添加打印机指纹

Plugins/NetBIOS.go

@@ -125,6 +125,9 @@ func NetBIOS1(info *common.HostInfo) (nbname NbnsName, err error) {
 		return
 	}
 	length := num1 + num2*256
+	if len(ret) < 48+length {
+		return
+	}
 	os_version := ret[47+length:]
 	tmp1 := bytes.ReplaceAll(os_version, []byte{0x00, 0x00}, []byte{124})
 	tmp1 = bytes.ReplaceAll(tmp1, []byte{0x00}, []byte{})

Plugins/icmp.go

@@ -3,6 +3,7 @@ package Plugins
 import (
 	"bytes"
 	"fmt"
+	"github.com/shadow1ng/fscan/common"
 	"golang.org/x/net/icmp"
 	"log"
 	"net"
@@ -77,7 +78,9 @@ func IcmpCheck(hostslist []string) {
 		for ip := range chanHosts {
 			if _, ok := TmpHosts[ip]; !ok {
 				TmpHosts[ip] = struct{}{}
-				fmt.Printf("(icmp) Target '%s' is alive\n", ip)
+				if common.Silent == false {
+					fmt.Printf("(icmp) Target '%s' is alive\n", ip)
+				}
 				AliveHosts = append(AliveHosts, ip)
 			}
 		}
@@ -141,7 +144,9 @@ func PingCMDcheck(hostslist []string, bsenv string) {
 			defer wg.Done()
 			if ExecCommandPing(host, bsenv) {
 				mutex.Lock()
-				fmt.Printf("(Ping) Target '%s' is alive\n", host)
+				if common.Silent == false {
+					fmt.Printf("(Ping) Target '%s' is alive\n", host)
+				}
 				AliveHosts = append(AliveHosts, host)
 				mutex.Unlock()
 			}

Plugins/mssql.go

@@ -36,7 +36,7 @@ func MssqlScan(info *common.HostInfo) (tmperr error) {
 func MssqlConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, info.Ports, user, pass
-	dataSourceName := fmt.Sprintf("server=%s;user id=%s;password=%s;port=%d;encrypt=disable;timeout=%d", Host, Username, Password, Port, time.Duration(info.Timeout)*time.Second)
+	dataSourceName := fmt.Sprintf("server=%s;user id=%s;password=%s;port=%v;encrypt=disable;timeout=%v", Host, Username, Password, Port, time.Duration(info.Timeout)*time.Second)
 	db, err := sql.Open("mssql", dataSourceName)
 	if err == nil {
 		db.SetConnMaxLifetime(time.Duration(info.Timeout) * time.Second)

Plugins/mysql.go

@@ -36,7 +36,7 @@ func MysqlScan(info *common.HostInfo) (tmperr error) {
 func MysqlConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, info.Ports, user, pass
-	dataSourceName := fmt.Sprintf("%v:%v@tcp(%v:%v)/%v?charset=utf8", Username, Password, Host, Port, "mysql")
+	dataSourceName := fmt.Sprintf("%v:%v@tcp(%v:%v)/mysql?charset=utf8&timeout=%v", Username, Password, Host, Port, time.Duration(info.Timeout)*time.Second)
 	db, err := sql.Open("mysql", dataSourceName)
 	if err == nil {
 		db.SetConnMaxLifetime(time.Duration(info.Timeout) * time.Second)

Plugins/webtitle.go

@@ -2,6 +2,7 @@ package Plugins
 
 import (
 	"bytes"
+	"compress/gzip"
 	"fmt"
 	"github.com/shadow1ng/fscan/WebScan"
 	"github.com/shadow1ng/fscan/WebScan/lib"
@@ -9,6 +10,7 @@ import (
 	"golang.org/x/net/html/charset"
 	"golang.org/x/text/encoding/simplifiedchinese"
 	"golang.org/x/text/transform"
+	"io"
 	"io/ioutil"
 	"net/http"
 	"net/url"
@@ -51,7 +53,7 @@ func GOWebTitle(info *common.HostInfo) error {
 	}
 
 	err, result, CheckData := geturl(info, 1, CheckData)
-	if err != nil {
+	if err != nil && !strings.Contains(err.Error(), "EOF") {
 		return err
 	}
 	if strings.Contains(result, "://") {
@@ -67,6 +69,7 @@ func GOWebTitle(info *common.HostInfo) error {
 	}
 
 	if result == "https" {
+		info.Url = strings.Replace(info.Url, "http://", "https://", 1)
 		err, result, CheckData = geturl(info, 1, CheckData)
 		if strings.Contains(result, "://") {
 			//有跳转
@@ -132,12 +135,16 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
 		if err == nil {
 			defer resp.Body.Close()
 			var title string
-			body, _ := ioutil.ReadAll(resp.Body)
+			var text []byte
+			body, err := getRespBody(resp)
+			if err != nil {
+				return err, "", CheckData
+			}
 			if flag != 2 {
 				re := regexp.MustCompile("(?im)<title>(.*)</title>")
 				find := re.FindSubmatch(body)
 				if len(find) > 1 {
-					text := find[1]
+					text = find[1]
 					GetEncoding := func() string { // 判断Content-Type
 						r1, err := regexp.Compile(`(?im)charset=\s*?([\w-]+)`)
 						if err != nil {
@@ -186,7 +193,14 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
 				if len(title) > 100 {
 					title = title[:100]
 				}
-				result := fmt.Sprintf("[*] WebTitle:%-25v %-3v %v", Url, resp.StatusCode, title)
+				if title == "" {
+					title = "None"
+				}
+				length := resp.Header.Get("Content-Length")
+				if length == "" {
+					length = fmt.Sprintf("%v", len(text))
+				}
+				result := fmt.Sprintf("[*] WebTitle:%-25v code:%-3v len:%-6v title:%v", Url, resp.StatusCode, length, title)
 				common.LogSuccess(result)
 			}
 			CheckData = append(CheckData, WebScan.CheckDatas{body, fmt.Sprintf("%s", resp.Header)})
@@ -195,12 +209,11 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
 				return nil, redirURL.String(), CheckData
 			}
 			if resp.StatusCode == 400 && info.Url[:5] != "https" {
-				info.Url = strings.Replace(info.Url, "http://", "https://", 1)
 				return err, "https", CheckData
 			}
 			return err, "", CheckData
 		}
-		return err, "", CheckData
+		return err, "https", CheckData
 	}
 	return err, "", CheckData
 }
@@ -214,3 +227,33 @@ func Decodegbk(s []byte) ([]byte, error) { // GBK解码
 	}
 	return d, nil
 }
+
+func getRespBody(oResp *http.Response) ([]byte, error) {
+	var body []byte
+	if oResp.Header.Get("Content-Encoding") == "gzip" {
+		gr, err := gzip.NewReader(oResp.Body)
+		if err != nil {
+			return nil, err
+		}
+		defer gr.Close()
+		for {
+			buf := make([]byte, 1024)
+			n, err := gr.Read(buf)
+			if err != nil && err != io.EOF {
+				return nil, err
+			}
+			if n == 0 {
+				break
+			}
+			body = append(body, buf...)
+		}
+	} else {
+		raw, err := ioutil.ReadAll(oResp.Body)
+		if err != nil {
+			return nil, err
+		}
+		defer oResp.Body.Close()
+		body = raw
+	}
+	return body, nil
+}

WebScan/info/rules.go

@@ -95,6 +95,7 @@ var RuleDatas = []RuleData{
 	{"360网站安全检测", "code", "(webscan.360.cn/status/pai/hash)"},
 	{"H3C ER5200G2", "code", "(ER5200G2系统管理)"},
 	{"华为（HUAWEI）安全设备", "code", "(sweb-lib/resource/)"},
+	{"华为（HUAWEI）USG", "code", "(UI_component/commonDefine/UI_regex_define.js)"},
 	{"H3C ER6300", "code", "(ER6300系统管理)"},
 	{"华为_HUAWEI_ASG2100", "code", "(HUAWEI ASG2100)"},
 	{"TP-Link 3600 DD-WRT", "code", "(TP-Link 3600 DD-WRT)"},
@@ -126,6 +127,7 @@ var RuleDatas = []RuleData{
 	{"Jenkins", "code", "(Jenkins)"},
 	{"红帆OA", "code", "(iOffice)"},
 	{"VMware vSphere", "code", "(VMware vSphere)"},
+	{"打印机", "code", "(打印机|media/canon.gif)"},
 }
 
 var Md5Datas = []Md5Data{

common/flag.go

@@ -38,7 +38,8 @@ func Flag(Info *HostInfo) {
 	flag.BoolVar(&Ping, "ping", false, "using ping replace icmp")
 	flag.StringVar(&TmpOutputfile, "o", "result.txt", "Outputfile")
 	flag.BoolVar(&TmpSave, "no", false, "not to save output log")
-	flag.Int64Var(&WaitTime, "debug", 120, "every time to LogErr")
+	flag.Int64Var(&WaitTime, "debug", 60, "every time to LogErr")
+	flag.BoolVar(&Silent, "silent", false, "silent scan")
 	flag.StringVar(&URL, "u", "", "url")
 	flag.StringVar(&UrlFile, "uf", "", "urlfile")
 	flag.StringVar(&Pocinfo.PocName, "pocname", "", "use the pocs these contain pocname, -pocname weblogic")

common/log.go

@@ -15,6 +15,7 @@ var Start = true
 var LogSucTime int64
 var LogErrTime int64
 var WaitTime int64
+var Silent bool
 var LogWG sync.WaitGroup
 
 func LogSuccess(result string) {
@@ -29,7 +30,9 @@ func LogSuccess(result string) {
 
 func SaveLog() {
 	for result := range Results {
-		fmt.Println(result)
+		if Silent == false || strings.Contains(result, "[+]") || strings.Contains(result, "[*]") {
+			fmt.Println(result)
+		}
 		if IsSave {
 			WriteFile(result, Outputfile)
 		}
@@ -72,6 +75,7 @@ func CheckErrs(err error) bool {
 		"no pg_hba.conf entry",
 		"no supported methods remain",
 		"No connection could be made",
+		"invalid packet size",
 	}
 	for _, key := range errs {
 		if strings.Contains(strings.ToLower(err.Error()), strings.ToLower(key)) {