#!/usr/bin/env python3
"""
Intelligent Web Application Fuzzer
Author: Gaurav Singh
"""

import requests
import threading
import time
from urllib.parse import urljoin, urlparse
from concurrent.futures import ThreadPoolExecutor
import queue

class WebFuzzer:
    def __init__(self, target_url, wordlist_path, threads=50):
        self.target_url = target_url
        self.wordlist_path = wordlist_path
        self.threads = threads
        self.session = requests.Session()
        self.discovered_paths = []
        self.queue = queue.Queue()
        self.setup_session()
        
    def setup_session(self):
        """Configure session with proper headers and settings"""
        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36',
            'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
            'Accept-Language': 'en-US,en;q=0.5',
            'Accept-Encoding': 'gzip, deflate',
            'Connection': 'keep-alive',
        })
        
    def load_wordlist(self):
        """Load and prepare wordlist for fuzzing"""
        try:
            with open(self.wordlist_path, 'r') as f:
                wordlist = [line.strip() for line in f if line.strip()]
            return wordlist
        except FileNotFoundError:
            print(f"Wordlist file not found: {self.wordlist_path}")
            return []
    
    def make_request(self, url, method='GET', data=None):
        """Make HTTP request with error handling"""
        try:
            if method.upper() == 'GET':
                response = self.session.get(url, timeout=10)
            elif method.upper() == 'POST':
                response = self.session.post(url, data=data, timeout=10)
            else:
                return None
                
            return response
        except requests.exceptions.RequestException as e:
            return None
    
    def analyze_response(self, response, path):
        """Analyze response to determine if path is interesting"""
        if not response:
            return False
            
        # Skip common error responses
        if response.status_code in [404, 403, 500]:
            return False
            
        # Check for redirects to login or error pages
        if response.status_code == 302:
            location = response.headers.get('Location', '')
            if 'login' in location.lower() or 'error' in location.lower():
                return False
                
        # Analyze content length and type
        content_length = len(response.content)
        content_type = response.headers.get('Content-Type', '')
        
        # Skip very small responses (likely error pages)
        if content_length < 100:
            return False
            
        # Interesting status codes
        if response.status_code in [200, 301, 302, 401, 403]:
            return True
            
        return False
    
    def fuzz_directories(self, base_url, wordlist):
        """Fuzz directories and files"""
        discovered = []
        
        with ThreadPoolExecutor(max_workers=self.threads) as executor:
            futures = []
            
            for word in wordlist:
                # Test as directory
                dir_url = urljoin(base_url, word + '/')
                future = executor.submit(self.test_path, dir_url, word + '/')
                futures.append(future)
                
                # Test as file
                file_url = urljoin(base_url, word)
                future = executor.submit(self.test_path, file_url, word)
                futures.append(future)
                
                # Test common extensions
                for ext in ['.php', '.asp', '.aspx', '.jsp', '.html', '.txt']:
                    file_ext_url = urljoin(base_url, word + ext)
                    future = executor.submit(self.test_path, file_ext_url, word + ext)
                    futures.append(future)
            
            for future in futures:
                result = future.result()
                if result:
                    discovered.append(result)
                    
        return discovered

# Configuration example
config = {
    'threads': 100,
    'delay': 0.1,
    'timeout': 10,
    'follow_redirects': True,
    'max_depth': 3,
    'extensions': ['.php', '.asp', '.jsp'],
    'status_codes': [200, 301, 302, 403],
    'user_agents': ['Mozilla/5.0...', 'curl/7.68.0'],
    'proxy': 'http://127.0.0.1:8080'
}