Shulou(Shulou.com)06/01 Report--

This article introduces the relevant knowledge of "using the web path scanning tool written by python". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

There are many off-the-shelf WEB path scanning tools, but all of them are not satisfactory, mainly because it determines whether the page exists according to the returned status code. But there is a problem here, the returned status code is controllable on the server side, and the tool's judgment rules for the status code are mostly fixed, which makes the scanning results of little value.

So take the time to write a web scanning tool, its principle is to detect a definitely non-existent path and page, / mustnotexistspath/ and / mustnotexistspath+ext, the return code of the other two as a sign that the page does not exist, if it is different, then the page may exist, the principle is quite simple, playing the effect of dynamic judgment.

The code is:

#! / usr/bin/python

Import httplib2

Import sys

If len (sys.argv)

< 3: print("written by lanz….") print( "Usage: " + sys.argv[0] + " host " + " .ext") print ("Eg: " + sys.argv[0] + " http://www.baidu.com .php") sys.exit(0) host = sys.argv[1] ext = sys.argv[2] print(host) http = httplib2.Http(".cache") response,content = http.request(host) response,content=http.request(host+"/mustnotexistspath/") nonpathstatus = response.status response,content=http.request(host+"/mustnotexistspath"+ext) nonpathextstatus = response.status print("NoneExistPathStatus:",nonpathstatus) print("NoneExistFileStatus:",nonpathextstatus) f = open ( ‘WebPath.txt’, ‘r’ ) fileList = f.readlines() def subscan(subpath): for fileLine in fileList: newline = fileLine.strip() path = subpath+"/"+newline response,content= http.request(path,"GET") if response.status!=nonpathstatus: st = str(response.status) print(st+" : "+path) subscan(path) pathext=path + ext response,content= http.request(pathext,"GET") if response.status!=nonpathextstatus: st = str(response.status) print(st+" : "+pathext) subscan(host) f.close() 效果对比： 使用webtools扫描目录的结果图：

The effect of using the new code:

This is the content of "web path scanning tool written by python". Thank you for reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.