diff --git a/CONFIG.md b/CONFIG.md index 55d679c..9eed012 100644 --- a/CONFIG.md +++ b/CONFIG.md @@ -8,9 +8,10 @@ token: # Authentication Token, both the admin pag domains: [] # The domain names used by the platform external_ip: # The external IP of the platform, you need to make sure that the target you want to test can access the platform through this IP admin_path_prefix: "/revsuit" # The http path prefix for the admin page, the page will be located at: /admin_path_prefix/admin -database: revsuit.db # Database connection information, support using Sqlite3, MySQL, Postgres -# database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local" +# Database connection information, support using MySQL, Postgres, Sqlite3 +database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local" # database: "postgres://host=127.0.0.1 user=root password=password dbname=revsuit port=5432 sslmode=disable TimeZone=Asia/Shanghai" +#database: revsuit.db # The use of sqlite databases on some systems may cause `SQLITE BUSY` problems in concurrent scenarios, so it is not recommended for use in a formal environment log_level: info # Output log levels, divided into: debug, info, warning, error, fatal check_upgrade: true # Whether to automatically check for updates @@ -43,4 +44,4 @@ notice: lark: https://open.feishu.cn/open-apis/bot/v2/hook/{token} # Webhook of Lark Bot weixin: https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key={key} # Webhook of Weixin Bot slack: https://hooks.slack.com/services/{id}/{token} # Webhook of Slack Bot -``` \ No newline at end of file +``` diff --git a/CONFIG.zh-CN.md b/CONFIG.zh-CN.md index 5dc1b09..b0831cf 100644 --- a/CONFIG.zh-CN.md +++ b/CONFIG.zh-CN.md @@ -7,9 +7,10 @@ token: # 鉴权Token,管理页面和客户端 domains: [] # 反连平台绑定的域名 external_ip: # 反连平台的外部IP,需要确保你想测试的目标能通过该 IP 访问到平台 admin_path_prefix: "/revsuit" # 管理页面的 http path 前缀,管理页面将位于:/admin_path_prefix/admin -database: revsuit.db # 数据库连接信息 支持Sqlite3、MySQL、Postgres -# database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local" +# 数据库连接信息 支持MySQL、Postgres、SQLite3 +database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local" # database: "postgres://host=127.0.0.1 user=root password=password dbname=revsuit port=5432 sslmode=disable TimeZone=Asia/Shanghai" +#database: revsuit.db # 在部分系统上使用 sqlite 数据库时,在并发场景下可能会出现 `SQLITE BUSY` 的问题,因此不推荐在正式环境中使用该类型数据库 log_level: info # 输出日志的级别,分为:debug、info、warning、error、fatal check_upgrade: false # 是否自动检查更新 @@ -43,4 +44,4 @@ notice: weixin: https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key={key} # 企业微信机器人webhook地址 slack: https://hooks.slack.com/services/{id}/{token} # slack机器人webhook地址 -``` \ No newline at end of file +``` diff --git a/README.md b/README.md index 8c90fe4..72530a6 100644 --- a/README.md +++ b/README.md @@ -158,6 +158,11 @@ example. As shown above, RevSuit supports multiple clients, and each client **in the connected state** receives a push of `flag`, so distributed scanning can be supported. +If you don't want every client to receive all `flag` pushes, you can use the `Flag-Filter` request header when creating an sse connection to set the format(regular expressions) of the `flag` you want that client to receive: + +![img.png](./images/flag-filter.gif) + + #### Temporary storage queue RevSuit will store `flag` temporarily in the queue when there is no client connection and send it when the client diff --git a/README.zh-CN.md b/README.zh-CN.md index e54276b..bdde60a 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -140,6 +140,11 @@ RevSuit 如上一节的图片里所展示的,RevSuit 支持多个客户端,每个在**连接状态**的客户端都会接收到 `flag` 的推送,因此分布式扫描也是支持的。 +如果你不希望每个客户端都收到全部的 `flag` 推送,你可以在创建 sse 连接时,使用 `Flag-Filter` 请求头设置希望该客户端接受的 `flag` 的格式(支持正则表达式),例如: + +![img.png](./images/flag-filter.gif) + + #### 暂存队列 当没有客户端连接的时候,RevSuit 会把 `flag` 暂时存储到队列里,当有客户端连接的时候再进行推送。因此你不必担心因为客户端与 RevSuit 断开连接就错过漏洞。(这对发现延时触发的漏洞尤为有帮助) @@ -225,4 +230,4 @@ payload,最后被扫描器发出的请求是:`['https://www.testvuln.com?url ## 开源许可协议 -@Apache License 2.0 \ No newline at end of file +@Apache License 2.0 diff --git a/images/flag-filter.gif b/images/flag-filter.gif new file mode 100644 index 0000000..becd1ef Binary files /dev/null and b/images/flag-filter.gif differ