antgroup / antgroup/YASA-Engine
【OSCP】YASA-漏洞检出适配开发
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 323
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
此 ISSUE 为 [YASA开源共建计划(YASA Open Source Contribution Plan,简称 YASA OSCP)] 任务 ISSUE,欢迎社区开发者参与共建~ YASA共建计划
若有感兴趣想要认领的任务,但还未报名,辛苦先完成添加微信小助手"YASA1024"后进行哈~
任务名称:【OSCP】YASA-漏洞检出适配开发
方向:checker开发
任务难度:🌟(根据难度不同可动态调整,最多5颗)
期望完成时间:2-3周(根据漏洞复杂度调整)
参与规则:同一CVE方向一人,先到先得
任务描述
为YASA开发新的漏洞检测规则(如:Checker),使其能够识别特定CVE漏洞,提升YASA的安全检测能力。
难度评级标准
- 🌟 简单模式:已有成熟检测方案(1星)
- 🌟🌟🌟中等难度:需要定制检测逻辑(3星)
- 🌟🌟🌟🌟🌟 复杂漏洞:需要深度代码分析(5星)
质量要求
- 可检测
- 提供完整技术文档
测试验证
测试报告示例
测试环境
- YASA版本:vX.X.X
- 测试样本:正样本X个
测试结果
- 可检出
测试用例
- 漏洞存在场景检测
认领流程
- 在本Issue下方回复:GitHub ID+【漏洞检出开发】 + 【CVE编号
(示例:@github-user + 漏洞检出开发 + CVE-2023-12234) - YASA小助手将在1个工作日内:
- 检查是否重复:如重复则回复"该CVE已被认领,请选择其他CVE"
- 如未重复:回复"认领成功,欢迎贡献"
提交方式
- Fork仓库并创建特性分支
- 遵循代码规范
- 编写测试用例验证检测效果
- 确保检出
欢迎社区开发者参与YASA检出漏洞的开发!让我们一起提升YASA的安全检测能力!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
First choose an unclaimed CVE and confirm it through the issue's YASA OSCP recognition process. Read the repository's checker-development guidance and existing checkers, then identify the relevant testing approach. Done means a working vulnerability checker, tests demonstrating detection in the vulnerable scenario, and complete technical documentation with a test report.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100