SRC漏洞挖掘上分技巧

漏洞盒子：https://www.vulbox.com补天漏洞响应平台：https://www.butian.netCNNVD信息安全漏洞库：https://www.cnnvd.org.cn教育漏洞提交平台：https://src.sjtu.edu.cn

fofa资产测绘引擎：https://fofa.info/鹰图资产测绘引擎：https://hunter.qianxin.com/shodan资产测绘引擎：https://www.shodan.io/360资产测绘引擎：https://quake.360.net/零零信安资产测绘引擎：https://0.zone/谷歌hacker语法：https://codeleading.com/article/8526777820/

爱企查：https://aiqicha.baidu.com天眼查：https://www.tianyancha.com企查查：https://www.qcc.com小蓝本：https://www.xiaolanben.com

爱站：https://www.aizhan.com站长工具：https://tool.chinaz.com

佩奇漏洞文库：https://www.yuque.com/peiqiwiki/peiqi-poc-wikihttp://wiki.peiqi.tech/白阁漏洞文库：https://wiki.bylibrary.cn/%E6%BC%8F%E6%B4%9E%E5%BA%93/01-CMS%E6%BC%8F%E6%B4%9E/ActiveMQ/ActiveMQ%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E/狼组安全团队公开知识库：https://wiki.wgpsec.org/knowledge/Morker文库：https://wiki.96.mk/风炫漏洞库：https://evalshell.com/exploit-db漏洞库：https://www.exploit-db.com/

fofaxfofa_viewernucleihttpxip2domain

from os import O_EXCLimport requestsimport threading
defPOC_1(target_url,ss):    vuln_url = target_url + r"/weaver/bsh.servlet.BshServlet"    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36","Content-Type": "application/x-www-form-urlencoded",    }try:        response = requests.get(url=vuln_url, headers=headers, timeout=5,verify=False)if response.status_code == 200and"BeanShell Test"in response.text:with open("存在漏洞的url.txt", 'a', encoding='UTF-8') as f:                print("�33[32m[o] 目标{}存在漏洞".format(target_url))                f.write(vuln_url + "n")else:            print("�33[31m[x] 目标不存在漏洞")except Exception as e:        print("�33[31m[x] 请求失败", e)
with open("fanwei.txt","r",encoding='UTF-8')as f:for i in f.readlines():            ss = i.replace('n','')            ip = i.replace('n','')            threading.Thread(target=POC_1,args=(ip,ss)).start()

#-- coding:UTF-8 --import re, timefrom urllib.parse import urlparseimport requestsfrom fake_useragent import UserAgentfrom tqdm import tqdmimport os
# 爱站defaizhan_chaxun(ip, ua):    aizhan_headers = {'Host': 'dns.aizhan.com','User-Agent': ua.random,'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8','Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2','Accept-Encoding': 'gzip, deflate, br','Referer': 'https://dns.aizhan.com/'}    aizhan_url = 'https://dns.aizhan.com/' + str(ip) + '/'try:        aizhan_r = requests.get(url=aizhan_url, headers=aizhan_headers, timeout=2).text        aizhan_nums = re.findall(r'''<span class="red">(.*?)</span>''', aizhan_r)if int(aizhan_nums[0]) > 0:            aizhan_domains = re.findall(r'''rel="nofollow" target="_blank">(.*?)</a>''', aizhan_r)return aizhan_domainsexcept:pass
defcatch_result(i):    ua_header = UserAgent()    i = i.strip()if"http://"notin i:        i="http://"+itry:        ip = urlparse(i).netloc        aizhan_result = aizhan_chaxun(ip, ua_header)        time.sleep(1)if (aizhan_result != None ):with open("ip反查结果.txt", 'a') as f:                result = "
:" + i + "   " +  "  [aizhan]:" + str(aizhan_result[0])                print(result)                f.write(result + "n")else:with open("反查失败列表.txt", 'a') as f:                f.write(i + "n")except:pass

if __name__ == '__main__':    url_list = open("待ip反查.txt", 'r').readlines()    url_len = len(open("待ip反查.txt", 'r').readlines())#每次启动时清空两个txt文件if os.path.exists("反查失败列表.txt"):        f = open("反查失败列表.txt", 'w')        f.truncate()if os.path.exists("ip反查结果.txt"):        f = open("ip反查结果.txt", 'w')        f.truncate()for i in tqdm(url_list):        catch_result(i)

# -- coding:UTF-8 --import requests   import reimport getoptimport sysimport threadpoolimport urllib.parseimport urllib.requestimport sslfrom urllib.error import HTTPError,URLErrorimport timessl._create_default_https_context = ssl._create_stdlib_context

headers={'Host': 'baidurank.aizhan.com','User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36','Sec-Fetch-Dest': 'document','Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9','Cookie': ''}

defgoogle_simple(url, j):    google_pc = "https://pr.aizhan.com/{}/".format(url)    bz = 0    http_or_find = 0try:        response = requests.get(google_pc, timeout=10).text        http_or_find = 1        result_pc = re.findall(re.compile(r'<span>谷歌PR：</span><a>(.*?)/></a>'), response)[0]        result_num = result_pc.split('alt="')[1].split('"')[0].strip()if int(result_num) > 0:            bz = 1        result = '[+] 谷歌权重:' + result_num + '  ' + jreturn result, bzexcept:if (http_or_find != 0):            result = "[!]格式错误:" + "j"return result, bzelse:            time.sleep(3)return google_simple(url, j)

defgetPc(domain):    aizhan_pc = 'https://baidurank.aizhan.com/api/br?domain={}&style=text'.format(domain)try:
        req = urllib.request.Request(aizhan_pc, headers=headers)        response = urllib.request.urlopen(req,timeout=10)        b = response.read()        a = b.decode("utf8")        result_pc = re.findall(re.compile(r'>(.*?)</a>'),a)        pc = result_pc[0]
except HTTPError as u:        time.sleep(3)return getPc(domain)
return pc
defgetMobile(domain):    aizhan_pc = 'https://baidurank.aizhan.com/api/mbr?domain={}&style=text'.format(domain)try:# b = requests.post(url=post_url,headers=headers, proxies=proxy, timeout = 7)# res = urllib.request.urlopen(aizhan_pc,timeout=10)# # res = opener.open(aizhan_pc,timeout=10)# a = res.read().decode('UTF-8')        req = urllib.request.Request(aizhan_pc, headers=headers)        response = urllib.request.urlopen(req,timeout=10)        b = response.read()        a = b.decode("utf8")        result_m = re.findall(re.compile(r'>(.*?)</a>'),a)        mobile = result_m[0]except HTTPError as u:        time.sleep(3)return getMobile(domain)

return mobile# 权重查询defseo(name,url):
try:
        result_pc = getPc(name)        result_mobile = getMobile(name)
except Exception as u:# print(u)        result_pc = '0'        result_mobile = '0'
        print('[- 目标{}获取权重失败,自动设为0'.format(url))# print('运行正常')    print('[+ 百度权重:'+result_pc+'  移动权重:'+result_mobile+'  Url:'+url)with open('vul.txt','a',encoding='utf-8') as y:        y.write('[百度权重:'+result_pc+','+"移动权重:"+result_mobile+','+url+']'+'n')
returnTrue
defexp(name1):# opts, args = getopt.getopt(sys.argv[1:], '-u:-r:', ['url', 'read'])# print(name1)try:        name = name1[name1.rfind('/'):].strip('/')# print(name)        rew = seo(name,name1)
except Exception as u:# except:        print(u)        print('[- 目标{}检测失败，已写入fail.txt等待重新检测'.format(name1))# file_fail.write(name1+'n')with open('fail.txt',mode='a',encoding='utf-8') as o:            o.write(name1+'n')

defmultithreading(funcname, params=[], filename="ip.txt", pools=15):    works = []with open(filename, "r") as f:for i in f:            func_params = [i.rstrip("n")] + params            works.append((func_params, None))    pool = threadpool.ThreadPool(pools)    reqs = threadpool.makeRequests(funcname, works)
    [pool.putRequest(req) for req in reqs]    pool.wait()
defmain():    multithreading(exp, [], "存在漏洞的url.txt", 15)  # 默认15线程    print("全部check完毕，请查看当前目录下的vul.txt")
if __name__ == "__main__":# st = False# main(st)    main()