svn信息泄漏探测工具(新手学python)

import sys

import httplib2

if len(sys.argv)<2:

print 'Usag:'+"svnscan.py"+" host"

sys.exit()

#判断输入url是否是http开头

if sys.argv[1].startswith('http://'):

host=sys.argv[1]

else:

host="http://"+sys.argv[1]

#访问一个不存在的目录，将返回的status和content-length做为特征

status=''

contentLen=''

http=httplib2.Http()

dirconurl=host+'/nodirinthiswebanx4dm1n/'

dirresponse=http.request(dirconurl,'GET')

status=dirresponse[0].status

contentLen=dirresponse[0].get('content-length')

#字典中保存svn的常见目录，逐个访问和特征status、content-length进行比对

f=open(r'e:\svnpath.txt','r')

pathlist=f.readlines()

def svnscan(subpath):

for svnpath in pathlist:

svnurl=host+svnpath.strip('\r\n')

response=http.request(svnurl,'GET')

if response[0].status!=status and response[0].get('content-length')!=contentLen:

print "vuln:"+svnurl

if __name__=='__main__':

svnscan(host)

f.close()