--- name: "pocsuite" section: "1" platform: "linux" package: "pocsuite3" version: "2.0.3-3" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/pocsuite" --- # pocsuite(1) open-sourced remote vulnerability testing framework. ## NAME *pocsuite3* - open-sourced remote vulnerability testing framework. ## Legal Disclaimer Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. pocsuite3 is for security testing purposes only. ## SYNOPSIS **pocsuite** -h\[elp\]\ **pocsuite** \[options\]\ ## DESCRIPTION *pocsuite3* is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec 404 Team. It comes with a powerful proof-of-concept engine, many nice features for the ultimate penetration testers and security researchers. ## OPTIONS ### optional arguments: - **-h**, **--help** show this help message and exit - **--version** Show program's version number and exit - **--update** Update Pocsuite3 - **-n**, **--new** Create a PoC template - **-v** {0,1,2,3,4,5,6} Verbosity level: 0-6 (default 1) ### Target: - At least one of these options has to be provided to define the target(s) - **-u** URL \[URL ...\], **--url** URL \[URL ...\] Target URL/CIDR (e.g. "http://www.site.com/vuln.php?id=1") - **-f** URL\_FILE, **--file** URL\_FILE Scan multiple targets given in a textual file (one per line) - **-p** PORTS, **--ports** PORTS add additional port to each target (\[proto:\]port, e.g. 8080,https:10000) - **-s** Skip target's port, only use additional port - **-r** POC \[POC ...\] Load POC file from local or remote from seebug website - **-k** POC\_KEYWORD Filter PoC by keyword, e.g. ecshop - **-c** CONFIGFILE Load options from a configuration INI file ### Mode: - Pocsuite running mode options - **--verify** Run poc with verify mode - **--attack** Run poc with attack mode - **--shell** Run poc with shell mode ### Request: - Network request options - **--cookie** COOKIE HTTP Cookie header value - **--host** HOST HTTP Host header value - **--referer** REFERER HTTP Referer header value - **--user-agent** AGENT HTTP User-Agent header value (default random) - **--proxy** PROXY Use a proxy to connect to the target URL (protocol://host:port) - **--proxy-cred** PROXY\_CRED Proxy authentication credentials (name:password) - **--timeout** TIMEOUT Seconds to wait before timeout connection (default 10) - **--retry** RETRY Time out retrials times (default 0) - **--delay** DELAY Delay between two request of one thread - **--headers** HEADERS Extra headers (e.g. "key1: value1\\nkey2: value2") ### Account: - Account options - **--ceye-token** CEYE\_TOKEN CEye token - **--oob-server** OOB\_SERVER Interactsh server to use (default "interact.sh") - **--oob-token** OOB\_TOKEN Authentication token to connect protected interactsh server - **--seebug-token** SEEBUG\_TOKEN Seebug token - **--zoomeye-token** ZOOMEYE\_TOKEN ZoomEye token - **--shodan-token** SHODAN\_TOKEN Shodan token - **--fofa-user** FOFA\_USER fofa user - **--fofa-token** FOFA\_TOKEN fofa token - **--quake-token** QUAKE\_TOKEN quake token - **--hunter-token** HUNTER\_TOKEN hunter token - **--censys-uid** CENSYS\_UID Censys uid - **--censys-secret** CENSYS\_SECRET Censys secret ### Modules: - Modules options - **--dork** DORK Zoomeye dork used for search - **--dork-zoomeye** DORK\_ZOOMEYE Zoomeye dork used for search - **--dork-shodan** DORK\_SHODAN Shodan dork used for search - **--dork-fofa** DORK\_FOFA Fofa dork used for search - **--dork-quake** DORK\_QUAKE Quake dork used for search - **--dork-hunter** DORK\_HUNTER Hunter dork used for search - **--dork-censys** DORK\_CENSYS Censys dork used for search - **--max-page** MAX\_PAGE Max page used in search API - **--search-type** SEARCH\_TYPE search type used in search API, web or host - **--vul-keyword** VUL\_KEYWORD Seebug keyword used for search - **--ssv-id** SSVID Seebug SSVID number for target PoC - **--lhost** CONNECT\_BACK\_HOST Connect back host for target PoC in shell mode - **--lport** CONNECT\_BACK\_PORT Connect back port for target PoC in shell mode - **--tls** Enable TLS listener in shell mode - **--comparison** Compare popular web search engines - **--dork-b64** Whether dork is in base64 format ### Optimization: - Optimization options - **-o** OUTPUT\_PATH, **--output** OUTPUT\_PATH Output file to write (JSON Lines format) - **--plugins** PLUGINS Load plugins to execute - **--pocs-path** POCS\_PATH User defined poc scripts path - **--threads** THREADS Max number of concurrent network requests (default 150) - **--batch** BATCH Automatically choose defalut choice without asking - **--requires** Check install\_requires - **--quiet** Activate quiet mode, working without logger - **--ppt** Hiden sensitive information when published to the network - **--pcap** use scapy capture flow - **--rule** export rules, default export request and response - **--rule-req** only export request rule - **--rule-filename** RULE\_FILENAME Specify the name of the export rule file - **--no-check** Disable URL protocol correction and honeypot check ### Poc options: - definition options for PoC - **--options** Show all definition options ## EXAMPLES Run poc with verify mode, poc will be only used for vulnerability scanning. *% pocsuite -r poc\_example.py -u http://example.com/ --verify* Run poc with attack mode, and it may allow hackers/researchers break into labs. *% pocsuite -r poc\_example.py -u http://example.com/ --attack* Run poc with shell mode, if executed successfully, pocsuite will drop into interactive shell. *% pocsuite -r poc\_example.py -u http://example.com/ --shell* Using multiple threads, the default number of threads is 150. *% pocsuite -r poc\_example.py -u http://example.com/ --verify --threads 20* Scan multiple targets given in a textual file. *% pocsuite -r poc\_example.py -f url.txt --verify* ## SEE ALSO The full documentation for **pocsuite3** is maintained at:\ *https://pocsuite.org* ## VERSION This manual page documents pocsuite3 version 2.0.3 ## AUTHOR (c) 2014-present by Knownsec 404 Team\ \<404-team@knownsec.com\> This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2 with the clarifications and exceptions described below. This guarantees your right to use, modify, and redistribute this software under certain conditions. If you wish to embed pocsuite3 technology into proprietary software, we sell alternative licenses (contact 404-team@knownsec.com). Manual page started by Tian Qiao \