z0noxz / mando.me Goto Github PK

POST /bWAPP/commandi.php HTTP/1.1
Host: <IP>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://<IP>/bWAPP/commandi.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 30
Connection: close
Cookie: security_level=1; PHPSESSID=2871ed8afbfcd800836a8111df1522da
Upgrade-Insecure-Requests: 1

target=www.nsa.gov&form=submit

[*] Testing different injection techniques
 [*] METHOD: Result based injection

 [-] Something went wrong. Terminating program.


Traceback (most recent call last):
 File "./mando.me.py", line 2339, in <module>
   if __name__ == "__main__": main(sys.argv[1:])
 File "./mando.me.py", line 2259, in main
   CommandInjector.init()
 File "./mando.me.py", line 1945, in init
   CommandInjector.exploit()
 File "./mando.me.py", line 2151, in exploit
   if technique() and not _gs["url_stager"] == None:
 File "./mando.me.py", line 2034, in technique_result_based
   if _placeholder == interactor("echo " + _placeholder).strip():
 File "./mando.me.py", line 2013, in interactor
   request = urllib.request.Request(url, headers=urllib.parse.urlencode(json.loads(_gs["post"].replace("'", "\"").replace("_INJECT_", "\"" + special + command + "\""))))
 File "/usr/lib/python3.7/json/__init__.py", line 348, in loads
   return _default_decoder.decode(s)
 File "/usr/lib/python3.7/json/decoder.py", line 337, in decode
   obj, end = self.raw_decode(s, idx=_w(s, 0).end())
 File "/usr/lib/python3.7/json/decoder.py", line 355, in raw_decode
   raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
None