feat: v2.1.0 核心重构与功能增强

## 架构重构 - 全局变量消除，迁移至 Config/State 对象 - SMB 插件融合（smb/smb2/smbghost/smbinfo） - 服务探测重构，实现 Nmap 风格 fallback 机制 - 输出系统重构，TXT 实时刷盘 + 双写机制 - i18n 框架升级至 go-i18n ## 性能优化 - 正则表达式预编译 - 内存优化 map[string]struct{} - 并发指纹匹配 - SOCKS5 连接复用 - 滑动窗口调度 + 自适应线程池 ## 新功能 - Web 管理界面 - 多格式 POC 适配（xray/afrog） - 增强指纹库（3139条） - Favicon hash 指纹识别 - 插件选择性编译（Build Tags） - fscan-lab 靶场环境 - 默认端口扩展（62→133） ## 构建系统 - 添加 no_local tag 支持排除本地插件 - 多版本构建：fscan/fscan-nolocal/fscan-web - CI 添加 snapshot 模式支持仅测试构建 ## Bug 修复 - 修复 120+ 个问题，包括 RDP panic、批量扫描漏报、 JSON 输出格式、Redis 检测、Context 超时等 ## 测试增强 - 单元测试覆盖率 74-100% - 并发安全测试 - 集成测试（Web/端口/服务/SSH/ICMP）
2026-09-24 04:01:52 +08:00 · 2026-01-11 20:16:23 +08:00
parent 6b13b2e84f
commit 71b92d4408
948 changed files with 92335 additions and 24630 deletions
@@ -0,0 +1,21 @@
+db = db.getSiblingDB('admin');
+
+db.createCollection('admin_secrets');
+
+db.admin_secrets.insert({
+    type: 'flag',
+    value: 'FSCAN_LAB{y0u_pwn3d_th3_n3tw0rk}',
+    description: 'Final Flag - Congratulations! You have successfully penetrated the entire network!',
+    achievement: 'Network Penetration Master',
+    timestamp: new Date()
+});
+
+db.admin_secrets.insert({
+    type: 'credentials',
+    service: 'root_access',
+    username: 'root',
+    password: 'RootP@ss2024',
+    notes: 'Full system access - game over!'
+});
+
+print('MongoDB initialized with final flag');
@@ -0,0 +1,36 @@
+-- MSSQL 初始化脚本
+-- 创建 secrets 表并插入 flag10
+
+USE master;
+GO
+
+CREATE TABLE dbo.secrets (
+    id INT IDENTITY(1,1) PRIMARY KEY,
+    key_name NVARCHAR(255) NOT NULL,
+    key_value NVARCHAR(MAX) NOT NULL,
+    created_at DATETIME DEFAULT GETDATE()
+);
+GO
+
+-- 插入 flag10
+INSERT INTO dbo.secrets (key_name, key_value) VALUES
+    ('flag10', 'FSCAN_LAB{mssql_s4_4cc0unt_pwn3d}'),
+    ('db_version', 'Microsoft SQL Server 2022'),
+    ('admin_account', 'sa'),
+    ('production_db', '10.10.3.31');
+GO
+
+-- 创建业务数据表
+CREATE TABLE dbo.employees (
+    id INT IDENTITY(1,1) PRIMARY KEY,
+    name NVARCHAR(100),
+    position NVARCHAR(100),
+    salary DECIMAL(10,2)
+);
+GO
+
+INSERT INTO dbo.employees (name, position, salary) VALUES
+    ('David', 'Manager', 95000.00),
+    ('Eve', 'Developer', 80000.00),
+    ('Frank', 'Designer', 75000.00);
+GO
@@ -0,0 +1,25 @@
+CREATE DATABASE IF NOT EXISTS secrets;
+USE secrets;
+
+CREATE TABLE IF NOT EXISTS flags (
+    id INT PRIMARY KEY,
+    flag VARCHAR(255) NOT NULL,
+    description VARCHAR(255)
+);
+
+CREATE TABLE IF NOT EXISTS credentials (
+    id INT PRIMARY KEY AUTO_INCREMENT,
+    service VARCHAR(50),
+    username VARCHAR(100),
+    password VARCHAR(100),
+    notes TEXT
+);
+
+INSERT INTO flags (id, flag, description) VALUES
+(1, 'FSCAN_LAB{mysql_d4t4b4s3_pwn3d}', 'Flag 6 - MySQL Database'),
+(2, 'Hint: LDAP admin credentials are admin:LdapAdmin2024', 'LDAP Hint');
+
+INSERT INTO credentials (service, username, password, notes) VALUES
+('ldap', 'admin', 'LdapAdmin2024', 'Domain controller admin account'),
+('mongodb', 'admin', 'mongo123', 'MongoDB root password'),
+('backup', 'backup_user', 'Backup@2024', 'Backup system credentials');
@@ -0,0 +1,29 @@
+-- PostgreSQL 初始化脚本
+-- 创建 secrets 表并插入 flag9
+
+CREATE TABLE IF NOT EXISTS secrets (
+    id SERIAL PRIMARY KEY,
+    key VARCHAR(255) NOT NULL,
+    value TEXT NOT NULL,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+);
+
+-- 插入 flag9
+INSERT INTO secrets (key, value) VALUES
+    ('flag9', 'FSCAN_LAB{p0stgr3s_d4t4b4s3_pwn3d}'),
+    ('db_type', 'PostgreSQL 15'),
+    ('admin_email', '[email protected]'),
+    ('backup_server', '10.10.2.22');
+
+-- 创建业务数据表
+CREATE TABLE IF NOT EXISTS users (
+    id SERIAL PRIMARY KEY,
+    username VARCHAR(100),
+    email VARCHAR(255),
+    department VARCHAR(100)
+);
+
+INSERT INTO users (username, email, department) VALUES
+    ('alice', '[email protected]', 'Engineering'),
+    ('bob', '[email protected]', 'Sales'),
+    ('charlie', '[email protected]', 'HR');
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmc1l6L2DsowOUp+IxkDhtHgSAGYXretgoQNcS6S4uZLx51Tw7uzXWoSH0RjY/VJaT6PZ/W3g8tYcTsUegq/Fa2yCgLLQB9l1tJ1SoT/UvbdIolynMTY02vVVLEO9mMxkS3TKIXdrwIcuw6J+4ON5SbZ2WitPwD3fiT0vDlFNlnw5SDHN/8mJgIPOU4WXSEZBgovG6ML1rcfd/MCk8pEi22TMS3xi9Q99wjAGRrNHyYICpeUokP13Q/f881en4aA1Wc88F+GXi/Ql+ySLbDgGl1WQhyCj9uk0JiFPzg6rccdDLaIunTT9beQF1WyXCPNZWMO8XddHfr7sRkzgvSsx office_vpn_key
@@ -0,0 +1,23 @@
+# FRP 服务端配置
+# VPN 网关上运行，用于建立代理隧道到办公网
+
+[common]
+# 监听端口（客户端连接端口）
+bind_port = 7000
+
+# Dashboard 配置（可选，用于查看连接状态）
+dashboard_port = 7500
+dashboard_user = admin
+dashboard_pwd = fscan_lab_frp
+
+# 日志配置
+log_file = /var/log/frps.log
+log_level = info
+log_max_days = 3
+
+# 性能配置
+max_pool_count = 50
+max_ports_per_client = 0
+
+# 认证（这里不启用，因为是内网测试环境）
+# token = your_secret_token
@@ -0,0 +1,16 @@
+#!/bin/bash
+# FRP 服务端启动脚本
+# 在后台启动 frps 服务
+
+echo "[+] 启动 FRP 服务端..."
+nohup /usr/local/bin/frps -c /etc/frp/frps.ini > /var/log/frps.log 2>&1 &
+
+if [ $? -eq 0 ]; then
+    echo "[+] FRP 服务端已启动"
+    echo "[+] 监听端口: 7000"
+    echo "[+] Dashboard: http://10.10.1.13:7500 (admin/fscan_lab_frp)"
+    echo "[+] 日志文件: /var/log/frps.log"
+else
+    echo "[-] FRP 服务端启动失败"
+    exit 1
+fi
@@ -0,0 +1,8 @@
+ls -la
+cd /var/www
+cat config.php
+redis-cli -h 10.10.3.31 -a redis123
+redis-cli -h 10.10.3.31 -a redis123 ping
+ssh [email protected]
+mysql -h 10.10.4.40 -u root -pPassword
+exit
@@ -0,0 +1,42 @@
+#!/bin/bash
+# Elasticsearch 初始化脚本
+# 等待 ES 启动后插入 flag8 数据
+
+sleep 30  # 等待 Elasticsearch 完全启动
+
+# 创建包含 flag8 的索引
+curl -X PUT "localhost:9200/secrets" -H 'Content-Type: application/json' -d'
+{
+  "settings": {
+    "number_of_shards": 1,
+    "number_of_replicas": 0
+  }
+}'
+
+# 插入 flag8 文档
+curl -X POST "localhost:9200/secrets/_doc/1" -H 'Content-Type: application/json' -d'
+{
+  "flag": "FSCAN_LAB{3l4st1cs34rch_un4uth0r1z3d}",
+  "description": "Elasticsearch Unauthorized Access Flag",
+  "network": "production",
+  "service": "elasticsearch",
+  "timestamp": "2024-12-17T00:00:00Z"
+}'
+
+# 插入其他敏感数据
+curl -X POST "localhost:9200/secrets/_doc/2" -H 'Content-Type: application/json' -d'
+{
+  "db_host": "10.10.4.40",
+  "db_type": "MySQL",
+  "db_user": "root",
+  "db_hint": "Check backup server for password"
+}'
+
+curl -X POST "localhost:9200/secrets/_doc/3" -H 'Content-Type: application/json' -d'
+{
+  "redis_host": "10.10.3.31",
+  "redis_password": "redis123",
+  "cache_type": "production"
+}'
+
+echo "Elasticsearch initialized with flag8"
@@ -0,0 +1,6 @@
+#!/bin/bash
+# 这个脚本在 Redis 启动后设置 flag
+sleep 5
+redis-cli -a redis123 SET flag5 "FSCAN_LAB{r3d1s_un4uth0r1z3d_4cc3ss}"
+redis-cli -a redis123 SET hint "Check /root/.ssh for SSH keys to core network"
+echo "Redis flag initialized"
				`@@ -0,0 +1 @@`
				`ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmc1l6L2DsowOUp+IxkDhtHgSAGYXretgoQNcS6S4uZLx51Tw7uzXWoSH0RjY/VJaT6PZ/W3g8tYcTsUegq/Fa2yCgLLQB9l1tJ1SoT/UvbdIolynMTY02vVVLEO9mMxkS3TKIXdrwIcuw6J+4ON5SbZ2WitPwD3fiT0vDlFNlnw5SDHN/8mJgIPOU4WXSEZBgovG6ML1rcfd/MCk8pEi22TMS3xi9Q99wjAGRrNHyYICpeUokP13Q/f881en4aA1Wc88F+GXi/Ql+ySLbDgGl1WQhyCj9uk0JiFPzg6rccdDLaIunTT9beQF1WyXCPNZWMO8XddHfr7sRkzgvSsx office_vpn_key`