You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
87 lines
3.5 KiB
87 lines
3.5 KiB
import re
|
|
import os
|
|
from collections import Counter
|
|
from tools.ToolBase import ToolBase
|
|
|
|
class GobusterTool(ToolBase):
|
|
|
|
def validate_instruction(self, instruction):
|
|
'''
|
|
指令过滤
|
|
1.线程默认调整为-t 5 (没有找到-t 就添加） ---暂时取消
|
|
2.*medium.txt 替换为*small.txt --- 暂时取消
|
|
3.-p 静默输出，只输出有用结果
|
|
:param instruction:
|
|
:return:
|
|
'''
|
|
# 定义要修改的参数的正则表达式模式
|
|
# thread_pattern = r'-t\s*\d+'
|
|
# wordlist_pattern = r'-w\s*(/.*?/.*?-medium\.txt)'
|
|
# # 检查是否有 -t 参数，若没有则添加 -t 5
|
|
# if not re.search(thread_pattern, instruction):
|
|
# instruction += ' -t 5'
|
|
#
|
|
# # 检查 -w 后面的字典文件，若是 *medium.txt 则换成 *small.txt
|
|
# if re.search(wordlist_pattern, instruction):
|
|
# instruction = re.sub(wordlist_pattern, lambda m: m.group(0).replace('-medium.txt', '-small.txt'),
|
|
# instruction)
|
|
timeout = 60*15
|
|
if "-q" not in instruction:
|
|
instruction += ' -q'
|
|
return instruction,timeout
|
|
|
|
def is_false_result(self,output,wordlist_path):
|
|
#输出结果的行数
|
|
discovered = [line for line in output.splitlines() if line]
|
|
#字典个数
|
|
with open(wordlist_path, "r") as f:
|
|
wordlist_count = sum(1 for line in f if line.strip())
|
|
if wordlist_count and len(discovered) >= int(0.1 * wordlist_count):
|
|
return False, "字典项中绝大部分路径都匹配成功，应该是应用端做了防护处理"
|
|
return True, output
|
|
|
|
def analyze_result(self, result,instruction,stderr,stdout):
|
|
#指令结果分析 -q后对结果进行提取
|
|
pattern = re.compile(r'-w\s+(\S+)')
|
|
match = pattern.search(instruction)
|
|
if match:
|
|
wordlist_path = match.group(1) #匹配字典路径
|
|
else:
|
|
return ("failure", "No wordlist path found in the command string")
|
|
|
|
#重新生成个结果，400-5个，401-5个，200所有，其他还不知道有什么结果所有
|
|
if stdout:
|
|
bok,result = self.is_false_result(stdout,wordlist_path)
|
|
if not bok:
|
|
return result
|
|
#结果基本合规，再做过滤
|
|
result = ""
|
|
i_400 = 0
|
|
i_401 = 0
|
|
lines = [line for line in stdout.splitlines() if line]
|
|
for line in lines:
|
|
if line:
|
|
badd = False
|
|
if "200" in line:
|
|
badd = True
|
|
elif "400" in line:
|
|
if i_400 < 5: #400有5个页面就可以了
|
|
badd = True
|
|
i_400 += 1
|
|
elif "401" in line:
|
|
if i_401 < 5:
|
|
badd = True
|
|
i_401 += 1
|
|
else: #未知项不太确定,先保留
|
|
badd = True
|
|
if badd:
|
|
result +='\n'
|
|
result += line
|
|
else:
|
|
return ""
|
|
return result
|
|
|
|
if __name__ == '__main__':
|
|
sub = GobusterTool()
|
|
gobuster_command = "gobuster dir -u http://haitutech.cn -w /usr/directory-list-2.3-medium.txt -x php,html,zip,bak"
|
|
print(sub.validate_instruction(gobuster_command))
|