Skip to content

Commit 19574c3

Browse files
a1phaboya1phaboy
committed
0.5
1 parent 8085469 commit 19574c3

File tree

9 files changed

+216
-77
lines changed

9 files changed

+216
-77
lines changed

‎Console/console.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ func Start(options Utils.Option){
3939
}(k,v,ch)
4040
}
4141
wg.Wait()
42+
if options.Result != ""{
43+
writeResults(options.Result,results)
44+
}
45+
fmt.Println(results)
4246
}
4347

4448
func initTargetList(options Utils.Option,targets *[]string) {
@@ -68,3 +72,19 @@ func initTargetList(options Utils.Option,targets *[]string) {
6872
}
6973
}
7074
}
75+
76+
func writeResults(file string, results []Utils.Result ){
77+
var f *os.File
78+
var err error
79+
f,err = os.Create(file)
80+
if err != nil{
81+
fmt.Println(err.Error())
82+
return
83+
}
84+
for _,v := range results{
85+
if v.Type == "Fastjson" {
86+
info := Utils.SCAN_RESULTS_OUTPUT_FACTORY(v)
87+
_, err = io.WriteString(f, info)
88+
}
89+
}
90+
}

‎Detect/Detect.go‎ renamed to ‎Detect/detect.go‎

Lines changed: 70 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,9 @@ import (
1616
*** 识别fastjson(主要通过报错回显的方式)
1717
**/
1818

19+
1920
func DetectFastjson(url string) (bool,string){
20-
fmt.Println("[+] 正在进行报错识别")
21+
fmt.Println("["+url+"] :"+"[+] 正在进行报错识别")
2122
jsonType, _ := ErrDetectVersion(url)
2223
if jsonType == "jackson" {
2324
return false,Utils.NOT_FS
@@ -34,57 +35,64 @@ func DetectFastjson(url string) (bool,string){
3435

3536
func DetectVersion(url string ) Utils.Result {
3637
var result Utils.Result
38+
Utils.InitResult(result)
3739
fmt.Println("开始检测 "+url)
3840
result.Url = url
39-
//是否出网
4041
var payloads Utils.DNSPayloads
4142
isFastjson,jsonType := DetectFastjson(url)
4243
if jsonType == "jackson" {
4344
result.Type = jsonType
4445
return result
4546
}
4647
//出网探测
47-
fmt.Println("[+] 正在进行出网探测")
48+
fmt.Println("["+result.Url+"] :"+"[+] 正在进行出网探测")
4849
payload, session := Utils.NET_DETECT_FACTORY()
49-
if DnslogDetect(url, payload, session) != "[]" {
50-
//出网
51-
fmt.Println("[*] 目标可出网")
52-
result.Netout = true
53-
result.Type = "Fastjson"
54-
fmt.Println("[+] 正在进行 AutoType状态 探测")
55-
result.AutoType = DetectAutoType(url)
56-
result.Dependency = DetectDependency(url)
57-
if isFastjson && jsonType != Utils.NOT_FS && jsonType != ""{
58-
fmt.Println("[+] Fastjson版本为 "+jsonType)
59-
result.Version = jsonType
60-
return result
61-
}
62-
fmt.Println("[+] 正在进行版本探测")
63-
payloads, session = Utils.DNS_DETECT_FACTORY()
64-
if DnslogDetect(url, payloads.Dns_48, session) == "48" {
65-
result.Version = Utils.FJ_UNDER_48
66-
return result
67-
}
68-
if DnslogDetect(url, payloads.Dns_68, session) == "68" {
69-
if result.AutoType{
70-
result.Version = Utils.FJ_BEYOND_48
50+
record := DnslogDetect(url, payload, session)
51+
if record != "[]" {
52+
if record != Utils.NETWORK_NOT_ACCESS {
53+
//出网
54+
fmt.Println("[" + result.Url + "] :" + "[*] 目标可出网")
55+
result.Netout = true
56+
result.Type = "Fastjson"
57+
fmt.Println("[" + result.Url + "] :" + "[+] 正在进行 AutoType状态 探测")
58+
result.AutoType = DetectAutoType(url)
59+
result.Dependency = DetectDependency(url)
60+
if isFastjson && jsonType != Utils.NOT_FS && jsonType != "" {
61+
fmt.Println("[" + result.Url + "] :" + "[+] Fastjson版本为 " + jsonType)
62+
result.Version = jsonType
7163
return result
7264
}
73-
result.Version = Utils.FJ_BETWEEN_48_68
74-
return result
75-
}
76-
if DnslogDetect(url, payloads.Dns_80, session) == "80" {
77-
result.Version = Utils.FJ_BETWEEN_69_80
78-
return result
79-
}
80-
if DnslogDetect(url, payloads.Dns_80, session) == "83" {
81-
result.Version = Utils.FS_BEYOND_80
82-
return result
65+
fmt.Println("[" + result.Url + "] :" + "[+] 正在进行版本探测")
66+
payloads, session = Utils.DNS_DETECT_FACTORY()
67+
if DnslogDetect(url, payloads.Dns_48, session) == "48" {
68+
result.Version = Utils.FJ_UNDER_48
69+
return result
70+
}
71+
if DnslogDetect(url, payloads.Dns_68, session) == "68" {
72+
if result.AutoType {
73+
result.Version = Utils.FJ_BEYOND_48
74+
return result
75+
}
76+
result.Version = Utils.FJ_BETWEEN_48_68
77+
return result
78+
}
79+
if DnslogDetect(url, payloads.Dns_80, session) == "80" {
80+
result.Version = Utils.FJ_BETWEEN_69_80
81+
return result
82+
}
83+
if DnslogDetect(url, payloads.Dns_80, session) == "83" {
84+
result.Version = Utils.FS_BEYOND_80
85+
return result
86+
}
87+
}else{
88+
fmt.Println("客户端与dnslog平台网络不可达")
89+
//内网测试场景 施工中
8390
}
91+
8492
} else {
8593
//不出网
86-
fmt.Println("[-] 目标不出网")
87-
fmt.Println("[+] 正在进行延迟探测")
94+
fmt.Println("["+result.Url+"] :"+"[-] 目标不出网")
95+
fmt.Println("["+result.Url+"] :"+"[+] 正在进行延迟探测")
8896
if TimeDelayCheck(url) {
8997
result.Netout = false
9098
result.Type = "Fastjson"
@@ -95,7 +103,7 @@ func DetectVersion(url string ) Utils.Result {
95103
}
96104
}
97105

98-
result.Type = ""
106+
result.Type = jsonType
99107
return result
100108
}
101109

@@ -105,25 +113,25 @@ func DetectVersion(url string ) Utils.Result {
105113
**/
106114

107115
func DetectDependency(target string)[]string{
108-
fmt.Println("[+] 正在进行依赖库探测")
109-
fmt.Println("[+] 正在进行报错探测")
110-
var result []string
116+
fmt.Println("["+target+"] :"+"[+] 正在进行依赖库探测")
117+
fmt.Println("["+target+"] :"+"[+] 正在进行报错探测")
118+
var results []string
111119
findDependency := ErrDetectDependency(target,Utils.DEPENDENCY_ERR_DETECT_FACTORY())
112120
//fmt.Println(findDependency)
113121
if findDependency[0] == "" {
114-
fmt.Println("[-] 报错探测未发现任何依赖库")
115-
result[0] = ""
122+
fmt.Println("["+target+"] :"+"[-] 报错探测未发现任何依赖库")
123+
results[0] = ""
116124
}else{
117-
fmt.Println("[*] 发现依赖库如下")
125+
fmt.Println("["+target+"] :"+"[*] 发现依赖库如下")
118126
for dependency := range findDependency{
119127
if findDependency[dependency] != "" {
120128
fmt.Println(findDependency[dependency])
121-
result = append(result,findDependency[dependency])
129+
results = append(results,findDependency[dependency])
122130
}
123131

124132
}
125133
}
126-
return result
134+
return results
127135
}
128136

129137

@@ -134,16 +142,17 @@ func DetectDependency(target string)[]string{
134142

135143
func DetectAutoType(url string) bool{
136144
dnsurl,session := Utils.GetDnslogUrl()
137-
var result bool
145+
var autoTypeStatus bool
138146
payload := Utils.AUTOTYPE_DETECT_FACTORY(dnsurl)
139-
if DnslogDetect(url,payload,session) == "[]" {
140-
fmt.Println("[-] 目标没有开启 AutoType")
141-
result = false
147+
record := DnslogDetect(url,payload,session)
148+
if record == "[]" || record == Utils.NETWORK_NOT_ACCESS{
149+
fmt.Println("["+url+"] :"+"[-] 目标没有开启 AutoType")
150+
autoTypeStatus = false
142151
}else{
143-
fmt.Println("[*] 目标开启了 AutoType ")
144-
result = true
152+
fmt.Println("["+url+"] :"+"[*] 目标开启了 AutoType ")
153+
autoTypeStatus = true
145154
}
146-
return result
155+
return autoTypeStatus
147156
}
148157

149158
func DnslogDetect(target string,payload string,session string) string{
@@ -178,7 +187,11 @@ func ErrDetectVersion(target string) (string,bool){
178187
httpReq.Header.Add("Content-Type", "application/json")
179188
httpRsp, err := http.DefaultClient.Do(httpReq)
180189
if err != nil {
181-
err.Error()
190+
httpRsp = Utils.NetWorkErrHandle(http.DefaultClient,httpReq,err)
191+
if httpRsp == nil{
192+
fmt.Println("与"+target+"网络不可达,请检查网络")
193+
return Utils.NETWORK_NOT_ACCESS,false
194+
}
182195
}
183196
defer httpRsp.Body.Close()
184197
body, err := ioutil.ReadAll(httpRsp.Body)
@@ -236,15 +249,15 @@ func TimeDelayCheck(url string) bool{
236249
var count int
237250
var start int64
238251
var pos int64 = 0
239-
for i := 0; i < 5; i++ {
252+
for i := 0; i < 6; i++ {
240253
start = pos
241-
payloads := Utils.TIME_DETECT_FACTORY(5)
254+
payloads := Utils.TIME_DETECT_FACTORY(6)
242255
pos = TimeGet(url,payloads[i])
243256
if pos - start > 0{
244257
count ++
245258
}
246259
}
247-
if count > 3 {
260+
if count > 4 {
248261
return true
249262
}
250263
return false

‎README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ FastjsonExpFramework一共分为探测、利用、混淆、bypass JDK等多个
1212

1313
### HOW?
1414
目前fastjsonScan支持
15+
☑️支持批量接口探测
1516
☑️1.2.83及以下的区间探测(主要分为48,68,80三大安全版本)
1617
☑️支持报错回显探测
1718
☑️DNS出网检测
@@ -21,9 +22,11 @@ FastjsonExpFramework一共分为探测、利用、混淆、bypass JDK等多个
2122

2223
### TODO
2324
适配内网环境下的探测
25+
适配webpack做自动化扫描
2426
完善DNS回显探测依赖库的探测
2527
完善在61版本以上并且不出网的检测方式
26-
完善其他不同json解析库的探测
28+
完善其他不同json解析库的探测
29+
完善相关依赖库检测
2730

2831
### 如果在使用过程中有任何问题欢迎提出issues👏
2932

‎Utils/dnslog.go‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package Utils
22

33
import (
4+
"fmt"
45
"io/ioutil"
56
"math/rand"
67
"net/http"
@@ -20,8 +21,16 @@ func GetDnslogUrl() (string,string){
2021
err.Error()
2122
}
2223
req.Header.Add("Cookie","PHPSESSID="+session)
23-
resp, _ := client.Do(req)
24+
resp, err := client.Do(req)
25+
if err != nil{
26+
resp = NetWorkErrHandle(client,req,err)
27+
if resp == nil{
28+
fmt.Println("与dns平台网络不可达,请检查网络")
29+
return NETWORK_NOT_ACCESS,""
30+
}
31+
}
2432
domain, _ := ioutil.ReadAll(resp.Body)
33+
2534
return string(domain),session
2635
}
2736

@@ -32,7 +41,14 @@ func GetDnslogRecord(PHPSESSID string) string{
3241
err.Error()
3342
}
3443
req.Header.Add("Cookie","PHPSESSID=" + PHPSESSID)
35-
resp, _ := client.Do(req)
44+
resp, err := client.Do(req)
45+
if err != nil{
46+
resp = NetWorkErrHandle(client,req,err)
47+
if resp == nil{
48+
fmt.Println("与dns平台网络不可达,请检查网络")
49+
return NETWORK_NOT_ACCESS
50+
}
51+
}
3652
body, _ := ioutil.ReadAll(resp.Body)
3753
dns_48 := regexp.MustCompile(`48_.`)
3854
dns_68 := regexp.MustCompile(`68_.`)

‎Utils/err.go‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
package Utils
2+
3+
import (
4+
"net/http"
5+
"strings"
6+
"time"
7+
)
8+
9+
/**
10+
*** 异常处理函数封装
11+
**/
12+
13+
func NetWorkErrHandle(client *http.Client,req *http.Request,err error) *http.Response{
14+
if strings.Contains(err.Error(), "Timeout") {
15+
i := 0
16+
for {
17+
time.Sleep(2 * time.Second)
18+
resp, err := client.Do(req)
19+
i++
20+
if err == nil {
21+
return resp
22+
}
23+
if i > 3 {
24+
defer client.CloseIdleConnections()
25+
return nil
26+
}
27+
}
28+
} else {
29+
defer client.CloseIdleConnections()
30+
return nil
31+
}
32+
}
33+
34+
35+
36+
37+
38+
39+
40+
41+

‎Utils/factory.go‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,3 +149,35 @@ func DEPENDENCY_ERR_DETECT_FACTORY() map[string]string{
149149
return payloads
150150

151151
}
152+
153+
func SCAN_RESULTS_OUTPUT_FACTORY(result Result) string{
154+
var outputString string
155+
var buffer bytes.Buffer
156+
var outputStringTemplate = RESULT_OUTPUT
157+
var net string
158+
var autotype string
159+
if result.Netout{
160+
net = "可出网"
161+
}else{
162+
net = "不出网"
163+
}
164+
if result.AutoType {
165+
autotype = "开启"
166+
}else{
167+
autotype = "未开启"
168+
}
169+
field := &ResultFomat{}
170+
field.Variables = make(map[string]string)
171+
field.Dependency = make([]string,len(result.Dependency))
172+
field.Variables["Url"] = result.Url
173+
field.Variables["Version"] = result.Version
174+
field.Variables["Netout"] = net
175+
field.Variables["Autotype"] = autotype
176+
field.Dependency = result.Dependency
177+
buffer.Reset()
178+
resultTemplate ,_ := template.New("field").Parse(outputStringTemplate)
179+
_ = resultTemplate.Execute(&buffer,field)
180+
outputString = buffer.String()
181+
return outputString
182+
}
183+

0 commit comments

Comments
 (0)