黑帽子工具编写（python）

渗透测试python代码

子域名扫描

# python subdomain_enumeration.py -w subdomain.txt -d baidu.com
import argparse
import requests
import concurrent.futures


def get_word_list(file_path):
    with open(file_path, 'r' ,encoding='utf-8') as r:
        word_list = [i.strip() for i in r.readlines()]
    return word_list

def subdomain_enumeration(domain, word_list, thread):
    def subdomain_enum(sub, domain):
        sub_domains = f"http://{sub}.{domain}"
        try:
            requests.get(sub_domains)
        except requests.ConnectionError: 
            pass
        else:
            print("Valid domain: ",sub_domains)
  
    with concurrent.futures.ThreadPoolExecutor(max_workers=int(thread)) as executor:
        futures = [executor.submit(subdomain_enum, sub, domain) for sub in word_list]
        concurrent.futures.wait(futures)

  
if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="subdomain enumeration")
    parser.add_argument("-w", "--word", help="Specify the dictionary file path", required=True)
    parser.add_argument("-d", "--domain", help="Specify the primary domain", required=True)
    parser.add_argument("-t", "--thread", help="Specify the thread number", required=False, default="20")
    args = parser.parse_args()
    word_list = get_word_list(args.word)
    subdomain_enumeration(args.domain, word_list, args.thread)

目录扫描

import argparse
import requests
import concurrent.futures


def get_word_list(file_path):
    with open(file_path, 'r' ,encoding='utf-8') as r:
        word_list = [i.strip() for i in r.readlines()]
    return word_list

def directory_enumeration(url, word_list, prefix="", suffix="", thread="20"):
    def dir_enum(url, prefix, dir_str, suffix):
        dir_enum = f"{url}/{prefix}{dir_str}{suffix}"
        r = requests.get(dir_enum)
        if r.status_code==404: 
            pass
        else:
            print("Valid directory:" ,dir_enum, r.status_code)

    url = url.rstrip("/")
    with concurrent.futures.ThreadPoolExecutor(max_workers=int(thread)) as executor:
        futures = [executor.submit(dir_enum, url, prefix, dir_str, suffix) for dir_str in word_list]
        concurrent.futures.wait(futures)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="directory enumeration")
    parser.add_argument("-w", "--word", help="Specify the dictionary file path", required=True)
    parser.add_argument("-u", "--url", help="Specify the url", required=True)
    parser.add_argument("-pf", "--prefix", help="Specify the prefix", required=False, default="")
    parser.add_argument("-sf", "--suffix", help="Specify the suffix", required=False, default="")
    parser.add_argument("-t", "--thread", help="Specify the thread number", required=False, default="20")
    args = parser.parse_args()
    word_list = get_word_list(args.word)
    directory_enumeration(args.url, word_list, args.prefix, args.suffix, args.thread)

网络扫描

from scapy.all import Ether, ARP, srp
import argparse
import concurrent.futures

def network_scanner(ip_range, interface, broadcastMac, thread):
    packet = Ether(dst=broadcastMac)/ARP(pdst = ip_range) 
    ans, _ = srp(packet, timeout =2