@@ -149,80 +149,80 @@ JSON 格式的 PoC 类似于完形填空,只需要填写相应的字段的值即
149
149
2 . PoC JSON 有两个 key,pocInfo 和 pocExecute,分别代表 PoC 信息部分执行体。
150
150
151
151
```
152
- {
153
- " pocInfo" :{},
154
- " pocExecute" :{}
155
- }
152
+ {
153
+ " pocInfo" :{},
154
+ " pocExecute" :{}
155
+ }
156
156
```
157
157
158
158
3 . 填写 pocInfo 部分:
159
159
160
160
```
161
- {
162
- " pocInfo" :{
163
- " vulID" : " poc-2015-0107" ,
164
- " name" : " Openssl 1.0.1 内存读取 信息泄露漏洞" ,
165
- " protocol" : " http" ,
166
- " author" : " test" ,
167
- " references" : [" http://drops.wooyun.org/papers/1381" ],
168
- " appName" : " OpenSSL" ,
169
- " appVersion" : " 1.0.1~1.0.1f, 1.0.2-beta, 1.0.2-beta1" ,
170
- " vulType" : " Information Disclosure" ,
171
- " desc" :" OpenSSL是一个强大的安全套接字层密码库。这次漏洞被称为OpenSSL“心脏出血”漏洞,这是关于 OpenSSL 的信息泄漏漏洞导致的安全问题。它使攻击者能够从内存中读取最多64 KB的数据。安全人员表示:无需任何特权信息或身份验证,我们就可以从我们自己的(测试机上)偷来X.509证书的私钥、用户名与密码、聊天工具的消息、电子邮件以及重要的商业文档和通信等数据." ,
172
- " samples" : [" http://www.baidu.com" , " http://www.qq.com" ]
173
- },
174
- " pocExecute" :{}
175
- }
161
+ {
162
+ " pocInfo" :{
163
+ " vulID" : " poc-2015-0107" ,
164
+ " name" : " Openssl 1.0.1 内存读取 信息泄露漏洞" ,
165
+ " protocol" : " http" ,
166
+ " author" : " test" ,
167
+ " references" : [" http://drops.wooyun.org/papers/1381" ],
168
+ " appName" : " OpenSSL" ,
169
+ " appVersion" : " 1.0.1~1.0.1f, 1.0.2-beta, 1.0.2-beta1" ,
170
+ " vulType" : " Information Disclosure" ,
171
+ " desc" :" OpenSSL是一个强大的安全套接字层密码库。这次漏洞被称为OpenSSL“心脏出血”漏洞,这是关于 OpenSSL 的信息泄漏漏洞导致的安全问题。它使攻击者能够从内存中读取最多64 KB的数据。安全人员表示:无需任何特权信息或身份验证,我们就可以从我们自己的(测试机上)偷来X.509证书的私钥、用户名与密码、聊天工具的消息、电子邮件以及重要的商业文档和通信等数据." ,
172
+ " samples" : [" http://www.baidu.com" , " http://www.qq.com" ]
173
+ },
174
+ " pocExecute" :{}
175
+ }
176
176
```
177
177
各字段的含义与 python 属性部分相同。
178
178
179
179
4 . 填写 pocExecute 部分:
180
180
pocExecute 分为 verify 和 attack 两部分
181
181
```
182
- {
183
- " pocInfo" :{},
184
- " pocExecute" :{
185
- " verify" :[],
186
- " attack" :[]
182
+ {
183
+ " pocInfo" :{},
184
+ " pocExecute" :{
185
+ " verify" :[],
186
+ " attack" :[]
187
+ }
187
188
}
188
- }
189
189
```
190
190
** 填写 verify 部分:**
191
191
```
192
- {
193
- " pocInfo" :{},
194
- " pocExecute" :{
195
- " verify" :[
196
- {
197
- " step" : " 1" ,
198
- " method" : " get" ,
199
- " vulPath" : " /api.php" ,
200
- " params" : " test=123&seebug=1234" ,
201
- " necessary" : " " ,
202
- " headers" : {" cookie" : " 123" },
203
- " status" :" 200" ,
204
- " match" : {
205
- " regex" : [" baidu" ," google" ],
206
- " time" : " time"
207
- }
208
- },
209
- {
210
- " step" : " 2" ,
211
- " method" : " get" ,
212
- " vulPath" : " /api.php" ,
213
- " params" : " test=seebug" ,
214
- " necessary" : " " ,
215
- " headers" : " " ,
216
- " status" : " 200" ,
217
- " match" :{
218
- " regex" : [" " ],
219
- " time" : " 0.01"
192
+ {
193
+ " pocInfo" :{},
194
+ " pocExecute" :{
195
+ " verify" :[
196
+ {
197
+ " step" : " 1" ,
198
+ " method" : " get" ,
199
+ " vulPath" : " /api.php" ,
200
+ " params" : " test=123&seebug=1234" ,
201
+ " necessary" : " " ,
202
+ " headers" : {" cookie" : " 123" },
203
+ " status" :" 200" ,
204
+ " match" : {
205
+ " regex" : [" baidu" ," google" ],
206
+ " time" : " time"
207
+ }
208
+ },
209
+ {
210
+ " step" : " 2" ,
211
+ " method" : " get" ,
212
+ " vulPath" : " /api.php" ,
213
+ " params" : " test=seebug" ,
214
+ " necessary" : " " ,
215
+ " headers" : " " ,
216
+ " status" : " 200" ,
217
+ " match" :{
218
+ " regex" : [" " ],
219
+ " time" : " 0.01"
220
+ }
220
221
}
221
- }
222
- ],
223
- " attack " :[]
222
+ ],
223
+ " attack " :[]
224
+ }
224
225
}
225
- }
226
226
```
227
227
> 说明:
228
228
@@ -252,32 +252,32 @@ JSON 格式的 PoC 类似于完形填空,只需要填写相应的字段的值即
252
252
253
253
** 填写 attack 部分:**
254
254
```
255
- {
256
- " pocInfo" :{},
257
- " pocExecute" :{
258
- " verify" :[],
259
- " attack" :[
260
- {
261
- " step" : " 1" ,
262
- " method" : " get" ,
263
- " vulPath" : " /api.php" ,
264
- " params" : " test=123&seebug=1234" ,
265
- " necessary" : " " ,
266
- " headers" : {" cookie" : " 123" },
267
- " status" :" 200" ,
268
- " match" : {
269
- " regex" : [" baidu" ," google" ],
270
- " time" : " time"
271
- },
272
- " result" :{
273
- " AdminInfo" :{
274
- " Password" :" <regex>www(.+)com"
275
- }
276
- }
277
- }
278
- ]
255
+ {
256
+ " pocInfo" :{},
257
+ " pocExecute" :{
258
+ " verify" :[],
259
+ " attack" :[
260
+ {
261
+ " step" : " 1" ,
262
+ " method" : " get" ,
263
+ " vulPath" : " /api.php" ,
264
+ " params" : " test=123&seebug=1234" ,
265
+ " necessary" : " " ,
266
+ " headers" : {" cookie" : " 123" },
267
+ " status" :" 200" ,
268
+ " match" : {
269
+ " regex" : [" baidu" ," google" ],
270
+ " time" : " time"
271
+ },
272
+ " result" :{
273
+ " AdminInfo" :{
274
+ " Password" :" <regex>www(.+)com"
275
+ }
276
+ }
277
+ }
278
+ ]
279
+ }
279
280
}
280
- }
281
281
```
282
282
attack 部分和 verify 部分类似,比 verify 部分多一个 " result" .
283
283
0 commit comments