agent-bypass 2.15.1 → 2.17.0

package/scripts/netdns.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""共享 DNS 工具：fake-IP 判定 + DoH 真 IP 解析 + 系统解析兜底（纯标准库）。
+
+为什么需要：iSH / iOS 或桌面开了 TUN（Clash / mihomo / sing-box 等）时，
+DNS 常被劫持成 fake-IP（默认 198.18.0.0/15）。此时：
+  · 端口扫描（nmap/masscan/本脚本 connect 扫）拿到的是不可路由假地址 → 全部超时/误判；
+  · 源站溯源 / 爆破 / 证书探测同样拿不到真 IP。
+解法：用 DoH（DNS over HTTPS，走 443，不经过被劫持的 UDP:53）拿真实 A/AAAA。
+
+用法（供 portscan / fastrecon / origin_trace 复用）：
+    import netdns
+    ips, source = netdns.resolve_real('example.com')      # auto: 系统 → DoH
+    ips, source = netdns.resolve_real('example.com', prefer='doh')
+    netdns.is_fake_ip('198.18.0.5')  # True
+
+CLI 自检：
+    python3 netdns.py example.com [--doh] [--json]
+"""
+import ipaddress
+import json
+import socket
+import sys
+import threading
+import time
+import urllib.parse
+import urllib.request
+
+# fake-IP 常见伪造段（Clash/mihomo/sing-box 默认 198.18.0.0/15；其它代理软件另有实现）
+FAKE_NETS = tuple(ipaddress.ip_network(n) for n in (
+    "198.18.0.0/15",      # RFC 2544 基准测试段：Clash / mihomo / sing-box 默认 fake-ip
+    "198.51.100.0/24",    # TEST-NET-2：部分代理软件伪造段
+    "203.0.113.0/24",     # TEST-NET-3
+    "240.0.0.0/4",        # 保留段：部分 fake-ip 实现
+))
+
+# DoH JSON 端点（走 HTTPS/443，TUN 劫持不到 UDP:53）
+DOH_PROVIDERS = (
+    "https://1.1.1.1/dns-query",    # Cloudflare（需 accept: application/dns-json）
+    "https://dns.google/resolve",   # Google
+    "https://223.5.5.5/resolve",    # AliDNS
+)
+UA = "agent-bypass-netdns/1.0"
+DEFAULT_TIMEOUT = 6.0
+
+
+def is_ipv4(s):
+    try:
+        ipaddress.IPv4Address(str(s).strip())
+        return True
+    except (ValueError, TypeError):
+        return False
+
+
+def is_fake_ip(ip):
+    """fake-IP / 不可路由伪造段判定。"""
+    if not is_ipv4(ip):
+        return False
+    a = ipaddress.IPv4Address(str(ip).strip())
+    return any(a in n for n in FAKE_NETS)
+
+
+def _system_resolve_impl(name):
+    """实际解析；可能被 TUN 劫持成 fake-IP。"""
+    infos = socket.getaddrinfo(name, None, socket.AF_INET, socket.SOCK_STREAM)
+    out = []
+    for info in infos:
+        ip = info[4][0]
+        if is_ipv4(ip) and ip not in out:
+            out.append(ip)
+    return out
+
+
+def system_resolve(name, timeout=5.0):
+    """系统解析 + 硬超时：getaddrinfo 在部分环境（iSH/TUN）会长时间卡住，
+    用守护线程 + join(timeout) 兜底，确保调用方最多等 timeout 秒。"""
+    box = {"ips": []}
+
+    def work():
+        try:
+            box["ips"] = _system_resolve_impl(name)
+        except Exception:
+            box["ips"] = []
+
+    th = threading.Thread(target=work, daemon=True)
+    th.start()
+    th.join(timeout)
+    return list(box["ips"])
+
+
+def _parse_dns_json(text, qtype):
+    try:
+        data = json.loads(text)
+    except (ValueError, TypeError):
+        return []
+    want = 1 if qtype == "A" else 28
+    ips = []
+    for ans in (data.get("Answer") or []):
+        if ans.get("type") != want:
+            continue
+        d = str(ans.get("data") or "").strip()
+        if qtype == "A" and is_ipv4(d) and d not in ips:
+            ips.append(d)
+        elif qtype == "AAAA" and ":" in d and d not in ips:
+            ips.append(d)
+    return ips
+
+
+def doh_query(name, qtype="A", timeout=DEFAULT_TIMEOUT, providers=None, fake_ok=False,
+              deadline=None):
+    """DoH 查询：按顺序尝试多个端点；默认过滤 fake-IP 结果。
+    deadline（time.monotonic 秒）用于总时限，避免多端点叠加导致长时间卡住。"""
+    deadline = deadline if deadline is not None else time.monotonic() + max(timeout, 1.0) * 3
+    for base in (providers or DOH_PROVIDERS):
+        remain = deadline - time.monotonic()
+        if remain <= 0.2:
+            break
+        sep = "&" if "?" in base else "?"
+        url = "%s%sname=%s&type=%s" % (
+            base, sep, urllib.parse.quote(str(name), safe=""), qtype)
+        try:
+            req = urllib.request.Request(url, headers={
+                "accept": "application/dns-json",
+                "user-agent": UA,
+            })
+            with urllib.request.urlopen(req, timeout=min(timeout, remain)) as r:
+                ips = _parse_dns_json(r.read(1 << 20).decode("utf-8", "ignore"), qtype)
+        except Exception:
+            continue
+        if not fake_ok:
+            ips = [x for x in ips if not is_fake_ip(x)]
+        if ips:
+            return ips
+    return []
+
+
+def resolve_real(name, prefer="auto", timeout=DEFAULT_TIMEOUT):
+    """解析真实 IP。prefer: auto（系统→DoH）/ system / doh。
+    返回 (ips, source)：source ∈ ip / system / doh / system-fake / fail。
+    """
+    name = str(name or "").strip().rstrip(".")
+    if is_ipv4(name):
+        return [name], "ip"
+    if prefer == "system":
+        ips = system_resolve(name, timeout)
+        return ips, ("system" if ips else "fail")
+    t0 = time.monotonic()
+    sys_ips = system_resolve(name, min(timeout, 5.0)) if prefer == "auto" else []
+    real = [x for x in sys_ips if not is_fake_ip(x)]
+    if real:
+        return real, "system"
+    budget = max(2.0, timeout - (time.monotonic() - t0))
+    doh_ips = doh_query(name, "A", timeout=min(4.0, budget),
+                        deadline=time.monotonic() + budget + 1.0)
+    if doh_ips:
+        return doh_ips, "doh"
+    if sys_ips:
+        return sys_ips, "system-fake"
+    return [], "fail"
+
+
+def fmt_ips(ips):
+    return ",".join(ips) if ips else "-"
+
+
+def _main(argv):
+    args = [a for a in argv[1:] if not a.startswith("-")]
+    flags = [a for a in argv[1:] if a.startswith("-")]
+    if not args:
+        print("用法: python3 netdns.py <domain>... [--doh] [--json]", file=sys.stderr)
+        return 2
+    prefer = "doh" if "--doh" in flags else "auto"
+    rc = 0
+    out = {}
+    for name in args:
+        ips, source = resolve_real(name, prefer=prefer)
+        out[name] = {"ips": ips, "source": source}
+        if not ips:
+            rc = 1
+            print("%s\t-\t[解析失败：TUN/fake-IP？换 DoH 或检查出网]" % name, file=sys.stderr)
+        elif source == "system-fake":
+            rc = 1
+            print("%s\t%s\t[fake-IP：不可信，换 DoH]" % (name, fmt_ips(ips)), file=sys.stderr)
+        else:
+            print("%s\t%s\t[%s]" % (name, fmt_ips(ips), source))
+    if "--json" in flags:
+        print(json.dumps(out, ensure_ascii=False))
+    return rc
+
+
+if __name__ == "__main__":
+    sys.exit(_main(sys.argv))

package/scripts/origin_trace.py

@@ -0,0 +1,369 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""origin_trace — 源站溯源（绕 CDN/WAF）：DoH 真 IP + 证书透明度 + 漏质子域 + 直连指纹比对
+
+为什么需要：开了 TUN / fake-IP（iSH 常见 198.18.0.0/15）时，系统 DNS 拿不到真实 IP，
+历史解析、子域、CT 查询都会被污染；本工具统一走 DoH 拿真 IP，再逐个直连比对指纹。
+
+只读：仅做 DNS / HTTPS GET / CT 查询，不修改目标任何状态。授权范围内使用。
+
+用法:
+  python3 origin_trace.py example.com
+  python3 origin_trace.py example.com --json
+  python3 origin_trace.py example.com --max-candidates 60 --timeout 8
+  python3 origin_trace.py example.com --no-ct --max-candidates 8 --budget 60   # iSH/fake-IP：跳过 CT、限时防卡
+  DOH_PROVIDERS="https://1.1.1.1/dns-query" python3 origin_trace.py example.com
+
+输出: 候选源站表（ip / 分数 / 来源 / 标题 / Server / CDN 头），--json 输出机器可读结构。
+退出码: 0 正常（有候选）/ 1 无候选或全部失败 / 2 用法错误。
+"""
+import concurrent.futures
+import hashlib
+import json
+import re
+import socket
+import ssl
+import sys
+import time
+import urllib.parse
+import urllib.request
+
+try:
+    import netdns
+except Exception:                      # 单文件拷贝场景
+    netdns = None
+
+UA = "Mozilla/5.0 (compatible; origin-trace/1.0; +agent-bypass)"
+SUBS = [
+    "direct", "origin", "origin-www", "mail", "mx", "smtp", "pop", "imap",
+    "webmail", "autodiscover", "autoconfig", "cpanel", "whm", "ftp",
+    "dev", "test", "staging", "stage", "pre", "prod", "beta", "old",
+    "legacy", "backup", "admin", "api", "gateway", "vpn", "oa", "portal",
+    "m", "wap", "static", "img", "cdn", "assets", "uploads",
+]
+CDN_HEADERS = (
+    "cf-ray", "cf-cache-status", "x-cache", "via", "x-amz-cf-id", "x-amz-cf-pop",
+    "x-fastly-request-id", "x-akamai-transformed", "x-cdn", "x-served-by",
+    "x-cache-hits", "x-timer", "server-timing",
+)
+
+
+def _err(msg):
+    print(msg, file=sys.stderr)
+
+
+def is_ipv4(s):
+    if netdns is not None:
+        return netdns.is_ipv4(s)
+    return bool(re.match(r"^\d{1,3}(?:\.\d{1,3}){3}$", str(s)))
+
+
+def doh_resolve(name, timeout=6.0):
+    """DoH 真 IP；无 netdns 时退回系统解析。返回 [(ip, 'doh'|'system')]"""
+    if netdns is not None:
+        ips = netdns.doh_query(name, "A", timeout)
+        if ips:
+            return [(ip, "doh") for ip in ips]
+        ips = netdns.system_resolve(name, timeout)
+        return [(ip, "system") for ip in ips if not netdns.is_fake_ip(ip)]
+    try:
+        return [(socket.gethostbyname(name), "system")]
+    except OSError:
+        return []
+
+
+def fetch_ct_names(domain, timeout=8.0):
+    """证书透明度（crt.sh）里的 DNS 名；返回去重主机名列表。
+    crt.sh 偶发 502/超时：重试一次，仍失败则跳过（不阻塞主流程）。"""
+    url = "https://crt.sh/?q=" + urllib.parse.quote("%." + domain, safe="") + "&output=json"
+    last = None
+    for attempt in (1, 2):
+        try:
+            req = urllib.request.Request(url, headers={"user-agent": UA})
+            with urllib.request.urlopen(req, timeout=timeout) as r:
+                text = r.read(8 << 20).decode("utf-8", "ignore")
+            return parse_crtsh(text, domain)
+        except Exception as e:
+            last = e
+            if attempt == 1:
+                time.sleep(1.0)
+    _err("[crt.sh] 查询失败（已重试）: %s —— 跳过 CT，继续漏质子域" % last)
+    return []
+
+
+def parse_crtsh(text, domain):
+    """解析 crt.sh JSON → 该域名下的主机名（去通配符、去重、保序）。"""
+    try:
+        rows = json.loads(text)
+    except (ValueError, TypeError):
+        return []
+    if not isinstance(rows, list):
+        return []
+    out, seen = [], set()
+    for row in rows:
+        if not isinstance(row, dict):
+            continue
+        for raw in str(row.get("name_value") or "").split("\n"):
+            name = raw.strip().lower().lstrip("*.").rstrip(".")
+            if not name or name in seen:
+                continue
+            if name == domain or name.endswith("." + domain):
+                seen.add(name)
+                out.append(name)
+    return out
+
+
+def cdn_markers(headers):
+    return [h for h in CDN_HEADERS if h in headers]
+
+
+def extract_title(body):
+    m = re.search(r"<title[^>]*>(.*?)</title>", body, re.I | re.S)
+    if not m:
+        return ""
+    t = re.sub(r"\s+", " ", m.group(1)).strip()
+    return t[:120]
+
+
+def parse_response(data):
+    """原始 HTTP 响应 → dict(status/title/server/headers/cdn/location)。"""
+    head, _, body = data.partition(b"\r\n\r\n")
+    lines = head.decode("iso-8859-1", "ignore").split("\r\n")
+    status = lines[0].strip() if lines else ""
+    headers = {}
+    for line in lines[1:]:
+        if ":" in line:
+            k, v = line.split(":", 1)
+            headers[k.strip().lower()] = v.strip()
+    return {
+        "status": status,
+        "title": extract_title(body.decode("utf-8", "ignore")),
+        "server": headers.get("server", ""),
+        "location": headers.get("location", ""),
+        "headers": headers,
+        "cdn": cdn_markers(headers),
+        "body_sha1": hashlib.sha1(body).hexdigest()[:12] if body else "",
+    }
+
+
+def http_probe(ip, domain, timeout=8.0, method="GET"):
+    """直连 IP + 正确 SNI/Host 的 HTTPS 探测（不校验证书，仅采集指纹）。"""
+    ctx = ssl.create_default_context()
+    ctx.check_hostname = False
+    ctx.verify_mode = ssl.CERT_NONE
+    raw = socket.create_connection((ip, 443), timeout=timeout)
+    try:
+        sock = ctx.wrap_socket(raw, server_hostname=domain)   # SSLContext.wrap_socket 不接受 timeout 参数
+        sock.settimeout(timeout)
+        try:
+            cert = sock.getpeercert() or {}
+            sans = [v for k, v in cert.get("subjectAltName", ()) if k == "DNS"]
+            req = ("%s / HTTP/1.1\r\nHost: %s\r\nUser-Agent: %s\r\n"
+                   "Accept: */*\r\nConnection: close\r\n\r\n") % (method, domain, UA)
+            sock.sendall(req.encode("utf-8", "ignore"))
+            data = b""
+            end = time.monotonic() + max(timeout, 2.0)     # 读取总预算，防慢连接挂住
+            while len(data) < 131072 and time.monotonic() < end:
+                try:
+                    chunk = sock.recv(16384)
+                except (socket.timeout, OSError):
+                    break
+                if not chunk:
+                    break
+                data += chunk
+        finally:
+            sock.close()
+    finally:
+        try:
+            raw.close()
+        except Exception:
+            pass
+    info = parse_response(data)
+    info["cert_sans"] = sans
+    info["cert_domain_ok"] = any(
+        domain == x or domain.endswith("." + x.lstrip("*.")) for x in sans
+    )
+    return info
+
+
+def score_candidate(base, cand):
+    """候选 vs 基线指纹打分：同标题/同 Server/无 CDN 头/证书匹配加分。"""
+    score, reasons = 0, []
+    if base.get("title") and cand.get("title") and cand["title"] == base["title"]:
+        score += 3
+        reasons.append("title")
+    if base.get("status") and cand.get("status") == base.get("status"):
+        score += 1
+    if base.get("server") and cand.get("server") == base.get("server"):
+        score += 1
+        reasons.append("server")
+    if base.get("cdn") and not cand.get("cdn"):
+        score += 2
+        reasons.append("no-cdn-headers")
+    if cand.get("cert_domain_ok"):
+        score += 1
+        reasons.append("cert-san")
+    if cand.get("cdn"):
+        if base.get("cdn") and set(cand["cdn"]) & set(base["cdn"]):
+            score -= 2                       # 与基线同一 CDN = 还是 CDN 边缘，不是源站
+            reasons.append("same-cdn")
+        else:
+            score -= 1
+            reasons.append("cdn")
+    return score, reasons
+
+
+def collect_candidates(domain, max_candidates=40, timeout=8.0, use_ct=True):
+    """收集候选 (name, ip, sources)。"""
+    names = ["www." + domain, domain] + ["%s.%s" % (s, domain) for s in SUBS]
+    if use_ct:
+        ct = fetch_ct_names(domain, timeout)
+        if ct:
+            _err("[CT] crt.sh 返回 %d 个主机名" % len(ct))
+            names.extend(ct)
+    uniq, seen = [], set()
+    for n in names:
+        n = n.strip().lower().rstrip(".")
+        if n and n not in seen and (n == domain or n.endswith("." + domain)):
+            seen.add(n)
+            uniq.append(n)
+    uniq = uniq[:max_candidates]
+    _err("[候选] 解析 %d 个主机（DoH）" % len(uniq))
+
+    def one(name):
+        return name, doh_resolve(name, timeout)
+
+    by_ip = {}
+    with concurrent.futures.ThreadPoolExecutor(max_workers=8) as ex:
+        for name, pairs in ex.map(one, uniq):
+            for ip, src in pairs:
+                srcs = by_ip.setdefault(ip, {"ips": set(), "sources": set()})
+                srcs["sources"].add(name)
+    return by_ip
+
+
+def main(argv=None):
+    args = list(sys.argv[1:] if argv is None else argv)
+    domains, as_json, no_verify, no_ct = [], False, False, False
+    max_c, timeout, budget = 40, 8.0, 120.0
+    i = 0
+    while i < len(args):
+        a = args[i]
+        if a == "--json":
+            as_json = True
+        elif a == "--no-verify":
+            no_verify = True
+        elif a == "--no-ct":
+            no_ct = True
+        elif a in ("--max-candidates", "--timeout", "--budget"):
+            if i + 1 >= len(args):
+                _err("%s 缺少取值" % a)
+                return 2
+            try:
+                if a == "--max-candidates":
+                    max_c = max(1, int(args[i + 1]))
+                elif a == "--budget":
+                    budget = max(10.0, float(args[i + 1]))
+                else:
+                    timeout = max(1.0, min(float(args[i + 1]), 30.0))
+            except (TypeError, ValueError):
+                _err("%s 取值非法: %s" % (a, args[i + 1]))
+                return 2
+            i += 1
+        elif a.startswith("-"):
+            _err("未知参数: %s" % a)
+            return 2
+        else:
+            domains.append(a)
+        i += 1
+    if not domains:
+        _err(__doc__)
+        return 2
+
+    rc = 0
+    report = {}
+    for domain in domains:
+        _err("\n[*] %s" % domain)
+        root_ips = doh_resolve(domain, timeout)
+        real_root = [ip for ip, _s in root_ips]
+        if not real_root:
+            _err("[!] %s DoH 解析失败（检查出网/DoH 端点）" % domain)
+            rc = 1
+            continue
+        _err("[根] %s → %s" % (domain, ",".join(real_root)))
+
+        base = None
+        if not no_verify:
+            try:
+                base = http_probe(real_root[0], domain, timeout)
+                _err("[基线] %s | server=%s | cdn=%s | title=%r" % (
+                    base["status"], base["server"], ",".join(base["cdn"]) or "-", base["title"][:40]))
+            except Exception as e:
+                _err("[基线] 探测失败: %s（继续）" % e)
+
+        by_ip = collect_candidates(domain, max_c, timeout, use_ct=not no_ct)
+        for ip in real_root:                       # 根 IP 纳入候选
+            by_ip.setdefault(ip, {"sources": set()})["sources"].add(domain)
+
+        rows = []
+        end = time.monotonic() + budget
+        pending = [(ip, meta) for ip, meta in by_ip.items()]
+
+        def verify(item):
+            ip, meta = item
+            row = {"ip": ip, "sources": sorted(meta["sources"]),
+                   "score": 0, "reasons": [], "cdn": [], "title": "", "server": "",
+                   "status": "", "cert_sans": []}
+            if not no_verify and time.monotonic() < end:
+                try:
+                    cand = http_probe(ip, domain, timeout)
+                    row.update({k: cand.get(k) for k in
+                                ("status", "title", "server", "cdn", "cert_sans")})
+                    row["score"], row["reasons"] = score_candidate(base or {}, cand)
+                except Exception as e:
+                    row["error"] = str(e)[:80]
+            return row
+
+        if no_verify or not pending:
+            rows = [verify(it) for it in pending]
+        else:
+            with concurrent.futures.ThreadPoolExecutor(max_workers=6) as ex:
+                futs = {ex.submit(verify, it): it for it in pending}
+                try:
+                    for f in concurrent.futures.as_completed(futs, timeout=max(5.0, budget)):
+                        try:
+                            rows.append(f.result())
+                        except Exception:
+                            pass
+                except concurrent.futures.TimeoutError:
+                    _err("[预算] 验证超过 %.0fs，先返回已完成的候选" % budget)
+                finally:
+                    ex.shutdown(wait=False, cancel_futures=True)
+        rows.sort(key=lambda r: (-r["score"], r["ip"]))
+        report[domain] = rows
+
+        if as_json:
+            continue
+        print("\n%s 候选源站（分数高=更像源站）" % domain)
+        print("%-16s %5s  %-28s %-10s %s" % ("ip", "score", "sources", "server", "title"))
+        for r in rows[:max_c]:
+            print("%-16s %5d  %-28s %-10s %s%s" % (
+                r["ip"], r["score"], ",".join(r["sources"])[:27] or "-",
+                (r["server"] or "-")[:10], (r["title"] or "")[:40],
+                ("  [cdn:%s]" % ",".join(r["cdn"])) if r["cdn"] else ""))
+        strong = [r for r in rows if r["score"] >= 4 and not r["cdn"]]
+        if strong:
+            print("[结论] 高置信候选（无 CDN 头）: %s" % ", ".join(r["ip"] for r in strong[:5]))
+        elif rows:
+            print("[结论] 无高置信候选：可能源站未暴露/全站 CDN/TUN 干扰（用 --json 看细节）")
+            rc = rc or 1
+        else:
+            rc = 1
+
+    if as_json:
+        print(json.dumps(report, ensure_ascii=False, indent=2))
+    return rc
+
+
+if __name__ == "__main__":
+    sys.exit(main())