xray-scan

xray Web Vulnerability Scanning Methodology

xray is a comprehensive Web security assessment tool produced by Chaitin Technology, with core advantages:High detection accuracy(semantic analysis engine) + Low false positive rate + Rich community POCs. Supports three modes: active scanning, passive proxy scanning, and crawler scanning.

Project address:https://github.com/chaitin/xray

Phase 1: Single URL Scanning (most commonly used)

# 扫描单个 URL（全插件）
xray webscan --url http://target/?id=1 --html-output result.html

# 指定检测插件（节省时间）
xray webscan --url http://target/?id=1 --plugins sqldet,cmd-injection --html-output result.html

# JSON 输出（便于解析）
xray webscan --url http://target/?id=1 --json-output result.json

Phase 2: Crawler Scanning (automatic page discovery)

# 基础爬虫 + 漏洞扫描
xray webscan --basic-crawler http://target --html-output crawl-result.html

# 指定爬虫深度和插件
xray webscan --basic-crawler http://target --plugins xss,sqldet,cmd-injection --html-output result.html

Phase 3: Passive Proxy Scanning

Suitable for manual testing with a browser, xray automatically analyzes traffic passing through the proxy:

# 启动代理监听
xray webscan --listen 127.0.0.1:7777 --html-output proxy-result.html

# 然后设置浏览器/工具代理为 127.0.0.1:7777
# 所有经过代理的请求都会被自动扫描

Phase 4: Detection Plugin Quick Reference

Plugin Key	Detection Content	Description
xss	XSS vulnerability	Semantic analysis engine
sqldet	SQL injection	Error-based/boolean-based/time-based blind injection
cmd-injection	Command injection/code execution/SSTI	Multiple payloads
dirscan	Directory enumeration	Backup files, configuration files, debug pages
path-traversal	Path traversal	Multi-platform multi-encoding
xxe	XML entity injection	Echo-based + reverse connection detection
upload	File upload	Common backend languages
brute-force	Weak passwords	HTTP basic authentication + forms
jsonp	JSONP hijacking	Cross-domain reading of sensitive information
ssrf	SSRF	Common bypasses + reverse connection detection
baseline	Baseline check	SSL version, HTTP header detection
redirect	Open redirect	meta/30x redirect
crlf-injection	CRLF injection	HTTP header injection
struts	Struts2 vulnerability	s2-016/032/045/059/061 (advanced version)
shiro	Shiro deserialization	Key detection (advanced version)
fastjson	Fastjson vulnerability	Series detection (advanced version)
thinkphp	ThinkPHP vulnerability	Series detection (advanced version)

Select plugin combinations by scenario

# 快速扫描（高危优先，1-2 分钟）
xray webscan --url URL --plugins sqldet,cmd-injection,xxe,ssrf

# 全面扫描（所有插件，默认行为）
xray webscan --url URL

# Web 应用测试（聚焦 Web 漏洞）
xray webscan --url URL --plugins xss,sqldet,cmd-injection,upload,path-traversal

# Java 应用（针对性）
xray webscan --url URL --plugins struts,shiro,fastjson,sqldet

Phase 5: POC Scanning

xray has a built-in POC engine (phantasm), supporting community-contributed POCs:

# 使用内置 POC 扫描
xray webscan --plugins phantasm --url http://target

# 指定自定义 POC 目录
xray webscan --plugins phantasm --poc /path/to/pocs/ --url http://target

Community POC repository:https://github.com/chaitin/xray-plugins

Configuration optimization

# 生成默认配置文件
xray genca    # 生成 CA 证书（HTTPS 代理需要）

# 配置文件位置：~/.xray/config.yaml
# 常用配置项：
# - http.proxy: 设置上游代理
# - http.headers: 自定义请求头
# - plugins.xxx.enabled: 启用/禁用插件

Comparison with nuclei for decision-making

Scenario	Recommended tool	Reason
Known CVE verification	nuclei	More complete template library (9000+)
General Web vulnerability scanning	xray	Semantic analysis, lower false positive rate
Passive proxy scanning	xray	Native support for proxy mode
Batch target PoC detection	nuclei	Better batch performance
In-depth SQL injection detection	xray	sqldet engine is more precise