Create CVE-2023-34992.yaml

.github/ISSUE_TEMPLATE/false-negative.md

@@ -0,0 +1,21 @@
+---
+name: False Negative
+about: 'Issue for template missing valid/expected result.'
+labels: 'false-negative'
+
+---
+
+<!-- ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION. -->
+
+### Nuclei Version:
+
+<!-- You can find current version of nuclei with "nuclei -version" -->
+
+### Template file:
+
+<!-- Template producing false-negative results, for example: "http/cves/XX/XX.yaml" -->
+
+### Command to reproduce:
+
+<!-- Please include the command to replicate the behavior so fix can be applied asap. -->
+<!-- if host information can not be shared publicly, please reach out to us on discord server in DM -->

.github/ISSUE_TEMPLATE/false-negative.yml

@@ -1,67 +0,0 @@
-name: False Negative
-description: Report templates with false negative results.
-title: "[FALSE-NEGATIVE] ..."
-labels: ["false-negative"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to fill out this false-negative report!
-
-        :warning: **Issues missing important information may be closed without further investigation.**
-  - type: textarea
-    attributes:
-      label: Template IDs or paths
-      description: |
-        Examples:
-          - CVE-202A-YYYYY
-          - CVE-202B-YYYYY
-          - http/cves/CVE-202C-YYYYY.yaml
-      value: |
-          - ...
-      render: markdown
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Environment
-      description: |
-        Examples:
-          - **OS**: Ubuntu 20.04
-          - **Nuclei** (`nuclei -version`): v3.3.3
-          - **Go** (`go version`): go1.22.0 _(only if you've installed it via `go install` command)_
-      value: |
-          - OS: 
-          - Nuclei: 
-          - Go: 
-      render: markdown
-    validations:
-      required: false
-  - type: textarea
-    attributes:
-      label: Steps To Reproduce
-      description: |
-        Steps to reproduce the behavior, for example, commands to run the templates with Nuclei.
-
-        :warning: **Please redact any literal target hosts/URLs or other sensitive information.**
-      placeholder: |
-        1. Run `nuclei -t ...`
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Relevant dumped responses
-      description: |
-        Please copy and paste any relevant dumped responses (`-dresp`/`-debug-resp`). This will be automatically formatted into code, so no need for backticks.
-
-        :warning: **Please redact any literal target hosts/URLs or other sensitive information.**
-      render: shell
-  - type: textarea
-    attributes:
-      label: Anything else?
-      description: |
-        Links? References? Trace (`-tlog`/`-trace-log`) or error (`-elog`/`-error-log`) log? Anything that will give us more context about the issue you are encountering!
-
-        Tip: You can attach images or log files by clicking this area to highlight it and then dragging files in.
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/false-positive.md

@@ -0,0 +1,24 @@
+---
+name: False Positive
+about: 'Issue for template producing invalid/unexpected result.'
+labels: 'false-positive'
+
+---
+
+<!-- ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION. -->
+
+### Nuclei Version:
+
+<!-- You can find current version of nuclei with "nuclei -version" -->
+
+### Template file:
+
+<!-- Template producing false-positive results, for example: "http/cves/XX/XX.yaml" -->
+
+### Command to reproduce:
+
+<!-- Please include the command to replicate the behavior so fix can be applied asap. -->
+<!-- if host information can not be shared publicly, please reach out to us on discord server in DM -->
+
+### Anything else:
+<!-- Links? References? Screnshots? Anything that will give us more context about the issue that you are encountering! -->

.github/ISSUE_TEMPLATE/false-positive.yml

@@ -1,67 +0,0 @@
-name: False Positive
-description: Report templates with false positive results.
-title: "[FALSE-POSITIVE] ..."
-labels: ["false-positive"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to fill out this false-positive report!
-
-        :warning: **Issues missing important information may be closed without further investigation.**
-  - type: textarea
-    attributes:
-      label: Template IDs or paths
-      description: |
-        Examples:
-          - CVE-202A-YYYYY
-          - CVE-202B-YYYYY
-          - http/cves/CVE-202C-YYYYY.yaml
-      value: |
-          - ...
-      render: markdown
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Environment
-      description: |
-        Examples:
-          - **OS**: Ubuntu 20.04
-          - **Nuclei** (`nuclei -version`): v3.3.3
-          - **Go** (`go version`): go1.22.0 _(only if you've installed it via `go install` command)_
-      value: |
-          - OS: 
-          - Nuclei: 
-          - Go: 
-      render: markdown
-    validations:
-      required: false
-  - type: textarea
-    attributes:
-      label: Steps To Reproduce
-      description: |
-        Steps to reproduce the behavior, for example, commands to run the templates with Nuclei.
-
-        :warning: **Please redact any literal target hosts/URLs or other sensitive information.**
-      placeholder: |
-        1. Run `nuclei -t ...`
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Relevant dumped responses
-      description: |
-        Please copy and paste any relevant dumped responses (`-dresp`/`-debug-resp`). This will be automatically formatted into code, so no need for backticks.
-
-        :warning: **Please redact any literal target hosts/URLs or other sensitive information.**
-      render: shell
-  - type: textarea
-    attributes:
-      label: Anything else?
-      description: |
-        Links? References? Trace (`-tlog`/`-trace-log`) or error (`-elog`/`-error-log`) log? Anything that will give us more context about the issue you are encountering!
-
-        Tip: You can attach images or log files by clicking this area to highlight it and then dragging files in.
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature request
+about: Request feature to implement in this project
+labels: 'Type: Enhancement'
+---
+
+<!--
+1. Please make sure to provide a detailed description with all the relevant information that might be required to start working on this feature.
+2. In case you are not sure about your request or whether the particular feature is already supported or not, please start a discussion instead.
+3. GitHub Discussion: https://github.com/projectdiscovery/nuclei-templates/discussions/categories/ideas
+4. Join our discord server at https://discord.gg/projectdiscovery to discuss the idea on the #nuclei-templates channel.
+-->
+
+### Please describe your feature request:
+<!-- A clear and concise description of feature to implement -->
+
+### Describe the use case of this feature:
+<!-- A clear and concise description of the feature request's motivation and the use-cases in which it could be useful. -->

.github/ISSUE_TEMPLATE/issue-report.md

@@ -0,0 +1,21 @@
+---
+name: Issue report
+about: "Issue to report invalid template"
+labels: 'Type: Bug'
+
+---
+
+<!-- 
+1. Please search to see if an issue already exists for the bug you encountered.
+2. For support requests, FAQs or "How to" questions, please use the GitHub Discussions section instead - https://github.com/projectdiscovery/nuclei-templates/discussions or
+3. Join our discord server at https://discord.gg/projectdiscovery and post the question on the #nuclei-templates channel.
+-->
+
+<!-- ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION. -->
+
+### Issue description:
+<!-- A concise description of what you're experiencing. -->
+
+
+### Anything else:
+<!-- Links? References? Screnshots? Anything that will give us more context about the issue that you are encountering! -->

.github/ISSUE_TEMPLATE/new-template.md

@@ -0,0 +1,17 @@
+---
+name: Template Request
+about: 'request for new template to be created.'
+labels: 'new-template'
+
+---
+
+<!-- ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION. -->
+
+
+### Template for?
+
+<!-- Name the CVE / Vulnerability / Exploit / Misconfiguration / Technology -->
+
+### Details:
+
+<!-- Required information to create a nuclei template such as exploit link / source / reference / vulnerable setup / search query / demo host -->

.github/ISSUE_TEMPLATE/submit-template.md

@@ -0,0 +1,23 @@
+---
+name: Template Contribution
+about: Contributing nuclei template using GitHub Issue
+labels: 'nuclei-template'
+---
+
+### Template Information:
+
+<!-- Include basic information of the template including reference -->
+<!-- Templates without any reference mostly likely to take more time for review/validation -->
+
+
+### Nuclei Template:
+
+<!-- Include nuclei template in between code block shared below -->
+
+
+```yaml
+
+```
+
+<!-- Include template results if available or redacted valid response snippet of valid match -->
+<!-- Example response help us to update the matchers as unique as possible to avoid possible false-positive results. -->

.github/ISSUE_TEMPLATE/template-contribution.yml

@@ -1,38 +0,0 @@
-name: Template Contribution
-description: Contributing Nuclei template.
-title: "[TEMPLATE CONTRIBUTION] ..."
-labels: ["template-contribution"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to contribute a Nuclei template!
-
-        :warning: **Please submit only one template per issue. This helps us manage and review contributions more effectively.**
-  - type: checkboxes
-    attributes:
-      label: Is there an existing template for this?
-      description: Please search to see if an template or issue already exists for the template you contributed.
-      options:
-      - label: I have searched the existing templates.
-        required: true
-  - type: textarea
-    attributes:
-      label: Nuclei Template
-      description: Please copy and paste the Nuclei template below. This will be automatically formatted into code, so no need for backticks.
-      render: yaml
-  - type: textarea
-    attributes:
-      label: Relevant dumped responses
-      description: |
-        Please copy and paste any relevant dumped responses (`-dresp`/`-debug-resp`). This will be automatically formatted into code, so no need for backticks.
-
-        :warning: **Please redact any literal target hosts/URLs or other sensitive information.**
-      render: shell
-  - type: textarea
-    attributes:
-      label: Anything else?
-      description: |
-        Links? References? Anything that can speed up the review or validation process.
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/template-requests.yml

@@ -1,40 +0,0 @@
-name: Template Requests
-description: Requesting new Nuclei templates.
-title: "[TEMPLATE REQUEST] ..."
-labels: ["template-requests"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to fill out this template request issue!
-  - type: checkboxes
-    attributes:
-      label: Is there an existing template for this?
-      description: Please search to see if an template or issue already exists for the template you contributed.
-      options:
-      - label: I have searched the existing templates.
-        required: true
-  - type: textarea
-    attributes:
-      label: Template requests
-      description: |
-        Examples:
-          - CVE-202A-YYYYY
-          - CVE-202B-YYYYY
-          - Exploit X
-          - Misconfiguration X
-          - Technology X Detection
-      value: |
-          - ...
-  - type: textarea
-    attributes:
-      label: Anything else?
-      description: |
-        Links? References (e.g. PoC, exploit, blog post, etc.)? Anything that can speed up template creation, such as:
-        - Detailed vulnerability descriptions
-        - Sample payloads or exploit code
-        - Expected responses or indicators of successful exploitation
-        - Affected software versions or configurations
-        - Any known limitations or edge cases
-    validations:
-      required: false

.github/scripts/assign_tasks.py

@@ -7,8 +7,8 @@ password = sys.argv[3]
 
 repo_owner = "projectdiscovery"
 repo_name = "nuclei-templates"
-pr_user_list = ["pussycat0x", "DhiyaneshGeek", "ritikchaddha"]
-issue_user_list = ["DhiyaneshGeek", "ritikchaddha", "pussycat0x", "princechaddha"]
+pr_user_list = ["DhiyaneshGeek", "pussycat0x", "ritikchaddha"]
+issue_user_list = ["DhiyaneshGeek", "pussycat0x", "ritikchaddha", "princechaddha"]
 
 headers = {'Authorization': f'Bearer {password}',
         'Accept': 'application/vnd.github+json',

.github/scripts/weak-matcher-checks.sh

@@ -1,33 +0,0 @@
-#!/bin/bash
-
-set -uo pipefail
-
-OUTPUT="/tmp/nuclei-result-${GITHUB_SHA}.out"
-CHANGED_FILES="$(sed 's/ / -t /g' <<< "${CHANGED_FILES}")"
-WEAK=false
-COMMENT=""
-
-eval "nuclei -duc -silent -ud ${GITHUB_WORKSPACE} -u ${HONEYPOT_URL} -o ${OUTPUT} -t ${CHANGED_FILES}"
-
-if [[ "$(wc -l < $OUTPUT)" -gt 0 ]]; then
-	COMMENT+="**:warning: Weak matcher detected**\n\n"
-	COMMENT+="It looks like Nuclei has found some results on the honeypot target.\n\n"
-	COMMENT+="To improve the accuracy of these results and avoid any false positives, "
-	COMMENT+="please adjust the matchers as needed. "
-	COMMENT+="This will help in providing more reliable and precise results.\n\n"
-	COMMENT+="| **Template ID** |\n"
-	COMMENT+="|--|\n"
-	COMMENT+=$(grep -Po "^\\K[[\w_-]+\]" $OUTPUT | sed 's/\[/| /g; s/\]/ |/g' | sed ':a;N;$!ba;s/\n/\\n/g')
-	COMMENT+="\n\n"
-	COMMENT+="> Ref ${GITHUB_SHA}"
-
-	WEAK=true
-fi
-
-echo "weak=${WEAK}" >> $GITHUB_OUTPUT
-
-{
-	echo "comment<<EOF"
-	echo -e "${COMMENT}"
-	echo "EOF"
-} >> $GITHUB_OUTPUT

.github/scripts/yaml2json/go.mod

@@ -1,5 +0,0 @@
-module yaml2json
-
-go 1.22.0
-
-require gopkg.in/yaml.v3 v3.0.1 // indirect

.github/scripts/yaml2json/go.sum

@@ -1,3 +0,0 @@
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

.github/workflows/autoassign.yml

@@ -1,26 +1,31 @@
 name: 🤖 issue/pr assignment
 on:
-#  pull_request:
-#    types: [opened]
-#    branches: 
-#      - main
+  pull_request:
+    types: [opened]
+    branches: 
+      - main
   issues:
     types: [opened]
 
-env:
-  ASSIGN_TASK_TOKEN: ${{ secrets.PDTEAMX_PAT }} # github personal token
-
 jobs:
   build:
     permissions: write-all
     runs-on: ubuntu-latest
+    env:
+      ASSIGN_TASK_TOKEN: ${{ secrets.PDTEAMX_PAT }} # github personal token
     steps:
-      - uses: actions/checkout@v4 # checkout the repository content
-      - uses: actions/setup-python@v5
+      - name: checkout repo content
+        uses: actions/checkout@v4 # checkout the repository content
+      - name: setup python
+        uses: actions/setup-python@v5
         with:
           python-version: '3.10' # install the python version needed
-      - run: pip install requests
-#      - if: github.event_name == 'pull_request'
-#        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
-      - if: github.event_name == 'issues'
+      - name: install python packages
+        run: |
+          pip install requests
+      - name: execute python script on pr
+        if: ${{ github.event_name == 'pull_request' }}
+        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
+      - name: execute python script on issue opened
+        if: ${{ github.event_name == 'issues' }}
         run: python .github/scripts/assign_tasks.py ${{ github.event.issue.number }} issue ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cve2json.yml

@@ -5,27 +5,41 @@ on:
     branches:
       - main
     paths:
-      - '**/cves/**'
-  workflow_dispatch:
+      - '*/cves/**'
+  workflow_dispatch: # allows manual triggering of the workflow
 
 jobs:
   cve2json:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v4
-      - uses: projectdiscovery/actions/setup/go@v1
+      - uses: actions/checkout@master
+      - name: Set up Go
+        uses: actions/setup-go@v5
         with:
-          go-version: 'stable'
-      - run: go run main.go $GITHUB_WORKSPACE/http/cves/,$GITHUB_WORKSPACE/network/cves/,$GITHUB_WORKSPACE/javascript/cves/ $GITHUB_WORKSPACE/cves.json
-        working-directory: .github/scripts/yaml2json
-      - run: md5sum cves.json | cut -d' ' -f1 > cves.json-checksum.txt
-      - uses: projectdiscovery/actions/setup/git@v1
-      - uses: projectdiscovery/actions/commit@v1
-        with:
-          files: 'cves.json*'
-          message: 'chore: generate CVEs metadata 🤖'
-      - name: Push changes
+          go-version: 1.19
+          
+      - name: Run YAML2JSON
+        id: cves
         run: |
-          git pull origin $GITHUB_REF --rebase
-          git push origin $GITHUB_REF
+          go env -w GO111MODULE=off
+          go get gopkg.in/yaml.v3
+          go run .github/scripts/yaml2json.go $GITHUB_WORKSPACE/http/cves/,$GITHUB_WORKSPACE/network/cves/ cves.json
+          md5sum cves.json | cut -d' ' -f1 > cves.json-checksum.txt
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+          
+      - name: Commit files
+        if: steps.cves.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add cves.json cves.json-checksum.txt
+          git commit -m "Auto Generated cves.json [$(date)] :robot:" -a
+
+      - name: Push changes
+        if: steps.cves.outputs.CHANGES > 0
+        run: |
+          git pull --rebase
+          git push origin ${{ github.ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/new-templates.yml

@@ -10,26 +10,36 @@ on:
   release:
     types: [published]  
 
-env:
-  NEW_ADDITION_FILE: '.new-additions'
-
 jobs:
-  new-addition:
+  templates:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@master
         with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: false
           fetch-depth: 0
-      - name: Generate new addition list
+
+      - name: Generate new template list
+        id: new-additions
         run: |
-          LATEST_TAG=$(git describe --tags `git rev-list --tags --max-count=1`)
-          git diff --name-only --diff-filter=A $LATEST_TAG @ . | grep -v "^\.github/" | grep "\.yaml$" | tee $NEW_ADDITION_FILE
-      - uses: projectdiscovery/actions/setup/git@v1
-      - uses: projectdiscovery/actions/commit@v1
+          git pull
+          git diff  --name-only --diff-filter=A $(git tag | tail -n 1) @ . | grep .yaml | tee .new-additions
+
+      - name: Commit files
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "[PDBot]"
+          git add .new-additions -f
+          git commit --allow-empty -m "Auto Generated New Template Addition List [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
         with:
-          files: '${{ env.NEW_ADDITION_FILE }}'
-          message: 'chore: generate new addition list 🤖'
-      - run: |
-          git pull origin $GITHUB_REF --rebase
-          git push origin $GITHUB_REF
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}
+
+      - name: Trigger Remote Workflow with curl
+        run: |
+          curl -i -s -k -X 'POST' -H 'Host: api.github.com' -H "Authorization: token ${{ secrets.GTOKEN }}" --data-binary $'{\"ref\":\"main\"}' 'https://api.github.com/repos/projectdiscovery/early-templates/actions/workflows/reposync.yml/dispatches'

.github/workflows/readme-update.yml

@@ -12,15 +12,36 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - run: sudo apt-get install tree -y
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - name: Install tree
+        run: sudo apt-get install tree -y
+
+      - name: Check out code
+        uses: actions/checkout@master
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
         with:
           python-version: "3.8"
-      - run: python .github/scripts/update-readme.py
-      - uses: projectdiscovery/actions/setup/git@v1
-      - uses: projectdiscovery/actions/commit@v1
+
+      - name: Update README
+        id: readme-update
+        run: |
+          python .github/scripts/update-readme.py
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+
+      - name: Commit files
+        if: steps.readme-update.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto README Update [$(date)] :robot:" -a
+
+      - name: Push changes
+        if: steps.readme-update.outputs.CHANGES > 0
+        uses: ad-m/github-push-action@master
         with:
-          files: 'README.md'
-          message: 'docs: update README 🤖'
-      - run: git push origin $GITHUB_REF
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}

.github/workflows/syntax-checking.yml

@@ -0,0 +1,20 @@
+name: ❄️ YAML Lint
+
+on:
+  pull_request:
+    paths:
+      - '**.yaml'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Yamllint
+        uses: karancode/[email protected]
+        with:
+          yamllint_config_filepath: .yamllint
+          yamllint_strict: false
+          yamllint_comment: true

.github/workflows/template-checksum.yml

@@ -6,10 +6,7 @@ on:
       - main
     paths:
       - '**.yaml'
-  workflow_dispatch:
-
-env:
-  CHECKSUM_FILE: 'templates-checksum.txt'
+  workflow_dispatch: # allows manual triggering of the workflow
 
 jobs:
   checksum:
@@ -17,17 +14,36 @@ jobs:
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - uses: actions/checkout@v4
-      - uses: projectdiscovery/actions/generate/checksum@v1
+        with: 
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
         with:
-          templates-directory: '${{ github.workspace }}'
-          checksum-file: '${{ env.CHECKSUM_FILE }}'
-      - run: git status
-      - uses: projectdiscovery/actions/setup/git@v1
-      - uses: projectdiscovery/actions/commit@v1
-        with:
-          files: '${{ env.CHECKSUM_FILE }}'
-          message: 'chore: generate templates checksum 🤖'
-      - name: Push changes
+          go-version: 1.21.x
+
+      - name: install checksum generator
         run: |
-          git pull origin $GITHUB_REF --rebase
-          git push origin $GITHUB_REF
+          go install -v github.com/projectdiscovery/nuclei/v3/cmd/generate-checksum@latest
+
+      - name: generate checksum
+        id: checksum
+        run: |
+          generate-checksum /home/runner/work/nuclei-templates/nuclei-templates/ templates-checksum.txt
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+
+      - name: Commit files
+        if: steps.checksum.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add templates-checksum.txt
+          git commit -am "Auto Generated Templates Checksum [$(date)] :robot:"
+
+      - name: Push changes
+        if: steps.checksum.outputs.CHANGES > 0
+        run: |
+          git pull --rebase
+          git push origin ${{ github.ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/template-db-indexer.yml

@@ -0,0 +1,31 @@
+name: 📑 Template-DB Indexer
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs:
+  index:
+    runs-on: ubuntu-latest-16-cores
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.21.x
+
+      - name: Installing Indexer
+        run: |
+          git config --global url."https://${{ secrets.ACCESS_TOKEN }}@github".insteadOf https://github
+          git clone https://github.com/projectdiscovery/nucleish-api.git
+          cd nucleish-api/cmd/generate-index/
+          go install
+
+      - name: Generate Index
+        env:
+          AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
+          AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
+        run: |
+          generate-index -mode templates -eft

.github/workflows/template-sign.yml

@@ -9,70 +9,44 @@ on:
   workflow_dispatch:
 
 jobs:
-  linux-sign:
-    name: Sign All Templates (Linux)
+  build:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - uses: actions/checkout@v4
-      - uses: projectdiscovery/actions/setup/nuclei@v1
-        with:
-          token: '${{ secrets.GITHUB_TOKEN}}'
-      - run: nuclei -lfa -duc -sign -ud $GITHUB_WORKSPACE -t .
-        env:
-          NUCLEI_USER_CERTIFICATE: ${{ secrets.NUCLEI_USER_CERTIFICATE }}
-          NUCLEI_USER_PRIVATE_KEY: ${{ secrets.NUCLEI_USER_PRIVATE_KEY }}
-      - uses: projectdiscovery/actions/setup/git@v1
-      - uses: projectdiscovery/actions/commit@v1
-        with:
-          files: '.'
-          message: 'chore: sign templates 🤖'
-      - name: Push changes
-        run: |
-          git pull origin $GITHUB_REF --rebase
-          git push origin $GITHUB_REF
+        with: 
+          fetch-depth: 0
 
-  windows-sign:
-    name: Sign Windows Templates
-    needs: linux-sign
-    runs-on: windows-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    steps:
-      - uses: actions/checkout@v4
-      
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.21'
-          
-      - name: Install Nuclei
+          go-version: 1.21.x
+
+      - name: nuclei install
+        run: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
+
+      - name: Template Sign
+        id: sign
         run: |
-          go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
-          nuclei -version
-        shell: bash
-          
-      - name: Sign Windows Templates
-        run: nuclei -lfa -duc -sign -ud "${{ github.workspace }}" -t "code/windows/audit"
-        shell: bash
+          nuclei -lfa -duc -sign -t /home/runner/work/nuclei-templates/nuclei-templates
+          nuclei -lfa -duc -t /home/runner/work/nuclei-templates/nuclei-templates
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
         env:
           NUCLEI_USER_CERTIFICATE: ${{ secrets.NUCLEI_USER_CERTIFICATE }}
           NUCLEI_USER_PRIVATE_KEY: ${{ secrets.NUCLEI_USER_PRIVATE_KEY }}
           
-      - name: Configure Git
+      - name: Commit files
+        if: steps.sign.outputs.CHANGES > 0
         run: |
-          git config --global user.name "Ghost"
-          git config --global user.email "[email protected]ithub.com"
-        shell: bash
-          
-      - name: Commit Changes
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add cves.json cves.json-checksum.txt
+          git commit -m "Auto Template Signing [$(date)] :robot:" -a
+
+      - name: Push changes
+        if: steps.sign.outputs.CHANGES > 0
         run: |
-          git add code/windows/audit
-          git commit -m "chore: re-sign windows templates 🤖" || echo "No changes to commit"
-        shell: bash
-          
-      - name: Push Changes
-        run: |
-          git remote update
-          git pull origin ${{ github.ref }} --rebase || exit 1
-          git push origin ${{ github.ref }} || (git remote update && git pull origin ${{ github.ref }} --rebase && git push origin ${{ github.ref }})
-        shell: bash
+          git pull --rebase
+          git push origin ${{ github.ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/template-validate.yml

@@ -0,0 +1,30 @@
+name: 🛠 Template Validate
+
+on:
+  pull_request:
+    paths:
+      - '**.yaml'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - uses: actions/checkout@v4
+        with: 
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.21.x
+
+      - name: nuclei install
+        run: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
+
+      - name: Template Validation
+        run: |
+          cp -r ${{ github.workspace }} $HOME
+          nuclei -duc -validate -allow-local-file-access -et /home/runner/nuclei-templates/config/.git -et /home/runner/nuclei-templates/config
+          nuclei -duc -validate -w ./workflows -allow-local-file-access -et /home/runner/nuclei-templates/config/.git -et /home/runner/nuclei-templates/config

.github/workflows/templateman.yml

@@ -9,15 +9,38 @@ jobs:
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - uses: actions/checkout@v4
-      - uses: projectdiscovery/actions/setup/templateman@v1
         with:
-          token: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'
-      - run: tmc -mr -e -at <<< "$(pwd)"
-      - uses: projectdiscovery/actions/setup/git@v1
-      - uses: projectdiscovery/actions/commit@v1
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
         with:
-          message: 'chore: update TemplateMan 🤖'
-      - name: Push changes
+          go-version: 1.21.x
+
+      - name: Install TemplateMan CLI Client
         run: |
-          git pull origin $GITHUB_REF --rebase
-          git push origin $GITHUB_REF
+          git config --global url."https://${{ secrets.ACCESS_TOKEN }}@github".insteadOf https://github
+          git clone https://github.com/projectdiscovery/templateman.git
+          cd templateman/templateman-cli/cmd/tmc
+          go install
+
+      - name: Run TemplateMan
+        id: tmc
+        run: |
+          echo /home/runner/work/nuclei-templates/nuclei-templates | tmc -mr -e -at
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+
+      - name: Commit files
+        if: steps.tmc.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit --allow-empty -m "TemplateMan Update [$(date)] :robot:" -a
+
+      - name: Push changes
+        if: steps.tmc.outputs.CHANGES > 0
+        run: |
+          git pull --rebase
+          git push origin ${{ github.ref }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/templates-stats.yml

@@ -14,27 +14,46 @@ jobs:
       - uses: actions/checkout@v4
         with: 
           fetch-depth: 0
-      - uses: projectdiscovery/actions/templates/stats@v1
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
         with:
-          path: '${{ github.workspace }}'
-          output: 'TEMPLATES-STATS.md'
-      - uses: projectdiscovery/actions/templates/stats@v1
-        with:
-          path: '${{ github.workspace }}'
-          output: 'TEMPLATES-STATS.json'
-          args: '-json'
-      - uses: projectdiscovery/actions/templates/stats@v1
-        with:
-          path: '${{ github.workspace }}'
-          output: 'TOP-10.md'
-          args: '-top 10'
-      - uses: projectdiscovery/actions/setup/git@v1
-      - uses: projectdiscovery/actions/commit@v1
-        with:
-          files: |
-            TEMPLATES-STATS.*
-            TOP-10.md
-          message: 'chore: generate templates stats 🤖'
-      - uses: ad-m/github-push-action@master
+          go-version: 1.19
+
+      - name: Installing Template Stats
+        run: |
+          go install github.com/projectdiscovery/templates-stats@main
+        shell: bash
+
+      - name: Markdown Stats
+        run: |
+          templates-stats -output TEMPLATES-STATS.md -path /home/runner/work/nuclei-templates/nuclei-templates/
+        shell: bash
+
+      - name: JSON Stats
+        run: |
+          templates-stats -output TEMPLATES-STATS.json -json -path /home/runner/work/nuclei-templates/nuclei-templates/
+        shell: bash
+
+      - name: Top 10 Stats
+        run: |
+          templates-stats -output TOP-10.md -top 10 -path /home/runner/work/nuclei-templates/nuclei-templates/
+        shell: bash
+
+      - name: Get statistical changes
+        id: stats
+        run: git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+
+      - name: Commit files
+        if: steps.stats.outputs.CHANGES > 0
+        run: |
+          git add TEMPLATES-STATS.*
+          git add TOP-10.md
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Generated Templates Stats [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/templates-sync.yml

@@ -0,0 +1,45 @@
+name: Sync Repositories Workflow
+on:
+  push:
+    paths:
+    - '.new-additions'
+    - 'http/cves/2022/CVE-2022-45269.yaml'
+    - 'http/cves/2023/CVE-2023-29204.yaml'
+    - 'http/cves/2023/CVE-2023-4220.yaml'
+    - 'http/cves/2023/CVE-2023-44012.yaml'
+    - 'http/cves/2023/CVE-2023-4450.yaml'
+    - 'http/cves/2023/CVE-2023-48728.yaml'
+    - 'http/cves/2024/CVE-2024-1512.yaml'
+    - 'http/cves/2024/CVE-2024-2330.yaml'
+    - 'http/cves/2024/CVE-2024-34257.yaml'
+    - 'http/cves/2024/CVE-2024-34351.yaml'
+    - 'http/cves/2024/CVE-2024-3742.yaml'
+    - 'http/cves/2024/CVE-2024-4257.yaml'
+    - 'http/cves/2024/CVE-2024-4879.yaml'
+    - 'http/cves/2024/CVE-2024-5217.yaml'
+    - 'http/cves/2024/CVE-2024-6289.yaml'
+    - 'http/cves/2024/CVE-2024-6646.yaml'
+    - 'http/default-logins/gitblit/gitblit-default-login.yaml'
+    - 'http/exposed-panels/adguard-panel.yaml'
+    - 'http/exposed-panels/falcosidekick-panel.yaml'
+    - 'http/exposed-panels/freshrss-panel.yaml'
+    - 'http/exposed-panels/gradle/gradle-develocity-panel.yaml'
+    - 'http/exposures/configs/apache-ozone-conf.yaml'
+    - 'http/exposures/configs/snoop-servlet-exposure.yaml'
+    - 'http/exposures/files/adcs-certificate.yaml'
+    - 'http/misconfiguration/freshrss-unauth.yaml'
+    - 'http/misconfiguration/installer/adguard-installer.yaml'
+    - 'http/misconfiguration/servicenow-title-injection.yaml'
+    - 'http/technologies/apache/apache-ozone-detect.yaml'
+    - 'http/technologies/wordpress/plugins/wp-crontrol.yaml'
+    - 'http/vulnerabilities/nextjs/nextjs-middleware-cache.yaml'
+    - 'http/vulnerabilities/nextjs/nextjs-rsc-cache.yaml'
+  workflow_dispatch:
+jobs:
+  triggerRemoteWorkflow:
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    runs-on: ubuntu-latest
+    steps:
+    - name: Trigger Remote Workflow with curl
+      run: |
+        curl -i -s -k -X 'POST' -H 'Host: api.github.com' -H "Authorization: token ${{ secrets.GTOKEN }}" --data-binary $'{\"ref\":\"main\"}' 'https://api.github.com/repos/projectdiscovery/early-templates/actions/workflows/reposync.yml/dispatches'

.github/workflows/tests.yml

@@ -1,83 +0,0 @@
-name: 🛠 Tests
-
-on:
-  pull_request:
-    paths:
-      - '**.yaml'
-  workflow_dispatch:
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    steps:
-      - uses: actions/checkout@v4
-      - uses: karancode/[email protected]
-        with:
-          yamllint_config_filepath: .yamllint
-          yamllint_strict: false
-          yamllint_comment: true
-
-  validate:
-    needs: lint
-    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    steps:
-      - uses: actions/checkout@v4
-      - uses: projectdiscovery/actions/setup/nuclei@v1
-        with:
-          token: '${{ secrets.GITHUB_TOKEN }}'
-      - name: Validate templates
-        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/
-
-  weak-matcher-checks:
-    needs: lint
-    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    permissions:
-      issues: write
-      pull-requests: write
-    env:
-      HONEYPOT_URL: 'http://honey.scanme.sh'
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v3
-        id: filter
-        with:
-          list-files: shell
-          filters: |
-            templates: &templates
-              - '**.yml'
-              - '**.yaml'
-              - '!.github/**'
-            changed:
-              - added|modified: *templates
-      - uses: projectdiscovery/actions/setup/nuclei@v1
-        with:
-          token: '${{ secrets.GITHUB_TOKEN }}'
-      - run: bash weak-matcher-checks.sh
-        id: check
-        if: steps.filter.outputs.changed == 'true'
-        env:
-          CHANGED_FILES: '${{ steps.filter.outputs.changed_files }}'
-        working-directory: '.github/scripts/'
-      - uses: actions/github-script@v7
-        if: steps.check.outputs.weak == 'true'
-        with:
-          script: |
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: process.env.COMMENT
-            })
-
-            github.rest.issues.addLabels({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              labels: ['false-positive']
-            })
-        env:
-          COMMENT: '${{ steps.check.outputs.comment }}'
-          GITHUB_TOKEN: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'

.github/workflows/wordpress-plugins-update.yml

@@ -11,24 +11,35 @@ jobs:
     steps:
       - name: Check out repository code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal token
+          fetch-depth: 0 # otherwise, you will failed to push refs to dest repo
 
       - name: Install Python3
         uses: actions/setup-python@v5
         with:
           python-version: "3.10"
-
-      - run: python -m pip install --upgrade pip
-      - run: pip install -r .github/scripts/wordpress-plugins-update-requirements.txt
+      - run: |
+          python -m pip install --upgrade pip
+          pip install -r .github/scripts/wordpress-plugins-update-requirements.txt
 
       - name: Update Templates
-        run: python3 .github/scripts/wordpress-plugins-update.py
+        id: update-templates
+        run: |
+          python3 .github/scripts/wordpress-plugins-update.py
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
 
-      - uses: projectdiscovery/actions/setup/git@v1
+      - name: Commit files
+        if: steps.update-templates.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add --all
+          git commit -m "Auto WordPress Plugins Update [$(date)] :robot:"
 
-      - uses: projectdiscovery/actions/commit@v1
+      - name: Push changes
+        if: steps.update-templates.outputs.CHANGES > 0
+        uses: ad-m/github-push-action@master
         with:
-          files: '.'
-          message: 'chore: update WordPress Plugins 🤖'
-
-      - run: git pull origin $GITHUB_REF --rebase
-      - run: git push origin $GITHUB_REF
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}

.new-additions

@@ -1,81 +1,32 @@
-code/cves/2022/CVE-2022-42475.yaml
-code/cves/2025/CVE-2025-6216.yaml
-code/windows/audit/kisa/account-lockout-threshold.yaml
-code/windows/audit/kisa/admin-account-rename.yaml
-code/windows/audit/kisa/admin-group-minimal.yaml
-code/windows/audit/kisa/autologon-control.yaml
-code/windows/audit/kisa/crash-on-audit-fail.yaml
-code/windows/audit/kisa/dns-zone-transfer-check.yaml
-code/windows/audit/kisa/ftp-access-control-check.yaml
-code/windows/audit/kisa/ftp-anonymous-check.yaml
-code/windows/audit/kisa/ftp-directory-permission-check.yaml
-code/windows/audit/kisa/hard-disk-default-share.yaml
-code/windows/audit/kisa/password-cleartext-encryption.yaml
-code/windows/audit/kisa/password-never-expires.yaml
-code/windows/audit/kisa/rds-removal-check.yaml
-code/windows/audit/kisa/remote-registry-access-check.yaml
-code/windows/audit/kisa/remote-system-shutdown.yaml
-code/windows/audit/kisa/sam-file-access-control.yaml
-code/windows/audit/kisa/service-pack-check.yaml
-code/windows/audit/kisa/shutdown-without-logon.yaml
-code/windows/audit/kisa/unnecessary-accounts-check.yaml
-code/windows/audit/kisa/unnecessary-service-check.yaml
-http/cves/2020/CVE-2020-9547.yaml
-http/cves/2020/CVE-2020-9548.yaml
-http/cves/2022/CVE-2022-23397.yaml
-http/cves/2023/CVE-2023-49230.yaml
-http/cves/2024/CVE-2024-50334.yaml
-http/cves/2025/CVE-2025-2010.yaml
-http/cves/2025/CVE-2025-27505.yaml
-http/cves/2025/CVE-2025-32813.yaml
-http/cves/2025/CVE-2025-32814.yaml
-http/cves/2025/CVE-2025-32815.yaml
-http/cves/2025/CVE-2025-34040.yaml
-http/cves/2025/CVE-2025-41646.yaml
-http/cves/2025/CVE-2025-4380.yaml
-http/cves/2025/CVE-2025-47812.yaml
-http/cves/2025/CVE-2025-47813.yaml
-http/cves/2025/CVE-2025-48827.yaml
-http/cves/2025/CVE-2025-49493.yaml
-http/cves/2025/CVE-2025-52488.yaml
-http/cves/2025/CVE-2025-53624.yaml
-http/cves/2025/CVE-2025-5777.yaml
-http/default-logins/molgenis/molgenis-default-login.yaml
-http/exposed-panels/cisco-cm-panel.yaml
-http/exposed-panels/cisco-prime-license-manager-panel.yaml
-http/exposed-panels/google-adk-api-exposed.yaml
-http/exposed-panels/google-adk-webui-exposed.yaml
-http/exposed-panels/molgenis-panel.yaml
-http/exposed-panels/peplink-panel.yaml
-http/exposed-panels/wingftp-panel.yaml
-http/miscellaneous/torrent-website-detect.yaml
-http/misconfiguration/dd-wrt-controlpanel-exposure.yaml
-http/misconfiguration/installer/pritunl-installer.yaml
-http/misconfiguration/twonky-server-exposure.yaml
-http/osint/user-enumeration/sessionize.yaml
-http/technologies/graphql/graphql-apiforwp-detect.yaml
-http/technologies/graphql/graphql-apollo-detect.yaml
-http/technologies/graphql/graphql-ariadne-detect.yaml
-http/technologies/graphql/graphql-dianajl-detect.yaml
-http/technologies/graphql/graphql-flutter-detect.yaml
-http/technologies/graphql/graphql-go-detect.yaml
-http/technologies/graphql/graphql-gqlgen-detect.yaml
-http/technologies/graphql/graphql-graphene-detect.yaml
-http/technologies/graphql/graphql-hasura-detect.yaml
-http/technologies/graphql/graphql-hypergraphql-detect.yaml
-http/technologies/graphql/graphql-java-detect.yaml
-http/technologies/graphql/graphql-juniper-detect.yaml
-http/technologies/graphql/graphql-php-detect.yaml
-http/technologies/graphql/graphql-ruby-detect.yaml
-http/technologies/graphql/graphql-sangria-detect.yaml
-http/technologies/graphql/graphql-strawberry-detect.yaml
-http/technologies/graphql/graphql-tartiflette-detect.yaml
-http/technologies/graphql/graphql-wpgraphql-detect.yaml
-http/technologies/wordpress/plugins/blocksy-companion.yaml
-http/technologies/wordpress/plugins/gosmtp.yaml
-http/technologies/wordpress/plugins/honeypot.yaml
-http/technologies/wordpress/plugins/pagelayer.yaml
-http/technologies/wordpress/plugins/siteseo.yaml
-http/technologies/wordpress/plugins/unlimited-elements-for-elementor.yaml
-http/vulnerabilities/infoblox/infoblox-netmri-rails-cookie-rce.yaml
-network/detection/jdwp-detect.yaml
+http/cves/2022/CVE-2022-45269.yaml
+http/cves/2023/CVE-2023-29204.yaml
+http/cves/2023/CVE-2023-4220.yaml
+http/cves/2023/CVE-2023-44012.yaml
+http/cves/2023/CVE-2023-4450.yaml
+http/cves/2023/CVE-2023-48728.yaml
+http/cves/2024/CVE-2024-1512.yaml
+http/cves/2024/CVE-2024-2330.yaml
+http/cves/2024/CVE-2024-32238.yaml
+http/cves/2024/CVE-2024-34257.yaml
+http/cves/2024/CVE-2024-34351.yaml
+http/cves/2024/CVE-2024-3742.yaml
+http/cves/2024/CVE-2024-4257.yaml
+http/cves/2024/CVE-2024-4879.yaml
+http/cves/2024/CVE-2024-5217.yaml
+http/cves/2024/CVE-2024-6289.yaml
+http/cves/2024/CVE-2024-6646.yaml
+http/default-logins/gitblit/gitblit-default-login.yaml
+http/exposed-panels/adguard-panel.yaml
+http/exposed-panels/falcosidekick-panel.yaml
+http/exposed-panels/freshrss-panel.yaml
+http/exposed-panels/gradle/gradle-develocity-panel.yaml
+http/exposures/configs/apache-ozone-conf.yaml
+http/exposures/configs/snoop-servlet-exposure.yaml
+http/exposures/files/adcs-certificate.yaml
+http/misconfiguration/freshrss-unauth.yaml
+http/misconfiguration/installer/adguard-installer.yaml
+http/misconfiguration/servicenow-title-injection.yaml
+http/technologies/apache/apache-ozone-detect.yaml
+http/technologies/wordpress/plugins/wp-crontrol.yaml
+http/vulnerabilities/nextjs/nextjs-middleware-cache.yaml
+http/vulnerabilities/nextjs/nextjs-rsc-cache.yaml

.nuclei-ignore

@@ -25,7 +25,11 @@ tags:
 # unless asked for by the user.
 
 files:
+  - http/cves/2006/CVE-2006-1681.yaml
   - http/cves/2019/CVE-2019-14696.yaml
+  - http/cves/2020/CVE-2020-2036.yaml
+  - http/cves/2020/CVE-2020-28351.yaml
+  - http/vulnerabilities/oracle/oracle-ebs-xss.yaml
   - http/cves/2021/CVE-2021-28164.yaml
   - http/fuzzing/wordpress-themes-detect.yaml
   - http/fuzzing/mdb-database-file.yaml
@@ -36,4 +40,3 @@ files:
   - javascript/enumeration/redis/redis-require-auth.yaml
   - dast/vulnerabilities/sqli/time-based-sqli.yaml
   - javascript/enumeration/minecraft-enum.yaml
-  - javascript/enumeration/minecraft-enum.yaml

.review-bot

@@ -1,465 +0,0 @@
-Nuclei-Templates is an open-source project featuring security checks written in YAML format, used by the Nuclei scanner.
-
-You are a reviewer for the GitHub repository: https://github.com/projectdiscovery/nuclei-templates. You will review a Pull Request (PR) diff, which may include new or updated templates, provided at the end of this prompt.
-
-Your objective is to thoroughly analyze the PR diff step-by-step and suggest improvements based solely on the context below. Begin your response by thanking the contributor and including: “You can join our [Discord server](https://discord.com/invite/projectdiscovery). It's a great place to connect with fellow contributors and stay updated with the latest developments. Thank you once again.”
-
-### Nuclei Templates Contribution Guide
-
-When submitting a new template, include these details with a proof of concept (P.O.C):
-
-1. `id`: A concise identifier (3-4 words, e.g., `grafana-unauth-rce`). For CVE templates, use the format `CVE-XXX-XXX`.
-2. Filename: Must match the template `id`.
-3. `name`: For vulnerability/CVE templates, use the format: `<Vendor> <Product> <Version> - Vulnerability`.
-4. `author`: Your GitHub/Twitter username or alias. Optionally, update [contributors.json](https://github.com/projectdiscovery/nuclei-templates/blob/master/contributors.json) with author details.
-5. `severity`: Based on CVSS score, adjusted for exploit impact and real-world implications.
-6. `description`: A brief summary of the vulnerability.
-7. `reference`: Include links to the POC, setup guide, or product details for verification.
-
-Best Practices:
-
-- Specify matcher location (e.g., `part: body` for response body).
-- Use `{{cmd}}` or `{{payloads}}` for RCE/injection templates, `{{username}}`/`{{password}}` for authenticated templates, and `{{token}}` for key/token templates.
-- For web shell uploads (last resort), use a random filename (`{{randstr}}`) and add the `intrusive` tag.
-- Add appropriate tags: `dos` for DoS templates, `auth` for authenticated templates, `cve` and `cve<year>` for CVE templates, `intrusive` for templates modifying configurations or files.
-- For XSS templates, include a unique endpoint string with the payload to avoid false positives (e.g., [CVE-2022-24899](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24899.yaml)).
-- For SSRF templates, include response-based matchers to reduce false positives from honeypots (see: https://github.com/projectdiscovery/nuclei-templates/issues/7401).
-- For time-based SQL injection templates, include a unique endpoint string with duration DSL to avoid false positives from network issues.
-
-Do’s:
-
-- Mark verified templates as `verified: true` and share debug data (redact sensitive server info).
-- Include multiple matchers to minimize false positives.
-- Provide a vulnerable environment (e.g., via [Vulhub](https://github.com/vulhub/vulhub)) when possible.
-- Include an active P.O.C in the template.
-
-Don’t:
-
-- Avoid weak matchers (e.g., strings from GET/POST data) to prevent false positives.
-- Do not make unnecessary changes to existing templates.
-- Avoid version-based CVE/exploit detection unless a full/partial POC is included. Exceptions (e.g., trending CVEs) require justification.
-
-### Templates Review Guide
-
-#### Functional Validation
-
-- Verify the reference to ensure the POC aligns with the template’s purpose (e.g., an RCE template must demonstrate RCE, not just version detection).
-- For XSS templates, confirm a unique endpoint string is included to avoid false positives.
-- Ensure sufficient, unique matchers to validate the issue without being overly strict.
-- For web templates, include at least two matchers (e.g., response header, status code).
-- For SSRF templates, add response-based matchers to counter honeypot triggers.
-- For time-based SQL injection templates, include a unique endpoint string with duration DSL.
-
-#### Non-Functional Validation
-
-After functional validation, check:
-
-- Template is in the correct folder, and filename matches `id`.
-- `id` is unique, descriptive, and uses 2-3 keywords (e.g., `alumni-management-sqli.yaml`). For CVE templates, the ID should be the CVE itself for example, CVE-2020-0796
-- `name` follows the format: `<Company> <Product> <Version> - <Vulnerability Class>` (e.g., `Adobe Coldfusion <=8.0.1 - Cross-Site Scripting`).
-- Fix capitalization, typos, or grammatical errors.
-- Update `tags`:
-  - Add vendor names (e.g., `Atlassian` for Jira/Confluence).
-  - Use `misconfig` for misconfigurations, `oss` for open-source CMS, `oast` for OAST templates, `intrusive` for file uploads or modifications.
-  - For CVEs, include `cve` and `cveYYYY` (e.g., `cve2022`).
-  - Tags should not contain spaces
-- Use `metadata` for additional info (e.g., `verified: true`, Shodan/FOFA queries).
-- Ensure proper `references` (e.g., WordPress plugin links, vendor pages).
-- Maintain consistent template structure and remove unnecessary headers/parameters.
-- Avoid using GET/POST data as matchers.
-- Fix indentation and trailing spaces using `yamllint` or the `validate` argument.
-- Assign a teammate for review before merging.
-
-#### Best Practices
-
-- For tech detection templates, consider adding templates for the tech’s panel or default credentials.
-- Ensure tag names start with the folder/vulnerability name.
-- Create a dedicated folder for technologies with multiple templates.
-- Add a `good first issue` label for first-time contributors’ PRs.
-- Use the `epic` label for creative templates.
-- Do not share vulnerable URLs publicly on GitHub or Discord.
-
-#### Below are examples of existing YAML templates for each protocol, along with their paths. You can use them as references when reviewing templates for the corresponding protocols.
-
-=== dast/vulnerabilities/ssti/oob/erb-erubi-erubis-oob.yaml ===
-```
-id: erb-erubi-erubis-oob
-
-info:
-  name: Erb OR Erubi OR Erubis - Out of Band Template Injection
-  author: 0xAwali,DhiyaneshDK
-  severity: high
-  reference:
-    - https://rubygems.org/gems/erb
-    - https://rubygems.org/gems/erubis
-    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
-  metadata:
-    verified: true
-  tags: ssti,dast,oast,oob
-
-http:
-  - pre-condition:
-      - type: dsl
-        dsl:
-          - 'method == "GET"'
-
-    payloads:
-      injection:
-        - '<%25%3d(`nslookup+-type=SRV+{{interactsh-url}}`)%25>'
-
-    fuzzing:
-      - part: query
-        type: postfix
-        mode: single
-        fuzz:
-          - "{{injection}}"
-
-    matchers:
-      - type: dsl
-        name: request-matcher
-        dsl:
-          - "contains(interactsh_protocol,'dns')"
-          - "contains(interactsh_request,'srv')"
-        condition: and
-```
-
-=== http/vulnerabilities/nps/nps-auth-bypass.yaml ===
-```
-id: nps-auth-bypass
-
-info:
-  name: NPS - Authentication Bypass
-  author: SleepingBag945
-  severity: high
-  description: |
-    This will reveal all parameters configured on the NPS, including the account username and password of the proxy.
-  reference:
-    - https://mari0er.club/post/nps.html/
-  metadata:
-    verified: true
-    max-request: 1
-    shodan-query: html:"window.nps"
-  tags: nps,auth-bypass
-
-http:
-  - raw:
-      - |
-        POST /index/gettunnel HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        auth_key={{md5(unix_time())}}&timestamp={{unix_time()}}&offset=0&limit=10&type=socks5&client_id=&search=
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - '"VerifyKey":'
-          - 'Password":'
-          - 'Id":'
-        condition: and
-
-      - type: word
-        part: header
-        words:
-          - "application/json"
-
-      - type: status
-        status:
-          - 200
-```
-
-=== http/cves/2021/CVE-2021-41291.yaml ===
-```
-id: CVE-2021-41291
-
-info:
-  name: ECOA Building Automation System - Directory Traversal Content Disclosure
-  author: gy741
-  severity: high
-  description: The ECOA BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager (fmangersub), attackers can disclose directory content on the affected device
-  impact: |
-    An attacker can exploit this vulnerability to access sensitive files and directories, potentially exposing sensitive information.
-  remediation: |
-    Apply the latest security patches or updates provided by the vendor to fix the directory traversal vulnerability in the ECOA Building Automation System.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-41291
-    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5670.php
-    - https://www.twcert.org.tw/en/cp-139-5140-6343c-2.html
-    - https://www.twcert.org.tw/tw/cp-132-5127-3cbd3-1.html
-    - https://github.com/ARPSyndicate/cvemon
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2021-41291
-    cwe-id: CWE-22
-    epss-score: 0.02626
-    epss-percentile: 0.90324
-    cpe: cpe:2.3:o:ecoa:ecs_router_controller-ecs_firmware:-:*:*:*:*:*:*:*
-  metadata:
-    max-request: 1
-    vendor: ecoa
-    product: ecs_router_controller-ecs_firmware
-  tags: cve,cve2021,ecoa,lfi,traversal
-
-http:
-  - raw:
-      - |
-        GET /fmangersub?cpath=../../../../../../../etc/passwd HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: regex
-        regex:
-          - "root:.*:0:0:"
-```
-
-=== code/windows/audit/minimum-password-age-zero.yaml ===
-```
-id: minimum-password-age-zero
-
-info:
-  name: Minimum Password Age Set to Zero
-  author: princechaddha
-  severity: medium
-  description: Checks if the minimum password age is set to zero, allowing immediate password changes and potential reuse.
-  impact: |
-    Allowing a password age of zero may lead to the rapid reuse of weak passwords, reducing account security.
-  remediation: |
-    Set a reasonable minimum password age to prevent users from reusing old passwords frequently.
-  tags: windows,password,policy,code,windows-audit
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - cmd
-    args:
-      - /c
-    pattern: "*.cmd"
-    source: |
-      net accounts
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "Minimum password age (days):                          0"
-        negative: true
-
-      - type: word
-        words:
-          - "Minimum password age"
-```
-
-=== cloud/azure/postgresql/azure-postgresql-storage-autogrow-disabled.yaml ===
-```
-id: azure-postgresql-storage-autogrow-disabled
-info:
-  name: Azure PostgreSQL Storage Auto-Growth Disabled
-  author: princechaddha
-  severity: high
-  description: |
-    Ensure that Storage Auto-Growth feature is enabled for your production Azure PostgreSQL database servers. Storage auto-growth prevents your PostgreSQL servers from running out of storage and becoming read-only.
-  impact: |
-    Failing to enable Storage Auto-Growth can lead to PostgreSQL servers running out of space, becoming read-only, and disrupting database services.
-  remediation: |
-    Enable the Storage Auto-Growth feature on your Azure PostgreSQL servers to prevent potential disruptions and ensure continuous database operation.
-  reference:
-    - https://docs.microsoft.com/en-us/azure/postgresql/concepts-storage
-  tags: cloud,devops,azure,microsoft,postgresql,azure-cloud-config
-
-flow: |
-  code(1);
-  for (let ServerData of iterate(template.serverList)) {
-    ServerData = JSON.parse(ServerData);
-    set("name", ServerData.Name);
-    set("resourceGroup", ServerData.ResourceGroup);
-    code(2);
-  }
-
-self-contained: true
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      az postgres server list --output json --query '[*].{"Name":name,"ResourceGroup":resourceGroup}'
-
-    extractors:
-      - type: json
-        name: serverList
-        internal: true
-        json:
-          - '.[]'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      az postgres server show --name "$name" --resource-group "$resourceGroup" --output json --query 'storageProfile.storageAutogrow'
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '"Disabled"'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'name + " in " + resourceGroup + " has Storage Auto-Growth disabled"'
-```
-
-=== ssl/c2/gozi-malware-c2.yaml ===
-```
-id: gozi-malware-c2
-
-info:
-  name: Gozi Malware C2 - Detect
-  author: pussycat0x
-  severity: info
-  description: |
-    Gozi is a banking Trojan that has been modified to include new obfuscation techniques, to evade detection. Previous breaches involving Gozi in the healthcare sector led to the compromise of data associated with 3.7 million patients costing $5.55 million.
-  reference: |
-    https://github.com/thehappydinoa/awesome-censys-queries#gozi-malware--
-  metadata:
-    verified: "true"
-    max-request: 1
-    censys-query: 'services.tls.certificates.leaf_data.issuer_dn: "C=XX, ST=1, L=1, O=1, OU=1, CN=\*"'
-  tags: ssl,tls,c2,ir,osint,malware,gozi
-ssl:
-  - address: "{{Host}}:{{Port}}"
-    matchers:
-      - type: word
-        part: issuer_dn
-        words:
-          - "CN=*, OU=1, O=1, L=1, ST=1, C=XX"
-
-    extractors:
-      - type: json
-        json:
-          - ".issuer_dn"
-```
-
-=== dns/mx-fingerprint.yaml ===
-```
-id: mx-fingerprint
-
-info:
-  name: MX Record Detection
-  author: pdteam
-  severity: info
-  description: An MX record was detected. MX records direct emails to a mail exchange server.
-  reference:
-    - https://www.cloudflare.com/learning/dns/dns-records/dns-mx-record/
-    - https://mxtoolbox.com/
-  classification:
-    cwe-id: CWE-200
-  metadata:
-    max-request: 1
-  tags: dns,mx
-
-dns:
-  - name: "{{FQDN}}"
-    type: MX
-    matchers:
-      - type: regex
-        part: answer
-        regex:
-          - "IN\tMX\\t(.+)$"
-
-    extractors:
-      - type: regex
-        group: 1
-        regex:
-          - "IN\tMX\t(.+)"
-```
-
-=== file/malware/shimrat-malware.yaml ===
-```
-id: shimrat-malware
-
-info:
-  name: ShimRat Malware - Detect
-  author: daffainfo
-  severity: info
-  reference: https://github.com/Yara-Rules/rules/blob/master/malware/RAT_Shim.yar
-  tags: malware,file
-file:
-  - extensions:
-      - all
-
-    matchers-condition: or
-    matchers:
-      - type: word
-        part: raw
-        words:
-          - ".dll"
-          - ".dat"
-          - "QWERTYUIOPLKJHG"
-          - "MNBVCXZLKJHGFDS"
-        condition: and
-
-      - type: word
-        part: raw
-        words:
-          - "Data$$00"
-          - "Data$$01%c%sData"
-        condition: and
-
-      - type: word
-        part: raw
-        words:
-          - "ping localhost -n 9 /c %s > nul"
-          - "Demo"
-          - "Win32App"
-          - "COMSPEC"
-          - "ShimMain"
-          - "NotifyShims"
-          - "GetHookAPIs"
-        condition: and
-```
-
-=== network/c2/7777botnet.yaml ===
-```
-id: 7777botnet-detect
-
-info:
-  name: 7777-Botnet - Detect
-  author: johnk3r
-  severity: info
-  reference:
-    - https://gi7w0rm.medium.com/the-curious-case-of-the-7777-botnet-86e3464c3ffd
-  metadata:
-    verified: true
-    max-request: 1
-    shodan-query: 'hash:1357418825'
-  tags: network,c2,ir,osint,cti,darktrack,botnet,tcp
-
-tcp:
-  - inputs:
-      - data: "fffc01fffb1ffffa1f00500018fff0fffd01fffd03"
-        read: 2048
-
-    host:
-      - "{{Hostname}}"
-    port: 7777
-
-    matchers:
-      - type: word
-        part: data
-        words:
-          - "xlog"
-          - "in"
-        condition: and
-```
-
-### Instructions for Comments
-
-Think step by step and structure your comments in two sections using GitHub Markdown:
-- Required Fixes – List missing or incorrect elements as a checklist (e.g., - [ ] Fix template ID to match filename).
-- Other Suggestions – Provide contextual recommendations, but only include suggestions you are 100% confident about.

CONTRIBUTING.md

@@ -1,71 +1,26 @@
-# Nuclei Contribution Guide
-Templates are the core of the [nuclei scanner](https://github.com/projectdiscovery/nuclei) which powers the actual scanning engine. The Nuclei Templates repository stores and houses various templates for a variety of protocols, including TCP, DNS, HTTP, SSL, File, Whois, Websocket, Headless etc. for the scanner provided by our team, as well as contributed by the community.
+# Template Contribution Guidelines
 
-We have over **9000+** templates contributed by **more than 800** security researchers and engineers. We hope that you contribute by sending templates via **pull requests** or [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) to grow the list. By contributing, you won't only help the community **❤️** but can also gain experience, increase community and peer recognition, improving your job prospects
+This documentation contains a set of guidelines to help you during the contribution process. 
+We are happy to welcome all the contributions from anyone willing to **improve/add** new **templates** to this project. 
+Thank you for helping out and remember, **no contribution is too small.**
 
-This documentation contains a set of guidelines to help you during the contribution process. We are happy to welcome all the contributions from anyone willing to **improve/add** new **templates** to this project. Thank you for helping out and remember, **no contribution is too small.**
+# Submitting Nuclei Templates 👩‍💻👨‍💻
 
-## **How Can I Contribute?**
+Below you will find the process and workflow used to review and merge your changes.
 
-- [Submitting Nuclei Templates](#Submitting-Nuclei-Templates)
-- [Reporting False Negative Template](#Reporting-False-Positive-Template)
-- [Reporting False Positive Template](#Reporting-False-Positive-Template)
-- [Enhancing existing templates](#Enhancing-existing-templates)
-- [Reporting Invalid templates](#Reporting-Invalid-templates)
-- [Request Template](#Request-Template)
-- [Sharing idea / feature for nuclei-templates](#Sharing-idea-/-feature-for-nuclei-templates)
+## Step 1 : Find existing templates
 
-### **Submitting Nuclei Templates**
+- Take a look at the [Existing Templates](https://github.com/projectdiscovery/nuclei-templates) before creating new one.
+- Take a look at Existing Templates in [GitHub Issues](https://github.com/projectdiscovery/nuclei-templates/issues) and [Pull Request](https://github.com/projectdiscovery/nuclei-templates/pulls) section to avoid duplicate work.
+- Take a look at [Templates](https://nuclei.projectdiscovery.io/templating-guide/) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers) Guideline for creating new template.
 
-**Before Submitting an Issue or Pull Request**
+## Step 2 : Fork the Project
 
-- Take a look at the [Existing Templates](https://github.com/projectdiscovery/nuclei-templates) or search for endpoints before creating new one.
-- Take a look at Existing Templates in [GitHub Issues](https://github.com/projectdiscovery/nuclei-templates/issues) and [Pull Request](https://github.com/projectdiscovery/nuclei-templates/pulls) section to avoid duplicate work.
-- Take a look at [Templates](https://nuclei.projectdiscovery.io/templating-guide/) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers) Guideline for creating new template.
+- Fork this Repository. This will create a Local Copy of this Repository on your Github Profile. Keep a reference to the original project in `upstream` remote.
 
-Along with the P.O.C following are the required fields in the info section for submitting new template.
-
-1. `id`: It should be short ideally max of 3-4 words. For example `grafana-unauth-rce`
-2. `name` : The name should be short in this format `<Vendor> <Product> <Version> - <Vulnerability>` 
-3. `author`: It can be your github/twitter username or alias. You can also create a PR to add more details associated with the author name here (https://github.com/projectdiscovery/nuclei-templates/blob/main/contributors.json)
-4. `severity` : Based on the CVSS score but can vary based on the exploit and real-world impact
-5. `description` : Short description of the vulnerability
-6. `reference` : Please provide the reference to the POC, setup guide or the product details to help the team verify the template.
-
-**Do’s**
-
-- If you have verified the template, mark it as `verified: true` under metadata field and share the debug data using `-debug` flag after redacting the vulnerable server information in the PR
-- Make sure to add more than one matcher to prevent false positive results. Avoid short word that could be encountered anywhere
-- If possible submit the vulnerable environment based on docker-compose. For example: https://github.com/vulhub/vulhub.
-- We only accept templates with complete P.O.Cs instead of just detection based on version
-
-**Don’t**
-
-- Don’t not share any real world target on the PR. If you have setup an vulnerable environment please share it privately on Discord with the team to easily validate the template.
-- Avoid submitting templates with weak matchers. For example: Adding GET/POST data as the matchers in the template, as it can result in false positive results on few hosts
-- Don’t make unnecessary changes to the existing templates like adding more requests to the templates when the existing requests or paths are good enough to verify that the bug exists
-- Try to keep the requests per template as low as possible
-
-**Best Practices**
-
-- Make sure to add the template in the appropriate directory.
-- Add part with the matchers. For example if the matcher is in response body add `part:` body
-- Use `cmd` variable for RCE templates so that they are unified throughout the repo
-- Use `{{username}}` and `{{password}}` variables in all authenticated templates
-- Use `{{token}}` variable in all the template that deals with keys or tokens
-- If there are more than 1 template for a tech create a separate folder for it
-- Don't share any vulnerable URL publicly on Github or Discord channel.
-- We should only upload a web shell as a last resort to validate the vulnerability, and if we do upload a file, make sure the file name is random(`{{randstr}}`)
-- Do not include code templates for exploits that can be written using HTTP or JavaScript. We avoid adding additional exploit code to the project unless there is an exception.
-
-### **Submitting a PR**
-
-**Fork the Project**
-
-- This will create a Local Copy of this Repository on your Github Profile. Keep a reference to the original project in `upstream` remote.
 <img width="928" alt="template-fork" src="https://user-images.githubusercontent.com/8293321/124467966-2afde200-ddb6-11eb-835f-8f8fc2fabedb.png">
 
-```jsx
+```sh
 git clone https://github.com/<your-username>/nuclei-templates
 cd nuclei-templates
 git remote add upstream https://github.com/projectdiscovery/nuclei-templates
@@ -73,132 +28,73 @@ git remote add upstream https://github.com/projectdiscovery/nuclei-templates
 
 - If you have already forked the project, update your copy before working.
 
-```jsx
+```sh
 git remote update
 git checkout main
 git rebase upstream/main
 ```
 
-**Create your Template Branch**
+## Step 3 : Create your Template Branch
 
-- Create a new branch. Use its name to identify the issue your addressing.
+Create a new branch. Use its name to identify the issue your addressing.
 
-```jsx
+```sh
 # It will create a new branch with name template_branch_name and switch to that branch
 git checkout -b template_branch_name
 ```
 
-**Create Template and Commit**
-
+## Step 4 : Create Template and Commit
 - Create your template.
 - Add all the files/folders needed.
 - After you've made changes or completed template creation, add changes to the branch you've just created by:
 
-```jsx
+```sh
 # To add all new files to branch template_branch_name
 git add .
 ```
 
 - To commit, give a descriptive message for the convenience of the reviewer by:
 
-```jsx
+```sh
 # This message get associated with all files you have changed
 git commit -m "Added/Fixed/Updated XXX Template"
 ```
 
 **NOTE**:
 
-- Try to add only one templates per Pull Request as it will make it simple for us to review and the PR will not be blocked because of one of the templates
-- Multiple templates for same technology can be grouped into single Pull Request.
+- A Pull Request should have only one unique template to make it simple for review.
+- Multiple templates for same technology can be grouped into single Pull Request. 
 
-**Push Your Changes**
+
+## Step 5 : Push Your Changes
 
 - Now you are ready to push your template to the remote (forked) repository.
 - When your work is ready and complies with the project conventions, upload your changes to your fork:
 
-```jsx
+```sh
 # To push your work to your remote repository
 git push -u origin template_branch_name
 ```
 
-**Pull Request**
+## Step 6 : Pull Request
 
 - Fire up your favorite browser, navigate to your GitHub repository, then click on the New pull request button within the Pull requests tab. Provide a meaningful name and description to your pull request, that describes the purpose of the template.
 - Voila! Your Pull Request has been submitted. It will be reviewed and merged by the moderators, if it complies with project standards, otherwise a feedback will be provided.🥳
 
-### Reporting [False Negative Template](https://github.com/projectdiscovery/nuclei-templates/issues/new?template=false-negative.yml)
+## Need more help?🤔
 
-You can contribute to the project by creating issue/PR for templates which are missing valid/expected result.
+You can refer to the following articles of Git and GitHub basics. In case you are stuck, feel free to contact the Project Mentors and Community by joining [PD Community](https://discord.gg/projectdiscovery) Discord server.
 
-- Share you nuclei version and the path of the template
-- Share the `-debug` data for the host where the template is not matching the vulnerable target
-- If possible share the improved or valid matchers, references and the information to setup vulnerable environment.
+- [Forking a Repo](https://help.github.com/en/github/getting-started-with-github/fork-a-repo)
+- [Cloning a Repo](https://help.github.com/en/desktop/contributing-to-projects/creating-an-issue-or-pull-request)
+- [How to create a Pull Request](https://opensource.com/article/19/7/create-pull-request-github)
+- [Getting started with Git and GitHub](https://towardsdatascience.com/getting-started-with-git-and-github-6fcd0f2d4ac6)
+- [Learn GitHub from Scratch](https://lab.github.com/githubtraining/introduction-to-github)
 
-> Note: If host information can not be shared publicly, please reach out to us on discord server in DM.
-> 
 
-**Creating a [False negative issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?template=false-negative.yml) or Submit a PR**
+## Tip from us😇
 
-- Click on the Issues Tab and then click on `new issue.`
-- Click on `get started` in front of **`False Negative`**
-
-### Reporting [False Positive Template](https://github.com/projectdiscovery/nuclei-templates/issues/new?template=false-positive.yml)
-
-You can contribute to the project by creating issue/PR for templates which are producing invalid/unexpected result.
-
-- Share you nuclei version and the path of the template
-- Share the `-debug` data and if possible the host where the template is matching the non-vulnerable target and producing invalid/unexpected result.
-- If possible share the improved or valid matchers and reference to the vulnerability.
-
-**Creating a [False positive issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?template=false-positive.yml) or Submit a PR**
-
-- Click on the Issues Tab and then click on `new issue.`
-- Click on `get started` in front of **`False Positive`**
-
-### Enhancing existing templates
-
-You can contribute to the project by creating issue/PR for enhancement of nuclei-templates repository which includes changing directory structure, adding new categories or fields to the templates etc
-
-Share the reason or requirement for the enhancement and how can it improve the overall quality of the template(s).
-
-**Creating a Issue for Suggesting Enhancements or Submit a PR**
-
-- Click on the Issues Tab and then click on `new issue`
-- Click on `get started` in front of `Enhancement request`
-
-### Reporting Invalid templates
-
-If you have encountered some invalid template or any template in the repo resulting in unexpected errors then please report it as invalid template. Make sure to provide the following info:
-
-- Share you nuclei version and the path of the template
-- Share the screenshot with the error and the  `-verbose` output and if applicable also provide the debug data using `-debug` flag
-- If this is specific to one environment and the bug don’t exist on the other setup please provide the OS and details your setup
-
-**Creating a Issue for reporting Invalid template**
-
-- Click on the Issues Tab and then click on `new issue`
-- Click on `get started` in front of `Report Issue`
-
-### Request Template
-
-If you have a reference to the POC of any vulnerbaility or new CVE. You can create an issue to template the template and the team will create one. Make sure to provide the following info:
-
-- Reference to the vulnerability with the complete P.O.C
-- If possible share the vulnerable docker image or steps to setup vulnerable environment
-
-> Note: If have setup the vulnerable environment. You can share the host with the team on discord server in DM.
-> 
-
-**Creating a Issue for requesting nuclei template**
-
-- Click on the Issues Tab and then click on `new issue`
-- Click on `get started` in front of `Request Template`
-
-### Sharing idea / feature for nuclei-templates
-
-If you have any ideas or want to request a feature for nuclei-templates you can do so by creating a new discussion.
-
-**Creating a Discussion for sharing idea / feature**
-
-- Click on the Issues Tab and then click on `new issue`
-- Click on `open` in front of `Share idea / feature to discuss for nuclei-templates`
+- **Nuclei** outcomes are only as excellent as **template matchers💡**
+- Declare at least two matchers to reduce false positive
+- Avoid matching words reflected in the URL to reduce false positive
+- Avoid short word that could be encountered anywhere

Community-Rewards-FAQ.md

@@ -1,76 +0,0 @@
-# Nuclei Templates Community Rewards Program - FAQ
-
-## What is the purpose of this rewards program?
-The program is designed to reward the community for their efforts in contributing high-quality templates for critical and trending vulnerabilities.
-
-## What are the bounty ranges for template submissions?
-Bounties range from **$50 to $250**, depending on the complexity of the template and the effort required.
-
-## Where can I find bounty issues?
-Only issues listed by us on our GitHub repository with the 💎 **Bounty** label are eligible for rewards. You can find these bounty issues [here](https://github.com/projectdiscovery/nuclei-templates/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22%F0%9F%92%8E%20Bounty%22)
-
-## What is the acceptance criteria for templates?
-Templates must meet the following criteria:
-1. **Complete POC**: A full Proof of Concept (POC) must be provided and not rely solely on version detection.
-2. **Debug Data**: Include debug data to assist with template validation.
-3. **Validation Required**: The template will be reviewed and validated before rewards are given.
-4. **Accurate Matchers**: Use strong matchers to avoid false positives.
-> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined.
-
-## How do I start working on a bounty issue?
-1. **Find an Issue**: Look for issues tagged with 💎 **Bounty**.
-2. **Declare Work**: Comment with `/attempt #<issue_number>` to claim the issue.
-3. **Submit Work**: Submit your pull request with `/claim #<issue_number>` in the PR description when ready.
-
-## How often are new bounty issues added?
-We add new bounty issues on a **weekly basis**, so make sure to check back regularly for fresh opportunities. In the future, you can expect many more bounty issues as the program expands, allowing more opportunities for contributors to participate and earn rewards.
-
-## Can I collaborate with others?
-Yes, you can collaborate with other contributors and split rewards by commenting:
-```
-/claim #<issue_number>
-/split @contributor1
-/split @contributor2
-```
-
-## Is there a limit to how many issues I can work on?
-You can work on up to **3 issues** simultaneously.
-
-## What happens if I don’t complete an issue on time?
-Issues must be completed within **2 months**, or they will be closed.
-
-## How are rewards distributed?
-Rewards are distributed once the template is fully validated. If the issue remains unresolved for **few weeks**, the bounty may increase.
-
-## What should I include in my template submission?
-Include the following:
-> Avoid adding code templates for CVEs that can be achieved using HTTP, TCP, or JavaScript. Such templates are blocked by default and won’t produce results, so we prioritize creating templates with other protocols unless exceptions are made.
-- **Complete POC**: A working Proof of Concept.
-- **Matchers**: Multiple matchers to prevent false positives.
-- **Debug Data**: Data to assist the triage team in validation.
-- **Metadata**: Include required fields like `id`, `name`, `author`, `severity`, `description`, and `reference`.
-
-## What types of templates will be rejected?
-Templates may be rejected if they:
-- Rely solely on version detection.
-- Lack a complete POC.
-- Contain weak matchers or redundant changes to existing templates.
-
-## What should I avoid when submitting a template?
-- Avoid sharing real-world targets publicly.
-- Don’t submit templates with weak matchers.
-- Avoid unnecessary changes to existing templates.
-
-## Is there a leaderboard for contributors?
-Yes! We now have a **leaderboard** that showcases top contributors. You can check it out here: [Leaderboard](https://cloud.projectdiscovery.io/templates/leaderboard).
-
-## Is this program permanent?
-The rewards program is currently a test run, but we may make changes based on community feedback.
-
-## What additional rewards are available besides bounties?
-Beyond bounties, we also reward contributors with:
-- **Swag** such as t-shirts and stickers.
-- **Invites to security conferences** for standout contributors.
-- **Stickers** as a token of appreciation for all first-time contributors, regardless of the bounty.
-
-> Contributors who feel their pull request or issue was overlooked for first-time contributor stickers can ping us on our Discord for assistance: [ProjectDiscovery Discord](https://discord.com/invite/projectdiscovery).

LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 ProjectDiscovery, Inc.
+Copyright (c) 2020 ProjectDiscovery, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3225 | dhiyaneshdk   |  1866 | http       |  8825 | info     |  4118 | file |   435 |
-| panel     |  1327 | daffainfo     |   868 | cloud      |   657 | high     |  2423 | dns  |    26 |
-| xss       |  1246 | dwisiswant0   |   806 | file       |   435 | medium   |  2339 |      |       |
-| wordpress |  1168 | princechaddha |   806 | dast       |   255 | critical |  1391 |      |       |
-| exposure  |  1094 | ritikchaddha  |   633 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1023 | pussycat0x    |   519 | code       |   174 | unknown  |    54 |      |       |
-| osint     |   810 | pikpikcu      |   352 | network    |   141 |          |       |      |       |
-| tech      |   782 | pdteam        |   308 | javascript |    71 |          |       |      |       |
-| lfi       |   772 | pdresearch    |   251 | ssl        |    38 |          |       |      |       |
-| rce       |   770 | ricardomaia   |   249 | dns        |    23 |          |       |      |       |
+| cve       |  2571 | dhiyaneshdk   |  1351 | http       |  7663 | info     |  3789 | file |   402 |
+| panel     |  1167 | daffainfo     |   864 | file       |   402 | high     |  1816 | dns  |    25 |
+| wordpress |  1002 | dwisiswant0   |   803 | workflows  |   191 | medium   |  1578 |      |       |
+| exposure  |   968 | pussycat0x    |   439 | network    |   135 | critical |  1071 |      |       |
+| xss       |   917 | ritikchaddha  |   380 | cloud      |   134 | low      |   271 |      |       |
+| wp-plugin |   872 | pikpikcu      |   353 | code       |    81 | unknown  |    40 |      |       |
+| osint     |   804 | princechaddha |   303 | javascript |    61 |          |       |      |       |
+| tech      |   698 | pdteam        |   297 | ssl        |    29 |          |       |      |       |
+| lfi       |   678 | ricardomaia   |   239 | dast       |    25 |          |       |      |       |
+| misconfig |   673 | geeknik       |   231 | dns        |    22 |          |       |      |       |
 
-**840 directories, 11171 files**.
+**663 directories, 9059 files**.
 
 </td>
 </tr>

README_CN.md

@@ -1,99 +0,0 @@
-
-
-<h1 align="center">
-Nuclei 模板
-</h1>
-<div align="center">
-<a href="README.md">English</a> |
-<a href="README_CN.md">简体中文</a> |
-<a href="README_JA.md">日本語</a> |
-<a href="README_KR.md">한국어</a>
-</div>
-<h4 align="center">这个仓库用于存放由社区精心挑选的模板,可以使用nuclei引擎结合模板发现应用中的漏洞。</h4>
-
-
-<p align="center">
-<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
-<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
-<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
-<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
-</p>
-
-<p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">文档</a> •
-  <a href="#-贡献">贡献</a> •
-  <a href="#-交流">交流</a> •
-  <a href="#-社区">社区</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
-  <a href="https://discord.gg/projectdiscovery">加入Discord</a>
-</p>
-
-----
-
-模板是 [nuclei 扫描器](https://github.com/projectdiscovery/nuclei) 的核心.
-这个git仓库储存了由PD团队以及社区贡献的各种扫描模板.
-我们希望您也能攻通过 **pull requests** 或者[Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)来提交模板以扩大我们的仓库列表.
-
-
-## Nuclei模板项目情况概述
-
-
-以下是nuclei模板项目的情况概览,包括唯一标签,作者,目录,严重性,模板类型的相关统计情况.以下表格列出了前面提到的每项情况的TOP10信息;你也可以点击[这里](TEMPLATES-STATS.md)查看详细信息.当然你也可以点击[这里](TEMPLATES-STATS.json)获取JSON格式的详细情况统计
-
-<table>
-<tr>
-<td> 
-
-## Nuclei模板TOP10统计信息
-
-|    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
-|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  2877 | dhiyaneshdk   |  1477 | http       |  8219 | info     |  3948 | file |   404 |
-| panel     |  1246 | daffainfo     |   866 | file       |   404 | high     |  2135 | dns  |    25 |
-| wordpress |  1072 | dwisiswant0   |   803 | cloud      |   370 | medium   |  1840 |      |       |
-| exposure  |  1006 | princechaddha |   570 | workflows  |   192 | critical |  1197 |      |       |
-| xss       |   987 | ritikchaddha  |   496 | code       |   157 | low      |   287 |      |       |
-| wp-plugin |   936 | pussycat0x    |   453 | network    |   138 | unknown  |    43 |      |       |
-| osint     |   807 | pikpikcu      |   353 | javascript |    65 |          |       |      |       |
-| tech      |   745 | pdteam        |   302 | ssl        |    30 |          |       |      |       |
-| lfi       |   727 | ricardomaia   |   245 | dast       |    26 |          |       |      |       |
-| misconfig |   720 | geeknik       |   231 | dns        |    22 |          |       |      |       |
-
-**743 directories, 9960 files**.
-
-</td>
-</tr>
-</table>
-
-📖 文档
------
-
-详细的文档请访问我们的网站[https://nuclei.projectdiscovery.io](https://nuclei.projectdiscovery.io),在我们网站的详细文档中,我们提供了如何创建模板的具体方法,并且也提供了相应的示例模板来帮助您更好地理解模板的开发以及运行原理.
-
-💪 贡献
------
-
-社区是Nuclei模板项目的主要贡献主力,我们非常欢迎开发者们来贡献模板,提出需求和报告Bug.
-
-![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
-
-💬 交流
------
-
-如果您有任何关于该项目的疑问或是新奇的点子,欢迎在[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions)创建新的板块来进行讨论.
-
-👨‍💻 社区
------
-
-欢迎您加入我们的[Discord 社区](https://discord.gg/projectdiscovery)，与项目维护人员直接讨论，或与其他人分享有关安全和自动化的想法。
-此外，您还可以在 [Twitter](https://twitter.com/pdnuclei) 上关注我们，了解 Nuclei 的最新动态。
-
-
-<p align="center">
-<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
-  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
-</a>
-</p>
-
-
-最后,感谢您对这个项目的贡献,这将让我们的社区更加充满活力.

README_JA.md

@@ -1,94 +0,0 @@
-<h1 align="center">
-Nuclei テンプレート
-</h1>
-<h4 align="center">アプリケーションのセキュリティ脆弱性を発見するためのNucleiエンジン用テンプレートのコミュニティキュレーションリスト</h4>
-
-<p align="center">
-<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
-<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
-<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
-<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
-</p>
-      
-<p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">ドキュメント</a> •
-  <a href="#-contributions">貢献</a> •
-  <a href="#-discussion">ディスカッション</a> •
-  <a href="#-community">コミュニティ</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
-  <a href="https://discord.gg/projectdiscovery">Discordに参加</a>
-</p>
-
-<p align="center">
-  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README.md">English</a> •
-  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_KR.md">한국어</a> •
-  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_JP.md">日本語</a>
-</p>
-
-----
-
-テンプレートは、実際のスキャンエンジンを動作させる[nucleiスキャナー](https://github.com/projectdiscovery/nuclei)のコアです。
-このリポジトリは、私たちのチームが提供するテンプレートや、コミュニティからの貢献によるさまざまなテンプレートを保存・管理します。
-テンプレートのリストを増やすために、**プルリクエスト**や[Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)を通じて貢献していただけると幸いです。
-
-## Nuclei テンプレートの概要
-
-Nucleiテンプレートプロジェクトの概要であり、ユニークなタグ、著者、ディレクトリ、重大度、テンプレートの種類に関する統計を含みます。以下の表は、各マトリックスのトップ10の統計を示しています。拡張バージョンは[こちら](TEMPLATES-STATS.md)で確認でき、[JSON](TEMPLATES-STATS.json)形式でも利用可能です。
-
-<table>
-<tr>
-<td> 
-
-## Nuclei テンプレート トップ10統計
-
-|    タグ    | 数   |    著者       | 数   |    ディレクトリ  | 数   | 重大度 | 数   |  種類   | 数   |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1325 | daffainfo     |   629 | cves             |  1306 | info     |  1398 | http    |  3644 |
-| panel     |   604 | dhiyaneshdk   |   509 | exposed-panels   |   613 | high     |   955 | file    |    76 |
-| lfi       |   490 | pikpikcu      |   322 | vulnerabilities  |   506 | medium   |   784 | network |    50 |
-| xss       |   451 | pdteam        |   269 | technologies     |   273 | critical |   445 | dns     |    17 |
-| wordpress |   409 | geeknik       |   187 | exposures        |   254 | low      |   211 |         |       |
-| exposure  |   360 | dwisiswant0   |   169 | token-spray      |   230 | unknown  |     7 |         |       |
-| cve2021   |   324 | 0x_akoko      |   157 | misconfiguration |   210 |          |       |         |       |
-| rce       |   319 | princechaddha |   149 | workflows        |   187 |          |       |         |       |
-| wp-plugin |   304 | pussycat0x    |   130 | default-logins   |   102 |          |       |         |       |
-| tech      |   286 | gy741         |   126 | file             |    76 |          |       |         |       |
-
-**286個のディレクトリ、4012個のファイル**。
-
-</td>
-</tr>
-</table>
-
-📖 ドキュメント
------
-
-新しいテンプレートやカスタムテンプレートを作成するための詳細なドキュメントは、https://nuclei.projectdiscovery.io で確認できます。作業方法を理解するためのテンプレートも用意しています。
-
-💪 貢献
------
-
-Nucleiテンプレートはコミュニティの貢献によって動作します。
-[テンプレートの貢献](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)、[機能リクエスト](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+)、[バグ報告](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+)はいつでも歓迎します。
-
-![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
-
-💬 ディスカッション
------
-
-質問、疑問、アイデアを話し合いたいですか？
-[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions)で自由に始めることができます。
-
-👨‍💻 コミュニティ
------
-
-プロジェクトの管理者と直接話し合い、セキュリティや自動化に関することを他の人と共有するために、[Discord Community](https://discord.gg/projectdiscovery)に参加することを歓迎します。さらに、Nucleiに関するすべての情報を更新するために、[Twitter](https://twitter.com/pdnuclei)をフォローすることもできます。
-
-<p align="center">
-<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
-  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
-</a>
-</p>
-
-皆さんの貢献とコミュニティの活性化への努力に感謝します。
-:heart:

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3225},{"name":"panel","count":1327},{"name":"xss","count":1246},{"name":"wordpress","count":1168},{"name":"exposure","count":1094},{"name":"wp-plugin","count":1023},{"name":"osint","count":810},{"name":"tech","count":782},{"name":"lfi","count":772},{"name":"rce","count":770},{"name":"misconfig","count":747},{"name":"devops","count":738},{"name":"cloud","count":697},{"name":"edb","count":599},{"name":"wp","count":573},{"name":"packetstorm","count":552},{"name":"wpscan","count":534},{"name":"cve2021","count":513},{"name":"cve2022","count":512},{"name":"cve2023","count":488},{"name":"detect","count":486},{"name":"sqli","count":484},{"name":"cve2024","count":462},{"name":"login","count":446},{"name":"unauth","count":431},{"name":"authenticated","count":422},{"name":"kev","count":405},{"name":"intrusive","count":398},{"name":"file","count":377},{"name":"oast","count":276},{"name":"default-login","count":275},{"name":"cve2020","count":274},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":241},{"name":"microsoft","count":238},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":216},{"name":"malware","count":213},{"name":"token","count":211},{"name":"osint-social","count":210},{"name":"azure","count":210},{"name":"csp-bypass","count":204},{"name":"","count":204},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"iot","count":184},{"name":"cve2018","count":184},{"name":"auth-bypass","count":183},{"name":"cve2019","count":182},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"code","count":157},{"name":"keys","count":156},{"name":"redirect","count":156},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"ssrf","count":144},{"name":"tcp","count":139},{"name":"security","count":133},{"name":"router","count":130},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":119},{"name":"phishing","count":117},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"cve2025","count":94},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":83},{"name":"takeover","count":81},{"name":"privesc","count":81},{"name":"local","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":78},{"name":"js","count":75},{"name":"windows","count":74},{"name":"cisco","count":73},{"name":"enum","count":72},{"name":"k8s","count":71},{"name":"windows-audit","count":70},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"cve2016","count":60},{"name":"file-upload","count":59},{"name":"detection","count":59},{"name":"atlassian","count":59},{"name":"google","count":57},{"name":"c2","count":57},{"name":"vmware","count":57},{"name":"audit","count":55},{"name":"deserialization","count":53},{"name":"dast","count":51},{"name":"cve2014","count":50},{"name":"php","count":50},{"name":"logs","count":50},{"name":"traversal","count":48},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"ssh","count":47},{"name":"generic","count":47},{"name":"debug","count":47},{"name":"vulhub","count":46},{"name":"misc","count":46},{"name":"ssti","count":46},{"name":"cnvd","count":46},{"name":"aem","count":46},{"name":"osint-gaming","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"jndi","count":44},{"name":"plugin","count":44},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"oa","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"fortinet","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":40},{"name":"miscellaneous","count":39},{"name":"dlink","count":39},{"name":"info-leak","count":39},{"name":"postgresql","count":39},{"name":"sap","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"cti","count":37},{"name":"api","count":37},{"name":"wp-theme","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"networking","count":34},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"lfr","count":34},{"name":"xxe","count":33},{"name":"fuzz","count":33},{"name":"dns","count":32},{"name":"nginx","count":31},{"name":"vpc","count":31},{"name":"printer","count":31},{"name":"osint-tech","count":31},{"name":"osint-coding","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"ec2","count":30},{"name":"admin","count":29},{"name":"gke","count":29},{"name":"prestashop","count":29},{"name":"tomcat","count":28},{"name":"proxy","count":28},{"namLine truncated
+{"tags":[{"name":"cve","count":2571},{"name":"panel","count":1167},{"name":"wordpress","count":1002},{"name":"exposure","count":968},{"name":"xss","count":917},{"name":"wp-plugin","count":872},{"name":"osint","count":804},{"name":"tech","count":698},{"name":"lfi","count":678},{"name":"misconfig","count":673},{"name":"rce","count":616},{"name":"edb","count":597},{"name":"packetstorm","count":546},{"name":"wpscan","count":506},{"name":"cve2021","count":493},{"name":"cve2022","count":472},{"name":"wp","count":435},{"name":"cve2023","count":393},{"name":"sqli","count":370},{"name":"unauth","count":370},{"name":"file","count":345},{"name":"authenticated","count":344},{"name":"detect","count":313},{"name":"intrusive","count":312},{"name":"login","count":299},{"name":"kev","count":277},{"name":"cve2020","count":256},{"name":"token-spray","count":243},{"name":"config","count":224},{"name":"oast","count":223},{"name":"top-200","count":222},{"name":"default-login","count":222},{"name":"devops","count":212},{"name":"osint-social","count":210},{"name":"malware","count":209},{"name":"apache","count":198},{"name":"network","count":197},{"name":"token","count":194},{"name":"","count":191},{"name":"cve2018","count":170},{"name":"cloud","count":169},{"name":"iot","count":167},{"name":"cve2019","count":163},{"name":"keys","count":156},{"name":"install","count":151},{"name":"joomla","count":148},{"name":"redirect","count":138},{"name":"tcp","count":137},{"name":"aws","count":135},{"name":"cve2024","count":134},{"name":"auth-bypass","count":133},{"name":"ssrf","count":120},{"name":"amazon","count":118},{"name":"phishing","count":117},{"name":"cms","count":115},{"name":"files","count":113},{"name":"cve2010","count":112},{"name":"cve2017","count":110},{"name":"router","count":108},{"name":"top-100","count":100},{"name":"aws-cloud-config","count":91},{"name":"disclosure","count":89},{"name":"linux","count":85},{"name":"code","count":81},{"name":"local","count":80},{"name":"privesc","count":79},{"name":"seclists","count":79},{"name":"tokens","count":78},{"name":"takeover","count":78},{"name":"fileupload","count":76},{"name":"oracle","count":74},{"name":"kubernetes","count":71},{"name":"oss","count":69},{"name":"js","count":68},{"name":"cisco","count":67},{"name":"enum","count":65},{"name":"adobe","count":64},{"name":"k8s","count":62},{"name":"ir","count":61},{"name":"huntr","count":60},{"name":"cve2015","count":59},{"name":"atlassian","count":59},{"name":"detection","count":57},{"name":"cve2016","count":57},{"name":"google","count":56},{"name":"vmware","count":56},{"name":"c2","count":55},{"name":"tenable","count":48},{"name":"logs","count":48},{"name":"log4j","count":47},{"name":"vulhub","count":46},{"name":"hackerone","count":46},{"name":"php","count":45},{"name":"aem","count":45},{"name":"generic","count":45},{"name":"osint-gaming","count":45},{"name":"debug","count":44},{"name":"cve2014","count":44},{"name":"deserialization","count":44},{"name":"jndi","count":44},{"name":"cnvd","count":43},{"name":"traversal","count":43},{"name":"osint-hobby","count":42},{"name":"oa","count":42},{"name":"osint-porn","count":42},{"name":"microsoft","count":42},{"name":"plugin","count":42},{"name":"springboot","count":41},{"name":"misc","count":40},{"name":"injection","count":39},{"name":"listing","count":38},{"name":"miscellaneous","count":38},{"name":"jira","count":37},{"name":"ibm","count":36},{"name":"cti","count":36},{"name":"osint-misc","count":35},{"name":"k8s-cluster-security","count":34},{"name":"sap","count":34},{"name":"fuzz","count":34},{"name":"ssl","count":33},{"name":"devsecops","count":32},{"name":"dlink","count":32},{"name":"tls","count":32},{"name":"osint-tech","count":31},{"name":"ec2","count":30},{"name":"wp-theme","count":30},{"name":"osint-coding","count":30},{"name":"gitlab","count":28},{"name":"api","count":28},{"name":"fortinet","count":28},{"name":"lfr","count":27},{"name":"file-upload","count":27},{"name":"citrix","count":27},{"name":"dns","count":27},{"name":"proxy","count":27},{"name":"bestwebsoft","count":27},{"name":"admin","count":26},{"name":"manageengine","count":26},{"name":"zohocorp","count":26},{"name":"cve2012","count":26},{"name":"ssh","count":26},{"name":"firewall","count":26},{"name":"weaver","count":25},{"name":"dast","count":25},{"name":"zoho","count":25},{"name":"xxe","count":25},{"name":"osint-shopping","count":24},{"name":"osint-images","count":24},{"name":"printer","count":24},{"name":"osint-business","count":24},{"name":"osint-finance","count":24},{"name":"yonyou","count":23},{"name":"stored-xss","count":23},{"name":"tomcat","count":23},{"name":"audit","count":23},{"name":"s3","count":22},{"name":"github","count":22},{"name":"cicd","count":22},{"name":"prestashop","count":22},{"name":"weblogic","count":21},{"name":"msf","count":21},{"name":"ecology","count":21},{"name":"camera","count":20},{"name":"ftp","count":20},{"name":"info-leak","count":20},{"name":"jenkins","count":20},{"name":"wavlink","coLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3225 | dhiyaneshdk   |  1866 | http       |  8825 | info     |  4118 | file |   435 |
-| panel     |  1327 | daffainfo     |   868 | cloud      |   657 | high     |  2423 | dns  |    26 |
-| xss       |  1246 | dwisiswant0   |   806 | file       |   435 | medium   |  2339 |      |       |
-| wordpress |  1168 | princechaddha |   806 | dast       |   255 | critical |  1391 |      |       |
-| exposure  |  1094 | ritikchaddha  |   633 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1023 | pussycat0x    |   519 | code       |   174 | unknown  |    54 |      |       |
-| osint     |   810 | pikpikcu      |   352 | network    |   141 |          |       |      |       |
-| tech      |   782 | pdteam        |   308 | javascript |    71 |          |       |      |       |
-| lfi       |   772 | pdresearch    |   251 | ssl        |    38 |          |       |      |       |
-| rce       |   770 | ricardomaia   |   249 | dns        |    23 |          |       |      |       |
+| cve       |  2571 | dhiyaneshdk   |  1351 | http       |  7663 | info     |  3789 | file |   402 |
+| panel     |  1167 | daffainfo     |   864 | file       |   402 | high     |  1816 | dns  |    25 |
+| wordpress |  1002 | dwisiswant0   |   803 | workflows  |   191 | medium   |  1578 |      |       |
+| exposure  |   968 | pussycat0x    |   439 | network    |   135 | critical |  1071 |      |       |
+| xss       |   917 | ritikchaddha  |   380 | cloud      |   134 | low      |   271 |      |       |
+| wp-plugin |   872 | pikpikcu      |   353 | code       |    81 | unknown  |    40 |      |       |
+| osint     |   804 | princechaddha |   303 | javascript |    61 |          |       |      |       |
+| tech      |   698 | pdteam        |   297 | ssl        |    29 |          |       |      |       |
+| lfi       |   678 | ricardomaia   |   239 | dast       |    25 |          |       |      |       |
+| misconfig |   673 | geeknik       |   231 | dns        |    22 |          |       |      |       |

cloud/alibaba/ack/ack-cluster-api-public.yaml

@@ -1,39 +0,0 @@
-id: ack-cluster-api-public
-
-info:
-  name: Public Access to ACK Cluster's API Server - Enabled
-  author: ritikchaddha
-  severity: high
-  description: |
-    Ensure that your ACK cluster's API server is not publicly accessible in order to avoid exposing private data and minimizing security risks. The level of access to your Kubernetes API server depends on your application use cases, however, for most use cases, the Kubernetes API Server should be accessible only from within your Virtual Private Cloud (VPC).
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ACK/private-cluster.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,ack
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs GET /clusters --header "Content-Type=application/json;" --body "{}"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'master_url":'
-          - 'api_server_endpoint\":\"'
-
-      - type: word
-        words:
-          - 'api_server_endpoint\":\"\",'
-        negative: true
-# digest: 4b0a00483046022100b7fc429fd01243451efc9c2af29a4f7dd9fa7d3d472f6b2390b237f52c8d29bd022100e7e94a2b747bfaf80f269494c33d26ad15655c94116df0673fc9002d46206901:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ack/ack-cluster-auditing-disable.yaml

@@ -1,57 +0,0 @@
-id: ack-cluster-auditing-disable
-
-info:
-  name: Cluster Auditing with Simple Log Service - Disabled
-  author: ritikchaddha
-  severity: low
-  description: |
-    Ensure that cluster auditing with Simple Log Service is enabled for your Container Service for Kubernetes (ACK) clusters. Simple Log Service is a comprehensive real-time data logging solution, facilitating the seamless handling of log collection, shipping, search, storage, and analysis. The service provides a user-friendly interface for accessing the Log Viewer and an API for efficient log management. Simple Log Service automatically captures, processes, and stores container and audit logs in a dedicated persistent datastore, collecting container logs from your containers and audit logs from kube-apiserver or deployed ingress, including cluster activity events.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ACK/enable-log-service.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,ack
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let cluster_id of iterate(template.cluster)) {
-    set("cluster", cluster_id)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs GET /clusters --header "Content-Type=application/json;" --body "{}"
-
-    extractors:
-      - type: json
-        name: cluster
-        internal: true
-        json:
-          - '.[].cluster_id'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs GET /clusters/$cluster --header "Content-Type=application/json;" --body "{}" --output cols=meta_data
-
-    matchers:
-      - type: regex
-        regex:
-          - '"AuditProjectName"\s*:\s*""'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'cluster + " Cluster auditing with Simple Log Service is not enabled"'
-# digest: 4a0a004730450220160df17dd98b2a12cee21ca6be28a84bf07a320c50059dd0513c0423203a3695022100b87631bebd1d69e7e6aa109c74ceb89f5c22358ee5bf1643a4f67e6986447559:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ack/ack-cluster-cloud-monitor-disable.yaml

@@ -1,59 +0,0 @@
-id: ack-cluster-cloud-monitor-disable
-
-info:
-  name: Cloud Monitor for ACK Clusters - Disable
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Ensure that Cloud Monitor is enabled for your Container Service for Kubernetes (ACK) clusters. Cloud Monitor relies on a specialized agent for accessing extra system resources and application services within virtual machine instances. The agent allows monitoring of metrics such as CPU utilization, specific disk traffic metrics, network traffic, and disk IO information. These metrics play a crucial role in observing signals and facilitating operational activities within your Kubernetes Engine clusters.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ACK/enable-cloud-monitor.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,ack
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let cluster_id of iterate(template.cluster)) {
-    set("cluster", cluster_id)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs GET /clusters --header "Content-Type=application/json;" --body "{}"
-
-    extractors:
-      - type: json
-        name: cluster
-        internal: true
-        json:
-          - '.[].cluster_id'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs GET /clusters/$cluster/nodepools --header "Content-Type=application/json;" --body "{}"
-
-    matchers:
-      - type: word
-        words:
-          - 'kubernetes_config":'
-          - 'cms_enabled": false'
-        condition: and
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'cluster + " Cloud Monitor service is not enabled"'
-# digest: 4a0a00473045022069baf44dc8c97e8026d54120e12b42a8b2b357a2dd490006b00d89291f18aebb022100e75b0f9abc1083ab553db314b51fba7ba3f51c66a2556c7f4a8d78b8270747dc:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ack/ack-cluster-health-disable.yaml

@@ -1,64 +0,0 @@
-id: ack-cluster-health-disable
-
-info:
-  name: ACK Clusters Check - Disable
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Ensure that the Cluster Check feature is triggered at least once per week to guarantee proactive health monitoring for your ACK clusters, minimizing downtime and optimizing the reliability of your containerized applications. By default, Cluster Check is not automatically triggered, the cluster inspection can be started using the Container Service for Kubernetes (ACK) console.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ACK/cluster-check.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,ack
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let cluster_id of iterate(template.cluster)) {
-    set("cluster", cluster_id)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs GET /clusters --header "Content-Type=application/json;" --body "{}"
-
-    extractors:
-      - type: json
-        name: cluster
-        internal: true
-        json:
-          - '.[].cluster_id'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs GET /clusters/$cluster/checks --header "Content-Type=application/json;" --body "{}"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'check_id":'
-          - 'status":'
-
-      - type: word
-        words:
-          - '"status": "Succeeded'
-        negative: true
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'cluster + " Cluster Health Check is Disabled"'
-# digest: 4a0a00473045022100ea949f6a65a4168fdcd3d79fea251acf2f4459e93dfade94b797f1c102c5396802204af0738eaf3419762f4832983c36e39a459e21ef1551b0b17a3a15c81e404d0c:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ack/ack-cluster-network-policies-disable.yaml

@@ -1,63 +0,0 @@
-id: ack-cluster-network-policies-disable
-
-info:
-  name: Enforced Cluster Support for Network Policies - Disabled
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Ensure that your ACK clusters are using Kubernetes network policies to implement secure policy-based access control. Container Service for Kubernetes (ACK) employs the Terway network plugin to enforce network policies at the cluster level.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ACK/enable-network-policy-support.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,ack
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let cluster_id of iterate(template.cluster)) {
-    set("cluster", cluster_id)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs GET /clusters --header "Content-Type=application/json;" --body "{}"
-
-    matchers:
-      - type: word
-        words:
-          - '"Network": "terway-eniip"'
-        internal: true
-
-    extractors:
-      - type: json
-        name: cluster
-        internal: true
-        json:
-          - '.[].cluster_id'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs GET /clusters/$cluster --header "Content-Type=application/json;" --body "{}" --output cols=meta_data
-
-    matchers:
-      - type: word
-        words:
-          - 'NetworkPolicy\":\"false'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'cluster + " Cluster is not using the plugin to enforce network policies"'
-# digest: 490a004630440220640da8dee3686d45b8d38d62d63cf5d7449b99340f644d1095463046e03db60602204eb932c45b8397a18c4562f067d09bd397bf4ddd06c5efeed9d66fc82f681f19:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ack/ack-cluster-network-policies-missing.yaml

@@ -1,43 +0,0 @@
-id: ack-cluster-network-policies-missing
-
-info:
-  name: Cluster Support for Network Policies - Missing
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Ensure that your ACK clusters are using Kubernetes network policies to implement secure policy-based access control. Container Service for Kubernetes (ACK) employs the Terway network plugin to enforce network policies at the cluster level.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ACK/enable-network-policy-support.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,ack
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs GET /clusters --header "Content-Type=application/json;" --body "{}"
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        regex:
-          - '"Network"\s*:\s*"'
-
-      - type: word
-        words:
-          - '"Network": "terway-eniip"'
-        negative: true
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"Cluster is not using the plugin to enforce network policies"'
-# digest: 490a004630440220131fa00233007ecfe8f70fc500b4efa66999ba6f1eb7d2987484c56ef13075dc02203e74e8da876a147c37d6de2a89c5995d52ca2933f9ec2eb473122fe32656a198:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ack/kubernetes-dashboard-enabled.yaml

@@ -1,57 +0,0 @@
-id: kubernetes-dashboard-enabled
-
-info:
-  name: Kubernetes Dashboard for ACK Clusters - Enabled
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Ensure that Kubernetes Dashboard (Dashboard WebUI) is disabled for your ACK clusters in order to enhance cluster security and prevent potential attack vectors. The Kubernetes Dashboard is a web-based user interface (UI) that provides a visual representation and management capabilities for Kubernetes clusters. It allows users to monitor and interact with the resources within the cluster, such as pods, deployments, and services, through a graphical interface rather than using command-line tools.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ACK/disable-kubernetes-dashboard.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,ack
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let cluster_id of iterate(template.cluster)) {
-    set("cluster", cluster_id)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs GET /clusters --header "Content-Type=application/json;" --body "{}"
-
-    extractors:
-      - type: json
-        name: cluster
-        internal: true
-        json:
-          - '.[].cluster_id'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun cs DescribeClusterAddonsVersion --ClusterId $cluster
-
-    matchers:
-      - type: word
-        words:
-          - 'kubernetes-dashboard'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'cluster + " Kubernetes Dashboard is enabled for the selected ACK cluster"'
-# digest: 4b0a00483046022100b4f98ba55922b99ffbf57dd68fa814f198dd99130e9d1d6c168a246eb842d3260221009a8c004329b2015cefef39ffbb2c7abda163de2e0d00132796e1cc133d5a5531:922c64590222798bb761d5b6d8e72950

cloud/alibaba/actiontrail/multi-region-logging-disabled.yaml

@@ -1,45 +0,0 @@
-id: multi-region-logging-disabled
-
-info:
-  name: Global Service (Multi-Region) Logging - Disabled
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    Global Service (Multi-Region) Logging is disabled, preventing the collection and monitoring of logs across multiple regions. This lack of centralized logging increases the risk of undetected security incidents and operational issues.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ActionTrail/enable-multi-region-trails.html
-    - https://www.alibabacloud.com/help/en/actiontrail/product-overview/services-that-work-with-actiontrail
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,actiontrail
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun actiontrail DescribeTrails --region $region
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '"TrailRegion": "All"'
-        negative: true
-
-      - type: word
-        words:
-          - '"Status": "Enable"'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"ActionTrail for Global Service Multi-Region is Disabled "'
-# digest: 4a0a0047304502200d2f4254879df34c1ea310e2004cbf0aeaecf7c33a55250b548ecd6647e58b0a022100e8d4c5c83d25132dc839a5035cff3ee4b21130b0801b9ecfaca6f3fe26b9ea08:922c64590222798bb761d5b6d8e72950

cloud/alibaba/actiontrail/public-actiontrail-bucket.yaml

@@ -1,57 +0,0 @@
-id: public-actiontrail-bucket
-
-info:
-  name: ActionTrail Log Buckets - Publicly Exposed
-  author: ritikchaddha
-  severity: high
-  description: |
-    Identify any publicly accessible ActionTrail trail log buckets in order to determine if your Alibaba Cloud account could be at risk. A publicly accessible trail bucket is a bucket were all users, including anonymous users, can perform read and write operations on the objects within the bucket.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ActionTrail/trail-bucket-publicly-accessible.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,actiontrail
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let BucketName of iterate(template.bucketname)) {
-    set("bucket", BucketName)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun actiontrail DescribeTrails --region $region
-
-    extractors:
-      - type: json
-        name: bucketname
-        internal: true
-        json:
-          - '.TrailList[].OssBucketName'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      ossutil stat oss://$bucket
-
-    matchers:
-      - type: regex
-        regex:
-          - 'ACL.*:.*public-read-write'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'bucket + " Bucket associated with ActionTrail trail is publicly accessible"'
-# digest: 4b0a004830460221009ad0983bbbc67aceaeefae2e0f2f98390937e979ed51482d79b61c41c11d662602210098b877f52c1cf1cc3273194270ad3d4dbdd9f07b50237fb110adcce97771bb0c:41987585204b393149694b2205534b1a

cloud/alibaba/alibaba-cloud-code-env.yaml

@@ -1,69 +0,0 @@
-id: alibaba-cloud-code-env
-
-info:
-  name: Alibaba Cloud Environment Validation
-  author: DhiyaneshDK
-  severity: info
-  description: |
-    Checks if Aliyun CLI is set up and all necessary tools are installed on the environment.
-  reference:
-    - https://github.com/aliyun/aliyun-cli
-  metadata:
-    max-request: 3
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config
-
-variables:
-  region: "cn-hangzhou"
-
-flow: code(1) && code(2) && code (3)
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun sts GetCallerIdentity
-
-    matchers:
-      - type: word
-        internal: true
-        words:
-          - '"UserId":'
-
-    extractors:
-      - type: json
-        name: account
-        internal: true
-        json:
-          - '.AccountId'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      jq --version >/dev/null 2>&1 && echo "jq is installed." || echo "jq is not installed."
-
-    matchers:
-      - type: word
-        words:
-          - "jq is installed"
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      ossutil --version >/dev/null 2>&1 && echo "ossutil is installed." || echo "ossutil is not installed."
-
-    matchers:
-      - type: word
-        words:
-          - "ossutil is installed"
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"Aliyun CLI is properly configured for account \"" + account + "\" and all the necessary tools required are installed."'
-# digest: 4a0a0047304502201c12ee70fb96893100a7ac8999e01834ac017716a0cdf13249855690a2c096a70221008644bea38cae55a580d6f044fd2b944e416d9f13ab32c1662a1c30cd60542014:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ecs/os-patches-outdated.yaml

@@ -1,48 +0,0 @@
-id: os-patches-outdated
-
-info:
-  name: OS Patches - Outdated
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Ensure that the latest OS patches for ECS virtual machines (VM) instances are applied in order to mitigate security vulnerabilities and ensure optimal performance and stability.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ECS/apply-latest-os-patches.html
-    - https://www.alibabacloud.com/help/en/security-center/user-guide/fix-software-vulnerabilities
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,ecs
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun sas DescribeVulList --Type cve --region $region
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '"RaspStatus":'
-          - '"Type":'
-        condition: and
-
-      - type: word
-        words:
-          - '"TotalCount": 0'
-          - '"VulRecords":'
-        condition: and
-        negative: true
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '" OS Patches are Outdated "'
-# digest: 490a004630440220075d428a4f7bf677cfb89468182e7f1e917c233bd6df02a9df3e0bc705434aa502204af7cc4cfcff4b1cbdb9b876b678b263a1486cbb328c2045cd209970f6221e3a:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ecs/unattached-disk-encryption-disabled.yaml

@@ -1,38 +0,0 @@
-id: unattached-disk-encryption-disabled
-
-info:
-  name: Encryption for Unattached Disks - Disabled
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    Unencrypted unattached disks in Alibaba Cloud pose a risk of data exposure if accessed by unauthorized users. Enabling encryption ensures the security of sensitive data at rest.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ECS/encrypt-unattached-disks.html
-    - https://www.alibabacloud.com/help/en/ecs/user-guide/encrypt-a-data-disk
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,ecs
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ecs DescribeDisks --Status Available --region $region
-
-    matchers:
-      - type: word
-        words:
-          - '"Encrypted": false'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '" Encryption for Unattached Disks is Disabled "'
-# digest: 4a0a00473045022100e3f1eb9d2f25397e2c3f9b1fc03ff807b1f188d0168bd3bb3f37314a23a68d6f02200a78f4cbcbf9c402d5e827134acfe497858577368c7c4ee8792fd1cd97198c32:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ecs/unattached-vminstance-encryption-disabled.yaml

@@ -1,66 +0,0 @@
-id: unattached-vminstance-encryption-disabled
-
-info:
-  name: Encryption for VM Instance Disks - Disabled
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    The encryption for VM instance disks in Alibaba Cloud is currently disabled. This means that the data stored on these disks is not automatically encrypted for enhanced security.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ECS/encrypt-vm-instance-disks.html
-    - https://www.alibabacloud.com/help/en/ecs/user-guide/encrypt-a-system-disk
-    - https://www.alibabacloud.com/help/en/ecs/user-guide/encrypt-a-data-disk
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,ecs
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let InstanceId of iterate(template.instanceid)){
-    set("instanceid", InstanceId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ecs DescribeDisks --region $region
-
-    extractors:
-      - type: json
-        name: instanceid
-        internal: true
-        json:
-          - '.Disks.Disk[].InstanceId'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun ecs DescribeDisks --InstanceId $instanceid --region $region
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '"Encrypted": false'
-
-      - type: word
-        words:
-          - '"InstanceId": ""'
-        negative: true
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'instanceid + " Encryption for VM Instance Disks is Disabled"'
-# digest: 490a00463044022065fc7c09f5a02fdbe644ceaf7fa05f05cc3ef357da65955c28917e0e7f18911c02205ff663b81f41ec4df06ecdaf43243c0b903c4971aca650730e6d51c918037c11:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ecs/unrestricted-rdp-access.yaml

@@ -1,62 +0,0 @@
-id: unrestricted-rdp-access
-
-info:
-  name: Unrestricted - RDP Access
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    Unrestricted RDP (Remote Desktop Protocol) access allows anyone on the internet to attempt to connect to your instance using port 3389, which is commonly used for RDP. This can expose the instance to potential brute force attacks, unauthorized access attempts, and exploitation of vulnerabilities in the RDP service.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ECS/unrestricted-rdp-access.html
-    - https://www.alibabacloud.com/help/en/ecs/use-cases/best-practices-of-the-security-group
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,ecs
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let SecurityGroupId of iterate(template.securitygroup)){
-    set("securitygroup", SecurityGroupId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ecs DescribeSecurityGroups --RegionId $region
-
-    extractors:
-      - type: json
-        name: securitygroup
-        internal: true
-        json:
-          - '.SecurityGroups.SecurityGroup[].SecurityGroupId'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ecs DescribeSecurityGroupAttribute --SecurityGroupId "$securitygroup" --Direction ingress --RegionId $region
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '"IpProtocol": "TCP"'
-          - '"PortRange": "3389/3389"'
-          - '"SourceCidrIp": "0.0.0.0/0"'
-        condition: and
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'securitygroup + " contains Unrestricted RDP Access"'
-# digest: 4b0a0048304602210083f03472a0f1275e78b08fc4b68bde30bca25b86d874e0b7f53691e7259a9574022100aff7788972912f8e416e28adb1e05a94f601b3c5904ac26e5ad79f69ed46cc39:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ecs/unrestricted-ssh-access.yaml

@@ -1,62 +0,0 @@
-id: unrestricted-ssh-access
-
-info:
-  name: Unrestricted - SSH Access
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    Unrestricted SSH access allows anyone on the internet to attempt connections to your instance over port 22, posing a risk of brute force attacks, unauthorized access, and exploitation of SSH vulnerabilities. Limiting access to trusted IPs is essential to secure your instance.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ECS/unrestricted-ssh-access.html
-    - https://www.alibabacloud.com/help/en/ecs/use-cases/best-practices-of-the-security-group
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,ecs
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let SecurityGroupId of iterate(template.securitygroup)){
-    set("securitygroup", SecurityGroupId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ecs DescribeSecurityGroups --RegionId $region
-
-    extractors:
-      - type: json
-        name: securitygroup
-        internal: true
-        json:
-          - '.SecurityGroups.SecurityGroup[].SecurityGroupId'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ecs DescribeSecurityGroupAttribute --SecurityGroupId "$securitygroup" --Direction ingress --RegionId $region
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '"IpProtocol": "TCP"'
-          - '"PortRange": "22/22"'
-          - '"SourceCidrIp": "0.0.0.0/0"'
-        condition: and
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'securitygroup + " contains Unrestricted SSH Access"'
-# digest: 4a0a00473045022078d2940e35439fb3d9447ac4fe8aa08ec376448ea3458f938bdbf7159089aa8c022100f9751047f3976afb22ed1b7db9d481f2cee00cfe1513dcc4e53818e0df7451c7:922c64590222798bb761d5b6d8e72950

cloud/alibaba/oss/access-logoss-disabled.yaml

@@ -1,63 +0,0 @@
-id: access-logoss-disabled
-
-info:
-  name: Access Logging for OSS Buckets - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Disabling access logging for OSS buckets reduces the ability to monitor and audit access, increasing the risk of undetected unauthorized activity.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-OSS/enable-bucket-access-logging.html
-    - https://www.alibabacloud.com/help/en/oss/user-guide/getting-started
-    - https://www.alibabacloud.com/help/en/oss/user-guide/enable-logging
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,alibaba-oss
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let BucketName of iterate(template.bucketname)) {
-    set("bucket", BucketName)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun oss ls --region $region
-
-    extractors:
-      - type: regex
-        name: bucketname
-        internal: true
-        regex:
-          - 'oss://([a-zA-Z0-9-]+)'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun oss logging --method get $bucket --region $region
-
-    matchers:
-      - type: word
-        words:
-          - '<LoggingEnabled>'
-          - '<TargetBucket></TargetBucket>'
-        condition: and
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'bucket + " Access Logging for OSS Buckets is Disabled "'
-# digest: 490a0046304402202c7db531327c5aa97814ff449d8796b0520264e13d531fcebdf3e90d64252cb60220045d1db959712237219b389022dbaabf1bcb023ca5151e5539546aad2819d8c7:922c64590222798bb761d5b6d8e72950

cloud/alibaba/oss/improper-bucket-sse.yaml

@@ -1,58 +0,0 @@
-id: improper-bucket-sse
-
-info:
-  name: Improper Bucket Server-Side Encryption
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Determine the Server-Side Encryption (SSE) feature configuration available for the selected OSS bucket. For compliance, the SSEAlgorithm must be set to KMS.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-OSS/enable-sse-with-customer-managed-key.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,oss
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let BucketName of iterate(template.bucketname)) {
-    set("bucket", BucketName)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      ossutil ls -s --region $region
-
-    extractors:
-      - type: regex
-        name: bucketname
-        internal: true
-        regex:
-          - 'oss://([a-zA-Z0-9-]+)'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      ossutil bucket-encryption --method get $bucket
-
-    matchers:
-      - type: regex
-        regex:
-          - 'SSEAlgorithm:\s?AES256'
-          - 'StatusCode=404'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'bucket + " Bucket SSEAlgorithm is not set to KMS"'
-# digest: 490a0046304402205bdf1095c23f74d8032d8c8ed10841cd2574f186f2d0a7e6a8b484974f0079c30220378a0a9868705810364cd850515e1f5a63b7596aef948a1a65372871462b69a6:922c64590222798bb761d5b6d8e72950

cloud/alibaba/oss/limit-networkaccess-disabled.yaml

@@ -1,70 +0,0 @@
-id: limit-networkaccess-disabled
-
-info:
-  name: Limit Network Access to Selected Networks - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Limit Network Access to Selected Networks in Alibaba OSS allows you to restrict access to your object storage service (OSS) to specific IP addresses or IP ranges, enhancing security by ensuring that only trusted networks can interact with your data."
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-OSS/publicly-accessible-oss-bucket.html
-    - https://www.alibabacloud.com/help/en/oss/user-guide/block-public-access
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,alibaba-oss
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let BucketName of iterate(template.bucketname)) {
-    set("bucket", BucketName)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun oss ls --region $region
-
-    extractors:
-      - type: regex
-        name: bucketname
-        internal: true
-        regex:
-          - 'oss://([a-zA-Z0-9-]+)'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun oss bucket-policy --method get $bucket --region $region
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '"IpAddress":'
-          - '"acs:SourceIp":'
-        negative: true
-
-      - type: word
-        words:
-          - '"Principal":'
-          - '"Resource":'
-          - '"Action":'
-        condition: and
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'bucket + " Limit Network Access to Selected Networks is Disabled "'
-# digest: 4a0a0047304502207e35a18d8164528de48029765a8fe55797af61fff934bb5d0b18d47fed41ae9a022100fab60e8b59b6a61f40ea8a69ca9b3e268c81ece8809a37425fc72b11ac7bc5ac:922c64590222798bb761d5b6d8e72950

cloud/alibaba/oss/oos-bucket-public-access.yaml

@@ -1,68 +0,0 @@
-id: oos-bucket-public-access
-
-info:
-  name: OSS Bucket Public Accessible
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    Ensure that your Object Storage Service (OSS) buckets are not publicly accessible to the Internet in order to protect against unauthorized access. Allowing public, anonymous access through bucket ACLs and bucket policies gives everyone the ability to access bucket contents.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-OSS/publicly-accessible-oss-bucket.html
-    - https://www.alibabacloud.com/help/en/oss/user-guide/block-public-access
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,alibaba-oss
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let BucketName of iterate(template.bucketname)) {
-    set("bucket", BucketName)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun oss ls --region $region
-
-    extractors:
-      - type: regex
-        name: bucketname
-        internal: true
-        regex:
-          - 'oss://([a-zA-Z0-9-]+)'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun oss stat $bucket --region $region
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'private'
-        negative: true
-
-      - type: word
-        words:
-          - 'public-read'
-          - 'public-read-write'
-        condition: or
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'bucket + " OSS Bucket is Public Accessible "'
-# digest: 4b0a00483046022100ebe3f235d7b322069926037bb46627b158f4c3aaef6fce8f53d5b7796c00d1f6022100a423932d5a987382196d74de46a97ba1dcb4b25980a28181945ee69c70512e45:922c64590222798bb761d5b6d8e72950

cloud/alibaba/oss/secure-transfeross-disabled.yaml

@@ -1,68 +0,0 @@
-id: secure-transfeross-disabled
-
-info:
-  name: Secure Transfer for OSS Buckets - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Disabling secure transfer (HTTPS) for OSS buckets exposes data to potential interception. It is recommended to enable HTTPS to ensure encrypted communication and data security.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-OSS/enable-secure-transfer.html
-    - https://www.alibabacloud.com/help/en/oss/user-guide/use-bucket-policy-to-grant-permission-to-access-oss/
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,alibaba-oss
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let BucketName of iterate(template.bucketname)) {
-    set("bucket", BucketName)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun oss ls --region $region
-
-    extractors:
-      - type: regex
-        name: bucketname
-        internal: true
-        regex:
-          - 'oss://([a-zA-Z0-9-]+)'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun oss bucket-policy --method get $bucket --region $region
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '"acs:SecureTransport":'
-        negative: true
-
-      - type: word
-        words:
-          - '"Resource":'
-          - '"Principal":'
-        condition: and
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'bucket + " Secure Transfer for OSS Buckets "'
-# digest: 490a0046304402205263fc71592240b51cc863e754efcf1a93e92cc10fa959cceb7c060facf15380022062ca3fc3027d327ed1902e208f39a88b57e8023b1869dcad5588940663145872:922c64590222798bb761d5b6d8e72950

cloud/alibaba/oss/sse-cmk-disabled.yaml

@@ -1,76 +0,0 @@
-id: sse-cmk-disabled
-
-info:
-  name: Server-Side Encryption with Customer Managed Key - Disabled
-  author: ritikchaddha
-  severity: high
-  description: |
-    Ensure that Server-Side Encryption (SSE) is using customer-managed keys (CMKs) instead of service-managed keys to protect your OSS data at rest. SSE with customer-managed keys (also known as Bring Your Own Key - BYOK) enables you to have full control over the encryption and decryption process and meet strict compliance requirements.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-OSS/enable-sse-with-customer-managed-key.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,ecs
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let BucketName of iterate(template.bucketname)) {
-    set("bucket", BucketName)
-    code(2)
-    for (let KMSMasterKeyID of iterate(template.KmsID)) {
-      set("KmsID", KMSMasterKeyID)
-      code(3)
-    }
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      ossutil ls -s --region $region
-
-    extractors:
-      - type: regex
-        name: bucketname
-        internal: true
-        regex:
-          - 'oss://([a-zA-Z0-9-]+)'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      ossutil bucket-encryption --method get $bucket --RegionId $region
-
-    extractors:
-      - type: regex
-        name: KmsID
-        internal: true
-        regex:
-          - 'KMSMasterKeyID: ([a-z0-9-]+)'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun kms DescribeKey --KeyId $KmsID --RegionId $region
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'Creator": "Rds'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'KmsID + " SSE with customer-managed keys Disable"'
-# digest: 4b0a00483046022100b066e8817becee38cb2b4857e6b84c939bb4cc9db6dae5efa90543d3c1becd57022100ecf71b3ad8d9d15f7eecc8f24441926de5d67b184ca58119e77fb12add36bfe2:922c64590222798bb761d5b6d8e72950

cloud/alibaba/oss/sse-smk-disabled.yaml

@@ -1,75 +0,0 @@
-id: sse-smk-disabled
-
-info:
-  name: Server-Side Encryption with Service Managed Key - Disabled
-  author: ritikchaddha
-  severity: high
-  description: |
-    Ensure that Server-Side Encryption (SSE) is using customer-managed keys (CMKs) instead of service-managed keys to protect your OSS data at rest. SSE with customer-managed keys (also known as Bring Your Own Key - BYOK) enables you to have full control over the encryption and decryption process and meet strict compliance requirements.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-OSS/enable-sse-with-service-key.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,oss
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for (let BucketName of iterate(template.bucketname)) {
-    set("bucket", BucketName)
-    code(2)
-    for (let KMSMasterKeyID of iterate(template.KmsID)) {
-      set("KmsID", KMSMasterKeyID)
-      code(3)
-    }
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      ossutil ls -s --region $region
-
-    extractors:
-      - type: regex
-        name: bucketname
-        internal: true
-        regex:
-          - 'oss://([a-zA-Z0-9-]+)'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      ossutil bucket-encryption --method get $bucket
-
-    extractors:
-      - type: regex
-        name: KmsID
-        internal: true
-        regex:
-          - 'KMSMasterKeyID: ([a-z0-9-]+)'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun kms ListAliasesByKeyId --KeyId $KmsID
-
-    matchers:
-      - type: word
-        words:
-          - 'AliasName": "alias/acs/rds'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'KmsID + " SSE with service-managed key Disable"'
-# digest: 490a0046304402201f11561ccac93c5f9c3f01b039ab732fcda5bd2fbea367d3f69e40a2116e2e9d022072c6621d2ee39c602af009b2127eaf59b7fbb7d03a39843c98636bcdd61592b6:41987585204b393149694b2205534b1a

cloud/alibaba/ram/custom-ram-policy-admin-priv.yaml

@@ -1,64 +0,0 @@
-id: custom-ram-policy-admin-priv
-
-info:
-  name: Custom RAM Policies With Full Administrative Privileges
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    The Alibaba Cloud Custom RAM policies with full administrative privileges grant users or groups unrestricted access to all resources and actions within the cloud environment.
-  reference:
-    - https://www.alibabacloud.com/help/en/ram/user-guide/create-a-custom-policy
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RAM/policies-with-full-administrative-privileges.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-ram
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let PolicyName of iterate(template.policyname)){
-    set("policy", PolicyName)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun ram ListPolicies --PolicyType Custom --region $region
-
-    extractors:
-      - type: json
-        name: policyname
-        internal: true
-        json:
-          - '.Policies.Policy[].PolicyName'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun ram GetPolicy --PolicyName $policyname --PolicyType Custom --region $region
-
-
-    matchers:
-      - type: word
-        words:
-          - '"Effect\":\"Allow\'
-          - '\"Action\":\"*\"'
-          - '\"Resource\":\"*\"'
-        condition: and
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'policy + " custom RAM Policy allow Full Administrative Privileges "'
-# digest: 4a0a0047304502204cbc305a46f0716c1d9cde8d2e7eb3267ea7b1d03724236860e6bbb6e75ce077022100c4f3830e4b2e5d3f63b7f68d5fbd35792e74fb3f0faebb0f9b05877ff71dfb21:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ram/max-password-retry-disabled.yaml

@@ -1,38 +0,0 @@
-id: max-password-retry-disabled
-
-info:
-  name: Maximum Password Retry Constraint Policy - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The password retry constraint policy for RAM (Resource Access Management) users in Alibaba Cloud is either disabled or not properly configured
-  reference:
-    - https://www.alibabacloud.com/help/en/ram/user-guide/configure-a-password-policy-for-ram-users
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-ram
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ram GetPasswordPolicy --region $region
-
-    matchers:
-      - type: word
-        name: policy
-        words:
-          - '"MaxLoginAttemps": 0'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"Maximum Password Retry Constraint Policy is Disabled "'
-# digest: 4a0a00473045022100f3433183b0212970a977499997f3e2c24d64c9450e10fd8b08ee4c813be0bb5c02202782c8d0ddf2c2bd5f715a11f3561d0635cb7d5994439495302e4b5936e38054:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ram/mfa-console-password-disabled.yaml

@@ -1,60 +0,0 @@
-id: mfa-console-password-disabled
-
-info:
-  name: MFA For RAM Users With Console Password - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    MFA (Multi-Factor Authentication) for RAM users with console password is currently disabled, meaning users can access the console without requiring a second form of authentication. This configuration reduces security by not enforcing an additional layer of protection beyond the password.
-  reference:
-    - https://www.alibabacloud.com/help/en/ram/user-guide/bind-an-mfa-device-to-a-ram-user
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RAM/ram-user-multi-factor-authentication-enabled.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-ram
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let UserName of iterate(template.username)){
-    set("user", UserName)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun ram ListUsers --region $region
-
-    extractors:
-      - type: json
-        name: username
-        internal: true
-        json:
-          - '.Users.User[].UserName'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun ram GetLoginProfile --UserName $user --region $region
-
-    matchers:
-      - type: word
-        words:
-          - '"MFABindRequired": false'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'username + "MFA For RAM Users With Console Password is Disabled "'
-# digest: 4b0a00483046022100c7afcb5e2dc6dc985fe7cdacc0c4b9df46771b260e4d9c285aebad82f799253f02210085b33d9186b18e92bbb5cb344b1fe586afee9a15e6ff8f3403dbf74815ff6a48:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ram/password-policy-expiration-unconfigured.yaml

@@ -1,44 +0,0 @@
-id: password-policy-expiration-unconfigured
-
-info:
-  name: RAM Password Policy Expiration - Unconfigured
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The Alibaba Cloud RAM Password Policy is unconfigured, leaving user accounts vulnerable to weak or expired passwords. This lack of a configured policy may lead to potential unauthorized access due to weak password management.
-  reference:
-    - https://www.alibabacloud.com/help/en/ram/user-guide/configure-a-password-policy-for-ram-users
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RAM/require-password-expiration-policy.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-ram
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun ram GetPasswordPolicy --region $region
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        regex:
-          - '"MaxPasswordAge":\s*(9[1-9]|[1-9][0-9]{2,})'  # Matches values greater than 90
-
-      - type: regex
-        regex:
-          - '"MaxPasswordAge":\s*(0|[1-9][0-9]?)'  # Excludes values between 0 and 90
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"RAM Password Policy Expiration is Greater than 90 Days "'
-# digest: 490a0046304402207549bde74799cf714c472d8f8730a35eaa38a938692866df1904d0bd21ef7687022034a74ab5e9e73f0cf753ba6c4aaa75c4ec50913741389f2f63b7dcfdd63a2fc3:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ram/password-policy-length-unconfigured.yaml

@@ -1,46 +0,0 @@
-id: password-policy-length-unconfigured
-
-info:
-  name: RAM Password Policy requires Minimum Length 14 or Greater
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The Alibaba RAM password policy is not configured to require a minimum length of 14 characters. This misconfiguration allows users to set shorter, potentially weaker passwords, increasing the risk of brute-force attacks.
-  reference:
-    - https://www.alibabacloud.com/help/en/ram/user-guide/configure-a-password-policy-for-ram-users
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RAM/require-14-characters-password-policy.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-ram
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun ram GetPasswordPolicy --region $region
-
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        regex:
-          - \"MinimumPasswordLength\":\s*(1[4-9]|[2-9][0-9]{1,})
-        negative: true
-
-      - type: regex
-        regex:
-          - \"MinimumPasswordLength":\s*(\d|1[0-3])
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"RAM Password Policy Does not contain Minimum Length "'
-# digest: 490a0046304402205d4196e02a5a3b0a4f7a8387344582cb697cd529c94f8b327a7b9c08de4945b002201f64123e410f44a14463f33f9b2bdd28b5c386eaa43fc7db3bf60ba2cf678ecf:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ram/password-policy-lowercase-unconfigured.yaml

@@ -1,39 +0,0 @@
-id: password-policy-lowercase-unconfigured
-
-info:
-  name: RAM Password Policy requires atleast One Lowercase - Unconfigured
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The Alibaba RAM password policy is not configured to require at least one lowercase letter in passwords. This misconfiguration may result in weak passwords, increasing the risk of unauthorized access.
-  reference:
-    - https://www.alibabacloud.com/help/en/ram/user-guide/configure-a-password-policy-for-ram-users
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RAM/lowercase-letter-password-policy.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-ram
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ram GetPasswordPolicy --region $region
-
-    matchers:
-      - type: word
-        name: policy
-        words:
-          - '"RequireLowercaseCharacters": false'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"RAM Password Policy Does not contain One Lowercase "'
-# digest: 4a0a00473045022058492c7376d065fd9a4bd5b0f6c3de42c2a7b15b7a4dff29f157fc0e69ec3e2f022100e845dd85858662f51084f880b16dc238a6c7f498a69cb478e8815f3cd9ede17d:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ram/password-policy-num-unconfigured.yaml

@@ -1,39 +0,0 @@
-id: password-policy-num-unconfigured
-
-info:
-  name: RAM Password Policy requires atleast One Number - Unconfigured
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The Alibaba RAM password policy does not enforce the inclusion of at least one numeric character, increasing the risk of weak passwords and potential unauthorized access.
-  reference:
-    - https://www.alibabacloud.com/help/en/ram/user-guide/configure-a-password-policy-for-ram-users
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RAM/require-number-password-policy.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-ram
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ram GetPasswordPolicy --region $region
-
-    matchers:
-      - type: word
-        name: policy
-        words:
-          - '"RequireNumbers": false'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"RAM Password Policy Does not contain One Number "'
-# digest: 490a00463044022020adf9739a13e0165e1c00e9ee425937191afd8c32a862f78383aa8901adc959022036afc09b6c217d87bdda0309426e4c5780459da865ee72c378f8e7a8872dd641:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ram/password-policy-reuse-enabled.yaml

@@ -1,39 +0,0 @@
-id: password-policy-reuse-enabled
-
-info:
-  name: RAM Password Policy Reuse - Enabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The Alibaba Cloud RAM (Resource Access Management) password policy reuse is disabled, meaning users are not restricted from reusing old passwords. This lack of a configured password history policy increases the risk of users reusing weak, previously compromised, or easily guessable passwords, which could lead to unauthorized access.
-  reference:
-    - https://www.alibabacloud.com/help/en/ram/user-guide/configure-a-password-policy-for-ram-users
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RAM/prevent-password-reuse-password-policy.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-ram
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ram GetPasswordPolicy --region $region
-
-    matchers:
-      - type: word
-        name: policy
-        words:
-          - '"PasswordReusePrevention": 0'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"RAM Password Policy Allows Users Re-Use Old Password "'
-# digest: 4a0a00473045022038d771b00b065b69552986f0255e955ada91cf894490f78ccd8dfd884cd45d54022100b2615506c64bcd841fef1b4d99c7c65d10acfce3feb2022405ab01f749c5834a:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ram/password-policy-symbol-unconfigured.yaml

@@ -1,39 +0,0 @@
-id: password-policy-symbol-unconfigured
-
-info:
-  name: RAM Password Policy requires atleast One Symbol - Unconfigured
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The Alibaba Cloud RAM password policy is unconfigured to require at least one symbol, leaving user accounts vulnerable to weak passwords. Enforcing this requirement is essential to ensure stronger, more secure passwords and reduce the risk of unauthorized access.
-  reference:
-    - https://www.alibabacloud.com/help/en/ram/user-guide/configure-a-password-policy-for-ram-users
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RAM/require-symbol-password-policy.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-ram
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ram GetPasswordPolicy --region $region
-
-    matchers:
-      - type: word
-        name: policy
-        words:
-          - '"RequireSymbols": false'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"RAM Password Policy Does not contain One Symbol "'
-# digest: 4b0a00483046022100fbcf64ed10963ef6c5ab722e556f906d1dc1de40dbe530d92050f8204af6e9b6022100d2c96ba77e32dbe2bb0467363d98de73b94dc328b9adae761a51a3b507e59334:922c64590222798bb761d5b6d8e72950

cloud/alibaba/ram/password-policy-uppercase-unconfigured.yaml

@@ -1,39 +0,0 @@
-id: password-policy-uppercase-unconfigured
-
-info:
-  name: RAM Password Policy requires atleast One Uppercase - Unconfigured
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The Alibaba RAM password policy is not configured to require at least one uppercase letter in passwords. This misconfiguration may result in weak passwords, increasing the risk of unauthorized access.
-  reference:
-    - https://www.alibabacloud.com/help/en/ram/user-guide/configure-a-password-policy-for-ram-users
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RAM/uppercase-letter-password-policy.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-ram
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun ram GetPasswordPolicy --region $region
-
-    matchers:
-      - type: word
-        name: policy
-        words:
-          - '"RequireUppercaseCharacters": false'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"RAM Password Policy Does not contain One Uppercase "'
-# digest: 4a0a00473045022100c499cd44ffa83f03e9c8fb263c637807c5715cb8e91ee70177758ccf4bb30a1b0220761da466ac954977004228aebfb485f970d35c750c42647a60d86e8b7788bac6:922c64590222798bb761d5b6d8e72950

cloud/alibaba/rds/encryption-intransit-disabled.yaml

@@ -1,60 +0,0 @@
-id: encryption-intransit-disabled
-
-info:
-  name: RDS Encryption in Transit - Disabled
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    Encryption in transit for Alibaba Cloud RDS is disabled, exposing data transmission to potential interception and unauthorized access.
-  reference:
-    - https://www.alibabacloud.com/help/en/rds/apsaradb-rds-for-mysql/configure-ssl-encryption-for-an-apsaradb-rds-for-mysql-instance
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RDS/enable-encryption-in-transit.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-rds
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let DBInstanceId of iterate(template.dbinstanceid)){
-    set("instance", DBInstanceId)
-    code(2)
-  }
-
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun rds DescribeDBInstances --region $region
-
-    extractors:
-      - type: json
-        name: dbinstanceid
-        internal: true
-        json:
-          - '.Items.DBInstance[].DBInstanceId'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun rds DescribeDBInstanceSSL --DBInstanceId $dbinstanceid --region $region
-
-    matchers:
-      - type: word
-        words:
-          - '"SSLEnabled": "No"'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'instance + " RDS Encryption in Transit is Disabled "'
-# digest: 4b0a004830460221008975c054537a43ffe8ff1465de493660483ef4e72f1f6a18862dfa18b710ca13022100d7e92bcb5bf853223af4bb77099236fe3789fbd45bb45b226ae878ac38c089ae:922c64590222798bb761d5b6d8e72950

cloud/alibaba/rds/log-connections-disabled.yaml

@@ -1,61 +0,0 @@
-id: log-connections-disabled
-
-info:
-  name: PostgreSQL "log_connections" Parameter - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The log_connections parameter in PostgreSQL is disabled, meaning the database does not log new client connections. This may limit the ability to monitor and track when clients connect to the database for security and auditing purposes.
-  reference:
-    - https://www.alibabacloud.com/help/en/rds/apsaradb-rds-for-postgresql/use-a-parameter-template-to-configure-the-parameters-of-apsaradb-rds-for-postgresql-instances
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RDS/enable-log-connections-for-postgresql.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-rds
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let DBInstanceId of iterate(template.dbinstanceid)){
-    set("instance", DBInstanceId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun rds DescribeDBInstances --region $region
-
-    extractors:
-      - type: json
-        name: dbinstanceid
-        internal: true
-        json:
-          - '.Items.DBInstance[].DBInstanceId'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun rds DescribeParameters --DBInstanceId $dbinstanceid --region $region | jq -r '.RunningParameters.DBInstanceParameter[] | select(.ParameterName == "log_connections") | {ParameterName, ParameterValue}'
-
-    matchers:
-      - type: word
-        words:
-          - '"ParameterValue": "off"'
-          - '"ParameterName": "log_connections"'
-        condition: and
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'instance + " RDS log_connections Parameter for PostgreSQL Database Instances "'
-# digest: 4a0a00473045022078a4e044bf6cf5e47d63412049b74edf9c64b7f42127e7475656e08cc5e206ef022100a1e5174f0f1daf3fc9e6a8a3c2b496601a3832b61f19bdf35f71aa0922bcd22f:922c64590222798bb761d5b6d8e72950

cloud/alibaba/rds/log-disconnections-disabled.yaml

@@ -1,61 +0,0 @@
-id: log-disconnections-disabled
-
-info:
-  name: PostgreSQL "log_disconnections" Parameter - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The log_disconnections parameter in Alibaba Cloud RDS for PostgreSQL is disabled, meaning the database does not log session disconnections. This can hinder the ability to audit and analyze database connection activities effectively.
-  reference:
-    - https://www.alibabacloud.com/help/en/rds/apsaradb-rds-for-postgresql/use-a-parameter-template-to-configure-the-parameters-of-apsaradb-rds-for-postgresql-instances
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RDS/enable-log-disconnections-for-postgresql.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-rds
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let DBInstanceId of iterate(template.dbinstanceid)){
-    set("instance", DBInstanceId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun rds DescribeDBInstances --region $region
-
-    extractors:
-      - type: json
-        name: dbinstanceid
-        internal: true
-        json:
-          - '.Items.DBInstance[].DBInstanceId'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun rds DescribeParameters --DBInstanceId $dbinstanceid --region $region | jq -r '.RunningParameters.DBInstanceParameter[] | select(.ParameterName == "log_disconnections") | {ParameterName, ParameterValue}'
-
-    matchers:
-      - type: word
-        words:
-          - '"ParameterValue": "off"'
-          - '"ParameterName": "log_disconnections"'
-        condition: and
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'instance + " RDS log_disconnections Parameter for PostgreSQL Database Instances "'
-# digest: 490a0046304402204e59b359a41fbd61fcff314b9f6c690ff24cd3dcfae57b0a9d6231bfb926f572022073e6ada8dae4a9d5c47cd0a64190ab068743738eed07939af2963d0dab4498f7:922c64590222798bb761d5b6d8e72950

cloud/alibaba/rds/log-duration-disabled.yaml

@@ -1,61 +0,0 @@
-id: log-duration-disabled
-
-info:
-  name: PostgreSQL "log_duration" Parameter - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The log_duration parameter in PostgreSQL is disabled, meaning the database does not log the duration of SQL queries. This can make it difficult to monitor and analyze query performance or identify slow-running queries for optimization.
-  reference:
-    - https://www.alibabacloud.com/help/en/rds/apsaradb-rds-for-postgresql/use-a-parameter-template-to-configure-the-parameters-of-apsaradb-rds-for-postgresql-instances
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RDS/enable-log-duration-for-postgresql.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-rds
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let DBInstanceId of iterate(template.dbinstanceid)){
-    set("instance", DBInstanceId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun rds DescribeDBInstances --region $region
-
-    extractors:
-      - type: json
-        name: dbinstanceid
-        internal: true
-        json:
-          - '.Items.DBInstance[].DBInstanceId'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun rds DescribeParameters --DBInstanceId $dbinstanceid --region $region | jq -r '.RunningParameters.DBInstanceParameter[] | select(.ParameterName == "log_duration") | {ParameterName, ParameterValue}'
-
-    matchers:
-      - type: word
-        words:
-          - '"ParameterValue": "off"'
-          - '"ParameterName": "log_duration"'
-        condition: and
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'instance + " RDS log_duration Parameter for PostgreSQL Database Instances "'
-# digest: 4a0a00473045022100b06ccbd5514c7efc8fe339304a4b8eca3059658f4fd88bec14f522d88b368bed022041a7e867fd144c3a2d560fb2699b1792f4b46cb494a94e3f4b5f4181daf5b812:922c64590222798bb761d5b6d8e72950

cloud/alibaba/rds/mssql-audit-disabled.yaml

@@ -1,59 +0,0 @@
-id: mssql-audit-disabled
-
-info:
-  name: Microsoft SQLServer Database Instances - SQL Auditing Disabled
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    SQL auditing is disabled on the MySQL database instances, meaning activities such as user queries and connection events are not logged. This may hinder the ability to track database activity, detect suspicious behavior, and comply with security auditing requirements.
-  reference:
-    - https://www.alibabacloud.com/help/en/rds/apsaradb-rds-for-mysql/use-the-sql-explorer-and-audit-feature-on-an-apsaradb-rds-for-mysql-instance
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RDS/enable-sql-server-audit-logs.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-rds
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let DBInstanceId of iterate(template.dbinstanceid)){
-    set("instance", DBInstanceId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun rds DescribeDBInstances --Engine SQLServer --region $region
-
-    extractors:
-      - type: json
-        name: dbinstanceid
-        internal: true
-        json:
-          - '.Items.DBInstance[].DBInstanceId'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun rds DescribeSQLCollectorPolicy --DBInstanceId $dbinstanceid --region $region
-
-    matchers:
-      - type: word
-        words:
-          - '"SQLCollectorStatus": "Disabled"'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'instance + " Microsoft SQLServer Database Instances SQL Auditing Disabled "'
-# digest: 4b0a00483046022100b12f7027262fdb72ae5cb4dda1491d4326f5236a6583ffc7ed3852b8810adc10022100d5ee7c6f58d43a06e8d8ae7eb554c286a67b07532971aa659d4ed79a8dfd5467:922c64590222798bb761d5b6d8e72950

cloud/alibaba/rds/mysql-audit-disabled.yaml

@@ -1,59 +0,0 @@
-id: mysql-audit-disabled
-
-info:
-  name: MySQL Database Instances - SQL Auditing Disabled
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    SQL auditing is disabled on the MySQL database instances, meaning activities such as user queries and connection events are not logged. This may hinder the ability to track database activity, detect suspicious behavior, and comply with security auditing requirements.
-  reference:
-    - https://www.alibabacloud.com/help/en/rds/apsaradb-rds-for-mysql/use-the-sql-explorer-and-audit-feature-on-an-apsaradb-rds-for-mysql-instance
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RDS/enable-mysql-audit-logs.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-rds
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let DBInstanceId of iterate(template.dbinstanceid)){
-    set("instance", DBInstanceId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun rds DescribeDBInstances --Engine MySQL --region $region
-
-    extractors:
-      - type: json
-        name: dbinstanceid
-        internal: true
-        json:
-          - '.Items.DBInstance[].DBInstanceId'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun rds DescribeSQLCollectorPolicy --DBInstanceId $dbinstanceid --region $region
-
-    matchers:
-      - type: word
-        words:
-          - '"SQLCollectorStatus": "Disabled"'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'instance + " MySQL Database Instances SQL Auditing Disabled "'
-# digest: 490a0046304402205a1185f2c0c30f07ffd9e058302d352539f591ef9f9b70d138ed10ff3214bf11022036b2bfdece214484a0fea82769f3b63f634ee1118a3681191aed816759316068:922c64590222798bb761d5b6d8e72950

cloud/alibaba/rds/postgresql-audit-disabled.yaml

@@ -1,59 +0,0 @@
-id: postgresql-audit-disabled
-
-info:
-  name: PostgreSQL Database Instances - SQL Auditing Disabled
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    SQL auditing is disabled on the PostgreSQL database instances, meaning activities such as user queries and connection events are not logged. This may hinder the ability to track database activity, detect suspicious behavior, and comply with security auditing requirements.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RDS/enable-postgres-audit-logs.html
-    - https://www.alibabacloud.com/help/en/rds/apsaradb-rds-for-postgresql/use-the-sql-explorer-and-audit-feature-on-an-apsaradb-rds-for-postgresql-instance
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-rds
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let DBInstanceId of iterate(template.dbinstanceid)){
-    set("instance", DBInstanceId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun rds DescribeDBInstances --Engine PostgreSQL --region $region
-
-    extractors:
-      - type: json
-        name: dbinstanceid
-        internal: true
-        json:
-          - '.Items.DBInstance[].DBInstanceId'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun rds DescribeSQLCollectorPolicy --DBInstanceId $dbinstanceid --region $region
-
-    matchers:
-      - type: word
-        words:
-          - '"SQLCollectorStatus": "Disabled"'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'instance + " PostgreSQL Database Instances SQL Auditing Disabled "'
-# digest: 4a0a00473045022100ce7c455a2ed9fdab36bc318389f3676c5b38da1642eb7c681c2298b3f2dcc024022057f0fb86ab309677a3c7e9f5ae172202b612be0712c5368c996c4428df8a4c70:922c64590222798bb761d5b6d8e72950

cloud/alibaba/rds/rds-audit-disabled.yaml

@@ -1,59 +0,0 @@
-id: rds-audit-disabled
-
-info:
-  name: RDS Database Instances - SQL Auditing Disabled
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    SQL auditing is disabled on the RDS Database instances, meaning activities such as user queries and connection events are not logged. This may hinder the ability to track database activity, detect suspicious behavior, and comply with security auditing requirements.
-  reference:
-    - https://www.alibabacloud.com/help/en/rds/apsaradb-rds-for-mysql/use-the-sql-explorer-and-audit-feature-on-an-apsaradb-rds-for-mysql-instance
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RDS/enable-audit-logs.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-rds
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let DBInstanceId of iterate(template.dbinstanceid)){
-    set("dbinstanceid", DBInstanceId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun rds DescribeDBInstances --region $region
-
-    extractors:
-      - type: json
-        name: dbinstanceid
-        internal: true
-        json:
-          - '.Items.DBInstance[].DBInstanceId'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun rds DescribeSQLCollectorPolicy --DBInstanceId $dbinstanceid --region $region
-
-    matchers:
-      - type: word
-        words:
-          - '"SQLCollectorStatus": "Disabled"'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'dbinstanceid + " RDS Database Instances SQL Auditing Disabled "'
-# digest: 490a00463044022028cdca0356b150bd29ac95327a5eb276331cde830eff7be2feec1c94f668f18902204652c90b1da9d39f6bc71d842c3e4ceaabbf28b4bf0c39a813baa1f523fa18cb:922c64590222798bb761d5b6d8e72950

cloud/alibaba/rds/transparent-encryption-disabled.yaml

@@ -1,59 +0,0 @@
-id: transparent-encryption-disabled
-
-info:
-  name: Transparent Data Encryption - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Alibaba Cloud Transparent Data Encryption (TDE) is disabled, meaning sensitive data at rest is not encrypted automatically. This may expose the data to unauthorized access, compromising confidentiality and security.
-  reference:
-    - https://www.alibabacloud.com/help/en/rds/apsaradb-rds-for-postgresql/enable-tde-for-an-apsaradb-rds-for-postgresql-instance-and-use-tde
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-RDS/enable-sql-database-tde.html
-  metadata:
-    max-request: 2
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-rds
-
-variables:
-  region: "cn-hangzhou"
-
-flow: |
-  code(1)
-  for(let DBInstanceId of iterate(template.dbinstanceid)){
-    set("dbinstanceid", DBInstanceId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun rds DescribeDBInstances --region $region
-
-    extractors:
-      - type: json
-        name: dbinstanceid
-        internal: true
-        json:
-          - '.Items.DBInstance[].DBInstanceId'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun rds DescribeDBInstanceTDE --DBInstanceId $dbinstanceid --region $region
-
-    matchers:
-      - type: word
-        words:
-          - '"TDEStatus": "Disabled"'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'dbinstanceid + " Transparent Data Encryption is Disabled "'
-# digest: 490a004630440220124e98dd4905cc95b3f61fe3ce77c32f5753feed8760539b76e8d8414dff15de02203f33711fafa6819d58182b4652d88435a1dabb7f4d7a93130ec81ef27116b5fc:922c64590222798bb761d5b6d8e72950

cloud/alibaba/security-center/scheduled-vulnscan-disabled.yaml

@@ -1,39 +0,0 @@
-id: scheduled-vulnscan-disabled
-
-info:
-  name: Scheduled Vulnerability Scan - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The automated vulnerability scanning feature is turned off, preventing regular checks for security weaknesses. This increases the risk of undetected vulnerabilities in the system.
-  reference:
-    - https://www.alibabacloud.com/help/en/security-center/user-guide/scan-for-vulnerabilities
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-SecurityCenter/enable-scheduled-vulnerability-scan.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,security-center
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun sas DescribeVulConfig --region $region
-
-    matchers:
-      - type: word
-        name: policy
-        words:
-          - '"Config": "off"'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"Scheduled Vulnerability Scan is Disabled "'
-# digest: 490a0046304402206c02830649fd1a4625f43a0339e4d3b03efda89840d274c8b94a54928878845d02207b010d79b6248d8df3e457e7550bafc969967a0f87d0b491911c9db87c527e5b:922c64590222798bb761d5b6d8e72950

cloud/alibaba/security-center/security-notification-disabled.yaml

@@ -1,46 +0,0 @@
-id: security-notification-disabled
-
-info:
-  name: Security Center Notifications - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Notifications for Alibaba Security Center are disabled, which may result in missed alerts for critical security events.
-  reference:
-    - https://www.alibabacloud.com/help/en/security-center/user-guide/use-the-notification-feature
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-SecurityCenter/enable-high-risk-item-notifications.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,security-center
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun sas DescribeNoticeConfig --region $region
-
-    matchers:
-      - type: word
-        words:
-          - '"Route": 0'
-          - '"Project":'
-        condition: and
-
-    extractors:
-      - type: json
-        name: noticeconfiglist
-        internal: true
-        json:
-          - '.NoticeConfigList | map(select(.Route == 0) | .Project)'
-
-      - type: dsl
-        dsl:
-          - '"Project: " + noticeconfiglist + " Security Center Notifications are Disabled"'
-# digest: 4b0a00483046022100827955f622c0bbf7651c3c6b3431aff9f25ede363c0cac2721eda13d5726a5a4022100d2a8d1e0a7c64807f03223acd88f50250a91ee5437866f68ed7a6731a291712c:922c64590222798bb761d5b6d8e72950

cloud/alibaba/security-center/security-plan-disabled.yaml

@@ -1,40 +0,0 @@
-id: security-plan-disabled
-
-info:
-  name: Security Center Plan - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Ensure your Alibaba Cloud Security Center is on the Advanced or Enterprise Edition for enhanced security features like malware detection, webshell identification, and anomaly recognition. Upgrading provides critical protection against undetected threats.
-  reference:
-    - https://www.alibabacloud.com/help/en/security-center/product-overview/upgrade-and-downgrade-security-center
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-SecurityCenter/security-center-plan.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,security-center
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun sas DescribeVersionConfig --region $region
-
-    matchers:
-      - type: word
-        words:
-          - '"IsPaidUser": false'
-          - '"Version": 1'
-        condition: and
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '" Security Center Plan is Not Configured to Enterprise or Advance Edition "'
-# digest: 4a0a00473045022100ddf5ad89ed8b0bec452536604f4644db143949178d1a3c98a9e50a1b3b0c0d1c02207ad46afe86a5e613808f1d73c1bb5411e803b114cb49423d6f14d1034de91d25:922c64590222798bb761d5b6d8e72950

cloud/alibaba/vpc/vpc-flow-disabled.yaml

@@ -1,59 +0,0 @@
-id: vpc-flow-disabled
-
-info:
-  name: VPC Flow Log - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    The VPC Flow Log is disabled, meaning network traffic data is not being captured or monitored. This lack of logging reduces visibility into network activities, making it difficult to detect and investigate potential security incidents or performance issues.
-  reference:
-    - https://www.alibabacloud.com/help/en/vpc/user-guide/create-and-manage-flow-log
-    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-VPC/enable-flow-logs.html
-  metadata:
-    max-request: 1
-    verified: true
-  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-vpc
-
-variables:
-  region: "cn-hangzhou"
-
-self-contained: true
-
-flow: |
-  code(1)
-  for(let VpcId of iterate(template.vpcid)){
-    set("vpc", VpcId)
-    code(2)
-  }
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aliyun vpc DescribeVpcs --region $region
-
-    extractors:
-      - type: json
-        name: vpcid
-        internal: true
-        json:
-          - '.Vpcs.Vpc[].VpcId'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aliyun vpc DescribeFlowLogs --RegionId $region --VpcId $vpcid
-
-    matchers:
-      - type: word
-        words:
-          - '"FlowLog": []'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'vpcid + " VPC Flow Log is Disabled "'
-# digest: 490a004630440220721651a199ad66d9248c520014a542df1de8ee0e95aa8b20688be059ffc1b07902204763733958bc565151af0a403d7ca951193862779fdaa488e62726dca8ed2151:922c64590222798bb761d5b6d8e72950

cloud/aws/acm/acm-cert-expired.yaml

@@ -38,4 +38,4 @@ code:
       - type: dsl
         dsl:
           - 'region + " AWS region have expired SSL/TLS certificates"'
-# digest: 4a0a0047304502207c3e71e79a28c959cf8f3595a0f9e9ec0d767a45145e7ad17689021ba4f696ed022100a2e40286c09afd8ef29dac3b6de54a7ecc1fd0475655955f7a25fc6b1c9864d9:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022020875df0814bb41d33d015a50a6a2d23309be5b695bad8ba9840f77e139f719b02205052abd88786969a3d7dcc2594b881841f82308df082a71df3b221085d1e9ceb:922c64590222798bb761d5b6d8e72950

cloud/aws/acm/acm-cert-renewal-30days.yaml

@@ -55,4 +55,4 @@ code:
       - type: dsl
         dsl:
           - '"The AWS ACM Certificate " + certificate +" is about to expire in 30 days"'
-# digest: 490a004630440220243fb2914333499fae730b472688256b5a3efec50ba804e061787fe3e4ca514402204e288a97312494ca3b200361da1cac4bf86c99217569211c89a30c226389e960:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bc7d6e62968fc709c8201354d29b61784664ef5c5ebed70a6a8b305447b93725022100bad54d48aab6fdd1356608d1940730ea10536641398de6172861695612abd412:922c64590222798bb761d5b6d8e72950

cloud/aws/acm/acm-cert-renewal-45days.yaml

@@ -55,4 +55,4 @@ code:
       - type: dsl
         dsl:
           - '"The AWS ACM Certificate " + certificate +" is about to expire in 30 days"'
-# digest: 4b0a00483046022100afa1e5b4ba6aeef0412564db36b6a727b3b10a17c6e90c745eaa7bf211398e18022100c5777c658dfc8695d06f6583b161f77b996454b09af2203bb799d85034fe6e12:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202b2fedb03a19db3f9d0f87fdc3982c926a2478e6e2903d2fbb55b63561d3a29c0220337c43e0512cc540287235d9f3489fb5af0dc783ae118c4341c27e2812a8d8c7:922c64590222798bb761d5b6d8e72950

cloud/aws/acm/acm-cert-validation.yaml

@@ -54,4 +54,4 @@ code:
       - type: dsl
         dsl:
           - '"The issue/renewal request for " + certificatearn + " SSL/TLS certificate was not validated"'
-# digest: 4b0a004830460221009c4c06dcc6415ac0bc7fc6357f399c97951c8c2af78cfd03f46c903b41586eb6022100e250115449f872d9360678566e7f3457e86e96cb1ad4f24007deb8309f810b3d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210092b18eb3a24d6dea12fc385763c84745bf8201424ef620661e9c9fbb1b3b513a02201dc10c6f007cea631d51e81c2b6c883bf6c530a4de13398dea1c605b4a925714:922c64590222798bb761d5b6d8e72950

cloud/aws/acm/acm-wildcard-cert.yaml

@@ -54,4 +54,4 @@ code:
       - type: dsl
         dsl:
           - 'certificatearn + " AWS ACM certificate is a wildcard certificate"'
-# digest: 4b0a00483046022100dbca7d2794c441a99df146a95cbce9fbdab400e333759e871cc37e8a268dd285022100f1d219c3674cb0992bbbbdd52439f972c0673e313ac4923ef82b226077cbc405:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022078c25c2aeb4e1ecb7851bfcf3e176bbd0eff547432a2a5ec04d150b1c3fbfdaf022100b3e428a513082fb7357f95e92309d0dfe47823bc6eb40cc403cc2836756ccd60:922c64590222798bb761d5b6d8e72950

cloud/aws/aws-code-env.yaml

@@ -52,4 +52,4 @@ code:
       - type: dsl
         dsl:
           - '"AWS CLI is properly configured for account \"" + account + "\" and all the necessary tools required are installed"'
-# digest: 4a0a00473045022052484996550fb7281548c8303d5073f5afe21282edd02f6b44327849754db470022100e00b95fbe7c0069c51b67f29380e776144f64464de6aa670a8bcf248722b0e69:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c79a6583acb05a00dfa742962972031f8c42ae9ce85aabc1c9edb1ae7ebd9368022100b98762cb406a952a4115e28bb639f0d16d02e0b737012da638e3bf3f5d73f5f5:922c64590222798bb761d5b6d8e72950

cloud/aws/cloudformation/stack-notification-disabled.yaml

@@ -1,59 +0,0 @@
-id: stack-notification-disabled
-
-info:
-  name: CloudFormation Stack Notification - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Ensure that your Amazon CloudFormation stacks are using SNS topics to send notifications when important events occur.
-  impact: |
-    Disabling CloudFormation Stack Notifications can lead to reduced visibility into stack events and errors, delaying the detection of issues and hindering effective monitoring of changes and deployments in the cloud environment.
-  remediation: |
-    Enable CloudFormation Stack Notifications by configuring SNS (Simple Notification Service) topics for your CloudFormation stack. This will ensure real-time alerts on stack events, including updates, errors, and resource creation, providing better monitoring and visibility.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/CloudFormation/cloudformation-stack-notification.html
-    - http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-stack.html
-  tags: cloud,devops,aws,amazon,cloudformation,aws-cloud-config
-
-variables:
-  region: "us-west-2"
-
-flow: |
-  code(1)
-  for(let StackSummaries of iterate(template.stacksummaries)){
-    set("stacksummary", StackSummaries)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aws cloudformation list-stacks --region $region --stack-status-filter CREATE_COMPLETE --output json --query 'StackSummaries[*].StackName'
-
-    extractors:
-      - type: json
-        name: stacksummaries
-        internal: true
-        json:
-          - '.[]'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-        aws cloudformation describe-stacks --region $region --stack-name $stacksummary --query 'Stacks[*].NotificationARNs[]'
-
-    matchers:
-      - type: word
-        words:
-          - '[]'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"CloudFormation Stack Notification " + stacksummary + " is Disabled"'
-# digest: 4a0a00473045022100bc25a76faa0c7e58a4a92eb2f19a3274305669771d48c016d498e89c11662c5e02203a98e65faea988f9df8e4a27ba1c90ebfe9fb35920fbdaaaa0d8e8231552a475:922c64590222798bb761d5b6d8e72950

cloud/aws/cloudformation/stack-policy-not-inuse.yaml

@@ -1,61 +0,0 @@
-id: stack-policy-not-inuse
-
-info:
-  name: CloudFormation Stack Policy - Not In Use
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Ensure your AWS CloudFormation stacks are using policies as a fail-safe mechanism in order to prevent accidental updates to stack resources.
-  impact: |
-    Lack of a CloudFormation Stack Policy allows unrestricted modifications to stack resources, increasing the risk of unintended or harmful changes.
-  remediation: |
-    Implement a CloudFormation Stack Policy to restrict updates to critical resources, defining explicit rules for which resources can be modified during stack updates.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/CloudFormation/cloudformation-stack-policy.html
-    - http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html
-  tags: cloud,devops,aws,amazon,cloudformation,aws-cloud-config
-
-variables:
-  region: "us-west-2"
-
-flow: |
-  code(1)
-  for(let StackSummaries of iterate(template.stacksummaries)){
-    set("stacksummary", StackSummaries)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aws cloudformation list-stacks --region $region --output json --query 'StackSummaries[*].StackName'
-
-    extractors:
-      - type: json
-        name: stacksummaries
-        internal: true
-        json:
-          - '.[]'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-        aws cloudformation get-stack-policy --region $region --stack-name $stacksummary --output json
-
-    matchers:
-      - type: word
-        words:
-          - 'StackPolicyBody'
-          - 'Effect'
-        negative: true
-
-    extractors:
-      - type: dsl
-        dsl:
-          - 'stacksummary + " No Stack Policy In Use"'
-# digest: 4b0a00483046022100a746affd01686c4b233d818424db502ef0dd44c73af71e06408ad6643c49817b022100ec9758a323f48a9ec00e94eb8669ad58551fd8b2cbb8fc0d1ad835020645cd13:922c64590222798bb761d5b6d8e72950

cloud/aws/cloudformation/stack-termination-disabled.yaml

@@ -1,59 +0,0 @@
-id: stack-termination-disabled
-
-info:
-  name: CloudFormation Termination Protection - Disabled
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Ensure that Termination Protection safety feature is enabled for your Amazon CloudFormation stacks in order to protect them from being accidentally deleted.
-  impact: |
-    Disabled termination protection increases the risk of accidental deletion of critical CloudFormation stacks.
-  remediation: |
-    Enable termination protection for critical CloudFormation stacks by setting TerminationProtection to true in the stack settings, preventing accidental deletions.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/CloudFormation/stack-termination-protection.html
-    - http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-protect-stacks.html
-  tags: cloud,devops,aws,amazon,cloudformation,aws-cloud-config
-
-variables:
-  region: "us-west-2"
-
-flow: |
-  code(1)
-  for(let StackSummaries of iterate(template.stacksummaries)){
-    set("stacksummary", StackSummaries)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      aws cloudformation list-stacks --region $region --stack-status-filter CREATE_COMPLETE --output json --query 'StackSummaries[*].StackName'
-
-    extractors:
-      - type: json
-        name: stacksummaries
-        internal: true
-        json:
-          - '.[]'
-
-  - engine:
-      - sh
-      - bash
-    source: |
-        aws cloudformation describe-stacks --region $region --stack-name $stacksummary --query 'Stacks[*].EnableTerminationProtection' --output json
-
-    matchers:
-      - type: word
-        words:
-          - 'false'
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"CloudFormation Termination Protection " + stacksummary + " is Disabled"'
-# digest: 4b0a004830460221008a2e3415182e202a607c9e30aa6cbac326038dd23f1209a7c133a713cc21b2730221009f32c2fb6c20a62e81094b8fbe1ad127c36237c9c6c813edf579d3c7ddc2983c:922c64590222798bb761d5b6d8e72950

cloud/aws/cloudfront/cloudfront-compress-object.yaml

@@ -1,61 +0,0 @@
-id: cloudfront-compress-object
-
-info:
-  name: CloudFront Compress Objects Automatically
-  author: DhiyaneshDK
-  severity: low
-  description: |
-    Ensure that your Amazon CloudFront Content Delivery Network (CDN) distributions are configured to automatically compress content for web requests that include "Accept-Encoding: gzip" in the request header, in order to increase the websites/web applications performance and reduce bandwidth costs.
-  impact: |
-    Disabling "Compress Objects Automatically" in CloudFront can lead to increased data transfer costs and slower page load times, negatively impacting user experience and performance.
-  remediation: |
-    Enable "Compress Objects Automatically" in CloudFront to reduce data transfer sizes, enhance loading speeds, and improve overall performance for end users.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/CloudFront/compress-objects-automatically.html
-    - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html
-  tags: cloud,devops,aws,amazon,cloudfront,aws-cloud-config
-
-variables:
-  region: "us-west-2"
-
-flow: |
-  code(1)
-  for(let DistributionListItemsId of iterate(template.distributions)){
-    set("distribution", DistributionListItemsId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aws cloudfront list-distributions --output table --query 'DistributionList.Items[*].Id' --region $region --output json
-
-    extractors:
-      - type: json
-        name: distributions
-        internal: true
-        json:
-          - '.[]'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-        aws cloudfront get-distribution-config --id $distribution --query 'DistributionConfig.CacheBehaviors.Items[*].Compress' --region $region --output text
-
-    matchers:
-      - type: word
-        words:
-          - "False"
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"CloudFront Compress Objects Automatically " + distribution + " is Disabled"'
-# digest: 4a0a0047304502210094de0b064b70663a82dba4b63ac8d5b2663b8251696fd3bba81d0a375c0fcbe7022018997148c58889699314b47fb7586b8ca1d4092bc320438bfab6d104904fe6ac:922c64590222798bb761d5b6d8e72950

cloud/aws/cloudfront/cloudfront-custom-certificates.yaml

@@ -1,61 +0,0 @@
-id: cloudfront-custom-certificates
-
-info:
-  name: Cloudfront Custom SSL/TLS Certificates - In Use
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Ensure that your Amazon CloudFront distributions are configured to use a custom SSL/TLS certificate instead of the default one.
-  impact: |
-    Failing to use custom SSL/TLS certificates in CloudFront can result in trust issues with end users, exposing your web content to man-in-the-middle attacks and potentially damaging your brand's reputation due to untrusted connection warnings.
-  remediation: |
-    Configure your Amazon CloudFront distribution to use custom SSL/TLS certificates to ensure secure and trusted connections for your users, enhancing data protection and maintaining brand integrity.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/CloudFront/cloudfront-distro-custom-tls.html
-    - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html
-  tags: cloud,devops,aws,amazon,cloudfront,aws-cloud-config
-
-variables:
-  region: "us-west-2"
-
-flow: |
-  code(1)
-  for(let DistributionListItemsId of iterate(template.distributions)){
-    set("distribution", DistributionListItemsId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aws cloudfront list-distributions --output table --query 'DistributionList.Items[*].Id' --region $region --output json
-
-    extractors:
-      - type: json
-        name: distributions
-        internal: true
-        json:
-          - '.[]'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-        aws cloudfront get-distribution --region $region --id $distribution --query 'Distribution.DistributionConfig.ViewerCertificate.CloudFrontDefaultCertificate' --output text
-
-    matchers:
-      - type: word
-        words:
-          - "False"
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"Cloudfront Custom SSL/TLS Certificates " + distribution + " In Use"'
-# digest: 4b0a00483046022100f4348f4cb85e838f5be2e607133e43a5b3a4c72fdc94fd193eded1206bd6e1eb022100f883292e3ccc805f74f4d647813d0575945275eb447ae0f08901b9c3700fb162:922c64590222798bb761d5b6d8e72950

cloud/aws/cloudfront/cloudfront-geo-restriction.yaml

@@ -1,61 +0,0 @@
-id: cloudfront-geo-restriction
-
-info:
-  name: CloudFront Geo Restriction - Not Enabled
-  author: DhiyaneshDK
-  severity: info
-  description: |
-    Ensure that geographic restriction is enabled for your Amazon CloudFront CDN distributions in order to allow or block viewers from specific locations (countries) from accessing your web content.
-  impact: |
-    Not enabling Geo Restriction in CloudFront exposes content to users from unauthorized regions, increasing the risk of content misuse, compliance violations, and potential security threats.
-  remediation: |
-    Enable Geo Restriction in CloudFront to control access to content based on geographic locations, ensuring only authorized users from designated regions can access specific resources.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/CloudFront/geo-restriction.html
-    - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html
-  tags: cloud,devops,aws,amazon,cloudfront,aws-cloud-config
-
-variables:
-  region: "us-west-2"
-
-flow: |
-  code(1)
-  for(let DistributionListItemsId of iterate(template.distributions)){
-    set("distribution", DistributionListItemsId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aws cloudfront list-distributions --output table --query 'DistributionList.Items[*].Id' --region $region --output json
-
-    extractors:
-      - type: json
-        name: distributions
-        internal: true
-        json:
-          - '.[]'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-        aws cloudfront get-distribution-config --id $distribution --query "DistributionConfig.Restrictions.GeoRestriction.RestrictionType" --region $region --output text
-
-    matchers:
-      - type: word
-        words:
-          - "none"
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"CloudFront Compress Objects Automatically " + distribution + " is Disabled"'
-# digest: 4b0a00483046022100ae8efc4f803814a5fc310174a16c555a56e74965bbe71f368be319f2099aaf75022100f86d42da45940d19950c1cc38c99ea9bbc51db0be308ac041d61c03c32c58782:922c64590222798bb761d5b6d8e72950

cloud/aws/cloudfront/cloudfront-insecure-protocol.yaml

@@ -1,61 +0,0 @@
-id: cloudfront-insecure-protocol
-
-info:
-  name: CloudFront Insecure Origin SSL Protocols
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Ensure that your Amazon CloudFront Content Delivery Network (CDN) distributions are not using insecure SSL protocols (i.e. SSLv3) for HTTPS communication between CloudFront edge locations and custom origins.
-  impact: |
-    Insecure SSL protocols for CloudFront origins can expose sensitive data to interception and compromise, increasing the risk of man-in-the-middle attacks.
-  remediation: |
-    Configure your CloudFront distribution to enforce the use of secure SSL/TLS protocols (TLS 1.2 or higher) for all origins and disable support for outdated protocols like SSLv3 and TLS 1.0/1.1.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/CloudFront/cloudfront-insecure-origin-ssl-protocols.html
-    - http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html
-  tags: cloud,devops,aws,amazon,cloudfront,aws-cloud-config
-
-variables:
-  region: "us-west-2"
-
-flow: |
-  code(1)
-  for(let DistributionListItemsId of iterate(template.distributions)){
-    set("distribution", DistributionListItemsId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aws cloudfront list-distributions --output table --query 'DistributionList.Items[*].Id' --region $region --output json
-
-    extractors:
-      - type: json
-        name: distributions
-        internal: true
-        json:
-          - '.[]'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-        aws cloudfront get-distribution --id $distribution --query 'Distribution.DistributionConfig.Origins.Items[*].CustomOriginConfig.OriginSslProtocols.Items | []' --region $region --output json
-
-    matchers:
-      - type: word
-        words:
-          - "SSLv3"
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"CloudFront Uses SSLv3 Protocol in" + distribution'
-# digest: 490a0046304402203f82a403b2d5299d4e40fe21ec8d29df8dca63b594e26c055fb1aea9e3b183e9022070d55cd893d231f70803f0755dfbf169c2917ea01d600a785c3b5e5e4277a9ae:922c64590222798bb761d5b6d8e72950

cloud/aws/cloudfront/cloudfront-integrated-waf.yaml

@@ -1,67 +0,0 @@
-id: cloudfront-integrated-waf
-
-info:
-  name: CloudFront Integrated With WAF
-  author: DhiyaneshDK
-  severity: medium
-  description: |
-    Ensure that all your Amazon CloudFront distributions are integrated with the Amazon Web Application Firewall (WAF) service to protect against application-layer attacks that can compromise the security of your websites/web applications or place unnecessary load on them
-  impact: |
-    Lack of integration between CloudFront and a Web Application Firewall (WAF) increases vulnerability to web-based attacks, including DDoS, SQL injection, and cross-site scripting (XSS).
-  remediation: |
-    Integrate CloudFront with an appropriate Web Application Firewall (WAF) to filter and monitor HTTP requests, providing enhanced protection against common web threats.
-  reference:
-    - https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/CloudFront/cloudfront-integrated-with-waf.html
-    - http://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html
-  tags: cloud,devops,aws,amazon,cloudfront,aws-cloud-config
-
-variables:
-  region: "us-west-2"
-
-flow: |
-  code(1)
-  for(let DistributionListItemsId of iterate(template.distributions)){
-    set("distribution", DistributionListItemsId)
-    code(2)
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      aws cloudfront list-distributions --output table --query 'DistributionList.Items[*].Id' --region $region --output json
-
-    extractors:
-      - type: json
-        name: distributions
-        internal: true
-        json:
-          - '.[]'
-
-  - engine:
-      - sh
-      - bash
-
-    source: |
-        aws cloudfront get-distribution --id $distribution --query 'Distribution.DistributionConfig.WebACLId' --region $region --output json
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '""'
-
-      - type: word
-        words:
-          - 'arn:'
-        negative: true
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"CloudFront Integrated With WAF " + distribution + " is Disabled"'
-# digest: 4a0a0047304502202d620642cc74990fe24716a6835537c17f0665b4f33110c47f495fa92f709ea1022100d5da002654b1eb9447b384320856fdac406517a81f3fea768bb8c0caacddd897:922c64590222798bb761d5b6d8e72950