Merge pull request #12 from JrDw0/patch-1

修复s2-009,012的误报
HatBoy · Sep 14, 2020 · 0c00054 · 0c00054
2 parents 11e903b + e209146
commit 0c00054
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/Struts2Scan.py b/Struts2Scan.py
@@ -211,11 +211,12 @@ def get_hash():
 
 def echo_check(self):
     """通过echo输出检查漏洞是否存在"""
-    hash_str = get_hash()
-    html = self.exec_cmd("echo " + hash_str)
+    num1 = random.randint(10000, 100000)
+    num2 = random.randint(10000, 100000)
+    html = self.exec_cmd(f"echo `expr {num1} + {num2}]`")
     if html.startswith("ERROR:"):
         return html
-    elif hash_str in html:
+    elif str(num1 + num2) in html:
         return True
     else:
         return False