三联套娃AWVS+Burp+XRAY,躺平刷洞(附批量脚本)

免责声明

0x01前言

续之前上一篇xray联动red,多个扫描器之间进行联动扫描漏洞,组合为非是:awvs+burp可在burp的http历史记录查看每一个数据包;awvs+xray无疑awvs的爬虫很好用,支持表单分析和单页应用的爬取,xray的扫描功能很强大;xray+burp将burp的流量转发给xray扫描,简单点来说就是你访问一个页面,xray就会对这个页面就行扫描;各有各的好处,三个套在一起,可谓是取长补短

0x02设置步骤

burp设置

设置burp代理,AWVS扫描流量会转发到burp

在添加一层代理转发给xray联动

xray设置

启动xray,设置代理与上一步ip端口一致

xray_windows_amd64.exe webscan --listen 127.0.0.1:1664 --html-output shy.html

AWVS设置

启动AWVS,添加扫描目标和代理,并自定义请求头

效果展示

burp

xray

AWVS

拓展

批量给awvs添加目标,实现自动化刷洞

需注意一下几点

1. 将apikey 替换为自己的,可在AWVSweb端进行生成

2. 修改代码58行,配置批量添加目标url.txt

3. 将awvs_url改为自己awvs地址和端口

#coding=utf-8
import requests
import json

import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


apikey = '1986ad8c0a5b3df4d7028d5f3c06e936c9ac1de7079174939808751e8af186837'  # API

headers = {'Content-Type': 'application/json', "X-Auth": apikey}


def addTask(url, target):
    try:
        url = ''.join((url, '/api/v1/targets/add'))
        data = {"targets": [{"address": target, "description": ""}], "groups": []}
        r = requests.post(url, headers=headers, data=json.dumps(data), timeout=30, verify=False)
        result = json.loads(r.content.decode())
        return result['targets'][0]['target_id']
    except Exception as e:
        return e


def scan(url, target, Crawl, user_agent, profile_id, proxy_address, proxy_port):
    scanUrl = ''.join((url, '/api/v1/scans'))
    target_id = addTask(url, target)

    if target_id:
        data = {"target_id": target_id, "profile_id": profile_id, "incremental": False,
                "schedule": {"disable": False, "start_date": None, "time_sensitive": False}}
        try:
            configuration(url, target_id, proxy_address, proxy_port, Crawl, user_agent)
            response = requests.post(scanUrl, data=json.dumps(data), headers=headers, timeout=30, verify=False)
            result = json.loads(response.content)
            return result['target_id']
        except Exception as e:
            print(e)


def configuration(url, target_id, proxy_address, proxy_port, Crawl, user_agent):
    configuration_url = ''.join((url, '/api/v1/targets/{0}/configuration'.format(target_id)))
    data = {"scan_speed": "fast", "login": {"kind": "none"}, "ssh_credentials": {"kind": "none"}, "sensor": False,
            "user_agent": user_agent, "case_sensitive": "auto", "limit_crawler_scope": True, "excluded_paths": [],
            "authentication": {"enabled": False},
            "proxy": {"enabled": Crawl, "protocol": "http", "address": proxy_address, "port": proxy_port},
            "technologies": [], "custom_headers": [], "custom_cookies": [], "debug": False,
            "client_certificate_password": "", "issue_tracker_id": "", "excluded_hours_id": ""}
    r = requests.patch(url=configuration_url, data=json.dumps(data), headers=headers, timeout=30, verify=False)


def main():
    Crawl = True
    proxy_address = '127.0.0.1'
    proxy_port = '8080'
    awvs_url = 'https://127.0.0.1:3443'  # awvs url
    with open(r'C:\x\x\url.txt', 'r', encoding='utf-8') as f:        #添加URL路径
        targets = f.readlines()
    profile_id = "11111111-1111-1111-1111-111111111111"
    user_agent = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21"  # 扫描默认UA头
    if Crawl:
        profile_id = "11111111-1111-1111-1111-111111111117"

    for target in targets:
        target = target.strip()
        if scan(awvs_url, target, Crawl, user_agent, profile_id, proxy_address, int(proxy_port)):
            print("{0} 添加成功".format(target))


if __name__ == '__main__':
    main()

工具 获取

链接：https://pan.baidu.com/s/1lZHsZJnCjKKpzkZ7mVhiUA
提取码：0000

原文始发于微信公众号（琴音安全）：三联套娃AWVS+Burp+XRAY,躺平刷洞(附批量脚本)