How edgesecurityteam/ehole works
EHole is a command-line asset fingerprinting tool with two main workflows: collect targets from a local file, a single URL, or FOFA and scan them for web-system fingerprints; or query FOFA and export asset details to XLSX. The scan fetches HTTP responses, follows discovered JavaScript URLs, checks configurable body/header/title and favicon rules, and reports matches and results. The graph reflects sampled command, source, scan, and HTTP code; some supporting modules are included based on the repository tree and documented capabilities, so their internal wiring is left unspecified where not sampled.
Main entry points: finger/finger.go Concurrent scanner · cmd/finger.go Fingerprint command · http.go HTTP response fetch · fofa.go FOFA asset search
Components 22
CLI workflows
- Program entry
main.go - Command setup
cmd/root.go - Fingerprint command
cmd/finger.go - FOFA export command
cmd/fofaext.go
Asset collection
- Local target reader
module/finger/source/localfile.go - FOFA asset search
module/finger/source/fofa.go - FOFA API
- FOFA credentials
config.ini
Fingerprint scan
- Concurrent scanner
module/finger/finger.go - URL work queue
module/queue/queue.go - HTTP response fetch
module/finger/http.go - Response decoding
module/finger/encoding.go - JavaScript discovery
module/finger/jsjump.go - Favicon hashing
module/finger/faviconhash.go - Fingerprint matcher
module/finger/matchfinger.go - Rule loading
module/finger/getfingerfile.go - Fingerprint rules
finger.json
Results and export
- Scan results
module/finger/finger.go - Scan result writer
module/finger/output.go - FOFA XLSX writer
module/fofaext/fofaext.go - XLSX file
Other components
- Operator
Connections 24
- Operator → Program entry: runs
- Program entry → Command setup: executes
- Operator → Fingerprint command: selects scan
- Command setup → Fingerprint command: registers
- Command setup → FOFA export command: registers
- Fingerprint command → Local target reader: reads targets
- Fingerprint command → FOFA asset search: requests targets
- Fingerprint command → Concurrent scanner: starts scan
- FOFA asset search → FOFA credentials: reads credentials
- FOFA asset search → FOFA API: queries
- FOFA export command → FOFA asset search: requests assets
- FOFA export command → FOFA XLSX writer: passes results
- FOFA XLSX writer → XLSX file: writes
- Concurrent scanner → URL work queue: queues targets
- Concurrent scanner → HTTP response fetch: fetches URL
- HTTP response fetch → Response decoding: decodes body
- HTTP response fetch → JavaScript discovery: extracts JS URLs
- HTTP response fetch → Favicon hashing: gets favicon hash
- Concurrent scanner → Rule loading: loads rules
- Rule loading → Fingerprint rules: reads
- Concurrent scanner → Fingerprint matcher: matches response
- Concurrent scanner → Scan results: collects findings
- Concurrent scanner → Scan result writer: writes results
- Scan result writer → XLSX file: exports XLSX