Skip to content

Commit 7740374

Browse files
hktalenthktalent
committed
up 2022-10-06
1 parent 7b4a398 commit 7740374

File tree

21 files changed

+326
-185
lines changed

21 files changed

+326
-185
lines changed

‎brute/dicts/filedic.txt

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3419,7 +3419,10 @@ $metadata
34193419
2022.sql
34203420
2022.sql.tar.gz
34213421
2022.sql.zip
3422+
2022.tar
3423+
2022.tar.bz2
34223424
2022.tar.gz
3425+
2022.tgz
34233426
2022.txt.gz
34243427
2022.zip
34253428
2022_dump.sql
@@ -10923,6 +10926,7 @@ components/login.ascx
1092310926
components/raiz0worm_1618449492.php
1092410927
compose.sh
1092510928
composer
10929+
composer-bx.json
1092610930
composer.json
1092710931
composer.lock
1092810932
composer.phar
@@ -23347,6 +23351,7 @@ public/web/css/add//index.css
2334723351
public/web/js/add/com.js
2334823352
public_html
2334923353
public_html.sql
23354+
public_html/
2335023355
public_html/.env
2335123356
public_html/robots.txt
2335223357
public_root/.env
@@ -26621,6 +26626,9 @@ systemsoft
2662126626
systemstatus.xml
2662226627
sysuser
2662326628
sz.php
26629+
szUrl
26630+
szUrl.jsp
26631+
szUrl.php
2662426632
szeredi
2662526633
szewo
2662626634
sánchez
@@ -27943,13 +27951,10 @@ ur-admin/
2794327951
urban
2794427952
uresk
2794527953
uri
27946-
szUrl
27947-
szUrl.jsp
27948-
szUrl.php
27949-
url_1.sql
27950-
url_2.sql
2795127954
urlList.
2795227955
urlList.txt.gz
27956+
url_1.sql
27957+
url_2.sql
2795327958
urlmem-app/.env
2795427959
urlogy
2795527960
urls.py
@@ -30604,4 +30609,4 @@ zzz.php
3060430609
带回显执行cmd.jsp
3060530610
灭天远程管理.jsp
3060630611
灭天远程管理.jsp~
30607-
内网渗透探测out.jsp".t.jsp!.gitignore
30612+
内网渗透探测out.jsp".t.jsp

‎brute/filefuzz.go

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,11 @@ func FileFuzz(u string, indexStatusCode int, indexContentLength int, indexbody s
165165
path []string // 成功页面路径
166166
)
167167
url404, url404req, err, ok := util.TestIs404Page(u) //reqPage(u + path404)
168-
if err == nil && ok {
168+
if err == nil && ok && nil != url404req {
169+
// 升级协议
170+
if "" != url404req.Protocol && !strings.Contains(url404req.Protocol, "HTTP/1.") {
171+
u = "https://" + u01.Host + "/"
172+
}
169173
go util.CheckHeader(url404req.Header, u)
170174
// 跳过当前目标所有的fuzz,后续所有的fuzz都无意义了
171175
if 200 == url404.StatusCode || 301 == url404.StatusCode || 302 == url404.StatusCode {
@@ -195,6 +199,9 @@ func FileFuzz(u string, indexStatusCode int, indexContentLength int, indexbody s
195199
var async_technologies = make(chan []string, util.Fuzzthreads*2)
196200
// 字典长度的 70% 的错误
197201
var MaxErrorTimes int32 = int32(float32(len(filedic)) * 0.7)
202+
if strings.HasPrefix(url404req.Protocol, "HTTP/2") || strings.HasPrefix(url404req.Protocol, "HTTP/3") {
203+
MaxErrorTimes = int32(len(filedic))
204+
}
198205
//defer func() {
199206
// close(ch)
200207
// close(async_data)

‎config/config.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@
7474
"priorityNmap": true,
7575
"noScan": false,
7676
"enableMultNuclei": false,
77-
"enableNuclei": true,
77+
"enableNuclei": false,
7878
"nuclei": {
7979
"Severities": [5,4,3],
8080
"RateLimit": 150,

‎go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ require (
101101
github.com/google/go-github v17.0.0+incompatible
102102
github.com/gorilla/websocket v1.5.0
103103
github.com/gosnmp/gosnmp v1.35.0
104-
github.com/hktalent/PipelineHttp v0.0.0-20221005170636-4c4c7c3108ea
104+
github.com/hktalent/PipelineHttp v0.0.0-20221006120713-f0d2d692285e
105105
github.com/hktalent/goSqlite_gorm v1.1.1
106106
github.com/hktalent/jarm-go v0.0.0-20220918133110-7801447b6267
107107
github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358
@@ -314,7 +314,7 @@ require (
314314
go.uber.org/zap v1.23.0 // indirect
315315
goftp.io/server/v2 v2.0.0 // indirect
316316
golang.org/x/exp v0.0.0-20221004215720-b9f4876ce741 // indirect
317-
golang.org/x/mod v0.6.0-dev.0.20220922195421-2adab6b8c60e // indirect
317+
golang.org/x/mod v0.6.0-dev.0.20221005201717-2666ed6287c1 // indirect
318318
golang.org/x/sync v0.0.0-20220907140024-f12130a52804 // indirect
319319
golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 // indirect
320320
golang.org/x/tools v0.1.12 // indirect

‎go.sum

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -518,6 +518,30 @@ github.com/hktalent/PipelineHttp v0.0.0-20221005141854-655e41c6acad h1:NFVuThP+N
518518
github.com/hktalent/PipelineHttp v0.0.0-20221005141854-655e41c6acad/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
519519
github.com/hktalent/PipelineHttp v0.0.0-20221005170636-4c4c7c3108ea h1:riOxhSWDEbwbNFgCxBUkOsTYhZte/I+6Khf9Pab7uxU=
520520
github.com/hktalent/PipelineHttp v0.0.0-20221005170636-4c4c7c3108ea/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
521+
github.com/hktalent/PipelineHttp v0.0.0-20221006042931-50e9738e9fa2 h1:Tg8VVpQY+Q/VY+Hktp5GzH3UX+9Wn9TAzg19i/MsSCA=
522+
github.com/hktalent/PipelineHttp v0.0.0-20221006042931-50e9738e9fa2/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
523+
github.com/hktalent/PipelineHttp v0.0.0-20221006043319-d0b0b81444e9 h1:RST32dMeocSC1gaNIV9dr+nUm5+j1Tl/P4NlASpjV80=
524+
github.com/hktalent/PipelineHttp v0.0.0-20221006043319-d0b0b81444e9/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
525+
github.com/hktalent/PipelineHttp v0.0.0-20221006050639-12d87d75cbb0 h1:kid3mPBRHpXqIfwu6J+8WOJHddluw0yiMB78ULqn1Ek=
526+
github.com/hktalent/PipelineHttp v0.0.0-20221006050639-12d87d75cbb0/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
527+
github.com/hktalent/PipelineHttp v0.0.0-20221006052353-35d1b8a29240 h1:4M1Kwakhi8CUsXi+8zChYHkmn4YPRXoJf85U+YXDkco=
528+
github.com/hktalent/PipelineHttp v0.0.0-20221006052353-35d1b8a29240/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
529+
github.com/hktalent/PipelineHttp v0.0.0-20221006061142-6d1c9910a885 h1:JVeoRVv1xq6tk9MaG2MTrnq551O/OcOwuW6CuqN+FSo=
530+
github.com/hktalent/PipelineHttp v0.0.0-20221006061142-6d1c9910a885/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
531+
github.com/hktalent/PipelineHttp v0.0.0-20221006063238-3152c63b243e h1:/YPFONUnpnhqa5xD+44+HjdjnBS+8O8b9hPjD5969p4=
532+
github.com/hktalent/PipelineHttp v0.0.0-20221006063238-3152c63b243e/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
533+
github.com/hktalent/PipelineHttp v0.0.0-20221006065030-cc56ca1f2105 h1:fOM6qSiVU17lxCYlEdNssNyfjNxWS+8i4yW1x2rBXLk=
534+
github.com/hktalent/PipelineHttp v0.0.0-20221006065030-cc56ca1f2105/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
535+
github.com/hktalent/PipelineHttp v0.0.0-20221006072228-9ee8802d3fa4 h1:XR3LsI8g3WYmKdzIdQh7HldzrdUlwTwYAEDtOdn8prw=
536+
github.com/hktalent/PipelineHttp v0.0.0-20221006072228-9ee8802d3fa4/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
537+
github.com/hktalent/PipelineHttp v0.0.0-20221006080839-6f699ce90f4d h1:jjgWWqXlQPXKnhLasC4oqMaat2pJ7i7ikQbJLoDZfio=
538+
github.com/hktalent/PipelineHttp v0.0.0-20221006080839-6f699ce90f4d/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
539+
github.com/hktalent/PipelineHttp v0.0.0-20221006083938-811ae05bcab2 h1:uydQn2QkVQ9O8gdDPj4pawpIX4jNt7DIWbat7xrLO3M=
540+
github.com/hktalent/PipelineHttp v0.0.0-20221006083938-811ae05bcab2/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
541+
github.com/hktalent/PipelineHttp v0.0.0-20221006102853-7270ca9cc3dc h1:dz5vNFzfGCCg3cq/vxNUzCXqKCTLiCHZDeBQBubZ0WY=
542+
github.com/hktalent/PipelineHttp v0.0.0-20221006102853-7270ca9cc3dc/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
543+
github.com/hktalent/PipelineHttp v0.0.0-20221006120713-f0d2d692285e h1:6Iy5XhPWznVIQEXJNFeE/RyXe3wrIfIjybW/yLAbch4=
544+
github.com/hktalent/PipelineHttp v0.0.0-20221006120713-f0d2d692285e/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
521545
github.com/hktalent/go-utils v0.0.0-20221004021941-7e10e0fb13ea h1:vuxZbB9vAwBi0Uj4F5GOfVtsi5E9MFX07EkCKypVu9M=
522546
github.com/hktalent/go-utils v0.0.0-20221004021941-7e10e0fb13ea/go.mod h1:9E0C0K+/zzyJ+VqFx1llC3y7+mGgW3toLoyMQnlNXhw=
523547
github.com/hktalent/go-utils v0.0.0-20221004095234-2e23f13b429d h1:z1IUP4hqn0LGgs78bU2gSlna92/p+RlB0MSZ+RxSmCo=
@@ -1282,6 +1306,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
12821306
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
12831307
golang.org/x/mod v0.6.0-dev.0.20220922195421-2adab6b8c60e h1:WhB000cGjOfbJiedMGvJkMTclI18VD69w27k+sceql8=
12841308
golang.org/x/mod v0.6.0-dev.0.20220922195421-2adab6b8c60e/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
1309+
golang.org/x/mod v0.6.0-dev.0.20221005201717-2666ed6287c1 h1:OA6fBHK4jYnCov6kv7N79LNg3i6uYzpaWyGPbCuBz1s=
1310+
golang.org/x/mod v0.6.0-dev.0.20221005201717-2666ed6287c1/go.mod h1:GcdizjqnHZfplEsgKNRaCUIjLeLmr0f33PF1GTBHBso=
12851311
golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
12861312
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
12871313
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=

‎lib/test/test.go

Lines changed: 36 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,45 @@
11
package main
22

33
import (
4-
"github.com/hktalent/scan4all/lib/socket"
5-
"io/ioutil"
4+
"fmt"
5+
"github.com/hktalent/scan4all/lib/util"
6+
"log"
7+
"sync"
68
)
79

810
func main() {
11+
//
12+
//data, err := ioutil.ReadFile("/Users/51pwn/MyWork/TestPoc/JRMPListener.ser")
13+
//if nil == err {
14+
// x1 := socket.NewCheckTarget("http://127.0.0.1:4444", "tcp", 15)
15+
// x1.SendPayload(data, 15)
16+
// x1.Close()
17+
//}
18+
//
19+
//x1 := PipelineHttp.NewPipelineHttp()
20+
////x1.ErrLimit = 9999999
21+
//defer x1.Close()
22+
//x1.DoGet("https://127.0.0.1:8081/scan4all", func(resp *http.Response, err error, szU string) {
23+
// if nil != resp {
24+
// log.Println(resp.StatusCode)
25+
// }
26+
//})
27+
var Wg = sync.WaitGroup{}
28+
// 单独测试没有问题
29+
for i := 33; i < 8082; i++ {
30+
Wg.Add(1)
31+
go func(n int) {
32+
defer Wg.Done()
33+
s1 := fmt.Sprintf("http://127.0.0.1:%d/scan4all", n)
34+
if resp, err := util.HttpRequset(s1, "GET", "", false, nil); nil == err {
35+
log.Println(resp.StatusCode, s1)
36+
} else {
37+
if n == 8081 {
38+
log.Println(err)
39+
}
40+
}
41+
}(i)
942

10-
data, err := ioutil.ReadFile("/Users/51pwn/MyWork/TestPoc/JRMPListener.ser")
11-
if nil == err {
12-
x1 := socket.NewCheckTarget("http://127.0.0.1:4444", "tcp", 15)
13-
x1.SendPayload(data, 15)
14-
x1.Close()
1543
}
44+
Wg.Wait()
1645
}

‎lib/util/config.go

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
"io/ioutil"
1414
"log"
1515
"math/rand"
16-
"net/http"
1716
"os"
1817
"os/exec"
1918
"reflect"
@@ -441,20 +440,31 @@ func TestIs404(szUrl string) (r01 *Response, err error, ok bool) {
441440
sz404 := szUrl + Abs404
442441
client := GetClient(sz404)
443442
if nil != client {
444-
client.Client.Timeout = 5
443+
//client.Client.Timeout = 500
444+
//client.ErrCount = 0
445+
//client.ErrLimit = 9999
445446
//log.Printf("%v %s \n", client, sz404)
446-
var x05 *http.Transport = client.Client.Transport.(*http.Transport)
447-
if nil != x05 {
448-
x05.DisableKeepAlives = true
449-
}
450447
}
451448

452-
log.Println("start test ", sz404)
453-
r01, err = HttpRequset(sz404, "GET", "", false, map[string]string{"Connection": "close"})
449+
//log.Println("start test ", sz404)
450+
var mh1 map[string]string
451+
if strings.HasPrefix(sz404, "http://") {
452+
mh1 = map[string]string{
453+
//"Connection": "close",
454+
"Content-Type": "",
455+
}
456+
}
457+
r01, err = HttpRequset(sz404, "GET", "", false, mh1)
454458
ok = err == nil && nil != r01 && 404 == r01.StatusCode
459+
if nil != err {
460+
CloseHttpClient(sz404)
461+
//log.Println(sz404, err)
462+
} else {
463+
log.Printf("%d %s %s\n", r01.StatusCode, r01.Protocol, sz404)
464+
}
455465
noRpt.Set(key, []interface{}{r01, err, ok}, defaultInteractionDuration)
456466
//client.Client.Timeout = 10
457-
log.Println("end test ", sz404)
467+
//log.Println("end test ", sz404)
458468
return r01, err, ok
459469
}
460470
func TestIs404Page(szUrl string) (page *Page, r01 *Response, err error, ok bool) {

‎lib/util/config_test.go

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
package util
2+
3+
import (
4+
"fmt"
5+
"sync"
6+
"testing"
7+
)
8+
9+
func TestTestIs404(t *testing.T) {
10+
Init2()
11+
var Wg = sync.WaitGroup{}
12+
// 单独测试没有问题
13+
for i := 8070; i < 8082; i++ {
14+
Wg.Add(1)
15+
go func(n int) {
16+
defer Wg.Done()
17+
s1 := fmt.Sprintf("https://127.0.0.1:%d/scan4all", n)
18+
if resp, err, ok := TestIs404(s1); ok && nil == err {
19+
t.Log(resp.StatusCode, s1)
20+
} else {
21+
if n == 8081 && nil != err {
22+
t.Error(s1, err)
23+
}
24+
}
25+
}(i)
26+
27+
}
28+
Wg.Wait()
29+
}

‎lib/util/modle.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,10 @@ type Response struct {
88
StatusCode int
99
Body string
1010
Header *http.Header // 不用负责对象，引用，节约内存开销
11-
ContentLength int
12-
RequestUrl string
13-
Location string
11+
ContentLength int `json:"content_length"`
12+
RequestUrl string `json:"request_url"`
13+
Location string `json:"location"`
14+
Protocol string `json:"protocol"`
1415
}
1516

1617
// fuzz请求返回的结果

‎lib/util/sv2es.go

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package util
22

33
import (
4+
"bytes"
45
"crypto/sha1"
56
"encoding/hex"
67
"encoding/json"
@@ -87,12 +88,14 @@ func SendReq(data1 interface{}, id string, szType ESaveType) {
8788
<-nThreads
8889
}()
8990
szUrl := fmt.Sprintf(EsUrl, szType, url.QueryEscape(id))
90-
log.Println("logs EsUrl = ", EsUrl)
91+
//log.Println("logs EsUrl = ", EsUrl)
9192
m1 := map[string]string{
9293
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15",
9394
"Content-Type": "application/json;charset=UTF-8",
9495
}
95-
SendData2Url(szUrl, data1, &m1, func(resp *http.Response, err error, szU string) {
96+
c1 := GetClient(szUrl, map[string]interface{}{"UseHttp2": true})
97+
data, _ := json.Marshal(data1)
98+
c1.DoGetWithClient4SetHd(c1.GetClient4Http2(), szUrl, "POST", bytes.NewReader(data), func(resp *http.Response, err error, szU string) {
9699
if nil != err {
97100
log.Println("pphLog.DoGetWithClient4SetHd ", err)
98101
} else {
@@ -103,6 +106,8 @@ func SendReq(data1 interface{}, id string, szType ESaveType) {
103106
Log(err)
104107
}
105108
}
106-
})
109+
}, func() map[string]string {
110+
return m1
111+
}, true)
107112
})
108113
}

0 commit comments

Comments
 (0)