Repository Analysis

Mr-xn/Penetration_Testing_POC

渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms

5.1 Low AI signal View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of Mr-xn/Penetration_Testing_POC, a HTML project with 7,438 GitHub stars. SynthScan v2.0 examined 127,324 lines of code across 613 source files, recording 238 pattern matches distributed across 14 syntactic categories. The overall adjusted score of 5.1 places this repository in the Low AI signal band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

5.1
Adjusted Score
5.1
Raw Score
100%
Time Factor
2026-08-02
Last Push
7.4K
Stars
HTML
Language
127.3K
Lines of Code
613
Files
238
Pattern Hits
2026-08-02
Scan Date
0.07
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.

No multi-scan history yet — run the scanner again to build trend data.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 22HIGH 21MEDIUM 25LOW 170

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 238 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Hallucination Indicators22 hits · 280 pts
SeverityFileLineSnippetContext
CRITICAL…defineClass:fastjson 1.2.83 @JSONType 注解探测链的完整逆向与利用.md26`com.alibaba.fastjson.parser.ParserConfig.checkAutoType(String typeName, Class<?> expectClass, int features)` 是 fastjsonCODE
CRITICALbooks/CC链再次挖掘.html581<span class=cm> org.apache.commons.collections.keyvalue.TiedMapEntry.hashCode()</span>CODE
CRITICALbooks/CC链再次挖掘.html582<span class=cm> org.apache.commons.collections.keyvalue.TiedMapEntry.getValue()</span>CODE
CRITICALbooks/CC链再次挖掘.html583<span class=cm> org.apache.commons.collections.map.LazyMap.get()</span>CODE
CRITICALbooks/CC链再次挖掘.html584<span class=cm> org.apache.commons.collections.functors.ChainedTransformer.transform()</span>CODE
CRITICALbooks/CC链再次挖掘.html585<span class=cm> org.apache.commons.collections.functors.InvokerTransformer.transform()</span>CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.html431 <span class="hljs-built_in">print</span>(<span class="hljs-string">f" long hash = com.alibaba.fastjson2.util.FnvSTRING
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.html732 <span class="hljs-built_in">print</span>(f<span class="hljs-string">" long hash = com.alibaba.fastjson2.util.FnvSTRING
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.html789 long hash <span class="hljs-operator">=</span> com.alibaba.fastjson2.util.Fnv.hashCode64(s);STRING
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md143at com.alibaba.fastjson2.reader.ObjectReaderCreatorASM.jitObjectReader(ObjectReaderCreatorASM.java:594)CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md144at com.alibaba.fastjson2.reader.ObjectReaderCreatorASM.createObjectReader(ObjectReaderCreatorASM.java:327)CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md145at com.alibaba.fastjson2.reader.ObjectReaderProvider.getObjectReaderInternal(ObjectReaderProvider.java:845)CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md146at com.alibaba.fastjson2.reader.ObjectReaderProvider.getObjectReader(ObjectReaderProvider.java:763)CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md257at com.alibaba.fastjson2.reader.ObjectReaderProvider.checkAutoType(ObjectReaderProvider.java:554)CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md258at com.alibaba.fastjson2.reader.ObjectReaderProvider.getObjectReader(ObjectReaderProvider.java:530)CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md260at com.alibaba.fastjson2.reader.ObjectReaderImplObject.readObject(ObjectReaderImplObject.java:119)CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md291at com.alibaba.fastjson2.reader.ObjectReaderProvider.checkAutoType(ObjectReaderProvider.java:554)CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md292at com.alibaba.fastjson2.reader.ObjectReaderProvider.getObjectReader(ObjectReaderProvider.java:530)CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md294at com.alibaba.fastjson2.reader.ObjectReaderImplObject.readObject(ObjectReaderImplObject.java:119)CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md514 print(f" long hash = com.alibaba.fastjson2.util.Fnv.hashCode64(s);")CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md852 print(f" long hash = com.alibaba.fastjson2.util.Fnv.hashCode64(s);")CODE
CRITICALbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md918 long hash = com.alibaba.fastjson2.util.Fnv.hashCode64(s);CODE
Cross-File Repetition17 hits · 85 pts
SeverityFileLineSnippetContext
HIGHtools/sqlmap_bypass_空格替换成换行符-某企业建站程序过滤_tamper.py0copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/) see the file 'license' for copying permissionSTRING
HIGHtools/sqlmap_yunyecms_front_sqli_tamp.py0copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/) see the file 'license' for copying permissionSTRING
HIGHtools/sqlmap_bypass_云锁_tamper.py0copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/) see the file 'license' for copying permissionSTRING
HIGH…_pocs/exploit-tools/WeblogicScanLot/WeblogicScanLot.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGH…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2018_2628.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGHvuln_pocs/exploit-tools/WeblogicScanLot/poc/Console.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGH…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2019_2729.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGH…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2017_3248.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGH…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2017_3506.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGHvuln_pocs/exploit-tools/WeblogicScanLot/poc/__init__.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGH…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2018_2893.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGH…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2018_2894.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGH…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2016_0638.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGH…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2016_3510.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGH…cs/exploit-tools/WeblogicScanLot/poc/CVE_2017_10271.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGH…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2019_2725.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
HIGH…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2014_4210.py0____ _ _ _ _ __ __ _ | _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ | |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |STRING
Excessive Try-Catch Wrapping50 hits · 59 pts
SeverityFileLineSnippetContext
LOWtools/tongda_oa_2017_sql_injection.py47 except Exception as e:CODE
MEDIUMtools/tongda_oa_2017_sql_injection.py37def run_payload(url,uid,num,mid):CODE
LOWtools/dede_burp_admin_path.md134 except Exception:CODE
LOWtools/ssh/fake_login_log.py153 except Exception as e:CODE
LOWtools/ssh/fake_login_log.py230 except Exception as e:CODE
LOWtools/ssh/fake_login_log.py337 except Exception as e:CODE
LOWtools/ssh/fake_login_log.py465 except Exception as e:CODE
LOW…nipper-ng_0.11.10-Remote_Buffer_Overflow远程缓冲区溢出附PoC.md100 except Exception as e:CODE
LOWweb/CVE-2019-2890-Oracle WebLogic 反序列化严重漏洞.md74 except Exception as e:CODE
LOWweb/CVE-2019-2890-Oracle WebLogic 反序列化严重漏洞.md102 except Exception as e:CODE
LOWweb/CVE-2019-2890-Oracle WebLogic 反序列化严重漏洞.md109 except Exception as e:CODE
LOWweb/通达OA前台任意用户伪造登录漏洞批量检测.md44 except Exception as err:CODE
MEDIUMweb/通达OA前台任意用户伪造登录漏洞批量检测.md13def http_request(url,session_id):CODE
LOWbooks/Vmware Vcenter 任意文件读取批量检测.md36 except Exception as err:CODE
MEDIUMbooks/Vmware Vcenter 任意文件读取批量检测.md22def http_request(url):CODE
LOWbooks/Python沙箱逃逸の旁门左道.html271 except Exception as e:CODE
LOWbooks/Python沙箱逃逸の旁门左道.html330 except Exception as e:CODE
LOWbooks/Python沙箱逃逸の旁门左道.html628 except Exception as e:STRING
MEDIUMbooks/Python沙箱逃逸の旁门左道.html625def get_stack_frame_via_exception():CODE
LOWbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md1154 except Exception as e:CODE
LOWiot/WLAN-AP-WEA453e RCE三星路由器远程命令执行漏洞.md97 except Exception as e:CODE
LOWiot/WLAN-AP-WEA453e RCE三星路由器远程命令执行漏洞.md121 except Exception as e:CODE
LOWiot/WLAN-AP-WEA453e RCE三星路由器远程命令执行漏洞.md135 except Exception as e:CODE
MEDIUMiot/WLAN-AP-WEA453e RCE三星路由器远程命令执行漏洞.md88def Checking(self):CODE
LOWiot/天翼创维awifi路由器存在多处未授权访问漏洞.md37 except Exception as e:CODE
LOWiot/天翼创维awifi路由器存在多处未授权访问漏洞.md54 except Exception as e:CODE
LOWiot/CNVD-2021-14536_锐捷RG-UAC统一上网行为管理审计系统账号密码信息泄露漏洞.md61 except Exception as e:CODE
LOWiot/CNVD-2021-14536_锐捷RG-UAC统一上网行为管理审计系统账号密码信息泄露漏洞.md73 except Exception as e:CODE
LOW…ln_pocs/cve/CVE-2019-16097/cve-2019-16097-batch-py3.py34 except Exception as e:CODE
LOW…ln_pocs/cve/CVE-2019-16097/cve-2019-16097-batch-py2.py32 except Exception as e:CODE
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py256 except Exception as e:CODE
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py385 except Exception as e:CODE
MEDIUMvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py250def socket_connection(obj, address, port=3389, receive_size=4000):CODE
LOW…pocs/exploit-tools/BlueKeep/bluekeep_weaponized_dos.py364 except Exception as e:CODE
MEDIUM…it-tools/BlueKeep/bluekeep-CVE-2019-0708-python/rdp.py379 print('Error not tpkt')CODE
MEDIUM…it-tools/BlueKeep/bluekeep-CVE-2019-0708-python/rdp.py394 print('Error not tpkt')CODE
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py67 except Exception as e:CODE
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py600 except Exception:CODE
LOW…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2018_2628.py55 except Exception:CODE
LOW…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2017_3248.py50 except Exception:CODE
LOW…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2017_3506.py59 except Exception:STRING
LOW…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2018_2893.py58 except Exception:CODE
LOW…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2016_0638.py51 except Exception:CODE
LOW…ocs/exploit-tools/WeblogicScanLot/poc/CVE_2016_3510.py49 except Exception:CODE
LOW…cs/exploit-tools/WeblogicScanLot/poc/CVE_2017_10271.py56 except Exception:STRING
LOW…exploit-tools/redis-rogue-server/redis-rogue-server.py220 except Exception as e:STRING
LOWscripts/update_readme.py48 except Exception as e:CODE
MEDIUMscripts/update_readme.py49 print(f"Error fetching RSS: {e}")CODE
MEDIUMscripts/update_readme.py71 print(f"Error: {README_PATH} not found.")CODE
MEDIUMscripts/update_readme.py91 print("Error: Markers not found in README.md")CODE
Over-Commented Block53 hits · 53 pts
SeverityFileLineSnippetContext
LOWtools/绕过disable_function汇总.md81## 第七种模式–PHP 7.0 < 7.3 (Unix) - ‘gc’ Disable Functions Bypass COMMENT
LOWtools/Zabbix 全系列 Authentication Bypass 利用工具.md1### Zabbix 全系列 Authentication Bypass 利用工具COMMENT
LOWtools/Zabbix 全系列 Authentication Bypass 利用工具.md21# # [ >>> User-Agent => Opera/9.61 (Macintosh; Intel Mac OS X; U; de) Presto/2.1.1COMMENT
LOWtools/Zabbix 全系列 Authentication Bypass 利用工具.md41# # [ <<< Set-Cookie => zbx_sessionid=e125efe43b1f67b0fdbfb4db2fa1ce0d; HttpOnlyPHPSESSID=n4dolnd118fhio9oslok6qpj3a; COMMENT
LOWtools/Zabbix 全系列 Authentication Bypass 利用工具.md61# # [ https://TARGET/zabbix/zabbix.php?action=web.view&ddreset=1COMMENT
LOWweb/Joomla-3.4.6-RCE.md181COMMENT
LOWweb/CVE-2020-8813 - Cacti v1.2.8 RCE.md1## Cacti v1.2.8 authenticated Remote Code Execution (CVE-2020-8813) COMMENT
LOW…-2019-16759 vBulletin 5.x 0day pre-auth RCE exploit.md21> vBulletin v5(5.0.0到5.5.4)版本 COMMENT
LOW…nipper-ng_0.11.10-Remote_Buffer_Overflow远程缓冲区溢出附PoC.md1## CVE-2019-17424 nipper-ng_0.11.10-Remote_Buffer_Overflow远程缓冲区溢出附PoC COMMENT
LOW…VE-2019-17662-ThinVNC 1.0b1 - Authentication Bypass.md1## ThinVNC 1.0b1 - Authentication Bypass COMMENT
LOWbooks/静默退出 DUMP LSASS.EXE.html541把原来的代码修改一下COMMENT
LOWvuln_pocs/cve/CVE-2019-6977-imagecolormatch/exploit.php1<?phpCOMMENT
LOWvuln_pocs/cve/CVE-2019-6977-imagecolormatch/exploit.php101COMMENT
LOWvuln_pocs/cve/CVE-2019-6977-imagecolormatch/exploit.php141# Create a memory layout as such:COMMENT
LOWvuln_pocs/cve/CVE-2019-6977-imagecolormatch/exploit.php161#COMMENT
LOWvuln_pocs/cve/CVE-2019-6977-imagecolormatch/exploit.php201COMMENT
LOWvuln_pocs/cve/CVE-2019-6977-imagecolormatch/exploit.php221# destroyed by calling ht.pDestructor(ht.arData[i]).COMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php1<?phpCOMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php21#COMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php41# - Debian GNU/Linux 9.6COMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php81# - Create DateInterval object ($place) meant to be unset and filled by anotherCOMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php121 # Create some space for our UAF blocks not to get overwrittenCOMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php141 # zend_string of size 78.COMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php161 # assumption, every structure constituting this new object will take theCOMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php181 $protector = ".$_protector";COMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php221 # Give us some roomCOMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php261 # We can now read/write in the whole SHM and apache's memory region.COMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php321 }COMMENT
LOWvuln_pocs/cve/CVE-2019-0211-apache/cfreal-carpediem.php461 {COMMENT
LOW…/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/struct.h1#pragma onceCOMMENT
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py361 tls.sendall(DoPduConnectionSequence().client_persistent_key_length_pdu())COMMENT
LOW…2017-12149/src/org/apache/commons/collections/Bag.java201// * This Bag equals another Bag if it contains the same number of occurrences ofCOMMENT
LOW…/src/org/apache/commons/collections/list/TreeList.java681 recalcHeight();COMMENT
LOW…/src/org/apache/commons/collections/list/TreeList.java701// // System.out.print(" right: ");COMMENT
LOW…/src/org/apache/commons/collections/list/TreeList.java721// }COMMENT
LOWvuln_pocs/exploit-tools/macOS-Kernel-Exploit/gadgets.h1//COMMENT
LOWvuln_pocs/exploit-tools/macOS-Kernel-Exploit/gadgets.h21#define ROP_POP_RSI 0xffffff800047c02e // pop rsi; ret; COMMENT
LOWvuln_pocs/exploit-tools/macOS-Kernel-Exploit/exploit.c1//COMMENT
LOW…tools/redis-rogue-server/RedisModulesSDK/redismodule.h21#define REDISMODULE_LIST_HEAD 0COMMENT
LOW…tools/redis-rogue-server/RedisModulesSDK/redismodule.h41/* Postponed array length. */COMMENT
LOW…tools/redis-rogue-server/RedisModulesSDK/redismodule.h81#define REDISMODULE_CTX_FLAGS_MAXMEMORY (1<<8)COMMENT
LOW…tools/redis-rogue-server/RedisModulesSDK/redismodule.h101/* A special pointer that we can use between the core and the module to signalCOMMENT
LOW…ls/redis-rogue-server/RedisModulesSDK/rmutil/strings.c1#include <string.h>COMMENT
LOW…tools/redis-rogue-server/RedisModulesSDK/rmutil/util.c1#include <stdlib.h>COMMENT
LOW…ls/redis-rogue-server/RedisModulesSDK/rmutil/logging.h1#ifndef __RMUTIL_LOGGING_H__COMMENT
LOW…s/redis-rogue-server/RedisModulesSDK/rmutil/sdsalloc.h41#elseCOMMENT
LOW…ools/redis-rogue-server/RedisModulesSDK/rmutil/alloc.h21COMMENT
LOWprivesc/CVE-2021-22555.md121 * root@theflow:/#COMMENT
LOWprivesc/CVE-2021-22555.md141#include <sys/socket.h>COMMENT
LOWprivesc/CVE-2021-22555.md161#define MSG_TAG 0xAAAAAAAACOMMENT
LOWprivesc/CVE-2021-22555.md181COMMENT
LOWprivesc/CVE-2021-22555.md201#define ANON_PIPE_BUF_OPS 0xE51600COMMENT
LOWprivesc/CVE-2021-22555.md221#define POP_RCX_RET 0xF5633COMMENT
Decorative Section Separators11 hits · 46 pts
SeverityFileLineSnippetContext
MEDIUMbooks/FastJson2 Hash 碰撞 RCE 分析与复现.html118<pre><code>// ────────────────────────────────────────────────────────────CODE
MEDIUMbooks/FastJson2 Hash 碰撞 RCE 分析与复现.html120// ────────────────────────────────────────────────────────────COMMENT
MEDIUMbooks/FastJson2 Hash 碰撞 RCE 分析与复现.html128// ────────────────────────────────────────────────────────────COMMENT
MEDIUMbooks/FastJson2 Hash 碰撞 RCE 分析与复现.html130// ────────────────────────────────────────────────────────────COMMENT
MEDIUMbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md35// ────────────────────────────────────────────────────────────COMMENT
MEDIUMbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md37// ────────────────────────────────────────────────────────────COMMENT
MEDIUMbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md45// ────────────────────────────────────────────────────────────COMMENT
MEDIUMbooks/FastJson2 Hash 碰撞 RCE 分析与复现.md47// ────────────────────────────────────────────────────────────COMMENT
MEDIUMvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py371 # -----------------------------------------------------COMMENT
MEDIUMvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py378 # -----------------------------------------------------COMMENT
MEDIUMscripts/update_readme.py26# ===========================================COMMENT
Verbosity Indicators17 hits · 28 pts
SeverityFileLineSnippetContext
LOWbooks/JAVA安全之Velocity模板注入刨析.html716 <span class=c1>// Step 1: 加载模板</span>CODE
LOWbooks/JAVA安全之Velocity模板注入刨析.html719 <span class=c1>// Step 2: 创建上下文并填充数据</span>CODE
LOWbooks/JAVA安全之Velocity模板注入刨析.html726 <span class=c1>// Step 3: 合并模板和上下文</span>CODE
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py112 # Step 1: Confirm /api/user/init is blocked (init guard works)COMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py121 # Step 2: Bypass via /open/user/init (NO auth required)COMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py503 # Step 3: Write malicious config.shCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py513 # Step 4: Create and trigger cronCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py572 # Step 1: Confirm /api/ requires authCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py577 # Step 2: /API/ bypasses auth completelyCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py583 # Step 3: /Api/ mixed case also bypassesCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py589 # Step 4: Direct unauthenticated command execution via /API/COMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py134 # Step 3: Verify by logging in with the new credentialsCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py146 # Step 4: Restore original credentialsCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py469 # Step 1: Reset credentials via init guard bypass (NO AUTH)COMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py483 # Step 2: Login with attacker credentialsCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py527 # Step 5: Verify RCECOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py613 # Step 5: Read sensitive config without authCOMMENT
Structural Annotation Overuse15 hits · 24 pts
SeverityFileLineSnippetContext
LOWbooks/JAVA安全之Velocity模板注入刨析.html716 <span class=c1>// Step 1: 加载模板</span>CODE
LOWbooks/JAVA安全之Velocity模板注入刨析.html719 <span class=c1>// Step 2: 创建上下文并填充数据</span>CODE
LOWbooks/JAVA安全之Velocity模板注入刨析.html726 <span class=c1>// Step 3: 合并模板和上下文</span>CODE
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py112 # Step 1: Confirm /api/user/init is blocked (init guard works)COMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py121 # Step 2: Bypass via /open/user/init (NO auth required)COMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py503 # Step 3: Write malicious config.shCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py513 # Step 4: Create and trigger cronCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py572 # Step 1: Confirm /api/ requires authCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py589 # Step 4: Direct unauthenticated command execution via /API/COMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py134 # Step 3: Verify by logging in with the new credentialsCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py146 # Step 4: Restore original credentialsCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py469 # Step 1: Reset credentials via init guard bypass (NO AUTH)COMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py483 # Step 2: Login with attacker credentialsCOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py527 # Step 5: Verify RCECOMMENT
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py613 # Step 5: Read sensitive config without authCOMMENT
Cross-Language Confusion4 hits · 22 pts
SeverityFileLineSnippetContext
HIGHtools/CVE-2017-12615.py28body = '''<%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%><%!public static String excuteCmCODE
HIGHtools/CVE-2017-12615.py29+"\\n");}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString();}%><%if("023".equals(reqCODE
HIGH…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py797 # payload: x" > /dev/null; echo MARKER > /tmp/stop_proof.txt; #COMMENT
HIGH…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py800 json={"command": f'x" > /dev/null; echo {stop_marker} > /tmp/stop_proof.txt; #'},CODE
Hyper-Verbose Identifiers17 hits · 18 pts
SeverityFileLineSnippetContext
LOWweb/solr_rce.md22def update_queryresponsewriter(core_name_url):CODE
LOWbooks/Python沙箱逃逸の旁门左道.html625def get_stack_frame_via_exception():STRING
LOWbooks/Python沙箱逃逸の旁门左道.html638def get_stack_frame_via_closure():STRING
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py95 def mcs_attach_user_request_pdu():CODE
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py132 def client_active_confirmation_pdu():CODE
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py147 def client_control_request_pdu():CODE
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py154 def client_control_cooperate_pdu():CODE
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py162 def client_persistent_key_length_pdu():CODE
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py201 def do_client_security_pdu_exchange():CODE
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py209 def client_synchronization_pdu():CODE
LOW…pocs/exploit-tools/BlueKeep/bluekeep_weaponized_dos.py117def send_initialization_pdu_packet(host, verbose=False):CODE
LOW…pocs/exploit-tools/BlueKeep/bluekeep_weaponized_dos.py145def send_client_data_pdu_packet(tls, deletion_structure=(12, 109, 118, 132, 390), verbose=False):CODE
LOW…pocs/exploit-tools/BlueKeep/bluekeep_weaponized_dos.py184def send_client_information_pdu_packet(tls):CODE
LOW…pocs/exploit-tools/BlueKeep/bluekeep_weaponized_dos.py240def send_confirm_active_pdu_packet(tls):CODE
LOW…pocs/exploit-tools/BlueKeep/bluekeep_weaponized_dos.py263def send_establish_session_pdu_packet(tls):CODE
LOW…it-tools/BlueKeep/bluekeep-CVE-2019-0708-python/rdp.py220def client_persistent_key_len(crypter):CODE
LOWvuln_pocs/exploit-tools/discuz-ml-rce/dz-ml-rce.py36def get_setcookie_language_value(tgtUrl,timeout):CODE
Unused Imports13 hits · 12 pts
SeverityFileLineSnippetContext
LOWtools/sqlmap_yunyecms_front_sqli_tamp.py10CODE
LOWtools/sqlmap_bypass_云锁_tamper.py8CODE
LOWtools/sqlmap_bypass_云锁_tamper.py10CODE
LOWtools/sqlmap_bypass_云锁_tamper.py12CODE
LOWtools/sqlmap_bypass_云锁_tamper.py13CODE
LOWtools/ssh/fake_login_log.py10CODE
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py5CODE
LOW…s/BlueKeep/bluekeep-CVE-2019-0708-python/rdp_crypto.py1CODE
LOW…/BlueKeep/bluekeep-CVE-2019-0708-python/win7_32_poc.py3CODE
LOW…it-tools/BlueKeep/bluekeep-CVE-2019-0708-python/rdp.py7CODE
LOW…ocs/exploit-tools/qinglong-auth-bypass2rce/poc_test.py28CODE
LOWvuln_pocs/exploit-tools/zentao-getshell/exp_py3.py6CODE
LOW…exploit-tools/redis-rogue-server/redis-rogue-server.py3CODE
Deep Nesting11 hits · 11 pts
SeverityFileLineSnippetContext
LOWtools/sqlmap_bypass_D盾_tamper.py12CODE
LOWtools/tongda_oa_2017_sql_injection.py37CODE
LOWtools/masscan+nmap.py31CODE
LOWtools/ssh/fake_login_log.py97CODE
LOWtools/ssh/fake_login_log.py236CODE
LOWtools/linux_auto_xunjian/yiansec.py137CODE
LOWtools/linux_auto_xunjian/yiansec.py191CODE
LOWvuln_pocs/cve/CVE-2018-6389/CVE-2018-6389.py26CODE
LOWvuln_pocs/exploit-tools/BlueKeep/bluekeep_poc.py390CODE
LOW…pocs/exploit-tools/BlueKeep/bluekeep_weaponized_dos.py321CODE
LOW…exploit-tools/redis-rogue-server/redis-rogue-server.py134CODE
Self-Referential Comments2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMtools/huaweihg255-traversal.rb2# This file is part of the Metasploit Framework and may be subject toCOMMENT
MEDIUMvuln_pocs/cve/CVE-2019-6977-imagecolormatch/exploit.php141# Create a memory layout as such:COMMENT
Fake / Example Data5 hits · 5 pts
SeverityFileLineSnippetContext
LOWbooks/JAVA安全之Velocity模板注入刨析.html259 <span class=n>context</span><span class=p>.</span><span class=n>put</span><span class=p>(</span><span class=s>"nCODE
LOWbooks/PHP中的模板注入漏洞刨析.html148<span class=k>echo</span> <span class=nv>$twig</span><span class=o>-&gt;</span><span class=na>render</span><span class=pCODE
LOWbooks/PHP中的模板注入漏洞刨析.html169<span class=nv>$smarty</span><span class=o>-&gt;</span><span class=na>assign</span><span class=p>(</span><span class=s1>CODE
LOWbooks/PHP中的模板注入漏洞刨析.html219<p>下面是parTemplate的一个简易使用示例,在上述示例中我们首先引入了patTemplate的文件,然后创建了一个patTemplate对象。接着使用setBasedir方法设置模板所在的目录,然后使用addVar方法添加变量到模CODE
LOWbooks/PHP中的模板注入漏洞刨析.html228<span class=nv>$template</span><span class=o>-&gt;</span><span class=na>addVar</span><span class=p>(</span><span class=sCODE
AI Slop Vocabulary1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUMbooks/CC链再次挖掘.html503<span class=c1>//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()")</span>CODE