本帖最后由 f4ckdog 于 2017-8-21 10:38 编辑
清除awvs在扫描过程中的指纹，变相隐藏awvs特征
最近研究awvs调用api直接扫描,实际测试中发现了一些问题,比如说我发现wvs总是会带一些类似指纹的东西.比如说
headers
Acunetix-Aspect
Acunetix-Aspect-Password
Acunetix-Aspect-Queries
Accept：acunetix/wvs
Referer：www.acunetix-
Cookie: acunetixCookie
2.url里面包含的特征
md5(acunetix_wvs_security_test)
injected_by_wvs
wvstest
acunetix-wvs-test
acunetix.wvs
acunetix_invalid
$acunetix
bxss.me
扫描了一个本地的靶场.然后查看日志
root@bee-box:/var/log/apache2# cat access.log |grep acunetix | wc -l
5549
root@bee-box:/var/log/apache2# cat access.log |grep acunetix_wvs_security_test | wc -l
5075
root@bee-box:/var/log/apache2# cat access.log |grep -v acunetix_wvs_security_test |grep wvs | wc -l
3879
root@bee-box:/var/log/apache2# cat access.log |grep -v acunetix_wvs_security_test |grep -v wvstest | grep wvs |wc -l
13
root@bee-box:/var/log/apache2# cat access.log |grep -v acunetix_wvs_security_test |grep -v wvstest | grep wvs |tail
192.168.0.100 - - [17/Aug/2017:19:29:55 +0200] "GET /acunetix-wvs-test-for-some-inexistent-file HTTP/1.1" 404 409 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21"
192.168.0.100 - - [17/Aug/2017:19:29:57 +0200] "GET http://www.acunetix.wvs HTTP/1.1" 200 588 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21"
192.168.0.100 - - [17/Aug/2017:19:29:57 +0200] "CONNECT www.acunetix.wvs:443 HTTP/1.1" 405 408 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21"
192.168.0.101 - - [17/Aug/2017:19:32:06 +0200] "GET /acunetix-wvs-test-for-some-inexistent-file HTTP/1.1" 404 409 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21"
192.168.0.101 - - [17/Aug/2017:20:24:37 +0200] "GET /acunetix-wvs-test-for-some-inexistent-file HTTP/1.1" 404 409 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21"
192.168.0.101 - - [17/Aug/2017:20:25:36 +0200] "GET /acunetix-wvs-test-for-some-inexistent-file HTTP/1.1" 404 409 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21"
192.168.0.101 - - [17/Aug/2017:20:35:08 +0200] "GET /acunetix-wvs-test-for-some-inexistent-file HTTP/1.1" 404 409 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21"
192.168.0.100 - - [18/Aug/2017:03:58:49 +0200] "GET /acunetix-wvs-test-for-some-inexistent-file HTTP/1.1" 404 409 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21"
192.168.0.100 - - [18/Aug/2017:03:58:54 +0200] "CONNECT www.acunetix.wvs:443 HTTP/1.1" 405 408 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21"
192.168.0.100 - - [18/Aug/2017:03:58:54 +0200] "GET http://www.acunetix.wvs HTTP/1.1" 200 588 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21"
root@bee-box:/var/log/apache2#
所以很容易确定这个属于wvs扫描的.也很容易就被waf直接干掉了.所以需要借助于第三发的其他来去掉这些标志。之前有看到burp来去掉这个标志的.但是在云端,开一个burp好像有点gg的.主要的是云主机的linux登录桌面不太习惯.于是想到了强悍的wyproxy.
首先去掉httpheader里面的标志.在handler.py里面增加了一个擦除函数
def Characteristics(headers):
#repeat wvs
if 'Acunetix-Aspect' in headers:
del headers['Acunetix-Aspect']
if 'Acunetix-Aspect-Password' in headers:
del headers['Acunetix-Aspect-Password']
if 'Acunetix-Aspect-Queries' in headers:
del headers['Acunetix-Aspect-Queries']
if 'Accept' in headers:
if headers['Accept'] == 'acunetix/wvs':
headers['Accept'] = 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8'
if 'Referer' in headers:
if 'www.acunetix-' in headers['Referer']:
headers['Referer'] = flow.request.url
if 'Cookie' in headers:
if 'acunetixCookie' in headers['Cookie']:
headers['Cookie'] = headers['Cookie'].replace('acunetixCookie','testCookie')
return headers
然后在wyproxy_request_handle里面增加一行
def wyproxy_request_handle(flow):
"""wyproxy send data to server before processing"""
flow.request.anticache() # disable cache
flow.request.anticomp() # disable gzip compress
Characteristics(flow.request.headers)
直接替换的函数.不过这样不可行.只是暂时的替换了，但是实际上请求的参数并没有被替换.
后来在看官方的文档的时候发现一个东西
http://docs.mitmproxy.org/en/stable/scripting/api.html#mitmproxy.http.HTTPRequest
replace(pattern, repl, flags=0, count=0)
Replaces a regular expression pattern with repl in the headers, the request path and the body of the request. Encoded content will be decoded before replacement, and re-encoded afterwards.
可以直接全文里面使用正则去替换.类似于
def dispose(url):
#replacee path query
#url.replace('md5\(acunetix_wvs_security_test\)','63c19a\'.\'6da79816\'.\'b21429e5b\'.\'b262daed8')
url.replace('injected_by_wvs','injected_by_tsn')
url.replace('wvstest','xsstest')
url.replace('acunetix-wvs-test','security-test')
url.replace('acunetix\.wvs','0xa.cc')
url.replace('acunetix_invalid','file_invalid')
url.replace('\[\$acunetix\]','[$filuname]')
return url
def wyproxy_request_handle(flow):
"""wyproxy send data to server before processing"""
flow.request.anticache() # disable cache
flow.request.anticomp() # disable gzip compress
Characteristics(flow.request.headers)
dispose(flow.request)
实际的测试里面.发现部分替换掉了无法检测出结果.比如md5(acunetix_wvs_security_test)被替换掉了.对于php代码执行这块就检测不到了.bxss.me是肯定不能换掉掉.替换了后发现ssrf xxe 远程包含，远程读取都不能被发现了.不过查日志可以根据这个作为关键字来查找倒是 |