Skip to content

Conversation

@jlkl
Copy link

@jlkl jlkl commented Oct 31, 2025

No description provided.

@cn-kali-team
Copy link
Collaborator

规则里默认就是忽略大小写,or匹配的,字符串有没有单引号括起来都是一样,新添加的有测试地址吗

@jlkl
Copy link
Author

jlkl commented Oct 31, 2025

大小写这个是改了吗,我看README里写的是

case-insensitive | bool | 是否忽略大小写,默认为false

bladex.yaml 47.111.103.162:8088
saber.yaml 61.182.120.54:18999
springboot-manager.yaml 39.101.186.48:8088
yishaadmin.yaml 47.92.133.10:8091

@cn-kali-team
Copy link
Collaborator

指纹在提交之后会格式化,会自动转小写和忽略大小写,把这个特殊路径删除了吧

 - method: GET
    path:
      - '{{BaseURL}}/api'
    matchers:
      - type: word
        words:
          - "No handler found for GET /"
          - "No endpoint GET /."
          - "Failed to handle request"
        condition: or
        part: body
        case-insensitive: true
  - method: GET
    path:
      - '{{BaseURL}}/gateway'
    matchers:
      - type: word
        words:
          - "No handler found for GET /"
          - "No endpoint GET /."
          - "Failed to handle request"
        condition: or
        part: body
        case-insensitive: 

而且这几个关键词太常见了,其他网站也会有这些关键词,就会导致其他网站被识别为bladex
words:
- "-auth/oauth/token"
- "Failed to handle request"
- "No handler found for GET /"
condition: or
如果不能确定,可以使用obserser_ward -t 47.111.103.162:8088 --debug 测试一下

@jlkl
Copy link
Author

jlkl commented Oct 31, 2025

指纹在提交之后会格式化,会自动转小写和忽略大小写,把这个特殊路径删除了吧

 - method: GET
    path:
      - '{{BaseURL}}/api'
    matchers:
      - type: word
        words:
          - "No handler found for GET /"
          - "No endpoint GET /."
          - "Failed to handle request"
        condition: or
        part: body
        case-insensitive: true
  - method: GET
    path:
      - '{{BaseURL}}/gateway'
    matchers:
      - type: word
        words:
          - "No handler found for GET /"
          - "No endpoint GET /."
          - "Failed to handle request"
        condition: or
        part: body
        case-insensitive: 

而且这几个关键词太常见了,其他网站也会有这些关键词,就会导致其他网站被识别为bladex words: - "-auth/oauth/token" - "Failed to handle request" - "No handler found for GET /" condition: or 如果不能确定,可以使用obserser_ward -t 47.111.103.162:8088 --debug 测试一下

不会的,是这个框架的特征,我优化处理过了的。路径的问题是因为有些站访问根路径特征出不来,/api和/gateway才会带特征

@jlkl
Copy link
Author

jlkl commented Oct 31, 2025

/路径可能为前端或者后端的api接口,/api和/gateway是后端api接口。/的我把前端后端的识别都加上了,/api和/gateway考虑了版本的差异

@cn-kali-team
Copy link
Collaborator

cn-kali-team commented Oct 31, 2025

你没懂我的意思,你访问一下 https://fofa.info/result?qbase64=RmFpbGVkIHRvIGhhbmRsZSByZXF1ZXN0
这里的任意一个网站都能识别成bladex,这个指纹当然能识别47.111.103.162:8088,但是还要考虑其他不是bladex的网站也会命中这个关键词,导致误报识别成bladex。

@jlkl
Copy link
Author

jlkl commented Oct 31, 2025

你没懂我的意思,你访问一下 https://fofa.info/result?qbase64=RmFpbGVkIHRvIGhhbmRsZSByZXF1ZXN0 这里的任意一个网站都能识别成bladex,这个指纹当然能识别47.111.103.162:8088,但是还要考虑其他不是bladex的网站也会命中这个关键词,导致误报识别成bladex。

考虑过的,正常springboot的是长这样,没有命中规则
{
"timestamp": "2023-10-31T12:34:56.789+00:00",
"status": 404,
"error": "Not Found",
"path": "/api/non-existent-endpoint"
}
之前也看了下数量的,9k还好吧,误报能够接受,可以删除这个规则

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants