在安全测试时,安全测试人员信息收集中时可使用它进行目录枚举,目录进行指纹识别,枚举出来的403状态目录可尝试进行绕过,绕过403有可能获取管理员权限。不影响dirsearch原本功能使用
dirsearch进行目录扫描--->将所有403状态的目录进行保存-->是否进行jsfind-->是(进行js爬取url和域名,将爬取到的url进行状态码识别如果是403状态则进行保存)-->进行403绕过-->目录进行指纹识别
![image](https://private-user-images.githubusercontent.com/56328995/237891036-db2d9226-4b0f-4d37-9501-6c24eef8c7b2.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQxMzA1NjMsIm5iZiI6MTcyNDEzMDI2MywicGF0aCI6Ii81NjMyODk5NS8yMzc4OTEwMzYtZGIyZDkyMjYtNGIwZi00ZDM3LTk1MDEtNmMyNGVlZjhjN2IyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIwVDA1MDQyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWYxYjllODhiNWJmYzE0YTUyMjg4ZjUxY2RlNTMyODljZDEyY2Y3ZDgzMDU4ZjhkNTIxMzY1YmQzNTk3MWIzNjMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.VKaD7JB1ycYlgC7aVldOFvX-WElkafKKCpCw16cLVD0)
https://www.bilibili.com/video/BV1J14y1k7o3/
默认不启用jsfind和403bypass
403bypass : -b yes
python dirsearch.py -u "http://www.xxx.com/" -b yes
jsfind :-j yes
python dirsearch.py -u "http://www.xxx.com/" -j yes
jsfind和403bypass : -b yes -j yes
python dirsearch.py -u "http://www.xxx.com/" -j yes -b yes
单独对指定目录进行bypass
python single_403pass.py -u "http://www.xxx.com/" -p "/index.php" # -p 指定路径
对扫描出来的目录进行指纹识别(结果会自动保存在reports目录下的.josn文件中)
python dirsearch.py -u "http://www.xxx.com/" -z yes
增加页面长度一样的无效结果进行过滤输出
是否进行jsfind查找js中的url,在网站的js文件中提取URl,排除(如png、gif)的URL,将403状态码的url进行403bypass
优化原版403bypasser,单独对某一指定路径进行403bypass
昨天同事在使用时遇到问题:发现一个403页面,如果运行dirsearch则会目录扫描后再403bypass
single_403pass.py 单独对一个url指定路径进行403bypass
python single_403pass.py -u "http://www.xxx.com/" -p "/index.php" # -p 指定路径
![image](https://private-user-images.githubusercontent.com/56328995/237587944-6698201c-734d-411a-92ba-379da6f4c5f0.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQxMzA1NjMsIm5iZiI6MTcyNDEzMDI2MywicGF0aCI6Ii81NjMyODk5NS8yMzc1ODc5NDQtNjY5ODIwMWMtNzM0ZC00MTFhLTkyYmEtMzc5ZGE2ZjRjNWYwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIwVDA1MDQyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWZjZjkwMjgxYzQ2ODdkZWExZTkxOGFiNjFjODIyMGQ3MjEyY2UwOWQ2MGIzYmRlODE4ZTUzNmJlODQyMjE4YzMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.cQk-ki7F8Yq6SaD8hlBmnOVjCStMRMe1x1kQ2Hb38Do)
对目录进行指纹识别(结果会自动保存在reports目录下的.josn文件中)
python dirsearch.py -u "http://www.xxx.com/" -z yes
![image](https://private-user-images.githubusercontent.com/56328995/237900141-2a6d5ad8-81cd-4408-b6c9-860d2e153ad9.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQxMzA1NjMsIm5iZiI6MTcyNDEzMDI2MywicGF0aCI6Ii81NjMyODk5NS8yMzc5MDAxNDEtMmE2ZDVhZDgtODFjZC00NDA4LWI2YzktODYwZDJlMTUzYWQ5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIwVDA1MDQyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTViOGIwZTM5MDc5ZDdjMmZhMDA4NTYxNjdmODk0YzdkYTdkMWU5ZmJjY2U3ODFmOGZhOGM0MGFhNGNlNGRmYTImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.l5Fl46Tad6d6EjOI2AW5WmsC4WWbEg7XMsauNphMT9E)
对404状态码和0B数据进行过滤不进行指纹识别
实验环境:https://portswigger.net/web-security/access-control/lab-url-based-access-control-can-be-circumvented
优化403bypass:与首页大小进行判断 如果size相同则表示绕过失败
增加了一点403bypass绕过方式
![image](https://private-user-images.githubusercontent.com/56328995/264973165-b9075d68-85f7-439b-886d-3748978b9962.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQxMzA1NjMsIm5iZiI6MTcyNDEzMDI2MywicGF0aCI6Ii81NjMyODk5NS8yNjQ5NzMxNjUtYjkwNzVkNjgtODVmNy00MzliLTg4NmQtMzc0ODk3OGI5OTYyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIwVDA1MDQyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTgxOWFhNTNiNmM4MmEzMjAwMmUyMTk5MGNiODkyMGI1MmUyMzU1NmQ4Yzk2NTgzYTI4NGRjY2FmMTc1MDQ4MzMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.y5CYGjRZaYdc9r3trqMJ-8yznFc9CWm0JvAICLf13A8)
![image](https://private-user-images.githubusercontent.com/56328995/264973800-933ac6e9-13a8-4a66-8ac2-52192c83b08a.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQxMzA1NjMsIm5iZiI6MTcyNDEzMDI2MywicGF0aCI6Ii81NjMyODk5NS8yNjQ5NzM4MDAtOTMzYWM2ZTktMTNhOC00YTY2LThhYzItNTIxOTJjODNiMDhhLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIwVDA1MDQyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTZkMzI0YzM4NDU0MTc4ZjUxYjlkOTEzOTI3YTExYmIxYjNhMTMxZjc3MjAxNzAwZmViYmI4ZjlkZTU0NWVhZjUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.cIGBctq5cNA6BI5s9xH6BhG1CdUS5FZEdb7E5h7gN2o)
![image](https://private-user-images.githubusercontent.com/56328995/264974175-5b2185c6-6680-4225-ab64-de8cde667791.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQxMzA1NjMsIm5iZiI6MTcyNDEzMDI2MywicGF0aCI6Ii81NjMyODk5NS8yNjQ5NzQxNzUtNWIyMTg1YzYtNjY4MC00MjI1LWFiNjQtZGU4Y2RlNjY3NzkxLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIwVDA1MDQyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWQ3MGI1N2Q1ZTIyYmRhNmY5Yzk4YWU1Yjc3ZGRhZWNjYjQ4NzNlODJlZTNmNTg0MWUzODFjYjllNDljOTRmNzMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.ayIXiRNkHqMFihgcjMzGFN1MsRD4DtERiOQKVNHhaLM)
dirsearch:https://github.com/maurosoria/dirsearch
403bypasser:https://github.com/yunemse48/403bypasser
JSFinder:https://github.com/Threezh1/JSFinder