From 370bf7bfd99d5193abaf05f46081ef7b4c6599d1 Mon Sep 17 00:00:00 2001 From: duckie Date: Fri, 21 Aug 2020 11:10:58 +0530 Subject: [PATCH] Converted Tab to Spaces --- core/requester.py | 15 +++++-- core/utils.py | 10 +++++ corsy.py | 104 +++++++++++++++++++++++----------------------- 3 files changed, 73 insertions(+), 56 deletions(-) diff --git a/core/requester.py b/core/requester.py index 5193fdc..c6ff60f 100644 --- a/core/requester.py +++ b/core/requester.py @@ -1,12 +1,19 @@ import urllib3 import requests +from core.colors import bad urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) +# Added better error handling. +# Added verbose options. def requester(url, scheme, headers, origin): headers['Origin'] = scheme + origin - response = requests.get(url, headers=headers, verify=False).headers - for key, value in response.items(): - if key.lower() == 'access-control-allow-origin': - return response + try: + response = requests.get(url, headers=headers, verify=False).headers + for key, value in response.items(): + if key.lower() == 'access-control-allow-origin': + return response + except requests.exceptions.RequestException as e: + if 'Failed to establish a new connection' in str(e): + print ( ' ' + bad + ' ' + url + ' seems to be down') diff --git a/core/utils.py b/core/utils.py index 38094f7..004bff7 100644 --- a/core/utils.py +++ b/core/utils.py @@ -2,6 +2,7 @@ import os import tld import json import tempfile +import re def host(string): @@ -34,6 +35,15 @@ def create_url_list(target_url, inp_file): urls.append(target_url) return urls +def create_stdin_list(target_url, inp_file): + urls = [] + if inp_file: + for line in inp_file.readlines(): + if line.startswith(('http://', 'https://')): + urls.append(line.rstrip('\n')) + if target_url and target_url.startswith(('http://', 'https://')): + urls.append(target_url) + return urls def prompt(default=None): editor = 'nano' diff --git a/corsy.py b/corsy.py index cf2b19a..22ca7ad 100644 --- a/corsy.py +++ b/corsy.py @@ -6,21 +6,21 @@ import json import argparse from core.tests import active_tests -from core.utils import host, prompt, format_result, create_url_list, create_stdin_list +from core.utils import host, prompt, format_result, create_url_list, create_stdin_list, extractHeaders from core.colors import bad, end, red, run, good, grey, green, white, yellow print(''' - %sＣＯＲＳＹ %s{%sv1.0-beta%s}%s + %sＣＯＲＳＹ %s{%sv1.0-beta%s}%s ''' % (green, white, grey, white, end)) try: - import concurrent.futures - from urllib.parse import urlparse + import concurrent.futures + from urllib.parse import urlparse except ImportError: - print(' %s corsy needs Python > 3.4 to run.' % bad) - quit() + print(' %s corsy needs Python > 3.4 to run.' % bad) + quit() parser = argparse.ArgumentParser() parser.add_argument('-u', help='target url', dest='target') @@ -43,65 +43,65 @@ header_dict = args.header_dict verbose = args.verbose if verbose: - print ('verbos is enabled') + print ('verbos is enabled') if type(header_dict) == bool: - header_dict = extractHeaders(prompt()) + header_dict = extractHeaders(prompt()) elif type(header_dict) == str: - header_dict = extractHeaders(header_dict) + header_dict = extractHeaders(header_dict) else: - header_dict = { - 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0', - 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Accept-Language': 'en-US,en;q=0.5', - 'Accept-Encoding': 'gzip', - 'DNT': '1', - 'Connection': 'close', - } + header_dict = { + 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0', + 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Accept-Language': 'en-US,en;q=0.5', + 'Accept-Encoding': 'gzip', + 'DNT': '1', + 'Connection': 'close', + } # PIPE output from other tools such as httprobe etc if ( sys.stdin.isatty()): - urls = create_url_list(target, inp_file) + urls = create_url_list(target, inp_file) else: - urls = create_stdin_list(target, sys.stdin) + urls = create_stdin_list(target, sys.stdin) def cors(target, header_dict, delay): - url = target - root = host(url) - parsed = urlparse(url) - netloc = parsed.netloc - scheme = parsed.scheme - url = scheme + '://' + netloc + parsed.path - return active_tests(url, root, scheme, header_dict, delay) + url = target + root = host(url) + parsed = urlparse(url) + netloc = parsed.netloc + scheme = parsed.scheme + url = scheme + '://' + netloc + parsed.path + return active_tests(url, root, scheme, header_dict, delay) if urls: - if len(urls) > 1: - print(' %s Estimated scan time: %i secs' % (run, round(len(urls) * 1.75))) - results = [] - threadpool = concurrent.futures.ThreadPoolExecutor(max_workers=threads) - futures = (threadpool.submit(cors, url, header_dict, delay) for url in urls) - for each in concurrent.futures.as_completed(futures): - result = each.result() - results.append(result) - if result: - for i in result: - print(' %s %s' % (good, i)) - print(' %s-%s Class: %s' % (yellow, end, result[i]['class'])) - if not quiet: - print(' %s-%s Description: %s' % (yellow, end, result[i]['description'])) - print(' %s-%s Severity: %s' % (yellow, end, result[i]['severity'])) - print(' %s-%s Exploitation: %s' % (yellow, end, result[i]['exploitation'])) - print(' %s-%s ACAO Header: %s' % (yellow, end, result[i]['acao header'])) - print(' %s-%s ACAC Header: %s\n' % (yellow, end, result[i]['acac header'])) - results = format_result(results) - if results: - if json_file: - with open(json_file, 'w+') as file: - json.dump(results, file, indent=4) - else: - print(' %s No misconfigurations found.' % bad) + if len(urls) > 1: + print(' %s Estimated scan time: %i secs' % (run, round(len(urls) * 1.75))) + results = [] + threadpool = concurrent.futures.ThreadPoolExecutor(max_workers=threads) + futures = (threadpool.submit(cors, url, header_dict, delay) for url in urls) + for each in concurrent.futures.as_completed(futures): + result = each.result() + results.append(result) + if result: + for i in result: + print(' %s %s' % (good, i)) + print(' %s-%s Class: %s' % (yellow, end, result[i]['class'])) + if not quiet: + print(' %s-%s Description: %s' % (yellow, end, result[i]['description'])) + print(' %s-%s Severity: %s' % (yellow, end, result[i]['severity'])) + print(' %s-%s Exploitation: %s' % (yellow, end, result[i]['exploitation'])) + print(' %s-%s ACAO Header: %s' % (yellow, end, result[i]['acao header'])) + print(' %s-%s ACAC Header: %s\n' % (yellow, end, result[i]['acac header'])) + results = format_result(results) + if results: + if json_file: + with open(json_file, 'w+') as file: + json.dump(results, file, indent=4) + else: + print(' %s No misconfigurations found.' % bad) else: - print(' %s No valid URLs to test.' % bad) + print(' %s No valid URLs to test.' % bad)