mirror of
https://github.com/sywinksvg/cnvd-skill.git
synced 2026-11-04 15:00:50 +00:00
sywinksvg
5533c92307
通用型未授权漏洞广扫方法论与工具集：
- skills/cnvd/SKILL.md 流程/原则/合规红线
- tools/scripts/ 9 个纯标准库 Python 脚本
(FOFA 多通道测绘 / HTTP·RTSP·FTP 只读探针
/ 抽验 / RTSP 真拉流四步确认 / Bing 检索)
- tools/rules/ 8 文件 28 条端点字典
- 示例产出/ 脱敏格式样例（RFC 5737 保留段）
- 校验.bat 环境自检 + 冒烟测试
仅用于授权范围内的 CNVD 漏洞提交。
16 lines
443 B
JSON
16 lines
443 B
JSON
{
|
|
"rules": [
|
|
{
|
|
"id": "superpw-qr",
|
|
"name": "超级密码兑换码未授权泄露",
|
|
"type": "http", "severity": "high", "method": "GET",
|
|
"paths": ["/Security/RecoverPasswordBySuperPassword"],
|
|
"match_any": ["SuperPasswordQRCode"],
|
|
"exclude_any": ["login", "unauthorized", "401", "403", "404"],
|
|
"fake_hints": [],
|
|
"min_len": 50,
|
|
"note": "未授权返回 SuperPasswordQRCode"
|
|
}
|
|
]
|
|
}
|