def urlDetect(urls, protocol, nThreads=40):
tools.setSheetTitle(t1_len=25,
title1="URL",
t2_len=2,
title2="Status",
t3_len=1,
title3="Visitable",
t4_len=20,
title4="Title")
start_time = time.time()
# print(tools.content2List(urls))
#因为当与用户输入 baidu.com时input2result无法处理,所以这里捕获一下异常人工进行处理一下,直接给其加上http或者www
try:
urls = tools.input2result(urls)
except:
# print("出错啦")
#msg = "Please input standard url like http://www.test.com or https://www.test.com"
# print(msg)
# if "www" not in urls:
# urls = "{protocol}://www.".format(protocol=protocol) + urls
# else:
urls = "{protocol}://".format(
protocol=protocol
) + urls #由于有时 类似 https://www.test.test.com 是不能正常访问的,所以就不手工添加www,先把上面代码注释掉,下次需要的时候再使用(2019-10-24 19:08:46)
#根据用户输入的不同,执行不同的操作
if type(urls) == type([]):
urls = GetQueue(urls)
elif type(urls) == type(""):
temp = []
temp.append(urls)
urls = GetQueue(temp)
ThreadList = []
for i in range(0, nThreads):
t = URLDetect(urls, protocol)
ThreadList.append(t)
for t in ThreadList:
t.start()
for t in ThreadList:
t.join()
msg1 = "[+] Time cost:" + str(time.time() - start_time) + " s"
msg2 = "[+] {count} visitable URLs have been found".format(count=count)
printc.printf(msg1, "yellow")
printc.printf(msg2, "yellow")
def menu():
global nThread, ports, PortList, response
tool = Tool()
address = ""
parser = argparse.ArgumentParser()
parser.add_argument(
'-host',
dest='host',
help=
'-h To scan the open ports of the Host Default scanning ports are most usual ports '
)
parser.add_argument(
'-sh',
dest='sh',
help=
'Specific Host Detective Example: -sh 127.0.0.1 '
)
parser.add_argument(
'-ah',
dest='ah',
help=
'All alive Hosts .Find all alive hosts Example: -ah 192.168.1.1-255'
)
parser.add_argument('-t', dest='t', help='Threads(1-200) Default is 80')
parser.add_argument(
'-r',
dest='r',
help=
'Read hosts file Example: -r "hosts.txt"'
)
parser.add_argument(
'-p',
dest='p',
help=
'Ports Example: -p="80,8080,443" or -p 1-255 default are most usual ports'
)
parser.add_argument(
'-o',
dest='o',
help=
'Output file address Example: -o recoder.txt or -o D:\\recoder.txt'
)
parser.add_argument(
'-dir',
dest='dir',
help=
'Scanning visible background directory Example: -dir http://127.0.0.1'
)
parser.add_argument(
'-add',
dest='add',
help=
'Dictionary File Address Example: -dir http://127.0.0.1 -add C:\dic.txt'
)
parser.add_argument(
'-sdn',
dest='sdn',
help=
'Subdomain names Example: -sdn baidu.com -types 3 -sdn pku.edu.cn -types 1 -sdn cn.gov.cn -types 2 '
)
parser.add_argument(
'-pro',
dest='pro',
help=
'Protocol Example: -pro https Default Protocol is http '
)
parser.add_argument(
'-types',
dest='types',
help=
'Using different dictionary txt file 1 2 3 means school government company website,it can make the result more reliable'
)
parser.add_argument(
'-url',
dest='url',
help=
'Butian SRC list url Example: -url https://butian.net/Reward/pub'
)
parser.add_argument(
'-page',
dest='page',
help=
'Butian SRC Pages Default is 10 Example: -urldetect baidu.com or -urldetect urls.txt'
)
parser.add_argument(
'-urldetect',
dest='urldetect',
help=
'url Detective Example: -url https://butian.net/Reward/pub'
)
parser.add_argument(
'-ip',
dest='ip',
help=
'Find ip information Example: -urldetect baidu.com or -urldetect urls.txt'
)
parser.add_argument('-help',
action="store_true",
help='To show help information')
options = parser.parse_args()
if options.host:
# if options.r:
# address = str(options.r) 待完成功能
# host_list = tools.content2List(address)
if options.o:
address = tool.address(options.o)
tool.output(address)
if options.t:
tool.nThreads(options.t)
if options.p:
PortList = tool.changeList(tool.split2List(options.p))
msg1 = msg2 = ''
if len(PortList) < 50:
for i in PortList:
msg1 += str(i) + ' '
msg2 = "[*] Scanning Ports :" + msg1
printc.printf(msg2, "skyblue")
#进行单个ip以及批量域名扫描
res_host = tools.input2result(str(options.host))
if type(res_host) == type([]):
for host in res_host:
s = tool.standardUrl(host)
ip = tools.getIPByName(s)
info = "[+]Starting scanning:" + str(s) + "({ip})".format(
ip=ip)
printc.printf(info, 'yellow')
scan_host_ports(s)
tool.printIfExist(address)
else:
s = tool.standardUrl(res_host)
ip = tools.getIPByName(s)
info = "[+]Starting scanning:" + str(s) + "({ip})".format(ip=ip)
printc.printf(info, 'yellow')
scan_host_ports(s)
tool.printIfExist(address)
elif options.ah:
if options.o:
address = tool.address(options.o)
tool.output(address)
if options.t:
tool.nThreads(options.t)
if options.p:
ports = tool.changeList(tool.split2List(options.p))
msg1 = msg2 = ''
for i in ports:
msg1 += str(i) + ' '
msg2 = "[*] Scanning Ports :" + msg1
printc.printf(msg2, "skyblue")
#print(msg2)
ip_addr = options.ah
scan_all_hosts(str(ip_addr))
tool.printIfExist(address)
elif options.r:
if options.o:
address = tool.address(options.o)
tool.output(address)
if options.t:
tool.nThreads(options.t)
if options.p:
PortList = tool.changeList(tool.split2List(options.p))
ports = tool.changeList(tool.split2List(options.p))
msg1 = msg2 = ''
for i in PortList:
msg1 += str(i) + ' '
msg2 = "[*] Scanning Ports :" + msg1
printc.printf(msg2, "skyblue")
file_add = options.r
scan_all_hosts_from_file(file_add)
tool.printIfExist(address)
elif options.sh:
if options.p:
ports = tool.changeList(tool.split2List(options.p))
msg1 = msg2 = ''
for i in ports:
msg1 += str(i) + ' '
msg2 = "[*] Scanning Ports :" + msg1
printc.printf(msg2, "skyblue")
flag = False
ip_addr = options.sh
for port in ports:
if (scan_specific_hosts(ip_addr, port) == True):
flag = True
break
if flag == True:
s1 = "[+] " + str(ip_addr) + "UP"
printc.printf(s1, "green")
else:
s1 = "[+] " + str(ip_addr) + "Down"
printc.printf(s1, "darkred")
elif options.dir:
start_time = time.time()
if options.o:
address = tool.address(options.o)
tool.output(address)
if options.t:
tool.nThreads(options.t)
#根据用户输入的数据来返回不同的结果,如果用户输入的是http://www.baidu.com则直接返回结果,如果用户输入的是txt文件地址则将结果返回list
res_host = tools.input2result(str(options.dir))
if type(res_host) == type([]):
for host in res_host:
# host=options.dir
if tool.isStandard(host) == True:
res = tool.Requests(host)
response = tool.set2utf8cont(res)
#dirList=tool.content2List()
if options.add:
add = options.add
else:
#Windows和Linux平台文件目录稍有差别
if "Windows" in systeminfo:
add = str(os.getcwd()) + "\\dict\\directory.txt"
# elif "Linux" in systeminfo:
else:
add = str(os.getcwd()) + "/dict/directory.txt"
scanDir(host, add)
# tool.printIfExist(address)
else:
printc.printf(
"\n[-] 请在您输入的地址前面添加http或者https。http://127.0.0.1 或者 https://www.baidu.com 格式的地址",
'yellow')
else:
host = res_host
if tool.isStandard(host) == True:
res = tool.Requests(host)
response = tool.set2utf8cont(res)
#dirList=tool.content2List()
if options.add:
add = options.add
else:
#Windows和Linux平台文件目录稍有差别
if "Windows" in systeminfo:
add = str(os.getcwd()) + "\\dict\\directory.txt"
#elif "Linux" in systeminfo:
else:
add = str(os.getcwd()) + "/dict/directory.txt"
scanDir(host, add)
# tool.printIfExist(address)
else:
printc.printf(
"\n[-] 请在您输入的地址前面添加http或者https。http://127.0.0.1 或者 https://www.baidu.com 格式的地址",
'yellow')
s1 = '[*] The scanning is finished'
s2 = '[*] Time cost :' + str((time.time() - start_time)) + ' s'
printc.printf(s1, "yellow")
printc.printf(s2, "yellow")
tool.printIfExist(address)
elif options.url:
url = options.url
if options.o:
address = tool.address(options.o)
tool.output(address)
if options.page:
page = options.page
else:
# url="https://butian.net/Reward/pub"
# page=10
page = 10
butianInfo.get_src_name(url, page)
tool.printIfExist(address)
elif options.sdn:
domain = options.sdn
if options.o:
address = tool.address(options.o)
tool.output(address)
if options.t:
tool.nThreads(options.t)
if options.pro:
protocol = options.pro
else:
protocol = "http"
if options.types:
types = int(options.types)
else:
types = 0
subdomains.getSubdomainName(nThread, types, domain, protocol)
#subdomains.getSubdomainName(300,1,"ncu.edu.cn","http")
tool.printIfExist(address)
elif options.urldetect:
urls = options.urldetect
if options.o:
address = tool.address(options.o)
tool.output(address)
if options.t:
tool.nThreads(options.t)
if options.pro:
protocol = options.pro
else:
protocol = "http"
subdomains.urlDetect(urls, protocol=protocol, nThreads=nThread)
tool.printIfExist(address)
elif options.ip:
if options.o:
address = tool.address(options.o)
tool.output(address)
ip = options.ip
tools.findAddressByIp(ip)
tool.printIfExist(address)
else:
helpInfo()
def menu():
global vulnerable_list
day = time.strftime("%Y-%m-%d",
time.localtime()).replace("-", "") #当前日期20190725
start_time = "{day}T220000+0800".format(day=day) #默认扫描任务是每天晚上10点
profile = "F" #默认是全类型漏洞扫描
speed = 's' #默认是慢扫描
protocol = "http" #默认是http
parser = argparse.ArgumentParser()
#AWVS区
parser.add_argument(
'-add',
dest='add',
help=
'The text file of targets Example: -add url.txt'
)
parser.add_argument(
'-pro',
dest='pro',
help=
'Protocol:https or http Default is http Example: -pro https '
)
parser.add_argument(
'-start',
dest='start',
help=
'The starting time of scanning! Default starting time is now Example: -start {time}'
.format(time=present_awvs_time))
parser.add_argument(
'-speed',
dest='speed',
help=
'Scanning speed(3 options:f,m,s) Default is s Slow scanning Example: -speed f'
)
parser.add_argument(
'-profile',
dest='profile',
help=
'Scaning Profile(6 options:H[High vul],W[Weak Password],C[Crawling],X[XSS],S[SQL],F[Full scan]) Default is F Full scanning'
)
parser.add_argument(
'-delete',
dest='delete',
help=
'Delete targets 4 options:1[NO vuln targets],2[NO vuln targets+low vuln targets],3[NO vuln targets+Medium vuln targets],4[All targets] Example: -delete 1'
)
parser.add_argument('-second',
dest='second',
help='second Example: -second 3600')
#vulnerability
parser.add_argument(
'-weblogic',
dest='weblogic',
help='Example: -weblogic /usrs/targets.txt or -weblogic 127.0.0.1')
parser.add_argument(
'-joomla',
dest='joomla',
help='Example: -joomla /usrs/targets.txt or -joomla 127.0.0.1')
parser.add_argument(
'-exploit',
dest='exploit',
help='Example: -exploit /usrs/targets.txt or -exploit 127.0.0.1')
parser.add_argument(
'-command',
dest='command',
help='Example: -command python2 poc.py -p 3389 -d /web/web.xml ')
parser.add_argument(
'-poc_add',
dest='poc_add',
help='Example: -poc_add="vulnerability,cve-2020-01-01,cve-2020-01-01.py'
)
parser.add_argument('-flag',
dest='flag',
help='Example: -flag="Refused,No Response"')
parser.add_argument('-time_out',
dest='time_out',
help='Example: -time_out 1 Default is 2')
parser.add_argument(
'-vuln_name',
dest='vuln_name',
help='Example: -vuln_name cve-2020-01-01 Default is NULL')
parser.add_argument(
'-ecology',
dest='ecology',
help='Example: -ecology baidu.com or -ecology /usrs/targets.txt')
parser.add_argument('-o', dest='o', help='Example: -o res.txt')
parser.add_argument('-help',
action="store_true",
help='To show help information')
options = parser.parse_args()
#批量添加扫描任务,可以自定义时间,扫描类型,扫描速度,默认是慢速扫描,全漏洞扫描,晚上十点开始扫描
if options.add:
second = seconds_default #默认是每隔10分钟开启一个新的扫描任务,主要是防止扫描器吃不消
add = options.add #存放目标站点的TXT文件
if options.pro:
protocol = options.pro #目标中没有协议时
if options.start:
start_time = options.start #开始扫描的时间,如果没有指定立即扫描
if options.profile:
profile = options.profile #扫描类型,默认扫描类型是全扫描
if options.speed:
speed = options.speed #扫描速度,默认是慢扫描
if options.second:
second = int(options.second)
target = tool.content2List(add) #获取扫描的目标,并将其内容转化为列表
tool.setSheetTitle(15, "URL", 6, "Start Time", 7, "Profile", 2,
"Speed", 20, "ID") #首先打印表格的标题
count = 0 # 每扫描1个任务,后面任务依次类推推迟1200s扫描
for address in target:
url_pattern = "(\w+[:/.\w-]+\.[a-z\d]{2,3}[:\w/]*)" #匹配有效的目标地址形如https://shbxwsb.nbhrss.gov.cn:8080/1212 或者 baidu.com
address = re.findall(url_pattern, address, re.S)
if address:
count = count + 1
address = address[0]
# if "www" not in address:
# address = "www." + address
if re.findall(
"^http", address, re.S
) == []: #对于没有指定http或者https协议的url,默认加http头,当然也可以通过-pro参数来指定
address = protocol + "://" + str(address) #如果目标中没有协议则写入协议
if count != 1:
start_time = awvs.awvs2standardTime(
start_time
) #将awvs时间转化为标准时间 并返回字典的形式{"y":"2019","m":"07","d":"12","h":"12","m":"20","s":"00"}
start_time = awvs.nSecondLatter(
start_time, second) #每扫描1个任务,后面任务依次类推推迟300s扫描
start_time = awvs.time2awvstime(
start_time) #转化为awvs能够识别的时间20190805T123640+0800
# print(count)
awvs.add_tasks(address, address, "10", speed)
awvs.start_scan(address, profile, start_time, speed) #开启扫描
#批量删除没有发现漏洞的目标,-delete参数后面是一个存放url和ID的txt文件
elif options.delete:
types = int(options.delete)
print("\n")
if types == 1:
msg = " 开始删除扫描器中没有发现任何漏洞的扫描任务"
elif types == 2:
msg = " 开始删除扫描器中没有发现任何漏洞或者仅仅发现低危漏洞的扫描任务"
elif types == 3:
msg = " 开始删除扫描器中没有发现任何漏洞或者发现中危以及以下漏洞的扫描"
elif types == 4:
msg = " 开始删除扫描器中的所有扫描任务"
print(msg)
print("\n")
tool.setSheetTitle(15, "URL", 18, "ID", 20, "Status") #设置标题
awvs.deleteTask(types) #开始进行删除任务操作
#vulnerability区域
elif options.weblogic:
msg = address = ''
if options.o:
address = tool.address(options.o)
tool.output(address)
res = tool.input2result(str(options.weblogic))
#指定http协议时
if options.pro:
protocol = str(options.pro)
if type(res) == type([]):
for host in res:
host = tool.setDefaultPro(protocol=protocol, url=host)
weblogic_cve_2019_2729.check(host)
else:
host = tool.setDefaultPro(protocol=protocol, url=res)
weblogic_cve_2019_2729.check(host,
vulnerable_list=vulnerable_list)
#不指定时默认设定http协议
else:
if type(res) == type([]):
for host in res:
host = tool.setDefaultPro(url=host)
msg = "[+] Start detecting if {host} is vulnerable to CVE-2019-2729".format(
host=host)
print(msg)
weblogic_cve_2019_2729.check(host)
else:
host = tool.setDefaultPro(url=res)
msg = "[+] Start detecting if {host} is vulnerable to CVE-2019-2729".format(
host=host)
print(msg)
weblogic_cve_2019_2729.check(host)
# if vulnerable_list:
# msg="************** Below are vulnerable URL:******************"
# printc.printf(msg,'yellow')
# tool.printList(vulnerable_list,"green")
tool.printIfExist(address)
#检查joomla的RCE漏洞
elif options.joomla:
if options.o:
address = tool.address(options.o)
tool.output(address)
res = tool.input2result(str(options.joomla))
#print(res)
#指定http协议时
if options.pro:
protocol = str(options.pro)
if type(res) == type([]):
for host in res:
host = tool.setDefaultPro(protocol=protocol, url=host)
msg = "[+] Starting detecting {target}".format(target=host)
print(msg)
host = tool.setDefaultPro(protocol=protocol, url=host)
command = Joomla_3_4_6_RCE.command(host)
os.system(command)
else:
host = res
host = tool.setDefaultPro(protocol=protocol, url=res)
msg = "[+] Starting detecting {target}".format(target=res)
print(msg)
command = Joomla_3_4_6_RCE.command(res)
os.system(command)
else:
if type(res) == type([]):
for host in res:
host = tool.setDefaultPro(url=host)
msg = "[+] Starting detecting {target}".format(target=host)
print(msg)
host = tool.setDefaultPro(protocol=protocol, url=host)
command = Joomla_3_4_6_RCE.command(host)
os.system(command)
else:
host = res
host = tool.setDefaultPro(url=host)
msg = "[+] Starting detecting {target}".format(target=res)
print(msg)
command = Joomla_3_4_6_RCE.command(res)
os.system(command)
#任何poc只要放进到/find/vulnerability/按照一定规则就可以进行批量检测
elif options.exploit:
dataList = []
if options.o:
address = tool.address(options.o)
tool.output(address)
targets = tool.input2result(str(options.exploit))
if options.command:
command = options.command
else:
msg = "您必须输入原POC的完整验证命令。注意不需要加绝对路径,而且不许要输入目标,目标跟在-exploit参数后面"
print(msg)
if options.flag:
flag = options.flag.split(",")
else:
flag = [
"Operation timed out", "most recent call last",
'NotImplementedError'
]
if options.poc_add:
poc_add = options.poc_add.split(",")
else:
pass
if options.time_out:
time_out = options.time_out
else:
time_out = 2
if options.vuln_name:
vuln_name = options.vuln_name
else:
vuln_name = ""
if type(targets) == type([]):
for host in targets:
dataList.append(
exploit.exploit(target=host,
flag=flag,
poc_add=poc_add,
command=command,
vulnerability=vuln_name,
time_out=time_out))
else:
dataList.append(
exploit.exploit(target=targets,
flag=flag,
poc_add=poc_add,
command=command,
vulnerability=vuln_name,
time_out=time_out))
tool.setSheetTitle(t1_len=30,
title1='Target',
t2_len=8,
title2='Vulnerability',
t3_len=2,
title3='Vulnerable',
t4_len=10,
title4='Response')
for data in dataList:
tool.print2sheet(t1_len=30,
t1=data["target"],
title1='Target',
t2_len=8,
t2=data["vuln"],
title2='Vulnerability',
t3_len=2,
t3=data["isVuln"],
title3='Vulnerable',
t4_len=10,
t4=str(data['response']),
title4='Response')
#检测泛微OA数据库配置信息泄漏
elif options.ecology:
if options.o:
address = tool.address(options.o)
tool.output(address)
url = tool.input2result(str(options.ecology))
#print(res)
#指定http协议时
if options.pro:
protocol = str(options.pro)
ecology_OA_db_conf_leak.run(url, protocol)
else:
helpInfo()