{"id":13843907,"url":"https://github.com/tiaotiaolong/TTLScan","last_synced_at":"2025-07-11T20:30:51.780Z","repository":{"id":105641423,"uuid":"148476925","full_name":"tiaotiaolong/TTLScan","owner":"tiaotiaolong","description":"一款简易的插件化的漏洞扫描器框架","archived":false,"fork":false,"pushed_at":"2018-09-23T06:46:13.000Z","size":55,"stargazers_count":68,"open_issues_count":0,"forks_count":15,"subscribers_count":6,"default_branch":"master","last_synced_at":"2024-11-21T15:39:37.311Z","etag":null,"topics":["plugin","redis","scanner","struts2-exp","vulnerability"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tiaotiaolong.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2018-09-12T12:28:28.000Z","updated_at":"2023-07-04T12:29:06.000Z","dependencies_parsed_at":"2023-06-12T14:45:27.961Z","dependency_job_id":null,"html_url":"https://github.com/tiaotiaolong/TTLScan","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tiaotiaolong/TTLScan","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tiaotiaolong%2FTTLScan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tiaotiaolong%2FTTLScan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tiaotiaolong%2FTTLScan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tiaotiaolong%2FTTLScan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tiaotiaolong","download_url":"https://codeload.github.com/tiaotiaolong/TTLScan/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tiaotiaolong%2FTTLScan/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264892028,"owners_count":23679208,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["plugin","redis","scanner","struts2-exp","vulnerability"],"created_at":"2024-08-04T17:02:30.480Z","updated_at":"2025-07-11T20:30:51.453Z","avatar_url":"https://github.com/tiaotiaolong.png","language":"Python","funding_links":[],"categories":["Python (1887)","Python","LLM分析过程"],"sub_categories":[],"readme":"# TTLScan\n\n[![Python3](https://img.shields.io/badge/python-3.6-green.svg?style=plastic)](https://www.python.org/)\n\n\n\n\n**一款插件化的漏洞扫描器框架**\n\n\n- 目前支持ip iplist zoomeye搜索引擎 url urllist\n- 目前支持RedisUn RedisGetShell Struts2系列漏洞 \n- POC的准确性的已被复测\n- 已经支持ZoomEYE搜索引擎自动获取ip系列POC的目标集合\n- 希望大家一起来提交Poc 一起来修改框架\n- To be Continued...\n\n    \n**截图**\n\n![](http://okzjjcktf.bkt.clouddn.com/logo.png)\n\n**使用说明**\n\n程序的整体设计是支持3种输入源，目前支持两种输入源分别为：\n\n- ip方式\n- url方式\n\n其中这两种都支持list形式 也就是文件列表格式。\n\n**eg**: Redis未授权访问，输入源就是ip方式 你可以使用--ip或者--ip_list两种参数\n其中--ip和--ip_list两者中--ip的优先级较高，如果同时使用了2种参数，则视为--ip_list无效\n\n**eg**: 查询目前的所有Poc脚本\n\n![](http://okzjjcktf.bkt.clouddn.com/logo4.png)\n\n**POC的格式**\npoc的格式非常简单，主要是2个函数被动态调用 POC()和POC_INFO()两个函数被动态调用，当检测到有漏洞的时候可以使用logger进行日志输出。\n\n**eg：** **redis_un** script\n\n```\n#coding=utf-8\nimport redis\nimport socket\nfrom lib import ttlscanlogger\n\ndef POC_INFO():\n\tdict_poc={};\n\tdict_poc[\"name\"]=\"Redis Access Without Limit\"\n\tdict_poc[\"Chinese_name\"]=\"Redis未授权访问\"\n\tdict_poc[\"author\"]=\"qi.tao\"\n\tdict_poc[\"port\"]=6379\n\treturn dict_poc\n\t\ndef POC(ip,port=6379):\n\ttry:\n\t\tsocket.setdefaulttimeout(2)\n\t\tpoc=\"\\x2a\\x31\\x0d\\x0a\\x24\\x34\\x0d\\x0a\\x69\\x6e\\x66\\x6f\\x0d\\x0a\"\n\t\ts=socket.socket()\n\t\ts.connect((ip,port))\n\t\ts.send(poc)\n\t\trec=s.recv(1024)\n\t\ts.close()\n\t\tif \"redis\" in rec:\n\t\t\tttlscanlogger.logger.error(\"[+]Vuln: {0} has found Redis access without limit\".format(ip))\n\t\t\treturn True\n\t\telse:\n\t\t\treturn False\n\texcept:\n\t\treturn False\n\nif __name__ == '__main__':\n\tprint(POC())\n```\n\n**搜索引擎的使用方法 --search**\n\n--search支持zoomeye搜索引擎，可以对ip系列的POC进行目标集合获取\n--search_page 为获取的页数 默认为20页\n\n**eg：** \n下图命令为利用zoomeye搜索引擎对redis未授权访问进行探测 默认只对有漏洞的ip进行日志输出，图中为了显示zoomeye搜索引擎目标集合，对整个集合进行了输出。\n\n![](http://okzjjcktf.bkt.clouddn.com/logo5.png)\n\n**zoomeye的设置和使用**\n\n**zoomeye官方提供了api允许我们使用，这里我已经做了集成。但仍需相关配置项 access_token\n获取zoomeye access_token的方法如下：**\n\n平台主要使用的是 Json Web Token 的登录验证方式，用户只需使用用户名和密码，登录一次，获取 access_token。\n\n并在接下来的其他 API 请求 HTTP 头中带上 access_token (格式如 Authorization: JWT \u003caccess_token\u003e) 即可，无需再次登录验证。\n\n获取access_token示例\n\n```\ncurl -X POST https://api.zoomeye.org/user/login -d\n'{\n    \"username\": \"foo@bar.com\",\n    \"password\": \"foobar\"\n}'\n{\"access_token\": \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eSI6MSwiaWF0IjoxNDU1NzE4NDcwLCJuYmYiOjE0N... ...\"}\n\n```\n\n**将获取的access_token添加到config.config.py中的access_token**\n\n```\n#coding=utf-8\n#Zoomeye Token\naccess_token=\"\"\n\n#Zoomeye Search API\nzoomeye_search_api=\"https://api.zoomeye.org/host/search?query={0}\u0026page={1}\"\n\n#Zoomeye Headers\nheaders={\n\t\"Authorization\":\"JWT \"+access_token\n}\n```\n更多相关Zoomeye的使用方法和文档情操考zoomeye官方 \n[ZoomEye API 参考手册](https://www.zoomeye.org/api#parameters)\n\n**Will Do**\n\n- 添加其他的搜索引擎\n- 当数量比较庞大的时候引入多线程以及协程相关技术\n- 对扫描的数据进行存储\n- Celery分布式任务处理\n\n**说明**\n\n如果对您有帮助，您可以点右上角 Star 支持一下 谢谢！\n或者您可以follow一下\n\n**免责声明**\n\n本项目只做技术研究，切勿对其他网站和系统进行攻击，违法必究。\n\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftiaotiaolong%2FTTLScan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftiaotiaolong%2FTTLScan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftiaotiaolong%2FTTLScan/lists"}