fscan/Plugins/scanner.go

package Plugins

import (
	"fmt"
	"reflect"
	"strconv"
	"strings"
	"sync"

	"github.com/fatih/color"
	"github.com/shadow1ng/fscan/WebScan/lib"
	"github.com/shadow1ng/fscan/common"
)

func Scan(info common.HostInfo, flags common.Flags) {
	fmt.Println("start infoscan")
	Hosts, err := common.ParseIP(&info.HostPort, info.Host, flags.HostFile, flags.NoHosts)
	if err != nil {
		fmt.Println("len(hosts)==0", err)
		return
	}
	lib.Inithttp(flags)
	var ch = make(chan struct{}, flags.Threads)
	var wg = sync.WaitGroup{}
	web := strconv.Itoa(common.PORTList["web"])
	ms17010 := strconv.Itoa(common.PORTList["ms17010"])
	if len(Hosts) > 0 || len(info.HostPort) > 0 {
		if flags.NoPing == false && len(Hosts) > 0 {
			Hosts = CheckLive(Hosts, flags.Ping, flags.LiveTop)
			color.Cyan("[*] Icmp alive hosts len is: %d", len(Hosts))
		}
		if flags.Scantype == "icmp" {
			common.LogWG.Wait()
			return
		}

		var AlivePorts []string
		if flags.Scantype == "webonly" || flags.Scantype == "webpoc" {
			AlivePorts = NoPortScan(Hosts, info.Ports, flags)
		} else if flags.Scantype == "hostname" {
			info.Ports = "139"
			AlivePorts = NoPortScan(Hosts, info.Ports, flags)
		} else if len(Hosts) > 0 {
			AlivePorts = PortScan(Hosts, info.Ports, flags)
			color.Cyan("[*] alive ports len is: %d", len(AlivePorts))
			if flags.Scantype == "portscan" {
				common.LogWG.Wait()
				return
			}
		}
		if len(info.HostPort) > 0 {
			AlivePorts = append(AlivePorts, info.HostPort...)
			AlivePorts = common.RemoveDuplicate(AlivePorts)
			info.HostPort = nil
			color.Cyan("[*] AlivePorts len is:", len(AlivePorts))
		}

		var severports []string //severports := []string{"21","22","135"."445","1433","3306","5432","6379","9200","11211","27017"...}
		for _, port := range common.PORTList {
			severports = append(severports, strconv.Itoa(port))
		}
		fmt.Println("start vulscan")
		for _, targetIP := range AlivePorts {
			info.Host, info.Ports = strings.Split(targetIP, ":")[0], strings.Split(targetIP, ":")[1]
			if flags.Scantype == "all" || flags.Scantype == "main" {
				switch {
				case info.Ports == "135":
					AddScan(info.Ports, info, flags, &ch, &wg) //findnet
					if flags.IsWmi {
						AddScan("1000005", info, flags, &ch, &wg) //wmiexec
					}
				case info.Ports == "445":
					AddScan(ms17010, info, flags, &ch, &wg) //ms17010
					//AddScan(info.Ports, info, ch, &wg)  //smb
					//AddScan("1000002", info, ch, &wg) //smbghost
				case info.Ports == "9000":
					AddScan(web, info, flags, &ch, &wg)        //http
					AddScan(info.Ports, info, flags, &ch, &wg) //fcgiscan
				case IsContain(severports, info.Ports):
					AddScan(info.Ports, info, flags, &ch, &wg) //plugins scan
				default:
					AddScan(web, info, flags, &ch, &wg) //webtitle
				}
			} else {
				scantype := strconv.Itoa(common.PORTList[flags.Scantype])
				AddScan(scantype, info, flags, &ch, &wg)
			}
		}
	}

	for _, url := range flags.Urls {
		info.Url = url
		AddScan(web, info, flags, &ch, &wg)
	}

	wg.Wait()
	common.LogWG.Wait()
	close(common.Results)

	fmt.Printf("Finished %d/%d", common.End, common.Num)
}

var Mutex = &sync.Mutex{}

func AddScan(scantype string, info common.HostInfo, flags common.Flags, ch *chan struct{}, wg *sync.WaitGroup) {
	*ch <- struct{}{}
	wg.Add(1)
	go func() {
		Mutex.Lock()
		common.Num += 1
		Mutex.Unlock()
		ScanFunc(scantype, info, flags)
		Mutex.Lock()
		common.End += 1
		Mutex.Unlock()
		wg.Done()
		<-*ch
	}()
}

func ScanFunc(name string, info common.HostInfo, flags common.Flags) {
	f := reflect.ValueOf(PluginList[name])
	in := []reflect.Value{reflect.ValueOf(info), reflect.ValueOf(flags)}
	f.Call(in)
}

func IsContain(items []string, item string) bool {
	for _, eachItem := range items {
		if eachItem == item {
			return true
		}
	}
	return false
}