roglew / pappy-proxy Goto Github PK

Without root:

$ pip install .
Exception:
Traceback (most recent call last):
File "/Library/Python/2.7/site-packages/pip-8.1.2-py2.7.egg/pip/basecommand.py", line 215, in main
status = self.run(options, args)
File "/Library/Python/2.7/site-packages/pip-8.1.2-py2.7.egg/pip/commands/install.py", line 317, in run
prefix=options.prefix_path,
File "/Library/Python/2.7/site-packages/pip-8.1.2-py2.7.egg/pip/req/req_set.py", line 742, in install
**kwargs
File "/Library/Python/2.7/site-packages/pip-8.1.2-py2.7.egg/pip/req/req_install.py", line 831, in install
self.move_wheel_files(self.source_dir, root=root, prefix=prefix)
File "/Library/Python/2.7/site-packages/pip-8.1.2-py2.7.egg/pip/req/req_install.py", line 1032, in move_wheel_files
isolated=self.isolated,
File "/Library/Python/2.7/site-packages/pip-8.1.2-py2.7.egg/pip/wheel.py", line 346, in move_wheel_files
clobber(source, lib_dir, True)
File "/Library/Python/2.7/site-packages/pip-8.1.2-py2.7.egg/pip/wheel.py", line 317, in clobber
ensure_dir(destdir)
File "/Library/Python/2.7/site-packages/pip-8.1.2-py2.7.egg/pip/utils/__init__.py", line 83, in ensure_dir
os.makedirs(path)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/os.py", line 157, in makedirs
mkdir(name, mode)
OSError: [Errno 13] Permission denied: '/Library/Python/2.7/site-packages/beautifulsoup4-4.5.1.dist-info'

With sudo:

error: could not create '/System/Library/Frameworks/Python.framework/Versions/2.7/include/python2.7/greenlet': Operation not permitted

----------------------------------------
Command "/usr/bin/python -u -c "import setuptools, tokenize;__file__='/private/tmp/pip-build-GH3cTs/greenlet/setup.py';exec(compile(getattr(tokenize, 'open', open)(__file__).read().replace('\r\n', '\n'), __file__, 'exec'))" install --record /tmp/pip-n2q6sl-record/install-record.txt --single-version-externally-managed --compile" failed with error code 1 in /private/tmp/pip-build-GH3cTs/greenlet/

Running with user permissions:

$ python setup.py install
Checking .pth file support in /Library/Python/2.7/site-packages/
error: can't create or remove files in install directory

The following error occurred while trying to add or remove files in the
installation directory:

    [Errno 13] Permission denied: '/Library/Python/2.7/site-packages/test-easy-install-12740.pth'

The installation directory you specified (via --install-dir, --prefix, or
the distutils default setting) was:

    /Library/Python/2.7/site-packages/

Perhaps your account does not have write access to this directory?  If the
installation directory is a system-owned directory, you may need to sign in
as the administrator or "root" account.  If you do not have administrative
access to this machine, you may wish to choose a different installation
directory, preferably one that is listed in your PYTHONPATH environment
variable.

For information on other options, you may wish to consult the
documentation at:

  https://pythonhosted.org/setuptools/easy_install.html

Please make the appropriate changes for your system and try again.

Running with sudo:
$ sudo python setup.py install
Generates some warning, and then the fatal error:

scrypt-1.1.6/lib/crypto/crypto_aesctr.c:38:10: fatal error: 'openssl/aes.h' file not found

Then when trying to execute:

$ pappy -l
Traceback (most recent call last):
  File "/usr/local/bin/pappy", line 5, in <module>
    from pkg_resources import load_entry_point
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources.py", line 2793, in <module>
    working_set.require(__requires__)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources.py", line 673, in require
    needed = self.resolve(parse_requirements(requirements))
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources.py", line 576, in resolve
    raise DistributionNotFound(req)
pkg_resources.DistributionNotFound: scrypt>=0.7.1

Running under El Capitan 10.11.6

I've been developing a feature to compress and encrypt the pappy project files, and have run into a bit of a hanging point.

How should I hook into the core pappy structure to check if the encrypted archive exists, and keep pappy from creating new project files?

Also, I am writing the feature as two separate plugins (one for encryption, one for compression), how do I call/import the compression feature from within the encryption feature?

Thanks in advance for any help/direction you can give me,
onizenso

In Pappy Proxy 0.3.1, when using a forward socks proxy, the following error is given in the browser:
"error submitting request: error reading response: unexpected EOF"

To reproduce:
Create a socks proxy using ssh -D (works in Burp, and in Pappy proxy 0.2.14)

$ ssh -q -f -N someuser@somehost -p 22 -L 127.0.0.1:2222:REMOTEIP:22
$ ssh -q -f -N -D 127.0.0.1:9050 -p 2222 [email protected]
$ netstat -nl | grep 9050
tcp 0 0 127.0.0.1:9050 0.0.0.0:* LISTEN
$ cat config.json
{
"listeners": [
{"iface": "127.0.0.1", "port": 8080}
],
"proxy": {"use_proxy": true, "host": "127.0.0.1", "port": 9050, "is_socks": true}
}
$ ~/pappy-proxy-master/start
pappy >

Note, that when using the pappy proxy with a forward proxy, the error appears in the browser:
"error submitting request: error reading response: unexpected EOF"

This error does not show up in Pappy proxy 0.2.14 and also not in Burp, and in those two tools, the SSH forward proxy works without any issue.

Pappy Proxy has been inventoried on Rawsec's CyberSecurity Inventory.

https://inventory.rawsec.ml/tools.html#Pappy%20Proxy

What is Rawsec's CyberSecurity Inventory?

An inventory of tools and resources about CyberSecurity. This inventory aims to help people to find everything related to CyberSecurity.

More details about features here.

Note: the inventory is a FLOSS (Free, Libre and Open-Source Software) project.

Why should you care about being inventoried?

Mainly because this is giving visibility to your tool and improve its referencing.

Badges

The badge shows to your community that your are inventoried. It looks good but also shows you care about your project, that your tool is referenced.

Feel free to claim your badge here: http://inventory.rawsec.ml/features.html#badges, it looks like that , but there are several styles available.

Want to thank us?

If you want to thank us, you can help make our open project better known by tweeting about it! For example:

So what?

That's all, this message is just to notify you if you care. Else you can close this issue.

Loved your demo at Blackhat! Unfortunately I'm having issues getting pappy up and going. Any idea what could be causing this to happen? I'm running pappy in the following environment.

Mac OS X 10.11.6
Python 2.7.11 (in a virtualenv)

Some printable symbols, for example russian letters (you can find it on http://ya.ru title) replaced by dots in printable_data func. Maybe it should use some other check, unicodedata.category or something like this.

./install.sh seems fine:

No GOPATH detected, creating temporary GOPATH at /root/Github/pappy-proxy/gopath
Already up to date.
Getting puppy dependencies...
Building puppy into /root/.pappy/puppy...
Running virtualenv with interpreter /usr/bin/python3
Using base prefix '/usr'
New python executable in /root/.pappy/venv/bin/python3
Not overwriting existing python script /root/.pappy/venv/bin/python (you must use /root/.pappy/venv/bin/python3)
Installing setuptools, pip, wheel...done.
Obtaining file:///root/Github/pappy-proxy
Requirement already satisfied: cmd2>=0.6.8 in /root/.pappy/venv/lib/python3.6/site-packages (from pappyproxy==0.3.1) (0.9.2)
Requirement already satisfied: Jinja2>=2.8 in /root/.pappy/venv/lib/python3.6/site-packages (from pappyproxy==0.3.1) (2.10)
Requirement already satisfied: pygments>=2.0.2 in /root/.pappy/venv/lib/python3.6/site-packages (from pappyproxy==0.3.1) (2.2.0)
Requirement already satisfied: pyperclip>=1.5.27 in /root/.pappy/venv/lib/python3.6/site-packages (from cmd2>=0.6.8->pappyproxy==0.3.1) (1.6.2)
Requirement already satisfied: colorama in /root/.pappy/venv/lib/python3.6/site-packages (from cmd2>=0.6.8->pappyproxy==0.3.1) (0.3.9)
Requirement already satisfied: wcwidth; sys_platform != "win32" in /root/.pappy/venv/lib/python3.6/site-packages (from cmd2>=0.6.8->pappyproxy==0.3.1) (0.1.7)
Requirement already satisfied: MarkupSafe>=0.23 in /root/.pappy/venv/lib/python3.6/site-packages (from Jinja2>=2.8->pappyproxy==0.3.1) (1.0)
Installing collected packages: pappyproxy
  Found existing installation: pappyproxy 0.3.1
    Uninstalling pappyproxy-0.3.1:
      Successfully uninstalled pappyproxy-0.3.1
  Running setup.py develop for pappyproxy
Successfully installed pappyproxy

Pappy installed. Run pappy by executing the generated "start" script.

But there is an issue when .start

Traceback (most recent call last):
  File "/root/.pappy/venv/bin/pappy", line 11, in <module>
    load_entry_point('pappyproxy', 'console_scripts', 'pappy')()
  File "/root/Github/pappy-proxy/pappyproxy/pap.py", line 142, in start
    main()
  File "/root/Github/pappy-proxy/pappyproxy/pap.py", line 134, in main
    interface_loop(client)
  File "/root/Github/pappy-proxy/pappyproxy/console.py", line 32, in interface_loop
    cons.cmdloop()
  File "/root/.pappy/venv/lib/python3.6/site-packages/cmd2/cmd2.py", line 3052, in cmdloop
    parser = argparse.ArgumentParser()
  File "/usr/lib/python3.6/argparse.py", line 1631, in __init__
    prog = _os.path.basename(_sys.argv[0])
IndexError: list index out of range

The repeter functionality of pappy seems to have stopped working for me since I updated to python 3.8. I haven't tried downgrading yet to confirm the issue but wanted to bring it to your attention at any rate. I get this warning in vim when trying to open repeter from pappy.

Vim must support python in order to use the repeater
Error detected while processing command line:
E492: Not an editor command: RepeaterSetup 4 1 unix:/tmp/proxy.40599.1574867861082597735.sock
Press ENTER or type command to continue

Vim is compiled with python support:

$ vim --version | grep python
+cmdline_hist      +langmap           +python/dyn        +visual
+cmdline_info      +libcall           +python3/dyn       +visualextra

Is anyone else experiencing this issue?

When using a macro to fuzz a webapp, users have to wait until the macro is completed and can't test other parts of the webapp.

It is desireable to run a second pappy instance without the proxy that accesses the state of the first instance. Currently a error message is thrown (since the second pappy instance tries to start the proxy and rebind the port that the proxy of the first pappy instance is already using) and the request list is not updated (e.g. when using ls or watch).

The alternative solution would be to allow minimizing running macros to background, but I'd prefer the former since that'd also allow multiplexing via tmux or tiling WMs, etc.

pip install pappy
Collecting pappy
  Using cached pappy-0.91.tar.gz
    Complete output from command python setup.py egg_info:
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/tmp/pip-build-pJrzAI/pappy/setup.py", line 2, in <module>
        from Pyrex.Distutils.extension import Extension
    ImportError: No module named Pyrex.Distutils.extension
    
    ----------------------------------------
Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-build-pJrzAI/pappy/

OS: 4.12.0-kali2-amd64 #1 SMP Debian 4.12.12-2kali1 (2017-09-13) x86_64 GNU/Linux
Python: Python 2.7.13
Pip: pip 9.0.1 from /usr/lib/python2.7/dist-packages (python 2.7)

I'd really love if this tool had a TUI interface (e.g. using curses/urwid/npyscreen) for browsing requests and sending them to the repeater, etc.

Would something like this be in scope of this project?

Some printable symbols, for example russian letters (you can find it on http://ya.ru title) replaced by dots in printable_data func. Maybe it should use some other check, unicodedata.category or something like this.

Hi all,

on executing install.sh I get:

█~/pappy-proxy/ ./install.sh
Already up to date.
Getting puppy dependencies...
go: go.mod file not found in current directory or any parent directory.
'go get' is no longer supported outside a module.
To build and install a command, use 'go install' with a version,
like 'go install example.com/cmd@latest'
For more information, see https://golang.org/doc/go-get-install-deprecation
or run 'go help get' or 'go help install'.
Error running /usr/local/go/bin/go get ./..., exiting...

I'm new to GO...any suggestions?
Thank you very much.
█

Hi there,

Keen on trying pappy out, but after following the installation instructions, creating a a folder and running pappy from the command line I get the following error:

[root@debian-dev test_project]# pappy
Traceback (most recent call last):
  File "/usr/local/bin/pappy", line 5, in 
    from pkg_resources import load_entry_point
  File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2876, in 
    working_set = WorkingSet._build_master()
  File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 451, in _build_master
    return cls._build_from_requirements(__requires__)
  File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 464, in _build_from_requirements
    dists = ws.resolve(reqs, Environment())
  File "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 639, in resolve
    raise DistributionNotFound(req)
pkg_resources.DistributionNotFound: cryptography>=0.7

I am not sure what the problem is. The output of pip freeze on my debian box is here http://pastie.org/private/f30wsdno81nxsk4ifypba

I tried installing the dependency mentioned on that error but that is already installed. Attempting an upgrade fails with an "ImportError: No module named setuptools_ext" error. I have python-setuptools on that box.

Thanks!
Pedro

The Burp Active Scanner is quite useful for finding issues and testing webapps for potential weaknesses automatically. Also, using Burps intruder to mark insertion points and then chosing "actively scan defined insertion points" is also neat.

Pappy is currently missing such a feature.

Hi,

I am getting the following when trying to use pappy on a site I am testing.

error submitting request: remote error: tls: handshake failure

I have imported the certificate and it is working for other sites with an ssl.

Installation

Pappy supports OS X and Linux (sorry Windows). Installation requires pip or some other command that can handle a setup.py with requirements. Once the requirements are installed, you can check that it installed correctly by running pappy -l to start the proxy.

$ git clone --recursive https://github.com/roglew/pappy-proxy.git
$ cd pappy-proxy
$ pip install .

^^^ pip install what?

I'm unable to run pappy due to what appears to be an unmet dependancy.

Steps Taken

Install

$ git clone --recursive https://github.com/roglew/pappy-proxy.git
$ cd pappy-proxy
$ pip install .
$ mkdir natas
$ cd natas

Run pappy -l

Traceback (most recent call last):
  File "/usr/local/bin/pappy", line 11, in <module>
    load_entry_point('pappyproxy==0.3.1', 'console_scripts', 'pappy')()
  File "/Library/Python/2.7/site-packages/pkg_resources/__init__.py", line 567, in load_entry_point
    return get_distribution(dist).load_entry_point(group, name)
  File "/Library/Python/2.7/site-packages/pkg_resources/__init__.py", line 2604, in load_entry_point
    return ep.load()
  File "/Library/Python/2.7/site-packages/pkg_resources/__init__.py", line 2264, in load
    return self.resolve()
  File "/Library/Python/2.7/site-packages/pkg_resources/__init__.py", line 2270, in resolve
    module = __import__(self.module_name, fromlist=['__name__'], level=0)
ImportError: No module named pappyproxy.pap

Versions

pip Version: 9.0.1
Python Version: 2.7

What needs to be installed in order to meet the pappyproxy.pap requirement?

Support for Python 3 would be really nice, especially since it features proper separation between str and bytes types.

pappy: error: unrecognized arguments: -l
✘  ~/p/jerry   master  pappy
Traceback (most recent call last):
File "/data/data/com.termux/files/usr/bin/pappy", line 11, in
load_entry_point('pappyproxy==0.3.1', 'console_scripts', 'pappy')()
File "/data/data/com.termux/files/usr/lib/python3.7/site-packages/pappyproxy/pap.py", line 142, in start
main()
File "/data/data/com.termux/files/usr/lib/python3.7/site-packages/pappyproxy/pap.py", line 92, in main
with ProxyClient(binary=binloc, conn_addr=msg_addr, debug=args.debug) as client:
File "/data/data/com.termux/files/usr/lib/python3.7/site-packages/pappyproxy/proxy.py", line 1173, in enter
self.execute_binary(binary=self.binloc, debug=self.debug)
File "/data/data/com.termux/files/usr/lib/python3.7/site-packages/pappyproxy/proxy.py", line 1201, in execute_binary
self.proxy_proc = Popen(args, stdout=PIPE, stderr=PIPE)
File "/data/data/com.termux/files/usr/lib/python3.7/subprocess.py", line 775, in init
restore_signals, start_new_session)
File "/data/data/com.termux/files/usr/lib/python3.7/subprocess.py", line 1520, in _execute_child
raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: '/data/data/com.termux/files/home/storage/storage/sdcard0/htdocs/go/bin/puppy': '/data/data/com.termux/files/home/storage/storage/sdcard0/htdocs/go/bin/puppy'
✘  ~/

...its gave me this error how can i fix this bro

I want to modify the request header and request body on specific url automatically, how do I do it, if using a plugin, can anyone provide a simple example of the plugin source code to modify it?