此标签则匹配泄露的关键代码部分，不存在则为空。
if '
' in code:
data = pattern_code.findall(code)
codes.append(pattern_sub.sub('
', data[0]))
else:
codes.append(' ')
return tUrls, codes
except Exception as e:
#如发生错误，则写入文件并且打印出来
error_Record(str(e), traceback.format_exc())
print(e)
def insert_DB(url, code):
try:
conn = sqlite3.connect('hunter.db')
cursor = conn.cursor()
cursor.execute('CREATE TABLE IF NOT EXISTS Baseline (url varchar(1000) primary key, code varchar(10000))')
cursor.execute('INSERT OR REPLACE INTO Baseline (url, code) values (?,?)', (url, code))
cursor.close
conn.commit()
conn.close()
except Exception as e:
print("数据库操作失败！\n")
error_Record(str(e), traceback.format_exc())
print(e)
def compare_DB_Url(url):
try:
con = sqlite3.connect('hunter.db')
cur = con.cursor()
cur.execute('SELECT url from Baseline where url = ?', (url,))
results = cur.fetchall()
cur.close()
con.commit()
con.close()
return results
except Exception as e:
error_Record(str(e), traceback.format_exc())
print(e)
def error_Record(error, tb):
try:
if os.path.exists('error.txt'):
with open('error.txt', 'a', encoding='utf-8') as f:
f.write(strftime("%a, %d %b %Y %H:%M:%S",gmtime()) + "-" + "Exception Record: " + error + '\n' + "具体错误信息如下：\n" +tb + '\r\n')
else:
with open('error.txt', 'w', encoding='utf-8') as f:
f.write(strftime("%a, %d %b %Y %H:%M:%S",gmtime()) + "-" + "Exception Record: " + error + '\n' + "具体错误信息如下：\n" +tb + '\r\n')
except Exception as e:
print(e)
def send_mail(host, username, password, sender, receivers, message):
def _format_addr(s):
name,addr = parseaddr(s)
return formataddr((Header(name,'utf-8').encode(),addr))
msg = MIMEText(message, 'html', 'utf-8')
subject = 'Github信息泄露监控通知'
msg['Subject'] = Header(subject, 'utf-8').encode()
msg['From'] = _format_addr('Github信息泄露监控<%s>' % sender)
msg['To'] = ','.join(receivers)
try:
smtp_obj = smtplib.SMTP(host, 25)
smtp_obj.login(username, password)
smtp_obj.sendmail(sender, receivers, msg.as_string())
print('邮件发送成功！')
smtp_obj.close()
except Exception as err:
error_Record(str(err), traceback.format_exc())
print(err)
if __name__ == '__main__':
config = configparser.ConfigParser()
config.read('info.ini')
g_User = config['Github']['user']
g_Pass = config['Github']['password']
host = config['EMAIL']['host']
m_User = config['EMAIL']['user']
m_Pass = config['EMAIL']['password']
m_sender = config['SENDER']['sender']
receivers = []
for k in config['RECEIVER']:
receivers.append(config['RECEIVER'][k])
keywords = []
#组合关键词，keyword + payload,两者之间加入“+”号，符合Github搜索语法
for keyword in config['KEYWORD']:
for payload in config['PAYLOADS']:
keywords.append(config['KEYWORD'][keyword] + '+' + config['PAYLOADS'][payload])
message = 'Dear all
未发现任何新增敏感信息！'
tUrls, codes= hunter(g_User, g_Pass, keywords)
target_codes = []
#第一次运行会查找是否存在数据文件，如果不存在则新建，存在则进行新增条目查找
if os.path.exists('hunter.db'):
print("存在数据库文件，进行新增数据查找......")
#拆分关键词，在泄露的代码中查找关键词和payload.如果两者都存在则进行下一步数据库查找
for keyword in keywords:
payload = keyword.split('+')
for i in range(0, len(tUrls)):
if (payload[0] in codes[i]) and (payload[1] in codes[i]):
#如果数据库中返回的值为空，则说明该条目在数据库中不存在，那么添加到target_codes里面用户发送邮件，并且添加到数据库中
if not compare_DB_Url(tUrls[i]):
target_codes.append('
' + '链接：' + tUrls[i] + '
')
target_codes.append('简要代码如下：
' + codes[i] + '
')
insert_DB(tUrls[i], codes[i])
else:
print("未发现数据库文件，创建并建立基线......")
for keyword in keywords:
payload = keyword.split('+')
for i in range(0, len(tUrls)):
#关键词和payload同时存在则加入到target_codes,并写入数据库
if (payload[0] in codes[i]) and (payload[1] in codes[i]):
target_codes.append('
' + '链接：' +tUrls[i] + '
')
target_codes.append('简要代码如下：
' + codes[i] + '
')
insert_DB(tUrls[i], codes[i])
#当target_codes有数据时，则进行邮件预警
if target_codes:
warning = ''.join(target_codes)
result = 'Dear all
发现信息泄露! ' + '一共发现{}条'.format(int(len(target_codes)/2)) + warning
send_mail(host, m_User, m_Pass, m_sender, receivers, result)
else:
send_mail(host, m_User, m_Pass, m_sender, receivers, message)