1.socket

端到端的交互

  1. socket协议--套接字:(ip：port);//socket模块可以用来模拟客户端服务端之间端到端的交互
  2.     反查域名->ip;端口爆破;子域名查询;

1.反查域名

  1. def function1(url,port):
  2.     ip=socket.getaddrinfo(url,port)
  3.     print(ip)
  4. url=input("请输入url:")
  5. port1=int(input("端口:"))
  6. function1(url,port1)
  7. #getaddinfo把url转换成IP地址
  9. def function2(url):
  10.     ip=socket.gethostbyname(url)#不需要端口
  11.     print(ip)
  12. url=input("域名:")
  13. function2(url)

2.端口爆破

  1. ip=input("ip:")
  2. ports={21,22,135,443,445,80,1443}
  3. server=socket.socket(socket.AF_INET,socket.SOCK_STREAM)#初始化对象;建立tcp连接
  4. #socket.AF_INET//使用ipv4 socket.SOCK_STREAM使用tcp
  5. for x in  ports:
  6.     try:
  7.         port=server.connect_ex((ip,x))#connext_ex模块连接成功返回0
  8.         if port==False:
  9.             print(ip+":"+str(x)+"|open")
  10.         else:
  11.             print (ip + ":" + str (x) + "|close")
  12.     except Exception as err:
  13.         print(err)

3.子域名查询

  1. def zym_check(url):
  2.     url=url.replace('www','')
  3.     for zym in open('dic.txt'):
  4.         zym=zym.replace('\n','')
  5.         zym_url=zym+url
  6.         try:
  7.             ip=socket.gethostbyname(zym_url)
  8.             print(+"->"+ip)
  9.         except Exception as e:
  10.             print(zym_url+"->error")
  11. zym_check('www.baidu.com')

2.sys模块

sys模块—>获得用户的输入模块;获取用户的输入参数

  1. def Dns_Check(url):
  2.     return os.system('nslookup '+url)
  4. def Port_Fuzz(url):
  5.     ip = socket.gethostbyname (url)
  6.     #print(ip)
  7.     ports = [21, 22, 135, 443, 445, 80, 1443]
  8.     server = socket.socket (socket.AF_INET, socket.SOCK_STREAM)
  9.     for x in ports:
  10.         try:
  11.             port = server.connect_ex ((ip, x))
  12.             if port==False:
  13.                 print(ip+":"+str(x)+"-->open")
  14.             else:
  15.                 continue
  16.         except Exception as err:
  17.             print (err)
  19. def Zym_Check(url,dic=''):
  20.     print(dic)
  21.     if dic=='':
  22.         dic='fuzz.txt'
  23.     url=url.replace('www','')
  24.     for zym in open(dic):
  25.         zym=zym.replace('\n','')
  26.         zym_list=zym+url
  27.         try:
  28.             ip=socket.gethostbyname(zym_list)
  29.             print(zym_list+"->"+ip)
  30.         except Exception as e:
  31.             pass
  34. if __name__ == '__main__':
  35.     if (sys.argv[1]).lower() == '-all':
  36.         Dns_Check(sys.argv[2])
  37.         Zym_Check(sys.argv[2])
  38.     elif (sys.argv[1]).lower() == '-sdn':
  39.         Dns_Check(sys.argv[2])
  40.     elif (sys.argv[1]).lower() == '-url':
  41.         Zym_Check(sys.argv[2])

![Z12O~%TVQLF%BFZUG1XW3K.png

3.requests模块

平台网站:https://xie1997.blog.csdn.net/article/details/82951408
链接

  1. import requests
  2. url='http://www.baidu.com/'
  3. proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}
  4. """
  5. 1get-->请求数据-->发起请求，获取完整的数据，速度慢-->获取网页的内容，爬虫，poc编写
  6. 2psot-->发送数据-->主动服务器提交数据，返回获取完整的数据-->提交数据，获取网页返回的结果，爬虫，poc编写
  7. 3head-->头请求-->很少网络流量获得概要信息,获取请求头，状态码，速度极快-->敏感目录扫描
  8. """
  10. requests_url=requests.get(url=url,proxies=proxies,verify=False)
  11. print(requests_url.text)
  13. '''
  14. proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}
  16. requests_url=requests.get(url=url,proxies=proxies,verify=False)
  17. print(requests_url.text)
  19. GET / HTTP/1.1
  20. Host: www.baidu.com
  21. User-Agent: python-requests/2.24.0
  22. Accept-Encoding: gzip, deflate
  23. Accept: */*
  24. Connection: close
  25. 构造的请求数据包;
  26. '''
  28. #修改数据包特征
  29. header={
  30.     'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36'
  32. }
  33. #重新请求数据包
  34. requests_url=requests.get(url=url,proxies=proxies,verify=False,headers=header)
  35. print(requests_url.status_code)
  36. """
  37. GET / HTTP/1.1
  38. Host: www.baidu.com
  39. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
  40. Accept-Encoding: gzip, deflate
  41. Accept: */*
  42. Connection: close
  44. """

Z32O6{HMMFQ]HX)6BPZ369N.png

  1. #设置URL
  2. url=r"http://www.hnyysyz.com/Site_admin/login.aspx"
  3. #url支持参数格式化http://www.langzi.fun/ge?key2=value2&key1=value1
  4. #print(requests_url.text) #返回Unicode格式的数据（str）
  5. #print(requests_url.content)# 打印出网页的内容--bytes格式
  6. print(r.content.decode('utf-8'))
  7.  # 请求的网页的内容--字符串格式，自动转换成中文，不同网站编码不同
  9. print(r.url)
  10. # 请求的网址，字符串类型
  12. print(r.headers)
  13.  # 请求头，字典类型
  15. print(r.status_code)
  16.  # 状态吗，整数类型
  18. print(r.encoding)
  19. # 网页的编码，字符串类型
  21. print(r.cookies)
  22. # 保存的cookie
  23. #get
  24. 1payload = {'key1': 'value1', 'key2': 'value2'}
  25. 2r = requests.get("http://langzi.fun/ge", params=payload)
  26. 3# 这里的网址自动转变成了 http://www.langzi.fun/ge?key2=value2&key1=value1
  28. #POST
  29. 1d = {'user':'admin','password':'123456'}
  30. 2r = requests.post(url='http://www.langzi.fun/admin.php',data=d)
  32. 还可以上传文件,格式也需要是字典格式
  33. 1files = {'file': open('report.xls', 'rb')}
  34. 2r = requests.post(url='http://www.langzi.fun/upload', files=files)

get-post-参数

  1. import requests
  2. ##设置请求头
  3.  headers = {
  4.         'Connection': 'close',
  5.         'Cache-Control': 'max-age=0',
  6.         'Upgrade-Insecure-Requests': '1',
  7.         'Content-Type': 'application/x-www-form-urlencoded',
  8.         'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36',
  9.         'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
  10.         'Sec-Fetch-Mode': 'navigate',
  11.         'Sec-Fetch-Site': 'same-origin',
  12.         'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8',
  13.     }
  14. ##设置cookie
  15. cookies = {
  16.         'route': '1af52316d573a0b09a54b621dc835a33',
  17.         'JSESSIONID': '0775F27EA4A55DF9C43471A52A9F7FC4'
  18.     }
  19. ##设置提交的数据
  20. values = {'name': 'Tom',
  21.           'sex' : 'Man',
  22.           'id'  : '10' }
  23. ##设置代理
  24. proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}     
  25. ##请求的url
  26. requrl="http://www.baidu.com"
  28. #使用session保持会话请求
  29. sess=requests.session()
  30. regu=sess.get("https://www.baidu.com")
  32. #GET请求
  33. response=requests.get(url=requrl,params=values,headers=headed,proxies=None,timeout=0.1,verify=False,cookies=cookies)
  35. url：要访问的链接
  36. params：url后面的参数
  37. headers：请求头
  38. proxies：代理，无的话填 None
  39. timeout：超时
  40. verify：https的认证，True是启用，False是不启用
  41. cookies：请求的cookie
  43. #POST请求
  44. response=requests.post(url=requrl,data=values,headers=header，timeout=0.1,proxies=proxy,verify=False,cookies=cookies)
  46. url：要访问的链接
  47. data：POST提交的参数
  48. headers：请求头
  49. proxies：代理，无的话填 None
  50. timeout：超时
  51. verify：https的认证，True是启用，False是不启用

响应内容处理

  1. import requests
  2. headers={
  3.     'Host': 'www.hnyysyz.com',
  4.     'User-Agent': r'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36',
  5.     'Referer': 'http://www.hnyysyz.com/Site_admin/login.aspx',
  6.     'Accept-Encoding': 'gzip, deflate',
  7.     'Accept-Language': "zh-CN,zh;q=0.9",
  8.     'Cookie': 'ASP.NET_SessionId=lhuoqi5iu54r1uvjl1t2mjod; Hm_lvt_cf6eaaea0b81e4d87a73486c1305e01c=1632224564; Hm_lpvt_cf6eaaea0b81e4d87a73486c1305e01c=1632224570; CheckCode=6J66N; code=6J66N',
  9.     'Connection': 'close'
  11. }
  12. #构造请求头header
  13. url='http://www.hnyysyz.com/Site_admin/checkcode.aspx?rn=1'
  14. requests_url=requests.get(url=url,headers=headers)
  15. print(requests_url.status_code)
  16. print(requests_url.headers)#返回体信息-->字典类型
  17. Set_Cookie=requests_url.headers['Set-Cookie']
  18. print(Set_Cookie)
  19. print(type(Set_Cookie))
  20. #字符串切片
  21. print(Set_Cookie[10:15])
  23. print(requests_url.cookies)
  25. """"
  26. 200
  27. {'Cache-Control': 'private', 'Content-Length': '1591', 'Content-Type': 'image/Gif', 'Server': 'Microsoft-IIS/7.5', 'X-AspNet-Version': '4.0.30319', 'Set-Cookie': 'CheckCode=B0226; path=/, code=B0226; path=/', 'Date': 'Tue, 21 Sep 2021 15:04:03 GMT', 'Connection': 'close'}
  28. CheckCode=B0226; path=/, code=B0226; path=/
  29. <class 'str'>
  30. B0226
  31. <RequestsCookieJar[<Cookie CheckCode=B0226 for www.hnyysyz.com/>, <Cookie code=B0226 for www.hnyysyz.com/>]>
  33. """
  34. //实现对验证码的截取
  1. import requests
  2. import urllib
  4. value={'username':'admin',
  5.        'password':'123'  }
  6. res=requests.get("http://www.baidu.com"，params=value)  //Get形式提交参数
  8. data=urllib.parse.urlencode(value)
  9. res=requests.get("http://www.baidu.com"，data=data)  //post形式提交参数
  11. res.encoding="utf-8"  #设置编码
  12. res.status_code       #状态码
  13. res.url               #请求的url
  14. res.request.headers   #请求头信息，返回的是一个字典对象，不修改的话，默认是python的请求头
  15. res.headers           #响应头信息，返回的是一个字典对象
  16. res.headers['Content-Type']  #响应头的具体的某个属性的信息
  17. res.headers['Content-Length']   #响应包的长度
  18. res.cookies           #cookie信息，返回的是一个字典对象
  19. print(';'.join(['='.join(item)for item in cookies.items()]))   #打印出具体的cookies信息
  20. res.text              #响应内容的字符串形式，即返回的页面内容
  21. res.content           #响应内容的二进制形式  
  22. res.apparent_encoding #从内容中分析出的响应内容编码方式（备选编码方式）
  24. #响应时间，可用于时间盲注
  25. print(res.elapsed)
  26. print(res.elapsed.total_seconds())
  27. print(res.elapsed.seconds)
  28. print(res.elapsed.microseconds)
  30. 0:00:00.007282
  31. 0.007282
  32. 0
  33. 7282
  35. #响应时间的比较
  36. time=res.elapsed.total_seconds()
  37. if time < float(2.000000):
  38.     print("true")
  39. else:
  40.     print("false")

4.lxml模块

lxml库:获取html标签内的内容
https://www.cnblogs.com/zhangxinqi/p/9210211.html#_label1

  1. from lxml import etree
  2. text='''
  3. <div>
  4.     <ul>
  5.          <li class="item-0"><a href="link1.html">第一个</a></li>
  6.          <li class="item-1"><a href="link2.html">second item</a></li>
  7.          <li class="item-0"><a href="link5.html">a属性</a>
  8.      </ul>
  9.  </div>
  10. '''
  11. html=etree.HTML(text) #初始化生成一个XPath解析对象
  12. result=etree.tostring(html,encoding='utf-8')#解析对象输出代码;二进制对象
  13. print(type(html))#<class 'lxml.etree._Element'>
  14. print(type(result))#<class 'bytes'>
  15. print(result)#二进制
  16. print(result.decode('utf-8'))
  17. """
  18. <class 'lxml.etree._Element'>
  19. <class 'bytes'>
  20. b'<html><body><div>\n    <ul>\n         <li class="item-0"><a href="link1.html">\xe7\xac\xac\xe4\xb8\x80\xe4\xb8\xaa</a></li>\n         <li class="item-1"><a href="link2.html">second item</a></li>\n         <li class="item-0"><a href="link5.html">a\xe5\xb1\x9e\xe6\x80\xa7</a>\n     </li></ul>\n </div>\n</body></html>'
  21. <html><body><div>
  22.     <ul>
  23.          <li class="item-0"><a href="link1.html">第一个</a></li>
  24.          <li class="item-1"><a href="link2.html">second item</a></li>
  25.          <li class="item-0"><a href="link5.html">a属性</a>
  26.      </li></ul>
  27.  </div>
  28. </body></html>
  30. """
  32. from lxml import etree
  33. Html= etree.parse('1.html',etree.HTMLParser())#加载本地文件
  34. result=etree.tostring(Html)
  36. from lxml import  etree
  37. import requests
  38. url='https://fofa.so/result?qbase64=ImdsYXNzZmlzaCIgJiYgcG9ydD0iNDg0OCI%3D'
  39. requests_url=requests.get(url=url,verify=None).content.decode('utf-8')
  42. html=etree.HTML(requests_url)#初始化生成一个XPath解析对象;解析对象为HTML
  43. #result=etree.tostring(html)#解析对象输出代码;
  44. '''
  45. print(type(html))#<class 'lxml.etree._Element'>
  46. print(type(result))#<class 'bytes'>
  47. print(type(resultlist))#<class 'list'>
  48. '''
  49. #print(result.decode())
  50. #f=open("xml.txt","w",encoding='utf-8')
  51. result=result.decode('utf-8')
  52. #把这句话注释掉之后写进文件的是bytes字节;二进制数字;
  53. print(type(result))
  54. for i in  result:
  55.     f.write(i)
  56. f.close()
  57. #byte->str->decode()函数,如果没有对byte类型解码，写进文件的是二进制

Xpath

  1. from lxml import etree
  3. text='''
  4. <div>
  5.     <ul>
  6.          <li class="item-0"><a href="link2.html">second item</a></li>
  7.          <li class="item-1"><a href="link2.html">second item</a></li>
  8.          <li class="item-0"><a href="link5.html">a属性</a>
  9.      </ul>
  10.  </div>
  11. '''
  12. html=etree.HTML(text)
  13. result=html.xpath('//div//ul')
  14. print(type(result))#<class 'list'>
  15. print(result[0].tag)#ul
  16. result2=html.xpath('//li[@class="item-0"]')
  17. print(type(result2))#<class 'list'>
  18. print(result2)#[<Element li at 0x20a714e4648>, <Element li at 0x20a714e4688>]
  19. print(result2[0].tag)#li
  20. print(result[0].attrib)#{}
  21. print(result[0].text)#NONE
  22. result3=html.xpath('//a/@href')#选择为该标签的属性
  23. print(result3)#['link2.html', 'link2.html', 'link5.html']
  1. import requests
  2. from lxml import etree
  3. '''f=open(file='edu.txt',mode='w',encoding='utf-8')
  4. for x in range(1,3):
  5.     url='https://src.sjtu.edu.cn/list/'
  6.     #print(url)
  7.     params={'page':x}
  8.     requests_url=requests.get(url=url,verify=None,params=params)
  9.     html=requests_url.text
  10.     f.write(html)
  11. f.close()
  12. '''
  13. etree_html=etree.parse('edu.txt',etree.HTMLParser())
  14. etree_dom=etree_html.xpath("//tr[@class='row']//td[@class='']//a/text()")
  15. f=open('eduR.txt',mode='w',encoding='utf-8')
  16. #print(etree_dom)
  17. for x in  range(len(etree_dom)):
  18.     etree_dom[x]=str(etree_dom[x])
  19.     etree_dom[x]=(etree_dom[x].replace("\r\n        \r\n      ","")).strip()
  20.     f.write(etree_dom[x]+'\n')
  21. print(etree_dom)
  22. #etree_dom=etree_html.xpath("//tr[@class='row']//td[@class='']//a/text()")选择的是文本就直接是文本列表
  23. #['北京交通大学存在命令执行漏洞', '清华大学存在敏感信息泄露', ...
  24. f.close()
  26. '''
  27. f=open(file='edu.txt',mode='w',encoding='utf-8')
  28. for x in range(1,3):
  29.     url='https://src.sjtu.edu.cn/list/'
  30.     #print(url)
  31.     params={'page':x}
  32.     requests_url=requests.get(url=url,verify=None,params=params)
  33.     html=requests_url.text
  34.     f.write(html)
  35. f.close()
  36. '''
  37. '''
  38.  <tr class="row">
  39.     <td class="am-text-center am-hide-sm-down">2021-09-24</td>
  40.     <td class="">
  41.       <a href="/post/108615/" >
  43.         北京交通大学存在命令执行漏洞
  45.       </a>
  46.     </td>
  47.     <td class="am-text-center am-hide-sm-down"><span class="am-badge am-badge-warning">高危</span></td>
  48.     <td class="am-text-center"><a href="/profile/7786/">全能小赵同学</a></td>
  49.   </tr>
  50.   '''
  52. '''
  54. etree_dom=etree_html.xpath("//tr[@class='row']//a")
  55. print(etree_dom)
  56. [<Element a at 0x21a57651e88>, <Element a at 0x21a57651ec8
  57. 类型为list类型
  58. 如果选择的是标签会直接显示<Element a at 0x21a57651e88>
  60. #对于标签
  61. Element类型是'lxml.etree._Element'，某种意义来说同时是一个列表
  62. 列表的需要使用tag\attrib\text三个不同的属性来获取我们需要的东西
  63. 变量.tag获取到的是标签名是---字符串
  64. 变量.attrib获取到的是节点标签a的属性---字典
  65. 变量.text获取到的是标签文本--字符串
  67. etree_dom=etree_html.xpath("//tr[@class='row']/a")
  68.   /从当前节点选取直接子节点;a为子孙节点;无法获得到a标签
  69.   etree_dom=etree_html.xpath("//tr[@class='row']//a")
  70.   //选择子孙节点
  71.   #etree_dom=etree_html.xpath("//tr[@class='row']//td[@class='']//a/text()")选择的是文本就直接是文本列表
  72. #['北京交通大学存在命令执行漏洞', '清华大学存在敏感信息泄露', ...
  74. 定位法:
  75. 假设是要选择a标签的之间的文本:爷-父-自己;
  76. 找到自己的父根在找父根的父根;
  77. ("//tr[@class='row']//td[@class='']//a/text()")#文本列表
  78. ("//tr[@class='row']//td[@class='']//a/@href")#属性字典
  79. '''

tips-使用

  1. from lxml import etree
  2. html=etree.HTML(text)#HTML对象
  3. #etree_html=etree.parse('edu.txt',etree.HTMLParser())
  4. #xpath
  5. etree_dom=etree_html.xpath("//tr[@class='row']//a")#选节点
  6. 注意编码方式:二进制转str:encode(),decode()

base64

  1. import base64
  2. str1="abc"
  3. str1=str1.encode('utf-8')
  4. #对于base64加密的必须是二进制数;要先进行str->baty
  5. str1=base64.b64encode(str1)
  6. print(str1)#二进制数据
  7. print(type(str1))
  8. str1=str1.decode()#二进制->str
  9. print(str1)