Critical Severity
Published: Nov 2, 2026
# RCE CVE(≧9.0) Scanner
# cve-scanner
Fingerprint-driven blind testing CVE scanner: first identifies Web/service fingerprints, hits component only runs the CVE/vulnerability exp mapped to that component, falls back to full blind testing when unable to identify application fingerprint. Automatically detects targets and verifies actual command execution (RCE).
**All target ranges use real Docker images, no mock.**
---
## Fingerprint-driven workflow
```
target ──► fingerprint.Detect()
│
├─ Hit application fingerprint (WebLogic/Tomcat/Struts2/Spring/Shiro/ActiveMQ/...)
│ └─► Only execute CVE exp mapped to that component (+ universal information disclosure detection)
│
├─ Hit only Web service weak fingerprint (nginx/Apache/PHP/Node.js)
│ └─► Treat as unidentified, execute full exp blind testing
│
└─ No fingerprint matched
└─► Full exp blind testing
```
### Secondary fingerprint expansion during collection
All exp requests go through the same collector (`internal/capture`):
1. First round `fingerprint.Detect()` (`bb` is `QuickDetect`) obtains baseline fingerprint;
2. Each exp/detection response is re-fingerprinted (`fingerprint.ObserveResponse`);
3. New components outside baseline appear (e.g., not identified on first access but later exp responses expose WebLogic/Struts2/Shiro/Tomcat, etc.), immediately merge into fingerprint and continue executing exp mapped to that component; already executed detections are deduplicated by `ran` set;
4. Both `bb` and `scan` follow this workflow; `scan` collection results are simultaneously the payload source for smuggling replay.
### Smuggling replay after zero success (second pass)
When `bb` normal scan completes with **0 findings** and `scan` globally has **0 PASS (no actual command output)**, automatically enter second pass:
1. Collector has recorded each exp request actually sent this round (method/path/headers/body) and direct connection response;
2. For each target first use limited TE obfuscation combination to confirm CL.TE/TE.CL channel;
3. Replay all collected payloads through channel once each (deduplicate by request, no longer limit count);
4. Smuggling response appears RCE features not in direct connection response → `CRITICAL`; only confirm channel and successfully deliver → `HIGH`;
5. Smuggling response similarly goes through fingerprint identification: if new component exposed, supplement running exp mapped to that component.
Supports http/https; if no payload available for replay (e.g., only ran GET detection) automatically skip. `scan` mode has integrated the same collector, smuggling replay results written to results file as `CVE=SMUGGLING-REPLAY`.
Built-in fingerprint library references matching methods from webanalyze/Wappalyzer (response headers, Server, Set-Cookie, title, body features + WebLogic Console/Tomcat Manager/Actuator/Nacos/Metabase/GeoServer/OFBiz/Solr deep detection), pure standard library implementation, no third-party dependencies. Component → CVE mapping see [internal/fingerprint/cve_map.go](internal/fingerprint/cve_map.go).
View fingerprint separately:
```bash
./cve-scanner fp -t http://127.0.0.1:7001
./cve-scanner fp -t http://127.0.0.1:8161 -json
```
---
## Supported Vulnerabilities
| CVE | Component | Protocol | CVSS | Affected Versions | Port | id | whoami | hostname | pwd |
|-----|-----------|----------|------|-------------------|------|-----|--------|----------|-----|
| [CVE-2026-70748](docs/CVE-2026-70748.md) | Oracle WebLogic Server | T3/IIOP | 9.8 | 12.2.1.4, 14.1.1.0 | 7