# web漏洞测试工具研发-http/s请求包处理 - guimaizi

# coding: utf-8
"""
@Time :    6/18/2021 17:02
@Author:  guimaizi
@File: process_http_request.py
@Software: PyCharm
"""
import json,copy
from urllib.parse import urlparse
from urllib import parse
class process_http_request:
    def __init__(self):
        self.list_data=[]

    def type_param(self,param_data):
        '''
        返回数据类型  INT Json List Url String
        :param param_data:
        :return:
        '''
        try:
            int(param_data)
            return 'Int'
        except:pass
        try:
            if type(param_data) == type({'a': 1}):return 'Json'
        except:pass
        try:
            if type(json.loads(param_data)) == type({'a': 1}):return 'Json'
        except:pass
        try:
            if type(param_data) == type([]):return 'List'
        except:pass
        if parse.unquote(param_data).startswith('http://') or parse.unquote(param_data).startswith('https://'):return 'Url'
        return 'String'

    def process_payload(self,json_data, num, payload):
        '''
        Payload处理 0追加 1替换 2值前添加
        :param json_data:
        :param num:
        :param payload:
        :return:
        '''
        #print(num)
        if num == 0:
            json_data = str(json_data) + payload
        elif num == 1:
            json_data = payload
        elif num == 2:
            json_data = payload + str(json_data)
        return json_data

    def process_json(self,http_request_body, param_name=''):
        '''
        遍历json键名
        :param http_request_body:
        :param param_name:
        :return:
        '''
        for name in http_request_body:
            #print(name)
            if param_name != '':
                self.list_data.append((param_name + '.' + name,self.type_param(http_request_body[name]),http_request_body[name]))
            else:
                self.list_data.append((name,self.type_param(http_request_body[name]),http_request_body[name]))
            if isinstance(http_request_body[name], dict):
                if param_name != '':
                    self.process_json(http_request_body[name], param_name + '.' + name)
                else:
                    self.process_json(http_request_body[name], name)
    def callback_set_json(self,http_request,data):
        http_request["param_name"] = data["param_name"]
        http_request["param_value"] = data["param_value"]
        http_request["param_type"] = data["param_type"]
        return http_request

    def callback_json_http_request(self,http_request_body, param_name_list, payload='', payload_num=0):
        '''
        Json格式http body返回
        :param http_request_body:
        :param param_name_list:json键名
        :param payload:
        :param num:
        :return:
        '''
        param_name_list = param_name_list.split('.')
        num_param = len(param_name_list)
        num=0
        task_name = 'http_request_body[param_name_list[%s]]' % num
        for i in range(num_param):
            if num ==num_param-1:
                param_type = self.type_param(eval(task_name))
                param_value=eval(task_name)
                item=eval('task_name')+" = self.process_payload("+eval('task_name')+", payload_num, payload)"
                exec(item)
            num = num + 1
            task_name =task_name+'[param_name_list[%s]]'%num
        return {"param_name": '.'.join(param_name_list), "param_value": param_value, "param_type": param_type,
                "data": http_request_body}

    def callback_param_http_request(self, http_request_body, param, payload='', payload_num=0):
        '''
        a=str&b=str&c=1 返回
        :param http_request_body:
        :param param: 参数名
        :param payload:
        :param num:
        :return:
        '''
        try:
            list_data=[]
            task_list=list(set(http_request_body.split('&')))
            if '' in task_list:
                task_list.remove('')
            #print(task_list)
            for tmp in task_list:
                #print(tmp.split('=')[0])
                #print(param)
                tmp=copy.deepcopy(tmp)
                if '=' in tmp and str(tmp.split('=')[0])==param:
                    param_name=tmp.split('=')[0]
                    param_value=tmp.split('=')[1]
                    param_type=self.type_param(tmp.split('=')[1])
                    list_data.append(tmp.split('=')[0]+'='+self.process_payload(tmp.split('=')[1],payload_num,payload))
                else:
                    #print(tmp.split('='))
                    if len(tmp.split('='))==2:
                        list_data.append(tmp.split('=')[0] + '=' + tmp.split('=')[1])
                    else:
                        param_value='Null'
                        param_type='Null'
                        list_data.append(tmp.split('=')[0] + '=' + param_value)
            #print(list_data)
            return {"param_name":param_name, "param_value": param_value, "param_type": param_type,"param_data":'&'.join(list_data)}
        except:return {}
    def process_param(self, http_request_body, param_name=''):
        '''
        遍历参数名 a=str&b=str&c=1  这类参数处理
        :param http_request:
        :param param_name:
        :return:
        '''
        try:
            callback_param = []
            for tmp in http_request_body.split('&'):
                if len(tmp.split('='))==2:
                    callback_param.append((tmp.split('=')[0],self.type_param(tmp.split('=')[1]),tmp.split('=')[1]))
                else:callback_param.append((tmp.split('=')[0],'Null','Null'))
            return callback_param
        except Exception as e:
            print(e)
            return []
    def callback_param_list(self,http_request):
        '''

        :param http_request:
        :return: (参数名 , 参数值类型)
        [('method', 'String'), ('name', 'String'), ('age', 'Int'), ('data', 'Json'), ('data.name', 'String'), ('sada', 'Int')]
        '''
        param_list=[]
        query = parse.urlparse(http_request['url']).query
        if http_request['method'] == 'GET' and query!='':
            param_list.extend(self.process_param(query))
        elif http_request['method'] == 'POST' and http_request['body']!='':
            if query!='':param_list.extend(self.process_param(query))
            if self.type_param(http_request['body'])=='Json':
                if type(http_request['body'])==type({}):
                    self.process_json(http_request['body'])
                else:
                    self.process_json(json.loads(http_request['body']))
                param_list.extend(self.list_data)
            else:
                param_list.extend(self.process_param(http_request['body']))
        self.list_data=[]
        return param_list
    def callback_http_request(self,http_request,param,payload='',payload_num=0):
        '''
        返回设置payload后的http请求包
        :param http_request:
        :param param:
        :param payload:
        :param payload_num:
        :return:
        '''
        http_request=copy.deepcopy(http_request)
        if self.type_param(http_request['body'])=='Json':
            http_request['body']=json.loads(http_request['body'])
        url_process = parse.urlparse(http_request['url'])
        http_get_data = self.callback_param_http_request(copy.deepcopy(url_process.query), param, payload, payload_num)
        if http_request['method'] == 'GET' and url_process.query!='' and http_get_data!= {}:
            http_request['url'] = url_process.scheme + '://' + url_process.netloc + url_process.path + '?' + http_get_data[
                'param_data']
            http_request=self.callback_set_json(http_request,http_get_data)
            return http_request
        elif http_request['method'] == 'POST' and http_request['body'] != 'Null':
            if url_process.query != '' and http_get_data!= {}:
                http_request['url']=url_process.scheme+'://'+url_process.netloc+url_process.path+'?'+http_get_data['param_data']
                http_request=self.callback_set_json(http_request,http_get_data)
                return http_request
            if self.type_param(http_request['body'] )=='Json':
                json_data=self.callback_json_http_request(http_request['body'],param,payload,payload_num)
                http_request = self.callback_set_json(http_request, json_data)
                http_request["body"] = json_data["data"]
                return http_request
            elif http_request['body']!='Null' :
                post_data = self.callback_param_http_request(copy.deepcopy(http_request["body"]), param, payload,payload_num)
                if post_data!={}:
                    http_request = self.callback_set_json(http_request, post_data)
                    http_request["body"] = post_data["param_data"]
                    return http_request
        return http_request

if __name__ == '__main__':
    test_json={"headers": {"Origin": "http://192.168.220.130", "Cookie": "PHPSESSID=1db5thrprbsm1nms5fer3fdj7c", "Accept": "*/*", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4505.0 Safari/537.36", "Referer": "http://192.168.220.130/web_vul_test/test_sql.html", "Connection": "close", "Accept-Encoding": "gzip, deflate", "Content-type": "application/json", "Accept-Language": "zh-CN,zh;q=0.9", "Content-Length": "58"}, "method": "POST", "body": "{\"name\":\"lisi\",\"age\":50,\"data\":{\"name\":\"acccca\"},\"sada\":1}", "url": "http://192.168.220.130:80/web_vul_test/php_api/json_sql.php?method=sql_inj_json_insert_method&dsadas=aa1111111"}
    #test_json = {"headers": {"Cookie": "PHPSESSID=1db5thrprbsm1nms5fer3fdj7c", "Accept": "*/*", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4505.0 Safari/537.36", "Referer": "http://192.168.220.130/web_vul_test/test_sql.html", "Connection": "close", "Accept-Encoding": "gzip, deflate", "Accept-Language": "zh-CN,zh;q=0.9"}, "method": "GET", "body": "null", "url": "http://192.168.220.130:80/web_vul_test/php_api/json_sql.php?as&fds=111"}
    #test_json={"headers": {"Origin": "http://192.168.220.130", "Cookie": "PHPSESSID=1db5thrprbsm1nms5fer3fdj7c", "Accept": "*/*", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4505.0 Safari/537.36", "Referer": "http://192.168.220.130/web_vul_test/test_sql.html", "Connection": "close", "Accept-Encoding": "gzip, deflate", "Content-type": "application/x-www-form-urlencoded", "Accept-Language": "zh-CN,zh;q=0.9", "Content-Length": "36"}, "method": "POST", "body": "fname=Bill&lname=Gates&id=2&dasdsa=1", "url": "http://192.168.220.130:80/web_vul_test/php_api/json_sql.php?method=sql_inj_post_method&sa1=sada&aaa1=a1"}
    task=process_http_request()
    for item in task.callback_param_list(test_json):
        if item[1] != 'Json':
            print(item)
            print(task.callback_http_request(test_json, item[0], 'payload', 0))