连接及基本信息

默认安装环境下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
root@ubuntu:/opt/xunfeng/xunfengdb/bin# ./mongo mongodb://127.0.0.1:65521/xunfeng
MongoDB shell version v3.4.0
connecting to: mongodb://127.0.0.1:65521/xunfeng
MongoDB server version: 3.4.0
> db.auth('scan','scanlol66')
1
> show collections
Config
Heartbeat
History
Info
Plugin
Result
Statistics
Task
Update

资产相关表

根据巡风代码,主要是Info表

https://github.com/ysrc/xunfeng/blob/master/nascan/lib/scan.py

1
2
3
mongo.NA_INFO.insert({"ip": self.ip, "port": self.port,“hostname": hostname, "banner": banner, "time": time_})

mongo.NA_INFO.update({'ip': self.ip, 'port': self.port},{"$set": {'banner': self.banner, 'server': 'web', 'webinfo': web_info,'time': time_}})

以一条具体数据为例:

1
2
3
db.Info.find()

{ "_id" : ObjectId("id信息"), "ip" : "ip_address", "hostname" : "hostname_miao", "time" : ISODate("2019-03-06T02:49:18.268Z"), "banner" : "banner 信息", "port" : 2333, "webinfo" : { "tag" : [ "php","apache"], "title" : "Error 404 Not Found" }, "server" : "web" }

在巡风web界面大概是这样

ip,port,hostname,banner等顾名思义

server:web

webinfo中php,apache

打码的蓝色信息为webinfo中title

可以获取下Info中的key:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
mr = db.runCommand({ "mapreduce" : "Info", "map" : function() { for (var key in this) { emit(key, null); } }, "reduce" : function(key, stuff) { return null; },  "out": "Info" + "_keys" })
{
"result" : "Info_keys",
"timeMillis" : 112,
"counts" : {
"input" : 1209,
"emit" : 8707,
"reduce" : 102,
"output" : 8
},
"ok" : 1
}

> db.Info_keys.distinct("_id")
[
"_id",
"banner",
"hostname",
"ip",
"port",
"server",
"time",
"webinfo"
]

可以看到主要就这些信息

因此如果认为巡风自身资产探测不完善,需要手工导入资产信息,既可以按照这种格式构造数据进行导入