Documentation
¶
Index ¶
- Constants
- Variables
- func AESCBCEncrypt(shirokey string) string
- func AESGCMEncrypt(shirokey string) string
- func CheckInfoPoc(infostr string) string
- func CheckMultiPoc(req *http.Request, pocs []*Poc, workers int, pocCtx *POCContext)
- func Combo(input ListMap) [][]string
- func Evaluate(env *cel.Env, expression string, params map[string]interface{}) (ref.Val, error)
- func EvaluateCached(env *cel.Env, expression string, params map[string]interface{}, ...) (ref.Val, error)
- func ExtendEnvWithVars(varDecls []*exprpb.Decl) (*cel.Env, error)
- func GetBaseEnv() *cel.Env
- func GetBaseProgramOptions() []cel.ProgramOption
- func GetHeader(header map[string]string) string
- func GetShrioCookie(key, mode string) string
- func InitHTTPClient(ThreadsNum int, DownProxy string, Timeout time.Duration, maxRedirects int, ...) error
- func InitPOCConfig(dnsLog bool)
- func Inithttp(cfg *common.Config) error
- func MakeData(base [][]string, nextData []string) [][]string
- func MakeVarDecl(key, value string) *exprpb.Decl
- func NewEnv(c *CustomLib) (*cel.Env, error)
- func Padding(plainText []byte, blockSize int) []byte
- func RandomStr(randSource *rand.Rand, letterBytes string, n int) string
- func SelectPoc(Pocs embed.FS, pocname string) []string
- func URLTypeToString(u *UrlType) string
- type AfrogPoc
- type AfrogPocAdapter
- type CelProgCache
- type CustomLib
- type Detail
- type FscanPocAdapter
- type ListItem
- type ListMap
- type MapSlice
- type NucleiMatcher
- type NucleiPoc
- type NucleiPocAdapter
- type POCContext
- type Poc
- type PocFormat
- type Request
- func (*Request) Descriptor() ([]byte, []int)deprecated
- func (x *Request) GetBody() []byte
- func (x *Request) GetContentType() string
- func (x *Request) GetHeaders() map[string]string
- func (x *Request) GetMethod() string
- func (x *Request) GetUrl() *UrlType
- func (*Request) ProtoMessage()
- func (x *Request) ProtoReflect() protoreflect.Message
- func (x *Request) Reset()
- func (x *Request) String() string
- type Response
- func (*Response) Descriptor() ([]byte, []int)deprecated
- func (x *Response) GetBody() []byte
- func (x *Response) GetContentType() string
- func (x *Response) GetDuration() float64
- func (x *Response) GetHeaders() map[string]string
- func (x *Response) GetStatus() int32
- func (x *Response) GetUrl() *UrlType
- func (*Response) ProtoMessage()
- func (x *Response) ProtoReflect() protoreflect.Message
- func (x *Response) Reset()
- func (x *Response) String() string
- type Reverse
- func (*Reverse) Descriptor() ([]byte, []int)deprecated
- func (x *Reverse) GetDomain() string
- func (x *Reverse) GetIp() string
- func (x *Reverse) GetIsDomainNameServer() bool
- func (x *Reverse) GetUrl() string
- func (*Reverse) ProtoMessage()
- func (x *Reverse) ProtoReflect() protoreflect.Message
- func (x *Reverse) Reset()
- func (x *Reverse) String() string
- type RuleItem
- type RuleMap
- type Rules
- type StrItem
- type StrMap
- type Task
- type UniversalPoc
- type UrlType
- func (*UrlType) Descriptor() ([]byte, []int)deprecated
- func (x *UrlType) GetDomain() string
- func (x *UrlType) GetFragment() string
- func (x *UrlType) GetHost() string
- func (x *UrlType) GetPath() string
- func (x *UrlType) GetPort() string
- func (x *UrlType) GetQuery() string
- func (x *UrlType) GetScheme() string
- func (*UrlType) ProtoMessage()
- func (x *UrlType) ProtoReflect() protoreflect.Message
- func (x *UrlType) Reset()
- func (x *UrlType) String() string
- type VulnResult
- type XrayPoc
- type XrayPocAdapter
- type XrayRule
Constants ¶
const ( // ProxyShortcutBurp Burp Suite默认代理快捷配置 ProxyShortcutBurp = "1" // ProxyShortcutSocks5 SOCKS5默认代理快捷配置 ProxyShortcutSocks5 = "2" // ProxyBurpURL Burp Suite代理地址 ProxyBurpURL = "http://127.0.0.1:8080" // ProxySocks5URL SOCKS5代理地址 ProxySocks5URL = "socks5://127.0.0.1:1080" )
Variables ¶
var ( Client *http.Client // 标准HTTP客户端 ClientNoRedirect *http.Client // 不自动跟随重定向的HTTP客户端 ClientGM *http.Client // 国密TLS HTTP客户端 ClientNoRedirectGM *http.Client // 国密TLS 不跟随重定向 )
全局HTTP客户端变量
var ( // CheckContent 是经过base64编码的Shiro序列化对象 CheckContent = "" /* 152-byte string literal not displayed */ // Content 是解码后的原始内容 Content, _ = base64.StdEncoding.DecodeString(CheckContent) )
var File_http_proto protoreflect.FileDescriptor
Functions ¶
func AESGCMEncrypt ¶
AESGCMEncrypt 使用AES-GCM模式加密(Shiro 1.4.2+)
func CheckMultiPoc ¶
func CheckMultiPoc(req *http.Request, pocs []*Poc, workers int, pocCtx *POCContext)
CheckMultiPoc 并发执行多个POC检测 参数说明: - req: HTTP请求对象 - pocs: POC检测脚本列表 - workers: 并发工作协程数量 - pocCtx: POC执行上下文配置
func EvaluateCached ¶
func EvaluateCached(env *cel.Env, expression string, params map[string]interface{}, cache CelProgCache) (ref.Val, error)
EvaluateCached 评估 CEL 表达式(带编译缓存,用于规则执行热路径)
func ExtendEnvWithVars ¶
ExtendEnvWithVars 扩展基础环境,添加POC特定的变量声明
func GetBaseProgramOptions ¶
func GetBaseProgramOptions() []cel.ProgramOption
GetBaseProgramOptions 获取基础程序选项
func GetShrioCookie ¶
GetShrioCookie 获取加密后的Shiro Cookie值
func InitHTTPClient ¶
func InitHTTPClient(ThreadsNum int, DownProxy string, Timeout time.Duration, maxRedirects int, networkConfig *common.NetworkConfig) error
InitHTTPClient 创建HTTP客户端
func InitPOCConfig ¶
func InitPOCConfig(dnsLog bool)
InitPOCConfig 初始化POC配置(在扫描开始前调用) 这样CEL回调函数可以使用包级变量而非GetGlobalConfig
func URLTypeToString ¶
URLTypeToString 将 TargetURL 结构体转换为字符串
Types ¶
type AfrogPoc ¶
type AfrogPoc struct {
ID string `yaml:"id"`
Info struct {
Name string `yaml:"name"`
Author yamlStringList `yaml:"author"`
Severity string `yaml:"severity"`
Verified bool `yaml:"verified"`
Description string `yaml:"description"`
Reference yamlStringList `yaml:"reference"`
Tags string `yaml:"tags"`
Created string `yaml:"created"`
} `yaml:"info"`
Set map[string]interface{} `yaml:"set"`
Rules map[string]XrayRule `yaml:"rules"` // 复用 xray 的 rule 结构
Expression string `yaml:"expression"`
}
AfrogPoc afrog POC结构(混合 Nuclei + xray 风格)
type AfrogPocAdapter ¶
type AfrogPocAdapter struct {
*AfrogPoc
}
AfrogPocAdapter afrog格式适配器
func (*AfrogPocAdapter) GetFormat ¶
func (a *AfrogPocAdapter) GetFormat() PocFormat
GetFormat 获取POC格式类型
func (*AfrogPocAdapter) GetName ¶
func (a *AfrogPocAdapter) GetName() string
GetName 获取POC名称(优先使用Info.Name,否则使用ID)
func (*AfrogPocAdapter) ToFscanPoc ¶
func (a *AfrogPocAdapter) ToFscanPoc() (*Poc, error)
ToFscanPoc 将afrog格式转换为fscan格式
type CelProgCache ¶
CelProgCache 缓存编译后的 CEL Program,避免同一 POC 内重复编译 在 executePoc 中创建,同一个 POC 的所有规则/参数组合共享
type CustomLib ¶
type CustomLib struct {
// contains filtered or unexported fields
}
CustomLib 自定义CEL库配置
func (*CustomLib) CompileOptions ¶
CompileOptions 返回环境编译选项
func (*CustomLib) ProgramOptions ¶
func (c *CustomLib) ProgramOptions() []cel.ProgramOption
ProgramOptions 返回程序运行选项 返回空切片,函数实现通过 GetBaseProgramOptions() 在 Evaluate() 时注入 这避免了多次创建环境时重复注册函数导致的冲突
func (*CustomLib) UpdateCompileOptions ¶
UpdateCompileOptions 更新编译选项,处理不同类型的变量声明
type Detail ¶
type Detail struct {
Author string `yaml:"author"` // POC作者
Links []string `yaml:"links"` // 相关链接
Description string `yaml:"description"` // POC描述
Version string `yaml:"version"` // POC版本
}
Detail 定义POC详情结构
type FscanPocAdapter ¶
type FscanPocAdapter struct {
*Poc
}
FscanPocAdapter fscan原生格式适配器
func (*FscanPocAdapter) GetFormat ¶
func (f *FscanPocAdapter) GetFormat() PocFormat
GetFormat 获取POC格式类型
func (*FscanPocAdapter) ToFscanPoc ¶
func (f *FscanPocAdapter) ToFscanPoc() (*Poc, error)
ToFscanPoc 转换为Fscan POC格式
type ListMap ¶
type ListMap []ListItem
ListMap 字符串键列表值映射
func (*ListMap) UnmarshalYAML ¶
UnmarshalYAML 实现ListMap的YAML解析接口 参数:
- unmarshal: YAML解析函数
返回:
- error: 解析错误
type NucleiMatcher ¶
type NucleiPoc ¶
type NucleiPoc struct {
ID string `yaml:"id"`
Info struct {
Name string `yaml:"name"`
Author yamlStringList `yaml:"author"`
Severity string `yaml:"severity"`
Description string `yaml:"description"`
Reference yamlStringList `yaml:"reference"`
} `yaml:"info"`
HTTP []struct {
Method string `yaml:"method"`
Path []string `yaml:"path"`
Headers map[string]string `yaml:"headers"`
Body string `yaml:"body"`
Matchers []NucleiMatcher `yaml:"matchers"`
MatchersCondition string `yaml:"matchers-condition"`
} `yaml:"http"`
}
NucleiPoc Nuclei模板结构(简化版,仅支持HTTP协议)
type NucleiPocAdapter ¶
type NucleiPocAdapter struct {
*NucleiPoc
}
NucleiPocAdapter Nuclei格式适配器
func (*NucleiPocAdapter) GetFormat ¶
func (n *NucleiPocAdapter) GetFormat() PocFormat
GetFormat 获取POC格式类型
func (*NucleiPocAdapter) GetName ¶
func (n *NucleiPocAdapter) GetName() string
GetName 获取POC名称(优先使用Info.Name,否则使用ID)
func (*NucleiPocAdapter) ToFscanPoc ¶
func (n *NucleiPocAdapter) ToFscanPoc() (*Poc, error)
ToFscanPoc 将Nuclei格式转换为fscan格式
type POCContext ¶
type POCContext struct {
DNSLog bool // 是否启用DNSLog检测
POCFull bool // 是否完整POC扫描
Session *common.ScanSession
}
POCContext POC执行上下文配置 显式传递配置
type Poc ¶
type Poc struct {
Name string `yaml:"name"` // POC名称
Set StrMap `yaml:"set"` // 单值配置映射
Sets ListMap `yaml:"sets"` // 列表值配置映射
Rules []Rules `yaml:"rules"` // 检测规则列表
Groups RuleMap `yaml:"groups"` // 规则组映射
Detail Detail `yaml:"detail"` // 漏洞详情
}
Poc 定义漏洞检测配置结构
type PocFormat ¶
type PocFormat string
PocFormat POC格式类型
func DetectPocFormat ¶
DetectPocFormat 检测POC格式 根据YAML字段特征识别格式
type Request ¶
type Request struct {
URL *UrlType `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
Method string `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"`
Headers map[string]string `` /* 155-byte string literal not displayed */
ContentType string `protobuf:"bytes,4,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
Body []byte `protobuf:"bytes,5,opt,name=body,proto3" json:"body,omitempty"`
// contains filtered or unexported fields
}
func ParseRequest ¶
ParseRequest 将标准 HTTP 请求转换为自定义请求对象
func (*Request) Descriptor
deprecated
func (*Request) GetContentType ¶
func (*Request) GetHeaders ¶
func (*Request) ProtoMessage ¶
func (*Request) ProtoMessage()
func (*Request) ProtoReflect ¶
func (x *Request) ProtoReflect() protoreflect.Message
type Response ¶
type Response struct {
URL *UrlType `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
Status int32 `protobuf:"varint,2,opt,name=status,proto3" json:"status,omitempty"`
Headers map[string]string `` /* 155-byte string literal not displayed */
ContentType string `protobuf:"bytes,4,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
Body []byte `protobuf:"bytes,5,opt,name=body,proto3" json:"body,omitempty"`
Duration float64 `protobuf:"fixed64,6,opt,name=duration,proto3" json:"duration,omitempty"`
// contains filtered or unexported fields
}
func ParseResponse ¶
ParseResponse 将标准 HTTP 响应转换为自定义响应对象
func (*Response) Descriptor
deprecated
func (*Response) GetContentType ¶
func (*Response) GetDuration ¶
func (*Response) GetHeaders ¶
func (*Response) ProtoMessage ¶
func (*Response) ProtoMessage()
func (*Response) ProtoReflect ¶
func (x *Response) ProtoReflect() protoreflect.Message
type Reverse ¶
type Reverse struct {
URL string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
Domain string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
Ip string `protobuf:"bytes,3,opt,name=ip,proto3" json:"ip,omitempty"`
IsDomainNameServer bool `protobuf:"varint,4,opt,name=is_domain_name_server,json=isDomainNameServer,proto3" json:"is_domain_name_server,omitempty"`
// contains filtered or unexported fields
}
func (*Reverse) Descriptor
deprecated
func (*Reverse) GetIsDomainNameServer ¶
func (*Reverse) ProtoMessage ¶
func (*Reverse) ProtoMessage()
func (*Reverse) ProtoReflect ¶
func (x *Reverse) ProtoReflect() protoreflect.Message
type RuleMap ¶
type RuleMap []RuleItem
RuleMap 字符串键规则列表映射
func (*RuleMap) UnmarshalYAML ¶
UnmarshalYAML 实现RuleMap的YAML解析接口 参数:
- unmarshal: YAML解析函数
返回:
- error: 解析错误
type Rules ¶
type Rules struct {
Method string `yaml:"method"` // HTTP请求方法
Path string `yaml:"path"` // 请求路径
Headers map[string]string `yaml:"headers"` // 请求头
Body string `yaml:"body"` // 请求体
Search string `yaml:"search"` // 搜索模式
FollowRedirects bool `yaml:"follow_redirects"` // 是否跟随重定向
Expression string `yaml:"expression"` // 匹配表达式
Continue bool `yaml:"continue"` // 是否继续执行
}
Rules 定义POC检测规则结构
type StrMap ¶
type StrMap []StrItem
StrMap 字符串键值对映射(自定义映射类型)
func (*StrMap) UnmarshalYAML ¶
UnmarshalYAML 实现StrMap的YAML解析接口
type UniversalPoc ¶
type UniversalPoc interface {
GetName() string // 获取POC名称
GetFormat() PocFormat // 获取格式类型
ToFscanPoc() (*Poc, error) // 转换为fscan内部格式
}
UniversalPoc 通用POC接口 - 所有格式都要实现这个接口
func LoadUniversalPoc ¶
func LoadUniversalPoc(filename string, data []byte) (UniversalPoc, error)
LoadUniversalPoc 加载通用POC(自动识别格式)
type UrlType ¶
type UrlType struct {
Scheme string `protobuf:"bytes,1,opt,name=scheme,proto3" json:"scheme,omitempty"`
Domain string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
Host string `protobuf:"bytes,3,opt,name=host,proto3" json:"host,omitempty"`
Port string `protobuf:"bytes,4,opt,name=port,proto3" json:"port,omitempty"`
Path string `protobuf:"bytes,5,opt,name=path,proto3" json:"path,omitempty"`
Query string `protobuf:"bytes,6,opt,name=query,proto3" json:"query,omitempty"`
Fragment string `protobuf:"bytes,7,opt,name=fragment,proto3" json:"fragment,omitempty"`
// contains filtered or unexported fields
}
func (*UrlType) Descriptor
deprecated
func (*UrlType) GetFragment ¶
func (*UrlType) ProtoMessage ¶
func (*UrlType) ProtoMessage()
func (*UrlType) ProtoReflect ¶
func (x *UrlType) ProtoReflect() protoreflect.Message
type VulnResult ¶
type VulnResult struct {
Poc *Poc // POC脚本
VulName string // 漏洞名称
Target string // 目标URL
Details map[string]interface{} // 详细信息
}
VulnResult 漏洞结果结构体
type XrayPoc ¶
type XrayPoc struct {
Name string `yaml:"name"`
Transport string `yaml:"transport"`
Set map[string]interface{} `yaml:"set"`
Rules map[string]XrayRule `yaml:"rules"`
Expression string `yaml:"expression"`
Detail Detail `yaml:"detail"`
}
XrayPoc xray POC结构
type XrayPocAdapter ¶
type XrayPocAdapter struct {
*XrayPoc
}
XrayPocAdapter xray格式适配器
func (*XrayPocAdapter) GetFormat ¶
func (x *XrayPocAdapter) GetFormat() PocFormat
GetFormat 获取POC格式类型
func (*XrayPocAdapter) ToFscanPoc ¶
func (x *XrayPocAdapter) ToFscanPoc() (*Poc, error)
ToFscanPoc 将xray格式转换为fscan格式
type XrayRule ¶
type XrayRule struct {
Request struct {
Cache bool `yaml:"cache"`
Method string `yaml:"method"`
Path string `yaml:"path"`
Headers map[string]string `yaml:"headers"`
Body string `yaml:"body"`
FollowRedirects bool `yaml:"follow_redirects"`
} `yaml:"request"`
Expression string `yaml:"expression"`
Output map[string]interface{} `yaml:"output"`
}
XrayRule xray规则结构