zer0yu/zeroscanMulti-Thread Vulnerability Verify Framework
ZEROScan is a multi-threaded vulnerability detection framework. Through it, you can easily obtain or develop vulnerability detection plugins to perform penetration testing on targets. The interface and usage are inspired by the metasploit-framework, making it easy to get started and develop plugins.
$ git clone https://github.com/zer0yu/ZEROScan.git
Or you can download the latest zip source package and extract it for installation:
$ wget https://codeload.github.com/zer0yu/ZEROScan/zip/master
$ unzip ZEROScan-master.zip
➜ ZEROScan git:(master) ✗ python z-console.py
____________ _____ ____ _____
|___ / ____| __ \ / __ \ / ____|
/ /| |__ | |__) | | | | (___ ___ __ _ _ __
/ / | __| | _ /| | | |\___ \ / __/ _` | '_ \
/ /__| |____| | \ \| |__| |____) | (_| (_| | | | |
/_____|______|_| \_\\____/|_____/ \___\__,_|_| |_|
+ -- --=[ ZEROScan - 1.0 ]
# Execute the help command to view the description of each parameter.
ZEROScan > help
Core Commands
=============
Command Description
------- -----------
run Run current plugin
help Help menu
use <plugin> Select a plugin by name
update Update the framework
search <keyword> Search plugin names and descriptions
set <option> <value> Set a variable to a value
info <plugin> Display information about one plugin
list List all plugins
version Show the framework version numbers
exit Exit the console
options Display options for current plugin
# Use the list command to display all current plugins
ZEROScan > list
\Modules
=======
expName appName appVersion description
--------- --------- ------------ -----------------------------
demo PHP 1230 PH1424/down.php SQL Injection
# Use the info command to view details of the corresponding plugin
ZEROScan > info demo
appName: PHP
appVersion: 1230
Author:
123
Description:
PH1424/down.php SQL Injection
Reference:
http://124.xyz/
# Use the use command to specify the plugin to call
ZEROScan > use demo
# Use the options command to view the corresponding settings for this plugin
ZEROScan exploit(demo) > options
# Batch scan files should be placed in the target directory
# For batch scanning, set the url parameter directly to the filename (no .txt extension needed)
Name Current Setting Required Description
------ ----------------- ---------- --------------------------
URL 1 URL or URL file
Thread 1 0 Threads
Cookie 0 Cookie
Report False 0 do you need a html report?
# Use the set command to configure
ZEROScan exploit(demo) > set URL ww.baidu.com
URL => ww.baidu.com
# Use the run command to execute the corresponding plugin
ZEROScan exploit(demo) > run
[!]exploit target:'ww.baidu.com'
[!]Requesting target site:ww.baidu.com
+--------------+------------+-------------+
| target-url | poc-name | status |
+==============+============+=============+
| ww.baidu.com | demo | test_plugin |
+--------------+------------+-------------+
success : 1
# The final results will be saved in a txt file under the output directory
ZEROScan exploit(demo) >
#!/usr/bin/env python
# -*- coding:utf-8 -*-
import re
from lib.core import log
# You can import the requests library from thirdparty
#from thirdparty import requests
# expInfo() is a required function; fill in the following information here
def expInfo():
expInfo={}
expInfo["appName"] = "PHP"
expInfo["appVersion"] = "123"
expInfo["author"] = "Z3r0yu"
expInfo["description"] = "PHPxxx/down.php SQL Injection"
expInfo["references"] = "http://zeroyu.xyz/"
expInfo["options"] = [
{
"Name": "URL",
"Current Setting": "",
"Required": True,
"Description": "URL or URL file"
},
{
"Name": "Thread",
"Current Setting": "1",
"Required": False,
"Description": "Threads"
},
{
"Name": "Cookie",
"Current Setting": "",
"Required": False,
"Description": "cookie"
},
{
"Name": "Report",
"Current Setting": "",
"Required": False,
"Description": "do you need a html report?"
},
]
return expInfo
# You can freely define the functions you need in the plugin
def yourDefinition():
return "test_plugin"
# exploit(target, headers=None) is the execution function, it is required, and needs two parameters
# The target parameter is used to specify the target, headers can be used to implement random UA
def exploit(target, headers=None):
log.process("Requesting target site:"+ target)
# Return the information you want
# However, the framework will consider a scan with a return value as successful and display it
return yourDefinition()
This software is intended for learning and communication purposes only. Do not use it for illegal activities. The author is not responsible for any consequences arising from misuse.