一款用于滲透測試的多功能掃描工具

Vxscan介紹

python3寫的綜合掃描工具，主要用來敏感文件探測(目錄掃描與js泄露接口)，WAF/CDN識別，端口掃描，指紋/服務(wù)識別，操作系統(tǒng)識別，弱口令探測，POC掃描，SQL注入，繞過CDN，查詢旁站等功能，主要用來甲方自測或乙方授權(quán)測試，請勿用來搞破壞。

看到上面的介紹也嚇一跳，這么多功能？但是依賴也多呀：

Python version > 3.6
requests
tqdm
pyfiglet
fake-useragent
beautifulsoup4
pycrypto
paramiko
geoip2
tldextract
pymysql
pymssql
python-nmap
geoip2
tldextract
lxml
pymongo
psycopg2
virustotal_python
apt install libpq-dev nmap
wget https://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gz
解壓后將里面的GeoLite2-City.mmdb放到vxscan/db/GeoLite2-City.mmdb
pip3 install -r requirements.txt

Vxscan特點

• 使用笛卡爾乘積方式生成字典列表，支持自定義字典列表

• 隨機的UserAgent、XFF、X-Real-IP

• 自定義404頁面識別，訪問隨機頁面然后通過difflib對比相似度，識別自定義302跳轉(zhuǎn)

• 掃描目錄時先探測http端口，將一個主機多個http端口加入到掃描目標(biāo)中

• 過濾無效Content-Type，無效狀態(tài)嗎

• WAF/CDN探測

• 使用socket發(fā)包探測常見端口，發(fā)送不同payload探測端口服務(wù)指紋

• 遇到全端口開放的主機(portspoof)自動跳過

• 調(diào)用wappalyzer.json與WebEye判斷網(wǎng)站指紋

• 檢測到CDN或者WAF網(wǎng)站自動跳過

• 調(diào)用nmap識別操作系統(tǒng)指紋

• 根據(jù)端口開放調(diào)用弱口令探測腳本(FTP/SSH/TELNET/Mysql/MSSQL...)

• 根據(jù)指紋識別或者端口調(diào)用POC掃描,或?qū)P開放的WEB端口上打一遍

• 分析js文件里面的敏感資產(chǎn)信息(域名、郵箱、apikey、password等)

• 抓取網(wǎng)站連接，測試SQL注入，LFI等

• 調(diào)用一些在線接口獲取信息例如VT、www.yougetsignal.com等網(wǎng)站，通過VT pdns判斷真實IP，通過www.yougetsignal.com、api.hackertarget.com查詢網(wǎng)站旁站

Vxscan安裝與使用

安裝

git clone https://github.com/al0ne/Vxscan.git

python3Vxscan.py-h
optional arguments:
  -h, --help            show this help message and exit  
  -u URL, --url URL     Start scanning this url -u xxx.com  
  -i INET, --inet INET  cidr eg. 1.1.1.1 or 1.1.1.0/24  
  -f FILE, --file FILE  read the url from the file  
  -t THREADS, --threads THREADS  
                        Set scan thread, default 150  
  -e EXT, --ext EXT     Set scan suffix, -e php,asp  
  -w WORD, --word WORD  Read the dict from the file

掃描一個網(wǎng)站
python3 vxscan.py -u http://www.xxx.com/ 
從文件列表里掃描網(wǎng)站
python3 vxscan.py -f hosts.txt
掃描一個C段
python3 vxscan.py -i 127.0.0.0/24
設(shè)置線程100，組合只用php后綴，使用自定義字典
python3 vxscan.py -u http://www.xxx.com -e php -t 100 -w ../dict.txt

Vxscan支持識別Waf/CDN

360
360wzws
Anquanbao
Armor
BaiduYunjiasu
AWS WAF
AdNovum
Airee CDN
Art of Defence HyperGuard
ArvanCloud
Barracuda NG
Beluga CDN
BinarySEC
BlockDoS
Bluedon IST
CacheFly CDN
ChinaCache CDN
Cisco ACE XML Gateway
CloudFlare CDN
Cloudfront CDN
Comodo
CompState
DenyALL WAF
DenyAll
Distil Firewall
DoSArrest Internet Security
F5 BIG-IP APM
F5 BIG-IP ASM
F5-TrafficShield
Fastly CDN
FortiWeb
FortiWeb Firewall
GoDaddy
GreyWizard Firewall
HuaweiCloudWAF
HyperGuard Firewall
IBM DataPower
ISAServer
Immunify360
Imperva SecureSphere
Incapsula CDN
Jiasule
KONA
KeyCDN
ModSecurity
NGENIX CDN
NSFOCUS
Naxsi
NetContinuum
NetContinuum WAF
Neusoft SEnginx
Newdefend
Palo Alto Firewall
PerimeterX Firewall
PowerCDN
Profense
Qiniu CDN
Reblaze Firewall
SDWAF
Safe3
Safedog
SiteLock TrueShield
SonicWALL
SonicWall
Sophos UTM Firewall
Stingray
Sucuri
Teros WAF
Usp-Sec
Varnish
Wallarm
WatchGuard
WebKnight
West263CDN
Yundun
Yunsuo
ZenEdge Firewall
aesecure
aliyun
azion CDN
cloudflare CDN
dotDefender
limelight CDN
maxcdn CDN
mod_security
yunsuo

Vxscan下載地址

https://github.com/al0ne/Vxscan