feat: v2.1.0 核心重构与功能增强

## 架构重构 - 全局变量消除，迁移至 Config/State 对象 - SMB 插件融合（smb/smb2/smbghost/smbinfo） - 服务探测重构，实现 Nmap 风格 fallback 机制 - 输出系统重构，TXT 实时刷盘 + 双写机制 - i18n 框架升级至 go-i18n ## 性能优化 - 正则表达式预编译 - 内存优化 map[string]struct{} - 并发指纹匹配 - SOCKS5 连接复用 - 滑动窗口调度 + 自适应线程池 ## 新功能 - Web 管理界面 - 多格式 POC 适配（xray/afrog） - 增强指纹库（3139条） - Favicon hash 指纹识别 - 插件选择性编译（Build Tags） - fscan-lab 靶场环境 - 默认端口扩展（62→133） ## 构建系统 - 添加 no_local tag 支持排除本地插件 - 多版本构建：fscan/fscan-nolocal/fscan-web - CI 添加 snapshot 模式支持仅测试构建 ## Bug 修复 - 修复 120+ 个问题，包括 RDP panic、批量扫描漏报、 JSON 输出格式、Redis 检测、Context 超时等 ## 测试增强 - 单元测试覆盖率 74-100% - 并发安全测试 - 集成测试（Web/端口/服务/SSH/ICMP）
2026-09-23 03:31:53 +08:00 · 2026-01-11 20:16:23 +08:00
parent 6b13b2e84f
commit 71b92d4408
948 changed files with 92335 additions and 24630 deletions
@@ -0,0 +1,274 @@
+//go:build plugin_postgresql || !plugin_selective
+
+package services
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"strings"
+
+	_ "github.com/lib/pq" // PostgreSQL driver
+	"github.com/shadow1ng/fscan/common"
+	"github.com/shadow1ng/fscan/common/i18n"
+	"github.com/shadow1ng/fscan/plugins"
+)
+
+// PostgreSQLPlugin PostgreSQL扫描插件
+type PostgreSQLPlugin struct {
+	plugins.BasePlugin
+}
+
+func NewPostgreSQLPlugin() *PostgreSQLPlugin {
+	return &PostgreSQLPlugin{
+		BasePlugin: plugins.NewBasePlugin("postgresql"),
+	}
+}
+
+func (p *PostgreSQLPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+	target := info.Target()
+
+	if config.DisableBrute {
+		return p.identifyService(ctx, info, config, state)
+	}
+
+	// 先测试未授权访问
+	if result := p.testUnauthorizedAccess(ctx, info, config, state); result != nil && result.Success {
+		common.LogSuccess(i18n.Tr("postgresql_vuln", target, result.VulInfo))
+		return result
+	}
+
+	credentials := GenerateCredentials("postgresql", config)
+	if len(credentials) == 0 {
+		return &ScanResult{
+			Success: false,
+			Service: "postgresql",
+			Error:   fmt.Errorf("没有可用的测试凭据"),
+		}
+	}
+
+	// 使用公共框架进行并发凭据测试
+	authFn := p.createAuthFunc(info, config, state)
+	testConfig := DefaultConcurrentTestConfig(config)
+
+	result := TestCredentialsConcurrently(ctx, credentials, authFn, "postgresql", testConfig)
+
+	if result.Success {
+		common.LogSuccess(i18n.Tr("postgresql_credential", target, result.Username, result.Password))
+	}
+
+	return result
+}
+
+// createAuthFunc 创建PostgreSQL认证函数
+func (p *PostgreSQLPlugin) createAuthFunc(info *common.HostInfo, config *common.Config, state *common.State) AuthFunc {
+	return func(ctx context.Context, cred Credential) *AuthResult {
+		return p.doPostgreSQLAuth(ctx, info, cred, config, state)
+	}
+}
+
+// doPostgreSQLAuth 执行PostgreSQL认证
+func (p *PostgreSQLPlugin) doPostgreSQLAuth(ctx context.Context, info *common.HostInfo, cred Credential, config *common.Config, state *common.State) *AuthResult {
+	connStr := fmt.Sprintf("postgres://%s:%s@%s:%d/postgres?sslmode=disable&connect_timeout=%d",
+		cred.Username, cred.Password, info.Host, info.Port, int64(config.Timeout.Seconds()))
+
+	db, err := sql.Open("postgres", connStr)
+	if err != nil {
+		state.IncrementTCPFailedPacketCount()
+		return &AuthResult{
+			Success:   false,
+			ErrorType: classifyPostgreSQLErrorType(err),
+			Error:     err,
+		}
+	}
+
+	db.SetConnMaxLifetime(config.Timeout)
+	db.SetMaxOpenConns(1)
+	db.SetMaxIdleConns(0)
+
+	pingCtx, cancel := context.WithTimeout(ctx, config.Timeout)
+	defer cancel()
+
+	err = db.PingContext(pingCtx)
+	if err != nil {
+		_ = db.Close()
+		state.IncrementTCPFailedPacketCount()
+		return &AuthResult{
+			Success:   false,
+			ErrorType: classifyPostgreSQLErrorType(err),
+			Error:     err,
+		}
+	}
+
+	state.IncrementTCPSuccessPacketCount()
+
+	return &AuthResult{
+		Success:   true,
+		Conn:      &pgDBWrapper{db},
+		ErrorType: ErrorTypeUnknown,
+		Error:     nil,
+	}
+}
+
+// pgDBWrapper 包装 sql.DB 以实现 io.Closer
+type pgDBWrapper struct {
+	*sql.DB
+}
+
+func (w *pgDBWrapper) Close() error {
+	return w.DB.Close()
+}
+
+// classifyPostgreSQLErrorType PostgreSQL错误分类
+func classifyPostgreSQLErrorType(err error) ErrorType {
+	if err == nil {
+		return ErrorTypeUnknown
+	}
+
+	pgAuthErrors := []string{
+		"authentication failed",
+		"password authentication failed",
+		"role does not exist",
+		"invalid authorization",
+		"permission denied",
+		"unauthorized",
+		"invalid credentials",
+		"access denied",
+		"pq: password authentication failed",
+		"pq: role",
+		"pq: invalid authorization specification",
+		"pq: permission denied",
+		"pq: authentication failed",
+		"pq: FATAL: password authentication failed",
+		"pq: FATAL: role",
+	}
+
+	pgNetworkErrors := append(CommonNetworkErrors,
+		"dial tcp",
+		"connection closed",
+		"eof",
+		"network error",
+		"context deadline exceeded",
+		"pq: server closed the connection unexpectedly",
+	)
+
+	return ClassifyError(err, pgAuthErrors, pgNetworkErrors)
+}
+
+// testUnauthorizedAccess 测试PostgreSQL未授权访问
+func (p *PostgreSQLPlugin) testUnauthorizedAccess(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+	connStr := fmt.Sprintf("postgres://postgres@%s:%d/postgres?sslmode=disable&connect_timeout=%d",
+		info.Host, info.Port, int64(config.Timeout.Seconds()))
+
+	db, err := sql.Open("postgres", connStr)
+	if err != nil {
+		return nil
+	}
+	defer func() { _ = db.Close() }()
+
+	db.SetConnMaxLifetime(config.Timeout)
+	db.SetMaxOpenConns(1)
+	db.SetMaxIdleConns(0)
+
+	pingCtx, cancel := context.WithTimeout(ctx, config.Timeout)
+	defer cancel()
+
+	err = db.PingContext(pingCtx)
+	if err != nil {
+		state.IncrementTCPFailedPacketCount()
+		return nil
+	}
+
+	state.IncrementTCPSuccessPacketCount()
+
+	queryCtx, queryCancel := context.WithTimeout(ctx, config.Timeout)
+	defer queryCancel()
+
+	var version string
+	err = db.QueryRowContext(queryCtx, "SELECT version()").Scan(&version)
+	if err != nil {
+		return &ScanResult{
+			Type:    plugins.ResultTypeVuln,
+			Success: true,
+			Service: "postgresql",
+			VulInfo: "未授权访问(trust认证)",
+		}
+	}
+
+	vulInfo := fmt.Sprintf("未授权访问(trust认证) - %s", version)
+	if len(vulInfo) > 100 {
+		vulInfo = vulInfo[:100] + "..."
+	}
+
+	return &ScanResult{
+		Type:    plugins.ResultTypeVuln,
+		Success: true,
+		Service: "postgresql",
+		VulInfo: vulInfo,
+	}
+}
+
+func (p *PostgreSQLPlugin) identifyService(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+	target := info.Target()
+
+	connStr := fmt.Sprintf("postgres://invalid:invalid@%s:%d/postgres?sslmode=disable&connect_timeout=%d",
+		info.Host, info.Port, int64(config.Timeout.Seconds()))
+
+	db, err := sql.Open("postgres", connStr)
+	if err != nil {
+		return &ScanResult{
+			Success: false,
+			Service: "postgresql",
+			Error:   err,
+		}
+	}
+	defer func() { _ = db.Close() }()
+
+	pingCtx, cancel := context.WithTimeout(ctx, config.Timeout)
+	defer cancel()
+
+	err = db.PingContext(pingCtx)
+
+	if err != nil {
+		state.IncrementTCPFailedPacketCount()
+	} else {
+		state.IncrementTCPSuccessPacketCount()
+	}
+
+	var banner string
+	if err != nil {
+		errMsg := strings.ToLower(err.Error())
+		if strings.Contains(errMsg, "postgres") ||
+			strings.Contains(errMsg, "authentication") ||
+			strings.Contains(errMsg, "database") ||
+			strings.Contains(errMsg, "password") ||
+			strings.Contains(errMsg, "role") ||
+			strings.Contains(errMsg, "user") ||
+			strings.Contains(errMsg, "pq:") {
+			banner = "PostgreSQL"
+		} else {
+			return &ScanResult{
+				Success: false,
+				Service: "postgresql",
+				Error:   fmt.Errorf("无法识别为PostgreSQL服务"),
+			}
+		}
+	} else {
+		banner = "PostgreSQL"
+	}
+
+	common.LogSuccess(i18n.Tr("postgresql_service", target, banner))
+
+	return &ScanResult{
+		Type:    plugins.ResultTypeService,
+		Success: true,
+		Service: "postgresql",
+		Banner:  banner,
+	}
+}
+
+func init() {
+	RegisterPluginWithPorts("postgresql", func() Plugin {
+		return NewPostgreSQLPlugin()
+	}, []int{5432, 5433, 5434})
+}