【信息收集】ARL灯塔搭建教程-联动vscan自动化漏洞扫描

发布于2025年6月5日2025年7月19日作者:cve-20

【信息收集】ARL灯塔搭建教程-联动vscan自动化漏洞扫描

原创网络攻防情报小组 C4安全团队 2025-06-05 15:37

安装环境：Ubuntu

灯塔安装docker容器下载链接：

https://pan.xunlei.com/s/VONOpsG-EUyAvbg9jWdGZ_6OA1?pwd=gdmz#

将上面的容器文件tar包和ARL的压缩包zip包下载下来，先解压zip文件

再使用docker命令加载下载下来的tar包：

进入zip解压后的ARL下面的docker目录，使用命令创建

之后使用docker-compose up -d启动ARL

启动成功

漏洞扫描工具vscan下载地址：

https://github.com/youki992/VscanPlus/releases

建议下载v1.0.4.2版本，选择Linux可执行文件

因为ARL自带的Centos容器版本较老，
v1.0.4.2以上的
版本编译的vscan运行会提示更新GLIBC，非常麻烦不建议尝试

重命名下载的vscanPlus为vscan，复制到ARL对应的三个容器中：

arl_web、arl_worker、arl_scheduler，目录都是一样的

docker cp vscan arl_web:/usr/bin/vscan
docker cp vscan arl_worker:/usr/bin/vscan
docker cp vscan arl_scheduler:/usr/bin/vscan

然后把漏洞扫描的逻辑文件nuclei_scan.py，也按同理复制到三个容器中

下载地址如下：

https://cowtransfer.com/s/739a8b4c12a44d，或访问奶牛快传 cowtransfer.com 输入传输口令 rl0omb

复制命令如下

docker cp nuclei_scan.py arl_web:/code/app/services/nuclei_scan.py
docker cp nuclei_scan.py arl_worker:/code/app/services/nuclei_scan.py
docker cp nuclei_scan.py arl_scheduler:/code/app/services/nuclei_scan.py

然后给这三个容器配置libpcap环境，这里以其中一个环境为例

因为Centos版本较老，首先需要更换yum源

在/etc/yum.repos.d文件夹下新建CentOS-Base.repo文件

写入内容如下

# CentOS-Base.repo
#
# The mirror system uses the connecting IP address of the client and the
# update status of each mirror to pick mirrors that are updated to and
# geographically close to the client.  You should use this for CentOS updates
# unless you are manually picking other mirrors.
#
# If the mirrorlist= does not work for you, as a fall back you can try the 
# remarked out baseurl= line instead.
#
#

[base]
name=CentOS-$releasever - Base
mirrorlist=http://vault.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra
baseurl=http://vault.centos.org/centos/$releasever/os/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

#released updates 
[updates]
name=CentOS-$releasever - Updates
mirrorlist=http://vault.centos.org/?release=$releasever&arch=$basearch&repo=updates&infra=$infra
baseurl=http://vault.centos.org/centos/$releasever/updates/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

#additional packages that may be useful
[extras]
name=CentOS-$releasever - Extras
mirrorlist=http://vault.centos.org/?release=$releasever&arch=$basearch&repo=extras&infra=$infra
baseurl=http://vault.centos.org/centos/$releasever/extras/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-$releasever - Plus
mirrorlist=http://vault.centos.org/?release=$releasever&arch=$basearch&repo=centosplus&infra=$infra
baseurl=http://vault.centos.org/centos/$releasever/centosplus/$basearch/
gpgcheck=1
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

之后更新yum源