licc/dt_automate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

2025.3.11

Browse Source
This commit is contained in:
李超 2025-03-11 15:07:17 +08:00
parent 88fbd1c06c
commit 2182b0e5cb
36 changed files with 215 additions and 175 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

295
attackevent/fw_data.go
View File

@ -2,9 +2,12 @@ package attackevent
import (
"bytes"
"database/sql"
"dt_automate/conn"
"dt_automate/dbpool"
"dt_automate/tool"
"encoding/json"
"fmt"
"log"
"math"
"net/url"
@ -21,7 +24,7 @@ import (
// var err error
// 传入cookie
func Fw_event(cookieStr string) {
func Fw_event(cookieStr, timeStr string) {
ss := spreadsheet.New()
sheet := ss.AddSheet()
// sheet.SetFrozen(true, false)
@ -53,55 +56,44 @@ func Fw_event(cookieStr string) {
sheet.Cell("O1").SetString("参数")
sheet.Cell("P1").SetString("源ip地区")
log.Println("生成表格列名完成")
//当前时间
EndTime := time.Unix(tool.Timestamp("second"), 0).Format("2006-01-02T15:04:05")
//今天0点
StartTime := time.Date(time.Now().Year(), time.Now().Month(), time.Now().Day(), 0, 0, 0, 0, time.Now().Location()).Format("2006-01-02T15:04:05")
//昨天23点59分59秒
EndTime_1 := time.Date(time.Now().Year(), time.Now().Month(), time.Now().Day(), 0, 0, 0, 0, time.Now().Location()).Add(-1 * time.Second).Format("2006-01-02T15:04:05")
StartTime_1 := time.Date(time.Now().Year(), time.Now().Month(), time.Now().Day(), 0, 0, 0, 0, time.Now().Location()).Add(-8 * time.Hour).Format("2006-01-02T15:04:05")
// log.Println(EndTime_1)
// log.Println(StartTime_1)
// 构建 x-www-form-urlencoded 格式的请求体
//今天0点到现在的攻击事件
values := url.Values{}
values.Add("xml", "<rpc message-id='101' xmlns='urn:ietf:params:xml:ns:netconf:base:1.0' xmlns:web='urn:ietf:params:xml:ns:netconf:base:1.0'><get-bulk><filter type='subtree'><top xmlns='http://www.unis.cn/netconf/data:1.0' xmlns:web='http://www.unis.cn/netconf/base:1.0' xmlns:data='http://www.unis.cn/netconf/data:1.0'><NTOP><LogPaging><Log><LogType>1</LogType><UserID/><ID/><TimeFilter><StartTime>"+StartTime+"</StartTime><EndTime>"+EndTime+"</EndTime></TimeFilter><PageNo>1</PageNo><CountPerPage>200</CountPerPage><TotalCounts/><InputJSON>{&#34;SrcZoneName&#34;:&#34;Untrust&#34;,&#34;DestZoneName&#34;:&#34;Trust&#34;}</InputJSON><OutputJSON/></Log></LogPaging></NTOP></top></filter></get-bulk></rpc>")
values.Add("req_menu", "M_Monitor/M_AtkLog/M_ThreatLog")
//昨天下午16点到晚上23点59分59秒的攻击事件
values_1 := url.Values{}
values_1.Add("xml", "<rpc message-id='101' xmlns='urn:ietf:params:xml:ns:netconf:base:1.0' xmlns:web='urn:ietf:params:xml:ns:netconf:base:1.0'><get-bulk><filter type='subtree'><top xmlns='http://www.unis.cn/netconf/data:1.0' xmlns:web='http://www.unis.cn/netconf/base:1.0' xmlns:data='http://www.unis.cn/netconf/data:1.0'><NTOP><LogPaging><Log><LogType>1</LogType><UserID/><ID/><TimeFilter><StartTime>"+StartTime_1+"</StartTime><EndTime>"+EndTime_1+"</EndTime></TimeFilter><PageNo>1</PageNo><CountPerPage>200</CountPerPage><TotalCounts/><InputJSON>{&#34;SrcZoneName&#34;:&#34;Untrust&#34;,&#34;DestZoneName&#34;:&#34;Trust&#34;}</InputJSON><OutputJSON/></Log></LogPaging></NTOP></top></filter></get-bulk></rpc>")
values_1.Add("req_menu", "M_Monitor/M_AtkLog/M_ThreatLog")
header := map[string]string{
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"referer": "https://11.2.68.146/wnm/frame/index.php",
"cookie": cookieStr,
}
//先查询昨天的事件
yesterday := conn.DT_POST("https://11.2.68.146/wnm/get.j", header, bytes.NewBufferString(values_1.Encode()))
// log.Println(string(body))
// log.Println(yesterday)
//计算时间范围（2023-01-01-2023-01-05）示例
//2023-01-01
startTime, _ := time.Parse("2006-01-02", timeStr) //之前的时间
endTime, _ := time.Parse("2006-01-02", time.Unix(tool.Timestamp("second"), 0).Format("2006-01-02")) //当前时间
//获取当前事件
var Con int //插入总数
//存储昨日攻击事件
num, _ := strconv.Atoi(Date_v(yesterday).NTOP.LogPaging[0].TotalCounts)
if num > 200 {
var nums = 1 //页数
a, err := strconv.ParseFloat(Date_v(yesterday).NTOP.LogPaging[0].TotalCounts, 64)
if err != nil {
log.Println(err)
// 计算时间段分成一天一段
for current := startTime; current.Before(endTime) || current.Equal(endTime); {
// 当天的开始时间（00:00:00）
dayStart := time.Date(current.Year(), current.Month(), current.Day(), 0, 0, 0, 0, current.Location())
// 当天的结束时间（23:59:59）
dayEnd := dayStart.AddDate(0, 0, 1).Add(-1 * time.Nanosecond)
// 如果当前计算的结束时间超过endTime，则将endTime作为结束时间
if dayEnd.After(endTime) {
dayEnd = time.Date(endTime.Year(), endTime.Month(), endTime.Day(), 23, 59, 59, 999999999, endTime.Location())
}
log.Println("昨日查询到总条数：", a)
totalPages := int(math.Floor(float64(a))/float64(200) + 1)
log.Println(totalPages)
for i := 1; i < totalPages+1; i++ {
values_1 := url.Values{}
values_1.Add("xml", "<rpc message-id='101' xmlns='urn:ietf:params:xml:ns:netconf:base:1.0' xmlns:web='urn:ietf:params:xml:ns:netconf:base:1.0'><get-bulk><filter type='subtree'><top xmlns='http://www.unis.cn/netconf/data:1.0' xmlns:web='http://www.unis.cn/netconf/base:1.0' xmlns:data='http://www.unis.cn/netconf/data:1.0'><NTOP><LogPaging><Log><LogType>1</LogType><UserID/><ID/><TimeFilter><StartTime>"+StartTime_1+"</StartTime><EndTime>"+EndTime_1+"</EndTime></TimeFilter><PageNo>"+strconv.Itoa(nums)+"</PageNo><CountPerPage>200</CountPerPage><TotalCounts/><InputJSON>{&#34;SrcZoneName&#34;:&#34;Untrust&#34;,&#34;DestZoneName&#34;:&#34;Trust&#34;}</InputJSON><OutputJSON/></Log></LogPaging></NTOP></top></filter></get-bulk></rpc>")
values_1.Add("req_menu", "M_Monitor/M_AtkLog/M_ThreatLog")
yesterday := conn.DT_POST("https://11.2.68.146/wnm/get.j", header, bytes.NewBufferString(values_1.Encode()))
log.Println(values_1, i)
var nums = 1 //页数
for _, k := range Date_v(yesterday).NTOP.LogPaging {
log.Println(len(sheet.Rows()))
fmt.Printf("从 %s 到 %s\n", dayStart.Format("2006-01-02T15:04:05"), dayEnd.Format("2006-01-02T15:04:05"))
// 构建 x-www-form-urlencoded 格式的请求体
values := url.Values{}
values.Add("xml", "<rpc message-id='101' xmlns='urn:ietf:params:xml:ns:netconf:base:1.0' xmlns:web='urn:ietf:params:xml:ns:netconf:base:1.0'><get-bulk><filter type='subtree'><top xmlns='http://www.unis.cn/netconf/data:1.0' xmlns:web='http://www.unis.cn/netconf/base:1.0' xmlns:data='http://www.unis.cn/netconf/data:1.0'><NTOP><LogPaging><Log><LogType>1</LogType><UserID/><ID/><TimeFilter><StartTime>"+dayStart.Format("2006-01-02T15:04:05")+"</StartTime><EndTime>"+dayEnd.Format("2006-01-02T15:04:05")+"</EndTime></TimeFilter><PageNo>1</PageNo><CountPerPage>200</CountPerPage><TotalCounts/><InputJSON>{&#34;SrcZoneName&#34;:&#34;Untrust&#34;,&#34;DestZoneName&#34;:&#34;Trust&#34;}</InputJSON><OutputJSON/></Log></LogPaging></NTOP></top></filter></get-bulk></rpc>")
values.Add("req_menu", "M_Monitor/M_AtkLog/M_ThreatLog")
//请求头信息
header := map[string]string{
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"referer": "https://11.2.68.146/wnm/frame/index.php",
"cookie": cookieStr,
}
//查询数据//请求数据体
security_event_data := conn.DT_POST("https://11.2.68.146/wnm/get.j", header, bytes.NewBufferString(values.Encode()))
//获取页数
count_pages, _ := strconv.Atoi(Date_v(security_event_data).NTOP.LogPaging[0].TotalCounts)
if count_pages < 200 {
for _, k := range Date_v(security_event_data).NTOP.LogPaging {
// log.Println(len(sheet.Rows()))
con := len(sheet.Rows()) + 1
// IP := conn.DT_GET("http://ip-api.com/json/"+k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string)+"?lang=zh-CN", nil, nil)
sheet.Cell("A" + strconv.Itoa(con)).SetString(strconv.Itoa(con - 1)) // 第一列 (A1)
@ -120,108 +112,123 @@ func Fw_event(cookieStr string) {
sheet.Cell("N" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["HttpFirstLine"].(string))
sheet.Cell("O" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Payload"].(string))
// sheet.Cell("P" + strconv.Itoa(Con)).SetString(Date_get(IP).(map[string]interface{})["country"].(string) + "." + Date_get(IP).(map[string]interface{})["city"].(string) + "/" + Date_get(IP).(map[string]interface{})["isp"].(string))
log.Println("开始插入昨日数据：", Con, k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string))
log.Printf("开始插入%s数据：%d %s", dayStart.Format("2006-01-02T15:04:05"), con, k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string))
//查询数据库中是否有重复数据
//查询sql 获取用户信息
rows, err := dbpool.QueryRows("SELECT `DT_TIME` FROM `dt_zgdz`.`dt_attack_event` WHERE DT_TIME = ?;", k.OutputJSON.(map[string]interface{})["Time"].(string))
if err != nil {
log.Println(err)
}
defer rows.Close()
var timeStr sql.NullString
// var typecho_userss []string
for rows.Next() {
if err := rows.Scan(&timeStr); err != nil {
log.Println(err)
}
// typecho_userss = append(typecho_userss, timeStr)
}
log.Println(timeStr)
if err := rows.Err(); err != nil {
log.Fatal(err)
}
if k.OutputJSON.(map[string]interface{})["Time"].(string) != timeStr.String {
//调用ExecteSQL函数执行插入语句
result, err := dbpool.ExecuteSQL("INSERT INTO `dt_zgdz`.`dt_attack_event` (`DT_ID`, `DT_TIME`, `DT_SRCZONENAME`, `DT_DESTZONENAME`, `DT_SRCIPADDR`, `DT_DESTIPADDR`, `DT_DESTPORT`, `DT_THREATNAME`, `DT_METHODNAMECN`, `DT_METHODSUBNAMECN`, `DT_AOOLICATION`, `DT_CVE`, `DT_HTTPHOST`, `DT_HTTPFIRSTLINE`, `DT_PAYLOAD`) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);", strconv.Itoa(con-1), k.OutputJSON.(map[string]interface{})["Time"].(string), k.OutputJSON.(map[string]interface{})["SrcZoneName"].(string), k.OutputJSON.(map[string]interface{})["DestZoneName"].(string), k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string), k.OutputJSON.(map[string]interface{})["DestIPAddr"].(string), strconv.FormatFloat(k.OutputJSON.(map[string]interface{})["DestPort"].(float64), 'f', -1, 64), k.OutputJSON.(map[string]interface{})["ThreatName"].(string), k.OutputJSON.(map[string]interface{})["MethodNameCN"].(string), k.OutputJSON.(map[string]interface{})["MethodSubNameCN"].(string), k.OutputJSON.(map[string]interface{})["Application"].(string), k.OutputJSON.(map[string]interface{})["CVE"].(string), k.OutputJSON.(map[string]interface{})["HttpHost"].(string), k.OutputJSON.(map[string]interface{})["HttpFirstLine"].(string), k.OutputJSON.(map[string]interface{})["Payload"].(string))
if err != nil {
log.Println(err)
}
// 获取插入操作的最后插入ID和受影响的行数
lastInsertId, err := result.LastInsertId()
if err != nil {
log.Fatal(err)
}
rowsAffected, err := result.RowsAffected()
if err != nil {
log.Fatal(err)
}
log.Printf("Last Insert ID: %d, Rows Affected: %d\n", lastInsertId, rowsAffected)
}
}
nums++
}
} else {
for _, k := range Date_v(yesterday).NTOP.LogPaging {
log.Println(len(sheet.Rows()))
con := len(sheet.Rows()) + 1
// IP := conn.DT_GET("http://ip-api.com/json/"+k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string)+"?lang=zh-CN", nil, nil)
sheet.Cell("A" + strconv.Itoa(con)).SetString(strconv.Itoa(con - 1)) // 第一列 (A1)
sheet.Cell("B" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Time"].(string))
sheet.Cell("C" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["SrcZoneName"].(string))
sheet.Cell("D" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["DestZoneName"].(string))
sheet.Cell("E" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string))
sheet.Cell("F" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["DestIPAddr"].(string))
sheet.Cell("G" + strconv.Itoa(con)).SetString(strconv.FormatFloat(k.OutputJSON.(map[string]interface{})["DestPort"].(float64), 'f', -1, 64))
sheet.Cell("H" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["ThreatName"].(string))
sheet.Cell("I" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["MethodNameCN"].(string))
sheet.Cell("J" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["MethodSubNameCN"].(string))
sheet.Cell("K" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Application"].(string))
sheet.Cell("L" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["CVE"].(string))
sheet.Cell("M" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["HttpHost"].(string))
sheet.Cell("N" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["HttpFirstLine"].(string))
sheet.Cell("O" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Payload"].(string))
// sheet.Cell("P" + strconv.Itoa(Con)).SetString(Date_get(IP).(map[string]interface{})["country"].(string) + "." + Date_get(IP).(map[string]interface{})["city"].(string) + "/" + Date_get(IP).(map[string]interface{})["isp"].(string))
log.Println("开始插入昨日数据：", Con, k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string))
}
}
} else {
//计算页数
totalPages := int(math.Floor(float64(count_pages))/float64(200) + 1)
for i := 0; i < totalPages; i++ {
values := url.Values{}
values.Add("xml", "<rpc message-id='101' xmlns='urn:ietf:params:xml:ns:netconf:base:1.0' xmlns:web='urn:ietf:params:xml:ns:netconf:base:1.0'><get-bulk><filter type='subtree'><top xmlns='http://www.unis.cn/netconf/data:1.0' xmlns:web='http://www.unis.cn/netconf/base:1.0' xmlns:data='http://www.unis.cn/netconf/data:1.0'><NTOP><LogPaging><Log><LogType>1</LogType><UserID/><ID/><TimeFilter><StartTime>"+dayStart.Format("2006-01-02T15:04:05")+"</StartTime><EndTime>"+dayEnd.Format("2006-01-02T15:04:05")+"</EndTime></TimeFilter><PageNo>"+strconv.Itoa(i+1)+"</PageNo><CountPerPage>200</CountPerPage><TotalCounts/><InputJSON>{&#34;SrcZoneName&#34;:&#34;Untrust&#34;,&#34;DestZoneName&#34;:&#34;Trust&#34;}</InputJSON><OutputJSON/></Log></LogPaging></NTOP></top></filter></get-bulk></rpc>")
values.Add("req_menu", "M_Monitor/M_AtkLog/M_ThreatLog")
//请求头信息
header := map[string]string{
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"referer": "https://11.2.68.146/wnm/frame/index.php",
"cookie": cookieStr,
}
//获取当天每页数据
daydata := conn.DT_POST("https://11.2.68.146/wnm/get.j", header, bytes.NewBufferString(values.Encode()))
for _, k := range Date_v(daydata).NTOP.LogPaging {
// log.Println(len(sheet.Rows()))
con := len(sheet.Rows()) + 1
// IP := conn.DT_GET("http://ip-api.com/json/"+k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string)+"?lang=zh-CN", nil, nil)
sheet.Cell("A" + strconv.Itoa(con)).SetString(strconv.Itoa(con - 1)) // 第一列 (A1)
sheet.Cell("B" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Time"].(string))
sheet.Cell("C" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["SrcZoneName"].(string))
sheet.Cell("D" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["DestZoneName"].(string))
sheet.Cell("E" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string))
sheet.Cell("F" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["DestIPAddr"].(string))
sheet.Cell("G" + strconv.Itoa(con)).SetString(strconv.FormatFloat(k.OutputJSON.(map[string]interface{})["DestPort"].(float64), 'f', -1, 64))
sheet.Cell("H" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["ThreatName"].(string))
sheet.Cell("I" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["MethodNameCN"].(string))
sheet.Cell("J" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["MethodSubNameCN"].(string))
sheet.Cell("K" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Application"].(string))
sheet.Cell("L" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["CVE"].(string))
sheet.Cell("M" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["HttpHost"].(string))
sheet.Cell("N" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["HttpFirstLine"].(string))
sheet.Cell("O" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Payload"].(string))
// sheet.Cell("P" + strconv.Itoa(Con)).SetString(Date_get(IP).(map[string]interface{})["country"].(string) + "." + Date_get(IP).(map[string]interface{})["city"].(string) + "/" + Date_get(IP).(map[string]interface{})["isp"].(string))
log.Printf("开始插入%s数据：%d %s", dayStart.Format("2006-01-02T15:04:05"), con, k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string))
// 调用ExecuteSQL函数执行插入操作
//查询数据库中是否有重复数据
//查询sql 获取用户信息
rows, err := dbpool.QueryRows("SELECT `DT_TIME` FROM `dt_zgdz`.`dt_attack_event` WHERE DT_TIME = ?;", k.OutputJSON.(map[string]interface{})["Time"].(string))
if err != nil {
log.Println(err)
}
defer rows.Close()
var timeStr sql.NullString
// var typecho_userss []string
for rows.Next() {
if err := rows.Scan(&timeStr); err != nil {
log.Println(err)
}
// typecho_userss = append(typecho_userss, timeStr)
}
if err := rows.Err(); err != nil {
log.Fatal(err)
}
if k.OutputJSON.(map[string]interface{})["Time"].(string) != timeStr.String {
result, err := dbpool.ExecuteSQL("INSERT INTO `dt_zgdz`.`dt_attack_event` (`DT_ID`, `DT_TIME`, `DT_SRCZONENAME`, `DT_DESTZONENAME`, `DT_SRCIPADDR`, `DT_DESTIPADDR`, `DT_DESTPORT`, `DT_THREATNAME`, `DT_METHODNAMECN`, `DT_METHODSUBNAMECN`, `DT_AOOLICATION`, `DT_CVE`, `DT_HTTPHOST`, `DT_HTTPFIRSTLINE`, `DT_PAYLOAD`, `DT_CUNTRY`) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);", strconv.Itoa(con-1), k.OutputJSON.(map[string]interface{})["Time"].(string), k.OutputJSON.(map[string]interface{})["SrcZoneName"].(string), k.OutputJSON.(map[string]interface{})["DestZoneName"].(string), k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string), k.OutputJSON.(map[string]interface{})["DestIPAddr"].(string), strconv.FormatFloat(k.OutputJSON.(map[string]interface{})["DestPort"].(float64), 'f', -1, 64), k.OutputJSON.(map[string]interface{})["ThreatName"].(string), k.OutputJSON.(map[string]interface{})["MethodNameCN"].(string), k.OutputJSON.(map[string]interface{})["MethodSubNameCN"].(string), k.OutputJSON.(map[string]interface{})["Application"].(string), k.OutputJSON.(map[string]interface{})["CVE"].(string), k.OutputJSON.(map[string]interface{})["HttpHost"].(string), k.OutputJSON.(map[string]interface{})["HttpFirstLine"].(string), k.OutputJSON.(map[string]interface{})["Payload"].(string))
if err != nil {
log.Println(err)
}
// 获取插入操作的最后插入ID和受影响的行数
lastInsertId, err := result.LastInsertId()
if err != nil {
log.Fatal(err)
}
rowsAffected, err := result.RowsAffected()
if err != nil {
log.Fatal(err)
}
log.Printf("Last Insert ID: %d, Rows Affected: %d\n", lastInsertId, rowsAffected)
}
//存储今日攻击事件
today := conn.DT_POST("https://11.2.68.146/wnm/get.j", header, bytes.NewBufferString(values.Encode()))
num_1, _ := strconv.Atoi(Date_v(today).NTOP.LogPaging[0].TotalCounts) //获取总页数
if num_1 > 200 {
a, err := strconv.ParseFloat(Date_v(today).NTOP.LogPaging[0].TotalCounts, 64)
if err != nil {
log.Println(err)
}
log.Println("今日查询到总条数：", a)
totalPages := int(math.Floor(float64(a))/float64(200) + 1)
log.Println(totalPages)
var nums = 1 //页数
for i := 1; i < totalPages+1; i++ {
values_1 := url.Values{}
values_1.Add("xml", "<rpc message-id='101' xmlns='urn:ietf:params:xml:ns:netconf:base:1.0' xmlns:web='urn:ietf:params:xml:ns:netconf:base:1.0'><get-bulk><filter type='subtree'><top xmlns='http://www.unis.cn/netconf/data:1.0' xmlns:web='http://www.unis.cn/netconf/base:1.0' xmlns:data='http://www.unis.cn/netconf/data:1.0'><NTOP><LogPaging><Log><LogType>1</LogType><UserID/><ID/><TimeFilter><StartTime>"+StartTime+"</StartTime><EndTime>"+EndTime+"</EndTime></TimeFilter><PageNo>"+strconv.Itoa(nums)+"</PageNo><CountPerPage>200</CountPerPage><TotalCounts/><InputJSON>{&#34;SrcZoneName&#34;:&#34;Untrust&#34;,&#34;DestZoneName&#34;:&#34;Trust&#34;}</InputJSON><OutputJSON/></Log></LogPaging></NTOP></top></filter></get-bulk></rpc>")
values_1.Add("req_menu", "M_Monitor/M_AtkLog/M_ThreatLog")
today := conn.DT_POST("https://11.2.68.146/wnm/get.j", header, bytes.NewBufferString(values.Encode()))
log.Println(values_1, i)
for _, k := range Date_v(today).NTOP.LogPaging {
log.Println(len(sheet.Rows()))
con := len(sheet.Rows()) + 1
// IP := conn.DT_GET("http://ip-api.com/json/"+k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string)+"?lang=zh-CN", nil, nil)
sheet.Cell("A" + strconv.Itoa(con)).SetString(strconv.Itoa(con - 1)) // 第一列 (A1)
sheet.Cell("B" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Time"].(string))
sheet.Cell("C" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["SrcZoneName"].(string))
sheet.Cell("D" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["DestZoneName"].(string))
sheet.Cell("E" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string))
sheet.Cell("F" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["DestIPAddr"].(string))
sheet.Cell("G" + strconv.Itoa(con)).SetString(strconv.FormatFloat(k.OutputJSON.(map[string]interface{})["DestPort"].(float64), 'f', -1, 64))
sheet.Cell("H" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["ThreatName"].(string))
sheet.Cell("I" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["MethodNameCN"].(string))
sheet.Cell("J" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["MethodSubNameCN"].(string))
sheet.Cell("K" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Application"].(string))
sheet.Cell("L" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["CVE"].(string))
sheet.Cell("M" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["HttpHost"].(string))
sheet.Cell("N" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["HttpFirstLine"].(string))
sheet.Cell("O" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Payload"].(string))
// sheet.Cell("P" + strconv.Itoa(Con+v)).SetString(Date_get(IP).(map[string]interface{})["country"].(string) + "." + Date_get(IP).(map[string]interface{})["city"].(string) + "/" + Date_get(IP).(map[string]interface{})["isp"].(string))
log.Println("开始插入今日数据：", con, k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string))
}
}
nums++
// log.Println(Date_v(JsonStr).NTOP.LogPaging)
}
} else {
for _, k := range Date_v(today).NTOP.LogPaging {
log.Println(len(sheet.Rows()))
con := len(sheet.Rows()) + 1
// IP := conn.DT_GET("http://ip-api.com/json/"+k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string)+"?lang=zh-CN", nil, nil)
sheet.Cell("A" + strconv.Itoa(con)).SetString(strconv.Itoa(con - 1)) // 第一列 (A1)
sheet.Cell("B" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Time"].(string))
sheet.Cell("C" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["SrcZoneName"].(string))
sheet.Cell("D" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["DestZoneName"].(string))
sheet.Cell("E" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string))
sheet.Cell("F" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["DestIPAddr"].(string))
sheet.Cell("G" + strconv.Itoa(con)).SetString(strconv.FormatFloat(k.OutputJSON.(map[string]interface{})["DestPort"].(float64), 'f', -1, 64))
sheet.Cell("H" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["ThreatName"].(string))
sheet.Cell("I" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["MethodNameCN"].(string))
sheet.Cell("J" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["MethodSubNameCN"].(string))
sheet.Cell("K" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Application"].(string))
sheet.Cell("L" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["CVE"].(string))
sheet.Cell("M" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["HttpHost"].(string))
sheet.Cell("N" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["HttpFirstLine"].(string))
sheet.Cell("O" + strconv.Itoa(con)).SetString(k.OutputJSON.(map[string]interface{})["Payload"].(string))
// sheet.Cell("P" + strconv.Itoa(Con+v)).SetString(Date_get(IP).(map[string]interface{})["country"].(string) + "." + Date_get(IP).(map[string]interface{})["city"].(string) + "/" + Date_get(IP).(map[string]interface{})["isp"].(string))
log.Println("开始插入今日数据：", con, k.OutputJSON.(map[string]interface{})["SrcIPAddr"].(string))
}
// log.Println(Date_v(JsonStr).NTOP.LogPaging)
// 移动到下一天
current = current.AddDate(0, 0, 1)
}
// 保存修改后的 Excel 文件
if err := ss.Validate(); err != nil {
log.Fatalf("验证文件时出错: %s", err)
}

BIN
ceshi.xlsx
View File

Binary file not shown.

2
conf/test.yaml
View File

@ -1,4 +1,4 @@
cookie: vindex==3f=10=0AB00=0R;supportLang=cn%2Cen;lang=cn;sessionid=200001f4be302ec689309d258f6ee6c0d187;loginid=a72a7ae33c1374e7d9f70b68cacd62be;200001f4be302ec689309d258f6ee6c0d187=true;abcd1234=true;login=false;
cookie: vindex==41=10=0AB00=0R;supportLang=cn%2Cen;lang=cn;sessionid=200001c53906386d042ccfb219dd9f942b72;loginid=4b66b6a063127e0810278173fc7e4200;200001c53906386d042ccfb219dd9f942b72=true;abcd1234=true;login=false;
mysql:
port: 3306
url: 127.0.0.1

34
damo/damo.go Normal file
View File

@ -0,0 +1,34 @@
package damo
import (
"fmt"
"log"
"math"
"time"
)
func Damo() {
startTime, _ := time.Parse("2006-01-02", "2023-01-01") //之前的时间
endTime, _ := time.Parse("2006-01-02", "2023-01-05") //当前时间
// 计算时间段分成一天一段
for current := startTime; current.Before(endTime) || current.Equal(endTime); {
// 当天的开始时间（00:00:00）
dayStart := time.Date(current.Year(), current.Month(), current.Day(), 0, 0, 0, 0, current.Location())
// 当天的结束时间（23:59:59）
dayEnd := dayStart.AddDate(0, 0, 1).Add(-1 * time.Nanosecond)
// 如果当前计算的结束时间超过endTime，则将endTime作为结束时间
if dayEnd.After(endTime) {
dayEnd = time.Date(endTime.Year(), endTime.Month(), endTime.Day(), 23, 59, 59, 999999999, endTime.Location())
}
fmt.Printf("从 %s 到 %s\n", dayStart.Format("2006-01-02T15:04:05"), dayEnd.Format("2006-01-02T15:04:05"))
// 移动到下一天
current = current.AddDate(0, 0, 1)
}
totalPages := int(math.Floor(float64(610))/float64(200) + 1)
log.Println(totalPages)
log.Println(time.Date(time.Now().Year(), time.Now().Month(), time.Now().Day(), 0, 0, 0, 0, time.Now().Location()))
}

16
dbpool/mysqldb.go
View File

@ -7,14 +7,14 @@ import (
_ "github.com/go-sql-driver/mysql"
)
var DB *sql.DB
var db *sql.DB
func init() {
DB, _ = sql.Open("mysql", "root:Lc753951!!@tcp(fanyu.online:53306)/douy?charset=utf8&parseTime=True&loc=Local")
DB.SetMaxOpenConns(20)
DB.SetMaxIdleConns(10)
DB.SetConnMaxLifetime(100)
err := DB.Ping()
db, _ = sql.Open("mysql", "root:Lc753951!!@tcp(fanyu.online:53306)/?charset=utf8&parseTime=True&loc=Local")
db.SetMaxOpenConns(20)
db.SetMaxIdleConns(10)
// DB.SetConnMaxLifetime(100)
err := db.Ping()
if err != nil {
log.Println("database init failed, err: ", err)
return
@ -25,7 +25,7 @@ func init() {
// QueryRows 是一个通用的查询函数，它执行SQL查询并返回结果集
func QueryRows(query string, args ...any) (*sql.Rows, error) {
rows, err := DB.Query(query, args...)
rows, err := db.Query(query, args...)
if err != nil {
return nil, err
}
@ -36,7 +36,7 @@ func QueryRows(query string, args ...any) (*sql.Rows, error) {
// ExecuteSQL 是一个通用的插入函数，它执行SQL插入并返回结果集
func ExecuteSQL(query string, args ...any) (sql.Result, error) {
result, err := DB.Exec(query, args...)
result, err := db.Exec(query, args...)
if err != nil {
return nil, err
}

BIN
img/afc2000_1.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 182 KiB

After

Width:  |  Height:  |  Size: 182 KiB

BIN
img/afc2000_2.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 246 KiB

After

Width:  |  Height:  |  Size: 248 KiB

BIN
img/capt.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 5.4 KiB

BIN
img/hw_baolj.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 197 KiB

After

Width:  |  Height:  |  Size: 197 KiB

BIN
img/hw_dtcloud_01.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 270 KiB

After

Width:  |  Height:  |  Size: 268 KiB

BIN
img/hw_dtcloud_02.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 253 KiB

After

Width:  |  Height:  |  Size: 252 KiB

BIN
img/hw_dtcloud_03.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 231 KiB

After

Width:  |  Height:  |  Size: 977 KiB

BIN
img/hw_dtcloud_04.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 224 KiB

After

Width:  |  Height:  |  Size: 224 KiB

BIN
img/hw_dtcloud_05.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 105 KiB

After

Width:  |  Height:  |  Size: 114 KiB

BIN
img/hw_dtcloud_06.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 239 KiB

After

Width:  |  Height:  |  Size: 244 KiB

BIN
img/hw_dtcloud_07.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 176 KiB

After

Width:  |  Height:  |  Size: 175 KiB

BIN
img/hw_dtcloud_08.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 157 KiB

After

Width:  |  Height:  |  Size: 157 KiB

BIN
img/hw_dtcloud_man.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 290 KiB

After

Width:  |  Height:  |  Size: 997 KiB

BIN
img/hw_fw1.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 388 KiB

After

Width:  |  Height:  |  Size: 380 KiB

BIN
img/hw_tsgz.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 319 KiB

After

Width:  |  Height:  |  Size: 229 KiB

BIN
img/zww_baolj.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 194 KiB

After

Width:  |  Height:  |  Size: 194 KiB

BIN
img/zww_dtcloud_01.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 260 KiB

After

Width:  |  Height:  |  Size: 259 KiB

BIN
img/zww_dtcloud_02.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 252 KiB

After

Width:  |  Height:  |  Size: 251 KiB

BIN
img/zww_dtcloud_03.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 243 KiB

After

Width:  |  Height:  |  Size: 254 KiB

BIN
img/zww_dtcloud_04.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 228 KiB

After

Width:  |  Height:  |  Size: 227 KiB

BIN
img/zww_dtcloud_05.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 114 KiB

After

Width:  |  Height:  |  Size: 114 KiB

BIN
img/zww_dtcloud_06.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 242 KiB

After

Width:  |  Height:  |  Size: 242 KiB

BIN
img/zww_dtcloud_07.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 175 KiB

After

Width:  |  Height:  |  Size: 174 KiB

BIN
img/zww_dtcloud_man.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 289 KiB

After

Width:  |  Height:  |  Size: 288 KiB

BIN
img/zww_fw1.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 253 KiB

After

Width:  |  Height:  |  Size: 214 KiB

BIN
img/zww_tsgz.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 185 KiB

After

Width:  |  Height:  |  Size: 156 KiB

15
main.go
View File

@ -66,26 +66,26 @@ func main() {
} else {
log.Printf("授权未到期，剩余时间：%d天 %d小时 %d分钟 %d秒", days, hours, minutes, secod)
//可执行程序位置
// 互联网区截图
// // 互联网区截图
// method.HW_FAC1() //截取流量清洗的图片
// method.HW_FW1() //截取防火墙的图片
// method.HW_FW1() //截取防火墙的图片
// method.HW_TSGZ() //截取态势感知的图片
// method.HW_DTCLOUD() //截取运维中心的图片
// method.HW_BAOLJ() //截取堡垒机的图片
//政务网区截图
// //政务网区截图
// method.ZWW_FW1() //截取防火墙的图片
// method.ZWW_TSGZ() //截取态势感知的图片
// method.ZWW_TSGZ() //截取态势感知的图片
// method.ZWW_DTCLOUD() //截取运维中心的图片
// method.ZWWW_BAOLJ() //截取堡垒机的图片
// 互联网区运维巡检文档生成
// wps.HW_SYS_Word() //运维平台word文档生成
// // //政务网区运维巡检文档生成
// // // //政务网区运维巡检文档生成
// wps.ZWW_SYS_Word() //运维平台word文档生成
// // //安全巡检文档生成
// // // //安全巡检文档生成
// wps.SAFET_Word() //安全巡检文档生成
//安全事件表格生成(需要先执行互联网区防火墙截图)
// attackevent.Fw_event(attackevent.HW_fw1_cookie()) //将防火墙安全事件存放到xlsx文件中
// attackevent.Fw_event(attackevent.HW_fw1_cookie(), "2025-03-10") //将防火墙安全事件存放到xlsx文件中
//nessus的csv文件生成docx报告
// wps.CSV_damo()
//翻译模块调用腾讯xt翻译月500万字限制
@ -97,6 +97,7 @@ func main() {
// dtcloud.Memory() //获取单个ecs的memory使用情况
// dtcloud.Cpu() ///获取单个ecs的cpu使用情况
// dtcloud.TenantList() //获取租户列表(完成)
// damo.Damo()
}
} else {

2
method/hw_dtcloud.go
View File

@ -62,7 +62,7 @@ func HW_DTCLOUD() {
if err := page.Locator(".el-button.login-form-item.login-btn.el-button--primary").Click(); err != nil {
log.Fatalf("could not click button: %v", err)
}
page.WaitForTimeout(7000)
page.WaitForTimeout(10000)
//运维中心主页
page.Screenshot(playwright.PageScreenshotOptions{
Path: playwright.String("img/hw_dtcloud_man.png"),

24
method/hw_fw1.go
View File

@ -1,9 +1,7 @@
package method
import (
"dt_automate/conf"
"dt_automate/tool"
"fmt"
"log"
"github.com/playwright-community/playwright-go"
@ -105,18 +103,18 @@ func HW_FW1() {
log.Fatalf("could not get title: %v", err)
}
log.Printf("Page title is: %s\n", title)
cookies, err := page.Context().Cookies("https://11.2.68.146/wnm/get.j")
if err != nil {
log.Println(err)
}
var cookieStr string
for i, cookie := range cookies {
cookieStr += fmt.Sprintf("%s=%s;", cookie.Name, cookie.Value)
log.Printf("Cookie %d: %+v", i, cookie)
}
log.Println(cookieStr)
// cookies, err := page.Context().Cookies("https://11.2.68.146/wnm/get.j")
// if err != nil {
// log.Println(err)
// }
// var cookieStr string
// for i, cookie := range cookies {
// cookieStr += fmt.Sprintf("%s=%s;", cookie.Name, cookie.Value)
// log.Printf("Cookie %d: %+v", i, cookie)
// }
// log.Println(cookieStr)
// attackevent.Fw_event(cookieStr)
conf.SET_Config_yaml("cookie", cookieStr) //临时存放数据
// conf.SET_Config_yaml("cookie", cookieStr) //临时存放数据
// StartBlocker()
page.WaitForTimeout(5000)
}

2
tool/util.go
View File

@ -14,7 +14,7 @@ func Auth_main() map[string]string {
fmt.Println("电脑序列号:", machine_code.Machine.BoardSerialNumber)
if machine_code.Machine.BoardSerialNumber != "" {
//查询sql 获取用户信息
rows, err := dbpool.QueryRows("SELECT * FROM douy_info WHERE serialNumber = ?;", machine_code.Machine.BoardSerialNumber)
rows, err := dbpool.QueryRows("SELECT * FROM `douy`.`douy_info` WHERE serialNumber = ?;", machine_code.Machine.BoardSerialNumber)
if err != nil {
log.Println(err)
}

BIN
防火墙安全事件20250310.xlsx Normal file
View File

Binary file not shown.