wsltools: Web Scan Lazy Tools

https://img.shields.io/pypi/v/wsltools.svg https://img.shields.io/pypi/l/wsltools.svg https://img.shields.io/pypi/wheel/wsltools.svg https://img.shields.io/pypi/pyversions/wsltools.svg

wsltools is an elegant and simple Web Scan auxiliary library for Python.


Installation:

>>> pip install wsltools

Basic Use:

In[0]: from wsltools import *
In[1]: payloads = ['-Symbo1-']
In[2]: url = 'https://www.example.com/path/index;params?a=1&b=2&c=3#fragment'
In[3]: urlclean.mixPayload(url, payloads, ['path', 'query', 'params'])
Out[3]: ['https://www.example.com/-Symbo1-/index;params?a=1&b=2&c=3#fragment',
'https://www.example.com/path/index;-Symbo1-?a=1&b=2&c=3#fragment',
'https://www.example.com/path/index;params?a=-Symbo1-&b=3&c=2#fragment',
'https://www.example.com/path/index;params?a=1&b=-Symbo1-&b=2#fragment',
'https://www.example.com/path/index;params?a=1&b=3&c=-Symbo1-#fragment']

Introduction

wsltools - Web Scan Lazy Tools (Python Package) 是开源的web扫描辅助集,在构建web爬虫/扫描器的基础上节省可通用实现的功能,例如:正文相似度判断、url多种处理、域名处理、正文/数据类型判断、处理/识别http响应基础安全、参数/表单数据填充等。兼容Python 2/3,开箱即用。

Implication

当我们使用Python构建web爬虫时,可以使用requests/urlparse/scrapy等优秀的三方库,基本不需要我们去处理繁琐/可通用实现的基础功能。

当我们构建漏洞扫描器时,会倾向于结合poc框架来实现。poc框架有很多,但至今编写poc并没有绝对的通用标准模版,也不需要有。不过这些poc框架或传统漏扫,会依赖于一些通用的扫描/检测基础方法论,所以完全可以合并这些方法论的具体实现。说到依赖的通用方法论,那么bin世界的pwntools就是这种类型。

wsltools提供的功能都不是复杂的实现,只是尽可能的提供一些便利,同时也可以作为爬虫/扫描器初学者的学习资料。

urlclean

该模块会对url进行清理:

  • ast 分析url每块部位的数据类型并进行替换
  • etl 分析url每块部位的每个字符数据类型并进行替换
  • pathSplit 拆分url path根据相对路径返回url列表
  • mixPayload 提供一个payload列表,将其组合进url指定部位

ast

Method ast(url, scope=[])

scope - [path, params, query, fragment], Default By All

In[0]: from wsltools.urlclean import ast
In[1]: scope = ['path', 'query']
In[2]: ast('https://www.example.com/path/index;params?a=query1&b=2#fragment', scope=scope)
Out[2]: 'https://www.example.com/string/string;params?a=string&b=numeric#fragment'

Support Type:

  • path - numeric/string
  • params - numeric/string
  • query - numeric/string/domain/ip/text/url
  • fragment - numeric/string

etl

Method etl(url, scope=[])

scope - [path, params, query, fragment], Default By All

In[0]: from wsltools.urlclean import etl
In[1]: scope = ['path', 'query']
In[2]: etl('https://www.example.com/path/index;params?a=query1&b=2#fragment', scope=scope)
Out[2]: 'https://www.example.com/AAAA/AAAAA;params?a=AAAAAN&b=N#fragment'

Implication:

  • E - Empty
  • A - Alphabet
  • N - Number
  • S - Symbol
  • O - Other

pathSplit

Method pathSplit(url)
In[0]: from wsltools.urlclean import pathSplit
In[1]: pathSplit('https://www.example.com/path1/path2/path3/index;params?a=query1&b=2#fragment')
Out[1]:
['https://www.example.com/path1/path2/path3/', 'https://www.example.com/path1/', 'https://www.example.com/path1/path2/', 'https://www.example.com/']

mixPayload

Method mixPayload(url, payloads, scope=[], append=True)
  • payloads - [payload list]
  • scope - [path, params, query, fragment], Default By All
  • append - append payload for params/query/fragment, Default is False
In[0]: from wsltools.urlclean import mixPayload
In[1]: payloads = ['-Symbo1-']
In[2]: url = 'https://www.example.com/path/index;params?a=1&b=2&c=3#fragment'
In[3]: mixPayload(url, payloads, ['path', 'query', 'params'])
Out[3]: ['https://www.example.com/-Symbo1-/index;params?a=1&b=2&c=3#fragment',
'https://www.example.com/path/index;-Symbo1-?a=1&b=2&c=3#fragment',
'https://www.example.com/path/index;params?a=-Symbo1-&b=3&c=2#fragment',
'https://www.example.com/path/index;params?a=1&b=-Symbo1-&b=2#fragment',
'https://www.example.com/path/index;params?a=1&b=3&c=-Symbo1-#fragment']

# use append:
In[4]: mixPayload(url, payloads, ['query', 'params', 'fragement'], append=True)
Out[4]: ['https://www.example.com/path/index;params?a=1&c=3-symbo1-&b=2#fragment',
'https://www.example.com/path/index;params-symbo1-?a=1&b=2&c=3#fragment',
'https://www.example.com/path/index;params?a=1&b=2&c=3#fragment-symbo1-',
'https://www.example.com/path/index;params?a=1&c=3&b=2-symbo1-#fragment',
'https://www.example.com/path/index;params?a=1-symbo1-&c=3&b=2#fragment']

checksec

Warning

该模块仅可识别/拆分基本http响应附带的安全属性,不做其他例如Bypass等处理。

Check Web Application Firewall

checkWaf

Method checkWaf(content)

传入Response正文进行匹配是否存在waf特征

In[0]: from wsltools.checksec import checkWaf
In[1]: import requests
In[2]: checkWaf(requests.get('http://www.cloudflare.com/?xss=<script>alert(/xss/)</script>').content)
Out[2]: cloudflare

updateRules

Method updateRules()

sqlmap/wafRules 拉取waf特征进行更新

In[0]: from wsltools.checksec import updateRules
In[1]: updateRules()
Out[1]:
! 360
+ checkpoint
+ ithemes
+ tmg
+ wapples

Check HTTP Response Headers

识别并拆分主流安全策略相关的Headers,由于开发人员配置的不同会导致格式不一致,比如存在crlf。只要是浏览器可以识别的格式,都可以精确拆分。

checkHeaders

Method checkHeaders(HTTP Response Headers)

传入一个标准的HTTP Response headers字典,将精确拆分这些安全相关的value字符串。

In[0]: from pprint import pprint
In[1]: from wsltools.checksec import checkHeaders
In[2]: import requests
In[3]: headers = requests.get('https://www.paypal.com/').headers
In[4]: pprint(checkHeaders(headers))
Out[4]:
{'content-security-policy': {'base-uri': ['self', 'https://*.paypal.com'],
                         'connect-src': ['self',
                                         'https://nominatim.openstreetmap.org',
                                         'https://*.paypal.com',
                                         'https://*.paypalobjects.com',
                                         'https://*.google-analytics.com',
                                         'https://*.salesforce.com',
                                         'https://*.force.com',
                                         'https://*.eloqua.com',
                                         'https://nexus.ensighten.com',
                                         'https://api.paypal-retaillocator.com',
                                         'https://*.brighttalk.com',
                                         'https://*.sperse.io',
                                         'https://*.dialogtech.com'],
                         'default-src': ['self',
                                         'https://*.paypal.com',
                                         'https://*.paypalobjects.com'],
                         'font-src': ['self',
                                      'https://*.paypal.com',
                                      'https://*.paypalobjects.com',
                                      'https://assets-cdn.s-xoom.com',
                                      'data:'],
                         'form-action': ['self',
                                         'https://*.paypal.com',
                                         'https://*.salesforce.com',
                                         'https://*.eloqua.com',
                                         'https://secure.opinionlab.com'],
                         'frame-ancestors': ['self',
                                             'https://*.paypal.com'],
                         'frame-src': ['self',
                                       'https://*.brighttalk.com',
                                       'https://*.paypal.com',
                                       'https://*.paypalobjects.com',
                                       'https://www.youtube-nocookie.com',
                                       'https://www.xoom.com',
                                       'https://www.wootag.com'],
                         'img-src': ['self', 'https:', 'data:'],
                         'object-src': ['none'],
                         'other': ['block-all-mixed-content'],
                         'report-uri': 'https://www.paypal.com/csplog/api/log/csp',
                         'script-src': ['nonce-dmnrj8qfpovrm2bv4ybke6tpgbmlhizeqrg/bqisl7m5znik',
                                        'self',
                                        'https://*.paypal.com',
                                        'https://*.paypalobjects.com',
                                        'https://assets-cdn.s-xoom.com',
                                        'unsafe-inline',
                                        'unsafe-eval'],
                         'style-src': ['self',
                                       'https://*.paypal.com',
                                       'https://*.paypalobjects.com',
                                       'https://assets-cdn.s-xoom.com',
                                       'unsafe-inline']},
'strict-transport-security': {'max-age': '63072000'},
'x-content-type-options': 'nosniff',
'x-frame-options': {'sameorigin': True},
'x-xss-protection': {'enable': True, 'mode': 'block'}}

x_xss_protection

Method x_xss_protection(value string)
In[0]: from wsltools.checksec import x_xss_protection
In[1]: headers = {'X-Xss-Protection': '1; mode = block; report=https://report-uri.com/r/d/xss/enforce'}
In[2]: x_xss_protection(headers['X-Xss-Protection'])
Out[2]:
{'enable': True,
 'mode': 'block',
 'report': 'https://report-uri.com/r/d/xss/enforce'}

content_security_policy

Method content_security_policy(value string)
In[0]: from pprint import pprint
In[1]: from wsltools.checksec import content_security_policy
In[2]: headers = {'Content-Security-Policy': "default-src 'self' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.brighttalk.com https://*.paypal.com https://*.paypalobjects.com https://www.youtube-nocookie.com https://www.xoom.com https://www.wootag.com; script-src 'nonce-dMNrj8qFpOVrM2Bv4yBKe6TPgBMlHizeqRg/BqiSl7M5Znik' 'self' https://*.paypal.com https://*.paypalobjects.com https://assets-cdn.s-xoom.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' https://nominatim.openstreetmap.org https://*.paypal.com https://*.paypalobjects.com https://*.google-analytics.com https://*.salesforce.com https://*.force.com https://*.eloqua.com https://nexus.ensighten.com https://api.paypal-retaillocator.com https://*.brighttalk.com https://*.sperse.io https://*.dialogtech.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com https://assets-cdn.s-xoom.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com https://assets-cdn.s-xoom.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com https://*.salesforce.com https://*.eloqua.com https://secure.opinionlab.com; base-uri 'self' https://*.paypal.com; object-src 'none'; frame-ancestors 'self' https://*.paypal.com; block-all-mixed-content; report-uri https://www.paypal.com/csplog/api/log/csp"}
In[3]: pprint(content_security_policy(headers['Content-Security-Policy']))
Out[3]:
{'base-uri': ['self', 'https://*.paypal.com'],
 'connect-src': ['self',
                 'https://nominatim.openstreetmap.org',
                 'https://*.paypal.com',
                 'https://*.paypalobjects.com',
                 'https://*.google-analytics.com',
                 'https://*.salesforce.com',
                 'https://*.force.com',
                 'https://*.eloqua.com',
                 'https://nexus.ensighten.com',
                 'https://api.paypal-retaillocator.com',
                 'https://*.brighttalk.com',
                 'https://*.sperse.io',
                 'https://*.dialogtech.com'],
 'default-src': ['self', 'https://*.paypal.com', 'https://*.paypalobjects.com'],
 'font-src': ['self',
              'https://*.paypal.com',
              'https://*.paypalobjects.com',
              'https://assets-cdn.s-xoom.com',
              'data:'],
 'form-action': ['self',
                 'https://*.paypal.com',
                 'https://*.salesforce.com',
                 'https://*.eloqua.com',
                 'https://secure.opinionlab.com'],
 'frame-ancestors': ['self', 'https://*.paypal.com'],
 'frame-src': ['self',
               'https://*.brighttalk.com',
               'https://*.paypal.com',
               'https://*.paypalobjects.com',
               'https://www.youtube-nocookie.com',
               'https://www.xoom.com',
               'https://www.wootag.com'],
 'img-src': ['self', 'https:', 'data:'],
 'object-src': ['none'],
 'other': ['block-all-mixed-content'],
 'report-uri': 'https://www.paypal.com/csplog/api/log/csp',
 'script-src': ['nonce-dMNrj8qFpOVrM2Bv4yBKe6TPgBMlHizeqRg/BqiSl7M5Znik',
                'self',
                'https://*.paypal.com',
                'https://*.paypalobjects.com',
                'https://assets-cdn.s-xoom.com',
                'unsafe-inline',
                'unsafe-eval'],
 'style-src': ['self',
               'https://*.paypal.com',
               'https://*.paypalobjects.com',
               'https://assets-cdn.s-xoom.com',
               'unsafe-inline']}

content_security_policy_report_only

Method content_security_policy_report_only(value string)

Same content_security_policy

x_content_security_policy

Method x_content_security_policy(value string)

Same content_security_policy

x_webkit_csp

Method x_webkit_csp(value string)

Same content_security_policy

feature_policy

Method feature_policy(value string)

Same content_security_policy

x_frame_options

Method x_frame_options(value string)
In[0]: from wsltools.checksec import x_frame_options
In[1]: headers = {'X-Frame-Options': 'allow-from  http://symbo1.com/, http://google.com/'}
In[2]: x_frame_options(headers['X-Frame-Options'])
Out[2]: {'allow-from': ['http://symbo1.com/', 'http://google.com/']}

In[3]: headers = {'X-Frame-Options': 'sameorigin'}
In[4]: x_frame_options(headers['X-Frame-Options'])
Out[4]: {'sameorigin': True}

In[5]: headers = {'X-Frame-Options': 'deny'}
In[6]: x_frame_options(headers['X-Frame-Options'])
Out[6]: {'deny': True}

access_control_allow_methods

Method access_control_allow_methods(value string)
In[0]: from wsltools.checksec import access_control_allow_methods
In[1]: headers = {'Access-Control-Allow-Methods': 'GET , POST, PUT, '}
In[2]: access_control_allow_methods(headers['Access-Control-Allow-Methods'])
Out[2]: ['GET', 'POST', 'PUT']

access_control_allow_headers

Method access_control_allow_headers(value string)
In[0]: from wsltools.checksec import access_control_allow_headers
In[1]: headers = {'Access-Control-Allow-Headers': ' Origin , X-Requested-With, Content-Type, Accept , '}
In[2]: access_control_allow_headers(headers['Access-Control-Allow-Headers'])
Out[2]: ['Origin', 'X-Requested-With', 'Content-Type', 'Accept']

access_control_expose_headers

Method access_control_expose_headers(value string)
In[0]: from wsltools.checksec import access_control_expose_headers
In[1]: headers = {'Access-Control-Expose-Headers': ' Content-Length , Content-Range'}
In[2]: access_control_expose_headers(headers['Access-Control-Expose-Headers'])
Out[2]: ['Content-Length', 'Content-Range']

strict_transport_security

Method strict_transport_security(value string)
In[0]: from wsltools.checksec import strict_transport_security
In[1]: headers = {'Strict-Transport-Security': 'max-age = 16070400 ; includeSubDomains ; preload'}
In[2]: strict_transport_security(headers['Strict-Transport-Security'])
Out[2]: {'max-age': '16070400', 'other': ['preload']}

public_key_pins

Method public_key_pins(value string)
In[0]: from wsltools.checksec import public_key_pins
In[1]: headers = {'Public-Key-Pins': 'pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs= "; pin-sha256 ="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE="; max-age =5184000; includeSubDomains; report-uri = " https://www.example.org/hpkp-report"'}
In[2]: public_key_pins(headers['Public-Key-Pins'])
Out[2]:
{'max-age': '5184000',
'pin-sha256': ['cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=',
'M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE='],
'report-uri': 'https://www.example.org/hpkp-report'}

public_key_pins_report_only

Method public_key_pins_report_only(value string)

Same public_key_pins

Other about Security Header

以下headers本身没有复杂的value,便原样输出:

  • access-control-allow-credentials
  • access-control-allow-origin
  • access-control-max-age
  • x-content-type-options
  • referrer-policy
  • x-download-options
  • x-permitted-cross-domain-policies
  • x-ratelimit-limit
  • x-ratelimit-remaining
  • x-ratelimit-reset
  • x-rate-limit-limit
  • x-rate-limit-remaining
  • x-rate-limit-reset

datatype

通过url suffix/content-type判断response类型未必精准,e.g. Content Sniffing ,还可以借助此方法扫描备份/敏感文件等。

如果判断流文件,image/audio/video/document/archive,支持类型可参考 Stream Support Types

datatype

Method datatype(datas, scope=[], decrange=[])
  • scope - [ip, domain, xml, numeric, text, json, jsonp, serialize, url, image, audio, video, document, archive] Default By All
  • decrange - #for istext()# Dec Range e.g range(32,127): normal char. Default By All
In[0]: from wsltools.datatype import datatype
In[1]: import requests
In[2]: datatype(requests.get('https://www.symbo1.com/feed.xml').content)
Out[2]: xml

isnumeric

Method isnumeric(datas)
In[0]: from wsltools.datatype import isnumeric
In[1]: isnumeric('-1.1')
Out[1]: True

istext

Method istext(datas, decrange=[])

decrange - Dec Range e.g range(32,127): normal char. Default By All

由于数据类型过多,HTTP Response可能返回frontend等等数据类型。如果需要匹配字符串如flag/密文, 可以指定十进制的范围,例如33-126: range(33,127) ,即除了空格以外的正常字符。或 [1,range(10,30),2] 等。

In[0]: from wsltools.datatype import istext
In[1]: istext('U3ltYm8x', decrange=range(33,127))
Out[1]: True

isxml

Method isxml(datas)
In[0]: from wsltools.datatype import isxml
In[1]: import requests
In[2]: isxml(requests.get('https://www.symbo1.com/feed.xml').content)
Out[2]: True

isjson

Method isjson(datas)
In[0]: from wsltools.datatype import isjson
In[1]: isjson('{"site":[{"id":"1","name":"Symbo1","url":"www.symbo1.com"}]}')
Out[1]: True

isjsonp

Method isjsonp(datas)
In[0]: from wsltools.datatype import jsjsonp
In[1]: isjsonp('symbo1({"site":[{"name":"Symbo1","url":"www.symbo1.com"}]})')
Out[1]: True

isurl

Method isurl(datas)

isurl Support Schemes

In[0]: from wsltools.datatype import isurl
In[1]: isurl('rsync://www.symbo1.com/')
Out[1]: True

isip

Method isip(datas)

Support Ipv4/6

In[0]: from wsltools.datatype import isip
In[1]: isip('2404:6800:4012:1::200e')
Out[1]: True

isdomain

Method isdomain(datas)

不会发起任何请求,会调用 domain 判断是否为合法domain格式。

In[0]: from wsltools.datatype import isdomain
In[1]: isdomain('symbo1.com')
Out[1]: True

isserialize

Method isserialize(datas)
In[0]: from wsltools.datatype import isserialize
In[1]: isserialize('a:3:{s:12:"merchantname";i:3;s:8:"zip_city";i:1;s:4:"sent";r:2;}')
Out[1]: True

isimage

Method isimage(datas)
In[0]: from wsltools.datatype import isimage
In[1]: import requests
In[2]: isimage(requests.get('https://statics.symbo1.com/file/symbo1/logo.png').content)
Out[2]: True

isaudio

Method isaudio(datas)
In[0]: from wsltools.datatype import isaudio
In[1]: import requests
In[2]: isaudio(requests.get('https://www.example.com/symbo1.mp3').content)
Out[2]: True

isvideo

Method isvideo(datas)
In[0]: from wsltools.datatype import isvideo
In[1]: import requests
In[2]: isvideo(requests.get('https://www.example.com/symbo1.mp4').content)
Out[2]: True

isdocument

Method isdocument(datas)
In[0]: from wsltools.datatype import isdocument
In[1]: import requests
In[2]: isdocument(requests.get('https://www.example.com/symbo1.pdf').content)
Out[2]: True

isarchive

Method isarchive(datas)
In[0]: from wsltools.datatype import isarchive
In[1]: import requests
In[2]: isarchive(requests.get('https://www.example.com/symbo1.zip').content)
Out[2]: True

isurl Support Schemes

  • rtsp
  • gopher
  • file
  • rtspu
  • git+ssh
  • ftp
  • rsync
  • git
  • s3
  • shttp
  • nntp
  • http
  • https
  • telnet
  • ws
  • mms
  • wais
  • imap
  • svn
  • prospero
  • svn+ssh
  • sftp
  • wss
  • vnc
  • ldap
  • ldaps

Stream Support Types

  • JPG
  • PNG
  • GIF
  • TIF
  • ICO
  • MP3
  • RAM
  • WAV
  • MID
  • M4A
  • SWF
  • MOV
  • RMVB
  • FLV
  • MP4
  • MPG
  • WMV
  • AVI
  • WMA
  • ASF
  • PDF
  • PST
  • OST
  • EML
  • LZ
  • RPM
  • CAB
  • GZIP
  • RAR
  • ISO
  • 7ZIP
  • IMG
  • ZIP
  • JAR
  • APK
  • DEB
  • XZ
  • DMG
  • BZ2
  • TBZ2
  • DOCX/XSLX/PPTX …
  • DOC/XLS/PPT/WPS …

similar

similar

Method similar(content1, content2, engine='difflib')

engine - difflib or simhash, Default By difflib

In[0]: from wsltools import similar
In[1]: import requests
In[2]: a = requests.get("https://www.symbo1.com/404notFoundPages").content
In[3]: b = requests.get("https://www.symbo1.com/spiderHere").content
In[4]: similar(a, b)
Out[4]: True

faker

该模块主要用于爬虫/扫描器在动态爬取的同时可生成对应需要填充的数据,例如搜索参数/注册登陆表单等。

而且实现代码并不多,是因为调用了 joke2k/faker 。对其做了很多改动。保留了主要的数据生成provider,并fixed几个本地化语言的bug,感兴趣可以将 wsltools/utils/faker/ 与原Package diff对比。

Instance

Class faker(Locale code)

Locale code - Support Locales code , Default By en

In[0]: from wsltools import faker
In[1]: faker('en_US')
Out[1]: <class: faker en_US>

profile

Attribute profile
In[0]: from pprint import pprint
In[1]: from wsltools import faker
In[2]: obj = faker()
In[3]: pprint(obj.profile)
Out[3]:
{'address': '761 Perez Village Apt. 282\nWest John, NE 36491',
 'birthdate': datetime.date(1911, 10, 26),
 'company': 'Johnston PLC',
 'credit_card': {'code': '036',
                 'expire': '01/30',
                 'first_name': 'Jennifer',
                 'last_name': 'Harris',
                 'name': 'Jennifer Harris',
                 'number': '3553426503431050',
                 'security': 'CVC',
                 'type': 'jcb16',
                 'type_full': 'JCB 16 digit'},
 'first_name': 'Jennifer',
 'job': 'Speech and language therapist',
 'last_name': 'Harris',
 'mail': 'ashley97@yahoo.com',
 'name': 'Jennifer Harris',
 'phone': '979-648-3157',
 'residence': '213 Darrell Wells Suite 305\nSouth Manuelmouth, CT 64277',
 'sex': 'M',
 'ssn': '893-66-9475',
 'username': 'ramirezchristina',
 'website': 'http://www.parker.org/'}

userAgent

Method userAgent(platform='desktop')

platform - desktop or mobile, Default By desktop

In[0]: from wsltools import faker
In[1]: obj = faker()
In[2]: obj.userAgent(platform='mobile')
Out[2]: Mozilla/5.0 (iPod; U; CPU iPhone OS 4_1 like Mac OS X; iu-CA) AppleWebKit/534.19.7 (KHTML, like Gecko) Version/4.0.5 Mobile/8B116 Safari/6534.19.7

creditCard

Method creditCard(card_type=Card Type)

card_type - Support Credit Card Types , Default By random choice

In[0]: from pprint import pprint
In[1]: from wsltools import faker
In[2]: obj = faker()
In[3]: pprint(obj.creditCard())
Out[3]:
{'code': '529',
 'expire': '09/24',
 'first_name': 'Derek',
 'last_name': 'Barrett',
 'name': 'Derek Barrett',
 'number': '4375995106301',
 'security': 'CVC',
 'type': 'visa13',
 'type_full': 'VISA 13 digit'}

email

Attribute email
In[0]: from wsltools import faker
In[1]: obj = faker()
In[2]: obj.email
Out[2]: wsmith@griffin-wright.biz

name

Attribute name
In[0]: from wsltools import faker
In[1]: obj = faker()
In[2]: obj.name
Out[2]: {'first_name': 'Lori', 'last_name': 'Williams', 'name': 'Lori Williams'}

ssn

Attribute ssn
In[0]: from wsltools import faker
In[1]: obj = faker()
In[2]: obj.ssn
Out[2]: 833-22-4862

phone

Attribute phone
In[0]: from wsltools import faker
In[1]: obj = faker()
In[2]: obj.phone
Out[2]: (062)144-8497x2311

job

Attribute job
In[0]: from wsltools import faker
In[1]: obj = faker()
In[2]: obj.job
Out[2]: Chartered legal executive (England and Wales)

company

Attribute company
In[0]: from wsltools import faker
In[1]: obj = faker()
In[2]: obj.company
Out[2]: Kennedy PLC

address

Attribute address
In[0]: from wsltools import faker
In[1]: obj = faker()
In[2]: obj.address
Out[2]:
01065 Armstrong Streets Apt. 665
Markfort, AL 85969

Support Credit Card Types

  • maestro - Maestro
  • discover - Discover
  • jcb15 - JCB 15 digit
  • jcb16 - JCB 16 digit
  • visa13 - VISA 13 digit
  • visa16 - VISA 16 digit
  • visa19 - VISA 19 digit
  • mastercard - Mastercard
  • amex - American Express
  • diners - Diners Club / Carte Blanch

If locale code use fa_IR:

  • ansar - انصار
  • iran_zamin - ایران زمین
  • hekmat - حکمت
  • keshavarzi - کشاورزی
  • shahr - شهر
  • mehre_ghtesad - مهراقتصاد
  • sarmayeh - سرمایه
  • post_bank - پست بانک
  • tose - توسعه
  • eghtesad_novin - اقتصاد نوین
  • meli - ملی
  • pasargad - پاسارگاد
  • tourism_bank - گردشگری
  • ghavamin - قوامین
  • day - دی
  • mellat - ملت
  • tejarat - تجارت
  • mellal - ملل
  • saman - سامان
  • kosar - کوثر
  • refah - رفاه
  • saderat - صادرات
  • tat - تات
  • sina - سینا
  • kar_afarin - کار آفرین
  • sepah - سپه
  • maskan - مسکن
  • parsian - پارسیان
  • bim - صنعت و معدن

Support Locales code

  • ar_EG - Arabic (Egypt)
  • ar_PS - Arabic (Palestine)
  • ar_SA - Arabic (Saudi Arabia)
  • bg_BG - Bulgarian
  • bs_BA - Bosnian
  • cs_CZ - Czech
  • de_DE - German
  • dk_DK - Danish
  • el_GR - Greek
  • en_AU - English (Australia)
  • en_CA - English (Canada)
  • en_GB - English (Great Britain)
  • en_IN - English (India)
  • en_NZ - English (New Zealand)
  • en_US - English (United States)
  • es_ES - Spanish (Spain)
  • es_MX - Spanish (Mexico)
  • et_EE - Estonian
  • fa_IR - Persian (Iran)
  • fi_FI - Finnish
  • fr_FR - French
  • hi_IN - Hindi
  • hr_HR - Croatian
  • hu_HU - Hungarian
  • hy_AM - Armenian
  • it_IT - Italian
  • ja_JP - Japanese
  • ka_GE - Georgian (Georgia)
  • ko_KR - Korean
  • lt_LT - Lithuanian
  • lv_LV - Latvian
  • ne_NP - Nepali
  • nl_NL - Dutch (Netherlands)
  • no_NO - Norwegian
  • pl_PL - Polish
  • pt_BR - Portuguese (Brazil)
  • pt_PT - Portuguese (Portugal)
  • ro_RO - Romanian
  • ru_RU - Russian
  • sl_SI - Slovene
  • sv_SE - Swedish
  • tr_TR - Turkish
  • uk_UA - Ukrainian
  • zh_CN - Chinese (China)
  • zh_TW - Chinese (Taiwan)

domaintools

domain

Method domain(domain, main=Main Domain)

main - Default by Not Use

In[0]: from wsltools.domaintools import domain
In[1]: domain('www.symbo1.com', main='symbo1.com')
Out[1]: symbo1.com

valid

Attribute valid
In[0]: from wsltools.domaintools import domain
In[1]: domain('www.symbo1.com').valid
Out[1]: True

main

Attribute main
In[0]: from wsltools.domaintools import domain
In[1]: domain('sub.symbo1.com').main
Out[1]: symbo1.com

# if provide main domain:
In[2]: domaintools.domain("sub.example.symbo1.com",'example.symbo1.com').main
Out[2]: example.symbo1.com

sld

Attribute sld
In[0]: from wsltools.domaintools import domain
In[1]: domain('sub.symbo1.com').sld
Out[1]: symbo1

# if provide main domain:
In[2]: domaintools.domain("sub.example.symbo1.com",'example.symbo1.com').sld
Out[2]: example.symbo1

tld

Attribute tld
In[0]: from wsltools.domaintools import domain
In[1]: domain('sub.symbo1.com').tld
Out[1]: com

subdomain

Attribute subdomain
In[0]: from wsltools.domaintools import domain
In[1]: domain('sub.example.symbo1.com').subdomain
Out[1]: sub.example

# if provide main domain:
In[2]: domain("sub.example.symbo1.com",'example.symbo1.com').subdomain
Out[2]: sub

sublevel

Attribute sublevel

可以通过提供main的方式选取从哪里开始截取,所以sublevel的索引从0开始。

In[0]: from wsltools.domaintools import domain
In[1]: domain('sub.example.symbo1.com').sublevel
Out[1]: {0: 'example', 1: 'sub'}

# if provide main domain:
In[2]: domaintools.domain('sub.example.symbo1.com', 'example.symbo1.com').sublevel
Out[2]: {0: 'sub'}

subMatch

Method subMatch(subdomain, mainlist)
  • subdomain - e.g. test.symbo1.com
  • mainlist - e.g. [symbo1.com, example.com]

当自动化收集子域名时,可通过该方法判断是否准确,并返回以上的属性。

In[0]: from wsltools.domaintools import subMatch
In[1]: subMatch('www.symbo1.com', ['symbo1.com', 'google.com', 'apple.com'])
Out[1]: symbo1.com

# valid/main/sld/tld/subdomain/sublevel attribute:
In[2]: subMatch('sub3.sub2.sub1.symbo1.com', ['symbo1.com', 'google.com', 'apple.com']).sublevel
Out[2]: {0: 'sub1', 1: 'sub2', 2: 'sub3'}

updateTLDS

Method updateTLDS()
In[0]: from wsltools.domain import updateTLDS
In[1]: updateTLDS()
Out[1]:
+ llp
+ phd
+ onion
+ inc
+ xn--e1a4c
TLDS update process ends

Credits

Note

wsltools对以下优秀的三方库进行了魔改,并加以调用。虽然有些地方改动较多,但没有选择直接融合进wsltools主代码中,遵守开源规则单独存放。感谢你们:

google/ipaddr

joke2k/faker

devhub/domaintools

sqlmap/wafRules