create-dwy 0.5.0 → 0.6.0

package/templates/claude-global/skills/dwy-pentest/scripts/pentest_scan.py

@@ -0,0 +1,205 @@
+"""阶段 2：端口扫描 + 服务枚举（python-nmap，TCP/UDP 并发）。
+
+用法:
+    uv run pentest_scan.py --target <host> --output-dir <dir> [--sudo]
+"""
+
+import argparse
+import sys
+import time
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+
+import nmap
+from rich.console import Console
+from rich.table import Table
+
+from lib.executor import AuditLog, run_command, save_json_result
+from lib.validator import validate_target
+
+console = Console()
+
+
+def scan_tcp_ports(host: str, sudo: bool = False, audit: AuditLog | None = None) -> dict:
+    """TCP 端口扫描 + 服务版本探测（阶段 1/2/3 必须串行,因 2 依赖 1 的端口列表）。"""
+    results = {
+        "scan_type": "tcp",
+        "ports": [],
+        "os_detection": [],
+        "scan_args": "",
+    }
+
+    nm = nmap.PortScanner()
+
+    console.print("[bold]TCP 阶段 1: 快速端口扫描 (top 1000)...[/bold]")
+    scan_args = "-sT -T3 --top-ports 1000 --open"
+    if sudo:
+        scan_args = "-sS -T3 --top-ports 1000 --open"
+
+    try:
+        nm.scan(hosts=host, arguments=scan_args)
+    except nmap.PortScannerError as e:
+        console.print(f"[red]nmap 扫描失败: {e}[/red]")
+        console.print("[yellow]提示: SYN 扫描需要 sudo 权限，尝试不加 --sudo 运行[/yellow]")
+        return results
+
+    results["scan_args"] = scan_args
+    open_ports = []
+
+    if host in nm.all_hosts():
+        for proto in nm[host].all_protocols():
+            for port in sorted(nm[host][proto].keys()):
+                state = nm[host][proto][port]["state"]
+                if state == "open":
+                    open_ports.append(port)
+
+    if not open_ports:
+        console.print("[yellow]未发现开放端口[/yellow]")
+        return results
+
+    console.print(f"  发现 {len(open_ports)} 个开放端口: {', '.join(map(str, open_ports[:20]))}")
+
+    # 阶段 2/3 并发：版本探测和 OS 检测可以同时跑(都基于阶段 1 结果,互不依赖)
+    console.print("[bold]TCP 阶段 2+3 并发: 版本探测 + OS 指纹识别...[/bold]")
+    port_str = ",".join(map(str, open_ports))
+
+    def _version_scan() -> nmap.PortScanner | None:
+        scanner = nmap.PortScanner()
+        try:
+            scanner.scan(hosts=host, arguments=f"-sV -sC -p {port_str}")
+            return scanner
+        except nmap.PortScannerError as e:
+            console.print(f"[yellow]版本探测失败: {e}[/yellow]")
+            return None
+
+    def _os_scan() -> nmap.PortScanner | None:
+        if not sudo:
+            return None
+        scanner = nmap.PortScanner()
+        try:
+            scanner.scan(hosts=host, arguments="-O")
+            return scanner
+        except Exception:
+            console.print("[yellow]  OS 检测需要 sudo 权限[/yellow]")
+            return None
+
+    with ThreadPoolExecutor(max_workers=2) as pool:
+        ver_future = pool.submit(_version_scan)
+        os_future = pool.submit(_os_scan)
+
+        ver_scanner = ver_future.result()
+        os_scanner = os_future.result()
+
+    if ver_scanner and host in ver_scanner.all_hosts():
+        for proto in ver_scanner[host].all_protocols():
+            for port in sorted(ver_scanner[host][proto].keys()):
+                info = ver_scanner[host][proto][port]
+                port_data = {
+                    "port": port,
+                    "protocol": proto,
+                    "state": info.get("state", ""),
+                    "service": info.get("name", ""),
+                    "version": info.get("version", ""),
+                    "product": info.get("product", ""),
+                    "extrainfo": info.get("extrainfo", ""),
+                    "scripts": dict(info["script"]) if "script" in info else {},
+                }
+                results["ports"].append(port_data)
+
+    if os_scanner and host in os_scanner.all_hosts() and "osmatch" in os_scanner[host]:
+        for os_match in os_scanner[host]["osmatch"][:3]:
+            results["os_detection"].append({
+                "name": os_match.get("name", ""),
+                "accuracy": os_match.get("accuracy", ""),
+            })
+            console.print(f"  OS: {os_match['name']} ({os_match['accuracy']}%)")
+
+    table = Table(title=f"端口扫描结果 — {host}")
+    table.add_column("端口", style="cyan")
+    table.add_column("协议")
+    table.add_column("服务", style="green")
+    table.add_column("版本")
+    table.add_column("附加信息")
+
+    for p in results["ports"]:
+        version_str = f"{p['product']} {p['version']}".strip()
+        table.add_row(str(p["port"]), p["protocol"], p["service"], version_str, p["extrainfo"])
+
+    console.print(table)
+    return results
+
+
+def scan_udp_top(host: str, audit: AuditLog | None = None) -> dict:
+    """UDP 关键端口扫描（top 20）。"""
+    results = {"scan_type": "udp", "ports": []}
+
+    console.print("[bold]UDP 关键端口扫描 (top 20)...[/bold]")
+    cmd = ["nmap", "-sU", "--top-ports", "20", "--open", "-T3", host]
+    exec_result = run_command(cmd, timeout=120, audit=audit)
+
+    if exec_result.returncode == 0:
+        for line in exec_result.stdout.split("\n"):
+            parts = line.strip().split()
+            if parts and "/" in parts[0] and "open" in line:
+                port_proto = parts[0].split("/")
+                results["ports"].append({
+                    "port": int(port_proto[0]),
+                    "protocol": port_proto[1] if len(port_proto) > 1 else "udp",
+                    "state": parts[1] if len(parts) > 1 else "open",
+                    "service": parts[2] if len(parts) > 2 else "",
+                })
+    else:
+        console.print(f"[yellow]UDP 扫描失败（可能需要 sudo）: {exec_result.stderr[:200]}[/yellow]")
+
+    return results
+
+
+def main():
+    parser = argparse.ArgumentParser(description="渗透测试 - 端口扫描（TCP/UDP 并发）")
+    parser.add_argument("--target", required=True, help="目标 IP/域名")
+    parser.add_argument("--output-dir", required=True, help="输出目录")
+    parser.add_argument("--sudo", action="store_true", help="使用 sudo 进行 SYN/OS 扫描")
+    args = parser.parse_args()
+
+    target, warning = validate_target(args.target)
+    if target is None:
+        console.print(f"[red]{warning}[/red]")
+        sys.exit(1)
+    if warning:
+        console.print(f"[yellow]{warning}[/yellow]")
+
+    output_dir = Path(args.output_dir)
+    output_dir.mkdir(parents=True, exist_ok=True)
+    audit = AuditLog(output_dir / "audit.log")
+
+    # TCP 与 UDP 全程并发（两者完全独立）
+    console.print("[bold cyan]TCP / UDP 扫描并发启动[/bold cyan]")
+    with ThreadPoolExecutor(max_workers=2) as pool:
+        tcp_future = pool.submit(scan_tcp_ports, target.host, args.sudo, audit)
+        udp_future = pool.submit(scan_udp_top, target.host, audit)
+        tcp_result = tcp_future.result()
+        udp_result = udp_future.result()
+
+    result = {
+        "target": target.host,
+        "timestamp": time.strftime("%Y-%m-%d %H:%M:%S"),
+        "tcp": tcp_result,
+        "udp": udp_result,
+    }
+
+    output_file = output_dir / "scan_ports.json"
+    save_json_result(result, output_file)
+    console.print(f"\n[green]结果已保存: {output_file}[/green]")
+
+    open_ports = [p["port"] for p in result["tcp"]["ports"] if p.get("state") == "open"]
+    http_ports = [p["port"] for p in result["tcp"]["ports"] if p.get("service") in ("http", "https", "http-proxy", "http-alt")]
+    ssl_ports = [p["port"] for p in result["tcp"]["ports"] if p.get("service") in ("https", "ssl", "imaps", "smtps", "pop3s")]
+
+    console.print(f"\n[bold]摘要:[/bold]")
+    console.print(f"  开放端口: {open_ports}")
+    console.print(f"  HTTP 端口: {http_ports}")
+    console.print(f"  SSL/TLS 端口: {ssl_ports}")
+
+
+if __name__ == "__main__":
+    main()

package/templates/claude-global/skills/dwy-pentest/scripts/pentest_ssl.py

@@ -0,0 +1,208 @@
+"""阶段 5：SSL/TLS 审计 — testssl.sh 封装 + Python ssl 基础检测（并发执行）。
+
+用法:
+    uv run pentest_ssl.py --target <host> --output-dir <dir> [--port 443]
+"""
+
+import argparse
+import json
+import socket
+import ssl
+import sys
+import time
+from concurrent.futures import ThreadPoolExecutor
+from datetime import datetime, timezone
+from pathlib import Path
+
+from rich.console import Console
+from rich.table import Table
+
+from lib.executor import AuditLog, run_command, save_json_result
+from lib.severity import Severity
+
+console = Console()
+
+
+def check_certificate(host: str, port: int = 443) -> dict:
+    """Python ssl 模块基础证书检查。"""
+    result = {
+        "valid": False,
+        "issuer": "",
+        "subject": "",
+        "not_before": "",
+        "not_after": "",
+        "days_remaining": 0,
+        "self_signed": False,
+        "expired": False,
+        "errors": [],
+    }
+
+    try:
+        ctx = ssl.create_default_context()
+        with socket.create_connection((host, port), timeout=10) as sock:
+            with ctx.wrap_socket(sock, server_hostname=host) as ssock:
+                cert = ssock.getpeercert()
+                result["valid"] = True
+                result["issuer"] = str(dict(x[0] for x in cert.get("issuer", [])))
+                result["subject"] = str(dict(x[0] for x in cert.get("subject", [])))
+                result["not_before"] = cert.get("notBefore", "")
+                result["not_after"] = cert.get("notAfter", "")
+
+                not_after_str = cert.get("notAfter", "")
+                if not_after_str:
+                    expire_date = datetime.strptime(not_after_str, "%b %d %H:%M:%S %Y %Z")
+                    expire_date = expire_date.replace(tzinfo=timezone.utc)
+                    days_remaining = (expire_date - datetime.now(timezone.utc)).days
+                    result["days_remaining"] = days_remaining
+                    if days_remaining < 0:
+                        result["expired"] = True
+                    elif days_remaining < 30:
+                        result["errors"].append(f"证书将在 {days_remaining} 天后过期")
+
+                issuer_cn = dict(x[0] for x in cert.get("issuer", [])).get("commonName", "")
+                subject_cn = dict(x[0] for x in cert.get("subject", [])).get("commonName", "")
+                if issuer_cn == subject_cn:
+                    result["self_signed"] = True
+
+    except ssl.SSLCertVerificationError as e:
+        result["errors"].append(f"证书验证失败: {e}")
+    except ssl.SSLError as e:
+        result["errors"].append(f"SSL 错误: {e}")
+    except (socket.timeout, ConnectionRefusedError, OSError) as e:
+        result["errors"].append(f"连接失败: {e}")
+
+    return result
+
+
+def scan_testssl(host: str, port: int, audit: AuditLog, output_dir: Path) -> list[dict]:
+    """testssl.sh 完整 SSL/TLS 审计。"""
+    findings = []
+
+    json_output = output_dir / "testssl_raw.json"
+    cmd = [
+        "testssl",
+        "--json", str(json_output),
+        "--quiet",
+        "--color", "0",
+        f"{host}:{port}",
+    ]
+
+    result = run_command(cmd, timeout=300, audit=audit)
+
+    if result.returncode == -3:
+        console.print("[yellow]testssl.sh 未安装，使用 Python ssl 基础检测[/yellow]")
+        return findings
+
+    if result.returncode != 0 and not json_output.exists():
+        console.print(f"[yellow]testssl.sh 异常: {result.stderr[:200]}[/yellow]")
+        return findings
+
+    if json_output.exists():
+        with open(json_output) as f:
+            try:
+                data = json.load(f)
+                for entry in data:
+                    severity_str = entry.get("severity", "INFO")
+                    finding_id = entry.get("id", "")
+                    finding_text = entry.get("finding", "")
+
+                    if severity_str.upper() in ("CRITICAL", "HIGH", "MEDIUM", "WARN"):
+                        severity_map = {
+                            "CRITICAL": Severity.CRITICAL,
+                            "HIGH": Severity.HIGH,
+                            "MEDIUM": Severity.MEDIUM,
+                            "WARN": Severity.LOW,
+                        }
+                        cvss_map = {
+                            "CRITICAL": 9.0,
+                            "HIGH": 7.0,
+                            "MEDIUM": 5.0,
+                            "WARN": 3.0,
+                        }
+                        findings.append({
+                            "id": finding_id,
+                            "finding": finding_text,
+                            "severity": severity_map.get(severity_str.upper(), Severity.INFO).value,
+                            "cvss": cvss_map.get(severity_str.upper(), 0.0),
+                        })
+            except json.JSONDecodeError:
+                console.print("[yellow]testssl.sh JSON 解析失败[/yellow]")
+
+    return findings
+
+
+def main():
+    parser = argparse.ArgumentParser(description="渗透测试 - SSL/TLS 审计（证书检查与 testssl.sh 并发）")
+    parser.add_argument("--target", required=True, help="目标域名/IP")
+    parser.add_argument("--output-dir", required=True, help="输出目录")
+    parser.add_argument("--port", type=int, default=443, help="SSL 端口（默认 443）")
+    args = parser.parse_args()
+
+    target, warning = validate_target(args.target)
+    if target is None:
+        console.print(f"[red]{warning}[/red]")
+        sys.exit(1)
+    if warning:
+        console.print(f"[yellow]{warning}[/yellow]")
+
+    output_dir = Path(args.output_dir)
+    output_dir.mkdir(parents=True, exist_ok=True)
+    audit = AuditLog(output_dir / "audit.log")
+
+    # 证书检查 + testssl.sh 并发
+    console.print(f"[bold]证书检查 + testssl.sh 并发: {target.host}:{args.port}[/bold]")
+    with ThreadPoolExecutor(max_workers=2) as pool:
+        cert_future = pool.submit(check_certificate, target.host, args.port)
+        testssl_future = pool.submit(scan_testssl, target.host, args.port, audit, output_dir)
+        cert_info = cert_future.result()
+        testssl_findings = testssl_future.result()
+
+    # 证书结果分析
+    cert_findings = []
+    if cert_info["expired"]:
+        console.print("  [red]证书已过期！[/red]")
+        cert_findings.append({"type": "expired_cert", "severity": "High", "cvss": 7.5, "detail": "SSL 证书已过期"})
+    elif cert_info["days_remaining"] < 30 and cert_info["valid"]:
+        console.print(f"  [yellow]证书将在 {cert_info['days_remaining']} 天后过期[/yellow]")
+        cert_findings.append({"type": "expiring_cert", "severity": "Medium", "cvss": 4.0, "detail": f"证书将在 {cert_info['days_remaining']} 天后过期"})
+    if cert_info["self_signed"]:
+        console.print("  [yellow]自签名证书[/yellow]")
+        cert_findings.append({"type": "self_signed", "severity": "Medium", "cvss": 5.0, "detail": "使用自签名证书"})
+    if cert_info["errors"]:
+        for err in cert_info["errors"]:
+            console.print(f"  [yellow]{err}[/yellow]")
+    if cert_info["valid"] and not cert_info["expired"] and not cert_info["self_signed"]:
+        console.print(f"  [green]证书有效，剩余 {cert_info['days_remaining']} 天[/green]")
+
+    all_findings = cert_findings + testssl_findings
+    result = {
+        "target": target.host,
+        "port": args.port,
+        "timestamp": time.strftime("%Y-%m-%d %H:%M:%S"),
+        "certificate": cert_info,
+        "findings": all_findings,
+        "total": len(all_findings),
+    }
+
+    output_file = output_dir / "ssl_audit.json"
+    save_json_result(result, output_file)
+    console.print(f"\n[green]结果已保存: {output_file}[/green]")
+
+    if all_findings:
+        table = Table(title="SSL/TLS 审计发现")
+        table.add_column("类型")
+        table.add_column("严重性")
+        table.add_column("详情")
+        for f in all_findings[:20]:
+            table.add_row(
+                f.get("type", f.get("id", "")),
+                f.get("severity", ""),
+                f.get("detail", f.get("finding", ""))[:80],
+            )
+        console.print(table)
+    else:
+        console.print("[green]未发现 SSL/TLS 安全问题[/green]")
+
+
+if __name__ == "__main__":
+    main()

package/templates/claude-global/skills/dwy-pentest/scripts/pentest_vuln.py

@@ -0,0 +1,205 @@
+"""阶段 3：漏洞扫描 — Nuclei 模板扫描 + Nmap NSE 漏洞脚本。
+
+用法:
+    uv run pentest_vuln.py --target <host> --mode nuclei|nse --output-dir <dir> [--ports 80,443,8080]
+"""
+
+import argparse
+import json
+import sys
+import time
+from pathlib import Path
+
+from rich.console import Console
+from rich.table import Table
+
+from lib.config import NUCLEI_SEVERITY, NUCLEI_TAGS, SCAN_RATE_LIMIT
+from lib.executor import AuditLog, run_command, save_json_result
+from lib.severity import Finding, Severity, cvss_to_severity, nuclei_severity_to_cvss, nmap_vuln_to_finding
+from lib.validator import validate_target
+
+console = Console()
+
+
+def scan_nuclei(target: str, audit: AuditLog, output_dir: Path) -> list[dict]:
+    """Nuclei 模板驱动漏洞扫描。"""
+    findings = []
+    console.print("[bold]Nuclei 漏洞扫描...[/bold]")
+
+    url = target if target.startswith(("http://", "https://")) else f"http://{target}"
+    nuclei_output = output_dir / "nuclei_raw.json"
+
+    cmd = [
+        "nuclei",
+        "-u", url,
+        "-severity", NUCLEI_SEVERITY,
+        "-rate-limit", str(SCAN_RATE_LIMIT),
+        "-jsonl",
+        "-o", str(nuclei_output),
+        "-silent",
+    ]
+
+    result = run_command(cmd, timeout=600, audit=audit)
+
+    if result.blocked:
+        console.print(f"[red]Nuclei 被安全策略拦截: {result.block_reason}[/red]")
+        return findings
+
+    if result.returncode != 0 and not nuclei_output.exists():
+        console.print(f"[yellow]Nuclei 扫描异常: {result.stderr[:300]}[/yellow]")
+        # nuclei 未安装时降级为仅 nmap
+        if "command not found" in result.stderr or result.returncode == -3:
+            console.print("[yellow]nuclei 未安装，跳过此阶段[/yellow]")
+        return findings
+
+    # 解析 nuclei JSON 输出（每行一个 JSON）
+    if nuclei_output.exists():
+        with open(nuclei_output) as f:
+            for line in f:
+                line = line.strip()
+                if not line:
+                    continue
+                try:
+                    entry = json.loads(line)
+                    severity_str = entry.get("info", {}).get("severity", "info")
+                    cvss = nuclei_severity_to_cvss(severity_str)
+                    finding = Finding(
+                        title=entry.get("info", {}).get("name", "Unknown"),
+                        severity=cvss_to_severity(cvss),
+                        cvss=cvss,
+                        cve_id=", ".join(entry.get("info", {}).get("classification", {}).get("cve-id", [])),
+                        description=entry.get("info", {}).get("description", ""),
+                        evidence=entry.get("matched-at", ""),
+                        affected_service=entry.get("host", target),
+                        discovery_tool="nuclei",
+                        remediation=entry.get("info", {}).get("remediation", ""),
+                        references=entry.get("info", {}).get("reference", []),
+                    )
+                    findings.append(finding.to_dict())
+                    severity_color = {
+                        Severity.CRITICAL: "red bold",
+                        Severity.HIGH: "red",
+                        Severity.MEDIUM: "yellow",
+                        Severity.LOW: "blue",
+                    }.get(finding.severity, "white")
+                    console.print(f"  [{severity_color}][{finding.severity.value}][/{severity_color}] {finding.title} — {finding.cve_id or 'N/A'}")
+                except json.JSONDecodeError:
+                    continue
+
+    console.print(f"  Nuclei 发现 {len(findings)} 个漏洞")
+    return findings
+
+
+def scan_nse(host: str, ports: str, audit: AuditLog) -> list[dict]:
+    """Nmap NSE 漏洞脚本扫描。"""
+    findings = []
+    console.print("[bold]Nmap NSE 漏洞脚本扫描...[/bold]")
+
+    if not ports:
+        console.print("[yellow]无开放端口，跳过 NSE 扫描[/yellow]")
+        return findings
+
+    cmd = [
+        "nmap",
+        "--script", "vuln",
+        "-p", ports,
+        host,
+    ]
+
+    result = run_command(cmd, timeout=300, audit=audit)
+
+    if result.returncode != 0:
+        console.print(f"[yellow]NSE 扫描异常: {result.stderr[:200]}[/yellow]")
+        return findings
+
+    # 解析 nmap 漏洞脚本输出
+    current_script = ""
+    current_output = []
+    in_script = False
+
+    for line in result.stdout.split("\n"):
+        stripped = line.strip()
+        if stripped.startswith("|_"):
+            # 脚本输出结束行
+            if current_script and in_script:
+                output_text = "\n".join(current_output)
+                if "VULNERABLE" in output_text.upper() or "vulnerable" in output_text.lower():
+                    finding = nmap_vuln_to_finding(current_script, output_text)
+                    findings.append(finding.to_dict())
+                    console.print(f"  [red][{finding.severity.value}][/red] {finding.title}")
+            current_output.append(stripped[2:].strip())
+            in_script = False
+        elif stripped.startswith("| "):
+            if in_script:
+                current_output.append(stripped[2:].strip())
+        elif ":" in stripped and stripped.startswith("|"):
+            # 新脚本开始
+            if current_script and in_script and current_output:
+                output_text = "\n".join(current_output)
+                if "VULNERABLE" in output_text.upper():
+                    finding = nmap_vuln_to_finding(current_script, output_text)
+                    findings.append(finding.to_dict())
+            script_name = stripped.lstrip("| ").split(":")[0].strip()
+            current_script = script_name
+            current_output = []
+            in_script = True
+
+    console.print(f"  NSE 发现 {len(findings)} 个漏洞")
+    return findings
+
+
+def main():
+    parser = argparse.ArgumentParser(description="渗透测试 - 漏洞扫描")
+    parser.add_argument("--target", required=True, help="目标 IP/域名/URL")
+    parser.add_argument("--mode", required=True, choices=["nuclei", "nse"], help="扫描模式")
+    parser.add_argument("--output-dir", required=True, help="输出目录")
+    parser.add_argument("--ports", default="", help="逗号分隔的端口列表（NSE 模式必需）")
+    args = parser.parse_args()
+
+    target, warning = validate_target(args.target)
+    if target is None:
+        console.print(f"[red]{warning}[/red]")
+        sys.exit(1)
+    if warning:
+        console.print(f"[yellow]{warning}[/yellow]")
+
+    output_dir = Path(args.output_dir)
+    output_dir.mkdir(parents=True, exist_ok=True)
+    audit = AuditLog(output_dir / "audit.log")
+
+    findings = []
+    if args.mode == "nuclei":
+        findings = scan_nuclei(target.raw, audit, output_dir)
+    elif args.mode == "nse":
+        findings = scan_nse(target.host, args.ports, audit)
+
+    result = {
+        "target": target.host,
+        "mode": args.mode,
+        "timestamp": time.strftime("%Y-%m-%d %H:%M:%S"),
+        "findings": findings,
+        "total": len(findings),
+    }
+
+    output_file = output_dir / f"vuln_{args.mode}.json"
+    save_json_result(result, output_file)
+    console.print(f"\n[green]结果已保存: {output_file}[/green]")
+
+    # 摘要
+    severity_counts = {}
+    for f in findings:
+        s = f["severity"]
+        severity_counts[s] = severity_counts.get(s, 0) + 1
+
+    if severity_counts:
+        table = Table(title="漏洞分布")
+        table.add_column("严重性")
+        table.add_column("数量")
+        for s in ["Critical", "High", "Medium", "Low", "Info"]:
+            if s in severity_counts:
+                table.add_row(s, str(severity_counts[s]))
+        console.print(table)
+
+
+if __name__ == "__main__":
+    main()