StarRankExplorer
返回排行榜

Lucifer1993/struts-scan

Python

Python2编写的struts2漏洞全版本检测和利用工具

vulnerability-scannersstruts-exppython2
Star 增长趋势
Star
1.4k
Forks
498
周增长
—
Issues
1
5001k
2016年12月2020年2月2023年5月2026年7月
制品库PyPIpip install struts-scan
README

struts-scan

快速检测struts命令执行漏洞，可批量。

运行环境

MAC/Linux下的Python2

支持对以下版本的检测

ST2-005

ST2-008

ST2-009

ST2-013

ST2-016

ST2-019

ST2-020

ST2-devmode

ST2-032

ST2-033

ST2-037

ST2-045

ST2-046

ST2-048

ST2-052

ST2-053

ST2-057

使用

image

image

增加

[+]针对各版本的shell命令交互

[+]struts2-052检测(利用后面会加上)

[+]struts2-053检测+利用(需要提供参数)

[+]检测过程中输出超时原因

[+]兼容HTTP/1.0，修复了struts-045检测不准确的问题

[+]struts2-046检测+利用

[+]修改struts2-048的payload

[+]针对某些超时的情况,注释掉 httplib.HTTPConnection._http_vsn = 10 和httplib.HTTPConnection._http_vsn_str = 'HTTP/1.0'这两行再测试一遍,因为有的可能不支持HTTP/1.0的协议。

[+]增加linux和win的可执行文件,windows需要.NET环境。

[+]增加写入文件功能,针对有漏洞的struts版本号会自动写入success.txt文件。

[+]增加struts2-057检测和利用,生产环境还没有找到可利用的例子，实属鸡肋的洞,参考https://github.com/Ivan1ee/struts2-057-exp

特别说明

此工具仅限于漏洞验证，如若使用者引起相关的法律责任请自负，开发者不承担连带责任。

相关仓库
aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

GoGo ModulesApache License 2.0securitysecurity-tools
trivy.dev
37k547
promptfoo/promptfoo

Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.

TypeScriptnpmMIT Licensellmprompt-engineering
promptfoo.dev
23.5k2.1k
CISOfy/lynis

Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

ShellGNU General Public License v3.0shelllinux
cisofy.com/lynis/
16k1.6k
future-architect/vuls

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

GoGo ModulesGNU General Public License v3.0vulsvulnerability-scanners
vuls.io
12.2k1.2k
We5ter/Scanners-Box

A powerful and open-source toolkit for hackers and security automation - 安全行业从业者自研开源扫描器合辑

pentesting-toolshacker-tools
9k2.4k
aquasecurity/tfsec

Tfsec is now part of Trivy

GoGo ModulesMIT Licenseterraformsecurity
aquasecurity.github.io/trivy/
7k555
infobyte/faraday

Open Source Vulnerability Management Platform

PythonPyPIGNU General Public License v3.0devopspenetration-testing
faradaysec.com
6.7k1.1k
GhostTroops/scan4all

Official repository vuls Scan: 15000+PoCs; 23 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty( ͡° ͜ʖ ͡°)...

GoGo ModulesBSD 3-Clause "New" or "Revised" Licenseattackauto
scan4all.51pwn.com
6.1k719
OWASP/Nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

PythonPyPIApache License 2.0pythonpenetration-testing
owasp.org/nettacker
5.4k1.1k
deepfence/ThreatMapper

Open Source Cloud Native Application Protection Platform (CNAPP)

TypeScriptnpmApache License 2.0cloud-nativevulnerability-management
threatmapper.org
5.3k636
charles2gan/GDA-android-reversing-Tool

the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory extraction, data decryption, and encryption, etc.

PythonPyPIApache License 2.0decompilervulnerability-scanners
twitter.com/charles_gan1
4.8k567
mitchellkrogza/nginx-ultimate-bad-bot-blocker

Nginx Block Bad Bots, Spam Referrer Blocker, Vulnerability Scanners, User-Agents, Malware, Adware, Ransomware, Malicious Sites, with anti-DDOS, Wordpress Theme Detector Blocking and Fail2Ban Jail for Repeat Offenders

ShellOthernginxnginx-server
4.8k521