def _get_domains(org_id, domain_address, ip_address):
'''获取域名
'''
domain_app = Domain()
domain_attr_app = DomainAttr()
org_app = Organization()
api = AssertInfoParser()
domain_list = []
domains = domain_app.gets_by_org_domain_ip(
org_id, domain_address, ip_address, page=1, rows_per_page=100000)
if domains:
for index, domain_row in enumerate(domains):
ips = domain_attr_app.gets(
query={'tag': 'A', 'r_id': domain_row['id']})
domain_info = api.get_domain_info(domain_row['id'])
domain_list.append({
'id': domain_row['id'],
"index": index+1,
"domain": domain_row['domain'],
"ip": ', '.join(set([ip_row['content'] for ip_row in ips])),
"org_name": org_app.get(int(domain_row['org_id']))['org_name'] if domain_row['org_id'] else '',
"create_time": str(domain_row['create_datetime']),
"update_time": str(domain_row['update_datetime']),
'port': ', '.join([str(x) for x in domain_info['port']]),
'title': '\n'.join(domain_info['title']),
'banner': '\n'.join(domain_info['banner'])
})
return domain_list
def _get_ips(org_id, domain_address, ip_address, port, content, iplocation,
port_status, color_tag, memo_content):
'''获取IP
'''
ip_table = Ip()
aip = AssertInfoParser()
ip_list = []
ips = ip_table.gets_by_search(org_id=org_id,
domain=domain_address,
ip=ip_address,
port=port,
content=content,
iplocation=iplocation,
port_status=port_status,
color_tag=color_tag,
memo_content=memo_content,
page=1,
rows_per_page=100000)
if ips:
for i, ip_row in enumerate(ips):
ip_info = aip.get_ip_info(ip_row['id'])
ip_info.update(index=i + 1)
ip_list.append(ip_info)
return ip_list
def ip_statistics_view():
'''统计IP数据
'''
org_id = request.args.get('org_id')
domain_address = request.args.get('domain_address')
ip_address = request.args.get('ip_address')
port = request.args.get('port')
content = request.args.get('content')
iplocation = request.args.get('iplocation')
ip_list, ip_c_set, port_set, port_count_dict = AssertInfoParser().statistics_ip(
org_id, domain_address, ip_address, port, content, iplocation)
data = []
data.append('Port: ({})'.format(len(port_set)))
data.append(','.join([str(x) for x in sorted(port_set)]))
port_count_list = sorted(port_count_dict.items(),
key=lambda x: x[1], reverse=True)
data.append('\nPort Count:')
for pc in port_count_list:
data.append('{:<6}:{}'.format(pc[0], pc[1]))
data.append('\nNetwork: ({})'.format(len(ip_c_set)))
data.extend(sorted(ip_c_set))
data.append('\nIP: ({})'.format(len(ip_list)))
data.extend(ip_list)
response = Response(
'\n'.join(data), content_type='application/octet-stream')
response.headers["Content-disposition"] = 'attachment; filename={}'.format(
"ip-statistics.txt")
return response
def ip_memo_export_view():
'''导出备忘录信息
'''
org_id = request.args.get('org_id')
domain_address = request.args.get('domain_address')
ip_address = request.args.get('ip_address')
port = request.args.get('port')
content = request.args.get('content')
iplocation = request.args.get('iplocation')
port_status = request.args.get('port_status')
color_tag = request.args.get('color_tag')
memo_content = request.args.get('memo_content')
date_delta = request.args.get('date_delta')
memo_list = AssertInfoParser().export_ip_memo(org_id, domain_address,
ip_address, port, content,
iplocation, port_status,
color_tag, memo_content,
date_delta)
response = Response('\n'.join(memo_list),
content_type='application/octet-stream')
response.headers["Content-disposition"] = 'attachment; filename={}'.format(
"ip-memo.txt")
return response
def domain_asset_info_view():
'''显示一个DOMAIN的详细信息
'''
domain = request.args.get('domain')
domains = Domain().gets(query={'domain': domain})
if domains and len(domains) > 0:
domain_info = AssertInfoParser().get_domain_info(domains[0]['id'])
# 表格背景设置：
table_backgroud_set = False
if 'port_attr' in domain_info and domain_info['port_attr']:
for p in domain_info['port_attr']:
if p['ip'] and p['port']:
table_backgroud_set = not table_backgroud_set
p['table_backgroud_set'] = table_backgroud_set
else:
domain_info = None
return render_template('domain-info.html', domain_info=domain_info)
def ip_asset_info_view():
'''显示一个IP地址的详细信息
'''
ip = request.args.get('ip')
ips = Ip().gets(query={'ip': ip})
if ips and len(ips) > 0:
ip_info = AssertInfoParser().get_ip_info(ips[0]['id'])
if 'port_attr' in ip_info and ip_info['port_attr']:
# 表格背景设置：
table_backgroud_set = False
for p in ip_info['port_attr']:
if p['ip'] and p['port']:
table_backgroud_set = not table_backgroud_set
p['table_backgroud_set'] = table_backgroud_set
else:
ip_info = None
return render_template('ip-info.html', ip_info=ip_info)
def domain_memo_export_view():
'''导出域名的备忘录信息
'''
org_id = request.args.get('org_id')
ip_address = request.args.get('ip_address')
domain_address = request.args.get('domain_address')
color_tag = request.args.get('color_tag')
memo_content = request.args.get('memo_content')
memo_list = AssertInfoParser().export_domain_memo(org_id, domain_address,
ip_address, color_tag,
memo_content)
response = Response('\n'.join(memo_list),
content_type='application/octet-stream')
response.headers["Content-disposition"] = 'attachment; filename={}'.format(
"domain-memo.txt")
return response
def domain_asset_view():
'''页面上显示域名资产，datatable前端ajax请求进行分页
'''
if request.method == 'GET':
org_table = Organization()
org_list = org_table.gets()
if not org_list:
org_list = []
org_list.insert(0, {'id': '', 'org_name': '--全部--'})
data = {
'org_list': org_list,
'domain_address': session.get('domain_address', default=''),
'ip_address_domain': session.get('ip_address_domain', default=''),
'session_org_id': session.get('session_org_id', default=''),
'pocsuite3_poc_files': Pocsuite3().load_poc_files(),
'xray_poc_files': XRay().load_poc_files()
}
return render_template('domain-list.html', data=data)
domain_list = []
org_table = Organization()
domain_table = Domain()
domain_attr_table = DomainAttr()
api = AssertInfoParser()
index = 1
json_data = {}
try:
draw = int(request.form.get('draw'))
start = int(request.form.get('start'))
length = int(request.form.get('length'))
org_id = request.form.get('org_id')
ip_address = request.form.get('ip_address')
domain_address = request.form.get('domain_address')
color_tag = request.form.get('color_tag')
memo_content = request.form.get('memo_content')
date_delta = request.form.get('date_delta')
session['ip_address_domain'] = ip_address
session['domain_address'] = domain_address
session['session_org_id'] = org_id
count = 0
domains = domain_table.gets_by_search(org_id,
domain_address,
ip_address,
color_tag,
memo_content,
date_delta,
page=start // length + 1,
rows_per_page=length)
if domains:
for domain_row in domains:
ips = domain_attr_table.gets(query={
'tag': 'A',
'r_id': domain_row['id']
})
domain_info = api.get_domain_info(domain_row['id'])
# 获取关联的漏洞信息：
vul_info = []
vul_results = Vulnerability().gets(
{'target': domain_row['domain']})
if vul_results and len(vul_results) > 0:
for v in vul_results:
vul_info.append('{}/{}'.format(v['poc_file'],
v['source']))
domain_list.append({
"id":
domain_row['id'],
"index":
index + start,
"color_tag":
domain_info['color_tag'],
"memo_content":
domain_info['memo'],
"domain":
domain_row['domain'],
"ip":
', '.join(
set([
'<a href="/ip-info?ip={0}" target="_blank">{0}</a>'
.format(ip_row['content']) for ip_row in ips
])),
"org_name":
org_table.get(int(domain_row['org_id']))['org_name']
if domain_row['org_id'] else '',
"create_time":
str(domain_row['create_datetime']),
"update_time":
str(domain_row['update_datetime']),
'port':
domain_info['port'],
'title':
', '.join(domain_info['title']),
'banner':
', '.join(domain_info['banner']),
'vulnerability':
'\r\n'.join(vul_info)
})
index += 1
count = domain_table.count_by_search(org_id, domain_address,
ip_address, color_tag,
memo_content, date_delta)
json_data = {
'draw': draw,
'recordsTotal': count,
'recordsFiltered': count,
'data': domain_list
}
except Exception as e:
logger.error(traceback.format_exc())
print(e)
return jsonify(json_data)
def domain_asset_view():
'''页面上显示域名资产，datatable前端ajax请求进行分页
'''
if request.method == 'GET':
org_table = Organization()
org_list = org_table.gets()
if not org_list:
org_list = []
org_list.insert(0, {'id': '', 'org_name': '--组织机构--'})
data = {
'org_list': org_list,
'domain_address': session.get('domain_address', default=''),
'ip_address_domain': session.get('ip_address_domain', default=''),
'session_org_id': session.get('session_org_id', default='')
}
return render_template('domain-list.html', data=data)
domain_list = []
org_table = Organization()
domain_table = Domain()
domain_attr_table = DomainAttr()
api = AssertInfoParser()
index = 1
json_data = {}
try:
draw = int(request.form.get('draw'))
start = int(request.form.get('start'))
length = int(request.form.get('length'))
org_id = request.form.get('org_id')
ip_address = request.form.get('ip_address')
domain_address = request.form.get('domain_address')
session['ip_address_domain'] = ip_address
session['domain_address'] = domain_address
session['session_org_id'] = org_id
count = 0
domains = domain_table.gets_by_org_domain_ip(org_id,
domain_address,
ip_address,
page=start // length + 1,
rows_per_page=length)
if domains:
for domain_row in domains:
ips = domain_attr_table.gets(query={
'tag': 'A',
'r_id': domain_row['id']
})
domain_info = api.get_domain_info(domain_row['id'])
domain_list.append({
'id':
domain_row['id'],
"index":
index + start,
"domain":
domain_row['domain'],
"ip":
', '.join(
set([
'<a href="/ip-info?ip={0}" target="_blank">{0}</a>'
.format(ip_row['content']) for ip_row in ips
])),
"org_name":
org_table.get(int(domain_row['org_id']))['org_name']
if domain_row['org_id'] else '',
"create_time":
str(domain_row['create_datetime']),
"update_time":
str(domain_row['update_datetime']),
'port':
domain_info['port'],
'title':
', '.join(domain_info['title']),
'banner':
', '.join(domain_info['banner'])
})
index += 1
count = domain_table.count_by_org_domain_ip(
org_id, domain_address, ip_address)
json_data = {
'draw': draw,
'recordsTotal': count,
'recordsFiltered': count,
'data': domain_list
}
except Exception as e:
logger.error(traceback.format_exc())
print(e)
return jsonify(json_data)
def ip_asset_view():
'''IP资产列表展示
'''
if request.method == 'GET':
org_table = Organization()
org_list = org_table.gets()
if not org_list:
org_list = []
org_list.insert(0, {'id': '', 'org_name': '--组织机构--'})
data = {'org_list': org_list, 'ip_address_ip': session.get('ip_address_ip', default=''), 'domain_address': session.get('domain_address', default=''),
'port': session.get('port', default=''), 'session_org_id': session.get('session_org_id', default='')}
return render_template('ip-list.html', data=data)
ip_table = Ip()
org_table = Organization()
aip = AssertInfoParser()
ip_list = []
json_data = {}
index = 1
try:
draw = int(request.form.get('draw'))
start = int(request.form.get('start'))
length = int(request.form.get('length'))
org_id = request.form.get('org_id')
ip_address = request.form.get('ip_address')
domain_address = request.form.get('domain_address')
port = request.form.get('port')
content = request.form.get('content')
iplocation = request.form.get('iplocation')
session['ip_address_ip'] = ip_address
session['domain_address'] = domain_address
session['port'] = port
session['session_org_id'] = org_id
count = 0
ips = ip_table.gets_by_search(org_id=org_id, domain=domain_address, ip=ip_address,
port=port, content=content, iplocation=iplocation, page=(start//length)+1, rows_per_page=length)
if ips:
for ip_row in ips:
port_list, title_set, banner_set, ports_attr_info = aip.get_ip_port_info(
ip_row['ip'], ip_row['id'])
ip_list.append({
'id': ip_row['id'],
"index": index+start,
"org_name": org_table.get(int(ip_row['org_id']))['org_name'] if ip_row['org_id'] else '',
"ip": ip_row['ip'],
"status": ip_row['status'],
"location": ip_row['location'].split(',')[0] if ip_row['location'] else '',
"create_time": str(ip_row['create_datetime']),
"update_time": str(ip_row['update_datetime']),
"port": port_list,
"title": ', '.join(list(title_set)),
"banner": ', '.join(list(banner_set))
})
index += 1
count = ip_table.count_by_search(org_id=org_id, domain=domain_address,
ip=ip_address, port=port, content=content, iplocation=iplocation)
json_data = {
'draw': draw,
'recordsTotal': count,
'recordsFiltered': count,
'data': ip_list
}
except Exception as e:
logger.error(traceback.format_exc())
print(e)
return jsonify(json_data)
def ip_asset_view():
'''IP资产列表展示
'''
if request.method == 'GET':
org_table = Organization()
org_list = org_table.gets()
if not org_list:
org_list = []
org_list.insert(0, {'id': '', 'org_name': '--全部--'})
data = {
'org_list': org_list,
'ip_address_ip': session.get('ip_address_ip', default=''),
'domain_address': session.get('domain_address', default=''),
'port': session.get('port', default=''),
'session_org_id': session.get('session_org_id', default=''),
'pocsuite3_poc_files': Pocsuite3().load_poc_files(),
'xray_poc_files': XRay().load_poc_files()
}
return render_template('ip-list.html', data=data)
ip_table = Ip()
org_table = Organization()
ip_color_tag_table = IpColorTag()
ip_memo_table = IpMemo()
aip = AssertInfoParser()
ip_list = []
json_data = {}
index = 1
try:
draw = int(request.form.get('draw'))
start = int(request.form.get('start'))
length = int(request.form.get('length'))
org_id = request.form.get('org_id')
ip_address = request.form.get('ip_address')
domain_address = request.form.get('domain_address')
port = request.form.get('port')
content = request.form.get('content')
iplocation = request.form.get('iplocation')
port_status = request.form.get('port_status')
color_tag = request.form.get('color_tag')
memo_content = request.form.get('memo_content')
date_delta = request.form.get('date_delta')
session['ip_address_ip'] = ip_address
session['domain_address'] = domain_address
session['port'] = port
session['session_org_id'] = org_id
count = 0
ips = ip_table.gets_by_search(org_id=org_id,
domain=domain_address,
ip=ip_address,
port=port,
content=content,
iplocation=iplocation,
port_status=port_status,
color_tag=color_tag,
memo_content=memo_content,
date_delta=date_delta,
page=(start // length) + 1,
rows_per_page=length)
if ips:
for ip_row in ips:
# 查询每一个IP的详细属性
port_list, title_set, banner_set, _, port_status_dict = aip.get_ip_port_info(
ip_row['ip'], ip_row['id'])
# 端口+HTTP状态码
port_with_status_list = []
for p in port_list:
if str(p) in port_status_dict and re.match(
r'^\d{3}$', port_status_dict[str(p)]):
port_with_status_list.append("{}[{}]".format(
p, port_status_dict[str(p)]))
else:
port_with_status_list.append(str(p))
# 获取颜色标记
color_tag_obj = ip_color_tag_table.get(ip_row['id'])
# 获取备忘录信息
memo_obj = ip_memo_table.get(ip_row['id'])
# 获取IP关联的漏洞信息：
vul_info = []
vul_results = Vulnerability().gets({'target': ip_row['ip']})
if vul_results and len(vul_results) > 0:
for v in vul_results:
vul_info.append('{}/{}'.format(v['poc_file'],
v['source']))
# 显示的数据
ip_list.append({
'id':
ip_row['id'],
"index":
index + start,
'color_tag':
color_tag_obj['color'] if color_tag_obj else '',
'memo_content':
memo_obj['content'] if memo_obj else '',
'vulnerability':
'\r\n'.join(vul_info),
"org_name":
org_table.get(int(ip_row['org_id']))['org_name']
if ip_row['org_id'] else '',
"ip":
ip_row['ip'],
"status":
ip_row['status'],
"location":
ip_row['location'].split(',')[0]
if ip_row['location'] else '',
"create_time":
str(ip_row['create_datetime']),
"update_time":
str(ip_row['update_datetime']),
"port":
port_with_status_list,
"title":
', '.join(list(title_set)),
"banner":
', '.join(list(banner_set))
})
index += 1
# 查询的记录数量
count = ip_table.count_by_search(org_id=org_id,
domain=domain_address,
ip=ip_address,
port=port,
content=content,
iplocation=iplocation,
port_status=port_status,
color_tag=color_tag,
memo_content=memo_content,
date_delta=date_delta)
json_data = {
'draw': draw,
'recordsTotal': count,
'recordsFiltered': count,
'data': ip_list
}
except Exception as e:
logger.error(traceback.format_exc())
print(e)
return jsonify(json_data)