PyHacker實(shí)現(xiàn)網(wǎng)站后臺掃描器編寫指南

第PyHacker實(shí)現(xiàn)網(wǎng)站后臺掃描器編寫指南目錄00x1：模塊00x2：請求基本代碼00x3：設(shè)置00x4：200頁面處理00x5：保存結(jié)果0x06：完整代碼包括如何處理假的200頁面/404智能判斷等

喜歡用Python寫腳本的小伙伴可以跟著一起寫一寫呀。

編寫環(huán)境：Python2.x

00x1：模塊

需要用到的模塊如下：

importrequest

00x2：請求基本代碼

先將請求的基本代碼寫出來：

importrequests

defdir(url):

headers={'User-Agent':'Mozilla/5.0(WindowsNT10.0;WOW64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/65.0.3314.0Safari/537.36SE2.XMetaSr1.0'}

req=requests.get(url=url,headers=headers)

printreq.status_code

dir('http://www.hackxc.cc')

00x3：設(shè)置

設(shè)置超時時間，以及忽略不信任證書

importurllib3

urllib3.disable_warnings()

req=requests.get(url=url,headers=headers,timeout=3,verify=False)

再加個異常處理

調(diào)試一下

再進(jìn)行改進(jìn)，如果為200則輸出

ifreq.status_code==200:

print"[*]",req.url

00x4：200頁面處理

難免會碰到假的200頁面，我們再處理一下

處理思路：

首先訪問hackxchackxchackxc.php和xxxxxxxxxx記錄下返回的頁面的內(nèi)容長度，然后在后來的掃描中，返回長度等于這個長度的判定為404

defdirsearch(u,dir):

try:

headers={

'User-Agent':'Mozilla/5.0(WindowsNT10.0;WOW64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/65.0.3314.0Safari/537.36SE2.XMetaSr1.0'}

#假的200頁面進(jìn)行處理

hackxchackxchackxc='/hackxchackxchackxc.php'

hackxchackxchackxc_404=requests.get(url=u+hackxchackxchackxc,headers=headers)

#printlen(hackxchackxchackxc_404.content)

xxxxxxxxxxxx='/xxxxxxxxxxxx'

xxxxxxxxxxxx_404=requests.get(url=u+xxxxxxxxxxxx,headers=headers)

#printlen(xxxxxxxxxxxx_404.content)

#正常掃描

req=requests.get(url=u+dir,headers=headers,timeout=3,verify=False)

#printlen(req.content)

ifreq.status_code==200:

iflen(req.content)!=len(hackxchackxchackxc_404.content)andlen(req.content)!=len(xxxxxxxxxxxx_404.content):

print"[+]",req.url

else:

printu+dir,404

except:

pass

很nice

00x5：保存結(jié)果

再讓結(jié)果自動保存

0x06：完整代碼

#!/usr/bin/python

#-*-coding:utf-8-*-

importrequests

importurllib3

urllib3.disable_warnings()

urls=[]

defdirsearch(u,dir):

try:

headers={

'User-Agent':'Mozilla/5.0(WindowsNT10.0;WOW64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/65.0.3314.0Safari/537.36SE2.XMetaSr1.0'}

#假的200頁面進(jìn)行處理

hackxchackxchackxc='/hackxchackxchackxc.php'

hackxchackxchackxc_404=requests.get(url=u+hackxchackxchackxc,headers=headers)

#printlen(hackxchackxchackxc_404.content)

xxxxxxxxxxxx='/xxxxxxxxxxxx'

xxxxxxxxxxxx_404=requests.get(url=u+xxxxxxxxxxxx,headers=headers)

#printlen(xxxxxxxxxxxx_404.content)

#正常掃描

req=requests.get(url=u+dir,headers=headers,timeout=3,verify=False)

#printlen(req.content)

ifreq.status_code==200:

iflen(req.content)!=len(hackxchackxchackxc_404.content)andlen(req.content)!=len(xxxxxxxxxxxx_404.content):

print"[+]",req.url

withopen('success_dir.txt','a+')asf:

f.write(req.url+"\n")

else:

printu+dir,404

else:

printu+dir,404

except:

pass

if__name__=='__main__':

url=raw_input('\nurl:')

print""

if'http'notinurl:

url='http://'+url

dirpath=open('r