Python笔记

YT?M

已于 2022-03-14 11:59:40 修改

阅读量679

点赞数

文章标签： python 开发语言后端

于 2022-03-08 11:33:53 首次发布

本文链接：https://blog.csdn.net/weixin_46402806/article/details/123324949

版权

requests

dirsearch

requests

Requests: HTTP for Humans™ — Requests 2.27.1 documentation

python -m pip install requests

>>> import requests
>>> r=requests.get('http://challenge-f11947463cd47902.sandbox.ctfhub.com:10800/flag_in_here/3/2/flag.txt')
>>> r.text
'ctfhub{b750b20c17d7a9e975f71dca}\n'
>>> exit()

dirsearch

官方网站： GitHub - maurosoria/dirsearch: Web path scanner

python dirsearch.py --help
Usage: dirsearch.py [-u|--url] target [-e|--extensions] extensions [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit

  Mandatory:
    -u URL, --url=URL   Target URL
    -l FILE, --url-list=FILE
                        Target URL list file
    --stdin             Target URL list from STDIN
    --cidr=CIDR         Target CIDR
    --raw=FILE          Load raw HTTP request from file (use `--scheme` flag
                        to set the scheme)
    -e EXTENSIONS, --extensions=EXTENSIONS
                        Extension list separated by commas (Example: php,asp)
    -X EXTENSIONS, --exclude-extensions=EXTENSIONS
                        Exclude extension list separated by commas (Example:
                        asp,jsp)
    -f, --force-extensions
                        Add extensions to every wordlist entry. By default
                        dirsearch only replaces the %EXT% keyword with
                        extensions

  Dictionary Settings:
    -w WORDLIST, --wordlists=WORDLIST
                        Customize wordlists (separated by commas)
    --prefixes=PREFIXES
                        Add custom prefixes to all wordlist entries (separated
                        by commas)
    --suffixes=SUFFIXES
                        Add custom suffixes to all wordlist entries, ignore
                        directories (separated by commas)
    --only-selected     Remove paths have different extensions from selected
                        ones via `-e` (keep entries don't have extensions)
    --remove-extensions
                        Remove extensions in all paths (Example: admin.php ->
                        admin)
    -U, --uppercase     Uppercase wordlist
    -L, --lowercase     Lowercase wordlist
    -C, --capital       Capital wordlist

  General Settings:
    -t THREADS, --threads=THREADS
                        Number of threads
    -r, --recursive     Brute-force recursively
    --deep-recursive    Perform recursive scan on every directory depth
                        (Example: api/users -> api/)
    --force-recursive   Do recursive brute-force for every found path, not
                        only paths end with slash
    -R DEPTH, --recursion-depth=DEPTH
                        Maximum recursion depth
    --recursion-status=CODES
                        Valid status codes to perform recursive scan, support
                        ranges (separated by commas)
    --subdirs=SUBDIRS   Scan sub-directories of the given URL[s] (separated by
                        commas)
    --exclude-subdirs=SUBDIRS
                        Exclude the following subdirectories during recursive
                        scan (separated by commas)
    -i CODES, --include-status=CODES
                        Include status codes, separated by commas, support
                        ranges (Example: 200,300-399)
    -x CODES, --exclude-status=CODES
                        Exclude status codes, separated by commas, support
                        ranges (Example: 301,500-599)
    --exclude-sizes=SIZES
                        Exclude responses by sizes, separated by commas
                        (Example: 123B,4KB)
    --exclude-texts=TEXTS
                        Exclude responses by texts, separated by commas
                        (Example: 'Not found', 'Error')
    --exclude-regexps=REGEXPS
                        Exclude responses by regexps, separated by commas
                        (Example: 'Not foun[a-z]{1}', '^Error$')
    --exclude-redirects=REGEXPS
                        Exclude responses by redirect regexps or texts,
                        separated by commas (Example: 'https://okta.com/*')
    --exclude-content=PATH
                        Exclude responses by response content of this path
    --skip-on-status=CODES
                        Skip target whenever hit one of these status codes,
                        separated by commas, support ranges
    --minimal=LENGTH    Minimal response length
    --maximal=LENGTH    Maximal response length
    --max-time=SECONDS  Maximal runtime for the scan
    -q, --quiet-mode    Quiet mode
    --full-url          Full URLs in the output (enabled automatically in
                        quiet mode)
    --no-color          No colored output

  Request Settings:
    -m METHOD, --http-method=METHOD
                        HTTP method (default: GET)
    -d DATA, --data=DATA
                        HTTP request data
    -H HEADERS, --header=HEADERS
                        HTTP request header, support multiple flags (Example:
                        -H 'Referer: example.com')
    --header-list=FILE  File contains HTTP request headers
    -F, --follow-redirects
                        Follow HTTP redirects
    --random-agent      Choose a random User-Agent for each request
    --auth-type=TYPE    Authentication type (basic, digest, bearer, ntlm)
    --auth=CREDENTIAL   Authentication credential (user:password or bearer
                        token)
    --user-agent=USERAGENT
    --cookie=COOKIE

  Connection Settings:
    --timeout=TIMEOUT   Connection timeout
    -s DELAY, --delay=DELAY
                        Delay between requests
    --proxy=PROXY       Proxy URL, support HTTP and SOCKS proxies (Example:
                        localhost:8080, socks5://localhost:8088)
    --proxy-list=FILE   File contains proxy servers
    --replay-proxy=PROXY
                        Proxy to replay with found paths
    --scheme=SCHEME     Default scheme (for raw request or if there is no
                        scheme in the URL)
    --max-rate=RATE     Max requests per second
    --retries=RETRIES   Number of retries for failed requests
    -b, --request-by-hostname
                        By default dirsearch requests by IP for speed. This
                        will force dirsearch to request by hostname
    --ip=IP             Server IP address
    --exit-on-error     Exit whenever an error occurs

  Reports:
    -o FILE, --output=FILE
                        Output file
    --format=FORMAT     Report format (Available: simple, plain, json, xml,
                        md, csv, html)

 You can change the dirsearch default configurations (default extensions,
timeout, wordlist location, ...) by editing the "default.conf" file. More
information at https://github.com/maurosoria/dirsearch.

报错

>python dirsearch.py -u http://challenge-aee21970e2e10e44.sandbox.ctfhub.com:10800/www.zip -e tar,tar.gz,zip,rar
NotADirectoryError: [WinError 267] 目录名称无效。: 'D:\\Software\\Python\\Lib\\site-packages\\dirsearch\\reports\\challenge-aee21970e2e10e44.sandbox.ctfhub.com:10800'

解决（Windows文件名不允许“:”）

>python dirsearch.py -u http://challenge-aee21970e2e10e44.sandbox.ctfhub.com:10800/www.zip -e tar,tar.gz,zip,rar -o reports/1.txt

疑问1：指定-x 503之后就没有结果了

d:\Software\Python\Lib\site-packages\dirsearch>python dirsearch.py -u http://challenge-356877c01dee5b8d.sandbox.ctfhub.com:10800/ -e * -o reports/1.txt -x 503

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, jsp, jsf, asp, aspx, do, action, cgi, pl, html, htm, js, json, json, tar.gz, tgz | HTTP method: GET | Threads: 30 | Wordlist size: 15971

Output File: d:\Software\Python\Lib\site-packages\dirsearch\reports\1.txt

Error Log: D:\Software\Python\Lib\site-packages\dirsearch\logs\errors-22-03-08_11-13-21.log

Target: http://challenge-356877c01dee5b8d.sandbox.ctfhub.com:10800/

[11:13:21] Starting:

Task Completed

疑问2：指定-e zip还是会有其他后缀的结果

d:\Software\Python\Lib\site-packages\dirsearch>python dirsearch.py -u http://challenge-356877c01dee5b8d.sandbox.ctfhub.com:10800/ -e zip -o reports/1.txt

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: zip | HTTP method: GET | Threads: 30 | Wordlist size: 8976

Output File: d:\Software\Python\Lib\site-packages\dirsearch\reports\1.txt

Error Log: D:\Software\Python\Lib\site-packages\dirsearch\logs\errors-22-03-08_11-08-35.log

Target: http://challenge-356877c01dee5b8d.sandbox.ctfhub.com:10800/

[11:08:35] Starting:
[11:08:35] 503 -  605B  - /%C0%AE%C0%AE%C0%AF
[11:08:35] 503 -  605B  - /zip.txt
[11:08:35] 503 -  605B  - /.actionScriptProperties
[11:08:35] 503 -  605B  - /.admin/
[11:08:35] 503 -  605B  - /zip
[11:08:35] 503 -  605B  - /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../
[11:08:35] 503 -  605B  - /.accdb
[11:08:35] 503 -  605B  - /.agilekeychain
[11:08:35] 503 -  605B  - /.analysis_options
[11:08:35] 503 -  605B  - /.all-contributorsrc
[11:08:35] 503 -  605B  - /.apdisk

GitHack

pip install githack

官方网站：GitHub - BugScanTeam/GitHack: .git 泄漏利用工具，可还原历史版本

>python githack -h
usage: githack [-h] [-o OUTPUT] [--level {NOTSET,DEBUG,INFO,WARNING,ERROR,CRITICAL}] [-k] URI

.git/ leakage exploit

positional arguments:
  URI                   target uri to exploit (eg. http://example.com/.git)

optional arguments:
  -h, --help            show this help message and exit
  -o OUTPUT, --output OUTPUT
                        output dir, all the file will download to this directory
  --level {NOTSET,DEBUG,INFO,WARNING,ERROR,CRITICAL}
                        log level (default: INFO)
  -k, --insecure        Ignore ssl verify

OwenChia <https://github.com/OwenChia/githack>