(IHttpRequestResponse baseRequestResponse)
| 46 | scanJudge = new ScanJudge(callbacks, stdout); |
| 47 | } |
| 48 | @Override |
| 49 | public List<IScanIssue> doPassiveScan(IHttpRequestResponse baseRequestResponse) { |
| 50 | List<String> resheaders = helpers.analyzeResponse(baseRequestResponse.getResponse()).getHeaders(); |
| 51 | IRequestInfo iRequestInfo = helpers.analyzeRequest(baseRequestResponse); |
| 52 | URL url = iRequestInfo.getUrl(); |
| 53 | if(!YamlReader.getInstance(callbacks).getBoolean("isStart")){ |
| 54 | stdout.println("插件关闭使用"); |
| 55 | return null; |
| 56 | } |
| 57 | if(scanJudge.isBlackdomain(url.getAuthority())){ |
| 58 | stdout.println("检查到黑名单域名，跳过目标: " + url); |
| 59 | return null; |
| 60 | } |
| 61 | if(scanJudge.isBlackheader(resheaders)){ |
| 62 | stdout.println("检查到非java网站特征，跳过目标: " + url); |
| 63 | return null; |
| 64 | } |
| 65 | if(scanJudge.isBlackSuffix(url.getPath())){ |
| 66 | stdout.println("检查到后缀黑名单，跳过目标: " + url); |
| 67 | return null; |
| 68 | } |
| 69 | if(YamlReader.getInstance(callbacks).getBoolean("scanModule.SpringSpiderScan.isStart")){ |
| 70 | List<IHttpRequestResponse> SpringSpiderScanResults= SpringBootActuatorScan.ScanMain(baseRequestResponse,callbacks,helpers, stdout); |
| 71 | for(IHttpRequestResponse result:SpringSpiderScanResults){ |
| 72 | if(result != null){ |
| 73 | String payload = helpers.analyzeRequest(result).getUrl().getPath(); |
| 74 | if(payload.endsWith("/env")){ |
| 75 | Addissuse(result,"Springboot actuator Foud!",payload); |
| 76 | } else if (payload.contains("api-docs") || payload.contains("swagger.")) { |
| 77 | Addissuse(result,"Api-Docs Foud!",payload); |
| 78 | } else if (payload.contains("druid")) { |
| 79 | Addissuse(result,"Druid-monitor-unauth Foud!",payload); |
| 80 | } |
| 81 | } |
| 82 | } |
| 83 | } |
| 84 | if(YamlReader.getInstance(callbacks).getBoolean("scanModule.Log4jScan.isStart")){ |
| 85 | List<Object> Log4jSuccess = null; |
| 86 | try { |
| 87 | Log4jSuccess = Log4jScan.ScanMain(baseRequestResponse, callbacks, helpers, stdout); |
| 88 | } catch (IOException e) { |
| 89 | stderr.println(e); |
| 90 | } catch (InterruptedException e) { |
| 91 | stderr.println(e); |
| 92 | } |
| 93 | if(Log4jSuccess != null){ |
| 94 | Addissuse((IHttpRequestResponse) Log4jSuccess.get(0),"Log4j Rce Foud!", (String) Log4jSuccess.get(1)); |
| 95 | } |
| 96 | } |
| 97 | if(YamlReader.getInstance(callbacks).getBoolean("scanModule.FastJsonScan.isStart")){ |
| 98 | List<Object> FastjsonSuccess = null; |
| 99 | try { |
| 100 | FastjsonSuccess = FastJsonScan.ScanMain(baseRequestResponse, callbacks, helpers, stdout); |
| 101 | } catch (IOException e) { |
| 102 | stderr.println(e); |
| 103 | } catch (InterruptedException e) { |
| 104 | stderr.println(e); |
| 105 | } |
nothing calls this directly
no test coverage detected