← retour aux outils back to tools

# pocsuite3

Framework open source de test de vulnérabilités distantes et de développement de PoC/exploits, développé par Knownsec 404, avec intégration Seebug et ZoomEye. Open-source remote vulnerability testing and PoC/exploit development framework from Knownsec 404, with Seebug and ZoomEye integration.

↗ https://github.com/knownsec/pocsuite3

## Overview

pocsuite3 is a Python-based framework for writing, running, and managing proof-of-concept (PoC) and exploit scripts against remote vulnerabilities, in the spirit of Metasploit modules but lighter-weight and Python-native. It’s built by Knownsec 404 Team and integrates directly with their Seebug vulnerability database and ZoomEye search engine, making it convenient for both writing a quick PoC for a specific CVE and mass-verifying it across internet-wide targets.

## Common Usage

Run a specific PoC script against a single target

    pocsuite -u http://<target> -r pocs/cve_2021_xxxxx.py --verify

Attempt exploitation (not just verification) against a target

    pocsuite -u http://<target> -r pocs/cve_2021_xxxxx.py --attack

Run against a list of targets from a file

    pocsuite -f targets.txt -r pocs/cve_2021_xxxxx.py --verify

Pull targets directly from ZoomEye search results

    pocsuite --zoomeye-search "app:nginx" -r pocs/cve_2021_xxxxx.py --verify

Interactive shell mode (Metasploit-like console)

    pocsuite

## Writing a Minimal PoC

    from pocsuite3.api import Output, POCBase, register_poc, requests

    class DemoPOC(POCBase):
        vulID = 'CVE-2021-XXXXX'
        version = '1.0'
        author = ['researcher']
        vulDate = '2021-01-01'
        createDate = '2021-01-01'
        updateDate = '2021-01-01'
        references = ['https://example.com/advisory']
        name = 'Example vulnerable endpoint RCE'
        appPowerLink = 'https://example.com'
        appName = 'ExampleApp'
        appVersion = '< 2.0'
        vulType = 'RCE'
        desc = 'Unauthenticated RCE via /debug endpoint'

        def _verify(self):
            result = {}
            resp = requests.get(f'{self.url}/debug?cmd=id')
            if 'uid=' in resp.text:
                result['VerifyInfo'] = {'URL': self.url}
            return self.parse_output(result)

        def _attack(self):
            return self._verify()

        def parse_output(self, result):
            output = Output(self)
            output.success(result) if result else output.fail('target not vulnerable')
            return output

    register_poc(DemoPOC)

## Options

    -u URL              single target URL
    -f FILE               file of target URLs, one per line
    -r PATH               PoC script (or directory of PoCs) to run
    --verify              only verify vulnerability, no exploitation
    --attack              attempt full exploitation
    --zoomeye-search Q    pull targets from a ZoomEye search query
    --threads N            concurrency for mass scanning

## Tips

- `--verify` should be preferred by default on client engagements — `--attack` actively exploits and may cause impact.
- pocsuite3’s PoC format is compatible with many public Seebug PoCs — check their PoC repo before writing one from scratch for a known CVE.

Help / Man page

    usage: pocsuite [options]

    Target:
      -u URL                target URL
      -f FILE                file with target URLs
      --zoomeye-search QUERY  search ZoomEye and use results as targets

    PoC:
      -r POC                  poc script or directory to load

    Mode:
      --verify                verify mode only
      --attack                 attack (exploit) mode
      --shell                  return an interactive shell on success

    Misc:
      --threads N              number of concurrent threads
      -v, --verbose            verbose output
      --debug                   debug mode

## Vue d’ensemble

pocsuite3 est un framework Python permettant d’écrire, d’exécuter et de gérer des scripts de preuve de concept (PoC) et d’exploitation contre des vulnérabilités distantes, dans l’esprit des modules Metasploit mais en plus léger et nativement Python. Il est développé par la Knownsec 404 Team et s’intègre directement à leur base de données de vulnérabilités Seebug ainsi qu’au moteur de recherche ZoomEye, ce qui le rend pratique aussi bien pour écrire rapidement un PoC pour une CVE spécifique que pour le vérifier massivement sur des cibles à l’échelle d’Internet.

## Utilisation courante

    # Lancer un script PoC spécifique contre une seule cible
    pocsuite -u http://<target> -r pocs/cve_2021_xxxxx.py --verify

    # Tenter l'exploitation (pas seulement la vérification) contre une cible
    pocsuite -u http://<target> -r pocs/cve_2021_xxxxx.py --attack

    # Lancer contre une liste de cibles depuis un fichier
    pocsuite -f targets.txt -r pocs/cve_2021_xxxxx.py --verify

    # Récupérer directement les cibles depuis les résultats de recherche ZoomEye
    pocsuite --zoomeye-search "app:nginx" -r pocs/cve_2021_xxxxx.py --verify

    # Mode shell interactif (console façon Metasploit)
    pocsuite

## Écrire un PoC minimal

    from pocsuite3.api import Output, POCBase, register_poc, requests

    class DemoPOC(POCBase):
        vulID = 'CVE-2021-XXXXX'
        version = '1.0'
        author = ['researcher']
        vulDate = '2021-01-01'
        createDate = '2021-01-01'
        updateDate = '2021-01-01'
        references = ['https://example.com/advisory']
        name = 'Example vulnerable endpoint RCE'
        appPowerLink = 'https://example.com'
        appName = 'ExampleApp'
        appVersion = '< 2.0'
        vulType = 'RCE'
        desc = 'Unauthenticated RCE via /debug endpoint'

        def _verify(self):
            result = {}
            resp = requests.get(f'{self.url}/debug?cmd=id')
            if 'uid=' in resp.text:
                result['VerifyInfo'] = {'URL': self.url}
            return self.parse_output(result)

        def _attack(self):
            return self._verify()

        def parse_output(self, result):
            output = Output(self)
            output.success(result) if result else output.fail('target not vulnerable')
            return output

    register_poc(DemoPOC)

## Options

    -u URL              single target URL
    -f FILE               file of target URLs, one per line
    -r PATH               PoC script (or directory of PoCs) to run
    --verify              only verify vulnerability, no exploitation
    --attack              attempt full exploitation
    --zoomeye-search Q    pull targets from a ZoomEye search query
    --threads N            concurrency for mass scanning

## Conseils

- `--verify` doit être privilégié par défaut lors des missions clients : `--attack` exploite activement et peut avoir un impact.
- Le format de PoC de pocsuite3 est compatible avec de nombreux PoC publics de Seebug : consultez leur dépôt de PoC avant d’en écrire un de zéro pour une CVE connue.

Aide / Page de manuel

    usage: pocsuite [options]

    Target:
      -u URL                target URL
      -f FILE                file with target URLs
      --zoomeye-search QUERY  search ZoomEye and use results as targets

    PoC:
      -r POC                  poc script or directory to load

    Mode:
      --verify                verify mode only
      --attack                 attack (exploit) mode
      --shell                  return an interactive shell on success

    Misc:
      --threads N              number of concurrent threads
      -v, --verbose            verbose output
      --debug                   debug mode