POCSUITE(1)

📦
version 2.1.0 · 4 versions
, in ubuntu resolute, ubuntu stonking

💖 POCSUITE(1) — the pocsuite3 glow-up 💖

okay bestie, sit down, hydrate, because we're about to get into pocsuite3 — and yeah, it's a General Commands Manual situation, the real deal, manual page POCSUITE(1) energy, and I am obsessed. 🫶

✨ NAME ✨

pocsuite3 — the open-sourced remote vulnerability testing framework. that's it, that's the girl. 💅

Using pocsuite3 to attack targets without prior mutual consent is illegal. pocsuite3 is for security testing purposes only.

like, fr fr. no cap. do not be that person. 🙈

🌸 SYNOPSIS 🌸

pocsuite -h[elp]
pocsuite [options]

two ways in, pick your fighter. ✨

🦋 DESCRIPTION 🦋

pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework, brought to you by the Knownsec 404 Team. it rolls up with a powerful proof-of-concept engine plus a whole stack of nice features made for the ultimate penetration testers and security researchers. it's giving main character energy in a terminal, and honestly? iconic. 👑

💅 OPTIONS 💅

optional arguments:

  • -h, --help — show this help message and exit. the classic. the blueprint. 🎀
  • --version — Show program's version number and exit. who am i? let's find out. ⭐
  • --update — Update Pocsuite3. glow-up time. ✨
  • -n, --new — Create a PoC template. brand new baby PoC, fresh out the box. 🍓
  • -v {0,1,2,3,4,5,6} — Verbosity level: 0-6 (default 1). pick how chatty she is. 💬

Target:

at least one of these options has to be provided to define the target(s). no target, no vibes. periodt.
  • -u URL [URL ...], --url URL [URL ...] — Target URL/CIDR (e.g. "http://www.site.com/vuln.php?id=1")
  • -f URL_FILE, --file URL_FILE — Scan multiple targets given in a textual file (one per line)
  • -p PORTS, --ports PORTS — add additional port to each target ([proto:]port, e.g. 8080,https:10000)
  • -s — Skip target's port, only use additional port
  • -r POC [POC ...] — Load POC file from local or remote from seebug website
  • -k POC_KEYWORD — Filter PoC by keyword, e.g. ecshop
  • -c CONFIGFILE — Load options from a configuration INI file

Mode:

Pocsuite running mode options, aka how are we doing this today 💫

  • --verify — Run poc with verify mode
  • --attack — Run poc with attack mode
  • --shell — Run poc with shell mode

Request:

Network request options 🌈

  • --cookie COOKIE — HTTP Cookie header value
  • --host HOST — HTTP Host header value
  • --referer REFERER — HTTP Referer header value
  • --user-agent AGENT — HTTP User-Agent header value (default random)
  • --proxy PROXY — Use a proxy to connect to the target URL (protocol://host:port)
  • --proxy-cred PROXY_CRED — Proxy authentication credentials (name:password)
  • --timeout TIMEOUT — Seconds to wait before timeout connection (default 10)
  • --retry RETRY — Time out retrials times (default 0)
  • --delay DELAY — Delay between two request of one thread
  • --headers HEADERS — Extra headers (e.g. "key1: value1\nkey2: value2")

Account:

Account options 🔑

  • --ceye-token CEYE_TOKEN — CEye token
  • --oob-server OOB_SERVER — Interactsh server to use (default "interact.sh")
  • --oob-token OOB_TOKEN — Authentication token to connect protected interactsh server
  • --seebug-token SEEBUG_TOKEN — Seebug token
  • --zoomeye-token ZOOMEYE_TOKEN — ZoomEye token
  • --shodan-token SHODAN_TOKEN — Shodan token
  • --fofa-user FOFA_USER — fofa user
  • --fofa-token FOFA_TOKEN — fofa token
  • --quake-token QUAKE_TOKEN — quake token
  • --hunter-token HUNTER_TOKEN — hunter token
  • --censys-uid CENSYS_UID — Censys uid
  • --censys-secret CENSYS_SECRET — Censys secret

Modules:

Modules options 🧚

  • --dork DORK — Zoomeye dork used for search
  • --dork-zoomeye DORK_ZOOMEYE — Zoomeye dork used for search
  • --dork-shodan DORK_SHODAN — Shodan dork used for search
  • --dork-fofa DORK_FOFA — Fofa dork used for search
  • --dork-quake DORK_QUAKE — Quake dork used for search
  • --dork-hunter DORK_HUNTER — Hunter dork used for search
  • --dork-censys DORK_CENSYS — Censys dork used for search
  • --max-page MAX_PAGE — Max page used in search API
  • --search-type SEARCH_TYPE — search type used in search API, web or host
  • --vul-keyword VUL_KEYWORD — Seebug keyword used for search
  • --ssv-id SSVID — Seebug SSVID number for target PoC
  • --lhost CONNECT_BACK_HOST — Connect back host for target PoC in shell mode
  • --lport CONNECT_BACK_PORT — Connect back port for target PoC in shell mode
  • --tls — Enable TLS listener in shell mode
  • --comparison — Compare popular web search engines
  • --dork-b64 — Whether dork is in base64 format

Optimization:

Optimization options 💜

  • -o OUTPUT_PATH, --output OUTPUT_PATH — Output file to write (JSON Lines format)
  • --plugins PLUGINS — Load plugins to execute
  • --pocs-path POCS_PATH — User defined poc scripts path
  • --threads THREADS — Max number of concurrent network requests (default 150)
  • --batch BATCH — Automatically choose defalut choice without asking (yes bestie, that's exactly how it's spelled in the original, we don't fix, we preserve 💀)
  • --requires — Check install_requires
  • --quiet — Activate quiet mode, working without logger
  • --ppt — Hiden sensitive information when published to the network
  • --pcap — use scapy capture flow
  • --rule — export rules, default export request and response
  • --rule-req — only export request rule
  • --rule-filename RULE_FILENAME — Specify the name of the export rule file
  • --no-check — Disable URL protocol correction and honeypot check

Poc options:

definition options for PoC 📝

  • --options — Show all definition options

🔥 EXAMPLES 🔥

Run poc with verify mode, poc will be only used for vulnerability scanning.

% pocsuite -r poc_example.py -u http://example.com/ --verify

Run poc with attack mode, and it may allow hackers/researchers break into labs.

% pocsuite -r poc_example.py -u http://example.com/ --attack

Run poc with shell mode, if executed successfully, pocsuite will drop into interactive shell.

% pocsuite -r poc_example.py -u http://example.com/ --shell

Using multiple threads, the default number of threads is 150.

% pocsuite -r poc_example.py -u http://example.com/ --verify --threads 20

Scan multiple targets given in a textual file.

% pocsuite -r poc_example.py -f url.txt --verify

🌈 SEE ALSO 🌈

The full documentation for pocsuite3 is maintained at: https://pocsuite.org — go read it, iykyk. 📚

⭐ VERSION ⭐

This manual page documents pocsuite3 version 2.0.5.

👑 AUTHOR 👑

(c) 2014-present by Knownsec 404 Team <404-team@knownsec.com>

This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2 with the clarifications and exceptions described below. This guarantees your right to use, modify, and redistribute this software under certain conditions. If you wish to embed pocsuite3 technology into proprietary software, we sell alternative licenses (contact 404-team@knownsec.com).

Manual page started by 13ph03nix <abcnsxyz@gmail.com> — shoutout to the founder, absolute legend 🫶

aaaand that's the whole page, bestie. this little manual page for pocsuite is dated Nov 2022, brought to you by the fine folks behind POCSUITE(1). go forth, test responsibly, and remember: consent first, always. slay safely 💖✨🎀

📦 where this page comes from