puzlbox(PHP程式碼稽核工具)

技術小美發表於2017-11-16
PuzlBox 1.0.0.9

Copyright (C) 2010 John Leitch john.leitch5@gmail.com

==Description
PuzlBox is a PHP fuzz tool that scans for several different vulnerabilities by
performing dynamic program analysis. It can detect the following vulnerabilities:

Arbitrary Command Execution
Arbitrary PHP Execution
Local File Inclusion
Aribtray File Read/Write/Change/Rename/Delete
SQL Injection
Reflected Cross-site Scripting

==Usage
PuzlBox must be run as administrator!

Do not navigate to any of the target web applications during the scan.

puzlbox [-s Server (default localhost)] [-m Scan Modes (default CFLPSX)] [Absolute Web Root] [-n No Unhook] [Application Paths (comma delimited)]

Modes:
C – Arbitrary Command Execution
F – Arbitrary File Read/Write/Change/Rename/Delete
L – Local File Inclusion
P – Arbitrary PHP Execution
S – SQL Injection
X – Reflected Cross-site Scripting

Examples:
puzlbox c:xampphtdocs MyApp
Runs all scans on MyApp, located in web root c:xampphtdocs

puzlbox -m CX c:xampphtdocs MyApp1,MyApp2
Runs Arbitrary Command Execution and Reflected Cross-site Scripting scans on MyApp1 
and MyApp2 located in web root c:xampphtdocs

==Change Log

1.0.0.9
Added scan overview report
Updated SQL injection scan
Updated command scan
Minor interface updates
Fixed bug caused by use of <? open tag


使用前本地搭建環境

引數:

C – 任意命令執行
F – 任意檔案讀/寫/更改/重新命名/刪除
L – 本地檔案包含
P – 執行任意PHP
S – SQL隱碼攻擊
X – 反映跨站點指令碼

列子:

puzlbox -m sx c:wwwroot ecshop

掃描 c:wwwroot 目錄下ecshop的SQL隱碼攻擊和XSS!

puzlbox -m cf c:wwwroot ecshop,shopex

掃描c:wwwroot目錄下ecshop,shopex的任意命令執行和任意檔案讀/寫/更改/重新命名/刪除

DOWN


本文轉sinojelly51CTO部落格,原文連結:http://blog.51cto.com/pnig0s1992/410773,如需轉載請自行聯絡原作者


相關文章