Arjun/arjun.py

#!/usr/bin/env python3

from __future__ import print_function

from core.colors import red, green, white, end, info, bad, good, run

print('''%s    _         
   /_| _ '    
  (  |/ /(//) %sv1.4%s
      _/      %s
''' % (green, white, green, end))

try:
    import concurrent.futures
except ImportError:
    print ('%s Please use Python > 3.2 to run Arjun.' % bad)
    quit()

import re
import sys
import json
import requests
import argparse

from urllib.parse import unquote

import core.config
from core.prompt import prompt
from core.requester import requester
from core.utils import e, d, stabilize, randomString, slicer, joiner, unityExtracter, getParams, flattenParams, removeTags, extractHeaders, log

parser = argparse.ArgumentParser() #defines the parser
#Arguements that can be supplied
parser.add_argument('-u', help='target url', dest='url')
parser.add_argument('-f', help='wordlist path', dest='wordlist')
parser.add_argument('-d', help='request delay', dest='delay', type=int)
parser.add_argument('-t', help='number of threads', dest='threads', type=int)
parser.add_argument('-o', help='path for the output file', dest='output_file')
parser.add_argument('--urls', help='file containing urls', dest='url_file')
parser.add_argument('--get', help='use get method', dest='GET', action='store_true')
parser.add_argument('--post', help='use post method', dest='POST', action='store_true')
parser.add_argument('--include', help='include this data in every request', dest='include')
parser.add_argument('--headers', help='add headers', dest='headers', nargs='?', const=True)
parser.add_argument('--json', help='treat post data as json', dest='jsonData', action='store_true')
args = parser.parse_args() #arguments to be parsed

url = args.url
jsonData = args.jsonData
headers = args.headers
delay = args.delay or 0
url_file = args.url_file
include = args.include or {}
threadCount = args.threads or 2
wordlist = args.wordlist or './db/params.txt'

core.config.globalVariables = vars(args)

if type(headers) == bool:
    headers = extractHeaders(prompt())
elif type(headers) == str:
    headers = extractHeaders(headers)
else:
    headers = {}

if jsonData:
    headers['Content-type'] = 'application/json'

if args.GET:
    GET = True
else:
    GET = False

include = getParams(include)

paramList = []
try:
    with open(wordlist, 'r') as file:
        for line in file:
            paramList.append(line.strip('\n'))
except FileNotFoundError:
    log('%s The specified file for parameters doesn\'t exist' % bad)
    quit()

urls = []

if url_file:
    try:
        with open(url_file, 'r') as file:
            for line in file:
                urls.append(line.strip('\n'))
    except FileNotFoundError:
        log('%s The specified file for URLs doesn\'t exist' % bad)
        quit()

if not url and not url_file:
    log('%s No URL specified.' % bad)
    quit()

def heuristic(response, paramList):
    done = []
    forms = re.findall(r'(?i)(?s)<form.*?</form.*?>', response)
    for form in forms:
        method = re.search(r'(?i)method=[\'"](.*?)[\'"]', form)
        inputs = re.findall(r'(?i)(?s)<input.*?>', response)
        for inp in inputs:
            inpName = re.search(r'(?i)name=[\'"](.*?)[\'"]', inp)
            if inpName:
                inpType = re.search(r'(?i)type=[\'"](.*?)[\'"]', inp)
                inpValue = re.search(r'(?i)value=[\'"](.*?)[\'"]', inp)
                inpName = d(e(inpName.group(1)))
                if inpName not in done:
                    if inpName in paramList:
                        paramList.remove(inpName)
                    done.append(inpName)
                    paramList.insert(0, inpName)
                    log('%s Heuristic found a potential parameter: %s%s%s' % (good, green, inpName, end))
                    log('%s Prioritizing it' % good)

def quickBruter(params, originalResponse, originalCode, factors, include, delay, headers, url, GET):
    newResponse = requester(url, joiner(params, include), headers, GET, delay)
    if newResponse.status_code != originalCode:
        return params
    elif factors['sameHTML'] and len(newResponse.text) != (len(originalResponse)):
        return params
    elif factors['samePlainText'] and len(removeTags(originalResponse)) != len(removeTags(newResponse.text)):
        return params
    else:
        return False

def bruter(param, originalResponse, originalCode, factors, include, reflections, delay, headers, url, GET): 
    fuzz = randomString(6)
    data = {param : fuzz}
    data.update(include)
    response = requester(url, data, headers, GET, delay)
    newReflections = response.text.count(fuzz)
    reason = False
    if response.status_code != originalCode:
        reason = 'Different response code'
    elif reflections != newReflections:
        reason = 'Different number of reflections'
    elif not factors['sameHTML'] and len(response.text) != (len(originalResponse)):
        reason = 'Different content length'
    elif not factors['samePlainText'] and len(removeTags(response.text)) != (len(removeTags(originalResponse))):
        reason = 'Different plain-text content length'
    if reason:
        return {param : reason}
    else:
        return None

def narrower(oldParamList, url, include, headers, GET, delay, originalResponse, originalCode, factors, threadCount):
    newParamList = []
    threadpool = concurrent.futures.ThreadPoolExecutor(max_workers=threadCount)
    futures = (threadpool.submit(quickBruter, part, originalResponse, originalCode, factors, include, delay, headers, url, GET) for part in oldParamList)
    for i, result in enumerate(concurrent.futures.as_completed(futures)):
        if result.result():
            newParamList.extend(slicer(result.result()))
        log('%s Processing: %i/%-6i' % (info, i + 1, len(oldParamList)), mode='run')
    return newParamList

def initialize(url, include, headers, GET, delay, paramList, threadCount):
    url = stabilize(url)

    log('%s Analysing the content of the webpage' % run)
    firstResponse = requester(url, include, headers, GET, delay)

    log('%s Analysing behaviour for a non-existent parameter' % run)

    originalFuzz = randomString(6)
    data = {originalFuzz : originalFuzz[::-1]}
    data.update(include)
    response = requester(url, data, headers, GET, delay)
    reflections = response.text.count(originalFuzz[::-1])
    log('%s Reflections: %s%i%s' % (info, green, reflections, end))

    originalResponse = response.text
    originalCode = response.status_code
    log('%s Response Code: %s%i%s' % (info, green, originalCode, end))

    newLength = len(response.text)
    plainText = removeTags(originalResponse)
    plainTextLength = len(plainText)
    log('%s Content Length: %s%i%s' % (info, green, newLength, end))
    log('%s Plain-text Length: %s%i%s' % (info, green, plainTextLength, end))

    factors = {'sameHTML': False, 'samePlainText': False}
    if len(firstResponse.text) == len(originalResponse):
        factors['sameHTML'] = True
    elif len(removeTags(firstResponse.text)) == len(plainText):
        factors['samePlainText'] = True

    log('%s Parsing webpage for potential parameters' % run)
    heuristic(firstResponse.text, paramList)

    fuzz = randomString(8)
    data = {fuzz : fuzz[::-1]}
    data.update(include)

    log('%s Performing heuristic level checks' % run)

    toBeChecked = slicer(paramList, 25)
    foundParams = []
    while True:
        toBeChecked = narrower(toBeChecked, url, include, headers, GET, delay, originalResponse, originalCode, factors, threadCount)
        toBeChecked = unityExtracter(toBeChecked, foundParams)
        if not toBeChecked:
            break

    if foundParams:
        log('%s Heuristic found %i potential parameters.' % (info, len(foundParams)))
        paramList = foundParams

    finalResult = []
    jsonResult = []

    threadpool = concurrent.futures.ThreadPoolExecutor(max_workers=threadCount)
    futures = (threadpool.submit(bruter, param, originalResponse, originalCode, factors, include, reflections, delay, headers, url, GET) for param in foundParams)
    for i, result in enumerate(concurrent.futures.as_completed(futures)):
        if result.result():
            finalResult.append(result.result())
        log('%s Progress: %i/%i' % (info, i + 1, len(paramList)), mode='run')

    log('%s Scan Completed' % info)

    for each in finalResult:
        for param, reason in each.items():
            log('%s Valid parameter found: %s%s%s' % (good, green, param, end))
            log('%s Reason: %s' % (info, reason))
            jsonResult.append({"param": param, "reason": reason})
    return jsonResult

finalResult = []
if url:
    finalResult = initialize(url, include, headers, GET, delay, paramList, threadCount)
elif urls:
    finalResult = {}
    for url in urls:
        print('%s Scanning: %s' % (run, url))
        jsonResult = initialize(url, include, headers, GET, delay, list(paramList), threadCount)
        if jsonResult:
            print('%s Parameters found: %s' % (good, ', '.join([each['param'] for each in jsonResult])))
        finalResult[url] = jsonResult

# Finally, export to json
if args.output_file and finalResult:
    log('%s Saving output to JSON file in %s' % (info, args.output_file))
    with open(str(args.output_file), 'w+') as json_output:
        json.dump({'results':finalResult}, json_output, sort_keys=True, indent=4,)