diff --git a/403Bypasser.py b/403Bypasser.py index f32d753..cd77155 100644 --- a/403Bypasser.py +++ b/403Bypasser.py @@ -257,22 +257,33 @@ def tryBypassWithQueryPayload(self, request, payload, httpService): requestPath = request.getUrl().getPath() payloads = self.generatePayloads(requestPath, payload) + requestInfo = self.helpers.analyzeRequest(request) + headers = requestInfo.getHeaders() + firstline = headers[0] originalRequest = self.helpers.bytesToString(request.getRequest()) for pathToTest in payloads: + headers[0] = firstline.replace(requestPath, pathToTest, 1) + headersAsJavaSublist = ArrayList() + for header in headers: + headersAsJavaSublist.add(String(header)) + + requestBody = originalRequest[requestInfo.getBodyOffset():] + + newRequest = self.helpers.buildHttpMessage(headersAsJavaSublist, requestBody) try: - newRequest = originalRequest.replace(requestPath, pathToTest) newRequestResult = self.callbacks.makeHttpRequest(httpService, newRequest) - newRequestStatusCode = str(self.helpers.analyzeResponse(newRequestResult.getResponse()).getStatusCode()) except: print("No response from server") newRequestStatusCode = None - pass + continue + newRequestStatusCode = str(self.helpers.analyzeResponse(newRequestResult.getResponse()).getStatusCode()) if newRequestStatusCode == "200": originalRequestUrl = str(request.getUrl()) - vulnerableReuqestUrl = originalRequestUrl.replace(requestPath,pathToTest) + scheme, urlWithoutScheme = originalRequestUrl.split("://") + vulnerableReuqestUrl = scheme + "://" + urlWithoutScheme.replace(requestPath, pathToTest, 1) responseHeaders = str(self.helpers.analyzeResponse(newRequestResult.getResponse()).getHeaders()).split(",") resultContentLength = "No CL in response" @@ -609,4 +620,4 @@ def getHttpMessages(self): return self._httpMessages def getHttpService(self): - return self._httpService \ No newline at end of file + return self._httpService