#coding=utf8
import optparse
import requests
import re
import time

def ReadFuzz(dbtype):
    if(dbtype == "mysql"):
        GenericBlindText = open("fuzztxt/GenericBlind.fuzz.txt", "r")
        MysqlText = open("fuzztxt/MySQL.fuzz.txt", "r")
        MysqlMssqlText = open("fuzztxt/MySQL_MSSQL.fuzz.txt", "r")
        return GenericBlindText.readlines()+MysqlText.readlines()+MysqlMssqlText.readlines()
    elif(dbtype == "mssql"):
        GenericBlindText = open("fuzztxt/GenericBlind.fuzz.txt", "r")
        MssqlText= open("fuzztxt/MSSQL.fuzz.txt", "r")
        MssqlBlindText = open("fuzztxt/MSSQL_blind.fuzz.txt", "r")
        MysqlMssqlText = open("fuzztxt/MySQL_MSSQL.fuzz.txt", "r")
        return GenericBlindText.readlines()+MssqlText.readlines()+MssqlBlindText.readlines()+MysqlMssqlText.readlines()
    elif(dbtype == "oracle"):
        GenericBlindText = open("fuzztxt/GenericBlind.fuzz.txt", "r")
        OracleText = open("fuzztxt/oracle.fuzz.txt", "r")
        return GenericBlindText.readlines()+OracleText.readlines()
    elif(dbtype == "xplatform"):
        GenericBlindText = open("fuzztxt/GenericBlind.fuzz.txt", "r")
        XplatformText = open("fuzztxt/xplatform.fuzz.txt", "r")
        return GenericBlindText.readlines()+XplatformText.readlines()
    else:
        GenericBlindText = open("fuzztxt/GenericBlind.fuzz.txt","r")
        MssqlText = open("fuzztxt/MSSQL.fuzz.txt","r")
        MssqlBlindText = open("fuzztxt/MSSQL_blind.fuzz.txt","r")
        MysqlText = open("fuzztxt/MySQL.fuzz.txt","r")
        MysqlMssqlText = open("fuzztxt/MySQL_MSSQL.fuzz.txt","r")
        OracleText = open("fuzztxt/oracle.fuzz.txt","r")
        XplatformText = open("fuzztxt/xplatform.fuzz.txt","r")
        return GenericBlindText.readlines() \
                +MssqlText.readlines() \
                +MssqlBlindText.readlines() \
                +MysqlText.readlines() \
                +MysqlMssqlText.readlines() \
                +OracleText.readlines() \
                +XplatformText.readlines()

def UrlRequest(requesttype,url,dbtype,*parameter):
    if url is None:
        print "[-] URL Error!";
        return False
    if dbtype is None:
        fuzzlist = ReadFuzz("")
    else:
        fuzzlist = ReadFuzz(dbtype)

    if (requesttype == "get"):
        #GET 请求处理
        #检查url是否包含提交参数
        for parameternum in range(len(parameter)):
            fuzzurl = re.findall(parameter[parameternum], url)
            if (len(fuzzurl) == 0):
                print "[-] Parameter Error!"
                return False
        resultweb = open("result.html", "a")
        resultweb.write("<table border='1'><tr><td>Request url</td><td>Use Time</td><td>ResponseLength</td></tr>")
        for parameternum in range(len(parameter)):
            for fuzzlistnum in range(len(fuzzlist)):
                fuzzurl = url.replace(parameter[parameternum],parameter[parameternum]+fuzzlist[fuzzlistnum])
                beforeTime = time.time()
                print fuzzurl
                try:
                    urlrequesttest = requests.get(fuzzurl)
                except:
                    continue
                urlrequest = urlrequesttest.content
                print urlrequesttest.status_code
                afterTime = time.time()
                useTime = afterTime - beforeTime
                resultweb.write("<tr><td>"+fuzzurl+"</td><td>"+str(useTime)+"</td><td>"+str(len(urlrequest))+"</td></tr>")

        resultweb.write("</table>")
        return True
    else:
        #POST请求处理
        resultweb = open("result.html", "a")
        resultweb.write("<table border='1'><tr><td>PostData</td><td>Use Time</td><td>ResponseLength</td></tr>")
        parameter = re.split("&",parameter[0])
        fuzzdata={} #搞一个字典，先把所有post数据放到字典里
        for parameternum in range(len(parameter)):
            fuzzdata[re.split("=",parameter[parameternum])[0]]=re.split("=",parameter[parameternum])[1]
        for parameternum in range(len(parameter)):
            for fuzzlistnum in range(len(fuzzlist)):
                fuzzdata[re.split("=",parameter[parameternum])[0]] = \
                    (re.split("=", parameter[parameternum])[1]+fuzzlist[fuzzlistnum]).replace("\n","")
                beforeTime = time.time()
                urlrequest = requests.post(url,data=fuzzdata).content
                afterTime = time.time()
                useTime = afterTime-beforeTime
                resultweb.write("<tr><td>" + str(fuzzdata) + "</td><td>" + str(useTime) + "</td><td>" + str(len(urlrequest)) + "</td></tr>")

        resultweb.write("</table>")
        return True
def main():
    parser = optparse.OptionParser('usage%prog '\
            '-t <requestype> -u <target url> -d <dbtype> -p <getparameter> -n <postparameter> ')
    parser.add_option('-t',dest='Requesttype',type='string')
    parser.add_option('-u',dest='Targeturl',type='string')
    parser.add_option('-d',dest='Dbtype',type='string')
    parser.add_option('-p',dest='Getpar',type='string')
    parser.add_option('-n',dest='Postpar',type='string')

    (options, args)=parser.parse_args()
    Requestype = options.Requesttype
    Targeturl = options.Targeturl
    Dbtype = options.Dbtype
    Getpar = options.Getpar
    Postpar = options.Postpar

    if (Requestype==None)| (Targeturl==None):
        print "[-] check url&request type"
    if (Getpar==None)&(Postpar==None):
        print "[-] check data"
    if (Dbtype==None):
        Dbtype = " "
    if(Getpar!=None):
        print UrlRequest(Requestype,Targeturl,Dbtype,Getpar)
    elif(Postpar!=None):
        print UrlRequest(Requestype,Targeturl,Dbtype,Postpar)
    else:
        print "[-] error"
if __name__ == '__main__':
    main()