Python实现Awvs自动化扫描

#coding:UTF-8

import subprocess

import os,time,shutil,sys

import win32com.client

import MySQLdb

import re,hashlib

reload(sys)

sys.setdefaultencoding('utf-8')

#需要先在win服务器设置odbc源，指向access文件。实际用pyodbc模块可能更好一些

def writeinmysql():

conn = win32com.client.Dispatch(r'ADODB.Connection')

DSN = 'PROVIDER=Microsoft Access Driver (*.mdb, *.accdb)'

conn.Open('awvs')

cur=conn.cursor()

rs = win32com.client.Dispatch(r'ADODB.Recordset')

rs.Open('[WVS_alerts]', conn, 1, 3)

if rs.recordcount == 0:

exit()

#遍历所有的结果，cmp进行筛选危害等级为3的，也就是高危

while not rs.eof:

severity = str(rs('severity'))

if cmp('3', severity):

rs.movenext

continue

vultype = rs('algroup')

vulfile=rs('affects')

#由于mysql库中要求的漏洞类型和access的名称有点差别，所以还需要对漏洞类型和危害等级进行二次命名,sql注入和xss为例

xss='Cross site'

sqlinject='injection'

if xss in str(vultype):

vultype='XSS'

level='低危'

elif sqlinject in str(vultype):

vultype="SQL注入"

level='高危'

else:

level='中危'

#拼凑出漏洞测试url，用了正则表达式， post和get类型的request请求是不同的

params = rs('parameter')

ss = str(rs('request'))

str1 = ss[0:4]

if 'POST'== str1:

requestType = 'POST'

regex = 'POST (.*?) HTTP/1\.\d+'

str1 = re.findall(regex, ss);

else:

requestType = 'GET'

regex = 'GET (.*?) HTTP/1\.\d+'

str1 = re.findall(regex, ss);

regex = 'Host:(.*?)\r\n'

host = re.findall(regex, ss);

if host == []:

host = ''

else:

host = host[0].strip()

if str1 == []:

str1 = ''

else:

str1 = str1[0]

url =host + str1

timex=time.strftime('%Y-%m-%d',time.localtime(time.time()))

status=0

scanner='Awvs'

comment=''

db = MySQLdb.connect(host="10.1.1.1", user="root", passwd="12345678", db="wvsdb",charset='utf8')

cursor = db.cursor()

sql = 'insert into vuls(status,comment,vultype,url,host,params,level,scanner) values(%s,%s,%s,%s,%s,%s,%s,%s)'

values =[status,comment,vultype,'http://'+url.lstrip(),host,params,level,scanner]

#入库的时候又进行了去重，确保mysql库中没有存在该条漏洞记录，跟本地保存的vulhash进行比对，感觉这种方法很原始。

hashvalue=str(values[2])+str(values[4])+str(vulfile)+str(values[5])

vulhash=hashlib.new('md5',hashvalue).hexdigest()

vulhash=vulhash+'\n'

file=open(r'D:\Wvscan\vulhash.txt','a+')

if vulhash in file.readlines():

pass

else:

file.write(vulhash+'\n')

cursor.execute(sql, values)

delsql='delete from vuls where vultype like %s or vultype like %s'

delvaluea='Slow HTTP%'

delvalueb='Host header%'

delinfo=[delvaluea,delvalueb]

cursor.execute(delsql,delinfo)

db.commit()

rs.movenext

rs.close

conn.close

cursor.close()

db.close()

if __name_=='__main__':

writeinmysql()

time.sleep(10)

#备份每天的扫描数据库，用原始数据库替换，方便第二天继续保存。

datanow=time.strftime('%Y-%m-%d',time.localtime(time.time()))

filetype='.mdb'

urlfilename=datanow+filetype

path="D:\wvscan\databak\\"

databakfile=path+urlfilename

shutil.copyfile(r'D:\Wvscan\data\vulnscanresults.mdb',databakfile)

shutil.copyfile(r'D:\Wvscan\vulnscanresults.mdb',r'D:\Wvscan\data\vulnscanresults.mdb')