if __name__ == "__main__":
	try:
		wascan().main()
	except KeyboardInterrupt,e: 
		exit(warn('Exiting... :('))

for opt,arg in opts:
	# CUrl 检查URL ，并规范化
    if opt in ('-u','--url'):url = CUrl(arg) 
	# CScan 检查scan参数是否符合范围
    if opt in ('-s','--scan'):scan = CScan(arg) 
	# CHeaders 传入参数为字符串，调用该函数解析成dict
    if opt in ('-H','--headers'):kwargs['headers'] = CHeaders(arg)
	# POST 体的参数  
    if opt in ('-d','--data'):kwargs['data'] = arg
	# 是否进行暴力破解
    if opt in ('-b','--brute'):kwargs['brute'] = True
	# 指定请求方法
    if opt in ('-m','--method'):kwargs['method'] = arg
	# 指定 host ，将其值更新到 header头 的 Host字段
    if opt in ('-h','--host'):kwargs['headers'].update({'Host':arg}) 
	# 指定 referer，将其值更新到 header头
    if opt in ('-R','--referer'):kwargs['headers'].update({'Referer':arg})
	# 指定 auth
    if opt in ('-a','--auth'):kwargs['auth'] = CAuth(arg) 
	# 指定 agent
    if opt in ('-A','--agent'):kwargs['agent'] = arg 
	# 指定 cookie
    if opt in ('-C','--cookie'):kwargs['cookie'] = arg 
	# 采用随机的 agent
    if opt in ('-r','--ragent'):kwargs['agent'] = ragent()
	# 采用代理
    if opt in ('-p','--proxy'):kwargs['proxy'] = arg 
	# 代理是否要认证
    if opt in ('-P','--proxy-auth'):kwargs['pauth'] = CAuth(arg) 
	# 指定超时时间
    if opt in ('-t','--timeout'):kwargs['timeout'] = float(arg) 
	# 对于302情况，是否要跟随，默认为 False不跳转
    if opt in ('-n','--redirect'):kwargs['redirect'] = False
	# 是否开启指纹识别
    if opt in ('-v','--verbose'):verbose = True
	# 输出版本信息
    if opt in ('-V','--version'):version = Version()
	# 输出帮助信息
    if opt in ('-hh','--help'):self.usage.basic(True)

class wascan(object):
    ...省略...
	def main(self):
		...省略...
		scan = "5"
		...省略...
		try:
			# 打印时间和URL
			PTIME(url)
			if kwargs['brute']:
				BruteParams(kwargs,url,kwargs['data']).run()
			if scan == 0:
				Fingerprint(kwargs,url).run()
			if scan == 1:
				Attacks(kwargs,url,kwargs['data'])
			if scan == 2:
				Audit(kwargs,url,kwargs['data'])
			if scan == 3:
				Brute(kwargs,url,kwargs['data'])
			if scan == 4:
				Disclosure(kwargs,url,kwargs['data']).run()
			# full scan  
			if int(scan) == 5:
				info('Starting full scan module...')
				Fingerprint(kwargs,url).run()
				for u in Crawler().run(kwargs,url,kwargs['data']):
					test('Testing URL: %s'%(u))
					if '?' not in url:
						warn('Not found query in this URL... Skipping..')
					if type(u[0]) is tuple:
						kwargs['data'] = u[1]
						FullScan(kwargs,u[0],kwargs['data'])
					else:
						FullScan(kwargs,u,kwargs['data'])
				Audit(kwargs,parse.netloc,kwargs['data'])
				Brute(kwargs,parse.netloc,kwargs['data'])
		except WascanUnboundLocalError,e:
			pass

def getcc(content):
	"""Credit Card"""
	CC_LIST = re.findall(r'((^|\s)\d{4}[- ]?(\d{4}[- ]?\d{4}|\d{6})[- ]?(\d{5}|\d{4})($|\s))',content)
	if CC_LIST != None or CC_LIST != []:
		return CC_LIST

def getip(content):
	"""Private IP"""
	IP_LIST = re.findall(r'[0-9]+(?:\.[0-9]+){3}',content,re.I)
	if IP_LIST != None or IP_LIST != []:
		return IP_LIST

def getmail(content):
	"""E-mail"""
	EMAIL_LIST = re.findall(r'[a-zA-Z0-9.\-_+#~!$&\',;=:]+@+[a-zA-Z0-9-]*\.\w*',content)
	if EMAIL_LIST != None or EMAIL_LIST != []:
		return EMAIL_LIST

def getssn(content):
	"""US Social Security number"""
	SSN_LIST = re.findall(r'(((?!000)(?!666)(?:[0-6]\d{2}|7[0-2][0-9]|73[0-3]|7[5-6][0-9]|77[0-2]))-((?!00)\d{2})-((?!0000)\d{4}))',content)
	if SSN_LIST != None or SSN_LIST != []:
		return SSN_LIST

class parse:
	def __init__(self,content):
		self.content = content 
	def clean(self):
		"""Clean HTML Response"""
		self.content = re.sub('<em>','',self.content)
		self.content = re.sub('<b>','',self.content)
		self.content = re.sub('</b>','',self.content)
		self.content = re.sub('<strong>','',self.content)
		self.content = re.sub('</strong>','',self.content)
		self.content = re.sub('</em>','',self.content)
		self.content = re.sub('<wbr>','',self.content)
		self.content = re.sub('</wbr>','',self.content)
		self.content = re.sub('<li>','',self.content)
		self.content = re.sub('</li>','',self.content)
		for x in ('>', ':', '=', '<', '/', '\\', ';', '&', '%3A', '%3D', '%3C'):
			self.content = string.replace(self.content,x,' ')
	def getmail(self):
		"""Get Emails"""
		self.clean()
		return getmail(self.content)
	def getip(self):
		""" Get IP """
		self.clean()
		return getip(self.content)
	def getcc(self):
		""" Get Credit Card"""
		self.clean()
		return getcc(self.content)
	def getssn(self):
		""" """
		self.clean()
		return getssn(self.content)

try:
	from BeautifulSoup import BeautifulSoup
except ImportError:
	from bs4 import BeautifulSoup
# 定义了要排除的情况。比如 确定是 7z后缀名，说明是压缩包 而不是网页
EXCLUDED_MEDIA_EXTENSIONS = (
    '.7z', '.aac', '.aiff', '.au', '.avi', '.bin', '.bmp', '.cab', '.dll', '.dmp', '.ear', '.exe', '.flv', '.gif',
    '.gz', '.image', '.iso', '.jar', '.jpeg', '.jpg', '.mkv', '.mov', '.mp3', '.mp4', '.mpeg', '.mpg', '.pdf', '.png',
    '.ps', '.rar', '.scm', '.so', '.tar', '.tif', '.war', '.wav', '.wmv', '.zip'
)

class SCrawler(Request):
	""" Simple Crawler """
	def __init__(self,kwargs,url,data):
		# 父类初始化
		Request.__init__(self,kwargs)
		# url
		self.url = url 
		# post 的 data体
		self.data = data
		# 表格？
		self.forms = []
		# ok 的 链接
		self.ok_links = []
		# 所有 链接
		self.all_links = []
		# 协议
		self.scheme = urlsplit(url).scheme
		# 域名
		self.netloc = urlsplit(url).netloc
		# 内容 初始化为 空
		self.content = None
	def run(self):
		# send request
		resp = self.Send(url=self.url,data=self.data)
		# 获取响应内容
		self.content = resp.content
		# 调用extract解析出相应内容
		self.extract 
		for link in self.all_links:
			# 对于 all_links 中的所有链接，包括 绝对URL 、 相对URL
			# 调用 absolute(link) 统一为 绝对URL
			r_link = self.absolute(link)
			if r_link:
				# 如果 r_link 还未被收录到 ok_links 中，则添加
				if r_link not in self.ok_links:
					self.ok_links.append(r_link)
		return self.ok_links
	@property
	# 疑问：<img src="proxy.php?url=" > 此链接不收取？
	def extract(self):
		# href 找到页面里所有的 超链接 <a href="proxy.php?url=http://test/com">test</a>
		for tag in self.soup.findAll('a',href=True):
			# 添加到 all_links 中
			self.all_links.append(tag['href'].split('#')[0])
		# src 找到页面里所有的 连接 <frame src="proxy.php?url="> <iframe src="proxy.php?url=">
		for tag in self.soup.findAll(['frame','iframe'],src=True):
			self.all_links.append(tag['src'].split('#')[0])
		# formaction 定位 button 提取formaction <button type="submit" formaction="proxy.php?url=demo_admin.asp">以管理员身份提交</button>
		for tag in self.soup.findAll('button',formaction=True):
			self.all_links.append(tag['formaction'])
		# extract form 
		# <form action="proxy.php?url=demo_form.asp" method="get">
		# 	<input type="text" name="lname" />
		# <button type="submit">提交</button><br />
		form = self.form()
		if form != None and form != []:
			if form not in self.all_links:
				self.all_links.append(form)
	@property
	def soup(self):
		soup = BeautifulSoup(self.content)
		return soup
	# 检查link中的 后缀名
	def check_ext(self,link):
		"""check extension"""
		if link not in EXCLUDED_MEDIA_EXTENSIONS:
			return link
	# 检查是否有定义 method，若无则默认为 GET
	def check_method(self,method):
		"""check method"""
		if method != []:
			return "GET"
		elif method != []:
			return method[0]
	
	# 检查 url 的合法性
	# 编码 、空格、 # 等
	def check_url(self,url):
		"""check url"""
		url = unquote_plus(url)
		url = url.replace("&amp;","&")
		url = url.replace("#","")
		url = url.replace(" ","+")
		return url 
	# 检查 action 对应的值 
	def check_action(self,action,url):
		""" check form action """
		if action == [] or action[0] == "/":
			return self.check_url(url)
		elif action != [] and action != "":
			if action[0] in url:
				self.check_url(url)
			else:
				return self.check_url(CPath(url+action[0]))
	def check_name_value(self,string):
		""" check form name and value """
		if string == []:
			return "TEST"
		elif string != []:
			return string[0]
	# <form action="proxy.php?url=demo_form.asp" method="get">
	# 	<input type="text" name="lname" />
	# <button type="submit">提交</button><br />
	def form(self):
		""" search forms """
		# 搜索表格 加入到 self.forms 中
		for form in self.soup.findAll('form'):
			if form not in self.forms:
				self.forms.append(form)
		for form in self.forms:
			if form != "" and form != None:
				# 调用 extract_form 将 url 从中解析出来
				return self.extract_form(str(form),self.url)
	# <form action="proxy.php?url=demo_form.asp" method="get">
	# 	<input type="text" name="lname" />
	# <button type="submit">提交</button><br />
	def extract_form(self,form,url):
		""" extract form """
		query = []
		action = ""
		method = ""
		try:
			# method 
			method += self.check_method(findall(r'method=[\'\"](.+?)[\'\"]',form,I))
			# action
			action += self.check_action((findall(r'method=[\'\"](.+?)[\'\"]',form,I),url))
		except Exception,e:
			pass
		# 寻找form中的参数 ，并保存到 query 中
		for inputs in form.split('/>'):
			if search(r'\<input',inputs,I):
				try:
					# name
					name = self.check_name_value(findall(r'name=[\'\"](.+?)[\'\"]',inputs,I))
					# value
					value = self.check_name_value(findall(r'value=[\'\"](.+?)[\'\"]',inputs,I))
					name_value = "%s=%s"%(name,value)
					if len(query) == 0:query.append(name_value)
					if len(query) == 1:query[0] += "&%s"%(name_value) 
				except Exception,e:
					pass
		# 根据 method 的不同，组装url
		if action:
			if method.lower() == "get":
				if query != []:
					return "%s?%s"%(action,query[0])
				return action
			elif method.lower() == "post":
				if query != []:
					return action,query[0]
				return action
		# 注，这里存在BUG。
		# 调用链 form = self.form()
		#	form() 的返回 return self.extract_form(str(form),self.url)
		#   extract_form  在 method为 POST 且 query != []  的情况下 ，
		# 				  return action,query[0]  
		#                 会丢失掉 query[0] 即 POST 的参数
	# 获取绝对URL
	def absolute(self,link):
		""" make absolute url """
		link = self.check_ext(link)
		parts = urlsplit(link)
		# urlsplit 
		scheme = ucode(parts.scheme)
		netloc = ucode(parts.netloc)
		path = ucode(parts.path) or '/'
		query = ucode(parts.query)
		# make 
		if scheme == 'http' or scheme == 'https':
			if netloc != "":
				if netloc in self.netloc:
					return urlunparse((scheme,netloc,path,'',query,''))
		#
		elif link.startswith('//'):
			if netloc != "":
				if self.netloc in netloc:
					return urlunparse((self.scheme,netloc,(path or '/'),'',query,''))
		#
		elif link.startswith('/'):
			return urlunparse((self.scheme,self.netloc,path,'',query,''))
		#
		elif link.startswith('?'):
			return urlunparse((self.scheme,self.netloc,path,'',query,''))
		#
		elif link == "" or link.startswith('#'):
			return self.url 
		#
		else:
			return urlunparse((self.scheme,self.netloc,path,'',query,''))

def ragent():
	"""random agent"""
	user_agents = ()
	realpath = path.join(path.realpath(__file__).split('lib')[0],'lib/db/')
	realpath += "useragent.wascan"
	for _ in readfile(realpath):
		user_agents += (_,)
	return user_agents[randint(0,len(user_agents)-1)]

if hasattr(ssl, '_create_unverified_context'): 
    ssl._create_default_https_context = ssl._create_unverified_context
# BasicAuthCredentials 用来处理 认证相关的信息
# 	wascan.py --url xxx --proxy yyy --proxy-auth "root:1234"
# 	wascan.py --url xxx --auth "admin:1233"
# In [20]: creds = "admin:123"
# In [21]: BasicAuthCredentials(creds)
# Out[21]: ('admin', '123')
def BasicAuthCredentials(creds):
	# return tuple
	return tuple(
		creds.split(':')
		)
# wascan.py --url xxx --scan yyy --proxy 10.10.10.10:80 
def ProxyDict(proxy):
	# return dict
	return {
		'http'  : proxy,
		'https' : proxy
	}

class Request(object):
	"""docstring for Request"""
	# 接受参数
	def __init__(self,*kwargs):
		self.kwargs = kwargs
	
	# 发送请求
	def Send(self,url,method="get",data=None,headers=None):
		# make a request
		# 提取各项参数 并 保存到 __dict__ ，后期进一步处理
		_dict_ = self.kwargs[0] # self.kwargs is a tuple, select [0]
		# 获取各项值
		auth = None if "auth" not in _dict_ else _dict_["auth"]
		agent = None if "agent" not in _dict_ else _dict_["agent"]
		proxy = None if "proxy" not in _dict_ else _dict_["proxy"]
		pauth = None if "pauth" not in _dict_ else _dict_["pauth"]
		cookie = None if "cookie" not in _dict_ else _dict_["cookie"]
		timeout = None if "timeout" not in _dict_ else _dict_["timeout"]
		redirect = True if "redirect" not in _dict_ else _dict_["redirect"]
		_headers_ = None if "headers" not in _dict_ else _dict_["headers"]
		_data_ = None if "data" not in _dict_ else _dict_["data"]
		_method_ = None if "method"  not in _dict_ else _dict_["method"]
		# set method 
		if method:
			if _method_ != None:
				method = _method_.upper()
			else:
				method = method.upper()
		# set data
		if data is None:
			if _data_ != None:
				data = _data_
			else:
				data = {}
		# if headers == None: headers = {}
		if headers is None: headers = {}
		# if auth == None: auth = () 
		if auth is None: auth = ()
		# set request headers
		# add user-agent header value
		if 'User-Agent' not in headers:
			headers['User-Agent'] = agent
		# _headers_ add to headers
		if isinstance(_headers_,dict):
			headers.update(_headers_)
		# 处理 认证 、代理
		# process basic authentication
		if auth != None and auth != ():
			if ':' in  auth:
				authorization = ("%s:%s"%(BasicAuthCredentials(auth))).encode('base64')
				headers['Authorization'] = "Basic %s"%(authorization.replace('\n',''))
		# process proxy basic authorization
		if pauth != None:
			if ':' in pauth:
				proxy_authorization = ("%s:%s"%(BasicAuthCredentials(pauth))).encode('base64')
				headers['Proxy-authorization'] = "Basic %s"%(proxy_authorization.replace('\n',''))
		# 处理 超时问题
		# process socket timeout
		if timeout != None:
			socket.setdefaulttimeout(timeout)
		# set handlers
		# handled http and https 
		handlers = [urllib2.HTTPHandler(),urllib2.HTTPSHandler()]
		# process cookie handler
		if 'Cookie' not in headers:
			if cookie != None and cookie != "":
				headers['Cookie'] = cookie
			# handlers.append(HTTPCookieProcessor(cookie))
		# process redirect
		# 处理是否跳转 ， NoRedirectHandler 定义见下
		if redirect != True:
			handlers.append(NoRedirectHandler)
		# process proxies
		if proxy:
			proxies = ProxyDict(proxy)
			handlers.append(urllib2.ProxyHandler(proxies))
		# install opener
		opener = urllib2.build_opener(*handlers)
		urllib2.install_opener(opener)
		
		# process method
		# method get 
		if method == "GET":
			if data: url = "%s?%s"%(url,data)
			req = urllib2.Request(url,headers=headers)
		# other methods
		elif method == "POST":
			req = urllib2.Request(url,data=data,headers=headers)
		# other methods
		else:
			req = urllib2.Request(url,headers=headers)
			req.get_method = lambda : method
		# response object
		try:
			resp = urllib2.urlopen(req)
		except urllib2.HTTPError,e:			
			resp = e
		except socket.error,e:
			exit(warn('Error: %s'%e))
		except urllib2.URLError,e:
			exit(warn('Error: %s'%e))
		return ResponseObject(resp)

class NoRedirectHandler(urllib2.HTTPRedirectHandler):
	"""docstring for NoRedirectHandler"""
	def http_error_302(self,req,fp,code,msg,headers):
		pass
	#  http status code 302
	http_error_302 = http_error_302 = http_error_302 = http_error_302

class ResponseObject(object):
	"""docstring for ResponseObject"""
	def __init__(self,resp):
		# get content
		self.content = resp.read()
		# get url 
		self.url = resp.geturl()
		# get status code
		self.code = resp.getcode()
		# get headers
		self.headers = resp.headers.dict

#!/usr/bin/env python 
# -*- coding:utf-8 -*-
#
# @name:    Wascan - Web Application Scanner
# @repo:    https://github.com/m4ll0k/Wascan
# @author:  Momo Outaadi (M4ll0k)
# @license: See the file 'LICENSE.txt'
from re import sub,I,findall
from lib.utils.colors import *
from lib.utils.printer import *
from urlparse import urlsplit,urljoin
from lib.utils.rand import r_string
# CPath 检查路径，用于处理 绝对/相对路径，生成完整路径
# 实际调用 urlparse 的 urljoin
# In [43]: CPath("http://www.google.com/1/aaa.html","bbbb.html")
# Out[43]: 'http://www.google.com/1/bbbb.html'
# In [44]: CPath("http://www.google.com/1/aaa.html","/2/bbbb.html")
# Out[44]: 'http://www.google.com/2/bbbb.html'
# In [45]: CPath("http://www.google.com/1/aaa.html","2/bbbb.html")
# Out[45]: 'http://www.google.com/1/2/bbbb.html'
def CPath(url,path):
	return urljoin(url,path)
# 生成随机参数值
# 这段代码存在bug
# In [49]: AParams("test=chybeta")
# ---------------------------------------------------------------------------
# TypeError                                 Traceback (most recent call last)
# <ipython-input-49-103eb92ad1e0> in <module>()
# ----> 1 AParams("test=chybeta")
# /media/chybeta/security/tool/scanner/WAScan/lib/utils/check.py in AParams(params)
#      21                 return "%s=%s"%(params,random_string)
#      22         else:
# ---> 23                 return "%s%s"%(r_string(10)).upper()
#      24         return params
#      25 
# TypeError: not enough arguments for format string
# fix bug：
# return "%s%s"%(params, random_string)
def AParams(params):
	random_string = "%s"%(r_string(10)).upper()
	if '=' not in params:
		return "%s=%s"%(params,random_string)
	
	else:
		# 这里如果 = 已经出现在 params 中了
		return "%s%s"%(r_string(10)).upper()
	return params
# CQuery 拼接 url 和 查询参数 ，主要针对 GET请求
def CQuery(url,params):
	# 生成参数值对
	params = AParams(params)
	# http://test.com/?
	if url.endswith('?'):
		# 直接加上 参数
		return url+params
	# 如果不是
	elif not url.endswith('?'):
		# http://test.com/a&
		if url.endswith('&'):
			# 也可以直接加上参数
			return url+params
		# http://test.com/?a=1 
		elif '?' in url and '&' not in url:
			# 需要加上  & 符号
			return url+'&'+params
		else:
			# 其他情况，干脆直接 加 ?
			return url+"?"+params
	else:
		# 这句话多余？？？？
		return url+"?"+ params
def CParams(url):
	if '&' not in url:
		url = sub(findall(r'\?(\S*)\=',url)[0],'%s%s%s'%(GREEN%(1),findall(r'\?(\S*)\=',url)[0],RESET),url)
		return url
	elif '&' in url:
		url = sub(findall(r'\&(\S*)\=',url)[0],'%s%s%s'%(GREEN%(1),findall(r'\&(\S*)\=',url)[0],RESET),url)
		return url 
	else: return url
# url检查，协议
def CUrl(url):
	split = urlsplit(url)
	# check URL scheme
	if split.scheme not in ['http','https','']:
		# e.g: exit if URL scheme = ftp,ssh,..etc
		exit(less('Check your URL, scheme "%s" not supported!!'%(split.scheme)))
	else:
		# if URL --> www.site.com
		if split.scheme not in ['http','https']:
			# return http://www.site.com
			return "http://%s"%(url)
		else:
			return url
# url重组
def CNQuery(url):
	if '?' in url:
		parse = urlsplit(url)
		if parse.scheme:return parse.scheme + '://' + parse.netloc + '/' 
		else: return 'http://' + parse.path+'/'
	else:
		parse = urlsplit(url)
		if parse.scheme:return parse.scheme + '://' + parse.netloc + '/'
		else:return 'http://' + parse.path + '/'
# 检查url的尾部 是否 / 结尾，去除
def CEndUrl(url):
	if url.endswith('/'):
		return url[:-1]
	return url
# 接受 scan参数即 扫描类型
# 然后进行检查是否在 0 - 5 的范围内
def CScan(scan):
	# check scan options
	if scan not in ['0','1','2','3','4','5']:
		info('Option --scan haven\'t argument, assuming default value 5')
		scan = int('5') 
	if isinstance(scan,str):
		return int(scan)
	return int(scan)
# 对 URL进行各项切分
class SplitURL:
	def __init__(self,url):
		# http,https
		# 协议
		self.scheme = urlsplit(url).scheme 
		# 域名
		# www.site.com
		self.netloc = CUrl(urlsplit(url).netloc)
		# 路径
		# /test/index.php
		self.path = urlsplit(url).path
		# 查询参数
		# id=1&f=1
		self.query = urlsplit(url).query
		# fragment
		# #test
		self.fragment = urlsplit(url).fragment
# 解析 host头部
def CHeaders(headers):
	# e.g: "Host:google.com" return {'Host':'google.com'}
	_ = {}
	if ':' in headers:
		if ',' in headers:
			headerList = headers.split(',')
			for header in headerList:
				_[header.split(':')[0]] = header.split(':')[1]
		else:
			_[headers.split(':')[0]] = headers.split(':')[1]
	return _
# 用于 认证
def CAuth(auth):
	if ':' not in auth:
		return "%s:"%(auth)
	return auth

def dirs(path):
	files = []
	_ = os.listdir(path)
	for file in _:
		if not file.endswith('.py') or file == '__init__.py':pass
		else:files.append(file)
	return files

In [39]: from lib.utils.dirs import dirs
In [40]: dirs("./")
Out[40]: ['wascan.py']
In [41]: dirs("./lib/utils/")
Out[41]: 
['params.py',
 'usage.py',
 'colors.py',
 'readfile.py',
 'exception.py',
 'check.py',
 'printer.py',
 'unicode.py',
 'settings.py',
 'rand.py',
 'dirs.py',
 'payload.py']

class WascanUnboundLocalError(UnboundLocalError):
	pass
class WascanDataException(Exception):
	pass
class WascanNoneException(Exception):
	pass
class WascanInputException(Exception):
	pass
class WascanGenericException(Exception):
	pass
class WascanConnectionException(HTTPError):
	pass
class WascanKeyboardInterrupt(KeyboardInterrupt):
	pass

class preplace:
	""" replace params with payload"""
	# 初始化
	def __init__(self,url,payload,data):
		# url
		self.url = url 
		# data 指 POST请求的 POST部分
		# 对于 GET 请求，data 为 None
		self.data = data
		# _params 
		self._params = []
		# 对应的 payload
		self.payload = payload
	# 处理GET请求
	# http://test.com?a=1&b=2
	def get(self):
		"""get"""
		params = self.url.split("?")[1].split("&")
		# params = ['a=1', 'b=2']
		# 对 params 中的每一个参数
		for param in params:
			# 按照 = 切割，替换成payload  即  a=payload
			ppayload = param.replace(param.split("=")[1],self.payload)
			# 获取原本的参数对
			porignal = param.replace(ppayload.split("=")[1],param.split("=")[1])
			# http://test.com?a=payload&b=2
			self._params.append(sub(porignal,ppayload,self.url))
	# 处理POST请求
	def post(self):
		"""post"""
		params = self.data.split("&")
		for param in params:
			ppayload = param.replace(param.split("=")[1],self.payload)
			porignal = param.replace(ppayload.split("=")[1],param.split("=")[1])
			self._params.append(self.data.replace(porignal,ppayload))
	
	# 开始处理
	def run(self):
		# 如果 url中 带有 ? , 并且 data部分 为 None
		if "?" in self.url and self.data == None:
			# GET请求 处理
			self.get()
		# 如果 url中 没有 ? , 并且 data部分 不为 None
		elif "?" not in self.url and self.data != None:
			# POST请求 处理
			self.post()
		# 其他情况 无法明确判断
		else:
			# 都进行一遍处理
			self.get()
			self.post()
		return self._params

class padd:
	""" add the payload to params """
	# 基本的初始化
	def __init__(self,url,payload,data):
		self.url = url 
		self.data = data
		self._params = []
		self.payload = payload
	# 处理GET请求
	# http://test.com?a=1&b=2
	def get(self):
		"""get"""
		params = self.url.split("?")[1].split("&")
		for param in params:
			# a=1payload
			ppayload = param.replace(param.split("=")[1],param.split('=')[1]+self.payload)
			porignal = param.replace(ppayload.split("=")[1],param.split("=")[1])
			self._params.append(sub(porignal,ppayload,self.url))
	def post(self):
		"""post"""
		params = self.data.split("&")
		for param in params:
			ppayload = param.replace(param.split("=")[1],param.split('=')[1]+self.payload)
			porignal = param.replace(ppayload.split("=")[1],param.split("=")[1])
			self._params.append(self.data.replace(porignal,ppayload))
	# 进行处理
	def run(self):
		if "?" in self.url and self.data == None:
			self.get()
		elif "?" not in self.url and self.data != None:
			self.post()
		else:
			self.get()
			self.post()
		return self._params

# Server Side Injection 
# 有待研究
def ssip():
	""" Server Side Injection """
	省略
# CRLF  
# CRLF字符对应 %0d %0a
def crlfp():
	"""Carriage Return Line Feed"""
	省略
# XXE
def xxep():
	""" XML External Entity"""
	省略
# SSI
def pssi():
	""" Server Side Include"""
	省略
# XSS
def pxss():
	""" Cross-Site Scripting"""
	省略
# php代码注入
def php():
	""" PHP Code Injection """
	省略
# xpath注入
def xpath():
	""" Xpath """
	省略
# bash注入
def bash():
	"""Basic Bash Command Injection """
	省略
# sql注入
def sql():
	"""Generic SQL"""
	省略
# os命令注入
def os():
	""" OS Command Injection """
	省略
# 本地文件包含
def plfi():
	""" Local file Inclusion """
	省略
# 盲注
def bsql():
	""" Blind SQL Injection """
	省略
# html注入
def html():
	""" HTML Code Injection """
	省略
# ldap注入
def ldap():
	""" LDAP Injection """
	省略

def plus(string,flag="[+]"):
	print "{}{}{} {}{}{}".format(
		GREEN%(0),flag,RESET,
		WHITE%(0),ucode(string),RESET
		)
def less(string,flag="[-]"):
def warn(string,flag="[!]"):
def test(string,flag="[*]"):
def info(string,flag="[i]"):
def more(string,flag="|"):
def null():
	print ""

def r_time():
	""" random numbers """
	return randint(0,int(strftime('%y%m%d')))

def r_string(n):
	""" random strings """
	return "".join([choice(uppercase+lowercase) for _ in xrange(0,int(n))])

def readfile(path):
	""" read file """
	if path != None or path != "":
		return [line.strip() for line in open(path,'rb')]
	return

# tool name  工具名称，即命令行运行时的第一个参数
NAME = argv[0]
# tool version 版本 
VERSION = "v0.2.1"
# author 作者 
AUTHOR = "Momo Outaadi (M4ll0k)"
# description 描述
DESCRIPTION = "Web Application Scanner"
# name + description + version 
NVD = (NAME.split('.')[0]).title()+": "+DESCRIPTION+" - "+VERSION
# max threads 最大线程数量
MAX = 5
# args 命令行参数
CHAR = "u:s:H:d:m:h:R:a:A:c:p:P:t:n:v=:V=:r=:b=:"
# 与上面命令行参数对应的 完整参数名称
LIST_NAME = [
   省略
]
# argv
ARGV = argv
# dict args
ARGS = {
    'auth': None,
    'brute': None,
    'agent': ragent(),
    'proxy': None,
    'pauth': None,
    'cookie': None,
    'timeout': 5,
    'redirect': True,
    'headers': {},
    'data': None,
    'method': 'GET'
}
# time
TIME = strftime('%d/%m/%Y at %H:%M:%S')
TNOW = strftime('%H:%M:%S')
# print version
def Version():
    print "\n{}".format(NVD)
    print "Author: {}\n".format(AUTHOR)
    exit()
# print time and url
def PTIME(url):
    plus("URL: {}".format(url))
    plus("Starting: {}".format(TIME))
    null()

def ucode(string):
	if isinstance(string,unicode):
		return string.encode('utf-8')
	return string

class usage:
	""" docstring for usage """
	def banner(self):
		省略
	def basic(self,_exit_=True):
		省略

def BruteParams(kwargs,url,data):
	params(kwargs,url,data).run()
	exit(0)

if kwargs['brute']:
	BruteParams(kwargs,url,kwargs['data']).run()

path = os.path.join(os.path.abspath('.').split('lib')[0],'plugins/brute/')
def Brute(kwargs,url,data):
	# 获取 根路径
    url = CNQuery(url)
    info('Starting bruteforce module...')
	# dirs函数，获取指定path目录下的以py结尾的非 __ini__.py 的py文件
    for file in dirs(path):
        file = file.split('.py')[0]
        __import__('plugins.brute.%s'%(file))
		# 作为模块导入，开始爆破
        module = sys.modules['plugins.brute.%s'%(file)]
        module = module.__dict__[file]
        module(kwargs,url,data).run()

if scan == 3:
	Brute(kwargs,url,kwargs['data'])
省略
if int(scan) == 5:
	省略
	Brute(kwargs,parse.netloc,kwargs['data'])

class Fingerprint(Request):
	"""Fingerprint"""
	def __init__(self,kwargs,url):
		# 相关参数 初始化
		Request.__init__(self,kwargs)
		self.kwarg = kwargs
		self.url = url
	def run(self):
		info('Starting fingerprint target...')
		try:
			# -- request --
			# 首先发送HTTP GET请求
			req = self.Send(url=self.url,method="GET")
			# -- detect server --
			# 探测 服务器指纹
			# 一个站点往往对应一种服务器如apache
			# 根据头部返回的信息 server: xxx 来确定
			__server__ = server(self.kwarg,self.url).run()
			if __server__:
				# 若探测到，plus打印模式
				plus('Server: %s'%(__server__))
			# -- detect cms
			# 探测 cms框架指纹
			__cms__ = Cms(req.headers,req.content)
			# 同一个站点，可能同时使用多种cms。因此会返回多种结果
			for cms in __cms__:
				if cms != (None and ""):
					plus('CMS: %s'%(cms))
			# -- detect framework
			# 探测 web框架
			__framework__ = Framework(req.headers,req.content)
			for framework in __framework__:
				if framework != (None and ""):
					plus('Framework: %s'%(framework))
			# -- detect lang
			# 探测 编程语言
			__lang__ = Language(req.content)
			for lang in __lang__:
				if lang != (None and ""):
					plus('Language: %s'%(lang))
			# -- detect os
			# 探测 操作系统版本
			__os__ = Os(req.headers)
			for os in __os__:
				if os != (None and ""):
					plus('Operating System: %s'%os)
			# -- detect waf
			# 探测 waf种类
			__waf__ = Waf(req.headers,req.content)
			for waf in __waf__:
				if waf != (None and ""):
					plus('Web Application Firewall (WAF): %s'%waf)
			Headers(req.headers,req.content)
		except Exception as e:
			pass