如何通过网站查找不同的 XPATH 值

Question

# import selenium
from selenium import webdriver
# lets you use the any by element statements
from selenium.webdriver.common.by import By
# start the webdriver for chrome
from selenium.webdriver.chrome.service import Service
# import locate_with for above, below
from selenium.webdriver.support.relative_locator import locate_with
# declare the path as the service using the letter s
s = Service('C:\ChromeDriver\chromedriver.exe')
# declare the web driver using the service as the browser
driver = webdriver.Chrome(service=s)

# declare the URL
url = 'https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321'
# get the url referenced above using the browser.get
driver.get(url)
# tells the driver to wait 10 seconds so the page can load the "DOM"
driver.implicitly_wait(10)

VN = driver.find_element(By.XPATH, '//h1').text
print("System Impacted: " + VN)
CVSS = driver.find_element(By.XPATH, '//*[@id="title"]/div/div/div/div[3]/div[1]/div/div/label').text
print("CVSS Detail is: " + CVSS)

**AV = driver.find_element(By.XPATH, '//summary[normalize-space()="Network"]').text
print("Attack Vector: " + AV)**

我正在尝试扫描 URL 并获取有关“攻击向量”字段的相关信息

其中之一是在不同漏洞中找到攻击向量的价值 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321

对于 CVE，每个 xpath 都不同，例如：

//summary[normalize-space()="Network"] or 
//summary[normalize-space()="Local"] or 
//summary[normalize-space()="Physical"] 

当我每次为 CVE 输入不同的 URL 时，我想打印出其中一个攻击向量，具体取决于 URL 捕获的与 CVE 关联的攻击向量的内容

Answer 1

您可以使用以下Locator Strategies：

• CVE-2021-42321

  • 代码块：

    driver.get("https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321")
    print("System Impacted: " + WebDriverWait(driver, 20).until(EC.visibility_of_element_located((By.XPATH, "//h1[text()]"))).text)
    print("CVSS Detail is: " + WebDriverWait(driver, 20).until(EC.visibility_of_element_located((By.XPATH, "//label[starts-with(@class, 'ms-Label') and starts-with(., 'CVSS')]"))).text)
    WebDriverWait(driver, 20).until(EC.element_to_be_clickable((By.XPATH, "//summary[contains(., 'Attack Vector')]//following::summary[1]"))).click()
    print("Attack Vector: " + WebDriverWait(driver, 20).until(EC.visibility_of_element_located((By.XPATH, "//summary[contains(., 'Attack Vector')]//following::summary[1]//following-sibling::div[1]/div"))).text)
    driver.quit() 
    

  • 控制台输出：

    System Impacted: Microsoft Exchange Server Remote Code Execution Vulnerability
    CVSS Detail is: CVSS:3.1 8.8 / 7.7
    Attack Vector: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
    

• CVE-2021-43209

  • 代码块：

    driver.get("https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43209")
    print("System Impacted: " + WebDriverWait(driver, 20).until(EC.visibility_of_element_located((By.TAG_NAME, "h1"))).text)
    print("CVSS Detail is: " + WebDriverWait(driver, 20).until(EC.visibility_of_element_located((By.XPATH, "//label[starts-with(@class, 'ms-Label') and starts-with(., 'CVSS')]"))).text)
    WebDriverWait(driver, 20).until(EC.element_to_be_clickable((By.XPATH, "//summary[contains(., 'Attack Vector')]//following::summary[1]"))).click()
    print("Attack Vector: " + WebDriverWait(driver, 20).until(EC.visibility_of_element_located((By.XPATH, "//summary[contains(., 'Attack Vector')]//following::summary[1]//following-sibling::div[1]/div"))).text)
    driver.quit()  
    

  • 控制台输出：

    System Impacted: 3D Viewer Remote Code Execution Vulnerability
    CVSS Detail is: CVSS:3.1 7.8 / 6.8
    Attack Vector: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document)
    

• 注意：您必须添加以下导入：

  from selenium.webdriver.support.ui import WebDriverWait
  from selenium.webdriver.common.by import By
  from selenium.webdriver.support import expected_conditions as EC