一段扫flash跨站的脚本
作者：xy7
没啥技术含量，主要是扫ExternalInterface.call
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 | #!/usr/bin/php -q <?php /*--------------------------------xy7@80sec.com---------------------------- #Flash文件跨站检测脚本 2010/6/3 #检测过程如下: 提取ExternalInterface.call调用的参数，检查参数是都是直接通过loaderInfo.parameters获取 #使用方法 ./scan.php /as代码目录>log ----------------------------------xy7@80sec.com---------------------------*/ set_time_limit(0); function find($directory) { $mydir=dir($directory); while($file=$mydir->read()){ if((is_dir("$directory/$file"))&&($file!=".")&&($file!="..")) { find("$directory/$file"); } else{ if($file != "." && $file != ".."&&eregi(".as",$file)){ $fd=realpath($directory."/".$file); $fp = fopen($fd, "r"); $i=0; while ($buffer = fgets($fp, 128)) { $i++; if(eregi("ExternalInterface.call",$buffer)) { echo "Line".$i.":".$buffer."\r\n\r\n"; preg_match("/\((.*)\)/i", $buffer, $match); if (strstr($match[1],"(")) { preg_match("/\((.*)\)/i", $match[1], $newmatch); echo "再次提取后参数包含 :".$newmatch[1]."\r\n\r\n"; $oldfp = ftell($fp); fseek($fp, 0); $p = 0; while ($newbuffer = fgets($fp, 128)) { $p++; if(eregi("loaderInfo.parameters",$newbuffer)) { //echo "Line".$p.":".$newbuffer."\r\n"; if (strstr($newbuffer,$newmatch[1])) { echo $newmatch[1]."存在漏洞\r\n\r\n"; } } } fseek($fp, $oldfp); unset($oldfp); } elseif(strstr($match[1],",")) { echo "多个参数:$match[1]\r\n"; if (strstr($match[1],"loaderInfo.parameters")){ echo $match[1]."直接调用loaderInfo.parameters传递存在漏洞\r\n\r\n"; } $var_array = array(); $var_array = explode(",",$match[1]); $oldfp = ftell($fp); fseek($fp,0); while ($newbuffer = fgets($fp, 128)) { if(eregi("loaderInfo.parameters",$newbuffer)) { //echo "Line".$p.":".$newbuffer."\r\n\r\n"; foreach ($var_array as $value) { if (strstr($newbuffer,$value)) { echo trim($value)."存在漏洞\r\n\r\n"; } } } } fseek($fp, $oldfp); unset($oldfp); }else { echo "唯一参数:".$match[1]."\r\n"; if (strstr($match[1],"loaderInfo.parameters")){ echo $match[1]."直接调用loaderInfo.parameters传递存在漏洞\r\n\r\n"; } $oldfp = ftell($fp); fseek($fp,0); while ($newbuffer = fgets($fp, 128)) { if(eregi("loaderInfo.parameters",$newbuffer)) { //echo "Line".$p.":".$newbuffer."\r\n\r\n"; if (strstr($newbuffer,$match[1])) { echo trim($match[1])."存在漏洞\r\n\r\n"; } } } fseek($fp, $oldfp); unset($oldfp); } } } fclose($fp); } } } $mydir->close(); } function all() { static $count = 1; echo $count; $count++; } find($argv[1]); ?> |
