tools

Documentation

Index

• Variables
• func BinaryLocations(binaryName ...string) []string
• func FetchCurrentNucleiTemplates(defaultDirs ...string) ([]*templateDesc, error)
• func HandleNucleiResultFromFile(ctx context.Context, fileName string) (chan *PocVul, error)
• func HandleNucleiResultFromReader(i io.Reader) chan *PocVul
• func HandleXrayResultChan(r io.Reader) chan *PocVul
• func LoadYamlPoCDatabase(nucleiDir ...string) error
• func PocVulToRisk(p *PocVul) *yakit.Risk
• func PullTemplatesFromGithub(giturl string, proxy ...string) (string, error)
• func RemovePoCDatabase() error
• func ResourceLocations(resResources ...string) []string
• type PocInvoker
  • func NewPocInvoker() (*PocInvoker, error)
  • func (p *PocInvoker) Exec(urls ...string) ([]*PocVul, error)
• type PocVul
  • func HandleNucleiResult(raw []byte) []*PocVul
  • func HandleXrayResult(raw []byte) []*PocVul
• type SubFinderInstance
  • func NewSubFinderInstance() (*SubFinderInstance, error)
  • func (s *SubFinderInstance) Exec(domain string, nsServers ...string) ([]*subdomain.SubdomainResult, error)
  • func (s *SubFinderInstance) SetTimeout(ts string)
  • func (s *SubFinderInstance) SetTimeoutRaw(t time.Duration)

Variables

var BruterExports = map[string]interface{}{
	"GetAvailableBruteTypes": func() []string {
		return bruteutils.GetBuildinAvailableBruteType()
	},
	"GetUsernameListFromBruteType": bruteutils.GetUsernameListFromBruteType,
	"GetPasswordListFromBruteType": bruteutils.GetPasswordListFromBruteType,

	"New":                _yakitBruterNew,
	"concurrentTarget":   yakBruteOpt_ConcurrentTarget,
	"debug":              yakBruteOpt_Debug,
	"userList":           yakBruteOpt_userlist,
	"passList":           yakBruteOpt_passlist,
	"autoDict":           yakBruteOpt_autoDict,
	"concurrent":         yakBruteOpt_concurrent,
	"minDelay":           yakBruteOpt_minDelay,
	"maxDelay":           yakBruteOpt_maxDelay,
	"bruteHandler":       yakBruteOpt_coreHandler,
	"okToStop":           yakBruteOpt_OkToStop,
	"finishingThreshold": yakBruteOpt_FinishingThreshold,
}

var BuildinNucleiYakScriptParam = []*ypb.YakScriptParam{
	{
		Field:        "target",
		DefaultValue: "",
		TypeVerbose:  "string",
		Required:     true,
		FieldVerbose: "扫描目标",
		Help:         "扫描目标可接受：主机名 / 主机名:端口 / IP段 / URL 等多种格式",
	},
	{
		Field:        "reverse-url",
		DefaultValue: "",
		TypeVerbose:  "string",
		FieldVerbose: "反连 URL",
		Help:         "可使用 InteractshURL 也可使用 Yakit Reverse URL",
	},
	{
		Field:        "debug",
		DefaultValue: "",
		TypeVerbose:  "boolean",
		FieldVerbose: "设置调试模式",
		Help:         "开启调试模式，调试模式将输出尽量多的调试信息",
	},
	{
		Field:        "proxy",
		DefaultValue: "",
		TypeVerbose:  "proxy",
		FieldVerbose: "HTTP 代理",
		Help:         "设置 HTTP 代理",
	},
}

var Exports = map[string]interface{}{

	"NewPocInvoker": func() (*PocInvoker, error) {
		return NewPocInvoker()
	},
	"NewBruteUtil": func(t string) (*bruteutils.BruteUtil, error) {
		res, err := bruteutils.GetBruteFuncByType(t)
		if err != nil {
			return nil, err
		}
		ut, err := bruteutils.NewMultiTargetBruteUtil(256, 1, 5, res)
		if err != nil {
			return nil, utils.Errorf("create brute utils failed: %s", err)
		}
		return ut, nil
	},
}

var FinPortScanExports = map[string]interface{}{
	"Scan": func(target string, port string, opts ...finScanOpt) (chan *finscan.FinScanResult, error) {
		config := &_yakFinPortScanConfig{
			waiting:           10 * time.Second,
			rateLimitDelayMs:  1,
			rateLimitDelayGap: 5,
		}
		for _, opt := range opts {
			opt(config)
		}
		return _finscanDo(hostsToChan(target), port, config)
	},

	"excludePorts":   _finScanOptExcludePorts,
	"excludeHosts":   _finScanOptExcludeHosts,
	"wait":           _finScanOptWaiting,
	"outputFile":     _finScanOptOpenPortResult,
	"outputPrefix":   _finScanOptOpenPortResultPrefix,
	"initHostFilter": _finScanOptOpenPortInitHostFilter,
	"initPortFilter": _finScanOptOpenPortInitPortFilter,
	"rateLimit":      _finScanOptRateLimit,
	"concurrent":     _finScanOptConcurrent,
}

FinPortScanExports 为了防止网卡过载，5个是上限

1. waiting 实现
2. timeout

var FingerprintScanExports = map[string]interface{}{
	"Scan":                scanFingerprint,
	"ScanOne":             scanOneFingerprint,
	"ScanFromSynResult":   _scanFromTargetStream,
	"ScanFromSpaceEngine": _scanFromTargetStream,
	"ScanFromPing":        _scanFromPingUtils,

	"proto": func(proto ...interface{}) fp.ConfigOption {
		return fp.WithTransportProtos(fp.ParseStringToProto(proto...)...)
	},

	"concurrent": fp.WithPoolSize,

	"excludePorts": fp.WithExcludePorts,
	"excludeHosts": fp.WithExcludeHosts,

	"probeTimeout": fp.WithProbeTimeoutHumanRead,

	"proxy": fp.WithProxy,

	"cache":         fp.WithCache,
	"databaseCache": fp.WithDatabaseCache,

	"webRule": fp.WithWebFingerprintRule,

	"nmapRule": fp.WithNmapRule,

	"nmapRarityMax": fp.WithRarityMax,

	"active": fp.WithActiveMode,

	"maxProbes": fp.WithProbesMax,

	"maxProbesConcurrent": fp.WithProbesConcurrentMax,

	"web": func() fp.ConfigOption {
		return func(config *fp.Config) {
			config.OnlyEnableWebFingerprint = true
		}
	},

	"service": func() fp.ConfigOption {
		return func(config *fp.Config) {
			config.DisableWebFingerprint = true
		}
	},

	"all": func() fp.ConfigOption {
		return func(config *fp.Config) {
			config.ForceEnableWebFingerprint = true
		}
	},
}

var NucleiOperationsExports = map[string]interface{}{
	"PullDatabase":   PullTemplatesFromGithub,
	"UpdateDatabase": LoadYamlPoCDatabase,
	"RemoveDatabase": RemovePoCDatabase,
	"AllPoC":         FetchCurrentNucleiTemplates,
	"PocVulToRisk":   PocVulToRisk,
	"GetPoCDir":      consts.GetNucleiTemplatesDir,
}

var SubDomainExports = map[string]interface{}{
	"Scan": _subdomainScan,

	"wildcardToStop":   subdomain.WithWildCardToStop,
	"recursive":        subdomain.WithAllowToRecursive,
	"workerConcurrent": subdomain.WithWorkerCount,
	"dnsServer":        subdomain.WithDNSServers,
	"maxDepth":         subdomain.WithMaxDepth,
	"targetConcurrent": subdomain.WithParallelismTasksCount,
	"targetTimeout": func(i float64) subdomain.ConfigOption {
		return subdomain.WithTimeoutForEachTarget(utils.FloatSecondDuration(i))
	},
	"eachQueryTimeout": func(i float64) subdomain.ConfigOption {
		return subdomain.WithTimeoutForEachQuery(utils.FloatSecondDuration(i))
	},
	"eachSearchTimeout": func(i float64) subdomain.ConfigOption {
		return subdomain.WithTimeoutForEachHTTPSearch(utils.FloatSecondDuration(i))
	},

	"mainDict": func(i interface{}) subdomain.ConfigOption {
		return subdomain.WithMainDictionary(utils.StringAsFileParams(i))
	},

	"recursiveDict": func(i interface{}) subdomain.ConfigOption {
		return subdomain.WithSubDictionary(utils.StringAsFileParams(i))
	},
}

var SynPortScanExports = map[string]interface{}{
	"FixPermission": pcapfix.Fix,
	"Scan": func(target string, port string, opts ...scanOpt) (chan *synscan.SynScanResult, error) {
		config := &_yakPortScanConfig{
			waiting:           5 * time.Second,
			rateLimitDelayMs:  1,
			rateLimitDelayGap: 5,
		}
		for _, opt := range opts {
			opt(config)
		}
		return _synScanDo(hostsToChan(target), port, config)
	},
	"ScanFromPing": _synscanFromPingUtils,

	"callback":           _scanOptCallback,
	"submitTaskCallback": _scanOptSubmitTaskCallback,
	"excludePorts":       _scanOptExcludePorts,
	"excludeHosts":       _scanOptExcludeHosts,
	"wait":               _scanOptWaiting,
	"outputFile":         _scanOptOpenPortResult,
	"outputPrefix":       _scanOptOpenPortResultPrefix,
	"initHostFilter":     _scanOptOpenPortInitHostFilter,
	"initPortFilter":     _scanOptOpenPortInitPortFilter,
	"rateLimit":          _scanOptRateLimit,
	"concurrent":         _scanOptSYNConcurrent,
}

为了防止网卡过载，5个是上限

1. waiting 实现
2. timeout

Functions

func BinaryLocations

func BinaryLocations(binaryName ...string) []string

func FetchCurrentNucleiTemplates

func FetchCurrentNucleiTemplates(defaultDirs ...string) ([]*templateDesc, error)

func HandleNucleiResultFromFile

func HandleNucleiResultFromFile(ctx context.Context, fileName string) (chan *PocVul, error)

func HandleNucleiResultFromReader

func HandleNucleiResultFromReader(i io.Reader) chan *PocVul

func HandleXrayResultChan

func HandleXrayResultChan(r io.Reader) chan *PocVul

func LoadYamlPoCDatabase

func LoadYamlPoCDatabase(nucleiDir ...string) error

func PocVulToRisk

func PocVulToRisk(p *PocVul) *yakit.Risk

func PullTemplatesFromGithub

func PullTemplatesFromGithub(giturl string, proxy ...string) (string, error)

func RemovePoCDatabase

func RemovePoCDatabase() error

func ResourceLocations

func ResourceLocations(resResources ...string) []string

Types

type PocInvoker

type PocInvoker struct {
	// contains filtered or unexported fields
}

func NewPocInvoker

func NewPocInvoker() (*PocInvoker, error)

func (*PocInvoker) Exec

func (p *PocInvoker) Exec(urls ...string) ([]*PocVul, error)

type PocVul

type PocVul struct {
	Source        string
	PocName       string
	CVE           string
	Description   string
	DescriptionZh string
	MatchedAt     string
	Target        string
	IP            string
	Port          int
	Timestamp     int64
	Payload       string
	Severity      string
	RawJson       string
	Tags          string
	TitleName     string
	Details       map[string]interface{}
}

func HandleNucleiResult

func HandleNucleiResult(raw []byte) []*PocVul

func HandleXrayResult

func HandleXrayResult(raw []byte) []*PocVul

解析 nuclei 和 xray 的输出结果 （JSON）

type SubFinderInstance

type SubFinderInstance struct {
	// contains filtered or unexported fields
}

func NewSubFinderInstance

func NewSubFinderInstance() (*SubFinderInstance, error)

func (*SubFinderInstance) Exec

func (s *SubFinderInstance) Exec(domain string, nsServers ...string) ([]*subdomain.SubdomainResult, error)

func (*SubFinderInstance) SetTimeout

func (s *SubFinderInstance) SetTimeout(ts string)

func (*SubFinderInstance) SetTimeoutRaw

func (s *SubFinderInstance) SetTimeoutRaw(t time.Duration)