python web指纹获取加目录扫描加端口扫描加判断robots.txt
前言:
总结上几次的信息收集构造出来的。
0x01:
首先今行web指纹识别,然后在进行robots是否存在。后面是目录扫描
然后到使用nmap命令扫描端口。(nmap模块在windows下使用会报停止使用的鬼鬼)
0x02:
代码:
import requests import os import socket from bs4 import BeautifulSoup import time def Webfingerprintcollection(): global lgr lgr=input('请输入目标域名:') url="http://{}".format(lgr) header={'User-Agent':'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36'} r=requests.get(url,headers=header) xyt=r.headers for key in xyt: print(key,':',xyt[key]) Webfingerprintcollection() print('================================================') def robots(): urlsd="http://{}/robots.txt".format(lgr) header = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36'} gf=requests.get(urlsd,headers=header,timeout=8) if gf.status_code == 200: print('robots.txt存在') print('[+]该站存在robots.txt',urlsd) else: print('[-]没有robots.txt') robots() print("=================================================") def Webdirectoryscanner(): dict=open('build.txt','r',encoding='utf-8').read().split('\n') for xyt in dict: try: header = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36'} urljc="http://"+lgr+"{}".format(xyt) rvc=requests.get(urljc,headers=header,timeout=8) if rvc.status_code == 200: print('[*]',urljc) except: print('[-]远程主机强迫关闭了一个现有的连接') Webdirectoryscanner() print("=====================================================") s = socket.gethostbyname(lgr) def portscanner(): o=os.system('nmap {} program'.format(s)) print(o) portscanner() print('======================================================') def whois(): heads={'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36'} urlwhois="http://site.ip138.com/{}/whois.htm".format(lgr) rvt=requests.get(urlwhois,headers=heads) bv=BeautifulSoup(rvt.content,"html.parser") for line in bv.find_all('p'): link=line.get_text() print(link) whois() print('======================================================') def IPbackupdomainname(): wu=socket.gethostbyname(lgr) rks="http://site.ip138.com/{}/".format(wu) rod={'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36'} sjk=requests.get(rks,headers=rod) liverou=BeautifulSoup(sjk.content,'html.parser') for low in liverou.find_all('li'): bc=low.get_text() print(bc) IPbackupdomainname() print('=======================================================')