{"id":13843866,"url":"https://github.com/burpheart/koko-moni","last_synced_at":"2026-01-16T17:30:30.754Z","repository":{"id":142549116,"uuid":"613422519","full_name":"burpheart/koko-moni","owner":"burpheart","description":"一个基于网络空间搜索引擎的攻击面管理平台，可定时进行资产信息爬取，及时发现新增资产，本项目聚合了 Fofa、Hunter、Quake、Zoomeye 和 Threatbook 的数据源，并对获取到的数据进行去重与清洗","archived":false,"fork":false,"pushed_at":"2023-04-19T13:35:30.000Z","size":176,"stargazers_count":441,"open_issues_count":10,"forks_count":22,"subscribers_count":9,"default_branch":"main","last_synced_at":"2024-11-21T15:39:37.063Z","etag":null,"topics":["blueteam","easm","fofa","hunter","infosec","pentest-tool","quake","redteam","security","security-tools","threatbook","web-security","zoomeye"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/burpheart.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-03-13T14:40:22.000Z","updated_at":"2024-11-17T00:23:50.000Z","dependencies_parsed_at":"2023-07-19T12:34:35.039Z","dependency_job_id":null,"html_url":"https://github.com/burpheart/koko-moni","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/burpheart/koko-moni","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/burpheart%2Fkoko-moni","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/burpheart%2Fkoko-moni/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/burpheart%2Fkoko-moni/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/burpheart%2Fkoko-moni/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/burpheart","download_url":"https://codeload.github.com/burpheart/koko-moni/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/burpheart%2Fkoko-moni/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264892027,"owners_count":23679208,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blueteam","easm","fofa","hunter","infosec","pentest-tool","quake","redteam","security","security-tools","threatbook","web-security","zoomeye"],"created_at":"2024-08-04T17:02:29.693Z","updated_at":"2026-01-16T17:30:30.711Z","avatar_url":"https://github.com/burpheart.png","language":null,"funding_links":[],"categories":["Others","信息搜集"],"sub_categories":[],"readme":"# KOKO-MONI\n## 介绍\n本项目是一个网络空间搜索引擎监控平台，本项目聚合了 Fofa、Hunter、Quake、Zoomeye 和 Threatbook 的数据源，并对获取到的数据进行去重与清洗。\n\n\n该项目可以用于蓝方监控自身资产公网暴露以及 SRC 项目新增资产进行监控。\n## 功能\n- 聚合 Fofa、Hunter、Quake、Zoomeye 和 Threatbook 的数据源，快速查询相关资产信息。\n- 自动化监控，可定时进行资产信息爬取，及时发现新增资产。\n- 支持钉钉，推送加消息提醒，让您能够及时发现异常情况。\n- 提供 Web 检索界面，使得查询操作更加方便。\n## 安装\n解压安装包\n\n按照config.demo.yaml 内的注释填写配置项 保存为config.yaml\n\n示例配置\n``` yaml\nglobal: #全局配置 启动时会触发一次所有的任务\n  hunter_key: \"\" #hunter API key 注意用量  留空不采集\n  zoomeye_key: \"\"\n  quake_cookies: \"\" #quake登陆后 cookies\n  threatbook_cookies: \"\" #微步登陆后  cookies  注意用量 频繁会触发验证码 强制退出登陆\n  fofa_email: \"\" #  FOFA 邮箱\n  fofa_key: \"\" #  FOFA KEY\n  save_path: \"./data\" #数据保存位置\n  ip: \"127.0.0.1\" #api 监听ip\n  port: \"12347\" #api 端口\n  secret_key: \"123456\" #api key 一定要修改\n  plus_push_key:  \"\" #推送加 key 有新增资产会推送\n  ding_push_key:  \"\" #钉钉HOOK推送key\n  scan_on_start: true #启动时是否触发一次爬取\n\njobs:\n- name: \"one-ip\" #任务名 推送用\n  schedule: \"@daily\" #定时采集  支持cron语法 示例 @daily 每天一次 (半夜0点触发 系统时间和时区一定要设置好) 参考 https://pkg.go.dev/github.com/robfig/cron?utm_source=godoc\n  hunter_query: \"ip=\\\"1.1.1.1/24\\\"\" # hunter搜索语法 (ps: hunter api获取的banner有问题 )特殊字符注意转义 注意不同搜索引擎使用不同的语法 留空不采集\n  hunter_page: 10 #最大爬取页数 每页10条\n  quake_query: \"ip: \\\"1.1.1.1/24\\\"\"\n  quake_page: 50\n  threatbook_query: \"ip=1.1.1.1/24\"\n  threatbook_page: 50\n  zoomeye_query: \"1.1.1.1/24\"\n  zoomeye_page: 10  #最大爬取页数  每页20条\n  fofa_query: \"ip=\\\"1.1.1.1/24\\\"\"\n  fofa_page: 10\n- name: \"哔哩哔哩-域名\"\n  schedule: \"@daily\"\n  hunter_query: \"domain=\\\"bilibili.com\\\"\"\n  hunter_page: 10\n  quake_query: \"domain: \\\"bilibili.com\\\"\"\n  quake_page: 50\n  threatbook_query: \"root_domain=bilibili.com\"\n  threatbook_page: 50\n  zoomeye_query: \"site:bilibili.com\"\n  zoomeye_page: 10\n  fofa_query: \"domain=\\\"bilibili.com\\\"\"\n  fofa_page: 10\n```\n\n\n启动 ./koko-moni\n\n## UI\n注: web无登陆界面 直接访问 `/?key=secret_key` 鉴权  secret_key不正确时被RST连接为正常现象 key不正确触发反测绘\n\n![图片.png](./img/1.png)\n\n![图片.png](./img/2.png)\n\n![图片.png](./img/2.jpg)\n\n## 搜索语法\n\n本项目使用了 [ZED](https://github.com/brimdata/zed) 作为结构化数据搜索引擎\n可参考[zed官方文档](https://zed.brimdata.io/docs/language/overview)\n字段见输出文件\n\n### 简单运算\n```\nint\ntlen \u003e= 0\n\n时间\ntimestamp \u003e= 2023-01-08T05:55:22.200Z\n\n字符串\ntitle==\"404\"\n\n\n```\n如果带有特殊符号(中文)的键 根下可以使用 `this[\"\"]` 引用\n```\nthis[\"status-code\"] \u003e10\nthis[\"content-length\"]==158\n非根\nabc[\"测试\"]==\"123456\"\n\n多层复杂json结构\n{\"a\":{\"b\":{\"c\":\"123\"}}}\nthis[\"a\"].b.c==\"123\"\n{\"a\":{\"b\":[\"123\",\"456\"]}}\nthis[\"a\"].b[0]==\"123\"\n```\n\n### 强制类型转换\n\n```\n\ncast(数据,\u003c类型\u003e)\n\n字符串日期转time\n\ncast(\"2022-09-19T18:11:05.545961703+08:00\",\u003ctime\u003e)\n\n字符串ip转ip\n\ncast(\"1.1.1.1\",\u003cip\u003e)\n\n也可以简写成\n\ntime(\"2022-09-19T18:11:05.545961703+08:00\")\nip(\"1.1.1.1\")\n\n用例\n\ncidr_match(1.1.0.0/16,ip(host))  //匹配ip是否在cidr内\n\n\ntime(timestamp) \u003e= 2022-01-08T05:55:22.200Z\n```\n### 常用操作\n#### 排序\n升序排序\n`sort dns_names` \n降序排序\n`sort -r dns_names`\n#### in\n判断某个值是否在数组内\n```\n{\"test\":[301,200]}\n200 in test\n```\n\n\n#### 聚合查询\n##### 统计计数\n`count() by key`\n输出  `key,count()`\n与sort组合使用\n`count() by title|sort -r count`\n\n\n## TOOD\n\n- [x] fofa API 支持\n- [x] Hunter API 支持\n- [x] Zoomeye API 支持\n- [x] Quake 支持\n- [x] Threatbook 支持\n- [x] WEB数据清洗\n- [ ] 非WEB数据清洗\n- [ ] WEB UI\n    - [x] 搜索\n    - [ ] 任务管理\n    - [ ] 系统设置\n    - [ ] 资产统计\n\n\n\n## 已知问题\n\n- 示例配置文件 fofa_key: \"\"后少一个空格\n- hunter web banner 异常 api返回到的不是对应host的返回(hunter的问题)\n- 微步频繁请求API会封号\n- 多任务同时执行时可能会只执行最后一个任务\n\n\n\n\n## API\n\n### 全局参数\n\n鉴权url参数 `key` \n\n在配置文件中设置(secret_key)\n\n\n### 测试推送\n\n请求方式: GET\n\n请求URL: `/api/testpush`\n\n请求参数: 无\n\n\n### 聚合查询\n\n请求方式: GET\n\n请求URL: `/api/aggregate`\n\n请求参数: \n\n| 参数名 | 必选 | 类型 | 说明 |\n| --- | --- | --- | --- |\n| query | 是 | string | ZQ查询语句 |\n\n响应格式: JSON\n\n响应示例: \n\n```\n{\n  \"data\": {\n    \"count\": 92,\n    \"elapsed\": 226,\n    \"finger\": [\n      {\n        \"finger\": \"Fofa\",\n        \"count\": 75\n      },\n      {\n        \"finger\": \"Hunter\",\n        \"count\": 17\n      },\n      {\n        \"finger\": \"Nginx\",\n        \"count\": 7\n      },\n      {\n        \"finger\": \"Lua\",\n        \"count\": 7\n      }\n    ],\n    \"ipcount\": 77,\n    \"port\": [\n      {\n        \"port\": \"443\",\n        \"count\": 57\n      },\n      {\n        \"port\": \"80\",\n        \"count\": 26\n      }\n    ],\n    \"title\": [\n      {\n        \"count\": 29\n      },\n      {\n        \"title\": \"301 Moved Permanently\",\n        \"count\": 16\n      },\n      {\n        \"title\": \"302 Found\",\n        \"count\": 11\n      }\n    ]\n  },\n  \"message\": \"ok\",\n  \"success\": true\n}\n```\n\n### 搜索\n\n请求方式: GET\n\n请求URL: `/api/search`\n\n请求参数: \n\n| 参数名 | 必选 | 类型 | 说明 |\n| --- | --- | --- | --- |\n| current | 是 | int | 当前页数 |\n| pageSize | 是 | int | 每页数据量 |\n| query | 是 | string | ZQ查询语句 |\n\n响应格式: JSON\n\n响应示例: \n\n```\n{\n\t\"data\": [{\n\t\t\"banner\": \"HTTP/1.1 403 Forbidden\\r\\nConnection: close\\r\\nContent-Length: 9\\r\\nContent-Type: application/octet-stream\\r\\nDate: Thu, 16 Feb 2023 17:11:21 GMT\\r\\nServer: Tengine\\r\\n\\r\\n\\r\\n\",\n\t\t\"body_length\": 9,\n\t\t\"commonname\": \"\",\n\t\t\"date\": \"2023-03-13 21:59:41\",\n\t\t\"dnsnames\": \"\",\n\t\t\"fingerprint\": [\"Fofa\"],\n\t\t\"host\": \"1.1.com\",\n\t\t\"ip\": \"1.1.1.1\",\n\t\t\"loc\": \"[中国 上海 上海]\",\n\t\t\"organization\": \"Huawei Cloud Service data center\",\n\t\t\"port\": \"443\",\n\t\t\"status_code\": 403,\n\t\t\"title\": \"\",\n\t\t\"tls\": \"Version:  v3\\nSerial Number: 123456546\\nSignature Algorithm: SHA256-RSA\",\n\t\t\"url\": \"https://1.1.com:443/\"\n\t}],\n\t\"message\": \"ok\",\n\t\"success\": true,\n\t\"total\": 92\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fburpheart%2Fkoko-moni","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fburpheart%2Fkoko-moni","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fburpheart%2Fkoko-moni/lists"}