API key：

1986ad8c0a5b3df4d7028d5f3c06e936c327b6aa44f4848198670eee1900911fe

参考

在一个创建好的目标上运行扫描

curl -k -i --request POST --url https://127.0.0.1:3443/api/v1/scans --header "X-Auth: API_KEY" --header "content-type: application/json" --data "{\"target_id\":\"07674c74-728e-4e99-aa9c-b5ac238975b9\",\"profile_id\":\"11111111-1111-1111-1111-111111111111\",\"schedule\":{\"disable\":false,\"start_date\":null,\"time_sensitive\":false}}"

终于搞明白了，就是创建一个target，然后配置他的configure，把headers和session塞给他

第一步，创建target

POST /api/v1/targets HTTP/1.1

Host: 104.238.171.11:13443

Connection: close

Content-Length: 118

Accept: application/json, text/plain, */*

Origin: https://104.238.171.11:13443

X-Auth: 2986ad8c0a5b3df4d7028d5f3c06e936c5deb4610b207c1fcc9464d728e6609f73317ebbe6dd7302d6133799ade40ae7a18dd79c78c0c1e34840f2940b5cf9775

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36

Content-Type: application/json;charset=UTF-8

Sec-Fetch-Site: same-origin

Sec-Fetch-Mode: cors

Referer: https://104.238.171.11:13443/

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Cookie: ui_session=2986ad8c0a5b3df4d7028d5f3c06e936c5deb4610b207c1fcc9464d728e6609f73317ebbe6dd7302d6133799ade40ae7a18dd79c78c0c1e34840f2940b5cf9775

{"address":"http://45.77.224.25:8082/vulnerabilities/sqli/?id=2222&Submit=Submit","description":"","criticality":"10"}

会返回target_id

下一步，配置config

PATCH /api/v1/targets/feb2d95d-ffa2-46ad-b2bc-4a62ca064a7d/configuration HTTP/1.1

Host: 104.238.171.11:13443

Connection: close

Content-Length: 442

Accept: application/json, text/plain, */*

Origin: https://104.238.171.11:13443

X-Auth: 2986ad8c0a5b3df4d7028d5f3c06e936c5deb4610b207c1fcc9464d728e6609f73317ebbe6dd7302d6133799ade40ae7a18dd79c78c0c1e34840f2940b5cf9775

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36

Content-Type: application/json;charset=UTF-8

Sec-Fetch-Site: same-origin

Sec-Fetch-Mode: cors

Referer: https://104.238.171.11:13443/

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Cookie: ui_session=2986ad8c0a5b3df4d7028d5f3c06e936c5deb4610b207c1fcc9464d728e6609f73317ebbe6dd7302d6133799ade40ae7a18dd79c78c0c1e34840f2940b5cf9775

{"issue_tracker_id":"","technologies":[],"custom_headers":["User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0","Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"custom_cookies":[{"url":"http://45.77.224.25:8082/vulnerabilities/sqli/?id=2222&Submit=Submit","cookie":"security_level=0; PHPSESSID=afbht1scro6egdakgju6e9k3p0; security=low"}],"debug":false,"excluded_hours_id":""}

发起扫描

POST /api/v1/scans HTTP/1.1

Host: 104.238.171.11:13443

Connection: close

Content-Length: 225

Accept: application/json, text/plain, */*

Origin: https://104.238.171.11:13443

X-Auth: 2986ad8c0a5b3df4d7028d5f3c06e936c5deb4610b207c1fcc9464d728e6609f73317ebbe6dd7302d6133799ade40ae7a18dd79c78c0c1e34840f2940b5cf9775

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36

Content-Type: application/json;charset=UTF-8

Sec-Fetch-Site: same-origin

Sec-Fetch-Mode: cors

Referer: https://104.238.171.11:13443/

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Cookie: ui_session=2986ad8c0a5b3df4d7028d5f3c06e936c5deb4610b207c1fcc9464d728e6609f73317ebbe6dd7302d6133799ade40ae7a18dd79c78c0c1e34840f2940b5cf9775

{"target_id":"feb2d95d-ffa2-46ad-b2bc-4a62ca064a7d","profile_id":"11111111-1111-1111-1111-111111111111","schedule":{"disable":false,"start_date":null,"time_sensitive":false},"ui_session_id":"5681ab9730dbb11605a451a7dfcc2fd1"}