Showing posts with label HTTP. Show all posts
Showing posts with label HTTP. Show all posts

A Simple php script for Port Scanning

The below given php script scans open ports on target server. There are mainly two functions are used for scanning :

fsockopen() : The fsockopen() function is used to open socket connection with given hostname and port. Syntax :
 fsockopen(hostname, port, errNo, errStr, timeout);
getservbyport() : The getservbyport() function is used to get the service name which corresponds to supplied port and protocol. Syntax :
 getservbyport(portNumber, ProtocolName);
Read more »

Wget for Beginners : How to use wget in Linux/Unix Based Systems

Wget is a command-line downloader for Linux and UNIX environments. It is very powerful and versatile tool used for retrieves content from web servers and websites. Wget is freely available package and license is under GNU GPL License. With wget we can download files or even entire website. It supports the download protocols (HTTP, HTTPS, FTP and, FTPS).  It helps users to download huge chunks of data, multiple files and to do recursive downloads. Main feature of Wget of it’s robustness, and it also works well in slow or unstable network connections. Some of the features of wget are resuming of downloads, bandwidth control, authentication handling etc.
Read more »

What is Cross Origin Resource Sharing : Beginners Guide To CORS

​​​Cross-origin resource sharing (CORS) is a standard for accessing web resources on different domains. CORS allows web scripts to interact more openly with content outside of the original domain, leading to better integration between web services. A web page may freely embed cross-origin images, stylesheets, scripts, iframes, and videos. Certain "cross-domain" requests, notably Ajax requests, are forbidden by default by the same-origin security policy. CORS defines a way in which a browser and server can interact to determine whether or not it is safe to allow the cross-origin request. It allows for more freedom and functionality than purely same-origin requests, but is more secure than simply allowing all cross-origin requests.
Read more »

What is Same Origin Policy : A Beginners Guide To SOP

The same-origin policy is an important concept in the web application security model. The same-origin policy restricts how a document or script loaded from one origin can interact with a resource from another origin. In this policy a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin. It is a critical security mechanism for isolating potentially malicious documents.
Read more »

Curl for Web Hacking and Pentesting

In the previous post we saw the basic uses of curl. Now at this we are going to see some useful and important command as web pentesting view.

1. Get the HTTP response header

We can get header information of a website with '-I' flag
 curl -I http://www.w3.org
2. Sending GET Requests
 curl "http://www.testserver.com/example.php?name=hacke&age=30"
3. Sending POST requests 
 curl -d "name=ajay&submit=Submit" http://www.testserver.com/example.php
4. To follow a redirect location:
 curl -L http://www.testserver.com
5. Sending custom Headers : 
 curl -H "user-agent:Mozilla/5.0 (X11; Linux x86_64) " http://www.testserver.com
 curl -H "Content-Type: text/xml" http://www.testserver.com
 curl -H "Host: www.unknownsite.com" http://www.testserver.com
6. Custom User-Agent Header :

We can send custom user agent header by '-A' flag
 curl -A "Mozilla/5.0 (X11; Linux x86_64)" http://www.testserver.com
 curl -A "Mozilla/5.0 (compatible;  Windows NT 5.0)" http://www.testserver.com
7. Custom Referrer field :
 curl -e http://referersite.com http://www.testserver.com
Or we can also send custom referrer with below command
 curl -H "Referrer: http://referersite.com"  http://www.testserver.com
8. Custom Cookies : 

To send custom cookies use '-b' flag
 curl -b "name=sectree" http://www.testserver.com
To store response cookies in a file use '-c' option. We can also send cookies which is stored in a file.
 curl -b current_cookies.txt -c new_cookies.txt http://www.testserver.com
where the current_cookies.txt are being sent to the web server and new_cookies.txt are response cookies by the server which is stored and written in that file.


Read more »

How to use Curl in Linux : Curl Guide For beginners

Curl is a command line tool for getting or sending files using URL syntax. It is used to transfer data from or to a server, using one of the supported protocols (DICT, FILE, FTP, FTPS, GOPHER, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET and TFTP). The command is designed to work without user interaction. We can use curl for download files from internet, sending custom HTTP ( GET and POST ) request, as FPT client, sending e-mails etc. Curl can be used in many different and interesting ways. Some of the main features of curl is :
Read more »

Web Scrapping with Python using BeautifulSoup module

Web Scrapping (also known as web harvesting or web data extraction ) is a technique used to extract information and data from websites. In this tutorial we are going to use a python module called beautifulSoup for web scrapping. It is very powerful python library for extract data from HTML and XML files. But note that BeautifulSoup does not send any page requests to website, so we have to do this by using other modules like urllib2, requests etc. Now first we need to install BeautifulSoup Library. To install the BeautifulSoup module use the below command :
 sudo apt-get install python-bs4
or you can also install with pip
 pip install beautifulsoup4
or in-order to install BeautifulSoup from source, Download the source from here

https://www.crummy.com/software/BeautifulSoup/bs4/download/4.6/

Then extract it and run the setup.py file
 tar xvf beautifulsoup4-x.x.tar.gz
 python setup.py install

Installing HTML Parser :

In Beautiful Soup we need to suppy an html parser to process the data. With python an html parser ('html.parser') comes built in, But we can also instal some more powerfull html parsers like xml, html5lib etc. To install below parsers use the below command :
 sudo apt-get install python-lxml
 sudo apt-get install python-html5lib
or
 pip install lxml
 pip install html5lib
The lxml parser is very fast and can be used to quickly parse given HTML. But the html5lib is a bit slow as compared to lxml, but it is also very useful parser. To clearify the difference between all the parsers, try the below code :
 $ python
 
 >>> from bs4 import BeautifulSoup
 >>> code = """<html>
 <HEAD>
 <title>This is test
 </HEAD>
 <body>
 <p>Hello world This is test</p>
 </html>"""
html.pareser :
 >>> psr1 = BeautifulSoup(code, 'html.parser')
 >>> print psr1
 <html>
 <head>
 <title>This is test
 </title></head>
 <body>
 <p>Hello world This is test</p>
 </body></html>
xml parser :
 >>> psr2 = BeautifulSoup(code, 'xml')
 >>> print psr2
 <?xml version="1.0" encoding="utf-8"?>
 <html>
 <HEAD>
 <title>This is test
 </title>
 <body>
 <p>Hello world This is test</p>
 </body></HEAD></html>
lxml parser :
 >>> psr3 = BeautifulSoup(code, 'lxml')
 >>> print psr3
 <html>
 <head>
 <title>This is test
 </title></head>
 <body>
 <p>Hello world This is test</p>
 </body></html>
html5lib parser :


Basics of beautifulSoup :

Now here are some basic example of how to use BeautifulSoup Library for Web Scrapping, we are taking a simple html code for demonstration :
 <html>
 <head>
  <title>Simple Web Page</title>
 </head>
 <body>
  <p class='heading'>Hello world : A Sample Page test</p>
  <p class='sub-heading'>This the Sub-heading or Description</p>
  <table>
    <tr>
   <th>Firstname</th><th>Lastname</th> <th>Age</th>
  </tr>
  <tr>
   <td>Frank</td><td>Castle</td><td>40</td>
    </tr>
    <tr>
   <td>Jack</td><td>Rietcher</td><td>45</td>
    </tr>
  </table>
  <a href="http://wikipedia.org/">Wikipedia</a>
  <a href="http://youtube.com">Watch Videos</a>
  <a href="http://google.com">Search Something</a>
  <a href="http://facebook.com">Find Your Friends</a>
 <body>
</html>
Store the above code in a variable in python interpreter
 code = """<html>
 <head>
  <title>Simple Web Page</title>
 </head>
 <body>
  <p class='heading'>Hello world : A Sample Page test</p>
  <p class='sub-heading'>This the Sub-heading or Description</p>
  <table>
    <tr>
    <th>Firstname</th><th>Lastname</th> <th>Age</th>
  </tr>
  <tr>
   <td>Frank</td><td>Castle</td><td>40</td>
    </tr>
    <tr>
   <td>Jack</td><td>Rietcher</td><td>45</td>
    </tr>
  </table>
  <a href="http://wikipedia.org/">Wikipedia</a>
  <a href="http://youtube.com">Watch Videos</a>
  <a href="http://google.com">Search Something</a>
  <a href="http://facebook.com">Find Your Friends</a>
 <body>
</html>"""
Now import the BeautifulSoup library :
 from bs4 import BeautifulSoup
Now create a bs4 object to parse the data, we going to use lxml parser in this example :
 soup = BeautifulSoup(code, 'lxml')
Now with the soup objects we can access all elements of the html page throgh tag names and its attributes. For example to get the title of page
 >>> soup.title
 <title>Simple Web Page</title>

 >>> soup.title.string
 u'Simple Web Page'

 >>> soup.title.name
 'title'
To get the paragraph :
  >>> soup.p
 <p class="heading">Hello world : A Sample Page test</p>
 
 >>> print soup.p.contents
 [u'Hello world : A Sample Page test']

 >>> soup.p.string
 u'Hello world : A Sample Page test'
To get all paragraph
  >>> soup.find_all('p')
 [<p class="heading">Hello world : A Sample Page test</p>, <p class="sub-heading">This the Sub-heading or Description</p>]
Extracting table information
   >>> soup.body.table
 <table>\n<tr>\n<th>Firstname</th><th>Lastname</th> <th>Age</th>\n</tr>\n<tr>\n<td>Frank</td><td>Castle</td><td>40</td>
 \n</tr>\n<tr>\n<td>Jack</td><td>Rietcher</td><td>45</td>\n</tr>\n</table>
 
 >>> soup.body.table.tr
 <tr>\n<th>Firstname</th><th>Lastname</th> <th>Age</th>\n</tr>
 
 >>> soup.body.table.tr.th
 <th>Firstname</th>
 
 >>> soup.body.table.tr.find_all('th')
 [<th>Firstname</th>, <th>Lastname</th>, <th>Age</th>]
printing all rows data in table
 >>> for dat in soup.body.table.find_all('tr'):
 ...      for ind in dat.find_all('td'):
 ...             print ind.string
 ... 
 Frank
 Castle
 40
 Jack
 Rietcher
 45
Getting link information
  >>> soup.body.a
 <a href="http://wikipedia.org/">Wikipedia</a>
 
 >>> soup.body.find_all('a')
 [<a href="http://wikipedia.org/">Wikipedia</a>, <a href="http://youtube.com">Watch Videos</a>, <a href="http://google.com">Search Something</a>, 
 <a href="http://facebook.com">Find Your Friends</a>]
print all the links :
 >>> for link in soup.body.find_all('a'):
 ...     print link['href']
 ... 
 http://wikipedia.org/
 http://youtube.com
 http://google.com
 http://facebook.com
With next_sibling and previous_sibling we can navigate between page elements that are on the same level
 >>> soup.body.p
 <p class="heading">Hello world : A Sample Page test</p>

 >>> soup.body.p.next_sibling
 u'\n'

 >>> soup.body.p.next_sibling.next_sibling
 <p class="sub-heading">This the Sub-heading or Description</p>

Parsing a Webpage with urllib2 and BeautifulSoup :

first imoprt all the necessary libraries
 from bs4 import BeautifulSoup
 import urllib2
Now to get the page, send the get request to the page url https://www.w3.org, and parse it with BeautifulSoup
 page = urllib2.urlopen("https://www.w3.org")
 soup = BeautifulSoup(page, 'lxml')
Now get the title of the page
 >>> soup.title.string
 u'World Wide Web Consortium (W3C)'

 >>> soup.body.p
 <p class="bct"><span class="skip"><a accesskey="2" href="#w3c_most-recently" tabindex="1" title="Skip to content (e.g., when browsing via audio)">Skip</a></span></p>

Harvesting all the links
 >>> for link in soup.find_all('a'):
 ...     print link['href']
 ... 
 /
 /standards/
 /participate/
 ------------
 -----------
 https://www.w3.org/WAI/videos/standards-and-benefits.html
 https://www.w3.org/WAI/videos/standards-and-benefits.html
 http://lists.w3.org/Archives/Public/site-comments/
 http://twitter.com/W3C
 http://www.csail.mit.edu/
 http://www.ercim.eu/
 http://www.keio.ac.jp/
 http://ev.buaa.edu.cn/
Printing all the text from page :
 print (soup.get_text())
And with like the above we can collect information by parsing the web pages.

Conclusion :

The BeautifulSoup is very powerful library to parse the HTML and XML documents and collecting data from it. At above we saw some very basic example of how to use it. And For more detail information please check the documentation page at here : Official Documentation
Read more »

A Beginners Guide to requests Library in Python : How to Use requests library in Python

Most existing Python modules for sending HTTP requests are extremely verbose and cumbersome. Python’s builtin urllib2 module provides most of the HTTP capabilities you should need, but the api is thoroughly broken. It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
Read more »

How to use urllib2 module in Python : A Beginners guide to urllib2 module

urllib2 is a Python module for fetching URLs. It offers a very simple interface, in the form of the urlopen function.  The urllib2 is capable of fetching URLs using a variety of different protocols and it also supports slightly complex interface for handling common situations - like basic authentication, cookies, proxies and so on. 
Read more »

Banner Grabbing with Python

In the previous post we saw the basics of banner grabbing techniques. Now we are trying to grab banners with some python scripts. In python we are going to use socket module to connect to target services. The socket module exposes the low-level C API for communicating over a network using the BSD socket interface.
Read more »

What is Banner Grabbing : Banner Grabbing for Beginners

Banner grabbing is a technique used to gain information about a computer system on a network and the services running on its open ports. An Attacker can use banner grabbing in order to find network hosts that are running versions of applications and operating systems with known exploits. Some examples of service ports used for banner grabbing are those used by Hyper Text Transfer Protocol (port 80), File Transfer Protocol (port 21), and Simple Mail Transfer Protocol (port 25). Banners can be accessed through Client softwares like netcat, telnet in the command prompt on the target system’s IP address. Other tools for banner grabbing include Nmap, SuperScan etc. For example, to grab a banner, we can establish a connection to a target web server using Netcat, then send an HTTP request. The response will typically contain information about the service running on the host.
Read more »

How to use THC Hydra for bruteforcing Web app Login Forms

Hydra is an online login cracker and form bruteforcer which supports numerous protocols to attack. It is very fast and flexible and this tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. There are already several login hacker tools available, however none does either support more than one protocol to attack or support parallelized connects. Hydra can be used and compiled cleanly on Linux, Windows/Cygwin, Solaris, FreeBSD/OpenBSD, QNX (Blackberry 10) and OSX. THC Hydra tool supports the following protocols:
Read more »

Wfuzz : How to install, Configure and start with wfuzz in linux based systems (Ubuntu)

Wfuzz is a Python-based flexible web application bruteforcer that can be considered an alternative to Burp Intruder as they both have some common features. It supports various methods and techniques to expose web application vulnerabilities. With Wfuzz we can audit parameters, authentication, forms with brute-forcing GET and POST parameters, cookies, forms, discover unlinked resources such as directories/files, headers and so on.

Read more »

How to install and configure WebGoat in Ubuntu Server 16.04 / Ubuntu 18.04

First update the repository and upgrade system

    sudo apt-get update
    sudo apt-get upgrade

Now install the Java runtime environment in Ubuntu Server

    sudo apt-get install default-jre

Check the version of JRE

    java -version

Now download WebGoat from: https://github.com/WebGoat/WebGoat/releases

https://github.com/WebGoat/WebGoat/releases/download/v8.0.0.M21/webgoat-server-8.0.0.M21.jar


wget https://github.com/WebGoat/WebGoat/releases/download/v8.0.0.M21/webgoat-server-8.0.0.M21.jar

Now if the java version you have installed is 8 or less then use the below command to run webgoat

    java -jar webgoat-server-8.0.0.M21.jar

Or if your java version is 9 or higher then 9 then use the below command to run it :

   java --add-modules java.xml.bind -jar webgoat-server-8.0.0.M21.jar

Now open up browser and navigate to WebGoat


http://(Server_IP_Address):8080/WebGoat 


http://192.168.0.110:8080/WebGoat


we can also start WebGoat with a shell script
 #!/bin/sh  
 java --add-modules java.xml.bind -jar webgoat-server-8.0.0.M21.jar  

    chmod +x webgoat.sh
    ./webgoat.sh
Read more »

Code for HTTP Sniffing with Raw Socket in Python



here is the code:

HttpSniff.py

 #!/usr/bin/python  
   
 import socket  
 import struct  
 import binascii  
   
 def mac_print(mac):  
  mac_ad = "%.2x:%.2x:%.2x:%.2x:%.2x:%.2x" % (ord(mac[0]), ord(mac[1]), ord(mac[2]), ord(mac[3]), ord(mac[4]), ord(mac[5]))  
  return mac_ad  
   
 RawSocket = socket.socket(socket.PF_PACKET, socket.SOCK_RAW, socket.htons(0x0800))  
   
 while True:  
  packet = RawSocket.recvfrom(65565)  
    
  # Check for the TCP packets  
  IpHeader = packet[0][14:34]  
  TcpHeader = packet[0][34:54]  
  ip_hdr = struct.unpack("!B8s1s2s4s4s", IpHeader)  
  tcp_hdr = struct.unpack("!HHLLB7s", TcpHeader)  
  if binascii.hexlify(ip_hdr[2]) == "06" and (tcp_hdr[0] == 80 or tcp_hdr[1] == 80):  
  # Check for the TCP protocol and port 80 [HTTP]  
    
  # Extracting the Mac Address from EtherNet Header  
  dst_mac = mac_print(packet[0][0:6])  
  src_mac = mac_print(packet[0][6:12])  
   
  # Extracting the IP address from IP header  
  src_ip = socket.inet_ntoa(ip_hdr[4])  
  dst_ip = socket.inet_ntoa(ip_hdr[5])  
   
  # Extracting Source and Destination Port  
  src_port = tcp_hdr[0]  
  dst_port = tcp_hdr[1]  
   
  # Calculating the length of data  
  eth_length = 14  
  iph_length = ip_hdr[0]  
  iph_length = (iph_length & 0xF) * 4  
  tcph_length = tcp_hdr[4]  
  tcph_length = (tcph_length >> 4) * 4  
  hdr_length = eth_length + iph_length + tcph_length  
  data_length = len(packet[0]) - hdr_length  
  Data = packet[0][hdr_length:]  
  if Data == None:  
   continue  
  else:  
   # print all The Data  
   print "Source { IP : " + str(src_ip) + " | Mac : " + src_mac + " | Port : " + str(src_port) + " }"  
   print "Dest. { IP : " + str(dst_ip) + " | Mac : " + dst_mac + " | Port : " + str(dst_port) + " }"  
   print "Data : " + Data  
   print "---------------------------------------"  

run this code with root privilege otherwise it may not work, and also you need to generate some http traffic by yourself.

 ajay@ubuntu:~$ sudo ./HttpSniff.py  
 Source { IP : 192.168.56.1 | Mac : 0a:00:27:00:00:00 | Port : 47708 }  
 Dest. { IP : 192.168.56.101 | Mac : 08:00:27:5e:26:c3 | Port : 80 }  
 Data :   
 ---------------------------------------  
 Source { IP : 192.168.56.1 | Mac : 0a:00:27:00:00:00 | Port : 47708 }  
 Dest. { IP : 192.168.56.101 | Mac : 08:00:27:5e:26:c3 | Port : 80 }  
 Data :   
 ---------------------------------------  
 Source { IP : 192.168.56.1 | Mac : 0a:00:27:00:00:00 | Port : 47708 }  
 Dest. { IP : 192.168.56.101 | Mac : 08:00:27:5e:26:c3 | Port : 80 }  
 Data : GET / HTTP/1.1  
 Host: 192.168.56.101  
 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0  
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
 Accept-Language: en-US,en;q=0.5  
 Accept-Encoding: gzip, deflate  
 Connection: keep-alive  
 If-Modified-Since: Mon, 27 Jun 2016 17:03:35 GMT  
 If-None-Match: "2cf6-536458034b832-gzip"  
 Cache-Control: max-age=0  

Read more »