archive/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2026-09-26 05:01:53 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

tighten scan session and HTTP paths

Browse Source
This commit is contained in:
ZacharyZcR
2026-05-23 07:46:53 +08:00
parent 1a714f6a0c
commit 3c7823355d
7 changed files with 89 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/services/neo4j.go
+14 -18
View File
@@ -27,15 +27,14 @@ func NewNeo4jPlugin() *Neo4jPlugin {
func (p *Neo4jPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
config := session.Config
state := session.State
target := info.Target()
if config.DisableBrute {
return p.identifyService(ctx, info, config, state)
return p.identifyService(ctx, info, session)
}
// 先测试未授权访问
if result := p.testUnauthorizedAccess(ctx, info, config, state); result != nil && result.Success {
if result := p.testUnauthorizedAccess(ctx, info, session); result != nil && result.Success {
common.LogVuln(i18n.Tr("neo4j_unauth", target))
return result
}
@@ -50,7 +49,7 @@ func (p *Neo4jPlugin) Scan(ctx context.Context, info *common.HostInfo, session *
}
// 使用公共框架进行并发凭据测试
authFn := p.createAuthFunc(info, config, state)
authFn := p.createAuthFunc(info, session)
testConfig := DefaultConcurrentTestConfigWithTarget(config, info)
result := TestCredentialsConcurrently(ctx, credentials, authFn, "neo4j", testConfig)
@@ -63,14 +62,15 @@ func (p *Neo4jPlugin) Scan(ctx context.Context, info *common.HostInfo, session *
}
// createAuthFunc 创建Neo4j认证函数
func (p *Neo4jPlugin) createAuthFunc(info *common.HostInfo, config *common.Config, state *common.State) AuthFunc {
func (p *Neo4jPlugin) createAuthFunc(info *common.HostInfo, session *common.ScanSession) AuthFunc {
return func(ctx context.Context, cred Credential) *AuthResult {
return p.doNeo4jAuth(ctx, info, cred, config, state)
return p.doNeo4jAuth(ctx, info, cred, session)
}
}
// doNeo4jAuth 执行Neo4j认证
func (p *Neo4jPlugin) doNeo4jAuth(ctx context.Context, info *common.HostInfo, cred Credential, config *common.Config, state *common.State) *AuthResult {
func (p *Neo4jPlugin) doNeo4jAuth(ctx context.Context, info *common.HostInfo, cred Credential, session *common.ScanSession) *AuthResult {
config := session.Config
baseURL := fmt.Sprintf("http://%s:%d", info.Host, info.Port)
client := &http.Client{Timeout: config.Timeout}
@@ -87,16 +87,14 @@ func (p *Neo4jPlugin) doNeo4jAuth(ctx context.Context, info *common.HostInfo, cr
req.SetBasicAuth(cred.Username, cred.Password)
req.Header.Set("Content-Type", "application/json")
resp, err := client.Do(req)
resp, err := session.HTTPDo(client, req)
if err != nil {
state.IncrementTCPFailedPacketCount()
return &AuthResult{
Success: false,
ErrorType: classifyNeo4jErrorType(err),
Error: err,
}
}
state.IncrementTCPSuccessPacketCount()
defer func() { _ = resp.Body.Close() }()
if resp.StatusCode == 200 {
@@ -147,7 +145,8 @@ func classifyNeo4jErrorType(err error) ErrorType {
return ClassifyError(err, neo4jAuthErrors, CommonNetworkErrors)
}
func (p *Neo4jPlugin) testUnauthorizedAccess(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
func (p *Neo4jPlugin) testUnauthorizedAccess(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
config := session.Config
baseURL := fmt.Sprintf("http://%s:%d", info.Host, info.Port)
client := &http.Client{Timeout: config.Timeout}
@@ -157,12 +156,10 @@ func (p *Neo4jPlugin) testUnauthorizedAccess(ctx context.Context, info *common.H
return nil
}
resp, err := client.Do(req)
resp, err := session.HTTPDo(client, req)
if err != nil {
state.IncrementTCPFailedPacketCount()
return nil
}
state.IncrementTCPSuccessPacketCount()
defer func() { _ = resp.Body.Close() }()
if resp.StatusCode == 200 {
@@ -177,7 +174,8 @@ func (p *Neo4jPlugin) testUnauthorizedAccess(ctx context.Context, info *common.H
return nil
}
func (p *Neo4jPlugin) identifyService(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
func (p *Neo4jPlugin) identifyService(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
config := session.Config
target := info.Target()
baseURL := fmt.Sprintf("http://%s:%d", info.Host, info.Port)
@@ -192,16 +190,14 @@ func (p *Neo4jPlugin) identifyService(ctx context.Context, info *common.HostInfo
}
}
resp, err := client.Do(req)
resp, err := session.HTTPDo(client, req)
if err != nil {
state.IncrementTCPFailedPacketCount()
return &ScanResult{
Success: false,
Service: "neo4j",
Error: err,
}
}
state.IncrementTCPSuccessPacketCount()
defer func() { _ = resp.Body.Close() }()
var banner string