展示全景的,利用路径遍历漏洞的工具

  • A+
所属分类:颓废's Blog
摘要

展示全景的是一个开源的渗透测试工具,能够exploitingA路径遍历漏洞。
” 偶尔在渗透测试,我遇到一个路径遍历漏洞不能轻易转换为射频识别和利用。 这是相当令人沮丧的漏洞升级您的访问,当你没有一个大型数据库的默认位置已知的配置,日志或其他重要文件。 的挫败感,展示全景的born.A Miroslav Stampar的协作和无价的帮助,我们写了一个工具,搜索常见文件通过LFI漏洞。” ——一个 罗伯特·萨尔加多(开发人员) 。
注意: 展示全景的需要Python 2.6或更高版本。   用法: panoptic.py –url TARGET [options] Options: -h/–help show this help message and exit -v/–verbose display extra output information -u/–url=URL set target URL -p/–param=PARAM set parameter name to test for (e.g. “page”) -d/–data=DATA set data for HTTP POST request (e.g. “page=default”) -t/–type=TYPE set type of file to look for (“conf” or “log”) -o/–os=OS set filter name for OS (e.g. “*NIX”) -s/–software=SOFT.. set filter name for software (e.g. “PHP”) -c/–category=CATE.. set filter name for category (e.g. “FTP”) -l/–list=GROUP list available filters for group (e.g. “software”) -a/–auto avoid user interaction by using default options -w/–write-files write content of retrieved files to output folder -x/–skip-parsing skip special tests if *NIX passwd file is found –load=LISTFILE load and try user provided list from a file –ignore-proxy ignore system default HTTP proxy –proxy=PROXY set proxy (e.g. “socks5://192.168.5.92”) –user-agent=UA set HTTP User-Agent header value –random-agent choose random HTTP User-Agent header value –cookie=COOKIE set HTTP Cookie header value (e.g. “sid=foobar”) –header=HEADER set a custom HTTP header (e.g. “Max-Forwards=10”) –prefix=PREFIX set prefix for file path (e.g. “../”) –postfix=POSTFIX set postfix for file path (e.g. “”) –multiplier=MULTI.. set multiplication number for prefix (default: 1) –bad-string=STRING set a string occurring when file is not found –replace-slash=RE.. set replacement for char / in paths (e.g. “/././”) –threads=THREADS set number of threads (default: 1) –update update Panoptic from official repository

展示全景的,利用路径遍历漏洞的工具

展示全景的是一个开源的渗透测试工具,能够exploitingA路径遍历漏洞
” 偶尔在渗透测试,我遇到一个路径遍历漏洞不能轻易转换为射频识别和利用。 这是相当令人沮丧的漏洞升级您的访问,当你没有一个大型数据库的默认位置已知的配置,日志或其他重要文件。 的挫败感,展示全景的born.A Miroslav Stampar的协作和无价的帮助,我们写了一个工具,搜索常见文件通过LFI漏洞。” ——一个 罗伯特·萨尔加多(开发人员) 。
注意: 展示全景的需要Python 2.6或更高版本。
  用法:
panoptic.py --url TARGET [options]  Options: -h/--help             show this help message and exit -v/--verbose          display extra output information -u/--url=URL          set target URL -p/--param=PARAM      set parameter name to test for (e.g. "page") -d/--data=DATA        set data for HTTP POST request (e.g. "page=default") -t/--type=TYPE        set type of file to look for ("conf" or "log") -o/--os=OS            set filter name for OS (e.g. "*NIX") -s/--software=SOFT..  set filter name for software (e.g. "PHP") -c/--category=CATE..  set filter name for category (e.g. "FTP") -l/--list=GROUP       list available filters for group (e.g. "software") -a/--auto             avoid user interaction by using default options -w/--write-files      write content of retrieved files to output folder -x/--skip-parsing     skip special tests if *NIX passwd file is found --load=LISTFILE       load and try user provided list from a file --ignore-proxy        ignore system default HTTP proxy --proxy=PROXY         set proxy (e.g. "socks5://192.168.5.92") --user-agent=UA       set HTTP User-Agent header value --random-agent        choose random HTTP User-Agent header value --cookie=COOKIE       set HTTP Cookie header value (e.g. "sid=foobar") --header=HEADER       set a custom HTTP header (e.g. "Max-Forwards=10") --prefix=PREFIX       set prefix for file path (e.g. "../") --postfix=POSTFIX     set postfix for file path (e.g. "") --multiplier=MULTI..  set multiplication number for prefix (default: 1) --bad-string=STRING   set a string occurring when file is not found --replace-slash=RE..  set replacement for char / in paths (e.g. "/././") --threads=THREADS     set number of threads (default: 1) --update              update Panoptic from official repository

例子:

./panoptic.py --url "http://localhost/include.php?file=test.txt" ./panoptic.py --url "http://localhost/include.php?file=test.txt&id=1" --param file ./panoptic.py --url "http://localhost/include.php" --data "file=test.txt&id=1" --param file  ./panoptic.py --list software ./panoptic.py --list category ./panoptic.py --list os  ./panoptic.py -u "http://localhost/include.php?file=test.txt" --os Windows ./panoptic.py -u "http://localhost/include.php?file=test.txt" --software WAMP

 

项目地址:https://github.com/lightos/Panoptic

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: