1. 程式人生 > 其它 >利用Python編寫挖掘Web頁面漏洞程式

利用Python編寫挖掘Web頁面漏洞程式

  核心思想:

      在獲取頁面內容會後,用BeautifulSoup對頁面標籤進行提取,提取出所有的Form表單,並進一步提取表單中的action(提交頁面的目標URL),method,以及input。

import requests
from bs4 import BeautifulSoup
import sys
from urllib.parse import urljoin


def request_page(url, data, method):
    """
    編寫通用的頁面請求函式,可以根據不同的請求方法向目標頁面發起請求,比如get, post等
    """
try: if data is None: response = requests.get(url) return response.text if method == 'get': response = requests.get(url, params=data) return response.text if method == 'post': response = requests.post(url, data=data)
return response.text except requests.exceptions.ConnectionError: pass if __name__ == "__main__": target_url = "http://192.168.140.137/mutillidae/index.php?page=dns-lookup.php" response = request_page(target_url,None, 'get') if response is None: print("Nothing captured") sys.exit() beautified_content
= BeautifulSoup(response) form_list = beautified_content.findAll('form') if len(form_list) == 0: print("No form is found!") sys.exit() for form in form_list: action = form.get('action') action_url_absolute = urljoin(target_url, action) method = form.get('method') input_list = form.findAll('input') input_dict = {} for input in input_list: input_name = input.get('name') input_type = input.get('type') input_value = input.get('value') if input_type == 'text': input_value = 'test' input_dict[input_name] = input_value res = request_page(action_url_absolute,input_dict,method) print(res)