python安全开发课程第三章第二节--python-web基础

python安全开发课程第三章第二节–python-web基础

注释：本文中所有代码均为Python2.7

requests代理

很多时候我们需要使用代理，而且是使用全局的代理，这个是方便我们隐藏自己的身份和让网络达到本来不可达的目的地
1.http代理

import requests
proxies = {
  "http": "http://10.10.1.10:3128",
  "https": "http://10.10.1.10:1080",
}
requests.get("http://example.org", proxies=proxies)

2.socks代理
要安装一个模块pip install requests[socks]

import requests
proxies = {
    'http': 'socks5://user:pass@host:port',
    'https': 'socks5://user:pass@host:port'
request.get('http://www.baidu.com',proxies=proxies)

urllib2代理

1.http代理
仅仅当前连接做代理,我们可能会在cc或者ddos的时候，需要这样的随机的代理，来模拟正常的访问行为

import urllib2
proxy_handler = urllib2.ProxyHandler({'http': '121.193.143.249:80'})
opener = urllib2.build_opener(proxy_handler)
r = opener.open('http://httpbin.org/ip')
print(r.read())

全局的代理，如果我们写一个业务代码，大多数时候我们需要一个全局代理，当然，这里还是推荐使用requests

import urllib2
proxy = urllib2.ProxyHandler({'http': '127.0.0.1:8087'})
opener = urllib2.build_opener(proxy)
urllib2.install_opener(opener)
response = urllib2.urlopen('http://feeds2.feedburner.com/MobileOrchard')
print response.read()

JSON函数

json是一种轻量级的数据交换格式，我们有的时候会需要使用各种网站的api进行交互，以前使用xml比较多，现在换成json了

函数	描述
json.dumps	将python对象编码成json字符串
json.loads	将已编码的json字符串解码为python

>>> import json
>>> #编码json
>>> data={'aa':1,'bb':2,'cc':3}
>>> j=json.dumps(data)
>>>type(j)
>>> #解码json
>>> jsonData = '{"a":1,"b":2,"c":3,"d":4,"e":5}';
>>> text = json.loads(jsonData)
>>> type(text)

####json api使用实例

#coding=utf-8
import requests
import json
r=requests.get('http://www.sojson.com/open/api/weather/json.shtml?city=武汉')
aa=json.loads(r.text)
print aa['city']
print aa['data']['yesterday']['notice']
print aa['data']['yesterday']['high']
print aa['data']['yesterday']['low']
#未来的数据，由于这里没有转换成完整的字典
for i in  aa['data']['forecast']:
	for x in i:
		print i[x]

一个暴力破解web目录和文件工具的构思

通过对特定模板的网站的已知目录的扫描，来猜出web网站的目录结构，尤其可以找到登录界面，后台界面，查询界面等
####关键代码实现

#coding=utf-8
import urllib2
def scan_url(url):
	try:
		header={}
		header={"User-Agent"}=’Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)’
		r=urllib2.Reuqests(url,headers=header)
		res=urllib2.urlopen(r)
		if len(res.read()): #判断返回是否有内容
			print "[%d] => %s"%(response.code,url)#为什么是%d？？
	except urllib2.URLError ,e:
		if hasattr(e,'code') and e.code !=404:#hassttr是判断class属性的，暂不介绍
			print "!!! %d=> %s "%(e.code,url)

完整实现

涉及到线程和队列的知识，后面讲解

import urllib2
import threading
import Queue
import urllib

threads = 5
target_url = "http://testphp.vulnweb.com"
wordlist_file = "/tmp/all.txt" # from SVNDigger
resume = None　#设定一个结束开关
user_agent = "Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101 Firefox/19.0"


def build_wordlist(wordlist_file):
    # read in the word list
    fd = open(wordlist_file, "rb")
    raw_words = fd.readlines()
    fd.close()

    found_resume = False
    words = Queue.Queue()

    for word in raw_words:
        word = word.rstrip()#这里是为了去掉空格和回车符

        if resume is not None:
            if found_resume:
                words.put(word)
            else:
                if word == resume:
                    found_resume = True
                    print "Resuming wordlist from: %s" % resume

        else:
            words.put(word)

    return words

def dir_bruter(word_queue, extensions=None):
    while not word_queue.empty():
        attempt = word_queue.get()
        attempt_list = []

        # check to see if there is a file extension; if not, it's a directory
        # path we're bruting
        if "." not in attempt:
            attempt_list.append("/%s/" % attempt)
        else:
            attempt_list.append("/%s" % attempt)

        # if we want to bruteforce extensions
        if extensions:
            for extension in extensions:
                attempt_list.append("/%s%s" % (attempt, extension))

        # iterate over our list of attempts
        for brute in attempt_list:
            url = "%s%s" % (target_url, urllib.quote(brute))

            try:
                headers = {}
                headers["User-Agent"] = user_agent
                r = urllib2.Request(url, headers=headers)

                response = urllib2.urlopen(r)

                if len(response.read()):
                    print "[%d] => %s" % (response.code, url)

            except urllib2.URLError as e:
                if hasattr(e, 'code') and e.code != 404:#这里需要类的知识
                    print "!!! %d => %s" % (e.code, url)

                pass


word_queue = build_wordlist(wordlist_file)
extensions = [".php", ".bak", ".orig", ".inc"]

for i in range(threads):
    t = threading.Thread(target=dir_bruter, args=(word_queue,extensions,))
    t.start()

思考：

1.如何提高爆破速度？