Exploit for poxiao

Name: Exploit for poxiao
Rating: 5 (9 reviews)
2026-07-23 | CVSS 5.7
## https://sploitus.com/exploit?id=E3D63A42-E659-572B-8320-94DE6D19376D
# PoXiao v3.0.0

**Twenty-Four Solar Safety Toolchain** — SRC Hole-Punching Automation

> PoXiao is the first light at dawn; FrostMoon is the cold collection; VernalEquinox is comprehensive reconnaissance; JingZhe is the verification of all things; GuanXing is continuous monitoring; XiaZhi is concealed scanning. ---

## Core Principles

**First, identify the technology stack, then match CVEs, and eliminate false positives with three-layer noise reduction.**

Avoid blind payload bombing, don’t pursue excessive template counts—focus on high-confidence results only. ---

## Toolchain Ecosystem

```
                    ┌─────────────┐
                    │    PoXiao Dawn  │
                    │   Core Scanner  │
                    │   Fingerprint + CVE +  │
                    │    Noise Reduction + Report  │
                    └──────┬──────┘
                           │ Orchestration
          ┌────────┬───────┼───────┬────────┐
          ▼        ▼       ▼       ▼        ▼
       ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐
       │ FrostMoon  │ │ VernalEquinox  │ │ JingZhe  │ │ GuanXing  │ │ XiaZhi  │
       │ Subdomain  │ │ Reconnaissance  │ │ Verification  │ │ Monitoring  │ │ Stealth  │
       └──────┘ └──────┘ └──────┘ └──────┘
```

| Tool | Command | Location |
|------|------|------|
| **PoXiao Dawn** | `poxiao scan` | Core Scanner: Technology Stack Fingerprint + CVE Exact Match + Three-Layer Noise Reduction + SRC Report |
| **FrostMoon** | `frostmoon` | Subdomain Collection: crt.sh + certspotter + OTX + DNS Bombs + Domain Analysis |
| **VernalEquinox** | `vernalequinox` | Passive Reconnaissance: WHOIS + ICP + DNS + Certificates + IP Intelligence + Wayback + GitHub Leaks |
| **JingZhe** | `jingzhe` | Vulnerability Verification: Default Credentials + Git Leaks + Swagger + Actuator + Configuration File Detection |
| **GuanXing** | `guanxing` | Asset Monitoring: Web Dashboard + Change Tracking + Authentication + Pagination |
| **XiaZhi** | `xiazhi` | Stealth Scanning: POC Template Engine + Proxy Pool + UA Rotation + WAF Bypass |

---

## Quick Start

```bash
# Installation
cd PoXiao
pip install -e . # Core Scanner
poxiao scan targets.txt                    # Scan Target List
poxiao scan example.com --report butian    # Generate PoXiao Report

# Standalone Tools
frostmoon example.com --brute              # Subdomain Collection
vernalequinox example.com                  # Passive Reconnaissance
jingzhe https://example.com                # Vulnerability Verification
guanxing serve                             # Start Monitoring Dashboard
xiazhi scan example.com -t templates/      # POC Scanning
xiazhi scan example.com -t templates/ --stealth  # Stealth Scanning

# Configuration Management
poxiao config init                         # Create Configuration File
poxiao config show                         # View Current Configuration

# MCP Server (AI Assistant Integration)
poxiao mcp                                 # Start stdio MCP Server for Claude/CodeBuddy Calls
```

---

## MCP Server (AI Assistant)

PoXiao supports **MCP (Model Context Protocol)**, exposing core capabilities through **stdio** and **SSE(HTTP)** protocols. This allows AI assistants to directly call scanning functions and consume structured JSON results (pure stdlib, no additional dependencies). ```bash
poxiao mcp                                 # stdio Transmission (Local AI Assistant Integration, Default)
poxiao mcp --transport sse                 # SSE/HTTP Transmission, Listening on 127.0.0.1:8765
poxiao mcp --transport sse --host 0.0.0.0 --port 9000
```

**stdio Client Configuration (Claude Desktop / CodeBuddy, etc.):**

```json
{
  "mcpServers": {
    "poxiao": { "command": "poxiao", "args": ["mcp"] }
  }
}
```

**SSE Client Configuration (Cursor / SSE-Supported Clients):**

```json
{
  "mcpServers": {
    "poxiao": { "url": "http://127.0.0.1:8765/sse" }
  }
}
```

> SSE defaults to listening only on the loopback address `127.0.0.1` (Privately Positioned to Avoid Miscommunication); To Allow Local Area Network Access, specify `--host` explicitly. Seven tools exposed:

| Tool | Description |
|------|------|
| `scan_targets` | Core Scanning: Live Check + Technology Stack + CVE + Sensitive Paths (Three-Layer Noise Reduction) |
| `check_alive` | Rapid Live Check |
| `subdomain_enum` | FrostMoon Subdomain Collection (Certificate Transparency + DNS Bombs + Domain Analysis) |
| `passive_recon` | VernalEquinox Passive Intelligence (Whois/Registration/DNS/Certificates/IP/History/GitHub) |

| `verify_target` | Jingzhe vulnerability auto-verification (default passwords/Swagger/Git/Actuator…) |
| `poc_scan` | Xiazi POC template scanning |
| `util_codec` | Encoding/decoding/encryption/decryption (base64/hex/jwt/auto…) |

---

## Three-layer noise reduction (core differentiation)

```
Layer 1: Content features — Configuration files return HTML → false positives
Layer 2: Size clustering — 3+ paths with the same size (±8% tolerance) → CDN catch-all
Layer 3: Calibration matching — Randomly detect path matching → unified error pages

Effect: False positive rate reduced from 94% to ~5%
```

---

## Project structure

```
Boshi/
├── src/
│   ├── dawn/              # Core scanner (7 modules)
│   │   ├── engine.py      # HTTP scanning + technology stack identification
│   │   ├── tech_stack.py  # Vulnerability database (Server/Language/CMS/CDN/WAF)
│   │   ├── cve_match.py   # CVE matching (257 built-in + NVD online)
│   │   ├── sensitive.py   # Sensitive paths + three-layer noise reduction
│   │   └── reporter.py    # SRC report generation
│   ├── frostmoon/         # Frost Moon — Subdomain collection
│   ├── vernalequinox/     # Spring Equinox — Passive reconnaissance (10 modules)
│   ├── jingzhe/           # Jingzhe — Vulnerability verification
│   ├── guanxing/          # Guanxing — Asset monitoring
│   ├── xiazhi/            # Xiazi — Hidden scanning + POC engine (10 modules)
│   ├── config.py          # Unified configuration system
│   ├── target/            # Target management
│   └── utils/             # Shared tools
│
├── templates/             # POC template library (215 templates)
├── configs/               # Configuration files
│   └── brands.json        # Bota brand database (107 brands)
│
├── poxiao.py              # Boshi entrance
├── frostmoon.py           # Frost Moon entrance
├── vernalequinox.py       # Spring Equinox entrance
├── jingzhe.py             # Jingzhe entrance
├── guanxing.py            # Guanxing entrance
├── xiazhi.py              # Xiazi entrance
└── pyproject.toml
```

---

## Configuration system

```bash
# Create configuration file
poxiao config init

# Location of configuration file
# Windows: %USERPROFILE%\.poxiao\config.yaml
# Linux/Mac: ~/.poxiao/config.yaml
```

```yaml
# ~/.poxiao/config.yaml
scan:
  concurrency: 5
  timeout: 5.0
poc:
  concurrency: 10
  timeout: 10.0
stealth:
  proxy_file: "~/.poxiao/proxies.txt"
  global_qps: 10.0
cve:
  nvd_api_key: ""           # NVD API Key (optional)
recon:
  shodan_api_key: ""        # Shodan (optional)
monitor:
  host: "127.0.0.1"         # Only listens locally by default
  port: 5099
```

---

## Environment variables

| Variable | Purpose |
|------|------|
| `POXIAO_SCAN_CONCURRENCY` | Scan concurrency |
| `POXIAO_SCAN_TIMEOUT` | Scan timeout |
| `POXIAO_NVD_API_KEY` | NVD API Key |
| `SHODAN_API_KEY` | Shodan API Key |
| `FOFA_KEY` / `FOFA_EMAIL` | FOFA API |
| `CENSYS_API_ID` / `CENSYS_API_SECRET` | Censys API |
| `GITHUB_TOKEN` | GitHub code leakage scanning |
| `POXIAO_MONITOR_USER` / `POXIAO_MONITOR_PASS` | Dashboard authentication |

---

## Actual measurement data

```
110+ vendors’ scans
7.6 seconds / 30 targets
58.com → 89 subdomains (54 active)
CVE database: 257 built-in + NVD online queries
POC templates: 215
Bota brands: 107
```

---

## Technology stack

| Component | Technology |
|------|------|
| HTTP | httpx (asynchronous) |
| DNS | dnspython |
| Certificate transparency | crt.sh / certspotter / AlienVault OTX |
| IP intelligence | Shodan / Censys / FOFA |
| Historical URLs | Wayback Machine |
| Code leakage | GitHub Search API |
| Database | SQLite |
| Web | Flask + Bootstrap 5 |
| Configuration | YAML + environment variables |
| Language | Python 3.10+ |

---

## Design principles

- **Asynchronous first** — All network I/O uses asyncio
- **No external dependencies** — No Docker, Redis, SQLite single files required
- **Progressive output** — Output results as scanning progresses, without waiting for everything to be done
- **Tools are independent** — Each tool can be used independently or coordinated together
- **High confidence** — Three-layer noise reduction, false positive rate < 5%

---

*"Boshi is the first light in the early morning,"*
*"Frost Moon is the coldness of November,"*
*"Spring Equinox is the beginning of everything,"*
*"Jingzhe is the revival of everything,"*
*"Guanxing is looking up at the sky,"*
*"Xiazhi is the longest day of the year."*