增加常见Web应用端口

This commit is contained in:
Jing Ling
2020-02-01 22:39:58 +08:00
parent 6cc6341e3a
commit d2e350b851
3 changed files with 228 additions and 223 deletions
+2 -2
View File
@@ -31,8 +31,8 @@ def get_ports(port):
elif isinstance(port, int): elif isinstance(port, int):
if 0 <= port <= 65535: if 0 <= port <= 65535:
ports = {port} ports = {port}
elif port in {'default', 'small', 'medium', 'large'}: elif port in {'default', 'small', 'large'}:
logger.log('INFOR', f'探测{port}等端口范围') logger.log('DEBUG', f'探测{port}等端口范围')
ports = config.ports.get(port) ports = config.ports.get(port)
if not ports: # 意外情况 if not ports: # 意外情况
logger.log('ERROR', f'指定探测端口范围有误') logger.log('ERROR', f'指定探测端口范围有误')
+225 -220
View File
@@ -1,220 +1,225 @@
# coding=utf-8 # coding=utf-8
""" """
OneForAll配置 OneForAll配置
""" """
import os import os
import sys import sys
import pathlib import pathlib
import urllib3 import urllib3
from loguru import logger from loguru import logger
# 路径设置 # 路径设置
oneforall_relpath = pathlib.Path(__file__).parent # oneforall代码相对路径 oneforall_relpath = pathlib.Path(__file__).parent # oneforall代码相对路径
oneforall_abspath = oneforall_relpath.resolve() # oneforall代码绝对路径 oneforall_abspath = oneforall_relpath.resolve() # oneforall代码绝对路径
oneforall_module_path = oneforall_relpath.joinpath('modules') # oneforall模块目录 oneforall_module_path = oneforall_relpath.joinpath('modules') # oneforall模块目录
data_storage_path = oneforall_relpath.joinpath('data') # 数据存放目录 data_storage_path = oneforall_relpath.joinpath('data') # 数据存放目录
result_save_path = oneforall_relpath.joinpath('results') # 结果保存目录 result_save_path = oneforall_relpath.joinpath('results') # 结果保存目录
# 模块设置 # 模块设置
save_module_result = False # 保存各模块发现结果为json文件(默认False) save_module_result = False # 保存各模块发现结果为json文件(默认False)
enable_all_module = True # 启用所有模块(默认True) enable_all_module = True # 启用所有模块(默认True)
enable_partial_module = [] # 启用部分模块 必须禁用enable_all_module才能生效 enable_partial_module = [] # 启用部分模块 必须禁用enable_all_module才能生效
# 只使用ask和baidu搜索引擎收集子域 # 只使用ask和baidu搜索引擎收集子域
# enable_partial_module = [('modules.search', 'ask') # enable_partial_module = [('modules.search', 'ask')
# ('modules.search', 'baidu')] # ('modules.search', 'baidu')]
# 爆破模块设置 # 爆破模块设置
enable_brute_module = False # 使用爆破模块(默认禁用) enable_brute_module = False # 使用爆破模块(默认禁用)
enable_dns_resolve = True # DNS解析子域(默认True) enable_dns_resolve = True # DNS解析子域(默认True)
enable_http_request = True # HTTP请求子域(默认True) enable_http_request = True # HTTP请求子域(默认True)
enable_wildcard_check = True # 开启泛解析检测 会去掉泛解析的子域 enable_wildcard_check = True # 开启泛解析检测 会去掉泛解析的子域
# 爆破时使用的进程数(根据系统中CPU数量情况设置 不宜大于CPU数量 默认为系统中的CPU数量) # 爆破时使用的进程数(根据系统中CPU数量情况设置 不宜大于CPU数量 默认为系统中的CPU数量)
brute_process_num = os.cpu_count() brute_process_num = os.cpu_count()
brute_coroutine_num = 1024 # 爆破时每个进程下的协程数 brute_coroutine_num = 1024 # 爆破时每个进程下的协程数
# 爆破所使用的字典路径 默认data/subdomains.txt # 爆破所使用的字典路径 默认data/subdomains.txt
brute_wordlist_path = data_storage_path.joinpath('subnames.txt') brute_wordlist_path = data_storage_path.joinpath('subnames.txt')
enable_recursive_brute = False # 是否使用递归爆破(默认禁用) enable_recursive_brute = False # 是否使用递归爆破(默认禁用)
brute_recursive_depth = 2 # 递归爆破深度(默认2层) brute_recursive_depth = 2 # 递归爆破深度(默认2层)
# 爆破下一层子域所使用的字典路径 默认data/next_subdomains.txt # 爆破下一层子域所使用的字典路径 默认data/next_subdomains.txt
recursive_namelist_path = data_storage_path.joinpath('next_subnames.txt') recursive_namelist_path = data_storage_path.joinpath('next_subnames.txt')
enable_fuzz = False # 是否使用fuzz模式枚举域名 enable_fuzz = False # 是否使用fuzz模式枚举域名
fuzz_rule = '' # fuzz域名的正则 示例:[a-z][0-9] 第一位是字母 第二位是数字 fuzz_rule = '' # fuzz域名的正则 示例:[a-z][0-9] 第一位是字母 第二位是数字
ips_appear_maximum = 10 # 同一IP集合出现次数超过10认为是泛解析 ips_appear_maximum = 10 # 同一IP集合出现次数超过10认为是泛解析
# 代理设置 # 代理设置
enable_proxy = False # 是否使用代理(全局开关) enable_proxy = False # 是否使用代理(全局开关)
proxy_all_module = False # 代理所有模块 proxy_all_module = False # 代理所有模块
proxy_partial_module = ['GoogleQuery', 'AskSearch', 'DuckDuckGoSearch', proxy_partial_module = ['GoogleQuery', 'AskSearch', 'DuckDuckGoSearch',
'GoogleAPISearch', 'GoogleSearch', 'YahooSearch', 'GoogleAPISearch', 'GoogleSearch', 'YahooSearch',
'YandexSearch', 'CrossDomainXml', 'YandexSearch', 'CrossDomainXml',
'ContentSecurityPolicy'] # 代理自定义的模块 'ContentSecurityPolicy'] # 代理自定义的模块
proxy_pool = [{'http': 'http://127.0.0.1:1080', proxy_pool = [{'http': 'http://127.0.0.1:1080',
'https': 'https://127.0.0.1:1080'}] # 代理池 'https': 'https://127.0.0.1:1080'}] # 代理池
# proxy_pool = [{'http': 'socks5h://127.0.0.1:10808', # proxy_pool = [{'http': 'socks5h://127.0.0.1:10808',
# 'https': 'socks5h://127.0.0.1:10808'}] # 代理池 # 'https': 'socks5h://127.0.0.1:10808'}] # 代理池
# 网络请求设置 # 网络请求设置
enable_fake_header = True # 启用伪造请求头 enable_fake_header = True # 启用伪造请求头
request_delay = 1 # 请求时延 request_delay = 1 # 请求时延
request_timeout = 30 # 请求超时 request_timeout = 30 # 请求超时
request_verify = False # 请求SSL验证 request_verify = False # 请求SSL验证
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) # 禁用安全警告信息 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) # 禁用安全警告信息
# 搜索模块设置 # 搜索模块设置
enable_recursive_search = False # 递归搜索子域 enable_recursive_search = False # 递归搜索子域
search_recursive_times = 2 # 递归搜索层数 search_recursive_times = 2 # 递归搜索层数
# DNS解析设置 # DNS解析设置
resolver_nameservers = [ resolver_nameservers = [
'119.29.29.29', '182.254.116.116', # DNSPod '119.29.29.29', '182.254.116.116', # DNSPod
'180.76.76.76', # Baidu DNS '180.76.76.76', # Baidu DNS
'223.5.5.5', '223.6.6.6', # AliDNS '223.5.5.5', '223.6.6.6', # AliDNS
'114.114.114.114', '114.114.115.115' # 114DNS '114.114.114.114', '114.114.115.115' # 114DNS
# '8.8.8.8', '8.8.4.4', # Google DNS # '8.8.8.8', '8.8.4.4', # Google DNS
# '1.0.0.1', '1.1.1.1' # CloudFlare DNS # '1.0.0.1', '1.1.1.1' # CloudFlare DNS
# '208.67.222.222', '208.67.220.220' # OpenDNS # '208.67.222.222', '208.67.220.220' # OpenDNS
] # 指定查询的DNS域名服务器 ] # 指定查询的DNS域名服务器
resolver_timeout = 5.0 # 解析超时时间 resolver_timeout = 5.0 # 解析超时时间
resolver_lifetime = 30.0 # 解析存活时间 resolver_lifetime = 30.0 # 解析存活时间
limit_resolve_conn = 500 # 限制同一时间解析的数量(默认500) limit_resolve_conn = 500 # 限制同一时间解析的数量(默认500)
# 请求端口探测设置 # 请求端口探测设置
default_ports = {80} # 默认使用 default_ports = {80} # 默认使用
small_ports = {80, 443, 8000, 8080, 8443} small_ports = {80, 443, 8000, 8080, 8443}
medium_ports = {80, 81, 443, 591, 2082, 2087, 2095, 2096, 3000, 8000, 8001, # 可以在这里面添加端口
8008, 8080, 8083, 8443, 8834, 8888} large_ports = {80, 81, 280, 300, 443, 591, 593, 832, 888, 901, 981, 1010, 1080,
large_ports = {80, 81, 300, 443, 591, 593, 832, 888, 981, 1010, 1311, 2082, 1100, 1241, 1311, 1352, 1434, 1521, 1527, 1582, 1583, 1944, 2082,
2087, 2095, 2096, 2480, 3000, 3128, 3333, 4243, 4567, 4711, 2082, 2086, 2087, 2095, 2096, 2222, 2301, 2480, 3000, 3128, 3333,
4712, 4993, 5000, 5104, 5108, 5800, 6543, 7000, 7396, 7474, 4000, 4001, 4002, 4100, 4125, 4243, 4443, 4444, 4567, 4711, 4712,
8000, 8001, 8008, 8014, 8042, 8069, 8080, 8081, 8088, 8090, 4993, 5000, 5104, 5108, 5432, 5555, 5800, 5801, 5802, 5984, 5985,
8091, 8016, 8118, 8123, 8172, 8222, 8243, 8280, 8281, 8333, 5986, 6082, 6225, 6346, 6347, 6443, 6480, 6543, 6789, 7000, 7001,
8443, 8500, 8834, 8880, 8888, 8983, 9000, 9043, 9060, 9080, 7002, 7396, 7474, 4848, 4849, 7674, 7675, 7777, 7778, 8000, 8001,
9090, 9091, 9200, 9443, 9800, 9981, 12443, 16080, 18091, 18092, 8002, 8003, 8004, 8005, 8006, 8008, 8009, 8010, 8014, 8042, 8069,
20720, 28017} # 可以在这里面添加端口 8075, 8080, 8081, 8083, 8088, 8090, 8091, 8092, 8093, 8016, 8118,
ports = {'default': default_ports, 'small': small_ports, 8123, 8172, 8181, 8200, 8222, 8243, 8280, 8281, 8333, 8384, 8403,
'medium': medium_ports, 'large': large_ports} 8443, 8500, 8530, 8531, 8800, 8806, 8834, 8880, 8887, 8888, 8910,
verify_ssl = False 8983, 8989, 8990, 8991, 9000, 9043, 9060, 9080, 9090, 9091, 9200,
# aiohttp 支持 HTTP/HTTPS形式的代理 9294, 9295, 9443, 9444, 9800, 9981, 9988, 9990, 9999, 10000,
get_proxy = None # proxy="http://user:pass@some.proxy.com" 10880, 11371, 12043, 12046, 12443, 15672, 16225, 16080, 18091,
get_timeout = 200 # http请求探测总超时时间 None或者0则表示不检测超时 18092, 20000, 20720, 24465, 28017, 28080, 30821, 43110, 61600}
get_redirects = True # 允许请求跳转 ports = {'default': default_ports, 'small': small_ports, 'large': large_ports}
fake_header = True # 使用伪造请求头 verify_ssl = False
# aiohttp 支持 HTTP/HTTPS形式的代理
# 限制同一时间打开的连接总数 get_proxy = None # proxy="http://user:pass@some.proxy.com"
limit_open_conn = 500 # 默认500 get_timeout = 200 # http请求探测总超时时间 None或者0则表示不检测超时
get_redirects = True # 允许请求跳转
# 限制同一时间在同一个端点((host, port, is_ssl) 3者都一样的情况)打开的连接数 fake_header = True # 使用伪造请求头
limit_per_host = 50 # 默认0表示不限制
# 限制同一时间打开的连接总数
# 模块API配置 limit_open_conn = 500 # 默认500
# Censys可以免费注册获取APIhttps://censys.io/api
censys_api_id = '' # 限制同一时间在同一个端点((host, port, is_ssl) 3者都一样的情况)打开的连接数
censys_api_secret = '' limit_per_host = 50 # 默认0表示不限制
# Binaryedge可以免费注册获取APIhttps://app.binaryedge.io/account/api # 模块API配置
# 免费的API有效期只有1个月,到期之后可以再次生成,每月可以查询250次。 # Censys可以免费注册获取APIhttps://censys.io/api
binaryedge_api = '' censys_api_id = ''
censys_api_secret = ''
# Chinaz可以免费注册获取APIhttp://api.chinaz.com/ApiDetails/Alexa
chinaz_api = '' # Binaryedge可以免费注册获取APIhttps://app.binaryedge.io/account/api
# 免费的API有效期只有1个月,到期之后可以再次生成,每月可以查询250次。
# Bing可以免费注册获取APIhttps://azure.microsoft.com/zh-cn/services/ binaryedge_api = ''
# cognitive-services/bing-web-search-api/#web-json
bing_api_id = '' # Chinaz可以免费注册获取APIhttp://api.chinaz.com/ApiDetails/Alexa
bing_api_key = '' chinaz_api = ''
# SecurityTrails可以免费注册获取APIhttps://securitytrails.com/corp/api # Bing可以免费注册获取APIhttps://azure.microsoft.com/zh-cn/services/
securitytrails_api = '' # cognitive-services/bing-web-search-api/#web-json
bing_api_id = ''
# https://fofa.so/api bing_api_key = ''
fofa_api_email = '' # fofa用户邮箱
fofa_api_key = '' # fofa用户key # SecurityTrails可以免费注册获取APIhttps://securitytrails.com/corp/api
securitytrails_api = ''
# Google可以免费注册获取API:
# https://developers.google.com/custom-search/v1/overview # https://fofa.so/api
# 免费的API只能查询前100条结果 fofa_api_email = '' # fofa用户邮箱
google_api_key = '' # Google API搜索key fofa_api_key = '' # fofa用户key
google_api_cx = '' # Google API搜索cx
# Google可以免费注册获取API:
# https://api.passivetotal.org/api/docs/ # https://developers.google.com/custom-search/v1/overview
riskiq_api_username = '' # 免费的API只能查询前100条结果
riskiq_api_key = '' google_api_key = '' # Google API搜索key
google_api_cx = '' # Google API搜索cx
# Shodan可以免费注册获取API: https://account.shodan.io/register
# 免费的API限速1秒查询1次 # https://api.passivetotal.org/api/docs/
shodan_api_key = '' riskiq_api_username = ''
# ThreatBook API 查询子域名需要收费 https://x.threatbook.cn/nodev4/vb4/myAPI riskiq_api_key = ''
threatbook_api_key = ''
# Shodan可以免费注册获取API: https://account.shodan.io/register
# VirusTotal可以免费注册获取API: https://developers.virustotal.com/reference # 免费的API限速1秒查询1次
virustotal_api_key = '' shodan_api_key = ''
# ThreatBook API 查询子域名需要收费 https://x.threatbook.cn/nodev4/vb4/myAPI
# https://www.zoomeye.org/doc?channel=api threatbook_api_key = ''
zoomeye_api_username = ''
zoomeye_api_password = '' # VirusTotal可以免费注册获取API: https://developers.virustotal.com/reference
virustotal_api_key = ''
# Spyse可以免费注册获取API: https://spyse.com/
spyse_api_token = '' # https://www.zoomeye.org/doc?channel=api
zoomeye_api_username = ''
# https://www.circl.lu/services/passive-dns/ zoomeye_api_password = ''
circl_api_username = ''
circl_api_password = '' # Spyse可以免费注册获取API: https://spyse.com/
spyse_api_token = ''
# https://www.dnsdb.info/
dnsdb_api_key = '' # https://www.circl.lu/services/passive-dns/
circl_api_username = ''
# ipv4info可以免费注册获取API: http://ipv4info.com/tools/api/ circl_api_password = ''
# 免费的API有效期只有2天,到期之后可以再次生成,每天可以查询50次。
ipv4info_api_key = '' # https://www.dnsdb.info/
dnsdb_api_key = ''
# https://github.com/360netlab/flint
# passivedns_api_addr默认空使用http://api.passivedns.cn # ipv4info可以免费注册获取API: http://ipv4info.com/tools/api/
# passivedns_api_token可为空 # 免费的API有效期只有2天,到期之后可以再次生成,每天可以查询50次。
passivedns_api_addr = '' ipv4info_api_key = ''
passivedns_api_token = ''
# https://github.com/360netlab/flint
# Github Token可以访问https://github.com/settings/tokens生成,user为Github用户名 # passivedns_api_addr默认空使用http://api.passivedns.cn
github_api_user = '' # passivedns_api_token可为空
github_api_token = '' passivedns_api_addr = ''
# github子域收集模块使用 passivedns_api_token = ''
github_email = ''
github_password = '' # Github Token可以访问https://github.com/settings/tokens生成,user为Github用户名
github_api_user = ''
subdomains_common = {'i', 'w', 'm', 'en', 'us', 'zh', 'w3', 'app', 'bbs', github_api_token = ''
'web', 'www', 'job', 'docs', 'news', 'blog', 'data', # github子域收集模块使用
'help', 'live', 'mall', 'blogs', 'files', 'forum', github_email = ''
'store', 'mobile'} github_password = ''
# 日志配置 subdomains_common = {'i', 'w', 'm', 'en', 'us', 'zh', 'w3', 'app', 'bbs',
# 终端日志输出格式 'web', 'www', 'job', 'docs', 'news', 'blog', 'data',
stdout_fmt = '<cyan>{time:HH:mm:ss,SSS}</cyan> ' \ 'help', 'live', 'mall', 'blogs', 'files', 'forum',
'[<level>{level: <5}</level>] ' \ 'store', 'mobile'}
'<blue>{module}</blue>:<cyan>{line}</cyan> - ' \
'<level>{message}</level>' # 日志配置
# 日志文件记录格式 # 终端日志输出格式
logfile_fmt = '<light-green>{time:YYYY-MM-DD HH:mm:ss,SSS}</light-green> ' \ stdout_fmt = '<cyan>{time:HH:mm:ss,SSS}</cyan> ' \
'[<level>{level: <5}</level>] ' \ '[<level>{level: <5}</level>] ' \
'<cyan>{process.name}({process.id})</cyan>:' \ '<blue>{module}</blue>:<cyan>{line}</cyan> - ' \
'<cyan>{thread.name: <10}({thread.id: <5})</cyan> | ' \ '<level>{message}</level>'
'<blue>{module}</blue>.<blue>{function}</blue>:' \ # 日志文件记录格式
'<blue>{line}</blue> - <level>{message}</level>' logfile_fmt = '<light-green>{time:YYYY-MM-DD HH:mm:ss,SSS}</light-green> ' \
'[<level>{level: <5}</level>] ' \
log_path = result_save_path.joinpath('oneforall.log') '<cyan>{process.name}({process.id})</cyan>:' \
'<cyan>{thread.name: <10}({thread.id: <5})</cyan> | ' \
logger.remove() '<blue>{module}</blue>.<blue>{function}</blue>:' \
logger.level(name='TRACE', no=5, color='<cyan><bold>', icon='✏️') '<blue>{line}</blue> - <level>{message}</level>'
logger.level(name='DEBUG', no=10, color='<blue><bold>', icon='🐞 ')
logger.level(name='INFOR', no=20, color='<green><bold>', icon='') log_path = result_save_path.joinpath('oneforall.log')
logger.level(name='ALERT', no=30, color='<yellow><bold>', icon='⚠️')
logger.level(name='ERROR', no=40, color='<red><bold>', icon='❌️') logger.remove()
logger.level(name='FATAL', no=50, color='<RED><bold>', icon='') logger.level(name='TRACE', no=5, color='<cyan><bold>', icon='')
logger.level(name='DEBUG', no=10, color='<blue><bold>', icon='🐞 ')
if not os.environ.get('PYTHONIOENCODING'): # 设置编码 logger.level(name='INFOR', no=20, color='<green><bold>', icon='')
os.environ['PYTHONIOENCODING'] = 'utf-8' logger.level(name='ALERT', no=30, color='<yellow><bold>', icon='⚠️')
logger.level(name='ERROR', no=40, color='<red><bold>', icon='❌️')
logger.add(sys.stderr, level='INFOR', format=stdout_fmt, enqueue=True) logger.level(name='FATAL', no=50, color='<RED><bold>', icon='☠️')
logger.add(log_path, level='DEBUG', format=logfile_fmt, enqueue=True,
encoding='utf-8') if not os.environ.get('PYTHONIOENCODING'): # 设置编码
os.environ['PYTHONIOENCODING'] = 'utf-8'
logger.add(sys.stderr, level='INFOR', format=stdout_fmt, enqueue=True)
logger.add(log_path, level='DEBUG', format=logfile_fmt, enqueue=True,
encoding='utf-8')
+1 -1
View File
@@ -61,7 +61,7 @@ class OneForAll(object):
Note: Note:
参数valid可选值1,0,None分别表示导出有效,无效,全部子域 参数valid可选值1,0,None分别表示导出有效,无效,全部子域
参数port可选值有'default', 'small', 'medium', 'large', 详见config.py配置 参数port可选值有'default', 'small', 'large', 详见config.py配置
参数format可选格式有'txt', 'rst', 'csv', 'tsv', 'json', 'yaml', 'html', 参数format可选格式有'txt', 'rst', 'csv', 'tsv', 'json', 'yaml', 'html',
'jira', 'xls', 'xlsx', 'dbf', 'latex', 'ods' 'jira', 'xls', 'xlsx', 'dbf', 'latex', 'ods'