You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
6.0 KiB
6.0 KiB
pocsuite3 https://github.com/knownsec/pocsuite3
Legal Disclaimer
Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. pocsuite3 is for security testing purposes only
法律免责声明
未经事先双方同意,使用 pocsuite3 攻击目标是非法的。 pocsuite3 仅用于安全测试目的
Overview
pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec 404 Team. It comes with a powerful proof-of-concept engine, many nice features for the ultimate penetration testers and security researchers.
Features
- PoC scripts can running with
verify
,attack
,shell
mode in different way - Plugin ecosystem
- Dynamic loading PoC script from any where (local file, redis, database, Seebug ...)
- Load multi-target from any where (CIDR, local file, redis, database, Zoomeye, Shodan ...)
- Results can be easily exported
- Dynamic patch and hook requests
- Both command line tool and python package import to use
- IPv6 support
- Global HTTP/HTTPS/SOCKS proxy support
- Simple spider API for PoC script to use
- Integrate with Seebug (for load PoC from Seebug website)
- Integrate with ZoomEye, Shodan, etc. (for load target use
Dork
) - Integrate with Ceye, Interactsh (for verify blind DNS and HTTP request)
- Friendly debug PoC scripts with IDEs
- More ...
Screenshots
pocsuite3 console mode
pocsuite3 shell mode
pocsuite3 load PoC from Seebug
pocsuite3 load multi-target from ZoomEye
pocsuite3 load multi-target from Shodan
Requirements
- Python 3.7+
- Works on Linux, Windows, Mac OSX, BSD, etc.
Installation
Paste at a terminal prompt:
Python pip
pip3 install pocsuite3
# use other pypi mirror
pip3 install -i https://pypi.tuna.tsinghua.edu.cn/simple pocsuite3
MacOS
brew update
brew info pocsuite3
brew install pocsuite3
Debian, Ubuntu, Kali
sudo apt update
sudo apt install pocsuite3
Docker
docker run -it pocsuite3/pocsuite3
ArchLinux
yay pocsuite3
Or click here to download the latest source zip package and extract
wget https://github.com/knownsec/pocsuite3/archive/master.zip
unzip master.zip
cd pocsuite3-master
pip3 install -r requirements.txt
python3 setup.py install
The latest version of this software is available at: https://pocsuite.org
Documentation
Documentation is available at: https://pocsuite.org
Usage
cli mode
# basic usage, use -v to set the log level
pocsuite -u http://example.com -r example.py -v 2
# run poc with shell mode
pocsuite -u http://example.com -r example.py -v 2 --shell
# search for the target of redis service from ZoomEye and perform batch detection of vulnerabilities. The threads is set to 20
pocsuite -r redis.py --dork service:redis --threads 20
# load all poc in the poc directory and save the result as html
pocsuite -u http://example.com --plugins poc_from_pocs,html_report
# load the target from the file, and use the poc under the poc directory to scan
pocsuite -f batch.txt --plugins poc_from_pocs,html_report
# load CIDR target
pocsuite -u 10.0.0.0/24 -r example.py
# the custom parameters `command` is implemented in ecshop poc, which can be set from command line options
pocsuite -u http://example.com -r ecshop_rce.py --attack --command "whoami"
console mode
poc-console
项目相关
- 2022-07-13 发布文章《Pocsuite3 入门教程》
最近更新
[v1.9.9] - 2022-08-24
更新
- 新增根据 poc 协议字段自动修正 target 路径
- 修复 windows 平台 poc-console 高亮显示的问题
- 默认去除 target 路径末尾的 '/' 字符
[v1.9.8] - 2022-08-06
更新
- 支持对 PoC 全文进行正则搜索
- 在基类 POCBase 中为 PoC 的所有属性设置了默认值
- 添加监听/反连 shell
- 修复 fofa 插件分页查询的 bug
[v1.9.7] - 2022-07-26
更新
- 优化 poc 文件编码兼容问题
- 混淆 REVERSE_PAYLOAD 以避免源码文件触发 windows defender
- 优化 --ppt 敏感信息打码显示功能
[v1.9.6] - 2022-07-07
更新
- 支持-o参数,将结果保存为json行格式
- 优化网络空间搜索引擎插件的超时
- 优化url协议的处理
- 文档更新
[v1.9.5] - 2022-06-22
更新
- 重构 --ppt 参数,优化 url 马赛克功能
- 优化 poc 模板
- 优化命令行默认提示信息
- 调整默认超时为 10 秒
- 调整默认线程数为 150
- 目标 url 目前支持 CIDR,用户可使用 -p 指定端口
- 支持本地模式,该模式化下 poc 不需要指定目标,比如本地提权漏洞
- 修复部分 bugs