From 88d8dec0fc7584609f1a8758b562a120240bf244 Mon Sep 17 00:00:00 2001 From: l0stkn0wledge Date: Thu, 4 Feb 2016 10:21:10 -0600 Subject: [PATCH 1/5] Rename wordlist/webservicces/ws-files.txt to wordlist/webservices/ws-files.txt fixing the folder path spelling --- wordlist/{webservicces => webservices}/ws-files.txt | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename wordlist/{webservicces => webservices}/ws-files.txt (100%) diff --git a/wordlist/webservicces/ws-files.txt b/wordlist/webservices/ws-files.txt similarity index 100% rename from wordlist/webservicces/ws-files.txt rename to wordlist/webservices/ws-files.txt From e43dcc2a29d1f9968f25537b79e4af174c7dc2cd Mon Sep 17 00:00:00 2001 From: l0stkn0wledge Date: Thu, 4 Feb 2016 10:21:32 -0600 Subject: [PATCH 2/5] Rename wordlist/webservicces/ws-dirs.txt to wordlist/webservices/ws-dirs.txt fixing folder path spelling --- wordlist/{webservicces => webservices}/ws-dirs.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename wordlist/{webservicces => webservices}/ws-dirs.txt (87%) diff --git a/wordlist/webservicces/ws-dirs.txt b/wordlist/webservices/ws-dirs.txt similarity index 87% rename from wordlist/webservicces/ws-dirs.txt rename to wordlist/webservices/ws-dirs.txt index 9fe7d58f..729d4727 100644 --- a/wordlist/webservicces/ws-dirs.txt +++ b/wordlist/webservices/ws-dirs.txt @@ -45,4 +45,4 @@ wsatom wsdl wsgw wsil -xmethods \ No newline at end of file +xmethods From a0dcc70886407934316d132df5e9e2390532fbe6 Mon Sep 17 00:00:00 2001 From: Federico Date: Tue, 1 Mar 2016 15:23:12 +0100 Subject: [PATCH 3/5] Added json printer --- plugins/printers.py | 57 ++++++++++++++++++++++++++++++++++----------- wfuzz.py | 0 2 files changed, 44 insertions(+), 13 deletions(-) mode change 100644 => 100755 wfuzz.py diff --git a/plugins/printers.py b/plugins/printers.py index 1dfa8fdf..e168fe90 100644 --- a/plugins/printers.py +++ b/plugins/printers.py @@ -1,5 +1,6 @@ import socket import sys +import json as jjson from xml.dom import minidom import os @@ -38,11 +39,11 @@ def header(self, summary): doc = minidom.Document() # - self.node_mt = doc.createElement("magictree") + self.node_mt = doc.createElement("magictree") self.node_mt.setAttribute("class", "MtBranchObject") # - node_td = doc.createElement("testdata") + node_td = doc.createElement("testdata") node_td.setAttribute("class", "MtBranchObject") self.node_mt.appendChild(node_td) @@ -80,7 +81,7 @@ def result(self, fuzz_result): location = "" if 'Location' in fuzz_result.history.fr_headers()['response']: - location = fuzz_result.history.fr_headers()['response']['Location'] + location = fuzz_result.history.fr_headers()['response']['Location'] if fuzz_result.code == 301 or fuzz_result.code == 302 and location: self.__create_xml_element(node_url, "RedirectLocation", location) @@ -194,14 +195,14 @@ def _write(self, text, line_suffix, color = ("", 8)): else: WConio.textcolor(wc) - self._write_line(text, line_suffix) - + self._write_line(text, line_suffix) + if wc != "": if self.OS!='nt': sys.stdout.write("\033[0;0m") else: WConio.textcolor(8) - + def _print(self, res, line_suffix): self._erase() @@ -211,13 +212,13 @@ def _print(self, res, line_suffix): if res.exception: self._write("XXX", line_suffix, self._get_code_color(res.code) if self.colour else ("",8)) else: - self._write("%03d" % (res.code), line_suffix, self._get_code_color(res.code) if self.colour else ("",8)) + self._write("%03d" % (res.code), line_suffix, self._get_code_color(res.code) if self.colour else ("",8)) self._write(" %4d L\t %5d W\t %5d Ch\t \"%s\"%s" % (res.lines, res.words, res.chars, res.description, line_suffix), line_suffix, txt_color) if line_suffix != "": for i in res.plugins_res: print " |_ %s\r" % i.issue - + sys.stdout.flush() def header(self, summary): @@ -274,12 +275,12 @@ def _print(self, res, line_suffix): txt_color = ("", 8) if not res.is_baseline or not self.colour else (term_colors.fgCyan, 8) - self._write("%05d: " % (res.nres), line_suffix, txt_color) - self._write("%.3fs C=" % (res.timer), line_suffix, txt_color) + self._write("%05d: " % (res.nres), line_suffix, txt_color) + self._write("%.3fs C=" % (res.timer), line_suffix, txt_color) location = "" if 'Location' in res.history.fr_headers()['response']: - location = res.history.fr_headers()['response']['Location'] + location = res.history.fr_headers()['response']['Location'] elif res.history.fr_url() != res.history.fr_redirect_url(): location = "(*) %s" % res.history.fr_url() @@ -290,13 +291,43 @@ def _print(self, res, line_suffix): if res.exception: self._write("XXX", line_suffix, self._get_code_color(res.code) if self.colour else ("",8)) else: - self._write("%03d" % (res.code), line_suffix, self._get_code_color(res.code) if self.colour else ("",8)) + self._write("%03d" % (res.code), line_suffix, self._get_code_color(res.code) if self.colour else ("",8)) self._write(" %4d L\t %5d W\t %5d Ch %20.20s %51.51s \"%s\"%s" % (res.lines, res.words, res.chars, server[:17], location[:48], res.description, line_suffix), line_suffix, txt_color) if line_suffix != "": for i in res.plugins_res: print " |_ %s\r" % i.issue - + sys.stdout.flush() +@moduleman_plugin("header", "footer", "noresult", "result") +class json: + name = "json" + description = "Results in json format" + category = ["default"] + priority = 99 + + json_res = [] + + def header(self, res): + pass + + def result(self, res): + location = "" + if 'Location' in res.history.fr_headers()['response']: + location = res.history.fr_headers()['response']['Location'] + elif res.history.fr_url() != res.history.fr_redirect_url(): + location = "(*) %s" % res.history.fr_url() + + server = "" + if 'Server' in res.history.fr_headers()['response']: + server = res.history.fr_headers()['response']['Server'] + + res_entry = {"lines": res.lines, "words": res.words, "chars" : res.chars, "url":res.url, "description":res.description, "location" : location, "server" : server} + self.json_res.append(res_entry) + + def noresult(self, res): + pass + def footer(self, summary): + print jjson.dumps(self.json_res) diff --git a/wfuzz.py b/wfuzz.py old mode 100644 new mode 100755 From 2cd32ac51c4c9bf7871b8382be6e4eab2c90331f Mon Sep 17 00:00:00 2001 From: Federico Date: Thu, 3 Mar 2016 15:20:56 +0100 Subject: [PATCH 4/5] added post data in the json printer --- plugins/printers.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/plugins/printers.py b/plugins/printers.py index e168fe90..5fbe03b5 100644 --- a/plugins/printers.py +++ b/plugins/printers.py @@ -314,17 +314,20 @@ def header(self, res): pass def result(self, res): + server = "" + if 'Server' in res.history.fr_headers()['response']: + server = res.history.fr_headers()['response']['Server'] location = "" if 'Location' in res.history.fr_headers()['response']: location = res.history.fr_headers()['response']['Location'] elif res.history.fr_url() != res.history.fr_redirect_url(): location = "(*) %s" % res.history.fr_url() - - server = "" - if 'Server' in res.history.fr_headers()['response']: - server = res.history.fr_headers()['response']['Server'] - - res_entry = {"lines": res.lines, "words": res.words, "chars" : res.chars, "url":res.url, "description":res.description, "location" : location, "server" : server} + res_entry = {"lines": res.lines, "words": res.words, "chars" : res.chars, "url":res.url, "description":res.description, "location" : location, "server" : server, "server" : server} + if res.history.fr_method().lower() == "post": + inputs="" + res_entry["postdata"] = {} + for n, v in res.history.fr_parameters()['post'].items(): + res_entry["postdata"][n] = v self.json_res.append(res_entry) def noresult(self, res): From 89584eb554d884c50c45aae3cc5bc17c4b23cb6a Mon Sep 17 00:00:00 2001 From: Federico Date: Thu, 3 Mar 2016 15:24:42 +0100 Subject: [PATCH 5/5] minor code changes --- plugins/printers.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/plugins/printers.py b/plugins/printers.py index 5fbe03b5..35bf24ef 100644 --- a/plugins/printers.py +++ b/plugins/printers.py @@ -322,12 +322,12 @@ def result(self, res): location = res.history.fr_headers()['response']['Location'] elif res.history.fr_url() != res.history.fr_redirect_url(): location = "(*) %s" % res.history.fr_url() - res_entry = {"lines": res.lines, "words": res.words, "chars" : res.chars, "url":res.url, "description":res.description, "location" : location, "server" : server, "server" : server} + post_data = {} if res.history.fr_method().lower() == "post": - inputs="" - res_entry["postdata"] = {} for n, v in res.history.fr_parameters()['post'].items(): - res_entry["postdata"][n] = v + post_data[n] = v + + res_entry = {"lines": res.lines, "words": res.words, "chars" : res.chars, "url":res.url, "description":res.description, "location" : location, "server" : server, "server" : server, "postdata" : post_data} self.json_res.append(res_entry) def noresult(self, res):