mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-23 19:51:52 +08:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
2026b5f587 | ||
|
|
ce657e22a9 | ||
|
|
d96b0c0ad0 | ||
|
|
a33ed4cfeb | ||
|
|
30c1f267c2 | ||
|
|
faae9c7870 | ||
|
|
57349aab7b | ||
|
|
33121ead42 | ||
|
|
12f9e6ed62 |
@@ -1,20 +1,21 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
//Ladon Scanner for golang
|
//Ladon Scanner for golang
|
||||||
//Author: k8gege
|
//Author: k8gege
|
||||||
//K8Blog: http://k8gege.org
|
//K8Blog: http://k8gege.org
|
||||||
//Github: https://github.com/k8gege
|
//Github: https://github.com/k8gege
|
||||||
import (
|
import (
|
||||||
"../common"
|
|
||||||
"bytes"
|
"bytes"
|
||||||
"fmt"
|
"fmt"
|
||||||
"net"
|
"net"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
)
|
)
|
||||||
|
|
||||||
const (
|
const (
|
||||||
pkt =
|
pkt = "\x00" + // session
|
||||||
"\x00" + // session
|
|
||||||
"\x00\x00\xc0" + // legth
|
"\x00\x00\xc0" + // legth
|
||||||
|
|
||||||
"\xfeSMB@\x00" + // protocol
|
"\xfeSMB@\x00" + // protocol
|
||||||
@@ -66,7 +67,6 @@ const (
|
|||||||
"\x11\x03" +
|
"\x11\x03" +
|
||||||
"\x00\x00\x00\x00" +
|
"\x00\x00\x00\x00" +
|
||||||
|
|
||||||
|
|
||||||
// [MS-SMB2]: SMB2_PREAUTH_INTEGRITY_CAPABILITIES
|
// [MS-SMB2]: SMB2_PREAUTH_INTEGRITY_CAPABILITIES
|
||||||
// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/5a07bd66-4734-4af8-abcf-5a44ff7ee0e5
|
// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/5a07bd66-4734-4af8-abcf-5a44ff7ee0e5
|
||||||
|
|
||||||
@@ -99,6 +99,7 @@ const (
|
|||||||
"\x00\x00" +
|
"\x00\x00" +
|
||||||
"\x00\x00\x00\x00"
|
"\x00\x00\x00\x00"
|
||||||
)
|
)
|
||||||
|
|
||||||
func SmbGhost(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
func SmbGhost(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
||||||
SmbGhostScan(info)
|
SmbGhostScan(info)
|
||||||
wg.Done()
|
wg.Done()
|
||||||
|
|||||||
@@ -1,7 +1,6 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
|
||||||
"fmt"
|
"fmt"
|
||||||
"io/ioutil"
|
"io/ioutil"
|
||||||
"net"
|
"net"
|
||||||
@@ -9,6 +8,8 @@ import (
|
|||||||
"strings"
|
"strings"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
)
|
)
|
||||||
|
|
||||||
func elasticsearchScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
func elasticsearchScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
||||||
@@ -17,7 +18,6 @@ func elasticsearchScan(info *common.HostInfo,ch chan int,wg *sync.WaitGroup) {
|
|||||||
<-ch
|
<-ch
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
func geturl2(info *common.HostInfo) (flag bool, err error) {
|
func geturl2(info *common.HostInfo) (flag bool, err error) {
|
||||||
flag = false
|
flag = false
|
||||||
url := fmt.Sprintf("%s:%d/_cat", info.Url, common.PORTList["elastic"])
|
url := fmt.Sprintf("%s:%d/_cat", info.Url, common.PORTList["elastic"])
|
||||||
|
|||||||
+2
-4
@@ -11,15 +11,15 @@ import (
|
|||||||
"fmt"
|
"fmt"
|
||||||
"sync"
|
"sync"
|
||||||
|
|
||||||
"../common"
|
"github.com/shadow1ng/fscan/common"
|
||||||
)
|
)
|
||||||
|
|
||||||
var (
|
var (
|
||||||
buffer_v1, _ = hex.DecodeString("05000b03100000004800000001000000b810b810000000000100000000000100c4fefc9960521b10bbcb00aa0021347a00000000045d888aeb1cc9119fe808002b10486002000000")
|
buffer_v1, _ = hex.DecodeString("05000b03100000004800000001000000b810b810000000000100000000000100c4fefc9960521b10bbcb00aa0021347a00000000045d888aeb1cc9119fe808002b10486002000000")
|
||||||
buffer_v2, _ = hex.DecodeString("050000031000000018000000010000000000000000000500")
|
buffer_v2, _ = hex.DecodeString("050000031000000018000000010000000000000000000500")
|
||||||
buffer_v3, _ = hex.DecodeString("0900ffff0000")
|
buffer_v3, _ = hex.DecodeString("0900ffff0000")
|
||||||
|
|
||||||
)
|
)
|
||||||
|
|
||||||
func Findnet(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
func Findnet(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
||||||
FindnetScan(info)
|
FindnetScan(info)
|
||||||
wg.Done()
|
wg.Done()
|
||||||
@@ -73,5 +73,3 @@ func read(text []byte,host string) {
|
|||||||
}
|
}
|
||||||
common.LogSuccess(result)
|
common.LogSuccess(result)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
+3
-2
@@ -1,12 +1,13 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
|
||||||
"github.com/jlaffaye/ftp"
|
|
||||||
"fmt"
|
"fmt"
|
||||||
"strings"
|
"strings"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/jlaffaye/ftp"
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
)
|
)
|
||||||
|
|
||||||
func FtpScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
func FtpScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
||||||
|
|||||||
@@ -1,12 +1,13 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
|
||||||
"fmt"
|
"fmt"
|
||||||
"net"
|
"net"
|
||||||
"strings"
|
"strings"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
)
|
)
|
||||||
|
|
||||||
func MemcachedScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) (err error, result string) {
|
func MemcachedScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) (err error, result string) {
|
||||||
|
|||||||
+6
-4
@@ -1,15 +1,15 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
|
||||||
"fmt"
|
"fmt"
|
||||||
_ "github.com/denisenkom/go-mssqldb"
|
|
||||||
"net"
|
"net"
|
||||||
"strings"
|
"strings"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
)
|
|
||||||
|
|
||||||
|
_ "github.com/denisenkom/go-mssqldb"
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
|
)
|
||||||
|
|
||||||
func MongodbScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
func MongodbScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
||||||
MongodbUnauth(info)
|
MongodbUnauth(info)
|
||||||
@@ -23,7 +23,9 @@ func MongodbUnauth(info *common.HostInfo) (flag bool,err error) {
|
|||||||
getlog_data := []byte{72, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 212, 7, 0, 0, 0, 0, 0, 0, 97, 100, 109, 105, 110, 46, 36, 99, 109, 100, 0, 0, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 2, 103, 101, 116, 76, 111, 103, 0, 16, 0, 0, 0, 115, 116, 97, 114, 116, 117, 112, 87, 97, 114, 110, 105, 110, 103, 115, 0, 0}
|
getlog_data := []byte{72, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 212, 7, 0, 0, 0, 0, 0, 0, 97, 100, 109, 105, 110, 46, 36, 99, 109, 100, 0, 0, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 2, 103, 101, 116, 76, 111, 103, 0, 16, 0, 0, 0, 115, 116, 97, 114, 116, 117, 112, 87, 97, 114, 110, 105, 110, 103, 115, 0, 0}
|
||||||
realhost := fmt.Sprintf("%s:%d", info.Host, common.PORTList["mgo"])
|
realhost := fmt.Sprintf("%s:%d", info.Host, common.PORTList["mgo"])
|
||||||
conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
|
conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
|
||||||
if err != nil{return}
|
if err != nil {
|
||||||
|
return
|
||||||
|
}
|
||||||
defer conn.Close()
|
defer conn.Close()
|
||||||
conn.Write(send_data)
|
conn.Write(send_data)
|
||||||
buf := make([]byte, 1024)
|
buf := make([]byte, 1024)
|
||||||
|
|||||||
+3
-2
@@ -8,8 +8,10 @@ import (
|
|||||||
//"flag"
|
//"flag"
|
||||||
"fmt"
|
"fmt"
|
||||||
"net"
|
"net"
|
||||||
"../common"
|
|
||||||
"strings"
|
"strings"
|
||||||
|
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
|
|
||||||
//"sync"
|
//"sync"
|
||||||
"time"
|
"time"
|
||||||
)
|
)
|
||||||
@@ -136,4 +138,3 @@ func MS17010Scan(info *common.HostInfo) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
+1
-5
@@ -1,18 +1,15 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
|
||||||
"database/sql"
|
"database/sql"
|
||||||
"fmt"
|
"fmt"
|
||||||
_ "github.com/denisenkom/go-mssqldb"
|
_ "github.com/denisenkom/go-mssqldb"
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
"strings"
|
"strings"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
func MssqlScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
func MssqlScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
||||||
Loop:
|
Loop:
|
||||||
for _, user := range common.Userdict["mssql"] {
|
for _, user := range common.Userdict["mssql"] {
|
||||||
@@ -45,4 +42,3 @@ func MssqlConn(info *common.HostInfo,user string,pass string)(flag bool,err erro
|
|||||||
}
|
}
|
||||||
return flag, err
|
return flag, err
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
+3
-4
@@ -1,17 +1,16 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
|
||||||
"database/sql"
|
"database/sql"
|
||||||
"fmt"
|
"fmt"
|
||||||
_ "github.com/go-sql-driver/mysql"
|
|
||||||
"strings"
|
"strings"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
_ "github.com/go-sql-driver/mysql"
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
func MysqlScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
func MysqlScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
||||||
Loop:
|
Loop:
|
||||||
for _, user := range common.Userdict["mysql"] {
|
for _, user := range common.Userdict["mysql"] {
|
||||||
|
|||||||
+11
-11
@@ -2,13 +2,13 @@ package Plugins
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
"net"
|
"net"
|
||||||
"sort"
|
"sort"
|
||||||
"strconv"
|
"strconv"
|
||||||
"strings"
|
"strings"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
"../common"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
func ParsePort(ports string) []int {
|
func ParsePort(ports string) []int {
|
||||||
@@ -91,28 +91,28 @@ func TCPportScan(hostslist []string,ports string,model string,timeout int) ([]s
|
|||||||
var aliveHosts []string
|
var aliveHosts []string
|
||||||
probePorts := ParsePort(ports)
|
probePorts := ParsePort(ports)
|
||||||
lm := 20
|
lm := 20
|
||||||
if (len(hostslist)>5 && len(hostslist)<=50) {
|
if len(hostslist) > 5 && len(hostslist) <= 50 {
|
||||||
lm = 40
|
lm = 40
|
||||||
}else if(len(hostslist)>50 && len(hostslist)<=100){
|
} else if len(hostslist) > 50 && len(hostslist) <= 100 {
|
||||||
lm = 50
|
lm = 50
|
||||||
}else if(len(hostslist)>100 && len(hostslist)<=150){
|
} else if len(hostslist) > 100 && len(hostslist) <= 150 {
|
||||||
lm = 60
|
lm = 60
|
||||||
}else if(len(hostslist)>150 && len(hostslist)<=200){
|
} else if len(hostslist) > 150 && len(hostslist) <= 200 {
|
||||||
lm = 70
|
lm = 70
|
||||||
}else if(len(hostslist)>200){
|
} else if len(hostslist) > 200 {
|
||||||
lm = 75
|
lm = 75
|
||||||
}
|
}
|
||||||
|
|
||||||
thread := 5
|
thread := 5
|
||||||
if (len(probePorts)>500 && len(probePorts)<=4000) {
|
if len(probePorts) > 500 && len(probePorts) <= 4000 {
|
||||||
thread = len(probePorts) / 100
|
thread = len(probePorts) / 100
|
||||||
}else if (len(probePorts)>4000 && len(probePorts)<=6000) {
|
} else if len(probePorts) > 4000 && len(probePorts) <= 6000 {
|
||||||
thread = len(probePorts) / 200
|
thread = len(probePorts) / 200
|
||||||
}else if (len(probePorts)>6000 && len(probePorts)<=10000) {
|
} else if len(probePorts) > 6000 && len(probePorts) <= 10000 {
|
||||||
thread = len(probePorts) / 350
|
thread = len(probePorts) / 350
|
||||||
}else if (len(probePorts)>10000 && len(probePorts)<50000){
|
} else if len(probePorts) > 10000 && len(probePorts) < 50000 {
|
||||||
thread = len(probePorts) / 400
|
thread = len(probePorts) / 400
|
||||||
}else if (len(probePorts)>=50000 && len(probePorts)<=65535){
|
} else if len(probePorts) >= 50000 && len(probePorts) <= 65535 {
|
||||||
thread = len(probePorts) / 500
|
thread = len(probePorts) / 500
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
+3
-4
@@ -1,13 +1,14 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
|
||||||
"database/sql"
|
"database/sql"
|
||||||
"fmt"
|
"fmt"
|
||||||
_ "github.com/lib/pq"
|
|
||||||
"strings"
|
"strings"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
_ "github.com/lib/pq"
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
)
|
)
|
||||||
|
|
||||||
func PostgresScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
func PostgresScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
||||||
@@ -42,5 +43,3 @@ func PostgresConn(info *common.HostInfo,user string,pass string)(flag bool,err e
|
|||||||
}
|
}
|
||||||
return flag, err
|
return flag, err
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
+1
-5
@@ -1,9 +1,9 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
|
||||||
"bufio"
|
"bufio"
|
||||||
"fmt"
|
"fmt"
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
"net"
|
"net"
|
||||||
"os"
|
"os"
|
||||||
"strings"
|
"strings"
|
||||||
@@ -51,7 +51,6 @@ func RedisConn(info *common.HostInfo,pass string)(flag bool,err error){
|
|||||||
return flag, err
|
return flag, err
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
|
func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
|
||||||
flag = false
|
flag = false
|
||||||
realhost := fmt.Sprintf("%s:%d", info.Host, common.PORTList["redis"])
|
realhost := fmt.Sprintf("%s:%d", info.Host, common.PORTList["redis"])
|
||||||
@@ -100,7 +99,6 @@ func Expoilt(info *common.HostInfo,realhost string,conn net.Conn) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
func writekey(conn net.Conn, filename string) (flag bool, text string) {
|
func writekey(conn net.Conn, filename string) (flag bool, text string) {
|
||||||
flag = false
|
flag = false
|
||||||
conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /root/.ssh/\r\n")))
|
conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /root/.ssh/\r\n")))
|
||||||
@@ -128,8 +126,6 @@ func writekey(conn net.Conn,filename string) (flag bool,text string) {
|
|||||||
return flag, text
|
return flag, text
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
func writecron(conn net.Conn, host string) (flag bool, text string) {
|
func writecron(conn net.Conn, host string) (flag bool, text string) {
|
||||||
flag = false
|
flag = false
|
||||||
conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /var/spool/cron/\r\n")))
|
conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /var/spool/cron/\r\n")))
|
||||||
|
|||||||
+7
-2
@@ -1,14 +1,16 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
|
||||||
"errors"
|
"errors"
|
||||||
"fmt"
|
"fmt"
|
||||||
"reflect"
|
"reflect"
|
||||||
"strconv"
|
"strconv"
|
||||||
"strings"
|
"strings"
|
||||||
"sync"
|
"sync"
|
||||||
|
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
)
|
)
|
||||||
|
|
||||||
func scan_func(m map[string]interface{}, name string, infos ...interface{}) (result []reflect.Value, err error) {
|
func scan_func(m map[string]interface{}, name string, infos ...interface{}) (result []reflect.Value, err error) {
|
||||||
f := reflect.ValueOf(m[name])
|
f := reflect.ValueOf(m[name])
|
||||||
if len(infos) != f.Type().NumIn() {
|
if len(infos) != f.Type().NumIn() {
|
||||||
@@ -38,6 +40,7 @@ func Scan(info common.HostInfo) {
|
|||||||
Hosts, _ := common.ParseIP(info.Host, info.HostFile)
|
Hosts, _ := common.ParseIP(info.Host, info.HostFile)
|
||||||
if info.Isping == false {
|
if info.Isping == false {
|
||||||
Hosts = ICMPRun(Hosts, info.IcmpThreads)
|
Hosts = ICMPRun(Hosts, info.IcmpThreads)
|
||||||
|
fmt.Println("icmp alive hosts len is:", len(Hosts))
|
||||||
}
|
}
|
||||||
_, AlivePorts := TCPportScan(Hosts, info.Ports, "icmp", 3) //return AliveHosts,AlivePorts
|
_, AlivePorts := TCPportScan(Hosts, info.Ports, "icmp", 3) //return AliveHosts,AlivePorts
|
||||||
var severports []string //severports := []string{"21","22","135"."445","1433","3306","5432","6379","9200","11211","27017"...}
|
var severports []string //severports := []string{"21","22","135"."445","1433","3306","5432","6379","9200","11211","27017"...}
|
||||||
@@ -75,7 +78,9 @@ func Scan(info common.HostInfo) {
|
|||||||
|
|
||||||
func AddScan(scantype string, info common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
func AddScan(scantype string, info common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
||||||
wg.Add(1)
|
wg.Add(1)
|
||||||
if info.Scantype == "webtitle"{scantype = "1000003"}
|
if info.Scantype == "webtitle" {
|
||||||
|
scantype = "1000003"
|
||||||
|
}
|
||||||
go scan_func(PluginList, scantype, &info, ch, wg)
|
go scan_func(PluginList, scantype, &info, ch, wg)
|
||||||
ch <- 1
|
ch <- 1
|
||||||
}
|
}
|
||||||
+3
-3
@@ -1,14 +1,15 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
"context"
|
||||||
"fmt"
|
"fmt"
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
"github.com/stacktitan/smb/smb"
|
"github.com/stacktitan/smb/smb"
|
||||||
"strings"
|
"strings"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
"context"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
func SmbScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
func SmbScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
||||||
|
|
||||||
Loop:
|
Loop:
|
||||||
@@ -36,7 +37,6 @@ func SmblConn(info *common.HostInfo,user string,pass string)(flag bool,err error
|
|||||||
Password: Password,
|
Password: Password,
|
||||||
Domain: "",
|
Domain: "",
|
||||||
Workstation: "",
|
Workstation: "",
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
session, err := smb.NewSession(options, false)
|
session, err := smb.NewSession(options, false)
|
||||||
|
|||||||
+2
-1
@@ -1,14 +1,15 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
|
||||||
"fmt"
|
"fmt"
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
"golang.org/x/crypto/ssh"
|
"golang.org/x/crypto/ssh"
|
||||||
"net"
|
"net"
|
||||||
"strings"
|
"strings"
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
)
|
)
|
||||||
|
|
||||||
func SshScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
func SshScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
|
||||||
Loop:
|
Loop:
|
||||||
for _, user := range common.Userdict["ssh"] {
|
for _, user := range common.Userdict["ssh"] {
|
||||||
|
|||||||
+21
-34
@@ -1,28 +1,43 @@
|
|||||||
package Plugins
|
package Plugins
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"../common"
|
"crypto/tls"
|
||||||
"fmt"
|
"fmt"
|
||||||
|
"github.com/shadow1ng/fscan/WebScan"
|
||||||
"io/ioutil"
|
"io/ioutil"
|
||||||
"net/http"
|
"net/http"
|
||||||
"regexp"
|
"regexp"
|
||||||
"strings"
|
|
||||||
"sync"
|
"sync"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
)
|
)
|
||||||
|
|
||||||
func WebTitle(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) (err error, result string) {
|
func WebTitle(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) (err error, result string) {
|
||||||
info.Url = fmt.Sprintf("http://%s:%s", info.Host, info.Ports)
|
info.Url = fmt.Sprintf("http://%s:%s", info.Host, info.Ports)
|
||||||
err, result = geturl(info)
|
err, result = geturl(info)
|
||||||
|
if err == nil{
|
||||||
|
WebScan.WebScan(info)
|
||||||
|
}
|
||||||
|
|
||||||
|
info.Url = fmt.Sprintf("https://%s:%s", info.Host, info.Ports)
|
||||||
|
err, result = geturl(info)
|
||||||
|
if err == nil{
|
||||||
|
WebScan.WebScan(info)
|
||||||
|
}
|
||||||
|
|
||||||
wg.Done()
|
wg.Done()
|
||||||
<-ch
|
<-ch
|
||||||
return err, result
|
return err, result
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
func geturl(info *common.HostInfo) (err error, result string) {
|
func geturl(info *common.HostInfo) (err error, result string) {
|
||||||
url := info.Url
|
url := info.Url
|
||||||
var client = &http.Client{Timeout:time.Duration(info.Timeout)*time.Second }
|
info.Timeout = 20
|
||||||
|
tr := &http.Transport{
|
||||||
|
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
|
||||||
|
}
|
||||||
|
var client = &http.Client{Timeout: time.Duration(info.WebTimeout) * time.Second, Transport: tr}
|
||||||
res, err := http.NewRequest("GET", url, nil)
|
res, err := http.NewRequest("GET", url, nil)
|
||||||
if err == nil {
|
if err == nil {
|
||||||
res.Header.Add("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")
|
res.Header.Add("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")
|
||||||
@@ -45,39 +60,11 @@ func geturl(info *common.HostInfo) (err error, result string) {
|
|||||||
if len(title) > 50 {
|
if len(title) > 50 {
|
||||||
title = title[:50]
|
title = title[:50]
|
||||||
}
|
}
|
||||||
if resp.StatusCode == 400 && string(url[5]) != "https"{
|
|
||||||
info.Url = strings.Replace(url, "http://", "https://", 1)
|
|
||||||
return geturl(info)
|
|
||||||
}else {
|
|
||||||
result = fmt.Sprintf("WebTitle:%v %v %v", url, resp.StatusCode, title)
|
result = fmt.Sprintf("WebTitle:%v %v %v", url, resp.StatusCode, title)
|
||||||
common.LogSuccess(result)
|
common.LogSuccess(result)
|
||||||
}
|
|
||||||
return err, result
|
return err, result
|
||||||
}
|
}
|
||||||
}
|
|
||||||
return err, ""
|
return err, ""
|
||||||
}
|
}
|
||||||
//var client = &http.Client{
|
return err, ""
|
||||||
// Transport:&http.Transport{
|
}
|
||||||
// DialContext:(&net.Dialer{
|
|
||||||
// Timeout:time.Duration(info.Timeout)*time.Second,
|
|
||||||
// }).DialContext,
|
|
||||||
// },
|
|
||||||
// CheckRedirect:func(req *http.Request, via []*http.Request) error{
|
|
||||||
// return http.ErrUseLastResponse
|
|
||||||
// },
|
|
||||||
//}
|
|
||||||
|
|
||||||
//if info.Cookie!=""{
|
|
||||||
// res.Header.Add("Cookie",info.Cookie)
|
|
||||||
//}
|
|
||||||
//if info.Header!=""{
|
|
||||||
// var header = make(map[string]string)
|
|
||||||
// err:=json.Unmarshal([]byte(info.Header),&header)
|
|
||||||
// if err!=nil{
|
|
||||||
// Misc.CheckErr(err)
|
|
||||||
// }
|
|
||||||
// for k,v:=range header{
|
|
||||||
// res.Header.Add(k,v)
|
|
||||||
// }
|
|
||||||
//}
|
|
||||||
|
|||||||
@@ -14,7 +14,8 @@
|
|||||||
因为用习惯了f-scrack,习惯一条命令跑完所有模块,省去一个个模块单独调用的时间,当然我附加了-m 指定模块的功能。
|
因为用习惯了f-scrack,习惯一条命令跑完所有模块,省去一个个模块单独调用的时间,当然我附加了-m 指定模块的功能。
|
||||||
|
|
||||||
## 最近更新
|
## 最近更新
|
||||||
[+] 2020/11/16 对icmp模块进行优化,增加-it 参数(IcmpThreads),默认3000,适合扫B段
|
[+] 2020/11/17 增加WebScan模块,新增shiro简单识别。https访问时,跳过证书认证。将服务模块和web模块的超时分开,增加-wt 参数(WebTimeout)。
|
||||||
|
[+] 2020/11/16 对icmp模块进行优化,增加-it 参数(IcmpThreads),默认11000,适合扫B段
|
||||||
[+] 2020/11/15 支持ip以文件导入,-hs ip.txt,并对去重做了处理
|
[+] 2020/11/15 支持ip以文件导入,-hs ip.txt,并对去重做了处理
|
||||||
|
|
||||||
## usege
|
## usege
|
||||||
|
|||||||
@@ -0,0 +1,9 @@
|
|||||||
|
package WebScan
|
||||||
|
|
||||||
|
import (
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
|
)
|
||||||
|
|
||||||
|
func WebScan(info *common.HostInfo) {
|
||||||
|
Shiro(info)
|
||||||
|
}
|
||||||
@@ -0,0 +1,44 @@
|
|||||||
|
package WebScan
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/tls"
|
||||||
|
"fmt"
|
||||||
|
"github.com/shadow1ng/fscan/common"
|
||||||
|
"net/http"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
func Shiro(info *common.HostInfo) (err error, result string) {
|
||||||
|
url := info.Url
|
||||||
|
tr := &http.Transport{
|
||||||
|
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
|
||||||
|
}
|
||||||
|
var client = &http.Client{Timeout: time.Duration(info.WebTimeout) * time.Second, Transport: tr}
|
||||||
|
res, err := http.NewRequest("GET", url, nil)
|
||||||
|
if err == nil {
|
||||||
|
res.Header.Add("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")
|
||||||
|
res.Header.Add("Accept", "*/*")
|
||||||
|
res.Header.Add("Cookie", "rememberMe=1")
|
||||||
|
res.Header.Add("Accept-Language", "zh-CN,zh;q=0.9")
|
||||||
|
res.Header.Add("Accept-Encoding", "gzip, deflate")
|
||||||
|
res.Header.Add("Connection", "close")
|
||||||
|
resp, err := client.Do(res)
|
||||||
|
if err == nil {
|
||||||
|
defer resp.Body.Close()
|
||||||
|
for _,a := range resp.Header{
|
||||||
|
if len(a) >1{
|
||||||
|
for _,b :=range a{
|
||||||
|
if strings.Contains(b,"rememberMe"){
|
||||||
|
result = fmt.Sprintf("%v is shiro",url)
|
||||||
|
common.LogSuccess(result)
|
||||||
|
return err, result
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return err, ""
|
||||||
|
}
|
||||||
+2
-1
@@ -1,5 +1,5 @@
|
|||||||
package common
|
package common
|
||||||
|
//fscan version 1.3
|
||||||
var Userdict = map[string][]string{
|
var Userdict = map[string][]string{
|
||||||
"ftp": {"www","admin","root","db","wwwroot","data","web","ftp"},
|
"ftp": {"www","admin","root","db","wwwroot","data","web","ftp"},
|
||||||
"mysql": {"root"},
|
"mysql": {"root"},
|
||||||
@@ -61,6 +61,7 @@ type HostInfo struct {
|
|||||||
Ports string
|
Ports string
|
||||||
Url string
|
Url string
|
||||||
Timeout int64
|
Timeout int64
|
||||||
|
WebTimeout int64
|
||||||
Scantype string
|
Scantype string
|
||||||
Isping bool
|
Isping bool
|
||||||
Threads int
|
Threads int
|
||||||
|
|||||||
+2
-1
@@ -26,7 +26,7 @@ func Flag(Info *HostInfo) {
|
|||||||
flag.StringVar(&Info.Ports,"p",DefaultPorts,"Select a port,for example: 22 | 1-65535 | 22,80,3306")
|
flag.StringVar(&Info.Ports,"p",DefaultPorts,"Select a port,for example: 22 | 1-65535 | 22,80,3306")
|
||||||
flag.StringVar(&Info.Command,"c","","exec command (ssh)")
|
flag.StringVar(&Info.Command,"c","","exec command (ssh)")
|
||||||
flag.IntVar(&Info.Threads,"t",200,"Thread nums")
|
flag.IntVar(&Info.Threads,"t",200,"Thread nums")
|
||||||
flag.IntVar(&Info.IcmpThreads,"it",3000,"Icmp Threads nums")
|
flag.IntVar(&Info.IcmpThreads,"it",11000,"Icmp Threads nums")
|
||||||
flag.BoolVar(&Info.Isping,"np",false,"not to ping")
|
flag.BoolVar(&Info.Isping,"np",false,"not to ping")
|
||||||
flag.BoolVar(&Info.IsSave,"no",false,"not to save output log")
|
flag.BoolVar(&Info.IsSave,"no",false,"not to save output log")
|
||||||
flag.StringVar(&Info.Username,"user","","username")
|
flag.StringVar(&Info.Username,"user","","username")
|
||||||
@@ -35,6 +35,7 @@ func Flag(Info *HostInfo) {
|
|||||||
flag.StringVar(&Info.Passfile,"pwdf","","password file")
|
flag.StringVar(&Info.Passfile,"pwdf","","password file")
|
||||||
flag.StringVar(&Info.Outputfile,"o","result.txt","Outputfile")
|
flag.StringVar(&Info.Outputfile,"o","result.txt","Outputfile")
|
||||||
flag.Int64Var(&Info.Timeout,"time",3,"Set timeout")
|
flag.Int64Var(&Info.Timeout,"time",3,"Set timeout")
|
||||||
|
flag.Int64Var(&Info.WebTimeout,"wt",3,"Set web timeout")
|
||||||
flag.StringVar(&Info.Scantype,"m","all","Select scan type ,as: -m ssh")
|
flag.StringVar(&Info.Scantype,"m","all","Select scan type ,as: -m ssh")
|
||||||
flag.StringVar(&Info.RedisFile,"rf","","redis file to write sshkey file (as: -rf id_rsa.pub) ")
|
flag.StringVar(&Info.RedisFile,"rf","","redis file to write sshkey file (as: -rf id_rsa.pub) ")
|
||||||
flag.StringVar(&Info.RedisShell,"rs","","redis shell to write cron file (as: -rs 192.168.1.1:6666) ")
|
flag.StringVar(&Info.RedisShell,"rs","","redis shell to write cron file (as: -rs 192.168.1.1:6666) ")
|
||||||
|
|||||||
@@ -0,0 +1,12 @@
|
|||||||
|
module github.com/shadow1ng/fscan
|
||||||
|
|
||||||
|
go 1.13
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/denisenkom/go-mssqldb v0.9.0
|
||||||
|
github.com/go-sql-driver/mysql v1.5.0
|
||||||
|
github.com/jlaffaye/ftp v0.0.0-20201112195030-9aae4d151126
|
||||||
|
github.com/lib/pq v1.8.0
|
||||||
|
github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8
|
||||||
|
golang.org/x/crypto v0.0.0-20201116153603-4be66e5b6582
|
||||||
|
)
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/denisenkom/go-mssqldb v0.9.0 h1:RSohk2RsiZqLZ0zCjtfn3S4Gp4exhpBWHyQ7D0yGjAk=
|
||||||
|
github.com/denisenkom/go-mssqldb v0.9.0/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
|
||||||
|
github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs=
|
||||||
|
github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
|
||||||
|
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
|
||||||
|
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
|
||||||
|
github.com/jlaffaye/ftp v0.0.0-20201112195030-9aae4d151126 h1:ly2C51IMpCCV8RpTDRXgzG/L9iZXb8ePEixaew/HwBs=
|
||||||
|
github.com/jlaffaye/ftp v0.0.0-20201112195030-9aae4d151126/go.mod h1:2lmrmq866uF2tnje75wQHzmPXhmSWUt7Gyx2vgK1RCU=
|
||||||
|
github.com/lib/pq v1.8.0 h1:9xohqzkUwzR4Ga4ivdTcawVS89YSDVxXMa3xJX3cGzg=
|
||||||
|
github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||||
|
github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8 h1:GVFkBBJAEO3CpzIYcDDBdpUObzKwVW9okNWcLYL/nnU=
|
||||||
|
github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8/go.mod h1:phLSETqH/UJsBtwDVBxSfJKwwkbJcGyy2Q/h4k+bmww=
|
||||||
|
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||||
|
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||||
|
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||||
|
golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||||
|
golang.org/x/crypto v0.0.0-20201116153603-4be66e5b6582 h1:0WDrJ1E7UolDk1KhTXxxw3Fc8qtk5x7dHP431KHEJls=
|
||||||
|
golang.org/x/crypto v0.0.0-20201116153603-4be66e5b6582/go.mod h1:tCqSYrHVcf3i63Co2FzBkTCo2gdF6Zak62921dSfraU=
|
||||||
|
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||||
|
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||||
|
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/term v0.0.0-20201113234701-d7a72108b828/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
|
||||||
|
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||||
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
Reference in New Issue
Block a user