snowpick

snowpick 是一个 ServiceNow 暴露面扫描器，用于发现配置错误的小部件 ACL、REST API 访问控制以及未认证的数据暴露。

ServiceNow 通过两个常见的公共暴露面暴露数据：Service Portal 小部件和 Table REST API。当任一暴露面上的访问控制配置错误时，未认证的用户可能能够查询内部记录，例如事件工单、用户目录、知识库文章和服务目录项。snowpick 会测试这两个暴露面，将行数据暴露与仅计数证据区分开来，并为授权验证生成复现详情。

工作原理

snowpick 无需任何凭据即可从 ServiceNow 登录页面获取会话令牌，然后使用该令牌查询平台的内部 API。它会检查两个攻击面：

Widget（小部件） 是驱动 ServiceNow Service Portal 的小型应用。每个小部件都有自己的访问控制设置。当这些设置过于宽松时，未认证的会话可能能够从小部件中检索数据。snowpick 首先尽可能向实例请求已安装小部件的列表，然后逐一探测每个小部件，检查其返回的是记录还是仅计数证据。

Table API 是位于 /api/now/table/ 的 REST 接口，用于直接查询 ServiceNow 表。它的访问控制与小部件相互独立，因此目标可能在一个暴露面上被锁定，却在另一个暴露面上开放。snowpick 会探测 sys_user、incident 和 oauth_entity 等高价值表。

计数预言机（Count oracle）。 有时小部件或表会确认存在匹配记录，却不返回行数据。snowpick 会将其标记为 count_oracle——既不算完全暴露，也不算彻底干净，因为可以通过过滤器探测计数来盲目推断数据。

安装

❯ go install github.com/BishopFox/snowpick@latest

或者从源码构建：

❯ git clone https://github.com/BishopFox/snowpick.git
❯ cd snowpick
❯ go build -o snowpick .

需要 Go 1.21 或更高版本。

使用方法

基础扫描

将 snowpick 指向一个 ServiceNow 实例。无需任何凭据。

❯ snowpick -target prod.service-now.com
snowpick v1.0.0 | 1 targets | 6 widgets | proxy direct
[!] prod.service-now.com
  | ticket-attachments 272 records [internal_operations:inferred]
[*] 1/1 targets complete, 1 with findings

RESULTS
1 targets scanned in 8.2s | 1 reachable | 1 with findings

  EXPOSED prod.service-now.com  272 records [internal_operations:inferred]
    | ticket-attachments       272 records [internal_operations:inferred]
    |   ServiceNow Overview and Open House 'How To.... Videos'
    |   How to - JIRA and Confluence Access Process
    |   Updating Your Personal Time Zone in ServiceNow

ATTACK SURFACE
  ticket-attachments           #################### 272 across 1 target

DATA CLASSIFICATION
  OPERATIONS          1 finding across 1 target

snowpick 会自动发现实例上已安装的小部件，并连同其内置默认项逐一探测。发现结果按严重程度排序。

理解输出

Progress markers (left of each host):
  [!] findings   [+] clean   [-] unreachable or no session   [*] progress

Summary buckets:
  EXPOSED  data or a confirmed count came back      CLEAN  nothing reachable
  SKIP     no public session (e.g. SSO-only login)  DOWN   host unreachable

Counts:
  272 records              total the instance reports as matching
  272 records, 10 sampled  total, plus the rows snowpick pulled as evidence

Tags:
  [pii:observed]   a hint, written as category:basis
                   basis  observed = value seen in returned data
                          inferred = from a table/field/widget name
                   category  pii, credentials, infrastructure,
                             internal_operations, review_required
  [blind oracle]   count confirmed but no rows returned (a count_oracle)
  [API]            finding came from the Table REST API, not a widget
  [stats.do]       the /stats.do diagnostic endpoint is publicly reachable

扫描多个目标

传入一个每行包含一个主机名的文件。snowpick 会并行扫描这些目标。

❯ snowpick -targets hosts.txt -concurrency 5
snowpick v1.0.0 | 6 targets | 6 widgets | proxy direct
[!] prod.service-now.com
  | ticket-attachments 272 records [internal_operations:inferred]
[*] 1/6 targets complete, 1 with findings
[+] staging.service-now.com clean
[*] 2/6 targets complete, 1 with findings
[!] dev.service-now.com [stats.do]
  | ticket-attachments 61 records [internal_operations:inferred]
[*] 3/6 targets complete, 2 with findings
[+] sandbox.service-now.com clean
[*] 4/6 targets complete, 2 with findings
[-] internal.service-now.com bootstrap failed: /login.do returned 302
[+] test.service-now.com clean
[*] 6/6 targets complete, 2 with findings

REST API 探测

ServiceNow 还在 /api/now/table/ 上暴露了 Table REST API，用于直接查询后端表。这是一个与小部件相互独立的访问控制面。使用 -table-api 可同时检查两者。

❯ snowpick -target prod.service-now.com -table-api
snowpick v1.0.0 | 1 targets | 6 widgets | proxy direct
[!] prod.service-now.com
  | [API] cmn_department 1,234 records, 10 sampled [infrastructure:inferred]
[*] 1/1 targets complete, 1 with findings

对于 Table API 发现，record_count 表示当 ServiceNow 返回总数时实例暴露的记录总数。sample_count 显示 snowpick 作为受限证据收集的记录数。

表发现

默认情况下，snowpick 会检查一组精选的高价值表（事件工单、用户记录、附件等）。使用 -discover 时，它会尝试从实例中枚举表名并一并检查。

❯ snowpick -target prod.service-now.com -discover -discover-limit 200

版本检测

使用 -fingerprint 来识别目标运行的 ServiceNow 版本。这有助于确定目标已应用了哪些安全补丁。

❯ snowpick -target prod.service-now.com -fingerprint
snowpick v1.0.0 | 1 targets | 6 widgets | proxy direct
[!] prod.service-now.com [Zurich (glide-zurich-07-01-2025__patch7-02-19-2026)] [stats.do]
  | ticket-attachments 61 records [internal_operations:inferred]
[*] 1/1 targets complete, 1 with findings

代理与速率限制

通过 Burp、ZAP 或 SOCKS 代理路由流量。使用 -rate 可限制对生产实例的请求速率。

❯ snowpick -target prod.service-now.com -proxy socks5://127.0.0.1:1080 -insecure -rate 200ms

管道模式

使用 -quiet 抑制进度输出。JSON 默认输出到 stdout，或通过 -output 输出到文件。退出码 2 表示存在发现，1 表示一个或多个目标无法测试，0 表示扫描完成且无发现。

❯ snowpick -target prod.service-now.com -quiet -output results.json
❯ echo $?
2

处理结果

JSON 输出包含发现详情，包括影响提示、请求详情、返回行数据时的受限示例记录，以及适用的复现材料。

JSON 结构

{
  "target": "acme.service-now.com",
  "reachable": true,
  "token_obtained": true,
  "stats_do": false,
  "widgets": [
    {
      "id": "ff26f2b1db12220099f93691f0b8f5ce",
      "name": "ticket-attachments",
      "status": "exposed",
      "record_count": 847,
      "sample_count": 10,
      "hints": [
        {
          "category": "pii",
          "basis": "observed",
          "reason": "email pattern in sample content",
          "signals": ["content:[email protected]"]
        },
        {
          "category": "internal_operations",
          "basis": "inferred",
          "reason": "widget name associated with internal operations",
          "signals": ["widget:ticket-attachments"]
        }
      ],
      "reproduction": {
        "method": "POST",
        "url": "https://acme.service-now.com/api/now/sp/widget/ff26f2b1db12220099f93691f0b8f5ce",
        "headers": {"X-UserToken": "...", "Cookie": "JSESSIONID=..."},
        "body": "{\"payload\":{\"start\":0,\"end\":1}}",
        "status_code": 200,
        "curl": "curl -i -sS -X 'POST' ..."
      }
    }
  ]
}

表枚举发现显示在 table_findings 下，Table REST API 发现显示在 table_api_findings 下。它们使用相同的 hints 结构。当存在总数时，Table API 发现还会同时包含 record_count 和 sample_count。

常用的 jq 查询

列出所有存在发现的目标：

❯ jq -r '.findings[] | select(any(.widgets[]?; .status == "exposed" or .status == "count_oracle") or ((.table_findings // []) | length > 0) or ((.table_api_findings // []) | length > 0)) | .target' results.json
prod.service-now.com
dev.service-now.com

获取暴露发现的复现 curl 命令（复制粘贴即可复现）：

❯ jq -r '.findings[] | (.widgets[]?, .table_findings[]?, .table_api_findings[]?) | select(.status == "exposed") | .reproduction.curl' results.json
curl -i -sS -X 'POST' 'https://acme.service-now.com/api/now/sp/widget/ff26f...' -H 'X-UserToken: MOCK_TOKEN' ...

显示 PII 发现及其目标、向量、状态、计数、示例和提示依据：

❯ jq -r '.findings[] as $f | ($f.widgets[]?, $f.table_findings[]?, $f.table_api_findings[]?) | select(any(.hints[]?; .category=="pii")) | [$f.target, (.name // (.table + (if .field then "." + .field else "" end))), .status, ((.record_count // .count // 0)|tostring), ((.sample_count // 0)|tostring), ([.hints[]? | select(.category=="pii") | .basis] | unique | join(","))] | @tsv' results.json
acme.service-now.com	ticket-attachments	exposed	847	10	observed
acme.service-now.com	sys_user	exposed	250	10	inferred

获取某个发现的示例标题：

❯ jq -r '.findings[] | select(.target == "acme.service-now.com") | .widgets[] | select(.name == "ticket-attachments") | .samples[]?.title' results.json
Synthetic ticket attachment title
Example onboarding guide

统计暴露的记录总数：

❯ jq '[.findings[] | (.widgets[]? | select(.status == "exposed") | .record_count), (.table_findings[]? | select(.status == "exposed") | .count), (.table_api_findings[]? | select(.status == "exposed") | .record_count)] | add // 0' results.json
12896

参数

TARGETS
  -target string          Single ServiceNow hostname
  -targets string         File with one hostname per line

OUTPUT
  -output string          JSON output file (default: stdout)
  -quiet                  Suppress informational output
  -version                Print version and exit

CONNECTION
  -proxy string           Proxy URL (http, https, socks5, socks5h)
  -timeout duration       HTTP timeout per request (default: 15s)
  -insecure               Skip TLS certificate verification
  -rate duration          Minimum interval between requests (default: unlimited)
  -vendor string          X-Vendor header for engagement tracking

SCANNING
  -concurrency int        Max parallel targets (default: 3)
  -table-concurrency int  Max parallel table probes per target (default: 5)
  -samples int            Sample records per exposed finding (default: 10)

WIDGET PROBING
  -widgets string         Comma-separated widget IDs (overrides defaults)
  -widgets-file string    JSON file with additional widget candidates

TABLE ENUMERATION
  -tables                 Enumerate via widget-simple-list (default: true)
  -tables-file string     JSON file with additional table/field candidates
  -table-api              Probe /api/now/table/ REST API

DISCOVERY
  -discover               Discover tables dynamically from the instance
  -discover-limit int     Max tables from discovery (default: 100)
  -discover-widgets-limit int
                          Max widgets from discovery (default: 50)
  -fingerprint            Detect ServiceNow version and release

扩展覆盖范围

snowpick 自带 6 个默认小部件和 26 个默认表/字段对。您可以使用 JSON 文件在不修改代码的情况下添加更多内容：

小部件候选（-widgets-file）：

[{"id": "WIDGET_ID", "name": "custom-widget"}]

表候选（-tables-file）：

[{"table": "TABLE_NAME", "field": "FIELD_NAME"}]

这些会与内置默认项合并，重复项会自动移除。

免责声明

本工具仅用于授权安全测试和研究目的。您有责任确保已获得明确许可，才能测试您锁定的任何 ServiceNow 实例。未经授权访问计算机系统属违法行为。作者不对滥用行为承担任何责任。

许可证

MIT