{"id":13841140,"url":"https://github.com/pmiaowu/BurpShiroPassiveScan","last_synced_at":"2025-07-11T12:30:24.816Z","repository":{"id":38347059,"uuid":"279794074","full_name":"pmiaowu/BurpShiroPassiveScan","owner":"pmiaowu","description":"一款基于BurpSuite的被动式shiro检测插件","archived":false,"fork":false,"pushed_at":"2022-12-14T20:55:01.000Z","size":9109,"stargazers_count":1628,"open_issues_count":5,"forks_count":152,"subscribers_count":19,"default_branch":"master","last_synced_at":"2024-08-05T17:26:50.483Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pmiaowu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-07-15T07:12:16.000Z","updated_at":"2024-08-05T11:19:46.000Z","dependencies_parsed_at":"2023-01-29T01:01:48.714Z","dependency_job_id":null,"html_url":"https://github.com/pmiaowu/BurpShiroPassiveScan","commit_stats":null,"previous_names":[],"tags_count":27,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pmiaowu%2FBurpShiroPassiveScan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pmiaowu%2FBurpShiroPassiveScan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pmiaowu%2FBurpShiroPassiveScan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pmiaowu%2FBurpShiroPassiveScan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pmiaowu","download_url":"https://codeload.github.com/pmiaowu/BurpShiroPassiveScan/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225720396,"owners_count":17513595,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:03.215Z","updated_at":"2024-11-21T11:30:19.823Z","avatar_url":"https://github.com/pmiaowu.png","language":"Java","funding_links":[],"categories":["Java","Scanners","Java (504)"],"sub_categories":[],"readme":"# BurpShiroPassiveScan\n一款基于BurpSuite的被动式shiro检测插件\n\n# 免责声明\n该工具仅用于安全自查检测\n\n由于传播、利用此工具所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，作者不为此承担任何责任。\n\n本人拥有对此工具的修改和解释权。未经网络安全部门及相关部门允许，不得善自使用本工具进行任何攻击活动，不得以任何方式将其用于商业目的。\n\n# 自言自语\n据听说它的诞生是因为作者太太太懒了!\n\n不想每个站点自己去添加个rememberMe去探测是否shiro框架\n\n于是乎～\n\n它就诞生了\n\n# 简介\nBurpShiroPassiveScan 一个希望能节省一些渗透时间好进行划水的扫描插件\n\n该插件会对BurpSuite传进来的每个不同的域名+端口的流量进行一次shiro检测\n\n目前的功能如下\n- shiro框架指纹检测\n- shiro加密key检测,cbc,gcm\n\n# 请注意!!!!\n下载完毕以后,请务必打开 /resources/config.yml 看看配置文件,里面有很多自定义的功能,可以自由选择, 例如添加shiro key功能\n\n下载完毕以后,请务必打开 /resources/config.yml 看看配置文件,里面有很多自定义的功能,可以自由选择, 例如添加shiro key功能\n\n下载完毕以后,请务必打开 /resources/config.yml 看看配置文件,里面有很多自定义的功能,可以自由选择, 例如添加shiro key功能\n\n# 编译方法\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003e编译方法\u003c/b\u003e\u003c/summary\u003e\n\n这是一个 java maven项目\n\n导入idea,打开刚刚好下载好的源码\n\n![](./images/1.png)\n\n打开: /BurpShiroPassiveScan/pom.xml 安装对应的包,第一次安装依赖包需要比较久,慢慢等不要急\n\n![](./images/2.png)\n\n![](./images/3.png)\n\n编译文件地址: ./BurpShiroPassiveScan/target/BurpShiroPassiveScan/\n\njar包地址: ./BurpShiroPassiveScan/target/BurpShiroPassiveScan/BurpShiroPassiveScan.jar\n\n项目配置文件地址: ./BurpShiroPassiveScan/target/BurpShiroPassiveScan/resources/config.yml\n\n接着拿着这个jar包, 导入BurpSuite即可\n\n\u003c/details\u003e\n\n# 安装方法\n\n![](./images/4.png)\n\n![](./images/5.png)\n\n# 检测方法选择\n\n目前只有一种方法进行shiro框架的key检测\n\n1. l1nk3r师傅的基于原生shiro框架 检测方法\n\nl1nk3r师傅的检测思路地址: https://mp.weixin.qq.com/s/do88_4Td1CSeKLmFqhGCuQ\n\n根据我的测试l1nk3r师傅的这个方法更加适合用来检测“shiro key”这个功能！！！\n\n使用l1nk3r师傅这个方法对比URLDNS我认为有以下优点\n\n1. 去掉了请求dnslog的时间, 提高了扫描速度, 减少了大量的额外请求\n2. 避免了有的站点不能出网导致漏报\n3. 生成的密文更短, 不容易被waf拦截\n\n基于以上优点, 我决定了, 现在默认使用 l1nk3r师傅 这个方法进行 shiro key的爆破\n\n# 使用方法\n我们正常去访问网站, 如果站点的某个请求出现了,那么该插件就会去尝试检测\n\n访问完毕以后, 插件就会自动去进行扫描\n\n如果有结果那么插件就会在以下地方显示\n- Tag\n- Extender\n- Scanner-Issue activity\n\n# 问题查看\n目前有这几个地方可以查看\n\n![](./images/6.png)\n\n![](./images/7.png)\n\n![](./images/8.png)\n\n![](./images/9.png)\n\n# tag界面查看漏洞情况\n\n```\n现在可以通过tag界面查看漏洞情况了\n\n分别会返回\n- the number of website scans exceeded = 超出网站可扫描次数(可通过config.yml修改)\n- shiro fingerprint problems have exceeded the number = shiro指纹问题已经超过了暴露次数(可通过config.yml修改)\n- shiro encryption key leakage problems have exceeded the number = shiro加密密钥泄露问题已经超过了暴露次数(可通过config.yml修改)\n- shiro fingerprint module startup error = shiro指纹模块启动错误\n- the site is not a shiro framework = 这个网站不是shiro框架\n- waiting for test results = 等待测试结果\n- [-] not found shiro key = 没有找到shiro的key\n- [+] found shiro key: xxxxx = 发现了shiro的key\n- [*] shiro fingerprint = 表示使用了shiro框架\n- [x] unknown error = 未知错误\n```\n\n# 新增key的方法\n```\n嫌弃内置key不够多,可以这样\n\n打开: ./BurpShiroPassiveScan/resources/config.yml\n找到: application.shiroCipherKeyExtension.config.payloads\n\n然后在后面添加新key即可\n\n注: 修改了配置,记得重新加载插件,这样才会生效\n```\n\n# 设置多线程的方法\n```\n嫌弃跑的慢,可以这样\n\n打开: ./BurpShiroPassiveScan/resources/config.yml\n找到: application.shiroCipherKeyExtension.config.threadTotal\n\n然后修改想开的线程即可,默认为4线程\n\n注: 修改了配置,记得重新加载插件,这样才会生效\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpmiaowu%2FBurpShiroPassiveScan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpmiaowu%2FBurpShiroPassiveScan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpmiaowu%2FBurpShiroPassiveScan/lists"}