Cors_test(批量测试网站是否存在CORS劫持)

import requests
from threading import Thread

headers = {
    ‘User-Agent‘:‘Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0‘,
    ‘Origin‘:‘http://www.baidu.com/‘
}

def test_cors(filename):
    with open(filename) as targets:
        for target in targets:
            if ‘http://‘ or ‘https://‘ not in target:
                target = ‘http://‘ + target.strip()
            try:
                req = requests.get(target,headers=headers,timeout=(5,20),verify=False,allow_redirects=False)
                if ‘Access-Control-Allow-Origin‘ and ‘Access-Control-Allow-Credentials‘ in req.headers:
                    print(‘[+]CORS Found： {} {} {}‘.format(target,req.headers[‘Access-Control-Allow-Origin‘],req.headers[‘Access-Control-Allow-Credentials‘]))
                    with open(‘success.txt‘,‘a+‘) as f:
                        f.write("{} {} {} \n".format(target,req.headers[‘Access-Control-Allow-Origin‘],req.headers[‘Access-Control-Allow-Credentials‘]))
                        continue
                else:
                    print(‘[+]maybe CORS：{} {}‘.format(target,req.headers[‘Access-Control-Allow-Origin‘]))
                    with open(‘success.txt‘,‘a+‘) as f:
                        f.write("{} {}  \n".format(target,req.headers[‘Access-Control-Allow-Origin‘]))
                        continue
            except (TimeoutError,requests.exceptions.ReadTimeout):
                print(‘{} {}‘.format(target,‘timeout‘))
                continue
            except KeyError:
                print(‘{} {}‘.format(target,‘key not found‘))

def main():
    filename = input(‘Please input your urls.txt：‘)
    thread = Thread(target=test_cors,args=(filename,))
    thread.start()

if __name__ == ‘__main__‘:
    main()