日本免费全黄少妇一区二区三区-高清无码一区二区三区四区-欧美中文字幕日韩在线观看-国产福利诱惑在线网站-国产中文字幕一区在线-亚洲欧美精品日韩一区-久久国产精品国产精品国产-国产精久久久久久一区二区三区-欧美亚洲国产精品久久久久

  1. 首頁 > 云知道 > >

電腦pdf轉word軟件推薦 word轉換pdf格式軟件免費版

云知道word


電腦pdf轉word軟件推薦 word轉換pdf格式軟件免費版


企業(yè)Web網(wǎng)站很多直接對Internet提供服務，往往會被黑客作為惡意攻擊的突破口，Web的安全和企業(yè)的信息安全高度相連 。
現(xiàn)實的管理中，在安全制度不完善的情況下，網(wǎng)站開發(fā)人員和維護人員經(jīng)常因為業(yè)務緊急上線或者Bug修復，私自上線新的內容或變更，安全人員往往在出現(xiàn)問題后追查時才發(fā)現(xiàn)，之前的安全環(huán)境或者代碼已經(jīng)都變更了 。
今天介紹如何利用GitHut上的SimpleAutoBurp項目，利用Python腳本實現(xiàn)網(wǎng)站的定時的自動掃描，這樣能夠在更短的時間發(fā)現(xiàn)Web系統(tǒng)的漏洞 。GitHub上的腳本針對Linux平臺，本文將腳本修改為在Windows平臺上運行 。
一、工作原理：
利用Crontab（linux平臺）或任務計劃程序（windows平臺）定期執(zhí)行SimpleAutoBurp.py，該腳本利用BurpsuitePro的RESTAPI和配置文件config.json對目標主機進行web掃描 。
二、腳本文件 SimpleAutoBurp Config.json
SimpleAutoBurp.py 是調用Burp suite API的腳本，config.json是其配置文件 。
SimpleAutoBurp.py
【電腦pdf轉word軟件推薦 word轉換pdf格式軟件免費版】from os import strerrorfrom subprocess import Popenimport requestsimport timeimport subprocessimport loggingimport osimport signalimport jsonimport sysfrom datetime import datetime#將configFile指向你的config.json文件configFile = r"F:/pythonCode/SimpleAutoBurp/SimpleAutoBurp-main/config.json"try:with open(configFile) as json_data:config=json.load(json_data)except:print("Missing config.json file. Make sure the configuration file is in the same folder")sys.exit()burpConfigs=config["burpConfigs"][0]siteConfigs=config["sites"]def set_logging():global rootLoggerlogFormatter = logging.Formatter("%(asctime)s [%(levelname)-5.5s]%(message)s")rootLogger = logging.getLogger()NumericLevel = getattr(logging, burpConfigs["loglevel"].upper(), 10)rootLogger.setLevel(NumericLevel)fileHandler = logging.FileHandler("{0}/{1}.log".format(burpConfigs["logPath"], burpConfigs["logfileName"]))fileHandler.setFormatter(logFormatter)rootLogger.addHandler(fileHandler)consoleHandler = logging.StreamHandler()consoleHandler.setFormatter(logFormatter)rootLogger.addHandler(consoleHandler)def execute_burp(site):cmd = burpConfigs["java"]" -jar -Xmx"burpConfigs["memory"]" -Djava.awt.headless="str(burpConfigs["headless"])" "burpConfigs["burpJar"]" --project-file="site["project"]" --unpause-spider-and-scanner"try:rootLogger.debug("Executing Burp: "str(cmd))p = Popen(cmd, shell=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)return p.pidexcept:rootLogger.error("Burp Suite failed to execute.")exit()def check_burp(site):count = 0url = "http://127.0.0.1:1337/"site["apikey"]"/v0.1/"time.sleep(10)while True:if count > burpConfigs["retry"]:rootLogger.error("Too many attempts to connect to Burp")exit()else:rootLogger.debug("Cheking API: "str(url))init = requests.get(url)if init.status_code == 200:rootLogger.debug("API running, response code: "str(init.status_code))# Let Brup time to load extensionstime.sleep(30)breakelse:rootLogger.debug("Burp is not ready yet, response code: "str(init.status_code))time.sleep(10)def execute_scan(site):data = 'https://www.shwenmu.com/wenda/{"urls":["'site["scanURL"]'"]}'url="http://127.0.0.1:1337/"site["apikey"]"/v0.1/scan"rootLogger.info("Starting scan to: "str(site["scanURL"]))scan = requests.post(url, data=https://www.shwenmu.com/wenda/data)rootLogger.debug("Task ID: "scan.headers["Location"])while True:url="http://127.0.0.1:1337/"site["apikey"]"/v0.1/scan/"scan.headers["Location"]scanresults = requests.get(url)data = https://www.shwenmu.com/wenda/scanresults.json()rootLogger.info("Current status: "data["scan_status"])if data["scan_status"] == "failed":rootLogger.error("Scan failed")kill_burp()exit()elif data["scan_status"] == "succeeded":rootLogger.info("Scan competed")return dataelse:rootLogger.debug("Waiting 60 before cheking the status again")time.sleep(60)def kill_burp(child_pid):rootLogger.info("Killing Burp.")try:os.kill(child_pid, signal.SIGTERM)rootLogger.debug("Burp killed")except:rootLogger.error("Failed to stop Burp")def get_data(data, site):for issue in data["issue_events"]:rootLogger.info("Vulnerability - Name: "issue["issue"]["name"]" Path: "issue["issue"]["path"]" Severity: "issue["issue"]["severity"])token=site["scanURL"].split('/')[2]top_level=token.split('.')[-2] '.' token.split('.')[-1]file = top_level"-"datetime.now().strftime("%Y_%m_%d-%I_%M_%S_%p")".txt"file = burpConfigs["ScanOutput"]filerootLogger.info("Writing full results to: "file)with open(file, "w") as f:f.write(str(data["issue_events"]))def main():set_logging()for site in config["sites"]:# Execute BurpSuite Prochild_pid = execute_burp(site)# Check if API burp is upcheck_burp(site)# Execute Scandata = https://www.shwenmu.com/wenda/execute_scan(site)# Get Vulnerability dataget_data(data, site)# Stop BurprootLogger.info("Scan finished, killing Burp.")kill_burp(child_pid)if __name__ == '__main__':main()

推薦閱讀