diff --git a/.gitignore b/.gitignore index 9fa6f4e5..a3a28d08 100644 --- a/.gitignore +++ b/.gitignore @@ -14,7 +14,7 @@ logs urls* *.txt -*.html +*/reports/*.html *.json # Dependency directories (remove the comment below to include it) diff --git a/README.md b/README.md index 8d51e3b9..01ed0b39 100644 --- a/README.md +++ b/README.md @@ -7,17 +7,17 @@

- - - - - + + + + +

- Download • - Wiki • - Helper Function + Download • + Wiki • + Helper Function

@@ -441,7 +441,7 @@ you can install it with: **Binary** ```sh -$ https://github.com/zan8in/afrog/releases/latest +$ https://github.com/zan8in/afrog/v3/releases/latest ``` **Github** @@ -454,7 +454,7 @@ $ ./afrog -h **Go** ```sh -$ go install -v github.com/zan8in/afrog/cmd/afrog@latest +$ go install -v github.com/zan8in/afrog/v3/cmd/afrog@latest ``` ## Running afrog @@ -553,14 +553,14 @@ The JNDI vulnerability refers to security vulnerabilities that exploit the JNDI To obtain JNDI, follow these steps: -- To obtain the source code and compile the JAR file, please visit the official website [github.com/r00tSe7en/JNDIMonitor](https://github.com/r00tSe7en/JNDIMonitor). Alternatively, you can go to the official afrog website [afrog/helper/jndi](https://github.com/zan8in/afrog/tree/main/helper/jndi) to download the pre-compiled JAR file +- To obtain the source code and compile the JAR file, please visit the official website [github.com/r00tSe7en/JNDIMonitor](https://github.com/r00tSe7en/JNDIMonitor). Alternatively, you can go to the official afrog website [afrog/helper/jndi](https://github.com/zan8in/afrog/v3/tree/main/helper/jndi) to download the pre-compiled JAR file - Upload the `JNDIMonitor-2.0.1-SNAPSHOT.jar` file to the server (such as a VPS server), and execute the following startup command: ```sh java -jar ./JNDIMonitor-2.0.1-SNAPSHOT.jar -i 0.0.0.0 -l 1389 -p 3456 ``` -Below are example methods for writing POCs. [Please click to view](https://github.com/zan8in/afrog/wiki/Examples#solr-log4j-rce). +Below are example methods for writing POCs. [Please click to view](https://github.com/zan8in/afrog/v3/wiki/Examples#solr-log4j-rce). ## Json Output (For developers) @@ -587,9 +587,9 @@ afrog -t https://example.com -ja result.json ## Screenshot -![](https://github.com/zan8in/afrog/blob/main/images/1.png) +![](https://github.com/zan8in/afrog/v3/blob/main/images/1.png) - + ## As Library @@ -623,7 +623,7 @@ More examples: To join the afrog communication group on WeChat, please first add the afrog personal account and mark it as **afrog**. Then, you will be added to the group by the administrator. - + ## 404Starlink diff --git a/afrog-helper-function.md b/afrog-helper-function.md index 64fc42af..4744e83d 100644 --- a/afrog-helper-function.md +++ b/afrog-helper-function.md @@ -23,7 +23,7 @@ rules: expression: r0() ``` -正确用法是首先在 set 内声明，详细用法请参考 [md5 函数示例](https://github.com/zan8in/afrog/blob/main/afrog-helper-function.md#md5) +正确用法是首先在 set 内声明，详细用法请参考 [md5 函数示例](https://github.com/zan8in/afrog/v3/blob/main/afrog-helper-function.md#md5) 内置函数源码位置：`v2\pkg\runner\celcompile.go` @@ -829,7 +829,7 @@ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ysoserial(payload, command, encode) ``` -payload: 攻击载荷，[支持payload列表](https://github.com/zan8in/afrog/blob/main/v2/pkg/utils/ysoserial.go) +payload: 攻击载荷，[支持payload列表](https://github.com/zan8in/afrog/v3/blob/main/v2/pkg/utils/ysoserial.go) command: 执行的命令，比如 xxx.dnslog.cn @@ -837,7 +837,7 @@ encode: 加密方法，目前支持：base64 和 hex 参考示例 -[CVE-2023-49070](https://github.com/zan8in/afrog/blob/46404e7527ca8d5752a9679ce13c83f7fd7b9e5b/v2/pocs/afrog-pocs/CVE/2023/CVE-2023-49070.yaml#L2)、[CVE-2021-29200](https://github.com/zan8in/afrog/blob/46404e7527ca8d5752a9679ce13c83f7fd7b9e5b/v2/pocs/afrog-pocs/CVE/2021/CVE-2021-29200.yaml) +[CVE-2023-49070](https://github.com/zan8in/afrog/v3/blob/46404e7527ca8d5752a9679ce13c83f7fd7b9e5b/v2/pocs/afrog-pocs/CVE/2023/CVE-2023-49070.yaml#L2)、[CVE-2021-29200](https://github.com/zan8in/afrog/v3/blob/46404e7527ca8d5752a9679ce13c83f7fd7b9e5b/v2/pocs/afrog-pocs/CVE/2021/CVE-2021-29200.yaml) ### AesCBC 用于 aes cbc 加密的 PoC @@ -856,4 +856,4 @@ iv: 加密 iv 参考示例 -[CVE-2023-20888](https://github.com/zan8in/afrog/blob/46404e7527ca8d5752a9679ce13c83f7fd7b9e5b/v2/pocs/afrog-pocs/CVE/2023/CVE-2023-20888.yaml) \ No newline at end of file +[CVE-2023-20888](https://github.com/zan8in/afrog/v3/blob/46404e7527ca8d5752a9679ce13c83f7fd7b9e5b/v2/pocs/afrog-pocs/CVE/2023/CVE-2023-20888.yaml) \ No newline at end of file diff --git a/afrog.go b/afrog.go index 6d2c9dcd..9283b3fe 100644 --- a/afrog.go +++ b/afrog.go @@ -8,10 +8,10 @@ import ( "sync/atomic" "time" - "github.com/zan8in/afrog/pkg/config" - "github.com/zan8in/afrog/pkg/result" - "github.com/zan8in/afrog/pkg/runner" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/config" + "github.com/zan8in/afrog/v3/pkg/result" + "github.com/zan8in/afrog/v3/pkg/runner" + "github.com/zan8in/afrog/v3/pkg/utils" "github.com/zan8in/goflags" "github.com/zan8in/gologger" ) diff --git a/cmd/afrog/main.go b/cmd/afrog/main.go index b7691f18..0d48becc 100644 --- a/cmd/afrog/main.go +++ b/cmd/afrog/main.go @@ -11,12 +11,12 @@ import ( _ "net/http/pprof" - "github.com/zan8in/afrog/pkg/config" - "github.com/zan8in/afrog/pkg/db/sqlite" - "github.com/zan8in/afrog/pkg/progress" - "github.com/zan8in/afrog/pkg/result" - "github.com/zan8in/afrog/pkg/runner" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/config" + "github.com/zan8in/afrog/v3/pkg/db/sqlite" + "github.com/zan8in/afrog/v3/pkg/progress" + "github.com/zan8in/afrog/v3/pkg/result" + "github.com/zan8in/afrog/v3/pkg/runner" + "github.com/zan8in/afrog/v3/pkg/utils" "github.com/zan8in/gologger" ) diff --git a/examples/basic_scan/main.go b/examples/basic_scan/main.go index ad7c4ebc..f5275304 100644 --- a/examples/basic_scan/main.go +++ b/examples/basic_scan/main.go @@ -3,7 +3,7 @@ package main import ( "fmt" - "github.com/zan8in/afrog" + "github.com/zan8in/afrog/v3" ) func main() { diff --git a/examples/batch_scan/main.go b/examples/batch_scan/main.go index 053eef3c..69e43232 100644 --- a/examples/batch_scan/main.go +++ b/examples/batch_scan/main.go @@ -3,7 +3,7 @@ package main import ( "fmt" - "github.com/zan8in/afrog" + "github.com/zan8in/afrog/v3" ) func main() { diff --git a/go.mod b/go.mod index db9f476b..717b5faa 100644 --- a/go.mod +++ b/go.mod @@ -1,4 +1,4 @@ -module github.com/zan8in/afrog +module github.com/zan8in/afrog/v3 go 1.20 diff --git a/go.sum b/go.sum index 22d5fb2b..146b172d 100644 --- a/go.sum +++ b/go.sum @@ -1222,8 +1222,6 @@ github.com/zan8in/gologger v0.0.0-20220917062627-c34a83c0a373 h1:T2YD/hp647jDauu github.com/zan8in/gologger v0.0.0-20220917062627-c34a83c0a373/go.mod h1:z3Zn3+DLpcfFKNqhAdYECiFeFK+o1EW3Gh0DEhFZ+v4= github.com/zan8in/goupdate v1.0.0 h1:H3ZVndassN6jNkJROAEkGFHbiyax0yG1RSKXMhzvgLY= github.com/zan8in/goupdate v1.0.0/go.mod h1:lB3IFGNY/wLFj1qfPOyee2m7lplg/mSDpsng+ax7sc8= -github.com/zan8in/oobadapter v0.0.0-20240228064213-611d47d14009 h1:WH7mV3GXvh8PRzevq/p0o6oRpw2Q6j0WbU2xLdZpa6Q= -github.com/zan8in/oobadapter v0.0.0-20240228064213-611d47d14009/go.mod h1:q9M+0H/FBTo9G2XZIsi3IDawHcwgEGDWCabCPoEpZ/I= github.com/zan8in/oobadapter v0.0.0-20240316010032-90d51fe61219 h1:oDGMh0SoiUYMOyKUrJ6i+mBu+MQs0cY0uLacdlosogM= github.com/zan8in/oobadapter v0.0.0-20240316010032-90d51fe61219/go.mod h1:q9M+0H/FBTo9G2XZIsi3IDawHcwgEGDWCabCPoEpZ/I= github.com/zan8in/pins v0.0.0-20231009082442-920437d7fa86 h1:sAwnml3XSZlSYr0yMUvGUgtNQ1fJoU6AdwyMh1mKHwc= diff --git a/pkg/config/afrogupdate.go b/pkg/config/afrogupdate.go index 91c093bb..a2ef289b 100644 --- a/pkg/config/afrogupdate.go +++ b/pkg/config/afrogupdate.go @@ -9,8 +9,8 @@ import ( "strings" "github.com/cavaliergopher/grab/v3" - "github.com/zan8in/afrog/pkg/poc" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/poc" + "github.com/zan8in/afrog/v3/pkg/utils" "github.com/zan8in/gologger" ) diff --git a/pkg/config/banner.go b/pkg/config/banner.go index 3828d66e..802c6399 100644 --- a/pkg/config/banner.go +++ b/pkg/config/banner.go @@ -4,8 +4,8 @@ import ( "fmt" "time" - "github.com/zan8in/afrog/pkg/log" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/log" + "github.com/zan8in/afrog/v3/pkg/utils" "github.com/zan8in/gologger" ) diff --git a/pkg/config/config.go b/pkg/config/config.go index 2336a9e5..ba87f666 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -5,7 +5,7 @@ import ( "path/filepath" "github.com/pkg/errors" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/utils" "gopkg.in/yaml.v2" ) diff --git a/pkg/config/options.go b/pkg/config/options.go index 7b849ec5..b645cbdb 100644 --- a/pkg/config/options.go +++ b/pkg/config/options.go @@ -8,13 +8,13 @@ import ( "strings" "sync" - "github.com/zan8in/afrog/pkg/log" - "github.com/zan8in/afrog/pkg/output" - "github.com/zan8in/afrog/pkg/poc" - "github.com/zan8in/afrog/pkg/utils" - "github.com/zan8in/afrog/pkg/web" - "github.com/zan8in/afrog/pkg/webhook/dingtalk" - "github.com/zan8in/afrog/pocs" + "github.com/zan8in/afrog/v3/pkg/log" + "github.com/zan8in/afrog/v3/pkg/output" + "github.com/zan8in/afrog/v3/pkg/poc" + "github.com/zan8in/afrog/v3/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/web" + "github.com/zan8in/afrog/v3/pkg/webhook/dingtalk" + "github.com/zan8in/afrog/v3/pocs" "github.com/zan8in/goflags" "github.com/zan8in/gologger" fileutil "github.com/zan8in/pins/file" diff --git a/pkg/cyberspace/cyberspace.go b/pkg/cyberspace/cyberspace.go index a3c3a6f5..ea82049e 100644 --- a/pkg/cyberspace/cyberspace.go +++ b/pkg/cyberspace/cyberspace.go @@ -4,7 +4,7 @@ import ( "fmt" "strings" - "github.com/zan8in/afrog/pkg/config" + "github.com/zan8in/afrog/v3/pkg/config" "github.com/zan8in/gologger" zoom_eyes "github.com/zan8in/zoomeye/pkg/runner" ) diff --git a/pkg/db/db.go b/pkg/db/db.go index c126963e..d9844dd2 100644 --- a/pkg/db/db.go +++ b/pkg/db/db.go @@ -7,8 +7,8 @@ import ( "path/filepath" "time" - "github.com/zan8in/afrog/pkg/poc" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/poc" + "github.com/zan8in/afrog/v3/pkg/utils" "gopkg.in/yaml.v2" ) diff --git a/pkg/db/sqlite/cmd/List.html b/pkg/db/sqlite/cmd/List.html new file mode 100644 index 00000000..71c86b96 --- /dev/null +++ b/pkg/db/sqlite/cmd/List.html @@ -0,0 +1,360 @@ + + + + + + 漏洞列表 + + + +
+
+ + + + + + +   + + +   + + +
+ {{if .}} + {{range .}} +
+
+ {{.VulID}} {{.Target}} + {{ if eq .Severity "INFO" }} + INFO + {{ else if eq .Severity "LOW" }} + LOW + {{ else if eq .Severity "MEDIUM" }} + MEDIUM + {{ else if eq .Severity "HIGH" }} + HIGH + {{ else if eq .Severity "CRITICAL" }} + CRITICAL + {{ end }} +
+
+ {{range .ResultList}} +
+
+ 
{{.Request}}
+
+
+ 
{{.Response}}
+
+
+ {{end}} +
+
+ {{end}} + + + + 页码: 1 + + + {{else}} + +

No matching

+ {{end}} +
+ + + + diff --git a/pkg/db/sqlite/cmd/List2.html b/pkg/db/sqlite/cmd/List2.html new file mode 100644 index 00000000..be53af14 --- /dev/null +++ b/pkg/db/sqlite/cmd/List2.html @@ -0,0 +1,23 @@ + + + + Data List + + +

Data List

+ + + + + + + {{range .}} + + + + + + {{end}} +
Column1Column2
{{.VulID}}{{.Target}}
+ + diff --git a/pkg/db/sqlite/cmd/main.go b/pkg/db/sqlite/cmd/main.go index 01c5c584..d8d18796 100644 --- a/pkg/db/sqlite/cmd/main.go +++ b/pkg/db/sqlite/cmd/main.go @@ -5,7 +5,7 @@ import ( "html/template" "net/http" - "github.com/zan8in/afrog/pkg/db/sqlite" + "github.com/zan8in/afrog/v3/pkg/db/sqlite" ) func main() { diff --git a/pkg/db/sqlite/sqlitex.go b/pkg/db/sqlite/sqlitex.go index 88de8629..a04e9b37 100644 --- a/pkg/db/sqlite/sqlitex.go +++ b/pkg/db/sqlite/sqlitex.go @@ -11,9 +11,9 @@ import ( "github.com/jmoiron/sqlx" _ "github.com/logoove/sqlite" - db2 "github.com/zan8in/afrog/pkg/db" - "github.com/zan8in/afrog/pkg/poc" - "github.com/zan8in/afrog/pkg/result" + db2 "github.com/zan8in/afrog/v3/pkg/db" + "github.com/zan8in/afrog/v3/pkg/poc" + "github.com/zan8in/afrog/v3/pkg/result" "github.com/zan8in/gologger" randutil "github.com/zan8in/pins/rand" ) diff --git a/pkg/log/color.go b/pkg/log/color.go index 73a208ab..041ba53f 100644 --- a/pkg/log/color.go +++ b/pkg/log/color.go @@ -4,7 +4,7 @@ import ( "strings" "github.com/gookit/color" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/utils" ) type Color struct { diff --git a/pkg/poc/poc.go b/pkg/poc/poc.go index 8d73b9f4..305f317a 100644 --- a/pkg/poc/poc.go +++ b/pkg/poc/poc.go @@ -6,7 +6,7 @@ import ( "path/filepath" "strings" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/utils" "gopkg.in/yaml.v2" ) diff --git a/pkg/protocols/gox/CVE-2011-2523.go b/pkg/protocols/gox/CVE-2011-2523.go index d133df15..866cef12 100644 --- a/pkg/protocols/gox/CVE-2011-2523.go +++ b/pkg/protocols/gox/CVE-2011-2523.go @@ -3,7 +3,7 @@ package gox import ( "fmt" - "github.com/zan8in/afrog/pkg/protocols/netxclient" + "github.com/zan8in/afrog/v3/pkg/protocols/netxclient" "github.com/zan8in/pins/netx" urlutil "github.com/zan8in/pins/url" ) diff --git a/pkg/protocols/gox/CVE-2023-25157.go b/pkg/protocols/gox/CVE-2023-25157.go index 1f5178ac..3b467242 100644 --- a/pkg/protocols/gox/CVE-2023-25157.go +++ b/pkg/protocols/gox/CVE-2023-25157.go @@ -9,7 +9,7 @@ import ( "strings" "time" - "github.com/zan8in/afrog/pkg/protocols/http/retryhttpclient" + "github.com/zan8in/afrog/v3/pkg/protocols/http/retryhttpclient" ) type WFS_Capabilities struct { diff --git a/pkg/protocols/gox/MS17-010.go b/pkg/protocols/gox/MS17-010.go index 8f1a30df..8891e8b8 100644 --- a/pkg/protocols/gox/MS17-010.go +++ b/pkg/protocols/gox/MS17-010.go @@ -11,7 +11,7 @@ import ( "fmt" "strings" - "github.com/zan8in/afrog/pkg/protocols/netxclient" + "github.com/zan8in/afrog/v3/pkg/protocols/netxclient" "github.com/zan8in/pins/netx" urlutil "github.com/zan8in/pins/url" ) diff --git a/pkg/protocols/gox/backdoored-zte.go b/pkg/protocols/gox/backdoored-zte.go index c9bec461..3f542c0e 100644 --- a/pkg/protocols/gox/backdoored-zte.go +++ b/pkg/protocols/gox/backdoored-zte.go @@ -3,7 +3,7 @@ package gox import ( "fmt" - "github.com/zan8in/afrog/pkg/protocols/netxclient" + "github.com/zan8in/afrog/v3/pkg/protocols/netxclient" "github.com/zan8in/pins/netx" urlutil "github.com/zan8in/pins/url" diff --git a/pkg/protocols/gox/backup-files.go b/pkg/protocols/gox/backup-files.go index 259d48a5..63e98d76 100644 --- a/pkg/protocols/gox/backup-files.go +++ b/pkg/protocols/gox/backup-files.go @@ -10,8 +10,8 @@ import ( "time" "github.com/remeh/sizedwaitgroup" - "github.com/zan8in/afrog/pkg/protocols/http/retryhttpclient" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/protocols/http/retryhttpclient" + "github.com/zan8in/afrog/v3/pkg/utils" "github.com/zan8in/gologger" iputil "github.com/zan8in/pins/ip" urlutil "github.com/zan8in/pins/url" diff --git a/pkg/protocols/gox/demo.go b/pkg/protocols/gox/demo.go index b654225c..4020bab4 100644 --- a/pkg/protocols/gox/demo.go +++ b/pkg/protocols/gox/demo.go @@ -7,8 +7,8 @@ import ( "net/http" "strings" - "github.com/zan8in/afrog/pkg/protocols/http/retryhttpclient" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/protocols/http/retryhttpclient" + "github.com/zan8in/afrog/v3/pkg/utils" "github.com/zan8in/retryablehttp" ) diff --git a/pkg/protocols/gox/ecology-filedownloadforoutdoc-sqli.go b/pkg/protocols/gox/ecology-filedownloadforoutdoc-sqli.go index 421010c0..92aed45f 100644 --- a/pkg/protocols/gox/ecology-filedownloadforoutdoc-sqli.go +++ b/pkg/protocols/gox/ecology-filedownloadforoutdoc-sqli.go @@ -10,8 +10,8 @@ import ( "strings" "time" - "github.com/zan8in/afrog/pkg/protocols/http/retryhttpclient" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/protocols/http/retryhttpclient" + "github.com/zan8in/afrog/v3/pkg/utils" randutil "github.com/zan8in/pins/rand" "github.com/zan8in/retryablehttp" ) diff --git a/pkg/protocols/gox/ftp-anonymous.go b/pkg/protocols/gox/ftp-anonymous.go index e4fc0ece..4ac4fea2 100644 --- a/pkg/protocols/gox/ftp-anonymous.go +++ b/pkg/protocols/gox/ftp-anonymous.go @@ -4,7 +4,7 @@ import ( "bytes" "fmt" - "github.com/zan8in/afrog/pkg/protocols/netxclient" + "github.com/zan8in/afrog/v3/pkg/protocols/netxclient" "github.com/zan8in/pins/netx" urlutil "github.com/zan8in/pins/url" diff --git a/pkg/protocols/gox/gox.go b/pkg/protocols/gox/gox.go index 88984659..25c95d47 100644 --- a/pkg/protocols/gox/gox.go +++ b/pkg/protocols/gox/gox.go @@ -4,7 +4,7 @@ import ( "fmt" "reflect" - "github.com/zan8in/afrog/pkg/proto" + "github.com/zan8in/afrog/v3/pkg/proto" "github.com/zan8in/gologger" ) diff --git a/pkg/protocols/http/retryhttpclient/client.go b/pkg/protocols/http/retryhttpclient/client.go index 92a85138..a7f57b50 100644 --- a/pkg/protocols/http/retryhttpclient/client.go +++ b/pkg/protocols/http/retryhttpclient/client.go @@ -12,9 +12,9 @@ import ( "strings" "time" - "github.com/zan8in/afrog/pkg/poc" - "github.com/zan8in/afrog/pkg/proto" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/poc" + "github.com/zan8in/afrog/v3/pkg/proto" + "github.com/zan8in/afrog/v3/pkg/utils" "github.com/zan8in/retryablehttp" "golang.org/x/net/context" ) @@ -192,7 +192,7 @@ func Request(target, cookie string, rule poc.Rule, variableMap map[string]any) e utf8RespBody := "" if len(respBody) > 0 { utf8RespBody = utils.Str2UTF8(string(respBody)) - // utf8RespBody := string(respBody) // fixed issue with https://github.com/zan8in/afrog/issues/68 + // utf8RespBody := string(respBody) // fixed issue with https://github.com/zan8in/afrog/v3/issues/68 } // store the response diff --git a/pkg/protocols/netxclient/netxclient.go b/pkg/protocols/netxclient/netxclient.go index 381c69b5..4a6f95e4 100644 --- a/pkg/protocols/netxclient/netxclient.go +++ b/pkg/protocols/netxclient/netxclient.go @@ -6,7 +6,7 @@ import ( "strings" "time" - "github.com/zan8in/afrog/pkg/proto" + "github.com/zan8in/afrog/v3/pkg/proto" "github.com/zan8in/pins/netx" ) diff --git a/pkg/protocols/raw/http.go b/pkg/protocols/raw/http.go index 0b174a81..bf880e72 100644 --- a/pkg/protocols/raw/http.go +++ b/pkg/protocols/raw/http.go @@ -9,8 +9,8 @@ import ( "strings" "time" - "github.com/zan8in/afrog/pkg/proto" - "github.com/zan8in/afrog/pkg/protocols/http/retryhttpclient" + "github.com/zan8in/afrog/v3/pkg/proto" + "github.com/zan8in/afrog/v3/pkg/protocols/http/retryhttpclient" "github.com/zan8in/rawhttp" ) diff --git a/pkg/report/cmd/main.go b/pkg/report/cmd/main.go index 4859b701..50744593 100644 --- a/pkg/report/cmd/main.go +++ b/pkg/report/cmd/main.go @@ -3,8 +3,8 @@ package main import ( "log" - "github.com/zan8in/afrog/pkg/report" - "github.com/zan8in/afrog/pkg/result" + "github.com/zan8in/afrog/v3/pkg/report" + "github.com/zan8in/afrog/v3/pkg/result" ) func main() { diff --git a/pkg/report/json.go b/pkg/report/json.go index 6b6d1602..ee29df94 100644 --- a/pkg/report/json.go +++ b/pkg/report/json.go @@ -10,7 +10,7 @@ import ( "sync" "time" - "github.com/zan8in/afrog/pkg/result" + "github.com/zan8in/afrog/v3/pkg/result" fileutil "github.com/zan8in/pins/file" timeutil "github.com/zan8in/pins/time" ) diff --git a/pkg/report/report.go b/pkg/report/report.go index 285b123f..986a6f3a 100644 --- a/pkg/report/report.go +++ b/pkg/report/report.go @@ -9,7 +9,7 @@ import ( "sync" "time" - "github.com/zan8in/afrog/pkg/result" + "github.com/zan8in/afrog/v3/pkg/result" fileutil "github.com/zan8in/pins/file" timeutil "github.com/zan8in/pins/time" ) diff --git a/pkg/result/result.go b/pkg/result/result.go index ebb3bb63..4484f89b 100644 --- a/pkg/result/result.go +++ b/pkg/result/result.go @@ -5,10 +5,10 @@ import ( "strconv" "strings" - "github.com/zan8in/afrog/pkg/log" - "github.com/zan8in/afrog/pkg/poc" - "github.com/zan8in/afrog/pkg/proto" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/log" + "github.com/zan8in/afrog/v3/pkg/poc" + "github.com/zan8in/afrog/v3/pkg/proto" + "github.com/zan8in/afrog/v3/pkg/utils" "github.com/zan8in/gologger" "gopkg.in/yaml.v2" ) diff --git a/pkg/runner/cel.go b/pkg/runner/cel.go index d51af23a..fc303c9f 100644 --- a/pkg/runner/cel.go +++ b/pkg/runner/cel.go @@ -11,7 +11,7 @@ import ( "github.com/google/cel-go/common/types" "github.com/google/cel-go/common/types/ref" "github.com/google/cel-go/interpreter/functions" - "github.com/zan8in/afrog/pkg/log" + "github.com/zan8in/afrog/v3/pkg/log" exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1" "gopkg.in/yaml.v2" ) diff --git a/pkg/runner/celcompile.go b/pkg/runner/celcompile.go index 83507126..2a2efaf4 100644 --- a/pkg/runner/celcompile.go +++ b/pkg/runner/celcompile.go @@ -4,7 +4,7 @@ import ( "github.com/google/cel-go/cel" "github.com/google/cel-go/checker/decls" "github.com/google/cel-go/common/types/ref" - "github.com/zan8in/afrog/pkg/proto" + "github.com/zan8in/afrog/v3/pkg/proto" exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1" ) diff --git a/pkg/runner/celprogram.go b/pkg/runner/celprogram.go index c1d9947b..c311192e 100644 --- a/pkg/runner/celprogram.go +++ b/pkg/runner/celprogram.go @@ -22,8 +22,8 @@ import ( "github.com/google/cel-go/common/types" "github.com/google/cel-go/common/types/ref" "github.com/google/cel-go/interpreter/functions" - "github.com/zan8in/afrog/pkg/proto" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/proto" + "github.com/zan8in/afrog/v3/pkg/utils" ) var ( diff --git a/pkg/runner/checker.go b/pkg/runner/checker.go index 1b0ecf49..4afb079f 100644 --- a/pkg/runner/checker.go +++ b/pkg/runner/checker.go @@ -7,17 +7,17 @@ import ( "sync" "time" - "github.com/zan8in/afrog/pkg/protocols/gox" - "github.com/zan8in/afrog/pkg/protocols/http/retryhttpclient" - "github.com/zan8in/afrog/pkg/protocols/netxclient" - "github.com/zan8in/afrog/pkg/protocols/raw" - "github.com/zan8in/afrog/pkg/result" + "github.com/zan8in/afrog/v3/pkg/protocols/gox" + "github.com/zan8in/afrog/v3/pkg/protocols/http/retryhttpclient" + "github.com/zan8in/afrog/v3/pkg/protocols/netxclient" + "github.com/zan8in/afrog/v3/pkg/protocols/raw" + "github.com/zan8in/afrog/v3/pkg/result" "github.com/google/cel-go/checker/decls" - "github.com/zan8in/afrog/pkg/config" - "github.com/zan8in/afrog/pkg/poc" - "github.com/zan8in/afrog/pkg/proto" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/config" + "github.com/zan8in/afrog/v3/pkg/poc" + "github.com/zan8in/afrog/v3/pkg/proto" + "github.com/zan8in/afrog/v3/pkg/utils" "gopkg.in/yaml.v2" ) diff --git a/pkg/runner/engine.go b/pkg/runner/engine.go index d30b1e36..9c5f3b9e 100644 --- a/pkg/runner/engine.go +++ b/pkg/runner/engine.go @@ -8,10 +8,10 @@ import ( "time" "github.com/panjf2000/ants/v2" - "github.com/zan8in/afrog/pkg/config" - "github.com/zan8in/afrog/pkg/log" - "github.com/zan8in/afrog/pkg/poc" - "github.com/zan8in/afrog/pkg/result" + "github.com/zan8in/afrog/v3/pkg/config" + "github.com/zan8in/afrog/v3/pkg/log" + "github.com/zan8in/afrog/v3/pkg/poc" + "github.com/zan8in/afrog/v3/pkg/result" "github.com/zan8in/gologger" ) @@ -208,7 +208,7 @@ func (runner *Runner) executeExpression(target string, poc *poc.Poc) { defer runner.engine.ReleaseChecker(c) defer func() { - // https://github.com/zan8in/afrog/issues/7 + // https://github.com/zan8in/afrog/v3/issues/7 if r := recover(); r != nil { c.Result.IsVul = false runner.OnResult(c.Result) diff --git a/pkg/runner/monitor.go b/pkg/runner/monitor.go index 5e411478..e3fd3df6 100644 --- a/pkg/runner/monitor.go +++ b/pkg/runner/monitor.go @@ -5,8 +5,8 @@ import ( "time" "github.com/remeh/sizedwaitgroup" - "github.com/zan8in/afrog/pkg/protocols/http/retryhttpclient" - "github.com/zan8in/afrog/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/protocols/http/retryhttpclient" + "github.com/zan8in/afrog/v3/pkg/utils" ) func (r *Runner) monitorTargets() { diff --git a/pkg/runner/runner.go b/pkg/runner/runner.go index 28756935..35896871 100644 --- a/pkg/runner/runner.go +++ b/pkg/runner/runner.go @@ -5,16 +5,16 @@ import ( "fmt" "strings" - "github.com/zan8in/afrog/pkg/catalog" - "github.com/zan8in/afrog/pkg/config" - "github.com/zan8in/afrog/pkg/cyberspace" - "github.com/zan8in/afrog/pkg/poc" - "github.com/zan8in/afrog/pkg/protocols/http/retryhttpclient" - "github.com/zan8in/afrog/pkg/report" - "github.com/zan8in/afrog/pkg/result" - "github.com/zan8in/afrog/pkg/utils" - "github.com/zan8in/afrog/pkg/webhook/dingtalk" - "github.com/zan8in/afrog/pocs" + "github.com/zan8in/afrog/v3/pkg/catalog" + "github.com/zan8in/afrog/v3/pkg/config" + "github.com/zan8in/afrog/v3/pkg/cyberspace" + "github.com/zan8in/afrog/v3/pkg/poc" + "github.com/zan8in/afrog/v3/pkg/protocols/http/retryhttpclient" + "github.com/zan8in/afrog/v3/pkg/report" + "github.com/zan8in/afrog/v3/pkg/result" + "github.com/zan8in/afrog/v3/pkg/utils" + "github.com/zan8in/afrog/v3/pkg/webhook/dingtalk" + "github.com/zan8in/afrog/v3/pocs" "github.com/zan8in/gologger" "github.com/zan8in/oobadapter/pkg/oobadapter" ) diff --git a/pkg/utils/utils.go b/pkg/utils/utils.go index 3a60dfaf..2eec2dea 100644 --- a/pkg/utils/utils.go +++ b/pkg/utils/utils.go @@ -12,7 +12,7 @@ import ( "time" "unicode/utf8" - "github.com/zan8in/afrog/pkg/proto" + "github.com/zan8in/afrog/v3/pkg/proto" "golang.org/x/text/encoding/simplifiedchinese" "golang.org/x/text/transform" ) diff --git a/pkg/web/template/List.html b/pkg/web/template/List.html new file mode 100644 index 00000000..b5ad16b1 --- /dev/null +++ b/pkg/web/template/List.html @@ -0,0 +1,514 @@ + + + + + + + Report List - Afrog A Security Tool for Bug Bounty, Pentest and Red Teaming. + + + + + + + +
+
+ + A F R O G   +
+ + + + + + +   + + +   + +   + Current: {{.CurrentDataCount}} + + +
+
+
+ {{if .}} + {{range $key, $value := .DataList}} + + + + + + + + + + {{range $key, $value := .ResultList}} + {{if or .Request .Response }} + + + + + + + {{end}} + {{end}} + +
+ + {{.VulID}}   + {{.Severity}}   + {{.FullTarget}} +
+ name: {{.PocInfo.Info.Name}}      author: {{.PocInfo.Info.Author}} + {{if .PocInfo.Info.Created}} +       created: {{.PocInfo.Info.Created}} + {{end}} + + {{if .PocInfo.Info.Description}} +
description: {{.PocInfo.Info.Description}} + {{end}} + + {{if .PocInfo.Info.Reference}} +
reference: + {{range $key, $value := .PocInfo.Info.Reference}} +
  - {{$value}} + {{end}} + {{end}} + + {{if .PocInfo.Info.Affected}} +
affected: {{.PocInfo.Info.Affected}} + {{end}} + + {{if .PocInfo.Info.Solutions}} +
solutions: {{.PocInfo.Info.Solutions}} + {{end}} + + +
{{.FullTarget}}
+
+
+
→
+ {{.Request}} +
+
+
←
+ {{.Response}} +
+
+
+ {{end}} + + +   + Page: 1  +   + Current: {{.CurrentDataCount}} + + + {{else}} + + + + +
No matching
+ {{end}} + + +
+ ↑ +
+ + + \ No newline at end of file diff --git a/pkg/web/web.go b/pkg/web/web.go index a225fdd7..5c73e953 100644 --- a/pkg/web/web.go +++ b/pkg/web/web.go @@ -5,8 +5,8 @@ import ( "net/http" "text/template" - "github.com/zan8in/afrog/pkg/db" - "github.com/zan8in/afrog/pkg/db/sqlite" + "github.com/zan8in/afrog/v3/pkg/db" + "github.com/zan8in/afrog/v3/pkg/db/sqlite" "github.com/zan8in/gologger" ) diff --git a/pocs/afrog-pocs/vulnerability/landray-oa-datajson-rce.yaml b/pocs/afrog-pocs/vulnerability/landray-oa-datajson-rce.yaml index 3ea3b870..e8abf67a 100644 --- a/pocs/afrog-pocs/vulnerability/landray-oa-datajson-rce.yaml +++ b/pocs/afrog-pocs/vulnerability/landray-oa-datajson-rce.yaml @@ -11,7 +11,7 @@ info: reference: - https://github.com/k3sc/Landray-oa-rce-1/blob/main/poc.py - https://github.com/hktalent/scan4all/blob/main/pocs_go/landray/Landray_RCE.go - - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/landray-oa-datajson-rce.yaml + - https://github.com/zan8in/afrog/v3/blob/main/v2/pocs/afrog-pocs/vulnerability/landray-oa-datajson-rce.yaml tags: landray,rce created: 2023/06/22 diff --git a/pocs/pocs.go b/pocs/pocs.go index eb6ee9d4..c5fd52e8 100644 --- a/pocs/pocs.go +++ b/pocs/pocs.go @@ -6,7 +6,7 @@ import ( "io/fs" "strings" - "github.com/zan8in/afrog/pkg/poc" + "github.com/zan8in/afrog/v3/pkg/poc" "gopkg.in/yaml.v2" ) diff --git a/v3/cmd/afrog/main.go b/v3/cmd/afrog/main.go deleted file mode 100644 index b7691f18..00000000 --- a/v3/cmd/afrog/main.go +++ /dev/null @@ -1,139 +0,0 @@ -package main - -import ( - "fmt" - "os" - "os/signal" - "strings" - "sync" - "sync/atomic" - "time" - - _ "net/http/pprof" - - "github.com/zan8in/afrog/pkg/config" - "github.com/zan8in/afrog/pkg/db/sqlite" - "github.com/zan8in/afrog/pkg/progress" - "github.com/zan8in/afrog/pkg/result" - "github.com/zan8in/afrog/pkg/runner" - "github.com/zan8in/afrog/pkg/utils" - "github.com/zan8in/gologger" -) - -func main() { - options, err := config.NewOptions() - if err != nil { - gologger.Error().Msg(err.Error()) - os.Exit(0) - } - - r, err := runner.NewRunner(options) - if err != nil { - gologger.Error().Msgf("Could not create runner: %s\n", err) - os.Exit(0) - } - - err = sqlite.InitX() - if err != nil { - gologger.Error().Msg(err.Error()) - os.Exit(0) - } - - var ( - lock = sync.Mutex{} - starttime = time.Now() - number uint32 - ) - r.OnResult = func(result *result.Result) { - - if !options.Silent { - defer func() { - atomic.AddUint32(&options.CurrentCount, 1) - if !options.Silent { - // 花里胡哨的进度条，看起来炫，实际并没什么卵用！ @edit 2024/01/03 - pgress := int(options.CurrentCount) * 100 / options.Count - // bar := progress.CreateProgressBar(pgress, 50, '|', '=') - // bar := progress.CreateProgressBar(pgress, 50, '▉', '░') 操蛋的 windows cmd 不兼容漂亮的进度条 - // fmt.Printf("\r%s %d%% (%d/%d), %s", bar, pgress, options.CurrentCount, options.Count, strings.Split(time.Since(starttime).String(), ".")[0]+"s") - // fmt.Printf("\r%d%% (%d/%d), %s", int(options.CurrentCount)*100/int(options.Count), options.CurrentCount, options.Count, strings.Split(time.Since(starttime).String(), ".")[0]+"s") - // fmt.Printf("\r%d/%d/%d%%/%s", options.CurrentCount, options.Count, int(options.CurrentCount)*100/int(options.Count), strings.Split(time.Since(starttime).String(), ".")[0]+"s") - fmt.Printf("\r[%s] %d%% (%d/%d), %s", progress.GetProgressBar(pgress, 0), pgress, options.CurrentCount, options.Count, strings.Split(time.Since(starttime).String(), ".")[0]+"s") - } - }() - } - - if result.IsVul { - lock.Lock() - - atomic.AddUint32(&number, 1) - result.PrintColorResultInfoConsole(utils.GetNumberText(int(number))) - - go sqlite.SetResultX(result) - - if options.Dingtalk { - go r.Ding.SendMarkDownMessageBySlice("From afrog vulnerability Notice", r.Ding.MarkdownText(result.PocInfo.Id, result.PocInfo.Info.Severity, result.FullTarget)) - } - - if !options.DisableOutputHtml { - r.Report.SetResult(result) - r.Report.Append(utils.GetNumberText(int(number))) - } - - if len(options.Json) > 0 || len(options.JsonAll) > 0 { - r.JsonReport.SetResult(result) - r.JsonReport.Append() - } - - if options.VulnerabilityScannerBreakpoint { - os.Exit(0) - } - - lock.Unlock() - } - - if options.Debug { - result.Debug() - } - - } - - // Setup graceful exits - // resumeFileName := types.DefaultResumeFilePath() - c := make(chan os.Signal, 1) - defer close(c) - signal.Notify(c, os.Interrupt) - go func(runner *runner.Runner) { - for range c { - gologger.Print().Msg("") - gologger.Info().Msg("CTRL+C pressed: Exiting") - // gologger.Info().Msgf("Current scan progress: %s\n", runner.ScanProgress.String()) - - resumeFileName, err := runner.ScanProgress.SaveScanProgress() - if len(resumeFileName) > 0 { - gologger.Info().Msgf("Creating resume file: %s\n", resumeFileName) - gologger.Info().Msgf("Resume Example: afrog -resume %s\n", resumeFileName) - } - if err != nil { - gologger.Error().Msgf("Couldn't create resume file: %s\n", err) - } - os.Exit(0) - } - }(r) - - if err := r.Run(); err != nil { - gologger.Error().Msgf("runner run err: %s\n", err) - os.Exit(0) - } - - if len(options.Json) > 0 || len(options.JsonAll) > 0 { - if err := r.JsonReport.AppendEndOfFile(); err != nil { - gologger.Error().Msgf("json or json-all output err: %s\n", err) - os.Exit(0) - } - } - - time.Sleep(time.Second * 3) - gologger.Print().Msg("") - - sqlite.CloseX() -}