自用的nuclei模板,尽量会不断更新。编写的过程中会和官方模板库进行对比,尽量避免出现重复的情况。在编写的过程中尽量是以2017年及以后出现的漏洞,太早的漏洞就没有进行编写了
更新hw poc
继续优化和添加了部分poc,这里部分使用了nuc的dnslog,因为官网的dnslog需要fq,也并未找到其他dnslog的使用方法,于是为了检测的准确性,可以服务器上搭建官方dnslog,然后调用即可使检测更加准确
https://github.com/projectdiscovery/interactsh/
下载相应的client端
![image](https://private-user-images.githubusercontent.com/48739932/320271915-bf8076aa-93e1-4a28-bac1-de022ddc9a34.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjExOTA1OTYsIm5iZiI6MTcyMTE5MDI5NiwicGF0aCI6Ii80ODczOTkzMi8zMjAyNzE5MTUtYmY4MDc2YWEtOTNlMS00YTI4LWJhYzEtZGUwMjJkZGM5YTM0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzE3VDA0MjQ1NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTc5M2E2YzYxY2YzMWVlMjRjODM2ZjI4NDE5Njc5NTZlYjQwZGRkYjliNzhiZTdhYTEzMzkzZDUxNWRiNmIxYmQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.CfsvHe5bi59zgBAFI1viAwWgcWLnqTFdx5NVY38qO3A)
然后服务器运行
![image](https://private-user-images.githubusercontent.com/48739932/320271943-643d1b89-e8ac-4fef-8c1c-c3cec986f148.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjExOTA1OTYsIm5iZiI6MTcyMTE5MDI5NiwicGF0aCI6Ii80ODczOTkzMi8zMjAyNzE5NDMtNjQzZDFiODktZThhYy00ZmVmLThjMWMtYzNjZWM5ODZmMTQ4LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzE3VDA0MjQ1NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTAxY2M3N2EzODYwZWM4MDlhY2I5ZTFiMDY3NzM1ZjNmMzFmYzFmNmMwZmVmZDlkNWMxNDM2ZDkxMTdmNzZiNjImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.SqmC9PIGvk4G-ePeis01e2iLADsYfNKm_kBMawFDutc)
在nuc中使用即可
![image](https://private-user-images.githubusercontent.com/48739932/320271981-28bc4e30-046f-433f-b53a-9b3988cf3661.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjExOTA1OTYsIm5iZiI6MTcyMTE5MDI5NiwicGF0aCI6Ii80ODczOTkzMi8zMjAyNzE5ODEtMjhiYzRlMzAtMDQ2Zi00MzNmLWI1M2EtOWIzOTg4Y2YzNjYxLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzE3VDA0MjQ1NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTgyYzQ4ZTg1MzgwYjdmMDhjNzdmYWIwYzUyMTY1OTRmZGRjYTA5NGM1Y2NhNDQzZmU2ZTBlY2ViZTljODM2MzkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.NBssWZmiRxbx9l6QTNJq_F2mZb3XoNXT5WTuC9ARvIQ)
-iserver oast.pro -itoken you token
检测log4如下
![image](https://private-user-images.githubusercontent.com/48739932/320272008-fcb62a64-a1a7-4616-8d41-f3a7b25e58eb.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjExOTA1OTYsIm5iZiI6MTcyMTE5MDI5NiwicGF0aCI6Ii80ODczOTkzMi8zMjAyNzIwMDgtZmNiNjJhNjQtYTFhNy00NjE2LThkNDEtZjNhN2IyNWU1OGViLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzE3VDA0MjQ1NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTdmNmU4MDA3MTExOWM4MmRjNjhmM2RhOGZmY2JhYTMzNTlmMDU5NzY3NWE5NGRjNzQ2ZWE5ZDZjZDk1OWYxOGEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.N1SbbqptGrKyMO00XqpNKhLt6SxOLnyIZ1Q4hD0fOCU)
下载nuclei: https://github.com/projectdiscovery/nuclei
放在nuclei-templates目录下即可使用
大部分poc已通过测试,主要以检测为主,不涉及攻击行为。
此处提供的所有工具仅供授权状态下使用,且poc仅以检测作用为主,如发生违法犯罪行为,非授权攻击行为于本人无关