Skip to content

Commit 34d20e7

Browse files
authored
Merge pull request #36 from knownsec/dev
Dev
2 parents f010dce + 1451a41 commit 34d20e7

11 files changed

Lines changed: 785 additions & 356 deletions

File tree

CHANGELOG

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
55
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
66

77
## [Released]
8+
## [2.0.4.6] - 2021-04-09
9+
- support web search
10+
- add new CLI command ip [-h][-filter filed=regexp] ip
11+
812
## [2.0.4.2] - 2021-03-22
913
- add new CLI command history [-h] [-filter filed=regexp] [-force] [-num value] ip
1014
- add new CLI command clear [-h] [-setting] [-cache]

README.rst

Lines changed: 132 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -37,18 +37,20 @@ After successfully installing ``ZoomEye-python``, you can use the
3737
::
3838

3939
$ zoomeye -h
40-
usage: zoomeye [-h] {info,search,init,history,clear} ...
41-
40+
usage: zoomeye [-h] [-v] {info,search,init,ip,history,clear} ...
4241
positional arguments:
43-
{info,search,init,history,clear}
42+
{info,search,init,ip,history,clear}
4443
info Show ZoomEye account info
4544
search Search the ZoomEye database
4645
init Initialize the token for ZoomEye-python
46+
ip Query IP information
4747
history Query device history
4848
clear Manually clear the cache and user information
4949

5050
optional arguments:
5151
-h, --help show this help message and exit
52+
-v, --version show program's version number and exit
53+
5254

5355
1.initialize token
5456
^^^^^^^^^^^^^^^^^^
@@ -128,13 +130,14 @@ will explain and demonstrate below.
128130

129131
::
130132

131-
-num set the number of displays/searches
133+
-num set the number of displays/searches, support 'all'
132134
-count query the total amount of this dork in the ZoomEye database
133135
-facet query the distribution of the full data of the dork
134136
-stat the distribution of statistical data result sets
135137
-filter query the list of a certain area in the data result set, or filter according to the content
136138
-save the result set can be exported according to the filter conditions
137139
-force ignore the local cache and force the data to be obtained from the API
140+
-type select web or host search
138141

139142
4.number of data
140143
^^^^^^^^^^^^^^^^
@@ -166,13 +169,23 @@ two commands include:
166169

167170
::
168171

169-
app statistics by application type
170-
device statistics by device type
171-
service statistics by service type
172-
os statistics by operating system type
173-
port statistics by port
174-
country statistics by country
175-
city statistics by city
172+
# host searhc
173+
app statistics by application type
174+
device statistics by device type
175+
service statistics by service type
176+
os statistics by operating system type
177+
port statistics by port
178+
country statistics by country
179+
city statistics by city
180+
181+
# web search
182+
webapp statistics by Web application
183+
component statistics by Web container
184+
framework statistics by Web framework
185+
server statistics by Web server
186+
waf statistics by Web firewall(WAF)
187+
os statistics by operating system
188+
country statistics by country
176189

177190
use ``-facet`` to count the application types of all ``telnet`` devices:
178191

@@ -214,16 +227,35 @@ by this command include:
214227

215228
::
216229

217-
app show application type details
218-
version show version information details
219-
device show device type details
220-
port show port information details
221-
city show city details
222-
country show country details
223-
asn show as number details
224-
banner show details of characteristic response
225-
time show record data time
226-
* when this symbol is included, show all field details
230+
# host/search
231+
app show application type details
232+
version show version information details
233+
device show device type details
234+
port show port information details
235+
city show city details
236+
country show country details
237+
asn show as number details
238+
banner show details of characteristic response
239+
timestamp show record data time
240+
* when this symbol is included, show all field details
241+
242+
# web/search
243+
app show application type details
244+
headers HTTP header
245+
keywords meta keyword
246+
title HTTP Title information
247+
site site search
248+
city show city details
249+
country show country details
250+
webapp Web application
251+
component Web container
252+
framework Web framework
253+
server Web server
254+
waf Web firewall(WAF)
255+
os operating system
256+
timestamp updated timestamp
257+
* when this symbol is included, show all field details
258+
227259

228260
Compared to the omitted display by default, the complete data can be
229261
viewed through ``-filter``, as follows:
@@ -236,18 +268,21 @@ viewed through ``-filter``, as follows:
236268

237269
total: 1
238270

239-
in addition, you can also filter the data through ``-filter``, you can
240-
filter the fields according to keywords (regular expressions are
241-
supported), and the format is ``field=regexp``, for example, we query in
242-
``banner`` data containing the ``telnet`` keyword:
271+
When using ``-filter`` to filter, the syntax is: ``key1,key2,key3=value``, where ``key3=value`` is the filter condition, and the displayed content is ``key1,key2`` Example:
243272

244273
::
245274

246-
$ zoomeye search "telnet" -filter banner=telnet
247-
ip banner
248-
222.*.*.* \xff\xfb\x01\xff\xfb\x03\xff\xfd\x03TELNET session now in ESTABLISHED state\r\n\r\n
275+
$ zoomeye search telnet -num 1 -filter port,app,banner=Telnet
276+
277+
ip port app
278+
240e:*:*:*::3 23 LANDesk remote management
279+
280+
In the above example: ``banner=Telnet`` is the filter condition, and ``port,app`` is the displayed content. If you need to display ``banner``, the filter statement is like this
281+
282+
::
283+
284+
$ zoomeye search telnet -num 1 -filter port,app,banner,banner=Telnet
249285

250-
total: 1
251286

252287

253288
7.data export
@@ -321,7 +356,7 @@ By default, five fields are shown to users:
321356
::
322357

323358
1. time recorded time
324-
2. service open service
359+
2. service Open service
325360
3. port port
326361
4. app web application
327362
5. raw fingerprint information
@@ -374,7 +409,7 @@ The `-filter` parameter supports the filtering of the following five fields:
374409
2.port port information
375410
3.service open service
376411
4.app web application
377-
5.raw original fingerprint information
412+
5.banner original fingerprint information
378413
* when this symbol is included, show all field details
379414

380415

@@ -386,7 +421,71 @@ A display of the ``id`` field is added during the display. ``id`` is the serial
386421

387422
The user quota will also be consumed when using the ``history`` command. The user quota will be deducted for the number of pieces of data returned in the ``history`` command. For example: IP "8.8.8.8" has a total of ``944`` historical records, and the user quota of ``944`` is deducted for one query.
388423

389-
10.cleanup function
424+
10. search IP information
425+
^^^^^^^^^^^^^^^^^^^^^^^^^
426+
You can query the information of the specified IP through the ``zoomeye ip`` command, for example:
427+
428+
::
429+
430+
$ zoomeye ip 185.*.*.57
431+
185.*.*.57
432+
Hostnames: [unknown]
433+
Isp: [unknown]
434+
Country: Saudi Arabia
435+
City: [unknown]
436+
Organization: [unknown]
437+
Lastupdated: 2021-03-02T11:14:33
438+
Number of open ports: 4{2002, 9002, 123, 25}
439+
440+
port service app banner
441+
9002 telnet \xff\xfb\x01\xff\xfb\x0...
442+
123 ntp ntpd \x16\x82\x00\x01\x05\x0...
443+
2002 telnet Pocket CMD telnetd \xff\xfb\x01\xff\xfb\x0...
444+
25 smtp Cisco IOS NetWor... 220 10.1.10.2 Cisco Net...
445+
446+
447+
The ``zoomeye ip`` command also supports the filter parameter ``-filter``, and the syntax is the same as that of ``zoomeye search``. E.g:
448+
449+
::
450+
451+
$ zoomeye ip "185.*.*.57" -filter "app,app=ntpd"
452+
Hostnames: [unknown]
453+
Isp: [unknown]
454+
Country: Saudi Arabia
455+
City: [unknown]
456+
Organization: [unknown]
457+
Lastupdated: 2021-02-17T02:15:06
458+
Number of open ports: 0
459+
Number of historical probes: 1
460+
461+
app
462+
ntpd
463+
464+
The fields supported by the ``filter`` parameter are:
465+
466+
::
467+
468+
1.port port information
469+
2.service open service
470+
3.app web application
471+
4.banner original fingerprint information
472+
473+
474+
475+
..
476+
477+
Note: This function limits the number of queries per user per day based on different user levels.
478+
479+
Registered users and developers can query 10 times a day
480+
481+
Advanced users can query 20 times a day
482+
483+
VIP users can query 30 times a day
484+
485+
After the number of times per day is used up, it will be refreshed after 24 hours, that is, counting from the time of the first IP check, and the number of refreshes after 24 hours.
486+
487+
488+
11.cleanup function
390489
^^^^^^^^^^^^^^^^^^^^
391490

392491
Users search for a large amount of data every day, which causes the storage space occupied by the cache folder to gradually increase; if users use ``ZoomEye-python`` on a public server, it may cause their own ``API KEY`` and ``ACCESS TOKEN`` to leak .
@@ -600,14 +699,7 @@ data more conveniently and extract the specified data fields as follows:
600699
601700
| **4.Why may the total amount of data in ZoomEye-python and the browser
602701
search the same dork be different?**
603-
| ``ZoomEye`` provides two search interfaces: ``/host/search`` and
604-
``/web/search``. only ``/host/search`` is used in ``ZoomEye-python``.
605-
in most cases, the data provided by the host interface can cover more
606-
than 90% or even 100% of the data, so the accuracy of the data can be
607-
guaranteed. when the API makes a request, the user quota will be
608-
consumed. if the two interfaces are compatible if it does, it will
609-
consume more user quota; therefore, in the command line tool, only the
610-
``/host/search`` interface is used for searching.
702+
| ``ZoomEye`` provides two search interfaces: ``/host/search`` and ``/web/search``. In ``ZoomEye-python``, only ``/host/search`` is used by default, and ``/web/search`` is not used. Users can choose the search method according to their needs by specifying the ``type`` parameter.
611703
612704
.. figure:: https://raw.githubusercontent.com/knownsec/ZoomEye-python/master/images/image-20210111141028072.png
613705
:width: 500px

0 commit comments

Comments
 (0)