利用acunetix-api进行扫描

自从Acunetix Web Vulnerability Scanner 11.x被52的大大Hmily破解以后，被它的界面惊艳到了。想着这玩意如果分布式的部署起来扫描应该会很爽。找了资料，发现api从官方获取好像需要联系他们。网速的相关东西很少。

主要依靠https://github.com/jenkinsci/acunetix-plugin/blob/master/src/main/java/com/acunetix/Engine.java里面所提供的api改写而来.

全局依赖于获取到的api-key
headers = {"X-Auth":apikey,"content-type": "application/json"}
1.添加任务
post /api/v1/targets
data = {"address":url,"description":url,"criticality":"10"}
2.扫描任务
post /api/v1/scans
data = {"target_id":target_id,"profile_id":"11111111-1111-1111-1111-111111111111","schedule": {"disable": False,"start_date":None,"time_sensitive": False}}
target_id 为第一步添加任务返回的结果
3.获取任务概要
get /api/v1/scans
4.获取任务详情
get /api/v1/scans/+scan_id
5.生成报告
post /api/v1/reports
data = {"template_id":"11111111-1111-1111-1111-111111111111","source":{"list_type":"scans","id_list":[scan_id]}}



转换了python格式的。添加的时候检测是否重复，获取全部的扫描查看状态是否结束，结束就输出报告

复制代码

1. #!/usr/bin/python
2. # -*- coding: utf-8 -*-
3. 
   
4. import json
5. import requests
6. import requests.packages.urllib3
7. '''
8. import requests.packages.urllib3.util.ssl_
9. requests.packages.urllib3.util.ssl_.DEFAULT_CIPHERS = 'ALL'
10. 
    
11. or
12. 
    
13. pip install requests[security]
14. '''
15. requests.packages.urllib3.disable_warnings()
16. 
    
17. tarurl = "https://127.0.0.1:3443/"
18. apikey="yourapikey"
19. headers = {"X-Auth":apikey,"content-type": "application/json"}
20. 
    
21. def addtask(url=''):
22.     #添加任务
23.     data = {"address":url,"description":url,"criticality":"10"}
24.     try:
25.         response = requests.post(tarurl+"/api/v1/targets",data=json.dumps(data),headers=headers,timeout=30,verify=False)
26.         result = json.loads(response.content)
27.         return result['target_id']
28.     except Exception as e:
29.         print(str(e))
30.         return
31. 
    
32. def startscan(url):
33.     # 先获取全部的任务.避免重复
34.     # 添加任务获取target_id
35.     # 开始扫描
36.     targets = getscan()
37.     if url in targets:
38.         return "repeat"
39.     else:
40.         target_id = addtask(url)
41.         data = {"target_id":target_id,"profile_id":"11111111-1111-1111-1111-111111111111","schedule": {"disable": False,"start_date":None,"time_sensitive": False}}
42.         try:
43.             response = requests.post(tarurl+"/api/v1/scans",data=json.dumps(data),headers=headers,timeout=30,verify=False)
44.             result = json.loads(response.content)
45.             return result['target_id']
46.         except Exception as e:
47.             print(str(e))
48.             return
49. 
    
50. def getstatus(scan_id):
51.     # 获取scan_id的扫描状况
52.     try:
53.         response = requests.get(tarurl+"/api/v1/scans/"+str(scan_id),headers=headers,timeout=30,verify=False)
54.         result = json.loads(response.content)
55.         status = result['current_session']['status']
56.         #如果是completed 表示结束.可以生成报告
57.         if status == "completed":
58.             return getreports(scan_id)
59.         else:
60.             return result['current_session']['status']
61.     except Exception as e:
62.         print(str(e))
63.         return
64. 
    
65. def getreports(scan_id):
66.     # 获取scan_id的扫描报告
67.     data = {"template_id":"11111111-1111-1111-1111-111111111111","source":{"list_type":"scans","id_list":[scan_id]}}
68.     try:
69.         response = requests.post(tarurl+"/api/v1/reports",data=json.dumps(data),headers=headers,timeout=30,verify=False)
70.         result = response.headers
71.         report = result['Location'].replace('/api/v1/reports/','/reports/download/')
72.         return tarurl.rstrip('/')+report
73.     except Exception as e:
74.         print(str(e))
75.         return
76. 
    
77. def getscan():
78.     #获取全部的扫描状态
79.     targets = []
80.     try:
81.         response = requests.get(tarurl+"/api/v1/scans",headers=headers,timeout=30,verify=False)
82.         results = json.loads(response.content)
83.         for result in results['scans']:
84.             targets.append(result['target']['address'])
85.             print result['scan_id'],result['target']['address'],getstatus(result['scan_id'])#,result['target_id']
86.         return list(set(targets))
87.     except Exception as e:
88.         raise e
89. 
    
90. if __name__ == '__main__':
91.     print startscan('http://testhtml5.vulnweb.com/')

感觉排版有点问题.原文件在https://github.com/0xa-saline/acunetix-api/blob/master/acunetix.py

详情参考
http://0cx.cc/about_awvs11_api.jspx


无耻的打了个广告



last:有人问咋个可以远程访问
[attachment=5443]