w-digital-scanner / W13scan
Licence: gpl-2.0
Passive Security Scanner (被动式安全扫描器)
Stars: ✭ 1,066
Labels
Projects that are alternatives of or similar to W13scan
Exein Openwrt Public
Openwrt 18.06.5 featured with the Exein's security framework
Stars: ✭ 36 (-96.62%)
Mutual labels: security-tools
Gitgot
Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.
Stars: ✭ 964 (-9.57%)
Mutual labels: security-tools
Machine Learning Approach For Malware Detection
A Machine Learning approach for classifying a file as Malicious or Legitimate
Stars: ✭ 35 (-96.72%)
Mutual labels: security-tools
Zeek Plugin Enip
Zeek network security monitor plugin that enables parsing of the Ethernet/IP and Common Industrial Protocol standards
Stars: ✭ 27 (-97.47%)
Mutual labels: security-tools
Shellshockhunter
It's a simple tool for test vulnerability shellshock
Stars: ✭ 52 (-95.12%)
Mutual labels: security-tools
Checkmyhttps
We propose a user-friendly add-on that allows you to check if your encrypted web traffic (SSL/TLS) towards secured Internet servers (HTTPS) is not intercepted (being listened to).
Stars: ✭ 35 (-96.72%)
Mutual labels: security-tools
Vulnx
vulnx 🕷️ is an intelligent bot auto shell injector that detect vulnerabilities in multiple types of cms { `wordpress , joomla , drupal , prestashop .. `}
Stars: ✭ 1,009 (-5.35%)
Mutual labels: security-tools
Doublepulsar Detection Script
A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.
Stars: ✭ 977 (-8.35%)
Mutual labels: security-tools
Ugfraud
An Unsupervised Graph-based Toolbox for Fraud Detection
Stars: ✭ 38 (-96.44%)
Mutual labels: security-tools
Attacker Group Predictor
Tool to predict attacker groups from the techniques and software used
Stars: ✭ 46 (-95.68%)
Mutual labels: security-tools
Eslint Plugin Security Node
ESLint security plugin for Node.js
Stars: ✭ 28 (-97.37%)
Mutual labels: security-tools
Pentest Chainsaw
Scrapes Router Passwords From http://www.routerpasswords.com ,more then +300 product
Stars: ✭ 36 (-96.62%)
Mutual labels: security-tools
Spellbook
Micro-framework for rapid development of reusable security tools
Stars: ✭ 53 (-95.03%)
Mutual labels: security-tools
Toxic
An ncurses-based Tox client (please make pull requests on the development fork: https://github.com/toktok/toxic)
Stars: ✭ 987 (-7.41%)
Mutual labels: security-tools
W13Scan
W13scan 是基于Python3的一款开源的Web漏洞发现工具,它支持主动扫描模式和被动扫描模式,能运行在Windows、Linux、Mac上。
声明
使用W13Scan前请遵守当地法律,W13Scan仅提供给教育行为使用。
特点
相比于其他专业的扫描工具,w13scan也有自己独有的优点。
免费/开源
安全从业人员可能不会信任任何程序,唯一能让人稍微信任的就是开源代码。
安全是建立在信任之上,信任需要开放和透明。w13scan核心代码完全开源,任何人可以检查其代码的安全性。
可以方便针对一些棘手且高度专业化的环境,可以按照w13scan开发文档补充其功能,自定义需要的模块。
丰富的检测插件
- [x] XSS扫描
- 基于语义的反射型XSS扫描,准确率极高
- XSS扫描会从网页中提取参数进行解析
- [x] jsonp信息泄漏
- 基于语义解析寻找敏感信息
- [x] sql注入
- 基于报错SQL注入检测
- 基于网页相似度布尔类型的SQL注入检测
- 基于时间SQL注入检测
- [x] http smuggling 走私攻击
- [x] Fastjson检测与利用
- [x] .Net通杀Xss检测
- portswigger 2019十大攻击技术第六名
- [x] iis解析漏洞
- [x] 敏感文件信息泄漏
- 支持含备份文件,debug文件,js敏感信息,php真实路径泄漏,仓库泄漏,phpinfo泄漏,目录遍历等
- [x] baseline检测(反序列化参数检测)
- [x] 命令/代码注入检测
- 支持asp,php等语言的检测
- 支持系统命令注入检测(支持无回显检测)
- 支持get,post,cookie等方式检测
- [x] 路径穿越漏洞
- [x] struts2漏洞检测
- 包括s2-016、s2-032、s2-045漏洞
- [x] webpack打包源文件泄漏
- [x] 未授权访问插件
扫描平台对比
w13scan测试了多个扫描平台,以下为扫描平台的测试报告
平台名称 | 扫描结果 | 扫描模式 |
---|---|---|
WVS PHP Vulnweb | 查看 | crawlergo+w13scan 自动扫描 |
WVS AJAX Vulnweb | 查看 | 被动扫描 |
demo.aisec.cn | 查看 | 被动扫描 |
使用
Useage
usage: w13scan [options]
optional arguments:
-h, --help show this help message and exit
-v, --version Show program's version number and exit
--debug Show programs's exception
--level {1,2,3,4,5} different level use different payload: 0-5 (default 2)
Proxy:
Passive Agent Mode Options
-s SERVER_ADDR, --server-addr SERVER_ADDR
server addr format:(ip:port)
Target:
options has to be provided to define the target(s)
-u URL, --url URL Target URL (e.g. "http://www.site.com/vuln.php?id=1")
-f URL_FILE, --file URL_FILE
Scan multiple targets given in a textual file
Request:
Network request options
--proxy PROXY Use a proxy to connect to the target URL
eg:[email protected]:8080 or [email protected]:1080
--timeout TIMEOUT Seconds to wait before timeout connection (default 30)
--retry RETRY Time out retrials times.
Output:
output
--html When selected, the output will be output to the output
directory by default, or you can specify
--json JSON The json file is generated by default in the output
directory, you can change the path
Optimization:
Optimization options
-t THREADS, --threads THREADS
Max number of concurrent network requests (default 31)
--disable DISABLE [DISABLE ...]
Disable some plugins (e.g. --disable xss sqli_error
webpack)
--able ABLE [ABLE ...]
Enable some moudle (e.g. --enable xss webpack)
安装
安装w13scan需要依赖Python3.6以上环境.
git clone https://github.com/w-digital-scanner/w13scan.git
cd w13scan # 进入git目录
pip3 install -r requirements.txt
cd W13SCAN # 进入源码目录
python3 w13scan.py -h
被动扫描
python3 w13scan.py -s 127.0.0.1:7778 --html # 端口可省略,默认为7778,开启--html即实时生成html报告
HTTPS支持
如果想让w13scan被动模式支持https,先启动w13scan,然后在浏览器中访问 http://w13scan.ca 下载证书并信任它。
主动扫描
-u 输入一个url进行扫描
--file 从文件中读取url扫描
w13scan会对url进行参数分析并使用插件扫描,但不会进行爬虫。
结合动态爬虫扫描
crawlergo + w13scan 自动扫描
在目录crawlergo_example
spider.py
展示了如何与crawlergo爬虫结合联动。
反连平台(非必须)
修改config.py
下有关反连平台的设置,可类似修改为
# REVERSE
USE_REVERSE = True # 使用反连平台将False改为True
REVERSE_HTTP_IP = "127.0.0.1" # 回连http IP地址,需要改为服务器ip,不能改为0.0.0.0,因为程序无法识别
REVERSE_HTTP_PORT = 9999 # 回连http端口
REVERSE_DNS = "dnslog.w13scan.hacking8.com" # 修改为自己的域名,并将域名dns修改为本机IP
REVERSE_RMI_IP = "127.0.0.1" # Java RMI 回连IP,需要改为服务器ip,不能改为0.0.0.0,因为程序无法识别
REVERSE_RMI_PORT = 10002 # Java RMI 回连端口
REVERSE_SLEEP = 5 # 反连后延时检测时间,单位是(秒)
之后先启动反连平台
python3 reverse.py
再启动w13scan即可
集成到自己扫描器
w13scan是开源的,我们也希望安全研究人员将w13scan集成到自己的扫描器中。
请点击 开发文档
贡献&感谢
有关的文章
- 微信公众号搜索"Hacking就是好玩",可订阅更新动态。
- 1024献礼,W13Scan 2.1.0发布,增加对代理的的支持
- w13scan 2.0的介绍
- w13scan 1.0畅想
Note that the project description data, including the texts, logos, images, and/or trademarks,
for each open source project belongs to its rightful owner.
If you wish to add or remove any projects, please contact us at [email protected].