Acunetix Web Vulnerability Scanner 11批量添加掃描/刪除小腳本

01-30

AWVS10有批量掃的功能,但是在AWVS11這個版本就沒有了，作為有個懶手黨和技術渣,掃描一個小站沒有批量就算了,一些大站和刷src的時候沒有就難受了,於是在網上找了一個,感覺還不錯,就分下了一下了。

用python寫的小工具，使用方法在腳本裡面寫了出來了。代碼如下:

#-*- coding:utf-8 -*-nimport urllib2nimport sslnimport jsonn__author="jamesj"n#localhost:3443全部替換為awvs所在的伺服器及埠nusername=root@ydxred.comn#賬號郵箱npw=自己sha256加密後的密碼n#sha256加密後的密碼，通過burp抓包可獲取,也可以使用(http://tool.oschina.net/encrypt?type=2)把密碼進行加密之後填入，請區分大小寫、中英文字元。n#以上內容為配置內容，然後把要添加的url列表保存成testawvs.txt文件，放在該腳本下運行該腳本。nssl._create_default_https_context = ssl._create_unverified_contextnurl_login="https://localhost:3443/api/v1/me/login"nsend_headers_login={nHost: localhost:3443,nAccept: application/json, text/plain, */*,nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3,nAccept-Encoding: gzip, deflate, br,nContent-Type: application/json;charset=utf-8n}nndata_login={"email":"+username+","password":"+pw+","remember_me":false}nnreq_login = urllib2.Request(url_login,headers=send_headers_login)nresponse_login = urllib2.urlopen(req_login,data_login)nxauth = response_login.headers[X-Auth]nCOOOOOOOOkie = response_login.headers[Set-Cookie]nprint "當前驗證信息如下rn cookie : %r rn X-Auth : %r "%(COOOOOOOOkie,xauth)nsend_headers2={tntHost:localhost:3443,ntAccept: application/json, text/plain, */*,ntAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3,ntContent-Type:application/json;charset=utf-8,ntX-Auth:xauth,ntCookie:COOOOOOOOkient}n#以上代碼實現登錄（獲取cookie）和校驗值ndef add_exec_scan():nturl="https://localhost:3443/api/v1/targets"nttry:ntturllist=open(testawvs.txt,r)#這是要添加的url列表nttformaturl=urllist.readlines()nttfor i in formaturl:nttttarget_url=http://+i.strip()ntttdata={"description":"222","address":"+target_url+","criticality":"10"}nttt#data = urllib.urlencode(data)由於使用json格式所以不用添加ntttreq = urllib2.Request(url,headers=send_headers2)ntttresponse = urllib2.urlopen(req,data)ntttjo=json.loads(response.read())nttttarget_id=jo[target_id]#獲取添加後的任務IDnttt#print target_idnt#以上代碼實現批量添加nnttturl_scan="https://localhost:3443/api/v1/scans"ntttheaders_scan={ntHost: localhost:3443,ntAccept: application/json, text/plain, */*,ntAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3,ntAccept-Encoding: gzip, deflate, br,ntContent-Type: application/json;charset=utf-8,ntX-Auth:xauth,ntCookie:COOOOOOOOkie,nttt}ntttdata_scan={"target_id":+"+target_id+"+,"profile_id":"11111111-1111-1111-1111-111111111111","schedule":{"disable":false,"start_date":null,"time_sensitive":false},"ui_session_id":"66666666666666666666666666666666"}ntttreq_scan=urllib2.Request(url_scan,headers=headers_scan)ntttresponse_scan=urllib2.urlopen(req_scan,data_scan)ntttprint response_scan.read()+"添加成功！"nt#以上代碼實現批量加入掃描ntturllist.close()ntexcept Exception,e:nttprint enndef count():nturl_count="https://localhost:3443/api/v1/notifications/count"ntreq_count=urllib2.Request(url_count,headers=send_headers2)ntresponse_count=urllib2.urlopen(req_count)ntprint "當前存在%r個通知！" % json.loads(response_count.read())[count]ntprint "-" * 50ntprint "已存在以下任務"nturl_info="https://localhost:3443/api/v1/scans"ntreq_info=urllib2.Request(url_info,headers=send_headers2)ntresponse_info=urllib2.urlopen(req_info)ntall_info = json.loads(response_info.read())ntnum = 0ntfor website in all_info.get("scans"):nttnum+=1nttprint website.get("target").get("address")+" rn target_id:"+website.get("scan_id")ntprint "共 %r個掃描任務" % numntt#count()n#scan、target、notification！ndef del_scan():nturl_info="https://localhost:3443/api/v1/scans"ntreq_info=urllib2.Request(url_info,headers=send_headers2)ntresponse_info=urllib2.urlopen(req_info)ntall_info = json.loads(response_info.read())ntcounter = 0ntfor website in all_info.get("scans"):ntt#if (website.get("target").get("description"))== "222":ntturl_scan_del="https://localhost:3443/api/v1/scans/"+str(website.get("scan_id"))nttreq_del = urllib2.Request(url_scan_del,headers=send_headers2)nttreq_del.get_method =lambda: DELETEnttresponse_del = urllib2.urlopen(req_del)nttcounter = counter+1nttprint "已經刪除第%r個!" % countern#del_scan()ttt#通過描述判斷是否使用掃描器添加掃描器添加的時候設置description=「222」ndef del_targets():nturl_info="https://localhost:3443/api/v1/targets"ntreq_info=urllib2.Request(url_info,headers=send_headers2)ntresponse_info=urllib2.urlopen(req_info)ntall_info = json.loads(response_info.read())ntfor website in all_info.get("targets"):nttif (website.get("description"))== "222":nttturl_scan_del="https://localhost:3443/api/v1/targets/"+str(website.get("target_id"))ntttreq_del = urllib2.Request(url_scan_del,headers=send_headers2)ntttreq_del.get_method =lambda: DELETEntttresponse_del = urllib2.urlopen(req_del)ntttprint "ok!"tn#del_targets()nif __name__== "__main__":ntprint "*" * 20ntcount()ntprint "1、使用testawvs.txt添加掃描任務並執行請輸入1，然後回車rn2、刪除所有使用該腳本添加的任務請輸入2，然後回車rn3、刪除所有任務請輸入3，然後回車rn4、查看已存在任務請輸入4，然後回車rn"ntchoice = raw_input(">")n#tprint type(choice)nntif choice =="1":nttadd_exec_scan()nttcount()ntelif choice =="2":nttdel_targets()nttcount()ntelif choice =="3":nttdel_scan()nttcount()ntelif choice =="4":nttcount()ntelse:nttprint "請重新運行並請輸入1、2、3、4選擇。"nttn#下圖的注釋信息是刪除通知。。tn"""tntcounter= 0ntfor website in all_info.get("notifications"):nttif (website["data"].get("address")== "www.ly.com"):ntttcounter = counter + 1nttturl_del = "https://localhost:3443/api/v1/scans/"+str(website["data"].get("scan_id"))ntttprint url_del#print url_delntttreq_del = urllib2.Request(url_del,headers=send_headers2)nttt #DELETE方法nttttry:nttttreq_del.get_method = lambda:"DELETE"nttttresponse1 = urllib2.urlopen(req_del)nttttntttexcept:nttttprint "error"nttttcontinuentprint counternttt#print response1.read()nt#for address in need_info["address"]nt#tif addressndel_all()n"""n

運行後的效果如下

用法:

------username------- 替換為用戶名，

------pw---------替換為密碼sha256後的密碼。

可以使用以下網址進行加密。http://tool.oschina.net/encrypt?type=2 servers替換awvs地址默認埠3443,如果有設置不同的埠請批量替換3443，url列表，保存成testawvs.txt文件放到這個腳本同目錄下。

掃描網站需要去除http://頭

注:批量添加掃多了和掃的時間長了電腦可能的哭,但是你可以選擇睡之前關閉除了awvs11電腦的所有任務不管他第二天重啟電腦看結果就ok了

本帖最後由 jamesj 發表於吾愛破解

原文鏈接:https://www.52pojie.cn/forum.php?mod=viewthread&tid=610851