利用crawlergo-to-xray实现自动化漏洞被动扫描平台搭建

﹏ヽ暗。殇╰゛Y 2024-04-07 10:45 71阅读 0赞

#### **一、xray的安装和配置** ####

1.下载linux下的xray可执行文件

\[root@instance-7q32v011 opt\]\#

wget [https://github.com/chaitin/xray/releases/download/0.21.8/xray\_linux\_amd64.zip][https_github.com_chaitin_xray_releases_download_0.21.8_xray_linux_amd64.zip]

![8022a2b95fa86ab0202cb773b87b967c.png][]

2.解压文件

\[root@instance-7q32v011 opt\]\# unzip [xray\_linux\_amd64.zip][https_github.com_chaitin_xray_releases_download_0.21.8_xray_linux_amd64.zip]

![05943c4379dade684418cc186eb43ebc.png][]

3.运行xray可执行文件生成证书和配置文件

\[root@instance-7q32v011 opt\]\# ./xray\_linux\_amd64 genca

![1259abdc7bcd50ebdefa4b9b3e3abf1a.png][]

4.配置 config.yaml

\[root@instance-7q32v011 crawlergo-to-xray\]\# vi config.yaml

这里主要配置认证登录的username以及password和cookie值，针对登录系统爬虫。

![8fda9997a09ba3327c4d17dab89954e7.png][]

![ad229f27e94fe749d975be0fcc8847e4.png][]

#### **二、****Server酱的配置** ####

1.登入：用GitHub账号 [登入网站][Link 1]，就能获得一个 [SCKEY][](在「 [发送消息][SCKEY]」页面)

![ec732c858fcf362e6f5b555f8876d2ba.jpeg][]

2.绑定：点击「 [微信推送][Link 2]」，扫码关注同时即可完成绑定

![9c804dd56adf0acd2a34b9cab256c9ff.png][]

3.发消息：往 [http://sc.ftqq.com/SCKEY.send][http_sc.ftqq.com_SCKEY.send] 发GET请求，就可以在微信里收到消息啦

如生成这样的get请求：

https://sc.ftqq.com/SCU100930Te4d1xxxxxxxxxxxxxxxxx5e1fc35edd9f5bac3e2.send(记下这个地址，后面需要)

![4e7110f0ffd604449b29447e565dc86f.jpeg][]

#### **三、****启动webhook和修改配置** ####

\[root@instance-7q32v011 opt\]\# git clone https://github.com/undefinedsec/crawlergo-to-xray.git

![19f23eed36eb528c3d12a9019fe7046a.png][]

\[root@instance-7q32v011 opt\]\# cd crawlergo-to-xray/

\[root@instance-7q32v011 crawlergo-to-xray\]\# vi webhook.py

下面主要对其requests.post中参数值进行修改，修改为上面得到的get请求值。

![75fd1a2a28f233d512f82661f6a67d59.png][]

![59d2faefbd0e6f6854fdcb89461e197a.png][]

\[root@instance-7q32v011 crawlergo-to-xray\]\# python3 webhook.py

![5d0c65733301a53a67e90ece8d779386.png][]

\[root@instance-7q32v011 crawlergo-to-xray\]\# nohup python3 webhook.py > webhook.log 2>&1 &

![96d7168a2f8179292ec1ba864aabbfeb.png][]

\[root@instance-7q32v011 crawlergo-to-xray\]\# tail -f webhook.log

![f4142386ded348ae7a6bbf0d573fa25c.png][]

#### **四、****启动xray和修改配置** ####

启动xray并查看日志(需要自行修改xray的配置文件以及命令行中的的配置，建议在xray里面配置username和password，以及\[xray\_port和webhook\_port端口)

1. nohup ./xray\_linux\_amd64 webscan --listen 127.0.0.1:7777 --webhook-output http://127.0.0.1:5000/webhook --html-output xray.html > xray.log 2>&1 &

![8670a39767171c85af2804280abf0faa.png][]

2.查看xray日志

\[root@instance-7q32v011 crawlergo-to-xray\]\# tail -f xray.log

![70dfaea60d3bb3c68fef2efda35ac9e4.png][]

![22b8b465804aefcc6d76b7f6b331f3e7.png][]

#### **五、下载和安装linux版本的chrome** ####

1.\[root@instance-7q32v011 ~\]

wget [https://dl.google.com/linux/direct/google-chrome-stable\_current\_x86\_64.rpm][https_dl.google.com_linux_direct_google-chrome-stable_current_x86_64.rpm]

\[root@instance-7q32v011 ~\] rpm -ivh google-chrome-stable\_current\_x86\_64.rpm --nodeps --force

\[root@instance-7q32v011 ~\]  whice google-chrome-stable

![b795465753b1007008f07e64cfa2ee6b.png][]

#### **六、****启动crawlergo和修改配置** ####

\[root@instance-7q32v011 crawlergo-to-xray\]\# vi crawlergo.py

一般修改chorme的路径地址以及代理IP地址

如果需要更准确的爬虫，需要设置cookie和user-agent信息以及加上代理的ip和用户名和密码,cookieh和user-agent值可以通过登录系统后,xyay的代理IP和用户名和密码，可以根据前面设置的xray的配置获得。

抓包获取

./crawlergo" , "-c" , "/usr/bin/google-chrome" , "-t" , "10" , "-f" , "smart" , "--fuzz-path" , "--output-mode" , "json" , "--ignore-url-keywords" , "quit,exit,logout" , "--custom-headers" , simplejson . dumps ( headers ), "--robots-path" , "--log-level" , "debug" , "--push-to-proxy" , "http://xray\_username:xray\_password@xray\_ip:xray\_port" , target

以及

headers = \{

"User-Agent": "",

"Cookie": ""

![bc76134d6af3a3a0076d2503c8b99967.png][]

\[root@instance-7q32v011 crawlergo-to-xray\]\# vi targets.txt

![643f26c230102841747d05686bb4a47e.png][]

\[root@instance-7q32v011 crawlergo-to-xray\]\# nohup python3 crawlergo.py > crawlergo.log 2>&1 &

![81e73f47668ccf6196c0c9d0f2ce577d.png][]

\[root@instance-7q32v011 crawlergo-to-xray\]\# tail -f crawlergo.log

![3be63602e194dcd89df6834e9dac0f87.png][]

#### **七，最终可以在微信端查看到漏洞情况** ####

![eee9ff086db6afe3e02e2988d89c80b2.jpeg][]

[https_github.com_chaitin_xray_releases_download_0.21.8_xray_linux_amd64.zip]: https://github.com/chaitin/xray/releases/download/0.21.8/xray_linux_amd64.zip
[8022a2b95fa86ab0202cb773b87b967c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/6729650c9bd446ae94af91ecc3a71a53.png
[05943c4379dade684418cc186eb43ebc.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/59d21411294843cb9b9d2d9176c689f4.png
[1259abdc7bcd50ebdefa4b9b3e3abf1a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/57d706c8ccd24b51b5923a726a2a43b1.png
[8fda9997a09ba3327c4d17dab89954e7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/780041431ebf4975a2c4f1f9adfcf446.png
[ad229f27e94fe749d975be0fcc8847e4.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/b42ffe7922ba40d5a66011fac3ee39cc.png
[Link 1]: http://sc.ftqq.com/?c=github&a=login
[SCKEY]: http://sc.ftqq.com/?c=code
[ec732c858fcf362e6f5b555f8876d2ba.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/82a2ff4206944e9ea0607f22b0677448.jpeg
[Link 2]: http://sc.ftqq.com/?c=wechat&a=bind
[9c804dd56adf0acd2a34b9cab256c9ff.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/45a4ad65ad204d55acce3afd5693dacd.png
[http_sc.ftqq.com_SCKEY.send]: http://sc.ftqq.com/SCKEY.send
[4e7110f0ffd604449b29447e565dc86f.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/221100e5967349ecbcc9b5106ff1701c.jpeg
[19f23eed36eb528c3d12a9019fe7046a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/de2268d4bef245c5a527153f47bde5bd.png
[75fd1a2a28f233d512f82661f6a67d59.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f6357fccc1424100b4ef18a7d7133ce5.png
[59d2faefbd0e6f6854fdcb89461e197a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/79cd6155ddae4573814baaea181c3555.png
[5d0c65733301a53a67e90ece8d779386.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/1641f97a5d1840cc8e2bd8507a682282.png
[96d7168a2f8179292ec1ba864aabbfeb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/8b723b6a13c24c2cbaa8e0db4e33bc2c.png
[f4142386ded348ae7a6bbf0d573fa25c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/64b8d9c50c8044d4833399b3f11c36d1.png
[8670a39767171c85af2804280abf0faa.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e44e03e800cc454bac8b61f755eb393e.png
[70dfaea60d3bb3c68fef2efda35ac9e4.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f4f09959b3c547d987cfb888edb90e3b.png
[22b8b465804aefcc6d76b7f6b331f3e7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/79f0502b36d3494d92162358011e1fe8.png
[https_dl.google.com_linux_direct_google-chrome-stable_current_x86_64.rpm]: https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm
[b795465753b1007008f07e64cfa2ee6b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/1240ea57f277491eaa793a1fc0917557.png
[bc76134d6af3a3a0076d2503c8b99967.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/00a6009d05e7405c97720639e0e7adb7.png
[643f26c230102841747d05686bb4a47e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/4226a30867004eb5a9ea61de49451a35.png
[81e73f47668ccf6196c0c9d0f2ce577d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9af8545de2a3461db486b10fcef9a3b1.png
[3be63602e194dcd89df6834e9dac0f87.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9ceffc126de445eb9eb841ae7ccc5d4c.png
[eee9ff086db6afe3e02e2988d89c80b2.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c504b6a99cab4a75920442fa699c7db4.jpeg