前言

xray 是一款功能强大的安全评估工具，由多名经验丰富的一线安全从业者呕心打造而成，主要特性有:

• 检测速度快。发包速度快; 漏洞检测算法效率高。
• 支持范围广。大至 OWASP Top 10 通用漏洞检测，小至各种 CMS 框架 POC，均可以支持。
• 代码质量高。编写代码的人员素质高, 通过 Code Review、单元测试、集成测试等多层验证来提高代码可靠性。
• 高级可定制。通过配置文件暴露了引擎的各种参数，通过修改配置文件可以客制化功能。
• 安全无威胁。xray 定位为一款安全辅助评估工具，而不是攻击工具，内置的所有 payload 和 poc 均为无害化检查。

• 目前支持的漏洞检测类型包括:

• XSS漏洞检测 (key: xss)
• SQL 注入检测 (key: sqldet)
• 命令/代码注入检测 (key: cmd-injection)
• 目录枚举 (key: dirscan)
• 路径穿越检测 (key: path-traversal)
• XML 实体注入检测 (key: xxe)
• 文件上传检测 (key: upload)
• 弱口令检测 (key: brute-force)
• jsonp 检测 (key: jsonp)
• ssrf 检测 (key: ssrf)
• 基线检查 (key: baseline)
• 任意跳转检测 (key: redirect)
• CRLF 注入 (key: crlf-injection)
• Struts2 系列漏洞检测 (高级版，key: struts)
• Thinkphp系列漏洞检测 (高级版，key: thinkphp)
• XStream 系列漏洞检测 (key: xstream)
• POC 框架 (key: phantasm)

• 其中 POC 框架默认内置 Github 上贡献的 poc，用户也可以根据需要自行构建 poc 并运行。

 更新介绍

2023年12月10日xray更新了1.9.11版本。



添加了多个yaml编写的poc以及xstream扫描模块。



superxray更新内容：



[important] 支持xray 1.9.4版本

[important] 指定多个POC

[bug] 从下载面板得到的xray无法保存设置

[bug] 取消选择文件的提示位置有误

xray更新内容：



插件更新

添加XStream扫描插件，支持列表如下（该插件需开启反连平台）

CVE-2021-21344

CVE-2021-21345

CVE-2021-39141

CVE-2021-39144

...(共29个插件)

fastjson插件支持CVE-2022-25845的检测

POC编写/执行更新

新增警告信息，师傅们可以根据警告信息删除检测插件创建的文件等

支持在GET，HEAD，OPTION时添加body

添加compare version函数，可以对匹配出的版本进行对比

添加html实体编码/解码函数

添加java反序列化函数

添加hex/hexDecode函数

优化内容

优化了反连平台漏洞捕获逻辑，提高了命中率

优化了 Poc lint 变得更人性化

yaml脚本支持获取rmi反连平台的链接，具体使用请参考官方文档

优化了Struts2检测模块，添加反连确认，减少误报漏报

修复POC

规则优化，规则弱

<span style="color:#c9d1d9"><span style="background-color:#0d1117"><span style="background-color:var(--color-canvas-subtle)"><code>poc-yaml-drawio-cve-2022-1713-ssrf

poc-yaml-h3c-cvm-upload-file-upload

poc-yaml-iis-cve-2017-7269

poc-yaml-74cms-sqli-cve-2020-22209

poc-yaml-reporter-file-read

poc-yaml-wanhu-ezoffice-documentedit-sqli

poc-yaml-joomla-cve-2017-8917-sqli

poc-yaml-iis-cve-2017-7269

poc-yaml-emerge-e3-cve-2019-7256

poc-yaml-alibaba-nacos-v1-auth-bypass

poc-yaml-wanhu-ezoffice-documentedit-sqli

poc-yaml-magicflow-gateway-main-xp-file-read

poc-yaml-gitblit-cve-2022-31268

poc-yaml-phpstudy-nginx-wrong-resolve

poc-yaml-confluence-cve-2022-26138

poc-yaml-metinfo-lfi-cnvd-2018-13393

poc-yaml-zabbix-cve-2019-17382

poc-yaml-wordpress-paypal-pro-cve-2020-14092-sqli

poc-yaml-vite-cnvd-2022-44615

poc-yaml-phpmyadmin-cve-2018-12613-file-inclusion

poc-yaml-zabbix-cve-2022-23134

poc-yaml-ametys-cms-cve-2022-26159

</code></span></span></span>



优化删除（功能与xray的通用插件重复）

<span style="color:#c9d1d9"><span style="background-color:#0d1117"><span style="background-color:var(--color-canvas-subtle)"><code>poc-yaml-nexusdb-cve-2020-24571-path-traversal

poc-yaml-specoweb-cve-2021-32572-fileread

poc-yaml-tvt-nvms-1000-file-read-cve-2019-20085

poc-yaml-zyxel-vmg1312-b10d-cve-2018-19326-path-traversal

</code></span></span></span>

新增无害化处理

<span style="color:#c9d1d9"><span style="background-color:#0d1117"><span style="background-color:var(--color-canvas-subtle)"><code>poc-yaml-fanruan-v9-file-upload

poc-yaml-h3c-cvm-upload-file-upload

poc-yaml-seeyon-unauthorized-fileupload

poc-yaml-thinkcmf-write-shell

poc-yaml-wanhu-oa-officeserver-file-upload

poc-yaml-weaver-oa-workrelate-file-upload

poc-yaml-yonyou-grp-u8-file-upload

poc-yaml-yonyou-nc-file-accept-upload

poc-yaml-yonyou-u8c-file-upload

poc-yaml-zhiyuan-oa-wpsassistservlet-file-upload

</code></span></span></span>

新增POC 96个

<span style="color:#c9d1d9"><span style="background-color:#0d1117"><span style="background-color:var(--color-canvas-subtle)"><code>poc-yaml-ruijie-fileupload-fileupload-rce

poc-yaml-eweaver-oa-mecadminaction-sqlexec

poc-yaml-xxl-job-default-password

poc-yaml-wordpress-plugin-superstorefinder-ssf-social-action-php-sqli

poc-yaml-magento-config-disclosure-info-leak

poc-yaml-ukefu-cnvd-2021-18305-file-read

poc-yaml-ukefu-cnvd-2021-18303-ssrf

poc-yaml-eweaver-eoffice-mainselect-info-leak

poc-yaml-linksys-cnvd-2014-01260

poc-yaml-wordpress-welcart-ecommerce-cve-2022-41840-path-traversal

poc-yaml-jeesite-userfiles-path-traversal

poc-yaml-yongyou-nc-iupdateservice-xxe

poc-yaml-v-sol-olt-platform-unauth-config-download

poc-yaml-ibm-websphere-portal-hcl-cve-2021-27748-ssrf

poc-yaml-yonyou-nc-uapws-db-info-leak

poc-yaml-yonyou-nc-service-info-leak

poc-yaml-yongyou-nc-cloud-fs-sqli

poc-yaml-finecms-filedownload

poc-yaml-weaver-eoffice-userselect-unauth

poc-yaml-fortinet-cve-2022-40684-auth-bypass

poc-yaml-dapr-dashboard-cve-2022-38817-unauth

poc-yaml-wordpress-zephyr-project-manager-cve-2022-2840-sqli

poc-yaml-jira-cve-2022-39960-unauth

poc-yaml-qnap-cve-2022-27593-fileupload

poc-yaml-wordpress-all-in-one-video-gallery-cve-2022-2633-lfi

poc-yaml-atlassian-bitbucket-archive-cve-2022-36804-remote-command-exec

poc-yaml-wordpress-simply-schedule-appointments-cve-2022-2373-unauth

poc-yaml-zoho-manageengine-opmanager-cve-2022-36923

poc-yaml-red-hat-freeipa-cve-2022-2414-xxe

poc-yaml-wavlink-cve-2022-2488-rce

poc-yaml-wavlink-cve-2022-34045-info-leak

poc-yaml-wordpress-shareaholic-cve-2022-0594-info-leak

poc-yaml-wordpress-wp-stats-manager-cve-2022-33965-sqli

poc-yaml-opencart-newsletter-custom-popup-sqli

poc-yaml-wordpress-events-made-easy-cve-2022-1905-sqli

poc-yaml-wordpress-kivicare-cve-2022-0786-sqli

poc-yaml-wordpress-cve-2022-1609-rce

poc-yaml-solarview-compact-cve-2022-29303-rce

poc-yaml-wordpress-arprice-lite-cve-2022-0867-sqli

poc-yaml-wordpress-fusion-cve-2022-1386-ssrf

poc-yaml-wordpress-nirweb-cve-2022-0781-sqli

poc-yaml-wordpress-metform-cve-2022-1442-info-leak

poc-yaml-wordpress-mapsvg-cve-2022-0592-sqli

poc-yaml-wordpress-badgeos-cve-2022-0817-sqli

poc-yaml-wordpress-daily-prayer-time-cve-2022-0785-sqli

poc-yaml-wordpress-woo-product-table-cve-2022-1020-rce

poc-yaml-wordpress-documentor-cve-2022-0773-sqli

poc-yaml-wordpress-multiple-shipping-address-woocommerce-cve-2022-0783-sqli

poc-yaml-gitlab-cve-2022-1162-hardcoded-password

poc-yaml-thinkphp-cve-2022-25481-info-leak

poc-yaml-wordpress-cve-2022-0591-ssrf

poc-yaml-wordpress-simple-link-directory-cve-2022-0760-sqli

poc-yaml-wordpress-ti-woocommerce-wishlist-cve-2022-0412-sqli

poc-yaml-wordpress-notificationx-cve-2022-0349-sqli

poc-yaml-wordpress-page-views-count-cve-2022-0434-sqli

poc-yaml-wordpress-masterstudy-lms-cve-2022-0441-unauth

poc-yaml-wordpress-seo-cve-2021-25118-info-leak

poc-yaml-wordpress-perfect-survey-cve-2021-24762-sqli

poc-yaml-wordpress-asgaros-forum-cve-2021-24827-sqli

poc-yaml-tcexam-cve-2021-20114-info-leak

poc-yaml-wordpress-woocommerce-cve-2021-32789-sqli

poc-yaml-wordpress-profilepress-cve-2021-34621-unauth

poc-yaml-wordpress-wp-statistics-cve-2021-24340-sqli

poc-yaml-voipmonitor-cve-2021-30461-rce

poc-yaml-rocket-chat-cve-2021-22911-nosqli

poc-yaml-pega-infinity-cve-2021-27651-unauth

poc-yaml-wordpress-modern-events-calendar-lite-cve-2021-24146-info-leak

poc-yaml-afterlogic-webmail-cve-2021-26294-path-traversal

poc-yaml-wavlink-cve-2020-13117-rce

poc-yaml-prestashop-cve-2021-3110-sqli

poc-yaml-cockpit-cve-2020-35847-nosqli

poc-yaml-cockpit-cve-2020-35848-nosqli

poc-yaml-keycloak-cve-2020-10770-ssrf

poc-yaml-prestashop-cve-2020-26248-sqli

poc-yaml-wordpress-paypal-pro-cve-2020-14092-sqli

poc-yaml-microstrategy-cve-2020-11450-info-leak

poc-yaml-adobe-experience-manager-cve-2019-8086-xxe

poc-yaml-blogengine-net-cve-2019-10717-path-traversal

poc-yaml-dotcms-cve-2018-17422-url-redirection

poc-yaml-php-proxy-cve-2018-19458-fileread

poc-yaml-circarlife-scada-cve-2018-16671-info-leak

poc-yaml-circarlife-scada-cve-2018-16670-info-leak

poc-yaml-circarlife-scada-cve-2018-16668-info-leak

poc-yaml-dotnetnuke-cve-2017-0929-ssrf

poc-yaml-orchid-core-vms-cve-2018-10956-path-traversal

poc-yaml-circarlife-scada-cve-2018-12634-info-leak

poc-yaml-nuuo-nvrmini2-cve-2018-11523-upload

poc-yaml-jolokia-cve-2018-1000130-code-injection

poc-yaml-fiberhome-cve-2017-15647-path-traversal

poc-yaml-opendreambox-cve-2017-14135-rce

poc-yaml-sap-cve-2017-12637-fileread

poc-yaml-glassfish-cve-2017-1000029-lfi

poc-yaml-boa-cve-2017-9833-fileread

poc-yaml-mantisbt-cve-2017-7615-unauth

poc-yaml-wordpress-cve-2017-5487-info-leak

poc-yaml-thinkcmf-cve-2018-19898-sqli

使用/安装方法

./xray_windows_amd64 webscan --basic-crawler http://testphp.vulnweb.com/ --html-output xray-crawler-testphp.html

下载地址

最新xray1.9.11高级版下载Windows/Linux

下载地址2

Xray1.9.11

免责声明

        本工具仅面向合法授权的企业安全建设行为，如您需要测试本工具的可用性，请自行搭建靶机环境。

        为避免被恶意使用，本项目所有收录的poc均为漏洞的理论判断，不存在漏洞利用过程，不会对目标发起真实攻击和漏洞利用。

        在使用本工具进行检测时，您应确保该行为符合当地的法律法规，并且已经取得了足够的授权。请勿对非授权目标进行扫描。

        如您在使用本工具的过程中存在任何非法行为，您需自行承担相应后果，我们将不承担任何法律及连带责任。

        本工具来源于网络，请在24小时内删除，请勿用于商业行为，自行查验是否具有后门，切勿相信软件内的广告！

        在安装并使用本工具前，请您务必审慎阅读、充分理解各条款内容，限制、免责条款或者其他涉及您重大权益的条款可能会以加粗、加下划线等形式提示您重点注意。除非您已充分阅读、完全理解并接受本协议所有条款，否则，请您不要安装并使用本工具。您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的，即视为您已阅读并同意本协议的约束，如有侵权请联系作者删除。