`))
tmpl.Execute(w, map[string]interface{}{
"Hosts": hosts,
"FilterListening": r.URL.Query().Get("listening"),
"FilterBanner": r.URL.Query().Get("banner"),
})
}
func telnetDetail(w http.ResponseWriter, r *http.Request) {
ip := strings.TrimPrefix(r.URL.Path, "/telnet/")
row := db.QueryRow("SELECT Ip, fullbanner FROM telnetbanners WHERE Ip=?", ip)
var ipAddr, banner string
row.Scan(&ipAddr, &banner)
tmpl := template.Must(template.New("telnetDetail").Parse(`
Telnet Host {{.Ip}}` + css + `
Telnet Host {{.Ip}}
{{.Banner}}
`))
tmpl.Execute(w, map[string]interface{}{
"Ip": ipAddr,
"Banner": banner,
})
}
const css = ``
// Admin panel handler
func adminPanel(w http.ResponseWriter, r *http.Request) {
fmt.Printf("admin login from %s, X-real-IP header: %s\n", r.RemoteAddr, r.Header.Get("X-Real-IP"))
if r.Method == http.MethodPost {
// Delete IP
if ip := r.FormValue("delete_ip"); ip != "" {
_, err := db.Exec("DELETE FROM httpbanners WHERE Ip = ?", ip)
fmt.Println("[admin panel] deleting IP: ", ip)
if err != nil {
http.Error(w, "Error deleting IP: "+err.Error(), http.StatusInternalServerError)
return
}
}
// Add excluded title
if title := r.FormValue("add_title"); title != "" {
f, err := os.OpenFile("excluded_titles.txt", os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
if err != nil {
http.Error(w, "Error writing title: "+err.Error(), http.StatusInternalServerError)
return
}
defer f.Close()
f.WriteString(title + "\n")
}
if remove := r.FormValue("remove_title"); remove != "" {
data, err := os.ReadFile("excluded_titles.txt")
if err == nil {
lines := strings.Split(strings.TrimSpace(string(data)), "\n")
var newLines []string
for _, l := range lines {
if strings.TrimSpace(l) != remove {
newLines = append(newLines, l)
}
}
os.WriteFile("excluded_titles.txt", []byte(strings.Join(newLines, "\n")+"\n"), 0644)
}
}
}
var titles []string
if data, err := os.ReadFile("excluded_titles.txt"); err == nil {
titles = strings.Split(strings.TrimSpace(string(data)), "\n")
}
tmpl := template.Must(template.New("admin").Parse(`
Admin Panel` + css + `
Admin Panel
Current Excluded Titles
{{range .}}
{{.}}
{{end}}
`))
tmpl.Execute(w, titles)
}
func buildExclusionSQL(filename string) string {
data, _ := os.ReadFile(filename)
lines := strings.Split(strings.TrimSpace(string(data)), "\n")
var parts []string
for _, l := range lines {
l = strings.TrimSpace(l)
if l == "" {
continue
}
parts = append(parts, fmt.Sprintf("httptitle NOT LIKE '%%%s%%'", l))
}
if len(parts) == 0 {
return ""
}
return " AND (" + strings.Join(parts, " AND ") + ")"
}
// taken from https://www.alexedwards.net/blog/basic-authentication-in-go
func basicAuth(next http.HandlerFunc, user, pass string) http.HandlerFunc {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
username, password, ok := r.BasicAuth()
if ok {
// Calculate SHA-256 hashes for the provided and expected
// usernames and passwords.
usernameHash := sha256.Sum256([]byte(username))
passwordHash := sha256.Sum256([]byte(password))
expectedUsernameHash := sha256.Sum256([]byte(user))
expectedPasswordHash := sha256.Sum256([]byte(pass))
usernameMatch := (subtle.ConstantTimeCompare(usernameHash[:], expectedUsernameHash[:]) == 1)
passwordMatch := (subtle.ConstantTimeCompare(passwordHash[:], expectedPasswordHash[:]) == 1)
// If the username and password are correct, then call
// the next handler in the chain. Make sure to return
// afterwards, so that none of the code below is run.
if usernameMatch && passwordMatch {
next.ServeHTTP(w, r)
return
}
}
// If the Authentication header is not present, is invalid, or the
// username or password is wrong, then set a WWW-Authenticate
// header to inform the client that we expect them to use basic
// authentication and send a 401 Unauthorized response.
w.Header().Set("WWW-Authenticate", `Basic realm="restricted", charset="UTF-8"`)
http.Error(w, "Unauthorized", http.StatusUnauthorized)
})
}