Description

The tool is intended for security research and internal audits only. It is forbidden to use it to launch illegal attacks. The user is responsible for any consequences.

Apache Tomcat file inclusion vulnerability (CVE-2020-1938 / CNVD-2020-1048) batch detection tool.

This project is modified based on Kit4y's project.

Code Modification

When there is only one domain or IP in ip.txt, threadCount becomes 1, and the program actually does not run. Added code to check the thread count.

...
if threadCount == 1:
    threadCount = 2
for i in range(0,threadCount-1):
...

Modified a small amount of code to be compatible with Python 3. Code before modification:

self.stream = self.socket.makefile("rb", bufsize=0)

print("".join([d.data for d in data]))

Code after modification:

if sys.version_info < (3, 0):
    self.stream = self.socket.makefile("rb", bufsize=0)
else:
    self.stream = self.socket.makefile("rb", buffering=None)

if sys.version_info < (3, 0):
    print("".join([d.data for d in data]))
else:
    print(b"".join([d.data for d in data]).decode("UTF-8"))

Usage

Batch Detection

1. Place the domains/IPs to be scanned in ip.txt, for example:

127.0.0.1
www.baidu.com
www.google.com

2. python threading-find-port-8009.py

Scans the domains/IPs in ip.txt to find those with port 8009 open, and saves them to the generated 8009.txt.