지난해 Bi She가 만든 소형 웹 취약점 스캔 도구입니다. 주로 단순 SQL 주입 취약점, SQL 블라인드 주입 및 XSS 취약점을 대상으로 합니다. 코드는 github에서 외국 마스터가 읽었습니다. SMAP 작성자) 두 가젯의 소스 코드는 그 안에 있는 아이디어를 바탕으로 직접 작성했습니다. 아래는 사용법과 소스코드입니다.
1. 사용 지침:
1. 작동 환경:
Linux 명령줄 인터페이스 + Python2.7
2. 🎜>
Vim scanner//scanner라는 파일 만들기파이썬 스캐너//파일 실행대상 URL 정보가 없으면 인터페이스에서 입력 가능한 매개변수를 알려주는 도움말 정보를 출력합니다. 매개변수에는 다음이 포함됩니다. --h 도움말 정보 출력
--url 스캔된 URL
--data POST 요청 방법의 매개변수
--cookie HTTP 요청 헤더 쿠키 value
--user-agent HTTP 요청 헤더 User-Agent value
--random-agent 브라우저 위장 사용 여부
--referer 대상 URL의 상위 계층 인터페이스
--proxy HTTP 헤더 프록시 값 요청
#!-*-coding:UTF-8-*- import optparse, random, re, string, urllib, urllib2,difflib,itertools,httplib NAME = "Scanner for RXSS and SQLI" AUTHOR = "Lishuze" PREFIXES = (" ", ") ", "' ", "') ", "\"") SUFFIXES = ("", "-- -", "#") BOOLEAN_TESTS = ("AND %d=%d", "OR NOT (%d=%d)") TAMPER_SQL_CHAR_POOL = ('(', ')', '\'', '"''"') TAMPER_XSS_CHAR_POOL = ('\'', '"', '>', '<', ';') GET, POST = "GET", "POST" COOKIE, UA, REFERER = "Cookie", "User-Agent", "Referer" TEXT, HTTPCODE, TITLE, HTML = xrange(4) _headers = {} USER_AGENTS = ( "Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Firefox/38.0", "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36", "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7_0; en-US) AppleWebKit/534.21 (KHTML, like Gecko) Chrome/11.0.678.0 Safari/534.21", ) XSS_PATTERNS = ( (r"<!--[^>]*%(chars)s|%(chars)s[^<]*-->","\"<!--.'.xss.'.-->\", inside the comment", None), (r"(?s)<script[^>]*>[^<]*?'[^<']*%(chars)s|%(chars)s[^<']*'[^<]*</script>","\"<script>.'.xss.'.</script>\", enclosed by <script> tags, inside single-quotes", None), (r'(?s)<script[^>]*>[^<]*?"[^<"]*%(chars)s|%(chars)s[^<"]*"[^<]*</script>',"'<script>.\".xss.\".</script>', enclosed by <script> tags, inside double-quotes", None), (r"(?s)<script[^>]*>[^<]*?%(chars)s|%(chars)s[^<]*</script>","\"<script>.xss.</script>\", enclosed by <script> tags", None), (r">[^<]*%(chars)s[^<]*(<|\Z)", "\">.xss.<\", outside of tags", r"(?s)<script.+?</script>|<!--.*?-->"), (r"<[^>]*'[^>']*%(chars)s[^>']*'[^>]*>", "\"<.'.xss.'.>\", inside the tag, inside single-quotes", r"(?s)<script.+?</script>|<!--.*?-->"), (r'<[^>]*"[^>"]*%(chars)s[^>"]*"[^>]*>', "'<.\".xss.\".>', inside the tag, inside double-quotes", r"(?s)<script.+?</script>|<!--.*?-->"), (r"<[^>]*%(chars)s[^>]*>", "\"<.xss.>\", inside the tag, outside of quotes", r"(?s)<script.+?</script>|<!--.*?-->") ) DBMS_ERRORS = { "MySQL": (r"SQL syntax.*MySQL", r"Warning.*mysql_.*", r"valid MySQL result", r"MySqlClient\."), "Microsoft SQL Server": (r"Driver.* SQL[\-\_\ ]*Server", r"OLE DB.* SQL Server", r"(\W|\A)SQL Server.*Driver", r"Warning.*mssql_.*", r"(\W|\A)SQL Server.*[0-9a-fA-F]{8}", r"(?s)Exception.*\WSystem\.Data\.SqlClient\.", r"(?s)Exception.*\WRoadhouse\.Cms\."), "Microsoft Access": (r"Microsoft Access Driver", r"JET Database Engine", r"Access Database Engine"), "Oracle": (r"ORA-[0-9][0-9][0-9][0-9]", r"Oracle error", r"Oracle.*Driver", r"Warning.*\Woci_.*", r"Warning.*\Wora_.*") } def _retrieve_content_xss(url, data=None): surl="" for i in xrange(len(url)): if i > url.find('?'): surl+=surl.join(url[i]).replace(' ',"%20") else: surl+=surl.join(url[i]) try: req = urllib2.Request(surl, data, _headers) retval = urllib2.urlopen(req, timeout=30).read() except Exception, ex: retval = getattr(ex, "message", "") return retval or "" def _retrieve_content_sql(url, data=None): retval = {HTTPCODE: httplib.OK} surl="" for i in xrange(len(url)): if i > url.find('?'): surl+=surl.join(url[i]).replace(' ',"%20") else: surl+=surl.join(url[i]) try: req = urllib2.Request(surl, data, _headers) retval[HTML] = urllib2.urlopen(req, timeout=30).read() except Exception, ex: retval[HTTPCODE] = getattr(ex, "code", None) retval[HTML] = getattr(ex, "message", "") match = re.search(r"<title>(?P<result>[^<]+)</title>", retval[HTML], re.I) retval[TITLE] = match.group("result") if match else None retval[TEXT] = re.sub(r"(?si)<script.+?</script>|<!--.+?-->|<style.+?</style>|<[^>]+>|\s+", " ", retval[HTML]) return retval def scan_page_xss(url, data=None): print "Start scanning RXSS:\n" retval, usable = False, False url = re.sub(r"=(&|\Z)", "=1\g<1>", url) if url else url data=re.sub(r"=(&|\Z)", "=1\g<1>", data) if data else data try: for phase in (GET, POST): current = url if phase is GET else (data or "") for match in re.finditer(r"((\A|[?&])(?P<parameter>[\w]+)=)(?P<value>[^&]+)", current): found, usable = False, True print "Scanning %s parameter '%s'" % (phase, match.group("parameter")) prefix = ("".join(random.sample(string.ascii_lowercase, 5))) suffix = ("".join(random.sample(string.ascii_lowercase, 5))) if not found: tampered = current.replace(match.group(0), "%s%s" % (match.group(0), urllib.quote("%s%s%s%s" % ("'", prefix, "".join(random.sample(TAMPER_XSS_CHAR_POOL, len(TAMPER_XSS_CHAR_POOL))), suffix)))) content = _retrieve_content_xss(tampered, data) if phase is GET else _retrieve_content_xss(url, tampered) for sample in re.finditer("%s([^ ]+?)%s" % (prefix, suffix), content, re.I): #print sample.group() for regex, info, content_removal_regex in XSS_PATTERNS: context = re.search(regex % {"chars": re.escape(sample.group(0))}, re.sub(content_removal_regex or "", "", content), re.I) if context and not found and sample.group(1).strip(): print "!!!%s parameter '%s' appears to be XSS vulnerable (%s)" % (phase, match.group("parameter"), info) found = retval = True if not usable: print " (x) no usable GET/POST parameters found" except KeyboardInterrupt: print "\r (x) Ctrl-C pressed" return retval def scan_page_sql(url, data=None): print "Start scanning SQLI:\n" retval, usable = False, False url = re.sub(r"=(&|\Z)", "=1\g<1>", url) if url else url data=re.sub(r"=(&|\Z)", "=1\g<1>", data) if data else data try: for phase in (GET, POST): current = url if phase is GET else (data or "") for match in re.finditer(r"((\A|[?&])(?P<parameter>\w+)=)(?P<value>[^&]+)", current): vulnerable, usable = False, True original=None print "Scanning %s parameter '%s'" % (phase, match.group("parameter")) tampered = current.replace(match.group(0), "%s%s" % (match.group(0), urllib.quote("".join(random.sample(TAMPER_SQL_CHAR_POOL, len(TAMPER_SQL_CHAR_POOL)))))) content = _retrieve_content_sql(tampered, data) if phase is GET else _retrieve_content_sql(url, tampered) for (dbms, regex) in ((dbms, regex) for dbms in DBMS_ERRORS for regex in DBMS_ERRORS[dbms]): if not vulnerable and re.search(regex, content[HTML], re.I): print "!!!%s parameter '%s' could be error SQLi vulnerable (%s)" % (phase, match.group("parameter"), dbms) retval = vulnerable = True vulnerable = False original = original or (_retrieve_content_sql(current, data) if phase is GET else _retrieve_content_sql(url, current)) for prefix,boolean,suffix in itertools.product(PREFIXES,BOOLEAN_TESTS,SUFFIXES): if not vulnerable: template = "%s%s%s" % (prefix,boolean, suffix) payloads = dict((_, current.replace(match.group(0), "%s%s" % (match.group(0), urllib.quote(template % (1 if _ else 2, 1), safe='%')))) for _ in (True, False)) contents = dict((_, _retrieve_content_sql(payloads[_], data) if phase is GET else _retrieve_content_sql(url, payloads[_])) for _ in (False, True)) if all(_[HTTPCODE] for _ in (original, contents[True], contents[False])) and (any(original[_] == contents[True][_] != contents[False][_] for _ in (HTTPCODE, TITLE))): vulnerable = True else: ratios = dict((_, difflib.SequenceMatcher(None, original[TEXT], contents[_][TEXT]).quick_ratio()) for _ in (True, False)) vulnerable = all(ratios.values()) and ratios[True] > 0.95 and ratios[False] < 0.95 if vulnerable: print "!!!%s parameter '%s' could be error Blind SQLi vulnerable" % (phase, match.group("parameter")) retval = True if not usable: print " (x) no usable GET/POST parameters found" except KeyboardInterrupt: print "\r (x) Ctrl-C pressed" return retval def init_options(proxy=None, cookie=None, ua=None, referer=None): global _headers _headers = dict(filter(lambda _: _[1], ((COOKIE, cookie), (UA, ua or NAME), (REFERER, referer)))) urllib2.install_opener(urllib2.build_opener(urllib2.ProxyHandler({'http': proxy})) if proxy else None) if __name__ == "__main__": print "----------------------------------------------------------------------------------" print "%s\nBy:%s" % (NAME, AUTHOR) print "----------------------------------------------------------------------------------" parser = optparse.OptionParser() parser.add_option("--url", dest="url", help="Target URL") parser.add_option("--data", dest="data", help="POST data") parser.add_option("--cookie", dest="cookie", help="HTTP Cookie header value") parser.add_option("--user-agent", dest="ua", help="HTTP User-Agent header value") parser.add_option("--random-agent", dest="randomAgent", action="store_true", help="Use randomly selected HTTP User-Agent header value") parser.add_option("--referer", dest="referer", help="HTTP Referer header value") parser.add_option("--proxy", dest="proxy", help="HTTP proxy address") options, _ = parser.parse_args() if options.url: init_options(options.proxy, options.cookie, options.ua if not options.randomAgent else random.choice(USER_AGENTS), options.referer) result_xss= scan_page_xss(options.url if options.url.startswith("http") else "http://%s" % options.url, options.data) print "\nScan results: %s vulnerabilities found" % ("possible" if result_xss else "no") print "----------------------------------------------------------------------------------" result_sql = scan_page_sql(options.url if options.url.startswith("http") else "http://%s" % options.url, options.data) print "\nScan results: %s vulnerabilities found" % ("possible" if result_sql else "no") print "----------------------------------------------------------------------------------" else: parser.print_help()위 내용은 웹 취약점 스캐닝 도구를 구현하기 위해 편집자가 구현한 Python 스크립트입니다. 궁금한 점이 있으면 메시지를 남겨주시면 편집자가 답변해 드리겠습니다. 제 시간에 당신에게. 또한 PHP 중국어 웹사이트를 지원해 주신 모든 분들께 감사드립니다! 웹 취약점 스캐닝 도구를 구현하는 Python 스크립트와 관련된 더 많은 기사를 보려면 PHP 중국어 웹사이트를 주목하세요!