如题，大量报 [reverse:server.go:178] server shutdown
或者是 request to http://www.xxxx.com/debug.txt failed, retrying (1 / 1)... 程序终止...
But，同样的网站和网络环境，换另一个工具扫，没问题，可以扫出来一些常规敏感文件。
IP也没有被拉黑，专门找了一个没有WAF的测试。
希望可以给出个可能的原因结果，个人猜测：

1. 有可能是程序设置的默认线程并发太高？将来是否可以手动设置线程数量 ？
2. 没有随机UA？
3. 线程之间设置随机延迟？将来也可以手动设置延迟？

RT

Could someone provide English docs for it?

这里的话，好像某些云还得配置允许监听非本机ip吧？
我这边报错。

查阅资料，有人说是因为监听了非本机ip，需要修改服务器配置。

是不是因为默认是直接监听的config的ip、而不是0.0.0.0？
建议如果配置公网，默认就0.0.0.0。
这两个在配置文件里也很好区分吧。（有无token）

扫描完结果非常多，希望加入按漏洞级别排序 方便使用者快速检查关注的漏洞

虽然别人链接这个端口扫描没啥用，但是还是怕别人提交一些乱七八糟的站扫描。

• mitm走一条线路代理，或者强制不走代理，即使设置了export http_proxy=*
• scan流量走另外一条代理，比如export http_proxy中定义的。过waf，防止被封等需求。

配置文件配置，或者命令参数，来区分。

建议添加 --poc-dir 来使用指定目录的所有 POC, 这个选项可以和 --poc 一起使用，取合集

OS：macOS 10.14.5
Broswer: FireFox 68.0
xary version: 0.5.1
使用被动扫描模式：./xray webscan --listen 127.0.0.1:8888 时报错后闪退

好像是并发较高导致的，Error log如下：

fatal error: concurrent map iteration and map write

goroutine 12128 [running]:
runtime.throw(0x187c820, 0x26)
/usr/local/go/src/runtime/panic.go:617 +0x72 fp=0xc001619d18 sp=0xc001619ce8 pc=0x102cdd2
runtime.mapiternext(0xc001619e40)
/usr/local/go/src/runtime/map.go:860 +0x597 fp=0xc001619da0 sp=0xc001619d18 pc=0x100eb77
assassin/http.(*Request).clone(0xc000e55ec0, 0xc0015e0901, 0xc001e49f40)
/builds/lohengrin/assassin/http/request.go:446 +0x3be fp=0xc001619f10 sp=0xc001619da0 pc=0x15c421e
assassin/http.(*Flow).DeepClone(0xc000fa3530, 0xc001b04450, 0x29e8d60800)
/builds/lohengrin/assassin/http/resource.go:35 +0x33 fp=0xc001619f38 sp=0xc001619f10 pc=0x15c8843
assassin/controller.(*unit).run.func1(0xc001c3b590, 0x1982940, 0xc000ec67c0, 0x1982840, 0xc000fa3530)
/builds/lohengrin/assassin/controller/controller.go:39 +0xcd fp=0xc001619fb8 sp=0xc001619f38 pc=0x161a9ed
runtime.goexit()
/usr/local/go/src/runtime/asm_amd64.s:1337 +0x1 fp=0xc001619fc0 sp=0xc001619fb8 pc=0x105be61
created by assassin/controller.(*unit).run
/builds/lohengrin/assassin/controller/controller.go:35 +0x138

goroutine 1 [select]:
assassin/utils.(*SizedWaitGroup).AddWithContext(0xc001c3b430, 0x1982940, 0xc000ec67c0, 0xc002379901, 0x1617e21)
/builds/lohengrin/assassin/utils/sync.go:34 +0xc5
assassin/controller.(*unit).run(0xc001c3b400, 0x1982940, 0xc000ec67c0, 0x1982840, 0xc000fa2180, 0x0, 0x0)
/builds/lohengrin/assassin/controller/controller.go:30 +0xc2
assassin/controller.(*SingleProcessController).Start(0xc002379c80, 0x1982940, 0xc000ec67c0, 0x10, 0x0)
/builds/lohengrin/assassin/controller/single.go:129 +0x1ef
assassin/cli.glob..func3(0xc000888120, 0x0, 0x0)
/builds/lohengrin/assassin/cli/webscan.go:177 +0x94e
gopkg.in/urfave/cli%2ev2.(*Command).Run(0xc001213560, 0xc001233710, 0x0, 0x0)
/go/pkg/mod/gopkg.in/urfave/[email protected]/command.go:167 +0x6c5
gopkg.in/urfave/cli%2ev2.(*App).Run(0xc00126c000, 0xc0000ae000, 0x4, 0x4, 0x0, 0x0)
/go/pkg/mod/gopkg.in/urfave/[email protected]/app.go:261 +0x661
main.main()
/builds/lohengrin/assassin/main.go:132 +0x21f

goroutine 18 [chan receive]:
github.com/panjf2000/ants.(*Pool).periodicallyPurge(0xc0001e0150)
/go/pkg/mod/github.com/panjf2000/[email protected]/pool.go:71 +0x212
created by github.com/panjf2000/ants.NewTimingPool
/go/pkg/mod/github.com/panjf2000/[email protected]/pool.go:116 +0xc5

goroutine 49 [syscall, 2 minutes]:
os/signal.signal_recv(0x0)
/usr/local/go/src/runtime/sigqueue.go:139 +0x9f
os/signal.loop()
/usr/local/go/src/os/signal/signal_unix.go:23 +0x22
created by os/signal.init.0
/usr/local/go/src/os/signal/signal_unix.go:29 +0x41

goroutine 81 [chan receive, 2 minutes]:
assassin/cli/ctx.WithSignal.func1(0xc0013363f0, 0xc001804120)
/builds/lohengrin/assassin/cli/ctx/ctx.go:44 +0xee
created by assassin/cli/ctx.WithSignal
/builds/lohengrin/assassin/cli/ctx/ctx.go:39 +0x1b0

goroutine 10 [select]:
assassin/collector.(*mitmProxy).FitOut.func1(0x1982940, 0xc000ec67c0, 0xc0018ea4e0)
/builds/lohengrin/assassin/collector/mitm.go:126 +0xe3
created by assassin/collector.(*mitmProxy).FitOut
/builds/lohengrin/assassin/collector/mitm.go:122 +0x8f

goroutine 83 [IO wait, 2 minutes]:
internal/poll.runtime_pollWait(0x277aba0, 0x72, 0x0)
/usr/local/go/src/runtime/netpoll.go:182 +0x56
internal/poll.(*pollDesc).wait(0xc00109c118, 0x72, 0x0, 0x0, 0x1862f2d)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:87 +0x9b
internal/poll.(*pollDesc).waitRead(...)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:92
internal/poll.(*FD).Accept(0xc00109c100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
/usr/local/go/src/internal/poll/fd_unix.go:384 +0x1ba
net.(*netFD).accept(0xc00109c100, 0x17ec1c0, 0x50, 0xc000f22000)
/usr/local/go/src/net/fd_unix.go:238 +0x42
net.(*TCPListener).accept(0xc0001ee030, 0xc001358000, 0x224a6d0, 0x0)
/usr/local/go/src/net/tcpsock_posix.go:139 +0x32
net.(*TCPListener).AcceptTCP(0xc0001ee030, 0x100c0a8, 0x30, 0x17ec1c0)
/usr/local/go/src/net/tcpsock.go:247 +0x48
net/http.tcpKeepAliveListener.Accept(0xc0001ee030, 0x17ec1c0, 0xc000888330, 0x1764be0, 0x20231d0)
/usr/local/go/src/net/http/server.go:3264 +0x2f
net/http.(*Server).Serve(0xc00009a410, 0x1981380, 0xc0001ee030, 0x0, 0x0)
/usr/local/go/src/net/http/server.go:2859 +0x22d
net/http.(*Server).ListenAndServe(0xc00009a410, 0x187120d, 0x17)
/usr/local/go/src/net/http/server.go:2797 +0xe4
assassin/reverse.(*Server).Start.func1(0xc001329f40)
/builds/lohengrin/assassin/reverse/server.go:152 +0x69
created by assassin/reverse.(*Server).Start
/builds/lohengrin/assassin/reverse/server.go:150 +0x4d

goroutine 84 [chan receive, 2 minutes]:
assassin/reverse.(*Server).Start.func2(0x1982940, 0xc000ec67c0, 0xc001329f40)
/builds/lohengrin/assassin/reverse/server.go:160 +0x48
created by assassin/reverse.(*Server).Start
/builds/lohengrin/assassin/reverse/server.go:159 +0x83

goroutine 41 [chan receive]:
github.com/panjf2000/ants.(*Pool).periodicallyPurge(0xc0012640e0)
/go/pkg/mod/github.com/panjf2000/[email protected]/pool.go:71 +0x212
created by github.com/panjf2000/ants.NewTimingPool
/go/pkg/mod/github.com/panjf2000/[email protected]/pool.go:116 +0xc5

goroutine 42 [IO wait]:
internal/poll.runtime_pollWait(0x277ac70, 0x72, 0x0)
/usr/local/go/src/runtime/netpoll.go:182 +0x56
internal/poll.(*pollDesc).wait(0xc000ef2098, 0x72, 0x0, 0x0, 0x1862f2d)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:87 +0x9b
internal/poll.(*pollDesc).waitRead(...)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:92
internal/poll.(*FD).Accept(0xc000ef2080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
/usr/local/go/src/internal/poll/fd_unix.go:384 +0x1ba
net.(*netFD).accept(0xc000ef2080, 0xc00138ad70, 0xc09bc6b8a0, 0x2053820)
/usr/local/go/src/net/fd_unix.go:238 +0x42
net.(*TCPListener).accept(0xc000eda038, 0x1ab79bc6b8a0, 0x100000001, 0xc00138adb0)
/usr/local/go/src/net/tcpsock_posix.go:139 +0x32
net.(*TCPListener).AcceptTCP(0xc000eda038, 0xc00138add8, 0x10b4ea6, 0x5d232056)
/usr/local/go/src/net/tcpsock.go:247 +0x48
net/http.tcpKeepAliveListener.Accept(0xc000eda038, 0xc00138ae28, 0x18, 0xc0013f2600, 0x136f734)
/usr/local/go/src/net/http/server.go:3264 +0x2f
net/http.(*Server).Serve(0xc00009a9c0, 0x1981380, 0xc000eda038, 0x0, 0x0)
/usr/local/go/src/net/http/server.go:2859 +0x22d
net/http.(*Server).ListenAndServe(0xc00009a9c0, 0x1873222, 0x1a)
/usr/local/go/src/net/http/server.go:2797 +0xe4
assassin/collector.(*mitmProxy).FitOut.func3(0xc001254ab0, 0xc00009a9c0, 0xc001367560, 0xc0018ea4e0)
/builds/lohengrin/assassin/collector/mitm.go:235 +0xac
created by assassin/collector.(*mitmProxy).FitOut
/builds/lohengrin/assassin/collector/mitm.go:233 +0xebb

goroutine 43 [chan receive, 2 minutes]:
assassin/collector.(*mitmProxy).FitOut.func4(0x1982940, 0xc000ec67c0, 0xc00009a9c0, 0xc0012640e0, 0xc001367560, 0xc0018ea4e0)
/builds/lohengrin/assassin/collector/mitm.go:243 +0x4c
created by assassin/collector.(*mitmProxy).FitOut
/builds/lohengrin/assassin/collector/mitm.go:242 +0xf21

goroutine 9820 [IO wait]:
internal/poll.runtime_pollWait(0x51400d8, 0x72, 0xffffffffffffffff)
/usr/local/go/src/runtime/netpoll.go:182 +0x56
internal/poll.(*pollDesc).wait(0xc002286398, 0x72, 0x1600, 0x16a3, 0xffffffffffffffff)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:87 +0x9b
internal/poll.(*pollDesc).waitRead(...)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:92
internal/poll.(*FD).Read(0xc002286380, 0xc001606000, 0x16a3, 0x16a3, 0x0, 0x0, 0x0)
/usr/local/go/src/internal/poll/fd_unix.go:169 +0x1f2
net.(*netFD).Read(0xc002286380, 0xc001606000, 0x16a3, 0x16a3, 0x203000, 0x0, 0x1696)
/usr/local/go/src/net/fd_unix.go:202 +0x4f
net.(*conn).Read(0xc00000e080, 0xc001606000, 0x16a3, 0x16a3, 0x0, 0x0, 0x0)
/usr/local/go/src/net/net.go:177 +0x69
crypto/tls.(*atLeastReader).Read(0xc0021509a0, 0xc001606000, 0x16a3, 0x16a3, 0x100b819, 0xc0019caf30, 0xc001c628f0)
/usr/local/go/src/crypto/tls/conn.go:761 +0x60
bytes.(*Buffer).ReadFrom(0xc0016b13d8, 0x1970f20, 0xc0021509a0, 0x1009875, 0x177de40, 0x182c920)
/usr/local/go/src/bytes/buffer.go:207 +0xbd
crypto/tls.(*Conn).readFromUntil(0xc0016b1180, 0x1972200, 0xc00000e080, 0x5, 0xc00000e080, 0xc001c62a10)
/usr/local/go/src/crypto/tls/conn.go:783 +0xf8
crypto/tls.(*Conn).readRecordOrCCS(0xc0016b1180, 0x189a300, 0xc0016b12b8, 0xc000e9d440)
/usr/local/go/src/crypto/tls/conn.go:590 +0x125
crypto/tls.(*Conn).readRecord(...)
/usr/local/go/src/crypto/tls/conn.go:558
crypto/tls.(*Conn).Read(0xc0016b1180, 0xc0015d2000, 0x1000, 0x1000, 0x0, 0x0, 0x0)
/usr/local/go/src/crypto/tls/conn.go:1236 +0x137
net/http.(*persistConn).Read(0xc000eee5a0, 0xc0015d2000, 0x1000, 0x1000, 0xc001c62c88, 0x1004ae5, 0xc00202ba40)
/usr/local/go/src/net/http/transport.go:1524 +0x7b
bufio.(*Reader).fill(0xc001841a40)
/usr/local/go/src/bufio/bufio.go:100 +0x10f
bufio.(*Reader).Peek(0xc001841a40, 0x1, 0x0, 0x0, 0x1, 0xc001920d00, 0x0)
/usr/local/go/src/bufio/bufio.go:138 +0x4f
net/http.(*persistConn).readLoop(0xc000eee5a0)
/usr/local/go/src/net/http/transport.go:1677 +0x1a3
created by net/http.(*Transport).dialConn
/usr/local/go/src/net/http/transport.go:1357 +0xae8

goroutine 12127 [runnable]:
assassin/http.CloneHeader(0xc001136ea0, 0xc0011f5680)
/builds/lohengrin/assassin/http/utils.go:47 +0xb1
assassin/http.(*Request).clone(0xc000e55ec0, 0x0, 0x0)
/builds/lohengrin/assassin/http/request.go:432 +0xf3
assassin/http.(*Request).Mutate(0xc000e55ec0, 0xc000ee6bd0, 0x0)
/builds/lohengrin/assassin/http/request.go:578 +0x54
assassin/plugins/crlf_injection.(*CRLFInjection).HandleFlow(0x2052100, 0x19829c0, 0xc002354000, 0x1982840, 0xc000fa3530, 0xc002354001, 0xc000e55ec0)
/builds/lohengrin/assassin/plugins/crlf_injection/crlf_injection.go:99 +0x3bb
assassin/controller.(*unit).run.func1(0xc001c3b400, 0x1982940, 0xc000ec67c0, 0x1982840, 0xc000fa3530)
/builds/lohengrin/assassin/controller/controller.go:39 +0x105
created by assassin/controller.(*unit).run
/builds/lohengrin/assassin/controller/controller.go:35 +0x138

goroutine 2726 [IO wait]:
internal/poll.runtime_pollWait(0x277a380, 0x72, 0xffffffffffffffff)
/usr/local/go/src/runtime/netpoll.go:182 +0x56
internal/poll.(*pollDesc).wait(0xc001b80f18, 0x72, 0x1000, 0x1000, 0xffffffffffffffff)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:87 +0x9b
internal/poll.(*pollDesc).waitRead(...)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:92
internal/poll.(*FD).Read(0xc001b80f00, 0xc001067000, 0x1000, 0x1000, 0x0, 0x0, 0x0)
/usr/local/go/src/internal/poll/fd_unix.go:169 +0x1f2
net.(*netFD).Read(0xc001b80f00, 0xc001067000, 0x1000, 0x1000, 0xc000042500, 0xc000fabc40, 0x1364e9a)
/usr/local/go/src/net/fd_unix.go:202 +0x4f
net.(*conn).Read(0xc000f863a0, 0xc001067000, 0x1000, 0x1000, 0x0, 0x0, 0x0)
/usr/local/go/src/net/net.go:177 +0x69
net/http.(*connReader).Read(0xc001bfb320, 0xc001067000, 0x1000, 0x1000, 0x27b54015a2, 0x2052280, 0x72)
/usr/local/go/src/net/http/server.go:787 +0x107
bufio.(*Reader).fill(0xc001f89a40)
/usr/local/go/src/bufio/bufio.go:100 +0x10f
bufio.(*Reader).Peek(0xc001f89a40, 0x4, 0x27b54015a2, 0x2052280, 0x0, 0x0, 0x2052280)
/usr/local/go/src/bufio/bufio.go:138 +0x4f
net/http.(*conn).serve(0xc0020a9040, 0x1982940, 0xc00195a480)
/usr/local/go/src/net/http/server.go:1903 +0x9bf
created by net/http.(*Server).Serve
/usr/local/go/src/net/http/server.go:2884 +0x2f4

goroutine 11734 [IO wait]:
internal/poll.runtime_pollWait(0x5140278, 0x72, 0xffffffffffffffff)
/usr/local/go/src/runtime/netpoll.go:182 +0x56
internal/poll.(*pollDesc).wait(0xc002402818, 0x72, 0x1600, 0x165b, 0xffffffffffffffff)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:87 +0x9b
internal/poll.(*pollDesc).waitRead(...)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:92
internal/poll.(*FD).Read(0xc002402800, 0xc0014e0000, 0x165b, 0x165b, 0x0, 0x0, 0x0)
/usr/local/go/src/internal/poll/fd_unix.go:169 +0x1f2
net.(*netFD).Read(0xc002402800, 0xc0014e0000, 0x165b, 0x165b, 0x203000, 0x0, 0x164e)
/usr/local/go/src/net/fd_unix.go:202 +0x4f
net.(*conn).Read(0xc001df63d8, 0xc0014e0000, 0x165b, 0x165b, 0x0, 0x0, 0x0)
/usr/local/go/src/net/net.go:177 +0x69
crypto/tls.(*atLeastReader).Read(0xc001f34260, 0xc0014e0000, 0x165b, 0x165b, 0x100b819, 0xc0019cb920, 0xc00138b8f0)
/usr/local/go/src/crypto/tls/conn.go:761 +0x60
bytes.(*Buffer).ReadFrom(0xc001f91758, 0x1970f20, 0xc001f34260, 0x1009875, 0x177de40, 0x182c920)
/usr/local/go/src/bytes/buffer.go:207 +0xbd
crypto/tls.(*Conn).readFromUntil(0xc001f91500, 0x1972200, 0xc001df63d8, 0x5, 0xc001df63d8, 0xc00138ba10)
/usr/local/go/src/crypto/tls/conn.go:783 +0xf8
crypto/tls.(*Conn).readRecordOrCCS(0xc001f91500, 0x189a300, 0xc001f91638, 0xc000e9d440)
/usr/local/go/src/crypto/tls/conn.go:590 +0x125
crypto/tls.(*Conn).readRecord(...)
/usr/local/go/src/crypto/tls/conn.go:558
crypto/tls.(*Conn).Read(0xc001f91500, 0xc0019ed000, 0x1000, 0x1000, 0x0, 0x0, 0x0)
/usr/local/go/src/crypto/tls/conn.go:1236 +0x137
net/http.(*persistConn).Read(0xc001afa5a0, 0xc0019ed000, 0x1000, 0x1000, 0xc00138bc88, 0x1004ae5, 0xc001e44cc0)
/usr/local/go/src/net/http/transport.go:1524 +0x7b
bufio.(*Reader).fill(0xc001a81d40)
/usr/local/go/src/bufio/bufio.go:100 +0x10f
bufio.(*Reader).Peek(0xc001a81d40, 0x1, 0x0, 0x0, 0x1, 0xc001bfc300, 0x0)
/usr/local/go/src/bufio/bufio.go:138 +0x4f
net/http.(*persistConn).readLoop(0xc001afa5a0)
/usr/local/go/src/net/http/transport.go:1677 +0x1a3
created by net/http.(*Transport).dialConn
/usr/local/go/src/net/http/transport.go:1357 +0xae8

goroutine 11731 [select]:
net/http.(*persistConn).writeLoop(0xc001b785a0)
/usr/local/go/src/net/http/transport.go:1976 +0x113
created by net/http.(*Transport).dialConn
/usr/local/go/src/net/http/transport.go:1358 +0xb0d

goroutine 11730 [IO wait]:
internal/poll.runtime_pollWait(0x5140c38, 0x72, 0xffffffffffffffff)
/usr/local/go/src/runtime/netpoll.go:182 +0x56
internal/poll.(*pollDesc).wait(0xc00204a418, 0x72, 0x1600, 0x165b, 0xffffffffffffffff)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:87 +0x9b
internal/poll.(*pollDesc).waitRead(...)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:92
internal/poll.(*FD).Read(0xc00204a400, 0xc001607800, 0x165b, 0x165b, 0x0, 0x0, 0x0)
/usr/local/go/src/internal/poll/fd_unix.go:169 +0x1f2
net.(*netFD).Read(0xc00204a400, 0xc001607800, 0x165b, 0x165b, 0x203000, 0x0, 0x164e)
/usr/local/go/src/net/fd_unix.go:202 +0x4f
net.(*conn).Read(0xc0000a8018, 0xc001607800, 0x165b, 0x165b, 0x0, 0x0, 0x0)
/usr/local/go/src/net/net.go:177 +0x69
crypto/tls.(*atLeastReader).Read(0xc002150b40, 0xc001607800, 0x165b, 0x165b, 0x100b819, 0xc0019cbaa0, 0xc0017c78f0)
/usr/local/go/src/crypto/tls/conn.go:761 +0x60
bytes.(*Buffer).ReadFrom(0xc001f91058, 0x1970f20, 0xc002150b40, 0x1009875, 0x177de40, 0x182c920)
/usr/local/go/src/bytes/buffer.go:207 +0xbd
crypto/tls.(*Conn).readFromUntil(0xc001f90e00, 0x1972200, 0xc0000a8018, 0x5, 0xc0000a8018, 0xc0017c7a10)
/usr/local/go/src/crypto/tls/conn.go:783 +0xf8
crypto/tls.(*Conn).readRecordOrCCS(0xc001f90e00, 0x189a300, 0xc001f90f38, 0xc000e9d440)
/usr/local/go/src/crypto/tls/conn.go:590 +0x125
crypto/tls.(*Conn).readRecord(...)
/usr/local/go/src/crypto/tls/conn.go:558
crypto/tls.(*Conn).Read(0xc001f90e00, 0xc001775000, 0x1000, 0x1000, 0x0, 0x0, 0x0)
/usr/local/go/src/crypto/tls/conn.go:1236 +0x137
net/http.(*persistConn).Read(0xc001b785a0, 0xc001775000, 0x1000, 0x1000, 0xc0017c7c88, 0x1004ae5, 0xc001e44960)
/usr/local/go/src/net/http/transport.go:1524 +0x7b
bufio.(*Reader).fill(0xc001a81620)
/usr/local/go/src/bufio/bufio.go:100 +0x10f
bufio.(*Reader).Peek(0xc001a81620, 0x1, 0x0, 0x0, 0x1, 0xc0018bfe00, 0x0)
/usr/local/go/src/bufio/bufio.go:138 +0x4f
net/http.(*persistConn).readLoop(0xc001b785a0)
/usr/local/go/src/net/http/transport.go:1677 +0x1a3
created by net/http.(*Transport).dialConn
/usr/local/go/src/net/http/transport.go:1357 +0xae8

goroutine 12126 [runnable]:
sort.Slice(0x1719c40, 0xc002150c20, 0xc0011db5d0)
/usr/local/go/src/sort/slice.go:17 +0x176
net/http/cookiejar.(*Jar).cookies(0xc000093bc0, 0xc00201a680, 0xbf40e5f6cb1ac600, 0x22b9806779, 0x2052280, 0x0, 0x0, 0x0)
/usr/local/go/src/net/http/cookiejar/jar.go:209 +0x785
net/http/cookiejar.(*Jar).Cookies(0xc000093bc0, 0xc00201a680, 0x1043602, 0xc0000a81b8, 0x0)
/usr/local/go/src/net/http/cookiejar/jar.go:155 +0x57
net/http.(*Client).send(0xc000093b60, 0xc001e18400, 0x0, 0x0, 0x0, 0xc0000a81b8, 0x0, 0x1, 0x158b62f)
/usr/local/go/src/net/http/client.go:170 +0x51
net/http.(*Client).do(0xc000093b60, 0xc001e18400, 0x0, 0x0, 0x0)
/usr/local/go/src/net/http/client.go:641 +0x279
net/http.(*Client).Do(...)
/usr/local/go/src/net/http/client.go:509
assassin/http.(*Client).doWithRetries(0xc001832480, 0xc001e18400, 0x1, 0xc0011dbc00, 0x2, 0x2, 0x0)
/builds/lohengrin/assassin/http/client.go:142 +0x56b
assassin/http.(*Client).respond(0xc001832480, 0x19829c0, 0xc00215a060, 0xc001b0a840, 0x1, 0x0, 0x8, 0x8)
/builds/lohengrin/assassin/http/client.go:194 +0x28b
assassin/http.(*Client).Respond(...)
/builds/lohengrin/assassin/http/client.go:211
assassin/plugins/dirscan.(*Dirscan).request404(0x2052340, 0x19829c0, 0xc00215a060, 0xc001b0a780, 0xa, 0xc001b0a780, 0x0)
/builds/lohengrin/assassin/plugins/dirscan/dirscan.go:110 +0x12f
assassin/plugins/dirscan.(*Dirscan).HandleFlow(0x2052340, 0x19829c0, 0xc00215a060, 0x1982840, 0xc000fa3530, 0xc00215a001, 0xc001b0a6c0)
/builds/lohengrin/assassin/plugins/dirscan/dirscan.go:206 +0x12e
assassin/controller.(*unit).run.func1(0xc000ff3040, 0x1982940, 0xc000ec67c0, 0x1982840, 0xc000fa3530)
/builds/lohengrin/assassin/controller/controller.go:39 +0x105
created by assassin/controller.(*unit).run
/builds/lohengrin/assassin/controller/controller.go:35 +0x138

goroutine 2727 [IO wait]:
internal/poll.runtime_pollWait(0x5105ea0, 0x72, 0xffffffffffffffff)
/usr/local/go/src/runtime/netpoll.go:182 +0x56
internal/poll.(*pollDesc).wait(0xc002286818, 0x72, 0x1000, 0x1000, 0xffffffffffffffff)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:87 +0x9b
internal/poll.(*pollDesc).waitRead(...)
/usr/local/go/src/internal/poll/fd_poll_runtime.go:92
internal/poll.(*FD).Read(0xc002286800, 0xc001194000, 0x1000, 0x1000, 0x0, 0x0, 0x0)
/usr/local/go/src/internal/poll/fd_unix.go:169 +0x1f2
net.(*netFD).Read(0xc002286800, 0xc001194000, 0x1000, 0x1000, 0xc001a50c40, 0x137e8b6, 0xc000e9d440)
/usr/local/go/src/net/fd_unix.go:202 +0x4f
net.(*conn).Read(0xc0001ee230, 0xc001194000, 0x1000, 0x1000, 0x0, 0x0, 0x0)
/usr/local/go/src/net/net.go:177 +0x69
net/http.(*persistConn).Read(0xc001010360, 0xc001194000, 0x1000, 0x1000, 0xc001a50c88, 0x1004ae5, 0xc001ae8c60)
/usr/local/go/src/net/http/transport.go:1524 +0x7b
bufio.(*Reader).fill(0xc000f85800)
/usr/local/go/src/bufio/bufio.go:100 +0x10f
bufio.(*Reader).Peek(0xc000f85800, 0x1, 0x0, 0x0, 0x1, 0xc000090400, 0x0)
/usr/local/go/src/bufio/bufio.go:138 +0x4f
net/http.(*persistConn).readLoop(0xc001010360)
/usr/local/go/src/net/http/transport.go:1677 +0x1a3
created by net/http.(*Transport).dialConn
/usr/local/go/src/net/http/transport.go:1357 +0xae8

goroutine 9821 [select]:
net/http.(*persistConn).writeLoop(0xc000eee5a0)
/usr/local/go/src/net/http/transport.go:1976 +0x113
created by net/http.(*Transport).dialConn
/usr/local/go/src/net/http/transport.go:1358 +0xb0d

goroutine 2728 [select]:
net/http.(*persistConn).writeLoop(0xc001010360)
/usr/local/go/src/net/http/transport.go:1976 +0x113
created by net/http.(*Transport).dialConn
/usr/local/go/src/net/http/transport.go:1358 +0xb0d

goroutine 11735 [select]:
net/http.(*persistConn).writeLoop(0xc001afa5a0)
/usr/local/go/src/net/http/transport.go:1976 +0x113
created by net/http.(*Transport).dialConn
/usr/local/go/src/net/http/transport.go:1358 +0xb0d

https://portswigger.net/web-security/request-smuggling
https://portswigger.net/web-security/request-smuggling/finding
https://portswigger.net/web-security/request-smuggling/exploiting

如果添加这种cms识别的话，识别出cms后，列出历史漏洞的cve编号。

includes: # 允许扫描的域
- "*.example.com"

可以配置多个子域名么？

(.*?).(a|b).example.com

• test.a.example.com
• test.b.example.com

(.*?).(example1|example2).com

• test.example1.com
• test.example2.com

由于有些老设备配置不高，可能用的还是32位linux系统，建议版本发布时像windows一样，也同时发布32位与64位的版本。

建议增强Referer支持：
在使用yaml自定义poc时，支持referer以target(目标url）+自定义uri。

配置文件config.yaml中，设置允许扫描的域的时候，发现如果设置域的时候是带端口号的话（例如这种：- "10.17.65.135:1289/*"），以代理模式开启xray后，挂了一下午没什么反应。希望白名单扫描域中增加带端口号的识别，满足测试带端口号的URL的需求

请问能支持域名列表批量扫描吗？

被动扫描能否支持这样的场景：会员业务 taodao.com/user 商品业务taodao.com/item，可能安全测试时仅仅想针对商品业务进行测试，希望被动扫描只针对taodao.com/item下的url进行扫描

当前的被动扫描似乎只能控制到域名级别

目前对于主动扫描一个网站的情况不太友好

比如，清洗好的流量，走mitm给xray喂数据时，可以动态控制扫描规则sqli,xxe,ssrf.

比如可以在headers，cookie，url参数上附加，进行动态规则控制.

//mitm添加headers
Scan_Type: ssrf,sqli,lfi 
//Cookies上
Scan_Type=ssrf,sqli,lfi;

最终实现，看到参数中有url，就仅测试ssrf。判断参数中有"Sort=desc", 就仅测试sqli

另外，遇到这些附加的头，接收后，一定要删掉！

和普通的base64稍微有些区别的

类似以下的效果

 curl --resolve ip.cn:443:1.1.1.1  https://ip.cn -H 'Host: ip.cn' -v --connect-timeout 5

走mitm时，ssl/sni hostname，是ip.cn, 强制绑定到1.1.1.1.
比如内网测试环境绑host的场景, 也有跨国分运营商走edns智能解析的场景。
也比如找到了源站ip, 就可以绕waf了。

建议增加POST请求时对data数据的分块传输功能：
1、在config配置中可以设置POST请求时对data数据的分块传输功能开关。
2、在config配置中可以设置分块传输的分块长度或块数范围。
3、分块传输时分块长度后自动加上混淆字符串。

之前提到的从指定目录加载 PoC （#41 ）在命令行端已经实现了，感谢大佬们。

现在的情况是在配置文件中以 glob 的形式指定 PoC 无法加载。

配置如下：

  phantasm:
    enabled: true
    poc:
    #- poc-yaml-drupal-drupalgeddon2-rce
    #- poc-yaml-joomla-cve-2015-7297-sqli
    #- poc-yaml-joomla-cve-2017-8917-sqli
    #- poc-yaml-thinkphp5-controller-rce
    #- poc-yaml-thinkphp5023-method-rce
    #- poc-go-tomcat-put
    - E:\xray\poc\*

运行结果：

可以看到从命令行指定--poc是可以的，但是配置文件中的配置未生效，希望这两部分可以同步，感谢。

建议添加一个sql注入的配置文件，里面可以使用自定义payload，因为每一个人对SQL语句认识不同，有的人使用的payload可能比较特殊。
还有就是写死payload的话如果目标存在SQL注入，但是存在waf，像这样传统的'and ''='或 and 1=1这种方式是没办法发现的。这时候需要自定义payload更为有效去发现SQL注入。

用来验证一些blind attack攻击。

我来举个例子
/xray_linux_amd64 webscan --plugins dirscan --url https://api.su.baidu.com/

我的想法是这样的哈。我这边有一堆爬好的url链接存在数据库 有method url data字段 想用这个批量测试。

请问下如果是自写poc的话，在代理模式下，这个path是否可以是请求的uri？比如检测fastjson或者xxe

0x00 json输出格式问题

json能一行一行输出么？现在的--json-output是json展开了，并且开始是[,每个json连接有个,,如果监控json文件结果，不好处理，查看结果，jq 也不好查看.
如果一行一个json，不用展开就是最好滴.

0x01 headers问题

现在只能预制1个header，在mitm原始流量和xray扫描流量容易混合了。在后面的nginx lua上不好做规则。mitm和scan流量能分别设置headers么。这样就容易区分了。
所以，建议config.yml中2处headers自定义配置. mitm的，扫描的.

0x02 webhook功能

扫描成功后，带上原始json，向指定url发送一个post请求，那就是最好滴.

0x03 reverse功能

是否后期可能对接dnslog平台呢？
或者对齐下格式，dnslog平台异步打个请求回来。

0x04 http代理问题

能否兼容下proxychains(ng)等工具的http代理. (换个代理库可能就好了. 比如v2ray-core之类的兼容性好)
比如proxychains4 python soft.py把流量导入xray

更新比较快，希望加上新版本检测功能，及时通知大家更新

举个例子

./xray_linux_amd64  webscan  --plugins sqldet --url "http://xxxx.qq.com/qunvideo/hall.html?_bid=2227&_wv=5127&from=tuijian_more"

`fatal error: concurrent map iteration and map write

goroutine 23989 [running]:
runtime.throw(0xd01b83, 0x26)
/usr/local/go/src/runtime/panic.go:617 +0x79 fp=0xc001a79d18 sp=0xc001a79ce8 pc=0x4308e9
runtime.mapiternext(0xc001a79e40)
/usr/local/go/src/runtime/map.go:860 +0x59e fp=0xc001a79da0 sp=0xc001a79d18 pc=0x40f61e
assassin/http.(*Request).clone(0xc0015b52c0, 0xc001f12001, 0xc001a79f40)
/builds/lohengrin/assassin/http/request.go:446 +0x212 fp=0xc001a79f10 sp=0xc001a79da0 pc=0x9f9812
assassin/http.(*Flow).DeepClone(0xc00117fda0, 0xc000ef2090, 0x29e8d60800)
/builds/lohengrin/assassin/http/resource.go:29 +0x3a fp=0xc001a79f38 sp=0xc001a79f10 pc=0x9fdfca
assassin/controller.(*unit).run.func1(0xc001118690, 0xe11540, 0xc000fe0c00, 0xe11480, 0xc00117fda0)
/builds/lohengrin/assassin/controller/controller.go:40 +0xd4 fp=0xc001a79fb8 sp=0xc001a79f38 pc=0xaef514
runtime.goexit()
/usr/local/go/src/runtime/asm_amd64.s:1337 +0x1 fp=0xc001a79fc0 sp=0xc001a79fb8 pc=0x45de71
created by assassin/controller.(*unit).run
/builds/lohengrin/assassin/controller/controller.go:36 +0x13f`

win64下在使用多线程的时候报错

 xray_windows_amd64.exe
[ERRO] 2019-07-04 20:25:50 +0800 [phantasm:yaml.go:219] poc \plugins\phantasm\pocs\yaml\drupal-drupal7geddon2-rce.yml doesn't exist
[FTAL] 2019-07-04 20:25:50 +0800 [phantasm:yaml.go:48] file does not exist

已在微信群反馈，辛苦辛苦~

加一些预判断来减少一些特殊情况的误报。

在 mitm 的配置部分还有两项配置值得注意：

includes表示只扫描哪些域。比如 *.example.com 只扫描 example.com 的子域
excludes 表示不扫描哪些域。比如 t.example.com 表示不扫描 t.example.com

建议支持 --includes xxx.com --excludes sss.com

像sqlmap中可以直接使用请求的 request 文件

建议配置文件可以增加一个网站编程语言的配置选项可以是dirscan发出的请求更有针对性，如果一个php写的网站发一些x.jsp x.asp x.aspx的请求不仅没用还增加了服务器的响应压力。（除了文件后缀不同的编程语言写的网站目录都还有一些其他的特征，针对不同的语言可以使用不同的字典最好）

目前自定义 PoC 使用--poc来调用，虽然可以通过逗号分隔加载多个，但当自定义 PoC 较多时还是不太友好，建议增加自定义 PoC 目录这一选项，方便用户批量调用。

Thx

• 使用被动扫描的时候，tagets pending in queue打印这些信息的时候，可不可打印出更多的信息，比如targets。
• 可不可以打印出扫描的进度

输出结果时能不能不依赖文件，直接在 stdout 里输出 json 格式的结果

选择输出到文件时最后才一次性写入，中途没法看漏洞详情，标准输出里的信息太简略，有点难受

可以把漏洞结果放在最后面，或者直接在最后面做一个总结，在命令行中很容易被滚掉