前言：楼主是在甲方工作的一名苦逼工程师  前几天有前线的小伙伴说不能在客户（证券类的）环境里装检查工具，让我给写个小脚本跑跑jsp马之类的，想了想可以实现，于是就写了个脚本： [Python] 纯文本查看 复制代码 #-*- encoding:UTF-8 -*-
import re
import time
from optparse import OptionParser
import os
from itertools import islice
p=re.compile("BASE64Decoder\(\).decodeBuffer\(|void BB|Socket\(\)|request.getInputStream\(\)|jspspy|KJ021320|PW_SESSION_ATTRIBUTE|getRuntime\(\).exec\(.*\)|Runtime.getRuntime\(\)|FileOutputStream\(application|getRealPath\(request.getServletPath\(",re.I)
#p=re.compile("Pwd\s{0,3}\=.{1,10}|BASE64Decoder|JFolder|getInputStream\(|getOutputStream\(|jspspy|KJ021320|PW_SESSION_ATTRIBUTE|getRuntime\(.*\)|FileOutputStream\(.*\)|FileInputStream\(.*\)|getRealPath\(.*\)",re.I)
file_log=os.getcwd()+'/'+time.strftime('%Y%m%d%H%M%S')+'.log'
#文件切片处理
def filelice(filespath):
with open(filespath) as f:
while True:
next_n_lines = "".join(list(islice(f,20)))
if p.findall(next_n_lines):
LastCreatedTime=time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(os.path.getctime(filespath)))
LastModifiedTime=time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(os.path.getmtime(filespath)))
filelog='FilePath:%s\nBadCode:%s\nLast Created Time:%s\nLast Modified Time:%s\n' % (filespath,p.findall(next_n_lines)[0],LastCreatedTime, LastModifiedTime)
print filelog+'\n'
fo=open(file_log,'a+')
fo.write(filelog+'\n')
fo.close()
break
elif not next_n_lines:
break
#扫描文件
def scan(file,include_ext):
global file_log
for root, dirs, files in os.walk(file):
for filespath in files:
if include_ext=='all':
filelice(os.path.join(root,filespath))
elif os.path.splitext(os.path.join(root,filespath))[1][1:].lower() in include_ext:
filelice(os.path.join(root,filespath))
#主函数
def main():
parser = OptionParser()
parser.add_option("-p", "--path", action="store",
dest="path",
default=False,
type="string",
help="Scanning Path")
parser.add_option("-i", "--ifileext",
action="store",
dest="ifileext",
default=False,
type="string",
help="Including FileExt")
(options, args) = parser.parse_args()
if(options.path and options.ifileext):
path = options.path
ifileext=options.ifileext
else:
return
print "scanning start..."
scan(path,ifileext)
if __name__=="__main__":
start =time.clock()
main()
end = time.clock()
print ("The function run time is : %.03f seconds" %(end-start))使用方法： 测试： 基于关键字的扫描，肯定有漏网之鱼，但是总比手工去查快些。
后来小伙伴说速度有点慢啊，有些客户的网站文件量非常的大，需要更快的扫描速度。 想想那就弄个多线程就能加快扫描。 [Python] 纯文本查看 复制代码 #-*- encoding:UTF-8 -*-
import re
import time
from optparse import OptionParser
import os
from itertools import islice
import threading
p=re.compile("BASE64Decoder\(\).decodeBuffer\(|void BB|Socket\(\)|new RandomAccessFile\(|request.getInputStream\(\)|jspspy|KJ021320|PW_SESSION_ATTRIBUTE|getRuntime\(\).exec\(.*\)|FileOutputStream\(application|getRealPath\(request.getServletPath\(",re.I)
#p=re.compile("Pwd\s{0,3}\=.{1,10}|BASE64Decoder|JFolder|getInputStream\(|getOutputStream\(|jspspy|KJ021320|PW_SESSION_ATTRIBUTE|getRuntime\(.*\)|FileOutputStream\(.*\)|FileInputStream\(.*\)|getRealPath\(.*\)",re.I)
file_log=os.getcwd()+'/'+time.strftime('%Y%m%d%H%M%S')+'.log'
rlock = threading.Lock()
#文件切片处理
def Filelice(filepath):
with open(filepath) as f:
while True:
next_n_lines = "".join(list(islice(f,40)))
if p.findall(next_n_lines):
LastCreatedTime=time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(os.path.getctime(filepath)))
LastModifiedTime=time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(os.path.getmtime(filepath)))
filelog='FilePath:%s\nBadCode:%s\nLast Created Time:%s\nLast Modified Time:%s\n' % (filepath,p.findall(next_n_lines)[0],LastCreatedTime, LastModifiedTime)
print filelog+'\n'
fo=open(file_log,'a+')
fo.write(filelog+'\n')
fo.close()
break
elif not next_n_lines:
break
#扫描文件
def scan(file,include_ext):
global file_log
global rlock
for root, dirs, files in os.walk(file):
rlock.acquire()
for filespath in files:
rlock.acquire()
if include_ext=='all' or os.path.splitext(os.path.join(root,filespath))[1][1:].lower() in include_ext :
filelice(os.path.join(root,filespath))
rlock.release()
#主函数
def main():
parser = OptionParser()
parser.add_option("-p", "--path", action="store",
dest="path",
default=False,
type="string",
help="Scanning Path")
parser.add_option("-i", "--ifileext",
action="store",
dest="ifileext",
default=False,
type="string",
help="Including FileExt")
parser.add_option("-t", "--threadNum",
action="store",
dest="threadNum",
default=5,
type="int",
help="Threading Num")
(options, args) = parser.parse_args()
if(options.path and options.ifileext and options.threadNum):
path = options.path
ifileext=options.ifileext
threadNum=options.threadNum
else:
return
print "scanning start..."
filelist=[]
for root, dirs, files in os.walk(path):
for filespath in files:
if ifileext=='all' or os.path.splitext(filespath)[1][1:].lower() in ifileext.split(','):
filelist.append(os.path.join(root,filespath))
for i in range(0,len(filelist),threadNum):
threads = []
for j in range(len(filelist[i:i+threadNum])):
threads.append(threading.Thread(target=Filelice,args=(filelist[i:i+threadNum][j],)))
for th in threads:
th.start()
for th in threads:
th.join()
if __name__=="__main__":
start =time.clock()
main()
end = time.clock()
print ("The function run time is : %.03f seconds" %(end-start))用法： 测试： 能快很多。
自我介绍一下： 我也是一名90后，大学里修的计算机科学与技术专业，没有接触过信息安全，后面毕业了才第一次接触，当时就下定决心走这条路。 一路下来，主要还是靠自学，遇到不懂的就百度，但是学到的东西都是面向公司业务的，有很多方面接触不到。 所以希望加入一个平台能和大家多交流，互通有无。 新手上路，本来有点不敢投稿，但是看到本次开放注册门槛降低了，就厚着脸皮申请加入90sec。 望组织收留 
==========================
超过10位正式成员同意，转正成功。
管理05
|
