(IHttpRequestResponse iHttpRequestResponse)
| 66 | } |
| 67 | |
| 68 | @Override |
| 69 | public List<IScanIssue> doPassiveScan(IHttpRequestResponse iHttpRequestResponse) { |
| 70 | // 判断是否开启插件 |
| 71 | if (!this.tags.getBaseSettingTagClass().isStart()) { |
| 72 | return null; |
| 73 | } |
| 74 | |
| 75 | List<IScanIssue> issues = new ArrayList<>(); |
| 76 | |
| 77 | List<String> domainNameBlacklist = this.yamlReader.getStringList("scan.domainName.blacklist"); |
| 78 | List<String> domainNameWhitelist = this.yamlReader.getStringList("scan.domainName.whitelist"); |
| 79 | |
| 80 | // 基础url解析 |
| 81 | CustomBurpUrl baseBurpUrl = new CustomBurpUrl(this.callbacks, iHttpRequestResponse); |
| 82 | // 判断域名黑名单 |
| 83 | if (domainNameBlacklist != null && domainNameBlacklist.size() >= 1) { |
| 84 | if (isMatchDomainName(baseBurpUrl.getRequestHost(), domainNameBlacklist)) { |
| 85 | return null; |
| 86 | } |
| 87 | } |
| 88 | |
| 89 | // 判断域名白名单 |
| 90 | if (domainNameWhitelist != null && domainNameWhitelist.size() >= 1) { |
| 91 | if (!isMatchDomainName(baseBurpUrl.getRequestHost(), domainNameWhitelist)) { |
| 92 | return null; |
| 93 | } |
| 94 | } |
| 95 | // 判断当前请求后缀,是否为url黑名单后缀 |
| 96 | if (this.isUrlBlackListSuffix(baseBurpUrl)) { |
| 97 | return null; |
| 98 | } |
| 99 | // 判断当前站点问题数量是否超出了 |
| 100 | Integer issueNumber = this.yamlReader.getInteger("scan.issueNumber"); |
| 101 | if (issueNumber != 0) { |
| 102 | Integer siteIssueNumber = this.getSiteIssueNumber(baseBurpUrl.getRequestDomainName()); |
| 103 | if (siteIssueNumber >= issueNumber) { |
| 104 | this.tags.getScanQueueTagClass().add( |
| 105 | "", |
| 106 | this.helpers.analyzeRequest(iHttpRequestResponse).getMethod(), |
| 107 | baseBurpUrl.getHttpRequestUrl().toString(), |
| 108 | this.helpers.analyzeResponse(iHttpRequestResponse.getResponse()).getStatusCode() + "", |
| 109 | "the number of website problems has exceeded", |
| 110 | iHttpRequestResponse |
| 111 | ); |
| 112 | return null; |
| 113 | } |
| 114 | } |
| 115 | // 判断当前站点是否超出扫描数量了 |
| 116 | Integer siteScanNumber = this.yamlReader.getInteger("scan.siteScanNumber"); |
| 117 | if (siteScanNumber != 0) { |
| 118 | Integer siteJsonNumber = this.getSiteJsonNumber(baseBurpUrl.getRequestDomainName()); |
| 119 | if (siteJsonNumber >= siteScanNumber) { |
| 120 | this.tags.getScanQueueTagClass().add( |
| 121 | "", |
| 122 | this.helpers.analyzeRequest(iHttpRequestResponse).getMethod(), |
| 123 | baseBurpUrl.getHttpRequestUrl().toString(), |
| 124 | this.helpers.analyzeResponse(iHttpRequestResponse.getResponse()).getStatusCode() + "", |
| 125 | "the number of website scans exceeded", |
nothing calls this directly
no test coverage detected