def init_spider(self):
for k, v in self.hash_pycode_Lists.iteritems():
pluginObj = self._load_module(v)
pluginObj.task_push = self.task_push
pluginObj.curl = miniCurl.Curl()
pluginObj.security_note = self._security_note
pluginObj.security_info = self._security_info
pluginObj.security_warning = self._security_warning
pluginObj.security_hole = self._security_hole
pluginObj.security_set = self._security_set
pluginObj.debug = self._debug
pluginObj.util = until
pluginObj._G = self._TargetScanAnge
pluginObj.hackhttp = hackhttp.hackhttp()
pluginObj.ThreadPool = w8_threadpool
try:
pluginObj_tuple = pluginObj.assign("spider_file", "")
if not isinstance(pluginObj_tuple, tuple): # 判断是否是元组
pluginObj_tuple = pluginObj.assign("spider_end", "")
if not isinstance(pluginObj_tuple, tuple):
continue
bool_value, agrs = pluginObj_tuple[0], pluginObj_tuple[1]
if bool_value:
pconf = {}
pconf["pluginObj"] = pluginObj
pconf["service"] = "spider_file"
w9_hash_pycode.setdefault(k, pconf)
except Exception as err_info:
raise ToolkitMissingPrivileges("load spider plugins error! " +
err_info)
def _load_module(self, chunk, name='<w9scan>'):
try:
pluginObj = imp.new_module(str(name))
exec chunk in pluginObj.__dict__
except Exception:
raise ToolkitMissingPrivileges("Load Module excepting")
return pluginObj
def _load_module(self, chunk, name='<Ajatar>'):
pluginObj = imp.new_module(str(name))
exec(chunk, pluginObj.__dict__)
try:
pluginObj = imp.new_module(str(name))
exec(chunk, pluginObj.__dict__)
except Exception:
raise ToolkitMissingPrivileges("Load Module excepting")
return pluginObj
def add_set(self, level, value, k='', domain=''):
if domain not in self.dict:
self.dict[domain] = dict()
self.dict[domain]["info"] = CollectData()
self.dict[domain]["note"] = CollectData()
self.dict[domain]["warning"] = CollectData()
self.dict[domain]["hole"] = CollectData()
if level not in self.dict[domain]:
raise ToolkitMissingPrivileges("Building error:level not in dict")
self.dict[domain][level].add_set(k, value)
def pluginScanRegister(args):
if args.u and args.plugin:
url = args.u
urlconfig.mutiurl = True
urlconfig.plugin = args.plugin
if url.startswith("@"):
fileName = url[1:]
try:
o = open(fileName,"r").readlines()
for u in o:
urlconfig.url.append(makeurl(u.strip()))
except IOError:
raise ToolkitMissingPrivileges("Filename:'%s' open faild"%fileName)
if len(o) == 0:
raise ToolkitMissingPrivileges("The target address is empty")
printMessage(urlconfig.url)
else:
urlconfig.url.append(makeurl(url))
def __init__(self, threadNum=15):
self.hash_pycode_Lists = {} #python代码字典 文件路径:代码
self.lock_result = threading.Lock() #
self.task_result = []
self.lock_output = threading.Lock()
self.table_exception = set()
#定义移除不用的插件
remove_plugins = list(
set(LIST_PLUGINS).difference(set(urlconfig.diyPlugin)))
#过滤除exp文件外pyc init DS 文件
def filter_func(file):
return (True, False)['__init__' in file or ".pyc" in file
or '.DS_Store' in file]
#getExp
def getExp():
direxp = []
#在目录树中游走输出在目录中的文件名 返回的是一个三元组(root,dirs,files)。
for dirpath, _, filenames in os.walk(paths.Ajatar_Plugin_PATH):
for filename in filenames:
#移除不用的插件
if filename.strip('.py') not in remove_plugins:
direxp.append(os.path.join(dirpath, filename))
return direxp
#过滤文件后的完整exp字典
dir_exploit = filter(filter_func, getExp())
#目标信息
self._TargetScanAnge = {
'target': urlconfig.url,
'scanport': urlconfig.scanport,
'find_service': urlconfig.find_service
}
try:
for exp in dir_exploit:
#读取python代码
with open(exp, 'rb') as f:
reads = str(f.read())
f.close()
#保存文件:code
self.hash_pycode_Lists.setdefault(os.path.basename(exp),
reads)
except Exception as error_info:
raise ToolkitMissingPrivileges(error_info)
self.buildHtml = buildHtml() #生成网页报告
self._print('Fetch %d new plugins' % len(self.hash_pycode_Lists))
self.th = Ajatar_threadpool(threadNum, self._work,
urlconfig.mutiurl) #调用work函数进入线程池
logger.info('Set threadnum:%d' % threadNum)
self.url = ""
def urlRegister(args):
#url处理
url = args.u
urlconfig.usePlugin = True
urlconfig.plugin = args.plugin
urlconfig.diyPlugin = [urlconfig.plugin]
if url.startswith("@"): #判断是否是文件
urlconfig.mutiurl = True
filename = url[1:] #取文件名
try:
o = open(filename, "r").readlines()
for u in o:
u = makeurl(u.strip()) #处理url
urlconfig.url.append(u)
printMessage(u) #获取url的信息
except IOError:
raise ToolkitMissingPrivileges("Filename:'%s' open faild" %
fileName)
if len(o) == 0:
raise ToolkitMissingPrivileges("The target address is empty")
else: #单个url处理
urlconfig.url.append(makeurl(url))
def __init__(self, threadNum=15):
self.hash_pycode_Lists = {}
self.lock_result = threading.Lock()
self.task_result = []
self.lock_output = threading.Lock()
self.table_exception = set()
remove_plugins = list(
set(LIST_PLUGINS).difference(set(urlconfig.diyPlugin)))
def filter_func(file):
return (True, False)['__init__' in file or ".pyc" in file
or '.DS_Store' in file]
def getExp():
direxp = []
for dirpath, _, filenames in os.walk(paths.w9scan_Plugin_Path):
for filename in filenames:
if filename.strip('.py') not in remove_plugins:
direxp.append(os.path.join(dirpath, filename))
return direxp
dir_exploit = filter(filter_func, getExp())
self._TargetScanAnge = {
'target': urlconfig.url,
'scanport': urlconfig.scanport,
'find_service': urlconfig.find_service
}
try:
for exp in dir_exploit:
with open(exp, 'rb') as f:
reads = str(f.read())
f.close()
self.hash_pycode_Lists.setdefault(os.path.basename(exp),
reads)
except Exception as error_info:
raise ToolkitMissingPrivileges(error_info)
self.buildHtml = buildHtml()
self._print('Fetch %d new plugins' % len(self.hash_pycode_Lists))
self.th = w8_threadpool(threadNum, self._work, urlconfig.mutiurl)
logger.info('Set threadnum:%d' % threadNum)
self.url = ""
def init_spider(self):
#items() 迭代器 k exp文件 v 代码
for k, v in self.hash_pycode_Lists.iteritems():
pluginObj = self._load_module(v) #动态加载代码
for each in ESSENTIAL_MODULE_METHODS: #bugcsan插件的两个主要函数
if not hasattr(pluginObj, each):
errorMsg = "Can't find essential method:'{}' in current script，Please modify your {}.".format(
each, k)
logger.error(errorMsg)
continue
pluginObj.task_push = self.task_push
pluginObj.curl = miniCurl.Curl() #bugscan 旧版http
#Bugscan 漏洞等级
pluginObj.security_note = self._security_note
pluginObj.security_info = self._security_info
pluginObj.security_warning = self._security_warning
pluginObj.security_hole = self._security_hole
pluginObj.security_set = self._security_set
pluginObj.debug = self._debug
pluginObj.util = until
pluginObj._G = self._TargetScanAnge #目标信息
pluginObj.hackhttp = hackhttp.hackhttp() #bugscan http
pluginObj.ThreadPool = Ajatar_threadpool #线程池
try:
#判断是否为爬虫插件 xss那些..
pluginObj_tuple = pluginObj.assign("spider_file", "") #
if not isinstance(pluginObj_tuple, tuple): # 判断是否是元组
pluginObj_tuple = pluginObj.assign("spider_end", "")
if not isinstance(pluginObj_tuple, tuple):
continue
bool_value, agrs = pluginObj_tuple[0], pluginObj_tuple[1]
if bool_value: #爬虫插件返回True
pconf = {}
pconf["pluginObj"] = pluginObj #保存爬虫插件对象
pconf["service"] = "spider_file"
Ajatar_hash_pycode.setdefault(k, pconf) #保存文件名，对象
except Exception as err_info:
raise ToolkitMissingPrivileges("load spider plugins error! " +
err_info)
def init_spider(self):
for k, v in self.hash_pycode_Lists.iteritems():
pluginObj = self._load_module(v)
for each in ESSENTIAL_MODULE_METHODS:
if not hasattr(pluginObj, each):
errorMsg = "Can't find essential method:'{}' in current script，Please modify your {}.".format(
each, k)
logger.error(errorMsg)
continue
pluginObj.task_push = self.task_push
pluginObj.curl = miniCurl.Curl()
pluginObj.security_note = self._security_note
pluginObj.security_info = self._security_info
pluginObj.security_warning = self._security_warning
pluginObj.security_hole = self._security_hole
pluginObj.security_set = self._security_set
pluginObj.debug = self._debug
pluginObj.util = until
pluginObj._G = self._TargetScanAnge
pluginObj.hackhttp = hackhttp.hackhttp()
pluginObj.ThreadPool = w8_threadpool
try:
pluginObj_tuple = pluginObj.assign("spider_file", "")
if not isinstance(pluginObj_tuple, tuple): # 判断是否是元组
pluginObj_tuple = pluginObj.assign("spider_end", "")
if not isinstance(pluginObj_tuple, tuple):
continue
bool_value, agrs = pluginObj_tuple[0], pluginObj_tuple[1]
if bool_value:
pconf = {}
pconf["pluginObj"] = pluginObj
pconf["service"] = "spider_file"
w9_hash_pycode.setdefault(k, pconf)
except Exception as err_info:
raise ToolkitMissingPrivileges("load spider plugins error! " +
err_info)
def mutiBuild(self):
# build base info
versionPlace = VERSION
reportTime = time.strftime('%Y-%m-%d %H:%M:%S',
time.localtime(time.time()))
selectPlugin = ' '.join(urlconfig.diyPlugin)
Ajatar_html = "PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KICA8aGVhZD4KICAgIDxtZXRhIGNoYXJzZXQ9InV0Zi04Ij4KICAgIDxtZXRhIGh0dHAtZXF1aXY9IlgtVUEtQ29tcGF0aWJsZSIgY29udGVudD0iSUU9ZWRnZSI+CiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEiPgoKICAgIDx0aXRsZT5BamF0YXIg5om56YeP5ryP5rSe5omr5o+P5oql5ZGKPC90aXRsZT4KCiAgICA8bWV0YSBuYW1lPSJkZXNjcmlwdGlvbiIgY29udGVudD0iU291cmNlIGNvZGUgZ2VuZXJhdGVkIHVzaW5nIGxheW91dGl0LmNvbSI+CiAgICA8bWV0YSBuYW1lPSJhdXRob3IiIGNvbnRlbnQ9IkxheW91dEl0ISI+CgogICAgPGxpbmsgcmVsPSJzdHlsZXNoZWV0IiBocmVmPSJodHRwOi8vY2RuLmJvb3Rjc3MuY29tL2Jvb3RzdHJhcC8zLjMuMC9jc3MvYm9vdHN0cmFwLm1pbi5jc3MiPiAKICAgIDxsaW5rIHJlbD0ic3R5bGVzaGVldCIgaHJlZj0iaHR0cDovL2Nkbi5ib290Y3NzLmNvbS9mb250LWF3ZXNvbWUvNC4yLjAvY3NzL2ZvbnQtYXdlc29tZS5taW4uY3NzIj4gCgogIDwvaGVhZD4KICA8Ym9keT4KCiAgICA8ZGl2IGNsYXNzPSJjb250YWluZXItZmx1aWQiPgoJPGRpdiBjbGFzcz0icm93Ij4KCQk8ZGl2IGNsYXNzPSJjb2wtbWQtMTIiPgoJCQk8ZGl2IGNsYXNzPSJwYWdlLWhlYWRlciI+CgkJCQk8aDE+CgkJCQkJQWphdGFy5om56YeP5omr5o+P5oql5ZGKICA8c21hbGw+dnt7dmVyc2lvbn19PC9zbWFsbD4KCQkJCTwvaDE+CgkJCTwvZGl2PiA8c3BhbiBjbGFzcz0ibGFiZWwgbGFiZWwtcHJpbWFyeSI+55Sf5oiQ5pe26Ze077yae3tyZXBvcnRUaW1lfX08L3NwYW4+CiAgICAgICAgICAgIDxzcGFuIGNsYXNzPSJsYWJlbCBsYWJlbC1zdWNjZXNzIj7pgInmi6nmj5Lku7bvvJp7e3NlbGVjdFBsdWdpbn19PC9zcGFuPgogICAgICAgICAgICA8c3BhbiBjbGFzcz0ibGFiZWwgbGFiZWwtZGFuZ2VyIj5TY2FuIHRpbWUJe3tzY2FudGltZX19PC9zcGFuPgogICAgICAgICAgICA8L2JyPjwvYnI+CgkJCTx0YWJsZSBjbGFzcz0idGFibGUiPgoJCQkJPHRoZWFkPgoJCQkJCTx0cj4KICAgIDx0aD4jPC90aD4KICAgIDx0aD5Vcmw8L3RoPgogICAgPHRoPlRpdGxlPC90aD4KICAgIDx0aD5CdWlsZHdpdGg8L3RoPgogICAgPHRoPkluZm88L3RoPgogICAgPHRoPk5vdGU8L3RoPgogICAgPHRoPldhcm5pbmc8L3RoPgogICAgPHRoPkhvbGU8L3RoPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90cj4KCQkJCTwvdGhlYWQ+CiAgICAgICAgICAgICAgICAKCQkJCTx0Ym9keT4KICAgICAgICAgICAgICAgICAgICB7e2NvbnRlbnR9fQoJCQkJPC90Ym9keT4KCQkJPC90YWJsZT4KCQk8L2Rpdj4KCTwvZGl2Pgo8L2Rpdj4KICA8L2JvZHk+CjwvaHRtbD4K"
Ajatar_html = base64.b64decode(Ajatar_html)
Ajatar_html = Ajatar_html.replace("{{version}}", str(versionPlace))
Ajatar_html = Ajatar_html.replace("{{reportTime}}", str(reportTime))
Ajatar_html = Ajatar_html.replace("{{scantime}}",
runningTime(urlconfig.runningTime))
Ajatar_html = Ajatar_html.replace("{{selectPlugin}}",
str(selectPlugin))
htmlDict = dict()
index = 0
full = []
try:
for url, content in self.dict.items():
htmlDict[url] = dict()
index = index + 1
Total = dict()
title = ""
server = ""
for key, value in content.items():
htmlDict[url][key] = value.getData()
if len(htmlDict[url][key]):
infoList = list()
if key == "info":
if "title" in htmlDict[url][key]:
title = htmlDict[url][key]["title"]
if isinstance(title, list):
title = ''.join(title)
htmlDict[url][key].pop("title")
if "WebStruct" in htmlDict[url][key]:
server = htmlDict[url][key]["WebStruct"]
htmlDict[url][key].pop("WebStruct")
for k, v in htmlDict[url][key].items():
f = v
if isinstance(v, list):
f = '[/br]'.join(v)
elif isinstance(v, set):
f = '[/br]'.join([i for i in f])
f = self.escape(f).replace('[/br]', '</br>')
infoList.append(self.addmutibug(str(k), str(f)))
info_page = ''.join(infoList)
else:
info_page = ""
Total[key] = info_page.replace('[/br]', '</br>')
tr = "<tr><td>%d</td><td>%s</td><td>%s</td><td>%s</td><td>%s</td><td> %s</td><td>%s</td><td>%s</td></tr>" % (
index, url, title, server, Total["info"], Total["note"],
Total["warning"], Total["hole"])
full.append(tr)
except Exception as err:
raise ToolkitMissingPrivileges("Building result faild!")
Ajatar_html = Ajatar_html.replace("{{content}}", ' '.join(full))
filename = os.path.join(
paths.Ajatar_Output_PATH,
"BatchScanning" + "_" + str(int(time.time())) + ".html")
result = open(filename, "w")
result.write(Ajatar_html)
result.close()
logger.info("success saved :" + filename)
def build(self):
# build base info
reportTime = time.strftime('%Y-%m-%d %H:%M:%S',
time.localtime(time.time()))
# build scan info
htmlDict = dict()
Total = {"hole": '0', "note": '0', "warning": '0', "info": '0'}
# build
DomainRoot = get_domain_root(''.join(urlconfig.url))
Ajatar_html = "PCFET0NUWVBFIGh0bWw+CjwhLS1baWYgSUUgOF0+PGh0bWwgY2xhc3M9ImllIGllOCI+IDwhW2VuZGlmXS0tPgo8IS0tW2lmIElFIDldPjxodG1sIGNsYXNzPSJpZSBpZTkiPiA8IVtlbmRpZl0tLT4KPCEtLVtpZiBndCBJRSA5XT48IS0tPgo8aHRtbD4gPCEtLTwhW2VuZGlmXS0tPgo8aGVhZD4KICAgIDxtZXRhIGNoYXJzZXQ9InV0Zi04Ij4KICAgIDxtZXRhIGh0dHAtZXF1aXY9IlgtVUEtQ29tcGF0aWJsZSIgY29udGVudD0iSUU9ZWRnZSI+CiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEiPgogICAgPG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IkNvYnJhIGlzIGEgY29kZSBzdGF0aWMgc2NhbiBzeXN0ZW0iPgogICAgPG1ldGEgbmFtZT0iYXV0aG9yIiBjb250ZW50PSJGZWVpIDxmZWVpQGZlZWkuY24+Ij4KICAgIDx0aXRsZT5BamF0YXIgc2VjdXJpdHkgcmVwb3J0PC90aXRsZT4KCiAgICA8IS0tIEZhdmljb24tLT4KICAgIDxsaW5rIHJlbD0ic2hvcnRjdXQgaWNvbiIgaHJlZj0iLi9hc3NldC9pY28vZmF2aWNvbi5pY28iIHR5cGU9ImltYWdlL3gtaWNvbiI+CiAgICAKICAgIDxsaW5rIGhyZWY9Imh0dHBzOi8vY2RuLmJvb3Rjc3MuY29tL2ZvbnQtYXdlc29tZS80LjcuMC9jc3MvZm9udC1hd2Vzb21lLm1pbi5jc3MiIHJlbD0ic3R5bGVzaGVldCI+CiAgICA8IS0tIENTUyAtLT4KICAgIDxsaW5rIGhyZWY9Imh0dHBzOi8vYnVncy5oYWNraW5nOC5jb20vY2RuL2Fzc2V0L2Nzcy9iYXNlLmNzcyIgcmVsPSJzdHlsZXNoZWV0Ij4KICAgIDxsaW5rIGhyZWY9Imh0dHBzOi8vYnVncy5oYWNraW5nOC5jb20vY2RuL2Fzc2V0L2Nzcy9yZXBvcnQuY3NzIiByZWw9InN0eWxlc2hlZXQiPgoKICAgIDwhLS1baWYgbHQgSUUgOV0+CiAgICAgIDxzY3JpcHQgc3JjPSJqcy9odG1sNXNoaXYubWluLmpzIj48L3NjcmlwdD4KICAgICAgPHNjcmlwdCBzcmM9ImpzL3Jlc3BvbmQubWluLmpzIj48L3NjcmlwdD4KICAgIDwhW2VuZGlmXS0tPgoKPC9oZWFkPgo8Ym9keT4KPGRpdiBjbGFzcz0iY29udGFpbmVyLWZsdWlkIj4KICAgIDxkaXYgY2xhc3M9InJvdyI+CiAgICAgICAgPGRpdiBjbGFzcz0iY29sLXhzLTEyIj4KICAgICAgICAgICAgPGRpdiBjbGFzcz0iaW52b2ljZS10aXRsZSI+CiAgICAgICAgICAgICAgICA8aDI+QWphdGFyPC9oMj4KICAgICAgICAgICAgICAgIDxoMyBjbGFzcz0icHVsbC1yaWdodCI+PC9oMz4KICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgIDxocj4KICAgICAgICAgICAgPHVsIGNsYXNzPSJuYXYgbmF2LXRhYnMiIGlkPSJteVRhYnMiPgogICAgICAgICAgICAgICAgPGxpIGNsYXNzPSJhY3RpdmUiPjxhIGRhdGEtaWQ9ImluZiIgZGF0YS10b2dnbGU9InRhYiI+SW5mb3JtYXRpb248L2E+PC9saT4KICAgICAgICAgICAgPC91bD4KICAgICAgICAgICAgPGRpdiBjbGFzcz0idGFiLWNvbnRlbnQiPgogICAgICAgICAgICAgICAgPGRpdiBjbGFzcz0idGFiLXBhbmUgYWN0aXZlIiBpZD0iaW5mIj4KICAgICAgICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJyb3ciPgogICAgICAgICAgICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJjb2wtbWQtNCBjb2x1bW4iPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGg0PldlbGNvbWUgdG8gQWphdGFyITwvaDQ+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJyb3ciPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxkaXYgY2xhc3M9ImNvbC14cy0xMiI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxhZGRyZXNzPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGg1PlByb2plY3QgaW5mb3JtYXRpb248L2g1PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRhYmxlIGNsYXNzPSJ0YWJsZSB0YWJsZS1zdHJpcGVkIHRhYmxlLWJvcmRlcmVkIHRhYmxlLWNvbmRlbnNlZCI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRoZWFkPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRoPkl0ZW08L3RoPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGg+VmFsdWU8L3RoPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdHI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90aGVhZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGJvZHk+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGQ+RG9tYWluPC90ZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRkPnt7dXJsfX08L3RkPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdHI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGQ+U2VsZWN0IHBsdWdpbjwvdGQ+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0ZD57e3NlbGVjdF9wbHVnaW59fTwvdGQ+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dHI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0ZD5zY2FuIGFsbCBwb3J0PC90ZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRkPnt7c2Nhbl9hbGxfcG9ydH19PC90ZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRkPlRocmVhZE51bTwvdGQ+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0ZD57e1RocmVhZE51bX19PC90ZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdGJvZHk+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RhYmxlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2FkZHJlc3M+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdiBjbGFzcz0iY29sLXhzLTEyIj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGFkZHJlc3M+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8aDU+U2NhbiBpbmZvcm1hdGlvbjwvaDU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGFibGUgY2xhc3M9InRhYmxlIHRhYmxlLXN0cmlwZWQgdGFibGUtYm9yZGVyZWQgdGFibGUtY29uZGVuc2VkIj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGhlYWQ+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGg+SXRlbTwvdGg+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0aD5WYWx1ZTwvdGg+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RoZWFkPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0Ym9keT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dHI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0ZD5SZXBvcnQgdGltZTwvdGQ+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0ZD57e3JlcG9ydFRpbWV9fTwvdGQ+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dHI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0ZD5TY2FuIHRpbWU8L3RkPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGQ+e3tzY2FudGltZX19PC90ZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdGJvZHk+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RhYmxlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2FkZHJlc3M+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGRpdiBjbGFzcz0iY29sLXhzLTEyIj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGFkZHJlc3M+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8aDU+TnVtYmVyIG9mIHZ1bG5lcmFiaWxpdGllczwvaDU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGFibGUgY2xhc3M9InRhYmxlIHRhYmxlLXN0cmlwZWQgdGFibGUtYm9yZGVyZWQgdGFibGUtY29uZGVuc2VkIj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGhlYWQ+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGg+TGV2ZWw8L3RoPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGg+VG90YWw8L3RoPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdHI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90aGVhZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGJvZHkgY2xhc3M9Im4tby12Ij4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dHI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0ZD5Ib2xlPC90ZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRkPnt7dG90YWxfSG9sZX19PC90ZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRkPk5vdGU8L3RkPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGQ+e3t0b3RhbF9Ob3RlfX08L3RkPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdHI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGQ+V2FybmluZzwvdGQ+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0ZD57e3RvdGFsX1dhcm5pbmd9fTwvdGQ+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dHI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0ZD5JbmZvPC90ZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRkPnt7dG90YWxfSW5mb319PC90ZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdGJvZHk+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RhYmxlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2FkZHJlc3M+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDxkaXYgY2xhc3M9ImNvbC1tZC04IGNvbHVtbiI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8aDQ+VnVsbmVyYWJpbGl0eSBzdGF0aXN0aWNzPC9oND4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJicy1leGFtcGxlIiBkYXRhLWV4YW1wbGUtaWQ9Im1lZGlhLWxpc3QiPgogICAgPHVsIGNsYXNzPSJtZWRpYS1saXN0Ij4KICAgICAgPGxpIGNsYXNzPSJtZWRpYSI+CiAgICAgICAgPGRpdiBjbGFzcz0ibWVkaWEtbGVmdCI+CiAgICAgICAgICA8YSBocmVmPSIjIj4KICAgICAgICAgICAgPGkgY2xhc3M9ImZhIGZhLWNpcmNsZSBtLWwtNSB0ZXh0LXB1cnBsZSI+PC9pPgogICAgICAgICAgPC9hPgogICAgICAgIDwvZGl2PgogICAgICAgIDxkaXYgY2xhc3M9Im1lZGlhLWJvZHkiPgogICAgICAgICAgPGg0IGNsYXNzPSJtZWRpYS1oZWFkaW5nIj5SZXBvcnQgTGV2ZWw8L2g0PgogICAgICAgICAgPHA+dzlzY2Fu5omr5o+P5oql5ZGK562J57qn5oyJ54Wn5Lil6YeN5oCn5YiG5Li65Zub57qnIGluZm8gbm90ZSB3YXJuaW5nIGhvbGUuPC9wPgogICAgICAgICAgPCEtLSBOZXN0ZWQgbWVkaWEgb2JqZWN0IC0tPgogICAgICAgICAgPGRpdiBjbGFzcz0ibWVkaWEiPgogICAgICAgICAgICA8ZGl2IGNsYXNzPSJtZWRpYS1sZWZ0Ij4KICAgICAgICAgICAgICA8YSBocmVmPSIjIj4KICAgICAgICAgICAgICA8aSBjbGFzcz0iZmEgZmEtY2lyY2xlIG0tbC01IHRleHQtaW5mbyI+PC9pPgogICAgICAgICAgICAgIDwvYT4KICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgIDxkaXYgY2xhc3M9Im1lZGlhLWJvZHkiPgogICAgICAgICAgICAgIDxoNCBjbGFzcz0ibWVkaWEtaGVhZGluZyI+SW5mbyBsZXZlbDwvaDQ+CiAgICAgICAgICAgICAgSW5mbyBsZXZlbCDmkJzpm4bnvZHnq5nnmoTkuIDkupvln7rmnKwuCiAgICAgICAgICAgICAgPCEtLSBOZXN0ZWQgbWVkaWEgb2JqZWN0IC0tPgogICAgICAgICAgICAgIHt7aW5mb19jb250ZW50fX0KICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICA8L2Rpdj4KICAgICAgICAgIDwhLS0gTmVzdGVkIG1lZGlhIG9iamVjdCAtLT4KICAgICAgICAgIDxkaXYgY2xhc3M9Im1lZGlhIj4KICAgICAgICAgICAgPGRpdiBjbGFzcz0ibWVkaWEtbGVmdCI+CiAgICAgICAgICAgICAgPGEgaHJlZj0iIyI+CiAgICAgICAgICAgICAgICA8aSBjbGFzcz0iZmEgZmEtY2lyY2xlIG0tbC01IHRleHQtc3VjY2VzcyI+PC9pPgogICAgICAgICAgICAgIDwvYT4KICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgIDxkaXYgY2xhc3M9Im1lZGlhLWJvZHkiPgogICAgICAgICAgICAgIDxoNCBjbGFzcz0ibWVkaWEtaGVhZGluZyI+Tm90ZSBsZXZlbDwvaDQ+CiAgICAgICAgICAgICAgTm90ZSBsZXZlbCDmj5DphpLnvZHnq5nnmoTkuIDkupvkv6Hmga/lj6/og73ooqvms4TpnLIuCiAgICAgICAgICAgICAge3tub3RlX2NvbnRlbnR9fQogICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgIDwvZGl2PgogICAgICAgICAgPCEtLSBOZXN0ZWQgbWVkaWEgb2JqZWN0IC0tPgogICAgICAgICAgPGRpdiBjbGFzcz0ibWVkaWEiPgogICAgICAgICAgICA8ZGl2IGNsYXNzPSJtZWRpYS1sZWZ0Ij4KICAgICAgICAgICAgICA8YSBocmVmPSIjIj4KICAgICAgICAgICAgICAgIDxpIGNsYXNzPSJmYSBmYS1jaXJjbGUgbS1sLTUgdGV4dC13YXJuaW5nIj48L2k+CiAgICAgICAgICAgICAgPC9hPgogICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgPGRpdiBjbGFzcz0ibWVkaWEtYm9keSI+CiAgICAgICAgICAgICAgPGg0IGNsYXNzPSJtZWRpYS1oZWFkaW5nIj5XYXJuaW5nIGxldmVsPC9oND4KICAgICAgICAgICAgICBXYXJuaW5nIGxldmVsIOitpuWRiue9keermeafkOS6m+WcsOaWueWPr+iDveiiq+WIqeeUqC4KICAgICAgICAgICAgICB7e3dhcm5pbmdfY29udGVudH19CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgPC9kaXY+CiAgICAgICAgICA8IS0tIE5lc3RlZCBtZWRpYSBvYmplY3QgLS0+CiAgICAgICAgICA8ZGl2IGNsYXNzPSJtZWRpYSI+CiAgICAgICAgICAgIDxkaXYgY2xhc3M9Im1lZGlhLWxlZnQiPgogICAgICAgICAgICAgIDxhIGhyZWY9IiMiPgogICAgICAgICAgICAgICAgPGkgY2xhc3M9ImZhIGZhLWNpcmNsZSBtLWwtNSB0ZXh0LWhvbGUiPjwvaT4KICAgICAgICAgICAgICA8L2E+CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICA8ZGl2IGNsYXNzPSJtZWRpYS1ib2R5Ij4KICAgICAgICAgICAgICA8aDQgY2xhc3M9Im1lZGlhLWhlYWRpbmciPkhvbGUgbGV2ZWw8L2g0PgogICAgICAgICAgICAgIEhvbGUgbGV2ZWwg6auY5Y2x562J57qnIOitpuWRiue9keermeafkOS6m+WcsOaWueWPr+iDveWtmOWcqOS4pemHjeeahOWuieWFqOmXrumimC4KICAgICAgICAgICAgICB7e2hvbGVfY29udGVudH19CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgPC9kaXY+CiAgICAgICAgPC9kaXY+CiAgICAgIDwvbGk+CiAgICA8L3VsPgogICAgCiAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAgIDwvZGl2PjwhLS0gRW5kIHJvdyAtLT4KICAgICAgICAgICAgICAgIDwvZGl2PjwhLS0gRW5kIHJhYiAtLT4KICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgPC9kaXY+CiAgICA8L2Rpdj4KICAgIDxocj4KICAgIDwhLS0gQ29udGFpbmVycyAtLT4KICAgIDxkaXYgY2xhc3M9InJvdyI+CiAgICAgICAgPGRpdiBjbGFzcz0iY29sLW1kLTYiPgogICAgICAgICAgICA8ZGl2PgogICAgICAgICAgICAgICAgPHAgc3R5bGU9ImZsb2F0OmxlZnQ7Ij4KICAgICAgICAgICAgICAgICAgICBDb3B5cmlnaHQgJmNvcHk7IDIwMTggPGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL0FqYXRhcnMvQWphdGFyIiB0YXJnZXQ9Il9ibGFuayI+QWphdGFyPC9hPi4gQWxsIHJpZ2h0cyByZXNlcnZlZAogICAgICAgICAgICAgICAgPC9wPgogICAgICAgICAgICA8L2Rpdj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8ZGl2IGNsYXNzPSJjb2wtbWQtNiI+CiAgICAgICAgICAgIDxkaXY+CiAgICAgICAgICAgICAgICA8cCBzdHlsZT0iZmxvYXQ6cmlnaHQ7Ij4KICAgICAgICAgICAgICAgICAgICA8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vQWphdGFycy9BamF0YXIiIHRhcmdldD0iX2JsYW5rIj5HaXRodWI8L2E+IC0KICAgICAgICAgICAgICAgICAgICA8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vQWphdGFycy9BamF0YXIiIHRhcmdldD0iX2JsYW5rIj5BamF0YXI8L2E+CiAgICAgICAgICAgICAgICA8L3A+CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgIDwvZGl2PgogICAgPC9kaXY+CjwvZGl2Pgo8L2JvZHk+CjwvaHRtbD4="
try:
Ajatar_html = base64.b64decode(Ajatar_html)
Ajatar_html = Ajatar_html.replace("{{url}}", str(urlconfig.url))
Ajatar_html = Ajatar_html.replace("{{scan_all_port}}",
str(urlconfig.scanport))
Ajatar_html = Ajatar_html.replace("{{ThreadNum}}",
str(urlconfig.threadNum))
Ajatar_html = Ajatar_html.replace(
"{{select_plugin}}", str(' '.join(urlconfig.diyPlugin)))
Ajatar_html = Ajatar_html.replace("{{reportTime}}",
str(reportTime))
Ajatar_html = Ajatar_html.replace(
"{{scantime}}", runningTime(urlconfig.runningTime))
except Exception:
raise ToolkitMissingPrivileges("BuildHtml Error Exception")
try:
for url, content in self.dict.items():
htmlDict[url] = dict()
for key, value in content.items():
try:
htmlDict[url][key] = value.getData()
if len(htmlDict[url][key]):
infoList = list()
for k, v in htmlDict[url][key].items():
f = v
if isinstance(v, list):
f = '[/br]'.join(v)
elif isinstance(v, set):
f = '[/br]'.join([i for i in f])
f = self.escape(f).replace('[/br]', '</br>')
infoList.append(
self.addbug(key, str(k), str(f)))
info_page = ''.join(infoList)
substr = "{{%s_content}}" % key
Ajatar_html = Ajatar_html.replace(
substr, info_page)
else:
substr = "{{%s_content}}" % key
Ajatar_html = Ajatar_html.replace(substr, '')
Total[key] = str(len(value.getData()))
except Exception:
raise ToolkitMissingPrivileges("Save Report Exception")
Ajatar_html = Ajatar_html.replace("{{total_Hole}}", Total["hole"])
Ajatar_html = Ajatar_html.replace("{{total_Note}}", Total["note"])
Ajatar_html = Ajatar_html.replace("{{total_Warning}}",
Total["warning"])
Ajatar_html = Ajatar_html.replace("{{total_Info}}", Total["info"])
filename = DomainRoot + "_" + str(int(time.time())) + ".html"
filename = filename.replace(":", "_")
filename = os.path.join(paths.Ajatar_Output_PATH, filename)
result = open(filename, "w")
result.write(Ajatar_html)
result.close()
logger.info("success saved :" + filename)
except Exception as err:
raise ToolkitMissingPrivileges("Sava Faild! error:" + err)