├── README.md ├── config.php ├── include ├── controller │ ├── about_controller.php │ ├── index_controller.php │ ├── plugin_controller.php │ ├── splugins_controller.php │ ├── task_controller.php │ ├── user_controller.php │ └── webdna_controller.php ├── lib │ ├── database.php │ ├── dispatcher.php │ ├── function.base.php │ ├── mysql.php │ ├── mysqlii.php │ └── view.php └── model │ ├── log_model.php │ ├── splugins_model.php │ ├── task_model.php │ ├── user_model.php │ └── webdna_model.php ├── index.php ├── init.php ├── py ├── data │ ├── data.json │ └── dir.txt ├── main.py ├── plugins │ ├── burtdir.py │ ├── portscan.py │ └── whatcms.py ├── spider │ ├── 2.py │ └── email.py └── test.py ├── theme ├── about.php ├── css │ ├── bootstrap-responsive.css │ ├── bootstrap-responsive.min.css │ ├── bootstrap.css │ ├── bootstrap.min.css │ └── site.css ├── footer.php ├── header.php ├── home.php ├── img │ ├── bg.png │ ├── glyphicons-halflings-white.png │ └── glyphicons-halflings.png ├── js │ ├── bootstrap.js │ ├── bootstrap.min.js │ ├── excanvas.min.js │ ├── html5.js │ ├── jquery.flot.js │ ├── jquery.flot.resize.js │ └── jquery.js ├── left_side.php ├── login.php ├── nav_list.php ├── plugin_add.php ├── plugin_manager.php ├── register.php ├── task_add.php ├── task_callback.php ├── task_manager.php ├── webdna_add.php └── webdna_manager.php ├── w7scan └── data │ └── cms.json └── w8scan.sql /README.md: -------------------------------------------------------------------------------- 1 | # w8scan 一款模仿bugscan的扫描器 2 | 3 | ## 前言 4 | 说是模仿bugscan,但是我并没有bugscan账号,我所做的是模仿他的通信原理。网页端返回一段代码,本地python环境执行上述代码即可扫描。 5 | ### 具体流程: 6 | web端提供一个链接 -> 节点运行 ->在web端可进行在线扫描等的操作 7 | 8 | ### 本扫描器主要特点 9 | - 就两点,使用简单,安装简单。 10 | 11 | ## 安装环境 12 | 小菜使用了很多大神的扫描器,但是安装太过于复杂,于是暗自下决心,自己写的一定要简单好用 13 | 14 | - 只需要拥有一个php+mysql环境(本地外地均可) 15 | - 安装网站:导入sql,ok,扫描器安装成功了。 16 | - 使用:进入扫描器新增目标,按照提示执行python命令即可 17 | 18 | ### 备注说明1 19 | 因为之前用其他大牛开发的工具,有一大堆的依赖库。所以自己开发的东西尽量没有使用第三方库,所有功能都由python的内置库打造。(集成了 hackhttp等库,不用额外安装) 20 | 21 | ### 备注说明2 22 | 扫描器可为个人和安全团队作为内部扫描器使用。扫描器切勿用于非法用途!! 23 | 24 | ## 开发想法 25 | 1. 通过python的脚本执行特性,从网页上下载代码来执行,只需要在某个节点执行 python xxx 即可进行扫描 26 | 2. 扫描规则通过web端进行配置,web指纹,exp等等可以web端上配置 27 | 3. web端基于php+mysql 不需要很多要求,一个空间足矣 28 | 29 | 扫描器内置了bugscan的hackhttp模块 30 | 31 | ## 图片展示 32 | 首页 33 | ![1](https://user-images.githubusercontent.com/18695984/27781327-f4cfc320-5fff-11e7-81be-c5281c140551.jpg) 34 | 35 | 加入任务完成后 在本地执行命令即可 36 | ![4](https://user-images.githubusercontent.com/18695984/27781403-4bb7451e-6000-11e7-97a1-08698042f052.jpg) 37 | ![5](https://user-images.githubusercontent.com/18695984/27781404-4bba7a90-6000-11e7-8ce4-8a0464fc55e0.jpg) 38 | 任务管理可查看任务 39 | 40 | 会自动生成漏洞报告 41 | 42 | ## 插件管理和指纹管理的网页端没有写完 43 | 我觉得这个写在网页端不如直接上传到空间实在。 44 | -------------------------------------------------------------------------------- /config.php: -------------------------------------------------------------------------------- 1 | Model_user = new User_Model(); 9 | } 10 | function display($params = ''){ 11 | include View::getView("header"); 12 | include View::getview("home"); //首页 13 | } 14 | function login($params = ''){ 15 | if(!empty($_POST["username"])){ 16 | $username = addslashes($_POST["username"]); 17 | $password = addslashes($_POST["password"]); 18 | if($this->Model_user->checkUser($username,$password)){ 19 | $userData = $this->Model_user->getUser($username,$password); 20 | $_SESSION["user"] = $userData["user"]; 21 | $_SESSION["uid"] = $userData["id"]; 22 | emDirect("./"); 23 | }else{ 24 | emMsg("用户名或密码错误"); 25 | } 26 | } 27 | include View::getView("header"); 28 | include View::getview("login"); 29 | } 30 | function reg($params = ''){ 31 | if(!empty($_POST["secode"])){ 32 | $logData = array(); 33 | $logData["user"] = addslashes($_POST["username"]); 34 | $logData["password"] = addslashes($_POST["password"]); 35 | $logData["email"] = addslashes($_POST["email"]); 36 | $logData["vip"] = 0; 37 | $secode = addslashes($_POST["secode"]); 38 | if($secode === REG_CODE){ 39 | if($this->Model_user->insertData($logData)){ 40 | $return_msg = "注册成功!"; 41 | }else{ 42 | emMsg("注册失败"); 43 | exit(); 44 | } 45 | }else{ 46 | emMsg("注册邀请码错误"); 47 | exit(); 48 | } 49 | 50 | } 51 | include View::getView("header"); 52 | include View::getview("register"); 53 | } 54 | 55 | function logout($params = ''){ 56 | $_SESSION = array(); 57 | emDirect(BLOG_URL); 58 | } 59 | } -------------------------------------------------------------------------------- /include/controller/plugin_controller.php: -------------------------------------------------------------------------------- 1 | Getinfo(EMLOG_ROOT."/py/spider"); 8 | // print_r($info); 9 | foreach($infos as $info){ 10 | $descipt = $info["descript"]; 11 | $name = $info["path"]; 12 | echo " {$descipt}"; 13 | } 14 | } 15 | 16 | function DisplayOnPlugins(){ 17 | $spider = new Splugins_Model(); 18 | $infos = $spider->Getinfo(EMLOG_ROOT."/py/plugins"); 19 | // print_r($info); 20 | foreach($infos as $info){ 21 | $descipt = $info["descript"]; 22 | $name = $info["path"]; 23 | echo " {$descipt}"; 24 | } 25 | } 26 | 27 | } -------------------------------------------------------------------------------- /include/controller/task_controller.php: -------------------------------------------------------------------------------- 1 | add(addslashes($_POST["url"]),addslashes($_POST["descript"]),$_POST["plugins"],$_POST["spider_plugins"],$uid); 13 | $callback_url = BLOG_URL.'?get/'.$token; 14 | } 15 | include View::getView("header"); 16 | include View::getview("task_add"); 17 | } 18 | function manager($params = ''){ 19 | $task = new Task_Model(); 20 | $uid = (int)$_SESSION["uid"]; 21 | $LogData = $task->GetPageData($uid); 22 | // print_r($LogData); 23 | // die(); 24 | include View::getView("header"); 25 | include View::getview("task_manager"); 26 | } 27 | 28 | function task_callback($params = ''){ 29 | if($params[1]=='/'&&!empty($params[2])){ 30 | $token = $params[2]; 31 | include View::getView("task_callback"); 32 | }else{ 33 | exit("sql error");//假错误 34 | } 35 | } 36 | 37 | function reciver_data($params = ''){ 38 | $data = addslashes($_POST["data"]); 39 | if($params[1]=='/'&&!empty($params[2])&&!empty($data)){ 40 | $token = $params[2]; 41 | $task = new Task_Model(); 42 | $task->update_Result($token,$data); 43 | echo "success!"; 44 | }else{ 45 | exit("sql error");//假错误 46 | } 47 | } 48 | } -------------------------------------------------------------------------------- /include/controller/user_controller.php: -------------------------------------------------------------------------------- 1 | getall(); 14 | 15 | $total_pages = ceil($lognum / 10); 16 | if ($page > $total_pages) { 17 | $page = $total_pages; 18 | } 19 | $pageurl .= BLOG_URL.'?webdna_manager/'; 20 | $page_url = pagination($lognum, 10, $page, $pageurl); 21 | $logDate = $WebDNA->getdata($page-1,10); 22 | 23 | include View::getView("header"); 24 | include View::getview("webdna_manager"); 25 | } 26 | } -------------------------------------------------------------------------------- /include/lib/database.php: -------------------------------------------------------------------------------- 1 | _path = $this->setPath(); 39 | $this->_routingTable = $this->getRoutingTable(); 40 | foreach ($this->_routingTable as $route) { 41 | if (preg_match($route['reg_0'], $this->_path, $matches)) { 42 | $this->_model = $route['controller']; 43 | $this->_method = $route['method']; 44 | $this->_params = $matches; 45 | break; 46 | } 47 | } 48 | 49 | if (empty($this->_model)) { 50 | show_404_page(); 51 | } 52 | 53 | } 54 | static function getRoutingTable(){ 55 | $routingtable = array( 56 | array( 57 | 'controller' => 'Index_Controller', 58 | 'method' => 'login', 59 | 'reg_0' => '|^.*/\?login|' 60 | ), 61 | array( 62 | 'controller' => 'Index_Controller', 63 | 'method' => 'reg', 64 | 'reg_0' => '|^.*/\?reg|' 65 | ), 66 | array( 67 | 'controller' => 'About_Controller', 68 | 'method' => 'display', 69 | 'reg_0' => '|^.*/\?about|' 70 | ), 71 | array( 72 | 'controller' => 'Index_Controller', 73 | 'method' => 'logout', 74 | 'reg_0' => '|^.*/\?logout|' 75 | ), 76 | array( 77 | 'controller' => 'Task_Controller', 78 | 'method' => 'add', 79 | 'reg_0' => '|^.*/\?task_add|' 80 | ), 81 | array( 82 | 'controller' => 'Task_Controller', 83 | 'method' => 'manager', 84 | 'reg_0' => '|^.*/\?task_manager|' 85 | ), 86 | array( 87 | 'controller' => 'Plugin_Controller', 88 | 'method' => 'add', 89 | 'reg_0' => '|^.*/\?plugin_add|' 90 | ), 91 | array( 92 | 'controller' => 'Plugin_Controller', 93 | 'method' => 'manager', 94 | 'reg_0' => '|^.*/\?plugin_manager|' 95 | ), 96 | array( 97 | 'controller' => 'WebDNA_Controller', 98 | 'method' => 'add', 99 | 'reg_0' => '|^.*/\?webdna_add|' 100 | ), 101 | array( 102 | 'controller' => 'WebDNA_Controller', 103 | 'method' => 'manager', 104 | 'reg_0' => '|^.*/\?webdna_manager(/)?(\d+)?|' 105 | ), 106 | array( 107 | 'controller' => 'Task_Controller', 108 | 'method' => 'task_callback', 109 | 'reg_0' => '|^.*/\?get(/)?(\w+)?|' 110 | ), 111 | array( 112 | 'controller' => 'Task_Controller', 113 | 'method' => 'reciver_data', 114 | 'reg_0' => '|^.*/\?send(/)?(\w+)?|' 115 | ), 116 | array( 117 | 'controller' => 'Index_Controller', 118 | 'method' => 'display', 119 | 'reg_0' => '|^/?([\?&].*)?$|' 120 | ), 121 | ); 122 | return $routingtable; 123 | } 124 | public function dispatch(){ 125 | $module = new $this->_model(); 126 | $method = $this->_method; 127 | $module->$method($this->_params); 128 | } 129 | 130 | public static function setPath(){ 131 | $path = ''; 132 | if (isset($_SERVER['HTTP_X_REWRITE_URL'])) { //iis 133 | $path = $_SERVER['HTTP_X_REWRITE_URL']; 134 | } elseif (isset($_SERVER['REQUEST_URI'])) { 135 | $path = $_SERVER['REQUEST_URI']; 136 | } else { 137 | if (isset($_SERVER['argv'])) { 138 | $path = $_SERVER['PHP_SELF'] .'?'. $_SERVER['argv'][0]; 139 | } else { 140 | $path = $_SERVER['PHP_SELF'] .'?'. $_SERVER['QUERY_STRING']; 141 | } 142 | } 143 | 144 | //for iis6 path is GBK 145 | if (isset($_SERVER['SERVER_SOFTWARE']) && false !== stristr($_SERVER['SERVER_SOFTWARE'], 'IIS')) { 146 | if (function_exists('mb_convert_encoding')) { 147 | $path = mb_convert_encoding($path, 'UTF-8', 'GBK'); 148 | } else { 149 | $path = @iconv('GBK', 'UTF-8', @iconv('UTF-8', 'GBK', $path)) == $path ? $path : @iconv('GBK', 'UTF-8', $path); 150 | } 151 | } 152 | //for ie6 header location 153 | $r = explode('#', $path, 2); 154 | $path = $r[0]; 155 | //for iis6 156 | $path = str_ireplace('index.php', '', $path); 157 | //for subdirectory 158 | $t = parse_url(BLOG_URL); 159 | $path = str_replace($t['path'], '/', $path); 160 | 161 | return $path; 162 | } 163 | } -------------------------------------------------------------------------------- /include/lib/function.base.php: -------------------------------------------------------------------------------- 1 | = 128) 159 | $char++; 160 | } 161 | $str2 = substr($strings, $start, $length + 1); 162 | $str3 = substr($strings, $start, $length + 2); 163 | if ($char % 3 == 1) { 164 | if ($length <= strlen($strings)) { 165 | $str3 = $str3 .= '...'; 166 | } 167 | return $str3; 168 | } 169 | if ($char % 3 == 2) { 170 | if ($length <= strlen($strings)) { 171 | $str2 = $str2 .= '...'; 172 | } 173 | return $str2; 174 | } 175 | if ($char % 3 == 0) { 176 | if ($length <= strlen($strings)) { 177 | $str = $str .= '...'; 178 | } 179 | return $str; 180 | } 181 | } 182 | 183 | /** 184 | * 从可能包含html标记的内容中萃取纯文本摘要 185 | * 186 | * @param string $data 187 | * @param int $len 188 | */ 189 | function extractHtmlData($data, $len) { 190 | $data = subString(strip_tags($data), 0, $len + 30); 191 | $search = array("/([\r\n])[\s]+/", // 去掉空白字符 192 | "/&(quot|#34);/i", // 替换 HTML 实体 193 | "/&(amp|#38);/i", 194 | "/&(lt|#60);/i", 195 | "/&(gt|#62);/i", 196 | "/&(nbsp|#160);/i", 197 | "/&(iexcl|#161);/i", 198 | "/&(cent|#162);/i", 199 | "/&(pound|#163);/i", 200 | "/&(copy|#169);/i", 201 | "/\"/i", 202 | ); 203 | $replace = array(" ", "\"", "&", " ", " ", "", chr(161), chr(162), chr(163), chr(169), ""); 204 | $data = trim(subString(preg_replace($search, $replace, $data), 0, $len)); 205 | return $data; 206 | } 207 | 208 | /** 209 | * 转换附件大小单位 210 | * 211 | * @param string $fileSize 文件大小 kb 212 | */ 213 | function changeFileSize($fileSize) { 214 | if ($fileSize >= 1073741824) { 215 | $fileSize = round($fileSize / 1073741824, 2) . 'GB'; 216 | } elseif ($fileSize >= 1048576) { 217 | $fileSize = round($fileSize / 1048576, 2) . 'MB'; 218 | } elseif ($fileSize >= 1024) { 219 | $fileSize = round($fileSize / 1024, 2) . 'KB'; 220 | } else { 221 | $fileSize = $fileSize . '字节'; 222 | } 223 | return $fileSize; 224 | } 225 | 226 | /** 227 | * 获取文件名后缀 228 | */ 229 | function getFileSuffix($fileName) { 230 | return strtolower(pathinfo($fileName, PATHINFO_EXTENSION)); 231 | } 232 | 233 | /** 234 | * 分页函数 235 | * 236 | * @param int $count 条目总数 237 | * @param int $perlogs 每页显示条数目 238 | * @param int $page 当前页码 239 | * @param string $url 页码的地址 240 | */ 241 | function pagination($count, $perlogs, $page, $url, $anchor = '') { 242 | $pnums = @ceil($count / $perlogs); 243 | // $re = '