漏洞挖掘fofa+xray

import requests import json import re import os import time import base64 def load_config(): try: os.mkdir('result') except: pass with open('config.ini', 'r') as f: config=f.readlines() if len(config)!=2: print('请先正确配置好fofa API的key和email') exit() return config def input_keyword(): print('先确保你已经在config.ini配置好fofa的api参数\n每个url的检测报告会实时输出到/result目录下\n微信公众号：台下言书') string=input("请输入fofa关键字:\n") a = base64.b64encode(string.encode()) size=input('API获取的条数：\n') keyword=str(a,encoding="utf8") return keyword,size def API(config,keyword,size): url='https://fofa.so/api/v1/search/all?email={}&key={}&qbase64={}&size={}'.format(config[0].replace('\n',''),config[1],keyword,size) print('获取资产中...') try: response = requests.get(url) # 获取网页源代码内容 response.raise_for_status() # 失败请求(非200响应)抛出异常 response.encoding = "utf-8" # 设置网页编码 fofa_data = response.text return fofa_data except: print('请求错误，请检查网络情况！') def get_urls(fofa_json): a = fofa_json['results'] for b in a: c = b[0] if re.findall('http', c) == []: c = 'http://' + c urls.append(c) def xray(urls): print('开始扫描...') for url in urls: name = url.replace('https://', '').replace('http://', '').replace('/', '').replace('\n', '').replace(':', '-') cmd = 'powershell .\\xray.exe webscan --basic-crawler {0}/ --html-output {1}.html'.format(url.replace('\n', ''), 'result/' + name) os.system(cmd.replace('\n', '')) time.sleep(10) urls=[] config=load_config() aaa=input_keyword() keyword=aaa[0] size=aaa[1] fofa_json=json.loads(API(config,keyword,size)) get_urls(fofa_json) xray(urls)