【小迪安全day10】信息收集——资产监控拓展

最新推荐文章于 2024-02-22 00:03:57 发布

RichUee

最新推荐文章于 2024-02-22 00:03:57 发布

阅读量457

点赞数 3

分类专栏：网安学习文章标签：安全 python 开发语言

本文链接：https://blog.csdn.net/RichUee/article/details/128104527

版权

网安学习专栏收录该内容

11 篇文章 5 订阅

订阅专栏

![在这里插入图片描述](https://img-blog.csdnimg.cn/34fa6c839cdf4f649377fa6f5de4ee30.png

1、Github监控

GitHub是搞计算机使用较多的平台，有很多项目，我们监控他可以：
（1）便于收集整理最新exp或poc
(POC全称是Proof of Concept，中文译作概念验证。它是专门为了验证漏洞是否真的存在的脚本。而EXP全称是Exploit，中文译作漏洞利用程序。它是对POC验证结果的一种漏洞利用脚本。)
（2）便于发现相关测试目标的资产

创建一个git.py文件：

# Title: wechat push CVE-2020
# Date: 2020-5-9
# Exploit Author: weixiao9188
# Version: 4.0
# Tested on: Linux,windows
# cd /root/sh/git/ && nohup python3 /root/sh/git/git.py &
# coding:UTF-8

import requests
import json
import time
import os
import pandas as pd

time_sleep = 60  # 每隔 20 秒爬取一次
while (True):
    headers1 = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)Chrome/70.0.3538.25 Safari/537.36 Core/1.70.3741.400 QQBrowser/10.5.3863.400"}
    # 判断文件是否存在
    datas = []
    response1 = None
    response2 = None
    if os.path.exists("olddata.csv"):
    # 如果文件存在则每次爬取 10 个
        df = pd.read_csv("olddata.csv", header=None)
        datas = df.where(df.notnull(), None).values.tolist()
        # 将提取出来的数据中的 nan 转化为 None
        requests.packages.urllib3.disable_warnings()
        response1 = requests.get(url="https://api.github.com/search/repositories?q=CVE-2020&sort=updated&perpage = 10",headers=headers1,verify=False)
        response2 =requests.get(url="https://api.github.com/search/repositories?q=RCE&ssort=updated&per_page=10", headers = headers1, verify = False)
    else:
    # 不存在爬取全部
        datas = []
        requests.packages.urllib3.disable_warnings()
        response1 = requests.get(url="https://api.github.com/search/repositories?q=CVE-2020&sort=updated&order=desc",headers=headers1, verify=False)
        response2 =requests.get(url="https://api.github.com/search/repositories?q=ctcms&ssort=updated&order=desc", headers=headers1,verify=False)

    data1 = json.loads(response1.text)
    data2 = json.loads(response2.text)
    for j in [data1['items'], data2['items']]:
        for i in j:
            s = {"name": i['name'], "html": i['html_url'], "description": i['description']}
            s1 = [i['name'], i['html_url'], i['description']]
    if s1 not in datas:
        # print(s1)
        # print(datas)
        params = {
            "text": s["name"],
            "desp": "链接:" + str(s["html"]) + "\n简介" + str(s["description"])
        }
        print("当前推送为" + str(s) + "\n")
        # print(params)
        requests.packages.urllib3.disable_warnings()
        requests.get("https://sct.ftqq.com/SCT185331TtMYVH3JjRXBysR1eY4U7pb7N.send", params=params, headers=headers1, timeout=10, verify=False)
        time.sleep(1)
        # 以防推送太快
        print("推送成功！\n")
        datas.append(s1)
    else:
        pass
        print("数据已经存在！")
pd.DataFrame(datas).to_csv("olddata.csv", header=Nonne, Index=None)
time.sleep(time_sleep)