|
| 1 | +#author:九世 |
| 2 | +#time:2019/3/3 |
| 3 | + |
| 4 | +import requests |
| 5 | +import random |
| 6 | +import configparser |
| 7 | +import os |
| 8 | +import threading |
| 9 | + |
| 10 | +black_list=[] |
| 11 | +result=[] |
| 12 | +result_ufck=[] |
| 13 | + |
| 14 | +threadsq=10 |
| 15 | +xianchen = threading.BoundedSemaphore(threadsq) |
| 16 | +def banner(): |
| 17 | + banners = ''' |
| 18 | + ___ ___ |
| 19 | + / /\ ___ / /\ _____ |
| 20 | + / /:/ / /\ / /::\ / /::\ |
| 21 | +/__/::\ / /:/ / /:/\:\ / /:/\:\ |
| 22 | +\__\/\:\ /__/::\ / /:/~/:/ / /:/~/::\ |
| 23 | + \ \:\ \__\/\:\__ /__/:/ /:/___ /__/:/ /:/\:| |
| 24 | + \__\:\ \ \:\/\ \ \:\/:::::/ \ \:\/:/~/:/ |
| 25 | + / /:/ \__\::/ \ \::/~~~~ \ \::/ /:/ |
| 26 | + /__/:/ /__/:/ \ \:\ \ \:\/:/ |
| 27 | + \__\/ \__\/ \ \:\ \ \::/ |
| 28 | + \__\/ \__\/ |
| 29 | +
|
| 30 | + author:九世 |
| 31 | + version:1.0 |
| 32 | + ''' |
| 33 | + print('\033[1;33m {} \033[0m'.format(banners)) |
| 34 | + |
| 35 | +class baopo: |
| 36 | + def __init__(self,rhost): |
| 37 | + self.rhost=rhost |
| 38 | + |
| 39 | + def read_config(self): |
| 40 | + if os.path.exists('config'): |
| 41 | + print('\033[1;32m [+] \33[0m 配置文件路径存在') |
| 42 | + else: |
| 43 | + print('\033[1;31m [-] \33[0m 配置文件路径不存在') |
| 44 | + exit() |
| 45 | + |
| 46 | + global default_folder,threadsq,status_code,default,xianchen,value |
| 47 | + value=0 |
| 48 | + default='' |
| 49 | + conf=configparser.ConfigParser() |
| 50 | + conf.read('config/config.ini',encoding='utf-8') |
| 51 | + default_folder=conf.get('setup','default_folder') |
| 52 | + default_file=conf.get('setup','default_file') |
| 53 | + if len(default_folder)==0 and len(default_file)!=0: |
| 54 | + value+=0 |
| 55 | + default+=str(default_file) |
| 56 | + |
| 57 | + elif len(default_folder)!=0 and len(default_file)==0: |
| 58 | + value+=1 |
| 59 | + default+=str(default_folder) |
| 60 | + |
| 61 | + status_code=conf.get('setup','status_code') |
| 62 | + try: |
| 63 | + dk=open('config/black.txt','r',encoding='utf-8') |
| 64 | + for r in dk.readlines(): |
| 65 | + r="".join(r.split('\n')) |
| 66 | + black_list.append(r) |
| 67 | + except: |
| 68 | + print('\033[1;31m [-] \33[0m 黑名单读取失败') |
| 69 | + exit() |
| 70 | + |
| 71 | + print('\033[1;32m [+] \33[0m 配置文件与黑名单读取成功') |
| 72 | + print('\033[1;32m [+] \33[0m 指定爆破路径或字典:{}'.format(default)) |
| 73 | + print('\033[1;32m [+] \33[0m 最大线程为:{}'.format(threadsq)) |
| 74 | + print('\033[1;32m [+] \33[0m 匹配状态码为:{}'.format(status_code)) |
| 75 | + |
| 76 | + |
| 77 | + def jiance(self): |
| 78 | + try: |
| 79 | + requests.get(url=self.rhost) |
| 80 | + print('\033[1;32m [+] \33[0m 网站存活:{}'.format(self.rhost)) |
| 81 | + t = threading.Thread(target=jb.blst_default, args=(value,)) |
| 82 | + t.start() |
| 83 | + except: |
| 84 | + print('\033[1;31m [-] \033[0m 网络连接失败....') |
| 85 | + print('\033[1;31m [-] \033[0m 无法爆破:{}'.format(self.rhost)) |
| 86 | + |
| 87 | + def rdheaders(self): |
| 88 | + headers_list=['Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36', |
| 89 | + 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0', |
| 90 | + 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0'] |
| 91 | + |
| 92 | + random.shuffle(headers_list) |
| 93 | + return headers_list[0] |
| 94 | + |
| 95 | + def blst_default(self,value): |
| 96 | + if value==1: |
| 97 | + dq=os.listdir(default) |
| 98 | + headers = {'user-agent':'{}'.format(self.rdheaders())} |
| 99 | + for f in dq: |
| 100 | + dk=open('{}/{}'.format(default,f),'rb') |
| 101 | + for d in self.reay(dk): |
| 102 | + try: |
| 103 | + url = '{}/{}'.format(str(self.rhost).strip(), d).strip() |
| 104 | + rqts=requests.get(url=url,headers=headers,timeout=3) |
| 105 | + if rqts.status_code==int(status_code): |
| 106 | + for b in black_list: |
| 107 | + if b not in rqts.text and b not in rqts.content.decode('utf-8'): |
| 108 | + if rqts.url in result:continue |
| 109 | + result.append(rqts.url) |
| 110 | + elif b in rqts.text or b in rqts.content.decode('utf-8'): |
| 111 | + if rqts.url in result_ufck:continue |
| 112 | + result_ufck.append(rqts.url) |
| 113 | + self.echo() |
| 114 | + except TimeoutError: |
| 115 | + print('\033[1;31m [-] \033[0m 超时:{}'.format(rqts.url)) |
| 116 | + pass |
| 117 | + xianchen.acquire() |
| 118 | + elif value==0: |
| 119 | + dk=open(default,'rb') |
| 120 | + headers = {'user-agent': '{}'.format(self.rdheaders())} |
| 121 | + for d in dk.readlines(): |
| 122 | + d="".join(bytes.decode(d).split('\n')) |
| 123 | + try: |
| 124 | + url='{}/{}'.format(str(self.rhost).strip(),d).strip() |
| 125 | + rqts=requests.get(url=url,headers=headers,timeout=3) |
| 126 | + if rqts.status_code==int(status_code): |
| 127 | + for b in black_list: |
| 128 | + if b not in rqts.text and b not in rqts.content.decode('utf-8'): |
| 129 | + if rqts.url in result:continue |
| 130 | + result.append(rqts.url) |
| 131 | + elif b in rqts.text or b in rqts.content.decode('utf-8'): |
| 132 | + if rqts.url in result_ufck:continue |
| 133 | + result_ufck.append(rqts.url) |
| 134 | + self.echo() |
| 135 | + else: |
| 136 | + print('\033[1;31m [-] \033[0m URL:{} 状态码不匹配:{}'.format(rqts.url,rqts.status_code)) |
| 137 | + except Exception as r: |
| 138 | + print('\033[1;31m [-] \033[0m URL:{} Error:{}'.format(rqts.url,r)) |
| 139 | + pass |
| 140 | + xianchen.acquire() |
| 141 | + |
| 142 | + def reay(self,fi): |
| 143 | + for d in fi.readlines(): |
| 144 | + d="".join(bytes.decode(d).split('\n')) |
| 145 | + yield d |
| 146 | + |
| 147 | + def echo(self): |
| 148 | + if len(result_ufck)==0: |
| 149 | + for k in result: |
| 150 | + print('\033[1;32m [+] \33[0m ok_URL:{}'.format(k)) |
| 151 | + print(k,file=open('save.txt','a')) |
| 152 | + result.clear() |
| 153 | + else: |
| 154 | + for n in result_ufck: |
| 155 | + print('\033[1;31m [-] \033[0m no_URL:{}'.format(n)) |
| 156 | + |
| 157 | + |
| 158 | +if __name__ == '__main__': |
| 159 | + banner() |
| 160 | + user=input('要爆破的URL:').rstrip('/') |
| 161 | + jb=baopo(rhost='{}'.format(user)) |
| 162 | + jb.read_config() |
| 163 | + jb.jiance() |
0 commit comments