From fcc2c9dc31bd273a090384faf1afbc7cf6614c52 Mon Sep 17 00:00:00 2001
From: yhy <31311038+yhy0@users.noreply.github.com>
Date: Wed, 15 May 2024 21:32:07 +0800
Subject: [PATCH] =?UTF-8?q?feat=20=E5=A2=9E=E5=8A=A0=E8=AF=B7=E6=B1=82?=
 =?UTF-8?q?=E5=8F=82=E6=95=B0=E6=94=B6=E9=9B=86;=E8=AF=B7=E6=B1=82/?=
 =?UTF-8?q?=E8=BF=94=E5=9B=9E=E5=AD=98=E5=9C=A8=E6=95=8F=E6=84=9F=E5=8F=82?=
 =?UTF-8?q?=E6=95=B0=E8=AF=86=E5=88=AB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 SCopilot/templates/SCopilot.html        |  97 +++++++++++-----
 SCopilot/web.go                         |  12 ++
 conf/banner.go                          |   2 +-
 conf/file.go                            |  67 +++++++++++-
 conf/type.go                            |  37 ++++---
 go.mod                                  |   1 +
 go.sum                                  |   4 +-
 pkg/input/input.go                      |   8 +-
 pkg/output/SCopilot.go                  |  27 +++++
 pkg/output/output.go                    |  13 ++-
 pkg/output/type.go                      |  23 ++--
 pkg/task/task.go                        |  36 +++++-
 pkg/util/uniqueness.go                  |  42 +------
 pkg/util/url.go                         |  95 ++++++++++++++++
 pkg/util/util.go                        | 122 +++++++++++----------
 scan/gadget/collection/sensitive.go     |  88 +++++++++++++++
 scan/plugins.go                         |   3 +
 Jie_config.yaml => test/Jie_config.yaml |  66 ++++++++++-
 test/web_test.go                        | 140 ++++++++++++++++++++++++
 19 files changed, 714 insertions(+), 169 deletions(-)
 create mode 100644 pkg/util/url.go
 create mode 100644 scan/gadget/collection/sensitive.go
 rename Jie_config.yaml => test/Jie_config.yaml (90%)
 create mode 100644 test/web_test.go

diff --git a/SCopilot/templates/SCopilot.html b/SCopilot/templates/SCopilot.html
index 3a6d02c..5c67ec1 100644
--- a/SCopilot/templates/SCopilot.html
+++ b/SCopilot/templates/SCopilot.html
@@ -80,23 +80,25 @@ <h3 class="fs-4">Security Copilot Report - Jie</h3>
                     <h4 class="card-title">基本信息</h4>
                     <div class="card-body" >
                         <p>{{ .data.Target }} </p>
-                        {{ if .ipInfo.Cdn }}
-                        <span class="badge rounded-pill text-bg-primary">cdn</span>
-                        {{ end }}
+                        {{ if .ipInfo }}
+                            {{ if .ipInfo.Cdn }}
+                            <span class="badge rounded-pill text-bg-primary">cdn</span>
+                            {{ end }}
 
-                        {{ if .ipInfo.Value }}
-                        <span class="badge rounded-pill text-bg-primary">{{ .ipInfo.Value }} </span>
-                        <span class="badge rounded-pill text-bg-primary">{{ .ipInfo.Type }} </span>
-                        {{ end }}
-                        <p></p>
-                        {{ if .ipInfo.AllRecords }}
-                        <div class="col overflow-auto" style="max-height: 80px;">
-                            <ul class="list-group">
-                                {{ range $i, $records := .ipInfo.AllRecords }}
-                                    <li class="list-group-item text-danger-emphasis">{{ $records }}</li>
-                                {{ end }}
-                            </ul>
-                        </div>
+                            {{ if .ipInfo.Value }}
+                            <span class="badge rounded-pill text-bg-primary">{{ .ipInfo.Value }} </span>
+                            <span class="badge rounded-pill text-bg-primary">{{ .ipInfo.Type }} </span>
+                            {{ end }}
+                            <p></p>
+                            {{ if .ipInfo.AllRecords }}
+                            <div class="col overflow-auto" style="max-height: 80px;">
+                                <ul class="list-group">
+                                    {{ range $i, $records := .ipInfo.AllRecords }}
+                                        <li class="list-group-item text-danger-emphasis">{{ $records }}</li>
+                                    {{ end }}
+                                </ul>
+                            </div>
+                            {{ end }}
                         {{ end }}
                     </div>
                 </div>
@@ -120,11 +122,13 @@ <h4 class="card-title">端口信息</h4>
                             </tr>
                             </thead>
                             <tbody>
-                            {{ range $port, $service := .ipInfo.PortService }}
-                                <tr>
-                                    <th scope="row">{{ $port }}</th>
-                                    <td>{{ $service }}</td>
-                                </tr>
+                            {{ if .ipInfo }}
+                                {{ range $port, $service := .ipInfo.PortService }}
+                                    <tr>
+                                        <th scope="row">{{ $port }}</th>
+                                        <td>{{ $service }}</td>
+                                    </tr>
+                                {{ end }}
                             {{ end }}
                             </tbody>
                         </table>
@@ -142,12 +146,9 @@ <h4 class="card-title">端口信息</h4>
                 </li>
                 <li class="nav-item position-relative" role="presentation">
                     <button class="nav-link" id="profile-tab" data-bs-toggle="tab" data-bs-target="#siteMap-tab-pane" type="button" role="tab" aria-controls="siteMap-tab-pane" aria-selected="false">Site Map</button>
-<!--                    {{ $sl := len .data.SiteMap }}-->
-<!--                    {{ if gt $sl 0 }}-->
                     <span id="SiteMapTotal" class="position-absolute top-0 start-100 translate-middle badge rounded-pill bg-info">
                         {{ len .data.SiteMap }}
                     </span>
-<!--                    {{ end }}-->
                 </li>
                 <li class="nav-item position-relative" role="presentation">
                     <button class="nav-link" id="vuln-tab" data-bs-toggle="tab" data-bs-target="#vuln-tab-pane" type="button" role="tab" aria-controls="vuln-tab-pane" aria-selected="false">Vuln</button>
@@ -380,6 +381,25 @@ <h4 class="level mb-0">
                                 {{ end }}
                             </ul>
                         </div>
+                        <div class="col mx-2 p-3 card border-success" style="width: 18rem;">
+                            <div class="card-header d-flex justify-content-between">
+                                Parameter
+                                <button id="special-copy-btn" class="copy_btn btn btn-sm btn-outline-secondary" data-clipboard-target="#para-list">
+                                    <svg width="16" height="16" fill="currentColor" class="bi bi-clipboard">
+                                        <use xlink:href="#clipboard-icon"></use>
+                                    </svg>
+                                </button>
+                            </div>
+                            <ul id="para-list" class="list-group list-group-flush overflow-auto" style="max-height: 30rem;">
+                                {{ if .paras }}
+                                {{range $para := .paras }}
+                                    <li class="list-group-item d-flex justify-content-between align-items-center">{{ $para.Key }}
+                                        <span class="badge bg-success rounded-pill">{{ $para.Value }}</span>
+                                    </li>
+                                {{ end }}
+                                {{ end }}
+                            </ul>
+                        </div>
                         <div class="col mx-2 p-3 card border-success" style="width: 18rem;">
                             <div class="card-header d-flex justify-content-between">
                                 Urls
@@ -437,10 +457,33 @@ <h4 class="level mb-0">
             }, 3000);
         });
 
-        // Display an error message when copying fails
-        clipboard.on('error', function(e) {
-            console.error('Error copying:', e.text);
+        const specialClipboard = new ClipboardJS('#special-copy-btn', {
+            text: function(trigger) {
+                const keys = [...document.querySelectorAll('#para-list .list-group-item')].map(item => {
+                    // 对item的文本进行处理
+                    let parts = item.textContent.split("\n")
+                    if (parts.length === 0) {
+                        return item.textContent
+                    }
+                    return parts[0].trim();
+                });
+                return keys.join('\n');
+            }
         });
+
+        specialClipboard.on('success', function(e) {
+            console.log('特殊复制成功:', e.text);
+            e.clearSelection();
+            // Change the SVG icon to the checkmark
+            const svgIcon = e.trigger.querySelector('svg use');
+            svgIcon.setAttribute('xlink:href', '#checkmark-icon');
+
+            // Restore the original SVG icon after 3 seconds
+            setTimeout(() => {
+                svgIcon.setAttribute('xlink:href', '#clipboard-icon');
+            }, 3000);
+        });
+
     </script>
     <script>
         document.addEventListener("DOMContentLoaded", function () {
diff --git a/SCopilot/web.go b/SCopilot/web.go
index 1a77437..a547377 100644
--- a/SCopilot/web.go
+++ b/SCopilot/web.go
@@ -73,6 +73,11 @@ func handleWebSocket(c *gin.Context) {
     }
 }
 
+type Para struct {
+    Key   string
+    Value interface{}
+}
+
 func Init() {
     logging.Logger.Infoln("Start SCopilot web service at :" + conf.GlobalConfig.Passive.WebPort)
     gin.SetMode("release")
@@ -110,11 +115,18 @@ func Init() {
     authorized.GET("/SCopilot", func(c *gin.Context) {
         host := c.Query("host")
         
+        var paras []Para
+        
+        for _, key := range output.SCopilotMessage[host].CollectionMsg.Parameters.Keys() {
+            value, _ := output.SCopilotMessage[host].CollectionMsg.Parameters.Get(key)
+            paras = append(paras, Para{Key: key, Value: value})
+        }
         c.HTML(http.StatusOK, "SCopilot.html", gin.H{
             "webPort": conf.GlobalConfig.Passive.WebPort,
             "data":    output.SCopilotMessage[host],
             "ipInfo":  output.IPInfoList[output.SCopilotMessage[host].HostNoPort],
             "year":    time.Now().Year(),
+            "paras":   paras,
         })
     })
     
diff --git a/conf/banner.go b/conf/banner.go
index 47fe09a..a0e1482 100644
--- a/conf/banner.go
+++ b/conf/banner.go
@@ -17,4 +17,4 @@ var Banner = `
 
 const Website = "https://github.com/yhy0/Jie"
 
-const Version = "1.1.0"
+const Version = "1.1.1"
diff --git a/conf/file.go b/conf/file.go
index fb8e0c3..53ce06a 100644
--- a/conf/file.go
+++ b/conf/file.go
@@ -31,7 +31,7 @@ http:
   allowRedirect: 0                      # 单个请求最大允许的跳转数，0 则不跳转
   verifySSL: false                      # 是否验证 ssl 证书
   maxQps: 50                            # 每秒最大请求数
-  headers:                              # 全局 http 请求头
+  headers:                              # 指定 http 请求头
   forceHTTP1: false                     # 强制指定使用 http/1.1, 不然会根据服务器选择，如果服务器支持 http2，默认会使用 http2
 
 # 漏洞探测的插件配置
@@ -173,6 +173,68 @@ collection:
   other:
     - "(access.{0,1}key|access.{0,1}Key|access.{0,1}Id|access.{0,1}id|.{0,8}密码|.{0,8}账号|默认.{0,8}|加密|解密|(password|pwd|pass|username|user|name|account):\\s+[\"'].{1,36}['\"])"
     - "['\"](ey[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9._-]{10,}|ey[A-Za-z0-9_\\/+-]{10,}\\.[A-Za-z0-9._\\/+-]{10,})['\"]"
+  sensitiveParameters: # 请求或者回显中一些可能可以利用的参数 不区分大小写
+    - url
+    - host
+    - href
+    - redirect
+    - u
+    - ip
+    - address
+    - addr
+    - file
+    - f
+    - dir
+    - directory
+    - path
+    - router
+    - callback
+    - conf
+    - cfg
+    - config
+    - jdbc
+    - db
+    - sql
+    - api
+    - apikey
+    - api_key
+    - access
+    - key
+    - token
+    - access_token
+    - accessToken
+    - stable_token
+    - authorizer
+    - authorizer_access_token
+    - authorizerAccessToken
+    - appid
+    - appSecret
+    - app_secret
+    - secret
+    - auth
+    - oauth
+    - oauth2
+    - corp
+    - admin
+    - pass
+    - pwd
+    - passwd
+    - password
+    - debug
+    - dbg
+    - exe
+    - exec
+    - execute
+    - load
+    - shell
+    - grant
+    - create
+    - k8s
+    - docker
+    - env
+    - _key  # 这种以 _ 开头的会不完全匹配，包含 _key 就会抛出来
+    - _token
+    - _secret
 `)
 
 // HotConf 使用 viper 对配置热加载
@@ -203,7 +265,7 @@ func Init() {
         }
         logging.Logger.Infof("%s not find, Generate profile.", ConfigFile)
     } else {
-        logging.Logger.Infoln("Load profile ", ConfigFile)
+        logging.Logger.Infoln("Load profile", ConfigFile)
     }
     
     ReadYamlConfig()
@@ -342,5 +404,4 @@ func ReadPlugin() {
     if GlobalConfig.Plugins.NginxAliasTraversal.Enabled {
         Plugin["nginx-alias-traversal"] = true
     }
-    
 }
diff --git a/conf/type.go b/conf/type.go
index 7d9c04e..5d6c2f1 100644
--- a/conf/type.go
+++ b/conf/type.go
@@ -37,15 +37,15 @@ type Options struct {
 }
 
 type Http struct {
-    Proxy           string            `json:"proxy"`   // http/socks5 proxy to use
-    Timeout         int               `json:"timeout"` // Timeout is the seconds to wait for a response from the server.
-    MaxConnsPerHost int               `json:"maxConnsPerHost"`
-    RetryTimes      int               `json:"retryTimes"`
-    AllowRedirect   int               `json:"allowRedirect"`
-    VerifySSL       bool              `json:"verifySSL"`
-    MaxQps          int               `json:"maxQps"` // MaxQps is the maximum number of queries per second.
-    Headers         map[string]string `json:"headers"`
-    ForceHTTP1      bool              `json:"forceHTTP1"` // 强制指定使用 http/1.1
+    Proxy           string            `json:"proxy"`           // 漏洞扫描时使用的代理，如: http://127.0.0.1:8080
+    Timeout         int               `json:"timeout"`         // 建立 tcp 连接的超时时间
+    MaxConnsPerHost int               `json:"maxConnsPerHost"` // 每个 host 最大连接数
+    RetryTimes      int               `json:"retryTimes"`      // 请求失败的重试次数，0 则不重试
+    AllowRedirect   int               `json:"allowRedirect"`   // 单个请求最大允许的跳转数，0 则不跳转
+    VerifySSL       bool              `json:"verifySSL"`       // 是否验证 ssl 证书
+    MaxQps          int               `json:"maxQps"`          // 每秒最大请求数
+    Headers         map[string]string `json:"headers"`         // 指定 http 请求头
+    ForceHTTP1      bool              `json:"forceHTTP1"`      // 强制指定使用 http/1.1
 }
 
 type Passive struct {
@@ -175,15 +175,16 @@ type Sqlmap struct {
 
 // Collection 信息收集中的正则
 type Collection struct {
-    Domain    []string `json:"domain"`
-    IP        []string `json:"ip"`
-    Phone     []string `json:"phone"`
-    Email     []string `json:"email"`
-    IDCard    []string `json:"idCard"`
-    API       []string `json:"api"`
-    Url       []string `json:"url"`
-    UrlFilter []string `json:"urlFilter"`
-    Other     []string `json:"other"`
+    Domain              []string `json:"domain"`
+    IP                  []string `json:"ip"`
+    Phone               []string `json:"phone"`
+    Email               []string `json:"email"`
+    IDCard              []string `json:"idCard"`
+    API                 []string `json:"api"`
+    Url                 []string `json:"url"`
+    UrlFilter           []string `json:"urlFilter"`
+    Other               []string `json:"other"`
+    SensitiveParameters []string `json:"sensitive_parameters"`
 }
 
 type Mitmproxy struct {
diff --git a/go.mod b/go.mod
index 6653464..3ec086e 100644
--- a/go.mod
+++ b/go.mod
@@ -55,6 +55,7 @@ require (
 	github.com/golang-jwt/jwt v3.2.2+incompatible
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
 	github.com/gorilla/websocket v1.5.1
+	github.com/iancoleman/orderedmap v0.3.0
 	github.com/imroc/req/v3 v3.43.2
 	github.com/ipinfo/go/v2 v2.10.0
 	github.com/jlaffaye/ftp v0.2.0
diff --git a/go.sum b/go.sum
index 77aa0c4..9874f68 100644
--- a/go.sum
+++ b/go.sum
@@ -641,6 +641,8 @@ github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpO
 github.com/hudl/fargo v1.3.0/go.mod h1:y3CKSmjA+wD2gak7sUSXTAoopbhU08POFhmITJgmKTg=
 github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358 h1:hVXNJ57IHkOA8FBq80UG263MEBwNUMfS9c82J2QE5UQ=
 github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358/go.mod h1:qBE210J2T9uLXRB3GNc73SvZACDEFAmDCOlDkV47zbY=
+github.com/iancoleman/orderedmap v0.3.0 h1:5cbR2grmZR/DiVt+VJopEhtVs9YGInGIxAoMJn+Ichc=
+github.com/iancoleman/orderedmap v0.3.0/go.mod h1:XuLcCUkdL5owUCQeF2Ue9uuw1EptkJDkXXS7VoV7XGE=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20220319035150-800ac71e25c2/go.mod h1:aYm2/VgdVmcIU8iMfdMvDMsRAQjcfZSKFby6HOFvi/w=
 github.com/icodeface/tls v0.0.0-20230910023335-34df9250cd12 h1:uSJXMFVNfN2hyXDLM19op2fNiCN/nL8xgdmNXgs5738=
@@ -1203,8 +1205,6 @@ github.com/tdewolff/test v1.0.11-0.20231101010635-f1265d231d52 h1:gAQliwn+zJrkjA
 github.com/tdewolff/test v1.0.11-0.20231101010635-f1265d231d52/go.mod h1:6DAvZliBAAnD7rhVgwaM7DE5/d9NMOAJ09SqYqeK4QE=
 github.com/tebeka/strftime v0.1.3 h1:5HQXOqWKYRFfNyBMNVc9z5+QzuBtIXy03psIhtdJYto=
 github.com/tebeka/strftime v0.1.3/go.mod h1:7wJm3dZlpr4l/oVK0t1HYIc4rMzQ2XJlOMIUJUJH6XQ=
-github.com/tetratelabs/wazero v1.7.0 h1:jg5qPydno59wqjpGrHph81lbtHzTrWzwwtD4cD88+hQ=
-github.com/tetratelabs/wazero v1.7.0/go.mod h1:ytl6Zuh20R/eROuyDaGPkp82O9C/DJfXAwJfQ3X6/7Y=
 github.com/tetratelabs/wazero v1.7.1 h1:QtSfd6KLc41DIMpDYlJdoMc6k7QTN246DM2+n2Y/Dx8=
 github.com/tetratelabs/wazero v1.7.1/go.mod h1:ytl6Zuh20R/eROuyDaGPkp82O9C/DJfXAwJfQ3X6/7Y=
 github.com/thoas/go-funk v0.9.3 h1:7+nAEx3kn5ZJcnDm2Bh23N2yOtweO14bi//dvRtgLpw=
diff --git a/pkg/input/input.go b/pkg/input/input.go
index 545b5d3..f2258c5 100644
--- a/pkg/input/input.go
+++ b/pkg/input/input.go
@@ -31,8 +31,8 @@ type CrawlResult struct {
     Fingerprints []string          `json:"fingerprints"` // 指纹，有的扫描插件需要匹配到指纹才会进行扫描
     Source       string            `json:"source"`       // 来源
     File         string            `json:"file"`
-    Kv           string            `json:"kv"`      // 参数名和参数值  user=admin&password=admin
-    Param        []string          `json:"param"`   // 请求中的参数名  user,password，
-    Waf          []string          `json:"waf"`     // 是否存在 waf
-    Archive      map[string]string `json:"archive"` // 从 web.archive.org 获取到的历史 url
+    Kv           string            `json:"kv"`          // 参数名和参数值  user=admin&password=admin
+    ParamNames   []string          `json:"param_names"` // 请求中的参数名  user,password，
+    Waf          []string          `json:"waf"`         // 是否存在 waf
+    Archive      map[string]string `json:"archive"`     // 从 web.archive.org 获取到的历史 url
 }
diff --git a/pkg/output/SCopilot.go b/pkg/output/SCopilot.go
index 70422fd..2d1b3dc 100644
--- a/pkg/output/SCopilot.go
+++ b/pkg/output/SCopilot.go
@@ -100,6 +100,13 @@ func SCopilot(host string, data SCopilotData) {
         SCopilotMessage[host].CollectionMsg.Urls = funk.UniqString(append(SCopilotMessage[host].CollectionMsg.Urls, data.CollectionMsg.Urls...))
         SCopilotMessage[host].CollectionMsg.Api = funk.UniqString(append(SCopilotMessage[host].CollectionMsg.Api, data.CollectionMsg.Api...))
         
+        sort.SliceStable(SCopilotMessage[host].CollectionMsg.Api, func(i, j int) bool {
+            return compareApi(SCopilotMessage[host].CollectionMsg.Api[i], SCopilotMessage[host].CollectionMsg.Api[j])
+        })
+        
+        sort.SliceStable(SCopilotMessage[host].CollectionMsg.Urls, func(i, j int) bool {
+            return compareLinks(SCopilotMessage[host].CollectionMsg.Urls[i], SCopilotMessage[host].CollectionMsg.Urls[j])
+        })
     } else {
         SCopilotMessage[host] = &data
         SCopilotLists = append(SCopilotLists, &SCopilotList{
@@ -124,6 +131,9 @@ func compareLinks(a, b string) bool {
     if err != nil {
         return false
     }
+    // 预处理路径，去除末尾的斜杠
+    aURL.Path = strings.TrimRight(aURL.Path, "/")
+    aURL.Path = strings.TrimRight(aURL.Path, "/")
     aPathComponents := strings.Split(aURL.Path, "/")
     bPathComponents := strings.Split(bURL.Path, "/")
     
@@ -135,3 +145,20 @@ func compareLinks(a, b string) bool {
     
     return len(aPathComponents) < len(bPathComponents)
 }
+
+// 按照目录结构对链接进行排序的比较函数
+func compareApi(a, b string) bool {
+    // 预处理路径，去除末尾的斜杠
+    a = strings.TrimRight(a, "/")
+    b = strings.TrimRight(b, "/")
+    aPathComponents := strings.Split(a, "/")
+    bPathComponents := strings.Split(b, "/")
+    
+    for i := 0; i < len(aPathComponents) && i < len(bPathComponents); i++ {
+        if aPathComponents[i] != bPathComponents[i] {
+            return aPathComponents[i] < bPathComponents[i]
+        }
+    }
+    
+    return len(aPathComponents) < len(bPathComponents)
+}
diff --git a/pkg/output/output.go b/pkg/output/output.go
index 3986690..a2523ad 100644
--- a/pkg/output/output.go
+++ b/pkg/output/output.go
@@ -19,17 +19,17 @@ func Write(progress bool) {
     if progress {
         go Progress()
     }
-
+    
     if conf.GlobalConfig.Options.Output != "" {
         go GenerateVulnReport(conf.GlobalConfig.Options.Output)
     }
-
+    
     for v := range OutChannel {
         // 漏洞保存到文件
         if conf.GlobalConfig.Options.Output != "" {
             ReportMessageChan <- v
         }
-
+        
         // 被动模式下的 SCopilot 结果保存
         if conf.GlobalConfig.Passive.WebPort != "" {
             parse, err := url.Parse(v.VulnData.Target)
@@ -40,7 +40,7 @@ func Write(progress bool) {
             msg := SCopilotData{
                 Target: v.VulnData.Target,
             }
-
+            
             if v.Level == "Low" {
                 msg.InfoMsg = []PluginMsg{
                     {
@@ -54,9 +54,10 @@ func Write(progress bool) {
             } else {
                 msg.VulMessage = append(msg.VulMessage, v)
             }
-
+            
             SCopilot(parse.Host, msg)
-            logging.Logger.Infoln(aurora.Red(v.PrintScreen()).String())
         }
+        
+        logging.Logger.Infoln(aurora.Red(v.PrintScreen()).String())
     }
 }
diff --git a/pkg/output/type.go b/pkg/output/type.go
index 3025f0e..fd4dd32 100644
--- a/pkg/output/type.go
+++ b/pkg/output/type.go
@@ -1,5 +1,7 @@
 package output
 
+import "github.com/iancoleman/orderedmap"
+
 /**
    @author yhy
    @since 2023/10/16
@@ -51,16 +53,17 @@ type SCopilotData struct {
 }
 
 type Collection struct {
-    Subdomain   []string `json:"subdomains"`
-    OtherDomain []string `json:"other_domains"`
-    PublicIp    []string `json:"public_ip"`
-    InnerIp     []string `json:"inner_ip"`
-    Phone       []string `json:"phone"`
-    Email       []string `json:"email"`
-    IdCard      []string `json:"id_card"`
-    Others      []string `json:"others"`
-    Urls        []string `json:"urls"`
-    Api         []string `json:"api"`
+    Subdomain   []string               `json:"subdomains"`
+    OtherDomain []string               `json:"other_domains"`
+    PublicIp    []string               `json:"public_ip"`
+    InnerIp     []string               `json:"inner_ip"`
+    Phone       []string               `json:"phone"`
+    Email       []string               `json:"email"`
+    IdCard      []string               `json:"id_card"`
+    Others      []string               `json:"others"`
+    Urls        []string               `json:"urls"`
+    Api         []string               `json:"api"`
+    Parameters  *orderedmap.OrderedMap `json:"parameters"`
 }
 
 type PluginMsg struct {
diff --git a/pkg/task/task.go b/pkg/task/task.go
index 8337a28..e4a400b 100644
--- a/pkg/task/task.go
+++ b/pkg/task/task.go
@@ -2,6 +2,7 @@ package task
 
 import (
     "fmt"
+    "github.com/iancoleman/orderedmap"
     "github.com/panjf2000/ants/v2"
     regexp "github.com/wasilibs/go-re2"
     "github.com/yhy0/Jie/conf"
@@ -10,6 +11,7 @@ import (
     "github.com/yhy0/Jie/pkg/output"
     "github.com/yhy0/Jie/pkg/protocols/httpx"
     "github.com/yhy0/Jie/pkg/util"
+    "github.com/yhy0/Jie/scan"
     "github.com/yhy0/Jie/scan/Pocs/pocs_go"
     "github.com/yhy0/Jie/scan/gadget/collection"
     "github.com/yhy0/Jie/scan/gadget/jwt"
@@ -231,12 +233,42 @@ func (t *Task) Distribution(in *input.CrawlResult) DistributionTaskFunc {
         if !strings.HasSuffix(in.ParseUrl.Path, ".css") && !strings.HasSuffix(in.ParseUrl.Path, ".js") {
             // 插件扫描
             t.Run(in)
+            t.Lock.Lock()
+            // 收集参数
+            paramNames, err := util.GetReqParameters(in.Method, in.ContentType, in.ParseUrl, []byte(in.RequestBody))
+            
+            if err != nil {
+                logging.Logger.Errorln("GetReqParameters err:", err)
+            } else {
+                in.ParamNames = paramNames
+                // 看请求、返回包中的参数是否包含敏感参数
+                scan.PerFilePlugins["SensitiveParameters"].Scan("", "", in, nil)
+                
+                if output.SCopilotMessage[in.Host].CollectionMsg.Parameters == nil {
+                    output.SCopilotMessage[in.Host].CollectionMsg.Parameters = orderedmap.New()
+                }
+                resParamNames, _ := util.GetResParameters(strings.ToLower(in.Resp.Header.Get("Content-Type")), []byte(in.Resp.Body))
+                paramNames = append(paramNames, resParamNames...)
+                for _, _para := range paramNames {
+                    v, ok := output.SCopilotMessage[in.Host].CollectionMsg.Parameters.Get(_para)
+                    if ok {
+                        output.SCopilotMessage[in.Host].CollectionMsg.Parameters.Set(_para, v.(int)+1)
+                    } else {
+                        output.SCopilotMessage[in.Host].CollectionMsg.Parameters.Set(_para, 0)
+                    }
+                }
+                
+                // 按照value的字典序升序排序
+                output.SCopilotMessage[in.Host].CollectionMsg.Parameters.Sort(func(a *orderedmap.Pair, b *orderedmap.Pair) bool {
+                    return a.Value().(int) > b.Value().(int)
+                })
+            }
+            
             // poc 模块依托于指纹识别，只有识别到对应的指纹才会扫描，所以这里就不插件化了
             if conf.Plugin["poc"] {
-                t.Lock.Lock()
                 t.ScanTask[in.Host].PocPlugin = pocs_go.PocCheck(in.Fingerprints, in.Target, in.Url, in.Ip, t.ScanTask[in.Host].PocPlugin, t.ScanTask[in.Host].Client)
-                t.Lock.Unlock()
             }
+            t.Lock.Unlock()
         } else {
             // 下面这些使用去重逻辑，因为扫描结果不会被别的插件用到
             if isScanned(in.UniqueId) {
diff --git a/pkg/util/uniqueness.go b/pkg/util/uniqueness.go
index 212411e..bef83b9 100644
--- a/pkg/util/uniqueness.go
+++ b/pkg/util/uniqueness.go
@@ -3,8 +3,6 @@ package util
 import (
     "crypto/md5"
     "encoding/hex"
-    "encoding/json"
-    "encoding/xml"
     "github.com/yhy0/Jie/pkg/mitmproxy/go-mitmproxy/proxy"
     "github.com/yhy0/logging"
     "net/url"
@@ -53,43 +51,11 @@ func getRequestKey(req *proxy.Request) (string, error) {
     // 将请求方法和 URL（不包括查询参数）连接在一起
     data := req.Method + req.URL.Scheme + "://" + host + req.URL.Path
     
-    // 提取查询参数的名称  有的即使是 POST 请求，url请求路径中也会存在参数，所以这里全部都要提取
-    var paramNames []string
-    queryParams := req.URL.Query()
-    for paramName := range queryParams {
-        paramNames = append(paramNames, paramName)
-    }
+    // 提取查询参数名
+    paramNames, err := GetReqParameters(req.Method, req.Header.Get("Content-Type"), req.URL, req.Body)
     
-    if req.Method == "POST" {
-        contentType := req.Header.Get("Content-Type")
-        if strings.Contains(contentType, "application/x-www-form-urlencoded") {
-            // 解析 POST 请求的请求体
-            postParams, err := url.ParseQuery(string(req.Body))
-            if err != nil {
-                return "", err
-            }
-            for paramName := range postParams {
-                paramNames = append(paramNames, paramName)
-            }
-        } else if strings.Contains(contentType, "application/json") {
-            var jsonData map[string]interface{}
-            err := json.Unmarshal(req.Body, &jsonData)
-            if err != nil {
-                return "", err
-            }
-            for paramName := range jsonData {
-                paramNames = append(paramNames, paramName)
-            }
-        } else if strings.Contains(contentType, "application/xml") {
-            var xmlData map[string]interface{}
-            err := xml.Unmarshal(req.Body, &xmlData)
-            if err != nil {
-                return "", err
-            }
-            for paramName := range xmlData {
-                paramNames = append(paramNames, paramName)
-            }
-        }
+    if err != nil {
+        return "", err
     }
     
     // 对查询参数名称进行排序，以确保相同的参数集合具有相同的哈希值
diff --git a/pkg/util/url.go b/pkg/util/url.go
new file mode 100644
index 0000000..f61b309
--- /dev/null
+++ b/pkg/util/url.go
@@ -0,0 +1,95 @@
+package util
+
+import (
+    "encoding/json"
+    "encoding/xml"
+    "errors"
+    "net/url"
+    "strings"
+)
+
+/**
+   @author yhy
+   @since 2024/5/14
+   @desc 用于提取 url 中的信息
+**/
+
+func GetReqParameters(method, contentType string, target *url.URL, body []byte) ([]string, error) {
+    // 提取查询参数的名称  有的即使是 POST 请求，url请求路径中也会存在参数，所以这里全部都要提取
+    var paramNames []string
+    queryParams := target.Query()
+    for paramName := range queryParams {
+        paramNames = append(paramNames, paramName)
+    }
+    
+    if strings.ToUpper(method) == "POST" {
+        if strings.Contains(contentType, "application/x-www-form-urlencoded") {
+            // 解析 POST 请求的请求体
+            postParams, err := url.ParseQuery(string(body))
+            if err != nil {
+                return nil, err
+            }
+            for paramName := range postParams {
+                paramNames = append(paramNames, paramName)
+            }
+        } else if strings.Contains(contentType, "application/json") {
+            var jsonData map[string]interface{}
+            err := json.Unmarshal(body, &jsonData)
+            if err != nil {
+                return nil, err
+            }
+            for paramName := range jsonData {
+                paramNames = append(paramNames, paramName)
+            }
+        } else if strings.Contains(contentType, "application/xml") {
+            var xmlData map[string]interface{}
+            err := xml.Unmarshal(body, &xmlData)
+            if err != nil {
+                return nil, err
+            }
+            for paramName := range xmlData {
+                paramNames = append(paramNames, paramName)
+            }
+        }
+    }
+    
+    return paramNames, nil
+}
+
+func GetResParameters(contentType string, body []byte) ([]string, error) {
+    // 提取查询参数的名称  有的即使是 POST 请求，url请求路径中也会存在参数，所以这里全部都要提取
+    var paramNames []string
+    
+    if strings.Contains(contentType, "application/x-www-form-urlencoded") {
+        // 解析 POST 请求的请求体
+        postParams, err := url.ParseQuery(string(body))
+        if err != nil {
+            return nil, err
+        }
+        for paramName := range postParams {
+            paramNames = append(paramNames, paramName)
+        }
+    } else if strings.Contains(contentType, "application/json") {
+        var jsonData map[string]interface{}
+        err := json.Unmarshal(body, &jsonData)
+        if err != nil {
+            return nil, err
+        }
+        for paramName := range jsonData {
+            paramNames = append(paramNames, paramName)
+        }
+    } else if strings.Contains(contentType, "application/xml") {
+        var xmlData map[string]interface{}
+        err := xml.Unmarshal(body, &xmlData)
+        if err != nil {
+            return nil, err
+        }
+        for paramName := range xmlData {
+            paramNames = append(paramNames, paramName)
+        }
+    } else {
+        return nil, errors.New("unsupported content type")
+    }
+    
+    return paramNames, nil
+}
diff --git a/pkg/util/util.go b/pkg/util/util.go
index 51e377f..5b6baf0 100644
--- a/pkg/util/util.go
+++ b/pkg/util/util.go
@@ -32,49 +32,6 @@ func Contains(stringA, stringB string) bool {
     return strings.Contains(strings.ToLower(stringA), strings.ToLower(stringB))
 }
 
-func Difference(slice1, slice2 []string) []string {
-    intersect := func(slice1, slice2 []string) []string {
-        m := make(map[string]int)
-        nn := make([]string, 0)
-        for _, v := range slice1 {
-            m[v]++
-        }
-
-        for _, v := range slice2 {
-            times, _ := m[v]
-            if times == 1 {
-                nn = append(nn, v)
-            }
-        }
-        return nn
-    }
-
-    m := make(map[string]int)
-    nn := make([]string, 0)
-    inter := intersect(slice1, slice2)
-    for _, v := range inter {
-        m[v]++
-    }
-
-    for _, value := range slice1 {
-        times, _ := m[value]
-        if times == 0 {
-            nn = append(nn, value)
-        }
-    }
-    return nn
-}
-
-func InMap(target string, strs map[string]string) bool {
-    for k, _ := range strs {
-        k = strings.TrimSpace(k)
-        if Contains(target, k) {
-            return true
-        }
-    }
-    return false
-}
-
 // SliceInCaseFold 判断一个字符串是否在另一个字符数组里面，存在返回true
 // target 中是否包含 strs 中的某一个
 // 这个是 target 范围大， element只是一个子串
@@ -106,6 +63,15 @@ func InSlice(slice []string, word string) bool {
     return false
 }
 
+func InCaseFoldSlice(slice []string, word string, ) bool {
+    for _, element := range slice {
+        if strings.ToLower(element) == strings.ToLower(word) {
+            return true
+        }
+    }
+    return false
+}
+
 func IntInSlice(i int, slice []int) bool {
     if slice == nil {
         return false
@@ -149,12 +115,12 @@ func IsInnerIP(ip string) bool {
 // Cidr2IPs C段转ip
 func Cidr2IPs(cidr string) []string {
     var ips []string
-
+    
     ipAddr, ipNet, err := net.ParseCIDR(cidr)
     if err != nil {
         logging.Logger.Print(err)
     }
-
+    
     for ip := ipAddr.Mask(ipNet.Mask); ipNet.Contains(ip); increment(ip) {
         ips = append(ips, ip.String())
     }
@@ -172,27 +138,27 @@ func increment(ip net.IP) {
 
 func StructureIps(ipsTmp []string, num int) (ips []string) {
     ipMap := make(map[string]int)
-
+    
     for _, ip := range ipsTmp {
         front := ip[:strings.LastIndex(ip, ".")] + ".0"
-
+        
         if _, ok := ipMap[front]; ok {
             ipMap[front] += 1
         } else {
             ipMap[front] = 1
         }
     }
-
+    
     for k, v := range ipMap {
         if v > num { // 一个 ip 段大于 15 个ip，才会将此段加入检测列表中
             ips = append(ips, Cidr2IPs(k+"/24")...)
         }
     }
-
+    
     ipMap = nil
-
+    
     ips = append(ips, ipsTmp...)
-
+    
     return funk.UniqString(ips)
 }
 
@@ -206,7 +172,7 @@ func ToStringSlice(actual interface{}) ([]string, error) {
         res = append(res, value.Index(i).Interface().(string))
     }
     return res, nil
-
+    
 }
 
 func CheckErrs(err error) bool {
@@ -237,13 +203,13 @@ func Hostname(target string) string {
         logging.Logger.Errorln("Hostname: ", err)
         return target
     }
-
+    
     return u.Hostname()
 }
 
 func FormatTarget(target string) (targets []string) {
     targets_tmp := strings.Split(target, "\n")
-
+    
     if strings.Contains(target, ",") {
         for _, t := range targets_tmp {
             ts := strings.Split(t, ",")
@@ -252,7 +218,7 @@ func FormatTarget(target string) (targets []string) {
     } else {
         targets = targets_tmp
     }
-
+    
     return funk.UniqString(targets)
 }
 
@@ -281,6 +247,7 @@ func CvtUps(s string) []UserPass {
     }
     return aRst
 }
+
 func CvtLines(s string) []string {
     return strings.Split(s, "\n")
 }
@@ -349,6 +316,49 @@ func RemoveQuotation(str []string) []string {
         s = strings.TrimRight(s, `'`)
         res = append(res, s)
     }
-
+    
     return res
 }
+
+func Difference(slice1, slice2 []string) []string {
+    intersect := func(slice1, slice2 []string) []string {
+        m := make(map[string]int)
+        nn := make([]string, 0)
+        for _, v := range slice1 {
+            m[v]++
+        }
+        
+        for _, v := range slice2 {
+            times, _ := m[v]
+            if times == 1 {
+                nn = append(nn, v)
+            }
+        }
+        return nn
+    }
+    
+    m := make(map[string]int)
+    nn := make([]string, 0)
+    inter := intersect(slice1, slice2)
+    for _, v := range inter {
+        m[v]++
+    }
+    
+    for _, value := range slice1 {
+        times, _ := m[value]
+        if times == 0 {
+            nn = append(nn, value)
+        }
+    }
+    return nn
+}
+
+func InMap(target string, strs map[string]string) bool {
+    for k, _ := range strs {
+        k = strings.TrimSpace(k)
+        if Contains(target, k) {
+            return true
+        }
+    }
+    return false
+}
diff --git a/scan/gadget/collection/sensitive.go b/scan/gadget/collection/sensitive.go
new file mode 100644
index 0000000..30bc982
--- /dev/null
+++ b/scan/gadget/collection/sensitive.go
@@ -0,0 +1,88 @@
+package collection
+
+import (
+    "github.com/yhy0/Jie/conf"
+    "github.com/yhy0/Jie/pkg/input"
+    "github.com/yhy0/Jie/pkg/output"
+    "github.com/yhy0/Jie/pkg/protocols/httpx"
+    "github.com/yhy0/Jie/pkg/util"
+    "strings"
+    "sync"
+    "time"
+)
+
+/**
+   @author yhy
+   @since 2024/5/15
+   @desc 敏感参数
+**/
+
+type Plugin struct {
+    SeenRequests sync.Map
+}
+
+func (p *Plugin) Scan(target string, path string, in *input.CrawlResult, client *httpx.Client) {
+    if p.IsScanned(in.UniqueId) {
+        return
+    }
+    
+    SensitiveParameters(in)
+}
+
+func (p *Plugin) IsScanned(key string) bool {
+    if key == "" {
+        return false
+    }
+    if _, ok := p.SeenRequests.Load(key); ok {
+        return true
+    }
+    p.SeenRequests.Store(key, true)
+    return false
+}
+
+func (p *Plugin) Name() string {
+    return "SensitiveParameters"
+}
+
+func SensitiveParameters(in *input.CrawlResult) {
+    var sensitiveParameters, rawRequest, rawResponse string
+    resParameters, _ := util.GetResParameters(strings.ToLower(in.Resp.Header.Get("Content-Type")), []byte(in.Resp.Body))
+    
+    for _, para := range conf.GlobalConfig.Collection.SensitiveParameters {
+        if strings.HasPrefix(para, "_") {
+            if util.InSliceCaseFold(para, in.ParamNames) {
+                rawRequest = in.RawRequest
+                sensitiveParameters += para + " "
+            }
+            
+            if util.InSliceCaseFold(para, resParameters) {
+                rawResponse = in.RawResponse
+                sensitiveParameters += para + " "
+            }
+        } else {
+            if util.InCaseFoldSlice(in.ParamNames, para) {
+                rawRequest = in.RawRequest
+                sensitiveParameters += para + " "
+            }
+            if util.InCaseFoldSlice(resParameters, para) {
+                rawResponse = in.RawResponse
+                sensitiveParameters += para + " "
+            }
+        }
+    }
+    if sensitiveParameters != "" {
+        output.OutChannel <- output.VulMessage{
+            DataType: "web_vul",
+            Plugin:   "SensitiveParameters",
+            VulnData: output.VulnData{
+                CreateTime: time.Now().Format("2006-01-02 15:04:05"),
+                Target:     in.Url,
+                Method:     in.Method,
+                Payload:    sensitiveParameters,
+                Request:    rawRequest,
+                Response:   rawResponse,
+            },
+            Level: output.Low,
+        }
+    }
+}
diff --git a/scan/plugins.go b/scan/plugins.go
index 3e07918..fdae571 100644
--- a/scan/plugins.go
+++ b/scan/plugins.go
@@ -16,6 +16,7 @@ import (
     "github.com/yhy0/Jie/scan/PerServer/portScan"
     "github.com/yhy0/Jie/scan/bbscan"
     "github.com/yhy0/Jie/scan/gadget/bypass403"
+    "github.com/yhy0/Jie/scan/gadget/collection"
 )
 
 /**
@@ -45,6 +46,8 @@ func init() {
     PerFilePlugins["fastjson"] = &fastjson.Plugin{}
     PerFilePlugins["bypass403"] = &bypass403.Plugin{}
     
+    PerFilePlugins["SensitiveParameters"] = &collection.Plugin{} // 这个不受开关控制
+    
     PerFolderPlugins["crlf"] = &crlf.Plugin{}
     PerFolderPlugins["iis"] = &crlf.Plugin{}
     PerFolderPlugins["nginx-alias-traversal"] = &traversal.Plugin{}
diff --git a/Jie_config.yaml b/test/Jie_config.yaml
similarity index 90%
rename from Jie_config.yaml
rename to test/Jie_config.yaml
index 4d5892d..25d10c4 100644
--- a/Jie_config.yaml
+++ b/test/Jie_config.yaml
@@ -1,4 +1,4 @@
-version: 1.0.4
+version: 1.1.1
 
 parallel: 10                            # 同时扫描的最大 url 个数
 
@@ -11,7 +11,7 @@ http:
   allowRedirect: 0                      # 单个请求最大允许的跳转数，0 则不跳转
   verifySSL: false                      # 是否验证 ssl 证书
   maxQps: 50                            # 每秒最大请求数
-  headers:                              # 全局 http 请求头
+  headers:                              # 指定 http 请求头
   forceHTTP1: false                     # 强制指定使用 http/1.1, 不然会根据服务器选择，如果服务器支持 http2，默认会使用 http2
 
 # 漏洞探测的插件配置
@@ -153,3 +153,65 @@ collection:
   other:
     - "(access.{0,1}key|access.{0,1}Key|access.{0,1}Id|access.{0,1}id|.{0,8}密码|.{0,8}账号|默认.{0,8}|加密|解密|(password|pwd|pass|username|user|name|account):\\s+[\"'].{1,36}['\"])"
     - "['\"](ey[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9._-]{10,}|ey[A-Za-z0-9_\\/+-]{10,}\\.[A-Za-z0-9._\\/+-]{10,})['\"]"
+  sensitiveParameters: # 请求或者回显中一些可能可以利用的参数 不区分大小写
+    - url
+    - host
+    - href
+    - redirect
+    - u
+    - ip
+    - address
+    - addr
+    - file
+    - f
+    - dir
+    - directory
+    - path
+    - router
+    - callback
+    - conf
+    - cfg
+    - config
+    - jdbc
+    - db
+    - sql
+    - api
+    - apikey
+    - api_key
+    - access
+    - key
+    - token
+    - access_token
+    - accessToken
+    - stable_token
+    - authorizer
+    - authorizer_access_token
+    - authorizerAccessToken
+    - appid
+    - appSecret
+    - app_secret
+    - secret
+    - auth
+    - oauth
+    - oauth2
+    - corp
+    - admin
+    - pass
+    - pwd
+    - passwd
+    - password
+    - debug
+    - dbg
+    - exe
+    - exec
+    - execute
+    - load
+    - shell
+    - grant
+    - create
+    - k8s
+    - docker
+    - env
+    - _key  # 这种以 _ 开头的会不完全匹配，包含 _key 就会抛出来
+    - _token
+    - _secret
diff --git a/test/web_test.go b/test/web_test.go
new file mode 100644
index 0000000..1daa47b
--- /dev/null
+++ b/test/web_test.go
@@ -0,0 +1,140 @@
+package test
+
+import (
+    "github.com/iancoleman/orderedmap"
+    "github.com/yhy0/Jie/SCopilot"
+    "github.com/yhy0/Jie/conf"
+    "github.com/yhy0/Jie/pkg/input"
+    "github.com/yhy0/Jie/pkg/output"
+    "github.com/yhy0/Jie/pkg/protocols/httpx"
+    "github.com/yhy0/Jie/scan"
+    "github.com/yhy0/logging"
+    "net/http"
+    "testing"
+)
+
+/**
+   @author yhy
+   @since 2024/5/13
+   @desc //TODO
+**/
+
+func TestWeb(t *testing.T) {
+    logging.Logger = logging.New(true, "", "web", true)
+    conf.Init()
+    conf.GlobalConfig.Passive.WebPort = "9088"
+    conf.GlobalConfig.Passive.WebUser = "yhy"
+    conf.GlobalConfig.Passive.WebPass = "123"
+    paras := orderedmap.New()
+    
+    paramNames := []string{"id", "url", "cunt", "appid", "id", "appid", "id", "op", "token"}
+    for _, _para := range paramNames {
+        v, ok := paras.Get(_para)
+        if ok {
+            paras.Set(_para, v.(int)+1)
+        } else {
+            paras.Set(_para, 1)
+        }
+    }
+    
+    // 按照value的字典序升序排序
+    paras.Sort(func(a *orderedmap.Pair, b *orderedmap.Pair) bool {
+        return a.Value().(int) > b.Value().(int)
+    })
+    
+    msg := output.SCopilotData{
+        Target:     "example.com",
+        Ip:         "192.168.0.1",
+        HostNoPort: "example.com",
+        SiteMap: []string{
+            "https://example.com/",
+            "https://example.com/about",
+            "https://example.com/contact",
+            "https://example.com/about/1",
+            "https://example.com/about/2",
+            "https://example.com/about/1?id=1",
+        },
+        Fingerprints: []string{
+            "Apache/2.4.29 (Ubuntu)",
+            "PHP/7.2.24",
+        },
+        VulMessage: []output.VulMessage{
+            {
+                DataType: "vuln",
+                VulnData: output.VulnData{
+                    CreateTime:  "2022-01-01 10:00:00",
+                    VulnType:    "SQL Injection",
+                    Target:      "example.com",
+                    Ip:          "192.168.0.1",
+                    Method:      "POST",
+                    Param:       "id",
+                    Payload:     "1' OR '1'='1",
+                    CURLCommand: "curl -X POST -d 'id=1' OR '1'='1' http://example.com",
+                    Description: "This is a SQL Injection vulnerability.",
+                    Request:     "POST /login HTTP/1.1\nHost: example.com\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 7\n\nid=1",
+                    Header:      "HTTP/1.1 200 OK\nContent-Type: text/html\n\n",
+                    Response:    "<html><body>Invalid credentials</body></html>",
+                },
+                Plugin: "SQL Injection Scanner",
+                Level:  output.High,
+            },
+        },
+        VulPlugin: map[string]int{
+            "SQL Injection Scanner": 1,
+        },
+        InfoMsg: []output.PluginMsg{
+            {
+                Url:      "http://example.com/about",
+                Plugin:   "Information Disclosure Scanner",
+                Result:   []string{"Sensitive information exposed."},
+                Request:  "GET /about HTTP/1.1\nHost: example.com\n\n",
+                Response: "<html><body>About page content</body></html>",
+            },
+        },
+        InfoPlugin: map[string]int{
+            "Information Disclosure Scanner": 1,
+        },
+        PluginMsg: []output.PluginMsg{
+            {
+                Url:      "http://example.com/contact",
+                Plugin:   "Contact Form Vulnerability Scanner",
+                Result:   []string{"Contact form is vulnerable to XSS."},
+                Request:  "POST /contact HTTP/1.1\nHost: example.com\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 20\n\nmessage=<script>alert('XSS')</script>",
+                Response: "<html><body>Thank you for your message.</body></html>",
+            },
+        },
+        CollectionMsg: output.Collection{
+            Subdomain:   []string{"sub1.example.com", "sub2.example.com"},
+            OtherDomain: []string{"example.net", "example.org"},
+            PublicIp:    []string{"203.0.113.1", "203.0.113.2"},
+            InnerIp:     []string{"192.168.0.2", "192.168.0.3"},
+            Phone:       []string{"1234567890", "0987654321"},
+            Email:       []string{"test@example.com", "info@example.com"},
+            IdCard:      []string{"123456789012345678", "987654321098765432"},
+            Others:      []string{"data1", "data2"},
+            Api:         []string{"/api/v1/book", "/api/v1/", "/api/v2/2", "/api/v1/2/", "/api/v1/book/1"},
+            Urls:        []string{"http://api.example.com", "https://api.example.com"},
+            Parameters:  paras,
+        },
+    }
+    header := make(http.Header)
+    header["Content-Type"] = []string{"application/json"}
+    in := &input.CrawlResult{
+        Url:        "http://example.com/login?token=admin",
+        Method:     "POST",
+        ParamNames: paramNames,
+        RawRequest: "POST /login?token=admin HTTP/1.1\nHost: example.com\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 7\n\nid=1",
+        Resp: &httpx.Response{
+            Header: header,
+            Body:   "{\"id\": 1,\"key\":\"test\"}",
+        },
+        RawResponse: "{\"id\": 1,\"key\":\"test\"}",
+    }
+    // 结果输出
+    go output.Write(true)
+    
+    scan.PerFilePlugins["SensitiveParameters"].Scan("", "", in, nil)
+    
+    output.SCopilot("example.com", msg)
+    SCopilot.Init()
+}