您好,登錄后才能下訂單哦!
小編給大家分享一下如何利用python實(shí)現(xiàn)對(duì)web服務(wù)器的目錄探測,相信大部分人都還不怎么了解,因此分享這篇文章給大家參考一下,希望大家閱讀完這篇文章后大有收獲,下面讓我們一起去了解一下吧!
一、python
Python是一種解釋型、面向?qū)ο?、?dòng)態(tài)數(shù)據(jù)類型的高級(jí)程序設(shè)計(jì)語言。
python 是一門簡單易學(xué)的語言,并且功能強(qiáng)大也很靈活,在滲透測試中的應(yīng)用廣泛,讓我們一起打造屬于自己的滲透測試工具
二、web服務(wù)器的目錄探測腳本打造
1、在滲透時(shí)如果能發(fā)現(xiàn)web服務(wù)器中的webshell,滲透是不是就可以變的簡單一點(diǎn)尼
通常情況下御劍深受大家的喜愛,但是今天在測試的時(shí)候webshell不知道為什么御劍掃描不到
仔細(xì)查看是webshell有防爬功能,是檢測User-Agent頭,如果沒有就回返回一個(gè)自己定義的404頁面
1、先來看看工具效果
2、利用python讀取掃描的目錄字典
def get_url(path): with open(path, "r", encoding='ISO-8859-1') as f: for url in f.readlines(): url_list.append(url.strip()) return url_list
3、利用 python 的 requests 庫對(duì)web目標(biāo)服務(wù)器進(jìn)行目錄探測
def Go_scan(url): while not queue.empty(): url_path = queue.get(timeout=1) new_url = url + url_path res = requests.get(new_url, headers=headers, timeout=5) #print(res.status_code) status_code = "[" + str(res.status_code) + "]" if str(res.status_code) != "404": print(get_time(), status_code, new_url)
4、利用 python 的 threading 庫對(duì)探測進(jìn)行線程的設(shè)置
def thread(Number,url): threadlist = [] for pwd in url_list: queue.put(pwd) for x in range(Number): t = threading.Thread(target=Go_scan, args=(url,)) threadlist.append(t) for t in threadlist: t.start()
5、利用 python 的 argparse 庫進(jìn)行對(duì)自己的工具進(jìn)行封裝
def main(): if len(sys.argv) == 1: print_banner() exit(1) parser = argparse.ArgumentParser( formatter_class=argparse.RawTextHelpFormatter, epilog='''\ use examples: python dir_scan.py -u [url]http://www.test.com[/url] -d /root/dir.txt python dir_scan.py -u [url]http://www.test.com[/url] -t 30 -d /root/dir.txt ''') parser.add_argument("-u","--url", help="scan target address", dest='url') parser.add_argument("-t","--thread", help="Number of threads", default="20", type=int, dest='thread') parser.add_argument("-d","--Dictionaries", help="Dictionary of Blasting Loading", dest="Dictionaries")
總結(jié)
各位大哥有意見或者建議盡管提,文章哪里不對(duì)的話會(huì)改的,小弟定會(huì)虛心學(xué)習(xí)最后附上全部源碼供大佬指教
#!/usr/bin/python # -*- coding: utf-8 -*- import requests import threading import argparse,sys import time,os from queue import Queue url_list = [] queue = Queue() headers = { 'Connection':'keep-alive', 'Accept':'*/*', 'Accept-Language': 'zh-CN', 'User-Agent':'Mozilla/5.0 (Windows NT 6.2; rv:16.0) Gecko/20100101 Firefox/16.0' } def print_banner(): banner = r""" .___.__ __________________ _____ _______ __| _/|__|_______ / _____/\_ ___ \ / _ \ \ \ / __ | | |\_ __ \ \_____ \ / \ \/ / /_\ \ / | \ / /_/ | | | | | \/ / \\ \____/ | \/ | \ \____ | |__| |__| /_______ / \______ /\____|__ /\____|__ / \/ \/ \/ \/ \/ [*] Very fast directory scanning tool. [*] try to use -h or --help show help message """ print(banner) def get_time(): return '[' + time.strftime("%H:%M:%S", time.localtime()) + '] ' def get_url(path): with open(path, "r", encoding='ISO-8859-1') as f: for url in f.readlines(): url_list.append(url.strip()) return url_list def Go_scan(url): while not queue.empty(): url_path = queue.get(timeout=1) new_url = url + url_path res = requests.get(new_url, headers=headers, timeout=5) #print(res.status_code) status_code = "[" + str(res.status_code) + "]" if str(res.status_code) != "404": print(get_time(), status_code, new_url) def thread(Number,url): threadlist = [] for pwd in url_list: queue.put(pwd) for x in range(Number): t = threading.Thread(target=Go_scan, args=(url,)) threadlist.append(t) for t in threadlist: t.start() def main(): if len(sys.argv) == 1: print_banner() exit(1) parser = argparse.ArgumentParser( formatter_class=argparse.RawTextHelpFormatter, epilog='''\ use examples: python dir_scan.py -u [url]http://www.test.com[/url] -d /root/dir.txt python dir_scan.py -u [url]http://www.test.com[/url] -t 30 -d /root/dir.txt ''') parser.add_argument("-u","--url", help="scan target address", dest='url') parser.add_argument("-t","--thread", help="Number of threads", default="20", type=int, dest='thread') parser.add_argument("-d","--Dictionaries", help="Dictionary of Blasting Loading", dest="Dictionaries") args = parser.parse_args() Number =args.thread url = args.url url_path = args.Dictionaries print_banner() get_url(url_path) print(get_time(), "[INFO] Start scanning----\n") time.sleep(2) thread(Number,url) if __name__ == '__main__': main()
以上是“如何利用python實(shí)現(xiàn)對(duì)web服務(wù)器的目錄探測”這篇文章的所有內(nèi)容,感謝各位的閱讀!相信大家都有了一定的了解,希望分享的內(nèi)容對(duì)大家有所幫助,如果還想學(xué)習(xí)更多知識(shí),歡迎關(guān)注億速云行業(yè)資訊頻道!
免責(zé)聲明:本站發(fā)布的內(nèi)容(圖片、視頻和文字)以原創(chuàng)、轉(zhuǎn)載和分享為主,文章觀點(diǎn)不代表本網(wǎng)站立場,如果涉及侵權(quán)請(qǐng)聯(lián)系站長郵箱:is@yisu.com進(jìn)行舉報(bào),并提供相關(guān)證據(jù),一經(jīng)查實(shí),將立刻刪除涉嫌侵權(quán)內(nèi)容。