安全工具-cansina

Cansina是一款Web内容的发现工具，使用该工具指定详细的web目录内容作为payload即可破探测出web路径等资源。

• 工具安装操作如下

pip install --user requests[security]
git clone --depth=1 https://github.com/deibit/cansina

• 安装后在安装目录里可以看到以下文件

• 点击cansina.py的帮助信息

+ View Code?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

tdcqma:cansina $ ./cansina.py --help usage: cansina.py -u url -p payload [options]   Cansina is a web content discovery tool. It makes requests and analyze the responses trying to figure out whether the resource is or not accessible.   optional arguments:   -h, --help            show this help message and exit   -A AUTHENTICATION     Basic Authentication (e.g: user:password)   -C COOKIES            your cookies (e.g: key:value)   -D                    Check for fake 404 (warning: machine decision)   -H                    Make HTTP HEAD requests   -P PROXIES            Set a http and/or https proxy (ex:                         http://127.0.0.1:8080,https://...   -S                    Remove ending slash for payloads   -T REQUEST_DELAY      Time (a float number, e.g: 0.25 or 1.75) between                         requests   -U                    Make payload requests upper-case   -a USER_AGENT         The preferred user-agent (default provided)   -b BANNED             List of banned response codes   -B UNBANNED           List of unbanned response codes, mark all response as                         invalid without unbanned response codes, higher                         priority than banned   -c CONTENT            Inspect content looking for a particular string   -d DISCRIMINATOR      If this string if found it will be treated as a 404   -e EXTENSION          Extension list to use e.g: php,asp,...(default none)   -p PAYLOAD            A single file, a file with filenames (.payload) or a                         directory (will do *.txt)   -s SIZE_DISCRIMINATOR                         Will skip pages with this size in bytes (or a list of                         sizes 0,500,1500...)   -t THREADS            Number of threads (default 4)   -u TARGET             Target url   -r RESUME             Resume a session   -R                    Parse robots.txt and check its contents   --recursive           Recursive descend on path directories   --persist             Use HTTP persistent connections   --full-path           Show full path instead of only resources   --show-type           Show content-type in results   --no-follow           Do not follow redirections   License, requests, etc: https://github.com/deibit/cansina

•  使用cansina进行目录内容探测，其中-u指定待扫描域名，-p指定的./directory_list/dire.list则是需要自己配制添加目录字典文件

tdcqma:cansina $ ./cansina.py -u http://pen.test.com.cn/ -p ./directory_list/dire.list 
Resolving pen.test.com.cn
HTTP GET requests
Banned response codes: 404
Using payload: ./directory_list/dire.list
Generating payloads...
Spawning 4 threads 
Total requests 34926  (aprox: 8731 / thread)

cod |    size    |  line  | time |
----------------------------------
200 |        730 |  10925 |   42 |  /cfide/administrator
200 |        730 |  13680 |   41 |  /dms/AggreSpy
200 |        730 |  13681 |   26 |  /dms/DMSDump
200 |        730 |  14981 |   43 |  /etc/motd
200 |        730 |  14984 |   36 |  /etc/shadow
200 |        730 |  18543 |   42 |  /iisadmin

 

参考：https://github.com/deibit/cansina