tsojan / tsojanscan Goto Github PK
View Code? Open in Web Editor NEWAn integrated BurpSuite vulnerability detection plug-in.
An integrated BurpSuite vulnerability detection plug-in.
目前druid存在大量重复结果
增加一个heapdump扫描
能否加个扫描域名白名单和扫描启动按钮,避免一启动插件就无差别的扫所有经过burp的域名。
从logger日志里就能看到有大量的扫描请求。
如题,现在好像只能是ceye,现在这个平台挂了,好多用dnslog检测的洞都用不了了
黑名单支持:*.a.com这种方式吗
建议添加自定义扫描路径功能
请问师傅为何我的插件不能被动扫描呢
响应的延时不对呢,重放burp并没有注入
多次发现jeecgboot的ssit与sql注入是出现在不同的根目录下,例如/xxx/jmreport/queryFieldBySql 下
实战三场红蓝,快准狠,误报难免,期待后续版本
请问师傅为何我的插件不能被动扫描呢
相同路径不同数据包会报出相同的漏洞,导致相同的漏洞出现多次,建议增加去重功能。同时也可以减少发包量。
纯被动会存在没有扫描到的情况,建议添加主动
添加域名的黑名单只能一个个域名的添加,可不可以一次性加完所有的黑名单?
首先感谢作者大大写的工具 ,可以开放一下源代码吗? 谢谢作者大大
在插件中配置dns地址后,被动用log4j去扫描地址。后续几天没使用burp过,一直看到目标去请求log4j-payload的请求,这是什么原因?流量太大了
例如: config.yml
Fastjson:
- "xxxx"
Log4j:
- "xxxx"
Shiro:
- "xxxx"
fastjson 扫描出错java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
fastjson 扫描出错java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
fastjson 扫描出错java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
fastjson 扫描出错java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
fastjson 扫描出错java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
fastjson 扫描出错java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
fastjson 扫描出错java.lang.IllegalArgumentException: URLDecoder: Illegal hex characters in escape (%) pattern - Error at index 0 in: ")�"
fastjson 扫描出错java.lang.IllegalArgumentException: URLDecoder: Illegal hex characters in escape (%) pattern - Error at index 0 in: "�ޭ"
fastjson 扫描出错java.lang.IllegalArgumentException: URLDecoder: Illegal hex characters in escape (%) pattern - Error at index 0 in: ">�"
建议增加内网鉴别机制,做内网测试时候无法使用dnslog.
建议可以跟https://github.com/r00tSe7en/JNDIMonitor 或者 https://github.com/f0ng/selistener 联动。
wsdl xml格式sql注入扫描不了--payload位置都是乱加的
RT
java.lang.NumberFormatException: null
at java.lang.Integer.parseInt(Unknown Source)
at java.lang.Integer.parseInt(Unknown Source)
at burp.ScanFun.SQLIScan.ParamEchoScan(SQLIScan.java:85)
at burp.BurpExtender.doPassiveScan(BurpExtender.java:1436)
at burp.r5d.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
java.lang.NumberFormatException: null
at java.lang.Integer.parseInt(Unknown Source)
at java.lang.Integer.parseInt(Unknown Source)
at burp.ScanFun.SQLIScan.ParamEchoScan(SQLIScan.java:85)
at burp.BurpExtender.doPassiveScan(BurpExtender.java:1436)
at burp.r5d.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
java.lang.NumberFormatException: null
at java.lang.Integer.parseInt(Unknown Source)
at java.lang.Integer.parseInt(Unknown Source)
at burp.ScanFun.SQLIScan.ParamEchoScan(SQLIScan.java:198)
at burp.BurpExtender.doPassiveScan(BurpExtender.java:1436)
at burp.r5d.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
target 、 proxy 前面的图标是怎么弄的?
首先感谢作者们的努力让我工作又可以轻松一截。不过我在使用过程中有个小建议,可否能设置为自定义dnslog(ceye之类的)或者采用备用dnslog的的方式。目前工具自带的dnslog出现“initDomain failed: Failed to connect“的情况。
使用的时候是空白,不知道为什么无法检测
请求第三方的dnslog,总是超时或者需要注册。
java.lang.NumberFormatException: null
at java.lang.Integer.parseInt(Unknown Source)
at java.lang.Integer.parseInt(Unknown Source)
at burp.ScanFun.SQLIScan.ParamEchoScan(SQLIScan.java:85)
at burp.BurpExtender.doPassiveScan(BurpExtender.java:1516)
at burp.ck3.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
java.lang.NumberFormatException: null
at java.lang.Integer.parseInt(Unknown Source)
at java.lang.Integer.parseInt(Unknown Source)
at burp.ScanFun.SQLIScan.ParamEchoScan(SQLIScan.java:85)
at burp.BurpExtender.doPassiveScan(BurpExtender.java:1516)
at burp.ck3.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Ueditor 扫描出错java.lang.NumberFormatException: null
代理抓包之后流量经过该插件 第二天会发现ceye平台一直有信息,会一直有请求
您好,我在使用的过程中burp2023.7专业版使用插件的时候 有时候会扫到一些成果的时候点开插件查看就会出现卡顿,不知道其他小伙伴会不会出现这种情况呢
能正常加载插件,但是测试pikachu的时候,有明显的sql报错语句未检测出。而且插件那里会报错:java.lang.NumberFormatException: Cannot parse null string
at java.base/java.lang.Integer.parseInt(Integer.java:630)
at java.base/java.lang.Integer.parseInt(Integer.java:786)
at burp.ScanFun.SQLIScan.ParamEchoScan(SQLIScan.java:198)
at burp.BurpExtender.doPassiveScan(BurpExtender.java:1436)
at burp.Zm3y.passiveAudit(Unknown Source)
at burp.Zst5.run(Unknown Source)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
at java.base/java.lang.Thread.run(Thread.java:833)
在扫描中有大量的扫描,然后提供的漏洞位置不准确。
例如:
漏洞位置为请求头中的Accept,但是在VulPanel中展示的结果记录的是其他位置的。
这样的情况导致在扫描的时候获取准确结果只能开启logger++根据dnslog的回显地址查找准确的漏洞信息。
部分网站需要cookie,否则会401
fastjson 扫描出错java.lang.ArrayIndexOutOfBoundsException: Index 0 out of bounds for length 0
fastjson 扫描出错java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
shiro 判断出错java.lang.NullPointerException: Cannot invoke "burp.api.montoya.http.message.responses.HttpResponse.headers()" because "" is null
shiro 判断出错java.lang.NullPointerException: Cannot invoke "burp.api.montoya.http.message.responses.HttpResponse.headers()" because "" is null
shiro 判断出错java.lang.NullPointerException: Cannot invoke "burp.api.montoya.http.message.responses.HttpResponse.headers()" because "" is null
shiro 判断出错java.lang.NullPointerException: Cannot invoke "burp.api.montoya.http.message.responses.HttpResponse.headers()" because "" is null
shiro 判断出错java.lang.NullPointerException: Cannot invoke "burp.api.montoya.http.message.responses.HttpResponse.headers()" because "" is null
fastjson 扫描出错java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
fastjson 扫描出错java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.