chore(release): 0.6.0

#63

.gitignore

@@ -28,4 +28,7 @@ package-lock.json
 node_modules/
 
 ## frontend dist
-dist/
+dist/
+
+## received files
+revsuit-files

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [0.6.0](https://github.com/Li4n0/revsuit/compare/v0.5.2...v0.6.0) (2023-03-24)
+
+
+### Features
+
+* support for using `Flag-Filter` request headers to filter the flags that the client expects to receive ([#64](https://github.com/Li4n0/revsuit/issues/64)) ([b33de11](https://github.com/Li4n0/revsuit/commit/b33de11ba8f126b03a45ad15cae69331ad59b865))
+
+
+### Bug Fixes
+
+* fix static resource loading failure after modifying `admin_path_prefix` ([b76757d](https://github.com/Li4n0/revsuit/commit/b76757da331b56f240ec2a0c69d479f3184bc4c2)), closes [#63](https://github.com/Li4n0/revsuit/issues/63)
+
 ### [0.5.2](https://github.com/Li4n0/revsuit/compare/v0.5.1...v0.5.2) (2022-11-16)
 
 

CONFIG.md

@@ -8,9 +8,10 @@ token:                                # Authentication Token, both the admin pag
 domains: []                           # The domain names used by the platform
 external_ip:                          # The external IP of the platform, you need to make sure that the target you want to test can access the platform through this IP
 admin_path_prefix: "/revsuit"          # The http path prefix for the admin page, the page will be located at: /admin_path_prefix/admin
-database: revsuit.db                  # Database connection information, support using Sqlite3, MySQL, Postgres
-# database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local"
+# Database connection information, support using MySQL, Postgres, Sqlite3
+database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local"
 # database: "postgres://host=127.0.0.1 user=root password=password dbname=revsuit port=5432 sslmode=disable TimeZone=Asia/Shanghai"
+#database: revsuit.db # The use of sqlite databases on some systems may cause `SQLITE BUSY` problems in concurrent scenarios, so it is not recommended for use in a formal environment
 
 log_level: info                       # Output log levels, divided into: debug, info, warning, error, fatal
 check_upgrade: true                   # Whether to automatically check for updates
@@ -43,4 +44,4 @@ notice:
   lark: https://open.feishu.cn/open-apis/bot/v2/hook/{token}               # Webhook of Lark Bot 
   weixin: https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key={key}       # Webhook of Weixin Bot
   slack: https://hooks.slack.com/services/{id}/{token}                     # Webhook of Slack Bot
-```
+```

CONFIG.zh-CN.md

@@ -7,9 +7,10 @@ token:                                # 鉴权Token，管理页面和客户端
 domains: []                           # 反连平台绑定的域名
 external_ip:                          # 反连平台的外部IP，需要确保你想测试的目标能通过该 IP 访问到平台
 admin_path_prefix: "/revsuit"          # 管理页面的 http path 前缀，管理页面将位于：/admin_path_prefix/admin
-database: revsuit.db                  # 数据库连接信息 支持Sqlite3、MySQL、Postgres
-# database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local"
+# 数据库连接信息 支持MySQL、Postgres、SQLite3
+database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local"
 # database: "postgres://host=127.0.0.1 user=root password=password dbname=revsuit port=5432 sslmode=disable TimeZone=Asia/Shanghai"
+#database: revsuit.db # 在部分系统上使用 sqlite 数据库时，在并发场景下可能会出现 `SQLITE BUSY` 的问题，因此不推荐在正式环境中使用该类型数据库
 
 log_level: info                       # 输出日志的级别，分为：debug、info、warning、error、fatal
 check_upgrade: false                  # 是否自动检查更新
@@ -43,4 +44,4 @@ notice:
   weixin: https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key={key}       # 企业微信机器人webhook地址
   slack: https://hooks.slack.com/services/{id}/{token}                     # slack机器人webhook地址
 
-```
+```

README.md

@@ -158,6 +158,11 @@ example.
 As shown above, RevSuit supports multiple clients, and each client **in the connected state** receives a push of `flag`,
 so distributed scanning can be supported.
 
+If you don't want every client to receive all `flag` pushes, you can use the `Flag-Filter` request header when creating an sse connection to set the format(regular expressions) of the `flag` you want that client to receive:
+
+![img.png](./images/flag-filter.gif)
+
+
 #### Temporary storage queue
 
 RevSuit will store `flag` temporarily in the queue when there is no client connection and send it when the client

README.zh-CN.md

@@ -140,6 +140,11 @@ RevSuit
 
 如上一节的图片里所展示的，RevSuit 支持多个客户端，每个在**连接状态**的客户端都会接收到 `flag` 的推送，因此分布式扫描也是支持的。
 
+如果你不希望每个客户端都收到全部的 `flag` 推送，你可以在创建 sse 连接时，使用 `Flag-Filter` 请求头设置希望该客户端接受的 `flag` 的格式（支持正则表达式），例如:
+
+![img.png](./images/flag-filter.gif)
+
+
 #### 暂存队列
 
 当没有客户端连接的时候，RevSuit 会把 `flag` 暂时存储到队列里，当有客户端连接的时候再进行推送。因此你不必担心因为客户端与 RevSuit 断开连接就错过漏洞。（这对发现延时触发的漏洞尤为有帮助）
@@ -225,4 +230,4 @@ payload，最后被扫描器发出的请求是：`['https://www.testvuln.com?url
 
 ## 开源许可协议
 
-@Apache License 2.0
+@Apache License 2.0

frontend/src/views/logs/Ftp.vue

@@ -47,7 +47,7 @@
      <a-tag
          v-if="file"
          color="#f5222d"
-     ><a target="_blank" :href="'/revsuit/api/file/ftp/'+file.id">TRUE</a> </a-tag>
+     ><a target="_blank" :href="'../api/file/ftp/'+file.id">TRUE</a> </a-tag>
      <a-tag v-else color="#722ed1">
       FALSE
       </a-tag>

frontend/src/views/logs/Mysql.vue

@@ -10,7 +10,7 @@
   >
     <div v-if="record.files.length" slot="expandedRowRender" slot-scope="record" style="margin: 0">
       <b v-if="record.files.length" style="color: gray">FILES:</b><br>
-      <a v-for="file in record.files" :key="file.name+record.id" :href="'/revsuit/api/file/mysql/'+file.id"
+      <a v-for="file in record.files" :key="file.name+record.id" :href="'../api/file/mysql/'+file.id"
          target="_blank">{{ file.name }} </a>
     </div>
     <div slot="selectDropdown"

frontend/src/views/settings/Rules.vue

@@ -3,13 +3,13 @@
     <a-space size="middle">
       <a-upload
           name="rules"
-          action="/revsuit/api/setting/importRules"
+          action="../api/setting/importRules"
           @change="handleChange"
           :showUploadList="false"
       >
         <a-button type="primary" icon="upload">Import</a-button>
       </a-upload>
-      <a-button type="primary" icon="download" onclick="window.open('/revsuit/api/setting/exportRules')">Export
+      <a-button type="primary" icon="download" onclick="window.open('../api/setting/exportRules')">Export
       </a-button>
     </a-space>
     <a-result v-if="status"

frontend/vue.config.js

@@ -11,14 +11,11 @@ module.exports = {
         proxy: {
             '/api': {
                 target: 'http://localhost:10000',
-                pathRewrite: {
-                    '^/api': '/revsuit/api'
-                }
             }
         },
     },
     productionSourceMap: false,
     runtimeCompiler: true,
     filenameHashing: false,
-    publicPath: '/revsuit/admin/',
+    publicPath: '',
 }

pkg/server/server.go

@@ -1,8 +1,10 @@
 package server
 
 import (
+	"regexp"
 	"sync"
 
+	"github.com/gin-contrib/sse"
 	"github.com/gin-gonic/gin"
 	"github.com/li4n0/revsuit/internal/database"
 	"github.com/li4n0/revsuit/internal/file"
@@ -44,6 +46,8 @@ func (revsuit *Revsuit) addClient(c *gin.Context) int {
 
 	revsuit.clientID++
 	revsuit.clients[revsuit.clientID] = c
+	sse.Event{}.WriteContentType(c.Writer)
+	c.Writer.Flush()
 	revsuit.clientsNum <- struct{}{}
 	return revsuit.clientID
 }
@@ -231,8 +235,23 @@ func (revsuit *Revsuit) Run() {
 			<-revsuit.clientsNum
 			revsuit.clientsLock.RLock()
 			for _, client := range revsuit.clients {
-				client.SSEvent("message", r.GetFlag())
-				client.Writer.Flush()
+				pushIt := false
+				flag := client.Request.Header.Get("Flag-Filter")
+				if len(flag) == 0 || flag == "*" {
+					pushIt = true
+				} else {
+					if catcher, err := regexp.Compile(flag); err != nil {
+						log.Warn("%s[sse flag:%s]", err, flag)
+						continue
+					} else {
+						matched := catcher.FindStringSubmatch(r.GetFlag())
+						pushIt = len(matched) > 0
+					}
+				}
+				if pushIt {
+					client.SSEvent("message", r.GetFlag())
+					client.Writer.Flush()
+				}
 			}
 			revsuit.clientsNum <- struct{}{}
 			revsuit.clientsLock.RUnlock()