From ef2c3474fe9fbbc3ab67767fd358a06b71f3ae27 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=85=AC=E6=98=8E?= <83812544+Ed1s0nZ@users.noreply.github.com> Date: Mon, 20 Jul 2026 16:54:50 +0800 Subject: [PATCH] Add files via upload --- README.md | 2 +- README_CN.md | 2 +- config.example.yaml | 15 ++++++++++++--- docs/en-US/asset-management.md | 17 +++++++++-------- docs/en-US/rbac.md | 3 ++- docs/zh-CN/asset-management.md | 17 +++++++++-------- docs/zh-CN/rbac.md | 4 +++- 7 files changed, 37 insertions(+), 23 deletions(-) diff --git a/README.md b/README.md index 2d4cb37c..7ce42f97 100644 --- a/README.md +++ b/README.md @@ -169,7 +169,7 @@ CyberStrikeAI ships with 100+ curated tools covering the whole kill chain: - **Web & App Scanners** – sqlmap, nikto, dirb, gobuster, feroxbuster, ffuf, httpx - **Vulnerability Scanners** – nuclei, wpscan, wafw00f, dalfox, xsser - **Subdomain Enumeration** – subfinder, amass, findomain, dnsenum, fierce -- **Network Space Search Engines** – fofa_search, zoomeye_search +- **Network Space Search Engines** – fofa_search, zoomeye_search, quake_search, shodan_search - **API Security** – graphql-scanner, arjun, api-fuzzer, api-schema-analyzer - **Container Security** – trivy, clair, docker-bench-security, kube-bench, kube-hunter - **Cloud Security** – prowler, scout-suite, cloudmapper, pacu, terrascan, checkov diff --git a/README_CN.md b/README_CN.md index 0b5a94a7..b126e079 100644 --- a/README_CN.md +++ b/README_CN.md @@ -168,7 +168,7 @@ CyberStrikeAI 将规划、执行、人工监督、证据与复盘连接在同一 - **Web 应用扫描**：sqlmap、nikto、dirb、gobuster、feroxbuster、ffuf、httpx - **漏洞扫描**：nuclei、wpscan、wafw00f、dalfox、xsser - **子域名枚举**：subfinder、amass、findomain、dnsenum、fierce -- **网络空间搜索引擎**：fofa_search、zoomeye_search +- **网络空间搜索引擎**：fofa_search、zoomeye_search、quake_search、shodan_search - **API 安全**：graphql-scanner、arjun、api-fuzzer、api-schema-analyzer - **容器安全**：trivy、clair、docker-bench-security、kube-bench、kube-hunter - **云安全**：prowler、scout-suite、cloudmapper、pacu、terrascan、checkov diff --git a/config.example.yaml b/config.example.yaml index eaf99e48..2fee41a5 100644 --- a/config.example.yaml +++ b/config.example.yaml @@ -86,13 +86,22 @@ vision: detail: auto # low | high | auto（Eino ImageURLDetail） timeout_seconds: 60 # ============================================ -# 资产管理（FOFA）配置（可选） +# 资产管理（网络空间测绘搜索）配置（可选） # ============================================ -# 用于「资产管理 → 信息收集」页面调用 FOFA API（后端代理，避免前端暴露 key） -# 也可通过环境变量配置：FOFA_API_KEY（优先级更高） +# 用于「资产管理 → 信息收集」页面调用 FOFA / ZoomEye / Quake / Shodan API +# 后端代理请求，避免前端暴露 key；环境变量优先级更高 fofa: base_url: https://fofa.info/api/v1/search/all # 可选，留空则使用默认 api_key: "" # FOFA API Key（可选，建议在系统设置中填写） +zoomeye: + base_url: https://api.zoomeye.org/v2/search # 可选，留空则使用默认 + api_key: "" # ZoomEye API Key；也可通过 ZOOMEYE_API_KEY 环境变量配置 +quake: + base_url: https://quake.360.cn/api/v3/search/quake_service # 可选，留空则使用默认 + api_key: "" # Quake API Token；也可通过 QUAKE_API_KEY 环境变量配置 +shodan: + base_url: https://api.shodan.io # 可选，留空则使用默认 + api_key: "" # Shodan API Key；也可通过 SHODAN_API_KEY 环境变量配置 # Agent 配置 # 达到最大迭代次数时，AI 会自动总结测试结果 agent: diff --git a/docs/en-US/asset-management.md b/docs/en-US/asset-management.md index 3f8d9f89..86e1dec2 100644 --- a/docs/en-US/asset-management.md +++ b/docs/en-US/asset-management.md @@ -2,7 +2,7 @@ [中文](../zh-CN/asset-management.md) -Asset management consolidates domains, IP addresses, ports, and services discovered through manual entry, FOFA, HTTP APIs, and Agent tasks into a maintainable baseline. It answers three questions: what assets exist, which assets have been assessed, and where risk is concentrated. +Asset management consolidates domains, IP addresses, ports, and services discovered through manual entry, network-space search engines, HTTP APIs, and Agent tasks into a maintainable baseline. It answers three questions: what assets exist, which assets have been assessed, and where risk is concentrated. > This feature is designed for security testing and attack-surface governance. It is not a replacement for a full enterprise CMDB. Add and scan only systems you own or are explicitly authorized to test. @@ -12,7 +12,7 @@ Asset management provides three main views: - **Overview**: asset totals, IPs, domains, ports, recent changes, scan coverage, and protocol distribution. - **Asset inventory**: identity, service details, source, tags, project ownership, responsibility and business metadata, scan history, and risk state. -- **Reconnaissance**: search FOFA and save confirmed results individually or in batches. +- **Reconnaissance**: search FOFA, ZoomEye, Quake, or Shodan and save confirmed results individually or in batches. Assets can launch single-target analysis or batch scans. After an Agent records findings and completes the scan callback, the inventory displays related vulnerability counts, risk level, and latest scan time. @@ -95,13 +95,14 @@ Limits and behavior: - Bulk import requires `asset:write`. Referenced projects must also be accessible to the current user. - Do not remove the server-side row limit. Split larger datasets and import them during a low-traffic window. -### Import from FOFA +### Import from network-space search -1. Configure the FOFA API key in the configuration file or under **System Settings → Asset Management**. You can also use the `FOFA_API_KEY` environment variable. +1. Configure the relevant API key in the configuration file or under **System Settings → Asset Management**. Environment variables are also supported: `FOFA_API_KEY`, `ZOOMEYE_API_KEY`, `QUAKE_API_KEY`, and `SHODAN_API_KEY`. 2. Open **Asset Management → Reconnaissance**. -3. Enter or generate a FOFA query and confirm its scope. -4. Run the query, select results whose ownership has been verified, and choose **Save Selected**. -5. Review the created, updated, and skipped counts. +3. Select the data source: FOFA, ZoomEye, Quake, or Shodan. +4. Enter or generate a query for that source and confirm its scope. +5. Run the query, select results whose ownership has been verified, and choose **Save Selected**. +6. Review the created, updated, and skipped counts. Internet search results are not automatically your assets. Narrow the query with organization domains, certificates, network ranges, or product fingerprints, then verify authorization before saving results. @@ -225,7 +226,7 @@ Asset batch endpoint limits: 1. Define an explicitly authorized set of domains, IP addresses, or network ranges. 2. Add a few critical targets manually and verify normalization and deduplication. 3. Use tags to separate production, testing, critical-business, and internet-facing scopes. -4. Configure FOFA, begin with narrow queries, and verify ownership. +4. Configure one or more network-space search engines, begin with narrow queries, and verify ownership. 5. Test scanning and vulnerability callbacks on one low-risk target. 6. Use never-scanned and over-30-day filters to identify coverage gaps. 7. After validating the workflow, expand gradually with small batch tasks. diff --git a/docs/en-US/rbac.md b/docs/en-US/rbac.md index a9fb1ace..9526bc75 100644 --- a/docs/en-US/rbac.md +++ b/docs/en-US/rbac.md @@ -87,7 +87,7 @@ Permissions use `module:action`. Common actions are `read`, `write`, `delete`, a | Robots | `robot:read`, `robot:write` | | Files | `files:read`, `files:write`, `files:delete` | | Attack chain | `attackchain:read`, `attackchain:write` | -| FOFA | `fofa:execute` | +| Network-space search / Reconnaissance | `fofa:execute` | | OpenAPI | `openapi:read` | | Chat groups | `group:read`, `group:write`, `group:delete` | | Monitor | `monitor:read`, `monitor:write`, `monitor:delete` | @@ -98,6 +98,7 @@ Important distinctions: - `agent:local-execute` is the local execution fallback and should be limited to trusted operators. - `mcp:execute` protects the authenticated MCP HTTP entry point. - `mcp:external:execute` allows Agent calls to external MCP tools and currently also requires `all` scope. +- `fofa:execute` is kept for backward compatibility, but it now protects the Reconnaissance page for FOFA, ZoomEye, Quake, and Shodan searches. - `mcp:write` manages external MCP configuration; it is separate from external tool execution. - `robot:write` manages robot configuration and the test endpoint. Chatbot conversations use the bound user or configured service account's business permissions. diff --git a/docs/zh-CN/asset-management.md b/docs/zh-CN/asset-management.md index 5f87d9d0..03817e07 100644 --- a/docs/zh-CN/asset-management.md +++ b/docs/zh-CN/asset-management.md @@ -2,7 +2,7 @@ [English](../en-US/asset-management.md) -资产管理用于将手工录入、FOFA、HTTP API 和 Agent 任务中发现的域名、IP、端口与服务统一归档，形成可持续维护的资产基线。它关注三个问题：当前拥有哪些资产、哪些资产已经检查、风险集中在哪里。 +资产管理用于将手工录入、网络空间测绘搜索、HTTP API 和 Agent 任务中发现的域名、IP、端口与服务统一归档，形成可持续维护的资产基线。它关注三个问题：当前拥有哪些资产、哪些资产已经检查、风险集中在哪里。 > 资产管理面向安全测试和攻击面治理，不替代完整的企业 CMDB。仅可录入和扫描自有系统或已获得明确授权的目标。 @@ -12,7 +12,7 @@ - **资产概览**：统计资产总量、IP、域名、端口、近期变化、扫描覆盖率和协议分布。 - **资产库**：维护资产身份、服务信息、来源、标签、项目归属、责任与业务属性、扫描记录和风险状态。 -- **信息收集**：查询 FOFA，并将确认归属的结果单条或批量写入资产库。 +- **信息收集**：查询 FOFA、ZoomEye、Quake 或 Shodan，并将确认归属的结果单条或批量写入资产库。 资产可以进一步发起单目标分析或批量扫描。Agent 保存漏洞并完成扫描回写后，资产列表会同步展示相关漏洞数量、风险等级和最近扫描时间。 @@ -95,13 +95,14 @@ example.com - 批量导入需要 `asset:write` 权限。填写项目时，当前用户还必须有权访问该项目。 - 不建议取消服务端条数上限。更大规模的数据应拆分文件并在低峰期导入。 -### 从 FOFA 导入 +### 从网络空间测绘搜索导入 -1. 在配置文件或 **系统设置 → 资产管理** 中填写 FOFA API Key，也可使用 `FOFA_API_KEY` 环境变量。 +1. 在配置文件或 **系统设置 → 资产管理** 中填写对应 API Key，也可使用环境变量：`FOFA_API_KEY`、`ZOOMEYE_API_KEY`、`QUAKE_API_KEY`、`SHODAN_API_KEY`。 2. 进入 **资产管理 → 信息收集**。 -3. 输入或生成 FOFA 查询语句，并确认查询范围。 -4. 执行查询，选择确认归属的结果后点击 **入库所选**。 -5. 根据返回的新增、更新和跳过数量检查导入结果。 +3. 选择数据源：FOFA、ZoomEye、Quake 或 Shodan。 +4. 输入或生成该数据源的查询语句，并确认查询范围。 +5. 执行查询，选择确认归属的结果后点击 **入库所选**。 +6. 根据返回的新增、更新和跳过数量检查导入结果。 外部搜索结果不等同于自有资产。建议先通过组织域名、证书、网段或产品指纹缩小范围，确认授权后再入库。 @@ -225,7 +226,7 @@ HTTP API 和 `query_assets` 还支持 `max_vulnerabilities`、最近扫描时间 1. 划定一组明确授权的域名、IP 或网段。 2. 手工加入少量核心目标，验证识别和去重结果。 3. 使用标签区分生产、测试、核心业务和外网范围。 -4. 配置 FOFA，从窄查询开始并确认资产归属。 +4. 配置一个或多个网络空间测绘搜索引擎，从窄查询开始并确认资产归属。 5. 对单个低风险目标测试扫描和漏洞回写流程。 6. 使用“从未扫描”和“超过 30 天未扫描”筛选覆盖盲区。 7. 确认流程稳定后，再逐步创建小规模批量任务。 diff --git a/docs/zh-CN/rbac.md b/docs/zh-CN/rbac.md index 0887fd38..46709afa 100644 --- a/docs/zh-CN/rbac.md +++ b/docs/zh-CN/rbac.md @@ -94,13 +94,15 @@ AI 测试角色不是安全授权边界。即使选择了“渗透测试”角 | 机器人 | `robot:read`、`robot:write` | | 文件 | `files:read`、`files:write`、`files:delete` | | 攻击链 | `attackchain:read`、`attackchain:write` | -| FOFA | `fofa:execute` | +| 网络空间测绘 / 信息收集 | `fofa:execute` | | OpenAPI | `openapi:read` | | 对话分组 | `group:read`、`group:write`、`group:delete` | | 执行监控 | `monitor:read`、`monitor:write`、`monitor:delete` | 特殊权限说明： +- `fofa:execute` 为兼容旧版本保留权限名，现在保护 **信息收集** 页中的 FOFA、ZoomEye、Quake、Shodan 查询。 + - `agent:execute` 允许运行 Agent，但不自动允许本地文件系统、Shell 或任意配置命令。 - `agent:local-execute` 是本地执行兜底权限，应仅授予可信操作员。 - `mcp:execute` 用于访问认证后的 MCP HTTP 入口。