[GitHub] cve-scanner

Rce

Type

N/A

CVSS Score

Views

Anonymous

Author

Description

RCE CVE (≥9.0) scanner

# cve-scanner

Fingerprint-driven blind testing CVE scanner: first identifies Web/service fingerprints, matching components only run their mapped CVE/vulnerability exp, and falls back to full blind testing when application fingerprints are not recognized. Automatically detects targets and verifies actual command execution (RCE).
**All ranges use real Docker images, no mock.**

---

## Fingerprint-driven workflow

```
target ──► fingerprint.Detect()
│
├─ Matched application fingerprint (WebLogic/Tomcat/Struts2/Spring/Shiro/ActiveMQ/...)
│ └─► Only execute CVE exp mapped to this component (+ generic leak detection)
│
├─ Only matched weak Web service fingerprint (nginx/Apache/PHP/Node.js)
│ └─► Treated as unrecognized, execute full exp blind testing
│
└─ No fingerprint matched
└─► Full exp blind testing
```

### Secondary fingerprint expansion during collection

All exp requests pass through the same collector (`internal/capture`):

1. First round `fingerprint.Detect()` (`bb` as `QuickDetect`) obtains baseline fingerprint;
2. Each exp/probe response undergoes fingerprint re-matching (`fingerprint.ObserveResponse`);
3. New components appearing outside baseline (e.g., not recognized on first access, but subsequent exp responses expose WebLogic/Struts2/Shiro/Tomcat, etc.) are immediately merged into fingerprints and continue executing mapped exp; executed probes are deduplicated by `ran` set;
4. Both `bb` and `scan` follow this workflow; `scan`'s collection results are also the payload source for smuggling replay.

### Smuggling replay after zero success (second pass)

When `bb` normal scanning completes with **0 findings** and `scan` has globally **0 PASS (no actual command echo)**, automatically enter second pass:

1. Collector has recorded each actual exp request sent this round (method/path/headers/body) and direct connection response;
2. For each target, first use limited TE obfuscation combinations to confirm CL.TE/TE.CL channel;
3. Replay all collected payloads once through the channel (deduplicate by request, no longer limit payload count);
4. Smuggling response shows RCE features not in direct connection response → `CRITICAL`; only confirm channel and successful delivery → `HIGH`;
5. Smuggling response also undergoes fingerprint identification: if new components are exposed, additionally run their mapped exp.

Support http/https; if no payloads available for replay (e.g., only ran GET probes), automatically skip. `scan` mode has integrated the same collector, smuggling replay results written to result file as `CVE=SMUGGLING-REPLAY`.

Built-in fingerprint library references webanalyze/Wappalyzer matching methods (response headers, Server, Set-Cookie, title, body features + WebLogic Console/Tomcat Manager/Actuator/Nacos/Metabase/GeoServer/OFBiz/Solr deep detection), pure standard library implementation, no third-party dependencies. Component → CVE mapping see [internal/fingerprint/cve_map.go](internal/fingerprint/cve_map.go).

View fingerprint separately:

```bash
./cve-scanner fp -t http://127.0.0.1:7001
./cve-scanner fp -t http://127.0.0.1:8161 -json
```

---

## Supported vulnerabilities

| CVE | Component | Protocol | CVSS | Affected versions | Port | id | whoami | hostname | pwd |
|-----|-----------|----------|------|-------------------|------|-----|--------|----------|-----|
| [CVE-2026-70748](docs/CVE-2026-70748.md) | Oracle WebLogic Server | T3/IIOP | 9.8 | 12.2.1.4, 14.1.1.0 | 7

Translated to English from Chinese. Show original · see the source links.

Original (Chinese):

RCE CVE（≧9.0） scanner

# cve-scanner

指纹驱动的盲测 CVE 扫描器：先识别 Web / 服务指纹，命中组件只跑该组件映射的 CVE/漏洞 exp，
识别不到应用指纹时回退全量盲测。自动检测目标并验证真实命令执行（RCE）。
**全部靶场使用真实 Docker 镜像，无 mock。**

---

## 指纹驱动流程

```
target ──► fingerprint.Detect()
│
├─ 命中应用指纹（WebLogic/Tomcat/Struts2/Spring/Shiro/ActiveMQ/...）
│ └─► 只执行该组件映射的 CVE exp（+ 通用泄露探测）
│
├─ 仅命中 Web 服务弱指纹（nginx/Apache/PHP/Node.js）
│ └─► 视为未识别，执行全量 exp 盲测
│
└─ 未命中任何指纹
└─► 全量 exp 盲测
```

### 采集中途的指纹二次扩展

所有 exp 请求都经过同一个采集器（`internal/capture`）：

1. 首轮 `fingerprint.Detect()`（`bb` 为 `QuickDetect`）得到 baseline 指纹；
2. 每条 exp / 探测响应都会被重新做一次指纹匹配（`fingerprint.ObserveResponse`）；
3. 出现 baseline 之外的新组件（例如首次访问没识别到、但后续 exp 响应暴露的
WebLogic / Struts2 / Shiro / Tomcat 等），立即合并进指纹并继续执行该组件映射的
exp；已执行过的探测由 `ran` 集合去重；
4. `bb` 与 `scan` 都走这套流程；`scan` 的采集结果同时是走私回放的 payload 来源。

### 零成功后的走私回放（第二遍）

`bb` 正常扫描完且 **0 findings**、`scan` 全局 **0 个 PASS（无真实命令回显）** 时，自动进入第二遍：

1. 采集器已记录本轮实际发送的每个 exp 请求（method / path / headers / body）及直连响应；
2. 对每个目标先用限定的 TE 混淆组合确认 CL.TE / TE.CL 通道；
3. 把采集到的 payload **全部**经通道逐条重放一次（按请求去重，不再限制条数）；
4. 走私响应出现直连响应中没有的 RCE 特征 → `CRITICAL`；仅确认通道并成功投递 → `HIGH`；
5. 走私响应同样会被指纹识别：若暴露了新组件，再补跑该组件映射的 exp。

支持 http/https；无 payload 可回放（如只跑了 GET 探测）则自动跳过。`scan` 模式已接入
同一采集器，走私回放结果以 `CVE=SMUGGLING-REPLAY` 写入结果文件。

内置指纹库参考 webanalyze / Wappalyzer 的匹配方式（响应头、Server、Set-Cookie、title、
body 特征 + WebLogic Console / Tomcat Manager / Actuator / Nacos / Metabase / GeoServer /
OFBiz / Solr 深度探测），纯标准库实现，无第三方依赖。组件 → CVE 映射见
[internal/fingerprint/cve_map.go](internal/fingerprint/cve_map.go)。

单独查看指纹：

```bash
./cve-scanner fp -t http://127.0.0.1:7001
./cve-scanner fp -t http://127.0.0.1:8161 -json
```

---

## 支持漏洞

| CVE | 组件 | 协议 | CVSS | 受影响版本 | 端口 | id | whoami | hostname | pwd |
|-----|------|------|------|-----------|------|-----|--------|----------|-----|
| [CVE-2026-70748](docs/CVE-2026-70748.md) | Oracle WebLogic Server | T3/IIOP | 9.8 | 12.2.1.4, 14.1.1.0 | 7

References

https://github.com/hktalent/cve-scanner

[GitHub] cve-scanner

Description

References

Community Rating

Quick Actions

Related Exploits