修改yaml解析模块,支持密码爆破,如tomcat弱口令。yaml中新增sets参数,类型为数组,用于存放密码,具体看tomcat-manager-week.yaml

WebScan/pocs/laravel-improper-webdir.yml

@@ -0,0 +1,11 @@
+name: poc-yaml-laravel-improper-webdir
+rules:
+  - method: GET
+    path: /storage/logs/laravel.log
+    follow_redirects: false
+    expression: >
+      response.status == 200 && (response.content_type.contains("plain") || response.content_type.contains("octet-stream")) && (response.body.bcontains(b"vendor\\laravel\\framework") || response.body.bcontains(b"vendor/laravel/framework")) && (response.body.bcontains(b"stacktrace") || response.body.bcontains(b"Stack trace"))
+detail:
+  author: Dem0ns (https://github.com/dem0ns)
+  links:
+    - https://github.com/dem0ns/improper