{"id":13842105,"url":"https://github.com/zema1/yarx","last_synced_at":"2025-04-06T07:11:24.752Z","repository":{"id":41395303,"uuid":"426946463","full_name":"zema1/yarx","owner":"zema1","description":"An awesome reverse engine for xray poc. | 一个自动化根据 xray poc 生成对应靶站的工具","archived":false,"fork":false,"pushed_at":"2023-03-22T05:37:07.000Z","size":2440,"stargazers_count":413,"open_issues_count":1,"forks_count":50,"subscribers_count":8,"default_branch":"main","last_synced_at":"2025-03-30T06:05:52.593Z","etag":null,"topics":["fake-data-generator","http-server","rule-generation","xray","xray-poc","yaml-poc"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zema1.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-11-11T09:43:21.000Z","updated_at":"2025-03-26T02:48:40.000Z","dependencies_parsed_at":"2024-06-18T21:12:01.897Z","dependency_job_id":"8ee0133d-390c-43a6-82be-4ad13ff81ea5","html_url":"https://github.com/zema1/yarx","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zema1%2Fyarx","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zema1%2Fyarx/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zema1%2Fyarx/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zema1%2Fyarx/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zema1","download_url":"https://codeload.github.com/zema1/yarx/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247445669,"owners_count":20939958,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["fake-data-generator","http-server","rule-generation","xray","xray-poc","yaml-poc"],"created_at":"2024-08-04T17:01:27.291Z","updated_at":"2025-04-06T07:11:24.734Z","avatar_url":"https://github.com/zema1.png","language":"Go","funding_links":[],"categories":["Go","LLM分析过程"],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\u003cimg src=\"assets/images/logo.png\" alt=\"Logo\" height=\"140\"\u003e\n\u003c/div\u003e\n\n\u003cp align=\"center\"\u003e\n    \u003ca href=\"https://yarx.koalr.me/\"\u003e\u003cb\u003e在线体验\u003c/b\u003e\u003c/a\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp;\n    \u003ca href=\"https://yarx.koalr.me/report.html\"\u003e\u003cb\u003e漏洞报告\u003c/b\u003e\u003c/a\u003e \n\u003c/p\u003e\n\n## Yarx 是什么\n\nYarx 来自于 `x-r-a-y` 的反向拼写，它能够根据 xray 的 yaml poc 规则全自动的生成一个满足规则要求的 Server，使用 xray 扫描该 Server 将会扫描出对应的漏洞。它的核心工作原理如下：\n\n\n\n![yarx-core](assets/images/core.svg)\n\n\n\n它的主要特性有:\n\n+ 支持 status、header、body 等位置的响应变换\n+ 支持 `==` `contains` `submatch` 等各种匹配模式\n+ 支持动态变量的渲染和捕获以及多级规则的变量追踪\n+ 支持绝大部分内置函数的解析和调用\n+ 通过路由合并和智能排序等策略有效减少路由冲突\n+ 平铺式规则处理逻辑，支持并发扫描\n+ 支持捕获扫描事件做进一步分析联动\n\n核心原理: [https://koalr.me/posts/core-concept-of-yarx/](https://koalr.me/posts/core-concept-of-yarx/)\n\n## 立即尝试\n\n```bash\n./xray webscan --plugins phantasm --html-output yarx.html --url https://yarx.koalr.me\n```\n\n![running](./assets/images/scan.gif)\n\n几秒钟后你就会得到一个类似的漏洞报告:  [report.html](https://yarx.koalr.me/report.html)\n\n\n## 安装\n+ Github Release\n\n  [https://github.com/zema1/yarx/releases](https://github.com/zema1/yarx/releases)\n  下载合适的版本然后从命令行运行即可\n  \n+ Docker Hub\n  ```bash\n  docker pull zemal/yarx:latest\n  ```\n  \n+ 源码安装\n  ```bash\n  git clone https://github.com/zema1/yarx\n  cd yarx\n  go build -o yarx ./cmd/yarx\n  ```\n\n## 用法\n\n```bash\nUSAGE:\n   yarx [global options] [arguments...]\n\nGLOBAL OPTIONS:\n   --pocs value, -p value    load pocs from this dir\n   --listen value, -l value  the http server listen address (default: \"127.0.0.1:7788\")\n   --root value, -r value    load files form this directory if the requested path is not found\n\n   --verbose, -V             verbose mode, which is  equivalent to --log-level debug (default: false)\n   --help, -h                show help (default: false)\n```\n\n使用示例：\n\n```bash\n# 在8080端口创建一个 http 服务，这个服务将模拟 pocs 文件夹下的所有漏洞\n./yarx -p ./pocs -l 0.0.0.0:8080\n\n# 和上面类似，但当路径不存在时，会从 `./www/html` 加载文件\n./yarx -p ./pocs -l 0.0.0.0:8080 -r ./www/html\n```\n![running](assets/images/running.png)\n\n你可以使用本仓库的 [pocs](./pocs) 文件夹，也可以直接使用 xray 官方仓库的 [https://github.com/chaitin/xray/tree/master/pocs](https://github.com/chaitin/xray/tree/master/pocs) 文件夹。本仓库仅仅是去掉了暂时不支持的 poc，后者除了在运行时会打印一点错误信息之外没有任何区别，我会定期同步数据来增加更多 poc。当然，你也可以指定自己编写的 poc。\n\n## 开发\n\nYarx 也可以作为 go 的 package 来使用\n\n```go\nyr := \u0026yarx.Yarx{}\n// err := yr.Parse([]byte(\"poc-data\"))\nerr := yr.ParseFile(\"/path/to/a/yaml/poc\")\nif err != nil {\n    panic(err)\n}\n\n// 每个成功加载的 poc 对应一个 MutationChain\n// poc 中的 rule 则对应于 MutationRule\nchains := yr.Chains()\nrules := yr.Rules()\n...\n\n// 一键生成上述规则的 http handler\nhandler := yr.HTTPHandler()\n\n// 事件处理\nhandler.OnRuleMatch(func(e *yarx.ScanEvent) {\n})\nhandler.OnPocMatch(func(e *yarx.ScanEvent) {\n    fmt.Println(e.RemoteAddr)\n    fmt.Println(e.Request)\n    fmt.Println(e.Response)\n    fmt.Println(e.PocMatched)\n    fmt.Println(e.RuleMatched)\n})\n\n// 启动服务\nhttp.ListenAndServe(handler, \"127.0.0.1:7788\")\n```\n\n## 错误说明\n\nYarx 在解析 poc 的过程中可能会出现错误，这些 poc 不会被加载到最终的 http 服务中，遇到错误时不要惊慌，基本都是这几类问题：\n\n+ 不支持路径本身太灵活的\n\n  主要是 `{{name}}.php` 和 `/` 之类的路径，这些路径作为路由时无法与其他类似的规则区分开，目测无解（相信我，Yarx 已经尽了最大努力避免路由冲突）\n\n+ 不支持 `set` 定义中存在复杂转换的情况，如：\n\n  ```yaml\n  set:\n    r0: randLowercase(8)\n    r1: base64(r0) # 追踪这个变量太复杂，不打算支持\n  ```\n  \n+ 不支持使用反连平台的，即 yaml 中有 `newReverse()` 调用的，后续有计划支持\n\n如果你遇到其他类型的报错，可以提交一个 issue，带上报错的 yaml poc 即可，我会尽快处理。\n\n## 规划\n\n- [x] 支持 Docker 一键部署\n- [ ] 支持依赖反连平台的 POC\n- [ ] 支持依赖 request 的 POC\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzema1%2Fyarx","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzema1%2Fyarx","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzema1%2Fyarx/lists"}