【python】POST上傳APK檢測是否存在ZipperDown漏洞

標籤：hex   int   android   檔案名稱   try   urllib   exce   web   上傳   

前言

用POST的方式上傳檔案，檢測APK是否存在ZipperDown漏洞。

代碼

#  authour:zzzhhh#  2018.08.08#  check ZipperDown# -*- coding: utf-8 -*-from selenium import webdriverimport osimport timeimport urllib2import base64import jsondef post_upload(file_path):    file_size = os.path.getsize(file_path)    # 擷取檔案大小    filename = os.path.basename(file_path)    # 擷取檔案名稱    boundary = ‘----------%s‘ % "WebKitFormBoundar"+base64.b64encode(hex(int(time.time() * 1000))).rstrip(‘=‘)    data = []    data.append(‘--%s‘ % boundary)    data.append(‘Content-Disposition: form-data; name="%s"\r\n‘ % ‘id‘)    data.append(‘WU_FILE_0‘)    data.append(‘--%s‘ % boundary)    data.append(‘Content-Disposition: form-data; name="%s"\r\n‘ % ‘name‘)    data.append("%s" % filename)    data.append(‘--%s‘ % boundary)    data.append(‘Content-Disposition: form-data; name="%s"\r\n‘ % ‘type‘)    data.append(‘application/vnd.android.package-archive‘)    data.append(‘--%s‘ % boundary)    data.append(‘Content-Disposition: form-data; name="%s"\r\n‘ % ‘lastModifiedDate‘)    data.append(‘Sat Apr 12 2014 05:07:04 GMT+0800 (涓浗鏍囧噯鏃墮棿)‘)    data.append(‘--%s‘ % boundary)    data.append(‘Content-Disposition: form-data; name="%s"\r\n‘ % ‘size‘)    data.append("%s" % file_size)    #檔案大小    data.append(‘--%s‘ % boundary)    fr = open(filename, ‘rb‘)    data.append(‘Content-Disposition: form-data; name="file"; filename="%s"‘ % filename)    data.append(‘Content-Type: %s\r\n‘ % ‘application/vnd.android.package-archive‘)    data.append(fr.read())    fr.close()    data.append(‘--%s--\r\n‘ % boundary)    http_url = ‘http://appscan.360.cn/app/upload_zipperdown/‘    http_body = ‘\r\n‘.join(data)    try:        # buld http request        req = urllib2.Request(http_url, data=http_body)        # header        req.add_header(‘Content-Type‘, ‘multipart/form-data; boundary=%s‘ % boundary)        req.add_header(‘User-Agent‘, ‘Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36‘)        req.add_header(‘Referer‘, ‘http://appscan.360.cn/tool/‘)        # post data to server        resp = urllib2.urlopen(req, timeout=5)        # get response        qrcont = resp.read()        print qrcont        return qrcont    except Exception, e:        print ‘http error‘if __name__ == ‘__main__‘:    file_path = os.getcwd() +"\\1.apk"    res = post_upload(file_path)    setting = json.loads(res)    print ‘http://appscan.360.cn/‘+setting[‘result‘]

【python】POST上傳APK檢測是否存在ZipperDown漏洞