Question

[imhunterand]

Question

[imhunterand]

of course, you can use it.

[rudSarkar]

Does it change the parameters from waybackurls like qsreplace of tomnomnom tool?

I tried, but it doesn't change waybackurls parameter it just appends the payloads end of the line also it doesn't check if there is already http or https available.

Example:

http://https://example.com/username/edit/?id=2677956../../../../../etc/passwd

CC: @imhunterand

[imhunterand]

as the result dont use a http or https just a domain example.com as your target.

[0xspade]

hmm, so after parsing the results from wayback urls we should remove the protocols? is that right? like this

Example:
example.com/endpoint?param=hello&test=world

and it will append the payload?

[imhunterand]

Hi @0xspade

The payloads will executed in request-param:
redacted.com/s.?param= or redacted.com/news=dlldkk/idspath=esxpath={payloads}

[rudSarkar]

Hi @0xspade

The payloads will executed in request-param: redacted.com/s.?param= or redacted.com/news=dlldkk/idspath=esxpath={payloads}

Then this tool needs more modification, I will suggest using regex to check if the _target variable matches with regex then leave them default URL with HTTP and HTTPS

ApachSAL/modules/request_mrclw.py

Line 23 in 7e0e24a

obj_urllib = urllib.request.Request(target_url)

If it does not match with regex then add target_url = self.protocol + '://'+_target variable

ApachSAL/modules/request_mrclw.py

Line 18 in 7e0e24a

target_url = self.protocol + '://'+_target

Yesterday I tried to edit the code for PR but it broke many times due to a lack of code quality style.

[rudSarkar]

RequestMrclw class

In this code I made changes but in main.py there are some spaghetti codes that make a mess while working.

import re
import time
from socket import timeout
import requests
import urllib
from requests.exceptions import ConnectionError, HTTPError


class RequestMrclw:
    def __init__(self):
        self.protocol = 'https'
        self.timeout = 8
        self.header = {}

    def send_request(self, _target: str, _value_header: str):
        if _target:
            target_url = None
            target_url = self.protocol + '://'+_target
            try:

                start = time.time()

                if re.match("^(http:\/\/|https:\/\/)+", _target):
                    print(_target)
                    obj_urllib = urllib.request.Request(_target)
                    obj_urllib.add_header(
                        "Content-type", "application/x-www-form-urlencoded")
                    obj_urllib.add_header(
                        "User-Agent", 'Mozilla/5.0 (Macintosh; Intel Mac OS X x.y; rv:42.0) Gecko/20100101 Firefox/42.0')
                    obj_request = urllib.request.urlopen(
                        obj_urllib, timeout=self.timeout)
                    obj_request_result = str(
                        obj_request.read().decode('utf-8'))

                    time_final = (f'in {time.time() - start:.2f}s')

                    if obj_request_result:
                        return obj_request.url, obj_request_result, obj_request.status, time_final
                    return _target, 'Empry', obj_request.status, time_final
                else:
                    print(target_url)
                    obj_urllib = urllib.request.Request(target_url)
                    obj_urllib.add_header(
                        "Content-type", "application/x-www-form-urlencoded")
                    obj_urllib.add_header(
                        "User-Agent", 'Mozilla/5.0 (Macintosh; Intel Mac OS X x.y; rv:42.0) Gecko/20100101 Firefox/42.0')
                    obj_request = urllib.request.urlopen(
                        obj_urllib, timeout=self.timeout)
                    obj_request_result = str(
                        obj_request.read().decode('utf-8'))

                    time_final = (f'in {time.time() - start:.2f}s')

                    if obj_request_result:
                        return obj_request.url, obj_request_result, obj_request.status, time_final
                    return target_url, 'Empry', obj_request.status, time_final

            except urllib.error.HTTPError as ehttp:
                return target_url, 'HTTP Error!', ehttp.code, str()
            except timeout:
                return target_url, 'Time!', 'Socket Timed Out', str()
            except urllib.error.URLError as eurl:
                return target_url, 'URL Error!', eurl.reason, str()


RequestMrclw().send_request("hackerone.com", None)

Output of send_request()

I suggest you implement this fix for this tool it will make more sense while working with waybackurls data.

CC: @imhunterand

[imhunterand]

Hi! @rudSarkar
Please make it to pull-request at this project source for contribute.

Regards,

[rudSarkar]

Hi! @rudSarkar Please make it to pull-request at this project source for contribute.

Regards,

But it breaks the main.py and returns URL ERROR!.