web-scan.py

#!/usr/bin/python
#-*- coding=utf-8 -*-

"""
* web系统周期性巡检
* 1.svn git泄露
* 2.备份文件扫描
* 3.列出目录
* ???4.任意域名指向
"""

import io
import sys
import urllib
import urllib2
import httplib
import socket
import time
import threading

socket.setdefaulttimeout(10) 

secretRs = []

# 重定义http方法 防止302跟随
class SmartRedirectHandler(urllib2.HTTPRedirectHandler):
	def http_error_301(self, req, fp, code, msg, headers):  
		result = urllib2.HTTPRedirectHandler.http_error_301(self, req, fp, code, msg, headers)              
		result.status = code
		return result

	def http_error_302(self, req, fp, code, msg, headers):
		result = urllib2.HTTPRedirectHandler.http_error_302(self, req, fp, code, msg, headers)              
		result.status = code                                
		return result 

class scanner(threading.Thread):
	def __init__(self, target):
		threading.Thread.__init__(self)
		self.target = target
	def run(self):
		target = self.target
		# 敏感文件扫描
		secretList = ["/.svn/entries", "/.git/config",
						"/www.tar.gz", "/www.zip", "/www.rar",
						"/wwwroot.tar.gz", "/wwwroot.zip", "/wwwroot.rar",
						"/backup.tar.gz", "/backup.zip", "/backup.rar",
						"/web.tar.gz", "/web.zip", "/web.rar",
						"/log.tar.gz", "/log.zip", "/log.rar",
						"/"+target+".sql", "/db.sql",
						"/"+target+".tar.gz", "/"+target+".zip", "/"+target+".rar",
						"/.config.php.swp", "/config.php.bak",
						"/protected/yiic"]

		# 取404页面大小用于比较 防止统一错误页面误记录
		notfound_length = 0
		try:
			req = urllib2.Request("http://" + target + "/notfound_123ada12314ad889.tmp")
			httplib.HTTPConnection.debuglevel = 1
			opener_nf = urllib2.build_opener(SmartRedirectHandler)
			resp_nf = opener_nf.open(req)
			notfound_length = len(resp_nf.read())
		except Exception, e:
			pass
			#print e

		for info in secretList:
			res = "http://" + target + info
			try:
				req = urllib2.Request(res)
				opener = urllib2.build_opener(SmartRedirectHandler)
				resp = opener.open(req)
				status = resp.code
				content_length = len(resp.read())
				print str(content_length) + "-" + str(notfound_length) + "|" + res
				if (200 == status) and (content_length <> notfound_length) and (resp.read().index("<html")>0):
					print "\t#found# " + res
					secretRs.append(res)
					writer = open("secret-res.txt", "a")
					writer.write(res+"\n")
					writer.close()
			except Exception, e:
				pass
				#print e


def dirList(target):
	pass
	

def main():
	reader = open("list.txt", "r")
	for line in reader.readlines():
		line = line.rstrip()
		job = scanner(line)
		job.start()
	reader.close()

if __name__ == '__main__':
	main()