一、目录扫描原理

1.读取字典URL
2.HTTP GET请求url
3.判断状态码 输出保存在目录

二、字典读取函数

with open(xxxx, ‘a+’) as f:
for line in f.readlines

三、代码实现

  1. import sys
  2. import requests
  3. import threading
  4. import queue
  5. import time
  6. import argparse
  8. class Dirscan(object):
  9.     """
  10.         目录扫描器 类
  11.     """
  12.     def __init__(self, scanSite, scanDict, scanOutput, threadNum):
  13.         """
  14.         :param scanSite: 初始扫描站点
  15.         :param scanDict:  初始化扫描字典
  16.         :param scanOutput:  扫描输出结果
  17.         :param threadNum: 线程数
  18.         """
  19.         self.scanSite = scanSite if scanSite.find('://')!=1 else 'http://%s' % scanSite
  20.         print('扫描目标：',self.scanSite)
  21.         self.scanDict = scanDict
  22.         self.scanOutput = scanSite.rstrip('/').replace('https://', '').replace('http://', '')+'.txt' if scanOutput == 0 else scanOutput
  23.         truncate = open(self.scanOutput,'w')
  24.         truncate.close()
  25.         self.threadNum = threadNum
  26.         self.lock = threading.Lock()#线程锁
  27.         # 类的功能 加载请求头，加载字典 初始化的
  28.         self._loadHeaders()
  29.         self._loadDict(self.scanDict)
  30.         self._analysis404()
  31.         self.STOP_ME = False
  33.     def _loadDict(self,dict_list):
  34.         #加入队列
  35.         self.qlists = queue.Queue()
  36.         with open(dict_list,encoding='utf-8') as f:
  37.             for line in f:
  38.                 if line[0:1] != '#':
  39.                     self.qlists.put(line.strip())
  40.     #默认请求头
  41.     def _loadHeaders(self):
  42.         self.headers = {
  43.             'Accept': '*/*',
  44.             'Referer': 'http://www.baidu.com',
  45.             'User-Agent': 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; ',
  46.             'Cache-Control': 'no-cache',
  47.         }
  48.     #代理服务器 ip port
  49.     def _proxies(self):
  50.         ip = "192.168.43.125"
  51.         port = 225
  52.         proxies = {'http':ip+':'+port,'https':ip+':'+port}
  54.     #404 NOT FIND
  55.     def _analysis404(self):
  56.         notFoundPage = requests.get(self.scanSite + '/songgeshigedashuaibi/hello.html', allow_redirects=False)
  57.         self.notFoundPageText = notFoundPage.text.replace('/songgeshigedashuaibi/hello.html', '')
  59.     #输出结果
  60.     def _writeOutput(self, result):
  61.         self.lock.acquire()#线程取锁
  62.         with open(self.scanOutput, 'a+') as f:
  63.             f.write(result + '\n')
  64.         self.lock.release()
  66.     #扫描目标站点
  67.     def _scan(self,url):
  68.         html_result = 0
  69.         try:
  70.             html_result = requests.get(url, headers=self.headers, allow_redirects=False, timeout=60)
  71.         except requests.exceptions.ConnectionError:
  72.             # print 'Request Timeout:%s' % url
  73.             pass
  74.         finally:
  75.             if html_result != 0:
  76.                 #访问网站状态码 是否是200 是就存在该页面
  77.                 if html_result.status_code == 200 and html_result.text != self.notFoundPageText:
  78.                     print('[%i]%s' % (html_result.status_code, html_result.url))
  79.                     self._writeOutput('[%i]%s' % (html_result.status_code, html_result.url))
  81.     def run(self):
  82.         while not self.qlists.empty() and self.STOP_ME == False:
  83.             url = self.scanSite + self.qlists.get() # url + dir字典队列
  84.             self._scan(url)
  87. if __name__ == '__main__':
  89.     #命令解析器使用
  90.     """
  91.     1.添加参数
  92.     parser.add_argument('integers', metavar='N', type=int, nargs='+', help='an integer for the accumu
  93.     2.解析参数
  94.     parser.parse_args(['--sum', '7', '-1', '42'])
  95.     """
  96.     #实例化命令解析器
  97.     parser = argparse.ArgumentParser()
  98.     parser.add_argument('scanSite', help="将要扫描的站点", type=str)
  99.     parser.add_argument('-d', '--dict', dest="scanDict", help="扫描字典", type=str,
  100.                         default="dict.txt")
  101.     parser.add_argument('-o', '--output', dest="scanOutput", help="扫描结果存为文件", type=str, default=0)
  102.     parser.add_argument('-t', '--thread', dest="threadNum", help="输入线程数量", type=int,
  103.                         default=60)#默认是60
  104.     args = parser.parse_args()
  107.     # 实例化SCAN对象 参数
  108.     """
  109.         1.
  110.     """
  111.     scan = Dirscan(args.scanSite, args.scanDict, args.scanOutput, args.threadNum)
  112.     for i in range(args.threadNum):
  113.         t = threading.Thread(target=scan.run)
  114.         # 通过setDaemon(true)
  115.         # 来设置线程为“守护线程”；将一个用户线程设置为守护线程的方式是在
  116.         # 线程对象创建
  117.         # 之前
  118.         # 用线程对象的setDaemon方法。
  119.         t.setDaemon(True)
  120.         t.start()
  122.     while True:
  123.         #此方法返回活动线程的当前线程的线程组中的数量。
  124.         if threading.activeCount() <= 1:
  125.             break
  126.         else:
  127.             try:
  128.                 time.sleep(0.1)
  129.             except KeyboardInterrupt as e:
  130.                 print('\n[警告]用户中止，等待所有从线程退出，当前 (%i)'% threading.activeCount())
  131.                 scan.STOP_ME = True
  132.     print('扫描结束')