Feature | v2.4.12 完善Authorization逻辑

Cl0udG0d · Feb 28, 2024 · 393efdc · 393efdc
1 parent eddc54a
commit 393efdc
Show file tree

Hide file tree

Showing 6 changed files with 43 additions and 42 deletions.
diff --git a/README.md b/README.md
@@ -11,10 +11,12 @@ PS: 感谢[FOFA](https://fofa.info/)提供这么好的测绘工具
 
 `-f` 参数开启关键字fuzz
 
-`--authorization` 指定登录用户的 authorization,authorization需要F12获取
+`--authorization` 指定登录用户的 authorization , authorization需要F12获取
 
 使用示例
 > fofa-hack.exe --keyword thinkphp --endcount 500
+> 
+> fofa-hack.exe --keyword thinkphp --endcount 500 --authorization your_authorization
 
 ### 安装
 
@@ -43,7 +45,7 @@ Fofa-hack>python fofa.py -h
 usage: fofa.py [-h] (--keyword KEYWORD | --inputfile INPUTFILE | --base BASE) [--timesleep TIMESLEEP] [--timeout TIMEOUT] [--endcount ENDCOUNT]
                [--level LEVEL] [--output OUTPUT] [--fuzz] [--proxy PROXY]
 
-Fofa-hack v2.4.3 使用说明
+Fofa-hack v2.4.12 使用说明
 
 optional arguments:
   -h, --help            show this help message and exit

diff --git a/core/fofaMain.py b/core/fofaMain.py
@@ -19,7 +19,7 @@
 import re, requests
 from lxml import etree
 
-from tookit.sign import getUrl, getPage2Url
+from tookit.sign import getUrl
 from tookit.unit import clipKeyWord, setProxy, colorize
 import gettext
 import locale
@@ -116,6 +116,8 @@ def getFofaKeywordsCount(self, search_key):
         """
         searchbs64 = base64.b64encode(f'{search_key}'.encode()).decode()
         print(colorize(_("[*] 爬取页面为:https://fofa.info/result?qbase64={}") .format(searchbs64) ,"green"))
+        if config.AUTHORIZATION:
+            return searchbs64,""
         html = requests.get(url="https://fofa.info/result?qbase64=" + searchbs64,
                             headers=fofaUseragent.getFofaPageNumHeaders(), timeout=self.timeout,proxies=self.proxy)\
                             .text
@@ -251,17 +253,10 @@ def setIndexTimestamp(self, searchbs64, timestamp_index):
         @return:
         """
         try:
-            if config.AUTHORIZATION:
-                request_url = getPage2Url(searchbs64,self.current_page_num)
-                # print(request_url)
-                self.current_page_num +=1
-                rep = requests.get(request_url, headers=fofaUseragent.getFofaCookieHeaders(), timeout=self.timeout,
-                                   proxies=self.proxy)
-            else:
-                request_url = getUrl(searchbs64)
-            # print(f'request_url:{request_url}')
-                rep = requests.get(request_url, headers=fofaUseragent.getFofaPageNumHeaders(), timeout=self.timeout,
-                                   proxies=self.proxy)
+            request_url = getUrl(searchbs64)
+            # print(request_url)
+            rep = requests.get(request_url, headers=fofaUseragent.getFofaPageNumHeaders(), timeout=self.timeout,
+                               proxies=self.proxy)
             # print(rep.text)
             timelist = self.getTimeList(rep.text)
             # print(timelist)
@@ -281,8 +276,8 @@ def fofaSpiderOnePageData(self, search_key, searchbs64, timestamp_index):
         # searchbs64 = searchbs64.replace("%3D", "=")
         # init_search_key = base64.b64decode(searchbs64).decode()
         init_search_key = search_key
-        if not config.AUTHORIZATION:
-            print("\033[1;34mnow search key: {}\033[0m" .format(init_search_key) )
+        # if not config.AUTHORIZATION:
+        print("\033[1;34mnow search key: {}\033[0m" .format(init_search_key) )
         TEMP_RETRY_NUM = 0
 
         while TEMP_RETRY_NUM < self.MAX_MATCH_RETRY_NUM:
@@ -371,15 +366,12 @@ def fofaSpider(self, search_key, searchbs64, index):
         if self.fuzz and not self.EXIT_FLAG:
             self.fofaFuzzSpider(search_key, context, index)
 
-        if config.AUTHORIZATION:
-            self.fofaSpider(search_key, searchbs64, index)
-        else:
-            search_key_modify = self.modifySearchTimeUrl(search_key, index)
-            # print(search_key_modify)
-            searchbs64_modify = urllib.parse.quote(base64.b64encode(search_key_modify.encode("utf-8")))
-            # search_key = search_key_modify
-            # searchbs64 = searchbs64_modify
-            self.fofaSpider(search_key_modify, searchbs64_modify, index)
+        search_key_modify = self.modifySearchTimeUrl(search_key, index)
+        # print(search_key_modify)
+        searchbs64_modify = urllib.parse.quote(base64.b64encode(search_key_modify.encode("utf-8")))
+        # search_key = search_key_modify
+        # searchbs64 = searchbs64_modify
+        self.fofaSpider(search_key_modify, searchbs64_modify, index)
 
     def isPortInKeyword(self):
         """

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ### 2.4.12
 + 修复[issue 63](https://github.com/Cl0udG0d/Fofa-hack/issues/63)
-+ 
++ 完善Authorization逻辑
 
 ### 2.4.11
 + 新增SECURITY文件

diff --git a/tookit/config.py b/tookit/config.py
@@ -5,6 +5,6 @@
 # @File    : config.py
 # @Github: https://github.com/Cl0udG0d
 
-VERSION_NUM = "2.4.11"
+VERSION_NUM = "2.4.12"
 ROOT_PATH=""
 AUTHORIZATION = ""
diff --git a/tookit/fofaUseragent.py b/tookit/fofaUseragent.py
@@ -94,12 +94,14 @@ def getFofaPageNumHeaders():
         'User-Agent': getFakeUserAgent(),
         'Accept': 'application/json, text/plain, */*',
     }
+    if config.AUTHORIZATION:
+        headers_use['Authorization'] = config.AUTHORIZATION
     return headers_use
 
-def getFofaCookieHeaders():
-    headers_use = {
-        'User-Agent': getFakeUserAgent(),
-        'Accept': 'application/json, text/plain, */*',
-        'Authorization':config.AUTHORIZATION,
-    }
-    return headers_use
+# def getFofaCookieHeaders():
+#     headers_use = {
+#         'User-Agent': getFakeUserAgent(),
+#         'Accept': 'application/json, text/plain, */*',
+#         'Authorization':config.AUTHORIZATION,
+#     }
+#     return headers_use
diff --git a/tookit/sign.py b/tookit/sign.py
@@ -11,6 +11,8 @@
 import time
 import base64
 
+from tookit import config
+
 '''
 加密算法部分感谢 tastypear
 '''
@@ -54,17 +56,20 @@ def getSign(message):
 
 def getUrl(qbase64):
     ts = int(time.time() * 1000)
-    message = f'fullfalsepage1qbase64{qbase64}size50ts{ts}'
+    size = 10 if config.AUTHORIZATION else 50
+    message = f'fullfalsepage1qbase64{qbase64}size{size}ts{ts}'
     sign = urllib.parse.quote(getSign(message))
-    url = f'https://api.fofa.info/v1/search?qbase64={urllib.parse.quote(qbase64)}&full=false&page=1&size=50&ts={ts}&sign={sign}&app_id=9e9fb94330d97833acfbc041ee1a76793f1bc691'
+    url = f'https://api.fofa.info/v1/search?qbase64={urllib.parse.quote(qbase64)}&full=false&page=1&size={size}&ts={ts}&sign={sign}&app_id=9e9fb94330d97833acfbc041ee1a76793f1bc691'
     return url
 
-def getPage2Url(qbase64,page):
-    ts = int(time.time() * 1000)
-    message = f'fullfalsepage{page}qbase64{qbase64}size10ts{ts}'
-    sign = urllib.parse.quote(getSign(message))
-    url = f'https://api.fofa.info/v1/search?qbase64={urllib.parse.quote(qbase64)}&full=false&page={page}&size=10&ts={ts}&sign={sign}&app_id=9e9fb94330d97833acfbc041ee1a76793f1bc691'
-    return url
+# def getPage2Url(qbase64,page):
+#     ts = int(time.time() * 1000)
+#     message = f'fullfalsepage{page}qbase64{qbase64}size10ts{ts}'
+#     sign = urllib.parse.quote(getSign(message))
+#     url = f'https://api.fofa.info/v1/search?qbase64={urllib.parse.quote(qbase64)}&full=false&page={page}&size=10&ts={ts}&sign={sign}&app_id=9e9fb94330d97833acfbc041ee1a76793f1bc691'
+#     return url
+
+
 
 if __name__ == '__main__':
     print(getUrl("InRoaW5rcGhwIg=="))