(原创)AWVS逆向API设计的批量提交控制网页 基于PHP设计
这段代码是一个简单的HTML和PHP混合的网页应用程序，用于管理和控制MyFPGA-Safe系统的一些功能。以下是对代码的分析：
HTML结构：
<!DOCTYPE html>：HTML5文档类型声明。<html>：HTML文档的根元素。<head>：包含页面的元信息和引入的CSS样式。<body>：页面的主要内容。页面样式：在
<style>标签内定义了一些CSS样式，用于美化页面的外观。这些样式定义了字体、表单、按钮、表格等元素的外观。页面内容：
标题：
<h1>元素显示了页面的标题为"MyFPGA-Safe"。表单：
<form>元素包含一个文本输入框和一个提交按钮，用于用户输入URL并提交。进度条：
<div>元素用于显示进度条，初始宽度为0。PHP代码：在
<?php ... ?>标记内嵌入了一些PHP代码，用于处理URL的提交、数据库操作、API请求等功能。页面底部：包含一些链接，用于导航到其他页面。
PHP功能：
设置时区：使用
date_default_timezone_set函数设置时区为"Asia/Shanghai"。定义API相关信息：定义了目标URL、API密钥等信息。
定义函数：定义了多个PHP函数，用于不同的操作，包括获取地址、提交缺失的目标、发起扫描、检查域名是否存在、保存URL等。
数据库连接：尝试使用PDO建立与MySQL数据库的连接，如果失败则捕获异常并显示错误信息。
处理表单提交：当用户提交URL时，将URL解析、保存到数据库、创建目标并配置扫描，并启动扫描任务。
显示仪表盘信息：通过API请求获取并显示仪表盘信息，包括运行中的扫描数量、等待中的扫描数量、目标数量等。
总体来说，这段代码实现了一个简单的Web界面，用户可以通过表单输入URL，然后通过PHP与后端API交互，将URL保存到数据库并触发扫描任务。此外，还提供了一些导航链接以便用户浏览其他页面。这个应用程序的核心功能是与MyFPGA-Safe系统进行交互，管理和执行网络扫描任务。请注意，这段代码依赖于外部的PHP库或函数（如requests和PDO）来完成操作，因此需要确保这些依赖项在服务器上正确配置和安装。
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>MyFPGA-Safe</title>
<style>
body {
font-family: Arial, sans-serif;
margin: 20px;
}
h1 {
text-align: center;
}
.container {
max-width: 600px;
margin: 0 auto;
}
form {
background-color: #f0f0f0;
padding: 20px;
border-radius: 5px;
box-shadow: 0px 0px 10px 0px #000;
}
label {
font-weight: bold;
}
input[type="text"] {
width: 100%;
padding: 10px;
margin-bottom: 10px;
border: 1px solid #ccc;
border-radius: 3px;
}
button[type="submit"] {
background-color: #007bff;
color: #fff;
padding: 10px 20px;
border: none;
border-radius: 3px;
cursor: pointer;
}
button[type="submit"]:hover {
background-color: #0056b3;
}
table {
border-collapse: collapse;
width: 100%;
margin-top: 20px;
}
th,
td {
border: 1px solid #ccc;
padding: 8px;
text-align: left;
}
th {
background-color: #f2f2f2;
}
</style>
</head>
<body>
<div class="container">
<h1>MyFPGA-Safe</h1>
<form method="POST" action="">
<label for="urls">Enter URLs (comma-separated):</label>
<input type="text" name="urls" id="urls" required>
<button type="submit">Submit</button>
</form>
<div id="progressContainer" style="margin-top: 10px;">
<div id="progressBar" style="width: 0%; background-color: #007bff; height: 20px;"></div>
</div>
<?php
date_default_timezone_set('Asia/Shanghai');
$tarurl = "https://192.168.0.169:13443";//这里根据你的实际情况填写
$apikey = "1986ad8c0a5b3df4d7028d5f3c06e936c8*********"; //这里填写APIKEY
$headers = [
"X-Auth: $apikey",
"Content-type: application/json;charset=utf8",
];
function GetAddresses($tarurl, $headers)
{
$page = 0;
$pageSize = 100;
$addresses = array();
do {
$api_url = $tarurl . "/api/v1/targets?c=" . $page . "&l=" . $pageSize;
$response = requests($api_url, 'GET', $headers);
$data = json_decode($response, true);
foreach ($data['targets'] as $target) {
$addresses[] = $target['address'];
}
$page += $pageSize;
} while (!empty($data['targets']));
return $addresses;
}
function SubmitMissingTargets($addresses, $pdo)
{
try {
$stmt = $pdo->prepare("SELECT url FROM urls_table");
$stmt->execute();
$existingDomains = $stmt->fetchAll(PDO::FETCH_COLUMN);
$missingDomains = array_diff($existingDomains, $addresses);
return $missingDomains;
} catch (PDOException $e) {
echo "Database Error: " . $e->getMessage();
return array();
}
}
function scans($url)
{
global $tarurl, $headers;
$api_url = $tarurl . '/api/v1/scans';
$urlCount = count($url);
$currentCount = 0;
foreach ($url as $i) {
$data = [
"target_id" => $i,
"profile_id" => "11111111-1111-1111-1111-111111111113", //我设置的默认为扫描SQL，你可以修改最后的3为2，即高危漏洞扫描。也可以改成1，全扫描。
"schedule" => [
"disable" => false,
"start_date" => null,
"time_sensitive" => false,
],
];
$data_json = json_encode($data);
requests($api_url, 'POST', $headers, $data_json);
$currentCount++;
ob_flush();
flush();
}
}
function isDomainNameExists($domainName, $pdo)
{
$stmt = $pdo->prepare("SELECT COUNT(*) FROM urls_table WHERE domain_name = ?");
$stmt->execute([$domainName]);
return $stmt->fetchColumn() > 0;
}
function saveURL($url, $pdo)
{
$domainName = parse_url($url, PHP_URL_HOST);
if (!isDomainNameExists($domainName, $pdo)) {
$allowedSuffixes = array(".gov", ".cn", ".edu"); //默认不对这几个后缀的进行扫描
$domainSuffix = substr($domainName, -4);
if (!in_array($domainSuffix, $allowedSuffixes)) {
$stmt = $pdo->prepare("INSERT INTO urls_table (url, domain_name) VALUES (:url, :domainName)");
$stmt->bindParam(':url', $url, PDO::PARAM_STR);
$stmt->bindParam(':domainName', $domainName, PDO::PARAM_STR);
$stmt->execute();
}
}
}
function requests($url, $method, $headers, $data = null)
{
$options = [
'http' => [
'header' => implode("\r\n", $headers),
'method' => $method,
'ignore_errors' => true,
],
'ssl' => [
'verify_peer' => false,
'verify_peer_name' => false,
],
];
if ($data !== null) {
$options['http']['content'] = $data;
}
$context = stream_context_create($options);
return file_get_contents($url, false, $context);
}
function number($url)
{
$url_list = explode(',', $url);
$number = count($url_list);
return [$url_list, $number];
}
function post_targets($url)
{
global $tarurl, $headers;
$api_url = $tarurl . '/api/v1/targets';
$target_id_list = [];
foreach ($url as $i) {
$data = [
"address" => $i,
"description" => "awvs_myfpga_cn", //这是描述，你可以不改。
"criticality" => "10",
];
$data_json = json_encode($data);
$response = requests($api_url, 'POST', $headers, $data_json);
$target_id = json_decode($response, true)["target_id"];
$target_id_list[] = $target_id;
}
return $target_id_list;
}
function modify_conf($target_id_list)
{
global $tarurl, $headers;
$config_data = [
"user_agent" => "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36",
"limit_crawler_scope" => true,
"excluded_paths" => [],
];
$config_data_json = json_encode($config_data);
foreach ($target_id_list as $target_id) {
$api_url = $tarurl . "/api/v1/targets/{$target_id}/configuration";
requests($api_url, 'PATCH', $headers, $config_data_json);
}
}
function ContinueTargetScan($page, $pageSize = 100)
{
global $tarurl, $headers;
$api_url = $tarurl . "/api/v1/targets?c=" . $page . "&l=" . $pageSize . "&q=never_scanned";
$response = requests($api_url, 'GET', $headers);
$data = json_decode($response, true);
$targetIds = array_column($data['targets'], 'target_id');
return $targetIds;
}
function dashboard_info()
{
global $tarurl, $headers;
$api_url = $tarurl . '/api/v1/me/stats';
$response = requests($api_url, 'GET', $headers);
$data = json_decode($response, true);
echo '<h3>Dashboard Information</h3>';
echo '<p>Total Scans Running Count: ' . $data['scans_running_count'] . '</p>';
echo '<p>Total Scans Waiting Count: ' . $data['scans_waiting_count'] . '</p>';
echo '<p>Total Targets Count: ' . $data['targets_count'] . '</p>';
}
dashboard_info();
try {
$pdo = new PDO('mysql:host=127.0.0.1;dbname=abc;charset=utf8', 'abc', 'abxc');
//这里根据你的数据库信息填写，别想着撞库，这个只是已删除的测试用户名和密码。连这个域名都是不存在的。
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$pdo->exec("SET NAMES utf8");
} catch (PDOException $e) {
echo "Database Connection Error: " . $e->getMessage();
}
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['urls'])) {
$urls = $_POST['urls'];
$urls = str_replace("\n", ",", $urls);
$urls = str_replace(" ", ",", $urls);
list($url_list, $number) = number($urls);
try {
foreach ($url_list as $url) {
saveURL($url, $pdo);
}
$all_target_id_list = post_targets($url_list);
modify_conf($all_target_id_list);
scans($all_target_id_list);
} catch (PDOException $e) {
echo "Save Urls Error: " . $e->getMessage();
}
}
echo '<a href="index.php">回到主页</a></br>';
echo '<a href="sync.php">同步链接</a></br>';
echo '<a href="continue.php">启动扫描</a></br>';
?>
</div>
</body>
</html>
