在进行web打点时,信息收集中对目标进行指纹识别是必不可少的一个环节,使用EHole识别出来的重点资产还要用其他漏洞利用工具去检测,非常的不方便,在原本的基础上加了个漏洞检测功能。提打点的效率。(不影响原版功能的使用)
对资产进行指纹识别-->重点资产进行漏洞检测-->如:http://www.xxx.com存在通达OA--> 对通达OA漏洞进行扫描->对ftp服务进行暴力破解
默认不开启,在poc.ini中将poc=no改为poc=yes开启
ftp爆破默认不开启,在poc.ini中将brute=no改为brute=yes开启
注意:从FOFA识别需要配置FOFA 密钥以及邮箱,在config.ini内配置好密钥以及邮箱即可使用。
ehole finger -s domain="baidu.com" // 支持所有fofa语法
注意:从hunter识别需要配置hunter 密钥,在config.ini内配置好密钥即可使用。
ehole finger -b ip="180.140.20.182" // 支持所有hunter语法
ehole finger -l 1.txt // 从文件中加载url扫描
ehole finger -u http://www.baidu.com // 单个url检测
![image](https://private-user-images.githubusercontent.com/56328995/250366651-e4064f38-6458-4778-a2f5-b7db2de54b1d.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ0NDIxNTcsIm5iZiI6MTcyNDQ0MTg1NywicGF0aCI6Ii81NjMyODk5NS8yNTAzNjY2NTEtZTQwNjRmMzgtNjQ1OC00Nzc4LWEyZjUtYjdkYjJkZTU0YjFkLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIzVDE5MzczN1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTYyOTlhMmIyMWVmMzIzNzVkMjk5MmVmOWJmYTlkMTk1OTlhZmJkOGQ1Y2IyMzVmMjI3MzQzYzQ1ZjY4MzdlZWImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.2kBpjA_j07DUJ5E58LraJca2oLSc4_iYdobAzIq0QZI)
1、修复mac版报错segmentation fault
2、增加从hunter提取资产,进行指纹识别
![image](https://private-user-images.githubusercontent.com/56328995/251018087-f2c733d8-6bf6-4d56-b31b-61015421fd7c.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ0NDIxNTcsIm5iZiI6MTcyNDQ0MTg1NywicGF0aCI6Ii81NjMyODk5NS8yNTEwMTgwODctZjJjNzMzZDgtNmJmNi00ZDU2LWIzMWItNjEwMTU0MjFmZDdjLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIzVDE5MzczN1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTY0YjA0ZDQxM2UwNjkxOWVlZDdmOTA5ZDE4NTMzODI5ZmJiYmNmMDMxMGVkYjY0YjAwYWI2YzNhZGQ0MDcyODkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.1IrRPHd9YiTEwOdRmWNiDPm3lklfFxV7dsPFjiBuEz0)
![image](https://private-user-images.githubusercontent.com/56328995/251017738-dfb7b200-4938-41b1-88c3-9756c6970ebc.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ0NDIxNTcsIm5iZiI6MTcyNDQ0MTg1NywicGF0aCI6Ii81NjMyODk5NS8yNTEwMTc3MzgtZGZiN2IyMDAtNDkzOC00MWIxLTg4YzMtOTc1NmM2OTcwZWJjLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIzVDE5MzczN1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTdmOTk1ODk2MjU2YTJmNmU0YWIzMWFmMTdjNjdjMzU3NzcyOGIyYWMwOTJiYzQxY2MzOThkNTFlZWJmZGM2MDkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.XftK1lt4IH2Y27U8HBft4gNsHTkd7xCssC7wyOFay4w)
1、增加常用poc数量
2、对ftp服务进行检测,将poc.ini中的brute设置为yes可进行密码爆破
![image](https://private-user-images.githubusercontent.com/56328995/251691661-d28ca59b-3eab-4ef8-a19a-d8726ed274f2.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ0NDIxNTcsIm5iZiI6MTcyNDQ0MTg1NywicGF0aCI6Ii81NjMyODk5NS8yNTE2OTE2NjEtZDI4Y2E1OWItM2VhYi00ZWY4LWExOWEtZDg3MjZlZDI3NGYyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIzVDE5MzczN1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTEwYzVmN2NmNmJhMzRiNTdkZWMwOGQ4NzdmYzg5NzU2ZTI5Y2RiOWUyMzlkM2RjMzFjN2VhN2IxODA1NDhhZjgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.sLktDsMaIRQOSFyi2QOsGQa-LLsgZ5zGDD6ADbt_YpE)
![image](https://private-user-images.githubusercontent.com/56328995/251692247-2fe41884-dd51-48ce-8651-b20e3a4a8139.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ0NDIxNTcsIm5iZiI6MTcyNDQ0MTg1NywicGF0aCI6Ii81NjMyODk5NS8yNTE2OTIyNDctMmZlNDE4ODQtZGQ1MS00OGNlLTg2NTEtYjIwZTNhNGE4MTM5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIzVDE5MzczN1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTI3YWZiZGQwMWQ5ODUxYzdhZWQ0Yjc5MDZiMmMxODU3MzllMzU1NTk0Zjk4MTU2MzNkZGFhMzk5NTcyN2U3ZDMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.6acqYM4fn168vAdK8dmoGWwYqnvblbfBOEM0bApnhjc)
1、更新指纹数量,1w+
2、修复fofa -f或者-s 后没有具体资产显示
3、增加宏景eHR人力资源信息管理系统sql注入检测
![image](https://private-user-images.githubusercontent.com/56328995/253150036-98c7590d-0dce-4b10-a329-5db313c5e484.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ0NDIxNTcsIm5iZiI6MTcyNDQ0MTg1NywicGF0aCI6Ii81NjMyODk5NS8yNTMxNTAwMzYtOThjNzU5MGQtMGRjZS00YjEwLWEzMjktNWRiMzEzYzVlNDg0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIzVDE5MzczN1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWE5ZjM1ZjkwMWU1ZmM3YjJjN2E1MjhiODg3Yzg4OGMzYWM0MjE2OWY2OGZmNDk3NGVjZmM5ODUwY2QzYTZlN2MmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.dct5vsZkAvzZsDRqRLKINEeYHmJMC_qZ443UpDX18Ac)
![image](https://private-user-images.githubusercontent.com/56328995/253208339-78af3d01-7c23-4058-9071-402e07dbea6a.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ0NDIxNTcsIm5iZiI6MTcyNDQ0MTg1NywicGF0aCI6Ii81NjMyODk5NS8yNTMyMDgzMzktNzhhZjNkMDEtN2MyMy00MDU4LTkwNzEtNDAyZTA3ZGJlYTZhLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIzVDE5MzczN1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWVkZDEzZjMwMzZhNGY4YTRiNzMyMzJkMmQxZmQzYzY1OTkyMGUxMzIxZGIyNWEwMGRjMzcwN2VjNzRmYzU0ODkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.3ynohvbjf7K3Kvl6w9R3h3ZdRiKxtnaSfIn82XdAaDI)
1、更新最近出的day(用友、金蝶云、大华)
2、优化指纹识别
POC-bomber:https://github.com/tr0uble-mAker/POC-bomber
peiqi文库:https://peiqi.wgpsec.org