Fscan源码解读

func main() {
    start := time.Now()
    var Info common.HostInfo
    common.Flag(&Info)
    common.Parse(&Info)
    Plugins.Scan(Info)
    t := time.Now().Sub(start)
    fmt.Printf("[*] 扫描结束,耗时: %s\n", t)
}

func Parse(Info *HostInfo) {
    ParseUser()
    ParsePass(Info)
    ParseInput(Info)
    ParseScantype(Info)
}

func ParseUser()

func ParsePass(Info *HostInfo)

func ParseInput(Info *HostInfo)

func ParseScantype(Info *HostInfo)

Hosts, err := common.ParseIP(info.Host, common.HostFile, common.NoHosts)
if err != nil {
    fmt.Println("len(hosts)==0", err)
    return
}

if common.NoPing == false && len(Hosts) > 0 {
    Hosts = CheckLive(Hosts, common.Ping)
    fmt.Println("[*] Icmp alive hosts len is:", len(Hosts))
}
if common.Scantype == "icmp" {
    common.LogWG.Wait()
    return
}
common.GC()

var AlivePorts []string
if common.Scantype == "webonly" || common.Scantype == "webpoc" {
    AlivePorts = NoPortScan(Hosts, info.Ports)
} else if common.Scantype == "hostname" {
    info.Ports = "139"
    AlivePorts = NoPortScan(Hosts, info.Ports)
} else if len(Hosts) > 0 {
    AlivePorts = PortScan(Hosts, info.Ports, common.Timeout)
    fmt.Println("[*] alive ports len is:", len(AlivePorts))
    if common.Scantype == "portscan" {
        common.LogWG.Wait()
        return
    }
}
if len(common.HostPort) > 0 {
    AlivePorts = append(AlivePorts, common.HostPort...)
    AlivePorts = common.RemoveDuplicate(AlivePorts)
    common.HostPort = nil
    fmt.Println("[*] AlivePorts len is:", len(AlivePorts))
}
common.GC()

func AddScan(scantype string, info common.HostInfo, ch *chan struct{}, wg *sync.WaitGroup) {
    *ch <- struct{}{}
    wg.Add(1)
    go func() {
        Mutex.Lock()
        common.Num += 1
        Mutex.Unlock()
        ScanFunc(&scantype, &info)
        Mutex.Lock()
        common.End += 1
        Mutex.Unlock()
        wg.Done()
        <-*ch
    }()
}

for _, targetIP := range AlivePorts {
    info.Host, info.Ports = strings.Split(targetIP, ":")[0], strings.Split(targetIP, ":")[1]
    ...
    //  info.Ports实际上是scantype
    AddScan(info.Ports, info, &ch, &wg)

func ScanFunc(name *string, info *common.HostInfo) {
    f := reflect.ValueOf(PluginList[*name])
    in := []reflect.Value{reflect.ValueOf(info)}
    f.Call(in)
}

func IsContain(items []string, item string) bool {
    for _, eachItem := range items {
        if eachItem == item {
            return true
        }
    }
    return false
}

chanHosts := make(chan string, len(hostslist))

go func() {
    for ip := range chanHosts {
        if _, ok := ExistHosts[ip]; !ok && IsContain(hostslist, ip) {
            ExistHosts[ip] = struct{}{}
            if common.Silent == false {
                if Ping == false {
                    fmt.Printf("(icmp) Target %-15s is alive\n", ip)
                } else {
                    fmt.Printf("(ping) Target %-15s is alive\n", ip)
                }
            }
            AliveHosts = append(AliveHosts, ip)
        }
        livewg.Done()
    }
}()

if Ping == true {
    RunPing(hostslist, chanHosts)
}

else {
    //优先尝试监听本地icmp,批量探测
    conn, err := icmp.ListenPacket("ip4:icmp", "0.0.0.0")
    if err == nil {
        RunIcmp1(hostslist, conn, chanHosts)
    } else {
        common.LogError(err)
        //尝试无监听icmp探测
        fmt.Println("trying RunIcmp2")
        conn, err := net.DialTimeout("ip4:icmp", "127.0.0.1", 3*time.Second)
        defer func() {
            if conn != nil {
                conn.Close()
            }
        }()
        if err == nil {
            RunIcmp2(hostslist, chanHosts)
        } else {
            common.LogError(err)
            //使用ping探测
            fmt.Println("The current user permissions unable to send icmp packets")
            fmt.Println("start ping")
            RunPing(hostslist, chanHosts)
        }
    }
}

//  监听本地网络地址laddr，网络类型net必须是面向数据包的网络类型
func ListenPacket(net, laddr string) (PacketConn, error)
//  在网络network上连接地址address，并返回一个Conn接口。
func Dial(network, address string) (Conn, error)
//  同Dial函数，增加了超时
func DialTimeout(network, address string, timeout time.Duration) (Conn, error)

livewg.Wait()
close(chanHosts)

if len(hostslist) > 1000 {
    arrTop, arrLen := ArrayCountValueTop(AliveHosts, common.LiveTop, true)
    for i := 0; i < len(arrTop); i++ {
        output := fmt.Sprintf("[*] LiveTop %-16s 段存活数量为: %d", arrTop[i]+".0.0/16", arrLen[i])
        common.LogSuccess(output)
    }
}
if len(hostslist) > 256 {
    arrTop, arrLen := ArrayCountValueTop(AliveHosts, common.LiveTop, false)
    for i := 0; i < len(arrTop); i++ {
        output := fmt.Sprintf("[*] LiveTop %-16s 段存活数量为: %d", arrTop[i]+".0/24", arrLen[i])
        common.LogSuccess(output)
    }
}

return AliveHosts