一个IIS短文件名枚举工具。
Shortscan旨在快速确定IIS Web服务器上存在哪些具有短文件名的文件。一旦识别出短文件名，该工具将尝试自动识别完整的文件名。
除了标准发现方法外，Shortscan还使用独特的校验和匹配方法来尝试查找长文件名，其中短文件名基于Windows专有的短名称冲突避免校验和算法（关于此研究的更多信息将在日后发布）。
使用最新版本的Go:
go install github.com/bitquark/shortscan/cmd/shortscan@latest
要在本地构建（并可选择安装）：
go get && go build
go install
Shortscan易于使用，只需最少的配置。基本用法如下：
$ shortscan http://example.org/
您还可以指定一个包含待扫描URL列表的文件：
$ shortscan @urls.txt
此示例通过多次使用--header/-H设置多个自定义标头：
shortscan -H 'Host: gibson' -H 'Authorization: Basic ZGFkZTpsMzN0'
要检查站点是否存在漏洞而不执行文件枚举，请使用：
shortscan --isvuln
以下选项允许进一步调整：
🌀 Shortscan v0.9.2 · an IIS short filename enumeration tool by bitquark
Usage: main [--wordlist FILE] [--header HEADER] [--concurrency CONCURRENCY] [--timeout SECONDS] [--output format] [--verbosity VERBOSITY] [--fullurl] [--norecurse] [--stabilise] [--patience LEVEL] [--characters CHARACTERS] [--autocomplete mode] [--isvuln] URL [URL ...]
Positional arguments:
URL url to scan (multiple URLs can be provided; a file containing URLs can be specified with an «at» prefix, for example: @urls.txt)
Options:
--wordlist FILE, -w FILE
combined wordlist + rainbow table generated with shortutil
--header HEADER, -H HEADER
header to send with each request (use multiple times for multiple headers)
--concurrency CONCURRENCY, -c CONCURRENCY
number of requests to make at once [default: 20]
--timeout SECONDS, -t SECONDS
per-request timeout in seconds [default: 10]
--output format, -o format
output format (human = human readable; json = JSON) [default: human]
--verbosity VERBOSITY, -v VERBOSITY
how much noise to make (0 = quiet; 1 = debug; 2 = trace) [default: 0]
--fullurl, -F display the full URL for confirmed files rather than just the filename [default: false]
--norecurse, -n don't detect and recurse into subdirectories (disabled when autocomplete is disabled) [default: false]
--stabilise, -s attempt to get coherent autocomplete results from an unstable server (generates more requests) [default: false]
--patience LEVEL, -p LEVEL
patience level when determining vulnerability (0 = patient; 1 = very patient) [default: 0]
--characters CHARACTERS, -C CHARACTERS
filename characters to enumerate [default: JFKGOTMYVHSPCANDXLRWEBQUIZ8549176320-_()&'!#$%@^{}~]
--autocomplete mode, -a mode
autocomplete detection mode (auto = autoselect; method = HTTP method magic; status = HTTP status; distance = Levenshtein distance; none = disable) [default: auto]
--isvuln, -V bail after determining whether the service is vulnerable [default: false]
--help, -h display this help and exit
--version display version and exit
shortscan项目包含一个名为shortutil的工具，可用于执行各种短文件名操作以及制作自定义彩虹表以供工具使用。
您可以像这样从现有词表中创建彩虹表：
shortutil wordlist input.txt > output.rainbow
要为文件生成一次性校验和：
shortutil checksum index.html
运行shortutil <command> --help可获取每个命令的明确选项列表。
Shortutil v0.3 · a short filename utility by bitquark
Usage: main <command> [<args>]
Options:
--help, -h display this help and exit
Commands:
wordlist add hashes to a wordlist for use with, for example, shortscan
checksum generate a one-off checksum for the given filename
一个自定义词表是为shortscan构建的。有关完整详细信息，请参阅pkg/shortscan/resources/README.md。
原始的IIS短文件名研究由Soroush Dalili完成。
额外研究及本项目由bitquark完成。