安服仔小工具-Host注入

#!/usr/bin/env python3# -*- coding: utf-8 -*-# @File : Host_into.py# @Author : Parchment# @Time : 2021/5/19 10:32# @Software: PyCharm
import requestsimport sysimport reimport csv
listsall = []   # 用于存储数据的总列表

def scan(url):    dns_url = "http://www.dnslog.cn/"       # dnslog地址    urlget = "http://www.dnslog.cn/getdomain.php"       # dnslog获取子域名链接    urlrender = "http://www.dnslog.cn//getrecords.php"  # dnslog获取子域名访问日志链接    conn1 = requests.session()          # 做一个会话保持    conn1.get(url=dns_url)      # 发起dnslog的首页请求    lisss = []      # 用于存储数据的列表    requests.packages.urllib3.disable_warnings()  # 禁用安全请求警告    payload = conn1.get(url=urlget).text    # 发起dnslog获取子域名的请求并取出子域名 作为payload    print("获取到的dnslog子域名：" + payload)    headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0',               'host': payload}     # 设定目标站的 host 值    res = re.search('http', url)      # 判断 url 是否存在http    if res is None:     # 如果变量 res 为 None 那么进行拼接 http:// 或 http:// 并发起请求        try:    # 当http访问发生错误时 将进行https访问            urls = "http://"+url            print(urls)            r = requests.get(url=urls, headers=headers,                             timeout=8, allow_redirects=False, verify=False)        except Exception as e:            urls = "https://" + url            print(urls)            try:                r = requests.get(url=urls, headers=headers,                                 timeout=8, allow_redirects=False, verify=False)            except Exception as err:                print(err)    else:       # 否则正常发起请求        try:            r = requests.get(url=url, headers=headers, timeout=8, allow_redirects=False, verify=False)        except Exception as err:            print(err)    try:        code = r.status_code        # 获取目标站点的状态码        dlog = conn1.get(url=urlrender, timeout=8).text   # 获取dnslog得到的访问日志列表        if payload in dlog:         # 判断是否为空 不为空即可证实存在Host注入            print("dnslog" + dlog)            print("dnslog验证存在")            lisss.append(url)            lisss.append("dnslog验证存在")            listsall.append(lisss)        elif code == 200:       # 根据状态码进行判断 状态码为200时            text = r.text            if payload in text:         # 判断返回的文本中是否存在 payload 字段                lisss.append(url)                lisss.append('html验证存在')                listsall.append(lisss)                print("html验证存在")            else:                print("不存在")            print("dnslog"+conn1.get(url=urlrender, timeout=8).text)        elif code == 302:   # 状态码为302时            locations = r.headers['Location']            if payload in locations:        # 判断返回包中的Location是否存在 payload 字段                lisss.append(url)                lisss.append('302返回包验证存在')                listsall.append(lisss)                print("返回包验证存在")            else:                print("不存在")        else:            print("不存在")    except Exception as err:        pass    return listsall

def start(argv):    try:        if argv[1] == "-i":            u = argv[2]  # 获取URL            scan(u)            print("-==============================")        elif argv[1] == "-r":            with open(argv[2], 'r') as f:                ff = f.read()                lists = ff.split('n')                for u in lists:                    print(u)                    scan(u)                    print("-==============================")        elif argv[1] == "-h":            print('''            python3 Host_into.py -h                    #帮助            python3 Host_into.py -i 
              #单个url扫描            python3 Host_into.py -r [绝对路径txt]      #批量url扫描                                               ''')        try:            with open("./Host_into.csv", "w", newline='') as csvfile:  # 打开一个.csv文件 没有 就创建一个                writer = csv.writer(csvfile)                writer.writerow(["url", "判断方法"])  # 先写入columns_name                writer.writerows(listsall)  # 写入多行用writerows            print("所有内容已保存至当前目录内：命名为Host_into.csv")        except Exception as err:            pass    except Exception as err:        pass

if __name__ == "__main__":    try:        start(sys.argv[0:])    except KeyboardInterrupt:        print("interrupted by user, killing all threads...")

python3 Host_into.py -h                    #帮助python3 Host_into.py -i 
              #单个url扫描python3 Host_into.py -r [绝对路径txt]        #批量url扫描