chaitin / xray

一款完善的安全评估工具,支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档
https://docs.xray.cool
Other
10.47k stars 1.83k forks source link

raw-request get EOF error #1840

Closed HugoWw closed 1 week ago

HugoWw commented 1 week ago

xray使用原始请求报错,原始请求文件格式下:

GET /AJAX/index.php HTTP/1.1
Host: testphp.vulnweb.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en
Key: 
Upgrade-Insecure-Requests: 1
Value: 
Accept-Encoding: gzip

命令如下:

./xray webscan --raw-request output-raw.txt --json-output ./out.json

请求结果如下:

____  ___.________.    ____.   _____.___.
\   \/  /\_   __   \  /  _  \  \__  |   |
 \     /  |    _  _/ /  /_\  \  /   |   |
 /     \  |    |   \/    |    \ \____   |
\___/\  \ |____|   /\____|_   / / _____/
      \_/       \_/        \_/  \/

Version: 1.9.11/eb0c331d/COMMUNITY

[INFO] 2024-11-20 19:05:42 [default:entry.go:226] Loading config file from config.yaml
[WARN] 2024-11-20 19:05:43 [default:webscan.go:287] disable these plugins as that's not an advanced version, [fastjson shiro struts thinkphp]

Enabled plugins: [dirscan xxe xstream brute-force cmd-injection jsonp redirect sqldet xss baseline phantasm crlf-injection path-traversal ssrf upload]

[INFO] 2024-11-20 19:05:43 [phantasm:phantasm.go:185] 819 pocs have been loaded (debug level will show more details)
These plugins will be disabled as reverse server is not configured, check out the reference to fix this error. 
Ref: https://docs.xray.cool/#/configration/reverse
Plugins: 
    poc-go-apache-log4j2-rce
    poc-go-weblogic-cve-2023-21839
...........
[ERRO] 2024-11-20 19:05:47 [collector:request.go:25] Get "http://testphp.vulnweb.com/AJAX/index.php": EOF
[INFO] 2024-11-20 19:05:47 [controller:dispatcher.go:553] wait for reverse server finished
[INFO] 2024-11-20 19:05:50 [controller:dispatcher.go:573] controller released, task done