antgroup / antgroup/YASA-Engine

【OSCP】YASA-漏洞检出适配开发

Open
#63 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

OSCP
Dominant language
TypeScript
Stars
323
Forks
40
PR merge metrics
No merged PRs in 30d

Description

此 ISSUE 为 [YASA开源共建计划(YASA Open Source Contribution Plan,简称 YASA OSCP)] 任务 ISSUE,欢迎社区开发者参与共建~ YASA共建计划
若有感兴趣想要认领的任务,但还未报名,辛苦先完成添加微信小助手"YASA1024"后进行哈~

任务名称:【OSCP】YASA-漏洞检出适配开发

方向:checker开发
任务难度:🌟(根据难度不同可动态调整,最多5颗)
期望完成时间:2-3周(根据漏洞复杂度调整)
参与规则:同一CVE方向一人,先到先得

任务描述

为YASA开发新的漏洞检测规则(如:Checker),使其能够识别特定CVE漏洞,提升YASA的安全检测能力。
难度评级标准

  • 🌟 简单模式:已有成熟检测方案(1星)
  • 🌟🌟🌟中等难度:需要定制检测逻辑(3星)
  • 🌟🌟🌟🌟🌟 复杂漏洞:需要深度代码分析(5星)
质量要求
  • 可检测
  • 提供完整技术文档
测试验证

测试报告示例

测试环境

  • YASA版本:vX.X.X
  • 测试样本:正样本X个

测试结果

  • 可检出

测试用例

  • 漏洞存在场景检测
认领流程
  1. 在本Issue下方回复:GitHub ID+【漏洞检出开发】 + 【CVE编号
    (示例:@github-user + 漏洞检出开发 + CVE-2023-12234)
  2. YASA小助手将在1个工作日内:
  • 检查是否重复:如重复则回复"该CVE已被认领,请选择其他CVE"
  • 如未重复:回复"认领成功,欢迎贡献"
提交方式
  • Fork仓库并创建特性分支
  • 遵循代码规范
  • 编写测试用例验证检测效果
  • 确保检出

欢迎社区开发者参与YASA检出漏洞的开发!让我们一起提升YASA的安全检测能力!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

First choose an unclaimed CVE and confirm it through the issue's YASA OSCP recognition process. Read the repository's checker-development guidance and existing checkers, then identify the relevant testing approach. Done means a working vulnerability checker, tests demonstrating detection in the vulnerable scenario, and complete technical documentation with a test report.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.