AutoShell - This code is a web scanner tool designed to find v

项目说明

AutoShell

<di="display: inline-block; width: 30%;">
<a href=" src=" alt="IMG-1321" style="width: 100%;"></a>
</div>
<di="display: inline-block; width: 30%;">
<a href=" src=" alt="IMG-1323" style="width: 100%;"></a>
</div>

This code is a web scanner tool designed to find and file upload points on a website. It uses techniques to bypass security measures and upload files in a hidden manner. In the following, the technical details of the code and the techniques used will be explained.

Different parts of the code:

1. Initial settings:
In this section, the necessary for running the code are defined. Some of these include:
* logger: A logging class object used to keep track of events and errors in the code.
* RANDOM_COMMANDS: A list of random commands that are used to execute the code on the server.
* IMAGE_FILE: A string that represents the name of the image file used to hide the code in it.
2. Generating random code:
The generate_random_shell and random_shell_name functions are defined in this section. The generate_random_shell function generates a random code using one of the random commands from the RANDOM_COMMANDS list. The random_shell_name function generates a random name for the code file.
3. Finding the upload point:
The find_upload_point function is used to find the file upload point on a website. This function uses the requests and BeautifulSoup libraries to retrieve the main page of the website and then finds the forms that have a file upload field. If no form is found, this function finds a list of website links using the ContentDiscovery class and then finds the forms that have a file upload field for each link.
4. Uploading the file:
The upload_file function is used to upload the file to an upload point. This function uses techniques to bypass security measures and upload the file in a hidden manner. Some of these techniques include:
* Changing the file extension: This technique uses a unknown file extension to bypass website security.
* Adding null byte character: This technique adds a null byte character to the end of the file name to bypass website security.
* Adding double extension: This technique adds a double extension to the file name to bypass website security.
* Increasing file size: This technique increases the file size to bypass website security.
* Adding code to an image: This technique adds the code to an image file to hide the code and bypass website security.
* Using base64 encoding: This technique encodes the file using base64 encoding to hide the code and bypass website security.
* Using gzinflate: This technique compresses the file using gzinflate to hide the code and bypass website security.
* Using eval: This technique uses the Ja e to execute the code and bypass website security.
* Using data URI: This technique uses data URI to hide the code and bypass website security.
* Using custom extension: This technique uses a custom file extension for the file to bypass website security.
* Using polyglot file: This technique creates a polyglot file to hide the code and bypass website security.
* Using steganography: This technique hides the code in an image using steganography to bypass website security.
5. Testing and execution:
The try_upload_methods function is used to test and execute the find_upload_point and upload_file functions. This function tries to find the file upload point and then uploads the file in a hidden manner for each website entered by the user. If the upload is successful, the address of the uploaded file on the website is printed.

Finally, the main function is used to run the code and get user inputs. This function generates a random name for the file and then tries to upload the file to the website using the try_upload_methods function.

This code is a powerful tool for finding and file upload points on a website. Using techniques to bypass website security and upload files in a hidden manner, this tool can be very useful for testing website security. It should be noted that the use of this tool should be done responsibly and with the necessary permissions.

项目信息

开发语言：Python

Star 数：19

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This code is a web scanner tool designed to find vulnerabilities and file upload points on a website. It uses various techniques to bypass security measures and upload files in a hidden manner. In the following, the technical details of the code and the techniques used will be explained.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。