a
    kÄ#dO_  ã                   @   sZ  d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl	m
Z
mZmZmZ ddlmZ ddlmZ ddlmZmZ ddlmZ dd	lmZmZmZmZ dd
lmZ ddlmZm Z  ddl!m"Z"m#Z# ddl$m%Z% zddl&Z&dZ'W n e(�y   dZ'Y n0 zddl)Z)dZ*W n e(�y.   dZ*Y n0 dej+v�rTi ej+d< dej+d d< g d¢Z,ddgZ-g d¢Z.g d¢Z/g d¢Z0g d¢Z1dd„ Z2dd„ Z3dd„ Z4dd „ Z5d!d"„ Z6G d#d$„ d$eƒZ7G d%d&„ d&eƒZ8d'd(„ Z9G d)d*„ d*e7ƒZ:G d+d,„ d,e7ƒZ;G d-d.„ d.eƒZ<d8d2d3„Z=ee"e<d0d4� ee"e<d0d5� ee"e<d0d0d6� ee"e<d7d4� ee"e<d7d5� dS )9aë  
HTTP 1.0 layer.

Load using::

    from scapy.layers.http import *

Or (console only)::

    >>> load_layer("http")

Note that this layer ISN'T loaded by default, as quite experimental for now.

To follow HTTP packets streams = group packets together to get the
whole request/answer, use ``TCPSession`` as:

    >>> sniff(session=TCPSession)  # Live on-the-flow session
    >>> sniff(offline="./http_chunk.pcap", session=TCPSession)  # pcap

This will decode HTTP packets using ``Content_Length`` or chunks,
and will also decompress the packets when needed.
Note: on failure, decompression will be ignored.

You can turn auto-decompression/auto-compression off with:

    >>> conf.contribs["http"]["auto_compression"] = False

(Defaults to True)
é    N)ÚNet)Ú	plain_strÚbytes_encodeÚgzip_compressÚgzip_decompress)Úconf)ÚWINDOWS)ÚwarningÚlog_loading)ÚStrField)ÚPacketÚbind_layersÚbind_bottom_upÚRaw)ÚStreamSocket)Úget_temp_fileÚContextManagerSubprocess)ÚTCPÚ
TCP_client)ÚsixTFÚhttpÚauto_compression)zCache-ControlÚ
ConnectionZ	PermanentzContent-LengthzContent-MD5zContent-TypeÚDatez
Keep-AliveÚPragmaZUpgradeZViaÚWarningzX-Request-IDzX-Correlation-ID)zA-IMÚAcceptzAccept-CharsetzAccept-EncodingzAccept-LanguagezAccept-DatetimezAccess-Control-Request-MethodzAccess-Control-Request-HeadersÚAuthorizationÚCookieZExpectZ	ForwardedÚFromÚHostzHTTP2-SettingszIf-MatchzIf-Modified-SincezIf-None-MatchzIf-RangezIf-Unmodified-SincezMax-ForwardsZOriginzProxy-AuthorizationÚRangeZRefererZTEz
User-Agent)zUpgrade-Insecure-RequestszX-Requested-WithZDNTzX-Forwarded-ForzX-Forwarded-HostzX-Forwarded-ProtozFront-End-HttpszX-Http-Method-OverridezX-ATT-DeviceIdzX-Wap-ProfilezProxy-ConnectionzX-UIDHzX-Csrf-Tokenz	Save-Data)$zAccess-Control-Allow-Originz Access-Control-Allow-CredentialszAccess-Control-Expose-HeaderszAccess-Control-Max-AgezAccess-Control-Allow-MethodszAccess-Control-Allow-HeaderszAccept-PatchzAccept-RangesZAgeZAllowzAlt-SvczContent-DispositionzContent-EncodingzContent-LanguagezContent-LocationzContent-Rangez
Delta-BaseÚETagZExpiresZIMzLast-ModifiedÚLinkZLocationZP3PzProxy-AuthenticatezPublic-Key-PinszRetry-AfterÚServerz
Set-CookiezStrict-Transport-SecurityZTrailerzTransfer-EncodingZTkZVaryzWWW-AuthenticatezX-Frame-Options)zContent-Security-PolicyzX-Content-Security-PolicyzX-WebKit-CSPZRefreshÚStatuszTiming-Allow-OriginzX-Content-DurationzX-Content-Type-OptionszX-Powered-ByzX-UA-CompatiblezX-XSS-Protectionc                 C   s   t |  ¡ ƒ dd¡S )zpTakes a header key (i.e., "Host" in "Host: www.google.com",
    and returns a stripped representation of it
    ú-Ú_)r   ÚstripÚreplace)Úname© r+   úH/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/layers/http.pyÚ_strip_header_nameÍ   s    r-   c                 C   s   t | ƒd t |ƒ S )zCreates a HTTP header lines   : )r   )r*   Úvalr+   r+   r,   Ú_header_lineÔ   s    r/   c              	   C   sd   |   d¡}i }|D ]L}z|  dd¡\}}W n ty@   Y qY n0 t|ƒ ¡ }|| ¡ f||< q|S )Nó   
ó   :é   )ÚsplitÚ
ValueErrorr-   Úlowerr(   )ÚsÚheadersZheaders_foundZheader_lineÚkeyÚvalueZ
header_keyr+   r+   r,   Ú_parse_headersÚ   s    

r:   c                 C   sj   d}|   |¡}|dkr@| d|t|ƒ … }| |t|ƒ d… }n| }d}| dd¡\}}| ¡ t|ƒ|fS )z˜ Takes a HTTP packet, and returns a tuple containing:
      _ the first line (e.g., "GET ...")
      _ the headers in a dictionary
      _ the body
    ó   

éÿÿÿÿNó    r0   r2   )ÚfindÚlenr3   r(   r:   )r6   ZcrlfcrlfZcrlfcrlfIndexr7   ÚbodyÚ
first_liner+   r+   r,   Ú_parse_headers_and_bodyç   s    
rB   c           	   	   C   s†   t |ƒ\}}}| jD ]J}t|jƒ ¡ }z| |¡\}}W n tyN   Y qY n0 |  |j|¡ q|r~tt	 
|¡ƒ}|  d|¡ ||fS )z±Takes a HTTP packet as the string s, and populates the scapy layer obj
    (either HTTPResponse or HTTPRequest). Returns the first line of the
    HTTP packet, and the body
    ÚUnknown_Headers)rB   Úfields_descr-   r*   r5   ÚpopÚKeyErrorÚsetfieldvalÚdictr   Ú
itervalues)	Úobjr6   rA   r7   r@   ÚfZstripped_namer'   r9   r+   r+   r,   Ú_dissect_headersù   s    

rL   c                       sD   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Z‡ fdd„Z‡  Z	S )Ú_HTTPContentc                 C   sZ   g }t | tƒrV| jr2|dd„ t| jƒ d¡D ƒ7 }| jrV|dd„ t| jƒ d¡D ƒ7 }|S )Nc                 S   s   g | ]}t |ƒ ¡  ¡ ‘qS r+   ©r   r(   r5   ©Ú.0Úxr+   r+   r,   Ú
<listcomp>  r=   z/_HTTPContent._get_encodings.<locals>.<listcomp>ú,c                 S   s   g | ]}t |ƒ ¡  ¡ ‘qS r+   rN   rO   r+   r+   r,   rR     r=   )Ú
isinstanceÚHTTPResponseZTransfer_Encodingr   r3   ZContent_Encoding)ÚselfÚ	encodingsr+   r+   r,   Ú_get_encodings  s    
ÿÿz_HTTPContent._get_encodingsc                 C   s   dS )Ns   HTTP1r+   ©rV   r+   r+   r,   Úhashret  s    z_HTTPContent.hashretc                 C   sp  t jd d s|S |  ¡ }d|v r¤d}|rœ| d¡\}}}zt|dƒ}W n ty^   Y qœY q&0 |d |… }|||d … dkr‚qœ||d d … }||7 }q&|s¤|}z²d|v rÂd	d l}| |¡}n’d
|v rÔt|ƒ}n€d|v rðd	d l	}	|	 |¡}ndd|v �rt
�rt |¡}n
t d¡ n<d|v �rTt�rJt |¡}
t ¡  |
¡}| ¡ }n
t d¡ W n t�yj   Y n0 |S )Nr   r   Úchunkedr=   r0   é   é   Údeflater   ÚgzipÚcompressÚbrz;Can't import brotli. brotli decompression will be ignored !Úzstdz<Can't import zstandard. zstd decompression will be ignored !)r   ÚcontribsrX   Ú	partitionÚintr4   ÚzlibÚ
decompressr   ÚlzwÚ_is_brotli_availableÚbrotlir
   ÚinfoÚ_is_zstd_availableÚioÚBytesIOÚ	zstandardZZstdDecompressorÚstream_readerÚreadÚ	Exception)rV   r6   rW   ÚdataÚlengthr'   r@   Úloadrf   rh   ZbioÚreaderr+   r+   r,   Úpost_dissect  sX    



ÿ


ÿz_HTTPContent.post_dissectc                 C   sº   t jd d s|| S |  ¡ }d|v r:dd l}| |¡}nxd|v rLt|ƒ}nfd|v rhdd l}| |¡}nJd|v rŒtr€t |¡}q²t	 
d¡ n&d	|v r²tr¨t ¡  |¡}n
t	 
d
¡ || S )Nr   r   r^   r   r_   r`   ra   z9Can't import brotli. brotli compression will be ignored !rb   z:Can't import zstandard. zstd compression will be ignored !)r   rc   rX   rf   r`   r   rh   ri   rj   r
   rk   rl   ro   ZZstdCompressor)rV   ZpktZpayrW   rf   rh   r+   r+   r,   Ú
post_buildX  s0    
ÿÿz_HTTPContent.post_buildc           	      K   s  t | jtƒstdƒ | jdur$| jS d}| jD ]ˆ}|jdkr>q.|  |j¡}|sPq.|jdvrft|j	|ƒ}t | t
ƒr†|jdv r€d}q¤d}nt | tƒr¤|jd	v r d}nd}| | ||| ¡}q.| jrþd}t | j¡D ]\}}|t||ƒd 7 }qÎ|  d¡ | ||¡}|�r| | |d¡}|S )
z\ Takes an HTTPRequest or HTTPResponse object, and creates its
        string representation.z:An HTTPResponse/HTTPRequest should always be below an HTTPNr=   rC   )ÚMethodÚPathÚReason_PhraseÚHttp_VersionÚStatus_Code)ry   rz   ó    r0   )r|   r}   )rT   Z
underlayerÚHTTPr	   Úraw_packet_cacherD   r*   Zgetfieldvalr/   Ú	real_nameÚHTTPRequestrU   ZaddfieldrC   r   Ú	iteritemsÚ	get_field)	rV   ÚkwargsÚprK   r.   Ú	separatorZheaders_textr*   r9   r+   r+   r,   Ú
self_buildw  sD    ÿ








ÿz_HTTPContent.self_buildc                    s0   | j r d| j v r ddlm} |S tt| ƒ |¡S )z"Detect potential payloads
        s   Upgrader   )ÚH2Frame)r   Úscapy.contrib.http2r‰   ÚsuperrM   Úguess_payload_class)rV   Úpayloadr‰   ©Ú	__class__r+   r,   rŒ   ª  s    z _HTTPContent.guess_payload_class)
Ú__name__Ú
__module__Ú__qualname__rX   rZ   rw   rx   rˆ   rŒ   Ú__classcell__r+   r+   rŽ   r,   rM     s   ;3rM   c                   @   s   e Zd ZdZdgZdd„ ZdS )Ú_HTTPHeaderFieldz-Modified StrField to handle HTTP Header namesr�   c                 C   s$   || _ t|ƒ}tj| ||dd� d S )NÚH)Úfmt)r�   r-   r   Ú__init__)rV   r*   Údefaultr+   r+   r,   r—   ·  s    z_HTTPHeaderField.__init__N)r�   r‘   r’   Ú__doc__Ú	__slots__r—   r+   r+   r+   r,   r”   ³  s   r”   c                  G   s<   g }| D ]}||7 }qg }t |ƒD ]}| t|dƒ¡ q"|S )z.Generate the header fields based on their nameN)ÚsortedÚappendr”   )ÚargsZall_headersr7   ÚresultsÚhr+   r+   r,   Ú_generate_headers½  s    
r    c                   @   sV   e Zd ZdZeddƒeddƒeddƒgeeeee	ƒ edd	ƒg Z
d
d„ Zdd„ Zd	S )r‚   zHTTP Requestry   ÚGETrz   ú/úHttp-VersionúHTTP/1.1úUnknown-HeadersNc                 C   s‚   t | |ƒ\}}z<t d|d¡\}}}|  d|¡ |  d|¡ |  d|¡ W n ty\   Y n0 |rx|dt|ƒ … | _n|| _|S )z6From the HTTP packet string, populate the scapy objectó   \s+r]   ry   rz   r|   N©rL   Úrer3   rG   r4   r?   r€   )rV   r6   rA   r@   ry   rz   ÚHTTPVersionr+   r+   r,   Ú
do_dissectß  s    zHTTPRequest.do_dissectc                 C   s
   |   d¡S )NzB%HTTPRequest.Method% %HTTPRequest.Path% %HTTPRequest.Http_Version%©ZsprintfrY   r+   r+   r,   Ú	mysummaryï  s    ÿzHTTPRequest.mysummary)r�   r‘   r’   r*   r”   r    ÚGENERAL_HEADERSÚREQUEST_HEADERSÚ!COMMON_UNSTANDARD_GENERAL_HEADERSÚ!COMMON_UNSTANDARD_REQUEST_HEADERSrD   rª   r¬   r+   r+   r+   r,   r‚   Ì  s"   üüùÿór‚   c                   @   s^   e Zd ZdZeddƒeddƒeddƒgeeeee	ƒ edd	ƒg Z
d
d„ Zdd„ Zdd„ Zd	S )rU   zHTTP Responser£   r¤   zStatus-CodeZ200zReason-PhraseÚOKr¥   Nc                 C   s   t |v S ©N)r‚   )rV   Úotherr+   r+   r,   Úanswers	  s    zHTTPResponse.answersc                 C   s‚   t | |ƒ\}}z<t d|d¡\}}}|  d|¡ |  d|¡ |  d|¡ W n ty\   Y n0 |rx|dt|ƒ … | _n|| _|S )z8 From the HTTP packet string, populate the scapy object r¦   r]   r|   r}   r{   Nr§   )rV   r6   rA   r@   r©   r%   ZReasonr+   r+   r,   rª     s    zHTTPResponse.do_dissectc                 C   s
   |   d¡S )NzS%HTTPResponse.Http_Version% %HTTPResponse.Status_Code% %HTTPResponse.Reason_Phrase%r«   rY   r+   r+   r,   r¬     s    ÿzHTTPResponse.mysummary)r�   r‘   r’   r*   r”   r    r­   ÚRESPONSE_HEADERSr¯   Ú"COMMON_UNSTANDARD_RESPONSE_HEADERSrD   r´   rª   r¬   r+   r+   r+   r,   rU   ö  s$   üüùÿórU   c                   @   s:   e Zd ZdZg ZdZed
dd„ƒZedd„ ƒZdd	„ Z	dS )r   zHTTP 1r   Nc                 O   sº   |r¶t |ƒdkr¶ddlm}m} |r²t |ƒdk r4| S t|dd… ƒ|vrL| S t dd|d d…  ¡d d }|t |ƒkr|| S t d|dd… ¡d }|d	? dkr¤| S ||d … }q |S | S )
Né	   r   )Ú_HTTP2_typesr‰   é   é   z!Ió    é   é   )r?   rŠ   r¸   r‰   ÚordÚstructÚunpack)ÚclsZ_pktr�   Zkargsr¸   r‰   rt   Zsidr+   r+   r,   Údispatch_hook*  s      zHTTP.dispatch_hookc           
         sN  ˆ  dd ¡}ˆ  dd¡}|r"|�r4dˆd< t|ƒ}t|jtƒsB|S |j‰ˆd uržtˆƒ‰|jjshˆdkrŒt|ƒt|jjƒ ‰ ‡ ‡fdd„}ndd„ }dˆd< n~|t j ¡ }d	|v }t|jt	ƒ}	|rÎd
d„ }nNt|jt
ƒrìdd„ }dˆd< n0|	�r|jdk�rdd„ }n‡fdd„}dˆd< |ˆd< ||ƒ�rJ|S n||ƒ�rJt|ƒ}|S d S )NÚ
detect_endZdetect_unknownTFr   c                    s   t | ƒˆ  ˆkS r²   )r?   ©Zdat)Úhttp_lengthrt   r+   r,   Ú<lambda>W  r=   z%HTTP.tcp_reassemble.<locals>.<lambda>c                 S   s   dS )NFr+   rÄ   r+   r+   r,   rÆ   Z  r=   r[   c                 S   s
   |   d¡S )Ns   0

©ÚendswithrÄ   r+   r+   r,   rÆ   b  r=   c                 S   s
   |   d¡S ©Nr;   rÇ   rÄ   r+   r+   r,   rÆ   f  r=   s   101c                 S   s
   |   d¡S rÉ   )r>   rÄ   r+   r+   r,   rÆ   o  r=   c                    s   ˆ   dd¡S )NZtcp_endF)ÚgetrÄ   )Úmetadatar+   r,   rÆ   t  r=   )rÊ   r   rT   r�   rM   ZContent_Lengthre   r?   rX   rU   r‚   r}   )
rÁ   rs   rË   r'   rÃ   Z
is_unknownZhttp_packetrW   r[   Zis_responser+   )rÅ   rt   rË   r,   Útcp_reassembleD  sB    






zHTTP.tcp_reassemblec                 C   sn   zVt  d¡}| d¡}|d|… }| |¡}|r6tW S t  d¡}| |¡}|rTtW S W n tyh   Y n0 tS )zZDecides if the payload is an HTTP Request or Response, or
        something else.
        sH   ^(?:OPTIONS|GET|HEAD|POST|PUT|DELETE|TRACE|CONNECT) (?:.+?) HTTP/\d\.\d$r0   Ns   ^HTTP/\d\.\d \d\d\d .*$)r¨   ÚcompileÚindexÚmatchr‚   rU   r4   r   )rV   r�   ÚprogZ	crlfIndexÚreqÚresultr+   r+   r,   rŒ   ~  s     ÿ




zHTTP.guess_payload_class)N)
r�   r‘   r’   r*   rD   Zshow_indentÚclassmethodrÂ   rÌ   rŒ   r+   r+   r+   r,   r   %  s   
9r   r¢   éP   r¹   c	                 K   s  ddl m}
 dddd| |dœ}| |	¡ tƒ tf i |¤Ž }d}|durLd}|r”d	}|r~tt| ƒƒ} t |d
| f ¡dks~J ‚t	j
t| |||d�}n(t tjtj¡}| | |f¡ t|tƒ}zX|j||
dd�||d�}W | ¡  |�rT|�rTtt| ƒƒ} t |d| f ¡dk�sTJ ‚n>| ¡  |�rR|�rRtt| ƒƒ} t |d| f ¡dk�sRJ ‚0 |�r|�r
t|v�rvtdƒ |S tdd�}t|dƒ�}| |j¡ W d  ƒ n1 �s®0    Y  t�rÊt |¡ n@ttjjƒ�" t tjj|g¡ W d  ƒ n1 �s 0    Y  |S dS )a–  Util to perform an HTTP request, using the TCP_client.

    :param host: the host to connect to
    :param path: the path of the request (default /)
    :param port: the port (default 80)
    :param timeout: timeout before None is returned
    :param display: display the result in the default browser (default False)
    :param raw: opens a raw socket instead of going through the OS's TCP
                socket. Scapy will then use its own TCP client.
                Careful, the OS might cancel the TCP connection with RST.
    :param iptables: when raw is enabled, this calls iptables to temporarily
                     prevent the OS from sending TCP RST to the host IP.
                     On Linux, you'll almost certainly need this.
    :param iface: interface to use. Changing this turns on "raw"
    :param headers: any additional headers passed to the request

    :returns: the HTTPResponse packet
    r   )Ú
TCPSessions   gzip, deflates   no-caches
   keep-alive)ZAccept_EncodingZCache_Controlr   r   r    rz   NTz2iptables -%c INPUT -s %s -p tcp --sport 80 -j DROPÚA)ÚdebugÚiface)Zapp)ÚsessionÚtimeoutÚverboseÚDz(No HTTP content returned. Cannot displayz.html)ZautoextÚwb) Zscapy.sessionsrÕ   Úupdater   r‚   Ústrr   ÚosÚsystemr   ZtcplinkÚsocketÚAF_INETÚSOCK_STREAMÚconnectr   Zsr1Úcloser   r	   r   ÚopenÚwriteru   r   Z	startfiler   r   rÐ   Zuniversal_openÚ
subprocessÚPopen)ÚhostÚpathÚportrÚ   ÚdisplayrÛ   ÚrawZiptablesrØ   r7   rÕ   Zhttp_headersrÑ   ZansZiptables_ruleÚsockÚfileÚfdr+   r+   r,   Úhttp_request˜  sh    ú
ÿ
üý

,2ró   )Úsport)Údport)rô   rõ   i�  )r¢   rÔ   r¹   Fr   FFN)>r™   rm   rà   r¨   râ   r¿   ré   Zscapy.base_classesr   Zscapy.compatr   r   r   r   Zscapy.configr   Zscapy.constsr   Zscapy.errorr	   r
   Zscapy.fieldsr   Zscapy.packetr   r   r   r   Zscapy.supersocketr   Zscapy.utilsr   r   Zscapy.layers.inetr   r   Z
scapy.libsr   rj   ri   ÚImportErrorro   rl   rc   r­   r¯   r®   r°   rµ   r¶   r-   r/   r:   rB   rL   rM   r”   r    r‚   rU   r   ró   r+   r+   r+   r,   Ú<module>   sv   "


þ' '
*/s   þ
U