Skip to content

Commit 10dd083

Browse files
x51pwnx51pwn
committed
fix 1、优化内存开销 2、支持url类型指纹 2022-07-14 11:58:1657771098
1 parent 842d391 commit 10dd083

File tree

19 files changed

+1894
-107
lines changed

19 files changed

+1894
-107
lines changed

‎.github/up.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,7 @@ go mod vendor
55
# 工具静态分析代码实现
66
go vet
77

8+
cat ./pkg/fingerprint/dicts/eHoleFinger.json|jq ".fingerprint[].cms"|wc -l
9+
cat ./pkg/fingerprint/dicts/localFinger.json|jq ".fingerprint[].cms"|wc -l
10+
cat ./pkg/fingerprint/dicts/fg.json|jq ".[].kind"|wc -l
811

‎brute/filefuzz.go

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package brute
22

33
import (
44
_ "embed"
5+
"fmt"
56
"github.com/antlabs/strsim"
67
"github.com/hktalent/scan4all/pkg"
78
"log"
@@ -111,8 +112,13 @@ func init() {
111112
//regs = append(regs, ret...)
112113
}
113114

115+
var eableFileFuzz = "true" != pkg.GetValByDefault("enablFileFuzz", "false")
116+
114117
// 文件fuzz
115118
func FileFuzz(u string, indexStatusCode int, indexContentLength int, indexbody string) ([]string, []string) {
119+
if eableFileFuzz {
120+
return []string{}, []string{}
121+
}
116122
u01, err := url.Parse(u)
117123
if nil == err {
118124
u = u01.Scheme + "://" + u01.Host + "/"
@@ -177,7 +183,10 @@ func FileFuzz(u string, indexStatusCode int, indexContentLength int, indexbody s
177183
if strings.HasPrefix(payload, "/") && endP {
178184
szUrl = u + payload[1:]
179185
}
180-
log.Println("fuzz: ", szUrl)
186+
if 0 < log.Flags() {
187+
fmt.Printf("fuzz: %s\r", szUrl)
188+
//log.Println("fuzz: ", szUrl)
189+
}
181190
if url, req, err := reqPage(szUrl); err == nil {
182191
// 403 by pass
183192
if url.is403 {

‎config/config.json

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,10 +58,19 @@
5858
"priorityNmap": true,
5959
"nuclei": {},
6060
"enablEmbedYaml": true,
61-
"httpx": {},
61+
"enablFileFuzz": true,
62+
"httpx": {
63+
"Pipeline": true,
64+
"HTTP2Probe": true,
65+
"VHost": true,
66+
"CSPProbe": true,
67+
"TLSProbe": true,
68+
"TechDetect": true
69+
},
6270
"enableEsSv": false,
6371
"esthread": 8,
6472
"hydrathread": 8,
6573
"Fuzzthreads": 32,
74+
"enableFingerTitleHeaderMd5Hex": false,
6675
"esUrl": "http://127.0.0.1:9200/%s_index/_doc/%s"
6776
}

‎config/config_me.json

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,15 @@
5858
"nuclei": {},
5959
"priorityNmap": true,
6060
"enablEmbedYaml": true,
61-
"httpx": {},
61+
"enablFileFuzz": true,
62+
"httpx": {
63+
"Pipeline": true,
64+
"HTTP2Probe": true,
65+
"VHost": true,
66+
"CSPProbe": true,
67+
"TLSProbe": true,
68+
"TechDetect": true
69+
},
6270
"enableEsSv": true,
6371
"esthread": 8,
6472
"esUrl": "http://127.0.0.1:9200/%s_index/_doc/%s"

‎config/doNmapScan.sh

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,10 @@
22
XRate=5000
33
function doMasScan {
44
if [[ -f $1 ]] ; then
5-
echo $PPSSWWDD|sudo -S nmap -F --top-ports=65535 -n --unique --resolve-all -Pn -sS --min-hostgroup 64 --max-retries 0 --host-timeout 10m --script-timeout 3m --version-intensity 9 --min-rate ${XRate} -T4 -iL $1 -oX $2
5+
# -F --top-ports=65535
6+
echo $PPSSWWDD|sudo -S nmap -p 80,443 -n --unique --resolve-all -Pn -sS --min-hostgroup 64 --max-retries 0 --host-timeout 10m --script-timeout 3m --version-intensity 9 --min-rate ${XRate} -T4 -iL $1 -oX $2
67
else
7-
echo $PPSSWWDD|sudo -S nmap -F --top-ports=65535 -n --unique --resolve-all -Pn -sS --min-hostgroup 64 --max-retries 0 --host-timeout 10m --script-timeout 3m --version-intensity 9 --min-rate ${XRate} -T4 $1 -oX $2
8+
echo $PPSSWWDD|sudo -S nmap -p 80,443 -n --unique --resolve-all -Pn -sS --min-hostgroup 64 --max-retries 0 --host-timeout 10m --script-timeout 3m --version-intensity 9 --min-rate ${XRate} -T4 $1 -oX $2
89
fi
910
}
1011
doMasScan $1 $2

‎config/nuclei-templates/exposed-panels/smartping-dashboard.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
id: smartping-dashboard
2+
3+
info:
4+
name: Unauth SmartPing Dashboard
5+
author: DhiyaneshDk
6+
severity: low
7+
metadata:
8+
verified: true
9+
shodan-query: title:"SmartPing Dashboard"
10+
tags: panel,misconfig,unauth,smartping
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}/config.html"
16+
17+
matchers-condition: and
18+
matchers:
19+
20+
- type: word
21+
part: body
22+
words:
23+
- 'SmartPing Dashboard'
24+
25+
- type: status
26+
status:
27+
- 200

‎db/vhost.txt

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
%s
2+
127.0.0.1
3+
admin
4+
admin.%s
5+
administration
6+
administration.%s
7+
ads
8+
adserver
9+
alerts
10+
alpha
11+
alpha.%s
12+
ap
13+
apache
14+
api
15+
app
16+
apps
17+
appserver
18+
aptest
19+
auth
20+
backup
21+
beta
22+
beta.%s
23+
blog
24+
cdn
25+
chat
26+
citrix
27+
cms
28+
corp
29+
crs
30+
cvs
31+
dashboard
32+
database
33+
db
34+
demo
35+
dev
36+
dev.%s
37+
devel
38+
development
39+
development.%s
40+
devsql
41+
devtest
42+
dhcp
43+
direct
44+
dmz
45+
dns
46+
dns0
47+
dns1
48+
dns2
49+
download
50+
en
51+
erp
52+
eshop
53+
exchange
54+
f5
55+
fileserver
56+
firewall
57+
forum
58+
ftp
59+
ftp0
60+
git
61+
gw
62+
help
63+
helpdesk
64+
home
65+
host
66+
http
67+
id
68+
images
69+
info
70+
internal
71+
internet
72+
intra
73+
intranet
74+
ipv6
75+
lab
76+
ldap
77+
linux
78+
local
79+
localhost
80+
log
81+
m
82+
m.%s
83+
mail
84+
mail2
85+
mail3
86+
mailgate
87+
main
88+
manage
89+
mgmt
90+
mirror
91+
mobile
92+
mobile.%s
93+
monitor
94+
mssql
95+
mta
96+
mx
97+
mx0
98+
mx1
99+
mysql
100+
news
101+
noc
102+
ns
103+
ns0
104+
ns1
105+
ns2
106+
ns3
107+
ntp
108+
old
109+
old.%s
110+
ops
111+
oracle
112+
owa
113+
pbx
114+
portal
115+
s3
116+
secure
117+
secure.%s
118+
server
119+
sharepoint
120+
shop
121+
sip
122+
smtp
123+
sql
124+
squid
125+
ssh
126+
ssl
127+
stage
128+
staging
129+
staging.%s
130+
stats
131+
status
132+
status.%s
133+
svn
134+
syslog
135+
test
136+
test1
137+
test2
138+
testing
139+
uat
140+
uat.%s
141+
upload
142+
v1
143+
v1.%s
144+
v2
145+
v2.%s
146+
v3
147+
v3.%s
148+
vm
149+
vnc
150+
voip
151+
vpn
152+
web
153+
web2test
154+
whois
155+
wiki
156+
www
157+
www.%s
158+
www2
159+
xml
160+
administrator
161+
webmail
162+
door
163+
phone
164+
lol
165+
test
166+
tester
167+
vmm
168+
local
169+
localadmin
170+
admin10
171+
admin01
172+
blogadmin
173+
about

0 commit comments

Comments
 (0)