Jie

What I have accomplished cannot be reversed

<p align="center"> <a href="https://github.com/yhy0/Jie/blob/main/LICENSE"> <img alt="Release" src="https://img.shields.io/github/license/yhy0/Jie"/> </a> <a href="https://github.com/yhy0/Jie"> <img alt="Release" src="https://img.shields.io/badge/release-v1.2.0-brightgreen"/> </a> <a href="https://github.com/yhy0/Jie"> <img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/yhy0/Jie?color=9cf"/> </a> <a href="https://github.com/yhy0/Jie"> <img alt="GitHub forks" src="https://img.shields.io/github/forks/yhy0/Jie"/> </a> <a href="https://github.com/yhy0/Jie"> <img alt="GitHub all release" src="https://img.shields.io/github/downloads/yhy0/Jie/total?color=blueviolet"/> </a> </p> <p align="center"> <a href="https://github.com/yhy0/Jie/blob/main/README.md">English</a> • <a href="https://github.com/yhy0/Jie/blob/main/README_CN.md">中文</a> • </p>

The English documentation was generated by GPT3.5

Analyze and scan traffic by using active crawler mode or passive proxy.

Please read the documentation carefully before using

Pre-requisites for use

nmap
masscan
chromium

You should check whether the above programs exist on your machine before using them

If you do not want to install nmap and masscan, you can use-nps to specify that port scanning will not be performed and turn off checking

Active Mode

Three built-in crawler modes are available:

| Mode | Corresponding Parameter | | :----------------------------------------------------------: | ----------------------- | | crawlergo Crawler (Headless browser mode crawler) | --craw c | | Default katana Crawler (Standard crawling mode using standard go http library to handle HTTP requests/responses) | --craw k | | katana Crawler (Headless browser mode crawler) | --craw kh |

When using headless mode, you can specify --show to display the crawling process of the browser.

In active mode, you can enter the Security Copilot mode by specifying --copilot, which will not exit after scanning, making it convenient to view the web results page.

./Jie web -t https://public-firing-range.appspot.com/ -p xss -o vulnerability_report.html --copilot

If the username and password for the web are not specified, a yhy/password will be automatically generated, which can be viewed in the logs. For example, the following is the automatically generated one:

INFO [cmd:webscan.go(glob):55] Security Copilot web report authorized:yhy/3TxSZw8t8w

Passive Mode (Security Copilot)

Passive proxy is implemented through go-mitmproxy.

Security Copilot

Why is it called Security Copilot? According to my idea, this is not just a vulnerability scanner, but also a comprehensive auxiliary tool.

After hanging the scanner, go through the website once. Even if there are no vulnerabilities, it should tell me the approximate information of this website (fingerprint, cdn, port information, sensitive information, API paths, subdomains, etc.), which helps in further exploration manually, assisting in vulnerability discovery, rather than just finishing the scan and considering it done, requiring manual reevaluation.

Certificate Download

HTTPS websites under passive proxy require installing certificates. The HTTPS certificate-related logic is compatible with mitmproxy,

and The certificate is automatically generated after the command is started for the first time, and the path is ~/.mitmproxy/mitmproxy-ca-cert.pem.

Install the root certificate. Installation steps can be found in the Python mitmproxy documentation: About Certificates.

Start

 ./Jie  web --listen :9081 --web 9088 --user yhy --pwd 123 --debug

This will listen on port 9081, and the web interface (SecurityCopilot) will be open on port 9088.

Set the browser's proxy to 9081, or integrate with Burp.

Basic Usage

Configuration

Some configurations can be modified through Jie_config.yaml, or through the configuration interface of http://127.0.0.1:9088/ (changes made in the web interface will be updated in the configuration file in real-time).

./Jie web -h

Flags:
      --copilot          Blocking program, go to the default port 9088 to view detailed scan information.
                         In active mode, specify this parameter to block the program. After scanning, the program will not exit, and you can view information on the web port.
  -h, --help             help for web
      --listen string    use proxy resource collector, value is proxy addr, (example: 127.0.0.1:9080).
                         Proxy address listened to in passive mode, default is 127.0.0.1:9080
      --np               not run plugin.
                         Disable all plugins
  -p, --plugin strings   Vulnerable Plugin, (example: --plugin xss,csrf,sql,dir ...)
                         Specify the enabled plugins. Specify 'all' to enable all plugins.
      --poc strings      specify the nuclei poc to run, separated by ','(example: test.yml,./test/*).
                         Custom nuclei vulnerability template address
      --pwd string       Security Copilot web report authorized pwd.
                         Web page login password. If not specified, a random password will be generated.
      --show             specifies whether to show the browser in headless mode.
                         Whether to display the browser in active scanning mode
      --user string      Security Copilot web report authorized user, (example: yhy).]
                         Web page login username, default is yhy (default "yhy")
      --web string       Security Copilot web report port, (example: 9088)].
                         Web page port, default is 9088 (default "9088")

Global Flags:
      --debug           debug
  -f, --file string     target file
  -o, --out string      output report file(eg:vulnerability_report.html)
      --proxy string    proxy, (example: --proxy http://127.0.0.1:8080)
  -t, --target string   target

Download and Compile

Download the corresponding program from https://github.com/yhy0/Jie/releases/latest. The entire process is built automatically by Github Action, so

feel free to use it.

Linux/Mac

Simply execute make to compile.

Windows

export CGO_ENABLED=1;go build -ldflags "-s -w" -o Jie main.go

Integration with Burp

Passive-scan-client Plugin (Strongly Recommended)

passive-scan-client

Freely select which scanner to use via three monitoring switches. Note: JavaScript and CSS should also go through the scanner to collect information.

Setting Upstream Proxy in Burp (Not Recommended)

The traffic of the Upstream Proxy Intruder and Repeater modules will also go through the scanner.

This will cause all traffic from manual testing to go through the scanner, which may not be ideal. This should be done as needed.

Features

The plugins internally judge whether they have been scanned based on the traffic collected passively or actively (TODO Should the scanning plugin be executed in a certain order?).

Information Gathering

Website fingerprint information
Aggregated display of URLs requested by each website
Website domain information: cdn/waf/cloud, resolution records
Jwt automatic blasting (todo generate dictionary automatically based on domain name)
Sensitive information
Active path scanning (bbscan rules, added a fingerprint field, when there is a fingerprint, only the corresponding rule will be scanned, for example, php websites will not scan springboot rules)
Port information
Collect domain names, IPs, APIs

Plugins

Some scans will recognize the language environment based on the collected fingerprint information to prevent invoking Java scanning plugins for PHP websites.

Directory Structure Scan

The scan directory is the scan plugin library, and each directory's plugin handles different situations.

PerFile: For each URL, including parameters, etc.
PerFolder: For the directory of the URL, the directory will be accessed separately
PerServer: For each domain, meaning a target is only scanned once

Jie

Install / Use

README

Jie