Documentation
¶
Overview ¶
Package runtools embeds ProjectDiscovery scanners (tlsx, dnsx, httpx, naabu, nuclei) as Go SDK calls. Each function writes JSONL output matching the corresponding CLI's format.
Index ¶
- Variables
- func AnyPublic(definitions []string) bool
- func ChromeHostResolverRules() string
- func DeniedProbePortStrings() []string
- func DeniedProbePorts() []int
- func EnsureLatestTemplates(ctx context.Context) (from, to string, err error)
- func FilterDeniedProbePorts(targets []string) (kept, dropped []string)
- func HaveUsableTemplates() bool
- func InitNucleiProcess()
- func InstalledTemplateVersion() string
- func IsDeniedProbePort(port int) bool
- func LastKnownTemplateTag() (string, time.Time)
- func LatestTemplateTag(ctx context.Context) (string, error)
- func RaiseFileLimit()
- func RequestTemplateRepair(reason string)
- func RunDnsx(ctx context.Context, hosts []string, opts DnsxOptions) (string, error)
- func RunHttpx(ctx context.Context, targets []string, opts HttpxOptions) (string, []string, error)
- func RunNaabu(ctx context.Context, hosts []string, opts NaabuOptions) (string, error)
- func RunNuclei(ctx context.Context, opts NucleiOptions) (string, error)
- func RunTlsx(ctx context.Context, targets []string, opts TlsxOptions) (string, error)
- func SilenceSDKLoggers()
- func StripDeniedProbePorts(targets []string) []string
- func SystemChromePath() (string, bool)
- func TemplateDir() string
- func VerifyTemplatesFor(required []string) []string
- type DnsxOptions
- type HttpxOptions
- type NaabuOptions
- type NucleiOptions
- type TlsxOptions
Constants ¶
This section is empty.
Variables ¶
var ErrFreshnessUnknown = errors.New("nuclei-templates freshness could not be verified")
ErrFreshnessUnknown reports that the newest release could not be resolved. Templates already on disk are untouched and remain usable, so callers that only wanted an upgrade should log and continue rather than abort.
var ErrGitHubRateLimited = errors.New("github api rate limit exhausted")
ErrGitHubRateLimited is ErrFreshnessUnknown's actionable case: the request was rejected for quota, which GITHUB_TOKEN raises from 60/hr per IP to 5000/hr per token.
Functions ¶
func AnyPublic ¶ added in v0.2.1
AnyPublic reports whether any definition belongs to the shared template directory. Private templates are absolute paths in a per-chunk temp dir, and reinstalling the public set cannot conjure one of those.
func ChromeHostResolverRules ¶ added in v0.2.1
func ChromeHostResolverRules() string
ChromeHostResolverRules returns a --host-resolver-rules value that makes Chrome fail resolution for any host on a denied port, so headless screenshots cannot reach one through a redirect or a subresource. Applies to IP literals as well as hostnames.
func DeniedProbePortStrings ¶ added in v0.2.1
func DeniedProbePortStrings() []string
DeniedProbePortStrings returns the deny set as strings (httpx Exclude).
func DeniedProbePorts ¶ added in v0.2.1
func DeniedProbePorts() []int
DeniedProbePorts returns the deny set as ints (fastdialer DenyPortList).
func EnsureLatestTemplates ¶ added in v0.2.1
EnsureLatestTemplates brings the template set to the newest published release, returning the versions before and after. A missing directory, a queued repair and a lagging release all resolve to the same staged install.
func FilterDeniedProbePorts ¶ added in v0.2.1
FilterDeniedProbePorts drops "host:port" targets whose port is denied. Bare hosts and unparseable targets pass through unchanged.
func HaveUsableTemplates ¶ added in v0.2.1
func HaveUsableTemplates() bool
HaveUsableTemplates reports whether the live directory holds enough templates to be worth scanning with. Boot continues on a set that could not be confirmed as newest, so this is what stands between a partial set and a fleet-wide silent false negative.
func InitNucleiProcess ¶
func InitNucleiProcess()
InitNucleiProcess flips nuclei's package-level globals once. These are process-wide, so per-scan toggling risks a write race with concurrent scans. It also caps http.DefaultClient, which reaches every caller in this process that does not pass its own client, not just nuclei.
Call it from the boot path, before any goroutine issues an HTTP request. Repeat calls are safe but only the first writes, and sync.Once orders callers against each other only: a first call from a scan goroutine would race every concurrent reader of http.DefaultClient.
func InstalledTemplateVersion ¶ added in v0.2.1
func InstalledTemplateVersion() string
InstalledTemplateVersion returns the release nuclei recorded on disk. It is advisory only: the version can be current while files are missing.
func IsDeniedProbePort ¶ added in v0.2.1
IsDeniedProbePort reports whether port must not receive probe bytes.
func LastKnownTemplateTag ¶ added in v0.2.1
LastKnownTemplateTag returns the most recent successfully resolved release and when it was resolved, so a caller can still compare versions while the release API is unreachable. Empty when no lookup has ever succeeded.
func LatestTemplateTag ¶ added in v0.2.1
LatestTemplateTag returns the newest published nuclei-templates release, cached for latestTagTTL to stay inside the unauthenticated API quota. Deliberately not nuclei's cached "nuclei-templates-latest-version": the SDK refreshes that only after the code that could act on it has already run.
func RaiseFileLimit ¶
func RaiseFileLimit()
RaiseFileLimit raises RLIMIT_NOFILE soft as high as the kernel accepts. On macOS rl.Max is often RLIM_INFINITY but setrlimit is capped by kern.maxfilesperproc, so probe a ladder of decreasing values.
func RequestTemplateRepair ¶ added in v0.2.1
func RequestTemplateRepair(reason string)
RequestTemplateRepair marks the on-disk set as suspect so the next scan-level refresh reinstalls it before any chunk runs. A repair already attempted at the current release is not retried: reinstalling the same release cannot produce a template that release does not contain.
func RunDnsx ¶
RunDnsx resolves every hostname in hosts and writes one JSON DNSData per line to opts.OutputFile. Per-host errors are logged at DEBUG and skipped.
func RunHttpx ¶
RunHttpx probes every target and writes one JSON Result per line to opts.OutputFile. Returns the output path and the URLs of successful probes.
func RunNaabu ¶
RunNaabu scans every target and writes one "host:port" line per open port to opts.OutputFile.
func RunNuclei ¶
func RunNuclei(ctx context.Context, opts NucleiOptions) (string, error)
RunNuclei runs nuclei via the embedded SDK and writes one JSON ResultEvent per finding to opts.OutputFile.
func RunTlsx ¶
RunTlsx scans every target and writes one JSON Response per reachable host to opts.OutputFile. Targets may be bare hosts or "host:port". Per-target errors are logged and skipped, not surfaced.
func SilenceSDKLoggers ¶
func SilenceSDKLoggers()
SilenceSDKLoggers routes gologger output to a discard sink. httpx and naabu SDKs write per-result lines via gologger.Silent() and ignore their own DisableStdout options. Call once at startup before any scanner runs.
func StripDeniedProbePorts ¶ added in v0.2.1
StripDeniedProbePorts trims targets, rewrites "host:<denied>" inputs to the bare host so its other ports are still discovered, and dedupes the result. Meant for scanner inputs (naabu); probe inputs use FilterDeniedProbePorts, since there the port is the whole target.
func SystemChromePath ¶
SystemChromePath returns the resolved system browser path and whether one was found, so callers can log which browser the embedded scanners will use.
func TemplateDir ¶ added in v0.2.1
func TemplateDir() string
TemplateDir returns the directory nuclei loads public templates from. It takes the read lock: a staged install repoints this global while it downloads, so an unlocked reader can see a path that is about to be deleted.
func VerifyTemplatesFor ¶ added in v0.2.1
VerifyTemplatesFor returns the requested public templates missing from disk. It never installs: repairs belong at scan scope, before chunks launch, so a bad set cannot have every chunk re-downloading the shared directory.
Types ¶
type DnsxOptions ¶
type DnsxOptions struct {
// OutputFile receives one JSON DNSData per line. Required.
OutputFile string
Concurrency int
Retries int
Resolvers []string
// QueryAll requests every record type (A/AAAA/CNAME/MX/...) instead of A only.
QueryAll bool
}
DnsxOptions configures an embedded dnsx scan.
type HttpxOptions ¶
type HttpxOptions struct {
// OutputFile receives one JSON Result per line. Required.
OutputFile string
Concurrency int
Timeout time.Duration
Screenshot bool
// ScreenshotTimeout bounds each headless screenshot.
ScreenshotTimeout time.Duration
// DisableStdout suppresses httpx's per-result stdout writes.
DisableStdout bool
StoreResponseDir string
}
HttpxOptions configures an embedded httpx scan.
type NaabuOptions ¶
type NaabuOptions struct {
// OutputFile receives one "host:port" line per open port. Required.
OutputFile string
// Ports is the control-plane port spec: "top-<N>" (e.g. "top-100"), "full",
// or a literal list/range ("80,443", "1-1000"). Empty uses naabu's default.
Ports string
SkipHostDiscovery bool
// ServiceVersion enables nmap-service-probes scanning (no external nmap binary).
ServiceVersion bool
// ServiceDiscovery enables port-number-to-service mapping (cheaper than ServiceVersion).
ServiceDiscovery bool
}
NaabuOptions configures an embedded naabu scan.
type NucleiOptions ¶
type NucleiOptions struct {
// OutputFile receives one JSON ResultEvent per match. Required.
OutputFile string
// Targets is the list of hosts/URLs to scan. Required.
Targets []string
// Templates lists template file or directory paths, globs included; empty
// runs the default set. Template IDs are a separate nuclei option.
Templates []string
// ScanID and TeamID stamp dashboard-upload metadata into output.
ScanID string
TeamID string
AllowLocalFileAccess bool
MatcherStatus bool
EnableCodeTemplates bool
Headless bool
// ProbeNonHttp enables tcp/dns/etc protocol probing in addition to HTTP.
ProbeNonHttp bool
// ConfigYAML is the cloud-shipped nuclei RuntimeConfig (tags, severity,
// rate-limit, ...). Already base64-decoded by the caller.
ConfigYAML []byte
// ReportingConfigYAML is the cloud-shipped tracker config (Jira/Linear/GitHub/etc.).
ReportingConfigYAML []byte
}
NucleiOptions configures an embedded nuclei scan.
type TlsxOptions ¶
type TlsxOptions struct {
// OutputFile receives one JSON Response per line. Required.
OutputFile string
Concurrency int
Timeout time.Duration
Retries int
// ScanMode picks the TLS implementation: "ctls" (default), "ztls", "openssl", "auto".
ScanMode string
}
TlsxOptions configures an embedded tlsx scan.
Source Files