mirror of
https://github.com/sywinksvg/cnvd-skill.git
synced 2026-10-29 20:10:49 +00:00
sywinksvg
5533c92307
通用型未授权漏洞广扫方法论与工具集：
- skills/cnvd/SKILL.md 流程/原则/合规红线
- tools/scripts/ 9 个纯标准库 Python 脚本
(FOFA 多通道测绘 / HTTP·RTSP·FTP 只读探针
/ 抽验 / RTSP 真拉流四步确认 / Bing 检索)
- tools/rules/ 8 文件 28 条端点字典
- 示例产出/ 脱敏格式样例（RFC 5737 保留段）
- 校验.bat 环境自检 + 冒烟测试
仅用于授权范围内的 CNVD 漏洞提交。
78 lines
3.5 KiB
JSON
78 lines
3.5 KiB
JSON
{
|
|
"_comment": "通用未授权端点字典 (2026-08-22)。新产品线无专属字典时起步用; 命中后按设备页面再挖专属端点。判据: HTTP 双差分+字段验证(脚本内建)。",
|
|
"rules": [
|
|
{
|
|
"id": "conf-read",
|
|
"name": "配置文件/备份未授权读取(含口令)",
|
|
"type": "http", "severity": "high", "method": "GET",
|
|
"paths": ["/config.bin", "/config.json", "/backup.conf", "/device.conf", "/system.ini",
|
|
"/webconfig", "/config.xml", "/backup/", "/export/config",
|
|
"/download/config.tar.gz", "/cgi-bin/DownloadCfg/RouterCfm.cfg"],
|
|
"match_any": ["password", "passwd", "wifi_key", "secret", "adminpass"],
|
|
"exclude_any": ["login", "unauthorized", "401", "404", "forbidden",
|
|
"javascript", "function(", "<html", "<!doctype", "login.html"],
|
|
"fake_hints": ["example", "localhost", "placeholder", "your_", "xxxx"],
|
|
"min_len": 200,
|
|
"note": "响应含真实口令/密钥明文 → 未授权读敏感配置, 高危"
|
|
},
|
|
{
|
|
"id": "passwd-traversal",
|
|
"name": "路径穿越读系统文件",
|
|
"type": "http", "severity": "high", "method": "GET",
|
|
"paths": ["/%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd", "/../../../../etc/passwd",
|
|
"/cgi-bin/../../../../etc/passwd", "/download?file=../../../../etc/passwd"],
|
|
"match_any": ["root:"],
|
|
"exclude_any": ["login", "404", "not found"],
|
|
"fake_hints": [],
|
|
"min_len": 10,
|
|
"note": "响应含 root: 行 → 任意文件读取, 高危"
|
|
},
|
|
{
|
|
"id": "api-sensitive",
|
|
"name": "API未授权返回敏感信息",
|
|
"type": "http", "severity": "mid", "method": "GET",
|
|
"paths": ["/api/v1/system/info", "/api/device/info", "/api/system/status",
|
|
"/cgi-bin/status.cgi", "/api/v1/device", "/status.json"],
|
|
"match_any": ["password", "passwd", "token", "secret", "key", "ssid"],
|
|
"exclude_any": ["login", "unauthorized", "401"],
|
|
"fake_hints": ["example", "localhost"],
|
|
"min_len": 30,
|
|
"note": "API 返回明文口令/密钥/令牌 → 中危起步, 内容更敏感可提级"
|
|
},
|
|
{
|
|
"id": "userlist",
|
|
"name": "用户列表未授权读取",
|
|
"type": "http", "severity": "mid", "method": "GET",
|
|
"paths": ["/api/users", "/api/v1/users", "/user/list", "/cgi-bin/get_user_list", "/users.json"],
|
|
"match_any": ["username", "user_id", "userid"],
|
|
"exclude_any": ["login", "unauthorized", "401", "404"],
|
|
"fake_hints": [],
|
|
"min_len": 30,
|
|
"note": "未授权枚举全部用户 → 中危"
|
|
},
|
|
{
|
|
"id": "backup-open",
|
|
"name": "备份/导出目录可访问",
|
|
"type": "http", "severity": "mid", "method": "GET",
|
|
"paths": ["/backup/", "/export/", "/download/", "/files/", "/log/"],
|
|
"match_any": [],
|
|
"exclude_any": ["login", "unauthorized", "401", "404", "403"],
|
|
"fake_hints": [],
|
|
"min_len": 100,
|
|
"note": "目录列表/文件可下 → needs_review 人工裁决(含配置=高危)"
|
|
},
|
|
{
|
|
"id": "rtsp-unauth",
|
|
"name": "RTSP 视频流未授权观看",
|
|
"type": "rtsp", "severity": "high", "port": 554,
|
|
"note": "DESCRIBE 200 且 SDP 含 v=0+m=video/audio = 无认证可拉流, 高危(v2 严格判据)"
|
|
},
|
|
{
|
|
"id": "ftp-anon",
|
|
"name": "FTP 匿名登录",
|
|
"type": "ftp", "severity": "mid", "port": 21,
|
|
"note": "anonymous 230 → 按目录内容定级: 含配置/固件=高危; 空目录=降级记录"
|
|
}
|
|
]
|
|
}
|