tools

Documentation

Index

• Variables
• func BinaryLocations(binaryName ...string) []string
• func FetchCurrentNucleiTemplates(defaultDirs ...string) ([]*templateDesc, error)
• func HandleNucleiResultFromFile(ctx context.Context, fileName string) (chan *PocVul, error)
• func HandleNucleiResultFromReader(i io.Reader) chan *PocVul
• func HandleXrayResultChan(r io.Reader) chan *PocVul
• func LoadYamlPoCDatabase(nucleiDir ...string) error
• func PocVulToRisk(p *PocVul) *yakit.Risk
• func PullTemplatesFromGithub(giturl string, proxy ...string) (string, error)
• func RemovePoCDatabase() error
• func ResourceLocations(resResources ...string) []string
• type PocInvoker
  • func NewPocInvoker() (*PocInvoker, error)
  • func (p *PocInvoker) Exec(urls ...string) ([]*PocVul, error)
• type PocVul
  • func HandleNucleiResult(raw []byte) []*PocVul
  • func HandleXrayResult(raw []byte) []*PocVul
• type SubFinderInstance
  • func NewSubFinderInstance() (*SubFinderInstance, error)
  • func (s *SubFinderInstance) Exec(domain string, nsServers ...string) ([]*subdomain.SubdomainResult, error)
  • func (s *SubFinderInstance) SetTimeout(ts string)
  • func (s *SubFinderInstance) SetTimeoutRaw(t time.Duration)

Variables

var BruterExports = map[string]interface{}{
	"GetAvailableBruteTypes": func() []string {
		return bruteutils.GetBuildinAvailableBruteType()
	},
	"GetUsernameListFromBruteType": bruteutils.GetUsernameListFromBruteType,
	"GetPasswordListFromBruteType": bruteutils.GetPasswordListFromBruteType,

	"New":                _yakitBruterNew,
	"concurrentTarget":   yakBruteOpt_ConcurrentTarget,
	"debug":              yakBruteOpt_Debug,
	"userList":           yakBruteOpt_userlist,
	"passList":           yakBruteOpt_passlist,
	"concurrent":         yakBruteOpt_concurrent,
	"minDelay":           yakBruteOpt_minDelay,
	"maxDelay":           yakBruteOpt_maxDelay,
	"bruteHandler":       yakBruteOpt_coreHandler,
	"okToStop":           yakBruteOpt_OkToStop,
	"finishingThreshold": yakBruteOpt_FinishingThreshold,
}

var BuildinNucleiYakScriptParam = []*ypb.YakScriptParam{
	{
		Field:        "target",
		DefaultValue: "",
		TypeVerbose:  "string",
		Required:     true,
		FieldVerbose: "扫描目标",
		Help:         "扫描目标可接受：主机名 / 主机名:端口 / IP段 / URL 等多种格式",
	},
	{
		Field:        "reverse-url",
		DefaultValue: "",
		TypeVerbose:  "string",
		FieldVerbose: "反连 URL",
		Help:         "可使用 InteractshURL 也可使用 Yakit Reverse URL",
	},
	{
		Field:        "debug",
		DefaultValue: "",
		TypeVerbose:  "boolean",
		FieldVerbose: "设置调试模式",
		Help:         "开启调试模式，调试模式将输出尽量多的调试信息",
	},
	{
		Field:        "proxy",
		DefaultValue: "",
		TypeVerbose:  "proxy",
		FieldVerbose: "HTTP 代理",
		Help:         "设置 HTTP 代理",
	},
}

var Exports = map[string]interface{}{

	"NewPocInvoker": func() (*PocInvoker, error) {
		return NewPocInvoker()
	},
	"NewBruteUtil": func(t string) (*bruteutils.BruteUtil, error) {
		res, err := bruteutils.GetBruteFuncByType(t)
		if err != nil {
			return nil, err
		}
		ut, err := bruteutils.NewMultiTargetBruteUtil(256, 1, 5, res)
		if err != nil {
			return nil, utils.Errorf("create brute utils failed: %s", err)
		}
		return ut, nil
	},
}

var FinPortScanExports = map[string]interface{}{
	"Scan": func(target string, port string, opts ...finScanOpt) (chan *finscan.FinScanResult, error) {
		config := &_yakFinPortScanConfig{
			waiting:           10 * time.Second,
			rateLimitDelayMs:  1,
			rateLimitDelayGap: 5,
		}
		for _, opt := range opts {
			opt(config)
		}
		return _finscanDo(hostsToChan(target), port, config)
	},

	"excludePorts":   _finScanOptExcludePorts,
	"excludeHosts":   _finScanOptExcludeHosts,
	"wait":           _finScanOptWaiting,
	"outputFile":     _finScanOptOpenPortResult,
	"outputPrefix":   _finScanOptOpenPortResultPrefix,
	"initHostFilter": _finScanOptOpenPortInitHostFilter,
	"initPortFilter": _finScanOptOpenPortInitPortFilter,
	"rateLimit":      _finScanOptRateLimit,
	"concurrent":     _finScanOptConcurrent,
}

FinPortScanExports 为了防止网卡过载，5个是上限

1. waiting 实现
2. timeout

var FingerprintScanExports = map[string]interface{}{
	"Scan":                scanFingerprint,
	"ScanOne":             scanOneFingerprint,
	"ScanFromSynResult":   _scanFromTargetStream,
	"ScanFromSpaceEngine": _scanFromTargetStream,
	"ScanFromPing":        _scanFromPingUtils,

	"proto": func(proto ...interface{}) fp.ConfigOption {
		return fp.WithTransportProtos(fp.ParseStringToProto(proto...)...)
	},

	"concurrent": fp.WithPoolSize,

	"excludePorts": fp.WithExcludePorts,
	"excludeHosts": fp.WithExcludeHosts,

	"probeTimeout": fp.WithProbeTimeoutHumanRead,

	"proxy": fp.WithProxy,

	"cache":         fp.WithCache,
	"databaseCache": fp.WithDatabaseCache,

	"webRule": fp.WithWebFingerprintRule,

	"nmapRule": fp.WithNmapRule,

	"nmapRarityMax": fp.WithRarityMax,

	"active": fp.WithActiveMode,

	"maxProbes": fp.WithProbesMax,

	"maxProbesConcurrent": fp.WithProbesConcurrentMax,

	"web": func() fp.ConfigOption {
		return func(config *fp.Config) {
			config.OnlyEnableWebFingerprint = true
		}
	},

	"service": func() fp.ConfigOption {
		return func(config *fp.Config) {
			config.DisableWebFingerprint = true
		}
	},

	"all": func() fp.ConfigOption {
		return func(config *fp.Config) {
			config.ForceEnableWebFingerprint = true
		}
	},
}

var NucleiOperationsExports = map[string]interface{}{
	"PullDatabase":   PullTemplatesFromGithub,
	"UpdateDatabase": LoadYamlPoCDatabase,
	"RemoveDatabase": RemovePoCDatabase,
	"AllPoC":         FetchCurrentNucleiTemplates,
	"PocVulToRisk":   PocVulToRisk,
	"GetPoCDir":      consts.GetNucleiTemplatesDir,
}

var SubDomainExports = map[string]interface{}{
	"Scan": _subdomainScan,

	"wildcardToStop":   subdomain.WithWildCardToStop,
	"recursive":        subdomain.WithAllowToRecursive,
	"workerConcurrent": subdomain.WithWorkerCount,
	"dnsServer":        subdomain.WithDNSServers,
	"maxDepth":         subdomain.WithMaxDepth,
	"targetConcurrent": subdomain.WithParallelismTasksCount,
	"targetTimeout": func(i float64) subdomain.ConfigOption {
		return subdomain.WithTimeoutForEachTarget(utils.FloatSecondDuration(i))
	},
	"eachQueryTimeout": func(i float64) subdomain.ConfigOption {
		return subdomain.WithTimeoutForEachQuery(utils.FloatSecondDuration(i))
	},
	"eachSearchTimeout": func(i float64) subdomain.ConfigOption {
		return subdomain.WithTimeoutForEachHTTPSearch(utils.FloatSecondDuration(i))
	},

	"mainDict": func(i interface{}) subdomain.ConfigOption {
		return subdomain.WithMainDictionary(utils.StringAsFileParams(i))
	},

	"recursiveDict": func(i interface{}) subdomain.ConfigOption {
		return subdomain.WithSubDictionary(utils.StringAsFileParams(i))
	},
}

var SynPortScanExports = map[string]interface{}{
	"FixPermission": pcapfix.Fix,
	"Scan": func(target string, port string, opts ...scanOpt) (chan *synscan.SynScanResult, error) {
		config := &_yakPortScanConfig{
			waiting:           5 * time.Second,
			rateLimitDelayMs:  1,
			rateLimitDelayGap: 5,
		}
		for _, opt := range opts {
			opt(config)
		}
		return _synScanDo(hostsToChan(target), port, config)
	},
	"ScanFromPing": _synscanFromPingUtils,

	"callback":           _scanOptCallback,
	"submitTaskCallback": _scanOptSubmitTaskCallback,
	"excludePorts":       _scanOptExcludePorts,
	"excludeHosts":       _scanOptExcludeHosts,
	"wait":               _scanOptWaiting,
	"outputFile":         _scanOptOpenPortResult,
	"outputPrefix":       _scanOptOpenPortResultPrefix,
	"initHostFilter":     _scanOptOpenPortInitHostFilter,
	"initPortFilter":     _scanOptOpenPortInitPortFilter,
	"rateLimit":          _scanOptRateLimit,
	"concurrent":         _scanOptSYNConcurrent,
}

为了防止网卡过载，5个是上限

1. waiting 实现
2. timeout

Functions

func BinaryLocations

func BinaryLocations(binaryName ...string) []string

func FetchCurrentNucleiTemplates

func FetchCurrentNucleiTemplates(defaultDirs ...string) ([]*templateDesc, error)

func HandleNucleiResultFromFile

func HandleNucleiResultFromFile(ctx context.Context, fileName string) (chan *PocVul, error)

func HandleNucleiResultFromReader

func HandleNucleiResultFromReader(i io.Reader) chan *PocVul

func HandleXrayResultChan

func HandleXrayResultChan(r io.Reader) chan *PocVul

func LoadYamlPoCDatabase

func LoadYamlPoCDatabase(nucleiDir ...string) error

func PocVulToRisk

func PocVulToRisk(p *PocVul) *yakit.Risk

func PullTemplatesFromGithub

func PullTemplatesFromGithub(giturl string, proxy ...string) (string, error)

func RemovePoCDatabase

func RemovePoCDatabase() error

func ResourceLocations

func ResourceLocations(resResources ...string) []string

Types

type PocInvoker

type PocInvoker struct {
	// contains filtered or unexported fields
}

func NewPocInvoker

func NewPocInvoker() (*PocInvoker, error)

func (*PocInvoker) Exec

func (p *PocInvoker) Exec(urls ...string) ([]*PocVul, error)

type PocVul

type PocVul struct {
	Source    string
	PocName   string
	MatchedAt string
	Target    string
	IP        string
	Port      int
	Timestamp int64
	Payload   string
	Severity  string
	RawJson   string
	Tags      string
	TitleName string
	Details   map[string]interface{}
}

func HandleNucleiResult

func HandleNucleiResult(raw []byte) []*PocVul

func HandleXrayResult

func HandleXrayResult(raw []byte) []*PocVul

解析 nuclei 和 xray 的输出结果 （JSON）

type SubFinderInstance

type SubFinderInstance struct {
	// contains filtered or unexported fields
}

func NewSubFinderInstance

func NewSubFinderInstance() (*SubFinderInstance, error)

func (*SubFinderInstance) Exec

func (s *SubFinderInstance) Exec(domain string, nsServers ...string) ([]*subdomain.SubdomainResult, error)

func (*SubFinderInstance) SetTimeout

func (s *SubFinderInstance) SetTimeout(ts string)

func (*SubFinderInstance) SetTimeoutRaw

func (s *SubFinderInstance) SetTimeoutRaw(t time.Duration)