buffer/thug — pull request #57 by florianschmitt (2013-06-22 17:46:36+00:00)
Title: Pull request

Hey, I ran across a problem with the property Navigator._window.url. I noticed, that after version v0.4.23 this values changes after content was fetched, which resulted in false Navigator URL translations. This is an example with a bleeding life 2 exploit kit. The first log snipped is according to your current master. The second one is after my commit.

The other commit, regarding is_pdf, contains a reference link.

/usr/bin/python2.7 /home/zack/workspace/thug-workspace/thug/src/thug.py -u winxpie80 http://localhost/bleeding-life-2
[2013-06-22 18:52:43] [Navigator URL Translation] include/PluginDetect.js --> http://localhost/bleeding-life-2/include/PluginDetect.js
[2013-06-22 18:52:43] [script src redirection] http://localhost/bleeding-life-2/ -> http://localhost/bleeding-life-2/include/PluginDetect.js
[2013-06-22 18:52:43] [HTTP] URL: http://localhost/bleeding-life-2/include/PluginDetect.js (Status: 200, Referrer: http://localhost/bleeding-life-2/)

[2013-06-22 18:52:44] [Navigator URL Translation] include/getJavaInfo.jar --> http://localhost/bleeding-life-2/include/include/getJavaInfo.jar
[2013-06-22 18:52:44] [params redirection] http://localhost/bleeding-life-2/include/PluginDetect.js -> http://localhost/bleeding-life-2/include/include/getJavaInfo.jar
[2013-06-22 18:52:44] [HTTP] URL: http://localhost/bleeding-life-2/include/include/getJavaInfo.jar (Status: 404, Referrer: http://localhost/bleeding-life-2/include/PluginDetect.js)
[2013-06-22 18:52:44] [File Not Found] URL: http://localhost/bleeding-life-2/include/include/getJavaInfo.jar

[2013-06-22 18:52:44] [Navigator URL Translation] getJavaInfo.jar --> http://localhost/bleeding-life-2/include/getJavaInfo.jar
[2013-06-22 18:52:44] [applet redirection] http://localhost/bleeding-life-2/include/PluginDetect.js -> http://localhost/bleeding-life-2/include/getJavaInfo.jar
[2013-06-22 18:52:44] [HTTP] URL: http://localhost/bleeding-life-2/include/getJavaInfo.jar (Status: 200, Referrer: http://localhost/bleeding-life-2/include/PluginDetect.js)

[2013-06-22 18:52:44] [Navigator URL Translation] include/getJavaInfo.jar --> http://localhost/bleeding-life-2/include/include/getJavaInfo.jar
[2013-06-22 18:52:44] [params redirection] http://localhost/bleeding-life-2/include/getJavaInfo.jar -> http://localhost/bleeding-life-2/include/include/getJavaInfo.jar
[2013-06-22 18:52:44] [HTTP] URL: http://localhost/bleeding-life-2/include/include/getJavaInfo.jar (Status: 404, Referrer: http://localhost/bleeding-life-2/include/getJavaInfo.jar)
[2013-06-22 18:52:44] [File Not Found] URL: http://localhost/bleeding-life-2/include/include/getJavaInfo.jar

[2013-06-22 18:52:44] [Navigator URL Translation] load_module.php?e=Adobe-90-2010-0188 --> http://localhost/bleeding-life-2/include/load_module.php?e=Adobe-90-2010-0188
[2013-06-22 18:52:44] [iframe redirection] http://localhost/bleeding-life-2/include/getJavaInfo.jar -> http://localhost/bleeding-life-2/include/load_module.php?e=Adobe-90-2010-0188
[2013-06-22 18:52:44] [HTTP] URL: http://localhost/bleeding-life-2/include/load_module.php?e=Adobe-90-2010-0188 (Status: 404, Referrer: http://localhost/bleeding-life-2/include/getJavaInfo.jar)
[2013-06-22 18:52:44] [File Not Found] URL: http://localhost/bleeding-life-2/include/load_module.php?e=Adobe-90-2010-0188

/usr/bin/python2.7 /home/zack/workspace/thug-workspace/thug/src/thug.py -u winxpie80 http://localhost/bleeding-life-2
[2013-06-22 18:53:23] [Navigator URL Translation] include/PluginDetect.js --> http://localhost/bleeding-life-2/include/PluginDetect.js
[2013-06-22 18:53:23] [script src redirection] http://localhost/bleeding-life-2/ -> http://localhost/bleeding-life-2/include/PluginDetect.js
[2013-06-22 18:53:23] [HTTP] URL: http://localhost/bleeding-life-2/include/PluginDetect.js (Status: 200, Referrer: http://localhost/bleeding-life-2/)

[2013-06-22 18:53:24] [Navigator URL Translation] add_visitor.php?referrer= --> http://localhost/bleeding-life-2/add_visitor.php?referrer=
[2013-06-22 18:53:24] [iframe redirection] http://localhost/bleeding-life-2/ -> http://localhost/bleeding-life-2/add_visitor.php?referrer=
[2013-06-22 18:53:24] [HTTP] URL: http://localhost/bleeding-life-2/add_visitor.php?referrer= (Status: 200, Referrer: http://localhost/bleeding-life-2/)

[2013-06-22 18:53:24] [Navigator URL Translation] add_visitor.php?referrer= --> http://localhost/bleeding-life-2/add_visitor.php?referrer=
[2013-06-22 18:53:24] [window open redirection] http://localhost/bleeding-life-2/ -> http://localhost/bleeding-life-2/add_visitor.php?referrer=
[2013-06-22 18:53:24] [HTTP] URL: http://localhost/bleeding-life-2/add_visitor.php?referrer= (Status: 200, Referrer: http://localhost/bleeding-life-2/)

[2013-06-22 18:53:25] [Navigator URL Translation] include/getJavaInfo.jar --> http://localhost/bleeding-life-2/include/getJavaInfo.jar
[2013-06-22 18:53:25] [params redirection] http://localhost/bleeding-life-2/ -> http://localhost/bleeding-life-2/include/getJavaInfo.jar
[2013-06-22 18:53:25] [HTTP] URL: http://localhost/bleeding-life-2/include/getJavaInfo.jar (Status: 200, Referrer: http://localhost/bleeding-life-2/)

[2013-06-22 18:53:25] [Navigator URL Translation] getJavaInfo.jar --> http://localhost/bleeding-life-2/getJavaInfo.jar
[2013-06-22 18:53:25] [applet redirection] http://localhost/bleeding-life-2/ -> http://localhost/bleeding-life-2/getJavaInfo.jar
[2013-06-22 18:53:25] [HTTP] URL: http://localhost/bleeding-life-2/getJavaInfo.jar (Status: 404, Referrer: http://localhost/bleeding-life-2/)

[2013-06-22 18:53:25] [Navigator URL Translation] include/getJavaInfo.jar --> http://localhost/bleeding-life-2/include/getJavaInfo.jar
[2013-06-22 18:53:25] [params redirection] http://localhost/bleeding-life-2/ -> http://localhost/bleeding-life-2/include/getJavaInfo.jar
[2013-06-22 18:53:25] [HTTP] URL: http://localhost/bleeding-life-2/include/getJavaInfo.jar (Status: 200, Referrer: http://localhost/bleeding-life-2/)

[2013-06-22 18:53:25] [Navigator URL Translation] load_module.php?e=Adobe-90-2010-0188 --> http://localhost/bleeding-life-2/load_module.php?e=Adobe-90-2010-0188
[2013-06-22 18:53:25] [iframe redirection] http://localhost/bleeding-life-2/ -> http://localhost/bleeding-life-2/load_module.php?e=Adobe-90-2010-0188
[2013-06-22 18:53:25] [HTTP] URL: http://localhost/bleeding-life-2/load_module.php?e=Adobe-90-2010-0188 (Status: 200, Referrer: http://localhost/bleeding-life-2/)

[2013-06-22 18:53:25] [Navigator URL Translation] load_module.php?e=Adobe-90-2010-0188 --> http://localhost/bleeding-life-2/load_module.php?e=Adobe-90-2010-0188
[2013-06-22 18:53:25] [window open redirection] http://localhost/bleeding-life-2/ -> http://localhost/bleeding-life-2/load_module.php?e=Adobe-90-2010-0188
[2013-06-22 18:53:25] [HTTP] URL: http://localhost/bleeding-life-2/load_module.php?e=Adobe-90-2010-0188 (Status: 200, Referrer: http://localhost/bleeding-life-2/)
[2013-06-22 18:53:25] [HTTP] URL: http://localhost/bleeding-life-2/load_module.php?e=Adobe-90-2010-0188 (Content-type: application/pdf, MD5: 17ec736f6bca195366891bb2b1331870)