使用docker安装最新AWVS及批量扫描

1. 概述

安装版本：14.4.210816098 Premium（高级版）

部署简单，不需要考虑激活问题

2. 部署

• 安装docker，各系统命令不一样，自行安装

• docker pull secfa/docker-awvs   拉取镜像

• docker run -it -d -p 13443:3443 secfa/docker-awvs  启动容器，外部监听端口13443

3. 使用

• 访问：https://YOUR_IP:13443/

• 用户名：admin@admin.com

• 密码：Admin123

4. 修改口令

• docker exec -u root -it $docker_names bin/bash

• /home/acunetix/.acunetix/change_credentials.sh

• 输入新口令

5. 批量扫描

分享一个批量扫描脚本，我是从数据库查询所有测试子域名，最大扫描任务数量可以自己设定，因为AWVS默认好像是20个任务，同时扫，电脑有点受不了。脚本很简单，有需求的自行修改吧。

import pymysql
import time
import urllib3
import requests
import json
from loguru import logger

urllib3.disable_warnings()

AWVS_HOST = 'https://127.0.0.1:13443/'
AWVS_API_KEY = '1986ad8c0a5b3df4d7028d5f3c06e936c3765f2f4a2f54908a90f20fa01c9e3cc'
AWVS_API_HEADER = {"X-Auth": AWVS_API_KEY, "content-type": "application/json"}

awvs_scan_rule = {
    "full": "11111111-1111-1111-1111-111111111111",
    "highrisk": "11111111-1111-1111-1111-111111111112",
    "XSS": "11111111-1111-1111-1111-111111111116",
    "SQL": "11111111-1111-1111-1111-111111111113",
    "Weakpass": "11111111-1111-1111-1111-111111111115",
    "crawlonly": "11111111-1111-1111-1111-111111111117",
}

logger.info('start')


def start(subdomain):
    target_id = add_task(subdomain)
    scan_task(subdomain, target_id)
    # result = get_scan_info(target_id)
    # get_reports(result, subdomain)
    # print(subdomain)


def add_task(url):
    data = {"address": url, "description": url, "criticality": "10"}
    try:
        response = requests.post(AWVS_HOST + "api/v1/targets", data=json.dumps(data), headers=AWVS_API_HEADER,
                                 timeout=30, verify=False)
        result = json.loads(response.content.decode('utf-8'))
        # logger.info(url + ' 已添加')
        return result['target_id']
    except Exception as e:
        logger.critical('* %s' % e)
        return


def scan_task(url, target_id):
    data = {'target_id': target_id, 'profile_id': awvs_scan_rule['highrisk'],
            'schedule': {'disable': False, 'start_date': None, 'time_sensitive': False}}
    try:
        response = requests.post(url=AWVS_HOST + 'api/v1/scans', timeout=10, verify=False, headers=AWVS_API_HEADER,
                                 data=json.dumps(data))
        if response.status_code == 201:
            logger.info('%s 已开启扫描' % url)           
    except Exception as e:
        logger.critical(e)


def get_scan_info(target_id):
    try:
        response = requests.get(AWVS_HOST + "api/v1/scans", headers=AWVS_API_HEADER, timeout=30, verify=False)
        results = json.loads(response.content.decode('utf-8'))
        logger.info(results['scans'])
        for result in results['scans']:
            if result['target_id'] == target_id:
                logger.info(target_id)
                return result
    except Exception as e:
        logger.critical('* %s' % e)
        return


def get_status(result):
    # 获取scan_id的扫描状况
    try:
        logger.info(result)
        scan_id = result['scan_id']
        response = requests.get(AWVS_HOST + "api/v1/scans/" + str(scan_id), headers=AWVS_API_HEADER, timeout=5, verify=False)
        result = json.loads(response.content.decode('utf-8'))
        status = result['current_session']['status']
        # 如果是completed 表示结束.可以生成报告
        if status == "completed":
            return "completed"
        else:
            return result['current_session']['status']
    except Exception as e:
        logger.critical('* %s' % e)
        return 'aborted'


def get_reports(result, subdomain):
    while True:
        time.sleep(15)
        res = get_status(result)
        if res == 'completed':
            logger.info(subdomain + ', scan completed')
            break
        if res == 'aborted':
            break


def get_scans_running_count():
    try:
        response = requests.get(AWVS_HOST + "/api/v1/me/stats", headers=AWVS_API_HEADER, timeout=30, verify=False)
        results = json.loads(response.content.decode('utf-8'))
        count = results['scans_running_count']
        # logger.info('目前运行任务数：' + str(count))
        return count
    except Exception as e:
        logger.critical('* %s' % e)
        return 5


sql = "select subdomain, waf, awvs_scanned from webapps_webapp where status_code=200 order by id desc"
subdomains = []


try:
    db = pymysql.connect(host="", port=3360, user="root", password="", database="")
    cursor = db.cursor()
    cursor.execute(sql)
    results = cursor.fetchall()

    for row in results:
        if row[1]:
            continue
        if row[2] == 'yes':
            continue
        subdomain = row[0]
        subdomains.append(subdomain)
    db.close()
except Exception as e:
    logger.critical(e)


jobs = len(subdomains)
count = 0
i = 0

while True:
    count = get_scans_running_count()
    if count < 3:
        subdomain = subdomains[i]
        start(subdomain)
        time.sleep(15)

        i += 1
复制