ScanT3r是一款强大的Web安全扫描工具，支持检测以下漏洞：远程代码执行漏洞——Linux；反射型XSS漏洞；模板注入漏洞：Jinja2、ERB、Java、Twig、Freemarker；SQL注入漏洞；系统支持：LinuxAndroidWindows工具安装注：ScanT3r仅支持Python>3.6环境。Linux安装首先，打开一个命令行终端窗口。输入并运行以下命令：$gitclonehttps://github.com/knassar702/scant3r$cdscant3r$python3-mpipinstall-rrequirements.txt$chmod+xscant3rAndroid安装首先，下载TermuxApp：https://play.google.com/store/apps/details?id=com.termux&hl=en打开Termux应用程序，然后输入并运行以下命令：$pkginstallpython-y$pkginstallgit-y$gitclonehttps://github.com/knassar702/scant3r$cdscant3r$python3-mpipinstall-rrequirements.txt$chmod+xscant3rWindows安装首先下载并安装Python3环境，然后打开命令行终端窗口，输入并运行以下命令：$python3-mpipinstall-rrequirements.txt工具使用选项：-h,--help|Showhelpmessageandexit--version|Showprogram'sversionnumberandexit-uURL,--url=URL|TargetURL(e.g."http://www.target.com/vuln.php?id=1")--data=DATA|DatastringtobesentthroughPOST(e.g."id=1")--list=FILE|GetAllUrlsfromList--threads|MaxnumberofconcurrentHTTP(s)requests(default10)--超时|Secondstowaitbeforetimeoutconnection--proxy|StartTheConnectionwithhttp(s)proxy--cookies|HTTPCookieheadervalue（例如“PHPSESSID=a8d127e..”）--encode|多少编码hepayload(default1)--allow-redirect|Allowthemainredirect--user-agent|addcustomuser-agent--scan-headers|Trytoinjectpayloadsinheadersnotparameters(user-agent,referrer)--skip-headers|SkipTheHeadersscanningprocess--sleep|SentonerequestaftersomeSeconds--模块|addcustommodule(e.g."google.py")--debug|DebuggingMood工具使用示例POST方法：$python3scant3r-u'http://localhost/dvwa/vulnerabilities/exec/'--data='ip=localhost&Submit=Submit'添加cookie:$python3scant3r-u'http://localhost/?l=2'--cookies='user=admin&id=1'添加超时：$python3scant3r-u'http://localhost/?l=13'--timeout=1允许重定向(302,301):$python3scant3r-u'http://localhost/?l=13'--allow-redirect休眠时间:$python3scant3r-u'http://localhost/?l=13'--sleep=2启用调试模式：$python3scant3r-u'http://localhost/?l=13'--debug扫描所有标头：$python3scant3r-u'http://localhost/?l=13'--scan-headers跳过标头：$python3scant3r-u'http://localhost/?l=13'--skip-headers添加自定义用户代理：$python3scant3r-u'http://localhost/?l=13'--user-agent='CustomUseragent(v2)'添加编码方案：$python3scant3r-u'http://localhost/?l=13'--encode=2添加代理:$python3scant3r-u'http://localhost/?l=13'--proxy='http://localhost:8080'运行你自己的模块：$python3scant3r-u'http://localhost/?l=13'--module=dumper.py添加URL列表：$python3scant3r--listurls.txt--threads=40测试样本$./scant3r-u'http://test.vulnweb.com/search。php?test=query'--data='searchFor=scant3r&goButton=go'$./scant3r-u'http://test.vulnweb.com/artists.php?artist=1'$./scant3r-u'https://menacoderrr.pythonanywhere.com/'工具运行截图诺基亚官网：项目地址ScanT3r：https://github.com/knassar702/scant3r
