create-dwy 0.5.1 → 0.6.0

package/templates/claude-global/skills/dwy-pentest/scripts/pentest_recon.py

@@ -0,0 +1,217 @@
+"""阶段 1：信息收集 — DNS 解析、WHOIS、技术栈指纹识别（并发实现）。
+
+用法:
+    uv run pentest_recon.py --target <host> --mode dns|tech --output-dir <dir>
+"""
+
+import argparse
+import asyncio
+import json
+import socket
+import sys
+import time
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from pathlib import Path
+
+import dns.resolver
+import httpx
+import whois
+from rich.console import Console
+
+from lib.executor import AuditLog, run_command, save_json_result
+from lib.validator import validate_target
+
+console = Console()
+
+DNS_RECORD_TYPES = ["A", "AAAA", "MX", "NS", "TXT", "CNAME", "SOA"]
+SENSITIVE_PATHS = ["/robots.txt", "/sitemap.xml", "/.env", "/.git/HEAD", "/wp-admin/"]
+INTERESTING_HEADERS = ["Server", "X-Powered-By", "X-Generator", "X-AspNet-Version"]
+
+
+def _query_dns_record(host: str, rtype: str) -> tuple[str, list[str]]:
+    """单个 DNS 记录类型查询，供线程池调用。"""
+    try:
+        answers = dns.resolver.resolve(host, rtype)
+        return rtype, [str(r) for r in answers]
+    except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer, dns.resolver.NoNameservers):
+        return rtype, []
+    except Exception:
+        return rtype, []
+
+
+def _resolve_addresses(host: str) -> list[str]:
+    try:
+        addrs = socket.getaddrinfo(host, None, socket.AF_UNSPEC, socket.SOCK_STREAM)
+        return list({addr[4][0] for addr in addrs})
+    except socket.gaierror:
+        return []
+
+
+def _whois_query(host: str) -> dict:
+    try:
+        w = whois.whois(host)
+        return {
+            "registrar": w.registrar,
+            "creation_date": str(w.creation_date),
+            "expiration_date": str(w.expiration_date),
+            "name_servers": w.name_servers if isinstance(w.name_servers, list) else [w.name_servers] if w.name_servers else [],
+            "org": w.org,
+            "country": w.country,
+        }
+    except Exception:
+        return {}
+
+
+def recon_dns(host: str) -> dict:
+    """DNS 解析 + 记录枚举 + WHOIS（DNS、WHOIS、地址解析三路并发）。"""
+    results = {
+        "dns_records": {},
+        "ip_addresses": [],
+        "whois": {},
+    }
+
+    console.print(f"[bold]DNS 解析 + WHOIS 并发查询: {host}[/bold]")
+
+    # 一次性派发：地址解析 + WHOIS + 7 个 DNS 记录类型，全部并发
+    with ThreadPoolExecutor(max_workers=10) as pool:
+        addr_future = pool.submit(_resolve_addresses, host)
+        whois_future = pool.submit(_whois_query, host)
+        record_futures = {
+            pool.submit(_query_dns_record, host, rtype): rtype for rtype in DNS_RECORD_TYPES
+        }
+
+        results["ip_addresses"] = addr_future.result()
+        if results["ip_addresses"]:
+            console.print(f"  IP 地址: {', '.join(results['ip_addresses'])}")
+
+        for fut in as_completed(record_futures):
+            rtype, records = fut.result()
+            if records:
+                results["dns_records"][rtype] = records
+                console.print(f"  {rtype}: {', '.join(records[:3])}")
+
+        results["whois"] = whois_future.result()
+        if results["whois"].get("registrar"):
+            console.print(f"  注册商: {results['whois']['registrar']}")
+
+    return results
+
+
+async def _async_probe_path(client: httpx.AsyncClient, base_url: str, path: str) -> dict | None:
+    try:
+        resp = await client.get(f"{base_url}{path}", timeout=5, follow_redirects=False)
+        if resp.status_code == 200:
+            return {"path": path, "status": resp.status_code, "size": len(resp.content)}
+    except Exception:
+        pass
+    return None
+
+
+async def _async_collect_http(url: str) -> tuple[dict, list[dict]]:
+    """并发收集 HTTP 头 + 敏感文件探测。"""
+    http_headers: dict = {}
+    interesting_files: list[dict] = []
+
+    async with httpx.AsyncClient(verify=False, timeout=10) as client:
+        head_task = client.get(url, follow_redirects=True)
+        path_tasks = [_async_probe_path(client, url, p) for p in SENSITIVE_PATHS]
+        results = await asyncio.gather(head_task, *path_tasks, return_exceptions=True)
+
+        head_resp = results[0]
+        if isinstance(head_resp, httpx.Response):
+            for header in INTERESTING_HEADERS:
+                value = head_resp.headers.get(header)
+                if value:
+                    http_headers[header] = value
+
+        for r in results[1:]:
+            if isinstance(r, dict):
+                interesting_files.append(r)
+
+    return http_headers, interesting_files
+
+
+def recon_tech(host: str, audit: AuditLog) -> dict:
+    """技术栈指纹识别（whatweb + HTTP 头分析 + 敏感文件并发探测）。"""
+    results = {
+        "http_headers": {},
+        "technologies": [],
+        "interesting_files": [],
+    }
+
+    console.print(f"[bold]技术栈指纹: {host}[/bold]")
+    url = f"http://{host}" if not host.startswith(("http://", "https://")) else host
+
+    # whatweb 与 HTTP 收集并发：whatweb 是子进程,HTTP 是 asyncio,放线程池里跑 asyncio
+    with ThreadPoolExecutor(max_workers=2) as pool:
+        whatweb_future = pool.submit(
+            run_command,
+            ["whatweb", "--color=never", "-a", "3", "--log-json=-", url],
+            audit=audit,
+        )
+        http_future = pool.submit(asyncio.run, _async_collect_http(url))
+
+        whatweb_result = whatweb_future.result()
+        if whatweb_result.returncode == 0 and whatweb_result.stdout.strip():
+            try:
+                whatweb_data = json.loads(whatweb_result.stdout.strip().split("\n")[0])
+                if isinstance(whatweb_data, list) and whatweb_data:
+                    plugins = whatweb_data[0].get("plugins", {})
+                    for name, info in plugins.items():
+                        if name not in ("IP", "Country", "UncommonHeaders"):
+                            version = info.get("version", [""])[0] if isinstance(info.get("version"), list) else ""
+                            tech = f"{name} {version}".strip()
+                            results["technologies"].append(tech)
+                    console.print(f"  发现技术: {', '.join(results['technologies'][:10])}")
+            except (json.JSONDecodeError, IndexError, KeyError):
+                pass
+
+        http_headers, interesting_files = http_future.result()
+        results["http_headers"] = http_headers
+        results["interesting_files"] = interesting_files
+
+        for header, value in http_headers.items():
+            console.print(f"  {header}: {value}")
+        for f in interesting_files:
+            console.print(f"  [yellow]发现敏感文件: {f['path']} ({f['status']})[/yellow]")
+
+    return results
+
+
+def main():
+    parser = argparse.ArgumentParser(description="渗透测试 - 信息收集（并发）")
+    parser.add_argument("--target", required=True, help="目标 IP/域名/URL")
+    parser.add_argument("--mode", required=True, choices=["dns", "tech"], help="扫描模式")
+    parser.add_argument("--output-dir", required=True, help="输出目录")
+    args = parser.parse_args()
+
+    target, warning = validate_target(args.target)
+    if target is None:
+        console.print(f"[red]{warning}[/red]")
+        sys.exit(1)
+    if warning:
+        console.print(f"[yellow]{warning}[/yellow]")
+
+    output_dir = Path(args.output_dir)
+    output_dir.mkdir(parents=True, exist_ok=True)
+    audit = AuditLog(output_dir / "audit.log")
+
+    result = {
+        "target": target.host,
+        "mode": args.mode,
+        "timestamp": time.strftime("%Y-%m-%d %H:%M:%S"),
+        "findings": {},
+    }
+
+    if args.mode == "dns":
+        result["findings"] = recon_dns(target.host)
+    elif args.mode == "tech":
+        result["findings"] = recon_tech(target.host, audit)
+
+    output_file = output_dir / f"recon_{args.mode}.json"
+    save_json_result(result, output_file)
+    console.print(f"\n[green]结果已保存: {output_file}[/green]")
+
+
+if __name__ == "__main__":
+    main()

package/templates/claude-global/skills/dwy-pentest/scripts/pentest_report.py

@@ -0,0 +1,343 @@
+"""报告生成器：汇总所有阶段 JSON 结果 → 渲染 Markdown 报告。
+
+用法:
+    uv run pentest_report.py --input-dir <dir> --output <report.md>
+"""
+
+import argparse
+import json
+import time
+from pathlib import Path
+
+from jinja2 import Template
+from rich.console import Console
+
+console = Console()
+
+
+def load_json_files(input_dir: Path) -> dict[str, dict]:
+    """加载输出目录下所有 JSON 结果。"""
+    results = {}
+    for json_file in sorted(input_dir.glob("*.json")):
+        if json_file.name == "audit.log":
+            continue
+        try:
+            with open(json_file) as f:
+                results[json_file.stem] = json.load(f)
+        except (json.JSONDecodeError, OSError) as e:
+            console.print(f"[yellow]跳过 {json_file.name}: {e}[/yellow]")
+    return results
+
+
+def collect_all_findings(results: dict[str, dict]) -> list[dict]:
+    """从所有结果中收集漏洞发现。"""
+    findings = []
+    for name, data in results.items():
+        if "findings" in data:
+            if isinstance(data["findings"], list):
+                for f in data["findings"]:
+                    if isinstance(f, dict):
+                        f.setdefault("source", name)
+                        findings.append(f)
+            elif isinstance(data["findings"], dict):
+                # recon 结果是 dict 结构，跳过
+                pass
+    return findings
+
+
+def sort_findings(findings: list[dict]) -> list[dict]:
+    """按 CVSS 评分降序排序。"""
+    severity_order = {"Critical": 0, "High": 1, "Medium": 2, "Low": 3, "Info": 4}
+    return sorted(
+        findings,
+        key=lambda f: (severity_order.get(f.get("severity", "Info"), 5), -f.get("cvss", 0)),
+    )
+
+
+def count_by_severity(findings: list[dict]) -> dict[str, int]:
+    """按严重性统计。"""
+    counts = {"Critical": 0, "High": 0, "Medium": 0, "Low": 0, "Info": 0}
+    for f in findings:
+        s = f.get("severity", "Info")
+        counts[s] = counts.get(s, 0) + 1
+    return counts
+
+
+def determine_risk_level(counts: dict[str, int]) -> str:
+    """根据漏洞分布确定整体风险等级。"""
+    if counts.get("Critical", 0) > 0:
+        return "Critical"
+    if counts.get("High", 0) > 0:
+        return "High"
+    if counts.get("Medium", 0) > 0:
+        return "Medium"
+    if counts.get("Low", 0) > 0:
+        return "Low"
+    return "Info"
+
+
+REPORT_TEMPLATE = """# 渗透测试报告
+
+## 基本信息
+
+| 项目 | 内容 |
+|------|------|
+| 目标 | {{ target }} |
+| 测试时间 | {{ timestamp }} |
+| 报告生成 | {{ report_time }} |
+
+## 执行摘要
+
+本次渗透测试发现 **{{ total_findings }}** 个安全问题：
+
+| 严重性 | 数量 |
+|--------|------|
+| Critical (9.0-10.0) | {{ counts.Critical }} |
+| High (7.0-8.9) | {{ counts.High }} |
+| Medium (4.0-6.9) | {{ counts.Medium }} |
+| Low (0.1-3.9) | {{ counts.Low }} |
+| Info | {{ counts.Info }} |
+
+**整体风险评级：{{ risk_level }}**
+
+---
+
+{% if recon_dns %}
+## 目标概况
+
+### DNS 信息
+{% if recon_dns.ip_addresses %}
+- IP 地址: {{ recon_dns.ip_addresses | join(', ') }}
+{% endif %}
+{% if recon_dns.dns_records %}
+{% for rtype, records in recon_dns.dns_records.items() %}
+- {{ rtype }}: {{ records | join(', ') }}
+{% endfor %}
+{% endif %}
+{% if recon_dns.whois.registrar %}
+- 注册商: {{ recon_dns.whois.registrar }}
+{% endif %}
+{% endif %}
+
+{% if recon_tech %}
+### 技术栈
+{% if recon_tech.technologies %}
+{{ recon_tech.technologies | join(', ') }}
+{% endif %}
+{% if recon_tech.http_headers %}
+| 响应头 | 值 |
+|--------|-----|
+{% for header, value in recon_tech.http_headers.items() %}
+| {{ header }} | {{ value }} |
+{% endfor %}
+{% endif %}
+{% if recon_tech.interesting_files %}
+
+### 发现的敏感文件
+| 路径 | 状态码 |
+|------|--------|
+{% for f in recon_tech.interesting_files %}
+| {{ f.path }} | {{ f.status }} |
+{% endfor %}
+{% endif %}
+{% endif %}
+
+{% if scan_ports %}
+## 端口扫描结果
+
+| 端口 | 协议 | 服务 | 版本 |
+|------|------|------|------|
+{% for p in scan_ports.tcp.ports %}
+| {{ p.port }} | {{ p.protocol }} | {{ p.service }} | {{ p.product }} {{ p.version }} |
+{% endfor %}
+{% if scan_ports.tcp.os_detection %}
+
+### OS 检测
+{% for os in scan_ports.tcp.os_detection %}
+- {{ os.name }} ({{ os.accuracy }}%)
+{% endfor %}
+{% endif %}
+{% endif %}
+
+---
+
+## 漏洞详情
+
+{% for finding in findings %}
+### VULN-{{ loop.index }}: {{ finding.title or finding.type or finding.id or 'Unknown' }}
+
+| 属性 | 值 |
+|------|-----|
+| 严重性 | {{ finding.severity }} |
+| CVSS 评分 | {{ finding.cvss | default('N/A') }} |
+{% if finding.cve_id %}| CVE ID | {{ finding.cve_id }} |{% endif %}
+| 影响范围 | {{ finding.affected_service or finding.service or finding.url or target }} |
+| 发现工具 | {{ finding.discovery_tool or finding.source or 'N/A' }} |
+
+{% if finding.description or finding.detail or finding.finding %}
+**描述：** {{ finding.description or finding.detail or finding.finding }}
+{% endif %}
+
+{% if finding.evidence %}
+**证据：**
+```
+{{ finding.evidence }}
+```
+{% endif %}
+
+{% if finding.remediation %}
+**修复建议：** {{ finding.remediation }}
+{% endif %}
+
+{% if finding.references %}
+**参考链接：**
+{% for ref in finding.references %}
+- {{ ref }}
+{% endfor %}
+{% endif %}
+
+---
+
+{% endfor %}
+
+{% if ssl_findings %}
+## SSL/TLS 审计结果
+
+{% if ssl_cert %}
+### 证书信息
+| 属性 | 值 |
+|------|-----|
+| 有效 | {{ '是' if ssl_cert.valid else '否' }} |
+| 颁发者 | {{ ssl_cert.issuer }} |
+| 剩余天数 | {{ ssl_cert.days_remaining }} |
+| 自签名 | {{ '是' if ssl_cert.self_signed else '否' }} |
+| 已过期 | {{ '是' if ssl_cert.expired else '否' }} |
+{% endif %}
+
+{% if ssl_findings %}
+| 问题 | 严重性 | 详情 |
+|------|--------|------|
+{% for f in ssl_findings %}
+| {{ f.type or f.id }} | {{ f.severity }} | {{ (f.detail or f.finding)[:80] }} |
+{% endfor %}
+{% endif %}
+{% endif %}
+
+## 修复优先级建议
+
+{% set critical_findings = findings | selectattr('severity', 'equalto', 'Critical') | list %}
+{% set high_findings = findings | selectattr('severity', 'equalto', 'High') | list %}
+{% set medium_findings = findings | selectattr('severity', 'equalto', 'Medium') | list %}
+
+{% if critical_findings %}
+### 1. 立即修复（24 小时内）
+{% for f in critical_findings %}
+- {{ f.title or f.type or f.id }}: {{ f.description or f.detail or '' }}
+{% endfor %}
+{% endif %}
+
+{% if high_findings %}
+### 2. 尽快修复（1 周内）
+{% for f in high_findings %}
+- {{ f.title or f.type or f.id }}: {{ f.description or f.detail or '' }}
+{% endfor %}
+{% endif %}
+
+{% if medium_findings %}
+### 3. 计划修复（1 个月内）
+{% for f in medium_findings %}
+- {{ f.title or f.type or f.id }}: {{ f.description or f.detail or '' }}
+{% endfor %}
+{% endif %}
+
+---
+
+## 免责声明
+
+本报告仅记录经授权的安全评估结果。所有测试均在授权范围内进行，
+未执行任何破坏性操作。发现的漏洞信息应妥善保管，仅用于安全加固。
+"""
+
+
+def generate_report(results: dict[str, dict], output_path: Path):
+    """生成渲染后的 Markdown 报告。"""
+    all_findings = collect_all_findings(results)
+    sorted_findings = sort_findings(all_findings)
+    counts = count_by_severity(sorted_findings)
+    risk_level = determine_risk_level(counts)
+
+    # 提取各阶段数据
+    recon_dns = results.get("recon_dns", {}).get("findings", {})
+    recon_tech = results.get("recon_tech", {}).get("findings", {})
+    scan_ports = results.get("scan_ports", {})
+    ssl_data = results.get("ssl_audit", {})
+    ssl_cert = ssl_data.get("certificate", {})
+    ssl_findings = ssl_data.get("findings", [])
+
+    # 确定目标
+    target = "Unknown"
+    for data in results.values():
+        if "target" in data:
+            target = data["target"]
+            break
+
+    # 确定时间
+    timestamps = [data.get("timestamp", "") for data in results.values() if "timestamp" in data]
+    timestamp = min(timestamps) if timestamps else time.strftime("%Y-%m-%d %H:%M:%S")
+
+    template = Template(REPORT_TEMPLATE)
+    report = template.render(
+        target=target,
+        timestamp=timestamp,
+        report_time=time.strftime("%Y-%m-%d %H:%M:%S"),
+        total_findings=len(sorted_findings),
+        counts=counts,
+        risk_level=risk_level,
+        recon_dns=recon_dns,
+        recon_tech=recon_tech,
+        scan_ports=scan_ports,
+        findings=sorted_findings,
+        ssl_cert=ssl_cert,
+        ssl_findings=ssl_findings,
+    )
+
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    output_path.write_text(report)
+    console.print(f"[green bold]报告已生成: {output_path}[/green bold]")
+
+    # 打印摘要
+    console.print(f"\n{'='*60}")
+    console.print(f"  渗透测试报告摘要")
+    console.print(f"{'='*60}")
+    console.print(f"  目标: {target}")
+    console.print(f"  总发现: {len(sorted_findings)} 个安全问题")
+    console.print(f"  风险等级: {risk_level}")
+    if counts["Critical"] > 0:
+        console.print(f"  [red bold]!! {counts['Critical']} 个严重漏洞 !![/red bold]")
+    if counts["High"] > 0:
+        console.print(f"  [red]{counts['High']} 个高危漏洞[/red]")
+    console.print(f"{'='*60}")
+
+
+def main():
+    parser = argparse.ArgumentParser(description="渗透测试 - 报告生成")
+    parser.add_argument("--input-dir", required=True, help="扫描结果目录")
+    parser.add_argument("--output", required=True, help="报告输出路径 (.md)")
+    args = parser.parse_args()
+
+    input_dir = Path(args.input_dir)
+    if not input_dir.exists():
+        console.print(f"[red]输入目录不存在: {input_dir}[/red]")
+        sys.exit(1)
+
+    results = load_json_files(input_dir)
+    if not results:
+        console.print(f"[yellow]未找到任何扫描结果 JSON 文件[/yellow]")
+        sys.exit(1)
+
+    console.print(f"加载了 {len(results)} 个结果文件: {', '.join(results.keys())}")
+    generate_report(results, Path(args.output))
+
+
+if __name__ == "__main__":
+    main()