Projects STRLCPY pentest-tools Commits e2d2425e
🤬
  • ■ ■ ■ ■ ■ ■
    csp-analyzer.py
    1  -#!/usr/bin/python2
     1 +#!/usr/bin/python3
    2 2   
    3 3  import sys
    4 4  import requests
    5  -from urlparse import urlparse
    6  -from termcolor import colored
     5 +import urllib.parse
     6 +from colored import fg, bg, attr
     7 + 
    7 8  import tldextract
    8 9   
    9 10   
    skipped 71 lines
    81 82   1: 'cyan',
    82 83   2: 'green',
    83 84   3: 'yellow',
    84  - 4: 'red',
     85 + 4: 'dark_orange',
     86 + 5: 'red',
    85 87  }
    86 88   
    87 89   
    88 90  def usage( err='' ):
    89  - print( "Usage: %s <url>" % sys.argv[0] )
     91 + print( "Usage: %s <url> [<cookies>]" % sys.argv[0] )
    90 92   if err:
    91 93   print( "Error: %s!" % err )
    92 94   sys.exit()
    skipped 1 lines
    94 96   
    95 97  if len(sys.argv) < 2:
    96 98   usage( 'url not found' )
    97  -if len(sys.argv) > 2:
     99 +if len(sys.argv) > 3:
    98 100   usage()
    99 101   
    100 102  url = sys.argv[1]
     103 +if len(sys.argv) > 2:
     104 + # cookies = sys.argv[2]
     105 + t_cookies = {}
     106 + for c in sys.argv[2].split(';'):
     107 + c = c.strip()
     108 + if len(c):
     109 + i = c.index('=')
     110 + k = c[0:i]
     111 + v = c[i+1:]
     112 + # print(c.index('='))
     113 + # print(k)
     114 + # print(v)
     115 + t_cookies[k] = v
     116 +else:
     117 + t_cookies = {}
     118 +# print(t_cookies)
    101 119   
    102 120  if not url.startswith('http'):
    103 121   url = 'https://' + url
    104 122   
     123 +# exit()
    105 124  print("Calling %s..." % url )
    106  -r = requests.get( url )
     125 +# r = requests.get( url )
     126 +r = requests.get(url, cookies=t_cookies, allow_redirects=False, headers={'User-Agent':'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:105.0) Gecko/20100101 Firefox/105.0'})
     127 +# print(r.headers)
     128 +# print(r.text)
    107 129   
    108 130  if 'Content-Security-Policy' not in r.headers:
    109 131   usage( 'Content-Security-Policy not found' )
    skipped 3 lines
    113 135  #print(" %s" % t_csp )
    114 136  print("")
    115 137   
    116  -t_parse_orig = urlparse( url )
     138 +t_parse_orig = urllib.parse.urlparse( url )
    117 139  t_tld_orig = tldextract.extract( t_parse_orig.netloc )
    118 140  # print( t_parse_orig )
    119 141   
    skipped 7 lines
    127 149   if not item.startswith('http'):
    128 150   item = 'https://'+item
    129 151   
    130  - tmp_parse = urlparse( item )
     152 + tmp_parse = urllib.parse.urlparse( item )
    131 153   tmp_tld = tldextract.extract( tmp_parse.netloc )
    132 154   # print(tmp_parse)
    133 155   
    skipped 1 lines
    135 157   w_level = 1
    136 158   elif tmp_tld.domain == t_tld_orig.domain and tmp_tld.suffix == t_tld_orig.suffix:
    137 159   w_level = 2
    138  - else:
     160 + elif tmp_tld.domain == t_tld_orig.domain:
    139 161   w_level = 3
     162 + else:
     163 + w_level = 4
    140 164   
    141 165   if '*' in tmp_parse.netloc:
    142 166   w_level+=1
    skipped 11 lines
    154 178   if not len(policy):
    155 179   continue
    156 180   #sys.stdout.write( " " )
    157  - sys.stdout.write( colored( "%s" % policy, 'cyan', attrs=['reverse'] ) )
     181 + sys.stdout.write("%s%s%s%s" % (fg('cyan'),attr('reverse'),policy,attr(0)) )
     182 + # sys.stdout.write( colored( "%s" % policy, 'cyan', attrs=['reverse'] ) )
    158 183   if policy in t_help:
    159  - sys.stdout.write( colored( " [%s]" % t_help[policy], 'white' ) )
     184 + sys.stdout.write(" %s[%s]%s" % (fg('light_gray'),t_help[policy],attr(0)))
     185 + # sys.stdout.write( colored( " [%s]" % t_help[policy], 'white' ) )
    160 186   sys.stdout.write( "\n" )
    161 187   for item in tmp:
    162 188   if not len(item):
    skipped 9 lines
    172 198   w_level = getWarningLevel( t_tld_orig, item )
    173 199   color = t_warning_level[w_level]
    174 200   if color == 'white':
    175  - sys.stdout.write( " + " ) # can't print white with colored
     201 + sys.stdout.write( " + " )
    176 202   else:
    177  - sys.stdout.write( colored( " + ", color ) )
     203 + sys.stdout.write(" %s + %s" % (fg(color),attr(0)) )
     204 + # sys.stdout.write( colored( " + ", color ) )
    178 205   sys.stdout.write( "%s" % orig_item )
    179 206   if item in t_help:
    180  - sys.stdout.write( colored( " [%s]" % t_help[item]['t'], color ) )
     207 + sys.stdout.write( " %s[%s]%s" % (fg(color),t_help[item]['t'],attr(0)) )
     208 + # sys.stdout.write( colored( " [%s]" % t_help[item]['t'], color ) )
    181 209   sys.stdout.write( "\n" )
    182 210   sys.stdout.write( "\n" )
    183 211   
Please wait...
Page is in error, reload to recover