add some new features

[physics-sec]

Hey there! I have been using pwndrop for a while and it is really really great, I added some new features that I think are useful on some scenarios.

added:

• Black and White list of IPs and IP ranges for dis-/allowing access to the payloads (this affects all hosted files)
• You can decide to put pwndrop behind a redirector and the client IP will be obtained from the X-Forwarded-For/Host headers
• An option to host all payloads on a particular folder (I use this with redirectors)
• Now you can decide how many times a payload can be downloaded (1 by default, this option is specific for each file)
• You can specify a file to write all the logs (useful for reporting)
• The debug logs now include the User-Agent header
• Pwndrop cookies now have SameSite: Lax (just to remove a Firefox warning)

Note: I only update how many times a file has been downloaded while using HTTP.

The new configuration file options are:

[pwndrop]
downloads_dir = "/my/payload/folder"        # directory path where files will be hosted by default, leave empty for ramdom
logfile = "/home/user/pwndrop.log"          # file where logs will be written, leave empty to only use stdout
trust_x_forwarded_for = true                # decides if pwndrop uses the X-Forwarded-For/X-Forwarded-Host HTTP headers to determine the remote address of a request. Use this option if pwndrop is behind an HTTP redirector.

I have also updated the GUI to include the Black/White listed IPs or IP ranges and how many times a payload can be downloaded.

Hope you will consider including these changes.

[physics-sec]

Add some screenshots to show de GUI: Global settings, here you can define individual IPs or ranges. A common use is to only allow the public IP of the company you are pentesting.

File config, here you can define how many times can this payload be downloaded.

The file view, showing the downloads left, once they reach 0, the file is disabled.

[B1t0n]

Great stuff! Do you think that it can get merged with this commit as well? I want to use these features as well https://github.com/kgretzky/pwndrop/pull/28

[physics-sec]

Saw your PR, the ability to add files programmatically is super powerful, great work! Take into account that you can just use a custom build and have both changes included. weather this gets merged or not depends on @kgretzky 😄

[lucawen]

Maybe we can keep working on in on this fork: https://github.com/SygniaLabs/pwndrop what you think ?