mirror of
https://github.com/shmilylty/OneForAll.git
synced 2026-08-25 20:37:48 +08:00
translate
This commit is contained in:
@@ -31,7 +31,7 @@ class CensysAPI(Query):
|
||||
json = resp.json()
|
||||
status = json.get('status')
|
||||
if status != 'ok':
|
||||
logger.log('ALERT', status)
|
||||
logger.log('ALERT', f'{self.source} module {status}')
|
||||
return
|
||||
subdomains = self.match_subdomains(self.domain, str(json))
|
||||
self.subdomains = self.subdomains.union(subdomains)
|
||||
|
||||
@@ -17,8 +17,9 @@ from config.log import logger
|
||||
|
||||
class CheckAXFR(Module):
|
||||
"""
|
||||
DNS域传送漏洞检查类
|
||||
DNS zone transfer vulnerability base class
|
||||
"""
|
||||
|
||||
def __init__(self, domain: str):
|
||||
Module.__init__(self)
|
||||
self.domain = self.register(domain)
|
||||
@@ -28,18 +29,18 @@ class CheckAXFR(Module):
|
||||
|
||||
def axfr(self, server):
|
||||
"""
|
||||
执行域传送
|
||||
Perform domain transfer
|
||||
|
||||
:param server: 域名服务器
|
||||
:param server: domain server
|
||||
"""
|
||||
logger.log('DEBUG', f'尝试对{self.domain}的域名服务器{server}进行域传送')
|
||||
logger.log('DEBUG', f'Trying to perform domain transfer in {server} of {self.domain}')
|
||||
try:
|
||||
xfr = dns.query.xfr(where=server, zone=self.domain,
|
||||
timeout=5.0, lifetime=10.0)
|
||||
zone = dns.zone.from_xfr(xfr)
|
||||
except Exception as e:
|
||||
logger.log('DEBUG', e.args)
|
||||
logger.log('DEBUG', f'对{self.domain}的域名服务器{server}进行域传送失败')
|
||||
logger.log('DEBUG', f'Domain transfer to server {server} of {self.domain} failed')
|
||||
return
|
||||
names = zone.nodes.keys()
|
||||
for name in names:
|
||||
@@ -49,13 +50,13 @@ class CheckAXFR(Module):
|
||||
record = zone[name].to_text(name)
|
||||
self.results.append(record)
|
||||
if self.results:
|
||||
logger.log('DEBUG', f'发现{self.domain}在{server}上的域传送记录')
|
||||
logger.log('DEBUG', f'Found the domain transfer record of {self.domain} on {server}')
|
||||
logger.log('DEBUG', '\n'.join(self.results))
|
||||
self.results = []
|
||||
|
||||
def check(self):
|
||||
"""
|
||||
正则匹配响应头中的内容安全策略字段以发现子域名
|
||||
check
|
||||
"""
|
||||
resolver = utils.dns_resolver()
|
||||
try:
|
||||
@@ -65,7 +66,7 @@ class CheckAXFR(Module):
|
||||
return
|
||||
nsservers = [str(answer) for answer in answers]
|
||||
if not len(nsservers):
|
||||
logger.log('ALERT', f'没有找到{self.domain}的NS域名服务器记录')
|
||||
logger.log('ALERT', f'No name server record found for {self.domain}')
|
||||
return
|
||||
for nsserver in nsservers:
|
||||
self.axfr(nsserver)
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
"""
|
||||
检查内容安全策略收集子域名收集子域名
|
||||
Collect subdomains from ContentSecurityPolicy
|
||||
"""
|
||||
import requests
|
||||
|
||||
@@ -10,7 +10,7 @@ from config.log import logger
|
||||
|
||||
class CheckCSP(Module):
|
||||
"""
|
||||
检查内容安全策略收集子域名
|
||||
Collect subdomains from ContentSecurityPolicy
|
||||
"""
|
||||
def __init__(self, domain, header):
|
||||
Module.__init__(self)
|
||||
@@ -21,9 +21,9 @@ class CheckCSP(Module):
|
||||
|
||||
def grab_header(self):
|
||||
"""
|
||||
抓取请求头
|
||||
Get header
|
||||
|
||||
:return: 请求头
|
||||
:return: ContentSecurityPolicy header
|
||||
"""
|
||||
csp_header = dict()
|
||||
urls = [f'http://{self.domain}',
|
||||
@@ -47,10 +47,10 @@ class CheckCSP(Module):
|
||||
self.csp_header = self.grab_header()
|
||||
csp = self.header.get('Content-Security-Policy')
|
||||
if not self.csp_header:
|
||||
logger.log('DEBUG', f'获取{self.domain}域的请求头失败')
|
||||
logger.log('DEBUG', f'Failed to get header of {self.domain} domain')
|
||||
return
|
||||
if not csp:
|
||||
logger.log('DEBUG', f'{self.domain}域的响应头不存在内容安全策略字段')
|
||||
logger.log('DEBUG', f'There is no Content-Security-Policy in the header of {self.domain}')
|
||||
return
|
||||
self.subdomains = self.match_subdomains(self.domain, csp)
|
||||
|
||||
|
||||
@@ -29,7 +29,7 @@ class Gitee(Search):
|
||||
if not resp:
|
||||
break
|
||||
if resp.status_code != 200:
|
||||
logger.log('ERROR', f'{self.source}模块搜索出错')
|
||||
logger.log('ERROR', f'{self.source} module query failed')
|
||||
break
|
||||
if 'class="empty-box"' in resp.text:
|
||||
break
|
||||
|
||||
@@ -46,7 +46,7 @@ class GithubAPI(Search):
|
||||
{'Accept': 'application/vnd.github.v3.text-match+json'})
|
||||
|
||||
if not self.auth_github():
|
||||
logger.log('ERROR', f'{self.source}模块登录失败')
|
||||
logger.log('ERROR', f'{self.source} module login failed')
|
||||
return
|
||||
page = 1
|
||||
while True:
|
||||
@@ -58,7 +58,7 @@ class GithubAPI(Search):
|
||||
logger.log('ERROR', e.args)
|
||||
break
|
||||
if resp.status_code != 200:
|
||||
logger.log('ERROR', f'{self.source}模块搜索出错')
|
||||
logger.log('ERROR', f'{self.source} module query failed')
|
||||
break
|
||||
subdomains = self.match_subdomains(self.domain, resp.text)
|
||||
if not subdomains:
|
||||
|
||||
@@ -23,11 +23,11 @@ class ZoomEyeAPI(Search):
|
||||
data = {'username': self.user, 'password': self.pwd}
|
||||
resp = self.post(url=url, json=data)
|
||||
if not resp:
|
||||
logger.log('FATAL', f'登录失败无法获取{self.source}的访问token')
|
||||
logger.log('FATAL', f'{self.source} module login failed, can not get access token')
|
||||
exit(1)
|
||||
data = resp.json()
|
||||
if resp.status_code == 200:
|
||||
logger.log('DEBUG', f'{self.source}模块登录成功')
|
||||
logger.log('DEBUG', f'{self.source} module login success')
|
||||
return data.get('access_token')
|
||||
else:
|
||||
logger.log('ALERT', data.get('message'))
|
||||
|
||||
Reference in New Issue
Block a user