translate

This commit is contained in:
JrD
2020-05-12 20:16:46 +08:00
parent 654b006a5b
commit 0258636827
11 changed files with 117 additions and 113 deletions
+1 -1
View File
@@ -31,7 +31,7 @@ class CensysAPI(Query):
json = resp.json()
status = json.get('status')
if status != 'ok':
logger.log('ALERT', status)
logger.log('ALERT', f'{self.source} module {status}')
return
subdomains = self.match_subdomains(self.domain, str(json))
self.subdomains = self.subdomains.union(subdomains)
+9 -8
View File
@@ -17,8 +17,9 @@ from config.log import logger
class CheckAXFR(Module):
"""
DNS域传送漏洞检查类
DNS zone transfer vulnerability base class
"""
def __init__(self, domain: str):
Module.__init__(self)
self.domain = self.register(domain)
@@ -28,18 +29,18 @@ class CheckAXFR(Module):
def axfr(self, server):
"""
执行域传送
Perform domain transfer
:param server: 域名服务器
:param server: domain server
"""
logger.log('DEBUG', f'尝试对{self.domain}的域名服务器{server}进行域传送')
logger.log('DEBUG', f'Trying to perform domain transfer in {server} of {self.domain}')
try:
xfr = dns.query.xfr(where=server, zone=self.domain,
timeout=5.0, lifetime=10.0)
zone = dns.zone.from_xfr(xfr)
except Exception as e:
logger.log('DEBUG', e.args)
logger.log('DEBUG', f'{self.domain}的域名服务器{server}进行域传送失败')
logger.log('DEBUG', f'Domain transfer to server {server} of {self.domain} failed')
return
names = zone.nodes.keys()
for name in names:
@@ -49,13 +50,13 @@ class CheckAXFR(Module):
record = zone[name].to_text(name)
self.results.append(record)
if self.results:
logger.log('DEBUG', f'发现{self.domain}{server}上的域传送记录')
logger.log('DEBUG', f'Found the domain transfer record of {self.domain} on {server}')
logger.log('DEBUG', '\n'.join(self.results))
self.results = []
def check(self):
"""
正则匹配响应头中的内容安全策略字段以发现子域名
check
"""
resolver = utils.dns_resolver()
try:
@@ -65,7 +66,7 @@ class CheckAXFR(Module):
return
nsservers = [str(answer) for answer in answers]
if not len(nsservers):
logger.log('ALERT', f'没有找到{self.domain}的NS域名服务器记录')
logger.log('ALERT', f'No name server record found for {self.domain}')
return
for nsserver in nsservers:
self.axfr(nsserver)
+6 -6
View File
@@ -1,5 +1,5 @@
"""
检查内容安全策略收集子域名收集子域名
Collect subdomains from ContentSecurityPolicy
"""
import requests
@@ -10,7 +10,7 @@ from config.log import logger
class CheckCSP(Module):
"""
检查内容安全策略收集子域名
Collect subdomains from ContentSecurityPolicy
"""
def __init__(self, domain, header):
Module.__init__(self)
@@ -21,9 +21,9 @@ class CheckCSP(Module):
def grab_header(self):
"""
抓取请求头
Get header
:return: 请求头
:return: ContentSecurityPolicy header
"""
csp_header = dict()
urls = [f'http://{self.domain}',
@@ -47,10 +47,10 @@ class CheckCSP(Module):
self.csp_header = self.grab_header()
csp = self.header.get('Content-Security-Policy')
if not self.csp_header:
logger.log('DEBUG', f'获取{self.domain}域的请求头失败')
logger.log('DEBUG', f'Failed to get header of {self.domain} domain')
return
if not csp:
logger.log('DEBUG', f'{self.domain}域的响应头不存在内容安全策略字段')
logger.log('DEBUG', f'There is no Content-Security-Policy in the header of {self.domain}')
return
self.subdomains = self.match_subdomains(self.domain, csp)
+1 -1
View File
@@ -29,7 +29,7 @@ class Gitee(Search):
if not resp:
break
if resp.status_code != 200:
logger.log('ERROR', f'{self.source}模块搜索出错')
logger.log('ERROR', f'{self.source} module query failed')
break
if 'class="empty-box"' in resp.text:
break
+2 -2
View File
@@ -46,7 +46,7 @@ class GithubAPI(Search):
{'Accept': 'application/vnd.github.v3.text-match+json'})
if not self.auth_github():
logger.log('ERROR', f'{self.source}模块登录失败')
logger.log('ERROR', f'{self.source} module login failed')
return
page = 1
while True:
@@ -58,7 +58,7 @@ class GithubAPI(Search):
logger.log('ERROR', e.args)
break
if resp.status_code != 200:
logger.log('ERROR', f'{self.source}模块搜索出错')
logger.log('ERROR', f'{self.source} module query failed')
break
subdomains = self.match_subdomains(self.domain, resp.text)
if not subdomains:
+2 -2
View File
@@ -23,11 +23,11 @@ class ZoomEyeAPI(Search):
data = {'username': self.user, 'password': self.pwd}
resp = self.post(url=url, json=data)
if not resp:
logger.log('FATAL', f'登录失败无法获取{self.source}的访问token')
logger.log('FATAL', f'{self.source} module login failed, can not get access token')
exit(1)
data = resp.json()
if resp.status_code == 200:
logger.log('DEBUG', f'{self.source}模块登录成功')
logger.log('DEBUG', f'{self.source} module login success')
return data.get('access_token')
else:
logger.log('ALERT', data.get('message'))