一段扫flash跨站的脚本

#!/usr/bin/php -q
<?php

/*——————————–xy7@80sec.com—————————-
#Flash文件跨站检测脚本 2010/6/3
#检测过程如下:
提取ExternalInterface.call调用的参数,检查参数是都是直接通过loaderInfo.parameters获取
#使用方法
./scan.php /as代码目录>log
———————————-xy7@80sec.com—————————*/

set_time_limit(0);

function find($directory)
{
$mydir=dir($directory);
while($file=$mydir->read()){
if((is_dir(“$directory/$file”))&&($file!=”.”)&&($file!=”..”))
{
find(“$directory/$file”);
}
else{
if($file != “.” && $file != “..”&&eregi(“.as”,$file)){
$fd=realpath($directory.”/”.$file);
$fp = fopen($fd, “r”);
$i=0;
while ($buffer = fgets($fp, 128)) {
$i++;
if(eregi(“ExternalInterface.call”,$buffer))
{
echo “Line”.$i.”:”.$buffer.”\r\n\r\n”;
preg_match(“/\((.*)\)/i”, $buffer, $match);
if (strstr($match[1],”(“))
{
preg_match(“/\((.*)\)/i”, $match[1], $newmatch);
echo “再次提取后参数包含 :”.$newmatch[1].”\r\n\r\n”;
$oldfp = ftell($fp);
fseek($fp, 0);
$p = 0;
while ($newbuffer = fgets($fp, 128))
{
$p++;
if(eregi(“loaderInfo.parameters”,$newbuffer))
{
//echo “Line”.$p.”:”.$newbuffer.”\r\n”;
if (strstr($newbuffer,$newmatch[1]))
{
echo $newmatch[1].”存在漏洞\r\n\r\n”;

}
}
}
fseek($fp, $oldfp);
unset($oldfp);
} elseif(strstr($match[1],”,”))
{
echo “多个参数:$match[1]\r\n”;
if (strstr($match[1],”loaderInfo.parameters”)){
echo $match[1].”直接调用loaderInfo.parameters传递存在漏洞\r\n\r\n”;
}
$var_array = array();
$var_array = explode(“,”,$match[1]);
$oldfp = ftell($fp);
fseek($fp,0);
while ($newbuffer = fgets($fp, 128))
{
if(eregi(“loaderInfo.parameters”,$newbuffer))
{
//echo “Line”.$p.”:”.$newbuffer.”\r\n\r\n”;
foreach ($var_array as $value)
{
if (strstr($newbuffer,$value))
{
echo trim($value).”存在漏洞\r\n\r\n”;
}

}

}
}
fseek($fp, $oldfp);
unset($oldfp);
}else
{
echo “唯一参数:”.$match[1].”\r\n”;
if (strstr($match[1],”loaderInfo.parameters”)){
echo $match[1].”直接调用loaderInfo.parameters传递存在漏洞\r\n\r\n”;
}
$oldfp = ftell($fp);
fseek($fp,0);
while ($newbuffer = fgets($fp, 128))
{
if(eregi(“loaderInfo.parameters”,$newbuffer))
{
//echo “Line”.$p.”:”.$newbuffer.”\r\n\r\n”;
if (strstr($newbuffer,$match[1]))
{
echo trim($match[1]).”存在漏洞\r\n\r\n”;
}
}
}
fseek($fp, $oldfp);
unset($oldfp);
}
}
}
fclose($fp);

}
}
}
$mydir->close();
}
function all()
{
static $count = 1;
echo $count;
$count++;
}
find($argv[1]);
?>

from:http://hackeye.com/post/6562.html

发表评论

电子邮件地址不会被公开。

您可以使用这些HTML标签和属性: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>