pkg

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 26, 2026 License: GPL-3.0 Imports: 39 Imported by: 1

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	NeutronEnabled bool
	NeutronPocMode PocMode
)
View Source 
var (
	SkipChar = "%SKIP%"
	EXTChar  = "%EXT%"
)
View Source 
var (
	LogVerbose          = logs.Level(18)
	LogFuzz             = logs.Level(19)
	DefaultWhiteStatus  = []int{200}                               // cmd input
	DefaultBlackStatus  = []int{400, 410}                          // cmd input
	DefaultFuzzyStatus  = []int{500, 501, 502, 503, 301, 302, 404} // cmd input
	DefaultUniqueStatus = []int{403, 200, 404}                     // 相同unique的403表示命中了同一条acl, 相同unique的200表示default页面
	WhiteStatus         = []int{}                                  // cmd input, 200
	BlackStatus         = []int{}                                  // cmd input, 400,410
	FuzzyStatus         = []int{}                                  // cmd input, 500,501,502,503
	WAFStatus           = []int{493, 418, 1020, 406, 429, 406, 412}
	UniqueStatus        = []int{} // 相同unique的403表示命中了同一条acl, 相同unique的200表示default页面

	// plugins
	EnableAllFingerEngine = false
)
View Source 
var (
	Rules map[string]string   = make(map[string]string)
	Dicts map[string][]string = make(map[string][]string)

	BadExt         = []string{".js", ".css", ".scss", ".,", ".jpeg", ".jpg", ".png", ".gif", ".svg", ".vue", ".ts", ".swf", ".pdf", ".mp4", ".zip", ".rar"}
	BadURL         = []string{";", "}", "\\n", "webpack://", "{", "www.w3.org", ".src", ".url", ".att", ".href", "location.href", "javascript:", "location:", ".createObject", ":location", ".path"}
	ExtractRegexps = make(parsers.Extractors)
	Extractors     = make(parsers.Extractors)

	FingerEngine *fingers.Engine
	ActivePath   []string

	DefaultUserAgent = randomUserAgent[rand.Intn(uacount)]
)
View Source 
var ErrMap = map[ErrorType]string{
	NoErr:                  "",
	ErrBadStatus:           "blacklist status",
	ErrSameStatus:          "same status with random baseline",
	ErrRequestFailed:       "request failed",
	ErrWaf:                 "maybe banned by waf",
	ErrRedirect:            "duplicate redirect url",
	ErrCompareFailed:       "compare failed",
	ErrCustomCompareFailed: "custom compare failed",
	ErrCustomFilter:        "custom filtered",
	ErrFuzzyCompareFailed:  "fuzzy compare failed",
	ErrFuzzyRedirect:       "fuzzy redirect",
	ErrFuzzyNotUnique:      "not unique",
	ErrUrlError:            "url parse error",
	ErrResponseError:       "response parse error",
}
View Source 
var MbTable = []uint16{}/* 256 elements not displayed */
View Source 
var (
	ProtonScanner *file.Scanner
)

Functions

func AddCustomExtractor added in v1.3.0 

func AddCustomExtractor(name, pattern string)

AddCustomExtractor creates a one-off regex extractor at runtime (for --extract <regex>).

func BakGenerator 

func BakGenerator(domain string) []string

func BaseURL 

func BaseURL(u *url.URL) string

func CRC16Hash 

func CRC16Hash(data []byte) uint16

func CleanURL 

func CleanURL(u string) string

func CompareWithExpr 

func CompareWithExpr(exp *vm.Program, params map[string]interface{}) bool

func Dir 

func Dir(u string) string

func EnableExtractors added in v1.3.0 

func EnableExtractors(names []string)

EnableExtractors activates a subset of templates by name or tag. Called after LoadProtonTemplates to filter what runs during scanning. Empty names = all templates active.

func EngineDetect 

func EngineDetect(content []byte) common.Frameworks

func FilterJs 

func FilterJs(u string) bool

func FilterUrl 

func FilterUrl(u string) bool

func FingersDetect 

func FingersDetect(content []byte) common.Frameworks

gogo fingers engine

func FormatURL 

func FormatURL(base, u string) string

func GetPresetWordList added in v1.1.0 

func GetPresetWordList(key []string) []string

func Load 

func Load() error

func LoadConfig 

func LoadConfig(typ string) []byte

LoadConfig loads config bytes from the external provider first, then from the embedded templates kept for standalone spray compatibility.

func LoadEmbeddedConfig added in v1.3.0 

func LoadEmbeddedConfig(typ string) []byte

LoadEmbeddedConfig loads the standalone embedded config without consulting an installed external provider.

func LoadExtractorConfig 

func LoadExtractorConfig(filename string) ([]*parsers.Extractor, error)

func LoadFileToSlice added in v1.1.0 

func LoadFileToSlice(filename string) ([]string, error)

func LoadFingers 

func LoadFingers() error

func LoadNeutron added in v1.3.0 

func LoadNeutron() error

func LoadNeutronTemplates added in v1.3.0 

func LoadNeutronTemplates() error

func LoadNeutronTemplatesFromDir added in v1.3.0 

func LoadNeutronTemplatesFromDir(dir string) error

func LoadPorts 

func LoadPorts() error

func LoadProtonRules added in v1.3.0 

func LoadProtonRules() error

LoadProtonRules loads embedded proton YAML templates. The data is a YAML array of template objects produced by recuLoadPoc.

func LoadProtonTemplates added in v1.3.0 

func LoadProtonTemplates(yamlDocs [][]byte) error

LoadProtonTemplates parses YAML template docs and builds a Scanner.

func LoadProtonTemplatesFromDir added in v1.3.0 

func LoadProtonTemplatesFromDir(dir string) error

LoadProtonTemplatesFromDir loads all .yaml template files from a directory.

func LoadRuleAndCombine added in v1.1.0 

func LoadRuleAndCombine(filename []string) (string, error)

func LoadRuleWithFiles added in v1.1.0 

func LoadRuleWithFiles(ruleFiles []string, filter string) ([]rule.Expression, error)

func LoadTemplates 

func LoadTemplates() error

func LoadWordlist added in v1.1.0 

func LoadWordlist(word string, dictNames []string) ([]string, error)

func MatchContentType added in v1.2.4 

func MatchContentType(contentType string) (string, bool)

func MatchWithGlobs 

func MatchWithGlobs(u string, globs []string) bool

func ParseEXTPlaceholderFunc added in v1.1.2 

func ParseEXTPlaceholderFunc(exts []string) func(string) []string

func ParseExtension added in v1.1.0 

func ParseExtension(s string) string

func ParseRawResponse 

func ParseRawResponse(raw []byte) (*http.Response, error)

func ParseStatus added in v1.1.0 

func ParseStatus(preset []int, changed string) []int

ParseStatus parses the input string and updates the preset status filters.

func PocResultToExtracteds added in v1.3.0 

func PocResultToExtracteds(results []*PocResult) parsers.Extracteds

PocResultToExtracteds converts POC results to parsers.Extracteds for output.

func PocResultToVulns added in v1.3.0 

func PocResultToVulns(results []*PocResult) common.Vulns

PocResultToVulns converts POC results to common.Vulns for structured output.

func ProtonExtract added in v1.3.0 

func ProtonExtract(content []byte) parsers.Extracteds

ProtonExtract runs proton scanner on in-memory content and returns parsers.Extracted results compatible with spray's output format.

func ProtonExtractorNames added in v1.3.0 

func ProtonExtractorNames() []string

ProtonExtractorNames returns all available template IDs.

func RandHost 

func RandHost() string

func RandPath 

func RandPath() string

func RandomUA 

func RandomUA() string

func RelaPath 

func RelaPath(base, u string) string

func ResetResourceProvider added in v1.3.0 

func ResetResourceProvider()

ResetResourceProvider removes the external template/config provider.

func SafeFilename added in v1.1.0 

func SafeFilename(filename string) string

func SafePath 

func SafePath(dir, u string) string

func SetResourceProvider added in v1.3.0 

func SetResourceProvider(provider ResourceProvider)

SetResourceProvider installs an external template/config provider.

func StatusContain added in v1.2.2 

func StatusContain(preset []int, status int) bool

StatusContain checks if a status matches any of the preset filters. Preset values < 100 are treated as prefix filters (e.g. 5 = 5xx, 51 = 51x).

func UniqueInts added in v1.2.2 

func UniqueInts(input []int) []int

func WrapWordsFunc added in v1.1.0 

func WrapWordsFunc(f func(string) string) func(string) []string

Types

type BS 

type BS []byte

func (BS) String 

func (b BS) String() string

type Bar 

type Bar struct {
	// contains filtered or unexported fields
}

func NewBar 

func NewBar(u string, total int, stat *Statistor, p *mpb.Progress) *Bar

func (*Bar) Close 

func (bar *Bar) Close()

func (*Bar) Done 

func (bar *Bar) Done()

type ErrorType 

type ErrorType uint
const (
	NoErr ErrorType = iota
	ErrBadStatus
	ErrSameStatus
	ErrRequestFailed
	ErrWaf
	ErrRedirect
	ErrCompareFailed
	ErrCustomCompareFailed
	ErrCustomFilter
	ErrFuzzyCompareFailed
	ErrFuzzyRedirect
	ErrFuzzyNotUnique
	ErrUrlError
	ErrResponseError
)

func (ErrorType) Error 

func (e ErrorType) Error() string

type PocMode added in v1.3.0 

type PocMode int
const (
	PocModeCheck PocMode = 1 << iota
	PocModeBrute
	PocModeAll = PocModeCheck | PocModeBrute
)

type PocResult added in v1.3.0 

type PocResult struct {
	TemplateID string
	Name       string
	Severity   string
	Tags       []string
	Matched    bool
	Extracts   []string
	Payload    map[string]interface{}
	Result     *operators.Result
}

func NeutronBrute added in v1.3.0 

func NeutronBrute(baseURL string, frameworks common.Frameworks) []*PocResult

NeutronBrute runs brute/login templates matching the given fingerprints.

func NeutronCheck added in v1.3.0 

func NeutronCheck(baseURL string, frameworks common.Frameworks) []*PocResult

NeutronCheck runs vulnerability check templates matching the given fingerprints.

func NeutronScan added in v1.3.0 

func NeutronScan(baseURL string, frameworks common.Frameworks) []*PocResult

NeutronScan runs both check and brute templates based on configured mode.

type ResourceProvider added in v1.3.0 

type ResourceProvider func(string) []byte

ResourceProvider supplies template/config bytes by logical name.

type Statistor 

type Statistor struct {
	BaseUrl        string                      `json:"url"`
	Error          string                      `json:"error"`
	Counts         map[int]int                 `json:"counts"`
	Sources        map[parsers.SpraySource]int `json:"sources"`
	FailedNumber   int32                       `json:"failed"`
	ReqTotal       int32                       `json:"req_total"`
	CheckNumber    int                         `json:"check"`
	FoundNumber    int                         `json:"found"`
	FilteredNumber int                         `json:"filtered"`
	FuzzyNumber    int                         `json:"fuzzy"`
	WafedNumber    int                         `json:"wafed"`
	End            int                         `json:"end"`
	Skipped        int                         `json:"skipped"`
	Offset         int                         `json:"offset"`
	Total          int                         `json:"total"`
	StartTime      int64                       `json:"start_time"`
	EndTime        int64                       `json:"end_time"`
	WordCount      int                         `json:"word_count"`
	Word           string                      `json:"word"`
	Dictionaries   []string                    `json:"dictionaries"`
	RuleFiles      []string                    `json:"rule_files"`
	RuleFilter     string                      `json:"rule_filter"`
}

func NewStatistor 

func NewStatistor(url string) *Statistor

func NewStatistorFromStat 

func NewStatistorFromStat(origin *Statistor) *Statistor

func (*Statistor) ColorCountString 

func (stat *Statistor) ColorCountString() string

func (*Statistor) ColorSourceString 

func (stat *Statistor) ColorSourceString() string

func (*Statistor) ColorString 

func (stat *Statistor) ColorString() string

func (*Statistor) CountString 

func (stat *Statistor) CountString() string

func (*Statistor) Json 

func (stat *Statistor) Json() string

func (*Statistor) SourceString 

func (stat *Statistor) SourceString() string

func (*Statistor) String 

func (stat *Statistor) String() string

type Statistors 

type Statistors []*Statistor

func ReadStatistors 

func ReadStatistors(filename string) (Statistors, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.