chaitin/xray一款长亭自研的完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档
🏠 Documentation • ⬇️ Download xray • ⬇️ Download xpoc • ⬇️ Download xapp • 📖 Plugin Repository
Note: xray is not open source, just download the built binary files directly. The repository mainly contains community-contributed POCs. Each xray release will automatically package them.
To address the issue of xray 1.0 becoming complex and bloated with added features, we have launched xray 2.0.
This new version aims to enhance the smoothness of functionality, lower the usage threshold, and help more security industry practitioners achieve a better experience more efficiently. xray 2.0 will integrate a series of new security tools to form a comprehensive security toolset.
The second tool in the xray 2.0 series, xapp, is now online, welcome to try it!
xpoc is the first tool in the xray 2.0 series, designed as a rapid emergency response tool for supply chain vulnerability scanning.
Project address: https://github.com/chaitin/xpoc
xapp is a tool focused on web fingerprint identification. You can use xapp to identify the technologies used by web targets and prepare for security testing.
Project address: https://github.com/chaitin/xapp
We have created a dedicated repository for various plugins, aimed at facilitating the sharing and use of different plugins.
It mainly collects open-source scripts converted into xray format for everyone to use.
We will periodically push some new plugins here and hope everyone will actively optimize or submit plugins to enrich this repository together.
Project address: https://github.com/chaitin/xray-plugins
Before using, be sure to read and agree to the terms in the License file. If not, please do not install or use this tool.
Use the basic crawler to scan the links crawled by the crawler for vulnerabilities
xray webscan --basic-crawler http://example.com --html-output vuln.html
Use HTTP proxy for passive scanning
xray webscan --listen 127.0.0.1:7777 --html-output proxy.html
Set the browser's HTTP proxy to http://127.0.0.1:7777, then you can automatically analyze proxy traffic and scan it.
To scan HTTPS traffic, please read the "Capture HTTPS Traffic" section below.
Scan a single URL without using a crawler
xray webscan --url http://example.com/?a=b --html-output single-url.html
Manually specify plugins for this run
By default, all built-in plugins will be enabled. You can specify the plugins to be enabled for this scan with the following commands.
xray webscan --plugins cmd-injection,sqldet --url http://example.com
xray webscan --plugins cmd-injection,sqldet --listen 127.0.0.1:7777
Specify Plugin Output
You can specify to output the vulnerability information of this scan to a file:
xray webscan --url http://example.com/?a=b \
--text-output result.txt --json-output result.json --html-output report.html
For other usage, please read the documentation: https://docs.xray.cool
New detection modules will be continuously added.
| Name | Key | Version | Description |
|---|---|---|---|
| XSS Detection | xss | Community | Detects XSS vulnerabilities using semantic analysis |
| SQL Injection Detection | sqldet | Community | Supports error-based injection, boolean-based injection, and time-based blind injection |
| Command/Code Injection Detection | cmd-injection | Community | Supports shell command injection, PHP code execution, template injection, etc. |
| Directory Enumeration | dirscan | Community | Detects over 10 types of sensitive paths and files such as backup files, temporary files, debug pages, and configuration files |
| Path Traversal Detection | path-traversal | Community | Supports common platforms and encodings |
| XML External Entity (XXE) Detection | xxe | Community | Supports detection with echo and back-connect platform |
| POC Management | phantasm | Community | Comes with some common POCs by default; users can build and run POCs as needed. Documentation: POC |
| File Upload Detection | upload | Community | Supports common backend languages |
| Weak Password Detection | brute-force | Community | Community edition supports HTTP basic authentication and simple form weak password detection, with built-in common username and password dictionary |
| JSONP Detection | jsonp | Community | Detects JSONP interfaces containing sensitive information that can be read across domains |
| SSRF Detection | ssrf | Community | SSRF detection module, supports common bypass techniques and back-connect platform detection |
| Baseline Check | baseline | Community | Detects low SSL versions, missing or incorrectly added HTTP headers |
| Arbitrary Redirect Detection | redirect | Community | Supports HTML meta redirects, 30x redirects, etc. |
| CRLF Injection | crlf-injection | Community | Detects HTTP header injection, supports parameters in query, body, etc. |
| XStream Vulnerability Detection | xstream | Community | Detects XStream series vulnerabilities |
| Struts2 Vulnerability Detection | struts | Advanced | Detects Struts2 series vulnerabilities, including common ones like s2-016, s2-032, s2-045, s2-059, s2-061, etc. |
| ThinkPHP Vulnerability Detection | thinkphp | Advanced | Detects related vulnerabilities in websites developed with ThinkPHP |
| Shiro Deserialization Vulnerability Detection | shiro | Advanced | Detects Shiro deserialization vulnerabilities |
| Fastjson Vulnerability Detection | fastjson | Advanced | Detects Fastjson series vulnerabilities |
For the following advanced usage, please see https://docs.xray.cool/.
The progress of xray cannot be achieved without the support of many contributors. In the spirit of mutual assistance and co-construction, to help us all progress together, xray has also opened a channel for "POC inclusion"! Here you will get: