DOCSEARCHbyAlgolia
Submit Docs

xpoc Documentation

repository·main·Indexed 22 days ago

https://github.com/chaitin/xpoc

A high-speed emergency response tool for supply chain vulnerability scanning. xpoc leverages cloud-based POCs using the xray yaml POC script format and supports custom Golang plugins for advanced detection, custom crawlers, and external tool integration.

Tokens
848
Snippets
2
Records
4
Agent score
29%

What's inside xpoc

  1. How xpoc plugins work

    main

    xpoc uses the xray yaml POC script format, which supports both HTTP and TCP/UDP protocols. This allows for rapid emergency response by fetching POCs from the cloud.

    Beyond YAML scripts, xpoc supports custom Golang plugins to extend functionality. Developers can implement custom logic for:

    • Advanced vulnerability detection
    • Injecting new features into YAML scripts
    • Custom crawlers
    • Webpage screenshots
    • Loading external tool plugins

  2. Quick Start with xpoc

    main

    xpoc is a fast emergency response tool designed for supply chain vulnerability scanning. You can perform basic scans, list cloud-based POCs, and manage plugins using the following commands:

    Scan a single target

    Scan a specific URL and save the output to an HTML file:

    ./xpoc -t https://example.com -o result.html

    Batch scanning

    You can scan multiple targets using a file or via stdin:

    ./xpoc -i targets.txt
# OR
cat targets.txt | ./xpoc
# OR
./xpoc < targets.txt

    Manage POCs and Plugins

    • List all cloud POCs: ./xpoc list -a
    • Sync latest plugins: ./xpoc pull (performs a full sync on first run)
    • Update xpoc: ./xpoc upgrade
    #!/bin/bash
./xpoc -t https://example.com -o result.html
./xpoc list -a
./xpoc pull
./xpoc upgrade

  3. Contributing POCs to the ecosystem

    main

    POCs can be contributed to the Chaitin/xray community to help improve detection capabilities.

    Submission Process

    1. Submit via PR: Submit POCs to the chaitin/xray repository:
      • POCs: https://github.com/chaitin/xray/tree/master/pocs
      • Fingerprint scripts: https://github.com/chaitin/xray/tree/master/fingerprints
    2. Use Templates: Fill out the Pull Request template provided in the repository.
    3. Review: The internal team will review the PR for merging.
    4. Rewards: To receive rewards for your contribution, you must also submit your POC to CT stack.

  4. xpoc CLI Reference

    main

    The xpoc command-line interface provides various options for target specification, plugin control, and output formatting.

    Commands

    • pull: Download and update plugins.
    • add: Add a file to the plugin repository.
    • list: List plugins.
    • upgrade: Upgrade to the latest version.
    • help, h: Show help.

    Global Options

    • -t, --target <value>: Scan target(s). Supports mixed input like URLs, IPs, domains, or Host:Port (e.g., 192.168.0.1, tcp://192.168.1.1:8000).
    • -i, --input <file>: Target file containing scan targets.
    • -o, --output <file>: Specify output file path (e.g., .json or .html).
    • -r, --run <value>: Execute specific plugins. Supports comma-separated values and glob syntax.
    • -e, --enable <value>: Add local plugins to the default strategy (supports glob syntax).
    • -d, --disable <value>: Disable specific plugins (supports glob syntax).
    • -c, --config <file>: Specify a configuration file.
    • -p <port>: TCP port to probe.
    • --bw <value>: Maximum bandwidth limit in KB/s (default: 2000).
    • --Pn: Disable host live detection before port scanning.
    • --debug: Enable debug mode.
    • --quiet, -q: Do not show the banner.
    xpoc -t https://example.com -o result.json
xpoc -r 1 -t http://example.com
xpoc list -a
xpoc pull -id 1