#!/usr/bin/env python
# -*- coding: utf-8 -*-

import threading
import requests
import json
from time import sleep

class Sqli(threading.Thread):
    """docstring for AutoSqli"""
    def __init__(self, server, target, data='', referer='', cookie=''):
        threading.Thread.__init__(self)
        self.server = server[0:-1] if server[-1]=='/' else server
        self.target = target
        self.data = data
        self.referer = referer
        self.cookie = cookie
        self.taskid = ''
        self.data

    def new_task(self):
        url = "{}/task/new".format(self.server)
        self.taskid = json.loads(requests.get(url).text)['taskid']
        if len(self.taskid)>0:
            print "Create new task,taskid is: %s" % self.taskid
            return True
        return False

    def set_option(self):
        headers = {'Content-Type': 'application/json'}
        option = {"options": {
                    "smart": True,
                    }
                 }
        url = "{}/option/{}/set".format(self.server,self.taskid)
        resp = requests.post(url, data=json.dumps(option), headers=headers)
        return json.loads(resp.text)['success']

    def start_scan(self):
        headers = {'Content-Type': 'application/json'}
        payload = {
            'url': self.target,
            'data': self.data,
            'cookie': self.cookie,
            'referer': self.referer
        }
        url = "{}/scan/{}/start".format(self.server,self.taskid)
        t = json.loads(requests.post(url,data=json.dumps(payload),headers=headers).text)
        if len(str(t['engineid'])) > 0 and t['success']:
            print "[%s] Start scan" % self.taskid
            return True
        return False

    def get_status(self):
        url = "{}/scan/{}/status".format(self.server,self.taskid)
        status = json.loads(requests.get(url).text)['status']
        if status == 'running':
            return 'running'
        elif status == 'terminated':
            return 'terminated'
        else:
            return 'error'

    def get_data(self):
        url = "{}/scan/{}/data".format(self.server,self.taskid)
        data = json.loads(requests.get(url).text)['data']
        if len(data) == 0:
            print '[] not injection:\t' + self.target
        else:
            print '=======> injection:\t' + self.target
            self.data = data

    def delete_task(self):
        url = "{}/task/{}/delete".format(self.server,self.taskid)
        if json.loads(requests.get(url).text)['success']:
            print "[%s] Delete task" % self.taskid
            return True
        return False

    def write_to_file(self,msg):
        with open('result.txt','a+') as f:
            f.write(json.dumps(msg)+'\n\n')

    def run(self):
        try:
            if not self.new_task():
                return False
            self.set_option()
            if not self.start_scan():
                return False
            while True:
                if self.get_status() == 'running':
                    sleep(10)
                elif self.get_status() == 'terminated':
                    break
                else:
                    break
            self.get_data()
            self.write_to_file(self.data)
            self.delete_task()
        except Exception, e:
            print e

if __name__ == '__main__':
    server = 'http://127.0.0.1:8775'
    target = 'http://192.168.188.134/sqli/Less-1/?id=1'
    sqli = Sqli(server, target)
    sqli.start()
    sqli.join()

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import sys
import optparse
import zipfile
import threading
import Queue

queue = Queue.Queue()
lock = threading.Lock()
result = ''

def load_pwd(filename):
    for line in open(filename,'r'):
        if line:
            queue.put(line.strip())

def bruter(zipname,queue):
    global result
    zFile = zipfile.ZipFile(zipname)
    while not queue.empty():
        password = queue.get()
        try:
            zFile.extractall(pwd=password) # 解压
            lock.acquire()
            print "[Ok] password is: %s" % password
            lock.release()
            result = password
        except:
            lock.acquire()
            print "[Error] password not is: %s" % password
            lock.release()
        queue.task_done()

def main():
    parser = optparse.OptionParser()
    parser.add_option('-f', '--file', dest='zipfile',
        type='string', help='Target zip file.')
    parser.add_option('-p', '--pfile', dest='pwdfile',default='pass.txt',
        type='string', help='Password file.')
    parser.add_option('-t', '--thread_num', dest='thread_num',default=60,
        type='int', help='Thread number.')

    (options, args) = parser.parse_args()

    if options.zipfile and options.pwdfile:
        load_pwd(options.pwdfile)
    else:
        parser.print_help()
        sys.exit(0)

    threads = []
    for x in range(options.thread_num):
        t = threading.Thread(target=bruter,args=(options.zipfile,queue,))
        t.setDaemon(True)
        t.start()
    queue.join()
    print "result is: %s" % result

if __name__ == '__main__':
    main()

#!/usr/bin/env python
# -*- coding: utf-8 -*-

'This is a proxy'

__author__ = 'xxx'

import sys
import socket
import threading
import optparse

lock = threading.Lock()

def locker(msg):
    lock.acquire()
    print msg
    lock.release()

def hexdump (src,length=16):#十六进制导出函数
    result = []
    digits = 4 if isinstance(src,unicode) else 2

    for i in xrange(0,len(src),length):
        s = src[i:i+length]
        hexa = b' '.join("[%0*X]" % (digits,ord(x)) for x in s)
        text = b''.join([x if 0x20 <= ord(x) < 0x7F else b'.' for x in s])
        result.append(b"%04X  %-*s  %s" % (i,length*(digits+1),hexa,text))

    print b'\n'.join(result)

def receive_from (connection):
    
    buffer = ""
    
    #我们设置了1秒的超时，这取决于目标的情况，可能需要调整
    connection.settimeout(1)
    try:
        #持续从缓存中读取数据直到没有数据或者超时
        while True:
            data = connection.recv(4096)
            if not data:
                break

            buffer += data
    except:
        pass
        
    return buffer
    
#对目标是远程主机的请求进行修改
def request_handler (buffer):
    #执行包修改
    return buffer

#对目标是本地主机的响应进行修改
def response_handler (buffer):
    #执行包修改
    return buffer

def proxy_handler (client_socket,remote_host,remote_port,receive_first):
    #连接远程主机
    remote_socket = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    remote_socket.connect((remote_host,remote_port))

    #如果必要从远程主机接收数据
    if receive_first:
        remote_buffer = receive_from(remote_socket)
        if len(remote_buffer):
            print "\n[==>] Received %d bytes from remote." % len(remote_buffer)
            # hexdump(remote_buffer)
        
        #发送给我们的相应处理
        remote_buffer = response_handler(remote_buffer)
        #若我们有数据传递给本地客户端，发送它
        if len(remote_buffer):
            print "[<==] Sending %d bytes to localhost.\n" % len(remote_buffer)
            client_socket.send(remote_buffer)
    
    #现在我们从本地循环读取数据，发送给远程主机和本地主机
    while True:
        #从本地读取数据
        local_buffer = receive_from(client_socket)
        if len(local_buffer):
            print "\n[==>] Received %d bytes from localhost." % len(local_buffer)
            # hexdump(local_buffer)
            #发送给我们的本地请求
            local_buffer = request_handler(local_buffer)
            #发送给远程主机
            remote_socket.send(local_buffer)
            print "[==>] Sent to remote."

        #接收响应的数据
        remote_buffer = receive_from(remote_socket)
        if len(remote_buffer):
            print "\n[<==] Received %d bytes from remote." % len(remote_buffer)
            # hexdump(remote_buffer)
            #发送数据到响应处理函数
            remote_buffer = response_handler(remote_buffer)
            #将响应发送给本地socket
            client_socket.send(remote_buffer)
            print "[==>] Sent to localhost."

        #若两边都没有数据，关闭连接
        if not len(local_buffer) or not len(remote_buffer):
            client_socket.close()
            remote_socket.close()
            print "[*] No more data. Closing connections."
            break

def server_loop(local_host,local_port,remote_host,remote_port,receive_first):

    server = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    try:
        server.bind((local_host,local_port))
    except:
        print "[!!] Failed to listen on %s:%d" % (local_host,local_port)
        print "[!!] Check for other listening sockets or correct permisssions."
        sys.exit(0)
    print "[*] Listening on %s:%d......" % (local_host,local_port)
    server.listen(5)

    while True:
        client_socket,addr = server.accept()
        
        #打印本地连接信息
        print "\n[==>] Received incoming connection from %s:%d" % (addr[0],addr[1])

        #开启一个线程与远程主机通信
        proxy_thread = threading.Thread(target=proxy_handler,args=(client_socket,remote_host,remote_port,receive_first))
        proxy_thread.start()

def main ():
    parser = optparse.OptionParser()
    parser.add_option('--lh', '--localhost', dest='localhost',default='127.0.0.1',
        type='string', help='Localhost.')
    parser.add_option('--lp', '--localport', dest='localport',default=8888,
        type='int', help='Localport.')
    parser.add_option('--rh', '--remotehost', dest='remotehost', default='127.0.0.1',
        type='string', help='Remotehost.')
    parser.add_option('--rp', '--remoteport', dest='remoteport', default=8080, 
        type='int', help='Remoteport.')
    parser.add_option('--rf', '--receivefirst', dest='receive_first', default=False,
        action='store_true',help='Connection before send and receive data.')

    (options, args) = parser.parse_args()

    #设置本地监听参数
    if options.localhost:
        local_host = options.localhost
    if options.localport:
        local_port = options.localport
    
    #设置远程目标
    if options.remotehost:
        remote_host = options.remotehost
    if options.remoteport:
        remote_port = options.remoteport

    receive_first = options.receive_first

    # print local_host,local_port,remote_host,remote_port,receive_first

    #现在设置好我们的监听socket
    server_loop(local_host,local_port,remote_host,remote_port,receive_first)

main()

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import MySQLdb

class mysql(object):
    """docstring for mysql"""
    def __init__(self, dbconfig):
        self.host = dbconfig['host']
        self.port = dbconfig['port']
        self.user = dbconfig['user']
        self.passwd = dbconfig['passwd']
        self.dbname = dbconfig['dbname']
        self.charset = dbconfig['charset']
        self._conn = None
        self._connect()
        self._cursor = self._conn.cursor()

    def _connect(self):
        try:
            self._conn = MySQLdb.connect(host=self.host,
                port = self.port,
                user=self.user,
                passwd=self.passwd,
                db=self.dbname,
                charset=self.charset)
        except MySQLdb.Error,e:
            print e
            
    def query(self, sql):
        try:
            result = self._cursor.execute(sql)
        except MySQLdb.Error, e:
            print e
            result = False
        return result

    def select(self, table, column='*', condition=''):
        condition = ' where ' + condition if condition else None
        if condition:
            sql = "select %s from %s %s" % (column,table,condition)
        else:
            sql = "select %s from %s" % (column,table)
        self.query(sql)
        return self._cursor.fetchall()

    def insert(self, table, tdict):
        column = ''
        value = ''
        for key in tdict:
            column += ',' + key
            value += "','" + tdict[key]
        column = column[1:]
        value = value[2:] + "'"
        sql = "insert into %s(%s) values(%s)" % (table,column,value)
        try:
            self._cursor.execute(sql)
            self._conn.commit()
        except:
            self.rollback()
        return self._cursor.lastrowid #返回最后的id

    def update(self, table, tdict, condition=''):
        if not condition:
            print "must have id"
            exit()
        else:
            condition = 'where ' + condition
        value = ''
        for key in tdict:
            value += ",%s='%s'" % (key,tdict[key])
        value = value[1:]
        sql = "update %s set %s %s" % (table,value,condition)
        try:
            self._cursor.execute(sql)
        except:
            self.rollback()
        return self.affected_num() #返回受影响行数

    def delete(self, table, condition=''):
        condition = 'where ' + condition if condition else None
        sql = "delete from %s %s" % (table,condition)
        try:
            self._cursor.execute(sql)
            self._conn.commit()
        except:
            self.rollback()
        return self.affected_num() #返回受影响行数

    def rollback(self):
        self._conn.rollback()

    def affected_num(self):
        return self._cursor.rowcount

    def __del__(self):
        try:
            self._cursor.close()
            self._conn.close()
        except:
            pass

    def close(self):
        self.__del__()

if __name__ == '__main__':
    dbconfig = {
        'host':'192.168.188.134',
        'port':3306,
        'user':'python',
        'passwd':'123456',
        'dbname':'python',
        'charset':'utf8'
    }
    db = mysql(dbconfig)

    # print db.select('msg','id,ip,domain')
    # print db.select('msg','id,ip,domain','id>2')
    # print db.affected_num()

    # tdict = {
    #     'ip':'111.13.100.91',
    #     'domain':'baidu.com'
    # }
    # print db.insert('msg', tdict)
    
    # tdict = {
    #     'ip':'111.13.100.91',
    #     'domain':'aaaaa.com'
    # }
    # print db.update('msg', tdict, 'id=5')

    # print db.delete('msg', 'id>3')

    db.close()