pentool 0.1.0__py3-none-any.whl

pentool/utils/copy_as.py

@@ -0,0 +1,250 @@
+"""Утилиты для генерации команд внешних инструментов из HTTP-запроса."""
+
+from __future__ import annotations
+
+import re
+import shlex
+import subprocess
+from pathlib import Path
+
+
+from pentool.utils.parser import ParsedRequest
+
+
+def copy_as_curl(req: ParsedRequest) -> str:
+    """Генерирует curl команду с флагами -X, -H, -d, --proxy."""
+    parts = ["curl", "-i", "-s", "-k"]
+
+    if req.method != "GET":
+        parts += ["-X", req.method]
+
+    for name, value in req.headers.items():
+        if name.lower() in ("content-length", "connection", "transfer-encoding"):
+            continue
+        parts += ["-H", f"{name}: {value}"]
+
+    if req.body:
+        body_str = req.body if isinstance(req.body, str) else req.body.decode("utf-8", errors="replace")
+        parts += ["--data-raw", body_str]
+
+    parts.append(req.url)
+    return " ".join(shlex.quote(p) for p in parts)
+
+
+def copy_as_ffuf(req: ParsedRequest) -> str:
+    """Генерирует ffuf команду для фаззинга URL."""
+    url = req.url
+    # Если FUZZ ещё нет в URL — добавляем к последнему сегменту
+    if "FUZZ" not in url:
+        url = url.rstrip("/") + "/FUZZ"
+
+    parts = ["ffuf", "-u", url, "-w", "wordlist.txt:FUZZ"]
+
+    for name, value in req.headers.items():
+        if name.lower() in ("content-length", "connection"):
+            continue
+        parts += ["-H", f"{name}: {value}"]
+
+    if req.method != "GET":
+        parts += ["-X", req.method]
+
+    if req.body:
+        body_str = req.body if isinstance(req.body, str) else req.body.decode("utf-8", errors="replace")
+        parts += ["-d", body_str]
+
+    return " ".join(shlex.quote(p) for p in parts)
+
+
+def copy_as_sqlmap(req: ParsedRequest, request_file: str = "request.txt") -> str:
+    """Генерирует sqlmap -r request.txt команду."""
+    parts = ["sqlmap", "-r", request_file, "--batch"]
+
+    # Если есть параметры — добавляем -p для явного указания
+    body_str = req.body if isinstance(req.body, str) else req.body.decode("utf-8", errors="replace")
+    if body_str and any(c in body_str for c in ("=", "&")):
+        parts += ["--data", body_str]
+
+    # Определяем dbms по заголовкам ответа если возможно
+    parts += ["--dbs"]
+
+    return " ".join(shlex.quote(p) for p in parts)
+
+
+def copy_as_nmap(req: ParsedRequest) -> str:
+    """Генерирует nmap -sV -p PORT HOST команду."""
+    from urllib.parse import urlparse
+    parsed = urlparse(req.url)
+    host = parsed.hostname or "TARGET"
+    port = parsed.port
+    if port is None:
+        port = 443 if parsed.scheme == "https" else 80
+
+    parts = ["nmap", "-sV", "-sC", "-p", str(port), host]
+    return " ".join(shlex.quote(p) for p in parts)
+
+
+def copy_as_jwt_tool(req: ParsedRequest) -> str:
+    """Если в заголовках есть JWT — генерирует jwt_tool команду."""
+    jwt_token: str | None = None
+
+    # Ищем JWT в Authorization: Bearer ...
+    auth = req.headers.get("Authorization", req.headers.get("authorization", ""))
+    if auth.lower().startswith("bearer "):
+        token = auth[7:].strip()
+        # Проверяем формат JWT (три части base64 через точки)
+        if re.match(r'^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$', token):
+            jwt_token = token
+
+    # Ищем JWT в Cookie
+    if jwt_token is None:
+        cookie_hdr = req.headers.get("Cookie", req.headers.get("cookie", ""))
+        for part in cookie_hdr.split(";"):
+            part = part.strip()
+            if "=" in part:
+                _, val = part.split("=", 1)
+                val = val.strip()
+                if re.match(r'^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$', val):
+                    jwt_token = val
+                    break
+
+    if jwt_token is None:
+        return f"# No JWT found in request headers\n# jwt_tool <token> -t {req.url}"
+
+    parts = ["jwt_tool", jwt_token, "-t", req.url]
+    return " ".join(shlex.quote(p) for p in parts)
+
+
+def save_request_txt(req: ParsedRequest, path: str) -> None:
+    """Сохраняет raw HTTP request в файл для внешних инструментов (sqlmap и др.)."""
+    from urllib.parse import urlparse
+    parsed = urlparse(req.url)
+    path_qs = parsed.path
+    if parsed.query:
+        path_qs += "?" + parsed.query
+
+    http_ver = getattr(req, "http_version", "HTTP/1.1") or "HTTP/1.1"
+    lines = [f"{req.method} {path_qs} {http_ver}"]
+    for name, value in req.headers.items():
+        lines.append(f"{name}: {value}")
+    lines.append("")
+
+    if req.body:
+        body_str = req.body if isinstance(req.body, str) else req.body.decode("utf-8", errors="replace")
+        lines.append(body_str)
+
+    Path(path).write_text("\r\n".join(lines), encoding="utf-8")
+
+
+def copy_as_fetch(req: ParsedRequest) -> str:
+    """Генерирует JavaScript fetch() вызов для DevTools Console."""
+    from urllib.parse import urlparse
+    import json as _json
+
+    headers_dict = {
+        k: v for k, v in req.headers.items()
+        if k.lower() not in ("content-length", "connection", "transfer-encoding", "host")
+    }
+
+    body_str: str | None = None
+    if req.body:
+        body_str = req.body if isinstance(req.body, str) else req.body.decode("utf-8", errors="replace")
+
+    opts: dict = {"method": req.method}
+    if headers_dict:
+        opts["headers"] = headers_dict
+    if body_str:
+        opts["body"] = body_str
+
+    opts_json = _json.dumps(opts, indent=2, ensure_ascii=False)
+    return f"fetch({_json.dumps(req.url)}, {opts_json});"
+
+
+def open_in_browser(url: str) -> bool:
+    import webbrowser
+    try:
+        webbrowser.open(url)
+        return True
+    except Exception:
+        return False
+
+
+def extract_url_from_raw(raw: str) -> str:
+    """Извлечь URL из сырого HTTP-запроса (первая строка + Host заголовок)."""
+    if not raw:
+        return ""
+    lines = raw.replace("\r\n", "\n").split("\n")
+    first = lines[0].strip()
+    parts = first.split(" ", 2)
+    if len(parts) < 2:
+        return ""
+    method_or_url = parts[0]
+    path = parts[1] if len(parts) >= 2 else "/"
+
+    # Если первая строка уже URL (не HTTP-метод)
+    if method_or_url.lower().startswith("http"):
+        return method_or_url
+
+    # Ищем Host заголовок
+    host = ""
+    scheme = "https"
+    for line in lines[1:]:
+        if not line.strip():
+            break
+        if line.lower().startswith("host:"):
+            host = line.split(":", 1)[1].strip()
+        if "x-forwarded-proto: http" in line.lower():
+            scheme = "http"
+
+    if not host:
+        return path
+
+    # Определяем схему по порту
+    if host.endswith(":80"):
+        scheme = "http"
+    elif host.endswith(":443"):
+        scheme = "https"
+        host = host[:-4]
+
+    return f"{scheme}://{host}{path}"
+
+
+def copy_to_clipboard(text: str) -> bool:
+    """Копирует в буфер через xclip/xsel/wl-copy/GTK/pyperclip. Возвращает успех."""
+    for cmd in [
+        ["xclip", "-selection", "clipboard"],
+        ["xsel", "--clipboard", "--input"],
+        ["wl-copy"],
+    ]:
+        try:
+            result = subprocess.run(cmd, input=text.encode(), timeout=2, capture_output=True)
+            if result.returncode == 0:
+                return True
+        except (FileNotFoundError, subprocess.TimeoutExpired):
+            continue
+
+    # GTK clipboard (работает на X11 без xclip/xsel)
+    try:
+        gtk_script = (
+            "import gi; gi.require_version('Gtk','3.0'); "
+            "from gi.repository import Gtk,Gdk; "
+            "cb=Gtk.Clipboard.get(Gdk.SELECTION_CLIPBOARD); "
+            f"cb.set_text({text!r},-1); cb.store()"
+        )
+        result = subprocess.run(
+            ["python3", "-c", gtk_script],
+            timeout=3, capture_output=True,
+        )
+        if result.returncode == 0:
+            return True
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        pass
+
+    # pyperclip как fallback
+    try:
+        import pyperclip  # type: ignore[import]
+        pyperclip.copy(text)
+        return True
+    except Exception:
+        pass
+
+    return False

pentool/utils/diff.py

@@ -0,0 +1,82 @@
+"""Сравнение текстов (diff) с форматированием для Rich/Textual."""
+
+from __future__ import annotations
+
+import difflib
+from dataclasses import dataclass
+from typing import Literal
+
+
+@dataclass
+class DiffLine:
+    """Одна строка результата diff."""
+
+    type: Literal["+", "-", " ", "@"]
+    content: str
+
+
+def diff_texts(text1: str, text2: str, context: int = 3) -> list[DiffLine]:
+    """Сравнить два текста и вернуть список строк diff (unified format).
+
+    Args:
+        text1: Исходный текст (левый / «до»).
+        text2: Изменённый текст (правый / «после»).
+        context: Количество контекстных строк вокруг изменений.
+
+    Returns:
+        Список объектов DiffLine.
+    """
+    lines1 = text1.splitlines(keepends=True)
+    lines2 = text2.splitlines(keepends=True)
+
+    result: list[DiffLine] = []
+    for line in difflib.unified_diff(lines1, lines2, n=context):
+        line_stripped = line.rstrip("\n")
+        if line_stripped.startswith("+++") or line_stripped.startswith("---"):
+            result.append(DiffLine(type="@", content=line_stripped))
+        elif line_stripped.startswith("@@"):
+            result.append(DiffLine(type="@", content=line_stripped))
+        elif line_stripped.startswith("+"):
+            result.append(DiffLine(type="+", content=line_stripped[1:]))
+        elif line_stripped.startswith("-"):
+            result.append(DiffLine(type="-", content=line_stripped[1:]))
+        else:
+            content = line_stripped[1:] if line_stripped.startswith(" ") else line_stripped
+            result.append(DiffLine(type=" ", content=content))
+
+    return result
+
+
+def diff_to_rich(diff: list[DiffLine]) -> str:
+    """Форматировать diff в строку с Rich-разметкой (цвета).
+
+    Args:
+        diff: Список DiffLine от diff_texts().
+
+    Returns:
+        Строка с Rich markup для отображения в Textual/Rich.
+    """
+    lines: list[str] = []
+    for dl in diff:
+        escaped = dl.content.replace("[", "\\[")
+        if dl.type == "+":
+            lines.append(f"[green]+{escaped}[/green]")
+        elif dl.type == "-":
+            lines.append(f"[red]-{escaped}[/red]")
+        elif dl.type == "@":
+            lines.append(f"[cyan]{escaped}[/cyan]")
+        else:
+            lines.append(f" {escaped}")
+    return "\n".join(lines)
+
+
+def diff_summary(text1: str, text2: str) -> dict[str, int]:
+    added = removed = unchanged = 0
+    for dl in diff_texts(text1, text2):
+        if dl.type == "+":
+            added += 1
+        elif dl.type == "-":
+            removed += 1
+        elif dl.type == " ":
+            unchanged += 1
+    return {"added": added, "removed": removed, "unchanged": unchanged}

pentool/utils/http_client.py

@@ -0,0 +1,145 @@
+"""Асинхронный HTTP-клиент на базе aiohttp."""
+
+from __future__ import annotations
+
+import asyncio
+import time
+from typing import Callable
+
+import aiohttp
+
+from pentool.utils.parser import ParsedRequest, ParsedResponse
+
+
+# Тип коллбэка: вызывается после каждого запроса
+RequestCallback = Callable[[ParsedRequest, ParsedResponse], None]
+
+
+class HTTPClient:
+    """Асинхронный HTTP-клиент для отправки перехваченных запросов.
+
+    Поддерживает прокси, таймауты, перенаправления и коллбэк логирования.
+    """
+
+    def __init__(
+        self,
+        proxy_url: str | None = None,
+        timeout: float = 30.0,
+        follow_redirects: bool = True,
+        verify_ssl: bool = False,
+        on_request_sent: RequestCallback | None = None,
+    ) -> None:
+        self._proxy_url = proxy_url
+        self._timeout = aiohttp.ClientTimeout(total=timeout)
+        self._follow_redirects = follow_redirects
+        self._verify_ssl = verify_ssl
+        self._on_request_sent = on_request_sent
+        self._session: aiohttp.ClientSession | None = None
+
+    async def _get_session(self) -> aiohttp.ClientSession:
+        if self._session is None or self._session.closed:
+            connector = aiohttp.TCPConnector(ssl=self._verify_ssl)
+            self._session = aiohttp.ClientSession(
+                connector=connector,
+                timeout=self._timeout,
+            )
+        return self._session
+
+    async def send(self, request: ParsedRequest) -> ParsedResponse:
+        session = await self._get_session()
+
+        # Убрать hop-by-hop заголовки + заменить Accept-Encoding чтобы исключить br
+        send_headers = {}
+        for k, v in request.headers.items():
+            if k.lower() in ("host", "content-length", "transfer-encoding",
+                             "connection", "keep-alive", "proxy-connection"):
+                continue
+            if k.lower() == "accept-encoding":
+                # Убрать brotli — aiohttp не умеет его декодировать
+                encodings = [e.strip() for e in v.split(",")
+                             if e.strip().lower() not in ("br", "zstd")]
+                v = ", ".join(encodings) if encodings else "gzip, deflate"
+            send_headers[k] = v
+
+        # Inject scan marker header if configured
+        try:
+            from pentool.core.config import get_config
+            cfg = get_config()
+            if cfg.scan_marker_enabled and cfg.scan_marker_name:
+                send_headers[cfg.scan_marker_name] = cfg.scan_marker_value
+        except Exception:
+            pass
+
+        body_data = request.body.encode("utf-8") if request.body else None
+        kwargs: dict = {
+            "headers": send_headers,
+            "allow_redirects": self._follow_redirects,
+            "data": body_data,
+        }
+        if self._proxy_url:
+            kwargs["proxy"] = self._proxy_url
+
+        start = time.monotonic()
+        async with session.request(request.method, request.url, **kwargs) as resp:
+            # Читаем сырые байты — aiohttp сам декодирует gzip/deflate через read()
+            resp_body_bytes: bytes = await resp.read()
+            elapsed_ms = int((time.monotonic() - start) * 1000)
+
+            # Декодируем для хранения в ParsedResponse (для TUI/отчётов)
+            try:
+                resp_body = resp_body_bytes.decode(
+                    resp.charset or "utf-8", errors="replace"
+                )
+            except (LookupError, TypeError):
+                resp_body = resp_body_bytes.decode("utf-8", errors="replace")
+
+            resp_headers = dict(resp.headers)
+            parsed_resp = ParsedResponse(
+                status=resp.status,
+                reason=resp.reason or "",
+                headers=resp_headers,
+                body=resp_body,
+                _raw_body=resp_body_bytes,
+            )
+
+        if self._on_request_sent:
+            self._on_request_sent(request, parsed_resp)
+
+        return parsed_resp
+
+    async def send_raw(self, raw_request: str) -> ParsedResponse:
+        from pentool.utils.parser import parse_http_request
+        req = parse_http_request(raw_request)
+        return await self.send(req)
+
+    async def close(self) -> None:
+        if self._session and not self._session.closed:
+            await self._session.close()
+
+    async def get(self, url: str, headers: dict | None = None) -> "ParsedResponse":
+        """Удобный метод: GET-запрос по URL."""
+        req = ParsedRequest(
+            method="GET",
+            url=url,
+            headers=headers or {},
+            body="",
+        )
+        return await self.send(req)
+
+    async def post(self, url: str, body: str = "", headers: dict | None = None) -> "ParsedResponse":
+        """Удобный метод: POST-запрос по URL."""
+        req = ParsedRequest(
+            method="POST",
+            url=url,
+            headers=headers or {"Content-Type": "application/x-www-form-urlencoded"},
+            body=body,
+        )
+        return await self.send(req)
+
+    async def __aenter__(self) -> "HTTPClient":
+        """Поддержка контекстного менеджера: вернуть self."""
+        return self
+
+    async def __aexit__(self, *_: object) -> None:
+        """Поддержка контекстного менеджера: закрыть сессию при выходе."""
+        await self.close()