[GitHub] cve-scanner

Rce

Type

N/A

CVSS Score

Views

Anonymous

Author

Description

RCE CVE (≧9.0) scanner

# cve-scanner

Fingerprint-driven blind testing CVE scanner: first identify Web / service fingerprints, and only run CVE/vulnerability exp mapped to hit components. When unable to identify application fingerprints, fall back to full-scale blind testing. Automatically detect targets and verify real command execution (RCE).
**All test environments use real Docker images, no mock.**

---

## Fingerprint-driven workflow

```
target ──► fingerprint.Detect()
│
├─ Hit application fingerprint (WebLogic/Tomcat/Struts2/Spring/Shiro/ActiveMQ/...)
│ └─► Only execute exp mapped to that component (+ universal information disclosure detection)
│
├─ Only hit weak Web service fingerprint (nginx/Apache/PHP/Node.js)
│ └─► Treat as unidentified, execute full exp blind testing
│
└─ No fingerprint matched
└─► Full exp blind testing
```

### Secondary fingerprint extension during collection

All exp requests pass through the same collector (`internal/capture`):

1. First round `fingerprint.Detect()` (`bb` as `QuickDetect`) obtains baseline fingerprint;
2. Each exp / detection response undergoes re-fingerprint matching (`fingerprint.ObserveResponse`);
3. When new components outside baseline appear (e.g., WebLogic / Struts2 / Shiro / Tomcat exposed by subsequent exp responses), immediately merge into fingerprint and continue executing exp mapped to that component; executed detections are deduplicated by `ran` set;
4. Both `bb` and `scan` follow this workflow; `scan` collection results are also the payload source for smuggling replay.

### Smuggling replay after zero success (second pass)

When `bb` normal scan completes with **0 findings** and `scan` globally **0 PASS (no real command echo)**, automatically enter second pass:

1. Collector has recorded each exp request actually sent this round (method / path / headers / body) and direct connection response;
2. For each target, first confirm CL.TE / TE.CL channel using limited TE obfuscation combinations;
3. Replay all collected payloads through the channel one by one (deduplicated by request, no longer limit number of conditions);
4. Smuggling response shows RCE features absent in direct connection response → `CRITICAL`; only confirms channel and successfully delivers → `HIGH`;
5. Smuggling response also undergoes fingerprint identification: if new components are exposed, re-run exp mapped to that component.

Supports http/https; automatically skip if no payloads available for replay (e.g., only ran GET detection). `scan` mode has integrated the same collector, smuggling replay results written to result file with `CVE=SMUGGLING-REPLAY`.

Built-in fingerprint library references matching methods from webanalyze / Wappalyzer (response headers, Server, Set-Cookie, title, body features + deep detection of WebLogic Console / Tomcat Manager / Actuator / Nacos / Metabase / GeoServer / OFBiz / Solr), pure standard library implementation, no third-party dependencies. Component → CVE mapping see [internal/fingerprint/cve_map.go](internal/fingerprint/cve_map.go).

View fingerprint separately:

```bash
./cve-scanner fp -t http://127.0.0.1:7001
./cve-scanner fp -t http://127.0.0.1:8161 -json
```

---

## Supported vulnerabilities

| CVE | Component | Protocol | CVSS | Affected versions | Port | id | whoami | hostname | pwd |
|-----|-----------|----------|------|-------------------|------|-----|--------|----------|-----|
| [CVE-2026-70748](docs/CVE-2026-70748.md) | Oracle WebLogic Server | T3/IIOP | 9.8 | 12.2.1.4, 14.1.1.0 | 7

Translated to English from Chinese. Show original · see the source links.

Original (Chinese):

RCE CVE（≧9.0） scanner

# cve-scanner

指纹驱动的盲测 CVE 扫描器：先识别 Web / 服务指纹，命中组件只跑该组件映射的 CVE/漏洞 exp，
识别不到应用指纹时回退全量盲测。自动检测目标并验证真实命令执行（RCE）。
**全部靶场使用真实 Docker 镜像，无 mock。**

---

## 指纹驱动流程

```
target ──► fingerprint.Detect()
│
├─ 命中应用指纹（WebLogic/Tomcat/Struts2/Spring/Shiro/ActiveMQ/...）
│ └─► 只执行该组件映射的 CVE exp（+ 通用泄露探测）
│
├─ 仅命中 Web 服务弱指纹（nginx/Apache/PHP/Node.js）
│ └─► 视为未识别，执行全量 exp 盲测
│
└─ 未命中任何指纹
└─► 全量 exp 盲测
```

### 采集中途的指纹二次扩展

所有 exp 请求都经过同一个采集器（`internal/capture`）：

1. 首轮 `fingerprint.Detect()`（`bb` 为 `QuickDetect`）得到 baseline 指纹；
2. 每条 exp / 探测响应都会被重新做一次指纹匹配（`fingerprint.ObserveResponse`）；
3. 出现 baseline 之外的新组件（例如首次访问没识别到、但后续 exp 响应暴露的
WebLogic / Struts2 / Shiro / Tomcat 等），立即合并进指纹并继续执行该组件映射的
exp；已执行过的探测由 `ran` 集合去重；
4. `bb` 与 `scan` 都走这套流程；`scan` 的采集结果同时是走私回放的 payload 来源。

### 零成功后的走私回放（第二遍）

`bb` 正常扫描完且 **0 findings**、`scan` 全局 **0 个 PASS（无真实命令回显）** 时，自动进入第二遍：

1. 采集器已记录本轮实际发送的每个 exp 请求（method / path / headers / body）及直连响应；
2. 对每个目标先用限定的 TE 混淆组合确认 CL.TE / TE.CL 通道；
3. 把采集到的 payload **全部**经通道逐条重放一次（按请求去重，不再限制条数）；
4. 走私响应出现直连响应中没有的 RCE 特征 → `CRITICAL`；仅确认通道并成功投递 → `HIGH`；
5. 走私响应同样会被指纹识别：若暴露了新组件，再补跑该组件映射的 exp。

支持 http/https；无 payload 可回放（如只跑了 GET 探测）则自动跳过。`scan` 模式已接入
同一采集器，走私回放结果以 `CVE=SMUGGLING-REPLAY` 写入结果文件。

内置指纹库参考 webanalyze / Wappalyzer 的匹配方式（响应头、Server、Set-Cookie、title、
body 特征 + WebLogic Console / Tomcat Manager / Actuator / Nacos / Metabase / GeoServer /
OFBiz / Solr 深度探测），纯标准库实现，无第三方依赖。组件 → CVE 映射见
[internal/fingerprint/cve_map.go](internal/fingerprint/cve_map.go)。

单独查看指纹：

```bash
./cve-scanner fp -t http://127.0.0.1:7001
./cve-scanner fp -t http://127.0.0.1:8161 -json
```

---

## 支持漏洞

| CVE | 组件 | 协议 | CVSS | 受影响版本 | 端口 | id | whoami | hostname | pwd |
|-----|------|------|------|-----------|------|-----|--------|----------|-----|
| [CVE-2026-70748](docs/CVE-2026-70748.md) | Oracle WebLogic Server | T3/IIOP | 9.8 | 12.2.1.4, 14.1.1.0 | 7

References

https://github.com/hktalent/cve-scanner

[GitHub] cve-scanner

Description

References

Community Rating

Quick Actions

Related Exploits