search

commixproject / commix

Automated All-in-One OS Command Injection Exploitation Tool.
https://commixproject.com
Other
4.62k stars 819 forks source link

Bug Report: Unhandled exception "AttributeError: '_io.StringIO' object has no attribute 'getheaders'" (#735e2bf4) #983

Open commixreporter opened 2 days ago

commixreporter commented 2 days ago 
Commix version: 4.0-dev#106
Python version: 3.11.2
Operating system: posix
Command line: /usr/local/bin/commix -u *********************************** 
Traceback (most recent call last):
  File \"requests.py", line 95, in estimate_response_time
    response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 216, in urlopen
    return opener.open(url, data, timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 525, in open
    response = meth(req, response)
               ^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 634, in http_response
    response = self.parent.error(
               ^^^^^^^^^^^^^^^^^^
  File \"request.py", line 563, in error
    return self._call_chain(*args)
           ^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File \"request.py", line 643, in http_error_default
    raise HTTPError(req.full_url, code, msg, hdrs, fp)
urllib.error.HTTPError: HTTP Error 401: Unauthorized

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File \"headers.py", line 210, in check_http_traffic
    response = _urllib.request.urlopen(request, timeout=settings.TIMEOUT)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 216, in urlopen
    return opener.open(url, data, timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 525, in open
    response = meth(req, response)
               ^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 634, in http_response
    response = self.parent.error(
               ^^^^^^^^^^^^^^^^^^
  File \"request.py", line 557, in error
    result = self._call_chain(*args)
             ^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File \"request.py", line 1238, in http_error_401
    retry = self.http_error_auth_reqed('www-authenticate',
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1118, in http_error_auth_reqed
    return self.retry_http_digest_auth(req, authreq)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1132, in retry_http_digest_auth
    resp = self.parent.open(req, timeout=req.timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 525, in open
    response = meth(req, response)
               ^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 634, in http_response
    response = self.parent.error(
               ^^^^^^^^^^^^^^^^^^
  File \"request.py", line 557, in error
    result = self._call_chain(*args)
             ^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File \"request.py", line 1238, in http_error_401
    retry = self.http_error_auth_reqed('www-authenticate',
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1118, in http_error_auth_reqed
    return self.retry_http_digest_auth(req, authreq)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1132, in retry_http_digest_auth
    resp = self.parent.open(req, timeout=req.timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 525, in open
    response = meth(req, response)
               ^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 634, in http_response
    response = self.parent.error(
               ^^^^^^^^^^^^^^^^^^
  File \"request.py", line 557, in error
    result = self._call_chain(*args)
             ^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File \"request.py", line 1238, in http_error_401
    retry = self.http_error_auth_reqed('www-authenticate',
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1118, in http_error_auth_reqed
    return self.retry_http_digest_auth(req, authreq)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1132, in retry_http_digest_auth
    resp = self.parent.open(req, timeout=req.timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 525, in open
    response = meth(req, response)
               ^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 634, in http_response
    response = self.parent.error(
               ^^^^^^^^^^^^^^^^^^
  File \"request.py", line 557, in error
    result = self._call_chain(*args)
             ^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File \"request.py", line 1238, in http_error_401
    retry = self.http_error_auth_reqed('www-authenticate',
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1118, in http_error_auth_reqed
    return self.retry_http_digest_auth(req, authreq)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1132, in retry_http_digest_auth
    resp = self.parent.open(req, timeout=req.timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 525, in open
    response = meth(req, response)
               ^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 634, in http_response
    response = self.parent.error(
               ^^^^^^^^^^^^^^^^^^
  File \"request.py", line 557, in error
    result = self._call_chain(*args)
             ^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File \"request.py", line 1238, in http_error_401
    retry = self.http_error_auth_reqed('www-authenticate',
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1118, in http_error_auth_reqed
    return self.retry_http_digest_auth(req, authreq)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1132, in retry_http_digest_auth
    resp = self.parent.open(req, timeout=req.timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 525, in open
    response = meth(req, response)
               ^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 634, in http_response
    response = self.parent.error(
               ^^^^^^^^^^^^^^^^^^
  File \"request.py", line 557, in error
    result = self._call_chain(*args)
             ^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File \"request.py", line 1238, in http_error_401
    retry = self.http_error_auth_reqed('www-authenticate',
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1118, in http_error_auth_reqed
    return self.retry_http_digest_auth(req, authreq)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1132, in retry_http_digest_auth
    resp = self.parent.open(req, timeout=req.timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 525, in open
    response = meth(req, response)
               ^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 634, in http_response
    response = self.parent.error(
               ^^^^^^^^^^^^^^^^^^
  File \"request.py", line 557, in error
    result = self._call_chain(*args)
             ^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File \"request.py", line 1238, in http_error_401
    retry = self.http_error_auth_reqed('www-authenticate',
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"request.py", line 1111, in http_error_auth_reqed
    raise HTTPError(req.full_url, 401, "digest auth failed",
urllib.error.HTTPError: HTTP Error 401: digest auth failed

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/bin/commix", line 36, in <module>
    main()
  File "/usr/local/bin/commix", line 31, in main
    import src.core.main
  File \"main.py", line 899, in <module>
    main(filename, url, http_request_method)
  File \"main.py", line 560, in main
    controller.do_check(url, http_request_method, filename)
  File \"controller.py", line 743, in do_check
    perform_checks(url, http_request_method, filename)
  File \"controller.py", line 706, in perform_checks
    data_checks(url, http_request_method, filename, timesec)
  File \"controller.py", line 627, in data_checks
    if get_request(url, http_request_method, filename, timesec) is None:
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"controller.py", line 590, in get_request
    do_injection(found_url, settings.HTTPMETHOD.GET, header_name, url, http_request_method, filename, timesec)
  File \"controller.py", line 576, in do_injection
    injection_proccess(url, check_parameter, http_request_method, filename, timesec)
  File \"controller.py", line 330, in injection_proccess
    timesec, url_time_response = requests.estimate_response_time(url, timesec, http_request_method)
                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"requests.py", line 199, in estimate_response_time
    auth_creds = authentication.http_auth_cracker(url, realm, http_request_method)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"authentication.py", line 174, in http_auth_cracker
    headers.check_http_traffic(request)
  File \"headers.py", line 231, in check_http_traffic
    checks.not_declared_cookies(err)
  File \"checks.py", line 386, in not_declared_cookies
    for response_header in response.getheaders():
                           ^^^^^^^^^^^^^^^^^^^
  File \"tempfile.py", line 633, in __getattr__
    a = getattr(file, name)
        ^^^^^^^^^^^^^^^^^^^
AttributeError: '_io.StringIO' object has no attribute 'getheaders'
stasinopoulos commented 22 hours ago

Similar with https://github.com/commixproject/commix/issues/830