-
Notifications
You must be signed in to change notification settings - Fork 203
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
b4dcc89
commit a4322de
Showing
27 changed files
with
2,428 additions
and
2,028 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| "flag" | ||
| "fmt" | ||
| "github.com/gookit/color" | ||
| "os" | ||
| ) | ||
|
|
||
| var ( | ||
| h bool | ||
| I bool | ||
| M int | ||
| S string | ||
| U string | ||
| D string | ||
| C string | ||
| A string | ||
| b string | ||
| F string | ||
| O string | ||
| X string | ||
| T = 50 | ||
| Z int | ||
| ) | ||
|
|
||
| func init() { | ||
| flag.StringVar(&A, "a", "", "set user-agent\n设置user-agent请求头") | ||
| flag.StringVar(&b, "b", "", "set baseurl\n设置baseurl路径") | ||
| flag.StringVar(&C, "c", "", "set cookie\n设置cookie") | ||
| flag.StringVar(&D, "d", "", "set domainName\n指定获取的域名") | ||
| flag.StringVar(&F, "f", "", "set urlFile\n批量抓取url,指定文件路径") | ||
| flag.BoolVar(&h, "h", false, "this help\n帮助信息") | ||
| flag.BoolVar(&I, "i", false, "set configFile\n加载yaml配置文件（不存在时，会在当前目录创建一个默认yaml配置文件）") | ||
| flag.IntVar(&M, "m", 1, "set mode\n抓取模式 \n 1 normal\n 正常抓取（默认） \n 2 thorough\n 深入抓取 （url深入一层,js深入三层，防止抓偏） \n 3 security\n 安全深入抓取（过滤delete，remove等敏感路由） \n ") | ||
| flag.StringVar(&O, "o", "", "set outFile\n结果导出到csv文件，需指定导出文件目录（.代表当前目录）") | ||
| flag.StringVar(&S, "s", "", "set Status\n显示指定状态码，all为显示全部（多个状态码用,隔开）") | ||
| flag.IntVar(&T, "t", 50, "set thread\n设置线程数（默认50）\n") | ||
| flag.StringVar(&U, "u", "", "set Url\n目标URL") | ||
| flag.StringVar(&X, "x", "", "set httpProxy\n设置代理,格式: http://username:[email protected]:8809") | ||
| flag.IntVar(&Z, "z", 0, "set Fuzz\n对404链接进行fuzz(只对主域名下的链接生效,需要与-s一起使用） \n 1 decreasing\n 目录递减fuzz \n 2 2combination\n 2级目录组合fuzz（适合少量链接使用） \n 3 3combination\n 3级目录组合fuzz（适合少量链接使用） \n") | ||
|
|
||
| // 改变默认的 Usage | ||
| flag.Usage = usage | ||
| } | ||
| func usage() { | ||
| fmt.Fprintf(os.Stderr, `Usage: URLFinder [-a user-agent] [-b baseurl] [-c cookie] [-d domainName] [-f urlFile] [-h help] [-i configFile] [-m mode] [-o outFile] [-s Status] [-t thread] [-u Url] [-x httpProxy] [-z fuzz] | ||
| Options: | ||
| `) | ||
| flag.PrintDefaults() | ||
| } | ||
|
|
||
| func Parse() { | ||
| color.LightCyan.Println(" __ __ ___ _ _ \n /\\ /\\ /__\\ / / / __(_)_ __ __| | ___ _ __ \n/ / \\ \\/ \\/// / / _\\ | | '_ \\ / _` |/ _ \\ '__|\n\\ \\_/ / _ \\ /___ / | | | | | (_| | __/ | \n \\___/\\/ \\_\\____\\/ |_|_| |_|\\__,_|\\___|_| \n\nBy: pingc0y\nUpdateTime: 2023/2/3\nGithub: https://github.com/pingc0y/URLFinder \n") | ||
| flag.Parse() | ||
| if h || (U == "" && F == "") { | ||
| flag.Usage() | ||
| os.Exit(0) | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,109 @@ | ||
| package config | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "github.com/pingc0y/URLFinder/cmd" | ||
| "github.com/pingc0y/URLFinder/mode" | ||
| "gopkg.in/yaml.v3" | ||
| "os" | ||
| "strings" | ||
| "sync" | ||
| ) | ||
|
|
||
| var Conf mode.Config | ||
| var Progress = 1 | ||
| var FuzzNum int | ||
|
|
||
| var ( | ||
| Risks = []string{"remove", "delete", "insert", "update", "logout"} | ||
|
|
||
| JsFuzzPath = []string{ | ||
| "login.js", | ||
| "app.js", | ||
| "main.js", | ||
| "config.js", | ||
| "admin.js", | ||
| "info.js", | ||
| "open.js", | ||
| "user.js", | ||
| "input.js", | ||
| "list.js", | ||
| "upload.js", | ||
| } | ||
| JsFind = []string{ | ||
| ".(https{0,1}:[-a-zA-Z0-9（）@:%_\\+.~#?&//=]{2,250}?[-a-zA-Z0-9（）@:%_\\+.~#?&//=]{3}[.]js)", | ||
| "[\",',‘,“]\\s{0,6}(/{0,1}[-a-zA-Z0-9（）@:%_\\+.~#?&//=]{2,250}?[-a-zA-Z0-9（）@:%_\\+.~#?&//=]{3}[.]js)", | ||
| "=\\s{0,6}[\",',’,”]{0,1}\\s{0,6}(/{0,1}[-a-zA-Z0-9（）@:%_\\+.~#?&//=]{2,250}?[-a-zA-Z0-9（）@:%_\\+.~#?&//=]{3}[.]js)", | ||
| } | ||
| UrlFind = []string{ | ||
| "[\",',‘,“]\\s{0,6}(https{0,1}:[-a-zA-Z0-9()@:%_\\+.~#?&//=]{2,250}?)\\s{0,6}[\",',‘,“]", | ||
| "=\\s{0,6}(https{0,1}:[-a-zA-Z0-9()@:%_\\+.~#?&//=]{2,250})", | ||
| "[\",',‘,“]\\s{0,6}([#,.]{0,2}/[-a-zA-Z0-9()@:%_\\+.~#?&//=]{2,250}?)\\s{0,6}[\",',‘,“]", | ||
| "\"([-a-zA-Z0-9()@:%_\\+.~#?&//=]+?[/]{1}[-a-zA-Z0-9()@:%_\\+.~#?&//=]+?)\"", | ||
| "href\\s{0,6}=\\s{0,6}[\",',‘,“]{0,1}\\s{0,6}([-a-zA-Z0-9()@:%_\\+.~#?&//=]{2,250})|action\\s{0,6}=\\s{0,6}[\",',‘,“]{0,1}\\s{0,6}([-a-zA-Z0-9()@:%_\\+.~#?&//=]{2,250})", | ||
| } | ||
|
|
||
| JsFiler = []string{ | ||
| "www\\.w3\\.org", | ||
| "example\\.com", | ||
| } | ||
| UrlFiler = []string{ | ||
| "\\.js\\?|\\.css\\?|\\.jpeg\\?|\\.jpg\\?|\\.png\\?|.gif\\?|www\\.w3\\.org|example\\.com|\\<|\\>|\\{|\\}|\\[|\\]|\\||\\^|;|/js/|\\.src|\\.replace|\\.url|\\.att|\\.href|location\\.href|javascript:|location:|application/x-www-form-urlencoded|\\.createObject|:location|\\.path|\\*#__PURE__\\*|\\*\\$0\\*|\\n", | ||
| ".*\\.js$|.*\\.css$|.*\\.scss$|.*,$|.*\\.jpeg$|.*\\.jpg$|.*\\.png&|.*\\.gif&|.*\\.ico$|.*\\.svg$|.*\\.vue$|.*\\.ts$", | ||
| } | ||
|
|
||
| Phone = []string{"['\"](1(3([0-35-9]\\d|4[1-8])|4[14-9]\\d|5([\\d]\\d|7[1-79])|66\\d|7[2-35-8]\\d|8\\d{2}|9[89]\\d)\\d{7})['\"]"} | ||
| Email = []string{"['\"]([\\w!#$%&'*+=?^_`{|}~-]+(?:\\.[\\w!#$%&'*+=?^_`{|}~-]+)*@(?:[\\w](?:[\\w-]*[\\w])?\\.)+[\\w](?:[\\w-]*[\\w])?)['\"]"} | ||
| IDcard = []string{"['\"]((\\d{8}(0\\d|10|11|12)([0-2]\\d|30|31)\\d{3}$)|(\\d{6}(18|19|20)\\d{2}(0[1-9]|10|11|12)([0-2]\\d|30|31)\\d{3}(\\d|X|x)))['\"]"} | ||
| Jwt = []string{"['\"](ey[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9._-]{10,}|ey[A-Za-z0-9_\\/+-]{10,}\\.[A-Za-z0-9._\\/+-]{10,})['\"]"} | ||
| ) | ||
|
|
||
| var ( | ||
| Lock sync.Mutex | ||
| Wg sync.WaitGroup | ||
| Mux sync.Mutex | ||
| Ch = make(chan int, 50) | ||
| Jsch = make(chan int, 50/2) | ||
| Urlch = make(chan int, 50/2) | ||
| ) | ||
|
|
||
| // 读取配置文件 | ||
| func GetConfig(path string) { | ||
| con := &mode.Config{} | ||
| if f, err := os.Open(path); err != nil { | ||
| if strings.Contains(err.Error(), "The system cannot find the file specified") || strings.Contains(err.Error(), "no such file or directory") { | ||
| con.Headers = map[string]string{"Cookie": cmd.C, "User-Agent": `Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36 SE 2.X MetaSr 1.0`, "Accept": "*/*"} | ||
| con.Proxy = "" | ||
| con.JsFind = JsFind | ||
| con.UrlFind = UrlFind | ||
| con.JsFiler = JsFiler | ||
| con.UrlFiler = UrlFiler | ||
| con.JsFuzzPath = JsFuzzPath | ||
| con.InfoFind = map[string][]string{"Phone": Phone, "Email": Email, "IDcard": IDcard, "Jwt": Jwt} | ||
| data, err2 := yaml.Marshal(con) | ||
| err2 = os.WriteFile(path, data, 0644) | ||
| if err2 != nil { | ||
| fmt.Println(err) | ||
| } else { | ||
| fmt.Println("未找到配置文件,已在当面目录下创建配置文件: config.yaml") | ||
| } | ||
| } else { | ||
| fmt.Println("配置文件错误,请尝试重新生成配置文件") | ||
| fmt.Println(err) | ||
| } | ||
| os.Exit(1) | ||
| } else { | ||
| yaml.NewDecoder(f).Decode(con) | ||
| Conf = *con | ||
| JsFind = con.JsFind | ||
| UrlFind = con.UrlFind | ||
| JsFiler = con.JsFiler | ||
| UrlFiler = con.UrlFiler | ||
| JsFuzzPath = con.JsFuzzPath | ||
| Phone = con.InfoFind["Phone"] | ||
| Email = con.InfoFind["Email"] | ||
| IDcard = con.InfoFind["IDcard"] | ||
| Jwt = con.InfoFind["Jwt"] | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.