- 高三在校，项目不定期维护更新QAQ
- 欢迎大师傅们向我申请协作位吖~
|
|
|
|
|
|
|
|
📢 请务必花一点时间阅读此文档，有助于你快速熟悉Z0SCAN！
获取发布版本（使用Nuitka编译，速度显著提高）：下载
- 想要构建适合您环境的可执行文件？请参阅：文档
git clone https://github.com/JiuZero/z0scan
cd z0scan
pip install -r requirements.txt
# 命令行界面
python3 z0.py help
# 可视化界面
python3 ling.py- 对于Termux等环境，请参阅：文档
- 请前往 Ling 的 项目主页 获取她
Warning
Ling 不包含 z0scan 核心, 需本地存在可用的 z0 可执行文件或脚本
被动扫描的默认配置（将浏览器流量转发到端口5920）：
z0 scan -s 127.0.0.1:5920
常用推荐配置：
z0 scan -s 127.0.0.1:5920 --risk 0,1,2,3 --level 2 --disable cmdi,unauth
被动扫描控制台界面
主动扫描的默认配置：
# 通过Burp/Yakit请求流量启动主动检测（推荐）
z0 scan -s 127.0.0.1:5920
# 直接检测
z0 scan -u https://example.com/?id=1
# 从URL列表进行批量检测
z0 scan -f urls.txt
- 更多详细信息，请参阅：文档
- PerPage
| Plugin Name | Description | Risk |
|---|---|---|
| sqli-bool | SQL Boolean-based Blind Injection | 2 |
| sqli-time | SQL Time-based Blind Injection | 2 |
| sqli-error | SQL Error-based Injection | 2 |
| codei-asp | ASP Code Execution | 3 |
| codei-php | PHP Code Execution | 3 |
| cmdi | Command Execution | 3 |
| other-objectdese | Deserialization Parameter Analysis | 3 |
| sensi-js | JS Sensitive Information Leak | 0 |
| sensi-jsonp | Jsonp Sensitive Information Leak | 1 |
| sensi-php-realpath | PHP Real Path Discovery | 0 |
| redirect | Redirect Vulnerability | 1 |
| sensi-webpack | Webpack Source Code Leak | 1 |
| other-webdav-passive | WebDAV Service Passive Detection | 1 |
| xpathi-error | Error-based XPATH Injection | 2 |
| trave-path | Path Traversal | 2 |
| sensi-backup_1 | Backup File Detection (File-based) | 1 |
| sensi-viewstate | Unencrypted VIEWSTATE Discovery | 0 |
| xss | JS Semantic-based XSS Scanning | 1 |
| crlf_1 | CRLF Vulnerability Detection | 2 |
| cors-passive | CORS Vulnerability (Passive Analysis) | 2 |
| unauth | Unauthorized Access Vulnerability | 2 |
| leakpwd-page-passive | Weak Password on Login Page | 2 |
| sensi-editfile | Editor Backup File Leak | 1 |
| sensi-sourcecode | Source Code Leak | 1 |
| captcha-bypass | CAPTCHA Bypass | 0 |
| sensi-retirejs | Outdated JS Component Detection | -1 |
| ssti | SSTI Vulnerability Detection | 3 |
| ssti-angularjs | AngularJS Client-Side Template Injection Detector | 2 |
| ssrf | SSRF plugin detects server-side request forgery vulnerabilities via crafted payloads. | 2 |
| xxe | XXE plugin detects XML external entity injection vulnerabilities via malicious payloads. | 3 |
| xxe-blind | Blind XXE plugin detects out-of-band data exfiltration. | 3 |
| codei-java | Java Code Injection Vulnerability Scanner (EL/SpEL/OGNL) | 3 |
| other-redos | Regular Expression Denial of Service (ReDoS) Vulnerability Scanner | -1 |
| other-jndi-error | JNDI Injection Vulnerability Scanner | 3 |
- PerDir
| Plugin Name | Description | Risk |
|---|---|---|
| sensi-backup_2 | Backup File Scan (Directory-based) | 1 |
| trave-list_2 | Directory Listing | 2 |
| sensi-files | Sensitive File Leak (e.g., phpinfo, .git) | 1 |
| upload-oss | OSS Bucket Arbitrary File Upload | 2 |
| sensi-frontpage | FrontPage Configuration Leak | 1 |
- PerDomain
| Plugin Name | Description | Risk |
|---|---|---|
| sensi-errorpage | Error Page Sensitive Information Leak | 0 |
| xss-net | .NET Universal XSS | 1 |
| other-dns-zonetransfer | DNS Zone Transfer Vulnerability | 1 |
| xss-flash | Flash Universal XSS | 1 |
| other-idea-parse | Idea Directory Parsing | 1 |
| other-xst | XST Vulnerability Detection | -1 |
| other-webdav-active | WebDAV Service Discovery | 1 |
| upload-put | PUT-based Arbitrary File Upload | 3 |
| sensi-backup_3 | Backup File Detection (Domain-based) | 1 |
| cors-active | CORS Vulnerability (Active Detection) | 2 |
| crlf_3 | CRLF Line Injection Vulnerability | 2 |
| other-hosti | Host Header Injection Detection | 1 |
| other-oss-takeover | OSS Bucket Takeover Vulnerability | 3 |
| sensi-iis-shortname | IIS Short Filename Vulnerability | 0 |
| other-clickjacking | Clickjacking Vulnerability | -1 |
| other-baseline | Service Version Leak | -1 |
| other-smuggling | Request Smuggling Vulnerability | 3 |
| trave-list_3 | Directory Listing | 2 |
- PerHost
| Plugin Name | Description |
|---|---|
| leakpwd-mssql | Weak Password on MSSQL Server |
| leakpwd-mysql | Weak Password on MySQL Server |
| leakpwd-postgresql | Weak Password on PostgreSQL Server |
| leakpwd-redis | Weak Password on Redis Server |
| leakpwd-smb | Weak Password on SMB Server |
| other-ftp-anonymous | FTP anonymous Login |
| other-solr-rce | Apache Solr RCE via Velocity |
| unauth-docker | Docker Unauthorized Access |
| unauth-jenkins | Jenkins Unauthorized Access |
| unauth-memcached | Memcached Unauthorized Access |
| unauth-mongodb | Mongodb Unauthorized Access |
| unauth-resis | Redis Unauthorized Access |
| unauth-rsync | Rsync Unauthorized Access |
| unauth-solr | Apache Solr Unauthorized Access |
| unauth-zookeeper | Zookeeper Unauthorized access |