1.9.3
版本发布时间: 2022-10-14 11:57:12
chaitin/xray最新发布版本:xpoc-0.1.0(2024-07-19 19:12:29)
- 做了一些优化
- 优化扫描效率
- 增强子域名收集功能
- 增加了一些功能
- 添加burp的history导出文件转yml脚本的功能
- log4j2-rce的检测
- 为自定义脚本(gamma)添加
- 格式化时间戳函数
- 进制转换函数
- sha,hmacsha函数
- url全字符编码函数
- rev 字符串反向函数
- 添加 upper 字符串大写函数
- dir()
- basename()
- body_string
- title_string
- 扫描时,可以指定POC的危害等级,分为
low,medium,high,critical
,通过--level
参数指定 - 为shiro插件添加文件加载功能,可以直接加载指定文件中的key
- 可在配置文件中配置每个poc的标签,通过--tags来指定标签扫描
- 更新了
--list
功能,可查看相关标签对应poc - 为 response 添加 icon_url 属性
- 修复了一些问题
- 修复cve-2021-29490误报严重问题
- 修复报告只显示参考链接,不显示提交者的问题
- 修复cache可能出现的请求不发送问题
- 过滤部分冗余的错误日志
- 修复一些意外导致panic的问题
- 新增x命令
- 支持对发现的web站点进行漏洞探测
- 支持带宽控制与智能速率调节,最优化扫描效率
- 支持多目标多端口随机探测,基于有限元的随机化方案
- 支持ICMP/TCP/UDP主机存活探测
- 支持SYN/CONNECT端口扫描
- 支持URL/IP/域名/IP范围/CIDR等多种输入方式
- 支持指纹识别
-
该命令实际上是xray内置的、启用了
- printer
- service-scan
- target-parse
这三个内置的插件的命令。
其中service-scan提供 主机存活探测
、服务指纹识别
、web指纹识别
的功能
可以查看 plugin-config.xray.yaml
,module-config.xray.yaml
获得详细配置信息,执行xray x --help
获取命令行参数与试用方法。
示例:
xray x -t example.com
xray x -t http://example.com
xray x -t example.com/24
xray x -t 192.168.1.1/24
xray x -t 192.168.1.1-192.168.1.254
xray x -t 192.168.1.1-254
xray x -t 192.168.1.1-254 -p 22,80,443-445
- 新增385个poc,感谢师傅们的提交,更新后即可自动加载
- vmware-vcenter-cve-2021-21985-rce.yml
- 74cms-cnvd-2021-45280.yml
- adobe-coldfusion-cve-2018-15961.yml
- ametys-cms-cve-2022-26159.yml
- anmei-rce.yml
- apache-airflow-cve-2020-13927-unauthorized.yml
- apache-apisix-dashboard-api-unauth-rce.yml
- atlassian-jira-unauth-user-enumeration.yml
- auerswald-cve-2021-40859.yml
- clickhouse-http-unauth.yml
- cve-2022-24990-terramaster-fileupload.yml
- dedecms-cve-2017-17731-sqli.yml
- dedecms-mysql-error-trace.yml
- dedecms-search-php-sqli.yml
- doccms-sqli.yml
- earcms-download-php-exec.yml
- earcms-index-uplog-php-file-upload.yml
- emlog-cve-2021-3293.yml
- ewebs-fileread.yml
- eyoucms-cve-2021-39501.yml
- ezoffice-smartupload-jsp-upload.yml
- finecms-getshell.yml
- full-read-ssrf-in-spring-cloud-netflix.yml
- grafana-snapshot-cve-2021-39226.yml
- hadoop-yarn-rpc-rce.yml
- hikvision-readfile.yml
- hongfan-oa-readfile.yml
- interlib-read-file.yml
- ivanti-endpoint-manager-cve-2021-44529-rce.yml
- jinhe-oa-readfile.yml
- joomla-jck-cve-2018-17254-sqli.yml
- kingdee-oa-apusic-readfile.yml
- landray-oa-rce.yml
- lionfish-cms-image-upload-php-upload.yml
- lionfish-cms-wxapp-php-upload.yml
- mastodon-cve-2022-0432.yml
- metersphere-plugincontroller-rce.yml
- metinfo-x-rewrite-url-sqli.yml
- movabletype-cve-2021-20837-rce.yml
- netpower-readfile.yml
- nette-framework-cve-2020-15227-rce.yml
- nginx-path-traversal.yml
- oa8000-workflowservice-sqli.yml
- onethink-sqli.yml
- php-chat-live-uploadimg-html-upload.yml
- phpcms-960-sqli.yml
- phpweb-appplus-php-upload.yml
- pigcms-file-upload.yml
- prestashop-smartblog-cve-2021-37538.yml
- qibocms-readfile.yml
- rudloff-alltube-cve-2022-0692.yml
- seeyon-oa-a6-information-disclosure.yml
- spring-cloud-gateway-cve-2022-22947-rce.yml
- supesite-sqli.yml
- sysaid-itil-cve-2021-43972.yml
- tongda-oa-action-upload-php-upload.yml
- tongda-oa-report-bi-func-php-sqli.yml
- voipmonitor-cve-2022-24260.yml
- wanhuoa-upload-rce.yml
- weaver-e-office-lazyuploadify-upload.yml
- weaver-oa-eoffice-information-disclosure.yml
- weijiaoyi-post-curl-ssrf.yml
- western-digital-mycloud-ftp-download-exec.yml
- western-digital-mycloud-jqueryfiletree-exec.yml
- western-digital-mycloud-multi-uploadify-file-upload.yml
- western-digital-mycloud-raid-cgi-exec.yml
- western-digital-mycloud-sendlogtosupport-php-exec.yml
- western-digital-mycloud-upload-php-exec.yml
- western-digital-mycloud-upload-php-upload.yml
- yonyou-erp-nc-readfile.yml
- zhixiang-oa-sqli.yml
- zoho-cve-2022-23779-info-leak.yml
- adobe-coldfusion-cve-2021-21087.yml
- alibaba-anyproxy-fetchbody-fileread.yml
- apache-apisix-cve-2020-13945-rce.yml
- apache-guacamole-default-password.yml
- atlassian-jira-cve-2019-3403.yml
- bsphp-unauthorized-access.yml
- cve-2017-16894-sensitive-documents.yml
- delta-entelitouch-cookie-user-password-disclosure.yml
- domoticz-cve-2019-10664.yml
- druid-cve-2021-25646.yml
- dynamicweb-cve-2022-25369.yml
- egroupware-spellchecker-rce.yml
- elfinder-cve-2021-32682-rce.yml
- emerge-e3-cve-2019-7256.yml
- essl-dataapp-unauth-db-leak.yml
- finecms-cve-2018-6893.yml
- franklinfueling-cve-2021-46417-lfi.yml
- fuelcms-cve-2018-16763-rce.yml
- genixcms-register-cve-2015-3933-sqli.yml
- getsimple-cve-2019-11231.yml
- ghostscript-cve-2018-19475-rce.yml
- jetty-servlets-concatservlet-information-disclosure-cve-2021-28169.yml
- jetty-web-inf-information-disclosure-cve-2021-34429.yml
- jira-cve-2021-26086.yml
- joomla-history-cve-2015-7857-sqli.yml
- jquery-picture-cut-upload-php-fileupload-cve-2018-9208.yml
- jsrog-artifactory-cve-2019-9733.yml
- kibana-cve-2019-7609-rce.yml
- kodexplorer-directory-traversal.yml
- maccms-cve-2017-17733-rce.yml
- metabase-cve-2021-41277.yml
- nostromo-cve-2011-0751-directory-traversal.yml
- nuxeo-cve-2018-16341-rce.yml
- odoo-cve-2019-14322.yml
- php-imap-cve-2018-19518-rce.yml
- phpmoadmin-cve-2015-2208-rce.yml
- piwigo-cve-2022-26266-sqli.yml
- rconfig-ajaxserversettingschk-cve-2019-16662-rce.yml
- rconfig-commands-inc-cve-2020-10220-sqli.yml
- resin-directory-traversal-cve-2021-44138.yml
- ruanhong-jvm-lfi.yml
- ruanhong-oa-xxe.yml
- ruckus-default-password.yml
- seeyon-oa-a8-m-information-disclosure.yml
- showdoc-cnvd-2020-26585.yml
- socomec-cve-2019-15859.yml
- spring-data-rest-cve-2017-8046-rce.yml
- subrions-search-cve-2017-11444-sqli.yml
- teclib-glpl-cve-2019-10232.yml
- terramaster-tos-cve-2022-24989.yml
- tibco-jasperreports-cve-2018-18809-directory-traversal.yml
- tongda-oa-login-code-php-login-bypass.yml
- twonkyserver-cve-2018-7171-fileread.yml
- vmware-workspace-cve-2021-22054-ssrf.yml
- vmware-workspace-cve-2022-22954-rce.yml
- vtigercrm-cve-2020-19363.yml
- weaver-ecology-getsqldata-sqli-rce.yml
- wordpress-site-editor-cve-2018-7422-lfi.yml
- wso2-cve-2022-29464-fileupload.yml
- wuzhicms-cve-2018-11528.yml
- zabbix-cve-2019-17382.yml
- zimbra-collaboration-server-cve-2013-7091-lfi.yml
- zoneminder-cve-2016-10140-unauth-access.yml
- apollo-default-password.yml
- ecology-oa-eoffice-officeserver-php-file-read.yml
- dptech-vpn-fileread.yml
- ezoffice-filupload-controller-getshell.yml
- yachtcontrol-webapplication-cve-2019-17270.yml
- atlassian-jira-cve-2019-3401.yml
- emerge-e3-cve-2019-7254.yml
- vbulletin-cve-2020-12720.yml
- netsweeper-webadmin-cve-2020-13167.yml
- searchblox-cve-2020-35580.yml
- opensis-cve-2020-6637.yml
- hd-network-real-time-monitoring-system-cve-2021-45043.yml
- visual-tools-dvr-vx16-cve-2021-42071.yml
- jsrog-artifactory-cve-2019-17444.yml
- reolink-RLC-410W-CVE-2022-21236.yml
- tlr-2005ksh-cve-2021-45428.yml
- zoho-manageengine-access-manager-plus-cve-2022-29081.yml
- selea-ocr-anpr-arbitrary-get-file-read.yml
- easyappointments-cve-2022-0482.yml
- netgear-ssl-vpn-20211222-cve-2022-29383.yml
- hitachi-vantara-pentaho-business-analytics-cve-2021-34684.yml
- manageengine-opmanager-cve-2020-11946.yml
- intelbras-wireless-cve-2021-3017.yml
- sapido-router-unauthenticated-rce.yml
- china-telecom-zte-f460-rce.yml
- china-mobile-yu-router-information-disclosure.yml
- tlr-2855ks6-arbitrary-file-creation-cve-2021-46418.yml
- uniview-isc-rce.yml
- feiyuxing-route-wifi-password-leak.yml
- changjie-crm-sqli.yml
- fhem-file-read-cve-2020-19360.yml
- hikvision-ip-camera-backdoor.yml
- kyocera-file-read.yml
- niushop-cms-sqli.yml
- dlink-dap-1620-firmware-cve-2021-46381.yml
- emby-mediaserver-cve-2020-26948.yml
- zoho-manageengine-opmanager-cve-2020-12116.yml
- zabbix-cve-2022-23134.yml
- tieline-ip-audio-gateway-cve-2021-35336.yml
- selea-ocr-anpr-arbitrary-seleacamera-file-read.yml
- microweber-cve-2022-0378.yml
- atlassian-jira-cve-2022-0540.yml
- sophosfirewall-bypass.yml
- zoho-manageengine-desktop-central-cve-2021-44515.yml
- tenda-11n-ultra-vires.yml
- tenda-w15e-passsword-leak.yml
- ziguang-sqli-cnvd-2021-41638.yml
- kemai-ras-ultra-vires.yml
- cerebro-request-ssrf.yml
- motioneye-info-leak-cve-2022-25568.yml
- yinda-get-file-read.yml
- jupyter-notebook-rce.yml
- e-message-unauth.yml
- kkfileview-cve-2021-43734.yml
- dlink-dsl-28881a-ultra-vires.yml
- kunshi-vos3000-fileread.yml
- reolink-nvr-configuration-disclosure-cve-2021-40150.yml
- d-Link-dir-825-cve-2021-46442.yml
- vite-cnvd-2022-44615.yml
- gitblit-cve-2022-31268.yml
- bigant-server-cve-2022-23347-lfi.yml
- wordpress-page-builder-kingcomposer-cve-2022-0165-url-redirect.yml
- huayu-reporter-rce.yml
- d-link-dap-2020-cve-2021-27250.yml
- 74cms-se-cve-2022-29720.yml
- 74cms-se-cve-2022-33095.yml
- pbootcms-rce-cve-2022-32417.yml
- e-office-v10-sqli.yml
- yonyou-nc-file-upload.yml
- xiaomi-cve-2019-18371.yml
- yonyou-erp-u8-file-upload.yml
- mingyu-waf-login-bypass.yml
- amcrest-cve-2017-8229-info-leak.yml
- anymacro-mail-fileread.yml
- anymacro-mail-sql-injection.yml
- aspcms-sqli.yml
- changjietong-downloadproxy-file-read.yml
- cisco-router-cve-2019-1653-info-leak.yml
- cisco-rv-series-router-cve-2021-1472-rce.yml
- cisco-rv132w-router-cve-2018-0127-information-disclosure.yml
- cockpit-cve-2020-35846-sqli.yml
- discuz-cve-2019-13956-rce.yml
- dlink-cve-2021-42627-unauth.yml
- e-cology-loginsso-sqli.yml
- ecology-hrmcareerapplyperview-sql.yml
- fanweioa-signaturedownload-file-read.yml
- fumengyun-ajaxmethod-name-sqli.yml
- h3c-cvm-upload-file-upload.yml
- h3c-er3100-unauth-access.yml
- huawei-dg8045-deviceinfo-info-leak.yml
- inspur-clusterenginev4-sysshell-remote-command-exec.yml
- kavita-cover-upload-file-read.yml
- kingdee-k3-cloud-mobfileupload-upload.yml
- kkfileview-getcorsfile-ssrf.yml
- kkfileview-xss-cve-2022-35151.yml
- landray-oa-datajson-rce.yml
- lg-n1a1-nas-cnnvd-201607-467-rce.yml
- lucee-cve-2021-21307-rce.yml
- manageengine-servicedesk-cve-2017-11512-lfi.yml
- netgear-cnnvd-201306-024.yml
- nuuo-nvrmini-cve-2018-14933.yml
- oracle-ebs-bispgrapgh-file-read.yml
- qiwang-erp-sql-injection.yml
- reporter-file-read.yml
- sanfor-reporter-anyfileread.yml
- solarview-compact-rce-cve-2022-29298.yml
- telesquare-cve-2021-46422-rce.yml
- tongda-anywhere2017-auth-bypass.yml
- tongda-oa-file-read.yml
- tongda-oa-get-contactlist-php-leak-information.yml
- tongda-oa-v11-auth-mobi-php-get-user-session.yml
- topapp-lb-any-user-login.yml
- totolink-cve-2022-25076-rce.yml
- u5cms-cve-2022-32444-url-redirection.yml
- unraid-cve-2020-5847-remote-code-execution.yml
- vicidial-info-leak.yml
- wanhu-ezoffice-documentedit-sqli.yml
- wanhu-ezoffice-downloadservlet-path-traversal.yml
- wavlink-cve-2022-2486-rce.yml
- wavlink-cve-2022-31845.yml
- wavlink-cve-2022-31846.yml
- wavlink-cve-2022-34046.yml
- wavlink-cve-2022-34049.yml
- wavlink-cve-2022-34570-info-leak.yml
- wavlink-nightled-remote-command-execute.yml
- wavlink-password-disclosure-cve-2022-34047.yml
- weaver-oa-filedownload-jsp-path-traversal.yml
- weaver-oa-jqueryfiletree-jsp-path-traversal.yml
- weaver-oa-sptmforportalthumbnail-jsp-path-traversal.yml
- weaver-oa-ultra-vires.yml
- weblogic-local-cve-2022-21371-file-inclusion.yml
- wordpress-wp-google-maps-cve-2019-10692-sqli.yml
- yongyou-chanjet-sql-injection.yml
- yonyou-fe-templateoftaohong-manager-jsp-directory-traversal.yml
- yonyou-iufo-userinformation-disclosure.yml
- zimbra-cve-2022-27925.yml
- zyxel-cve-2022-0342-auth-bypass.yml
- zyxel-vmg1312-b10d-cve-2018-19326-path-traversal.yml
- zyxel-ztp-rce-cve-2022-30525.yml
- tongda-oa-unauth.yml
- 74cms-cve-2020-22211-sqli.yml
- alibaba-nacos-cve-2021-29442-unauth.yml
- artica-pandora-fms-cve-2020-8497-unauth.yml
- bitbucket-unauth.yml
- citrix-cve-2020-8194-code-injection.yml
- dahua-dss-file-read.yml
- drawio-cve-2022-1713-ssrf.yml
- dzzoffice-2-02-1-sc-utf8-unauth.yml
- dzzoffice-2-02-1-sc-utf8-xss.yml
- emerge-e3-series-cve-2022-31269.yml
- eweaver-eoffice-ajax-upload.yml
- glpi-barcode-cve-2021-43778-path-traversal.yml
- glpi-telemetry-cve-2021-39211-info-leak.yml
- gurock-testrail-cve-2021-40875-info-leak.yml
- hwl-2511-ss-cve-2022-36554-rce.yml
- intouch-access-anywhere-cve-2022-23854-lfi.yml
- ispyconnect-cve-2022-29775-unauth.yml
- kyocera-printer-cve-2020-23575-path-traversal.yml
- laravel-filemanager-cve-2022-40734-path-traversal.yml
- msnswitch-cve-2022-32429.yml
- node-red-cve-2021-25864-fileread.yml
- oracle-ebs-cve-2018-3167-ssrf.yml
- panabit-syaddmount-command-exec.yml
- prtg-network-monitor-cve-2020-11547-info-leak.yml
- redash-cve-2021-41192-unauth.yml
- springboot-jolokia-lfi.yml
- tapestry-cve-2019-0195-readfile.yml
- teampass-cve-2020-12478-unauth.yml
- thinfinity-virtualui-cve-2021-44848-user-enum-unauth.yml
- tongda-oa-gateway-path-traversal.yml
- wapples-filrewall-cve-2022-35413.yml
- wavlink-cve-2022-31847-info-leak.yml
- weaver-e-cology-dbconfigreader-jsp-info-leak.yml
- weaver-e-cology-ktreeuploadaction-upload.yml
- weaver-e-mobile-client-do-sqli.yml
- weaver-e-mobile-ognl-inject.yml
- wordpress-backupbuddy-cve-2022-31474-lfi.yml
- yonyou-u8c-file-upload.yml
- zoho-manageengine-adaudit-plus-cve-2022-28219-xxe.yml
- 74cms-sqli-cve-2020-22209.yml
- aruba-instant-default-password.yml
- cloud-oa-system-sqli.yml
- dahua-dss-arbitrary-file-download-cnvd-2020-61986.yml
- dell-idarc-default-password.yml
- eyou-mail-rce-cnvd-2021-26422.yml
- f5-big-ip-cve-2022-1388-rce.yml
- hongfan-ioffice-oa-cnvd-2021-32400-sqli.yml
- iceflow-vpn-cnvd-2016-10768-info-leak.yml
- kevinlab-bems-backdoor-cve-2021-37292.yml
- microsoft-exchange-ssrf-cve-2021-26885.yml
- pfsense-rce-cve-2021-41282.yml
- ruijie-eg-update-rce.yml
- venustech-tianyue-default-password.yml
- wanhu-ezoffice-file-upload.yml
- weaver-eoffice-arbitrary-cnvd-2021-49104-file-upload.yml
- xieda-oa-artibute-cnvd-2021-29066-file-read.yml
- crawlab-users-add.yml
- microweber-cve-2022-0666.yml
- ucms-v148-cve-2020-25483.yml
- wordpress-photo-gallery-cve-2022-1281.yml
- eoffice10-file-upload.yml
- topsec-rce.yml
- weaver-oa-workrelate-file-upload.yml
- zentao-sqli-cnvd-2022-42853.yml
- dataease-cve-2022-34114.yml
- gogs-cve-2018-18925-rce.yml
- landray-oa-treexml-rce.yml
- node-red-file-read.yml
- specoweb-cve-2021-32572-fileread.yml
- wi-fi-web-rce.yml
- yonyou-ksoa-file-upload.yml
- wanhu-oa-officeserver-file-upload.yml
- yonyou-grp-u8-file-upload.yml
- cobub-channel-cve-2018-8057-sqli.yml
- cuberite-cve-2019-15516.yml
- greencms-cve-2018-12604.yml
- junams-fileupload-cnvd-2020-24741.yml
- rconfig-cve-2020-10546.yml
- rconfig-cve-2020-10547.yml
- rconfig-cve-2020-10548.yml
- rconfig-cve-2020-10549.yml
- strs-mas-remote-command-exec.yml
- webgrind-index-cve-2018-12909-fileread.yml
- youphptube-cve-2019-18662.yml
- apache-spark-rce-cve-2022-33891.yml
- confluence-cve-2022-26138.yml
- h3c-route-unauthorized.yml
- nps-auth-bypass.yml
- seeyon-default-password.yml
- spiderflow-save-remote-command-execute.yml
- spring-cve-2020-5398-rfd.yml
- topsec-defalut-password.yml
- weaver-oa-cnvd-2022-43245.yml
- yonyou-nc-file-accept-upload.yml
- yonyou-nc-xxe.yml
- zhiyuan-oa-fanruan-info-leak.yml
- zhiyuan-oa-wpsassistservlet-file-upload.yml
- fanruan-v9-file-upload.yml
- hexinchuang-cloud-desktop-file-upload.yml
- hongfan-oa-sqli.yml
- kingsoft-tss-v8-file-upload.yml
- lianruan-uninac-fileupload.yml
- nagiosxi-cve-2020-35578-rce.yml
- topsec-topapp-lb-sqli.yml
- trs-was5-file-read.yml
- weaver-emobile-v6-sqli.yml
- wordpress-file-manager-cve-2020-25213-file-upload.yml
- zentao-v11-sqli.yml
- vbulletin-cve-2015-7808.yml
- yonyou-chanjet-file-upload.yml
- 对如下插件规则进行修复,增强:
- full-read-ssrf-in-spring-cloud-netflix.yml
- wuzhicms-v410-sqli.yml
- nexusdb-cve-2020-24571-path-traversal.yml
- joomla-cve-2015-7297-sqli.yml
- joomla-cve-2017-8917-sqli.yml
- zcms-v3-sqli.yml
- 74cms-sqli.yml
- discuz-v72-sqli.yml
- duomicms-sqli.yml
- seacms-sqli.yml
- f5-big-ip-cve-2022-1388-rce.yml
- nginx-cve-2017-7529-info-leak.yml
- cerebro-request-ssrf.yml
- openfire-cve-2019-18394-ssrf.yml
- prometheus-url-redirection-cve-2021-29622.yml
- zoho-cve-2022-23779-info-leak.yml
- xunchi-cnvd-2020-23735-file-read.yml
- 74cms-se-cve-2022-33095.yml
- e-office-v10-sqli.yml
- weaver-emobile-v6-sqli.yml
- mingyu-waf-login-bypass.yml
- confluence-cve-2021-26084-rce
- hadoop-yarn-unauthorized-access
- confluence-cve-2019-3396-path-traversal
- httpd-ssrf-cve-2021-40438
- terramaster-cve-2020-28188-rce
- laravel-cve-2021-3129-rce
- seeyon-oa-arbitrary-auth
- qizhi-unauthorized-access
- yonyou-nc-javabeanshell-rce
- apache-httpd-cve-2021-41773
- gitlab-cve-2021-22214-ssrf
- niushop-attrarray-sqli
- phpmyadmin-wooyun-2016-199433-deserialization
- php-cgi-cve-2012-1823-rce
- apache-druid-cve-2021-36749-file-read
- elasticsearch-cve-2015-3337
1、 sha256.txt 1.21KB
2、 xray_darwin_amd64.zip 29.14MB
3、 xray_darwin_arm64.zip 28.35MB
4、 xray_linux_386.zip 27.93MB
5、 xray_linux_amd64.zip 28.9MB
6、 xray_linux_arm64.zip 27.68MB
7、 xray_windows_386.exe.zip 27.12MB
8、 xray_windows_amd64.exe.zip 27.7MB