diff --git a/core/requester.py b/core/requester.py index 971e777..8c14079 100644 --- a/core/requester.py +++ b/core/requester.py @@ -5,14 +5,18 @@ import urllib.parse class Requester(object): - protocol = "http" - host = "" - method = "" - action = "" - headers = {} - data = {} - - def __init__(self, path, uagent, ssl, proxies): + protocol = "http" + host = "" + method = "" + action = "" + headers = {} + data = {} + + # === MODIFICATION 1: Update __init__ to accept the protocol_counts dictionary === + def __init__(self, path, uagent, ssl, proxies, protocol_counts): + self.protocol_counts = protocol_counts + # =============================================================================== + try: # Read file request with open(path, 'r') as f: @@ -38,7 +42,7 @@ def __init__(self, path, uagent, ssl, proxies): self.headers[name] = value self.host = self.headers['Host'] - # Parse user-agent + # Parse user-agent if uagent != None: self.headers['User-Agent'] = uagent @@ -78,6 +82,16 @@ def data_to_dict(self, data): def do_request(self, param, value, timeout=3, stream=False): try: + # === MODIFICATION 2: Protocol Tracking Logic === + try: + # Payload value will be a URI like 'gopher://...' or 'http://...' + protocol_prefix = value.split("://")[0] + self.protocol_counts[protocol_prefix] = self.protocol_counts.get(protocol_prefix, 0) + 1 + except Exception: + # Ignore payloads that don't look like URIs (e.g., standard parameter values) + pass + # =============================================== + # Debug information logging.debug(f"Request param: {param}") logging.debug(f"Request value: {value}") @@ -98,7 +112,7 @@ def do_request(self, param, value, timeout=3, stream=False): if param in str(data_injected): # Fix for issue/10 : str(data_injected) data_injected[param] = value - + # Handle JSON data if self.headers['Content-Type'] and "application/json" in self.headers['Content-Type']: logging.debug("Request type: JSON") @@ -134,11 +148,11 @@ def do_request(self, param, value, timeout=3, stream=False): stream=stream, verify=False, proxies=self.proxies - ) + ) else: logging.error("No injection point found ! (use -p)") - exit(1) + exit(1) # Handle FORM data else: @@ -160,7 +174,7 @@ def do_request(self, param, value, timeout=3, stream=False): else: logging.error("No injection point found ! (use -p)") - exit(1) + exit(1) else: logging.debug("Request inject: GET parameter") @@ -190,4 +204,4 @@ def __str__(self): text += "\n\n" for data in self.data: text += data + "=" + self.data[data] + "&" - return text[:-1] + return text[:-1] \ No newline at end of file diff --git a/ssrfmap.py b/ssrfmap.py index b4ef059..65a75dd 100755 --- a/ssrfmap.py +++ b/ssrfmap.py @@ -7,14 +7,14 @@ import os def display_banner(): - print(r" _____ _________________ ") - print(r"/ ___/ ___| ___ \ ___| ") - print(r"\ `--.\ `--.| |_/ / |_ _ __ ___ __ _ _ __ ") - print(r" `--. \`--. \ /| _| '_ ` _ \ / _` | '_ \ ") + print(r" _____ _________________ ") + print(r"/ ___/ ___| ___ \ ___| ") + print(r"\ `--.\ `--.| |_/ / |_ _ __ ___ __ _ _ __ ") + print(r" `--. \`--. \ \/| _| '_ ` _ \ / _` | '_ \ ") print(r"/\__/ /\__/ / |\ \| | | | | | | | (_| | |_) |") print(r"\____/\____/\_| \_\_| |_| |_| |_|\__,_| .__/ ") - print(r" | | ") - print(r" |_| ") + print(r" | | ") + print(r" |_| ") def parse_args(): example_text = '''Examples: @@ -39,6 +39,11 @@ def parse_args(): parser.add_argument('--proxy', action ='store', dest='proxy', help="Use HTTP(s) proxy (ex: http://localhost:8080)") parser.add_argument('--level', action ='store', dest='level', help="Level of test to perform (1-5, default: 1)", nargs='?', const=1, default=1, type=int) parser.add_argument('--logfile', action ='store', dest='logfile', help="SSRFmap Log file") + + # === NEW CODE LINE: Add the --protocol-report argument === + parser.add_argument('--protocol-report', action='store_true', help='Print a report of all protocols used in generated payloads.') + # ======================================================= + results = parser.parse_args() return results @@ -81,5 +86,4 @@ def parse_args(): logging.debug("Verbose output is enabled") # SSRFmap - ssrf = SSRF(args) - + ssrf = SSRF(args) \ No newline at end of file