elza-1.4.3.orig/ 0040755 0001750 0000144 00000000000 07235622506 012472 5 ustar stijn users elza-1.4.3.orig/anon.elz 0100644 0001750 0000144 00000000244 07032112724 014125 0 ustar stijn users var proxy = proxy.bgnet.bg 3128
var rawfile = anon.raw
subst THEURL = http://www.einet.bg/
get url http://anon.user.anonymizer.com/THEURL
get url %Location%
elza-1.4.3.orig/CHANGES.txt 0100644 0001750 0000144 00000003157 07032703570 014302 0 ustar stijn users This list may or may not be comprehensive.
ELZA's syntax is changing rapidly to accomodate all ideas in my mind.
Please see elza.txt for a reference on the commands currently supported.
In 1.4.3:
- Added Keep-Alive connections.
- Added MD5 Digest authentication.
- Content-length: is now honored when receiving data.
- Removed maxlines variables. Will reintroduce later.
- seslines changed to ses_lines (also sesspeed) .
- Miscelaneous bug fixes.
In 1.4.1:
- Added seslines sesrcv sestime sesspeed maxlines variables
- Added SOCKS proxy support.
- Added forking under Unix.
- Added dictionary sharing between children when forked under Win32;
- Added pause/resume functionality on dictionary attacks;
- Added 'printraw' statement;
- Added 'if CONDITION COMMAND' statements;
- Added 'silent' and 'verbose' variables.
In 1.3.9:
- Reintroduced 'label' and 'goto LABEL (if)';
- Reintroduced HTTP Referer, which dropped on the way, I do not know why.
- Procedures can now be accessed from anywhere in the script.
- Removed 'insert' directive for now, will reintroduce it later.
- Proc named BEFOREREQUEST is executed before each request.
- Added host:port mapping.
- Added 'honorhttps = no' to prevent spawning of SSL tunnel.
- Added 'if >' and 'if <' conditions.
- Added 'autoredir = no' to prevent automatic 302 Moved following.
- VAR is substituted when %VAR% is encountered.
- Added dynamic substs 'subst SUBST @ ARRAY'.
- Added 'subst SUBST f= FIELD' syntax.
- Reduced information that is printed to STDOUT. However, we are still very
verbose and the implementation of verbosity control is pending.
elza-1.4.3.orig/dict.elz 0100644 0001750 0000144 00000001456 07032704166 014132 0 ustar stijn users # This example illustrates performing dictionary attack on HTTP
# basic authentication
# Step -1. Use Keep-Alive. This may speed things dramatically
var keepalive = on
# Step 0. Do not stop on errors, so that we can see the stats even if
# unsuccessful
var onerror = continue
# Step 1. Set the realm
var realm = Restricted Stuff
# Step 2. Set the user
var user = philip
# Step 3. Set the dictionary
var dictionary = dict.txt
# Step 4. Request the URL
head url http://127.0.0.1/protected
# If the remote httpd does not accept HEAD requests, try this:
# var forcehead = on
# get url http://127.0.0.1/protected
#But you may loose keep-alive functionality due to remote httpd closing
#connection after each request. That is not ELZA's fault.
# Step 5. Display the stats
stats
elza-1.4.3.orig/dict.txt 0100644 0001750 0000144 00000000441 07032675514 014154 0 ustar stijn users one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
one
two
foo
bar
flowers
elza-1.4.3.orig/download.elz 0100644 0001750 0000144 00000000242 07032704046 015003 0 ustar stijn users # This example will download and save bozo.exe in downloaded-file.exe
var rawfile = downloaded-file.exe
var binary = on
get url http://localhost/bozo.exe
elza-1.4.3.orig/elza.def 0100644 0001750 0000144 00000016267 07032705364 014115 0 ustar stijn users #
# DEFAULT VALUES FOR VARIOUS ELZA VARIABLES. PLEASE REVIEW.
#
# ========================================================================
# STEP 1 - Choosing the operating system
# ========================================================================
# Uncomment the line below to show that you have reviewed elza.def
$DefaultsReviewed = 1
# Uncomment the line below if running in Win32 environment
use Win32::Process; use Win32;
# ========================================================================
# STEP 1A - Choosing authentication mechanism
# ========================================================================
# If you plan to talk to sites that use Basic authentication, uncomment
# the line below. You will also need the MIME::Base64 module from CPAN
#use MIME::Base64;
# If you plan to talk to sites that use Basic authentication, uncomment
# the line below. You will also need the Digest:MD5 module from CPAN
#use Digest::MD5;
# ========================================================================
# STEP 1B - Keepalive
# ========================================================================
$VAR{'keepalive'} = 'on';
# ========================================================================
# STEP 2 - Setting up the SSL tunnel
# ========================================================================
$VAR{'ssllocal'} = "24442"; # Local port to bind the SSL tunnel to
# Please uncomment the set pertaining to your system.
# SSLHOST and SSLPORT will be replaced by the ELZA with
# the appropriate values at runtime.
# SET FOR WIN32 (tested with stunnel on Win95)
$DEF{'sslapp'} = "c:\\win-util\\stunnel.exe";
$DEF{'sslcmd'} = "stunnel -c -d 127.0.0.1:SSLLOCAL -r SSLHOST:SSLPORT -D 1";
$DEF{'sslconsole'} = 1; # Set to 1 to see the console
# SET FOR UNIX (tested with stunnel on Debian Linux)
#$DEF{'sslapp'} = "stunnel"; # This name will be passed to KILLALL
#$DEF{'sslcmd'} = "/usr/sbin/stunnel -c -d 127.0.0.1:$DEF{'ssllocal'} -r SSLHOST:SSLPORT -D 1";
# ========================================================================
# STEP 3 - Proxies
# ========================================================================
# HTTP Proxy configuration.
# NOTE:SSL requests are piped through the SSL tunnel, not the proxy.
#$VAR{'proxyhost'} = 'proxy.bgnet.bg';
#$VAR{'proxyport'} = '3128';
# SOCKS proxy configuration.
# Uncomment the line below to load the SOCKS module.
#use Net::SOCKS;
#$VAR{'sockshost'} = '127.0.0.1';
#$VAR{'socksport'} = 1080;
#$VAR{'socksversion'} = 5;
#$VAR{'socksuser'} = 'foo';
#$VAR{'sockspassword'} = 'bar';
# ========================================================================
# STEP 4 - Dumping
# ========================================================================
# Make ELZA completely silent?
#$VAR{'silent'} = 'on';
# Output debugging information?
#$VAR{'debug'} = 'on';
# Default file for raw output
#$VAR{'rawfile'} = 'raw.out';
# Options for what should be dumped. Comment out those you do not need.
# Dump the literal request we send?
$VAR{'dumprequest'} = '1';
# Dump the headers of the response?
$VAR{'dumpheaders'} = '1';
# Dump the body of the response? - basically between and
$VAR{'dumpbody'} = '1';
# Temporary files where the current attack position will be saved so that
# the attack can be resumed.
$VAR{'tmpfile'} = 'elza.tmp';
# ========================================================================
# STEP 5 - Defaults for various things
# ========================================================================
# Those can also be changed from within the script files.
# Default action upon error condition
$VAR{'onerror'} = 'exit';
# Default User-Agent - IE5
$VAR{'agent'} = "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)";
# Default host - if none specified in the first request
$DEF{'host'} = 'localhost';
# Send User-Agent?
$VAR{'sendagent'} = 'on';
# Encode URLs to bypass IDS alarms? Courtesy of r.f.p. (rfp@wiretrip.net)
#$VAR{'encode'} = 'on';
# Send various other HTTP request fields?
$DEF{'headers'}.= "X-Elza: Request generated by the ELZA script ver. $DEF{'version'}.\n";
$DEF{'headers'}.= "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/msword, */*\n";
$DEF{'headers'}.= "Accept-Language: en\n";
$DEF{'headers'}.= "UA-pixels: 640x480\n";
$DEF{'headers'}.= "UA-color: color16\n";
$DEF{'headers'}.= "UA-OS: Windows 95\n";
$DEF{'headers'}.= "UA-CPU: x86\n";
# Follow 302 Moved redirects automatically?
$VAR{'autoredir'} = 'on';
# Follow HTTP-EQUIV refreshes automatically?
$VAR{'autorefresh'} = 'on';
# ========================================================================
# VARIABLES BELOW THIS LINE DO NOT REQUIRE CHANGING
# ========================================================================
# Default URL prefixes and port assignments
$DEF{'port'} = '80';
$DEF{'sslport'} = '443';
$DEF{'http'} = 'http://';
$DEF{'https'} = 'https://';
$DEF{'protocol'} = 'HTTP/1.0';
# Bracketz
$LeftBrack = '<'; $RightBrack = '>';
# Those are the various tags that the tag processor can look for.
$TagBegin{'base'} = ') {eval $Line;}
close DEFAULTS;
if ($DefaultsReviewed != 1) {
shout ('critical', "Please review the defaults in $DEFAULTS before running the ELZA.");
}
# Initally, no successful requests
$VAR{'tot_req'} = 0; $SuccessfulRequests = 0;
$BytesSent = 0; $VAR{'tot_rcv'} = 0;
$VAR{'tot_ok'} = 0; $RedirRequests = 0;
$VAR{'tot_pass'} = 0;
$SocketOpened = 0;
# We will normally have 2nd and 3rc command line parameter if we are forked.
$VAR{'instance'} = $ARGV[1];
$VAR{'instances'} = $ARGV[2];
# Unbuffer STDOUT, otherwise Linux misbehaves on printraw statements.
$| = 1;
$LastPosition = 0;
# If we are called via GET / HEAD ...
if (($ENV{'REQUEST_METHOD'} ne '') && ($ENV{'REQUEST_METHOD'} ne 'POST')) {
print STDOUT "Content-type: text/plain\n\n";
print STDOUT "Please execute ELZA with POST.\n";
exit;
}
# If we are called via a POST ...
if ($ENV{'REQUEST_METHOD'} eq 'POST') {
# Read the fields of the form
read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});
@pairs = split(/&/, $buffer);
foreach $pair (@pairs) {
($name, $value) = split(/=/, $pair);
$value =~ tr/+/ /;
$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
$FORM{$name} = $value;
shout ('verbose' , "Received from POST request: $name \= $value .");
}
if ($FORM{'silent'} eq 'on') {
$VAR{'silent'} = $FORM{'silent'};
} else {
shout ('raw', 'Content-type: text/plain\n\n');
shout ('normal', "--- Hello. This is the ELZA interpreter version $DEF{'version'}.");
shout ('normal', "--- Running in remote mode. Called from $ENV{'REMOTE_ADDR'} .");
}
# The file to execute is within the 'elza-web-script' field
$SCRIPT = "<$FORM{'elza-web-script'}";
$| = 1;
} else {
# The file to execute is the first argument of the command line
shout ('info', "Hello. This is the ELZA interpreter version $DEF{'version'}.");
if ($VAR{'instance'} ne '') {
shout ('info', "I am instance $VAR{'instance'} of total $VAR{'instances'} instances.");
}
if ($ARGV[0] eq '') {
print STDOUT "??? Please enter script to execute: ";
$SCRIPT = ;
$SCRIPT =~ s/[\r\n]//g;
if ($SCRIPT eq '') {
shout ('critical',"No script name was entered.");
} else {
$SCRIPT = '<'.$SCRIPT;
}
} else {
$SCRIPT = '<'.$ARGV[0];
}
}
$startclock = time();
open SCRIPT or shout ('critical', "Unable to open script $SCRIPT: $!");
shout ('info',"Now processing commands from $SCRIPT");
$IsWebEnabled = 0;
$ProcName = '';
# Process the main command file, labels, procs, etc.
$LineNum = 0;
while (