http://7-a.org
5 | All rights reserved.
6 |
7 | Redistribution and use in source and binary forms, with or without
8 | modification, are permitted provided that the following conditions are met:
9 | * Redistributions of source code must retain the above copyright
10 | notice, this list of conditions and the following disclaimer.
11 | * Redistributions in binary form must reproduce the above copyright
12 | notice, this list of conditions and the following disclaimer in the
13 | documentation and/or other materials provided with the distribution.
14 | * Neither the name of the copyright owner nor the
15 | names of its contributors may be used to endorse or promote products
16 | derived from this software without specific prior written permission.
17 |
18 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
19 | ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20 | WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
22 | ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 | (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 | LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
25 | ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 | (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27 | SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 |
29 | # Inbound Proxy Module developed by Bharadwaj Machiraju (blog.tunnelshade.in)
30 | # as a part of Google Summer of Code 2013
31 | '''
32 | from OpenSSL import crypto
33 | import os
34 | import hashlib
35 |
36 | from filelock import FileLock
37 |
38 |
39 | def gen_signed_cert(domain,
40 | ca_crt="ca.crt",
41 | ca_key="ca.key",
42 | key_path = "cert.key"
43 | ):
44 | """
45 | This function takes a domain name as a parameter and then creates a certificate and key with the
46 | domain name(replacing dots by underscores), finally signing the certificate using specified CA and
47 | returns the path of key and cert files. If you are yet to generate a CA then check the top comments
48 | """
49 | certs_folder = "certs/"
50 |
51 |
52 | cert_path = os.path.join(certs_folder, domain.replace('.', '_') + ".crt")
53 |
54 | # The first conditions checks if file exists, and does nothing if true
55 | # If file doenst exist lock is obtained for writing (Other processes in race must wait)
56 | # After obtaining lock another check to handle race conditions gracefully
57 | if os.path.exists(key_path) and os.path.exists(cert_path):
58 | pass
59 | else:
60 | with FileLock(cert_path, timeout=2):
61 | # Check happens if the certificate and key pair already exists for a domain
62 | if os.path.exists(key_path) and os.path.exists(cert_path):
63 | pass
64 | else:
65 | # Serial Generation - Serial number must be unique for each certificate,
66 | # so serial is generated based on domain name
67 | md5_hash = hashlib.md5()
68 | md5_hash.update(str.encode(domain))
69 | serial = int(md5_hash.hexdigest(), 36)
70 |
71 | # The CA stuff is loaded from the same folder as this script
72 | ca_cert = crypto.load_certificate(crypto.FILETYPE_PEM, open(ca_crt).read())
73 | # The last parameter is the password for your CA key file
74 | ca_key = crypto.load_privatekey(crypto.FILETYPE_PEM, open(ca_key).read())
75 |
76 | key = crypto.load_privatekey(crypto.FILETYPE_PEM, open(key_path).read())
77 |
78 | #key.generate_key(crypto.TYPE_RSA, 2048)
79 |
80 | cert = crypto.X509()
81 | cert.set_version(3-1) # version 3, starts at 0
82 | cert.get_subject().C = "IN"
83 | cert.get_subject().ST = "AP"
84 | cert.get_subject().L = "127.0.0.1"
85 | cert.get_subject().O = "TProxy"
86 | cert.get_subject().OU = domain
87 | #cert.get_subject().CN = domain
88 | cert.gmtime_adj_notBefore(0)
89 | cert.gmtime_adj_notAfter(365 * 24 * 60 * 60)
90 | cert.set_serial_number(serial)
91 | cert.set_issuer(ca_cert.get_subject())
92 |
93 | #san_list = ["DNS:"+domain]
94 | cert.add_extensions([
95 | crypto.X509Extension(
96 | "subjectAltName", True, "DNS: "+domain
97 | )
98 | ])
99 |
100 | cert.set_pubkey(key)
101 | cert.sign(ca_key, "sha256")
102 |
103 | # The key and cert files are dumped and their paths are returned
104 |
105 | domain_cert = open(cert_path, "wb")
106 | domain_cert.write(crypto.dump_certificate(crypto.FILETYPE_PEM, cert))
107 | print(("[*] Generated signed certificate for %s" % (domain)))
108 | return key_path, cert_path
109 |
--------------------------------------------------------------------------------
/templates/show_detect.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
43 |
44 |
45 |
49 |
50 |
51 |
52 |
142 |
--------------------------------------------------------------------------------
/templates/show_vul.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
43 |
44 |
45 |
49 |
50 |
51 |
52 |
142 |
--------------------------------------------------------------------------------
/proxy.py:
--------------------------------------------------------------------------------
1 | # -*- coding: utf-8 -*-
2 | import sys, json, time
3 | import config
4 |
5 | from tornado_proxy.proxy import ProxyHandler, ProxyServer
6 | from lib.httphelper import mark_unique, process_post_body, check_lang
7 |
8 | import lib.detector
9 | import hashlib
10 |
11 | import os
12 |
13 | py3k = sys.version_info.major > 2
14 | if py3k:
15 | from urllib import parse as urlparse
16 | else:
17 | import urlparse
18 |
19 | def obj2Dict(obj):
20 | ret = {}
21 | for i in obj:
22 | ret[i] = obj[i]
23 | return ret
24 |
25 | def parseReq(request, rtype):
26 | #rtype 代表post的类型
27 | #'multipart'/'json'/'qs'/'raw'/rewrite
28 | Entity={}
29 | Entity['rtype']=rtype
30 | Entity['body']=request.body
31 | Entity['protocol']=request.protocol
32 | Entity['remote_ip']=request.remote_ip
33 | Entity['host']=request.host
34 | Entity['method']=request.method
35 | Entity['uri']=request.uri
36 | Entity['version']=request.version
37 | Entity['headers']=obj2Dict(request.headers)
38 | return Entity
39 |
40 | def parseRsp(res, response_body, flag, raw_response_body):
41 | Entity={}
42 | Entity['code']=res.code
43 | Entity['headers']=obj2Dict(res.headers)
44 | if flag:
45 | Entity['response_body']=response_body[:config.max_save_size]
46 | else:
47 | Entity['response_body']= 'ignored:'+hashlib.md5(raw_response_body).hexdigest()
48 | return Entity
49 |
50 | def makeFullUri(uri, host, protocol):
51 | if urlparse.urlparse(uri).scheme:
52 | return uri
53 | else:
54 | return protocol+'://'+host+os.path.normpath(uri)
55 |
56 | class RequestProxy(ProxyHandler):
57 | def newgidtype(self, req, res):
58 | # 如果是ajax请求，合并到上一个group
59 | last = config.dbconn().fetch_rows('http', '*', {'type': 1}, order='time desc', limit=1, fetchone=True)
60 | if not last: return 1,1
61 | if req.headers.get('x-requested-with', '').lower() == 'xmlhttprequest' or 'xml' in res.headers.get('content-type', '') or 'json' in res.headers.get('content-type', ''):
62 | return last['gid'],2
63 | elif 'html' in res.headers.get('content-type', '') and time.time()-last['time']>3:
64 | return last['gid']+1,1
65 | else:
66 | return last['gid'],3
67 |
68 | def request_handler(self, request):
69 | pass
70 |
71 | def response_handler(self, request, response, response_body):
72 | pass
73 |
74 | def save_handler(self, request, response, response_body):
75 | #check res.status
76 | #if re.match(config.filter_code, str(res.status)): return
77 | reqtype = 'qs'
78 |
79 | raw_response_body = ''
80 |
81 | if request.body:
82 | request.body = request.body.decode('utf-8','ignore')
83 | if response_body:
84 | raw_response_body = response_body
85 | response_body = response_body.decode('utf-8','ignore')
86 | request.uri = makeFullUri(request.uri, request.host, request.protocol)
87 |
88 | parsed = urlparse.urlparse(request.uri)
89 |
90 | #check host
91 | if config.included_host and not len([h for h in config.included_host if request.host.endswith(h)]): return
92 | if len([h for h in config.excluded_host if request.host.endswith(h)]): return
93 | #check fileext
94 | if len([h for h in config.filter_file if parsed.path.endswith(h)]): return
95 |
96 | path = os.path.normpath(parsed.path)
97 | #check query string
98 | if request.method == 'GET' and not parsed.query:
99 | if os.path.splitext(path)[1]: return
100 | if len(path.split('/')) < 3: return
101 | reqtype = 'rewrite'
102 |
103 | #don' save response body into database
104 | save_body = True
105 | #check query, get must have query string or url-rewrited
106 | #GET method, have ext and do not have query string
107 | #if os.uri.splitext(request.uri)[1] and request.method == 'GET' and not urlparse.urlparse(request.uri).query: save_body = False
108 | #only some content-type save to database
109 | if config.filter_content_type and not len([h for h in config.filter_content_type if h in response.headers.get('content-type', '')]): save_body = False
110 |
111 | conn = config.dbconn()
112 |
113 | separator = None
114 | args = {}
115 |
116 | if 'multipart/form-data;' in request.headers.get('content-type', ''):
117 | separator = request.headers.get('content-type').split("=")[-1]
118 |
119 | if request.method == 'POST':
120 | reqtype, args, files = process_post_body(request.body, separator)
121 |
122 | signature = mark_unique(request.uri, args)
123 |
124 | if conn.fetch_rows('http', condition={'signature': signature}, fetchone=True):
125 | return
126 |
127 | # site basic info
128 | siteinfo = conn.fetch_rows('siteinfo', '*', {'host': request.host, 'key': 'lang'}, fetchone=True)
129 | if not siteinfo:
130 | lang, framework = check_lang(request, response)
131 | conn.insert('siteinfo', {'host': request.host, 'key': 'lang', 'value': lang})
132 | conn.insert('siteinfo', {'host': request.host, 'key': 'framework', 'value': framework})
133 |
134 | if siteinfo and siteinfo.get('value', '') == 'unkonwn':
135 | lang = check_lang(request.uri)
136 | conn.update('siteinfo', {'value': lang}, condition={'host': request.host, 'key': 'lang'})
137 |
138 |
139 | req = parseReq(request, reqtype)
140 | rsp = parseRsp(response, response_body, save_body, raw_response_body)
141 |
142 |
143 | gid, rtype = self.newgidtype(request, response)
144 |
145 | data = {'gid':gid, 'host': request.host,'req':json.dumps(req), 'rsp':json.dumps(rsp), 'time':time.time(), 'type':rtype, 'signature': signature}
146 | conn.insert('http', data)
147 |
148 | detector = [i for i in dir(lib.detector) if i.startswith('detect_')]
149 | for d in detector:
150 | try:
151 | c = getattr(lib.detector,d)
152 | c(req, rsp)
153 | except Exception as e:
154 | print e
155 |
156 | if __name__ == "__main__":
157 | try:
158 | proxy = ProxyServer(RequestProxy, inbound_ip=config.proxy_host, inbound_port=config.proxy_port)
159 | proxy.start()
160 | except KeyboardInterrupt:
161 | proxy.stop()
162 |
163 |
164 |
--------------------------------------------------------------------------------
/XSSHelper.user.js:
--------------------------------------------------------------------------------
1 | // ==UserScript==
2 | // @name XSSHelper
3 | // @version 0.1
4 | // @description XSS Helper
5 | // @exclude http://*.google.com/*
6 | // @exclude https://*.google.com/*
7 | // @grant none
8 | // @run-at document-start
9 | // ==/UserScript==
10 |
11 |
12 | // @match http://*/*
13 | // @match https://*/*
14 |
15 | //md5_salt
16 | __XSSHelper_reporturl = "http://127.0.0.1:5000/report_log";
17 | function __XSSHelper_ReportDetection(method, info){
18 | //var url = __XSSHelper_reporturl+"?url="+escape(window.location.href)+"&method="+escape(method)+"&info="+escape(info);
19 | //new Image().src=url;
20 | var xmlhttp=new XMLHttpRequest();
21 | xmlhttp.open("POST",__XSSHelper_reporturl,true);
22 | xmlhttp.setRequestHeader("Content-type","application/x-www-form-urlencoded");
23 | xmlhttp.send("url="+escape(window.location.href)+"&method="+escape(method)+"&info="+escape(info));
24 | }
25 |
26 | // hook window.onerror
27 | (function() {
28 | __XSSHelper_onerror = window.onerror;
29 | window.onerror = function (msg, url, lineNo, columnNo, error) {
30 | if(__XSSHelper_onerror) __XSSHelper_onerror();
31 | var string = msg.toLowerCase();
32 | var substring = "script error";
33 | if (string.indexOf(substring) > -1){
34 | //alert('Script Error: See Browser Console for Detail');
35 | var message = [
36 | 'Message: ' + msg,
37 | 'URL: ' + url,
38 | 'Line: ' + lineNo,
39 | 'Column: ' + columnNo,
40 | 'Error object: ' + JSON.stringify(error)
41 | ].join('\n');
42 | __XSSHelper_ReportDetection('window.onerror: script error', message);
43 | } else {
44 | var message = [
45 | 'Message: ' + msg,
46 | 'URL: ' + url,
47 | 'Line: ' + lineNo,
48 | 'Column: ' + columnNo,
49 | 'Error object: ' + JSON.stringify(error)
50 | ].join('\n');
51 | if(msg.indexOf('SyntaxError') != -1 || msg.indexOf('Uncaught ReferenceError') != -1){
52 | console.log(message);
53 | __XSSHelper_ReportDetection('window.onerror: SyntaxError', message);
54 | }
55 | }
56 |
57 | return false;
58 | };
59 |
60 | })();
61 |
62 | function __XSSHelper_GetQueryParams() {
63 | var url = location.search; //获取url中"?"符后的字串
64 | var theRequest = new Object();
65 | if (url.indexOf("?") != -1) {
66 | var str = url.substr(1);
67 | strs = str.split("&");
68 | for(var i = 0; i < strs.length; i ++) {
69 | theRequest[strs[i].split("=")[0]] = unescape(strs[i].split("=")[1]);
70 | }
71 | }
72 | return theRequest;
73 | }
74 |
75 | // find flash
76 | /*
77 | (function() {
78 | setTimeout(function(){
79 | var urls = performance.getEntries();
80 | have_flash = false;
81 | urls.forEach(function(e){
82 | if(e.name.indexOf(".swf") !== -1){
83 | have_flash = true;
84 | console.warn("%c"+location.hostname+' 发现Flash:'+e.name,"color:red;font-size:13px");
85 | }
86 | });
87 | if(have_flash) __XSSHelper_ReportDetection('flash', 'Flash found!');
88 | }, 5000);
89 | })();
90 | */
91 | //hook innerHTML
92 | (function () {
93 | var setter = Object.getOwnPropertyDescriptor(Element.prototype, 'innerHTML').set;
94 | Object.defineProperty(Element.prototype, 'innerHTML', {
95 | set: function innerHTML_Setter(val) {
96 | /*
97 | console.group();
98 | console.log('innerHTML on Object:', this);
99 | console.log('Value:', JSON.stringify(val));
100 | var stack = new Error().stack;
101 | // Remove this function from the stack:
102 | stack = stack.trim().split('\n').slice(1).join(' <- ')
103 | console.log('Stack: ', stack)
104 | console.groupEnd(); */
105 | params = __XSSHelper_GetQueryParams();
106 | if(window.location.hash.substr(1)) params["__local_hash"] = window.location.hash.substr(1);
107 | var info = '';
108 | for (var key in params){
109 | if(val.indexOf(params[key]) !== -1 && isNaN(params[key])){
110 | console.group();
111 | //console.log(document.currentScript.src);
112 | console.log('innerHTML on Object:', this);
113 | console.log('Key:', JSON.stringify(key));
114 | console.log('Value:', JSON.stringify(val.substr(0, 256)));
115 | var stack = new Error().stack;
116 | // Remove this function from the stack:
117 | stack = stack.trim().split('\n').slice(1).join(' <- ');
118 | console.log('Stack: ', stack);
119 | console.groupEnd();
120 | info += [
121 | 'innerHTML on Object: ' + this,
122 | 'Key: ' + key,
123 | 'Value: ' + params[key],
124 | 'stack: ' + stack
125 | ].join('\n')+"\n";
126 | //alert("query appears in innerHTML");
127 | }
128 | }
129 | if(info){
130 | info += "\n\ninnerHTML: "+val;
131 | __XSSHelper_ReportDetection('innerHTML: query appears in innerHTML', info);
132 | }
133 | // call original innerHTML setter:
134 | return setter.call(this, val);
135 | }
136 | });
137 | })();
138 |
139 | //hook window.postMessage
140 | (function () {
141 | window.__postMessage__ = window.postMessage;
142 | window.postMessage = function(){
143 | if(arguments[1] == "*"){
144 | //alert("Post Message origin is *!");
145 | console.log(arguments[0]);
146 | console.log(document.currentScript.src);
147 | info = ["Data: "+arguments[0],
148 | "origin: "+arguments[1],
149 | "srcUrl: "+document.currentScript.src].join('\n');
150 | __XSSHelper_ReportDetection('window.postMessage: origin is *', info);
151 | }
152 | window.__postMessage__.apply(this, arguments);
153 | };
154 | })();
155 |
156 | // check onmessage
157 | (function () {
158 | // 储存被 Hook 的函数
159 | var EventTarget_addEventListener = EventTarget.prototype.addEventListener;
160 | var document_addEventListener = document.addEventListener;
161 |
162 | // Hook addEventListener proc
163 | function addEventListener(type, func, useCapture) {
164 | var _addEventListener = this === document ? document_addEventListener : EventTarget_addEventListener;
165 |
166 | if(this === window && type === 'message'){
167 | console.log("window.onmessage found");
168 | console.log(func);
169 | info = ["Function: "+func].join('\n');
170 | __XSSHelper_ReportDetection('window.onmessage: page has onmessage', info);
171 | }
172 |
173 | _addEventListener.apply(this, arguments);
174 |
175 | }
176 | // hook addEventListener
177 | EventTarget.prototype.addEventListener = addEventListener;
178 | document.addEventListener = addEventListener;
179 | })();
180 |
181 | //hook window.prompt
182 | (function () {
183 | window.__prompt__ = window.prompt;
184 | window.prompt = function(){
185 | if(arguments[0] == 233){
186 | info = ["url: "+document.currentScript.src].join('\n');
187 | __XSSHelper_ReportDetection('window.prompt: xss found', info);
188 | }
189 | window.__prompt__.apply(this, arguments);
190 | };
191 | })();
--------------------------------------------------------------------------------
/tornado_proxy/proxy.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | '''
3 | owtf is an OWASP+PTES-focused try to unite great tools & facilitate pentesting
4 | Copyright (c) 2013, Abraham Aranguren http://7-a.org
5 | All rights reserved.
6 |
7 | Redistribution and use in source and binary forms, with or without
8 | modification, are permitted provided that the following conditions are met:
9 | * Redistributions of source code must retain the above copyright
10 | notice, this list of conditions and the following disclaimer.
11 | * Redistributions in binary form must reproduce the above copyright
12 | notice, this list of conditions and the following disclaimer in the
13 | documentation and/or other materials provided with the distribution.
14 | * Neither the name of the copyright owner nor the
15 | names of its contributors may be used to endorse or promote products
16 | derived from this software without specific prior written permission.
17 |
18 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
19 | ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20 | WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
22 | ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 | (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 | LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
25 | ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 | (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27 | SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 |
29 | # Inbound Proxy Module developed by Bharadwaj Machiraju (blog.tunnelshade.in)
30 | # as a part of Google Summer of Code 2013
31 |
32 | # Modified by md5_salt (5alt.me)
33 | '''
34 | import tornado.httpserver
35 | import tornado.ioloop
36 | import tornado.iostream
37 | import tornado.web
38 | import tornado.curl_httpclient
39 | import socket
40 | import ssl
41 | import tornado.escape
42 | import tornado.httputil
43 | import os
44 |
45 | from socket_wrapper import wrap_socket
46 |
47 | def join_with_script_dir(path):
48 | return os.path.join(os.path.dirname(os.path.abspath(__file__)), path)
49 |
50 |
51 | class ProxyHandler(tornado.web.RequestHandler):
52 | """
53 | This RequestHandler processes all the requests that the application recieves
54 | """
55 | SUPPORTED_METHODS = ['GET', 'POST', 'CONNECT', 'HEAD', 'PUT', 'DELETE', 'OPTIONS', 'PATCH']
56 |
57 | cakey = 'ca.key'
58 | cacert = 'ca.crt'
59 | certdir = 'certs/'
60 |
61 | response_body = None
62 |
63 | def request_handler(self, request):
64 | pass
65 |
66 | def response_handler(self, request, response, response_body):
67 | pass
68 |
69 | def save_handler(self, request, response, response_body):
70 | pass
71 |
72 | def set_status(self, status_code, reason=None):
73 | """Sets the status code for our response.
74 | Overriding is done so as to handle unknown
75 | response codes gracefully.
76 | """
77 | self._status_code = status_code
78 | if reason is not None:
79 | self._reason = tornado.escape.native_str(reason)
80 | else:
81 | try:
82 | self._reason = tornado.httputil.responses[status_code]
83 | except KeyError:
84 | self._reason = tornado.escape.native_str("Unknown Error")
85 |
86 | @tornado.web.asynchronous
87 | def get(self):
88 | """
89 | * This function handles all requests except the connect request.
90 | * Once ssl stream is formed between browser and proxy, the requests are
91 | then processed by this function
92 | """
93 |
94 | # Data for handling headers through a streaming callback
95 | restricted_headers = ['Content-Length',
96 | 'Content-Encoding',
97 | 'Etag',
98 | 'Transfer-Encoding',
99 | 'Connection',
100 | 'Vary',
101 | 'Accept-Ranges',
102 | 'Pragma']
103 |
104 | # This function is a callback after the async client gets the full response
105 | # This method will be improvised with more headers from original responses
106 | def handle_response(response):
107 |
108 | self.response_body = response.body if response.body else self.response_body
109 |
110 | # Hook response
111 | ret = self.response_handler(self.request, response, self.response_body)
112 | if ret:
113 | self.response_body = ret
114 | if self.response_body:
115 | self.write(self.response_body)
116 |
117 | self.set_status(response.code)
118 | for header, value in list(response.headers.items()):
119 | if header == "Set-Cookie":
120 | # print(("%s: %s" % (header, value)))
121 | self.add_header(header, value)
122 | else:
123 | if header not in restricted_headers:
124 | self.set_header(header, value)
125 | # print("\n\n")
126 | #self.set_header('Content-Type', response.headers['Content-Type'])
127 | self.finish()
128 |
129 | # Save request and response
130 | self.save_handler(self.request, response, self.response_body)
131 |
132 | # This function is a callback when a small chunk is recieved
133 | def handle_data_chunk(data):
134 | if data:
135 | if not self.response_body:
136 | self.response_body = data
137 | else:
138 | self.response_body += data
139 |
140 | # Hook request
141 | self.request_handler(self.request)
142 |
143 | # The requests that come through ssl streams are relative requests, so transparent
144 | # proxying is required. The following snippet decides the url that should be passed
145 | # to the async client
146 | if self.request.host in self.request.uri.split('/'): # Normal Proxy Request
147 | url = self.request.uri
148 | else: # Transparent Proxy Request
149 | url = self.request.protocol + "://" + self.request.host + self.request.uri
150 |
151 | # More headers are to be removed
152 | for header in ('Connection', 'Pragma', 'Cache-Control'):
153 | try:
154 | del self.request.headers[header]
155 | except:
156 | continue
157 |
158 | # httprequest object is created and then passed to async client with a callback
159 | # pycurl is needed for curl client
160 |
161 | async_client = tornado.curl_httpclient.CurlAsyncHTTPClient()
162 | request = tornado.httpclient.HTTPRequest(
163 | url=url,
164 | method=self.request.method,
165 | body=self.request.body if self.request.method != 'GET' else None,
166 | headers=self.request.headers,
167 | follow_redirects=False,
168 | use_gzip=True,
169 | streaming_callback=handle_data_chunk,
170 | header_callback=None,
171 | proxy_host=self.application.outbound_ip,
172 | proxy_port=self.application.outbound_port,
173 | allow_nonstandard_methods=True,
174 | validate_cert=False)
175 |
176 | try:
177 | async_client.fetch(request, callback=handle_response)
178 | except Exception as e:
179 | print(e)
180 |
181 | # The following 5 methods can be handled through the above implementation
182 | @tornado.web.asynchronous
183 | def post(self):
184 | return self.get()
185 |
186 | @tornado.web.asynchronous
187 | def head(self):
188 | return self.get()
189 |
190 | @tornado.web.asynchronous
191 | def put(self):
192 | return self.get()
193 |
194 | @tornado.web.asynchronous
195 | def delete(self):
196 | return self.get()
197 |
198 | @tornado.web.asynchronous
199 | def options(self):
200 | return self.get()
201 |
202 | @tornado.web.asynchronous
203 | def connect(self):
204 | if os.path.isfile(self.cakey) and os.path.isfile(self.cacert) and os.path.isdir(self.certdir):
205 | self.connect_intercept()
206 | else:
207 | self.connect_relay()
208 |
209 | def connect_intercept(self):
210 | """
211 | This function gets called when a connect request is recieved.
212 | * The host and port are obtained from the request uri
213 | * A socket is created, wrapped in ssl and then added to SSLIOStream
214 | * This stream is used to connect to speak to the remote host on given port
215 | * If the server speaks ssl on that port, callback start_tunnel is called
216 | * An OK response is written back to client
217 | * The client side socket is wrapped in ssl
218 | * If the wrapping is successful, a new SSLIOStream is made using that socket
219 | * The stream is added back to the server for monitoring
220 | """
221 | host, port = self.request.uri.split(':')
222 |
223 | def start_tunnel():
224 | try:
225 | self.request.connection.stream.write(b"HTTP/1.1 200 OK CONNECTION ESTABLISHED\r\n\r\n")
226 | wrap_socket(self.request.connection.stream.socket, host, success=ssl_success)
227 | except tornado.iostream.StreamClosedError:
228 | pass
229 |
230 | def ssl_success(client_socket):
231 | client = tornado.iostream.SSLIOStream(client_socket)
232 | server.handle_stream(client, self.application.inbound_ip) # lint:ok
233 |
234 | try:
235 | s = ssl.wrap_socket(socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0))
236 | upstream = tornado.iostream.SSLIOStream(s)
237 | upstream.connect((host, int(port)), start_tunnel, host)
238 | except Exception:
239 | print(("[!] Dropping CONNECT request to " + self.request.uri))
240 | self.write(b"404 Not Found :P")
241 | self.finish()
242 |
243 | def connect_relay(self):
244 | host, port = self.request.uri.split(':')
245 | client = self.request.connection.stream
246 |
247 | def read_from_client(data):
248 | upstream.write(data)
249 |
250 | def read_from_upstream(data):
251 | client.write(data)
252 |
253 | def client_close(data=None):
254 | if upstream.closed():
255 | return
256 | if data:
257 | upstream.write(data)
258 | upstream.close()
259 |
260 | def upstream_close(data=None):
261 | if client.closed():
262 | return
263 | if data:
264 | client.write(data)
265 | client.close()
266 |
267 | def start_tunnel():
268 | client.read_until_close(client_close, read_from_client)
269 | upstream.read_until_close(upstream_close, read_from_upstream)
270 | client.write(b'HTTP/1.0 200 Connection established\r\n\r\n')
271 |
272 | def on_proxy_response(data=None):
273 | if data:
274 | first_line = data.splitlines()[0]
275 | http_v, status, text = first_line.split(None, 2)
276 | if int(status) == 200:
277 | start_tunnel()
278 | return
279 |
280 | self.set_status(500)
281 | self.finish()
282 |
283 | def start_proxy_tunnel():
284 | upstream.write('CONNECT %s HTTP/1.1\r\n' % self.request.uri)
285 | upstream.write('Host: %s\r\n' % self.request.uri)
286 | upstream.write('Proxy-Connection: Keep-Alive\r\n\r\n')
287 | upstream.read_until('\r\n\r\n', on_proxy_response)
288 |
289 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0)
290 | upstream = tornado.iostream.IOStream(s)
291 |
292 | if self.application.outbound_ip and self.application.outbound_port:
293 | upstream.connect((self.application.outbound_ip, self.application.outbound_port), start_proxy_tunnel)
294 | else:
295 | upstream.connect((host, int(port)), start_tunnel)
296 |
297 |
298 | class ProxyServer(object):
299 |
300 | def __init__(self, handler,inbound_ip="0.0.0.0", inbound_port=8088, outbound_ip=None, outbound_port=None):
301 |
302 | self.application = tornado.web.Application(handlers=[(r".*", handler)], debug=False, gzip=True)
303 | self.application.inbound_ip = inbound_ip
304 | self.application.inbound_port = inbound_port
305 | self.application.outbound_ip = outbound_ip
306 | self.application.outbound_port = outbound_port
307 | global server
308 | server = tornado.httpserver.HTTPServer(self.application, decompress_request=True)
309 | self.server = server
310 |
311 | # "0" equals the number of cores present in a machine
312 | def start(self, instances=0):
313 | try:
314 | #total = Profiler()
315 | #app = tornado.web.Application(handlers=[(r".*", handler)], debug=False, gzip=True)
316 | #global http_server # Easy to add SSLIOStream later in the request handlers
317 | #http_server = tornado.httpserver.HTTPServer(app)
318 | self.server.bind(self.application.inbound_port, address=self.application.inbound_ip)
319 |
320 | # To run any number of instances
321 | self.server.start(instances)
322 | tornado.ioloop.IOLoop.instance().start()
323 |
324 | except Exception as e:
325 | print(e)
326 |
327 | def stop(self):
328 | tornado.ioloop.IOLoop.instance().stop()
329 | print("[!] Shutting down the proxy server")
330 |
331 | if __name__ == "__main__":
332 | try:
333 | proxy = ProxyServer(ProxyHandler)
334 | proxy.start()
335 | except KeyboardInterrupt:
336 | proxy.stop()
--------------------------------------------------------------------------------