在测试中偶尔会碰到swagger泄露 常见的泄露如图： 
有的泄露接口特别多，每一个都手动去试根本试不过来 于是用python写了个脚本自动爬取所有接口，配置好传参发包访问
原理是首先抓取http://url/swagger-resources 获取到有哪些标准及对应的文档地址 而后对每个标准下的接口文档进行解析，构造请求包，获取响应
尽量考虑到了所有可能的传参格式，实际测试只有少数几个会500或400响应需要手动修改一下，其余都是401或者200 200就是未授权访问接口了，可以进一步做其他诸如sqli等测试 运行时如图： 
所有测试结果都存储在csv中： 
欢迎大家关注稻草人安全团队，后续有更多技术文章、工具分享等 
Minimal Django + Pytest + GitHub Actions example This minimal example shows you how you can runs pytest on your Django app on every commit using GitHu
Python-Automation-with-openpyxl Using openpyxl in Python, performed following tasks on an Excel Sheet containing Product Suppliers along with their pr
Tamil Nadu Chief Minister's Relief Fund Donors Scrapped data from https://ereceipt.tn.gov.in/cmprf/Interface/CMPRF/MonthWiseReport Scrapper scrapper.p
An AWS Pentesting tool that lets you use one-liner commands to backdoor an AWS account's resources with a rogue AWS account - or share the resources with the entire internet 😈
pytest-idempotent Pytest plugin for testing the idempotency of a function. Usage pip install pytest-idempotent Documentation Suppose we had the follo
FeishuAutoTestDemo This is a automation testing framework which use Feishu as an example. Execute runner.py to run. Technology Web UI Test pytest + se
This project demonstrates selenium's ability to extract files from a website. I've added the challenge of connecting over TOR. This package also includes a personal archive site built in NodeJS and A
django-nose django-nose provides all the goodness of nose in your Django tests, like: Testing just your apps by default, not all the standard ones tha
Build fast, reliable, end-to-end tests. SeleniumBase is a Python framework for web automation, end-to-end testing, and more. Tests are run with "pytes
Splash - A javascript rendering service Splash is a javascript rendering service with an HTTP API. It's a lightweight browser with an HTTP API, implem
Automate home Yet another home automation project because a smart light is more than just on or off. Overview When talking about home automation there
XSSearch A Comprehensive Reflected XSS Scanner XSSearch is a comprehensive refle
Django-google-optimize Django-google-optimize is a Django application designed to make running Google Optimize A/B tests easy. Here is a tutorial on t
LuluTest LuluTest is an open source browser automation framework using Python and Selenium. It is relatively lightweight in that it mostly provides wr
factory_boy factory_boy is a fixtures replacement based on thoughtbot's factory_bot. As a fixtures replacement tool, it aims to replace static, hard t
Hypothesis Hypothesis is a family of testing libraries which let you write tests parametrized by a source of examples. A Hypothesis implementation the
pytest-watch -- Continuous pytest runner pytest-watch a zero-config CLI tool that runs pytest, and re-runs it when a file in your project changes. It
Delegator.py — Subprocesses for Humans 2.0 Delegator.py is a simple library for dealing with subprocesses, inspired by both envoy and pexpect (in fact
pychoir - Python Test Matchers for humans Super duper low cognitive overhead matching for Python developers reading or writing tests. Implemented in p
The pytest framework makes it easy to write small tests, yet scales to support complex functional testing for applications and libraries. An example o
5 Sep 19, 2022
1 Apr 06, 2022
5 May 18, 2021
276 Mar 03, 2021
3 Dec 14, 2022
2 Aug 19, 2022
2 Jan 16, 2022
880 Dec 15, 2022
3k Jan 04, 2023
3.8k Jan 03, 2023
62 Oct 10, 2022
49 Oct 18, 2022
39 Oct 25, 2022
14 Sep 26, 2022
3k Jan 05, 2023
6.4k Jan 05, 2023
675 Dec 23, 2022
1.6k Jan 04, 2023
15 Sep 14, 2022
9.6k Jan 02, 2023