nesca/finder.cpp

2614 lines
79 KiB
C++
Raw Normal View History

2015-03-10 14:35:50 +00:00
#include "STh.h"
2014-11-22 16:22:24 +00:00
#include "mainResources.h"
2014-10-26 15:05:51 +00:00
#include "externFunctions.h"
#include "externData.h"
2015-03-05 14:29:05 +00:00
#include "WebformWorker.h"
#include "Connector.h"
2015-03-16 14:29:34 +00:00
#include "BasicAuth.h"
#include "FTPAuth.h"
2015-03-06 14:32:36 +00:00
#include <memory>
2014-09-07 18:54:46 +00:00
2015-03-02 14:27:38 +00:00
char* strstri(const char *_Str, const char *_SubStr)
2014-09-07 18:54:46 +00:00
{
if(_Str != NULL)
{
2015-03-02 14:27:38 +00:00
const std::string &_lowStr = toLowerStr(_Str);
const std::string &_lowSubStr = toLowerStr(_SubStr);
2014-09-07 18:54:46 +00:00
const char *resChar = strstr(_lowStr.c_str(), _lowSubStr.c_str());
2015-03-02 14:27:38 +00:00
if(resChar == 0) return NULL;
else {
return (char*)(_Str + (resChar - _lowStr.c_str()));
}
2014-09-07 18:54:46 +00:00
};
2015-02-27 13:55:35 +00:00
return 0;
}
2014-09-07 18:54:46 +00:00
bool gGlobalTrackLocked = false;
2015-03-07 17:31:48 +00:00
char *_findFirst(const char *str, char *delim)
2014-09-07 18:54:46 +00:00
{
int sz = strlen(str);
int dsz = strlen(delim);
for(int i = 0; i < sz; ++i)
{
for(int j = 0; j < dsz; ++j)
{
if(str[i] == delim[j]) return (char *)(str + i);
};
};
return NULL;
2015-02-27 13:55:35 +00:00
}
char *_findLast(char *str, char *delim)
2014-09-07 18:54:46 +00:00
{
int sz = strlen(str);
int dsz = strlen(delim);
int savedPosition = 0;
for(int i = 0; i < sz; ++i)
{
for(int j = 0; j < dsz; ++j)
{
if(str[i] == delim[j]) savedPosition = i;
};
};
return (char *)(str + savedPosition);
2015-02-27 13:55:35 +00:00
}
2015-03-07 17:31:48 +00:00
char *GetCodePage(const char *str)
2014-09-07 18:54:46 +00:00
{
char cdpg[32] = {0};
2015-03-02 14:27:38 +00:00
char *ptr1 = strstri(str, "<meta ");
2014-09-07 18:54:46 +00:00
2015-03-02 14:27:38 +00:00
if(ptr1 != NULL)
{
char *ptr2 = strstri(ptr1 + 6, "charset=");
if(ptr2 != NULL)
{
char *temp4 = _findFirst((char *)(ptr2 + 6), " \"'>\n\r");
2014-09-07 18:54:46 +00:00
if(temp4 != NULL)
{
2015-03-02 14:27:38 +00:00
int ln = (int)(temp4 - ptr2 - 8);
2014-09-07 18:54:46 +00:00
if(ln > 16)
{
return "WTF?";
};
2015-03-02 14:27:38 +00:00
strncpy(cdpg, (char *)(ptr2 + 8), (ln > 32) ? 32 : ln );
2014-09-07 18:54:46 +00:00
if(strstri(cdpg, "%s") != NULL) return "UTF-8";
return cdpg;
}
else
{
2015-03-02 14:27:38 +00:00
stt->doEmitionRedFoundData("[GetCodePage] [" + QString(ptr2).mid(0, 16) + "]");
2015-02-27 13:55:35 +00:00
return "NULL";
2014-09-07 18:54:46 +00:00
};
2015-03-02 14:27:38 +00:00
}
ptr2 = strstri(ptr1 + 6, "charset = ");
if(ptr2 != NULL)
{
char *temp4 = _findFirst((char *)(ptr2 + 10), " \"'>\n\r");
2014-09-07 18:54:46 +00:00
if(temp4 != NULL)
{
2015-03-02 14:27:38 +00:00
int ln = (int)(temp4 - ptr2 - 10);
2014-09-07 18:54:46 +00:00
if(ln > 16)
{
return "WTF?";
};
2015-03-02 14:27:38 +00:00
strncpy(cdpg, (char *)(ptr2 + 10), (ln > 32) ? 32 : ln );
2014-09-07 18:54:46 +00:00
if(strstri(cdpg, "%s") != NULL) return "UTF-8";
return cdpg;
}
else
{
2015-03-02 14:27:38 +00:00
stt->doEmitionRedFoundData("[GetCodePage] [" + QString(ptr2).mid(0, 16) + "]");
2015-02-27 13:55:35 +00:00
return "NULL";
2014-09-07 18:54:46 +00:00
};
2015-03-02 14:27:38 +00:00
}
ptr2 = strstri(ptr1 + 6, "charset =");
if(ptr2 != NULL)
{
char *temp4 = _findFirst((char *)(ptr2 + 9), " \"'>\n\r");
2014-09-07 18:54:46 +00:00
if(temp4 != NULL)
{
2015-03-02 14:27:38 +00:00
int ln = (int)(temp4 - ptr2 - 9);
2014-09-07 18:54:46 +00:00
if(ln > 16)
{
return "WTF?";
};
2015-03-02 14:27:38 +00:00
strncpy(cdpg, (char *)(ptr2 + 9), (ln > 32) ? 32 : ln );
2014-09-07 18:54:46 +00:00
if(strstri(cdpg, "%s") != NULL) return "UTF-8";
return cdpg;
}
else
{
2015-03-02 14:27:38 +00:00
stt->doEmitionRedFoundData("[GetCodePage] [" + QString(ptr2).mid(0, 16) + "]");
2015-02-27 13:55:35 +00:00
return "NULL";
2014-09-07 18:54:46 +00:00
};
}
else
{
if(strstri(str, "charset=") != NULL)
{
char *temp2 = strstri(str, "charset=");
2015-03-02 14:27:38 +00:00
char *temp3 = _findFirst((char *)(temp2 + 8), " \"'>\n\r");
2014-09-07 18:54:46 +00:00
if(temp3 != NULL)
{
2015-03-02 14:27:38 +00:00
int ln = (int)(temp3 - temp2 - 8);
2014-09-07 18:54:46 +00:00
if(ln > 16)
{
return "WTF?";
};
2015-03-02 14:27:38 +00:00
strncpy(cdpg, (char *)(temp2 + 8), (ln > 32) ? 32 : ln );
2014-09-07 18:54:46 +00:00
if(strstri(cdpg, "%s") != NULL) return "UTF-8";
return cdpg;
}
else
{
stt->doEmitionRedFoundData("[GetCodePage] [" + QString(temp3).mid(0, 16) + "]");
2015-02-27 13:55:35 +00:00
return "NULL";
2014-09-07 18:54:46 +00:00
}
}
else
{
return "NULL";
};
};
}
2015-03-02 14:27:38 +00:00
ptr1 = strstri(str, "charset=");
if(ptr1 != NULL)
{
char *temp3 = _findFirst((char *)(ptr1 + 8), " \"'\n\r");
2014-09-07 18:54:46 +00:00
if(temp3 != NULL)
{
2015-03-02 14:27:38 +00:00
int ln = (int)(temp3 - ptr1 - 8);
2014-09-07 18:54:46 +00:00
if(ln > 16)
{
return "WTF?";
};
2015-03-02 14:27:38 +00:00
strncpy(cdpg, (char *)(ptr1 + 8), (ln > 32) ? 32 : ln );
2014-09-07 18:54:46 +00:00
if(strstri(cdpg, "%s") != NULL) return "UTF-8";
return cdpg;
}
else
{
stt->doEmitionRedFoundData("[GetCodePage] [" + QString(temp3).mid(0, 16) + "]");
2015-02-27 13:55:35 +00:00
return "NULL";
2014-09-07 18:54:46 +00:00
};
}
else
{
return "NULL";
};
2015-02-27 13:55:35 +00:00
}
2015-03-10 14:35:50 +00:00
int globalSearchNeg(const char *buffcpy, char *ip, int port)
2014-09-07 18:54:46 +00:00
{
char negWord[256] = {0};
2015-03-10 14:35:50 +00:00
for(int i = 0; i < GlobalNegativeSize; ++i)
2014-09-07 18:54:46 +00:00
{
2015-03-10 20:09:05 +00:00
if(!globalScanFlag) return -1;
2015-03-10 14:35:50 +00:00
2014-09-07 18:54:46 +00:00
strcpy(negWord, GlobalNegatives[i]);
2014-09-19 19:27:28 +00:00
if(strstr(buffcpy, negWord) != NULL)
2014-09-07 18:54:46 +00:00
{
if(gNegDebugMode)
{
stt->doEmitionDebugFoundData("[<a href=\"http://" + QString(ip) + ":" + QString::number(port) + "/\"><font color=\"#0084ff\">" + QString(ip) + ":" + QString::number(port) + "</font></a>" + "]\tNegative hit: \"" + QString::fromLocal8Bit(negWord).toHtmlEscaped() + "\"");
2014-09-07 18:54:46 +00:00
if(strlen(negWord) < 2)
{
stt->doEmitionDebugFoundData(" Len:" + QString::number(strlen(negWord)));
};
if(strcmp(negWord, "") == 0)
{
stt->doEmitionDebugFoundData("Empty hit!");
};
if(strcmp(negWord, " ") == 0)
{
stt->doEmitionDebugFoundData("Space hit!");
};
};
2015-03-10 14:35:50 +00:00
2014-09-07 18:54:46 +00:00
++Filt;
return -1;
};
2015-03-10 14:35:50 +00:00
2014-09-07 18:54:46 +00:00
ZeroMemory(negWord, 256);
};
2015-02-27 13:55:35 +00:00
}
2015-03-10 14:35:50 +00:00
int globalSearchPrnt(const char *buffcpy)
2014-09-07 18:54:46 +00:00
{
if(strstr(buffcpy, "en/_top.htm") != NULL || strstr(buffcpy, "cannon http server") != NULL
|| strstr(buffcpy, "konica minolta") != NULL || strstr(buffcpy, "/eng/home_frm.htm") != NULL
|| strstr(buffcpy, "networkScanner webserver") != NULL || strstr(buffcpy, "/eng/htm/top.htm") != NULL
|| strstr(buffcpy, "pages/t_ixdmy.htm") != NULL
|| strstr(buffcpy, "/web/guest/") != NULL || strstr(buffcpy, "printerInfo") != NULL
|| strstr(buffcpy, "hp photosmart") != NULL
|| strstr(buffcpy, "menu and") != NULL
|| strstr(buffcpy, "hewlett packard") != NULL
|| strstr(buffcpy, "laserjet") != NULL || strstr(buffcpy, "supplies summary") != NULL
|| strstr(buffcpy, "seiko epson") != NULL || strstr(buffcpy, "ink_y.png") != NULL
|| strstr(buffcpy, "epsonnet") != NULL || strstr(buffcpy, "printer name") != NULL
)
{
if(gNegDebugMode)
{
stt->doEmitionDebugFoundData("Printer detected.");
};
2015-03-10 14:35:50 +00:00
2014-09-07 18:54:46 +00:00
return -1;
};
2015-03-10 14:35:50 +00:00
return 0;
}
int sharedDetector(char * ip, int port, const char *buffcpy) {
if(strstr(buffcpy, "401 authorization") != NULL || strstr(buffcpy, "401 unauthorized") != NULL
|| (strstr(buffcpy, "www-authenticate") != NULL && strstr(buffcpy, "401 ") != NULL )
|| strstr(buffcpy, "401 unauthorized access denied") != NULL
|| strstr(buffcpy, "401 unauthorised") != NULL || (strstr(buffcpy, "www-authenticate") != NULL
&& strstr(buffcpy, " 401\r\n") != NULL)
) {
if(strstr(buffcpy, "digest realm") != NULL && strstr(buffcpy, "basic realm") == NULL) {
return 101;
} else return 1;
};
if(strstr(buffcpy, "netwave ip camera")) return 11;
if(strstr(buffcpy, "live view / - axis")) return 12;
if(strstr(buffcpy, "vilar ipcamera")) return 13;
if(strstr(buffcpy, "window.location = \"rdr.cgi\"")) return 14;
if(strstr(buffcpy, "httpfileserver")) return 15;
if(strstr(buffcpy, "real-time ip camera monitoring system") != NULL
|| strstr(buffcpy, "server push mode") != NULL
) return 17; //Real-time IP Camera Monitoring System
if(strstr(buffcpy, "linksys.com") != NULL && strstr(buffcpy, "tm05") != NULL) return 18; //linksys.com cameras
if(strstr(buffcpy, "reecam ip camera") != NULL) return 19; //reecam cameras
if(strstr(buffcpy, "/view/viewer_index.shtml") != NULL) return 20; //axis cameras
if(strstr(buffcpy, "bridge eyeon") != NULL) return 21; //Bridge Eyeon
if(strstr(buffcpy, "ip camera control webpage") != NULL && strstr(buffcpy, "/main/cs_motion.asp") != NULL) return 22; //ip camera control
if(strstr(buffcpy, "network camera") != NULL && strstr(buffcpy, "/live/index2.html") != NULL) return 23; //network camera BB-SC384
if(strstr(buffcpy, "network camera") != NULL && strstr(buffcpy, "/viewer/live/en/live.html") != NULL) return 24; //Network Camera VB-M40
if(strstr(buffcpy, "panasonic ") != NULL && strstr(buffcpy, ":60002/snapshotjpeg") != NULL) return 25; //Panasonic wtfidonteven-camera
if(strstr(buffcpy, "sony network camera") != NULL && strstr(buffcpy, "/command/inquiry.cgi?") != NULL) return 26; //Sony Network Camera
if(strstr(buffcpy, "network camera") != NULL && strstr(buffcpy, "src=\"webs.cgi?") != NULL) return 27; //UA Network Camera
if(strstr(buffcpy, "network camera") != NULL && strstr(buffcpy, "/viewer/live/index.html") != NULL) return 28; //Network Camera VB-M40
if(strstr(buffcpy, "lg smart ip device") != NULL) return 29; //LG Smart IP Device Camera
if(strstr(buffcpy, "/view/viewer_index.shtml") != NULL) return 20; //axis cameras
if(strstr(buffcpy, "nas") != NULL && strstr(buffcpy, "/cgi-bin/data/viostor-220/viostor/viostor.cgi") != NULL) return 30; //NAX
if(strstr(buffcpy, "ip camera") != NULL && strstr(buffcpy, "check_user.cgi") != NULL) return 31; //axis cameras
if(strstr(buffcpy, "ws(\"user\");") != NULL && strstr(buffcpy, "src=\"/tool.js") != NULL
&& strstr(buffcpy, "<b class=\"xb1\"></b>") != NULL) return 32; //web ip cam
if(strstr(buffcpy, "geovision") != NULL
&& (strstr(buffcpy, "ip camera") != NULL
|| strstr(buffcpy, "ssi.cgi/login.htm") != NULL)) return 33; //GEO web ip cam
if(strstr(buffcpy, "hikvision-webs") != NULL
|| (strstr(buffcpy, "hikvision digital") != NULL && strstr(buffcpy, "dvrdvs-webs") != NULL)
|| (strstr(buffcpy, "lapassword") != NULL && strstr(buffcpy, "lausername") != NULL && strstr(buffcpy, "dologin()") != NULL)) return 34; //hikvision cam
if((strstr(buffcpy, "easy cam") != NULL && strstr(buffcpy, "easy life") != NULL)
|| (strstr(buffcpy, "ipcamera") != NULL && strstr(buffcpy, "/tool.js") != NULL)) return 35; //EasyCam
if(strstr(buffcpy, "/config/cam_portal.cgi") != NULL || strstr(buffcpy, "/config/easy_index.cgi") != NULL) return 36; //Panasonic Cam
if(strstr(buffcpy, "panasonic") != NULL && strstr(buffcpy, "/view/getuid.cgi") != NULL) return 37; //Panasonic Cam WJ-HD180
if(strstr(buffcpy, "ipcam client") != NULL && strstr(buffcpy, "plugins.xpi") != NULL && strstr(buffcpy, "js/upfile.js") != NULL) return 38; //Foscam
if(strstr(buffcpy, "ip surveillance") != NULL && strstr(buffcpy, "customer login") != NULL) return 39; //EagleEye
if(strstr(buffcpy, "network camera") != NULL && strstr(buffcpy, "/admin/index.shtml?") != NULL) return 40; //Network Camera VB-C300
if(strstr(buffcpy, "sq-webcam") != NULL && strstr(buffcpy, "liveview.html") != NULL) return 41; //AVIOSYS-camera
if(strstr(buffcpy, "nw_camera") != NULL && strstr(buffcpy, "/cgi-bin/getuid") != NULL) return 42; //NW_camera
if(strstr(buffcpy, "micros") != NULL && strstr(buffcpy, "/gui/gui_outer_frame.shtml") != NULL) return 43; //NW_camera
if(strstr(buffcpy, "lapassword") != NULL
&& strstr(buffcpy, "lausername") != NULL
&& strstr(buffcpy, "g_ologin.dologin()") != NULL
) return 44; //hikvision cam 2
if(strstr(buffcpy, "panasonic") != NULL && strstr(buffcpy, "/config/index.cgi") != NULL) return 45; //Panasonic Cam BB-HG???
if(strstr(buffcpy, "/ui/") != NULL && strstr(buffcpy, "sencha-touch") != NULL) return 46; //BUFFALO disk
if(strstr(buffcpy, "digital video server") != NULL && strstr(buffcpy, "gui.css") != NULL) return 47; //Digital Video Server
if(strstr(buffcpy, "/ipcamerasetup.zip") != NULL && strstr(buffcpy, "download player") != NULL
&& strstr(buffcpy, "ipcam") != NULL) return 48; //ipCam
if(strstr(buffcpy, "dvr") != NULL && strstr(buffcpy, "ieorforefox") != NULL
&& strstr(buffcpy, "sofari") != NULL) return 49; //IEORFOREFOX
if (strstr(buffcpy, "seyeon") != NULL && (strstr(buffcpy, "/app/multi/single.asp") != NULL
|| strstr(buffcpy, "/app/live/sim/single.asp") != NULL)) return 50; //Network Video System
if(((strstr(buffcpy, "220") != NULL) && (port == 21)) ||
(strstr(buffcpy, "220 diskStation ftp server ready") != NULL) ||
(strstr(buffcpy, "220 ftp server ready") != NULL)
|| strstr(buffcpy, "500 'get': command not understood") != NULL
) return 16; // 16 - FTP
if((strstr(buffcpy, "camera web server") != NULL || strstr(buffcpy, "webcamxp 5") != NULL
|| strstr(buffcpy, "ip box camera") != NULL || strstr(buffcpy, "snaff") != NULL
|| strstr(buffcpy, "hfs /") != NULL || strstr(buffcpy, "httpfileserver") != NULL
|| strstr(buffcpy, "network camera") != NULL
|| strstr(buffcpy, "$lock extended") != NULL || strstr(buffcpy, "ip camera") != NULL
|| strstr(buffcpy, "/viewer/video.jpg") != NULL || strstr(buffcpy, "smart ip device") != NULL
|| strstr(buffcpy, "sanpshot_icon") != NULL || strstr(buffcpy, "snapshot_icon") != NULL
|| strstr(buffcpy, "ipcam") != NULL)
&& strstr(buffcpy, "customer") == NULL
&& strstr(buffcpy, "purchase") == NULL
&& strstr(buffcpy, "contac") == NULL
&& strstr(buffcpy, "company") == NULL
) return 0;
if(globalSearchNeg(buffcpy, ip, port) == -1) return -1;
if(globalSearchPrnt(buffcpy) == -1) return -1;
2015-03-10 20:09:05 +00:00
//if(strstr(buffcpy, "<form ") != NULL && strstr(buffcpy, "302 found") == NULL) return 10;
//nic.sucks, ...
2015-03-10 14:35:50 +00:00
return -2;
2015-02-27 13:55:35 +00:00
}
2014-09-07 18:54:46 +00:00
// 500 < 1600
2015-03-10 14:35:50 +00:00
int _mainFinderFirst(const char *buffcpy, int f, int port, char *ip)
{
int flag = sharedDetector(ip, port, buffcpy);
if(flag != -2) return flag;
if(f) return 7;
2014-09-07 18:54:46 +00:00
return 0;
2015-02-27 13:55:35 +00:00
}
2014-09-07 18:54:46 +00:00
//> 1600
2015-03-10 14:35:50 +00:00
int _mainFinderSecond(const char *buffcpy, int port, char *ip)
2014-09-07 18:54:46 +00:00
{
2015-03-10 14:35:50 +00:00
int flag = sharedDetector(ip, port, buffcpy);
if(flag != -2) return flag;
2014-09-07 18:54:46 +00:00
return 3; //Suspicious
2015-02-27 13:55:35 +00:00
}
2014-09-07 18:54:46 +00:00
2015-03-07 17:31:48 +00:00
int ContentFilter(const char *buff, int port, char *ip, char *cp)
2014-09-07 18:54:46 +00:00
{
2015-03-02 14:27:38 +00:00
if(buff != NULL)
2014-09-07 18:54:46 +00:00
{
int res = 0;
2015-01-17 01:33:03 +00:00
std::string tempString = "";
2015-01-17 01:06:47 +00:00
2014-09-07 18:54:46 +00:00
if(strstr(cp, "1251") != NULL)
{
2015-01-17 01:33:03 +00:00
tempString = toLowerStr(buff);
2014-09-07 18:54:46 +00:00
}
else
{
2015-03-02 14:27:38 +00:00
#if defined(WIN32) || defined(_WIN32) || defined(__WIN32) && !defined(__CYGWIN__)
tempString = toLowerStr(xcode(buff, CP_UTF8, CP_ACP).c_str());
#else
tempString = toLowerStr(buff);
#endif
2014-09-07 18:54:46 +00:00
};
2015-01-17 01:33:03 +00:00
int sz = tempString.size();
char *lBuff = new char[sz + 1];
ZeroMemory(lBuff, sz + 1);
strcpy(lBuff, tempString.c_str());
2014-09-07 18:54:46 +00:00
memset(lBuff + sz, '\0', 1);
2015-03-10 14:35:50 +00:00
2014-09-07 18:54:46 +00:00
if(sz <= 500)
{
2015-03-10 14:35:50 +00:00
res = _mainFinderFirst(lBuff, 1, port, ip);
2014-09-07 18:54:46 +00:00
}
else if((sz > 500 && sz <= 3500) || sz > 180000)
{
2015-03-10 14:35:50 +00:00
res = _mainFinderFirst(lBuff, 0, port, ip);
2014-09-07 18:54:46 +00:00
}
else if(sz > 3500 && sz <= 180000)
{
2015-03-10 14:35:50 +00:00
res = _mainFinderSecond(lBuff, port, ip);
2014-09-07 18:54:46 +00:00
};
2015-03-10 14:35:50 +00:00
2014-09-07 18:54:46 +00:00
delete []lBuff;
return res;
}
else return -1;
2015-02-27 13:55:35 +00:00
}
2015-03-16 14:29:34 +00:00
void fillGlobalLogData(char *ip, char *hostname, char *port, const char *sz, char *title,
const char *login, const char *pass, char *comment, char *cdpg, char *clss)
2014-09-07 18:54:46 +00:00
{
if(trackerOK == true)
{
while(gGlobalTrackLocked == true) Sleep(10);
gGlobalTrackLocked = true;
QJsonObject jsonData;
if(gMode == 0 || gMode == -1)
{
if(strlen(ip) > 0) jsonData.insert("ip_addr", QJsonValue(QString(ip)) );
else jsonData.insert("ip_addr", QJsonValue(QString("")) );
jsonData.insert("hostname", QJsonValue(QString(hostname)) );
}
else
{
jsonData.insert("ip_addr", QJsonValue(QString("")) );
jsonData.insert("hostname", QJsonValue(QString(ip)) );
};
jsonData.insert("port", QJsonValue(QString(port).replace(":", "")) );
jsonData.insert("recv", QJsonValue(QString(sz)) );
QString tt = QString(base64_encode((const unsigned char *)title, strlen(title)).c_str());
if(strlen(title) == 0) jsonData.insert("title", QJsonValue(QString("NULL")) );
else jsonData.insert("title", QJsonValue(QString(base64_encode((const unsigned char *)title, strlen(title)).c_str())) );
if(strlen(login) > 0) jsonData.insert("login", QJsonValue(QString(login)) );
else jsonData.insert("login", QJsonValue(QString("")) );
if(strlen(pass) > 0) jsonData.insert("pass", QJsonValue(QString(pass)) );
else jsonData.insert("pass", QJsonValue(QString("")) );
if(strlen(comment) > 0) jsonData.insert("other", QJsonValue(QString(comment)) );
else jsonData.insert("other", QJsonValue(QString("")) );
if(strlen(cdpg) > 0) jsonData.insert("encoding", QJsonValue(QString(cdpg)) );
else jsonData.insert("encoding", QJsonValue(QString("")) );
if(strlen(clss) > 0) jsonData.insert("Class", QJsonValue(QString(clss)) );
else jsonData.insert("Class", QJsonValue(QString("")) );
while(jsonArr == NULL);
jsonArr->push_front(jsonData);
gGlobalTrackLocked = false;
};
2015-02-27 13:55:35 +00:00
}
2014-09-07 18:54:46 +00:00
int __checkFileExistence(int flag)
{
char fileName[64] = {0};
if(flag == 666 || flag == 350) strcpy(fileName, "./result_files/STRANGE_ERROR.html");
else if(flag == -22) strcpy(fileName, "./result_files/ssh.html");
else if(flag == 0 || flag == 15 || flag == -10) strcpy(fileName, "./result_files/strange.html");
else if(flag == 3) strcpy(fileName, "./result_files/other.html");
else if(flag == 7) strcpy(fileName, "./result_files/low_loads.html");
2014-09-08 17:38:19 +00:00
else if(flag == 10) strcpy(fileName, "./result_files/LoginForms.html");
2014-09-07 18:54:46 +00:00
else if(flag == 16) strcpy(fileName, "./result_files/FTP.html");
else if(flag >= 17 || flag == 11 || flag == 12
|| flag == 13 || flag == 14 || flag == 1) strcpy(fileName, "./result_files/Basicauth.html");
FILE *f = fopen(fileName, "r");
if(f == NULL) return true;
else
{
fclose(f);
return false;
};
2015-02-27 13:55:35 +00:00
}
2014-09-07 18:54:46 +00:00
bool ftsAnom = true;
bool ftsOther = true;
bool ftsSSH = true;
bool ftsLL = true;
bool ftsFTP = true;
bool ftsBA = true;
bool ftsLF = true;
bool fOpened = false;
2015-02-19 18:02:49 +00:00
char styleBuff[1024] = {"<style> #recvSpan{display: inline-block;width: 150px;} #hostSpan{display: inline-block;width: 200px;}body { background-color: #141414; font-family: monospace; font-size:95%;} #ipd{background:black;width:100%;white-space:nowrap;overflow-x:none;display:inline-block;}#ipd:hover{color: #909090;background:#202020;}#tit{text-align:center;border:1px solid #5d5d5d;}a{color: gray;text-decoration: underline;} a:focus{ outline-style: dashed;outline-width:1px; outline-color: red;}</style>"};
2014-09-07 18:54:46 +00:00
char topBuff[1024] = {"<div id=\"tit\"><a href=\"strange.html\">.strange</a> <a href=\"other.html\">.other</a> <a href=\"Basicauth.html\">.BasicAuth</a> <a href=\"FTP.html\">.FTP</a> <a href=\"low_loads.html\">.LowLoads</a> <a href=\"LoginForms.html\">.loginforms</a> <a href=\"SSH.html\">.SSH</a></div><br><br>"};
2015-02-27 13:55:35 +00:00
void fputsf(char *text, int flag, char *msg)
2014-09-07 18:54:46 +00:00
{
2015-02-27 13:55:35 +00:00
FILE *file = NULL;
2014-09-07 18:54:46 +00:00
if(flag == 0 || flag == 15 || flag == -10)
{
if(ftsAnom) ftsAnom = __checkFileExistence(flag);
file = fopen("./result_files/strange.html", "a");
}
else if(flag == 3)
{
if(ftsOther) ftsOther = __checkFileExistence(flag);
file = fopen("./result_files/other.html", "a");
}
else if(flag == -22)
{
if(ftsSSH) ftsSSH = __checkFileExistence(flag);
file = fopen("./result_files/SSH.html", "a");
}
else if(flag == 7)
{
if(ftsLL) ftsLL = __checkFileExistence(flag);
file = fopen("./result_files/low_loads.html", "a");
}
else if(flag == 10)
{
if(ftsLF) ftsLF = __checkFileExistence(flag);
2014-09-08 17:38:19 +00:00
file = fopen("./result_files/LoginForms.html", "a");
2014-09-07 18:54:46 +00:00
}
else if(flag == 16)
{
if(ftsFTP) ftsFTP = __checkFileExistence(flag);
file = fopen("./result_files/FTP.html", "a");
}
else if(flag >= 17 || flag == 11 || flag == 12
|| flag == 13 || flag == 14 || flag == 1
)
{
if(ftsBA) ftsBA = __checkFileExistence(flag);
file = fopen("./result_files/Basicauth.html", "a");
}
else
{
stt->doEmitionRedFoundData("[WUT!?] Unknown flag [FLAG: " + QString::number(flag) + "]");
};
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
if(file != NULL)
{
time_t rtime;
time(&rtime);
if(horLineFlag == false)
{
horLineFlag = true;
char delimiter[128] = {0};
char cdate[32] = {0};
strcpy (cdate, "[");
strcat (cdate, ctime (&rtime));
memset (cdate + strlen(cdate) - 1, '\0', 1);
strcat (cdate, "] ");
strcpy(delimiter, "<hr><center><h5><font color=\"#a1a1a1\">");
strcat(delimiter, cdate);
strcat(delimiter, "</font></h5></center><hr>");
fputs (delimiter, file);
};
++saved;
char *string = new char[strlen(text) + 512];
if(flag != -22)
{
strcpy (string, "<div id=\"ipd\" style=\"color:#707070;text-decoration: none;\">");
char cdate[32] = {0};
strcat (cdate, "[");
strcat (cdate, ctime (&rtime));
memset (cdate + strlen(cdate) - 1, '\0', 1);
strcat (cdate, "] ");
strcat (string, cdate);
strcat (string, text);
strcat (string, "</div>");
}
else
{
strcpy (string, "<div id=\"ipd\" style=\"color:#707070;\">");
char cdate[32] = {0};
strcat (cdate, "[");
strcat (cdate, ctime (&rtime));
memset (cdate + strlen(cdate) - 1, '\0', 1);
strcat (cdate, "] ");
strcat (string, cdate);
strcat (string, text);
strcat (string, "</div>");
};
if(flag == 0 && ftsAnom)
{
char tmsg[1024] = {0};
ftsAnom = false;
strcpy(tmsg, "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" /><title>Anomalies</title>");
strcat(tmsg, msg);
strcat(tmsg, styleBuff);
fputs (tmsg, file);
fputs ("<div id=\"tit\"><a href=\"strange.html\">.strange</a> <a href=\"other.html\">.other</a> <a href=\"Basicauth.html\">.BasicAuth</a> <a href=\"FTP.html\">.FTP</a> <a href=\"low_loads.html\">.LowLoads</a> <a href=\"LoginForms.html\">.loginforms</a> <a href=\"SSH.html\">.SSH</a></div><br><br>", file);
};
if(flag == 3 && ftsOther)
{
char tmsg[1024] = {0};
ftsOther = false;
strcpy(tmsg, "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" /><title>Suspicious</title>");
strcat(tmsg, msg);
strcat(tmsg, styleBuff);
fputs (tmsg, file);
fputs (topBuff, file);
};
if(flag == -22 && ftsSSH)
{
char tmsg[1024] = {0};
ftsOther = false;
strcpy(tmsg, "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" /><title>SSH</title>");
strcat(tmsg, msg);
strcat(tmsg, styleBuff);
fputs (tmsg, file);
fputs (topBuff, file);
};
if(flag == 7 && ftsLL)
{
char tmsg[1024] = {0};
ftsLL = false;
strcpy(tmsg, "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" /><title>Lowloads</title>");
strcat(tmsg, msg);
strcat(tmsg, styleBuff);
fputs (tmsg, file);
fputs (topBuff, file);
};
if(flag == 16 && ftsFTP)
{
char tmsg[1024] = {0};
ftsFTP = false;
strcpy(tmsg, "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" /><title>FTP</title>");
strcat(tmsg, msg);
strcat(tmsg, styleBuff);
fputs (tmsg, file);
fputs (topBuff, file);
};
if(flag == 10 && ftsLF)
{
char tmsg[1024] = {0};
ftsLF = false;
strcpy(tmsg, "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" /><title>LoginsForms</title>");
strcat(tmsg, msg);
strcat(tmsg, styleBuff);
fputs (tmsg, file);
fputs (topBuff, file);
};
if((flag >= 17 || flag == 11 || flag == 12 || flag == 13 || flag == 14 || flag == 1) && ftsBA)
{
char tmsg[1024] = {0};
ftsBA = false;
strcpy(tmsg, "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" /><title>BasicAuth</title>");
strcat(tmsg, msg);
strcat(tmsg, styleBuff);
fputs (tmsg, file);
fputs (topBuff, file);
};
int innerCounter = 0;
while(fOpened)
{
if(innerCounter > 20)
{
stt->doEmitionRedFoundData("\"fOpened\" loop detected!");
break;
};
++innerCounter;
2015-03-16 14:29:34 +00:00
Sleep((rand() % 100 + 60));
2014-09-07 18:54:46 +00:00
};
fOpened = true;
fputs (string, file);
fclose (file);
fOpened = false;
delete []string;
}
else
{
stt->doEmitionRedFoundData("Cannot open file [FLAG: " + QString::number(flag) + "]");
};
2015-02-27 13:55:35 +00:00
}
2014-09-07 18:54:46 +00:00
void putInFile(int flag, char *ip, char *port, int recd, char *finalstr, char *hl, char *cp)
{
char log[4096] = {0}, msg[512] = {0};
if(flag == 0 || flag == 15 || flag == -10) strcpy(msg, "[A]:");
else if(flag == 3) strcpy(msg, "[S]:");
else if(flag == 7) strcpy(msg, "[LL]:");
else if(flag == 2) strcpy(msg, "[P]:");
else if(flag == 666 || flag == 350) strcpy(msg, "[Strange Error]:");
else if(flag == 10) strcpy(msg, "[LF]:");
QTextCodec *codec;
strcat(msg, "<a href=\"http://");
strcat(msg, ip);
strcat(msg, ":");
strcat(msg, port);
strcat(msg, "/\"><span style=\"color: #a1a1a1;\">");
strcat(msg, ip);
strcat(msg, ":");
strcat(msg, port);
strcat(msg, "</span></a>");
QString resMes(msg);
QString strf;
if(strstri(cp, "shift_jis") != NULL)
{
codec = QTextCodec::codecForName("Shift-JIS");
strf = codec->toUnicode(finalstr);
}
else if(strstri(cp, "utf") != NULL)
{
codec = QTextCodec::codecForName("UTF-8");
strf = codec->toUnicode(finalstr);
}
else if(strstri(cp, "cp") != NULL || strstri(cp, "windows") != NULL)
{
codec = QTextCodec::codecForName("Windows-1251");
strf = codec->toUnicode(finalstr);
}
else strf = QString(finalstr);
if(flag != 6 && flag != 5 && flag != 4 && flag != 666 && flag != 350)
{
strcat(msg, " <font color=\"#0084ff\">: </font><font color=\"#ff9600\">");
int sz = strf.size();
strncat(msg, QString::fromLocal8Bit(finalstr).toHtmlEscaped().toLocal8Bit().data(), (sz < 128 ? sz : 128));
strcat(msg, "</font>");
2014-11-16 13:52:23 +00:00
resMes += " <font color=\"#0084ff\">: </font><font color=\"#ff9600\">" + strf.toHtmlEscaped() + "</font>";
2014-09-07 18:54:46 +00:00
};
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
stt->doEmitionFoundData(resMes);
strcpy(log, "<font color=GreenYellow>");
strcat(log, hl);
strcat(log, "</font>");
int flr = 40 - strlen(hl);
if(flr > 0)
{
while(flr != 0)
{
strcat(log, " ");
--flr;
};
}
else strcat(log, " ");
strcat(log, "<span id=\"hostSpan\"><a href=\"http://");
strcat(log, ip);
strcat(log, ":");
strcat(log, port);
strcat(log, "\"/><font color=MediumSeaGreen>");
strcat(log, ip);
strcat(log, ":");
strcat(log, port);
strcat(log, "</font></a>;</span> <span id=\"recvSpan\">Received: <font color=SteelBlue>");
2015-02-08 19:00:53 +00:00
strcat(log, std::to_string(recd).c_str());
2014-09-07 18:54:46 +00:00
strcat(log, "</font>");
if(flag == 666 || flag == 350)
{
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, port, std::to_string(recd).c_str(), finalstr, "", "", "", cp, "Strange error");
2014-09-07 18:54:46 +00:00
++PieAnomC1;
++AnomC1;
}
else if(flag == 0 || flag == 15 || flag == -10)
{
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, port, std::to_string(recd).c_str(), finalstr, "", "", "", cp, "Anomaly");
2014-09-07 18:54:46 +00:00
++PieAnomC1;
++AnomC1;
}
else if(flag == 3)
{
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, port, std::to_string(recd).c_str(), finalstr, "", "", "", cp, "Suspicious");
2014-09-07 18:54:46 +00:00
++PieSusp;
++Susp;
}
else if(flag == 7)
{
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, port, std::to_string(recd).c_str(), finalstr, "", "", "", cp, "Low load");
2014-09-07 18:54:46 +00:00
++PieLowl;
}
else if(flag == 10)
{
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, port, std::to_string(recd).c_str(), finalstr, "", "", "", cp, "Login form");
2014-09-07 18:54:46 +00:00
++PieWF;
};
if(flag != 6 && flag != 5 && flag != 4)
{
strcat(log, ";</span> T: <font color=GoldenRod>");
strncat(log, QString::fromLocal8Bit(finalstr).toHtmlEscaped().toLocal8Bit().data(), 100);
strcat(log, "</font>");
};
strcat(log, "\n");
2015-02-27 13:55:35 +00:00
fputsf (log, flag, msg);
2014-09-07 18:54:46 +00:00
ZeroMemory(msg, strlen(msg));
2015-02-27 13:55:35 +00:00
}
2015-03-16 14:29:34 +00:00
void _specFillerBA(char *hl, char *ip, char *port, char *finalstr, const char *login, const char *pass, int flag)
2014-09-07 18:54:46 +00:00
{
2015-03-16 14:29:34 +00:00
char log[512] = {0};
2014-09-07 18:54:46 +00:00
++PieBA;
2015-03-16 14:29:34 +00:00
if(strcmp(login, "NULL") != 0 && strcmp(pass, "NULL") != 0)
{
sprintf(log, "[BA]:<span id=\"hostSpan\"><a href=\"http://%s:%s@%s%s\"><font color=MediumSeaGreen>%s:%s@%s%s</font></a></span> T: <font color=GoldenRod>%s</font>\n",
login, pass, ip, port, login, pass, ip, port, finalstr);
} else {
sprintf(log, "[BA]:<span id=\"hostSpan\"><a href=\"http://%s%s\"><font color=MediumSeaGreen>%s%s</font></a></span> T: <font color=GoldenRod>%s</font>\n",
ip, port, ip, port, finalstr);
}
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
stt->doEmitionFoundData(QString::fromLocal8Bit(log));
2015-02-27 13:55:35 +00:00
fputsf (log , flag, "Basic Authorization");
}
2014-09-07 18:54:46 +00:00
void _specFillerWF(char *hl, char *ip, char *port, char *finalstr, char *login, char *pass, int flag)
{
char log[512] = {0};
++PieWF;
2015-03-07 17:31:48 +00:00
2015-03-10 14:35:50 +00:00
sprintf(log, "[WF]:<span id=\"hostSpan\"><a href=\"http://%s:%s\"><font color=MediumSeaGreen>%s:%s</font></a></span> T: <font color=GoldenRod>%s</font> Pass: <font color=SteelBlue>%s:%s</font>\n",
ip, port, ip, port, finalstr, login, pass);
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
stt->doEmitionFoundData(QString::fromLocal8Bit(log));
2015-02-27 13:55:35 +00:00
fputsf (log , flag, "Web Form");
}
2014-09-07 18:54:46 +00:00
void _getFormVal(char *data, char *result, char *key, char *path = NULL)
{
char parVal[256] = {0};
int psz = 0;
char *pkeyResult1 = strstr(data, ">");
if(pkeyResult1 != NULL)
{
psz = pkeyResult1 - data + 1;
strncpy(parVal, data, (psz < 256 ? psz : 256));
}
else
{
strncpy(parVal, data, 256);
};
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
int sz = 0;
char parVal2[256] = {0};
char startPath[256] = {0};
if(strcmp(key, "action") == 0)
{
if(strstr(path, "./") == NULL)
{
char *ptrP1 = _findLast(path, "/");
2014-09-07 18:54:46 +00:00
if(ptrP1 != path)
{
int pSz = ptrP1 -path;
strncpy(startPath, path, pSz);
};
};
};
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
char *keyResult1 = strstri(parVal, key);
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
if(keyResult1 != NULL)
{
char *pkeyResult2 = _findFirst(keyResult1, " >");
2014-09-07 18:54:46 +00:00
if(pkeyResult2 != NULL)
{
int psz2 = pkeyResult2 - keyResult1;
strncpy(parVal2, keyResult1, (psz2 < 256 ? psz2 : 256));
char *keyResult2 = _findFirst(parVal2, "'\"");
2014-09-07 18:54:46 +00:00
if(keyResult2 != NULL)
{
char *keyResult3 = _findFirst(keyResult2 + 1, "'\"> ");
2014-09-07 18:54:46 +00:00
if(keyResult3 != NULL)
{
sz = keyResult3 - keyResult2 - 1;
char tempRes[256] = {0};
if(strstr(keyResult2, "./") != NULL)
{
strcpy(result, startPath);
strncpy(tempRes, keyResult2 + 2, sz - 1);
if(tempRes[0] != '/') strcat(result, "/");
strcat(result, tempRes);
}
else if(strstr(keyResult2, "/") == NULL)
{
if(strcmp(key, "action") == 0)
{
strcpy(result, startPath);
strncpy(tempRes, keyResult2 + 1, sz);
if(tempRes[0] != '/') strcat(result, "/");
strcat(result, tempRes);
}
else
{
strncpy(result, keyResult2 + 1, sz);
};
}
else
{
strncpy(result, keyResult2 + 1, sz);
};
};
}
else
{
keyResult2 = _findFirst(parVal2, "=");
2014-09-07 18:54:46 +00:00
if(keyResult2 != NULL)
{
char *keyResult3 = _findFirst(keyResult2, "'\"> ");
2014-09-07 18:54:46 +00:00
if(keyResult3 != NULL )
{
sz = keyResult3 - keyResult2 - 1;
strncpy(result, keyResult2 + 1, sz);
char tempRes[256] = {0};
if(strstr(keyResult2, "./") != NULL)
{
strcpy(result, startPath);
strncpy(tempRes, keyResult2 + 2, sz - 1);
if(tempRes[0] != '/') strcat(result, "/");
strcat(result, tempRes);
}
else if(strstr(keyResult2, "/") == NULL)
{
if(strcmp(key, "action") == 0)
{
strcpy(result, startPath);
strncpy(tempRes, keyResult2 + 1, sz);
if(tempRes[0] != '/') strcat(result, "/");
strcat(result, tempRes);
}
else
{
strncpy(result, keyResult2 + 1, sz);
};
}
else
{
strncpy(result, keyResult2 + 1, sz);
};
}
else
{
strcpy(result, startPath);
strcat(result, keyResult2 + 1);
};
}
};
}
else
{
stt->doEmitionFoundData("[WF]: GetParam - Cannot retrieve field.");
};
};
2015-02-27 13:55:35 +00:00
}
2014-09-07 18:54:46 +00:00
static const std::string arrUser[] = {"user", "usr", "username", "login", "lgn", "account", "acc", "param1", "param3", "id", "A1", "uname", "mail", "name"};
2014-10-26 15:05:51 +00:00
std::vector<std::string> vecUser (arrUser, arrUser + sizeof(arrUser) / sizeof(arrUser[0]) );
2014-09-19 19:27:28 +00:00
static const std::string arrPass[] = {"pass", "pw", "password", "code", "param2", "param4", "secret", "login_p", "A2", "admin_pw", "pws", "secretkey"};
2014-10-26 15:05:51 +00:00
std::vector<std::string> vecPass (arrPass, arrPass + sizeof(arrPass) / sizeof(arrPass[0]) );
2014-09-07 18:54:46 +00:00
2015-03-07 17:31:48 +00:00
char *_getAttribute(const char *str, char *attrib)
2014-09-07 18:54:46 +00:00
{
if(strstri(str, attrib) != NULL)
{
char res[1024] = {0};
char *ptrStart = strstri(str, attrib);
char *ptrEnd = _findFirst(ptrStart, "\r\n");
2014-09-07 18:54:46 +00:00
if(ptrEnd != NULL)
{
int szAt = strlen(attrib);
int sz = ptrEnd - ptrStart - szAt;
if(sz != 0 && sz < 1024) strncpy(res, ptrStart + szAt, sz);
else return "";
return res;
}
else return "";
}
else return "";
2015-02-27 13:55:35 +00:00
}
2014-09-07 18:54:46 +00:00
void _getInputVal(std::vector<std::string> inputVec, char *buff, char *key)
{
char *pos = NULL;
2014-09-19 19:27:28 +00:00
char field[256] = {0};
2014-09-07 18:54:46 +00:00
if(strcmp(key, "USER") == 0)
{
for(int i = 0; i < inputVec.size(); ++i)
{
2014-09-19 19:27:28 +00:00
ZeroMemory(field, 256);
2014-09-07 18:54:46 +00:00
_getFormVal((char*)inputVec[i].data(), field, "name=");
for(int j = 0; j < vecUser.size(); ++j)
{
pos = strstri(field, vecUser[j].data());
if(pos != NULL)
{
2014-09-19 19:27:28 +00:00
strncpy(buff, field, 256);
2014-09-07 18:54:46 +00:00
return;
};
};
};
}
else
{
for(int i = 0; i < inputVec.size(); ++i)
{
2014-09-19 19:27:28 +00:00
ZeroMemory(field, 256);
2014-09-07 18:54:46 +00:00
_getFormVal((char*)inputVec[i].data(), field, "name=");
for(int j = 0; j < vecPass.size(); ++j)
{
pos = strstri(field, vecPass[j].data());
if(pos != NULL)
{
2014-09-19 19:27:28 +00:00
strncpy(buff, field, 256);
2014-09-07 18:54:46 +00:00
return;
};
};
};
};
2015-02-27 13:55:35 +00:00
}
2015-03-16 14:29:34 +00:00
void _specWFBrute(char *ip, int port, char *hl, const char *buff, int flag, char *path, char *comment, char *tclass, char *cp, int recd, char *title)
2014-09-07 18:54:46 +00:00
{
if(strstr(buff, "VER_CODE") != NULL || strstri(buff, "captcha") != NULL)
{
if(gNegDebugMode)
{
stt->doEmitionDebugFoundData("[<a href=\"http://" + QString(ip) + ":" + QString::number(port) + "\"><font color=\"#0084ff\">" + QString(ip) + ":" + QString::number(port) + "</font></a>" + "] Ignoring: Captcha detected.");
};
return;
2015-03-16 14:29:34 +00:00
};
2014-09-07 18:54:46 +00:00
char methodVal[128] = {0};
char actionVal[512] = {0};
char userVal[128] = {0};
char passVal[128] = {0};
char frmBlock[4096] = {0};
char *fBlock = strstri(buff, "<form ");
char formVal[128] = {0};
int fbsz = 0;
char tport[16] = {0};
2015-02-26 14:20:37 +00:00
sprintf(tport, "%d", port);
2014-09-07 18:54:46 +00:00
std::vector<std::string> inputVec;
if(fBlock != NULL)
{
char *fBlock2 = strstri(fBlock, ">");
int szfb2 = fBlock2 - fBlock;
strncpy(formVal, fBlock, (szfb2 < 128 ? szfb2 : 128));
char *frmBlockEnd = strstri(fBlock, "</form>");
if(frmBlockEnd != NULL)
{
fbsz = frmBlockEnd - fBlock;
strncpy(frmBlock, fBlock, (fbsz < 4096 ? fbsz : 4096));
}
else
{
strncpy(frmBlock, fBlock, 4096);
};
_getFormVal(frmBlock, methodVal, "method");
_getFormVal(frmBlock, actionVal, "action", path);
if(actionVal[0] == '.')
{
char tmpBuff[512] = {0};
char *tempPtr1 = _findLast(path, "/");
2014-09-07 18:54:46 +00:00
int sz = tempPtr1 - path;
if(sz > 0)
{
strncpy(tmpBuff, path, sz);
strncat(tmpBuff, actionVal + 1, strlen(actionVal) - 1);
ZeroMemory(actionVal, sizeof(actionVal));
strcpy(actionVal, tmpBuff);
};
};
char *inptPtr1 = strstri(frmBlock, "<input ");
int insz = 0;
char *inptPtrEnd = NULL;
2014-09-19 19:27:28 +00:00
char tempInptStr[256] = {0};
2014-09-07 18:54:46 +00:00
while(inptPtr1 != NULL)
{
inptPtrEnd = strstr(inptPtr1, ">");
if(inptPtrEnd != NULL)
{
2014-09-19 19:27:28 +00:00
ZeroMemory(tempInptStr, 256);
2014-09-07 18:54:46 +00:00
insz = inptPtrEnd - inptPtr1 + 1;
2014-09-19 19:27:28 +00:00
strncpy(tempInptStr, inptPtr1, (insz < 256 ? insz : 256));
2014-09-07 18:54:46 +00:00
inputVec.push_back(std::string(tempInptStr));
inptPtr1 = strstri(inptPtrEnd, "<input ");
}
else break;
};
if(inputVec.size() != 0)
{
_getInputVal(inputVec, userVal, "USER");
_getInputVal(inputVec, passVal, "PASS");
}
else
{
2014-09-19 19:27:28 +00:00
if(gNegDebugMode) stt->doEmitionFoundData("<a href=\"http://" + QString(ip) + ":" + QString::number(port) + "\"><font color=\"#c3c3c3\">" + QString(ip) + ":" + QString::number(port) + "</font></a> - [WF]: No text/password fields found.");
2015-02-08 19:00:53 +00:00
///fillGlobalLogData(ip, hl, tport, std::to_string(recd).c_str(), title, "NULL", "NULL", comment, cp, tclass);
2014-09-19 19:27:28 +00:00
///putInFile(flag, ip, tport, recd, title, hl, cp);
2014-09-07 18:54:46 +00:00
};
}
else
{
stt->doEmitionFoundData("<a href=\"http://" + QString(ip) + ":" + QString::number(port) + "\"><font color=\"#c3c3c3\">" + QString(ip) + ":" + QString::number(port) + "</font></a> - [WF]: Cannot find form block.");
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, tport, std::to_string(recd).c_str(), title, "NULL", "NULL", comment, cp, tclass);
2014-09-07 18:54:46 +00:00
putInFile(flag, ip, tport, recd, title, hl, cp);
};
if(strlen(methodVal) == 0)
{
strcpy(methodVal, "GET");
};
if(strlen(actionVal) == 0)
{
strcpy(actionVal, "/");
}
else
{
if(strstri(actionVal, "http") != NULL)
{
char tmp[128] = {0};
strncpy(tmp, actionVal, 128);
if(strstr(tmp, "//") != NULL)
{
char *tmp1 = strstr(tmp, "//");
char *tmp2 = strstr(tmp1 + 2, "/");
ZeroMemory(actionVal, 128);
if(tmp2 != NULL)
{
strncpy(actionVal, tmp2, strlen(tmp2));
}
else
{
strcpy(actionVal, "/");
};
}
else if(strstr(tmp, "%2f%2f") != NULL)
{
char *tmp1 = strstr(tmp, "%2f%2f");
char *tmp2 = strstr(tmp1 + 6, "%2f");
ZeroMemory(actionVal, 128);
if(tmp2 != NULL)
{
strcpy(actionVal, "/");
strncpy(actionVal, tmp2 + 3, strlen(tmp2) - 3);
}
else
{
strcpy(actionVal, "/");
};
};
};
if(actionVal[0] != '/')
{
char temp[128] = {0};
strncpy(temp, actionVal, 128);
strcpy(actionVal, "/");
strncat(actionVal, temp, strlen(temp));
};
};
if(inputVec.size() > 0)
{
if(strlen(userVal) != 0 && strlen(passVal) != 0)
2015-03-05 14:29:05 +00:00
{
WFClass WFC;
lopaStr lps = WFC._WFBrute(ip, port, methodVal, actionVal, userVal, passVal, formVal);
2014-09-07 18:54:46 +00:00
if(strstr(lps.login, "UNKNOWN") == NULL && strlen(lps.other) == 0)
{
_specFillerWF(hl, ip, tport, title, lps.login, lps.pass, flag);
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, tport, std::to_string(recd).c_str(), title, lps.login, lps.pass, comment, cp, tclass);
2014-09-07 18:54:46 +00:00
putInFile(flag, ip, tport, recd, title, hl, cp);
};
}
else
{
2014-09-19 19:27:28 +00:00
if(gNegDebugMode) stt->doEmitionFoundData("<a href=\"http://" + QString(ip) + ":" + QString::number(port) + "\"><font color=\"#c3c3c3\">" + QString(ip) + ":" + QString::number(port) + "</font></a> - [WF]: Cannot find user/pass field.");
2015-02-08 19:00:53 +00:00
///fillGlobalLogData(ip, hl, tport, std::to_string(recd).c_str(), title, "", "", "UnknownWebform", cp, tclass);
2014-09-19 19:27:28 +00:00
///putInFile(flag, ip, tport, recd, title, hl, cp);
2014-09-07 18:54:46 +00:00
};
2015-03-16 14:29:34 +00:00
};
2015-02-27 13:55:35 +00:00
}
2015-02-08 19:00:53 +00:00
2015-02-27 13:55:35 +00:00
void _specWEBIPCAMBrute(char *ip, int port, char *hl, char *finalstr, int flag, char *comment, char *cp, int recd, char *SPEC)
2014-09-07 18:54:46 +00:00
{
lopaStr lps;
ZeroMemory(lps.login, sizeof(lps.login));
ZeroMemory(lps.pass, sizeof(lps.pass));
ZeroMemory(lps.other, sizeof(lps.other));
2015-02-26 14:20:37 +00:00
char tport[32] = {0};
sprintf(tport, ":%d", port);
2015-03-05 14:29:05 +00:00
lps = _IPCameraBLobby(ip, port, SPEC);
2014-09-07 18:54:46 +00:00
if(strstr(lps.login, "UNKNOWN") == NULL && strlen(lps.other) == 0)
{
_specFillerBA(hl, ip, tport, finalstr, lps.login, lps.pass, flag);
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, tport, std::to_string(recd).c_str(), finalstr, lps.login, lps.pass, comment, cp, "Basic Authorization");
2014-09-07 18:54:46 +00:00
};
2015-02-27 13:55:35 +00:00
}
2015-03-16 14:29:34 +00:00
void _specBrute(char *cookie, char *ip, int port,
char *hl, char *finalstr, int flag,
char *path, char *comment, char *cp, int recd)
2014-09-07 18:54:46 +00:00
{
char temp[64] = {0};
2015-02-26 14:20:37 +00:00
char tport[32] = {0};
sprintf(tport, ":%d", port);
2014-09-07 18:54:46 +00:00
2015-03-16 14:29:34 +00:00
const lopaStr &lps = BA::_BALobby((string(ip) + string(path)).c_str(), port);
//if(strcmp(comment, "[DIGEST]") == 0) lps = _BALobby(cookie, ip, port, path, "[DIGEST]");
//else lps = _BALobby(cookie, ip, port, path, "[NORMAL]");
2014-09-07 18:54:46 +00:00
if(strstr(lps.login, "UNKNOWN") == NULL && strlen(lps.other) == 0)
{
_specFillerBA(hl, ip, tport, finalstr, lps.login, lps.pass, flag);
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, tport, std::to_string(recd).c_str(), finalstr, lps.login, lps.pass, comment, cp, "Basic Authorization");
2014-09-07 18:54:46 +00:00
};
2014-09-19 19:27:28 +00:00
ZeroMemory(temp, sizeof(temp));
2015-02-27 13:55:35 +00:00
}
2015-03-07 17:31:48 +00:00
const char *GetTitle(const char* str)
2014-09-07 18:54:46 +00:00
{
char delimiterT[] = "<title id=titletext>";
char delimiterT2[] = "<title id=\"title\">";
2015-03-07 17:31:48 +00:00
const char *firstStr, *secondStr;
char finalstr[512] = { 0 };
2014-09-07 18:54:46 +00:00
if (strstri(str, "realm") != NULL)
{
if (strstr(str, "\"") != NULL)
{
int hm;
firstStr = strstr(str, "\"");
if(strstr((firstStr+1), "\"") != NULL)
{
secondStr = strstr((firstStr+1), "\"");
hm = (int)(secondStr-firstStr);
}
else hm = 10;
if(hm > 127) hm = 20;
strncat(finalstr, firstStr, hm+1);
};
};
if(strlen(finalstr) != 0) strcat(finalstr, "::");
if(strstri(str, "<card") != NULL)
{
char *str1 = strstri(str, "<card");
if(strstri(str1, "title=") != NULL)
{
char *str2 = strstri(str1, "title=");
if(strstri(str2, ">") != NULL)
{
char *str3 = strstri(str2, ">");
int y = str3 - str2;
if(y > 256)
{
strcpy(finalstr, "[Strange title]");
}
else
{
strncat(finalstr, (char*)(str2 + strlen("title=")), y);
strcat(finalstr, " += ");
};
};
};
};
if(strstri(str, "<title>") != NULL)
{
if(strstri(str, "<title>") != NULL) firstStr = strstri(str, "<title>");
if(strstri(firstStr, "</title>") != NULL) secondStr = strstri(firstStr, "</title>");
else
{
strcat(finalstr, "[Corrupted title]");
return finalstr;
};
int hm = (int)(secondStr - firstStr);
if(hm > 256) hm = 20;
strncat(finalstr, firstStr + 7, hm - 7);
if(strstri(finalstr, "index of /") != NULL)
{
int hm = 0;
strcat(finalstr, " (");
if(strstri(firstStr, "description") != NULL) firstStr = strstri(firstStr, "description");
if(strstri(firstStr, "<a href=") != NULL) firstStr = strstri(firstStr, "<a href=");
else firstStr = NULL;
int iterCount = 0;
while(firstStr != NULL && strstr(firstStr , "\">") != NULL && strlen(finalstr) < 480)
{
if(iterCount++ > 4 || strlen(finalstr) > 300) break;
if(strstr(firstStr, "\">") != NULL) firstStr = strstr(firstStr, "\">");
else break;
secondStr = strstri(firstStr, "</a>");
hm = (int)(secondStr-firstStr);
if(hm > 16) hm = 16;
strncat(finalstr, firstStr + 2, hm - 2);
strcat(finalstr, " ");
if(strstri(firstStr, "<a href=") != NULL) firstStr = strstri(firstStr, "<a href=");
else break;
};
strcat(finalstr, ");");
};
};
if(strstri(str, delimiterT2) != NULL)
{
firstStr = strstri(str, delimiterT2);
if(strstri(firstStr, "</title>") != NULL) secondStr = strstri(firstStr, "</title>");
else
{
strcpy(finalstr, "[Corrupted title]");
return finalstr;
};
int hm = (int)(secondStr-firstStr);
if(hm > 127) hm = 30;
strncat(finalstr, firstStr+18, hm-18);
}
else if(strstri(str, delimiterT) != NULL)
{
firstStr = strstri(str, delimiterT);
if(strstri(firstStr, "</title>") != NULL) secondStr = strstri(firstStr, "</title>");
int hm = (int)(secondStr-firstStr);
if(hm > 127) hm = 30;
strncat(finalstr, firstStr+20, hm-20);
};
return finalstr;
2015-02-27 13:55:35 +00:00
}
2015-03-07 17:31:48 +00:00
void _saveSSH(char *ip, int port, int recd, const char *buffcpy)
2014-09-07 18:54:46 +00:00
{
2014-09-19 19:27:28 +00:00
if(buffcpy != NULL)
2015-02-27 13:55:35 +00:00
{
2014-09-07 18:54:46 +00:00
char log[2048] = {0};
char logEmit[2048] = {0};
char goodStr[256] = {0};
char banner[256] = {0};
2015-03-07 17:31:48 +00:00
const char *ptr1 = strstr(buffcpy, "|+|");
2014-09-19 19:27:28 +00:00
if(ptr1 != NULL)
{
int gsz = ptr1 - buffcpy;
strncpy(goodStr, buffcpy, gsz);
if(strlen(ptr1 + 3) > 0) strcpy(banner, ptr1 + 3);
2015-02-26 14:20:37 +00:00
char portString[16] = {0};
sprintf(portString, "%d", port);
sprintf(log, "[SSH] <font color=\"#00a8ff\"> %s:%d </font><font color=\"#323232\">; Banner:</font> <font color=\"#9cff00\"> %s </font>", goodStr, port, banner);
2015-02-27 13:55:35 +00:00
sprintf(logEmit, "[SSH] <span style=\"color: #00a8ff;\"> %s:%d </span>", goodStr, port);
2015-02-26 14:20:37 +00:00
2014-09-19 19:27:28 +00:00
++PieSSH;
2015-02-27 13:55:35 +00:00
fputsf (log, -22, "SSH");
2014-09-19 19:27:28 +00:00
char loginSSH[128] = {0};
char passSSH[128] = {0};
2015-03-07 17:31:48 +00:00
const char *ptrl1 = strstr(buffcpy, ":");
2014-09-19 19:27:28 +00:00
int lpsz = ptrl1 - buffcpy;
strncpy(loginSSH, buffcpy, lpsz);
2015-03-07 17:31:48 +00:00
const char *ptrl2 = strstr(buffcpy, "@");
2014-09-19 19:27:28 +00:00
lpsz = ptrl2 - ptrl1;
strncpy(passSSH, ptrl1 + 1, lpsz);
2015-02-27 13:55:35 +00:00
fillGlobalLogData(ip, "", portString, std::to_string(recd).c_str(), "[SSH service]", loginSSH, passSSH, "NULL", "UTF-8", "SSH");
2014-09-19 19:27:28 +00:00
stt->doEmitionFoundData(QString::fromLocal8Bit(logEmit));
}
else
{
stt->doEmitionRedFoundData("[_saveSSH] Wrong format! [" + QString(ip) + ":" + QString::number(port) + "]");
};
}
else
{
stt->doEmitionRedFoundData("[_saveSSH] Empty buffer! [" + QString(ip) + ":" + QString::number(port) + "]");
};
2015-02-27 13:55:35 +00:00
}
2015-03-07 17:31:48 +00:00
int Lexems::_filler(int p, const char* buffcpy, char* ip, int recd, Lexems *lx, char *hl)
2014-09-19 19:27:28 +00:00
{
2015-02-08 19:00:53 +00:00
if( strstr(buffcpy, "SSH-2.0-OpenSSH") != NULL || strstr(buffcpy, "SSH-2.0-mod_sftp") != NULL)
2015-03-05 14:29:05 +00:00
{
2015-03-02 14:27:38 +00:00
std::string sshBuff;
2015-03-05 14:29:05 +00:00
int res = Connector::_SSHLobby(ip, p, &sshBuff);
2014-09-19 19:27:28 +00:00
if(res != -1 && res != -2)
{
2015-03-02 14:27:38 +00:00
_saveSSH(ip, p, recd, (char*)sshBuff.c_str());
2014-09-19 19:27:28 +00:00
};
return -1;
};
if(p == 22)
{
_saveSSH(ip, p, recd, buffcpy);
2014-09-07 18:54:46 +00:00
return -1;
};
PathStr ps;
ps.port = p;
strcpy(ps.ip, ip);
ZeroMemory(ps.headr, sizeof(ps.headr));
ZeroMemory(ps.path, sizeof(ps.path));
2014-09-19 19:27:28 +00:00
char finalstr[TITLE_MAX_SIZE] = {0};
2014-09-07 18:54:46 +00:00
char port[32] = {0};
int flag = 0;
char cp[32] = {0};
2015-03-02 14:27:38 +00:00
strcpy(cp, GetCodePage(buffcpy));
2014-09-07 18:54:46 +00:00
flag = ContentFilter(buffcpy, p, ip, cp);
if(flag == -1 ) return -1;
strcpy(ps.headr, GetTitle(buffcpy));
ps.flag = flag;
2015-03-16 14:29:34 +00:00
char baPath[256] = {0};
strcpy(baPath, "/");
2014-09-07 18:54:46 +00:00
2015-03-16 14:29:34 +00:00
std::vector<std::string> redirStrLst;
2014-09-07 18:54:46 +00:00
if(flag == 0 || flag == 3 || flag == 7 )
{
2015-03-16 14:29:34 +00:00
int rh = _header(ip, p, buffcpy, lx, &ps, &redirStrLst);
2014-09-07 18:54:46 +00:00
strcpy(cp, ps.codepage);
2015-02-22 12:31:51 +00:00
if (rh == -1) return -1;
2014-09-07 18:54:46 +00:00
if(rh <= -2)
{
flag = ps.flag;
strcat(finalstr, ps.headr);
p = ps.port;
strcpy(ip, ps.ip);
};
int sz = strlen(ps.path);
2015-03-16 14:29:34 +00:00
strncpy(baPath, ps.path, (sz < 256 ? sz : 256));
2014-09-19 19:27:28 +00:00
}
else
{
if(strstr(buffcpy, "Set-Cookie:") != NULL) strncpy(ps.cookie, _getAttribute(buffcpy, "Set-Cookie:"), COOKIE_MAX_SIZE);
2014-09-07 18:54:46 +00:00
};
2015-02-26 14:20:37 +00:00
sprintf(port, "%d", p);
2014-09-07 18:54:46 +00:00
if(strstr(finalstr, ps.headr) == NULL) strcat(finalstr, ps.headr);
2015-03-07 17:31:48 +00:00
if(flag == -1 || flag == 6) return -1;
2014-09-07 18:54:46 +00:00
if(flag == 16)
2015-03-05 14:29:05 +00:00
{
2014-09-07 18:54:46 +00:00
char log[2048] = {0};
char logEmit[2048] = {0};
2015-03-16 14:29:34 +00:00
const lopaStr &lps = FTPA::_FTPLobby(ip, p, &ps);
2014-09-07 18:54:46 +00:00
if(strstr(lps.other, "ROUTER") != NULL)
{
++PieBA;
2015-02-27 13:55:35 +00:00
sprintf(log, "[FTP]:<font color=\"#0f62e2\">%s:%s</font>; Received: %d<a href=\"ftp://%s:%s@%s/\"><span style=\"color: #ff6600;\">ftp://%s:%s@%s</span></a> <font color=\"#43EC00\"><a href=\"http://%s\" style=\"color:#43EC00;\">[ROUTER]</a></font>%s",
ip, port, recd, lps.login, lps.pass, ip, lps.login, lps.pass, ip, ip, ps.headr);
sprintf(logEmit, "[FTP]:<a href=\"ftp://%s:%s@%s/\"><span style=\"color: #ff6600;\">ftp://%s:%s@%s</span></a> <font color=\"#43EC00\"><a href=\"http://%s/\" style=\"color:#43EC00;\">[ROUTER]</a></font>",
lps.login, lps.pass, ip, lps.login, lps.pass, ip, ip);
fputsf (log, flag, "FTP");
2014-09-07 18:54:46 +00:00
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, port, std::to_string(recd).c_str(), "[FTP service]", lps.login, lps.pass, "Router FTP detected.", cp, "FTP");
2015-03-16 14:29:34 +00:00
2014-09-07 18:54:46 +00:00
stt->doEmitionFoundData(QString::fromLocal8Bit(logEmit));
}
else if(strstr(lps.login, "UNKNOWN") == NULL && strlen(lps.other) == 0)
{
++PieBA;
2015-02-27 13:55:35 +00:00
sprintf(log, "[FTP]:<font color=\"#0f62e2\">%s:%s</font>; Received: %d<a href=\"ftp://%s:%s@%s/\"><span style=\"color: #ff6600;\">ftp://%s:%s@%s</span></a>%s",
ip, port, recd, lps.login, lps.pass, ip, lps.login, lps.pass, ip, ps.headr);
sprintf(logEmit, "[FTP]:<a href=\"ftp://%s:%s@%s/\"><span style=\"color: #ff6600;\">ftp://%s:%s@%s</span></a> (F:%d)",
lps.login, lps.pass, ip, lps.login, lps.pass, ip, ps.directoryCount);
fputsf(log, flag, "FTP");
2014-09-07 18:54:46 +00:00
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, port, std::to_string(recd).c_str(), "[FTP service]", lps.login, lps.pass, "NULL", cp, "FTP");
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
stt->doEmitionFoundData(QString::fromLocal8Bit(logEmit));
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
}
else if(strstr(lps.login, "Unknown protocol") != NULL)
{
strcat(log, "; [!] USER/PASS commands failed. Dunno what to do.");
2015-02-27 13:55:35 +00:00
fputsf(log, flag, "");
2014-09-07 18:54:46 +00:00
stt->doEmitionFoundData(QString::fromLocal8Bit(log));
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
};
}
else if(flag == 21) //Eyeon
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "Eyeon Camera", flag, "/user/index.htm", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 22) //IP Camera control
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "IP camera Control webpage", flag, "/main/cs_motion.asp", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 23) //Network Camera BB-SC384
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "Network Camera BB-SC384", flag, "/live/index2.html", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 24) //Network Camera VB-M40
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "Network Camera VB-M40", flag, "/-wvhttp-01-/open.cgi?", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 25) //Panasonic WTFISTHISAreaOMGIDONTEVEN-camera
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, 60002, hl, "Panasonic WTFISTHISAreaOMGIDONTEVEN-camera", flag, "/SnapshotJPEG", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 26) //Sony Network Camera
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "Sony Network Camera", flag, "/oneshotimage?", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 27) //UA Network Camera
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "UA Network Camera", flag, "/webs.cgi?", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 28) //Network Camera VB-M40
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "Network Camera VB-??", flag, "/-wvhttp-01-/open.cgi?", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 29) //LG Smart IP Device
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "LG Smart IP Device Camera", flag, "/digest.php", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 30) //NAS
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "NAS", flag, "/cgi-bin/data/viostor-220/viostor/viostor.cgi", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 31) //ip cam
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "IP Camera", flag, "/check_user.cgi", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 32) //IPC WEB ip cam
{
2015-02-27 13:55:35 +00:00
_specWEBIPCAMBrute(ip, p, hl, "[IPC] WEB IP Camera", flag, "WEB Authorization", cp, recd, "IPC");
2014-09-07 18:54:46 +00:00
}
else if(flag == 33) //GEOvision ip cam
{
2015-02-27 13:55:35 +00:00
_specWEBIPCAMBrute(ip, p, hl, "[GEO] WEB IP Camera", flag, "WEB Authorization", cp, recd, "GEO");
2014-09-07 18:54:46 +00:00
}
else if(flag == 34) //Hikvision ip cam
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "[Hikvision] IP Camera", flag, "/PSIA/Custom/SelfExt/userCheck", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 35) //EasyCam
{
2015-02-27 13:55:35 +00:00
_specWEBIPCAMBrute(ip, p, hl, "[EasyCam] WEB IP Camera", flag, "WEB Authorization", cp, recd, "EasyCam");
2014-09-07 18:54:46 +00:00
}
else if(flag == 36) //Panasonic Cam
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "[Panasonic] IP Camera", flag, "/config/index.cgi", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 37) //Panasonic Cam
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "[Panasonic] IP Camera", flag, "/view/getuid.cgi", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 38) //Foscam
{
2015-02-27 13:55:35 +00:00
_specWEBIPCAMBrute(ip, p, hl, "[Foscam] IP Camera", flag, "Web Authorization", cp, recd, "Foscam");
2014-09-07 18:54:46 +00:00
}
else if(flag == 39) //EagleEye
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "[EagleEye] IP Camera", flag, "/cgi-bin/guest/Video.cgi?", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 40) //Network Camera VB-C??
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "[Network Camera VB-C??] IP Camera", flag, "/admin/index.shtml?", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 41) //AVIOSYS-camera
{
2015-02-27 13:55:35 +00:00
_specWEBIPCAMBrute(ip, p, hl, "[AVIOSYS] IP Camera", flag, "Web Authorization", cp, recd, "AVIOSYS");
2014-09-07 18:54:46 +00:00
}
2014-09-08 17:38:19 +00:00
else if(flag == 42) //NW_camera
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "[NW_camera] IP Camera", flag, "/cgi-bin/getuid?FILE=indexnw.html", "Basic Authorization", cp, recd);
2014-09-08 17:38:19 +00:00
}
else if(flag == 43) //NW_camera
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "[Micros] IP Camera", flag, "/gui/rem_display.shtml", "Basic Authorization", cp, recd);
2014-09-08 17:38:19 +00:00
}
2014-09-19 19:27:28 +00:00
else if(flag == 44) //Hikvision ip cam 2
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "[Hikvision] IP Camera 2", flag, "/ISAPI/Security/userCheck", "Basic Authorization", cp, recd);
2014-09-19 19:27:28 +00:00
}
else if(flag == 45) //Panasonic ip cam
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "[Panasonic] IP Camera", flag, "/config/index.cgi", "Basic Authorization", cp, recd);
}
2014-11-02 09:53:50 +00:00
else if(flag == 46) //Buffalo disk
{
2015-02-27 13:55:35 +00:00
_specWEBIPCAMBrute(ip, p, hl, "[Buffalo] Lan Disk", flag, "Web Authorization", cp, recd, "BUFFALO");
}
else if(flag == 47) //Digital Video Server
{
2015-02-27 13:55:35 +00:00
_specWEBIPCAMBrute(ip, p, hl, "[DVS] Camera", flag, "Web Authorization", cp, recd, "DVS");
}
else if(flag == 48) //ipCAM
{
2015-02-27 13:55:35 +00:00
_specWEBIPCAMBrute(ip, p, hl, "[ipCAM] Camera", flag, "Web Authorization", cp, recd, "IPCAM");
2015-03-01 13:09:55 +00:00
}
else if (flag == 49) //IEORFOREFOX
{
_specWEBIPCAMBrute(ip, p, hl, "[IEORFOREFOX] Camera", flag, "Web Authorization", cp, recd, "IEORFOREFOX");
}
else if (flag == 50) //IP Camera
2015-01-05 22:11:43 +00:00
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "IP Camera", flag, "/app/multi/single.asp", "Basic Authorization", cp, recd);
2014-11-02 09:53:50 +00:00
}
2014-09-07 18:54:46 +00:00
else if(flag == 20) //AXIS Camera
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "AXIS Camera", flag, "/axis-cgi/com/ptz.cgi?", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 19) //reecam cameras
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "Reecam (network camera)", flag, "/videostream.cgi", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 18) //linksys camera
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "Linksys camera", flag, "/img/main.cgi", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 17) //Real-time IP Camera Monitoring System
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "Real-time IP Camera Monitoring System", flag, "/live.htm", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 11)
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "Netwave IP Camera", flag, "/videostream.cgi", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 12)
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "IP Camera", flag, "/view/view.shtml?videos=", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 13)
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "IP Camera", flag, "/eng/view/indexjava.html", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 14)
{
2015-03-06 14:32:36 +00:00
_specBrute(ps.cookie, ip, p, hl, "IP Camera", flag, "/rdr.cgi", "Basic Authorization", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 15) //For HFS
2015-03-16 14:29:34 +00:00
{
2015-03-05 14:29:05 +00:00
char log[512] = {0};
2014-09-07 18:54:46 +00:00
++AnomC1;
2015-02-27 13:55:35 +00:00
2015-03-16 14:29:34 +00:00
const lopaStr &lps = BA::_BALobby((string(ip) + "/~login").c_str(), p);
2015-02-27 13:55:35 +00:00
sprintf(log, "[HFS]:<font color=\"#ff6600\">%s :: </font><a href=\"http://%s:%s/\"><span style=\"color: #a1a1a1;\">%s:%s</span></a><font color=\"#0084ff\"> T: </font><font color=\"#ff9600\">%s Pass: %s:%s</font>",
hl, ip, port, ip, port, finalstr, lps.login, lps.pass);
2015-03-16 14:29:34 +00:00
2015-02-08 19:00:53 +00:00
fillGlobalLogData(ip, hl, port, std::to_string(recd).c_str(), finalstr, lps.login, lps.pass, "HFS-FTP", cp, "Basic Authorization");
2015-02-27 13:55:35 +00:00
fputsf (log , flag, "HFS");
2015-03-16 14:29:34 +00:00
stt->doEmitionFoundData(QString::fromLocal8Bit(log));
2014-09-07 18:54:46 +00:00
}
else if(flag == 1)
{
2015-03-16 14:29:34 +00:00
_specBrute(ps.cookie, ip, p, hl, finalstr, flag, baPath, "[NORMAL]", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 101)
{
2015-03-16 14:29:34 +00:00
_specBrute(ps.cookie, ip, p, hl, finalstr, flag, baPath, "[DIGEST]", cp, recd);
2014-09-07 18:54:46 +00:00
}
else if(flag == 10)
{
2015-03-16 14:29:34 +00:00
_specWFBrute(ip, p, hl, buffcpy, flag, baPath, "Web Form", "Web Form", cp, recd, finalstr);
2014-09-07 18:54:46 +00:00
}
else
{
putInFile(flag, ip, port, recd, finalstr, hl, cp);
};
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
return flag;
2015-02-27 13:55:35 +00:00
}
2014-09-07 18:54:46 +00:00
2015-03-16 14:29:34 +00:00
int redirectReconnect(char *cookie, char *ip, int port, char *str, Lexems *ls, PathStr *ps, std::vector<std::string> *redirStrLst)
2014-09-07 18:54:46 +00:00
{
if(ls->iterationCount++ == 5)
{
ls->iterationCount = 0;
strcpy(ps->headr, "[!][Loop detected.]");
strcpy(ps->path, "");
return 0;
};
char tempIP[MAX_ADDR_LEN] = {0};
strcpy(tempIP, ip);
2014-11-02 11:19:22 +00:00
int tempPort = port;
2015-03-06 14:32:36 +00:00
char tempPath[1024] = {0};
2014-09-07 18:54:46 +00:00
if(strstri(str, "https://") != NULL)
{
tempPort = 443;
char *ptr1 = strstri(str, "https://");
char *ptr2 = _findFirst(str + 8, ":/?");
2014-09-07 18:54:46 +00:00
if(ptr2 != NULL)
{
int sz = ptr2 - ptr1 - 8;
2014-10-19 10:39:27 +00:00
ZeroMemory(tempIP, MAX_ADDR_LEN);
2014-09-07 18:54:46 +00:00
strncpy(tempIP, ptr1 + 8, sz < 128 ? sz : 128);
if(ptr2[0] == ':')
{
char *ptrPath = strstr(ptr2, "/");
if(ptrPath != NULL)
{
sz = ptrPath - ptr2 - 1;
char *pPth = strstr(ptr1 + 8, "/");
strcpy(tempPath, pPth);
}
else
{
strcpy(tempPath, "/");
sz = ptr2 - ptr1 - 9;
};
char tPort[8] = {0};
strncpy(tPort, ptr2 + 1, sz < 8 ? sz : 5);
tempPort = atoi(tPort);
}
else if(ptr2[0] == '/')
{
strncpy(tempPath, ptr2, strlen(ptr2));
}
2014-10-19 10:39:27 +00:00
else if(ptr2[0] == '?')
{
strcpy(tempPath, "/");
strncat(tempPath, ptr2, strlen(ptr2));
}
2014-09-07 18:54:46 +00:00
else
{
stt->doEmitionRedFoundData("[Redirect] Unknown protocol (" + QString(ip) + ":" + QString::number(port) + ")");
};
}
else
{
2014-10-19 10:39:27 +00:00
ZeroMemory(tempIP, MAX_ADDR_LEN);
2014-09-07 18:54:46 +00:00
strncpy(tempIP, ptr1 + 8, strlen(str) - 8);
strcpy(tempPath, "/");
};
2015-03-06 14:32:36 +00:00
std::unique_ptr<char[]> nip(new char[strlen(tempIP) + strlen(tempPath) + 1]);
sprintf(nip.get(), "%s%s", tempIP, tempPath);
2015-03-05 14:29:05 +00:00
std::string buffer;
2015-03-06 14:32:36 +00:00
int cSz = Connector::nConnect(nip.get(), tempPort, &buffer);
2015-03-16 14:29:34 +00:00
2015-03-05 14:29:05 +00:00
if(cSz > -1)
2015-03-16 14:29:34 +00:00
{
strcpy(ps->codepage, GetCodePage(buffer.c_str()));
2014-09-07 18:54:46 +00:00
2015-03-16 14:29:34 +00:00
ls->flag = ContentFilter(buffer.c_str(), tempPort, tempIP, ps->codepage);
2014-09-07 18:54:46 +00:00
ps->flag = ls->flag;
if(ls->flag == -1)
{
ps->flag = -1;
2015-03-05 14:29:05 +00:00
strcpy(ps->path, tempPath);
2014-09-07 18:54:46 +00:00
2015-02-28 11:47:21 +00:00
return -1;
2014-09-07 18:54:46 +00:00
};
2015-03-16 14:29:34 +00:00
2014-09-07 18:54:46 +00:00
if(ls->flag >= 17 || ls->flag == 11 || ls->flag == 12
|| ls->flag == 13 || ls->flag == 14 || ls->flag == 1 || ls->flag == 10)
{
2015-03-16 14:29:34 +00:00
strcat(ps->headr, GetTitle(buffer.c_str()));
2014-09-07 18:54:46 +00:00
ps->flag = ls->flag;
strcpy(ps->path, tempPath);
ps->port = tempPort;
strcpy(ps->ip, tempIP);
2015-02-28 11:47:21 +00:00
return -2;
2014-09-07 18:54:46 +00:00
};
2015-03-16 14:29:34 +00:00
2014-09-07 18:54:46 +00:00
if(ls->flag == 6)
{
ps->flag = ls->flag;
ps->port = tempPort;
2015-02-28 11:47:21 +00:00
return -2;
2014-09-07 18:54:46 +00:00
};
2015-03-05 14:29:05 +00:00
2014-09-07 18:54:46 +00:00
strcat(ps->headr, " -> ");
2015-03-16 14:29:34 +00:00
strcat(ps->headr, GetTitle(buffer.c_str()));
if (ls->_header(tempIP, tempPort, buffer.c_str(), ls, ps, redirStrLst) == -1)
2015-02-28 11:47:21 +00:00
{
ps->flag = -1;
2015-03-05 14:29:05 +00:00
strcpy(ps->path, tempPath);
2015-02-28 11:47:21 +00:00
return -1;
};
2015-03-16 14:29:34 +00:00
ps->port = tempPort;
2014-09-07 18:54:46 +00:00
}
else
{
ps->flag = -1;
ls->flag = -1;
if(gNegDebugMode) stt->doEmitionDebugFoundData("[<a href=\"http://" + QString(ip) + ":" + QString::number(port) + "/\"><font color=\"#0084ff\">" + QString(ip) + ":" + QString::number(port) + "</font></a>" + "] Rejecting in _header::redirect [Dead host].");
};
2015-02-28 11:47:21 +00:00
return -2;
2014-09-07 18:54:46 +00:00
}
else if(strstr(str, "http://") != NULL) //http
{
2015-02-28 11:47:21 +00:00
tempPort = 80;
2014-09-07 18:54:46 +00:00
char *ptr1 = strstri(str, "http://");
char *ptr2 = _findFirst(str + 7, ":/?");
2015-03-16 14:29:34 +00:00
2014-09-07 18:54:46 +00:00
if(ptr2 != NULL)
{
int sz = ptr2 - ptr1 - 7;
2014-10-19 10:39:27 +00:00
ZeroMemory(tempIP, MAX_ADDR_LEN);
2014-09-07 18:54:46 +00:00
strncpy(tempIP, ptr1 + 7, sz < 128 ? sz : 128);
2015-03-16 14:29:34 +00:00
2014-09-07 18:54:46 +00:00
if(ptr2[0] == ':')
{
char *ptrPath = strstr(ptr2, "/");
2015-03-16 14:29:34 +00:00
2014-09-07 18:54:46 +00:00
if(ptrPath != NULL)
{
sz = ptrPath - ptr2 - 1;
char *pPth = strstr(ptr1 + 7, "/");
strcpy(tempPath, pPth);
}
else
{
strcpy(tempPath, "/");
sz = ptr2 - ptr1 - 7;
};
2015-03-06 14:32:36 +00:00
2014-09-07 18:54:46 +00:00
char tPort[8] = {0};
strncpy(tPort, ptr2 + 1, sz < 8 ? sz : 5);
tempPort = atoi(tPort);
}
else if(ptr2[0] == '/')
{
strncpy(tempPath, ptr2, strlen(ptr2));
}
2014-10-19 10:39:27 +00:00
else if(ptr2[0] == '?')
{
strcpy(tempPath, "/");
strncat(tempPath, ptr2, strlen(ptr2));
}
2014-09-07 18:54:46 +00:00
else
{
stt->doEmitionRedFoundData("[Redirect] Unknown protocol (" + QString(ip) + ":" + QString::number(port) + ")");
};
}
else
{
2014-10-19 10:39:27 +00:00
ZeroMemory(tempIP, MAX_ADDR_LEN);
2014-09-07 18:54:46 +00:00
strncpy(tempIP, ptr1 + 7, strlen(str) - 7);
strcpy(tempPath, "/");
};
2015-03-06 14:32:36 +00:00
std::unique_ptr<char[]> nip(new char[strlen(tempIP) + strlen(tempPath) + 1]);
sprintf(nip.get(), "%s%s", tempIP, tempPath);
2015-03-05 14:29:05 +00:00
std::string buffer;
2015-03-06 14:32:36 +00:00
int cSz = Connector::nConnect(nip.get(), tempPort, &buffer);
2015-03-16 14:29:34 +00:00
2015-03-05 14:29:05 +00:00
if(cSz > -1)
2015-03-16 14:29:34 +00:00
{
strcpy(ps->codepage, GetCodePage(buffer.c_str()));
2014-09-07 18:54:46 +00:00
2015-03-16 14:29:34 +00:00
ls->flag = ContentFilter(buffer.c_str(), tempPort, tempIP, ps->codepage);
2014-09-07 18:54:46 +00:00
ps->flag = ls->flag;
if(ls->flag == -1)
{
ps->flag = -1;
2015-03-05 14:29:05 +00:00
strcpy(ps->path, tempPath);
2014-09-07 18:54:46 +00:00
return -1;
};
2015-03-16 14:29:34 +00:00
2014-09-07 18:54:46 +00:00
if(ls->flag >= 17 || ls->flag == 11 || ls->flag == 12
|| ls->flag == 13 || ls->flag == 14 || ls->flag == 1 || ls->flag == 10)
{
2015-03-16 14:29:34 +00:00
strcat(ps->headr, GetTitle(buffer.c_str()));
2014-09-07 18:54:46 +00:00
ps->flag = ls->flag;
2015-03-05 14:29:05 +00:00
strcpy(ps->path, tempPath);
2014-09-07 18:54:46 +00:00
ps->port = tempPort;
strcpy(ps->ip, tempIP);
2015-02-28 11:47:21 +00:00
return -2;
2014-09-07 18:54:46 +00:00
};
2015-03-16 14:29:34 +00:00
2014-09-07 18:54:46 +00:00
if(ls->flag == 6)
{
ps->flag = ls->flag;
ps->port = tempPort;
2015-02-28 11:47:21 +00:00
return -2;
2014-09-07 18:54:46 +00:00
};
2015-03-06 14:32:36 +00:00
2014-09-07 18:54:46 +00:00
strcat(ps->headr, " -> ");
2015-03-16 14:29:34 +00:00
strcat(ps->headr, GetTitle(buffer.c_str()));
2015-03-06 14:32:36 +00:00
2015-03-16 14:29:34 +00:00
if (ls->_header(tempIP, tempPort, buffer.c_str(), ls, ps, redirStrLst) == -1)
2015-02-28 11:47:21 +00:00
{
ps->flag = -1;
2015-03-05 14:29:05 +00:00
strcpy(ps->path, tempPath);
2015-02-28 11:47:21 +00:00
return -1;
};
2014-09-07 18:54:46 +00:00
ps->port = tempPort;
}
else
{
ps->flag = -1;
ls->flag = -1;
if(gNegDebugMode) stt->doEmitionDebugFoundData("[<a href=\"http://" + QString(ip) + ":" + QString::number(port) + "/\"><font color=\"#0084ff\">" + QString(ip) + ":" + QString::number(port) + "</font></a>" + "] Rejecting in _header::redirect [Dead host].");
};
2015-03-06 14:32:36 +00:00
2015-02-28 11:47:21 +00:00
return -2;
2014-09-07 18:54:46 +00:00
}
else if(str[0] == '/' || (str[0] == '.' && str[1] == '/') || (str[0] == '.' && str[1] == '.' && str[2] == '/'))
{
if(str[0] == '.' && str[1] == '.') strcpy(tempPath, str + 2);
else if(str[0] == '.') strcpy(tempPath, str + 1);
else strcpy(tempPath, str);
2014-09-07 18:54:46 +00:00
2015-03-06 14:32:36 +00:00
std::unique_ptr<char[]> nip(new char[strlen(tempIP) + strlen(tempPath) + 1]);
sprintf(nip.get(), "%s%s", tempIP, tempPath);
std::string buffer;
int cSz = Connector::nConnect(nip.get(), tempPort, &buffer);
2015-03-16 14:29:34 +00:00
2015-03-06 14:32:36 +00:00
if(cSz > -1)
2015-03-16 14:29:34 +00:00
{
strcpy(ps->codepage, GetCodePage(buffer.c_str()));
2014-09-07 18:54:46 +00:00
2015-03-16 14:29:34 +00:00
ls->flag = ContentFilter(buffer.c_str(), port, ip, ps->codepage);
2014-09-07 18:54:46 +00:00
ps->flag = ls->flag;
if(ls->flag == -1)
{
ps->flag = -1;
2015-03-06 14:32:36 +00:00
strcpy(ps->path, tempPath);
2014-09-07 18:54:46 +00:00
return -2;
};
2015-03-06 14:32:36 +00:00
2014-09-07 18:54:46 +00:00
if(ls->flag >= 17 || ls->flag == 11 || ls->flag == 12
|| ls->flag == 13 || ls->flag == 14 || ls->flag == 1 || ls->flag == 10)
{
2015-03-16 14:29:34 +00:00
strcat(ps->headr, GetTitle(buffer.c_str()));
2014-09-07 18:54:46 +00:00
ps->flag = ls->flag;
2015-03-06 14:32:36 +00:00
strcpy(ps->path, tempPath);
2014-09-07 18:54:46 +00:00
ps->port = port;
strcpy(ps->ip, ip);
2015-02-28 11:47:21 +00:00
return -2;
2014-09-07 18:54:46 +00:00
};
if(ls->flag == 6)
{
ps->flag = ls->flag;
ps->port = tempPort;
2015-02-28 11:47:21 +00:00
return -2;
2014-09-07 18:54:46 +00:00
};
2015-03-06 14:32:36 +00:00
2014-09-07 18:54:46 +00:00
strcat(ps->headr, "->");
2015-03-16 14:29:34 +00:00
strcat(ps->headr, GetTitle(buffer.c_str()));
2015-03-06 14:32:36 +00:00
2015-03-16 14:29:34 +00:00
if (ls->_header(tempIP, tempPort, buffer.c_str(), ls, ps, redirStrLst) == -1)
2015-02-28 11:47:21 +00:00
{
ps->flag = -1;
2015-03-06 14:32:36 +00:00
strcpy(ps->path, tempPath);
2015-02-28 11:47:21 +00:00
return -1;
};
2014-09-07 18:54:46 +00:00
ps->port = tempPort;
}
else
{
ps->flag = -1;
ls->flag = -1;
if(gNegDebugMode) stt->doEmitionDebugFoundData("[<a href=\"http://" + QString(ip) + ":" + QString::number(port) + "/\"><font color=\"#0084ff\">" + QString(ip) + ":" + QString::number(port) + "</font></a>" + "] Rejecting in _header::redirect [Dead host].");
};
2015-02-28 11:47:21 +00:00
return -2;
2014-09-07 18:54:46 +00:00
}
else if(strlen(str) > 2)
2015-03-06 14:32:36 +00:00
{
std::unique_ptr<char[]> nip(new char[strlen(ip) + strlen(str) + 1]);
sprintf(nip.get(), "%s%s", ip, str);
std::string buffer;
int cSz = Connector::nConnect(nip.get(), port, &buffer);
2015-03-16 14:29:34 +00:00
2015-03-06 14:32:36 +00:00
if(cSz > -1)
2015-03-16 14:29:34 +00:00
{
strcpy(ps->codepage, GetCodePage(buffer.c_str()));
2014-09-07 18:54:46 +00:00
2015-03-16 14:29:34 +00:00
ls->flag = ContentFilter(buffer.c_str(), port, ip, ps->codepage);
2014-09-07 18:54:46 +00:00
ps->flag = ls->flag;
2015-03-16 14:29:34 +00:00
2014-09-07 18:54:46 +00:00
if(ls->flag == -1)
{
ps->flag = -1;
2015-03-06 14:32:36 +00:00
strcpy(ps->path, tempPath);
2014-09-07 18:54:46 +00:00
return -1;
};
2015-02-28 11:47:21 +00:00
2014-09-07 18:54:46 +00:00
if(ls->flag >= 17 || ls->flag == 11 || ls->flag == 12
|| ls->flag == 13 || ls->flag == 14 || ls->flag == 1 || ls->flag == 10)
{
2015-03-16 14:29:34 +00:00
strcat(ps->headr, GetTitle(buffer.c_str()));
2014-09-07 18:54:46 +00:00
ps->flag = ls->flag;
2015-03-06 14:32:36 +00:00
strcpy(ps->path, tempPath);
2014-09-07 18:54:46 +00:00
ps->port = port;
strcpy(ps->ip, ip);
2015-02-28 11:47:21 +00:00
return -2;
2014-09-07 18:54:46 +00:00
};
2015-02-28 11:47:21 +00:00
2015-03-06 14:32:36 +00:00
if(ls->flag == 6)
{
ps->flag = ls->flag;
ps->port = tempPort;
return -2;
};
2014-09-07 18:54:46 +00:00
strcat(ps->headr, " -> ");
2015-03-16 14:29:34 +00:00
strcat(ps->headr, GetTitle(buffer.c_str()));
ls->_header(ip, port, buffer.c_str(), ls, ps, redirStrLst);
2014-09-07 18:54:46 +00:00
ps->port = tempPort;
}
else
{
ps->flag = -1;
ls->flag = -1;
if(gNegDebugMode) stt->doEmitionDebugFoundData("[<a href=\"http://" + QString(ip) + ":" + QString::number(port) + "/\"><font color=\"#0084ff\">" + QString(ip) + ":" + QString::number(port) + "</font></a>" + "] Rejecting in _header::redirect [Dead host].");
};
2015-02-28 11:47:21 +00:00
return -2;
2014-09-07 18:54:46 +00:00
};
return -1;
2015-02-27 13:55:35 +00:00
}
2014-09-07 18:54:46 +00:00
void _getPopupTitle(PathStr *ps, char *str)
{
strcat(ps->headr, "[Popup detected. Title: ");
char *ptr1 = strstr(str, ",");
if(ptr1 != NULL)
{
char *ptr2 = strstr(ptr1 + 1, ",");
if(ptr2 != NULL)
{
int sz = ptr2 - ptr1 - 1;
if(sz >= 32) sz = 32;
strncat(ps->headr, ptr1 + 1, sz < 32 ? sz : 32);
}
else
{
2015-01-05 22:11:43 +00:00
strcat(ps->headr, "[BOUNDARY ERROR]");
2014-09-07 18:54:46 +00:00
};
}
else
{
2015-01-05 22:11:43 +00:00
char temp[32] = {0};
if(strstr(str, "(") != NULL){
strncpy(temp, strstr(str, "("), 32);
strcat(ps->headr, temp);
} else {
strcat(ps->headr, "[No title]");
};
2014-09-07 18:54:46 +00:00
};
strcat(ps->headr, "]");
2015-02-27 13:55:35 +00:00
}
2014-09-07 18:54:46 +00:00
void _getLinkFromJSLocation(char *dataBuff, char *str, char *tag, char *ip, int port)
{
char *ptr1 = strstr(str, tag);
if(ptr1 != NULL)
{
char *ptr2 = _findFirst(ptr1, "=(");
char *ptrSemi = _findFirst(ptr1 + strlen(tag), ".;");
2014-11-03 18:50:42 +00:00
if(ptrSemi == NULL)
{
ptrSemi = _findLast(ptr1 + strlen(tag) + 1, "'\"");
}
2014-09-07 18:54:46 +00:00
if(ptr2 != NULL && ptrSemi != NULL)
{
int sz = ptrSemi - ptr2;
2015-02-21 09:51:23 +00:00
if(sz >= 2)
2014-09-07 18:54:46 +00:00
{
char *ptrQuote1 = _findFirst(ptr2, "\"'");
2014-09-07 18:54:46 +00:00
if(ptrQuote1 != NULL)
{
2014-11-07 17:22:39 +00:00
char *ptrQuoteTemp = _findFirst(ptrQuote1 + 1, ";\n}");
if(ptrQuoteTemp != NULL)
{
sz = ptrQuoteTemp - ptrQuote1 + 1;
2014-11-16 13:31:34 +00:00
}
else
{
ptrQuoteTemp = _findFirst(ptrQuote1 + 1, "\"'");
sz = ptrQuoteTemp - ptrQuote1 + 1;
}
2014-11-07 17:22:39 +00:00
char *tempBuff = new char[sz + 1];
2015-03-16 14:29:34 +00:00
ZeroMemory(tempBuff, sizeof(*tempBuff));
2014-11-07 17:22:39 +00:00
strncpy(tempBuff, ptrQuote1 + 1, sz);
memset(tempBuff + sz, 0, 1);
2014-09-07 18:54:46 +00:00
char delim[2] = {0};
ZeroMemory(delim, 1);
delim[0] = ptrQuote1[0];
delim[1] = '\0';
2015-02-21 09:51:23 +00:00
2014-11-07 17:22:39 +00:00
char *ptrQuote2 = _findLast(tempBuff + 1, delim);
2014-09-07 18:54:46 +00:00
if(ptrQuote2 != NULL)
{
2015-02-27 13:55:35 +00:00
sz = ptrQuote2 - tempBuff;
2014-11-07 17:22:39 +00:00
if(sz < 511)
2014-09-07 18:54:46 +00:00
{
2015-02-21 09:51:23 +00:00
if (tempBuff[0] == '.' && tempBuff[1] == '/')
{
strncat(dataBuff, tempBuff + 1, sz - 1);
}
else if(tempBuff[0] != '/'
2014-11-07 17:22:39 +00:00
&& strstri(tempBuff, "http://") == NULL
&& strstri(tempBuff, "https://") == NULL
2014-09-07 18:54:46 +00:00
)
{
strcpy(dataBuff, "/");
2015-03-01 12:01:24 +00:00
strncat(dataBuff, tempBuff, sz);
2014-09-07 18:54:46 +00:00
}
2014-11-07 17:22:39 +00:00
else strncpy(dataBuff, tempBuff, sz);
2014-09-07 18:54:46 +00:00
};
};
2014-11-07 17:22:39 +00:00
delete tempBuff;
2014-09-19 19:27:28 +00:00
}
else
{
ptrQuote1 = strstr(ptr2, "=");
if(ptrQuote1 != NULL)
{
char *ptrQuote2 = _findFirst(ptr2, ";\n");
2014-09-19 19:27:28 +00:00
if(ptrQuote2 != NULL)
{
int sz = ptrQuote2 - ptr2 - 1;
char link1[512] = {0};
strncpy(link1, ptr2 + 1, sz);
char *ptrQuote3 = strstr(link1, "/");
if(ptrQuote3 != NULL)
2015-02-27 13:55:35 +00:00
{
2014-09-19 19:27:28 +00:00
strcpy(dataBuff, ptrQuote3);
};
};
};
2014-09-07 18:54:46 +00:00
};
};
}
else
{
stt->doEmitionRedFoundData("[JSLocator] _findFirst failed [" + QString(ip) + ":" + QString::number(port) + "]");
};
};
2015-02-27 13:55:35 +00:00
}
2015-03-07 17:31:48 +00:00
void _getJSCookie(char *dataBuff, const char *str, char *ip, int port)
2014-09-07 18:54:46 +00:00
{
char *ptr1 = strstri(str, "document.cookie");
if(ptr1 != NULL)
{
char *ptr2 = _findFirst(ptr1, "\"'");
2014-09-07 18:54:46 +00:00
if(ptr2 != NULL)
{
char *ptr3 = _findFirst(ptr2 + 1, "\"'");
2014-09-07 18:54:46 +00:00
if(ptr3 != NULL)
{
int sz = ptr3 - ptr2 - 1;
if(sz < 1024) strncpy(dataBuff, ptr2 + 1, sz);
else
{
stt->doEmitionRedFoundData("[_getJSCookie] Cookie exceeds max value [" + QString(ip) + ":" + QString::number(port) + "]");
};
};
};
};
2015-02-27 13:55:35 +00:00
}
2015-03-16 14:29:34 +00:00
int Lexems::_header(char *ip, int port, const char str[], Lexems *l, PathStr *ps, std::vector<std::string> *redirStrLst)
2014-09-07 18:54:46 +00:00
{
std::string redirectStr = "";
2014-09-19 19:27:28 +00:00
if(strstr(str, "Set-Cookie:") != NULL) strncpy(ps->cookie, _getAttribute(str, "Set-Cookie:"), COOKIE_MAX_SIZE);
2014-09-07 18:54:46 +00:00
strcpy(ps->codepage, GetCodePage(str));
2015-02-27 13:55:35 +00:00
char finalstr[512] = {0};
2014-09-07 18:54:46 +00:00
if(strstri(str, "notice auth :*** looking up your hostname...")
|| strstri(str, "451 * :You have not registered.")
)
{
strcpy(ps->headr, "[IRC server]");
strcpy(ps->path, "/"); return 1;
};
2015-02-28 08:12:13 +00:00
2015-03-07 17:31:48 +00:00
if((strstri(str, "ip camera") != NULL || strstr(str, "+tm01+") != NULL
2014-09-07 18:54:46 +00:00
|| strstri(str, "camera web server") != NULL || strstri(str, "ipcam_language") != NULL
|| strstri(str, "/viewer/video.jpg") != NULL || strstri(str, "network camera") != NULL
|| strstri(str, "sanpshot_icon") != NULL || strstri(str, "snapshot_icon") != NULL
|| strstri(str, "lan camera") != NULL || strstri(str, "cgiuserlogin?") != NULL
|| strstri(str, "web camera") != NULL || strstri(str, "smart ip device") != NULL
|| strstri(str, "pan/tilt camera") != NULL || strstri(str, "/cgi-bin/viewer/getparam.cgi?") != NULL
2015-02-28 08:12:13 +00:00
|| strstri(str, "IPCamera") != NULL)
&& strstr(str, "customer") == NULL
&& strstr(str, "purchase") == NULL
&& strstr(str, "contac") == NULL
&& strstr(str, "company") == NULL
2014-09-07 18:54:46 +00:00
)
2015-03-07 17:31:48 +00:00
{
if (strstr(str, "CgiStart?page=Single") != NULL) {
strcpy(ps->headr, "[IP Camera (Unibrowser)]");
}
else {
strcpy(ps->headr, "[IP Camera]");
}
2014-09-07 18:54:46 +00:00
l->flag = 0;
ps->flag = 0;
};
2015-02-28 08:12:13 +00:00
2015-03-07 17:31:48 +00:00
if(strstri(str, "get_status.cgi") != NULL) strcpy(ps->headr, "[It may be ip camera]");
2014-09-07 18:54:46 +00:00
if(strstri(str, "vo_logo.gif") != NULL
|| strstri(str, "vo logo.gif") != NULL
2015-03-07 17:31:48 +00:00
) strcpy(ps->headr, "[VIVOTEK camera detected?]");
2014-09-07 18:54:46 +00:00
if(strstri(str, "$lock extended") != NULL)
2015-03-07 17:31:48 +00:00
{
strcpy(ps->headr, "[DChub detected.]");
strcpy(ps->path, "/");
return 0;
};
2014-09-07 18:54:46 +00:00
if(strstri(str, "top.htm?currenttime") != NULL
|| strstri(str, "top.htm?") != NULL
2015-03-07 17:31:48 +00:00
) strcat(finalstr, " [?][SecCam detected]");
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
if(strstri(str, "<script") != NULL)
{
if(strstri(str, "document.cookie") != NULL)
{
ZeroMemory(ps->cookie, sizeof(ps->cookie));
_getJSCookie(ps->cookie, str, ip, port);
};
2015-03-07 17:31:48 +00:00
2014-09-07 18:54:46 +00:00
char *ptr1 = strstri(str, "<script");
char *ptr2 = NULL;
char linkPtr[512] = {0};
2015-03-07 17:31:48 +00:00
2014-09-07 18:54:46 +00:00
do
{
ZeroMemory(linkPtr, 512);
ptr2 = strstri(ptr1, "</script>");
if(ptr2 != NULL)
{
int sz = ptr2 - ptr1;
char *scriptContainer = new char[sz + 1];
ZeroMemory(scriptContainer, sz + 1);
strncpy(scriptContainer, ptr1, sz);
memset(scriptContainer + sz, '\0', 1);
ZeroMemory(linkPtr, 512);
2014-09-07 18:54:46 +00:00
if(strstri(scriptContainer, "location.href") != NULL) _getLinkFromJSLocation(linkPtr, scriptContainer, "location.href", ip, port);
else if(strstri(scriptContainer, "location.replace") != NULL) _getLinkFromJSLocation(linkPtr, scriptContainer, "location.replace", ip, port);
else if(strstri(scriptContainer, "location.reload") != NULL) strcpy(linkPtr, "/");
else if(strstri(scriptContainer, "location") != NULL) _getLinkFromJSLocation(linkPtr, scriptContainer, "location", ip, port);
if(strlen(linkPtr) != 0)
{
redirectStr = std::string(linkPtr);
if(std::find(redirStrLst->begin(), redirStrLst->end(), redirectStr) == redirStrLst->end())
{
redirStrLst->push_back(redirectStr);
2015-03-16 14:29:34 +00:00
redirectReconnect(ps->cookie, ip, port, linkPtr, l, ps, redirStrLst);
2014-09-07 18:54:46 +00:00
};
};
delete []scriptContainer;
2014-09-19 19:27:28 +00:00
if(ps->flag >= 17 || ps->flag == 11 || ps->flag == 12
|| ps->flag == 13 || ps->flag == 14 || ps->flag == 1
|| ps->flag == 10
)
return -2;
2014-11-15 17:59:07 +00:00
else if(ps->flag == -1) return -1;
2014-09-07 18:54:46 +00:00
}
else
{
strcat(ps->headr, "[Cannot retrieve \"<script>\"-block]");
strcat(ps->headr, " ");
break;
};
ptr1 = strstri(ptr2, "<script");
}
while(ptr1 != NULL);
2014-09-19 19:27:28 +00:00
}
if(strstri(str, " onload") != NULL)
2014-09-19 19:27:28 +00:00
{
char *ptr1 = strstri(str, " onload");
char *ptr2 = strstr(ptr1, ">");
if(ptr2 != NULL)
{
int sz = ptr2 - ptr1;
if(sz < 512)
{
char linkPtr[512] = {0};
ZeroMemory(linkPtr, 512);
strncpy(linkPtr, ptr1, sz);
char *scriptContainer = new char[sz + 1];
ZeroMemory(scriptContainer, sz + 1);
strncpy(scriptContainer, ptr1, sz);
memset(scriptContainer + sz, '\0', 1);
ZeroMemory(linkPtr, 512);
2014-09-19 19:27:28 +00:00
if(strstri(scriptContainer, "location.href") != NULL) _getLinkFromJSLocation(linkPtr, scriptContainer, "location.href", ip, port);
else if(strstri(scriptContainer, "location.replace") != NULL) _getLinkFromJSLocation(linkPtr, scriptContainer, "location.replace", ip, port);
else if(strstri(scriptContainer, "location.reload") != NULL) strcpy(linkPtr, "/");
else if(strstri(scriptContainer, "location") != NULL) _getLinkFromJSLocation(linkPtr, scriptContainer, "location", ip, port);
if(strlen(linkPtr) != 0)
{
redirectStr = std::string(linkPtr);
if(std::find(redirStrLst->begin(), redirStrLst->end(), redirectStr) == redirStrLst->end())
{
redirStrLst->push_back(redirectStr);
2015-03-16 14:29:34 +00:00
return redirectReconnect(ps->cookie, ip, port, linkPtr, l, ps, redirStrLst);
2015-02-28 11:47:21 +00:00
} return -1;
2014-09-19 19:27:28 +00:00
};
delete []scriptContainer;
if(ps->flag >= 17 || ps->flag == 11 || ps->flag == 12
|| ps->flag == 13 || ps->flag == 14 || ps->flag == 1
|| ps->flag == 10
)
return -2;
2014-11-15 17:59:07 +00:00
else if(ps->flag == -1) return -1;
2014-09-19 19:27:28 +00:00
};
};
2014-09-07 18:54:46 +00:00
};
2015-02-27 13:55:35 +00:00
2014-09-07 18:54:46 +00:00
if(strstri(str, "ActiveXObject") != NULL
|| strstri(str, ".cab") != NULL
|| strstri(str, "clsid:") != NULL
)
{
strcat(ps->headr, "[ActiveX]");
};
2015-03-07 17:31:48 +00:00
2014-09-07 18:54:46 +00:00
if(strstri(str, "<applet") != NULL
&& strstri(str, ".jar") != NULL
)
{
strcat(ps->headr, "[Java]");
};
if(strstri(str, "<script") != NULL)
{
strcat(ps->headr, "[Javascript]");
};
if(strstri(str, "<video") != NULL)
{
strcat(ps->headr, "[Video]");
};
if(strstri(str, "<frameset") != NULL || strstri(str, "<frame") != NULL || strstri(str, "<iframe") != NULL)
{
2015-03-07 17:31:48 +00:00
const char *str1 = str;
2014-09-07 18:54:46 +00:00
char *str2 = NULL;
2015-02-27 13:55:35 +00:00
char lol[128] = {0};
2014-09-07 18:54:46 +00:00
int AreaLen = 0;
do
{
if(strstri(str1, "<frameset") != NULL) str1 = strstri(str1, "<frameset");
else if(strstri(str1, "<frame") != NULL) str1 = strstri(str1, "<frame");
else if(strstri(str1, "<iframe") != NULL) str1 = strstri(str1, "<iframe");
else break;
if(strstri(str1, "src=\"") != NULL)
{
str1 = strstri(str1, "src=\"");
AreaLen = 5;
}
else if(strstri(str1, "src='") != NULL)
{
str1 = strstri(str1, "src='");
AreaLen = 5;
}
else if(strstri(str1, "src = \"") != NULL)
{
str1 = strstri(str1, "src = \"");
AreaLen = 7;
}
else if(strstri(str1, "src = '") != NULL)
{
str1 = strstri(str1, "src = '");
AreaLen = 7;
}
else if(strstri(str1, "src=") != NULL)
{
str1 = strstri(str1, "src=");
AreaLen = 4;
}
else if(strstri(str1, "src = ") != NULL)
{
str1 = strstri(str1, "src = ");
AreaLen = 6;
}
else
{
str1 = NULL;
AreaLen = 0;
};
if(str1 != NULL)
{
str2 = _findFirst(str1 + AreaLen, "'\">");
2014-09-07 18:54:46 +00:00
if(str2 != NULL)
{
char script[128] = {0};
int sz = (int)(str2 - str1) - AreaLen;
if((int)(str2 - str1) < 128) strncpy(script, str1 + AreaLen, sz);
if(strstri(script, "http://") == NULL && strstri(script, "https://") == NULL)
{
strcpy(lol, "http://");
strcat(lol, ip);
strcat(lol, ":");
2015-02-08 19:00:53 +00:00
strcat(lol, std::to_string(port).c_str());
2014-09-07 18:54:46 +00:00
if(script[0] != '/') strcat(lol, "/");
strcat(lol, script);
}
else strcpy(lol, script);
int flag = 0;
if(sz > 0)
{
if(script[0] != '#')
{
redirectStr = std::string(lol);
if(std::find(redirStrLst->begin(), redirStrLst->end(), redirectStr) == redirStrLst->end())
{
redirStrLst->push_back(redirectStr);
2015-03-16 14:29:34 +00:00
return redirectReconnect(ps->cookie, ip, port, lol, l, ps, redirStrLst);
2015-03-07 17:31:48 +00:00
};
2014-09-07 18:54:46 +00:00
}
else
{
strcat(ps->headr, "[Unknown frame: \"");
strcat(ps->headr, script);
strcat(ps->headr, "\"]");
};
}
flag = ps->flag;
if(flag == 1 || flag == 11 || flag == 12
|| flag == 13 || flag == 14 || flag >= 17 || flag == 10)
{
return -2;
2014-11-15 17:59:07 +00:00
}
else if(ps->flag == -1) return -1;
2014-09-07 18:54:46 +00:00
}
else
{
2015-03-07 17:31:48 +00:00
stt->doEmitionRedFoundData("[FrameLocator] Corrupted tag. [" + QString(ip) +":" + QString::number(port) + "]");
2014-09-07 18:54:46 +00:00
};
};
}
while(str1 != NULL);
return -2;
};
if(strstri(str, "<form ") != NULL)
{
strcat(ps->headr, " [Login form detected]");
char *ptr1 = strstri(str, "<form");
char *ptr2 = strstri(ptr1, "action");
if(ptr2 != NULL)
{
char *ptr3 = strstri(ptr2, "=");
if(ptr3 != NULL)
{
char *ptr4 = NULL;
char *ptrEnd = NULL;
int sz = 0;
char redirStr[512] = {0};
if(ptr3[1] == ' ' || ptr3[1] == '"' || ptr3[1] == '\"')
{
ptr4 = _findFirst(ptr3, " \"'\n\r");
2014-09-07 18:54:46 +00:00
if(ptr4 != NULL)
{
ptrEnd = _findFirst(ptr4 + 1, " \"'\n\r");
2014-09-07 18:54:46 +00:00
if(ptrEnd != NULL)
{
sz = ptrEnd - ptr4 - 1;
strncpy(redirStr, ptr4 + 1, sz < 512 ? sz : 512);
};
};
}
else
{
ptrEnd = _findFirst(ptr3, " \"'\n\r");
2014-09-07 18:54:46 +00:00
if(ptrEnd != NULL)
{
sz = ptrEnd - ptr3 - 1;
strncpy(redirStr, ptr3 + 1, sz < 512 ? sz : 512);
};
};
2015-03-10 20:09:05 +00:00
if (redirStr[0] != '#') {
if (std::find(redirStrLst->begin(), redirStrLst->end(), redirStr) == redirStrLst->end())
{
redirStrLst->push_back(redirStr);
2015-03-16 14:29:34 +00:00
return redirectReconnect(ps->cookie, ip, port, redirStr, l, ps, redirStrLst);
2015-03-10 20:09:05 +00:00
} return -1;
}
2014-09-07 18:54:46 +00:00
return -2;
};
}
else
{
strcat(ps->headr, " [Form action not found]");
};
return 0;
};
if(strlen(ps->headr) == 0)
{
strcat(ps->headr, "[Empty title]");
if(strstri(str, "<html") == NULL && strstri(str, "<!doctype html") == NULL)
{
strcat(ps->headr, "[No html]");
};
if(strstri(str, "<body") == NULL)
{
strcat(ps->headr, "[No body]");
};
if(strstr(str, "\r\n\r\n") != NULL)
{
2015-03-07 17:31:48 +00:00
const char *tempStr = strstr(str, "\r\n\r\n");
2014-09-07 18:54:46 +00:00
if(strlen(tempStr) - 4 >= 250)
{
if(strstr(str, "Content-Encoding: gzip") != NULL)
{
strcat(ps->headr, "[GZIP]");
};
strcat(ps->headr, " [Data: ");
if(strstri(tempStr + 4, "<body") != NULL)
{
strncat(ps->headr, strstri(tempStr, "<body") + 5, 64);
}
else if(strstri(tempStr + 4, "<html") != NULL)
{
strncat(ps->headr, strstri(tempStr, "<html") + 5, 64);
}
else if(strstri(tempStr + 4, "</style>") != NULL)
{
strncat(ps->headr, strstri(tempStr, "</style>") + 8, 64);
}
else strncat(ps->headr, tempStr + 4, 64);
strcat(ps->headr, "]");
}
else
{
if(gNegDebugMode)
{
stt->doEmitionDebugFoundData("[<a href=\"http://" + QString(ip) + ":" + QString::number(port) + "/\"><font color=\"#0084ff\">" + QString(ip) + ":" + QString::number(port) + "</font></a>" + "] Rejecting in _header::Lowload_body (&lt;250b)");
};
++Filt;
strcpy(ps->path, "/");
return 0;
};
}
else
{
strcat(ps->headr, " [Data:");
strncat(ps->headr, str, 128);
strcat(ps->headr, "]");
};
};
2015-03-07 17:31:48 +00:00
2014-09-07 18:54:46 +00:00
ps->flag = ContentFilter(str, port, ip, ps->codepage);
if(strstri(str, "window.open(") != NULL)
{
_getPopupTitle(ps, strstri(str, "window.open("));
};
strcpy(ps->path, "/");
return 0;
2015-02-27 13:55:35 +00:00
}