【Python】Fofa&SRC

【Python】Fofa&SRC

• 关于选择器
• 总体函数
• 教育网漏洞ip收集

关于选择器

xpath方法：//开头，紧跟div标签，其属性[@class=“re-domain”]。再紧跟其下的a标签，再找属性为target="_blank"

xpath定位方法详解

但并不推荐自己写xpath选择表达式，推荐鼠标copy表达式。
如下图在一个CSDN的网站的测试：

• 鼠标右键需要选取的内容，检测前端代码
  
• 对整个代码，鼠标右键，copy，可以copy selector和xpath，自由选择，获取到整个标签。

//*[@id="floor-www-index_558"]/div/div[2]/div[1]/div[1]/div[2]/div[1]/div[2]/div/div[3]/a[1]

然后根据CSS selector的参考文档，选取标签内自己需要的属性值：CSS Selector Reference

#https://fofa.so/result?qbase64=ImdsYXNzZmlzaCIgJiYgcG9ydD0iNDg0OCI%3D
search_data='"glassfish"&&port="4848"'
for yeshu in range(1,11):
	url='http://fofa.so/result?page'+str(yeshu)+'&qbase64='	search_data_bs=str(base64.b64encode(search_data.encode("utf-8")),"utf-8")
	urls=url+search_data_bs
	print(urls)
	result=requests.get(urls).content
	print(result.decode('utf-8'))
	soup=etree.HTML(result)
	ip_data=soup.xpath('//div[@class="re-domain"] /a[@target="_blank"]/@href')
	ipdata='\n'.join(ip_data)//返回的是一个列表对象，通过join方法，分隔。
	with open(r'ip.txt','a+') as f:
	print(ip_data)

获取登录状态的cookie，包装到headers里面，再进行爬取数据。

import base64
import requests
import time
headers={
    'cookie':'fofapro_ars_session=xxxx',
}
search_data='"glassfish"&&port="4848"&&country="CN"'
for yeshu in range(1,11):
    url='https://fofa.so/result?page='+str(yeshu)+'&qbase64='
    search_data_bs=str(base64.b64encode(search_data.encode("utf-8")),"utf-8")
    urls=url+search_data_bs
    print("正在提取第"+str(yeshu)+"页")
    result=requests.get(urls,headers=headers,timeout=0.5).content#延迟请求，这里不行的话在with open最后添加
    print(result.decode('utf-8'))
    try:
	    soup=etree.HTML(result)
	    ip_data=soup.xpath('//div[@class="re-domain"] /a[@target="_blank"]/@href')
	    ipdata='\n'.join(ip_data)#返回的是一个列表对象，通过join方法，分隔。
	    with open(r'ip.txt','a+') as f:
			f.write(ipdata+'\n')
			f.close()
	        print(ip_data)
	    #time.sleep(0.5)
	except Exception as e:
		pass

写的代码遇到报错了就用try

import requests
import time
payload_linux=''
payload_windows=''
for ip in open('ip.txt'):
	ip=ip.replace('\n','')
	windows_url=ip+payload_windows
	linux_url=ip+payload_linux
	#print(windows_url)
	#print(linux_url)
	try:
		vuln_code_l=requests.get(linux_url).status_code
		vuln_code_w=requests.get(windows_url).status_code
		print("check->"+ip)
		if vuln_code_l==200 or vuln_code_w==200:
			with open(r'vuln.txt','a+') as f:
				f.write(ip)
				f.write('\r\n')
				f.close()
		time.sleep(0.5)
	except Exception as e:
		pass

总体函数

def fofa_search(search_data,page+1):
	headers={
    'cookie':'fofapro_ars_session=xxxx',
}
#search_data='"glassfish"&&port="4848"&&country="CN"'
	for yeshu in range(1,page):
	    url='https://fofa.so/result?page='+str(yeshu)+'&qbase64='
	    search_data_bs=str(base64.b64encode(search_data.encode("utf-8")),"utf-8")
	    urls=url+search_data_bs
	    print("正在提取第"+str(yeshu)+"页")
	    result=requests.get(urls,headers=headers,timeout=0.5).content#延迟请求，这里不行的话在with open最后添加
	    print(result.decode('utf-8'))
	    try:
		    soup=etree.HTML(result)
		    ip_data=soup.xpath('//div[@class="re-domain"] /a[@target="_blank"]/@href')
		    ipdata='\n'.join(ip_data)#返回的是一个列表对象，通过join方法，分隔。
		    with open(r'ip.txt','a+') as f:
				f.write(ipdata+'\n')
				f.close()
		        print(ip_data)
		    #time.sleep(0.5)
		except Exception as e:
			pass
def check_vuln():
	payload_linux=''
	payload_windows=''
	for ip in open('ip.txt'):
		ip=ip.replace('\n','')
		windows_url=ip+payload_windows
		linux_url=ip+payload_linux
		#print(windows_url)
		#print(linux_url)
		try:
			vuln_code_l=requests.get(linux_url).status_code
			vuln_code_w=requests.get(windows_url).status_code
			print("check->"+ip)
			if vuln_code_l==200 or vuln_code_w==200:
				with open(r'C:\\xxx\\vuln.txt','a+') as f:
					f.write(ip)
					f.write('\r\n')
					f.close()
			time.sleep(0.5)
		except Exception as e:
			pass
if _name_=='_main_':
	search=sys.argv[1]
	page=sys.argv[2]
	fofa_search(search,int(page))

教育网漏洞ip收集

https://src.sjtu.edu.cn/

import requests
from lxml import etree
def src_tiqu(yeshu):
	for i in range(1,int(yeshu)):
		url='https://src.sjtu.edu.cn/list/?page='+str(i)
		print("提取->",str(i)+"页数")
		data=requests.get(url).content
		print(data.decode('utf-8'))
		#分析完代码后，xpath查找
		soup=etree.HTML(data)
		result=soup.xpath('//td[@class=""]/a/text()')
		results='\n'.join(result)#分隔单元
		resultss=results.split()#去空 
		print(resultss)
		for edu in resultss:
			with open(r'src_edu.txt','a+',encoding='utf-8') as f:
				f.write(edu+'\n')
				f.close()
if __name__=='__main__':
	yeshu=input("您要查询几页:")
	src_tiqu(yeshu)