Web SurvivalScan

By AabyssZG && jingyuxing

✈️ 1. Tool Overview

During the penetration test process of daily work, penetration testing projects are often encountered, and web penetration testing is usually the focus or entry point of penetration projects.

Usually after obtaining the formal project authorization, you will be given an IP asset list and the corresponding Web asset address. At this time, we need to perform quick survival verification.

As shown in the figure, this project gives more than 10,000 IPs and lists the corresponding Web asset addresses. At this time, it is necessary to quickly verify the survival of the asset.

I searched online and found that there were no easy tools. So, I wrote this web asset survival detection gadget: Web-SurvivalScan

If this tool helps you, please give me a Star~ Haha

2. TODO

• Fixed the bug where the web page Title is empty and caused an error
• Support batch access to fixed paths (very effective when verifying simple vulnerabilities)
• Supports displaying titles in the export HTML interface, making it more convenient to confirm asset information
• Support verification of HTTP proxy to verify proxy availability
• Supports the use of HTTP/HTTPS to proxy all traffic, and can use HTTP authentication
• Supports automatic recognition of :443 to https://
• Supports reading of TXT in multiple encoding formats (both ANSI and UTF-8 support)
• Supports export of HTML files, facilitates visual organization of assets
• Multi-threaded scanning, 10,000 web assets were tested in about 20 minutes
• Random User-Agent request header is used when survival verification
• Solve the target SSL certificate problem (please change the self-signed certificate http:// ))
• Intelligently identify the target address (no errors will be reported for example.com , http://example.com:8080 and http://example.com )

3. Install Python dependency library

 pip3 install -r requirements.txt

? 4. Tool use

First, you need to copy the target web assets into TXT in batches and place the TXT in the same directory as the following figure:

Note: This script can intelligently identify the target address (either example.com , http://example.com:8080 and http://example.com will report errors)

 # python3 Web-SurvivalScan.py

              ╦ ╦┌─┐┌┐
              ║║║├┤ ├┴┐
              ╚╩╝└─┘└─┘
╔═╗┬ ┬┬─┐┬  ┬┬┬  ┬┌─┐┬  ╔═╗┌─┐┌─┐┌┐┌
╚═╗│ │├┬┘└┐┌┘│└┐┌┘├─┤│  ╚═╗│  ├─┤│││
╚═╝└─┘┴└─ └┘ ┴ └┘ ┴ ┴┴─┘╚═╝└─┘┴ ┴┘└┘
             Version: 1.11
Author: 曾哥(@AabyssZG) && jingyuexing
 Whoami: https://github.com/AabyssZG

请输入目标TXT文件名
FileName >>> 【TXT文件名】
请输入需要访问的路径（无则回车）
DirName >>> 【需要批量访问的路径】
请输入代理IP和端口（无则回车）
Proxy >>> 【HTTP认证账号:HTTP认证密码@代理IP:端口】
Proxy >>> 【代理IP:端口（没有HTTP认证的情况下）】

After running, you can get the two exported files: output.txt and outerror.txt

• output.txt : Export the web assets that have successfully survived (status code 200)
• outerror.txt : Export web assets with other status codes to facilitate later troubleshooting omissions and finding other fragile points
• .data/report.json : The running data of all assets is exported in JSON format for easy processing
• report.html : Visually export all assets to HTML for easy organization

5. Thank you to all the masters

Stargazers

Forkers

Star History