92 lines
2.9 KiB
Python
92 lines
2.9 KiB
Python
# -*- coding:utf-8 -*-
|
||
# author:f0ngf0ng
|
||
|
||
# 入参为：yml文件 url.txt yml文件里有时间条件、关键词条件
|
||
# command写死在java里，直接python3 xxxx.py xx.yml即可
|
||
# java输出为文件，
|
||
# 如http://x.x.x.x ————————vul
|
||
# http://x.x.x.x ———————
|
||
|
||
import requests
|
||
import csv,yaml,os
|
||
from concurrent.futures import ThreadPoolExecutor
|
||
import sys
|
||
|
||
proxies = {
|
||
'http':'127.0.0.1:8080',
|
||
'https':'127.0.0.1:8080'
|
||
}
|
||
|
||
def exp(url,ymlfile):
|
||
global words
|
||
# 获取当前脚本所在文件夹路径
|
||
curPath = os.path.dirname(os.path.realpath(__file__))
|
||
# 获取yaml文件路径
|
||
yamlPath = os.path.join(curPath + '/..' , ymlfile)
|
||
# open方法打开直接读出来
|
||
f = open(yamlPath, 'r', encoding='utf-8')
|
||
cfg = f.read()
|
||
|
||
d = yaml.load(cfg, Loader=yaml.FullLoader) # 用load方法转字典
|
||
|
||
for _ in d:
|
||
if _ == "method":
|
||
method = d[_] # 请求方法
|
||
|
||
if _ == "uri":
|
||
uri = d[_] # 请求的uri
|
||
|
||
if _ == "param":
|
||
param = d[_] # 加在uri后面的带入的参数
|
||
|
||
if _ == "data":
|
||
data = d[_] # 请求体，如果没有的话，就为空，后续发请求需要判断
|
||
|
||
if _ == "others":
|
||
headers = d[_] # 将others参数设置为headers头
|
||
|
||
if _ == "condition":
|
||
words = d[_]['words'] # 关键字条件
|
||
time = d[_]['time'] # 时间条件
|
||
|
||
for value in headers: # 因为有纯数字，需要转成string
|
||
if type(headers[value]) == int:
|
||
headers[value] = str(headers[value])
|
||
|
||
try:
|
||
if method == "GET":
|
||
requests.packages.urllib3.disable_warnings()
|
||
r = requests.get(url + uri + "?" + param, headers=headers, timeout=5, verify=False )
|
||
elif( method == "POST" ):
|
||
requests.packages.urllib3.disable_warnings()
|
||
r = requests.get(url + uri + "?" + param, data=data ,headers=headers, timeout=5, verify=False )
|
||
elif( method == "PUT" ):
|
||
requests.packages.urllib3.disable_warnings()
|
||
r = requests.put(url + uri + "?" + param, data=data ,headers=headers, timeout=5, verify=False )
|
||
|
||
# 把响应头和响应体转换成string
|
||
total = ""
|
||
for _ in r.headers:
|
||
total = total + _ + ":" + r.headers[_] +'\n'
|
||
total = total + r.text
|
||
|
||
if words != "":
|
||
if words in total:
|
||
url = url + '…………vul'
|
||
print(url)
|
||
|
||
except Exception as e:
|
||
pass
|
||
|
||
if __name__ == '__main__':
|
||
data = open('pythonexp/url.txt') # 批量IP
|
||
ymlFile = sys.argv[1]
|
||
reader = csv.reader(data) # 50是线程
|
||
|
||
with ThreadPoolExecutor(50) as pool:
|
||
for row in reader:
|
||
if 'http' not in row[0]:
|
||
url = 'http://' + row[0]
|
||
else:
|
||
url = row[0]
|
||
pool.submit(exp, url , ymlFile) |