From 01a93d44a95673df621c90e793935840b8e2195a Mon Sep 17 00:00:00 2001 From: Jing Ling Date: Wed, 26 Aug 2020 10:25:32 +0800 Subject: [PATCH 1/6] typos --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f54c85c..701be30 100644 --- a/README.md +++ b/README.md @@ -110,9 +110,9 @@ pipenv run python oneforall.py --target example.com run ``` 3. 开启爆破模块运行（使用massdns进行爆破，网络占用极大，可能会阻塞网络） ```bash -python3 run python oneforall.py --target example.com --burte True run +python3 run python oneforall.py --target example.com --brute True run # or -pipenv run python oneforall.py --target example.com --burte True run +pipenv run python oneforall.py --target example.com --brute True run ``` From ea9249a939e5241f4741b70ea8521b98cc9ebd73 Mon Sep 17 00:00:00 2001 From: Jing Ling Date: Wed, 26 Aug 2020 10:45:06 +0800 Subject: [PATCH 2/6] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E8=A7=A3=E7=A0=81?= =?UTF-8?q?=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- common/utils.py | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/common/utils.py b/common/utils.py index a8f3f90..b4ffa16 100644 --- a/common/utils.py +++ b/common/utils.py @@ -719,11 +719,17 @@ def get_url_resp(url): def decode_resp_text(resp): + content = resp.content + if not content: + return str('') try: - text = resp.text(encoding='utf-8', errors='strict') # 先尝试用utf-8严格解码 - except UnicodeError: + # 先尝试用utf-8严格解码 + content = str(content, encoding='utf-8', errors='strict') + except (LookupError, TypeError, UnicodeError): try: - text = resp.text(encoding='gb18030', errors='strict') # 再尝试用gb18030严格解码 - except UnicodeError: - text = resp.text(encoding=None, errors='ignore') # 最后尝试自动解码 - return text + # 再尝试用gb18030严格解码 + content = str(content, encoding='gb18030', errors='strict') + except (LookupError, TypeError, UnicodeError): + # 最后尝试自动解码 + content = str(content, errors='replace') + return content From 575879c88c57a6a1fcd3866183780b17fc2da72b Mon Sep 17 00:00:00 2001 From: Jing Ling Date: Wed, 26 Aug 2020 12:34:32 +0800 Subject: [PATCH 3/6] =?UTF-8?q?=E8=B0=83=E6=95=B4=E8=AF=B7=E6=B1=82?= =?UTF-8?q?=E6=8A=A5=E9=94=99=E6=97=A5=E5=BF=97=E7=AD=89=E7=BA=A7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- takeover.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/takeover.py b/takeover.py index 681be82..9d3b37d 100644 --- a/takeover.py +++ b/takeover.py @@ -83,8 +83,8 @@ class Takeover(Module): utils.save_data(self.path, data) def compare(self, subdomain, cname, responses): - domain_resp = self.get('http://' + subdomain, check=False) - cname_resp = self.get('http://' + cname, check=False) + domain_resp = self.get('http://' + subdomain, check=False, ignore=True) + cname_resp = self.get('http://' + cname, check=False, ignore=True) if domain_resp is None or cname_resp is None: return @@ -164,4 +164,3 @@ class Takeover(Module): if __name__ == '__main__': fire.Fire(Takeover) - From 9b4615e32442056c09ed33caf0503fe4ae3c3152 Mon Sep 17 00:00:00 2001 From: Jing Ling Date: Wed, 26 Aug 2020 12:38:55 +0800 Subject: [PATCH 4/6] typos --- takeover.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/takeover.py b/takeover.py index 9d3b37d..878a915 100644 --- a/takeover.py +++ b/takeover.py @@ -90,7 +90,7 @@ class Takeover(Module): for resp in responses: if resp in domain_resp.text and resp in cname_resp.text: - logger.log('ALERT', f'{subdomain}Subdomain takeover threat found') + logger.log('ALERT', f'{subdomain} takeover threat found') self.results.append([subdomain, cname]) break @@ -142,13 +142,13 @@ class Takeover(Module): # 创建待检查的子域队列 for domain in self.subdomains: self.subdomainq.put(domain) + # 进度线程 + progress_thread = Thread(target=self.progress) + progress_thread.start() # 检查线程 for _ in range(self.thread): - check_thread = Thread(target=self.check, daemon=True) + check_thread = Thread(target=self.check) check_thread.start() - # 进度线程 - progress_thread = Thread(target=self.progress, daemon=True) - progress_thread.start() self.subdomainq.join() self.save() From 3b74f932a2e4d415206fe1572d8cd579c5b20451 Mon Sep 17 00:00:00 2001 From: Jing Ling Date: Wed, 26 Aug 2020 12:39:38 +0800 Subject: [PATCH 5/6] =?UTF-8?q?=E4=B8=B4=E6=97=B6=E8=B0=83=E6=95=B4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- test.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test.py b/test.py index e59c64f..4e63e5b 100644 --- a/test.py +++ b/test.py @@ -8,7 +8,7 @@ Example from oneforall import OneForAll if __name__ == '__main__': - test = OneForAll(target='mi.com') + test = OneForAll(target='freebuf.com') test.brute = True test.req = True test.takeover = True From 2189af880525fbcb4651b31720006f5098487195 Mon Sep 17 00:00:00 2001 From: Jing Ling Date: Wed, 26 Aug 2020 13:09:39 +0800 Subject: [PATCH 6/6] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E8=BF=9B=E5=BA=A6?= =?UTF-8?q?=E6=9D=A1=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- common/request.py | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/common/request.py b/common/request.py index 1966793..af12eb0 100644 --- a/common/request.py +++ b/common/request.py @@ -113,6 +113,14 @@ def get_jump_urls(history): return urls +def get_progress_bar(total): + bar = tqdm.tqdm() + bar.total = total + bar.desc = 'Request Progress' + bar.ncols = 80 + return bar + + def get(url, resp_queue, session): timeout = settings.request_timeout_second redirect = settings.request_allow_redirect @@ -132,16 +140,13 @@ def request(urls_queue, resp_queue, session): urls_queue.task_done() -def progress(urls, resp_queue): - bar = tqdm.tqdm() - bar.total = len(urls) - bar.desc = 'Request Progress' - bar.ncols = 80 +def progress(bar, total, urls_queue): while True: - done = resp_queue.qsize() + remaining = urls_queue.qsize() + done = total - remaining bar.n = done bar.update() - if done == bar.total: + if remaining == 0: break @@ -163,10 +168,12 @@ def bulk_request(urls): resp_queue = Queue() for url in urls: urls_queue.put(url) + total = len(urls) session = get_session() thread_count = req_thread_count() + bar = get_progress_bar(total) - progress_thread = Thread(target=progress, args=(urls, resp_queue)) + progress_thread = Thread(target=progress, args=(bar, total, urls_queue)) progress_thread.start() for _ in range(thread_count):