This is a vewwwy big commit

- The inject plugin now uses beautifulsoup4 to actually parse HTML and add content to it as supposed to using regexes
- The logging of the whole framework has been compleatly overhauled
- plugindetect.js now includes os.js from the metasploit framework for os and browser detection, let's us fingerprint hosts even if UA is lying!
- New plugin HTA Drive-by has been added, prompts the user for a plugin update and makes them download an hta app which contains a powershell payload
- the API of the plugins has been simplified
- Improvements and error handling to user-agent parsing
- Some misc bugfixes

core/servers/http/HTTPServer.py

@@ -1,82 +0,0 @@
-#!/usr/bin/env python2.7
-
-# Copyright (c) 2014-2016 Marcello Salvati
-#
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License as
-# published by the Free Software Foundation; either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
-# USA
-#
-
-import logging
-import sys
-import tornado.ioloop
-import tornado.web
-import threading
-
-from core.configwatcher import ConfigWatcher
-
-tornado_logger = logging.getLogger("tornado")
-tornado_logger.propagate = False
-formatter = logging.Formatter("%(asctime)s [HTTPserver] %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
-fileHandler = logging.FileHandler("./logs/mitmf.log")
-streamHandler = logging.StreamHandler(sys.stdout)
-fileHandler.setFormatter(formatter)
-streamHandler.setFormatter(formatter)
-tornado_logger.addHandler(fileHandler)
-tornado_logger.addHandler(streamHandler)
-
-class HTTPServer(ConfigWatcher):
-
-    _instance = None
-    application = tornado.web.Application([])
-    http_port = int(ConfigWatcher.config["MITMf"]["HTTP"]["port"])
-
-    @staticmethod
-    def getInstance():
-        if HTTPServer._instance == None:
-            HTTPServer._instance = HTTPServer()
-
-        return HTTPServer._instance
-
-    def addHandler(self, urlregex, handler, vhost=''):
-        self.application.add_handlers(vhost, [(urlregex, handler)])
-
-    def addStaticPathHandler(self, urlregex, path, vhost=''):
-        self.application.add_handlers(vhost, [(urlregex, {"static_path": path})])
-
-    def resetApplication(self):
-        self.application = tornado.web.Application([])
-
-    def parseConfig(self):
-        for url,path in self.config['MITMf']['HTTP']['Paths'].iteritems():
-            self.addStaticPathHandler(url, path)
-
-    def onConfigChange(self):
-        self.resetApplication()
-        self.parseConfig()
-
-    def start(self):
-        self.parseConfig()
-        self.application.listen(self.http_port)
-
-        t = threading.Thread(name='HTTPserver', target=tornado.ioloop.IOLoop.instance().start)
-        t.setDaemon(True)
-        t.start()
-
-class HTTPHandler(tornado.web.RequestHandler):
-    def get(self):
-        raise HTTPError(405)
-
-    def post(self):
-        raise HTTPError(405)

core/servers/http/HTTPserver.py

@@ -0,0 +1,48 @@
+# Copyright (c) 2014-2016 Marcello Salvati
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
+# USA
+#
+import logging
+import threading
+
+from core.configwatcher import ConfigWatcher
+from flask import Flask
+
+class HTTPserver(ConfigWatcher):
+
+    server = Flask("HTTPserver")
+
+    __shared_state = {}
+
+    def __init__(self):
+        self.__dict__ = self.__shared_state
+
+    def start_flask(self):
+        self.server.run(debug=False, host='0.0.0.0', port=int(self.config['MITMf']['HTTP']['port']))
+
+    def start(self):
+        self.setup_http_logger()
+        server_thread = threading.Thread(name='HTTPserver', target=self.start_flask)
+        server_thread.setDaemon(True)
+        server_thread.start()
+
+    def setup_http_logger(self):
+        formatter = logging.Formatter("%(asctime)s [HTTP] %(message)s", datefmt="%Y-%m-%d %H:%M:%S")
+        flask_logger = logging.getLogger('werkzeug')
+        flask_logger.propagate = False
+        fileHandler = logging.FileHandler("./logs/mitmf.log")
+        fileHandler.setFormatter(formatter)
+        flask_logger.addHandler(fileHandler)