Share 
## https://sploitus.com/exploit?id=9CF573E4-00C7-5252-9D23-56766D972F66
# vuln-verify

A vulnerability verification engine driven by evidence chains. It’s not the eleventh scannerβ€”each discovered vulnerability comes with a curl command that can be executed in the terminal to reproduce it. ## One-line explanation

```
Regular scanner: "The target may contain CVE-2024-xxx (confidence: low)"
vuln-verify: "curl -s 'http://target/shell.jsp' β†’ Output: uid=33(www-data)"
```

It outputs a curl command instead of a risk level. Each vulnerability’s evidence chain can be reproduced and disproven. ## Quick start

```bash
# No need to install dependencies after cloning (uses only the Python standard library)
python3 vuln_verify.py http://target:8080

# View the 7 built-in plugins
python3 vuln_verify.py --list
```

## Features

- **Fingerprinter first** β€” Identifies the target’s technology stack first, then selects the appropriate plugin to avoid blindly executing payloads.
- **Three-stage progression** β€” `check()` only detects but doesn’t execute payloads β†’ `verify()` verifies and returns a curl command β†’ `exploit()` for exploitation (disabled by default).
- **Evidence chain output** β€” Each discovery comes with a curl command and expected responses.
- **JSON output** β€” `-o json` for consumption by AI Agents, with zero parsing effort.
- **Zero-config plugin addition** β€” Write a `.py` file and place it in the `plugins/` directory; it will automatically load.

## Usage

```bash
# Full scan of a single target
python3 vuln_verify.py http://target:8080

# View plugin list
python3 vuln_verify.py --list

# Run only specific plugins
python3 vuln_verify.py http://target --plugin thinkphp_rce

# JSON output (for AI Agent consumption)
python3 vuln_verify.py http://target -o json

# Batch scanning
python3 vuln_verify.py -f targets.txt

# Enable exploitation mode (default: only verification, no exploitation)
python3 vuln_verify.py http://target --exploit --cmd whoami
```

## 7 built-in plugins

| File | Plugin Name | Detection Content | Fingerprinter Conditions | Severity |
|----|-------------|-------------------|-------------------------|----------|
| `thinkphp_rce.py` | thinkphp_rce | ThinkPHP 5.x RCE (5 payload variants) | ThinkPHP features | critical |
| `shiro_check.py` | shiro_check | Apache Shiro detection + default key cracking | Set-Cookie: rememberMe | critical |
| `middleware_check.py` | middleware_check | Tomcat/JBoss/WebLogic management interface detection | Server header keywords | high |
| `quick_poc.py` | quick_poc | Actuator / Druid / Swagger / .git / .env leaks | Unlimited | high |
| `database_check.py` | mysql_udf | MySQL 3306 port open detection | 3306 | high |
| `database_check.py` | redis_unauth | Redis 6379 port open detection | 6379 | high |
| `database_check.py` | mssql_cmdshell | MSSQL 1433 port open detection | 1433 | high |

## Architecture

```
Input target β†’ Fingerprinter identification β†’ Plugin matching β†’ check (detection) β†’ verify (verification) β†’ Evidence chain output
                                                    ↓
                                           curl command + Expected response
```

### Fingerprinter Identification

Executed before plugins, collecting public information about the target:

- HTTP response headers (Server, X-Powered-By)
- Body keywords (ThinkPHP, Swagger, Druid, etc. framework fingerprints)
- Common management path detections (/manager/html, /actuator/health, .git/HEAD, etc.)
- Port scans (3306 MySQL, 6379 Redis, 1433 MSSQL, etc.)

All detections have no side effects on the target; no payloads are executed. ### Plugin System

Each vulnerability corresponds to a plugin. It inherits from BasePlugin and implements three methods:

```python
class BasePlugin:
    keywords = ["keyword"]    # Matching conditions
    ports = []                # Port number matching
    def check(self, target, profile) -> CheckResult:
```

### Quick Detection: Checking if the target has vulnerabilities. No payload is executed.

```python
def verify(self, target, profile) -> VerifyResult:
    """Vulnerability verification: Executes a payload and returns the curl command plus the response."

def exploit(self, target, cmd) -> ExploitResult:
    """Exploitation: Executes the command (requires --exploit enabled)."
```

### Engine Core

Executes each target in order:

1. **Fingerprint recognition** β†’ generates a TargetProfile.
2. Traverses the plugin list, matches fingerprints β†’ filters out non-matching plugins.
3. Calls `check`, `verify`, and `exploit` on the matching plugins in sequence (optional).
4. Collects evidence chains β†’ formats output (terminal/JSON).

## Writing New Plugins

Copy `plugin_template.py` to `plugins/your_plugin.py`, and modify the following code:

```python
from plugins.base import BasePlugin, CheckResult, VerifyResult

class YourPlugin(BasePlugin):
    name = "your_plugin"
    description = "Description of the vulnerabilities you detect"
    keywords = ["keyword"]  # Matching criteria
    severity = "high"  # Critical / High / Medium / Low

    def check(self, target, profile):
        return CheckResult(vulnerable=True, reason="Matching features")

    def verify(self, target, profile):
        return VerifyResult(
            vulnerable=True,
            curl_command="curl -s 'http://target/path'",
            response="Vulnerability evidence"
        )

# No registration step required; no changes needed to the configuration file.
```

### Notes for Writing Plugins

- **`check` should not execute a payload** – `check` should have no side effects.
- **`verify` must include a curl command** – `curl_command` is the core of the evidence chain.
- **Don’t hardcode the version number when matching fingerprints** – Use the product family name instead of the specific version.
- **Use a unique identifier to verify RCE** – `echo VULN_VERIFY_OK` is safer than using `id`.
- **Don’t evaluate user input** – The `cmd` parameter in the payload must be escaped.

## Output Example

### Terminal Mode (Default)

```bash
$ python3 vuln_verify.py http://target:8080

vuln-verify β€” Evidence-chain-driven vulnerability verification
Target: http://target:8080
β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”
[Fingerprint] Server: Apache/2.4.57 | Framework: ThinkPHP | Open Ports: 8080, 3306
![!] One vulnerability found:
[!!] ThinkPHP 5.x RCE
 Severity: CRITICAL | Confidence: 95%
  β†’ Fingerprint: //thinkphp/logo.png Return HTTP 200
  β†’ Verification: curl -s 'http://target/index.php?s=captcha'
      Output: uid=33(www-data) VULN_VERIFY_OK
β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”
Total plugins: 7 | Matches found: 1 | Vulnerabilities confirmed: 1
```

### JSON Mode (For Agent Consumption)

```bash
python3 vuln_verify.py http://target -o json
```

Output is structured JSON, including the target, profile (fingerprint), and findings (evidence chain). The agent can directly read `findings[0].evidence[0].curl` to execute the command.

## Comparison: vuln-verify vs. Traditional Scanners

| Feature | nuclei / goby | vuln-verify |
|---------|-------------|-------------|
| Verification Method | Feature matching β†’ Alarm | Fingerprint β†’ Check β†’ Verify β†’ Evidence chain |
| Output | Risk level + Version number | curl command + Expected response (replicable) |
| Plugin Development | YAML template (declarative) | Python class (command-based, supports conditional branches) |
| Fingerprint Recognition | Included in the template | Unified execution by the engine |
| Friendly to AI Agents | JSON output requires additional parsing | JSON with `curl_command` field, ready for direct execution |
| Third-Party Dependencies | nuclei requires Go runtime | Pure Python standard library |