI_blind_testphp.vulnweb.com.yml From 9aeefd93c4136d4560e53ab6b54ef53e5e11e0a2 Mon Sep 17 00:00:00 2001 From: webklex Date: Mon, 19 Sep 2022 04:41:47 +0200 Subject: [PATCH 3/4] Allow template variables within parameter.url and parameter.method --- explo/connection.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/explo/connection.py b/explo/connection.py index d014b06..68b06a6 100644 --- a/explo/connection.py +++ b/explo/connection.py @@ -59,6 +59,9 @@ def http_request(block, scope): for key, val in headers.items(): headers[key] = pystache.render(str(val), scope) + opts['url'] = pystache.render(str(opts['url']), scope) + opts['method'] = pystache.render(str(opts['method']), scope) + req = requests.Request(opts['method'], opts['url'], headers=headers, data=data, cookies=cookies) request = req.prepare() From 5a8d0fd99aae78a3552a4d443a04eef323c653c1 Mon Sep 17 00:00:00 2001 From: webklex Date: Mon, 19 Sep 2022 06:19:20 +0200 Subject: [PATCH 4/4] Chain multiple response cookies divided by "," --- explo/connection.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/explo/connection.py b/explo/connection.py index 68b06a6..0fb7505 100644 --- a/explo/connection.py +++ b/explo/connection.py @@ -40,8 +40,10 @@ def http_request(block, scope): if cookies_path != '': try: - cookie_module = cookies_path.split('.', 1)[0] - cookies = scope[cookie_module]['response']['cookies'] + for cookie_module_path in cookies_path.split(',', -1): + cookie_module = cookie_module_path.split('.', 1)[0] + for k, v in scope[cookie_module]['response']['cookies'].items(): + cookies[k] = v except KeyError: Message.log( level='warning',