Merge remote-tracking branch 'origin/main' into main

# Conflicts:
#	README.md

Plugins/CVE-2020-0796.go

@@ -1,20 +1,21 @@
 package Plugins
+
 //Ladon Scanner for golang
 //Author: k8gege
 //K8Blog: http://k8gege.org
 //Github: https://github.com/k8gege
 import (
-	"../common"
 	"bytes"
 	"fmt"
 	"net"
 	"sync"
 	"time"
+
+	"github.com/shadow1ng/fscan/common"
 )
 
 const (
-	pkt =
-	"\x00" + // session
+	pkt = "\x00" + // session
 		"\x00\x00\xc0" + // legth
 
 		"\xfeSMB@\x00" + // protocol
@@ -66,7 +67,6 @@ const (
 		"\x11\x03" +
 		"\x00\x00\x00\x00" +
 
-
 		// [MS-SMB2]: SMB2_PREAUTH_INTEGRITY_CAPABILITIES
 		// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/5a07bd66-4734-4af8-abcf-5a44ff7ee0e5
 
@@ -99,6 +99,7 @@ const (
 		"\x00\x00" +
 		"\x00\x00\x00\x00"
 )
+
 func SmbGhost(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
 	SmbGhostScan(info)
 	wg.Done()

Plugins/elasticsearch.go

@@ -1,7 +1,6 @@
 package Plugins
 
 import (
-	"../common"
 	"fmt"
 	"io/ioutil"
 	"net"
@@ -9,6 +8,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"github.com/shadow1ng/fscan/common"
 )
 
 func elasticsearchScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
@@ -17,7 +18,6 @@ func elasticsearchScan(info *common.HostInfo,ch chan int,wg *sync.WaitGroup)  {
 	<-ch
 }
 
-
 func geturl2(info *common.HostInfo) (flag bool, err error) {
 	flag = false
 	url := fmt.Sprintf("%s:%d/_cat", info.Url, common.PORTList["elastic"])

Plugins/findnet.go

@@ -11,15 +11,15 @@ import (
 	"fmt"
 	"sync"
 
-	"../common"
+	"github.com/shadow1ng/fscan/common"
 )
 
 var (
 	buffer_v1, _ = hex.DecodeString("05000b03100000004800000001000000b810b810000000000100000000000100c4fefc9960521b10bbcb00aa0021347a00000000045d888aeb1cc9119fe808002b10486002000000")
 	buffer_v2, _ = hex.DecodeString("050000031000000018000000010000000000000000000500")
 	buffer_v3, _ = hex.DecodeString("0900ffff0000")
-
 )
+
 func Findnet(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
 	FindnetScan(info)
 	wg.Done()
@@ -73,5 +73,3 @@ func read(text []byte,host string)  {
 	}
 	common.LogSuccess(result)
 }
-
-

Plugins/ftp.go

@@ -1,12 +1,13 @@
 package Plugins
 
 import (
-	"../common"
-	"github.com/jlaffaye/ftp"
 	"fmt"
 	"strings"
 	"sync"
 	"time"
+
+	"github.com/jlaffaye/ftp"
+	"github.com/shadow1ng/fscan/common"
 )
 
 func FtpScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {

Plugins/icmp.go

@@ -2,7 +2,6 @@ package Plugins
 
 import (
 	"bytes"
-	"encoding/binary"
 	"fmt"
 	"net"
 	"os"
@@ -14,17 +13,9 @@ import (
 	"time"
 )
 
-var icmp ICMP
-
 var AliveHosts []string
 
-type ICMP struct {
-	Type        uint8
-	Code        uint8
-	Checksum    uint16
-	Identifier  uint16
-	SequenceNum uint16
-}
+var SysInfo = GetSys()
 
 type SystemInfo struct {
 	OS          string
@@ -56,38 +47,30 @@ func GetSys() SystemInfo {
 }
 
 func isping(ip string) bool {
-	icmp.Type = 8
-	icmp.Code = 0
-	icmp.Checksum = 0
-	icmp.Identifier = 0
-	icmp.SequenceNum = 0
-
-	recvBuf := make([]byte, 32)
-	var buffer bytes.Buffer
-
-	binary.Write(&buffer, binary.BigEndian, icmp)
-	icmp.Checksum = CheckSum(buffer.Bytes())
-
-	buffer.Reset()
-	binary.Write(&buffer, binary.BigEndian, icmp)
-
+	IcmpByte := []byte{8, 0, 247, 255, 0, 0, 0, 0}
 	Time, _ := time.ParseDuration("3s")
 	conn, err := net.DialTimeout("ip4:icmp", ip, Time)
 	if err != nil {
 		return false
 	}
-	_, err = conn.Write(buffer.Bytes())
-	if err != nil {
-		return false
-	}
-	conn.SetReadDeadline(time.Now().Add(time.Second * 3))
-	num, err := conn.Read(recvBuf)
+	defer conn.Close()
+	_, err = conn.Write(IcmpByte)
 	if err != nil {
 		return false
 	}
 
-	conn.SetReadDeadline(time.Time{})
+	if err := conn.SetReadDeadline(time.Now().Add(time.Second * 3)); err != nil {
+		return false
+	}
 
+	recvBuf := make([]byte, 40)
+	num, err := conn.Read(recvBuf[0:40])
+	if err != nil {
+		return false
+	}
+	if err := conn.SetReadDeadline(time.Time{}); err != nil {
+		return false
+	}
 	if string(recvBuf[0:num]) != "" {
 		fmt.Printf("(ICMP) Target '%s' is alive\n", ip)
 		return true
@@ -96,32 +79,13 @@ func isping(ip string) bool {
 
 }
 
-func CheckSum(data []byte) uint16 {
-	var (
-		sum    uint32
-		length int = len(data)
-		index  int
-	)
-	for length > 1 {
-		sum += uint32(data[index])<<8 + uint32(data[index+1])
-		index += 2
-		length -= 2
-	}
-	if length > 0 {
-		sum += uint32(data[index])
-	}
-	sum += (sum >> 16)
-
-	return uint16(^sum)
-}
-
 func IcmpCheck(hostslist []string, IcmpThreads int) {
 	var wg sync.WaitGroup
 	mutex := &sync.Mutex{}
-	limiter := make(chan int, IcmpThreads)
+	limiter := make(chan struct{}, IcmpThreads)
 	for _, host := range hostslist {
 		wg.Add(1)
-		limiter <- 1
+		limiter <- struct{}{}
 		go func(host string) {
 			defer wg.Done()
 			if isping(host) {
@@ -136,20 +100,25 @@ func IcmpCheck(hostslist []string,IcmpThreads int) {
 	wg.Wait()
 }
 
-
 func ExecCommandPing(ip string, bsenv string) bool {
-	command := exec.Command(bsenv, "-c", "ping -c 1 -w 1 "+ip+" >/dev/null && echo true || echo false")  //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
+	var command *exec.Cmd
+	if SysInfo.OS == "windows" {
+		command = exec.Command("cmd", "/c", "ping -n 1 -w 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
+	} else if SysInfo.OS == "linux" {
+		command = exec.Command(bsenv, "-c", "ping -c 1 -w 1 "+ip+" >/dev/null && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
+	} else if SysInfo.OS == "darwin" {
+		command = exec.Command(bsenv, "-c", "ping -c 1 -W 1 "+ip+" >/dev/null && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
+	}
 	outinfo := bytes.Buffer{}
 	command.Stdout = &outinfo
 	err := command.Start()
 	if err != nil {
 		return false
 	}
-
 	if err = command.Wait(); err != nil {
 		return false
 	} else {
-		if(strings.Contains(outinfo.String(), "true")) {
+		if strings.Contains(outinfo.String(), "true") {
 			return true
 		} else {
 			return false
@@ -177,24 +146,37 @@ func PingCMDcheck(hostslist []string,bsenv string) {
 	}
 	wg.Wait()
 }
+func ICMPRun(hostslist []string, IcmpThreads int, Ping bool) []string {
 
-func ICMPRun(hostslist []string,IcmpThreads int)  []string{
-	var sysinfo SystemInfo
-	sysinfo = GetSys()
-
-	if sysinfo.OS == "windows" {
+	if SysInfo.OS == "windows" {
+		if Ping == false {
 			IcmpCheck(hostslist, IcmpThreads)
-	}else if sysinfo.OS == "linux" {
-		if (sysinfo.Groupid == "0" || sysinfo.Userid == "0" || sysinfo.Username == "root") {
+		} else {
+			PingCMDcheck(hostslist, "")
+		}
+	} else if SysInfo.OS == "linux" {
+		if SysInfo.Groupid == "0" || SysInfo.Userid == "0" || SysInfo.Username == "root" {
+			if Ping == false {
 				IcmpCheck(hostslist, IcmpThreads)
 			} else {
 				PingCMDcheck(hostslist, "/bin/bash")
 			}
-	}else if sysinfo.OS == "darwin" {
-		if (sysinfo.Groupid == "0" || sysinfo.Userid == "0" || sysinfo.Username == "root") {
+		} else {
+			fmt.Println("The current user permissions unable to send icmp packets")
+			fmt.Println("start ping")
+			PingCMDcheck(hostslist, "/bin/bash")
+		}
+	} else if SysInfo.OS == "darwin" {
+		if SysInfo.Groupid == "0" || SysInfo.Userid == "0" || SysInfo.Username == "root" {
+			if Ping == false {
 				IcmpCheck(hostslist, IcmpThreads)
 			} else {
-			PingCMDcheck(hostslist,"/usr/local/bin/bash")
+				PingCMDcheck(hostslist, "/bin/bash")
+			}
+		} else {
+			fmt.Println("The current user permissions unable to send icmp packets")
+			fmt.Println("start ping")
+			PingCMDcheck(hostslist, "/bin/bash")
 		}
 	}
 	return AliveHosts

Plugins/memcached.go

@@ -1,12 +1,13 @@
 package Plugins
 
 import (
-	"../common"
 	"fmt"
 	"net"
 	"strings"
 	"sync"
 	"time"
+
+	"github.com/shadow1ng/fscan/common"
 )
 
 func MemcachedScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) (err error, result string) {

Plugins/mongodb.go

@@ -1,15 +1,15 @@
 package Plugins
 
 import (
-	"../common"
 	"fmt"
-	_ "github.com/denisenkom/go-mssqldb"
 	"net"
 	"strings"
 	"sync"
 	"time"
-)
 
+	_ "github.com/denisenkom/go-mssqldb"
+	"github.com/shadow1ng/fscan/common"
+)
 
 func MongodbScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
 	MongodbUnauth(info)
@@ -23,7 +23,9 @@ func MongodbUnauth(info *common.HostInfo) (flag bool,err error) {
 	getlog_data := []byte{72, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 212, 7, 0, 0, 0, 0, 0, 0, 97, 100, 109, 105, 110, 46, 36, 99, 109, 100, 0, 0, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 2, 103, 101, 116, 76, 111, 103, 0, 16, 0, 0, 0, 115, 116, 97, 114, 116, 117, 112, 87, 97, 114, 110, 105, 110, 103, 115, 0, 0}
 	realhost := fmt.Sprintf("%s:%d", info.Host, common.PORTList["mgo"])
 	conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
-	if err != nil{return}
+	if err != nil {
+		return
+	}
 	defer conn.Close()
 	conn.Write(send_data)
 	buf := make([]byte, 1024)

Plugins/ms17017.go

@@ -8,8 +8,10 @@ import (
 	//"flag"
 	"fmt"
 	"net"
-	"../common"
 	"strings"
+
+	"github.com/shadow1ng/fscan/common"
+
 	//"sync"
 	"time"
 )
@@ -136,4 +138,3 @@ func MS17010Scan(info *common.HostInfo) {
 	}
 
 }
-

Plugins/mssql.go

@@ -1,18 +1,15 @@
 package Plugins
 
 import (
-	"../common"
 	"database/sql"
 	"fmt"
 	_ "github.com/denisenkom/go-mssqldb"
+	"github.com/shadow1ng/fscan/common"
 	"strings"
 	"sync"
 	"time"
 )
 
-
-
-
 func MssqlScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
 Loop:
 	for _, user := range common.Userdict["mssql"] {
@@ -45,4 +42,3 @@ func MssqlConn(info *common.HostInfo,user string,pass string)(flag bool,err erro
 	}
 	return flag, err
 }
-

Plugins/mysql.go

@@ -1,17 +1,16 @@
 package Plugins
 
 import (
-	"../common"
 	"database/sql"
 	"fmt"
-	_ "github.com/go-sql-driver/mysql"
 	"strings"
 	"sync"
 	"time"
+
+	_ "github.com/go-sql-driver/mysql"
+	"github.com/shadow1ng/fscan/common"
 )
 
-
-
 func MysqlScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
 Loop:
 	for _, user := range common.Userdict["mysql"] {

Plugins/portscan.go

@@ -2,13 +2,13 @@ package Plugins
 
 import (
 	"fmt"
+	"github.com/shadow1ng/fscan/common"
 	"net"
 	"sort"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
-	"../common"
 )
 
 func ParsePort(ports string) []int {
@@ -35,12 +35,9 @@ func ParsePort(ports string) []int {
 	return scanPorts
 }
 
-func ProbeHosts(host string, ports <-chan int, respondingHosts chan<- string, done chan<- bool, model string, adjustedTimeout int) {
-	Timeout := time.Duration(adjustedTimeout) * time.Second
+func ProbeHosts(host string, ports <-chan int, respondingHosts chan<- string, done chan<- bool, adjustedTimeout int) {
 	for port := range ports {
-		start := time.Now()
 		con, err := net.DialTimeout("tcp4", fmt.Sprintf("%s:%d", host, port), time.Duration(adjustedTimeout)*time.Second)
-		duration := time.Now().Sub(start)
 		if err == nil {
 			defer con.Close()
 			address := host + ":" + strconv.Itoa(port)
@@ -48,21 +45,17 @@ func ProbeHosts(host string, ports <-chan int, respondingHosts chan<- string, do
 			common.LogSuccess(result)
 			respondingHosts <- address
 		}
-		if duration < Timeout {
-			difference := Timeout - duration
-			Timeout = Timeout - (difference / 2)
-		}
 	}
 	done <- true
 }
 
-func ScanAllports(address string, probePorts []int, threads int, timeout time.Duration, model string, adjustedTimeout int) ([]string, error) {
+func ScanAllports(address string, probePorts []int, threads int, adjustedTimeout int) ([]string, error) {
 	ports := make(chan int, 20)
 	results := make(chan string, 10)
 	done := make(chan bool, threads)
 
 	for worker := 0; worker < threads; worker++ {
-		go ProbeHosts(address, ports, results, done, model, adjustedTimeout)
+		go ProbeHosts(address, ports, results, done, adjustedTimeout)
 	}
 
 	for _, port := range probePorts {
@@ -80,57 +73,49 @@ func ScanAllports(address string, probePorts []int, threads int, timeout time.Du
 			if threads == 0 {
 				return responses, nil
 			}
-		case <-time.After(timeout):
-			return responses, nil
 		}
 	}
 }
 
-func TCPportScan(hostslist []string,ports string,model string,timeout int)  ([]string,[]string){
+func TCPportScan(hostslist []string, ports string, timeout int) ([]string, []string) {
 	var AliveAddress []string
 	var aliveHosts []string
 	probePorts := ParsePort(ports)
 	lm := 20
-	if (len(hostslist)>5 && len(hostslist)<=50) {
+	if len(hostslist) > 5 && len(hostslist) <= 50 {
 		lm = 40
-	}else if(len(hostslist)>50 && len(hostslist)<=100){
+	} else if len(hostslist) > 50 && len(hostslist) <= 100 {
 		lm = 50
-	}else if(len(hostslist)>100 && len(hostslist)<=150){
+	} else if len(hostslist) > 100 && len(hostslist) <= 150 {
 		lm = 60
-	}else if(len(hostslist)>150 && len(hostslist)<=200){
+	} else if len(hostslist) > 150 && len(hostslist) <= 200 {
 		lm = 70
-	}else if(len(hostslist)>200){
+	} else if len(hostslist) > 200 {
 		lm = 75
 	}
 
 	thread := 5
-	if (len(probePorts)>500 && len(probePorts)<=4000) {
+	if len(probePorts) > 500 && len(probePorts) <= 4000 {
 		thread = len(probePorts) / 100
-	}else if (len(probePorts)>4000 && len(probePorts)<=6000) {
+	} else if len(probePorts) > 4000 && len(probePorts) <= 6000 {
 		thread = len(probePorts) / 200
-	}else if (len(probePorts)>6000 && len(probePorts)<=10000) {
+	} else if len(probePorts) > 6000 && len(probePorts) <= 10000 {
 		thread = len(probePorts) / 350
-	}else if (len(probePorts)>10000 && len(probePorts)<50000){
+	} else if len(probePorts) > 10000 && len(probePorts) < 50000 {
 		thread = len(probePorts) / 400
-	}else if (len(probePorts)>=50000 && len(probePorts)<=65535){
+	} else if len(probePorts) >= 50000 && len(probePorts) <= 65535 {
 		thread = len(probePorts) / 500
 	}
 
 	var wg sync.WaitGroup
 	mutex := &sync.Mutex{}
 	limiter := make(chan struct{}, lm)
-	aliveHost := make(chan string, lm/2)
-	go func() {
-		for s := range aliveHost {
-			fmt.Println(s)
-		}
-	}()
 	for _, host := range hostslist {
 		wg.Add(1)
 		limiter <- struct{}{}
 		go func(host string) {
 			defer wg.Done()
-			if aliveAdd, err := ScanAllports(host, probePorts,thread, 5*time.Second,model,timeout);err == nil && len(aliveAdd)>0{
+			if aliveAdd, err := ScanAllports(host, probePorts, thread, timeout); err == nil && len(aliveAdd) > 0 {
 				mutex.Lock()
 				aliveHosts = append(aliveHosts, host)
 				for _, addr := range aliveAdd {
@@ -142,6 +127,5 @@ func TCPportScan(hostslist []string,ports string,model string,timeout int)  ([]s
 		}(host)
 	}
 	wg.Wait()
-	close(aliveHost)
 	return aliveHosts, AliveAddress
 }

Plugins/postgres.go

@@ -1,13 +1,14 @@
 package Plugins
 
 import (
-	"../common"
 	"database/sql"
 	"fmt"
-	_ "github.com/lib/pq"
 	"strings"
 	"sync"
 	"time"
+
+	_ "github.com/lib/pq"
+	"github.com/shadow1ng/fscan/common"
 )
 
 func PostgresScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
@@ -42,5 +43,3 @@ func PostgresConn(info *common.HostInfo,user string,pass string)(flag bool,err e
 	}
 	return flag, err
 }
-
-

Plugins/redis.go

@@ -1,9 +1,9 @@
 package Plugins
 
 import (
-	"../common"
 	"bufio"
 	"fmt"
+	"github.com/shadow1ng/fscan/common"
 	"net"
 	"os"
 	"strings"
@@ -51,7 +51,6 @@ func RedisConn(info *common.HostInfo,pass string)(flag bool,err error){
 	return flag, err
 }
 
-
 func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
 	flag = false
 	realhost := fmt.Sprintf("%s:%d", info.Host, common.PORTList["redis"])
@@ -100,7 +99,6 @@ func Expoilt(info *common.HostInfo,realhost string,conn net.Conn)  {
 	}
 }
 
-
 func writekey(conn net.Conn, filename string) (flag bool, text string) {
 	flag = false
 	conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /root/.ssh/\r\n")))
@@ -128,8 +126,6 @@ func writekey(conn  net.Conn,filename string) (flag bool,text string) {
 	return flag, text
 }
 
-
-
 func writecron(conn net.Conn, host string) (flag bool, text string) {
 	flag = false
 	conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /var/spool/cron/\r\n")))

Plugins/scanner.go

@@ -1,22 +1,22 @@
 package Plugins
 
 import (
-	"../common"
 	"errors"
 	"fmt"
 	"reflect"
 	"strconv"
 	"strings"
 	"sync"
+
+	"github.com/shadow1ng/fscan/common"
 )
+
 func scan_func(m map[string]interface{}, name string, infos ...interface{}) (result []reflect.Value, err error) {
 	f := reflect.ValueOf(m[name])
 	if len(infos) != f.Type().NumIn() {
 		err = errors.New("The number of infos is not adapted.")
-		if err != nil {
 		fmt.Println(err.Error())
 	}
-	}
 	in := make([]reflect.Value, len(infos))
 	for k, info := range infos {
 		in[k] = reflect.ValueOf(info)
@@ -37,9 +37,10 @@ func Scan(info common.HostInfo)  {
 	fmt.Println("scan start")
 	Hosts, _ := common.ParseIP(info.Host, info.HostFile)
 	if info.Isping == false {
-		Hosts =  ICMPRun(Hosts,info.IcmpThreads)
+		Hosts = ICMPRun(Hosts, info.IcmpThreads, info.Ping)
+		fmt.Println("icmp alive hosts len is:", len(Hosts))
 	}
-	_,AlivePorts := TCPportScan(Hosts,info.Ports,"icmp",3)   //return AliveHosts,AlivePorts
+	_, AlivePorts := TCPportScan(Hosts, info.Ports, 3) //return AliveHosts,AlivePorts
 	var severports []string                            //severports := []string{"21","22","135"."445","1433","3306","5432","6379","9200","11211","27017"...}
 	for _, port := range common.PORTList {
 		severports = append(severports, strconv.Itoa(port))
@@ -51,12 +52,12 @@ func Scan(info common.HostInfo)  {
 	for _, targetIP := range AlivePorts {
 		scan_ip, scan_port := strings.Split(targetIP, ":")[0], strings.Split(targetIP, ":")[1]
 		info.Host = scan_ip
+		info.Ports = scan_port
 		if info.Scantype == "all" {
 			if IsContain(severports, scan_port) {
 				AddScan(scan_port, info, ch, &wg)
 			} else {
 				if !IsContain(severports1, scan_port) {
-					info.Ports = scan_port
 					AddScan("1000003", info, ch, &wg) //webtitle
 				}
 			}
@@ -75,7 +76,6 @@ func Scan(info common.HostInfo)  {
 
 func AddScan(scantype string, info common.HostInfo, ch chan int, wg *sync.WaitGroup) {
 	wg.Add(1)
-	if info.Scantype == "webtitle"{scantype = "1000003"}
 	go scan_func(PluginList, scantype, &info, ch, wg)
 	ch <- 1
 }

Plugins/smb.go

@@ -1,14 +1,15 @@
 package Plugins
 
 import (
-	"../common"
+	"context"
 	"fmt"
+	"github.com/shadow1ng/fscan/common"
 	"github.com/stacktitan/smb/smb"
 	"strings"
 	"sync"
 	"time"
-	"context"
 )
+
 func SmbScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
 
 Loop:
@@ -26,7 +27,7 @@ Loop:
 
 }
 
-func SmblConn(info *common.HostInfo,user string,pass string)(flag bool,err error){
+func SmblConn(info *common.HostInfo, user string, pass string, Domain string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, common.PORTList["smb"], user, pass
 	options := smb.Options{
@@ -34,16 +35,21 @@ func SmblConn(info *common.HostInfo,user string,pass string)(flag bool,err error
 		Port:        445,
 		User:        Username,
 		Password:    Password,
-		Domain:      "",
+		Domain:      Domain,
 		Workstation: "",
-
 	}
 
 	session, err := smb.NewSession(options, false)
 	if err == nil {
 		defer session.Close()
 		if session.IsAuthenticated {
-			result := fmt.Sprintf("SMB:%v:%v:%v %v",Host,Port,Username,Password)
+			var result string
+			if Domain != "" {
+				result = fmt.Sprintf("SMB:%v:%v:%v\\%v %v", Host, Port, Domain, Username, Password)
+			} else {
+				result = fmt.Sprintf("SMB:%v:%v:%v %v", Host, Port, Username, Password)
+			}
+
 			common.LogSuccess(result)
 			flag = true
 		}
@@ -56,7 +62,7 @@ func doWithTimeOut(info *common.HostInfo,user string,pass string)(flag bool,err
 	defer cancel()
 	signal := make(chan int, 1)
 	go func() {
-		flag,err = SmblConn(info,user,pass)
+		flag, err = SmblConn(info, user, pass, info.Domain)
 		signal <- 1
 	}()
 

Plugins/ssh.go

@@ -1,14 +1,15 @@
 package Plugins
 
 import (
-	"../common"
 	"fmt"
+	"github.com/shadow1ng/fscan/common"
 	"golang.org/x/crypto/ssh"
 	"net"
 	"strings"
 	"sync"
 	"time"
 )
+
 func SshScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
 Loop:
 	for _, user := range common.Userdict["ssh"] {

Plugins/webtitle.go

@@ -1,12 +1,13 @@
 package Plugins
 
 import (
-	"../common"
+	"crypto/tls"
 	"fmt"
+	"github.com/shadow1ng/fscan/WebScan"
+	"github.com/shadow1ng/fscan/common"
 	"io/ioutil"
 	"net/http"
 	"regexp"
-	"strings"
 	"sync"
 	"time"
 )
@@ -14,15 +15,27 @@ import (
 func WebTitle(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) (err error, result string) {
 	info.Url = fmt.Sprintf("http://%s:%s", info.Host, info.Ports)
 	err, result = geturl(info)
+	if err == nil {
+		WebScan.WebScan(info)
+	}
+
+	info.Url = fmt.Sprintf("https://%s:%s", info.Host, info.Ports)
+	err, result = geturl(info)
+	if err == nil {
+		WebScan.WebScan(info)
+	}
+
 	wg.Done()
 	<-ch
 	return err, result
 }
 
-
 func geturl(info *common.HostInfo) (err error, result string) {
 	url := info.Url
-	var client = &http.Client{Timeout:time.Duration(info.Timeout)*time.Second }
+	tr := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	}
+	var client = &http.Client{Timeout: time.Duration(info.WebTimeout) * time.Second, Transport: tr}
 	res, err := http.NewRequest("GET", url, nil)
 	if err == nil {
 		res.Header.Add("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")
@@ -45,39 +58,11 @@ func geturl(info *common.HostInfo) (err error, result string) {
 			if len(title) > 50 {
 				title = title[:50]
 			}
-			if resp.StatusCode == 400 &&  string(url[5]) != "https"{
-				info.Url = strings.Replace(url, "http://", "https://", 1)
-				return geturl(info)
-			}else {
 			result = fmt.Sprintf("WebTitle:%v %v %v", url, resp.StatusCode, title)
 			common.LogSuccess(result)
-			}
 			return err, result
 		}
-	}
 		return err, ""
 	}
-//var client = &http.Client{
-//	Transport:&http.Transport{
-//		DialContext:(&net.Dialer{
-//			Timeout:time.Duration(info.Timeout)*time.Second,
-//		}).DialContext,
-//	},
-//	CheckRedirect:func(req *http.Request, via []*http.Request) error{
-//		return http.ErrUseLastResponse
-//	},
-//}
-
-//if info.Cookie!=""{
-//	res.Header.Add("Cookie",info.Cookie)
-//}
-//if info.Header!=""{
-//	var header = make(map[string]string)
-//	err:=json.Unmarshal([]byte(info.Header),&header)
-//	if err!=nil{
-//		Misc.CheckErr(err)
-//	}
-//	for k,v:=range header{
-//		res.Header.Add(k,v)
-//	}
-//}
+	return err, ""
+}

README.md

@@ -14,7 +14,11 @@
    因为用习惯了f-scrack，习惯一条命令跑完所有模块，省去一个个模块单独调用的时间，当然我附加了-m 指定模块的功能。
 
 ## 最近更新
-[+] 2020/11/16 对icmp模块进行优化,增加-it 参数(IcmpThreads),默认3000,适合扫B段  
+[+] 2020/12/6 优化icmp模块,新增-domain 参数(用于smb爆破模块,适用于域用户)  
+[+] 2020/12/03 优化ip段处理模块、icmp、端口扫描模块。新增支持192.168.1.1-192.168.255.255。  
+[+] 2020/11/17 增加-ping 参数,作用是存活探测模块用ping代替icmp发包。   
+[+] 2020/11/17 增加WebScan模块,新增shiro简单识别。https访问时,跳过证书认证。将服务模块和web模块的超时分开,增加-wt 参数(WebTimeout)。    
+[+] 2020/11/16 对icmp模块进行优化,增加-it 参数(IcmpThreads),默认11000,适合扫B段  
 [+] 2020/11/15 支持ip以文件导入,-hs ip.txt,并对去重做了处理
 
 ## usege
@@ -45,7 +49,7 @@ fscan.exe -h 192.168.1.1/24 -m ms17010 (指定模块)
   -hf string
         host file, -hs ip.txt
   -it int
-        Icmp Threads nums (default 3000)
+        Icmp Threads nums (default 11000)
   -m string
         Select scan type ,as: -m ssh (default "all")
   -no
@@ -56,6 +60,8 @@ fscan.exe -h 192.168.1.1/24 -m ms17010 (指定模块)
         Outputfile (default "result.txt")
   -p string
         Select a port,for example: 22 | 1-65535 | 22,80,3306 (default "21,22,23,80,135,443,445,1433,1521,3306,5432,6379,7001,8080,8089,9000,9200,11211,27017")
+  -ping
+        using ping replace icmp
   -pwd string
         password
   -pwdf string
@@ -72,6 +78,8 @@ fscan.exe -h 192.168.1.1/24 -m ms17010 (指定模块)
         username
   -userf string
         username file
+  -wt int
+        Set web timeout (default 3)
 
 ```
 

WebScan/WebScan.go

@@ -0,0 +1,9 @@
+package WebScan
+
+import (
+	"github.com/shadow1ng/fscan/common"
+)
+
+func WebScan(info *common.HostInfo) {
+	Shiro(info)
+}

WebScan/shiro.go

@@ -0,0 +1,44 @@
+package WebScan
+
+import (
+	"crypto/tls"
+	"fmt"
+	"github.com/shadow1ng/fscan/common"
+	"net/http"
+	"strings"
+	"time"
+)
+
+
+func Shiro(info *common.HostInfo) (err error, result string) {
+	url := info.Url
+	tr := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	}
+	var client = &http.Client{Timeout: time.Duration(info.WebTimeout) * time.Second, Transport: tr}
+	res, err := http.NewRequest("GET", url, nil)
+	if err == nil {
+		res.Header.Add("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")
+		res.Header.Add("Accept", "*/*")
+		res.Header.Add("Cookie", "rememberMe=1")
+		res.Header.Add("Accept-Language", "zh-CN,zh;q=0.9")
+		res.Header.Add("Accept-Encoding", "gzip, deflate")
+		res.Header.Add("Connection", "close")
+		resp, err := client.Do(res)
+		if err == nil {
+			defer resp.Body.Close()
+			for _,a := range resp.Header{
+				if len(a) >1{
+					for _,b :=range a{
+						if strings.Contains(b,"rememberMe"){
+							result = fmt.Sprintf("%v is shiro",url)
+							 common.LogSuccess(result)
+							return err, result
+						}
+					}
+				}
+			}
+		}
+	}
+	return err, ""
+}

common/ParseIP.go

@@ -18,6 +18,7 @@ var ParseIPErr  =errors.New("host parsing error\n" +
 	"192.168.1.1/16\n" +
 	"192.168.1.1/24\n" +
 	"192.168.1.1,192.168.1.2\n" +
+	"192.168.1.1-192.168.255.255\n" +
 	"192.168.1.1-255")
 
 func ParseIP(ip string, filename string) (hosts []string, err error) {
@@ -76,6 +77,7 @@ func ParseIPone(ip string)([]string,error){
 		return []string{ip}, nil
 	}
 }
+
 //Parsing CIDR IP
 func ParseIPA(ip string) ([]string, error) {
 	realIP := ip[:len(ip)-3]
@@ -105,10 +107,12 @@ func ParseIPB(ip string)([]string,error){
 
 }
 
-//Resolving a range of IP,for example: 192.168.111.1-255
+//Resolving a range of IP,for example: 192.168.111.1-255,192.168.111.1-192.168.112.255
 func ParseIPC(ip string) ([]string, error) {
 	IPRange := strings.Split(ip, "-")
 	testIP := net.ParseIP(IPRange[0])
+	var AllIP []string
+	if len(IPRange[1]) < 4 {
 		Range, err := strconv.Atoi(IPRange[1])
 		if testIP == nil || Range > 255 || err != nil {
 			return nil, ParseIPErr
@@ -117,13 +121,37 @@ func ParseIPC(ip string)([]string,error){
 		ip1, err1 := strconv.Atoi(SplitIP[3])
 		ip2, err2 := strconv.Atoi(IPRange[1])
 		PrefixIP := strings.Join(SplitIP[0:3], ".")
-	var AllIP []string
 		if ip1 > ip2 || err1 != nil || err2 != nil {
 			return nil, ParseIPErr
 		}
 		for i := ip1; i <= ip2; i++ {
 			AllIP = append(AllIP, PrefixIP+"."+strconv.Itoa(i))
 		}
+	} else {
+		SplitIP1 := strings.Split(IPRange[0], ".")
+		SplitIP2 := strings.Split(IPRange[1], ".")
+		fmt.Println(SplitIP1, SplitIP2, len(SplitIP1), len(SplitIP2))
+		if len(SplitIP1) != 4 || len(SplitIP2) != 4 {
+			return nil, ParseIPErr
+		}
+		start, end := [4]int{}, [4]int{}
+		for i := 0; i < 4; i++ {
+			ip1, err1 := strconv.Atoi(SplitIP1[i])
+			ip2, err2 := strconv.Atoi(SplitIP2[i])
+			if ip1 > ip2 || err1 != nil || err2 != nil {
+				return nil, ParseIPErr
+			}
+			start[i], end[i] = ip1, ip2
+		}
+		startNum := (start[0]<<24 | start[1]<<16 | start[2]<<8 | start[3])
+		endNum := (end[0]<<24 | end[1]<<16 | end[2]<<8 | end[3])
+		fmt.Println(startNum, endNum)
+		for num := startNum; num < endNum; num++ {
+			ip := (strconv.Itoa((num>>24)&0xff) + "." + strconv.Itoa((num>>16)&0xff) + "." + strconv.Itoa((num>>8)&0xff) + "." + strconv.Itoa((num)&0xff))
+			AllIP = append(AllIP, ip)
+		}
+	}
+
 	return AllIP, nil
 
 }
@@ -184,8 +212,7 @@ func Readipfile(filename string)([]string,error){
 	return content, nil
 }
 
-
-func RemoveDuplicate(old []string) ([]string) {
+func RemoveDuplicate(old []string) []string {
 	result := make([]string, 0, len(old))
 	temp := map[string]struct{}{}
 	for _, item := range old {
@@ -196,4 +223,3 @@ func RemoveDuplicate(old []string) ([]string) {
 	}
 	return result
 }
-

common/config.go

@@ -1,5 +1,6 @@
 package common
 
+//fscan version 1.3
 var Userdict = map[string][]string{
 	"ftp":        {"www", "admin", "root", "db", "wwwroot", "data", "web", "ftp"},
 	"mysql":      {"root"},
@@ -52,16 +53,18 @@ var PORTList_bak = map[string]int{
 var Outputfile = "result.txt"
 var IsSave = true
 
-var DefaultPorts = "21,22,23,80,135,443,445,1433,1521,3306,5432,6379,7001,8080,8089,9000,9200,11211,27017"
-
+var DefaultPorts = "21,22,80,81,135,443,445,1433,1521,3306,5432,6379,7001,8000,8080,8089,11211,27017"
 
 type HostInfo struct {
 	Host        string
 	HostFile    string
 	Ports       string
+	Domain      string
 	Url         string
 	Timeout     int64
+	WebTimeout  int64
 	Scantype    string
+	Ping        bool
 	Isping      bool
 	Threads     int
 	IcmpThreads int
@@ -77,5 +80,3 @@ type HostInfo struct {
 	RedisFile   string
 	RedisShell  string
 }
-
-

common/flag.go

@@ -16,9 +16,6 @@ func Banner(){
 	print(banner)
 }
 
-
-
-
 func Flag(Info *HostInfo) {
 	Banner()
 	flag.StringVar(&Info.Host, "h", "", "IP address of the host you want to scan,for example: 192.168.11.11 | 192.168.11.11-255 | 192.168.11.11,192.168.11.12")
@@ -26,15 +23,18 @@ func Flag(Info *HostInfo)  {
 	flag.StringVar(&Info.Ports, "p", DefaultPorts, "Select a port,for example: 22 | 1-65535 | 22,80,3306")
 	flag.StringVar(&Info.Command, "c", "", "exec command (ssh)")
 	flag.IntVar(&Info.Threads, "t", 200, "Thread nums")
-	flag.IntVar(&Info.IcmpThreads,"it",3000,"Icmp Threads nums")
+	flag.IntVar(&Info.IcmpThreads, "it", 11000, "Icmp Threads nums")
 	flag.BoolVar(&Info.Isping, "np", false, "not to ping")
+	flag.BoolVar(&Info.Ping, "ping", false, "using ping replace icmp")
 	flag.BoolVar(&Info.IsSave, "no", false, "not to save output log")
+	flag.StringVar(&Info.Domain, "domain", "", "smb domain")
 	flag.StringVar(&Info.Username, "user", "", "username")
 	flag.StringVar(&Info.Userfile, "userf", "", "username file")
 	flag.StringVar(&Info.Password, "pwd", "", "password")
 	flag.StringVar(&Info.Passfile, "pwdf", "", "password file")
 	flag.StringVar(&Info.Outputfile, "o", "result.txt", "Outputfile")
 	flag.Int64Var(&Info.Timeout, "time", 3, "Set timeout")
+	flag.Int64Var(&Info.WebTimeout, "wt", 3, "Set web timeout")
 	flag.StringVar(&Info.Scantype, "m", "all", "Select scan type ,as: -m ssh")
 	flag.StringVar(&Info.RedisFile, "rf", "", "redis file to write sshkey file (as: -rf id_rsa.pub) ")
 	flag.StringVar(&Info.RedisShell, "rs", "", "redis shell to write cron file (as: -rs 192.168.1.1:6666) ")

go.mod

@@ -0,0 +1,12 @@
+module github.com/shadow1ng/fscan
+
+go 1.13
+
+require (
+	github.com/denisenkom/go-mssqldb v0.9.0
+	github.com/go-sql-driver/mysql v1.5.0
+	github.com/jlaffaye/ftp v0.0.0-20201112195030-9aae4d151126
+	github.com/lib/pq v1.8.0
+	github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8
+	golang.org/x/crypto v0.0.0-20201116153603-4be66e5b6582
+)

go.sum

@@ -0,0 +1,27 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/denisenkom/go-mssqldb v0.9.0 h1:RSohk2RsiZqLZ0zCjtfn3S4Gp4exhpBWHyQ7D0yGjAk=
+github.com/denisenkom/go-mssqldb v0.9.0/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
+github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs=
+github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
+github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/jlaffaye/ftp v0.0.0-20201112195030-9aae4d151126 h1:ly2C51IMpCCV8RpTDRXgzG/L9iZXb8ePEixaew/HwBs=
+github.com/jlaffaye/ftp v0.0.0-20201112195030-9aae4d151126/go.mod h1:2lmrmq866uF2tnje75wQHzmPXhmSWUt7Gyx2vgK1RCU=
+github.com/lib/pq v1.8.0 h1:9xohqzkUwzR4Ga4ivdTcawVS89YSDVxXMa3xJX3cGzg=
+github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8 h1:GVFkBBJAEO3CpzIYcDDBdpUObzKwVW9okNWcLYL/nnU=
+github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8/go.mod h1:phLSETqH/UJsBtwDVBxSfJKwwkbJcGyy2Q/h4k+bmww=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20201116153603-4be66e5b6582 h1:0WDrJ1E7UolDk1KhTXxxw3Fc8qtk5x7dHP431KHEJls=
+golang.org/x/crypto v0.0.0-20201116153603-4be66e5b6582/go.mod h1:tCqSYrHVcf3i63Co2FzBkTCo2gdF6Zak62921dSfraU=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/term v0.0.0-20201113234701-d7a72108b828/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

main.go

@@ -1,8 +1,8 @@
 package main
 
 import (
-	"./common"
-	"./Plugins"
+	"github.com/shadow1ng/fscan/common"
+	"github.com/shadow1ng/fscan/Plugins"
 	"fmt"
 )