Glass是一款针对资产列表的快速指纹识别工具,通过调用Fofa/ZoomEye/Shodan/360等api接口

Overview

Glass(镜) V2.0-剑客到刺客的蜕变

一、简介:

    _____    _      _____                    
 __|___  |__| | __ |_   _|__  __ _ _ __ ___  
/ __| / / __| |/ /   | |/ _ \/ _` | '_ ` _ \ 
\__ \/ / (__|   <    | |  __/ (_| | | | | | |
|___/_/ \___|_|\_\   |_|\___|\__,_|_| |_| |_|
  ____ _               
 / ___| | __ _ ___ ___ 
| |  _| |/ _` / __/ __|
| |_| | | (_| \__ \__ \
 \____|_|\__,_|___/___/ 	http://www.s7ck.com    

Glass为s7ck Team 红队武器库F-Box里的一款信息收集工具。

在红队作战中,信息收集是必不可少的环节,如何才能从大量的资产中提取有用的系统(如OA、VPN、路由、Weblogic...)是众多红队人员头疼的问题。

Glass是一款针对资产列表的快速指纹识别工具,通过调用Fofa/ZoomEye/Shodan/360等api接口快速查询资产信息并识别重点资产的指纹,也可针对IP/IP段或资产列表进行快速的指纹识别。

Glass旨在帮助红队人员在资产信息收集期间能够快速从C段、大量杂乱的资产中精准识别到易被攻击的系统,从而实施进一步测试攻击。

s7ck Team F-box旨在通过开源或者开放的方式,长期维护并推进涉及安全研究各个领域不同环节的工具化,高度自动化,将立足于不同安全领域、不同安全环节的研究人员和工具链接/封装/优化起来。

主要目的是改善安全圈内工具庞杂、水平层次不齐、开源无人维护、工具找不到的等多种问题,营造一个更好更开放的安全工具促进与交流的技术氛围。

开发语言

  • Python3

运行环境

  • Linux
  • Windows
  • Mac

使用依赖库

  • requests
  • colorama
  • prettytable
  • xlsxwriter

安装

git clone https://github.com/s7ckTeam/Glass
cd Glass
pip3 install -r requirements.txt

二、更新日志:

正式版

  • 2.0.6 更改默认搜索设置,添加哪个api就会默认调用哪个,不需要指定,如果有多个api-s指定

  • 2.0.5 添加自定义搜索(-s,--search)

    1. 添加钟馗之眼(https://www.zoomeye.org/)搜索
    2. config/config.pyzoomeyeApi设置,输入key值即可(注: 用的时候注意api使用条数)
    3. -s参数[eye(钟馗之眼) or fofa(Fofa)](python3 Glass.py -i 127.0.0.1 -s eye or fofa)
    4. 不加参数-s默认使用fofa搜索
  • 2.0.4 添加删除更新的缓存文件

  • 2.0.3 扫描域名或批量扫描时可不加协议(注: 建议添加协议)

  • 2.0.2 增加自定义输出格式(-o,--output)

    1. 支持输出的格式有:txtjsonhtmlxlscsv
    2. 默认输出txt格式
    3. 输出目录在根目录output
  • 2.0

    1. 增加代理功能(--proxy)
    2. 增加获取代理功能(--proxy-list)
      • 首次使用会按照参数获取相应代理,然后在根目录生成/proxyFile/proxy.txt
      • 参数(all)获取全部
      • 参数(cn)获取国内
    3. 增加在线更新功能(--update)
    4. 去除print,改用logging输出
    5. 优化运行代码,后期还会优化
    6. 增加对url协议使用相应协议的代理
    7. 增加查看版本参数(-v,--version)
    8. 使用不生成pyc文件
    9. 全局随机分配代理,获取到多少就用多少,每次访问都不一样
    10. 将获取到的代理文件保存,根目录生成/proxyFile/proxy.txt,终端以表格形式输出,一目了然
    11. 增加版本判断,建议使用 >=python 3.7.3
    12. 对证书认证方面的处理
    13. 每过15分钟会重新获取一次代理IP
  • 1.3(添加cookie识别方式,将识别规则改为列表,防止重复的cms不带入识别,识别精准度提高,速度更快)

  • 1.2(修复编码问题,以及fofa会员获取数量问题,现在默认100,在config/config.pyfofaSize更改,普通会员为100,高级10000,企业100000,请自行更改)

  • 1.1(处理每日一说超时后写入空文件问题)

  • 1.0(全面优化识别效率,命中率99%

  • 0.9(添加每日一说获取异常,添加识别规则)

Glass V2.0新版内容部分截图

测试版更新信息

  • 0.9(优化IP段的扫描,以及批量下可添加IP段)
  • 0.8(更改线程运行方式)
  • 0.7(与协程对比,最好还是用线程并发)
  • 0.6(更改配色方案,采用线程并发,增加单url以及批量url识别)
  • 0.5(优化采集速度以及与识别分开,增加输出)
  • 0.4(整理识别规则)
  • 0.3(添加指纹扫描)
  • 0.2(更新每天一说,让红队不再乏味)
  • 0.1(写出整体实现功能,Fofa接口的设置与采集)

三、使用方法:

Usage: python3 Glass.py -i 127.0.0.1 or 127.0.0.0/24
Usage: python3 Glass.py -i 127.0.0.1 -s eye or fofa
Usage: python3 Glass.py -f ips.txt
Usage: python3 Glass.py -u https://96.mk/
Usage: python3 Glass.py -w webs.txt
Usage: python3 Glass.py --proxy-list all or cn
Usage: python3 Glass.py (-i -f -u -w) 127.0.0.1 or 127.0.0.0/24 --proxy all or cn
Usage: python3 Glass.py --update
Usage: python3 Glass.py -u https://96.mk/ -o html


usage: Glass.py [-h] [-i IP] [-f FILE] [-u URL] [-w WEB] [--proxy PROXY] [--proxy-list PROXYLIST] [-v] [--update] [-o OUTPUTTARGET] [-s SEARCH]

Glass scan.

optional arguments:
  -h, --help            show this help message and exit
  -i IP, --ip IP        Input your ip.
  -f FILE, --file FILE  Input your ips.txt.
  -u URL, --url URL     Input your url.
  -w WEB, --web WEB     Input your webs.txt.
  --proxy PROXY         Input your proxy options(all or cn) or proxy address(127.0.0.1:8080).
  --proxy-list PROXYLIST
                        List the proxys.
  -v, --version         Show program's version number and exit.
  --update              Update the program.
  -o OUTPUTTARGET, --output OUTPUTTARGET
                        Select the output format.
  -s SEARCH, --search SEARCH
                        Choose your search engine.


-i 可指定单独IP或者IP段(需添加您fofa的API或者zoomeye的API)
-f 批量要扫的IP或IP段(需添加您fofa的API或者zoomeye的API)
-u 单个url识别
-w 批量url识别
-s 指定搜索引擎
--proxy all/cn/http://127.0.0.1:8080 使用 all表示全部 cn表示国内或者自定义的代理(支持http、https)
--proxy-list all/cn 获取代理 all表示全部 cn表示国内

相关配置更改

  • API设置
    1. config/config.pyfofaApi设置,输入对应的emailkey即可
    2. config/config.pyzoomeyeApi设置,输入key值即可
  • 线程默认 100可在config/config.pythreadNum修改线程数 (注:建议在200以内)
  • 每日一说可设置开启关闭,在config/config.pytosayRunTrue为开,False为关
  • fofa会员搜索的更改,默认搜索100,在config/config.pyfofaSize更改,普通会员为100,高级10000,企业100000,请自行更改

Glass提供了四种指纹识别方式,可从本地读取识别,也可以从FOFA进行批量调用API识别(需要FOFA密钥)。

1.本地识别:

python Glass.py -u http://www.s7ck.com  // 单url测试
python Glass.py -w url.txt  // url文件内

2.FOFA识别:

注意:从FOFA识别需要配置FOFA 密钥以及邮箱,在.../config/config.py内配置好密钥以及邮箱即可使用。

fofaApi = {
    "email": "[email protected]",
    "key": "1234567890",
}
python3 Glass.py -i 127.0.0.1  //支持单IP资产
python3 Glass.py -i 127.0.0.1/24 //支持IP段资产
python3 Glass.py -f ips.txt //支持文本内IP资产,可添加IP段

结果输出

结果输出在../output/xxxxx.txt

识别规则添加方法

目前只加了对源码和header头文件进行识别,后面会陆续添加识别的规则以及方式

已加入cookie识别

规则文件在config/rules.py

添加方法

['CMS', 'headers', '(nginx)']
['CMS', 'cookie', '(MorkerSession)']
['CMS', 'code', '(Morker)']

三种识别方式,headers头文件识别,cookie识别,code源码识别

支持同方式多种识别内容,比如:

['CMS', 'code', '(Morker)|css/css.css']

注:单引号和反斜杆记得转义,转义符号为\

四、效果:

1.本地识别:

2.fofa识别:

五、特别感谢

  • s7ck Team
  • Morker
  • XBJ
  • d0gamn

特别感谢EHole(棱洞) 运行思路

六、文末

Github项目地址(BUG、需求、规则欢迎提交): https://github.com/s7ckTeam/Glass

404StarLink 2.0 - Galaxy

Glass 是 404Team 星链计划2.0中的一环,如果对Glass 有任何疑问又或是想要找小伙伴交流,可以参考星链计划的加群方式。

Owner
s7ck Team
s7ck Team
A small POC plugin for launching dumpulator emulation within IDA, passing it addresses from your IDA view using the context menu.

Dumpulator-IDA Currently proof-of-concept This project is a small POC plugin for launching dumpulator emulation within IDA, passing it addresses from

Michael 9 Sep 21, 2022
MainCoon - an automated recon framework

MainCoon is an automated recon framework meant for gathering information during penetration testing of web applications.

Md. Nur habib 8 Aug 26, 2022
This is a simple Port Flooder written in Python 3.

This is a simple Port Flooder written in Python 3. Use this tool to quickly stress test your network devices and measure your router's or server's load.

Júlio Carneiro 4 Feb 20, 2022
A fast sub domain brute tool for pentesters

subDomainsBrute 1.4 A fast sub domain brute tool for pentesters. It works with P

Oliver 2 Oct 18, 2022
Generates password lists/dictionaries based on keywords written in python3.

dicbyru Introduction Generates password lists/dictionaries based on keywords. It uses the keywords and adds capital letters, numbers and special chara

ru55o 2 Oct 31, 2022
Simplify getting and using cookies from the browser to use in Python.

CookieCache Simplify getting and using cookies from the browser to use in Python. NOTE: All the logic to interface with the browsers is done by the Br

pat_h/to/file 2 May 06, 2022
Apache OFBiz rmi反序列化EXP(CVE-2021-26295)

Apache OFBiz rmi反序列化EXP(CVE-2021-26295) 目前仅支持nc弹shell 将ysoserial.jar放置在同目录下,py3运行,根据提示输入漏洞url,你的vps地址和端口 第二次使用建议删除exp.ot 本工具仅用于安全测试,禁止未授权非法攻击站点,否则后果自负

15 Nov 09, 2022
AnonStress-Stored-XSS-Exploit - An exploit and demonstration on how to exploit a Stored XSS vulnerability in anonstress

AnonStress Stored XSS Exploit An exploit and demonstration on how to exploit a S

صلى الله على محمد وآله 3 Jun 22, 2022
Exploit for GitLab CVE-2021-22205 Unauthenticated Remote Code Execution

Vuln Impact An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files tha

Hendrik Agung 2 Dec 30, 2021
The best Python Backdoor👌

Backdoor The best Python Backdoor Files Server file is used in all of cases If client is Windows, the client need execute EXE file If client is Linux,

13 Oct 28, 2022
Lnkbomb - Malicious shortcut generator for collecting NTLM hashes from insecure file shares

Lnkbomb Lnkbomb is used for uploading malicious shortcut files to insecure file

Joe Helle 216 Jan 08, 2023
Finite Volume simulation of the Raleigh-Taylor Instability

finitevolume2-python Finite Volume simulation of the Raleigh-Taylor Instability Create Your Own Finite Volume Fluid Simulation (With Python): Part 2 B

Philip Mocz 12 Sep 01, 2022
APKLeaks - Scanning APK file for URIs, endpoints & secrets.

APKLeaks - Scanning APK file for URIs, endpoints & secrets.

dw1 3.5k Jan 09, 2023
Privacy-respecting metasearch engine

Privacy-respecting, hackable metasearch engine / pronunciation səːks. If you are looking for running instances, ready to use, then visit searx.space.

Searx engine 12.4k Jan 08, 2023
一款辅助探测Orderby注入漏洞的BurpSuite插件,Python3编写,适用于上xray等扫描器被ban的场景

OrderbyHunter 一款辅助探测Orderby注入漏洞的BurpSuite插件,Python3编写,适用于上xray等扫描器被ban的场景 1. 支持Get/Post型请求参数的探测,被动探测,对于存在Orderby注入的请求将会在HTTP Histroy里标红 2. 自定义排序参数list

Automne 21 Aug 12, 2022
Cam-Hacker: Ip Cameras hack with python

Cam-Hacker Hack Cameras Mode Of Execution: apt-get install python3 apt-get insta

Error 4 You 9 Dec 17, 2022
Lightweight and beneficial Dependency Injection plugin for apscheduler

Implementation of dependency injection for apscheduler Prerequisites: apscheduler-di solves the problem since apscheduler doesn't support Dependency I

Glib 11 Dec 07, 2022
将hw时信息收集以及简单的漏洞操作步骤简单化

Braised-vegetables 将hw时信息收集以及简单的漏洞扫描操作步骤简单化 使用subfinder(被动子域名爆破收集) subdomain(主动域名爆破) nabbu(端口扫描) httpx(探测目录浏览) crawlergo(360深度爬虫) chorme(谷歌浏览器) xray(漏

19 Nov 15, 2022
Hacktricks - Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

Hacktricks - Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

Carlos Polop 5.8k Jan 07, 2023
Confluence OGNL injection

CVE-2021-26084 Confluence OGNL injection CVE-2021-26084 is an Object-Graph Navigation Language (OGNL) injection vulnerability in the Atlassian Conflue

Ashish Kunwar 15 Sep 23, 2022