chainreactors / neutron

nano nuclei engine. no side effect.
https://chainreactors.github.io/wiki/libs/neutron/
20 stars 7 forks source link

DSL兼容性问题 #8

Open lovelyjuice opened 1 day ago

lovelyjuice commented 1 day ago

用的这个poc: https://github.com/iamHuFei/HVVault/blob/4558fdb/oa/%E9%87%91%E8%9D%B6OA/kingdee-erp-srm-scpsupreghandler-fileupload.yaml

两个请求包都正确发出去了,但是

PS D:\DevDir\Go\neutron> go run ./cmd/shot -proxy http://127.0.0.1:8083 D:\DevDir\Go\gogo\v2\templates\neutron\http\HVVault\oa\金蝶OA\kingdee-erp-srm-scpsupreghandler-fileupload.yaml http://xxx.xx.xx.xx:8090
Using proxy: http://127.0.0.1:8083
Load success for D:\DevDir\Go\gogo\v2\templates\neutron\http\HVVault\oa\金蝶OA\kingdee-erp-srm-scpsupreghandler-fileupload.yaml
OK: <nil>
Execution time: 841.3678ms

用nuclei和yakit都是可以扫出漏洞的,但是neutron不行

  1. 将dsl改成 200 == 200 后,neutron显示OK: &{true false map[] map[] [] map[] map[] map[filename:OStCs]}
  2. 改成status_code_1 == 200,neutron就不行了
  3. status_code == 200,成功
  4. - contains((body_1), 'true') ,失败
  5. - contains((body), 'true'),成功
  6. contains((body), '{{randstr}}'),失败
lovelyjuice commented 17 hours ago

{{randstr_1}}这种形式是不是也不能在neutron中用?