你好 @k8gege,
K8CScan目前使用DLL作为插件格式,这带来了一些问题:
当前问题:
- Windows专属,Linux/Mac不支持
- 需要编译环境,社区贡献门槛高
- DLL加载有安全风险
建议:YAML插件定义
格式:
name: "PhpStudy后门检测"
version: "1.0"
author: "k8gege"
protocol: http
port: 80
payload:
method: POST
path: "/index.php"
headers:
Content-Type: application/x-www-form-urlencoded
body: "c=system('whoami');"
match:
- type: regex
pattern: "nt authority\\system"
part: body
- type: status
status: 200
severity: critical
好处:
- 跨平台(纯文本,无需编译)
- 社区贡献门槛低(会写YAML就能贡献)
- 更安全(不需要加载动态库)
- 版本控制友好
这与Nuclei/afrog的PoC格式兼容。
[English Translation / 英文摘要]
Hi maintainers, this issue is a feature / architecture / security suggestion for 06_K8CScan.
The Chinese text above contains the detailed proposal with technical context and implementation ideas.
In summary: we are requesting the enhancement described above and would be happy to provide PRs or further discussion in either Chinese or English.
Thank you for the excellent work on this project!
你好 @k8gege,
K8CScan目前使用DLL作为插件格式,这带来了一些问题:
当前问题:
建议:YAML插件定义
格式:
好处:
这与Nuclei/afrog的PoC格式兼容。
[English Translation / 英文摘要]
Hi maintainers, this issue is a feature / architecture / security suggestion for 06_K8CScan.
The Chinese text above contains the detailed proposal with technical context and implementation ideas.
In summary: we are requesting the enhancement described above and would be happy to provide PRs or further discussion in either Chinese or English.
Thank you for the excellent work on this project!