指纹识别记录

强仔fight

已于 2022-05-19 11:28:03 修改

阅读量1.7k

点赞数

分类专栏：网络安全文章标签： web安全 java

于 2022-04-21 15:24:14 首次发布

本文链接：https://blog.csdn.net/qq_35076836/article/details/124322535

版权

网络安全专栏收录该内容

3 篇文章 0 订阅

订阅专栏

①判断webserver服务器
识别逻辑: 通过构造错误404页面的返回值识别

protected HttpURLRequest requests = new HttpURLRequest();
//通过404判断webSERVER
  try {
      String page404 = requests.url("http://"+this.target.concat("/asdasdsad")).get().body();
      for (WEBServer web : WEBServer.values()) {
          if (!web.getKeywords().isEmpty())
          {
              if (StringUtils.containsAny(page404,web.getKeywords().toArray(new String[]{}))){
                  task.getResult().getSystemInfo().setWebServer(web);
              }
          }
      }
  } catch (MalformedURLException e) {
      e.printStackTrace();
  }

public enum WEBServer {
    RESIN("Resin"),
    IIS8("class=\"content-container\"><fieldset>"),
    IIS6("go.microsoft.com/fwlink/?linkid="),
    IIS7("Internet Information Services 7","background-color:#555555;}","<h3>您要查找的资源可能已被删除","<div id=\"header\"><h1>服务器错误</h1></div>"),
    NGINX("nginx/"),
    TOMCAT("Apache Tomcat"),
    APACHE("The requested URL","Apache/"),
    WEBLOGIC("Hypertext Transfer Protocol","From RFC 2068","unavailable and has no forwarding address"),
    OTHER;
    private List<String> keywords = new ArrayList<>();
    WEBServer() {
    }

    WEBServer(String ... text) {
        for (String s : text) {
            keywords.add(s);
        }
    }

    public List<String> getKeywords() {
        return keywords;
    }
}

②识别web指纹
遍历指纹库，访问url，通过match字段与md5值进行匹配

//遍历指纹库
for (FingerBean bean : beans) {
    try {
          //目标主机与url拼接
          String url = target.concat(bean.getUrl());
          //请求url,获取返回结果
          HttpResponse response = requests.url(url).get();
          //获取状态码
          int statusCode = response.getStatusCode();
          //获取返回内容
          String content = response.body();
          if (bean.isMatch()){
               //状态码不为404，内容包含或者匹配。
               if (statusCode!=404&&(content.contains(bean.getMatch())||content.matches(bean.getMatch()))){
                            //记录指纹
                        record(finger);
                   }
           }else{
                String md5 = bean.getMd5();
                //根据返回结果匹配Md5
                if (matchMd5(response,md5)){
                         record(finger);
                 }
                    }
      } catch (Exception e) {
               continue;
           }
     }

网络安全相关数据集介绍

https://blog.csdn.net/asialee_bird/article/details/84281149?utm_medium=distribute.pc_relevant.none-task-blog-2~default~baidujs_baidulandingword~default-0-84281149-blog-117459736.pc_relevant_default&spm=1001.2101.3001.4242.1&utm_relevant_index=2