#!/usr/bin/python

import argparse

import json

import signal

import sys

import concurrent.futures

import urllib.parse

import requests

from core import Expect, Filter, Input, accesslog, data, proc, sshlog, DirTraversal

from core.rich_output import (

print_banner,

configure_output,

load_config,

create_default_config,

rich_print,

print_error,

print_success,

_config,

)

from core.ThreadManager import ThreadManager

from core.utils import configure_http_options, configure_runtime_options, HTTP_OPTIONS

from tests.test_liffy import (

test_data,

test_input,

test_expect,

test_proc,

test_access,

test_ssh,

test_filter,

test_directory_traversal,

test_null_byte,

test_zip_wrapper,

test_wrapper_scan,

test_oob_scan,

test_blind_scan,

)

def ping(url):

"""Check whether the target HTTP service is reachable."""

request_kwargs = {"timeout": HTTP_OPTIONS["timeout"]}

if HTTP_OPTIONS.get("proxy"):

request_kwargs["proxies"] = {

"http": HTTP_OPTIONS["proxy"],

"https": HTTP_OPTIONS["proxy"],

}

if HTTP_OPTIONS.get("verify_tls"):

request_kwargs["verify"] = True

try:

response = requests.head(url, allow_redirects=True, **request_kwargs)

return True

except requests.RequestException:

try:

response = requests.get(url, stream=True, **request_kwargs)

response.close()

return True

except requests.RequestException:

return False

def signal_handler(signal, frame):

print_error("\n\nYou pressed Ctrl+C!")

sys.exit(0)

def apply_auto_scan(args):

if not args.auto:

return

args.detection = True

args.directorytraverse = True

args.wrappers = True

args.blind = True

if args.oob_url:

args.oob = True

def main():

if not len(sys.argv):

print("[!] Not Enough Arguments!")

# TODO: Add usage

sys.exit(0)

# Parse args first to check for banner/color settings

parser = argparse.ArgumentParser()

parser.add_argument("url", help="URL to test for LFI", nargs="?")

parser.add_argument(

"-d", "--data", help="Use data:// technique", action="store_true"

)

parser.add_argument(

"-i", "--input", help="Use input:// technique", action="store_true"

)

parser.add_argument(

"-e", "--expect", help="Use expect:// technique", action="store_true"

)

parser.add_argument(

"-f", "--filter", help="Use filter:// technique", action="store_true"

)

parser.add_argument(

"-p", "--proc", help="Use /proc/self/environ technique", action="store_true"

)

parser.add_argument(

"-a", "--access", help="Apache access logs technique", action="store_true"

)

parser.add_argument(

"-ns",

"--nostager",

help="execute payload directly, do not use stager",

action="store_true",

)

parser.add_argument(

"-r",

"--relative",

help="use path traversal sequences for attack",

action="store_true",

)

parser.add_argument("--ssh", help="SSH auth log poisoning", action="store_true")

parser.add_argument(

"-l", "--location", help="path to target file (access log, auth log, etc.)"

)

parser.add_argument("--cookies", help="session cookies for authentication")

parser.add_argument(

"-dt",

"--directorytraverse",

help="Test for Directory Traversal",

action="store_true",

)

parser.add_argument(

"-t", "--threads", help="number of threads to use", default=5, type=int

)

parser.add_argument(

"--detection",

help="Only perform LFI detection, without attempting to get a shell",

action="store_true",

)

parser.add_argument(

"--null-byte",

help="Test for Null Byte Poisoning",

action="store_true",

)

parser.add_argument(

"--zip",

help="Test for ZIP wrapper exploitation",

action="store_true",

)

parser.add_argument(

"--wrappers",

"--wrapper",

dest="wrappers",

help="Detect common LFI stream wrappers",

action="store_true",

)

parser.add_argument(

"--wrapper-list",

help="Path to custom wrapper probe payload list",

)

parser.add_argument(

"--oob",

help="Send out-of-band callback probes",

action="store_true",

)

parser.add_argument("--oob-url", help="OOB callback base URL")

parser.add_argument(

"--blind",

help="Run blind LFI response-difference checks",

action="store_true",

)

parser.add_argument("--blind-list", help="Path to custom blind LFI probe list")

parser.add_argument(

"--auto",

help="Run a safe automatic scan plan",

action="store_true",

)

parser.add_argument(

"--encoding",

help="Use advanced encoding/bypass techniques",

action="store_true",

)

parser.add_argument(

"--waf-bypass",

help="Use WAF evasion techniques",

action="store_true",

)

parser.add_argument(

"--method",

help="HTTP method to use (GET/POST)",

default="GET",

choices=["GET", "POST"],

)

parser.add_argument(

"--post-data",

help="POST data (format: key=value&key2=value2)",

)

parser.add_argument(

"--headers",

help="Custom headers (format: Header1:Value1,Header2:Value2)",

)

parser.add_argument("--lhost", help="callback host for staged payloads")

parser.add_argument("--lport", help="callback port for staged payloads")

parser.add_argument("--read-file", help="file path to read with filter://")

parser.add_argument(

"-y",

"--yes",

help="use defaults for prompts and run non-interactively",

action="store_true",

)

parser.add_argument("--timeout", type=float, help="HTTP request timeout in seconds")

parser.add_argument("--proxy", help="HTTP(S) proxy URL")

parser.add_argument(

"--verify-tls",

help="verify TLS certificates instead of using insecure requests",

action="store_true",

)

parser.add_argument("--user-agent", help="custom User-Agent header")

parser.add_argument("--delay", type=float, help="delay between requests in seconds")

parser.add_argument("--retries", type=int, help="HTTP retries per request")

parser.add_argument(

"--json",

help="print a JSON run summary",

action="store_true",

)

parser.add_argument("--output", help="write JSON run summary to a file")

parser.add_argument(

"--quiet",

help="suppress normal terminal output",

action="store_true",

)

parser.add_argument(

"--no-color",

help="Disable colored output",

action="store_true",

)

parser.add_argument(

"--no-banner",

help="Disable banner display",

action="store_true",

)

parser.add_argument(

"--config",

help="Create default YAML configuration file",

action="store_true",

)

args = parser.parse_args()

# Handle config creation

if args.config:

if create_default_config():

print_success(

"Default configuration file 'liffy_config.yaml' created successfully!"

)

else:

print_error(

"Configuration file already exists! Delete 'liffy_config.yaml' first or edit it directly."

)

sys.exit(0)

# Load configuration and apply CLI overrides

load_config()

configure_output(

disable_colors=args.no_color,

disable_banner=args.no_banner,

quiet=args.quiet or (args.json and not args.output),

)

configure_http_options(args, _config)

configure_runtime_options(args)

# Show banner after configuration is loaded

print_banner()

if not args.url:

print_error("URL is required")

sys.exit(1)

parsed = urllib.parse.urlsplit(args.url)

if not parsed.query:

print_error("No GET parameter Provided")

pre_run_tasks = {

ping: "Checking Target: {0}".format(args.url),

}

with concurrent.futures.ThreadPoolExecutor(

max_workers=len(pre_run_tasks)

) as executor:

future_to_task = {

executor.submit(task, args.url): task for task in pre_run_tasks

}

for future in concurrent.futures.as_completed(future_to_task):

task = future_to_task[future]

try:

result = future.result()

if not result:

print_error("Target irresponsive")

sys.exit(1)

else:

print_success("Target looks alive")

except Exception as exc:

print(f"{pre_run_tasks[task]} generated an exception: {exc}")

apply_auto_scan(args)

tasks = []

if args.data:

tasks.append(test_data)

if args.input:

tasks.append(test_input)

if args.expect:

tasks.append(test_expect)

if args.proc:

tasks.append(test_proc)

if args.access:

tasks.append(test_access)

if args.ssh:

tasks.append(test_ssh)

if args.filter:

tasks.append(test_filter)

if args.directorytraverse:

tasks.append(test_directory_traversal)

if args.null_byte:

tasks.append(test_null_byte)

if args.zip:

tasks.append(test_zip_wrapper)

if args.wrappers:

tasks.append(test_wrapper_scan)

if args.oob:

tasks.append(test_oob_scan)

if args.blind:

tasks.append(test_blind_scan)

if not tasks:

print_error("Please select at least one technique to test")

sys.exit(0)

# Create enhanced thread manager

max_workers = getattr(args, "threads", _config.get("max_threads", 5))

rate_limit = _config.get("rate_limit_delay", 0.1)

thread_manager = ThreadManager(max_workers=max_workers, rate_limit_delay=rate_limit)

# Execute each selected technique once with the parsed CLI arguments.

results = thread_manager.execute_tasks(tasks, [args])

if args.json or args.output:

summary = {

"target": args.url,

"techniques": [task.__name__ for task in tasks],

"completed": thread_manager.completed_tasks,

"failed": thread_manager.failed_tasks,

"result_count": len(results),

}

rendered = json.dumps(summary, indent=2)

if args.output:

with open(args.output, "w") as output_file:

output_file.write(rendered + "\n")

if args.json:

print(rendered)

if __name__ == "__main__":

signal.signal(signal.SIGINT, signal_handler)

main()