+
+
+
+
+
+
+[[中文 Readme]][url-doczh]
+
+[[English Readme]][url-docen]
+
+作者很久没更新了，就自己改了下，加入漏洞检测，效果如下：
+
+
+
+## 1 简介
+
+Kscan是一款纯go开发的全方位扫描器，具备端口扫描、协议检测、指纹识别，暴力破解等功能。支持协议1200+，协议指纹10000+，应用指纹20000+，暴力破解协议10余种。
+
+## 2 写在前面
+
+目前类似的资产扫描、指纹识别、漏洞检测的工具其实已经非常多了，也不乏有很棒的工具，但是Kscan其实有很多不同的想法。
+
+- Kscan希望能够接受多种输入格式，无需在使用之前对扫描对象进行分类，比如区分为IP，还是URL地址等，这对于使用者来说无疑是徒增工作量，所有的条目，均能正常输入和识别，若是URL地址，则会保留路径进行检测，若只是IP:PORT，则会优先对该端口进行协议识别。目前Kscan支持三种输入方式（-t,--target|-f,--fofa|--spy）。
+
+- Kscan没有为了追求效率，而根据端口号与常见协议进行比对来确认端口协议，也不是只检测WEB资产，在这方面，Kscan则更加看重准确性和全面性，只有高准确性的协议识别，才能为后续的应用层识别，提供良好的检测条件。
+
+- Kscan不是采用模块化的方式做单纯的功能堆叠，比如某个模块单独获取标题，某个模块单独获取SMB信息等等，独立运行，独立输出，而是以端口为单位输出资产信息，比如端口协议为HTTP，则会自动化进行后续的指纹识别、标题获取，端口协议为RPC，则会尝试获取主机名等等。
+
+
+
+## 3 编译手册
+
+[编译手册](https://github.com/lcvvvv/kscan/wiki/%E7%BC%96%E8%AF%91)
+
+## 4 开始吧
+
+Kscan目前具备3种输入目标的方式
+
+- -t/--target 可添加--check参数，只对指定的目标端口进行指纹识别，否则将对目标进行端口扫描和指纹识别
+
+```
+IP地址：114.114.114.114
+IP地址段：114.114.114.114-115.115.115.115
+URL地址：https://www.baidu.com
+文件地址：/tmp/target.txt
+```
+
+- --spy 可添加--scan参数可对存活C段进行端口扫描和指纹识别，否则将只检测存活的网段
+
+```
+[空]：将检测本机IP地址，对本机IP所在B段进行探测
+[all]：将对所有私网地址（192.168/172.32/10等）进行探测
+IP地址：将对指定IP地址所在B段进行探测
+```
+
+
+- -f/--fofa 可添加--check将对检索结果进行存活性验证，添加--scan参数将对检索结果进行端口扫描和指纹识别，否则将只返回fofa检索结果
+```
+fofa搜索关键字：将直接返回fofa搜索结果
+```
+
+## 5 使用方法
+
+```
+usage: kscan [-h,--help,--fofa-syntax] (-t,--target,-f,--fofa,--spy) [-p,--port|--top] [-o,--output] [-oJ] [--proxy] [--threads] [--path] [--host] [--timeout] [-Pn] [-Cn] [-sV] [--check] [--encoding] [--hydra] [hydra options] [fofa options]
+
+
+optional arguments:
+ -h , --help show this help message and exit
+ -f , --fofa 从fofa获取检测对象，需提前配置环境变量:FOFA_EMAIL、FOFA_KEY
+ -t , --target 指定探测对象：
+ IP地址：114.114.114.114
+ IP地址段：114.114.114.114/24,不建议子网掩码小于12
+ IP地址段：114.114.114.114-115.115.115.115
+ URL地址：https://www.baidu.com
+ 文件地址：file:/tmp/target.txt
+ --spy 网段探测模式，此模式下将自动探测主机可达的内网网段可接收参数为：
+ (空)、192、10、172、all、指定IP地址(将探测该IP地址B段存活网关)
+ --check 针对目标地址做指纹识别，仅不会进行端口探测
+ --scan 将针对--fofa、--spy提供的目标对象，进行端口扫描和指纹识别
+ -p , --port 扫描指定端口，默认会扫描TOP400，支持：80,8080,8088-8090
+ -eP, --excluded-port 跳过扫描指定的端口，支持：80,8080,8088-8090
+ -o , --output 将扫描结果保存到文件
+ -oJ 将扫描结果使用json格式保存到文件
+ -Pn 使用此参数后，将不会进行智能存活性探测，现在默认会开启智能存活性探测，提高效率
+ -Cn 使用此参数后，控制台输出结果将不会带颜色
+ -Dn 使用此参数后，将关闭CDN识别功能
+ -sV 使用此参数后，将对所有端口进行全探针探测，此参数极度影响效率，慎用！
+ --top 扫描经过筛选处理的常见端口TopX，最高支持1000个，默认为TOP400
+ --proxy 设置代理(socks5|socks4|https|http)://IP:Port
+ --threads 线程参数,默认线程100,最大值为2048
+ --path 指定请求访问的目录，只支持单个目录
+ --host 指定所有请求的头部Host值
+ --timeout 设置超时时间
+ --encoding 设置终端输出编码，可指定为：gb2312、utf-8
+ --match 对资产返回banner进行检索，存在关键字的，才会显示，否则不会显示
+ --hydra 自动化爆破支持协议：ssh,rdp,ftp,smb,mysql,mssql,oracle,postgresql,mongodb,redis,默认会开启全部
+hydra options:
+ --hydra-user 自定义hydra爆破用户名:username or user1,user2 or file:username.txt
+ --hydra-pass 自定义hydra爆破密码:password or pass1,pass2 or file:password.txt
+ 若密码中存在使用逗号的情况，则使用\,进行转义，其他符号无需转义
+ --hydra-update 自定义用户名、密码模式，若携带此参数，则为新增模式，会将用户名和密码补充在默认字典后面。否则将替换默认字典。
+ --hydra-mod 指定自动化暴力破解模块:rdp or rdp,ssh,smb
+fofa options:
+ --fofa-syntax 将获取fofa搜索语法说明
+ --fofa-size 将设置fofa返回条目数，默认100条
+ --fofa-fix-keyword 修饰keyword，该参数中的{}最终会替换成-f参数的值
+```
+
+功能不复杂，其他的自行探索
+
+## 6 演示
+
+### 6.1 端口扫描模式
+
+
+
+### 6.2 存活网段探测
+
+
+
+### 6.3 Fofa结果检索
+
+
+
+### 6.4 暴力破解
+
+
+
+### 6.5 CDN识别
+
+
+
+[url-doczh]: README
+[url-docen]: README_ENG.md
diff --git a/README_ENG.md b/README_ENG.md
new file mode 100644
index 0000000..51703ad
--- /dev/null
+++ b/README_ENG.md
@@ -0,0 +1,177 @@
+# Kscan - Simple Asset Mapping Tool
+
+
+
+
+
+
+
+[[中文 Readme]][url-doczh]
+|
+[[English Readme]][url-docen]
+
+## 0 Disclaimer (~~The author did not participate in the XX action, don't trace it~~)
+
+- This tool is only for legally authorized enterprise security construction behaviors and personal learning behaviors. If you need to test the usability of this tool, please build a target drone environment by yourself.
+
+- When using this tool for testing, you should ensure that the behavior complies with local laws and regulations and has obtained sufficient authorization. Do not scan unauthorized targets.
+
+We reserve the right to pursue your legal responsibility if the above prohibited behavior is found.
+
+If you have any illegal behavior in the process of using this tool, you shall bear the corresponding consequences by yourself, and we will not bear any legal and joint responsibility.
+
+Before installing and using this tool, please be sure to carefully read and fully understand the terms and conditions.
+
+Unless you have fully read, fully understood and accepted all the terms of this agreement, please do not install and use this tool. Your use behavior or your acceptance of this Agreement in any other express or implied manner shall be deemed that you have read and agreed to be bound by this Agreement.
+
+## 1 Introduction
+
+```
+ _ __
+|#| /#/ Lightweight Asset Mapping Tool by: kv2
+|#|/#/ _____ _____ * _ _
+|#.#/ /Edge/ /Forum| /#\ |#\ |#|
+|##| |#|___ |#| /###\ |##\|#|
+|#.#\ \#####\|#| /#/_\#\ |#.#.#|
+|#|\#\ /\___|#||#|____/#/###\#\|#|\##|
+|#| \#\\#####/ \#####/#/ \#\#| \#|
+```
+
+Kscan is an asset mapping tool that can perform port scanning, TCP fingerprinting and banner capture for specified assets, and obtain as much port information as possible without sending more packets. It can perform automatic brute force cracking on scan results, and is the first open source RDP brute force cracking tool on the go platform.
+
+## 2 Foreword
+
+At present, there are actually many tools for asset scanning, fingerprint identification, and vulnerability detection, and there are many great tools, but Kscan actually has many different ideas.
+
+- Kscan hopes to accept a variety of input formats, and there is no need to classify the scanned objects before use, such as IP, or URL address, etc. This is undoubtedly an unnecessary workload for users, and all entries can be normal Input and identification. If it is a URL address, the path will be reserved for detection. If it is only IP:PORT, the port will be prioritized for protocol identification. Currently Kscan supports three input methods (-t,--target|-f,--fofa|--spy).
+
+- Kscan does not seek efficiency by comparing port numbers with common protocols to confirm port protocols, nor does it only detect WEB assets. In this regard, Kscan pays more attention to accuracy and comprehensiveness, and only high-accuracy protocol identification , in order to provide good detection conditions for subsequent application layer identification.
+
+- Kscan does not use a modular approach to do pure function stacking, such as a module obtains the title separately, a module obtains SMB information separately, etc., runs independently, and outputs independently, but outputs asset information in units of ports, such as ports If the protocol is HTTP, subsequent fingerprinting and title acquisition will be performed automatically. If the port protocol is RPC, it will try to obtain the host name, etc.
+
+
+
+## 3 Compilation Manual
+
+[Compiler Manual](https://github.com/lcvvvv/kscan/wiki/%E7%BC%96%E8%AF%91)
+
+## 4 Get started
+
+Kscan currently has 3 ways to input targets
+
+- -t/--target can add the --check parameter to fingerprint only the specified target port, otherwise the target will be port scanned and fingerprinted
+
+```
+IP address: 114.114.114.114
+IP address range: 114.114.114.114-115.115.115.115
+URL address: https://www.baidu.com
+File address: file:/tmp/target.txt
+```
+
+- --spy can add the --scan parameter to perform port scanning and fingerprinting on the surviving C segment, otherwise only the surviving network segment will be detected
+
+```
+[Empty]: will detect the IP address of the local machine and detect the B segment where the local IP is located
+[all]: All private network addresses (192.168/172.32/10, etc.) will be probed
+IP address: will detect the B segment where the specified IP address is located
+```
+
+
+- -f/--fofa can add --check to verify the survivability of the retrieval results, and add the --scan parameter to perform port scanning and fingerprint identification on the retrieval results, otherwise only the fofa retrieval results will be returned
+```
+fofa search keywords: will directly return fofa search results
+```
+
+## 5 Instructions
+
+```
+usage: kscan [-h,--help,--fofa-syntax] (-t,--target,-f,--fofa,--spy) [-p,--port|--top] [-o,--output] [-oJ] [--proxy] [--threads] [--path] [--host] [--timeout] [-Pn] [-Cn] [-sV] [--check] [--encoding] [--hydra] [hydra options] [fofa options]
+
+
+optional arguments:
+ -h , --help show this help message and exit
+ -f , --fofa Get the detection object from fofa, you need to configure the environment variables in advance: FOFA_EMAIL, FOFA_KEY
+ -t , --target Specify the detection target:
+ IP address: 114.114.114.114
+ IP address segment: 114.114.114.114/24, subnet mask less than 12 is not recommended
+ IP address range: 114.114.114.114-115.115.115.115
+ URL address: https://www.baidu.com
+ File address: file:/tmp/target.txt
+ --spy network segment detection mode, in this mode, the internal network segment reachable by the host will be automatically detected. The acceptable parameters are:
+ (empty), 192, 10, 172, all, specified IP address (the IP address B segment will be detected as the surviving gateway)
+ --check Fingerprinting the target address, only port detection will not be performed
+ --scan will perform port scanning and fingerprinting on the target objects provided by --fofa and --spy
+ -p , --port scan the specified port, TOP400 will be scanned by default, support: 80, 8080, 8088-8090
+ -eP, --excluded-port skip scanning specified ports，support：80,8080,8088-8090
+ -o , --output save scan results to file
+ -oJ save the scan results to a file in json format
+ -Pn After using this parameter, intelligent survivability detection will not be performed. Now intelligent survivability detection is enabled by default to improve efficiency.
+ -Cn With this parameter, the console output will not be colored.
+ -sV After using this parameter, all ports will be probed with full probes. This parameter greatly affects the efficiency, so use it with caution!
+ --top Scan the filtered common ports TopX, up to 1000, the default is TOP400
+ --proxy set proxy (socks5|socks4|https|http)://IP:Port
+ --threads thread parameter, the default thread is 100, the maximum value is 2048
+ --path specifies the directory to request access, only a single directory is supported
+ --host specifies the header Host value for all requests
+ --timeout set timeout
+ --encoding Set the terminal output encoding, which can be specified as: gb2312, utf-8
+ --match returns the banner to the asset for retrieval. If there is a keyword, it will be displayed, otherwise it will not be displayed
+ --hydra automatic blasting support protocol: ssh, rdp, ftp, smb, mysql, mssql, oracle, postgresql, mongodb, redis, all are enabled by default
+hydra options:
+ --hydra-user custom hydra blasting username: username or user1,user2 or file:username.txt
+ --hydra-pass Custom hydra blasting password: password or pass1,pass2 or file:password.txt
+ If there is a comma in the password, use \, to escape, other symbols do not need to be escaped
+ --hydra-update Customize the user name and password mode. If this parameter is carried, it is a new mode, and the user name and password will be added to the default dictionary. Otherwise the default dictionary will be replaced.
+ --hydra-mod specifies the automatic brute force cracking module: rdp or rdp, ssh, smb
+fofa options:
+ --fofa-syntax will get fofa search syntax description
+ --fofa-size will set the number of entries returned by fofa, the default is 100
+ --fofa-fix-keyword Modifies the keyword, and the {} in this parameter will eventually be replaced with the value of the -f parameter
+```
+
+The function is not complicated, the others are explored by themselves
+
+## 6 Demo
+
+### 6.1 Port Scan Mode
+
+
+
+### 6.2 Survival network segment detection
+
+
+
+### 6.3 Fofa result retrieval
+
+
+
+### 6.4 Brute-force cracking
+
+
+
+### 6.5 CDN identification
+
+
+
+## 7 Special thanks
+
+- [EdgeSecurityTeam](https://github.com/EdgeSecurityTeam)
+
+- [bufferfly](https://github.com/dr0op/bufferfly)
+
+- [EHole(Edge Hole)](https://github.com/EdgeSecurityTeam/EHole)
+
+- [NMAP](https://github.com/nmap/nmap/)
+
+- [grdp](https://github.com/tomatome/grdp/)
+
+- [fscan](https://github.com/shadow1ng/fscan)
+
+- [dismap](https://github.com/zhzyker/dismap)
+
+## 8 End of article
+
+Github project address (bugs, requirements, rules are welcome to submit): https://github.com/lcvvvv/kscan
+
+[url-doczh]: README
+[url-docen]: README_ENG.md
\ No newline at end of file
diff --git a/app/type-args.go b/app/type-args.go
new file mode 100644
index 0000000..a1dad33
--- /dev/null
+++ b/app/type-args.go
@@ -0,0 +1,217 @@
+package app
+
+import (
+ "KscanPro/lib/sflag"
+ "fmt"
+ "github.com/gookit/color"
+ "os"
+ "strings"
+)
+
+type args struct {
+ USAGE, HELP, LOGO, SYNTAX string
+
+ Help, Debug, ClosePing, Check, CloseColor, Scan bool
+ ScanVersion, DownloadQQwry, CloseCDN bool
+ Output, Proxy, Encoding string
+ Port, ExcludedPort []int
+ Path, Host, Target []string
+ OutputJson, OutputCSV string
+ Spy, Touch string
+ Top, Threads, Timeout int
+ //hydra模块
+ Hydra, HydraUpdate bool
+ HydraUser, HydraPass, HydraMod []string
+ //fofa模块
+ Fofa []string
+ FofaField, FofaFixKeyword string
+ FofaSize int
+ FofaSyntax bool
+ //输出修饰
+ Match, NotMatch string
+}
+
+var (
+ green = []*color.Style256{color.S256(46), color.S256(47), color.S256(48), color.S256(49), color.S256(50), color.S256(51)}
+ pink = []*color.Style256{color.S256(214), color.S256(215), color.S256(216), color.S256(217), color.S256(218), color.S256(219)}
+ yellow = []*color.Style256{color.S256(226), color.S256(227), color.S256(228), color.S256(229), color.S256(230), color.S256(231)}
+)
+
+var (
+ UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"
+ Accept = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"
+ Cookie = ""
+ PocNum = 20
+ DnsLog = false
+ PocFull = false
+ Proxy = ""
+ WebTimeout = 5
+ Socks5Proxy = ""
+)
+
+type PocInfo struct {
+ Target string
+ PocName string
+}
+
+var Args = args{}
+
+// Parse 初始化参数
+func (o *args) Parse() {
+ //自定义Usage
+ sflag.SetUsage(o.LOGO)
+ //定义参数
+ o.define()
+ //实例化参数值
+ sflag.Parse()
+ //输出LOGO
+ o.printBanner()
+}
+
+// 定义参数
+func (o *args) define() {
+ sflag.BoolVar(&o.Help, "h", false)
+ sflag.BoolVar(&o.Help, "help", false)
+ sflag.BoolVar(&o.Debug, "debug", false)
+ sflag.BoolVar(&o.Debug, "d", false)
+ //spy模块
+ sflag.AutoVarString(&o.Spy, "spy", "None")
+ //hydra模块
+ sflag.BoolVar(&o.Hydra, "hydra", false)
+ sflag.BoolVar(&o.HydraUpdate, "hydra-update", false)
+ sflag.StringSpliceVar(&o.HydraUser, "hydra-user")
+ sflag.StringSpliceVar(&o.HydraPass, "hydra-pass")
+ sflag.StringSpliceVar(&o.HydraMod, "hydra-mod")
+ //fofa模块
+ sflag.StringSpliceVar(&o.Fofa, "fofa")
+ sflag.StringSpliceVar(&o.Fofa, "f")
+ sflag.StringVar(&o.FofaField, "fofa-field", "")
+ sflag.StringVar(&o.FofaFixKeyword, "fofa-fix-keyword", "")
+ sflag.IntVar(&o.FofaSize, "fofa-size", 100)
+ sflag.BoolVar(&o.FofaSyntax, "fofa-syntax", false)
+ sflag.BoolVar(&o.Scan, "scan", false)
+ //kscan模块
+ sflag.StringSpliceVar(&o.Target, "target")
+ sflag.StringSpliceVar(&o.Target, "t")
+ sflag.IntSpliceVar(&o.Port, "port")
+ sflag.IntSpliceVar(&o.Port, "p")
+ sflag.IntSpliceVar(&o.ExcludedPort, "eP")
+ sflag.IntSpliceVar(&o.ExcludedPort, "excluded-port")
+ sflag.StringSpliceVar(&o.Path, "path")
+ sflag.StringSpliceVar(&o.Host, "host")
+ sflag.StringVar(&o.Proxy, "proxy", "")
+ sflag.IntVar(&o.Top, "top", 400)
+ sflag.IntVar(&o.Threads, "threads", 800)
+ sflag.IntVar(&o.Timeout, "timeout", 3)
+ sflag.BoolVar(&o.ClosePing, "Pn", false)
+ sflag.BoolVar(&o.Check, "check", false)
+ sflag.BoolVar(&o.ScanVersion, "sV", false)
+ //CDN检测
+ sflag.BoolVar(&o.CloseCDN, "Dn", false)
+ sflag.BoolVar(&o.DownloadQQwry, "download-qqwry", false)
+
+ //输出模块
+ sflag.StringVar(&o.Encoding, "encoding", "utf-8")
+ sflag.StringVar(&o.Match, "match", "")
+ sflag.StringVar(&o.NotMatch, "not-match", "")
+ sflag.StringVar(&o.Output, "o", "")
+ sflag.StringVar(&o.Output, "output", "")
+ sflag.StringVar(&o.OutputJson, "oJ", "")
+ sflag.StringVar(&o.OutputCSV, "oC", "")
+ sflag.BoolVar(&o.CloseColor, "Cn", false)
+}
+
+func (o *args) SetLogo(logo string) {
+ o.LOGO = logo
+}
+
+func (o *args) SetUsage(usage string) {
+ o.USAGE = usage
+}
+
+func (o *args) SetSyntax(syntax string) {
+ o.SYNTAX = syntax
+}
+
+func (o *args) SetHelp(help string) {
+ o.HELP = help
+}
+
+// CheckArgs 校验参数真实性
+func (o *args) CheckArgs() {
+ //判断必须的参数是否存在
+ if len(o.Target) == 0 && len(o.Fofa) == 0 && o.Spy == "None" && o.DownloadQQwry == false {
+ fmt.Print("至少有--target、--fofa、--spy参数中的一个")
+ os.Exit(0)
+ }
+ //判断冲突参数
+ if len(o.Target) > 0 && len(o.Fofa) == 0 && o.Spy != "None" && o.Touch == "None" {
+ fmt.Print("--target、--fofa、--spy不能同时使用")
+ os.Exit(0)
+ }
+ if len(o.Port) > 0 && o.Top != 400 {
+ fmt.Print("--port、--top参数不能同时使用")
+ os.Exit(0)
+ }
+ //判断内容
+ if o.Top != 0 && (o.Top > 1000 || o.Top < 1) {
+ fmt.Print("TOP参数输入错误,TOP参数应为1-1000之间的整数。")
+ os.Exit(0)
+ }
+ if o.Proxy != "" && sflag.ProxyStrVerification(o.Proxy) {
+ fmt.Print("--proxy参数输入错误，其格式应为：http://ip:port，支持socks5/4")
+ }
+ if o.Threads != 0 && o.Threads > 2048 {
+ fmt.Print("--threads参数最大值为2048")
+ os.Exit(0)
+ }
+}
+
+// 输出LOGO
+func (o *args) printBanner() {
+ if len(os.Args) == 1 {
+ fmt.Println(gradient(o.LOGO, pink))
+ fmt.Print(o.USAGE)
+ os.Exit(0)
+ }
+ if o.Help {
+ fmt.Println(gradient(o.LOGO, pink))
+ fmt.Print(o.USAGE)
+ fmt.Print(o.HELP)
+ os.Exit(0)
+ }
+ if o.FofaSyntax {
+ fmt.Println(gradient(o.LOGO, pink))
+ fmt.Print(o.USAGE)
+ fmt.Print(o.SYNTAX)
+ os.Exit(0)
+ }
+ //打印logo
+ fmt.Println(gradient(o.LOGO, pink))
+}
+
+func gradient(text string, coloRR []*color.Style256) string {
+ lines := strings.Split(text, "\n")
+
+ var output string
+
+ t := len(text) / 6
+ i := 0
+ j := 0
+ for l := 0; l < len(lines); l++ {
+ str := strings.Split(lines[l], "")
+ for _, x := range str {
+ j++
+ output += coloRR[i].Sprint(x)
+ if j > t {
+ i++
+ j = 0
+ }
+ }
+ if len(lines) != 0 {
+ output += "\n"
+ }
+ }
+
+ return strings.TrimRight(output, "\n")
+}
diff --git a/app/type-config.go b/app/type-config.go
new file mode 100644
index 0000000..622b1f3
--- /dev/null
+++ b/app/type-config.go
@@ -0,0 +1,312 @@
+package app
+
+import (
+ "KscanPro/core/hydra"
+ "KscanPro/core/slog"
+ "KscanPro/lib/misc"
+ "encoding/csv"
+ "os"
+ "strings"
+ "sync"
+ "time"
+)
+
+type Config struct {
+ Target []string
+ Port []int
+ Output *os.File
+ Proxy, Encoding string
+ Path, Host []string
+ OutputJson *JSONWriter
+ OutputCSV *CSVWriter
+ Threads int
+ Timeout time.Duration
+ ClosePing, Check, CloseColor bool
+ ScanVersion bool
+ Spy string
+ //hydra
+ Hydra, HydraUpdate bool
+ HydraPass, HydraUser, HydraMod []string
+ //exploit
+ Exploit bool
+ //fofa
+ Fofa []string
+ FofaFixKeyword string
+ FofaSize int
+ Scan bool
+ //CDN检测模块
+ DownloadQQwry bool
+ CloseCDN bool
+ //输出修饰
+ Match string
+ NotMatch string
+}
+
+var Setting = New()
+
+func ConfigInit() {
+ args := Args
+ Setting.Spy = args.Spy
+ if args.Spy == "None" {
+ Setting.Target = args.Target
+ }
+ Setting.loadPort()
+ Setting.loadExcludedPort()
+ Setting.loadOutput()
+ Setting.loadScanPing()
+ Setting.Timeout = time.Duration(args.Timeout) * time.Second
+ Setting.Check = args.Check
+ if Setting.Check == true {
+ Setting.Port = []int{}
+ }
+ Setting.Path = args.Path
+ Setting.Proxy = args.Proxy
+ Setting.Host = args.Host
+ Setting.Threads = args.Threads
+ Setting.Encoding = args.Encoding
+ Setting.OutputJson = loadOutputJSON(args.OutputJson)
+ Setting.OutputCSV = loadOutputCSV(args.OutputCSV)
+ Setting.ScanVersion = args.ScanVersion
+ //Setting.CloseColor = args.CloseColor
+ //hydra模块
+ Setting.Hydra = args.Hydra
+ Setting.HydraUpdate = args.HydraUpdate
+ Setting.HydraUser = args.HydraUser
+ Setting.HydraPass = args.HydraPass
+ Setting.loadHydraMod(args.HydraMod)
+ //fofa模块
+ Setting.Fofa = args.Fofa
+ Setting.FofaSize = args.FofaSize
+ Setting.FofaFixKeyword = args.FofaFixKeyword
+ Setting.Scan = args.Scan
+ //CDN检测模块
+ Setting.DownloadQQwry = args.DownloadQQwry
+ Setting.CloseCDN = args.CloseCDN
+ //输出修饰
+ Setting.Match = args.Match
+ Setting.NotMatch = args.NotMatch
+}
+
+func loadOutputJSON(path string) *JSONWriter {
+ if path == "" {
+ return nil
+ }
+ if _, err := os.Stat(path); err == nil || os.IsExist(err) {
+ slog.Println(slog.WARN, "检测到JSON输出文件已存在，将自动删除该文件：", path)
+ if err := os.Remove(path); err != nil {
+ slog.Println(slog.ERROR, "删除文件失败，请检查：", err)
+ }
+ }
+ f, err := os.OpenFile(path, os.O_CREATE+os.O_RDWR, 0764)
+ if err != nil {
+ slog.Println(slog.ERROR, err)
+ }
+ jw := &JSONWriter{f, &sync.Mutex{}}
+ jw.f.Seek(0, 0)
+ _, err = jw.f.WriteString(`[]`)
+ if err != nil {
+ slog.Println(slog.ERROR, err)
+ }
+ return &JSONWriter{f, &sync.Mutex{}}
+}
+
+func loadOutputCSV(path string) *CSVWriter {
+ if path == "" {
+ return nil
+ }
+
+ if _, err := os.Stat(path); err == nil || os.IsExist(err) {
+ slog.Println(slog.WARN, "检测到CSV输出文件已存在，将自动删除该文件：", path)
+ if err := os.Remove(path); err != nil {
+ slog.Println(slog.ERROR, "删除文件失败，请检查：", err)
+ }
+ }
+
+ f, err := os.OpenFile(path, os.O_CREATE+os.O_RDWR, 0764)
+ if err != nil {
+ slog.Println(slog.ERROR, err)
+ }
+ f.WriteString("\xEF\xBB\xBF") // 写入UTF-8 BOM
+ w := csv.NewWriter(f)
+ writer := &CSVWriter{w, []string{
+ "URL", "Keyword", "IP", "Port", "Service", "Length",
+ "FingerPrint", "Addr",
+ "Digest", "Info", "Hostname", "OperatingSystem",
+ "DeviceType", "ProductName", "Version",
+ "FoundDomain", "FoundIP", "ICP",
+ "ProbeName", "MatchRegexString",
+ //"Header", "Cert", "Response", "Body",
+ }}
+ writer.f.Write(writer.title)
+ writer.f.Flush()
+ return writer
+}
+
+func (c *Config) loadPort() {
+ if len(Args.Port) > 0 {
+ c.Port = append(c.Port, Args.Port...)
+ }
+ if Args.Top != 400 {
+ c.Port = append(c.Port, TOP_1000[:Args.Top]...)
+ }
+ if len(c.Port) == 0 {
+ c.Port = TOP_1000[:400]
+ }
+
+ c.Port = misc.RemoveDuplicateElement(c.Port)
+}
+
+func (c *Config) loadExcludedPort() {
+ if len(Args.ExcludedPort) == 0 {
+ return
+ }
+
+ var availablePort = misc.CopySlice(c.Port)
+ var ignoredPort []int
+
+ for i, p := range c.Port {
+ for _, ep := range Args.ExcludedPort {
+ if p == ep {
+ var l = len(ignoredPort)
+ availablePort = append(availablePort[:i-l], availablePort[i-l+1:]...)
+ ignoredPort = append(ignoredPort, p)
+ break
+ }
+ }
+ }
+ c.Port = availablePort
+ slog.Println(slog.WARN, "本次扫描用户屏蔽的端口:", ignoredPort)
+}
+
+func (c *Config) loadOutput() {
+ expr := Args.Output
+ if expr == "" {
+ return
+ }
+ f, err := os.OpenFile(expr, os.O_CREATE+os.O_RDWR, 0764)
+ if err != nil {
+ slog.Println(slog.ERROR, err.Error())
+ } else {
+ c.Output = f
+ }
+}
+
+func (c *Config) loadScanPing() {
+ if len(c.Port) < 10 {
+ c.ClosePing = true
+ slog.Println(slog.INFO, "由于扫描端口数量小于10，已自动关闭主机存活性检测功能")
+ } else {
+ c.ClosePing = Args.ClosePing
+ }
+}
+
+func (c *Config) loadHydraMod(splice []string) {
+ if len(splice) == 0 {
+ c.HydraMod = hydra.ProtocolList
+ return
+ }
+ if splice[0] == "all" {
+ c.HydraMod = hydra.ProtocolList
+ return
+ }
+ c.HydraMod = splice
+}
+
+func (c *Config) loadFofaField(expr string) []string {
+ //判断对象是否为多个
+ if strArr := strings.ReplaceAll(expr, "\\,", "[DouHao]"); strings.Count(strArr, ",") > 0 {
+ var passArr []string
+ for _, str := range strings.Split(strArr, ",") {
+ passArr = append(passArr, strings.ReplaceAll(str, "[DouHao]", ","))
+ }
+ return passArr
+ }
+ //对象为单个且不为空时直接返回
+ if expr != "" {
+ return []string{expr}
+ }
+ return []string{}
+}
+
+func New() Config {
+ return Config{
+ Target: []string{},
+ Path: []string{"/"},
+ Port: []int{},
+ Output: nil,
+ Proxy: "",
+ Host: []string{},
+ Threads: 800,
+ Timeout: 0,
+ Encoding: "utf-8",
+ }
+}
+
+var TOP_1000 = []int{21, 22, 23, 25, 53, 69, 80, 81, 88, 89, 110, 135, 161, 445, 139, 137,
+ 143, 389, 443, 512, 513, 514, 548, 873, 1433, 1521, 2181, 3306, 3389, 3690, 4848, 5000,
+ 5001, 5432, 5632, 5900, 5901, 5902, 6379, 7000, 7001, 7002, 8000, 8001, 8007, 8008, 8009,
+ 8069, 8080, 8081, 8088, 8089, 8090, 8091, 9060, 9090, 9091, 9200, 9300, 10000, 11211, 27017,
+ 27018, 50000, 1080, 888, 1158, 2100, 2424, 2601, 2604, 3128, 5984, 7080, 8010, 8082, 8083,
+ 8084, 8085, 8086, 8087, 8222, 8443, 8686, 8888, 9000, 9001, 9002, 9003, 9004, 9005, 9006,
+ 9007, 9008, 9009, 9010, 9043, 9080, 9081, 9418, 9999, 50030, 50060, 50070, 82, 83, 84,
+ 85, 86, 87, 7003, 7004, 7005, 7006, 7007, 7008, 7009, 7010, 7070, 7071, 7072, 7073,
+ 7074, 7075, 7076, 7077, 7078, 7079, 8002, 8003, 8004, 8005, 8006, 8200, 90, 801, 8011,
+ 8100, 8012, 8070, 99, 7777, 8028, 808, 38888, 8181, 800, 18080, 8099, 8899, 8360, 8300,
+ 8800, 8180, 3505, 8053, 1000, 8989, 28017, 49166, 3000, 41516, 880, 8484, 6677, 8016, 7200,
+ 9085, 5555, 8280, 1980, 8161, 7890, 8060, 6080, 8880, 8020, 889, 8881, 38501, 1010, 93,
+ 6666, 100, 6789, 7060, 8018, 8022, 3050, 8787, 2000, 10001, 8013, 6888, 8040, 10021, 2011,
+ 6006, 4000, 8055, 4430, 1723, 6060, 7788, 8066, 9898, 6001, 8801, 10040, 9998, 803, 6688,
+ 10080, 8050, 7011, 40310, 18090, 802, 10003, 8014, 2080, 7288, 8044, 9992, 8889, 5644, 8886,
+ 9500, 58031, 9020, 8015, 8887, 8021, 8700, 91, 9900, 9191, 3312, 8186, 8735, 8380, 1234,
+ 38080, 9088, 9988, 2110, 21245, 3333, 2046, 9061, 2375, 9011, 8061, 8093, 9876, 8030, 8282,
+ 60465, 2222, 98, 1100, 18081, 70, 8383, 5155, 92, 8188, 2517, 8062, 11324, 2008, 9231,
+ 999, 28214, 16080, 8092, 8987, 8038, 809, 2010, 8983, 7700, 3535, 7921, 9093, 11080, 6778,
+ 805, 9083, 8073, 10002, 114, 2012, 701, 8810, 8400, 9099, 8098, 8808, 20000, 8065, 8822,
+ 15000, 9901, 11158, 1107, 28099, 12345, 2006, 9527, 51106, 688, 25006, 8045, 8023, 8029, 9997,
+ 7048, 8580, 8585, 2001, 8035, 10088, 20022, 4001, 2013, 20808, 8095, 106, 3580, 7742, 8119,
+ 6868, 32766, 50075, 7272, 3380, 3220, 7801, 5256, 5255, 10086, 1300, 5200, 8096, 6198, 6889,
+ 3503, 6088, 9991, 806, 5050, 8183, 8688, 1001, 58080, 1182, 9025, 8112, 7776, 7321, 235,
+ 8077, 8500, 11347, 7081, 8877, 8480, 9182, 58000, 8026, 11001, 10089, 5888, 8196, 8078, 9995,
+ 2014, 5656, 8019, 5003, 8481, 6002, 9889, 9015, 8866, 8182, 8057, 8399, 10010, 8308, 511,
+ 12881, 4016, 8042, 1039, 28080, 5678, 7500, 8051, 18801, 15018, 15888, 38443, 8123, 8144, 94,
+ 9070, 1800, 9112, 8990, 3456, 2051, 9098, 444, 9131, 97, 7100, 7711, 7180, 11000, 8037,
+ 6988, 122, 8885, 14007, 8184, 7012, 8079, 9888, 9301, 59999, 49705, 1979, 8900, 5080, 5013,
+ 1550, 8844, 4850, 206, 5156, 8813, 3030, 1790, 8802, 9012, 5544, 3721, 8980, 10009, 8043,
+ 8390, 7943, 8381, 8056, 7111, 1500, 7088, 5881, 9437, 5655, 8102, 6000, 65486, 4443, 10025,
+ 8024, 8333, 8666, 103, 8, 9666, 8999, 9111, 8071, 9092, 522, 11381, 20806, 8041, 1085,
+ 8864, 7900, 1700, 8036, 8032, 8033, 8111, 60022, 955, 3080, 8788, 7443, 8192, 6969, 9909,
+ 5002, 9990, 188, 8910, 9022, 10004, 866, 8582, 4300, 9101, 6879, 8891, 4567, 4440, 10051,
+ 10068, 50080, 8341, 30001, 6890, 8168, 8955, 16788, 8190, 18060, 7041, 42424, 8848, 15693, 2521,
+ 19010, 18103, 6010, 8898, 9910, 9190, 9082, 8260, 8445, 1680, 8890, 8649, 30082, 3013, 30000,
+ 2480, 7202, 9704, 5233, 8991, 11366, 7888, 8780, 7129, 6600, 9443, 47088, 7791, 18888, 50045,
+ 15672, 9089, 2585, 60, 9494, 31945, 2060, 8610, 8860, 58060, 6118, 2348, 8097, 38000, 18880,
+ 13382, 6611, 8064, 7101, 5081, 7380, 7942, 10016, 8027, 2093, 403, 9014, 8133, 6886, 95,
+ 8058, 9201, 6443, 5966, 27000, 7017, 6680, 8401, 9036, 8988, 8806, 6180, 421, 423, 57880,
+ 7778, 18881, 812, 15004, 9110, 8213, 8868, 1213, 8193, 8956, 1108, 778, 65000, 7020, 1122,
+ 9031, 17000, 8039, 8600, 50090, 1863, 8191, 65, 6587, 8136, 9507, 132, 200, 2070, 308,
+ 5811, 3465, 8680, 7999, 7084, 18082, 3938, 18001, 9595, 442, 4433, 7171, 9084, 7567, 811,
+ 1128, 6003, 2125, 6090, 10007, 7022, 1949, 6565, 65001, 1301, 19244, 10087, 8025, 5098, 21080,
+ 1200, 15801, 1005, 22343, 7086, 8601, 6259, 7102, 10333, 211, 10082, 18085, 180, 40000, 7021,
+ 7702, 66, 38086, 666, 6603, 1212, 65493, 96, 9053, 7031, 23454, 30088, 6226, 8660, 6170,
+ 8972, 9981, 48080, 9086, 10118, 40069, 28780, 20153, 20021, 20151, 58898, 10066, 1818, 9914, 55351,
+ 8343, 18000, 6546, 3880, 8902, 22222, 19045, 5561, 7979, 5203, 8879, 50240, 49960, 2007, 1722,
+ 8913, 8912, 9504, 8103, 8567, 1666, 8720, 8197, 3012, 8220, 9039, 5898, 925, 38517, 8382,
+ 6842, 8895, 2808, 447, 3600, 3606, 9095, 45177, 19101, 171, 133, 8189, 7108, 10154, 47078,
+ 6800, 8122, 381, 1443, 15580, 23352, 3443, 1180, 268, 2382, 43651, 10099, 65533, 7018, 60010,
+ 60101, 6699, 2005, 18002, 2009, 59777, 591, 1933, 9013, 8477, 9696, 9030, 2015, 7925, 6510,
+ 18803, 280, 5601, 2901, 2301, 5201, 302, 610, 8031, 5552, 8809, 6869, 9212, 17095, 20001,
+ 8781, 25024, 5280, 7909, 17003, 1088, 7117, 20052, 1900, 10038, 30551, 9980, 9180, 59009, 28280,
+ 7028, 61999, 7915, 8384, 9918, 9919, 55858, 7215, 77, 9845, 20140, 8288, 7856, 1982, 1123,
+ 17777, 8839, 208, 2886, 877, 6101, 5100, 804, 983, 5600, 8402, 5887, 8322, 770, 13333,
+ 7330, 3216, 31188, 47583, 8710, 22580, 1042, 2020, 34440, 20, 7703, 65055, 8997, 6543, 6388,
+ 8283, 7201, 4040, 61081, 12001, 3588, 7123, 2490, 4389, 1313, 19080, 9050, 6920, 299, 20046,
+ 8892, 9302, 7899, 30058, 7094, 6801, 321, 1356, 12333, 11362, 11372, 6602, 7709, 45149, 3668,
+ 517, 9912, 9096, 8130, 7050, 7713, 40080, 8104, 13988, 18264, 8799, 55070, 23458, 8176, 9517,
+ 9541, 9542, 9512, 8905, 11660, 1025, 44445, 44401, 17173, 436, 560, 733, 968, 602, 3133,
+ 3398, 16580, 8488, 8901, 8512, 10443, 9113, 9119, 6606, 22080, 5560, 7, 5757, 1600, 8250,
+ 10024, 10200, 333, 73, 7547, 8054, 6372, 223, 3737, 9800, 9019, 8067, 45692, 15400, 15698,
+ 9038, 37006, 2086, 1002, 9188, 8094, 8201, 8202, 30030, 2663, 9105, 10017, 4503, 1104, 8893,
+ 40001, 27779, 3010, 7083, 5010, 5501, 309, 1389, 10070, 10069, 10056, 3094, 10057, 10078, 10050,
+ 10060, 10098, 4180, 10777, 270, 6365, 9801, 1046, 7140, 1004, 9198, 8465, 8548, 108, 30015,
+ 8153, 1020, 50100, 8391, 34899, 7090, 6100, 8777, 8298, 8281, 7023, 3377, 9100,
+}
diff --git a/app/type-csvwriter.go b/app/type-csvwriter.go
new file mode 100644
index 0000000..5e3dd43
--- /dev/null
+++ b/app/type-csvwriter.go
@@ -0,0 +1,35 @@
+package app
+
+import "encoding/csv"
+
+type CSVWriter struct {
+ f *csv.Writer
+ title []string
+}
+
+func (cw *CSVWriter) inTitle(title string) bool {
+ for _, value := range cw.title {
+ if value == title {
+ return true
+ }
+ }
+ return false
+}
+
+func (cw *CSVWriter) Push(m map[string]string) {
+ var cells []string
+ for _, key := range cw.title {
+ if value, ok := m[key]; ok {
+ cells = append(cells, value)
+ delete(m, key)
+ } else {
+ cells = append(cells, "")
+ }
+ }
+ for key, value := range m {
+ cells = append(cells, value)
+ cw.title = append(cw.title, key)
+ }
+ cw.f.Write(cells)
+ cw.f.Flush()
+}
diff --git a/app/type-jsonwriter.go b/app/type-jsonwriter.go
new file mode 100644
index 0000000..136da8f
--- /dev/null
+++ b/app/type-jsonwriter.go
@@ -0,0 +1,33 @@
+package app
+
+import (
+ "KscanPro/core/slog"
+ "encoding/json"
+ "os"
+ "sync"
+)
+
+type JSONWriter struct {
+ f *os.File
+ mutex *sync.Mutex
+}
+
+func (jw *JSONWriter) Push(m map[string]string) {
+ jw.mutex.Lock()
+ defer jw.mutex.Unlock()
+ stat, err := jw.f.Stat()
+ if err != nil {
+ slog.Println(slog.ERROR, err)
+ }
+ jsonBuf, _ := json.MarshalIndent(m, "\t", "\t")
+ jsonBuf = append(jsonBuf, []byte("\n]\n")...)
+ if stat.Size() == 2 {
+ jw.f.Seek(stat.Size()-1, 0)
+ jsonBuf = append([]byte("\n\t"), jsonBuf...)
+ jw.f.Write(jsonBuf)
+ } else {
+ jw.f.Seek(stat.Size()-4, 0)
+ jsonBuf = append([]byte("},\n\t"), jsonBuf...)
+ jw.f.Write(jsonBuf)
+ }
+}
diff --git "a/assets/CDN\350\257\206\345\210\253\346\274\224\347\244\272.jpg" "b/assets/CDN\350\257\206\345\210\253\346\274\224\347\244\272.jpg"
new file mode 100644
index 0000000..bb6382a
Binary files /dev/null and "b/assets/CDN\350\257\206\345\210\253\346\274\224\347\244\272.jpg" differ
diff --git "a/assets/Fofa\347\273\223\346\236\234\346\243\200\347\264\242\346\274\224\347\244\272.png" "b/assets/Fofa\347\273\223\346\236\234\346\243\200\347\264\242\346\274\224\347\244\272.png"
new file mode 100644
index 0000000..d28131e
Binary files /dev/null and "b/assets/Fofa\347\273\223\346\236\234\346\243\200\347\264\242\346\274\224\347\244\272.png" differ
diff --git "a/assets/Hydra\345\212\237\350\203\275\346\274\224\347\244\272.png" "b/assets/Hydra\345\212\237\350\203\275\346\274\224\347\244\272.png"
new file mode 100644
index 0000000..9f4c784
Binary files /dev/null and "b/assets/Hydra\345\212\237\350\203\275\346\274\224\347\244\272.png" differ
diff --git a/assets/image-20210220164117921.jpg b/assets/image-20210220164117921.jpg
new file mode 100644
index 0000000..b55c0d9
Binary files /dev/null and b/assets/image-20210220164117921.jpg differ
diff --git a/assets/image-20210220164117923.png b/assets/image-20210220164117923.png
new file mode 100644
index 0000000..658bfc5
Binary files /dev/null and b/assets/image-20210220164117923.png differ
diff --git "a/assets/img\346\225\210\346\236\234\345\233\276.png" "b/assets/img\346\225\210\346\236\234\345\233\276.png"
new file mode 100644
index 0000000..f5f8d02
Binary files /dev/null and "b/assets/img\346\225\210\346\236\234\345\233\276.png" differ
diff --git "a/assets/kscan\351\200\273\350\276\221\345\233\276.drawio.png" "b/assets/kscan\351\200\273\350\276\221\345\233\276.drawio.png"
new file mode 100644
index 0000000..5b555e3
Binary files /dev/null and "b/assets/kscan\351\200\273\350\276\221\345\233\276.drawio.png" differ
diff --git "a/assets/\345\255\230\346\264\273\347\275\221\346\256\265\346\243\200\346\265\213\346\274\224\347\244\272.jpg" "b/assets/\345\255\230\346\264\273\347\275\221\346\256\265\346\243\200\346\265\213\346\274\224\347\244\272.jpg"
new file mode 100644
index 0000000..5a285d9
Binary files /dev/null and "b/assets/\345\255\230\346\264\273\347\275\221\346\256\265\346\243\200\346\265\213\346\274\224\347\244\272.jpg" differ
diff --git "a/assets/\347\253\257\345\217\243\346\211\253\346\217\217\346\274\224\347\244\272.png" "b/assets/\347\253\257\345\217\243\346\211\253\346\217\217\346\274\224\347\244\272.png"
new file mode 100644
index 0000000..470098c
Binary files /dev/null and "b/assets/\347\253\257\345\217\243\346\211\253\346\217\217\346\274\224\347\244\272.png" differ
diff --git a/build.sh b/build.sh
new file mode 100644
index 0000000..b4e7758
--- /dev/null
+++ b/build.sh
@@ -0,0 +1,5 @@
+export LDFLAGS='-s -w '
+
+go build -ldflags="$LDFLAGS" -trimpath kscan.go
+
+upx -9 kscan
\ No newline at end of file
diff --git a/build_release.sh b/build_release.sh
new file mode 100644
index 0000000..e877c7e
--- /dev/null
+++ b/build_release.sh
@@ -0,0 +1,29 @@
+export LDFLAGS='-s -w '
+
+CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="$LDFLAGS" -trimpath -o kscan_linux_amd64 kscan.go
+CGO_ENABLED=0 GOOS=windows GOARCH=386 go build -ldflags="$LDFLAGS" -trimpath -o kscan_windows_386.exe kscan.go
+CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags="$LDFLAGS" -trimpath -o kscan_windows_amd64.exe kscan.go
+CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -ldflags="$LDFLAGS" -trimpath -o kscan_windows_arm64.exe kscan.go
+CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -ldflags="$LDFLAGS" -trimpath -o kscan_darwin_amd64 kscan.go
+CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -ldflags="$LDFLAGS" -trimpath -o kscan_darwin_arm64 kscan.go
+
+upx -9 kscan_linux_amd64
+upx -9 kscan_windows_386.exe
+upx -9 kscan_windows_amd64.exe
+upx -9 kscan_windows_arm64.exe
+upx -9 kscan_darwin_amd64
+upx -9 kscan_darwin_arm64
+
+zip kscan_linux_amd64.zip kscan_linux_amd64
+zip kscan_windows_386.zip kscan_windows_386.exe
+zip kscan_windows_amd64.zip kscan_windows_amd64.exe
+zip kscan_windows_arm64.zip kscan_windows_arm64.exe
+zip kscan_darwin_amd64.zip kscan_darwin_amd64
+zip kscan_darwin_arm64.zip kscan_darwin_arm64
+
+rm -f kscan_linux_amd64
+rm -f kscan_windows_386.exe
+rm -f kscan_windows_amd64.exe
+rm -f kscan_windows_arm64.exe
+rm -f kscan_darwin_amd64
+rm -f kscan_darwin_arm64
\ No newline at end of file
diff --git a/core/cdn/cdn.go b/core/cdn/cdn.go
new file mode 100644
index 0000000..ead796e
--- /dev/null
+++ b/core/cdn/cdn.go
@@ -0,0 +1,386 @@
+package cdn
+
+import (
+ "KscanPro/core/slog"
+ "KscanPro/lib/dns"
+ "KscanPro/lib/qqwry"
+ "KscanPro/lib/uri"
+ "os"
+ "path/filepath"
+ "strings"
+)
+
+var database *qqwry.QQwry
+
+func Init(path string) {
+ fs, err := os.OpenFile(path, os.O_RDONLY, 0400)
+ if err != nil {
+ slog.Println(slog.WARN, "qqwry open err:", err)
+ return
+ }
+ d, err := qqwry.NewQQwryFS(fs)
+ if err != nil {
+ slog.Println(slog.WARN, "qqwry init err:", err)
+ return
+ }
+ database = d
+}
+
+func DownloadQQWry() error {
+ return qqwry.Download("./qqwry.dat")
+}
+
+func FindWithIP(query string) (bool, string, error) {
+ result, err := Find(query)
+ if strings.Contains(result, "CDN") {
+ return true, result, err
+ }
+ return false, "", err
+}
+
+func Find(query string) (string, error) {
+ result, err := database.Find(query)
+ if err != nil {
+ return "", err
+ }
+ if strings.Contains(result.String(), "对方和您在同一内部网") {
+ return "", err
+ }
+ return result.String(), err
+}
+
+func getRealPath() string {
+ dir, _ := os.Executable()
+ path := filepath.Dir(dir)
+ return path
+}
+
+type Item struct {
+ Domain string
+ Name string
+ Description string
+}
+
+func FindWithDomain(domain string) (bool, string, error) {
+ IPs, err := dns.LookupIP(domain)
+ if err != nil {
+ slog.Println(slog.DEBUG, domain, "lookupIP err :", err)
+ return false, "", err
+ }
+ if uri.SameSegment(IPs...) == false {
+ return true, "域名指向多个IP地址，且不在同一网段，该域名可能使用了CDN技术", nil
+ }
+
+ CNAMES, err := dns.LookupCNAME(domain)
+ if err != nil {
+ slog.Println(slog.DEBUG, domain, "lookupCNAME err :", err)
+ return false, "", err
+ }
+ for _, cname := range CNAMES {
+ if strings.Contains(cname, "cdn") {
+ return true, "CNAME中含有关键字：cdn，该域名可能使用了CDN技术", nil
+
+ }
+ for _, domain := range parseBaseCname(cname) {
+ for _, item := range domainItems {
+ if item.Domain == domain {
+ return true, item.Name + ":" + item.Description, nil
+ }
+ }
+ }
+ }
+ return false, "", nil
+}
+
+func Resolution(domain string) (string, error) {
+ ips, err := dns.LookupIP(domain)
+ if err != nil {
+ return "", err
+ }
+ return ips[0], nil
+
+}
+
+func parseBaseCname(cname string) (result []string) {
+ parts := strings.Split(cname, ".")
+ size := len(parts)
+ if size == 0 {
+ return []string{}
+ }
+ cname = parts[size-1]
+ result = append(result, cname)
+ for i := len(parts) - 2; i >= 0; i-- {
+ cname = parts[i] + "." + cname
+ result = append(result, cname)
+ }
+ return result
+}
+
+var domainItems = []Item{
+ {"15cdn.com", "腾正安全加速（原 15CDN）", "https://www.15cdn.com"},
+ {"tzcdn.cn", "腾正安全加速（原 15CDN）", "https://www.15cdn.com"},
+ {"cedexis.net", "Cedexis GSLB", "https://www.cedexis.com/"},
+ {"cdxcn.cn", "Cedexis GSLB (For China)", "https://www.cedexis.com/"},
+ {"qhcdn.com", "360 云 CDN (由奇安信运营)", "https://cloud.360.cn/doc?name=cdn"},
+ {"qh-cdn.com", "360 云 CDN (由奇虎 360 运营)", "https://cloud.360.cn/doc?name=cdn"},
+ {"qihucdn.com", "360 云 CDN (由奇虎 360 运营)", "https://cloud.360.cn/doc?name=cdn"},
+ {"360cdn.com", "360 云 CDN (由奇虎 360 运营)", "https://cloud.360.cn/doc?name=cdn"},
+ {"360cloudwaf.com", "奇安信网站卫士", "https://wangzhan.qianxin.com"},
+ {"360anyu.com", "奇安信网站卫士", "https://wangzhan.qianxin.com"},
+ {"360safedns.com", "奇安信网站卫士", "https://wangzhan.qianxin.com"},
+ {"360wzws.com", "奇安信网站卫士", "https://wangzhan.qianxin.com"},
+ {"akamai.net", "Akamai CDN", "https://www.akamai.com"},
+ {"akamaiedge.net", "Akamai CDN", "https://www.akamai.com"},
+ {"ytcdn.net", "Akamai CDN", "https://www.akamai.com"},
+ {"edgesuite.net", "Akamai CDN", "https://www.akamai.com"},
+ {"akamaitech.net", "Akamai CDN", "https://www.akamai.com"},
+ {"akamaitechnologies.com", "Akamai CDN", "https://www.akamai.com"},
+ {"edgekey.net", "Akamai CDN", "https://www.akamai.com"},
+ {"tl88.net", "易通锐进（Akamai 中国）由网宿承接", "https://www.akamai.com"},
+ {"cloudfront.net", "AWS CloudFront", "https://aws.amazon.com/cn/cloudfront/"},
+ {"worldcdn.net", "CDN.NET", "https://cdn.net"},
+ {"worldssl.net", "CDN.NET / CDNSUN / ONAPP", "https://cdn.net"},
+ {"cdn77.org", "CDN77", "https://www.cdn77.com/"},
+ {"panthercdn.com", "CDNetworks", "https://www.cdnetworks.com"},
+ {"cdnga.net", "CDNetworks", "https://www.cdnetworks.com"},
+ {"cdngc.net", "CDNetworks", "https://www.cdnetworks.com"},
+ {"gccdn.net", "CDNetworks", "https://www.cdnetworks.com"},
+ {"gccdn.cn", "CDNetworks", "https://www.cdnetworks.com"},
+ {"akamaized.net", "Akamai CDN", "https://www.akamai.com"},
+ {"126.net", "网易云 CDN", "https://www.163yun.com/product/cdn"},
+ {"163jiasu.com", "网易云 CDN", "https://www.163yun.com/product/cdn"},
+ {"amazonaws.com", "AWS Cloud", "https://aws.amazon.com/cn/cloudfront/"},
+ {"cdn77.net", "CDN77", "https://www.cdn77.com/"},
+ {"cdnify.io", "CDNIFY", "https://cdnify.com"},
+ {"cdnsun.net", "CDNSUN", "https://cdnsun.com"},
+ {"bdydns.com", "百度云 CDN", "https://cloud.baidu.com/product/cdn.html"},
+ {"ccgslb.com.cn", "蓝汛 CDN", "https://cn.chinacache.com/"},
+ {"ccgslb.net", "蓝汛 CDN", "https://cn.chinacache.com/"},
+ {"ccgslb.com", "蓝汛 CDN", "https://cn.chinacache.com/"},
+ {"ccgslb.cn", "蓝汛 CDN", "https://cn.chinacache.com/"},
+ {"c3cache.net", "蓝汛 CDN", "https://cn.chinacache.com/"},
+ {"c3dns.net", "蓝汛 CDN", "https://cn.chinacache.com/"},
+ {"chinacache.net", "蓝汛 CDN", "https://cn.chinacache.com/"},
+ {"wswebcdn.com", "网宿 CDN", "https://www.wangsu.com/"},
+ {"lxdns.com", "网宿 CDN", "https://www.wangsu.com/"},
+ {"wswebpic.com", "网宿 CDN", "https://www.wangsu.com/"},
+ {"cloudflare.net", "Cloudflare", "https://www.cloudflare.com"},
+ {"akadns.net", "Akamai CDN", "https://www.akamai.com"},
+ {"chinanetcenter.com", "网宿 CDN", "https://www.wangsu.com"},
+ {"customcdn.com.cn", "网宿 CDN", "https://www.wangsu.com"},
+ {"customcdn.cn", "网宿 CDN", "https://www.wangsu.com"},
+ {"51cdn.com", "网宿 CDN", "https://www.wangsu.com"},
+ {"wscdns.com", "网宿 CDN", "https://www.wangsu.com"},
+ {"cdn20.com", "网宿 CDN", "https://www.wangsu.com"},
+ {"wsdvs.com", "网宿 CDN", "https://www.wangsu.com"},
+ {"wsglb0.com", "网宿 CDN", "https://www.wangsu.com"},
+ {"speedcdns.com", "网宿 CDN", "https://www.wangsu.com"},
+ {"wtxcdn.com", "网宿 CDN", "https://www.wangsu.com"},
+ {"wsssec.com", "网宿 WAF CDN", "https://www.wangsu.com"},
+ {"fastly.net", "Fastly", "https://www.fastly.com"},
+ {"fastlylb.net", "Fastly", "https://www.fastly.com/"},
+ {"hwcdn.net", "Stackpath (原 Highwinds)", "https://www.stackpath.com/highwinds"},
+ {"incapdns.net", "Incapsula CDN", "https://www.incapsula.com"},
+ {"kxcdn.com.", "KeyCDN", "https://www.keycdn.com/"},
+ {"lswcdn.net", "LeaseWeb CDN", "https://www.leaseweb.com/cdn"},
+ {"mwcloudcdn.com", "QUANTIL (网宿)", "https://www.quantil.com/"},
+ {"mwcname.com", "QUANTIL (网宿)", "https://www.quantil.com/"},
+ {"azureedge.net", "Microsoft Azure CDN", "https://azure.microsoft.com/en-us/services/cdn/"},
+ {"msecnd.net", "Microsoft Azure CDN", "https://azure.microsoft.com/en-us/services/cdn/"},
+ {"mschcdn.com", "Microsoft Azure CDN", "https://azure.microsoft.com/en-us/services/cdn/"},
+ {"v0cdn.net", "Microsoft Azure CDN", "https://azure.microsoft.com/en-us/services/cdn/"},
+ {"azurewebsites.net", "Microsoft Azure App Service", "https://azure.microsoft.com/en-us/services/app-service/"},
+ {"azurewebsites.windows.net", "Microsoft Azure App Service", "https://azure.microsoft.com/en-us/services/app-service/"},
+ {"trafficmanager.net", "Microsoft Azure Traffic Manager", "https://azure.microsoft.com/en-us/services/traffic-manager/"},
+ {"cloudapp.net", "Microsoft Azure", "https://azure.microsoft.com"},
+ {"chinacloudsites.cn", "世纪互联旗下上海蓝云（承载 Azure 中国）", "https://www.21vbluecloud.com/"},
+ {"spdydns.com", "云端智度融合 CDN", "https://www.isurecloud.net/index.html"},
+ {"jiashule.com", "知道创宇云安全加速乐CDN", "https://www.yunaq.com/jsl/"},
+ {"jiasule.org", "知道创宇云安全加速乐CDN", "https://www.yunaq.com/jsl/"},
+ {"365cyd.cn", "知道创宇云安全创宇盾（政务专用）", "https://www.yunaq.com/cyd/"},
+ {"huaweicloud.com", "华为云WAF高防云盾", "https://www.huaweicloud.com/product/aad.html"},
+ {"cdnhwc1.com", "华为云 CDN", "https://www.huaweicloud.com/product/cdn.html"},
+ {"cdnhwc2.com", "华为云 CDN", "https://www.huaweicloud.com/product/cdn.html"},
+ {"cdnhwc3.com", "华为云 CDN", "https://www.huaweicloud.com/product/cdn.html"},
+ {"dnion.com", "帝联科技", "http://www.dnion.com/"},
+ {"ewcache.com", "帝联科技", "http://www.dnion.com/"},
+ {"globalcdn.cn", "帝联科技", "http://www.dnion.com/"},
+ {"tlgslb.com", "帝联科技", "http://www.dnion.com/"},
+ {"fastcdn.com", "帝联科技", "http://www.dnion.com/"},
+ {"flxdns.com", "帝联科技", "http://www.dnion.com/"},
+ {"dlgslb.cn", "帝联科技", "http://www.dnion.com/"},
+ {"newdefend.cn", "牛盾云安全", "https://www.newdefend.com"},
+ {"ffdns.net", "CloudXNS", "https://www.cloudxns.net"},
+ {"aocdn.com", "可靠云 CDN (贴图库)", "http://www.kekaoyun.com/"},
+ {"bsgslb.cn", "白山云 CDN", "https://zh.baishancloud.com/"},
+ {"qingcdn.com", "白山云 CDN", "https://zh.baishancloud.com/"},
+ {"bsclink.cn", "白山云 CDN", "https://zh.baishancloud.com/"},
+ {"trpcdn.net", "白山云 CDN", "https://zh.baishancloud.com/"},
+ {"anquan.io", "牛盾云安全", "https://www.newdefend.com"},
+ {"cloudglb.com", "快网 CDN", "http://www.fastweb.com.cn/"},
+ {"fastweb.com", "快网 CDN", "http://www.fastweb.com.cn/"},
+ {"fastwebcdn.com", "快网 CDN", "http://www.fastweb.com.cn/"},
+ {"cloudcdn.net", "快网 CDN", "http://www.fastweb.com.cn/"},
+ {"fwcdn.com", "快网 CDN", "http://www.fastweb.com.cn/"},
+ {"fwdns.net", "快网 CDN", "http://www.fastweb.com.cn/"},
+ {"hadns.net", "快网 CDN", "http://www.fastweb.com.cn/"},
+ {"hacdn.net", "快网 CDN", "http://www.fastweb.com.cn/"},
+ {"cachecn.com", "快网 CDN", "http://www.fastweb.com.cn/"},
+ {"qingcache.com", "青云 CDN", "https://www.qingcloud.com/products/cdn/"},
+ {"qingcloud.com", "青云 CDN", "https://www.qingcloud.com/products/cdn/"},
+ {"frontwize.com", "青云 CDN", "https://www.qingcloud.com/products/cdn/"},
+ {"msscdn.com", "美团云 CDN", "https://www.mtyun.com/product/cdn"},
+ {"800cdn.com", "西部数码", "https://www.west.cn"},
+ {"tbcache.com", "阿里云 CDN", "https://www.aliyun.com/product/cdn"},
+ {"aliyun-inc.com", "阿里云 CDN", "https://www.aliyun.com/product/cdn"},
+ {"aliyuncs.com", "阿里云 CDN", "https://www.aliyun.com/product/cdn"},
+ {"alikunlun.net", "阿里云 CDN", "https://www.aliyun.com/product/cdn"},
+ {"alikunlun.com", "阿里云 CDN", "https://www.aliyun.com/product/cdn"},
+ {"alicdn.com", "阿里云 CDN", "https://www.aliyun.com/product/cdn"},
+ {"aligaofang.com", "阿里云盾高防", "https://www.aliyun.com/product/ddos"},
+ {"yundunddos.com", "阿里云盾高防", "https://www.aliyun.com/product/ddos"},
+ {"kunlun(.*).com", "阿里云 CDN", "https://www.aliyun.com/product/cdn"},
+ {"cdngslb.com", "阿里云 CDN", "https://www.aliyun.com/product/cdn"},
+ {"yunjiasu-cdn.net", "百度云加速", "https://su.baidu.com"},
+ {"momentcdn.com", "魔门云 CDN", "https://www.cachemoment.com"},
+ {"aicdn.com", "又拍云", "https://www.upyun.com"},
+ {"qbox.me", "七牛云", "https://www.qiniu.com"},
+ {"qiniu.com", "七牛云", "https://www.qiniu.com"},
+ {"qiniudns.com", "七牛云", "https://www.qiniu.com"},
+ {"jcloudcs.com", "京东云 CDN", "https://www.jdcloud.com/cn/products/cdn"},
+ {"jdcdn.com", "京东云 CDN", "https://www.jdcloud.com/cn/products/cdn"},
+ {"qianxun.com", "京东云 CDN", "https://www.jdcloud.com/cn/products/cdn"},
+ {"jcloudlb.com", "京东云 CDN", "https://www.jdcloud.com/cn/products/cdn"},
+ {"jcloud-cdn.com", "京东云 CDN", "https://www.jdcloud.com/cn/products/cdn"},
+ {"maoyun.tv", "猫云融合 CDN", "https://www.maoyun.com/"},
+ {"maoyundns.com", "猫云融合 CDN", "https://www.maoyun.com/"},
+ {"xgslb.net", "WebLuker (蓝汛)", "http://www.webluker.com"},
+ {"ucloud.cn", "UCloud CDN", "https://www.ucloud.cn/site/product/ucdn.html"},
+ {"ucloud.com.cn", "UCloud CDN", "https://www.ucloud.cn/site/product/ucdn.html"},
+ {"cdndo.com", "UCloud CDN", "https://www.ucloud.cn/site/product/ucdn.html"},
+ {"zenlogic.net", "Zenlayer CDN", "https://www.zenlayer.com"},
+ {"ogslb.com", "Zenlayer CDN", "https://www.zenlayer.com"},
+ {"uxengine.net", "Zenlayer CDN", "https://www.zenlayer.com"},
+ {"tan14.net", "TAN14 CDN", "http://www.tan14.cn/"},
+ {"verycloud.cn", "VeryCloud 云分发", "https://www.verycloud.cn/"},
+ {"verycdn.net", "VeryCloud 云分发", "https://www.verycloud.cn/"},
+ {"verygslb.com", "VeryCloud 云分发", "https://www.verycloud.cn/"},
+ {"xundayun.cn", "SpeedyCloud CDN", "https://www.speedycloud.cn/zh/Products/CDN/CloudDistribution.html"},
+ {"xundayun.com", "SpeedyCloud CDN", "https://www.speedycloud.cn/zh/Products/CDN/CloudDistribution.html"},
+ {"speedycloud.cc", "SpeedyCloud CDN", "https://www.speedycloud.cn/zh/Products/CDN/CloudDistribution.html"},
+ {"mucdn.net", "Verizon CDN (Edgecast)", "https://www.verizondigitalmedia.com/platform/edgecast-cdn/"},
+ {"nucdn.net", "Verizon CDN (Edgecast)", "https://www.verizondigitalmedia.com/platform/edgecast-cdn/"},
+ {"alphacdn.net", "Verizon CDN (Edgecast)", "https://www.verizondigitalmedia.com/platform/edgecast-cdn/"},
+ {"systemcdn.net", "Verizon CDN (Edgecast)", "https://www.verizondigitalmedia.com/platform/edgecast-cdn/"},
+ {"edgecastcdn.net", "Verizon CDN (Edgecast)", "https://www.verizondigitalmedia.com/platform/edgecast-cdn/"},
+ {"zetacdn.net", "Verizon CDN (Edgecast)", "https://www.verizondigitalmedia.com/platform/edgecast-cdn/"},
+ {"coding.io", "Coding Pages", "https://coding.net/pages"},
+ {"coding.me", "Coding Pages", "https://coding.net/pages"},
+ {"gitlab.io", "GitLab Pages", "https://docs.gitlab.com/ee/user/project/pages/"},
+ {"github.io", "GitHub Pages", "https://pages.github.com/"},
+ {"herokuapp.com", "Heroku SaaS", "https://www.heroku.com"},
+ {"googleapis.com", "Google Cloud Storage", "https://cloud.google.com/storage/"},
+ {"netdna.com", "Stackpath (原 MaxCDN)", "https://www.stackpath.com/maxcdn/"},
+ {"netdna-cdn.com", "Stackpath (原 MaxCDN)", "https://www.stackpath.com/maxcdn/"},
+ {"netdna-ssl.com", "Stackpath (原 MaxCDN)", "https://www.stackpath.com/maxcdn/"},
+ {"cdntip.com", "腾讯云 CDN", "https://cloud.tencent.com/product/cdn-scd"},
+ {"dnsv1.com", "腾讯云 CDN", "https://cloud.tencent.com/product/cdn-scd"},
+ {"tencdns.net", "腾讯云 CDN", "https://cloud.tencent.com/product/cdn-scd"},
+ {"dayugslb.com", "腾讯云大禹 BGP 高防", "https://cloud.tencent.com/product/ddos-advanced"},
+ {"tcdnvod.com", "腾讯云视频 CDN", "https://lab.skk.moe/cdn"},
+ {"tdnsv5.com", "腾讯云 CDN", "https://cloud.tencent.com/product/cdn-scd"},
+ {"ksyuncdn.com", "金山云 CDN", "https://www.ksyun.com/post/product/CDN"},
+ {"ks-cdn.com", "金山云 CDN", "https://www.ksyun.com/post/product/CDN"},
+ {"ksyuncdn-k1.com", "金山云 CDN", "https://www.ksyun.com/post/product/CDN"},
+ {"netlify.com", "Netlify", "https://www.netlify.com"},
+ {"zeit.co", "ZEIT Now Smart CDN", "https://zeit.co"},
+ {"zeit-cdn.net", "ZEIT Now Smart CDN", "https://zeit.co"},
+ {"b-cdn.net", "Bunny CDN", "https://bunnycdn.com/"},
+ {"lsycdn.com", "蓝视云 CDN", "https://cloud.lsy.cn/"},
+ {"scsdns.com", "逸云科技云加速 CDN", "http://www.exclouds.com/navPage/wise"},
+ {"quic.cloud", "QUIC.Cloud", "https://quic.cloud/"},
+ {"flexbalancer.net", "FlexBalancer - Smart Traffic Routing", "https://perfops.net/flexbalancer"},
+ {"gcdn.co", "G - Core Labs", "https://gcorelabs.com/cdn/"},
+ {"sangfordns.com", "深信服 AD 系列应用交付产品 单边加速解决方案", "http://www.sangfor.com.cn/topic/2011adn/solutions5.html"},
+ {"stspg-customer.com", "StatusPage.io", "https://www.statuspage.io"},
+ {"turbobytes.net", "TurboBytes Multi-CDN", "https://www.turbobytes.com"},
+ {"turbobytes-cdn.com", "TurboBytes Multi-CDN", "https://www.turbobytes.com"},
+ {"att-dsa.net", "AT&T Content Delivery Network", "https://www.business.att.com/products/cdn.html"},
+ {"azioncdn.net", "Azion Tech | Edge Computing PLatform", "https://www.azion.com"},
+ {"belugacdn.com", "BelugaCDN", "https://www.belugacdn.com"},
+ {"cachefly.net", "CacheFly CDN", "https://www.cachefly.com/"},
+ {"inscname.net", "Instart CDN", "https://www.instart.com/products/web-performance/cdn"},
+ {"insnw.net", "Instart CDN", "https://www.instart.com/products/web-performance/cdn"},
+ {"internapcdn.net", "Internap CDN", "https://www.inap.com/network/content-delivery-network"},
+ {"footprint.net", "CenturyLink CDN (原 Level 3)", "https://www.centurylink.com/business/networking/cdn.html"},
+ {"llnwi.net", "Limelight Network", "https://www.limelight.com"},
+ {"llnwd.net", "Limelight Network", "https://www.limelight.com"},
+ {"unud.net", "Limelight Network", "https://www.limelight.com"},
+ {"lldns.net", "Limelight Network", "https://www.limelight.com"},
+ {"stackpathdns.com", "Stackpath CDN", "https://www.stackpath.com"},
+ {"stackpathcdn.com", "Stackpath CDN", "https://www.stackpath.com"},
+ {"mncdn.com", "Medianova", "https://www.medianova.com"},
+ {"rncdn1.com", "Relected Networks", "https://reflected.net/globalcdn"},
+ {"simplecdn.net", "Relected Networks", "https://reflected.net/globalcdn"},
+ {"swiftserve.com", "Conversant - SwiftServe CDN", "https://reflected.net/globalcdn"},
+ {"bitgravity.com", "Tata communications CDN", "https://cdn.tatacommunications.com"},
+ {"zenedge.net", "Oracle Dyn Web Application Security suite (原 Zenedge CDN)", "https://cdn.tatacommunications.com"},
+ {"biliapi.com", "Bilibili 业务 GSLB", "https://lab.skk.moe/cdn"},
+ {"hdslb.net", "Bilibili 高可用负载均衡", "https://github.com/bilibili/overlord"},
+ {"hdslb.com", "Bilibili 高可用地域负载均衡", "https://github.com/bilibili/overlord"},
+ {"xwaf.cn", "极御云安全（浙江壹云云计算有限公司）", "https://www.stopddos.cn"},
+ {"shifen.com", "百度旗下业务地域负载均衡系统", "https://lab.skk.moe/cdn"},
+ {"sinajs.cn", "新浪静态域名", "https://lab.skk.moe/cdn"},
+ {"tencent-cloud.net", "腾讯旗下业务地域负载均衡系统", "https://lab.skk.moe/cdn"},
+ {"elemecdn.com", "饿了么静态域名与地域负载均衡", "https://lab.skk.moe/cdn"},
+ {"sinaedge.com", "新浪科技融合CDN负载均衡", "https://lab.skk.moe/cdn"},
+ {"sina.com.cn", "新浪科技融合CDN负载均衡", "https://lab.skk.moe/cdn"},
+ {"sinacdn.com", "新浪云 CDN", "https://www.sinacloud.com/doc/sae/php/cdn.html"},
+ {"sinasws.com", "新浪云 CDN", "https://www.sinacloud.com/doc/sae/php/cdn.html"},
+ {"saebbs.com", "新浪云 SAE 云引擎", "https://www.sinacloud.com/doc/sae/php/cdn.html"},
+ {"websitecname.cn", "美橙互联旗下建站之星", "https://www.sitestar.cn"},
+ {"cdncenter.cn", "美橙互联CDN", "https://www.cndns.com"},
+ {"vhostgo.com", "西部数码虚拟主机", "https://www.west.cn"},
+ {"jsd.cc", "上海云盾YUNDUN", "https://www.yundun.com"},
+ {"powercdn.cn", "动力在线CDN", "http://www.powercdn.com"},
+ {"21vokglb.cn", "世纪互联云快线业务", "https://www.21vianet.com"},
+ {"21vianet.com.cn", "世纪互联云快线业务", "https://www.21vianet.com"},
+ {"21okglb.cn", "世纪互联云快线业务", "https://www.21vianet.com"},
+ {"21speedcdn.com", "世纪互联云快线业务", "https://www.21vianet.com"},
+ {"21cvcdn.com", "世纪互联云快线业务", "https://www.21vianet.com"},
+ {"okcdn.com", "世纪互联云快线业务", "https://www.21vianet.com"},
+ {"okglb.com", "世纪互联云快线业务", "https://www.21vianet.com"},
+ {"cdnetworks.net", "北京同兴万点网络技术", "http://www.txnetworks.cn/"},
+ {"txnetworks.cn", "北京同兴万点网络技术", "http://www.txnetworks.cn/"},
+ {"cdnnetworks.com", "北京同兴万点网络技术", "http://www.txnetworks.cn/"},
+ {"txcdn.cn", "北京同兴万点网络技术", "http://www.txnetworks.cn/"},
+ {"cdnunion.net", "宝腾互联旗下上海万根网络（CDN 联盟）", "http://www.cdnunion.com"},
+ {"cdnunion.com", "宝腾互联旗下上海万根网络（CDN 联盟）", "http://www.cdnunion.com"},
+ {"mygslb.com", "宝腾互联旗下上海万根网络（YaoCDN）", "http://www.vangen.cn"},
+ {"cdnudns.com", "宝腾互联旗下上海万根网络（YaoCDN）", "http://www.vangen.cn"},
+ {"sprycdn.com", "宝腾互联旗下上海万根网络（YaoCDN）", "http://www.vangen.cn"},
+ {"chuangcdn.com", "创世云融合 CDN", "https://www.chuangcache.com/index.html"},
+ {"aocde.com", "创世云融合 CDN", "https://www.chuangcache.com"},
+ {"ctxcdn.cn", "中国电信天翼云CDN", "https://www.ctyun.cn/product2/#/product/10027560"},
+ {"yfcdn.net", "云帆加速CDN", "https://www.yfcloud.com"},
+ {"mmycdn.cn", "蛮蛮云 CDN（中联利信）", "https://www.chinamaincloud.com/cloudDispatch.html"},
+ {"chinamaincloud.com", "蛮蛮云 CDN（中联利信）", "https://www.chinamaincloud.com/cloudDispatch.html"},
+ {"cnispgroup.com", "中联数据（中联利信）", "http://www.cnispgroup.com/"},
+ {"cdnle.com", "新乐视云联（原乐视云）CDN", "http://www.lecloud.com/zh-cn"},
+ {"gosuncdn.com", "高升控股CDN技术", "http://www.gosun.com"},
+ {"mmtrixopt.com", "mmTrix性能魔方（高升控股旗下）", "http://www.mmtrix.com"},
+ {"cloudfence.cn", "蓝盾云CDN", "https://www.cloudfence.cn/#/cloudWeb/yaq/yaqyfx"},
+ {"ngaagslb.cn", "新流云（新流万联）", "https://www.ngaa.com.cn"},
+ {"p2cdn.com", "星域云P2P CDN", "https://www.xycloud.com"},
+ {"00cdn.com", "星域云P2P CDN", "https://www.xycloud.com"},
+ {"sankuai.com", "美团云（三快科技）负载均衡", "https://www.mtyun.com"},
+ {"lccdn.org", "领智云 CDN（杭州领智云画）", "http://www.linkingcloud.com"},
+ {"nscloudwaf.com", "绿盟云 WAF", "https://cloud.nsfocus.com"},
+ {"2cname.com", "网堤安全", "https://www.ddos.com"},
+ {"ucloudgda.com", "UCloud 罗马 Rome 全球网络加速", "https://www.ucloud.cn/site/product/rome.html"},
+ {"google.com", "Google Web 业务", "https://lab.skk.moe/cdn"},
+ {"1e100.net", "Google Web 业务", "https://lab.skk.moe/cdn"},
+ {"ncname.com", "NodeCache", "https://www.nodecache.com"},
+ {"alipaydns.com", "蚂蚁金服旗下业务地域负载均衡系统", "https://lab.skk.moe/cdn/"},
+ {"wscloudcdn.com", "全速云（网宿）CloudEdge 云加速", "https://www.quansucloud.com/product.action?product.id=270"},
+}
diff --git a/core/fofa/fofa.go b/core/fofa/fofa.go
new file mode 100644
index 0000000..c391197
--- /dev/null
+++ b/core/fofa/fofa.go
@@ -0,0 +1,118 @@
+package fofa
+
+import (
+ "KscanPro/app"
+ "KscanPro/core/slog"
+ "KscanPro/lib/color"
+ "KscanPro/lib/fofa"
+ "KscanPro/lib/misc"
+ "fmt"
+ "regexp"
+ "strconv"
+ "strings"
+)
+
+var this *fofa.Client
+var keywordSlice []string
+var results []fofa.Result
+
+func Init(email, key string) {
+ //设置日志输出器
+ fofa.SetLogger(slog.Debug())
+ //初始化fofa模块
+ this = fofa.New(email, key)
+ this.SetSize(app.Setting.FofaSize)
+ //获取所有关键字
+ keywordSlice = makeKeywordSlice()
+}
+
+func Run() {
+ //对每个关键字进行查询
+ for _, keyword := range keywordSlice {
+ slog.Printf(slog.WARN, "本次搜索关键字为：%v", keyword)
+ size, r := this.Search(keyword)
+ displayResponse(r)
+ slog.Printf(slog.INFO, "本次搜索，返回结果总条数为：%d，此次返回条数为：%d", size, len(r))
+ results = append(results, r...)
+ }
+}
+
+func makeKeywordSlice() []string {
+ var keywordSlice []string
+ if app.Setting.FofaFixKeyword == "" {
+ keywordSlice = app.Setting.Fofa
+ } else {
+ for _, keyword := range app.Setting.Fofa {
+ keyword = strings.ReplaceAll(app.Setting.FofaFixKeyword, "{}", keyword)
+ keywordSlice = append(keywordSlice, keyword)
+ }
+ }
+ return keywordSlice
+}
+
+func GetUrlTarget() []string {
+ var strSlice []string
+ for _, r := range results {
+ Fix(&r)
+ strSlice = append(strSlice, r.Host)
+ }
+ strSlice = misc.RemoveDuplicateElement(strSlice)
+ return strSlice
+}
+
+func GetHostTarget() []string {
+ var strSlice []string
+ for _, r := range results {
+ strSlice = append(strSlice, r.Ip)
+ }
+ strSlice = misc.RemoveDuplicateElement(strSlice)
+ return strSlice
+}
+
+func displayResponse(r []fofa.Result) {
+ for _, row := range r {
+ Fix(&row)
+ m := row.Map()
+ m["Header"] = ""
+ m["Cert"] = ""
+ m["Title"] = row.Title
+ m["Host"] = ""
+ m["As_organization"] = ""
+ if m["Domain"] == "" {
+ m["Ip"] = ""
+ }
+ m["Port"] = ""
+ m["Country_name"] = ""
+ m = misc.FixMap(m)
+ if m["Banner"] != "" {
+ m["Banner"] = misc.FixLine(m["Banner"])
+ m["Banner"] = misc.StrRandomCut(m["Banner"], 20)
+ }
+
+ line := fmt.Sprintf("%-30v %-"+strconv.Itoa(misc.AutoWidth(row.Title, 26))+"v %v",
+ row.Host,
+ row.Title,
+ color.StrMapRandomColor(m, app.Setting.CloseColor, []string{"Server"}, []string{}),
+ )
+ slog.Println(slog.DATA, line)
+ }
+}
+
+func Fix(r *fofa.Result) {
+ //修复title
+ if r.Title == "" && r.Protocol != "" {
+ r.Title = strings.ToUpper(r.Protocol)
+ }
+ r.Title = misc.FixLine(r.Title)
+ //修改host
+ if r.Host == "" {
+ r.Host = r.Ip
+ }
+
+ if regexp.MustCompile("\\w+://.*").MatchString(r.Host) == false {
+ if r.Host == "" {
+ r.Protocol = "http"
+ }
+ r.Host = r.Protocol + "://" + r.Host
+ }
+}
diff --git a/core/fofa/fofa_test.go b/core/fofa/fofa_test.go
new file mode 100644
index 0000000..d2f6dce
--- /dev/null
+++ b/core/fofa/fofa_test.go
@@ -0,0 +1 @@
+package fofa
diff --git a/core/hydra/cracker.go b/core/hydra/cracker.go
new file mode 100644
index 0000000..c04c117
--- /dev/null
+++ b/core/hydra/cracker.go
@@ -0,0 +1,102 @@
+package hydra
+
+import (
+ "KscanPro/core/hydra/ftp"
+ "KscanPro/core/hydra/mongodb"
+ "KscanPro/core/hydra/mssql"
+ "KscanPro/core/hydra/mysql"
+ "KscanPro/core/hydra/oracle"
+ "KscanPro/core/hydra/postgresql"
+ "KscanPro/core/hydra/rdp"
+ "KscanPro/core/hydra/redis"
+ "KscanPro/core/hydra/smb"
+ "KscanPro/core/hydra/ssh"
+ "KscanPro/core/hydra/telnet"
+ "KscanPro/core/hydra/web"
+ "KscanPro/lib/gotelnet"
+ "KscanPro/lib/grdp"
+ "fmt"
+)
+
+func rdpCracker(IPAddr string, port int) func(interface{}) error {
+ target := fmt.Sprintf("%s:%d", IPAddr, port)
+ protocol := grdp.VerifyProtocol(target)
+ //slog.Println(slog.DEBUG, "rdp protocol is :", protocol)
+ return func(i interface{}) error {
+ info := i.(AuthInfo)
+ domain := ""
+ return rdp.Check(info.IPAddr, domain, info.Auth.Username, info.Auth.Password, info.Port, protocol)
+ }
+}
+
+func smbCracker(i interface{}) error {
+ info := i.(AuthInfo)
+ domain := ""
+ return smb.Check(info.IPAddr, domain, info.Auth.Username, info.Auth.Password, info.Port)
+}
+
+func webCracker(i interface{}) error {
+ info := i.(AuthInfo)
+ domain := ""
+ return web.Check(info.IPAddr, domain, info.Auth.Username, info.Auth.Password, info.Port)
+}
+
+func sshCracker(i interface{}) error {
+ info := i.(AuthInfo)
+ return ssh.Check(info.IPAddr, info.Auth.Username, info.Auth.Password, info.Port)
+}
+
+func telnetCracker(serverType int) func(interface{}) error {
+ return func(i interface{}) error {
+ info := i.(AuthInfo)
+ return telnet.Check(info.IPAddr, info.Auth.Username, info.Auth.Password, info.Port, serverType)
+ }
+}
+
+func getTelnetServerType(ip string, port int) int {
+ client := gotelnet.New(ip, port)
+ err := client.Connect()
+ if err != nil {
+ return gotelnet.Closed
+ }
+ defer client.Close()
+ return client.MakeServerType()
+}
+
+func mysqlCracker(i interface{}) error {
+ info := i.(AuthInfo)
+ return mysql.Check(info.IPAddr, info.Auth.Username, info.Auth.Password, info.Port)
+}
+
+func mssqlCracker(i interface{}) error {
+ info := i.(AuthInfo)
+ return mssql.Check(info.IPAddr, info.Auth.Username, info.Auth.Password, info.Port)
+}
+
+func redisCracker(i interface{}) error {
+ info := i.(AuthInfo)
+ return redis.Check(info.IPAddr, info.Auth.Password, info.Port)
+}
+
+func ftpCracker(i interface{}) error {
+ info := i.(AuthInfo)
+ return ftp.Check(info.IPAddr, info.Auth.Username, info.Auth.Password, info.Port)
+}
+
+func postgresqlCracker(i interface{}) error {
+ info := i.(AuthInfo)
+ return postgresql.Check(info.IPAddr, info.Auth.Username, info.Auth.Password, info.Port)
+}
+
+func oracleCracker(sid string) func(interface{}) error {
+ return func(i interface{}) error {
+ info := i.(AuthInfo)
+ info.Auth.Other["SID"] = sid
+ return oracle.Check(info.IPAddr, info.Auth.Username, info.Auth.Password, info.Port, sid)
+ }
+}
+
+func mongodbCracker(i interface{}) error {
+ info := i.(AuthInfo)
+ return mongodb.Check(info.IPAddr, info.Auth.Username, info.Auth.Password, info.Port)
+}
diff --git a/core/hydra/default_ftp_authlist.go b/core/hydra/default_ftp_authlist.go
new file mode 100644
index 0000000..b50065c
--- /dev/null
+++ b/core/hydra/default_ftp_authlist.go
@@ -0,0 +1,85 @@
+package hydra
+
+func DefaultFtpList() *AuthList {
+ a := NewAuthList()
+ a.Username = []string{
+ "anonymous",
+ "ftp",
+ "test",
+ "web",
+ //"admin",
+ //"test",
+ //"user",
+ //"root",
+ //"manager",
+ //"webadmin",
+ }
+ a.Password = []string{
+ "",
+ "123456",
+ "zaq1@WSX",
+ "%user%",
+ "%user%123",
+ "%user%1234",
+ "%user%123456",
+ "%user%12345",
+ "%user%@123",
+ "%user%@123456",
+ "%user%@12345",
+ "%user%#123",
+ "%user%#123456",
+ "%user%#12345",
+ "%user%_123",
+ "%user%_123456",
+ "%user%_12345",
+ "%user%123!@#",
+ "%user%!@#$",
+ "%user%!@#",
+ "%user%~!@",
+ "%user%!@#123",
+ "%user%2022",
+ "%user%2021",
+ "%user%2020",
+ "%user%2019",
+ "%user%2018",
+ "%user%2017",
+ "%user%2016",
+ "%user%2015",
+ "%user%@2017",
+ "%user%@2016",
+ "%user%@2015",
+ "qweasdzxc",
+ "Passw0rd",
+ "password",
+ "12345",
+ "1234",
+ "123",
+ "qwerty",
+ "1q2w3e4r",
+ "1qaz2wsx",
+ "qazwsx",
+ "123qwe",
+ "123qaz",
+ "0000",
+ "1234567",
+ "123456qwerty",
+ "password123",
+ "12345678",
+ "1q2w3e",
+ "abc123",
+ "test123",
+ "123456789",
+ "q1w2e3r4",
+ //"okmnji",
+ //"postgres",
+ //"test",
+ //"user",
+ }
+ a.Special = []Auth{
+ NewSpecialAuth("anonymous", "anonymous"),
+ NewSpecialAuth("ftp", "ftp"),
+ NewSpecialAuth("admin", "admin"),
+ NewSpecialAuth("admin", "123456"),
+ }
+ return a
+}
diff --git a/core/hydra/default_mssql_authlist.go b/core/hydra/default_mssql_authlist.go
new file mode 100644
index 0000000..db879ec
--- /dev/null
+++ b/core/hydra/default_mssql_authlist.go
@@ -0,0 +1,80 @@
+package hydra
+
+func DefaultMssqlList() *AuthList {
+ a := NewAuthList()
+ a.Username = []string{
+ "sa",
+ //"admin",
+ //"test",
+ //"user",
+ //"root",
+ //"manager",
+ //"webadmin",
+ }
+ a.Password = []string{
+ "",
+ "123456",
+ "zaq1@WSX",
+ "%user%",
+ "%user%123",
+ "%user%1234",
+ "%user%123456",
+ "%user%12345",
+ "%user%@123",
+ "%user%@123456",
+ "%user%@12345",
+ "%user%#123",
+ "%user%#123456",
+ "%user%#12345",
+ "%user%_123",
+ "%user%_123456",
+ "%user%_12345",
+ "%user%123!@#",
+ "%user%!@#$",
+ "%user%!@#",
+ "%user%~!@",
+ "%user%!@#123",
+ "%user%2022",
+ "%user%2021",
+ "%user%2020",
+ "%user%2019",
+ "%user%2018",
+ "%user%2017",
+ "%user%2016",
+ "%user%2015",
+ "%user%@2017",
+ "%user%@2016",
+ "%user%@2015",
+ "qweasdzxc",
+ "Passw0rd",
+ "password",
+ "12345",
+ "1234",
+ "123",
+ "qwerty",
+ "1q2w3e4r",
+ "1qaz2wsx",
+ "qazwsx",
+ "123qwe",
+ "123qaz",
+ "0000",
+ "1234567",
+ "123456qwerty",
+ "password123",
+ "12345678",
+ "1q2w3e",
+ "abc123",
+ "test123",
+ "123456789",
+ "q1w2e3r4",
+ //"okmnji",
+ //"postgres",
+ //"test",
+ //"user",
+ }
+ a.Special = []Auth{
+ NewSpecialAuth("test", "test"),
+ NewSpecialAuth("test", "123456"),
+ }
+ return a
+}
diff --git a/core/hydra/default_mysql_authlist.go b/core/hydra/default_mysql_authlist.go
new file mode 100644
index 0000000..dd89e32
--- /dev/null
+++ b/core/hydra/default_mysql_authlist.go
@@ -0,0 +1,80 @@
+package hydra
+
+func DefaultMysqlList() *AuthList {
+ a := NewAuthList()
+ a.Username = []string{
+ "root",
+ //"admin",
+ //"test",
+ //"user",
+ //"root",
+ //"manager",
+ //"webadmin",
+ }
+ a.Password = []string{
+ "",
+ "123456",
+ "zaq1@WSX",
+ "%user%",
+ "%user%123",
+ "%user%1234",
+ "%user%123456",
+ "%user%12345",
+ "%user%@123",
+ "%user%@123456",
+ "%user%@12345",
+ "%user%#123",
+ "%user%#123456",
+ "%user%#12345",
+ "%user%_123",
+ "%user%_123456",
+ "%user%_12345",
+ "%user%123!@#",
+ "%user%!@#$",
+ "%user%!@#",
+ "%user%~!@",
+ "%user%!@#123",
+ "%user%2022",
+ "%user%2021",
+ "%user%2020",
+ "%user%2019",
+ "%user%2018",
+ "%user%2017",
+ "%user%2016",
+ "%user%2015",
+ "%user%@2017",
+ "%user%@2016",
+ "%user%@2015",
+ "qweasdzxc",
+ "Passw0rd",
+ "password",
+ "12345",
+ "1234",
+ "123",
+ "qwerty",
+ "1q2w3e4r",
+ "1qaz2wsx",
+ "qazwsx",
+ "123qwe",
+ "123qaz",
+ "0000",
+ "1234567",
+ "123456qwerty",
+ "password123",
+ "12345678",
+ "1q2w3e",
+ "abc123",
+ "test123",
+ "123456789",
+ "q1w2e3r4",
+ //"okmnji",
+ //"postgres",
+ //"test",
+ //"user",
+ }
+ a.Special = []Auth{
+ NewSpecialAuth("test", "test"),
+ NewSpecialAuth("test", "123456"),
+ }
+ return a
+}
diff --git a/core/hydra/default_oracle_authlist.go b/core/hydra/default_oracle_authlist.go
new file mode 100644
index 0000000..4e17da8
--- /dev/null
+++ b/core/hydra/default_oracle_authlist.go
@@ -0,0 +1,51 @@
+package hydra
+
+func DefaultOracleList() *AuthList {
+ a := NewAuthList()
+ a.Username = []string{
+ "sys",
+ "system",
+ "admin",
+ "test",
+ "web",
+ "orcl",
+ }
+ a.Password = []string{
+ "123456",
+ "abc123",
+ "okmnji",
+ }
+ a.Special = []Auth{
+ NewSpecialAuth("internal", "oracle"),
+ NewSpecialAuth("system", "manager"),
+ NewSpecialAuth("system", "oracle"),
+ NewSpecialAuth("sys", "change_on_install"),
+ NewSpecialAuth("SYS", "CHANGE_ON_INSTALLorINTERNAL"),
+ NewSpecialAuth("SYSTEM", "MANAGER"),
+ NewSpecialAuth("OUTLN", "OUTLN"),
+ NewSpecialAuth("SCOTT", "TIGER"),
+ NewSpecialAuth("ADAMS", "WOOD"),
+ NewSpecialAuth("JONES", "STEEL"),
+ NewSpecialAuth("CLARK", "CLOTH"),
+ NewSpecialAuth("BLAKE", "PAPER."),
+ NewSpecialAuth("HR", "HR"),
+ NewSpecialAuth("OE", "OE"),
+ NewSpecialAuth("SH", "SH"),
+ NewSpecialAuth("DBSNMP", "DBSNMP"),
+ NewSpecialAuth("sysman", "oem_temp"),
+ NewSpecialAuth("aqadm", "aqadm"),
+ NewSpecialAuth("ANONYMOUS", "ANONYMOUS"),
+ NewSpecialAuth("CTXSYS", "CTXSYS"),
+ NewSpecialAuth("DIP", "DIP"),
+ NewSpecialAuth("DMSYS", "DMSYS"),
+ NewSpecialAuth("EXFSYS", "EXFSYS"),
+ NewSpecialAuth("MDDATA", "MDDATA"),
+ NewSpecialAuth("MDSYS", "MDSYS"),
+ NewSpecialAuth("MGMT_VIEW", "MGMT_VIEW"),
+ NewSpecialAuth("OLAPSYS", "MANAGER"),
+ NewSpecialAuth("ORDPLUGINS", "ORDPLUGINS"),
+ NewSpecialAuth("ORDSYS", "ORDSYS"),
+ NewSpecialAuth("WK_TEST", "WK_TEXT"),
+ }
+ return a
+}
diff --git a/core/hydra/default_postgresql_authlist.go b/core/hydra/default_postgresql_authlist.go
new file mode 100644
index 0000000..e009a37
--- /dev/null
+++ b/core/hydra/default_postgresql_authlist.go
@@ -0,0 +1,83 @@
+package hydra
+
+func DefaultPostgresqlList() *AuthList {
+ a := NewAuthList()
+ a.Username = []string{
+ "postgres",
+ "test",
+ //"user",
+ //"root",
+ //"manager",
+ //"webadmin",
+ }
+ a.Password = []string{
+ "",
+ "1",
+ "123456",
+ "zaq1@WSX",
+ "%user%",
+ "%user%123",
+ "%user%1234",
+ "%user%123456",
+ "%user%12345",
+ "%user%@123",
+ "%user%@123456",
+ "%user%@12345",
+ "%user%#123",
+ "%user%#123456",
+ "%user%#12345",
+ "%user%_123",
+ "%user%_123456",
+ "%user%_12345",
+ "%user%123!@#",
+ "%user%!@#$",
+ "%user%!@#",
+ "%user%~!@",
+ "%user%!@#123",
+ "%user%2022",
+ "%user%2021",
+ "%user%2020",
+ "%user%2019",
+ "%user%2018",
+ "%user%2017",
+ "%user%2016",
+ "%user%2015",
+ "%user%@2017",
+ "%user%@2016",
+ "%user%@2015",
+ "qweasdzxc",
+ "Passw0rd",
+ "admin123!@#",
+ "admin",
+ "admin123",
+ "admin@123",
+ "admin#123",
+ "password",
+ "12345",
+ "1234",
+ "123",
+ "qwerty",
+ "1q2w3e4r",
+ "1qaz2wsx",
+ "qazwsx",
+ "123qwe",
+ "123qaz",
+ "1234567",
+ "123456qwerty",
+ "password123",
+ "12345678",
+ "1q2w3e",
+ "abc123",
+ "test123",
+ "123456789",
+ "q1w2e3r4",
+ //"0000",
+ //"root",
+ //"test",
+ //"okmnji",
+ //"postgres",
+ //"user",
+ }
+ a.Special = []Auth{}
+ return a
+}
diff --git a/core/hydra/default_rdp_authlist.go b/core/hydra/default_rdp_authlist.go
new file mode 100644
index 0000000..79e777e
--- /dev/null
+++ b/core/hydra/default_rdp_authlist.go
@@ -0,0 +1,88 @@
+package hydra
+
+func DefaultRdpList() *AuthList {
+ a := NewAuthList()
+ a.Username = []string{
+ "administrator",
+ "admin",
+ "test",
+ //"user",
+ //"root",
+ //"manager",
+ //"webadmin",
+ }
+ a.Password = []string{
+ "1",
+ "123456",
+ "zaq1@WSX",
+ "%user%",
+ "%user%123",
+ "%user%1234",
+ "%user%123456",
+ "%user%12345",
+ "%user%@123",
+ "%user%@123456",
+ "%user%@12345",
+ "%user%#123",
+ "%user%#123456",
+ "%user%#12345",
+ "%user%_123",
+ "%user%_123456",
+ "%user%_12345",
+ "%user%123!@#",
+ "%user%!@#$",
+ "%user%!@#",
+ "%user%~!@",
+ "%user%!@#123",
+ "qweasdzxc",
+ "%user%2022",
+ "%user%2021",
+ "%user%2020",
+ "%user%2019",
+ "%user%2018",
+ "%user%2017",
+ "%user%2016",
+ "%user%2015",
+ "%user%@2017",
+ "%user%@2016",
+ "%user%@2015",
+ "Passw0rd",
+ "admin123!@#",
+ "admin",
+ "admin123",
+ "admin@123",
+ "admin#123",
+ "password",
+ "12345",
+ "1234",
+ //"root",
+ "123",
+ "qwerty",
+ //"test",
+ "1q2w3e4r",
+ "1qaz2wsx",
+ "qazwsx",
+ "123qwe",
+ "123qaz",
+ "0000",
+ "1234567",
+ "123456qwerty",
+ "password123",
+ "12345678",
+ "1q2w3e",
+ "abc123",
+ "test123",
+ "123456789",
+ "q1w2e3r4",
+ //"user",
+ //"okmnji",
+ //"postgres",
+
+ }
+ a.Special = []Auth{
+ NewSpecialAuth("guest", "guest"),
+ NewSpecialAuth("guest", "123456"),
+ NewSpecialAuth("db2admin", "db2admin"),
+ }
+ return a
+}
diff --git a/core/hydra/default_redis_authlist.go b/core/hydra/default_redis_authlist.go
new file mode 100644
index 0000000..6ed69b0
--- /dev/null
+++ b/core/hydra/default_redis_authlist.go
@@ -0,0 +1,43 @@
+package hydra
+
+func DefaultRedisList() *AuthList {
+ a := NewAuthList()
+ a.Username = []string{
+ "",
+ //"admin",
+ //"test",
+ //"user",
+ //"root",
+ //"manager",
+ //"webadmin",
+ }
+ a.Password = []string{
+ "redis",
+ "123456",
+ "zaq1@WSX",
+ "qweasdzxc",
+ "Passw0rd",
+ "password",
+ "12345",
+ "1234",
+ "123",
+ "qwerty",
+ "1q2w3e4r",
+ "1qaz2wsx",
+ "qazwsx",
+ "123qwe",
+ "123qaz",
+ "0000",
+ "1234567",
+ "123456qwerty",
+ "password123",
+ "12345678",
+ "1q2w3e",
+ "abc123",
+ "test123",
+ "123456789",
+ "q1w2e3r4",
+ }
+ a.Special = []Auth{}
+ return a
+}
diff --git a/core/hydra/default_smb_authlist.go b/core/hydra/default_smb_authlist.go
new file mode 100644
index 0000000..7a6ade8
--- /dev/null
+++ b/core/hydra/default_smb_authlist.go
@@ -0,0 +1,89 @@
+package hydra
+
+func DefaultSmbList() *AuthList {
+ a := NewAuthList()
+ a.Username = []string{
+ "administrator",
+ "admin",
+ "test",
+ //"user",
+ //"root",
+ //"manager",
+ //"webadmin",
+ }
+ a.Password = []string{
+ "1",
+ "123456",
+ "zaq1@WSX",
+ "%user%",
+ "%user%123",
+ "%user%1234",
+ "%user%123456",
+ "%user%12345",
+ "%user%@123",
+ "%user%@123456",
+ "%user%@12345",
+ "%user%#123",
+ "%user%#123456",
+ "%user%#12345",
+ "%user%_123",
+ "%user%_123456",
+ "%user%_12345",
+ "%user%123!@#",
+ "%user%!@#$",
+ "%user%!@#",
+ "%user%~!@",
+ "%user%!@#123",
+ "qweasdzxc",
+ "%user%2022",
+ "%user%2021",
+ "%user%2020",
+ "%user%2019",
+ "%user%2018",
+ "%user%2017",
+ "%user%2016",
+ "%user%2015",
+ "%user%@2017",
+ "%user%@2016",
+ "%user%@2015",
+ "Passw0rd",
+ "admin123!@#",
+ "admin",
+ "admin123",
+ "admin@123",
+ "admin#123",
+ "password",
+ "12345",
+ "1234",
+ //"root",
+ "123",
+ "qwerty",
+ //"test",
+ "1q2w3e4r",
+ "1qaz2wsx",
+ "qazwsx",
+ "123qwe",
+ "123qaz",
+ "0000",
+ "1234567",
+ "123456qwerty",
+ "password123",
+ "12345678",
+ "1q2w3e",
+ "abc123",
+ //"okmnji",
+ "test123",
+ "123456789",
+ //"postgres",
+ "q1w2e3r4",
+ //"user",
+ }
+ a.Special = []Auth{
+ NewSpecialAuth("guest", "guest"),
+ NewSpecialAuth("guest", "123456"),
+ //NewSpecialAuth("db2admin", "db2admin"),
+ //NewSpecialAuth("oracle", "oracle"),
+ //NewSpecialAuth("mysql", "mysql"),
+ }
+ return a
+}
diff --git a/core/hydra/default_ssh_authlist.go b/core/hydra/default_ssh_authlist.go
new file mode 100644
index 0000000..1adb84f
--- /dev/null
+++ b/core/hydra/default_ssh_authlist.go
@@ -0,0 +1,122 @@
+package hydra
+
+func DefaultSshList() *AuthList {
+ a := NewAuthList()
+ a.Username = []string{
+ "root",
+ "admin",
+ //"test",
+ //"user",
+ //"root",
+ //"manager",
+ //"webadmin",
+ }
+ a.Password = []string{
+ "1",
+ "123456",
+ "zaq1@WSX",
+ "%user%",
+ "%user%123",
+ "%user%1234",
+ "%user%123456",
+ "%user%12345",
+ "%user%@123",
+ "%user%@123456",
+ "%user%@12345",
+ "%user%#123",
+ "%user%#123456",
+ "%user%#12345",
+ "%user%_123",
+ "%user%_123456",
+ "%user%_12345",
+ "%user%123!@#",
+ "%user%!@#$",
+ "%user%!@#",
+ "%user%~!@",
+ "%user%!@#123",
+ "%user%2022",
+ "%user%2021",
+ "%user%2020",
+ "%user%2019",
+ "%user%2018",
+ "%user%2017",
+ "%user%2016",
+ "%user%2015",
+ "%user%@2017",
+ "%user%@2016",
+ "%user%@2015",
+ "qweasdzxc",
+ "Passw0rd",
+ "admin123!@#",
+ "admin",
+ "admin123",
+ "admin@123",
+ "admin#123",
+ "password",
+ "12345",
+ "1234",
+ "123",
+ "qwerty",
+ "1q2w3e4r",
+ "1qaz2wsx",
+ "qazwsx",
+ "123qwe",
+ "123qaz",
+ "1234567",
+ "123456qwerty",
+ "password123",
+ "12345678",
+ "1q2w3e",
+ "abc123",
+ "test123",
+ "123456789",
+ "q1w2e3r4",
+ //"0000",
+ //"root",
+ //"test",
+ //"okmnji",
+ //"postgres",
+ //"user",
+ }
+ a.Special = []Auth{
+ NewSpecialAuth("db2admin", "db2admin"),
+ NewSpecialAuth("oracle", "oracle"),
+ NewSpecialAuth("mysql", "mysql"),
+ NewSpecialAuth("postgres", "postgres"),
+ NewSpecialAuth("kali", "kali"),
+ NewSpecialAuth("defaultUsername", "defaultPassword"),
+ NewSpecialAuth("admin", "Admin@huawei"),
+ NewSpecialAuth("admin", "admin@huawei.com"),
+ NewSpecialAuth("admin", "admin"),
+ NewSpecialAuth("admin", "Admin@123"),
+ NewSpecialAuth("admin", "Changeme_123"),
+ NewSpecialAuth("admin", "Admin123"),
+ NewSpecialAuth("admin", "Changeme123"),
+ NewSpecialAuth("admin", "Admin@storage"),
+ NewSpecialAuth("admin", "eSight@123"),
+ NewSpecialAuth("admin", "Cis#BigData123"),
+ NewSpecialAuth("admin", "Huawei@123"),
+ NewSpecialAuth("LogAdmin", "Changeme123"),
+ NewSpecialAuth("SystemAdmin", "Changeme123"),
+ NewSpecialAuth("OperateAdmin", "Changeme123"),
+ NewSpecialAuth("administrator", "Changeme123"),
+ NewSpecialAuth("Administrator", "Admin@9000"),
+ NewSpecialAuth("Administrator", "Changeme@321"),
+ NewSpecialAuth("api-admin", "admin@123"),
+ NewSpecialAuth("root", "admin123"),
+ NewSpecialAuth("root", "mduadmin"),
+ NewSpecialAuth("root", "Changeme_123"),
+ NewSpecialAuth("root", "admin"),
+ NewSpecialAuth("root", "adminHW"),
+ NewSpecialAuth("root", "password"),
+ NewSpecialAuth("root", "Huawei12#$"),
+ NewSpecialAuth("root", "Changeme@321"),
+ NewSpecialAuth("root", "Changeme123"),
+ NewSpecialAuth("sa", "Changeme123"),
+ NewSpecialAuth("db2inst1", "db2inst1"),
+ NewSpecialAuth("db2fenc1", "db2fenc1"),
+ NewSpecialAuth("dasusr1", "dasusr1"),
+ NewSpecialAuth("db2admin", "db2admin"),
+ }
+ return a
+}
diff --git a/core/hydra/default_telnet_authlist.go b/core/hydra/default_telnet_authlist.go
new file mode 100644
index 0000000..6d3dff4
--- /dev/null
+++ b/core/hydra/default_telnet_authlist.go
@@ -0,0 +1,117 @@
+package hydra
+
+func DefaultTelnetList() *AuthList {
+ a := NewAuthList()
+ a.Username = []string{
+ "admin",
+ "root",
+ //"test",
+ //"user",
+ //"root",
+ //"manager",
+ //"webadmin",
+ }
+ a.Password = []string{
+ "1",
+ "123456",
+ //"zaq1@WSX",
+ //"%user%",
+ //"%user%123",
+ //"%user%1234",
+ //"%user%123456",
+ //"%user%12345",
+ //"%user%@123",
+ //"%user%@123456",
+ //"%user%@12345",
+ //"%user%#123",
+ //"%user%#123456",
+ //"%user%#12345",
+ //"%user%_123",
+ //"%user%_123456",
+ //"%user%_12345",
+ //"%user%123!@#",
+ //"%user%!@#$",
+ //"%user%!@#",
+ //"%user%~!@",
+ //"%user%!@#123",
+ //"%user%2022",
+ //"%user%2021",
+ //"%user%2020",
+ //"%user%2019",
+ //"%user%2018",
+ //"%user%2017",
+ //"%user%2016",
+ //"%user%2015",
+ //"%user%@2017",
+ //"%user%@2016",
+ //"%user%@2015",
+ //"qweasdzxc",
+ //"Passw0rd",
+ //"admin123!@#",
+ //"admin",
+ //"admin123",
+ //"admin@123",
+ //"admin#123",
+ //"password",
+ //"12345",
+ //"1234",
+ //"123",
+ //"qwerty",
+ //"1q2w3e4r",
+ //"1qaz2wsx",
+ //"qazwsx",
+ //"123qwe",
+ //"123qaz",
+ //"1234567",
+ //"123456qwerty",
+ //"password123",
+ //"12345678",
+ //"1q2w3e",
+ //"abc123",
+ //"test123",
+ //"123456789",
+ //"q1w2e3r4",
+ //"0000",
+ //"root",
+ //"test",
+ //"okmnji",
+ //"postgres",
+ //"user",
+ }
+ a.Special = []Auth{
+ NewSpecialAuth("admin", "admin"),
+ NewSpecialAuth("oracle", "oracle"),
+ NewSpecialAuth("postgres", "postgres"),
+ NewSpecialAuth("db2admin", "db2admin"),
+ NewSpecialAuth("defaultUsername", "defaultPassword"),
+ NewSpecialAuth("admin", "Admin@huawei"),
+ NewSpecialAuth("admin", "admin@huawei.com"),
+ NewSpecialAuth("admin", "admin"),
+ NewSpecialAuth("admin", "Admin@123"),
+ NewSpecialAuth("admin", "Changeme_123"),
+ NewSpecialAuth("admin", "Admin123"),
+ NewSpecialAuth("admin", "Changeme123"),
+ NewSpecialAuth("admin", "Admin@storage"),
+ NewSpecialAuth("admin", "eSight@123"),
+ NewSpecialAuth("admin", "Cis#BigData123"),
+ NewSpecialAuth("admin", "Huawei@123"),
+ NewSpecialAuth("LogAdmin", "Changeme123"),
+ NewSpecialAuth("SystemAdmin", "Changeme123"),
+ NewSpecialAuth("OperateAdmin", "Changeme123"),
+ NewSpecialAuth("administrator", "Changeme123"),
+ NewSpecialAuth("Administrator", "Admin@9000"),
+ NewSpecialAuth("Administrator", "Changeme@321"),
+ NewSpecialAuth("api-admin", "admin@123"),
+ NewSpecialAuth("root", "admin123"),
+ NewSpecialAuth("root", "mduadmin"),
+ NewSpecialAuth("root", "Changeme_123"),
+ NewSpecialAuth("root", "admin"),
+ NewSpecialAuth("root", "adminHW"),
+ NewSpecialAuth("root", "password"),
+ NewSpecialAuth("root", "Huawei12#$"),
+ NewSpecialAuth("root", "Changeme@321"),
+ NewSpecialAuth("root", "Changeme123"),
+ NewSpecialAuth("sa", "Changeme123"),
+ }
+ return a
+}
diff --git a/core/hydra/defuault_mongodb_authlist.go b/core/hydra/defuault_mongodb_authlist.go
new file mode 100644
index 0000000..949974d
--- /dev/null
+++ b/core/hydra/defuault_mongodb_authlist.go
@@ -0,0 +1,88 @@
+package hydra
+
+func DefaultMongodbList() *AuthList {
+ a := NewAuthList()
+ a.Username = []string{
+ "admin",
+ "test",
+ //"user",
+ //"root",
+ //"manager",
+ //"webadmin",
+ }
+ a.Password = []string{
+ "",
+ "1",
+ "123456",
+ "zaq1@WSX",
+ "%user%",
+ "%user%123",
+ "abc123",
+ //"%user%1234",
+ //"%user%123456",
+ //"%user%12345",
+ //"%user%@123",
+ //"%user%@123456",
+ //"%user%@12345",
+ //"%user%#123",
+ //"%user%#123456",
+ //"%user%#12345",
+ //"%user%_123",
+ //"%user%_123456",
+ //"%user%_12345",
+ //"%user%123!@#",
+ //"%user%!@#$",
+ //"%user%!@#",
+ //"%user%~!@",
+ //"%user%!@#123",
+ //"%user%2022",
+ //"%user%2021",
+ //"%user%2020",
+ //"%user%2019",
+ //"%user%2018",
+ //"%user%2017",
+ //"%user%2016",
+ //"%user%2015",
+ //"%user%@2017",
+ //"%user%@2016",
+ //"%user%@2015",
+ //"qweasdzxc",
+ //"Passw0rd",
+ //"password",
+ //"12345",
+ //"1234",
+ //"123",
+ //"qwerty",
+ //"1q2w3e4r",
+ //"1qaz2wsx",
+ //"qazwsx",
+ //"123qwe",
+ //"123qaz",
+ //"1234567",
+ //"123456qwerty",
+ //"password123",
+ //"12345678",
+ //"1q2w3e",
+ //"abc123",
+ //"test123",
+ //"123456789",
+ //"q1w2e3r4",
+ //"admin123!@#",
+ //"admin",
+ //"admin123",
+ //"admin@123",
+ //"admin#123",
+ //"0000",
+ //"root",
+ //"test",
+ //"okmnji",
+ //"postgres",
+ //"user",
+ }
+ a.Special = []Auth{
+ NewSpecialAuth("", ""),
+ NewSpecialAuth("simpleUser", "simplePass"),
+ NewSpecialAuth("adminUser", "adminPass"),
+ }
+ return a
+}
diff --git a/core/hydra/ftp/ftp.go b/core/hydra/ftp/ftp.go
new file mode 100644
index 0000000..3b4826b
--- /dev/null
+++ b/core/hydra/ftp/ftp.go
@@ -0,0 +1,20 @@
+package ftp
+
+import (
+ "fmt"
+ "github.com/jlaffaye/ftp"
+ "time"
+)
+
+func Check(Host, Username, Password string, Port int) error {
+ conn, err := ftp.DialTimeout(fmt.Sprintf("%s:%d", Host, Port), 5*time.Second)
+ if err != nil {
+ return err
+ }
+ defer conn.Logout()
+ err = conn.Login(Username, Password)
+ if err != nil {
+ return err
+ }
+ return nil
+}
diff --git a/core/hydra/hydra.go b/core/hydra/hydra.go
new file mode 100644
index 0000000..6c16ded
--- /dev/null
+++ b/core/hydra/hydra.go
@@ -0,0 +1,226 @@
+package hydra
+
+import (
+ "KscanPro/core/hydra/oracle"
+ "KscanPro/lib/gotelnet"
+ "KscanPro/lib/misc"
+ "errors"
+ "github.com/lcvvvv/pool"
+ "strings"
+ "sync/atomic"
+ "time"
+)
+
+type Cracker struct {
+ Pool *pool.Pool
+ authList *AuthList
+ authInfo *AuthInfo
+
+ retries int
+
+ SuccessCount int32
+ SuccessAuth Auth
+}
+
+func init() {
+ InitDefaultAuthMap()
+}
+
+func InitDefaultAuthMap() {
+ m := make(map[string]*AuthList)
+ m["rdp"] = DefaultRdpList()
+ m["ssh"] = DefaultSshList()
+ m["mysql"] = DefaultMysqlList()
+ m["mssql"] = DefaultMssqlList()
+ m["oracle"] = DefaultOracleList()
+ m["postgresql"] = DefaultPostgresqlList()
+ m["redis"] = DefaultRedisList()
+ m["ftp"] = DefaultFtpList()
+ m["mongodb"] = DefaultMongodbList()
+ m["smb"] = DefaultSmbList()
+ m["telnet"] = DefaultTelnetList()
+ DefaultAuthMap = m
+}
+
+type loginType string
+
+const (
+ ProtocolInvalid loginType = "ProtocolInvalid"
+ UsernameAndPassword = "UsernameAndPassword"
+ OnlyPassword = "OnlyPassword"
+ UnauthorizedAccessVulnerability = "UnauthorizedAccessVulnerability"
+)
+
+var (
+ DefaultAuthMap map[string]*AuthList
+ CustomAuthMap *AuthList
+ ProtocolList = []string{
+ "ssh", "rdp", "ftp", "smb", "telnet",
+ "mysql", "mssql", "oracle", "postgresql", "mongodb", "redis", "web",
+ //110: "pop3",
+ //995: "pop3",
+ //25: "smtp",
+ //994: "smtp",
+ //143: "imap",
+ //993: "imap",
+ //389: "ldap",
+ //23: "telnet",
+ //50000: "db2",
+ }
+ LoginFailedErr = errors.New("login failed")
+ ProtocolErr = errors.New("protocol error")
+)
+
+func NewCracker(info *AuthInfo, isAuthUpdate bool, threads int) *Cracker {
+ c := &Cracker{}
+ c.retries = 3
+ c.Pool = pool.New(threads)
+ c.authInfo = info
+ c.authList = func() *AuthList {
+ list := DefaultAuthMap[c.authInfo.Protocol]
+ if isAuthUpdate {
+ list.Merge(CustomAuthMap)
+ return list
+ }
+ if CustomAuthMap.IsEmpty() == false {
+ list.Replace(CustomAuthMap)
+ return list
+ }
+ return list
+ }()
+ c.Pool.Interval = time.Second * 1
+ return c
+}
+
+func (c *Cracker) Retries(i int) {
+ if i <= 0 {
+ return
+ }
+ c.retries = i
+}
+
+func (c *Cracker) success(info Auth) {
+ c.SuccessAuth = info
+ atomic.AddInt32(&c.SuccessCount, 1)
+}
+
+func (c *Cracker) Run() (*Auth, error) {
+ switch c.initJobFunc() {
+ case ProtocolInvalid:
+ return nil, ProtocolErr
+ case UsernameAndPassword:
+ go c.dispatcher(false)
+ case OnlyPassword:
+ go c.dispatcher(true)
+ case UnauthorizedAccessVulnerability:
+ return &UnauthorizedAccessVulnerabilityAuth, nil
+ }
+ //开始暴力破解
+ c.Pool.Run()
+ switch {
+ case c.SuccessCount == 0:
+ return nil, LoginFailedErr
+ case c.SuccessCount <= 3:
+ return &c.SuccessAuth, nil
+ default:
+ return nil, ProtocolErr
+ }
+}
+
+func (c *Cracker) initJobFunc() loginType {
+ ip := c.authInfo.IPAddr
+ port := c.authInfo.Port
+ //选择暴力破解函数
+ switch c.authInfo.Protocol {
+ case "rdp":
+ c.Pool.Function = c.generateWorker(rdpCracker(ip, port))
+ case "mysql":
+ c.Pool.Function = c.generateWorker(mysqlCracker)
+ case "mssql":
+ c.Pool.Function = c.generateWorker(mssqlCracker)
+ case "oracle":
+ //若SID未知，则不进行后续暴力破解
+ sid := oracle.GetSID(ip, port, oracle.ServiceName)
+ if sid == "" {
+ return ProtocolInvalid
+ }
+ c.Pool.Function = c.generateWorker(oracleCracker(sid))
+ case "postgresql":
+ c.Pool.Function = c.generateWorker(postgresqlCracker)
+ case "ssh":
+ c.Pool.Function = c.generateWorker(sshCracker)
+ case "telnet":
+ serverType := getTelnetServerType(ip, port)
+ if serverType == gotelnet.UnauthorizedAccess {
+ auth := NewAuth()
+ auth.Other["Status"] = "UnauthorizedAccess"
+ c.success(auth)
+ return ProtocolInvalid
+ }
+ c.Pool.Function = c.generateWorker(telnetCracker(serverType))
+ if serverType == gotelnet.OnlyPassword {
+ return OnlyPassword
+ }
+ case "ftp":
+ c.Pool.Function = c.generateWorker(ftpCracker)
+ case "mongodb":
+ c.Pool.Function = c.generateWorker(mongodbCracker)
+ case "redis":
+ c.Pool.Function = c.generateWorker(redisCracker)
+ return OnlyPassword
+ case "smb":
+ c.Pool.Function = c.generateWorker(smbCracker)
+ default:
+ return ProtocolInvalid
+ }
+ return UsernameAndPassword
+}
+
+func (c *Cracker) generateWorker(f func(interface{}) error) func(interface{}) {
+ return func(in interface{}) {
+ for j := 0; j < c.retries; j++ {
+ info := in.(AuthInfo)
+ info.Auth.MakePassword()
+ err := f(info)
+ if err == nil {
+ info.Status = true
+ c.success(info.Auth)
+ break
+ }
+ if strings.Contains(err.Error(), "timeout") == true {
+ continue
+ }
+ if strings.Contains(err.Error(), "EOF") == true {
+ continue
+ }
+ break
+ }
+ }
+}
+
+// 分发器
+func (c *Cracker) dispatcher(onlyPassword bool) {
+ for _, auth := range c.authList.Dict(onlyPassword) {
+ if c.SuccessCount > 0 {
+ break
+ }
+ info := *c.authInfo
+ info.Auth = auth
+ c.Pool.Push(info)
+ }
+ //关闭信道
+ c.Pool.Stop()
+}
+
+func InitCustomAuthMap(user, pass []string) {
+ CustomAuthMap = NewAuthList()
+ CustomAuthMap.Username = user
+ CustomAuthMap.Password = pass
+}
+
+func Ok(protocol string) bool {
+ if misc.IsDuplicate(ProtocolList, protocol) {
+ return true
+ }
+ return false
+}
diff --git a/core/hydra/mongodb/mongodb.go b/core/hydra/mongodb/mongodb.go
new file mode 100644
index 0000000..9caa4eb
--- /dev/null
+++ b/core/hydra/mongodb/mongodb.go
@@ -0,0 +1,27 @@
+package mongodb
+
+import (
+ "context"
+ "fmt"
+ "go.mongodb.org/mongo-driver/mongo"
+ "go.mongodb.org/mongo-driver/mongo/options"
+ "go.mongodb.org/mongo-driver/mongo/readpref"
+ "time"
+)
+
+func Check(Host, Username, Password string, Port int) error {
+ dataSourceName := fmt.Sprintf("mongodb://%v:%v@%v:%v/?authMechanism=SCRAM-SHA-1", Username, Password, Host, Port)
+ ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+ defer cancel()
+ // 建立mongodb连接
+ client, err := mongo.Connect(ctx, options.Client().ApplyURI(dataSourceName))
+ if err != nil {
+ return err
+ }
+ defer client.Disconnect(ctx)
+ err = client.Ping(ctx, readpref.Primary())
+ if err != nil {
+ return err
+ }
+ return nil
+}
diff --git a/core/hydra/mssql/mssql.go b/core/hydra/mssql/mssql.go
new file mode 100644
index 0000000..3ffa70c
--- /dev/null
+++ b/core/hydra/mssql/mssql.go
@@ -0,0 +1,28 @@
+package mssql
+
+import (
+ "database/sql"
+ "fmt"
+ _ "github.com/denisenkom/go-mssqldb"
+ mssql "github.com/denisenkom/go-mssqldb"
+ "io"
+ "log"
+ "time"
+)
+
+func Check(Host, Username, Password string, Port int) error {
+ mssql.SetLogger(log.New(io.Discard, "", log.Ldate|log.Ltime))
+ dataSourceName := fmt.Sprintf("server=%s;user id=%s;password=%s;port=%v;encrypt=disable;timeout=%v", Host, Username, Password, Port, 5*time.Second)
+ db, err := sql.Open("mssql", dataSourceName)
+ if err != nil {
+ return err
+ }
+ db.SetConnMaxLifetime(5 * time.Second)
+ db.SetMaxIdleConns(0)
+ defer db.Close()
+ err = db.Ping()
+ if err != nil {
+ return err
+ }
+ return nil
+}
diff --git a/core/hydra/mysql/mysql.go b/core/hydra/mysql/mysql.go
new file mode 100644
index 0000000..28e033c
--- /dev/null
+++ b/core/hydra/mysql/mysql.go
@@ -0,0 +1,28 @@
+package mysql
+
+import (
+ "database/sql"
+ "fmt"
+ "github.com/go-sql-driver/mysql"
+ _ "github.com/go-sql-driver/mysql"
+ "io"
+ "log"
+ "time"
+)
+
+func Check(Host, Username, Password string, Port int) error {
+ _ = mysql.SetLogger(log.New(io.Discard, "", log.Ldate|log.Ltime))
+ dataSourceName := fmt.Sprintf("%v:%v@tcp(%v:%v)/information_schema?charset=utf8&timeout=%v", Username, Password, Host, Port, 5*time.Second)
+ db, err := sql.Open("mysql", dataSourceName)
+ if err != nil {
+ return err
+ }
+ db.SetConnMaxLifetime(5 * time.Second)
+ db.SetMaxIdleConns(0)
+ defer db.Close()
+ err = db.Ping()
+ if err != nil {
+ return err
+ }
+ return nil
+}
diff --git a/core/hydra/oracle/oracle.go b/core/hydra/oracle/oracle.go
new file mode 100644
index 0000000..c95c964
--- /dev/null
+++ b/core/hydra/oracle/oracle.go
@@ -0,0 +1,141 @@
+package oracle
+
+import (
+ "KscanPro/core/slog"
+ "database/sql"
+ "errors"
+ "fmt"
+ _ "github.com/sijms/go-ora/v2"
+ "io"
+ "strings"
+ "time"
+)
+
+var ServiceName = []string{
+ "orcl", "XE", "TEST", "RIS", "HIS", "PACS", "ORACLE", "ORACLE10", "ORACLE11", "ORACLEDB",
+ "ORA10", "ORA11", "orcl3", "orcl.3", "orcl.1", "LINUX8174", "ASDB", "IASDB", "OEMREP", "CLREXTPROC",
+ "SA0", "PLSEXTPROC", "SA1", "SA2", "SA3", "SA4", "SA5", "SA6", "SA7", "SA8",
+ "SA9", "SAA", "SAB", "SAC", "SAD", "SAE", "SAF", "SAG", "SAH", "SAI",
+ "SAJ", "SAK", "SAL", "SAM", "SAN", "SAO", "SAP", "SAQ", "SAR", "SAS",
+ "SAT", "SAU", "SAV", "SAW", "SAX", "SAY", "SAZ", "IXOS", "CTM4_0", "CTM4_1",
+ "CTM4_6", "ARIS", "MSAM", "ADV1", "ADVCPROD", "ASDB0", "ASDB1", "ASDB2", "ASDB3", "ASDB4",
+ "ASDB5", "ASDB6", "ASDB7", "ASDB8", "ASDB9", "ASG817", "ASG817P", "ASG817T", "ATRPROD", "ATRTEST",
+ "BLA", "BUDGET", "C630", "D", "D10", "D8", "D9", "DB", "DB01", "DB02",
+ "DB03", "DB1", "DB2", "DB2EDU", "DB2PROD", "DB2TEST", "DB3", "DBA", "DBA1", "DBA2",
+ "DBA3", "DBA4", "DBA5", "DBA6", "DBA7", "DBA8", "DBA9", "DBX", "DEMO", "DEV",
+ "DEV0", "DEV1", "DEV2", "DEV3", "DEV4", "DEV5", "DEV6", "DEV7", "DEV8", "DEV9",
+ "DEVEL", "DIA1", "DIA2", "DIS", "DWH", "DWHPROD", "DWHTEST", "DWRHS", "ELCARO", "EMRS2",
+ "EOF", "ESOR", "FINDEC", "FINPROD", "FNDFS_HR1", "FNDFS_HR2", "FPRD", "GR01", "GR02", "GR03",
+ "HR", "HR0", "HR1", "HR2", "HR3", "HR4", "HR5", "HR6", "HR7", "HR8",
+ "HR9", "HRDMO", "INCD", "ISD01", "ISD06", "ISP01", "ITS", "KRAUS", "KRONOS", "LDAP",
+ "LINUX101", "LINUX1011", "LINUX1012", "LINUX1013", "LINUX1014", "LINUX102", "LINUX1021", "LINUX817", "LINUX8171", "LINUX8172",
+ "LINUX8173", "LINUX901", "LINUX902", "LINUX9021", "LINUX9022", "LINUX9023", "LINUX9024", "LINUX9025", "LINUX9026", "LINUX9027",
+ "LUN", "MDTEST", "MYDB", "NEDB", "NORTHWIND", "ODB", "OGDP", "OID", "OJS", "OMS",
+ "ORA1", "ORA101", "ORA10101", "ORA10101P", "ORA10101T", "ORA10102", "ORA10102P", "ORA10102T", "ORA10103", "ORA10103P",
+ "ORA10103T", "ORA10104", "ORA10104P", "ORA10104T", "ORA10105", "ORA10105P", "ORA10105T", "ORA1011", "ORA1011P", "ORA1011T",
+ "ORA1012", "ORA1012P", "ORA1012T", "ORA1013", "ORA1013P", "ORA1013T", "ORA1014", "ORA1014P", "ORA1014T", "ORA1015",
+ "ORA1015P", "ORA1015T", "ORA1021", "ORA1021P", "ORA1021T", "ORA1022", "ORA1022P", "ORA1022T", "ORA2", "ORA8",
+ "ORA805", "ORA806", "ORA815", "ORA816", "ORA817", "ORA8170", "ORA8170P", "ORA8170T", "ORA8171", "ORA8171P",
+ "ORA8171T", "ORA8172", "ORA8172P", "ORA8172T", "ORA8173", "ORA8173P", "ORA8173T", "ORA8174", "ORA8174P", "ORA8174T",
+ "ORA8_SC", "ORA910", "ORA920", "ORA9201", "ORA9201P", "ORA9201T", "ORA9202", "ORA9202P", "ORA9202T", "ORA9203",
+ "ORA9203P", "ORA9203T", "ORA9204", "ORA9204P", "ORA9204T", "ORA9205", "ORA9205P", "ORA9205T", "ORA9206", "ORA9206P",
+ "ORA9206T", "ORA9207", "ORA9207P", "ORA9207T", "ORACL", "ORADB", "ORADB1", "ORADB2", "ORADB3", "ORALIN",
+ "orcl0", "orcl1", "orcl10", "orcl2", "orcl4", "orcl5", "orcl6", "orcl7", "orcl8", "orcl9",
+ "orclA", "orclB", "orclC", "orclD", "orclE", "orclF", "orclG", "orclH", "orclI", "orclJ",
+ "orclK", "orclL", "orclM", "orclN", "orclO", "orclP", "orclP0", "orclP1", "orclP2", "orclP3",
+ "orclP4", "orclP5", "orclP6", "orclP7", "orclP8", "orclP9", "orclQ", "orclR", "orclS", "orclSOL",
+ "orclT", "orclU", "orclV", "orclW", "orclX", "orclY", "orclZ", "ORIONDB", "ORTD", "P",
+ "P10", "P10G", "P8", "P8I", "P9", "P9I", "PD1", "PINDB", "PORA10101", "PORA10102",
+ "PORA10103", "PORA10104", "PORA10105", "PORA1011", "PORA1012", "PORA1013", "PORA1014", "PORA1015", "PORA1021", "PORA1022",
+ "PORA8170", "PORA8171", "PORA8172", "PORA8173", "PORA8174", "PORA9201", "PORA9202", "PORA9203", "PORA9204", "PORA9205",
+ "PORA9206", "PORA9207", "PRD", "PRITXI", "PROD", "PROD0", "PROD1", "PROD10G", "PROD2", "PROD3",
+ "PROD4", "PROD5", "PROD6", "PROD7", "PROD8", "PROD8I", "PROD9", "PROD920", "PROD9I", "PROG10",
+ "RAB1", "RAC", "RAC1", "RAC2", "RAC3", "RAC4", "RECV", "REP", "REP0", "REP1",
+ "REP2", "REP3", "REP4", "REP5", "REP6", "REP7", "REP8", "REP9", "REPO", "REPO0",
+ "REPO1", "REPO2", "REPO3", "REPO4", "REPO5", "REPO6", "REPO7", "REPO8", "REPO9", "REPOS",
+ "REPOS0", "REPOS1", "REPOS2", "REPOS3", "REPOS4", "REPOS5", "REPOS6", "REPOS7", "REPOS8", "REPOS9",
+ "RIPPROD", "RITCTL", "RITDEV", "RITPROD", "RITQA", "RITTRN", "RITTST", "SALES", "SAMPLE", "SANIPSP",
+ "SAP0", "SAP1", "SAP2", "SAP3", "SAP4", "SAP5", "SAP6", "SAP7", "SAP8", "SAP9",
+ "SAPHR", "SGNT", "SID0", "SID1", "SID2", "SID3", "SID4", "SID5", "SID6", "SID7",
+ "SID8", "SID9", "STAG1", "STAG2", "T1", "T10", "T101", "T102", "T2", "T3",
+ "T4", "T7", "T71", "T72", "T73", "T8", "T80", "T81", "T82", "T9",
+ "T91", "T92", "TEST10G", "THUMPER", "TRC28", "TRIUMF", "TSH1", "TST", "TST0", "TST1",
+ "TST2", "TST3", "TST4", "TST5", "TST6", "TST7", "TST8", "TST9", "TYCP", "UNIX101",
+ "UNIX1011", "UNIX1012", "UNIX1013", "UNIX1014", "UNIX102", "UNIX1021", "UNIX817", "UNIX8171", "UNIX8172", "UNIX8173",
+ "UNIX8174", "UNIX901", "UNIX902", "UNIX9021", "UNIX9022", "UNIX9023", "UNIX9024", "UNIX9025", "UNIX9026", "UNIX9027",
+ "VENOM", "VENU", "VISTA", "W101", "W1011", "W1012", "W1013", "W1014", "W102", "W1021",
+ "W817", "W8171", "W8172", "W8173", "W8174", "W901", "W902", "W9021", "W9022", "W9023",
+ "W9024", "W9025", "W9026", "W9027", "WG73", "WIN101", "WIN1011", "WIN1012", "WIN1013", "WIN1014",
+ "WIN102", "WIN1021", "WIN817", "WIN8171", "WIN8172", "WIN8173", "WIN8174", "WIN901", "WIN902", "WIN9021",
+ "WIN9022", "WIN9023", "WIN9024", "WIN9025", "WIN9026", "WIN9027", "WINDOWS101", "WINDOWS1011", "WINDOWS1012", "WINDOWS1013",
+ "WINDOWS1014", "WINDOWS102", "WINDOWS1021", "WINDOWS817", "WINDOWS8171", "WINDOWS8172", "WINDOWS8173", "WINDOWS8174", "WINDOWS901", "WINDOWS902",
+ "WINDOWS9021", "WINDOWS9022", "WINDOWS9023", "WINDOWS9024", "WINDOWS9025", "WINDOWS9026", "WINDOWS9027", "XEXDB", "XE_XPT", "HSAGENT",
+}
+
+func Check(Host, Username, Password string, Port int, SID string) error {
+ var db *sql.DB
+ var err error
+ dataSourceName := fmt.Sprintf("oracle://%s:%s@%s:%d/%s", Username, Password, Host, Port, SID)
+ db, err = sql.Open("oracle", dataSourceName)
+ if err != nil {
+ return err
+ }
+ defer db.Close()
+ db.SetConnMaxLifetime(5 * time.Second)
+ db.SetMaxIdleConns(0)
+ err = db.Ping()
+ if err == nil {
+ return nil
+ }
+ if strings.Contains(err.Error(), "ORA-28009") {
+ return nil
+ }
+ return err
+}
+
+func GetSID(Host string, Port int, sids []string) string {
+ for _, sid := range sids {
+ if CheckSID(sid, Host, Port) {
+ return sid
+ }
+ }
+ return ""
+}
+
+func CheckSID(sid, Host string, Port int) bool {
+ dataSourceName := fmt.Sprintf("oracle://sid:sid@%s:%d/%s", Host, Port, sid)
+ db, err := sql.Open("oracle", dataSourceName)
+ if err != nil {
+ return false
+ }
+ db.SetConnMaxLifetime(3 * time.Second)
+ db.SetMaxIdleConns(0)
+ defer func() {
+ if e := recover(); e != nil {
+ err = errors.New(fmt.Sprint("sid check failed: ", Host, e))
+ slog.Println(slog.DEBUG, err, e)
+ }
+ }()
+
+ err = db.Ping()
+ if err == nil || err == io.EOF {
+ db.Close()
+ return true
+ }
+ if strings.Contains(err.Error(), "ORA-") == false {
+ return false
+ }
+ if strings.Contains(err.Error(), "ORA-12505") {
+ return false
+ }
+ if strings.Contains(err.Error(), "ORA-12504") {
+ return false
+ }
+ if strings.Contains(err.Error(), "ORA-12514") {
+ return false
+ }
+ if strings.Contains(err.Error(), "ORA-12564") {
+ return false
+ }
+ return true
+}
diff --git a/core/hydra/oracle/oracle_test.go b/core/hydra/oracle/oracle_test.go
new file mode 100644
index 0000000..469997e
--- /dev/null
+++ b/core/hydra/oracle/oracle_test.go
@@ -0,0 +1,27 @@
+package oracle
+
+import (
+ "database/sql"
+ "fmt"
+ "testing"
+ "time"
+)
+
+func TestGetSID(t *testing.T) {
+ target := []string{""}
+ for _, ip := range target {
+ sid := GetSID(ip, 1521, ServiceName)
+ if sid != "" {
+ fmt.Println(ip, "\t", sid)
+ }
+ }
+
+}
+
+func TestConnect(t *testing.T) {
+ dataSourceName := fmt.Sprintf("oracle://sid:sid@%s:%d/?SID=%s", "192.168.100.11", 1521, "orcl")
+ db, _ := sql.Open("oracle", dataSourceName)
+ db.SetConnMaxLifetime(3 * time.Second)
+ db.SetMaxIdleConns(0)
+ fmt.Println(db.Ping())
+}
diff --git a/core/hydra/postgresql/postgresql.go b/core/hydra/postgresql/postgresql.go
new file mode 100644
index 0000000..fc42568
--- /dev/null
+++ b/core/hydra/postgresql/postgresql.go
@@ -0,0 +1,23 @@
+package postgresql
+
+import (
+ "database/sql"
+ "fmt"
+ _ "github.com/lib/pq"
+ "time"
+)
+
+func Check(Host, Username, Password string, Port int) error {
+ dataSourceName := fmt.Sprintf("postgres://%v:%v@%v:%v/%v?sslmode=%v", Username, Password, Host, Port, "postgres", "disable")
+ db, err := sql.Open("postgres", dataSourceName)
+ if err != nil {
+ return err
+ }
+ db.SetConnMaxLifetime(5 * time.Second)
+ defer db.Close()
+ err = db.Ping()
+ if err != nil {
+ return err
+ }
+ return nil
+}
diff --git a/core/hydra/rdp/grdp.go b/core/hydra/rdp/grdp.go
new file mode 100644
index 0000000..1145d05
--- /dev/null
+++ b/core/hydra/rdp/grdp.go
@@ -0,0 +1,23 @@
+package rdp
+
+import (
+ "KscanPro/lib/grdp"
+ "fmt"
+)
+
+func Check(ip, domain, login, password string, port int, protocol string) error {
+ var err error
+ target := fmt.Sprintf("%s:%d", ip, port)
+ if protocol == grdp.PROTOCOL_SSL {
+ err = grdp.LoginForSSL(target, domain, login, password)
+ } else {
+ err = grdp.LoginForRDP(target, domain, login, password)
+ }
+ //err = grdp.Login(target, domain, login, password)
+ //slog.Println(slog.INFO, target, domain, login, password)
+ //slog.Println(slog.INFO, err)
+ if err != nil {
+ return err
+ }
+ return nil
+}
diff --git a/core/hydra/redis/redis.go b/core/hydra/redis/redis.go
new file mode 100644
index 0000000..66e6ce5
--- /dev/null
+++ b/core/hydra/redis/redis.go
@@ -0,0 +1,50 @@
+package redis
+
+import (
+ "errors"
+ "fmt"
+ "net"
+ "strings"
+ "time"
+)
+
+func Check(Host, Password string, Port int) error {
+ netloc := fmt.Sprintf("%s:%d", Host, Port)
+ conn, err := net.DialTimeout("tcp", netloc, 5*time.Second)
+ if err != nil {
+ return err
+ }
+ defer conn.Close()
+ err = conn.SetReadDeadline(time.Now().Add(5 * time.Second))
+ if err != nil {
+ return err
+ }
+ _, err = conn.Write([]byte(fmt.Sprintf("auth %s\r\n", Password)))
+ time.Sleep(time.Millisecond * 500)
+ if err != nil {
+ return err
+ }
+ reply, err := readResponse(conn)
+ if err != nil {
+ return err
+ }
+ if strings.Contains(reply, "+OK") == false {
+ return errors.New("login failed")
+ }
+ return nil
+}
+
+func readResponse(conn net.Conn) (r string, err error) {
+ buf := make([]byte, 4096)
+ for {
+ count, err := conn.Read(buf)
+ if err != nil {
+ break
+ }
+ r += string(buf[0:count])
+ if count < 4096 {
+ break
+ }
+ }
+ return r, err
+}
diff --git a/core/hydra/smb/smb.go b/core/hydra/smb/smb.go
new file mode 100644
index 0000000..18cf9e1
--- /dev/null
+++ b/core/hydra/smb/smb.go
@@ -0,0 +1,49 @@
+package smb
+
+import (
+ "context"
+ "errors"
+ "github.com/stacktitan/smb/smb"
+ "time"
+)
+
+var (
+ LoginFailedError = errors.New("login failed")
+ LoginTimeoutError = errors.New("login timeout")
+)
+
+func Check(Host, Username, Domain, Password string, Port int) error {
+ status := make(chan error)
+ ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+ defer cancel()
+ options := smb.Options{
+ Host: Host,
+ Port: Port,
+ User: Username,
+ Password: Password,
+ Domain: Domain,
+ Workstation: "",
+ }
+ //开始进行SMB连接
+ go func() {
+ session, err := smb.NewSession(options, false)
+ if err != nil {
+ status <- err
+ return
+ }
+ defer session.Close()
+ if session.IsAuthenticated == false {
+ status <- LoginFailedError
+ return
+ }
+ status <- nil
+ }()
+
+ select {
+ case <-ctx.Done():
+ return LoginTimeoutError
+ case err := <-status:
+ return err
+ }
+
+}
diff --git a/core/hydra/smb/smb_test.go b/core/hydra/smb/smb_test.go
new file mode 100644
index 0000000..f211483
--- /dev/null
+++ b/core/hydra/smb/smb_test.go
@@ -0,0 +1,11 @@
+package smb
+
+import (
+ "fmt"
+ "testing"
+)
+
+func TestCheck(t *testing.T) {
+ err := Check("192.168.0.2", "administrator", "workgroup", "123456", 445)
+ fmt.Println(err)
+}
diff --git a/core/hydra/ssh/ssh.go b/core/hydra/ssh/ssh.go
new file mode 100644
index 0000000..934adbc
--- /dev/null
+++ b/core/hydra/ssh/ssh.go
@@ -0,0 +1,26 @@
+package ssh
+
+import (
+ "fmt"
+ "golang.org/x/crypto/ssh"
+ "net"
+ "time"
+)
+
+func Check(Host, Username, Password string, Port int) error {
+ var Auth = []ssh.AuthMethod{ssh.Password(Password)}
+ config := &ssh.ClientConfig{
+ User: Username,
+ Auth: Auth,
+ Timeout: 3 * time.Second,
+ HostKeyCallback: func(hostname string, remote net.Addr, key ssh.PublicKey) error {
+ return nil
+ },
+ }
+ client, err := ssh.Dial("tcp", fmt.Sprintf("%s:%d", Host, Port), config)
+ if err != nil {
+ return err
+ }
+ defer client.Close()
+ return nil
+}
diff --git a/core/hydra/telnet/telnet.go b/core/hydra/telnet/telnet.go
new file mode 100644
index 0000000..e1b5072
--- /dev/null
+++ b/core/hydra/telnet/telnet.go
@@ -0,0 +1,22 @@
+package telnet
+
+import (
+ "KscanPro/lib/gotelnet"
+)
+
+func Check(addr, username, password string, port, serverType int) error {
+ client := gotelnet.New(addr, port)
+ err := client.Connect()
+ if err != nil {
+ return err
+ }
+ defer client.Close()
+ client.UserName = username
+ client.Password = password
+ client.ServerType = serverType
+ err = client.Login()
+ if err != nil {
+ return err
+ }
+ return nil
+}
diff --git a/core/hydra/type-auth.go b/core/hydra/type-auth.go
new file mode 100644
index 0000000..2516b95
--- /dev/null
+++ b/core/hydra/type-auth.go
@@ -0,0 +1,69 @@
+package hydra
+
+import "strings"
+
+type Auth struct {
+ Username string
+ Password string
+ Other map[string]string
+}
+
+var UnauthorizedAccessVulnerabilityAuth = NewAuth()
+
+func NewAuth() Auth {
+ a := Auth{
+ Username: "",
+ Password: "",
+ Other: make(map[string]string),
+ }
+ return a
+}
+
+func NewAuthFromPasswords(passwords []string) []Auth {
+ var auths []Auth
+ for _, password := range passwords {
+ auths = append(auths, NewSpecialAuth("", password))
+ }
+ return auths
+}
+
+func NewAuthFromUsernameAndPassword(usernames, passwords []string) []Auth {
+ var auths []Auth
+ for _, password := range passwords {
+ for _, username := range usernames {
+ auths = append(auths, NewSpecialAuth(username, password))
+ }
+ }
+ return auths
+}
+
+func NewSpecialAuth(username, password string) Auth {
+ a := NewAuth()
+ a.Username = username
+ a.Password = password
+ return a
+}
+
+func (a *Auth) MakePassword() {
+ if strings.Contains(a.Password, "%user%") {
+ a.Password = strings.ReplaceAll(a.Password, "%user%", a.Username)
+ }
+}
+
+func (a *Auth) Map() map[string]string {
+ var m = make(map[string]string)
+ if a.Username != "" {
+ m["Username"] = a.Username
+ }
+ if a.Password != "" {
+ m["Password"] = a.Password
+ } else {
+ m["Password"] = "空"
+ }
+ for key, value := range a.Other {
+ if value != "" {
+ m[key] = value
+ }
+ }
+ return m
+}
diff --git a/core/hydra/type-authinfo.go b/core/hydra/type-authinfo.go
new file mode 100644
index 0000000..0f3c707
--- /dev/null
+++ b/core/hydra/type-authinfo.go
@@ -0,0 +1,46 @@
+package hydra
+
+import (
+ "KscanPro/lib/color"
+ "fmt"
+)
+
+type AuthInfo struct {
+ Protocol string
+ Port int
+ IPAddr string
+ Auth Auth
+ Status bool
+}
+
+func NewAuthInfo(IPAddr string, Port int, Protocol string) *AuthInfo {
+ a := &AuthInfo{
+ Protocol: Protocol,
+ Port: Port,
+ IPAddr: IPAddr,
+ }
+ a.Auth = NewAuth()
+ a.Status = false
+ return a
+}
+
+func (a *AuthInfo) Display() string {
+ URL := fmt.Sprintf("%s://%s:%d", a.Protocol, a.IPAddr, a.Port)
+ authChar := ""
+ outMap := a.Auth.Other
+ if a.Auth.Username != "" {
+ outMap["Username"] = a.Auth.Username
+ }
+ if a.Auth.Password != "" {
+ outMap["Password"] = a.Auth.Password
+ }
+ for key, value := range outMap {
+ authChar += fmt.Sprintf("%s:%s、", key, value)
+ }
+ authChar = authChar[:len(authChar)-3]
+ var s string
+ s = fmt.Sprintf("%-30v %-26v %v", URL, "Success", authChar)
+ s = color.Red(s)
+ s = color.Overturn(s)
+ return s
+}
diff --git a/core/hydra/type-authlist.go b/core/hydra/type-authlist.go
new file mode 100644
index 0000000..f4f85ad
--- /dev/null
+++ b/core/hydra/type-authlist.go
@@ -0,0 +1,62 @@
+package hydra
+
+import (
+ "KscanPro/lib/misc"
+)
+
+type AuthList struct {
+ Username []string
+ Password []string
+ Special []Auth
+}
+
+func NewAuthList() *AuthList {
+ a := &AuthList{}
+ a.Special = []Auth{}
+ return a
+}
+
+func (a *AuthList) IsEmpty() bool {
+ if len(a.Username) > 0 || len(a.Password) > 0 {
+ return false
+ }
+ return true
+}
+
+func (a *AuthList) Merge(list *AuthList) {
+ a.Username = append(a.Username, list.Username...)
+ a.Password = append(a.Password, list.Password...)
+ a.Special = append(a.Special, list.Special...)
+ a.Username = misc.RemoveDuplicateElement(a.Username)
+ a.Password = misc.RemoveDuplicateElement(a.Password)
+}
+
+func (a *AuthList) Replace(list *AuthList) {
+ if len(list.Username) > 0 {
+ a.Username = list.Username
+ }
+ if len(list.Password) > 0 {
+ a.Password = list.Password
+ }
+ a.Special = list.Special
+ a.Username = misc.RemoveDuplicateElement(a.Username)
+ a.Password = misc.RemoveDuplicateElement(a.Password)
+}
+
+func (a *AuthList) Length() int {
+ if len(a.Username) == 0 {
+ return len(a.Password) + len(a.Special)
+ }
+ return (len(a.Password) * len(a.Username)) + len(a.Special)
+}
+
+func (a *AuthList) Dict(onlyPassword bool) []Auth {
+ var dict []Auth
+ if onlyPassword {
+ dict = append(dict, NewAuthFromPasswords(a.Password)...)
+ } else {
+ dict = append(dict, a.Special...)
+ dict = append(dict, NewAuthFromUsernameAndPassword(a.Username, a.Password)...)
+ }
+ return dict
+}
diff --git a/core/hydra/web/web.go b/core/hydra/web/web.go
new file mode 100644
index 0000000..90581b7
--- /dev/null
+++ b/core/hydra/web/web.go
@@ -0,0 +1,49 @@
+package web
+
+import (
+ "context"
+ "errors"
+ "github.com/stacktitan/smb/smb"
+ "time"
+)
+
+var (
+ LoginFailedError = errors.New("login failed")
+ LoginTimeoutError = errors.New("login timeout")
+)
+
+func Check(Host, Username, Domain, Password string, Port int) error {
+ status := make(chan error)
+ ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+ defer cancel()
+ options := smb.Options{
+ Host: Host,
+ Port: Port,
+ User: Username,
+ Password: Password,
+ Domain: Domain,
+ Workstation: "",
+ }
+ //开始进行SMB连接
+ go func() {
+ session, err := smb.NewSession(options, false)
+ if err != nil {
+ status <- err
+ return
+ }
+ defer session.Close()
+ if session.IsAuthenticated == false {
+ status <- LoginFailedError
+ return
+ }
+ status <- nil
+ }()
+
+ select {
+ case <-ctx.Done():
+ return LoginTimeoutError
+ case err := <-status:
+ return err
+ }
+
+}
diff --git a/core/pocScan/POC.go b/core/pocScan/POC.go
new file mode 100644
index 0000000..1598f13
--- /dev/null
+++ b/core/pocScan/POC.go
@@ -0,0 +1,96 @@
+package pocScan
+
+import (
+ "KscanPro/app"
+ "KscanPro/core/pocScan/lib"
+ "embed"
+ "fmt"
+ "net/http"
+ "net/url"
+ "strings"
+ "sync"
+)
+
+//go:embed pocs
+var Pocs embed.FS
+var once sync.Once
+var AllPocs []*lib.Poc
+
+func Run1(Url string) {
+ once.Do(initpoc)
+ var pocinfo = app.PocInfo{}
+ URL, _ := removeStandardPorts(Url)
+ buf := strings.Split(URL, "/")
+ pocinfo.Target = strings.Join(buf[:3], "/")
+ pocinfo.PocName = lib.CheckInfoPoc("")
+ Execute(pocinfo)
+}
+
+func Execute(PocInfo app.PocInfo) {
+ req, err := http.NewRequest("GET", PocInfo.Target, nil)
+ if err != nil {
+ //errlog := fmt.Sprintf("[-] webpocinit %v %v", PocInfo.Target, err)
+ //common2.LogError(errlog)
+ return
+ }
+ req.Header.Set("User-agent", app.UserAgent)
+ req.Header.Set("Accept", app.Accept)
+ req.Header.Set("Accept-Language", "zh-CN,zh;q=0.9")
+ if app.Cookie != "" {
+ req.Header.Set("Cookie", app.Cookie)
+ }
+ pocs := filterPoc(PocInfo.PocName)
+ lib.CheckMultiPoc(req, pocs, app.PocNum)
+}
+
+func initpoc() {
+ entries, err := Pocs.ReadDir("pocs")
+ if err != nil {
+ fmt.Printf("[-] init poc error: %v", err)
+ return
+ }
+ for _, one := range entries {
+ path := one.Name()
+ if strings.HasSuffix(path, ".yaml") || strings.HasSuffix(path, ".yml") {
+ if poc, _ := lib.LoadPoc(path, Pocs); poc != nil {
+ AllPocs = append(AllPocs, poc)
+ }
+ }
+ }
+
+}
+
+func filterPoc(pocname string) (pocs []*lib.Poc) {
+ if pocname == "" {
+ return AllPocs
+ }
+ for _, poc := range AllPocs {
+ if strings.Contains(poc.Name, pocname) {
+ pocs = append(pocs, poc)
+ }
+ }
+ return
+}
+
+// 从URL字符串中移除端口80和443
+func removeStandardPorts(rawURL string) (string, error) {
+ // 解析URL
+ u, err := url.Parse(rawURL)
+ if err != nil {
+ return "", err
+ }
+
+ // 获取端口部分
+ host := u.Host
+ colonIndex := strings.LastIndex(host, ":")
+ if colonIndex != -1 {
+ port := host[colonIndex+1:]
+ if port == "80" || port == "443" {
+ // 移除端口
+ u.Host = host[:colonIndex]
+ }
+ }
+
+ // 重建URL字符串，不包括默认端口
+ return u.String(), nil
+}
diff --git a/core/pocScan/info/rules.go b/core/pocScan/info/rules.go
new file mode 100644
index 0000000..939b981
--- /dev/null
+++ b/core/pocScan/info/rules.go
@@ -0,0 +1,314 @@
+package info
+
+type RuleData struct {
+ Name string
+ Type string
+ Rule string
+}
+
+type Md5Data struct {
+ Name string
+ Md5Str string
+}
+
+type PocData struct {
+ Name string
+ Alias string
+}
+
+var RuleDatas = []RuleData{
+ {"宝塔", "body", "(app.bt.cn/static/app.png|安全入口校验失败|