HExHTTP/modules/cpdos/ocd.py at main · security-geeks/HExHTTP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
#!/usr/bin/env python3

from utils.style import Colors, Identify
from utils.utils import random, requests, sys

"""
ORIGIN Cache Poisoning.
by Geluchat

"""


def print_result(status: str, vuln: str, reason: str, url: str, payload: str) -> None:
    if payload:
        print(
            f" {status} | {vuln} | {reason} | {Colors.BLUE}{url}{Colors.RESET} |{Colors.THISTLE}{payload}{Colors.RESET}"
        )


def verify_ocd_caching(url: str, method: str, headers: dict[str, str]) -> None:
    for _ in range(5):
        requests.request(
            method,
            url=url,
            headers=headers,
            verify=False,
            allow_redirects=False,
            timeout=10,
        )
    req_main = requests.get(url, verify=False, allow_redirects=False, timeout=10)
    if "geluorigin" in req_main.text:
        print_result(
            Identify.confirmed,
            "OCD",
            f"{method} BODY REFLECTION",
            url,
            "PAYLOAD: 'Origin: https://geluorigin.chat'",
        )
    if "geluorigin" in req_main.headers:
        print_result(
            Identify.confirmed,
            "OCD",
            f"{method} HEADER REFLECTION",
            url,
            "PAYLOAD: 'Origin: https://geluorigin.chat'",
        )


def get_ocd(
    url: str,
    headers: dict[str, str],
    authent: tuple[str, str] | None,
) -> None:
    req_get = requests.get(
        url,
        headers=headers,
        verify=False,
        allow_redirects=False,
        auth=authent,
        timeout=10,
    )
    if "geluorigin" in req_get.text:
        print_result(
            Identify.behavior,
            "OCD",
            "GET BODY REFLECTION",
            url,
            "PAYLOAD: 'Origin: https://geluorigin.chat'",
        )
        verify_ocd_caching(url, "GET", headers)
    if "geluorigin" in req_get.headers:
        print_result(
            Identify.behavior,
            "OCD",
            "GET HEADER REFLECTION",
            url,
            "PAYLOAD: 'Origin: https://geluorigin.chat'",
        )
        verify_ocd_caching(url, "GET", headers)


def options_ocd(
    url: str,
    headers: dict[str, str],
    authent: tuple[str, str] | None,
) -> None:
    req_options = requests.options(
        url,
        headers=headers,
        verify=False,
        allow_redirects=False,
        auth=authent,
        timeout=10,
    )
    if "geluorigin" in req_options.text:
        print_result(
            Identify.behavior,
            "OCD",
            "OPTIONS BODY REFLECTION",
            url,
            "PAYLOAD: 'Origin: https://geluorigin.chat'",
        )
        verify_ocd_caching(url, "OPTIONS", headers)
    if "geluorigin" in req_options.headers:
        print_result(
            Identify.behavior,
            "OCD",
            "OPTIONS HEADER REFLECTION",
            url,
            "PAYLOAD: 'Origin: https://geluorigin.chat'",
        )
        verify_ocd_caching(url, "OPTIONS", headers)


def OCD(url: str, authent: tuple[str, str] | None) -> None:
    headers = {"Origin": "https://geluorigin.chat"}
    get_ocd(f"{url}{random.randrange(999)}", headers, authent)
    options_ocd(f"{url}{random.randrange(999)}", headers, authent)