PoC Specification #

PoC Number #

The PoC number ID is the same as the vulnerability ID. For example, the vulnerabilities in the Seebug are numbered by SSV-xxx, and the PoC number is xxx.

PoC Naming Convention #

Poc Naming: _<PoC number>_<Component>_<Affected version>_<Vulnerability type>, look like this:

_1847_seeyon_3_1_login_info_disclosure.py

PoC Third-party Module Dependency #

When writing PoC, try not to use third-party modules. If necessary, please add the install_requires field in the basic information part of the PoC, and fill in the dependent module name in the following format:

install_requires =[str_item_, str_item, …] # The value of the entire field is list, and each item is a dependent module.

str_item format: module name[><=]version number, the module name is the module name when pip install is installed (please do not fill in the module name of import).

If you encounter the inconsistency between the module name during installation and the call, use : to separate, such as the common encryption algorithm library pycryptodome, but the call is from Crypto.Cipher import AES, then you need to fill in the following :

install_requires = ['pycryptodome>=3.12.0:Crypto']

PoC Result Convention #

result is the result data returned by PoC. The return value of result requires a complete item to be returned. It does not meet the situation of the result field and is placed in the extra field. This step must ensure that the operator can reproduce/understand according to the information as much as possible. Vulnerabilities, if the steps are complicated, are described in the forensic information. E.g:

# Return the database administrator password
result['DBInfo'] = {}
result['DBInfo']['Password']='xxxxx'
# return webshell address
result['ShellInfo'] = {}
result['ShellInfo']['URL'] = 'xxxxx'
# return webmaster username
result['AdminInfo'] = {}
result['AdminInfo']['Username']='xxxxx'

extra field description

The extra field is a supplementary field of the general result field. If the content to be returned does not belong to the general result field, you can use the extra field to assign values. The extra field is in dict format and can be assigned a custom key, such as:

result['extra'] = {}
result['extra']['field'] = 'aa'

Special Fields

evidence, for the forensic information returned in the result, the definition field name is only allowed to be evidence, and can only be stored in the extar field, that is:

result['extra'] = {}
result['extra' ]['evidence'] = 'aa'

General Field Description (Just an example of the field meaning, not the standard JSON format)

result: [
    { name: 'DBInfo', value: 'Database content' },
        { name: 'Username', value: 'Admin username'},
        { name: 'Password', value: 'Admin password' },
        { name: 'Salt', value: 'Salt value'},
        { name: 'Uid', value: 'User ID'},
        { name: 'Groupid', value: 'User group ID'},


    { name: 'ShellInfo', value: 'Webshell info'},
        { name: 'URL', value: 'Webshell address'},
        { name: 'Content', value: 'Webshell content'},


    { name: 'FileInfo', value: 'File Info'},
        { name: 'Filename', value: 'Filename'},
        { name: 'Content', value: 'file content'},


    { name: 'XSSInfo', value: 'Cross-site scripting information'},
        { name: 'URL', value: 'Authentication URL'},
        { name: 'Payload', value: 'Authentication Payload'},


    { name: 'AdminInfo', value: 'Admin Info'},
        { name: 'Uid', value: 'Admin ID'},
        { name: 'Username', value: 'Admin username'},
        { name: 'Password', value: 'Admin password'},


    { name: 'Database', value: 'Database information' },
        { name: 'Hostname', value: 'Database hostname'},
        { name: 'Username', value: 'Database username' },
        { name: 'Password', value: 'Database password'},
        { name: 'DBname', value: 'DBname'},


    { name: 'VerifyInfo', value: 'Verify Info'},
        { name: 'Target', value: 'Authentication host:port'},
        { name: 'URL', value: 'Authentication URL'},
        { name: 'Postdata', value: 'Verify POST data'},
        { name: 'Path', value: 'Website absolute path'},


    { name: 'SiteAttr', value: 'Website server information'},
    { name: 'Process', value: 'Server Process'}

]

Vulnerability Type Specification #

See also Seebug Vulnerability Type Specification.