Python工具开发 | 目录扫描脚本

import sys
import os
import queue
import requests
import time
import threading

q=queue.Queue()


def scan():
while not q.empty():  ### 只要字典里不为空，就一直循环
   dir=q.get()        ### 把存储的payload取出来
   urls=url+dir       ### url+payload就是一个payload
   urls=urls.replace('\n','')  ### 利用回车来分割开来，不然打印的时候不显示
   code=requests.get(urls).status_code  ### 把拼接的url发起http请求
   if code==200 or code==403:   ### 如果返回包状态码为200或者403，就打印url+状态码
       print(urls+'|'+str(code))
       f=open('ok.txt','a+')  ###
       f.write(urls)
       f.close()
       然后把结果以追加的方式存储到ok.txt中，然后关闭文件
   else:
       print(urls+'|'+str(code))
       time.sleep(1)
       ### 不然就打印url+状态码，并延时一秒
def show():
   print("                        _  _                                ")
   print("                     __| |(_) _ __   ___   ___  __ _  _ __  ")
   print("                    / _` || || '__| / __| / __|/ _` || '_ \ ")
   print("                   | (_| || || |    \__ \| (__| (_| || | | |")
   print("                    \__,_||_||_|    |___/ \___|\__,_||_| |_|")
   print("                                                            ")
   print("说明:网址+字典文件+线程,例如:filesan.py http://www.xxx.cn 1.txt 10")
   print("Author:KingHandles5")

if __name__ == '__main__':
   path=os.path.dirname(os.path.realpath(__file__)) ### 这里的功能是获取当前的路径
   if len(sys.argv)<4: ### 小于4的话，打印banner
       show()
       sys.exit()
   url=sys.argv[1]  ### 用户输入的url
   txt=sys.argv[2]  ### 用户输入的字典
   xc=sys.argv[3]   ### 用户输入的线程
   for dir in open(path+"/"+txt):
        q.put(dir)
        ### 当前路径加上字典名就是绝对路径，然后循环字典里的payload
   for i in range(int(xc)):
       t = threading.Thread(target=scan)
       t.start()
       
       ### 多线程实现

# -*- coding:utf-8 -*-
__author__ = "Yiqing"
import sys
import threading
import random
from Queue import Queue
from optparse import OptionParser
 
try:
 import requests
except Exception:
 print "[!] You need to install requests module!"
 print "[!] Usage:pip install requests"
 exit()
 
 
class WebDirScan:
 """
 Web目录扫描器
 """
 
 def __init__(self, options):
 self.url = options.url
 self.file_name = options.file_name
 self.count = options.count
 
 class DirScan(threading.Thread):
 """
 多线程
 """
 
 def __init__(self, queue, total):
 threading.Thread.__init__(self)
 self._queue = queue
 self._total = total
 
 def run(self):
 while not self._queue.empty():
 url = self._queue.get()
 # 多线程显示进度
 threading.Thread(target=self.msg).start()
 try:
 r = requests.get(url=url, headers=get_user_agent(), timeout=5)
 if r.status_code == 200:
 sys.stdout.write('\r' + '[+]%s\t\t\n' % url)
 # 保存到本地文件，以HTML的格式
 result = open('result.html', 'a+')
 result.write('<a href="' + url + '" rel="external nofollow" target="_blank">' + url + '</a>')
 result.write('\r\n</br>')
 result.close()
 except Exception:
 pass
 
 def msg(self):
 """
 显示进度
 :return:None
 """
 per = 100 - float(self._queue.qsize()) / float(self._total) * 100
 percent = "%s Finished| %s All| Scan in %1.f %s" % (
 (self._total - self._queue.qsize()), self._total, per, '%')
 sys.stdout.write('\r' + '[*]' + percent)
 
 def start(self):
 result = open('result.html', 'w')
 result.close()
 queue = Queue()
 f = open('dict.txt', 'r')
 for i in f.readlines():
 queue.put(self.url + "/" + i.rstrip('\n'))
 total = queue.qsize()
 threads = []
 thread_count = int(self.count)
 for i in range(thread_count):
 threads.append(self.DirScan(queue, total))
 for thread in threads:
 thread.start()
 for thread in threads:
 thread.join()
 
 
def get_user_agent():
 """
 User Agent的细节处理
 :return:
 """
 user_agent_list = [
 {'User-Agent': 'Mozilla/4.0 (Mozilla/4.0; MSIE 7.0; Windows NT 5.1; FDM; SV1; .NET CLR 3.0.04506.30)'},
 {'User-Agent': 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00'},
 {
 'User-Agent': 'Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.2) Gecko/2008092313 Ubuntu/8.04 (hardy) Firefox/3.0.2'},
 {
 'User-Agent': 'Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.1.15) Gecko/20101027 Fedora/3.5.15-1.fc12 Firefox/3.5.15'},
 {
 'User-Agent': 'Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.551.0 Safari/534.10'},
 {'User-Agent': 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008092809 Gentoo Firefox/3.0.2'},
 {
 'User-Agent': 'Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/7.0.544.0'},
 {'User-Agent': 'Opera/9.10 (Windows NT 5.2; U; en)'},
 {
 'User-Agent': 'Mozilla/5.0 (iPhone; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko)'},
 {'User-Agent': 'Opera/9.80 (X11; U; Linux i686; en-US; rv:1.9.2.3) Presto/2.2.15 Version/10.10'},
 {
 'User-Agent': 'Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5'},
 {'User-Agent': 'Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9b3) Gecko/2008020514 Firefox/3.0b3'},
 {
 'User-Agent': 'Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; fr) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16'},
 {
 'User-Agent': 'Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; en-US) AppleWebKit/534.20 (KHTML, like Gecko) Chrome/11.0.672.2 Safari/534.20'},
 {
 'User-Agent': 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2)'},
 {'User-Agent': 'Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux x86_64; en) Opera 9.60'},
 {
 'User-Agent': 'Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.366.0 Safari/533.4'},
 {'User-Agent': 'Mozilla/5.0 (Windows NT 6.0; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.51'}
 ]
 
 return random.choice(user_agent_list)
 
 
def main():
 """
 主函数
 :return: None
 """
 print '''
 ____ _ ____
 | _ \(_)_ __/ ___| ___ __ _ _ __
 | | | | | '__\___ \ / __/ _` | '_ \
 | |_| | | | ___) | (_| (_| | | | |
 |____/|_|_| |____/ \___\__,_|_| |_|
 
 Welcome to WebDirScan
 Version:1.0 Author: %s
 ''' % __author__
 parser = OptionParser('python WebDirScanner.py -u <Target URL> -f <Dictionary file name> [-t <Thread_count>]')
 parser.add_option('-u', '--url', dest='url', type='string', help='target url for scan')
 parser.add_option('-f', '--file', dest='file_name', type='string', help='dictionary filename')
 parser.add_option('-t', '--thread', dest='count', type='int', default=10, help='scan thread count')
 (options, args) = parser.parse_args()
 if options.url and options.file_name:
 dirscan = WebDirScan(options)
 dirscan.start()
 sys.exit(1)
 else:
 parser.print_help()
 sys.exit(1)
 
 
if __name__ == '__main__':
 main()