Xray 1.9.4 高级版

admin 2023年1月11日17:02:17评论719 views字数 4956阅读16分31秒阅读模式

免责声明

本文仅用于技术讨论与学习,利用此文所提供的信息而造成的任何直接或者间接的后果及损失,均由使用者本人负责,文章作者不为此承担任何责任。只供对已授权的目标使用测试,对未授权目标的测试作者不承担责任,均由使用本人自行承担。
项目地址
https://github.com/NHPT/Xray_racked

Xray 1.9.4 高级版

Xray 1.9.4 高级版

Patch原理和1.9.3一样。

插件更新

1、添加XStream扫描插件,支持列表如下(该插件需开启反连平台)CVE-2021-21344CVE-2021-21345CVE-2021-39141CVE-2021-39144...(共29个插件)2、fastjson插件支持cve-2022-25845的检测

POC编写/执行更新

1、新增警告信息,师傅们可以根据警告信息删除检测插件创建的文件等2、支持在GET,HEAD,OPTION时添加body3、添加compare version函数,可以对匹配出的版本进行对比4、添加html实体编码/解码函数5、添加java反序列化函数6、添加hex/hexDecode函数

新增96个Poc

poc-yaml-ruijie-fileupload-fileupload-rcepoc-yaml-eweaver-oa-mecadminaction-sqlexecpoc-yaml-xxl-job-default-passwordpoc-yaml-wordpress-plugin-superstorefinder-ssf-social-action-php-sqlipoc-yaml-magento-config-disclosure-info-leakpoc-yaml-ukefu-cnvd-2021-18305-file-readpoc-yaml-ukefu-cnvd-2021-18303-ssrfpoc-yaml-eweaver-eoffice-mainselect-info-leakpoc-yaml-linksys-cnvd-2014-01260poc-yaml-wordpress-welcart-ecommerce-cve-2022-41840-path-traversalpoc-yaml-jeesite-userfiles-path-traversalpoc-yaml-yongyou-nc-iupdateservice-xxepoc-yaml-v-sol-olt-platform-unauth-config-downloadpoc-yaml-ibm-websphere-portal-hcl-cve-2021-27748-ssrfpoc-yaml-yonyou-nc-uapws-db-info-leakpoc-yaml-yonyou-nc-service-info-leakpoc-yaml-yongyou-nc-cloud-fs-sqlipoc-yaml-finecms-filedownloadpoc-yaml-weaver-eoffice-userselect-unauthpoc-yaml-fortinet-cve-2022-40684-auth-bypasspoc-yaml-dapr-dashboard-cve-2022-38817-unauthpoc-yaml-wordpress-zephyr-project-manager-cve-2022-2840-sqlipoc-yaml-jira-cve-2022-39960-unauthpoc-yaml-qnap-cve-2022-27593-fileuploadpoc-yaml-wordpress-all-in-one-video-gallery-cve-2022-2633-lfipoc-yaml-atlassian-bitbucket-archive-cve-2022-36804-remote-command-execpoc-yaml-wordpress-simply-schedule-appointments-cve-2022-2373-unauthpoc-yaml-zoho-manageengine-opmanager-cve-2022-36923poc-yaml-red-hat-freeipa-cve-2022-2414-xxepoc-yaml-wavlink-cve-2022-2488-rcepoc-yaml-wavlink-cve-2022-34045-info-leakpoc-yaml-wordpress-shareaholic-cve-2022-0594-info-leakpoc-yaml-wordpress-wp-stats-manager-cve-2022-33965-sqlipoc-yaml-opencart-newsletter-custom-popup-sqlipoc-yaml-wordpress-events-made-easy-cve-2022-1905-sqlipoc-yaml-wordpress-kivicare-cve-2022-0786-sqlipoc-yaml-wordpress-cve-2022-1609-rcepoc-yaml-solarview-compact-cve-2022-29303-rcepoc-yaml-wordpress-arprice-lite-cve-2022-0867-sqlipoc-yaml-wordpress-fusion-cve-2022-1386-ssrfpoc-yaml-wordpress-nirweb-cve-2022-0781-sqlipoc-yaml-wordpress-metform-cve-2022-1442-info-leakpoc-yaml-wordpress-mapsvg-cve-2022-0592-sqlipoc-yaml-wordpress-badgeos-cve-2022-0817-sqlipoc-yaml-wordpress-daily-prayer-time-cve-2022-0785-sqlipoc-yaml-wordpress-woo-product-table-cve-2022-1020-rcepoc-yaml-wordpress-documentor-cve-2022-0773-sqlipoc-yaml-wordpress-multiple-shipping-address-woocommerce-cve-2022-0783-sqlipoc-yaml-gitlab-cve-2022-1162-hardcoded-passwordpoc-yaml-thinkphp-cve-2022-25481-info-leakpoc-yaml-wordpress-cve-2022-0591-ssrfpoc-yaml-wordpress-simple-link-directory-cve-2022-0760-sqlipoc-yaml-wordpress-ti-woocommerce-wishlist-cve-2022-0412-sqlipoc-yaml-wordpress-notificationx-cve-2022-0349-sqlipoc-yaml-wordpress-page-views-count-cve-2022-0434-sqlipoc-yaml-wordpress-masterstudy-lms-cve-2022-0441-unauthpoc-yaml-wordpress-seo-cve-2021-25118-info-leakpoc-yaml-wordpress-perfect-survey-cve-2021-24762-sqlipoc-yaml-wordpress-asgaros-forum-cve-2021-24827-sqlipoc-yaml-tcexam-cve-2021-20114-info-leakpoc-yaml-wordpress-woocommerce-cve-2021-32789-sqlipoc-yaml-wordpress-profilepress-cve-2021-34621-unauthpoc-yaml-wordpress-wp-statistics-cve-2021-24340-sqlipoc-yaml-voipmonitor-cve-2021-30461-rcepoc-yaml-rocket-chat-cve-2021-22911-nosqlipoc-yaml-pega-infinity-cve-2021-27651-unauthpoc-yaml-wordpress-modern-events-calendar-lite-cve-2021-24146-info-leakpoc-yaml-afterlogic-webmail-cve-2021-26294-path-traversalpoc-yaml-wavlink-cve-2020-13117-rcepoc-yaml-prestashop-cve-2021-3110-sqlipoc-yaml-cockpit-cve-2020-35847-nosqlipoc-yaml-cockpit-cve-2020-35848-nosqlipoc-yaml-keycloak-cve-2020-10770-ssrfpoc-yaml-prestashop-cve-2020-26248-sqlipoc-yaml-wordpress-paypal-pro-cve-2020-14092-sqlipoc-yaml-microstrategy-cve-2020-11450-info-leakpoc-yaml-adobe-experience-manager-cve-2019-8086-xxepoc-yaml-blogengine-net-cve-2019-10717-path-traversalpoc-yaml-dotcms-cve-2018-17422-url-redirectionpoc-yaml-php-proxy-cve-2018-19458-filereadpoc-yaml-circarlife-scada-cve-2018-16671-info-leakpoc-yaml-circarlife-scada-cve-2018-16670-info-leakpoc-yaml-circarlife-scada-cve-2018-16668-info-leakpoc-yaml-dotnetnuke-cve-2017-0929-ssrfpoc-yaml-orchid-core-vms-cve-2018-10956-path-traversalpoc-yaml-circarlife-scada-cve-2018-12634-info-leakpoc-yaml-nuuo-nvrmini2-cve-2018-11523-uploadpoc-yaml-jolokia-cve-2018-1000130-code-injectionpoc-yaml-fiberhome-cve-2017-15647-path-traversalpoc-yaml-opendreambox-cve-2017-14135-rcepoc-yaml-sap-cve-2017-12637-filereadpoc-yaml-glassfish-cve-2017-1000029-lfipoc-yaml-boa-cve-2017-9833-filereadpoc-yaml-mantisbt-cve-2017-7615-unauthpoc-yaml-wordpress-cve-2017-5487-info-leakpoc-yaml-thinkcmf-cve-2018-19898-sqli

原文始发于微信公众号(Hack All):Xray 1.9.4 高级版

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2023年1月11日17:02:17
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   Xray 1.9.4 高级版https://cn-sec.com/archives/1513012.html

发表评论

匿名网友 填写信息