114 Commits

Author SHA1 Message Date
jor 64017d1b44 Merge pull request #142 from hsmoying/master
fix  dahua snapshot
2026-10-13 07:44:26 +08:00
hsmoying 2e766ce234 fix dahua snapshot
fix(dahua): restore independent requests for DigestAuth snapshot

Ingram-master 新版引入 self.session 持久会话以复用 keep-alive,
但 Dahua 设备 HTTP Server 存在奇葩行为:有 cookie 时忽略
Authorization header。

根因:
  verify() 用 self.session.post(RPC2_Login) → session 内部残留 cookie
  exploit() 用同一 self.session.get(snapshot, auth=DigestAuth)
  → 大华设备优先看无效 cookie → 忽略 Digest Auth → 401 无快照

修复:
  1. 3 个 Dahua RPC2_Login POC 的 verify() 回退为独立 requests.post
  2. base._snapshot() 有 auth 时用独立 requests.get,无 auth 保留 session

fix(dahua): restore independent requests for DigestAuth snapshot

Ingram-master introduced self.session to reuse TCP connections via
keep-alive, but Dahua HTTP servers ignore Authorization headers
when a cookie is present.

Root cause:
  verify() posts RPC2_Login via self.session → cookie leaks into session
  exploit() reuses same session for DigestAuth snapshot request
  → server sees stale cookie → ignores Digest Auth → returns 401

Fix:
  1. 3 Dahua RPC2_Login POCs use independent requests.post for verify()
  2. base._snapshot() uses independent requests.get when auth is present,
     keeps self.session for auth-less requests (preserves keep-alive)
2026-10-13 05:22:54 +08:00
jor 8dee6bd909 Merge pull request #139 from fff122/fix/gevent-queue-conflict
fix: resolve gevent LoopExit and AssertionError crashes
2026-08-19 13:04:43 +08:00
fff122 0c4953f4e3 fix: resolve gevent LoopExit and AssertionError crashes
monkey.patch_all(thread=False) still patches the queue module, which
replaces queue.SimpleQueue used internally by ThreadPoolExecutor with
a gevent queue. Worker threads in ThreadPoolExecutor have no gevent
hub, causing LoopExit ("This operation would block forever") and
AssertionError ("Can only use Waiter.switch method from the Hub
greenlet") exceptions during scanning.

Adding queue=False preserves the standard queue for ThreadPoolExecutor
while keeping gevent's socket/ssl patching for cooperative I/O.
2026-08-19 12:41:03 +08:00
jor 166cd29f32 nothing
Updated README.md to remove deprecated sections and add new content.
2026-05-20 18:06:29 +08:00
jor afdb9a0182 Merge pull request #138 from Haoke98/master
refactor(core): 优化 IP 生成器以修复内存溢出隐患
2026-05-13 19:11:45 +08:00
Sadam·Sadik a3aa80773e refactor(core): Optimize the concurrency mechanism of port scanning, refine the concurrency granularity of coroutines to the IP:Port level, and enhance scanning speed
- Refactor the serial port scanning logic of the `_scan` method in `core.py`.
- Extract the `_scan_port` method to handle the logic for a single port, and within the `_scan` function, utilize `gevent.spawn` and `gevent.joinall` to implement concurrent scanning of multiple ports on the target IP using coroutines.
- Address the significant time-consuming bottleneck caused by serial waiting of multiple ports during target packet loss.
2026-05-13 13:16:04 +08:00
Sadam·Sadik ccabd1ec74 refactor(poc): Introduce requests.Session to enhance the efficiency of batch HTTP requests
- Initialize `requests.Session()` in the `POCTemplate` base class and configure `Connection: keep-alive`
- Replace all `requests.get` and `requests.post` calls in the `pocs/` directory with Session-based requests
- The explicitly declared `Connection: close` header in each POC has been removed, allowing for the reuse of underlying TCP connections and significantly reducing handshake latency during batch scanning.
2026-05-13 13:12:52 +08:00
Sadam·Sadik 10aef974ad refactor(core): Optimize the IP generator to fix the memory overflow issue
- Modify the `get_all_ip` function in `utils/net.py` from returning a complete list to using a `yield` generator, to prevent Out-Of-MemoryError (OOM) when scanning large network segments (such as /8 or /16).
- In the `_generate_ip` function in `data.py`, which is responsible for restoring the scanning state, `itertools.islice` is introduced to replace the unsupported generator slicing operation, ensuring correct skipping logic during the resumption of scanning for large network segments.
2026-05-13 13:01:11 +08:00
BlackHaoke 0dd750dd72 Merge branch 'jorhelp:master' into master 2026-05-13 12:16:47 +08:00
jor b501c63f1b Merge pull request #137 from fff122/fix/gevent-loopexit-and-no-resume
Fix gevent LoopExit crash and add --no-resume option
2026-05-05 23:26:22 +08:00
fff122 9285a2e4b3 Fix gevent LoopExit crash and add --no-resume option
- Fix gevent.exceptions.LoopExit in SnapshotPipeline.process() by
  adding timeout to queue.get() and catching exceptions, preventing
  the thread from crashing when the gevent hub has no pending events
- Add --no-resume CLI flag to start a fresh scan instead of resuming
  from a previous interrupted scan, addressing the need to clear
  scan cache

Closes #118, Closes #135
2026-05-05 23:09:42 +08:00
jorhelp c8ae840181 add axis and nuuo webcam 2025-07-07 22:33:22 +08:00
jorhelp c5258e0d2c add an uniview rule 2024-11-20 00:26:06 +08:00
root 79bb320ecd add xiongmai bypass poc 2024-10-30 23:58:40 +08:00
root 60daff84d5 fix avtech, add xiongmai weakpass 2024-10-30 00:24:44 +08:00
jor be124d7c2f add AVTech weak passwork 2024-10-29 01:01:39 +08:00
jor 82d022c153 add reecam weak passwork 2024-08-10 02:25:54 +08:00
jor f633945e1a Merge pull request #83 from andyco2008/master
Update run_ingram.py
2024-03-17 15:30:40 +08:00
andyco2008 04e831cb7c Update run_ingram.py
小小改动。
2024-03-17 15:03:57 +08:00
Sadam·Sadik e06abce4b2 Update README.md 2024-01-23 23:09:02 +08:00
Sadam·Sadik 75e2aa0c7d Update README.md
增加了开发计划
2024-01-23 22:41:17 +08:00
Sadam·Sadik 1d1c78adba Merge branch 'jorhelp:master' into master 2024-01-22 22:14:16 +08:00
jor 6bbbe2c6ae masscan 的引号标错了位置 2023-09-19 22:12:24 +08:00
jor d7eb4427a1 add some new device 2023-09-19 21:50:51 +08:00
Sadam·Sadik cbfc7f5954 Merge branch 'jorhelp:master' into master 2023-05-19 13:40:27 +08:00
jorhelp 84d17945ab readme file merge conflict v2.0.0 2023-03-13 10:17:25 +08:00
jor 71093ef5db Merge pull request #49 from avikowy/master
Merge pull request #49 from avikowy/master
2023-03-13 09:54:23 +08:00
avikowy 8ea8ad3394 Merge branch 'master' into master 2023-03-12 14:54:15 -04:00
Sadam·Sadik 1f26160805 Merge remote-tracking branch 'origin/master' 2022-12-23 23:29:12 +08:00
Sadam·Sadik 076322cb01 Implemented the method that can generate the targets.txt automatically by the area code. 2022-12-23 23:28:34 +08:00
jorhelp f681e99474 not vulnerable 2022-12-15 19:16:54 +08:00
jorhelp 2f09a9aaf2 Redundant code 2022-12-15 18:42:34 +08:00
jor 8ae9757f86 Merge pull request #42 from jorhelp/dev
Dev
2022-12-15 17:55:01 +08:00
jorhelp 6cbb5c2f35 修复requests不关闭的错误,添加英文 readme 2022-12-15 17:53:57 +08:00
jorhelp 1fe534c452 修复requests不关闭的错误,添加英文 readme 2022-12-15 17:52:16 +08:00
jorhelp 042eaeea4b Merge branch 'master' into dev 2022-12-15 16:36:40 +08:00
jorhelp 251b10641d stash 2022-12-15 16:33:14 +08:00
jor 07ae16cd5e Merge pull request #39 from Haoke98/master
Fixed the BUG(OSError: [Errno 25] Inappropriate ioctl for device) tha…
2022-12-10 19:23:22 +08:00
Sadam·Sadik e963da457a Fixed the BUG(OSError: [Errno 25] Inappropriate ioctl for device) that has been occurred when use this script on background via nohup. 2022-12-10 19:15:04 +08:00
avikowy 630f7354ec Update README.md 2022-11-04 18:00:16 +01:00
avikowy 9993233c68 Update README.md 2022-11-04 15:42:08 +01:00
avikowy 8302f78278 Update README.md 2022-11-04 15:40:06 +01:00
avikowy a49fa008ef Update README.md 2022-11-04 15:39:17 +01:00
avikowy 92c1f309e2 Update weak_passwd.py 2022-11-04 15:35:05 +01:00
avikowy ec03fab43c Update __init__.py 2022-11-04 15:32:05 +01:00
avikowy 06f0b468a0 Update config.py 2022-11-04 15:30:17 +01:00
jorhelp 7bac1004cb logo错位 2022-08-27 17:20:24 +08:00
jor d04a1030f4 Merge pull request #20 from jorhelp/dev
解决中断恢复耗时的问题
2022-08-27 16:43:10 +08:00
jorhelp 93832dbc6a 解决中断恢复耗时的问题 2022-08-27 16:40:18 +08:00