$ show SourByte05/Vulnerability-Wiki-PoC
This repository is a comprehensive collection of vulnerability proof-of-concept (PoC) exploits and detailed write-ups, primarily targeting Chinese enterprise software (OA, ERP, CMS, network devices, etc.). It contains over 1000 vulnerability entries organized by year and CVE identifier, each with structured risk assessments, HTTP request/response PoCs, FOFA search queries for asset discovery, and custom Snort/Suricata detection rules. The repository also includes executable Python scripts and YAML nuclei templates for automated exploitation and detection. While the majority of content is documentation, the scripts provide reusable scanning patterns with threading, proxy support, and output saving. The code quality is functional but basic, with many single-file scripts. The repository is actively maintained and serves as a practical reference for penetration testers and security researchers, though some CVE numbers appear speculative and PoCs may rely on future-dated vulnerabilities.
The LLM identified 3 files worth highlighting for reuse:
A Python3 exploit script for CVE-2024-3273 targeting D-Link NAS devices. It implements a scanner class with threading (ThreadPoolExecutor), argparse CLI, proxy support, and output saving to file. Demonstrates a reusable pattern for building batch vulnerability checkers with progress indication (alive_progress). The script isolates the exploitation logic, uses proper error handling, and can be easily adapted to other vulnerabilities.
A YAML template in Nuclei format for automated detection of a remote code execution vulnerability in Panalog. It defines HTTP request with regex-based matching and is directly usable with the Nuclei scanner. This template follows the standard Nuclei format and can be extracted and used as a reference for crafting detection rules for other web vulnerabilities.
A Python exploit script for CVE-2025-55182 targeting React Server Components. It features a ReactServerScanner class with batch scanning, threading, JSON result storage, and colored console output. The script demonstrates a modular scanner architecture that can be repurposed for other web vulnerabilities, with clear separation of target input, exploit logic, and result handling.