example_1_pydirbust.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-
#
#  example_1_pydirbust.py
#
#  Copyright 2016 Spencer McIntyre
#
#  Redistribution and use in source and binary forms, with or without
#  modification, are permitted provided that the following conditions are
#  met:
#
#  * Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
#  * Redistributions in binary form must reproduce the above
#    copyright notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
#  * Neither the name of the  nor the names of its
#    contributors may be used to endorse or promote products derived from
#    this software without specific prior written permission.
#
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
#  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
#  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
#  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
#  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
#  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
#  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
#  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
#  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
#  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
################################################################################
#
#                     Python for Pentesters Example Script
#
# Title: PyDirBust
# Description:
#   A Python script to enumerate directories on a web server demonstrating basic
#   usage of the requests library, manual argument parsing, and iterationing
#   over a word list. The reason we use the requests library is for it's
#   flexibility and compatibility with both Python 2.x and Python 3.x.
#
# Post Webinar Challenge:
#   Convert the script to use multiple threads.
#
################################################################################

from __future__ import print_function
from __future__ import unicode_literals

import sys

import requests

def main():
	if len(sys.argv) < 3:
		print("usage: {0} [base_url] [wordlist]".format(sys.argv[0]))
		return 0

	base_url = sys.argv[1]
	wordlist = open(sys.argv[2], 'r')
	# make sure the url ends with '/' so it's ready to be appended to
	if not base_url.endswith('/'):
		base_url += '/'

	for word in wordlist:
		word = word.rstrip() # remove the trailing newline
		try:
			response = requests.get(base_url + word)
		except requests.exceptions.ConnectionError:
			print('[-] failed to connect to the web server')
			# if we can't connect to the web server we should just break because
			# its likely that every request in this loop will experience the
			# same issue
			break

		# process the response object
		if 200 <= response.status_code <= 299:
			print("[+] success      ({0}) {1}".format(response.status_code, word))
		elif 300 <= response.status_code <= 399:
			print("[*] redirect     ({0}) {1}".format(response.status_code, word))
		elif response.status_code == 401:
			print("[*] unauthorized (401) {0}".format(word))
		elif response.status_code == 403:
			print("[*] forbidden    (403) {0}".format(word))

	wordlist.close()
	return 0

if __name__ == '__main__':
	sys.exit(main())