Python3漏洞掃描工具 ( Python3 插件式框架 )
阿新 • • 發佈:2018-07-21
uid weblogic more ise 基本功 linu blog 掃描 active
目錄
- Python3 漏洞檢測工具 -- lance
- screenshot
- requirements
- 關鍵代碼
- usage
- documents
- README
- Guide
- Change Log
- TODO list
- Any advice or sugggestions
- 目錄結構
Python3 漏洞檢測工具 -- lance
lance, a simple version of the vulnerability detection framework based on Python3.
基於Python3的簡單版漏洞檢測框架 -- lance
可以自定義poc或exp插件,可以 指定 要加載的poc或exp。
再次添加了logging模塊來控制輸出,同時也支持Linux平臺的彩色輸出提示。
代碼已經上傳到Github : https://github.com/b4zinga/lance
screenshot
requirements
python
關鍵代碼
def loadPlugin(url, poc=None): """load all plugins. """ if "://" not in url: url = "http://" + url url = url.strip("/") logger.info("Target url: %s" % url) plugin_path = os.path.join(os.path.dirname(os.path.dirname(os.path.realpath(__file__))),"plugins") if not os.path.isdir(plugin_path): logger.warning("%s is not a directory! " % plugin_path) raise EnvironmentError logger.info("Plugin path: %s " % plugin_path) items = os.listdir(plugin_path) if poc: logger.infxito("Loading %s plugins." % poc) else: poc="" for item in items: if item.endswith(".py") and not item.startswith(‘__‘): plugin_name = item[:-3] if poc in plugin_name: logger.info("Loading plugin: %s" % plugin_name) module = importlib.import_module("plugins." + plugin_name) try: result = module.run(url) if result: logger.success(result) else: logger.error("Not Vulnerable %s " % plugin_name) except: logger.warning("ConnectionError ") else: continue logger.info("Finished")
usage
please run python3 lance.py -h
for help.
root@kali:~/lance# python3 lance.py usage: python lance.py lance. By [email protected] optional arguments: -h, --help show this help message and exit Target: -u URL target url. Module: -m module poc or exp to be loaded. defaul is all.
documents
README
說明文檔 : https://github.com/b4zinga/lance/blob/master/README.md
Guide
Guide : https://github.com/b4zinga/lance/blob/master/docs/Guide.md
Change Log
ChangeLog : https://github.com/b4zinga/lance/blob/master/docs/ChangeLog.md
2018/07/20
- 添加logging模塊,支持日誌
- 添加彩色輸出(目前支持Linux下Py3,Win下的Py3暫不支持顏色)
2018/07/18
- 程序基本功能實現, 可以運行
- 可以實現`-u URL`指定URl, `-m plugin`指定只加載含有"plugin"關鍵字的插件, 如"weblogic"
TODO list
TODOList : https://github.com/b4zinga/lance/blob/master/docs/TODOList.md
[] 添加多線程
[x] 終端顏色區分結果
[x] 添加日誌
[] more...
Any advice or sugggestions
Please mail to [email protected]
if you have poc or exp , mail me.
目錄結構
lance
│ lance.py
│ README.md
│
├─docs
│ ChangeLog.md
│ Guide.md
│ screenshot1.png
│ screenshot2.png
│ TODOList.md
│
├─lib
│ ansistrm.py
│ cli.py
│ cmdline.py
│ convert.py
│ data.py
│ loader.py
│ log.py
│ __init__.py
│
└─plugins
activemq_movefile.py
activemq_putfile.py
activemq_weakpwd.py
discuz_faqsql.py
elasticSearch_dir_traversal.py
elasticSearch_dir_traversal2.py
elasticSearch_remote_code_exec.py
elasticSearch_remote_code_exec2.py
redis_unauth.py
struts2_053.py
weblogic_ssrf.py
weblogic_weakpasswd.py
weblogic_xmldecoder.py
__init__.py
代碼已經上傳到Github : https://github.com/b4zinga/lance
Python3漏洞掃描工具 ( Python3 插件式框架 )