PoC With Customizable Parameters

Example

If you need to write a PoC with customizable parameters, for example, some PoC scripts need to fill in login information or execute arbitrary commands, then you can declare a _options method in the PoC file. A simple example is as follows:

from pocsuite3.api import Output, POCBase, POC_CATEGORY, register_poc, requests, VUL_TYPE
from pocsuite3.api import OrderedDict, OptString


class DemoPOC(POCBase):
    vulID = '0'
    version = '1.0'
    author = ['seebug']
    vulDate = '2019-2-26'
    createDate = '2019-2-26'
    updateDate = '2019-2-25'
    references = ['']
    name = 'Custom command parameter login example'
    appPowerLink = 'http://www.knownsec.com/'
    appName = 'test'
    appVersion = 'test'
    vulType = VUL_TYPE.XSS
    desc = ''
    samples = []
    category = POC_CATEGORY.EXPLOITS.WEBAPP

    def _options(self):
        o = OrderedDict()
        o["username"] = OptString('', description='This poc requires the user to log in, please enter the username', require=True)
        o["password"] = OptString('', description='This poc requires a user password, please enter the user password', require=False)
        return o

    def _verify(self):
        result = {}
        payload = "username={0}&password={1}".format(self.get_option("username"), self.get_option("password"))
        r = requests.post(self.url, data=payload)
        if r.status_code == 200:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url
            result['VerifyInfo']['Postdata'] = payload

        return self.parse_output(result)

    def _attack(self):
        return self._verify()


register_poc(DemoPOC)

You can use this PoC both in console and cli mode.

In console mode, you need to use set command to set the corresponding parameters, and then use run or check command to execute (attack and shell commands also work) .
In cli mode, as shown in the above example, two fields username and password are defined. You can add --username test --password test as the CLI parameter. If your parameter contains spaces, wrap it with double quotes ".

Parameter Types

Similar to above, if you want to use a custom parameter, define it in the _options method. The custom parameter types supported by Pocsuite3 are as follows:

from pocsuite3.api import OptString, OptDict, OptIP, OptPort, OptBool, OptInteger, OptFloat, OptItems

It should be noted that console mode supports all parameter types, and cli mode supports all types except OptDict, OptBool, OptItems.

PoC With Customizable Parameters #

Example #

Parameter Types #

PoC With Customizable Parameters

Example

Parameter Types