对使用已知CMS系统的目录遍历
若目标系统使用了CMS模板,那么我们可以对该系统进行已知目录的遍历。首先下载该CMS模板到本地,然后对本地的目录进行一个提取,将提取到的文件目录作为字典,对目标系统进行访问,通过状态码来查看目标系统是否存在该文件。
代码:
from queue import Queue
import threading
import os
import urllib
import urllib.request as urllib2
threads = 10
target = "http://192.168.137.131"
directory = "F:/test/directory"
filters = [".jpg",".gif",".png",".css",".htm",".js"]
os.chdir(directory)
web_paths = Queue()
#获取本地目录结构
for r,d,f in os.walk("."):
for files in f:
r1 = r.replace("\\","/")
remote_path = "%s/%s" %(r1,files)
if remote_path.startswith("."):
remote_path = remote_path[1:]
if os.path.splitext(files)[1] not in filters:
web_paths.put(remote_path)
#根据获取到的本地目录结构对目标系统进行遍历
def test_remote():
while not web_paths.empty():
path = web_paths.get()
url = "%s%s" % (target,path)
#print(url)
request = urllib2.Request(url)
try:
response = urllib2.urlopen(request)
content = response.read()
print("[%d] => %s" % (response.code,url))
response.close()
except urllib2.HTTPError as err:
print("ERROR[%s]%s"% (err.code,url))
pass
except urllib2.URLError as err:
print("ERROR[%s]%s"% (err,url))
pass
#创建多线程
for i in range(threads):
print("开始运行线程【%d】" % i)
t = threading.Thread(target=test_remote)
t.start()
总结: