mirror of
https://github.com/UzJu/Cloud-Bucket-Leak-Detection-Tools.git
synced 2025-11-05 10:44:04 +00:00
2022-5-29-Update-Info
感谢各位大佬的star和支持 add 1、add Aws S3 Bucket Core（新增AWS存储桶检测功能） Fix 1、The function to save detection results to CSV is moved to config/conf.py（将检测结果CSV保存功能移至config/conf.py） 2、Fix boto3 error（修复Boto3报错问题） 3、Change the problem that some documents are not clear（更新部分文档内容不清晰的问题）
This commit is contained in:
UzJu
parent
5c6639121b
commit
4cc669edd0
126
README.en.md
126
README.en.md
@ -1,10 +1,29 @@
|
||||
# :rooster:0x00 Preface
|
||||
|
||||
Want to write a storage bucket utilization, first draw a pie for yourself
|
||||
|
||||
|
||||
> March 7, 2022
|
||||
>
|
||||
> I think the documentation is not very clear, wait for the time to update the full documentation of the use of tutorials
|
||||
> March 8, 2022
|
||||
>
|
||||
> May 29, 2022
|
||||
>
|
||||
> 1. updated the aws storage bucket detection feature
|
||||
>
|
||||
> 2. feel that the update is a bit slow, this is a busy time, in fact, the new local version is written, has not been push
|
||||
|
||||
**Using tutorial**: [Using tutorial](使用教程.md)
|
||||
|
||||
**Language**
|
||||
|
||||
English README: [English](README.en.md)
|
||||
|
||||
I want to write a storage bucket utilization, first draw a pie for myself
|
||||
|
||||
+ Aliyun Cloud (Aliyun Cloud Oss)
|
||||
+ Tencent Cloud COS
|
||||
+ Huawei Cloud OBS
|
||||
+ Huawei Cloud (HuaWei Cloud OBS)
|
||||
+ AWS (Amazon S3 Bucket)
|
||||
+ Azure (Azure Blob)
|
||||
+ GCP (Google Cloud Bucket)
|
||||
@ -19,14 +38,16 @@ If you think it works fine, you can raise an issue to give the tool a name? :sos
|
||||
|
||||
Not too good with Git, code writing also sucks, there are bugs directly mention Issue can (as if I may not even use issue to understand)
|
||||
|
||||
> good in the second master to my recommended GitHub Desktop second master YYDS
|
||||
> Good thing the second master recommended to me GitHub Desktop second master YYDS
|
||||
|
||||
2, AWS storage bucket use
|
||||
|
||||
# :pill:0x01 dependency
|
||||
|
||||
+ pip3 install oss2
|
||||
+ pip3 install colorlog
|
||||
+ pip3 install logging
|
||||
+ pip3 install argparse
|
||||
+ pip3 install boto3
|
||||
|
||||
# :gun:0x02 Usage
|
||||
|
||||
@ -41,37 +62,46 @@ Then write your own Aliyun AK in config/conf.py, the role is as follows
|
||||
|
||||
2, used to verify the legitimate user
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## 1. When storage bucket Policy permission is available
|
||||
|
||||
|
||||
|
||||
|
||||
## 2. When the storage bucket does not exist (automatically created and hijacked)
|
||||
|
||||
|
||||
## 3、Batch detection of storage bucket
|
||||
|
||||
|
||||
## 3、Batch detection of storage buckets
|
||||
|
||||
New detection function of batch storage bucket, recommend fofa to export all assets with one click
|
||||
|
||||
New detection function of batch storage bucket, recommend fofa to export all assets in one click
|
||||
**fofa**
|
||||
|
||||
```bash
|
||||
domain="aliyuncs.com"
|
||||
server="AliyunOSS"domain="aliyuncs.com" #This syntax is not recommended
|
||||
server="AliyunOSS" domain="aliyuncs.com" #This syntax is not recommended
|
||||
```
|
||||
|
||||
```bash
|
||||
python3 main.py -f filepath
|
||||
python3 main.py -f aws/aliyun filepath
|
||||
|
||||
# For example
|
||||
python3 main.py -f aws . /url.tx\\\\\\\``````````````````````````````````````````````````````````````````````````
|
||||
```
|
||||
Then just wait, the scan results will be in the results directory, the file name is the date of the day
|
||||
|
||||
|
||||
|
||||
Then just wait, the scan results will be in the results directory with the date of the day as the filename
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Only buckets that have permission to operate will be saved
|
||||
|
||||
Enter the storage bucket address to automatically detect, the function is as follows
|
||||
|
||||
|
||||
+ 1. Detect whether the current bucket can be hijacked
|
||||
Input the storage bucket address to detect automatically, the function is as follows
|
||||
|
||||
+ 1. detect whether the current bucket can be hijacked
|
||||
+ If it can be hijacked, automatically create a bucket with the same name on the AK account written in the config and open all permissions
|
||||
+ 2. detect whether the current bucket can list Object
|
||||
+ 3. Check if the current bucket can get ACL
|
||||
@ -79,26 +109,27 @@ Enter the storage bucket address to automatically detect, the function is as fol
|
||||
+ 5、Detect whether the bucket can upload Objects
|
||||
+ 6、Batch detection function
|
||||
|
||||
## 4, domain name detection function
|
||||
## 4、Domain name detection function
|
||||
|
||||
Many storage buckets have resolved the domain name, the new judgment of the CNAME of the domain name, and then take the CNAME to detect
|
||||
Many storage buckets have resolved the domain name, the new judgment of the domain name CNAME, and then take the CNAME to detect
|
||||
|
||||
**can now directly import a large number of domain name assets for detection, will automatically determine the CNAME of the domain name **
|
||||
** can now directly import a large number of domain name assets for detection, will automatically determine the CNAME of the domain name **
|
||||
|
||||
|
||||
|
||||
|
||||
# 0x03 Ali cloud storage bucket utilization
|
||||
|
||||
### 1、Implementation idea
|
||||
### 1、Implementation ideas
|
||||
|
||||
First implement the `OssBucketCheckFromSDK` class
|
||||
|
||||
+ AliyunOssBucketDoesBucketExist
|
||||
|
||||
+ AliyunOssBucketDoesBucketExist is used to determine whether the current storage bucket exists, first if the bucket exists then return a True, continue with the following process, if the bucket does not exist, then call the OssBucketExploitFromSDK class, create the bucket, and set ACL permissions, upload access policy, then upload a file for verification, if the bucket exists at this time or AccessDenied, continue with the following process
|
||||
+ AliyunOssBucketDoesBucketExist is used to determine whether the current bucket exists, first if the bucket exists then return a True, continue with the following process, if the bucket does not exist, then call the OssBucketExploitFromSDK class, create the bucket, and set ACL permissions, upload access policy, then upload a file for verification, if the bucket exists at this time or AccessDenied, continue with the following process
|
||||
|
||||
+ AliyunOssGetBucketObjectList
|
||||
|
||||
+ determine if the contents of the bucket can be traversed, if so, the first 3 contents will be selected for traversal and displayed
|
||||
+ determine if the contents of the bucket can be traversed, and if so, the first 3 contents will be selected for traversal and displayed
|
||||
|
||||
> If you want to iterate through more content, you can check the AliyunOssGetBucketObjectList method in aliyunOss.py
|
||||
|
||||
@ -114,22 +145,61 @@ First implement the `OssBucketCheckFromSDK` class
|
||||
|
||||
+ Try to upload a file, whether it can be successfully uploaded
|
||||
|
||||
# 0x04 Aws storage bucket utilization
|
||||
|
||||
```bash
|
||||
python3 main.py -aws xxxx
|
||||
```
|
||||
|
||||
|
||||
|
||||
# 0x05 Explanation of the results file after use
|
||||
|
||||
You can see the problematic bucket in the results directory
|
||||
|
||||
|
||||
|
||||
1, ListObject means the contents of the bucket can be listed
|
||||
|
||||
2、PutObject means that the bucket can upload any file
|
||||
|
||||
3、NoSuchBucket means the bucket can be taken over
|
||||
|
||||
4、GetBucketACL means you can get the ACL of the bucket
|
||||
|
||||
5、GetBucketPolicy means you can get the policy configuration of the bucket
|
||||
|
||||
# :older_man:0x040001 Update Log
|
||||
|
||||
**March 6, 2022**
|
||||
|
||||
+ Add batch scan function
|
||||
+ Fix the problem of Fake_UserAgent reporting errors
|
||||
+ Fix the Fake_UserAgent error reporting problem
|
||||
|
||||
> actually just delete this library, don't use it ^ ^
|
||||
|
||||
**March 7, 2022**
|
||||
|
||||
+ New Domain Name Detection
|
||||
+ Added domain detection
|
||||
|
||||
**May 29, 2022**
|
||||
|
||||
- Added AWS storage bucket scan
|
||||
|
||||
# :cop:0xffffffff Disclaimer
|
||||
|
||||
Disclaimers
|
||||
|
||||
1、This tool is only for academic exchange, it is forbidden to use the tool to do illegal things
|
||||
1、This tool is for academic exchange only, it is forbidden to use the tool to do illegal things
|
||||
|
||||
2, just writing for fun
|
||||
|
||||
3、My WeChat
|
||||
|
||||
> If you have a better suggestion or make a friend
|
||||
|
||||
|
||||
|
||||
# Curve chart
|
||||
|
||||
[](https://starchart.cc/UzJu/Cloud-Bucket-Leak-Detection-Tools)
|
||||
60
README.md
60
README.md
@ -1,9 +1,17 @@
|
||||
# :rooster:0x00 前言
|
||||
|
||||
|
||||
|
||||
> 2022年3月7日
|
||||
>
|
||||
> 我觉得文档写的还不是很清楚，等有空更新一下文档完整的使用教程
|
||||
> 2022年3月8日
|
||||
>
|
||||
> 2022年5月29日
|
||||
>
|
||||
> 1、更新了aws存储桶检测功能
|
||||
>
|
||||
> 2、感觉更新有些慢了，这段时间比较忙，其实本地的新版本写好了，一直没有push
|
||||
|
||||
**使用教程**: [使用教程](使用教程.md)
|
||||
|
||||
@ -32,11 +40,14 @@ English README: [English](README.en.md)
|
||||
|
||||
> 好在二爷给我推荐的GitHub Desktop 二爷YYDS
|
||||
|
||||
2、AWS存储桶利用
|
||||
|
||||
# :pill:0x01 依赖
|
||||
|
||||
+ pip3 install oss2
|
||||
+ pip3 install colorlog
|
||||
+ pip3 install argparse
|
||||
+ pip3 install boto3
|
||||
|
||||
# :gun:0x02 使用方法
|
||||
|
||||
@ -45,21 +56,21 @@ git clone https://github.com/UzJu/Cloud-Bucket-Leak-Detection-Tools.git
|
||||
python3 main.py -h
|
||||
```
|
||||
|
||||
随后在config/conf.py中写入自己的阿里云AK，作用如下
|
||||
随后在config/conf.py中写入自己的AK，作用如下
|
||||
|
||||
1、如果可以劫持，会用该AK创建同名的存储桶
|
||||
|
||||
2、用来验证合法用户
|
||||
|
||||
|
||||
|
||||
|
||||
## 1、当存储桶Policy权限可获取时
|
||||
|
||||
|
||||
|
||||
|
||||
## 2、当存储桶不存在时(自动创建并劫持)
|
||||
|
||||
|
||||
|
||||
|
||||
## 3、批量检测存储桶
|
||||
|
||||
@ -73,17 +84,20 @@ server="AliyunOSS"domain="aliyuncs.com" #不推荐该语法
|
||||
```
|
||||
|
||||
```bash
|
||||
python3 main.py -f filepath
|
||||
python3 main.py -f aws/aliyun filepath
|
||||
|
||||
# 例如
|
||||
python3 main.py -f aws ./url.tx\\\\\\\``````````````````````````````````````````````````````````````````````````
|
||||
```
|
||||
|
||||
随后等待即可，扫描结果会在results目录下，文件名为当天的日期
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
只会保存有权限操作的存储桶
|
||||
|
||||
|
||||
|
||||
输入存储桶地址即可自动检测，功能如下
|
||||
|
||||
@ -101,7 +115,7 @@ python3 main.py -f filepath
|
||||
|
||||
**现在可以直接导入大量域名资产来进行检测，会自动判断域名的CNAME**
|
||||
|
||||
|
||||
|
||||
|
||||
# 0x03 阿里云存储桶利用
|
||||
|
||||
@ -131,7 +145,29 @@ python3 main.py -f filepath
|
||||
|
||||
+ 尝试上传一个文件，是否可以成功上传
|
||||
|
||||
# 0x04 Aws存储桶利用
|
||||
|
||||
```bash
|
||||
python3 main.py -aws xxxx
|
||||
```
|
||||
|
||||
|
||||
|
||||
# 0x05 利用后results文件解释
|
||||
|
||||
在results目录下可以看到存在问题的存储桶
|
||||
|
||||
|
||||
|
||||
1、ListObject 代表该存储桶的内容可以列出来
|
||||
|
||||
2、PutObject 代表该存储桶可以上传任意的文件
|
||||
|
||||
3、NoSuchBucket 代表该存储桶可以接管
|
||||
|
||||
4、GetBucketACL 代表可以获取该存储桶的ACL
|
||||
|
||||
5、GetBucketPolicy 代表可以获取该存储桶的策略配置
|
||||
|
||||
# :older_man:0x040001 更新日志
|
||||
|
||||
@ -146,6 +182,10 @@ python3 main.py -f filepath
|
||||
|
||||
+ 新增域名检测
|
||||
|
||||
**2022年5月29日**
|
||||
|
||||
- 新增AWS存储桶扫描
|
||||
|
||||
# :cop:0xffffffff 免责声明
|
||||
|
||||
免责声明
|
||||
@ -158,7 +198,7 @@ python3 main.py -f filepath
|
||||
|
||||
> 如果你有更好的建议或者交个朋友
|
||||
|
||||
|
||||
|
||||
|
||||
# 曲线图
|
||||
|
||||
|
||||
@ -12,6 +12,11 @@
|
||||
# headers = {
|
||||
# "UserAgent": UA.random
|
||||
# }
|
||||
import os
|
||||
import datetime
|
||||
import csv
|
||||
|
||||
NowTime = datetime.datetime.now().strftime('%Y-%m-%d')
|
||||
"""
|
||||
2022年3月6日 16:55
|
||||
部分用户反馈该库存在报错的问题，故此目前删除该库
|
||||
@ -19,6 +24,27 @@
|
||||
现在实现的方式是直接调SDK所以不需要这个Fake_useragent了
|
||||
"""
|
||||
|
||||
# aliyun
|
||||
AliyunAccessKey_ID = ""
|
||||
AliyunAccessKey_Secret = ""
|
||||
|
||||
# aws
|
||||
AWS_ACCESS_KEY = ''
|
||||
AWS_SECRET_KEY = ''
|
||||
|
||||
|
||||
def save_results(target, info):
|
||||
headers = ['存储桶地址', '权限']
|
||||
filepath = f'{os.getcwd()}/results/{NowTime}.csv'
|
||||
rows = [
|
||||
[f"{target}", info]
|
||||
]
|
||||
if not os.path.isfile(filepath):
|
||||
with open(filepath, 'a+', newline='') as f:
|
||||
f = csv.writer(f)
|
||||
f.writerow(headers)
|
||||
f.writerows(rows)
|
||||
else:
|
||||
with open(filepath, 'a+', newline='') as f:
|
||||
f_csv = csv.writer(f)
|
||||
f_csv.writerows(rows)
|
||||
|
||||
121
core/AmazoneCloudS3Bucket.py
Normal file
121
core/AmazoneCloudS3Bucket.py
Normal file
@ -0,0 +1,121 @@
|
||||
#!/usr/bin/python3.8.4 (python版本)
|
||||
# -*- coding: utf-8 -*-
|
||||
# @Author : UzJu@菜菜狗
|
||||
# @Email : UzJuer@163.com
|
||||
# @Software: PyCharm
|
||||
# @Time : 2022/4/7 15:33
|
||||
# @File : AmazoneCloudS3Bucket.py
|
||||
import botocore
|
||||
from boto3.session import Session
|
||||
import boto3
|
||||
from config import conf
|
||||
import logging
|
||||
import datetime
|
||||
|
||||
module_logger = logging.getLogger("mainModule.AmazoneCloudS3Bucket")
|
||||
NowTime = datetime.datetime.now().strftime('%Y-%m-%d')
|
||||
|
||||
|
||||
class AwsCloudS3Check:
|
||||
def __init__(self, BucketName, BucketDomain):
|
||||
'''
|
||||
bucketName: 只取Bucket名字
|
||||
BucketDomain: Bucket完整域名
|
||||
'''
|
||||
self.getBucketName = BucketName
|
||||
self.getBucketDomain = BucketDomain
|
||||
|
||||
'''
|
||||
Boto3 Session 和 Client
|
||||
'''
|
||||
session = Session(aws_access_key_id=conf.AWS_ACCESS_KEY,
|
||||
aws_secret_access_key=conf.AWS_SECRET_KEY)
|
||||
self.s3 = session.client('s3')
|
||||
|
||||
'''
|
||||
为了解决boto3 Clinet中没有resource的问题
|
||||
因为如果使用client, 在调用CheckBucketListObject的时候, 会提示没有Object
|
||||
'''
|
||||
self.s3_resource = session.resource('s3')
|
||||
'''
|
||||
Logger
|
||||
'''
|
||||
self.logger = logging.getLogger("mainModule.AmazoneCloudS3Bucket.Check.module")
|
||||
|
||||
'''
|
||||
results_list 返回给CSV的列表
|
||||
'''
|
||||
self.results_list = []
|
||||
|
||||
def CheckBucketListObject(self):
|
||||
try:
|
||||
getObjectList = self.s3_resource.Bucket(self.getBucketName)
|
||||
for getObject in getObjectList.objects.all():
|
||||
self.logger.info(f"List Bucket Object > {getObject.key}")
|
||||
self.results_list.append("ListObject")
|
||||
break
|
||||
except Exception as e:
|
||||
'''
|
||||
这里为什么要加判断
|
||||
NoSuchBucket的报错是这样的botocore.errorfactory.NoSuchBucket
|
||||
但是不知道为什么这边调不到这个方法，所以干脆直接判断字符
|
||||
'''
|
||||
if "NoSuchBucket" in str(e):
|
||||
self.logger.info("NoSuchBucket")
|
||||
self.results_list.append("NoSuchBucket")
|
||||
else:
|
||||
self.logger.error(e)
|
||||
|
||||
def CheckBucketPutObject(self):
|
||||
try:
|
||||
'''
|
||||
下面为什么要把对象的元数据设置为text/html，原因是因为默认上传文件之后，元数据为binary/octet-stream，当元数据为binary/octet-stream的时候，访问HTML文件
|
||||
会直接下载该文件，修改为text/html之后，我们访问xxxx/UzJu.html的时候，会像访问静态网站一样访问这个对象
|
||||
'''
|
||||
self.s3_resource.Object(self.getBucketName, "UzJu.html").put(
|
||||
Body="Put By https://github.com/UzJu/Cloud-Bucket-Leak-Detection-Tools.git",
|
||||
ContentType='text/html')
|
||||
self.logger.info(f"Put File Success > {self.getBucketDomain}/UzJu.html")
|
||||
self.results_list.append("PutObject")
|
||||
except Exception as e:
|
||||
self.logger.error(e)
|
||||
|
||||
def CheckBucketAcl(self):
|
||||
try:
|
||||
response = self.s3.get_bucket_acl(Bucket=self.getBucketName)
|
||||
self.logger.info(f"Get Bucket Acl Success > {response}")
|
||||
self.results_list.append("GetBucketAcl")
|
||||
except Exception as e:
|
||||
self.logger.error(repr(e))
|
||||
|
||||
def CheckNoSuchBucket(self):
|
||||
'''
|
||||
这里主要是用来确认，如果上面的那些方法报错了，显示NoSuchBucket的话，就证明该存储桶是可以接管的
|
||||
但是这里不会自动取创建一个存储桶去接管，而只是提示可以接管
|
||||
'''
|
||||
try:
|
||||
pass
|
||||
except Exception as e:
|
||||
self.logger.error(repr(e))
|
||||
|
||||
def CheckResult(self):
|
||||
return self.results_list
|
||||
|
||||
def test(self):
|
||||
pass
|
||||
|
||||
|
||||
def CheckBucket(BucketName, BucketDomain):
|
||||
'''
|
||||
BucketName: 取下标后的存储桶名
|
||||
BucketDomain: 完整的存储桶地址
|
||||
'''
|
||||
run = AwsCloudS3Check(BucketName, BucketDomain)
|
||||
run.CheckBucketListObject()
|
||||
run.CheckBucketPutObject()
|
||||
run.CheckBucketAcl()
|
||||
if not run.CheckResult():
|
||||
pass
|
||||
else:
|
||||
conf.save_results(BucketDomain, run.CheckResult())
|
||||
module_logger.info(">" * 80)
|
||||
@ -18,30 +18,13 @@ import json
|
||||
from config import conf
|
||||
import logging
|
||||
import os
|
||||
import csv
|
||||
import datetime
|
||||
|
||||
|
||||
module_logger = logging.getLogger("mainModule.AliyunOss")
|
||||
NowTime = datetime.datetime.now().strftime('%Y-%m-%d')
|
||||
|
||||
|
||||
def results(target, info):
|
||||
headers = ['存储桶地址', '权限']
|
||||
filepath = f'{os.getcwd()}/results/{NowTime}.csv'
|
||||
rows = [
|
||||
[f"{target}", info]
|
||||
]
|
||||
if not os.path.isfile(filepath):
|
||||
with open(filepath, 'a+', newline='') as f:
|
||||
f = csv.writer(f)
|
||||
f.writerow(headers)
|
||||
f.writerows(rows)
|
||||
else:
|
||||
with open(filepath, 'a+', newline='') as f:
|
||||
f_csv = csv.writer(f)
|
||||
f_csv.writerows(rows)
|
||||
|
||||
|
||||
class OssBucketExploitFromSDK:
|
||||
def __init__(self, target, location):
|
||||
self.target = target
|
||||
@ -209,7 +192,7 @@ def CheckBucket(target, location):
|
||||
if not check.CheckResult():
|
||||
pass
|
||||
else:
|
||||
results(f"{target}.{location}.aliyuncs.com", check.CheckResult())
|
||||
conf.save_results(f"{target}.{location}.aliyuncs.com", check.CheckResult())
|
||||
module_logger.info(">" * 80)
|
||||
except Exception as e:
|
||||
module_logger.error(f"Target: {target} Chceck Faild:( {e}")
|
||||
|
||||
BIN
images/156925718-9a3dc236-0ef6-4afa-8d26-a2946fe876b2.png
Normal file
BIN
images/156925718-9a3dc236-0ef6-4afa-8d26-a2946fe876b2.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 444 KiB |
BIN
images/156925744-3c012b86-6449-4cf1-a790-b2c1282f76bd.png
Normal file
BIN
images/156925744-3c012b86-6449-4cf1-a790-b2c1282f76bd.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.2 MiB |
BIN
images/156925758-36a8fcba-8bc8-4d1a-8863-d8110dbe0b71.png
Normal file
BIN
images/156925758-36a8fcba-8bc8-4d1a-8863-d8110dbe0b71.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.3 MiB |
BIN
images/156925766-15d415d3-d573-4b54-ab0f-5c79bc1966ad.png
Normal file
BIN
images/156925766-15d415d3-d573-4b54-ab0f-5c79bc1966ad.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 353 KiB |
BIN
images/157070417-dbb7886f-1bb8-412f-a30b-0f85bc8ffa10.png
Normal file
BIN
images/157070417-dbb7886f-1bb8-412f-a30b-0f85bc8ffa10.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 190 KiB |
BIN
images/UzJuMarkDownImageimage-20220304184757595.png
Normal file
BIN
images/UzJuMarkDownImageimage-20220304184757595.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 81 KiB |
BIN
images/UzJuMarkDownImageimage-20220304185015693.png
Normal file
BIN
images/UzJuMarkDownImageimage-20220304185015693.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 288 KiB |
BIN
images/UzJuMarkDownImageimage-20220307231827585.png
Normal file
BIN
images/UzJuMarkDownImageimage-20220307231827585.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 343 KiB |
BIN
images/image-20220529094124272.png
Normal file
BIN
images/image-20220529094124272.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 494 KiB |
BIN
images/image-20220529132925098.png
Normal file
BIN
images/image-20220529132925098.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 4.8 MiB |
BIN
images/image-20220529134339645.png
Normal file
BIN
images/image-20220529134339645.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 304 KiB |
49
main.py
49
main.py
@ -17,6 +17,7 @@ import requests
|
||||
import argparse
|
||||
from core import aliyunOss
|
||||
from core import DnsResolution
|
||||
from core import AmazoneCloudS3Bucket
|
||||
|
||||
NowTime = datetime.datetime.now().strftime('%Y-%m-%d')
|
||||
|
||||
@ -86,9 +87,13 @@ if __name__ == '__main__':
|
||||
try:
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('-aliyun', dest='aliyun', help='python3 -aliyun UzJu.oss-cn-beijing.aliyuncs.com')
|
||||
parser.add_argument('-f', '--file', dest='file', help='python3 -f/--file url.txt')
|
||||
parser.add_argument('-aws', dest='aws', help='python3 -aws UzJu.oss-cn-beijing.aliyuncs.com')
|
||||
parser.add_argument('-f', '--file', dest='file', nargs='+', help='python3 -f/--file url.txt')
|
||||
args = parser.parse_args()
|
||||
|
||||
'''
|
||||
阿里云OSS模块
|
||||
'''
|
||||
if args.aliyun:
|
||||
existDomain = DnsResolution.GetDomainDnsResolution(args.aliyun)
|
||||
if existDomain:
|
||||
@ -96,14 +101,42 @@ if __name__ == '__main__':
|
||||
else:
|
||||
getTargetBucket = args.aliyun.split(".")
|
||||
aliyunOss.CheckBucket(getTargetBucket[0], getTargetBucket[1])
|
||||
'''
|
||||
aws S3模块
|
||||
'''
|
||||
if args.aws:
|
||||
'''
|
||||
这里本来是这样写的
|
||||
bucketDomain = args.aws.split(".")
|
||||
但是在Fofa中找资产测试发现一个问题，如果这样写，举个例子
|
||||
xxx.xxx.cdn.s3.amazonaws.com
|
||||
这种存储桶地址就会取出来
|
||||
['xxx', 'xxx', 'cdn', 's3', 'amazonaws', 'com']
|
||||
一般情况下，都能正常取下标来判断xxx就是存储桶名字，但是这里不一样，这里xxx.xxx.cdn都是存储桶的名字，这样取就会存在问题
|
||||
|
||||
bucketDomain = args.aws.split(".s3")
|
||||
这种写法能解决上述的问题，为什么？
|
||||
我们简单分析一下存储桶的地址构造
|
||||
xxx.xxx.xxcdn.s3.amazonaws.com
|
||||
xxx.xxx.xxcdn.s3.us-east-1.amazonaws.com
|
||||
无非就是存储桶名+s3+地区+云厂商的域名 或者 存储桶名+s3+云厂商域名，这里可以用来分割的字段，.s3再适合不过了
|
||||
'''
|
||||
bucketDomain = args.aws.split(".s3")
|
||||
AmazoneCloudS3Bucket.CheckBucket(bucketDomain[0], args.aws)
|
||||
if args.file:
|
||||
with open(args.file, 'r') as f:
|
||||
with open(args.file[1], 'r') as f:
|
||||
for i in f.read().splitlines():
|
||||
existDomain = DnsResolution.GetDomainDnsResolution(i)
|
||||
if existDomain:
|
||||
aliyunOss.CheckBucket(existDomain.split(".")[0], existDomain.split(".")[1])
|
||||
else:
|
||||
getTargetBucket = i.split(".")
|
||||
aliyunOss.CheckBucket(getTargetBucket[0], getTargetBucket[1])
|
||||
|
||||
if args.file[0] == "aliyun":
|
||||
existDomain = DnsResolution.GetDomainDnsResolution(i)
|
||||
if existDomain:
|
||||
aliyunOss.CheckBucket(existDomain.split(".")[0], existDomain.split(".")[1])
|
||||
else:
|
||||
getTargetBucket = i.split(".")
|
||||
aliyunOss.CheckBucket(getTargetBucket[0], getTargetBucket[1])
|
||||
|
||||
elif args.file[0] == "aws":
|
||||
bucketDomain = i.split(".s3")
|
||||
AmazoneCloudS3Bucket.CheckBucket(bucketDomain[0], i)
|
||||
except KeyboardInterrupt:
|
||||
logger.error("KeyError Out")
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user