已加入yaml解析引擎,支持xray的Poc,默认使用所有Poc(已对xray的poc进行了筛选),可以使用-pocname weblogic,只使用某种或某个poc。需要go版本1.16以上,只能自行编译最新版go来进行测试

WebScan/WebScan.go

@@ -1,9 +1,42 @@
 package WebScan
 
 import (
+	"embed"
+	"github.com/shadow1ng/fscan/WebScan/lib"
 	"github.com/shadow1ng/fscan/common"
+	"net/http"
+	"time"
 )
 
+//go:embed pocs
+var Pocs embed.FS
+
 func WebScan(info *common.HostInfo) {
-	Shiro(info)
-}
+	info.PocInfo.Target = info.Url
+	Execute(info.PocInfo)
+}
+
+func Execute(PocInfo common.PocInfo) error {
+	//PocInfo.Proxy = "http://127.0.0.1:8080"
+	err := lib.InitHttpClient(PocInfo.Num, PocInfo.Proxy, time.Duration(PocInfo.Timeout)*time.Second)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequest("GET", PocInfo.Target, nil)
+	req.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")
+	if err != nil {
+		return err
+	}
+	if PocInfo.Cookie != "" {
+		req.Header.Set("Cookie", PocInfo.Cookie)
+	}
+
+	//PocInfo.PocName = "weblogic-cve-2017-10271.yml"
+	if PocInfo.PocName != "" {
+		lib.CheckMultiPoc(req, Pocs, PocInfo.Num, PocInfo.PocName)
+	} else {
+		lib.CheckMultiPoc(req, Pocs, PocInfo.Num, "")
+	}
+
+	return nil
+}