b0bac / apolloscanner

自动化巡航扫描框架（可用于红队打点评估）

最新更新

2023.09.14

• 增加新功能，可以支持根据关键字监控Github上面新的漏洞POC/EXP

python3 manage.py crontab add # 添加计划任务
python3 manage.py crontab show # 查看计划任务

2023.09.12

• 优化显示逻辑

2023.09.11

• 更新了依赖库和安装说明文件
• 修复了virustotal请求验证证书失败的问题
• 修复github找不到Github的问题
• 修复了详情扫描中间件具体信息不能扫描的问题的

通知

请因缺少依赖库、依赖库版本不对、缺少组件、数据库账号口令与配置文件不同等引发的报错的使用者，先自行Google解决。

对于没有兴趣自己解决环境报错的小伙伴们，这里提供了虚拟机文件可直接下载导入运行。

ApolloScanner

自动化巡航扫描框架（可用于红队打点评估）

安装

提供了虚拟机版本

• 系统账号: apollo/apollo
• web访问账号: apollo/apollo
• 连接地址百度网盘
• 链接: https://pan.baidu.com/s/164TUtMLqv8yyxfrse5VR2g
• 提取码: s5ti
• 格式：
  • ova 适用于virtual box
  • ovf（zip压缩包）适用于 vmware workstations 和 vmware fusion
• 使用简便

cd ~/ApolloScanner
sudo python3.8 manage.py runserver 0.0.0.0:8080

• 虚拟机迁移可能导致的网络问题

sudo ifconfig -a 
# 查看所有网卡，假设网卡为ens33
# 调整为NAT模式
sudo ifconfig ens33 down
sudo ifconfig ens33 up

源码安装

• python版本： 3.8.x 或 3.9.x
• django版本：4.0.1
• nmap：需要
• masscan：需要
• mysql
• 前端：基于simple-ui
• 支持操作系统：MacOS Monterey 12.3 / Ubuntu 18.04 LTS

sudo apt install masscan nmap libmysqlclient-dev mysql-server
sudo python3 -m pip install -r requirments.txt
# 需要手动修改mysql root密码 创建Apollo 数据库 并修改settings.py 中的数据库账密
sudo python3 manage.py migrate
sudo python3 manage.py createsuperuser
sudo python3 manage.py runserver 0.0.0.0:80

功能

• 资产收集（需要主域名，资产对象可直接在爆破和漏扫过程中调用）

  • 子域名收集（需要virustotal-api-token）
  • cname收集
  • ip地址（a记录）收集
  • 开放端口扫描（基于masscan）
  • 端口对应服务、组件指纹版本探测（基于nmap）
  • http标题探测
  • http框架组件探测

• github敏感信息收集

  • 基于域名和关键字的敏感信息收集（需要github-token）

• 暴力破解（基于exp的暴力破解）

  • exp注册模块
    • 代码动态编辑
    • 代码动态调试
    • 支持资产对象
  • 破解任务模块
    • 支持exp对象调用
    • 支持资产对象
    • 支持批量资产
    • 支持多线程（可配置）
  • 破解结果模块
    • 支持结果显示
    • 支持钉钉通知
  • 敏感路径探测任务
  • 敏感路径探测结果

• 漏洞扫描模块

  • exp注册模块
    • 代码动态编辑
    • 代码动态调试
    • 支持资产对象
  • 漏扫任务模块
    • 支持exp对象调用
    • 支持资产对象
    • 支持批量资产
    • 支持多线程（可配置)
  • 结果显示模块
    • 支持结果显示
    • 支持钉钉通知

• 配置模块

  • 支持常用系统配置（各类token、线程数）
  • 支持用户、用户组、权限配置模块
  • 支持启动服务模块
    • HTTP服务（支持HTTP请求记录）
    • DNS服务（支持DNS请求记录）

exp编写规范

• 暴力破解

def brute_scan_function_name(ipaddress, port, username, password, logger):  
    import xx_module # 引入模块全部在函数内容写
    # ... 
    # ...是爆破exp核心代码
    logger.log("xxxxx") # 代替print
    return True  # 返回必须是true/false

• 漏扫扫描

def brute_scan_function_name(ipaddress, port, logger):  
    import xx_module # 引入模块全部在函数内容写
    # ... 
    # ...是漏扫exp核心代码
    logger.log("xxxxx") # 代替print
    return True  # 返回必须是true/false

报错解答

1、缺乏mysql_config命令：

• 报错示例

Preparing metadata (setup.py) ... error
error: subprocess-exited-with-error

× python setup.py egg_info did not run successfully.
│ exit code: 1
╰─> [11 lines of output]
/bin/sh: 1: mysql_config: not found
Traceback (most recent call last):
File "", line 2, in
File "", line 34, in
File "/tmp/pip-install-2er683ou/mysqlclient_5ba8560cf6ca429b8316cf1cf6771c9a/setup.py", line 16, in
metadata, options = get_config()
File "/tmp/pip-install-2er683ou/mysqlclient_5ba8560cf6ca429b8316cf1cf6771c9a/setup_posix.py", line 51, in get_config
libs = mysql_config("libs")
File "/tmp/pip-install-2er683ou/mysqlclient_5ba8560cf6ca429b8316cf1cf6771c9a/setup_posix.py", line 29, in mysql_config
raise EnvironmentError("%s not found" % (_mysql_config_path,))
OSError: mysql_config not found
[end of output]

note: This error originates from a subprocess, and is likely not a problem with pip.
error: metadata-generation-failed

× Encountered error while generating package metadata.
╰─> See above for output.

• 解析：由于部分环境缺乏mysql_config命令导致mysqlclient依赖安装失败，可能是由于没有安装该命令或者没有建立该命令的软连接，可根据自己环境google解决。
• 参考文献 : 解决Mysql中mysql_config not found的方法

关于一些异常简单的报错的解答：

目前看到一些ISSUE报错的原因是以下几种情况：

• 自己环境mysql账号密码与配置文件不匹配
• 缺少相关依赖Python库或版本不对
• 缺少相关依赖的组件或版本不对 此类问题请自行Google解决，不要提ISSUE

apolloscanner's Issues

所有的配置接口都出现问题

nuclei模板扫描能支持吗

nuclei模板扫描能支持吗

解决了

安装出错

Preparing metadata (setup.py) ... error
error: subprocess-exited-with-error

× python setup.py egg_info did not run successfully.
│ exit code: 1
╰─> [11 lines of output]
/bin/sh: 1: mysql_config: not found
Traceback (most recent call last):
File "", line 2, in
File "", line 34, in
File "/tmp/pip-install-2er683ou/mysqlclient_5ba8560cf6ca429b8316cf1cf6771c9a/setup.py", line 16, in
metadata, options = get_config()
File "/tmp/pip-install-2er683ou/mysqlclient_5ba8560cf6ca429b8316cf1cf6771c9a/setup_posix.py", line 51, in get_config
libs = mysql_config("libs")
File "/tmp/pip-install-2er683ou/mysqlclient_5ba8560cf6ca429b8316cf1cf6771c9a/setup_posix.py", line 29, in mysql_config
raise EnvironmentError("%s not found" % (_mysql_config_path,))
OSError: mysql_config not found
[end of output]

note: This error originates from a subprocess, and is likely not a problem with pip.
error: metadata-generation-failed

× Encountered error while generating package metadata.
╰─> See above for output.

kali 报错能看下吗

error: subprocess-exited-with-error

× python setup.py egg_info did not run successfully.
│ exit code: 1
╰─> [11 lines of output]
/bin/sh: 1: mysql_config: not found
Traceback (most recent call last):
File "", line 2, in
File "", line 34, in
File "/tmp/pip-install-a97fgjbo/mysqlclient_f2403b13f7fe41259413094ec5354b47/setup.py", line 16, in
metadata, options = get_config()
File "/tmp/pip-install-a97fgjbo/mysqlclient_f2403b13f7fe41259413094ec5354b47/setup_posix.py", line 51, in get_config
libs = mysql_config("libs")
File "/tmp/pip-install-a97fgjbo/mysqlclient_f2403b13f7fe41259413094ec5354b47/setup_posix.py", line 29, in mysql_config
raise EnvironmentError("%s not found" % (_mysql_config_path,))
OSError: mysql_config not found
[end of output]

note: This error originates from a subprocess, and is likely not a problem with pip.
error: metadata-generation-failed

× Encountered error while generating package metadata.
╰─> See above for output.

note: This is an issue with the package mentioned above, not pip.
hint: See above for details.

path路径遍历的时候 请问是否进行里 agent的伪造呢？

表哥们，加群465772464一起讨论搭建问题啊

开始扫描提示如下信息

请配置VT接口Token，这个token在哪配的？

虚拟机部署配置好了，下发扫描任务没反应，查看日志，反馈403，师傅们可以帮忙看下吗

虚拟机和各种配置都已经配置好了，可以启动，下发扫描任务，没反应，日志显示403，

师傅您好，以下问题烦请看看

您说的对。

能不能部署成docker版本的，，搭建了一下午各种bug根本不能用，，建议直接走docker一键部署这样大家都方便搭建和使用

能不能部署成docker版本的，，搭建了一下午各种bug根本不能用，，建议直接走docker一键部署这样大家都方便搭建和使用

增加开源poc

建议poc可以增加nuclei开源的poc

资产收集的结果等其他收集的结果无法一次性全部删除

资产收集结果等其他收集无法一次性全部删除
如果太多会报错
建议设置一个全部删除

ifconfig ens33报错

SIOCSIFFLAGS:Operation not permitted

After opening the virtual machine and obtaining the network card, it cannot run normally

Open the vmdk version of the virtual machine, and after obtaining the network card, the service cannot be started normally. The upgrade may be a django problem, but using the command to update django still reports an error, I don't understand the code, please ask how to solve this。
打开vmdk版本的虚拟机，获取网卡后，服务还是无法正常启动。 提示可能是django的问题，但是用命令更新django还是报错，看不懂代码，麻烦问一下要怎么解决。

github模块

这个root密码多少，一直获取不到ip，用那几个命令也不行

token在哪配置？github

师傅，没找到啊，token在哪配置呢

请问一些虚拟机安装的版本token如何配置

虚拟机安装的版本，如何配置github的token还有其他的token

我在云主机上安装好了但是无法访问

麻烦看一下是什么问题

虚拟机获取不到ip怎么办

window环境中报错

error: Microsoft Visual C++ 14.0 or greater is required. Get it with "Microsoft C++ Build Tools": https://visualstudio.microsoft.com/visual-cpp-build-tools/
[end of output]

note: This error originates from a subprocess, and is likely not a problem with pip.
ERROR: Failed building wheel for cryptography
Failed to build backports.zoneinfo cryptography
ERROR: Could not build wheels for backports.zoneinfo, cryptography, which is required to install pyproject.toml-based projects
但是c++ 14.0已经装了

运行子域名收集一直报错

好像不扫描

配好了，点启动的时候没看到masscan进程 htop 负载没变化 等好久也没结果 Python 用conda py3.8.5 系统Debian12 数据库 xampp MySQL 本地搭建 虚拟机 virtual box

我在Kali Linux中测试，显示已应答DNS超时

The resolution lifetime expired after 5.419510841369629 seconds: Server 192.168.183.2 UDP port 53 answered The DNS operation timed out.; Server 192.168.183.2 UDP port 53 answered The DNS operation timed out.; Server 192.168.183.2 UDP port 53 answered The DNS operation timed out.
The resolution lifetime expired after 5.440458536148071 seconds: Server 192.168.183.2 UDP port 53 answered The DNS operation timed out.; Server 192.168.183.2 UDP port 53 answered The DNS operation timed out.; Server 192.168.183.2 UDP port 53 answered The DNS operation timed out.

无法执行sudo python3 manage.py migrate 命令

Traceback (most recent call last):
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/base/base.py", line 230, in ensure_connection
self.connect()
File "/usr/local/lib/python3.8/dist-packages/django/utils/asyncio.py", line 25, in inner
return func(*args, **kwargs)
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/base/base.py", line 211, in connect
self.connection = self.get_new_connection(conn_params)
File "/usr/local/lib/python3.8/dist-packages/django/utils/asyncio.py", line 25, in inner
return func(*args, **kwargs)
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/mysql/base.py", line 233, in get_new_connection
connection = Database.connect(**conn_params)
File "/usr/local/lib/python3.8/dist-packages/pymysql/connections.py", line 353, in init
self.connect()
File "/usr/local/lib/python3.8/dist-packages/pymysql/connections.py", line 633, in connect
self._request_authentication()
File "/usr/local/lib/python3.8/dist-packages/pymysql/connections.py", line 907, in _request_authentication
auth_packet = self._read_packet()
File "/usr/local/lib/python3.8/dist-packages/pymysql/connections.py", line 725, in _read_packet
packet.raise_for_error()
File "/usr/local/lib/python3.8/dist-packages/pymysql/protocol.py", line 221, in raise_for_error
err.raise_mysql_exception(self._data)
File "/usr/local/lib/python3.8/dist-packages/pymysql/err.py", line 143, in raise_mysql_exception
raise errorclass(errno, errval)
pymysql.err.OperationalError: (1698, "Access denied for user 'root'@'localhost'")

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "manage.py", line 22, in
main()
File "manage.py", line 18, in main
execute_from_command_line(sys.argv)
File "/usr/local/lib/python3.8/dist-packages/django/core/management/init.py", line 425, in execute_from_command_line
utility.execute()
File "/usr/local/lib/python3.8/dist-packages/django/core/management/init.py", line 419, in execute
self.fetch_command(subcommand).run_from_argv(self.argv)
File "/usr/local/lib/python3.8/dist-packages/django/core/management/base.py", line 373, in run_from_argv
self.execute(*args, **cmd_options)
File "/usr/local/lib/python3.8/dist-packages/django/core/management/base.py", line 417, in execute
output = self.handle(*args, **options)
File "/usr/local/lib/python3.8/dist-packages/django/core/management/base.py", line 90, in wrapped
res = handle_func(*args, **kwargs)
File "/usr/local/lib/python3.8/dist-packages/django/core/management/commands/migrate.py", line 75, in handle
self.check(databases=[database])
File "/usr/local/lib/python3.8/dist-packages/django/core/management/base.py", line 438, in check
all_issues = checks.run_checks(
File "/usr/local/lib/python3.8/dist-packages/django/core/checks/registry.py", line 77, in run_checks
new_errors = check(app_configs=app_configs, databases=databases)
File "/usr/local/lib/python3.8/dist-packages/django/core/checks/model_checks.py", line 34, in check_all_models
errors.extend(model.check(**kwargs))
File "/usr/local/lib/python3.8/dist-packages/django/db/models/base.py", line 1307, in check
*cls._check_indexes(databases),
File "/usr/local/lib/python3.8/dist-packages/django/db/models/base.py", line 1715, in _check_indexes
connection.features.supports_expression_indexes or
File "/usr/local/lib/python3.8/dist-packages/django/utils/functional.py", line 48, in get
res = instance.dict[self.name] = self.func(instance)
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/mysql/features.py", line 266, in supports_expression_indexes
not self.connection.mysql_is_mariadb and
File "/usr/local/lib/python3.8/dist-packages/django/utils/functional.py", line 48, in get
res = instance.dict[self.name] = self.func(instance)
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/mysql/base.py", line 400, in mysql_is_mariadb
return 'mariadb' in self.mysql_server_info.lower()
File "/usr/local/lib/python3.8/dist-packages/django/utils/functional.py", line 48, in get
res = instance.dict[self.name] = self.func(instance)
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/mysql/base.py", line 389, in mysql_server_info
return self.mysql_server_data['version']
File "/usr/local/lib/python3.8/dist-packages/django/utils/functional.py", line 48, in get
res = instance.dict[self.name] = self.func(instance)
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/mysql/base.py", line 365, in mysql_server_data
with self.temporary_connection() as cursor:
File "/usr/lib/python3.8/contextlib.py", line 113, in enter
return next(self.gen)
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/base/base.py", line 614, in temporary_connection
with self.cursor() as cursor:
File "/usr/local/lib/python3.8/dist-packages/django/utils/asyncio.py", line 25, in inner
return func(*args, **kwargs)
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/base/base.py", line 270, in cursor
return self._cursor()
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/base/base.py", line 246, in _cursor
self.ensure_connection()
File "/usr/local/lib/python3.8/dist-packages/django/utils/asyncio.py", line 25, in inner
return func(*args, **kwargs)
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/base/base.py", line 230, in ensure_connection
self.connect()
File "/usr/local/lib/python3.8/dist-packages/django/db/utils.py", line 90, in exit
raise dj_exc_value.with_traceback(traceback) from exc_value
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/base/base.py", line 230, in ensure_connection
self.connect()
File "/usr/local/lib/python3.8/dist-packages/django/utils/asyncio.py", line 25, in inner
return func(*args, **kwargs)
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/base/base.py", line 211, in connect
self.connection = self.get_new_connection(conn_params)
File "/usr/local/lib/python3.8/dist-packages/django/utils/asyncio.py", line 25, in inner
return func(*args, **kwargs)
File "/usr/local/lib/python3.8/dist-packages/django/db/backends/mysql/base.py", line 233, in get_new_connection
connection = Database.connect(**conn_params)
File "/usr/local/lib/python3.8/dist-packages/pymysql/connections.py", line 353, in init
self.connect()
File "/usr/local/lib/python3.8/dist-packages/pymysql/connections.py", line 633, in connect
self._request_authentication()
File "/usr/local/lib/python3.8/dist-packages/pymysql/connections.py", line 907, in _request_authentication
auth_packet = self._read_packet()
File "/usr/local/lib/python3.8/dist-packages/pymysql/connections.py", line 725, in _read_packet
packet.raise_for_error()
File "/usr/local/lib/python3.8/dist-packages/pymysql/protocol.py", line 221, in raise_for_error
err.raise_mysql_exception(self._data)
File "/usr/local/lib/python3.8/dist-packages/pymysql/err.py", line 143, in raise_mysql_exception
raise errorclass(errno, errval)
django.db.utils.OperationalError: (1698, "Access denied for user 'root'@'localhost'")

虚拟机获取不到地址咋办

(1366, "Incorrect string value: '\\xE5\\x85\\xB3\\xE9\\x94\\xAE...' for column 'object_repr' at row 1")

虚拟机设置vt等配置参数时报错。 应该是插入中文时出现了错误，麻烦提供一下数据库账号密码。
使用的是vm的镜像。

师傅你好，可以向你讨教一下，部署这个扫描仪出现的一些问题吗！

师傅你好，可以向你讨教一下，部署这个扫描仪出现的一些问题吗！

这里的命令输错了

python3 -m pip install -r requirments.txt

老哥得支持批量

好像不支持批量，智能加完一个 加下一个

poc兼容

考虑使用xrayyaml格式的poc吗？

从头开始部署踩过的坑及解决办法

1 安装ubuntun系统18.04
2 安装 python3.9
3.安装库 python3 -m pip install -r requirments.txt
4 安装 mysql #apt直接装就行
5 新建数据库 # create database 库名 default charset=utf8;
6 mysql 新建用户 密码 授权访问新建的库 #最好别用root用户
7 修改 ApolloScanner/ApolloScanner/setting.py 中的数据库配置

虚拟机版的系统配置接口出现编码错误了，不知道去哪里该

通过查询是需要配置utf-8

虚拟机资产扫描的时候dns.resolver模块报错

报以下的错，然后加载不了文件，大佬帮忙看看。

Performing system checks...

System check identified some issues:

WARNINGS:
?: (urls.W005) URL namespace 'admin' isn't unique. You may not be able to reverse all URLs in this namespace

负载管理部分如何配置

负载管理部分如何配置,我没有看到配置的相关文档

扫码速度可能被墙问题

建议 能否根据需求控制口令爆破、路径遍历等 速度问题 同时也可以减少对系统等压力。防止系统崩溃

有非百度网盘的下载方式么？？？

123pan或者什么其他