Download to read offline
![CONFIDENTIAL: The information in this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Code-Picture1&2 import requests from bs4 import BeautifulSoup import os import time def clear_console(): os.system('cls' if os.name == 'nt' else 'clear') def check_login_attempts(url): login_url = f"{url}/login" # Adjust this to your actual login endpoint try: response = requests.get(login_url) if response.status_code == 200: # Look for specific text that indicates login attempts are limited if 'max login attempts' in response.text.lower(): return "Vulnerable: More than 3 login attempts allowed." else: return "Not Vulnerable: Login attempts are limited." else: return f"Error: Unable to access login page (Status code: {response.status_code})." except Exception as e: return f"Error: {str(e)}" def check_admin_panel(url): admin_paths = ['/admin', '/server'] vulnerabilities = [] for path in admin_paths: try: response = requests.get(url + path) if response.status_code == 200: vulnerabilities.append(f"Vulnerable: Admin panel accessible at {url + path}.") except Exception as e: return f"Error accessing {url + path}: {str(e)}" if not vulnerabilities: return "Not Vulnerable: Admin panel is not accessible." return "n".join(vulnerabilities)](https://image.slidesharecdn.com/capstoneppt-241113132354-d894618e/75/Developing-a-Simple-Python-Tool-for-Website-Vulnerability-Scanning-9-2048.jpg)
![CONFIDENTIAL: The information in this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Code-Picture3&4 def check_file_upload_vulnerability(url): upload_url = f"{url}/upload" # Adjust this to your actual upload endpoint malicious_files = ['malicious.exe', 'malicious.php', 'malicious.js'] vulnerabilities = [] for file in malicious_files: try: with open(file, 'wb') as f: # Create a dummy malicious file f.write(b'This is a test for malicious file upload.') files = {'file': (file, open(file, 'rb'))} response = requests.post(upload_url, files=files) if response.status_code == 200 and 'success' in response.text.lower(): vulnerabilities.append(f"Vulnerable: File upload accepts malicious file {file}.") except Exception as e: return f"Error during file upload test: {str(e)}" if not vulnerabilities: return "Not Vulnerable: File upload validation appears secure." return "n".join(vulnerabilities) def main(): while True: clear_console() print("Website Vulnerability Scanner") target_url = input("Enter the URL to scan (e.g., http://example.com): ").strip() if not target_url.startswith("http"): print("Invalid URL. Please enter a valid URL starting with http or https.") continue print("nScanning for vulnerabilities...n") # Check for login attempts print("1. Check Limit Login Attempts:") print(check_login_attempts(target_url)) print("n2. Check Admin Panel Accessibility:") print(check_admin_panel(target_url)) print("n3. Check File Upload Vulnerabilities:") print(check_file_upload_vulnerability(target_url)) print("nScan complete.") # Ask the user if they want to scan again or exit user_choice = input("Do you want to scan another URL? (y/n): ").strip().lower() if user_choice != 'y': print("Exiting the scanner. Goodbye!") break if __name__ == "__main__": try: main() except KeyboardInterrupt:](https://image.slidesharecdn.com/capstoneppt-241113132354-d894618e/75/Developing-a-Simple-Python-Tool-for-Website-Vulnerability-Scanning-10-2048.jpg)
Developing a Simple Python Tool for Website Vulnerability Scanning
- 1. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Create a simple Python tool designed to perform a website vulnerability scan KOPPULA DILEEP KUMAR JUN-Batch2024
- 2. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Agenda To create a simple Python tool for performing a website vulnerability scan. By utilizing Python libraries and modules, it need to analyze the target website for potential security vulnerabilities. Overall, the goal is to develop a lightweight and easy-to-use tool that can assist in identifying security weaknesses in web applications.
- 3. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Abstract The aim of the project is to find vulnerabilities of websites by using Python tool. Python tool will be created in this project. By this Python tool, we can find if there is Limit Login Attempts or not. From this we can know Burteforce is possible or not. Secondly, Admin panel is accessible or not. If Admin panel is accessible publicy, there will be chances to do any attacks on the Admin page. Lastly, File Upload Vulnerabilities. If there will be chances to upload any malicious files, Website or web server have chances to get compromised.
- 4. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Company: Gowra group Website: https://www.gbb.co.in/ Category: IT Infrastructure Solutions and Services Company Technologies: Wordpress, Bootstrap, PHP, MySQL, Apache HTTP Server, OpenSSL Target
- 5. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Technologies Technologies-pic-2 Technologies-pic-1
- 6. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Click to edit Master title style Procedure to implement Python Tool Prerequisites 1.Installations of Code Editor and Python 2.Code to Identify Vulnerabilities of Website 3.Test 4.Publish
- 7. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Installation 1.Open Terminal 2.Run “sudo apt install python3 -y”
- 8. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Code 1.Open Text Editor 2.Write Python code to find vulnerabilities of a website
- 9. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Code-Picture1&2 import requests from bs4 import BeautifulSoup import os import time def clear_console(): os.system('cls' if os.name == 'nt' else 'clear') def check_login_attempts(url): login_url = f"{url}/login" # Adjust this to your actual login endpoint try: response = requests.get(login_url) if response.status_code == 200: # Look for specific text that indicates login attempts are limited if 'max login attempts' in response.text.lower(): return "Vulnerable: More than 3 login attempts allowed." else: return "Not Vulnerable: Login attempts are limited." else: return f"Error: Unable to access login page (Status code: {response.status_code})." except Exception as e: return f"Error: {str(e)}" def check_admin_panel(url): admin_paths = ['/admin', '/server'] vulnerabilities = [] for path in admin_paths: try: response = requests.get(url + path) if response.status_code == 200: vulnerabilities.append(f"Vulnerable: Admin panel accessible at {url + path}.") except Exception as e: return f"Error accessing {url + path}: {str(e)}" if not vulnerabilities: return "Not Vulnerable: Admin panel is not accessible." return "n".join(vulnerabilities)
- 10. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Code-Picture3&4 def check_file_upload_vulnerability(url): upload_url = f"{url}/upload" # Adjust this to your actual upload endpoint malicious_files = ['malicious.exe', 'malicious.php', 'malicious.js'] vulnerabilities = [] for file in malicious_files: try: with open(file, 'wb') as f: # Create a dummy malicious file f.write(b'This is a test for malicious file upload.') files = {'file': (file, open(file, 'rb'))} response = requests.post(upload_url, files=files) if response.status_code == 200 and 'success' in response.text.lower(): vulnerabilities.append(f"Vulnerable: File upload accepts malicious file {file}.") except Exception as e: return f"Error during file upload test: {str(e)}" if not vulnerabilities: return "Not Vulnerable: File upload validation appears secure." return "n".join(vulnerabilities) def main(): while True: clear_console() print("Website Vulnerability Scanner") target_url = input("Enter the URL to scan (e.g., http://example.com): ").strip() if not target_url.startswith("http"): print("Invalid URL. Please enter a valid URL starting with http or https.") continue print("nScanning for vulnerabilities...n") # Check for login attempts print("1. Check Limit Login Attempts:") print(check_login_attempts(target_url)) print("n2. Check Admin Panel Accessibility:") print(check_admin_panel(target_url)) print("n3. Check File Upload Vulnerabilities:") print(check_file_upload_vulnerability(target_url)) print("nScan complete.") # Ask the user if they want to scan again or exit user_choice = input("Do you want to scan another URL? (y/n): ").strip().lower() if user_choice != 'y': print("Exiting the scanner. Goodbye!") break if __name__ == "__main__": try: main() except KeyboardInterrupt:
- 11. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Output 1.Open Terminal 2.Locate vuln_scanner.py file 3.Run “python3 vuln_scanner.py”
- 12. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Mitigation's Limit Login Attempts: Implement measures to limit the number of login attempts to prevent brute force attacks. Change Default Admin Paths: Rename admin panel URLs to less predictable strings (e.g., /masterdfns, /admyhj) to restrict the admin interface publicly. File Upload Vulnerability: Whitelisting allowed file types, limiting file sizes, renaming files, storing them outside the web root, and disabling script execution in the upload directory. Regular Updates: Keep WordPress core, themes, and plugins updated to the latest versions. Regular Backups: Maintain regular backups of your website to recover from potential attacks.
- 13. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Proof of Concept When we run automatic scan using Python tool to know vulnerability for https://gbb.co.in/ website, there is no limit of login attempts. This shows Burteforce attack is possible. So, Attacker have chances to use this technique to compromise the server or a website. Next, If Admin panels path are known names like /admin or /user or /server, attackers get easy into admin panels. So, It is better to change to random paths. If Upload file button allows all file types, then it is possible to upload any malicious code via file. So, It is better to using whitelist only specific file types like, PDF, PNG.
- 14. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Tools • Terminal / CMD • Code editor: VSCode. In this project, we used default Text Editor • Python programming language Installation: Linux: run “sudo apt install python3 -y” on Terminal Windows: https://www.python.org/ftp/python/3.13.0/Python-3.13.0.tar.xz
- 15. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Questions ?
- 16. CONFIDENTIAL: The informationin this document belongs to Boston Institute of Analytics LLC. Any unauthorized sharing of this material is prohibited and subject to legal action under breach of IP and confidentiality clauses. Thank You!