Skip to content

Commit

Permalink
docs: introduction to Flag-Filter usage
Browse files Browse the repository at this point in the history
  • Loading branch information
Li4n0 committed Mar 24, 2023
1 parent b76757d commit eee9c7b
Show file tree
Hide file tree
Showing 5 changed files with 19 additions and 7 deletions.
7 changes: 4 additions & 3 deletions CONFIG.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,10 @@ token: # Authentication Token, both the admin pag
domains: [] # The domain names used by the platform
external_ip: # The external IP of the platform, you need to make sure that the target you want to test can access the platform through this IP
admin_path_prefix: "/revsuit" # The http path prefix for the admin page, the page will be located at: /admin_path_prefix/admin
database: revsuit.db # Database connection information, support using Sqlite3, MySQL, Postgres
# database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local"
# Database connection information, support using MySQL, Postgres, Sqlite3
database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local"
# database: "postgres://host=127.0.0.1 user=root password=password dbname=revsuit port=5432 sslmode=disable TimeZone=Asia/Shanghai"
#database: revsuit.db # The use of sqlite databases on some systems may cause `SQLITE BUSY` problems in concurrent scenarios, so it is not recommended for use in a formal environment

log_level: info # Output log levels, divided into: debug, info, warning, error, fatal
check_upgrade: true # Whether to automatically check for updates
Expand Down Expand Up @@ -43,4 +44,4 @@ notice:
lark: https://open.feishu.cn/open-apis/bot/v2/hook/{token} # Webhook of Lark Bot
weixin: https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key={key} # Webhook of Weixin Bot
slack: https://hooks.slack.com/services/{id}/{token} # Webhook of Slack Bot
```
```
7 changes: 4 additions & 3 deletions CONFIG.zh-CN.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,10 @@ token: # 鉴权Token,管理页面和客户端
domains: [] # 反连平台绑定的域名
external_ip: # 反连平台的外部IP,需要确保你想测试的目标能通过该 IP 访问到平台
admin_path_prefix: "/revsuit" # 管理页面的 http path 前缀,管理页面将位于:/admin_path_prefix/admin
database: revsuit.db # 数据库连接信息 支持Sqlite3、MySQL、Postgres
# database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local"
# 数据库连接信息 支持MySQL、Postgres、SQLite3
database: "mysql://root:password@tcp(127.0.0.1:3306)/revsuit?charset=utf8mb4&parseTime=True&loc=Local"
# database: "postgres://host=127.0.0.1 user=root password=password dbname=revsuit port=5432 sslmode=disable TimeZone=Asia/Shanghai"
#database: revsuit.db # 在部分系统上使用 sqlite 数据库时,在并发场景下可能会出现 `SQLITE BUSY` 的问题,因此不推荐在正式环境中使用该类型数据库

log_level: info # 输出日志的级别,分为:debug、info、warning、error、fatal
check_upgrade: false # 是否自动检查更新
Expand Down Expand Up @@ -43,4 +44,4 @@ notice:
weixin: https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key={key} # 企业微信机器人webhook地址
slack: https://hooks.slack.com/services/{id}/{token} # slack机器人webhook地址

```
```
5 changes: 5 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,11 @@ example.
As shown above, RevSuit supports multiple clients, and each client **in the connected state** receives a push of `flag`,
so distributed scanning can be supported.

If you don't want every client to receive all `flag` pushes, you can use the `Flag-Filter` request header when creating an sse connection to set the format(regular expressions) of the `flag` you want that client to receive:

![img.png](./images/flag-filter.gif)


#### Temporary storage queue

RevSuit will store `flag` temporarily in the queue when there is no client connection and send it when the client
Expand Down
7 changes: 6 additions & 1 deletion README.zh-CN.md
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,11 @@ RevSuit

如上一节的图片里所展示的,RevSuit 支持多个客户端,每个在**连接状态**的客户端都会接收到 `flag` 的推送,因此分布式扫描也是支持的。

如果你不希望每个客户端都收到全部的 `flag` 推送,你可以在创建 sse 连接时,使用 `Flag-Filter` 请求头设置希望该客户端接受的 `flag` 的格式(支持正则表达式),例如:

![img.png](./images/flag-filter.gif)


#### 暂存队列

当没有客户端连接的时候,RevSuit 会把 `flag` 暂时存储到队列里,当有客户端连接的时候再进行推送。因此你不必担心因为客户端与 RevSuit 断开连接就错过漏洞。(这对发现延时触发的漏洞尤为有帮助)
Expand Down Expand Up @@ -225,4 +230,4 @@ payload,最后被扫描器发出的请求是:`['https://www.testvuln.com?url

## 开源许可协议

@Apache License 2.0
@Apache License 2.0
Binary file added images/flag-filter.gif
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit eee9c7b

Please sign in to comment.