wangyihang / sourceleakhacker

:bug: A multi threads web application source leak scanner

Description

SourceLeakHacker is a muilt-threads web directories scanner.

Installation

pip install -r requirements.txt

Usage　

usage: SourceLeakHacker.py [options]

optional arguments:
  -h, --help            show this help message and exit
  --url URL             url to scan, eg: 'http://127.0.0.1/'
  --urls URLS           file contains urls to scan, one line one url.
  --scale {full,tiny}   build-in dictionary scale
  --output OUTPUT       output folder, default: result/YYYY-MM-DD hh:mm:ss
  --threads THREADS, -t THREADS
                        threads numbers, default: 4
  --timeout TIMEOUT     HTTP request timeout
  --level {CRITICAL,ERROR,WARNING,INFO,DEBUG}, -v {CRITICAL,ERROR,WARNING,INFO,DEBUG}
                        log level
  --version, -V         show program's version number and exit

Example

$ python SourceLeakHacker.py --url=http://baidu.com --threads=4 --timeout=8
[302]   0       3.035766        text/html; charset=iso-8859-1   http://baidu.com/_/_index.php
[302]   0       3.038096        text/html; charset=iso-8859-1   http://baidu.com/_/__index.php.bak
...
[302]   0       0.063973        text/html; charset=iso-8859-1   http://baidu.com/_adm/_index.php
[302]   0       0.081672        text/html; charset=iso-8859-1   http://baidu.com/_adm/_index.php.bak
Result save in file: result/2020-02-27 07:07:47.csv

$ cat url.txt                 
http://baidu.com/
http://google.com/

$ python SourceLeakHacker.py --urls=url.txt --threads=4 --timeout=8
[302]   0       2.363600        text/html; charset=iso-8859-1   http://baidu.com/_/__index.php.bak
[302]   0       0.098417        text/html; charset=iso-8859-1   http://baidu.com/_adm/__index.php.bak
...
[302]   0       0.060524        text/html; charset=iso-8859-1   http://google.com/_adm/_index.php.bak
[302]   0       0.075042        text/html; charset=iso-8859-1   http://baidu.com/_adm/_index.php.back
Result save in file: result/2020-02-27 07:08:54.csv

Demo

TODOs

• Arguments parser.
• Store scan result into csv file.
• Support for multiple urls (from file).
• Add help comments for every params.
• Update Usage.
• Adjust dictionary elements order systematically.
• Change logger in order to suite for both windows and linux.
• Add log level.
• Update Screenshots.
• Retry and avoid dead lock
• Store scan result into sqlite database.
• Download small url contents, then store them into sqlite database.

Known Bugs

• CTRL C does not works on windows platform

sourceleakhacker's Issues

ImportError: No module named context

git clone https://github.com/WangYihang/SourceLeakHacker.git
cd SourceLeakHacker
pip install -r requirments.txt
python SourceLeakHacker.py --url=http://server:port/ --threads=4 --timeout=8 

之后出现:

Traceback (most recent call last):
  File "SourceLeakHacker.py", line 16, in <module>
    from lib.util import output
  File "/Users/boming/Downloads/SourceLeakHacker-3.0/lib/util/output.py", line 7, in <module>
    from lib.context import context
ImportError: No module named context

是我的环境问题吗

Error occurs when adding `--scale=tiny` argument

--scale=tiny为啥会报错啊。。。

Old-style class defined

7
8 screenLock = threading.Semaphore(value=1)
9
10 class ColorPrinter:
11     @staticmethod
12     def print_red_text(content):

In regards to line 10.

Why is this an issue?
In Python 2.x, old-style classes are defined by not inheriting from a base class or by inheriting from other old-style classes. New-style classes are defined by inheriting from class object or from other new-style classes.
Python 3.x supports only new-style classes; if no base class is specified on a class definition, the class implicitly inherits from object.
It is recommended to define only new-style classes, because they are properly integrated into Python's type system.

https://www.python.org/doc/newstyle/

Not mandatory and with no relevant improvement to the master but keep in mind for future 👍

SSL报错

请问有中文手册吗；还有爬虫模块SSL没处理好

Take Input From File

Hello,

Would be really cool if you could import a list of domains from a file to scan.