pocsuite1

Open-sourced remote vulnerability testing framework.

Usage

pocsuite -h [elp]

pocsuite [options]

Legal Disclaimer

Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. pocsuite3 is for security testing purposes only.

Overview

pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec 404 Team. It comes with a powerful proof-of-concept engine, many nice features for the ultimate penetration testers and security researchers.

Options

optional arguments:

-h, --help: show this help message and exit

--version: Show program's version number and exit

--update: Update Pocsuite3

-n, --new: Create a PoC template

-v {0,1,2,3,4,5,6}: Verbosity level: 0-6 (default 1)

Target:

	At least one of these options has to be provided to define the target(s)
`-u URL [URL ...], --url URL [URL ...]`	Target URL/CIDR (e.g. "http://www.site.com/vuln.php?id=1")

-f URL_FILE, --file URL_FILE: Scan multiple targets given in a textual file (one per line)

-p PORTS, --ports PORTS: add additional port to each target ([proto:]port, e.g. 8080,https:10000)

-s: Skip target's port, only use additional port

-r POC [POC ...]: Load POC file from local or remote from seebug website

-k POC_KEYWORD: Filter PoC by keyword, e.g. ecshop

-c CONFIGFILE: Load options from a configuration INI file

Mode:

: Pocsuite running mode options

--verify: Run poc with verify mode

--attack: Run poc with attack mode

--shell: Run poc with shell mode

Request:

: Network request options

--cookie COOKIE: HTTP Cookie header value

--host HOST: HTTP Host header value

--referer REFERER: HTTP Referer header value

--user-agent AGENT: HTTP User-Agent header value (default random)

--proxy PROXY: Use a proxy to connect to the target URL (protocol://host:port)

--proxy-cred PROXY_CRED: Proxy authentication credentials (name:password)

--timeout TIMEOUT: Seconds to wait before timeout connection (default 10)

--retry RETRY: Time out retrials times (default 0)

--delay DELAY: Delay between two request of one thread

--headers HEADERS: Extra headers (e.g. "key1: value1\nkey2: value2")

Account:

: Account options

--ceye-token CEYE_TOKEN: CEye token

--oob-server OOB_SERVER: Interactsh server to use (default "interact.sh")

--oob-token OOB_TOKEN: Authentication token to connect protected interactsh server

--seebug-token SEEBUG_TOKEN: Seebug token

--zoomeye-token ZOOMEYE_TOKEN: ZoomEye token

--shodan-token SHODAN_TOKEN: Shodan token

--fofa-user FOFA_USER: fofa user

--fofa-token FOFA_TOKEN: fofa token

--quake-token QUAKE_TOKEN: quake token

--hunter-token HUNTER_TOKEN: hunter token

--censys-uid CENSYS_UID: Censys uid

--censys-secret CENSYS_SECRET: Censys secret

Modules:

: Modules options

--dork DORK: Zoomeye dork used for search

--dork-zoomeye DORK_ZOOMEYE: Zoomeye dork used for search

--dork-shodan DORK_SHODAN: Shodan dork used for search

--dork-fofa DORK_FOFA: Fofa dork used for search

--dork-quake DORK_QUAKE: Quake dork used for search

--dork-hunter DORK_HUNTER: Hunter dork used for search

--dork-censys DORK_CENSYS: Censys dork used for search

--max-page MAX_PAGE: Max page used in search API

--search-type SEARCH_TYPE: search type used in search API, web or host

--vul-keyword VUL_KEYWORD: Seebug keyword used for search

--ssv-id SSVID: Seebug SSVID number for target PoC

--lhost CONNECT_BACK_HOST: Connect back host for target PoC in shell mode

--lport CONNECT_BACK_PORT: Connect back port for target PoC in shell mode

--tls: Enable TLS listener in shell mode

--comparison: Compare popular web search engines

--dork-b64: Whether dork is in base64 format

Optimization:

: Optimization options

-o OUTPUT_PATH, --output OUTPUT_PATH: Output file to write (JSON Lines format)

--plugins PLUGINS: Load plugins to execute

--pocs-path POCS_PATH: User defined poc scripts path

--threads THREADS: Max number of concurrent network requests (default 150)

--batch BATCH: Automatically choose defalut choice without asking

--requires: Check install_requires

--quiet: Activate quiet mode, working without logger

--ppt: Hiden sensitive information when published to the network

--pcap: use scapy capture flow

--rule: export rules, default export request and response

--rule-req: only export request rule

--rule-filename RULE_FILENAME: Specify the name of the export rule file

--no-check: Disable URL protocol correction and honeypot check

Poc options:

: definition options for PoC

--options: Show all definition options

Examples

Run poc with verify mode, poc will be only used for vulnerability scanning.

% pocsuite -r poc_example.py -u http://example.com/ --verify

Run poc with attack mode, and it may allow hackers/researchers break into labs.

% pocsuite -r poc_example.py -u http://example.com/ --attack

Run poc with shell mode, if executed successfully, pocsuite will drop into interactive shell.

% pocsuite -r poc_example.py -u http://example.com/ --shell

Using multiple threads, the default number of threads is 150.

% pocsuite -r poc_example.py -u http://example.com/ --verify --threads 20

Scan multiple targets given in a textual file.

% pocsuite -r poc_example.py -f url.txt --verify

Version

This manual page documents pocsuite3 version 2.0.3

Releases

2 releases since Debian 12 (Bookworm); the text changed 1 time.

--no-check since Debian 13 (Trixie); -s since Debian 13 (Trixie).