PuzlBox 1.0.0.9Copyright (C) 2010 John Leitch john.leitch5@gmail.com==DescriptionPuzlBox is a PHP fuzz tool that scans for several different vulnerabilities byperforming dynamic program analysis. It can detect the following vulnerabilities:Arbitrary Command ExecutionArbitrary PHP ExecutionLocal File InclusionAribtray File Read/Write/Change/Rename/DeleteSQL InjectionReflected Cross-site Scripting==UsagePuzlBox must be run as administrator!Do not navigate to any of the target web applications during the scan.puzlbox [-s Server (default localhost)] [-m Scan Modes (default CFLPSX)] [Absolute Web Root] [-n No Unhook] [Application Paths (comma delimited)]Modes:C - Arbitrary Command ExecutionF - Arbitrary File Read/Write/Change/Rename/DeleteL - Local File InclusionP - Arbitrary PHP ExecutionS - SQL InjectionX - Reflected Cross-site ScriptingExamples:puzlbox c:\xampp\htdocs MyAppRuns all scans on MyApp, located in web root c:\xampp\htdocspuzlbox -m CX c:\xampp\htdocs MyApp1,MyApp2Runs Arbitrary Command Execution and Reflected Cross-site Scripting scans on MyApp1 and MyApp2 located in web root c:\xampp\htdocs==Change Log1.0.0.9Added scan overview reportUpdated SQL injection scanUpdated command scanMinor interface updatesFixed bug caused by use of <? open tag使用前本地搭建环境参数:C - 任意命令执行F - 任意文件读/写/更改/重命名/删除L - 本地文件包含P - 执行任意PHPS - SQL注入X - 反映跨站点脚本列子:puzlbox -m sx c:\wwwroot ecshop扫描 c:\wwwroot 目录下ecshop的SQL注入和XSS!puzlbox -m cf c:\wwwroot ecshop,shopex扫描c:\wwwroot目录下ecshop,shopex的任意命令执行和任意文件读/写/更改/重命名/删除DOWN
本文转sinojelly51CTO博客,原文链接:http://blog.51cto.com/pnig0s1992/410773,如需转载请自行联系原作者